last executing test programs: 10m31.603045439s ago: executing program 4 (id=404): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$pppl2tp(0x18, 0x1, 0x1) r2 = socket$inet_udp(0x2, 0x2, 0x0) connect$pppl2tp(r1, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r2, 0x2, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}}}, 0x32) r3 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0a000000040000000800000008"], 0x48) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, &(0x7f00000002c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000001000000850000000f00000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000600)={&(0x7f00000005c0)='sys_enter\x00', r5}, 0x10) r6 = socket$inet(0x2b, 0x801, 0x0) listen(r6, 0x9) sendmsg$nl_route(r2, 0xfffffffffffffffc, 0x40480c0) r7 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) r8 = bpf$PROG_LOAD(0x5, &(0x7f0000000700)={0x11, 0xf, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r7, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000800000000bf91000000000000b702000043e7b5538500000085000000b70000000000000095"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000140)='kmem_cache_free\x00', r8}, 0x10) ppoll(&(0x7f0000000500)=[{r1}], 0x1, 0x0, 0x0, 0x0) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x40000000000, 0x3, 0x4, 0x0, 0x0, 0x3}, 0x0, &(0x7f00000002c0)={0x3ff, 0x0, 0x0, 0x9, 0x0, 0x0, 0x7fffffff}, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) close(0x4) socket$unix(0x1, 0x5, 0x0) r9 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(r9, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="01000cbd70100400000005000000080009000200000008000c00a80a000008000000000600010000080000000000"], 0x34}, 0x1, 0x0, 0x0, 0x40811}, 0x20) r10 = socket(0x2, 0x80805, 0x0) r11 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r11, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r11, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x10, &(0x7f00000001c0)=[@in={0x2, 0x4e23, @rand_addr=0x64010100}]}, &(0x7f0000000140)=0x10) sendmmsg$inet_sctp(r10, &(0x7f00000032c0)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="30000000000000008400000001000000000000017c"], 0x30}], 0x1, 0x0) setsockopt$inet_sctp_SCTP_DELAYED_SACK(r10, 0x84, 0x10, &(0x7f0000000400)=@assoc_value={r12, 0x5}, 0x8) syz_genetlink_get_family_id$SEG6(&(0x7f0000000080), r10) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a3c000000120a01010000000000000000020000000c000b40ffff01ffffffffff08000440000000000900010073797a3000000000487fee46204bbfff44000000140a03000000000000000000020000000900010073797a300000000018000800d2f37679929719a2e33420decc7be35783edffcc0900020073797a3100000000140000001100010000000000000000000500000a"], 0xa8}}, 0x0) 10m30.1469879s ago: executing program 4 (id=416): r0 = socket$rds(0x15, 0x5, 0x0) setsockopt$RDS_RECVERR(r0, 0x114, 0x5, &(0x7f0000000180)=0x1, 0x4) r1 = syz_init_net_socket$ax25(0x3, 0x5, 0x7) ioctl$sock_SIOCINQ(r1, 0x541b, &(0x7f0000000000)) r2 = socket$rxrpc(0x21, 0x2, 0xa) bind$rxrpc(r2, &(0x7f0000000000)=@in6={0x21, 0x0, 0x2, 0x1c, {0xa, 0x4e24, 0x9, @dev={0xfe, 0x80, '\x00', 0x1c}, 0x8000}}, 0x24) socket$inet_icmp_raw(0x2, 0x3, 0x1) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000080)='ns/ipc\x00') unshare(0x6a040000) socket(0x8, 0x3, 0x0) unshare(0x20000400) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r4, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000001bc0)=ANY=[@ANYRESHEX=r0, @ANYBLOB="b8de60281b8ed64f5f5564018ff55f6449c967f44001ab52f4480c2c8976e0b30ff1b38eb0fc15a98e4bb0be632e12cdc6623b9b136666812485b567", @ANYRESOCT=r2, @ANYRESOCT=r1, @ANYRESDEC=r1, @ANYRES32=r4, @ANYRES8=r0, @ANYRES8=0x0], 0x3c}}, 0x0) ioctl$int_in(0xffffffffffffffff, 0x5452, &(0x7f0000000000)=0x1) socket$kcm(0x29, 0xd, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000600), 0xffffffffffffffff) sendmsg$WG_CMD_SET_DEVICE(r5, &(0x7f0000001000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000640)={0x78, r6, 0x1, 0x0, 0x0, {}, [@WGDEVICE_A_PEERS={0x50, 0x8, 0x0, 0x1, [{0x4c, 0x0, 0x0, 0x1, [@WGPEER_A_PRESHARED_KEY={0x24, 0x2, "3cfcd5c801ec3291074ff1ae2f9a9bb19b9847c763b995066671a4832a35222b"}, @WGPEER_A_PUBLIC_KEY={0x24}]}]}, @WGDEVICE_A_IFNAME={0x14, 0x2, 'wg2\x00'}]}, 0x78}, 0x1, 0x0, 0x0, 0x4084}, 0x20008040) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r7, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) connect$inet6(r7, &(0x7f0000000100)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x1}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r7, 0x6, 0x1f, &(0x7f00000002c0), 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r7, 0x6, 0x14, &(0x7f0000000240)=0x2, 0x4) setsockopt$inet6_tcp_TLS_TX(r7, 0x11a, 0x2, &(0x7f0000000180)=@gcm_256={{0x304}, "32f058ec27d46898", "d40f86fd02541c95afec379bdb3cc0d5646e20975202603a18fe7474dc4c3d7b", '\"\vEX', "010000000100"}, 0x38) 10m27.257214662s ago: executing program 4 (id=430): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="140000001000010000000200000000000000000a20000000000a03000000000000000000010000000900010073797a300000000078000000030a01010000000000000000010000000900030073797a310000000028000480080002400000000208000140000000051400030076657468315f746f5f626174616476000900010073797a300000000008000a4000000002"], 0xc0}}, 0x840) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_FASTOPEN_KEY(r1, 0x6, 0x21, &(0x7f0000000140)="5aada6df63d531b4b30d10bf2a57e6e9", 0x10) 10m27.060746591s ago: executing program 4 (id=431): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000b80)=@newtaction={0x98, 0x30, 0x1, 0x0, 0x0, {}, [{0x84, 0x1, [@m_tunnel_key={0x50, 0x1, 0x0, 0x0, {{0xf}, {0x20, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_PARMS={0x1c, 0x2, {{}, 0x2}}]}, {0x4}, {0xc}, {0xc}}}, @m_gact={0x30, 0x2, 0x0, 0x0, {{0x9}, {0x4}, {0x4}, {0xc}, {0xc}}}]}]}, 0x98}}, 0x0) (async, rerun: 32) r1 = socket(0x10, 0x803, 0x0) (rerun: 32) r2 = socket$nl_route(0x10, 0x3, 0x0) (async) sendmsg$nl_route_sched(r1, &(0x7f0000000140)={0x0, 0xffffffffffffff34, &(0x7f0000000080)={0x0, 0xb8}}, 0x0) (async) getsockname$packet(r1, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000540)=ANY=[@ANYBLOB="34000000100081eee80000040000000010000000", @ANYRES32=r3, @ANYBLOB="ddfffffdff000000140012000c000100627269646765"], 0x34}}, 0x0) (async) r4 = socket$nl_route(0x10, 0x3, 0x0) (async) r5 = socket(0x10, 0x3, 0x0) r6 = socket(0x10, 0x803, 0x2) syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), r6) getsockname$packet(r6, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000003c0)=0x14) sendmsg$nl_route_sched(r5, &(0x7f0000005840)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=@newqdisc={0x2c, 0x24, 0x5820a61ca228651, 0x0, 0x0, {0x0, 0x0, 0x0, r7, {0x0, 0x6}, {0xffff, 0xffff}, {0x0, 0x10}}, [@qdisc_kind_options=@q_qfg={0x8}]}, 0x2c}}, 0x0) (async) sendmsg$nl_route_sched(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000340)=@newtfilter={0x3c, 0x28, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r7}, [@filter_kind_options=@f_basic={{0xa}, {0x4}}, @TCA_RATE={0x6, 0x5, {0x9, 0x81}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x8000}, 0x0) (async) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) getpeername$tipc(r8, 0x0, 0x0) 10m26.760920918s ago: executing program 4 (id=435): bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0xd, 0x4, &(0x7f0000000400)=ANY=[@ANYBLOB="b40000000080000061176c00000000000600f900000000009500000000000000"], &(0x7f0000000080)='GPL\x00', 0x4, 0x3e0, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sock_ops, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0x76}, 0x48) unshare(0x22020600) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout_data(r0, 0x107, 0x16, 0x0, 0x0) ioctl$sock_rose_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000010c0)={@dev={0xbb, 0xbb, 0xbb, 0x1, 0x0}, 0x7, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @rose={'rose', 0x0}, 0x6, [@null, @default, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}]}) r1 = socket$inet_sctp(0x2, 0x5, 0x84) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000e00)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=@ipmr_delroute={0x11, 0x19, 0x1, 0x0, 0x0, {0x80, 0x20, 0x0, 0x40, 0xfd, 0x4, 0x0, 0x5, 0x2200}}, 0x1c}, 0x1, 0x0, 0x0, 0x800}, 0x40010) getsockopt$inet_sctp_SCTP_MAX_BURST(r1, 0x84, 0xc, &(0x7f0000000240)=@assoc_value, &(0x7f0000000080)=0x8) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000c00)=@filter={'filter\x00', 0xe, 0x3, 0xba2, [0x0, 0x200000000040, 0x200000000070, 0x2000000002a4], 0x0, &(0x7f0000000000), &(0x7f0000000040)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xfffffffffffffffc, 0x2, [{0x11, 0x10, 0x9, 'virt_wifi0\x00', 'ipvlan0\x00', 'bond_slave_1\x00', 'vxcan1\x00', @random="f4e2f83a8008", [0xff, 0xff, 0x0, 0xff, 0xff], @broadcast, [0xff, 0xff, 0xff, 0xff, 0x0, 0xff], 0x6e, 0x6e, 0xa6, [], [], @common=@mark={'mark\x00', 0x10, {{0xffffffc0, 0xfffffffffffffffc}}}}, {0x11, 0x31, 0x18, 'vxcan1\x00', 'batadv_slave_1\x00', 'bridge0\x00', 'team0\x00', @multicast, [0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}, [0x0, 0xff, 0xff, 0x0, 0xff, 0xff], 0xde, 0x10e, 0x15e, [@m802_3={{'802_3\x00', 0x0, 0x8}, {{0x7e, 0xa, 0x6}}}, @devgroup={{'devgroup\x00', 0x0, 0x18}, {{0x4, 0x8, 0xc93a, 0xbc, 0x7}}}], [@common=@NFQUEUE0={'NFQUEUE\x00', 0x8, {{0xf626}}}], @common=@IDLETIMER={'IDLETIMER\x00', 0x28, {{0x9, 'syz0\x00'}}}}]}, {0x0, '\x00', 0x2, 0x1, 0x1, [{0xa, 0x41, 0x3, 'vxcan1\x00', 'veth0_to_bridge\x00', 'macvtap0\x00', 'syzkaller1\x00', @empty, [0x0, 0x0, 0xff, 0xff, 0xff], @link_local, [0x0, 0x0, 0xff, 0x0, 0xff], 0x896, 0x8de, 0x90e, [@time={{'time\x00', 0x0, 0x18}, {{0x0, 0xffffffff, 0x574d, 0xa4b, 0x0, 0x4, 0x3}}}, @u32={{'u32\x00', 0x0, 0x7c0}, {{[{[{0x8, 0x3}, {0x50, 0x1}, {0x0, 0x2}, {0x6, 0x3}, {0x1e}, {0x4, 0x2}, {0x6, 0x3}, {0x101}, {0xa4, 0x1}, {0xd, 0x3}, {0x7f, 0x1}], [{0xa5a3, 0x722830f6}, {0xe, 0x3ff}, {0x8, 0xe206}, {0x0, 0x1ff}, {0x401, 0x2}, {0xbf6, 0x5}, {0x2, 0x6}, {0x2, 0x1ff}, {0xff, 0x5}, {0xf, 0x3}, {0x9, 0x1}], 0x3, 0x5}, {[{0x1, 0x3}, {0xfffffff7, 0x3}, {0x4}, {0x9, 0x1}, {0x4, 0x2}, {0x3ff}, {0xc, 0x5}, {0x1}, {0x1}, {0xfffffeff, 0x3}, {0x0, 0x3}], [{0x1ff, 0x9}, {0x6ed, 0x7}, {0x10000, 0x6}, {0x3, 0x6}, {0x525}, {0x5, 0xb}, {0x7fffffff, 0x3}, {0x6, 0x6}, {0x6, 0x80000001}, {0x8, 0xff}, {0x1, 0x5}], 0x2, 0xb}, {[{0x10}, {0x5}, {0x993, 0x3}, {0xfff}, {0x1, 0x1}, {0x4, 0x1}, {0xffffffec}, {0x74}, {0x200, 0x3}, {0x0, 0x3}, {0x9, 0x2}], [{0x3, 0x90}, {0x0, 0x7ff}, {0x1, 0x8}, {0x101, 0x7ff}, {0x4, 0x100}, {0x33, 0x7}, {0x100, 0x6}, {0x7fff, 0x4}, {0x3, 0x1}, {0x7, 0x2}, {0x40}], 0x8, 0x7}, {[{0x9}, {0xf}, {0x5, 0x2}, {0x3df3, 0x2}, {0xfffffff9, 0x3}, {0xf2, 0x2}, {0x1, 0x3}, {0x9, 0x4}, {0x4000000, 0x1}, {0x9}, {0xfff, 0x3}], [{0x6, 0x3}, {0xa6ea, 0xb}, {0x6, 0x80000000}, {0x7, 0xc}, {0x7, 0x9}, {0x4, 0x7}, {0x80000001, 0x11}, {0x18000, 0xacf}, {0x2, 0x400}, {0x6, 0x9}, {0x6, 0x3}], 0x3, 0x4}, {[{0x8, 0x1}, {0x3, 0x1}, {0x7, 0x2}, {}, {0xfffffff9, 0x3}, {0x6}, {0xff1, 0x3}, {0x71, 0x2}, {0x7}, {0x3}, {0x10001, 0x1}], [{0xa, 0x80000001}, {0xfffffffa, 0xef}, {0x8, 0xd}, {0xffffffff, 0x2}, {0x6, 0x5}, {0x40, 0x5}, {0x6}, {0x200, 0xffffff80}, {0x900000, 0x3}, {0xde, 0x8}, {0x80, 0x2}], 0x1, 0x9}, {[{0x1, 0x1}, {0x4, 0x2}, {0xe}, {0x80000, 0x1}, {0x9d10}, {0x2}, {0x7, 0x1}, {0x7}, {0x2}, {0x2, 0x1}, {0x7ff, 0x1}], [{0x8, 0x3}, {0xfffffffb, 0x4a55}, {0x2, 0x7}, {0x4, 0x4a}, {0xfffffffc, 0x10000}, {0x9, 0x800}, {0x1, 0x7}, {0xa, 0x1}, {0x7fff, 0x8}, {0x9, 0xf}, {0x7, 0x1}], 0x8, 0x4}, {[{0x6}, {0x7cb, 0x2}, {0x0, 0x8566b63fb5099919}, {0x101}, {0x1000, 0x3}, {0x0, 0x3}, {0x5, 0x1}, {0x7}, {0xfff, 0x3}, {0xce000000, 0x3}, {0x800, 0x2}], [{0x9, 0x2}, {0x101, 0x5}, {0x9, 0x6}, {0x703, 0x10001}, {0x8000}, {0x3, 0x2}, {0x3, 0x3}, {0x8001, 0x1}, {0x6, 0x9}, {0x3, 0x3e0}, {0x1, 0x9}], 0x9, 0x7}, {[{0xb, 0x2}, {0x9}, {0x4, 0x1}, {0x5}, {0xe0d, 0x2}, {0x4, 0x2}, {0x5, 0x1}, {0xffff8001, 0x3}, {0x725, 0x3}, {0xfffffe01}], [{0x8}, {0x5}, {0xfcf0, 0x3ff}, {0x80000001, 0x7}, {0x2, 0x2}, {0x9, 0x47}, {0xffb9, 0xb5}, {0x3, 0x7}, {0x7fffffff, 0x7}, {0xecf, 0x4}, {0x7, 0xe1800000}], 0x5, 0x8}, {[{0x100}, {0x2}, {0xd}, {0x800}, {0x7f}, {0x3ff, 0x3}, {0x2a8, 0x3}, {0x5, 0x1}, {0x9, 0x3}, {0x5, 0x3}, {0x6, 0x2}], [{0x800, 0x3}, {0xef37, 0x1}, {0x400, 0x7}, {0x0, 0xfffffff7}, {0x9, 0x9}, {0x2, 0x2}, {0x6, 0xe}, {0x2, 0xfff}, {0x5, 0x4}, {0xffffffff, 0x7}, {0x4}], 0x1, 0xa}, {[{}, {0x80, 0x3}, {0x0, 0x3}, {0xa70, 0x3}, {0x7, 0x1}, {0x4}, {0xa, 0x1}, {0x9, 0x1}, {0xb57, 0x2}, {0xa, 0x2}, {0x4}], [{0x9, 0x7}, {0x80000001, 0x8}, {0x6, 0x5}, {0x1, 0xb}, {0x6, 0x1}, {0x3ff, 0xfffffffe}, {0x6, 0x8}, {0x0, 0x3f2}, {0xff, 0x77e2}, {0x9, 0x8}, {0x40, 0x7}], 0x2, 0x8}, {[{0x2, 0x2}, {0x4, 0x1}, {0x0, 0x3}, {0xfffffff5, 0x3}, {0x449e, 0x3}, {0x9, 0x1}, {0xfff}, {0x50000}, {0xb}, {0xaf2}, {0x4, 0x2}], [{0xf}, {0x60, 0x2}, {0x1, 0xd1}, {0x4, 0x9}, {0x8001, 0x8000}, {0xfffffff6}, {0x346, 0x8000}, {0x7, 0x3}, {0x80, 0x4}, {0x7, 0x6}, {0x401, 0x7}], 0xb, 0x8}], 0x8, 0x1}}}], [@common=@RATEEST={'RATEEST\x00', 0x20, {{'syz0\x00', 0xb, 0x2, {0x9}}}}], @common=@NFQUEUE0={'NFQUEUE\x00', 0x8, {{0x3}}}}]}]}, 0xc1a) 10m26.191212736s ago: executing program 4 (id=445): r0 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000000)='ib_mad_send_done_handler\x00', 0xffffffffffffffff, 0x0, 0x8}, 0x18) read(r0, &(0x7f0000000080)=""/97, 0x61) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_START_AP(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)={0x64, r1, 0x1, 0x70bd29, 0x25dfdbfc, {{}, {@void, @void}}, [@NL80211_ATTR_PBSS={0x4}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ibss_ssid}, @beacon=[@NL80211_ATTR_IE_PROBE_RESP={0x17, 0x7f, [@challenge={0x10, 0x1, 0xc5}, @mesh_id={0x72, 0x6}, @mesh_id={0x72, 0x6}]}, @NL80211_ATTR_BEACON_TAIL={0x10, 0xf, [@supported_rates={0x1, 0x1, [{0x48, 0x1}]}, @mesh_config={0x71, 0x7, {0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x28}}]}], @NL80211_ATTR_DTIM_PERIOD={0x8, 0xd, 0x6}, @NL80211_ATTR_SMPS_MODE={0x5, 0xd5, 0x3}, @NL80211_ATTR_P2P_OPPPS={0x5, 0xa3, 0x1}]}, 0x64}, 0x1, 0x0, 0x0, 0x10}, 0x4000010) (async) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000002c0)={'macsec0\x00', 0x20}) r3 = accept4$bt_l2cap(0xffffffffffffffff, &(0x7f0000000300), &(0x7f0000000340)=0xe, 0x80000) connect$bt_l2cap(r3, &(0x7f0000000380)={0x1f, 0x40, @none, 0x800, 0x1}, 0xe) (async) openat$tun(0xffffffffffffff9c, &(0x7f00000003c0), 0x200940, 0x0) (async) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000440), 0xffffffffffffffff) sendmsg$NL80211_CMD_UNEXPECTED_FRAME(0xffffffffffffffff, &(0x7f0000000500)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000480)={0x20, r4, 0x300, 0x70bd2c, 0x25dfdbfe, {{}, {@void, @val={0xc, 0x99, {0xdf2, 0x4c}}}}, ["", "", "", "", ""]}, 0x20}, 0x1, 0x0, 0x0, 0x800}, 0x8001) r5 = socket$inet(0x2, 0x0, 0x8) recvfrom$inet(r5, &(0x7f0000000540)=""/208, 0xd0, 0x100a0, 0x0, 0x0) (async) r6 = socket$nl_route(0x10, 0x3, 0x0) (async) r7 = socket$inet6_udplite(0xa, 0x2, 0x88) getsockopt$IP6T_SO_GET_INFO(r7, 0x29, 0x40, &(0x7f0000000640)={'nat\x00', 0x0, [0x7, 0x5, 0x4, 0x4]}, &(0x7f00000006c0)=0x54) (async) syz_genetlink_get_family_id$fou(&(0x7f0000000700), 0xffffffffffffffff) (async, rerun: 64) r8 = socket$nl_generic(0x10, 0x3, 0x10) (async, rerun: 64) r9 = syz_genetlink_get_family_id$devlink(&(0x7f0000000780), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_PORT_SET(r8, &(0x7f00000008c0)={&(0x7f0000000740)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000880)={&(0x7f00000007c0)={0xa4, r9, 0x200, 0x70bd25, 0x25dfdbfc, {}, [{{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8}}, {0x6, 0x4, 0x1}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8}}, {0x6}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x1}}, {0x6, 0x4, 0x2}}]}, 0xa4}, 0x1, 0x0, 0x0, 0x4008000}, 0x4000000) (async) r10 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000940), r8) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r5, 0x89f0, &(0x7f0000000a40)={'sit0\x00', &(0x7f0000000980)={'erspan0\x00', 0x0, 0x7, 0x7800, 0xb5, 0x0, {{0x24, 0x4, 0x1, 0x2, 0x90, 0x64, 0x0, 0x2, 0x4, 0x0, @multicast2, @remote, {[@timestamp_prespec={0x44, 0xc, 0x38, 0x3, 0x7, [{@initdev={0xac, 0x1e, 0x1, 0x0}, 0x2}]}, @timestamp_prespec={0x44, 0xc, 0xd3, 0x3, 0x2, [{@loopback}]}, @timestamp_addr={0x44, 0x1c, 0xcc, 0x1, 0x8, [{@loopback, 0x4}, {@dev={0xac, 0x14, 0x14, 0x23}}, {@local, 0x2}]}, @cipso={0x86, 0x1b, 0x2, [{0x1, 0x7, "01078c9fc2"}, {0x0, 0xa, "0b6dc9674150e7f2"}, {0x2, 0x4, "24bb"}]}, @ra={0x94, 0x4}, @ra={0x94, 0x4}, @noop, @timestamp_addr={0x44, 0x24, 0xef, 0x1, 0x2, [{@broadcast, 0x1f33}, {@multicast2, 0x6}, {@private=0xa010100, 0x9}, {@broadcast, 0x4}]}]}}}}}) sendmsg$ETHTOOL_MSG_LINKINFO_SET(r8, &(0x7f0000000b40)={&(0x7f0000000900)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000b00)={&(0x7f0000000a80)={0x58, r10, 0x400, 0x70bd2d, 0x25dfdbfe, {}, [@ETHTOOL_A_LINKINFO_TP_MDIX_CTRL={0x5, 0x5, 0x81}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x9}, @ETHTOOL_A_LINKINFO_HEADER={0x2c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r11}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}]}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x7}]}, 0x58}, 0x1, 0x0, 0x0, 0x801}, 0x800) (async, rerun: 64) sendmsg$DEVLINK_CMD_TRAP_GROUP_GET(r8, &(0x7f0000000d80)={&(0x7f0000000b80)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000d40)={&(0x7f0000000bc0)={0x154, r9, 0x2, 0x70bd2c, 0x5, {}, [{@pci={{0x8}, {0x11}}, {0xd}}, {@pci={{0x8}, {0x11}}, {0xd}}, {@pci={{0x8}, {0x11}}, {0xd}}, {@pci={{0x8}, {0x11}}, {0xd}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0xd}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0xd}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0xd}}]}, 0x154}, 0x1, 0x0, 0x0, 0x8014}, 0x10810) (async, rerun: 64) r12 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000e00), r8) sendmsg$MPTCP_PM_CMD_SUBFLOW_CREATE(r8, &(0x7f0000000f40)={&(0x7f0000000dc0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000f00)={&(0x7f0000000e40)={0xb8, r12, 0x20, 0x70bd25, 0x25dfdbfc, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x1}, @MPTCP_PM_ATTR_ADDR={0x28, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @mcast1}]}, @MPTCP_PM_ATTR_LOC_ID={0x5, 0x5, 0xff}, @MPTCP_PM_ATTR_ADDR={0x38, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x8}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e20}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private0}]}, @MPTCP_PM_ATTR_ADDR={0x2c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x73}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e20}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e20}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x9}]}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x5}]}, 0xb8}, 0x1, 0x0, 0x0, 0x8804}, 0x0) setsockopt$sock_int(r3, 0x1, 0x1e, &(0x7f0000000f80)=0x68, 0x4) ioctl$EXT4_IOC_SETFSUUID(0xffffffffffffffff, 0x4008662c, &(0x7f0000000fc0)={0x0, 0x0, "c5486c3d56a7c9545b9c03eb6e7f29a4"}) (async) sendmsg$nl_route(r6, &(0x7f00000010c0)={&(0x7f0000001000)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000001080)={&(0x7f0000001040)=@delneigh={0x24, 0x1d, 0x200, 0x70bd2c, 0x25dfdbfd, {0xa, 0x0, 0x0, 0x0, 0x0, 0x96, 0xa}, [@NDA_PORT={0x6, 0x6, 0x4e22}]}, 0x24}, 0x1, 0x0, 0x0, 0x40000}, 0x841) sendmsg$key(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000001240)={&(0x7f0000001100)={0x2, 0xe, 0x1, 0x2, 0x24, 0x0, 0x70bd26, 0x25dfdbfe, [@sadb_lifetime={0x4, 0x2, 0x7, 0x7efeedaf, 0x2, 0xf949}, @sadb_ident={0x2, 0x0, 0x2, 0x0, 0x42}, @sadb_address={0x5, 0x5, 0x33, 0xa0, 0x0, @in6={0xa, 0x4e20, 0x5, @local, 0x281e}}, @sadb_x_policy={0x8, 0x12, 0x2, 0x1, 0x0, 0x6e6bc0, 0x4257, {0x6, 0x33, 0x9, 0x1, 0x0, 0xc87, 0x0, @in=@broadcast, @in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}}, @sadb_x_kmaddress={0x5, 0x19, 0x0, @in={0x2, 0x4e21, @multicast2}, @in={0x2, 0x4e20, @remote}}, @sadb_address={0x3, 0x7, 0x32, 0x180, 0x0, @in={0x2, 0x4e24, @remote}}, @sadb_x_sa2={0x2, 0x13, 0x81, 0x0, 0x0, 0x70bd2d, 0x3507}, @sadb_address={0x3, 0x6, 0x32, 0xa0, 0x0, @in={0x2, 0x4e21, @multicast2}}, @sadb_x_sa2={0x2, 0x13, 0x1, 0x0, 0x0, 0x70bd29}]}, 0x120}}, 0x20048000) 10m25.745129474s ago: executing program 32 (id=445): r0 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000000)='ib_mad_send_done_handler\x00', 0xffffffffffffffff, 0x0, 0x8}, 0x18) read(r0, &(0x7f0000000080)=""/97, 0x61) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_START_AP(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)={0x64, r1, 0x1, 0x70bd29, 0x25dfdbfc, {{}, {@void, @void}}, [@NL80211_ATTR_PBSS={0x4}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ibss_ssid}, @beacon=[@NL80211_ATTR_IE_PROBE_RESP={0x17, 0x7f, [@challenge={0x10, 0x1, 0xc5}, @mesh_id={0x72, 0x6}, @mesh_id={0x72, 0x6}]}, @NL80211_ATTR_BEACON_TAIL={0x10, 0xf, [@supported_rates={0x1, 0x1, [{0x48, 0x1}]}, @mesh_config={0x71, 0x7, {0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x28}}]}], @NL80211_ATTR_DTIM_PERIOD={0x8, 0xd, 0x6}, @NL80211_ATTR_SMPS_MODE={0x5, 0xd5, 0x3}, @NL80211_ATTR_P2P_OPPPS={0x5, 0xa3, 0x1}]}, 0x64}, 0x1, 0x0, 0x0, 0x10}, 0x4000010) (async) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000002c0)={'macsec0\x00', 0x20}) r3 = accept4$bt_l2cap(0xffffffffffffffff, &(0x7f0000000300), &(0x7f0000000340)=0xe, 0x80000) connect$bt_l2cap(r3, &(0x7f0000000380)={0x1f, 0x40, @none, 0x800, 0x1}, 0xe) (async) openat$tun(0xffffffffffffff9c, &(0x7f00000003c0), 0x200940, 0x0) (async) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000440), 0xffffffffffffffff) sendmsg$NL80211_CMD_UNEXPECTED_FRAME(0xffffffffffffffff, &(0x7f0000000500)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000480)={0x20, r4, 0x300, 0x70bd2c, 0x25dfdbfe, {{}, {@void, @val={0xc, 0x99, {0xdf2, 0x4c}}}}, ["", "", "", "", ""]}, 0x20}, 0x1, 0x0, 0x0, 0x800}, 0x8001) r5 = socket$inet(0x2, 0x0, 0x8) recvfrom$inet(r5, &(0x7f0000000540)=""/208, 0xd0, 0x100a0, 0x0, 0x0) (async) r6 = socket$nl_route(0x10, 0x3, 0x0) (async) r7 = socket$inet6_udplite(0xa, 0x2, 0x88) getsockopt$IP6T_SO_GET_INFO(r7, 0x29, 0x40, &(0x7f0000000640)={'nat\x00', 0x0, [0x7, 0x5, 0x4, 0x4]}, &(0x7f00000006c0)=0x54) (async) syz_genetlink_get_family_id$fou(&(0x7f0000000700), 0xffffffffffffffff) (async, rerun: 64) r8 = socket$nl_generic(0x10, 0x3, 0x10) (async, rerun: 64) r9 = syz_genetlink_get_family_id$devlink(&(0x7f0000000780), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_PORT_SET(r8, &(0x7f00000008c0)={&(0x7f0000000740)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000880)={&(0x7f00000007c0)={0xa4, r9, 0x200, 0x70bd25, 0x25dfdbfc, {}, [{{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8}}, {0x6, 0x4, 0x1}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8}}, {0x6}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x1}}, {0x6, 0x4, 0x2}}]}, 0xa4}, 0x1, 0x0, 0x0, 0x4008000}, 0x4000000) (async) r10 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000940), r8) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r5, 0x89f0, &(0x7f0000000a40)={'sit0\x00', &(0x7f0000000980)={'erspan0\x00', 0x0, 0x7, 0x7800, 0xb5, 0x0, {{0x24, 0x4, 0x1, 0x2, 0x90, 0x64, 0x0, 0x2, 0x4, 0x0, @multicast2, @remote, {[@timestamp_prespec={0x44, 0xc, 0x38, 0x3, 0x7, [{@initdev={0xac, 0x1e, 0x1, 0x0}, 0x2}]}, @timestamp_prespec={0x44, 0xc, 0xd3, 0x3, 0x2, [{@loopback}]}, @timestamp_addr={0x44, 0x1c, 0xcc, 0x1, 0x8, [{@loopback, 0x4}, {@dev={0xac, 0x14, 0x14, 0x23}}, {@local, 0x2}]}, @cipso={0x86, 0x1b, 0x2, [{0x1, 0x7, "01078c9fc2"}, {0x0, 0xa, "0b6dc9674150e7f2"}, {0x2, 0x4, "24bb"}]}, @ra={0x94, 0x4}, @ra={0x94, 0x4}, @noop, @timestamp_addr={0x44, 0x24, 0xef, 0x1, 0x2, [{@broadcast, 0x1f33}, {@multicast2, 0x6}, {@private=0xa010100, 0x9}, {@broadcast, 0x4}]}]}}}}}) sendmsg$ETHTOOL_MSG_LINKINFO_SET(r8, &(0x7f0000000b40)={&(0x7f0000000900)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000b00)={&(0x7f0000000a80)={0x58, r10, 0x400, 0x70bd2d, 0x25dfdbfe, {}, [@ETHTOOL_A_LINKINFO_TP_MDIX_CTRL={0x5, 0x5, 0x81}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x9}, @ETHTOOL_A_LINKINFO_HEADER={0x2c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r11}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}]}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x7}]}, 0x58}, 0x1, 0x0, 0x0, 0x801}, 0x800) (async, rerun: 64) sendmsg$DEVLINK_CMD_TRAP_GROUP_GET(r8, &(0x7f0000000d80)={&(0x7f0000000b80)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000d40)={&(0x7f0000000bc0)={0x154, r9, 0x2, 0x70bd2c, 0x5, {}, [{@pci={{0x8}, {0x11}}, {0xd}}, {@pci={{0x8}, {0x11}}, {0xd}}, {@pci={{0x8}, {0x11}}, {0xd}}, {@pci={{0x8}, {0x11}}, {0xd}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0xd}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0xd}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0xd}}]}, 0x154}, 0x1, 0x0, 0x0, 0x8014}, 0x10810) (async, rerun: 64) r12 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000e00), r8) sendmsg$MPTCP_PM_CMD_SUBFLOW_CREATE(r8, &(0x7f0000000f40)={&(0x7f0000000dc0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000f00)={&(0x7f0000000e40)={0xb8, r12, 0x20, 0x70bd25, 0x25dfdbfc, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x1}, @MPTCP_PM_ATTR_ADDR={0x28, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @mcast1}]}, @MPTCP_PM_ATTR_LOC_ID={0x5, 0x5, 0xff}, @MPTCP_PM_ATTR_ADDR={0x38, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x8}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e20}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private0}]}, @MPTCP_PM_ATTR_ADDR={0x2c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x73}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e20}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e20}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x9}]}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x5}]}, 0xb8}, 0x1, 0x0, 0x0, 0x8804}, 0x0) setsockopt$sock_int(r3, 0x1, 0x1e, &(0x7f0000000f80)=0x68, 0x4) ioctl$EXT4_IOC_SETFSUUID(0xffffffffffffffff, 0x4008662c, &(0x7f0000000fc0)={0x0, 0x0, "c5486c3d56a7c9545b9c03eb6e7f29a4"}) (async) sendmsg$nl_route(r6, &(0x7f00000010c0)={&(0x7f0000001000)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000001080)={&(0x7f0000001040)=@delneigh={0x24, 0x1d, 0x200, 0x70bd2c, 0x25dfdbfd, {0xa, 0x0, 0x0, 0x0, 0x0, 0x96, 0xa}, [@NDA_PORT={0x6, 0x6, 0x4e22}]}, 0x24}, 0x1, 0x0, 0x0, 0x40000}, 0x841) sendmsg$key(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000001240)={&(0x7f0000001100)={0x2, 0xe, 0x1, 0x2, 0x24, 0x0, 0x70bd26, 0x25dfdbfe, [@sadb_lifetime={0x4, 0x2, 0x7, 0x7efeedaf, 0x2, 0xf949}, @sadb_ident={0x2, 0x0, 0x2, 0x0, 0x42}, @sadb_address={0x5, 0x5, 0x33, 0xa0, 0x0, @in6={0xa, 0x4e20, 0x5, @local, 0x281e}}, @sadb_x_policy={0x8, 0x12, 0x2, 0x1, 0x0, 0x6e6bc0, 0x4257, {0x6, 0x33, 0x9, 0x1, 0x0, 0xc87, 0x0, @in=@broadcast, @in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}}, @sadb_x_kmaddress={0x5, 0x19, 0x0, @in={0x2, 0x4e21, @multicast2}, @in={0x2, 0x4e20, @remote}}, @sadb_address={0x3, 0x7, 0x32, 0x180, 0x0, @in={0x2, 0x4e24, @remote}}, @sadb_x_sa2={0x2, 0x13, 0x81, 0x0, 0x0, 0x70bd2d, 0x3507}, @sadb_address={0x3, 0x6, 0x32, 0xa0, 0x0, @in={0x2, 0x4e21, @multicast2}}, @sadb_x_sa2={0x2, 0x13, 0x1, 0x0, 0x0, 0x70bd29}]}, 0x120}}, 0x20048000) 4.343523399s ago: executing program 2 (id=4137): socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r0, &(0x7f0000000500)={&(0x7f0000000040)=@hci, 0x80, &(0x7f0000000100)=[{&(0x7f0000000400)=""/248, 0x200105d0}], 0x1}, 0x1f00) (async) sendmsg$tipc(r1, &(0x7f0000000240)={0x0, 0xfffffff5, &(0x7f0000000200)=[{&(0x7f0000000140)="a2", 0xfffffdef}], 0x1}, 0x0) (async) r2 = socket$l2tp(0x2, 0x2, 0x73) setsockopt$inet_int(r2, 0x0, 0x31, &(0x7f0000000000)=0x1, 0x1) r3 = socket$netlink(0x10, 0x3, 0xc) close(0x4) r4 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet6_int(r4, 0x29, 0x1a, &(0x7f0000000180)=0x2f9, 0x4) (async) getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r4, 0x84, 0x85, &(0x7f00000000c0)={0x0, @in6={{0xa, 0x4e20, 0xbace, @ipv4={'\x00', '\xff\xff', @loopback}, 0x6}}, 0x0, 0xc}, &(0x7f0000000080)=0x90) (async) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) (async) r7 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0xe, 0x4, 0x4, 0x5, 0x0, 0xffffffffffffffff, 0x3}, 0x50) r8 = bpf$MAP_CREATE(0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x10, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r8, @ANYBLOB="0000000000000000b702000000000000850000008600000018110000", @ANYRES32=r7, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r9 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0x10, &(0x7f0000000180)=ANY=[], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) (async) r10 = socket(0xa, 0x5, 0x0) sendmsg$inet_sctp(r10, &(0x7f0000001640)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="18000000000000008400000005000000c7"], 0x18}, 0x280400d5) (async) setsockopt$TIPC_DEST_DROPPABLE(r10, 0x10f, 0x81, &(0x7f0000000280)=0x5, 0x4) (async) setsockopt$sock_attach_bpf(r5, 0x1, 0x32, &(0x7f00000000c0)=r9, 0x4) (async) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_attach_bpf(r12, 0x1, 0x4c, &(0x7f0000000000), 0x4) sendmsg$inet(r11, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) (async) recvmsg$unix(r12, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000300)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) ioctl$sock_inet6_tcp_SIOCINQ(r13, 0x541b, 0x0) (async) sendmsg$unix(r6, &(0x7f00000006c0)={0x0, 0xfffffffffffffe96, 0x0, 0x0, 0x0, 0x0, 0x20000001}, 0x40000) (async) sendmsg$IPSET_CMD_TYPE(r3, &(0x7f0000002a40)={0x0, 0x0, &(0x7f0000002a00)={&(0x7f00000000c0)=ANY=[@ANYBLOB], 0x14}, 0x1, 0x0, 0x0, 0x20006818}, 0x88) (async) syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), r3) 4.182708061s ago: executing program 2 (id=4138): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) socket$can_bcm(0x1d, 0x2, 0x2) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_mreq(r1, 0x29, 0x1b, &(0x7f0000000080)={@remote}, 0x14) setsockopt$inet6_mreq(r1, 0x29, 0x1b, &(0x7f0000000200)={@dev}, 0x14) setsockopt$inet6_mreq(r1, 0x29, 0x1b, &(0x7f0000000000)={@remote}, 0x14) close(0x4) socket(0x400000000010, 0x3, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000240)={0x26, 'hash\x00', 0x0, 0x0, 'sm3\x00'}, 0x58) accept4(r2, 0x0, 0x0, 0x0) bpf$MAP_UPDATE_BATCH(0x1a, 0x0, 0x0) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001400)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) bpf$MAP_CREATE(0x0, &(0x7f0000001d80)=ANY=[], 0x48) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000280)={&(0x7f0000000040)='kmem_cache_free\x00'}, 0x10) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) bpf$MAP_CREATE(0x0, 0x0, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1b, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x15, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8c}, 0x94) r4 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={0x0, r4}, 0x18) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r5, 0x0) ioctl$sock_inet6_tcp_SIOCOUTQ(r5, 0x5411, 0x0) r6 = socket$key(0xf, 0x3, 0x2) sendmsg$key(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={0x0}}, 0x0) sendmsg$key(r6, &(0x7f00000001c0)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="02030609100000000000004c9e0000000200130002000000da16c167d803f1f805000600200000000a00060000000000ff0000000000000000001ffeff0001000003f1dc7f7c6e7c0200010000000000004000020000000005000500000000000a"], 0x80}}, 0x0) sendmmsg(r6, &(0x7f0000000180), 0x400008a, 0x0) socket$key(0xf, 0x3, 0x2) 4.083709399s ago: executing program 2 (id=4141): r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc2(&(0x7f0000000000), r0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000080), r0) sendmsg$IPVS_CMD_SET_CONFIG(r2, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x64, r3, 