last executing test programs: 2m49.872048466s ago: executing program 2 (id=1692): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0x6, 0xe, &(0x7f00000008c0)=ANY=[@ANYBLOB="b7020000f10d0000bfa30000000000000703000000feffff7a0af0fff8ffff1971a4f0ff00000000b7060000080000006f6400000000000045040400010000001704000001000a00b7040000ff0100006a0a00fe0000000085000000be000000b70000000000000095000000000000009e17f199a68b06d83298a8cdc21ce784909b849d5550ad857d0454d8877a6db61d69f2ffcaa10350e11cb97c8adf1bc9a0c4eeceb9971e43405d621ffbc9ce000000d8ca56b50d0c010d631f6dde53a9a53608c10556e5734eb84049761451ce540c772e2d9f8004e26f7fcc059c062234d5595f6fbaa187b81d1106000000000fd60000fd9ac3d09e29a9d542ca9d85a5c9c88474895d679838def0a83a733dc6a39b63a5ed69d32394c53361d7e43c5cbd80450f859ce8122a79c3e40000b59b0fc46d6cec3c0802882add4e3179bd4a44f231b6d753a7be428ba953df4aece69311687f4122073a236c3a32efa04137d4524847d2638da3261c8162bb7c7824be6195a66d2e17e122040e1100000000928612a29fc691e4f1f7bd053abb885f39381f1759410b1059f05684261f332d606834669b49ec99320ca7712d7e79bd5bf5ed818ecc7640917f6a559a47db608fcf9f6c131b84e41c354c66838f72b9e12d36e996f316f0812ca83efb30c7f6c6d57c4a64590401eec22523dd712c680013e87f649a1ede7142ca9d5d8a8c9f9b440fe4331ad5532c74d9a31a5d737537f7a2caa30581253d14dd3e92af7dc836686365ae01bdec561c0402b67801267a8df97d2f85426a5963d4fa3e26cc05972c162f223f000000d999e80de00fcbcc02d0aed7bb8f7ba337d59c14f39dcd4aad4139ef6425a9367f1bd1467fc6b95a4df7669839771ce9d5788029901e5a79d8b9990ace8f74087f25ad50c46088000000008000"/686], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x3a, 0x10, &(0x7f0000000340), 0xd58495bc, 0x0, 0xffffffffffffffff, 0xffffffffffffff5b}, 0x42) (async) r2 = socket$netlink(0x10, 0x3, 0x0) (async, rerun: 64) close(0x3) (async, rerun: 64) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000040)={0x0, 0xffffffffffffffff, 0x0, 0x7, &(0x7f0000000000)='cgroup\x00', 0x0}, 0x30) (async, rerun: 32) r4 = socket$inet(0x2, 0x800, 0x0) (rerun: 32) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) (async) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0a000000010000003f0000004000000042000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYRES8=r0], 0x48) (async, rerun: 64) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000500)={'veth1\x00', &(0x7f0000000c40)=@ethtool_sset_info={0x37, 0x0, 0x18f, [0x3, 0x7, 0x3, 0x8, 0x200, 0x6, 0x1000, 0x87f, 0xd, 0x10001]}}) (rerun: 64) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080), &(0x7f0000000100), 0x1003, r5}, 0x38) (async) bpf$BPF_MAP_LOOKUP_AND_DELETE_ELEM(0x15, &(0x7f0000000000)={r5, &(0x7f00000006c0), 0x0}, 0x20) (async) unshare(0x20000400) (async, rerun: 64) sendmsg$nl_route(r2, 0x0, 0x4000) (async, rerun: 64) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000010c0)={0x11, 0xb, &(0x7f0000000c80)=ANY=[@ANYBLOB, @ANYRES16=r3, @ANYRES8=r4, @ANYRESOCT=r0], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x29, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000002c0)={&(0x7f0000000300)='sched_switch\x00', r6}, 0x10) (async) r7 = socket$alg(0x26, 0x5, 0x0) bind$alg(r7, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-camellia-asm\x00'}, 0x58) setsockopt$ALG_SET_KEY(r7, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) (async) r8 = accept4(r7, 0x0, 0x0, 0x800) sendmmsg$alg(r8, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x4, &(0x7f0000001fd8)=ANY=[@ANYBLOB="b7000000000000004e0000000000004040007400000000009500000003000000"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xb579, &(0x7f000000cf3d)=""/195}, 0x23) recvmsg(r8, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) (async) ioctl$ifreq_SIOCGIFINDEX_wireguard(r7, 0x8933, &(0x7f0000000600)={'wg2\x00', 0x0}) (async, rerun: 32) r10 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000001040)={&(0x7f0000000d00)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x104, 0x104, 0x9, [@ptr={0x7}, @datasec={0xa, 0x2, 0x0, 0xf, 0x1, [{0x5, 0xbfffffff, 0x1}, {0x4, 0x8, 0x5}], "ae"}, @union={0x0, 0x8, 0x0, 0x5, 0x1, 0x3, [{0x9, 0x2, 0x2}, {0xe, 0x5, 0x6}, {0xe, 0x3, 0x8}, {0xe, 0x2, 0x3}, {0x9, 0x0, 0x2}, {0x8, 0x0, 0x5}, {0x5, 0x5, 0x10001}, {0x3, 0x5, 0x10}]}, @enum={0x2, 0x8, 0x0, 0x6, 0x4, [{0xf, 0x5}, {0x9, 0x14000}, {0xa, 0x3}, {0x1, 0x3}, {0xd, 0xf}, {0x8, 0x4}, {0x7, 0x9}, {0x7, 0x5}]}, @datasec={0x7, 0x1, 0x0, 0xf, 0x3, [{0x2, 0x2, 0x1}], "968e4f"}]}, {0x0, [0x0, 0x2e, 0x0, 0x5f, 0x61, 0x0, 0x61]}}, &(0x7f0000000b80)=""/144, 0x125, 0x90, 0x0, 0x4bca, 0x10000}, 0x28) (rerun: 32) r11 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000e40)={0x1b, 0x0, 0x0, 0x8, 0x0, 0x1, 0x4c, '\x00', 0x0, 0xffffffffffffffff, 0x5, 0x3, 0x4}, 0x50) r12 = socket$kcm(0x10, 0x3, 0x10) sendmsg$kcm(r12, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)=[{&(0x7f0000000080)="1400000016000b63d25a80648c2566e506bce1e8", 0x14}], 0x1}, 0x0) r13 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000880)={0x0, 0x3, 0x10}, 0xc) (async) r14 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000ec0)=ANY=[@ANYBLOB="1b00000000000000000000000b00000000000000", @ANYRES32, @ANYBLOB="c90f00"/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000020000000500"/28], 0x50) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000f80)=@bpf_tracing={0x1a, 0x4, &(0x7f0000000540)=@raw=[@cb_func={0x18, 0x1, 0x4, 0x0, 0xfffffffffffffffe}, @generic={0x2, 0x1, 0xc, 0xe, 0x2d6}, @call={0x85, 0x0, 0x0, 0xd3}], &(0x7f0000000580)='GPL\x00', 0x7, 0x0, 0x0, 0x41000, 0x11, '\x00', r9, 0x18, r10, 0x8, &(0x7f0000000680)={0xa, 0x1}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x6, 0xa92}, 0x10, 0x28221, r1, 0x0, &(0x7f0000000f40)=[r11, r13, r14]}, 0x94) 2m49.660834224s ago: executing program 2 (id=1694): socket$packet(0x11, 0x3, 0x300) (async) r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r0, 0x107, 0xf, &(0x7f0000000080)=0xf3e, 0x62) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r2 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}) (async) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}) socket$inet6_tcp(0xa, 0x1, 0x0) write$tun(r1, &(0x7f00000002c0)={@val={0x0, 0x86dd}, @val={0x0, 0x1, 0x11, 0x4, 0x0, 0xca6}, @mpls={[], @ipv6=@gre_packet={0xe, 0x6, "ec00be", 0x44, 0x2f, 0xff, @local, @mcast2, {[], {{0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x88be, 0x0, 0x3}, {0x0, 0x0, 0x1, 0x1}, {0x1, 0x0, 0x1}, {0xa888, 0x88be, 0x2, {{0x6, 0x1, 0x9, 0x2, 0x1, 0x0, 0x3, 0x5}, 0x1, {0x8100}}}, {0x8, 0x22eb, 0x20000, {{0x0, 0x2, 0xc, 0x0, 0x0, 0x2, 0x7, 0x8}, 0x2, {0x2, 0x4, 0x0, 0x5, 0x1, 0x1, 0x1}}}, {0x8, 0x6558, 0x2}}}}}}, 0x7a) (async) write$tun(r1, &(0x7f00000002c0)={@val={0x0, 0x86dd}, @val={0x0, 0x1, 0x11, 0x4, 0x0, 0xca6}, @mpls={[], @ipv6=@gre_packet={0xe, 0x6, "ec00be", 0x44, 0x2f, 0xff, @local, @mcast2, {[], {{0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x88be, 0x0, 0x3}, {0x0, 0x0, 0x1, 0x1}, {0x1, 0x0, 0x1}, {0xa888, 0x88be, 0x2, {{0x6, 0x1, 0x9, 0x2, 0x1, 0x0, 0x3, 0x5}, 0x1, {0x8100}}}, {0x8, 0x22eb, 0x20000, {{0x0, 0x2, 0xc, 0x0, 0x0, 0x2, 0x7, 0x8}, 0x2, {0x2, 0x4, 0x0, 0x5, 0x1, 0x1, 0x1}}}, {0x8, 0x6558, 0x2}}}}}}, 0x7a) recvmmsg(r0, &(0x7f0000003540)=[{{0x0, 0x0, &(0x7f0000000d40)=[{&(0x7f0000000580)=""/104, 0x68}], 0x1}, 0x3}], 0x1, 0x0, 0x0) 2m49.536838064s ago: executing program 2 (id=1696): socket$nl_route(0x10, 0x3, 0x0) (async) r0 = socket$alg(0x26, 0x5, 0x0) (async) r1 = socket$nl_route(0x10, 0x3, 0x0) getsockopt$IP_SET_OP_GET_FNAME(r1, 0x1, 0x53, &(0x7f0000000240)={0x8, 0x7, 0x0, 'syz2\x00'}, &(0x7f0000000300)=0x2c) r2 = socket$inet_udplite(0x2, 0x2, 0x88) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) (async, rerun: 64) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040), 0x200002, 0x0) (rerun: 64) r4 = openat$cgroup_devices(r3, &(0x7f0000000080)='devices.deny\x00', 0x2, 0x0) write$cgroup_devices(r4, &(0x7f0000000000)=ANY=[@ANYBLOB='b *:4\t', @ANYRESHEX=r4], 0xa) (async, rerun: 32) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000340)={'bridge0\x00', 0x0}) (async, rerun: 32) r6 = socket(0x10, 0x80002, 0x0) sendmsg$nl_route(r6, &(0x7f0000000000)={0x0, 0x10, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="440000001300290a000000000000000007000000", @ANYRES32=r5, @ANYBLOB="00000000000000001c001a800800028008000200080000003e120000080002001040e5"], 0x44}}, 0x0) (async) sendmsg$nl_route_sched(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)=@getchain={0x24, 0x11, 0x1, 0x2000000, 0x0, {0x0, 0x0, 0x0, r5, {}, {}, {0xfff3}}}, 0x24}}, 0x0) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x19, 0x2, 0x8, 0xff1, 0x41000, 0xffffffffffffffff, 0x82f, '\x00', r5, 0xffffffffffffffff, 0x5, 0x5, 0x4}, 0x50) (async, rerun: 32) r7 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="0200000004000000080000000100000080000000", @ANYRES32, @ANYBLOB="400000b29e29d1582b61c6002652703400"/33, @ANYRES32=r5, @ANYRES32=0x0, @ANYBLOB='\x00'/28], 0x50) (rerun: 32) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f00000002c0)={{r7}, &(0x7f0000000280), &(0x7f00000000c0)='%pi6 \x00'}, 0x20) (async) socket$inet6_sctp(0xa, 0x5, 0x84) (async) socket(0x1d, 0x2, 0x6) unshare(0x22020400) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000500)={'veth1\x00', &(0x7f0000000200)=@ethtool_per_queue_op={0x4b, 0xf, [0xa, 0x1, 0x7fff, 0x1, 0x4, 0x9, 0xa4, 0xffb, 0x7, 0xb69, 0xc1, 0x4, 0x1, 0x3, 0x5, 0x101, 0x1000, 0x9, 0x3, 0x3, 0x1, 0xfffffffa, 0x0, 0x6, 0x9, 0x4, 0x7, 0x5, 0x100000, 0x762, 0x3, 0xd, 0xe, 0x2b12, 0x100, 0x6, 0x1c00, 0xb, 0x7, 0xbed4, 0x8, 0x8000100, 0x3, 0x0, 0x11000, 0x8, 0x5, 0x79b, 0x2, 0x1, 0x7f, 0x4, 0xa, 0x7, 0xf, 0x101, 0xd7, 0x1fa0860a, 0x7, 0xaa, 0x81, 0x2, 0x180000, 0x4007, 0x8b, 0x5, 0x2af, 0xf7, 0x5, 0x2, 0x6, 0x9, 0x4, 0x7, 0x4009, 0x0, 0x4, 0x100002, 0x8, 0x752, 0x0, 0x3, 0x0, 0x10001, 0x2, 0xffffffff, 0x6, 0x6, 0x9, 0x80000000, 0xfdffffff, 0x2, 0x2, 0x84, 0x100, 0x5, 0x252, 0x81, 0xb, 0x5, 0x20006, 0x5, 0x2, 0xb, 0x2, 0xd9a, 0xd, 0x2a2, 0xfffffffd, 0x3, 0x2, 0x5, 0x8, 0x0, 0x4, 0x2, 0x40, 0x8, 0x4, 0x4, 0x401, 0x66cd, 0x8, 0x8, 0x1, 0x1fc, 0xc5c, 0xffffffff]}}) (async) poll(&(0x7f0000000000), 0x20000000000000b5, 0x9) r8 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000003c0)={0x18, 0xb, &(0x7f0000000640)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020000000000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], &(0x7f00000004c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000300)='rcu_utilization\x00', r8, 0x0, 0x4}, 0x18) (async) r9 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x3, 0x10, &(0x7f0000000200)=ANY=[@ANYBLOB="18020000ff0500000000000000000000b7080000000000007b8af8ff00000000b7080000ff0100007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb7", @ANYRES32=r7, @ANYBLOB="0000000000000000b705000008"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x41000}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000003c0)={r9, 0x0, 0xe, 0x0, &(0x7f0000000100)="b34715ecd04550d3abc89b6f7bec", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) bind$alg(r0, &(0x7f0000000480)={0x26, 'hash\x00', 0x0, 0x0, 'nhpoly1305-generic\x00'}, 0x58) (async, rerun: 32) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000000)="8a", 0x440) (rerun: 32) accept4(r0, 0x0, 0x0, 0x0) (async, rerun: 64) r10 = openat$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000600), 0x2, 0x0) (rerun: 64) write$cgroup_subtree(r10, &(0x7f00000006c0)={[{0x2b, 'perf_event'}, {0x2b, 'memory'}, {0x0, 'io'}, {0x2b, 'freezer'}]}, 0x21) 2m49.340911791s ago: executing program 2 (id=1699): r0 = socket$kcm(0x2, 0x200000000000001, 0x106) sendmsg$inet(r0, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x30004001) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$inet_sctp6_SCTP_DELAYED_SACK(r1, 0x84, 0x10, &(0x7f0000004340)=@assoc_value, 0x8) setsockopt$sock_attach_bpf(r1, 0x6, 0xd, &(0x7f0000000000), 0x4) 2m49.1767981s ago: executing program 2 (id=1703): sendmsg$NL802154_CMD_NEW_SEC_KEY(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000100)={&(0x7f0000000640)=ANY=[@ANYBLOB="9feb010018000000000000003400000034000000060000000400000000000012020000000000000000000001050000018000000000000000010000850200000000000000010000000000000400000000da"], 0x0, 0x52}, 0x20) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000140)={r0, 0x20, &(0x7f0000000080)={&(0x7f0000002700)=""/4116, 0x1014, 0x0, &(0x7f0000000000)=""/102, 0x66}}, 0x10) r1 = socket$netlink(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), r1) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000280)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_GET_MPATH(0xffffffffffffffff, &(0x7f00000004c0)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f00000002c0)={&(0x7f0000000440)={0x58, r2, 0x400, 0x70bd2c, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r3}, @val={0xc, 0x99, {0xb, 0x13}}}}, [@NL80211_ATTR_MPATH_NEXT_HOP={0xa}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @device_b}]}, 0x58}, 0x1, 0x0, 0x0, 0x24000000}, 0x40000) r4 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) sendmmsg(r4, &(0x7f0000008540)=[{{&(0x7f00000003c0)=@un=@abs={0x0, 0x0, 0x4e22}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000000a40)=[{0x0}, {&(0x7f0000000500)="33ec018e56a7a77bf15e3505922de3cd9dde6edc4bf0dd8e213688043915ea3cc1d17c4f1c1d6f26282d3574cd75f0c404e9b908ed9d9a3821133abde4cd9cc088108de429a0e6c31b51405d92c31330d3fb2cd008081d73c34e057bce558ecd238d36b4e0d35bd8386a982dab9e1b8028d9923c24cce616fd6f3ca09e7dc11cc5d7e1b48640ef257c5ec4a7863467ced819e54fa728ad1aefa35ceff4c082e26df0c8e8d325a13d4576878e4f4de96a4d68b1953264afb998c70d6ce1", 0xbd}, {&(0x7f00000005c0)="cac90f5addb0e51e58e0132f88530531f3e048b8ec26a932b5a21d3952a87387cc387f0c3e049fad577f6c8603861ce7e9974e9cc7308f8a48815f1c357f3a36529c01427547bd1f221e915ea2cfe2bf9af0372544e91dc27d47ed9ec0ac95121b0e82d906d50e23b811c47689d8cbd13535f156ff1b24b342cc13bbf5f5cc8d89775234437544211980b3aa301dd0bd80b1b4cbf8f738f55c46b5c25ff6e6b1946e2479e476b9cca00f81bf37798f32b5cd73c1e68e5d985e840f0b8b2bff945902cfeffc84d4ba4dc7df10ca262ffc296b94a631aab6a3621ec2a99a38ced737bc8bb3dc8bb90cb0e3ff354c623c343dca0afd19ee476cc1edb61bc761", 0xfe}, {&(0x7f00000007c0)="0719e04580973538763c12dc18f7b6596b22664c023d6682605bd1df28ea6efac733c5d99e7974507ffd1671b0d32a23194a9022b6b3758f307ae2a925c92066fa5e707281a1946f16c1adbc675ecf2efa8aacd7634ababa18681f11ce89f326c69f455f039a86f54f8fc653fa2893d4fabd22a6ebed2cde81d573468736a549445a35c0c456fb22efb0f3d522010f5f1a4e5377e892783be31446f3e2", 0x9d}, {&(0x7f0000000880)="823f0a739f732953914b48ef43c38390024a706ac204da022813bbd421b65104311d8fdf55b485c594f8dd817cf0037e130bbd8c96bdf6cd8884c4dd67e6b80cb650be47176dd2f4a37c556cae68a1d3648d94bcf9ff7d5bb55fcd8bdb3060c1737fead174c67fd75a1a61b9e2e1cde130433eac2c9795a47417da8f9d35bd8d3a20a9a63b28b9c54607e10546f6c388df16daee86b86817ac6ef2d7f392411aec011db6c3f4f9eb17", 0xa9}, {&(0x7f0000000d40)}], 0x6, &(0x7f0000002d40)}}], 0x2, 0x40) socket$key(0xf, 0x3, 0x2) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000000)=ANY=[@ANYRES32=0x0, @ANYBLOB="1a00000000", @ANYRES32, @ANYRES32], 0x20) r5 = socket$inet(0x2, 0x2, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=ANY=[@ANYBLOB="1400000042003303"], 0x14}, 0x1, 0x0, 0x0, 0x4015}, 0x24040004) recvmsg(r6, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000680)=[{&(0x7f00000019c0)=""/4094, 0xffe}, {&(0x7f0000000000)=""/170, 0xaa}, {&(0x7f0000000900)=""/168, 0xa8}, {&(0x7f0000000380)=""/169, 0xa9}, {&(0x7f0000000440)=""/165, 0xa5}, {&(0x7f0000000280)=""/161, 0xa1}, {&(0x7f0000000840)=""/124, 0x7c}, {&(0x7f0000000140)=""/28, 0x1c}, {&(0x7f0000000640)=""/11, 0xb}], 0x9}, 0x100) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8b04, &(0x7f0000000000)={'wlan1\x00'}) r7 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r7, &(0x7f0000514ff4)={0x10, 0x0, 0x25dfdbfb, 0x2ffffffff}, 0xc) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r8, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=@newlink={0x3c, 0x10, 0x44b, 0xfffffffc, 0x0, {0x7a}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bridge={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BR_MCAST_ROUTER={0x5, 0x16, 0x2}]}}}]}, 0x3c}}, 0x4) setsockopt$sock_int(r7, 0x1, 0x8, &(0x7f0000000300), 0x4) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r7, 0x10e, 0x4, &(0x7f0000000040)=0x1800, 0x4) r9 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r9, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000001ac0)={&(0x7f0000000000)=ANY=[@ANYBLOB="2c0000002d00010026bd7000fcdbdf2504"], 0x2c}, 0x1, 0x0, 0x0, 0x4000d}, 0x20008010) r10 = socket$kcm(0x10, 0x2, 0x0) r11 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r11, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000070000000900010073797a300000000050030000090a030000000000000000000700000008000a40000000000900020073797a30000000000900010073797a3000000000080005400000000d04001280080003400000011008000c400000edd8f802098060000280040001803c000180080001400000000108000140000001d0080001400000000008000140000000090800014000000009080901400000800008000140000000091c000180080001407fffffff0800014000009af7080081400000000708000140000003ff700002802c"], 0x398}}, 0x0) sendmsg$kcm(r10, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e00000010008188e6b62aa73772cc9f1ba1f848430000005e1406ca000000000e000a000f000000028000001294", 0x2e}, {&(0x7f0000000080)="bbb376b7bd831c7c00000000000000000000000000000000000000000000ef0b00000000000000", 0x27}, {&(0x7f00000000c0)="c7a26c6b1e38a32eff9d181ee85612ba049bc3593c8fc0ae8f1a079bae667206c90cc3c5342e80a962de9b78a4c5ee0aa6aeff35", 0x34}], 0x3}, 0x0) 2m48.721143232s ago: executing program 2 (id=1710): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f0000000280)=ANY=[@ANYBLOB="1801000021000000000000003b810000850000006d000000070000000000000095"], &(0x7f0000000040)='GPL\x00', 0x6, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000880)={&(0x7f0000000100)='rxrpc_tx_packet\x00', r0, 0x0, 0x10}, 0x18) r1 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f0000000280)=ANY=[], &(0x7f0000000040)='GPL\x00', 0x6, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000880)={&(0x7f0000000080)='svc_unregister\x00', r2, 0x0, 0xfaf}, 0x18) sendmsg$netlink(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000002580)=[{&(0x7f0000000000)=ANY=[@ANYBLOB="1400000025000100000000000000040006"], 0x14}], 0x1, 0x0, 0x0, 0x400048c0}, 0x0) 2m33.657402977s ago: executing program 32 (id=1710): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f0000000280)=ANY=[@ANYBLOB="1801000021000000000000003b810000850000006d000000070000000000000095"], &(0x7f0000000040)='GPL\x00', 0x6, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000880)={&(0x7f0000000100)='rxrpc_tx_packet\x00', r0, 0x0, 0x10}, 0x18) r1 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f0000000280)=ANY=[], &(0x7f0000000040)='GPL\x00', 0x6, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000880)={&(0x7f0000000080)='svc_unregister\x00', r2, 0x0, 0xfaf}, 0x18) sendmsg$netlink(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000002580)=[{&(0x7f0000000000)=ANY=[@ANYBLOB="1400000025000100000000000000040006"], 0x14}], 0x1, 0x0, 0x0, 0x400048c0}, 0x0) 2m27.63334914s ago: executing program 1 (id=1925): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@gettaction={0x50, 0x32, 0x20, 0x70bd25, 0x25dfdbfe, {}, [@action_gd=@TCA_ACT_TAB={0x1c, 0x1, [{0xc, 0x1c, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'bpf\x00'}}, {0xc, 0x1d, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'ife\x00'}}]}, @action_gd=@TCA_ACT_TAB={0x20, 0x1, [{0x10, 0xd, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'mirred\x00'}}, {0xc, 0x17, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x40}}]}]}, 0x50}, 0x1, 0x0, 0x0, 0x40000}, 0x4048840) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)=@newqdisc={0x24, 0x24, 0x1, 0x70bd2a, 0x25dfdc00, {0x0, 0x0, 0x0, 0x0, {}, {0xffff, 0xffff}, {0x5}}}, 0x24}, 0x1, 0x0, 0x0, 0x40}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="4800000010000d0428bd7000fcdbff2500008000", @ANYRES32=0x0, @ANYBLOB="1000000000000000280012800b0001006272696467650000180002"], 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0300000000000000280012800a00010076786c616e00"], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22cca65c15}, 0x4008840) r0 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r0, &(0x7f00000002c0), 0x40000000000009f, 0x0) 2m27.315665909s ago: executing program 1 (id=1929): bpf$BPF_GET_MAP_INFO(0xf, &(0x7f00000001c0)={0x1, 0x58, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0}}, 0x10) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000000c0)=@bpf_lsm={0x4, 0x4, &(0x7f0000000180)=ANY=[@ANYBLOB="660a00000000000061117c000000000085000000ce00000095"], &(0x7f0000000200)='syzkaller\x00', 0x4, 0x0, 0x0, 0x0, 0x1, '\x00', r0}, 0x94) socket$key(0xf, 0x3, 0x2) 2m27.176860178s ago: executing program 1 (id=1930): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128-generic\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000140)="2c385aa3d49100dc6626c892b6bc436a", 0x10) r2 = accept4(r1, 0x0, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_route(0x10, 0x3, 0x0) socket(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x0, 0x3, 0x8000000000, 0x1, 0x0, 0x100000000}, 0x0, &(0x7f00000002c0)={0x3ff, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x3000000, 0x7fffffff, 0xfffffffffffffffc}, 0x0, 0x0) sendmsg$nl_route_sched_retired(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000019c0)=@newqdisc={0x24, 0x24, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {0x0, 0x1}}}, 0x24}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000300)=@newlink={0x40, 0x10, 0x403, 0x0, 0x3f, {0x0, 0x0, 0x0, 0x0, 0x40400, 0xa90}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x10, 0x2, 0x0, 0x1, [@IFLA_BR_GROUP_ADDR={0xa, 0x14, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}]}}}]}, 0x40}, 0x1, 0x300000000000000, 0x0, 0x4004}, 0x0) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000004c0)=[{&(0x7f0000000dc0)="d8000000180081084e81f783db4cb9040a10080006007c09e8fc55a10a0015000600142603600e120800020081000401a8000100fec0ffff000000fd035c0461c1d67f6f94007134cf6efb800189b316277ce06bbaceac3c2fb14c2ee5a7cef4090f00201f373f7b9555da25364c3b10b7b91b14d6d930dfe1d9d322fe7c9f8775820d16a4683f5aeb4edbb57a5025ccca9e003640fad9e3bb9ad809d5e1cace0d81ed0bffece0b42a9ecbee5de6ccd4e1ffffffffc1c9b6278754ca397c388b0dd6e4edef3d9300"/216, 0xd8}], 0x1, 0x0, 0x0, 0x4788}, 0x0) getsockopt$IP_VS_SO_GET_DESTS(r3, 0x0, 0x484, &(0x7f0000000040)=""/232, &(0x7f0000000140)=0xe8) 2m26.13680164s ago: executing program 1 (id=1943): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r2, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_CALIPSO_C_ADD(r3, &(0x7f00000004c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000480)={&(0x7f0000000340)={0x24, 0x0, 0x0, 0x70bd27, 0x25dfdbfb, {}, [@NLBL_CALIPSO_A_DOI={0x8, 0x1, 0x1}, @NLBL_CALIPSO_A_MTYPE={0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x1}, 0x4000000) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r4, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c0002000800010006"], 0x3c}}, 0x0) sendmsg$nl_route(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000400)=@newlink={0x44, 0x10, 0xffffff1f, 0x0, 0x1, {}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ip6gretap={{0xe}, {0x8, 0x2, 0x0, 0x1, [@IFLA_GRE_COLLECT_METADATA={0x4}]}}}, @IFLA_MASTER={0x8, 0xa, r4}]}, 0x44}, 0x1, 0x0, 0x0, 0x40000}, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket(0x1, 0x803, 0x0) getsockname$packet(r6, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=@newlink={0x3c, 0x10, 0x403, 0x70bd25, 0x0, {0x0, 0x0, 0x0, 0x0, 0x500}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @veth={{0x9}, {0x4, 0x2, 0x0, 0x1, @void}}}, @IFLA_MASTER={0x8, 0xa, r7}]}, 0x3c}, 0x1, 0x0, 0x0, 0x20000804}, 0x8000) r8 = socket(0x1, 0x803, 0x0) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000740)={&(0x7f0000000500)="ab874e544d4c219c23", &(0x7f0000000540)=""/239, &(0x7f0000000640)="a2f2ee310027355cb963e38e84edac01261c3fd123a773fe0f30334d0c1f77b6a9bd262ab7161fa2fd8197c24386d13f1cb49ca1faf223750eebc316f959fb65326e138c7d48a4cc46e988c808dfede62e821e712e32e14777c2f206abd174d8de83ee308af8ad44077b6be9b7eb68ad409c35ec045e2ecaa878c7c6ec7b5bfe2dc2243b37d161766e3ff6ac5a799453d2ccbf70906f9f3b4107d7a22ab40c767000d2b004875fd7", &(0x7f0000000700)="a3069fc765ded75e181868462c93d35a23fa4a58141722da7352fd11cf", 0xe6, 0x1, 0x4}, 0x38) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=@newlink={0x3c, 0x10, 0x403, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x90646}, [@IFLA_ALT_IFNAME={0x14, 0x35, 'erspan0\x00'}, @IFLA_MASTER={0x8, 