last executing test programs: 3.977425904s ago: executing program 0 (id=4419): r0 = socket$nl_rdma(0x10, 0x3, 0x14) r1 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r1, 0x107, 0xa, &(0x7f0000000080)=0x1, 0x4) (async) setsockopt$packet_rx_ring(r1, 0x107, 0x5, &(0x7f0000000040)=@req3={0x1000, 0x3a, 0x1000, 0x3a, 0x2}, 0x1c) (async) r2 = socket$netlink(0x10, 0x3, 0x0) (async) r3 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r3, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r4, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c0002000800010006"], 0x3c}}, 0x0) (async) r5 = socket$nl_route(0x10, 0x3, 0x0) (async) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r6, &(0x7f0000000000)=ANY=[], 0x3261e) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r6, 0x0) (async) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x4000002, 0x3032, 0xffffffffffffffff, 0x2a1cf000) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000580)={0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x60d1}, 0x94) r7 = socket$packet(0x11, 0x2, 0x300) mmap(&(0x7f0000568000/0x2000)=nil, 0x1000000, 0x0, 0x11, r7, 0x0) (async, rerun: 64) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) (async, rerun: 64) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) (async, rerun: 32) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) (rerun: 32) sendmsg$NFT_BATCH(r9, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000440)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r9, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000b00)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000100000a74000000060a010400000000000000000200000048000480440001800c0001007061796c6f616400340002800800044000000000080005400000000008000340000000570800024000000001080006402000000208000840000000000900010073797a30000000000900020073797a32"], 0x9c}}, 0x4) (async) r10 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r10, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000700)=ANY=[@ANYBLOB="60010000100001000000000000000000e0000002000000000000000000000000000000000000000000000000000000004e240000000000000a00000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="ffffffff0000000000000000000000000000000033000000ac1414aa000000000000000000000000000000000000000000000000000000000000000000000000fdffffffffffffff0000000000000000db0000000000000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000002000000000000000000000000000000000000000a0000000000000000000000200017000100000027bd70002abd70002abd700028bd7000000008001d00000000004800010073686132353600000000000000000000000000000000000000000000000000cee046c62b3c1a9400"/280], 0x160}}, 0x0) sendmsg$nl_route(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=ANY=[@ANYRES8=r0, @ANYRES8=r8, @ANYBLOB="46060900000000001c00128009000100766c616e000000000c000280060001000200000008000500", @ANYRES32=r8, @ANYBLOB="5239441ff7c41bc98a6ae6842965e82e3a43e62ec9921ee27e5c3f2284e83c0fa376b0e60c8cd28e914bdbd08017cb64e2e05c9ea046df5d245fa60fe02b9a9b490ab79656183f1223160f676c88ae2ebfde2c02b90dfc98828dfbe008"], 0x44}, 0x1, 0x0, 0x0, 0x20000600}, 0x0) (async) r11 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x48241, 0x0) ioctl$TUNSETIFF(r11, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r12 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r12, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}) 2.733482716s ago: executing program 1 (id=4427): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000480)={0x6, 0xc, &(0x7f0000000540)=@framed={{0x18, 0x2, 0x0, 0x0, 0xa}, [@call={0x85, 0x0, 0x0, 0x41}, @printk={@llx, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x3}}]}, &(0x7f0000001640)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r0, 0x0, 0x2100, 0x0, &(0x7f0000000100), 0x0, 0x1008, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x50) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000540)={0x26, 'hash\x00', 0x0, 0x0, 'hmac(streebog256)\x00'}, 0x58) r2 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_HMAC_IDENT(r2, 0x84, 0x16, &(0x7f0000000000)={0x7, [0x4, 0x8, 0x80, 0xe6, 0x8, 0x1ff, 0x1]}, &(0x7f0000000040)=0x12) 2.67934012s ago: executing program 3 (id=4428): socket$packet(0x11, 0x2, 0x300) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) syz_emit_ethernet(0xfdef, &(0x7f00000003c0)=ANY=[@ANYBLOB="0380c265767c0b492b6bc5270197c0231381c268115908004500001c00000000000190787f00000000004890fcccb7c112f32781c6b79ec58d846c794a1d791f"], 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x15, 0x2000000000000216, &(0x7f0000000440)=ANY=[], 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x1c, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0xfffffffc}, 0x94) r0 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1f, 0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1a, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, 0x0, 0x0) bind$inet6(r1, &(0x7f0000000300)={0xa, 0x4e23, 0x0, @loopback, 0x3}, 0x7e) setsockopt$inet_sctp6_SCTP_RTOINFO(r1, 0x84, 0x0, &(0x7f0000000000)={0x0, 0x1, 0x8001, 0x6}, 0x10) sendto$inet6(r1, &(0x7f0000847fff)='X', 0x34000, 0xe0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt(r3, 0x84, 0x81, 0x0, 0x0) sendmmsg$inet_sctp(0xffffffffffffffff, &(0x7f0000001f00)=[{&(0x7f0000000000)=@in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, 0x0}], 0x1, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000280)=0x8) setsockopt$inet_sctp6_SCTP_AUTH_KEY(r3, 0x84, 0x17, &(0x7f00000001c0)=ANY=[@ANYRES32=r4, @ANYBLOB="5b9c0645ddb804b28c8b4c"], 0x9) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="2800000010000108feffffff0000000000000000", @ANYRES32=0x0, @ANYBLOB="080000002f1c060008001b"], 0x28}}, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000a00)={0x0, @in6={{0xa, 0x4e23, 0x2, @loopback, 0xfffffffd}}, 0x0, 0x0, 0x300, 0x0, 0x54, 0x6}, 0x9c) socket$nl_route(0x10, 0x3, 0x0) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000200)={'batadv_slave_0\x00'}) r7 = socket$inet6_udp(0xa, 0x2, 0x0) r8 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_RES_MR_GET(r8, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000340)=ANY=[@ANYBLOB="200000000414010000000000000000", @ANYRES64=r7], 0x20}, 0x1, 0x0, 0x0, 0x4008055}, 0x814) socket$unix(0x1, 0x1, 0x0) ioctl$XFS_IOC_PATH_TO_HANDLE(r5, 0xc0385869, &(0x7f0000000400)={r0, &(0x7f00000000c0)='%{\x00', 0x408000, &(0x7f0000000240)={@_ha_fsid={[0xa, 0x6]}, {0xe1, 0x9e, 0xd, 0x7fffffff}}, 0xe96d, &(0x7f0000000380)={@_ha_fsid}, &(0x7f00000003c0)=0xf41d}) 2.350865128s ago: executing program 0 (id=4431): r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)=ANY=[@ANYBLOB="4800000040007c0000732c765e4670c28f1e5f8e880400428020b8d2a93521800a1c0002801800118014001c001000030100010600000000000000a1cf9ed978f5dc5fc4ae61f7036f3ccdb8fb42785313cad379caf1ae81c20b770062fdd2715d2f5301270d894e362a98f1c67f8026a5feddf3bfdd6c77a5fedcf64b47f136350581ebc370d7fc46825a09931cb01e8bc78ee6ac000000000000000000006a1f1943d61c545882dff1d9982a4236e413c69caa056e0219f82b42c3a81638350d373c8c8d290cd6b974a59d7892d343a95e01df185ce7baef1ef73d1640925a7dfb3083961e4676d569f2a488e6e495399e1fa05713b2acbc4bd4f08322e3ef29fca68e15db501b5ed74d56e975226dc1349daa68e075a832b9d71e9c53feb1e0b332e1a8556f09c69f11"], 0x48}, 0x1, 0x0, 0x0, 0x48815}, 0xc000) shutdown(r0, 0x1) 2.17871768s ago: executing program 1 (id=4433): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB], 0x7c}, 0x1, 0x0, 0x0, 0x48080}, 0x20004450) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000180)={{0x14, 0x10, 0x1, 0x0, 0x0, {0xa}}, [@NFT_MSG_NEWRULE={0x64, 0x6, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x1}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_EXPRESSIONS={0x38, 0x4, 0x0, 0x1, [{0x34, 0x1, 0x0, 0x1, @hash={{0x9}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_HASH_DREG={0x8, 0x2, 0x1, 0x0, 0xa}, @NFTA_HASH_SREG={0x8, 0x1, 0x1, 0x0, 0x4}, @NFTA_HASH_MODULUS={0x8, 0x4, 0x1, 0x0, 0x4}, @NFTA_HASH_LEN={0x8, 0x3, 0x1, 0x0, 0x6d}]}}}]}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x8c}, 0x1, 0x0, 0x0, 0x20004000}, 0x24000840) 2.159719797s ago: executing program 0 (id=4434): bpf$TOKEN_CREATE(0x24, &(0x7f00000001c0), 0x8) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x3, 0x3, &(0x7f0000000000)=ANY=[@ANYRES64=0x0], &(0x7f0000000180)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x5, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x8}, 0x94) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000040)={&(0x7f0000000000)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x18, 0x18, 0x2, [@func_proto={0x0, 0x0, 0x0, 0x2, 0x2}, @union={0x0, 0x0, 0x0, 0x5, 0x1}]}}, 0x0, 0x32, 0x0, 0xa}, 0x28) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='hugetlb.2MB.usage_in_bytes\x00', 0x275a, 0x0) write$cgroup_subtree(r0, &(0x7f0000000b40)=ANY=[@ANYBLOB="c0f688a8aadbd78cab1be968ff0a5f2e3116104913d03ce1d0d1316d93ffebc52909b957b23e82b5494ad56c9c02314953e68a3e6fc268ff38d66bcf2a8bb970fd2f513fb6e8ca95c652802e0ad13b080d3a386ee6df6d8dd616ccd792bec6de52b936243952d6e88b3ed72925b70ba5abe6968d435a3cd82dbe4770d50a48e8e340c3a6c5e358dd597cc59488685ed7112236d455fdb2fc4ff2d7510cbba0163e1ceda50ad2d87c2817d3831fc2d4f0ad932e4cd87fe5c3ec3514d7dae536249483b828781c9412a868aae371ae15611161af74ff7511056697c98fef12fe933d2a259f74114a14fbd1e658471cc859", @ANYBLOB="2ebbeb256b7718ce8deb9fe304882639036b29d8cba99779cdf78c9f39b8dd2461a75d73514b535de9ff69607e0bc14799d1feb782ebc6d2601ded75172911eb212cd77cc6d8a76b3544686ccfee787a6991fcf36029fef9694c5c5508977a724c2c34ede8684a10c50b650ab010e994639af84e64682745ed537f86c8c3d7c5127f45e5c8e1dab75cdd94d1b8329cd08c8b4375851d3f2fed"], 0x3261e) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000009, 0x12, r0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0xe, &(0x7f0000000740)=ANY=[@ANYBLOB="b7020000b96871dfbfa30000000000000703000000feffff7a0af0fff8ffff1971a4f0ff00000000b7060000080000003c6400000000000045040400010000001704000001000a00b7040000000100006a0af2fe0000004f850000008b000000b7000000000000009500000000000000455781a5feee5e1ce784909b849d5550adf200000000000000b61d69f2ffdaa10350e11cb97c8ad51bcda0c4ee6d9674c77404ceb9971e43405d62de53a9a53608c10556e5734eb84049761451ce2e2d9f8004e26f7fcc059c06220002595f6dba87b81d1106fb026cce67a66afd9ac3d09e29a9d542ca9d85a5c9c88474895d679838def0a83a733dc6a39b63a5ed69d32394c53361d7480884bd6fee53f5b2e7b91c61ced1ebad000000000000e8122a793c080a882add4e1179bd4a44f2fcb6d753a78845d8363e0401861abebe428ba953df4aece69311687f4122070d00000000000000a532efa04137d452ff47d2638da3261c8362bb7c7824be6195a66d2e17e122040e11e3bd4a69fc6e8d9f7043e09b9e10dc7777bfae58e99e30810400000000000000d63d716c0975e1ce4a655362e7062ff6ab3934555c01840219829472ad529cefa06d3482c7b2711b98eabdca89b77efd13e6dba4a431ce47911834118093b6cabaa17a57727474e1785ee234835088445aa4a9b677d3d342640e328504aea02a2d727e62b7f097a02dbf8fe1d704765de7482040b2fc3000000000000000008947baeaaf954aff687deaa2f804924600273ee26d8115cbca081a14cba24788779291745083fccdddc979ddca066da478c197d4a550470557bc99cca336bd88cd28a5ee651627e3a6fbf6ea53b95ddb64c69c7d423e4baddc239828760459564124bad68209d2a1d16ad085886c017679cfcda8b10700ac1e2bcc5ede5b5687aa418abfa09acd7339e73b2cd185c9eb5fb34fccd20ffa155b16c0c309ed6f6663677df37de0ec0d0f548b183940be5d1fe0bae14d1a76bf741330dacd9cc19c0163bcc93059e8d2d1bfa928e2ba458ecd989cb3581a3f270ad48255ac0dad4923e3e357e4e90583ce8d43ec65ed491d87a51d7c13f665dcf772e3ead71112008b16b0ea821f70aee1ccbd71c5a1c21e87d5b7b73d356337d15b9dcae4d0d750ffa07909c955e718585b2456308beda2fa03bb9bcf03cdff31ee4b1665b987829c0f0872c006c6e4ed666fe23b343aae943923eedbdb0e7abee90e3da7b98b7d07d2d4816201ad1737798635b0a3ebd3aed120e4500c16e6c9dc729f009db49c6b8b19613e4d792cb4ff5106419291d0222980b49ddb9527ce785822d8f4e29086146cc91657f4b67892eaf2539404ed807ae46f5dba9622aa9ec567d74b730346989a184f5e730d911eb9b39f1dabe460ddab327566d2f2573e8d46aa2ccb744dbd23797644c642ddc64a042f944e3f7d1962fe24bcd62af510ed9268e6b6bdf1b9a443b17eb0259b73ec0f17fd6982b55ab0"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x27, r0, 0x8, &(0x7f0000000000)={0x0, 0x3}, 0x8, 0x10, &(0x7f0000000340)={0x0, 0x4}, 0x10}, 0x94) 2.099239737s ago: executing program 2 (id=4435): socket$alg(0x26, 0x5, 0x0) r0 = socket$unix(0x1, 0x2, 0x0) bind$unix(r0, &(0x7f0000000080)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) r1 = socket$unix(0x1, 0x2, 0x0) connect$unix(r1, &(0x7f0000000180)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) sendmmsg(r1, &(0x7f0000002dc0), 0x307017fdb7a66cb, 0x0) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x20, 0x0, 0x0, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x50, '\x00', 0x0, @netfilter=0x2d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x99ee}, 0x94) r3 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r3, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r2, 0x84, 0x85, &(0x7f0000000000)={r4, @in={{0x2, 0x0, @empty}}, 0x27c0}, 0x90) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b70800000d0000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="0b00000005000000000400000900000001"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xa, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18000000000000000000000000000000850000006d"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000d80)={0x18, 0x5, &(0x7f0000000480)=ANY=[@ANYBLOB="1801000021"], 0x0, 0x40, 0x0, 0x0, 0x0, 0xb4a02fe0ce239f93, '\x00', 0x0, 0x2}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xe, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000800000000000000000000018110000", @ANYRES32=r5], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x59, '\x00', 0x0, @fallback=0x2a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, r6, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x94) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={r7, 0x2000000, 0xe, 0x0, &(0x7f0000000040)="630b008646dc3f0adf33c9f7b986", 0x0, 0xcf25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x80}, 0x50) socket$nl_netfilter(0x10, 0x3, 0xc) setsockopt$inet_int(0xffffffffffffffff, 0x0, 0xc, 0x0, 0x0) syz_genetlink_get_family_id$nl802154(0x0, 0xffffffffffffffff) r8 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r8, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r9 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r9, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0xffffffff, {0x0, 0x0, 0x0, r10, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xd, 0xf}}, [@qdisc_kind_options=@q_qfg={0x8}]}, 0x2c}}, 0x0) r11 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r11, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) r12 = openat$tun(0xffffffffffffff9c, &(0x7f00000004c0), 0x0, 0x0) close(r12) 2.022436736s ago: executing program 1 (id=4436): socket$nl_netfilter(0x10, 0x3, 0xc) (async) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r0) (async) close(r0) close(0xffffffffffffffff) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYRES32=r0], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a44000000090a014f76f33a00000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc080003400000010614000000110001"], 0x6c}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) (async) sendmsg$NFT_BATCH(r1, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a44000000090a014f76f33a00000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc080003400000010614000000110001"], 0x6c}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)=ANY=[], 0x68}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) (async) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)=ANY=[], 0x68}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x15, 0x4, &(0x7f00000001c0)=ANY=[@ANYBLOB="b4020000000000007911000000000000850000002e0000009500000000000000359bb9f43d86b136000000008762000000f3"], &(0x7f0000000100)='syzkaller\x00', 0x4, 0xc5, &(0x7f0000000300)=""/197, 0x0, 0x0, '\x00', 0x0, @sk_reuseport, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f00000002c0), 0xffffffffffffff35}, 0x54) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x1a, &(0x7f0000000000)={0x2, &(0x7f00000000c0)=[{0x20, 0x0, 0x2, 0xfffff00c}, {0x6}]}, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) (async) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x3, 0x0, 0x0, {0x7}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x44, 0x9, 0xa, 0x401, 0x0, 0x0, {0x7}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz0\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0xd}, @NFTA_SET_USERDATA={0x7, 0xd, 0x1, 0x0, "63efee"}]}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x5, 0x84}}}, 0x8c}, 0x1, 0x0, 0x0, 0x20004010}, 0x20050800) r5 = socket$vsock_stream(0x28, 0x1, 0x0) setsockopt$SO_VM_SOCKETS_CONNECT_TIMEOUT_OLD(r5, 0x28, 0x6, 0x0, 0x22) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000440)={&(0x7f00000004c0)=ANY=[@ANYRESHEX=r6, @ANYRES32=0x0, @ANYRES8=r3, @ANYRES16=r3, @ANYRES64=r2], 0x1c}, 0x1, 0x0, 0x0, 0xc005}, 0x200480d0) sendmmsg(r1, &(0x7f0000000180), 0x0, 0x0) (async) sendmmsg(r1, &(0x7f0000000180), 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000180), 0xffffffffffffffff) (async) r7 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000180), 0xffffffffffffffff) r8 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r8, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @empty}, 0x1c) listen(r8, 0x0) r9 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r9, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) (async) connect$inet(r9, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) close(r9) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) (async) r10 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x10010, r10, 0x0) sendmsg$ETHTOOL_MSG_FEATURES_SET(r10, 0x0, 0x20000004) accept4(r8, &(0x7f0000000240)=@in={0x2, 0x0, @loopback}, 0x0, 0x800) sendmsg$ETHTOOL_MSG_DEBUG_SET(0xffffffffffffffff, 0x0, 0x20000814) sendmsg$L2TP_CMD_TUNNEL_CREATE(r6, &(0x7f0000000280)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x24, r7, 0x20, 0x70bd2c, 0x25dfdbfd, {}, [@L2TP_ATTR_PW_TYPE={0x6, 0x1, 0x8}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0xed31}]}, 0x24}, 0x1, 0x0, 0x0, 0x40}, 0x20040004) (async) sendmsg$L2TP_CMD_TUNNEL_CREATE(r6, &(0x7f0000000280)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x24, r7, 0x20, 0x70bd2c, 0x25dfdbfd, {}, [@L2TP_ATTR_PW_TYPE={0x6, 0x1, 0x8}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0xed31}]}, 0x24}, 0x1, 0x0, 0x0, 0x40}, 0x20040004) 1.982236371s ago: executing program 0 (id=4437): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000040), r2) (async) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeef, 0x8031, 0xffffffffffffffff, 0x215eb000) (async) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000400)={&(0x7f0000000180)="8e9ee2cd8fdb6491db3bec5d75c9e9ac451577e78f567fc82402b350e38a1904dcdb4555a4ba03b95cdc888b4bc0d5d5600e9b60ded8456db387fb18401f7f2f2b8354e82ea27f958cbf23a23471f72c87ef922937c63be931cc010783d585e58439b427d6f083b94ad2a51189c05cc6a08d189a533d754ee70ce7241e639e36b9bc8a97cdb8", &(0x7f0000000240)=""/99, &(0x7f00000002c0)="faec99996e", &(0x7f0000000300)="867e2e70977eb72f7291b908009e9a16e2ee4c2b8b77861f9b2dddced21d15e5156765ba362ef5599242fe03d7873d0517497f827b5ce3100457a9c7a4eb4fd8ddfa21742f1cbb4d87f2a783b6b1d247430e756f2c6a606f6d02a7334f33f2cdd2903308520d3bb541bbf2436916c47401419fceca274c600b2a27bd47ac4f830f70d0f8ffbbe45b33f81b07a9fd7caa03292479fec72fee61094f652748ef56a8fee4763955d0bd5a2f47214f7f555f8edce8e062c41c32c5af8771f64fd4d55782", 0x6, 0x1}, 0x38) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000080)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1c}}) (async) write$tun(r0, &(0x7f00000004c0)=ANY=[@ANYBLOB="000086dd0500560008005400000060ec970001983a00fc000018c6ba35000000000000000700ff020000000000000000000000000001000000000000000000000000000000000000000000000000860090780000000000000000000000000000ee3f000000002b036f8c006e75021d683910c3090b3188a7c747eb2278a273c1b80029442911892704"], 0xfdef) (async) r3 = socket$nl_generic(0x10, 0x3, 0x10) (async) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)={0x34, 0x40, 0x1, 0x7fffc, 0x4, {0x1}, [@nested={0x4, 0xcb}, @nested={0x10, 0x1, 0x0, 0x1, [@nested={0xc, 0x10, 0x0, 0x1, [@typed={0x8, 0x1, 0x0, 0x0, @u32=0x5}]}]}, @typed={0xc, 0x2, 0x0, 0x0, @u64}]}, 0x34}, 0x1, 0x0, 0x0, 0x400c801}, 0x4008094) r5 = socket$nl_generic(0x10, 0x3, 0x10) (async) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = socket$nl_generic(0x10, 0x3, 0x10) (async) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r7, 0x8933, &(0x7f0000000040)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_COALESCE(r6, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000b00)={&(0x7f0000000000)={0x30, r8, 0x1, 0x70bd2b, 0x0, {{0x2}, {@val={0x8, 0x3, r9}, @val={0xc, 0x99, {0x9, 0x44}}}}, [@NL80211_ATTR_COALESCE_RULE_CONDITION={0x8, 0x2, 0x2f}]}, 0x30}, 0x1, 0x0, 0x0, 0x2400c891}, 0x0) (async) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000080)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_START_SCHED_SCAN(r5, &(0x7f0000000740)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000700)={&(0x7f00000001c0)={0x31c, r8, 0x800, 0x70bd2a, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r10}, @void}}, [@NL80211_ATTR_BG_SCAN_PERIOD={0x6, 0x98, 0x4}, @NL80211_ATTR_SCHED_SCAN_MATCH={0x22c, 0x84, 0x0, 0x1, [{0xd0, 0x0, 0x0, 0x1, [@NL80211_SCHED_SCAN_MATCH_PER_BAND_RSSI={0x54, 0x6, 0x0, 0x1, [@NL80211_BAND_6GHZ={0x8, 0x3, 0x1}, @NL80211_BAND_60GHZ={0x8, 0x2, 0xf5}, @NL80211_BAND_6GHZ={0x8}, @NL80211_BAND_6GHZ={0x8, 0x3, 0x7}, @NL80211_BAND_6GHZ={0x8, 0x3, 0x3}, @NL80211_BAND_5GHZ={0x8, 0x1, 0x7}, @NL80211_BAND_LC={0x8, 0x5, 0x8}, @NL80211_BAND_5GHZ={0x8, 0x1, 0x8000}, @NL80211_BAND_6GHZ={0x8, 0x3, 0x9}, @NL80211_BAND_6GHZ={0x8, 0x3, 0xc5a}]}, @NL80211_SCHED_SCAN_MATCH_ATTR_RSSI={0x8, 0x2, 0x8}, @NL80211_SCHED_SCAN_MATCH_ATTR_BSSID={0xa}, @NL80211_SCHED_SCAN_MATCH_PER_BAND_RSSI={0x2c, 0x6, 0x0, 0x1, [@NL80211_BAND_6GHZ={0x8, 0x3, 0x8}, @NL80211_BAND_6GHZ={0x8, 0x3, 0x5}, @NL80211_BAND_LC={0x8, 0x5, 0x9}, @NL80211_BAND_6GHZ={0x8, 0x3, 0xd}, @NL80211_BAND_LC={0x8, 0x5, 0x9}]}, @NL80211_SCHED_SCAN_MATCH_ATTR_SSID={0xa, 0x1, @default_ibss_ssid}, @NL80211_SCHED_SCAN_MATCH_PER_BAND_RSSI={0x2c, 0x6, 0x0, 0x1, [@NL80211_BAND_5GHZ={0x8, 0x1, 0x4}, @NL80211_BAND_LC={0x8, 0x5, 0x7}, @NL80211_BAND_2GHZ={0x8, 0x0, 0x7fff}, @NL80211_BAND_2GHZ={0x8, 0x0, 0x6}, @NL80211_BAND_LC={0x8, 0x5, 0x3}]}]}, {0x4c, 0x0, 0x0, 0x1, [@NL80211_SCHED_SCAN_MATCH_ATTR_SSID={0xa, 0x1, @default_ap_ssid}, @NL80211_SCHED_SCAN_MATCH_ATTR_RSSI={0x8, 0x2, 0x10001}, @NL80211_SCHED_SCAN_MATCH_ATTR_BSSID={0xa, 0x5, @random="8df81b92b200"}, @NL80211_SCHED_SCAN_MATCH_PER_BAND_RSSI={0xc, 0x6, 0x0, 0x1, [@NL80211_BAND_6GHZ={0x8, 0x3, 0x3}]}, @NL80211_SCHED_SCAN_MATCH_PER_BAND_RSSI={0x1c, 0x6, 0x0, 0x1, [@NL80211_BAND_60GHZ={0x8, 0x2, 0x51b4334d}, @NL80211_BAND_5GHZ={0x8, 0x1, 0x3926}, @NL80211_BAND_5GHZ={0x8, 0x1, 0x6c}]}]}, {0x64, 0x0, 0x0, 0x1, [@NL80211_SCHED_SCAN_MATCH_ATTR_BSSID={0xa}, @NL80211_SCHED_SCAN_MATCH_ATTR_SSID={0x9, 0x1, @random="870a764a77"}, @NL80211_SCHED_SCAN_MATCH_ATTR_SSID={0x21, 0x1, @random="2c0898fa478caf5f02b2b3df4ca7d53039aa473b00e6aaa00a2e913234"}, @NL80211_SCHED_SCAN_MATCH_ATTR_SSID={0xa, 0x1, @default_ibss_ssid}, @NL80211_SCHED_SCAN_MATCH_ATTR_BSSID={0xa}, @NL80211_SCHED_SCAN_MATCH_ATTR_BSSID={0xa}]}, {0x74, 0x0, 0x0, 0x1, [@NL80211_SCHED_SCAN_MATCH_PER_BAND_RSSI={0x34, 0x6, 0x0, 0x1, [@NL80211_BAND_6GHZ={0x8, 0x3, 0x99f2}, @NL80211_BAND_5GHZ={0x8, 0x1, 0xc00}, @NL80211_BAND_60GHZ={0x8, 0x2, 0x5}, @NL80211_BAND_5GHZ={0x8, 0x1, 0xc}, @NL80211_BAND_6GHZ={0x8, 0x3, 0x1}, @NL80211_BAND_5GHZ={0x8, 0x1, 0xe}]}, @NL80211_SCHED_SCAN_MATCH_PER_BAND_RSSI={0x3c, 0x6, 0x0, 0x1, [@NL80211_BAND_2GHZ={0x8, 0x0, 0x9}, @NL80211_BAND_6GHZ={0x8, 0x3, 0x4}, @NL80211_BAND_5GHZ={0x8, 0x1, 0x43c}, @NL80211_BAND_2GHZ={0x8, 0x0, 0x143}, @NL80211_BAND_6GHZ={0x8, 0x3, 0x2}, @NL80211_BAND_LC={0x8, 0x5, 0x7}, @NL80211_BAND_LC={0x8, 0x5, 0x7}]}]}, {0x34, 0x0, 0x0, 0x1, [@NL80211_SCHED_SCAN_MATCH_PER_BAND_RSSI={0x14, 0x6, 0x0, 0x1, [@NL80211_BAND_60GHZ={0x8, 0x2, 0x400}, @NL80211_BAND_6GHZ={0x8, 0x3, 0x8}]}, @NL80211_SCHED_SCAN_MATCH_ATTR_RSSI={0x8, 0x2, 0x8}, @NL80211_SCHED_SCAN_MATCH_ATTR_SSID={0x13, 0x1, @random="b260e201ea4a5c2a7c551601c5468c"}]}]}, @NL80211_ATTR_SCAN_SUPP_RATES={0xcc, 0x7d, 0x0, 0x1, [@NL80211_BAND_60GHZ={0x4}, @NL80211_BAND_5GHZ={0x4}, @NL80211_BAND_60GHZ={0x81, 0x2, "d6284efe5213e5fc5f3d7e1053692c99c1407dd1c65f95c8116480de650d1f05d640ef5c874f13870bf9ee41fbc0585dfca79ace040f23f0733ce95ed0403265cddd048b3fffd3c1eee26948ac9596c602bd88631356ae9cf8deb476620527a6164580aa1c05a5475c309260920d59ad99b76da6623753276b9f64eb1d"}, @NL80211_BAND_5GHZ={0x39, 0x1, "d3c7564774801fa158b94e1c07587be7e7ef89623ef667b8501f8b013e1009d1edcc44d860dd986974c63dc93009262ec3d2d74cfd"}]}]}, 0x31c}}, 0x20000000) (async) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000100)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r3, &(0x7f0000000580)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000480)={&(0x7f0000000440)={0x2c, r8, 0x10, 0x70bd29, 0x25dfdbff, {{}, {@val={0x8, 0x3, r11}, @void}}, [@NL80211_ATTR_CRIT_PROT_ID={0x6, 0xb3, 0x1ef8bd51bb7d56dc}, @NL80211_ATTR_MAX_CRIT_PROT_DURATION={0x6, 0xb4, 0x861}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4004080}, 0x4000) 1.646698676s ago: executing program 1 (id=4438): socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) (async) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0e000000040000000800000005"], 0x48) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f00000001c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bc82000000000000a6020000f8ffffffb703000008000000b703000000000000850000003300000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={r2, 0x18000000000002a0, 0xe, 0x0, &(0x7f0000000580)="b9ff03076804268c989e14f088a8", 0x0, 0x0, 0x60000000, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) (async, rerun: 32) sendmsg$tipc(r0, &(0x7f0000003a00)={&(0x7f0000000080)=@nameseq={0x1e, 0x1, 0x2, {0x1, 0x0, 0x9}}, 0x10, &(0x7f0000000b40)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000001a00)}], 0x4, 0x0, 0x0, 0x20000001}, 0x0) (rerun: 32) 1.386450569s ago: executing program 4 (id=4439): r0 = socket$netlink(0x10, 0x3, 0x8000000004) sendmsg$NFT_BATCH(r0, &(0x7f0000000dc0)={0x0, 0x0, &(0x7f0000000d80)={&(0x7f0000000740)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x7}}, [], {0x14, 0x11, 0x1, 0x0, 0x0, {0x5}}}, 0x28}, 0x1, 0x0, 0x0, 0x4810}, 0x10d4) (async) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='blkio.bfq.io_service_time_recursive\x00', 0x275a, 0x0) write$cgroup_int(r1, &(0x7f0000000000), 0xffffff6a) (async, rerun: 64) r2 = openat$6lowpan_enable(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) (rerun: 64) sendfile(r2, r1, 0x0, 0x5) (async) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x15, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x1c, '\x00', 0x0, @fallback=0x28, r1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = socket$nl_route(0x10, 0x3, 0x0) (async) r5 = socket(0x80000000000000a, 0x2, 0x0) setsockopt$inet6_group_source_req(r5, 0x29, 0x2e, &(0x7f0000000340)={0x1, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x0, 0x0, @rand_addr=' \x01\x00', 0x4}}}, 0x108) (async) r6 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r6, 0x107, 0xf, &(0x7f0000000100)=0x207, 0x4) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000040)={'erspan0\x00', 0x0}) sendto$packet(r6, &(0x7f00000002c0)="05031c00d1fd140000004788031c09102c28", 