last executing test programs: 4.127764398s ago: executing program 3 (id=2801): ioctl$XFS_IOC_START_COMMIT(0xffffffffffffffff, 0x80585882, &(0x7f0000000740)={0xffffffffffffffff}) getsockopt$PNPIPE_IFINDEX(r0, 0x113, 0x2, &(0x7f00000007c0)=0x0, &(0x7f0000000800)=0x4) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$netlink(0x10, 0x3, 0x4) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000000300), 0x400000000000159, 0x40840) sendmsg$RDMA_NLDEV_CMD_STAT_GET(r3, &(0x7f0000000340)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000003c0)={0x0}, 0x1, 0x0, 0x0, 0x4000000}, 0xd465f47fd5527c60) write(0xffffffffffffffff, 0x0, 0x0) write(0xffffffffffffffff, 0x0, 0x0) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0x2000) r5 = syz_genetlink_get_family_id$devlink(&(0x7f0000000400), 0xffffffffffffffff) socketpair(0x1, 0x3, 0x8000, &(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) socket$nl_generic(0x10, 0x3, 0x10) sendmsg$DEVLINK_CMD_SB_POOL_GET(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000500)={&(0x7f0000000540)=ANY=[@ANYBLOB="b97902ce", @ANYRES16=r5, @ANYBLOB="080027bd7000ffdbdf250f0000000e0001006e657464657673696d0000000f0002006e657464657673696d30000008000b000700000006001100050000000e0001006e657464657673696d0000000f0002006e657464657673696d30000008000b000500000006001100010000000e0001006e657464657673696d0000000f0002006e657464657673696d30000008000b0002000000060011007e0a0000080001007063690011000200303030303a30303a31302e300000000008000b000500000006001100080000000e0001006e657464657673696d0000000f0002006e657464657673696d30000008000b000800000006001100b7050000080001007063690011000200303030303a30303a31302e300000000008000b00080000000600110004000000"], 0x12c}, 0x1, 0x0, 0x0, 0xc091}, 0x8090) write(r3, &(0x7f0000000680)="29000000140005b7ff000051915f95eb2d010003a606a40e07fff024bb000000000000000040000000", 0x29) epoll_create1(0x80000) socket$unix(0x1, 0x5, 0x0) r8 = socket$netlink(0x10, 0x3, 0xc) r9 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000d80)=ANY=[@ANYBLOB="020001005f00000000000000150000010000404ac1fb", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xc, 0x10, &(0x7f0000000ac0)=ANY=[@ANYBLOB="18050000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r9, @ANYBLOB="0000000000000000b704000008000000850000001c00000095"], &(0x7f0000000b40)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$packet_add_memb(r7, 0x107, 0x1, &(0x7f0000000940)={r1, 0x1, 0x6, @remote}, 0x10) sendmsg$nl_route(r8, &(0x7f0000000d40)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB, @ANYRES32=0x0, @ANYBLOB="08000180"], 0x20}}, 0x4040) r10 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x3, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000610000001801000020786c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000110b0008850000000500000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0xd, '\x00', 0x0, @fallback=0x2a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r4, 0x0, 0x0, 0x0, 0x0}, 0x94) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r6, 0x84, 0x66, &(0x7f0000000840)={0x2, 0x6}, &(0x7f0000000880)=0x8) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r7, 0x84, 0x7b, &(0x7f00000008c0)={r11, 0x72f}, &(0x7f0000000900)=0x8) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r10, 0x0, 0x6b, 0x0, &(0x7f00000002c0)="dc188619b95d02ff4284860188a86a4e08", 0x0, 0x8001ff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r12 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000300)='memory.events\x00', 0x7a05, 0x1700) pwritev(r12, &(0x7f00000006c0)=[{&(0x7f0000000700)="2c0e", 0x3}], 0x1, 0x803ffff, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000b80)={0x0, 0x0, &(0x7f0000000bc0)={&(0x7f0000000e00)=@newtaction={0x124, 0x30, 0xfbed, 0x70bd29, 0x25dfdbff, {}, [{0x110, 0x1, [@m_bpf={0x10c, 0xf, 0x0, 0x0, {{0x8}, {0x88, 0x2, 0x0, 0x1, [@TCA_ACT_BPF_PARMS={0x18, 0x2, {0x3, 0x3, 0x4, 0x5, 0x3}}, @TCA_ACT_BPF_FD={0x8, 0x5, r12}, @TCA_ACT_BPF_OPS_LEN={0x6, 0x3, 0xa}, @TCA_ACT_BPF_FD={0x8, 0x5, r6}, @TCA_ACT_BPF_OPS_LEN={0x6, 0x3, 0x5}, @TCA_ACT_BPF_OPS={0x2c, 0x4, [{0x9, 0xf2, 0x52, 0xf3}, {0x2, 0xf, 0x4f, 0xb9}, {0x1, 0xba, 0x9, 0xc000}, {0x4, 0x5, 0xff, 0x8}, {0x5, 0x1, 0x7, 0x6bca}]}, @TCA_ACT_BPF_FD={0x8, 0x5, r8}, @TCA_ACT_BPF_OPS_LEN={0x6, 0x3, 0x3}, @TCA_ACT_BPF_FD={0x8}, @TCA_ACT_BPF_OPS_LEN={0x6, 0x3, 0x7}]}, {0x60, 0x6, "d9b000487eb021769ecaa461b8b3a09faaf4f4da4d6a7c7c943912bc6c104b60d66900135f671df87628137883d879efcca57283105da74fb9996ad2742a7240afdd78652c9cf1400459156b6425d850ec7d93bf24bb932c33a70266"}, {0xc, 0x7, {0x1}}, {0xc}}}]}]}, 0x124}}, 0x0) 3.931414503s ago: executing program 2 (id=2805): mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x1, 0x32, 0xffffffffffffffff, 0xa2fac000) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x13, &(0x7f0000000180)=ANY=[@ANYBLOB="18080000000000000000000010f00000851000000600000018020000", @ANYRES32, @ANYBLOB="00000000200000006600020080ffffff18000000fffffffe00000000000000009500040000000000360a020000000000180100002020782500000000002020207b1a00fe00000000bfa100000000000007010000f8ffffffb702000008000000b50afdff0000000085000000060000009500000000000000"], &(0x7f0000000240)='GPL\x00', 0x2, 0xff5c, &(0x7f0000000280)=""/222, 0xd0ff}, 0x78) 3.66246707s ago: executing program 3 (id=2807): openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x42901, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) socket$netlink(0x10, 0x3, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cpuacct.usage_percpu_sys\x00', 0x275a, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) socket(0x400000000010, 0x3, 0x0) socket$unix(0x1, 0x1, 0x0) socket(0x400000000010, 0x3, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket$inet6_mptcp(0xa, 0x1, 0x106) socket$nl_generic(0x10, 0x3, 0x10) socket$key(0xf, 0x3, 0x2) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x1f, 0xd, &(0x7f0000000300)=ANY=[@ANYBLOB="1800000005080000000000008200000018010000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000048004807b8af8ff00000000000000000000000007020000f8ffffffb703000008000000b70400000200000085000000a6000000850000005000000095"], &(0x7f0000000380)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x35}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000003c0)={r1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0xa, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="1800000074918fda000000000100000061107d000000000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x17, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x1}, 0x94) 3.417516262s ago: executing program 3 (id=2808): r0 = openat$cgroup(0xffffffffffffffff, &(0x7f0000000300)='syz1\x00', 0x200002, 0x0) openat$cgroup_ro(r0, 0x0, 0x0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) close(0x3) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x275a, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x13, 0x4, &(0x7f0000000100)=ANY=[@ANYRES64=r2], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x1, '\x00', 0x0, @fallback=0x2d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) write$cgroup_int(r2, &(0x7f0000000200), 0x806000) ioctl$FS_IOC_RESVSP(r2, 0x40305829, &(0x7f0000000380)={0x0, 0x0, 0x4000, 0x9ffffc}) unshare(0x22020600) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, 0x0, 0x20004090) epoll_pwait(0xffffffffffffffff, 0x0, 0x0, 0x7, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) unshare(0xa000200) r4 = socket$inet6(0xa, 0x80002, 0x0) setsockopt$inet6_udp_int(r4, 0x11, 0x67, 0x0, 0x0) sendmmsg$inet6(r4, 0x0, 0x62, 0x1404) unshare(0x10000000) socket$nl_generic(0x10, 0x3, 0x10) mmap$xdp(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x0, 0x20010, 0xffffffffffffffff, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, 0x0) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x1000004, 0x42072, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, 0x0, 0x50) socket$nl_route(0x10, 0x3, 0x0) sendfile(r2, r1, 0x0, 0x7d1d7457) r5 = socket$inet_udp(0x2, 0x2, 0x0) sendmsg$inet(r5, &(0x7f0000000340)={&(0x7f0000000440)={0x2, 0x4e20, @multicast1}, 0x10, 0x0, 0x0, &(0x7f0000000400)=[@ip_tos_int={{0x14, 0x0, 0x1, 0x6}}, @ip_ttl={{0x14, 0x0, 0x2, 0x1a7}}], 0x30}, 0x8) 2.806587444s ago: executing program 2 (id=2813): socket(0x10, 0x80002, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) bind$netlink(0xffffffffffffffff, &(0x7f0000000b40)={0x10, 0x0, 0x3, 0x80000000}, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r0, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r2, 0x84, 0xd, &(0x7f00000002c0)=@assoc_value, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000280)={'netdevsim0\x00'}) socket$unix(0x1, 0x2, 0x0) bpf$BPF_PROG_QUERY(0x10, 0x0, 0x0) bpf$BPF_LINK_CREATE_XDP(0x1c, 0x0, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000004c0)={&(0x7f0000000500)=ANY=[], 0x0, 0x8e}, 0x28) socket$inet(0x2, 0x2, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x40241, 0x0) socket$key(0xf, 0x3, 0x2) bpf$MAP_CREATE(0x0, &(0x7f0000000a00)=ANY=[@ANYBLOB="12000000040100000800000002"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000640)={0x3, 0x10, &(0x7f0000000700)=ANY=[@ANYBLOB="bfa200000000000007020000fcfeffff620200000000000018", @ANYRES32, @ANYBLOB="000000000000000085000000010000001500070000000000bf06000000000000bf61000000000000070100000400000085000000aa000000bf61000000000000070100000400"], &(0x7f0000000780)='GPL\x00', 0x7, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = syz_genetlink_get_family_id$ethtool(&(0x7f00000003c0), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_COALESCE_SET(r3, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000480)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="010000000000000000001000000018000180140002006e657464657673696d3000080000000005000b"], 0x34}}, 0x4044890) 2.710459705s ago: executing program 1 (id=2815): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0200000004000000080000000100000080"], 0x48) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000100)={{r0, 0xffffffffffffffff}, &(0x7f0000000240), &(0x7f0000000280)='%pi6 \x00'}, 0x20) bpf$BPF_BTF_GET_FD_BY_ID(0x13, 0x0, 0x0) r2 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000040)={&(0x7f0000000a00)=ANY=[@ANYBLOB="9feb010018000000000000004c0000004c0000002a0000000100000000000001040000002000000105000000010000040400000013000000010000000000000017000000020000040800000021000000010000000000000025000000020000002000000000696e74006270665f7370696e5f6c6f636b0076616c006d61705f76616c756500636e74006c"], 0x0, 0x8e}, 0x28) bpf$MAP_CREATE(0x0, &(0x7f0000000c00)=ANY=[@ANYBLOB="0200000004000000080000000100000000000000", @ANYRES32=0x0, @ANYBLOB="0000000000000000000000000000000000000000f955066afe", @ANYRES32=0x0, @ANYRES32=r2, @ANYBLOB="010000000300"/28], 0x48) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)=ANY=[@ANYRESOCT=r2], 0x40) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000b80)={r3, &(0x7f0000000bc0)="84"}, 0x20) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r4 = openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nfc(&(0x7f0000000340), r5) r7 = socket$inet6(0xa, 0x802, 0x0) connect$inet6(r7, &(0x7f00000004c0)={0xa, 0x0, 0x0, @loopback, 0x3}, 0x1c) setsockopt$inet6_IPV6_HOPOPTS(r7, 0x29, 0x36, 0x0, 0x0) r8 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x11, 0x13, &(0x7f00000006c0)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000020850000009400000018010000786c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x11}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000007c0)={r8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20}, 0x48) ioctl$IOCTL_GET_NCIDEV_IDX(r4, 0x0, &(0x7f00000000c0)=0x0) sendmsg$NFC_CMD_DEV_UP(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r6, @ANYBLOB="010426bd7000f8dbdf250200000008000100", @ANYRES32=r9], 0x1c}}, 0x4008054) r10 = bpf$MAP_CREATE(0x0, &(0x7f0000000c80)=ANY=[@ANYBLOB="0100000004000000080000000c00000000000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000000000000000000000000000000000000000000f9c997edf300f5cff9d23e7399557f2dfa11b98c0bc5ec611ad111407055251cdb0782dfc10c0534ee8081bde0d5ea9272d8f2723e94a99beebbc38de53e6eb2ff37975afc64f4e572b3cc68210368d5777a833784fc2b839bf56ea179b8fc1bb00a"], 0x50) r11 = bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x11, 0xd, &(0x7f0000000900)=@framed={{0x18, 0x0, 0x0, 0x0, 0x400}, [@call={0x85, 0x0, 0x0, 0x11}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r10}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x24, '\x00', 0x0, @fallback=0x34, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f00000009c0)={r11, r10}, 0xc) r12 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), r12) write$nci(r4, &(0x7f00000002c0)=ANY=[@ANYBLOB="61050c02030002302a6ef75b246178c2a300c802f000"], 0x16) bpf$PROG_LOAD(0x5, &(0x7f0000000ac0)={0x7, 0x4, &(0x7f0000000d40)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, [@kfunc={0x85, 0x0, 0x2, 0x0, 0x2d075}]}, &(0x7f0000000d80)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x42, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x5}, 0x94) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000300)={r1}, 0x4) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0x3, 0x11, &(0x7f0000000500)=ANY=[@ANYBLOB="180200000000000000000000020004008500000097000000b7080000000000007b8af8ff00000000b7080000ffffffff7b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r0, @ANYBLOB="0000000000000000b70500000800000085000000a500000095"], &(0x7f00000005c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x4}, 0x94) 2.532487945s ago: executing program 2 (id=2818): r0 = socket$can_raw(0x1d, 0x3, 0x1) setsockopt$CAN_RAW_ERR_FILTER(r0, 0x65, 0x7, &(0x7f00000001c0)=0x8, 0x4) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000440)={'batadv_slave_0\x00', 0x0}) sendmsg$can_raw(r0, &(0x7f0000000140)={&(0x7f0000000000)={0x1d, r1}, 0x10, &(0x7f00000005c0)={&(0x7f0000000040)=@canfd={{0x3, 0x0, 0x1, 0x1}, 0x2e, 0x0, 0x0, 0x0, "3cf3a2617b51b06f859ed3d1a1b5e9e624fd2a9bae3bce51acf411e140660622299e7f85c9221ffb417de95a01dbb72054a547273c3dfe901320a2c54b22270d"}, 0x48}}, 0x0) 2.392303673s ago: executing program 2 (id=2819): unshare(0x2c020400) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000002c0)=@newlink={0x50, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x42010, 0x2}, [@IFLA_LINKINFO={0x30, 0x12, 0x0, 0x1, @geneve={{0xb}, {0x20, 0x2, 0x0, 0x1, [@IFLA_GENEVE_REMOTE6={0x14, 0x12, @private1}, @IFLA_GENEVE_ID={0x8, 0x1, 0x4}]}}}]}, 0x50}, 0x1, 0x0, 0x0, 0x40680c5}, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup/syz0\x00', 0x1ff) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000000c0), 0x200002, 0x0) r3 = openat$cgroup_int(r2, &(0x7f0000000100)='cgroup.max.descendants\x00', 0x2, 0x0) bind$inet6(r0, &(0x7f00000003c0)={0xa, 0x4e22, 0x0, @empty}, 0x1c) r4 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000c00)={0x6, 0x8, &(0x7f0000000340)=@raw=[@tail_call={{0x18, 0x2, 0x1, 0x0, 0x1}}, @map_val={0x18, 0x2, 0x2, 0x0, 0x1, 0x0, 0x0, 0x0, 0xffffffff}, @alu={0x7, 0x0, 0xa, 0x0, 0x2, 0xfffffffffffffff8, 0xfffffffffffffff0}], &(0x7f0000000380)='GPL\x00', 0x2, 0x0, 0x0, 0x41100, 0x41, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, &(0x7f0000000a80)={0x7, 0x2}, 0x8, 0x10, &(0x7f0000000ac0)={0x1, 0x7, 0x2, 0x865}, 0x10, 0x0, 0x0, 0x9, &(0x7f0000000b00)=[r3, 0x1], &(0x7f0000000b40)=[{0x3, 0x2, 0x1, 0x1}, {0x4, 0x5, 0x0, 0x9}, {0x5, 0x4, 0x4, 0xb}, {0x1, 0x4, 0x2, 0x19}, {0x5, 0x3, 0xe, 0x2}, {0x4, 0x4, 0xe, 0x3}, {0x1, 0x1, 0x1, 0x7}, {0x3, 0x3, 0xe, 0x6}, {0x1, 0x3, 0xd, 0x3}], 0x10, 0x5}, 0x94) write(r4, &(0x7f0000000cc0)="11e6b24d885ad649a7979ab22d0a07b7e964abda9312a8412dc8c97d24a999fb1af1743ea23eb132bac4693dd26d33c7690634945c00d5af1e1cca1c", 0x3c) r5 = socket$inet6_udp(0xa, 0x2, 0x0) r6 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r6, &(0x7f00000000c0)={0x1f, 0xffff, 0x3}, 0x6) write(r6, &(0x7f0000000180)="4c00000011001200001100020000140002000000200000", 0x17) setsockopt$IP6T_SO_SET_REPLACE(r5, 0x29, 0x40, &(0x7f0000000400)=@mangle={'mangle\x00', 0x2, 0x6, 0x5e8, 0x2e8, 0x3d8, 0x1c0, 0x1c0, 0x3d8, 0x518, 0x518, 0x518, 0x518, 0x518, 0x6, 0x0, {[{{@uncond, 0x0, 0xa8, 0xe0, 0x0, {0x7a00000010000000}}, @common=@inet=@SET3={0x38, 'SET\x00', 0x3, {{0xffffffffffffffff, 0x2, 0x1}, {0xffffffffffffffff, 0x4, 0x1}, {0xffffffffffffffff, 0x4}, 0x5, 0x7ff}}}, {{@ipv6={@mcast2, @dev={0xfe, 0x80, '\x00', 0xa}, [0x0, 0x0, 0x0, 0xffffff00], [0x0, 0x0, 0xffffffff, 0xff], 'macvlan0\x00', 'veth1_vlan\x00', {}, {}, 0x6, 0x1, 0x4}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38, 'SET\x00', 0x3, {{0xffff}, {}, {0x87, 0x0, 0x7}}}}, {{@uncond, 0x0, 0x100, 0x128, 0x48000000, {}, [@common=@eui64={{0x28}}, @common=@srh={{0x30}, {0x33, 0x66, 0xf8, 0xa6, 0x9, 0x440, 0x502}}]}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffc}}, {{@uncond, 0x0, 0xa8, 0xf0}, @DNPT={0x48, 'DNPT\x00', 0x0, {@ipv4=@initdev={0xac, 0x1e, 0x1, 0x0}, @ipv4=@empty, 0x2c, 0x16, 0x4}}}, {{@uncond, 0x0, 0x118, 0x140, 0x0, {}, [@common=@dst={{0x48}, {0x7ff, 0x2, 0x1, [0xff, 0x4239, 0x1, 0x8001, 0xb1, 0xfff5, 0x5, 0x8, 0xfff, 0x3, 0xb, 0xa, 0x5, 0x10, 0x2, 0xc], 0xd}}, @inet=@rpfilter={{0x28}, {0x6}}]}, @HL={0x28, 'HL\x00', 0x0, {0x5}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x648) listen(r0, 0x0) setsockopt$inet_sctp_SCTP_EVENTS(0xffffffffffffffff, 0x84, 0xb, &(0x7f0000000f80)={0x0, 0x2, 0x9, 0x4, 0xbe, 0x1, 0x3, 0x54, 0x81, 0x5, 0x4d, 0xb, 0x5, 0x8}, 0xe) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000d80)='ns/net\x00') sendmsg$GTP_CMD_NEWPDP(r7, &(0x7f0000000dc0)={0x0, 0x0, &(0x7f0000000e00)={&(0x7f0000000e40)={0x3c, 0x0, 0x1, 0x0, 0x0, {0x3}, [@GTPA_LINK={0x8}, @GTPA_VERSION={0x8}, @GTPA_PEER_ADDRESS={0x8, 0x4, @remote}, @GTPA_NET_NS_FD={0x8, 0x7, r8}, @GTPA_MS_ADDRESS={0x8, 0x5, @multicast2}]}, 0x3c}}, 0x0) sendmsg$GTP_CMD_DELPDP(r4, &(0x7f0000000f40)={&(0x7f0000000d00)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000f00)={&(0x7f0000000e80)={0x44, 0x0, 0x200, 0x70bd2b, 0x25dfdbff, {}, [@GTPA_VERSION={0x8, 0x2, 0x1}, @GTPA_VERSION={0x8, 0x2, 0x1}, @GTPA_MS_ADDR6={0x14, 0xc, @ipv4={'\x00', '\xff\xff', @local}}, @GTPA_TID={0xc, 0x3, 0x1}]}, 0x44}, 0x1, 0x0, 0x0, 0x44010}, 0x40050) ppoll(&(0x7f0000000000)=[{r0, 0x228}], 0x1, 0x0, 0x0, 0x0) r9 = socket$netlink(0x10, 0x3, 0x6) writev(r9, &(0x7f0000000080)=[{&(0x7f0000000200)="a10100001500add427323b470c45b4560a067fffffff81004e22000d00ff0028925aa80020007b00090080000efffeffe809000000ff0000f03ac7100003ffffffffffffffffffffffe7ee00000000000000000200000000", 0x1a1}], 0x1) 2.302921187s ago: executing program 1 (id=2821): r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, 0x0, 0x0) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f00000003c0)={0x500, 0x0, 0x0, 0x19}, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000005c0)=@newtaction={0x14, 0x30, 0xb, 0x70bd2d}, 0x14}, 0x1, 0x0, 0x0, 0x890}, 0x40) r3 = socket$netlink(0x10, 0x3, 0x6) bind$netlink(r3, &(0x7f0000000900)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) connect$vsock_stream(0xffffffffffffffff, 0x0, 0x0) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000980)={&(0x7f0000000d00)=@newsa={0xf8, 0x10, 0x401, 0x0, 0x0, {{@in=@local, @in=@rand_addr=0x64010101, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x73}, {@in=@local, 0x4d2, 0x32}, @in=@remote, {0x7fffffffffffffff, 0x7fffffffffffffff, 0x7fffffffffffffff, 0x7fffffffffffffff}, {}, {0x0, 0x0, 0x3}, 0x0, 0x0, 0x2, 0x5, 0x9}, [@sa_dir={0x5, 0x21, 0x1}]}, 0xf8}}, 0x0) syz_emit_ethernet(0x30, &(0x7f0000000e40)={@local, @remote, @void, {@ipv4={0x800, @esp={{0x5, 0x4, 0x0, 0x8, 0x22, 0x0, 0x0, 0x40, 0x32, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}, @local}, {0x4d2, 0xffff}}}}}, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000500)=ANY=[@ANYBLOB="2000000046000901fefffffffeffffff017c00000c0003804e10"], 0x20}, 0x1, 0x0, 0x0, 0x48815}, 0xc000) r5 = socket$nl_route(0x10, 0x3, 0x0) syz_genetlink_get_family_id$team(&(0x7f0000000680), 0xffffffffffffffff) sendmsg$nl_route(r5, &(0x7f0000000380)={0x0, 0x0, 0x0}, 0x0) socket$packet(0x11, 0x3, 0x300) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000b00), 0xffffffffffffffff) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000700)=@base={0xf, 0x4, 0x4, 0x12}, 0x48) r7 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000780)={0xe, 0x4, &(0x7f0000000840)=ANY=[@ANYBLOB="18020000801000000000000004000000850000002700000095"], &(0x7f00000009c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00}, 0x80) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000a00)={@map=r6, r7, 0x5}, 0x10) r8 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(&(0x7f0000000b40), r8) 2.280446383s ago: executing program 4 (id=2822): r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000003c0)='blkio.throttle.io_service_bytes_recursive\x00', 0x275a, 0x0) pwrite64(r1, &(0x7f0000000400)="8c", 0x1, 0x7fffffffffffffff) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r1, 0x89f3, &(0x7f00000005c0)={'ip6gre0\x00', &(0x7f0000000540)={'syztnl0\x00', 0x0, 0x2f, 0x2, 0x29, 0x4, 0x1, @mcast1, @ipv4={'\x00', '\xff\xff', @multicast2}, 0x700, 0x700, 0x2, 0x5}}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCETHTOOL(r3, 0x89f6, &(0x7f00000007c0)={'bridge0\x00', &(0x7f0000000800)=@ethtool_regs={0x12, 0x0, 0x6, "2a161d2d71db"}}) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000600)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x3, '\x00', r2, r1, 0x1, 0x1, 0x5}, 0x50) bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f0000000500)={&(0x7f0000000140)="046a10ae889ce61fcb5adcde68222f6f649db77650b59831548f0be5d2d7a548958f9e78cd5365de519ba28cd5f109a7cc59545203a49ce6d21b2781a02d55d256b6486967438db82cfdc2d93efd97d38a78c7203e627423b4220c7319fc6cd4c0b04df6a4404fa1271dd80a1642dfc4cda2a454d2d127a444ed8444d8ccc1eb67c423c2f062a2439d598d25294fa0a620ed68cbce001dce75e2f7685f1826943212ed5025741ab08299971481734594446318b62e745a1a6738dd3015f03405f48fa771a848e6699393de2eb69a733f29244d12c2746e0ba10049fb1b57dea7d1b2a66afd62500c387a1d76b05691d40f53ee40221dc1", &(0x7f0000000240)=""/79, &(0x7f00000002c0)="38973f227fcb7097dbf4ac4f172a5a237f8cc1af724c437640f20bb2f27e149ccc7eb09728ec00615a6d", &(0x7f0000000300)="354185955ab1452b2e297f2f8a3a7e411d9eec76bff72728f960155e3391154d4c30c250f82e280d49f010e2d15fca635e3c5bee99d17ae0e448dff060b8c98bb12c19e01d11e04baedd580adbe93fdb41ecbbcfd6a5e1f17ab17142f3e960fa935196778a9047183236113e802889018926a4c72396d2e832bbedd9bb14394420a79cf2caa9a57b28b7184b029ef5e0f788cda66cad", 