0xa, r9}]}, 0x3c}, 0x1, 0x0, 0x0, 0x600}, 0x24044800) r10 = socket(0x840000000002, 0x3, 0xfa) sendmmsg$inet(r10, &(0x7f0000005240), 0x4000095, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r10, 0x81f8943c, &(0x7f00000000c0)) setsockopt$bt_hci_HCI_DATA_DIR(r10, 0x0, 0x1, 0x0, 0x0) 2m25.859296623s ago: executing program 1 (id=1945): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00000003c0)={0xa, 0x4e22, 0x0, @empty}, 0x1c) listen(r0, 0x0) r1 = epoll_create(0x6) clock_gettime(0x0, &(0x7f0000000140)) ppoll(&(0x7f0000000100)=[{r0, 0x8}, {r0, 0x40}], 0x2, 0x0, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000280)={0x10000014}) r2 = socket$netlink(0x10, 0x3, 0x4) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000400)=@base={0xe, 0x4, 0x4, 0x3}, 0x50) r4 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0xb, 0x1c, &(0x7f0000000d80)=ANY=[@ANYBLOB="18080000281c0040000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000005000000bf0900000000000035090100000000009500000000070000b7020000000000007b9a00fe00000000b6090000002000a80700000050000058bf8600000000000007080000f8ffffffbfa400000000000007040000f0ffffff550000000800000018220000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7050000080000004608f0ff760000005d9800000000000056000000a80000008500000007000000b70000000000000095"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x9, '\x00', 0x0, @fallback=0x11, 0x0, 0xf00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) writev(r2, &(0x7f0000000080)=[{&(0x7f0000000200)="a10100001500add427323b470c45b4560a067fffffff81004e22000d00ff0028925aa80020007b00090080000efffeffe809000000ff0000f03ac7100003ffffffffffffffffffffffe7ee00000000000000000200000000", 0x1a1}], 0x1) 2m25.63979109s ago: executing program 1 (id=1946): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x10, 0x4, 0x8, 0x8}, 0x48) close(r0) bpf$MAP_CREATE(0x0, &(0x7f00000008c0)=ANY=[@ANYBLOB="1e0000000000000004000000ff"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f0000000200)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {}, {}, {0x4}, {0x6, 0x0, 0xa}, {}, {}, {0x85, 0x0, 0x0, 0x57}}]}, &(0x7f00000004c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)={0x14, 0x25, 0x301, 0x270bd24, 0x25dfdbfd, {0x1}}, 0x14}}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$devlink(&(0x7f0000000600), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_GET(r2, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000880)={&(0x7f0000000040)={0x14, r3, 0x1, 0x0, 0x0, {0x54}}, 0x14}}, 0x880) r4 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) shutdown(r4, 0x0) recvmmsg(r4, &(0x7f00000004c0), 0xf02, 0xf0, 0x0) recvmmsg(r4, &(0x7f0000006080)=[{{0x0, 0x0, &(0x7f0000000280)=[{&(0x7f0000000000)=""/15, 0xf}, {&(0x7f0000000040)=""/149, 0x95}, {&(0x7f0000000100)=""/185, 0xb9}, {&(0x7f00000001c0)=""/170, 0xaa}], 0x4, &(0x7f00000002c0)=""/73, 0x49}, 0x18000}, {{0x0, 0x0, &(0x7f00000035c0)=[{&(0x7f0000000340)=""/4096, 0x1000}, {&(0x7f0000001340)=""/160, 0xa0}, {&(0x7f0000001400)=""/4096, 0x1000}, {&(0x7f0000002400)=""/4096, 0x1000}, {&(0x7f0000003400)=""/167, 0xa7}, {&(0x7f00000034c0)=""/9, 0x9}, {&(0x7f0000003500)=""/138, 0xfffffffffffffe9b}], 0x7}, 0x7b8}, {{&(0x7f0000003640)=@alg, 0x80, &(0x7f00000039c0)=[{&(0x7f00000036c0)=""/213, 0xd5}, {&(0x7f00000037c0)=""/10, 0xa}, {&(0x7f0000003800)=""/199, 0xc7}, {&(0x7f0000003900)=""/183, 0xb7}], 0x4}, 0x4}, {{&(0x7f0000003a00)=@hci, 0x80, &(0x7f0000003c80)=[{&(0x7f0000003a80)=""/150, 0x96}, {&(0x7f0000003b40)=""/99, 0x63}, {&(0x7f0000003bc0)=""/142, 0x8e}], 0x3, &(0x7f0000003cc0)=""/251, 0xfb}, 0x5710925a}, {{&(0x7f0000003dc0)=@nl=@proc, 0x80, &(0x7f0000004f00)=[{&(0x7f0000003e40)=""/154, 0x9a}, {&(0x7f0000003f00)=""/4096, 0x1000}], 0x2, &(0x7f0000004f40)=""/98, 0x62}, 0x3}, {{&(0x7f0000004fc0)=@ax25={{}, [@netrom, @null, @null, @null, @rose, @null, @netrom]}, 0x80, &(0x7f0000006040)=[{&(0x7f0000005040)=""/4096, 0x1000}], 0x1}, 0x400}], 0x6, 0x10142, 0x0) close(0x3) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000006240), 0xffffffffffffffff) sendmsg$IEEE802154_LLSEC_DEL_DEVKEY(r5, &(0x7f0000006300)={&(0x7f0000006200)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000062c0)={&(0x7f0000006280)={0x3c, r6, 0x800, 0x70bd2c, 0x25dfdbfb, {}, [@IEEE802154_ATTR_SHORT_ADDR={0x6, 0x4, 0xaaa3}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0102}}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0102}}, @IEEE802154_ATTR_SHORT_ADDR={0x6, 0x4, 0xffff}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4}, 0x4) 2m10.553115761s ago: executing program 33 (id=1946): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x10, 0x4, 0x8, 0x8}, 0x48) close(r0) bpf$MAP_CREATE(0x0, &(0x7f00000008c0)=ANY=[@ANYBLOB="1e0000000000000004000000ff"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f0000000200)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {}, {}, {0x4}, {0x6, 0x0, 0xa}, {}, {}, {0x85, 0x0, 0x0, 0x57}}]}, &(0x7f00000004c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)={0x14, 0x25, 0x301, 0x270bd24, 0x25dfdbfd, {0x1}}, 0x14}}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$devlink(&(0x7f0000000600), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_GET(r2, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000880)={&(0x7f0000000040)={0x14, r3, 0x1, 0x0, 0x0, {0x54}}, 0x14}}, 0x880) r4 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) shutdown(r4, 0x0) recvmmsg(r4, &(0x7f00000004c0), 0xf02, 0xf0, 0x0) recvmmsg(r4, &(0x7f0000006080)=[{{0x0, 0x0, &(0x7f0000000280)=[{&(0x7f0000000000)=""/15, 0xf}, {&(0x7f0000000040)=""/149, 0x95}, {&(0x7f0000000100)=""/185, 0xb9}, {&(0x7f00000001c0)=""/170, 0xaa}], 0x4, &(0x7f00000002c0)=""/73, 0x49}, 0x18000}, {{0x0, 0x0, &(0x7f00000035c0)=[{&(0x7f0000000340)=""/4096, 0x1000}, {&(0x7f0000001340)=""/160, 0xa0}, {&(0x7f0000001400)=""/4096, 0x1000}, {&(0x7f0000002400)=""/4096, 0x1000}, {&(0x7f0000003400)=""/167, 0xa7}, {&(0x7f00000034c0)=""/9, 0x9}, {&(0x7f0000003500)=""/138, 0xfffffffffffffe9b}], 0x7}, 0x7b8}, {{&(0x7f0000003640)=@alg, 0x80, &(0x7f00000039c0)=[{&(0x7f00000036c0)=""/213, 0xd5}, {&(0x7f00000037c0)=""/10, 0xa}, {&(0x7f0000003800)=""/199, 0xc7}, {&(0x7f0000003900)=""/183, 0xb7}], 0x4}, 0x4}, {{&(0x7f0000003a00)=@hci, 0x80, &(0x7f0000003c80)=[{&(0x7f0000003a80)=""/150, 0x96}, {&(0x7f0000003b40)=""/99, 0x63}, {&(0x7f0000003bc0)=""/142, 0x8e}], 0x3, &(0x7f0000003cc0)=""/251, 0xfb}, 0x5710925a}, {{&(0x7f0000003dc0)=@nl=@proc, 0x80, &(0x7f0000004f00)=[{&(0x7f0000003e40)=""/154, 0x9a}, {&(0x7f0000003f00)=""/4096, 0x1000}], 0x2, &(0x7f0000004f40)=""/98, 0x62}, 0x3}, {{&(0x7f0000004fc0)=@ax25={{}, [@netrom, @null, @null, @null, @rose, @null, @netrom]}, 0x80, &(0x7f0000006040)=[{&(0x7f0000005040)=""/4096, 0x1000}], 0x1}, 0x400}], 0x6, 0x10142, 0x0) close(0x3) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000006240), 0xffffffffffffffff) sendmsg$IEEE802154_LLSEC_DEL_DEVKEY(r5, &(0x7f0000006300)={&(0x7f0000006200)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000062c0)={&(0x7f0000006280)={0x3c, r6, 0x800, 0x70bd2c, 0x25dfdbfb, {}, [@IEEE802154_ATTR_SHORT_ADDR={0x6, 0x4, 0xaaa3}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0102}}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0102}}, @IEEE802154_ATTR_SHORT_ADDR={0x6, 0x4, 0xffff}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4}, 0x4) 4.352695679s ago: executing program 0 (id=2831): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0e000000040000000400000004"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x14, &(0x7f0000000200)=ANY=[@ANYBLOB="1802000001000000000000000000000018010000786c6c2500000000070000007b1af8ff00000000bfa100000000000007010000f8ffffffb700000000000000b70300000000ffff850000000400000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='kmem_cache_free\x00', r1}, 0x10) r2 = socket$inet6(0xa, 0x2, 0x3a) sendmmsg$inet6(r2, &(0x7f0000000e40)=[{{&(0x7f00000000c0)={0xa, 0x4e24, 0x400, @loopback={0xff00000000000000}, 0x105}, 0x1c, &(0x7f0000000180)=[{&(0x7f0000000380)="a0002e7577d4017a", 0x8}], 0x1, &(0x7f00000005c0)=ANY=[], 0xd}}], 0x1, 0x4000880) 4.197761792s ago: executing program 0 (id=2835): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000a40), r0) r2 = syz_open_procfs$namespace(0x0, &(0x7f0000000140)='ns/mnt\x00') sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(r0, &(0x7f0000000bc0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000b00)={0x24, r1, 0x1, 0x70bd2a, 0x25dfdbfc, {}, [@NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x1}, @NL802154_ATTR_NETNS_FD={0x8, 0x1d, r2}]}, 0x24}, 0x1, 0x0, 0x0, 0x8000}, 0x40) 3.953946324s ago: executing program 0 (id=2838): r0 = bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x11, 0x3, &(0x7f0000000440)=@framed, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000080)='kmem_cache_free\x00', r0}, 0x10) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) bind$inet6(r1, &(0x7f0000000280)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendto$inet6(r1, &(0x7f00000002c0)="9e", 0x1, 0x41, &(0x7f0000000200)={0xa, 0x4e23, 0x10003, @loopback, 0x7}, 0x1c) setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r1, 0x84, 0x72, &(0x7f0000000140)={0x0, 0x0, 0x10}, 0xc) writev(r1, &(0x7f00000003c0)=[{&(0x7f0000000340)=',', 0x34000}], 0x1) 3.836992179s ago: executing program 0 (id=2840): bpf$MAP_CREATE(0x1900000000000000, &(0x7f0000000040)=ANY=[@ANYBLOB="1b00000000000000000000000020000000000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000000100"], 0x48) socket$kcm(0xa, 0x3, 0x87) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @broadcast}) write$tun(r0, &(0x7f0000000040)=ANY=[@ANYBLOB="034886dd010000000000140000006000000003088700fe88a43de1a400000000000000007d01ff020000000000000000000000000001"], 0xfdef) 3.444324582s ago: executing program 0 (id=2851): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000400)={0x11, 0xb, &(0x7f00000002c0)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020782500000000002020207b1af8fe00000000bfa100000000000007010000f8ffffffb702000008000000b703000007000000850000001100000095"], &(0x7f0000000940)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x18, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000005c0)={&(0x7f0000000080)='kfree\x00', r0, 0x0, 0xffff}, 0x18) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000480)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a030000000000000000f0070000000900010073797a300000000080000000090a010400000000000000000700000008000a40000000000900020073797a30000000000900010073797a3000000000080005400000000d3c00128014000180090001006c617374000000000400028010000180090001006c61737400000000140001800c000100636f756e746572000400028008000340000001"], 0xc8}, 0x1, 0x0, 0x0, 0x40000}, 0x20000000) 3.248704944s ago: executing program 0 (id=2856): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="0200000004000000080000000100000080"], 0x50) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000480)={r1}, 0x4) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x18, &(0x7f00000001c0)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000000000018230000", @ANYRES32=r1, @ANYBLOB="0000000000000000b70500001000000085000000a5000000180100002020640500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000a50000000800000095"], &(0x7f0000000600)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000000)='kfree\x00', r2}, 0x10) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x3, 0x0, 0x0, {0x7, 0x0, 0x4}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x80, 0x9, 0xa, 0x401, 0x0, 0x0, {0x7, 0x0, 0x3}, [@NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0xffffffff}, @NFTA_SET_NAME={0x9, 0x2, 'syz0\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0xd}, @NFTA_SET_EXPRESSIONS={0x3c, 0x12, 0x0, 0x1, [{0x20, 0x1, 0x0, 0x1, @connlimit={{0xe}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_CONNLIMIT_COUNT={0x8, 0x1, 0x1, 0x0, 0x8}]}}}, {0x18, 0x1, 0x0, 0x1, @connlimit={{0xe}, @val={0x4}}}]}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x120}]}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x0, 0x84}}}, 0xc8}}, 0x20050800) 2.267645808s ago: executing program 5 (id=2867): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x11, 0xb, &(0x7f00000009c0)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000083850000007100000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000000)='kfree\x00', r0, 0x0, 0xfffffffffffffffd}, 0x18) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000580), r1) sendmsg$ETHTOOL_MSG_FEATURES_GET(r1, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={&(0x7f00000005c0)={0x2c, r2, 0x1, 0x70bd25, 0x25dfdbfc, {}, [@HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'lo\x00'}]}]}, 0x2c}, 0x1, 0x0, 0x0, 0x20000084}, 0x20040000) 2.064099199s ago: executing program 5 (id=2868): socket$nl_route(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f00000000c0)={0x2, &(0x7f0000000040)=[{0x40, 0x5d, 0x2, 0x9}, {0x6, 0x0, 0x6, 0x1}]}, 0x10) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="0700000004000000000100000100000028"], 0x50) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x8, &(0x7f0000000080)=ANY=[@ANYBLOB="18000000bb00551a000000000000000018120000", @ANYRES32=r1, @ANYBLOB="0000000000000000b703000000000000850000001b000000b70000000000000095"], &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x2d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000bc0)={&(0x7f0000000040)='kmem_cache_free\x00', r2}, 0x18) gettid() bind$bt_hci(r0, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r0, &(0x7f0000000140)="24000000010006", 0x7) 1.837167911s ago: executing program 5 (id=2870): r0 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r0, &(0x7f0000000380)={0x0, 0x4076cbba9945d516, &(0x7f0000000340)={0x0, 0x14}}, 0x0) getsockname$packet(r0, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="400000001000390400"/20, @ANYRES32=r1, @ANYBLOB="019800000000000020001280080001006772650014000280080001", @ANYRES32=r1], 0x40}, 0x1, 0x0, 0x0, 0x4014}, 0x0) r3 = socket(0x10, 0x3, 0x0) getsockname$packet(r0, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000003c0)=0x14) sendmsg$nl_route_sched(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x44, 0x24, 0x5820a61ca228659, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {0x0, 0x9}, {0xffff, 0xffff}, {0x0, 0x7}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_USC={0x10, 0x3, {0x3, 0x2}}}}]}, 0x44}}, 0x800) sendmsg$nl_route_sched(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000d40)=@newtfilter={0x8bc, 0x28, 0xd27, 0x1003ffd, 0x0, {0x0, 0x0, 0x0, r4, {0xffe0, 0x9}, {0x0, 0x9}, {0x2, 0xb}}, [@filter_kind_options=@f_fw={{0x7}, {0x890, 0x2, [@TCA_FW_POLICE={0x87c, 0x2, [@TCA_POLICE_RESULT={0x8, 0x5, 0xbc}, @TCA_POLICE_RESULT={0x8, 0x5, 0x8}, @TCA_POLICE_RATE={0x404, 0x2, [0x4, 0x80000000, 0x1, 0x8001, 0x6, 0xd4, 0x4, 0x6, 0x7, 0x1, 0x6, 0xdd, 0x3, 0x6, 0x7, 0x793, 0x88, 0x1, 0x1, 0x8, 0x2, 0x14000000, 0x4, 0x5, 0xfff, 0xb0000, 0x10, 0x8, 0x6, 0x7a8, 0x101, 0xfffffffc, 0xffffffff, 0x4, 0x7fffffff, 0x2, 0x5, 0x3, 0x7ff, 0x7fff, 0x80, 0x10, 0xffff8000, 0x80000000, 0xac0, 0x1, 0x7f, 0x6, 0x9, 0x6, 0xfff, 0x8, 0x9, 0x8001, 0xeb23, 0x2, 0x7ff, 0x2, 0x40, 0x4, 0x9, 0x9, 0xffffffff, 0xdc, 0x40800, 0x86, 0x1, 0x1, 0x4, 0x2, 0x200, 0x8, 0x3, 0x4c, 0x400, 0x2, 0xfffffff7, 0x9, 0x3, 0x1ff, 0x2, 0x1, 0x4, 0x9, 0x8001, 0x10, 0x9, 0x4, 0x4, 0x6, 0x400, 0x69f, 0x5, 0x0, 0x1, 0xc981, 0x800, 0x3, 0xfffffffc, 0x8, 0xfff, 0x1, 0x5, 0x1000, 0x7, 0x4, 0x4, 0x80000, 0x3, 0x5, 0x4d, 0x0, 0x9, 0xfb, 0xf, 0x6, 0x9, 0x20000000, 0x7735, 0x7ff, 0x3, 0xd, 0x6, 0x0, 0xdf8, 0x6, 0x80000001, 0x2, 0x0, 0x80000000, 0x9, 0x0, 0xa, 0x2, 0x5, 0x3, 0x7, 0x5, 0x0, 0x10001, 0xed2, 0x1, 0x4, 0x4, 0x4, 0x10000, 0x0, 0x8, 0x2, 0x9, 0x2, 0x8, 0xfffffff9, 0x5, 0x2, 0x8, 0x5, 0x401, 0x5, 0xffffffff, 0x8, 0x3, 0x2, 0x10, 0x8, 0x81, 0x81, 0x1, 0xbef, 0x6, 0x0, 0x1, 0x3ff, 0x7ae, 0xe, 0x2, 0x80, 0x5, 0x100, 0x83e2, 0x10, 0x8, 0x101, 0xfffffffe, 0x10, 0x8, 0xff, 0x470, 0x2, 0x477c, 0x4, 0x4, 0x8, 0x1000, 0x3ff, 0x5, 0x7ff, 0x9, 0x2, 0x3, 0x800, 0xa4, 0xfb, 0x6a, 0x74e027fd, 0x63, 0x3, 0x80000001, 0x1, 0xfffffffc, 0xc7b, 0xffffffff, 0x5, 0x6000, 0x3ff, 0x1, 0x4c, 0x7ff, 0x2c9, 0x8db25fff, 0x9, 0x3, 0x40, 0xfff, 0x8000, 0x3, 0x8, 0x8, 0x3, 0xa9, 0xffffffff, 0x0, 0x2, 0x9, 0x9, 0xeb, 0xfd79, 0x10000, 0x940, 0x4, 0x3, 0x7, 0x8001, 0xfffffff7, 0x8, 0x54b, 0x3, 0xfffffffb, 0x1, 0x8, 0x0, 0x2be, 0x0, 0x9, 0x200, 0x2]}, @TCA_POLICE_PEAKRATE64={0xc, 0x9, 0xfffffffffffffffc}, @TCA_POLICE_RATE={0x404, 0x2, [0x0, 0x0, 0x0, 0x101, 0x8, 0xad, 0x6, 0x5, 0x7, 0x1ff, 0x2, 0x60000, 0x2, 0x1, 0x2, 0x0, 0x7282, 0x2, 0x6aaf, 0x6, 0x7f8, 0x1, 0x2, 0x9, 0x6, 0xc, 0x9, 0x5, 0x3, 0x400, 0xdf4, 0x80000000, 0x100, 0x1, 0xc106, 0x3ff, 0x800, 0x7, 0x6, 0x7fff, 0xc, 0x3, 0x0, 0x9, 0x9, 0xf8, 0x5, 0x9, 0x7, 0xef10, 0x2, 0x51, 0x7, 0x3, 0x2, 0x1000, 0x1, 0x7715b04d, 0x6, 0x0, 0x9, 0x2, 0x5, 0x3, 0x1cfc, 0x6, 0x1, 0x5, 0x9, 0x9, 0x200, 0x6, 0x8e, 0x8, 0xff, 0x2, 0x2, 0x3, 0x0, 0x1, 0x2, 0x2, 0x4, 0x2, 0x3, 0x80000000, 0x101, 0xfffffff6, 0x7, 0x8, 0x3, 0xfffffffa, 0x7, 0x4, 0x8, 0x8, 0x2, 0x8, 0x7, 0x8, 0x5, 0x4, 0x400, 0x7f, 0x6, 0x3, 0x1ff, 0x1, 0x10001, 0x305e, 0x9, 0xfb728165, 0x8, 0x1, 0x7, 0xff, 0x0, 0x6a87, 0xfffff800, 0x5, 0x284, 0x4, 0x5, 0x3, 0x3, 0x6, 0x9, 0x0, 0x10200000, 0x8, 0x4, 0xf0, 0x6, 0x7ff, 0xfffffff9, 0x2, 0x6, 0x6, 0x8, 0x0, 0x2, 0x6, 0x33a8, 0x7, 0x7, 0xb119, 0x2, 0x78, 0x2, 0x9, 0x8, 0x3c1d, 0x8, 0x3, 0x3, 0x68c, 0x12f5, 0x644917bf, 0x1, 0x7e7c, 0x4, 0x800, 0x2, 0xb68d990, 0x25, 0x2, 0xdd, 0x0, 0x2, 0x6, 0xf2, 0x2, 0x0, 0x7ff, 0x8, 0x20008, 0x7, 0x6bb8, 0xb77, 0x4, 0xfffffe00, 0x1, 0x1, 0x40c6, 0x10, 0x5, 0x3, 0x8000, 0x0, 0x7fff, 0x7fff, 0x6, 0x4, 0x8, 0x8, 0xff, 0x81000, 0x5, 0x400000, 0x6, 0x8, 0x7f, 0x0, 0x8001, 0x36, 0x8, 0x3, 0x5, 0x7, 0x8, 0x2, 0xa, 0x40, 0x8, 0x6, 0x8, 0x1, 0x9, 0x9386, 0x4, 0x8, 0xf7fffffa, 0x3, 0xf, 0x4, 0x5, 0x2, 0x0, 0x2, 0x0, 0xffffbc27, 0x81, 0x1, 0x5, 0x4, 0x9, 0xa, 0xfff, 0x8, 0xaf46, 0x80000001, 0x74c2, 0x3, 0x4, 0x4dec, 0x6, 0x6, 0x101, 0x5, 0x10001, 0x4, 0x9, 0x2, 0x9b, 0x7e, 0xaa]}, @TCA_POLICE_TBF={0x3c, 0x1, {0x9, 0x3, 0xf04, 0x0, 0x7fffffff, {0x1, 0x0, 0xfffb, 0x40, 0x100, 0x81}, {0x5, 0x1, 0x2, 0x81, 0x7, 0x7fff}, 0x7, 0x9, 0x9}}, @TCA_POLICE_RATE64={0xc, 0x8, 0x8}, @TCA_POLICE_PEAKRATE64={0xc, 0x9, 0x3ff}]}, @TCA_FW_POLICE={0x10, 0x2, [@TCA_POLICE_PEAKRATE64={0xc}]}]}}]}, 0x8bc}, 0x1, 0x0, 0x0, 0x810}, 0x200008c4) r5 = socket(0x10, 0x3, 0x0) sendmmsg(r5, &(0x7f0000000000), 0x4000000000001f2, 0x0) 1.6087585s ago: executing program 6 (id=2874): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="0200000004000000080000000100000080"], 0x50) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000480)={r0, 0xffffffffffffffff}, 0x4) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x18, &(0x7f00000001c0)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000000000018230000", @ANYRES32=r1, @ANYBLOB="0000000000000000b70500001000000085000000a5000000180100002020640500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000a50000000800000095"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000000)='kfree\x00', r2}, 0x18) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000600)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01020000000000000000010000000900010073797a300000000058000000160a01000000000000000000010000000900010073797a30000000000900020073797a31000000002c0003800800014000000000180003801400010076657468315f746f5f626f6e6400000008000240000000006c000000160a0101000b000000000000010000000900020073797a30000000000900010073797a30000000004000038008000140000000002c0003801400010067656e657665300000000000000000001400010076657468315f746f5f626f6e64000000080002"], 0x10c}}, 0x0) 1.608575858s ago: executing program 5 (id=2875): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000008c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000002010000850000004300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x17, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x2d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='rss_stat\x00', r1}, 0x10) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) 1.486028986s ago: executing program 6 (id=2878): bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="120000000800000004000000b47c"], 0x50) 1.210594871s ago: executing program 6 (id=2881): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000001e80)=ANY=[@ANYBLOB="0b000000080000000c000000ffffffff01"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0xd, &(0x7f0000000240)=ANY=[@ANYBLOB="18000000000000000000000000000000850000006d00000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000010b704000000000000850000000100000095"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0x67, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000180)='kfree\x00', r1, 0x0, 0x2}, 0x18) r2 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r2, &(0x7f0000000040)={0x18, 0x0, {0x1, @local, 'ip6_vti0\x00'}}, 0x1e) close(r2) 1.099574355s ago: executing program 6 (id=2884): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="170000000000000004000000ff"], 0x50) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005900000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xffffffff}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000100)='kmem_cache_free\x00', r1}, 0x10) r2 = socket$inet_sctp(0x2, 0x5, 0x84) close(r2) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r3, 0x84, 0x6f, &(0x7f0000000040)={0x0, 0x10, &(0x7f0000000000)=[@in={0x2, 0x0, @private=0xa010101}]}, &(0x7f0000000080)=0x10) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r3, 0x84, 0x1d, &(0x7f0000000140)={0x1, [0x0]}, &(0x7f0000000240)=0x8) sendmsg$inet_sctp(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f00000001c0)='F', 0x1}, {0x0, 0xe0}], 0x2, &(0x7f00000000c0)=[@sndinfo={0x20, 0x84, 0x2, {0xa, 0x4, 0x28, 0x200000b, r4}}], 0x20, 0x2400e044}, 0x0) 966.591338ms ago: executing program 5 (id=2887): socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r1, &(0x7f0000001600)={0x0, 0x0, &(0x7f0000001580)=[{&(0x7f0000000280)="db", 0x1}], 0x1}, 0x41) recvmsg(r0, &(0x7f0000000840)={0x0, 0x0, 0x0}, 0x10001) sendmsg$inet(r1, &(0x7f0000000700)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000380)="1e", 0x1}], 0x1}, 0x41) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="18010000200180000000000000000000850000007b00000095"], &(0x7f00000001c0)='GPL\x00', 0x4}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000080)='sched_switch\x00', r2}, 0x10) recvmsg(r0, &(0x7f0000000480)={0x0, 0x0, 0x0}, 0x2) 939.852873ms ago: executing program 4 (id=2888): r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0x48241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000280)={'syzkaller1\x00', @link_local}) write$tun(r0, &(0x7f0000000140)={@val={0x800e}, @void, @eth={@broadcast, @local, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0xe000, 0x0, 0x4, 0x0, @empty, @empty}, {0x0, 0x0, 0x8}}}}}}, 0x2e) 828.693633ms ago: executing program 3 (id=2889): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000008000000000000001000000940000000fad413ec50000000f00000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x78) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000040)='netlink_extack\x00', r0}, 0x10) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)=@ipv6_newaddr={0x40, 0x14, 0x1, 0x70bd26, 0x25dfdbfc, {0xa, 0x0, 0x1, 0xff}, [@IFA_LOCAL={0x14, 0x2, @loopback}, @IFA_CACHEINFO={0x14, 0x6, {0x200, 0x6, 0x8, 0x3}}]}, 0x40}, 0x1, 0x0, 0x0, 0x4060000}, 0x8000800) 814.066832ms ago: executing program 3 (id=2890): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000008c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000002010000850000004300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x17, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000f40)={&(0x7f0000000f00)='kfree\x00', r2}, 0x10) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="0100000000000000000005000000180001801400020073797a5f74756e000000080000000000180003801400038010"], 0x44}}, 0x0) 681.490174ms ago: executing program 4 (id=2891): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x11, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000", @ANYRES32, @ANYBLOB="0000000000008da4b70800000000396f7b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000002400000095"], &(0x7f0000000800)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x1, '\x00', 0x0, @fallback=0x12, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000600)={&(0x7f0000000200)='sys_enter\x00', r0, 0x0, 0x80000000}, 0x18) epoll_pwait(0xffffffffffffffff, 0x0, 0x0, 0x4, 0x0, 0x0) 604.901794ms ago: executing program 3 (id=2892): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b7030000ddffffff850000002d00000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000002c0)={&(0x7f0000000300)='sched_switch\x00', r0}, 0x10) r1 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r1, 0x0, 0x40) sendmsg$kcm(r1, &(0x7f0000000600)={0x0, 0xa00, &(0x7f0000000080)=[{&(0x7f0000000040)="2e00000010008188040f80ec59acbc0413a1f848110000005e140602000000000e000a000f00000002800000121f", 0x2e}], 0x1}, 0x8000) 547.657711ms ago: executing program 4 (id=2893): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000001e80)=ANY=[@ANYBLOB="0b000000080000000c000000ffffffff01"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0xd, &(0x7f0000000240)=ANY=[@ANYBLOB="18000000000000000000000000000000850000006d00000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000010b704000000000000850000000100000095"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000180)='kfree\x00', r1, 0x0, 0x2}, 0x18) r2 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000001240)=@newqdisc={0x38, 0x24, 0x3fe3aa0262d8c583, 0x70bd29, 0x25dfdbfe, {0x0, 0x0, 0x0, r3, {0x0, 0xffe0}, {0xffff, 0xffff}, {0x10, 0xe}}, [@qdisc_kind_options=@q_fq={{0x7}, {0xc, 0x2, [@TCA_FQ_QUANTUM={0x8, 0x12, 0x468fe4e8}]}}]}, 0x38}}, 0x4048000) 476.417708ms ago: executing program 3 (id=2894): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000f40)={0x7, 0x10, &(0x7f0000000580)=ANY=[@ANYBLOB="18050000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r0, @ANYBLOB="0000000000000000b704000008000000850000007800000095"], 0x0, 0x6, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback=0x21, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0xcfcd}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x10, &(0x7f0000000580)=ANY=[], &(0x7f0000000600)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000006c0)={&(0x7f0000000700)='kfree\x00', r1}, 0x10) r2 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020e0000150000000000000000000000030005000000000002004e24ac1e00010000000000000000030006003c000000020000fc34000000000000000000000001001800000000000800120000000200fcffffff0000000006003300000000000000000000000000fe8000000000000000000000000000aa00000000000000000000000000000000040003"], 0xa8}}, 0x0) 324.741771ms ago: executing program 4 (id=2895): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'lo\x00', 0x0}) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1b, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8c}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000f40)={&(0x7f0000000f00)='kfree\x00', r2}, 0x10) sendmsg$nl_route_sched(r0, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000046c0)=@newqdisc={0x45c, 0x24, 0x4ee4e6a52ff56541, 0x8000000, 0x0, {0x0, 0x0, 0x0, r1, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x430, 0x2, [@TCA_TBF_PTAB={0x404, 0x3, [0x2, 0x0, 0x0, 0x0, 0x10000000, 0x0, 0x40000000, 0x1000, 0x6, 0x0, 0x0, 0x8000002, 0x0, 0x7e150a0b, 0x0, 0x5, 0x0, 0x0, 0x0, 0x4, 0x0, 0x100000, 0x0, 0x43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200000, 0x0, 0x0, 0x0, 0x10000, 0x5d2, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf7fffffe, 0x800000, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x1007, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000, 0x40000000, 0x3, 0x3, 0x6, 0x1, 0x8, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x2, 0x9, 0x0, 0x3, 0x7, 0xfbfffffd, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x3, 0x0, 0x0, 0x4fd, 0x2000, 0x0, 0x0, 0x2, 0x0, 0x0, 0xfffffffe, 0x0, 0x7e98263b, 0x9, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x6, 0x10000000, 0x0, 0x0, 0x5, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd2d1, 0x0, 0x0, 0xb2e, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0xff, 0x1000, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x6, 0xc3f3, 0x1, 0x0, 0x800, 0x9, 0x800, 0x0, 0x8, 0xe, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001, 0x0, 0xfffffffe, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x8000, 0x0, 0xfffffffd, 0x0, 0x0, 0xd819ac9, 0x1, 0x0, 0x0, 0x0, 0x4, 0x0, 0xffffffff, 0x0, 0x0, 0x80000001, 0x0, 0x10, 0x20, 0x4, 0x400000b2, 0x0, 0x0, 0x6, 0x0, 0x0, 0x8, 0x0, 0x0, 0x1000, 0x100, 0x0, 0x0, 0x0, 0x40000, 0x0, 0x0, 0xfffffffd, 0x1, 0x1, 0xfffffffe, 0x800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x4, 0x0, 0x0, 0x20000040, 0xffffffff, 0x400, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000000, 0x0, 0x80, 0x0, 0x0, 0x8000, 0x1ff, 0x23, 0xaaf0]}, @TCA_TBF_PARMS={0x28, 0x1, {{0x0, 0x0, 0x0, 0x0, 0x0, 0xc0000001}, {0x3, 0x0, 0xf, 0x0, 0x1, 0xffffffff}, 0x7, 0x10, 0x2000000}}]}}]}, 0x45c}}, 0x0) 274.243599ms ago: executing program 3 (id=2896): ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, 0x0) r0 = socket$inet6_sctp(0xa, 0x1, 0x84) bind$inet6(r0, &(0x7f0000000280)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendto$inet6(r0, &(0x7f00000002c0)="9e", 0x1, 0x41, &(0x7f0000000200)={0xa, 0x4e23, 0x10001, @loopback, 0xe}, 0x1c) r1 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r1, &(0x7f0000000480)={0x2, 0x0, @multicast2}, 0x10) sendmmsg(r1, &(0x7f0000007fc0), 0x800001d, 0x0) setsockopt$inet6_IPV6_HOPOPTS(r0, 0x29, 0x36, &(0x7f0000002600)=ANY=[], 0x10) r2 = socket$netlink(0x10, 0x3, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="1e000000000000000500000006"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000500)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005900000095"], 0x0}, 0x94) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000005c0)={&(0x7f0000000580)='kmem_cache_free\x00', r4}, 0x10) r5 = socket$packet(0x11, 0x2, 0x300) sendto$packet(r5, 0x0, 0x0, 0x4c001, &(0x7f00000002c0)={0x11, 0x8100, 0x0, 0x1, 0x2, 0x6, @random="f838dc54b3cc"}, 0x14) writev(r2, &(0x7f00000003c0)=[{&(0x7f0000000380)="390000001300034700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fdd411efc40800040000000000000000", 0x39}], 0x1) sendto$inet6(r0, &(0x7f0000000700)='\x00', 0x1, 0x4090, 0x0, 0x0) writev(r0, &(0x7f00000003c0)=[{&(0x7f0000000340)=',', 0x34000}], 0x1) 177.645513ms ago: executing program 4 (id=2897): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000500)=ANY=[@ANYBLOB="440000001a00010000000000000000000a000000000000000000000006001d000000000006001c000000", @ANYRES32], 0x44}}, 0x0) 151.772582ms ago: executing program 6 (id=2898): bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000400)=@bpf_lsm={0x6, 0x4, &(0x7f0000000700)=ANY=[@ANYBLOB="180000000000000000000000fcffffff810300000000000095"], &(0x7f0000000100)='GPL\x00', 0xd}, 0x94) 28.747561ms ago: executing program 6 (id=2899): r0 = bpf$MAP_CREATE(0x0, 0x0, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xe, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000001300)={&(0x7f0000000c00)='net_dev_start_xmit\x00', r1}, 0x10) socket$packet(0x11, 0xa, 0x300) socket$packet(0x11, 0xa, 0x300) r2 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000540)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], &(0x7f0000000040)='syzkaller\x00', 0x2, 0x0, 0x0, 0x0, 0x9}, 0x94) socket$packet(0x11, 0xa, 0x300) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0x0, 0xc, &(0x7f0000000240)=ANY=[@ANYBLOB="1800000000000002000000000000000018090000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000002000000b704000000000000850000004300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000240)=ANY=[], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r2, 0x5, 0xb68, 0x560b0000, &(0x7f0000000000)="219a53f271a76d2608004c6588a8", 0x0, 0xd01, 0x2a0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff) 28.170942ms ago: executing program 3 (id=2900): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x4, 0x0, 0x0, 0x4}, 0x94) socket$inet6_tcp(0xa, 0x1, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000000300)={@link_local, @random="2059249b3790", @void, {@ipv6={0x86dd, @udp={0x0, 0x6, "108114", 0x8, 0x11, 0x0, @empty, @mcast2, {[], {0x0, 0xe22, 0x8}}}}}}, 0x0) 27.752277ms ago: executing program 4 (id=2901): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000a80)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000fdff00000000000000000000180100002020702500000000002120207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000083850000002d00000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0xe, '\x00', 0x0, @fallback=0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000000)='kfree\x00', r0}, 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020207025000000002d"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="6000000002060103000000000000000000000004050001000700000013000300686173683a6e65742c696661636500000900020073797a30000000000500040000000000050005000a00000014000780050015000000000008001240"], 0x60}}, 0x0) 0s ago: executing program 5 (id=2902): setsockopt$inet6_group_source_req(0xffffffffffffffff, 0x29, 0x2e, &(0x7f0000000080)={0x0, {{0xa, 0x4, 0x0, @mcast1={0xff, 0x7}, 0x8a4}}, {{0xa, 0x4e20, 0x100, @remote, 0x4}}}, 0x108) r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCETHTOOL(r2, 0x8946, &(0x7f0000000240)={'dummy0\x00', &(0x7f0000000200)=@ethtool_perm_addr={0x4b, 0x16, "4372070000000000476fb2be4c3f9725f0f2bf568d62"}}) sendto$inet6(r1, &(0x7f0000000240)='\x00', 0x1, 0x0, &(0x7f0000000140)={0xa, 0x4e23, 0x0, @loopback, 0x5}, 0x1c) recvmmsg(r1, &(0x7f0000000740)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=""/21, 0x15}, 0x1ff}], 0x1, 0x10062, 0x0) sendmsg$netlink(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000001d40)=[{&(0x7f0000000380)=ANY=[@ANYBLOB="2c000000000000000003ff0000800000000000007d0f7fba0fa7185b14fa32f2bdcd0d1bc4fa01d2d897554ba9d97bebbc33de809c3e27629c07a7ee2da13e67345a893e7a44b1b8c4b1a188f2fcb24646c37f6437adef6158788f902d60cbeec2ee4662f0177efe27d46f99480d5904245687cd5476cf9781450e6c3ecb98ad3b2ef04c9127f5d12db35cce89e7e04b25dd6a569d42f4ec45f9dd46a01c1d2378be40f2cc1d99dead144b983fe7fffe9fa85755772c259c19b2d70044dcff549ffab6cbf167b95d51693a1c2b4331acf6f845164594c9505a93de0fdcebc7f1304a884c8d5512f1197c03f09c24e456e79c4d3978926e863a212e47ff4c7eaf38b1014eb1daaef8a21cfd0a339b197580ee20a69efbd43d242573ae4ace56eede27cc3de0fd9c42c2dbe0c594967db1c9cc3c07f8a86253cf96974ede24e8122a0443ea5afb108602730ff5966dbba3ca5509bd2a539861227a9ad5c46e0d27cee2549831056e44d522fb8fed5e34960cabdb68d471e3e0437065e4a21254ff5c902ab617fa7505629ae16592c71ae4eafcf1bfa082cb13e2c2387477e9ad22e84137453fd4922a020197397b91504a06f1d1ddaea6", @ANYRES32=0x0, @ANYBLOB="0a043cbf", @ANYRES32, @ANYBLOB="0a001b"], 0x2c}], 0x1}, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) sendmsg$IPSET_CMD_CREATE(r3, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000300)={&(0x7f0000000780)=ANY=[@ANYBLOB="4c00000002d198d2aed7e9d298fad7191974d92ae00601000000000005724d1400020073797a310000000011000300686173683a6e65742c6e65740000000005000400000000000500050001000000004e37000000000000000000000000000000992dc6fbf2338e7245cf28c6bf228989d6172d7e0fbf4531d4a51473d3e4f6264aa1b404f0208d59689acaefb6e5734df7c2cd48366884995acb6c30b2824cba81f82d113c893d265e2ba6cc0a2808cb4d7b9eda465117bbb3aa66a32d207741afaf78f1ac94d4efa37cf52ebdde13e583bfecb4436db97e35497ed1e4d10bc560366a80052c61bde08b68895e5468b792d21ccf1f7ac4b4a731125d9c7d5894c8f73003615d572f23deead4db63d28c7a4a28"], 0x4c}, 0x1, 0x0, 0x0, 0x80}, 0x804) pipe(0x0) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000001800)={0x11, 0xc, &(0x7f0000000600)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000fa540000850000008200000095"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x3, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000bc0)={&(0x7f0000000a80)='kfree\x00', r5}, 0x18) sendmsg$nl_route_sched(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)=@newqdisc={0x54, 0x10, 0x1, 0x0, 0xffffffd, {0x0, 0x0, 0x0, 0x0, {0x1, 0x3}, {}, {0xe}}, [@TCA_INGRESS_BLOCK={0x8}, @TCA_STAB={0x28, 0x8, 0x0, 0x1, [{{0x1c, 0x1a, {0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001, 0x0, 0x2}}, {0x8, 0x1b, [0x0, 0x0]}}]}]}, 0x54}}, 0x0) kernel console output (not intermixed with test programs): 6] netdevsim netdevsim3 eth3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 216.020624][ T7336] netdevsim netdevsim3 eth3: unset [1, 0] type 2 family 0 port 256 - 0 [ 216.029177][ T7336] netdevsim netdevsim3 eth3: unset [1, 1] type 2 family 0 port 6081 - 0 [ 216.037777][ T7336] netdevsim netdevsim3 eth3: set [1, 2] type 2 family 0 port 19999 - 0 [ 216.047288][T11506] wg1 speed is unknown, defaulting to 1000 [ 216.132604][T11537] lo speed is unknown, defaulting to 1000 [ 216.150248][T11537] wg1 speed is unknown, defaulting to 1000 [ 217.241999][T11592] 8021q: adding VLAN 0 to HW filter on device bond3 [ 217.593375][T11632] netlink: 'syz.3.1458': attribute type 1 has an invalid length. [ 217.729678][T11643] Unsupported ieee802154 address type: 0 [ 218.302640][T11673] A link change request failed with some changes committed already. Interface bridge_slave_1 may have been left with an inconsistent configuration, please check. [ 218.412584][T11678] lo speed is unknown, defaulting to 1000 [ 218.432752][T11678] wg1 speed is unknown, defaulting to 1000 [ 218.520757][T11681] tipc: Can't bind to reserved service type 1 [ 218.545473][T11681] netlink: 'syz.0.1474': attribute type 39 has an invalid length. [ 218.600010][T11691] __nla_validate_parse: 15 callbacks suppressed [ 218.600033][T11691] netlink: 44 bytes leftover after parsing attributes in process `syz.0.1474'. [ 218.676049][T11691] netlink: 43 bytes leftover after parsing attributes in process `syz.0.1474'. [ 218.686011][T11691] netlink: 'syz.0.1474': attribute type 5 has an invalid length. [ 218.695797][T11691] netlink: 43 bytes leftover after parsing attributes in process `syz.0.1474'. [ 218.734107][T11691] vlan3: entered allmulticast mode [ 218.976457][T11708] netlink: 212376 bytes leftover after parsing attributes in process `syz.1.1484'. [ 219.135826][T11720] FAULT_INJECTION: forcing a failure. [ 219.135826][T11720] name failslab, interval 1, probability 0, space 0, times 0 [ 219.181312][T11720] CPU: 1 UID: 0 PID: 11720 Comm: syz.1.1488 Not tainted syzkaller #0 PREEMPT(full) [ 219.181340][T11720] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 219.181351][T11720] Call Trace: [ 219.181358][T11720] [ 219.181367][T11720] dump_stack_lvl+0x189/0x250 [ 219.181395][T11720] ? __pfx____ratelimit+0x10/0x10 [ 219.181415][T11720] ? __pfx_dump_stack_lvl+0x10/0x10 [ 219.181438][T11720] ? __pfx__printk+0x10/0x10 [ 219.181466][T11720] ? __lock_acquire+0xab9/0xd20 [ 219.181504][T11720] should_fail_ex+0x414/0x560 [ 219.181539][T11720] should_failslab+0xa8/0x100 [ 219.181570][T11720] kmem_cache_alloc_noprof+0x73/0x3c0 [ 219.181595][T11720] ? skb_clone+0x212/0x3a0 [ 219.181634][T11720] skb_clone+0x212/0x3a0 [ 219.181661][T11720] __netlink_deliver_tap+0x404/0x850 [ 219.181697][T11720] ? netlink_deliver_tap+0x2e/0x1b0 [ 219.181722][T11720] netlink_deliver_tap+0x19c/0x1b0 [ 219.181746][T11720] netlink_unicast+0x7fa/0x9e0 [ 219.181775][T11720] ? __pfx_netlink_unicast+0x10/0x10 [ 219.181798][T11720] ? netlink_sendmsg+0x642/0xb30 [ 219.181820][T11720] ? skb_put+0x11b/0x210 [ 219.181846][T11720] netlink_sendmsg+0x805/0xb30 [ 219.181879][T11720] ? __pfx_netlink_sendmsg+0x10/0x10 [ 219.181906][T11720] ? aa_sock_msg_perm+0xf1/0x1d0 [ 219.181929][T11720] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 219.181950][T11720] ? __pfx_netlink_sendmsg+0x10/0x10 [ 219.181974][T11720] __sock_sendmsg+0x219/0x270 [ 219.181998][T11720] ____sys_sendmsg+0x505/0x830 [ 219.182030][T11720] ? __pfx_____sys_sendmsg+0x10/0x10 [ 219.182067][T11720] ? import_iovec+0x74/0xa0 [ 219.182096][T11720] ___sys_sendmsg+0x21f/0x2a0 [ 219.182125][T11720] ? __pfx____sys_sendmsg+0x10/0x10 [ 219.182191][T11720] ? __fget_files+0x2a/0x420 [ 219.182208][T11720] ? __fget_files+0x3a0/0x420 [ 219.182236][T11720] __x64_sys_sendmsg+0x19b/0x260 [ 219.182265][T11720] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 219.182302][T11720] ? __pfx_ksys_write+0x10/0x10 [ 219.182334][T11720] ? do_syscall_64+0xbe/0x3b0 [ 219.182358][T11720] do_syscall_64+0xfa/0x3b0 [ 219.182377][T11720] ? lockdep_hardirqs_on+0x9c/0x150 [ 219.182395][T11720] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 219.182412][T11720] ? clear_bhb_loop+0x60/0xb0 [ 219.182434][T11720] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 219.182451][T11720] RIP: 0033:0x7fe3b5b8eba9 [ 219.182469][T11720] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 219.182487][T11720] RSP: 002b:00007fe3b6ab7038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 219.182507][T11720] RAX: ffffffffffffffda RBX: 00007fe3b5dd5fa0 RCX: 00007fe3b5b8eba9 [ 219.182522][T11720] RDX: 0000000000000080 RSI: 0000200000000240 RDI: 0000000000000003 [ 219.182533][T11720] RBP: 00007fe3b6ab7090 R08: 0000000000000000 R09: 0000000000000000 [ 219.182544][T11720] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 219.182555][T11720] R13: 00007fe3b5dd6038 R14: 00007fe3b5dd5fa0 R15: 00007fffc36d8988 [ 219.182586][T11720] [ 219.565938][T11726] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1490'. [ 219.621325][T11735] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1495'. [ 219.899374][T11744] netlink: 24 bytes leftover after parsing attributes in process `syz.4.1496'. [ 220.217781][T11736] lo speed is unknown, defaulting to 1000 [ 220.221671][T11767] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1501'. [ 220.241516][T11763] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1498'. [ 220.270665][T11767] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1501'. [ 220.353025][T11763] syz_tun (unregistering): left allmulticast mode [ 220.471072][T11778] netlink: 'syz.4.1505': attribute type 4 has an invalid length. [ 220.479513][T11736] wg1 speed is unknown, defaulting to 1000 [ 220.614202][T11786] syzkaller1: entered promiscuous mode [ 220.631752][T11786] syzkaller1: entered allmulticast mode [ 221.020022][T11806] pim6reg1: entered promiscuous mode [ 221.025528][T11806] pim6reg1: entered allmulticast mode [ 221.236104][T11817] lo speed is unknown, defaulting to 1000 [ 221.244793][T11817] wg1 speed is unknown, defaulting to 1000 [ 221.334661][T11826] syzkaller0: entered allmulticast mode [ 222.284832][T11870] lo speed is unknown, defaulting to 1000 [ 222.293593][T11870] wg1 speed is unknown, defaulting to 1000 [ 222.380121][T11877] macvlan2: entered promiscuous mode [ 222.399139][T11877] vlan0: entered promiscuous mode [ 222.512032][T11885] tipc: Enabled bearer , priority 0 [ 222.525098][T11885] syzkaller0: entered promiscuous mode [ 222.537968][T11885] syzkaller0: entered allmulticast mode [ 222.586573][T11885] tipc: Resetting bearer [ 222.669993][T11882] tipc: Resetting bearer [ 222.724251][T11882] tipc: Disabling bearer [ 222.814052][T11899] netlink: 'syz.3.1540': attribute type 21 has an invalid length. [ 222.824455][T11899] netlink: 'syz.3.1540': attribute type 5 has an invalid length. [ 223.012358][T11907] netlink: 'syz.3.1543': attribute type 1 has an invalid length. [ 223.036206][T11907] netlink: 'syz.3.1543': attribute type 2 has an invalid length. [ 223.108528][T11910] FAULT_INJECTION: forcing a failure. [ 223.108528][T11910] name failslab, interval 1, probability 0, space 0, times 0 [ 223.135334][T11910] CPU: 0 UID: 0 PID: 11910 Comm: syz.0.1544 Not tainted syzkaller #0 PREEMPT(full) [ 223.135361][T11910] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 223.135372][T11910] Call Trace: [ 223.135379][T11910] [ 223.135388][T11910] dump_stack_lvl+0x189/0x250 [ 223.135415][T11910] ? __pfx____ratelimit+0x10/0x10 [ 223.135433][T11910] ? __pfx_dump_stack_lvl+0x10/0x10 [ 223.135454][T11910] ? __pfx__printk+0x10/0x10 [ 223.135484][T11910] ? __pfx___might_resched+0x10/0x10 [ 223.135500][T11910] ? fs_reclaim_acquire+0x7d/0x100 [ 223.135522][T11910] should_fail_ex+0x414/0x560 [ 223.135552][T11910] ? hash_ipmac_create+0x3a9/0xfe0 [ 223.135577][T11910] should_failslab+0xa8/0x100 [ 223.135605][T11910] __kvmalloc_node_noprof+0x161/0x5f0 [ 223.135632][T11910] ? hash_ipmac_create+0x3a9/0xfe0 [ 223.135656][T11910] ? hash_ipmac_create+0x2fe/0xfe0 [ 223.135687][T11910] hash_ipmac_create+0x3a9/0xfe0 [ 223.135721][T11910] ? __nla_parse+0x40/0x60 [ 223.135741][T11910] ? __pfx_hash_ipmac_create+0x10/0x10 [ 223.135767][T11910] ip_set_create+0xa94/0x1940 [ 223.135784][T11910] ? ip_set_create+0x4a2/0x1940 [ 223.135813][T11910] ? __pfx_ip_set_create+0x10/0x10 [ 223.135868][T11910] nfnetlink_rcv_msg+0xb4d/0x1130 [ 223.135890][T11910] ? nfnetlink_rcv_msg+0x20d/0x1130 [ 223.135927][T11910] ? __pfx_nfnetlink_rcv_msg+0x10/0x10 [ 223.135979][T11910] ? is_bpf_text_address+0x26/0x2b0 [ 223.136033][T11910] netlink_rcv_skb+0x208/0x470 [ 223.136056][T11910] ? __pfx_nfnetlink_rcv_msg+0x10/0x10 [ 223.136077][T11910] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 223.136112][T11910] ? bpf_lsm_capable+0x9/0x20 [ 223.136137][T11910] ? security_capable+0x7e/0x2e0 [ 223.136170][T11910] nfnetlink_rcv+0x26a/0x2520 [ 223.136187][T11910] ? is_bpf_text_address+0x26/0x2b0 [ 223.136213][T11910] ? kernel_text_address+0xa5/0xe0 [ 223.136239][T11910] ? __kernel_text_address+0xd/0x40 [ 223.136259][T11910] ? unwind_get_return_address+0x4d/0x90 [ 223.136276][T11910] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 223.136293][T11910] ? arch_stack_walk+0xfc/0x150 [ 223.136332][T11910] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 223.136349][T11910] ? stack_depot_save_flags+0x40/0x860 [ 223.136374][T11910] ? __lock_acquire+0xab9/0xd20 [ 223.136416][T11910] ? __lock_acquire+0xab9/0xd20 [ 223.136445][T11910] ? netlink_deliver_tap+0x2e/0x1b0 [ 223.136468][T11910] ? netlink_deliver_tap+0x2e/0x1b0 [ 223.136491][T11910] netlink_unicast+0x82c/0x9e0 [ 223.136514][T11910] ? __pfx_netlink_unicast+0x10/0x10 [ 223.136531][T11910] ? netlink_sendmsg+0x642/0xb30 [ 223.136547][T11910] ? skb_put+0x11b/0x210 [ 223.136568][T11910] netlink_sendmsg+0x805/0xb30 [ 223.136595][T11910] ? __pfx_netlink_sendmsg+0x10/0x10 [ 223.136615][T11910] ? aa_sock_msg_perm+0xf1/0x1d0 [ 223.136632][T11910] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 223.136648][T11910] ? __pfx_netlink_sendmsg+0x10/0x10 [ 223.136666][T11910] __sock_sendmsg+0x219/0x270 [ 223.136683][T11910] ____sys_sendmsg+0x505/0x830 [ 223.136708][T11910] ? __pfx_____sys_sendmsg+0x10/0x10 [ 223.136735][T11910] ? import_iovec+0x74/0xa0 [ 223.136757][T11910] ___sys_sendmsg+0x21f/0x2a0 [ 223.136779][T11910] ? __pfx____sys_sendmsg+0x10/0x10 [ 223.136831][T11910] ? __fget_files+0x2a/0x420 [ 223.136844][T11910] ? __fget_files+0x3a0/0x420 [ 223.136866][T11910] __x64_sys_sendmsg+0x19b/0x260 [ 223.136889][T11910] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 223.136937][T11910] ? __pfx_ksys_write+0x10/0x10 [ 223.136954][T11910] ? rcu_is_watching+0x15/0xb0 [ 223.136974][T11910] ? do_syscall_64+0xbe/0x3b0 [ 223.136993][T11910] do_syscall_64+0xfa/0x3b0 [ 223.137008][T11910] ? lockdep_hardirqs_on+0x9c/0x150 [ 223.137030][T11910] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 223.137044][T11910] ? clear_bhb_loop+0x60/0xb0 [ 223.137064][T11910] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 223.137077][T11910] RIP: 0033:0x7faa7958eba9 [ 223.137092][T11910] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 223.137105][T11910] RSP: 002b:00007faa7a4da038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 223.137122][T11910] RAX: ffffffffffffffda RBX: 00007faa797d5fa0 RCX: 00007faa7958eba9 [ 223.137132][T11910] RDX: 0000000000000080 RSI: 0000200000000240 RDI: 0000000000000003 [ 223.137141][T11910] RBP: 00007faa7a4da090 R08: 0000000000000000 R09: 0000000000000000 [ 223.137150][T11910] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 223.137160][T11910] R13: 00007faa797d6038 R14: 00007faa797d5fa0 R15: 00007ffce9551798 [ 223.137185][T11910] [ 223.723593][T11918] __nla_validate_parse: 10 callbacks suppressed [ 223.723687][T11918] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1547'. [ 223.737578][T11914] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1545'. [ 223.741080][T11918] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1547'. [ 223.758160][T11918] netlink: 'syz.0.1547': attribute type 13 has an invalid length. [ 223.766546][T11918] netlink: 'syz.0.1547': attribute type 12 has an invalid length. [ 223.783567][T11903] lo speed is unknown, defaulting to 1000 [ 223.834352][T11903] wg1 speed is unknown, defaulting to 1000 [ 223.945371][T11928] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1549'. [ 224.458847][T11960] netlink: 'syz.1.1558': attribute type 5 has an invalid length. [ 224.554217][T11968] netlink: 36 bytes leftover after parsing attributes in process `syz.2.1560'. [ 