0xfdef, 0x4, &(0x7f0000000140)={0x11, 0x0, r7, 0x1, 0x0, 0x6, @multicast}, 0x14) (async) ioctl$BTRFS_IOC_QUOTA_RESCAN_WAIT(r5, 0x942e, 0x0) (async) r8 = accept4$llc(0xffffffffffffffff, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @multicast}, &(0x7f0000000040)=0x10, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(r3, 0xc020f509, &(0x7f0000000080)={r8, 0xc8, 0x2a, 0x7}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f0000000280)=ANY=[@ANYBLOB="1801000021000000000000003b"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) (async) r9 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r9, &(0x7f0000000100)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r9, 0x0) nanosleep(&(0x7f0000000180), 0x0) (async) sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x0) (async) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000340)) sendmsg$nl_route(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="5400000010000104000000000200000000000000", @ANYRES32, @ANYBLOB="1000faffffff000034001280110001006272696467655f736c610200000000001c000580050021000000aaa21f76967f561911000006001f"], 0x54}}, 0x0) 1.375107738s ago: executing program 3 (id=4440): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f0000000840)={&(0x7f0000000400)=ANY=[@ANYBLOB="ac010000170001030000000000000000ffffffff0000000000000000000000000000000000000000fe8000000000000000000000000000bb00000000000000000000ffff7f000001ff01000000000000000000000000000100"/104, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="7f000001000000000000000000000000fc02000000000000000000000000000000000000000000000a00000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000120000000000000000000000000000000000ff80000000000000000000000000000000000000000000000000000000000000008400050020010000000000000000000000000001000000002b0000000200000000000000000000000000ffffe0000001000000000100"], 0x1ac}}, 0x0) 1.275293248s ago: executing program 1 (id=4441): r0 = bpf$PROG_LOAD_XDP(0x5, &(0x7f00000000c0)={0x18, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="180000000800000000000000820000008500"/32], &(0x7f0000000080)='GPL\x00', 0x9, 0x0, 0x0, 0x40f00, 0x64, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x7}, 0x94) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=@newtfilter={0x24, 0x2c, 0x200, 0x70bd25, 0x6, {0x0, 0x0, 0x0, 0x0, {0x0, 0x4}, {0x6, 0xb}, {0x8, 0x4}}}, 0x24}, 0x1, 0x0, 0x0, 0x20000}, 0x8010) mmap(&(0x7f0000200000/0x4000)=nil, 0x4000, 0x4, 0x200000006c832, 0xffffffffffffffff, 0x0) r2 = socket(0x40000000015, 0x5, 0x0) connect$inet(r2, &(0x7f0000000040)={0x2, 0x4e20, @loopback}, 0x10) bind$inet(r2, &(0x7f0000000340)={0x2, 0x4e20, @loopback}, 0x57) recvmmsg(r2, &(0x7f0000001740)=[{{0x0, 0x0, &(0x7f0000001400)=[{&(0x7f0000000400)=""/4096, 0x10c4}], 0x1}}], 0x4000210, 0x2, 0x0) setsockopt$SO_TIMESTAMP(r2, 0x1, 0x40, &(0x7f00000000c0)=0xfd, 0x4) sendmsg$NFT_BATCH(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[], 0xc4}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0xbcff, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000300)={'xfrm0\x00', 0x0}) r4 = socket$key(0xf, 0x3, 0x2) sendmsg$key(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={0x0}}, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[], 0x38}}, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f00000001c0)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000280)=ANY=[@ANYBLOB="020100090e000000030000000000000405000600000000000a0000000000000400000000000000000000002100000000000100000000000002000100010000000000010200fd000005000500000000000a"], 0x70}}, 0x0) sendmmsg(r4, &(0x7f0000000180), 0x3ef, 0x0) ioctl$F2FS_IOC_RELEASE_COMPRESS_BLOCKS(r2, 0x8008f512, &(0x7f0000000140)) setsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1b, &(0x7f0000000000)={@remote, r3}, 0x14) r5 = socket$packet(0x11, 0x2, 0x300) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), 0xffffffffffffffff) r6 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000480)="5c00000012006bab9a3fe3d86e17aa0b046b876c1d0048380019001931a0e69ee517d34460bc06000000a701251e6182949a3651f60a84c9f4d4938037e70e4509c51c2688110000000000000000000025", 0x51}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) recvmsg$kcm(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)}, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f0000000340)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_JOIN_MESH(r1, &(0x7f0000000080)={0x0, 0xfffffffffffffdfc, &(0x7f0000000240)={&(0x7f0000000100)=ANY=[@ANYBLOB="f07e0400", @ANYRES16=r0, @ANYRES64=r1, @ANYRES32=r7, @ANYBLOB="0c00240003028b9802308b0b14002380060003005f00000006000c0003000000"], 0x3c}, 0x1, 0x0, 0x0, 0x1881}, 0x4c040) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r8, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000840)={&(0x7f0000000c40)=ANY=[@ANYBLOB="580000001000010400000000000000000000ffff", @ANYRES32=0x0, @ANYBLOB="00000000da44000024001a8020000a8014000700fe8000000000000000020040000000000500080002000000140003007866726d30"], 0x58}}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0e0000"], 0x48) 1.214392501s ago: executing program 3 (id=4442): socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0f000000040000000400000012"], 0x48) r3 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0xe, 0x4, &(0x7f0000000400)=ANY=[@ANYBLOB="18020000801000000000000004000000850000000700000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00}, 0x80) bpf$BPF_PROG_DETACH(0x8, &(0x7f00000015c0)=ANY=[@ANYRES32=r2, @ANYRES32=r3, @ANYBLOB="05"], 0x10) openat$tun(0xffffffffffffff9c, 0x0, 0x140, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000ec0)={0x18, 0x25, 0x319, 0x70bd26, 0x8000, {0x5}, [@nested={0x4, 0x13b}]}, 0x18}, 0x1, 0x0, 0x0, 0x4000000}, 0x24044004) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000740)={{r2}, &(0x7f00000006c0), &(0x7f0000000700)=r1}, 0x20) sendmsg$inet(r0, &(0x7f0000000980)={0x0, 0x6000, &(0x7f0000000900)=[{&(0x7f0000000640)='U', 0xa00120}], 0x1}, 0x3) 1.101703663s ago: executing program 4 (id=4443): r0 = socket$nl_route(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x3, 0x4, &(0x7f00000008c0)=ANY=[@ANYBLOB="b7050000000000006110480000000000dc0500002000000095000000000000009abb1723bf24203831c9545b21c751ee4024f479cbe4b89f9808837203000000000000c2d182c7a3221481f5009edaf5f5ac058299e10e790a198f42a715b99fb3d2a73dd025848710155ad1efd7d991408000000000000085a0db0401fa29e075b7ab0408a0d8cfceeb23465bb027ee1151c02af21d8f9aa57e673a6724441d08087aff070eda8abef22b3a806c8226f5a2886c93bd29b37252ba4a6e9cc5f69e75680c431aa855e487ae513abd6c4ee973fce29a26018ed5e0780f8778a602a3533a3dac7da4fe491edf3abfa7bf871c58848ac46ada6776bd9b85df01e626026a59ddfa7a9c879acbfb0bf426785dec7d8611dc850df49ed8633bdb83dd505fb20649f53841a0e200c91f5bf1bb186ed87efc7b6f8859d029c8376ca19265e281fea0a6fd2222f8850c8445758503ede0ce1b3f73ecd8989e8c53c5e679b13802bddf80f3b1d07d6d68bfa12ab34697d40ac1150a842f8bb381344b994c19642a10eb30845a993daaa8bd4aebc595475feb3475d8e802498382e73edb98fcf2df96ab3c870490c4"], &(0x7f00000002c0)='syzkaller\x00', 0x5, 0xfd90, &(0x7f0000000300)=""/195, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x1f3, 0x10, &(0x7f0000000080), 0xfffffffffffffc79}, 0x48) unshare(0x20020600) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0xe, 0x6, &(0x7f0000000000)=ANY=[@ANYBLOB="050000000000000071114200000000008510000002000000850000000500000095000d00000000009500a50000000000"], &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x6}, 0x70) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000100)={r1, 0xe0, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0}}, 0x10) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="340000001400010000000000000000000a00a100", @ANYRES32=r3, @ANYBLOB="14000100fff1ffffffffffffe0000000000000be4901080008000204"], 0x34}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000002680)={0xd, 0xc, &(0x7f0000000500)=ANY=[@ANYBLOB="18000000000000000000000000000000850000003100000018010000696c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000006b00000095"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0x1, '\x00', 0x0, @sock_ops=0x3, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_DEBUG_SET(r4, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x100b004}, 0xc, &(0x7f00000001c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="14000000", @ANYRES16=r5, @ANYBLOB="00033d17bd7000fedbdf25beb2150895565ddccd0e76bf6b74448192d706bbaacd1a26c70808ff5a1d4fbebee5f8507d264dfa9bce09ff5caf9d10ff2c70933ec4cd0c2cf9526dc68642246cea5f21cca4d3b752c814fcdfa4ce237b2cfc92d005b5e23a886aa39f296ede75543f4f0d37ad912387ba7ef08299a5e5efdfd3cdcd28b41d6414976f3d3af43333edd7282ff0bc64ce13adcac3595a0aeba5fd"], 0x14}, 0x1, 0x0, 0x0, 0x40080d1}, 0x4004001) socket$nl_route(0x10, 0x3, 0x0) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x3, 0x4, &(0x7f00000008c0)=ANY=[@ANYBLOB="b7050000000000006110480000000000dc0500002000000095000000000000009abb1723bf24203831c9545b21c751ee4024f479cbe4b89f9808837203000000000000c2d182c7a3221481f5009edaf5f5ac058299e10e790a198f42a715b99fb3d2a73dd025848710155ad1efd7d991408000000000000085a0db0401fa29e075b7ab0408a0d8cfceeb23465bb027ee1151c02af21d8f9aa57e673a6724441d08087aff070eda8abef22b3a806c8226f5a2886c93bd29b37252ba4a6e9cc5f69e75680c431aa855e487ae513abd6c4ee973fce29a26018ed5e0780f8778a602a3533a3dac7da4fe491edf3abfa7bf871c58848ac46ada6776bd9b85df01e626026a59ddfa7a9c879acbfb0bf426785dec7d8611dc850df49ed8633bdb83dd505fb20649f53841a0e200c91f5bf1bb186ed87efc7b6f8859d029c8376ca19265e281fea0a6fd2222f8850c8445758503ede0ce1b3f73ecd8989e8c53c5e679b13802bddf80f3b1d07d6d68bfa12ab34697d40ac1150a842f8bb381344b994c19642a10eb30845a993daaa8bd4aebc595475feb3475d8e802498382e73edb98fcf2df96ab3c870490c4"], &(0x7f00000002c0)='syzkaller\x00', 0x5, 0xfd90, &(0x7f0000000300)=""/195, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x1f3, 0x10, &(0x7f0000000080), 0xfffffffffffffc79}, 0x48) (async) unshare(0x20020600) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0xe, 0x6, &(0x7f0000000000)=ANY=[@ANYBLOB="050000000000000071114200000000008510000002000000850000000500000095000d00000000009500a50000000000"], &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x6}, 0x70) (async) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000100)={r1, 0xe0, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0}}, 0x10) (async) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)) (async) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'lo\x00'}) (async) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="340000001400010000000000000000000a00a100", @ANYRES32=r3, @ANYBLOB="14000100fff1ffffffffffffe0000000000000be4901080008000204"], 0x34}}, 0x0) (async) bpf$PROG_LOAD(0x5, &(0x7f0000002680)={0xd, 0xc, &(0x7f0000000500)=ANY=[@ANYBLOB="18000000000000000000000000000000850000003100000018010000696c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000006b00000095"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0x1, '\x00', 0x0, @sock_ops=0x3, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$ethtool(&(0x7f0000000100), 0xffffffffffffffff) (async) sendmsg$ETHTOOL_MSG_DEBUG_SET(r4, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x100b004}, 0xc, &(0x7f00000001c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="14000000", @ANYRES16=r5, @ANYBLOB="00033d17bd7000fedbdf25beb2150895565ddccd0e76bf6b74448192d706bbaacd1a26c70808ff5a1d4fbebee5f8507d264dfa9bce09ff5caf9d10ff2c70933ec4cd0c2cf9526dc68642246cea5f21cca4d3b752c814fcdfa4ce237b2cfc92d005b5e23a886aa39f296ede75543f4f0d37ad912387ba7ef08299a5e5efdfd3cdcd28b41d6414976f3d3af43333edd7282ff0bc64ce13adcac3595a0aeba5fd"], 0x14}, 0x1, 0x0, 0x0, 0x40080d1}, 0x4004001) (async) 1.047426643s ago: executing program 2 (id=4444): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$BTRFS_IOC_QUOTA_RESCAN_WAIT(r1, 0x942e, 0x0) r2 = socket(0x10, 0x3, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000000500), r2) getsockname$packet(r2, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="480000001000050700000086d7c0d6c878f064eb", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000900)=@newqdisc={0x30, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_clsact={0xb}]}, 0x30}}, 0x4000804) sendmsg$nl_route_sched(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000003c0)=@delchain={0x3c, 0x64, 0xf31, 0xfffffffb, 0x0, {0x0, 0x0, 0x0, r3, {0xffe0, 0xfff1}, {0xfff2, 0xffff}, {0xa, 0x1b}}, [@filter_kind_options=@f_flower={{0xb}, {0xc, 0x2, [@TCA_FLOWER_KEY_FLAGS_MASK={0x8, 0x30, 0x800}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x10}, 0x4000) 802.877598ms ago: executing program 2 (id=4445): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="0a000000050000000200000004"], 0x48) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000dc0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) close(0x3) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=@base={0xb, 0x8, 0xc, 0x80000000, 0x1}, 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0), &(0x7f0000000140), 0x5, r3}, 0x38) bpf$PROG_LOAD(0x5, &(0x7f0000001c40)={0x0, 0x10, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b702000001000000850000008600000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x54, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0x10, &(0x7f0000000180)=ANY=[], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) setsockopt$sock_attach_bpf(r4, 0x1, 0x32, &(0x7f00000000c0)=r6, 0x4) sendmsg$unix(r5, &(0x7f00000006c0)={0x0, 0x0, 0x0}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000680)={{0x14}, [@NFT_MSG_NEWRULE={0x70, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x44, 0x4, 0x0, 0x1, [{0x40, 0x1, 0x0, 0x1, @match={{0xa}, @val={0x30, 0x2, 0x0, 0x1, [@NFTA_MATCH_REV={0x8, 0x2, 0x1, 0x0, 0x1}, @NFTA_MATCH_INFO={0x18, 0x3, "c6a41d106c720000000100000000000002000000"}, @NFTA_MATCH_NAME={0xa, 0x1, 'owner\x00'}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x98}}, 0x4048010) bpf$PROG_LOAD(0x5, &(0x7f0000000800)={0x4, 0x4, &(0x7f0000000040)=@framed={{0x18, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x1f}, [@generic={0x91, 0x1, 0x1, 0x87}]}, &(0x7f00000003c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x32, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe}, 0x94) 753.598252ms ago: executing program 4 (id=4446): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31"], 0x7c}, 0x1, 0x0, 0x0, 0x48080}, 0x20004450) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000180)={{0x14, 0x10, 0x1, 0x0, 0x0, {0xa}}, [@NFT_MSG_NEWRULE={0x64, 0x6, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x1}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_EXPRESSIONS={0x38, 0x4, 0x0, 0x1, [{0x34, 0x1, 0x0, 0x1, @hash={{0x9}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_HASH_DREG={0x8, 0x2, 0x1, 0x0, 0xa}, @NFTA_HASH_SREG={0x8, 0x1, 0x1, 0x0, 0x4}, @NFTA_HASH_MODULUS={0x8, 0x4, 0x1, 0x0, 0x4}, @NFTA_HASH_LEN={0x8, 0x3, 0x1, 0x0, 0x6d}]}}}]}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x8c}, 0x1, 0x0, 0x0, 0x20004000}, 0x24000840) 602.918613ms ago: executing program 3 (id=4447): r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_buf(r0, 0x6, 0x1f, &(0x7f0000001300)="d7b5", 0x2) getsockopt$IPT_SO_GET_REVISION_TARGET(r0, 0x0, 0x43, 0x0, &(0x7f0000000040)) r1 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0xc, &(0x7f0000000040)={0x4001}, 0xfea3) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="2c0000001600156f000000000000000002000000", @ANYRES32=0x0, @ANYBLOB="140006"], 0x2c}}, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000010400)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-serpent-avx2\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, 0x0, 0x0) r3 = accept4(r2, 0x0, 0x0, 0x80800) sendmmsg$alg(r3, &(0x7f0000000040)=[{0x0, 0x0, 0x0}], 0x1, 0x40800) recvmsg(r3, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000340)=[{&(0x7f0000000640)=""/88, 0x58}], 0x1}, 0x0) setsockopt$inet_int(r3, 0x0, 0x21, &(0x7f00000000c0)=0x7, 0x4) 602.541247ms ago: executing program 0 (id=4448): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x3261e) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x9, 0x13, r0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_udp_int(r1, 0x11, 0x64, 0x0, &(0x7f00000000c0)) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) close(0x3) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) close(r2) r4 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r4, 0x84, 0x64, &(0x7f00000005c0)=[@in6={0xa, 0x4e23, 0x0, @remote, 0x3}], 0x1c) sendmmsg$inet6(r4, &(0x7f0000001d80)=[{{&(0x7f00000003c0)={0xa, 0x4e20, 0x9, @local, 0x9}, 0x1c, &(0x7f0000001c00)=[{&(0x7f0000001740)='p', 0x1}], 0x1}}], 0x1, 0x5dc) setsockopt(r3, 0x84, 0x80, &(0x7f0000000000)="1400000009000000", 0x8) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x0, 0x0, @rand_addr=' \x01\x00', 0x6}, 0x1c) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000000000)=[@in6={0xa, 0x4e23, 0x401, @ipv4={'\x00', '\xff\xff', @broadcast}}], 0x1c) socket(0x28, 0x5, 0x0) r5 = openat$ppp(0xffffffffffffff9c, &(0x7f00000000c0), 0x101900, 0x0) ioctl$PPPIOCNEWUNIT(r5, 0xc004743e, &(0x7f0000000080)) socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$PPPIOCSMAXCID(r5, 0x40047451, &(0x7f0000002540)=0x1) close(0x4) 600.007751ms ago: executing program 2 (id=4449): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x19, 0x4, 0x4, 0x2}, 0x50) (async) bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x6, 0x4, &(0x7f0000000200)=@framed={{}, [@call={0x85, 0x0, 0x0, 0x63}]}, &(0x7f00000004c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x16, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$BTRFS_IOC_QGROUP_CREATE(r0, 0x4010942a, &(0x7f0000000080)={0x1, 0x4}) 458.381556ms ago: executing program 4 (id=4450): ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE(0xffffffffffffffff, 0x4048587b, &(0x7f0000000700)={{0xffffffffffffffff, &(0x7f0000000000)='\x00', 0x220001, &(0x7f0000000040)={@align=0x4, {0x7, 0x10, 0x7fffffff, 0xc}}, 0x2, &(0x7f0000000080), &(0x7f00000000c0)=0xb8}, 0x5, &(0x7f0000000640)=[{0x2, 0x800, &(0x7f0000000100)='!{\x00', &(0x7f0000000140)="abfc71e953b1bec0b056e01d090446bfc5d9a8067cb807283d558a226f105436653cff4081f8cb2fa403f6a0777c85d9ec391acbb675d6dfc09edf807cc166425f0718e988e19832183a21882a96df8350fd9241a6749f56858ad04c773f9b57adf100622e1bd9f492120644527ce773c13fbdb44f84a17df3c122327859a4cb73b8dfb6755ef9e0598e3a4e84872e5b3a4aff1101858f867445e4d3dec5780a1a30bccbf18365fcf7cc0845782d9b1c8704f8b93bfd8abd92", 0xb9, 0x26}, {0x1, 0x8, &(0x7f0000000200)='(\\,\x00', &(0x7f0000000240)="2a02a5a4b0f839ac06611e9f44f47b6068c4b63a5f9b2b1faf4c56a300a41787c76955bcc30cfa275bfcc3f341639104ac3dbf3490b8baa2ac4f4d7181b21a56a4d1617bbf864a67f898f72b20783905ce3112a305a216e9e4c8855466341b83779346fb", 0x64}, {0x2, 0xf, &(0x7f00000002c0)='\x00', &(0x7f0000000300)="42ec8cad5c407effa635c38ee8ee6a907598a7d47bcf369074941a4c322b7c38ac880c7e733aaa5426d96aa075bda6fadb0be0ac176313110ccd7bb4e675ecbbe46c0f35150f98c8527c04505a4fb638695b445e9703b170d695a5f49a500f292880452e091dd6a732940109620a7253cd4f0bbcb572b417c9e079f19310059819780e264793ea80f7b786a54115d5efb55a38f30c56ec17b913e0df568bb4bb48ee7135ee8e06", 0xa7, 0x18}, {0x3, 0x82e, &(0x7f00000003c0)='#\x00', &(0x7f0000000400)="f058937b214174d49b57dc12c7e49831a3a7dd4a4723f0f337086de49cff1929276b4a36a57440ef6df9c6f5314bc98fb6bfea3bd92b3fe624f89a53e097c2d2559b43fb0fbf2e2ee43e5fe9dba3b3d5e05e1b012f558653cd922ead2f6a1d9f238c83f773e5feb7895c8761e274acc98e773f6a4e571d7ae21cfa979334f6d79721ed43d4b0ec4df7764db84cc3fd569717ae41b00374052ee63ad30635fb9cebd2365a37fba7e11d3336a8bc1b29e37449e31269ba38d853864a7d33938a045b4057f0a8d8eb13", 0xc8}, {0x7d099778906d4ff1, 0x9, &(0x7f0000000500)='-)%-#{%&\x00', &(0x7f0000000540)="05ba63b9548afd668bf2b18d3f7f911fdd8c0cbfd0c37f45defe6fa01db35f47faf42e3d09547a4e0e7330de5046968effd352427ae5fde9871af6ddad1eddd5ab208b450b8e2a20d4a9b3243326915d6a79dc0d62ebe0f0b2064f7ab55e60dbbe1ece188e855ea1c4db6ca373efa1964660252dd09cb349ac2b242e0eed347ad216371bb8a370adeacde89bff8d04f95e919113cba69f6ada940d28184ba59442929c8d88fe4b2bf947e526a6f4fa384faab3d896ade8e6c702ed1c51cb489edccf17ba08c6cfcb15f31348b06e544527a756aff337394324d94e112c44593f73371bbf5468fd7553a0fa67", 0xec}]}) getsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(r0, 0x84, 0x72, &(0x7f0000000780)={0x0, 0xac, 0x10}, &(0x7f00000007c0)=0xc) getsockopt$inet_sctp_SCTP_GET_LOCAL_ADDRS(r0, 0x84, 0x6d, &(0x7f0000000800)={r1, 0xf, "b3f9bf4f3233c4808ffcbd91679454"}, &(0x7f0000000840)=0x17) ioctl$ifreq_SIOCGIFINDEX_wireguard(r0, 0x8933, &(0x7f00000008c0)={'wg2\x00', 0x0}) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000900)={0x0, 0x0}, &(0x7f0000000940)=0xc) sendmsg$nl_xfrm(r0, &(0x7f0000000a40)={&(0x7f0000000880)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000a00)={&(0x7f0000000980)=@getpolicy={0x74, 0x15, 0x2, 0x70bd29, 0x25dfdbfd, {{@in=@loopback, @in=@broadcast, 0x4e23, 0x7, 0x4e23, 0x3, 0xa, 0x20, 0x80, 0x2b, r3, r4}, 0x6e6bb5, 0x1}, [@lifetime_val={0x24, 0x9, {0xfffffffffffffff7, 0x9972, 0x400, 0x81}}]}, 0x74}, 0x1, 0x0, 0x0, 0x80}, 0xc0) sendmsg$nl_xfrm(r0, &(0x7f0000000b40)={&(0x7f0000000a80)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000b00)={&(0x7f0000000ac0)=@newspdinfo={0x1c, 0x24, 0x10, 0x70bd2b, 0x25dfdbff, 0x7, [@XFRMA_SPD_IPV4_HTHRESH={0x6}]}, 0x1c}}, 0x0) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000000d80)={0xf, 0x0}, 0x8) r6 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000e00)=@generic={&(0x7f0000000dc0)='./file0\x00'}, 0x18) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000ec0)={0x8, 0x16, &(0x7f0000000b80)=@framed={{0x18, 0x0, 0x0, 0x0, 0x800, 0x0, 0x0, 0x0, 0x27}, [@generic={0x2, 0x0, 0x8, 0x0, 0x10}, @cb_func={0x18, 0x9, 0x4, 0x0, 0x4}, @jmp={0x5, 0x0, 0x1, 0x8, 0x8, 0xffffffffffffffe0, 0x1}, @tail_call={{0x18, 0x2, 0x1, 0x0, r0}}, @ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}, @ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}, @exit, @generic={0x0, 0x8, 0x0, 0x9, 0x1}]}, &(0x7f0000000c40)='GPL\x00', 0x3ff, 0x48, &(0x7f0000000c80)=""/72, 0x40f00, 0x68, '\x00', r3, @fallback=0x28, r0, 0x8, &(0x7f0000000d00)={0x7, 0x3}, 0x8, 0x10, &(0x7f0000000d40)={0x2, 0xb, 0x1, 0x4}, 0x10, r5, 0xffffffffffffffff, 0x4, &(0x7f0000000e40)=[r6], &(0x7f0000000e80)=[{0x3, 0x1, 0x8, 0x1}, {0x1, 0x1, 0xe, 0x1}, {0x1, 0x1, 0xa, 0x5}, {0x4, 0x4, 0x7}], 0x10, 0x5}, 0x94) r8 = openat$tun(0xffffffffffffff9c, &(0x7f0000000f80), 0x101800, 0x0) accept4$x25(r0, 0x0, &(0x7f0000000fc0), 0x80000) ioctl$IOCTL_GET_NCIDEV_IDX(r0, 0x0, &(0x7f0000001000)=0x0) connect$nfc_raw(r0, &(0x7f0000001040)={0x27, r9, 0x0, 0x5}, 0x10) recvfrom$l2tp(r0, &(0x7f0000001080)=""/54, 0x36, 0x10020, 0x0, 0x0) close(r7) sendmsg$TIPC_CMD_SHOW_PORTS(r0, &(0x7f0000001180)={&(0x7f00000010c0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000001140)={&(0x7f0000001100)={0x1c, 0x0, 0x400, 0x70bd26, 0x25dfdbfd, {}, ["", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x40090) setsockopt$inet_sctp6_SCTP_RESET_ASSOC(r0, 0x84, 0x78, &(0x7f00000011c0)=r1, 0x4) r10 = bpf$PROG_LOAD(0x5, &(0x7f0000001500)={0x1e, 0x1c, &(0x7f0000001200)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x1}, {{0x18, 0x1, 0x1, 0x0, r6}}, {}, [@cb_func={0x18, 0x1, 0x4, 0x0, 0xfffffffffffffffe}, @jmp={0x5, 0x1, 0x1, 0xb, 0x4, 0x0, 0x8}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffffa}, @printk={@llx, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x10000}}, @generic={0x1, 0x1, 0x4, 0x6, 0x8}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000001300)='GPL\x00', 0x1, 0xc1, &(0x7f0000001340)=""/193, 0x41100, 0x0, '\x00', r3, @fallback=0x14, r0, 0x8, &(0x7f0000001440)={0xa, 0x4}, 0x8, 0x10, 0x0, 0x0, r5, r7, 0x3, &(0x7f0000001480)=[r0], &(0x7f00000014c0)=[{0x0, 0x5, 0x2, 0x10}, {0x0, 0x5, 0xc, 0x9}, {0x1, 0x4, 0x6, 0x2}], 0x10, 0x5}, 0x94) bpf$BPF_LINK_CREATE(0x1c, &(0x7f00000015c0)={r10, r0, 0x35, 0x0, @val=@netkit={@void, @value=r8}}, 0x1c) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x23, &(0x7f0000001740)={&(0x7f0000ffb000/0x5000)=nil, 0x5000, 0x0, 0x0, 0x0, &(0x7f0000001600)=""/126, 0x7e, 0x0, &(0x7f0000001680)=""/170, 0xaa}, &(0x7f0000001780)=0x40) openat$cgroup_type(r0, &(0x7f00000017c0), 0x2, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(r0, 0x84, 0x77, &(0x7f0000001800)={r2, 0x6, 0x6, [0xfff1, 0x7, 0x1, 0x1, 0x1, 0x8]}, &(0x7f0000001840)=0x14) r11 = syz_genetlink_get_family_id$nl80211(&(0x7f00000018c0), r0) sendmsg$NL80211_CMD_DEL_STATION(r0, &(0x7f0000001980)={&(0x7f0000001880)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000001940)={&(0x7f0000001900)={0x38, r11, 0x2, 0x70bd28, 0x25dfdbfe, {{}, {@void, @val={0xc, 0x99, {0x1, 0x66}}}}, [@NL80211_ATTR_REASON_CODE={0x6, 0x36, 0xe9c0}, @NL80211_ATTR_STA_SUPPORT_P2P_PS={0x5}, @NL80211_ATTR_STA_SUPPORT_P2P_PS={0x5}]}, 0x38}, 0x1, 0x0, 0x0, 0x8081}, 0x4010) r12 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000001a40)={&(0x7f00000019c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x3, [@volatile={0xb, 0x0, 0x0, 0x9, 0x4}]}, {0x0, [0x61]}}, &(0x7f0000001a00), 0x27, 0x0, 0x1, 0x1, 0x10000, @value=r0}, 0x28) ioctl$FICLONERANGE(r12, 0x4020940d, &(0x7f0000001a80)={{r0}, 0x1, 0xc8b3}) socket$nl_generic(0x10, 0x3, 0x10) r13 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_STRSET_GET(r13, &(0x7f0000001bc0)={&(0x7f0000001ac0)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000001b80)={&(0x7f0000001b40)={0x1c, 0x0, 0x400, 0x70bd27, 0x25dfdbfd, {}, [@ETHTOOL_A_STRSET_COUNTS_ONLY={0x4}, @ETHTOOL_A_STRSET_COUNTS_ONLY={0x4}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000010}, 0x8000) 404.211053ms ago: executing program 0 (id=4451): r0 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000000)=0x1, 0x4) setsockopt$sock_timeval(r0, 0x1, 0x15, &(0x7f0000000040), 0x10) setsockopt$sock_int(r0, 0x1, 0x12, &(0x7f0000000080)=0x9b31, 0x4) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$TIPC_CMD_SET_LINK_WINDOW(r1, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x68, r2, 0x8, 0x70bd26, 0x25dfdbfc, {{}, {}, {0x4c, 0x18, {0x6, @media='udp\x00'}}}, ["", "", ""]}, 0x68}, 0x1, 0x0, 0x0, 0x4}, 0x0) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), r1) sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r1, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x24, r3, 0x400, 0x70bd2d, 0x25dfdbfd, {{}, {@void, @void}}, [@NL80211_ATTR_MAX_CRIT_PROT_DURATION={0x6, 0xb4, 0x18}, @NL80211_ATTR_CRIT_PROT_ID={0x6, 0xb3, 0x3}]}, 0x24}, 0x1, 0x0, 0x0, 0x20048001}, 0x20044000) r4 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_DELLINK(r4, &(0x7f0000000440)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x30, 0x1404, 0x1, 0x70bd28, 0x25dfdbfd, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0x8}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x2}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}]}, 0x30}, 0x1, 0x0, 0x0, 0x800}, 0x0) r5 = socket$pptp(0x18, 0x1, 0x2) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_DELETE(r6, &(0x7f0000000680)={&(0x7f0000000480)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000640)={&(0x7f00000004c0)={0x178, 0x2, 0x1, 0x5, 0x0, 0x0, {0x0, 0x0, 0x8}, [@CTA_FILTER={0x24, 0x19, 0x0, 0x1, [@CTA_FILTER_REPLY_FLAGS={0x8, 0x2, 0x6}, @CTA_FILTER_REPLY_FLAGS={0x8, 0x2, 0x98}, @CTA_FILTER_REPLY_FLAGS={0x8, 0x2, 0x8}, @CTA_FILTER_REPLY_FLAGS={0x8, 0x2, 0x418}]}, @CTA_ZONE={0x6, 0x12, 0x1, 0x0, 0x2}, @CTA_TIMEOUT={0x8, 0x7, 0x1, 0x0, 0x5}, @CTA_TUPLE_MASTER={0x9c, 