0x20, 0x70bd25, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x4}, @IPVS_CMD_ATTR_DAEMON={0x38, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x3}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @empty}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x1}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0xd}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x3}]}, 0x64}, 0x1, 0x0, 0x0, 0x4880}, 0x0) socketpair(0x27, 0x4, 0x8, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$IP_VS_SO_SET_ZERO(r5, 0x0, 0x48f, &(0x7f0000000200)={0x87, @multicast1, 0x4e20, 0x3, 'lblcr\x00', 0x1, 0x6, 0x38}, 0x2c) getsockopt$IP_SET_OP_GET_BYINDEX(r0, 0x1, 0x53, &(0x7f0000000240), &(0x7f0000000280)=0x28) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$net_dm(&(0x7f00000002c0), r6) r7 = bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000440), 0x4) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f00000004c0)={0x10000, 0x0}, 0x8) r9 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000500)={0x1b, 0x0, 0x0, 0x5, 0x0, 0xffffffffffffffff, 0x7, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x0, 0x2}, 0x50) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000580)={0x1, 0xffffffffffffffff}, 0x4) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f00000005c0)={0x1, 0xffffffffffffffff}, 0x4) r12 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000600)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x6, '\x00', 0x0, 0xffffffffffffffff, 0x5, 0x2, 0x5}, 0x50) r13 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000680)={0x2, 0x4, 0x8, 0x1, 0x80, 0x1, 0x101, '\x00', 0x0, 0xffffffffffffffff, 0x2, 0x0, 0x4}, 0x50) r14 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000700)={0x2, 0x4, 0x8, 0x1, 0x80, 0x1, 0x9, '\x00', 0x0, 0xffffffffffffffff, 0x5, 0x5, 0x1}, 0x50) r15 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000780)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x4, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x4, 0x5}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x7, 0x19, &(0x7f0000000300)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, {{0x18, 0x1, 0x1, 0x0, 0x1}}, {}, [@printk={@x, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x87c0}}, @map_idx={0x18, 0x3, 0x5, 0x0, 0x9}], {{}, {}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000400)='syzkaller\x00', 0x1, 0x0, 0x0, 0x40f00, 0x50, '\x00', 0x0, @fallback=0x36, r7, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000480)={0x1, 0xf, 0x0, 0xa}, 0x10, r8, 0xffffffffffffffff, 0x7, &(0x7f0000000800)=[r9, r10, r11, r12, r13, r14, r5, 0xffffffffffffffff, r15, r1], &(0x7f0000000840)=[{0x2, 0x2, 0x8, 0x2}, {0x1, 0x1, 0x2, 0xb}, {0x0, 0x3, 0xfff, 0x9}, {0xdc49, 0x3, 0x0, 0x3}, {0x1, 0x2, 0x1, 0x5}, {0x3, 0x4, 0x1, 0x1}, {0x0, 0x4, 0x1, 0x5}], 0x10, 0x3ff}, 0x94) ioctl$ifreq_SIOCGIFINDEX_wireguard(r5, 0x8933, &(0x7f0000000ac0)={'wg0\x00', 0x0}) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000c00)={0x6, 0xf, &(0x7f0000000980)=@framed={{0x18, 0x0, 0x0, 0x0, 0x276e4fe8, 0x0, 0x0, 0x0, 0x800}, [@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r15}}, @tail_call={{0x18, 0x2, 0x1, 0x0, r15}}, @jmp={0x5, 0x0, 0xd, 0x6, 0x8, 0xfffffffffffffff4, 0x10}, @initr0={0x18, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x6}]}, &(0x7f0000000a00)='syzkaller\x00', 0x26f4, 0x5d, &(0x7f0000000a40)=""/93, 0x0, 0x46, '\x00', r16, 0x25, r7, 0x8, &(0x7f0000000b00)={0x4, 0x5}, 0x8, 0x10, &(0x7f0000000b40)={0x3, 0xd, 0x7}, 0x10, 0x0, 0x0, 0x4, &(0x7f0000000b80)=[r10, r10, 0x1, r9, r14], &(0x7f0000000bc0)=[{0x1, 0x4, 0x8, 0xa}, {0x2, 0x3, 0x3, 0x7}, {0x3, 0x3, 0x7, 0x9}, {0x5, 0x2, 0xc, 0x1}], 0x10, 0xda6}, 0x94) setsockopt$IPT_SO_SET_ADD_COUNTERS(r5, 0x0, 0x41, &(0x7f0000000cc0)={'security\x00', 0x5, [{}, {}, {}, {}, {}]}, 0x78) r17 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000f80)={0x6, 0x19, &(0x7f0000000d40)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x2}, {{0x18, 0x1, 0x1, 0x0, r9}}, {}, [@btf_id={0x18, 0xa, 0x3, 0x0, 0x3}, @kfunc={0x85, 0x0, 0x2, 0x0, 0x3}, @generic={0x8, 0x1, 0x6, 0x8, 0xbbd5}, @map_idx={0x18, 0x0, 0x5, 0x0, 0x9}, @map_val={0x18, 0x3, 0x2, 0x0, r15, 0x0, 0x0, 0x0, 0x1}, @ldst={0x1, 0x3, 0x0, 0x7, 0x7, 0x20, 0x8}, @call={0x85, 0x0, 0x0, 0xca}], {{}, {}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000e40)='GPL\x00', 0x8, 0x10, &(0x7f0000000e80)=""/16, 0x40f00, 0x0, '\x00', r16, 0x25, 0xffffffffffffffff, 0x8, &(0x7f0000000ec0)={0xa, 0x3}, 0x8, 0x10, 0x0, 0x0, 0x0, 0x0, 0x3, &(0x7f0000000f00)=[r10], &(0x7f0000000f40)=[{0x2, 0x3, 0x10, 0x6}, {0x4, 0x5, 0x6}, {0x3, 0x3, 0x9, 0xd}], 0x10, 0x80000000}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000002280)={r17, 0x0, 0x1000, 0xf4, &(0x7f0000001040)="4f8b501149cb4db18a3c46d88c76dc0563246c9dc363e9b73a0872779b53f0a3444af5bc55e93c17f97c7be4cf2f4f4a2c5a701734a5f9d61360c93b35926754aad947cafe774f5534cd351e63683a87bbf12a9177377983593e13e1bfeb19a37b6e52992f7bacd30e15b738b9f31f2c5f0efc0cc6a9f0fc86885baeab07c8b536727172b7a4d131a7d21310de959005e9c3667f045644fb75346a18b9fd5f29d9e5d6fd8794233617c61d14be319c3ca138d7e4734fa54837881fdbf4944648c603b05b4814582ca63c7ad86a5531d1ca4f20c888a28f34006e61caf907f50eaa4a8a5caed1ef0ef3807ad80ac143bde6eeff2a47c64d2943b6b46df2eb919b5c6bb8bcb219199a04e1ad1f23a7066be14d66c131d396d8ffcabff72d3aec2389b800d50410bec5d0aa37bd9c11bc959ce70a3ac5912b94d77e5d0594e72e6a54ef2cb7a90989472b175235774438f6b9c9c938bc2d29297247a2aafeaead958e3620b0fb7eb385e9910992e992af200342e6ce9728389a1a341c0d7427e2c80aeece228b309a3fdc03aa76a6955943e8b32337384fc1c90cb4dafcc4617194d1bf546e1521a52266b502a5f7e68a707e907fc78029a4bead0a3e74776ca99295f77a5c36acda30512d0b3b9edea2237e4a2d0234e66ce6b58dae6322e3a5b3e50669441c8a0280df959366dd1146a96bbe43493cd8ae05ab1c4edcfdaef8dd5e880ea76c0dc886c795db64fda023910d06f2efc612c565309a5595b4c6fc78c63c1a17890ea9e30e34d7dea3229acfde658f0b205ba23d2a139975843411301ead643fb2d26cd0db1fa5e55075c441eabe55f3337bd56f63daadc8065e75878109db12030adeb466b91f2e21dab311bafad4e313e536ee8e5b09a5e5da35f36af9ff3bb8d33f31179619eb3dc3710f237a0503c78407ad9fa63ee0080de9041d307d21af88a4f59642d33e64fee92d86fb51cba68fa4fe607a97c291118a06ded02aae422dfcb2d46542f767969909a09104400526a860b8acdcb6436694d895f0bde5a7051714b9c99d8cf9b3e98f764b856e9a608677b449ad4c643d3b1f8e41bbcadd600ec5ccc8300d0e99ea9a16366c81f71155000fe771d0f944e9ea94be623a031e3f6ca1ab72bfebe598c7c7e705a2b91843aa516fffd1e69830451969c13edc106a96bea5eba337c7f2f81e1dd8ac05fffbaf87908d98d0e21121aca37a070c4d15d95010fad1700cca57d4e8cb0de59ae2de7f25b14c690efe3dc9bad0d8f4d2aa0798c519a5b7a270d2db7534c4cce46817b0749baed36b2dc6ff5032ae0c50cb32c5f2dcb6254103a2cee6693a4fd8b2173d39edd1ec12947764a6ac4c4a5a158d906a0d805440318e48c49fc2d67bc817e7f073b71e4a5fa3f76fb38f709f6585636222824c9ca97c8cb827f63468cf24c894c562ee6b47ba4ecbb99b8f4082ed2db7efa433eeaeb9b00e083cf3821ebccf0b3ca779b72c80929092a32ed141a62d1a220faf9b676735c2c096217005f5f94f0e95a390997dcd312b212dbb98223fe5d6dde32c419c035db2fe178a1615b20d82e9512fa451812dc544b9cd86c24563f48a38f4731f279f93401ad2b24574a5a6af986d859193efff541c8f7ef1125704546f03dddda259c6f1349710d51a313b9edac9d28e803fb4e69639b54336565aec2398ad18845443652ae1bf2f0d73bbe2149ac885aca9f86c452d8d18d05d670eaca0234e72398ac0318048a3e99910f25b8a349c874700579616addfad01dcb17a905a831dfd727b13784d052ca1432b9035a0c7ad0adad77ed95e66669cd22a61d898cdb69f97602a343ee367c47980b6bef58c8adbbd4b69ef35f2221202a43e13c0cd1196d097c9d731f9530ad165764374fc57f2a7689b3984bfbe97dc07498d1f0fc853a0c682b3334d6cec313a1a1f4bd0ddbf27905e2650e3dee31a90833cc9bb87eeaebc550fcd95aab633edce21de08dd8ad9965f5a3f54f1e765919430344d789991b96d5f39d0611229eaeca048f7466397a3019e2dce7a06d47265ccc2f1ac59ecbae691e93cd3c4ee2ace34b95abcff5c50b23fbb103f07442befdff19d6d77b7de07280c0c3e82aad01caadded0943117e92dc88e169033fc794cb5d0f11bc0ccd3cfe2d5d5448afaf1ca85659d350ac7fcbdeaa12f80957686c94d76ead164529af30f09b9f536dbf3cf550fc7463ebe1ba40c2cf4e7444cec1e74c3e51299d94c631071ce395c921ef9db6b83dc52541372f5d955c758d1d0220bf01b57fe8dbd16b5d4d5384f9cb7290486edb82ee2f0604a060045c916529c9d8fbdee6fb1b137de220ee1b8a9447afbd5c4b1991dd8d97b6fbafccc6e389368914ca9e20fa07654f38a3007d09222eae027fa3babe75068278b538ef0c162e3c4c54f962ae2e18b4e0dcfcf026a20a1d431e729da5876c542ea0c84e261e4154e1f94f407623658530b6e6b6dd987570858c6dccd36d851a1f6342d619d4f9888046d0344615a2b1a213a4a11a916759de4fc6a2a206f14264b3ae34d348cac1dbae16b5d6608b0db786b3ec6c0234198318a6838a573c48c1f90662195f6044c336fe231d6203e3ac695e679f59f583d485528133aa7311b41ebf4644b14920d4b6b04038b9853589379fa11d52a2e76d0c905666b42fd1c4e926ae5ba30b5eff0d72e2196445e808247ddd47241e5662d69c32650b486f0533f0c0c9a8087dcff21cb15bb4bf91090581323c26fe33e0077106bc338b250ed08008c696423e76551f6a3d72a853ef65e7720a2b62fe190b7b89c0d47efb92c3f78d73636cc5a531cd2ef3b45501fee5d4b51d48fd4a316bd3e69fd062b977171c784b0dccc2e81f1e273933a7567b318c2dc3b91df1cee4de7336e443712ca9e81707e7535806373b808833ef2e1628a2d8020801247dda0a6768161c9c4dbecadedc4cf4d187fbcf858ab363488743a3d77ec43d4d4e06477cb6faeae54cafa926fc6bb7049590921fbd32d8d165fccd6f63ed08a3f424622f0c1764982d938f080db12a11948351ba0697a5cb701756e5eb50f408d262f9539d592614367c694c9e2f705ca88c7430f8971265539afd12af665ec0ba94175ee98a1154ee7f939f355ce6ffe860ef4dd72791d87892c94c7b57dfb019f8434f70411309584bf64d9cd3045ddd0007979c3db79fe9ad4e8cd52220c810bfc2aabc8b6a50b1cbabb73f53d11114d08bceed05209a5d7795259a79bbcf418cdadd9c40b51f0bb3209943f1f56945c7468ca14e99244e29990eb91105967678d4e007f5881ecede77c8f7445ce31ecd1a808acd9c4d523475a87651bc7a5ef5c7a3f210cd83acca19bcab784cbd941e3b8e9259ab8df8f150c3b763c595535b323425ae753c851331a1b72daee3510bda399098241b1ee07ffb0a42cbae293b06dc1243e066c476796f454c95b73ed08617b6a03cd37e94e309a593b344e2fa0da7db6ca8c68312e141c3f98732766ad54f186fc09b8c8e20b0f1d743530b79b6560207f855c29f4125ef86b5debd8bdb5cb3b6291b2ed6283e71ba29673479326ca2e5adbcd2da6d1834dd9fefba2d711d5e7c1c745633fee8dd3d86b21886d74802782a2e6bdd7f5bbcddb7322461f6174f4494a485f2262bc5a6f00f75c1510761204a2be845b60c7226d7aac743a7c8955df68703a2939411f48f8e4ff2b3ba51ec8713656eacc0b54314a5997c1c01d69a6649b438f7dc76c9691aa172927273d5cad837e00957aa0abbcbcd8edbbb6815dc8b6427ec34a9b9522cbd5b724250ad3472dae9be5c47ff1452a9f9c0918f768c67a9674df833839ae4bd864d3c11a085898227badf755c9849d57419cbdab33e0dc35182442fcb9c7c57d999e2667c07ed2e1b962e621ce9d8d65d34bdeea7d3686d18852d76e48f8841b7df78b5dacb5f979722c76ee217d1f3a8aa2b03b44a0057cfec1d7f929e5a84d28b5aa86fd10af3e9d23344c43d6f1208d4af6f9351a3c13529fab29b8dd02b68b06758624eecf07c3fc2fec904cd107c58ee4518bf33d836d28b2f93efe8698aed635300aea852af5ad3e8e306a35edac0a1bf7187e48afa944739711255327359b8428bb971fdd5d13bce6b32aee2e8ff34c10cf91902d0efc369afa03244a16fe3b0f033ab69dcf0e379069d71f9d8dcfc10ecfa86a74f9135ad04797248719cb3a15df93831c324f9707f412e03f914df95bd2d7e7bd3ea71433af2eba407a83f794fefc321f4f23a72ddafee873113297a8b9725cdae16a1702eca1313dd3a4600ce0e97dfe688cb790b9bcd59c7ce9519f2ad49f47ba1c85b2226f9cb01508598ac7bce133811af1606c515c45a22a3c9680a5d99139ac40b881749e9c95fd6b767e91342025a198168794b5c06c5631e827d7cc219bab07d2831384743e8fad3f3d5920d454e0669cf82a915dba84cdf6f7404dc519737116f951f2a3623c21aeaa0f2c10a555024f1a437b6298aa9fdd6303f64240096e1be7ba86f34ef60540b37e15fb9dd61e941596876eb6a0540a777364dfd7101d80894ec63ad922ee997005ff5530f4778c1aa13ef6473734d08a6ae7029a09ac2da9ae3a1956b87b56095645e842b947bfe05bf7a80c2105456da54ea0d299cf3c5096d4afa7463d6affe720f8c0a5ea08581740cd46ec9bc8c36b8ff2ddfbc4e13f05853a603df359f7c3070ae5b1625f36bfb6ee5cc2b39d6ba3f1f967d407bb3831cee5e3c891fd15539782f41fde0f460eea71d874d7e8ad0562cc82fd0fd10f0ba023b7e7a3ee9e21514e5e0299295f925e1f26eecaf1df42c62fa62cd990729077ca13550bbb07a67eeae85dcfc4edfa828fee692566c8d6127eb0507ebb1c2cf9f6791e30c4bc321bba3e6ff60e58c8b24c8223479143e0f1831450df4d829c3f2644fbd05ef4fcae6a7d059e4dfacf3c6244e529f707c8b59899a49b98b17dc86491cb5fe077aa38342646e06f5897dcba1ca2c93ae7998354d4794441c314961ea64730188014430daf1a2a29037034526f78550d136a5c1a0c1b8631af8c9e5a9871027b6c5687c2427503c9042f3516886989c631df7035b1f9e5017df10031725467b289adb3412d0f01e2ba20b4e0287b715b7f723e88fd1b22bab0774cbe163871c8c22af3db593a9db98de4982d1d1986dec33d691b5ae3c4bb98fc526327807982beb076574a979d45e1dee629e44ffb9c60e147a897290641498c87287d49dfa3f80d0638104866f65fd1fd564cbaf658ac7853a75546428911ed4ce0dc3f5274ea74c556737aedc77823f9e9ab02f2d79f32c1b7ddfe2c97affd62aeae6683c40633d95aed9bf3b5dc2ce0510f21a8b2f46dec784d9452d829df8b2bb021f37cb90d85113af31d69d84a835cbefa51a78be4f41a1dccaaa377c9ab0d854e01c50302bf9d1e83a790d2de72d581cd518cd6436911cbfe92ad673e489bdf03bf832c87b7c2ff09b9d56d65990c6287a9c567d85e95daec4b62898ec05c2655e66132906b0f2ee7237ac1f14493aab2014524521dc1c71e2bdccf132f085b00737e91da485ecccd32fb7b5fdabf35eb1de526a0b9ee3b5252d587b0c4c9e2764d10e008643bc865385c5023fe6f9d55227cb95ac98935102976020005a54df0998489fdb6b1b9fe6f921b700c63df972131c7b0a46b835d0b6067ffee0d4eb6ce0a7e1e2daa059dc30a92327d4107c3cd5caa18a289ab6c571fe2c613597f4ff654e500181ae84392bb90ec2c1d4f07b3476dba80a9620a40aff61770c", &(0x7f0000002040)=""/244, 0xffffffc0, 0x0, 0x56, 0xbb, &(0x7f0000002140)="2a43beff2af45198db89b5941ba1c590eab4314a0d1bdc9271e878f68bc6dfb3543f8553e983ea72cafec9c4c334b7cea03744f53929029d9aae60dbff5055ed2cde12fd47b5309db9eba772aa518d2f7605bed14ad2", &(0x7f00000021c0)="c146036cad72ffbf439a771e4d6b54e121ffa48a1dea0ec7b915d139d9da782e9e1d6ed3d350cf63c90ed4563c1bc832e816156eb1fe8d3ace214a81f1df497ad2612c3c2d9a75aaa2d12ced4cf6cc1e30911957eba088e7dd333e44919dff23e07ef0320a2fd4f4e19d25d4a432eebb5c6b4d31bef0c97195afa9ad777c559b050b2d21262b6e1d02c6004659892dd48b77d613accb4a8dddcf84ca18cadbc331104145fd1b8c3f0012bcb3b56e87965e22d6f4c53ca92c542da5", 0x3, 0x0, 0x10001}, 0x50) socket$kcm(0x29, 0x5, 0x0) ioctl$BTRFS_IOC_QGROUP_CREATE(r15, 0x4010942a, &(0x7f0000002300)={0x1, 0xcb0}) syz_genetlink_get_family_id$tipc(&(0x7f0000002340), r2) ioctl$sock_ifreq(r4, 0x894a, &(0x7f00000023c0)={'veth1_to_hsr\x00', @ifru_settings={0xffffffff, 0x1, @fr=&(0x7f0000002380)={0x401, 0x6, 0x6, 0xffff, 0x5, 0xff, 0xf7c7}}}) 3.988382657s ago: executing program 2 (id=4143): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000180), r0) r2 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) sendmmsg$sock(r2, &(0x7f0000000cc0)=[{{&(0x7f0000000100)=@l2tp={0x2, 0x0, @broadcast, 0x3}, 0x80, 0x0}}, {{&(0x7f0000000700)=@in6={0xa, 0x4e20, 0x7, @dev={0xfe, 0x80, '\x00', 0x18}, 0x60}, 0x80, 0x0}}], 0x2, 0x48094) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='blkio.bfq.io_queued\x00', 0x275a, 0x0) write$cgroup_int(r3, &(0x7f0000000000), 0xffffff6a) sendfile(r2, r3, 0x0, 0xffffffff000) socket$kcm(0x29, 0x2, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0xf, &(0x7f0000000040)=0x80000004, 0x4) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x33, 0x0, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x4e20, 0x1, @empty, 0xfffffffc}, 0x1c) syz_open_procfs$namespace(0x0, 0x0) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nbd(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NBD_CMD_CONNECT(r4, &(0x7f0000001ac0)={0x0, 0x0, &(0x7f0000001a80)={&(0x7f0000000440)={0x14, r5, 0x0, 0x70bd27, 0xfffffffa}, 0x14}}, 0x8084) unshare(0x62040200) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x7, 0x0, 0x0) r6 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) connect$bt_l2cap(r6, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) r7 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) ioctl$sock_bt_hidp_HIDPCONNADD(r7, 0x400448c8, &(0x7f0000000340)={r6, r6, 0x8, 0x0, 0x0, 0x82, 0x4a, 0x15c2, 0x5886, 0x801, 0x0, 0x8, 'syz1\x00'}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.numa_stat\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r8, 0x0) r9 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x1c1341, 0x0) ioctl$TUNSETIFF(r9, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) sendmsg$IEEE802154_ADD_IFACE(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000040)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="01022dbd7000ffdbdf252100000009081f0070687933000000000a0001a1f9330000000500200001000000d709d4ecae24d65c73b949057a28e2c5a1ce0b8f863255aad76b493733caf8f9496fd9c6ed911d7c7747fe403b8595c569ef80732a736159e4"], 0x34}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) 2.594047716s ago: executing program 1 (id=4157): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x16, 0x3, &(0x7f0000000040)=ANY=[@ANYBLOB="720ac4ff00000000711090000000000095"], &(0x7f0000000480)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x4}, 0x94) r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x20}) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) r1 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r1, &(0x7f0000000440)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x1, @remote}, 0xa}}, 0x26) ioctl$F2FS_IOC_ABORT_ATOMIC_WRITE(0xffffffffffffffff, 0xf505, 0x0) r2 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0x11, 0x10, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bf8100000000000007080000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r2, @ANYBLOB="0000000002060000b70500000800000085000000a50000f59400000000000000"], &(0x7f0000000300)='GPL\x00', 0x5}, 0x94) r3 = socket$kcm(0x2, 0x1000000000000002, 0x0) sendmsg$inet(r3, &(0x7f0000000b40)={&(0x7f0000000080)={0x2, 0x4e20, @remote}, 0x10, &(0x7f00000000c0)=[{0x0, 0x4f}], 0x1, &(0x7f0000000180)=[@ip_pktinfo={{0x2f, 0x0, 0x7, {0x0, @dev, @loopback}}}], 0x30}, 0x0) r4 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8916, &(0x7f0000000040)={'batadv_slave_1\x00', {0x2, 0x0, @loopback=0x7f000000}}) ioctl$sock_inet_SIOCSIFADDR(r4, 0x891c, &(0x7f0000000540)={'batadv_slave_1\x00', {0x2, 0xfffe, @empty}}) r5 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(r5, 0x0, 0x2a, &(0x7f0000000180)={0x2, {{0x2, 0x0, @multicast1}}}, 0x88) setsockopt$inet_group_source_req(r5, 0x0, 0x2f, &(0x7f0000000240)={0x2, {{0x2, 0x0, @multicast2}}, {{0x2, 0x0, @empty}}}, 0x108) r6 = socket$inet6(0xa, 0x2, 0x0) sendmmsg$inet6(r6, &(0x7f0000000900)=[{{&(0x7f0000000100)={0xa, 0x4e21, 0x0, @mcast1, 0x10}, 0x1c, 0x0}}], 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r5, 0x0, 0x40, &(0x7f00000006c0)=@nat={'nat\x00', 0x1b, 0x5, 0x390, 0x180, 0x228, 0xffffffff, 0x228, 0x0, 0x2f8, 0x2f8, 0xffffffff, 0x2f8, 0x2f8, 0x5, &(0x7f0000000080), {[{{@uncond, 0x0, 0x70, 0xb8}, @unspec=@SNAT1={0x48, 'SNAT\x00', 0x1, {0x8, @ipv4=@local, @ipv4=@dev={0xac, 0x14, 0x14, 0xe}, @port=0x4e23, @port=0x4e22}}}, {{@ip={@local, @dev={0xac, 0x14, 0x14, 0x21}, 0xff000000, 0x0, '\x00', 'pimreg\x00', {}, {0xff}, 0x1d, 0x2, 0x6}, 0x0, 0x90, 0xc8, 0x0, {}, [@common=@socket0={{0x20}}]}, @NETMAP={0x38, 'NETMAP\x00', 0x0, {0x1, {0x1c, @broadcast, @rand_addr=0x64010100, @icmp_id=0x64, @icmp_id=0x65}}}}, {{@uncond, 0x0, 0x70, 0xa8}, @SNAT0={0x38, 'SNAT\x00', 0x0, {0x1, {0x1, @loopback, @loopback, @icmp_id=0x65, @port=0x4e20}}}}, {{@ip={@broadcast, @rand_addr=0x64010100, 0xffffff00, 0xff000000, 'veth1_to_batadv\x00', 'veth1_vlan\x00', {0xff}, {0xff}, 0x4, 0x2, 0x6c}, 0x0, 0x98, 0xd0, 0x0, {}, [@common=@ttl={{0x28}, {0x2, 0xfa}}]}, @SNAT0={0x38, 'SNAT\x00', 0x0, {0x1, {0x10, @dev={0xac, 0x14, 0x14, 0x28}, @multicast1, @icmp_id=0x64, @icmp_id=0x65}}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x3f0) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$wireguard(&(0x7f00000005c0), r7) sendmsg$WG_CMD_SET_DEVICE(r7, &(0x7f0000001000)={0x0, 0x0, &(0x7f0000000fc0)={&(0x7f0000000000)=ANY=[@ANYBLOB="ec000000", @ANYRES16=r8, @ANYBLOB="01000000000000000000010000000800050001000000140002007767310000000000000000000000000024000300a0cb879a47f5bc644c0e693fa6d031c74a1553b6e901b9ff2f518c78042fb5420800050000000000900008808c00008024000100975c9d81c983c8209ee781254b899f8ed925ae9f0923c23c62f53c57cdbf691c640009801c000080060001000200000008000200ffffffff05000300030000001c000080060001000200000008000200ac141427050003"], 0xec}, 0x1, 0x0, 0x0, 0x4084}, 0x840) r9 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r10 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCGARP(r10, 0x8954, &(0x7f0000000080)={{0x2, 0x4e23, @private=0xa010100}, {0x306, @broadcast}, 0x2e, {0x2, 0x4e21, @empty}, 'ip6gretap0\x00'}) r11 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000580)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000540)={&(0x7f0000000bc0)=ANY=[@ANYBLOB="3dcd6dbea6749bdd076f4c1d17d54f699f5d7c", @ANYRES16=r11, @ANYBLOB="000226bd7000fedbdf25030000000c00020000000000000000000c0008000e0e000000000000080001000000000008000100000000000c00050008000000000000000c000500f9a89fe3fe6c9515"], 0x54}, 0x1, 0x0, 0x0, 0x48044}, 0x4000000) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(r3, 0x84, 0x71, &(0x7f0000000ac0)={0x0, 0x1}, &(0x7f0000000b00)=0x8) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r6, 0x84, 0x22, &(0x7f0000000b80)={0xff, 0x0, 0xffffff40, 0x0, r12}, 0x10) 2.468320951s ago: executing program 1 (id=4160): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) sendmsg$unix(r0, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000740)=[@rights={{0x14, 0x1, 0x1, [r0]}}], 0x18}, 0x0) close(0x3) close(0x4) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x3, 0x3, &(0x7f0000000000)=ANY=[@ANYBLOB="6a0ac4ff000000007110b9000000000095"], &(0x7f0000000480)='GPL\x00', 0x0, 0x0, 0x0, 0x41100}, 0x94) 2.290402388s ago: executing program 1 (id=4163): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f0000000280)=ANY=[@ANYBLOB="1800000000000000000000004b64ffec850000006d000000850000000e00000095"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) r1 = socket(0x400000000010, 0x3, 0x0) setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r1, 0x6, 0x21, &(0x7f00000000c0)="d82c15ad7b3e30e61690164189d53871", 0x10) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001500)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r3, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x0) recvmsg$unix(r2, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), 0x100}, 0x0) write(r1, &(0x7f0000000040)="3a03000018002551075c0165ff0ffc02802000030004000500e1000c0400070080000900", 0x33a) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000180)='sched_switch\x00', r0, 0x0, 0xff}, 0x18) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000680)={{0x14}, [@NFT_MSG_NEWFLOWTABLE={0x40, 0x16, 0xa, 0x5, 0x0, 0x0, {0x2}, [@NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_FLOWTABLE_HOOK={0x14, 0x3, 0x0, 0x1, [@NFTA_FLOWTABLE_HOOK_NUM={0x8}, @NFTA_FLOWTABLE_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x3}]}, @NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz0\x00'}]}], {0x14}}, 0x68}}, 0x800) sendmsg$NFT_BATCH(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000440)={{0x14}, [@NFT_MSG_NEWFLOWTABLE={0x48, 0x16, 0xa, 0x801, 0x0, 0x0, {0x2}, [@NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz0\x00'}, @NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_FLOWTABLE_HOOK={0x1c, 0x3, 0x0, 0x1, [@NFTA_FLOWTABLE_HOOK_DEVS={0x18, 0x3, 0x0, 0x1, [{0x14, 0x1, 'geneve0\x00'}]}]}]}], {0x14}}, 0x70}}, 0x24040884) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000600)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01020000000000000000010000000900010073797a300000000058000000160a01000000000000000000010000000900010073797a30000000000900020073797a31000000002c0003800800014000000000180003801400010076657468315f746f5f626f6e6400000008000240000000006c000000160a0101000b000000000000010000000900020073797a30000000000900010073797a30000000004000038008000140000000002c0003801400010067656e657665300000000000000000001400010076657468315f746f5f626f6e64000000080002"], 0x10c}}, 0x0) bpf$MAP_CREATE(0x600000000000000, &(0x7f0000000580)=@base={0xf, 0x4, 0x4, 0x20002, 0x0, 0x1, 0xfffffffd, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x4}, 0x48) 1.82673443s ago: executing program 3 (id=4164): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000300)=@base={0xa, 0x4, 0x8, 0xc}, 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, &(0x7f0000000280)=ANY=[@ANYBLOB="18010000000000000000000001080021850000006d00000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='kfree\x00', r1}, 0x10) (async) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r2, 0x10e, 0x1, &(0x7f0000000240)=0xb, 0x4) (async) r3 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r3, &(0x7f0000000140), 0x10) (async) sendmmsg$sock(r3, &(0x7f0000003180)=[{{&(0x7f0000000240)=@qipcrtr={0x1d, 0x4, 0x3fff}, 0x80, &(0x7f0000000400)=[{&(0x7f00000002c0)="024468f75872dc275c4a865167ce141180f86d6d2d2b667592a3c33936462143e78071d6c161acbb6e42171be6f3bb2c71676866c351e658a3e643566881df0577a462feffaafa974e3e86985e3ae7dbd8b6bc88af3374be083ced9a2b1f3b847103a9ad492dabf2f341cf7c9d27d81972b94be151e7a3c9487c087f8a25", 0x7e}, {&(0x7f0000000340)="da653e6368ca3086947a7cd9f675fec207fa0522eb427678a26306d4d58e3174157055bad9d94baf2b8a476ed0798d84173e4d6a8c03e3ad87f36f69e2d254f2fc17dc5260b177829e93e8de0efe7be1837255949efb5d662b4b", 0x5a}], 0x2}}], 0x1, 0x200000c1) (async) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000000)={'sit0\x00', &(0x7f0000000380)={'gretap0\x00', 0x0, 0x80, 0x8, 0xfff, 0x5, {{0x9, 0x4, 0x1, 0x1c, 0x24, 0x68, 0x0, 0x9, 0x29, 0x0, @local, @dev={0xac, 0x14, 0x14, 0x39}, {[@noop, @ssrr={0x89, 0xb, 0x13, [@initdev={0xac, 0x1e, 0x0, 0x0}, @loopback]}, @end]}}}}}) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r4, 0x8933, &(0x7f0000000200)={'batadv_slave_1\x00', 0x0}) sendmsg$nl_route(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=@dellinkprop={0x98, 0x6d, 0x1, 0x70bd2a, 0x25dfdbfb, {0x0, 0x0, 0x0, r5, 0x102, 0x8040}, [@IFLA_BROADCAST={0xa, 0x2, @broadcast}, @IFLA_ALT_IFNAME={0x14, 0x35, 'macvlan0\x00'}, @IFLA_VFINFO_LIST={0x58, 0x16, 0x0, 0x1, [{0x54, 0x1, 0x0, 0x1, [@IFLA_VF_TRUST={0xc, 0x9, {0xc72, 0x2}}, @IFLA_VF_SPOOFCHK={0xc, 0x4, {0x0, 0x100}}, @IFLA_VF_VLAN_LIST={0x2c, 0xc, 0x0, 0x1, [{0x14, 0x1, {0xf27b, 0xb8b, 0xa7b4, 0x8100}}, {0x14, 0x1, {0xff, 0x423, 0x7f, 0x88a8}}]}, @IFLA_VF_RSS_QUERY_EN={0xc, 0x7, {0x0, 0x7330}}]}]}]}, 0x98}, 0x1, 0x0, 0x0, 0x4004800}, 0x4810) 1.762017116s ago: executing program 1 (id=4165): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={0x0}, 0x1, 0x0, 0x0, 0x4000811}, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r1, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000002d80)={&(0x7f00000000c0)={0x5c, 0x3, 0x1, 0x301, 0x0, 0x0, {0xa}, [@CTA_FILTER={0xc, 0x19, 0x0, 0x1, [@CTA_FILTER_REPLY_FLAGS={0x8, 0x2, 0xc2d}]}, @CTA_TUPLE_REPLY={0x3c, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @loopback}, {0x14, 0x4, @dev={0xfe, 0x80, '\x00', 0x2b}}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x11}}]}]}, 0x5c}, 0x1, 0x0, 0x0, 0x4000004}, 0x44080) sendmsg$nl_route_sched(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000980)=@newtaction={0x64, 0x30, 0x871a15abc695f91d, 0x800000, 0x80000, {}, [{0x50, 0x1, [@m_vlan={0x4c, 0x1, 0x0, 0x0, {{0x9}, {0x20, 0x2, 0x0, 0x1, [@TCA_VLAN_PARMS={0x1c, 0x2, {{0x3468802, 0x40, 0x1, 0x3, 0x80000000}, 0x4}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x1, 0x3}}}}]}]}, 0x64}, 0x1, 0x0, 0x0, 0x4000004}, 0x0) sendmmsg(r0, &(0x7f00000002c0), 0x40000000000009f, 0x0) r2 = socket$packet(0x11, 0x2, 0x300) r3 = syz_init_net_socket$bt_rfcomm(0x1f, 0x3, 0x3) bind$bt_rfcomm(r3, &(0x7f0000000740)={0x1f, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0xc}, 0xa) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000080)={'veth0_to_team\x00', 0x0}) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r5, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)=@newqdisc={0x60, 0x24, 0x4ee4e6a52ff56541, 0x70bd25, 0x0, {0x0, 0x0, 0x0, r4, {}, {0xffff, 0xffff}, {0x0, 0x7}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x34, 0x2, [@TCA_TBF_PBURST={0x8, 0x7, 0x162f}, @TCA_TBF_PARMS={0x28, 0x1, {{0x1, 0xe0a2ff6baa7cc2d2}, {0xde, 0x0, 0x0, 0x0, 0x0, 0x100}, 0xffffffff}}]}}]}, 0x60}}, 0x4800) 1.675192201s ago: executing program 3 (id=4166): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="050000000a0000004200000040000000c0000000", @ANYRES32=0x1, @ANYBLOB="0100"/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000010000000000400f4ffffffffffffff0000000000322f"], 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080), &(0x7f0000000080), 0x1003, r0}, 0x38) r1 = socket(0x10, 0x2, 0x0) write(r1, &(0x7f0000000040)="1c0000001a009b8a140000003b9b301f00"/28, 0x1c) r2 = syz_init_net_socket$rose(0xb, 0x5, 0x0) recvmmsg(r2, &(0x7f00000037c0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb00}}], 0x1, 0x0, 0x0) recvmmsg(r1, &(0x7f0000002ec0), 0x400000000000ec0, 0x2, &(0x7f00000001c0)={0x77359400}) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r4 = socket(0x1d, 0x2, 0x6) ppoll(&(0x7f0000000380)=[{r4, 0x100}], 0x1, 0x0, 0x0, 0x0) r5 = socket$inet6(0xa, 0x3, 0x88) setsockopt$inet6_IPV6_XFRM_POLICY(r5, 0x29, 0x23, &(0x7f0000000980)={{{@in6=@initdev={0xfe, 0x88, '\x00', 0x40, 0x0}, @in6=@empty, 0x4e22, 0x0, 0x0, 0x3, 0x2}, {0x0, 0x200000004, 0x40000000007, 0x20000a0da, 0x100000000, 0x4, 0x200000003, 0x9}, {0x5}, 0x1, 0x0, 0x1, 0x0, 0x6, 0x3}, {{@in=@empty, 0x0, 0x6c}, 0xa, @in=@empty, 0x3502, 0x1, 0x8, 0x0, 0x9075, 0x800, 0x2}}, 0xe8) connect$inet6(r5, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x4}}}, 0x1c) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r6 = socket(0x400000000010, 0x3, 0x0) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000001c0)={0x18, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000000000000009500000000000000", @ANYBLOB="074d5620b37b65484da0d01cb663039bcc490ba39369a6eb4748284d4f592ab97d9fd7be5645e3b5a92008c6c1e1d92ad8abd3fdc8b27b1d28d9c22200a82a8b71a6d41bf7b602ee7f453e3edd454cf28fe82186a2a6ea3c69a265c75c96b8de9037985438dd9f9b8ae0d958143bbdfa7b14642a3a03dd894f60518f074b7542e79717d5407754dd8d5da0ca0401bb7260b128506d194ee757b1891223b2633c054ce697b4682366ae6b830b1bc698bfc5f97a6202c92365b2282e72cb7bd4906b586ff67d012010ea5624b246c8beba3ec0492841fd63d3194365beb39a0d68057e0788afee5388610f0643c8f51a0f5b7559728064f0c6cb", @ANYRESHEX=r5, @ANYRES64, @ANYRES8, @ANYRESHEX], &(0x7f0000000100)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x7}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000280)={&(0x7f0000000040)='contention_end\x00', r9}, 0x10) sendmsg$nl_generic(r8, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000004c0)=ANY=[@ANYBLOB="140000002c00ef5f"], 0x14}, 0x1, 0x0, 0x0, 0x20008081}, 0x800) sendmsg$IPCTNL_MSG_CT_NEW(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="bc0000000001010400000000000000000a0000003c0001802c000180140003000000000000000000000000000000000014000400ff0100000000000000001200000000010c0002800400010000000000240002801400018008000100ac14142f08000200ac1414aa0c000280050001000000000008000740000000004000068014000400fe8800000000000000000000000000011400050000000000000000000000ffffac1e000114000500ff020000000000000000000000000001"], 0xbc}}, 0x0) r10 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r12 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r12, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000080)=ANY=[@ANYBLOB="2c00000015000504e1ff4319918e00352d"], 0x2c}}, 0x60040050) sendmsg$nl_route_sched(r6, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x800, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r11, {0x0, 0xfff1}, {0xffff}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x0, 0x87f}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x8080}, 0x40020) ioctl$TUNGETVNETBE(r3, 0x800454df, &(0x7f00000000c0)=0x1) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000002c0)=@gettclass={0x24, 0x2a, 0x400, 0x70bd28, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, {0x0, 0x9}, {0xfff3, 0xfffd}, {0xd, 0x6}}}, 0x24}, 0x1, 0x0, 0x0, 0x40}, 0x20008000) socket$nl_route(0x10, 0x3, 0x0) 1.650069115s ago: executing program 1 (id=4167): r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x3, 