last executing test programs: 14.818732006s ago: executing program 4 (id=3072): bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0xe, 0x16, &(0x7f0000001440)=ANY=[@ANYBLOB="611578000000000061133c0000000000bfa000000000000007000000ee0000052d03010000000000250500000000000069163e0000000000bf07200000000000350507000fff0720670500003f000000140300000ee60060bf500000000000002f650000000000006507f9ff0100000007070000cddfffff1e75000000000000bf54000000000000070400000400f9ffad4301000000000095000000000000001500000000000000950000000000000032ed3c12dc8c27df8ecf264e0f84f9f17d3c30e32f1754558f2278af6d71d79a5e12814cb1d8a5d4601d295c45a6a0b9bdb7dd3997f9c9c4f6f3be4b369289aa6812b8e007e733a9a4f1b0af3dda82ee45a010fb94fe9de57b9d8a814261bdb94a05002000c6c60bf70d742a81762bab8395fa64810b5b40d893ea8fe0185473d51b546cad3f1d5ab2af27546e7c955ccefa1f6ab689b555202da2e0ec2871b4a7e65836429a527dc47ebe84a423b6c8d345dc8da3085b0ab71ca1b901627b562ed04ae76002d4519af619e3cca4d69e0dee5eb106774a8f3e6916dfec88158f0200000000c8fb730a5c1bf2b2bb71a629361997a75fd552bdc206438b8ef4901fd03c16dfda44e2a2235c8ac86d8a297dff0445a15f21dce431e56723888fb126a163f16f920ae2fb494059bba8e3b680324a188076eb685d55c4e9b2ad9bc1172ba7cbebe174aba210d739a018f9bbec63222d20cecac4d03723f1c932fb3bba54b3a6aa57f1ad2e99e0e67ab9ff16d20000009f0f53acbb40b4f8e2738270001562ed834f2af97787f696649a462e7ee4bcf8b07a10d6735154beb4000000000000000000000000004000bc00f679629709e7e78f4ddc211bc3ebe6bd9d42ca0140a7afaab43176e65ec1118d50d1e827f3472f4445d253880800000000000000690884f800031e03a651bb96589a7e2e509bcc1d161347623cb5e7ac4629c8ab04871bc47287cd31cc43010000007b40407d000000210000000000000000005f37d83f84e98a523d80bd970d703f37ca364a601ae899a56715a0a62a34c6c94cce6994521629ab028acfc1d926a0f6a5489af8dc2f17923f3c40dfd1970a55c22fe3a5ac000000000000000000000000000000c1eb2d91fb79ea00000000000000bb0d00000000000000000000e4007be511fe32fbc90e2364a55e9bb66ac64423d2d00fea2594e190de000000003cc3aa39642994cacd473b543ccb5f0d7b63924f17c67b13631822a11dc3c693962895496d4f6e9cc54db6c7205a6b068fff496d2da7d6327f31d7c8cc5d325c5379b0363ce8bd1f61b007e1ff5f1be1969a1ba791ad46d800000000c7f26a0337302f3b41eae59809fd05d12f6186f117b062df67d3a63f3265dd1410eea68208a3f26b2989b832d8b34a34a4f08b34b3042065acaa10856e858d27adee7daf32903d3fc78700d429a2d4c8b6d803eb83eecfe4c7ff9e6ab5a52e83d089dad7a8710e0254f1b11cced7bc3c8da0c44d2fbf9f6f3ff3be4d1458077c2253b0c7c7a0a9fdd63bf910dc20e5cb2a88e59febc47f1212a21f631dbaa74f22bad050e9856b48ae3a03a497c37758537650fe6db80300c41fdc3d78e046f6160e1741299e6431ed1eab5d067a183f064b060a8ec12725d42e3a74863d66bee966b1574f8e01b3f34a01000000a1e1c758a0079b747067312e9815a21cb3f1f8150d999d788535a4d3114dbc7e2bf2402a75fd7a55733360040855ed5d1c0d634fc5fb38f84d9d87b27f8a5d9121fdc058447b728f134f72062fc4b1ca0780b1a7af137ff7b4ff139604faf0453b65586f65c7943d56b52f06c870edf0c5d744b5272b44c23488b2bdbff947c4dfa108cbb88202eeb81f428a5b3c299848649e1a6bff52f657a67463d7dbf85ae9321fc2cc17dc4a29b9cba8ded5de8206c812439ab129ae818837ee1562078fc524b3baf49a0be9bb7d958d5e87c6c09bf71a894bad62934782cc308e936d7637e07c4a2a3bc87b0da20000d9ef418cf19e7a8c4c328be0ce91798adc2dca871073f6bd61940aabc86b94f8cbde4d47060400e722a6a2af483ad0d3415ed0f9db009acaba9eaea93f811d434e00000000000000000000d1542c882e672fea96aedf346279ec00000000000000000000d535d41b0067f01e2e54b9154d876020b669640ead4ca44631fadf7c4ac39a1b331dbdcd52b36df021b731ef1f92330d347f88ced5c1aaadbcdd8d2257e3a9a7c7494fadf9be36f7a2474ee6e9446fa1fd486f85d672a77dc5bd21463994d49f12016305a1e394d292b66840fe32b40ad665d241a8b8a32b3100450c32832789aa8a096f41201b585cd76631c88cf958e9e9047f5af1730c5e83db12460a0768fd4b62be6c41eed307048bac8d1f7f164574241e06027654b248dcc38749eee0c1ee7c61b3f6411a559c3d45637b11e440ed5a99109b8e71d28c3d677af5f0499c6d3fc6e15e1417058ba11671295d20ba906d4331ce87573d2472371ac6369744a569da6c90f0e8ecba9ee68be2691922073d177bdffd5f1aa96173286f7d66f6c3e6b5eff01ed91681bbddcc66544b42a3d68c129798f2ae62b0fc690c9df12ef0dee69bdbe446322a18155e6662c13708d73aa49f1d8fd2cf86754065bfed808d0c76caaca1e0fc8a6baf185b58a1541911688f4a055bc49ed73c5bfb556c7c7bb62a8594e0aef56a374f4bf910a60d9cd751c3a14f94a3be70dbc9211d754ca9023e1efeef81c775664c3f348d000000000000000000000076d4b94b8d33469cdf2aba94c6e871fcd122f18409ee01620e45ab01c4af441373c1e6234b631ea4bb41e344"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0xffffffffffffffd2}, 0x48) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000007c0)=ANY=[], 0x7c}, 0x1, 0x0, 0x0, 0x40}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0b0000000700000001000100090000"], 0x48) r2 = bpf$MAP_CREATE(0x0, 0x0, 0x48) r3 = bpf$BPF_LINK_CREATE(0x1c, &(0x7f0000000100)={0xffffffffffffffff, r2, 0x7, 0x0, @val=@tcx}, 0x1c) r4 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000000)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x2, [@struct]}}, 0x0, 0x26}, 0x20) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000500)={0x6, 0xc, &(0x7f0000000cc0)=@framed={{}, [@func={0x85, 0x0, 0x1, 0x0, 0x3}, @map_val, @exit, @tail_call]}, &(0x7f0000000280)='GPL\x00', 0xa, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, r4, 0x8, 0x0, 0x0, 0x10, &(0x7f00000004c0), 0x10}, 0x90) bpf$BPF_LINK_UPDATE(0x1d, &(0x7f0000000040)={r3}, 0x16) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000000)=ANY=[@ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000010000001801000020756c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000000085"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000500)={r5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) sendmsg$NFT_BATCH(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000500)={{0x14}, [@NFT_MSG_DELRULE={0x2c, 0x6, 0xa, 0x3, 0x0, 0x0, {0x2}, [@NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x5}}}, 0x54}, 0x1, 0x0, 0x0, 0x20040804}, 0x800) r6 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) r7 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r8 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r9 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0x200000, 0x0) ioctl$TUNSETVNETHDRSZ(r9, 0x400454d8, &(0x7f0000000240)=0x7f) r10 = openat$cgroup_ro(r8, &(0x7f00000000c0)='cpu.stat\x00', 0x275a, 0x0) preadv(r10, &(0x7f00000002c0)=[{&(0x7f0000001740)=""/12, 0xc}], 0x1, 0x4, 0xfffffffe) connect$bt_l2cap(r7, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) ioctl$sock_bt_hidp_HIDPCONNADD(r6, 0x400448c8, &(0x7f0000000280)={r7, r7, 0x3, 0x53, &(0x7f0000000140)="818325fd661ca34ec8a87d1ff40eb45db54c3a60f05b063fb3d9c2b335d57194899e6a9b9ad986ab0107b3bc118c90fd6e03e349ed30a5f125502ec3d6a150f3eb5eb8325d7c9b73a559bede854e9212235276", 0x9, 0xf3, 0x15c2, 0x40, 0xc336, 0x1, 0x7ff, 'syz0\x00'}) 13.720537711s ago: executing program 4 (id=3077): r0 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000980)=ANY=[@ANYBLOB="380000005500e50226bd70000100000007000000", @ANYRES32, @ANYBLOB="200001"], 0x38}, 0x1, 0x0, 0x0, 0x2000c844}, 0x20000150) socket$packet(0x11, 0x2, 0x300) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) (async) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) socket$kcm(0x2, 0xa, 0x2) (async) r2 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r1, &(0x7f0000000100)=ANY=[@ANYBLOB="00200000ffffffffffffbbbb0000000088a82000810039000800450000240000000000299078ac1414bbe000000103000000001090780200000080000000"], 0x3e) (async) write$tun(r1, &(0x7f0000000100)=ANY=[@ANYBLOB="00200000ffffffffffffbbbb0000000088a82000810039000800450000240000000000299078ac1414bbe000000103000000001090780200000080000000"], 0x3e) r3 = socket(0x2, 0x80805, 0x0) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r4, 0x0) close(0x3) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r4, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x1c, &(0x7f0000000300)=[@in6={0xa, 0x4e24, 0x1536ef9, @private2={0xfc, 0x2, '\x00', 0x1}, 0x7}]}, &(0x7f0000000180)=0x10) (async) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r4, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x1c, &(0x7f0000000300)=[@in6={0xa, 0x4e24, 0x1536ef9, @private2={0xfc, 0x2, '\x00', 0x1}, 0x7}]}, &(0x7f0000000180)=0x10) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r4, 0x84, 0x7a, &(0x7f0000000400)={r5, @in={{0x2, 0x4e24, @private=0xa010104}}}, &(0x7f0000000040)=0x84) sendmmsg$inet_sctp(r3, &(0x7f00000032c0)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="30000000000000008400000001000000000000017c"], 0x30}], 0x1, 0x0) setsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r3, 0x84, 0x18, &(0x7f00000002c0)={r6, 0x9}, 0x8) epoll_create(0x7) (async) r7 = epoll_create(0x7) r8 = epoll_create(0x7) r9 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r9, 0x1, r8, &(0x7f0000000100)) (async) epoll_ctl$EPOLL_CTL_ADD(r9, 0x1, r8, &(0x7f0000000100)) epoll_create1(0x0) (async) r10 = epoll_create1(0x0) r11 = socket$nl_route(0x10, 0x3, 0x0) r12 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r12, 0x8933, &(0x7f0000000c80)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r11, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0x0, {0x0, 0x0, 0x0, r13, {0x0, 0xffe0}, {0xffff, 0xffff}, {0x10}}, [@qdisc_kind_options=@q_gred={{0x9}, {0x14, 0x2, [@TCA_GRED_DPS={0x10, 0x3, {0xd, 0x3, 0x1, 0x1}}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x51}, 0x0) sendmsg$nl_route_sched(r11, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000007c0)=@newqdisc={0x138, 0x24, 0xd0f, 0x200000, 0x0, {0x60, 0x0, 0x0, r13, {}, {0xffff, 0xffff}, {0x0, 0x10}}, [@qdisc_kind_options=@q_gred={{0x9}, {0x108, 0x2, [@TCA_GRED_STAB={0x104, 0x2, "abcc61b4e508c02286f1bafc7a22c407a52b0e13291c865d493f15736245f220cd4e40006df455836aa3bd3aaa2c9b95578719c46f89e0179832927deecf7465ea95bd97b018b7afaccdcb28bb42d677b73c44e790f0875fb4b795ca95b7dd712d2c5d69945535f92f74a71236749b077cc85e96554beb53c986a216051bd5979a8cfcfe9f98be58ff7944f6cfda8579dbaedceee578bfd1fb554b6e185e9315425ef0a3fc69d17ede93fc7c46357990604b9f12033688caa0b04adecfc926b3f6ca25bcb5432905e3f30ccbf10cf0f2d00858ba2bbd2702b8d4a7a7c744fbaa2fa35b1c586020d600"}]}}]}, 0x138}}, 0x24008004) (async) sendmsg$nl_route_sched(r11, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000007c0)=@newqdisc={0x138, 0x24, 0xd0f, 0x200000, 0x0, {0x60, 0x0, 0x0, r13, {}, {0xffff, 0xffff}, {0x0, 0x10}}, [@qdisc_kind_options=@q_gred={{0x9}, {0x108, 0x2, [@TCA_GRED_STAB={0x104, 0x2, "abcc61b4e508c02286f1bafc7a22c407a52b0e13291c865d493f15736245f220cd4e40006df455836aa3bd3aaa2c9b95578719c46f89e0179832927deecf7465ea95bd97b018b7afaccdcb28bb42d677b73c44e790f0875fb4b795ca95b7dd712d2c5d69945535f92f74a71236749b077cc85e96554beb53c986a216051bd5979a8cfcfe9f98be58ff7944f6cfda8579dbaedceee578bfd1fb554b6e185e9315425ef0a3fc69d17ede93fc7c46357990604b9f12033688caa0b04adecfc926b3f6ca25bcb5432905e3f30ccbf10cf0f2d00858ba2bbd2702b8d4a7a7c744fbaa2fa35b1c586020d600"}]}}]}, 0x138}}, 0x24008004) epoll_ctl$EPOLL_CTL_ADD(r8, 0x1, r7, &(0x7f0000000140)={0x60000000}) (async) epoll_ctl$EPOLL_CTL_ADD(r8, 0x1, r7, &(0x7f0000000140)={0x60000000}) epoll_ctl$EPOLL_CTL_ADD(r10, 0x1, r9, &(0x7f0000000000)) (async) epoll_ctl$EPOLL_CTL_ADD(r10, 0x1, r9, &(0x7f0000000000)) sendmsg$key(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00008feff0)={0x0}}, 0x8850) sendmsg$key(0xffffffffffffffff, &(0x7f0000000100)={0x4, 0x0, &(0x7f00008feff0)={&(0x7f0000000140)=ANY=[@ANYBLOB="020d0000100000002f3144a8edffffff03000600ff18000002004909000100000000000000001e0e080012000200010000d200000000000030006c540203009f7eae02000000adb20200000000f52c000000cdff00000001020014bb000001000000002300001300030005000020000002"], 0x80}}, 0x0) 11.618544679s ago: executing program 4 (id=3095): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)=ANY=[@ANYBLOB="2c000000090601020000000000000000000000000900020073797a3100000000050001000700000004000780d2bbc6d9475b6787d27afb58638f452fad5917e6"], 0x2c}, 0x1, 0x0, 0x0, 0x10040047}, 0x240008c4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="0f000000040000000400000012"], 0x50) r4 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0xe, 0x5, &(0x7f00000007c0)=@framed={{0x18, 0x2}, [@initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0xa}]}, &(0x7f00000005c0)='syzkaller\x00'}, 0x94) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000280)=ANY=[@ANYRES32=r3, @ANYRES32=r4, @ANYBLOB="05"], 0x10) r5 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r5, 0x0, 0x0) connect$inet6(r5, &(0x7f0000000340)={0x2, 0x0, 0x0, @rand_addr=' \x01\x00'}, 0x1c) socket$netlink(0x10, 0x3, 0x8000000004) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000200), 0xffffffffffffffff) r8 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000c80)={'lo\x00', 0x0}) sendmsg$WG_CMD_GET_DEVICE(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000800)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r7, @ANYBLOB="01032cbd700000dcdf250000000008000100", @ANYRES32=r9, @ANYBLOB="0a8088fe3e007372d273c508bb300668fb73cf5da0d689575633a4f641bd71b78eafe184a003a36def109ba42c8db60b38201587b29875104b1353aa493393639ec2804387ebeeb3b2f0f66cf3d96f0b03265ffd9a9f6935b6c980040ee3c1aaa56a3e81d59b65c6c04294815d478d36d902abf1fb3b2a176171a601ee3e3b6af723"], 0x1c}, 0x1, 0x0, 0x0, 0xc0}, 0x404c880) bind$inet6(0xffffffffffffffff, 0x0, 0x0) syz_emit_ethernet(0x46, &(0x7f0000000740)={@link_local, @random="9144e7641200", @val={@val={0x88a8, 0x1, 0x0, 0x2}, {0x8100, 0x3, 0x0, 0x4}}, {@ipv6={0x86dd, @udp={0x0, 0x6, "00b700", 0x8, 0x11, 0x1, @empty, @mcast2, {[], {0x0, 0x4e21, 0x8}}}}}}, 0x0) r10 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000001a40)={&(0x7f0000000540)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x24, 0x24, 0x4, [@array={0x0, 0x0, 0x0, 0x3, 0x0, {0x5, 0x2, 0x5}}, @fwd={0x9}]}, {0x0, [0x2e, 0x61]}}, &(0x7f0000001980)=""/150, 0x40, 0x96, 0x1, 0x4}, 0x28) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000001a80)={0x3, 0x4, 0x4, 0xa, 0x0, r3, 0x5, '\x00', 0x0, r10, 0x0, 0x0, 0x5}, 0x50) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000440)={r3, &(0x7f0000000440), &(0x7f0000000040)=@udp=r2}, 0x20) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x21) syz_emit_ethernet(0xbe, &(0x7f0000000000)={@dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xc}, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0xb0, 0x0, 0x0, 0x0, 0x11, 0x0, @empty, @empty}, {0x4e21, 0x4e20, 0x9c, 0x0, @wg=@initiation={0x1, 0x0, "7b4b142b7461fd777b1c012bd14efb9f49fcdb8f080c26a04883ad5c8c82b8af", "584cbf2649a50f2dbc43efa8698d0a881c51852e4451b57d037ad3c04594282423424d00", "bcfd56f1375461caaa2f19935e697cc7096ffeeb0300000000000064", {"9a3bfbc1f39cb307b3472eb9cdb042d2", "643fcbb2c5a57df67d544af6e8dafe09"}}}}}}}, 0x0) r11 = socket(0xa, 0x5, 0x0) sendmsg$inet_sctp(r11, &(0x7f0000001640)={&(0x7f0000000100)=@in6={0xa, 0x4e24, 0x4, @rand_addr=' \x01\x00', 0x6}, 0x1c, &(0x7f0000000280)=[{&(0x7f0000000300)="dd950918be7b71b7ce56a05765f41d50ddfc9df8", 0x14}], 0x1, &(0x7f00000008c0)=[@prinfo={0x18, 0x84, 0x5, {0x20, 0x2}}, @init={0x18, 0x84, 0x0, {0xc7d, 0x5, 0x1, 0x2}}, @init={0x18, 0x84, 0x0, {0x3ff, 0x6, 0x8, 0x1}}, @dstaddrv4={0x18, 0x84, 0x7, @local}], 0x60, 0x4008000}, 0x28008841) setsockopt$inet_sctp_SCTP_FRAGMENT_INTERLEAVE(r11, 0x84, 0x12, &(0x7f0000000000)=0x4ca68b28, 0x4) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x2003}, 0x94) r12 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f0000000200)='syzkaller\x00', 0x9}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r12, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) 9.25798441s ago: executing program 4 (id=3112): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000001b80)=ANY=[@ANYBLOB="0600000004000000080000000a"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000e00)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000000000000000000000000181100", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000b2e900007b8af8ff00000000bfa200000000000007020000f8feffffb703000000000000b70400000000000085000000c300000095"], 0x0, 0xfffffffc, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x11, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x94) r2 = socket$packet(0x11, 0x2, 0x300) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x18, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$sock_attach_bpf(r2, 0x1, 0x32, &(0x7f0000000180)=r3, 0x4) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={0xffffffffffffffff, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x88be, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) sendmsg$nl_route(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=@newlink={0x44, 0x10, 0x401, 0x70bd28, 0x80, {0x0, 0x0, 0x0, 0x0, 0x1705, 0x200febe}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macsec={{0xb}, {0x4}}}, @IFLA_LINK={0x8}, @IFLA_MASTER={0x8}]}, 0x44}, 0x1, 0x0, 0x0, 0x4}, 0x0) 9.029039187s ago: executing program 4 (id=3116): bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="0a00000003fa000000880000", @ANYRES32], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0xa, 0x4, &(0x7f00000000c0)=ANY=[@ANYBLOB="180000000220000000000000080000006b1189000000000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x22, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x94) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_int(r1, 0x29, 0x1a, &(0x7f0000000100)=0x5, 0x4) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000004c0)=ANY=[@ANYBLOB="ab905096f0dacf1addb2f303c961954000000010000304001320000000000000000000", @ANYRES32=0x0, @ANYBLOB="80200100420000002000128008000100677470001400028008000200", @ANYRES32=r1, @ANYBLOB="08000100", @ANYRES32=r1, @ANYBLOB], 0x40}, 0x1, 0xba01}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000480)='cgroup.controllers\x00', 0x275a, 0x0) write$tun(r2, &(0x7f0000000540)=ANY=[@ANYRES64=r2], 0x38) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000400)=@bpf_lsm={0x6, 0x4, &(0x7f0000000240)=ANY=[@ANYBLOB="18000000000000000000000000000000d3980500010000009500000000000000b2bd396551f70d205f166dea7ee660913ee03d0b34abcada73dd95ee9acb849aa401034f165a2394c3a890ffc71aa601d1e012a9bce3bd2498fd55d523141969ccdef3c5d091dcff2bb2a878eb902d3a06bf6bd177d026adeff41d84dc8cd84a9b3d9858a59caba97cb0b3aaf45371a69a78108a547ceaa4c12843a0c0215baf3b40759a2227243c506337d0dd93c6c34783bbf608a90d3b67113758781b3da727bfc975418063c0a5c865d2f6bc76210681640bb1d0e2a3e8f6d36c30e13f5c3d6bb953d7d67ff1d2cbdd09e5ea3c9e0026"], &(0x7f0000000040)='GPL\x00', 0x8, 0x0, 0x0, 0x0, 0x5, '\x00', 0x0, 0x1b, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x6}, 0x94) r3 = socket(0x2, 0x80805, 0x0) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000040)={0x0, 0x9007}, 0x4) close(0xffffffffffffffff) ioctl$sock_inet_udp_SIOCINQ(r3, 0x541b, &(0x7f0000000600)) shutdown(0xffffffffffffffff, 0x1) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000008c0)={0xffffffffffffffff, 0xe0, &(0x7f00000007c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, &(0x7f00000005c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x6, 0x3, &(0x7f0000000640)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000680)=[0x0, 0x0, 0x0], 0x0, 0x2b, &(0x7f00000006c0)=[{}, {}, {}, {}, {}, {}], 0x30, 0x10, &(0x7f0000000700), &(0x7f0000000740), 0x8, 0x3a, 0x8, 0x8, &(0x7f0000000780)}}, 0x10) socket$nl_generic(0x10, 0x3, 0x10) r5 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_ADD_VIF(r5, 0x0, 0xca, 0x0, 0x0) setsockopt$sock_int(r2, 0x1, 0xb, &(0x7f0000000080)=0x10001, 0x4) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_SUBFLOW_DESTROY(r6, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000900)={0x50, r7, 0x4, 0x0, 0xffffffff, {}, [@MPTCP_PM_ATTR_TOKEN={0x8, 0x4, 0x7}, @MPTCP_PM_ATTR_ADDR={0x4}, @MPTCP_PM_ATTR_ADDR_REMOTE={0x30, 0x6, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r4}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @mcast2}, @MPTCP_PM_ADDR_ATTR_ID={0x5}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}]}]}, 0x50}}, 0x0) setsockopt$inet_mreq(0xffffffffffffffff, 0x0, 0x23, 0x0, 0x0) getsockopt$CAN_RAW_FD_FRAMES(r2, 0x65, 0x5, &(0x7f0000000340), &(0x7f0000000380)=0x4) syz_emit_ethernet(0x36, &(0x7f0000000140)=ANY=[@ANYBLOB], 0x0) setsockopt$MRT_ADD_MFC_PROXY(0xffffffffffffffff, 0x0, 0xd2, &(0x7f0000000200)={@empty, @multicast2=0xe0000300, 0x0, "028a3f6c58b274e6d8451697efe42811ee1df06e9264f7d866b1970548fc3c7b", 0xb2, 0xffffeff7, 0x1, 0x40000006}, 0x68) r8 = socket$netlink(0x10, 0x3, 0x0) writev(r8, &(0x7f00000003c0)=[{&(0x7f0000000180)="390000001300034700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) 6.474067262s ago: executing program 4 (id=3129): socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_STAT_GET(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="20000000111401f2f08ca8000000000008004a000100000008004b0013"], 0x20}}, 0x0) socket(0x2b, 0x80801, 0x1) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ctr-aes-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r4 = accept4(r3, 0x0, 0x0, 0x800) sendmsg$NL80211_CMD_TDLS_OPER(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000001c0)=ANY=[@ANYBLOB="14000000", @ANYRES16=0x0, @ANYBLOB="00f328bd70000000000000000000"], 0x4b}, 0x1, 0x0, 0x0, 0x20040084}, 0x10) recvmsg(r4, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000600)=[{&(0x7f0000000140)=""/77, 0x37}, {&(0x7f00000007c0)=""/232, 0xf2}, {&(0x7f0000000540)=""/32, 0x20}], 0x3}, 0x0) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_LLSEC_ADD_SECLEVEL(r5, 0x0, 0x4) recvmsg(r0, &(0x7f0000000500)={&(0x7f0000000040)=@hci, 0x80, &(0x7f0000000100)=[{&(0x7f0000000400)=""/248, 0xd68210}], 0x1, 0x0, 0x1f00000000000000, 0x200000}, 0x1f00) sendmsg$tipc(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000140)="a2", 0xfffffdef}], 0x1}, 0x0) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x2, 0x3032, 0xffffffffffffffff, 0x0) r6 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_add_memb(r6, 0x107, 0x1, 0x0, 0x0) setsockopt$packet_add_memb(r6, 0x107, 0x1, &(0x7f0000000000)={0x0, 0x1, 0x6, @random="790c7edd3d8d"}, 0x10) 4.588198259s ago: executing program 3 (id=3150): r0 = socket$nl_generic(0x10, 0x3, 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x1, 0x4, &(0x7f0000000700)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x200}, [@generic={0x81, 0x1, 0x1, 0x66}]}, &(0x7f0000000c40)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x8eceb2e30985c02b, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd}, 0x94) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000001c0)={0xd, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x1, 0x0, 0x3, 0x2, 0x1, 0x20}]}, &(0x7f0000000040)='syzkaller\x00', 0xb, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x9}, 0x90) bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0x10, 0x4, 0x8, 0xb}, 0x50) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r1, 0xc0c89425, &(0x7f00000002c0)={"6b2f3b6a399bc2f1af59106a2a1667f8", 0x0, 0x0, {0x9, 0x9d5f}, {0x0, 0x43}, 0x7, [0xde97, 0x8e9, 0xc, 0x5, 0x10, 0xfffffffffffffffb, 0x4000000000, 0x2, 0x34dfffc, 0x7ffffffffffffffb, 0x6, 0x4, 0x8, 0x8, 0xffffffffffffffff, 0x5ce2]}) write$cgroup_subtree(r1, &(0x7f0000000280)=ANY=[], 0x10448) mmap(&(0x7f0000000000/0x95c000)=nil, 0x95c000, 0x9, 0x8c4b815a5465c2b1, 0xffffffffffffffff, 0xb0260000) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r3, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c560a0677bc45ff810500000000000058000b480400945f64009400050028925a01000000000000008000f0fffeffe809000000fff5dd0000001000010000081000418e00000004fcff", 0x58}], 0x1) setsockopt$inet6_tcp_TCP_ULP(r2, 0x6, 0x1f, &(0x7f00000002c0), 0x4) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000002b40), r4) sendmsg$NLBL_MGMT_C_ADD(r4, &(0x7f0000002c40)={0x0, 0x0, &(0x7f0000002c00)={&(0x7f00000003c0)=ANY=[@ANYBLOB="3400000050343e485362460c9d38a11601043bcc202768ce215326f6f5b914eb018cb004a5486e7dcb47a3027e45355be18b6b4452cebefa2a46555ad2f98553817c1079f5c72cfc1813287be188bc206f4809dde5911ed78fe049328d6436a0eb22d9ebbf60ff08dda16f3dbda9474024a53d23", @ANYRES16=r5, @ANYBLOB="010025bd7000fedbdf250100000008000700000000000e0001006e65742f6c326361700000000800020003000000"], 0x34}, 0x1, 0x0, 0x0, 0x20000000}, 0x4000080) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r1, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_attach_bpf(r7, 0x1, 0x4c, &(0x7f0000000000), 0x4) sendmsg$inet(r6, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) recvmsg$unix(r7, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) r9 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r9, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)={0x14, 0x14, 0x229, 0x0, 0x0, {0xa}}, 0x14}}, 0x0) ioctl$sock_inet_SIOCADDRT(r8, 0x890b, 0x0) getsockopt$sock_int(r0, 0x1, 0x2f, 0x0, &(0x7f0000000080)) 4.33786407s ago: executing program 3 (id=3153): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000380)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r2, {0x0, 0x7ffe}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_fq_codel={{0xd}, {0x4}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000780)=@newtfilter={0x40, 0x2c, 0xd27, 0x170bd2b, 0x2, {0x0, 0x0, 0x0, r2, {0x0, 0x10}, {}, {0x8, 0xffe0}}, [@filter_kind_options=@f_flow={{0x9}, {0x10, 0x2, [@TCA_FLOW_KEYS={0x8, 0x1, 0x1a29d}, @TCA_FLOW_ACT={0x4}]}}]}, 0x40}, 0x1, 0x0, 0x0, 0x884}, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x6, 0x4, &(0x7f0000000100)=@framed={{0x18, 0x2, 0x0, 0x0, 0xfffffffd}, [@call={0x85, 0x0, 0x0, 0x94}]}, &(0x7f0000000000)='syzkaller\x00', 0x2, 0x0, 0x0, 0x40f00, 0x40, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x5}, 0x94) 3.96999241s ago: executing program 3 (id=3158): r0 = socket$xdp(0x2c, 0x3, 0x0) mmap(&(0x7f0000005000/0x3000)=nil, 0x3000, 0x6, 0x8012, r0, 0x0) (async) r1 = socket$inet6(0xa, 0x80002, 0x0) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f0000000000)=0x6d93, 0x4) (async) sendmsg$sock(r1, &(0x7f0000000540)={&(0x7f0000000580)=@in6={0xa, 0x4e1e, 0x83, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x30}}, 0x3}, 0x80, 0x0, 0x0, &(0x7f0000000700)=[@mark={{0x14, 0x1, 0x51, 0xfffffff9}}], 0x18}, 0x40000) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0x13, &(0x7f0000000080)=ANY=[@ANYBLOB="18080000000010c300000000033e0000851000000600000018000000", @ANYRES32, @ANYBLOB="00000000000000116608000000000000180000000000000000000000000010009500000000000000360a020000000001180100002020782500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b50afdff0000000085000000060000009500000000000000"], &(0x7f0000000000)='GPL\x00', 0xa, 0xff5c, &(0x7f0000000340)=""/222, 0x0, 0x8}, 0x78) 3.582258969s ago: executing program 3 (id=3161): syz_init_net_socket$x25(0x9, 0x5, 0x0) socket$kcm(0x10, 0x2, 0x0) bpf$ITER_CREATE(0x21, 0x0, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r1, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000003c0)=@newtaction={0xe68, 0x30, 0x871a15abc695fa3d, 0x70bd2d, 0x1, {}, [{0xe54, 0x1, [@m_pedit={0xe50, 0x1, 0x0, 0x0, {{0xa}, {0xe24, 0x2, 0x0, 0x1, [@TCA_PEDIT_PARMS={0xe20, 0x2, {{{0x0, 0x300}, 0x93}, [{0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x3}, {0x0, 0x0, 0x0, 0x0, 0x3000000, 0x40000000}, {0x1, 0x0, 0x0, 0x4000000, 0x7, 0x80000}, {0x8000, 0x5, 0x0, 0xfffffffc, 0x5, 0x1}, {0x0, 0x8000000}, {0x0, 0x0, 0x800000, 0x0, 0x6, 0x80000001}, {0xffff4c74, 0xc3}, {0x0, 0x5, 0x0, 0x9}, {0x5}, {}, {0x0, 0x10, 0x0, 0xfffffffd}, {0x0, 0x470a, 0x0, 0x8000000}, {}, {0x2, 0x0, 0x0, 0x0, 0x6, 0x6}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, {0x0, 0x0, 0x0, 0x1, 0x0, 0xfff}, {0x0, 0x0, 0x0, 0x8000000}, {}, {0x0, 0x0, 0x0, 0x0, 0xd9f7}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000}, {0x0, 0x0, 0x0, 0xfffffffc}, {0x20000, 0x0, 0x8001, 0x0, 0xfffffffe}, {}, {0x0, 0x7, 0x0, 0x0, 0xffffffff}, {0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x3}, {0x0, 0x0, 0x0, 0x0, 0x5, 0xfffffffc}, {0xffffffff, 0x0, 0x0, 0x0, 0xfffffffd, 0x60569add}, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, {0xffffffff, 0x5, 0x0, 0x0, 0x4}, {0xffffffff, 0x0, 0x0, 0x0, 0xfffff800}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x400000}, {}, {0xffffffff, 0x0, 0x0, 0x0, 0x0, 0xfffffffc}, {0xfffffffd}, {0x0, 0x5}, {0x0, 0x9, 0x0, 0xffffffff, 0x0, 0x2}, {}, {0x80}, {0x80}, {0x0, 0x0, 0x0, 0x5, 0x5}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x2a}, {0x0, 0x0, 0x8}, {0x0, 0x2, 0x0, 0x0, 0x9}, {0x0, 0x0, 0x8, 0x0, 0x3}, {0x0, 0x9}, {0x0, 0xffffffff, 0x0, 0x0, 0x2}, {0x0, 0x0, 0x0, 0x8510}, {0xffff}, {0x2}, {}, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff}, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc}, {0x0, 0xfffefffd, 0x0, 0x0, 0x0, 0x2}, {0x0, 0x0, 0x0, 0x1}, {}, {0x5}, {0x0, 0x0, 0x2000, 0x0, 0x0, 0x8000000}, {0x0, 0x7}, {}, {0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x9}, {0x0, 0xfffffffc, 0x200}, {0x0, 0xe3b6, 0x0, 0x200}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x40000}, {0x4, 0x0, 0xfa48}, {0x0, 0x0, 0x0, 0x0, 0xfffffffb}, {0x0, 0x0, 0x800}, {0xdb3, 0x0, 0x0, 0x0, 0x0, 0x1}, {0x0, 0x101, 0x0, 0x0, 0x0, 0xffffffff}, {}, {0x3, 0xfffffffe}, {0x0, 0x0, 0x0, 0x4, 0x9}, {0x4}, {0x0, 0x0, 0x0, 0x0, 0x1, 0x7}, {0x0, 0xb}, {}, {}, {0x0, 0x5, 0xe}, {0x2000, 0x0, 0x0, 0x0, 0x0, 0x56}, {0x0, 0x9797, 0x0, 0xec33, 0x0, 0x4}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x20000}, {0xb, 0x0, 0x0, 0x0, 0x0, 0xfe1}, {0x0, 0x0, 0x9, 0x0, 0x4}, {0x0, 0x2, 0xfffffffc}, {}, {0x0, 0xfffffffd, 0x0, 0x0, 0x8000}, {0x6, 0x0, 0x0, 0x0, 0x0, 0x1}, {0x7f}, {0x0, 0x0, 0x0, 0x8}, {0x0, 0x8, 0x0, 0x0, 0xfffffffe}, {0x4, 0x2, 0x2000000, 0x2, 0x0, 0xfffffffe}, {0x0, 0xfffffffd, 0x0, 0x0, 0xe9d, 0x58a}, {0x2}, {0x2, 0x9, 0x20000000}, {0xfffffffc}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x292}, {0x0, 0x0, 0x0, 0x0, 0x0, 0xa}, {0x0, 0x0, 0x81, 0x0, 0x0, 0x2}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x101}, {0x0, 0x5, 0x0, 0x7, 0x1}, {0x0, 0x5}, {0x0, 0x0, 0x0, 0x0, 0x80, 0x2}, {0x10000008, 0x0, 0x0, 0x0, 0x4}, {0x0, 0x200000}, {0x0, 0x10000, 0xffffffff, 0x0, 0xfffffffd}, {0x3, 0x0, 0x0, 0x9}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x7fffffff}, {}, {0x0, 0x0, 0x0, 0x8, 0x0, 0xfffffffd}, {}, {}, {}, {0xfffffffb, 0x0, 0x0, 0x0, 0x8000}, {0x6, 0x0, 0x0, 0x0, 0x0, 0x2}, {0x2d, 0x0, 0x10000}, {0x0, 0x3, 0x8000}, {0x0, 0x8000}, {0x0, 0x0, 0x1010000}, {0x0, 0x80000000, 0x0, 0x7fff800, 0x87}, {0x0, 0x3}, {0xffffffff, 0x0, 0x0, 0x0, 0xd}], [{}, {}, {0x0, 