0xe, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @initdev={0xac, 0x1e, 0x0, 0x0}}, {0x8, 0x2, @rand_addr=0x64010101}}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @private2}, {0x14, 0x4, @mcast2}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x84}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x11}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x21}}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @dev={0xac, 0x14, 0x14, 0x3f}}, {0x8, 0x2, @multicast1}}}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @initdev={0xac, 0x1e, 0x1, 0x0}}, {0x8, 0x2, @empty}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x3a}}]}, @CTA_MARK={0x8, 0x8, 0x1, 0x0, 0x80000000}, @CTA_PROTOINFO={0x18, 0x4, 0x0, 0x1, @CTA_PROTOINFO_DCCP={0x14, 0x2, 0x0, 0x1, [@CTA_PROTOINFO_DCCP_ROLE={0x5, 0x2, 0x6}, @CTA_PROTOINFO_DCCP_STATE={0x5, 0x1, 0xf1}]}}, @CTA_TUPLE_REPLY={0x74, 0x2, 0x0, 0x1, [@CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x3}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x88}}, @CTA_TUPLE_ZONE={0x6}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x1}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x4}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x84}}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @private=0xa010102}, {0x8, 0x2, @empty}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x1}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x21}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x21}}]}]}, 0x178}, 0x1, 0x0, 0x0, 0x4000001}, 0x20000040) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$smc(&(0x7f0000000700), r1) sendmsg$SMC_PNETID_FLUSH(r7, &(0x7f0000000800)={&(0x7f00000006c0)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f00000007c0)={&(0x7f0000000740)={0x50, r8, 0x400, 0x70bd28, 0x25dfdbff, {}, [@SMC_PNETID_NAME={0x9, 0x1, 'syz0\x00'}, @SMC_PNETID_IBPORT={0x5, 0x4, 0x2}, @SMC_PNETID_IBNAME={0x9, 0x3, 'syz1\x00'}, @SMC_PNETID_IBPORT={0x5, 0x4, 0x2}, @SMC_PNETID_IBNAME={0x9, 0x3, 'syz1\x00'}, @SMC_PNETID_IBPORT={0x5, 0x4, 0x2}]}, 0x50}, 0x1, 0x0, 0x0, 0xc084}, 0x800) r9 = syz_genetlink_get_family_id$devlink(&(0x7f0000000880), r1) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f00000008c0)={0x0}, &(0x7f0000000900)=0xc) r11 = syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000940)='ns/ipc\x00') sendmsg$DEVLINK_CMD_RELOAD(r7, &(0x7f0000000ac0)={&(0x7f0000000840)={0x10, 0x0, 0x0, 0x8140404d}, 0xc, &(0x7f0000000a80)={&(0x7f0000000980)={0x100, r9, 0x8, 0x70bd2c, 0x25dfdbfe, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, @DEVLINK_ATTR_NETNS_PID={0x8, 0x8b, r10}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, @DEVLINK_ATTR_NETNS_FD={0x8, 0x8a, r11}}, {@pci={{0x8}, {0x11}}, @DEVLINK_ATTR_NETNS_ID={0x8}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, @DEVLINK_ATTR_NETNS_ID={0x8, 0x8c, 0x1}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, @DEVLINK_ATTR_NETNS_ID={0x8}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, @DEVLINK_ATTR_NETNS_ID={0x8}}]}, 0x100}, 0x1, 0x0, 0x0, 0x80}, 0x40) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000b40)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_DEL_PMKSA(r1, &(0x7f0000000c00)={&(0x7f0000000b00)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000bc0)={&(0x7f0000000b80)={0x38, r3, 0x1, 0x70bd2a, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r12}, @void}}, [@NL80211_ATTR_PMK={0x14, 0xfe, "952ee37e69a36722d560f9a4f94c97df"}, @NL80211_ATTR_PMK_LIFETIME={0x8, 0x11f, 0x6}]}, 0x38}, 0x1, 0x0, 0x0, 0x4000}, 0x800) r13 = accept4$tipc(0xffffffffffffffff, 0x0, &(0x7f0000000c40), 0x800) getsockopt$TIPC_GROUP_JOIN(r13, 0x10f, 0x87, &(0x7f0000000c80), &(0x7f0000000cc0)=0x4) getsockopt$ARPT_SO_GET_ENTRIES(r0, 0x0, 0x61, &(0x7f0000000d00)={'filter\x00', 0x9c, "d53cbe51c2d821bbfb9278aed32a6e2e0009923dbe1203e9e1ac3a0881e12734f5a27da556629b68cc829b3d0f946e2d470405c5fb1e1bcc12dcb9ac137bcd1e20e034b80bb0fcdcbe5b0a77a8c1d026053064e93808a74d5def714dbb0c9cdeb38094a1ea9f4eac472b816bddcc66b046f21308149d3311cd20faf851fdfb299835afe10bba595b8b4fd7fbbd4bbe2dbf54a90e605093a6a71095a3"}, &(0x7f0000000dc0)=0xc0) sendmsg$IPCTNL_MSG_CT_NEW(r6, &(0x7f0000000f00)={&(0x7f0000000e00)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000ec0)={&(0x7f0000000e40)={0x58, 0x0, 0x1, 0x101, 0x0, 0x0, {0x5, 0x0, 0x3}, [@CTA_MARK_MASK={0x8, 0x15, 0x1, 0x0, 0x1}, @CTA_NAT_SRC={0x3c, 0x6, 0x0, 0x1, [@CTA_NAT_PROTO={0x24, 0x3, 0x0, 0x1, [@CTA_PROTONAT_PORT_MIN={0x6, 0x1, 0x4e24}, @CTA_PROTONAT_PORT_MIN={0x6, 0x1, 0x4e22}, @CTA_PROTONAT_PORT_MAX={0x6, 0x2, 0x4e20}, @CTA_PROTONAT_PORT_MIN={0x6, 0x1, 0x4e20}]}, @CTA_NAT_V6_MAXIP={0x14, 0x5, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}]}]}, 0x58}, 0x1, 0x0, 0x0, 0x4000004}, 0x40000) getsockopt$IPT_SO_GET_ENTRIES(r0, 0x0, 0x41, &(0x7f0000000f40)={'mangle\x00', 0x76, "2ea0c58b51b76b8e8b2b70b68d2237579164793dbb5305e4603b1bb79c6d464461a53eeac221652292157e1f07639a60b83d79abc6861065441074a1d48604c75a7f33d2e28b1256606cdac961766be5372748b50a2b7a97b332e9e164ad4a88c8934cfe8ab194fe29234fd96d78d449340f97374f2f"}, &(0x7f0000001000)=0x9a) socket$l2tp(0x2, 0x2, 0x73) getsockopt$inet_sctp6_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001600)={0x0, 0x8, 0xe, 0x6}, &(0x7f0000001640)=0x10) 355.37782ms ago: executing program 2 (id=4452): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f0000000840)={&(0x7f0000000400)=ANY=[@ANYBLOB="ac010000170001030000000000000000ffffffff0000000000000000000000000000000000000000fe8000000000000000000000000000bb00000000000000000000ffff7f000001ff01000000000000000000000000000100"/104, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="7f000001000000000000000000000000fc02000000000000000000000000000000000000000000000a00000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000012000000000000000000000000000000000080ff000000000000000000000000000000000000000000000000000000000000008400050020010000000000000000000000000001000000002b0000000200000000000000000000000000ffffe0000001000000000100"], 0x1ac}}, 0x0) 296.43263ms ago: executing program 3 (id=4453): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$BATADV_CMD_GET_TRANSTABLE_LOCAL(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x2c, 0x0, 0x8, 0x70bd29, 0x25dfdbfc, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x5}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) r1 = socket$kcm(0x29, 0x2, 0x0) sendmsg$kcm(r1, &(0x7f00000009c0)={0x0, 0x0, &(0x7f0000000580)=[{&(0x7f0000000100)="a6d7840d99d1744a7dde548abfb2dc6b0f50e1ef8680182796ca313135869312ae8fbccf401d9b3114587b89e3f753aed5df5411c5d7c3a8169a608b279520210526007a8a27f52a7dc4ec556ad3e7304d6ae329e3c3ade28f2ab8933868de3e65db763568a7a069349b4360321532d915a3b38e9acb4a37b6e798e3b7b61327ac1d24798f465d173516b17c76416f9a173c1b3a67ac910321acf49153ea2e548e229fa204407b22aae01cbbd9608ccd98130c92071333f8ff6fee2ee3dbd70e9434827dc6c3608b476ff45206c1dcf50fe56bd6ed402fa0c970141595a0706d77cd9d6a481d277997dfe16ab38d86ee485f68162e001dcf17c5e3", 0xfb}, {&(0x7f0000000200)="2e95fdf1c8211138f4c87b13f737600310e65a84d9c658c9fd968484434658f8ec20c739ac9239cc420c707263efa54bdf7f7fc7eef1f9276220151f17e56f6cca1f6e9ce56c124a", 0x48}, {&(0x7f0000000280)="e0e68a31d48520c428579002a9aac94a70aa1466e3a590d05190e322ca1cb6263f5069a6b608941670080299a3c893f2361d5f0c979963af016f6d55a8957a15713119bf1e1198ff575245dcc0b6b49f905efa797fd5bf6ed9e22923b203da71339a33d9aeff56f16f83012596743b172cf49699806fcbfbf452aac6eb24e3b7739718f4654a2398c5a6aa1f8de5fffbe860a26d6bb0ef5edfcf944fabd8c9851d4b5158fe38f3b331a8c0cd669d00ad98e275d53fac1cf8a391d188a7258573d7646f80e328", 0xc6}, {&(0x7f0000000380)="618126c9bd5201b9ea8f3620ae6a580a4ee5eab27cccab8d558257a6d9275dfd1255e45e2e3490de0ec0a5fece5a1384cb1123a13004a9a65e14075ddea92254669c651891567a710cf07202cf2bf749", 0x50}, {&(0x7f0000000400)="77f328a89ffa69c6434fb5e1b14017643bf2b280587085ef39c8b624d240482035d5dcec6ec0015660466e42031235441851ac1576fd58aedf3f16bfffd2dc6dd1ea33798be6c8cd61b023295203c5ecd19492042ac7d39bb8ec643167a5eba8c6ff", 0x62}, {&(0x7f0000000480)="8d26abcb59856eaf83ed751123dbca4f574ecf078cf741bc3f35f07ca51b16ac64d6e3dc06c82b79193640e0aefa757aae9f3c8652c61553d3ad01498847e0c954bbd6620c4530053698e5bca024f56105474a57f1bcc3e6ce2845", 0x5b}, {&(0x7f0000000500)="c1f50cf0", 0x4}, {&(0x7f0000000540)="be4fc4e03b261952463cc0a2ea23c81350f4fa675a", 0x15}], 0x8, &(0x7f0000000600)=[{0xd0, 0x29, 0x6, "7b9bf912417148ca8dd9895c35f3dc9beb7578d55ae10d6a71a86cf382e92aafd00f8eb95f0e78acebe55362b36417ef8e437ae4a7476224e44716d1cfb9487e13c4396f8355eafc03532f6d217fb50b2870247f587e178cfb002e2d33ff033f168fd485189b35a323a04dac73f18074ba3526900887bbd254946d89a44c02d53a6a3e8f715af2dff4ba9abe452e0986de1cd9950a8c384cfc68166ce09f8b4f93021bf6a63144ab74a6de55b89b75a20ea23de843ba202e10"}, {0x110, 0x0, 0x8, "437585a074d55fed3b452d073a83affc840a9f57978c7af9ac957a8a826a90edb52a8650ed2197795c0102749e1f5830e7fee2d8648812fbe95bbbc7829dbb35c00f0c845df6e61f01fb49e5ba4b4c23a037c7e41f2efc596d84c5572cfd6d9c4192ace2c65401de8da2ec4235fdb5f940362bb905016e3cfa3bdac11502e328d812dcd74133a4ed149f29cccd4924e8dba087fe905b185b8d4bcba10971c4d63d11aff88998ec7331fd5ef74c7406f14c794044d49e8d6790fb29d332b4d29a6182bb071443d984a6525b71d515828a73644d46609ff511fa05b4710d991361f2e6b6a1af495517f6abf75f8b216f6fede1daabd0923d743f"}, {0xf8, 0x113, 0x1bc31672, "49403aa10fabdb83fdc0431e5cfb01fc0bb895ca9cb7bd70240ea7e569a7eedb4a01398cbb46c2a0806a5a469dfc52f77a5663c92eedb755981195f9575212274e813b22d01a564abc7f4957ed4db1b2bd810e4079ebf0e432df415bbd46257647b05e41893dfa25b22396976ed7d24552f2a3603c061538dc13937d6879a8ec92040e8ccfbc7c5c5634b0d7f0488bf5f31a02b6e3486842372a4ce8528c6ae575908127678c7fea9a301e1e1a6a3105dff61a280dc75c02c0505af1ed2fb9f2ef1bf4131862752fb641a9e5dfeb5c59ab53609bd984994ff20ec84e4a4ab4cf623379"}, {0xc0, 0x101, 0x401, "78834af6af36751bf6f48889167dce70dfe9e731865080fdcb64979538a913df626ded8d3d76491619126e1a35fe50b69bba51e79f507ad397052f9be031661005472aa1c4db4e49de96279b9ff112a3304d33f2d96b3c8ff53edccbb62768009b758a5f7f58696e508e3204e9cbc2ad9fee02af167bfc9aed683c7e99f24ac11f23dc2be9c4f3cde7dbddaae7848f6e4ca254f417fe5b5e4620dbf56be1f08ba3d6eebfd50f6c77b21d65413435e62f"}], 0x398}, 0x40040) r2 = socket$unix(0x1, 0x5, 0x0) r3 = accept$unix(r2, &(0x7f0000000a00)=@abs, &(0x7f0000000a80)=0x6e) (async) r4 = accept4$inet(0xffffffffffffffff, &(0x7f0000000ac0)={0x2, 0x0, @empty}, &(0x7f0000000b00)=0x10, 0x1c00) setsockopt$inet_opts(r4, 0x0, 0x4, &(0x7f0000000b40)="96c7dfa5630f5daefe1bc3315e54fba5696987dc8a23aa80a9edfcab7c0c426dc8cdea1c5bd770e51004b80552972de7539d4ceded6309bf48fe128ccca18d76bb60969e46c895c00659ace98e3489ece63d8f7bbb27fcf222004ffdbeb9cb7701466f844f176f540fb7a111101f03bbb28a011c4b49dbb02c6e2a33ec6c10d25160e4ccbfb85883cd4bcd396dbffb0f21e8", 0x92) (async) sendmsg$NL80211_CMD_SET_REG(0xffffffffffffffff, &(0x7f0000000e00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000dc0)={&(0x7f0000000c40)={0x154, 0x0, 0x2, 0x70bd2d, 0x25dfdbfc, {}, [@NL80211_ATTR_REG_RULES={0xb0, 0x22, 0x0, 0x1, [{0x3c, 0x0, 0x0, 0x1, [@NL80211_ATTR_DFS_CAC_TIME={0x8, 0x7, 0x5}, @NL80211_ATTR_FREQ_RANGE_END={0x8, 0x3, 0xfffffff9}, @NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN={0x8, 0x5, 0xa}, @NL80211_ATTR_REG_RULE_FLAGS={0x8, 0x1, 0xa2}, @NL80211_ATTR_FREQ_RANGE_START={0x8, 0x2, 0xffff}, @NL80211_ATTR_FREQ_RANGE_MAX_BW={0x8, 0x4, 0x6}, @NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN={0x8, 0x5, 0x885}]}, {0xc, 0x0, 0x0, 0x1, [@NL80211_ATTR_FREQ_RANGE_END={0x8, 0x3, 0x40}]}, {0x24, 0x0, 0x0, 0x1, [@NL80211_ATTR_POWER_RULE_MAX_EIRP={0x8, 0x6, 0x40}, @NL80211_ATTR_REG_RULE_FLAGS={0x8, 0x1, 0xfff}, @NL80211_ATTR_DFS_CAC_TIME={0x8, 0x7, 0x7fff}, @NL80211_ATTR_FREQ_RANGE_END={0x8, 0x3, 0x7}]}, {0x14, 0x0, 0x0, 0x1, [@NL80211_ATTR_POWER_RULE_MAX_EIRP={0x8, 0x6, 0x4}, @NL80211_ATTR_DFS_CAC_TIME={0x8, 0x7, 0x4}]}, {0x2c, 0x0, 0x0, 0x1, [@NL80211_ATTR_FREQ_RANGE_MAX_BW={0x8, 0x4, 0x7}, @NL80211_ATTR_DFS_CAC_TIME={0x8, 0x7, 0x600000}, @NL80211_ATTR_FREQ_RANGE_MAX_BW={0x8}, @NL80211_ATTR_DFS_CAC_TIME={0x8, 0x7, 0x9}, @NL80211_ATTR_FREQ_RANGE_END={0x8, 0x3, 0x8000}]}]}, @NL80211_ATTR_USER_REG_HINT_TYPE={0x8, 0x9a, 0x2}, @NL80211_ATTR_REG_ALPHA2={0x6, 0x21, 'a\x00'}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x1d}, @NL80211_ATTR_REG_ALPHA2={0x7, 0x21, 'bb\x00'}, @NL80211_ATTR_USER_REG_HINT_TYPE={0x8, 0x9a, 0x1}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x19}, @NL80211_ATTR_REG_ALPHA2={0x6, 0x21, 'b\x00'}, @NL80211_ATTR_REG_RULES={0x58, 0x22, 0x0, 0x1, [{0x2c, 0x0, 0x0, 0x1, [@NL80211_ATTR_FREQ_RANGE_START={0x8, 0x2, 0x2b0}, @NL80211_ATTR_FREQ_RANGE_MAX_BW={0x8, 0x4, 0x10}, @NL80211_ATTR_POWER_RULE_MAX_EIRP={0x8, 0x6, 0xfffffe01}, @NL80211_ATTR_FREQ_RANGE_START={0x8, 0x2, 0x800}, @NL80211_ATTR_POWER_RULE_MAX_EIRP={0x8, 0x6, 0x9}]}, {0x4}, {0x24, 0x0, 0x0, 0x1, [@NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN={0x8, 0x5, 0x5}, @NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN={0x8, 0x5, 0x3}, @NL80211_ATTR_FREQ_RANGE_START={0x8, 0x2, 0x3}, @NL80211_ATTR_FREQ_RANGE_START={0x8, 0x2, 0xfffffffd}]}]}]}, 0x154}}, 0x0) (async) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000e40), 0x80, 0x0) ioctl$SIOCSIFHWADDR(r5, 0x8924, &(0x7f0000000e80)={'pimreg\x00', @remote}) r6 = socket$packet(0x11, 0x3, 0x300) r7 = socket$inet_udp(0x2, 0x2, 0x0) r8 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000ec0)={0x0, 0x7, 0x8}, 0xc) (async) r9 = bpf$ITER_CREATE(0x21, &(0x7f0000000f00)={r7}, 0x8) (async) getsockopt$PNPIPE_IFINDEX(0xffffffffffffffff, 0x113, 0x2, &(0x7f0000001140)=0x0, &(0x7f0000001180)=0x4) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000001500)={0xffffffffffffffff, 0xe0, &(0x7f0000001400)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, &(0x7f0000001240)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x5, 0x3, &(0x7f0000001280)=[0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f00000012c0)=[0x0, 0x0, 0x0], 0x0, 0x6, &(0x7f0000001300)=[{}, {}, {}, {}], 0x20, 0x10, &(0x7f0000001340), &(0x7f0000001380), 0x8, 0x35, 0x8, 0x8, &(0x7f00000013c0)}}, 0x10) bpf$PROG_LOAD(0x5, &(0x7f00000015c0)={0x13, 0x1f, &(0x7f0000000f40)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, [@btf_id={0x18, 0x2, 0x3, 0x0, 0x5}, @printk={@lu, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x4}}, @map_fd={0x18, 0x4, 0x1, 0x0, r8}, @generic={0x1, 0x6, 0x3, 0x2, 0x14ca}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r9}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x4095}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x2}}, @map_idx={0x18, 0x4, 0x5, 0x0, 0x6}, @map_idx_val={0x18, 0x4, 0x6, 0x0, 0x5, 0x0, 0x0, 0x0, 0xd5}, @alu={0x3, 0x0, 0x2, 0x8, 0xb, 0x7, 0x8}, @kfunc={0x85, 0x0, 0x2, 0x0, 0x5}]}, &(0x7f0000001040)='syzkaller\x00', 0xfffffffd, 0xb0, &(0x7f0000001080)=""/176, 0x40f00, 0x50, '\x00', r10, @fallback=0x2f, 0xffffffffffffffff, 0x8, &(0x7f00000011c0)={0x1, 0x1}, 0x8, 0x10, &(0x7f0000001200)={0x5, 0x9, 0xc, 0x2}, 0x10, r11, 0xffffffffffffffff, 0x2, &(0x7f0000001540)=[0xffffffffffffffff], &(0x7f0000001580)=[{0x1, 0x5, 0xf, 0x9}, {0x5, 0x4, 0xa, 0x9}], 0x10, 0x9}, 0x94) (async) getpeername$packet(0xffffffffffffffff, &(0x7f0000001680)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @multicast}, &(0x7f00000016c0)=0x14) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r9, 0x89f3, &(0x7f0000001780)={'ip6_vti0\x00', &(0x7f0000001700)={'ip6tnl0\x00', r12, 0x29, 0x5, 0xf, 0x2, 0x10, @mcast2, @dev={0xfe, 0x80, '\x00', 0x36}, 0x8, 0x700, 0x40000, 0x1565}}) (async) socket$unix(0x1, 0x5, 0x0) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$XFS_IOC_FSGEOMETRY_V4(r6, 0x8070587c, &(0x7f00000017c0)) (async) getsockopt$IP_SET_OP_GET_BYNAME(r6, 0x1, 0x53, &(0x7f0000001840)={0x6, 0x7, 'syz1\x00'}, &(0x7f0000001880)=0x28) (async) sendto$unix(r3, &(0x7f00000018c0)="381e83da", 0x4, 0x8010, &(0x7f0000001900)=@file={0x0, './file0\x00'}, 0x6e) socket$nl_route(0x10, 0x3, 0x0) (async) r13 = syz_genetlink_get_family_id$ipvs(&(0x7f00000019c0), r9) sendmsg$IPVS_CMD_DEL_DEST(r0, &(0x7f0000001ac0)={&(0x7f0000001980)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000001a80)={&(0x7f0000001a00)={0x58, r13, 0x10, 0x70bd2b, 0x25dfdbfe, {}, [@IPVS_CMD_ATTR_DAEMON={0x20, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e21}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'team_slave_1\x00'}]}, @IPVS_CMD_ATTR_SERVICE={0x1c, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_SCHED_NAME={0x7, 0x6, 'rr\x00'}, @IPVS_SVC_ATTR_FWMARK={0x8}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x4}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x5}]}, 0x58}, 0x1, 0x0, 0x0, 0x20040000}, 0x2a000811) (async) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000001b00)={'vxcan1\x00'}) (async) connect$can_bcm(0xffffffffffffffff, &(0x7f0000001b40), 0x10) 194.361704ms ago: executing program 4 (id=4454): r0 = socket$nl_route(0x10, 0x3, 0x0) syz_emit_ethernet(0x56, &(0x7f0000000080)={@multicast, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, @void, {@canfd={0xd, {{0x2, 0x0, 0x1}, 0x0, 0x1, 0x0, 0x0, "8d2ca880b41704e38dc11d120a0c8711899f2a1cdb2dff70a464bd46e5adade43f8311985d82003e6aa0748296633ec4dee4631d3874f06d2056a823db56903a"}}}}, &(0x7f0000000100)={0x1, 0x1, [0x3de, 0x28f, 0x4a5, 0x2a4]}) sendmsg$nl_route_sched(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000001340)=@newtaction={0x8ec, 0x30, 0x1, 0x7fffffd, 0x3, {}, [{0x8d8, 0x1, [@m_mpls={0x38, 0x1, 0x0, 0x0, {{0x9}, {0xc, 0x2, 0x0, 0x1, [@TCA_MPLS_LABEL={0x8, 0x5, 0x2000000}]}, {0x4, 0x4}, {0xc}, {0xc, 0x8, {0x0, 0x1}}}}, @m_police={0x89c, 0x1, 0x0, 0x0, {{0xb}, {0x870, 0x2, 0x0, 0x1, [[@TCA_POLICE_RATE={0x404, 0x2, [0x6, 0xf81f, 0x8b, 0xc1f2, 0x7308, 0x9, 0x1, 0xd, 0x3, 0x800, 0x800, 0x7fff, 0x7fff, 0x5, 0xd37d, 0x2, 0x664, 0xa91baf78, 0x80000001, 0x5, 0x400, 0xd9, 0x8, 0x1, 0xffffff9f, 0x0, 0xfffffc01, 0x8, 0x7f, 0xeb, 0xd9c7, 0x3, 0x5, 0x4, 0x9, 0x50b, 0x0, 0x80000001, 0x80, 0x98, 0xffff0000, 0x3ff, 0x3, 0x0, 0x8, 0x65a, 0x0, 0x3, 0x4, 0x101, 0x80, 0xfffffff7, 0x7fffffff, 0x2, 0x40, 0xff87, 0xff, 0xa92c, 0x6, 0xf6, 0x1, 0x5, 0x1, 0x81, 0x7, 0x0, 0x2, 0x7, 0x3, 0xb5e7, 0xfffffffb, 0x8, 0x1, 0xd1, 0x80, 0x80000001, 0xffff, 0x9, 0x1, 0x4, 0x54c9cce6, 0x9, 0x10, 0x7, 0x4, 0x8, 0x3, 0x2, 0xffff3bb9, 0x3, 0xffff, 0x7, 0x7, 0x5, 0x9, 0x7fffffff, 0x6, 0x0, 0x3, 0x7ba, 0x3, 0x8, 0x7, 0x0, 0xc, 0x9, 0x2, 0x400, 0x0, 0x8, 0x79, 0x0, 0x3, 0x40, 0x688, 0x8, 0x0, 0x7, 0xffffffbc, 0x1, 0x6, 0x2, 0x1000, 0x1, 0x401, 0x2, 0x6, 0x6, 0x8, 0x2, 0x1, 0x6, 0x6, 0x9, 0x3, 0xa, 0x4, 0x467, 0x2, 0x3, 0xdd7, 0xfff, 0x7fff, 0x6, 0x1, 0xfae, 0x5, 0x1, 0xfc000000, 0x3, 0x8, 0x8f30, 0xa, 0x4d92139b, 0x400, 0x7, 0x4, 0x2, 0xdd91, 0x0, 0x4, 0x4, 0x5, 0x3, 0x7fffffff, 0x100, 0x8, 0x4, 0x7ff, 0xd, 0x1, 0xf, 0x7fffffff, 0x2, 0x0, 0x4, 0x9, 0x80000001, 0x0, 0x7, 0x5, 0x3825, 0x3f, 0x3a, 0x8, 0x1, 0x3, 0x0, 0xe4c, 0x1, 0x200, 0x81, 0x7, 0x0, 0x5, 0x0, 0xce7, 0xc, 0xf, 0x81, 0x10000, 0x7ff000, 0x2, 0x7, 0x51, 0xc, 0x9, 0x5, 0x55, 0x7ad, 0x8, 0xfffffbff, 0x2ee3, 0x3, 0x4, 0x2, 0xfffffeff, 0x100000, 0x93, 0x1, 0x0, 0xffff, 0x7, 0x6, 0x5, 0x2, 0x2, 0x4, 0x0, 0x9, 0x6, 0xd, 0x80000000, 0x8, 0x9, 0x1000, 0x631a, 0x7cfa, 0x1fffc00, 0x2, 0x585e, 0x3, 0xffff8001, 0x1, 0xc, 0xfffffffb, 0x6, 0x2, 0x1, 0x6, 0x6, 0x3, 0x495, 0x6a, 0x5, 0x10000]}], [@TCA_POLICE_RESULT={0x8, 0x5, 0x4}, @TCA_POLICE_PEAKRATE64={0xc, 0x9, 0xfffffffffffffff7}], [], [@TCA_POLICE_RESULT={0x8, 0x5, 0x8c2}], [@TCA_POLICE_RATE={0x404, 0x2, [0x7ff, 0x6, 0x5, 0xa, 0x1, 0x1, 0x2, 0x7, 0x2, 0x2, 0x5, 0x3, 0x100, 0x4, 0x53c, 0x9, 0x9, 0x0, 0x2b, 0x6, 0x10000000, 0x3, 0xead1, 0xa, 0x4, 0x5, 0x6f54a5ef, 0x1000, 0x99, 0x0, 0x7aec, 0x80000001, 0x0, 0xf, 0x60, 0x4, 0x1c, 0x9, 0x400, 0x919d, 0x100, 0xfff, 0xe, 0x0, 0x458, 0xb, 0x1, 0x2, 0x9, 0x2, 0x10001, 0x8, 0x7, 0x81, 0x0, 0xc00000, 0x80000001, 0x100, 0x6, 0x7fff, 0xb, 0x2e4, 0x1, 0x3, 0x1, 0x5, 0x401, 0x400, 0x0, 0xa, 0x71, 0xfffffff9, 0xfffffffa, 0x80000000, 0x6, 0x101, 0x9, 0x6, 0xf066, 0x3e, 0x2763, 0x10001, 0x303, 0xa, 0xc71e, 0x3, 0xd, 0x5, 0x70, 0x1, 0x4, 0x401, 0x5, 0x7, 0x4, 0x6, 0xfffff5f6, 0x1, 0x0, 0x0, 0x4, 0x9, 0x7, 0x9, 0xc000, 0x400, 0x3, 0x2, 0x6, 0x3, 0xf, 0x81, 0x9, 0x2, 0x2, 0xd92a, 0x3, 0x6, 0x9, 0x7, 0x1, 0x8001, 0x8, 0x81, 0x6a5b, 0x6b35, 0x4, 0x80, 0xb6, 0x7, 0x1, 0x88, 0x3, 0x0, 0x2d23, 0x6, 0x3, 0x400, 0x9, 0x2, 0x0, 0x80000001, 0x40, 0x0, 0x97d, 0x80000001, 0x101, 0x3, 0x4, 0x3, 0x80, 0x6, 0x4, 0x5, 0x6b2, 0x7fff, 0xf, 0x7, 0xfffff31e, 0x1000, 0x3, 0x2e36, 0x3, 0x80000000, 0x400, 0x1, 0x400, 0x4, 0x2, 0x9, 0x100, 0xa27, 0x1, 0x0, 0x1, 0x35, 0x9, 0x5, 0x9, 0x2, 0x6, 0xfffffff8, 0x7, 0xfffffffe, 0x1, 0xd, 0x2, 0x2, 0x3ff, 0x1000, 0x4, 0xffffffff, 0x0, 0x8, 0x5, 0xfffffffb, 0x6, 0x7, 0x3, 0x9, 0x10, 0x1, 0x2, 0x8, 0x8, 0x20000000, 0x63a, 0x1, 0x100, 0x6, 0x6, 0x5, 0x10, 0x7, 0x10, 0x2, 0x6000, 0x5, 0x4de4, 0x625, 0x1, 0x80200000, 0x6, 0xeb1, 0x3, 0xfff, 0x9, 0x9, 0x5, 0x2, 0xda1b, 0x8, 0x6, 0xffff, 0x5, 0x1000, 0x99b, 0x3, 0xfffffff9, 0x701, 0xfffffe01, 0x200, 0x4, 0x60000, 0x6, 0xa2a, 0x928, 0xf6f9, 0x101, 0x6, 0x8001, 0x2, 0x401, 0x4, 0x20000]}, @TCA_POLICE_RATE64={0xc, 0x8, 0x5}], [@TCA_POLICE_TBF={0x3c, 0x1, {0x1, 0x6, 0x2, 0x3, 0x79129e42, {0xfa, 0x0, 0xfffd, 0xfffa, 0x4, 0x7}, {0xa2, 0xfc01811103a93f91, 0x3ff, 0xcf2, 0x10, 0x4}, 0x2, 0xfffffe00, 0x2}}]]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x1, 0x1}}}}]}]}, 0x8ec}}, 0x0) 157.637698ms ago: executing program 2 (id=4455): r0 = socket$nl_route(0x10, 0x3, 0x0) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x2, 0x4, 0x4, 0x9}, 0x48) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000900)=ANY=[@ANYBLOB="0d00000009000000040000000100000000000000", @ANYRES32=r1], 0x48) setsockopt$inet6_tcp_buf(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000080)="afd33f44f41376067929ddaef4ca77b0f9c950b65f7cf0d888f4acbd3451ee9245a8ccdff81aced0b659d6d26c00d5b2f70431303d40bd50dd274949d5acb3faaf96dfc7fb79befecec3c8f73af469dd520ec0092c379c1795145b9a63c232a1bdd486e4dde55a547fca6e053fcd92260af50aeecccd63142038ef1725551a97a94ae5360cbcaac34f6c1cfceff547df1602a00771a1a881b99f2223aa47aa7032a8", 0xa2) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0xf, &(0x7f0000000680)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x80, 0x0, 0x0, 0x0, 0x9}, {{0x18, 0x1, 0x1, 0x0, r2}}, {}, [], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000000)='GPL\x00', 0x8, 0xde, &(0x7f0000003e40)=""/222}, 0x94) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=@newlink={0x4c, 0x10, 0x401, 0x0, 0xfffffffe, {}, [@IFLA_LINKINFO={0x2c, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x1c, 0x2, 0x0, 0x1, [@IFLA_BR_MCAST_QUERY_INTVL={0xc, 0x21, 0xe0}, @IFLA_BR_MCAST_QUERY_RESPONSE_INTVL={0xc, 0x22, 0x7e}]}}}]}, 0x4c}, 0x1, 0xd, 0x0, 0x4000000}, 0x0) 95.755096ms ago: executing program 1 (id=4456): r0 = socket$kcm(0x2, 0xa, 0x2) r1 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="942f88179b685aef", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000001"], 0x48) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040), 0x200002, 0x0) r3 = openat$cgroup_devices(r2, &(0x7f0000000100)='devices.allow\x00', 0x2, 0x0) write$cgroup_devices(r3, &(0x7f0000000180)=ANY=[@ANYBLOB='b 122532'], 0xa) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000180)={0x1b, 0x0, 0x0, 0x3, 0x0, r1, 0x2, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x1, 0x3}, 0x50) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="9feb01001800000000000000300000003000000002000000000000000000008406010000000000000300000d"], 0x0, 0x4a, 0x0, 0x6, 0x4}, 0x28) ioctl$SIOCSIFHWADDR(r0, 0x8914, &(0x7f0000000180)={'netdevsim0\x00', @broadcast}) 10.571332ms ago: executing program 4 (id=4457): r0 = socket(0x2a, 0x2, 0x0) getsockopt$bt_BT_DEFER_SETUP(r0, 0x112, 0x7, &(0x7f0000000000), &(0x7f0000000040)=0x4) sendmsg$TIPC_NL_LINK_GET(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000280)={0x0, 0x24}}, 0x0) getsockname$packet(r0, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000001480)=0x14) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000380)=@newqdisc={0x24, 0x24, 0xf0b, 0x4, 0x0, {0x0, 0x0, 0x0, r1, {}, {0xffff, 0xffff}}}, 0x24}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000100)=@newtfilter={0x58, 0x2c, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {0xfffa, 0x7}, {}, {0x1c, 0xa}}, [@filter_kind_options=@f_flower={{0xb}, {0x28, 0x2, [@TCA_FLOWER_KEY_ETH_TYPE={0x6, 0x8, 0x800}, @TCA_FLOWER_KEY_IP_PROTO={0x5, 0x9, 0x84}, @TCA_FLOWER_KEY_IPV6_DST={0x14, 0x10, @private0}]}}]}, 0x58}}, 0x24004000) r2 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r2, &(0x7f00000002c0), 0x40000000000009f, 0x0) 0s ago: executing program 3 (id=4458): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) (async, rerun: 32) r1 = socket$inet_tcp(0x2, 0x1, 0x0) (async, rerun: 32) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000180)=@newtaction={0x98, 0x30, 0x871a15abc695fb3d, 0x0, 0x0, {}, [{0x84, 0x1, [@m_tunnel_key={0x80, 0x1, 0x0, 0x0, {{0xf}, {0x50, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_PARMS={0x1c, 0x2, {{0x0, 0x0, 0x300, 0x0, 0x1}, 0x1}}, @TCA_TUNNEL_KEY_ENC_IPV6_DST={0x14, 0x6, @ipv4={'\x00', '\xff\xff', @private}}, @TCA_TUNNEL_KEY_ENC_IPV6_SRC={0x14, 0x5, @remote}, @TCA_TUNNEL_KEY_ENC_IPV4_SRC={0x8, 0x3, @remote}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x98}}, 0x0) (async, rerun: 64) r3 = socket(0x10, 0x3, 0x0) (rerun: 64) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000001700)={'ip6tnl0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000a00)=@newqdisc={0x78, 0x24, 0x3fe3aa0262d8c783, 0x4, 0x25dfdbfe, {0x0, 0x0, 0x0, r4, {0x0, 0x10}, {0xffff, 0xffff}, {0x0, 0x16747c6d2baaace}}, [@qdisc_kind_options=@q_sfq={{0x8}, {0x4c, 0x2, {{0x2, 0x7, 0x401, 0x0, 0x2}, 0x609d, 0x1, 0x8, 0xfffffffa, 0xffffffff, 0x2, 0x18, 0x1, 0x6, 0xe, {0xe389, 0x5, 0x5, 0x0, 0x9, 0x2}}}}]}, 0x78}, 0x1, 0x0, 0x0, 0x20004090}, 0x0) (async) ioctl$sock_SIOCADDRT(r2, 0x890b, &(0x7f0000000100)={0x0, @phonet={0x23, 0xf7, 0x8, 0x7}, @qipcrtr={0x2a, 0x4, 0x7ffe}, @rc={0x1f, @none}, 0xc, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000080)='xfrm0\x00', 0x100000001, 0x5, 0x2}) (async) r5 = socket$nl_generic(0x10, 0x3, 0x10) (async) r6 = syz_genetlink_get_family_id$tipc(&(0x7f0000000500), 0xffffffffffffffff) sendmsg$TIPC_CMD_SET_NODE_ADDR(r5, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000380)={0x24, r6, 0x1, 0x0, 0x0, {{}, {0x0, 0x400b}, {0x8, 0x11, 0x2007ff}}}, 0x24}}, 0x0) setsockopt$inet_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f0000000040), 0x3) (async) sendmsg$IPSET_CMD_SAVE(r3, &(0x7f0000000640)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000600)={&(0x7f0000000580)={0x44, 0x8, 0x6, 0x301, 0x0, 0x0, {0xa, 0x0, 0x8}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x44}, 0x1, 0x0, 0x0, 0x8080}, 0x80) (async) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a1e000000000a050000000000000000000200000008000240000000f11300007427efa1540a0e2f17802c00030a010200000000000000000500000134000000060ac99f76b0118647e33500000000000000000500008008000b40000000000900020073797a30000000000900010073797a300000000014000000110001000000000000e95fe95bddb60991a7ff8a872c514bbfa27886ebddeeb44de6d60501d870845c47ccf3834baa3392e75b316ce7abe40c093898cd5e0d58677d2a238fb5af13ac2a68de4cda6614e4e48004a536d3160a0b111b9072544c5ffe95e63dc08e3bf09a14749936865b63c91a32dc7aab598f1b565cd37b4bf7abe4f39bba63f1620dce151c7ed6d66ca0be76c9fe83afca9eef226a5f6ffe4bdb3dcef2e53a75312c52ebe00bbb4ac8ecd02a1bf4a65de9373f40a4d34f1eadd5fa50e664e2b7433687bcac08820195d20486bc09aa5317c2fd02da184838d3cad0371442862c1988214b387704b9e5935dbca0422827492ca7a02988aa5f5c6349a21b"], 