0x7, r1}, 0x38) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000040)={'sit0\x00', &(0x7f0000000a80)={'syztnl0\x00', 0x0, 0x40, 0x700, 0x40, 0x7, {{0x43, 0x4, 0x0, 0x1, 0x10c, 0x67, 0x0, 0x0, 0x4, 0x0, @broadcast, @private=0xa010102, {[@timestamp_prespec={0x44, 0x34, 0xc0, 0x3, 0x4, [{@empty, 0x4}, {@remote, 0x4}, {@rand_addr=0x64010102, 0xa}, {@dev={0xac, 0x14, 0x14, 0x21}, 0xfff}, {@local, 0x6e6c}, {@loopback, 0x7ff}]}, @ssrr={0x89, 0x23, 0xf0, [@local, @local, @rand_addr=0x64010102, @remote, @remote, @broadcast, @loopback, @remote]}, @end, @lsrr={0x83, 0x7, 0xad, [@private=0xa010102]}, @cipso={0x86, 0x26, 0x2, [{0x0, 0xe, "731f23b8c5dea47725b932c1"}, {0x2, 0x12, "8b7c56ae7cec8c943119dd80f6bd496d"}]}, @cipso={0x86, 0x45, 0x3, [{0x2, 0xe, "d0e079a25621b73ea2e39210"}, {0x0, 0x7, "48d88ddb5c"}, {0x6, 0xf, "e05a41b85bddb7fea0df4a6836"}, {0x6, 0x12, "13b52622039f47c1550fa6b587bbaff0"}, {0x2, 0x9, "f9185eb66443f2"}]}, @timestamp={0x44, 0x28, 0x26, 0x0, 0x5, [0x116, 0xff, 0x50000, 0x400, 0x6, 0x1, 0x6, 0x42000000, 0xb0]}, @generic={0x89, 0x3, "b8"}]}}}}}) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_DELETE(r4, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000880)={&(0x7f00000008c0)=ANY=[@ANYBLOB="500000000201030000000000000000000a0000040c0019800800020023000000300002802c00018014000300"], 0x50}, 0x1, 0x0, 0x0, 0x8041}, 0x4000052) setsockopt$sock_attach_bpf(r4, 0x1, 0x32, &(0x7f0000000900)=r1, 0x4) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f3, &(0x7f00000000c0)={'syztnl0\x00', &(0x7f0000000100)={'gretap0\x00', 0x0, 0x10, 0x80, 0x0, 0x2, {{0x5, 0x4, 0x0, 0x1, 0xfffffffffffffd4d, 0x0, 0x0, 0x10, 0x0, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}, @empty}}}}) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000680)=@bpf_lsm={0xb, 0x4, &(0x7f0000000740)=ANY=[@ANYBLOB="660a00002f00000061116e0000000000850000001c00000095"], &(0x7f0000000780)='GPL\x00', 0x1, 0x0, 0x0, 0x41100, 0x46}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x18, 0xe, &(0x7f0000000a00)=ANY=[@ANYBLOB="18080000d0ff0000000000003e00000018000000", @ANYRES32, @ANYBLOB="00000000000000006608000000000000180100002028782500000000002020207b1bf0ff00000000bfa10000000000000701000000feffffb702000008000000b50afbff00000000850000000600000095"], &(0x7f0000000000)='GPL\x00', 0xb, 0x0, 0x0, 0x0, 0xc}, 0x94) 2.155254343s ago: executing program 3 (id=2823): socket$nl_netfilter(0x10, 0x3, 0xc) pipe(&(0x7f0000000b80)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000bc0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000c00)="fc0000001d000724ab09254ec100070007ab08001b000000f0ffff002100057e0000000000000e000039000000039815fad151ba0101099cecb94b46fe0000000a00020025", 0xffffff0c) write$cgroup_subtree(r0, &(0x7f0000000c80)={[{0x2d, 'cpuset'}]}, 0x8) splice(r1, 0x0, r0, 0x0, 0x1100000000f336, 0x8) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000800)={0x0, 0x0, &(0x7f0000000840)={&(0x7f0000000880)=ANY=[@ANYBLOB="c40000001900674c2cbd70000000000000000000000000000000000000000000ac1eff0100000000000000000000000000000000000000000a00000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0100000000000000000000000000000000000020000000000000000000000000000000000000000000008000000000000000000000000000fcffffffffffffff0000000000000000b0ac00000000000000000000000000000000000000000000000400000000000000000002000000000a00100001"], 0xc4}}, 0x4c050) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000940), 0x40241, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000cc0)='./cgroup.cpu/syz1\x00', 0x1ff) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000d00), 0x200002, 0x0) r6 = openat$cgroup_int(r5, &(0x7f0000000d40)='cgroup.clone_children\x00', 0x2, 0x0) r7 = openat$cgroup_ro(r5, &(0x7f0000000d80)='cpuacct.usage_percpu_user\x00', 0x0, 0x0) sendfile(r6, r7, 0x0, 0x38) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000980)={'syzkaller1\x00', 0xc201}) r8 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r8, 0x8914, &(0x7f00000009c0)={'syzkaller1\x00', @link_local}) write$tun(r4, &(0x7f0000000a00)=ANY=[@ANYBLOB="034886dd010000000000140000006000000003082f00fe88a43de1a400000000000000007d01ff020000000000000000000000000001"], 0xfdef) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1100000004000000040000000001"], 0x50) r9 = socket$packet(0x11, 0x2, 0x300) setsockopt$sock_linger(r9, 0x1, 0x3d, &(0x7f0000000a40)={0x0, 0x1}, 0x8) sendmmsg$sock(r9, &(0x7f0000000a80)=[{{&(0x7f0000000ac0)=@ieee802154={0x24, @long={0x3, 0x2, {0xaaaaaaaaaaaa0202}}}, 0x80, 0x0, 0x0, &(0x7f0000000b40)=[@txtime={{0x18, 0x1, 0x3d, 0xffffffffffff}}], 0x18}}], 0x1, 0x8840) sendmsg$tipc(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000340)="76b6939e031833d84849623a32403fb4bee581d5177b28ad5fe175be156097d8d51c42910f7b666c3ca659af7418559555b83a134d5a7d694de73d76673b9c9570cb5d86f4e683565b99eca59bcc00d2e0dd69a369bfbe2e36362dee2c8954c0d279e2124bb59fb1254d2c493aeee9025a116e84f6dd235e32b4e23fe637a74bfce81656852005c1dd68618aabb077e8fa3d024dd1871b894c895b316fa780c26be7de8fdfa9a17e4ef7c491ed9127d41c5067e35a0ea8e704028581c093c7c64de95055928bd58831b4f140adf4024ff47c13b939b08f8419a83278265b7746b5544d55f9da44bf4c88516d6739f5f1ae805f5c54d1831b3c5d3c93d569cf7881b7d066e0d57b3d77d97bc24964556d875f80c5bee4fc81b8fc3731468a3df2ee385149ae7e40c9762218f34d8cc4c5f1df58efc17f05ef6da8d8d1e961e10197c59e8b06bca9df2c7cacf0de9760d1520871b15fef8462a93e51795ebeb2e7b2835686fc37310299b3582f4988e80538b15edf45cf9397f4bcc39bcbd8cad3d0f1e7bfd86f4882c176b22a07ad78c7efaf22dd34502c71f36a13eedce6c92a93e01b6082b842cb2481aff9239dcd72f22c84d5240b1543487386ba908ee50203e706877f73a0df9d", 0x1c9}], 0x1, 0x0, 0x0, 0x4000080}, 0x44004) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000005c0)=ANY=[@ANYBLOB="600000001800010400000000000000000a400000fe0200010000000014000500fe80000000000000000000000000000208000400", @ANYRES32=0x2, @ANYBLOB="0600150008000000200016801c00"], 0x60}}, 0x0) r10 = socket(0x10, 0x3, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000680)=[{&(0x7f00000006c0)='Uf', 0x2}, {&(0x7f0000000700)="ff324d", 0x3}], 0x2, 0x0, 0x10b8}, 0xff00) r11 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r11, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000007c0)=ANY=[@ANYBLOB="300000001800010301000d00000000000a410000ff0300060000000014000100fe80"], 0x30}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) sendmmsg(r10, &(0x7f0000000640), 0x4000000000001f2, 0x0) 2.001100744s ago: executing program 1 (id=2825): ioctl$XFS_IOC_START_COMMIT(0xffffffffffffffff, 0x80585882, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000200), 0xa6f01, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000340)={0x5c, 0x41, 0x1, 0x0, 0x0, {0x3, 0x1}, [@generic="000000002600010000112233445566778899aabb88a845000014aa00000001170000010203040506070800000c00020006002000080000000c0003000800", @typed={0x6, 0x103, 0x0, 0x0, @str='\xe9\x00'}]}, 0x5c}}, 0x4000000) r2 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r2, 0x8914, &(0x7f0000000100)={'syzkaller1\x00', 0x1}) write$tun(r0, &(0x7f0000001b80)=ANY=[@ANYRES32=r0, @ANYRES8=r1, @ANYRESDEC=r0, @ANYRESDEC=r1, @ANYRESDEC=r1, @ANYRESOCT], 0x82) r3 = socket$nl_audit(0x10, 0x3, 0x9) recvmsg(r3, &(0x7f0000000300)={&(0x7f0000000000)=@l2tp={0x2, 0x0, @local}, 0x80, &(0x7f0000001b40)=[{&(0x7f0000000900)=""/4096, 0x1000}, {&(0x7f0000001900)=""/175, 0xaf}, {&(0x7f00000019c0)=""/79, 0x4f}, {&(0x7f0000001a40)=""/196, 0xc4}], 0x4, &(0x7f00000002c0)=""/43, 0x2b}, 0x100) r4 = socket$inet6(0xa, 0x3, 0x8000000003c) setsockopt$IP6T_SO_SET_REPLACE(r4, 0x29, 0x40, &(0x7f0000001c00)=@raw={'raw\x00', 0x8, 0x3, 0x3f8, 0x250, 0xffffffff, 0xffffffff, 0x250, 0xffffffff, 0x328, 0xffffffff, 0xffffffff, 0x328, 0xffffffff, 0x3, 0x0, {[{{@uncond, 0x0, 0x228, 0x250, 0x0, {}, [@common=@ipv6header={{0x28}, {0x1a, 0x1, 0x1}}, @common=@inet=@policy={{0x158}, {[{@ipv4=@local, [0xff], @ipv6=@remote, [0x0, 0xff000000, 0xff000000, 0xffffff00], 0x4d3, 0x34ff, 0x1, 0x1, 0x15, 0x10}, {@ipv4=@multicast1, [0x0, 0xffffffff, 0xffffffff, 0xff], @ipv4=@remote, [0xff000000, 0xffffffff], 0x4d6, 0x3503, 0x87, 0x0, 0x2, 0x10}, {@ipv4=@empty, [0x0, 0xffffffff, 0xff000000, 0xffffff00], @ipv4=@dev={0xac, 0x14, 0x14, 0x11}, [0xff000000, 0x0, 0xff, 0xff000000], 0x4d6, 0x3500, 0x3a, 0x0, 0x0, 0x4}, {@ipv4=@initdev={0xac, 0x1e, 0x1, 0x0}, [0xff, 0xffffff00, 0x0, 0xffffff00], @ipv6=@mcast1, [0xff000000, 0xffffffff, 0xff000000, 0xffffffff], 0x4d3, 0x0, 0x2f, 0x0, 0x4, 0x1a}], 0x1, 0x3}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@empty, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x18}}, [], [], 'wg1\x00', 'caif0\x00', {}, {}, 0x62}, 0x0, 0xa8, 0xd8}, @common=@unspec=@CONNMARK={0x30, 'CONNMARK\x00', 0x1, {0x0, 0x0, 0x0, 0x2}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x47e) ioctl$XFS_IOC_START_COMMIT(0xffffffffffffffff, 0x80585882, 0x0) (async) openat$tun(0xffffffffffffff9c, &(0x7f0000000200), 0xa6f01, 0x0) (async) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000340)={0x5c, 0x41, 0x1, 0x0, 0x0, {0x3, 0x1}, [@generic="000000002600010000112233445566778899aabb88a845000014aa00000001170000010203040506070800000c00020006002000080000000c0003000800", @typed={0x6, 0x103, 0x0, 0x0, @str='\xe9\x00'}]}, 0x5c}}, 0x4000000) (async) socket$inet_udp(0x2, 0x2, 0x0) (async) ioctl$sock_inet_SIOCSIFFLAGS(r2, 0x8914, &(0x7f0000000100)={'syzkaller1\x00', 0x1}) (async) write$tun(r0, &(0x7f0000001b80)=ANY=[@ANYRES32=r0, @ANYRES8=r1, @ANYRESDEC=r0, @ANYRESDEC=r1, @ANYRESDEC=r1, @ANYRESOCT], 0x82) (async) socket$nl_audit(0x10, 0x3, 0x9) (async) recvmsg(r3, &(0x7f0000000300)={&(0x7f0000000000)=@l2tp={0x2, 0x0, @local}, 0x80, &(0x7f0000001b40)=[{&(0x7f0000000900)=""/4096, 0x1000}, {&(0x7f0000001900)=""/175, 0xaf}, {&(0x7f00000019c0)=""/79, 0x4f}, {&(0x7f0000001a40)=""/196, 0xc4}], 0x4, &(0x7f00000002c0)=""/43, 0x2b}, 0x100) (async) socket$inet6(0xa, 0x3, 0x8000000003c) (async) setsockopt$IP6T_SO_SET_REPLACE(r4, 0x29, 0x40, &(0x7f0000001c00)=@raw={'raw\x00', 0x8, 0x3, 0x3f8, 0x250, 0xffffffff, 0xffffffff, 0x250, 0xffffffff, 0x328, 0xffffffff, 0xffffffff, 0x328, 0xffffffff, 0x3, 0x0, {[{{@uncond, 0x0, 0x228, 0x250, 0x0, {}, [@common=@ipv6header={{0x28}, {0x1a, 0x1, 0x1}}, @common=@inet=@policy={{0x158}, {[{@ipv4=@local, [0xff], @ipv6=@remote, [0x0, 0xff000000, 0xff000000, 0xffffff00], 0x4d3, 0x34ff, 0x1, 0x1, 0x15, 0x10}, {@ipv4=@multicast1, [0x0, 0xffffffff, 0xffffffff, 0xff], @ipv4=@remote, [0xff000000, 0xffffffff], 0x4d6, 0x3503, 0x87, 0x0, 0x2, 0x10}, {@ipv4=@empty, [0x0, 0xffffffff, 0xff000000, 0xffffff00], @ipv4=@dev={0xac, 0x14, 0x14, 0x11}, [0xff000000, 0x0, 0xff, 0xff000000], 0x4d6, 0x3500, 0x3a, 0x0, 0x0, 0x4}, {@ipv4=@initdev={0xac, 0x1e, 0x1, 0x0}, [0xff, 0xffffff00, 0x0, 0xffffff00], @ipv6=@mcast1, [0xff000000, 0xffffffff, 0xff000000, 0xffffffff], 0x4d3, 0x0, 0x2f, 0x0, 0x4, 0x1a}], 0x1, 0x3}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@empty, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x18}}, [], [], 'wg1\x00', 'caif0\x00', {}, {}, 0x62}, 0x0, 0xa8, 0xd8}, @common=@unspec=@CONNMARK={0x30, 'CONNMARK\x00', 0x1, {0x0, 0x0, 0x0, 0x2}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x47e) (async) 1.966750414s ago: executing program 4 (id=2826): socket$inet6_udp(0xa, 0x2, 0x0) (async) r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r1, &(0x7f0000000040)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @loopback}, 0x4}}, 0x2e) (async) connect$pppl2tp(r1, &(0x7f0000000040)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @loopback}, 0x4}}, 0x2e) close(0x4) r2 = socket$pppl2tp(0x18, 0x1, 0x1) r3 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r2, &(0x7f00000005c0)=@pppol2tpv3in6={0x18, 0x1, {0x0, r3, 0x2, 0x4, 0x0, 0x3, {0xa, 0x4e23, 0x9, @mcast1, 0x1a8d87ee}}}, 0x3a) bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x6, 0x9, &(0x7f00000006c0)=@raw=[@generic={0x18, 0x2, 0x0, 0x0, 0x100000a}, @generic, @generic={0x18, 0x2, 0x0, 0x0, 0x100}, @generic, @generic={0xbf, 0x2, 0xa}, @cb_func={0x18, 0x5, 0x4, 0x0, 0xfffffffa}, @generic={0xb7, 0x4, 0x0, 0x0, 0x7f}, @generic={0x95}], &(0x7f0000000740)='GPL\x00', 0x1, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x6, 0x9, &(0x7f00000006c0)=@raw=[@generic={0x18, 0x2, 0x0, 0x0, 0x100000a}, @generic, @generic={0x18, 0x2, 0x0, 0x0, 0x100}, @generic, @generic={0xbf, 0x2, 0xa}, @cb_func={0x18, 0x5, 0x4, 0x0, 0xfffffffa}, @generic={0xb7, 0x4, 0x0, 0x0, 0x7f}, @generic={0x95}], &(0x7f0000000740)='GPL\x00', 0x1, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={0x0}, 0x1, 0x0, 0x0, 0x804}, 0x20000010) (async) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={0x0}, 0x1, 0x0, 0x0, 0x804}, 0x20000010) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f00000000c0)={'wlan0\x00', &(0x7f0000000100)=@ethtool_drvinfo={0x3, "bf1b4087edfe5c4e7dbc3101422ad7e146e549d45ef8ffffffffffffff00", "0b427558163b547e4025a26d22b3ff070000f2000000cfb77cc869a53447e49f", "ffff0000428dae4ebd4e96f981ffd39d1c000000000000000000c000", "d8f28fdc3ec20b8facef9aa9d6f53dd7527511d9bb717ba90adf6ac47453a1f1", "53b310d0a21007c3cb8fe4f81000946b000000fba1e81f91b4c1f000", "4e002d9f02000090ac00", 0x1b4, 0x2ace, 0x8000, 0x87d42, 0x80009e}}) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000540), 0x0, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000580)={'\x00', 0x2}) ioctl$TUNSETDEBUG(r5, 0x400454c9, 0xffffffffffffffff) ioctl$BTRFS_IOC_GET_SUPPORTED_FEATURES(r5, 0x80489439, 0x0) bind$can_raw(r4, &(0x7f0000000200), 0x10) (async) bind$can_raw(r4, &(0x7f0000000200), 0x10) setsockopt$CAN_RAW_FILTER(r4, 0x65, 0x1, &(0x7f0000000240)=[{{0x3, 0x1, 0x1, 0x1}, {0x4, 0x1, 0x0, 0x1}}], 0x8) close(r4) socket$nl_generic(0x10, 0x3, 0x10) (async) r6 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$l2tp(&(0x7f0000000280), 0xffffffffffffffff) (async) r7 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000280), 0xffffffffffffffff) r8 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(r8, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000340)=ANY=[@ANYBLOB='O\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="01002cbd70100400000005000000080009000200000008000c00a80a000008000b00000000800600010007000000"], 0x34}, 0x1, 0x0, 0x0, 0x4080}, 0x20) (async) sendmsg$L2TP_CMD_SESSION_DELETE(r8, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000340)=ANY=[@ANYBLOB='O\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="01002cbd70100400000005000000080009000200000008000c00a80a000008000b00000000800600010007000000"], 0x34}, 0x1, 0x0, 0x0, 0x4080}, 0x20) r9 = socket$nl_xfrm(0x10, 0x3, 0x6) recvmmsg(r9, &(0x7f0000000440)=[{{0x0, 0x0, 0x0}, 0xe3}], 0x1, 0x20, 0x0) sendmsg$nl_xfrm(r9, &(0x7f0000000480)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000500)=ANY=[@ANYBLOB="2001000012001307"], 0x120}}, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r6, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000400)={0x14, r7, 0x325, 0x0, 0x0, {0x8}}, 0x14}, 0x1, 0x0, 0x0, 0x40001}, 0x0) 1.76652838s ago: executing program 0 (id=2827): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000540)={0x1, 0x5, &(0x7f0000000880)=ANY=[@ANYBLOB="bf16000000000000b707000000fcf0ff5070000000000000480000002c41000095000000000000002ba7e1d30c04aa8b3382022ce2a1d97411a0f6b599e83f24a3aa81d36bb7019c13bd23212fb56f040026fbfefc4a056bdc17487902317142fac7e7be168c1886d0d4d94f2f4eb45c652fbc1626cca2a28d67893547db51ee988e6e06c8cedf7ceb9fc40400ae5e4aa74c92c6a51cbf9b0a4def23d410f6accd3641130bfc4e90a6341865c3f5ab3e89cf6c662ed4148d3b3e22278d00031e5388ee5c867de2c6211d6ececb0c18ce7400dae15cb7947c491b8bea3fd2f73902ebcfcf4982277d9800011b405bbf7b02433a9bcd715f5888b2007f000000001c000000010000000000000600000000309329170ee5b567e70f000006a10f58fa64533500000000000000000000000031000000000000001208e75a89faffbfb11b7dc6ea31001e846c12423a169f87463ad6f7c2e8ee1a39244960b318778f2a047f6d5bc24fef5d7d617de7a6520655a80d0900f4d433623c850af895abba14f6fbd7fbad1f98e26ad4deaf1a4f294b2a431ab9142f3a06d54740a4bc5e3abd378af7c9676a08e774c48785f895b4ec8d1141d5e8744d7f09ab4df6027bf48cabecead649f96ea24d32872c494160cb7f46ce680eeb80157eb23f9902519ac655fa73103170cbc496d7122034b85e7e87a2db762cbb253fbd76b9117c1a11d18aa2040c5f0c289906000000000000005ffe94ff010011d9b219c00c369a12bf8685b862d0dbdd956cbda1bae489bcef5ae59136aaadc59609f4d42617c0e6066938b521a0f2e2467a6c435ad5b800262a5da053ced5e95394e500000072737638ac44fb61310e2df511c60b3c88113996a81fb64bce5eb95ce91738640ff7ae6ed6b62086e699955926934389cdf9bcebc7586186fe9ce05268bf8a3958f2206cdc7095682c14f10be1075832956762b2dcc6251e7b74cb1da627e332765511c58215bf84d263e8778e6e8ffe4ea50b076446f35eff00006b340658342d2d9e1ef68c6ef3e98407d2fcefb34a0000000000000000895ddbb76122b1222e4da37177fe833e4fcaa67997e92a206ebd085bd9f90008d3fdd528efe6c1dca17f45ba5e8bd311a40030f9ffce75ffff996a80153a0077bb43f8a63dd390d18f0239b41da1a52383a4c6768ca1bb66b8fb3c5000f6f246fd20356a60769b461b6cdf133de073b1df08ae09268b0073bb97d88d741a5546e76caf4b6b1387ff37ec13d262dae0260be74cdf7bb6d3107597430ef5bbd476bb9d69b2aef9f3cb644b4bf01ccf16d40720939daf2af469bdfb361b9c015dd026fd0fffe3c66f5c343afb78a7cfd852f3e05c089887d7df2ff4f9982030019421af6b78ff9c444a17091875cfe4eab0e7f50eb69c860b1613a6b4f5af04f9c635d8d646c89f8b85f820ce7464c731deba39f9ff7b815f7b0acba754c01ed8bf1bba0010a8c6a2b966d861f9dd547abf2e9b23e5607f00f80b58fd76e4bc46c84799aa792cdaeb6cfb858e577dacff607ba513250e13ae696cd6ed7d318190a93b9ee07927efca6b8d1f5980994690bbe002db5146439d906a0d4aef065214b15666cdca81091b69acee2c7ce0821fc19e0891f0b53469f935c5ac420100010000000000fb53faf4420638489e6a1c696d8c414a87b60000000000080000b6be1557951854c01dbc2d061827ae6349a045b780893771524a424335b9fc34616ee9f09141057262530b7c2f7c9b969938779736ece7b470078ac0b1b4b528000000009866e9994ca9096672ec9f3800c2fc35ba6516e542624c47bdba76a816c3a3dd6c3fa87a3ec91df199a9af91a7babf2b8d0e7b77e6dfb4bbc9817847b705000000a1000000000000ab8353f3800f045b90b0eaab6d731199c9447eabbc8c740183aff5389742e47de5000000826a570d14310700cf2ae3366ebdb7f1000000000000333c00e6addbf4c71ffad6bfb5babb49109f92a5a52042c425190a6e3f1a8a3abfe6059da9c952cf35c98ce7616355493d280f2d0be99e18fd0900c769e7eb4edc1c03a33676590bd2047229e0237c1e34641848531712ff09e89fb062a3e66f4fced0ae679733830039cb61ea0691f0b4e0b33194404e643243c3841e1e7fe301f7f47a7f89512d92e83624e3de705bdfbfd0e5e381398e9d5428a00cc8a6d097d97e6ac8bd09b1a5577920a650114a522c1e2dcdc4f606fcbcee91770a9fada34d38cd7976a9228a0a0dd8661be8162e966aac26bea4c11458cd6ce22ddf7054cdd0a60ef3ec000000000000000000425cb75dc7ec92e9a5d29f9c99697d2a98ae0a9f35e4196c3faeb7a60a0290bf897846f6f0f1c163d6075119169d55d10da9ad0e4b2c636d200000009baaf94e2b2c48e70d8453f832eecfb1de2a3f38a5c986de9e37737dac74db251d5e9ea2b8ed39e91a7a17d01b49f7aaff7c4c73c3484bdcab362838ed940035b239a3646ef55b9f070ae14466b3acef9f8b28fb938a237e2e068ae4a6bce4407b54cc14614c2cdf877f000000000000000000000000bdcf23144e6c16b9235552aed83b6428f34d88c258a9ad16386bba51b60838fb11bc193a206b5a25b7233b222e4e68e0d1e88f26b9a45b6c29469530a37ea92aaf421cdcc1f594ecfaff9a79b56f8b38038002d29b3193cea9cd0a0ef4f58fa48f61071f548d411353965615c24c1860fd0dfae0f4cdf8c8f8645a289a79f9b919b674f0325d81eacaa8399324a304885da01733bb7917ec5e52718eb05f9c1ffd69f834150e9100c215968e8fb31c83526e6f66897569e28d01ca6135a2acca398c1415e0f9b58b63ee9dc33608ba7e5c4bdf3f37d8e4f4f424be263d9c2a5204f41e9b0ee01ad4cc0519395b69c310c98d3c8edc7d07b30617f3535634257f5472d9f3263a6f04778a920c12000721bb82f9884780ac294b8bb07ebf6e3f16584e95607e319b2ea9778289c19fb775514246159bbfa9dc0fdf711d3efa316a3323c915a40e6d7c8f8d7daf98824fd0bc955dc9731cc8c7a600d94b8049af764688c7ffdd26a741b03b065ba9c586914d8beb94c8a265ace34172ed003357ddd400557230b2caba17a647a171c2fc73a8c7541c7ffaafba62195fce77382ae962f30d4a377d760040975a44aa73a4e687d06f96f0987b980f6f883534dfc71ace539eeeb08cff54e0e05d5e0563660a3664c67d0eb9cdf4eab93ab4bf1972a2acc5c5d43dc2f2b66d7493c390d042d896a1ad772f6d4c2cf38ba0"], &(0x7f00000011c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000001200), 0x57, 0x10, &(0x7f0000001240), 0xffffffffffffffc9}, 0x48) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001280)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000002600), r3) sendmsg$IEEE802154_LLSEC_DEL_SECLEVEL(r3, &(0x7f0000002640)={0x0, 0x0, &(0x7f0000002680)={&(0x7f0000002940)=ANY=[@ANYBLOB="30000000315fe9013122114f1520865a43c196894d2ca4f03ae40651d8c39c8ab2329a807eae6cbde987d98f204b3b619c68461381a403b7df8cf8d9fcf6bd83fa2e1e2f14ac82e4fe39b4bb582b76978b7a419224c7a7a1581be8eb2789143105a44fd59cdc96cfc417d63e1493444844426fcb060f068b24dae3d949ccc1a1b6627ad2178dd40853750b49dd8bfccd5ba542d62e65759a6fad22810a9fbce42ee57b81aa6a84e7329d97cab52fe1d8be35859ea013eed2716ec3b1a3c07a320644b85c4db2f72bbcb1284ee6d01c141e79f09e5f4611295b96f72d1759535274167ad0a61c0d1ab0", @ANYRES16=r4, @ANYBLOB="090927bd7000ffdbdf253100000005003500990000000a0001007770616e300000000500330002000000"], 0x30}, 0x1, 0x0, 0x0, 0x4000}, 0x8000) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETRULE(r5, &(0x7f0000002540)={0x0, 0x0, &(0x7f0000002580)={&(0x7f00000025c0)=ANY=[@ANYBLOB="14000000190a01020000000000000000e9ffffff"], 0x14}, 0x1, 0x0, 0x0, 0x41}, 0x8004) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = socket$inet6(0xa, 0x2, 0x0) close(r7) r8 = socket$l2tp6(0xa, 0x2, 0x73) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r7, 0x29, 0x20, &(0x7f0000000500)={@loopback, 0x800, 0x0, 0x3, 0x1, 0x8, 0x8000}, 0x20) r9 = socket$kcm(0xa, 0x2, 0x0) sendmsg$kcm(r9, &(0x7f00000007c0)={&(0x7f0000000800)=@in6={0xa, 0x4e24, 0x9, @dev={0xfe, 0x80, '\x00', 0x2d}, 0xfffffffc}, 0x80, 0x0, 0x0, &(0x7f0000002500)=[{0x10, 0x107, 0xb}, {0x10, 0x11, 0x7}], 0x20}, 0x44855) r10 = socket$nl_netfilter(0x10, 0x3, 0xc) r11 = socket$nl_netfilter(0x10, 0x3, 0xc) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(0xffffffffffffffff, 0x84, 0x85, &(0x7f0000002e80)={0x0, @in={{0x2, 