0x1}, {0x1, 0x1}, {}, {0x3}, {}, {0x0, 0x1}, {}, {}, {}, {}, {}, {}, {0x0, 0x1}, {}, {0x3, 0x1}, {0x0, 0x1}, {}, {0x5, 0x1}, {}, {0x4}, {0x3}, {}, {}, {}, {}, {}, {}, {}, {0x5}, {}, {0x4}, {}, {}, {0x1}, {}, {0x0, 0x1}, {0x0, 0x1}, {}, {}, {0x4}, {}, {}, {}, {}, {}, {0x4}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x1}, {}, {0x1}, {}, {}, {}, {}, {0x5}, {}, {0x0, 0x1}, {}, {}, {}, {0x0, 0x1}, {}, {0x5}, {0x3}, {0x4}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x5}, {}, {0x0, 0x1}, {}, {0x0, 0x1}, {}, {}, {0x1}, {}, {0x1}, {0x1}, {}, {0x5}, {}, {}, {}, {}, {}, {0x0, 0x1}, {}, {0x2, 0x1}, {}, {}, {}, {}, {0x5, 0x1}, {}, {0x3}, {}, {0x2}, {}, {}, {0x4}, {0x3}, {}, {}, {}, {}, {0x0, 0x1}]}}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0xe68}}, 0x200c0) setsockopt$ARPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x60, &(0x7f0000000b40)={'filter\x00', 0x7, 0x4, 0x3c8, 0xe8, 0xe8, 0x1d0, 0x2e0, 0x2e0, 0x2e0, 0x4, &(0x7f0000000140), {[{{@uncond, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffb}}, {{@uncond, 0xc0, 0xe8}, @unspec=@AUDIT={0x28}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@remote, @mac=@local, @remote, @empty, 0x8}}}], {{'\x00', 0xc0, 0xe8}, {0x28}}}}, 0x418) getsockname$packet(r1, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r3, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c0002000800010006"], 0x3c}}, 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000540)=ANY=[@ANYBLOB="3c00000010001fff000000000100000000000000", @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800900010076657468000000000400028008000a00", @ANYRES32=r3], 0x3c}, 0x1, 0x0, 0x0, 0x40000}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c0000001000030400"/20, @ANYRES32=0x0, @ANYBLOB="a4280400000000001400350064756d6d79300000000000000000000008000a00", @ANYRES32=r3, @ANYBLOB="b759cdc0af94680674f451c513371f4927b49175dc9ee9db8eb8eb5fcaca9296def45a15b56382a7441ce4e79983c157442c23fe123fd4468ca55c510635f9c28dc8b0648bf29681f9ab1313f4ccad8e0ded61a6f250426f9eac"], 0x3c}}, 0x8000) socket$nl_generic(0x10, 0x3, 0x10) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000040)='ns/cgroup\x00') mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeef, 0x8031, 0xffffffffffffffff, 0x215eb000) r5 = bpf$PROG_LOAD(0x5, &(0x7f00002a0fb8)={0x16, 0x4, &(0x7f0000000400)=ANY=[@ANYBLOB="85000000070000006a0a00ff000000000c00000000000000950000000000000018100000", @ANYRES32, @ANYBLOB="000000000000000005000000000000009500000000000000b1f8306e05d1e4aab009c16b5c05077115d0749619ca39f89974785ae0619b77c6585f678ac92a3b6b4148f56b43c3dd75d75f97c8f92f60a2def458df05e2fbfb3e849b2b3cffd4f29446ae60dd76654b2639b2bc14350706214a6ab7a712d4317fbc3ca01d0d3ed6110b3775903141a5091a4d3db8eb335414fbdb288aba73aaf6d18000a3a2a069cf7f9402e1425bb6bc370576aa1faea0fe222671ecf99038fce8dba53dcb11f87cca"], &(0x7f0000000140)='GPL\x00', 0x2, 0xffa0, &(0x7f0000000180)=""/149, 0x0, 0x0, '\x00', 0x0, @flow_dissector, 0xffffffffffffffff, 0x8, 0x0, 0x1e, 0x10, 0x0, 0x1e}, 0x2d) bpf$BPF_PROG_DETACH(0x8, &(0x7f00000002c0)=ANY=[@ANYRES32=0x0, @ANYRES32=r5, @ANYBLOB="1100000000001d0000000000", @ANYRES32, @ANYBLOB, @ANYRES64=0x0], 0xa) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x13, 0x13, 0x0, 0x0, 0x2, 0x0, 0x0, 0x41100, 0x8}, 0x94) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r6, 0x0, r7, 0x0, 0x6, 0x0) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r8, &(0x7f0000000280)=ANY=[], 0x10448) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r8, 0x0) 2.982217948s ago: executing program 2 (id=3167): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001680)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000"], 0x7c}, 0x1, 0x0, 0x0, 0x40001}, 0x4040850) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a64000000030a0fdb00000000000000000a0000050900030073797a30000000000900010073797a31000000001400048008000240a04b3d02080001400000000308000540000000001c0008800c00014000000000000000090c000240000000000018ab6e14000000110001"], 0x8c}, 0x1, 0x0, 0x0, 0x4000850}, 0x24000840) r1 = socket(0xa, 0x3, 0xff) sendmsg$inet6(r1, &(0x7f0000001c00)={&(0x7f0000000000)={0xa, 0xa, 0x2, @dev={0xfe, 0x80, '\x00', 0x18}}, 0x1c, &(0x7f0000000240)=[{&(0x7f0000000040)="671723d7c6012c", 0x7}, {&(0x7f0000000100)="9e91d93a92dc7c8fff658bb539e2a1485d4c9223a7dfe538a2e2fea2", 0x1c}, {&(0x7f00000004c0)="e32e40d0f3099fa777eb9b4cb4b88baba6141ba3541afb54cae68986e70c2cd663106876e33e733b8e57ff059412aaee", 0x30}, {&(0x7f0000000140)="2bc4", 0x2}], 0x4}, 0x20008b88) 2.867095704s ago: executing program 2 (id=3171): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000001000010000000000000000000700000a20000000000a05000000000000000000050000000900010073797a30000000002c000000030a01010000000000000000050000000900010073797a30000000000900030073797a32000000004c000000060a010400000000000000000500000008000b400000000024048020000180070001006374000014000280080001400000001508000240000000070900010073797a3000000000140000001100010000000000000000000300000a"], 0xc0}}, 0x0) 2.717132048s ago: executing program 2 (id=3174): socket(0x10, 0x3, 0x800000) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r1) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000380)=@newlink={0x64, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x30, 0x12, 0x0, 0x1, @geneve={{0xb}, {0x20, 0x2, 0x0, 0x1, [@IFLA_GENEVE_REMOTE6={0x14, 0x7, @dev={0xfe, 0x80, '\x00', 0xa}}, @IFLA_GENEVE_REMOTE={0x8, 0x2, @loopback}]}}}, @IFLA_IFNAME={0x14, 0x3, 'geneve1\x00'}]}, 0x64}}, 0x2000000) sendmsg$IEEE802154_LLSEC_ADD_DEVKEY(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000001200)={&(0x7f0000000380)={0x38, r2, 0x607, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x1}, @IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0x1}, @IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8, 0x2f, 0x5}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}]}, 0x38}}, 0x20048840) setsockopt$sock_attach_bpf(r0, 0x1, 0xa, &(0x7f0000000480), 0x4) socket$inet6_sctp(0xa, 0x1, 0x84) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) r4 = socket$alg(0x26, 0x5, 0x0) bind$alg(r4, &(0x7f0000000100)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128-generic\x00'}, 0x58) r5 = accept4(r4, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f05ebbee1, 0x8031, 0xffffffffffffffff, 0x0) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r5, 0x89f8, &(0x7f0000000a00)={'syztnl2\x00', &(0x7f0000000300)={'gretap0\x00', 0x0, 0x7800, 0x8, 0x9, 0xaf03, {{0x11, 0x4, 0x0, 0x3f, 0x44, 0x67, 0x0, 0x0, 0x29, 0x0, @broadcast, @loopback, {[@timestamp_prespec={0x44, 0xc, 0x78, 0x3, 0x6, [{@remote}]}, @generic={0x94, 0x12, "06926625dd145decb8fac1ad3aaaeb8c"}, @ra={0x94, 0x4, 0x1}, @timestamp_addr={0x44, 0xc, 0x38, 0x1, 0x5, [{@rand_addr=0x64010102, 0xa}]}, @end]}}}}}) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r4, 0x89f1, &(0x7f0000000ac0)={'ip6gre0\x00', &(0x7f0000000a40)={'ip6tnl0\x00', r6, 0x29, 0x0, 0x3, 0x800000, 0x48, @private2={0xfc, 0x2, '\x00', 0x1}, @dev={0xfe, 0x80, '\x00', 0x2c}, 0x0, 0x8, 0x4, 0x4}}) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x1032, 0xffffffffffffffff, 0x21d67000) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={0x0, 0x0}, 0x28) socket$netlink(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=@newlink={0x38, 0x10, 0x801, 0xfffffffd, 0x8000000, {0x0, 0x0, 0x0, 0x0, 0x0, 0x20421}, [@IFLA_GROUP={0x8}, @IFLA_AF_SPEC={0x10, 0x1a, 0x0, 0x1, [@AF_INET={0x8, 0x2, 0x0, 0x1, {0x4}}, @AF_INET6={0x4, 0x2d}]}]}, 0x38}, 0x1, 0x0, 0x0, 0x4040000}, 0x0) syz_open_procfs$namespace(0x0, &(0x7f0000000040)='ns/cgroup\x00') setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000000400)=@nat={'nat\x00', 0x1b, 0x5, 0x490, 0x0, 0x0, 0xffffffff, 0x0, 0x210, 0x570, 0x570, 0xffffffff, 0x570, 0x570, 0x5, 0x0, {[{{@uncond, 0x0, 0xa8, 0xf0}, @REDIRECT={0x48, 'REDIRECT\x00', 0x0, {0x5, @ipv4=@multicast1, @ipv6=@ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x1, 0x0}}, @icmp_id=0x64, @port=0x4e22}}}, {{@ipv6={@dev={0xfe, 0x80, '\x00', 0x34}, @dev={0xfe, 0x80, '\x00', 0x39}, [0xff000000, 0x0, 0x0, 0xff000000], [0x0, 0x0, 0xffffff00], 'bond_slave_0\x00', 'veth0_to_bond\x00', {0xff}, {}, 0xc65ec123d57cf83, 0x7, 0x8, 0x12}, 0x0, 0xa8, 0xf0}, @NETMAP={0x48, 'NETMAP\x00', 0x0, {0x11, @ipv4=@multicast1, @ipv4=@private=0xa010101, @port=0x4e20, @gre_key=0xabfc}}}, {{@ipv6={@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @mcast1, [0xff000000, 0xffff00, 0xffffffff, 0xffffff00], [0xffffff00, 0xffffff00, 0xff000000, 0xffffffff], 'nicvf0\x00', 'veth1_to_hsr\x00', {0xff}, {}, 0x3c, 0x6, 0x1, 0x4}, 0x0, 0xa8, 0xf0}, @MASQUERADE={0x48, 'MASQUERADE\x00', 0x0, {0x0, @ipv4=@broadcast, @ipv6=@private2={0xfc, 0x2, '\x00', 0x1}, @icmp_id=0x64, @port=0x4e20}}}, {{@uncond, 0x0, 0xa8, 0xf0}, @MASQUERADE={0x48, 'MASQUERADE\x00', 0x0, {0x8, @ipv4=@rand_addr=0x64010101, @ipv6=@mcast1, @port=0x4e21, @port=0x4e21}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x4f0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeef, 0x8031, 0xffffffffffffffff, 0x215eb000) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x3, 0x5, &(0x7f00000000c0)=@framed={{0x18, 0x2, 0x0, 0x0, 0x75, 0x0, 0x0, 0x0, 0x40002}, [@btf_id={0x18, 0x4, 0x3, 0x0, 0x3}]}, 0x0, 0x0, 0x0, 0x0, 0x1e00, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x100000}, 0x94) r8 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000840)={&(0x7f00000009c0)=ANY=[@ANYBLOB="280000001200010100000000e0ffffff07000000", @ANYRES32=0x0, @ANYBLOB="000000000040ead008001d00c3"], 0x28}}, 0x0) sendmmsg(r8, &(0x7f0000000000), 0x4000000000001f2, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000b00)={0x6, 0x4, &(0x7f0000000180)=ANY=[@ANYRES32=r3], &(0x7f0000000240)='GPL\x00', 0x2, 0x0, 0x0, 0x40f00, 0x1, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x18000}, 0xfffffffffffffd77) 1.830199912s ago: executing program 0 (id=3182): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = socket$inet(0x2, 0x2, 0x1) bind$inet(r1, 0x0, 0x0) (async, rerun: 64) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000007c0)={0x6, 0xc, &(0x7f00000002c0)=ANY=[@ANYBLOB="180200000400000000000000000000008500000041000000180100002020732500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007200000095"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (rerun: 64) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r2, 0x0, 0x2100, 0x0, &(0x7f0000000100), 0x0, 0x700, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x50) (async) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000040)={'wpan3\x00', 0x0}) (async, rerun: 32) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000080)={'wpan3\x00', 0x0}) (rerun: 32) sendmsg$IEEE802154_LLSEC_DEL_KEY(r0, &(0x7f0000000240)={&(0x7f0000000000), 0xc, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[@ANYBLOB='H\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="022c27bd70000000050088c30700000008000200000000000000", @ANYRES32=r4, @ANYBLOB="08000200", @ANYRES32=r5, @ANYBLOB="06000400feff000006000400feff00000a0001007770616e31000000"], 0x48}, 0x1, 0x0, 0x0, 0x20000004}, 0x20000000) (async) r6 = syz_genetlink_get_family_id$net_dm(&(0x7f0000000280), r3) r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f00000002c0), r7) sendmsg$NLBL_MGMT_C_ADDDEF(r7, &(0x7f0000002380)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)={0x24, r8, 0x1, 0x70bd26, 0x25dfdbfe, {}, [@NLBL_MGMT_A_CLPDOI={0x8, 0xc, 0x1}, @NLBL_MGMT_A_PROTOCOL={0x8, 0x2, 0x7}]}, 0x24}, 0x1, 0x0, 0x0, 0x40000}, 0x4080) (async) syz_genetlink_get_family_id$net_dm(&(0x7f00000000c0), r7) (async) sendmsg$NET_DM_CMD_STOP(r0, &(0x7f0000000f00)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)={0x14, r6, 0x1, 0x0, 0x0, {0x6}}, 0x14}}, 0x0) 1.71295468s ago: executing program 0 (id=3183): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000680)=@newtaction={0x914, 0x30, 0x8101, 0xe501, 0x1000, {}, [{0x900, 0x1, [@m_police={0x6c, 0x1, 0x0, 0x0, {{0xb}, {0x40, 0x2, 0x0, 0x1, [[@TCA_POLICE_TBF={0x3c, 0x1, {0x0, 0x81000000, 0x800, 0x0, 0x0, {0x0, 0x1}, {0x0, 0x2}, 0x8001, 0x0, 0x5}}]]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc}}}, @m_police={0x890, 0x2, 0x0, 0x0, {{0xb}, {0x864, 0x2, 0x0, 0x1, [[@TCA_POLICE_TBF={0x3c, 0x1, {0x1, 0x0, 0x0, 0x0, 0x400000, {0x0, 0x0, 0x0, 0x0, 0xffff}}}], [@TCA_POLICE_RESULT={0x8, 0x5, 0x9}, @TCA_POLICE_RATE64={0xc, 0x8, 0x253}, @TCA_POLICE_RATE={0x404, 0x2, [0x0, 0xf1d, 0x1, 0x6, 0x6, 0x81, 0xc, 0x3, 0xab99, 0xe, 0xffff, 0x2, 0x80000000, 0x9, 0x4, 0xfff, 0x1ff, 0xfffffff9, 0x4, 0x1, 0xa7e, 0x5f8b, 0x2, 0x7, 0x8001, 0x6, 0x1, 0x6f, 0x5098, 0x3a, 0x3, 0xff, 0x7, 0x1ff, 0x7fffffff, 0x4, 0x2, 0x2, 0x8, 0x10, 0x70bb, 0xb, 0x8, 0x9, 0x7f, 0x2, 0x8, 0x4, 0x0, 0x80000001, 0x1, 0x9, 0x65a, 0x0, 0x5, 0xe1, 0x3, 0x1, 0xf61, 0x3, 0x4, 0x4, 0x5, 0x2, 0x1, 0x9, 0x6, 0xc5bb, 0x3, 0x8, 0x8, 0x2, 0x7, 0x3, 0x8, 0x9, 0xb6b7, 0x3, 0x0, 0xfffffff8, 0x3, 0x6, 0x200, 0x0, 0x7, 0xd497, 0x6, 0x1, 0x8, 0x0, 0x2, 0x7, 0x4, 0x3, 0xdc, 0xc2b0, 0x9, 0x2, 0x10000, 0x6, 0xff, 0x5, 0x3, 0x2, 0x6, 0x8001, 0x8001, 0x200, 0x4, 0x1, 0x7, 0x4, 0x9, 0xffffff5f, 0x2, 0x3, 0xc8, 0x1, 0x1, 0x8, 0x5, 0x7fffffff, 0x2445, 0x1, 0x53c9, 0x2, 0x4f0, 0x7fffffff, 0x2, 0x0, 0xcd6, 0x9, 0x3, 0x9489, 0xc, 0xf3, 0x1, 0x67f4, 0x101, 0x9, 0x9, 0x4, 0x3, 0x8001, 0xb, 0x7ff, 0xb91, 0xd, 0x930, 0x3, 0x7, 0x2, 0x6, 0x4758, 0x9, 0xd, 0x5, 0x4, 0x5, 0x2, 0x9, 0xd84, 0x5, 0x8, 0x400, 0x7c, 0x6, 0x5477, 0x1, 0x100, 0xa5, 0x3b3, 0xb04, 0x9, 0x6, 0xfffffffb, 0x9, 0x7, 0x2, 0xf02, 0x9, 0x1, 0x4, 0x9, 0x7, 0x6e5, 0x7, 0x2, 0x7fffffff, 0x7, 0xffff, 0x10001, 0x2, 0x400, 0x6, 0xa7, 0x7444, 0x0, 0x0, 0x4, 0x80000001, 0x40ac, 0xfffffff7, 0x1, 0x5, 0x9a83, 0x10001, 0x100, 0xc6cf, 0xb5fd, 0x2, 0x0, 0x7, 0x80000001, 0x7, 0x8, 0x9, 0xff, 0xffff8001, 0x80000000, 0x7, 0x5, 0xe, 0xe, 0x10, 0x2, 0x4, 0x3, 0x400, 0x5, 0x1000, 0x1, 0xa1, 0xfffffffe, 0xd5c, 0x1ff, 0x6, 0x0, 0xc6, 0x1, 0x8, 0xe078, 0x8, 0x3, 0xf, 0x9, 0x7, 0x6a59, 0x7, 0x2, 0xbe9, 0x40, 0x7fffffff, 0x3, 0x0, 0x5]}, @TCA_POLICE_AVRATE={0x8}, @TCA_POLICE_RATE={0x404, 0x2, [0x4, 0x3, 0x6, 0x7, 0xdae, 0x5, 0x5, 0xbe0, 0xc119, 0x3, 0x5, 0x7, 0x27, 0x135f43c3, 0x200, 0x9, 0xf8, 0x10, 0xff, 0x40, 0x7b, 0xb31abe6, 0x400, 0x90000000, 0x2, 0x7, 0x7, 0x7a40, 0x9, 0xa4fb, 0x7, 0x400, 0x101, 0x2, 0x8001, 0x6, 0x400, 0x4, 0xd, 0xb59, 0x800, 0x9288, 0x5, 0x89, 0x7fffffff, 0xa, 0x80000000, 0xffff, 0x9, 0x8, 0x5, 0x40, 0x414d, 0x7822, 0xfe73, 0x800, 0x6, 0x10000, 0x3, 0x6, 0xa, 0x7, 0x3, 0x800, 0x3, 0x81, 0x80, 0x10000, 0x4, 0xfffff61b, 0x6, 0x5e00, 0x4, 0x7, 0xffffffff, 0x1, 0x5, 0xfffffd61, 0x8, 0x7fffffff, 0x5, 0xe, 0xd0, 0xe58dfa9, 0xffffffff, 0x802000, 0x6, 0x8, 0x0, 0x6, 0x984, 0x9, 0x10001, 0x6, 0xbb4, 0xc, 0x4, 0x63, 0x3, 0x8, 0x100, 0x6221, 0x3, 0x6, 0x0, 0x6, 0x9, 0x2, 0x4, 0x44a, 0x3, 0x400, 0xffff, 0x5, 0xfff, 0x2, 0x6, 0x9, 0x5, 0x4, 0x4, 0x4, 0x2, 0x10001, 0x1, 0x1ff, 0x6, 0x8, 0x8, 0x4, 0x8, 0x9, 0x1, 0x4, 0x81, 0x6, 0x7ff, 0x9, 0xffffffff, 0x2, 0xd0, 0x3, 0x20, 0x7659, 0xdf, 0x9, 0x0, 0x0, 0x1, 0x7, 0x7, 0x0, 0x6, 0x1, 0x270, 0xa, 0x0, 0x0, 0x9, 0x80000000, 0x100, 0x4, 0x81, 0x401, 0x8, 0x7fffffff, 0x8, 0xffff, 0x5, 0x80000000, 0xc40, 0x1000, 0x6, 0x7, 0x1c00, 0x81, 0xcf5, 0x4b, 0x0, 0xb69, 0x1, 0x7fffffff, 0x6, 0xdbce, 0x6, 0xffffffff, 0x0, 0xf, 0x4, 0x3, 0x3, 0xfffff800, 0x3, 0x7fff, 0x2, 0x0, 0x0, 0x0, 0x10001, 0x8, 0x0, 0x345, 0x0, 0x81, 0x8, 0x3, 0x7f, 0x9, 0x6, 0x9e0, 0x1, 0x3, 0x8, 0x0, 0x4, 0xffffffff, 0x1, 0x11fb3e66, 0x9, 0x3, 0x1, 0x1, 0x6, 0x3, 0x7, 0xfffffff5, 0x79ea, 0x2, 0x101, 0x0, 0x0, 0x2, 0xfff, 0x2, 0xfffff801, 0x2, 0x5, 0x401, 0x7fffffff, 0x2, 0x714, 0x600, 0x3, 0xb33, 0xffffffff, 0x100, 0x0, 0x7, 0x4, 0x9, 0x3, 0xd, 0xeb, 0x5, 0x1e]}]]}, {0x4}, {0xc}, {0xc, 0x8, {0xffffffff, 0x1}}}}]}]}, 0x914}}, 0x0) 1.620034763s ago: executing program 0 (id=3184): mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x8, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_buf(r0, 0x6, 0x1f, &(0x7f0000000280)='\x00', 0x1) setsockopt$inet6_IPV6_ADDRFORM(r0, 0x29, 0x1, &(0x7f0000000000), 0x4) ppoll(&(0x7f00000000c0)=[{r0}], 0x1, &(0x7f0000000040)={0x0, 0x989680}, &(0x7f0000000100), 0x8) close(r0) r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000001c0)={0x18, 0x17, &(0x7f0000000580)=ANY=[@ANYBLOB="1800000006000000000000000900000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b702000014000000b7030000fffe00008500000086000000bf09000000000000550901000000008095000000000000001801000020696c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000020000008500000006000000bf91000000000000b7020000030000008500000085000000b700000000050000950000000000000058056bba250f7f3b88374254ced17f4e2f0f60109d32c759460e844193e2bc5ead4535acd9795e7936b050d13955609a32da8f1b092d9d5b9e3bb91b977309da969915064759318374eeb4948f801f3893a6db534a9f74aabf5893b7777258bcedcb6da61e5bf433ae0f51da9631ce8ff5a8dcf69b325c313df69fe78041ca8c98704d11859bf059f6196c5cf6ea7d35ad87"], &(0x7f0000000080)='GPL\x00', 0xa, 0xff8, &(0x7f0000000780)=""/4088, 0x41000, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3}, 0x94) 1.413972811s ago: executing program 0 (id=3186): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x11, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x0, 0x1010, r0, 0x4b581000) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x12, r1, 0x0) r2 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0xe, 0x3, &(0x7f0000000040)=@framed={{0x15, 0xa, 0x0, 0x0, 0x0, 0x61, 0x10, 0x64}}, &(0x7f0000000000)='GPL\x00'}, 0x90) socket$inet6(0xa, 0x2, 0x10000) r3 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r3, 0x10e, 0xc, &(0x7f0000000000)={0xd, 0x1fffd, 0x0, 0x3}, 0x10) r4 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) ioctl$sock_bt_hidp_HIDPCONNADD(r4, 0x400448c8, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000480)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a30000000003652e5cbe1e5037d1821e98e2a69692808000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x4000) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_TIMEOUT_NEW(r6, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000880008010100cd76000000000002000005"], 0x14}, 0x1, 0x0, 0x0, 0x4000800}, 0x0) r7 = socket(0x11, 0x800, 0x10001) r8 = syz_genetlink_get_family_id$ethtool(&(0x7f00000000c0), r7) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r2, 0x89f2, &(0x7f0000000580)={'syztnl2\x00', &(0x7f0000000500)={'syztnl0\x00', 0x0, 0x4, 0x0, 0x0, 0x4, 0x2c, @ipv4={'\x00', '\xff\xff', @empty}, @private0, 0x7850, 0x40, 0x1, 0x8}}) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r6, 0x8933, &(0x7f00000005c0)={'batadv0\x00', 0x0}) getsockopt$PNPIPE_IFINDEX(r1, 0x113, 0x2, &(0x7f0000000600)=0x0, &(0x7f0000000640)=0x4) r12 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r12, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="700000000001010400000000141a000002000010240001801400018008000100e000000108000200e00000010c000280f2ff0000ac1414aa08000200ac1e00010c00028005ffff000000000008000740000000010c001640000000020000000300"/112], 0x70}}, 0x0) r13 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r13, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000280)=ANY=[@ANYBLOB="40000000000101010000000000000000020000020800164000000005240001801400018008000102800500010000000000"], 0x40}, 0x1, 0x0, 0x0, 0x4004881}, 0x20008820) sendmsg$ETHTOOL_MSG_RINGS_GET(r7, &(0x7f0000000780)={&(0x7f0000000080), 0xc, &(0x7f0000000740)={&(0x7f0000000680)={0xb4, r8, 0x300, 0x70bd2a, 0x25dfdbfe, {}, [@HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r9}]}, @HEADER={0x3c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'erspan0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'syzkaller0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}]}, @HEADER={0x4c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1_macvtap\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1_to_hsr\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r10}]}, @HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r11}]}]}, 0xb4}, 0x1, 0x0, 0x0, 0x10}, 0x20000000) getsockopt$inet_sctp_SCTP_CONTEXT(r3, 0x84, 0x11, &(0x7f0000000100)={0x0, 0x2}, &(0x7f0000000140)=0x8) getsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r1, 0x84, 0x76, &(0x7f0000000180)={r14, 0xb004}, &(0x7f0000000240)=0x8) bpf$MAP_CREATE_RINGBUF(0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x1, 0xf, &(0x7f0000000d80)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket$nl_netfilter(0x10, 0x3, 0xc) 1.396474009s ago: executing program 2 (id=3187): r0 = socket$kcm(0x29, 0x2, 0x0) unshare(0x2a020400) r1 = bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB="9feb010018000000000000000c0000000c000000020000000000000000000004"], 0x0, 0x26, 0x0, 0x2}, 0x28) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000005c0)=ANY=[@ANYBLOB="fc00000019000100000400000000000000000000000000000000000000000000ff02000000000000000000000000000100000008000000000a00000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000000000000a900000000000000000000000000000001000000000000000000000000000000ffffffffffffffff000000000000000000000000000000000000000000000000000a000000000000000000000080400002000000000000080000000000000010000100000000000044000500fc000000000000000000000000000001000000003c000000000000007f0000000000000000000700000000000200000004"], 0xfc}}, 0x0) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000080)=ANY=[@ANYBLOB="bc000000210001000400000000000000fc020000000000000000000000000001ff02000000000000000000000000000100000000000000020a0000a02e000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000000000000050001100fc0000000000000000000000000000017f000001000000000000000000000000fc020000000000000000000000000001e00000010000000000000000000000003c04"], 0xbc}, 0x1, 0x0, 0x0, 0x40000}, 0x0) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xd, 0x3, &(0x7f0000000800)=ANY=[@ANYBLOB="18000000000000000000000000000000950000000000000009000000dfa2bff372df8cdbeb318ab2bec8fc36903c0ec359caa1af3c914019395cc154010c693709800000000000000016a85adef34bf78c76e6222337923e1bea6ef682cc4375f594425d408ccc58187feb0e3d43347f989007a7c63f6dae2acb4af936461f34a8a32a50bbbb69ec85168947b86df9f2609bf93f7a1be259621818c3c75da31290bce645451b851111dd98ac4d8da9317c2c082020e0b2d634086785f3fe41a3053645cc413790faf7e229c782845b5bb774f7f154263178151ea93ff2cac4b181332c9c9a1c7d85616c8100000000000000d8300d19d585000000fc005774b56a7142047326f940e95b8489e1c5650f5c61299a295f39c88456391cffdef93e29f10f4a11f0cfbfc0ff976b20fef6033495b9b94777db9bb9b678ffc1130000009faa798226a080c01e47151268a02dc1a557cfdcf76305fbf6643df66b1b4d2d5e7bf698fc5a18d984ecb91e6683a5f522d536e2f3c43b89823659d1945258fc668950e5aacfffffffffffffff7f7a266c90e64efc8d8f730867202a9ee94e6a00"], &(0x7f0000000080)='GPL\x00', 0x5, 0x1f6, &(0x7f00000002c0)=""/168, 0x0, 0x0, '\x00', 0x0, @sock_ops, r1, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000200), 0x1, 0x0, 0xffffffffffffffff, 0xf5010000}, 0x6d) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r5, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000009c0)=ANY=[@ANYBLOB="38010000100001000000000800000000ac1e00010000000000000000000000000000000000000000000000000000000000000000000000000000200000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="ac1e01010000000000000000000000000000000033000000ac1414aa0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffffffffffff0000008056000000000000000000000000000000000000000000000000000000100000000900000002000000000000000000000002000300000000000000000048000100736861323536000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000801f00000000000000000000004bceda3aaf87126e75860300000000000000f702e1029cb7b9791caad96abcdf4f8e9c38f1e7ac01c1b719879bd07daa03dd9299f43970dada0c3204f53eb4b5f4e002f614d064c8c266c844"], 0x138}}, 0x0) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000007c0)={r4, 0xe0, &(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, &(0x7f0000001a00), 0x0, 0xfeffffff, 0x10, 0x8, 0x0, 0x0}}, 0x10) close(r0) r6 = socket$kcm(0x2b, 0x1, 0x0) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000000)={0x3, 0x1000}, 0x4) close(r6) socket(0x2, 0x2, 0x1) setsockopt$sock_attach_bpf(r0, 0x1, 0xd, &(0x7f00000000c0), 0xfe11) r7 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r7, 0x8933, &(0x7f0000000340)={'batadv_slave_1\x00', 0x0}) r9 = socket$nl_generic(0x10, 0x3, 0x10) r10 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000680), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_PAUSE_GET(r9, &(0x7f0000001ac0)={0x0, 0x0, &(0x7f0000001a80)={&(0x7f0000001940)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r10, @ANYBLOB="03000000000000000000210000000c00018008000100", @ANYRES32=r8], 0x20}}, 0x0) close(r6) socket(0x2, 0x80805, 0x0) close(0x4) r11 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TUNSETIFF(r11, 0x400454ca, &(0x7f0000000080)={'pimreg0\x00', 0x7c2}) ioctl$TUNSETCARRIER(r11, 0x400454e2, &(0x7f00000003c0)=0x1) close(0x4) 1.210069135s ago: executing program 0 (id=3190): socket$nl_generic(0x10, 0x3, 0x10) r0 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000000c0)={'veth0_macvtap\x00', 0x0}) r2 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=@newqdisc={0x88, 0x24, 0xf0b, 0x70bd26, 0x0, {0x0, 0x0, 0x0, r1, {0x0, 0xffff}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_mqprio={{0xb}, {0x58, 0x2, {{0x1, [], 0x0, [0x1, 0x2, 0xfffe, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x5c4, 0x8000, 0x0, 0x0, 0x3dc], [0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000]}}}}]}, 0x88}}, 0x20000000) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x70bd29, 0xfffbffff, {0x0, 0x0, 0x0, r1, {0x0, 0xd}, {0xffff, 0x2}, {0xc, 0xfff3}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x1c, 0x2, [@TCA_TAPRIO_ATTR_SCHED_ENTRY_LIST={0x10, 0x2, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, [@TCA_TAPRIO_SCHED_ENTRY_INTERVAL={0x8, 0x4, 0x8001}]}]}, @TCA_TAPRIO_ATTR_SCHED_CLOCKID={0x8, 0x5, 0x6}]}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40001}, 0x4040010) r3 = socket$kcm(0x21, 0x2, 0x2) sendmsg$kcm(r3, &(0x7f0000000040)={&(0x7f0000000080)=@in={0x2, 0x4e23, @local}, 0x80, 0x0, 0x0, &(0x7f00000001c0)=ANY=[], 0x10b8}, 0x20048000) r4 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r4, 0x29, 0x40, &(0x7f00000005c0)=@raw={'raw\x00', 0x3c1, 0x3, 0x428, 0x290, 0xc8, 0x8, 0x0, 0x5803, 0x358, 0x2e8, 0x2e8, 0x358, 0x2e8, 0x3, 0x0, {[{{@ipv6={@remote, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, [0xff, 0xff], [0xff000000, 0xff000000, 0xff, 0x1fe0000ff], 'bridge0\x00', 'batadv_slave_1\x00', {0xff}, {}, 0x89, 0x3, 0x0, 0x12}, 0x0, 0x228, 0x290, 0x0, {0x0, 0x2000000000000}, [@inet=@rpfilter={{0x28}, {0xc}}, @common=@inet=@hashlimit3={{0x158}, {'veth1_macvtap\x00', {0xeb98, 0x101, 0x7a, 0xfffd, 0x4, 0x9, 0x0, 0x7f, 0x8, 0x78}, {0xaa}}}]}, @unspec=@CT1={0x68, 'CT\x00', 0x1, {0x8, 0x7, 0x2, 0x563, 'netbios-ns\x00', 'syz1\x00', {0x6}}}}, {{@ipv6={@private1={0xfc, 0x1, '\x00', 0xf0}, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x1c}}, [0xffffffff, 0x0, 0xff, 0xffffff00], [0xff000000, 0x0, 0x0, 0xff000000], 'pim6reg\x00', 'veth0_to_bond\x00', {0xff}, {0xff}, 0x11, 0x2, 0x3, 0x40}, 0x0, 0xa8, 0xc8}, @unspec=@NOTRACK={0x20}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x488) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f0000010400)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast6-avx\x00'}, 0x58) r6 = socket(0x2, 0x80805, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x50) ioctl$int_in(0xffffffffffffffff, 0x5452, &(0x7f0000000280)=0xffffffffffffffff) r7 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$mptcp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_GET_ADDR(r7, 0x0, 0xc100) pselect6(0x40, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x800, 0x0, 0x800010100000}, 0x0, &(0x7f00000000c0)={0x1c, 0x40002, 0x0, 0x0, 0x0, 0x200000000, 0x6a9}, 0x0, 0x0) shutdown(0xffffffffffffffff, 0x1) sendmmsg$inet_sctp(r6, &(0x7f00000032c0)=[{&(0x7f0000000440)=@in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, &(0x7f00000004c0)=[{&(0x7f0000000100)="03", 0x1}], 0x1}], 0x1, 0x0) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r8, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000c00)=ANY=[@ANYBLOB="4800000010002104000000000200000000000000b15ee762fe57d57cf7f4d13914f166cc5a15e80bf8295f841dc57a4ba47882c7b3829346e967b65759c6ddeb252140e101d3d648b537c4d208fbeb4ce9", @ANYRES32=0x0, @ANYBLOB="00000000000000001c0012800b00010067726574617000000c00028008000700000000000a000100aaaaaaaaaa000000"], 0x48}}, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, 0x0}, 0x0) sendmmsg$inet_sctp(r6, &(0x7f00000032c0)=[{&(0x7f00000000c0)=@in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, &(0x7f00000004c0)=[{&(0x7f0000000100)='a', 0xdd02}], 0xc, &(0x7f0000000a80)=ANY=[@ANYBLOB="30000000000000008400000001000000000000000c0000000000000000000000000000000000000000000000d602ad13425b2b0fedcd7be5a66678e3b93074c9432c4af8891f48080bb78f5ae527bc9b53d7fae7623688c4b907424e7bcf2729eb71611b9696b99e54ba8fcda5cc3a792b6db4a180fc28991e5418d2b38fa0de75d0e1d952c4048caa1e4b4e5891de002ca8987b9a91332bf6d1e741e3e51e5e4fd125475b0e7c752355066baafe1d26b7cdb136c6524020a97aa816d0d2d62ceba4195e6b6d7dc08645b8f2c081733da3de1a2bee4241055cd1d40e7d140c9456854e881a7d8c6ffa91ed8fb9e688a1989d72a3ca1ffa86303c39e67e46e567774b100e03ea9ef32de923d8cb74e93e54dca529a9e440c913de07c448d80469f1c3402a9a430ed65dc0e0cb7a5b83732e8f070777e2f6a47c656a629c1b3ff92c35688f77", @ANYRES32=0x0], 0x30}], 0x1, 0x0) setsockopt$ALG_SET_KEY(r5, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) accept4(r5, 0x0, 0x0, 0x80800) bpf$PROG_LOAD(0x5, &(0x7f0000000cc0)={0x16, 