0x8c}}, 0x0) (async) r7 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) (async) r8 = socket$alg(0x26, 0x5, 0x0) bind$alg(r8, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(twofish)\x00'}, 0x58) (async) setsockopt$ALG_SET_KEY(r8, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) (async) r9 = accept4(r8, 0x0, 0x0, 0x800) sendmmsg$alg(r9, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb0958730", 0x4c}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722", 0x44}], 0x2, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) (async) recvmsg(r9, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000700)=[{&(0x7f0000000300)=""/15, 0xf}, {&(0x7f0000000080)=""/8, 0x8}], 0x2}, 0x120) (async) getsockopt$WPAN_SECURITY_LEVEL(r7, 0x0, 0x2, &(0x7f0000000300), &(0x7f0000000500)=0x4) (async) r10 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000300)={0x6, 0x10, &(0x7f00000003c0)=@ringbuf={{}, {{0x18, 0x1, 0x1, 0x0, r10}}, {}, [@ldst={0x1, 0x0, 0x3, 0x0, 0x0, 0xfffffffffffffffc}]}, &(0x7f0000000100)='GPL\x00', 0x2}, 0x94) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000240), 0xffffffffffffffff) (async) getsockopt$bt_BT_RCVMTU(0xffffffffffffffff, 0x112, 0xd, &(0x7f0000000280)=0x3bd9, &(0x7f00000002c0)=0x2) kernel console output (not intermixed with test programs): crewing up backlog [ 603.525244][T19666] netlink: 80 bytes leftover after parsing attributes in process `syz.1.3318'. [ 604.053756][T19514] hsr_slave_0: entered promiscuous mode [ 604.062346][T19514] hsr_slave_1: entered promiscuous mode [ 604.077183][T19514] debugfs: 'hsr0' already exists in 'hsr' [ 604.104201][T19514] Cannot create hsr debugfs directory [ 604.194617][ T8855] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 604.215471][ T3330] bridge_slave_1: left allmulticast mode [ 604.230158][ T3330] bridge_slave_1: left promiscuous mode [ 604.249821][ T3330] bridge0: port 2(bridge_slave_1) entered disabled state [ 604.342148][ T3330] dvmrp0: left allmulticast mode [ 604.506645][T19686] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3323'. [ 604.925677][ T998] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 604.945606][ T3330] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 604.956398][ T3330] bond0 (unregistering): Released all slaves [ 604.971248][ T3330] bond1 (unregistering): Released all slaves [ 604.993666][ T3330] bond2 (unregistering): Released all slaves [ 605.032064][ T3330] bond3 (unregistering): Released all slaves [ 605.056255][ T3330] bond4 (unregistering): Released all slaves [ 605.077987][ T3330] bond5 (unregistering): Released all slaves [ 605.111351][ T3330] bond6 (unregistering): Released all slaves [ 605.131794][ T3330] bond7 (unregistering): Released all slaves [ 605.163856][ T3330] bond8 (unregistering): Released all slaves [ 605.227283][T19692] netlink: 36 bytes leftover after parsing attributes in process `syz.4.3325'. [ 605.234397][ T5852] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 605.265436][T19699] netlink: 'syz.1.3326': attribute type 1 has an invalid length. [ 605.571346][ T3330] tipc: Left network mode [ 605.861303][T19715] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3328'. [ 606.099139][ T3330] IPVS: stopping master sync thread 12038 ... [ 606.165716][T19514] netdevsim netdevsim2 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 606.243366][T19514] netdevsim netdevsim2 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 606.274321][ T8855] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 606.410566][T19514] netdevsim netdevsim2 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 606.582361][T19737] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 606.591948][T19734] FAULT_INJECTION: forcing a failure. [ 606.591948][T19734] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 606.619625][T19514] netdevsim netdevsim2 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 606.622094][T19734] CPU: 1 UID: 0 PID: 19734 Comm: syz.0.3337 Not tainted syzkaller #0 PREEMPT(full) [ 606.622124][T19734] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 606.622134][T19734] Call Trace: [ 606.622141][T19734] [ 606.622148][T19734] dump_stack_lvl+0xe8/0x150 [ 606.622175][T19734] should_fail_ex+0x412/0x560 [ 606.622199][T19734] prepare_alloc_pages+0x22a/0x650 [ 606.622232][T19734] __alloc_frozen_pages_noprof+0x12f/0x380 [ 606.622254][T19734] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 606.622283][T19734] ? __pfx_policy_nodemask+0x10/0x10 [ 606.622300][T19734] ? update_cfs_rq_load_avg+0x3fb/0x4e0 [ 606.622327][T19734] alloc_pages_mpol+0x235/0x490 [ 606.622350][T19734] folio_alloc_mpol_noprof+0x39/0x160 [ 606.622370][T19734] vma_alloc_folio_noprof+0xe1/0x1e0 [ 606.622391][T19734] ? __pfx_vma_alloc_folio_noprof+0x10/0x10 [ 606.622420][T19734] do_wp_page+0x118a/0x4cc0 [ 606.622446][T19734] ? __pte_offset_map+0x29/0x240 [ 606.622478][T19734] ? __pfx_do_wp_page+0x10/0x10 [ 606.622495][T19734] ? do_raw_spin_lock+0x12b/0x2f0 [ 606.622521][T19734] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 606.622554][T19734] handle_mm_fault+0x1698/0x3170 [ 606.622589][T19734] ? handle_mm_fault+0xf1/0x3170 [ 606.622617][T19734] ? __pfx_handle_mm_fault+0x10/0x10 [ 606.622665][T19734] ? lock_mm_and_find_vma+0xa7/0x340 [ 606.622692][T19734] do_user_addr_fault+0x75b/0x1340 [ 606.622727][T19734] exc_page_fault+0x6a/0xc0 [ 606.622746][T19734] asm_exc_page_fault+0x26/0x30 [ 606.622762][T19734] RIP: 0010:rep_movs_alternative+0x4a/0x90 [ 606.622784][T19734] Code: cc cc cc 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 8b 06 48 89 07 48 83 c6 08 48 83 c7 08 83 e9 08 74 db 83 f9 08 73 e8 eb c5 a4 c3 cc cc cc cc 48 8b 06 48 89 07 48 8d 47 08 48 83 e0 f8 48 [ 606.622798][T19734] RSP: 0018:ffffc900058c7a08 EFLAGS: 00050206 [ 606.622814][T19734] RAX: ffffffff84b1c001 RBX: 0000000000000e40 RCX: 0000000000000140 [ 606.622825][T19734] RDX: 0000000000000000 RSI: ffff888053d00d40 RDI: 0000200000001000 [ 606.622837][T19734] RBP: ffffc900058c7b48 R08: ffff888053d00e7f R09: 1ffff1100a7a01cf [ 606.622848][T19734] R10: dffffc0000000000 R11: ffffed100a7a01d0 R12: 0000200000001140 [ 606.622859][T19734] R13: 00007ffffffff000 R14: ffff888053d00040 R15: 0000200000000300 [ 606.622879][T19734] ? _copy_to_user+0x31/0xb0 [ 606.622907][T19734] _copy_to_user+0x8a/0xb0 [ 606.622930][T19734] bpf_test_finish+0x191/0x6b0 [ 606.622960][T19734] ? __pfx_bpf_test_finish+0x10/0x10 [ 606.622978][T19734] ? eth_type_trans+0x348/0x7e0 [ 606.623010][T19734] bpf_prog_test_run_skb+0x1250/0x2260 [ 606.623052][T19734] ? __fget_files+0x3a0/0x420 [ 606.623072][T19734] ? __fget_files+0x2a/0x420 [ 606.623097][T19734] ? __pfx_bpf_prog_test_run_skb+0x10/0x10 [ 606.623117][T19734] bpf_prog_test_run+0x2c7/0x340 [ 606.623139][T19734] __sys_bpf+0x643/0x950 [ 606.623165][T19734] ? __pfx___sys_bpf+0x10/0x10 [ 606.623205][T19734] ? ksys_write+0x242/0x270 [ 606.623231][T19734] ? __pfx_ksys_write+0x10/0x10 [ 606.623252][T19734] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 606.623274][T19734] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 606.623292][T19734] __x64_sys_bpf+0x7c/0x90 [ 606.623315][T19734] do_syscall_64+0x174/0x580 [ 606.623334][T19734] ? clear_bhb_loop+0x40/0x90 [ 606.623356][T19734] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 606.623382][T19734] RIP: 0033:0x7fad2c59ce59 [ 606.623398][T19734] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 606.623411][T19734] RSP: 002b:00007fad2d523028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 606.623427][T19734] RAX: ffffffffffffffda RBX: 00007fad2c815fa0 RCX: 00007fad2c59ce59 [ 606.623438][T19734] RDX: 000000000000004c RSI: 0000200000000240 RDI: 000000000000000a [ 606.623448][T19734] RBP: 00007fad2d523090 R08: 0000000000000000 R09: 0000000000000000 [ 606.623459][T19734] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 606.623468][T19734] R13: 00007fad2c816038 R14: 00007fad2c815fa0 R15: 00007ffc6d22c088 [ 606.623498][T19734] [ 606.912547][T19741] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3336'. [ 607.127664][T19738] bond0: (slave wlan0): Error: Device can not be enslaved while up [ 607.137218][T19741] hsr_slave_0: left promiscuous mode [ 607.266197][T19752] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3341'. [ 607.318537][ T8855] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 607.958141][T19768] IPv6: addrconf: prefix option has invalid lifetime [ 607.966766][ T998] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 608.060658][T19769] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3345'. [ 608.080944][T19768] syz_tun: entered allmulticast mode [ 608.143565][T19769] syz_tun (unregistering): left allmulticast mode [ 608.199802][T19514] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 608.223162][T19514] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 608.255091][T19514] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 608.268641][T19514] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 608.282169][T19514] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 608.314614][T19514] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 608.350043][T19514] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 608.358432][ T8855] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 608.419363][T19514] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 609.068464][T19787] vlan3: entered promiscuous mode [ 609.083398][T19787] bridge0: entered promiscuous mode [ 609.271746][T19514] 8021q: adding VLAN 0 to HW filter on device bond0 [ 609.386931][T19514] 8021q: adding VLAN 0 to HW filter on device team0 [ 609.417969][ T5852] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 609.447515][ T6134] bridge0: port 1(bridge_slave_0) entered blocking state [ 609.454823][ T6134] bridge0: port 1(bridge_slave_0) entered forwarding state [ 609.468679][T19794] x_tables: duplicate underflow at hook 2 [ 609.499131][ T6134] bridge0: port 2(bridge_slave_1) entered blocking state [ 609.506502][ T6134] bridge0: port 2(bridge_slave_1) entered forwarding state [ 609.669325][T19799] netlink: 'syz.4.3351': attribute type 18 has an invalid length. [ 609.698074][T19799] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3351'. [ 609.741775][T19799] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3351'. [ 609.802001][T19799] netlink: 'syz.4.3351': attribute type 12 has an invalid length. [ 609.862894][T19799] netlink: 'syz.4.3351': attribute type 13 has an invalid length. [ 610.083006][T19812] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3352'. [ 610.331735][ T3330] hsr_slave_0: left promiscuous mode [ 610.361351][ T3330] hsr_slave_1: left promiscuous mode [ 610.436400][ T8855] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 610.520646][T19823] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3356'. [ 610.997213][ T998] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 611.171487][ T5765] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 611.475137][ T5743] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 611.925440][T19867] lo: Caught tx_queue_len zero misconfig [ 611.935313][T19867] netlink: 1028 bytes leftover after parsing attributes in process `syz.0.3365'. [ 611.984003][T19867] sch_tbf: peakrate 7 is lower than or equals to rate 6829859379779001161 ! [ 612.503686][ T3330] IPVS: stop unused estimator thread 0... [ 612.516614][ T8855] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 612.959456][T19905] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3375'. [ 613.175258][T19912] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3377'. [ 613.252746][T19916] x_tables: ip_tables: ah match: only valid for protocol 51 [ 613.349225][T19514] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 613.487810][T19514] veth0_vlan: entered promiscuous mode [ 613.539192][T19514] veth1_vlan: entered promiscuous mode [ 613.558866][ T8855] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 613.589689][T19920] netlink: 60 bytes leftover after parsing attributes in process `syz.4.3379'. [ 613.631879][T19920] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3379'. [ 613.668652][T19920] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3379'. [ 613.767872][T19924] sctp: [Deprecated]: syz.0.3380 (pid 19924) Use of int in maxseg socket option. [ 613.767872][T19924] Use struct sctp_assoc_value instead [ 613.945336][T19514] veth0_macvtap: entered promiscuous mode [ 614.044794][ T998] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 614.100055][T19514] veth1_macvtap: entered promiscuous mode [ 614.163081][T19514] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 614.205371][T19514] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 614.253838][ T57] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 614.303534][ T57] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 614.359802][ T57] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 614.432084][ T57] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 614.564717][T19958] pim6reg1: entered promiscuous mode [ 614.594364][ T8855] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 614.623197][T19958] pim6reg1: entered allmulticast mode [ 614.706806][ T57] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 614.759048][ T57] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 614.872738][T19965] netlink: 'syz.4.3389': attribute type 10 has an invalid length. [ 614.928612][T19965] bridge0: port 1(netdevsim1) entered blocking state [ 614.967231][T19965] bridge0: port 1(netdevsim1) entered disabled state [ 615.007362][T19965] netdevsim netdevsim4 netdevsim1: entered allmulticast mode [ 615.029102][T19965] netdevsim netdevsim4 netdevsim1: entered promiscuous mode [ 615.058179][ T57] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 615.097504][ T57] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 615.482036][T19988] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3392'. [ 615.636104][ T8855] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 615.718449][T19993] syzkaller1: entered promiscuous mode [ 615.748365][T19993] syzkaller1: entered allmulticast mode [ 615.799865][T19997] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3395'. [ 616.677700][ T5743] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 616.918582][ T998] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 616.931920][ T8835] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 617.057607][T20050] netlink: 'syz.1.3409': attribute type 9 has an invalid length. [ 617.109184][ T8835] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 617.714681][ T5743] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 617.798887][ T5743] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 617.849131][T20080] nbd: socks must be embedded in a SOCK_ITEM attr [ 618.049459][ T998] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 618.577770][T20068] syzkaller0 speed is unknown, defaulting to 1000 [ 618.763317][ T5852] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 618.843393][ T5852] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 619.476698][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 619.628478][T20068] lo speed is unknown, defaulting to 1000 [ 619.794889][ T5852] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 619.811815][T20127] syzkaller0: entered promiscuous mode [ 619.828826][T20127] syzkaller0: entered allmulticast mode [ 619.877465][ T5852] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 620.003765][T20135] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3423'. [ 620.115444][ T998] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 620.667208][T20150] gretap0: entered promiscuous mode [ 620.707518][T20150] vlan4: entered promiscuous mode [ 620.770892][ T998] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 621.594959][T20170] netlink: 212408 bytes leftover after parsing attributes in process `syz.1.3429'. [ 621.883999][T20176] bridge0: port 1(bridge_slave_0) entered disabled state [ 621.908431][T20179] netlink: 'syz.1.3431': attribute type 16 has an invalid length. [ 621.928736][T20176] bridge0: port 2(bridge_slave_1) entered disabled state [ 621.954300][T20179] netlink: 'syz.1.3431': attribute type 17 has an invalid length. [ 622.050711][T20183] tipc: Started in network mode [ 622.067353][T20183] tipc: Node identity 926959c30ba, cluster identity 4711 [ 622.075962][T20183] tipc: Enabled bearer , priority 0 [ 622.129677][T20179] bridge0: port 1(bridge_slave_0) entered blocking state [ 622.136975][T20179] bridge0: port 1(bridge_slave_0) entered forwarding state [ 622.178247][T20179] bridge0: port 2(bridge_slave_1) entered blocking state [ 622.185729][T20179] bridge0: port 2(bridge_slave_1) entered forwarding state [ 622.330987][T20179] netdevsim netdevsim1 netdevsim0: left allmulticast mode [ 622.356000][T20179] vlan2: left promiscuous mode [ 622.375331][T20179] mac80211_hwsim hwsim46 syzkaller0: left promiscuous mode [ 622.387594][T20179] mac80211_hwsim hwsim46 syzkaller0: left allmulticast mode [ 622.412900][T20185] netlink: 'syz.4.3434': attribute type 2 has an invalid length. [ 622.438114][T20185] netlink: 112 bytes leftover after parsing attributes in process `syz.4.3434'. [ 622.457956][T20185] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3434'. [ 622.467894][T20188] block nbd0: Unsupported socket: should be TCP or UNIX. [ 622.468161][T20178] syzkaller0: entered promiscuous mode [ 622.534668][T20178] syzkaller0: entered allmulticast mode [ 622.640590][T20199] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3437'. [ 622.723632][T20194] tipc: Resetting bearer [ 622.777672][T20194] tipc: Disabling bearer [ 622.855715][T20196] netlink: 'syz.1.3435': attribute type 1 has an invalid length. [ 622.898902][T20196] netlink: 'syz.1.3435': attribute type 2 has an invalid length. [ 622.915128][ T5852] net_ratelimit: 7 callbacks suppressed [ 622.915148][ T5852] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 622.940701][T20206] Cannot find del_set index 0 as target [ 622.996964][ T8855] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 623.076831][ T8855] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 623.158447][ T8835] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 623.426030][T20225] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3439'. [ 623.509096][T20227] Cannot find add_set index 0 as target [ 623.537463][T20229] netlink: 32 bytes leftover after parsing attributes in process `syz.0.3442'. [ 623.557063][T20229] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3442'. [ 623.575011][T20229] netlink: 32 bytes leftover after parsing attributes in process `syz.0.3442'. [ 623.654534][T20229] tipc: Failed to remove unknown binding: 66,0,0/0:3413758035/3413758037 [ 623.675726][T20229] tipc: Failed to remove unknown binding: 66,0,0/0:3413758035/3413758036 [ 623.698175][T20229] tipc: Failed to remove unknown binding: 66,0,0/0:3413758035/3413758037 [ 623.714743][T20229] tipc: Failed to remove unknown binding: 66,0,0/0:3413758035/3413758036 [ 623.730403][ T30] audit: type=1800 audit(1780375152.488:21): pid=20203 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.3436" name="memory.events" dev="tmpfs" ino=507 res=0 errno=0 [ 623.960677][ T8855] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 624.037139][ T8855] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 624.118822][ T5750] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 624.202881][T20246] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3447'. [ 624.217283][T20247] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 624.254631][T20248] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3448'. [ 624.641385][T20268] openvswitch: netlink: Unexpected mask (mask=200240, allowed=10048) [ 624.995216][ T8855] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 626.716813][T20345] __nla_validate_parse: 5 callbacks suppressed [ 626.716856][T20345] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3470'. [ 626.769355][T20345] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3470'. [ 626.826965][T20344] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3470'. [ 626.847604][T20344] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3470'. [ 627.026796][T20352] netlink: 'syz.4.3473': attribute type 21 has an invalid length. [ 627.058913][T20352] netlink: 168 bytes leftover after parsing attributes in process `syz.4.3473'. [ 627.195655][T20364] netlink: 88 bytes leftover after parsing attributes in process `syz.1.3477'. [ 627.225172][T20360] netlink: 28 bytes leftover after parsing attributes in process `syz.3.3475'. [ 627.263401][T20364] netlink: 212408 bytes leftover after parsing attributes in process `syz.1.3477'. [ 627.274233][T20360] netlink: 28 bytes leftover after parsing attributes in process `syz.3.3475'. [ 627.332853][T20367] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3478'. [ 627.633020][T20383] mac80211_hwsim hwsim46 syzkaller0: entered promiscuous mode [ 627.670411][T20383] mac80211_hwsim hwsim46 syzkaller0: entered allmulticast mode [ 628.047562][T20407] netlink: 'syz.1.3489': attribute type 2 has an invalid length. [ 628.116713][ T8855] net_ratelimit: 13 callbacks suppressed [ 628.116746][ T8855] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 628.195110][ T5743] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 628.274332][ T8835] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 628.276613][T20414] vlan2: entered promiscuous mode [ 628.297661][T20417] netlink: 'syz.1.3491': attribute type 1 has an invalid length. [ 628.318657][T20414] bridge0: entered promiscuous mode [ 628.699774][T20421] bond3: option miimon: invalid value (18446744073709551607) [ 628.708837][T20421] bond3: option miimon: allowed values 0 - 2147483647 [ 628.722614][T20421] bond3 (unregistering): Released all slaves [ 628.998318][ T50] block nbd0: Receive control failed (result -32) [ 629.157185][ T5852] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 629.236274][ T5852] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 629.238169][ T8835] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 629.539708][T20394] syzkaller0 speed is unknown, defaulting to 1000 [ 629.761798][T20449] A link change request failed with some changes committed already. Interface veth0_vlan may have been left with an inconsistent configuration, please check. [ 629.832866][ T6141] batadv1: left allmulticast mode [ 629.858108][ T6141] batadv1: left promiscuous mode [ 629.878190][ T6141] bridge0: port 1(batadv1) entered disabled state [ 630.215802][ T5852] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 630.287276][ T5743] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 630.355939][ T5765] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 631.199720][T20480] netlink: 'syz.0.3503': attribute type 23 has an invalid length. [ 631.370262][ T6141] batman_adv: batadv0: Removing interface: vlan2 [ 631.392024][ T6141] gretap0 (unregistering): left promiscuous mode [ 631.489053][ T6141] bond12 (unregistering): (slave geneve4): Releasing active interface [ 631.506211][ T6141] bond0 (unregistering): (slave geneve3): Releasing active interface [ 631.526538][ T6141] bond5 (unregistering): (slave geneve2): Releasing active interface [ 631.543399][ T6141] team0: Port device geneve1 removed [ 631.613645][ T6141] bond4 (unregistering): (slave bridge1): Removing an active aggregator [ 631.629339][ T6141] bond4 (unregistering): (slave bridge1): Releasing backup interface [ 631.650900][ T6141] bond8 (unregistering): (slave bridge2): Releasing active interface [ 631.711601][ T6141] bond18 (unregistering): (slave bridge5): Releasing active interface [ 631.742084][ T6141] bond1 (unregistering): Released all slaves [ 631.780676][ T6141] bond2 (unregistering): Released all slaves [ 631.828927][ T6141] bond3 (unregistering): Released all slaves [ 631.865482][ T6141] bond4 (unregistering): Released all slaves [ 631.920291][ T6141] bond5 (unregistering): Released all slaves [ 631.963660][ T6141] bond6 (unregistering): Released all slaves [ 632.007129][ T6141] bond7 (unregistering): (slave veth3): Releasing active interface [ 632.018054][ T6141] bond7 (unregistering): Released all slaves [ 632.043467][ T6141] bond0 (unregistering): Released all slaves [ 632.068467][ T6141] bond8 (unregistering): Released all slaves [ 632.093843][ T6141] bond9 (unregistering): Released all slaves [ 632.121027][ T6141] bond10 (unregistering): Released all slaves [ 632.152967][ T6141] bond11 (unregistering): Released all slaves [ 632.177411][ T6141] bond12 (unregistering): Released all slaves [ 632.202241][ T6141] bond13 (unregistering): Released all slaves [ 632.231396][ T6141] bond14 (unregistering): Released all slaves [ 632.252142][ T6141] bond15 (unregistering): Released all slaves [ 632.285699][ T6141] bond16 (unregistering): (slave veth9): Releasing backup interface [ 632.296281][ T6141] bond16 (unregistering): Released all slaves [ 632.315588][ T6141] bond17 (unregistering): Released all slaves [ 632.337891][ T6141] bond18 (unregistering): Released all slaves [ 632.366964][T20474] batadv0: entered promiscuous mode [ 632.374653][T20394] lo speed is unknown, defaulting to 1000 [ 632.781577][T20493] __nla_validate_parse: 9 callbacks suppressed [ 632.781597][T20493] netlink: 32 bytes leftover after parsing attributes in process `syz.1.3505'. [ 632.885341][T20489] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3505'. [ 632.895376][T20489] netlink: 'syz.1.3505': attribute type 30 has an invalid length. [ 633.181039][ T6141] 5nč: left promiscuous mode [ 633.314344][ T5852] net_ratelimit: 9 callbacks suppressed [ 633.314363][ T5852] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 633.395933][T20492] bridge_slave_0: left allmulticast mode [ 633.402359][T20492] bridge_slave_0: left promiscuous mode [ 633.404704][ T5852] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 633.418869][T20492] bridge0: port 1(bridge_slave_0) entered disabled state [ 633.457812][T20492] bridge_slave_1: left allmulticast mode [ 633.478211][T20492] bridge_slave_1: left promiscuous mode [ 633.493093][T20492] bridge0: port 2(bridge_slave_1) entered disabled state [ 633.533073][T20492] bond0: (slave bond_slave_0): Releasing backup interface [ 633.547391][T20492] bond0: (slave bond_slave_1): Releasing backup interface [ 633.565254][T20492] team0: Port device team_slave_0 removed [ 633.578231][T20492] team0: Port device team_slave_1 removed [ 633.587934][T20492] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 633.597478][T20492] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 633.610569][T20492] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 633.619311][T20492] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 633.632203][T20492] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 633.677112][ T6141] tipc: Disabling bearer [ 633.689132][ T6141] tipc: Left network mode [ 633.826879][T20516] Unsupported ieee802154 address type: 0 [ 633.846400][ T6134] netdevsim netdevsim1 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 634.149331][ T6134] netdevsim netdevsim1 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 634.158495][ T6134] netdevsim netdevsim1 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 634.167265][ T6134] netdevsim netdevsim1 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 