0x4e24, @empty}}}, 0x90) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r7, 0x84, 0x6d, &(0x7f0000002f40)={0x0, 0x78, "c98a23624da6a734e3e6d387870e744940d4ac2c52888e6ada873b64b152516d694f57d50d2dde6d3e5dc2dbd83ed5d3b04b649cab6be6994eb6603fe2deed1fd28bbd721d46522e801f7954e06e61bfa9a26dbb2a6fbd4cd40ed1cc499b9c6c9036fe80d3e1839acbe7661bffa655a69cd2382f6f90043f"}, &(0x7f0000002fc0)=0x80) sendmsg$NFULNL_MSG_CONFIG(r11, &(0x7f00000026c0)={0x0, 0x0, &(0x7f0000002a80)={&(0x7f0000002ac0)={0x1c, 0x1, 0x4, 0x101, 0x0, 0x0, {0x1, 0x0, 0x400}, [@NFULA_CFG_CMD={0x5, 0x1, 0x1}]}, 0x1c}, 0x1, 0x0, 0x0, 0x60000081}, 0x800) sendmsg$NFULNL_MSG_CONFIG(r10, &(0x7f0000002b00)={0x0, 0x0, &(0x7f0000002b40)={&(0x7f0000002b80)=ANY=[@ANYBLOB="240000000104010200000180002000000100000008000540efffffff0500010001"], 0x24}}, 0x0) sendmsg$NFULNL_MSG_CONFIG(r10, &(0x7f0000002bc0)={0x0, 0x0, &(0x7f0000002c00)={&(0x7f0000002c40)=ANY=[@ANYBLOB="24000000010401040000000000000000050000000500010002008000060006"], 0x24}, 0x1, 0x0, 0x0, 0x20000835}, 0x2002889c) r12 = bpf$MAP_CREATE(0x0, &(0x7f0000002700)=ANY=[@ANYBLOB="0b000000080000000c000000ffbfffff01"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000002740)={0x6, 0x17, &(0x7f0000002800)=ANY=[@ANYBLOB="1800000006000000000000000500000018110000", @ANYRES32=r12, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf090000000000005509010000000000950000000000000018010000202069250000000000202020811af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300004d0000008500000006000000bf91000000000000b7020000020000008500000085000000b70000000000000095"], &(0x7f00000028c0)='GPL\x00', 0x6, 0x6, &(0x7f0000002900)=""/6, 0x40f00, 0xa, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x8}, 0x94) setsockopt$inet6_int(r7, 0x29, 0x1000000000021, &(0x7f00000006c0)=0x2005, 0x4) sendmsg$inet6(r8, &(0x7f0000000700)={&(0x7f0000000740)={0xa, 0x4e20, 0x180000, @ipv4={'\x00', '\xff\xff', @broadcast}, 0xfffffffb}, 0x1c, 0x0, 0x0, &(0x7f0000000780)=ANY=[@ANYBLOB="1400000000000000290000000b000000ff"], 0xe8}, 0x8040) sendmsg$nl_generic(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="18000000260001031dbd7002fadbdf25010000000400ae"], 0x18}}, 0x0) recvmmsg(r6, &(0x7f00000000c0)=[{{0x0, 0x0, 0x0}, 0x85}, {{0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000240)=""/214, 0xd6}, {&(0x7f0000000340)=""/70, 0x46}, {&(0x7f00000003c0)=""/203, 0xcb}, {&(0x7f00000004c0)=""/16, 0x10}, {&(0x7f0000000600)=""/154, 0x9a}, {&(0x7f00000013c0)=""/4085, 0xff5}, {&(0x7f00000023c0)=""/102, 0x66}], 0x7}, 0x8}, {{0x0, 0x0, 0x0}, 0x4}, {{0x0, 0x0, 0x0}, 0x1}], 0x4, 0x20, 0x0) recvmmsg(r6, &(0x7f0000002440)=[{{0x0, 0x0, 0x0}, 0x2}, {{0x0, 0x0, 0x0}, 0x800008}, {{0x0, 0x0, 0x0}}], 0x3, 0x100, 0x0) setsockopt$sock_attach_bpf(r1, 0x1, 0x32, &(0x7f00000012c0)=r0, 0x4) sendmsg$inet(r2, &(0x7f0000001300)={0x0, 0x0, &(0x7f0000001340)=[{&(0x7f0000001380)="fa82", 0xfdef}], 0x1}, 0x20000000) 1.610380696s ago: executing program 4 (id=2828): socket(0x10, 0x80002, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) bind$netlink(0xffffffffffffffff, &(0x7f0000000b40)={0x10, 0x0, 0x3, 0x80000000}, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r0, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r2, 0x84, 0xd, &(0x7f00000002c0)=@assoc_value, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000280)={'netdevsim0\x00'}) socket$unix(0x1, 0x2, 0x0) bpf$BPF_PROG_QUERY(0x10, 0x0, 0x0) bpf$BPF_LINK_CREATE_XDP(0x1c, 0x0, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000004c0)={&(0x7f0000000500)=ANY=[], 0x0, 0x8e}, 0x28) socket$inet(0x2, 0x2, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x40241, 0x0) socket$key(0xf, 0x3, 0x2) bpf$MAP_CREATE(0x0, &(0x7f0000000a00)=ANY=[@ANYBLOB="12000000040100000800000002"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000640)={0x3, 0x10, &(0x7f0000000700)=ANY=[@ANYBLOB="bfa200000000000007020000fcfeffff620200000000000018", @ANYRES32, @ANYBLOB="000000000000000085000000010000001500070000000000bf06000000000000bf61000000000000070100000400000085000000aa000000bf61000000000000070100000400"], &(0x7f0000000780)='GPL\x00', 0x7, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = syz_genetlink_get_family_id$ethtool(&(0x7f00000003c0), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_COALESCE_SET(r3, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000480)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="010000000000000000001000000018000180140002006e657464657673696d3000080000000005000b"], 0x34}}, 0x4044890) 1.550607284s ago: executing program 0 (id=2829): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0xc, 0xe, &(0x7f0000000240)=ANY=[@ANYBLOB="b702000007000000bfa30000000000000703000000feffff7a0af0ff0100000079a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe00000000850000000d000000b70000000000000095000000000000005ecefab8f2e85c6c1ca711fcd0cdfa146ec561750379585e5a076d839240d29c034055b67dafe6c8dc3d5d78c07fa1f7e655ce34e4d5b3185fec0e07004e60c08dc8b8dbf11e6e94d75938321a3aa502cd2424a66e6d2ef831ab7ea0c34f17e3946ef3bb622003b538dfd8e01f3440cee51bc53099e90f4580d760551b5b341a29f31e3106d1ddd6152f7cbdb9cd38bdb2209c67deca8eeb9c15ab3a14817ac61e4dd11183a13477bf7e860e3670ef0e789f65f1328d6704902cbe7bc04b82d2789cad32b8667c2147661df28d9961b63e1a9cf6c2a660a1fe3c184b751c51160fb20b1c581e7be6ba0dc001c4110555850915148ba532e6ea09c346dfebd38608b3280080005d9a9500000000000000334d83239dd27080851dcac3c12233f9a1fb9c2aec61ce63a38d2fd50117b89a9ab359b4eea0c6e95767d42b4e54861d0227dbfd2e6d7f715a7f3deadd7130856f756436303767d2e24f29e5dad9796edb697aeea0182babd18cac1bd4f4390af9a9ceafd0002cab154ad029a1090000002780870014f51c3c975d5aec84222fd3a0ec4be3e563112f0b39501aafe234870072858dc06e7c337602d3e5a815232f5e16c1b30c3a6abc85018e5ff2c91018afc9ffc2cc788bee1b47683db012469398685211dfbbae3e2ed0a50e7393bff5d4c391ddece00fc772dd6b4d4de2a41990f05ca3bdfc92c88c5b8dcd36e7487afa447e2edfae4f390a8337841cef386e22cc22ee17476d738952229682e24b92533ac2a9f5a699593f084419cae0b4532bcc97d300006aca54183fb01c73f979ca9857399537f5dc2a2d0e0000000000000578673f8b6e74ce23877a6b24db0e067345560942fa629fbef2461c96a088a22e8b15c3e233db7af22e30d46a9d26d37cef099ece729aa218f9f44a3210223fdae7ed04935c3c90d3add8eebc8619d73415cda2130f5011e48455b5a8b90dfae158b94f50adab988dd8e12baf5cc9398fff00404d5d99f82e20ee6a8c88e18c2977fb536a9caab37d9ac4cfc1c7b400000000000007ffc826b956ba859ac8e3c177b91bd7d5e41ff83ced846891180604b6dd2499d16d7d9158ffffffff00000000ef069dc42749a89f854797f29d000069a16203a967c1bbe09315c29877a308bcc87dc3addb08142bdee5d27874b2f663ddeef0005b3d96c7aabf4df517d90bdc01e73835d5a3e1a90800c66ee2b1ad76dff9f9000071414c99d4894ee7f8240000e3428d2129369ee1b85af9ffffff0d0df414b315f651c8412392191fa83ee830548f11be359454a3f2239cfe35f81b7a490f167e6d5c1109000000000000000042b8ff8c21ad702ccacad5b39eef213d1ca296d2a27798c8ce2a305c0c7d35cf4b22549a4bd92000000000f285f653b621491dc6aaee0200e2ff08644fb94c06006eff1be2f633c1d987591ec3db58a7bb74d4ec3f771f7a1338a5c3dd35e926049fe86e09c58e273cd905de328c13c1ed1c0d9cae846bcbfa8cce7b893e578af7dc7d5e87d44ff828de453f34c2b18660b080efc707e676e1fb4d5825c0ca177a4c7fbb4eda0545c00f576b2b5cc7f819abd0f885cc4806f40300966fcf1e54f5a2d38708294cd6f496e5dee734fe7da3770845cf442d488afdc0e17000000000000000000000000000000000000000000000000000005205000000dc1c56d59f35d367632952a978ee56c83a3466ae595c6a8cda690d192a070886df42b27098773b45198b4a34ac977ebd4450e121d01342e0eaf6f330e935878a6d169c80aa4252d4ea6b8f6216ff202b5b5a182cb5e838b307632d03a7ca6f6d0339f9953c3093c3690d10ecb65dc5b47481edbf1f000000000000004d16d29c28eb5167e9936ed327fb237a56224e49d9ea95ec1b3ccd35364600000000000000000000000000000000000000000000000000000000000026ded4dd6fe1518cc7802043ecfe69f743f1213bf81700cd9e5a225d67521dc728eac7d80a5656ac2cbde21d3ebfbf69ff861f4394836ddf128d6d19079e64336e7c676505c78ad67548f4b192be3827fcd95cf107753cb0a6a979d3db0c407081c6281e2d8429a863903ca75f4c7df3ea8fc2018d07af1491ef060cd4403a099f32468f65bd06b4082d43e121861b5cc03f1a1561f0589e0d12969bc982ff5d8e9b986c0c6c747d9a1cc500bb892c3a16ff10feea20bdac0000000000000000ca06f256c8028e0f9b65f037b21f3289f86a6826c69fa35ba5cbc3f2db1516ffc5c6e3fa618b24a6ce16d6c7010bb37b61fa0a2d8974e69115d33394e86e4b838297ba20f969369de47422604e2fc5d1d33d84d96b50fb000000ae07c65b71088dd7d5d1e1bab9000000000000000000000000b5ace293b6c833c13e3229432ad71d646218b5229dd88137fc7c59aa242af3bb4efb82055a3b612272d40f522d8c98c879aca11033ec14bb9cc16bd83a00840e31d828ec78e116ae46c4897e2795b6ff92e9a1e24b0b855c02f2b7add58ffb25f339297729a7a51810134d3dfbe71f6516737be55c06d9cdcfb1e2bb10b50000eb4acff90756dba1ecf9f58afd3c19b5c4558ba9af6b7333c894a1fb29ade9ad75c9c022e8d03fe28bc358684492aa771dbfe80745fe89ad349ffaad76ff9dd643796caffdf67af5dd476c37e7e9a84e2e5da2696e285a59b53f2fb0e16d8262c080c159ce40c14089c82759106f422582b42e3e8484ea5a6ad9aa52106eafe0e0caea1ad4cb23f3c2b8a0f455ba69ea284c268d54b43158a8b1d128d02af263b3dc1cab794c9ac57a2a7332f4d8764c302ccd5aac114482b619fc575aa0dd2777e881e29a854380e2f1e49db5a1517ec40bb3fa44f9959bad67ccaba76408da35c9f1534c8bd46dbd61627a2e0a74b5e6aefb7eee403502734137ff47a57f164391c673b6079e65d7295eed164ca63e4ea26dce0fb3ce0f6591d80dfb8f386bb74b5589829b6b0679b5d65a125e3af1130d66a7b66837ae7e7123dde7404a067ad0a6a2d6bec9411b61cad4121be3c72ff3a04713042253d438e7becf8120de3895b8ce974958bde39cb8da3427a2e9e2de936431e67fed5ab5684db07de39083d8948cc4c8a2608100000000000000000000aecb8b0b7941088f971ce17427eec32a012295cc0cdd32955176b6ad5a4bb953e58ccfa9428f452cfb5a48a9fda26db3985c8be3c2f99827da074825b01c4a3a71fb59d5798100000000000000c76b05a45d2dd8c20d971e2f3e4369168f5cb83d6ff3a18733fec726034fbfa95624135bee374414b2c8c61f52357a520efd6a10aff244bc8a62ed367981fb4d5d77f7bc093958ff46527499957da4934cd4b370cf76f72dd05fa80cdfb68c836fd81be7a58532e041a87f9222f157610a4bcdc05b2a55308c8e7568b90f7a338557e816a16972aea79dff5becefa6f9c5ce6c58fb38da9e7532dc53cfdc2e789b76f7d32aca1bfea2aa62621b78dded30fc07171866bf3d552900000000a32dda61eeda1750e157c2d569b9d08f583c0ee28daec2e8bb85f3c8e91c4448096ee953def18dc73e55cb30f9cd069d8780b00eaba382f0c3ae391c30a5f1b0f36dd0c2193b791995d2890327a10d7abac76d1202f72e97f0105184d7aaaab8d3e29c9a8d263f076b55cf53c5bb9c0662a3d19a6722d7f83ae4331d3256f90af0857788b380ccc3b266c418e66d1d756d5df6423dd0cea67bc235d3776d22270fc19301ead09f156893e9"], &(0x7f0000000d40)='syzkaller\x00'}, 0x48) close(0x3) bpf$PROG_LOAD(0x5, &(0x7f0000001040)={0xc, 0x4, &(0x7f0000001100)=ANY=[@ANYBLOB="18000000000000000000000000000000730133000000000095"], &(0x7f0000001140)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x16, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x200}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000d80)={0xc, 0x7, &(0x7f0000000e40)=ANY=[@ANYBLOB="7911a800000000005501020000000000b7000000000000009500000000000000850000008b000000b70000000000000095"], &(0x7f0000000e80)='GPL\x00', 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000ec0)={r0, 0x18000000000002a0, 0xfe, 0x0, &(0x7f0000000f40)="b9ff03316844268cb89e14f0080047e0ffff00124000632f77fbac14fe16ac14fe1607080403fe80000020006558845013f2325f1a3901050b038da1880b88481aa59d943be3f4aed50ea5a6b8686731cb89ef77123c899b699eeaa8eaa0073461119663906400f30c0600000000000059b6d3296e8ca31bce1d8392078b72f24996ae17dffc2e43c8174b54b620636894aaacf28ff62616363c70a440aec4014caf28c0adc043084617d7ecf41e9d134589d46e5dfc4ca5780d38cae870b9a1df48b238190da450296b0ac01496ace23eefc9d4246dd14afbf79a2283a0bb7e1d235f3df126c3acc240d75a058f6efa6d1f5f7ff4000000000000000000", 0x0, 0x8024, 0x60000000, 0x0, 0x0, &(0x7f0000001040), &(0x7f0000001080)}, 0x2a) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_COALESCE_SET(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010000b2f0cbaa1f357331000000180001801400020073797a5f74756e000000000000000000080002000f"], 0x34}, 0x1, 0x0, 0x0, 0x400c890}, 0x4080000) 1.459295767s ago: executing program 4 (id=2830): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) sendto$inet6(r0, &(0x7f0000000180)="8b", 0x34000, 0x0, &(0x7f00000001c0)={0xa, 0x0, 0x0, @private1}, 0x1c) shutdown(r0, 0x1) getsockopt$inet_sctp6_SCTP_EVENT(r0, 0x84, 0x7f, &(0x7f0000000200)={0x0, 0x8000}, &(0x7f0000000240)=0x8) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) r2 = socket$nl_route(0x10, 0x3, 0x0) getpeername$packet(0xffffffffffffffff, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @multicast}, &(0x7f0000000080)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)=@mpls_getroute={0x38, 0x1a, 0x210, 0x70bd2a, 0x25dfdbfe, {0x1c, 0x0, 0x0, 0x4, 0xfd, 0x0, 0xff, 0x7, 0x1b00}, [@RTA_OIF={0x8, 0x4, r3}, @RTA_DST={0x8, 0x1, {0xff, 0x0, 0x1}}, @RTA_MULTIPATH={0xc, 0x9, {0x4, 0x7, 0x3}}]}, 0x38}, 0x1, 0x0, 0x0, 0x8880}, 0x5) sendmsg$OSF_MSG_ADD(r1, &(0x7f0000001dc0)={0x0, 0x0, &(0x7f0000001d80)={&(0x7f00000018c0)={0x268, 0x0, 0x5, 0x401, 0x0, 0x0, {0x3, 0x0, 0x2}, [{{0x254, 0x1, {{0x0, 0x6}, 0xb7, 0x6, 0x4, 0x9, 0x9, 'syz1\x00', "79049bc4a0e6bff8a6a34d3dab976c165454e3a3330d5dbf789e52e151b75b9c", "d501ea5f3788129783a1796f25d7e6ceea6d78d366fdfec2c496cf7b25efcfd2", [{0x2, 0x3, {0x3, 0x38}}, {0x2, 0x81, {0x3, 0x3}}, {0x3, 0xfe8f, {0x2, 0xffffcdd7}}, {0xfffe, 0x101, {0x2, 0xa5b}}, {0xa8c3, 0x8, {0x2, 0x4}}, {0x8, 0x0, {0x1, 0x8}}, {0x6, 0x8, {0x1, 0x2}}, {0x6, 0x5, {0x1, 0x1ff}}, {0x9, 0x100, {0x2, 0x4}}, {0xa, 0x401, {0x0, 0x5}}, {0xd, 0x90, {0x2, 0x1b8c}}, {0x1000, 0x4e8, {0x2, 0x8001}}, {0x0, 0x2, {0x3, 0xf804}}, {0x7, 0xffff, {0x1, 0x6}}, {0x7, 0x10, {0x1, 0xa3d6}}, {0x9, 0xb0, {0x3, 0x7fffffff}}, {0xcdb0, 0x5, {0x2, 0xe88}}, {0x2, 0xe8, {0x1, 0x5}}, {0x7, 0x1a77, {0x2, 0xa}}, {0x3, 0xc7f, {0x8030cc2437013a5a, 0x8001}}, {0x5, 0x1, {0x3, 0x3}}, {0x1, 0x2, {0x2, 0x2}}, {0x8, 0x2, {0x1, 0x7fffffff}}, {0x4, 0x100, {0x3}}, {0xf80c, 0x9, {0x1, 0xffffff10}}, {0x5, 0x53, {0x1, 0x5}}, {0x0, 0x6, {0x1, 0x412}}, {0xd, 0x7, {0x3, 0x8}}, {0x9, 0x5, {0x1, 0x6}}, {0x5, 0xf1d6, {0x3, 0x401}}, {0x7, 0x6, {0x2, 0x740}}, {0x4, 0x2, {0x2, 0x4}}, {0x6, 0x4, {0x2, 0xfffffffe}}, {0x2, 0x7f, {0x0, 0x31c29da4}}, {0x5, 0x6, {0x2, 0x8000}}, {0x4, 0x3, {0x0, 0xae91}}, {0x3, 0x0, {0x3, 0xff}}, {0x111, 0xe, {0x3, 0x7ff}}, {0x6, 0x80, {0x0, 0x5}}, {0x0, 0x8, {0x1, 0x2}}]}}}]}, 0x268}, 0x1, 0x0, 0x0, 0x20000c0}, 0x24000840) 1.374631827s ago: executing program 2 (id=2831): unshare(0x8040480) pipe(&(0x7f0000000580)={0xffffffffffffffff}) bpf$PROG_LOAD(0x5, 0x0, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=@dellink={0x34, 0x11, 0x1, 0x70bd27, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, 0x1092, 0x40000}, [@IFLA_IFNAME={0x14, 0x3, 'veth1_vlan\x00'}]}, 0x34}, 0x1, 0x0, 0x0, 0x801}, 0x4000000) socket$packet(0x11, 0x3, 0x300) socket$nl_generic(0x10, 0x3, 0x10) ioctl$NILFS_IOCTL_SET_ALLOC_RANGE(r0, 0x40106e8c, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000280), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_FEATURES_SET(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000340)=ANY=[@ANYBLOB='H\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="01002dbd7000fddbdf250c0000002000018008000300030000001400020076657468305f766c616e0000000000001400038010000380"], 0x48}, 0x1, 0x0, 0x0, 0x4801}, 0x0) getsockopt$PNPIPE_IFINDEX(r0, 0x113, 0x2, &(0x7f0000000380), &(0x7f00000003c0)=0x4) r4 = socket(0x10, 0x3, 0x0) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nbd(&(0x7f00000001c0), r5) r7 = syz_genetlink_get_family_id$nbd(&(0x7f0000000540), 0xffffffffffffffff) syz_emit_ethernet(0x12a7, &(0x7f0000000a80)={@local, @broadcast, @void, {@ipv4={0x800, @esp={{0x5, 0x4, 0x1, 0x2, 0x1299, 0x68, 0x0, 0x46, 0x32, 0x0, @local, @initdev={0xac, 0x1e, 0x1, 0x0}}, {0x4d3, 0x7f, @cc={0x1, 0x0, 0x1ff, 0x0, 0xcd2, 0x5, 0x1, [@ipv4=@gre={{0x21, 0x4, 0x0, 0x8, 0x1260, 0x65, 0x0, 0x9, 0x2f, 0x0, @broadcast, @dev={0xac, 0x14, 0x14, 0x2e}, {[@timestamp_prespec={0x44, 0x54, 0xd4, 0x3, 0x3, [{@dev={0xac, 0x14, 0x14, 0x1f}, 0x5}, {@loopback, 0x20400}, {@remote, 0xb}, {@empty, 0x100}, {@dev={0xac, 0x14, 0x14, 0x3b}, 0x80000000}, {@local, 0x9}, {@initdev={0xac, 0x1e, 0x0, 0x0}, 0x9}, {@local}, {@initdev={0xac, 0x1e, 0x0, 0x0}, 0x3}, {@empty, 0x1}]}, @lsrr={0x83, 0x1b, 0xd, [@broadcast, @private=0xa010101, @private=0xa010100, @multicast2, @loopback, @local]}]}}, {{0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x880b, 0x1000, 0x0, [0xb], "231f93d9f3e93b46c8efa9e28218b0402eeb693d3856d101176a460422bdc480dab5ccdf192c7eca9e47ebc7897c29832a6088d98aa5e65e35fe16f9ccd7a00958ef35575918c0e456910a631bd36a2e57f5e35249388fcdb0760b04d88a2b86277d6820924114697415e1076a611b03b2db674f7bf6ac9a4be9e1e7447a6954d6017d6512e7adbed8ffaaae95a0e33cfa4ec07d6a4409b1f943b87f49e9705f1c1d8e49ffe5d6a27338d5271ad7e79f2259686f0cfda7a8472959e2a18e7e3d2b4dbf2f1518c7da24e8761ecbcf89780970bc3c293f2f4bfe259b97745b1804d41f49cd2928b99e96d3e55cf9f4f896b1a2c6ceb74ce2694fb081d6002caaf1790a9ecf8d3ca8898c6a384b1d9caa88c68be6a75db8b90075b0ba37147e1381ec05e2d715b11d04e59004cef522de2e126d7c03955d353ab9287ab52f16ecf149ba4183dd8d138a5888bc21fd7664b99566341e6ee3a1846a5fd17abeddf96880f18338a2b12d80df2a4f9edb20768d12c6f7aa35d48c21e70293f480f4df4caba5229c9193eca837a344da976c0b892012b4859fbceddb96236d8c2e6c8a355424493308fa493916d9b5417ecc49bd9c842546555b444f029d7dda9d9f0c3d718e156381f5962ac705d26a326e5c67698eddcc27ec62abde493c4fd73d8ee09def7472fc54e738e07c8f714a5d66ac7e75503ead05bdc586dcab7fe2a722100bfacfdc96a69d1f675902163cb70bcfe41eaead1303f143110b7168ce90b76e432347b9ced37c37f09c9bfa59703f8dc5b52967c76cdfa2121d59796f5341d63a37fb0c0bb7434915d43b42363030973f04b8675d55eb80857e7c4e94c0e288d9293f2808a92a6974144154936e1d2753e92fbc8e73b244ea252e725ca0a15042dea610d6b39e2a68d3c91c70aa7709ac347fad4177f221a64d9d11b13876647955690d9e60a1446ca1878860999be12a3877936b97c8fab022de8dcba952703b05a4b78869c5b965e3a5e73bb8a2be19d8de915a2e90e214a8ed17e59bc23268e7f4f0b3d5ab3aaa88f8d1f0bb7a882e5e6ddfb60506e07c99fcd95bbabd83ca0dbe502384a730fe5c04c656ca464469736adbda3e4ee449c13ca4a4bbf5371da34ec3c5dbde162b882a3c385809c1de005f71f9fd1e7b5c8b340f55727413ad0e835290800a7676f779536d67e9f2780106b358ed2192fa97aa3b6ee022a9a2ded346a305df78eabdca9aeb3f49a814c0d09de0c1a99f1a2e4c55d2a6ef0a2c36c1446dac7898d5eff424943bcfb3bebfe23c6e0cee5752e288f8335c9bc1c4eeb75d3b55014ba9626f9a8815f10ccaad74d7f13fe40ca43d1b466559011bd3ad7019459818a72500c1baae4237653732afda8b148aadbbf8d725dc1b054e643c756f2446d6c78659828583f125e2451c6d94ada1b0415e1715273e7bf0cfad789275da003f1cba31da7aa5a4785907ef5414ac68d4a9ce7b37a1656308b7d37fd7ecd1716816ea1b2b6e1301225ec6fb6f75b02886bc5f68d8017ac639a7b053725bc6e035fff8ecfd7f6dbb1ef388fe4d30574d46915221775cfa8f78f5ed47de9d59f50c88ecfcade7f37ab006c8508be74a9549f0845b26992ba3ad8ccb5b7a9f715df89a3cb628a5c61234b5bf559d88b14d4f8bb52e686477d61109ebbacbedf3b156042c8e25be2963f4dac57c5514b227d587c926b1045b6b9dcb350ad57c811ca95820e692aeb5838155050269ff8df7dd03cd53721d5a4f937a44dd43858d2a3ef380841548cf5424b283e3e9b7e716687d15236b34bdfa559f38af2a0bf44ee61ce2e6a075c1d95c1b07240bfd0da2faef3f98bea624f815b35eaca7dc7d7221398d7363725a08222190b110311b61537dbed833110ad5348a46bbeb234b5b6330455839c9bcf54f67061d322961ccc0b198f5c558392a3ee801474f70b4ff7e44ee56e7ce2641d4e2695722b8dba8d9554928a151a2e8b1cdaa161451c228ab7479ae985ef134648c8c2bcd739c90d8552571c67e183a25e2c443a72e08bcc3c5822e82d6cc61c8890af26d23da1444509bd7c9949f4b0d96b999c2f81a929fbf4593c19c43a414b18b05a8b53e2bbcc3876c3c6555a58dad8bc647d7ab0690b2f3c1780658290352392619b1927c8191d6087d49a46b15e9a03a40250ce96112e085bef349ae06204cac871c4ad95b8a5afd2c06cfc3f530c9773e5196264a20ef00536ce95b5e4ce60e8632f1081fdc3265993f8d6057865d06213478f129d9d6415db7022fb87aa7b34f98c5fb9dc1485b7f7844adc4fde098930c29a0e97be2736f6bfdb28446d8555bfcd889a94dc025f84d312ef9a7614043f42a44bec4717596b453c54678c8198cc47a48e50bdc51b013252bdc14dffe879353d28fd14123f03339372eaee11173ff7c4f4d15e6fa8a7d664457b5d1e98fc718e69d304d49bfbc0e4f51d5e744800c8e6383231b6b2cec3ff131e00d05a4191237c5f979b0120277895a4d03294ef824fa9145e15b25efdd6a33ef0c04130d63e880ae1ffbc7a7ac9946db65f54ef34ce1702b399189195ee77a3b2a22290839f4327c70edace1895018fa323276cc4874291774611eadbc7cd6a2292994145c30fc9f6148ad6994b212da6a47bd084be16e3ffd42751ab157cef129d1be44e7ab1880a7e8d04051a1c8cb22ec96a0af24902814a11994641266e3f37f32d96efac236c0239853555350895971725e557dc17d9ca586a18a87508d33b43dd720dd792a64161b6c087593e2321128e85f148428c6067c2a5e781f2ff6308128fefa933b6ccec8b1be3a26c10df4a16b70f23ce758ee9a62a4c01dfcebfb9642353ad8fcd1b4c91e21a37dbd0bda7941aaeb8ceb6b402e2b3d9d6c1e90ab5757b4e7c014746431f151a5f43ee17a27ed21a7391c85e98f66f2b930ff7428ee6986eba1b5bffa2ecdbe72980640d3d86733f5b7b9e9ad52018617fea3c07a0a22d2d9261cd8ec6876d7c0ce0fc843db2691dec1d2a8df9152d4aa9cb214ab6dc9f2adf34fc4bc35bfc9b7771b9db1ee091d4235737ed4eea00347d19142613d2cc6f9447f29670e02efc25e4cf179b123e28ed6f59c5a6326b3addaae8f7aa5eb507f5798befa5c89d04201f740824c02d3be9fc185e38e5f1acc72737bc51e5189498f679b367279dce2bff784522d5ab1a8475361651cfae0b7e2870151e8cbaf2eb7ad5cefa2ee27eb38e61678c0108b1a45b54e82c8ef49fdb85cbc936ecc143abccd0e5b7368626b4c4d2f04abd3a602fda60effe19735a95bc527714140d4bfd8866544a59eb5448f1743f5357ccc090fbc21ebe76dbeef53a60be5edeb9ff9ef316afbafca8be16502cc0f732e1d631e0878fddc45e10bafdb14dc503f0f128de1ce6f873eec1a8502a8639fb9ab62d82ce04ed694a643f3a23ec7ba27fd4fbea6612ab578f01c4104c4b92d86a1f010b8e14715ca7fc6648875858e0e53de2e383d4ac3f7d8c58744f64d83f1ccbfbe54da34140ee19f332bc9ffc633aeec3e47aa5624e001e398945f1166cd761971a308b5cad68c42c5b276b62b9b5474df0877f9b8724e30413bf874b03e4971ab5453e3912d7577796c9a5350e0ed0445a9cb69eed164dce0eb6ee47bcee0986283d48b85d1e0819a427eb12caacd393e6a75d7b09fd25b6a68b9c9dcb13210a6317500a74a5fd3407b12da376ab7a405e171eb0a08113bad5e81842797d72be45a719826ed68f7fff5ae23662716dd78936caaef2debd54991553bca72e7482e12ca5ed579f71c19fa2a96cc25a54c1897270e1b94073f493475162eee1db509a754b42b3c90eebf027ecedb005fc70de8a44abeec8b4ed52dcc51ac1fed15b1d618ce9c98a174789cf06316759ec00e831010f3ddc658bbd1dcb809e476e460bc1b98f62827d274dbf59c3e2cc7ba989b0b16b8ba98eb8fb72b28da0d2a2b697b63db1f6b1f28dfd1b69e6001bda10a6a4eb06c616f776fb9eee756239f8dc6cb8d5ac9099dd6505bb18c36051770fffeb9460462b4a0791f95ab0bde52158d9fcf91d19157b4e36cbaa2958ce0eabe022118eece3698b956f3d2eac385fc59546339da5306ca986af2ef513bd194f9f3b6e5018958b5442ff959f70c2a148486924d4125d6469a7103977c9f32bfcf945770fd8bbe87335def6013992eb50939830e7cd9845ae555196302cee70ce673a3047eb61df5f18c11f1fdf8647ed085e6808f9ff83b29e90a1d90bc317af77f459f0c88b2277620ff8f1cc2d876edefd1e6a49921b9fbf99997df0733358bc1e6d111e74469d639942322df1dd7737ae220e13780fd73043dba372eec5864a7c527d2f831a66dd51e398f2cc07cf5e49e62be4d01a3a339b9b51a0510ddd47021b23bcaec366baf6d175aac1e891407b3831c90a57a52f0d6c0476053311e049888041fc198f0dbe06ae0dffd8c3e11e6b2456446af0453aa43b3d8c7caa625be520a3e30e7b6064e6dbd32d43317cd7e3cb7e20af3f8c3e02604c546687ef95d43ed148041af543ae049afb0d8f04595febb5c5eff02463827cbcb3e34967b248d178e1531b966da41fad9f9cb67580ccaf1e7ad1deb9fb0771914d6dc113d2fd6ae7b7442cd7f25d48f7804608dc1de1b1904a5cc22a1b7ccb4c20ff00e15fdec7bacd86aed7110c885fdbc3cdddf75110ea1d6046b5508702381a72ac018c4a00d6c85552a4056e9d925439d2e7c7562bf746daa425d3834ae2dedcfff06f5924085a6bc7580f1c39991e97199f00918da639d6111614cab442167b7241f1e6b3db57b34317e19b0ce718cbcad82e0b7f42348a169a77a406b9e8007f68cc15314b5dcb569f33a016752658d953480885ba815804367938473d5a2d332d013829e6b8284138d6eec0556dbd3074e8b2fd445c964ad69f7d06c29996edb125d83cdf2f41756f61922ea50c79889f9b4ffe11d58ad9bab562b7dcc6df2be1d3d0d534a9cf24de5f9a78343285a62a38b71fb85c20fb3d016a173c137d4f5e532dba7d88cd92a1102cb66e377182a91237ac6ff06bec007d412966c0aa3b080e3f4c82c97c7907c46056988ff77afa799543f05a8af3f345de7a50ba03a1d741c82eb729ce4cb42ed55f786a4dbbed0ed9a2b613fa2b60e17d0cacdc674327fc11aff1ecc739aa5846e8a61f8db31063f00a3bdb2ef396e3850debac9f06372a9b3b025c9b57687e0096d2c1a75ec95ee80a015597fef23a9550678303afeb7e6bb5248de8130b07eee31915eb6dbe553301344e6d474e94db64d5888fad89fd68f4f96deba3f8ed4d7af6ab6d780c1c4a2e813a1f96b013acdfbb21b6ebe474cbf3e12050eb4ea19145e510085c03c59f4ef5e3e94b52e0bfd6ccaaba754c0e778867cc67163eeb05f51239a28198ae4ee3805d78e1f6239cd96a4180d934f1f3a08db31bf259a49cfec8f3871fcbc4bd4dc764a826641f3601a3f6411b4df7d48d0b447752e6409ed5faa6c2efcfb8f3587903fbe86830fa1170677b2f0bcbd694604cc2c13c7d69cce8709a353a891d0bcd62237c9a215a8f0318bb9f3f6a74c6d2913dd308f5812762258f86dd9d469271dd00c13aebc8f375bfc197ce1272f0647d2ceffe0e642e6efe9c92a07d0c01ef0a9efe27c5bc30f984883d6fa5191e58e7817538e9a1c27d915367cb857cab397374761b9cf40762f72ac644214d858c4c90beca602a1206040b1a33ecfa86754924876486f8ce900243255d4bff86071e35121241a1154489db2f6dff0bbbe4fe074db5a"}, {0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x800, [0x1, 