224.646772][T11973] netlink: 'syz.0.1561': attribute type 1 has an invalid length. [ 224.726421][T11976] netlink: 'syz.4.1563': attribute type 4 has an invalid length. [ 224.798085][T11982] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1565'. [ 224.815785][T11982] netlink: 'syz.1.1565': attribute type 20 has an invalid length. [ 224.867529][ T7336] netdevsim netdevsim1 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 224.892382][ T7336] netdevsim netdevsim1 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 224.910015][ T1101] netdevsim netdevsim1 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 224.924049][ T1101] netdevsim netdevsim1 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 225.014204][T11990] lo speed is unknown, defaulting to 1000 [ 225.054273][T11990] wg1 speed is unknown, defaulting to 1000 [ 225.148386][T12000] pim6reg: entered allmulticast mode [ 225.192597][T12000] pim6reg: left allmulticast mode [ 225.268692][T12008] bond0: option ad_select: unable to set because the bond device is up [ 225.374919][T12015] netlink: 'syz.3.1576': attribute type 4 has an invalid length. [ 225.417014][T12017] netlink: 68 bytes leftover after parsing attributes in process `syz.0.1577'. [ 225.469804][T12021] netlink: 48 bytes leftover after parsing attributes in process `syz.2.1579'. [ 225.489770][T12021] netlink: 44 bytes leftover after parsing attributes in process `syz.2.1579'. [ 225.543698][T12017] tipc: Enabled bearer , priority 0 [ 225.556275][T12017] syzkaller0: entered promiscuous mode [ 225.588531][T12017] syzkaller0: entered allmulticast mode [ 225.664977][T12031] netlink: 48 bytes leftover after parsing attributes in process `syz.2.1583'. [ 225.698331][T12019] lo speed is unknown, defaulting to 1000 [ 225.749133][T12017] tipc: Resetting bearer [ 225.765977][T12031] af_packet: tpacket_rcv: packet too big, clamped from 1 to 4294967272. macoff=96 [ 225.766647][T12019] wg1 speed is unknown, defaulting to 1000 [ 225.807263][T12016] tipc: Resetting bearer [ 225.827781][T12016] tipc: Disabling bearer [ 225.869230][T12035] xfrm1: entered allmulticast mode [ 225.903116][T12035] macvlan2: entered allmulticast mode [ 225.908914][T12035] hsr0: entered allmulticast mode [ 225.914358][T12035] hsr_slave_0: entered allmulticast mode [ 225.921368][T12035] hsr_slave_1: entered allmulticast mode [ 226.093297][T12047] netlink: 'syz.2.1586': attribute type 1 has an invalid length. [ 226.108923][T12047] netlink: 'syz.2.1586': attribute type 1 has an invalid length. [ 226.166834][T12047] openvswitch: netlink: Missing key (keys=40, expected=2000) [ 226.280830][T12050] lo speed is unknown, defaulting to 1000 [ 226.307754][T12050] wg1 speed is unknown, defaulting to 1000 [ 226.339210][T12047] lo speed is unknown, defaulting to 1000 [ 226.376943][T12047] wg1 speed is unknown, defaulting to 1000 [ 226.377737][T12056] syzkaller1: entered promiscuous mode [ 226.388794][T12056] syzkaller1: entered allmulticast mode [ 226.567260][T12061] netlink: 'syz.1.1591': attribute type 4 has an invalid length. [ 226.746348][T12065] IPVS: Scheduler module ip_vs_ not found [ 227.232317][T12083] 8021q: adding VLAN 0 to HW filter on device bond4 [ 227.251739][T12088] bond4: (slave geneve2): making interface the new active one [ 227.260883][T12088] bond4: (slave geneve2): Enslaving as an active interface with an up link [ 227.286161][T12083] bond4: entered promiscuous mode [ 227.291498][T12083] geneve2: entered promiscuous mode [ 227.475194][ T1101] netdevsim netdevsim4 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 227.485562][T12087] bridge_slave_1: left allmulticast mode [ 227.491704][T12087] bridge_slave_1: left promiscuous mode [ 227.498208][T12087] bridge0: port 2(bridge_slave_1) entered disabled state [ 227.514168][T12087] bridge_slave_0: left promiscuous mode [ 227.520441][T12087] bridge0: port 1(bridge_slave_0) entered disabled state [ 227.747208][ T1101] netdevsim netdevsim4 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 227.771691][ T1101] netdevsim netdevsim4 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 227.817078][ T1101] netdevsim netdevsim4 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 227.891042][T12111] lo speed is unknown, defaulting to 1000 [ 227.898494][T12111] wg1 speed is unknown, defaulting to 1000 [ 228.556462][T12147] IPVS: set_ctl: invalid protocol: 60 172.20.20.38:20001 [ 228.742585][T12153] lo speed is unknown, defaulting to 1000 [ 228.755380][T12153] wg1 speed is unknown, defaulting to 1000 [ 228.818330][T12156] __nla_validate_parse: 8 callbacks suppressed [ 228.818349][T12156] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1622'. [ 229.485839][T12179] validate_nla: 6 callbacks suppressed [ 229.485860][T12179] netlink: 'syz.2.1629': attribute type 13 has an invalid length. [ 229.500113][T12179] netlink: 'syz.2.1629': attribute type 17 has an invalid length. [ 229.609990][T12186] netlink: 33 bytes leftover after parsing attributes in process `syz.3.1631'. [ 229.680560][ T9] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 229.691102][T12179] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 229.708847][T12176] xfrm0: entered promiscuous mode [ 229.716120][T12176] xfrm0: entered allmulticast mode [ 229.737084][T12191] A link change request failed with some changes committed already. Interface bridge_slave_0 may have been left with an inconsistent configuration, please check. [ 229.813712][T12184] lo speed is unknown, defaulting to 1000 [ 229.821892][T12194] netlink: 64 bytes leftover after parsing attributes in process `syz.3.1633'. [ 229.838744][T12184] wg1 speed is unknown, defaulting to 1000 [ 229.920575][T12175] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 230.027676][T12207] netlink: 'syz.1.1635': attribute type 1 has an invalid length. [ 230.308907][T12222] lo speed is unknown, defaulting to 1000 [ 230.341826][T12222] wg1 speed is unknown, defaulting to 1000 [ 230.448849][T12231] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1643'. [ 230.654892][T12243] netlink: 'syz.1.1648': attribute type 9 has an invalid length. [ 230.663198][T12243] netlink: 'syz.1.1648': attribute type 7 has an invalid length. [ 230.680404][T12243] netlink: 'syz.1.1648': attribute type 8 has an invalid length. [ 230.719721][ T9450] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 230.895061][T12253] netlink: 'syz.1.1651': attribute type 1 has an invalid length. [ 230.956487][T12253] 8021q: adding VLAN 0 to HW filter on device bond4 [ 231.015252][T12263] bond4: (slave bridge2): Enslaving as an active interface with an up link [ 231.218020][T12272] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1656'. [ 231.240516][T12272] netlink: 20 bytes leftover after parsing attributes in process `syz.2.1656'. [ 231.248676][T12265] lo speed is unknown, defaulting to 1000 [ 231.263862][T12272] geneve0: entered promiscuous mode [ 231.295747][T12272] geneve0: entered allmulticast mode [ 231.314554][T12265] wg1 speed is unknown, defaulting to 1000 [ 231.406066][T12281] netlink: 'syz.1.1660': attribute type 10 has an invalid length. [ 231.485369][T12281] netlink: 'syz.1.1660': attribute type 10 has an invalid length. [ 231.536363][T12281] dummy0: entered promiscuous mode [ 231.572011][T12281] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 231.807863][T12295] netlink: 'syz.1.1664': attribute type 1 has an invalid length. [ 231.946710][T12295] 8021q: adding VLAN 0 to HW filter on device bond5 [ 232.064431][T12297] bond0: (slave dummy0): Releasing backup interface [ 232.087846][T12297] dummy0: left promiscuous mode [ 232.137010][T12309] netlink: 48 bytes leftover after parsing attributes in process `syz.0.1667'. [ 233.058165][T12355] netlink: 84 bytes leftover after parsing attributes in process `syz.3.1678'. [ 233.287702][T12361] (unnamed net_device) (uninitialized): option primary_reselect: invalid value (6) [ 233.350835][T12367] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 233.358669][T12367] IPv6: NLM_F_CREATE should be set when creating new route [ 233.366063][T12367] IPv6: NLM_F_CREATE should be set when creating new route [ 233.405068][T12370] netlink: 184 bytes leftover after parsing attributes in process `syz.2.1683'. [ 233.441019][T12369] lo speed is unknown, defaulting to 1000 [ 233.448607][T12369] wg1 speed is unknown, defaulting to 1000 [ 233.667593][T12388] IPVS: set_ctl: invalid protocol: 41 255.255.255.255:20001 [ 233.701220][T12381] netlink: 72 bytes leftover after parsing attributes in process `syz.4.1687'. [ 233.973321][T12413] __nla_validate_parse: 1 callbacks suppressed [ 233.973340][T12413] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1693'. [ 234.261337][T12429] netlink: 16 bytes leftover after parsing attributes in process `syz.4.1697'. [ 234.570538][T12443] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1703'. [ 234.594996][T12450] netlink: 36 bytes leftover after parsing attributes in process `syz.4.1704'. [ 234.661134][T12453] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1703'. [ 234.678544][T12453] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1703'. [ 234.689564][T12453] netlink: 40 bytes leftover after parsing attributes in process `syz.2.1703'. [ 234.706527][T12453] netlink: 540 bytes leftover after parsing attributes in process `syz.2.1703'. [ 234.723387][T12461] validate_nla: 1 callbacks suppressed [ 234.723405][T12461] netlink: 'syz.2.1703': attribute type 10 has an invalid length. [ 234.759110][T12460] netlink: 'syz.1.1708': attribute type 1 has an invalid length. [ 234.772064][T12460] netlink: 168 bytes leftover after parsing attributes in process `syz.1.1708'. [ 234.791057][T12460] NCSI netlink: No device for ifindex 0 [ 234.872433][T12460] tipc: Enabled bearer , priority 0 [ 234.886670][T12460] syzkaller0: entered promiscuous mode [ 234.894632][T12460] syzkaller0: entered allmulticast mode [ 235.148937][T12472] netlink: 'syz.1.1708': attribute type 1 has an invalid length. [ 235.157834][T12472] netlink: 'syz.1.1708': attribute type 1 has an invalid length. [ 235.165872][T12472] netlink: 184 bytes leftover after parsing attributes in process `syz.1.1708'. [ 235.423184][T12483] atomic_op ffff88807d4c4998 conn xmit_atomic 0000000000000000 [ 236.001379][ T9] tipc: Node number set to 1516559516 [ 236.498468][T12471] tipc: Resetting bearer [ 236.528032][T12458] tipc: Resetting bearer [ 236.605494][T12458] tipc: Disabling bearer [ 237.191945][T12524] netlink: 'syz.4.1724': attribute type 29 has an invalid length. [ 238.274909][T12577] team0: No ports can be present during mode change [ 238.934691][T12592] tipc: Trying to set illegal importance in message [ 239.086602][T12595] block nbd2: shutting down sockets [ 239.171990][T12604] __nla_validate_parse: 8 callbacks suppressed [ 239.172008][T12604] netlink: 65039 bytes leftover after parsing attributes in process `syz.3.1747'. [ 239.442049][T12612] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1750'. [ 239.590435][T12618] netlink: 76 bytes leftover after parsing attributes in process `syz.4.1751'. [ 240.264173][T12638] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1756'. [ 240.288086][T12640] netlink: 'syz.1.1757': attribute type 8 has an invalid length. [ 240.616475][T12645] lo speed is unknown, defaulting to 1000 [ 240.624984][T12645] wg1 speed is unknown, defaulting to 1000 [ 240.659734][T12649] block nbd2: server does not support multiple connections per device. [ 240.671777][T12649] block nbd2: shutting down sockets [ 240.716327][T12654] lo speed is unknown, defaulting to 1000 [ 240.727699][T12654] wg1 speed is unknown, defaulting to 1000 [ 241.258264][T12678] netlink: 16402 bytes leftover after parsing attributes in process `syz.1.1767'. [ 241.273257][T12671] netlink: 16402 bytes leftover after parsing attributes in process `syz.1.1767'. [ 241.857774][T12714] vxcan3: entered allmulticast mode [ 241.869933][T12717] netlink: 108 bytes leftover after parsing attributes in process `syz.4.1782'. [ 241.990865][T12722] openvswitch: netlink: IPv6 tunnel dst address is zero [ 242.341243][T12737] netlink: 'syz.4.1785': attribute type 13 has an invalid length. [ 242.358486][T12737] netlink: 'syz.4.1785': attribute type 17 has an invalid length. [ 242.756497][T12737] 8021q: adding VLAN 0 to HW filter on device bond0 [ 243.019920][T12737] 8021q: adding VLAN 0 to HW filter on device team0 [ 243.037122][T12737] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 243.102169][T12745] lo speed is unknown, defaulting to 1000 [ 243.112345][T12745] wg1 speed is unknown, defaulting to 1000 [ 243.484028][T12766] sctp: [Deprecated]: syz.3.1792 (pid 12766) Use of int in max_burst socket option deprecated. [ 243.484028][T12766] Use struct sctp_assoc_value instead [ 243.570413][T12766] lo speed is unknown, defaulting to 1000 [ 243.612113][T12775] netlink: 68 bytes leftover after parsing attributes in process `syz.0.1794'. [ 243.631727][T12766] wg1 speed is unknown, defaulting to 1000 [ 243.723404][T12775] tipc: Enabled bearer , priority 0 [ 243.750876][T12775] syzkaller0: entered promiscuous mode [ 243.756513][T12775] syzkaller0: entered allmulticast mode [ 243.771920][T12778] netlink: 'syz.4.1795': attribute type 1 has an invalid length. [ 243.774007][T12775] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 243.804570][T12775] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1794'. [ 243.816712][T12778] 8021q: VLANs not supported on sit0 [ 243.830283][T12774] tipc: Resetting bearer [ 243.878526][T12774] tipc: Disabling bearer [ 244.023674][T12785] sctp: [Deprecated]: syz.4.1797 (pid 12785) Use of int in max_burst socket option. [ 244.023674][T12785] Use struct sctp_assoc_value instead [ 244.150126][T12792] netlink: 24 bytes leftover after parsing attributes in process `syz.4.1799'. [ 244.159774][T12792] netlink: 'syz.4.1799': attribute type 1 has an invalid length. [ 244.193817][T12792] lo speed is unknown, defaulting to 1000 [ 244.479090][T12792] wg1 speed is unknown, defaulting to 1000 [ 244.754416][T12805] lo speed is unknown, defaulting to 1000 [ 244.769133][T12805] wg1 speed is unknown, defaulting to 1000 [ 244.834744][T12804] lo speed is unknown, defaulting to 1000 [ 244.865661][T12809] __nla_validate_parse: 1 callbacks suppressed [ 244.865682][T12809] netlink: 20 bytes leftover after parsing attributes in process `syz.4.1804'. [ 244.935704][T12804] wg1 speed is unknown, defaulting to 1000 [ 245.050404][T12811] netlink: 'syz.4.1805': attribute type 1 has an invalid length. [ 245.071178][T12811] netlink: 'syz.4.1805': attribute type 1 has an invalid length. [ 245.372919][T12818] netlink: 'syz.4.1805': attribute type 1 has an invalid length. [ 245.383231][T12819] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1806'. [ 245.422940][T12819] openvswitch: netlink: Flow actions attr not present in new flow. [ 245.458505][T12819] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1806'. [ 245.477332][T12819] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1806'. [ 245.633427][T12818] 8021q: adding VLAN 0 to HW filter on device bond5 [ 245.719541][T12811] vlan1: entered allmulticast mode [ 245.736725][T12811] veth1: entered allmulticast mode [ 246.107962][T12840] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1811'. [ 246.207932][T12844] !: renamed from dummy0 [ 246.306036][T12849] netlink: 'syz.0.1815': attribute type 10 has an invalid length. [ 246.315205][T12849] openvswitch: netlink: Flow set message rejected, Key attribute missing. [ 246.435967][T12850] lo speed is unknown, defaulting to 1000 [ 246.481493][T12850] wg1 speed is unknown, defaulting to 1000 [ 246.568041][T12865] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1819'. [ 247.109856][T12888] netlink: 'syz.4.1824': attribute type 1 has an invalid length. [ 247.118630][T12888] netlink: 224 bytes leftover after parsing attributes in process `syz.4.1824'. [ 247.377381][T12906] netlink: 16 bytes leftover after parsing attributes in process `syz.3.1831'. [ 247.657952][T12923] netlink: 36 bytes leftover after parsing attributes in process `syz.4.1836'. [ 247.773497][T12925] lo speed is unknown, defaulting to 1000 [ 247.781806][T12925] wg1 speed is unknown, defaulting to 1000 [ 247.805872][T12929] netlink: 104 bytes leftover after parsing attributes in process `syz.4.1839'. [ 248.160589][T12939] A link change request failed with some changes committed already. Interface bridge_slave_1 may have been left with an inconsistent configuration, please check. [ 248.178848][T12939] netlink: 'syz.1.1842': attribute type 13 has an invalid length. [ 248.187040][T12939] netlink: 'syz.1.1842': attribute type 17 has an invalid length. [ 248.220780][T12939] gretap0: refused to change device tx_queue_len [ 248.232567][T12939] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 248.349923][T12946] netlink: 'syz.1.1844': attribute type 13 has an invalid length. [ 248.446127][T12946] lo speed is unknown, defaulting to 1000 [ 248.464342][T12946] wg1 speed is unknown, defaulting to 1000 [ 248.493739][T12948] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 248.613636][ T69] netdevsim netdevsim3 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 248.682901][ T69] netdevsim netdevsim3 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 248.704706][ T69] netdevsim netdevsim3 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 248.745196][ T69] netdevsim netdevsim3 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 248.813239][T12965] wg1: entered promiscuous mode [ 248.818436][T12965] wg1: entered allmulticast mode [ 248.987879][T12971] netlink: 'syz.0.1850': attribute type 1 has an invalid length. [ 249.025431][T12971] 8021q: adding VLAN 0 to HW filter on device bond3 [ 249.155400][T12979] lo speed is unknown, defaulting to 1000 [ 249.163332][T12979] wg1 speed is unknown, defaulting to 1000 [ 249.396829][T12999] netlink: 'syz.3.1857': attribute type 1 has an invalid length. [ 249.405154][T12999] netlink: 'syz.3.1857': attribute type 2 has an invalid length. [ 249.876105][T13024] vlan3: entered allmulticast mode [ 249.881892][T13024] batadv0: entered allmulticast mode [ 249.977577][T13029] __nla_validate_parse: 7 callbacks suppressed [ 249.977596][T13029] netlink: 200 bytes leftover after parsing attributes in process `syz.3.1868'. [ 249.997313][T13029] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1868'. [ 250.200701][T13037] netlink: 'syz.4.1870': attribute type 11 has an invalid length. [ 250.209674][T13036] lo speed is unknown, defaulting to 1000 [ 250.245058][T13037] netlink: 244 bytes leftover after parsing attributes in process `syz.4.1870'. [ 250.302782][T13036] wg1 speed is unknown, defaulting to 1000 [ 250.308789][T13030] lo speed is unknown, defaulting to 1000 [ 250.371943][T13027] lo speed is unknown, defaulting to 1000 [ 250.486100][T13030] wg1 speed is unknown, defaulting to 1000 [ 250.503625][T13050] netlink: 68 bytes leftover after parsing attributes in process `syz.0.1874'. [ 250.625644][T13027] wg1 speed is unknown, defaulting to 1000 [ 250.633874][T13050] tipc: Enabled bearer , priority 0 [ 250.660286][T13050] syzkaller0: entered promiscuous mode [ 250.679425][T13050] syzkaller0: entered allmulticast mode [ 250.724499][ T51] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 250.736056][ T51] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 250.746268][T13050] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 250.749501][ T51] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 250.773713][ T51] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 250.790879][ T51] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 250.861483][T13051] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1874'. [ 251.042074][T13049] tipc: Resetting bearer [ 251.062652][T13066] netlink: 20 bytes leftover after parsing attributes in process `syz.4.1878'. [ 251.133182][T13069] netlink: 'syz.4.1879': attribute type 1 has an invalid length. [ 251.150393][T13069] netlink: 'syz.4.1879': attribute type 1 has an invalid length. [ 251.197803][T13049] tipc: Disabling bearer [ 251.216326][T13069] netlink: 64 bytes leftover after parsing attributes in process `syz.4.1879'. [ 251.260451][T13057] lo speed is unknown, defaulting to 1000 [ 251.287490][T13057] wg1 speed is unknown, defaulting to 1000 [ 251.528714][T13057] chnl_net:caif_netlink_parms(): no params data found [ 251.631194][T13082] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1881'. [ 251.901281][T13057] bridge0: port 1(bridge_slave_0) entered blocking state [ 251.911803][T13057] bridge0: port 1(bridge_slave_0) entered disabled state [ 251.919229][T13057] bridge_slave_0: entered allmulticast mode [ 251.927745][T13057] bridge_slave_0: entered promiscuous mode [ 251.942650][T13057] bridge0: port 2(bridge_slave_1) entered blocking state [ 251.950312][T13057] bridge0: port 2(bridge_slave_1) entered disabled state [ 251.969573][T13057] bridge_slave_1: entered allmulticast mode [ 251.977767][T13057] bridge_slave_1: entered promiscuous mode [ 252.053372][T13091] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1884'. [ 252.086966][T13057] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 252.138386][T13057] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 252.206075][T13095] xt_l2tp: v2 tid > 0xffff: 37482740 [ 252.274021][T13057] team0: Port device team_slave_0 added [ 252.302485][T13057] team0: Port device team_slave_1 added [ 252.387857][T13103] netlink: 68 bytes leftover after parsing attributes in process `syz.0.1889'. [ 252.402052][T13057] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 252.418906][T13057] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 252.446010][T13057] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 252.478539][T13110] netlink: 'syz.4.1891': attribute type 1 has an invalid length. [ 252.487692][T13057] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 252.494837][T13057] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 252.521329][T13057] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 252.590235][T13103] tipc: Enabled bearer , priority 0 [ 252.607212][T13115] netlink: 'syz.3.1892': attribute type 2 has an invalid length. [ 252.616797][T13115] netlink: 'syz.3.1892': attribute type 2 has an invalid length. [ 252.678686][T13103] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 252.756439][T13103] tipc: Resetting bearer [ 252.825452][T13057] hsr_slave_0: entered promiscuous mode [ 252.835764][T13057] hsr_slave_1: entered promiscuous mode [ 252.845727][T13057] debugfs: 'hsr0' already exists in 'hsr' [ 252.856133][T13057] Cannot create hsr debugfs directory [ 252.879478][ T51] Bluetooth: hci5: command tx timeout [ 252.904797][T13102] tipc: Disabling bearer [ 254.962321][ T51] Bluetooth: hci5: command tx timeout [ 255.407695][T13193] netlink: 'syz.4.1914': attribute type 13 has an invalid length. [ 255.442408][T13193] netlink: 'syz.4.1914': attribute type 17 has an invalid length. [ 255.485901][T13201] __nla_validate_parse: 4 callbacks suppressed [ 255.485923][T13201] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1916'. [ 255.516661][T13193] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 255.563019][T13057] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 255.595209][T13057] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 255.628576][T13057] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 255.667743][T13057] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 255.708298][T13216] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1920'. [ 255.777842][T13228] netlink: 'syz.1.1922': attribute type 4 has an invalid length. [ 255.830403][T13233] netlink: 'syz.1.1922': attribute type 4 has an invalid length. [ 255.941884][T13228] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1922'. [ 255.971826][T13216] bridge3: port 1(veth9) entered blocking state [ 255.978502][T13216] bridge3: port 1(veth9) entered disabled state [ 255.985138][T13216] veth9: entered allmulticast mode [ 255.991859][T13216] veth9: entered promiscuous mode [ 256.142643][T13247] netlink: 'syz.1.1925': attribute type 13 has an invalid length. [ 256.169575][T13247] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1925'. [ 256.169638][T13246] wg2: entered promiscuous mode [ 256.186479][T13246] wg2: entered allmulticast mode [ 256.194969][T13247] netlink: 'syz.1.1925': attribute type 13 has an invalid length. [ 256.199064][T13057] 8021q: adding VLAN 0 to HW filter on device bond0 [ 256.214259][T13247] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1925'. [ 