634.360423][ T5852] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 634.360474][ T5750] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 634.388355][T20530] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3514'. [ 634.437575][ T5852] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 635.316351][ T8835] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 635.398274][ T5852] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 635.467065][T20564] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3520'. [ 635.485073][ T5852] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 635.609514][T20565] gretap1: entered allmulticast mode [ 635.801687][T20573] openvswitch: netlink: IP tunnel dst address not specified [ 636.389364][ T6134] smc: removing ib device syz2 [ 636.540205][ T8855] syzkaller0 speed is unknown, defaulting to 1000 [ 636.755600][ T6134] smbdirect: ib_dev[syz2] removed [ 636.922217][ T5650] Bluetooth: hci5: command 0x0406 tx timeout [ 637.669294][T20622] netlink: 148 bytes leftover after parsing attributes in process `syz.1.3536'. [ 637.930323][T20639] netlink: 40 bytes leftover after parsing attributes in process `syz.0.3541'. [ 638.088908][T20633] bond1: Removing last ns target with arp_interval on [ 638.268077][T20647] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3543'. [ 638.326586][T20633] bond2: Removing last ns target with arp_interval on [ 638.402191][ T998] net_ratelimit: 8 callbacks suppressed [ 638.402213][ T998] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 638.425621][T20651] netlink: 228 bytes leftover after parsing attributes in process `syz.1.3545'. [ 638.462438][T20633] bond3: Removing last ns target with arp_interval on [ 638.514543][ T5852] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 638.598226][ T8855] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 638.757767][T20633] workqueue: Failed to create a rescuer kthread for wq "bond4": -EINTR [ 638.843226][T20666] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3547'. [ 639.015491][T20658] syzkaller0: entered promiscuous mode [ 639.021287][T20668] netlink: 104 bytes leftover after parsing attributes in process `syz.4.3547'. [ 639.026964][T20658] syzkaller0: entered allmulticast mode [ 639.158048][T20673] ipt_ECN: cannot use operation on non-tcp rule [ 639.394898][T20678] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 639.502991][T20678] netlink: 52 bytes leftover after parsing attributes in process `syz.3.3550'. [ 639.527703][T20678] netlink: 56 bytes leftover after parsing attributes in process `syz.3.3550'. [ 639.554314][ T8855] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 639.639372][ T8855] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 639.754482][T20684] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 639.765318][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 639.957298][ T998] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 639.967391][T20694] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3553'. [ 640.162871][T20698] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3555'. [ 640.447794][ T8835] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 640.705190][T20712] netlink: 'syz.4.3557': attribute type 9 has an invalid length. [ 640.716301][ T30] audit: type=1800 audit(1780375169.468:22): pid=20709 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.3557" name="memory.events" dev="tmpfs" ino=597 res=0 errno=0 [ 640.778840][T20707] netlink: 'syz.4.3557': attribute type 5 has an invalid length. [ 640.794059][T20712] netlink: 212340 bytes leftover after parsing attributes in process `syz.4.3557'. [ 642.276738][T20738] syzkaller0: entered promiscuous mode [ 642.303340][T20738] syzkaller0: entered allmulticast mode [ 642.353344][T20744] netlink: 'syz.0.3563': attribute type 4 has an invalid length. [ 642.782424][T20749] ip6gre1: entered promiscuous mode [ 642.859825][T20749] ip6gre1: entered allmulticast mode [ 642.944386][T20754] __nla_validate_parse: 2 callbacks suppressed [ 642.944409][T20754] netlink: 1010 bytes leftover after parsing attributes in process `syz.2.3565'. [ 643.009281][T20754] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3565'. [ 643.111727][T20754] netlink: 220 bytes leftover after parsing attributes in process `syz.2.3565'. [ 643.474989][ T998] net_ratelimit: 9 callbacks suppressed [ 643.475032][ T998] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 643.498974][T20758] netlink: 'syz.4.3566': attribute type 4 has an invalid length. [ 643.539029][T20758] netlink: 17 bytes leftover after parsing attributes in process `syz.4.3566'. [ 643.651368][T20761] syzkaller0: entered promiscuous mode [ 643.682429][T20761] syzkaller0: entered allmulticast mode [ 643.715986][ T5852] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 643.759772][T20761] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3568'. [ 643.869252][T20761] netlink: 40 bytes leftover after parsing attributes in process `syz.0.3568'. [ 643.880258][ T5852] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 643.921759][T20761] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3568'. [ 644.159328][T20775] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3570'. [ 644.318597][T20775] hsr_slave_0: left promiscuous mode [ 644.359829][T20775] hsr_slave_1: left promiscuous mode [ 644.528064][ T998] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 644.765552][ T8855] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 644.881383][T20794] syzkaller0: entered promiscuous mode [ 644.909929][T20794] syzkaller0: entered allmulticast mode [ 644.917760][ T8855] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 645.033165][T20799] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3576'. [ 645.086644][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 645.277744][ T6141] veth1_to_team: left promiscuous mode [ 645.726105][ T8835] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 645.738175][T20818] netlink: 40 bytes leftover after parsing attributes in process `syz.2.3578'. [ 645.796357][ T8855] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 645.954271][ T5743] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 646.459704][T20791] syzkaller1: entered promiscuous mode [ 646.481899][T20791] syzkaller1: entered allmulticast mode [ 646.949010][ T6141] IPVS: stop unused estimator thread 0... [ 647.795313][T20848] netlink: 'syz.3.3588': attribute type 16 has an invalid length. [ 647.803491][T20848] netlink: 'syz.3.3588': attribute type 17 has an invalid length. [ 647.824513][T20848] bridge0: port 2(bridge_slave_1) entered blocking state [ 647.831798][T20848] bridge0: port 2(bridge_slave_1) entered forwarding state [ 647.839626][T20848] bridge0: port 1(bridge_slave_0) entered blocking state [ 647.846939][T20848] bridge0: port 1(bridge_slave_0) entered forwarding state [ 647.859654][T20848] bridge0: left promiscuous mode [ 647.864880][T20848] bridge0: left allmulticast mode [ 647.967678][T20848] 8021q: adding VLAN 0 to HW filter on device bond1 [ 647.980864][T20848] 8021q: adding VLAN 0 to HW filter on device bond2 [ 647.991458][T20848] 8021q: adding VLAN 0 to HW filter on device bond3 [ 648.001039][ T8855] lo speed is unknown, defaulting to 1000 [ 648.540184][T20810] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 648.552808][ T5750] net_ratelimit: 13 callbacks suppressed [ 648.552823][ T5750] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 648.824662][T20858] __nla_validate_parse: 2 callbacks suppressed [ 648.824684][T20858] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3589'. [ 648.845136][ T8855] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 648.856714][ T8855] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 648.864900][ T8855] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 648.877130][ T8835] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 648.902231][T20858] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3589'. [ 648.914612][ T8853] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 648.942713][ T8835] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 648.951179][T20862] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3589'. [ 648.951208][T20862] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3589'. [ 648.951436][T20862] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3589'. [ 648.951454][T20862] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3589'. [ 648.989583][ T8835] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 649.002237][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 649.064146][T20868] netlink: 40 bytes leftover after parsing attributes in process `syz.3.3591'. [ 649.075401][ T8853] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 649.192885][T20872] x_tables: ip6_tables: TCPMSS target: only valid for protocol 6 [ 649.258999][T20875] netlink: 56 bytes leftover after parsing attributes in process `syz.0.3595'. [ 649.556562][T20889] netlink: 'syz.2.3600': attribute type 1 has an invalid length. [ 649.880822][T20904] netlink: 32 bytes leftover after parsing attributes in process `syz.1.3604'. [ 649.892106][T20903] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3603'. [ 650.179303][T20913] xt_hashlimit: max too large, truncated to 1048576 [ 650.229843][T20913] Cannot find set identified by id 1 to match [ 650.308723][ T30] audit: type=1107 audit(1780375179.068:23): pid=20914 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='' [ 651.202602][T20958] tipc: Started in network mode [ 651.219199][T20958] tipc: Node identity ca353f5c1de2, cluster identity 4711 [ 651.247922][T20958] tipc: Enabled bearer , priority 0 [ 651.272048][T20961] syzkaller0: entered promiscuous mode [ 651.293654][T20961] syzkaller0: entered allmulticast mode [ 651.296616][ T8835] IPVS: starting estimator thread 0... [ 651.408684][T20956] tipc: Resetting bearer [ 651.415237][T20966] IPVS: using max 25 ests per chain, 60000 per kthread [ 651.487908][T20956] tipc: Disabling bearer [ 651.822362][T20974] netlink: 'syz.2.3624': attribute type 1 has an invalid length. [ 652.315449][T20983] netlink: 'syz.3.3627': attribute type 21 has an invalid length. [ 652.439204][T20953] lo speed is unknown, defaulting to 1000 [ 653.752924][T21035] netlink: 'syz.1.3643': attribute type 2 has an invalid length. [ 653.761827][T21035] netlink: 'syz.1.3643': attribute type 11 has an invalid length. [ 653.949970][T21039] __nla_validate_parse: 14 callbacks suppressed [ 653.949990][T21039] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3644'. [ 653.968155][T21039] bridge0: port 2(bridge_slave_1) entered disabled state [ 653.982643][T21039] bridge_slave_1 (unregistering): left allmulticast mode [ 653.989978][T21039] bridge_slave_1 (unregistering): left promiscuous mode [ 653.997336][T21039] bridge0: port 2(bridge_slave_1) entered disabled state [ 654.115985][ T8853] net_ratelimit: 19 callbacks suppressed [ 654.116007][ T8853] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 654.277439][ T8855] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 654.684393][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 654.844438][ T5750] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 655.157045][ T8853] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 655.330686][ T8855] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 655.776532][T20999] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 655.960107][ T8855] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 656.196340][ T8855] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 656.274509][ T5765] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 656.361165][T21050] netlink: 44 bytes leftover after parsing attributes in process `syz.1.3648'. [ 656.395512][ T5743] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 656.472731][T21054] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci4/hci4:200/input5 [ 657.731072][T21117] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3668'. [ 657.808322][T21124] mapping of prio or/and queue is allowed only from OUTPUT/FORWARD/POSTROUTING chains [ 657.827257][T21123] mapping of prio or/and queue is allowed only from OUTPUT/FORWARD/POSTROUTING chains [ 657.895150][T21121] netlink: 'syz.2.3668': attribute type 1 has an invalid length. [ 657.909289][T21130] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3672'. [ 657.929875][T21123] workqueue: Failed to create a rescuer kthread for wq "wg-crypt-wireguard%d": -EINTR [ 657.995049][T21117] erspan1: entered allmulticast mode [ 658.122684][T21140] netlink: 'syz.1.3674': attribute type 1 has an invalid length. [ 658.158668][T21140] netlink: 'syz.1.3674': attribute type 2 has an invalid length. [ 658.184046][T21140] netlink: 'syz.1.3674': attribute type 2 has an invalid length. [ 658.219804][T21140] netlink: 'syz.1.3674': attribute type 2 has an invalid length. [ 658.253034][T21140] netlink: 'syz.1.3674': attribute type 1 has an invalid length. [ 658.269578][T21137] bridge2: port 1(veth3) entered blocking state [ 658.279316][T21140] netlink: 'syz.1.3674': attribute type 2 has an invalid length. [ 658.290022][T21137] bridge2: port 1(veth3) entered disabled state [ 658.302543][T21137] veth3: entered allmulticast mode [ 658.328927][T21137] veth3: entered promiscuous mode [ 658.368580][T21130] bridge2: port 2(veth0_to_bond) entered blocking state [ 658.393548][T21130] bridge2: port 2(veth0_to_bond) entered disabled state [ 658.440278][T21130] veth0_to_bond: entered allmulticast mode [ 658.457883][T21130] veth0_to_bond: entered promiscuous mode [ 658.771896][T21149] syzkaller1: default qdisc (pfifo_fast) fail, fallback to noqueue [ 658.919703][T21171] netlink: 'syz.3.3683': attribute type 1 has an invalid length. [ 658.943755][T21171] netlink: 'syz.3.3683': attribute type 1 has an invalid length. [ 658.958003][T21171] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3683'. [ 658.982852][T21171] netlink: 1 bytes leftover after parsing attributes in process `syz.3.3683'. [ 659.137563][T21184] macvlan1: entered allmulticast mode [ 659.154468][ T5750] net_ratelimit: 5 callbacks suppressed [ 659.154487][ T5750] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 659.174376][ T8835] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 659.318531][ T5743] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 659.326753][ T5743] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 659.422279][T21194] x_tables: unsorted underflow at hook 4 [ 659.555899][ T5743] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 659.872146][T21216] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 659.882844][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 660.040033][T21158] lo speed is unknown, defaulting to 1000 [ 660.244836][T21225] FAULT_INJECTION: forcing a failure. [ 660.244836][T21225] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 660.274678][T21225] CPU: 0 UID: 0 PID: 21225 Comm: syz.1.3697 Not tainted syzkaller #0 PREEMPT(full) [ 660.274707][T21225] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 660.274718][T21225] Call Trace: [ 660.274726][T21225] [ 660.274734][T21225] dump_stack_lvl+0xe8/0x150 [ 660.274761][T21225] should_fail_ex+0x412/0x560 [ 660.274789][T21225] _copy_from_user+0x2d/0xb0 [ 660.274814][T21225] ___sys_recvmsg+0x175/0x590 [ 660.274842][T21225] ? __pfx____sys_recvmsg+0x10/0x10 [ 660.274870][T21225] ? __fget_files+0x2a/0x420 [ 660.274912][T21225] ? __fget_files+0x3a0/0x420 [ 660.274946][T21225] do_recvmmsg+0x334/0x800 [ 660.274978][T21225] ? __pfx_do_recvmmsg+0x10/0x10 [ 660.275013][T21225] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 660.275054][T21225] __x64_sys_recvmmsg+0x198/0x250 [ 660.275079][T21225] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 660.275111][T21225] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 660.275133][T21225] do_syscall_64+0x174/0x580 [ 660.275154][T21225] ? clear_bhb_loop+0x40/0x90 [ 660.275177][T21225] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 660.275197][T21225] RIP: 0033:0x7fdcb859ce59 [ 660.275215][T21225] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 660.275231][T21225] RSP: 002b:00007fdcb94aa028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 660.275252][T21225] RAX: ffffffffffffffda RBX: 00007fdcb8815fa0 RCX: 00007fdcb859ce59 [ 660.275265][T21225] RDX: 0000000000000001 RSI: 0000200000000080 RDI: 0000000000000003 [ 660.275276][T21225] RBP: 00007fdcb94aa090 R08: 0000000000000000 R09: 0000000000000000 [ 660.275287][T21225] R10: 0000000000000002 R11: 0000000000000246 R12: 0000000000000001 [ 660.275298][T21225] R13: 00007fdcb8816038 R14: 00007fdcb8815fa0 R15: 00007ffe5a406758 [ 660.275330][T21225] [ 660.470925][ T5750] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 660.480910][ T5750] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 660.500038][ T160] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 660.630837][T21232] netlink: 32 bytes leftover after parsing attributes in process `syz.3.3699'. [ 660.692163][T21234] netlink: 88 bytes leftover after parsing attributes in process `syz.1.3701'. [ 660.765786][T21234] netlink: 212408 bytes leftover after parsing attributes in process `syz.1.3701'. [ 661.294944][T21245] syzkaller0: entered promiscuous mode [ 661.300638][T21245] syzkaller0: entered allmulticast mode [ 661.618142][T21277] netlink: 60 bytes leftover after parsing attributes in process `syz.0.3711'. [ 661.692651][T21280] FAULT_INJECTION: forcing a failure. [ 661.692651][T21280] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 661.741228][T21280] CPU: 1 UID: 0 PID: 21280 Comm: syz.2.3712 Not tainted syzkaller #0 PREEMPT(full) [ 661.741262][T21280] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 661.741274][T21280] Call Trace: [ 661.741282][T21280] [ 661.741290][T21280] dump_stack_lvl+0xe8/0x150 [ 661.741318][T21280] should_fail_ex+0x412/0x560 [ 661.741346][T21280] _copy_to_user+0x31/0xb0 [ 661.741374][T21280] simple_read_from_buffer+0xe1/0x170 [ 661.741414][T21280] proc_fail_nth_read+0x1bb/0x230 [ 661.741442][T21280] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 661.741471][T21280] ? rw_verify_area+0x2a6/0x4d0 [ 661.741497][T21280] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 661.741524][T21280] vfs_read+0x20c/0xa70 [ 661.741557][T21280] ? __pfx___mutex_lock+0x10/0x10 [ 661.741580][T21280] ? __pfx_vfs_read+0x10/0x10 [ 661.741609][T21280] ? __fget_files+0x2a/0x420 [ 661.741636][T21280] ? __fget_files+0x3a0/0x420 [ 661.741657][T21280] ? __fget_files+0x2a/0x420 [ 661.741691][T21280] ksys_read+0x150/0x270 [ 661.741721][T21280] ? __pfx_ksys_read+0x10/0x10 [ 661.741758][T21280] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 661.741780][T21280] do_syscall_64+0x174/0x580 [ 661.741802][T21280] ? clear_bhb_loop+0x40/0x90 [ 661.741826][T21280] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 661.741844][T21280] RIP: 0033:0x7f7e6655d68e [ 661.741864][T21280] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 661.741879][T21280] RSP: 002b:00007f7e674a7fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 661.741900][T21280] RAX: ffffffffffffffda RBX: 00007f7e674a86c0 RCX: 00007f7e6655d68e [ 661.741913][T21280] RDX: 000000000000000f RSI: 00007f7e674a80a0 RDI: 0000000000000004 [ 661.741925][T21280] RBP: 00007f7e674a8090 R08: 0000000000000000 R09: 0000000000000000 [ 661.741936][T21280] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 661.741947][T21280] R13: 00007f7e66816038 R14: 00007f7e66815fa0 R15: 00007ffea8411548 [ 661.741980][T21280] [ 662.230073][T21294] netlink: 'syz.4.3716': attribute type 16 has an invalid length. [ 662.291362][T21295] No such timeout policy "syz1" [ 662.762837][T21304] netlink: 88 bytes leftover after parsing attributes in process `syz.0.3717'. [ 662.778198][T21304] netlink: 212408 bytes leftover after parsing attributes in process `syz.0.3717'. [ 664.684429][ T5852] net_ratelimit: 20 callbacks suppressed [ 664.684452][ T5852] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 664.844723][ T5743] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 665.234527][ T5750] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 665.719128][ T8855] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 665.875433][ T8855] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 666.325363][T21294] ipip0: entered promiscuous mode [ 666.668549][T21324] netlink: 'syz.0.3722': attribute type 1 has an invalid length. [ 666.754202][ T5852] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 666.762376][ T5852] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 666.809272][T21324] 8021q: adding VLAN 0 to HW filter on device bond1 [ 666.919904][ T8855] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 666.997644][T21338] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3725'. [ 667.019501][T21341] netlink: 68 bytes leftover after parsing attributes in process `syz.2.3727'. [ 667.050735][T21339] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3725'. [ 667.060274][ T8855] IPVS: starting estimator thread 0... [ 667.069625][T21333] bond1: (slave veth3): Enslaving as an active interface with a down link [ 667.119417][T21334] bond1: (slave dummy0): making interface the new active one [ 667.146695][T21334] dummy0: entered promiscuous mode [ 667.157691][T21334] bond1: (slave dummy0): Enslaving as an active interface with an up link [ 667.166647][T21346] IPVS: using max 28 ests per chain, 67200 per kthread [ 667.198864][T21341] bridge1: entered promiscuous mode [ 667.211610][T21343] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 667.634179][ T5650] Bluetooth: hci1: command 0x0406 tx timeout [ 667.796496][ T8855] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 668.092208][T21384] Bluetooth: MGMT ver 1.23 [ 668.317801][T21391] mac80211_hwsim hwsim52 ŖŖŖŖŖ;: renamed from wlan0 (while UP) [ 668.342505][T21391] syz.3.3740: vmalloc error: size 8589938688, exceeds total pages, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 668.378719][T21391] CPU: 0 UID: 0 PID: 21391 Comm: syz.3.3740 Not tainted syzkaller #0 PREEMPT(full) [ 668.378748][T21391] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 668.378759][T21391] Call Trace: [ 668.378767][T21391] [ 668.378775][T21391] dump_stack_lvl+0xe8/0x150 [ 668.378805][T21391] warn_alloc+0x249/0x340 [ 668.378834][T21391] ? stack_trace_save+0xa9/0x100 [ 668.378865][T21391] ? __pfx_warn_alloc+0x10/0x10 [ 668.378899][T21391] ? kasan_save_track+0x4f/0x80 [ 668.378922][T21391] ? kasan_save_track+0x3e/0x80 [ 668.378945][T21391] ? __kasan_kmalloc+0x93/0xb0 [ 668.378969][T21391] ? __kmalloc_cache_noprof+0x31c/0x660 [ 668.378992][T21391] ? xskq_create+0x56/0x170 [ 668.379018][T21391] ? xsk_setsockopt+0x54c/0x990 [ 668.379037][T21391] ? do_sock_setsockopt+0x17c/0x1b0 [ 668.379056][T21391] ? __x64_sys_setsockopt+0x13d/0x1b0 [ 668.379073][T21391] ? do_syscall_64+0x174/0x580 [ 668.379096][T21391] __vmalloc_node_range_noprof+0x132/0x1750 [ 668.379155][T21391] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 668.379188][T21391] ? __kasan_kmalloc+0x93/0xb0 [ 668.379227][T21391] vmalloc_user_noprof+0xad/0xe0 [ 668.379252][T21391] ? xskq_create+0xbf/0x170 [ 668.379277][T21391] xskq_create+0xbf/0x170 [ 668.379305][T21391] xsk_init_queue+0x8a/0xe0 [ 668.379332][T21391] xsk_setsockopt+0x54c/0x990 [ 668.379369][T21391] ? __pfx_xsk_setsockopt+0x10/0x10 [ 668.379394][T21391] ? __pfx_aa_sk_perm+0x10/0x10 [ 668.379431][T21391] ? aa_sock_opt_perm+0xff/0x1a0 [ 668.379459][T21391] ? bpf_lsm_socket_setsockopt+0x9/0x20 [ 668.379484][T21391] ? __pfx_xsk_setsockopt+0x10/0x10 [ 668.379509][T21391] do_sock_setsockopt+0x17c/0x1b0 [ 668.379536][T21391] __x64_sys_setsockopt+0x13d/0x1b0 [ 668.379559][T21391] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 668.379579][T21391] do_syscall_64+0x174/0x580 [ 668.379597][T21391] ? trace_irq_disable+0x3b/0x140 [ 668.379623][T21391] ? clear_bhb_loop+0x40/0x90 [ 668.379647][T21391] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 668.379665][T21391] RIP: 0033:0x7fb12939ce59 [ 668.379684][T21391] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 668.379700][T21391] RSP: 002b:00007fb12a1e8028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 668.379720][T21391] RAX: ffffffffffffffda RBX: 00007fb129616090 RCX: 00007fb12939ce59 [ 668.379733][T21391] RDX: 0000000000000006 RSI: 000000000000011b RDI: 0000000000000009 [ 668.379744][T21391] RBP: 00007fb129432d6f R08: 0000000000000004 R09: 0000000000000000 [ 668.379755][T21391] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000000 [ 668.379765][T21391] R13: 00007fb129616128 R14: 00007fb129616090 R15: 00007ffebf3cbaa8 [ 668.379798][T21391] [ 668.381113][T21391] Mem-Info: [ 668.610708][T21400] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3742'. [ 668.675257][T21391] active_anon:10598 inactive_anon:134 isolated_anon:0 [ 668.675257][T21391] active_file:3153 inactive_file:40596 isolated_file:0 [ 668.675257][T21391] unevictable:768 dirty:241 writeback:0 [ 668.675257][T21391] slab_reclaimable:12274 slab_unreclaimable:117542 [ 668.675257][T21391] mapped:33613 shmem:4305 pagetables:1309 [ 668.675257][T21391] sec_pagetables:0 bounce:0 [ 668.675257][T21391] kernel_misc_reclaimable:0 [ 668.675257][T21391] free:1288810 free_pcp:15826 free_cma:0 [ 668.725366][T21391] Node 0 active_anon:42392kB inactive_anon:536kB active_file:12612kB inactive_file:162180kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:134452kB dirty:964kB writeback:0kB shmem:15684kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:14112kB pagetables:5128kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 668.771923][T21391] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:32kB pagetables:108kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 668.807776][T21391] Node 0 DMA free:15352kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:8kB local_pcp:0kB free_cma:0kB [ 668.852842][T21391] lowmem_reserve[]: 0 2492 2493 2493 2493 [ 668.860115][T21391] Node 0 DMA32 free:1228344kB boost:0kB min:34188kB low:42732kB high:51276kB reserved_highatomic:0KB free_highatomic:0KB active_anon:42292kB inactive_anon:536kB active_file:12612kB inactive_file:162180kB unevictable:1536kB writepending:964kB zspages:0kB present:3129332kB managed:2552608kB mlocked:0kB bounce:0kB free_pcp:35200kB local_pcp:13608kB free_cma:0kB [ 668.896583][T21391] lowmem_reserve[]: 0 0 0 0 0 [ 668.901929][T21391] Node 0 Normal free:0kB boost:0kB min:8kB low:8kB high:8kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:672kB mlocked:0kB bounce:0kB free_pcp:4kB local_pcp:4kB free_cma:0kB [ 668.941527][T21391] lowmem_reserve[]: 0 0 0 0 0 [ 668.949050][T21391] Node 1 Normal free:3911544kB boost:0kB min:55704kB low:69628kB high:83552kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:1536kB writepending:0kB zspages:0kB present:4194300kB managed:4111100kB mlocked:0kB bounce:0kB free_pcp:28700kB local_pcp:28700kB free_cma:0kB [ 668.984019][T21391] lowmem_reserve[]: 0 0 0 0 0 [ 668.989226][T21391] Node 0 DMA: 0*4kB 1*8kB (U) 1*16kB (U) 1*32kB (U) 1*64kB (U) 1*128kB (U) 1*256kB (U) 1*512kB (U) 2*1024kB (U) 2*2048kB (UM) 2*4096kB (M) = 15352kB [ 669.023745][T21391] Node 0 DMA32: 6786*4kB (UME) 5815*8kB (UM) 3366*16kB (UME) 501*32kB (UME) 581*64kB (UME) 890*128kB (UME) 651*256kB (UME) 376*512kB (UM) 223*1024kB (U) 129*2048kB (UME) 20*4096kB (UM) = 1228288kB [ 669.050398][T21391] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 