0x7ff]}, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x86dd, [0x7, 0xce6, 0x3], "967f61132fd7370d13696ad0884f75858f1fa244133683694dc38c34e8da6d09d82bba24369d5afc539db3b410a87e30f0a93b608d4be75215d953118d77fd1e165d756c895bbfdbc4019b4e0004b416db36bbea6a7c539045e989dd16b1b110ad631c48eb21d0dfeb63439566eae62408737a8a15faf54f987eb1868cde79d6f1c979a8256b07f07c4dadcf41c33c6d90a55e4252c3b5eeb144b82e95fc0919509a3e6889fa22f046d5c2f8f536a0"}, {0x8, 0x88be, 0x3, {{0xc, 0x1, 0x5, 0x2, 0x1, 0x3, 0x4, 0x18}, 0x1, {0x8000}}}, {0x8, 0x22eb, 0x0, {{0x0, 0x2, 0xf7, 0x1, 0x0, 0x3, 0x6, 0x80}, 0x2, {0x9, 0x7e, 0x3, 0x10}}}, {0x8, 0x6558, 0x3, "d61b9b998a07b71b7bd6a88a445971fcbee3501b82871e5ea21bba8e8e2678a7d3c2585c72fd50b4b27f381a50b7c4dabbdea602232de6ab0fdb18b0c267713162671f6275ae41de9e559b2ee936527d8f9324c089605c8cd1fb9869aa21406a81c9fdc17f439914d8e3f80319c445394a18129935b73e53b8463966cb8dfa6a3aea61b45e9ae6d48b02417f12be2fa99822d789e36ad9d1f0a89cf9ec26564cd871bb8f8d1230326027e016eb7039b8fc6fe0a5a6e686271079253ccd3516f2e18e2be1ae2f43e084b19edf01e1cd78577626d409e081a7132f4233bf"}}}]}, "aafe3c", 0x3}}}}}, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000001d40)={0xffffffffffffffff}) sendmsg$NBD_CMD_CONNECT(r6, &(0x7f0000001d80)={0x0, 0x0, &(0x7f0000001dc0)={&(0x7f0000001e00)={0x38, r7, 0x1, 0xfffffffd, 0x0, {}, [@NBD_ATTR_SOCKETS={0x10, 0x7, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r8}}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7fff}]}, 0x38}}, 0x20000000) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f0000001e40)={0x0, 0x0, &(0x7f0000001e80)={&(0x7f0000001ec0)={0x1c, r7, 0x1, 0x70bd27, 0x25dfdbff, {}, [@NBD_ATTR_INDEX={0x8, 0x1, 0x0}]}, 0x1c}, 0x1, 0x0, 0x0, 0x51}, 0x4000810) r9 = socket$nl_route(0x10, 0x3, 0x0) r10 = socket(0x10, 0x803, 0x2) syz_genetlink_get_family_id$mptcp(&(0x7f0000000400), r10) getsockname$packet(r10, &(0x7f0000000440)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000480)=0x14) syz_emit_ethernet(0x6e, &(0x7f0000000a00)={@random="77bd238d2893", @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "f57a14", 0x38, 0x3a, 0x0, @remote, @mcast2, {[], @pkt_toobig={0x2, 0x0, 0x0, 0x7fff, {0xf, 0x6, "9566e1", 0x3, 0x6c, 0xff, @remote, @mcast1, [], "de182904fca7b431"}}}}}}}, 0x0) sendmsg$nl_route(r9, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000500)={0x0, 0x3c}}, 0x0) sendmsg$nl_route_sched(r4, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000640)=@newqdisc={0x2c, 0x24, 0x5820a61ca228651, 0x0, 0x25dfdbfb, {0x0, 0x0, 0x0, r11, {}, {0xffff, 0xffff}, {0x0, 0xfff1}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}}, 0x0) sendmsg$nl_route_sched(r9, &(0x7f0000000680)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000700)=@newtfilter={0x30, 0x28, 0x575ac7824d421709, 0x70bd29, 0x4, {0x0, 0x0, 0x0, r11, {0x9}, {0xffff}, {0x13, 0x5}}, [@filter_kind_options=@f_u32={{0x8}, {0x4}}]}, 0x30}, 0x1, 0x0, 0x0, 0x10}, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000740)={'sit0\x00'}) 1.319185633s ago: executing program 0 (id=2832): r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x20, 0x3, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000380)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @netfilter=0x2d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x99ee}, 0x94) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000540)={@map, 0x31, 0x0, 0x9, &(0x7f0000000440)=[0x0], 0x1, 0x0, &(0x7f0000000480)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f00000004c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000500)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0}, 0x40) bpf$BPF_LINK_CREATE(0x1c, &(0x7f00000005c0)={r1, 0xffffffffffffffff, 0x1f, 0x0, @val=@tcx={@void, @value=r1}}, 0x1c) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000580)={r1, 0x0, 0x2d, 0x0, @val=@netkit={@void, @value=r1, @void, @void, r2}}, 0x1c) r3 = syz_genetlink_get_family_id$nbd(&(0x7f00000000c0), 0xffffffffffffffff) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) sendmsg$NBD_CMD_RECONFIGURE(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="63812bbd7000fcdbdf25030000000800010000000000280007800c00018008000100", @ANYRES32=r4, @ANYBLOB="0c00018008000100", @ANYRES32=r0], 0x44}, 0x1, 0x0, 0x0, 0x40040}, 0x40040) socket$inet6(0xa, 0x5, 0x0) sendmsg$NL80211_CMD_SET_STATION(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000600)=ANY=[@ANYBLOB="2cc8d200", @ANYRES16=0x0, @ANYBLOB="000130bd7000fcdbdf25120000000c00990006000000370000000c0043000900000001000000"], 0x2c}, 0x1, 0x0, 0x0, 0x4000020}, 0x40040) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r5, 0x0, 0x80) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(0xffffffffffffffff, 0x84, 0x18, &(0x7f0000000400)={0x0, 0x1}, 0x0) close(0x3) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB="4c0000002000010028bd7000fcdbdf350a9680000800000717000000080017004e234e2314000200fc0000000000000000000000000000011400010020"], 0x4c}, 0x1, 0x0, 0x0, 0x140000d0}, 0x20048810) socket$inet6_sctp(0xa, 0x1, 0x84) r7 = socket$packet(0x11, 0x2, 0x300) getsockopt$packet_int(r7, 0x107, 0xb, 0x0, &(0x7f0000000000)) close(0x3) 1.255317897s ago: executing program 4 (id=2833): r0 = openat$cgroup(0xffffffffffffffff, &(0x7f0000000300)='syz1\x00', 0x200002, 0x0) openat$cgroup_ro(r0, 0x0, 0x0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) close(0x3) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x275a, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x13, 0x4, &(0x7f0000000100)=ANY=[@ANYRES64=r2], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x1, '\x00', 0x0, @fallback=0x2d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) write$cgroup_int(r2, &(0x7f0000000200), 0x806000) ioctl$FS_IOC_RESVSP(r2, 0x40305829, &(0x7f0000000380)={0x0, 0x0, 0x4000, 0x9ffffc}) unshare(0x22020600) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, 0x0, 0x20004090) epoll_pwait(0xffffffffffffffff, 0x0, 0x0, 0x7, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) unshare(0x2a040200) r4 = socket$inet6(0xa, 0x80002, 0x4) setsockopt$inet6_udp_int(r4, 0x11, 0x67, 0x0, 0x0) sendmmsg$inet6(r4, 0x0, 0x0, 0x4001c00) unshare(0x52000000) socket$nl_generic(0x10, 0x3, 0x10) mmap$xdp(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x0, 0x20010, 0xffffffffffffffff, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, 0x0) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x1000004, 0x42072, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, 0x0, 0x50) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000002c0)=ANY=[@ANYBLOB="2c000000190001000000000000000000802000000011000500"], 0x2c}, 0x1, 0x0, 0x0, 0x240440c4}, 0x80) sendfile(r2, r1, 0x0, 0x7d1d7457) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x22052, r1, 0x0) 1.123927087s ago: executing program 0 (id=2834): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$TIPC_NL_KEY_SET(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)={0x44, r1, 0x1, 0x0, 0x0, {0x3}, [@TIPC_NLA_BEARER={0x30, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xf}}}, {0x14, 0x2, @in={0x2, 0x0, @broadcast}}}}]}]}, 0x44}}, 0x0) sendmsg$TIPC_NL_BEARER_SET(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010036bd7000fbdbdf2505000000280001800d0001007564703a73797a320000000014000280080001000b000000080004005f0d0054"], 0x3c}, 0x1, 0x0, 0x0, 0x48c05}, 0x4040140) socket$inet_udp(0x2, 0x2, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={0x0, 0x14}}, 0x0) getsockname$packet(r4, &(0x7f0000000300)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000340)=0x14) r6 = socket(0x80000000000000a, 0x2, 0x0) setsockopt$inet6_group_source_req(r6, 0x29, 0x2e, &(0x7f0000000cc0)={0x0, {{0xa, 0x0, 0xfffffffe, @mcast1={0xff, 0x7}, 0x2}}, {{0xa, 0x0, 0xfe, @remote}}}, 0x108) r7 = socket(0x80000000000000a, 0x2, 0x0) setsockopt$inet6_group_source_req(r7, 0x29, 0x2a, &(0x7f0000000e00)={0x20, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x0, 0x0, @remote}}}, 0x108) setsockopt$inet6_group_source_req(r7, 0x29, 0x2b, &(0x7f0000000f40)={0x0, {{0xa, 0xffff, 0x2002, @mcast1={0xff, 0x7}, 0x24f3}}, {{0xa, 0x0, 0x0, @private0}}}, 0x108) close(r6) r8 = socket(0x80000000000000a, 0x2, 0x0) setsockopt$inet6_group_source_req(r8, 0x29, 0x2e, &(0x7f0000001080)={0x0, {{0xa, 0x0, 0x1, @mcast1={0xff, 0x7}, 0x100}}, {{0xa, 0x0, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}}}, 0x108) sendmsg$nl_route(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700000086d7c0d6c878f064eb", @ANYRES32=r5, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000480)={&(0x7f00000004c0)=@newqdisc={0x2c, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {0x0, 0x8}, {0xfff1, 0xffff}, {0x6}}, [@TCA_EGRESS_BLOCK={0x8, 0xe, 0x456}]}, 0x2c}}, 0x4000800) r9 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r9, &(0x7f0000000500)={0x3, 0x0, &(0x7f0000000540)={&(0x7f0000000580)={0x2, 0x3, 0xff, 0x3, 0xe, 0x0, 0x70bd2a, 0x25dfdbfb, [@sadb_key={0x2, 0x9, 0x8, 0x0, "c1"}, @sadb_address={0x3, 0x6, 0x3c, 0x0, 0x0, @in={0x2, 0x4e22, @remote}}, @sadb_sa={0x2, 0x1, 0x4d4, 0x0, 0x0, 0x7, 0x3}, @sadb_address={0x3, 0x5, 0x0, 0x0, 0x0, @in={0x2, 0x4e21, @initdev={0xac, 0x1e, 0x1, 0x0}}}, @sadb_x_sa2={0x2, 0x13, 0xa0, 0x0, 0x0, 0x70bd2a}]}, 0x70}, 0x1, 0x7}, 0x0) r10 = bpf$MAP_CREATE(0x0, &(0x7f0000000600)=ANY=[@ANYBLOB="11000000040000000400000009"], 0x50) r11 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=@base={0xd, 0x2, 0x4, 0x1, 0x0, r10}, 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000006c0)={{r11}, &(0x7f0000000700), &(0x7f0000000740)=r10}, 0x20) sendmsg$nl_route_sched(r2, &(0x7f0000000780)={0x0, 0x0, &(0x7f00000007c0)={&(0x7f0000000800)=@delchain={0x34, 0x64, 0xf31, 0xfffffffb, 0x0, {0x0, 0x0, 0x0, r5, {0x0, 0x9}, {0xfff3, 0xffff}, {0x0, 0x1b}}, [@filter_kind_options=@f_flower={{0x9}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x10}, 0x0) r12 = openat$tun(0xffffffffffffff9c, &(0x7f0000000840), 0x585142, 0x0) ioctl$TUNSETIFF(r12, 0x400454ca, &(0x7f0000000880)={'\x00', 0x2}) socket$nl_generic(0x10, 0x3, 0x10) 810.865114ms ago: executing program 1 (id=2835): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000400)=ANY=[@ANYBLOB="9000000000010506010000000000000002000000340001801400018008000100c0a8010108000200c0a801021c000280050001000600000006000200303900000600030000150000340002801400018008000100c0a8010208000200c0a801011c000280050001000600000006000200001500000600030030390000080007000000012c0c0005800800010066747000"], 0x90}}, 0x0) r1 = socket(0x1e, 0x4, 0x0) connect$tipc(r1, &(0x7f0000000080)=@name={0x1e, 0x2, 0x0, {{0x1, 0x1}}}, 0x10) sendmmsg$unix(r1, &(0x7f00000000c0), 0x400000000000203, 0x0) connect$inet(r1, &(0x7f0000000180)={0x2, 0x4e22, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10) sendmsg$nl_netfilter(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000500)=ANY=[@ANYBLOB="b800000000020104010000000000000002000000340001801400018008000100c0a8010108000200c0a801021c000280050001000600000006000200303900000600030000150000340002801400018008000100c0a8010208000200c0a801011c00028005000100060000000600020000000000060003004e200000340003801400018008000100ffffffff08000200ffffffff1c00028005000100ff000000060002000000000006000300ffff0000080004000000012c"], 0xb8}}, 0x0) sendmsg$nl_netfilter(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000600)=ANY=[@ANYBLOB="b800000000020100020000000000000002000000340001801400018008000100c0a8010108000200c0a801021c000280050001000600000006000200303900000600030000150000340002801400018008000100c0a8010208000200c0a801011c00028005000100060000000600020000000000060003004e200000340003801400018008000100ffffffff08000200ffffffff1c00028005000100ff000000060002000000000006000300ffff00000800040000000258"], 0xb8}}, 0x0) 710.732748ms ago: executing program 1 (id=2836): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x400448ca, 0x0) bind$bt_hci(r0, &(0x7f0000000200)={0x1f, 0xffff, 0x2}, 0x6) bpf$TOKEN_CREATE(0x24, &(0x7f0000000000), 0x8) bpf$TOKEN_CREATE(0x24, &(0x7f0000000080), 0x8) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000001c0)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f00000000c0), &(0x7f0000000100)}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x2, 0xe, &(0x7f0000000580)=ANY=[@ANYBLOB="b700000063000000bca30000000000002403000020fef6ff720af0fff8ffffff71a4f0ff000000001f030000000000002e100200000000002604f8ffffff000014010000630000001d130000000000007a0a00fe0000001f0f14000000000000b503f7fff800000095"], 0x0}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0xe, 0xe, &(0x7f00000006c0)=ANY=[], &(0x7f0000000700)='syzkaller\x00', 0x2, 0x1016, &(0x7f0000000740)=""/4118}, 0x94) r2 = socket$inet6(0x10, 0x3, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000002c0)=@newtaction={0x6c, 0x30, 0x53b, 0x0, 0x0, {}, [{0x58, 0x1, [@m_simple={0x54, 0x1, 0x0, 0x0, {{0xb}, {0x28, 0x2, 0x0, 0x1, [@TCA_DEF_DATA={0xb, 0x3, 'simple\x00'}, @TCA_DEF_PARMS={0x18, 0x2, {0x9f}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x1}}}}]}]}, 0x6c}, 0x1, 0x0, 0x0, 0x4060040}, 0x0) sendto$inet6(r2, &(0x7f0000000400)='s', 0x10a73, 0x800, 0x0, 0x4b6ae4f95a5de35b) bpf$TOKEN_CREATE(0x24, &(0x7f0000000140)={0x0, r1}, 0x8) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x12, 0x4, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000feffffff00000000090200009b00000000000000950000000000000088d2cfc7554fb48337da6836f3d840c620792325025caab78267db7768e0c58784388b104432f8ee322236bbb3acbd12b12a"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x28, '\x00', 0x0, @cgroup_sock_addr=0x1e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x95}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x18, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4000000000000007910000000000000db041818000100009500740000000000"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0x9164, &(0x7f000000cf3d)=""/195, 0x0, 0xa0}, 0x48) 501.67934ms ago: executing program 1 (id=2837): mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x43c37000) r0 = bpf$ITER_CREATE(0xb, &(0x7f0000002740), 0x0) close(r0) bpf$BPF_PROG_DETACH(0x1c, &(0x7f00000001c0)=ANY=[@ANYRES32, @ANYRES32, @ANYBLOB="0000eb083b399e44d18400fd814d8acb49920b10800000", @ANYRES32=0x0, @ANYRES64=0x0], 0x20) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f00000027c0), 0x4) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, 0x0, 0x0) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_CQM(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x7}, 0x1c) listen(r1, 0xfffffffc) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r2, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) socket$nl_generic(0x10, 0x3, 0x10) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), 0xffffffffffffffff) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010005fba00"/20, @ANYRES32=0x0, @ANYBLOB="80000200e180000008001b"], 0x28}}, 0x0) r6 = bpf$MAP_CREATE(0x0, 0x0, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, &(0x7f00000002c0)=ANY=[@ANYRES32=r6, @ANYBLOB="0000000000000000b7080000000002007b8af8ff00000000bfa200000000000007"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) bpf$BPF_PROG_QUERY(0x10, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x30, r4, 0x1, 0x0, 0x0, {}, [@MPTCP_PM_ATTR_ADDR={0x1c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @local}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0xe}]}]}, 0x30}, 0x1, 0x0, 0x0, 0xaa34a4cfdf933201}, 0x10) r7 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$bt_hci(r7, 0x84, 0x84, &(0x7f0000000440)=""/4096, &(0x7f0000001440)=0x1000) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r8, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="010000000000000000000700000024000180060005004e230000060001000200051b08000300ac1414aa"], 0x38}, 0x1, 0x0, 0x0, 0x14}, 0x0) 443.298782ms ago: executing program 3 (id=2838): bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x3, 0xf, &(0x7f00000005c0)=ANY=[@ANYBLOB="7a0af8ff000000007a0af0ff000000007a0ae8ff000000007a0ae0ff000000007a0ad8ff000000007a0ad0ff000000007a0ac8ff000000007a0ac0ff00000000bfa100000000000007010000d8ffffffbfa200000000000007020000c0ffffff85000000cf000000b70000000200000095"], &(0x7f0000000640)='GPL\x00', 0x5, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x1, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0xff00, 0x0, 0x0, 0x0, 0x0}, 0x94) 442.511941ms ago: executing program 2 (id=2839): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x5032}) r2 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r2, 0x8914, &(0x7f0000000080)={'syzkaller0\x00', 0x1}) writev(r1, &(0x7f00000000c0)=[{&(0x7f0000000100)="010000000000140010000900000000010000000000020800450000740001400040063c817f0000017f00000104d204d2", 0x30}, {&(0x7f0000000140)="605223115b1d83d13d7a514a665db0fa", 0x10}], 0x2) sendmsg$WG_CMD_SET_DEVICE(0xffffffffffffffff, 0x0, 0x40000) connect$inet(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_mreqsrc(r2, 0x0, 0x27, &(0x7f0000000180)={@remote, @dev={0xac, 0x14, 0x14, 0x3f}, @empty}, 0xc) r3 = syz_genetlink_get_family_id$nbd(&(0x7f0000000200), r0) r4 = socket$rxrpc(0x21, 0x2, 0xa) setsockopt$RXRPC_SECURITY_KEY(r4, 0x110, 0x11, 0x0, 0x0) sendmsg$NBD_CMD_CONNECT(r0, &(0x7f0000001ac0)={0x0, 0x0, &(0x7f0000001a80)={&(0x7f0000000240)=ANY=[@ANYBLOB='H\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="01002cbd700000100000010000000c00020002000000000000001c0007800c00018008000100", @ANYRES32, @ANYRES64=0x0, @ANYRES32, @ANYBLOB="0c00010028010000000000007104baf9e9260570f1539facea93b34858023a7b46af9a1190c109ff2b99f29d7e2dfd981de5ac5b0afd747e8ac7ac94819bfbc5eaede5ba168b05b19121d0073a9ee37daf03f84875d6a68afa16"], 0x48}}, 0x4) 336.172489ms ago: executing program 0 (id=2840): socket(0x10, 0x80002, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) bind$netlink(0xffffffffffffffff, &(0x7f0000000b40)={0x10, 0x0, 0x3, 0x80000000}, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r0, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r2, 0x84, 0xd, &(0x7f00000002c0)=@assoc_value, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000280)={'netdevsim0\x00'}) socket$unix(0x1, 0x2, 0x0) bpf$BPF_PROG_QUERY(0x10, 0x0, 0x0) bpf$BPF_LINK_CREATE_XDP(0x1c, 0x0, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000004c0)={&(0x7f0000000500)=ANY=[], 0x0, 0x8e}, 0x28) socket$inet(0x2, 0x2, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x40241, 0x0) socket$key(0xf, 0x3, 0x2) bpf$MAP_CREATE(0x0, &(0x7f0000000a00)=ANY=[@ANYBLOB="12000000040100000800000002"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000640)={0x3, 0x10, &(0x7f0000000700)=ANY=[@ANYBLOB="bfa200000000000007020000fcfeffff620200000000000018", @ANYRES32, @ANYBLOB="000000000000000085000000010000001500070000000000bf06000000000000bf61000000000000070100000400000085000000aa000000bf61000000000000070100000400"], &(0x7f0000000780)='GPL\x00', 0x7, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = syz_genetlink_get_family_id$ethtool(&(0x7f00000003c0), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_COALESCE_SET(r3, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000480)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="010000000000000000001000000018000180140002006e657464657673696d3000080000000005000b"], 0x34}}, 0x4044890) 256.078857ms ago: executing program 3 (id=2841): unshare(0x2c020400) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000002c0)=@newlink={0x50, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x42010, 0x2}, [@IFLA_LINKINFO={0x30, 0x12, 0x0, 0x1, @geneve={{0xb}, {0x20, 0x2, 0x0, 0x1, [@IFLA_GENEVE_REMOTE6={0x14, 0x12, @private1}, @IFLA_GENEVE_ID={0x8, 0x1, 0x4}]}}}]}, 0x50}, 0x1, 0x0, 0x0, 0x40680c5}, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup/syz0\x00', 0x1ff) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000000c0), 0x200002, 0x0) r3 = openat$cgroup_int(r2, &(0x7f0000000100)='cgroup.max.descendants\x00', 