0xc, &(0x7f0000000000)=ANY=[@ANYBLOB="180000000000000000000000000000008500000022000000180100002020702500000000002020207b0af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007200000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x11, 0xb, &(0x7f0000000840)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007100000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x9, '\x00', 0x0, @fallback=0xf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000080)='sched_switch\x00', r1}, 0x10) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r0, 0x0, 0xe40, 0xe40, &(0x7f00000002c0)='\x00\x00\x00\x00\x00\x00\x00\x00', &(0x7f0000000300)=""/8, 0xa00, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) ioctl$FS_IOC_GET_ENCRYPTION_POLICY(0xffffffffffffffff, 0x400c6615, &(0x7f0000000140)={0x0, @aes128, 0x0, @desc3}) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETOFFLOAD(r2, 0x5421, 0x110e22fff7) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_audit(0x10, 0x3, 0x9) sendmsg$IPCTNL_MSG_CT_NEW(r4, &(0x7f0000000480)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000440)={&(0x7f0000000580)={0xa0, 0x0, 0x1, 0x201, 0x0, 0x0, {0x6, 0x0, 0x7}, [@CTA_TUPLE_REPLY={0xc, 0x2, 0x0, 0x1, [@CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x3}]}, @CTA_SEQ_ADJ_ORIG={0x14, 0xf, 0x0, 0x1, [@CTA_SEQADJ_OFFSET_AFTER={0x8, 0x3, 0x1, 0x0, 0xb6fd}, @CTA_SEQADJ_OFFSET_BEFORE={0x8, 0x2, 0x1, 0x0, 0x8}]}, @CTA_PROTOINFO={0x20, 0x4, 0x0, 0x1, @CTA_PROTOINFO_TCP={0x1c, 0x1, 0x0, 0x1, [@CTA_PROTOINFO_TCP_FLAGS_REPLY={0x6, 0x5, {0x5, 0x3}}, @CTA_PROTOINFO_TCP_FLAGS_ORIGINAL={0x6, 0x4, {0xe, 0x6}}, @CTA_PROTOINFO_TCP_FLAGS_ORIGINAL={0x6, 0x4, {0x0, 0x6}}]}}, @CTA_TIMEOUT={0x8, 0x7, 0x1, 0x0, 0x4}, @CTA_ID={0x8}, @CTA_ID={0x8}, @CTA_LABELS={0x28, 0x16, 0x1, 0x0, [0x5, 0x8001, 0xffff, 0xa, 0x4, 0x3, 0x1, 0x0, 0x10000]}, @CTA_LABELS={0xc, 0x16, 0x1, 0x0, [0x6, 0x9]}]}, 0xa0}, 0x1, 0x0, 0x0, 0x4001}, 0x40000) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000000)='kfree\x00'}, 0x10) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f00000001c0)={'sit0\x00', 0x0}) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000140), r3) sendmsg$IPVS_CMD_NEW_DAEMON(r7, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000080)={0x4c, r8, 0x511, 0x400000, 0x0, {}, [@IPVS_CMD_ATTR_DAEMON={0x38, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0xd769}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'veth0_to_bond\x00'}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x2}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast2}]}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40850}, 0x0) r9 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cpuacct.usage_percpu_sys\x00', 0x275a, 0x0) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000180)={@map=r9, 0x2f, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) sendmsg$nl_route_sched(r5, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=@newqdisc={0x34, 0x24, 0x4ee4e6a52ff56541, 0x200, 0x25dfdbfb, {0x0, 0x0, 0x0, r6, {0x0, 0xffe0}, {0xffff, 0xb}, {0x0, 0x3}}, [@TCA_RATE={0x6, 0x5, {0x40, 0x7}}, @TCA_RATE={0x6}]}, 0x34}, 0x1, 0x0, 0x0, 0x8090}, 0x4) r10 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$TUNSETIFF(r10, 0x400454ca, &(0x7f0000000080)={'pimreg0\x00', 0x7c2}) ioctl$TUNATTACHFILTER(r10, 0x401054d5, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x4, 0x7}]}) openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0xa8001, 0x0) ioctl$TUNSETQUEUE(r10, 0x400454d9, &(0x7f00000000c0)={'veth0_to_batadv\x00', 0x400}) ioctl$TUNSETQUEUE(r10, 0x400454d9, &(0x7f0000000140)={'veth0_macvtap\x00', 0x200}) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000280)=ANY=[@ANYBLOB="4c00000000010104000000000000000002000000240001801400018008000100e000000108000200e00000010c0002800500010000000000140016"], 0x4c}}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1900000004000000040000006637cf2c00000000", @ANYRES32, @ANYBLOB="0000000000000000001110000000000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) 1.396466132s ago: executing program 2 (id=4169): r0 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000001c0)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x8001, '\x00', 0x0, 0xffffffffffffffff, 0x1, 0x0, 0x4}, 0x50) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000340)=@base={0x2, 0x4, 0x1, 0xbf24}, 0x50) mmap(&(0x7f0000fa2000/0x3000)=nil, 0x3000, 0x3, 0x13, r1, 0x0) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x18, 0x3, &(0x7f0000000d00)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000000)='syzkaller\x00'}, 0x94) r3 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000300)={&(0x7f00000002c0)='rpc_xdr_alignment\x00', r2, 0x0, 0x9}, 0x18) r4 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r3}, 0x8) close(r4) bpf$PROG_LOAD(0x5, &(0x7f0000000400)={0x5, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18080000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000700000095"], &(0x7f00000000c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x5, r4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmsg$kcm(r4, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000580)="d8001c00180081064e81f782db44fd56170d12a0b9b545c7", 0x18}], 0x1}, 0x40040) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000003c0)={0x1e, 0x9, &(0x7f00000005c0)=ANY=[@ANYBLOB="18230000", @ANYRES32=r0, @ANYBLOB="0000000004000000185100000f0000000000000000181200000000008230ef9a659692a8e291c4da64e08b9cdf28edb4922e10849c6d50ed047223699d77bf3944734733765aef0aad916c5c584639b50d6b0d24a6241ee3f70e4edba86dabe982b53cb2b516b3ba769da6cc7be62aafbe95d603b3121aa2c5b16450e210f465d8466118b870dfb622a1f1403133b50fb78776904efd8fdef2f67661e20da79420d6ec83ca54163941099138960911abf1bc3d6928549edc267647fde7ea85c8291a7090", @ANYRES32=r1, @ANYBLOB="0000000000000000b703000000000000850000000c000000b700000000000000"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x24, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x1fc}, 0x94) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=@deltaction={0x54, 0x18, 0x1, 0x70bd29, 0x25dfdc00, {0xa}, [@TCA_ACT_TAB={0x40, 0x1, [{0xc, 0x80, 0x0, 0x0, @TCA_ACT_INDEX={0x8}}, {0x14, 0x5, 0x0, 0x0, @TCA_ACT_KIND={0xf, 0x1, 'tunnel_key\x00'}}, {0x10, 0x9, 0x0, 0x0, @TCA_ACT_KIND={0xa, 0x1, 'pedit\x00'}}, {0xc, 0x6, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'ife\x00'}}]}]}, 0x54}, 0x1, 0x0, 0x0, 0x4000}, 0x0) 1.376489107s ago: executing program 3 (id=4170): r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f00000035c0)="5c00000013006bcd9e3fe3dc4e48aa31086b8703340000001f00000000010000040014000d000a00140000009ee517d34460bc08eab556a705251e6182949a3651f60a84c9f5d1938837e786a6d0bdd7fcf50e4509c5bb5a00f69853", 0x5c}], 0x1, 0x0, 0x0, 0x1f000801}, 0x240000c0) sendto$inet(0xffffffffffffffff, &(0x7f0000000180)="0fc8e6c2d3f20c8352b9ece7720f1ddbef8f583b2d5c039b32a8cd0e67847297aea1dab1cd7731f80ce5486ff8beb9014c01f3bd538c18aea909c65f34016016994c3e6d2ee3bf4ab51412b681a4feedf542898d34c62e8d03559e0021159ad58a1c9fca28271aa873474a951ebc18b87b3f7dc5f96f2c6908ebb7e8a7e89ba373e5fe7f776df08005d9b9b41e832f6ab8c4e4a983dd5d170656e8c09e3d6294562ecf2645fdf1030a49b8611f4912989bd45d2943f6c80e037c8f", 0xbb, 0x8001, &(0x7f0000000040)={0x2, 0xf, @local}, 0x10) 1.148459469s ago: executing program 5 (id=4172): r0 = socket(0xa, 0x5, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000140)="2c385aa3d4", 0x5) r2 = accept4(r1, 0x0, 0x0, 0x0) sendmsg$alg(r2, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000180)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18, 0x40010}, 0x14000012) sendmsg$nl_route_sched_retired(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000009c0)=@deltclass={0x24, 0x29, 0x300, 0x70bd29, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, {0x10, 0xffff}, {0x6, 0xf}, {0xe, 0xd}}}, 0x62}}, 0x0) recvmmsg(r2, &(0x7f0000000c40)=[{{0x0, 0x0, &(0x7f0000000480)=[{&(0x7f0000000500)=""/1, 0x1}, {&(0x7f00000001c0)=""/64, 0x40}], 0x2}, 0x8}], 0x1, 0x2, 0x0) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128-generic\x00'}, 0x58) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, &(0x7f0000000140)="2c385aa3d49100dc6626c892b6bc436a", 0x10) r4 = accept4(r3, 0x0, 0x0, 0x0) sendmmsg$alg(r4, &(0x7f0000004e00)=[{0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000540)="0ddac400000000000000bfb48c676fab22e2d076fb296526ae98655ee4c429d1f245f7b1cfa5447a76830be1d0cfd34ed8af4ddbcc0b787eb0619e69f27ab98c3754b47c0b61fc44", 0x48}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}, @assoc={0x18, 0x117, 0x4, 0x40}], 0x30, 0x88010}], 0x1, 0x20000010) recvmsg$can_bcm(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000300)=[{&(0x7f00000003c0)=""/88, 0x58}], 0x1}, 0x10000) sendmsg$inet_sctp(r0, &(0x7f00000000c0)={&(0x7f00000010c0)=@in6={0xa, 0x4e23, 0x7, @private1, 0x400}, 0x1c, &(0x7f0000001100)=[{&(0x7f0000000100)='\x00', 0x1}], 0x1, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000a400000007000000ac140104000000002000000000000000840000000800000020"], 0x38, 0x4855}, 0x24000052) 1.096957922s ago: executing program 3 (id=4173): socket$inet6_sctp(0xa, 0x5, 0x84) socket$inet(0x2, 0x4000000000000001, 0x0) unshare(0x22020400) pselect6(0x40, &(0x7f0000000100)={0x0, 0x0, 0x3000000, 0x0, 0x800, 0x0, 0x100000}, 0x0, &(0x7f0000000240)={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6a9}, &(0x7f0000000280)={0x0, 0x3938700}, 0x0) 1.014783509s ago: executing program 5 (id=4174): ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'pim6reg1\x00'}) r0 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000440)=@raw={'raw\x00', 0x8, 0x3, 0x4c8, 0x170, 0xffffffff, 0xffffffff, 0x170, 0xffffffff, 0x3f8, 0xffffffff, 0xffffffff, 0x3f8, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'dvmrp1\x00'}, 0x0, 0x148, 0x170, 0x0, {}, [@common=@unspec=@helper={{0x48}}, @common=@inet=@hashlimit1={{0x58}, {'bond_slave_1\x00', {0x41, 0x1ff, 0x6, 0xb0e2, 0x10001, 0x84e, 0xfffffffb, 0x18, 0x8}, {0x1}}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'erspan0\x00', 'gre0\x00'}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'vcan0\x00', {0x3, 0x0, 0x41, 0x0, 0x2, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x528) syz_emit_ethernet(0xa8, &(0x7f0000000040)={@remote, @random="4001f78800", @void, {@llc={0x4, {@llc={0x0, 0x6, "1f66", "5443d0561e70e72bd2449faa5fdb76dda25e0ffc999b3d4bdea5ae1fb8a7a7e647a8390ca9d6f2269bc5b81b01cad111468f7cfcc527d415633b98f9dd8d9839fd0999dc82275d03259cdb8232bd909504463c71ec931ad4a257055c1e5574d4eb2936a18f768280f336be0953fc26bcfd514cc30a24a30f65d6b4db1b1e1aefa8d860a67f73676b5d3222f29f1546080540dd4501cf"}}}}}, 0x0) 955.883426ms ago: executing program 2 (id=4175): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="07000000040000000001000001"], 0x50) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x8, &(0x7f0000000080)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32=r1, @ANYBLOB="0000000000000000b703000000010000850000001b000000b70000000000000095"], &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x2d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000340)='signal_generate\x00', r2, 0x0, 0x3}, 0x18) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r3, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x528, 0x0, 0x1b8, 0x428, 0x428, 0x0, 0x588, 0x588, 0x588, 0x588, 0x588, 0x6, 0x0, {[{{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE2={0x28, 'NFQUEUE\x00', 0x2, {0x0, 0x80}}}, {{@ipv6={@mcast1, @local, [0xffff00], [], 'macvtap0\x00', 'ip6tnl0\x00', {}, {}, 0x11, 0x0, 0x1}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00', 0x1, {0x0, 0x0, @ipv4=@broadcast}}}, {{@ipv6={@empty, @loopback, [], [], 'veth0_to_team\x00', 'syzkaller0\x00'}, 0x0, 0xd8, 0x100, 0x0, {}, [@common=@unspec=@connmark={{0x30}}]}, @common=@unspec=@MARK={0x28}}, {{@uncond, 0x0, 0xa8, 0xd0}, @inet=@DSCP={0x28, 'DSCP\x00', 0x0, {0xfd}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @inet=@DSCP={0x28, 'DSCP\x00', 0x0, {0x2f}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x588) r4 = syz_open_procfs$namespace(0x0, &(0x7f0000000340)) preadv(r4, &(0x7f00000003c0), 0x364, 0x0, 0x0) r5 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040), 0x801, 0x0) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x275a, 0x0) r7 = openat$cgroup_devices(r6, &(0x7f0000000100)='devices.deny\x00', 0x2, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2, 0x13, r7, 0x1d57a000) write$rfkill(r5, &(0x7f0000000080)={0x800003, 0x0, 0x3, 0x1}, 0x8) r8 = syz_genetlink_get_family_id$ethtool(&(0x7f00000001c0), r0) getsockopt$PNPIPE_IFINDEX(r6, 0x113, 0x2, &(0x7f0000000200)=0x0, &(0x7f0000000240)=0x4) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r6, 0x89f0, &(0x7f00000002c0)={'sit0\x00', &(0x7f00000007c0)={'gretap0\x00', 0x0, 0x700, 0x31, 0xe42, 0x7ff, {{0x2c, 0x4, 0x0, 0x4, 0xb0, 0x66, 0x0, 0x4, 0x4, 0x0, @private=0xa010101, @multicast1, {[@timestamp={0x44, 0x10, 0x59, 0x0, 0x9, [0x0, 0x8, 0x0]}, @lsrr={0x83, 0x23, 0x97, [@empty, @loopback, @loopback, @local, @multicast1, @local, @loopback, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @timestamp_addr={0x44, 0x1c, 0x67, 0x1, 0xc, [{@dev={0xac, 0x14, 0x14, 0x1a}, 0x9}, {@private=0xa010101, 0x5}, {@broadcast, 0x7}]}, @end, @timestamp={0x44, 0x14, 0x5f, 0x0, 0x5, [0x9, 0xf94a, 0x30000, 0x8]}, @end, @timestamp_addr={0x44, 0x24, 0xd3, 0x1, 0x3, [{@loopback, 0x100}, {@multicast1, 0x6}, {@initdev={0xac, 0x1e, 0x0, 0x0}, 0x2c}, {@private=0xa010102, 0x401}]}, @rr={0x7, 0xf, 0xb1, [@remote, @dev={0xac, 0x14, 0x14, 0x3d}, @private=0xa010100]}, @end, @noop]}}}}}) sendmsg$ETHTOOL_MSG_COALESCE_GET(r6, &(0x7f0000000600)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000500)={0xac, r8, 0x400, 0x70bd28, 0x25dfdbfd, {}, [@HEADER={0x74, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r9}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r10}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'netpci0\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vlan0\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_bond\x00'}]}, @HEADER={0x24, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}]}]}, 0xac}, 0x1, 0x0, 0x0, 0x4}, 0x2404c020) writev(r0, &(0x7f0000000400)=[{&(0x7f0000000000)="390000001000111867090707a640400f0021ff3f31000000170a00170000000004003700090003002e372564b758b9a64411f6bb744dc48f57", 0x39}], 0x1) 935.312297ms ago: executing program 0 (id=4176): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={0x0}, 0x1, 0x0, 0x0, 0x4000811}, 0x0) r0 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="4000000010013704000061cd23a4df2500000000", @ANYRES32=0x0, @ANYBLOB="890c040000000000200012800800010067747000140002800500050001000000080007000a010102"], 0x40}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000001b40)={0x4, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="180200008300000000000000200400008500000045000000850000007d00000095"], &(0x7f00000000c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x40, '\x00', 0x0, @fallback=0x34, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3ffffffc}, 0x94) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000040)={'veth0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000002480)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd28, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}, {0xd}}, [@qdisc_kind_options=@q_skbprio={{0xc}, {0x8, 0x2, 0xe11}}]}, 0x38}, 0x1, 0x0, 0x0, 0x51}, 0x0) sendmmsg(r1, &(0x7f00000002c0), 0x40000000000009f, 0x0) 895.407253ms ago: executing program 3 (id=4177): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000100), 0xffffffffffffffff) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) (async) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r3) r4 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r4, &(0x7f00000000c0)={0x0, 0x45, &(0x7f0000000080)={&(0x7f0000000000)=ANY=[@ANYBLOB="3c0000004900010036560000000000000a0000800000200000000000140001800d2a79075827af5aa534d6815c2e93f10c0002"], 0x3c}}, 0x0) (async) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)) (async) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000000000)={'syzkaller0\x00', @broadcast}) (async) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r8, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_FSC={0x10, 0x2, {0x4d, 0xfffffffb, 0x7fffffff}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000000}, 0x20040084) (async) sendmsg$nl_route_sched(r6, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000dc0)=@newqdisc={0x434, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdfc, {0x0, 0x0, 0x0, r8, {0x10}, {}, {0xa, 0xfff3}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x408, 0x2, [@TCA_TBF_RTAB={0x404, 0x2, [0x7, 0x4, 0x4, 0x6, 0x5, 0x0, 0x5, 0xe, 0xf, 0x9, 0x1, 0xc6d, 0x401, 0x6c, 0x3, 0x7fffffff, 0x572, 0x1ff, 0x0, 0x7, 0x5, 0x4e, 0xfffffbcc, 0x4, 0x9, 0x7a9, 0x0, 0xb, 0x4, 0x6, 0x6, 0x80, 0xc, 0x4, 0x2, 0x80, 0x3a1, 0x1, 0x1, 0xbf9, 0x5, 0x9, 0x14e19416, 0x80000, 0x2c2f, 0x6, 0x0, 0x0, 0x324, 0x8, 0x42f6, 0x8001, 0x5, 0x9d, 0x6, 0xff, 0x7, 0x0, 0x6, 0x3, 0x5, 0x4, 0x3, 0x5, 0x9e58, 0xff, 0x38, 0x55b, 0x3, 0xfada, 0x4, 0x4, 0xc, 0xf0000000, 0x6, 0x2, 0xd2, 0x8, 0x80000001, 0x10000, 0x3ff, 0x7ff, 0x2, 0x3, 0x1, 0x6, 0x8, 0xfffffff8, 0x1ff, 0x30000, 0x3, 0x4, 0xcd, 0x9, 0x3, 0x3, 0x7, 0x2, 0x400, 0x13, 0x64, 0xb07, 0x7, 0x6, 0x30c, 0x10, 0x6, 0x9, 0x40, 0xffff, 0x2045, 0x6, 0x80000000, 0xf1b, 0xc16, 0x1ff, 0x9c, 0x5, 0x3, 0x1, 0x1, 0xa, 0x3, 0x46f, 0x6, 0x6, 0xffff, 0x1000, 0x0, 0xa7, 0xf8e, 0x1, 0x9, 0x4, 0x7fff, 0x2, 0x6, 0x4, 0x7, 0x10000, 0x3a273b20, 0x4, 0xff, 0xdc00, 0x7ff, 0xfffffffb, 0x6, 0x0, 0xc9, 0x8, 0x3, 0x3, 0xfffffffa, 0x3, 0x2, 0x8, 0x4, 0x2, 0x9, 0x8, 0x401, 0x10001, 0xa7, 0x6f49, 0x2, 0xfffffffc, 0x9, 0xc3d, 0x9, 0x40000000, 0x0, 0x2, 0x100, 0xae3, 0xd8, 0x9, 0x1, 0x1, 0x10000, 0x7, 0xfffffffa, 0x0, 0x0, 0x9, 0xf5e, 0x4, 0x9, 0x0, 0x8, 0x7fffffff, 0x6, 0xb3, 0x5, 0x6, 0x5, 0x4, 0x1, 0xb, 0x3, 0x8, 0xffff0c68, 0x922c, 0x5, 0x8, 0x7, 0xa9, 0x8cd, 0x5, 0x800, 0x2e72, 0x0, 0x58f1, 0xd0, 0x80000001, 0x7, 0x6, 0x0, 0x4, 0x2, 0x934c, 0x7fff, 0xffffffff, 0x7, 0xe, 0x5, 0x400, 0x0, 0x1, 0x5c, 0x2, 0x8, 0x400, 0x3, 0x6a, 0x4, 0x7fffffff, 0x1, 0x2, 0x10001, 0x4, 0xfffff8fd, 0x2, 0x4, 0x8, 0x4, 0x6, 0x5, 0x81, 0x0, 0x5, 0x3, 0x7, 0x2, 0x80000000, 0xff, 0x45319ce3]}]}}]}, 0x434}, 0x1, 0x0, 0x0, 0x40098}, 0x0) (async) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r10 = socket$kcm(0x11, 0xa, 0x300) ioctl$SIOCSIFHWADDR(r10, 0x8b04, &(0x7f0000000040)={'wlan1\x00', @random="c3000e000300"}) r11 = socket$packet(0x11, 0x3, 0x300) sendto$packet(r11, &(0x7f00000005c0)="24785466124cebc6c81c38c136a9", 0xe, 0x40000c0, &(0x7f00000001c0)={0x11, 0xf8, r9, 0x1, 0xd8, 0x6, @remote}, 0x14) (async) r12 = socket$nl_generic(0x10, 0x3, 0x10) r13 = syz_genetlink_get_family_id$tipc(&(0x7f0000000080), r12) sendmsg$TIPC_CMD_ENABLE_BEARER(r12, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r13, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}}, 0x0) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x11, 0x3, &(0x7f0000000200)=ANY=[@ANYBLOB="c3aa00b37c60ba6dbd4b83c2dab839fe4100000071101a00000000009500000000000092a1f0"], &(0x7f0000000480)='syzkaller\x00'}, 0x90) (async) sendmsg$TIPC_NL_BEARER_GET(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)={0x28, r1, 0x1, 0x70bd2a, 0x25dfdbfe, {}, [@TIPC_NLA_BEARER={0x14, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @l2={'eth', 0x3a, 'hsr0\x00'}}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x42054}, 0x14) 818.692055ms ago: executing program 5 (id=4178): r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000140), 0x10) sendmsg$can_bcm(r0, &(0x7f0000000a80)={0x0, 0x0, &(0x7f0000000a40)={&(0x7f0000000080)=ANY=[@ANYBLOB="050000000208"], 0x80}, 0x1, 0x0, 0x0, 0x40084}, 0x20000000) r1 = socket$netlink(0x10, 0x3, 0x0) bind$netlink(r1, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r2 = socket(0x2a, 0x2, 0x0) sendmsg$TIPC_NL_LINK_GET(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000280)={0x0, 0x24}}, 0x0) getsockname$packet(r2, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000001480)=0x14) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000380)=@newqdisc={0x2c, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000080)=@newtfilter={0x44, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0xfffa, 0x2}, {}, {0x1c, 0xfff9}}, [@filter_kind_options=@f_flower={{0xb}, {0x14, 0x2, [@TCA_FLOWER_KEY_ETH_TYPE={0x6, 0x8, 0x800}, @TCA_FLOWER_KEY_IP_PROTO={0x5, 0x9, 0x84}]}}]}, 0x44}}, 0x24004000) r4 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r4, &(0x7f00000002c0), 0x40000000000009f, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000480)=ANY=[@ANYBLOB="05"], 0x48}, 0x1, 0x0, 0x0, 0x1}, 0x4004844) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000740)=ANY=[@ANYBLOB="4800000010000104000002000000000000000000", @ANYRES32=0x0, @ANYBLOB="0380000000000000280012800a000100767863616e00000018005f14636c010000000000", @ANYRES32=0x0, @ANYBLOB="1b90000081810000"], 0x48}, 0x1, 0x0, 0x0, 0x240008c4}, 0x4054) 722.30689ms ago: executing program 0 (id=4179): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@setlink={0x40, 0x13, 0x331, 0x70bd27, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, 0x24604, 0x46001}, [@IFLA_IFNAME={0xffffffffffffff38, 0x3, 'nr0\x00'}, @IFLA_PROTO_DOWN={0x5, 0x27, 0x26}, @IFLA_AF_SPEC={0x4}]}, 0x40}, 0x1, 0x0, 0x0, 0x20008810}, 0x20040850) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x3, 0xc, &(0x7f0000000000)=ANY=[@ANYBLOB="180000000000000000000000000000008500000061000000180100002020732500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007300000095"], &(0x7f0000000200)='GPL\x00', 0x9, 0x0, 0x0, 0x0, 0x45, '\x00', 0x0, @sched_cls=0x36, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r1, 0x0, 0xe80, 0xe80, &(0x7f00000002c0)="0000ffffffffa000", &(0x7f0000000300)=""/8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=@base={0x16, 0x0, 0x4, 0xff, 0x4, 0x1}, 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b704000000000000850000005700000095"], 0x0}, 0x90) r3 = bpf$BPF_LINK_CREATE(0x1c, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff, 0x14, 0x0, @val=@uprobe_multi={&(0x7f0000000080)='./file0\x00', &(0x7f0000000100)=[0x9], &(0x7f0000000140)=[0x0, 0x4, 0x1, 0x0], 0x3, 0x1}}, 0x40) socket$inet6_mptcp(0xa, 0x1, 0x106) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0f000000040000000800000008"], 0x48) socket$unix(0x1, 0x5, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$igmp6(0xa, 0x3, 0x2) bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x1e, 0xc, &(0x7f0000000440)=@framed={{}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r4}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x17ff}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x26, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket(0x10, 0x803, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x3, 0xb, &(0x7f0000000140)=@framed={{0x18, 0x2, 0x0, 0x0, 0x5}, [@printk={@s, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x3}}]}, &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x4}, 0x94) socket$packet(0x11, 0x2, 0x300) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket$nl_route(0x10, 0x3, 0x0) socket$inet_udp(0x2, 0x2, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x4}, 0x94) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000380)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) close(0x3) socket$inet_udp(0x2, 0x2, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x1e, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="1800000001000000000000000000000071163a000000000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_lookup=0x24, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r5 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000000c0), 0x50) bpf$MAP_LOOKUP_ELEM(0x5, &(0x7f00000000c0)={r5, &(0x7f0000000000), &(0x7f0000000040)=""/73}, 0x70) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000040)={@map=r2, r1, 0x14, 0x2000, 0xffffffffffffffff, @value=r3}, 0x20) 714.371059ms ago: executing program 1 (id=4180): ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, &(0x7f0000000000)={0xffffffffffffffff}) sendmsg$IPCTNL_MSG_TIMEOUT_NEW(r0, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x24, 0x0, 0x8, 0x801, 0x0, 0x0, {0x3, 0x0, 0x2}, [@CTA_TIMEOUT_L4PROTO={0x5, 0x3, 0x88}, @CTA_TIMEOUT_L4PROTO={0x5, 0x3, 0x84}]}, 0x24}, 0x1, 0x0, 0x0, 0x40}, 0x24004001) r1 = socket(0x3, 0x1, 0x400) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000140), r2) syz_genetlink_get_family_id$nl802154(&(0x7f0000000180), r2) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000200), r2) sendmsg$IEEE802154_ASSOCIATE_RESP(r2, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x24, r4, 0x20, 0x70bd2d, 0x25dfdbfd, {}, [@IEEE802154_ATTR_STATUS={0x5, 0x3, 0x4}, @IEEE802154_ATTR_STATUS={0x5, 0x3, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x4084}, 0x40000) socket$igmp(0x2, 0x3, 0x2) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(r1, 0x84, 0x77, &(0x7f0000000300)={0x0, 0x3, 0x2, [0x200, 0x101]}, &(0x7f0000000340)=0xc) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r0, 0x84, 0xf, &(0x7f0000000380)={r5, @in={{0x2, 0x4e23, @local}}, 0x3, 0x8, 0x1, 0x0, 0x4}, &(0x7f0000000440)=0x98) r6 = socket$netlink(0x10, 0x3, 0x7) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f00000004c0), r6) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f0000000500)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_FLUSH_PMKSA(r6, &(0x7f00000005c0)={&(0x7f0000000480)={0x10, 0x0, 0x0, 0x2080044}, 0xc, &(0x7f0000000580)={&(0x7f0000000540)={0x28, r7, 0x2, 0x70bd2d, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r8}, @val={0xc, 0x99, {0x400, 0x36}}}}, ["", "", "", "", ""]}, 0x28}, 0x1, 0x0, 0x0, 0x40000}, 0x20004891) socket$inet6(0xa, 0x80000, 0x1) getsockopt$inet_sctp_SCTP_RESET_STREAMS(r0, 0x84, 0x77, &(0x7f0000000600)={0x0, 0x9, 0x1, [0x8]}, &(0x7f0000000640)=0xa) openat$nci(0xffffffffffffff9c, &(0x7f0000000680), 0x2, 0x0) getpeername$packet(r0, &(0x7f00000006c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000700)=0x14) sendmsg$xdp(r1, &(0x7f0000001940)={&(0x7f0000000740)={0x2c, 0x4, r9, 0x16}, 0x10, &(0x7f0000001900)=[{&(0x7f0000000780)="e5eb7d0df6781ea4ff4061035e090c6d9e186d432281bc74c5b0377a4bbbea15ebbde8d5e65ab29f51cf1af09545b092ee68f2b37e426f5c30e39900b9cbd3d28a981f6f8f", 0x45}, {&(0x7f0000000800)="df080cdf4ad7e94d5e8d8d62f75e3801a5f02b64924f1ac64d2daff170affd2c5eacd4976ef1e32cd9b008b9f940b2dabe9bc763f229487c69e8719bbcea9722255de3f535346fbd53447a0475c7e9a566abd1ab13d4864fd56954d88250b1436a0d6cadcc45748282347edf14bb573973e6a03ec46cda7ceeab804fe3e6277bb38d3bd8a1061db2523ce639aa680f0de8a283297d642975f54cbe95ef91e87a2006cd53fac786e06ef71aec17660408f4b5d327be904e5a5eee72f2a174e2c41f143f254d8c1aecea9deae67dbdf8ff782df89bac09c0031d3daf2452eee6dd0958efd210779ff75573333e3c40e21042e5fbb67d6611ee61a50354ee0a4e7f7637afd918fd8367c5c6b83e8586d62ab85506eb64ea9fb6ddc2b4a3247754f605c88519f401313f9840d72ff2770ebed60b20f8642dd89ba482c680362950d5a335be7b947d2ef894492df1f5c72a026eecdd24b03ec438d88a5da0fea9b447b44b3469e92ef556a9544d279e2c2c64c1b731f9a2c605670b937d320d942dc43a5177ef5bb9db08e68965dd7c7291852879197a520a29a1b1968d016813de42e09711fa570c3eee903fb5578acda71e89500d18c01e27f4179a8c0f2ef3fcceecb88734770ed4e6c2eae9d9954b644f9685e46a51bad73c29e60d5f650ea874771b7c4aced9584c01d7e8f18a332c8315827c5e3dbbae8ab43970d3c32163ef8ce0069676d1324058025f837db963fde97de36a442342695343d3aeb6a32ad56a195965f570573ecf4b06d725e1ec19a73d43d1d5de161dfc8016bd89a4175f8df0fbb63d14c0c704973644c3a68581b83c367847674fb890b4b8bc76232a090b7acc27fc998b22c666ec55ff37aa5a38e0b0c6b803f543835945bed79b588a10964ea0eb85f2df17144d7773c06eec5f02b56919a43645f0572521c81494b7e20b6f4eaec1c77de52b9a03c952b944edb24225cfde5c1458e51837a83b11122bf6feda5e35a0aa299679a1cb862c6fb48df74ca0518ac391423acdc0bcc718ddd15d86716f6d2a79101fb7c7751b9016fa45faaef74e4d99bf6dd88273ae4d89e3d57726c49c1c81cf268839c82958a46008c526c42c912ecaf401f85f7d821228a230f75e0f2d063d2a506caea3a30362b4056eb673757c7f7059c50bbef572970f544875d66b902fbf52fe6cb4594588a7781c4f03216d07eb254f1225fbb867164f75cbcf157f48f23e424c4de25f116630129c5069e47a0911cd532db022bdfaa4c8ea428d835b883736e5592e95318fb2cec3209762dd9483a0c39511221e7d49e6479cca8e1d491ae8f21603a4c0301f8d73f9a00743cc99ad7e996d90211b2c54c4350668a50cb664d59fd2c95defa0a0639cac3da6c88736f84a66c12c7d52057c59714cf720b63f5241ef91f64baf909b101ec0061187cba6b7fc2728f59d06ece6df8c4e17f8a62a92389d97fb96954eb8b3b70dde547b369616102c957fd4fbabee7b18a3894c5daf1407f793f4ebce9a3813149d905f14221bbf80ad82dec602744d6570fb8cf28fd478eef64d0ff7ff8aa500038274625c413a4c1f1d4a4f8f5b23cd8b69deb20f0e789bd25a73b734225852f7a8e26d22b7fbb8765ba06ada1fb5ea512ff2ba6dd5ed668ecf83de073f0e9a1811dc4d45e71f91e7cdc78e8b252e9822582926444e4e5896c5b136002c7e46dabf3d12fc217d70e82cb91895bf07f498cbd057d8d14e41e8d4304908b85fae63e351bc60af6918fddb259343b3c08a1e3b48a5e4aa68779696f63cc14ac87118e8cbd40924fa0145fa715818f64a5b0adbd985eba4ae6a4dc57b63003ec4a586bf33b73cbd2e9c715acb36f8e14a31afa9dba7a64ba4087836d15fbe3d31b6e5634614758ce5657d056359f9134832cc65057ba43916057a5c7a2d149b34ba3df36f3b3f18b74d651c11ac14805acb883d4b9eba00a2421245e276e0bd2518ce83c95c3422371bcbc9b982e43b6083a363568510251ab0bde51114df569e2543173ab1b0df6cfcbad745594a976fcded177e90a78b70c70a031ccaaff82d1abe726a4e22fcb664a80c90804b7f7571851d0c8bf55b33e3a0fac80982793a1106661efe08fb8f48e6b0bf73d68b14e7e59ac8abebf5e1f8cacb9f462aa591550ebfffdeb706c9e6c17cdd93064f67128c01dbe1d7ade42a21d26d6af8203916f5b75973f37cc6ca96a18ab06969e3d05beb95d38a061a1e3c11bd68e2368812b8e5a1260e6777215b7eb22bd00a34516d24b58703078331150ea07377b91a5aba970cbc77cb610ca28149600ca1ea4bb3e31d0173dcafb3e4fa6bc960cb8e38200373e2b5cb2c37c2e6418d655cd5c9a11be078703b19cb0fb79853bbf74ffd13037778a1cfa5c8339cac14892cbb0f21d009c98528cd6349cacf44e4ef9872506279dad2e2d78fe55453ab25d2c6b8839c247a5d9a9888bf1bc3c4a2a3d26d19678a2f43f013a93f4165a32937648c40f8208cd4f5611e18698fc6b2e5262df9c1e70e920b87c8c6915a2a6c593eb4ad37e5442c055f60ab72b3dec0859642d2ca14d703551dcc57daeb032aff15d2e1c60f324541bdaf9fc6eb9269c91747b3ada8f583f41e18f962a5011ca3c1a64e018a86d176df0db752ba7475997c4d3a38f9bfabfd08c82c8666b969c2152535941df7612636aed11de44a9ed146710be79b5abea279210daf3063abaafd3de1fbab192e59d3a56d9445ffca9612bb2de82f560456a197d072109167032a1b63187e1cb1b8d41f24aec9c1afbde7f902900b49e23c76337f5a76e3c53ebb21af9b0033db7424e9d5c7cb33694aeb943b4cf9589c94b66451789da8ff032776d070ed9b545ea1d18f515545f9c85da8a37aa9d06b41f21cf55dc3d95e21b2134477528f9902d391cbe25c09239973fc2617860741e26a076c3cf3fe5d35f61b5fde5509323639bec720e46d7d64111b3800c4172dd48aa3605e3ac11e7db1fde17c5893eb64ece9e498a9cfa6aef8cf654edf418c9a5ca08a95e5c0c4ddab084e161ad06c8f28299b9af15edaa3d80adc8f07107328f1cc505ccd4eb382a1a15ca0ba2560d9c0b533cb18139933bcb5238322b981a67a2e2320bf160affe880dfe36f325d8887b6a571e6884b825ee4b26fd5f6e813c477a16e0ed6629a099adc20917f2592f05a2eeb24d6af5477db25227eb6fe08abe7d0165530903f148daf1cc56994b65fc51beacc589f4e013a7948e88e6afa26d46d3b66de72b5d77e79ad442ef939a43be7c4a2a8c9f7940275bd5225717191b8e61f8e81dce951f7994a92e3a2d96a29222f0096a22fa31083ea0d98fa46e078ff2cc30da5e1f05113598c990d8ff2a20df025eca744aaaabfc98beb9f722db37b3ec31528e562a5064b920c47ecfa08123e73a5465a207dd262ed1d258a5c8004869d1b5eef75bad0ecc14d5131d890933bee3717cbca554f04963e197ff2ba18d8cc34b65bda0bb7ad0af33060b33280dd9435b0874c23b8d8a21b306651b43c0b2b504a60a79478cf66371c1ec2969485b8ada7a80b1581787b50219fb3fd0a5f4ecf80ac9159d7d03cac0fd2ad197b161620c6a3fa4175df73cabf354e30382c7b335cca6a6452f8649a473f1a4b8237fc159c59aeda0e85f6266b706d24965ea867e68418439e76f12d99965a6780b153f8ccc77d8d4492a32f77583dbca1c0d70099c9a67380708562f79b176fca5571bdd6028a94cbbd2af7dafface800d1c9840e5958ef22125824ed7204f995d748e6af9ce189bd8c52d3eeb1f36644063cd1da3d767f5c286c20545e4823a0e9f41a80700aaeba9504ef21dcd538eecdfd0cb4c9c8acd2a79881a30668d753c2a773e2ae2a3f5996ef968d8c003ec8669e59135b8f9a39d3a90fab5990ec4e2e6a05f3236a842380e0da5f0eeb12f362d46b30494a68b53c9ddb2ae255e6c92272e8033d62b5dcf989be528a00d03a3b2c201faf23da24e511d05247ecf3a21eb5c6b6baae1dd328ee4cad0cb6bbb9910e5fb0a5f48bfba0041cb85bca9b0fbb3457bb5e5f3d661c2cef35457d2b7dd6e1e337e0542da909fc38e5d71e59a66d19774f9a0320bc69fef05d1d6f84ab3034e373ad81034210ec23317e3b93ada279927ba25ccdad7537ca957f2bea18245824cf00937bd44f70f4ac59da1696459cdf017e4df96a6ac1666634d7485064f69afc71c11e07472e117f147ee32914baa4515f7387755d9338f3d0b9e31516d8d0584554318beba236828895137d3c0be4b433d962fd26f1ce9907d99573ec49c9f568dd3b70e5ce310c379e7f4ee199ec36fa9f996d4c7bb75a1d9c6dbe95572843dd481962e6edba1e06bd81adcf70dca86bd2dcb3c7004237a3fb28ffce6f00275d4e27ec3a5f0b6b70a34b41723eb608bcba760376f125bb6c59d5fa5d8ab5034db7360da2c93cc1e35ff84193f6a8873122ca0d1cd3bb6d3308568522a17541b9fe56182104452f7869f2bca846d03d22889088383657939ea2d2f1550a601693e5fb439ea2d160f0e7ab9b6b1c25ec4d8ed70d787ee84dea167cd66d4535a8a7f2ce69efcdb8017ea3a29dc122cc9d86068ddc313e09102bfd7fb4f298c8fea94e9699ce8181abf8c94fba5efd876c3acf11beddbf91e776eeda19b90de6222ab3368a6a47452de22b797e6806ca39001798d074d5ef0ee1708d4d4ced4eb5ffa6714106cd1ebdc3f4f02f66093ad76d1da2af527d7b471f4586e74c28843837060baf5cd6ac9bc78f4a576ad3622391e172a8cd15bf19568396ae15de6eff532470b2a1521c08105222f86c468ef36502933097611bc7c2b399336eb41657aa0c46af1fed25035a27aa753be95730f0d6d27f076eb252e6332383ca07f67631ae84318d55efb35e39b28d26adc6be76d04c17708ed816dd1b64817d4e5306417b37e00ab064bf6c43bde9f0e595d0acc7ae3868df2ad671024ed2d2a5957a1e8a489dc8556f874bbeaa212d85136b5b76fb0bd0981700d6e2e1731382cc88ffb6a4612ed26bebc28c851fb6980f6470241da14bd0ad79042a7bde7502033cfa1f1edfff8654048cc499a107f13ead29861ccfd53ec1ee77a60906073662802b9fa88e52880003dc33c2c2f330dcb8129a0432a02a70b4745c0336a133c9cb01cd525876ff21f7b8d5d177470114699eed92bc2d58ac39a47e11b84f95896b3c7e657a1d517f2184446168a44b5c812987bf0db06124c9ff832779e43b10b57f17c30dde12d922f5327595c2800fb231a8b1fa23b3115c0c33330f18dcb11375addeefe0ac50bb76d65df87825d585280b8854b4c51e98c8c2c9df8b66264ece03e0d03cae0fa23f63bff719a2e3b803ae1381d420e90e2a1db0002b8d9ca65156ba9aaea1f908e7827e4d8f386f1a16d7c31ce0162056013e63f364eb41b6563e8e0c6e04d22b1da7c83d0041a08a4288fb501e08967f010b798c3ad0efe7fbbf1feb5156e9b9b8c66168038fa39c503d5d864de36f76f2b64d7cd0d952076b49246e79e65852dfeeda6b3d6b6dc9e29a9dc72d660d036745221e6596b6140f102e988a4c16702d94ae77c18a6df788de2eb7f898989f670b2cad912884948835361be45cfcec5949da914c475fa297f2c090229d2c2fa58be08a73308063d7a15b534c3fbb22af2f2ca056a6cf161609dd7550fc74136f0f0acbad8e7d80916fbaa842dac978c0733804c9e2961624a182e73eee00f5d663e789fe1019156687e0a0d7c4d44847dcabd6adf24c12779d6e2b2887b8d624", 