0x4, &(0x7f0000003300)=ANY=[@ANYRESHEX=r2, @ANYBLOB="508ac86702034c155d944f966489d91d5c496e388198dcba864954cde92bc45ea70aed7007568adfa2ac51d1e58cad97efc7c341e60e851f461a84587f80e645021e5286096e9296eea6a74165b44e8378e1fcb2d9480ad10b08d91730f17b965b030b0ad88186c3fe431e4ee28bd465fde50edd291f4907d644a6c76df56fa7c3c11fc808e0575d6a53e0de924ce3311cd53ef732245844bc5ab4c951f5f558302345053e587fb74ca6e7d0e45756da6114ca99e6ff312c1728bfc70e7076b3bc2f45819ce8442e10c1f5e7804310c5219e58a63301cd7f2f65d8e2372b9ada796291118f2820c62f94d458851d8f6aeaac4cd905ccfad05e1407c36b4a54560948c077559c7750909c6c38488af0f3dd3a5a8d12d4488ed7e03e5f533d8f47da04e7275c6dc757aa9a7185c7f16b1fca15b97eaa5118e281344a1093d6f1d89742cdbac1f9896895e01410829304dc97a60bba1dc367f0c08500b0b7c41076846f8c24fc855adf6bbf162e77722797e3567911598759b5eabb540fbd7f3527e1852f040234f097ff421a2f0ff6ee67c4717ae3217d1e2e5c4fb28a94608ec794f058e1e550e3cd867c708ea2efc6f322daa2054cd504f7dd5cc566df76e6f4d30b44638ee51d2a53161840ac318e1e9c8b7ca9d9136c58027a106c1c92005e33d7f5dda2f65e28893ac76c55fc1e8540ba4af19aec0fa524dd194dc00b0290ed83249b4061b8ee052ca1a29da9298aed85600cf7fe9c9009b7b17b40108b320d931e31b3ad5d8d2f5712d28eecb4093d9ebc1ca9bb6564df37920a188ab0f1a0f497e93ab8b30f63bb1e6be4097598c0bcd8564ccca498edfbed2a591f8355665f0e0dbd6ad8c5840f1b643a90e26dbff2a80dbcd83fe028c08c00593bd1cea1d0c68067e467fc613c8c399b6a1625eea4c71512875437b1839b99b0f63bf08517f88451b3140cd50390183fe3e307a990a33229f021eed66093a17f1e8522f72de57a87d299033bfbaaa8f1b3dce4dae1e96d83d8edf46ff9de86351bd951e0bb53858a3171d6ace358a3b8ffc41c3372ce2702fb3b1b833d0319624a544fa885bf894a19a35b4b0caefea416e663a4b81d0b9a728dd017c4f4b013145ce5b93206fcf43c2cad51fe9f31be51d5add1663a5132802d8cf207394afe28c62d6cceaf4b44c98295f9b4901827a8f49a9eeccd9cb6348912246a7e8ab539607ee080342ef2c31c35345a3436b549126090c0ec20e106f8b0a5c36f6ea2c9d7bc71a619047a8330ea7b994553f2c45a9ce45b4f71d280c7e830ac4d200f8d43ad67bc5e880f9bf0e918c5941e2db5d2d29791d11547b9a4d492d5b447dc4f59687635b4a0b784cf8daded8e0a13a7b56979703f3f02e08884bf8f0a682727dbbd6a0ae6eba2746fec368929ee7c24839dc35a9e7503a860cd265e6eed0346c7580d8c53b477e5c8c298f3cca508293e772a4b8b0b5f4f1181b811728d748b0bb96fe81babf0b79de1e63005a0e2a132f87136dce00f61952f27626abbc4beaf0984c643dd4891a9b7c6ba748f461dae06e8b7c04937546fa772120150242a38e11dc2870efe6e238f3ec50d1b33dfc34d03418c2b2c8f5326ede5d57546417c20f3aef19fce3e932808b895fd5b56d2155b2dc2c3c0e0e810220ea45edea2b6fb907b448929858f2aa34f17312a8525036a4012aa55b434dde405f0ee3eb10a3932a59e8f80207f28e4ad3aeed8bebc185a1e427178f765f74e3aeee846e575573a3ff1a7236adce9c04bc9a6d23d4cc9613120f873f6ab2070d223d9e4b81409b5bbdff02917b536d1b676aed0e74e71e9b0be7da499d49f222c944cc38e4b35a50fc612def8524c7d62b964415070e69b58569f83ddac0cdbc4b63abcbbf313b4c4bc661181384112800623bb88dbe37b53ee46d884ac2cf5c9d3d7da9b6c568ca8400a62dbb0bbb32110a6670a8ddc993bcd22818c3e3a533375202f8fc57c800a3e8168583da4248c1794c61bee4d872e002420fcca86304102942522843fe30a78078c4275e2c4b227cc06d23d54e75e18fabdb397b39522d9cd6a8a0306849e6f056d72e96838193ba53850119afa1ec6809679d024ec531cdcb8b07b2ebe7423bdf4a9e2e091948de0aca0815ab289b0c327ea520d960e6cd93416ebb486c0ba2f9463e0c4e604f1518fb78aac9a86d126aacdec470b85fe53fe2a4fc4a69d5076017427818cb137a8f379f7c4a6e44fc9f3667c11dc88cbe08b1c0edaf08144f813f3cae29605b2335e3f59b66d533ac00f724e5ea0816d096983e1e86fcf08662ca1474420c16fdb00181297a217b4a059745d68cc26af853273c3fcc5b5e7bdda1e6d246b59d357c1628836b35cea4de2fd8864068f48dc5375247314cb0c49b5cab49140a5d148b1d3296cf6a353b05bfbe9e8f4c6024bf63eb45a166f6c1669e042d679a23e0cad2ed7074710ca9b95c098d74e0e8e81e7b4710549ecbe95bf29a1d8dd815078338bc5d65b8137e49eddb904ef35f26b83639b12d5f712da49b615f65dae40965e591a55f5996a0fe4c841c5c9d6f32f0299f1bd513916514729f6d0f54674d711bb43aae3e90ec96e666b76bb7b997d8d69d13104988b7233d0503d5da52e9e1ed8e66f0c1079b7efbf133ab5b9df97eb73490e724c4363d8c5a81f14172f3ef1b8f4ca992e4cad0000406970b40d336a4b4eb7a7692a9298acc0dacb868af0d6a3595e551b556b9b862b49e922938f13b5753cfb6fc3fccf1a3f9be50db203642f59a0c60211e4ce61f7a95a147cabe41e2ab51537aeb68c0bb79c0a056d6a55831b4e96e392eea2a71b9609eec26e9c72aa5812859132f4d265bc6366a2549dd502f8334a10df928ab0d11adf16769ab7caa9e0d488c42613bf7eb61601f93ec0b78370edf1d08ee169aa19367cab21625f9ef4649ed881ce317ade057c2b801334ebdb17b9acca174de22312222c888ce9021e07a703735047fd0a495b461d0fc383bbb55cb25c86dee74bca7e62b4098c6d30c6400e1bcf83fa3fa60a6e4f761fe3954373ee30c40db4a5136a2d69407c9b68eaa54d212781cd1ba75d00ac6110f59cf6321ef915be9d629667160de47e4ae09a14685e6569c14e9c55f2cf6c6ce390352fd36e1d78e01c53161c874617c970cf693d8615a6176ac9ef7cc4f6b5cdcdc9d7072be97484c3b98ba0de1980e0047da16c0c10cc86efdd4684d124a95db5fdd374307c376c4bab42f6cac24917c33f94c6a9461bf177eb28c74ac324c04d3484e4c010fcb444b962f738f31bcdf3dd045bb1d1b7e24d574329d9f86aa7afbeff349919a57f886d8763e0f1187ed79aad79d66cf02a64748a56b74e62448356eb45e12c553632fdb5dfa9b921987acd8fa568727c3b968c61dcbcce5f81069bd524d65d944dd032d50c084033711cab95ba17269403fa1aea7be8aceb608576b314b48d9e3d48b425eb697d93148d276966ee4a521b42913586eff4548a5a5a51032772a01e7b2d344065187bde30d4990799173d8df84b9208d47c10b0f7bc7c693dc77f17cc78fd5ac813ae5d37f75c6fb4ebc4400a4da961433778d6fc59e83df23859b6a9836d5a3a4761a5cd78f9a28e70171c79feafa7252363101ad5246228a0f07605f3970ce575783af7fbeb10f077ac06b9b123b77b5341b1b185cba602cc68c1d110c5e09c83507c2d41f1f306ffd608e62bc12439e2ea4cc9e87a3f03863e0a0a7aea250e81f743180b1b1259a0aa0b4d33f6f3a0603d91866c9e1e86d21c95711237823f1c6d53e5a57357f207d873524d5d56203c2b0f89d6575fd26508b7151d467208d1ae0a682c7a2664fb8aa987a4fb43fa2d014ec9eadac5eccc329ee6c1f4e9907b6184519a686dd3ab6cdfc5859c84b785fc1022a4c2c9cba6cbe3a06279fb495118789b9d0a9d91bf949abf2979a9bbd8084b5369155685728926d77264b745c182587010c246a25bfaa753fe753dc6a62af2dbfc4c68c006503470901a36ed3decd3df8312aa78ceb85a40f56f5b039b424503ce0316fa64fb6fbf445102d0fc34452f52f1d8b6cf53579e1895960546e1057901b522703e6b22b328218ce682faae8c5dae24851f77b5f6334135e8334245789df0db225655efc4af2b2fe6bb2e306f8ac74fef3eb56aedb53c107ba9c31c12e5d90d71988760e0d9b03d4738bb03a9364f2ecbc28f6c2ca073fec06a16316054715c53b932bca63c84a4fc1cc67c1c598f43376908c82a479eb0b8effd671f27bf3ecb68f83c129b92a4c4eaf618bcb75fd9f060a9c5fd8ade61a734b29def4eb1be2b2ffddd4fe414e3274fed9672bcd004a0d78ecbb80cf854ac9a4cdcb2c213e9b8437a75d5873fdb5642845bc67404e57ffd93487f0298eeb2fdeee48f5bec5071f7e684d33d4f376fb2f87a3d5f3eb802bea506bd69a6953949d2309f178fe4101085fddb0c72cfdd66ecae7e73a44392885be52062d046b049921483b0c0d6c475957da88e4027aa616d394164ade053cf5c0ea0e867a783286ddfb53a31ca1c5700877ab295d994cb25f15e03d8e00c47a06d8ba2fdea20328584eb237553b40acd9ae617c58180b8ae2f3d7c66cbfcfec57ff09d30240539ae4ce9ba77161554ff7adb61c9ddcd2643e30c937eb246a3db4a8a70f1b2e0f0f97fef1416313ef917bfe243fde633553e1ac96a7516b9b5d884824b270f10299db7804d82bcd0d276748dacf688cf0d1f9d771a30e794242340fb720bf6615253a600893ed08b4ae034abf8fde23fca76898299f97d0f0692a5ae4ce70b1077fd4ce353b5c32a8be47c782221ec56bca14341615e32400ab8d8fb514939750859c7abcadc644ae3bccb753a99bd849d1c7297955b38a57dd0d57218ea43c3eda77008457ba8444e3f1c53f2ea38a3b76e9c32a712e89970af9f9f0f499a2075d19ff21326491e776a5496ad2fe46c1ae011e29947fb722cbfc4cd284caeb4c2fe26cc2d57882152ed892f1bcc17e0336a1dd7b00a6655cbbfec2f18724486904256c8e6a0ef4acd04bb243aad39ea9cf4a3b53e42e2f4ce6644605542be5149879f6e3bc6c9d0eb717fc106ef242cd6a5b9111090ba26d99ba1bc2b5dae77cd753fc53659fb4f8d6135db8d16d0e0586b0f5d5f622f303510debf8a5aa416f16866d7345824ac0de4e18ac3300e5afe0e7009b457569bb8579d897076cd86a3985306554b1675bb808d603b2d9f7bfa64203cafb05b62de2c3bcd0e294cbb7282accd83e6cd308b01a412c25059f6bc67e4d046fd7e66ea54fd86fa87248176e80db4c18b23f81f6d8aab11df27010c2450129657b8d1795d8ab766f4df2dff2f64c1a2700c7107aa67520e50f70f22fb3f8b7a0daa577e618e7296c2503f4e131f57097b26be55523a9fc5f10610ac82a15aa1c6ad37ea3b8f5e2125ce6b7020dfc62b92f7ecc2694d5b26d7c2770079c51bd406c3c8956b621df12bf55eda238e748827a50f2553760386092ad5bbb082d243e89f9f2ad7eba5cc3ff7c0dad85a247491a12847f5f221bc718dfa540c31d04d4a11da8591662cb2d24038f8b58fbd8c702828122de4497ff846dba5400f6e363ce03b99fb7bff6b318ef1cea064a97b7f3ba64312d834caf0691731fb0446c701f5d3c231b0f0f9cd60d1f3084b37860a270a4b66cc1fa7e6dee022ba296f12f4cb2eb0f769dcf44b54305ad4cf1beefba19c8d45d2c55024787d4a71c6fa1ddb158942dd1c803c5113e4b6920384062252f9969ab4815ccf6607adeb45", @ANYRESHEX=r3, @ANYRESDEC=r5], &(0x7f0000000100)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x2a, '\x00', 0x0, @fallback=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r9, &(0x7f00000bd000), 0x318, 0x0) 1.077748942s ago: executing program 2 (id=3191): socket$netlink(0x10, 0x3, 0x15) r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r1 = socket$inet_mptcp(0x2, 0x1, 0x106) ioctl$sock_inet_SIOCGARP(r1, 0x8954, &(0x7f00000004c0)={{0x2, 0x4e21, @broadcast}, {0x306, @multicast}, 0x28, {0x2, 0x4e24, @broadcast}, 'veth0_macvtap\x00'}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge0\x00', 0x0}) r3 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000000)={'bridge0\x00'}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x10004000}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=ANY=[@ANYBLOB="780000001000830404000000fedbdf2500007400", @ANYRES32=r2, @ANYBLOB="0008000007500500580012800b0001006272696467650000480002800500190002000000050017"], 0x78}, 0x1, 0x0, 0x0, 0x800}, 0x4008010) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x15, 0x0, 0x0, 0x0}, 0x94) unshare(0x62000000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) r5 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCDELRT(r5, 0x890c, &(0x7f0000000080)={0x0, {0x2, 0x8}, {0x2, 0x3ffd, @remote}, {0x2, 0x0, @empty}, 0xab852ebbeefbd729, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000010, 0x0, 0xfffd}) openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) ioctl$XFS_IOC_PATH_TO_FSHANDLE(0xffffffffffffffff, 0xc0385868, &(0x7f0000000180)={0xffffffffffffffff, 0x0, 0x101, 0x0, 0xf, 0x0, 0x0}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="12aaf1e75c40000004000000020000000051c1c92ad10d3c"], 0x50) sendmsg$IPCTNL_MSG_EXP_DELETE(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0xd1}, 0x50) r6 = socket$alg(0x26, 0x5, 0x0) bind$alg(r6, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r6, 0x117, 0x1, &(0x7f0000000280)="2c385a7af3", 0x5) r7 = accept4(r6, 0x0, 0x0, 0x800) recvmsg(r7, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r8 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r8, 0x8933, &(0x7f00000013c0)={'wlan1\x00'}) 782.080548ms ago: executing program 1 (id=3194): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000680)=@newtaction={0x914, 0x30, 0x8101, 0xe501, 0x1000, {}, [{0x900, 0x1, [@m_police={0x6c, 0x1, 0x0, 0x0, {{0xb}, {0x40, 0x2, 0x0, 0x1, [[@TCA_POLICE_TBF={0x3c, 0x1, {0x0, 0x81000000, 0x800, 0x0, 0x0, {0x0, 0x1}, {0x0, 0x2}, 0x8001, 0x0, 0x5}}]]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc}}}, @m_police={0x890, 0x2, 0x0, 0x0, {{0xb}, {0x864, 0x2, 0x0, 0x1, [[@TCA_POLICE_TBF={0x3c, 0x1, {0x1, 0x0, 0x0, 0x0, 0x400000, {0x0, 0x0, 0x0, 0x0, 0xffff}}}], [@TCA_POLICE_RESULT={0x8, 0x5, 0x9}, @TCA_POLICE_RATE64={0xc, 0x8, 0x253}, @TCA_POLICE_RATE={0x404, 0x2, [0x0, 0xf1d, 0x1, 0x6, 0x6, 0x81, 0xc, 0x3, 0xab99, 0xe, 0xffff, 0x2, 0x80000000, 0x9, 0x4, 0xfff, 0x1ff, 0xfffffff9, 0x4, 0x1, 0xa7e, 0x5f8b, 0x2, 0x7, 0x8001, 0x6, 0x1, 0x6f, 0x5098, 0x3a, 0x3, 0xff, 0x7, 0x1ff, 0x7fffffff, 0x4, 0x2, 0x2, 0x8, 0x10, 0x70bb, 0xb, 0x8, 0x9, 0x7f, 0x2, 0x8, 0x4, 0x0, 0x80000001, 0x1, 0x9, 0x65a, 0x0, 0x5, 0xe1, 0x3, 0x1, 0xf61, 0x3, 0x4, 0x4, 0x5, 0x2, 0x1, 0x9, 0x6, 0xc5bb, 0x3, 0x8, 0x8, 0x2, 0x7, 0x3, 0x8, 0x9, 0xb6b7, 0x3, 0x0, 0xfffffff8, 0x3, 0x6, 0x200, 0x0, 0x7, 0xd497, 0x6, 0x1, 0x8, 0x0, 0x2, 0x7, 0x4, 0x3, 0xdc, 0xc2b0, 0x9, 0x2, 0x10000, 0x6, 0xff, 0x5, 0x3, 0x2, 0x6, 0x8001, 0x8001, 0x200, 0x4, 0x1, 0x7, 0x4, 0x9, 0xffffff5f, 0x2, 0x3, 0xc8, 0x1, 0x1, 0x8, 0x5, 0x7fffffff, 0x2445, 0x1, 0x53c9, 0x2, 0x4f0, 0x7fffffff, 0x2, 0x0, 0xcd6, 0x9, 0x3, 0x9489, 0xc, 0xf3, 0x1, 0x67f4, 0x101, 0x9, 0x9, 0x4, 0x3, 0x8001, 0xb, 0x7ff, 0xb91, 0xd, 0x930, 0x3, 0x7, 0x2, 0x6, 0x4758, 0x9, 0xd, 0x5, 0x4, 0x5, 0x2, 0x9, 0xd84, 0x5, 0x8, 0x400, 0x7c, 0x6, 0x5477, 0x1, 0x100, 0xa5, 0x3b3, 0xb04, 0x9, 0x6, 0xfffffffb, 0x9, 0x7, 0x2, 0xf02, 0x9, 0x1, 0x4, 0x9, 0x7, 0x6e5, 0x7, 0x2, 0x7fffffff, 0x7, 0xffff, 0x10001, 0x2, 0x400, 0x6, 0xa7, 0x7444, 0x0, 0x0, 0x4, 0x80000001, 0x40ac, 0xfffffff7, 0x1, 0x5, 0x9a83, 0x10001, 0x100, 0xc6cf, 0xb5fd, 0x2, 0x0, 0x7, 0x80000001, 0x7, 0x8, 0x9, 0xff, 0xffff8001, 0x80000000, 0x7, 0x5, 0xe, 0xe, 0x10, 0x2, 0x4, 0x3, 0x400, 0x5, 0x1000, 0x1, 0xa1, 0xfffffffe, 0xd5c, 0x1ff, 0x6, 0x0, 0xc6, 0x1, 0x8, 0xe078, 0x8, 0x3, 0xf, 0x9, 0x7, 0x6a59, 0x7, 0x2, 0xbe9, 0x40, 0x7fffffff, 0x3, 0x0, 0x5]}, @TCA_POLICE_AVRATE={0x8}, @TCA_POLICE_RATE={0x404, 0x2, [0x4, 0x3, 0x6, 0x7, 0xdae, 0x5, 0x5, 0xbe0, 0xc119, 0x3, 0x5, 0x7, 0x27, 0x135f43c3, 0x200, 0x9, 0xf8, 0x10, 0xff, 0x40, 0x7b, 0xb31abe6, 0x400, 0x90000000, 0x2, 0x7, 0x7, 0x7a40, 0x9, 0xa4fb, 0x7, 0x400, 0x101, 0x2, 0x8001, 0x6, 0x400, 0x4, 0xd, 0xb59, 0x800, 0x9288, 0x5, 0x89, 0x7fffffff, 0xa, 0x80000000, 0xffff, 0x9, 0x8, 0x5, 0x40, 0x414d, 0x7822, 0xfe73, 0x800, 0x6, 0x10000, 0x3, 0x6, 0xa, 0x7, 0x3, 0x800, 0x3, 0x81, 0x80, 0x10000, 0x4, 0xfffff61b, 0x6, 0x5e00, 0x4, 0x7, 0xffffffff, 0x1, 0x5, 0xfffffd61, 0x8, 0x7fffffff, 0x5, 0xe, 0xd0, 0xe58dfa9, 0xffffffff, 0x802000, 0x6, 0x8, 0x0, 0x6, 0x984, 0x9, 0x10001, 0x6, 0xbb4, 0xc, 0x4, 0x63, 0x3, 0x8, 0x100, 0x6221, 0x3, 0x6, 0x0, 0x6, 0x9, 0x2, 0x4, 0x44a, 0x3, 0x400, 0xffff, 0x5, 0xfff, 0x2, 0x6, 0x9, 0x5, 0x4, 0x4, 0x4, 0x2, 0x10001, 0x1, 0x1ff, 0x6, 0x8, 0x8, 0x4, 0x8, 0x9, 0x1, 0x4, 0x81, 0x6, 0x7ff, 0x9, 0xffffffff, 0x2, 0xd0, 0x3, 0x20, 0x7659, 0xdf, 0x9, 0x0, 0x0, 0x1, 0x7, 0x7, 0x0, 0x6, 0x1, 0x270, 0xa, 0x0, 0x0, 0x9, 0x80000000, 0x100, 0x4, 0x81, 0x401, 0x8, 0x7fffffff, 0x8, 0xffff, 0x5, 0x80000000, 0xc40, 0x1000, 0x6, 0x7, 0x1c00, 0x81, 0xcf5, 0x4b, 0x0, 0xb69, 0x1, 0x7fffffff, 0x6, 0xdbce, 0x6, 0xffffffff, 0x0, 0xf, 0x4, 0x3, 0x3, 0xfffff800, 0x3, 0x7fff, 0x2, 0x0, 0x0, 0x0, 0x10001, 0x8, 0x0, 0x345, 0x0, 0x81, 0x8, 0x3, 0x7f, 0x9, 0x6, 0x9e0, 0x1, 0x3, 0x8, 0x0, 0x4, 0xffffffff, 0x1, 0x11fb3e66, 0x9, 0x3, 0x1, 0x1, 0x6, 0x3, 0x7, 0xfffffff5, 0x79ea, 0x2, 0x101, 0x0, 0x0, 0x2, 0xfff, 0x2, 0xfffff801, 0x2, 0x5, 0x401, 0x7fffffff, 0x2, 0x714, 0x600, 0x3, 0xb33, 0xffffffff, 0x100, 0x0, 0x7, 0x4, 0x9, 0x3, 0xd, 0xeb, 0x5, 0x1e]}]]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x1}}}}]}]}, 0x14}}, 0x0) 733.983107ms ago: executing program 1 (id=3195): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001680)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000"], 0x7c}, 0x1, 0x0, 0x0, 0x40001}, 0x4040850) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a64000000030a0fdb00000000000000000a0000050900030073797a30000000000900010073797a31000000001400048008000240a04b3d02080001400000000308000540000000001c0008800c00014000000000000000090c000240000000000018ab6e14000000110001"], 0x8c}, 0x1, 0x0, 0x0, 0x4000850}, 0x24000840) r1 = socket(0xa, 0x3, 0xff) sendmsg$inet6(r1, &(0x7f0000001c00)={&(0x7f0000000000)={0xa, 0xa, 0x2, @dev={0xfe, 0x80, '\x00', 0x18}}, 0x1c, &(0x7f0000000240)=[{&(0x7f0000000040)="671723d7c6012c", 0x7}, {&(0x7f0000000100)="9e91d93a92dc7c8fff658bb539e2a1485d4c9223a7dfe538a2e2fea2", 0x1c}, {&(0x7f00000004c0)="e32e40d0f3099fa777eb9b4cb4b88baba6141ba3541afb54cae68986e70c2cd663106876e33e733b8e57ff059412aaee", 0x30}, {&(0x7f0000000140)="2bc4", 0x2}], 0x4}, 0x20008b88) 588.104742ms ago: executing program 1 (id=3196): bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000001c6a000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900"], 0x7c}}, 0x0) r0 = socket$inet6(0xa, 0x80001, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r0, 0x29, 0x2a, &(0x7f0000fca000)={0x100000001, {{0xa, 0x0, 0x0, @mcast1}}}, 0x88) setsockopt$inet6_group_source_req(r0, 0x29, 0x2b, &(0x7f0000000240)={0x0, {{0xa, 0x0, 0x0, @mcast1}}, {{0xa, 0x4e21, 0x4, @empty, 0x3}}}, 0x108) setsockopt$inet6_MCAST_MSFILTER(r0, 0x29, 0x30, &(0x7f0000000380)=ANY=[@ANYBLOB="01000000000000000a00000000000000ff010000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000003000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001"], 0x190) 509.974202ms ago: executing program 1 (id=3197): socket$nl_route(0x10, 0x3, 0x0) r0 = socket$tipc(0x1e, 0x5, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a7c000000060a0b04000000000000000002000000500004802c0001800b000100736f636b657400001c000280080002400000000b080001400000000308000300000000ff20000180080001006475700014000280080001400000000c08000240000000020900010073797a30000000000900020073797a32"], 0xa4}}, 0x0) connect$tipc(r0, &(0x7f0000000080)=@id={0x1e, 0x3, 0x2, {0x4e22}}, 0x10) bind$tipc(r0, &(0x7f00000000c0)=@nameseq={0x1e, 0x1, 0x0, {0x41, 0x0, 0x4}}, 0x10) r2 = socket$tipc(0x1e, 0x5, 0x0) sendmsg$tipc(r2, &(0x7f0000000240)={&(0x7f0000000100)=@name={0x1e, 0x2, 0x0, {{0x41}}}, 0x10, 0x0}, 0x20001) 305.990695ms ago: executing program 3 (id=3199): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(camellia)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f0000000800)=[{0x0, 0x0, &(0x7f0000001e80)=[{&(0x7f0000000340)="7d7a68e25d38566c61856d6817441a9caa9b23557af3d00f974cd91d1b33a9d6077fd480051346d814913f8a3ef2e1a781a2bbfc8d55dca693d39139f04047784190d93b5301b4abe27c9242396d40a5c2b7789629214281c8e09a6c1f1e0db5d1e74e1f27a89b2c25c2316fcddc9ff2a71eceb3094ba465389e", 0x7a}, {&(0x7f0000000700)="ce2ede98d4a7e4b9a7938b050ddf51835e71aa0857d0f79d3ce502000000b5cc4397be", 0x23}, {&(0x7f0000000600)="5fec9dec1e9d48e2b3a02e29dcaadb6d242c08b8b6e2a34dd08e48e34000000000000000d6bf39fd7dac80fedaaab8ff4258ecbc4e025305fab94303f773d083bb47da24c3341e27416f38e3251fe082c8f8ff2308cd2f7dc846c93e62a8d53d22fcabce47b5531463290c970dccfaa7da3e4ee56136f44b991100e3db7c750c3ccb3e01d6598d53d05ca7503d7430f3ff2b79ab629faa1dfb2d0899dd807d28174305bd600e50112aa4d0ec230a89b3078bb60a198e5a7169d91005cda3fc9870956d72773bd700", 0xc8}, {&(0x7f0000002dc0)="c615271a9dc3c1d27eee864db95e0b71f8e4965515323d75357cb0914b03d9b18c63ca3692399e0aa8be01a5b9883f1e4830cd8b777bb75c27cba21f087b8a8a92bb4353b5e825f3837bfcce5681589bd0ce90380fed43b1ebc4d4c4e3efe4c1a60e3d56753ebac731ddf0a80a42e71cd2fa58a5779bd29d2b7e65156607f7ca769417e0f79d2dcc55c20e63117ccc11b7faea5291fc6099b1694de06c2a9f0b9e7b096784ffd831026ff8e1c65bb146f6d443a0dbf1e379b81cddca421133db702ba0b832784f9cff4679d7c639f779eabf51f99e63be27e73b9e823b1dc226481799c216265c35c25e233d5c4ea908010d96628e3bc81e0134d28f5ce875b9bc0a97dab94cb025b8c79d30e98c442d0e25711c70f4368e89daa677bd09d7fdb29c712c758b570304cfe142985c3a9de164cf56a473d09ccdc5ececde2856b684cd15201f0f575ff59d57e647e6fd7dc20538faf8ed3c816f1bcebb9fe53173f8066cdf4e98d87042924db327542497f991bc0f4a19bd587921b1d009bf7e1f649c5b22771494a9cdab7f773a6ccb95c795698b85a91236c885f0", 0x19b}], 0x4, 0x0, 0x0, 0x4004845}], 0x1, 0x48800) bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=@base={0xf, 0x4, 0x4, 0x12, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x200}, 0x50) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) 305.350775ms ago: executing program 1 (id=3200): socketpair$unix(0x1, 0x5, 0x0, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f0000000800)=ANY=[@ANYBLOB="fc00000019000100000000000000000020010000000000000000000000000000ac1414aa00000000000000000000000000000005000000000a00000000000000", @ANYRES32=0x0, @ANYRESHEX=r0, @ANYBLOB="00000000000000000200000000000000000000000000000000000000000000000000000000000000ffffffffffffff09010000000000000000000000000000000000000000000000000a0000000000000000000000804000000000000000040800000000000000000000ac1414aa000f00000000000000000000000000003c00000000000000ffffffff00000000000000000000000000000000030300"/180], 0xfc}}, 0x0) (async) sendmsg$nl_xfrm(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f0000000800)=ANY=[@ANYBLOB="fc00000019000100000000000000000020010000000000000000000000000000ac1414aa00000000000000000000000000000005000000000a00000000000000", @ANYRES32=0x0, @ANYRESHEX=r0, @ANYBLOB="00000000000000000200000000000000000000000000000000000000000000000000000000000000ffffffffffffff09010000000000000000000000000000000000000000000000000a0000000000000000000000804000000000000000040800000000000000000000ac1414aa000f00000000000000000000000000003c00000000000000ffffffff00000000000000000000000000000000030300"/180], 0xfc}}, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000a40)=ANY=[], 0xa0}, 0x1, 0x0, 0x0, 0x4c808}, 0x51) sendmsg$OSF_MSG_ADD(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x4000800) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0xe, &(0x7f0000001100)=ANY=[@ANYRES32=r1], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000340), 0x10}, 0x94) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000340)={{0x1, 0xffffffffffffffff}, &(0x7f0000000200), 0x0}, 0x20) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1b00000000000000000000000000040000000000", @ANYRES32=r2, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b'], 0x50) bind$alg(0xffffffffffffffff, &(0x7f0000000680)={0x26, 'hash\x00', 0x0, 0x0, 'sha3-256-ce\x00'}, 0x58) r3 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r3, 0x29, 0x20, &(0x7f0000000040)={@private2={0xfc, 0x2, '\x00', 0x1}, 0x800, 0x0, 0x0, 0xb, 0x9}, 0x20) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(0xffffffffffffffff, 0x84, 0x6d, &(0x7f0000000240)={0x0, 0x87, "7bf8ec152fa16d39e4553d9607191c01003f4f261459314625abafbae0dd3d3a415cb19b2f3f5bd1d92f8a3b28f86ac6911e26622113c1d519b46c2b1bb9b76cf8008d37a06e88b31100ae16fcb20ca3c5e2bc78d0014278c1e4c7fb4ab35e2c3ae32abc7bf205fd325765be5684ece2933f3325ec9cb8b4725605bf2722d1ded87089430c8a35"}, 0x0) writev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000100)="480000001400195a8563e43c12f461560a2972063700000000000000590000a2bc5603ca00000f7f89000004200000000101ff000000032fdc0e2d9d9b7373ed", 0x40}], 0x1) (async) writev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000100)="480000001400195a8563e43c12f461560a2972063700000000000000590000a2bc5603ca00000f7f89000004200000000101ff000000032fdc0e2d9d9b7373ed", 0x40}], 0x1) sendmsg$NFULNL_MSG_CONFIG(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f00000000c0)={0x0}}, 0x40040) socket$alg(0x26, 0x5, 0x0) (async) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) (async) bind$alg(r5, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r5, 0x117, 0x1, &(0x7f0000000280)="2c385a7af3", 0x5) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="6400000010000305160000001dc76dcd00000000", @ANYRES32=0x0, @ANYBLOB="00000000000000004400128009000100626f6e6400000000340002800500010004000000050016000000000008001c000000000005000c00000000000a001a"], 0xc3}, 0x1, 0x100000000000000}, 0x0) accept4(r5, 0x0, 0x0, 0x800) (async) r6 = accept4(r5, 0x0, 0x0, 0x800) sendmmsg$alg(r6, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0x10}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0x4d}, {&(0x7f0000000940)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11", 0xce}], 0x3, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18, 0x8000}], 0x1, 0x40880) (async) sendmmsg$alg(r6, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0x10}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0x4d}, {&(0x7f0000000940)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11", 0xce}], 0x3, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18, 0x8000}], 0x1, 0x40880) recvmsg(r6, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000300)=[{&(0x7f00000000c0)=""/81, 0x51}, {&(0x7f0000000200)=""/83, 0x53}], 0x2}, 0x0) (async) recvmsg(r6, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000300)=[{&(0x7f00000000c0)=""/81, 0x51}, {&(0x7f0000000200)=""/83, 0x53}], 0x2}, 0x0) sendmsg$NLBL_UNLABEL_C_STATICADDDEF(0xffffffffffffffff, &(0x7f0000000640)={0x0, 0x5f, &(0x7f0000000280)={&(0x7f00000004c0)=ANY=[@ANYRES8=r4, @ANYBLOB="010026bd7000fddbdf2506000000140002002001000000000000000000000000000114000300fe88000000000000000000000000010108000400ac1414bb2b00070073797374656d5f753a6f626a6563745f723a7373685f"], 0x70}, 0x1, 0x0, 0x0, 0x4}, 0xc8a0) bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x3, 0x16, &(0x7f0000000300)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback=0x18}, 0x94) socket$nl_generic(0x10, 0x3, 0x10) (async) r8 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc2(&(0x7f0000000100), 0xffffffffffffffff) (async) syz_genetlink_get_family_id$tipc2(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$TIPC_NL_KEY_SET(r8, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000bc0)=ANY=[@ANYBLOB="f21ca4da62c3e9b515b9da9b", @ANYRES8=r7, @ANYBLOB="0100000000000000000017000000540006803c00040067636d286165732900000000000000000000000000000000000000000000000014000000e3de3d7b4cd07ec3ee777fe774fc7987cca4198914000318a956e97a533ffdc155c5e3e6067ce328d1e989a73bd112c8249678c6ee65a346515eca8bb325f21d5a619d91640e8e5b92d8c0828209bdb59019d92985c5ba32f26d094f7b9e93c3cf6285e48f46c0091adcbeb9aa12a967446915c75b9c9d7a9aa2ea11"], 0x68}, 0x1, 0x0, 0x0, 0x4}, 0x4008014) (async) sendmsg$TIPC_NL_KEY_SET(r8, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000bc0)=ANY=[@ANYBLOB="f21ca4da62c3e9b515b9da9b", @ANYRES8=r7, @ANYBLOB="0100000000000000000017000000540006803c00040067636d286165732900000000000000000000000000000000000000000000000014000000e3de3d7b4cd07ec3ee777fe774fc7987cca4198914000318a956e97a533ffdc155c5e3e6067ce328d1e989a73bd112c8249678c6ee65a346515eca8bb325f21d5a619d91640e8e5b92d8c0828209bdb59019d92985c5ba32f26d094f7b9e93c3cf6285e48f46c0091adcbeb9aa12a967446915c75b9c9d7a9aa2ea11"], 0x68}, 0x1, 0x0, 0x0, 0x4}, 0x4008014) accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) r9 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r9, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000740)=ANY=[@ANYBLOB="200000002e00090027bd7000ffdbdf250400000004001900080017000200000053dc0ce362351fe975d8fd7ff09b66303f7969c6166d53d632ae2e37ad82fa5a3c0f0c099a95eb6f127bf814a6dfb4795ae652c5d3f7fc9515ca93049a5eb20d7a346579b294a50748dea738e1561acd366aeafb790789ee5e81c9b2320220d2877f"], 0x20}, 0x1, 0x0, 0x0, 0x42804}, 0x40040d0) 221.441371ms ago: executing program 0 (id=3201): r0 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000040)={0x5, 0x0, 0x0, &(0x7f0000000000)='syzkaller\x00', 0x8009000c, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xb8e}, 0x94) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wlan1\x00'}) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'sha512\x00'}, 0x58) r2 = accept4(r1, 0x0, 0x0, 0x800) sendmmsg$alg(r2, &(0x7f0000000640)=[{0x0, 0x0, &(0x7f0000000880)=[{&(0x7f0000000140)="b57523cb1a2c90d8acad2e2d98dfc9ea7a5843c3b63b683ced2b3266175599b779617e66e6b3e15c042be90635a2d36160bbf9a2edcacc0bbe015b84150a1928de94397894ff36aa430fc2a0814ba634308d6d0837250dfd1eca5383f9d151449743b1a0c4ffc51242a229c5d6d06f147a61d797ea7ffeda95b76f5623", 0x7d}, {&(0x7f00000001c0)="66f7", 0x4}, {&(0x7f0000000300)='l3', 0x7fffef80}, {&(0x7f0000000780)="5b06c70461fab92b3d952a0a0b5eca7d6b21f62c4f56ea9109a00b742eab4a7fdac90ab7c51a813cc4d693127d10c4e7234944e9410ad19c43ca9751c1b97aca344e5bf77fde23184af0b7e160e7a9a681f6391270dedc2978f7d1b9a913801beaa52e1eedf0ae71021e0d40864fc63603f1d6d94f55d23fb15eebc780292ee4be48a9036dcb83345a4285e043439e95b3f23b6edf199cea092725d6f7fab0f975cc42bd279f5de21d08a38091edbb34b32c6cd53373651fd3343aa6b228a996d957c556694dc3a26b68b38093a92eb192aa973bda1b51c61b6cc2b49a54550085e8d8270d889cefe65f62c975815b1b1208ed"}], 0x3f}], 0x1, 0x0) sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD(r2, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000680)=ANY=[@ANYBLOB='\t\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="200027bd7000fcdbdf254f0000000c0099000000000072000000"], 0x20}, 0x1, 0x0, 0x0, 0x20040080}, 0x8004) accept4$llc(r2, 0x0, 0x0, 0x0) r3 = syz_genetlink_get_family_id$gtp(&(0x7f0000000180), 0xffffffffffffffff) ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE(r0, 0x4048587b, &(0x7f0000000bc0)={{r0, &(0x7f00000001c0)='*%&@\x00', 0x40400, &(0x7f0000000200)={@_ha_fsid={[0x7, 0x9]}, {0x6f8c, 0x214, 0x4, 0x7}}, 0xd3, &(0x7f0000000240)={@_ha_fsid}, &(0x7f0000000300)=0x8}, 0x7, &(0x7f0000000ac0)=[{0x5, 0x2f, &(0x7f0000000340)='\x00', &(0x7f00000004c0)="6ccdfa250a31e281b3405cc9ff000b9840a6431632e1c746e4104af9b8401ac0874490d951ba0ac5d6a0266c181da8daf3e132172bc84c0622a59346604258a20256091c4214472aa91e5ed29bcdfce9c8e988df0a14d53a617d92bc400ca913ced003ba44dd75", 0x67, 0x10}, {0x2, 0x1ff, &(0x7f0000000540)='$\xcc:&&\x00', &(0x7f0000000580)="1c03339abd8b684591fecce9d4dcf133ace4d5c51c5683a24279c3996852db8ed765027e9ffe5512af343627fa2d", 0x2e, 0x2}, {0x1, 0x2f4, &(0x7f00000005c0)='wlan1\x00', &(0x7f0000000600)="463db3ba8719789db05d8aaf9119a2ea6af4e553bb60cbc12a6fd288c058d97566ea1b91a7e15d0e3968d019675a4382b08316bb7fe9d4ac5e49792acdbff84ac4654fb7ecbf27a91938e5a072d3050bdd2e1b4130177bac754376419806051188c682c9f9e3329fcc93ce5edc0c8561e125c51f8971000d49402c7bd883b5293ddd8afaedd59cfd9f0db99d72b61a385f4e4b88c885f965f6f15da21b9587dcde52b579c73245ab7729cd40509150716338963ff9769f4d5c2537162f082f7a14ec7597ff174110b18c6665464aede4850a9b832021451cf70cfe5397b154fda5db0b700363401a4916747330da30e994cb", 0xf2}, {0x3, 0xfffffffe, &(0x7f0000000740)='\x00', &(0x7f0000000780)="985a221756a4aa8ea38d8efcf4484bc85e0f9bec77cd71ec14f8c1d3687c56ac33bdd20b74f3e74470b4723f2cbbafcc9674fff90e87e778059f9a33af0169107bea7f667ee9d8b6b617d508eb58da33aed2aaa70543a8d887d63ee2fb902291e4270f3e1b6e7045d15cbe7c3964abfef6360b45f54f9b45932036f29983847aa93325f3cb1c26b6eb48001d950ad7b0041eb71db0e06a829d73c2b278069261baaa4c3f49073c565a5baf486322e28fcb823d0a8118503a", 0xb8, 0x10}, {0x2, 0x4, &(0x7f0000000840)='\x00', &(0x7f0000000880)="61d17d6bf591d9145e6cbad0ea39011347d7ad6e937a8e35f6807d759fba94a35a68cc76dfc5b4e0d98a5deb04fc7331590ee1fce9d88a60c00675ee7b38de5be5cd2c696d89f376770b06b843d8aba7c129ba80b0905a5ddc85c054bea498f9ce87efbf00f9eeac816b74c6ce751bd6b6f1", 0x72}, {0x2, 0x1c00000, &(0x7f0000000940)='wlan1\x00', &(0x7f0000000980)="b2c0eb5b355f68133360edd043091b459f13614d266f5b058ff239f229c0a9d6e0e3def1b0e93aaeeef6319eaad2246754f653df544444adc56803a0d6a3e676b03f04637edf833c", 0x48, 0x10}, {0x2, 0xd, &(0x7f0000000a00)='syzkaller\x00', &(0x7f0000000a40)="380ee6ecdc72fd21099d50762c47ded01c502b65f3206acf0be69b7c90012c9b9eaf0865e3667512fe7a736e5def1b4ba725f8f75bff879bec71da17ba501c8038ba82f0a7f8fa8c50b42b2c558ec4a2bc46773ce34e29ad1c2bac04ab410dd6f9baa1016da0358629976d1e89", 0x6d, 