256.239629][T13250] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1927'. [ 256.256864][T13246] pimreg3: entered allmulticast mode [ 256.302572][T13057] 8021q: adding VLAN 0 to HW filter on device team0 [ 256.323585][ T7340] bridge0: port 1(bridge_slave_0) entered blocking state [ 256.330795][ T7340] bridge0: port 1(bridge_slave_0) entered forwarding state [ 256.362109][T13250] lo speed is unknown, defaulting to 1000 [ 256.371852][ T7327] bridge0: port 2(bridge_slave_1) entered blocking state [ 256.378990][ T7327] bridge0: port 2(bridge_slave_1) entered forwarding state [ 256.413704][T13250] wg1 speed is unknown, defaulting to 1000 [ 256.740407][T13266] netlink: 'syz.1.1930': attribute type 21 has an invalid length. [ 256.756086][T13266] IPv6: NLM_F_CREATE should be specified when creating new route [ 256.776206][T13266] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 256.784010][T13266] IPv6: NLM_F_CREATE should be set when creating new route [ 256.791340][T13266] IPv6: NLM_F_CREATE should be set when creating new route [ 256.798567][T13266] IPv6: NLM_F_CREATE should be set when creating new route [ 257.039908][ T51] Bluetooth: hci5: command tx timeout [ 257.130588][T13282] nbd2: detected capacity change from 0 to 127 [ 257.136745][T13289] netlink: 5 bytes leftover after parsing attributes in process `syz.4.1937'. [ 257.146998][ T51] block nbd2: Receive control failed (result -32) [ 257.183558][T13057] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 257.191564][T13291] netlink: 36 bytes leftover after parsing attributes in process `syz.0.1936'. [ 257.553161][T13310] rdma_rxe: rxe_newlink: failed to add lo [ 257.576790][T13313] netlink: 'syz.1.1943': attribute type 1 has an invalid length. [ 257.585009][T13302] lo speed is unknown, defaulting to 1000 [ 257.605473][T13302] wg1 speed is unknown, defaulting to 1000 [ 257.657149][T13313] 8021q: adding VLAN 0 to HW filter on device bond6 [ 257.685657][T13318] bond6: (slave ip6gretap1): making interface the new active one [ 257.695657][T13318] bond6: (slave ip6gretap1): Enslaving as an active interface with an up link [ 257.742108][T13313] veth7: entered promiscuous mode [ 257.750426][T13313] bond6: (slave veth7): Enslaving as an active interface with a down link [ 257.767298][T13313] erspan0: entered allmulticast mode [ 257.783031][T13313] bond6: (slave erspan0): Enslaving as an active interface with an up link [ 257.867479][T13057] veth0_vlan: entered promiscuous mode [ 257.880067][T13057] veth1_vlan: entered promiscuous mode [ 257.917464][T13057] veth0_macvtap: entered promiscuous mode [ 257.934843][T13057] veth1_macvtap: entered promiscuous mode [ 257.969400][T13057] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 257.987799][T13057] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 258.012339][ T7324] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 258.024382][ T7324] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 258.036451][ T7324] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 258.045764][ T7324] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 258.123574][ T7331] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 258.141591][ T7331] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 258.237965][ T7324] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 258.248286][ T7324] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 258.448663][T13339] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1948'. [ 258.458388][T13339] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1948'. [ 258.468784][T13339] netlink: 'syz.0.1948': attribute type 15 has an invalid length. [ 258.543927][ T7324] netdevsim netdevsim0 eth0: set [0, 0] type 1 family 0 port 256 - 0 [ 258.554843][T13339] netlink: 'syz.0.1948': attribute type 15 has an invalid length. [ 258.571434][ T7324] netdevsim netdevsim0 eth1: set [0, 0] type 1 family 0 port 256 - 0 [ 258.581676][T13341] atm:sigd_send: bad message type 36 [ 258.596240][ T7324] netdevsim netdevsim0 eth2: set [0, 0] type 1 family 0 port 256 - 0 [ 258.605593][ T7324] netdevsim netdevsim0 eth3: set [0, 0] type 1 family 0 port 256 - 0 [ 258.634496][T13343] lo speed is unknown, defaulting to 1000 [ 258.642249][T13343] wg1 speed is unknown, defaulting to 1000 [ 258.737200][T13346] sctp: [Deprecated]: syz.3.1951 (pid 13346) Use of struct sctp_assoc_value in delayed_ack socket option. [ 258.737200][T13346] Use struct sctp_sack_info instead [ 258.853743][T13352] lo speed is unknown, defaulting to 1000 [ 258.861532][T13352] wg1 speed is unknown, defaulting to 1000 [ 258.971792][T13358] lo speed is unknown, defaulting to 1000 [ 259.006965][T13358] wg1 speed is unknown, defaulting to 1000 [ 259.120510][ T51] Bluetooth: hci5: command tx timeout [ 259.462337][T13370] lo speed is unknown, defaulting to 1000 [ 259.470285][T13370] wg1 speed is unknown, defaulting to 1000 [ 259.489239][T13374] Bluetooth: MGMT ver 1.23 [ 259.501623][T13374] geneve2: entered promiscuous mode [ 259.522774][T13373] netlink: 'syz.3.1959': attribute type 4 has an invalid length. [ 259.548918][T13373] batadv_slave_1: entered promiscuous mode [ 259.682783][T13372] batadv_slave_1: left promiscuous mode [ 259.700620][T13377] netlink: 'syz.5.1960': attribute type 11 has an invalid length. [ 259.792197][T13385] A link change request failed with some changes committed already. Interface wg1 may have been left with an inconsistent configuration, please check. [ 260.006850][T13394] lo speed is unknown, defaulting to 1000 [ 260.044853][T13394] wg1 speed is unknown, defaulting to 1000 [ 260.081758][T13399] netlink: 'syz.5.1966': attribute type 9 has an invalid length. [ 260.303524][T13407] tipc: Enabled bearer , priority 0 [ 260.325040][T13406] syzkaller0: entered promiscuous mode [ 260.337670][T13406] syzkaller0: entered allmulticast mode [ 260.375087][T13417] netlink: 'syz.0.1970': attribute type 4 has an invalid length. [ 260.462767][T13423] ªªªªª»: renamed from syz_tun (while UP) [ 260.509727][T13405] tipc: Resetting bearer [ 260.592571][T13405] tipc: Disabling bearer [ 260.755844][T13439] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 260.880438][ T5967] IPVS: starting estimator thread 0... [ 260.900246][T13455] __nla_validate_parse: 7 callbacks suppressed [ 260.900267][T13455] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1981'. [ 260.970023][T13453] IPVS: using max 32 ests per chain, 76800 per kthread [ 261.014049][T13457] lo speed is unknown, defaulting to 1000 [ 261.022400][T13457] wg1 speed is unknown, defaulting to 1000 [ 261.183579][T13463] lo speed is unknown, defaulting to 1000 [ 261.190623][T13463] wg1 speed is unknown, defaulting to 1000 [ 262.465190][T13505] lo speed is unknown, defaulting to 1000 [ 262.483433][T13505] wg1 speed is unknown, defaulting to 1000 [ 262.881268][ T5877] Bluetooth: hci5: command 0x0405 tx timeout [ 262.925561][T13516] netlink: 292 bytes leftover after parsing attributes in process `syz.5.1998'. [ 263.032760][T13529] netlink: del zone limit has 8 unknown bytes [ 263.266337][T13549] lo speed is unknown, defaulting to 1000 [ 263.274172][T13549] wg1 speed is unknown, defaulting to 1000 [ 263.860151][T13571] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2013'. [ 263.924468][T13587] validate_nla: 1 callbacks suppressed [ 263.924486][T13587] netlink: 'syz.3.2017': attribute type 10 has an invalid length. [ 263.953072][T13587] mac80211_hwsim hwsim11 wlan1: entered allmulticast mode [ 264.082489][T13596] openvswitch: netlink: Missing key (keys=40, expected=10000000) [ 264.196053][T13602] net veth1_virt_wifi ªªªªª: renamed from virt_wifi0 [ 264.342135][T13613] lo speed is unknown, defaulting to 1000 [ 264.350143][T13613] wg1 speed is unknown, defaulting to 1000 [ 264.428363][T13618] dvmrp0: entered allmulticast mode [ 264.523386][T13623] netlink: 'syz.3.2026': attribute type 1 has an invalid length. [ 264.535050][T13624] netlink: 16 bytes leftover after parsing attributes in process `syz.5.2027'. [ 264.664504][T13634] tipc: Started in network mode [ 264.669681][T13634] tipc: Node identity b6bd510b37fa, cluster identity 4711 [ 264.678196][T13634] tipc: Enabled bearer , priority 0 [ 264.695492][T13636] syzkaller0: entered promiscuous mode [ 264.703296][T13636] syzkaller0: entered allmulticast mode [ 264.744495][T13634] tipc: Resetting bearer [ 264.754748][T13636] netlink: 12 bytes leftover after parsing attributes in process `syz.5.2029'. [ 264.766072][T13640] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2030'. [ 264.778614][T13632] tipc: Resetting bearer [ 264.806783][T13632] tipc: Disabling bearer [ 264.934055][T13644] netlink: 'syz.0.2032': attribute type 12 has an invalid length. [ 264.960179][T13649] netlink: 'syz.5.2034': attribute type 10 has an invalid length. [ 264.972851][T13649] team0: Device ipvlan1 failed to register rx_handler [ 265.024631][T13654] netlink: 52 bytes leftover after parsing attributes in process `syz.3.2036'. [ 265.037048][T13654] netlink: 52 bytes leftover after parsing attributes in process `syz.3.2036'. [ 265.049886][T13654] netlink: 52 bytes leftover after parsing attributes in process `syz.3.2036'. [ 265.318034][T13670] pim6reg99999999: entered allmulticast mode [ 265.787235][T13704] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2048'. [ 265.805570][T13704] mac80211_hwsim hwsim28 wlan1: entered promiscuous mode [ 265.814495][T13704] macvtap1: entered promiscuous mode [ 266.088946][T13719] A link change request failed with some changes committed already. Interface bridge_slave_0 may have been left with an inconsistent configuration, please check. [ 266.120162][T13720] Bluetooth: MGMT ver 1.23 [ 266.332473][T13722] lo speed is unknown, defaulting to 1000 [ 266.392770][T13722] wg1 speed is unknown, defaulting to 1000 [ 266.392973][T13723] netlink: 12 bytes leftover after parsing attributes in process `syz.5.2054'. [ 266.423974][T13723] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 266.431420][T13723] IPv6: NLM_F_CREATE should be set when creating new route [ 266.500098][T13727] batadv0: entered promiscuous mode [ 266.672154][T13728] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 266.685424][T13733] netlink: 'syz.0.2057': attribute type 3 has an invalid length. [ 266.724578][T13736] netlink: 16 bytes leftover after parsing attributes in process `syz.5.2058'. [ 266.782296][T13736] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 267.230531][T13762] netlink: 'syz.3.2065': attribute type 13 has an invalid length. [ 267.238470][T13762] netlink: 'syz.3.2065': attribute type 17 has an invalid length. [ 267.255339][T13764] netlink: 844 bytes leftover after parsing attributes in process `syz.0.2066'. [ 267.300688][T13768] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2067'. [ 267.334365][T13762] 8021q: adding VLAN 0 to HW filter on device team0 [ 267.345912][T13762] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 267.391693][T13768] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2067'. [ 267.481200][T13769] lo speed is unknown, defaulting to 1000 [ 267.488781][T13769] wg1 speed is unknown, defaulting to 1000 [ 267.620650][T13768] bond0: (slave 77ÿ): Releasing backup interface [ 267.813295][T13768] bond0: (slave bond_slave_1): Releasing backup interface [ 267.976443][T13768] team0: Port device team_slave_0 removed [ 268.122085][T13768] team0: Port device team_slave_1 removed [ 268.129135][T13768] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 268.362330][T13794] lo speed is unknown, defaulting to 1000 [ 268.410021][T13794] wg1 speed is unknown, defaulting to 1000 [ 268.585169][T13801] netlink: 'syz.5.2075': attribute type 10 has an invalid length. [ 268.634298][T13801] team0: Port device dummy0 added [ 268.662351][T13801] ksmbd: Daemon and kernel module version mismatch. ksmbd: 124, kernel module: 1. User-space ksmbd should terminate. [ 268.991559][T13819] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 269.144154][T13833] netlink: 'syz.0.2083': attribute type 11 has an invalid length. [ 269.157895][T13833] netlink: 'syz.0.2083': attribute type 11 has an invalid length. [ 269.178266][T13833] netlink: 224 bytes leftover after parsing attributes in process `syz.0.2083'. [ 269.246440][T13833] netlink: 16 bytes leftover after parsing attributes in process `syz.0.2083'. [ 269.427102][T13852] netlink: 'syz.0.2089': attribute type 1 has an invalid length. [ 269.441421][T13852] netlink: 17 bytes leftover after parsing attributes in process `syz.0.2089'. [ 269.583181][T13856] lo speed is unknown, defaulting to 1000 [ 269.595971][T13856] wg1 speed is unknown, defaulting to 1000 [ 269.814081][T13869] netlink: 224 bytes leftover after parsing attributes in process `syz.4.2092'. [ 269.882560][T13869] netlink: 'syz.4.2092': attribute type 1 has an invalid length. [ 269.935545][T13869] 8021q: adding VLAN 0 to HW filter on device bond7 [ 269.949523][T13871] lo speed is unknown, defaulting to 1000 [ 270.030157][T13871] wg1 speed is unknown, defaulting to 1000 [ 270.082555][T13874] macsec1: entered promiscuous mode [ 270.087897][T13874] macsec1: entered allmulticast mode [ 270.338943][T13890] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2099'. [ 270.381710][T13890] batman_adv: batadv0: Adding interface: ipvlan2 [ 270.388098][T13890] batman_adv: batadv0: The MTU of interface ipvlan2 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 270.418047][T13890] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 270.430136][T13890] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 270.441236][T13890] batman_adv: batadv0: Not using interface ipvlan2 (retrying later): interface not active [ 270.606864][T13911] netlink: 'syz.0.2107': attribute type 15 has an invalid length. [ 271.316174][T13932] netlink: 'syz.0.2114': attribute type 12 has an invalid length. [ 271.480400][T13941] __nla_validate_parse: 6 callbacks suppressed [ 271.480419][T13941] netlink: 16 bytes leftover after parsing attributes in process `syz.5.2117'. [ 271.524002][T13941] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 271.647722][T13948] openvswitch: netlink: Unexpected mask (mask=1040, allowed=10048) [ 271.648557][T13946] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2119'. [ 271.666638][T13946] openvswitch: netlink: nsh attribute has 65532 unknown bytes. [ 271.674347][T13946] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 271.858379][T13962] netlink: 48 bytes leftover after parsing attributes in process `syz.4.2125'. [ 271.947078][T13969] netlink: 32 bytes leftover after parsing attributes in process `syz.3.2127'. [ 272.068333][T13979] netlink: 200 bytes leftover after parsing attributes in process `syz.0.2128'. [ 272.140541][T13980] netlink: 'syz.3.2129': attribute type 3 has an invalid length. [ 272.461461][T14004] netlink: 20 bytes leftover after parsing attributes in process `syz.0.2133'. [ 272.484111][T14007] netlink: 'syz.3.2134': attribute type 4 has an invalid length. [ 272.492844][T14005] netlink: 20 bytes leftover after parsing attributes in process `syz.0.2133'. [ 272.850942][T14020] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 272.988443][T14040] netlink: 36 bytes leftover after parsing attributes in process `syz.3.2142'. [ 272.998782][T14040] netlink: 36 bytes leftover after parsing attributes in process `syz.3.2142'. [ 273.014150][T14040] netlink: 36 bytes leftover after parsing attributes in process `syz.3.2142'. [ 273.027429][T14020] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 273.106082][T14020] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 273.232486][T14020] netdevsim netdevsim5 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 273.306865][T14050] lo speed is unknown, defaulting to 1000 [ 273.425845][T14052] netlink: 'syz.4.2146': attribute type 4 has an invalid length. [ 273.441403][ T7327] netdevsim netdevsim5 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 273.488186][ T7327] netdevsim netdevsim5 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 273.515099][ T7327] netdevsim netdevsim5 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 273.567280][ T7327] netdevsim netdevsim5 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 273.586831][ T51] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 273.610655][ T51] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 273.623947][ T51] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 273.634429][ T51] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 273.643354][ T51] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 273.751568][T14054] lo speed is unknown, defaulting to 1000 [ 273.798726][T14059] lo speed is unknown, defaulting to 1000 [ 273.992587][T14072] netlink: 'syz.3.2152': attribute type 1 has an invalid length. [ 274.317994][T14093] netlink: 'syz.0.2156': attribute type 32 has an invalid length. [ 274.334736][T14099] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 274.342022][T14099] IPv6: NLM_F_CREATE should be set when creating new route [ 274.393316][T14054] chnl_net:caif_netlink_parms(): no params data found [ 274.703511][T14054] bridge0: port 1(bridge_slave_0) entered blocking state [ 274.722437][T14054] bridge0: port 1(bridge_slave_0) entered disabled state [ 274.742744][T14054] bridge_slave_0: entered allmulticast mode [ 274.762444][T14054] bridge_slave_0: entered promiscuous mode [ 274.782854][T14054] bridge0: port 2(bridge_slave_1) entered blocking state [ 274.792175][T14054] bridge0: port 2(bridge_slave_1) entered disabled state [ 274.800465][T14054] bridge_slave_1: entered allmulticast mode [ 274.811631][T14054] bridge_slave_1: entered promiscuous mode [ 274.885960][T14054] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 274.921248][T14054] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 275.107911][T14054] team0: Port device team_slave_0 added [ 275.145725][T14054] team0: Port device team_slave_1 added [ 275.211227][T14054] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 275.225374][T14054] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 275.260481][T14054] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 275.273109][T14140] sch_tbf: peakrate 4096 is lower than or equals to rate 185707055559232049 ! [ 275.320913][T14054] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 275.339219][T14054] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 275.373755][T14054] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 275.416054][T14151] wg1 speed is unknown, defaulting to 1000 [ 275.422904][T14151] wg1 speed is unknown, defaulting to 1000 [ 275.431623][T14151] wg1 speed is unknown, defaulting to 1000 [ 275.466142][T14155] netlink: 'syz.3.2173': attribute type 4 has an invalid length. [ 275.468829][T14151] infiniband syz0: RDMA CMA: cma_listen_on_dev, error -98 [ 275.527593][T14151] wg1 speed is unknown, defaulting to 1000 [ 275.537552][T14151] wg1 speed is unknown, defaulting to 1000 [ 275.546700][T14151] wg1 speed is unknown, defaulting to 1000 [ 275.554793][T14151] wg1 speed is unknown, defaulting to 1000 [ 275.568432][T14054] hsr_slave_0: entered promiscuous mode [ 275.578565][T14054] hsr_slave_1: entered promiscuous mode [ 275.585971][T14054] debugfs: 'hsr0' already exists in 'hsr' [ 275.593000][T14054] Cannot create hsr debugfs directory [ 275.598972][T14151] wg1 speed is unknown, defaulting to 1000 [ 275.607953][T14151] wg1 speed is unknown, defaulting to 1000 [ 275.616228][T14151] wg1 speed is unknown, defaulting to 1000 [ 275.679741][ T5871] Bluetooth: hci6: command tx timeout [ 275.937361][T14176] netlink: 'syz.5.2180': attribute type 20 has an invalid length. [ 276.028024][T14179] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 276.049323][ T9450] lo speed is unknown, defaulting to 1000 [ 276.050913][T14180] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 276.059919][ T9450] syz1: Port: 1 Link ACTIVE [ 276.072118][T14054] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 276.099730][T14054] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 276.122042][T14054] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 276.173724][T14054] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 276.386870][T14210] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 276.404845][T14208] netlink: 'syz.4.2191': attribute type 2 has an invalid length. [ 276.454038][T14213] netlink: 'syz.0.2193': attribute type 1 has an invalid length. [ 276.546500][T14213] 8021q: adding VLAN 0 to HW filter on device bond4 [ 276.598240][T14054] 8021q: adding VLAN 0 to HW filter on device bond0 [ 276.665188][T14054] 8021q: adding VLAN 0 to HW filter on device team0 [ 276.692395][ T7327] bridge0: port 1(bridge_slave_0) entered blocking state [ 276.699692][ T7327] bridge0: port 1(bridge_slave_0) entered forwarding state [ 276.726837][ T7331] bridge0: port 2(bridge_slave_1) entered blocking state [ 276.734256][ T7331] bridge0: port 2(bridge_slave_1) entered forwarding state [ 276.901440][T14232] openvswitch: netlink: IP tunnel attribute has 12 unknown bytes. [ 276.980344][T14240] FAULT_INJECTION: forcing a failure. [ 276.980344][T14240] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 277.023697][T14240] CPU: 1 UID: 0 PID: 14240 Comm: syz.4.2200 Not tainted syzkaller #0 PREEMPT(full) [ 277.023724][T14240] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 277.023747][T14240] Call Trace: [ 277.023755][T14240] [ 277.023763][T14240] dump_stack_lvl+0x189/0x250 [ 277.023790][T14240] ? __pfx____ratelimit+0x10/0x10 [ 277.023809][T14240] ? __pfx_dump_stack_lvl+0x10/0x10 [ 277.023830][T14240] ? __pfx__printk+0x10/0x10 [ 277.023855][T14240] ? __might_fault+0xb0/0x130 [ 277.023890][T14240] should_fail_ex+0x414/0x560 [ 277.023921][T14240] _copy_from_user+0x2d/0xb0 [ 277.023947][T14240] __sys_bpf+0x1ed/0x870 [ 277.023974][T14240] ? __pfx___sys_bpf+0x10/0x10 [ 277.024014][T14240] ? ksys_write+0x22a/0x250 [ 277.024042][T14240] ? __pfx_ksys_write+0x10/0x10 [ 277.024072][T14240] ? rcu_is_watching+0x15/0xb0 [ 277.024099][T14240] __x64_sys_bpf+0x7c/0x90 [ 277.024121][T14240] do_syscall_64+0xfa/0x3b0 [ 277.024140][T14240] ? lockdep_hardirqs_on+0x9c/0x150 [ 277.024158][T14240] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 277.024175][T14240] ? clear_bhb_loop+0x60/0xb0 [ 277.024197][T14240] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 277.024214][T14240] RIP: 0033:0x7f9c7578eba9 [ 277.024231][T14240] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 277.024246][T14240] RSP: 002b:00007f9c765aa038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 277.024265][T14240] RAX: ffffffffffffffda RBX: 00007f9c759d5fa0 RCX: 00007f9c7578eba9 [ 277.024278][T14240] RDX: 0000000000000050 RSI: 0000200000000180 RDI: 000000000000000a [ 277.024289][T14240] RBP: 00007f9c765aa090 R08: 0000000000000000 R09: 0000000000000000 [ 277.024300][T14240] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 277.024309][T14240] R13: 00007f9c759d6038 R14: 00007f9c759d5fa0 R15: 00007fffb78b56a8 [ 277.024339][T14240] [ 277.312812][T14243] lo speed is unknown, defaulting to 1000 [ 277.393134][T14252] __nla_validate_parse: 78 callbacks suppressed [ 277.393154][T14252] netlink: 264 bytes leftover after parsing attributes in process `syz.4.2203'. [ 277.476120][T14243] wg1 speed is unknown, defaulting to 1000 [ 277.510633][T14252] netlink: 'syz.4.2203': attribute type 10 has an invalid length. [ 277.551061][T14252] team0: Port device dummy0 added [ 277.570647][T14252] netlink: 'syz.4.2203': attribute type 10 has an invalid length. [ 277.585500][T14252] team0: Port device dummy0 removed [ 277.612793][T14252] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 277.654648][T14054] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 277.760221][ T51] Bluetooth: hci6: command 0x041b tx timeout [ 278.052939][T14275] syzkaller1: entered promiscuous mode [ 278.064604][T14275] syzkaller1: entered allmulticast mode [ 278.326097][T14294] netlink: 'syz.4.2212': attribute type 1 has an invalid length. [ 278.348700][T14294] netlink: 212 bytes leftover after parsing attributes in process `syz.4.2212'. [ 278.365932][T14294] netlink: 'syz.4.2212': attribute type 1 has an invalid length. [ 278.373755][T14054] veth0_vlan: entered promiscuous mode [ 278.414496][T14054] veth1_vlan: entered promiscuous mode [ 278.563081][T14054] veth0_macvtap: entered promiscuous mode [ 278.590918][T14054] veth1_macvtap: entered promiscuous mode [ 278.638152][T14054] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 278.692660][T14054] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 278.715522][ T7336] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 278.762016][ T7336] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 278.806589][ T7336] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 278.837823][ T7336] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 278.851114][T14321] netlink: 144 bytes leftover after parsing attributes in process `syz.5.2219'. [ 279.094583][T14329] netlink: 'syz.5.2222': attribute type 16 has an invalid length. [ 279.119643][T14329] netlink: 'syz.5.2222': attribute type 17 has an invalid length. [ 279.159067][ T7324] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 279.184801][ T7324] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 279.245057][T14320] lo speed is unknown, defaulting to 1000 [ 279.785565][T14329] bridge0: port 2(bridge_slave_1) entered disabled state [ 279.793464][T14329] bridge0: port 1(bridge_slave_0) entered disabled state [ 279.839956][ T51] Bluetooth: hci6: command 0x041b tx timeout [ 280.160009][T14329] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 280.178897][T14329] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 280.493162][T14320] wg1 speed is unknown, defaulting to 1000 [ 280.498563][ T7324] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 280.517439][ T7324] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 280.542621][ T7336] netdevsim netdevsim5 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 280.568899][ T7336] netdevsim netdevsim5 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 280.622784][ T7336] netdevsim netdevsim5 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 280.639528][ T7336] netdevsim netdevsim5 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 280.980563][T14369] bond5: entered promiscuous mode [ 280.986583][T14369] bond5: entered allmulticast mode [ 280.992355][T14369] 8021q: adding VLAN 0 to HW filter on device bond5 [ 281.292361][T14369] bond5 (unregistering): Released all slaves [ 281.821197][T14405] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2239'. [ 281.887237][T14405] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2239'. [ 281.920340][ T51] Bluetooth: hci6: command 0x041b tx timeout [ 281.929111][T14409] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2241'. [ 281.942426][T14405] netlink: 'syz.5.2239': attribute type 5 has an invalid length. [ 281.950896][T14405] netlink: 'syz.5.2239': attribute type 6 has an invalid length. [ 282.314857][T14407] geneve3: entered promiscuous mode [ 282.323239][T14407] geneve3: entered allmulticast mode [ 282.340522][T14409] batman_adv: batadv0: Adding interface: ipvlan0 [ 282.347082][T14409] batman_adv: batadv0: The MTU of interface ipvlan0 is too small (1536) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1568 would solve the problem. [ 282.373779][T14409] batman_adv: batadv0: Not using interface ipvlan0 (retrying later): interface not active [ 282.505401][T14414] 8021q: adding VLAN 0 to HW filter on device bond5 [ 282.554176][ T7324] netdevsim netdevsim4 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 282.599517][ T7324] netdevsim netdevsim4 eth0: set [1, 1] type 2 family 0 port 19999 - 0 [ 282.642792][ T7324] netdevsim netdevsim4 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 282.664991][ T7324] netdevsim netdevsim4 eth1: set [1, 1] type 2 family 0 port 19999 - 0 [ 282.693934][ T7324] netdevsim netdevsim4 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 282.709849][ T7324] netdevsim netdevsim4 eth2: set [1, 1] type 2 family 0 port 19999 - 0 [ 282.726294][ T7324] netdevsim netdevsim4 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 282.735901][ T7324] netdevsim netdevsim4 eth3: set [1, 1] type 2 family 0 port 19999 - 0 [ 282.792948][T14436] netlink: 16 bytes leftover after parsing attributes in process `syz.0.2246'. [ 282.865334][T14436] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 283.200129][T14448] netlink: 256 bytes leftover after parsing attributes in process `syz.4.2249'. [ 283.342826][T14455] lo speed is unknown, defaulting to 1000 [ 283.367875][T14455] wg1 speed is unknown, defaulting to 1000 [ 283.397361][T14462] netlink: 8 bytes leftover after parsing attributes in process `syz.6.2253'. [ 283.457721][T14462] (unnamed net_device) (uninitialized): option primary: mode dependency failed, not supported in mode balance-rr(0) [ 283.547171][T14470] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2255'. [ 283.587244][T14470] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2255'. [ 283.612851][T14470] netlink: 'syz.4.2255': attribute type 5 has an invalid length. [ 283.646983][T14474] netlink: 'syz.0.2256': attribute type 3 has an invalid length. [ 283.656270][T14471] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2255'. [ 283.660299][T14470] netlink: 'syz.4.2255': attribute type 6 has an invalid length. [ 283.665775][T14471] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2255'. [ 283.683735][T14471] netlink: 'syz.4.2255': attribute type 5 has an invalid length. [ 283.690029][T14474] netlink: 'syz.0.2256': attribute type 3 has an invalid length. [ 283.691848][T14471] netlink: 'syz.4.2255': attribute type 6 has an invalid length. [ 283.750685][T14474] IPv6: Can't replace route, no match found [ 284.001289][ T51] Bluetooth: hci6: command 0x041b tx timeout [ 284.139046][T14505] netlink: 16 bytes leftover after parsing attributes in process `syz.0.2264'. [ 284.195503][T14505] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 284.424777][T14517] lo speed is unknown, defaulting to 1000 [ 284.444197][T14517] wg1 speed is unknown, defaulting to 1000 [ 284.978572][T14542] lo speed is unknown, defaulting to 1000 [ 285.030584][T14542] wg1 speed is unknown, defaulting to 1000 [ 285.164022][T14558] lo speed is unknown, defaulting to 1000 [ 285.214190][T14564] netlink: 44 bytes leftover after parsing attributes in process `syz.3.2281'. [ 285.273374][T14558] wg1 speed is unknown, defaulting to 1000 [ 285.292753][T14564] netlink: 56 bytes leftover after parsing attributes in process `syz.3.2281'. [ 285.536560][T14560] infiniband syz!: set down [ 285.548745][T14560] infiniband syz!: added team_slave_0 [ 285.713160][T14560] RDS/IB: syz!: added [ 285.718207][T14560] smc: adding ib device syz! with port count 1 [ 285.754412][T14560] smc: ib device syz! port 1 has no pnetid [ 285.900498][T14580] netlink: 'syz.3.2287': attribute type 4 has an invalid length. [ 285.922138][T14581] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 285.990477][T14583] netlink: 'syz.5.2288': attribute type 1 has an invalid length. [ 286.080606][ T51] Bluetooth: hci6: command 0x041b tx timeout [ 287.097472][ T43] hid-generic 0005:0007:0008.0001: item fetching failed at offset 0/2 [ 287.120675][ T43] hid-generic 0005:0007:0008.0001: probe with driver hid-generic failed with error -22 [ 287.673609][T14617] batadv1: entered promiscuous mode [ 287.678863][T14617] batadv1: entered allmulticast mode [ 287.832362][T14618] bridge0: port 2(bridge_slave_1) entered disabled state [ 287.840310][T14618] bridge0: port 1(bridge_slave_0) entered disabled state [ 287.983446][T14618] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 288.002349][T14618] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 288.164633][ T7328] netdevsim netdevsim6 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 288.190928][ T7328] netdevsim netdevsim6 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 288.220918][ T7328] netdevsim netdevsim6 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 288.249918][ T7328] netdevsim netdevsim6 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 288.395793][T14622] syzkaller0: entered promiscuous mode [ 288.410835][T14626] __nla_validate_parse: 5 callbacks suppressed [ 288.410855][T14626] netlink: 16 bytes leftover after parsing attributes in process `syz.5.2300'. [ 288.420439][T14622] syzkaller0: entered allmulticast mode [ 288.433035][T14626] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 289.720263][T14641] Can not set IPV6_FL_F_REFLECT if flowlabel_consistency sysctl is enable [ 289.857660][T14644] syz.5.2306: vmalloc error: size 8589938688, exceeds total pages, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 289.873245][T14644] CPU: 0 UID: 0 PID: 14644 Comm: syz.5.2306 Not tainted syzkaller #0 PREEMPT(full) [ 289.873274][T14644] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 289.873286][T14644] Call Trace: [ 289.873293][T14644] [ 289.873301][T14644] dump_stack_lvl+0x189/0x250 [ 289.873330][T14644] ? __pfx_dump_stack_lvl+0x10/0x10 [ 289.873350][T14644] ? __pfx__printk+0x10/0x10 [ 289.873374][T14644] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 289.873395][T14644] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 289.873417][T14644] ? cpuset_print_current_mems_allowed+0x2ee/0x360 [ 289.873439][T14644] warn_alloc+0x214/0x310 [ 289.873467][T14644] ? stack_depot_save_flags+0x40/0x860 [ 289.873495][T14644] ? __pfx_warn_alloc+0x10/0x10 [ 289.873522][T14644] ? kasan_save_track+0x4f/0x80 [ 289.873545][T14644] ? xskq_create+0x56/0x170 [ 289.873559][T14644] ? xsk_init_queue+0xb0/0x110 [ 289.873583][T14644] ? xsk_setsockopt+0x4dc/0x8d0 [ 289.873605][T14644] ? do_sock_setsockopt+0x179/0x1b0 [ 289.873626][T14644] ? __x64_sys_setsockopt+0x13f/0x1b0 [ 289.873646][T14644] ? do_syscall_64+0xfa/0x3b0 [ 289.873662][T14644] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 289.873686][T14644] __vmalloc_node_range_noprof+0x125/0x12f0 [ 289.873738][T14644] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 289.873768][T14644] ? __kasan_kmalloc+0x93/0xb0 [ 289.873793][T14644] vmalloc_user_noprof+0xad/0xf0 [ 289.873818][T14644] ? xskq_create+0xbf/0x170 [ 289.873834][T14644] xskq_create+0xbf/0x170 [ 289.873852][T14644] xsk_init_queue+0xb0/0x110 [ 289.873879][T14644] xsk_setsockopt+0x4dc/0x8d0 [ 289.873906][T14644] ? __pfx_xsk_setsockopt+0x10/0x10 [ 289.873931][T14644] ? __pfx_aa_sk_perm+0x10/0x10 [ 289.873960][T14644] ? aa_sock_opt_perm+0xff/0x1b0 [ 289.873980][T14644] ? bpf_lsm_socket_setsockopt+0x9/0x20 [ 289.873998][T14644] ? __pfx_xsk_setsockopt+0x10/0x10 [ 289.874024][T14644] do_sock_setsockopt+0x179/0x1b0 [ 289.874049][T14644] __x64_sys_setsockopt+0x13f/0x1b0 [ 289.874076][T14644] do_syscall_64+0xfa/0x3b0 [ 289.874092][T14644] ? lockdep_hardirqs_on+0x9c/0x150 [ 289.874110][T14644] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 289.874125][T14644] ? clear_bhb_loop+0x60/0xb0 [ 289.874146][T14644] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 289.874162][T14644] RIP: 0033:0x7fbb9ed8eba9 [ 289.874178][T14644] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 289.874194][T14644] RSP: 002b:00007fbb9fca0038 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 289.874219][T14644] RAX: ffffffffffffffda RBX: 00007fbb9efd6090 RCX: 00007fbb9ed8eba9 [ 289.874232][T14644] RDX: 0000000000000006 RSI: 000000000000011b RDI: 0000000000000008 [ 289.874243][T14644] RBP: 00007fbb9ee11e19 R08: 0000000000000004 R09: 0000000000000000 [ 289.874254][T14644] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000000 [ 289.874265][T14644] R13: 00007fbb9efd6128 R14: 00007fbb9efd6090 R15: 00007ffe640ca178 [ 289.874293][T14644] [ 289.874304][T14644] Mem-Info: [ 290.181923][T14644] active_anon:6980 inactive_anon:0 isolated_anon:0 [ 290.181923][T14644] active_file:3336 inactive_file:39959 isolated_file:0 [ 290.181923][T14644] unevictable:768 dirty:285 writeback:0 [ 290.181923][T14644] slab_reclaimable:13190 slab_unreclaimable:268411 [ 290.181923][T14644] mapped:40647 shmem:1357 pagetables:1231 [ 290.181923][T14644] sec_pagetables:0 bounce:0 [ 290.181923][T14644] kernel_misc_reclaimable:0 [ 290.181923][T14644] free:1114042 free_pcp:22765 free_cma:0 [ 290.228255][T14644] Node 0 active_anon:27944kB inactive_anon:0kB active_file:13344kB inactive_file:159632kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:162532kB dirty:1156kB writeback:0kB shmem:3892kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:14768kB pagetables:4736kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 290.260814][T14644] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:4kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:48kB pagetables:140kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 290.291724][T14644] Node 0 DMA free:15360kB boost:0kB min:204kB low:252kB high:300kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 290.320971][T14644] lowmem_reserve[]: 0 2497 2499 2499 2499 [ 290.326848][T14644] Node 0 DMA32 free:554528kB boost:0kB min:34248kB low:42808kB high:51368kB reserved_highatomic:0KB free_highatomic:0KB active_anon:27892kB inactive_anon:0kB active_file:13344kB inactive_file:158068kB unevictable:1536kB writepending:1152kB present:3129332kB managed:2557416kB mlocked:0kB bounce:0kB free_pcp:72580kB local_pcp:36392kB free_cma:0kB [ 290.360364][T14644] lowmem_reserve[]: 0 0 1 1 1 [ 290.365127][T14644] Node 0 Normal free:12kB boost:0kB min:20kB low:24kB high:28kB reserved_highatomic:0KB free_highatomic:0KB active_anon:52kB inactive_anon:0kB active_file:0kB inactive_file:1564kB unevictable:0kB writepending:4kB present:1048580kB managed:1644kB mlocked:0kB bounce:0kB free_pcp:16kB local_pcp:8kB free_cma:0kB [ 290.394789][T14644] lowmem_reserve[]: 0 0 0 0 0 [ 290.399608][T14644] Node 1 Normal free:3886172kB boost:0kB min:55632kB low:69540kB high:83448kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:1536kB writepending:4kB present:4194300kB managed:4111100kB mlocked:0kB bounce:0kB free_pcp:18464kB local_pcp:7328kB free_cma:0kB [ 290.432322][T14644] lowmem_reserve[]: 0 0 0 0 0 [ 290.437189][T14644] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 290.450537][T14644] Node 0 DMA32: 428*4kB (UM) 362*8kB (UME) 158*16kB (UM) 108*32kB (UME) 9*64kB (UME) 7*128kB (UME) 7*256kB (UM) 2*512kB (U) 7*1024kB (UME) 4*2048kB (UE) 128*4096kB (UM) = 554528kB [ 290.469657][T14644] Node 0 Normal: 1*4kB (M) 1*8kB (M) 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 12kB [ 290.482735][T14644] Node 1 Normal: 207*4kB (UME) 44*8kB (UME) 36*16kB (UME) 142*32kB (UME) 43*64kB (UM) 6*128kB (UME) 4*256kB (UME) 3*512kB (ME) 1*1024kB (M) 1*2048kB (E) 945*4096kB (M) = 3886172kB [ 290.501011][T14644] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 290.511022][T14644] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 290.520689][T14644] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 290.530847][T14644] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 290.540643][T14644] 44648 total pagecache pages [ 290.545588][T14644] 0 pages in swap cache [ 290.550322][T14644] Free swap = 124996kB [ 290.554492][T14644] Total swap = 124996kB [ 290.558754][T14644] 2097051 pages RAM [ 290.562760][T14644] 0 pages HighMem/MovableOnly [ 290.567448][T14644] 425671 pages reserved [ 290.572201][T14644] 0 pages cma reserved [ 290.910721][T14643] team0: Port device dummy0 removed [ 290.916513][T14643] bridge_slave_0: left allmulticast mode [ 290.922437][T14643] bridge_slave_0: left promiscuous mode [ 290.928213][T14643] bridge0: port 1(bridge_slave_0) entered disabled state [ 290.937917][T14643] bridge_slave_1: left allmulticast mode [ 290.944559][T14643] bridge_slave_1: left promiscuous mode [ 290.951677][T14643] bridge0: port 2(bridge_slave_1) entered disabled state [ 290.978526][T14643] bond0: (slave bond_slave_0): Releasing backup interface [ 291.002822][T14643] bond0: (slave bond_slave_1): Releasing backup interface [ 291.032490][T14643] team0: Port device team_slave_0 removed [ 291.051651][T14643] team0: Port device team_slave_1 removed [ 291.058049][T14643] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 291.081052][T14643] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 291.101292][T14643] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 292.281757][T14674] macvtap0: entered promiscuous mode [ 292.484340][T14684] tc_dump_action: action bad kind [ 292.667627][T14690] netlink: 16 bytes leftover after parsing attributes in process `syz.5.2321'. [ 292.737094][T14603] lo speed is unknown, defaulting to 1000 [ 292.751585][T14603] wg1 speed is unknown, defaulting to 1000 [ 292.776785][T14690] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 292.810102][T14599] lo speed is unknown, defaulting to 1000 [ 292.849436][T14599] wg1 speed is unknown, defaulting to 1000 [ 293.001792][T14700] validate_nla: 64 callbacks suppressed [ 293.001813][T14700] netlink: 'syz.0.2325': attribute type 3 has an invalid length. [ 293.255734][T14709] netlink: 'syz.0.2329': attribute type 1 has an invalid length. [ 293.300774][T14709] netlink: 'syz.0.2329': attribute type 1 has an invalid length. [ 293.317972][T14710] netlink: 'syz.0.2329': attribute type 1 has an invalid length. [ 293.326463][T14710] netlink: 'syz.0.2329': attribute type 1 has an invalid length. [ 293.380651][T14712] tc_dump_action: action bad kind [ 293.805070][T14728] veth0: renamed from veth1_vlan [ 293.827541][T14730] netlink: 198220 bytes leftover after parsing attributes in process `syz.0.2335'. [ 294.167655][T14755] tc_dump_action: action bad kind [ 294.207778][T13234] nci: nci_rf_intf_activated_ntf_packet: unsupported activation_rf_tech_and_mode 0x7 [ 294.724264][T14788] lo speed is unknown, defaulting to 1000 [ 294.762740][T14783] vxcan1: entered allmulticast mode [ 294.775723][T14787] lo speed is unknown, defaulting to 1000 [ 294.785747][T14788] wg1 speed is unknown, defaulting to 1000 [ 294.871270][T14787] wg1 speed is unknown, defaulting to 1000 [ 295.095624][T14806] tc_dump_action: action bad kind [ 295.500784][T14816] netlink: 6 bytes leftover after parsing attributes in process `syz.3.2360'. [ 295.510888][T14816] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 295.671179][T14819] netlink: 20 bytes leftover after parsing attributes in process `syz.0.2361'. [ 295.705047][T14819] netlink: 20 bytes leftover after parsing attributes in process `syz.0.2361'. [ 295.773957][T14819] netlink: 20 bytes leftover after parsing attributes in process `syz.0.2361'. [ 295.811874][T14819] netlink: 20 bytes leftover after parsing attributes in process `syz.0.2361'. [ 295.830727][T14819] netlink: 20 bytes leftover after parsing attributes in process `syz.0.2361'. [ 295.950166][T14825] netlink: 'syz.3.2363': attribute type 2 has an invalid length. [ 295.963636][T14819] netlink: 20 bytes leftover after parsing attributes in process `syz.0.2361'. [ 295.981260][T14819] netlink: 20 bytes leftover after parsing attributes in process `syz.0.2361'. [ 296.086866][T14819] netlink: 20 bytes leftover after parsing attributes in process `syz.0.2361'. [ 296.332629][T14829] lo speed is unknown, defaulting to 1000 [ 296.364589][T14831] lo speed is unknown, defaulting to 1000 [ 296.364653][T14829] wg1 speed is unknown, defaulting to 1000 [ 296.402359][T14831] wg1 speed is unknown, defaulting to 1000 [ 296.574796][T14847] tc_dump_action: action bad kind [ 297.151528][ T51] block nbd3: Receive control failed (result -32) [ 297.627657][T14868] lo speed is unknown, defaulting to 1000 [ 297.641749][T14868] wg1 speed is unknown, defaulting to 1000 [ 298.163280][T14905] netlink: 'syz.6.2383': attribute type 2 has an invalid length. [ 298.577983][T14919] lo speed is unknown, defaulting to 1000 [ 298.705597][T14919] wg1 speed is unknown, defaulting to 1000 [ 298.709820][T14918] lo speed is unknown, defaulting to 1000 [ 298.749824][T14924] lo speed is unknown, defaulting to 1000 [ 298.758798][T14918] wg1 speed is unknown, defaulting to 1000 [ 298.824421][T14924] wg1 speed is unknown, defaulting to 1000 [ 299.036384][T14936] __nla_validate_parse: 27 callbacks suppressed [ 299.036402][T14936] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2391'. [ 299.103757][T14939] tap0: tun_chr_ioctl cmd 1074025677 [ 299.112849][T14939] tap0: linktype set to 0 [ 299.284783][T14943] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2392'. [ 299.539694][T14948] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2394'. [ 299.689171][T14947] rdma_rxe: rxe_newlink: failed to add team_slave_0 [ 299.777646][T14954] netlink: 201916 bytes leftover after parsing attributes in process `syz.5.2396'. [ 300.531432][T14978] netlink: 32 bytes leftover after parsing attributes in process `syz.5.2402'. [ 300.732764][T14985] lo speed is unknown, defaulting to 1000 [ 300.742900][T14988] lo speed is unknown, defaulting to 1000 [ 300.753435][T14985] wg1 speed is unknown, defaulting to 1000 [ 300.778954][T14988] wg1 speed is unknown, defaulting to 1000 [ 300.841291][T14990] lo speed is unknown, defaulting to 1000 [ 300.848865][T14990] wg1 speed is unknown, defaulting to 1000 [ 301.043330][T15000] lo speed is unknown, defaulting to 1000 [ 301.051609][T15000] wg1 speed is unknown, defaulting to 1000 [ 301.492961][T15008] lo speed is unknown, defaulting to 1000 [ 301.514333][T15008] wg1 speed is unknown, defaulting to 1000 [ 303.340519][T15026] RDS: rds_bind could not find a transport for 2001::1, load rds_tcp or rds_rdma? [ 303.383089][T15030] netlink: 'syz.3.2415': attribute type 1 has an invalid length. [ 303.413989][T15029] netlink: 8 bytes leftover after parsing attributes in process `syz.6.2412'. [ 303.415250][T15026] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2413'. [ 303.547259][T15030] 8021q: adding VLAN 0 to HW filter on device bond6 [ 303.640688][T15037] 8021q: adding VLAN 0 to HW filter on device bond6 [ 303.670527][T15037] bond6: (slave vxcan1): The slave device specified does not support setting the MAC address [ 303.691726][T15037] bond6: (slave vxcan1): Error -95 calling set_mac_address [ 303.792048][T15034] bond6: (slave vxcan1): The slave device specified does not support setting the MAC address [ 303.819118][T15034] bond6: (slave vxcan1): Error -95 calling set_mac_address [ 303.858697][T15035] lo speed is unknown, defaulting to 1000 [ 303.910879][T15035] wg1 speed is unknown, defaulting to 1000 [ 303.986856][T15053] netlink: 16 bytes leftover after parsing attributes in process `syz.6.2420'. [ 304.086138][T15057] netlink: 14 bytes leftover after parsing attributes in process `syz.5.2422'. [ 304.116819][T15060] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2423'. [ 304.127015][T15060] veth1: entered promiscuous mode [ 304.137301][T15060] netlink: 'syz.4.2423': attribute type 8 has an invalid length. [ 304.149946][T15060] A link change request failed with some changes committed already. Interface veth1 may have been left with an inconsistent configuration, please check. [ 304.207637][T15065] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 304.345359][T15056] lo speed is unknown, defaulting to 1000 [ 304.372213][T15071] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2425'. [ 304.405048][T15068] lo speed is unknown, defaulting to 1000 [ 304.411797][T15065] netlink: 'syz.5.2422': attribute type 74 has an invalid length. [ 304.427180][T15056] wg1 speed is unknown, defaulting to 1000 [ 304.462855][T15068] wg1 speed is unknown, defaulting to 1000 [ 304.623250][ T30] audit: type=1800 audit(1758143723.363:5): pid=15077 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.2426" name="blkio.bfq.time_recursive" dev="tmpfs" ino=2587 res=0 errno=0 [ 304.671769][ T30] audit: type=1800 audit(1758143723.363:6): pid=15077 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.2426" name="blkio.bfq.time_recursive" dev="tmpfs" ino=2587 res=0 errno=0 [ 305.358056][T15094] (unnamed net_device) (uninitialized): option miimon: invalid value (18446744073709551613) [ 305.375630][T15098] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2430'. [ 305.398726][T15094] (unnamed net_device) (uninitialized): option miimon: allowed values 0 - 2147483647 [ 305.417340][T15098] netlink: 24 bytes leftover after parsing attributes in process `syz.5.2430'. [ 305.844132][T15106] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2434'. [ 305.981193][T15104] lo speed is unknown, defaulting to 1000 [ 305.990381][T15112] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2433'. [ 306.040769][T15112] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2433'. [ 306.140402][T15104] wg1 speed is unknown, defaulting to 1000 [ 306.277969][T15119] lo speed is unknown, defaulting to 1000 [ 306.291049][T15119] wg1 speed is unknown, defaulting to 1000 [ 306.692013][T15136] xt_limit: Overflow, try lower: 604147548/4200216962 [ 306.726631][T15141] netlink: 3 bytes leftover after parsing attributes in process `syz.4.2442'. [ 306.737681][T15141] 0ªX¹¦À: renamed from caif0 [ 306.767741][T15141] 0ªX¹¦À: entered allmulticast mode [ 306.782782][T15141] A link change request failed with some changes committed already. Interface 60ªX¹¦À may have been left with an inconsistent configuration, please check. [ 306.842678][T15144] vlan0: entered promiscuous mode [ 306.852227][T15144] bond0: entered promiscuous mode [ 306.863308][T15144] ip6gretap1: entered promiscuous mode [ 306.876329][T15144] vlan0: entered allmulticast mode [ 306.902421][T15144] bond0: entered allmulticast mode [ 306.915593][T15144] ip6gretap1: entered allmulticast mode [ 307.097754][T15153] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2445'. [ 307.126521][T15156] sch_tbf: burst 0 is lower than device veth1_virt_wifi mtu (1514) ! [ 307.131884][T15153] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 307.148856][T15156] netlink: 'syz.5.2447': attribute type 1 has an invalid length. [ 307.158151][T15156] netlink: 'syz.5.2447': attribute type 4 has an invalid length. [ 307.167599][T15156] netlink: 'syz.5.2447': attribute type 1 has an invalid length. [ 307.177186][T15156] netlink: 'syz.5.2447': attribute type 4 has an invalid length. [ 311.118444][T15151] lo speed is unknown, defaulting to 1000 [ 315.336748][T15171] __nla_validate_parse: 3 callbacks suppressed [ 315.336772][T15171] netlink: 64 bytes leftover after parsing attributes in process `syz.4.2450'. [ 316.083514][T15151] wg1 speed is unknown, defaulting to 1000 [ 316.090120][T15172] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2450'. [ 316.110221][T15172] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2450'. [ 316.195727][T15171] netlink: 'syz.4.2450': attribute type 49 has an invalid length. [ 316.236989][T15173] netlink: 'syz.4.2450': attribute type 49 has an invalid length. [ 316.575636][T15176] siw: device registration error -23 [ 316.576543][T15185] lo speed is unknown, defaulting to 1000 [ 316.623002][T15185] wg1 speed is unknown, defaulting to 1000 [ 316.910195][T15191] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2456'. [ 317.128593][T15195] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2457'. [ 317.495595][T15205] netlink: 'syz.5.2459': attribute type 21 has an invalid length. [ 317.661824][T15209] netlink: 76 bytes leftover after parsing attributes in process `syz.0.2460'. [ 317.676102][T15209] netlink: 76 bytes leftover after parsing attributes in process `syz.0.2460'. [ 318.096579][T15219] netlink: 16 bytes leftover after parsing attributes in process `syz.6.2461'. [ 318.108379][T15219] netlink: 64 bytes leftover after parsing attributes in process `syz.6.2461'. [ 318.117906][T15219] tipc: Invalid UDP bearer configuration [ 318.117973][T15219] tipc: Enabling of bearer rejected, failed to enable media [ 318.156801][T15224] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2462'. [ 318.184817][T15224] bridge0: trying to set multicast query interval above maximum, setting to 8640000 (86400000ms) [ 318.279035][T15228] netdevsim netdevsim3 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 318.289917][T15228] netdevsim netdevsim3 eth3 (unregistering): unset [1, 2] type 2 family 0 port 19999 - 0 [ 318.306615][T15227] (unnamed net_device) (uninitialized): option arp_all_targets: invalid value (3) [ 318.352402][T15228] netdevsim netdevsim3 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 318.388715][T15228] netdevsim netdevsim3 eth2 (unregistering): unset [1, 2] type 2 family 0 port 19999 - 0 [ 318.502556][T15228] netdevsim netdevsim3 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 318.517472][T15228] netdevsim netdevsim3 eth1 (unregistering): unset [1, 2] type 2 family 0 port 19999 - 0 [ 318.573155][T15238] 8021q: adding VLAN 0 to HW filter on device bond1 [ 318.591194][T15228] netdevsim netdevsim3 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 318.608085][T15228] netdevsim netdevsim3 eth0 (unregistering): unset [1, 2] type 2 family 0 port 19999 - 0 [ 318.804271][T15254] netlink: 'syz.4.2473': attribute type 13 has an invalid length. [ 318.813354][ T7331] netdevsim netdevsim3 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 318.822603][T15254] netlink: 'syz.4.2473': attribute type 17 has an invalid length. [ 318.831029][ T7331] netdevsim netdevsim3 eth0: set [1, 0] type 2 family 0 port 19999 - 0 [ 318.842391][ T7331] netdevsim netdevsim3 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 318.851828][ T7331] netdevsim netdevsim3 eth1: set [1, 0] type 2 family 0 port 19999 - 0 [ 318.884564][T15252] lo speed is unknown, defaulting to 1000 [ 318.934624][T15254] 8021q: adding VLAN 0 to HW filter on device bond0 [ 318.944090][T15254] 8021q: adding VLAN 0 to HW filter on device team0 [ 318.956292][T15254] 0ªX¹¦À: left allmulticast mode [ 318.962909][T15254] A link change request failed with some changes committed already. Interface 60ªX¹¦À may have been left with an inconsistent configuration, please check. [ 318.995460][T15252] wg1 speed is unknown, defaulting to 1000 [ 319.011298][T15256] lo speed is unknown, defaulting to 1000 [ 319.016943][ T7331] netdevsim netdevsim3 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 319.035706][ T7331] netdevsim netdevsim3 eth2: set [1, 0] type 2 family 0 port 19999 - 0 [ 319.070420][ T7331] netdevsim netdevsim3 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 319.081597][T15260] netlink: 'syz.6.2474': attribute type 13 has an invalid length. [ 319.095610][ T7331] netdevsim netdevsim3 eth3: set [1, 0] type 2 family 0 port 19999 - 0 [ 319.097451][T15260] netlink: 'syz.6.2474': attribute type 17 has an invalid length. [ 319.116676][T15256] wg1 speed is unknown, defaulting to 1000 [ 319.224881][T15261] lo speed is unknown, defaulting to 1000 [ 319.240649][T15261] wg1 speed is unknown, defaulting to 1000 [ 320.117489][T15283] GUP no longer grows the stack in syz.5.2481 (15283): 200000003000-20000000a000 (200000001000) [ 320.156258][T15283] CPU: 1 UID: 0 PID: 15283 Comm: syz.5.2481 Not tainted syzkaller #0 PREEMPT(full) [ 320.156285][T15283] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 320.156297][T15283] Call Trace: [ 320.156305][T15283] [ 320.156313][T15283] dump_stack_lvl+0x189/0x250 [ 320.156344][T15283] ? __pfx_dump_stack_lvl+0x10/0x10 [ 320.156368][T15283] ? __pfx__printk+0x10/0x10 [ 320.156392][T15283] ? find_vma+0xe7/0x160 [ 320.156433][T15283] __get_user_pages+0x24d0/0x2ce0 [ 320.156459][T15283] ? __bpf_trace_mmap_lock_acquire_returned+0x13b/0x190 [ 320.156514][T15283] ? rcu_is_watching+0x15/0xb0 [ 320.156540][T15283] __gup_longterm_locked+0xde9/0x1660 [ 320.156580][T15283] ? sanity_check_pinned_pages+0x123a/0x1300 [ 320.156613][T15283] gup_fast_fallback+0x1e6a/0x2010 [ 320.156673][T15283] ? __pfx_gup_fast_fallback+0x10/0x10 [ 320.156695][T15283] ? stack_trace_save+0x9c/0xe0 [ 320.156718][T15283] ? __pfx_stack_trace_save+0x10/0x10 [ 320.156745][T15283] ? __kernel_text_address+0xd/0x40 [ 320.156777][T15283] ? pin_user_pages_fast+0x4d/0xb0 [ 320.156803][T15283] iov_iter_extract_pages+0x35a/0x5e0 [ 320.156840][T15283] extract_iter_to_sg+0xe46/0x24e0 [ 320.156875][T15283] ? __pfx_extract_iter_to_sg+0x10/0x10 [ 320.156906][T15283] ? __asan_memset+0x22/0x50 [ 320.156930][T15283] af_alg_get_rsgl+0x436/0x810 [ 320.156972][T15283] aead_recvmsg+0x4cc/0x13f0 [ 320.157003][T15283] ? rcu_is_watching+0x15/0xb0 [ 320.157029][T15283] ? __pfx_aead_recvmsg+0x10/0x10 [ 320.157049][T15283] ? bpf_lsm_socket_recvmsg+0x9/0x20 [ 320.157070][T15283] ? __pfx_aead_recvmsg+0x10/0x10 [ 320.157086][T15283] sock_recvmsg_nosec+0x186/0x1c0 [ 320.157110][T15283] ____sys_recvmsg+0x3aa/0x460 [ 320.157164][T15283] ? __pfx_____sys_recvmsg+0x10/0x10 [ 320.157207][T15283] ? import_iovec+0x74/0xa0 [ 320.157233][T15283] ___sys_recvmsg+0x1b5/0x510 [ 320.157264][T15283] ? __pfx____sys_recvmsg+0x10/0x10 [ 320.157325][T15283] ? __might_fault+0xb0/0x130 [ 320.157355][T15283] do_recvmmsg+0x307/0x770 [ 320.157386][T15283] ? __pfx_do_recvmmsg+0x10/0x10 [ 320.157406][T15275] 8021q: adding VLAN 0 to HW filter on device bond8 [ 320.157405][T15283] ? file_init_path+0x3b/0x590 [ 320.157438][T15283] ? __pfx_do_futex+0x10/0x10 [ 320.157472][T15283] __x64_sys_recvmmsg+0x190/0x240 [ 320.157501][T15283] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 320.157525][T15283] ? rcu_is_watching+0x15/0xb0 [ 320.157548][T15283] ? do_syscall_64+0xbe/0x3b0 [ 320.157573][T15283] do_syscall_64+0xfa/0x3b0 [ 320.157590][T15283] ? lockdep_hardirqs_on+0x9c/0x150 [ 320.157608][T15283] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 320.157626][T15283] ? clear_bhb_loop+0x60/0xb0 [ 320.157649][T15283] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 320.157667][T15283] RIP: 0033:0x7fbb9ed8eba9 [ 320.157684][T15283] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 320.157701][T15283] RSP: 002b:00007fbb9fc7f038 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 320.157721][T15283] RAX: ffffffffffffffda RBX: 00007fbb9efd6180 RCX: 00007fbb9ed8eba9 [ 320.157736][T15283] RDX: 0000000000000002 RSI: 0000200000000180 RDI: 000000000000000d [ 320.157747][T15283] RBP: 00007fbb9ee11e19 R08: 0000000000000000 R09: 0000000000000000 [ 320.157759][T15283] R10: 0000000000000101 R11: 0000000000000246 R12: 0000000000000000 [ 320.157770][T15283] R13: 00007fbb9efd6218 R14: 00007fbb9efd6180 R15: 00007ffe640ca178 [ 320.157802][T15283] [ 320.547925][T15284] bond8: (slave ip6gretap1): Enslaving as a backup interface with an up link [ 320.655082][ T7340] bond8: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 320.790577][ T7328] bond8: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 320.806753][T15304] lo speed is unknown, defaulting to 1000 [ 320.913027][T15302] __nla_validate_parse: 4 callbacks suppressed [ 320.913046][T15302] netlink: 36 bytes leftover after parsing attributes in process `syz.0.2485'. [ 320.950461][T15304] wg1 speed is unknown, defaulting to 1000 [ 321.233429][T15327] netlink: 20 bytes leftover after parsing attributes in process `syz.0.2493'. [ 321.244239][T15327] netlink: 20 bytes leftover after parsing attributes in process `syz.0.2493'. [ 321.423382][ T5877] Bluetooth: hci6: link tx timeout [ 321.429073][ T5877] Bluetooth: hci6: killing stalled connection 11:aa:aa:aa:aa:aa [ 321.442769][ T51] Bluetooth: hci6: link tx timeout [ 321.447930][ T51] Bluetooth: hci6: killing stalled connection 11:aa:aa:aa:aa:aa [ 321.459965][ T51] Bluetooth: hci6: link tx timeout [ 321.465206][ T51] Bluetooth: hci6: killing stalled connection 11:aa:aa:aa:aa:aa [ 321.473700][ T51] Bluetooth: hci6: link tx timeout [ 321.478836][ T51] Bluetooth: hci6: killing stalled connection 11:aa:aa:aa:aa:aa [ 321.510476][T15331] lo speed is unknown, defaulting to 1000 [ 321.518324][T15331] wg1 speed is unknown, defaulting to 1000 [ 321.616725][T15341] lo speed is unknown, defaulting to 1000 [ 321.631688][T15344] sctp: [Deprecated]: syz.5.2498 (pid 15344) Use of struct sctp_assoc_value in delayed_ack socket option. [ 321.631688][T15344] Use struct sctp_sack_info instead [ 321.694099][T15341] wg1 speed is unknown, defaulting to 1000 [ 321.920039][T15350] netlink: 12 bytes leftover after parsing attributes in process `syz.5.2500'. [ 322.638071][T15363] netlink: 8 bytes leftover after parsing attributes in process `syz.6.2503'. [ 323.185227][T15374] rdma_rxe: rxe_newlink: failed to add vxcan1 [ 323.521261][ T51] Bluetooth: hci6: command 0x041b tx timeout [ 323.705330][T15397] netlink: 'syz.5.2514': attribute type 1 has an invalid length. [ 323.930111][T15406] netlink: 'syz.3.2516': attribute type 13 has an invalid length. [ 323.966887][T15406] netlink: 'syz.3.2516': attribute type 17 has an invalid length. [ 324.006313][T15406] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 324.061549][T15401] lo speed is unknown, defaulting to 1000 [ 324.073835][T15401] wg1 speed is unknown, defaulting to 1000 [ 324.151103][T15412] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2520'. [ 324.162397][T15410] lo speed is unknown, defaulting to 1000 [ 324.173011][T15410] wg1 speed is unknown, defaulting to 1000 [ 324.608636][T15428] lo speed is unknown, defaulting to 1000 [ 324.636982][T15428] wg1 speed is unknown, defaulting to 1000 [ 324.727450][T15434] netlink: 212376 bytes leftover after parsing attributes in process `syz.6.2527'. [ 325.240837][T15448] netlink: 'syz.6.2531': attribute type 1 has an invalid length. [ 325.260437][T15449] netlink: 'syz.6.2531': attribute type 1 has an invalid length. [ 325.418856][T15448] 8021q: adding VLAN 0 to HW filter on device bond1 [ 325.577774][T15454] 8021q: adding VLAN 0 to HW filter on device bond1 [ 325.606720][T15454] bond1: (slave vxcan3): The slave device specified does not support setting the MAC address [ 325.673381][T15454] bond1: (slave vxcan3): Error -95 calling set_mac_address [ 325.842888][T15467] lo speed is unknown, defaulting to 1000 [ 325.863180][T15467] wg1 speed is unknown, defaulting to 1000 [ 326.034823][T15485] netlink: 108 bytes leftover after parsing attributes in process `syz.6.2538'. [ 326.533162][T15500] lo speed is unknown, defaulting to 1000 [ 326.548270][T15508] netlink: 'syz.4.2547': attribute type 1 has an invalid length. [ 326.560108][T15508] netlink: 'syz.4.2547': attribute type 3 has an invalid length. [ 326.567951][T15508] netlink: 224 bytes leftover after parsing attributes in process `syz.4.2547'. [ 326.573368][T15500] wg1 speed is unknown, defaulting to 1000 [ 326.643554][T15510] netlink: 16 bytes leftover after parsing attributes in process `syz.6.2548'. [ 326.698102][T15510] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 326.981391][T15517] lo speed is unknown, defaulting to 1000 [ 327.065494][T15517] wg1 speed is unknown, defaulting to 1000 [ 327.072449][T15520] lo speed is unknown, defaulting to 1000 [ 327.123532][T15520] wg1 speed is unknown, defaulting to 1000 [ 327.156660][T15515] lo speed is unknown, defaulting to 1000 [ 327.196873][T15515] wg1 speed is unknown, defaulting to 1000 [ 327.361680][T15527] pim6reg1: entered promiscuous mode [ 327.367110][T15527] pim6reg1: entered allmulticast mode [ 327.385492][T15530] netlink: 'syz.6.2554': attribute type 1 has an invalid length. [ 327.451815][T15534] netlink: 4 bytes leftover after parsing attributes in process `syz.6.2554'. [ 327.492684][T15534] netlink: 4 bytes leftover after parsing attributes in process `syz.6.2554'. [ 327.507762][T15530] 8021q: adding VLAN 0 to HW filter on device bond2 [ 327.730087][T15538] tap0: tun_chr_ioctl cmd 1074025677 [ 327.735614][T15538] tap0: linktype set to 774 [ 328.094688][T15547] netlink: 24 bytes leftover after parsing attributes in process `syz.5.2558'. [ 328.371854][T15552] pim6reg: entered allmulticast mode [ 328.806208][T15533] lo speed is unknown, defaulting to 1000 [ 328.900149][T15533] wg1 speed is unknown, defaulting to 1000 [ 328.905815][T15541] pim6reg: left allmulticast mode [ 329.385318][T15572] netlink: 16 bytes leftover after parsing attributes in process `syz.0.2562'. [ 329.437253][T15572] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 329.624827][T15578] netlink: 40 bytes leftover after parsing attributes in process `syz.6.2564'. [ 329.626033][T15574] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 329.650876][T15575] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 329.651763][T15578] netlink: 'syz.6.2564': attribute type 1 has an invalid length. [ 330.038419][T15585] netlink: 20 bytes leftover after parsing attributes in process `syz.0.2567'. [ 330.070097][T15586] netlink: 20 bytes leftover after parsing attributes in process `syz.0.2567'. [ 330.071509][T15580] lo speed is unknown, defaulting to 1000 [ 330.114353][T15580] wg1 speed is unknown, defaulting to 1000 [ 330.383769][T15600] netlink: zone id is out of range [ 330.402182][T15600] netlink: zone id is out of range [ 330.407506][T15600] netlink: zone id is out of range [ 330.444762][T15600] netlink: zone id is out of range [ 330.456627][T15600] netlink: zone id is out of range [ 330.479687][T15600] netlink: zone id is out of range [ 330.512739][T15600] netlink: zone id is out of range [ 330.530236][T15600] netlink: zone id is out of range [ 330.549183][T15600] netlink: zone id is out of range [ 330.574182][T15600] netlink: zone id is out of range [ 330.766328][T15606] lo speed is unknown, defaulting to 1000 [ 330.940739][T15606] wg1 speed is unknown, defaulting to 1000 [ 331.031808][T15614] netdevsim netdevsim0 eth3 (unregistering): unset [0, 0] type 1 family 0 port 256 - 0 [ 331.116413][T15614] netdevsim netdevsim0 eth2 (unregistering): unset [0, 0] type 1 family 0 port 256 - 0 [ 331.179158][T15614] netdevsim netdevsim0 eth1 (unregistering): unset [0, 0] type 1 family 0 port 256 - 0 [ 331.271402][T15614] netdevsim netdevsim0 eth0 (unregistering): unset [0, 0] type 1 family 0 port 256 - 0 [ 331.492362][T15625] pim6reg: entered allmulticast mode [ 331.500441][T15626] pim6reg: left allmulticast mode [ 331.615815][ T7324] netdevsim netdevsim0 eth0: set [0, 0] type 1 family 0 port 256 - 0 [ 331.631964][T15628] __nla_validate_parse: 1 callbacks suppressed [ 331.631984][T15628] netlink: 20 bytes leftover after parsing attributes in process `syz.3.2582'. [ 331.664820][ T7324] netdevsim netdevsim0 eth1: set [0, 0] type 1 family 0 port 256 - 0 [ 331.701821][ T7324] netdevsim netdevsim0 eth2: set [0, 0] type 1 family 0 port 256 - 0 [ 331.745735][ T7324] netdevsim netdevsim0 eth3: set [0, 0] type 1 family 0 port 256 - 0 [ 332.062670][T15635] lo speed is unknown, defaulting to 1000 [ 332.074801][T15635] wg1 speed is unknown, defaulting to 1000 [ 332.107284][T15640] lo speed is unknown, defaulting to 1000 [ 332.116851][T15640] wg1 speed is unknown, defaulting to 1000 [ 332.426102][T15651] netlink: 1041 bytes leftover after parsing attributes in process `syz.0.2587'. [ 332.583460][T15660] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2589'. [ 333.235473][T15689] netlink: 56 bytes leftover after parsing attributes in process `syz.4.2594'. [ 333.484334][T15704] netlink: 'syz.0.2599': attribute type 10 has an invalid length. [ 333.524756][T15704] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 333.541314][T15704] bond0: (slave batadv_slave_0): Enslaving as an active interface with an up link [ 333.551938][T15691] lo speed is unknown, defaulting to 1000 [ 333.560439][T15691] wg1 speed is unknown, defaulting to 1000 [ 334.346627][T15731] netlink: 68 bytes leftover after parsing attributes in process `syz.5.2606'. [ 334.443072][T15731] tipc: Enabled bearer , priority 0 [ 334.477571][T15731] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 334.496856][T15731] netlink: 12 bytes leftover after parsing attributes in process `syz.5.2606'. [ 334.639002][T15731] tipc: Resetting bearer [ 334.698109][T15741] lo speed is unknown, defaulting to 1000 [ 334.723539][T15730] tipc: Disabling bearer [ 334.738267][T15741] wg1 speed is unknown, defaulting to 1000 [ 335.397482][T15766] tipc: Enabled bearer , priority 0 [ 335.408428][T15766] syzkaller0: entered promiscuous mode [ 335.415623][T15766] syzkaller0: entered allmulticast mode [ 335.433718][T15766] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 335.581699][T15775] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 335.642028][T15781] tipc: Resetting bearer [ 335.712945][T15765] tipc: Resetting bearer [ 335.747768][T15765] tipc: Disabling bearer [ 335.785575][T15776] lo speed is unknown, defaulting to 1000 [ 335.853515][T15776] wg1 speed is unknown, defaulting to 1000 [ 336.682939][T15814] netlink: 40 bytes leftover after parsing attributes in process `syz.3.2626'. [ 336.848602][T15813] lo speed is unknown, defaulting to 1000 [ 336.970997][T15813] wg1 speed is unknown, defaulting to 1000 [ 337.062903][T15823] tipc: Enabled bearer , priority 0 [ 337.094786][T15823] syzkaller0: entered promiscuous mode [ 337.111270][T15823] syzkaller0: entered allmulticast mode [ 337.299076][T15829] tipc: Resetting bearer [ 337.342989][T15822] tipc: Resetting bearer [ 337.411548][T15822] tipc: Disabling bearer [ 337.471995][T15839] netlink: 28 bytes leftover after parsing attributes in process `syz.0.2634'. [ 337.627517][T15850] netlink: 68 bytes leftover after parsing attributes in process `syz.6.2636'. [ 337.672182][T15853] netlink: 68 bytes leftover after parsing attributes in process `syz.5.2637'. [ 337.734773][T15854] tipc: Started in network mode [ 337.741329][T15854] tipc: Node identity ee0eb2e626b, cluster identity 4711 [ 337.748798][T15854] tipc: Enabled bearer , priority 0 [ 337.764570][T15853] tipc: Enabled bearer , priority 0 [ 337.813001][T15853] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 337.852533][T15853] netlink: 12 bytes leftover after parsing attributes in process `syz.5.2637'. [ 337.873214][T15850] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 337.882301][T15850] netlink: 12 bytes leftover after parsing attributes in process `syz.6.2636'. [ 337.895415][T15853] tipc: Resetting bearer [ 337.921390][T15862] netlink: 224 bytes leftover after parsing attributes in process `syz.0.2641'. [ 337.936274][T15850] tipc: Resetting bearer [ 337.982450][T15852] tipc: Disabling bearer [ 338.020441][T15849] tipc: Disabling bearer [ 338.117313][T15868] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2643'. [ 338.725424][T15895] netlink: 20 bytes leftover after parsing attributes in process `syz.4.2651'. [ 338.750581][T15890] vlan3: entered promiscuous mode [ 338.768450][T15890] batadv0: entered promiscuous mode [ 338.913463][T15911] netlink: 4 bytes leftover after parsing attributes in process `syz.6.2654'. [ 339.843160][T15952] netlink: 'syz.6.2668': attribute type 1 has an invalid length. [ 339.872288][ T9452] lo speed is unknown, defaulting to 1000 [ 339.872342][T15940] tipc: Enabling of bearer rejected, failed to enable media [ 339.878051][ T9452] syz1: Port: 1 Link DOWN [ 339.893138][T13234] netdevsim netdevsim0 eth0: unset [0, 0] type 1 family 0 port 256 - 0 [ 339.903104][T13234] netdevsim netdevsim0 eth1: unset [0, 0] type 1 family 0 port 256 - 0 [ 339.940355][T13234] netdevsim netdevsim0 eth2: unset [0, 0] type 1 family 0 port 256 - 0 [ 339.967870][T13234] netdevsim netdevsim0 eth3: unset [0, 0] type 1 family 0 port 256 - 0 [ 340.302603][T13234] nci: nci_add_new_protocol: the target found does not have the desired protocol [ 340.569675][ T51] Bluetooth: hci6: command 0x041b tx timeout [ 347.999745][ C0] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 387.950384][T16002] netdevsim netdevsim3 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 387.961174][T16002] netdevsim netdevsim3 eth3 (unregistering): unset [1, 0] type 2 family 0 port 19999 - 0 [ 388.008847][T16003] __nla_validate_parse: 1 callbacks suppressed [ 388.008870][T16003] netlink: 20 bytes leftover after parsing attributes in process `syz.4.2683'. [ 388.166345][T16016] netlink: 'syz.6.2685': attribute type 13 has an invalid length. [ 388.174721][T16016] netlink: 'syz.6.2685': attribute type 17 has an invalid length. [ 388.202221][T16017] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2684'. [ 388.306086][T16002] netdevsim netdevsim3 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 388.358665][T16002] netdevsim netdevsim3 eth2 (unregistering): unset [1, 0] type 2 family 0 port 19999 - 0 [ 388.463682][T16016] 8021q: adding VLAN 0 to HW filter on device bond0 [ 388.473930][T16016] 8021q: adding VLAN 0 to HW filter on device team0 [ 388.484680][T16016] net_ratelimit: 15 callbacks suppressed [ 388.484687][T16016] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 388.516799][T16002] netdevsim netdevsim3 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 388.531282][T16002] netdevsim netdevsim3 eth1 (unregistering): unset [1, 0] type 2 family 0 port 19999 - 0 [ 388.580994][T16012] lo speed is unknown, defaulting to 1000 [ 388.616855][T16002] netdevsim netdevsim3 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 388.633119][T16002] netdevsim netdevsim3 eth0 (unregistering): unset [1, 0] type 2 family 0 port 19999 - 0 [ 388.660222][T16012] wg1 speed is unknown, defaulting to 1000 [ 388.666296][T16019] lo speed is unknown, defaulting to 1000 [ 388.696348][T16021] lo speed is unknown, defaulting to 1000 [ 388.723838][T16019] wg1 speed is unknown, defaulting to 1000 [ 388.762209][T16021] wg1 speed is unknown, defaulting to 1000 [ 388.902962][ T7331] netdevsim netdevsim3 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 388.919892][ T7331] netdevsim netdevsim3 eth0: set [1, 0] type 2 family 0 port 19999 - 0 [ 389.023640][T16024] netlink: 'syz.4.2686': attribute type 1 has an invalid length. [ 389.055237][T16024] netlink: 224 bytes leftover after parsing attributes in process `syz.4.2686'. [ 389.074265][ T7340] netdevsim netdevsim3 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 389.086082][ T7340] netdevsim netdevsim3 eth1: set [1, 0] type 2 family 0 port 19999 - 0 [ 389.115808][ T7340] netdevsim