0x1000}, {&(0x7f0000001800)="9be33eb0964eb7cdcd44d68c99be2853d8f9bbee7e0576f7ec98da432e6c799ae296bcbe158b25c4a58e90e23eac2da6124d3c4b5ef7cbf0846856bf9c9a3a74ebd017a352f49e8b58b9ce320377d50314df3dc22c89ea703f275f5d7d5acd506e41a868e9017a9c4d816a99c801e72a0fa443e09a2cdf03d64b3a8e16379bb6ae230b9996316c8040f89c75d329cd1fde6de0962e8d67d746541071495c7f7bc41613616fe94a368f4494e4057702278c88991f50695e88acf9795fa0c0e77c36df110b957c83fbc7d01ef958d178ae160a10a707507c6a0967a3c8fbe7ec1d3fd998162ee8ae60fa1810f5274cf8a9090ec24abd18810353e820", 0xfb}], 0x3, 0x0, 0x0, 0x20004005}, 0x4000) setsockopt$MRT_DEL_VIF(r0, 0x0, 0xcb, &(0x7f0000001980)={0x1, 0x1, 0x0, 0x537d, @vifc_lcl_ifindex=r9, @multicast2}, 0x10) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000019c0)) r10 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_DISASSOCIATE_REQ(r10, &(0x7f0000001ac0)={&(0x7f0000001a00)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000001a80)={&(0x7f0000001a40)={0x24, r4, 0x300, 0x70bd2c, 0x25dfdbfb, {}, [@IEEE802154_ATTR_COORD_SHORT_ADDR={0x6, 0x8, 0xaaa2}, @IEEE802154_ATTR_REASON={0x5, 0x12, 0xf9}]}, 0x24}, 0x1, 0x0, 0x0, 0x40}, 0x91) r11 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r10, 0x8933, &(0x7f0000001b40)={'wpan0\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(r10, 0x8933, &(0x7f0000001b80)={'wpan3\x00', 0x0}) sendmsg$NL802154_CMD_GET_INTERFACE(r11, &(0x7f0000001c80)={&(0x7f0000001b00)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000001c40)={&(0x7f0000001bc0)={0x54, r3, 0x700, 0x70bd25, 0x25dfdbfe, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x33431511a3ca753a}, @NL802154_ATTR_WPAN_DEV={0xc}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r12}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r13}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x3}]}, 0x54}, 0x1, 0x0, 0x0, 0x20044010}, 0x4040844) socket$pppoe(0x18, 0x1, 0x0) getsockopt$inet_sctp_SCTP_RECVRCVINFO(r0, 0x84, 0x20, &(0x7f0000001cc0), &(0x7f0000001d00)=0x4) 617.425094ms ago: executing program 5 (id=4181): bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x43}, 0x94) r0 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00'}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r0, 0x5, 0xb68, 0xf5ffffff, &(0x7f0000000000)='%', 0x0, 0xd01, 0xbe02, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) r1 = socket(0x2, 0xa, 0x300) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r2, 0x29, 0x1b, &(0x7f00000000c0)={@empty, 0x1, 0x2}, 0x20) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000000100)={0x1, &(0x7f00000001c0)=[{0x6, 0x4, 0x6, 0x6}]}, 0x10) 616.990222ms ago: executing program 3 (id=4182): socket$nl_generic(0x10, 0x3, 0x10) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, &(0x7f00000038c0)=ANY=[@ANYBLOB="620af8ff0c200021bfa100000000000007010000f8ffffffb702000003000000bd120000000000008500000006000000b70000000000000095000000000000003faf4f1e7f2aa3d9b18ed81c0c869b51ec6c0af4e0e4a9446c7670568982b4e020f698393aa0f3881f9c24aa56f15199fad0093c59d66b5ece9f36c70d0f13905ea23c22624c9f87f9793f50bb546040677b0c5077da80fb982c1e9400e693146cea484a415b76966118b64f751a0f241b072e90080008002d75593a625704f07a72c234664c0af9360a1f7a5e6b607130c89f18c0c1089d8b853289e01aa27ae8b09e00e79ab20b0b8e1148f49faf2ad0000000000000006fa03c6468972089b302d7bf6023cdcedb5e0125ebbc08dee510cb2364149215108333719acd97cfa107d40224edc5465a932b77e74e802a0d42bc6099ad2300000080006ef6c1ff0900000000000010c63a949e8b7955394ffa82b8e942c89112f4ab87b1bfeda7be586602d985430cea0162ab3fcf4591c926abfb0767192302000000b0eea24492a660583eecb42cbcd3de3a83209da17a0faf60fd6ad9b97aa5fa68480366c9c6fd6fa5043aa3926b81e3b59c95c25a573dc2edcaea2b1a52496dfcaf99431412fd134a996382a1a04d5bb924cfe5f3185418d605ffff9c4d2ec7c32f2095e63c80aff9fa740b5b7632f32030916f89c6dad7603f2ba2a790d62d6faec2fed44da4928b30142ba11de6c5d50b83bae613402216b5054d1e7c13b1355d6f4a8245ffa4997da97e22f4c0eb97fca585ec6bf58351d564beb6d952aab9c70764b0a8a7583c90b3433b809bdb9fbd48bc873495cbff8a326eea31ae4e0f7505ebf6c9d13330ca005ace1a84521f14518c9b476fccbd6c712016219848624b87cec2dbe98223a0eb4fa39f6b5c02e6d6d90756ff57902a8f57000000009700cf0b4b8bc2294133000000000000000000030000000000000000000000000010008bc0d9559711e6e8861c46495ba585a4b2d02edc3e28dd271c896249ed85b980680b00002b435ac15fc0288d9b2a169cdcacc413038dafb7a2c8cb482bac0ac502d9ba96ffffff7f0000100000000000007d5ad897ef3b7cda42013d53046da21b40216e14ba2d6ad5656bfff17addaedab25b30002abbba7fa725f38400be7c1f001b2cd317902f19e385be9e48dccff729433282830689da6b53b263339863297771429d120000003341bf4abacac95900fca0493cf29b33dcc9ffffffffffffffd39fec2271ff01589646efd1cf870cd7bb2366fde41f94290c2a5ff870ce41fd3467decb05cfd9fcb32c8ed1dbd9d10a64c1083d5e71b5565b1768ee58969c41595229df17bcad70fb4021428ce970275d13b78100788f11f76161d46ea3ab60fa4d30dc94ef241875f3b4ce0232fcea69c271d7fa29822aea68a660e717a04becff0f719197724f4fce1093b62d7e8c7123d8ec571be54c72d978cf906df0042e36acd37d7f9e119f2c06f815312e0cfe222a06f56dd022c074eb8a322fb0bf47c0a8d154b405c37feaf3dd95f6ef2ae582786105c7df8be5877050c91301bb997316dbf17866fb84d4173731efe895ff2e1c5560926e90109b598502d3e959efc71f665c4d75cf2458e3546c1c776da64fb5abee0acfd235f2f4632c9062ece84c99a061887a20639b41c8c12ee86c50804042b3fb5aac518a75f9e7d7101d5e186c489b3a06fb99e0aa7f23a054de2f4d92d6bd72ee2c9fdc75aaaf1e3e483b4ad05573af40326993947d9a631bcbf3583784acbda216550d7aec6b79e30cbd128f54c2d3335457acf37331766e472391e358c3b377327ac9ecc34f24c9ae153ec60ad0694dc55bff9f5f45f90400000000000000d6b2c5ea1393fdf24285bff3b89c9cc0ad1857216f1a985f369191ae954febb3df464bfe0f7f3ee9afe7befb89d2777399f5874c553aeb3729cffe86e66964ae09bb6d163118e4cbe024fd4500f8ff0700000000cc9d8046c216c1f895778cb25122a2a9f9b444aeadea2a40da8daccf080842a486721737390cbf3a74cb2003016f1514216bdf57d2a40d40b51ab63e96ec8485b3b8a8c9ae3d14f93100c2e0893862eef552fcde2981f48c482bde8a168c3f5db2fea6f26e4a4304e50c349f4f9ecee27defc93871c5f99b355b72d538ba4958ea8e4aa37094191e10096e7e60fc3541a2c905a1a95e9571bf38ae1981c4238ecaee6f75cd0a6881bd1517a8250ddc8674152f94e3a409e2a3bce109b60000000000000000d6d5210d7503000000a87a27602b81f76386f1535bef1497f92186086e29c6bc5a1fad6ec9a31137abf9a404abde7750898b1bd627e873f8703be8672d70d1ab57075228a9f46ed9bd1f08fb8191bbab2dc51de3a61f0868afc4294859323e6c257a45319f18101288d139bd3da20fed05a8fe64680b0a3fc22dd70400000000946912d6c98cd1a9fbe1e7d58c08acaf30235b918a31d2eca55f74a23641f61f2d5b308cf0d031b0c7f0ced69993e9960ff5f76015e6009556237badf4e7965bbe2777e808fcba821aa8e8c5c39609ff854352cb4900000000000000000000000000c1fee30a3f7a85d1b29e58c77685efc0ceb1c8e5729c66418d169fc03aa188546b3ad2a182068e1e3a0e2505bc7f41019645466a53f1c96e0d4b3bc19faa5449209b083dbd334b47f067bbab40743b2a42010082008df75cf43f8ecc8d3726602111b40e761fd21081920382f14d12ca3c3431ee97471c2ed01faa7eaa69eb7f7f80572fdd11bb1d0d1280fbc22bf73468788df51710d7d31c632fc5ed1762eb0b428ee751c47d8e894f745a868404a0bf35f0121008b722b1eaa6aedfa1bf2e7ccb2d61d5d76331945ecefa26b8471d42645288d7226bbd9ccd628ab84875f2c50ba891cea592b0430a537a395dc73bda367bf12cb7d81691a5fe8c47be395656a297e9df0e71f96756ea5cce7daac4be290159f6bcd75f0dda9de5532e71ae9e48b0ed0254a83100000000f6fbb869604d51a36a54c832e45b2569dc0d90b075225fde44c4e0973171ad47d6b0fdf9743af932cd6db49a47613808bad959710300000000000000832d0a45fa4242e24c7e800003c9e8095e02985f28e678f66422436f949e2ab8f162d7e3f855e378f4a1f40b0c6fb2d4b205a800b6d713acebc5b014e61a543a5a194f9ac18d76b5440e3b1a569e7397f6cafa86966d7ba19e720413267a6ccea9c439671d2c680f2753ca184eeeb843450368acb4383a01d25eb3d1e23e0f2645d1cdfa9fa410632f95a5f622f851c66ee7e30393cd7a4d67ff2a49c4f93c0984b5c2d4523497dad64f95f08493564a1df87111c9bf3194fef97dcecc467ace45feeb685c5870d05f88a0f463db88d377442e1349acaf766218b54a9d624778e1c4e064c98e494198276eb2df7766411bef0ebb5000000000006065d635b0b7a00ee767221d8af9753387e0cd8d718f54a29df6fba3bd4c440e6e2172e3fcc01b8babb757b5c59217b80d0db3ba582814a604e4ef7a803e9ca7c85b35c9b93a9e0885e238b44ae1c2e64cce3b27083b8246829e64056000302bffff15405bd5f2eba20000000000000000000000000000000000009a9823fd8fbc5aa165099c5ed032b48ea12d8e0588dc52702e4084913a06d468d0928bad76d697e1f85ab030e788d38788ee5b5428d4a971cc97db9fd2310801570735ce129e7e77fc2777692664a1488fd8d6dff4dad618fd54f529d4555c6507009ee69dd1bc55258789b24052137e9637f3efbab71720f88cf573fe0e5239c000be2733c49546f6e8a9175ec6f14dbf72cac91643b2fd99c29eca28a3c2e60d5e5b8795fae16a7c3ea57e728eca35eaf0155a39f97580e079175426c088a0208040982a0000000000000000000000000051ceaaf0159fe61f2eade7603d0a7a56fb09cd119ac06adb6597155ae47846892bb414c024d8cbe9240b71ec6dc2124d3a19e2d714b273d95d1d3aa737cb04a33615ff2a730e51067d5d675d7122361c37c61a43b5afd865b60d4cae891b73220f17d25985a7f76834995e53a93a1c7b9eef267df691ca983a0b15bda7f6c5c1ca7aa50261a3089a1ebf0734c9b07e8951ff023263ad5aed8cfb49b49e128c697724c057d22c5df5aef27ce3db11d5ad5527d149d076e1a87e2df27c0cb8a67ad026bf953e88f10447e125c2c0f1aebee1f3390a9e3ddad4e2a6e0f6e4569fdefa19e870e04acf9493b963f98e23cfc665e4f465fa3f801e1957c399e45f61d3459b1c606204368bb931345af2823c487d2fd99db6ea6e008e7ffa06ca861551189d155bd077a79fe2c7e961352e56824f727d21d41eae78bfec4a2d7a7edbc8ef958c5ea599f7c25bf71c2340558aa12fdd24a88aaad5921aee7dae6a2f3009d9cb43ab4898d0f0aa565431b6abe585d75db04d1c9ba0b9de4ae8b0d3132bc6810cc9a693979f55174a72e1df9fdef35bc470f9e6e591982757f45c52c645d891bf63bb21fb66926ebe1a8525611fc3e8bb8795c36dc2a86b5ab46ff33cc74f61751b2dae92676db85c8d0c721b7ea4544bf51c95c86fcac1f434d09d1ee4928aafe23de66fed972e0dddfb33f64e48701b049239e7f552d816441d11c4c2647c014462344359198d97c4b6e9ed31ca18987b64de079b2bed641e8a92f13ca70844c65cb423d01950b0ebf44bd28e09c05d9ae5dd689fb880fb18d042219f5ac60c3a03b085abf3e8e3efc842a8d328733461f04c99607061c65ed14c61322a5ac2d371a95b8ad867857ed13a4fa4ae033a09673866cd77f4bcdaaa05207166b19a8758d8855400d8c6a7242dc207251e8797eca24ea4f487663e60f2f5e1f1424958fd148f846830e88a42d93e1fe9c0b4a4a268921738938aa9f3cb3811ac87c54c8ebc8bcfb4613cc3a997ff1579edbd4ade8020e3ad001b072b1a751b588ac4639f35a58e00a50c0270608c7a7f10132b1c25b9ea81232fbef665f6212f875b2a000000000000000000000000000000000000000000000000000000a0cc2b89ce1525748ce167cbabb881f060599a6a59f645edca1d5c24b2f6b8c997a8f3e1b7679984a566d98d4d31198ee4c5ea7be0d99cf89bba4a6fd0bec12e7792bec3c5038e13b1982f80cdecd07f8908a983a7c9fb81c2ba7f7e87c991f30e50d1b3bbe4cf2a2f5d4571b6568ada51bc121c91"], &(0x7f0000000380)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000540)='rcu_utilization\x00', r0}, 0x10) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) shutdown(r1, 0x1) getsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r1, 0x84, 0x72, &(0x7f0000000700)={0x0, 0x81, 0x10}, &(0x7f0000000040)=0xc) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, 0x0, 0x0) r3 = socket$packet(0x11, 0x3, 0x300) bpf$MAP_CREATE(0x0, 0x0, 0x48) setsockopt$packet_int(r3, 0x107, 0x8, &(0x7f0000000100)=0x40049, 0x4) socket$nl_route(0x10, 0x3, 0x0) recvmmsg(r3, 0x0, 0x0, 0x0, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x400, 0x70bd28, 0x25dfdbdd, {0x0, 0x0, 0x0, 0x0, {0x5, 0xffe0}, {0xfff3, 0x2}, {0x2, 0x5}}, [""]}, 0x24}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f0000000000)="0800d907000000", 0x7) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x3, 0x20000000ec071, 0xffffffffffffffff, 0x0) unshare(0x62040200) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), r4) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_CONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000280)=ANY=[@ANYBLOB="386a4e26de800c8100", @ANYRES16=r5, @ANYBLOB="050000000000000000", @ANYRES32=r6, @ANYBLOB="0a003400020202"], 0x38}}, 0x0) syz_80211_inject_frame(0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="5000000008bd9118bba4e29a48a472f30211000001080211e8ffff07021100000000000000000000000000640001"], 0x2e) nanosleep(&(0x7f0000000340)={0x0, 0x2faf080}, &(0x7f0000000380)) syz_80211_inject_frame(&(0x7f00000003c0)=@device_b, &(0x7f0000000580)=ANY=[@ANYBLOB], 0x1e) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000500)={&(0x7f0000000400)=ANY=[@ANYBLOB="9feb010018000000000000000c0000000c000000020000000000000000000004", @ANYRESDEC=r1, @ANYRESHEX=r7, @ANYRES32=r6, @ANYRES32], 0x0, 0x26, 0x0, 0x2}, 0x28) unshare(0x2c020400) 213.723642ms ago: executing program 0 (id=4183): r0 = socket$nl_route(0x10, 0x3, 0x0) (async) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) (async) r2 = epoll_create1(0x80000) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000000040)={0x10000000}) (async) r3 = socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=@newqdisc={0x60, 0x24, 0xd0f, 0x70bd2d, 0x0, {0x60, 0x0, 0x0, r5, {0x0, 0xa}, {0xffff, 0xffff}, {0x0, 0x7}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x34, 0x2, [@TCA_TBF_PARMS={0x28, 0x1, {{0x4, 0x2, 0x0, 0x0, 0x7, 0x8}, {0x12, 0x3, 0x0, 0x1, 0x1, 0x400}, 0xa5, 0x4, 0x10000000}}, @TCA_TBF_BURST={0x8, 0x6, 0x8057}]}}]}, 0x60}}, 0x44080) (async) sendmsg$nl_route_sched(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000001c0)=@newqdisc={0x78, 0x24, 0xd0f, 0x0, 0x0, {0x60, 0x0, 0x0, r5, {0x0, 0xf}, {0xd, 0xa}, {0x6}}, [@qdisc_kind_options=@q_sfq={{0x8}, {0x4c, 0x2, {{0x7, 0x10001, 0x3, 0x0, 0x7}, 0xf0, 0x1, 0x8, 0x3, 0x88a, 0x9, 0x8e, 0x1f, 0x3, 0xff, {0x4415, 0x2, 0x800, 0x5, 0x0, 0x5}}}}]}, 0x78}}, 0x4000) r6 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) connect$bt_l2cap(r6, &(0x7f0000000080)={0x1f, 0x1, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}, 0xe) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000004000)=ANY=[@ANYBLOB="b702000003000000bfa30000000000000703000000feffff7a0af0ff0100000079a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe00000000850000000d000000b70000000000000095000000000000005ecefab8f2e85c6c1ca711fcd0cdfa146ec561750379585e5a076d839240d29c034055b67dafe6c8dc3d5d0f65acc0d06d1a1434e4d5b3185fec0e07004e60c08dc8b8dbf11e6e94d75938321a3aa502cd2424a66e6d2ef831ab7ea0c34f17e3946ef3bb622e03b538dfd8e012e79578e51bc53099e90f4580d760551b5b341a29f31e3106d1ddd6152f7cbdb9cd38bdb2209c67deca8eeb9c15ab0300817ac61e4dd11183a13477bf7e860e3670ef0e789f65f1328d6704902cbe7bc04b82d2789cb132b8667c2147661df28d9961b63e1a9cf6c2a660a1fe3c184b751c51160fb20b1c690220b87b20581e7be6ba0dc001c4110555850915148ba532e6ea09c346dfebd38608b3280080005d9a9500000000000000334d83239dd27080851dcac3c12233f9a1fb9c2aec61ce63a38d2fd50117b89a9ab359b4eea0c6e95767d42b4e54861d0227dbfd2e6d7f715a7f3deadd713089856f756436303767d2e24f29e5dad9796edb697a8ad004eea0182babd18cac1bd4f4390af9a9ceafd0002cab154ad029a1090000002780870014751c3c975d5aec84222fd3a0ec4be3e563112f0b39501aafe234870072858dc06e7c337642d3e5a815232f5e16c1b30c3a6a71bc85018e5ff22dc518afc9ffc2cc788bee1b47683db01a2f9398685211dfbbae3e2ed0a50e7313bff5d4c391ddece00fc772dd6b4d4de2a41990f05ca3bdfc92c88c5b8dcd36e7487afa407e2edfae4f390a8337841cef386e22cc22ee17476d738952229682e24b92533ac2a9f5a699593f084419cae0b4532bcc97d3ae526aca54183fb01c73f979ca9857399537f5831808b0dc2a2d0e0000000000000578673f8b6e74ce23877a6b24db0e067345560942fa629fbef2461c96a0c93d47018c12e7ba8188a22e8b15c3e233db00002e30d46a9d24d37cef099ece729aa218f9f44a3210223fdae7ed04935c3c90d3add8eebc8619d73415cda2130f5011e4845535a8b90dfae158b94f50adab188dd8e12baf5cc9398fff00404d5d99f82e20ee6a8c88e18c2977aab37d9ac4cfc1c7b400000000000007ff57c39495c826b956ba859ac8e3c177b91bd7d5e41ff868f7ca1664fe2f3ced846891180604b6dd2499d16d7d9158ffffffff00000000ef069dc42749a89f854797f29d0000002d8c38a967c1bbe09315c29877a308bcc87dc3addb08141bdee5d27874b2f663ddeef0005b4896c7aabf4df517d90bdc01e73835d50200a90800c66ee2b1ad76dff9f9003f07000099d4894ee7f8249dc1e3428d2129369ee1b85af6eb2eea0d0df414b315f651c8412392191fa83ee830548f11e1036a8debd64cbe359454a3f2239cfe35f81b7a490f167e6d5c1109000000000000000042b8ff8c21ad702ccacad5b39eef213d1ca296d2a27798c8ce2a305c0c7d35cf4b22549a4bd92052188bd1f285f653b621491dc6aaee0200e2ff08644fb94c06006eff1be2f633c1d987595ec3db58a7bb3042ec3f771f7a1338a5c3dd35e926049fe86e09c58e273cd905deb28c13c1ed1c0d9cae846bcbfa8cce7b893e578af7dc7d5e87d44ff828de453f34c2b18660b080efc707e676e1fb4d5825c0ca177a4c7fbb4eda0545c00f576b2b5cc7f819abd0f885cc4806f40300966fcf1e54f5a2d38708294cd6f496e547f7ad33850d9feccd0111a2e3700845dee734fe7da3770845cf442d488afd80e17000000000000000000000000000000000000000000000000000005202000000dc1c56d59f35d367632952a93466ae595c6a8cda690d192a070886df42b27098773b45198b4a34ac977ebd4450e121d01342703f5bf030e935878a12489c80aa4252d4ea6b8f6216ff202b5b5a182cb5e838b307632d03a7ca6f6d0339f9953c3093c3690d10ecb65dc5b47481edbf1f000000000000004d16d29c28eb5167e9936ed327fb237a56224e49d9ea955a5f0dec1b3ccd35364600000000000000000000000000000000000000000000000000000000000026ded4dd6fe1518cc7802043ecfe69f743f1213bf8179ecd9e5a225d67521dc728eac7d80a5656ac2cbde21d3ebfbf69ff861f4394836ddf128d6d19079e64336e7c676505c78ad67548f4b192be1827fcd95cf107753cb0a6a979d3db08407081c6281e2d8429a8639034a75f4c7df3ea8fc2018d07af14915f29b719f54926fc32468f65bd06b4092140faed0c329be610c3082d43e121861b5cc03f1a1561f0589e0d12969bc982ff5d8e9b986c0c6c747d9a1cc500bb892c3a16ff10feea20bdac0000000000000000ca06f256c8028e0f9b4c8787361f3289f86ae826c69fa35ba5cbc3f2db1516ffc5c6e3fa618b24a6ce16d6c7010bb37b61fa0a2d8974e69115d33394e86e4b838297ba20f96936b7e4746e92dea6c5d1d33d84d96b50fb000000ae07c65b71088dd7d5d1e1bab9000000000000000000000000b5ace293bec833c13e3229432ad71d646218b5229dd88137fc7c59aa242af3bb4efb82055a3b61227ad40f52c9f2500579aca11033bb9cc16bd83a00840e31d828ec78e116ae46c4897e2795b6ff92e9a1e24b0b855c02f2b7add58ffb25f339297729a7a51810134d3dfbf71f6516737be55c06d9cdcfb1e2bb10b50000eb4acff90756dba1ecf9f58afd3c19b5c4558ba9af6b7333c894a1fb29ade9ad75c9c022e8d03fe28bc358684492aa771dbfe80745fe89ad349ffaad76ff9dd643796caffdf67af5dd476c37e7e9a84e2e5da2696e285a59b53f2fb0e16d8262c080c159ce1d9bc7ef3e3f40c14089c82759106f422582b42e3e8484ea5a6ad9aa520000afe0e0caea1ad4cb23f3c2b8a0f455ba69ea284c268d54b43158a8b1d128d02af263b3dc1cab794c9ac57a2a7332f4d8764c302ccd5aac114482b619fc575aa0dd2777e881e29a854380e2f1e49db5a1517ec40bb3fa44f9959bad67ccaba76408da357f9e93ce055019c9f1534c8bd48bbd61627a2e0a74b5e6aefb7eee403502734137ff47257f164391c672b6079e65d7295eed164ca63e4ea26dce0fb3ce0f6591d80dfb8f386bb74b5589829b6b0679b5d6fccbecfae5553d9950d48c774eaa35b24fce69a20d8bc410d9f48bf7eac90529cd6af061c9e53addddc620ce73c5d177e3d097159f2768636fc10276c6a0adc57483b3f7083f66b87ef296ee85e9bb70a3009a5d30f479e293a3302e11350ea857b37e76ca2f50378e4092ce2c574ad278b9b7b717c571afb2077b019fd9d89efd59b41f051ec5a8ff87ecc8df917a1e386d849fcd10e2f9ca52e02339c2f4666b0c545e25f1cd62421c28d25994be0cff7271a0dee38d7ac4ac736b090e1d29f981fd9086e4000000000000646174b55d251f7f8ca5ccc22a5efb33b237eff5597a3c3a5f3a9bb54abb40e54593e1a7ce4cfa17b3c3fe91c06363496341eae20dcc59b6179b32ddddef5c34000096a54c0c571a91878f61f74912e2299e5501d4d6943bfd74c856511726f0ac8f7d17f1c6b4451c1bcdc6b6e1700e4cd87709d97afc5423c96fa981873d4369b04bbf1fb9f68f17991540868e408201ad1a74179e489aa61f021a437a3fa935588be2068f7ff9b253106326fde795e530b93626cc68e06e602198724249b4445eef08401cd1a3e266db41474e69902e4d8f5da4e94cc36794258fd4032de7ab36bc24c5efd5c8495c1ccd580033c55725f2d60354f8ad5914a0155eaa743350ddb388f486b6de0549ef3b1b3c3b7d4d3a830ff39885776119408029be3788dd8422b1ab7b4c9d5b7d8682fd759c713108e1bdfc64b9121bbf07099def5c0ce3c861ae4b5cad8bba5a0b6059b9ef90c2f96a59320309e25df89484522bb1d6eaa92164f9e4042cb689a45a898354c17b08705205a9189772bcbcb6414e44b33a2470d3bc16f761c33f565b9da5e7991ad8482579cc1b16c1fcec815a5482ae8b1779c5e339971a6ec1217bcfd1ef24284de8a0a9f068f297037d6478c2434a9a18dcc6c7c791e444a79d7ce37f9cf2826b47ad8ca6a2fa254aa02cd098026798a6d336348af0fc11fa2809a5ebbe17ca4d0f889d518f64ee50f562b5fdb1f76d4a7fe14701f8ed0c6a55d66a6efea3e449e6b478abc5b196dd5308cb20c4e2a0bd702651bb39f10523102dcd8ece692159028f314e0d6bfa400475c6699fdc40efe0948e3cef7419a7f113134e5ee20fd87c4521ccfbd32d6f147f743d30866bdd86ca8bf0c7bcc475f4ed53517aaa51f1c151d859a7f0b53abd332c84bdad313e82ac3777a6f7f649ff8a25f6dfe09cb29213896b49a825257bf143e9fa3bbd47009e66fe5705b3ef2b40a182e408c680727d64e00e1ce508f8fd64ac6c84ccc28fc333067de63b9bb5daaa12ce60ee3779ded79651be69d2a413cd948a873dd7ad7017b150828cf100d3df8537f22aff58343c9ee966fceb594bbe10b911427f76a25a219be2f85287b7f83d323a30991067ad1369792166062085ff20c5fb9f6e4f78dd09c7d2d6ca3c8a5d0d26ccbe576f44a1bc94194817"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r7, 0x18000000000002a0, 0xe80, 0x6000, &(0x7f0000000640)="b9ff03076844268cb89e14f088a847e088641100050000210283ac141440e0", 0x0, 0x11, 0x60000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000}, 0x48) (async) r8 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r8, 0x0, 0x0, 0x22004001, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @loopback}, 0x1c) (async) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000009c0)=ANY=[@ANYBLOB="2800000010005fba000000000000b878d5da8a93", @ANYRES32=0x0, @ANYBLOB="80000200e180000008001b0000000000"], 0x28}}, 0x0) 195.108326ms ago: executing program 5 (id=4184): r0 = socket$inet6_udplite(0xa, 0x2, 0x88) connect$inet6(r0, &(0x7f00000000c0)={0xa, 0x4e21, 0x679, @ipv4={'\x00', '\xff\xff', @remote}, 0x1}, 0x1c) getsockopt$inet6_int(r0, 0x29, 0x10, 0x0, 0x0) (async) r1 = syz_init_net_socket$llc(0x1a, 0x2, 0x0) bind$llc(r1, &(0x7f0000000040)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x10) (async) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='blkio.bfq.io_queued\x00', 0x275a, 0x0) (async, rerun: 32) ioctl$F2FS_IOC_MOVE_RANGE(r0, 0xc020f509, &(0x7f0000000180)={r1, 0xffffffffffffffff, 0x4, 0x1}) (async, rerun: 32) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) (async) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) (async) r4 = syz_init_net_socket$ax25(0x3, 0x2, 0xcc) setsockopt$ax25_SO_BINDTODEVICE(r4, 0x101, 0x19, &(0x7f00000001c0)=@bpq0, 0x10) socket$nl_generic(0x10, 0x3, 0x10) (async) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async, rerun: 32) r5 = socket$nl_route(0x10, 0x3, 0x0) (async, rerun: 32) r6 = socket(0x10, 0x803, 0x0) sendmsg$NL80211_CMD_GET_COALESCE(r6, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000400)={0x0, 0x14}}, 0x0) (async) getsockname$packet(r6, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000040)=0x8f) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r8, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)=ANY=[@ANYBLOB="3c0000001000030400000006000000005dcc0300", @ANYRES32=r7, @ANYBLOB="71e79fd800000000140012800c0001006d616376746170001400028008000500", @ANYRES32=r8], 0x3c}}, 0x0) (async, rerun: 64) sendmsg$nl_route_sched(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000640)=@newtfilter={0x24, 0x10, 0x1, 0x0, 0x25dfdbfb, {0x0, 0x0, 0x74, r7, {0xffe0}, {}, {0xa, 0x1}}}, 0x24}, 0x1, 0xf0ffffffffffff, 0x0, 0x400c140}, 0x0) (async, rerun: 64) syz_genetlink_get_family_id$mptcp(&(0x7f0000000140), r3) write$cgroup_int(r2, &(0x7f0000000000), 0xffffff6a) (async, rerun: 64) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) (rerun: 64) sendmsg$NFT_BATCH(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000740)={{0x14, 0x15c}, [@NFT_MSG_NEWFLOWTABLE={0x14, 0x16, 0xa, 0x3, 0x0, 0x0, {0x0, 0x0, 0x9}}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x3c}}, 0x0) sendfile(r1, r2, 0x0, 0xffffffff000) 149.4446ms ago: executing program 0 (id=4185): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x44b, 0x0, 0x0, {0x7a}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bridge={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BR_MCAST_LAST_MEMBER_CNT={0x8, 0x31}]}}}]}, 0x3c}}, 0x0) ioctl$sock_SIOCGIFVLAN_DEL_VLAN_CMD(r0, 0x8982, &(0x7f0000000080)={0x1, 'bridge_slave_1\x00', {}, 0x1}) 38.591788ms ago: executing program 5 (id=4186): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000001080)=ANY=[@ANYBLOB="0a000000050000000200000007"], 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000003c0), &(0x7f00000002c0), 0x75, r1}, 0x38) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x10, &(0x7f00000004c0)=ANY=[@ANYBLOB="18000000040000000000000000000000b7080000000000007b8af8ff00000000b7080000010000007b8af0ff000000003c2830b1212fa553000000000000f0ffffffb702000008000000182300000000800000000200002b8f6794000000000000", @ANYRES32=r1, @ANYRES32], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x30, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0xa, '\x00', 0x0, @fallback=0x31, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) unshare(0x22020600) r3 = socket$unix(0x1, 0x1, 0x0) bind$unix(r3, &(0x7f00000001c0)=@abs={0x1, 0x0, 0x4e23}, 0x6e) bind$unix(r3, &(0x7f0000000000)=@abs={0x1, 0x0, 0x4e24}, 0x2) bpf$BPF_GET_PROG_INFO(0xa, &(0x7f0000000740)={r2, 0x0, 0x0}, 0x10) socket$alg(0x26, 0x5, 0x0) socket$nl_route(0x10, 0x3, 0x0) tee(0xffffffffffffffff, r0, 0x0, 0x8) r4 = socket$inet6(0xa, 0x2, 0x0) syz_emit_ethernet(0x15e, &(0x7f00000003c0)={@random="e33110495bfd", @dev, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "cb653e", 0x128, 0x3a, 0xff, @dev, @local, {[], @ndisc_redir={0x89, 0x0, 0x0, '\x00', @rand_addr=' \x01\x00', @private1, [{0x4, 0x20, "9595f429ae08a5654664601e3b70a44d2e6f790a3872d50bb14d25344dc5b3a281f175f5ee04aab21301b94d966c72c15a143c69205625466855101cf44d89d9f6ee47d77c0d4e53e34b67c542fc6f6f6c60139c43b78286f5bb8f4f11d164af24e2633a45bf4ed944b0ef6a7b7167f73cf54e78686ac09402659c29eb0ce380654c1bb0f61d255b1556b7a311096b7aab867396997ffab76abca01185b08d1e29ee14d8fe61245487104b1c5205c6adc794ba413b92d2d208b86f40983c4819c33b59c1abe2a4b0aa661fcb54e0855d6bb5dd267878ff59bcfc6079e7a5e0135118be22dc6c97e730f7053d6ec34ca11b5c7c3830af6b26868600f042ff"}]}}}}}}, 0x0) setsockopt$inet6_mreq(r4, 0x29, 0x1b, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000300)={'virt_wifi0\x00', 0x0}) recvmmsg(0xffffffffffffffff, &(0x7f0000002440), 0x3ffffffffffff67, 0x0, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f05ebbee1, 0x8031, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r4, 0x89f0, &(0x7f00000002c0)={'syztnl0\x00', &(0x7f0000000340)={'ip6_vti0\x00', r5, 0x2f, 0x2, 0x0, 0x4, 0x32, @remote, @local, 0x20, 0x7800, 0x1000, 0x2}}) socket$packet(0x11, 0x3, 0x300) r6 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_int(r6, 0x11, 0x68, 0x0, &(0x7f0000000140)) socket$inet_tcp(0x2, 0x1, 0x0) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'dummy0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000900)=@newqdisc={0x24, 0x2a, 0x8, 0x4001, 0xfffffdfc, {0x0, 0x0, 0x0, r8, {0x3}, {}, {0x2, 0xfff1}}}, 0x24}, 0x1, 0x0, 0x0, 0x20008091}, 0x4000000) socket$kcm(0x29, 0x0, 0x0) 37.765039ms ago: executing program 0 (id=4187): r0 = socket(0x10, 0x803, 0x0) sendmsg$SMC_PNETID_GET(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000001c0)={0x0, 0x14}}, 0x0) syz_genetlink_get_family_id$devlink(&(0x7f0000000080), r0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000000)={'batadv0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000040)=@newlink={0x34, 0x10, 0x437, 0x3, 0xffffffff, {0x0, 0x0, 0x0, r1, 0x51b4b}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @batadv={{0xb}, {0x4}}}]}, 0x34}, 0x1, 0x0, 0x0, 0x48800}, 0x4) 0s ago: executing program 0 (id=4188): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @multicast1}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x20020084, &(0x7f00000018c0)={0x2, 0x4e20}, 0x10) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="0f000000040000000400"], 0x50) sendmmsg$inet(r0, &(0x7f0000000740)=[{{0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000080)='h', 0x1}], 0x1}}], 0x1, 0x4044001) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000100)={r1, &(0x7f0000000340), &(0x7f0000000040)=@tcp=r0}, 0x20) recvmmsg(r0, &(0x7f0000001140)=[{{0x0, 0x0, &(0x7f0000000ac0)=[{&(0x7f0000000940)=""/249, 0xf9}], 0x1}, 0x2}], 0x1, 0x2, 0x0) kernel console output (not intermixed with test programs): lags 0x0 phys_seg 1 prio class 2 [ 559.410928][ T6887] Buffer I/O error on dev nbd0, logical block 3, async page read [ 559.418979][ T6887] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 559.429197][ T6887] Buffer I/O error on dev nbd0, logical block 0, async page read [ 559.437267][ T6887] I/O error, dev nbd0, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 559.446737][ T6887] Buffer I/O error on dev nbd0, logical block 1, async page read [ 559.457733][ T6887] ldm_validate_partition_table(): Disk read failed. [ 559.467503][ T6887] Dev nbd0: unable to read RDB block 0 [ 559.474577][ T6887] nbd0: unable to read partition table [ 559.486528][ T6887] ldm_validate_partition_table(): Disk read failed. [ 559.495724][ T6887] Dev nbd0: unable to read RDB block 0 [ 559.503076][ T6887] nbd0: unable to read partition table [ 559.519006][ T6887] udevd[6887]: failed to send result of seq 16448 to main daemon: Connection refused [ 609.123947][ C0] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 621.443762][ T52] Bluetooth: hci5: command 0x0406 tx timeout [ 631.683834][ T52] Bluetooth: hci1: command 0x0405 tx timeout [ 651.572179][T18936] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3212'. [ 651.730931][T18943] pimreg3: entered allmulticast mode [ 651.740816][T18952] netlink: 96 bytes leftover after parsing attributes in process `syz.3.3215'. [ 651.872844][T18952] vlan1: entered allmulticast mode [ 651.884635][T18952] erspan0: entered allmulticast mode [ 651.924234][T18953] ip6_vti0 speed is unknown, defaulting to 1000 [ 