0x10}]}) sendmsg$GTP_CMD_ECHOREQ(r2, &(0x7f0000000cc0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000c80)={&(0x7f0000000d00)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="00022abd7000fddbde2503000000080007003be9129531ac22cf19a29491d160ebc97cabfc6f4c5bf5cd4ab33b7e4db60dbdc2037a5f40fe6390677271e913e728767b0732b3fc29262c8c169cc4bc5d2d953267e511e9ffe016218cc8df4d53cc953e6ecb175ec5b42cb400eee3e45e6c15fbfe0b4cec7f1d5c1871961ad3cd14fe6e07b295847a2f03252cea88757330f4061a311bdda79cb9e4e217583996094d7dd16a9fd4a50e26455e9b280c5268d9014a30a987b86a011e93c2dee4f60bd0b1cec4aeb85ab2064cc6e4f3ae317116ff64e45b9d12bb2936040d69046585c3c8ef0702b126a6a611cf1c1de42bfb1da2df5465b033da81ffa241f982a61f07a820094830793cfab055c4ea41c0e4e436ba24b67de5ae2fa95aa147a677f1d2ddf9f29977a82bb7da9b761ca82f5fcfbc8a546e50956daa3b89fa7f1420c1cf4e6ed33bfb0a4e3e9b02c82bf1d79c577306418eaa7114f54b755305a8cb1cf14e4cf791cc03cc411467311e31be65980676d85c06386131723e5b5a12e216ddd3c223612725a4c5043f44fb930dc43657c2f1dcc13c37e0f064471aded9098d06c99be07000c84d6dc6cd156b4b2895caefe9595fc04cae4f51af58f57ad3e85d0e4aa43d838ed2843772ca477a84b94b40a25ee031ad6393e53f3267a44611751d", @ANYRES32=r4, @ANYBLOB="0800020001000000"], 0x24}, 0x1, 0x0, 0x0, 0x4}, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) socket(0x8, 0x3, 0x401) ioctl(r5, 0x8b2a, &(0x7f0000000040)) bpf$PROG_LOAD(0x5, &(0x7f0000000400)={0x3, 0x3, &(0x7f0000000040)=ANY=[@ANYBLOB="1800000008000000000000000000910095"], &(0x7f0000000100)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @sched_cls=0x37, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, 0x94) bind$vsock_stream(0xffffffffffffffff, &(0x7f0000000440), 0x10) listen(0xffffffffffffffff, 0xfffffffe) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) bind$netlink(r6, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) sendmsg$NL80211_CMD_DEL_INTERFACE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000280)={0x0}, 0x1, 0x0, 0x0, 0x4}, 0x4002004) r7 = socket(0x2a, 0x2, 0x0) getsockname$packet(r7, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000001480)=0x14) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000380)=@newqdisc={0x2c, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r8, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000500)={0x0}, 0x1, 0x0, 0x0, 0x4040000}, 0x24000000) r9 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r9, &(0x7f00000002c0), 0x40000000000009f, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x40241, 0x0) r10 = socket$inet6(0xa, 0x3, 0x3a) setsockopt$inet6_int(r10, 0x29, 0x24, &(0x7f0000000000)=0x400, 0x4) 157.696738ms ago: executing program 3 (id=3202): r0 = socket$nl_route(0x10, 0x3, 0x0) (async) syz_emit_ethernet(0xaf, &(0x7f0000000000)=ANY=[@ANYBLOB="ffffffffffffaaaaaaaaaabb5500450000a1000400000073737800000000e00000014e20ffff008d9078b4e1fa95765798262e83e352be08f88858937290daa680842f452c30d6040000000000000038848cde35b72a6259f080b611ec951e601467dd381201b1a8402587b51fe0ecbb44d049159db7957b28fbe8c64d"], 0x0) (async) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=@gettfilter={0x3c, 0x2e, 0x100, 0x70bc25, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {0x10, 0xfff1}, {0xd, 0xf}, {0x6, 0xffff}}, [{0x8, 0xb, 0x5}, {0x8, 0xb, 0x9}, {0x8, 0xb, 0xc11}]}, 0x3c}}, 0x0) (async) r1 = socket$kcm(0x10, 0x2, 0x10) (async) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x5, &(0x7f0000003280)=ANY=[@ANYBLOB="bf16000000000000b7070000000100004870000000000000280000000000000095000000000000002ba728041598fbd30cb599e83d24a3aa81d36bb3019c13bd23212fb56fa54f2641d8b02c3815e79c1414eb07eae6f0711e6bd917487960717142da7646c4fe02996b60cf81ebcd50fa9ea4308123f602000000000000de89e661168c1886d0d4d94f204e345c652fbc1626e3a2a2ad358061d0ae0209e62f51ee988e6ea604ce974a22a550d6f97080980400003e05df3ceb9f1feae5737ecaa80a666963c474c2a100c788b277beee1cbf9b0a4d3881dcc7b1b85f3c3d44aeaccd3641110bec4e90a6341965c39e4b3431abe802f5ab3e89cf6c662ed4048d3b3e22278d00ce00000000d3a02762011052eac2951257b85802189d74005d2a1bcf9436e192e23fd275985bf31b714f000bcab6fcd610f25f5888000000003f11afc9bd08c6ebfbb89432fb465bc52f49129b9b6150e320c9901de2ebb9000000018e3095c4c5c7a156cec33a667dc8aff950ca1e5efdd4c968dacf81baa3a509b1041d06f6b0097c430481824a3f4fddd3c643f630ba175d876defd3541772f26e27c44cfdb2d85d6d29983e830a9cdd79837b3468e8c67a571d0a017c100344c52a6f387a1340a1c8889464f90cc4cd1f570dd39877dfb2ff1ae66e1ce917474b2e650ae630afd014a337ac5d58bcb5e51723257c872c5255f20100000000000000f041b665ab21372c8d8b7bac5b5c784d20a4a24d8dbd75062e1daef9dead619cc6e7baa72707157791c3d2a286ffb8d35452bb5d36c2a8682bf7ecbd53f950ef4709ec01e230d2f53594ef4839c6130c4c13a0cca84b9935f771fd49e4b9ec7a410ec42315255be1ed66d9051f22614d1f62734d679039a97d2b74f9e8e997ccd314000f747f4e8e7025123e783df8b8a17e3aa9fe1f662aef87a065b03cfb65b4dfe4f1b56e1f23128d743753a1de172d683d5892ce9414a1d98ea93e3d35dbb6c23b90cf36e83b8a434a97d09343d7f83079ccb02e69d384146056d125cfa788237874dd42dae334bda042819a2aa24dba1c25be2794448b4f63483026b5e34d44705b76ef29241adab0dd7d68bf975e02069f6f2425e1bc97a3d588085f16bef63a06578d4f5de7bfb6aaa75f16996d536256c02284cb1d3a6fb8cae87691fae365a70c3fc69e1565bba8dd8a8ca049f798ab20000000bebd69413afc9d8a5edd7aaa000000000000001e6c2f2a287c5278a218dbfaffffff00a14db5cfa6819eb1d39c48cfdc80d2000000000000000819363154cca4e2f89800d18c89d7f46f679df6c9e2952ae1ebfd0ca88368ee6ce139e8b5822c22cf2e9dde943d34c432e1001171792c65986146666a5490928441f47e0fe5eac41824ca1fd0eb71aa243c88d5480e5aee9c9e5f2e5a56a6d920335c8e8726fd8329d9a728995b1531bd20360d33d8f9ffffff5f912ac4e34bf6ea8a86da707b03bddb491ba0cc98f6be92c55969a2b50025419d1476c73132ca7ca26ce8a7e3ffb700f09e157f9b844051f1a642aca9ff98c9036471ccff0522903e7bcf62e18f7696bbc280b95e8e0d6fd5644b0ebde3a95b06548862de809d3dae3cccf109f7c78e8479a345e800000000000000000000009455bf417627ce723a5d9103706aba84279500bb82f6b5a3ddc0bd9856712945b70c75ce5b722578820820d010d7a3cffc99fc647d0b82ef26ab708c0b19ed144be51c3b398f0e6bb7a30006000000cba12953d58cff0f0378740fe6662f377b97d8e7cdb047050d7296cd3856476a60a49ad127ba6570bafc2bbcf9ee721fd9cb467ff071e5603a9d801300000000007d932d7a64de4c4aa433fc0840aff7c47da3a4c6966d0000000000000000f6bfbae29e8a6e2a889f6ef6869d82d6bd73eb76b65c7a35a54a4a6b8ad4600e3a972a0bb5971a5f16590b0a03dafa3fd1118765cc8ab9fccf3b51c41a339f200f2fa33006910a679a9ae0187b4d750c4bd244cb0cbfd23b265f4d4da448a7a0d19c5e43eae50a31609dfa2dde267551467eb6475293dd7012cc449009981f22820e57a0eff234ccfe21d7a2302e000669753d3c3432cc14ee1abe724adb6b5431befedd3e22971118f0e21aed03a6fe7860b3e13c3173a60a1823cb7dde8212a8531bd9060000006a370e9eb56b3d790b98f2bd0db1e5de6a146597b2cbb7103040d2a39d7965d34df524b760ab92efcce7dd1574052c735935bf6a752c015c7f5ffee9ff66e5dd2866b15b6e0d17618cb1f5c1ee4b05ebf1445ea110f499f840a5c965443d535556351ee25fe09f69494b053678dcadcf02e063dff2fa4bef1ac3bbbebe6c74d71ec3b23e29895eff1d1017024fe3e8cc759b05785adc346b7ffd05963f92c1d0d7d90ba878ad89e490f3e29ac51d30632869a534418f916bf6fe8167827a8e6c8f8b391c822805cb0adf1b8bd6947ff208753eb0d208ce14f7b206b2e02221e963abc5ceb735c1b3c46b0a843de52a0000000000000001ee9c2b2705c1a81d9d3b9656b219c8cd99c9cafcd0d0540884d97aecb19983fc6af29ab44a82aff9cba921192c665b877af6539bdb1b567f481ba0790ee0d112f99e59ba82e7ad758f4e1eac69e7e88a63960975f490e161e371ec8534791e3b61c685d900a9c0839208356b53750e76fcc3c2d1bddcbd83897921414d0c02e8188f3df79ea2a5c5444004830e6cb227ca1bdafb977c00000000003a417193b8c5d793687335a930867094fd6a78218218e04b705ec62f1608cb569b81914e68f175b392af6bc4fd2121d7fd276af268c900a756e7a0687d98b8e76d8d0d231e4fe00be1de76bd19cc12e2bd938eb681ed6bc951c1b4f7c51af59eea4d40c6000000000200778a677b72786311153271a3313da02645e11761699e4d04ac86dd14ff7b9a10d3fa74696fe3953a5b7706bf5d1faba4b18808d9cb0e9db696dec4e0820ee4028d7225a2c9c427cf64cbde6fba056b2006b7a37c1181d530fb865e235cd302f3b4071ee52303da186b9e5e3144bf479f277f10656ad3744037ccc9c63685a6f1109d2ea73773d3635f61497f1fa1ea4a16f601800bf3e59141fbf05a96113320c44500f8ffff970d5254727e804fbd99ccefb7c09269dd2c5c25e56e169ac15980f3f85f7ca36dd5950ef5b64fd46f123311829534a82940994199b3cf7a8f09c1946e55289f668c423fcbb31ae91864c882313151741a67538c9689dc8ecc9903c7041e5c1b04e2fa55a756487517a7445cbd9e3f5175e41c00000000000000000000000000bf98efd587fffe326f474b0b089c017b16c0062cbce96f5adebec52a79f9363909842f79c50a1520be46d87003137e4c5031f00123e812a5e37cd52c9eb7336281cb8c6ce9934b157d7875a70eaf103cb3138e2361c51cd1eab8a26b232acf6bf0ab829c26dab637538b2eb1420d812d2b80c777710ba0f18e4661681aa218d9ba54023ab4305977eb15611ae2545835e9d30e9f6d4fb43a291c69545a1eea0f87204311327c18380fedf3d3dad8549f99bf6c5cb060fc37d2449f72de0cbea4bc1dc89c136cdbc504f849d5502d77a95c7bfff4cd9c03058d0d4d07ea64824f1acf2b39289f675f39d01719cdbab3f1ce1060f3e6806e774a5f079c8d7b3e37cb99b41da5e485a441b6a103549f55ab09dc98767763d1f2fafd45bb7d2b40050d1f8292f4d9ec6d0000000000003932062290f4996fdd55b06023437e9e2072daf7f5d82f6f1b5b89a41134f4dc2e65bb11272fdf8c8141f41d6160b3d8b6ecd16d14267f61b4881adee7f07f3d6af5ae794286b6c3e1f5a76b85ed6e1f0000c608b8262c807dd755e22b801162381aa9d1af2bbc9cfd497585337eac408b8475b47a392a10cae349160f128e5f873a58064eb400c36a90624f6aed398a215e9ce64522ab249f67c38a656d32bf349d2c0f88a42e9189bbfa7f5cf35b6e7ef8f9d33163b7ea87550fb1ba334c83e3aec4714c9c4ca3ecb04f2720237615a28bf310b58ffa2a103216fdcc8c2d8f5d55e5e7ebf147105272aaae56e86d856b3cf79a3f7306436762dd07cebc7892ec6f9f696da38feed3dc0001500e34adae1ba89a32bad2af9030f840f1ba4664f35547cdadd5cbacc59352c290f55d971b65953533668c25f21d8d62d849e9058eaa97c63491568887548f668cdbca2abf01a361a0b64d8b523e669da350e3ec7445dfbf366b0b3bc5e76824a1951393352bc756f3fcaad2c1c399a3e43eaaeca70db90f2fa395964434476719334482eb5424c81814079a24fe3681ad9ac361f71ac279a688f10a12105edebc5e3b8dad4c8305ab129ca2dfb9b7c5e9d097bd01b495cccefddce569117f7f5d6a6270ff0f0f4c371029ca8489571b55841bf3dd003bc81460eee57ceb3c33f4e9300b0144fe040cf5fcfcbb616c2070237881afdb314cecd1623f3e55ab8b7627fa1be349145a8d6313cbc790eefe2020138e82fbdd351be4ddcbcc9bc048dd3db5828d16baec6e07a007f0030f34ea3cfd524d6fa1d45da5641d6c94e1d3ae7fba1c85035d2a60ef1696e0d96aa1c60019f73ae0aa6113cd66ef26b577243152374d7b367337c26e1461405d86fdf091edd526f25cada439bb3609ed5c35ab60a539ade786bd6004d0ea3edbd6c4da0d8e8be8c771c8c8a0b07d9859e04adb18964dcce9bce546074c26dffbc2dff78ce9308c845d4257000000000000000000000000000000000000f29657697d9c2b132b2dc2f5ea5122836582a7e85fe2bc166f17aefd9d861de0191f5277d4a3b5afb6f200000000000000000089de7f8485d9507164a187220b36ddc7fa645d4bd0c1414c30a416f80ba17d21d53961471b2d2d459e4bb23230d676ca49633b25e26a322024beb7c3427da59f7daa70a5d44a0eb895f29245df6401295d3da939954e126a3be932f47fe61ef1bfe83086651af7e23c2a8fa702b9aaa65aa3edaaa6b3f5a0c7cdfd008c898d73bb97168ca390ef539800000000000077a5ad1e683aeff92bb0b66b33ed878df1e344b99450086c819bf174578705c049d2fb25a91ba04643cde1a3c391d8646e5249dbf28b13b1c4d5127f685ee0c0576bf74e17cd3b4df4eb7095e504e361689572b0f93ff1dc6f52e8728a03e5a4df80a32c6055df8f4f4152c0bf4d793b20ac2cfa907b5af80716118f82027d3e4cb096fe86de545008b85cb9b637bca30d765b0c3ad489db32955454dcfe000000002830e5e125322d2f5829040a91405bf2fe5bf14833fd7b1e72c775f267bc4511183096eff3188a288c408b10285e7ec75f826e9b08a82cde1f4470545eebc71440623752e87ecc689b7fec2f667e22705b4660b2ef936cce446244bb48f8c7d062ea4a955facf6c2957cfb3c3ee9229efab5b72a5c5266eb493c7c3b08a91971692d9673cb9df620a8240d4f94b9fafd8e2bf0f9cedd1e08f4f10fd8f25f3169ed878624adccb5572cb918e0e3ba7e4ac0967aa65241903509778e63bebf00107524f858d7d48ef9e2c112c75d732344dc0a9bc506172d5a45e3bcb203862307c24c20fe1ffe6b5a43dbc1b20156161b5f59ab9955f2a6fb2469d6cbf857a137b542045d203e43874fe17720a05d3bc42bde811dcf97732108f5cb5943e609856876c2108491e88875ead76331822c8f0151a1cf06e634ac0933487716484f30f17d8f29af19784814192b4677759b781fc1a6726b154bbf3f30c48f0b829397acb9b337a6929d1158492e49bfe9a1158a57b6a422c8d1a3c476487a736a74d01bf48e05ac030092c66a502a8a5c9ef0a29582b6fef6d0dcd6a3a277887134f98291d79a2ed48adb3086b7c1c7340e0998036686b1919d25c3aa9591f4135fdad46003d76b366b81e50fdefeecf3b5d17e946059e2883ca43d61e14e725f0acaff73e0922319b6ea7b09b7b9ea691f5598f014f362e033ba9bc2a64f1c2ed591ef9c6f1a7a08e8e2842c0a592dd82d72e141db440000000000000000"], &(0x7f0000000140)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0xfffffffffffffe89}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r2, 0x0, 0xe, 0x0, &(0x7f0000000040)="2b1c52ac82e71ea05b0c5e43ede4", 0x0, 0xb20c, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000070000040900010073797a30000000009c000000090a010400000000000000000700000308000a40000000000900020073797a30000000000900010073797a3000000000080005400000000d58001280200001800e000100636f6e6e6c696d69740000000c0002800800014000000008200001800e000100636f6e6e6c696d69740000000c00028008000140000000001400017b090001006cdbf80789f3f947dd000280080003"], 0xe4}, 0x1, 0x0, 0x0, 0x8001}, 0x20050840) (async) sendmsg$kcm(r1, &(0x7f0000000000)={0x0, 0xd18c9b25, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f030041000b05d25a806c8c6394f90324fc60100000000a000200053582c137153e3704020180fc5409000c00", 0x33fe0}], 0x1}, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x1, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r4) (async) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000440)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r6, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0xae0, 0x6361, 0x5, 0xffffffff, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) (async) sendmsg$nl_route_sched(r5, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000004c0)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd28, 0x25dfdc01, {0x0, 0x0, 0x0, r6, {}, {0xffff, 0xb}, {0x4, 0x8}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x1ff, 0x9}}]}}]}, 0x48}, 0x1, 0x0, 0x0, 0x240408a0}, 0x0) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) (async) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$tipc(&(0x7f0000000380), r7) sendmsg$TIPC_CMD_ENABLE_BEARER(r7, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r8, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}, 0x1, 0x0, 0x0, 0x44081}, 0x0) (async) sendmsg$nl_route_sched(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f00000000c0)=@newtaction={0x70, 0x30, 0x871a15abc695fa3d, 0x0, 0x0, {}, [{0x5c, 0x1, [@m_ctinfo={0x58, 0x1, 0x0, 0x0, {{0xb}, {0x2c, 0x2, 0x0, 0x1, [@TCA_CTINFO_PARMS_DSCP_MASK={0x8, 0x5, 0x3f00}, @TCA_CTINFO_ACT={0x18, 0x3, {0xfa, 0x1, 0xffffffffffffffff, 0x100}}, @TCA_CTINFO_ZONE={0x6, 0x4, 0x6}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x70}, 0x1, 0x0, 0x0, 0x200488c0}, 0x0) 2.833687ms ago: executing program 1 (id=3203): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=@base={0x9, 0x4, 0x7fe2, 0x1}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000002c40)={0xa, 0x17, &(0x7f0000000600)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000005000000bf090000000000009709010000000281650000000000000018010000646c6c2500000000002020207b9af8ff000000002e9100000000000037010000f8ffffffb702000008000000b70300000000000014000000060000805f93000000000000b5030000000000008500000076000000b70000000000000095"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x33, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = socket$nl_generic(0x10, 0x3, 0x10) bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f00000003c0)={&(0x7f0000000180)="00ed093d3bd84af8f3721101f92b55832e9003345c428363d95631f2017272d47db08c89d4fda204ad7501032ba677afe88a5f206c75f3c37cd55d453d237d59e1456381f779535a8380ba74bcf1e1e8850ca34b7010fc65e1c45b52fe6e8e824bd88edd96cd4ade73a4d1709e38d328cb50907d7cb73eb3a4568dcc51aca3966a333c5e743dad925aafbbbc36f88ab26e663f1bd1a5ffce8a179c2346345e8b96bb8261260d6509389cd00a66d4c953a1266f0ef43a8d4be90251ff47a9fb4b6b945fb7f71ea4574954b0d77bd4", &(0x7f0000000280)=""/84, &(0x7f0000000300), &(0x7f0000000340)="2f0e90c5c69a581922be01286bf5a4787f85a115160f55b954315cf9bd8b7e018aeaade7fa05014a91e9e7123f6a0fa94fc19cd8b7a52525ba33523e93da3f0737ac81f90b170d7b86cea49e82fe2d896789fbbf378b035e75f22bfec25c55ee5620e0294950f2be4b6ec34ef6b2a9dd2e6ccca6596b2fb924", 0x401, r0, 0x4}, 0x38) sendmsg$nl_generic(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000700)={0x1c, 0x2e, 0x9, 0x70bd27, 0x0, {0x4}, [@typed={0x8, 0x17, 0x0, 0x0, @u32=0x4}]}, 0x1c}, 0x1, 0x0, 0x0, 0x42804}, 0x0) 0s ago: executing program 2 (id=3204): r0 = socket$vsock_stream(0x28, 0x1, 0x0) bind$vsock_stream(r0, &(0x7f00000001c0)={0x28, 0x0, 0x2710, @host}, 0x10) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000340)=@newtaction={0x44, 0x32, 0xffffffffffffffff, 0x0, 0x0, {}, [{0x30, 0x1, [@m_bpf={0x2c, 0x1, 0x0, 0x0, {{0x8}, {0x4}, {0x4}, {0xc}, {0xc}}}]}]}, 0x44}}, 0x0) r1 = socket$inet_sctp(0x2, 0x5, 0x84) bind$inet(r1, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) sendto$inet(r1, &(0x7f0000000280)="ab", 0x1, 0x0, &(0x7f0000000380)={0x2, 0x4e22, @local}, 0x10) sendmsg$inet_sctp(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000080)='S', 0x34000}], 0x1, &(0x7f0000000140)=[@sndinfo={0x20, 0x84, 0x2, {0x4, 0x41, 0xffffff7f, 0xffffffff}}], 0x20, 0x2}, 0x80) sendmsg$NL802154_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000340)=ANY=[@ANYBLOB='@\x00\x00\x00', @ANYRES16, @ANYBLOB="01002bbd7000fedbdf25070000000a0004007770616e3000000008000100010000000800050000000000080003"], 0x40}}, 0x8084) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=@base={0xa, 0x3, 0x4, 0x8, 0x88}, 0x50) close(r2) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0xe, 0x4, 0x8, 0x7}, 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1, 0xd, &(0x7f0000000300)=ANY=[@ANYBLOB="18000000000000000000000000000000850000002f00000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r3, 0x0, 0xe, 0x0, &(0x7f00000008c0)="7a7fa22c2aff88df53ef2a2d280f", 0x0, 0xa00, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) r4 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(r5, 0x29, 0x2, &(0x7f0000000000)=0x7, 0x4) setsockopt$inet6_int(r5, 0x29, 0x8, &(0x7f00000000c0)=0xf2b, 0x4) getsockopt$inet6_buf(r5, 0x29, 0x6, &(0x7f0000000140)=""/10, &(0x7f0000000080)=0xa) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001680)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x40001}, 0x4040850) sendmsg$NFT_BATCH(r6, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x7}}, [@NFT_MSG_NEWCHAIN={0x50, 0x3, 0xa, 0x76a9bba1a690db0f, 0x0, 0x0, {0xa, 0x0, 0x6}, [@NFTA_CHAIN_ID={0x8, 0xb, 0x1, 0x0, 0x2}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_CHAIN_HOOK={0x28, 0x4, 0x0, 0x1, [@NFTA_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x767bd2c3}, @NFTA_HOOK_HOOKNUM={0x8, 0x1, 0x1, 0x0, 0x2}, @NFTA_HOOK_DEV={0x14, 0x3, 'veth0_macvtap\x00'}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x5}}}, 0x78}, 0x1, 0x0, 0x0, 0x4000850}, 0x24000840) r7 = socket(0x10, 0x803, 0x0) sendto(r7, &(0x7f00000000c0)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r7, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x365}, {&(0x7f0000000280)=""/85, 0x14c}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000400)=""/106, 0x645}, {&(0x7f0000000980)=""/73, 0x1b}, {&(0x7f0000000200)=""/77, 0x188}, {&(0x7f00000007c0)=""/154, 0x8}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0x41}}], 0x4000000000003b4, 0x0, &(0x7f0000003700)={0x77359400}) sendmsg$netlink(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000340)=ANY=[@ANYBLOB="180100002000010000000000fcdbdf2506"], 0x118}], 0x1, 0x0, 0x0, 0x20008001}, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000080)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x28, 0x28, 0x6, [@var={0x4, 0x0, 0x0, 0xe, 0x3}, @func={0x1, 0x0, 0x0, 0x12}, @ptr={0x0, 0x0, 0x0, 0x2, 0x2}]}, {0x0, [0x2e, 0x0, 0x0, 0x61]}}, 0x0, 0x46}, 0x28) kernel console output (not intermixed with test programs): arsing attributes in process `syz.4.2063'. [ 316.417551][ T3374] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 316.448244][ T3374] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 316.498160][T13539] bridge9: entered allmulticast mode [ 316.726539][T13552] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2076'. [ 316.991298][T13561] netlink: 'syz.1.2079': attribute type 1 has an invalid length. [ 317.106757][T13567] netlink: 212368 bytes leftover after parsing attributes in process `syz.0.2081'. [ 317.124268][T13565] bond6: (slave dummy0): making interface the new active one [ 317.133817][T13565] bond6: (slave dummy0): Enslaving as an active interface with an up link [ 317.158144][T13561] bond6: entered promiscuous mode [ 317.163886][T13561] dummy0: entered promiscuous mode [ 317.240597][ T1315] ieee802154 phy0 wpan0: encryption failed: -22 [ 317.516795][T13561] bond6: (slave dummy0): Releasing active interface [ 317.528667][T13561] dummy0: left promiscuous mode [ 317.554501][T13583] ieee802154 phy0 wpan0: encryption failed: -22 [ 317.878814][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 318.048224][T13561] team0: Port device geneve1 removed [ 318.140680][T13561] bond2: (slave bridge2): Releasing backup interface [ 318.516888][T13561] bond4: (slave bridge8): Releasing backup interface [ 318.538700][T13561] erspan0: left allmulticast mode [ 318.679132][T13560] bond6: left promiscuous mode [ 318.693123][ T12] netdevsim netdevsim1 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 318.719812][ T12] netdevsim netdevsim1 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 318.761295][ T12] netdevsim netdevsim1 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 318.801176][ T12] netdevsim netdevsim1 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 318.841676][ T12] netdevsim netdevsim1 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 318.888846][ T12] netdevsim netdevsim1 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 318.922720][ T3374] wlan1: Trigger new scan to find an IBSS to join [ 318.932467][ T12] netdevsim netdevsim1 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 318.977610][ T12] netdevsim netdevsim1 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 319.041189][T13592] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2089'. [ 319.285894][T13620] openvswitch: netlink: IPv4 tun info is not correct [ 319.386367][T13626] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2099'. [ 319.514368][T13634] SET target dimension over the limit! [ 319.621794][T13644] netlink: 7064 bytes leftover after parsing attributes in process `syz.3.2102'. [ 319.657271][T13644] openvswitch: netlink: Missing key (keys=40, expected=2000) [ 319.694232][T13644] netlink: 7064 bytes leftover after parsing attributes in process `syz.3.2102'. [ 319.736739][T13644] openvswitch: netlink: Missing key (keys=40, expected=2000) [ 319.822221][T13651] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2103'. [ 320.136450][T13670] mac80211_hwsim hwsim10 syzkaller0: entered promiscuous mode [ 320.171298][T13670] mac80211_hwsim hwsim10 syzkaller0: entered allmulticast mode [ 320.362679][T13688] netlink: 260 bytes leftover after parsing attributes in process `syz.2.2110'. [ 320.414416][T13690] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2112'. [ 320.669294][T13693] netlink: 'syz.1.2113': attribute type 4 has an invalid length. [ 320.686026][T13698] syzkaller0: entered promiscuous mode [ 320.704328][T13698] syzkaller0: entered allmulticast mode [ 320.803029][T13714] openvswitch: netlink: VXLAN extension message has 12 unknown bytes. [ 320.959569][T13708] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2116'. [ 321.603143][T13766] netlink: 'syz.3.2128': attribute type 1 has an invalid length. [ 321.689052][T13755] can: request_module (can-proto-0) failed. [ 321.826659][T13766] 8021q: adding VLAN 0 to HW filter on device bond6 [ 321.958984][ T3374] wlan1: Trigger new scan to find an IBSS to join [ 322.175680][T13794] netlink: 'syz.1.2131': attribute type 11 has an invalid length. [ 322.214555][T13794] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2131'. [ 322.494980][T13820] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2138'. [ 322.752410][T13835] 8021q: adding VLAN 0 to HW filter on device bond7 [ 322.804639][T13841] bond7: (slave veth11): Enslaving as an active interface with an up link [ 322.827980][T13835] lo: Caught tx_queue_len zero misconfig [ 322.865951][T13835] 8021q: adding VLAN 0 to HW filter on device batadv1 [ 322.875404][T13835] bond7: (slave batadv1): Enslaving as an active interface with an up link [ 323.319048][T13867] ip6gre2: entered promiscuous mode [ 323.330529][T13867] ip6gre2: entered allmulticast mode [ 323.700268][T13880] ipip0: entered promiscuous mode [ 323.705562][T13880] ipip0: entered allmulticast mode [ 323.867004][T13888] openvswitch: netlink: Tunnel attr 4104 out of range max 16 [ 323.884121][T13888] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 323.929479][T13888] netlink: 'syz.4.2163': attribute type 49 has an invalid length. [ 324.401748][T13917] xt_CT: You must specify a L4 protocol and not use inversions on it [ 324.440387][T13917] xfrm0 speed is unknown, defaulting to 1000 [ 324.468724][T13921] __nla_validate_parse: 11 callbacks suppressed [ 324.468739][T13921] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2170'. [ 324.592985][T13917] lo speed is unknown, defaulting to 1000 [ 324.723424][T13925] netlink: 220 bytes leftover after parsing attributes in process `syz.2.2172'. [ 324.759461][T13927] netlink: 260 bytes leftover after parsing attributes in process `syz.4.2173'. [ 324.834638][T13931] netlink: 'syz.1.2174': attribute type 1 has an invalid length. [ 324.857655][T13931] netlink: 'syz.1.2174': attribute type 2 has an invalid length. [ 324.922424][ T36] wlan1: Trigger new scan to find an IBSS to join [ 325.114409][T13944] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2179'. [ 325.242295][T13950] netlink: 'syz.4.2182': attribute type 1 has an invalid length. [ 325.267085][T13948] batadv0: Caught tx_queue_len zero misconfig [ 325.277330][T13950] openvswitch: netlink: Actions may not be safe on all matching packets [ 325.533835][T13962] xfrm0 speed is unknown, defaulting to 1000 [ 325.568328][T13968] dvmrp0: entered allmulticast mode [ 325.634657][T13970] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 325.778677][T13962] lo speed is unknown, defaulting to 1000 [ 325.941015][T13974] xfrm0: entered allmulticast mode [ 325.946498][T13974] A link change request failed with some changes committed already. Interface xfrm0 may have been left with an inconsistent configuration, please check. [ 325.947231][T13979] netlink: 'syz.4.2188': attribute type 89 has an invalid length. [ 325.977161][T13976] gtp0: entered promiscuous mode [ 325.983012][T13976] gtp0: entered allmulticast mode [ 326.111028][ T7308] hid-generic 0005:0C45:0008.0001: item fetching failed at offset 2/3 [ 326.125987][ T7308] hid-generic 0005:0C45:0008.0001: probe with driver hid-generic failed with error -22 [ 326.251836][T13986] netlink: 32 bytes leftover after parsing attributes in process `syz.4.2191'. [ 326.565669][T13996] netlink: 'syz.0.2196': attribute type 2 has an invalid length. [ 326.666095][T14000] netlink: 2 bytes leftover after parsing attributes in process `syz.0.2197'. [ 326.688184][T14000] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2197'. [ 326.780228][T14000] bond8: option ad_actor_sys_prio: mode dependency failed, not supported in mode broadcast(3) [ 326.780251][T14007] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2200'. [ 326.780271][T14007] nbd: must specify a size in bytes for the device [ 326.809932][T14000] bond8 (unregistering): Released all slaves [ 326.858149][T14003] syzkaller0: entered promiscuous mode [ 326.864373][T14003] syzkaller0: entered allmulticast mode [ 326.993439][T14018] netlink: 'syz.0.2202': attribute type 1 has an invalid length. [ 327.134017][T14023] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2204'. [ 327.232282][T14027] netlink: 200 bytes leftover after parsing attributes in process `syz.2.2206'. [ 327.361584][ T30] audit: type=1800 audit(1781645312.407:2): pid=14035 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.2209" name="memory.events" dev="tmpfs" ino=2280 res=0 errno=0 [ 327.643415][T14051] syzkaller0: refused to change device tx_queue_len [ 327.892068][T14060] ip6tnl2: entered allmulticast mode [ 327.921878][T14060] netlink: 'syz.3.2216': attribute type 11 has an invalid length. [ 327.930691][T14064] veth0_to_hsr: Caught tx_queue_len zero misconfig [ 328.375464][T14092] netlink: 'syz.1.2227': attribute type 1 has an invalid length. [ 328.526143][T14092] 8021q: adding VLAN 0 to HW filter on device bond7 [ 328.666793][T14110] netlink: 'syz.1.2232': attribute type 3 has an invalid length. [ 329.190878][T14125] netlink: 'syz.3.2238': attribute type 1 has an invalid length. [ 329.493488][T14134] geneve1: entered allmulticast mode [ 329.524261][T14136] __nla_validate_parse: 13 callbacks suppressed [ 329.524283][T14136] netlink: 148 bytes leftover after parsing attributes in process `syz.4.2240'. [ 329.601059][T14138] bond0: option active_slave: mode dependency failed, not supported in mode balance-rr(0) [ 329.632679][T14138] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2243'. [ 329.652993][T14138] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2243'. [ 329.676899][T14138] netlink: 32 bytes leftover after parsing attributes in process `syz.1.2243'. [ 329.691025][T14141] netlink: 'syz.4.2244': attribute type 1 has an invalid length. [ 329.790656][T14144] bond8: (slave ip6gretap2): Enslaving as a backup interface with an up link [ 329.894735][T14150] xt_hashlimit: size too large, truncated to 1048576 [ 329.905064][T14150] xt_hashlimit: max too large, truncated to 1048576 [ 329.916378][ T57] netdevsim netdevsim1 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 329.936015][ T57] netdevsim netdevsim1 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 329.945394][ T57] netdevsim netdevsim1 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 329.955821][T14148] syzkaller0: entered promiscuous mode [ 329.988833][T14148] syzkaller0: entered allmulticast mode [ 329.997134][ T57] netdevsim netdevsim1 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 330.074277][T14147] tipc: Enabling of bearer rejected, max 3 bearers permitted [ 330.100946][T14155] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2249'. [ 330.152738][T14155] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2249'. [ 330.327661][T14169] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2254'. [ 330.581398][T14177] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2255'. [ 330.979186][T14188] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 331.088867][T14190] netlink: 'syz.2.2258': attribute type 1 has an invalid length. [ 331.119052][T14190] netlink: 'syz.2.2258': attribute type 2 has an invalid length. [ 331.134791][T14190] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2258'. [ 