669.063493][T21391] Node 1 Normal: 1*4kB (U) 7*8kB (UM) 13*16kB (UM) 11*32kB (UM) 9*64kB (UM) 4*128kB (UM) 3*256kB (UM) 5*512kB (UM) 3*1024kB (UM) 2*2048kB (U) 952*4096kB (UM) = 3911596kB [ 669.086905][T21391] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 669.102634][T21391] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 669.113430][T21391] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 669.127923][T21391] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 669.138614][T21391] 48050 total pagecache pages [ 669.143733][T21391] 0 pages in swap cache [ 669.151389][T21391] Free swap = 124996kB [ 669.160084][T21415] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3747'. [ 669.164544][T21391] Total swap = 124996kB [ 669.173789][T21391] 2097051 pages RAM [ 669.178576][T21391] 0 pages HighMem/MovableOnly [ 669.183569][T21391] 427116 pages reserved [ 669.188347][T21391] 0 pages cma reserved [ 669.412112][ T5650] block nbd1: Receive control failed (result -32) [ 669.412112][ T50] block nbd1: Receive control failed (result -32) [ 669.459785][T21429] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3750'. [ 669.810206][T21444] netlink: 88 bytes leftover after parsing attributes in process `syz.3.3752'. [ 670.052763][ T5743] net_ratelimit: 5 callbacks suppressed [ 670.052782][ T5743] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 670.537596][T21476] netlink: 35220 bytes leftover after parsing attributes in process `syz.2.3762'. [ 670.678172][ T8835] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 670.828601][T21484] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3765'. [ 671.087746][ T5743] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 671.127141][T21463] lo speed is unknown, defaulting to 1000 [ 671.173069][T21489] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3766'. [ 671.214694][T21489] netlink: 'syz.1.3766': attribute type 1 has an invalid length. [ 671.334099][T21499] netlink: 'syz.3.3768': attribute type 2 has an invalid length. [ 671.347395][T21499] tipc: Cannot configure node identity twice [ 672.172005][ T5743] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 672.435554][ T8835] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 672.568835][T21544] __nla_validate_parse: 3 callbacks suppressed [ 672.568856][T21544] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3779'. [ 673.105340][T21567] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3783'. [ 673.176386][T21567] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3783'. [ 673.194737][ T5650] Bluetooth: hci4: link tx timeout [ 673.201676][ T5650] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 673.285662][ T5852] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 673.418350][T21575] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3787'. [ 673.612831][T21590] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3792'. [ 673.615203][T21582] netlink: 'syz.1.3790': attribute type 9 has an invalid length. [ 673.668256][T21591] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3792'. [ 673.749220][T21594] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 673.879443][ T5750] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 674.129398][T21616] tipc: Cannot configure node identity twice [ 674.151097][T21616] tipc: Cannot configure node identity twice [ 674.270801][T21623] netlink: 'syz.4.3800': attribute type 1 has an invalid length. [ 674.296880][T21623] netlink: 88 bytes leftover after parsing attributes in process `syz.4.3800'. [ 674.336870][T21623] netlink: 'syz.4.3800': attribute type 1 has an invalid length. [ 674.348499][ T6141] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 674.376133][T21623] netlink: 634 bytes leftover after parsing attributes in process `syz.4.3800'. [ 674.399277][ T5743] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 674.438950][ T6141] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 674.474016][ T6141] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 674.513582][ T6141] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 675.255505][ T50] Bluetooth: hci4: command 0x0406 tx timeout [ 675.404688][T21666] netlink: 44 bytes leftover after parsing attributes in process `syz.0.3807'. [ 675.475165][ T5743] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 675.827521][T21679] siw: device registration error -23 [ 676.121363][T21690] netlink: 'syz.0.3813': attribute type 1 has an invalid length. [ 676.251545][T21690] bond2: entered promiscuous mode [ 676.257398][T21690] 8021q: adding VLAN 0 to HW filter on device bond2 [ 676.437441][ T5750] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 676.446264][T21704] pim6reg: entered allmulticast mode [ 676.551599][ T5743] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 676.914474][ T5750] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 677.058736][T21719] netlink: 240 bytes leftover after parsing attributes in process `syz.2.3821'. [ 677.461119][T21729] dvmrp0: entered allmulticast mode [ 677.467700][T21701] lo speed is unknown, defaulting to 1000 [ 677.468884][T21703] pim6reg: left allmulticast mode [ 677.582522][ T5852] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 677.602076][T21732] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3823'. [ 678.118535][T21738] tipc: Failed to remove unknown binding: 66,1,1/0:3237678081/3237678083 [ 678.160093][T21738] tipc: Failed to remove unknown binding: 66,1,1/0:3237678081/3237678083 [ 678.204429][T21738] tipc: Failed to remove unknown binding: 66,1,1/0:3237678081/3237678083 [ 678.233580][T21738] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3825'. [ 678.285380][T21741] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3826'. [ 678.361911][ T5750] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 678.373460][T21741] netlink: 'syz.4.3826': attribute type 4 has an invalid length. [ 678.525466][ T160] dummy0: left promiscuous mode [ 678.606271][ T5852] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 678.683150][T21755] netlink: 212408 bytes leftover after parsing attributes in process `syz.1.3831'. [ 679.407831][T21764] mac80211_hwsim hwsim46 syzkaller0: left promiscuous mode [ 679.426395][T21764] mac80211_hwsim hwsim46 syzkaller0: left allmulticast mode [ 679.616496][T21786] syzkaller0: entered promiscuous mode [ 679.635396][T21786] syzkaller0: entered allmulticast mode [ 679.641374][ T5743] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 679.954968][ T5765] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 680.256823][T21813] gtp1: entered promiscuous mode [ 680.295579][T21813] gtp1: entered allmulticast mode [ 680.342920][T21813] team0: Device gtp1 is of different type [ 680.406250][T21817] netlink: 212408 bytes leftover after parsing attributes in process `syz.1.3844'. [ 680.674871][ T5743] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 680.971401][T21835] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3848'. [ 681.715831][ T5743] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 681.747437][T21867] netlink: 212408 bytes leftover after parsing attributes in process `syz.2.3856'. [ 681.862806][T21868] netlink: 16186 bytes leftover after parsing attributes in process `syz.4.3855'. [ 681.947689][T21875] netlink: 104 bytes leftover after parsing attributes in process `syz.2.3857'. [ 681.999353][T21875] netlink: 'syz.2.3857': attribute type 2 has an invalid length. [ 682.171047][T21880] netlink: 'syz.0.3858': attribute type 1 has an invalid length. [ 682.242727][T21880] bond3: entered promiscuous mode [ 682.249335][T21880] 8021q: adding VLAN 0 to HW filter on device bond3 [ 682.282479][T21880] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3858'. [ 682.318673][T21880] netlink: 'syz.0.3858': attribute type 11 has an invalid length. [ 682.443658][T21880] bond3: (slave bridge2): making interface the new active one [ 682.469462][T21880] bridge2: entered promiscuous mode [ 682.519565][T21880] bond3: (slave bridge2): Enslaving as an active interface with an up link [ 682.578559][T21884] macvlan2: entered promiscuous mode [ 682.584445][T21884] bond0: entered promiscuous mode [ 682.589683][T21884] bond_slave_0: entered promiscuous mode [ 682.602328][T21884] bond_slave_1: entered promiscuous mode [ 682.659842][T21884] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 682.779785][ T5852] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 682.789573][T21896] Cannot find add_set index 0 as target [ 682.861906][T21895] __nla_validate_parse: 3 callbacks suppressed [ 682.861961][T21895] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3862'. [ 682.925960][T21895] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3862'. [ 682.999770][ T5765] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 683.179059][T21912] netlink: 212408 bytes leftover after parsing attributes in process `syz.4.3867'. [ 683.236238][T21909] syzkaller1: entered promiscuous mode [ 683.263445][T21909] syzkaller1: entered allmulticast mode [ 683.376486][T21909] netdevsim netdevsim0 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 683.538911][T21915] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3868'. [ 683.559390][T21931] bond5: option lacp_rate: mode dependency failed, not supported in mode active-backup(1) [ 683.579711][T21931] bond5 (unregistering): Released all slaves [ 683.671025][T21909] netdevsim netdevsim0 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 683.805324][ T8853] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 683.859057][T21909] netdevsim netdevsim0 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 683.969894][T21909] netdevsim netdevsim0 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 684.214854][ T5852] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 684.408554][T21943] bridge0: port 2(bridge_slave_1) entered disabled state [ 684.416377][T21943] bridge0: port 1(bridge_slave_0) entered disabled state [ 684.446867][T21943] bridge0: entered allmulticast mode [ 684.508197][T21951] bridge_slave_1: left allmulticast mode [ 684.537860][T21951] bridge_slave_1: left promiscuous mode [ 684.567058][T21951] bridge0: port 2(bridge_slave_1) entered disabled state [ 684.602856][T21951] bridge_slave_0: left allmulticast mode [ 684.624342][T21951] bridge_slave_0: left promiscuous mode [ 684.642307][T21951] bridge0: port 1(bridge_slave_0) entered disabled state [ 684.668640][T21969] netlink: 'syz.1.3877': attribute type 1 has an invalid length. [ 684.689765][T21969] netlink: 'syz.1.3877': attribute type 1 has an invalid length. [ 684.835651][ T8855] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 685.040543][ T6144] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 685.072492][T21978] netlink: 212408 bytes leftover after parsing attributes in process `syz.1.3880'. [ 685.119593][ T6144] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 685.172282][ T6144] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 685.234501][T21984] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 685.234783][T21985] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3882'. [ 685.246050][ T160] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 685.277366][T21987] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3881'. [ 685.290893][T21983] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3882'. [ 685.352109][T21996] xt_TPROXY: Can be used only with -p tcp or -p udp [ 685.417000][T22001] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3885'. [ 685.427198][T21985] bond5: option broadcast_neighbor: mode dependency failed, not supported in mode balance-rr(0) [ 685.443576][T21985] bond5 (unregistering): Released all slaves [ 685.509573][T21987] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 685.536508][T21983] workqueue: Failed to create a rescuer kthread for wq "bond5": -EINTR [ 685.538003][T21999] IPVS: Unknown mcast interface: ipvlan1 [ 685.717502][T22009] syzkaller0: entered promiscuous mode [ 685.727338][T22009] syzkaller0: entered allmulticast mode [ 685.900753][ T8855] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 685.919104][T22016] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 685.929913][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 686.161436][T22025] netlink: 132 bytes leftover after parsing attributes in process `syz.3.3892'. [ 686.207644][ T8853] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 686.462891][T22034] xt_cgroup: xt_cgroup: no path or classid specified [ 686.784784][ T5743] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 686.866234][T22050] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci4/hci4:200/input6 [ 686.915140][ T8855] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 687.234966][ T5750] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 687.570661][T22070] xt_CT: No such helper "snmp" [ 687.699193][T22077] sctp: [Deprecated]: syz.4.3903 (pid 22077) Use of struct sctp_assoc_value in delayed_ack socket option. [ 687.699193][T22077] Use struct sctp_sack_info instead [ 687.855181][T22038] lo speed is unknown, defaulting to 1000 [ 687.958757][ T8855] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 687.987627][ T5765] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 688.101577][T22089] __nla_validate_parse: 3 callbacks suppressed [ 688.101599][T22089] netlink: 212408 bytes leftover after parsing attributes in process `syz.4.3907'. [ 688.408578][T22099] netlink: 204 bytes leftover after parsing attributes in process `syz.2.3908'. [ 688.547062][T22097] netlink: 'syz.1.3904': attribute type 1 has an invalid length. [ 688.599803][ T5765] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 688.619523][T22103] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3909'. [ 688.789019][T22097] 8021q: adding VLAN 0 to HW filter on device bond3 [ 688.841299][T22101] batadv0: left promiscuous mode [ 688.870028][T22101] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 688.966544][T22101] bond3: (slave batadv0): Enslaving as a backup interface with an up link [ 689.372136][T22139] netlink: 244 bytes leftover after parsing attributes in process `syz.1.3915'. [ 689.479781][T22145] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3915'. [ 689.669082][T22149] netlink: 48 bytes leftover after parsing attributes in process `syz.0.3917'. [ 689.977145][T22145] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3915'. [ 690.137911][T22164] netlink: 212408 bytes leftover after parsing attributes in process `syz.4.3919'. [ 690.497955][T22173] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3922'. [ 690.499822][T22171] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3921'. [ 690.647367][T22171] 8021q: adding VLAN 0 to HW filter on device bond4 [ 691.201342][ T5852] net_ratelimit: 5 callbacks suppressed [ 691.201365][ T5852] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 691.217760][ T8853] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 691.274778][T22211] netlink: 'syz.3.3931': attribute type 8 has an invalid length. [ 691.894848][T22234] netlink: 'syz.2.3934': attribute type 10 has an invalid length. [ 692.262285][T22236] team_slave_1: entered promiscuous mode [ 692.356530][ T8853] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 692.521902][T22252] IPVS: set_ctl: invalid protocol: 50 224.0.0.1:20000 [ 693.036156][T22267] netlink: 'syz.0.3947': attribute type 1 has an invalid length. [ 693.234229][ T5650] Bluetooth: hci3: command 0x0406 tx timeout [ 693.316738][ T8835] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 693.394365][ T5852] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 693.535611][T22276] netlink: 'syz.4.3950': attribute type 13 has an invalid length. [ 693.900384][T22278] __nla_validate_parse: 14 callbacks suppressed [ 693.900407][T22278] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3950'. [ 693.952234][T22289] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3953'. [ 694.056672][T22281] ’’’’’’: renamed from vlan0 (while UP) [ 694.070993][T22255] lo speed is unknown, defaulting to 1000 [ 694.143154][T22290] netlink: 40 bytes leftover after parsing attributes in process `syz.0.3952'. [ 694.435573][ T8853] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 694.482789][T22304] netlink: 212408 bytes leftover after parsing attributes in process `syz.1.3956'. [ 695.474425][ T8853] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 695.714412][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 696.361261][ T5765] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 696.515981][ T8855] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 696.774504][T22316] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3958'. [ 696.808671][T22315] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 696.868755][T22287] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 697.402069][T22331] netlink: 67 bytes leftover after parsing attributes in process `syz.4.3964'. [ 697.489570][T22333] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3965'. [ 697.529733][T22336] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3966'. [ 697.553697][T22336] netlink: 'syz.1.3966': attribute type 7 has an invalid length. [ 697.564072][ T5852] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 697.587912][T22336] netlink: 'syz.1.3966': attribute type 8 has an invalid length. [ 697.589400][T22339] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3968'. [ 697.626594][T22340] netlink: 'syz.1.3966': attribute type 62 has an invalid length. [ 697.669538][T22336] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3966'. [ 697.717092][T22336] team0: entered promiscuous mode [ 697.722573][T22336] team_slave_0: entered promiscuous mode [ 697.730654][T22336] team_slave_1: entered promiscuous mode [ 697.746060][T22336] bond0: entered promiscuous mode [ 697.751727][T22336] bond_slave_0: entered promiscuous mode [ 697.759668][T22336] bond_slave_1: entered promiscuous mode [ 697.772830][T22336] erspan0: entered promiscuous mode [ 697.781254][T22348] netlink: 'syz.2.3969': attribute type 1 has an invalid length. [ 697.785746][T22336] 8021q: adding VLAN 0 to HW filter on device hsr0 [ 697.897381][T22348] bond3: entered promiscuous mode [ 697.906694][T22348] 8021q: adding VLAN 0 to HW filter on device bond3 [ 697.930934][T22351] bond3: (slave bridge2): making interface the new active one [ 697.939741][T22351] bridge2: entered promiscuous mode [ 697.946852][T22351] bond3: (slave bridge2): Enslaving as an active interface with an up link [ 698.058529][T22339] 8021q: adding VLAN 0 to HW filter on device bond4 [ 698.070080][T22339] bond3: (slave bond4): Enslaving as an active interface with an up link [ 698.082789][T22342] 8021q: adding VLAN 0 to HW filter on device bond3 [ 698.226362][ T8835] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 698.584803][T22376] macvlan2: entered promiscuous mode [ 698.601696][ T5852] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 698.620372][T22376] macvlan2: entered allmulticast mode [ 698.643067][T22376] team0: Device macvlan2 is already an upper device of the team interface [ 698.834343][ T8853] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 699.001755][T22391] __nla_validate_parse: 3 callbacks suppressed [ 699.001776][T22391] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3979'. [ 699.207952][T22401] netlink: 'syz.1.3984': attribute type 21 has an invalid length. [ 699.218727][T22401] netlink: 128 bytes leftover after parsing attributes in process `syz.1.3984'. [ 699.237709][T22403] netlink: 92 bytes leftover after parsing attributes in process `syz.2.3985'. [ 699.296104][T22401] netlink: 'syz.1.3984': attribute type 5 has an invalid length. [ 699.317279][T22401] netlink: 'syz.1.3984': attribute type 6 has an invalid length. [ 699.329217][T22401] netlink: 3 bytes leftover after parsing attributes in process `syz.1.3984'. [ 699.396536][ T5765] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 699.609559][T22410] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 699.629087][T22410] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 699.673440][T22410] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 699.851992][T22428] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3991'. [ 699.927377][T22432] netlink: 'syz.2.3994': attribute type 1 has an invalid length. [ 700.029242][T22436] netlink: 212368 bytes leftover after parsing attributes in process `syz.1.3995'. [ 700.118303][T22431] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3995'. [ 700.257994][T22410] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 700.281617][T22410] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 700.502888][T22454] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3996'. [ 700.538130][T22410] bond0: left promiscuous mode [ 700.552270][T22410] bond_slave_0: left promiscuous mode [ 700.558669][T22410] bond_slave_1: left promiscuous mode [ 700.582249][ T5852] lo speed is unknown, defaulting to 1000 [ 700.620410][ T5852] syś2: Port: 1 Link DOWN [ 700.758754][T22432] bond4: entered promiscuous mode [ 700.804461][T22432] 8021q: adding VLAN 0 to HW filter on device bond4 [ 700.855730][T22437] macvtap1: entered allmulticast mode [ 700.870789][T22464] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3997'. [ 700.925459][T22431] 8021q: adding VLAN 0 to HW filter on device bond5 [ 700.942615][T22440] macvtap2: entered allmulticast mode [ 700.955464][ T82] netdevsim netdevsim3 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 701.042955][T22470] Bluetooth: MGMT ver 1.23 [ 701.043058][T22441] syzkaller0: entered promiscuous mode [ 701.053729][T22441] syzkaller0: entered allmulticast mode [ 701.063414][T22464] workqueue: Failed to create a rescuer kthread for wq "bond5": -EINTR [ 705.420796][ T82] netdevsim netdevsim3 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 705.439056][ T82] netdevsim netdevsim3 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 705.456503][ T82] netdevsim netdevsim3 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 705.600750][T22496] netlink: 20 bytes leftover after parsing attributes in process `syz.1.4005'. [ 705.819114][T22508] netlink: 'syz.2.4009': attribute type 6 has an invalid length. [ 705.957451][T22513] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4008'. [ 706.016843][T22518] x_tables: duplicate underflow at hook 3 [ 706.039853][T22518] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 706.108747][T22518] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 706.227770][T22526] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4013'. [ 706.244143][T22526] netlink: 20 bytes leftover after parsing attributes in process `syz.1.4013'. [ 706.406699][T22526] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4013'. [ 706.423353][T22526] netlink: 20 bytes leftover after parsing attributes in process `syz.1.4013'. [ 707.339185][T22573] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4027'. [ 707.369251][T22570] xt_hashlimit: size too large, truncated to 1048576 [ 707.396048][T22578] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4027'. [ 707.440314][T22579] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4026'. [ 707.796373][ T160] net_ratelimit: 2 callbacks suppressed [ 707.796394][ T160] bond3: (slave batadv0): link status up again after 0 ms [ 707.881398][ T160] bond3: (slave batadv0): link status up again after 0 ms [ 707.924234][ T160] bond3: (slave batadv0): link status up again after 0 ms [ 707.942202][T22586] A link change request failed with some changes committed already. Interface syzkaller0 may have been left with an inconsistent configuration, please check. [ 707.955957][ T160] bond3: (slave batadv0): link status up again after 0 ms [ 708.014347][ T160] bond3: (slave batadv0): link status up again after 0 ms [ 708.027859][T22589] mac80211_hwsim hwsim46 wlan0: entered allmulticast mode [ 708.044887][ T160] bond3: (slave batadv0): link status up again after 0 ms [ 708.053355][T22593] netlink: 'syz.3.4032': attribute type 3 has an invalid length. [ 708.073989][T22593] netlink: 'syz.3.4032': attribute type 3 has an invalid length. [ 708.094792][ T57] bond3: (slave batadv0): link status up again after 0 ms [ 708.124156][ T57] bond3: (slave batadv0): link status up again after 0 ms [ 708.154176][ T160] bond3: (slave batadv0): link status up again after 0 ms [ 708.314449][T22601] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4034'. [ 708.396802][T22603] tipc: Started in network mode [ 708.410217][T22603] tipc: Node identity ee155d2e76a5, cluster identity 4711 [ 708.424425][T22603] tipc: Enabled bearer , priority 0 [ 708.485861][T22609] syzkaller0: entered promiscuous mode [ 708.503140][T22609] syzkaller0: entered allmulticast mode [ 708.572206][T22612] batman_adv: batadv0: Adding interface: macvtap0 [ 708.579137][T22612] batman_adv: batadv0: The MTU of interface macvtap0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 708.610189][T22612] batman_adv: batadv0: Not using interface macvtap0 (retrying later): interface not active [ 708.622040][T22610] netlink: 'syz.4.4036': attribute type 13 has an invalid length. [ 708.630399][T22610] netlink: 'syz.4.4036': attribute type 17 has an invalid length. [ 708.653786][T22603] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 708.855044][T22627] netlink: 'syz.1.4040': attribute type 1 has an invalid length. [ 709.009522][T22610] 8021q: adding VLAN 0 to HW filter on device bond0 [ 709.063830][T22610] 8021q: adding VLAN 0 to HW filter on device team0 [ 709.089310][T22610] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 709.149029][T22610] team_slave_1: left promiscuous mode [ 709.173202][T22610] virt_wifi0: default qdisc (pfifo_fast) fail, fallback to noqueue [ 709.235282][T22610] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 709.286133][T22610] 8021q: adding VLAN 0 to HW filter on device bond2 [ 709.309518][T22610] gretap1: default qdisc (pfifo_fast) fail, fallback to noqueue [ 709.320382][T22610] ip6gre1: left promiscuous mode [ 709.327191][T22610] ip6gre1: left allmulticast mode [ 709.333723][T22610] ipip0: left promiscuous mode [ 709.353296][T22603] tipc: Resetting bearer [ 709.579976][T22630] ip6gretap1: entered allmulticast mode [ 709.666401][T22602] tipc: Resetting bearer [ 709.729698][T22602] tipc: Disabling bearer [ 709.755225][ T3330] netdevsim netdevsim4 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 709.767716][ T5750] tipc: Node number set to 2561695022 [ 709.788082][ T160] netdevsim netdevsim4 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 709.814584][ T160] netdevsim netdevsim4 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 709.866486][ T160] netdevsim netdevsim4 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 709.971371][T22645] netlink: 'syz.4.4047': attribute type 1 has an invalid length. [ 710.699838][T22664] __nla_validate_parse: 3 callbacks suppressed [ 710.699858][T22664] netlink: 7 bytes leftover after parsing attributes in process `syz.4.4052'. [ 710.828355][ T8855] IPVS: starting estimator thread 0... [ 710.933975][T22668] IPVS: using max 28 ests per chain, 67200 per kthread [ 711.184506][T22680] team0: Mode changed to "activebackup" [ 711.424719][T22658] lo speed is unknown, defaulting to 1000 [ 711.574437][T22683] netlink: 'syz.0.4057': attribute type 21 has an invalid length. [ 711.583483][T22683] netlink: 'syz.0.4057': attribute type 20 has an invalid length. [ 