651.941771][T18956] netlink: 12 bytes leftover after parsing attributes in process `syz.5.3218'. [ 651.953319][T18956] netlink: 'syz.5.3218': attribute type 6 has an invalid length. [ 652.005798][T18960] netlink: 'syz.2.3219': attribute type 1 has an invalid length. [ 652.057017][T18960] netlink: 'syz.2.3219': attribute type 15 has an invalid length. [ 652.108912][T18960] netlink: 'syz.2.3219': attribute type 10 has an invalid length. [ 652.127519][T18960] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 652.143354][T18960] bond0: (slave batadv0): Enslaving as an active interface with an up link [ 652.253548][T18953] wg1 speed is unknown, defaulting to 1000 [ 652.366264][T18965] IPVS: length: 132 != 8 [ 652.472515][T18965] pimreg: entered allmulticast mode [ 652.494183][T18967] netlink: 'syz.2.3221': attribute type 3 has an invalid length. [ 652.540347][T18971] syzkaller0: entered promiscuous mode [ 652.554087][T18971] syzkaller0: entered allmulticast mode [ 652.569759][T18965] pimreg: left allmulticast mode [ 652.981177][T18984] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3225'. [ 653.103454][T18984] xt_addrtype: both incoming and outgoing interface limitation cannot be selected [ 653.209687][T18988] ip6_vti0 speed is unknown, defaulting to 1000 [ 653.226295][T18989] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 653.363790][T18989] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 653.598682][ T5840] team0: Port device syz_tun removed [ 653.627853][ T52] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 653.636013][T18993] sctp: [Deprecated]: syz.2.3227 (pid 18993) Use of int in maxseg socket option. [ 653.636013][T18993] Use struct sctp_assoc_value instead [ 653.656886][ T52] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 653.667482][ T52] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 653.688042][ T52] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 653.695317][T18988] wg1 speed is unknown, defaulting to 1000 [ 653.717795][ T52] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 653.839861][T12768] nci: nci_add_new_protocol: the target found does not have the desired protocol [ 653.854882][T18994] ip6_vti0 speed is unknown, defaulting to 1000 [ 654.190190][T19012] netlink: 'syz.0.3231': attribute type 12 has an invalid length. [ 654.205160][T19010] ip6_vti0 speed is unknown, defaulting to 1000 [ 654.214076][T18994] wg1 speed is unknown, defaulting to 1000 [ 654.277154][T19012] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3231'. [ 654.916496][T19010] wg1 speed is unknown, defaulting to 1000 [ 654.942507][T19024] netlink: 'syz.5.3232': attribute type 12 has an invalid length. [ 655.038175][T18994] chnl_net:caif_netlink_parms(): no params data found [ 655.055808][T19024] netlink: 'syz.5.3232': attribute type 4 has an invalid length. [ 655.465225][T19025] ip6_vti0 speed is unknown, defaulting to 1000 [ 655.551779][T18994] bridge0: port 1(bridge_slave_0) entered blocking state [ 655.562764][T18994] bridge0: port 1(bridge_slave_0) entered disabled state [ 655.570891][T18994] bridge_slave_0: entered allmulticast mode [ 655.579641][T18994] bridge_slave_0: entered promiscuous mode [ 655.591755][T18994] bridge0: port 2(bridge_slave_1) entered blocking state [ 655.599343][T18994] bridge0: port 2(bridge_slave_1) entered disabled state [ 655.607050][T18994] bridge_slave_1: entered allmulticast mode [ 655.616123][T18994] bridge_slave_1: entered promiscuous mode [ 655.730634][T18994] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 655.763815][ T52] Bluetooth: hci3: command tx timeout [ 655.782623][T18994] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 655.803303][T19038] tipc: Enabled bearer , priority 0 [ 655.820773][T19040] syzkaller0: entered promiscuous mode [ 655.833938][T19040] syzkaller0: entered allmulticast mode [ 656.010073][T19025] wg1 speed is unknown, defaulting to 1000 [ 656.017158][T18994] team0: Port device team_slave_0 added [ 656.044811][T19038] tipc: Resetting bearer [ 656.056330][T18994] team0: Port device team_slave_1 added [ 656.078991][T19037] tipc: Resetting bearer [ 656.096192][T19037] tipc: Disabling bearer [ 656.138399][T18994] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 656.146308][T18994] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 656.173215][T18994] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 656.204569][T18994] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 656.211801][T18994] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 656.239188][T18994] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 656.358954][T19045] netlink: 136 bytes leftover after parsing attributes in process `syz.5.3237'. [ 656.386410][T18994] hsr_slave_0: entered promiscuous mode [ 656.393399][T18994] hsr_slave_1: entered promiscuous mode [ 656.400101][T18994] debugfs: 'hsr0' already exists in 'hsr' [ 656.406194][T18994] Cannot create hsr debugfs directory [ 656.873631][T18994] netdevsim netdevsim1 eth3 (unregistering): unset [1, 0] type 2 family 0 port 256 - 0 [ 656.893809][T18994] netdevsim netdevsim1 eth3 (unregistering): unset [1, 1] type 2 family 0 port 6081 - 0 [ 656.985004][T18994] netdevsim netdevsim1 eth2 (unregistering): unset [1, 0] type 2 family 0 port 256 - 0 [ 657.003669][T18994] netdevsim netdevsim1 eth2 (unregistering): unset [1, 1] type 2 family 0 port 6081 - 0 [ 657.036365][T19062] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 657.085949][T18994] netdevsim netdevsim1 eth1 (unregistering): unset [1, 0] type 2 family 0 port 256 - 0 [ 657.096046][T18994] netdevsim netdevsim1 eth1 (unregistering): unset [1, 1] type 2 family 0 port 6081 - 0 [ 657.194444][T18994] netdevsim netdevsim1 eth0 (unregistering): unset [1, 0] type 2 family 0 port 256 - 0 [ 657.215703][T18994] netdevsim netdevsim1 eth0 (unregistering): unset [1, 1] type 2 family 0 port 6081 - 0 [ 657.318641][T19071] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3244'. [ 657.586643][T18994] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 657.627615][T18994] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 657.650820][T18994] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 657.669934][T18994] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 657.760963][T19091] IPv6: NLM_F_CREATE should be specified when creating new route [ 657.816898][T19077] ip6_vti0 speed is unknown, defaulting to 1000 [ 657.848009][ T5147] Bluetooth: hci3: command tx timeout [ 658.115507][T19077] wg1 speed is unknown, defaulting to 1000 [ 658.335050][T18994] 8021q: adding VLAN 0 to HW filter on device bond0 [ 658.369956][T19102] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3250'. [ 658.407010][T18994] 8021q: adding VLAN 0 to HW filter on device team0 [ 658.632923][T12768] bridge0: port 1(bridge_slave_0) entered blocking state [ 658.640132][T12768] bridge0: port 1(bridge_slave_0) entered forwarding state [ 658.703137][T12768] bridge0: port 2(bridge_slave_1) entered blocking state [ 658.710389][T12768] bridge0: port 2(bridge_slave_1) entered forwarding state [ 658.866260][T19114] syzkaller0: entered promiscuous mode [ 658.871909][T19114] syzkaller0: entered allmulticast mode [ 659.078586][T19118] ip6_vti0 speed is unknown, defaulting to 1000 [ 659.434885][T19137] bridge0: port 2(bridge_slave_1) entered disabled state [ 659.442734][T19137] bridge0: port 1(bridge_slave_0) entered disabled state [ 659.495179][T19138] bridge0: port 2(bridge_slave_1) entered blocking state [ 659.502473][T19138] bridge0: port 2(bridge_slave_1) entered forwarding state [ 659.510044][T19138] bridge0: port 1(bridge_slave_0) entered blocking state [ 659.517250][T19138] bridge0: port 1(bridge_slave_0) entered forwarding state [ 659.544271][T19138] bridge0: entered promiscuous mode [ 659.546337][T19137] netlink: 'syz.0.3259': attribute type 15 has an invalid length. [ 659.549516][T19138] bridge0: entered allmulticast mode [ 659.588017][T19118] wg1 speed is unknown, defaulting to 1000 [ 659.619711][T19146] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 659.631802][T18994] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 659.691618][T19143] ip6_vti0 speed is unknown, defaulting to 1000 [ 659.713261][T19146] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 659.923680][ T5147] Bluetooth: hci3: command 0x040f tx timeout [ 659.940534][T19152] netlink: 'syz.5.3264': attribute type 2 has an invalid length. [ 659.954652][T19152] netlink: 16 bytes leftover after parsing attributes in process `syz.5.3264'. [ 659.973800][T19152] A link change request failed with some changes committed already. Interface ip6tnl0 may have been left with an inconsistent configuration, please check. [ 659.990098][T19143] wg1 speed is unknown, defaulting to 1000 [ 660.118721][T19165] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3267'. [ 660.132655][T19167] netlink: 'syz.5.3269': attribute type 2 has an invalid length. [ 660.160059][T18994] veth0_vlan: entered promiscuous mode [ 660.166158][T19167] netlink: 'syz.5.3269': attribute type 1 has an invalid length. [ 660.208206][T19167] netlink: 152 bytes leftover after parsing attributes in process `syz.5.3269'. [ 660.360954][T19165] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3267'. [ 660.418090][T12765] netdevsim netdevsim0 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 660.443969][T12765] netdevsim netdevsim0 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 660.540791][T18994] veth1_vlan: entered promiscuous mode [ 660.568570][T12765] netdevsim netdevsim0 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 660.596457][T12765] netdevsim netdevsim0 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 660.720085][T18994] veth0_macvtap: entered promiscuous mode [ 660.738044][T18994] veth1_macvtap: entered promiscuous mode [ 660.783829][T18994] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 660.811383][T18994] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 660.833308][T12765] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 660.868032][T12765] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 660.894641][T12765] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 660.930875][T12765] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 661.149392][T19185] ip6_vti0 speed is unknown, defaulting to 1000 [ 661.156798][T19196] netlink: 'syz.2.3278': attribute type 1 has an invalid length. [ 661.330301][T19202] netlink: 92 bytes leftover after parsing attributes in process `syz.0.3279'. [ 661.359677][ T8176] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 661.389959][ T8176] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 661.520771][T19185] wg1 speed is unknown, defaulting to 1000 [ 661.746489][T19214] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3283'. [ 661.861333][T19217] netlink: 'syz.0.3283': attribute type 298 has an invalid length. [ 661.883279][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 661.902554][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 662.025622][ T5147] Bluetooth: hci3: command 0x040f tx timeout [ 662.160342][T19237] netlink: 'syz.2.3287': attribute type 13 has an invalid length. [ 662.168600][T19237] netlink: 'syz.2.3287': attribute type 17 has an invalid length. [ 662.459917][T19237] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 662.854710][T19247] ip6_vti0 speed is unknown, defaulting to 1000 [ 663.007770][T19262] geneve2: entered promiscuous mode [ 663.027200][ T12] netdevsim netdevsim5 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 663.064234][ T12] netdevsim netdevsim5 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 663.087509][T19262] netlink: 4 bytes leftover after parsing attributes in process `syz.5.3291'. [ 663.099617][ T12] netdevsim netdevsim5 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 663.121072][ T12] netdevsim netdevsim5 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 663.236622][T19247] wg1 speed is unknown, defaulting to 1000 [ 663.572553][T19277] syz_tun: entered allmulticast mode [ 663.663480][T19277] infiniband syz0: RDMA CMA: cma_listen_on_dev, error -98 [ 663.700132][T19282] netlink: 'syz.2.3298': attribute type 1 has an invalid length. [ 663.829913][T19287] netlink: 20 bytes leftover after parsing attributes in process `syz.2.3298'. [ 664.071359][T19286] bond1: (slave vxcan3): The slave device specified does not support setting the MAC address [ 664.084290][ T5147] Bluetooth: hci3: command 0x040f tx timeout [ 664.098665][T19286] bond1: (slave vxcan3): Error -95 calling set_mac_address [ 664.169731][T19287] bond1: (slave bridge1): Enslaving as an active interface with a down link [ 664.237168][T19289] syzkaller0: entered promiscuous mode [ 664.242682][T19289] syzkaller0: entered allmulticast mode [ 664.270873][T19300] FAULT_INJECTION: forcing a failure. [ 664.270873][T19300] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 664.315611][T19300] CPU: 0 UID: 0 PID: 19300 Comm: syz.5.3302 Not tainted syzkaller #0 PREEMPT(full) [ 664.315638][T19300] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 664.315650][T19300] Call Trace: [ 664.315657][T19300] [ 664.315665][T19300] dump_stack_lvl+0x189/0x250 [ 664.315693][T19300] ? __pfx____ratelimit+0x10/0x10 [ 664.315714][T19300] ? __pfx_dump_stack_lvl+0x10/0x10 [ 664.315734][T19300] ? __pfx__printk+0x10/0x10 [ 664.315749][T19300] ? __might_fault+0xb0/0x130 [ 664.315779][T19300] should_fail_ex+0x414/0x560 [ 664.315807][T19300] _copy_from_user+0x2d/0xb0 [ 664.315828][T19300] ___sys_sendmsg+0x158/0x2a0 [ 664.315850][T19300] ? __pfx____sys_sendmsg+0x10/0x10 [ 664.315915][T19300] ? __might_fault+0xb0/0x130 [ 664.315941][T19300] __sys_sendmmsg+0x227/0x430 [ 664.315968][T19300] ? __pfx___sys_sendmmsg+0x10/0x10 [ 664.315998][T19300] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 664.316040][T19300] ? ksys_write+0x22a/0x250 [ 664.316066][T19300] ? __pfx_ksys_write+0x10/0x10 [ 664.316091][T19300] __x64_sys_sendmmsg+0xa0/0xc0 [ 664.316114][T19300] do_syscall_64+0xfa/0xfa0 [ 664.316133][T19300] ? lockdep_hardirqs_on+0x9c/0x150 [ 664.316154][T19300] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 664.316171][T19300] ? clear_bhb_loop+0x60/0xb0 [ 664.316192][T19300] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 664.316209][T19300] RIP: 0033:0x7f8e7158f749 [ 664.316225][T19300] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 664.316238][T19300] RSP: 002b:00007f8e6f7f6038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 664.316256][T19300] RAX: ffffffffffffffda RBX: 00007f8e717e5fa0 RCX: 00007f8e7158f749 [ 664.316267][T19300] RDX: 0400000000000292 RSI: 0000200000002c40 RDI: 0000000000000003 [ 664.316278][T19300] RBP: 00007f8e6f7f6090 R08: 0000000000000000 R09: 0000000000000000 [ 664.316288][T19300] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 664.316297][T19300] R13: 00007f8e717e6038 R14: 00007f8e717e5fa0 R15: 00007ffc35011f68 [ 664.316325][T19300] [ 664.660314][T19276] syz_tun: left allmulticast mode [ 664.837325][T19319] syzkaller0: entered promiscuous mode [ 664.842844][T19319] syzkaller0: entered allmulticast mode [ 664.858717][T19322] netlink: 48 bytes leftover after parsing attributes in process `syz.2.3310'. [ 664.985161][T19324] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3311'. [ 665.811081][T19362] syzkaller0: entered promiscuous mode [ 665.824261][T19362] syzkaller0: entered allmulticast mode [ 665.843484][T19366] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3317'. [ 665.958329][T19375] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3320'. [ 665.969370][T19375] netlink: 20 bytes leftover after parsing attributes in process `syz.2.3320'. [ 666.100115][T19377] batadv_slave_1: entered promiscuous mode [ 666.171952][T19378] batadv_slave_1: left promiscuous mode [ 666.202223][T19383] IPVS: set_ctl: invalid protocol: 28777 114.101.48.0:0 [ 666.321875][T19396] netlink: 20 bytes leftover after parsing attributes in process `syz.1.3327'. [ 666.461435][T19409] x_tables: ip_tables: recent.0 match: invalid size 216 (kernel) != (user) 4096 [ 666.599750][T19413] ip6_vti0 speed is unknown, defaulting to 1000 [ 666.901110][T19426] syzkaller0: entered promiscuous mode [ 666.923310][T19426] syzkaller0: entered allmulticast mode [ 666.946132][T19428] syzkaller0: entered promiscuous mode [ 666.951849][T19428] syzkaller0: entered allmulticast mode [ 667.007904][T19413] wg1 speed is unknown, defaulting to 1000 [ 667.216941][T19436] openvswitch: netlink: Key type 114 is out of range max 32 [ 667.276859][T19432] bond1: up delay (1024) is not a multiple of miimon (100), value rounded to 1000 ms [ 667.288385][T19432] bond1: down delay (4) is not a multiple of miimon (100), value rounded to 0 ms [ 668.012924][T19470] netlink: 'syz.3.3346': attribute type 21 has an invalid length. [ 668.035539][T19470] netlink: 128 bytes leftover after parsing attributes in process `syz.3.3346'. [ 668.301828][T19455] netlink: 32 bytes leftover after parsing attributes in process `syz.1.3344'. [ 668.315765][T19470] netlink: 'syz.3.3346': attribute type 4 has an invalid length. [ 668.336665][T19470] netlink: 'syz.3.3346': attribute type 5 has an invalid length. [ 668.367797][T19470] netlink: 3 bytes leftover after parsing attributes in process `syz.3.3346'. [ 668.397706][T19476] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3347'. [ 668.454686][T19478] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3348'. [ 668.669054][T19487] syzkaller0: entered promiscuous mode [ 668.683722][T19487] syzkaller0: entered allmulticast mode [ 668.740048][T10760] IPVS: starting estimator thread 0... [ 668.745575][T19491] ip6_vti0 speed is unknown, defaulting to 1000 [ 668.765823][T19497] IPVS: set_ctl: invalid protocol: 11608 172.20.20.11:20001 [ 668.853693][T19499] IPVS: using max 32 ests per chain, 76800 per kthread [ 668.889565][T19507] netlink: 'syz.1.3357': attribute type 1 has an invalid length. [ 669.072272][T19507] gretap1: entered promiscuous mode [ 669.101113][T19510] syzkaller0: entered promiscuous mode [ 669.118233][T19510] syzkaller0: entered allmulticast mode [ 669.126234][T19517] netlink: 'syz.0.3359': attribute type 8 has an invalid length. [ 669.159208][T19507] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3357'. [ 669.358503][T19521] warn_alloc: 3 callbacks suppressed [ 669.358520][T19521] syz.5.3360: vmalloc error: size 16781312, failed to allocated page array size 32776, mode:0xdc2(GFP_KERNEL|__GFP_HIGHMEM|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 669.397316][T19521] CPU: 1 UID: 0 PID: 19521 Comm: syz.5.3360 Not tainted syzkaller #0 PREEMPT(full) [ 669.397342][T19521] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 669.397353][T19521] Call Trace: [ 669.397361][T19521] [ 669.397369][T19521] dump_stack_lvl+0x189/0x250 [ 669.397400][T19521] ? __pfx_dump_stack_lvl+0x10/0x10 [ 669.397423][T19521] ? __pfx__printk+0x10/0x10 [ 669.397442][T19521] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 669.397465][T19521] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 669.397489][T19521] ? cpuset_print_current_mems_allowed+0x2ee/0x360 [ 669.397515][T19521] warn_alloc+0x214/0x310 [ 669.397546][T19521] ? __pfx_warn_alloc+0x10/0x10 [ 669.397578][T19521] ? __get_vm_area_node+0x28f/0x300 [ 669.397601][T19521] ? xskq_create+0xbf/0x170 [ 669.397626][T19521] __vmalloc_node_range_noprof+0x690/0x12d0 [ 669.397681][T19521] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 669.397709][T19521] ? __kasan_kmalloc+0x93/0xb0 [ 669.397731][T19521] vmalloc_user_noprof+0xad/0xf0 [ 669.397755][T19521] ? xskq_create+0xbf/0x170 [ 669.397780][T19521] xskq_create+0xbf/0x170 [ 669.397804][T19521] xsk_init_queue+0xb0/0x110 [ 669.397827][T19521] xsk_setsockopt+0x57b/0x8d0 [ 669.397849][T19521] ? __pfx_xsk_setsockopt+0x10/0x10 [ 669.397872][T19521] ? __pfx_aa_sk_perm+0x10/0x10 [ 669.397898][T19521] ? aa_sock_opt_perm+0xff/0x1b0 [ 669.397926][T19521] ? bpf_lsm_socket_setsockopt+0x9/0x20 [ 669.397943][T19521] ? __pfx_xsk_setsockopt+0x10/0x10 [ 669.397963][T19521] do_sock_setsockopt+0x17c/0x1b0 [ 669.397990][T19521] __x64_sys_setsockopt+0x13f/0x1b0 [ 669.398017][T19521] do_syscall_64+0xfa/0xfa0 [ 669.398037][T19521] ? lockdep_hardirqs_on+0x9c/0x150 [ 669.398066][T19521] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 669.398083][T19521] ? clear_bhb_loop+0x60/0xb0 [ 669.398105][T19521] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 669.398121][T19521] RIP: 0033:0x7f8e7158f749 [ 669.398137][T19521] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 669.398152][T19521] RSP: 002b:00007f8e6f7d5038 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 669.398171][T19521] RAX: ffffffffffffffda RBX: 00007f8e717e6090 RCX: 00007f8e7158f749 [ 669.398185][T19521] RDX: 0000000000000003 RSI: 000000000000011b RDI: 0000000000000003 [ 669.398195][T19521] RBP: 00007f8e71613f91 R08: 0000000000000004 R09: 0000000000000000 [ 669.398206][T19521] R10: 0000200000001780 R11: 0000000000000246 R12: 0000000000000000 [ 669.398218][T19521] R13: 00007f8e717e6128 R14: 00007f8e717e6090 R15: 00007ffc35011f68 [ 669.398250][T19521] [ 669.398257][T19521] Mem-Info: [ 669.667268][T19521] active_anon:5622 inactive_anon:0 isolated_anon:0 [ 669.667268][T19521] active_file:3597 inactive_file:40116 isolated_file:0 [ 669.667268][T19521] unevictable:768 dirty:287 writeback:0 [ 669.667268][T19521] slab_reclaimable:12855 slab_unreclaimable:153225 [ 669.667268][T19521] mapped:33630 shmem:1387 pagetables:1046 [ 669.667268][T19521] sec_pagetables:0 bounce:0 [ 669.667268][T19521] kernel_misc_reclaimable:0 [ 669.667268][T19521] free:1265718 free_pcp:16757 free_cma:0 [ 669.717672][T19521] Node 0 active_anon:22488kB inactive_anon:0kB active_file:14388kB inactive_file:160260kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:134520kB dirty:1148kB writeback:0kB shmem:4012kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:13892kB pagetables:3944kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 669.751961][T19521] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:48kB pagetables:140kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 669.786557][T19521] Node 0 DMA free:15360kB boost:0kB min:204kB low:252kB high:300kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 669.818398][T19521] lowmem_reserve[]: 0 2504 2504 2504 2504 [ 669.825155][T19521] Node 0 DMA32 free:1154976kB boost:0kB min:34308kB low:42884kB high:51460kB reserved_highatomic:0KB free_highatomic:0KB active_anon:22388kB inactive_anon:0kB active_file:14388kB inactive_file:160260kB unevictable:1536kB writepending:1148kB zspages:0kB present:3129332kB managed:2564988kB mlocked:0kB bounce:0kB free_pcp:51164kB local_pcp:22724kB free_cma:0kB [ 669.861017][T19521] lowmem_reserve[]: 0 0 0 0 0 [ 669.865973][T19521] Node 0 Normal free:0kB boost:0kB min:0kB low:0kB high:0kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:108kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 669.901065][T19521] lowmem_reserve[]: 0 0 0 0 0 [ 669.906190][T19521] Node 1 Normal free:3892536kB boost:0kB min:55592kB low:69488kB high:83384kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:1536kB writepending:0kB zspages:0kB present:4194300kB managed:4111100kB mlocked:0kB bounce:0kB free_pcp:16648kB local_pcp:7712kB free_cma:0kB [ 669.947865][T19521] lowmem_reserve[]: 0 0 0 0 0 [ 669.952918][T19521] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 669.969102][T19521] Node 0 DMA32: 557*4kB (UE) 735*8kB (UME) 501*16kB (UME) 577*32kB (UME) 224*64kB (UME) 125*128kB (UME) 181*256kB (UME) 71*512kB (UME) 38*1024kB (UM) 7*2048kB (UME) 232*4096kB (UM) = 1151132kB [ 669.988996][T19521] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 670.000851][T19521] Node 1 Normal: 180*4kB (UE) 45*8kB (UME) 52*16kB (UME) 86*32kB (UME) 34*64kB (UME) 9*128kB (UME) 2*256kB (M) 2*512kB (M) 2*1024kB (ME) 1*2048kB (E) 947*4096kB (UM) = 3892536kB [ 670.019660][T19521] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 670.029376][T19521] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 670.039151][T19521] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 670.048907][T19521] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 670.060472][T19521] 45084 total pagecache pages [ 670.065250][T19521] 0 pages in swap cache [ 670.069414][T19521] Free swap = 124996kB [ 670.074075][T19521] Total swap = 124996kB [ 670.078261][T19521] 2097051 pages RAM [ 670.082096][T19521] 0 pages HighMem/MovableOnly [ 670.087305][T19521] 424162 pages reserved [ 670.091486][T19521] 0 pages cma reserved [ 670.106860][T19495] ip6_vti0 speed is unknown, defaulting to 1000 [ 670.113380][T19491] wg1 speed is unknown, defaulting to 1000 [ 670.609305][T19515] ip6_vti0 speed is unknown, defaulting to 1000 [ 670.623415][T19495] wg1 speed is unknown, defaulting to 1000 [ 670.762151][T19557] netlink: 4 bytes leftover after parsing attributes in process `syz.5.3368'. [ 670.807732][T19551] A link change request failed with some changes committed already. Interface veth1_vlan may have been left with an inconsistent configuration, please check. [ 670.957707][T19560] syzkaller0: entered promiscuous mode [ 670.972753][T19560] syzkaller0: entered allmulticast mode [ 671.089828][T19561] svc: failed to register nfsdv3 RPC service (errno 111). [ 671.129847][T19517] ip6_vti0 speed is unknown, defaulting to 1000 [ 671.130360][T19561] svc: failed to register nfsaclv3 RPC service (errno 111). [ 671.302834][T19546] ip6_vti0 speed is unknown, defaulting to 1000 [ 671.302850][T19515] wg1 speed is unknown, defaulting to 1000 [ 671.564897][T19546] wg1 speed is unknown, defaulting to 1000 [ 671.643055][T19517] wg1 speed is unknown, defaulting to 1000 [ 672.363070][T19577] can: request_module (can-proto-4) failed. [ 672.650548][ T5147] Bluetooth: hci2: command 0x0406 tx timeout [ 672.799726][T19586] ip6_vti0 speed is unknown, defaulting to 1000 [ 673.102517][T19605] FAULT_INJECTION: forcing a failure. [ 673.102517][T19605] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 673.163675][T19605] CPU: 1 UID: 0 PID: 19605 Comm: syz.1.3383 Not tainted syzkaller #0 PREEMPT(full) [ 673.163700][T19605] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 673.163710][T19605] Call Trace: [ 673.163717][T19605] [ 673.163724][T19605] dump_stack_lvl+0x189/0x250 [ 673.163759][T19605] ? __pfx____ratelimit+0x10/0x10 [ 673.163781][T19605] ? __pfx_dump_stack_lvl+0x10/0x10 [ 673.163802][T19605] ? __pfx__printk+0x10/0x10 [ 673.163820][T19605] ? __might_fault+0xb0/0x130 [ 673.163852][T19605] should_fail_ex+0x414/0x560 [ 673.163880][T19605] _copy_from_user+0x2d/0xb0 [ 673.163901][T19605] __sys_bpf+0x1e3/0x860 [ 673.163922][T19605] ? __pfx___sys_bpf+0x10/0x10 [ 673.163955][T19605] ? ksys_write+0x22a/0x250 [ 673.163980][T19605] ? __pfx_ksys_write+0x10/0x10 [ 673.164006][T19605] __x64_sys_bpf+0x7c/0x90 [ 673.164030][T19605] do_syscall_64+0xfa/0xfa0 [ 673.164050][T19605] ? lockdep_hardirqs_on+0x9c/0x150 [ 673.164071][T19605] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 673.164087][T19605] ? clear_bhb_loop+0x60/0xb0 [ 673.164108][T19605] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 673.164124][T19605] RIP: 0033:0x7f653a38f749 [ 673.164141][T19605] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 673.164155][T19605] RSP: 002b:00007f653b22b038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 673.164174][T19605] RAX: ffffffffffffffda RBX: 00007f653a5e6090 RCX: 00007f653a38f749 [ 673.164187][T19605] RDX: 0000000000000038 RSI: 0000200000000000 RDI: 000000000000001a [ 673.164198][T19605] RBP: 00007f653b22b090 R08: 0000000000000000 R09: 0000000000000000 [ 673.164208][T19605] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 673.164218][T19605] R13: 00007f653a5e6128 R14: 00007f653a5e6090 R15: 00007ffcbf145048 [ 673.164249][T19605] [ 673.366129][T19605] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3383'. [ 673.486519][T19586] wg1 speed is unknown, defaulting to 1000 [ 673.503613][T19602] ip6_vti0 speed is unknown, defaulting to 1000 [ 673.687133][T19621] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3384'. [ 673.920605][T19602] wg1 speed is unknown, defaulting to 1000 [ 673.930143][T19611] ip6_vti0 speed is unknown, defaulting to 1000 [ 674.319434][T19623] ip6_vti0 speed is unknown, defaulting to 1000 [ 674.450678][T19626] ip6_vti0 speed is unknown, defaulting to 1000 [ 674.452171][T19638] netlink: 36 bytes leftover after parsing attributes in process `syz.0.3388'. [ 674.467178][T19638] netlink: 16 bytes leftover after parsing attributes in process `syz.0.3388'. [ 674.476610][T19638] netlink: 36 bytes leftover after parsing attributes in process `syz.0.3388'. [ 674.486251][T19638] netlink: 36 bytes leftover after parsing attributes in process `syz.0.3388'. [ 674.622841][T19626] wg1 speed is unknown, defaulting to 1000 [ 674.630959][T19611] wg1 speed is unknown, defaulting to 1000 [ 674.649190][T19623] wg1 speed is unknown, defaulting to 1000 [ 674.660000][T19634] ip6_vti0 speed is unknown, defaulting to 1000 [ 675.238625][T19634] wg1 speed is unknown, defaulting to 1000 [ 675.469197][T19642] netlink: 'syz.1.3389': attribute type 11 has an invalid length. [ 675.488115][T19642] netlink: 224 bytes leftover after parsing attributes in process `syz.1.3389'. [ 675.501613][T19642] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3389'. [ 675.588193][T19643] bridge0: entered promiscuous mode [ 675.596051][T19643] bridge0: port 3(macvtap1) entered blocking state [ 675.602704][T19643] bridge0: port 3(macvtap1) entered disabled state [ 675.612764][T19643] macvtap1: entered allmulticast mode [ 675.618699][T19643] bridge0: entered allmulticast mode [ 675.638487][T19643] macvtap1: left allmulticast mode [ 675.643937][T19643] bridge0: left allmulticast mode [ 675.656595][T19643] bridge0: left promiscuous mode [ 675.801235][T19642] geneve0: entered promiscuous mode [ 675.817232][T19642] geneve0: entered allmulticast mode [ 675.826352][T19644] geneve0: left promiscuous mode [ 675.831638][T19644] geneve0: left allmulticast mode [ 676.394451][T19662] 8021q: adding VLAN 0 to HW filter on device bond8 [ 676.408097][T19658] syzkaller0: entered promiscuous mode [ 676.415404][T19658] syzkaller0: entered allmulticast mode [ 676.520645][T19665] bridge0: port 2(bridge_slave_1) entered disabled state [ 676.528435][T19665] bridge0: port 1(bridge_slave_0) entered disabled state [ 676.682578][T19683] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3399'. [ 676.709158][T19665] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 676.723367][T19665] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 676.891065][T12765] netdevsim netdevsim1 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 676.903144][T12765] netdevsim netdevsim1 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 676.912497][T12765] netdevsim netdevsim1 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 676.987105][T12765] netdevsim netdevsim1 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 677.021341][T19679] ip6_vti0 speed is unknown, defaulting to 1000 [ 677.087560][T19688] syzkaller0: entered promiscuous mode [ 677.096594][T19688] syzkaller0: entered allmulticast mode [ 677.451363][T19705] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 677.519645][T19705] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 678.573923][ T5147] Bluetooth: hci3: command 0x040f tx timeout [ 679.435167][T19686] ip6_vti0 speed is unknown, defaulting to 1000 [ 679.443190][T19679] wg1 speed is unknown, defaulting to 1000 [ 679.708071][T12765] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 679.737678][T12765] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 679.802025][T19686] wg1 speed is unknown, defaulting to 1000 [ 679.845264][T19717] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3405'. [ 679.864812][T19700] ip6_vti0 