0x2, 0x0) bind$inet6(r0, &(0x7f00000003c0)={0xa, 0x4e22, 0x0, @empty}, 0x1c) r4 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000c00)={0x6, 0x8, &(0x7f0000000340)=@raw=[@tail_call={{0x18, 0x2, 0x1, 0x0, 0x1}}, @map_val={0x18, 0x2, 0x2, 0x0, 0x1, 0x0, 0x0, 0x0, 0xffffffff}, @alu={0x7, 0x0, 0xa, 0x0, 0x2, 0xfffffffffffffff8, 0xfffffffffffffff0}], &(0x7f0000000380)='GPL\x00', 0x2, 0x0, 0x0, 0x41100, 0x41, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, &(0x7f0000000a80)={0x7, 0x2}, 0x8, 0x10, &(0x7f0000000ac0)={0x1, 0x7, 0x2, 0x865}, 0x10, 0x0, 0x0, 0x9, &(0x7f0000000b00)=[r3, 0x1], &(0x7f0000000b40)=[{0x3, 0x2, 0x1, 0x1}, {0x4, 0x5, 0x0, 0x9}, {0x5, 0x4, 0x4, 0xb}, {0x1, 0x4, 0x2, 0x19}, {0x5, 0x3, 0xe, 0x2}, {0x4, 0x4, 0xe, 0x3}, {0x1, 0x1, 0x1, 0x7}, {0x3, 0x3, 0xe, 0x6}, {0x1, 0x3, 0xd, 0x3}], 0x10, 0x5}, 0x94) write(r4, &(0x7f0000000cc0)="11e6b24d885ad649a7979ab22d0a07b7e964abda9312a8412dc8c97d24a999fb1af1743ea23eb132bac4693dd26d33c7690634945c00d5af1e1cca1c", 0x3c) r5 = socket$inet6_udp(0xa, 0x2, 0x0) r6 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r6, &(0x7f00000000c0)={0x1f, 0xffff, 0x3}, 0x6) write(r6, &(0x7f0000000180)="4c00000011001200001100020000140002000000200000", 0x17) setsockopt$IP6T_SO_SET_REPLACE(r5, 0x29, 0x40, &(0x7f0000000400)=@mangle={'mangle\x00', 0x2, 0x6, 0x5e8, 0x2e8, 0x3d8, 0x1c0, 0x1c0, 0x3d8, 0x518, 0x518, 0x518, 0x518, 0x518, 0x6, 0x0, {[{{@uncond, 0x0, 0xa8, 0xe0, 0x0, {0x7a00000010000000}}, @common=@inet=@SET3={0x38, 'SET\x00', 0x3, {{0xffffffffffffffff, 0x2, 0x1}, {0xffffffffffffffff, 0x4, 0x1}, {0xffffffffffffffff, 0x4}, 0x5, 0x7ff}}}, {{@ipv6={@mcast2, @dev={0xfe, 0x80, '\x00', 0xa}, [0x0, 0x0, 0x0, 0xffffff00], [0x0, 0x0, 0xffffffff, 0xff], 'macvlan0\x00', 'veth1_vlan\x00', {}, {}, 0x6, 0x1, 0x4}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38, 'SET\x00', 0x3, {{0xffff}, {}, {0x87, 0x0, 0x7}}}}, {{@uncond, 0x0, 0x100, 0x128, 0x48000000, {}, [@common=@eui64={{0x28}}, @common=@srh={{0x30}, {0x33, 0x66, 0xf8, 0xa6, 0x9, 0x440, 0x502}}]}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffc}}, {{@uncond, 0x0, 0xa8, 0xf0}, @DNPT={0x48, 'DNPT\x00', 0x0, {@ipv4=@initdev={0xac, 0x1e, 0x1, 0x0}, @ipv4=@empty, 0x2c, 0x16, 0x4}}}, {{@uncond, 0x0, 0x118, 0x140, 0x0, {}, [@common=@dst={{0x48}, {0x7ff, 0x2, 0x1, [0xff, 0x4239, 0x1, 0x8001, 0xb1, 0xfff5, 0x5, 0x8, 0xfff, 0x3, 0xb, 0xa, 0x5, 0x10, 0x2, 0xc], 0xd}}, @inet=@rpfilter={{0x28}, {0x6}}]}, @HL={0x28, 'HL\x00', 0x0, {0x5}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x648) listen(r0, 0x0) setsockopt$inet_sctp_SCTP_EVENTS(0xffffffffffffffff, 0x84, 0xb, &(0x7f0000000f80)={0x0, 0x2, 0x9, 0x4, 0xbe, 0x1, 0x3, 0x54, 0x81, 0x5, 0x4d, 0xb, 0x5, 0x8}, 0xe) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000d80)='ns/net\x00') sendmsg$GTP_CMD_NEWPDP(r7, &(0x7f0000000dc0)={0x0, 0x0, &(0x7f0000000e00)={&(0x7f0000000e40)={0x3c, 0x0, 0x1, 0x0, 0x0, {0x3}, [@GTPA_LINK={0x8}, @GTPA_VERSION={0x8}, @GTPA_PEER_ADDRESS={0x8, 0x4, @remote}, @GTPA_NET_NS_FD={0x8, 0x7, r8}, @GTPA_MS_ADDRESS={0x8, 0x5, @multicast2}]}, 0x3c}}, 0x0) sendmsg$GTP_CMD_DELPDP(r4, &(0x7f0000000f40)={&(0x7f0000000d00)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000f00)={&(0x7f0000000e80)={0x44, 0x0, 0x200, 0x70bd2b, 0x25dfdbff, {}, [@GTPA_VERSION={0x8, 0x2, 0x1}, @GTPA_VERSION={0x8, 0x2, 0x1}, @GTPA_MS_ADDR6={0x14, 0xc, @ipv4={'\x00', '\xff\xff', @local}}, @GTPA_TID={0xc, 0x3, 0x1}]}, 0x44}, 0x1, 0x0, 0x0, 0x44010}, 0x40050) ppoll(&(0x7f0000000000)=[{r0, 0x228}], 0x1, 0x0, 0x0, 0x0) r9 = socket$netlink(0x10, 0x3, 0x6) writev(r9, &(0x7f0000000080)=[{&(0x7f0000000200)="a10100001500add427323b470c45b4560a067fffffff81004e22000d00ff0028925aa80020007b00090080000efffeffe809000000ff0000f03ac7100003ffffffffffffffffffffffe7ee00000000000000000200000000", 0x1a1}], 0x1) 34.555586ms ago: executing program 4 (id=2842): r0 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet_int(r0, 0x0, 0x2, 0x0, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000340), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000400)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="170900000000000000000100000005000700000000000800090000000000060002000100000008000a000000000008001800ac14140b08001900ff"], 0x44}, 0x1, 0x0, 0x0, 0x24008805}, 0x0) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r3, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r3, 0x84, 0x6f, &(0x7f0000000040)={0x0, 0x10, &(0x7f0000000080)=[@in={0x2, 0x4e23, @rand_addr=0x64010100}]}, &(0x7f00000000c0)=0x10) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r3, 0x84, 0x7a, &(0x7f0000000100)={r4, @in6={{0xa, 0x3, 0x4, @rand_addr=' \x01\x00'}}}, &(0x7f00000001c0)=0x84) r5 = socket$inet_sctp(0x2, 0x1, 0x84) sendmmsg$inet_sctp(r5, &(0x7f0000000000)=[{&(0x7f0000000240)=@in={0x2, 0x4e22, @local}, 0x10, &(0x7f0000000280)=[{&(0x7f00000002c0)="1528e3e780", 0x5}], 0x1, &(0x7f0000000300)=[@dstaddrv4={0x18, 0x84, 0x7, @local}], 0x18, 0x4005}], 0x1, 0x8008) syz_emit_ethernet(0x86, &(0x7f0000000200)=ANY=[@ANYRES8=r0, @ANYRES16=r3], 0x0) 0s ago: executing program 0 (id=2843): r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) r1 = socket$nl_route(0x10, 0x3, 0x0) write(r1, &(0x7f0000000000)="340000001a000100000000000000000002202000000000000000000008000100e001020308000200ac1414bb0800050001000000", 0x34) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x8080}, 0x20004450) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000500)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWRULE={0x64, 0x6, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x1}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_EXPRESSIONS={0x38, 0x4, 0x0, 0x1, [{0x34, 0x1, 0x0, 0x1, @xfrm={{0x9}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_XFRM_SPNUM={0x8, 0x4, 0x1, 0x0, 0x3}, @NFTA_XFRM_KEY={0x8, 0x2, 0x1, 0x0, 0x6}, @NFTA_XFRM_DREG={0x8, 0x1, 0x1, 0x0, 0x13}, @NFTA_XFRM_DIR={0x5}]}}}]}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x8c}, 0x1, 0x0, 0x0, 0x20004000}, 0x24000840) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x200002, 0x0) r3 = openat$cgroup_ro(r2, &(0x7f00000000c0)='blkio.throttle.io_service_bytes_recursive\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r3, 0x0) writev(r3, &(0x7f0000000100)=[{0x0}, {&(0x7f0000000140)='C', 0x1}], 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x20, 0x22, &(0x7f0000000340)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x40, 0x0, 0x0, 0x0, 0xba6}, {{0x18, 0x1, 0x1, 0x0, r0}, {}, {}, {0x85, 0x0, 0x0, 0x5}, {0x7, 0x1, 0xb, 0x9, 0x0, 0x20}}, {{0x6, 0x0, 0x6, 0x9, 0x0, 0x1, 0xe7030000}, {0x16, 0x0, 0x0, 0x80000000}}, [@printk={@p, {0x3, 0x3, 0x3, 0xa, 0x9}, {0x5, 0x1, 0xa, 0x1, 0x9}, {0x7, 0x0, 0x3}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x4df}, {0x56}}, @printk={@s, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x6}}, @map_idx={0x18, 0x0, 0x5, 0x0, 0x9}, @ldst={0x0, 0x3, 0x2, 0x8, 0x2, 0x18, 0xfffffffffffffffc}], {{0x4, 0x1, 0x3, 0x2, 0x3}, {0x5, 0x0, 0xb, 0x3}, {0x85, 0x0, 0x0, 0x76}}}, &(0x7f0000000080)='syzkaller\x00', 0xe, 0x0, 0x0, 0x41100, 0x2d, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) kernel console output (not intermixed with test programs): g backup interface [ 252.330831][T12220] bond0 (unregistering): Released all slaves [ 252.698831][T12247] netlink: 36 bytes leftover after parsing attributes in process `syz.3.1680'. [ 252.704872][T12247] bond1: entered promiscuous mode [ 252.704895][T12247] lo: entered promiscuous mode [ 252.728260][T12247] bond1: entered allmulticast mode [ 252.728283][T12247] lo: entered allmulticast mode [ 252.740721][T12247] 8021q: adding VLAN 0 to HW filter on device bond1 [ 252.757001][T12255] netlink: 904 bytes leftover after parsing attributes in process `syz.1.1682'. [ 252.757029][T12255] netlink: 904 bytes leftover after parsing attributes in process `syz.1.1682'. [ 253.136300][T12274] netlink: 'syz.0.1688': attribute type 1 has an invalid length. [ 253.306154][T12276] netlink: 'syz.4.1689': attribute type 1 has an invalid length. [ 253.306178][T12276] netlink: 244 bytes leftover after parsing attributes in process `syz.4.1689'. [ 253.360446][T12276] netlink: 20 bytes leftover after parsing attributes in process `syz.4.1689'. [ 253.486141][T12295] syzkaller1: entered promiscuous mode [ 253.486164][T12295] syzkaller1: entered allmulticast mode [ 253.831875][T12033] udevd[12033]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 254.064873][T12319] netlink: 20 bytes leftover after parsing attributes in process `syz.3.1698'. [ 257.479435][T12339] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 257.728269][T12395] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1716'. [ 257.728522][T12395] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1716'. [ 257.728816][T12395] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1716'. [ 257.729053][T12395] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1716'. [ 257.729282][T12395] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1716'. [ 257.729504][T12395] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1716'. [ 257.735521][T12399] netlink: 'syz.0.1719': attribute type 10 has an invalid length. [ 257.735541][T12399] netlink: 40 bytes leftover after parsing attributes in process `syz.0.1719'. [ 257.798518][T12399] netlink: 60 bytes leftover after parsing attributes in process `syz.0.1719'. [ 257.820352][T12395] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1716'. [ 257.820613][T12395] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1716'. [ 258.069530][T12413] IPVS: set_ctl: invalid protocol: 47 224.0.0.2:20265 [ 258.082719][T12413] netlink: 'syz.2.1721': attribute type 1 has an invalid length. [ 258.261453][T12423] bond5: (slave geneve4): making interface the new active one [ 258.279321][T12423] bond5: (slave geneve4): Enslaving as an active interface with an up link [ 258.296813][ T165] netdevsim netdevsim2 netdevsim3: set [1, 1] type 2 family 0 port 20000 - 0 [ 258.296916][ T165] netdevsim netdevsim2 netdevsim2: set [1, 1] type 2 family 0 port 20000 - 0 [ 258.296950][ T165] netdevsim netdevsim2 netdevsim1: set [1, 1] type 2 family 0 port 20000 - 0 [ 258.296984][ T165] netdevsim netdevsim2 netdevsim0: set [1, 1] type 2 family 0 port 20000 - 0 [ 258.851640][T12461] bond1: option mode: unable to set because the bond device has slaves [ 258.852148][T12461] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 258.868064][T12463] syzkaller0: entered promiscuous mode [ 258.868084][T12463] syzkaller0: entered allmulticast mode [ 258.888382][T12463] tc mirred: Loop (syzkaller0:egress --> syzkaller0:egress) [ 259.578645][T12494] xt_CONNSECMARK: invalid mode: 254 [ 259.674931][T12496] af_packet: tpacket_rcv: packet too big, clamped from 136 to 4294967286. macoff=82 [ 259.683163][T12488] netlink: 'syz.0.1740': attribute type 1 has an invalid length. [ 259.683185][T12488] netlink: 'syz.0.1740': attribute type 2 has an invalid length. [ 260.062217][T12513] bond1: option mode: unable to set because the bond device has slaves [ 260.082431][T12513] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 260.709127][T12537] syzkaller0: entered promiscuous mode [ 260.709150][T12537] syzkaller0: entered allmulticast mode [ 261.003227][T12549] netlink: 'syz.3.1754': attribute type 1 has an invalid length. [ 261.112989][T12549] bond15: entered promiscuous mode [ 261.113578][T12549] 8021q: adding VLAN 0 to HW filter on device bond15 [ 261.259837][T12554] veth5: entered promiscuous mode [ 261.286652][T12554] bond15: (slave veth5): Enslaving as a backup interface with a down link [ 261.385431][T12567] bond0: option packets_per_slave: mode dependency failed, not supported in mode balance-tlb(5) [ 261.390327][T12567] bond0 (unregistering): Released all slaves [ 262.880131][T12632] __nla_validate_parse: 65 callbacks suppressed [ 262.880161][T12632] netlink: 76 bytes leftover after parsing attributes in process `syz.1.1772'. [ 262.919457][T12631] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1774'. [ 262.939485][T12634] netlink: 44 bytes leftover after parsing attributes in process `syz.4.1771'. [ 263.116829][T12640] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 263.370480][T12660] netlink: 'syz.1.1779': attribute type 49 has an invalid length. [ 263.540291][T12669] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1781'. [ 263.540318][T12669] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1781'. [ 264.147780][T12692] netlink: 56 bytes leftover after parsing attributes in process `syz.4.1785'. [ 264.147805][T12692] netlink: 52 bytes leftover after parsing attributes in process `syz.4.1785'. [ 264.147818][T12692] netlink: 56 bytes leftover after parsing attributes in process `syz.4.1785'. [ 264.510722][T12701] bond1: option mode: unable to set because the bond device has slaves [ 264.514925][T12701] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 265.632540][T12754] team0 (unregistering): Port device team_slave_0 removed [ 265.649759][T12754] team0 (unregistering): Port device team_slave_1 removed [ 265.665579][T12754] team0 (unregistering): Port device bond6 removed [ 265.800247][T12774] syzkaller0: entered promiscuous mode [ 265.800269][T12774] syzkaller0: entered allmulticast mode [ 265.899973][T12760] netlink: 'syz.3.1806': attribute type 1 has an invalid length. [ 266.001070][T12780] Bluetooth: MGMT ver 1.23 [ 266.414796][T12800] netlink: 'syz.4.1814': attribute type 1 has an invalid length. [ 266.497952][T12800] bond0: entered promiscuous mode [ 266.498319][T12800] 8021q: adding VLAN 0 to HW filter on device bond0 [ 266.548938][T12800] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1814'. [ 266.877426][T12800] 8021q: adding VLAN 0 to HW filter on device bond0 [ 266.889154][T12800] bond0: (slave wireguard0): The slave device specified does not support setting the MAC address [ 266.889181][T12800] bond0: (slave wireguard0): Setting fail_over_mac to active for active-backup mode [ 266.982727][T12800] bond0: (slave wireguard0): making interface the new active one [ 266.982751][T12800] wireguard0: entered promiscuous mode [ 266.999884][T12800] bond0: (slave wireguard0): Enslaving as an active interface with an up link [ 267.027713][T12816] tipc: Started in network mode [ 267.027745][T12816] tipc: Node identity ff010000000000000000000000000001, cluster identity 4711 [ 267.027796][T12816] tipc: Enabling of bearer rejected, failed to enable media [ 267.402125][T12827] syzkaller0: entered promiscuous mode [ 267.402148][T12827] syzkaller0: entered allmulticast mode [ 267.502261][T12827] tipc: Enabled bearer , priority 0 [ 267.522694][T12826] tipc: Resetting bearer [ 267.591578][T12826] tipc: Disabling bearer [ 267.682572][T12840] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1819'. [ 268.260076][T12771] Set syz0 is full, maxelem 23469 reached [ 268.695573][T12874] bond1: option mode: unable to set because the bond device has slaves [ 268.741951][T12875] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 269.019953][T12888] sctp: [Deprecated]: syz.2.1830 (pid 12888) Use of int in max_burst socket option. [ 269.019953][T12888] Use struct sctp_assoc_value instead [ 269.175833][T12895] netlink: 20 bytes leftover after parsing attributes in process `syz.2.1832'. [ 269.268196][T12895] 8021q: adding VLAN 0 to HW filter on device bond1 [ 269.294611][T12895] 8021q: adding VLAN 0 to HW filter on device bond3 [ 269.303655][T12895] syzkaller0: left promiscuous mode [ 269.318194][T12895] A link change request failed with some changes committed already. Interface vxlan0 may have been left with an inconsistent configuration, please check. [ 269.386067][T12899] netlink: 'syz.0.1835': attribute type 10 has an invalid length. [ 269.393063][ T7488] ip6_tunnel: syztnl0 xmit: Local address not yet configured! [ 269.691672][T12924] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1836'. [ 270.766164][T12952] bond1: option mode: unable to set because the bond device has slaves [ 270.766605][T12952] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 271.092490][T12974] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1844'. [ 271.191277][T12979] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 271.582376][T12994] bond1: option mode: unable to set because the bond device has slaves [ 271.593082][T12994] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 271.830667][T13003] x_tables: duplicate underflow at hook 1 [ 271.978545][T13010] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 272.055221][T13016] tipc: Enabling of bearer rejected, failed to enable media [ 272.073645][T13016] gre1: entered promiscuous mode [ 272.073668][T13016] gre1: entered allmulticast mode [ 272.189733][T13022] bond1: option mode: unable to set because the bond device has slaves [ 272.190144][T13022] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 272.610288][T13032] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1856'. [ 273.129833][T13036] SET target dimension over the limit! [ 273.413287][T13054] netlink: 279 bytes leftover after parsing attributes in process `syz.0.1862'. [ 273.426126][T13054] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1862'. [ 273.604089][ C1] ip6_tunnel: syztnl0 xmit: Local address not yet configured! [ 273.769455][T13064] Bluetooth: hci0: invalid length 0, exp 2 for type 18 [ 273.776490][T13064] Cannot find map_set index 135 as target [ 273.882233][T13067] netlink: 337 bytes leftover after parsing attributes in process `syz.3.1864'. [ 274.587378][T13079] bond3: option mode: unable to set because the bond device has slaves [ 274.589339][T13079] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 275.085843][T13101] syzkaller0: left allmulticast mode [ 275.998607][T13136] x_tables: duplicate underflow at hook 1 [ 276.009001][T13133] bond1: option mode: unable to set because the bond device has slaves [ 276.011101][T13133] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 276.280626][T13147] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 276.513811][T13158] batman_adv: batadv0: Adding interface: veth0 [ 276.513833][T13158] batman_adv: batadv0: The MTU of interface veth0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 276.513947][T13158] batman_adv: batadv0: Interface activated: veth0 [ 276.696588][T13160] bond7: entered promiscuous mode [ 276.697112][T13160] 8021q: adding VLAN 0 to HW filter on device bond7 [ 276.763359][T13157] tc_dump_action: action bad kind [ 277.140204][T13175] syzkaller0: entered promiscuous mode [ 277.140229][T13175] syzkaller0: entered allmulticast mode [ 277.367166][T13181] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1891'. [ 277.578470][T13194] bond1: option mode: unable to set because the bond device has slaves [ 277.578917][T13194] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 277.979731][T13216] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1901'. [ 278.103686][T13222] syzkaller0: entered promiscuous mode [ 278.104466][T13222] syzkaller0: entered allmulticast mode [ 278.147185][T13226] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1905'. [ 278.230565][T13230] netlink: 56 bytes leftover after parsing attributes in process `syz.0.1906'. [ 278.250012][T13231] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1901'. [ 278.307166][T13188] netlink: 'syz.1.1893': attribute type 1 has an invalid length. [ 278.376073][T13237] syzkaller1: entered promiscuous mode [ 278.376096][T13237] syzkaller1: entered allmulticast mode [ 278.439952][T13236] bond1: option mode: unable to set because the bond device has slaves [ 278.448305][T13236] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 278.569966][T13245] ip6gretap1: entered allmulticast mode [ 278.571906][T13245] batman_adv: batadv0: Adding interface: ip6gretap1 [ 278.571924][T13245] batman_adv: batadv0: The MTU of interface ip6gretap1 is too small (1434) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 278.571955][T13245] batman_adv: batadv0: Interface activated: ip6gretap1 [ 278.747427][T13253] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1912'. [ 278.747635][T13255] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1912'. [ 278.791472][T13257] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 278.814512][T13257] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1914'. [ 278.818650][T13257] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1914'. [ 279.058904][T13266] ip_tables: iptables: counters copy to user failed while replacing table [ 279.081159][T13268] vlan4: entered promiscuous mode [ 279.081183][T13268] hsr0: entered promiscuous mode [ 279.081412][T13268] vlan4: entered allmulticast mode [ 279.081425][T13268] hsr0: entered allmulticast mode [ 279.081438][T13268] hsr_slave_0: entered allmulticast mode [ 279.081454][T13268] hsr_slave_1: entered allmulticast mode [ 279.123615][T13268] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1918'. [ 279.132956][T13268] hsr_slave_0: left promiscuous mode [ 279.144054][T13268] hsr_slave_1: left promiscuous mode [ 279.324657][ T165] netdevsim netdevsim3 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 279.324703][ T165] netdevsim netdevsim3 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 279.324737][ T165] netdevsim netdevsim3 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 279.324770][ T165] netdevsim netdevsim3 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 279.701703][T13294] smbdirect: ib_dev[syz1]: added: RNIC max_fast_reg_page_list_len=256 device_cap_flags=0x200000 kernel_cap_flags=0x10 page_size_cap=0x1000 [ 279.701740][T13294] smbdirect: ib_dev[syz1]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=1 max_cqe=3276800 max_qp_wr=32768 max_send_sge=6 max_recv_sge=6 [ 279.701777][T13294] smbdirect: ib_dev[syz1]PORT[1]: iwarp=1 ib=0 roce=0 v1=0 v2=0 core_cap_flags=0x400008 [ 279.857317][T13305] ip_tables: iptables: counters copy to user failed while replacing table [ 279.919566][T13305] ip_tables: iptables: counters copy to user failed while replacing table [ 280.118648][T13315] macvtap1: entered promiscuous