711.910522][T22689] netlink: 68 bytes leftover after parsing attributes in process `syz.0.4059'. [ 712.030307][T22689] netlink: 44 bytes leftover after parsing attributes in process `syz.0.4059'. [ 712.734835][T22712] netlink: 20 bytes leftover after parsing attributes in process `syz.2.4065'. [ 712.748168][T22714] netlink: 'syz.0.4064': attribute type 1 has an invalid length. [ 712.894722][ T1095] net_ratelimit: 25 callbacks suppressed [ 712.894766][ T1095] bond3: (slave batadv0): failed to get link speed/duplex [ 713.054514][ T6134] bond3: (slave batadv0): failed to get link speed/duplex [ 713.184047][ T3330] bond3: (slave batadv0): failed to get link speed/duplex [ 713.255302][T22699] syzkaller1: entered promiscuous mode [ 713.267809][T22699] syzkaller1: entered allmulticast mode [ 713.397411][ T160] bond3: (slave batadv0): failed to get link speed/duplex [ 713.520478][T22731] ip6tnl2: entered allmulticast mode [ 713.543101][ T160] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 713.560529][ T160] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 713.568521][ T5852] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 713.599058][ T160] bond3: (slave batadv0): failed to get link speed/duplex [ 713.745195][ T82] bond3: (slave batadv0): failed to get link speed/duplex [ 713.815317][ T5852] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 713.875248][ T57] bond3: (slave batadv0): failed to get link speed/duplex [ 714.014241][ T3330] bond3: (slave batadv0): failed to get link speed/duplex [ 714.207882][ T160] bond3: (slave batadv0): failed to get link speed/duplex [ 714.334611][ T160] bond3: (slave batadv0): failed to get link speed/duplex [ 714.383630][T22753] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4076'. [ 714.425046][T22753] netlink: 24 bytes leftover after parsing attributes in process `syz.2.4076'. [ 714.525106][ T5852] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 714.848259][T22765] netlink: 52 bytes leftover after parsing attributes in process `syz.4.4077'. [ 715.637029][T22797] netlink: 'syz.1.4080': attribute type 16 has an invalid length. [ 715.710713][T22797] netlink: 'syz.1.4080': attribute type 17 has an invalid length. [ 715.902566][T22797] mac80211_hwsim hwsim46 wlan0: left allmulticast mode [ 716.273403][T22815] netlink: 'syz.3.4084': attribute type 1 has an invalid length. [ 716.359206][T22815] workqueue: Failed to create a rescuer kthread for wq "bond5": -EINTR [ 717.089597][T22846] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4091'. [ 717.474220][ C0] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 717.895889][T22878] netlink: 40 bytes leftover after parsing attributes in process `syz.3.4098'. [ 717.994039][ T82] net_ratelimit: 31 callbacks suppressed [ 717.994063][ T82] bond3: (slave batadv0): failed to get link speed/duplex [ 718.054425][T22878] Cannot find add_set index 0 as target [ 718.156569][ T6126] bond3: (slave batadv0): failed to get link speed/duplex [ 718.284258][ T3330] bond3: (slave batadv0): failed to get link speed/duplex [ 718.435629][ T160] bond3: (slave batadv0): failed to get link speed/duplex [ 718.572369][ T3330] bond3: (slave batadv0): failed to get link speed/duplex [ 718.695332][ T3330] bond3: (slave batadv0): failed to get link speed/duplex [ 718.731657][T22904] netlink: 88 bytes leftover after parsing attributes in process `syz.2.4103'. [ 718.772660][T22904] A link change request failed with some changes committed already. Interface bridge_slave_0 may have been left with an inconsistent configuration, please check. [ 718.843987][ T3330] bond3: (slave batadv0): failed to get link speed/duplex [ 718.973098][T22905] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4103'. [ 718.997067][ T6126] bond3: (slave batadv0): failed to get link speed/duplex [ 719.135300][ T82] bond3: (slave batadv0): failed to get link speed/duplex [ 719.832461][T22953] netlink: 'syz.2.4113': attribute type 1 has an invalid length. [ 720.028260][T22953] 8021q: adding VLAN 0 to HW filter on device bond5 [ 720.078661][T22962] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4116'. [ 720.166089][T22954] bond5: (slave veth5): Enslaving as an active interface with a down link [ 720.280941][T22951] RDS: rds_bind could not find a transport for fe80::1a, load rds_tcp or rds_rdma? [ 720.431790][T22964] netlink: 46 bytes leftover after parsing attributes in process `syz.4.4115'. [ 720.488712][T22970] netlink: 'syz.1.4118': attribute type 1 has an invalid length. [ 720.532489][T22970] netlink: 92 bytes leftover after parsing attributes in process `syz.1.4118'. [ 720.546073][T22970] netlink: 'syz.1.4118': attribute type 1 has an invalid length. [ 720.560607][T22970] netlink: 634 bytes leftover after parsing attributes in process `syz.1.4118'. [ 720.642019][T22970] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4118'. [ 720.752915][T22979] netlink: 'syz.2.4121': attribute type 4 has an invalid length. [ 720.770858][T22982] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4122'. [ 721.239476][T22993] netlink: 'syz.1.4125': attribute type 10 has an invalid length. [ 722.186772][T23024] 8021q: adding VLAN 0 to HW filter on device bond0 [ 722.227186][T23024] 8021q: adding VLAN 0 to HW filter on device team0 [ 722.306104][T23024] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 722.470784][T23024] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 722.482797][T23024] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 722.503482][T23024] veth1_vlan: left promiscuous mode [ 722.510614][T23024] veth0_vlan: left promiscuous mode [ 722.519161][T23024] veth0_vlan: entered promiscuous mode [ 722.529488][T23024] veth1_vlan: entered promiscuous mode [ 722.557627][T23024] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 722.575739][T23024] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 722.585733][T23024] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 722.596035][T23024] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 722.619657][T23024] 8021q: adding VLAN 0 to HW filter on device bond1 [ 722.635882][T23024] 8021q: adding VLAN 0 to HW filter on device bond2 [ 722.659373][T23024] 8021q: adding VLAN 0 to HW filter on device bond3 [ 722.683581][T23024] 8021q: adding VLAN 0 to HW filter on device bond4 [ 722.701514][T23024] bond0: entered promiscuous mode [ 722.707185][T23024] bond_slave_0: entered promiscuous mode [ 722.713125][T23024] bond_slave_1: entered promiscuous mode [ 722.719850][T23024] macvlan2: left promiscuous mode [ 722.725371][T23024] bond0: left promiscuous mode [ 722.732514][T23024] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 722.747742][T23024] mac80211_hwsim hwsim54 wlan1: entered promiscuous mode [ 722.756046][T23024] batman_adv: batadv0: Interface activated: macvtap0 [ 722.768283][T23030] __nla_validate_parse: 2 callbacks suppressed [ 722.768305][T23030] netlink: 16 bytes leftover after parsing attributes in process `syz.4.4136'. [ 722.790796][ T8835] lo speed is unknown, defaulting to 1000 [ 722.799372][T23036] batadv_slave_0: entered promiscuous mode [ 722.805343][ T8835] syś2: Port: 1 Link ACTIVE [ 722.857245][ T82] bridge2: port 2(veth0_to_bond) entered blocking state [ 722.864408][ T82] bridge2: port 2(veth0_to_bond) entered forwarding state [ 722.941549][ T82] bridge2: port 1(veth3) entered blocking state [ 722.948200][ T82] bridge2: port 1(veth3) entered forwarding state [ 722.979922][ T6126] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 723.031370][T23035] batadv_slave_0: left promiscuous mode [ 723.062633][ T6126] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 723.108325][ T6126] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 723.160498][ T6126] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 723.164232][T23048] net_ratelimit: 723 callbacks suppressed [ 723.164250][T23048] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 723.185768][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 723.261654][ T160] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 723.287304][ T5765] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 723.442228][T23055] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4142'. [ 723.477340][ T8855] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 723.489049][T23062] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4145'. [ 723.680109][T23062] ipvlan2: entered allmulticast mode [ 723.697178][T23062] syz_tun: entered allmulticast mode [ 723.804289][ T3330] bond3: (slave batadv0): failed to get link speed/duplex [ 723.870702][ T6126] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 723.913165][T23077] netdevsim netdevsim1: Direct firmware load for . failed with error -2 [ 723.924777][ T5365] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 723.953991][T23077] netdevsim netdevsim1: Falling back to sysfs fallback for: . [ 724.056305][ T3330] bond3: (slave batadv0): failed to get link speed/duplex [ 724.090813][T23087] netlink: 'syz.0.4151': attribute type 1 has an invalid length. [ 724.184258][ T3330] bond3: (slave batadv0): failed to get link speed/duplex [ 724.374412][ T6134] bond3: (slave batadv0): failed to get link speed/duplex [ 724.468185][T23096] netlink: 24 bytes leftover after parsing attributes in process `syz.0.4155'. [ 724.967212][T23110] RDS: rds_bind could not find a transport for fc02::, load rds_tcp or rds_rdma? [ 724.986018][T23115] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci4/hci4:200/input7 [ 725.119906][ T50] Bluetooth: hci4: link tx timeout [ 725.125668][ T50] Bluetooth: hci4: killing stalled connection 10:aa:aa:aa:aa:aa [ 725.714168][ C0] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 725.858863][T23113] lo speed is unknown, defaulting to 1000 [ 726.006366][T23146] netlink: 54976 bytes leftover after parsing attributes in process `syz.0.4167'. [ 726.579006][T23161] netlink: 200 bytes leftover after parsing attributes in process `syz.0.4172'. [ 726.920901][ T82] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 726.943442][ T82] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 727.070002][T23180] netlink: 'syz.1.4178': attribute type 11 has an invalid length. [ 727.090395][T23180] netlink: 'syz.1.4178': attribute type 4 has an invalid length. [ 727.099710][T23180] netlink: 'syz.1.4178': attribute type 6 has an invalid length. [ 727.127361][T23180] netlink: 199556 bytes leftover after parsing attributes in process `syz.1.4178'. [ 727.155281][ T50] Bluetooth: hci4: command 0x0406 tx timeout [ 727.161182][T23182] netlink: 40 bytes leftover after parsing attributes in process `syz.4.4177'. [ 727.478510][T23181] block nbd4: not configured, cannot reconfigure [ 727.554404][ C1] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 727.630629][T23176] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 727.691332][ T3330] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 727.728760][ T3330] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 727.824443][T23191] syzkaller1: entered promiscuous mode [ 727.834760][T23191] syzkaller1: entered allmulticast mode [ 728.280218][ T6144] net_ratelimit: 27 callbacks suppressed [ 728.282204][ T6144] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 728.300112][ T8855] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 728.320526][ T5852] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 728.334133][ T6144] bond3: (slave batadv0): failed to get link speed/duplex [ 728.348456][T23214] syzkaller1: entered promiscuous mode [ 728.357511][T23229] netlink: 256 bytes leftover after parsing attributes in process `syz.3.4184'. [ 728.400781][T23214] syzkaller1: entered allmulticast mode [ 728.407778][T23224] netlink: 'syz.3.4184': attribute type 29 has an invalid length. [ 728.445619][ T6134] bond3: (slave batadv0): failed to get link speed/duplex [ 728.521322][ T5365] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 728.579539][ T12] bond3: (slave batadv0): failed to get link speed/duplex [ 728.735360][ T12] bond3: (slave batadv0): failed to get link speed/duplex [ 728.927472][ T12] bond3: (slave batadv0): failed to get link speed/duplex [ 728.994391][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 729.433650][T23269] netlink: 28 bytes leftover after parsing attributes in process `syz.0.4191'. [ 729.481463][T23269] netlink: 28 bytes leftover after parsing attributes in process `syz.0.4191'. [ 729.615023][T23275] netlink: 32 bytes leftover after parsing attributes in process `syz.0.4191'. [ 729.814301][T23282] netlink: 'syz.3.4196': attribute type 1 has an invalid length. [ 730.086198][T23282] bond5: entered promiscuous mode [ 730.151572][T23282] 8021q: adding VLAN 0 to HW filter on device bond5 [ 730.306793][T23301] bond5: (slave bridge0): making interface the new active one [ 730.341363][T23301] bridge0: entered promiscuous mode [ 730.368090][T23301] bond5: (slave bridge0): Enslaving as an active interface with an up link [ 730.733567][T23315] netlink: 'syz.1.4201': attribute type 62 has an invalid length. [ 730.768048][T23315] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 730.775357][T23315] IPv6: NLM_F_CREATE should be set when creating new route [ 730.782675][T23315] IPv6: NLM_F_CREATE should be set when creating new route [ 731.490534][T23345] bridge3: trying to set multicast startup query interval below minimum, setting to 100 (1000ms) [ 731.739012][T23348] netlink: 67 bytes leftover after parsing attributes in process `syz.1.4207'. [ 731.799111][T23354] netlink: 16 bytes leftover after parsing attributes in process `syz.1.4207'. [ 731.849862][T23353] netlink: 'syz.0.4208': attribute type 1 has an invalid length. [ 732.058943][T23369] netlink: 48 bytes leftover after parsing attributes in process `syz.2.4211'. [ 732.250598][T23353] 8021q: adding VLAN 0 to HW filter on device bond4 [ 732.253378][T23381] netlink: 16 bytes leftover after parsing attributes in process `syz.1.4213'. [ 732.560474][T23358] bond4: (slave veth5): Enslaving as an active interface with a down link [ 732.651611][T23364] bond1: (slave dummy0): Releasing active interface [ 732.720074][T23364] bond4: (slave dummy0): making interface the new active one [ 732.765851][T23401] FAULT_INJECTION: forcing a failure. [ 732.765851][T23401] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 732.773463][T23364] dummy0: entered promiscuous mode [ 732.797598][T23401] CPU: 1 UID: 0 PID: 23401 Comm: syz.4.4217 Not tainted syzkaller #0 PREEMPT(full) [ 732.797633][T23401] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 732.797644][T23401] Call Trace: [ 732.797651][T23401] [ 732.797659][T23401] dump_stack_lvl+0xe8/0x150 [ 732.797687][T23401] should_fail_ex+0x412/0x560 [ 732.797713][T23401] _copy_from_user+0x2d/0xb0 [ 732.797736][T23401] hidp_sock_ioctl+0x244/0x650 [ 732.797764][T23401] ? __pfx_hidp_sock_ioctl+0x10/0x10 [ 732.797832][T23401] ? do_vfs_ioctl+0x1166/0x1530 [ 732.797865][T23401] sock_do_ioctl+0x101/0x320 [ 732.797890][T23401] ? __pfx_sock_do_ioctl+0x10/0x10 [ 732.797912][T23401] ? __mutex_unlock_slowpath+0x1be/0x6f0 [ 732.797949][T23401] sock_ioctl+0x5c6/0x7f0 [ 732.797975][T23401] ? __pfx_sock_ioctl+0x10/0x10 [ 732.797998][T23401] ? __fget_files+0x2a/0x420 [ 732.798019][T23401] ? __fget_files+0x3a0/0x420 [ 732.798038][T23401] ? __fget_files+0x2a/0x420 [ 732.798064][T23401] ? bpf_lsm_file_ioctl+0x9/0x20 [ 732.798091][T23401] ? __pfx_sock_ioctl+0x10/0x10 [ 732.798115][T23401] __se_sys_ioctl+0xfc/0x170 [ 732.798143][T23401] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 732.798173][T23401] do_syscall_64+0x174/0x580 [ 732.798195][T23401] ? clear_bhb_loop+0x40/0x90 [ 732.798220][T23401] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 732.798239][T23401] RIP: 0033:0x7ff55b59ce59 [ 732.798258][T23401] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 732.798274][T23401] RSP: 002b:00007ff55c406028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 732.798295][T23401] RAX: ffffffffffffffda RBX: 00007ff55b816090 RCX: 00007ff55b59ce59 [ 732.798309][T23401] RDX: 0000200000000000 RSI: 00000000400448c9 RDI: 0000000000000004 [ 732.798322][T23401] RBP: 00007ff55c406090 R08: 0000000000000000 R09: 0000000000000000 [ 732.798333][T23401] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 732.798344][T23401] R13: 00007ff55b816128 R14: 00007ff55b816090 R15: 00007ffdb1d48e78 [ 732.798376][T23401] [ 732.802084][T23364] bond4: (slave dummy0): Enslaving as an active interface with an up link [ 733.340187][ T160] net_ratelimit: 28 callbacks suppressed [ 733.340213][ T160] bond3: (slave batadv0): failed to get link speed/duplex [ 733.488700][ T160] bond3: (slave batadv0): failed to get link speed/duplex [ 733.519768][T23409] syzkaller1: entered promiscuous mode [ 733.539810][T23409] syzkaller1: entered allmulticast mode [ 733.671502][ T8855] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 734.051176][ T3330] bond3: (slave batadv0): failed to get link speed/duplex [ 734.076523][ T3330] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 734.110487][ T5365] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 734.156544][ T8855] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 734.176331][ T160] bond3: (slave batadv0): failed to get link speed/duplex [ 734.294269][ T6144] bond3: (slave batadv0): failed to get link speed/duplex [ 734.594528][ T8835] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 735.415365][T23449] netdevsim netdevsim1 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 735.458482][T23449] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 735.726479][T23457] pimreg: entered allmulticast mode [ 735.930691][T23449] netdevsim netdevsim1 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 735.954145][ C1] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 735.981004][T23449] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 736.352173][T23449] netdevsim netdevsim1 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 736.387309][T23449] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 736.463285][T23517] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4236'. [ 736.565298][T23521] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4236'. [ 736.586276][T23521] netlink: 348 bytes leftover after parsing attributes in process `syz.4.4236'. [ 736.609704][T23521] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4236'. [ 736.630839][T23521] netlink: 348 bytes leftover after parsing attributes in process `syz.4.4236'. [ 736.646191][T23521] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4236'. [ 737.116418][T23449] netdevsim netdevsim1 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 737.174969][T23449] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 737.298798][T23531] tipc: Enabled bearer , priority 0 [ 737.330730][T23542] tipc: Resetting bearer [ 737.359103][T23533] syzkaller0: entered promiscuous mode [ 737.399418][T23533] syzkaller0: entered allmulticast mode [ 737.628273][T23530] tipc: Resetting bearer [ 737.669242][T23530] tipc: Disabling bearer [ 738.267744][ T160] netdevsim netdevsim1 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 738.278815][ T160] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 738.309119][T23562] syzkaller1: entered promiscuous mode [ 738.329176][T23562] syzkaller1: entered allmulticast mode [ 738.372796][ T6134] net_ratelimit: 13 callbacks suppressed [ 738.372816][ T6134] bond3: (slave batadv0): failed to get link speed/duplex [ 738.435546][ T8853] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 738.448525][ T6144] netdevsim netdevsim1 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 738.462344][ T6144] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 738.509337][ T6144] netdevsim netdevsim1 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 738.526350][ T6144] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 738.566582][ T6134] netdevsim netdevsim1 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 738.592352][ T6134] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 738.678112][ T6144] bond3: (slave batadv0): failed to get link speed/duplex [ 738.806980][ T3330] bond3: (slave batadv0): failed to get link speed/duplex [ 738.926967][T23605] syzkaller0: entered promiscuous mode [ 738.945077][T23605] syzkaller0: entered allmulticast mode [ 738.964222][ T3330] bond3: (slave batadv0): failed to get link speed/duplex [ 739.093978][ T3330] bond3: (slave batadv0): failed to get link speed/duplex [ 739.205161][ T6144] bond3: (slave batadv0): failed to get link speed/duplex [ 739.325726][ T3330] bond3: (slave batadv0): failed to get link speed/duplex [ 739.454270][ T6144] bond3: (slave batadv0): failed to get link speed/duplex [ 739.475287][ T8855] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 740.778137][T23572] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 741.074089][ C0] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 741.130706][T23646] netlink: 44 bytes leftover after parsing attributes in process `syz.4.4254'. [ 741.174377][T23646] netlink: 43 bytes leftover after parsing attributes in process `syz.4.4254'. [ 741.190509][T23646] netlink: 'syz.4.4254': attribute type 5 has an invalid length. [ 741.243723][T23646] netlink: 43 bytes leftover after parsing attributes in process `syz.4.4254'. [ 741.602018][T23679] FAULT_INJECTION: forcing a failure. [ 741.602018][T23679] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 741.621273][T23679] CPU: 0 UID: 0 PID: 23679 Comm: syz.3.4265 Not tainted syzkaller #0 PREEMPT(full) [ 741.621303][T23679] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 741.621315][T23679] Call Trace: [ 741.621323][T23679] [ 741.621331][T23679] dump_stack_lvl+0xe8/0x150 [ 741.621361][T23679] should_fail_ex+0x412/0x560 [ 741.621389][T23679] _copy_to_user+0x31/0xb0 [ 741.621415][T23679] simple_read_from_buffer+0xe1/0x170 [ 741.621443][T23679] proc_fail_nth_read+0x1bb/0x230 [ 741.621471][T23679] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 741.621500][T23679] ? rw_verify_area+0x2a6/0x4d0 [ 741.621524][T23679] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 741.621550][T23679] vfs_read+0x20c/0xa70 [ 741.621583][T23679] ? __pfx___mutex_lock+0x10/0x10 [ 741.621606][T23679] ? __pfx_vfs_read+0x10/0x10 [ 741.621635][T23679] ? __fget_files+0x2a/0x420 [ 741.621663][T23679] ? __fget_files+0x3a0/0x420 [ 741.621683][T23679] ? __fget_files+0x2a/0x420 [ 741.621720][T23679] ksys_read+0x150/0x270 [ 741.621748][T23679] ? __pfx_ksys_read+0x10/0x10 [ 741.621785][T23679] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 741.621806][T23679] do_syscall_64+0x174/0x580 [ 741.621826][T23679] ? trace_irq_disable+0x3b/0x140 [ 741.621853][T23679] ? clear_bhb_loop+0x40/0x90 [ 741.621878][T23679] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 741.621897][T23679] RIP: 0033:0x7fb12935d68e [ 741.621916][T23679] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 741.621932][T23679] RSP: 002b:00007fb12a208fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 741.621954][T23679] RAX: ffffffffffffffda RBX: 00007fb12a2096c0 RCX: 00007fb12935d68e [ 741.621967][T23679] RDX: 000000000000000f RSI: 00007fb12a2090a0 RDI: 0000000000000003 [ 741.621978][T23679] RBP: 00007fb12a209090 R08: 0000000000000000 R09: 0000000000000000 [ 741.621988][T23679] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 741.621999][T23679] R13: 00007fb129616038 R14: 00007fb129615fa0 R15: 00007ffebf3cbaa8 [ 741.622034][T23679] [ 742.133422][T23691] netlink: 'syz.3.4267': attribute type 1 has an invalid length. [ 742.211093][T23691] netlink: 'syz.3.4267': attribute type 2 has an invalid length. [ 742.254056][T23691] netlink: 16 bytes leftover after parsing attributes in process `syz.3.4267'. [ 742.712789][T23708] netlink: 'syz.2.4268': attribute type 3 has an invalid length. [ 742.820740][T23711] netlink: 212348 bytes leftover after parsing attributes in process `syz.1.4271'. [ 743.147120][T23718] netlink: 'syz.0.4274': attribute type 2 has an invalid length. [ 743.193125][T23721] netlink: 14 bytes leftover after parsing attributes in process `syz.0.4274'. [ 743.207856][T23719] netlink: 28 bytes leftover after parsing attributes in process `syz.3.4272'. [ 743.261224][T23721] bond4: (slave dummy0): Releasing active interface [ 743.285909][T23721] dummy0 (unregistering): left promiscuous mode [ 743.414046][ T3330] net_ratelimit: 34 callbacks suppressed [ 743.414075][ T3330] bond3: (slave batadv0): failed to get link speed/duplex [ 743.544376][ T160] bond3: (slave batadv0): failed to get link speed/duplex [ 743.634389][ T8853] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 743.664994][ T160] bond3: (slave batadv0): failed to get link speed/duplex [ 743.717023][ T8835] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 743.736985][T23740] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4279'. [ 743.774670][ T6134] bond3: (slave batadv0): failed to get link speed/duplex [ 743.921365][ T3330] bond3: (slave batadv0): failed to get link speed/duplex [ 744.074224][ T6144] bond3: (slave batadv0): failed to get link speed/duplex [ 744.170680][T23758] netlink: 'syz.2.4283': attribute type 1 has an invalid length. [ 744.224663][ T12] bond3: (slave batadv0): failed to get link speed/duplex [ 744.376230][ T6144] bond3: (slave batadv0): failed to get link speed/duplex [ 744.651571][T23778] netlink: 16 bytes leftover after parsing attributes in process `syz.0.4287'. [ 744.723383][T23788] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4290'. [ 744.840113][T23789] netlink: 20 bytes leftover after parsing attributes in process `syz.2.4288'. [ 744.950158][T23791] netlink: 260 bytes leftover after parsing attributes in process `syz.0.4291'. [ 744.971571][T23795] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4292'. [ 746.090422][T23825] netlink: 'syz.4.4302': attribute type 1 has an invalid length. [ 746.322419][T23833] bond0: (slave ip6tnl0): refused to change device type [ 746.408334][T23836] : entered promiscuous mode [ 746.477194][T23833] ip6erspan0: entered allmulticast mode [ 746.533332][T23800] lo speed is unknown, defaulting to 1000 [ 748.835221][ T8853] net_ratelimit: 117 callbacks suppressed [ 748.835244][ T8853] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 749.754711][ T6126] bond3: (slave batadv0): failed to get link speed/duplex [ 749.794384][ T5365] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 749.857222][T23881] __nla_validate_parse: 5 callbacks suppressed [ 749.857241][T23881] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4313'. [ 749.883237][ T8853] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 749.895051][ T6126] bond3: (slave batadv0): failed to get link speed/duplex [ 750.024343][ T6126] bond3: (slave batadv0): failed to get link speed/duplex [ 750.688452][T23900] netlink: 'syz.3.4317': attribute type 1 has an invalid length. [ 750.729340][ T8834] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 750.812245][T23892] bridge0: port 1(bridge_slave_0) entered disabled state [ 750.915714][ T5743] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 751.187657][T23892] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 751.245967][T23892] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 751.813782][T23902] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4318'. [ 751.858087][T23900] workqueue: Failed to create a rescuer kthread for wq "bond6": -EINTR [ 751.947457][ T6126] netdevsim netdevsim1 