speed is unknown, defaulting to 1000 [ 680.142794][T19726] gretap1: entered allmulticast mode [ 680.215041][T19710] ip6_vti0 speed is unknown, defaulting to 1000 [ 680.498222][T19700] wg1 speed is unknown, defaulting to 1000 [ 680.525714][T19710] wg1 speed is unknown, defaulting to 1000 [ 682.096498][T19773] FAULT_INJECTION: forcing a failure. [ 682.096498][T19773] name failslab, interval 1, probability 0, space 0, times 0 [ 682.121177][T19773] CPU: 0 UID: 0 PID: 19773 Comm: syz.2.3418 Not tainted syzkaller #0 PREEMPT(full) [ 682.121205][T19773] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 682.121215][T19773] Call Trace: [ 682.121223][T19773] [ 682.121231][T19773] dump_stack_lvl+0x189/0x250 [ 682.121258][T19773] ? __pfx____ratelimit+0x10/0x10 [ 682.121280][T19773] ? __pfx_dump_stack_lvl+0x10/0x10 [ 682.121302][T19773] ? __pfx__printk+0x10/0x10 [ 682.121323][T19773] ? __pfx___might_resched+0x10/0x10 [ 682.121342][T19773] ? fs_reclaim_acquire+0x7d/0x100 [ 682.121364][T19773] should_fail_ex+0x414/0x560 [ 682.121394][T19773] should_failslab+0xa8/0x100 [ 682.121414][T19773] kmem_cache_alloc_node_noprof+0x77/0x710 [ 682.121437][T19773] ? __alloc_skb+0x255/0x430 [ 682.121455][T19773] ? napi_skb_cache_get+0x4a5/0x790 [ 682.121472][T19773] ? napi_skb_cache_get+0x151/0x790 [ 682.121494][T19773] __alloc_skb+0x255/0x430 [ 682.121516][T19773] ? __pfx___alloc_skb+0x10/0x10 [ 682.121533][T19773] ? __kasan_save_free_info+0x46/0x50 [ 682.121552][T19773] ? kmem_cache_free+0x19b/0x690 [ 682.121573][T19773] ? unix_dgram_sendmsg+0x570/0x1840 [ 682.121590][T19773] ? __sock_sendmsg+0x21c/0x270 [ 682.121611][T19773] ? ___sys_sendmsg+0x21f/0x2a0 [ 682.121629][T19773] ? __sys_sendmmsg+0x227/0x430 [ 682.121647][T19773] ? __x64_sys_sendmmsg+0xa0/0xc0 [ 682.121671][T19773] alloc_skb_with_frags+0xca/0x890 [ 682.121707][T19773] sock_alloc_send_pskb+0x84d/0x980 [ 682.121748][T19773] ? __pfx_sock_alloc_send_pskb+0x10/0x10 [ 682.121769][T19773] ? lockdep_hardirqs_on+0x9c/0x150 [ 682.121796][T19773] ? unix_dgram_sendmsg+0x570/0x1840 [ 682.121812][T19773] ? kmem_cache_free+0x19b/0x690 [ 682.121836][T19773] ? bpf_lsm_socket_getpeersec_dgram+0x9/0x20 [ 682.121859][T19773] unix_dgram_sendmsg+0x454/0x1840 [ 682.121882][T19773] ? __lock_acquire+0xab9/0xd20 [ 682.121918][T19773] ? __pfx_unix_dgram_sendmsg+0x10/0x10 [ 682.121935][T19773] ? tomoyo_socket_sendmsg_permission+0x1e1/0x300 [ 682.121970][T19773] ? unix_seqpacket_sendmsg+0x111/0x1e0 [ 682.121994][T19773] ? __pfx_unix_seqpacket_sendmsg+0x10/0x10 [ 682.122013][T19773] __sock_sendmsg+0x21c/0x270 [ 682.122041][T19773] ____sys_sendmsg+0x52d/0x830 [ 682.122068][T19773] ? __pfx_____sys_sendmsg+0x10/0x10 [ 682.122099][T19773] ? import_iovec+0x74/0xa0 [ 682.122124][T19773] ___sys_sendmsg+0x21f/0x2a0 [ 682.122148][T19773] ? __pfx____sys_sendmsg+0x10/0x10 [ 682.122215][T19773] ? __might_fault+0xb0/0x130 [ 682.122242][T19773] __sys_sendmmsg+0x227/0x430 [ 682.122269][T19773] ? __pfx___sys_sendmmsg+0x10/0x10 [ 682.122300][T19773] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 682.122341][T19773] ? ksys_write+0x22a/0x250 [ 682.122366][T19773] ? __pfx_ksys_write+0x10/0x10 [ 682.122394][T19773] __x64_sys_sendmmsg+0xa0/0xc0 [ 682.122418][T19773] do_syscall_64+0xfa/0xfa0 [ 682.122438][T19773] ? lockdep_hardirqs_on+0x9c/0x150 [ 682.122458][T19773] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 682.122475][T19773] ? clear_bhb_loop+0x60/0xb0 [ 682.122496][T19773] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 682.122512][T19773] RIP: 0033:0x7fce18f8f749 [ 682.122529][T19773] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 682.122543][T19773] RSP: 002b:00007fce171f6038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 682.122563][T19773] RAX: ffffffffffffffda RBX: 00007fce191e5fa0 RCX: 00007fce18f8f749 [ 682.122576][T19773] RDX: 0400000000000292 RSI: 0000200000002c40 RDI: 0000000000000003 [ 682.122588][T19773] RBP: 00007fce171f6090 R08: 0000000000000000 R09: 0000000000000000 [ 682.122599][T19773] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 682.122609][T19773] R13: 00007fce191e6038 R14: 00007fce191e5fa0 R15: 00007fff9fc90e18 [ 682.122641][T19773] [ 682.635722][T19781] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3421'. [ 682.649361][T19781] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3421'. [ 682.690137][T19781] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3421'. [ 682.800908][T19783] ip6_vti0 speed is unknown, defaulting to 1000 [ 683.029639][T19798] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3425'. [ 683.159278][T19783] wg1 speed is unknown, defaulting to 1000 [ 683.821586][T19839] netlink: 'syz.2.3437': attribute type 1 has an invalid length. [ 683.869855][T19839] 8021q: adding VLAN 0 to HW filter on device bond2 [ 683.892644][T19842] 8021q: adding VLAN 0 to HW filter on device bond2 [ 683.899925][T19842] bond2: (slave vxcan3): The slave device specified does not support setting the MAC address [ 683.911368][T19842] bond2: (slave vxcan3): Error -95 calling set_mac_address [ 683.948545][T19839] veth5: entered promiscuous mode [ 683.958976][T19839] bond2: (slave veth5): Enslaving as an active interface with a down link [ 684.502224][T19866] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3444'. [ 684.735218][T19870] netlink: 'syz.0.3446': attribute type 1 has an invalid length. [ 685.032306][T12769] netdevsim netdevsim5 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 685.046647][T12769] netdevsim netdevsim5 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 685.137957][T12769] netdevsim netdevsim5 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 685.161335][ T52] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 685.174437][ T52] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 685.184215][ T52] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 685.209248][ T52] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 685.219338][ T52] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 685.243659][T12769] netdevsim netdevsim5 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 685.382676][T12769] netdevsim netdevsim5 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 685.394851][T12769] netdevsim netdevsim5 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 685.469897][T19890] ip6_vti0 speed is unknown, defaulting to 1000 [ 685.499495][T12769] netdevsim netdevsim5 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 685.548818][T12769] netdevsim netdevsim5 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 685.591990][T19900] netlink: 1216 bytes leftover after parsing attributes in process `syz.0.3452'. [ 685.647550][T19900] netlink: 4436 bytes leftover after parsing attributes in process `syz.0.3452'. [ 685.671233][T19903] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3454'. [ 685.744853][T19903] bond1: entered promiscuous mode [ 685.750498][T19903] 8021q: adding VLAN 0 to HW filter on device bond1 [ 685.856810][T19902] 8021q: adding VLAN 0 to HW filter on device bond2 [ 685.866279][T19902] bond2: entered promiscuous mode [ 685.889972][T19909] netlink: 'syz.2.3455': attribute type 39 has an invalid length. [ 685.901894][T19902] bond1: (slave bond2): Enslaving as an active interface with an up link [ 685.920242][T19890] wg1 speed is unknown, defaulting to 1000 [ 686.100084][T12769] bridge_slave_1: left allmulticast mode [ 686.106591][T12769] bridge_slave_1: left promiscuous mode [ 686.113920][T12769] bridge0: port 2(bridge_slave_1) entered disabled state [ 686.142783][T12769] bridge_slave_0: left allmulticast mode [ 686.155133][T12769] bridge_slave_0: left promiscuous mode [ 686.171226][T12769] bridge0: port 1(bridge_slave_0) entered disabled state [ 686.495825][T19927] Cannot find set identified by id 0 to match [ 686.643955][ T52] Bluetooth: hci3: command 0x040f tx timeout [ 686.689200][T19934] Bluetooth: MGMT ver 1.23 [ 687.000343][T19940] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3463'. [ 687.187671][T12769] bond2 (unregistering): (slave gretap1): Releasing backup interface [ 687.196524][T12769] gretap1 (unregistering): left promiscuous mode [ 687.246717][T12769] bond1 (unregistering): (slave gre1): Releasing backup interface [ 687.254906][T12769] gre1 (unregistering): left promiscuous mode [ 687.283838][ T52] Bluetooth: hci0: command tx timeout [ 687.430708][T12769] team0: Port device geneve0 removed [ 687.485017][T12769] bridge0 (unregistering): left allmulticast mode [ 688.324665][T12769] bond1 (unregistering): Released all slaves [ 688.469197][T12769] bond2 (unregistering): Released all slaves [ 688.620169][T12769] bond3 (unregistering): Released all slaves [ 688.632954][T12769] bond4 (unregistering): Released all slaves [ 688.789171][T12769] bond0 (unregistering): Released all slaves [ 688.952231][T12769] bond5 (unregistering): (slave batadv1): Releasing backup interface [ 688.964781][T12769] bond5 (unregistering): Released all slaves [ 689.116460][T12769] bond6 (unregistering): Released all slaves [ 689.264960][T12769] bond7 (unregistering): Released all slaves [ 689.365271][ T52] Bluetooth: hci0: command tx timeout [ 689.405019][T12769] bond8 (unregistering): Released all slaves [ 689.432113][T19945] A link change request failed with some changes committed already. Interface ip6tnl0 may have been left with an inconsistent configuration, please check. [ 689.555208][T19959] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3466'. [ 689.869782][T19979] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3469'. [ 689.891067][T19976] dvmrp0: entered allmulticast mode [ 689.923760][T19966] ip6_vti0 speed is unknown, defaulting to 1000 [ 689.938717][T19974] netlink: 7 bytes leftover after parsing attributes in process `syz.0.3470'. [ 689.991604][T19890] chnl_net:caif_netlink_parms(): no params data found [ 690.296973][T19990] x_tables: duplicate underflow at hook 2 [ 690.331646][T19966] wg1 speed is unknown, defaulting to 1000 [ 690.367680][T19890] bridge0: port 1(bridge_slave_0) entered blocking state [ 690.375856][T19890] bridge0: port 1(bridge_slave_0) entered disabled state [ 690.383167][T19890] bridge_slave_0: entered allmulticast mode [ 690.391865][T19890] bridge_slave_0: entered promiscuous mode [ 690.399971][T19984] ip6_vti0 speed is unknown, defaulting to 1000 [ 690.401016][T19890] bridge0: port 2(bridge_slave_1) entered blocking state [ 690.413543][T19890] bridge0: port 2(bridge_slave_1) entered disabled state [ 690.422106][T19890] bridge_slave_1: entered allmulticast mode [ 690.430377][T19890] bridge_slave_1: entered promiscuous mode [ 690.551248][T20001] syz.0.3474 (20001) used obsolete PPPIOCDETACH ioctl [ 690.611871][T19890] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 690.649314][T19890] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 690.767873][T19984] wg1 speed is unknown, defaulting to 1000 [ 690.777767][T19890] team0: Port device team_slave_0 added [ 690.806143][T19890] team0: Port device team_slave_1 added [ 691.001246][T19890] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 691.029528][T19890] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 691.082253][T19890] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 691.111354][T19890] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 691.118484][T19890] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 691.145135][T19890] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 691.261371][T19890] hsr_slave_0: entered promiscuous mode [ 691.268053][T19890] hsr_slave_1: entered promiscuous mode [ 691.277501][T19890] debugfs: 'hsr0' already exists in 'hsr' [ 691.283267][T19890] Cannot create hsr debugfs directory [ 691.290558][T12769] : left promiscuous mode [ 691.443709][ T52] Bluetooth: hci0: command tx timeout [ 691.496656][T12769] tipc: Left network mode [ 691.769565][T20017] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3482'. [ 691.816488][T20019] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3481'. [ 691.869646][T20021] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3481'. [ 691.879858][T20021] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3481'. [ 691.997003][T20017] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3482'. [ 692.439155][T12769] hsr_slave_0: left promiscuous mode [ 692.449523][T12769] hsr_slave_1: left promiscuous mode [ 692.458206][T12769] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 692.470563][T12769] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 692.515811][T20043] delete_channel: no stack [ 692.545518][T12769] pimreg3 (unregistering): left allmulticast mode [ 692.549945][T20046] netlink: 'syz.3.3487': attribute type 1 has an invalid length. [ 692.600612][T12769] pim6reg99999999 (unregistering): left allmulticast mode [ 693.109704][T12769] team0 (unregistering): Port device team_slave_1 removed [ 693.162899][T12769] team0 (unregistering): Port device team_slave_0 removed [ 693.460379][T12769] team0 (unregistering): Port device dummy0 removed [ 693.527765][ T52] Bluetooth: hci0: command tx timeout [ 693.648264][T20042] bridge_slave_0: left allmulticast mode [ 693.654085][T20042] bridge_slave_0: left promiscuous mode [ 693.659826][T20042] bridge0: port 1(bridge_slave_0) entered disabled state [ 693.669756][T20042] bridge_slave_1: left allmulticast mode [ 693.677045][T20042] bridge_slave_1: left promiscuous mode [ 693.682847][T20042] bridge0: port 2(bridge_slave_1) entered disabled state [ 693.697624][T20042] bond0: (slave bond_slave_0): Releasing backup interface [ 693.713980][T20042] bond0: (slave bond_slave_1): Releasing backup interface [ 693.740463][T20042] team0: Port device team_slave_0 removed [ 693.766786][T20042] team0: Port device team_slave_1 removed [ 693.773228][T20042] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 693.780976][T20042] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 693.789865][T20042] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 693.797597][T20042] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 693.807734][T20042] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 693.888551][T20030] ip6_vti0 speed is unknown, defaulting to 1000 [ 693.904657][ T6998] syz0: Port: 1 Link DOWN [ 694.235465][T19890] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 694.338497][T19890] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 694.389384][T12769] IPVS: stop unused estimator thread 0... [ 694.395948][T19890] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 694.411731][T19890] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 694.490937][T20067] ip6_vti0 speed is unknown, defaulting to 1000 [ 694.511676][T20030] wg1 speed is unknown, defaulting to 1000 [ 694.589246][T20060] netlink: 44 bytes leftover after parsing attributes in process `syz.0.3493'. [ 694.636049][T20079] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 694.656613][T20060] netlink: 'syz.0.3493': attribute type 2 has an invalid length. [ 694.727795][T20079] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 694.768642][T19890] 8021q: adding VLAN 0 to HW filter on device bond0 [ 694.813397][T19890] 8021q: adding VLAN 0 to HW filter on device team0 [ 694.845007][T12768] bridge0: port 1(bridge_slave_0) entered blocking state [ 694.852242][T12768] bridge0: port 1(bridge_slave_0) entered forwarding state [ 694.885963][T20077] ip6_vti0 speed is unknown, defaulting to 1000 [ 694.899262][T12769] bridge0: port 2(bridge_slave_1) entered blocking state [ 694.906486][T12769] bridge0: port 2(bridge_slave_1) entered forwarding state [ 695.203210][T20077] wg1 speed is unknown, defaulting to 1000 [ 695.213136][T20067] wg1 speed is unknown, defaulting to 1000 [ 695.495304][T19890] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 696.213187][T19890] veth0_vlan: entered promiscuous mode [ 696.285780][T19890] veth1_vlan: entered promiscuous mode [ 696.401303][T19890] veth0_macvtap: entered promiscuous mode [ 696.424209][T20123] netlink: 'syz.3.3505': attribute type 12 has an invalid length. [ 696.472995][T19890] veth1_macvtap: entered promiscuous mode [ 696.537271][T20127] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 696.553539][T19890] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 696.612669][T19890] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 696.695889][ T12] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 696.711702][ T12] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 696.796082][ T12] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 696.873175][T20134] pim6reg: entered allmulticast mode [ 696.887780][ T12] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 697.083722][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 697.112354][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 697.186485][ T8176] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 697.206014][ T8176] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 697.234940][T20146] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3513'. [ 697.330592][T20144] ip6_vti0 speed is unknown, defaulting to 1000 [ 697.380033][T20149] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 697.420732][T20146] team_slave_0: entered promiscuous mode [ 697.426887][T20146] team_slave_1: entered promiscuous mode [ 697.468064][T20149] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 697.554134][T20154] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3514'. [ 697.754222][T20162] syz_tun: entered allmulticast mode [ 697.802040][T20144] wg1 speed is unknown, defaulting to 1000 [ 697.896198][T20167] nftables ruleset with unbound set [ 697.958565][T20163] ip6_vti0 speed is unknown, defaulting to 1000 [ 697.969561][T20166] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci0/hci0:200/input8 [ 698.051748][T20174] netlink: 'syz.3.3521': attribute type 4 has an invalid length. [ 698.468756][T20163] wg1 speed is unknown, defaulting to 1000 [ 698.890927][T20194] syzkaller0: entered promiscuous mode [ 698.907156][T20194] syzkaller0: entered allmulticast mode [ 699.274477][T20206] ip6_vti0 speed is unknown, defaulting to 1000 [ 699.570138][T20162] syz_tun: left allmulticast mode [ 699.742539][T20207] ip6_vti0 speed is unknown, defaulting to 1000 [ 699.908423][T20223] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3534'. [ 700.038847][T20207] wg1 speed is unknown, defaulting to 1000 [ 700.048364][T20206] wg1 speed is unknown, defaulting to 1000 [ 700.137771][T20228] netlink: 'syz.0.3535': attribute type 10 has an invalid length. [ 700.190287][T20230] netlink: 'syz.0.3535': attribute type 10 has an invalid length. [ 700.200464][T20228] dummy0: entered promiscuous mode [ 700.213155][T20228] team0: Failed to send options change via netlink (err -105) [ 700.222328][T20228] team0: Port device dummy0 added [ 700.287497][T20230] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 700.306110][T20230] team0: Failed to send options change via netlink (err -105) [ 700.314043][T20230] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 700.323089][T20229] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3536'. [ 700.334037][T20230] team0: Port device dummy0 removed [ 700.340547][T20230] dummy0: left promiscuous mode [ 700.349319][T20230] dummy0: entered promiscuous mode [ 700.357509][T20230] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 700.525211][T20227] ip6_vti0 speed is unknown, defaulting to 1000 [ 701.044897][T20247] netlink: 4 bytes leftover after parsing attributes in process `syz.5.3540'. [ 701.177476][T20246] v: renamed from vlan0 [ 701.213355][T20227] wg1 speed is unknown, defaulting to 1000 [ 701.214594][T20244] ip6_vti0 speed is unknown, defaulting to 1000 [ 701.703247][T20258] TCP: tcp_parse_options: Illegal window scaling value 47 > 14 received [ 701.751629][T20261] Bluetooth: MGMT ver 1.23 [ 701.843215][T20264] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3543'. [ 701.872453][T20264] bridge_slave_1: left allmulticast mode [ 701.888356][T20264] bridge_slave_1: left promiscuous mode [ 701.894560][T20264] bridge0: port 2(bridge_slave_1) entered disabled state [ 701.905921][T20264] bridge_slave_0: left allmulticast mode [ 701.911723][T20264] bridge_slave_0: left promiscuous mode [ 701.919740][T20264] bridge0: port 1(bridge_slave_0) entered disabled state [ 701.972913][T20267] netlink: 'syz.0.3544': attribute type 4 has an invalid length. [ 702.011932][T20244] wg1 speed is unknown, defaulting to 1000 [ 702.023149][T20262] netlink: 'syz.0.3544': attribute type 4 has an invalid length. [ 702.157856][T20270] netlink: 'syz.1.3546': attribute type 7 has an invalid length. [ 702.167798][T20270] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3546'. [ 702.287217][T20273] netlink: 'syz.0.3547': attribute type 1 has an invalid length. [ 702.400070][T20273] netlink: 28 bytes leftover after parsing attributes in process `syz.0.3547'. [ 702.417627][T20276] bond2: (slave vxcan5): The slave device specified does not support setting the MAC address [ 702.429487][T20276] bond2: (slave vxcan5): Error -95 calling set_mac_address [ 702.480073][T20273] 8021q: adding VLAN 0 to HW filter on device bond2 [ 702.568503][T20283] macvlan2: entered promiscuous mode [ 702.574715][T20283] macvlan2: entered allmulticast mode [ 702.590214][T20283] bond2: entered promiscuous mode [ 702.599397][T20283] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 702.634413][T20283] bond2: left promiscuous mode [ 702.977710][T20302] atomic_op ffff888054238198 conn xmit_atomic 0000000000000000 [ 703.158455][T20316] netlink: 52 bytes leftover after parsing attributes in process `syz.0.3557'. [ 703.472321][T20329] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3560'. [ 703.566342][T20335] netlink: 20 bytes leftover after parsing attributes in process `syz.2.3563'. [ 703.587452][T20335] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3563'. [ 703.627974][T20335] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3563'. [ 703.639846][T20335] netlink: 176 bytes leftover after parsing attributes in process `syz.2.3563'. [ 703.650697][T20335] netlink: 32 bytes leftover after parsing attributes in process `syz.2.3563'. [ 703.674124][T20335] netlink: 36 bytes leftover after parsing attributes in process `syz.2.3563'. [ 703.959157][T20359] syzkaller1: entered promiscuous mode [ 703.964863][T20359] syzkaller1: entered allmulticast mode [ 704.121053][T20361] netlink: 'syz.2.3571': attribute type 1 has an invalid length. [ 704.167074][T20361] 8021q: adding VLAN 0 to HW filter on device bond4 [ 704.193198][T20361] ipvlan2: entered allmulticast mode [ 704.198872][T20361] bond4: entered allmulticast mode [ 704.224536][T20361] bond4: (slave gretap2): making interface the new active one [ 704.232096][T20361] gretap2: entered allmulticast mode [ 704.240306][T20361] bond4: (slave gretap2): Enslaving as an active interface with an up link [ 704.349450][T20366] netlink: 'syz.2.3572': attribute type 1 has an invalid length. [ 704.357539][T20366] netlink: 264 bytes leftover after parsing attributes in process `syz.2.3572'. [ 704.368162][T20366] netlink: 'syz.2.3572': attribute type 1 has an invalid length. [ 704.613924][T20380] tipc: Started in network mode [ 704.618840][T20380] tipc: Node identity 1a10ca31124c, cluster identity 4711 [ 704.629669][T20380] tipc: Enabled bearer , priority 0 [ 704.654031][T20380] syzkaller0: entered promiscuous mode [ 704.669883][T20380] syzkaller0: entered allmulticast mode [ 704.680448][T20380] bond_slave_1: mtu less than device minimum [ 704.690318][T20379] tipc: Resetting bearer [ 704.754953][T20379] tipc: Disabling bearer [ 704.776509][T20389] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 704.786241][T20396] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 705.102311][T20407] syzkaller0: entered promiscuous mode [ 705.108858][T20407] syzkaller0: entered allmulticast mode [ 705.158923][T20423] syzkaller0: entered promiscuous mode [ 705.164871][T20423] syzkaller0: entered allmulticast mode [ 705.295026][T20425] IPv6: Can't replace route, no match found [ 705.630900][T20434] ip6t_REJECT: TCP_RESET illegal for non-tcp [ 707.293707][ T5147] Bluetooth: hci0: command 0x0405 tx timeout [ 707.935233][T20439] nbd: nbd0 already in use [ 707.940340][T20439] block nbd0: NBD_DISCONNECT [ 707.946381][T20439] block nbd0: Send disconnect failed -32 [ 708.026215][T20441] FAULT_INJECTION: forcing a failure. [ 708.026215][T20441] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 708.045262][T20441] CPU: 0 UID: 0 PID: 20441 Comm: syz.1.3593 Not tainted syzkaller #0 PREEMPT(full) [ 708.045290][T20441] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 708.045302][T20441] Call Trace: [ 708.045310][T20441] [ 708.045318][T20441] dump_stack_lvl+0x189/0x250 [ 708.045346][T20441] ? __pfx____ratelimit+0x10/0x10 [ 708.045369][T20441] ? __pfx_dump_stack_lvl+0x10/0x10 [ 708.045391][T20441] ? __pfx__printk+0x10/0x10 [ 708.045413][T20441] ? ktime_get_ts64+0xa9/0x3d0 [ 708.045443][T20441] should_fail_ex+0x414/0x560 [ 708.045475][T20441] _copy_to_user+0x31/0xb0 [ 708.045500][T20441] put_timespec64+0xc0/0x120 [ 708.045518][T20441] ? __pfx_put_timespec64+0x10/0x10 [ 708.045546][T20441] poll_select_finish+0x479/0x5e0 [ 708.045568][T20441] ? __pfx_poll_select_finish+0x10/0x10 [ 708.045593][T20441] ? __pfx_set_user_sigmask+0x10/0x10 [ 708.045625][T20441] __se_sys_pselect6+0x291/0x300 [ 708.045656][T20441] ? __pfx___se_sys_pselect6+0x10/0x10 [ 708.045680][T20441] ? __pfx_ksys_write+0x10/0x10 [ 708.045707][T20441] ? __x64_sys_pselect6+0x21/0xf0 [ 708.045735][T20441] do_syscall_64+0xfa/0xfa0 [ 708.045755][T20441] ? lockdep_hardirqs_on+0x9c/0x150 [ 708.045777][T20441] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 708.045795][T20441] ? clear_bhb_loop+0x60/0xb0 [ 708.045815][T20441] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 708.045832][T20441] RIP: 0033:0x7f653a38f749 [ 708.045848][T20441] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 708.045863][T20441] RSP: 002b:00007f653b22b038 EFLAGS: 00000246 ORIG_RAX: 000000000000010e [ 708.045882][T20441] RAX: ffffffffffffffda RBX: 00007f653a5e6090 RCX: 00007f653a38f749 [ 708.045896][T20441] RDX: 0000000000000000 RSI: 0000200000000100 RDI: 0000000000000040 [ 708.045908][T20441] RBP: 00007f653b22b090 R08: 0000200000000280 R09: 0000000000000000 [ 708.045919][T20441] R10: 0000200000000240 R11: 0000000000000246 R12: 0000000000000001 [ 708.045930][T20441] R13: 00007f653a5e6128 R14: 00007f653a5e6090 R15: 00007ffcbf145048 [ 708.045962][T20441] [ 708.095215][T20442] __nla_validate_parse: 7 callbacks suppressed [ 708.095231][T20442] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3595'. [ 708.304092][T20449] syzkaller0: entered promiscuous mode [ 708.309613][T20449] syzkaller0: entered allmulticast mode [ 708.387698][T20456] bond2: Removing last arp target with arp_interval on [ 708.397835][T20456] bond2: entered promiscuous mode [ 708.403070][T20456] bond2: entered allmulticast mode [ 708.408889][T20456] 8021q: adding VLAN 0 to HW filter on device bond2 [ 710.902153][T20465] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3600'. [ 710.931571][T20480] syzkaller0: entered promiscuous mode [ 710.938338][T20480] syzkaller0: entered allmulticast mode [ 711.068060][T20485] netdevsim netdevsim0 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 711.087821][T20485] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 711.111719][T20491] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3604'. [ 711.229985][T20485] netdevsim netdevsim0 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 711.248218][T20485] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 711.259686][T20495] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3606'. [ 711.273342][T20493] netlink: 68 bytes leftover after parsing attributes in process `syz.2.3607'. [ 711.302667][T20495] workqueue: Failed to create a rescuer kthread for wq "bond3": -EINTR [ 711.361899][T20485] netdevsim netdevsim0 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 711.403712][T20485] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 711.518620][T20517] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3608'. [ 711.544084][T20499] ip6_vti0 speed is unknown, defaulting to 1000 [ 711.620945][T20485] netdevsim netdevsim0 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 711.644923][T20485] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 711.680615][T20524] FAULT_INJECTION: forcing a failure. [ 711.680615][T20524] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 711.710901][T20524] CPU: 0 UID: 0 PID: 20524 Comm: syz.5.3611 Not tainted syzkaller #0 PREEMPT(full) [ 711.710929][T20524] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 711.710940][T20524] Call Trace: [ 711.710949][T20524] [ 711.710957][T20524] dump_stack_lvl+0x189/0x250 [ 711.710985][T20524] ? __pfx____ratelimit+0x10/0x10 [ 711.711015][T20524] ? __pfx_dump_stack_lvl+0x10/0x10 [ 711.711038][T20524] ? __pfx__printk+0x10/0x10 [ 711.711070][T20524] should_fail_ex+0x414/0x560 [ 711.711100][T20524] _copy_to_user+0x31/0xb0 [ 711.711125][T20524] simple_read_from_buffer+0xe1/0x170 [ 711.711155][T20524] proc_fail_nth_read+0x1b3/0x220 [ 711.711181][T20524] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 711.711206][T20524] ? rw_verify_area+0x2a6/0x4d0 [ 711.711229][T20524] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 711.711252][T20524] vfs_read+0x200/0xa30 [ 711.711279][T20524] ? __pfx_poll_select_finish+0x10/0x10 [ 711.711297][T20524] ? __pfx_vfs_read+0x10/0x10 [ 711.711321][T20524] ? __pfx_set_user_sigmask+0x10/0x10 [ 711.711357][T20524] ksys_read+0x145/0x250 [ 711.711380][T20524] ? __pfx_ksys_read+0x10/0x10 [ 711.711405][T20524] ? do_syscall_64+0xbe/0xfa0 [ 711.711428][T20524] do_syscall_64+0xfa/0xfa0 [ 711.711449][T20524] ? lockdep_hardirqs_on+0x9c/0x150 [ 711.711471][T20524] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 711.711489][T20524] ? clear_bhb_loop+0x60/0xb0 [ 711.711511][T20524] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 711.711528][T20524] RIP: 0033:0x7fdf66f8e15c [ 711.711548][T20524] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 711.711564][T20524] RSP: 002b:00007fdf67ee0030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 711.711584][T20524] RAX: ffffffffffffffda RBX: 00007fdf671e6090 RCX: 00007fdf66f8e15c [ 711.711598][T20524] RDX: 000000000000000f RSI: 00007fdf67ee00a0 RDI: 0000000000000005 [ 711.711609][T20524] RBP: 00007fdf67ee0090 R08: 0000000000000000 R09: 0000000000000000 [ 711.711619][T20524] R10: 0000200000000240 R11: 0000000000000246 R12: 0000000000000001 [ 711.711629][T20524] R13: 00007fdf671e6128 R14: 00007fdf671e6090 R15: 00007ffc011fc558 [ 711.711662][T20524] [ 711.791113][T20499] wg1 speed is unknown, defaulting to 1000 [ 711.843853][T20484] delete_channel: no stack [ 712.005929][T20532] netlink: 'syz.3.3614': attribute type 1 has an invalid length. [ 712.031939][T20530] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3613'. [ 712.052494][T20532] 8021q: adding VLAN 0 to HW filter on device bond4 [ 712.223770][T20532] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3614'. [ 712.298295][T20539] ip6_vti0 speed is unknown, defaulting to 1000 [ 712.504791][T20539] wg1 speed is unknown, defaulting to 1000 [ 712.504826][T20535] ip6_vti0 speed is unknown, defaulting to 1000 [ 712.554444][ T8183] netdevsim netdevsim0 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 712.562887][ T8183] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 712.677923][ T6780] netdevsim netdevsim0 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 712.690531][ T6780] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 712.706605][T20529] llcp: nfc_llcp_send_ui_frame: Could not allocate PDU (error=-512) [ 712.777663][ T8183] netdevsim netdevsim0 