mode [ 280.118669][T13315] geneve0: entered promiscuous mode [ 280.118937][T13315] macvtap1: entered allmulticast mode [ 280.118951][T13315] geneve0: entered allmulticast mode [ 280.159963][T13312] geneve0: left allmulticast mode [ 280.159985][T13312] geneve0: left promiscuous mode [ 280.165084][T13312] macvtap1: left promiscuous mode [ 280.165852][T13312] macvtap1: left allmulticast mode [ 280.471489][T13334] ip6t_rt: unknown flags 1F [ 280.785771][T13351] netlink: 'syz.0.1936': attribute type 10 has an invalid length. [ 280.813043][T13351] team0: Port device veth1_to_hsr added [ 281.018844][T13365] netlink: 'syz.4.1939': attribute type 9 has an invalid length. [ 281.161911][T13373] RDS: rds_bind could not find a transport for ::ffff:10.1.1.1, load rds_tcp or rds_rdma? [ 281.163588][T13370] RDS: rds_bind could not find a transport for ::ffff:10.1.1.1, load rds_tcp or rds_rdma? [ 281.493347][T13389] 8021q: adding VLAN 0 to HW filter on device bond8 [ 281.495255][T13392] lo: entered promiscuous mode [ 281.512037][T13392] bond3: (slave lo): Releasing backup interface [ 281.529838][T13392] bond3: (slave lo): last VLAN challenged slave left bond - VLAN blocking is removed [ 281.948829][T13408] netlink: 'syz.4.1950': attribute type 11 has an invalid length. [ 282.244133][ C1] ip6_tunnel: syztnl0 xmit: Local address not yet configured! [ 282.734574][T13459] netlink: 'syz.4.1960': attribute type 4 has an invalid length. [ 282.734596][T13459] __nla_validate_parse: 12 callbacks suppressed [ 282.734607][T13459] netlink: 17 bytes leftover after parsing attributes in process `syz.4.1960'. [ 283.266910][T13489] IPv6: NLM_F_CREATE should be specified when creating new route [ 283.419115][T13500] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1971'. [ 283.759194][T13512] netlink: 'syz.4.1973': attribute type 1 has an invalid length. [ 283.870331][T13516] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1974'. [ 283.903660][T13512] netlink: 28 bytes leftover after parsing attributes in process `syz.4.1973'. [ 283.920695][T13514] bond12: (slave geneve3): making interface the new active one [ 283.921464][T13514] bond12: (slave geneve3): Enslaving as an active interface with an up link [ 283.945650][T13512] 8021q: adding VLAN 0 to HW filter on device bond12 [ 283.947055][ T3019] netdevsim netdevsim4 netdevsim3: set [1, 1] type 2 family 0 port 20000 - 0 [ 283.948913][ T165] netdevsim netdevsim4 netdevsim2: set [1, 1] type 2 family 0 port 20000 - 0 [ 283.948953][ T165] netdevsim netdevsim4 netdevsim1: set [1, 1] type 2 family 0 port 20000 - 0 [ 283.949003][ T165] netdevsim netdevsim4 netdevsim0: set [1, 1] type 2 family 0 port 20000 - 0 [ 284.015391][T13521] SET target dimension over the limit! [ 284.336981][T13533] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1978'. [ 284.585899][T13549] netlink: 'syz.4.1981': attribute type 11 has an invalid length. [ 284.912581][T13564] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1987'. [ 285.482042][T13592] bridge0: entered allmulticast mode [ 285.544895][T13597] netlink: 36 bytes leftover after parsing attributes in process `syz.0.1996'. [ 285.723680][T13603] IPVS: Unknown mcast interface: nicvf0 [ 286.090964][T13625] tipc: Enabled bearer , priority 10 [ 286.179738][T13624] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2005'. [ 286.420439][T13643] netlink: 'syz.2.2008': attribute type 4 has an invalid length. [ 286.420462][T13643] netlink: 17 bytes leftover after parsing attributes in process `syz.2.2008'. [ 286.471410][T13648] tipc: Enabling not permitted [ 286.471444][T13648] tipc: Enabling of bearer rejected, failed to enable media [ 286.471686][T13648] tipc: Enabling not permitted [ 286.471712][T13648] tipc: Enabling of bearer rejected, failed to enable media [ 286.471939][T13648] tipc: Enabling not permitted [ 286.471964][T13648] tipc: Enabling of bearer rejected, failed to enable media [ 286.472186][T13648] tipc: Enabling not permitted [ 286.472212][T13648] tipc: Enabling of bearer rejected, failed to enable media [ 286.472443][T13648] tipc: Enabling not permitted [ 286.474795][T13648] tipc: Enabling of bearer rejected, failed to enable media [ 286.480331][T13648] tipc: Enabling not permitted [ 286.480362][T13648] tipc: Enabling of bearer rejected, failed to enable media [ 286.480586][T13648] tipc: Enabling not permitted [ 286.480611][T13648] tipc: Enabling of bearer rejected, failed to enable media [ 286.480833][T13648] tipc: Enabling not permitted [ 286.480857][T13648] tipc: Enabling of bearer rejected, failed to enable media [ 286.481066][T13648] tipc: Enabling not permitted [ 286.481089][T13648] tipc: Enabling of bearer rejected, failed to enable media [ 286.481304][T13648] tipc: Enabling not permitted [ 286.481327][T13648] tipc: Enabling of bearer rejected, failed to enable media [ 286.481557][T13648] tipc: Enabling not permitted [ 286.481581][T13648] tipc: Enabling of bearer rejected, failed to enable media [ 286.598710][T13661] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2011'. [ 286.799164][T13653] tipc: Resetting bearer [ 286.938822][T13653] bridge0: port 2(bridge_slave_1) entered blocking state [ 286.938957][T13653] bridge0: port 2(bridge_slave_1) entered forwarding state [ 286.939445][T13653] bridge0: port 1(bridge_slave_0) entered blocking state [ 286.939565][T13653] bridge0: port 1(bridge_slave_0) entered forwarding state [ 287.055475][T13648] tipc: Enabling not permitted [ 287.055510][T13648] tipc: Enabling of bearer rejected, failed to enable media [ 287.057292][T13648] tipc: Enabling not permitted [ 287.057324][T13648] tipc: Enabling of bearer rejected, failed to enable media [ 287.057616][T13648] tipc: Enabling not permitted [ 287.057642][T13648] tipc: Enabling of bearer rejected, failed to enable media [ 287.057920][T13648] tipc: Enabling not permitted [ 287.057946][T13648] tipc: Enabling of bearer rejected, failed to enable media [ 287.186302][T13648] tipc: Enabling not permitted [ 287.186337][T13648] tipc: Enabling of bearer rejected, failed to enable media [ 287.186679][T13648] tipc: Enabling not permitted [ 287.186703][T13648] tipc: Enabling of bearer rejected, failed to enable media [ 287.186959][T13648] tipc: Enabling not permitted [ 287.186987][T13648] tipc: Enabling of bearer rejected, failed to enable media [ 287.187660][T13648] tipc: Enabling not permitted [ 287.187686][T13648] tipc: Enabling of bearer rejected, failed to enable media [ 287.191364][T13648] tipc: Enabling not permitted [ 287.191394][T13648] tipc: Enabling of bearer rejected, failed to enable media [ 287.191695][T13648] tipc: Enabling not permitted [ 287.191721][T13648] tipc: Enabling of bearer rejected, failed to enable media [ 287.191982][T13648] tipc: Enabling not permitted [ 287.192007][T13648] tipc: Enabling of bearer rejected, failed to enable media [ 287.192325][T13648] tipc: Enabling not permitted [ 287.192350][T13648] tipc: Enabling of bearer rejected, failed to enable media [ 287.192620][T13648] tipc: Enabling not permitted [ 287.192644][T13648] tipc: Enabling of bearer rejected, failed to enable media [ 287.309974][T13648] tipc: Enabling not permitted [ 287.310006][T13648] tipc: Enabling of bearer rejected, failed to enable media [ 287.310262][T13648] tipc: Enabling not permitted [ 287.310288][T13648] tipc: Enabling of bearer rejected, failed to enable media [ 287.310556][T13648] tipc: Enabling not permitted [ 287.310581][T13648] tipc: Enabling of bearer rejected, failed to enable media [ 287.310801][T13648] tipc: Enabling not permitted [ 287.310829][T13648] tipc: Enabling of bearer rejected, failed to enable media [ 287.311040][T13648] tipc: Enabling not permitted [ 287.311064][T13648] tipc: Enabling of bearer rejected, failed to enable media [ 287.311281][T13648] tipc: Enabling not permitted [ 287.311310][T13648] tipc: Enabling of bearer rejected, failed to enable media [ 287.333367][T13648] tipc: Enabling not permitted [ 287.333399][T13648] tipc: Enabling of bearer rejected, failed to enable media [ 287.333623][T13648] tipc: Enabling not permitted [ 287.333647][T13648] tipc: Enabling of bearer rejected, failed to enable media [ 287.334316][T13648] tipc: Enabling not permitted [ 287.334341][T13648] tipc: Enabling of bearer rejected, failed to enable media [ 287.561695][T13679] xt_nat: multiple ranges no longer supported [ 287.590026][T13686] xt_nat: multiple ranges no longer supported [ 287.677193][T13699] ip_tables: iptables: counters copy to user failed while replacing table [ 288.012689][T13718] __nla_validate_parse: 68 callbacks suppressed [ 288.012713][T13718] netlink: 112 bytes leftover after parsing attributes in process `syz.0.2024'. [ 288.784155][T13762] netlink: 16 bytes leftover after parsing attributes in process `syz.0.2035'. [ 289.108612][T13785] IPVS: set_ctl: invalid protocol: 0 0.0.0.0:0 [ 289.372818][T13789] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 289.376282][T13789] netlink: 'syz.4.2042': attribute type 5 has an invalid length. [ 289.820250][T13825] IPVS: set_ctl: invalid protocol: 44 100.1.1.0:20003 [ 290.138319][T13834] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2054'. [ 290.205003][T13850] xt_CONNSECMARK: only valid in 'mangle' or 'security' table, not 'raw' [ 290.336354][T13855] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2057'. [ 290.336378][T13855] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2057'. [ 290.459244][T13855] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2057'. [ 290.459267][T13855] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2057'. [ 291.103457][T13891] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 291.114129][ T29] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 291.148723][T13904] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 291.449198][T13919] netlink: 'syz.4.2068': attribute type 1 has an invalid length. [ 291.449222][T13919] netlink: 'syz.4.2068': attribute type 2 has an invalid length. [ 291.675859][T13930] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2076'. [ 291.769905][T13938] netlink: 36 bytes leftover after parsing attributes in process `syz.1.2075'. [ 291.973225][T13948] A link change request failed with some changes committed already. Interface syz_tun may have been left with an inconsistent configuration, please check. [ 292.347227][T13963] netlink: 'syz.4.2083': attribute type 1 has an invalid length. [ 292.347264][T13963] netlink: 244 bytes leftover after parsing attributes in process `syz.4.2083'. [ 292.438178][T13969] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 292.443412][T13971] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 292.575786][T13980] block nbd0: reconnected socket [ 292.576392][ T5638] block nbd0: Receive control failed (result -32) [ 292.825158][T13990] ip_tables: iptables: counters copy to user failed while replacing table [ 293.189164][T14009] netlink: 20 bytes leftover after parsing attributes in process `syz.3.2093'. [ 294.269044][T14059] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2103'. [ 294.269146][T14059] block nbd1: Unsupported socket: should be TCP or UNIX. [ 294.316985][T14060] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2102'. [ 294.646286][T14073] block nbd0: reconnected socket [ 294.646404][T14073] block nbd0: reconnected socket [ 294.685244][T14073] netlink: 'syz.3.2104': attribute type 9 has an invalid length. [ 294.778143][ T5645] block nbd0: Receive control failed (result -32) [ 294.778248][ T5638] block nbd0: Receive control failed (result -32) [ 295.174546][T14090] Bluetooth: hci0: invalid length 0, exp 2 for type 18 [ 295.175053][T14090] Cannot find map_set index 135 as target [ 295.412546][T14107] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2110'. [ 295.475126][ T51] netdevsim netdevsim4 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 295.476258][ T51] netdevsim netdevsim4 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 295.476323][ T51] netdevsim netdevsim4 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 295.476354][ T51] netdevsim netdevsim4 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 295.566354][T14112] netlink: 'syz.3.2112': attribute type 34 has an invalid length. [ 295.566379][T14112] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2112'. [ 295.729157][T14112] bond17: option miimon: invalid value (18446744073709551614) [ 295.729184][T14112] bond17: option miimon: allowed values 0 - 2147483647 [ 295.751315][T14112] bond17 (unregistering): Released all slaves [ 295.958865][T14129] syzkaller0: entered promiscuous mode [ 295.958885][T14129] syzkaller0: entered allmulticast mode [ 295.986424][T14129] smc: removing ib device rxe0 [ 296.162087][T14129] smbdirect: ib_dev[rxe0] removed [ 296.260348][T14144] Bluetooth: hci0: invalid length 0, exp 2 for type 13 [ 296.315359][T14145] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2118'. [ 296.320645][T14145] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2118'. [ 296.321549][T14148] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2118'. [ 296.761606][T14155] bond1: option mode: unable to set because the bond device has slaves [ 296.773437][T14155] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 296.913346][T14162] syz_tun: entered allmulticast mode [ 296.971425][T14161] smbdirect: ib_dev[s`z1]: added: RNIC max_fast_reg_page_list_len=256 device_cap_flags=0x200000 kernel_cap_flags=0x10 page_size_cap=0x1000 [ 296.971465][T14161] smbdirect: ib_dev[s`z1]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=1 max_cqe=3276800 max_qp_wr=32768 max_send_sge=6 max_recv_sge=6 [ 296.971503][T14161] smbdirect: ib_dev[s`z1]PORT[1]: iwarp=1 ib=0 roce=0 v1=0 v2=0 core_cap_flags=0x400008 [ 297.327835][T14158] syz_tun: left allmulticast mode [ 298.112167][T14204] IPVS: set_ctl: invalid protocol: 98 127.0.0.1:21 [ 298.401446][T14212] bond1: option mode: unable to set because the bond device has slaves [ 298.447300][T14212] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 298.697440][T14219] vlan2: entered allmulticast mode [ 298.697464][T14219] bond0: entered allmulticast mode [ 298.697479][T14219] bond_slave_0: entered allmulticast mode [ 298.697495][T14219] ¬0Ù: entered allmulticast mode [ 298.883939][ C1] ip6_tunnel: ip6erspan0 xmit: Local address not yet configured! [ 299.077359][T14232] ip_tables: iptables: counters copy to user failed while replacing table [ 299.524525][ C1] ip6_tunnel: syztnl0 xmit: Local address not yet configured! [ 299.534577][T14242] trusted_key: syz.2.2141 sent an empty control message without MSG_MORE. [ 300.007033][T14252] bond1: option mode: unable to set because the bond device has slaves [ 300.012010][T14252] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 300.141409][T14260] bond1: option mode: unable to set because the bond device has slaves [ 300.141764][T14260] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 300.488885][T14269] netlink: 'syz.1.2146': attribute type 8 has an invalid length. [ 301.066797][T14299] tipc: Enabled bearer , priority 10 [ 301.091338][T14299] ip_tables: iptables: counters copy to user failed while replacing table [ 301.127994][T14301] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2153'. [ 301.140108][T14305] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2153'. [ 301.533042][T14323] sctp: [Deprecated]: syz.3.2158 (pid 14323) Use of struct sctp_assoc_value in delayed_ack socket option. [ 301.533042][T14323] Use struct sctp_sack_info instead [ 301.615998][T14326] bond1: option mode: unable to set because the bond device has slaves [ 301.616332][T14326] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 301.697542][T14329] netlink: 'syz.3.2160': attribute type 63 has an invalid length. [ 301.697569][T14329] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2160'. [ 302.184477][ T5767] tipc: Node number set to 4278255617 [ 302.492364][T14428] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2166'. [ 302.927365][T14455] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2169'. [ 303.143315][T14448] netlink: 'syz.1.2169': attribute type 21 has an invalid length. [ 303.232962][T14460] bond1: option mode: unable to set because the bond device has slaves [ 303.251455][T14460] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 303.572645][T14477] batadv_slave_1: entered promiscuous mode [ 303.590422][T14474] batadv_slave_1: left promiscuous mode [ 303.656728][T14478] netlink: 68 bytes leftover after parsing attributes in process `syz.2.2176'. [ 303.751903][T14483] netlink: 68 bytes leftover after parsing attributes in process `syz.2.2176'. [ 303.953350][T14503] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2178'. [ 304.170272][T14512] netlink: 'syz.0.2183': attribute type 1 has an invalid length. [ 304.422225][T14515] macvtap2: entered allmulticast mode [ 304.431983][T14521] bond1: option mode: unable to set because the bond device has slaves [ 304.435939][T14521] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 304.556709][T14523] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2183'. [ 304.703638][T14515] macvtap3: entered allmulticast mode [ 304.756741][T14539] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2187'. [ 304.907402][T14512] bond8: (slave bridge4): making interface the new active one [ 304.913581][T14512] bond8: (slave bridge4): Enslaving as an active interface with an up link [ 305.287742][T14559] tipc: Failed to remove unknown binding: 66,0,0/16777217:2639508714/2639508715 [ 305.315648][T14559] tipc: Failed to remove unknown binding: 66,0,0/16777217:2639508714/2639508715 [ 305.372473][T14559] 8021q: VLANs not supported on ip6gre0 [ 306.051819][T14591] block nbd3: not configured, cannot reconfigure [ 306.162928][T14587] A link change request failed with some changes committed already. Interface nicvf0 may have been left with an inconsistent configuration, please check. [ 306.372445][T14608] netlink: 'syz.4.2207': attribute type 1 has an invalid length. [ 306.372649][T14607] netlink: 'syz.4.2207': attribute type 1 has an invalid length. [ 306.466294][T14608] __nla_validate_parse: 4 callbacks suppressed [ 306.466313][T14608] netlink: 4564 bytes leftover after parsing attributes in process `syz.4.2207'. [ 306.466419][T14608] netlink: 4564 bytes leftover after parsing attributes in process `syz.4.2207'. [ 306.480680][T14613] netlink: 4564 bytes leftover after parsing attributes in process `syz.4.2207'. [ 306.480803][T14613] netlink: 4564 bytes leftover after parsing attributes in process `syz.4.2207'. [ 307.636101][T14656] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2218'. [ 307.888221][T14666] netlink: 64 bytes leftover after parsing attributes in process `syz.2.2221'. [ 307.888566][T14667] netlink: 64 bytes leftover after parsing attributes in process `syz.2.2221'. [ 308.636158][T14713] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2233'. [ 308.768530][T14720] ip_tables: iptables: counters copy to user failed while replacing table [ 309.227978][T14740] bond1: option mode: unable to set because the bond device has slaves [ 309.233305][T14740] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 309.761593][T14767] netlink: 20 bytes leftover after parsing attributes in process `syz.3.2243'. [ 310.492332][T14796] bond1: option mode: unable to set because the bond device has slaves [ 310.506769][T14796] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 310.881970][T14824] netlink: 'syz.3.2257': attribute type 1 has an invalid length. [ 311.042137][T14820] syzkaller1: entered promiscuous mode [ 311.042157][T14820] syzkaller1: entered allmulticast mode [ 311.918185][T14865] bond1: option mode: unable to set because the bond device has slaves [ 311.919521][T14865] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 312.015876][T14871] v: renamed from vlan1 [ 312.477683][T14901] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2270'. [ 312.893647][T14923] bond1: option mode: unable to set because the bond device has slaves [ 312.905760][T14930] openvswitch: netlink: push_nsh: missing base or metadata attributes [ 313.015867][T14923] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 313.272273][T14947] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2282'. [ 313.272410][T14947] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2282'. [ 313.272579][T14947] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2282'. [ 313.272742][T14947] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2282'. [ 313.272930][T14947] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2282'. [ 313.273122][T14947] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2282'. [ 313.273298][T14947] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2282'. [ 313.273473][T14947] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2282'. [ 313.273637][T14947] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2282'. [ 313.426061][T14948] bond13: option tlb_dynamic_lb: invalid value (255) [ 313.428683][T14948] bond13 (unregistering): Released all slaves [ 313.559804][T14951] xfrm0: entered promiscuous mode [ 313.559843][T14951] xfrm0: entered allmulticast mode [ 313.612900][ T7488] smbdirect: ib_dev[s`z1] removed [ 313.643169][ T9] infiniband s`z1: ib_query_port failed (-19) [ 314.162188][T14975] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 314.203330][T14975] batman_adv: batadv0: Adding interface: veth0 [ 314.203350][T14975] batman_adv: batadv0: The MTU of interface veth0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 314.203477][T14975] batman_adv: batadv0: Interface activated: veth0 [ 314.206892][T14975] batman_adv: batadv0: Interface deactivated: veth0 [ 314.206911][T14975] batman_adv: batadv0: Removing interface: veth0 [ 314.266890][T14977] bond1: option mode: unable to set because the bond device has slaves [ 314.268048][T14977] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 315.223309][ T31] audit: type=1804 audit(1793461103.671:8): pid=15024 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.1.2301" name="/newroot/421/cgroup.controllers" dev="tmpfs" ino=2159 