331.242412][T14197] netlink: 'syz.3.2260': attribute type 3 has an invalid length. [ 331.469173][T14203] syzkaller0: entered promiscuous mode [ 331.482282][T14203] syzkaller0: entered allmulticast mode [ 331.514765][T14203] tipc: Started in network mode [ 331.525105][T14203] tipc: Node identity f2b3ed29a137, cluster identity 4711 [ 331.552969][T14203] tipc: Enabled bearer , priority 0 [ 331.568735][T14208] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2262'. [ 331.640247][T14202] tipc: Resetting bearer [ 331.718192][T14202] tipc: Disabling bearer [ 332.185144][T14232] bridge0: port 3(vxlan0) entered blocking state [ 332.200888][T14232] bridge0: port 3(vxlan0) entered disabled state [ 332.221053][T14232] vxlan0: entered allmulticast mode [ 332.247899][T14232] vxlan0: entered promiscuous mode [ 332.450682][T14246] 8021q: adding VLAN 0 to HW filter on device bond9 [ 332.763835][T14259] batman_adv: batadv0: Adding interface: vlan6 [ 332.784587][T14259] batman_adv: batadv0: The MTU of interface vlan6 is too small (1450) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 332.838213][T14259] batman_adv: batadv0: Not using interface vlan6 (retrying later): interface not active [ 332.852062][T14260] netdevsim netdevsim1 netdevsim0: entered promiscuous mode [ 332.863609][T14260] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 333.136264][T14271] can: request_module (can-proto-0) failed. [ 333.194345][T14273] syzkaller1: entered promiscuous mode [ 333.209703][T14273] syzkaller1: entered allmulticast mode [ 333.517695][T14297] FAULT_INJECTION: forcing a failure. [ 333.517695][T14297] name failslab, interval 1, probability 0, space 0, times 0 [ 333.555839][T14297] CPU: 1 UID: 0 PID: 14297 Comm: syz.1.2295 Not tainted syzkaller #0 PREEMPT(full) [ 333.555866][T14297] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 333.555876][T14297] Call Trace: [ 333.555883][T14297] [ 333.555899][T14297] dump_stack_lvl+0xe8/0x150 [ 333.555926][T14297] should_fail_ex+0x40c/0x560 [ 333.555984][T14297] should_failslab+0xa8/0x100 [ 333.556003][T14297] ? alloc_empty_file+0x5b/0x1d0 [ 333.556024][T14297] kmem_cache_alloc_noprof+0x87/0x650 [ 333.556068][T14297] alloc_empty_file+0x5b/0x1d0 [ 333.556090][T14297] alloc_file_pseudo+0x155/0x240 [ 333.556129][T14297] ? __pfx_alloc_file_pseudo+0x10/0x10 [ 333.556189][T14297] ? security_inode_alloc+0xd5/0x310 [ 333.556215][T14297] ? inode_init_always_gfp+0x994/0xd30 [ 333.556240][T14297] sock_alloc_file+0xb8/0x2e0 [ 333.556266][T14297] do_accept+0x3a0/0x750 [ 333.556295][T14297] ? __pfx_do_accept+0x10/0x10 [ 333.556343][T14297] __sys_accept4+0x139/0x230 [ 333.556370][T14297] ? __pfx___sys_accept4+0x10/0x10 [ 333.556395][T14297] ? __pfx_ksys_write+0x10/0x10 [ 333.556426][T14297] __x64_sys_accept4+0x9a/0xb0 [ 333.556450][T14297] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 333.556469][T14297] do_syscall_64+0x174/0x580 [ 333.556489][T14297] ? trace_irq_disable+0x3b/0x140 [ 333.556513][T14297] ? clear_bhb_loop+0x40/0x90 [ 333.556536][T14297] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 333.556552][T14297] RIP: 0033:0x7f5bff99ce59 [ 333.556587][T14297] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 333.556605][T14297] RSP: 002b:00007f5c0085a028 EFLAGS: 00000246 ORIG_RAX: 0000000000000120 [ 333.556623][T14297] RAX: ffffffffffffffda RBX: 00007f5bffc15fa0 RCX: 00007f5bff99ce59 [ 333.556636][T14297] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003 [ 333.556645][T14297] RBP: 00007f5c0085a090 R08: 0000000000000000 R09: 0000000000000000 [ 333.556664][T14297] R10: 0000000000080000 R11: 0000000000000246 R12: 0000000000000001 [ 333.556675][T14297] R13: 00007f5bffc16038 R14: 00007f5bffc15fa0 R15: 00007ffd07f42158 [ 333.556702][T14297] [ 333.889316][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 333.919004][T14311] netlink: 'syz.3.2301': attribute type 58 has an invalid length. [ 334.356595][T14335] netlink: 'syz.4.2310': attribute type 89 has an invalid length. [ 334.378097][T14336] tipc: Enabling of bearer rejected, failed to enable media [ 334.419483][T14336] netlink: 'syz.0.2309': attribute type 30 has an invalid length. [ 334.427986][T14332] netlink: 'syz.1.2308': attribute type 1 has an invalid length. [ 334.433732][T14338] veth14: entered allmulticast mode [ 334.471422][T14341] netlink: 'syz.0.2309': attribute type 30 has an invalid length. [ 334.589126][ T36] netdevsim netdevsim0 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 334.602793][ T36] netdevsim netdevsim0 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 334.631022][ T36] netdevsim netdevsim0 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 334.685510][T14349] FAULT_INJECTION: forcing a failure. [ 334.685510][T14349] name failslab, interval 1, probability 0, space 0, times 0 [ 334.737306][T14349] CPU: 0 UID: 0 PID: 14349 Comm: syz.3.2313 Not tainted syzkaller #0 PREEMPT(full) [ 334.737332][T14349] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 334.737341][T14349] Call Trace: [ 334.737348][T14349] [ 334.737356][T14349] dump_stack_lvl+0xe8/0x150 [ 334.737382][T14349] should_fail_ex+0x40c/0x560 [ 334.737412][T14349] should_failslab+0xa8/0x100 [ 334.737429][T14349] ? security_file_alloc+0x34/0x310 [ 334.737449][T14349] kmem_cache_alloc_noprof+0x87/0x650 [ 334.737470][T14349] ? rcu_is_watching+0x15/0xb0 [ 334.737491][T14349] ? trace_kmem_cache_alloc+0x29/0xe0 [ 334.737514][T14349] security_file_alloc+0x34/0x310 [ 334.737535][T14349] init_file+0x90/0x2b0 [ 334.737556][T14349] alloc_empty_file+0x74/0x1d0 [ 334.737573][T14349] alloc_file_pseudo+0x155/0x240 [ 334.737595][T14349] ? __pfx_alloc_file_pseudo+0x10/0x10 [ 334.737614][T14349] ? security_inode_alloc+0xd5/0x310 [ 334.737639][T14349] ? inode_init_always_gfp+0x994/0xd30 [ 334.737661][T14349] sock_alloc_file+0xb8/0x2e0 [ 334.737684][T14349] do_accept+0x3a0/0x750 [ 334.737713][T14349] ? __pfx_do_accept+0x10/0x10 [ 334.737758][T14349] __sys_accept4+0x139/0x230 [ 334.737784][T14349] ? __pfx___sys_accept4+0x10/0x10 [ 334.737807][T14349] ? __pfx_ksys_write+0x10/0x10 [ 334.737839][T14349] __x64_sys_accept4+0x9a/0xb0 [ 334.737863][T14349] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 334.737882][T14349] do_syscall_64+0x174/0x580 [ 334.737900][T14349] ? trace_irq_disable+0x3b/0x140 [ 334.737925][T14349] ? clear_bhb_loop+0x40/0x90 [ 334.737956][T14349] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 334.737974][T14349] RIP: 0033:0x7f309cb9ce59 [ 334.737998][T14349] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 334.738013][T14349] RSP: 002b:00007f309da88028 EFLAGS: 00000246 ORIG_RAX: 0000000000000120 [ 334.738031][T14349] RAX: ffffffffffffffda RBX: 00007f309ce15fa0 RCX: 00007f309cb9ce59 [ 334.738044][T14349] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003 [ 334.738054][T14349] RBP: 00007f309da88090 R08: 0000000000000000 R09: 0000000000000000 [ 334.738064][T14349] R10: 0000000000080000 R11: 0000000000000246 R12: 0000000000000001 [ 334.738074][T14349] R13: 00007f309ce16038 R14: 00007f309ce15fa0 R15: 00007fff20031f28 [ 334.738104][T14349] [ 335.073046][T14360] __nla_validate_parse: 20 callbacks suppressed [ 335.073066][T14360] netlink: 32 bytes leftover after parsing attributes in process `syz.1.2316'. [ 335.107866][T14361] netlink: 'syz.2.2317': attribute type 3 has an invalid length. [ 335.281134][T14365] ip6tnl0: entered promiscuous mode [ 335.286605][T14365] ip6tnl0: entered allmulticast mode [ 335.406329][T14373] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2320'. [ 335.805841][T14384] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2324'. [ 335.925567][T14387] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2326'. [ 335.959318][ T7554] wlan1: Trigger new scan to find an IBSS to join [ 335.980467][T14393] netlink: 32 bytes leftover after parsing attributes in process `syz.0.2328'. [ 336.021908][T14387] hmac(sha2: entered promiscuous mode [ 336.114919][T14396] x_tables: duplicate underflow at hook 1 [ 336.136093][T14397] x_tables: duplicate underflow at hook 1 [ 336.402349][T14406] netlink: 'syz.1.2332': attribute type 3 has an invalid length. [ 337.229741][T14437] netlink: 32 bytes leftover after parsing attributes in process `syz.0.2339'. [ 337.244254][ T5637] Bluetooth: hci4: link tx timeout [ 337.253056][ T5637] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 337.353031][T14446] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2342'. [ 337.563115][T14453] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2346'. [ 338.047378][T14483] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2350'. [ 338.373601][T14501] netlink: 44 bytes leftover after parsing attributes in process `syz.4.2356'. [ 338.387867][T14501] x_tables: ip6_tables: mh match: only valid for protocol 135 [ 338.843273][T14513] 8021q: adding VLAN 0 to HW filter on device team0 [ 338.893187][T14522] xt_CT: No such helper "snmp_trap" [ 338.999454][ T36] wlan1: Trigger new scan to find an IBSS to join [ 339.247482][T14513] veth1_vlan: left promiscuous mode [ 339.254928][T14513] veth0_vlan: left promiscuous mode [ 339.269885][T14513] veth0_vlan: entered promiscuous mode [ 339.280729][T14513] veth1_vlan: entered promiscuous mode [ 339.292631][T14513] veth1_macvtap: left promiscuous mode [ 339.300658][T14513] veth0_macvtap: left promiscuous mode [ 339.307930][T14513] veth0_macvtap: entered promiscuous mode [ 339.316356][T14513] veth1_macvtap: entered promiscuous mode [ 339.323273][ T5637] Bluetooth: hci4: command 0x0405 tx timeout [ 339.352309][T14513] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 339.363326][T14513] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 339.373006][T14513] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 339.383570][T14513] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 339.397382][T14513] mac80211_hwsim hwsim10 syzkaller0: left promiscuous mode [ 339.405445][T14513] mac80211_hwsim hwsim10 syzkaller0: left allmulticast mode [ 339.413337][T14513] A link change request failed with some changes committed already. Interface syzkaller0 may have been left with an inconsistent configuration, please check. [ 339.430059][ T5614] lo speed is unknown, defaulting to 1000 [ 339.436537][ T5614] syz2: Port: 1 Link ACTIVE [ 339.566772][ T137] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 339.620621][ T137] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 339.671223][ T137] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 339.731700][ T137] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 339.843689][T14558] tipc: New replicast peer: 255.255.255.255 [ 339.895352][T14558] tipc: Enabled bearer , priority 10 [ 340.207649][T14571] __nla_validate_parse: 3 callbacks suppressed [ 340.207669][T14571] netlink: 28 bytes leftover after parsing attributes in process `syz.3.2372'. [ 340.392475][T14579] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2374'. [ 340.449108][T14581] netlink: 56 bytes leftover after parsing attributes in process `syz.1.2375'. [ 340.941539][T14601] netlink: 20 bytes leftover after parsing attributes in process `syz.4.2383'. [ 340.998978][T13589] tipc: Node number set to 1401220393 [ 341.150054][T14611] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 341.194487][T14611] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2384'. [ 341.214278][T14611] netlink: 'syz.2.2384': attribute type 2 has an invalid length. [ 341.414921][T14622] netlink: 20 bytes leftover after parsing attributes in process `syz.4.2389'. [ 341.463533][T14622] tunl0: Caught tx_queue_len zero misconfig [ 341.487814][T14622] netlink: 204 bytes leftover after parsing attributes in process `syz.4.2389'. [ 341.523692][T14622] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2389'. [ 341.565007][T14627] netlink: 28 bytes leftover after parsing attributes in process `syz.0.2390'. [ 341.772195][T14634] batman_adv: batadv0: Interface deactivated: dummy0 [ 341.893802][T14634] batman_adv: batadv0: Interface deactivated: macsec2 [ 341.959317][ T36] wlan1: Trigger new scan to find an IBSS to join [ 341.994934][T14650] netlink: 'syz.4.2397': attribute type 21 has an invalid length. [ 342.068048][T14653] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2399'. [ 342.087998][T14652] netlink: 'syz.2.2399': attribute type 7 has an invalid length. [ 342.096492][T14652] netlink: 'syz.2.2399': attribute type 8 has an invalid length. [ 342.105981][T14653] netlink: 'syz.2.2399': attribute type 7 has an invalid length. [ 342.115777][T14653] netlink: 'syz.2.2399': attribute type 8 has an invalid length. [ 342.129800][T14657] xt_hashlimit: size too large, truncated to 1048576 [ 342.398015][T14652] veth1: entered promiscuous mode [ 342.435955][T14652] veth1: left promiscuous mode [ 342.487193][T14653] veth1: entered promiscuous mode [ 342.497279][T14653] veth1: left promiscuous mode [ 342.537427][ T7563] netdevsim netdevsim0 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 342.551381][T14671] TCP: TCP_TX_DELAY enabled [ 342.562482][T14674] FAULT_INJECTION: forcing a failure. [ 342.562482][T14674] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 342.577544][ T7563] netdevsim netdevsim0 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 342.587715][T14647] xfrm0 speed is unknown, defaulting to 1000 [ 342.595692][ T7563] netdevsim netdevsim0 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 342.607834][T14674] CPU: 0 UID: 0 PID: 14674 Comm: syz.0.2403 Not tainted syzkaller #0 PREEMPT(full) [ 342.607859][T14674] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 342.607916][T14674] Call Trace: [ 342.607924][T14674] [ 342.607932][T14674] dump_stack_lvl+0xe8/0x150 [ 342.607959][T14674] should_fail_ex+0x40c/0x560 [ 342.607989][T14674] _copy_to_user+0x31/0xb0 [ 342.608012][T14674] simple_read_from_buffer+0xe1/0x170 [ 342.608037][T14674] proc_fail_nth_read+0x1bb/0x230 [ 342.608062][T14674] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 342.608086][T14674] ? rw_verify_area+0x24a/0x4c0 [ 342.608111][T14674] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 342.608132][T14674] vfs_read+0x213/0xa80 [ 342.608160][T14674] ? __pfx___mutex_lock+0x10/0x10 [ 342.608182][T14674] ? __pfx_vfs_read+0x10/0x10 [ 342.608216][T14674] ? __fget_files+0x2a/0x420 [ 342.608241][T14674] ? __fget_files+0x3a2/0x420 [ 342.608261][T14674] ? __fget_files+0x2a/0x420 [ 342.608290][T14674] ksys_read+0x150/0x270 [ 342.608317][T14674] ? __pfx_ksys_read+0x10/0x10 [ 342.608351][T14674] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 342.608368][T14674] do_syscall_64+0x174/0x580 [ 342.608385][T14674] ? trace_irq_disable+0x3b/0x140 [ 342.608408][T14674] ? clear_bhb_loop+0x40/0x90 [ 342.608429][T14674] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 342.608445][T14674] RIP: 0033:0x7fe7c8d5d68e [ 342.608461][T14674] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 342.608475][T14674] RSP: 002b:00007fe7c9be9fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 342.608493][T14674] RAX: ffffffffffffffda RBX: 00007fe7c9bea6c0 RCX: 00007fe7c8d5d68e [ 342.608505][T14674] RDX: 000000000000000f RSI: 00007fe7c9bea0a0 RDI: 0000000000000004 [ 342.608516][T14674] RBP: 00007fe7c9bea090 R08: 0000000000000000 R09: 0000000000000000 [ 342.608524][T14674] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 342.608534][T14674] R13: 00007fe7c9016038 R14: 00007fe7c9015fa0 R15: 00007ffcba442be8 [ 342.608563][T14674] [ 342.963465][ T1107] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 343.261217][T14647] lo speed is unknown, defaulting to 1000 [ 344.536711][T14737] macvlan1: entered promiscuous mode [ 344.552139][T14737] macvlan1: entered allmulticast mode [ 344.562180][T14737] veth1_vlan: entered allmulticast mode [ 344.581499][T14750] openvswitch: netlink: Key type 769 is out of range max 32 [ 345.025942][T14767] x_tables: duplicate underflow at hook 2 [ 345.193279][T14774] netlink: 'syz.0.2423': attribute type 1 has an invalid length. [ 345.382451][T14748] bridge0: port 2(bridge_slave_1) entered disabled state [ 345.390045][T14748] bridge0: port 1(bridge_slave_0) entered disabled state [ 346.206218][T14748] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 346.266583][T14748] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 347.412299][T14767] team_slave_1: Caught tx_queue_len zero misconfig [ 347.541271][T14774] bond8: entered promiscuous mode [ 347.556148][T14774] 8021q: adding VLAN 0 to HW filter on device bond8 [ 347.570372][T14813] __nla_validate_parse: 7 callbacks suppressed [ 347.570391][T14813] netlink: 24 bytes leftover after parsing attributes in process `syz.4.2426'. [ 347.604883][T14779] bond8: (slave bridge3): making interface the new active one [ 347.613818][T14779] bridge3: entered promiscuous mode [ 347.626926][T14779] bond8: (slave bridge3): Enslaving as an active interface with an up link [ 347.667047][ T12] netdevsim netdevsim3 netdevsim0: unset [0, 0] type 1 family 0 port 2816 - 0 [ 347.686971][ T12] netdevsim netdevsim3 netdevsim0: unset [0, 1] type 1 family 0 port 8472 - 0 [ 347.709897][ T12] netdevsim netdevsim3 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 347.788503][ T12] netdevsim netdevsim3 netdevsim1: unset [0, 0] type 1 family 0 port 2816 - 0 [ 347.812543][ T12] netdevsim netdevsim3 netdevsim1: unset [0, 1] type 1 family 0 port 8472 - 0 [ 347.830445][ T12] netdevsim netdevsim3 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 347.853429][ T12] netdevsim netdevsim3 netdevsim2: unset [0, 0] type 1 family 0 port 2816 - 0 [ 347.870805][T14781] netlink: 840 bytes leftover after parsing attributes in process `syz.0.2423'. [ 347.886184][ T12] netdevsim netdevsim3 netdevsim2: unset [0, 1] type 1 family 0 port 8472 - 0 [ 347.920819][ T12] netdevsim netdevsim3 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 347.953496][ T12] netdevsim netdevsim3 netdevsim3: unset [0, 0] type 1 family 0 port 2816 - 0 [ 347.995246][ T12] netdevsim netdevsim3 netdevsim3: unset [0, 1] type 1 family 0 port 8472 - 0 [ 348.041721][ T12] netdevsim netdevsim3 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 348.068417][T14824] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2428'. [ 348.095044][T14826] nbd: must specify a size in bytes for the device [ 348.180578][T14821] bond10: option ad_actor_sys_prio: mode dependency failed, not supported in mode broadcast(3) [ 348.197435][T14821] bond10 (unregistering): Released all slaves [ 348.309762][T14839] netlink: 'syz.3.2434': attribute type 1 has an invalid length. [ 348.413116][T14839] bond7: entered promiscuous mode [ 348.436844][T14839] 8021q: adding VLAN 0 to HW filter on device bond7 [ 348.475134][T14847] bond7: (slave veth15): making interface the new active one [ 348.485031][T14847] veth15: entered promiscuous mode [ 348.491645][T14847] bond7: (slave veth15): Enslaving as an active interface with an up link [ 348.580491][ T4944] block nbd3: Receive control failed (result -32) [ 348.588681][ T5637] block nbd3: Receive control failed (result -32) [ 348.968559][T14869] netlink: 92 bytes leftover after parsing attributes in process `syz.2.2440'. [ 348.983653][T14870] netlink: 'syz.4.2439': attribute type 7 has an invalid length. [ 349.654525][T14901] hsr0: entered promiscuous mode [ 349.689785][T14900] hsr0: left promiscuous mode [ 349.724513][T14906] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2450'. [ 349.827472][T14909] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2451'. [ 349.884320][T14915] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2450'. [ 350.016453][T14920] xt_hashlimit: size too large, truncated to 1048576 [ 350.538520][T14930] nbd4: detected capacity change from 0 to 63 [ 350.568249][T14943] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2458'. [ 350.693470][T14933] A link change request failed with some changes committed already. Interface syzkaller0 may have been left with an inconsistent configuration, please check. [ 350.700486][T14947] netlink: 'syz.2.2458': attribute type 1 has an invalid length. [ 350.766881][T14951] netlink: 'syz.3.2461': attribute type 1 has an invalid length. [ 350.843098][T14943] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2458'. [ 350.859294][ T4944] block nbd4: Receive control failed (result -104) [ 350.875924][T14947] bond7: entered promiscuous mode [ 350.888918][T14947] 8021q: adding VLAN 0 to HW filter on device bond7 [ 350.909759][T14943] bond7: entered allmulticast mode [ 350.926240][T14936] xfrm0 speed is unknown, defaulting to 1000 [ 351.005769][T14943] bond7: (slave bridge8): making interface the new active one [ 351.018114][T14943] bridge8: entered promiscuous mode [ 351.026654][T14943] bridge8: entered allmulticast mode [ 351.034546][T14943] bond7: (slave bridge8): Enslaving as an active interface with an up link [ 351.084735][T14957] netlink: 'syz.3.2463': attribute type 5 has an invalid length. [ 351.246873][T14954] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2462'. [ 351.287905][ T137] netdevsim netdevsim0 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 351.304929][ T137] netdevsim netdevsim0 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 351.324186][ T137] netdevsim netdevsim0 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 351.376019][T14962] veth1_to_bond: entered promiscuous mode [ 351.397705][T14962] veth1_to_bond: entered allmulticast mode [ 351.422679][T14962] veth1_to_bond (unregistering): left promiscuous mode [ 351.433988][T14962] veth1_to_bond (unregistering): left allmulticast mode [ 351.465458][T14962] bond0: (slave bond_slave_1): Releasing backup interface [ 351.484258][T14962] bond_slave_1 (unregistering): left promiscuous mode [ 351.512928][T14936] lo speed is unknown, defaulting to 1000 [ 352.074885][T14975] 8021q: adding VLAN 0 to HW filter on device team0 [ 352.099848][T14975] batman_adv: batadv0: Interface activated: dummy0 [ 352.113891][T14975] batadv0: mtu less than device minimum [ 352.121299][T14975] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 352.133225][T14975] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 352.144874][T14975] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 352.156769][T14975] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 352.168471][T14975] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 352.180081][T14975] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 352.191860][T14975] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 352.203538][T14975] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 352.270290][T14975] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 352.382935][T14975] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 352.405169][T14975] veth0_vlan: left promiscuous mode [ 352.411777][T14975] veth0_vlan: entered promiscuous mode [ 352.426230][T14975] veth1_macvtap: left promiscuous mode [ 352.433806][T14975] veth0_macvtap: left promiscuous mode [ 352.441174][T14975] veth0_macvtap: entered promiscuous mode [ 352.452464][T14975] veth1_macvtap: entered promiscuous mode [ 352.470567][T14975] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 352.479181][T14975] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 352.487558][T14975] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 352.496030][T14975] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 352.701443][ T12] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 352.710971][ T12] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 352.724212][ T12] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 353.140120][T15031] bridge10: entered allmulticast mode [ 353.346732][T15045] __nla_validate_parse: 4 callbacks suppressed [ 353.346751][T15045] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2489'. [ 353.853892][T15067] netlink: 'syz.1.2497': attribute type 268 has an invalid length. [ 353.857056][T15070] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2498'. [ 353.913873][T15073] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2498'. [ 354.023217][T15078] netlink: 'syz.3.2501': attribute type 3 has an invalid length. [ 354.056363][T15078] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2501'. [ 354.094078][T15075] can: request_module (can-proto-0) failed. [ 354.145600][T15085] netlink: 'syz.2.2503': attribute type 2 has an invalid length. [ 354.180796][T15085] netlink: 232 bytes leftover after parsing attributes in process `syz.2.2503'. [ 354.281740][T15088] syzkaller0: entered promiscuous mode [ 354.298262][T15088] syzkaller0: entered allmulticast mode [ 354.659789][T15108] netlink: 'syz.0.2509': attribute type 1 has an invalid length. [ 354.679323][T15108] netlink: 476 bytes leftover after parsing attributes in process `syz.0.2509'. [ 354.706944][T15108] netlink: 1041 bytes leftover after parsing attributes in process `syz.0.2509'. [ 354.803166][T15112] netlink: 92 bytes leftover after parsing attributes in process `syz.2.2511'. [ 355.009815][T15121] netlink: 'syz.2.2515': attribute type 3 has an invalid length. [ 355.033592][T15121] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2515'. [ 355.475509][T15140] RDS: rds_bind could not find a transport for ::ffff:172.20.20.170, load rds_tcp or rds_rdma? [ 355.560860][T15147] netlink: 20 bytes leftover after parsing attributes in process `syz.4.2522'. [ 355.972760][ T7554] net_ratelimit: 26 callbacks suppressed [ 355.972778][ T7554] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 355.994919][ T7554] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 356.257507][T15172] ieee802154 phy0 wpan0: encryption failed: -22 [ 356.318122][T15185] netlink: 'syz.2.2529': attribute type 9 has an invalid length. [ 356.431119][T15187] 8021q: adding VLAN 0 to HW filter on device bond8 [ 356.440590][T15185] netlink: 'syz.2.2529': attribute type 6 has an invalid length. [ 356.449317][T15150] netlink: 'syz.0.2523': attribute type 2 has an invalid length. [ 356.466300][T15185] netlink: 'syz.2.2529': attribute type 7 has an invalid length. [ 356.474603][T15185] netlink: 'syz.2.2529': attribute type 8 has an invalid length. [ 356.652351][ T12] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 356.667209][ T12] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 356.776246][T15192] bond8: entered promiscuous mode [ 356.797013][T15192] bond8: entered allmulticast mode [ 356.825688][T15192] 8021q: adding VLAN 0 to HW filter on device bond8 [ 356.851628][T15192] team0: Port device bond8 added [ 356.944166][T15187] team0: Port device bond8 removed [ 356.961415][T15187] bond8 (unregistering): Released all slaves [ 357.190033][ T7554] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 357.204857][ T7554] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 357.725804][T15241] rdma_op ffff88805889f9f0 conn xmit_rdma 0000000000000000 [ 357.769194][ T137] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 357.783824][ T137] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 357.842531][T15246] IPVS: set_ctl: invalid protocol: 98 127.0.0.1:20002 [ 357.882180][T15243] syzkaller0: entered promiscuous mode [ 357.899062][T15243] syzkaller0: entered allmulticast mode [ 358.029361][T15255] bond0: Device is already in use. [ 358.080043][T15254] nbd: must specify a device to reconfigure [ 358.087426][T15247] nbd: must specify a device to reconfigure [ 358.368719][ T137] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 358.383223][ T137] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 358.401190][T15269] __nla_validate_parse: 6 callbacks suppressed [ 358.401209][T15269] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2555'. [ 358.432025][T15269] sch_tbf: burst 6 is lower than device gretap0 mtu (1476) ! [ 358.543618][T15276] netlink: 132 bytes leftover after parsing attributes in process `syz.4.2557'. [ 358.557419][T15271] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2556'. [ 358.629596][T15280] netlink: 132 bytes leftover after parsing attributes in process `syz.4.2557'. [ 358.873802][T15288] tipc: Enabling of bearer rejected, max 3 bearers permitted [ 358.896315][T15289] tipc: Enabling of bearer rejected, max 3 bearers permitted [ 359.325189][T15317] netlink: 36 bytes leftover after parsing attributes in process `syz.4.2569'. [ 359.382766][T15317] netlink: 36 bytes leftover after parsing attributes in process `syz.4.2569'. [ 359.414932][T15317] netlink: 36 bytes leftover after parsing attributes in process `syz.4.2569'. [ 359.454318][T15317] netlink: 36 bytes leftover after parsing attributes in process `syz.4.2569'. [ 359.480190][T15317] netlink: 36 bytes leftover after parsing attributes in process `syz.4.2569'. [ 359.490038][T15320] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2570'. [ 359.823673][ T5761] lo speed is unknown, defaulting to 1000 [ 359.832433][ T137] netdevsim netdevsim4 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 359.832455][ T5761] syz2: Port: 1 Link DOWN [ 359.857026][ T137] netdevsim netdevsim4 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 359.882573][ T137] netdevsim netdevsim4 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 359.908501][ T137] netdevsim netdevsim4 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 360.130907][T15336] bond8: entered promiscuous mode [ 360.140782][T15336] bond8: entered allmulticast mode [ 360.151299][T15336] 8021q: adding VLAN 0 to HW filter on device bond8 [ 360.443937][T15355] validate_nla: 1 callbacks suppressed [ 360.443955][T15355] netlink: 'syz.4.2581': attribute type 5 has an invalid length. [ 361.480351][ T3374] net_ratelimit: 11 callbacks suppressed [ 361.480370][ T3374] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 361.502181][ T3374] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 361.650668][T15426] syzkaller0: entered promiscuous mode [ 361.660610][T15426] syzkaller0: entered allmulticast mode [ 361.695033][T15429] Can not set IPV6_FL_F_REFLECT if flowlabel_consistency sysctl is enable [ 362.050241][ T137] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 362.064780][ T137] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 362.340260][T15465] workqueue: Failed to create a rescuer kthread for wq "nfc2_nci_cmd_wq": -EINTR [ 