netdevsim3 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 389.130028][T16027] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2687'. [ 389.142693][ T7340] netdevsim netdevsim3 eth2: set [1, 0] type 2 family 0 port 19999 - 0 [ 389.196232][ T7340] netdevsim netdevsim3 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 389.228387][ T7340] netdevsim netdevsim3 eth3: set [1, 0] type 2 family 0 port 19999 - 0 [ 389.540346][T16038] netlink: 203516 bytes leftover after parsing attributes in process `syz.5.2690'. [ 389.589934][T16038] openvswitch: netlink: ufid size 3068 bytes exceeds the range (1, 16) [ 389.615241][T16038] openvswitch: netlink: Duplicate key (type 0). [ 390.495126][T16044] Bluetooth: MGMT ver 1.23 [ 390.566820][T16050] netlink: 'syz.5.2691': attribute type 13 has an invalid length. [ 390.587145][T16050] netlink: 'syz.5.2691': attribute type 17 has an invalid length. [ 390.725940][T16050] 8021q: adding VLAN 0 to HW filter on device bond0 [ 390.750878][T16050] 8021q: adding VLAN 0 to HW filter on device team0 [ 390.762656][T16050] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 390.900215][T16059] netlink: 244 bytes leftover after parsing attributes in process `syz.6.2695'. [ 390.912907][T16059] netlink: 'syz.6.2695': attribute type 9 has an invalid length. [ 390.917912][T16055] lo speed is unknown, defaulting to 1000 [ 390.937270][T16059] macvlan2: entered promiscuous mode [ 390.951686][T16055] wg1 speed is unknown, defaulting to 1000 [ 391.042218][ T5877] Bluetooth: hci5: command 0x0405 tx timeout [ 391.233679][T16066] netlink: 'syz.3.2697': attribute type 11 has an invalid length. [ 391.407022][T16068] tipc: Enabled bearer , priority 0 [ 391.427262][T16068] syzkaller0: entered promiscuous mode [ 391.433609][T16068] syzkaller0: entered allmulticast mode [ 391.454935][ T51] Bluetooth: hci6: link tx timeout [ 391.468543][ T51] Bluetooth: hci6: killing stalled connection 10:aa:aa:aa:aa:aa [ 391.477041][ T5877] Bluetooth: hci6: link tx timeout [ 391.483744][ T5877] Bluetooth: hci6: killing stalled connection 10:aa:aa:aa:aa:aa [ 391.511146][T16070] lo speed is unknown, defaulting to 1000 [ 391.524292][T16068] tipc: Resetting bearer [ 391.532271][T16070] wg1 speed is unknown, defaulting to 1000 [ 391.539638][T16067] tipc: Resetting bearer [ 391.573441][T16067] tipc: Disabling bearer [ 391.618791][T16074] netlink: 32 bytes leftover after parsing attributes in process `syz.6.2700'. [ 391.784810][T16078] netlink: 68 bytes leftover after parsing attributes in process `syz.4.2701'. [ 391.800870][T16078] tipc: Enabling of bearer rejected, failed to enable media [ 391.975930][T16078] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2701'. [ 392.314994][T16094] netlink: 20 bytes leftover after parsing attributes in process `syz.0.2704'. [ 392.326257][T16094] netlink: 'syz.0.2704': attribute type 3 has an invalid length. [ 392.340503][T16094] netlink: 'syz.0.2704': attribute type 2 has an invalid length. [ 392.358930][T16094] netlink: 'syz.0.2704': attribute type 2 has an invalid length. [ 392.536136][T16099] netlink: 'syz.6.2705': attribute type 16 has an invalid length. [ 392.589154][T16099] IPv6: NLM_F_REPLACE set, but no existing node found! [ 392.856524][T16111] ksmbd: Unknown IPC event: 3, ignore. [ 392.886047][T16111] (unnamed net_device) (uninitialized): option ad_actor_system: mode dependency failed, not supported in mode balance-rr(0) [ 392.943948][T16111] nbd: socks must be embedded in a SOCK_ITEM attr [ 392.977470][T16119] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 393.037194][T16121] __nla_validate_parse: 9 callbacks suppressed [ 393.037212][T16121] netlink: 20 bytes leftover after parsing attributes in process `syz.5.2713'. [ 393.038727][T16114] lo speed is unknown, defaulting to 1000 [ 393.075747][T16114] wg1 speed is unknown, defaulting to 1000 [ 393.084171][T16118] lo speed is unknown, defaulting to 1000 [ 393.140354][T16123] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 393.196355][T16118] wg1 speed is unknown, defaulting to 1000 [ 393.520099][ T5877] Bluetooth: hci6: command 0x041b tx timeout [ 394.408885][T16166] bridge0: port 1(batadv2) entered blocking state [ 394.416229][T16166] bridge0: port 1(batadv2) entered disabled state [ 394.423410][T16166] batadv2: entered allmulticast mode [ 394.434031][T16166] batadv2: entered promiscuous mode [ 394.580480][T16163] pim6reg1: entered promiscuous mode [ 394.586156][T16163] pim6reg1: entered allmulticast mode [ 394.714310][T16178] validate_nla: 2 callbacks suppressed [ 394.714331][T16178] netlink: 'syz.3.2737': attribute type 7 has an invalid length. [ 394.734085][T16178] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2737'. [ 394.902648][ T7324] batman_adv: batadv2: No IGMP Querier present - multicast optimizations disabled [ 394.912819][ T7324] batman_adv: batadv2: No MLD Querier present - multicast optimizations disabled [ 395.100033][T16191] macvtap0: refused to change device tx_queue_len [ 395.279074][T16199] siw: device registration error -23 [ 395.392934][T16203] sch_tbf: peakrate 7 is lower than or equals to rate 6829859379779001161 ! [ 395.645539][T16213] netlink: 176 bytes leftover after parsing attributes in process `syz.0.2754'. [ 395.825720][T16226] netlink: 'syz.3.2761': attribute type 4 has an invalid length. [ 396.191981][T16249] sctp: [Deprecated]: syz.3.2769 (pid 16249) Use of int in max_burst socket option. [ 396.191981][T16249] Use struct sctp_assoc_value instead [ 396.567844][T16264] macvtap0: refused to change device tx_queue_len [ 396.576495][T16263] netlink: 20 bytes leftover after parsing attributes in process `syz.0.2773'. [ 396.854998][T16277] tipc: New replicast peer: 255.255.255.255 [ 396.868703][T16277] tipc: Enabled bearer , priority 6 [ 397.078812][T16300] netlink: 4 bytes leftover after parsing attributes in process `syz.6.2790'. [ 397.170820][T16306] netlink: 'syz.6.2792': attribute type 6 has an invalid length. [ 397.332230][T16315] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2797'. [ 397.979834][ T9452] tipc: Node number set to 213200547 [ 398.682273][T16359] IPv6: Can't replace route, no match found [ 399.275471][T16379] smc: net device bond0 applied user defined pnetid SYZ0 [ 399.287742][T16379] smc: net device bond0 erased user defined pnetid SYZ0 [ 399.356592][T16385] netlink: 'syz.4.2829': attribute type 10 has an invalid length. [ 399.416144][T16385] bond0: (slave dummy0): Releasing backup interface [ 399.437495][T16385] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 399.441144][T16392] netlink: 'syz.4.2829': attribute type 10 has an invalid length. [ 399.461859][T16385] team0: Failed to send options change via netlink (err -105) [ 399.471511][T16385] team0: Port device dummy0 added [ 399.478370][T16394] netlink: 48 bytes leftover after parsing attributes in process `syz.6.2834'. [ 399.492300][T16391] netlink: 12 bytes leftover after parsing attributes in process `syz.5.2833'. [ 399.502301][T16391] netlink: 28 bytes leftover after parsing attributes in process `syz.5.2833'. [ 399.521865][T16391] netlink: 12 bytes leftover after parsing attributes in process `syz.5.2833'. [ 399.536983][T16391] netlink: 28 bytes leftover after parsing attributes in process `syz.5.2833'. [ 399.555656][T16391] netlink: 'syz.5.2833': attribute type 6 has an invalid length. [ 399.565428][T16392] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 399.583788][T16392] team0: Failed to send options change via netlink (err -105) [ 399.601812][T16392] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 399.620493][T16392] team0: Port device dummy0 removed [ 399.641097][T16392] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 399.684161][T16401] netlink: 256 bytes leftover after parsing attributes in process `syz.5.2837'. [ 399.699588][T16401] ksmbd: Unknown IPC event: 3, ignore. [ 400.002787][T16409] syzkaller1: entered promiscuous mode [ 400.009133][T16409] syzkaller1: entered allmulticast mode [ 400.671698][T16455] netlink: 'syz.4.2855': attribute type 11 has an invalid length. [ 401.616304][ T5877] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1 [ 401.627137][ T5877] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9 [ 401.635915][ T5877] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9 [ 401.645978][ T5877] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4 [ 401.654659][ T5877] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2 [ 401.858007][ T5860] syz_tun (unregistering): left allmulticast mode [ 401.882324][T16481] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2870'. [ 401.972820][T16475] lo speed is unknown, defaulting to 1000 [ 401.991556][T16475] wg1 speed is unknown, defaulting to 1000 [ 402.511644][T16507] netlink: 'syz.4.2883': attribute type 10 has an invalid length. [ 403.076318][T16475] chnl_net:caif_netlink_parms(): no params data found [ 403.099003][T16532] netlink: 'syz.3.2892': attribute type 10 has an invalid length. [ 403.276309][T16475] bridge0: port 1(bridge_slave_0) entered blocking state [ 403.304530][T16475] bridge0: port 1(bridge_slave_0) entered disabled state [ 403.328863][T16475] bridge_slave_0: entered allmulticast mode [ 403.355249][T16475] bridge_slave_0: entered promiscuous mode [ 403.378487][T16541] sch_tbf: burst 3298 is lower than device lo mtu (65499) ! [ 403.433693][T16475] bridge0: port 2(bridge_slave_1) entered blocking state [ 403.453589][T16475] bridge0: port 2(bridge_slave_1) entered disabled state [ 403.469077][T16475] bridge_slave_1: entered allmulticast mode [ 403.490352][T16475] bridge_slave_1: entered promiscuous mode [ 403.512180][T16543] netlink: 'syz.3.2896': attribute type 4 has an invalid length. [ 403.552542][T16546] netlink: 24 bytes leftover after parsing attributes in process `syz.4.2897'. [ 403.680034][ T5877] Bluetooth: hci7: command tx timeout [ 403.686479][ T31] INFO: task syz.1.1946:13326 blocked for more than 143 seconds. [ 403.697540][T16475] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 403.716194][ T31] Not tainted syzkaller #0 SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 403.733517][T16475] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 403.750374][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 403.766376][ T31] task:syz.1.1946 state:D stack:25864 pid:13326 tgid:13325 ppid:5865 task_flags:0x400140 flags:0x00004004 [ 403.799725][ T31] Call Trace: [ 403.803076][ T31] [ 403.806207][ T31] __schedule+0x1798/0x4cc0 [ 403.850247][ T31] ? __lock_acquire+0xab9/0xd20 [ 403.855174][ T31] ? __lock_acquire+0xab9/0xd20 [ 403.869765][ T31] ? __pfx___schedule+0x10/0x10 [ 403.875181][ T31] ? schedule+0x91/0x360 [ 403.905634][ T31] schedule+0x165/0x360 [ 403.919353][ T31] schedule_preempt_disabled+0x13/0x30 [ 403.924949][ T31] __mutex_lock+0x7e6/0x1350 [ 403.949832][ T31] ? __mutex_lock+0x5bb/0x1350 [ 403.955118][ T31] ? nfsd_nl_rpc_status_get_dumpit+0xdf/0x1290 [ 404.027679][ T31] ? __pfx___mutex_lock+0x10/0x10 [ 404.056100][ T31] ? stack_trace_save+0x9c/0xe0 [ 404.061611][ T31] ? stack_depot_save_flags+0x40/0x860 [ 404.067485][ T31] ? __pfx_stack_trace_save+0x10/0x10 [ 404.073208][ T31] nfsd_nl_rpc_status_get_dumpit+0xdf/0x1290 [ 404.080187][ T31] ? __kmalloc_node_track_caller_noprof+0x271/0x4e0 [ 404.086876][ T31] ? kmalloc_reserve+0x136/0x290 [ 404.092027][ T31] ? __alloc_skb+0x142/0x2d0 [ 404.096813][ T31] ? netlink_dump+0x1b7/0xe90 [ 404.101904][ T31] ? __netlink_dump_start+0x5cb/0x7e0 [ 404.107463][ T31] ? genl_family_rcv_msg_dumpit+0x1e7/0x2c0 [ 404.113699][ T31] ? genl_rcv_msg+0x5da/0x790 [ 404.118591][ T31] ? netlink_rcv_skb+0x208/0x470 [ 404.124067][ T31] ? genl_rcv+0x28/0x40 [ 404.128323][ T31] ? netlink_unicast+0x82c/0x9e0 [ 404.133841][ T31] ? netlink_sendmsg+0x805/0xb30 [ 404.138976][ T31] ? __sock_sendmsg+0x219/0x270 [ 404.144101][ T31] ? ____sys_sendmsg+0x505/0x830 [ 404.149136][ T31] ? ___sys_sendmsg+0x21f/0x2a0 [ 404.154331][ T31] ? __x64_sys_sendmsg+0x19b/0x260 [ 404.160158][ T31] ? do_syscall_64+0xfa/0x3b0 [ 404.164963][ T31] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 404.171533][ T31] ? __pfx_nfsd_nl_rpc_status_get_dumpit+0x10/0x10 [ 404.178267][ T31] ? rcu_is_watching+0x15/0xb0 [ 404.183283][ T31] ? trace_kmalloc+0x1f/0xd0 [ 404.187961][ T31] ? __kmalloc_node_track_caller_noprof+0x28e/0x4e0 [ 404.195063][ T31] ? __build_skb_around+0x257/0x3e0 [ 404.200531][ T31] genl_dumpit+0x108/0x1b0 [ 404.205120][ T31] netlink_dump+0x6e1/0xe90 [ 404.210121][ T31] ? __pfx_netlink_dump+0x10/0x10 [ 404.215165][ T31] ? genl_start+0x499/0x6c0 [ 404.220469][ T31] __netlink_dump_start+0x5cb/0x7e0 [ 404.225898][ T31] genl_family_rcv_msg_dumpit+0x1e7/0x2c0 [ 404.232091][ T31] ? __pfx_genl_family_rcv_msg_dumpit+0x10/0x10 [ 404.238348][ T31] ? genl_get_cmd+0x496/0x910 [ 404.243920][ T31] ? __pfx_genl_start+0x10/0x10 [ 404.249067][ T31] ? __pfx_genl_dumpit+0x10/0x10 [ 404.254335][ T31] ? __pfx_genl_done+0x10/0x10 [ 404.259143][ T31] genl_rcv_msg+0x5da/0x790 [ 404.263734][ T31] ? __pfx_genl_rcv_msg+0x10/0x10 [ 404.268781][ T31] ? __pfx_nfsd_nl_rpc_status_get_dumpit+0x10/0x10 [ 404.275516][ T31] ? __asan_memcpy+0x40/0x70 [ 404.280372][ T31] ? __pfx_ref_tracker_free+0x10/0x10 [ 404.285834][ T31] netlink_rcv_skb+0x208/0x470 [ 404.290958][ T31] ? __lock_acquire+0xab9/0xd20 [ 404.295832][ T31] ? __pfx_genl_rcv_msg+0x10/0x10 [ 404.301104][ T31] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 404.306407][ T31] ? down_read+0x1ad/0x2e0 [ 404.311065][ T31] genl_rcv+0x28/0x40 [ 404.315129][ T31] netlink_unicast+0x82c/0x9e0 [ 404.320699][ T31] ? __pfx_netlink_unicast+0x10/0x10 [ 404.326084][ T31] ? netlink_sendmsg+0x642/0xb30 [ 404.331435][ T31] ? skb_put+0x11b/0x210 [ 404.335701][ T31] netlink_sendmsg+0x805/0xb30 [ 404.340774][ T31] ? __pfx_netlink_sendmsg+0x10/0x10 [ 404.346094][ T31] ? aa_sock_msg_perm+0xf1/0x1d0 [ 404.351405][ T31] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 404.356685][ T31] ? __pfx_netlink_sendmsg+0x10/0x10 [ 404.362230][ T31] __sock_sendmsg+0x219/0x270 [ 404.366989][ T31] ____sys_sendmsg+0x505/0x830 [ 404.372140][ T31] ? __pfx_____sys_sendmsg+0x10/0x10 [ 404.377557][ T31] ? import_iovec+0x74/0xa0 [ 404.382323][ T31] ___sys_sendmsg+0x21f/0x2a0 [ 404.387255][ T31] ? __pfx____sys_sendmsg+0x10/0x10 [ 404.392814][ T31] ? __fget_files+0x2a/0x420 [ 404.397403][ T31] ? __fget_files+0x3a0/0x420 [ 404.402385][ T31] __x64_sys_sendmsg+0x19b/0x260 [ 404.407319][ T31] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 404.413029][ T31] ? rcu_is_watching+0x15/0xb0 [ 404.417780][ T31] ? do_syscall_64+0xbe/0x3b0 [ 404.422774][ T31] do_syscall_64+0xfa/0x3b0 [ 404.427271][ T31] ? lockdep_hardirqs_on+0x9c/0x150 [ 404.432786][ T31] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 404.438841][ T31] ? clear_bhb_loop+0x60/0xb0 [ 404.443939][ T31] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 404.450210][ T31] RIP: 0033:0x7fe3b5b8eba9 [ 404.454719][ T31] RSP: 002b:00007fe3b6ab7038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 404.463466][ T31] RAX: ffffffffffffffda RBX: 00007fe3b5dd5fa0 RCX: 00007fe3b5b8eba9 [ 404.471713][ T31] RDX: 0000000000000000 RSI: 0000200000000180 RDI: 0000000000000004 [ 404.480208][ T31] RBP: 00007fe3b5c11e19 R08: 0000000000000000 R09: 0000000000000000 [ 404.488222][ T31] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 404.496673][ T31] R13: 00007fe3b5dd6038 R14: 00007fe3b5dd5fa0 R15: 00007fffc36d8988 [ 404.505071][ T31] [ 404.508229][ T31] [ 404.508229][ T31] Showing all locks held in the system: [ 404.516536][ T31] 1 lock held by ksoftirqd/1/23: [ 404.546519][ T31] #0: ffff8880b8739f98 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x2a/0x140 [ 404.557635][ T31] 1 lock held by khungtaskd/31: [ 404.563307][ T31] #0: ffffffff8e13a0e0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 [ 404.576303][ T31] 2 locks held by getty/5621: [ 404.581868][ T31] #0: ffff88814e0d60a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 [ 404.592351][ T31] #1: ffffc9000332b2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x43e/0x1400 [ 404.603336][ T31] 3 locks held by kworker/u8:19/7327: [ 404.608815][ T31] #0: ffff88801a489148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x17b0 [ 404.621927][ T31] #1: ffffc900050afbc0 ((linkwatch_work).work){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x17b0 [ 404.633982][ T31] #2: ffffffff8f53a2c8 (rtnl_mutex){+.+.}-{4:4}, at: linkwatch_event+0xe/0x60 [ 404.644127][ T31] 3 locks held by kworker/u8:20/7328: [ 404.669273][ T31] #0: ffff88814cbcf948 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x17b0 [ 404.690400][ T31] #1: ffffc9000509fbc0 ((work_completion)(&(&net->ipv6.addr_chk_work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x17b0 [ 404.720560][ T31] #2: ffffffff8f53a2c8 (rtnl_mutex){+.+.}-{4:4}, at: addrconf_verify_work+0x19/0x30 [ 404.740146][ T31] 3 locks held by kworker/0:10/9456: [ 404.745477][ T31] 2 locks held by syz.2.1710/12465: [ 404.769990][ T31] #0: ffffffff8f59fa90 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 [ 404.778352][ T31] #1: ffffffff8e4189c8 (nfsd_mutex){+.+.}-{4:4}, at: nfsd_nl_listener_set_doit+0x137/0x1690 [ 404.809795][ T31] 3 locks held by syz.1.1946/13326: [ 404.815207][ T31] #0: ffffffff8f59fa90 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 [ 404.839799][ T31] #1: ffff8880525d26e0 (nlk_cb_mutex-GENERIC){+.+.}-{4:4}, at: __netlink_dump_start+0xfe/0x7e0 [ 404.870046][ T31] #2: ffffffff8e4189c8 (nfsd_mutex){+.+.}-{4:4}, at: nfsd_nl_rpc_status_get_dumpit+0xdf/0x1290 [ 404.885016][ T31] 3 locks held by syz-executor/16475: [ 404.892047][ T31] #0: ffffffff8eca95a0 (&ops->srcu#2){.+.+}-{0:0}, at: rtnl_link_ops_get+0x23/0x250 [ 404.915086][ T31] #1: ffffffff8f53a2c8 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0x8db/0x1c70 [ 404.924578][ T31] #2: ffffffff8e13fb78 (rcu_state.exp_mutex){+.+.}-{4:4}, at: synchronize_rcu_expedited+0x3b9/0x730 [ 404.935822][ T31] 1 lock held by syz.5.2902/16556: [ 404.941409][ T31] #0: ffffffff8f53a2c8 (rtnl_mutex){+.+.}-{4:4}, at: dev_ethtool+0x1d0/0x19b0 [ 404.951100][ T31] [ 404.953553][ T31] ============================================= [ 404.953553][ T31] [ 404.963927][ T31] NMI backtrace for cpu 0 [ 404.963960][ T31] CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) [ 404.963983][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 404.963995][ T31] Call Trace: [ 404.964003][ T31] [ 404.964012][ T31] dump_stack_lvl+0x189/0x250 [ 404.964043][ T31] ? __pfx_dump_stack_lvl+0x10/0x10 [ 404.964066][ T31] ? __pfx__printk+0x10/0x10 [ 404.964105][ T31] nmi_cpu_backtrace+0x39e/0x3d0 [ 404.964136][ T31] ? __pfx_nmi_cpu_backtrace+0x10/0x10 [ 404.964166][ T31] ? __pfx__printk+0x10/0x10 [ 404.964198][ T31] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 404.964232][ T31] nmi_trigger_cpumask_backtrace+0x17a/0x300 [ 404.964262][ T31] watchdog+0xf93/0xfe0 [ 404.964295][ T31] ? watchdog+0x1de/0xfe0 [ 404.964327][ T31] kthread+0x70e/0x8a0 [ 404.964355][ T31] ? __pfx_watchdog+0x10/0x10 [ 404.964380][ T31] ? __pfx_kthread+0x10/0x10 [ 404.964406][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 404.964435][ T31] ? lockdep_hardirqs_on+0x9c/0x150 [ 404.964453][ T31] ? __pfx_kthread+0x10/0x10 [ 404.964478][ T31] ret_from_fork+0x436/0x7d0 [ 404.964503][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 404.964529][ T31] ? __switch_to_asm+0x39/0x70 [ 404.964553][ T31] ? __switch_to_asm+0x33/0x70 [ 404.964577][ T31] ? __pfx_kthread+0x10/0x10 [ 404.964602][ T31] ret_from_fork_asm+0x1a/0x30 [ 404.964642][ T31] [ 404.964649][ T31] Sending NMI from CPU 0 to CPUs 1: [ 405.121586][ C1] NMI backtrace for cpu 1 [ 405.121603][ C1] CPU: 1 UID: 0 PID: 16550 Comm: syz.6.2899 Not tainted syzkaller #0 PREEMPT(full) [ 405.121624][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 405.121635][ C1] RIP: 0010:check_preemption_disabled+0x5c/0x120 [ 405.121662][ C1] Code: 3e 26 07 48 3b 4c 24 08 0f 85 cc 00 00 00 48 83 c4 10 5b 41 5e 41 5f 5d e9 81 ca 02 00 cc 48 c7 04 24 00 00 00 00 9c 8f 04 24 04 24 00 02 00 00 74 c8 65 4c 8b 3c 25 08 a0 a0 92 41 f6 47 2f [ 405.121677][ C1] RSP: 0018:ffffc9000519f770 EFLAGS: 00000046 [ 405.121693][ C1] RAX: 0000000000000001 RBX: 0000000000000000 RCX: 0000000080000000 [ 405.121704][ C1] RDX: 0000000000000001 RSI: ffffffff8dba8d58 RDI: ffffffff8be33c00 [ 405.121717][ C1] RBP: ffffffff822e5322 R08: 0000000000000000 R09: ffffffff822e5322 [ 405.121731][ C1] R10: dffffc0000000000 R11: fffff940001c67d7 R12: 0000000000000002 [ 405.121743][ C1] R13: ffffffff8e13a0e0 R14: 0000000000000000 R15: 0000000000000246 [ 405.121755][ C1] FS: 0000000000000000(0000) GS:ffff888125d16000(0000) knlGS:0000000000000000 [ 405.121769][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 405.121781][ C1] CR2: 000055af10d90000 CR3: 000000000df36000 CR4: 00000000003526f0 [ 405.121797][ C1] Call Trace: [ 405.121803][ C1] [ 405.121812][ C1] ? page_ext_get+0x22/0x2f0 [ 405.121834][ C1] lock_acquire+0x130/0x360 [ 405.121862][ C1] ? page_ext_get+0x22/0x2f0 [ 405.121884][ C1] page_ext_get+0x3e/0x2f0 [ 405.121905][ C1] ? page_ext_get+0x22/0x2f0 [ 405.121931][ C1] __reset_page_owner+0x28/0x1f0 [ 405.121954][ C1] __free_frozen_pages+0xbc4/0xd30 [ 405.121983][ C1] vfree+0x25a/0x400 [ 405.122006][ C1] ? __pfx_kcov_close+0x10/0x10 [ 405.122029][ C1] kcov_close+0x28/0x50 [ 405.122051][ C1] __fput+0x44c/0xa70 [ 405.122072][ C1] task_work_run+0x1d1/0x260 [ 405.122096][ C1] ? __pfx_task_work_run+0x10/0x10 [ 405.122120][ C1] ? kmem_cache_free+0x18f/0x400 [ 405.122145][ C1] do_exit+0x6b5/0x2300 [ 405.122169][ C1] ? do_raw_spin_lock+0x121/0x290 [ 405.122191][ C1] ? __pfx_do_exit+0x10/0x10 [ 405.122211][ C1] ? cgroup_freezing+0x20/0x350 [ 405.122238][ C1] do_group_exit+0x21c/0x2d0 [ 405.122259][ C1] ? lockdep_hardirqs_on+0x9c/0x150 [ 405.122277][ C1] get_signal+0x1286/0x1340 [ 405.122301][ C1] arch_do_signal_or_restart+0x9a/0x750 [ 405.122331][ C1] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 405.122363][ C1] ? exit_to_user_mode_loop+0x40/0x110 [ 405.122389][ C1] exit_to_user_mode_loop+0x75/0x110 [ 405.122413][ C1] do_syscall_64+0x2bd/0x3b0 [ 405.122431][ C1] ? lockdep_hardirqs_on+0x9c/0x150 [ 405.122447][ C1] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 405.122464][ C1] ? clear_bhb_loop+0x60/0xb0 [ 405.122482][ C1] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 405.122499][ C1] RIP: 0033:0x7f124218eba9 [ 405.122512][ C1] Code: Unable to access opcode bytes at 0x7f124218eb7f. [ 405.122521][ C1] RSP: 002b:00007f1242f8c038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 405.122538][ C1] RAX: fffffffffffffffc RBX: 00007f12423d5fa0 RCX: 00007f124218eba9 [ 405.122552][ C1] RDX: 0000000000000048 RSI: 0000200000000600 RDI: 000000000000000a [ 405.122563][ C1] RBP: 00007f1242211e19 R08: 0000000000000000 R09: 0000000000000000 [ 405.122574][ C1] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 405.122584][ C1] R13: 00007f12423d6038 R14: 00007f12423d5fa0 R15: 00007fff91ce1ee8 [ 405.122605][ C1] [ 405.480142][ T31] Kernel panic - not syncing: hung_task: blocked tasks [ 405.487037][ T31] CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) [ 405.496163][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 405.506499][ T31] Call Trace: [ 405.509790][ T31] [ 405.512730][ T31] dump_stack_lvl+0x99/0x250 [ 405.517519][ T31] ? __asan_memcpy+0x40/0x70 [ 405.522339][ T31] ? __pfx_dump_stack_lvl+0x10/0x10 [ 405.527991][ T31] ? __pfx__printk+0x10/0x10 [ 405.532611][ T31] vpanic+0x281/0x750 [ 405.536617][ T31] ? __pfx_vpanic+0x10/0x10 [ 405.541132][ T31] ? preempt_schedule+0xae/0xc0 [ 405.545998][ T31] ? preempt_schedule_common+0x83/0xd0 [ 405.551823][ T31] panic+0xb9/0xc0 [ 405.555573][ T31] ? __pfx_panic+0x10/0x10 [ 405.560073][ T31] ? preempt_schedule_thunk+0x16/0x30 [ 405.565554][ T31] ? nmi_trigger_cpumask_backtrace+0x2bb/0x300 [ 405.571817][ T31] watchdog+0xfd2/0xfe0 [ 405.576020][ T31] ? watchdog+0x1de/0xfe0 [ 405.580366][ T31] kthread+0x70e/0x8a0 [ 405.584445][ T31] ? __pfx_watchdog+0x10/0x10 [ 405.589124][ T31] ? __pfx_kthread+0x10/0x10 [ 405.593717][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 405.598919][ T31] ? lockdep_hardirqs_on+0x9c/0x150 [ 405.604107][ T31] ? __pfx_kthread+0x10/0x10 [ 405.608792][ T31] ret_from_fork+0x436/0x7d0 [ 405.613396][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 405.618663][ T31] ? __switch_to_asm+0x39/0x70 [ 405.623431][ T31] ? __switch_to_asm+0x33/0x70 [ 405.628571][ T31] ? __pfx_kthread+0x10/0x10 [ 405.633251][ T31] ret_from_fork_asm+0x1a/0x30 [ 405.638053][ T31] [ 405.641484][ T31] Kernel Offset: disabled [ 405.645908][ T31] Rebooting in 86400 seconds..