res=1 errno=0 [ 315.238563][ T31] audit: type=1800 audit(1793461103.691:9): pid=15024 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.2301" name="cgroup.controllers" dev="tmpfs" ino=2159 res=0 errno=-22 [ 315.581626][T15044] netlink: 'syz.0.2305': attribute type 1 has an invalid length. [ 315.583217][T15043] netlink: 'syz.4.2306': attribute type 1 has an invalid length. [ 315.685188][T15044] 8021q: adding VLAN 0 to HW filter on device bond9 [ 315.757458][T15043] bond13: entered promiscuous mode [ 315.757998][T15043] 8021q: adding VLAN 0 to HW filter on device bond13 [ 315.790719][T15044] bond9: (slave geneve3): making interface the new active one [ 315.805311][T15044] bond9: (slave geneve3): Enslaving as an active interface with an up link [ 315.881311][T12154] netdevsim netdevsim0 netdevsim3: set [1, 1] type 2 family 0 port 6081 - 0 [ 315.881607][T12154] netdevsim netdevsim0 netdevsim2: set [1, 1] type 2 family 0 port 6081 - 0 [ 315.930551][T12154] netdevsim netdevsim0 netdevsim1: set [1, 1] type 2 family 0 port 6081 - 0 [ 315.930774][T12154] netdevsim netdevsim0 netdevsim0: set [1, 1] type 2 family 0 port 6081 - 0 [ 316.697574][T15087] block nbd1: server does not support multiple connections per device. [ 316.697937][T15087] block nbd1: shutting down sockets [ 329.604025][ C1] ip6_tunnel: ip6erspan0 xmit: Local address not yet configured! [ 354.860910][T16705] __nla_validate_parse: 63 callbacks suppressed [ 354.860932][T16705] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2321'. [ 354.938273][T16706] netlink: 'syz.2.2323': attribute type 1 has an invalid length. [ 355.006370][T16706] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2323'. [ 355.008441][T16706] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2323'. [ 355.008889][T16706] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2323'. [ 355.009660][T16706] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2323'. [ 355.016310][T16706] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2323'. [ 355.016999][T16706] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2323'. [ 355.297879][T16723] netlink: 96 bytes leftover after parsing attributes in process `syz.4.2327'. [ 355.301352][T16723] sctp: [Deprecated]: syz.4.2327 (pid 16723) Use of int in maxseg socket option. [ 355.301352][T16723] Use struct sctp_assoc_value instead [ 356.051745][T16738] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2331'. [ 356.102815][T16741] xt_CONNSECMARK: only valid in 'mangle' or 'security' table, not 'raw' [ 356.142623][T16738] team0: Port device team_slave_0 removed [ 356.521862][T16771] netlink: 'syz.4.2337': attribute type 1 has an invalid length. [ 356.521887][T16771] netlink: 224 bytes leftover after parsing attributes in process `syz.4.2337'. [ 356.566746][T16773] ksmbd: Daemon and kernel module version mismatch. ksmbd: 0, kernel module: 1. User-space ksmbd should terminate. [ 356.748577][T16778] bridge0: port 1(bridge_slave_0) entered disabled state [ 357.086054][T16785] bridge_slave_0: left allmulticast mode [ 357.086084][T16785] bridge_slave_0: left promiscuous mode [ 357.086337][T16785] bridge0: port 1(bridge_slave_0) entered disabled state [ 357.160700][T16786] bridge_slave_1: left allmulticast mode [ 357.160726][T16786] bridge_slave_1: left promiscuous mode [ 357.160955][T16786] bridge0: port 2(bridge_slave_1) entered disabled state [ 357.462332][T16790] 8021q: adding VLAN 0 to HW filter on device team0 [ 357.671158][T16790] veth1_vlan: left promiscuous mode [ 357.676513][T16790] veth0_vlan: left promiscuous mode [ 357.679898][T16790] veth0_vlan: entered promiscuous mode [ 357.695491][T16790] veth1_vlan: entered promiscuous mode [ 357.708994][T16790] veth1_macvtap: left promiscuous mode [ 357.712630][T16790] veth0_macvtap: left promiscuous mode [ 357.720002][T16790] veth0_macvtap: entered promiscuous mode [ 357.723421][T16790] veth1_macvtap: entered promiscuous mode [ 357.847195][T16790] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 357.888633][T16790] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 357.893045][T16790] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 357.901646][T16790] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 358.067895][T16814] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 358.267898][T16790] 8021q: adding VLAN 0 to HW filter on device bond1 [ 358.460128][T16790] 8021q: adding VLAN 0 to HW filter on device bond5 [ 358.473526][T16790] geneve0: entered promiscuous mode [ 358.507622][T16790] 8021q: adding VLAN 0 to HW filter on device bond6 [ 358.513216][T16790] 8021q: adding VLAN 0 to HW filter on device bond7 [ 358.533858][T16790] 8021q: adding VLAN 0 to HW filter on device bond8 [ 358.534889][T16790] bond8: entered allmulticast mode [ 358.534908][T16790] bridge4: entered allmulticast mode [ 358.535561][T16790] 8021q: adding VLAN 0 to HW filter on device macvtap2 [ 358.536948][T16790] 8021q: adding VLAN 0 to HW filter on device macvtap3 [ 358.538188][T16790] bridge4: entered promiscuous mode [ 358.566707][ T3019] bridge0: port 1(bridge_slave_0) entered blocking state [ 358.566842][ T3019] bridge0: port 1(bridge_slave_0) entered forwarding state [ 358.590098][ T3019] bridge0: port 2(bridge_slave_1) entered blocking state [ 358.590230][ T3019] bridge0: port 2(bridge_slave_1) entered forwarding state [ 361.922946][ T5754] syz2: Port: 1 Link ACTIVE [ 361.991061][T12154] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 362.004994][T12154] ip6_tunnel: syztnl0 xmit: Local address not yet configured! [ 362.066738][T12154] ip6_tunnel: ip6erspan0 xmit: Local address not yet configured! [ 362.123244][ T5754] ip6_tunnel: ip6erspan0 xmit: Local address not yet configured! [ 362.197381][T16835] netlink: 'syz.2.2352': attribute type 1 has an invalid length. [ 362.327565][T16843] netlink: 'syz.2.2352': attribute type 21 has an invalid length. [ 362.327588][T16843] __nla_validate_parse: 2 callbacks suppressed [ 362.327599][T16843] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2352'. [ 362.327765][T16850] netlink: 'syz.2.2352': attribute type 21 has an invalid length. [ 362.327780][T16850] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2352'. [ 362.386284][ T24] ip6_tunnel: ip6erspan0 xmit: Local address not yet configured! [ 362.393210][T16835] 8021q: adding VLAN 0 to HW filter on device bond6 [ 362.397201][T16854] netlink: 'syz.2.2352': attribute type 10 has an invalid length. [ 362.397224][T16854] netlink: 40 bytes leftover after parsing attributes in process `syz.2.2352'. [ 362.443215][T16836] bond6: (slave dummy0): making interface the new active one [ 362.455844][T16836] bond6: (slave dummy0): Enslaving as an active interface with an up link [ 362.456120][T16843] netlink: 1 bytes leftover after parsing attributes in process `syz.2.2352'. [ 362.456860][T16850] netlink: 1 bytes leftover after parsing attributes in process `syz.2.2352'. [ 362.459550][T16854] dummy0: entered promiscuous mode [ 362.507437][T16854] bond6: (slave dummy0): Releasing active interface [ 362.602195][T16849] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2355'. [ 362.710747][T16863] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2357'. [ 363.129550][ T165] ip6_tunnel: ip6erspan0 xmit: Local address not yet configured! [ 363.133557][ T165] ip6_tunnel: ip6erspan0 xmit: Local address not yet configured! [ 363.930472][ T195] ip6_tunnel: ip6erspan0 xmit: Local address not yet configured! [ 363.943018][T16899] TCP: TCP_TX_DELAY enabled [ 363.943658][T16899] caif0: tun_chr_ioctl cmd 2147767507 [ 364.212155][T16913] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2369'. [ 364.393123][T16924] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2375'. [ 365.460271][T16966] netlink: 20 bytes leftover after parsing attributes in process `syz.4.2381'. [ 365.577697][T16957] ipvlan1: entered promiscuous mode [ 365.585315][T16957] ipvlan1: left promiscuous mode [ 365.657966][T16973] A link change request failed with some changes committed already. Interface syz_tun may have been left with an inconsistent configuration, please check. [ 365.763923][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 366.277535][T16966] Bluetooth: hci4: Opcode 0x0401 failed: -4 [ 366.324379][ C1] ip6_tunnel: syztnl0 xmit: Local address not yet configured! [ 366.551005][T17004] The dccp option matching is deprecated and scheduled to be removed in 2027. [ 366.551005][T17004] Please contact the netfilter-devel mailing list or update your nftables rules. [ 366.655258][T17007] lo: entered promiscuous mode [ 366.655449][T17007] tunl0: entered promiscuous mode [ 366.655714][T17007] gre0: entered promiscuous mode [ 366.686395][T17007] 0ªX¹¦Dö»: entered promiscuous mode [ 366.756635][T17007] ip_vti0: entered promiscuous mode [ 366.771840][T17007] ip6_vti0: entered promiscuous mode [ 366.797988][T17007] sit0: entered promiscuous mode [ 366.858606][T17007] ip6tnl0: entered promiscuous mode [ 366.878739][T17007] ip6gre0: entered promiscuous mode [ 366.907296][T17007] ip6gretap0: entered promiscuous mode [ 366.907655][T17007] bridge0: port 2(bridge_slave_1) entered disabled state [ 366.908509][T17007] bridge0: port 1(bridge_slave_0) entered disabled state [ 366.925153][T17007] bridge0: entered promiscuous mode [ 366.968653][T17007] vcan0: entered promiscuous mode [ 366.981645][T17007] nlmon0: entered promiscuous mode [ 366.993652][T17007] veth0: entered promiscuous mode [ 367.009102][T17007] veth1: entered promiscuous mode [ 367.019900][T17007] wg0: entered promiscuous mode [ 367.037752][T17007] wg2: entered promiscuous mode [ 367.042534][T17007] veth0_to_bridge: entered promiscuous mode [ 367.081637][T17007] veth1_to_bridge: entered promiscuous mode [ 367.103417][T17007] veth0_to_bond: entered promiscuous mode [ 367.119420][T17007] bond_slave_0: entered promiscuous mode [ 367.119770][T17007] veth1_to_bond: entered promiscuous mode [ 367.130551][T17007] bond_slave_1: entered promiscuous mode [ 367.136973][T17007] veth1_to_team: entered promiscuous mode [ 367.150175][T17007] team_slave_1: entered promiscuous mode [ 367.150509][T17007] veth0_to_batadv: entered promiscuous mode [ 367.169624][T17007] batadv_slave_0: entered promiscuous mode [ 367.183216][T17007] veth1_to_batadv: entered promiscuous mode [ 367.193701][T17007] batadv_slave_1: entered promiscuous mode [ 367.197528][T17007] veth0_to_hsr: entered promiscuous mode [ 367.203213][T17007] veth1_to_hsr: entered promiscuous mode [ 367.231112][T17007] hsr0: entered promiscuous mode [ 367.239928][T17007] veth1_virt_wifi: entered promiscuous mode [ 367.242923][T17007] veth0_virt_wifi: entered promiscuous mode [ 367.258171][T17007] virt_wifi0: entered promiscuous mode [ 367.270418][T17007] vlan0: entered promiscuous mode [ 367.280188][T17007] vlan1: entered promiscuous mode [ 367.283511][T17007] macvlan1: entered promiscuous mode [ 367.310875][T17007] ipvlan1: entered promiscuous mode [ 367.311184][T17007] veth1_macvtap: entered promiscuous mode [ 367.337050][T17007] macvtap0: entered promiscuous mode [ 367.350517][T17007] geneve0: entered promiscuous mode [ 367.368726][T17007] geneve1: entered promiscuous mode [ 367.412320][T17007] netdevsim netdevsim4 netdevsim0: entered promiscuous mode [ 367.437544][T17007] netdevsim netdevsim4 netdevsim1: entered promiscuous mode [ 367.444331][ C0] ip6_tunnel: ip6erspan0 xmit: Local address not yet configured! [ 367.473654][T17007] netdevsim netdevsim4 netdevsim2: entered promiscuous mode [ 367.513661][T17007] netdevsim netdevsim4 netdevsim3: entered promiscuous mode [ 367.524951][ T5638] Bluetooth: hci4: command 0x0406 tx timeout [ 367.561192][T17007] mac80211_hwsim hwsim10 wlan0: entered promiscuous mode [ 367.572193][T17007] mac80211_hwsim hwsim11 wlan1: entered promiscuous mode [ 367.572386][T17007] macvlan2: entered promiscuous mode [ 367.573009][T17007] bridge1: entered promiscuous mode [ 367.593321][T17007] mac80211_hwsim hwsim13 wlan2: entered promiscuous mode [ 367.593518][T17007] mac80211_hwsim hwsim10 veth1_to_bod: entered promiscuous mode [ 367.593660][T17007] bond1: entered promiscuous mode [ 367.597546][T17007] ip6tnl1: entered promiscuous mode [ 367.597681][T17007] mac80211_hwsim hwsim15 wlan3: entered promiscuous mode [ 367.601627][T17007] mac80211_hwsim hwsim19 wlan4: entered promiscuous mode [ 367.601829][T17007] vx0: entered promiscuous mode [ 367.601952][T17007] mac80211_hwsim hwsim26 wlan5: entered promiscuous mode [ 367.602093][T17007] bond2: entered promiscuous mode [ 367.602222][T17007] vxlan0: entered promiscuous mode [ 367.602332][T17007] erspan1: entered promiscuous mode [ 367.602449][T17007] mac80211_hwsim hwsim27 wlan6: entered promiscuous mode [ 367.602949][T17007] geneve2: entered promiscuous mode [ 367.622068][T17007] bond3: entered promiscuous mode [ 367.622236][T17007] mac80211_hwsim hwsim30 wlan7: entered promiscuous mode [ 367.622384][T17007] dvmrp0: entered promiscuous mode [ 367.622505][T17007] mac80211_hwsim hwsim32 wlan8: entered promiscuous mode [ 367.712196][T17007] bond4: entered promiscuous mode [ 367.712219][T17007] bond5: entered promiscuous mode [ 367.748287][T17007] bond6: entered promiscuous mode [ 367.748448][T17007] bond7: entered promiscuous mode [ 367.757019][T17007] vlan2: entered promiscuous mode [ 367.757322][T17007] mac80211_hwsim hwsim34 wlan9: entered promiscuous mode [ 367.757469][T17007] syztnl1: entered promiscuous mode [ 367.761053][T17007] sit1: entered promiscuous mode [ 367.770554][T17026] __nla_validate_parse: 4 callbacks suppressed [ 367.770573][T17026] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2395'. [ 367.876730][T17007] mac80211_hwsim hwsim35 wlan10: entered promiscuous mode [ 367.893300][T17007] bond10: entered promiscuous mode [ 367.901969][T17007] bond11: entered promiscuous mode [ 367.902791][T17007] ip6gretap1: entered promiscuous mode [ 367.903065][T17007] gre1: entered promiscuous mode [ 367.908853][T17007] mac80211_hwsim hwsim40 wlan11: entered promiscuous mode [ 367.909027][T17007] macvlan0: entered promiscuous mode [ 367.938592][T17007] mac80211_hwsim hwsim51 wlan12: entered promiscuous mode [ 367.938790][T17007] mac80211_hwsim hwsim53 wlan13: entered promiscuous mode [ 367.948469][T17007] bond12: entered promiscuous mode [ 367.948490][T17007] geneve3: entered promiscuous mode [ 367.961563][T17007] mac80211_hwsim hwsim55 wlan14: entered promiscuous mode [ 367.961738][T17007] ip6gre1: entered promiscuous mode [ 367.961859][T17007] ip6erspan0: entered promiscuous mode [ 367.997631][T17007] syztnl0: entered promiscuous mode [ 367.999114][T17007] sit2: entered promiscuous mode [ 368.072169][T17007] wireguard1: entered promiscuous mode [ 368.074284][ T7488] netdevsim netdevsim4 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 368.074318][ T7488] netdevsim netdevsim4 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 368.074341][ T7488] netdevsim netdevsim4 netdevsim0: unset [1, 1] type 2 family 0 port 20000 - 0 [ 368.076060][ T3019] netdevsim netdevsim4 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 368.076089][ T3019] netdevsim netdevsim4 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 368.076119][ T3019] netdevsim netdevsim4 netdevsim1: unset [1, 1] type 2 family 0 port 20000 - 0 [ 368.076173][ T3019] netdevsim netdevsim4 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 368.076197][ T3019] netdevsim netdevsim4 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 368.076216][ T3019] netdevsim netdevsim4 netdevsim2: unset [1, 1] type 2 family 0 port 20000 - 0 [ 368.076250][ T3019] netdevsim netdevsim4 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 368.076273][ T3019] netdevsim netdevsim4 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 368.076296][ T3019] netdevsim netdevsim4 netdevsim3: unset [1, 1] type 2 family 0 port 20000 - 0 [ 368.203009][T17018] syzkaller0: entered promiscuous mode [ 368.203035][T17018] syzkaller0: entered allmulticast mode [ 368.272016][T17034] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2397'. [ 368.272050][T17034] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2397'. [ 368.284639][T17028] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2396'. [ 368.284673][T17028] netlink: 16 bytes leftover after parsing attributes in process `syz.0.2396'. [ 368.442539][T17038] netlink: 452 bytes leftover after parsing attributes in process `syz.3.2398'. [ 368.998081][T17053] bond10: option tlb_dynamic_lb: mode dependency failed, not supported in mode balance-rr(0) [ 369.017993][T17053] bond10 (unregistering): Released all slaves [ 369.750704][T17093] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2410'. [ 369.750742][T17093] netlink: 'syz.1.2410': attribute type 5 has an invalid length. [ 369.934731][T17105] netlink: 104 bytes leftover after parsing attributes in process `syz.4.2414'. [ 370.172468][T17113] netlink: 76 bytes leftover after parsing attributes in process `syz.0.2418'. [ 370.172495][T17113] netlink: 76 bytes leftover after parsing attributes in process `syz.0.2418'. [ 370.538193][T17143] bond1: option mode: unable to set because the bond device has slaves [ 370.538793][T17143] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 370.724854][ T5645] Bluetooth: hci4: command 0x0406 tx timeout [ 370.867078][T17157] netlink: 'syz.1.2429': attribute type 6 has an invalid length. [ 370.867111][T17157] netlink: 'syz.1.2429': attribute type 6 has an invalid length. [ 371.983306][T17207] bridge0: left allmulticast mode [ 372.052497][T17204] bond1: option mode: unable to set because the bond device has slaves [ 372.085666][T17204] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 372.260446][T17221] netlink: zone id is out of range [ 372.260819][T17221] netlink: zone id is out of range [ 372.260852][T17221] netlink: zone id is out of range [ 372.260976][T17221] netlink: zone id is out of range [ 372.261173][T17221] netlink: zone id is out of range [ 372.261331][T17221] netlink: zone id is out of range [ 372.263223][T17221] netlink: zone id is out of range [ 372.263421][T17221] netlink: zone id is out of range [ 372.263571][T17221] netlink: zone id is out of range [ 372.643141][T17234] bond9: option arp_interval: mode dependency failed, not supported in mode 802.3ad(4) [ 372.669053][T17234] bond9 (unregistering): Released all slaves [ 372.862926][T17252] __nla_validate_parse: 5 callbacks suppressed [ 372.862950][T17252] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2448'. [ 373.124055][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 373.821073][T17287] gretap1: entered promiscuous mode [ 373.914485][T17295] FAULT_INJECTION: forcing a failure. [ 373.914485][T17295] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 373.914521][T17295] CPU: 0 UID: 0 PID: 17295 Comm: syz.2.2459 Not tainted syzkaller #0 PREEMPT(full) [ 373.914544][T17295] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 373.914559][T17295] Call Trace: [ 373.914566][T17295] [ 373.914574][T17295] dump_stack_lvl+0xe8/0x150 [ 373.914610][T17295] should_fail_ex+0x3eb/0x540 [ 373.914637][T17295] _copy_from_user+0x2d/0xb0 [ 373.914668][T17295] __sys_bpf+0x2e7/0xe00 [ 373.914697][T17295] ? __pfx___sys_bpf+0x10/0x10 [ 373.914725][T17295] ? __fget_files+0x2a/0x420 [ 373.914762][T17295] ? ksys_write+0x242/0x270 [ 373.914789][T17295] ? __pfx_ksys_write+0x10/0x10 [ 373.914819][T17295] __x64_sys_bpf+0xba/0xd0 [ 373.914849][T17295] do_syscall_64+0x166/0x520 [ 373.914871][T17295] ? trace_irq_disable+0x3b/0x140 [ 373.914895][T17295] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 373.914913][T17295] ? clear_bhb_loop+0x70/0xc0 [ 373.914936][T17295] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 373.914960][T17295] RIP: 0033:0x7fe16639f559 [ 373.914979][T17295] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 373.914996][T17295] RSP: 002b:00007fe16726b028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 373.915017][T17295] RAX: ffffffffffffffda RBX: 00007fe166625fa0 RCX: 00007fe16639f559 [ 373.915032][T17295] RDX: 0000000000000050 RSI: 0000200000000f00 RDI: 000000000000000a [ 373.915045][T17295] RBP: 00007fe16726b090 R08: 0000000000000000 R09: 0000000000000000 [ 373.915058][T17295] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 373.915069][T17295] R13: 00007fe166626038 R14: 00007fe166625fa0 R15: 00007ffd11946458 [ 373.915103][T17295] [ 374.257249][T17298] netlink: 124 bytes leftover after parsing attributes in process `syz.3.2460'. [ 374.378640][T17297] syzkaller1: entered promiscuous mode [ 374.378666][T17297] syzkaller1: entered allmulticast mode [ 374.487103][T17317] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 374.713106][T17330] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2465'. [ 375.045488][ C1] ip6_tunnel: syztnl0 xmit: Local address not yet configured! [ 375.210054][T17351] block nbd1: shutting down sockets [ 375.278742][T17358] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2471'. [ 376.089954][T17390] xt_TPROXY: Can be used only with -p tcp or -p udp [ 376.173012][T17396] syz.1.2480: vmalloc error: size 8589938688, exceeds total pages, mode:0x400dc0(GFP_KERNEL_ACCOUNT|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 376.173309][T17396] CPU: 0 UID: 0 PID: 17396 Comm: syz.1.2480 Not tainted syzkaller #0 PREEMPT(full) [ 376.173333][T17396] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 376.173345][T17396] Call Trace: [ 376.173354][T17396] [ 376.173372][T17396] dump_stack_lvl+0xe8/0x150 [ 376.173412][T17396] warn_alloc+0x24d/0x270 [ 376.173436][T17396] ? stack_depot_save_flags+0x33/0x810 [ 376.173469][T17396] ? __pfx_warn_alloc+0x10/0x10 [ 376.173490][T17396] ? kasan_save_track+0x4f/0x80 [ 376.173517][T17396] ? __kasan_kmalloc+0x93/0xb0 [ 376.173544][T17396] ? xsk_init_queue+0x8a/0xe0 [ 376.173563][T17396] ? xsk_setsockopt+0x52a/0x960 [ 376.173583][T17396] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 376.173618][T17396] __vmalloc_node_range_noprof+0x12c/0x16f0 [ 376.173673][T17396] ? rcu_is_watching+0x16/0xb0 [ 376.173710][T17396] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 