362.498937][T15478] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 362.619060][ T1107] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 362.633673][ T1107] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 362.776048][T15494] netlink: 'syz.1.2621': attribute type 3 has an invalid length. [ 362.889946][T15495] netlink: 'syz.4.2618': attribute type 7 has an invalid length. [ 362.981441][T15500] syzkaller0: entered promiscuous mode [ 363.008707][T15500] syzkaller0: entered allmulticast mode [ 363.209890][ T137] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 363.224570][ T137] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 363.697831][T15521] __nla_validate_parse: 253 callbacks suppressed [ 363.697851][T15521] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2627'. [ 363.769855][T15525] netlink: 29 bytes leftover after parsing attributes in process `syz.2.2626'. [ 364.439551][T15544] netlink: 'syz.2.2634': attribute type 3 has an invalid length. [ 364.464769][T15544] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2634'. [ 364.783267][T15554] netlink: 152 bytes leftover after parsing attributes in process `syz.1.2638'. [ 364.863845][T15557] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2640'. [ 364.957294][T15557] netlink: 187308 bytes leftover after parsing attributes in process `syz.0.2640'. [ 364.980137][T15559] netlink: 'syz.4.2641': attribute type 2 has an invalid length. [ 365.003954][T15562] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2642'. [ 365.138751][T15565] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2642'. [ 365.392349][T15575] netlink: 'syz.0.2647': attribute type 3 has an invalid length. [ 365.423904][T15575] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2647'. [ 365.713375][T15583] ip6gre1: entered promiscuous mode [ 365.748639][T15583] ip6gre1: entered allmulticast mode [ 365.750618][T15588] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 365.831345][T15595] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2652'. [ 366.052216][ T7554] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 366.074798][ T7554] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 366.083092][ T7303] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 366.648750][ T7303] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 366.851564][ T3374] net_ratelimit: 12 callbacks suppressed [ 366.851584][ T3374] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 366.873133][ T3374] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 366.918801][ T7303] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 367.068124][T15629] netlink: 'syz.4.2664': attribute type 11 has an invalid length. [ 367.139714][T15634] netlink: 'syz.4.2664': attribute type 11 has an invalid length. [ 367.395505][T15629] 8021q: adding VLAN 0 to HW filter on device team0 [ 367.403748][ T1107] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 367.418258][ T1107] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 367.627786][T15629] veth1_vlan: left promiscuous mode [ 367.650991][T15629] veth0_vlan: left promiscuous mode [ 367.667629][T15629] veth0_vlan: entered promiscuous mode [ 367.690369][T15629] veth1_vlan: entered promiscuous mode [ 367.731932][T15629] veth1_macvtap: left promiscuous mode [ 367.750308][T15629] veth0_macvtap: left promiscuous mode [ 367.775006][T15629] veth0_macvtap: entered promiscuous mode [ 367.807299][T15629] veth1_macvtap: entered promiscuous mode [ 367.866761][T15629] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 367.902748][T15629] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 367.935877][T15629] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 367.964800][T15629] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 367.989692][T15629] A link change request failed with some changes committed already. Interface syzkaller0 may have been left with an inconsistent configuration, please check. [ 368.018578][ T7554] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 368.033256][ T7554] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 368.070579][ T10] lo speed is unknown, defaulting to 1000 [ 368.087693][ T10] syz2: Port: 1 Link ACTIVE [ 368.129187][T15654] tipc: Enabling of bearer rejected, max 3 bearers permitted [ 368.141378][ T12] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 368.151826][ T12] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 368.253577][ T12] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 368.276354][ T12] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 368.433003][T15682] netlink: 'syz.2.2676': attribute type 1 has an invalid length. [ 368.579197][ T12] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 368.593876][ T12] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 368.696756][T15690] mac80211_hwsim hwsim10 syzkaller0: entered promiscuous mode [ 368.703011][T15688] __nla_validate_parse: 4 callbacks suppressed [ 368.703029][T15688] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2679'. [ 368.711123][T15690] mac80211_hwsim hwsim10 syzkaller0: entered allmulticast mode [ 368.768613][T15687] tun0: tun_chr_ioctl cmd 1074025675 [ 368.791317][T15687] tun0: persist enabled [ 368.838259][T15695] tipc: Failed to remove unknown binding: 66,1,1/232011947:1584528410/1584528413 [ 368.846059][T15687] tun0: tun_chr_ioctl cmd 1074025675 [ 368.858584][T15687] tun0: persist disabled [ 368.870074][T15697] tipc: Failed to remove unknown binding: 66,1,1/232011947:1584528410/1584528413 [ 368.897845][T15698] sctp: [Deprecated]: syz.2.2679 (pid 15698) Use of struct sctp_assoc_value in delayed_ack socket option. [ 368.897845][T15698] Use struct sctp_sack_info instead [ 368.927181][T15697] tipc: Failed to remove unknown binding: 66,1,1/232011947:1584528410/1584528413 [ 368.953367][T15697] tipc: Failed to remove unknown binding: 66,1,1/232011947:1584528410/1584528413 [ 369.148878][ T36] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 369.184402][T15705] netlink: 3 bytes leftover after parsing attributes in process `syz.3.2684'. [ 369.246543][T15705] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2684'. [ 369.281305][T15705] netlink: 3 bytes leftover after parsing attributes in process `syz.3.2684'. [ 369.312020][T15705] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2684'. [ 369.324093][T15705] netlink: 3 bytes leftover after parsing attributes in process `syz.3.2684'. [ 369.525351][T15728] netlink: 'syz.2.2690': attribute type 89 has an invalid length. [ 369.536769][T15728] netlink: 100 bytes leftover after parsing attributes in process `syz.2.2690'. [ 369.798642][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 369.897969][T15750] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2698'. [ 370.205422][T15765] SET target dimension over the limit! [ 370.394271][T15772] netlink: 236 bytes leftover after parsing attributes in process `syz.0.2703'. [ 370.419479][T15772] netlink: 236 bytes leftover after parsing attributes in process `syz.0.2703'. [ 370.484253][T15781] batadv_slave_1: entered promiscuous mode [ 370.585505][T15781] batadv_slave_1: left promiscuous mode [ 370.868787][T15802] smc: ib device syz0 ibport 2 applied user defined pnetid SYZ2 [ 370.970109][T15802] xfrm0 speed is unknown, defaulting to 1000 [ 371.574070][T15852] netlink: 'syz.3.2727': attribute type 18 has an invalid length. [ 371.660736][T15850] bond9: option tlb_dynamic_lb: mode dependency failed, not supported in mode balance-rr(0) [ 371.673958][T15850] bond9 (unregistering): Released all slaves [ 371.742272][T15858] netlink: 'syz.3.2729': attribute type 1 has an invalid length. [ 371.778774][T15858] netlink: 'syz.3.2729': attribute type 2 has an invalid length. [ 371.835076][T15802] lo speed is unknown, defaulting to 1000 [ 371.955335][T15866] netlink: 'syz.0.2732': attribute type 1 has an invalid length. [ 372.240883][ T36] net_ratelimit: 17 callbacks suppressed [ 372.240899][ T36] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 372.261308][ T36] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 372.302540][T15878] gre1: entered allmulticast mode [ 372.652264][T15903] netlink: 'syz.1.2741': attribute type 1 has an invalid length. [ 372.707786][T15903] netlink: 'syz.1.2741': attribute type 2 has an invalid length. [ 372.945293][ T7549] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 372.959645][ T7549] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 373.042955][T15915] macvtap1: entered allmulticast mode [ 373.068550][T15915] veth0_to_bridge: entered allmulticast mode [ 373.083016][T15915] veth0_to_bridge: left allmulticast mode [ 373.391077][T15912] xfrm0 speed is unknown, defaulting to 1000 [ 373.451804][T15930] erspan1: entered allmulticast mode [ 373.498926][T15934] syz.2.2748 (15934) used obsolete PPPIOCDETACH ioctl [ 373.528511][ T36] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 373.543008][ T36] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 373.565367][T15935] xt_hashlimit: size too large, truncated to 1048576 [ 373.802276][T15938] openvswitch: netlink: Unexpected mask (mask=240, allowed=10048) [ 373.936812][T15950] __nla_validate_parse: 14 callbacks suppressed [ 373.936832][T15950] netlink: 175056 bytes leftover after parsing attributes in process `syz.3.2754'. [ 373.967423][T15952] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2755'. [ 373.980946][T15912] lo speed is unknown, defaulting to 1000 [ 374.005826][T15952] netlink: 'syz.2.2755': attribute type 1 has an invalid length. [ 374.018622][T15952] netlink: 'syz.2.2755': attribute type 2 has an invalid length. [ 374.100074][ T7549] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 374.115184][ T7549] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 374.119885][T15954] netlink: 'syz.3.2756': attribute type 32 has an invalid length. [ 374.162470][T15958] netlink: 48 bytes leftover after parsing attributes in process `syz.2.2758'. [ 374.189032][T15954] tunl0: Caught tx_queue_len zero misconfig [ 374.396728][T15962] netlink: 192 bytes leftover after parsing attributes in process `syz.2.2759'. [ 374.410298][T15968] team0: Port device dummy0 removed [ 374.416117][T15968] bridge_slave_0: left allmulticast mode [ 374.422401][T15968] bridge_slave_0: left promiscuous mode [ 374.428282][T15968] bridge0: port 1(bridge_slave_0) entered disabled state [ 374.445940][T15969] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2761'. [ 374.457076][T15970] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2759'. [ 374.466169][T15970] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2759'. [ 374.491713][T15968] bridge_slave_1: left allmulticast mode [ 374.497490][T15968] bridge_slave_1: left promiscuous mode [ 374.521907][T15968] bridge0: port 2(bridge_slave_1) entered disabled state [ 374.530170][T15972] netlink: 'syz.0.2762': attribute type 1 has an invalid length. [ 374.538037][T15972] netlink: 88 bytes leftover after parsing attributes in process `syz.0.2762'. [ 374.547890][T15972] netlink: 'syz.0.2762': attribute type 1 has an invalid length. [ 374.557817][T15968] bond0: (slave bond_slave_0): Releasing backup interface [ 374.565174][T15972] netlink: 638 bytes leftover after parsing attributes in process `syz.0.2762'. [ 374.575228][T15972] netlink: 1 bytes leftover after parsing attributes in process `syz.0.2762'. [ 374.588169][T15968] bond0: (slave bond_slave_1): Releasing backup interface [ 374.603624][T15968] team0: Port device team_slave_0 removed [ 374.611025][T15968] team0: Port device team_slave_1 removed [ 374.617185][T15968] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 374.625325][T15968] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 374.637586][T15968] team0: Port device bridge4 removed [ 374.644672][T15968] team0: Port device bridge5 removed [ 374.651017][T15968] vxlan0: left allmulticast mode [ 374.655974][T15968] vxlan0: left promiscuous mode [ 374.658540][ T7549] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 374.661978][T15968] bridge0: port 3(vxlan0) entered disabled state [ 374.685168][T15968] batman_adv: batadv0: Removing interface: vlan6 [ 374.693481][T15968] bond7: (slave veth15): Releasing backup interface [ 374.700306][T15968] veth15: left promiscuous mode [ 374.861084][T15966] xfrm0 speed is unknown, defaulting to 1000 [ 375.048986][T15987] netlink: 'syz.0.2766': attribute type 1 has an invalid length. [ 375.849940][T15966] lo speed is unknown, defaulting to 1000 [ 377.398595][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 377.728522][ T36] net_ratelimit: 13 callbacks suppressed [ 377.728540][ T36] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 377.748668][ T36] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 377.808866][T16093] nbd: must specify a device to reconfigure [ 378.091815][T16111] nbd5: detected capacity change from 0 to 127 [ 378.104295][ T36] netdevsim netdevsim1 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 378.114419][ T36] netdevsim netdevsim1 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 378.132335][ T36] netdevsim netdevsim1 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 378.152435][ T36] netdevsim netdevsim1 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 378.318587][ T7559] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 378.333197][ T7559] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 378.390086][T16125] netlink: 'syz.2.2803': attribute type 2 has an invalid length. [ 378.404836][T16125] netlink: 'syz.2.2803': attribute type 8 has an invalid length. [ 378.686657][ T1315] ieee802154 phy0 wpan0: encryption failed: -22 [ 378.868555][ T7559] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 378.883998][ T7559] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 378.905648][ T4944] block nbd5: Receive control failed (result -104) [ 378.914254][T16149] netlink: 'syz.1.2811': attribute type 1 has an invalid length. [ 378.941915][T16149] netlink: 'syz.1.2811': attribute type 2 has an invalid length. [ 379.136473][T16156] dvmrp1: tun_chr_ioctl cmd 1074025677 [ 379.163426][T16156] dvmrp1: linktype set to 0 [ 379.287598][T16165] __nla_validate_parse: 15 callbacks suppressed [ 379.287620][T16165] netlink: 40 bytes leftover after parsing attributes in process `syz.1.2815'. [ 379.297578][T16158] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2814'. [ 379.459366][ T7559] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 379.473867][ T7559] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 379.597617][T16174] nbd: must specify a device to reconfigure [ 379.723462][T16182] syzkaller0: entered promiscuous mode [ 379.738739][T16182] syzkaller0: entered allmulticast mode [ 379.756132][T16182] netlink: 36 bytes leftover after parsing attributes in process `syz.0.2818'. [ 380.028979][ T3374] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 380.043695][ T3374] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 380.218305][T16195] netlink: 'syz.3.2823': attribute type 1 has an invalid length. [ 380.252389][T16195] netlink: 'syz.3.2823': attribute type 2 has an invalid length. [ 380.524453][T16208] netlink: 'syz.2.2825': attribute type 1 has an invalid length. [ 380.550808][ T7559] nci: nci_extract_activation_params_iso_dep: unsupported activation_rf_tech_and_mode 0x80 [ 380.602843][ T4960] block nbd4: Possible stuck request ffff888027cce000: control (read@0,1024B). Runtime 30 seconds [ 380.620205][ T4960] block nbd4: Possible stuck request ffff888027cce1c0: control (read@1024,1024B). Runtime 30 seconds [ 380.631240][ T4960] block nbd4: Possible stuck request ffff888027cce380: control (read@2048,1024B). Runtime 30 seconds [ 380.642473][ T4960] block nbd4: Possible stuck request ffff888027cce540: control (read@3072,1024B). Runtime 30 seconds [ 380.642486][T16213] 8021q: adding VLAN 0 to HW filter on device bond9 [ 380.660071][T16213] bond8: (slave bond9): making interface the new active one [ 380.684825][T16213] bond8: (slave bond9): Enslaving as an active interface with an up link [ 380.761767][T16208] bond8: (slave gretap3): Enslaving as a backup interface with an up link [ 380.784049][T16213] 8021q: adding VLAN 0 to HW filter on device bond8 [ 380.791750][T16214] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2824'. [ 380.815122][T16208] netlink: 'syz.2.2825': attribute type 1 has an invalid length. [ 381.191475][T16199] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 381.413865][ T4960] block nbd5: Connection timed out, retrying (0/1 alive) [ 381.422064][ T4960] block nbd5: Connection timed out, retrying (0/1 alive) [ 381.429945][ T4960] block nbd5: Connection timed out, retrying (0/1 alive) [ 381.439092][ T4960] block nbd5: Connection timed out, retrying (0/1 alive) [ 381.446725][ T4960] block nbd5: Dead connection, failed to find a fallback [ 381.456708][ T4960] block nbd5: shutting down sockets [ 381.463639][ T4960] blk_print_req_error: 19 callbacks suppressed [ 381.463660][ T4960] I/O error, dev nbd5, sector 6 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 381.481550][ T4960] buffer_io_error: 48 callbacks suppressed [ 381.481566][ T4960] Buffer I/O error on dev nbd5, logical block 3, async page read [ 381.498982][ T4960] I/O error, dev nbd5, sector 4 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 381.508083][ T4960] Buffer I/O error on dev nbd5, logical block 2, async page read [ 381.519580][ T4960] I/O error, dev nbd5, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 381.528711][ T4960] Buffer I/O error on dev nbd5, logical block 1, async page read [ 381.536512][ T4960] I/O error, dev nbd5, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 381.545789][ T4960] Buffer I/O error on dev nbd5, logical block 0, async page read [ 381.558469][ T9281] I/O error, dev nbd5, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 381.567559][ T9281] Buffer I/O error on dev nbd5, logical block 0, async page read [ 381.575564][ T9281] I/O error, dev nbd5, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 381.584759][ T9281] Buffer I/O error on dev nbd5, logical block 1, async page read [ 381.592809][ T9281] I/O error, dev nbd5, sector 4 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 381.601983][ T9281] Buffer I/O error on dev nbd5, logical block 2, async page read [ 381.610037][ T9281] I/O error, dev nbd5, sector 6 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 381.619262][ T9281] Buffer I/O error on dev nbd5, logical block 3, async page read [ 381.627230][ T9281] I/O error, dev nbd5, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 381.636460][ T9281] Buffer I/O error on dev nbd5, logical block 0, async page read [ 381.644808][ T9281] I/O error, dev nbd5, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 381.654119][ T9281] Buffer I/O error on dev nbd5, logical block 1, async page read [ 381.665080][ T9281] ldm_validate_partition_table(): Disk read failed. [ 381.674174][ T9281] Dev nbd5: unable to read RDB block 0 [ 381.681769][ T9281] nbd5: unable to read partition table [ 381.706418][ T9281] ldm_validate_partition_table(): Disk read failed. [ 381.717839][T16242] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2834'. [ 381.737502][ T9281] Dev nbd5: unable to read RDB block 0 [ 381.772771][ T9281] nbd5: unable to read partition table [ 381.812746][T16247] tipc: Enabled bearer , priority 0 [ 381.821309][T16247] syzkaller0: entered promiscuous mode [ 381.827243][T16247] syzkaller0: entered allmulticast mode [ 381.877002][T16249] 8021q: adding VLAN 0 to HW filter on device ipvlan3 [ 381.899586][T16247] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 381.931978][T16247] tipc: Resetting bearer [ 381.942802][T16246] tipc: Resetting bearer [ 381.972612][T16246] tipc: Disabling bearer [ 382.030127][T16252] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2837'. [ 382.622907][T16270] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2844'. [ 382.801475][T16278] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2848'. [ 383.174484][T16295] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2855'. [ 383.210476][ T7559] net_ratelimit: 10 callbacks suppressed [ 383.210493][ T7559] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 383.226799][T16295] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2855'. [ 383.230728][ T7559] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 383.732665][T16315] RDS: rds_bind could not find a transport for ::ffff:10.1.1.3, load rds_tcp or rds_rdma? [ 383.772312][ T1107] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 383.787336][ T1107] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 383.831069][T16321] netlink: 'syz.0.2862': attribute type 5 has an invalid length. [ 383.855336][T16321] geneve3: entered promiscuous mode [ 383.860778][T16321] geneve3: entered allmulticast mode [ 383.867782][ T1107] netdevsim netdevsim0 netdevsim1: set [1, 1] type 2 family 0 port 35256 - 0 [ 383.880038][ T1107] netdevsim netdevsim0 netdevsim2: set [1, 1] type 2 family 0 port 35256 - 0 [ 383.898482][ T1107] netdevsim netdevsim0 netdevsim3: set [1, 1] type 2 family 0 port 35256 - 0 [ 383.963622][ T36] wlan0: Trigger new scan to find an IBSS to join [ 384.134282][T16326] veth13: entered promiscuous mode [ 384.296727][T16341] __nla_validate_parse: 5 callbacks suppressed [ 384.296743][T16341] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2868'. [ 384.309090][ T3374] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 384.327174][ T3374] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 384.365980][T16342] netlink: 32 bytes leftover after parsing attributes in process `syz.1.2869'. [ 384.376457][T16347] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2870'. [ 384.454214][T16347] xfrm1: entered promiscuous mode [ 384.465158][T16347] xfrm1: entered allmulticast mode [ 384.472118][T16347] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2870'. [ 384.489336][T16351] tipc: Failed to remove unknown binding: 66,1,1/1401220393:3268615226/3268615228 [ 384.512363][T16352] tipc: Failed to remove unknown binding: 66,1,1/1401220393:3268615226/3268615228 [ 384.527901][T16352] tipc: Failed to remove unknown binding: 66,1,1/1401220393:3268615226/3268615228 [ 384.739269][T16363] gre0: left allmulticast mode [ 384.766497][T16363] xfrm0: left allmulticast mode [ 384.779525][T16363] geneve1: left allmulticast mode [ 384.785560][T16363] ip6tnl1: left allmulticast mode [ 384.792273][T16363] gretap1: left allmulticast mode [ 384.799833][T16363] bond4: left allmulticast mode [ 384.805700][T16363] bond5: left allmulticast mode [ 384.821502][T16363] bridge3: left allmulticast mode [ 384.840343][T16363] sit1: left allmulticast mode [ 384.857557][T16363] bridge6: left allmulticast mode [ 384.858842][ T36] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 384.875047][T16363] bond7: left allmulticast mode [ 384.877037][ T36] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 384.883819][T16363] bridge8: left allmulticast mode [ 384.932453][T16363] gre1: left allmulticast mode [ 385.013036][T16363] xfrm1: left allmulticast mode [ 385.187363][T16381] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2880'. [ 385.419215][ T3374] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 385.433708][ T3374] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 385.496692][T16398] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2886'. [ 385.603295][T16406] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2888'. [ 385.612607][T16405] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2888'. [ 385.653129][T16409] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2887'. [ 385.657143][T16405] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2888'. [ 385.840219][T16419] syzkaller1: entered promiscuous mode [ 385.845913][T16419] syzkaller1: entered allmulticast mode [ 385.856464][T16419] syzkaller1: left promiscuous mode [ 385.862310][T16419] syzkaller1: left allmulticast mode [ 386.404989][T16435] ip6tnl4: entered promiscuous mode [ 386.692944][T16443] ip6tnl4: entered allmulticast mode [ 387.351392][ T5637] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 387.372686][ T5637] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 387.382456][ T5637] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 387.391297][ T5637] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 387.401004][ T5637] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 388.013841][T16480] xfrm0 speed is unknown, defaulting to 1000 [ 388.350112][T16480] lo speed is unknown, defaulting to 1000 [ 388.529264][ T7549] net_ratelimit: 10 callbacks suppressed [ 388.529283][ T7549] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 388.549446][ T7549] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 388.697374][T16507] xfrm0: entered allmulticast mode [ 388.705973][T16507] A link change request failed with some changes committed already. Interface xfrm0 may have been left with an inconsistent configuration, please check. [ 389.077478][T16480] bridge0: port 1(bridge_slave_0) entered blocking state [ 389.103011][T16480] bridge0: port 1(bridge_slave_0) entered disabled state [ 389.110267][ T7559] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 389.124975][ T7559] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 389.152986][T16480] bridge_slave_0: entered allmulticast mode [ 389.169948][T16480] bridge_slave_0: entered promiscuous mode [ 389.187180][T16480] bridge0: port 2(bridge_slave_1) entered blocking state [ 389.194804][T16480] bridge0: port 2(bridge_slave_1) entered disabled state [ 389.202569][T16480] bridge_slave_1: entered allmulticast mode [ 389.211349][T16480] bridge_slave_1: entered promiscuous mode [ 389.271397][T16480] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 389.285696][T16480] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 389.334760][T16480] team0: Port device team_slave_0 added [ 389.344374][T16480] team0: Port device team_slave_1 added [ 389.412249][T16480] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 389.428502][T16480] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 389.478545][T16480] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 389.479649][ T4944] Bluetooth: hci5: command tx timeout [ 389.502095][T16480] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 389.509514][T16480] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 389.536368][T16480] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 389.560308][T16537] netlink: 'syz.4.2920': attribute type 11 has an invalid length. [ 389.568325][T16537] __nla_validate_parse: 9 callbacks suppressed [ 389.588317][T16537] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2920'. [ 389.660966][T16542] netlink: 'syz.4.2920': attribute type 11 has an invalid length. [ 389.669113][T16542] netlink: 59 bytes leftover after parsing attributes in process `syz.4.2920'. [ 389.690595][T16480] hsr_slave_0: entered promiscuous mode [ 389.697684][T16480] hsr_slave_1: entered promiscuous mode [ 389.708670][ T1107] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 389.723092][ T1107] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 389.959143][ T1107] wlan0: Trigger new scan to find an IBSS to join [ 390.288578][ T3374] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 390.304064][ T3374] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 390.507018][T16560] FAULT_INJECTION: forcing a failure. [ 390.507018][T16560] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 390.528660][T16560] CPU: 1 UID: 0 PID: 16560 Comm: syz.0.2930 Not tainted syzkaller #0 PREEMPT(full) [ 390.528710][T16560] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 390.528736][T16560] Call Trace: [ 390.528747][T16560] [ 390.528755][T16560] dump_stack_lvl+0xe8/0x150 [ 390.528849][T16560] should_fail_ex+0x40c/0x560 [ 390.529007][T16560] _copy_from_user+0x2d/0xb0 [ 390.529065][T16560] do_ipv6_setsockopt+0x258/0x3190 [ 390.529205][T16560] ? get_pid_task+0x20/0x1f0 [ 390.529261][T16560] ? __pfx_do_ipv6_setsockopt+0x10/0x10 [ 390.529284][T16560] ? get_pid_task+0x20/0x1f0 [ 390.529305][T16560] ? get_pid_task+0x20/0x1f0 [ 390.529323][T16560] ? get_pid_task+0x20/0x1f0 [ 390.529353][T16560] ? __lock_acquire+0x683/0x2cd0 [ 390.529408][T16560] ? aa_sk_perm+0x6d5/0x900 [ 390.529484][T16560] ? __fget_files+0x2a/0x420 [ 390.529538][T16560] ? __pfx_aa_sk_perm+0x10/0x10 [ 390.529563][T16560] ? __fget_files+0x2a/0x420 [ 390.529580][T16560] ? aa_sock_opt_perm+0xff/0x1a0 [ 390.529636][T16560] ipv6_setsockopt+0x59/0x170 [ 390.529662][T16560] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 390.529768][T16560] do_sock_setsockopt+0x17c/0x1b0 [ 390.529819][T16560] __x64_sys_setsockopt+0x13d/0x1b0 [ 390.529839][T16560] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 390.529904][T16560] do_syscall_64+0x174/0x580 [ 390.530015][T16560] ? trace_irq_disable+0x3b/0x140 [ 390.530058][T16560] ? clear_bhb_loop+0x40/0x90 [ 390.530087][T16560] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 390.530105][T16560] RIP: 0033:0x7fe7c8d9ce59 [ 390.530123][T16560] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 390.530138][T16560] RSP: 002b:00007fe7c9bea028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 390.530157][T16560] RAX: ffffffffffffffda RBX: 00007fe7c9015fa0 RCX: 00007fe7c8d9ce59 [ 390.530171][T16560] RDX: 0000000000000020 RSI: 0000000000000029 RDI: 0000000000000004 [ 390.530181][T16560] RBP: 00007fe7c9bea090 R08: 0000000000000020 R09: 0000000000000000 [ 390.530192][T16560] R10: 0000200000000280 R11: 0000000000000246 R12: 0000000000000001 [ 390.530204][T16560] R13: 00007fe7c9016038 R14: 00007fe7c9015fa0 R15: 00007ffcba442be8 [ 390.530234][T16560] [ 390.861441][ T7559] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 391.366027][T16480] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 391.384205][T16480] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 391.392556][T16480] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 391.407674][T16480] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 391.439855][T16480] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 391.455720][T16480] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 