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 712.791564][ T8183] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 712.846064][ T8183] netdevsim netdevsim0 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 712.874358][ T8183] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 712.904940][T20550] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3617'. [ 712.925416][T20550] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3617'. [ 713.040061][T20550] geneve2: entered promiscuous mode [ 713.047100][T20550] geneve2: entered allmulticast mode [ 713.261625][T20535] wg1 speed is unknown, defaulting to 1000 [ 713.285756][T20568] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3622'. [ 713.315541][T20568] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3622'. [ 713.350094][T20568] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3622'. [ 713.369352][T20568] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3622'. [ 713.609941][T20577] ip6tnl2: entered allmulticast mode [ 713.960790][T20587] ip6_vti0 speed is unknown, defaulting to 1000 [ 714.116515][T20593] netlink: 40 bytes leftover after parsing attributes in process `syz.0.3629'. [ 714.128245][T20593] netlink: 32 bytes leftover after parsing attributes in process `syz.0.3629'. [ 714.223342][T20585] ip6_vti0 speed is unknown, defaulting to 1000 [ 714.224179][T20587] wg1 speed is unknown, defaulting to 1000 [ 714.536100][T10760] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 714.780784][T20601] ¾x9ÿ: renamed from bridge_slave_0 [ 714.922966][T20585] wg1 speed is unknown, defaulting to 1000 [ 715.164866][T20615] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 715.229262][T12768] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 715.450062][T10762] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 715.519393][T20617] syzkaller0: entered promiscuous mode [ 715.542246][T20617] syzkaller0: entered allmulticast mode [ 715.827819][T20620] pimreg: entered allmulticast mode [ 716.031830][T20636] netlink: 'syz.1.3640': attribute type 8 has an invalid length. [ 716.293795][T20633] ip6_vti0 speed is unknown, defaulting to 1000 [ 716.356763][ T8183] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 716.383833][ T8183] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 716.791102][T20633] wg1 speed is unknown, defaulting to 1000 [ 716.791127][T20650] ip6_vti0 speed is unknown, defaulting to 1000 [ 716.900641][T20661] bond1: peer notification delay (9) is not a multiple of miimon (100), value rounded to 0 ms [ 716.924953][T20670] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3646'. [ 717.047234][T20674] IPv6: Can't replace route, no match found [ 717.123920][ T5908] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 717.207926][T20636] ip6_vti0 speed is unknown, defaulting to 1000 [ 717.418161][T20658] ip6_vti0 speed is unknown, defaulting to 1000 [ 717.625963][T20658] wg1 speed is unknown, defaulting to 1000 [ 717.639467][T20650] wg1 speed is unknown, defaulting to 1000 [ 717.703515][T20636] wg1 speed is unknown, defaulting to 1000 [ 718.131220][T20682] pimreg: entered allmulticast mode [ 718.383256][T20690] netlink: 'syz.5.3653': attribute type 1 has an invalid length. [ 718.468772][T20692] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 718.476371][T20692] IPv6: NLM_F_CREATE should be set when creating new route [ 718.483762][T20692] IPv6: NLM_F_CREATE should be set when creating new route [ 718.506167][T20692] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 718.827855][T20704] netlink: 256 bytes leftover after parsing attributes in process `syz.5.3656'. [ 719.233354][T20728] netlink: 48 bytes leftover after parsing attributes in process `syz.2.3663'. [ 719.248636][T20733] ip6_vti0 speed is unknown, defaulting to 1000 [ 719.364351][T20742] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 719.433220][T20736] iwpm_parse_nlmsg: Invalid NULL attribute (msg type Query Mapping response ret = -22) [ 719.456350][T20744] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3667'. [ 719.474133][T20740] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3664'. [ 719.481308][T20739] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 719.549820][T20748] netlink: 5 bytes leftover after parsing attributes in process `syz.2.3668'. [ 719.828592][T20730] ip6_vti0 speed is unknown, defaulting to 1000 [ 719.828609][T20733] wg1 speed is unknown, defaulting to 1000 [ 719.943182][T20768] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3672'. [ 720.092346][T20730] wg1 speed is unknown, defaulting to 1000 [ 720.099329][T20741] ip6_vti0 speed is unknown, defaulting to 1000 [ 720.199405][T20776] netlink: 260 bytes leftover after parsing attributes in process `syz.2.3675'. [ 720.211601][T20776] netlink: 'syz.2.3675': attribute type 1 has an invalid length. [ 720.243770][ C1] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 720.293986][T20779] netlink: 'syz.2.3676': attribute type 10 has an invalid length. [ 720.411990][T20759] ip6_vti0 speed is unknown, defaulting to 1000 [ 720.562806][T20786] netlink: 3 bytes leftover after parsing attributes in process `syz.3.3678'. [ 720.664213][T20759] wg1 speed is unknown, defaulting to 1000 [ 720.677269][T20741] wg1 speed is unknown, defaulting to 1000 [ 721.774158][ C0] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 722.012242][T20815] ip6_vti0 speed is unknown, defaulting to 1000 [ 722.106435][T20818] netlink: 312 bytes leftover after parsing attributes in process `syz.1.3687'. [ 722.188584][T20825] netlink: 2 bytes leftover after parsing attributes in process `syz.0.3690'. [ 722.199216][T20826] netlink: 'syz.1.3687': attribute type 10 has an invalid length. [ 722.214367][T20826] 8021q: adding VLAN 0 to HW filter on device team0 [ 722.231988][T20826] bond0: (slave team0): Enslaving as an active interface with an up link [ 722.527347][T20815] wg1 speed is unknown, defaulting to 1000 [ 722.535776][T20834] ip6_vti0 speed is unknown, defaulting to 1000 [ 722.852418][T20857] netlink: 'syz.1.3694': attribute type 15 has an invalid length. [ 722.923852][T20834] wg1 speed is unknown, defaulting to 1000 [ 723.826004][T20895] gretap3: entered promiscuous mode [ 724.115537][T20917] ip6_vti0 speed is unknown, defaulting to 1000 [ 724.196454][T20925] __nla_validate_parse: 12 callbacks suppressed [ 724.196472][T20925] netlink: 16 bytes leftover after parsing attributes in process `syz.5.3710'. [ 724.403458][T20917] wg1 speed is unknown, defaulting to 1000 [ 724.729808][T20938] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3712'. [ 724.857713][T20943] pimreg: entered allmulticast mode [ 724.888303][T20938] netlink: 'syz.1.3712': attribute type 1 has an invalid length. [ 724.895133][T20943] pimreg: left allmulticast mode [ 724.903418][T20938] netlink: 224 bytes leftover after parsing attributes in process `syz.1.3712'. [ 725.034053][T20959] netlink: 56 bytes leftover after parsing attributes in process `syz.1.3712'. [ 725.128622][T20959] bond3 (unregistering): Released all slaves [ 725.282760][T20973] ip6_vti0 speed is unknown, defaulting to 1000 [ 725.431189][T20978] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 725.451489][T20983] netlink: 'syz.5.3725': attribute type 10 has an invalid length. [ 725.476262][T20983] batadv0: entered allmulticast mode [ 725.487511][T20983] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 725.497991][T20983] bond0: (slave batadv0): Enslaving as an active interface with an up link [ 725.517416][T20971] syz_tun: entered allmulticast mode [ 725.587340][T20983] netlink: 'syz.5.3725': attribute type 10 has an invalid length. [ 725.595135][T20984] netlink: 'syz.2.3723': attribute type 83 has an invalid length. [ 725.609072][T20983] netlink: 40 bytes leftover after parsing attributes in process `syz.5.3725'. [ 725.622369][T20978] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 725.648203][T20983] batadv0: entered promiscuous mode [ 725.655732][T20983] bond0: (slave batadv0): Releasing backup interface [ 725.670261][T20983] bridge0: port 3(batadv0) entered blocking state [ 725.677648][T20983] bridge0: port 3(batadv0) entered disabled state [ 725.688097][T20973] wg1 speed is unknown, defaulting to 1000 [ 725.688471][T20960] syz_tun: left allmulticast mode [ 725.820667][T20978] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 725.866688][T20996] netlink: 24 bytes leftover after parsing attributes in process `syz.5.3728'. [ 725.958681][T20978] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 725.997117][T20991] ip6_vti0 speed is unknown, defaulting to 1000 [ 726.037267][ T6780] batman_adv: batadv0: No IGMP Querier present - multicast optimizations disabled [ 726.047054][ T6780] batman_adv: batadv0: No MLD Querier present - multicast optimizations disabled [ 726.380384][ T6780] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 726.407135][T21020] IPVS: set_ctl: invalid protocol: 255 224.0.0.2:20002 [ 726.436301][T20991] wg1 speed is unknown, defaulting to 1000 [ 726.436317][ T6780] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 726.542459][T12768] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 726.710671][T12768] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 727.072987][T21042] ip6_vti0 speed is unknown, defaulting to 1000 [ 727.379027][T21042] wg1 speed is unknown, defaulting to 1000 [ 727.892144][T21070] syzkaller0: entered promiscuous mode [ 727.898510][T21070] syzkaller0: entered allmulticast mode [ 728.166004][ C1] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 728.936446][T21093] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3756'. [ 730.458628][T21079] netlink: 6 bytes leftover after parsing attributes in process `syz.3.3754'. [ 730.481155][T21079] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 730.532999][T21081] ip6_vti0 speed is unknown, defaulting to 1000 [ 730.811892][T21088] ip6_vti0 speed is unknown, defaulting to 1000 [ 730.821032][T21081] wg1 speed is unknown, defaulting to 1000 [ 731.125825][T21109] ip6_vti0 speed is unknown, defaulting to 1000 [ 731.274728][T21109] wg1 speed is unknown, defaulting to 1000 [ 731.287987][T21088] wg1 speed is unknown, defaulting to 1000 [ 731.581960][T21125] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3765'. [ 731.928754][T21137] netlink: 52 bytes leftover after parsing attributes in process `syz.5.3767'. [ 731.945040][T21137] netlink: 24 bytes leftover after parsing attributes in process `syz.5.3767'. [ 731.965187][T21137] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3767'. [ 732.136607][T21142] SET target dimension over the limit! [ 732.151029][T21142] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 732.162510][T21143] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3771'. [ 732.179174][T21143] gre0: entered promiscuous mode [ 732.191211][T21143] gre0: entered allmulticast mode [ 732.276836][T21146] netlink: 212368 bytes leftover after parsing attributes in process `syz.0.3772'. [ 732.416744][T21153] ip6_vti0 speed is unknown, defaulting to 1000 [ 732.445721][T21157] team0: Device xfrm1 is of different type [ 732.449280][T21154] netlink: 'syz.0.3775': attribute type 13 has an invalid length. [ 732.640624][T21164] netlink: 44 bytes leftover after parsing attributes in process `syz.1.3779'. [ 732.680571][T21154] bridge0: port 2(bridge_slave_1) entered disabled state [ 732.687873][T21154] bridge0: port 1(bridge_slave_0) entered disabled state [ 732.762197][T21170] sctp: [Deprecated]: syz.1.3781 (pid 21170) Use of struct sctp_assoc_value in delayed_ack socket option. [ 732.762197][T21170] Use struct sctp_sack_info instead [ 732.774133][T21154] team_slave_0: left promiscuous mode [ 732.784955][T21154] team_slave_1: left promiscuous mode [ 732.810266][T21173] netlink: 88 bytes leftover after parsing attributes in process `syz.5.3780'. [ 732.903338][T21154] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 732.918027][T21154] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 733.076759][T21153] wg1 speed is unknown, defaulting to 1000 [ 733.083265][ T12] netdevsim netdevsim0 eth0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 733.102811][ T12] netdevsim netdevsim0 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 733.116170][ T12] netdevsim netdevsim0 eth1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 733.137049][ T12] netdevsim netdevsim0 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 733.167836][ T12] netdevsim netdevsim0 eth2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 733.178231][ T12] netdevsim netdevsim0 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 733.226266][ T12] netdevsim netdevsim0 eth3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 733.245684][ T12] netdevsim netdevsim0 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 733.825332][T21205] FAULT_INJECTION: forcing a failure. [ 733.825332][T21205] name failslab, interval 1, probability 0, space 0, times 0 [ 733.869665][T21205] CPU: 0 UID: 0 PID: 21205 Comm: syz.2.3790 Not tainted syzkaller #0 PREEMPT(full) [ 733.869698][T21205] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 733.869709][T21205] Call Trace: [ 733.869722][T21205] [ 733.869730][T21205] dump_stack_lvl+0x189/0x250 [ 733.869757][T21205] ? __pfx____ratelimit+0x10/0x10 [ 733.869778][T21205] ? __pfx_dump_stack_lvl+0x10/0x10 [ 733.869799][T21205] ? __pfx__printk+0x10/0x10 [ 733.869819][T21205] ? __pfx___might_resched+0x10/0x10 [ 733.869837][T21205] ? fs_reclaim_acquire+0x7d/0x100 [ 733.869857][T21205] should_fail_ex+0x414/0x560 [ 733.869887][T21205] should_failslab+0xa8/0x100 [ 733.869906][T21205] kmem_cache_alloc_node_noprof+0x77/0x710 [ 733.869929][T21205] ? __alloc_skb+0x255/0x430 [ 733.869948][T21205] ? napi_skb_cache_get+0x4a5/0x790 [ 733.869964][T21205] ? napi_skb_cache_get+0x151/0x790 [ 733.869988][T21205] __alloc_skb+0x255/0x430 [ 733.870009][T21205] ? __pfx___alloc_skb+0x10/0x10 [ 733.870026][T21205] ? __kasan_save_free_info+0x46/0x50 [ 733.870046][T21205] ? kmem_cache_free+0x19b/0x690 [ 733.870068][T21205] ? unix_dgram_sendmsg+0x570/0x1840 [ 733.870085][T21205] ? __sock_sendmsg+0x21c/0x270 [ 733.870107][T21205] ? ___sys_sendmsg+0x21f/0x2a0 [ 733.870125][T21205] ? __sys_sendmmsg+0x227/0x430 [ 733.870144][T21205] ? __x64_sys_sendmmsg+0xa0/0xc0 [ 733.870167][T21205] alloc_skb_with_frags+0xca/0x890 [ 733.870200][T21205] sock_alloc_send_pskb+0x84d/0x980 [ 733.870240][T21205] ? __pfx_sock_alloc_send_pskb+0x10/0x10 [ 733.870259][T21205] ? lockdep_hardirqs_on+0x9c/0x150 [ 733.870288][T21205] ? unix_dgram_sendmsg+0x570/0x1840 [ 733.870305][T21205] ? kmem_cache_free+0x19b/0x690 [ 733.870330][T21205] ? bpf_lsm_socket_getpeersec_dgram+0x9/0x20 [ 733.870354][T21205] unix_dgram_sendmsg+0x454/0x1840 [ 733.870377][T21205] ? do_wp_page+0x161d/0x5800 [ 733.870408][T21205] ? __pfx_do_wp_page+0x10/0x10 [ 733.870433][T21205] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 733.870462][T21205] ? __pfx_unix_dgram_sendmsg+0x10/0x10 [ 733.870478][T21205] ? tomoyo_socket_sendmsg_permission+0x1e1/0x300 [ 733.870515][T21205] ? unix_seqpacket_sendmsg+0x111/0x1e0 [ 733.870534][T21205] ? __pfx_unix_seqpacket_sendmsg+0x10/0x10 [ 733.870555][T21205] __sock_sendmsg+0x21c/0x270 [ 733.870583][T21205] ____sys_sendmsg+0x52d/0x830 [ 733.870610][T21205] ? __pfx_____sys_sendmsg+0x10/0x10 [ 733.870641][T21205] ? import_iovec+0x74/0xa0 [ 733.870672][T21205] ___sys_sendmsg+0x21f/0x2a0 [ 733.870696][T21205] ? __pfx____sys_sendmsg+0x10/0x10 [ 733.870770][T21205] ? __might_fault+0xb0/0x130 [ 733.870798][T21205] __sys_sendmmsg+0x227/0x430 [ 733.870825][T21205] ? __pfx___sys_sendmmsg+0x10/0x10 [ 733.870857][T21205] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 733.870898][T21205] ? ksys_write+0x22a/0x250 [ 733.870924][T21205] ? __pfx_ksys_write+0x10/0x10 [ 733.870953][T21205] __x64_sys_sendmmsg+0xa0/0xc0 [ 733.870977][T21205] do_syscall_64+0xfa/0xfa0 [ 733.870997][T21205] ? lockdep_hardirqs_on+0x9c/0x150 [ 733.871019][T21205] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 733.871036][T21205] ? clear_bhb_loop+0x60/0xb0 [ 733.871058][T21205] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 733.871075][T21205] RIP: 0033:0x7fce18f8f749 [ 733.871093][T21205] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 733.871109][T21205] RSP: 002b:00007fce171f6038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 733.871129][T21205] RAX: ffffffffffffffda RBX: 00007fce191e5fa0 RCX: 00007fce18f8f749 [ 733.871143][T21205] RDX: 0400000000000292 RSI: 0000200000002c40 RDI: 0000000000000003 [ 733.871156][T21205] RBP: 00007fce171f6090 R08: 0000000000000000 R09: 0000000000000000 [ 733.871167][T21205] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 733.871178][T21205] R13: 00007fce191e6038 R14: 00007fce191e5fa0 R15: 00007fff9fc90e18 [ 733.871211][T21205] [ 733.932120][T21207] netlink: 'syz.5.3791': attribute type 8 has an invalid length. [ 734.158522][T21210] netlink: 3 bytes leftover after parsing attributes in process `syz.2.3792'. [ 734.165247][T21207] netlink: 'syz.5.3791': attribute type 9 has an invalid length. [ 734.307343][T21207] netlink: 'syz.5.3791': attribute type 10 has an invalid length. [ 734.315401][T21207] netlink: 'syz.5.3791': attribute type 11 has an invalid length. [ 734.537712][T21223] netlink: 'syz.3.3795': attribute type 23 has an invalid length. [ 734.760900][T21236] netlink: 'syz.5.3801': attribute type 1 has an invalid length. [ 734.780108][T21236] netlink: 'syz.5.3801': attribute type 2 has an invalid length. [ 734.790983][T21235] x_tables: ip_tables: REDIRECT target: used from hooks POSTROUTING, but only usable from PREROUTING/OUTPUT [ 734.837156][T21241] FAULT_INJECTION: forcing a failure. [ 734.837156][T21241] name failslab, interval 1, probability 0, space 0, times 0 [ 734.877308][T21241] CPU: 1 UID: 0 PID: 21241 Comm: syz.2.3802 Not tainted syzkaller #0 PREEMPT(full) [ 734.877336][T21241] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 734.877348][T21241] Call Trace: [ 734.877355][T21241] [ 734.877362][T21241] dump_stack_lvl+0x189/0x250 [ 734.877391][T21241] ? __pfx____ratelimit+0x10/0x10 [ 734.877413][T21241] ? __pfx_dump_stack_lvl+0x10/0x10 [ 734.877435][T21241] ? __pfx__printk+0x10/0x10 [ 734.877457][T21241] ? __pfx___might_resched+0x10/0x10 [ 734.877477][T21241] ? fs_reclaim_acquire+0x7d/0x100 [ 734.877499][T21241] should_fail_ex+0x414/0x560 [ 734.877530][T21241] should_failslab+0xa8/0x100 [ 734.877550][T21241] kmem_cache_alloc_node_noprof+0x77/0x710 [ 734.877574][T21241] ? __alloc_skb+0x255/0x430 [ 734.877593][T21241] ? napi_skb_cache_get+0x4a5/0x790 [ 734.877618][T21241] ? napi_skb_cache_get+0x151/0x790 [ 734.877645][T21241] __alloc_skb+0x255/0x430 [ 734.877666][T21241] ? __pfx___alloc_skb+0x10/0x10 [ 734.877683][T21241] ? __kasan_save_free_info+0x46/0x50 [ 734.877701][T21241] ? kmem_cache_free+0x19b/0x690 [ 734.877720][T21241] ? unix_dgram_sendmsg+0x570/0x1840 [ 734.877735][T21241] ? __sock_sendmsg+0x21c/0x270 [ 734.877756][T21241] ? ___sys_sendmsg+0x21f/0x2a0 [ 734.877772][T21241] ? __sys_sendmmsg+0x227/0x430 [ 734.877790][T21241] ? __x64_sys_sendmmsg+0xa0/0xc0 [ 734.877817][T21241] alloc_skb_with_frags+0xca/0x890 [ 734.877851][T21241] sock_alloc_send_pskb+0x84d/0x980 [ 734.877891][T21241] ? __pfx_sock_alloc_send_pskb+0x10/0x10 [ 734.877910][T21241] ? lockdep_hardirqs_on+0x9c/0x150 [ 734.877937][T21241] ? unix_dgram_sendmsg+0x570/0x1840 [ 734.877952][T21241] ? kmem_cache_free+0x19b/0x690 [ 734.877976][T21241] ? bpf_lsm_socket_getpeersec_dgram+0x9/0x20 [ 734.878000][T21241] unix_dgram_sendmsg+0x454/0x1840 [ 734.878021][T21241] ? do_wp_page+0x161d/0x5800 [ 734.878050][T21241] ? __pfx_do_wp_page+0x10/0x10 [ 734.878073][T21241] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 734.878097][T21241] ? __pfx_unix_dgram_sendmsg+0x10/0x10 [ 734.878114][T21241] ? tomoyo_socket_sendmsg_permission+0x1e1/0x300 [ 734.878149][T21241] ? unix_seqpacket_sendmsg+0x111/0x1e0 [ 734.878168][T21241] ? __pfx_unix_seqpacket_sendmsg+0x10/0x10 [ 734.878189][T21241] __sock_sendmsg+0x21c/0x270 [ 734.878216][T21241] ____sys_sendmsg+0x52d/0x830 [ 734.878242][T21241] ? __pfx_____sys_sendmsg+0x10/0x10 [ 734.878272][T21241] ? import_iovec+0x74/0xa0 [ 734.878298][T21241] ___sys_sendmsg+0x21f/0x2a0 [ 734.878321][T21241] ? __pfx____sys_sendmsg+0x10/0x10 [ 734.878380][T21241] ? __might_fault+0xb0/0x130 [ 734.878407][T21241] __sys_sendmmsg+0x227/0x430 [ 734.878434][T21241] ? __pfx___sys_sendmmsg+0x10/0x10 [ 734.878465][T21241] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 734.878506][T21241] ? ksys_write+0x22a/0x250 [ 734.878532][T21241] ? __pfx_ksys_write+0x10/0x10 [ 734.878560][T21241] __x64_sys_sendmmsg+0xa0/0xc0 [ 734.878583][T21241] do_syscall_64+0xfa/0xfa0 [ 734.878648][T21241] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 734.878665][T21241] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 734.878682][T21241] ? clear_bhb_loop+0x60/0xb0 [ 734.878703][T21241] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 734.878720][T21241] RIP: 0033:0x7fce18f8f749 [ 734.878737][T21241] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 734.878752][T21241] RSP: 002b:00007fce171f6038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 734.878780][T21241] RAX: ffffffffffffffda RBX: 00007fce191e5fa0 RCX: 00007fce18f8f749 [ 734.878798][T21241] RDX: 0400000000000292 RSI: 0000200000002c40 RDI: 0000000000000003 [ 734.878811][T21241] RBP: 00007fce171f6090 R08: 0000000000000000 R09: 0000000000000000 [ 734.878822][T21241] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 734.878833][T21241] R13: 00007fce191e6038 R14: 00007fce191e5fa0 R15: 00007fff9fc90e18 [ 734.878864][T21241] [ 735.549988][T21247] __nla_validate_parse: 7 callbacks suppressed [ 735.550009][T21247] netlink: 32 bytes leftover after parsing attributes in process `syz.0.3805'. [ 735.647269][T21256] netlink: 'syz.3.3804': attribute type 9 has an invalid length. [ 735.780718][T21260] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3808'. [ 735.809218][T21260] netlink: 64 bytes leftover after parsing attributes in process `syz.0.3808'. [ 735.986855][T21265] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3810'. [ 735.996457][T21265] netlink: 72 bytes leftover after parsing attributes in process `syz.0.3810'. [ 736.146219][T21265] vti0: entered promiscuous mode [ 736.163444][T21265] vti0: entered allmulticast mode [ 736.465626][T21283] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3813'. [ 736.516678][T21281] netlink: 14 bytes leftover after parsing attributes in process `syz.5.3816'. [ 736.581561][T21280] ip6_vti0 speed is unknown, defaulting to 1000 [ 736.927300][T21301] geneve2: entered promiscuous mode [ 737.077453][T21304] netlink: 212368 bytes leftover after parsing attributes in process `syz.2.3822'. [ 737.398851][T21280] wg1 speed is unknown, defaulting to 1000 [ 737.569061][T21313] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3824'. [ 737.588800][T21311] ip6_vti0 speed is unknown, defaulting to 1000 [ 738.102403][T21311] wg1 speed is unknown, defaulting to 1000 [ 738.708586][T21333] netlink: 36 bytes leftover after parsing attributes in process `syz.5.3828'. [ 741.332237][T21341] ip6_vti0 speed is unknown, defaulting to 1000 [ 741.872611][T21356] bond5: option lacp_active: mode dependency failed, not supported in mode balance-rr(0) [ 741.900572][T21356] bond5 (unregistering): Released all slaves [ 741.962960][T21341] wg1 speed is unknown, defaulting to 1000 [ 741.962982][T21353] ip6_vti0 speed is unknown, defaulting to 1000 [ 742.301200][T21353] wg1 speed is unknown, defaulting to 1000 [ 742.936931][T21397] netlink: 68 bytes leftover after parsing attributes in process `syz.1.3844'. [ 742.991534][T21401] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3845'. [ 743.041433][T21401] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3845'. [ 743.080225][T21405] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3846'. [ 743.092256][T21395] ip6_vti0 speed is unknown, defaulting to 1000 [ 743.092467][T21405] xt_TCPMSS: Only works on TCP SYN packets [ 743.289989][T21407] netlink: 'syz.0.3847': attribute type 21 has an invalid length. [ 743.324635][T21408] netlink: 'syz.0.3847': attribute type 21 has an invalid length. [ 743.348946][T21407] netlink: 'syz.0.3847': attribute type 6 has an invalid length. [ 743.360738][T21407] netlink: 132 bytes leftover after parsing attributes in process `syz.0.3847'. [ 743.398011][T21408] netlink: 'syz.0.3847': attribute type 6 has an invalid length. [ 743.407403][T21408] netlink: 132 bytes leftover after parsing attributes in process `syz.0.3847'. [ 743.431055][T21395] wg1 speed is unknown, defaulting to 1000 [ 743.480152][T21412] sch_tbf: burst 240 is lower than device lo mtu (65550) ! [ 743.839233][T21433] Bluetooth: MGMT ver 1.23 [ 744.237875][T21453] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3857'. [ 744.280834][T21452] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3857'. [ 744.735734][T21474] ip6_vti0 speed is unknown, defaulting to 1000 [ 745.030504][T21474] wg1 speed is unknown, defaulting to 1000 [ 745.438108][T21510] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3868'. [ 745.746943][T21526] xt_bpf: check failed: parse error [ 745.773302][T21529] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3872'. [ 745.989502][T21539] x_tables: ip_tables: ah match: only valid for protocol 51 [ 746.012818][T21539] netlink: 'syz.5.3875': attribute type 13 has an invalid length. [ 746.371267][T21549] netlink: 'syz.2.3876': attribute type 2 has an invalid length. [ 746.556797][T21549] : entered promiscuous mode [ 746.662506][T21555] team0: Device gtp0 is up. Set it down before adding it as a team port [ 747.024315][T21570] netlink: 'syz.5.3880': attribute type 4 has an invalid length. [ 747.097858][T21575] mac80211_hwsim hwsim49 wlan0: entered promiscuous mode [ 747.138901][T21575] A link change request failed with some changes committed already. Interface wlan0 may have been left with an inconsistent configuration, please check. [ 747.299943][T21579] netlink: 'syz.0.3882': attribute type 1 has an invalid length. [ 747.344755][T21579] 8021q: adding VLAN 0 to HW filter on device bond3 [ 747.429341][T21584] xt_bpf: check failed: parse error [ 747.559143][T21590] siw: device registration error -23 [ 747.738372][T21607] netlink: 'syz.5.3891': attribute type 1 has an invalid length. [ 747.857346][T21607] 8021q: adding VLAN 0 to HW filter on device bond2 [ 747.940364][T21621] FAULT_INJECTION: forcing a failure. [ 747.940364][T21621] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 747.967436][T21622] __nla_validate_parse: 6 callbacks suppressed [ 747.967454][T21622] netlink: 4 bytes leftover after parsing attributes in process `syz.5.3891'. [ 747.980514][T21621] CPU: 0 UID: 0 PID: 21621 Comm: syz.3.3893 Not tainted syzkaller #0 PREEMPT(full) [ 747.980541][T21621] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 747.980552][T21621] Call Trace: [ 747.980560][T21621] [ 747.980569][T21621] dump_stack_lvl+0x189/0x250 [ 747.980597][T21621] ? __pfx____ratelimit+0x10/0x10 [ 747.980620][T21621] ? __pfx_dump_stack_lvl+0x10/0x10 [ 747.980641][T21621] ? __pfx__printk+0x10/0x10 [ 747.980660][T21621] ? __might_fault+0xb0/0x130 [ 747.980694][T21621] should_fail_ex+0x414/0x560 [ 747.980724][T21621] _copy_from_user+0x2d/0xb0 [ 747.980748][T21621] ___sys_sendmsg+0x158/0x2a0 [ 747.980772][T21621] ? __pfx____sys_sendmsg+0x10/0x10 [ 747.980836][T21621] ? __might_fault+0xb0/0x130 [ 747.980862][T21621] __sys_sendmmsg+0x227/0x430 [ 747.980889][T21621] ? __pfx___sys_sendmmsg+0x10/0x10 [ 747.980920][T21621] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 747.980961][T21621] ? ksys_write+0x22a/0x250 [ 747.980987][T21621] ? __pfx_ksys_write+0x10/0x10 [ 747.981014][T21621] __x64_sys_sendmmsg+0xa0/0xc0 [ 747.981038][T21621] do_syscall_64+0xfa/0xfa0 [ 747.981058][T21621] ? lockdep_hardirqs_on+0x9c/0x150 [ 747.981079][T21621] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 747.981096][T21621] ? clear_bhb_loop+0x60/0xb0 [ 747.981117][T21621] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 747.981134][T21621] RIP: 0033:0x7f7f0eb8f749 [ 747.981150][T21621] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 747.981165][T21621] RSP: 002b:00007f7f0f9e8038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 747.981184][T21621] RAX: ffffffffffffffda RBX: 00007f7f0ede5fa0 RCX: 00007f7f0eb8f749 [ 747.981198][T21621] RDX: 0400000000000292 RSI: 0000200000002c40 RDI: 0000000000000003 [ 747.981210][T21621] RBP: 00007f7f0f9e8090 R08: 0000000000000000 R09: 0000000000000000 [ 747.981221][T21621] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 747.981232][T21621] R13: 00007f7f0ede6038 R14: 00007f7f0ede5fa0 R15: 00007ffc1da8d358 [ 747.981262][T21621] [ 748.347573][T21622] bond2 (unregistering): Released all slaves [ 748.819189][T21660] veth0: Caught tx_queue_len zero misconfig [ 748.825653][T21660] netlink: 7 bytes leftover after parsing attributes in process `syz.5.3905'. [ 748.845610][T21661] netlink: 'syz.2.3904': attribute type 4 has an invalid length. [ 748.877753][T21657] ip6_vti0 speed is unknown, defaulting to 1000 [ 748.896442][T21661] netlink: 3657 bytes leftover after parsing attributes in process `syz.2.3904'. [ 749.343402][T21657] wg1 speed is unknown, defaulting to 1000 [ 749.343468][T21666] ip6_vti0 speed is unknown, defaulting to 1000 [ 749.590826][T21666] wg1 speed is unknown, defaulting to 1000 [ 750.444923][T21719] netlink: 676 bytes leftover after parsing attributes in process `syz.5.3917'. [ 750.463080][T21719] netlink: 676 bytes leftover after parsing attributes in process `syz.5.3917'. [ 750.674556][T21731] netlink: 'syz.5.3920': attribute type 1 has an invalid length. [ 750.692672][T21733] netlink: 'syz.0.3921': attribute type 2 has an invalid length. [ 750.701441][T21734] netlink: 'syz.0.3921': attribute type 2 has an invalid length. [ 750.737132][T21733] !: entered promiscuous mode [ 750.765577][T21734] !: left promiscuous mode [ 750.943932][T21744] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3924'. [ 750.978265][T21744] netlink: 20 bytes leftover after parsing attributes in process `syz.1.3924'. [ 751.006263][T21744] geneve2: entered promiscuous mode [ 751.011505][T21744] geneve2: entered allmulticast mode [ 751.026158][ T12] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 751.048241][ T12] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 751.068880][ T12] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 751.092798][ T12] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 751.107329][T21749] netlink: 60 bytes leftover after parsing attributes in process `syz.5.3926'. [ 751.121093][T21749] IPv6: addrconf: prefix option has invalid lifetime [ 751.289615][T21760] bond2 (unregistering): Released all slaves [ 751.360600][T21763] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3931'. [ 751.401608][T21763] bond3: entered promiscuous mode [ 751.407659][T21763] 8021q: adding VLAN 0 to HW filter on device bond3 [ 751.441101][T21763] 8021q: adding VLAN 0 to HW filter on device bond3 [ 751.447980][T21770] netlink: 28 bytes leftover after parsing attributes in process `syz.0.3933'. [ 751.458749][T21763] bond3: (slave wireguard0): The slave device specified does not support setting the MAC address [ 751.470738][T21763] bond3: (slave wireguard0): Error -95 calling set_mac_address [ 751.563814][T21771] bond3: (slave wireguard0): The slave device specified does not support setting the MAC address [ 751.575504][T21771] bond3: (slave wireguard0): Error -95 calling set_mac_address [ 751.609646][T21770] openvswitch: netlink: Flow actions attr not present in new flow. [ 751.819592][T21777] netlink: zone id is out of range [ 751.828868][T21777] netlink: zone id is out of