eth0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 751.974615][T23919] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 752.007130][ T6126] netdevsim netdevsim1 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 752.033491][ T6126] netdevsim netdevsim1 eth1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 752.057248][ T6126] netdevsim netdevsim1 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 752.106747][T23902] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4318'. [ 752.126842][ T6126] netdevsim netdevsim1 eth2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 752.149816][ T6126] netdevsim netdevsim1 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 752.171876][ T6126] netdevsim netdevsim1 eth3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 752.198387][ T6126] netdevsim netdevsim1 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 752.366328][T23936] hmac(sha224: entered promiscuous mode [ 752.512650][T23942] Cannot find add_set index 0 as target [ 752.594825][ C1] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 752.595411][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 752.648022][T23958] tipc: Enabled bearer , priority 0 [ 752.679807][T23958] syzkaller0: entered promiscuous mode [ 752.712101][T23958] syzkaller0: entered allmulticast mode [ 752.846799][T23964] x_tables: duplicate underflow at hook 1 [ 752.895139][T23958] tipc: Resetting bearer [ 752.918073][T23962] netlink: 44 bytes leftover after parsing attributes in process `syz.2.4328'. [ 752.943496][T23958] netlink: 20 bytes leftover after parsing attributes in process `syz.2.4328'. [ 752.982165][T23964] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4329'. [ 753.031701][T23957] tipc: Resetting bearer [ 753.183427][T23957] tipc: Disabling bearer [ 753.357684][T23970] syzkaller0: entered promiscuous mode [ 753.381750][T23970] syzkaller0: entered allmulticast mode [ 753.526292][T23982] netlink: 'syz.1.4334': attribute type 1 has an invalid length. [ 753.574655][T23982] netlink: 'syz.1.4334': attribute type 2 has an invalid length. [ 753.823345][T23992] netlink: 68 bytes leftover after parsing attributes in process `syz.2.4338'. [ 753.839683][T23992] netlink: 16 bytes leftover after parsing attributes in process `syz.2.4338'. [ 753.858160][T23992] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4338'. [ 753.868272][T23983] vlan0: entered promiscuous mode [ 753.879266][T23983] geneve1: entered promiscuous mode [ 753.892271][T23983] vlan0: entered allmulticast mode [ 753.907335][T23983] geneve1: entered allmulticast mode [ 754.065745][ T10] net_ratelimit: 346 callbacks suppressed [ 754.065767][ T10] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 754.358173][T24003] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4341'. [ 754.476039][T24003] team1: entered promiscuous mode [ 754.506934][T24003] team1: entered allmulticast mode [ 754.513383][T24003] 8021q: adding VLAN 0 to HW filter on device team1 [ 754.544881][T24010] netlink: 'syz.0.4342': attribute type 10 has an invalid length. [ 754.598506][T24006] team2: entered promiscuous mode [ 754.603770][T24006] team2: entered allmulticast mode [ 754.609811][T24006] 8021q: adding VLAN 0 to HW filter on device team2 [ 754.638416][T24010] team0: Failed to send port change of device geneve1 via netlink (err -105) [ 754.648532][T24010] team0: Failed to send options change via netlink (err -105) [ 754.664143][T24010] team0: Port device geneve1 added [ 754.791146][T24016] syzkaller0: entered promiscuous mode [ 754.797539][T24016] syzkaller0: entered allmulticast mode [ 754.880981][T24016] __nla_validate_parse: 5 callbacks suppressed [ 754.881021][T24016] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4344'. [ 754.922299][T24016] netlink: 16 bytes leftover after parsing attributes in process `syz.3.4344'. [ 755.528289][T24043] netlink: 14 bytes leftover after parsing attributes in process `syz.1.4348'. [ 755.663436][T24048] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4349'. [ 755.697708][T24043] bond0 (unregistering): left promiscuous mode [ 755.700231][T24044] netlink: 'syz.4.4347': attribute type 2 has an invalid length. [ 755.731717][T24043] bond_slave_0: left promiscuous mode [ 755.750068][T24043] bond_slave_1: left promiscuous mode [ 755.783286][T24043] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 755.788407][T24044] block nbd0: reconnected socket [ 755.792753][ T5650] block nbd0: Receive control failed (result -107) [ 755.871236][T24043] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 755.921035][T24053] netlink: 16 bytes leftover after parsing attributes in process `syz.0.4350'. [ 755.967414][T24043] bond0 (unregistering): Released all slaves [ 756.554522][T24072] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4353'. [ 757.271152][T24092] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4356'. [ 757.308872][T24092] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4356'. [ 757.450432][T24104] netlink: 72 bytes leftover after parsing attributes in process `syz.3.4359'. [ 757.463332][T24105] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4360'. [ 757.545522][T24104] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 757.587986][T24096] bond6: entered allmulticast mode [ 757.624460][T24096] 8021q: adding VLAN 0 to HW filter on device bond6 [ 758.139194][T24138] netdevsim netdevsim2 netdevsim0: entered allmulticast mode [ 758.182762][T24138] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 758.631311][T24160] netlink: 'syz.1.4371': attribute type 21 has an invalid length. [ 758.837722][T24166] netlink: 'syz.4.4373': attribute type 1 has an invalid length. [ 759.163614][T24190] team0: left promiscuous mode [ 759.175749][T24190] team_slave_0: left promiscuous mode [ 759.217204][T24190] team_slave_1: left promiscuous mode [ 759.275402][T24190] erspan0: left promiscuous mode [ 759.981333][T24218] __nla_validate_parse: 4 callbacks suppressed [ 759.981372][T24218] netlink: 32 bytes leftover after parsing attributes in process `syz.1.4381'. [ 760.001958][T24216] netlink: 36 bytes leftover after parsing attributes in process `syz.3.4380'. [ 760.379722][T24231] xt_TPROXY: Can be used only with -p tcp or -p udp [ 760.402348][T24231] xt_TPROXY: Can be used only with -p tcp or -p udp [ 760.427888][T24231] xt_TPROXY: Can be used only with -p tcp or -p udp [ 760.654527][T24243] netlink: 190972 bytes leftover after parsing attributes in process `syz.1.4385'. [ 761.775030][T24175] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 762.416158][T24314] netlink: 20 bytes leftover after parsing attributes in process `syz.4.4395'. [ 762.483322][T24314] bridge_slave_0: entered promiscuous mode [ 762.537294][T24314] A link change request failed with some changes committed already. Interface bridge_slave_0 may have been left with an inconsistent configuration, please check. [ 763.617093][ T30] audit: type=1800 audit(1780375292.368:24): pid=24359 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.4403" name="memory.events" dev="tmpfs" ino=1247 res=0 errno=0 [ 763.704324][ T30] audit: type=1804 audit(1780375292.418:25): pid=24359 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.0.4403" name="/newroot/239/memory.events" dev="tmpfs" ino=1247 res=1 errno=0 [ 763.894744][T24368] netlink: 'syz.4.4405': attribute type 1 has an invalid length. [ 764.068865][T24369] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4404'. [ 764.823070][T24393] bond8: option min_links: invalid value (18446744073697427452) [ 764.875291][T24393] bond8: option min_links: allowed values 0 - 2147483647 [ 764.936020][T24393] bond8 (unregistering): Released all slaves [ 765.328116][T24416] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4412'. [ 765.389698][T24419] netlink: 208240 bytes leftover after parsing attributes in process `syz.2.4412'. [ 765.461879][T24421] netlink: 'syz.3.4413': attribute type 10 has an invalid length. [ 765.501810][T24421] netlink: 40 bytes leftover after parsing attributes in process `syz.3.4413'. [ 765.548258][T24421] dummy0: entered promiscuous mode [ 765.555830][T24424] netlink: 232 bytes leftover after parsing attributes in process `syz.1.4414'. [ 765.587868][T24421] dummy0: entered allmulticast mode [ 765.618932][T24421] A link change request failed with some changes committed already. Interface dummy0 may have been left with an inconsistent configuration, please check. [ 765.777389][T24427] netlink: 'syz.4.4415': attribute type 1 has an invalid length. [ 765.976127][T24431] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4415'. [ 766.147358][T24435] netlink: 'syz.2.4416': attribute type 1 has an invalid length. [ 766.221376][T24446] syzkaller1: tun_chr_ioctl cmd 1074025677 [ 766.290757][T24446] syzkaller1: Refused to change device type [ 766.329285][T24453] netlink: 'syz.0.4419': attribute type 1 has an invalid length. [ 766.779517][T24453] 8021q: adding VLAN 0 to HW filter on device bond7 [ 766.787756][T24470] netlink: 44 bytes leftover after parsing attributes in process `syz.3.4421'. [ 767.303674][T24484] netlink: 'syz.3.4425': attribute type 9 has an invalid length. [ 767.330486][T24486] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4424'. [ 767.338775][T24484] netlink: 212340 bytes leftover after parsing attributes in process `syz.3.4425'. [ 767.793091][T24505] netlink: 16 bytes leftover after parsing attributes in process `syz.3.4428'. [ 767.898651][T24494] bond_slave_0: left promiscuous mode [ 767.923650][T24494] bond_slave_1: left promiscuous mode [ 768.120447][T24494] bridge2: port 2(veth0_to_bond) entered disabled state [ 768.217574][T24494] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 768.253289][T24494] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 768.295340][T24521] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 768.349939][T24494] bridge2: port 1(veth3) entered disabled state [ 768.411286][T24494] batman_adv: batadv0: Interface deactivated: macvtap0 [ 768.631276][ T9] lo speed is unknown, defaulting to 1000 [ 768.657669][ T9] syś2: Port: 1 Link DOWN [ 768.788904][ T160] netdevsim netdevsim3 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 768.819333][ T160] netdevsim netdevsim3 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 768.844151][ T160] netdevsim netdevsim3 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 768.980204][ T160] netdevsim netdevsim3 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 769.271362][T24555] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4443'. [ 770.156231][T24578] smc: removing ib device syz0 [ 770.245043][T24578] [ 770.247432][T24578] ====================================================== [ 770.254475][T24578] WARNING: possible circular locking dependency detected [ 770.261536][T24578] syzkaller #0 Not tainted [ 770.265979][T24578] ------------------------------------------------------ [ 770.273030][T24578] syz.0.4451/24578 is trying to acquire lock: [ 770.279140][T24578] ffff88801be8d2a0 (&root->kernfs_supers_rwsem){++++}-{4:4}, at: kernfs_remove+0x35/0x80 [ 770.289031][T24578] [ 770.289031][T24578] but task is already holding lock: [ 770.296428][T24578] ffffffff8f390060 (gdp_mutex){+.+.}-{4:4}, at: cleanup_glue_dir+0xc3/0x220 [ 770.305274][T24578] [ 770.305274][T24578] which lock already depends on the new lock. [ 770.305274][T24578] [ 770.315798][T24578] [ 770.315798][T24578] the existing dependency chain (in reverse order) is: [ 770.324820][T24578] [ 770.324820][T24578] -> #10 (gdp_mutex){+.+.}-{4:4}: [ 770.332040][T24578] __mutex_lock+0x1a3/0x1550 [ 770.337339][T24578] get_device_parent+0x16f/0x3a0 [ 770.342811][T24578] device_add+0x2e1/0xbb0 [ 770.347667][T24578] device_create+0x269/0x300 [ 770.352919][T24578] msr_device_create+0x33/0x50 [ 770.358242][T24578] cpuhp_invoke_callback+0x445/0x860 [ 770.364071][T24578] cpuhp_thread_fun+0x36b/0x780 [ 770.369460][T24578] smpboot_thread_fn+0x541/0xa50 [ 770.375009][T24578] kthread+0x389/0x470 [ 770.380040][T24578] ret_from_fork+0x514/0xb70 [ 770.385198][T24578] ret_from_fork_asm+0x1a/0x30 [ 770.390689][T24578] [ 770.390689][T24578] -> #9 (cpuhp_state-up){+.+.}-{0:0}: [ 770.398275][T24578] cpuhp_thread_fun+0x127/0x780 [ 770.403790][T24578] smpboot_thread_fn+0x541/0xa50 [ 770.409276][T24578] kthread+0x389/0x470 [ 770.413929][T24578] ret_from_fork+0x514/0xb70 [ 770.419072][T24578] ret_from_fork_asm+0x1a/0x30 [ 770.424364][T24578] [ 770.424364][T24578] -> #8 (cpu_hotplug_lock){++++}-{0:0}: [ 770.432379][T24578] cpus_read_lock+0x42/0x160 [ 770.437692][T24578] static_key_slow_inc+0x12/0x30 [ 770.443166][T24578] nbd_genl_reconfigure+0x132f/0x1ea0 [ 770.449075][T24578] genl_family_rcv_msg_doit+0x22a/0x330 [ 770.455150][T24578] genl_rcv_msg+0x61c/0x7a0 [ 770.460188][T24578] netlink_rcv_skb+0x232/0x4b0 [ 770.465506][T24578] genl_rcv+0x28/0x40 [ 770.470100][T24578] netlink_unicast+0x75c/0x8e0 [ 770.475394][T24578] netlink_sendmsg+0x813/0xb40 [ 770.480705][T24578] ____sys_sendmsg+0x972/0x9f0 [ 770.485995][T24578] ___sys_sendmsg+0x2a5/0x360 [ 770.491203][T24578] __x64_sys_sendmsg+0x1bd/0x2a0 [ 770.497819][T24578] do_syscall_64+0x174/0x580 [ 770.503323][T24578] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 770.509939][T24578] [ 770.509939][T24578] -> #7 (&nsock->tx_lock){+.+.}-{4:4}: [ 770.517616][T24578] __mutex_lock+0x1a3/0x1550 [ 770.522769][T24578] nbd_queue_rq+0x37b/0x1100 [ 770.528002][T24578] blk_mq_dispatch_rq_list+0xa70/0x1910 [ 770.534164][T24578] __blk_mq_sched_dispatch_requests+0xdcc/0x1600 [ 770.541038][T24578] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 770.547661][T24578] blk_mq_run_hw_queue+0x348/0x4f0 [ 770.553312][T24578] blk_mq_dispatch_list+0xd16/0xe10 [ 770.559132][T24578] blk_mq_flush_plug_list+0x48d/0x570 [ 770.565033][T24578] __blk_flush_plug+0x3ed/0x4d0 [ 770.570609][T24578] __submit_bio+0x28d/0x580 [ 770.575663][T24578] submit_bio_noacct_nocheck+0x2f4/0xa40 [ 770.581829][T24578] block_read_full_folio+0x599/0x830 [ 770.587640][T24578] filemap_read_folio+0x137/0x3b0 [ 770.593201][T24578] do_read_cache_folio+0x358/0x590 [ 770.598838][T24578] read_part_sector+0xb6/0x2b0 [ 770.604127][T24578] adfspart_check_ICS+0xb1/0x960 [ 770.609595][T24578] bdev_disk_changed+0x817/0x1770 [ 770.615148][T24578] blkdev_get_whole+0x380/0x510 [ 770.620791][T24578] bdev_open+0x31e/0xd30 [ 770.625563][T24578] blkdev_open+0x470/0x610 [ 770.630562][T24578] do_dentry_open+0x822/0x13a0 [ 770.635854][T24578] vfs_open+0x3b/0x340 [ 770.640456][T24578] path_openat+0x2e08/0x3860 [ 770.645574][T24578] do_file_open+0x23e/0x4a0 [ 770.650606][T24578] do_sys_openat2+0x113/0x200 [ 770.656059][T24578] __x64_sys_openat+0x138/0x170 [ 770.661449][T24578] do_syscall_64+0x174/0x580 [ 770.666564][T24578] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 770.672983][T24578] [ 770.672983][T24578] -> #6 (&cmd->lock){+.+.}-{4:4}: [ 770.680550][T24578] __mutex_lock+0x1a3/0x1550 [ 770.685704][T24578] nbd_queue_rq+0xc6/0x1100 [ 770.690757][T24578] blk_mq_dispatch_rq_list+0xa70/0x1910 [ 770.696937][T24578] __blk_mq_sched_dispatch_requests+0xdcc/0x1600 [ 770.703805][T24578] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 770.710419][T24578] blk_mq_run_hw_queue+0x348/0x4f0 [ 770.716348][T24578] blk_mq_dispatch_list+0xd16/0xe10 [ 770.722109][T24578] blk_mq_flush_plug_list+0x48d/0x570 [ 770.728043][T24578] __blk_flush_plug+0x3ed/0x4d0 [ 770.733524][T24578] __submit_bio+0x28d/0x580 [ 770.738578][T24578] submit_bio_noacct_nocheck+0x2f4/0xa40 [ 770.744828][T24578] block_read_full_folio+0x599/0x830 [ 770.750638][T24578] filemap_read_folio+0x137/0x3b0 [ 770.756628][T24578] do_read_cache_folio+0x358/0x590 [ 770.762443][T24578] read_part_sector+0xb6/0x2b0 [ 770.767932][T24578] adfspart_check_ICS+0xb1/0x960 [ 770.773507][T24578] bdev_disk_changed+0x817/0x1770 [ 770.779063][T24578] blkdev_get_whole+0x380/0x510 [ 770.784635][T24578] bdev_open+0x31e/0xd30 [ 770.789908][T24578] blkdev_open+0x470/0x610 [ 770.795231][T24578] do_dentry_open+0x822/0x13a0 [ 770.800635][T24578] vfs_open+0x3b/0x340 [ 770.805250][T24578] path_openat+0x2e08/0x3860 [ 770.810383][T24578] do_file_open+0x23e/0x4a0 [ 770.815419][T24578] do_sys_openat2+0x113/0x200 [ 770.820637][T24578] __x64_sys_openat+0x138/0x170 [ 770.826034][T24578] do_syscall_64+0x174/0x580 [ 770.831164][T24578] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 770.837793][T24578] [ 770.837793][T24578] -> #5 (set->srcu){.+.+}-{0:0}: [ 770.844943][T24578] __synchronize_srcu+0xca/0x300 [ 770.850492][T24578] elevator_switch+0x1e8/0x7a0 [ 770.855781][T24578] elevator_change+0x2cc/0x450 [ 770.861072][T24578] elevator_set_default+0x36c/0x430 [ 770.867444][T24578] blk_register_queue+0x3e9/0x4e0 [ 770.873125][T24578] __add_disk+0x677/0xd50 [ 770.877989][T24578] add_disk_fwnode+0xfb/0x480 [ 770.883199][T24578] nbd_dev_add+0x72c/0xb50 [ 770.888152][T24578] nbd_init+0x168/0x1f0 [ 770.893011][T24578] do_one_initcall+0x250/0x870 [ 770.898305][T24578] do_initcall_level+0x104/0x190 [ 770.903772][T24578] do_initcalls+0x59/0xa0 [ 770.908627][T24578] kernel_init_freeable+0x2a6/0x3e0 [ 770.914375][T24578] kernel_init+0x1d/0x1d0 [ 770.919255][T24578] ret_from_fork+0x514/0xb70 [ 770.924481][T24578] ret_from_fork_asm+0x1a/0x30 [ 770.929863][T24578] [ 770.929863][T24578] -> #4 (&q->elevator_lock){+.+.}-{4:4}: [ 770.937948][T24578] __mutex_lock+0x1a3/0x1550 [ 770.943069][T24578] elevator_change+0x1b3/0x450 [ 770.948366][T24578] elevator_set_none+0xb5/0x140 [ 770.953740][T24578] blk_mq_update_nr_hw_queues+0x5e7/0x1a60 [ 770.960072][T24578] nbd_start_device+0x17f/0xb10 [ 770.965458][T24578] nbd_genl_connect+0x165b/0x1cf0 [ 770.971008][T24578] genl_family_rcv_msg_doit+0x22a/0x330 [ 770.977083][T24578] genl_rcv_msg+0x61c/0x7a0 [ 770.982377][T24578] netlink_rcv_skb+0x232/0x4b0 [ 770.987673][T24578] genl_rcv+0x28/0x40 [ 770.992293][T24578] netlink_unicast+0x75c/0x8e0 [ 770.997598][T24578] netlink_sendmsg+0x813/0xb40 [ 771.003041][T24578] ____sys_sendmsg+0x972/0x9f0 [ 771.008436][T24578] ___sys_sendmsg+0x2a5/0x360 [ 771.013643][T24578] __x64_sys_sendmsg+0x1bd/0x2a0 [ 771.019277][T24578] do_syscall_64+0x174/0x580 [ 771.024402][T24578] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 771.030824][T24578] [ 771.030824][T24578] -> #3 (&q->q_usage_counter(io)#50){++++}-{0:0}: [ 771.039434][T24578] blk_alloc_queue+0x546/0x680 [ 771.044731][T24578] __blk_mq_alloc_disk+0x197/0x390 [ 771.050390][T24578] nbd_dev_add+0x499/0xb50 [ 771.055336][T24578] nbd_init+0x168/0x1f0 [ 771.060032][T24578] do_one_initcall+0x250/0x870 [ 771.065319][T24578] do_initcall_level+0x104/0x190 [ 771.070787][T24578] do_initcalls+0x59/0xa0 [ 771.075646][T24578] kernel_init_freeable+0x2a6/0x3e0 [ 771.081376][T24578] kernel_init+0x1d/0x1d0 [ 771.086234][T24578] ret_from_fork+0x514/0xb70 [ 771.091350][T24578] ret_from_fork_asm+0x1a/0x30 [ 771.096637][T24578] [ 771.096637][T24578] -> #2 (fs_reclaim){+.+.}-{0:0}: [ 771.103875][T24578] fs_reclaim_acquire+0x71/0x100 [ 771.109345][T24578] kmem_cache_alloc_lru_noprof+0x45/0x640 [ 771.115590][T24578] alloc_inode+0xb8/0x1b0 [ 771.120442][T24578] iget_locked+0x131/0x6a0 [ 771.125473][T24578] kernfs_get_inode+0x4f/0x780 [ 771.130939][T24578] kernfs_get_tree+0x5cd/0x980 [ 771.136486][T24578] sysfs_get_tree+0x46/0x110 [ 771.141690][T24578] vfs_get_tree+0x92/0x2a0 [ 771.146641][T24578] do_new_mount+0x341/0xd30 [ 771.151669][T24578] __se_sys_mount+0x31d/0x420 [ 771.156965][T24578] do_syscall_64+0x174/0x580 [ 771.162163][T24578] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 771.168575][T24578] [ 771.168575][T24578] -> #1 (&root->kernfs_rwsem){++++}-{4:4}: [ 771.176579][T24578] down_write+0x96/0x200 [ 771.181378][T24578] kernfs_remove_by_name_ns+0x4e/0x140 [ 771.187466][T24578] device_links_driver_bound+0x54f/0x14e0 [ 771.193720][T24578] driver_bound+0xd8/0x2e0 [ 771.198734][T24578] really_probe+0x789/0xaf0 [ 771.203764][T24578] __driver_probe_device+0x1ef/0x380 [ 771.209660][T24578] driver_probe_device+0x4f/0x240 [ 771.215315][T24578] __device_attach_driver+0x279/0x430 [ 771.221259][T24578] bus_for_each_drv+0x258/0x2f0 [ 771.226755][T24578] __device_attach+0x2c5/0x450 [ 771.232161][T24578] device_initial_probe+0xa1/0xd0 [ 771.237723][T24578] bus_probe_device+0x12a/0x220 [ 771.243120][T24578] device_add+0x7e9/0xbb0 [ 771.248156][T24578] faux_device_create_with_groups+0x189/0x290 [ 771.254776][T24578] regulator_dummy_init+0x19/0x40 [ 771.260327][T24578] regulator_init+0xca/0x110 [ 771.265440][T24578] do_one_initcall+0x250/0x870 [ 771.270966][T24578] do_initcall_level+0x104/0x190 [ 771.276520][T24578] do_initcalls+0x59/0xa0 [ 771.281380][T24578] kernel_init_freeable+0x2a6/0x3e0 [ 771.287109][T24578] kernel_init+0x1d/0x1d0 [ 771.292066][T24578] ret_from_fork+0x514/0xb70 [ 771.297186][T24578] ret_from_fork_asm+0x1a/0x30 [ 771.302481][T24578] [ 771.302481][T24578] -> #0 (&root->kernfs_supers_rwsem){++++}-{4:4}: [ 771.311274][T24578] __lock_acquire+0x15a5/0x2cf0 [ 771.316740][T24578] lock_acquire+0x106/0x350 [ 771.321766][T24578] down_read+0x47/0x2e0 [ 771.326444][T24578] kernfs_remove+0x35/0x80 [ 771.331407][T24578] __kobject_del+0xe1/0x330 [ 771.336522][T24578] kobject_del+0x45/0x60 [ 771.341286][T24578] cleanup_glue_dir+0x1a3/0x220 [ 771.346843][T24578] device_del+0x780/0x8f0 [ 771.351695][T24578] cdev_device_del+0x27/0xf0 [ 771.356815][T24578] ib_umad_kill_port+0xf9/0x320 [ 771.362196][T24578] ib_umad_remove_one+0x160/0x270 [ 771.367751][T24578] remove_client_context+0xb9/0x1e0 [ 771.373558][T24578] disable_device+0x137/0x330 [ 771.378769][T24578] __ib_unregister_device+0x2cb/0x3f0 [ 771.384756][T24578] ib_unregister_device_and_put+0xb8/0xf0 [ 771.391004][T24578] nldev_dellink+0x39e/0x430 [ 771.396132][T24578] rdma_nl_rcv+0x6d1/0xa10 [ 771.401160][T24578] netlink_unicast+0x75c/0x8e0 [ 771.406452][T24578] netlink_sendmsg+0x813/0xb40 [ 771.411738][T24578] ____sys_sendmsg+0x972/0x9f0 [ 771.417023][T24578] ___sys_sendmsg+0x2a5/0x360 [ 771.422230][T24578] __x64_sys_sendmsg+0x1bd/0x2a0 [ 771.427698][T24578] do_syscall_64+0x174/0x580 [ 771.432812][T24578] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 771.439317][T24578] [ 771.439317][T24578] other info that might help us debug this: [ 771.439317][T24578] [ 771.449723][T24578] Chain exists of: [ 771.449723][T24578] &root->kernfs_supers_rwsem --> cpuhp_state-up --> gdp_mutex [ 771.449723][T24578] [ 771.463370][T24578] Possible unsafe locking scenario: [ 771.463370][T24578] [ 771.470997][T24578] CPU0 CPU1 [ 771.476372][T24578] ---- ---- [ 771.481865][T24578] lock(gdp_mutex); [ 771.485764][T24578] lock(cpuhp_state-up); [ 771.492618][T24578] lock(gdp_mutex); [ 771.499037][T24578] rlock(&root->kernfs_supers_rwsem); [ 771.504607][T24578] [ 771.504607][T24578] *** DEADLOCK *** [ 771.504607][T24578] [ 771.512756][T24578] 3 locks held by syz.0.4451/24578: [ 771.517956][T24578] #0: ffffffff9a7ef3c8 (&rdma_nl_types[idx].sem){.+.+}-{4:4}, at: rdma_nl_rcv+0x328/0xa10 [ 771.527973][T24578] #1: ffff8880739686f8 (&device->unregistration_lock){+.+.}-{4:4}, at: __ib_unregister_device+0x284/0x3f0 [ 771.539387][T24578] #2: ffffffff8f390060 (gdp_mutex){+.+.}-{4:4}, at: cleanup_glue_dir+0xc3/0x220 [ 771.548637][T24578] [ 771.548637][T24578] stack backtrace: [ 771.554529][T24578] CPU: 1 UID: 0 PID: 24578 Comm: syz.0.4451 Not tainted syzkaller #0 PREEMPT(full) [ 771.554546][T24578] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 771.554556][T24578] Call Trace: [ 771.554564][T24578] [ 771.554572][T24578] dump_stack_lvl+0xe8/0x150 [ 771.554589][T24578] print_circular_bug+0x2e1/0x300 [ 771.554610][T24578] check_noncircular+0x12e/0x150 [ 771.554630][T24578] __lock_acquire+0x15a5/0x2cf0 [ 771.554649][T24578] ? irqentry_exit+0x218/0x8b0 [ 771.554664][T24578] ? lockdep_hardirqs_on+0x7a/0x110 [ 771.554678][T24578] ? irqentry_exit+0x218/0x8b0 [ 771.554691][T24578] ? trace_irq_disable+0x3b/0x140 [ 771.554713][T24578] ? kernfs_remove+0x35/0x80 [ 771.554731][T24578] lock_acquire+0x106/0x350 [ 771.554745][T24578] ? kernfs_remove+0x35/0x80 [ 771.554768][T24578] down_read+0x47/0x2e0 [ 771.554783][T24578] ? kernfs_remove+0x35/0x80 [ 771.554803][T24578] kernfs_remove+0x35/0x80 [ 771.554822][T24578] __kobject_del+0xe1/0x330 [ 771.554840][T24578] kobject_del+0x45/0x60 [ 771.554855][T24578] cleanup_glue_dir+0x1a3/0x220 [ 771.554870][T24578] device_del+0x780/0x8f0 [ 771.554885][T24578] ? __pfx_device_del+0x10/0x10 [ 771.554899][T24578] ? xa_load+0x60/0x210 [ 771.554914][T24578] cdev_device_del+0x27/0xf0 [ 771.554930][T24578] ib_umad_kill_port+0xf9/0x320 [ 771.554950][T24578] ? remove_client_context+0x79/0x1e0 [ 771.554964][T24578] ib_umad_remove_one+0x160/0x270 [ 771.554985][T24578] ? __pfx_ib_umad_remove_one+0x10/0x10 [ 771.555003][T24578] remove_client_context+0xb9/0x1e0 [ 771.555017][T24578] disable_device+0x137/0x330 [ 771.555032][T24578] ? __pfx_disable_device+0x10/0x10 [ 771.555048][T24578] ? __mutex_unlock_slowpath+0x1be/0x6f0 [ 771.555064][T24578] ? __pfx_autoremove_wake_function+0x10/0x10 [ 771.555085][T24578] __ib_unregister_device+0x2cb/0x3f0 [ 771.555110][T24578] ib_unregister_device_and_put+0xb8/0xf0 [ 771.555131][T24578] nldev_dellink+0x39e/0x430 [ 771.555151][T24578] ? __pfx_nldev_dellink+0x10/0x10 [ 771.555199][T24578] ? apparmor_capable+0x126/0x170 [ 771.555216][T24578] ? bpf_lsm_capable+0x9/0x20 [ 771.555238][T24578] ? security_capable+0x7e/0x2c0 [ 771.555258][T24578] ? __pfx_nldev_dellink+0x10/0x10 [ 771.555276][T24578] rdma_nl_rcv+0x6d1/0xa10 [ 771.555299][T24578] ? __pfx_rdma_nl_rcv+0x10/0x10 [ 771.555325][T24578] ? netlink_deliver_tap+0x2e/0x1b0 [ 771.555341][T24578] ? netlink_deliver_tap+0x2e/0x1b0 [ 771.555357][T24578] netlink_unicast+0x75c/0x8e0 [ 771.555375][T24578] netlink_sendmsg+0x813/0xb40 [ 771.555393][T24578] ? __pfx_netlink_sendmsg+0x10/0x10 [ 771.555410][T24578] ? aa_sock_msg_perm+0xf1/0x1b0 [ 771.555431][T24578] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 771.555450][T24578] ____sys_sendmsg+0x972/0x9f0 [ 771.555471][T24578] ? __pfx_____sys_sendmsg+0x10/0x10 [ 771.555489][T24578] ? import_iovec+0x73/0xa0 [ 771.555506][T24578] ___sys_sendmsg+0x2a5/0x360 [ 771.555522][T24578] ? __lock_acquire+0x6b5/0x2cf0 [ 771.555537][T24578] ? __pfx____sys_sendmsg+0x10/0x10 [ 771.555553][T24578] ? __lock_acquire+0x6b5/0x2cf0 [ 771.555576][T24578] ? __fget_files+0x2a/0x420 [ 771.555593][T24578] ? __fget_files+0x3a0/0x420 [ 771.555612][T24578] __x64_sys_sendmsg+0x1bd/0x2a0 [ 771.555629][T24578] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 771.555648][T24578] ? handle_softirqs+0x715/0x840 [ 771.555665][T24578] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 771.555680][T24578] do_syscall_64+0x174/0x580 [ 771.555695][T24578] ? clear_bhb_loop+0x40/0x90 [ 771.555711][T24578] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 771.555725][T24578] RIP: 0033:0x7fad2c59ce59 [ 771.555740][T24578] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 771.555752][T24578] RSP: 002b:00007fad2d523028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 771.555769][T24578] RAX: ffffffffffffffda RBX: 00007fad2c815fa0 RCX: 00007fad2c59ce59 [ 771.555779][T24578] RDX: 0000000000000000 RSI: 0000200000000440 RDI: 0000000000000005 [ 771.555789][T24578] RBP: 00007fad2c632d6f R08: 0000000000000000 R09: 0000000000000000 [ 771.555798][T24578] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 771.555807][T24578] R13: 00007fad2c816038 R14: 00007fad2c815fa0 R15: 00007ffc6d22c088 [ 771.555823][T24578] [ 772.031707][T24578] smbdirect: ib_dev[syz0] removed