391.464384][T16480] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 391.476217][T16480] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 391.561248][ T4944] Bluetooth: hci5: command tx timeout [ 391.590648][T16594] xt_CT: You must specify a L4 protocol and not use inversions on it [ 391.649911][T16599] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2938'. [ 391.745080][T16480] 8021q: adding VLAN 0 to HW filter on device bond0 [ 391.779115][T16480] 8021q: adding VLAN 0 to HW filter on device team0 [ 391.810094][ T1107] bridge0: port 1(bridge_slave_0) entered blocking state [ 391.817327][ T1107] bridge0: port 1(bridge_slave_0) entered forwarding state [ 391.828129][ T1107] bridge0: port 2(bridge_slave_1) entered blocking state [ 391.835345][ T1107] bridge0: port 2(bridge_slave_1) entered forwarding state [ 391.986337][T16613] FAULT_INJECTION: forcing a failure. [ 391.986337][T16613] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 392.003666][T16613] CPU: 1 UID: 0 PID: 16613 Comm: syz.3.2943 Not tainted syzkaller #0 PREEMPT(full) [ 392.003692][T16613] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 392.003702][T16613] Call Trace: [ 392.003709][T16613] [ 392.003717][T16613] dump_stack_lvl+0xe8/0x150 [ 392.003742][T16613] should_fail_ex+0x40c/0x560 [ 392.003775][T16613] _copy_from_user+0x2d/0xb0 [ 392.003796][T16613] ipv6_flowlabel_opt+0x14c/0x2ae0 [ 392.003916][T16613] ? register_lock_class+0x31/0x2e0 [ 392.003941][T16613] ? __lock_acquire+0x683/0x2cd0 [ 392.003961][T16613] ? __pfx_ipv6_flowlabel_opt+0x10/0x10 [ 392.003990][T16613] ? do_user_addr_fault+0xc4a/0x1340 [ 392.004031][T16613] ? irqentry_exit+0x218/0x8e0 [ 392.004058][T16613] ? do_raw_spin_lock+0x12b/0x2f0 [ 392.004079][T16613] ? lock_sock_nested+0x6a/0x100 [ 392.004105][T16613] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 392.004138][T16613] ? __local_bh_enable_ip+0xd0/0x130 [ 392.004161][T16613] do_ipv6_setsockopt+0xe0e/0x3190 [ 392.004185][T16613] ? get_pid_task+0x20/0x1f0 [ 392.004215][T16613] ? __pfx_do_ipv6_setsockopt+0x10/0x10 [ 392.004238][T16613] ? get_pid_task+0x20/0x1f0 [ 392.004259][T16613] ? get_pid_task+0x20/0x1f0 [ 392.004278][T16613] ? get_pid_task+0x20/0x1f0 [ 392.004309][T16613] ? __lock_acquire+0x683/0x2cd0 [ 392.004347][T16613] ? aa_sk_perm+0x6d5/0x900 [ 392.004410][T16613] ? __fget_files+0x2a/0x420 [ 392.004437][T16613] ? __pfx_aa_sk_perm+0x10/0x10 [ 392.004556][T16613] ? __fget_files+0x2a/0x420 [ 392.004577][T16613] ? aa_sock_opt_perm+0xff/0x1a0 [ 392.004603][T16613] ipv6_setsockopt+0x59/0x170 [ 392.004629][T16613] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 392.004656][T16613] do_sock_setsockopt+0x17c/0x1b0 [ 392.004681][T16613] __x64_sys_setsockopt+0x13d/0x1b0 [ 392.004702][T16613] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 392.004722][T16613] do_syscall_64+0x174/0x580 [ 392.004743][T16613] ? trace_irq_disable+0x3b/0x140 [ 392.004768][T16613] ? clear_bhb_loop+0x40/0x90 [ 392.004789][T16613] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 392.004805][T16613] RIP: 0033:0x7f309cb9ce59 [ 392.004821][T16613] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 392.004836][T16613] RSP: 002b:00007f309da88028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 392.004854][T16613] RAX: ffffffffffffffda RBX: 00007f309ce15fa0 RCX: 00007f309cb9ce59 [ 392.004864][T16613] RDX: 0000000000000020 RSI: 0000000000000029 RDI: 0000000000000004 [ 392.004873][T16613] RBP: 00007f309da88090 R08: 0000000000000020 R09: 0000000000000000 [ 392.004882][T16613] R10: 0000200000000280 R11: 0000000000000246 R12: 0000000000000001 [ 392.004892][T16613] R13: 00007f309ce16038 R14: 00007f309ce15fa0 R15: 00007fff20031f28 [ 392.004919][T16613] [ 392.280945][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 392.590693][T16633] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2946'. [ 393.438923][ T7549] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 393.638665][ T4944] Bluetooth: hci5: command tx timeout [ 393.875218][T16480] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 393.930444][ T7549] net_ratelimit: 13 callbacks suppressed [ 393.930462][ T7549] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 393.950651][ T7549] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 394.007191][T16480] veth0_vlan: entered promiscuous mode [ 394.023834][T16480] veth1_vlan: entered promiscuous mode [ 394.102992][T16480] veth0_macvtap: entered promiscuous mode [ 394.138095][T16480] veth1_macvtap: entered promiscuous mode [ 394.183507][T16685] netlink: 'syz.3.2952': attribute type 1 has an invalid length. [ 394.195510][T16480] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 394.223464][T16480] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 394.287796][T16685] 8021q: adding VLAN 0 to HW filter on device bond10 [ 394.314447][T16685] veth0_to_bond: Caught tx_queue_len zero misconfig [ 394.402845][T16685] veth19: entered allmulticast mode [ 394.433364][T16685] bond10: (slave veth19): Enslaving as an active interface with an up link [ 394.470594][ T7559] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 394.506156][ T7549] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 394.538821][ T7559] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 394.553634][ T7559] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 394.572222][ T3374] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 394.613482][T16696] xt_TCPMSS: Only works on TCP SYN packets [ 394.627027][ T3374] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 394.629336][T16696] netlink: 'syz.1.2954': attribute type 1 has an invalid length. [ 394.644837][T16696] netlink: 96 bytes leftover after parsing attributes in process `syz.1.2954'. [ 394.678865][T16696] netlink: 1 bytes leftover after parsing attributes in process `syz.1.2954'. [ 394.691800][T16696] netlink: 658 bytes leftover after parsing attributes in process `syz.1.2954'. [ 394.710232][T16701] openvswitch: netlink: Tunnel attr 4104 out of range max 16 [ 394.718202][T16701] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 394.752918][T16701] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2956'. [ 394.807997][ T3374] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 394.817264][ T3374] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 394.894535][ T36] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 394.903552][ T36] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 395.143041][T16715] netlink: 32 bytes leftover after parsing attributes in process `syz.1.2959'. [ 395.158602][ T7549] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 395.173123][ T7549] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 395.365137][T16716] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2959'. [ 395.466440][T16732] netlink: 212344 bytes leftover after parsing attributes in process `syz.2.2962'. [ 395.477134][T16731] netlink: 212344 bytes leftover after parsing attributes in process `syz.2.2962'. [ 395.668813][T16738] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2966'. [ 395.704582][T16742] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2967'. [ 395.708675][ T36] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 395.729636][ T36] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 395.745236][ T4944] Bluetooth: hci5: command tx timeout [ 395.755118][T16740] bond10 (unregistering): Released all slaves [ 395.769755][T16745] block nbd6: Unsupported socket: should be TCP or UNIX. [ 395.859309][T16747] bond1: entered promiscuous mode [ 395.865117][T16747] 8021q: adding VLAN 0 to HW filter on device bond1 [ 395.997305][T16758] xt_l2tp: v2 sid > 0xffff: 8388608 [ 396.526088][ T5637] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 396.540464][ T5637] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 396.555164][ T5637] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 396.563358][ T5637] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 396.571964][ T5637] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 396.942912][T16776] xfrm0 speed is unknown, defaulting to 1000 [ 397.106965][T16776] lo speed is unknown, defaulting to 1000 [ 397.692737][ T7559] .` (unregistering): Released all slaves [ 397.709515][ T7559] bond1 (unregistering): Released all slaves [ 397.725602][ T7559] bond2 (unregistering): Released all slaves [ 397.739746][ T7559] bond3 (unregistering): Released all slaves [ 397.765766][ T7559] bond0 (unregistering): Released all slaves [ 397.779598][ T7559] bond4 (unregistering): Released all slaves [ 397.793944][ T7559] bond5 (unregistering): Released all slaves [ 397.807362][ T7559] bond6 (unregistering): Released all slaves [ 397.824299][ T7559] bond7 (unregistering): Released all slaves [ 397.847131][ T7559] bond8 (unregistering): Released all slaves [ 397.891963][T16776] bridge0: port 1(bridge_slave_0) entered blocking state [ 397.899645][T16776] bridge0: port 1(bridge_slave_0) entered disabled state [ 397.906875][T16776] bridge_slave_0: entered allmulticast mode [ 397.914619][T16776] bridge_slave_0: entered promiscuous mode [ 397.923411][T16776] bridge0: port 2(bridge_slave_1) entered blocking state [ 397.931023][T16776] bridge0: port 2(bridge_slave_1) entered disabled state [ 397.938306][T16776] bridge_slave_1: entered allmulticast mode [ 397.946624][T16776] bridge_slave_1: entered promiscuous mode [ 397.987433][T16776] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 398.000477][T16776] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 398.067648][ T7559] : left promiscuous mode [ 398.140546][T16776] team0: Port device team_slave_0 added [ 398.149791][T16776] team0: Port device team_slave_1 added [ 398.171936][T16776] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 398.179016][T16776] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 398.206637][T16776] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 398.220861][ T7559] tipc: Left network mode [ 398.221951][T16776] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 398.233276][T16776] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 398.259447][T16776] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 398.331339][T16776] hsr_slave_0: entered promiscuous mode [ 398.338080][T16776] hsr_slave_1: entered promiscuous mode [ 398.344968][T16776] debugfs: 'hsr0' already exists in 'hsr' [ 398.351313][T16776] Cannot create hsr debugfs directory [ 398.598609][ T4944] Bluetooth: hci2: command tx timeout [ 398.667836][T16745] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 399.320580][ T7549] net_ratelimit: 12 callbacks suppressed [ 399.320599][ T7549] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 399.340913][ T7549] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 399.908948][ T3374] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 399.923561][ T3374] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 400.478578][ T7549] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 400.492943][T16776] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 400.500239][ T7549] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 400.537100][T16776] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 400.583045][T16776] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 400.636123][T16776] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 400.687003][ T4944] Bluetooth: hci2: command tx timeout [ 400.688318][T16776] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 400.727279][T16856] __nla_validate_parse: 2 callbacks suppressed [ 400.727298][T16856] netlink: 388 bytes leftover after parsing attributes in process `syz.0.2990'. [ 400.790558][T16776] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 400.821900][T16776] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 400.887599][T16776] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 400.956604][T16870] netlink: 124 bytes leftover after parsing attributes in process `syz.0.2993'. [ 401.029180][ T12] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 401.043613][ T12] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 401.096068][T16776] 8021q: adding VLAN 0 to HW filter on device bond0 [ 401.163243][T16881] bridge_slave_1: Caught tx_queue_len zero misconfig [ 401.177324][T16870] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2993'. [ 401.220861][T16776] 8021q: adding VLAN 0 to HW filter on device team0 [ 401.417903][T16852] IPVS: set_ctl: invalid protocol: 0 10.1.1.0:20001 [ 401.459313][ T1107] bridge0: port 1(bridge_slave_0) entered blocking state [ 401.466486][ T1107] bridge0: port 1(bridge_slave_0) entered forwarding state [ 401.599060][ T7549] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 401.613873][ T7549] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 401.730680][T16895] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 401.757199][ T1107] bridge0: port 2(bridge_slave_1) entered blocking state [ 401.764411][ T1107] bridge0: port 2(bridge_slave_1) entered forwarding state [ 401.905642][ T7559] IPVS: stop unused estimator thread 0... [ 402.374121][T16915] IPVS: Scheduler module ip_vs_ not found [ 402.758984][ T4944] Bluetooth: hci2: command tx timeout [ 402.779848][T16939] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3008'. [ 402.799105][T16939] netlink: 5 bytes leftover after parsing attributes in process `syz.0.3008'. [ 402.860750][T16943] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3010'. [ 402.916998][T16776] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 402.997525][T16776] veth0_vlan: entered promiscuous mode [ 403.032673][T16776] veth1_vlan: entered promiscuous mode [ 403.083003][T16776] veth0_macvtap: entered promiscuous mode [ 403.112752][T16776] veth1_macvtap: entered promiscuous mode [ 403.119735][T16953] netlink: 'syz.3.3012': attribute type 1 has an invalid length. [ 403.141465][T16776] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 403.170453][T16776] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 403.183103][T16955] netlink: 'syz.2.3013': attribute type 10 has an invalid length. [ 403.216781][ T3374] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 403.239962][ T3374] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 403.262181][T16955] team0: Device vxcan1 is of different type [ 403.280773][ T3374] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 403.308886][ T3374] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 403.465185][T16959] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3016'. [ 403.515559][T16962] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3016'. [ 403.595577][T16964] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3017'. [ 403.610943][T16964] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3017'. [ 403.630876][ T3374] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 403.639793][ T3374] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 403.706811][T16959] lo: entered allmulticast mode [ 403.734359][T16959] lo: left allmulticast mode [ 403.742566][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 403.760583][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 403.761662][T16966] syzkaller1: entered promiscuous mode [ 403.782572][T16966] syzkaller1: entered allmulticast mode [ 404.292923][ T5637] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 404.308031][ T5637] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 404.318189][ T5637] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 404.330209][ T5637] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 404.339856][ T5637] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 404.729434][ T12] net_ratelimit: 12 callbacks suppressed [ 404.729453][ T12] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 404.749670][ T12] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 404.849314][ T4944] Bluetooth: hci2: command tx timeout [ 404.862438][T17004] 8021q: adding VLAN 0 to HW filter on device bond2 [ 405.100836][T16987] xfrm0 speed is unknown, defaulting to 1000 [ 405.313584][T16987] lo speed is unknown, defaulting to 1000 [ 405.358897][ T3374] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 405.373361][ T3374] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 405.538878][T16987] bridge0: port 1(bridge_slave_0) entered blocking state [ 405.546540][T16987] bridge0: port 1(bridge_slave_0) entered disabled state [ 405.555001][T16987] bridge_slave_0: entered allmulticast mode [ 405.563816][T16987] bridge_slave_0: entered promiscuous mode [ 405.572088][T16987] bridge0: port 2(bridge_slave_1) entered blocking state [ 405.579505][T16987] bridge0: port 2(bridge_slave_1) entered disabled state [ 405.586716][T16987] bridge_slave_1: entered allmulticast mode [ 405.594243][T16987] bridge_slave_1: entered promiscuous mode [ 405.625121][T16987] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 405.637468][T16987] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 405.669616][T16987] team0: Port device team_slave_0 added [ 405.677709][T16987] team0: Port device team_slave_1 added [ 405.701962][T16987] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 405.709127][T16987] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 405.735336][T16987] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 405.748881][T16987] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 405.756028][T16987] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 405.782243][T16987] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 405.823722][T16987] hsr_slave_0: entered promiscuous mode [ 405.830179][T16987] hsr_slave_1: entered promiscuous mode [ 405.836511][T16987] debugfs: 'hsr0' already exists in 'hsr' [ 405.842721][T16987] Cannot create hsr debugfs directory [ 405.908541][ T57] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 405.923180][ T57] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 406.439235][ T4944] Bluetooth: hci3: command tx timeout [ 406.439312][ T1107] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 406.459852][ T1107] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 406.978610][ T57] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 406.993165][ T57] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 407.798625][T17009] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 407.831678][T16987] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 407.848205][T16987] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 407.857580][T16987] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 408.002102][T16987] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 408.016464][T17050] __nla_validate_parse: 3 callbacks suppressed [ 408.016481][T17050] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3038'. [ 408.035253][T16987] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 408.047817][T16987] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 408.143473][T17060] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3040'. [ 408.165782][T16987] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 408.183390][T16987] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 408.382959][T16987] 8021q: adding VLAN 0 to HW filter on device bond0 [ 408.422880][T16987] 8021q: adding VLAN 0 to HW filter on device team0 [ 408.436112][ T3374] bridge0: port 1(bridge_slave_0) entered blocking state [ 408.443368][ T3374] bridge0: port 1(bridge_slave_0) entered forwarding state [ 408.478545][ T3374] bridge0: port 2(bridge_slave_1) entered blocking state [ 408.485783][ T3374] bridge0: port 2(bridge_slave_1) entered forwarding state [ 408.519557][ T4944] Bluetooth: hci3: command tx timeout [ 408.532238][T17081] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3046'. [ 408.556261][T17082] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3046'. [ 408.560802][T16987] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 408.832316][T17101] netlink: 'syz.0.3050': attribute type 3 has an invalid length. [ 409.248558][T17123] tipc: Enabled bearer , priority 0 [ 409.292805][T17123] syzkaller0: entered promiscuous mode [ 409.326987][T17123] syzkaller0: entered allmulticast mode [ 409.402456][T16987] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 409.578065][T16987] veth0_vlan: entered promiscuous mode [ 409.604185][T16987] veth1_vlan: entered promiscuous mode [ 409.767085][T16987] veth0_macvtap: entered promiscuous mode [ 409.780350][T16987] veth1_macvtap: entered promiscuous mode [ 409.805060][T16987] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 409.824479][T16987] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 409.850075][ T12] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 409.869762][ T12] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 409.892082][ T12] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 409.909381][ T12] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 410.064177][T17151] FAULT_INJECTION: forcing a failure. [ 410.064177][T17151] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 410.090718][ T12] net_ratelimit: 12 callbacks suppressed [ 410.090737][ T12] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 410.111177][ T12] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 410.120554][T17151] CPU: 1 UID: 0 PID: 17151 Comm: syz.1.3061 Not tainted syzkaller #0 PREEMPT(full) [ 410.120583][T17151] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 410.120593][T17151] Call Trace: [ 410.120600][T17151] [ 410.120607][T17151] dump_stack_lvl+0xe8/0x150 [ 410.120635][T17151] should_fail_ex+0x40c/0x560 [ 410.120667][T17151] _copy_from_user+0x2d/0xb0 [ 410.120687][T17151] ___sys_sendmsg+0x1c6/0x360 [ 410.120706][T17151] ? __lock_acquire+0x683/0x2cd0 [ 410.120729][T17151] ? __pfx____sys_sendmsg+0x10/0x10 [ 410.120780][T17151] ? __fget_files+0x2a/0x420 [ 410.120800][T17151] ? __fget_files+0x3a2/0x420 [ 410.120829][T17151] __x64_sys_sendmsg+0x1bd/0x2a0 [ 410.120850][T17151] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 410.120877][T17151] ? __pfx_ksys_write+0x10/0x10 [ 410.120947][T17151] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 410.120966][T17151] do_syscall_64+0x174/0x580 [ 410.120987][T17151] ? clear_bhb_loop+0x40/0x90 [ 410.121008][T17151] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 410.121024][T17151] RIP: 0033:0x7fccefd9ce59 [ 410.121041][T17151] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 410.121055][T17151] RSP: 002b:00007fccf0d3a028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 410.121073][T17151] RAX: ffffffffffffffda RBX: 00007fccf0015fa0 RCX: 00007fccefd9ce59 [ 410.121086][T17151] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000005 [ 410.121096][T17151] RBP: 00007fccf0d3a090 R08: 0000000000000000 R09: 0000000000000000 [ 410.121114][T17151] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 410.121124][T17151] R13: 00007fccf0016038 R14: 00007fccf0015fa0 R15: 00007ffd0e9fc418 [ 410.121152][T17151] [ 410.331879][T17149] netlink: 28 bytes leftover after parsing attributes in process `syz.4.3060'. [ 410.341687][ T7559] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 410.351730][ T7559] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 410.422373][T17154] netlink: 72 bytes leftover after parsing attributes in process `syz.1.3063'. [ 410.446080][ T7559] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 410.480103][ T7559] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 410.599377][ T4944] Bluetooth: hci3: command tx timeout [ 410.610029][T17166] netlink: 104 bytes leftover after parsing attributes in process `syz.0.3064'. [ 410.680978][ T4960] block nbd4: Possible stuck request ffff888027cce000: control (read@0,1024B). Runtime 60 seconds [ 410.691736][ T4960] block nbd4: Possible stuck request ffff888027cce1c0: control (read@1024,1024B). Runtime 60 seconds [ 410.712557][ T4960] block nbd4: Possible stuck request ffff888027cce380: control (read@2048,1024B). Runtime 60 seconds [ 410.724108][ T4960] block nbd4: Possible stuck request ffff888027cce540: control (read@3072,1024B). Runtime 60 seconds [ 410.818600][ T7559] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 410.833743][ T7559] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 410.904487][ T4944] block nbd6: Receive control failed (result -32) [ 410.905689][ T5637] block nbd6: Receive control failed (result -32) [ 411.045976][T17183] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3070'. [ 411.066121][T17183] xt_hashlimit: size too large, truncated to 1048576 [ 411.231600][T17187] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3070'. [ 411.276480][T17187] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3070'. [ 411.360141][ T12] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 411.374670][ T12] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 411.467148][ T4944] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 411.487714][ T4944] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 411.504570][ T4944] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 411.524180][ T4944] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 411.534923][ T4944] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 411.950629][ T7559] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 411.965689][ T7559] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 412.107652][T17217] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci0/hci0:200/input9 [ 412.265687][T17200] bridge0: port 2(bridge_slave_1) entered disabled state [ 412.273200][T17200] bridge0: port 1(bridge_slave_0) entered disabled state [ 412.543158][ T57] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 412.557928][ T57] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 412.623666][T17200] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 412.665213][T17200] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 412.679106][ T5637] Bluetooth: hci3: command tx timeout [ 413.029783][T17200] __nla_validate_parse: 150 callbacks suppressed [ 413.029806][T17200] netlink: 36 bytes leftover after parsing attributes in process `syz.2.3075'. [ 413.045673][T17200] netlink: 36 bytes leftover after parsing attributes in process `syz.2.3075'. [ 413.055144][T17200] netlink: 36 bytes leftover after parsing attributes in process `syz.2.3075'. [ 413.188113][ T3374] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 413.230672][ T3374] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 413.263857][ T3374] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 413.292122][ T3374] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 413.493673][T17192] xfrm0 speed is unknown, defaulting to 1000 [ 413.599830][T17251] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3085'. [ 413.642415][ T5637] Bluetooth: hci0: command tx timeout [ 413.782398][T17256] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3086'. [ 413.799703][T17261] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3087'. [ 413.974918][T17192] lo speed is unknown, defaulting to 1000 [ 413.984949][T17267] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3088'. [ 414.380430][T17289] RDS: rds_bind could not find a transport for 2001::1, load rds_tcp or rds_rdma? [ 414.413341][T17290] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3094'. [ 414.505693][T17284] netlink: 'syz.2.3094': attribute type 1 has an invalid length. [ 414.732713][T17192] bridge0: port 1(bridge_slave_0) entered blocking state [ 414.741560][T17192] bridge0: port 1(bridge_slave_0) entered disabled state [ 414.751842][T17192] bridge_slave_0: entered allmulticast mode [ 414.761446][T17192] bridge_slave_0: entered promiscuous mode [ 414.775702][T17192] bridge0: port 2(bridge_slave_1) entered blocking state [ 414.783849][T17192] bridge0: port 2(bridge_slave_1) entered disabled state [ 414.792931][T17192] bridge_slave_1: entered allmulticast mode [ 414.803141][T17192] bridge_slave_1: entered promiscuous mode [ 414.854548][T17192] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 414.870248][T17192] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 414.948893][T17192] team0: Port device team_slave_0 added [ 414.960690][T17192] team0: Port device team_slave_1 added [ 415.000811][T17192] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 415.008002][T17192] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 415.056053][T17192] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 415.076462][T17192] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 415.085299][T17192] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 415.112445][T17192] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 415.123259][ T1107] net_ratelimit: 8 callbacks suppressed [ 415.123278][ T1107] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 415.143875][ T1107] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 415.166508][T17314] openvswitch: netlink: nsh attribute has 4 unknown bytes. [ 415.206644][T17192] hsr_slave_0: entered promiscuous mode [ 415.240572][T17192] hsr_slave_1: entered promiscuous mode [ 415.259983][T17192] debugfs: 'hsr0' already exists in 'hsr' [ 415.278052][T17192] Cannot create hsr debugfs directory [ 415.437380][T17325] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3104'. [ 415.458548][T17325] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3104'. [ 415.469442][T17325] netlink: 'syz.2.3104': attribute type 15 has an invalid length. [ 415.678756][ T3374] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 415.693632][ T3374] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 415.721066][ T5637] Bluetooth: hci0: command tx timeout [ 416.220298][ T36] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 416.234770][ T36] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 416.533927][T17192] netdevsim netdevsim0 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 416.548128][T17192] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 416.559151][T17192] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 1] type 2 family 0 port 35256 - 0 [ 416.773338][T17192] netdevsim netdevsim0 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 416.797010][T17192] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 