range [ 751.836877][T21777] netlink: zone id is out of range [ 751.844976][T21777] netlink: zone id is out of range [ 751.850398][T21777] netlink: zone id is out of range [ 751.861070][T21777] netlink: zone id is out of range [ 751.873241][T21777] netlink: zone id is out of range [ 752.065121][T21791] x_tables: ip6_tables: mh match: only valid for protocol 135 [ 752.172087][T21799] FAULT_INJECTION: forcing a failure. [ 752.172087][T21799] name failslab, interval 1, probability 0, space 0, times 0 [ 752.203629][T21797] netlink: 'syz.2.3939': attribute type 29 has an invalid length. [ 752.207517][T21800] net_ratelimit: 47 callbacks suppressed [ 752.207536][T21800] sock: sock_set_timeout: `syz.3.3941' (pid 21800) tries to set negative timeout [ 752.211653][T21799] CPU: 0 UID: 0 PID: 21799 Comm: syz.0.3943 Not tainted syzkaller #0 PREEMPT(full) [ 752.211679][T21799] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 752.211690][T21799] Call Trace: [ 752.211698][T21799] [ 752.211707][T21799] dump_stack_lvl+0x189/0x250 [ 752.211735][T21799] ? __pfx____ratelimit+0x10/0x10 [ 752.211758][T21799] ? __pfx_dump_stack_lvl+0x10/0x10 [ 752.211780][T21799] ? __pfx__printk+0x10/0x10 [ 752.211802][T21799] ? __pfx___might_resched+0x10/0x10 [ 752.211822][T21799] ? fs_reclaim_acquire+0x7d/0x100 [ 752.211843][T21799] should_fail_ex+0x414/0x560 [ 752.211875][T21799] should_failslab+0xa8/0x100 [ 752.211895][T21799] kmem_cache_alloc_node_noprof+0x77/0x710 [ 752.211919][T21799] ? __alloc_skb+0x255/0x430 [ 752.211937][T21799] ? napi_skb_cache_get+0x4a5/0x790 [ 752.211955][T21799] ? napi_skb_cache_get+0x151/0x790 [ 752.211978][T21799] __alloc_skb+0x255/0x430 [ 752.212000][T21799] ? __pfx___alloc_skb+0x10/0x10 [ 752.212017][T21799] ? __kasan_save_free_info+0x46/0x50 [ 752.212037][T21799] ? kmem_cache_free+0x19b/0x690 [ 752.212058][T21799] ? unix_dgram_sendmsg+0x570/0x1840 [ 752.212073][T21799] ? __sock_sendmsg+0x21c/0x270 [ 752.212093][T21799] ? ___sys_sendmsg+0x21f/0x2a0 [ 752.212110][T21799] ? __sys_sendmmsg+0x227/0x430 [ 752.212125][T21799] ? __x64_sys_sendmmsg+0xa0/0xc0 [ 752.212146][T21799] alloc_skb_with_frags+0xca/0x890 [ 752.212181][T21799] sock_alloc_send_pskb+0x84d/0x980 [ 752.212220][T21799] ? __pfx_sock_alloc_send_pskb+0x10/0x10 [ 752.212238][T21799] ? lockdep_hardirqs_on+0x9c/0x150 [ 752.212263][T21799] ? unix_dgram_sendmsg+0x570/0x1840 [ 752.212278][T21799] ? kmem_cache_free+0x19b/0x690 [ 752.212298][T21799] ? bpf_lsm_socket_getpeersec_dgram+0x9/0x20 [ 752.212320][T21799] unix_dgram_sendmsg+0x454/0x1840 [ 752.212342][T21799] ? do_wp_page+0x161d/0x5800 [ 752.212373][T21799] ? __pfx_do_wp_page+0x10/0x10 [ 752.212397][T21799] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 752.212419][T21799] ? __pfx_unix_dgram_sendmsg+0x10/0x10 [ 752.212435][T21799] ? tomoyo_socket_sendmsg_permission+0x1e1/0x300 [ 752.212470][T21799] ? unix_seqpacket_sendmsg+0x111/0x1e0 [ 752.212489][T21799] ? __pfx_unix_seqpacket_sendmsg+0x10/0x10 [ 752.212508][T21799] __sock_sendmsg+0x21c/0x270 [ 752.212536][T21799] ____sys_sendmsg+0x52d/0x830 [ 752.212562][T21799] ? __pfx_____sys_sendmsg+0x10/0x10 [ 752.212641][T21799] ? import_iovec+0x74/0xa0 [ 752.212667][T21799] ___sys_sendmsg+0x21f/0x2a0 [ 752.212690][T21799] ? __pfx____sys_sendmsg+0x10/0x10 [ 752.212756][T21799] ? __might_fault+0xb0/0x130 [ 752.212782][T21799] __sys_sendmmsg+0x227/0x430 [ 752.212808][T21799] ? __pfx___sys_sendmmsg+0x10/0x10 [ 752.212839][T21799] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 752.212879][T21799] ? ksys_write+0x22a/0x250 [ 752.212904][T21799] ? __pfx_ksys_write+0x10/0x10 [ 752.212932][T21799] __x64_sys_sendmmsg+0xa0/0xc0 [ 752.212954][T21799] do_syscall_64+0xfa/0xfa0 [ 752.212975][T21799] ? lockdep_hardirqs_on+0x9c/0x150 [ 752.212996][T21799] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 752.213013][T21799] ? clear_bhb_loop+0x60/0xb0 [ 752.213034][T21799] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 752.213050][T21799] RIP: 0033:0x7fc7f698f749 [ 752.213067][T21799] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 752.213081][T21799] RSP: 002b:00007fc7f77c6038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 752.213101][T21799] RAX: ffffffffffffffda RBX: 00007fc7f6be5fa0 RCX: 00007fc7f698f749 [ 752.213115][T21799] RDX: 0400000000000292 RSI: 0000200000002c40 RDI: 0000000000000003 [ 752.213127][T21799] RBP: 00007fc7f77c6090 R08: 0000000000000000 R09: 0000000000000000 [ 752.213138][T21799] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 752.213149][T21799] R13: 00007fc7f6be6038 R14: 00007fc7f6be5fa0 R15: 00007ffc63845658 [ 752.213180][T21799] [ 752.641459][T21807] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for gretap1 [ 752.655901][T21807] batman_adv: batadv0: Adding interface: gretap1 [ 752.662277][T21807] batman_adv: batadv0: The MTU of interface gretap1 is too small (1462) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 752.694877][T21807] batman_adv: batadv0: Interface activated: gretap1 [ 752.730603][T21809] ip6_vti0 speed is unknown, defaulting to 1000 [ 752.751180][T21810] batadv_slave_0: entered promiscuous mode [ 752.760356][T21810] batman_adv: batadv0: Adding interface: macsec1 [ 752.767992][T21810] batman_adv: batadv0: The MTU of interface macsec1 is too small (1468) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 752.834638][T21810] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 752.868694][T21810] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 752.894049][T21810] batman_adv: batadv0: Interface activated: macsec1 [ 753.006502][T21827] __nla_validate_parse: 10 callbacks suppressed [ 753.006522][T21827] netlink: 96 bytes leftover after parsing attributes in process `syz.2.3947'. [ 753.198728][T21836] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3953'. [ 753.246640][T21836] team1: entered promiscuous mode [ 753.265431][T21836] team1: entered allmulticast mode [ 753.431227][T21850] netlink: 28 bytes leftover after parsing attributes in process `syz.3.3956'. [ 753.439377][T21851] netlink: 'syz.0.3958': attribute type 1 has an invalid length. [ 753.449165][T21852] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3957'. [ 753.462623][T21850] netlink: 7 bytes leftover after parsing attributes in process `syz.3.3956'. [ 753.541804][T21850] netlink: 'syz.3.3956': attribute type 13 has an invalid length. [ 753.560051][T21851] bond4: entered promiscuous mode [ 753.574974][T21851] bond4: entered allmulticast mode [ 753.580857][T21851] 8021q: adding VLAN 0 to HW filter on device bond4 [ 753.664415][T21858] macvlan2: entered promiscuous mode [ 753.674418][T21858] macvlan2: entered allmulticast mode [ 753.703454][T21858] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 754.065026][T21873] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 754.082358][T21874] netlink: 'syz.2.3960': attribute type 33 has an invalid length. [ 754.090680][T21874] netlink: 152 bytes leftover after parsing attributes in process `syz.2.3960'. [ 754.114198][T21872] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 754.114466][T21873] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 754.209390][T21873] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 755.315541][T21809] wg1 speed is unknown, defaulting to 1000 [ 755.379640][T12769] netdevsim netdevsim3 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 755.411508][T12769] netdevsim netdevsim3 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 755.525875][T12769] netdevsim netdevsim3 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 755.543756][T12769] netdevsim netdevsim3 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 755.577020][T21875] ip6_vti0 speed is unknown, defaulting to 1000 [ 755.906064][T21914] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3971'. [ 755.917090][T21917] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3971'. [ 755.927232][T21875] wg1 speed is unknown, defaulting to 1000 [ 755.936393][T21919] netlink: 36 bytes leftover after parsing attributes in process `syz.5.3972'. [ 755.945953][T21919] netlink: 16 bytes leftover after parsing attributes in process `syz.5.3972'. [ 757.772266][T21993] netlink: 'syz.1.3991': attribute type 1 has an invalid length. [ 758.013135][T22002] ip6_vti0 speed is unknown, defaulting to 1000 [ 758.089114][T22004] __nla_validate_parse: 13 callbacks suppressed [ 758.089134][T22004] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3993'. [ 758.332275][T22010] sch_tbf: peakrate 5120 is lower than or equals to rate 13439510820189295412 ! [ 758.346249][T22002] wg1 speed is unknown, defaulting to 1000 [ 758.532642][T22025] netlink: 32 bytes leftover after parsing attributes in process `syz.2.3999'. [ 758.628739][T22033] tipc: Enabled bearer , priority 0 [ 758.642403][T22035] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4001'. [ 758.668078][T22037] netlink: 200 bytes leftover after parsing attributes in process `syz.2.4003'. [ 758.765994][T22033] syzkaller0: entered promiscuous mode [ 758.775033][T22033] syzkaller0: entered allmulticast mode [ 758.828299][T22033] tipc: Resetting bearer [ 758.920233][T22032] tipc: Resetting bearer [ 759.006181][T22032] tipc: Disabling bearer [ 759.030987][ T8183] nci: nci_rx_work: unknown MT 0x6 [ 759.364174][T22077] macsec0: entered promiscuous mode [ 759.370678][T22077] macsec0: left promiscuous mode [ 759.526834][T10762] IPVS: starting estimator thread 0... [ 759.533230][T22088] IPVS: wlc: FWM 3 0x00000003 - no destination available [ 759.544579][T22088] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4014'. [ 759.623866][T22090] IPVS: using max 31 ests per chain, 74400 per kthread [ 760.181395][T22127] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4026'. [ 760.425291][T22142] netlink: 'syz.5.4029': attribute type 3 has an invalid length. [ 760.433064][T22142] netlink: 'syz.5.4029': attribute type 16 has an invalid length. [ 760.478735][T22142] netlink: 132 bytes leftover after parsing attributes in process `syz.5.4029'. [ 760.582244][T22145] ip6tnl0: Caught tx_queue_len zero misconfig [ 760.639477][T22152] netlink: 28 bytes leftover after parsing attributes in process `syz.0.4033'. [ 760.652094][T22152] netlink: 28 bytes leftover after parsing attributes in process `syz.0.4033'. [ 760.779146][T22154] xt_CT: No such helper "snmp_trap" [ 760.821124][T22159] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4036'. [ 760.821788][T22161] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 760.843730][T22161] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 760.852730][T22161] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 760.860787][T22161] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 760.874477][T22161] batman_adv: batadv0: Interface deactivated: macsec1 [ 760.881499][T22161] batman_adv: batadv0: Removing interface: macsec1 [ 760.914459][T22161] bridge0: port 3(batadv0) entered disabled state [ 761.221868][T22188] FAULT_INJECTION: forcing a failure. [ 761.221868][T22188] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 761.242125][T22188] CPU: 1 UID: 0 PID: 22188 Comm: syz.1.4044 Not tainted syzkaller #0 PREEMPT(full) [ 761.242155][T22188] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 761.242166][T22188] Call Trace: [ 761.242174][T22188] [ 761.242183][T22188] dump_stack_lvl+0x189/0x250 [ 761.242212][T22188] ? __pfx____ratelimit+0x10/0x10 [ 761.242235][T22188] ? __pfx_dump_stack_lvl+0x10/0x10 [ 761.242257][T22188] ? __pfx__printk+0x10/0x10 [ 761.242277][T22188] ? __might_fault+0xb0/0x130 [ 761.242310][T22188] should_fail_ex+0x414/0x560 [ 761.242340][T22188] _copy_from_user+0x2d/0xb0 [ 761.242363][T22188] ___sys_sendmsg+0x158/0x2a0 [ 761.242389][T22188] ? __pfx____sys_sendmsg+0x10/0x10 [ 761.242455][T22188] ? __might_fault+0xb0/0x130 [ 761.242483][T22188] __sys_sendmmsg+0x227/0x430 [ 761.242509][T22188] ? __pfx___sys_sendmmsg+0x10/0x10 [ 761.242539][T22188] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 761.242581][T22188] ? ksys_write+0x22a/0x250 [ 761.242606][T22188] ? __pfx_ksys_write+0x10/0x10 [ 761.242634][T22188] __x64_sys_sendmmsg+0xa0/0xc0 [ 761.242657][T22188] do_syscall_64+0xfa/0xfa0 [ 761.242677][T22188] ? lockdep_hardirqs_on+0x9c/0x150 [ 761.242707][T22188] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 761.242724][T22188] ? clear_bhb_loop+0x60/0xb0 [ 761.242746][T22188] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 761.242763][T22188] RIP: 0033:0x7f653a38f749 [ 761.242780][T22188] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 761.242795][T22188] RSP: 002b:00007f653b24c038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 761.242814][T22188] RAX: ffffffffffffffda RBX: 00007f653a5e5fa0 RCX: 00007f653a38f749 [ 761.242828][T22188] RDX: 0400000000000292 RSI: 0000200000002c40 RDI: 0000000000000003 [ 761.242846][T22188] RBP: 00007f653b24c090 R08: 0000000000000000 R09: 0000000000000000 [ 761.242858][T22188] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 761.242868][T22188] R13: 00007f653a5e6038 R14: 00007f653a5e5fa0 R15: 00007ffcbf145048 [ 761.242900][T22188] [ 761.593226][T22197] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 761.624344][T22200] ip6_vti0 speed is unknown, defaulting to 1000 [ 761.948326][T22218] netlink: 'syz.5.4052': attribute type 20 has an invalid length. [ 761.972594][T22218] netlink: 'syz.5.4052': attribute type 21 has an invalid length. [ 762.015601][T22222] syzkaller0: entered promiscuous mode [ 762.022176][T22222] syzkaller0: entered allmulticast mode [ 762.036456][T22200] wg1 speed is unknown, defaulting to 1000 [ 762.037101][T22201] ip6_vti0 speed is unknown, defaulting to 1000 [ 763.034237][T22201] wg1 speed is unknown, defaulting to 1000 [ 763.640623][T22297] __nla_validate_parse: 2 callbacks suppressed [ 763.640643][T22297] netlink: 4 bytes leftover after parsing attributes in process `syz.5.4072'. [ 763.684371][T22289] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 764.380892][T22334] bridge_slave_1: entered promiscuous mode [ 764.388730][T22334] bridge_slave_1: entered allmulticast mode [ 764.924939][T22352] netlink: 'syz.0.4089': attribute type 1 has an invalid length. [ 764.932997][T22352] netlink: 252 bytes leftover after parsing attributes in process `syz.0.4089'. [ 765.272106][T22366] netlink: 96 bytes leftover after parsing attributes in process `syz.5.4092'. [ 765.540433][T22385] netlink: 12 bytes leftover after parsing attributes in process `syz.5.4097'. [ 765.833289][T22411] netlink: 'syz.3.4105': attribute type 4 has an invalid length. [ 765.962486][T22419] ip6_vti0 speed is unknown, defaulting to 1000 [ 765.966036][T22421] netlink: 'syz.2.4108': attribute type 1 has an invalid length. [ 765.993783][T22416] netlink: 12 bytes leftover after parsing attributes in process `syz.5.4107'. [ 766.004864][T22420] netlink: 'syz.2.4108': attribute type 1 has an invalid length. [ 766.045205][T22421] 8021q: adding VLAN 0 to HW filter on device bond5 [ 766.069536][T22421] 8021q: adding VLAN 0 to HW filter on device batadv1 [ 766.098610][T22421] bond5: (slave batadv1): making interface the new active one [ 766.109678][T22421] bond5: (slave batadv1): Enslaving as an active interface with an up link [ 766.342070][T22419] wg1 speed is unknown, defaulting to 1000 [ 766.430474][T22439] netlink: 'syz.1.4113': attribute type 5 has an invalid length. [ 766.648275][T22450] netlink: 'syz.0.4117': attribute type 1 has an invalid length. [ 766.657086][T22450] netlink: 11510 bytes leftover after parsing attributes in process `syz.0.4117'. [ 766.680686][T22453] netlink: 32 bytes leftover after parsing attributes in process `syz.5.4116'. [ 766.691701][T22454] netlink: 32 bytes leftover after parsing attributes in process `syz.5.4116'. [ 767.160680][T22470] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4121'. [ 767.478433][T22487] FAULT_INJECTION: forcing a failure. [ 767.478433][T22487] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 767.526889][T22487] CPU: 0 UID: 0 PID: 22487 Comm: syz.1.4129 Not tainted syzkaller #0 PREEMPT(full) [ 767.526916][T22487] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 767.526928][T22487] Call Trace: [ 767.526936][T22487] [ 767.526944][T22487] dump_stack_lvl+0x189/0x250 [ 767.526973][T22487] ? __pfx____ratelimit+0x10/0x10 [ 767.526995][T22487] ? __pfx_dump_stack_lvl+0x10/0x10 [ 767.527018][T22487] ? __pfx__printk+0x10/0x10 [ 767.527046][T22487] ? __might_fault+0xb0/0x130 [ 767.527082][T22487] should_fail_ex+0x414/0x560 [ 767.527112][T22487] _copy_from_user+0x2d/0xb0 [ 767.527136][T22487] ___sys_sendmsg+0x158/0x2a0 [ 767.527161][T22487] ? __pfx____sys_sendmsg+0x10/0x10 [ 767.527229][T22487] ? __might_fault+0xb0/0x130 [ 767.527256][T22487] __sys_sendmmsg+0x227/0x430 [ 767.527283][T22487] ? __pfx___sys_sendmmsg+0x10/0x10 [ 767.527314][T22487] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 767.527356][T22487] ? ksys_write+0x22a/0x250 [ 767.527382][T22487] ? __pfx_ksys_write+0x10/0x10 [ 767.527411][T22487] __x64_sys_sendmmsg+0xa0/0xc0 [ 767.527434][T22487] do_syscall_64+0xfa/0xfa0 [ 767.527455][T22487] ? lockdep_hardirqs_on+0x9c/0x150 [ 767.527477][T22487] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 767.527494][T22487] ? clear_bhb_loop+0x60/0xb0 [ 767.527516][T22487] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 767.527533][T22487] RIP: 0033:0x7f653a38f749 [ 767.527549][T22487] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 767.527564][T22487] RSP: 002b:00007f653b24c038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 767.527585][T22487] RAX: ffffffffffffffda RBX: 00007f653a5e5fa0 RCX: 00007f653a38f749 [ 767.527598][T22487] RDX: 0400000000000292 RSI: 0000200000002c40 RDI: 0000000000000003 [ 767.527611][T22487] RBP: 00007f653b24c090 R08: 0000000000000000 R09: 0000000000000000 [ 767.527622][T22487] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 767.527634][T22487] R13: 00007f653a5e6038 R14: 00007f653a5e5fa0 R15: 00007ffcbf145048 [ 767.527666][T22487] [ 768.051216][T22508] netlink: 148 bytes leftover after parsing attributes in process `syz.2.4134'. [ 768.348513][T22526] netlink: 'syz.0.4140': attribute type 12 has an invalid length. [ 768.379672][T22526] netlink: 'syz.0.4140': attribute type 12 has an invalid length. [ 768.635874][T22545] ip6t_rpfilter: unknown options [ 768.684473][T22549] netlink: 'syz.3.4147': attribute type 1 has an invalid length. [ 768.764349][T22549] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4147'. [ 768.844171][T22551] ip6_vti0 speed is unknown, defaulting to 1000 [ 768.875565][T22561] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci0/hci0:200/input9 [ 769.490454][T22557] ip6_vti0 speed is unknown, defaulting to 1000 [ 769.505115][T22551] wg1 speed is unknown, defaulting to 1000 [ 769.746561][T22588] netlink: 'syz.5.4156': attribute type 23 has an invalid length. [ 769.784704][T22586] netlink: 'syz.1.4155': attribute type 4 has an invalid length. [ 769.800740][T22586] lo: entered allmulticast mode [ 769.811368][T22585] lo: left allmulticast mode [ 769.934743][T22596] x_tables: duplicate underflow at hook 1 [ 770.026755][T22557] wg1 speed is unknown, defaulting to 1000 [ 770.283584][T22604] bridge0: port 2(bridge_slave_1) entered disabled state [ 770.291297][T22604] bridge0: port 1(bridge_slave_0) entered disabled state [ 770.561921][T22605] netlink: 12 bytes leftover after parsing attributes in process `syz.5.4162'. [ 770.580060][T22608] geneve3: entered promiscuous mode [ 770.587547][T22607] netlink: 566 bytes leftover after parsing attributes in process `syz.1.4163'. [ 770.621026][ T8176] netdevsim netdevsim5 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 770.640101][ T8176] netdevsim netdevsim5 netdevsim0: set [1, 1] type 2 family 0 port 20002 - 0 [ 770.651644][ T8176] netdevsim netdevsim5 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 770.664801][ T8176] netdevsim netdevsim5 netdevsim1: set [1, 1] type 2 family 0 port 20002 - 0 [ 770.701046][ T8176] netdevsim netdevsim5 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 770.710581][ T8176] netdevsim netdevsim5 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 770.739962][T22617] sch_tbf: burst 0 is lower than device veth0_to_team mtu (1514) ! [ 770.751086][ T8176] netdevsim netdevsim5 netdevsim0: unset [1, 1] type 2 family 0 port 20002 - 0 [ 770.791798][ T8176] netdevsim netdevsim5 netdevsim1: unset [1, 1] type 2 family 0 port 20002 - 0 [ 770.932394][T22621] netlink: 'syz.3.4166': attribute type 1 has an invalid length. [ 770.941332][T22621] netlink: 20 bytes leftover after parsing attributes in process `syz.3.4166'. [ 771.105150][T22625] netlink: 'syz.3.4170': attribute type 10 has an invalid length. [ 771.113006][T22625] netlink: 40 bytes leftover after parsing attributes in process `syz.3.4170'. [ 771.164787][T22625] batman_adv: batadv0: Adding interface: virt_wifi0 [ 771.171737][T22625] batman_adv: batadv0: The MTU of interface virt_wifi0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 771.246209][T22625] batman_adv: batadv0: Not using interface virt_wifi0 (retrying later): interface not active [ 771.432765][T22639] netlink: 'syz.2.4169': attribute type 6 has an invalid length. [ 771.442732][T22639] IPv6: NLM_F_CREATE should be specified when creating new route [ 771.734204][T22658] netlink: 9 bytes leftover after parsing attributes in process `syz.2.4175'. [ 771.751459][T22660] netlink: 32 bytes leftover after parsing attributes in process `syz.0.4179'. [ 771.772962][T22658] .70·: renamed from hsr0 (while UP) [ 771.786676][T22658] .70·: entered allmulticast mode [ 771.794265][T22658] hsr_slave_0: entered allmulticast mode [ 771.829457][T22658] hsr_slave_1: entered allmulticast mode [ 771.854764][T22658] A link change request failed with some changes committed already. Interface .70· may have been left with an inconsistent configuration, please check. [ 771.935529][T22670] ip6_vti0 speed is unknown, defaulting to 1000 [ 772.223041][T22683] sch_tbf: burst 4398 is lower than device lo mtu (11337746) ! [ 772.265812][T22670] wg1 speed is unknown, defaulting to 1000 [ 772.422415][T22649] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 772.431674][T22649] Bluetooth: hci5: Error when powering off device on rfkill (-4) [ 772.482508][T22649] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 772.490489][T22649] Bluetooth: hci1: Error when powering off device on rfkill (-4) [ 772.505180][T22649] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 772.513130][T22649] Bluetooth: hci2: Error when powering off device on rfkill (-4) [ 772.547524][T22649] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 772.559009][T22649] Bluetooth: hci3: Error when powering off device on rfkill (-4) [ 772.579885][T22649] ------------[ cut here ]------------ [ 772.586331][T22649] refcount_t: underflow; use-after-free. [ 772.592518][T22649] WARNING: CPU: 1 PID: 22649 at lib/refcount.c:28 refcount_warn_saturate+0x11a/0x1d0 [ 772.602661][T22649] Modules linked in: [ 772.607230][T22649] CPU: 1 UID: 0 PID: 22649 Comm: syz.2.4175 Not tainted syzkaller #0 PREEMPT(full) [ 772.616734][T22649] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 772.627392][T22649] RIP: 0010:refcount_warn_saturate+0x11a/0x1d0 [ 772.634105][T22649] Code: 00 5a be 8b e8 27 80 f9 fc 90 0f 0b 90 90 eb d7 e8 1b 64 36 fd c6 05 21 9a dd 0a 01 90 48 c7 c7 60 5a be 8b e8 07 80 f9 fc 90 <0f> 0b 90 90 eb b7 e8 fb 63 36 fd c6 05 fe 99 dd 0a 01 90 48 c7 c7 [ 772.654336][T22649] RSP: 0018:ffffc9000be977b8 EFLAGS: 00010246 [ 772.660464][T22649] RAX: 526ea6f9ca325400 RBX: 0000000000000003 RCX: 0000000000080000 [ 772.670911][T22649] RDX: ffffc9000cb21000 RSI: 000000000003028c RDI: 000000000003028d [ 772.679515][T22649] RBP: 0000000000000000 R08: 0000000000000003 R09: 0000000000000004 [ 772.688012][T22649] R10: dffffc0000000000 R11: fffffbfff1bba684 R12: ffff888048a94400 [ 772.696526][T22649] R13: ffff888048f78860 R14: ffff888048f78878 R15: dffffc0000000000 [ 772.705019][T22649] FS: 00007fce171f66c0(0000) GS:ffff88812622e000(0000) knlGS:0000000000000000 [ 772.714783][T22649] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 772.721405][T22649] CR2: 00007fc7f7784d58 CR3: 0000000061a4a000 CR4: 00000000003526f0 [ 772.730131][T22649] Call Trace: [ 772.733438][T22649] [ 772.736962][T22649] klist_dec_and_del+0x3c7/0x3d0 [ 772.741960][T22649] klist_remove+0x1bd/0x340 [ 772.747217][T22649] ? __pfx_klist_children_put+0x10/0x10 [ 772.752803][T22649] ? __pfx_klist_remove+0x10/0x10 [ 772.758428][T22649] ? __pfx_kobject_move+0x10/0x10 [ 772.764134][T22649] ? do_raw_spin_unlock+0x122/0x240 [ 772.769386][T22649] ? get_device_parent+0x366/0x3a0 [ 772.775229][T22649] device_move+0x193/0x700 [ 772.779705][T22649] hci_conn_del_sysfs+0xb8/0x170 [ 772.785157][T22649] hci_conn_del+0xc36/0x11b0 [ 772.789807][T22649] hci_conn_hash_flush+0x191/0x230 [ 772.795467][T22649] hci_dev_close_sync+0x821/0xff0 [ 772.800571][T22649] ? __pfx_hci_dev_close_sync+0x10/0x10 [ 772.806692][T22649] ? _raw_spin_unlock_irqrestore+0xad/0x110 [ 772.812639][T22649] hci_dev_do_close+0x2f/0x90 [ 772.817978][T22649] hci_rfkill_set_block+0x21d/0x2e0 [ 772.823218][T22649] ? __pfx_hci_rfkill_set_block+0x10/0x10 [ 772.829460][T22649] rfkill_set_block+0x1d2/0x440 [ 772.834903][T22649] rfkill_fop_write+0x44b/0x570 [ 772.839807][T22649] ? __pfx_rfkill_fop_write+0x10/0x10 [ 772.845739][T22649] ? security_kernfs_init_security+0x260/0x290 [ 772.851942][T22649] ? rw_verify_area+0x255/0x4d0 [ 772.857303][T22649] ? __lock_acquire+0xab9/0xd20 [ 772.862207][T22649] ? __pfx_rfkill_fop_write+0x10/0x10 [ 772.868143][T22649] vfs_write+0x27e/0xb30 [ 772.872465][T22649] ? __pfx_vfs_write+0x10/0x10 [ 772.877850][T22649] ? __fget_files+0x2a/0x420 [ 772.882581][T22649] ? __fget_files+0x2a/0x420 [ 772.890904][T22649] ? __fget_files+0x3a0/0x420 [ 772.895991][T22649] ? __fget_files+0x2a/0x420 [ 772.900802][T22649] ksys_write+0x145/0x250 [ 772.905437][T22649] ? __pfx_ksys_write+0x10/0x10 [ 772.910344][T22649] ? do_syscall_64+0xbe/0xfa0 [ 772.915251][T22649] do_syscall_64+0xfa/0xfa0 [ 772.919784][T22649] ? lockdep_hardirqs_on+0x9c/0x150 [ 772.925407][T22649] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 772.931485][T22649] ? clear_bhb_loop+0x60/0xb0 [ 772.936597][T22649] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 772.942671][T22649] RIP: 0033:0x7fce18f8f749 [ 772.947500][T22649] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 772.968866][T22649] RSP: 002b:00007fce171f6038 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 772.977816][T22649] RAX: ffffffffffffffda RBX: 00007fce191e5fa0 RCX: 00007fce18f8f749 [ 772.986447][T22649] RDX: 0000000000000008 RSI: 0000200000000080 RDI: 0000000000000009 [ 772.994983][T22649] RBP: 00007fce19013f91 R08: 0000000000000000 R09: 0000000000000000 [ 773.003023][T22649] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 773.011358][T22649] R13: 00007fce191e6038 R14: 00007fce191e5fa0 R15: 00007fff9fc90e18 [ 773.019764][T22649] [ 773.022803][T22649] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 773.030089][T22649] CPU: 1 UID: 0 PID: 22649 Comm: syz.2.4175 Not tainted syzkaller #0 PREEMPT(full) [ 773.039456][T22649] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 773.049510][T22649] Call Trace: [ 773.052783][T22649] [ 773.055712][T22649] dump_stack_lvl+0x99/0x250 [ 773.060408][T22649] ? __asan_memcpy+0x40/0x70 [ 773.065123][T22649] ? __pfx_dump_stack_lvl+0x10/0x10 [ 773.070323][T22649] ? __pfx__printk+0x10/0x10 [ 773.074936][T22649] vpanic+0x237/0x6d0 [ 773.078938][T22649] ? __pfx_vpanic+0x10/0x10 [ 773.083747][T22649] panic+0xb9/0xc0 [ 773.087471][T22649] ? __pfx_panic+0x10/0x10 [ 773.091900][T22649] __warn+0x31b/0x4b0 [ 773.095896][T22649] ? refcount_warn_saturate+0x11a/0x1d0 [ 773.101463][T22649] ? refcount_warn_saturate+0x11a/0x1d0 [ 773.107004][T22649] report_bug+0x2be/0x4f0 [ 773.111426][T22649] ? refcount_warn_saturate+0x11a/0x1d0 [ 773.116966][T22649] ? refcount_warn_saturate+0x11a/0x1d0 [ 773.122505][T22649] ? refcount_warn_saturate+0x11c/0x1d0 [ 773.128061][T22649] handle_bug+0x84/0x160 [ 773.132303][T22649] exc_invalid_op+0x1a/0x50 [ 773.136802][T22649] asm_exc_invalid_op+0x1a/0x20 [ 773.141641][T22649] RIP: 0010:refcount_warn_saturate+0x11a/0x1d0 [ 773.147788][T22649] Code: 00 5a be 8b e8 27 80 f9 fc 90 0f 0b 90 90 eb d7 e8 1b 64 36 fd c6 05 21 9a dd 0a 01 90 48 c7 c7 60 5a be 8b e8 07 80 f9 fc 90 <0f> 0b 90 90 eb b7 e8 fb 63 36 fd c6 05 fe 99 dd 0a 01 90 48 c7 c7 [ 773.167384][T22649] RSP: 0018:ffffc9000be977b8 EFLAGS: 00010246 [ 773.173452][T22649] RAX: 526ea6f9ca325400 RBX: 0000000000000003 RCX: 0000000000080000 [ 773.181414][T22649] RDX: ffffc9000cb21000 RSI: 000000000003028c RDI: 000000000003028d [ 773.189384][T22649] RBP: 0000000000000000 R08: 0000000000000003 R09: 0000000000000004 [ 773.197345][T22649] R10: dffffc0000000000 R11: fffffbfff1bba684 R12: ffff888048a94400 [ 773.205311][T22649] R13: ffff888048f78860 R14: ffff888048f78878 R15: dffffc0000000000 [ 773.213301][T22649] ? refcount_warn_saturate+0x119/0x1d0 [ 773.218853][T22649] klist_dec_and_del+0x3c7/0x3d0 [ 773.223806][T22649] klist_remove+0x1bd/0x340 [ 773.228320][T22649] ? __pfx_klist_children_put+0x10/0x10 [ 773.233866][T22649] ? __pfx_klist_remove+0x10/0x10 [ 773.238889][T22649] ? __pfx_kobject_move+0x10/0x10 [ 773.243907][T22649] ? do_raw_spin_unlock+0x122/0x240 [ 773.249107][T22649] ? get_device_parent+0x366/0x3a0 [ 773.254219][T22649] device_move+0x193/0x700 [ 773.258642][T22649] hci_conn_del_sysfs+0xb8/0x170 [ 773.263602][T22649] hci_conn_del+0xc36/0x11b0 [ 773.268194][T22649] hci_conn_hash_flush+0x191/0x230 [ 773.273395][T22649] hci_dev_close_sync+0x821/0xff0 [ 773.278425][T22649] ? __pfx_hci_dev_close_sync+0x10/0x10 [ 773.283976][T22649] ? _raw_spin_unlock_irqrestore+0xad/0x110 [ 773.289871][T22649] hci_dev_do_close+0x2f/0x90 [ 773.294543][T22649] hci_rfkill_set_block+0x21d/0x2e0 [ 773.299750][T22649] ? __pfx_hci_rfkill_set_block+0x10/0x10 [ 773.305485][T22649] rfkill_set_block+0x1d2/0x440 [ 773.310367][T22649] rfkill_fop_write+0x44b/0x570 [ 773.315219][T22649] ? __pfx_rfkill_fop_write+0x10/0x10 [ 773.320597][T22649] ? security_kernfs_init_security+0x260/0x290 [ 773.326764][T22649] ? rw_verify_area+0x255/0x4d0 [ 773.331630][T22649] ? __lock_acquire+0xab9/0xd20 [ 773.336479][T22649] ? __pfx_rfkill_fop_write+0x10/0x10 [ 773.341945][T22649] vfs_write+0x27e/0xb30 [ 773.346192][T22649] ? __pfx_vfs_write+0x10/0x10 [ 773.350956][T22649] ? __fget_files+0x2a/0x420 [ 773.355552][T22649] ? __fget_files+0x2a/0x420 [ 773.360132][T22649] ? __fget_files+0x3a0/0x420 [ 773.364799][T22649] ? __fget_files+0x2a/0x420 [ 773.369387][T22649] ksys_write+0x145/0x250 [ 773.373722][T22649] ? __pfx_ksys_write+0x10/0x10 [ 773.378659][T22649] ? do_syscall_64+0xbe/0xfa0 [ 773.383433][T22649] do_syscall_64+0xfa/0xfa0 [ 773.387962][T22649] ? lockdep_hardirqs_on+0x9c/0x150 [ 773.393157][T22649] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 773.399229][T22649] ? clear_bhb_loop+0x60/0xb0 [ 773.403924][T22649] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 773.409840][T22649] RIP: 0033:0x7fce18f8f749 [ 773.414258][T22649] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 773.433858][T22649] RSP: 002b:00007fce171f6038 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 773.442272][T22649] RAX: ffffffffffffffda RBX: 00007fce191e5fa0 RCX: 00007fce18f8f749 [ 773.450240][T22649] RDX: 0000000000000008 RSI: 0000200000000080 RDI: 0000000000000009 [ 773.458213][T22649] RBP: 00007fce19013f91 R08: 0000000000000000 R09: 0000000000000000 [ 773.466176][T22649] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 773.474143][T22649] R13: 00007fce191e6038 R14: 00007fce191e5fa0 R15: 00007fff9fc90e18 [ 773.482137][T22649] [ 773.485568][T22649] Kernel Offset: disabled [ 773.489885][T22649] Rebooting in 86400 seconds..