416.809724][T17192] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 1] type 2 family 0 port 35256 - 0 [ 416.820563][ T7554] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 416.836088][ T7554] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 416.914373][T17360] 5Ò: entered promiscuous mode [ 416.951509][T17192] team0: Port device netdevsim1 removed [ 416.964076][T17192] netdevsim netdevsim0 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 416.975243][T17192] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 416.985752][T17192] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 1] type 2 family 0 port 35256 - 0 [ 417.057089][T17368] netlink: 'syz.4.3116': attribute type 4 has an invalid length. [ 417.103697][ T7303] lo speed is unknown, defaulting to 1000 [ 417.110106][ T7303] syz2: Port: 1 Link DOWN [ 417.378783][ T36] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 417.799285][ T5637] Bluetooth: hci0: command tx timeout [ 418.652929][T17336] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 418.702915][T17192] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 418.746253][T17192] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 418.772045][T17192] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 418.803058][T17192] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 418.822937][T17374] xt_connbytes: Forcing CT accounting to be enabled [ 418.834513][T17374] ip6t_REJECT: TCP_RESET illegal for non-tcp [ 418.851365][T17192] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 418.956360][T17192] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 418.970845][T17375] syzkaller1: entered allmulticast mode [ 418.981953][T17192] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 419.072368][T17192] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 419.382891][T17192] 8021q: adding VLAN 0 to HW filter on device bond0 [ 419.407274][T17410] netlink: 20 bytes leftover after parsing attributes in process `syz.2.3127'. [ 419.449967][T17410] syzkaller1: entered promiscuous mode [ 419.462327][T17410] syzkaller1: entered allmulticast mode [ 419.482002][T17192] 8021q: adding VLAN 0 to HW filter on device team0 [ 419.539345][ T36] bridge0: port 1(bridge_slave_0) entered blocking state [ 419.546577][ T36] bridge0: port 1(bridge_slave_0) entered forwarding state [ 419.591441][ T36] bridge0: port 2(bridge_slave_1) entered blocking state [ 419.598729][ T36] bridge0: port 2(bridge_slave_1) entered forwarding state [ 419.710639][T17423] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3131'. [ 419.725264][T17423] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3131'. [ 419.886596][ T5637] Bluetooth: hci0: command tx timeout [ 420.021534][T17438] Bluetooth: MGMT ver 1.23 [ 420.131644][T17446] x_tables: duplicate underflow at hook 1 [ 420.442984][T17463] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3138'. [ 420.462860][ T7554] net_ratelimit: 11 callbacks suppressed [ 420.462879][ T7554] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 420.483065][ T7554] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 420.542179][T17192] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 420.676749][T17192] veth0_vlan: entered promiscuous mode [ 420.739713][T17192] veth1_vlan: entered promiscuous mode [ 420.824066][T17192] veth0_macvtap: entered promiscuous mode [ 420.859035][T17192] veth1_macvtap: entered promiscuous mode [ 420.933850][T17192] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 420.994111][T17192] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 421.046572][ T12] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 421.070660][ T57] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 421.085276][ T57] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 421.106790][ T12] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 421.125865][ T12] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 421.135247][ T12] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 421.475978][T17504] block nbd2: reconnected socket [ 421.483081][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 421.493151][T17504] netlink: 48 bytes leftover after parsing attributes in process `syz.2.3149'. [ 421.502708][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 421.525801][ T5637] block nbd2: Receive control failed (result -32) [ 421.560277][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 421.627628][ T57] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 421.642129][ T1107] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 421.656513][ T1107] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 421.688774][ T57] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 422.014181][T17518] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 422.185490][T17546] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3157'. [ 422.248940][ T12] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 422.263390][ T12] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 422.410073][T17551] netlink: 'syz.3.3161': attribute type 1 has an invalid length. [ 422.457846][T17551] 8021q: adding VLAN 0 to HW filter on device bond1 [ 422.521574][T17555] bond1: (slave veth3): Enslaving as an active interface with a down link [ 422.617087][T17557] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3163'. [ 422.640367][T17551] bond1: (slave dummy0): making interface the new active one [ 422.660730][T17551] dummy0: entered promiscuous mode [ 422.666454][T17551] bond1: (slave dummy0): Enslaving as an active interface with an up link [ 422.868849][ T12] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 422.883320][ T12] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 422.907950][T17564] mac80211_hwsim hwsim47 syzkaller0: Caught tx_queue_len zero misconfig [ 423.169018][T17577] netlink: 48 bytes leftover after parsing attributes in process `syz.2.3171'. [ 423.205192][T17576] netlink: 68 bytes leftover after parsing attributes in process `syz.1.3172'. [ 423.225837][T17576] netlink: 64 bytes leftover after parsing attributes in process `syz.1.3172'. [ 424.476798][T17635] __nla_validate_parse: 3 callbacks suppressed [ 424.476819][T17635] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3185'. [ 424.643406][T17644] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3187'. [ 424.657174][T17645] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3188'. [ 424.702455][T17645] mac80211_hwsim hwsim47 syzkaller0: entered promiscuous mode [ 424.711194][T17645] mac80211_hwsim hwsim47 syzkaller0: entered allmulticast mode [ 424.891311][T17651] netlink: 40 bytes leftover after parsing attributes in process `syz.0.3190'. [ 424.920960][T17653] netlink: 52 bytes leftover after parsing attributes in process `syz.2.3191'. [ 424.980896][T17653] xfrm0 speed is unknown, defaulting to 1000 [ 425.350581][T17653] lo speed is unknown, defaulting to 1000 [ 425.519447][ T36] net_ratelimit: 8 callbacks suppressed [ 425.519463][ T36] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 425.539464][ T36] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 425.801101][T17678] netlink: 68 bytes leftover after parsing attributes in process `syz.1.3200'. [ 425.880291][T17677] netlink: 68 bytes leftover after parsing attributes in process `syz.1.3200'. [ 425.978061][T17686] netlink: 212368 bytes leftover after parsing attributes in process `syz.3.3202'. [ 426.080933][T17684] tipc: Started in network mode [ 426.089222][ T57] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 426.103720][ T57] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 426.129532][T17684] tipc: Node identity 328578e0ac72, cluster identity 4711 [ 426.137440][T17684] tipc: Enabled bearer , priority 0 [ 426.195676][ T4944] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 426.196719][T17683] tipc: Disabling bearer [ 426.216231][ T4944] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 426.232338][ T4944] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 426.240544][ T4944] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 426.250143][ T4944] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 426.275413][ T5637] [ 426.277801][ T5637] ====================================================== [ 426.284820][ T5637] WARNING: possible circular locking dependency detected [ 426.291875][ T5637] syzkaller #0 Not tainted [ 426.296275][ T5637] ------------------------------------------------------ [ 426.303290][ T5637] kworker/u9:3/5637 is trying to acquire lock: [ 426.309440][ T5637] ffff88801be85210 (&root->kernfs_iattr_rwsem){++++}-{4:4}, at: kernfs_link_sibling+0x4c7/0x5a0 [ 426.320047][ T5637] [ 426.320047][ T5637] but task is already holding lock: [ 426.327403][ T5637] ffff88801be85180 (&root->kernfs_rwsem){++++}-{4:4}, at: kernfs_add_one+0x41/0x5d0 [ 426.336803][ T5637] [ 426.336803][ T5637] which lock already depends on the new lock. [ 426.336803][ T5637] [ 426.347211][ T5637] [ 426.347211][ T5637] the existing dependency chain (in reverse order) is: [ 426.356223][ T5637] [ 426.356223][ T5637] -> #9 (&root->kernfs_rwsem){++++}-{4:4}: [ 426.364212][ T5637] down_write+0x96/0x200 [ 426.369056][ T5637] kernfs_add_one+0x41/0x5d0 [ 426.374184][ T5637] kernfs_create_dir_ns+0xde/0x130 [ 426.379814][ T5637] internal_create_group+0x440/0x1180 [ 426.385700][ T5637] cpuhp_invoke_callback+0x448/0x860 [ 426.391582][ T5637] cpuhp_issue_call+0x3f0/0x750 [ 426.396981][ T5637] __cpuhp_setup_state_cpuslocked+0x3f4/0x6f0 [ 426.403561][ T5637] __cpuhp_setup_state+0x3f/0x60 [ 426.409017][ T5637] do_one_initcall+0x250/0x870 [ 426.414301][ T5637] do_initcall_level+0x10a/0x1a0 [ 426.419814][ T5637] do_initcalls+0x59/0xa0 [ 426.424738][ T5637] kernel_init_freeable+0x29d/0x3e0 [ 426.430445][ T5637] kernel_init+0x1d/0x1d0 [ 426.435288][ T5637] ret_from_fork+0x514/0xb70 [ 426.440431][ T5637] ret_from_fork_asm+0x1a/0x30 [ 426.445707][ T5637] [ 426.445707][ T5637] -> #8 (cpuhp_state_mutex){+.+.}-{4:4}: [ 426.453515][ T5637] [ 426.453515][ T5637] -> #7 (cpu_hotplug_lock){++++}-{0:0}: [ 426.461233][ T5637] cpus_read_lock+0x42/0x160 [ 426.466339][ T5637] static_key_slow_inc+0x12/0x30 [ 426.471830][ T5637] nbd_genl_reconfigure+0x1301/0x1e80 [ 426.477838][ T5637] genl_family_rcv_msg_doit+0x233/0x340 [ 426.484005][ T5637] genl_rcv_msg+0x614/0x7a0 [ 426.489033][ T5637] netlink_rcv_skb+0x226/0x4a0 [ 426.494305][ T5637] genl_rcv+0x28/0x40 [ 426.498800][ T5637] netlink_unicast+0x7bb/0x940 [ 426.504081][ T5637] netlink_sendmsg+0x813/0xb40 [ 426.509468][ T5637] ____sys_sendmsg+0x9b9/0xa20 [ 426.514741][ T5637] ___sys_sendmsg+0x2a5/0x360 [ 426.519931][ T5637] __x64_sys_sendmsg+0x1bd/0x2a0 [ 426.525426][ T5637] do_syscall_64+0x174/0x580 [ 426.530550][ T5637] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 426.536964][ T5637] [ 426.536964][ T5637] -> #6 (&nsock->tx_lock){+.+.}-{4:4}: [ 426.544612][ T5637] __mutex_lock+0x19d/0x1590 [ 426.549722][ T5637] nbd_queue_rq+0x373/0x1150 [ 426.554831][ T5637] blk_mq_dispatch_rq_list+0x499/0x1990 [ 426.560990][ T5637] __blk_mq_sched_dispatch_requests+0xd36/0x1580 [ 426.567880][ T5637] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 426.574373][ T5637] blk_mq_run_hw_queue+0x348/0x4f0 [ 426.580008][ T5637] blk_mq_dispatch_list+0xd11/0xe10 [ 426.585812][ T5637] blk_mq_flush_plug_list+0x45f/0x540 [ 426.591713][ T5637] __blk_flush_plug+0x3ed/0x4d0 [ 426.597699][ T5637] __submit_bio+0x465/0x560 [ 426.602727][ T5637] submit_bio_noacct_nocheck+0x2f4/0xa40 [ 426.608883][ T5637] block_read_full_folio+0x599/0x830 [ 426.614732][ T5637] filemap_read_folio+0x12c/0x3a0 [ 426.620295][ T5637] do_read_cache_folio+0x354/0x590 [ 426.625948][ T5637] read_part_sector+0xb6/0x2b0 [ 426.631324][ T5637] adfspart_check_ICS+0xb1/0x960 [ 426.636801][ T5637] bdev_disk_changed+0x82b/0x1780 [ 426.642344][ T5637] blkdev_get_whole+0x372/0x510 [ 426.647772][ T5637] bdev_open+0x324/0xd70 [ 426.652530][ T5637] blkdev_open+0x461/0x600 [ 426.657461][ T5637] do_dentry_open+0x816/0x1380 [ 426.662744][ T5637] vfs_open+0x3b/0x340 [ 426.667350][ T5637] path_openat+0x2e3b/0x3890 [ 426.672458][ T5637] do_file_open+0x23e/0x4a0 [ 426.677482][ T5637] do_sys_openat2+0x113/0x200 [ 426.682689][ T5637] __x64_sys_openat+0x138/0x170 [ 426.688051][ T5637] do_syscall_64+0x174/0x580 [ 426.693155][ T5637] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 426.699564][ T5637] [ 426.699564][ T5637] -> #5 (&cmd->lock){+.+.}-{4:4}: [ 426.706771][ T5637] __mutex_lock+0x19d/0x1590 [ 426.711877][ T5637] nbd_queue_rq+0xc1/0x1150 [ 426.716899][ T5637] blk_mq_dispatch_rq_list+0x499/0x1990 [ 426.722958][ T5637] __blk_mq_sched_dispatch_requests+0xd36/0x1580 [ 426.729825][ T5637] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 426.736318][ T5637] blk_mq_run_hw_queue+0x348/0x4f0 [ 426.741940][ T5637] blk_mq_dispatch_list+0xd11/0xe10 [ 426.747738][ T5637] blk_mq_flush_plug_list+0x45f/0x540 [ 426.753621][ T5637] __blk_flush_plug+0x3ed/0x4d0 [ 426.758986][ T5637] __submit_bio+0x465/0x560 [ 426.764001][ T5637] submit_bio_noacct_nocheck+0x2f4/0xa40 [ 426.770146][ T5637] block_read_full_folio+0x599/0x830 [ 426.775943][ T5637] filemap_read_folio+0x12c/0x3a0 [ 426.781487][ T5637] do_read_cache_folio+0x354/0x590 [ 426.787113][ T5637] read_part_sector+0xb6/0x2b0 [ 426.792405][ T5637] adfspart_check_ICS+0xb1/0x960 [ 426.797854][ T5637] bdev_disk_changed+0x82b/0x1780 [ 426.803471][ T5637] blkdev_get_whole+0x372/0x510 [ 426.808831][ T5637] bdev_open+0x324/0xd70 [ 426.813602][ T5637] blkdev_open+0x461/0x600 [ 426.818532][ T5637] do_dentry_open+0x816/0x1380 [ 426.823818][ T5637] vfs_open+0x3b/0x340 [ 426.828409][ T5637] path_openat+0x2e3b/0x3890 [ 426.833520][ T5637] do_file_open+0x23e/0x4a0 [ 426.838621][ T5637] do_sys_openat2+0x113/0x200 [ 426.843807][ T5637] __x64_sys_openat+0x138/0x170 [ 426.849175][ T5637] do_syscall_64+0x174/0x580 [ 426.854291][ T5637] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 426.860692][ T5637] [ 426.860692][ T5637] -> #4 (set->srcu){.+.+}-{0:0}: [ 426.867808][ T5637] __synchronize_srcu+0xc9/0x2f0 [ 426.873313][ T5637] elevator_switch+0x1e8/0x7b0 [ 426.878682][ T5637] elevator_change+0x2fa/0x480 [ 426.884237][ T5637] elevator_set_default+0x375/0x440 [ 426.889980][ T5637] blk_register_queue+0x3f3/0x4e0 [ 426.895521][ T5637] __add_disk+0x6cb/0xe30 [ 426.900375][ T5637] add_disk_fwnode+0xfb/0x4b0 [ 426.905614][ T5637] nbd_dev_add+0x733/0xb60 [ 426.910634][ T5637] nbd_init+0x15f/0x1e0 [ 426.915390][ T5637] do_one_initcall+0x250/0x870 [ 426.920681][ T5637] do_initcall_level+0x10a/0x1a0 [ 426.926133][ T5637] do_initcalls+0x59/0xa0 [ 426.931063][ T5637] kernel_init_freeable+0x29d/0x3e0 [ 426.936794][ T5637] kernel_init+0x1d/0x1d0 [ 426.941642][ T5637] ret_from_fork+0x514/0xb70 [ 426.946745][ T5637] ret_from_fork_asm+0x1a/0x30 [ 426.952121][ T5637] [ 426.952121][ T5637] -> #3 (&q->elevator_lock){+.+.}-{4:4}: [ 426.959950][ T5637] __mutex_lock+0x19d/0x1590 [ 426.965056][ T5637] elevator_change+0x1af/0x480 [ 426.970329][ T5637] elevator_set_none+0xb5/0x140 [ 426.975707][ T5637] blk_mq_update_nr_hw_queues+0x5ef/0x19f0 [ 426.982059][ T5637] nbd_start_device+0x189/0xb30 [ 426.987428][ T5637] nbd_genl_connect+0x1597/0x1c10 [ 426.992980][ T5637] genl_family_rcv_msg_doit+0x233/0x340 [ 426.999150][ T5637] genl_rcv_msg+0x614/0x7a0 [ 427.004167][ T5637] netlink_rcv_skb+0x226/0x4a0 [ 427.009439][ T5637] genl_rcv+0x28/0x40 [ 427.013933][ T5637] netlink_unicast+0x7bb/0x940 [ 427.019216][ T5637] netlink_sendmsg+0x813/0xb40 [ 427.024492][ T5637] ____sys_sendmsg+0x9b9/0xa20 [ 427.029765][ T5637] ___sys_sendmsg+0x2a5/0x360 [ 427.034956][ T5637] __x64_sys_sendmsg+0x1bd/0x2a0 [ 427.040405][ T5637] do_syscall_64+0x174/0x580 [ 427.045506][ T5637] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 427.051904][ T5637] [ 427.051904][ T5637] -> #2 (&q->q_usage_counter(io)#52){++++}-{0:0}: [ 427.060507][ T5637] blk_alloc_queue+0x544/0x690 [ 427.065785][ T5637] __blk_mq_alloc_disk+0x194/0x390 [ 427.071429][ T5637] nbd_dev_add+0x494/0xb60 [ 427.076423][ T5637] nbd_init+0x15f/0x1e0 [ 427.081093][ T5637] do_one_initcall+0x250/0x870 [ 427.086393][ T5637] do_initcall_level+0x10a/0x1a0 [ 427.091838][ T5637] do_initcalls+0x59/0xa0 [ 427.096676][ T5637] kernel_init_freeable+0x29d/0x3e0 [ 427.102383][ T5637] kernel_init+0x1d/0x1d0 [ 427.107229][ T5637] ret_from_fork+0x514/0xb70 [ 427.112326][ T5637] ret_from_fork_asm+0x1a/0x30 [ 427.117598][ T5637] [ 427.117598][ T5637] -> #1 (fs_reclaim){+.+.}-{0:0}: [ 427.124802][ T5637] fs_reclaim_acquire+0x71/0x100 [ 427.130323][ T5637] kmem_cache_alloc_noprof+0x40/0x650 [ 427.136237][ T5637] __kernfs_iattrs+0xdd/0x340 [ 427.141449][ T5637] kernfs_iop_setattr+0xe6/0x3f0 [ 427.146927][ T5637] notify_change+0xbba/0xea0 [ 427.152055][ T5637] do_truncate+0x1c2/0x250 [ 427.157036][ T5637] path_openat+0x2fbd/0x3890 [ 427.162150][ T5637] do_file_open+0x23e/0x4a0 [ 427.167220][ T5637] do_sys_openat2+0x113/0x200 [ 427.172427][ T5637] __x64_sys_openat+0x138/0x170 [ 427.177805][ T5637] do_syscall_64+0x174/0x580 [ 427.182906][ T5637] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 427.189312][ T5637] [ 427.189312][ T5637] -> #0 (&root->kernfs_iattr_rwsem){++++}-{4:4}: [ 427.197816][ T5637] __lock_acquire+0x1520/0x2cd0 [ 427.203179][ T5637] lock_acquire+0x106/0x350 [ 427.208193][ T5637] down_write+0x96/0x200 [ 427.212954][ T5637] kernfs_link_sibling+0x4c7/0x5a0 [ 427.218586][ T5637] kernfs_add_one+0x1d2/0x5d0 [ 427.223797][ T5637] kernfs_create_dir_ns+0xde/0x130 [ 427.229444][ T5637] sysfs_create_dir_ns+0x12f/0x2a0 [ 427.235072][ T5637] kobject_add_internal+0x622/0xcd0 [ 427.240901][ T5637] kobject_add+0x163/0x240 [ 427.245831][ T5637] device_add+0x3fa/0xb90 [ 427.250777][ T5637] hci_conn_add_sysfs+0xd5/0x210 [ 427.256327][ T5637] hci_conn_complete_evt+0x8a8/0x1350 [ 427.262273][ T5637] hci_event_packet+0x6cd/0xf10 [ 427.267657][ T5637] hci_rx_work+0x3ee/0x1020 [ 427.272750][ T5637] process_scheduled_works+0xa8e/0x14e0 [ 427.278817][ T5637] worker_thread+0xa47/0xfb0 [ 427.283916][ T5637] kthread+0x389/0x470 [ 427.288499][ T5637] ret_from_fork+0x514/0xb70 [ 427.293716][ T5637] ret_from_fork_asm+0x1a/0x30 [ 427.298994][ T5637] [ 427.298994][ T5637] other info that might help us debug this: [ 427.298994][ T5637] [ 427.309216][ T5637] Chain exists of: [ 427.309216][ T5637] &root->kernfs_iattr_rwsem --> cpuhp_state_mutex --> &root->kernfs_rwsem [ 427.309216][ T5637] [ 427.323652][ T5637] Possible unsafe locking scenario: [ 427.323652][ T5637] [ 427.331096][ T5637] CPU0 CPU1 [ 427.336448][ T5637] ---- ---- [ 427.341799][ T5637] lock(&root->kernfs_rwsem); [ 427.346555][ T5637] lock(cpuhp_state_mutex); [ 427.353654][ T5637] lock(&root->kernfs_rwsem); [ 427.360953][ T5637] lock(&root->kernfs_iattr_rwsem); [ 427.366248][ T5637] [ 427.366248][ T5637] *** DEADLOCK *** [ 427.366248][ T5637] [ 427.374384][ T5637] 4 locks held by kworker/u9:3/5637: [ 427.379652][ T5637] #0: ffff888057c26140 ((wq_completion)hci1#2){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 [ 427.390619][ T5637] #1: ffffc9000472fc40 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 [ 427.402612][ T5637] #2: ffff8880811580b8 (&hdev->lock){+.+.}-{4:4}, at: hci_conn_complete_evt+0xba/0x1350 [ 427.412435][ T5637] #3: ffff88801be85180 (&root->kernfs_rwsem){++++}-{4:4}, at: kernfs_add_one+0x41/0x5d0 [ 427.422266][ T5637] [ 427.422266][ T5637] stack backtrace: [ 427.428177][ T5637] CPU: 0 UID: 0 PID: 5637 Comm: kworker/u9:3 Not tainted syzkaller #0 PREEMPT(full) [ 427.428196][ T5637] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 427.428206][ T5637] Workqueue: hci1 hci_rx_work [ 427.428225][ T5637] Call Trace: [ 427.428234][ T5637] [ 427.428242][ T5637] dump_stack_lvl+0xe8/0x150 [ 427.428260][ T5637] print_circular_bug+0x2e1/0x300 [ 427.428281][ T5637] check_noncircular+0x12e/0x150 [ 427.428302][ T5637] __lock_acquire+0x1520/0x2cd0 [ 427.428321][ T5637] ? __lock_acquire+0x683/0x2cd0 [ 427.428341][ T5637] ? kernfs_link_sibling+0x4c7/0x5a0 [ 427.428362][ T5637] lock_acquire+0x106/0x350 [ 427.428377][ T5637] ? kernfs_link_sibling+0x4c7/0x5a0 [ 427.428402][ T5637] down_write+0x96/0x200 [ 427.428438][ T5637] ? kernfs_link_sibling+0x4c7/0x5a0 [ 427.428459][ T5637] ? __pfx_down_write+0x10/0x10 [ 427.428477][ T5637] ? kernfs_root+0x1c/0x230 [ 427.428494][ T5637] ? kernfs_root+0x1c/0x230 [ 427.428517][ T5637] ? kernfs_root+0x1ea/0x230 [ 427.428535][ T5637] kernfs_link_sibling+0x4c7/0x5a0 [ 427.428559][ T5637] kernfs_add_one+0x1d2/0x5d0 [ 427.428580][ T5637] kernfs_create_dir_ns+0xde/0x130 [ 427.428602][ T5637] sysfs_create_dir_ns+0x12f/0x2a0 [ 427.428621][ T5637] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 427.428640][ T5637] ? do_raw_spin_unlock+0xf5/0x210 [ 427.428666][ T5637] kobject_add_internal+0x622/0xcd0 [ 427.428690][ T5637] kobject_add+0x163/0x240 [ 427.428710][ T5637] ? __pfx_kobject_add+0x10/0x10 [ 427.428730][ T5637] ? get_device_parent+0x366/0x3a0 [ 427.428754][ T5637] device_add+0x3fa/0xb90 [ 427.428776][ T5637] hci_conn_add_sysfs+0xd5/0x210 [ 427.428801][ T5637] hci_conn_complete_evt+0x8a8/0x1350 [ 427.428818][ T5637] ? __pfx_hci_conn_complete_evt+0x10/0x10 [ 427.428834][ T5637] ? skb_pull_data+0xf0/0x200 [ 427.428853][ T5637] hci_event_packet+0x6cd/0xf10 [ 427.428870][ T5637] ? __pfx_hci_conn_complete_evt+0x10/0x10 [ 427.428885][ T5637] ? __pfx_hci_event_packet+0x10/0x10 [ 427.428901][ T5637] ? tag_mounts+0x14f0/0x1600 [ 427.428956][ T5637] ? hci_send_to_monitor+0xe2/0x590 [ 427.428976][ T5637] hci_rx_work+0x3ee/0x1020 [ 427.428994][ T5637] ? process_scheduled_works+0xa20/0x14e0 [ 427.429009][ T5637] process_scheduled_works+0xa8e/0x14e0 [ 427.429034][ T5637] ? __pfx_process_scheduled_works+0x10/0x10 [ 427.429051][ T5637] ? assign_work+0x3cf/0x5d0 [ 427.429067][ T5637] worker_thread+0xa47/0xfb0 [ 427.429092][ T5637] kthread+0x389/0x470 [ 427.429110][ T5637] ? __pfx_worker_thread+0x10/0x10 [ 427.429124][ T5637] ? __pfx_kthread+0x10/0x10 [ 427.429142][ T5637] ret_from_fork+0x514/0xb70 [ 427.429159][ T5637] ? __pfx_ret_from_fork+0x10/0x10 [ 427.429173][ T5637] ? __switch_to+0xc89/0x1420 [ 427.429195][ T5637] ? __pfx_kthread+0x10/0x10 [ 427.429213][ T5637] ret_from_fork_asm+0x1a/0x30 [ 427.429237][ T5637] SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 427.743639][T17692] ieee80211 phy56: Selected rate control algorithm 'minstrel_ht' [ 427.789360][T17698] netlink: 260 bytes leftover after parsing attributes in process `syz.2.3204'. [ 427.802500][ T1107] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 427.817440][ T1107] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 428.378796][ T7554] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 428.393133][ T7554] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 428.607701][ T3374] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 428.643285][ T3374] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 428.701236][ T3374] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 428.752634][ T3374] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 428.837617][ T3374] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 428.874195][ T3374] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 428.935458][ T3374] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 428.979017][ T7559] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 428.993539][ T7559] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 429.012573][ T3374] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 429.099636][ T5290] 8021q: adding VLAN 0 to HW filter on device eth1 [ 429.136835][ T3374] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 429.184769][ T3374] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 429.219594][ T3374] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 429.282156][ T3374] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 429.373836][ T3374] bridge_slave_1: left allmulticast mode [ 429.380053][ T3374] bridge_slave_1: left promiscuous mode [ 429.386513][ T3374] bridge0: port 2(bridge_slave_1) entered disabled state [ 429.397264][ T3374] bridge_slave_0: left allmulticast mode [ 429.403296][ T3374] bridge_slave_0: left promiscuous mode [ 429.409584][ T3374] bridge0: port 1(bridge_slave_0) entered disabled state [ 429.421871][ T3374] bridge_slave_1: left allmulticast mode [ 429.427603][ T3374] bridge_slave_1: left promiscuous mode [ 429.433679][ T3374] bridge0: port 2(bridge_slave_1) entered disabled state [ 429.443442][ T3374] bridge_slave_0: left allmulticast mode [ 429.449252][ T3374] bridge_slave_0: left promiscuous mode [ 429.454898][ T3374] bridge0: port 1(bridge_slave_0) entered disabled state [ 429.465497][ T3374] bridge_slave_1: left allmulticast mode [ 429.471447][ T3374] bridge_slave_1: left promiscuous mode [ 429.477191][ T3374] bridge0: port 2(bridge_slave_1) entered disabled state [ 429.485692][ T3374] bridge_slave_0: left allmulticast mode [ 429.491803][ T3374] bridge_slave_0: left promiscuous mode [ 429.497480][ T3374] bridge0: port 1(bridge_slave_0) entered disabled state [ 429.596703][ T3374] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 429.608969][ T3374] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 429.618959][ T3374] bond0 (unregistering): Released all slaves [ 429.647811][ T3374] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 429.658162][ T3374] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 429.669448][ T3374] bond0 (unregistering): Released all slaves [ 429.714688][ T3374] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 429.726044][ T3374] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 429.736389][ T3374] bond0 (unregistering): Released all slaves [ 429.744776][ T3374] bond1 (unregistering): (slave veth3): Releasing active interface [ 429.754373][ T3374] bond1 (unregistering): (slave dummy0): Releasing active interface [ 429.763603][ T3374] bond1 (unregistering): Released all slaves [ 429.773905][ T5290] 8021q: adding VLAN 0 to HW filter on device eth2 [ 429.861692][ T3374] 5Ò: left promiscuous mode [ 429.890105][ T3374] tipc: Left network mode [ 430.054232][ T5290] 8021q: adding VLAN 0 to HW filter on device eth3 [ 430.290783][ T5290] 8021q: adding VLAN 0 to HW filter on device eth4 [ 430.541927][ T7559] net_ratelimit: 4 callbacks suppressed [ 430.541944][ T7559] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 430.562354][ T7559] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 430.653876][ T5290] 8021q: adding VLAN 0 to HW filter on device eth5 [ 430.734937][ T3374] hsr_slave_0: left promiscuous mode [ 430.745562][ T3374] hsr_slave_1: left promiscuous mode [ 430.751879][ T3374] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 430.759671][ T3374] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 430.767581][ T3374] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 430.776176][ T3374] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 430.787721][ T3374] hsr_slave_0: left promiscuous mode [ 430.793997][ T3374] hsr_slave_1: left promiscuous mode [ 430.800111][ T3374] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 430.807525][ T3374] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 430.815613][ T3374] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 430.830471][ T3374] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 430.842961][ T3374] hsr_slave_0: left promiscuous mode [ 430.849033][ T3374] hsr_slave_1: left promiscuous mode [ 430.854949][ T3374] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 430.863336][ T3374] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 430.871715][ T3374] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 430.879454][ T3374] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 430.896312][ T3374] veth1_macvtap: left promiscuous mode [ 430.902070][ T3374] veth0_macvtap: left promiscuous mode [ 430.907655][ T3374] veth1_vlan: left promiscuous mode [ 430.913729][ T3374] veth0_vlan: left promiscuous mode [ 430.920886][ T3374] veth1_macvtap: left promiscuous mode [ 430.926432][ T3374] veth0_macvtap: left promiscuous mode [ 430.932557][ T3374] veth1_vlan: left promiscuous mode [ 430.937880][ T3374] veth0_vlan: left promiscuous mode [ 430.944274][ T3374] veth1_macvtap: left promiscuous mode [ 430.950242][ T3374] veth0_macvtap: left promiscuous mode [ 430.955856][ T3374] veth1_vlan: left promiscuous mode [ 430.961642][ T3374] veth0_vlan: left promiscuous mode [ 431.124808][ T1107] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 431.139297][ T1107] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 431.193978][ T3374] team0 (unregistering): Port device team_slave_1 removed [ 431.207756][ T3374] team0 (unregistering): Port device team_slave_0 removed [ 431.305798][ T3374] team0 (unregistering): Port device team_slave_1 removed [ 431.322316][ T3374] team0 (unregistering): Port device team_slave_0 removed [ 431.426502][ T3374] team0 (unregistering): Port device team_slave_1 removed [ 431.452265][ T3374] team0 (unregistering): Port device team_slave_0 removed [ 431.491047][ T5290] 8021q: adding VLAN 0 to HW filter on device eth6 [ 431.658961][ T1107] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 431.673625][ T1107] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 431.887210][ T5290] 8021q: adding VLAN 0 to HW filter on device eth7 [ 432.184081][ T5290] 8021q: adding VLAN 0 to HW filter on device eth8 [ 432.199090][ T1107] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 432.213437][ T1107] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 432.418953][ T5290] 8021q: adding VLAN 0 to HW filter on device eth9 [ 432.622030][ T5290] 8021q: adding VLAN 0 to HW filter on device eth10 [ 432.769427][ T3374] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 432.784272][ T3374] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 432.841258][ T5290] 8021q: adding VLAN 0 to HW filter on device eth11 [ 433.050617][ T5290] 8021q: adding VLAN 0 to HW filter on device eth12 [ 435.372020][ T4995] udevd[4995]: worker [9285] /devices/virtual/block/nbd4 is taking a long time [ 435.858552][ T3374] net_ratelimit: 10 callbacks suppressed [ 435.858570][ T3374] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 435.878864][ T3374] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01