376.173730][T17396] ? __kmalloc_cache_noprof+0x31c/0x600 [ 376.173753][T17396] ? __kmalloc_cache_noprof+0x148/0x600 [ 376.173776][T17396] ? xskq_create+0x56/0x220 [ 376.173803][T17396] xskq_create+0x148/0x220 [ 376.173825][T17396] ? xsk_init_queue+0x8a/0xe0 [ 376.173849][T17396] xsk_init_queue+0x8a/0xe0 [ 376.173871][T17396] xsk_setsockopt+0x52a/0x960 [ 376.173895][T17396] ? __pfx_xsk_setsockopt+0x10/0x10 [ 376.173916][T17396] ? __pfx_aa_sk_perm+0x10/0x10 [ 376.173959][T17396] ? bpf_lsm_socket_setsockopt+0x9/0x20 [ 376.173986][T17396] ? __pfx_xsk_setsockopt+0x10/0x10 [ 376.174009][T17396] do_sock_setsockopt+0x17c/0x1b0 [ 376.174036][T17396] __x64_sys_setsockopt+0x13d/0x1b0 [ 376.174063][T17396] do_syscall_64+0x166/0x520 [ 376.174087][T17396] ? trace_irq_disable+0x3b/0x140 [ 376.174116][T17396] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 376.174138][T17396] ? clear_bhb_loop+0x70/0xc0 [ 376.174163][T17396] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 376.174183][T17396] RIP: 0033:0x7fc04a39f559 [ 376.174202][T17396] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 376.174221][T17396] RSP: 002b:00007fc04b24e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 376.174242][T17396] RAX: ffffffffffffffda RBX: 00007fc04a625fa0 RCX: 00007fc04a39f559 [ 376.174258][T17396] RDX: 0000000000000006 RSI: 000000000000011b RDI: 0000000000000003 [ 376.174271][T17396] RBP: 00007fc04a436b50 R08: 0000000000000004 R09: 0000000000000000 [ 376.174286][T17396] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000000 [ 376.174299][T17396] R13: 00007fc04a626038 R14: 00007fc04a625fa0 R15: 00007ffd5440c0a8 [ 376.174335][T17396] [ 376.290831][T17396] Mem-Info: [ 376.290847][T17396] active_anon:5886 inactive_anon:0 isolated_anon:0 [ 376.290847][T17396] active_file:2 inactive_file:43812 isolated_file:0 [ 376.290847][T17396] unevictable:0 dirty:472 writeback:0 [ 376.290847][T17396] slab_reclaimable:12429 slab_unreclaimable:115891 [ 376.290847][T17396] mapped:29978 shmem:523 pagetables:1293 [ 376.290847][T17396] sec_pagetables:0 bounce:0 [ 376.290847][T17396] kernel_misc_reclaimable:0 [ 376.290847][T17396] free:1258115 free_pcp:12718 free_cma:0 [ 376.290912][T17396] Node 0 active_anon:23544kB inactive_anon:0kB active_file:8kB inactive_file:175044kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:119912kB dirty:1888kB writeback:0kB shmem:2092kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:14364kB pagetables:5048kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 376.290970][T17396] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:0kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:32kB pagetables:124kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 376.291015][T17396] Node 0 DMA free:15360kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 376.291071][T17396] lowmem_reserve[]: 0 2463 2465 2465 2465 [ 376.291106][T17396] Node 0 DMA32 free:1076452kB boost:0kB min:33936kB low:42420kB high:50904kB reserved_highatomic:0kB free_highatomic:0kB active_anon:23544kB inactive_anon:0kB active_file:8kB inactive_file:175044kB unevictable:0kB writepending:1888kB zspages:0kB present:3129332kB managed:2523120kB mlocked:0kB bounce:0kB free_pcp:50868kB local_pcp:26432kB free_cma:0kB [ 376.291169][T17396] lowmem_reserve[]: 0 0 1 1 1 [ 376.291202][T17396] Node 0 Normal free:0kB boost:0kB min:20kB low:24kB high:28kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:1660kB mlocked:0kB bounce:0kB free_pcp:4kB local_pcp:0kB free_cma:0kB [ 376.291258][T17396] lowmem_reserve[]: 0 0 0 0 0 [ 376.291298][T17396] Node 1 Normal free:3940648kB boost:0kB min:55940kB low:69924kB high:83908kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:0kB writepending:0kB zspages:0kB present:4194300kB managed:4111104kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 376.291360][T17396] lowmem_reserve[]: 0 0 0 0 0 [ 376.291395][T17396] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 376.291517][T17396] Node 0 DMA32: 2555*4kB (UME) 958*8kB (UM) 410*16kB (UM) 181*32kB (UM) 170*64kB (UM) 102*128kB (UM) 59*256kB (UM) 3*512kB (M) 18*1024kB (UME) 2*2048kB (UM) 240*4096kB (UM) = 1076380kB [ 376.291674][T17396] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 376.291774][T17396] Node 1 Normal: 4*4kB (UM) 5*8kB (UM) 9*16kB (UM) 15*32kB (UM) 10*64kB (UM) 6*128kB (UM) 3*256kB (UM) 5*512kB (UM) 1*1024kB (M) 1*2048kB (U) 960*4096kB (M) = 3940648kB [ 376.311487][T17396] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 376.311505][T17396] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 376.311520][T17396] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 376.311536][T17396] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 376.311553][T17396] 44333 total pagecache pages [ 376.311575][T17396] 0 pages in swap cache [ 376.311583][T17396] Free swap = 124996kB [ 376.311590][T17396] Total swap = 124996kB [ 376.311599][T17396] 2097051 pages RAM [ 376.311606][T17396] 0 pages HighMem/MovableOnly [ 376.311614][T17396] 434240 pages reserved [ 376.311621][T17396] 0 pages cma reserved [ 376.847678][T17405] bond0: up delay (5) is not a multiple of miimon (4), value rounded to 4 ms [ 376.965019][ C0] ip6_tunnel: ip6erspan0 xmit: Local address not yet configured! [ 377.800429][T17441] net_ratelimit: 38 callbacks suppressed [ 377.800452][T17441] netlink: set zone limit has 4 unknown bytes [ 377.851689][T17445] FAULT_INJECTION: forcing a failure. [ 377.851689][T17445] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 377.851723][T17445] CPU: 1 UID: 0 PID: 17445 Comm: syz.0.2493 Not tainted syzkaller #0 PREEMPT(full) [ 377.851745][T17445] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 377.851757][T17445] Call Trace: [ 377.851765][T17445] [ 377.851773][T17445] dump_stack_lvl+0xe8/0x150 [ 377.851808][T17445] should_fail_ex+0x3eb/0x540 [ 377.851836][T17445] _copy_from_user+0x2d/0xb0 [ 377.851862][T17445] __sys_bpf+0x2e7/0xe00 [ 377.851888][T17445] ? __pfx___sys_bpf+0x10/0x10 [ 377.851920][T17445] ? __fget_files+0x2a/0x420 [ 377.851969][T17445] ? ksys_write+0x242/0x270 [ 377.851996][T17445] ? __pfx_ksys_write+0x10/0x10 [ 377.852026][T17445] __x64_sys_bpf+0xba/0xd0 [ 377.852056][T17445] do_syscall_64+0x166/0x520 [ 377.852077][T17445] ? trace_irq_disable+0x3b/0x140 [ 377.852103][T17445] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 377.852123][T17445] ? clear_bhb_loop+0x70/0xc0 [ 377.852148][T17445] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 377.852182][T17445] RIP: 0033:0x7f94de39f559 [ 377.852200][T17445] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 377.852217][T17445] RSP: 002b:00007f94df1ee028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 377.852238][T17445] RAX: ffffffffffffffda RBX: 00007f94de625fa0 RCX: 00007f94de39f559 [ 377.852253][T17445] RDX: 0000000000000010 RSI: 0000200000000540 RDI: 000000000000000a [ 377.852266][T17445] RBP: 00007f94df1ee090 R08: 0000000000000000 R09: 0000000000000000 [ 377.852279][T17445] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 377.852296][T17445] R13: 00007f94de626038 R14: 00007f94de625fa0 R15: 00007ffc90658518 [ 377.852328][T17445] [ 378.574850][T17476] bond9: option active_slave: mode dependency failed, not supported in mode broadcast(3) [ 378.581669][T17476] bond9 (unregistering): Released all slaves [ 378.945847][T17504] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2502'. [ 379.011246][T17507] netlink: set zone limit has 4 unknown bytes [ 379.206909][T17512] FAULT_INJECTION: forcing a failure. [ 379.206909][T17512] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 379.206937][T17512] CPU: 1 UID: 0 PID: 17512 Comm: syz.1.2507 Not tainted syzkaller #0 PREEMPT(full) [ 379.206957][T17512] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 379.206968][T17512] Call Trace: [ 379.206974][T17512] [ 379.206982][T17512] dump_stack_lvl+0xe8/0x150 [ 379.207018][T17512] should_fail_ex+0x3eb/0x540 [ 379.207045][T17512] _copy_to_user+0x31/0xb0 [ 379.207071][T17512] bpf_prog_test_run_syscall+0x343/0x4c0 [ 379.207105][T17512] ? __pfx_bpf_prog_test_run_syscall+0x10/0x10 [ 379.207131][T17512] ? __fget_files+0x2a/0x420 [ 379.207159][T17512] ? __pfx_bpf_prog_test_run_syscall+0x10/0x10 [ 379.207189][T17512] bpf_prog_test_run+0x2c5/0x340 [ 379.207213][T17512] __sys_bpf+0xb1e/0xe00 [ 379.207240][T17512] ? __pfx___sys_bpf+0x10/0x10 [ 379.207269][T17512] ? __fget_files+0x2a/0x420 [ 379.207309][T17512] ? ksys_write+0x242/0x270 [ 379.207336][T17512] ? __pfx_ksys_write+0x10/0x10 [ 379.207360][T17512] __x64_sys_bpf+0xba/0xd0 [ 379.207388][T17512] do_syscall_64+0x166/0x520 [ 379.207407][T17512] ? trace_irq_disable+0x3b/0x140 [ 379.207433][T17512] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 379.207452][T17512] ? clear_bhb_loop+0x70/0xc0 [ 379.207475][T17512] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 379.207493][T17512] RIP: 0033:0x7fc04a39f559 [ 379.207510][T17512] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 379.207535][T17512] RSP: 002b:00007fc04b24e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 379.207556][T17512] RAX: ffffffffffffffda RBX: 00007fc04a625fa0 RCX: 00007fc04a39f559 [ 379.207570][T17512] RDX: 0000000000000010 RSI: 0000200000000540 RDI: 000000000000000a [ 379.207583][T17512] RBP: 00007fc04b24e090 R08: 0000000000000000 R09: 0000000000000000 [ 379.207594][T17512] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 379.207606][T17512] R13: 00007fc04a626038 R14: 00007fc04a625fa0 R15: 00007ffd5440c0a8 [ 379.207640][T17512] [ 379.367145][T17517] FAULT_INJECTION: forcing a failure. [ 379.367145][T17517] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 379.367174][T17517] CPU: 0 UID: 0 PID: 17517 Comm: syz.4.2509 Not tainted syzkaller #0 PREEMPT(full) [ 379.367196][T17517] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 379.367207][T17517] Call Trace: [ 379.367214][T17517] [ 379.367223][T17517] dump_stack_lvl+0xe8/0x150 [ 379.367259][T17517] should_fail_ex+0x3eb/0x540 [ 379.367289][T17517] _copy_to_user+0x31/0xb0 [ 379.367316][T17517] simple_read_from_buffer+0xe1/0x170 [ 379.367345][T17517] proc_fail_nth_read+0x1bb/0x230 [ 379.367379][T17517] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 379.367412][T17517] ? rw_verify_area+0x24a/0x4c0 [ 379.367437][T17517] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 379.367466][T17517] vfs_read+0x213/0xa80 [ 379.367496][T17517] ? __pfx___mutex_lock+0x10/0x10 [ 379.367519][T17517] ? __pfx_vfs_read+0x10/0x10 [ 379.367544][T17517] ? __fget_files+0x2a/0x420 [ 379.367566][T17517] ? __fget_files+0x3a2/0x420 [ 379.367587][T17517] ? __fget_files+0x2a/0x420 [ 379.367613][T17517] ? fdget+0x1ac/0x250 [ 379.367650][T17517] ksys_read+0x150/0x270 [ 379.367676][T17517] ? __pfx_ksys_read+0x10/0x10 [ 379.367713][T17517] do_syscall_64+0x166/0x520 [ 379.367734][T17517] ? trace_irq_disable+0x3b/0x140 [ 379.367759][T17517] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 379.367779][T17517] ? clear_bhb_loop+0x70/0xc0 [ 379.367803][T17517] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 379.367822][T17517] RIP: 0033:0x7f81be75fd8e [ 379.367841][T17517] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 379.367856][T17517] RSP: 002b:00007f81bf5e2fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 379.367877][T17517] RAX: ffffffffffffffda RBX: 00007f81bf5e36c0 RCX: 00007f81be75fd8e [ 379.367891][T17517] RDX: 000000000000000f RSI: 00007f81bf5e30a0 RDI: 0000000000000004 [ 379.367903][T17517] RBP: 00007f81bf5e3090 R08: 0000000000000000 R09: 0000000000000000 [ 379.367915][T17517] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 379.367927][T17517] R13: 00007f81bea26038 R14: 00007f81bea25fa0 R15: 00007fffde6184a8 [ 379.367959][T17517] [ 379.990547][T17539] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2512'. [ 380.037935][T17543] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2517'. [ 380.037970][T17543] netlink: 'syz.3.2517': attribute type 10 has an invalid length. [ 380.037984][T17543] netlink: 32 bytes leftover after parsing attributes in process `syz.3.2517'. [ 380.270530][T17547] netlink: set zone limit has 4 unknown bytes [ 380.518041][T17565] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 380.859872][T17577] nbd: socks must be embedded in a SOCK_ITEM attr [ 381.647492][T17614] netlink: set zone limit has 4 unknown bytes [ 381.763240][T17624] netlink: 20 bytes leftover after parsing attributes in process `syz.1.2534'. [ 382.115183][T17641] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2538'. [ 382.115378][T17641] bridge_slave_0: entered promiscuous mode [ 382.116312][T17644] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2536'. [ 382.432248][T17653] tipc: Started in network mode [ 382.432316][T17653] tipc: Node identity 00000000000000000000000000000001, cluster identity 4711 [ 382.432374][T17653] tipc: Enabling of bearer rejected, failed to enable media [ 382.889410][T17672] netlink: set zone limit has 4 unknown bytes [ 383.025965][T17680] netlink: 36 bytes leftover after parsing attributes in process `syz.1.2549'. [ 383.454901][T17699] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2551'. [ 383.560267][T17703] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2553'. [ 384.010343][T17726] FAULT_INJECTION: forcing a failure. [ 384.010343][T17726] name failslab, interval 1, probability 0, space 0, times 0 [ 384.010380][T17726] CPU: 0 UID: 0 PID: 17726 Comm: syz.4.2555 Not tainted syzkaller #0 PREEMPT(full) [ 384.010406][T17726] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 384.010418][T17726] Call Trace: [ 384.010426][T17726] [ 384.010435][T17726] dump_stack_lvl+0xe8/0x150 [ 384.010470][T17726] should_fail_ex+0x3eb/0x540 [ 384.010500][T17726] should_failslab+0xa8/0x100 [ 384.010530][T17726] ? vm_area_alloc+0x24/0x140 [ 384.010550][T17726] kmem_cache_alloc_noprof+0x9c/0x600 [ 384.010575][T17726] ? vm_area_alloc+0x24/0x140 [ 384.010599][T17726] vm_area_alloc+0x24/0x140 [ 384.010621][T17726] mmap_region+0x18ff/0x2840 [ 384.010665][T17726] ? __lock_acquire+0x747/0x2de0 [ 384.010694][T17726] ? __pfx_mmap_region+0x10/0x10 [ 384.010725][T17726] ? __lock_acquire+0x747/0x2de0 [ 384.010847][T17726] ? arch_get_unmapped_area_topdown+0x269/0xc30 [ 384.010912][T17726] ? apparmor_capable+0x126/0x170 [ 384.010938][T17726] ? bpf_lsm_capable+0x9/0x20 [ 384.010955][T17726] ? security_capable+0x7e/0x2c0 [ 384.010984][T17726] ? shmem_mapping+0xd/0x50 [ 384.011003][T17726] ? memfd_check_seals_mmap+0x16f/0x220 [ 384.011028][T17726] do_mmap+0xe0a/0x1300 [ 384.011054][T17726] ? get_pid_task+0x20/0x1f0 [ 384.011084][T17726] ? __pfx_do_mmap+0x10/0x10 [ 384.011132][T17726] ? vm_mmap_pgoff+0x1ed/0x520 [ 384.011153][T17726] ? down_write_killable+0x179/0x230 [ 384.011182][T17726] ? __pfx_down_write_killable+0x10/0x10 [ 384.011207][T17726] ? apparmor_mmap_file+0x2e7/0x390 [ 384.011239][T17726] vm_mmap_pgoff+0x27a/0x520 [ 384.011270][T17726] ? __pfx_vm_mmap_pgoff+0x10/0x10 [ 384.011296][T17726] ? __fget_files+0x2a/0x420 [ 384.011323][T17726] ? __fget_files+0x3a2/0x420 [ 384.011345][T17726] ? __fget_files+0x2a/0x420 [ 384.011372][T17726] ksys_mmap_pgoff+0x4dc/0x760 [ 384.011408][T17726] do_syscall_64+0x166/0x520 [ 384.011429][T17726] ? trace_irq_disable+0x3b/0x140 [ 384.011455][T17726] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 384.011475][T17726] ? clear_bhb_loop+0x70/0xc0 [ 384.011499][T17726] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 384.011518][T17726] RIP: 0033:0x7f81be79f559 [ 384.011537][T17726] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 384.011553][T17726] RSP: 002b:00007f81bc9f6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 384.011574][T17726] RAX: ffffffffffffffda RBX: 00007f81bea26360 RCX: 00007f81be79f559 [ 384.011588][T17726] RDX: 0000000000000002 RSI: 0000000000b36000 RDI: 0000200000000000 [ 384.011600][T17726] RBP: 00007f81bc9f6090 R08: 0000000000000003 R09: 0000000000000000 [ 384.011611][T17726] R10: 0000000000022052 R11: 0000000000000246 R12: 0000000000000001 [ 384.011623][T17726] R13: 00007f81bea263f8 R14: 00007f81bea26360 R15: 00007fffde6184a8 [ 384.011655][T17726] [ 384.534230][T17734] __nla_validate_parse: 1 callbacks suppressed [ 384.534250][T17734] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2558'. [ 385.058451][T17758] netlink: 'syz.3.2560': attribute type 10 has an invalid length. [ 385.058474][T17758] netlink: 40 bytes leftover after parsing attributes in process `syz.3.2560'. [ 385.089495][T17758] dummy0: entered promiscuous mode [ 385.562869][T17778] IPVS: sync thread started: state = MASTER, mcast_ifn = tunl0, syncid = 2, id = 0 [ 385.671709][T17784] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2565'. [ 385.811863][T17780] netlink: 20 bytes leftover after parsing attributes in process `syz.0.2568'. [ 386.282868][T17818] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2572'. [ 386.338922][T17821] FAULT_INJECTION: forcing a failure. [ 386.338922][T17821] name failslab, interval 1, probability 0, space 0, times 0 [ 386.338953][T17821] CPU: 1 UID: 0 PID: 17821 Comm: syz.1.2572 Not tainted syzkaller #0 PREEMPT(full) [ 386.338975][T17821] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 386.338988][T17821] Call Trace: [ 386.338996][T17821] [ 386.339004][T17821] dump_stack_lvl+0xe8/0x150 [ 386.339043][T17821] should_fail_ex+0x3eb/0x540 [ 386.339072][T17821] should_failslab+0xa8/0x100 [ 386.339100][T17821] ? anon_vma_clone+0x3b1/0xa20 [ 386.339121][T17821] kmem_cache_alloc_noprof+0x9c/0x600 [ 386.339147][T17821] ? anon_vma_clone+0x3b1/0xa20 [ 386.339176][T17821] anon_vma_clone+0x3b1/0xa20 [ 386.339205][T17821] __split_vma+0x3e0/0xa90 [ 386.339233][T17821] ? mas_next_slot+0xc91/0xd70 [ 386.339256][T17821] ? __pfx___split_vma+0x10/0x10 [ 386.339291][T17821] ? mas_find+0x6d6/0xcb0 [ 386.339316][T17821] vms_gather_munmap_vmas+0x4e3/0x1370 [ 386.339357][T17821] ? __pfx_vms_gather_munmap_vmas+0x10/0x10 [ 386.339390][T17821] ? mas_walk+0x37e/0x490 [ 386.339420][T17821] mmap_region+0x95a/0x2840 [ 386.339466][T17821] ? __pfx_mmap_region+0x10/0x10 [ 386.339492][T17821] ? lock_acquire+0x115/0x350 [ 386.339534][T17821] ? process_measurement+0x7b2/0x1c10 [ 386.339563][T17821] ? up_write+0x19d/0x4a0 [ 386.339595][T17821] ? __lock_acquire+0x747/0x2de0 [ 386.339689][T17821] ? arch_get_unmapped_area_topdown+0x269/0xc30 [ 386.339736][T17821] ? __pfx_hook_capable+0x10/0x10 [ 386.339769][T17821] ? mm_get_unmapped_area+0xd3/0x100 [ 386.339799][T17821] ? apparmor_capable+0x126/0x170 [ 386.339825][T17821] ? bpf_lsm_capable+0x9/0x20 [ 386.339842][T17821] ? security_capable+0x7e/0x2c0 [ 386.339870][T17821] ? shmem_mapping+0xd/0x50 [ 386.339891][T17821] ? memfd_check_seals_mmap+0x16f/0x220 [ 386.339917][T17821] do_mmap+0xe0a/0x1300 [ 386.339945][T17821] ? get_pid_task+0x20/0x1f0 [ 386.339975][T17821] ? __pfx_do_mmap+0x10/0x10 [ 386.340018][T17821] ? vm_mmap_pgoff+0x1ed/0x520 [ 386.340041][T17821] ? down_write_killable+0x179/0x230 [ 386.340070][T17821] ? __pfx_down_write_killable+0x10/0x10 [ 386.340095][T17821] ? apparmor_mmap_file+0x2e7/0x390 [ 386.340127][T17821] vm_mmap_pgoff+0x27a/0x520 [ 386.340161][T17821] ? __pfx_vm_mmap_pgoff+0x10/0x10 [ 386.340187][T17821] ? __fget_files+0x2a/0x420 [ 386.340217][T17821] ? __fget_files+0x3a2/0x420 [ 386.340239][T17821] ? __fget_files+0x2a/0x420 [ 386.340267][T17821] ksys_mmap_pgoff+0x4dc/0x760 [ 386.340304][T17821] do_syscall_64+0x166/0x520 [ 386.340325][T17821] ? trace_irq_disable+0x3b/0x140 [ 386.340351][T17821] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 386.340373][T17821] ? clear_bhb_loop+0x70/0xc0 [ 386.340398][T17821] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 386.340419][T17821] RIP: 0033:0x7fc04a39f559 [ 386.340437][T17821] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 386.340454][T17821] RSP: 002b:00007fc04b1ca028 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 386.340474][T17821] RAX: ffffffffffffffda RBX: 00007fc04a626360 RCX: 00007fc04a39f559 [ 386.340489][T17821] RDX: 0000000000000002 RSI: 0000000000b36000 RDI: 0000200000000000 [ 386.340503][T17821] RBP: 00007fc04b1ca090 R08: 0000000000000003 R09: 0000000000000000 [ 386.340515][T17821] R10: 0000000000022052 R11: 0000000000000246 R12: 0000000000000001 [ 386.340528][T17821] R13: 00007fc04a6263f8 R14: 00007fc04a626360 R15: 00007ffd5440c0a8 [ 386.340563][T17821] [ 386.867592][T17828] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2575'. [ 387.207470][T17833] netlink: 'syz.0.2577': attribute type 70 has an invalid length. [ 387.259120][T17833] netlink: 7 bytes leftover after parsing attributes in process `syz.0.2577'. [ 387.280670][T17835] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2579'. [ 387.357136][T17842] nbd: must specify a device to reconfigure [ 387.412013][T17837] bridge2: entered promiscuous mode [ 387.412070][T17837] bridge2: entered allmulticast mode [ 387.844338][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 388.377990][T17881] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2590'. [ 388.387093][T17883] netlink: 16 bytes leftover after parsing attributes in process `syz.0.2588'. [ 388.448679][T17887] FAULT_INJECTION: forcing a failure. [ 388.448679][T17887] name failslab, interval 1, probability 0, space 0, times 0 [ 388.448710][T17887] CPU: 0 UID: 0 PID: 17887 Comm: syz.0.2588 Not tainted syzkaller #0 PREEMPT(full) [ 388.448732][T17887] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 388.448743][T17887] Call Trace: [ 388.448750][T17887] [ 388.448757][T17887] dump_stack_lvl+0xe8/0x150 [ 388.448791][T17887] should_fail_ex+0x3eb/0x540 [ 388.448824][T17887] should_failslab+0xa8/0x100 [ 388.448851][T17887] ? __anon_vma_prepare+0xbe/0x4a0 [ 388.448873][T17887] kmem_cache_alloc_noprof+0x9c/0x600 [ 388.448897][T17887] ? __anon_vma_prepare+0xbe/0x4a0 [ 388.448925][T17887] __anon_vma_prepare+0xbe/0x4a0 [ 388.448946][T17887] ? vma_has_anon_rmap+0x95/0x270 [ 388.448975][T17887] do_pte_missing+0x30a2/0x3570 [ 388.449015][T17887] ? mtree_range_walk+0x707/0x8b0 [ 388.449051][T17887] handle_mm_fault+0x1a53/0x3750 [ 388.449086][T17887] ? mt_find+0x186/0x630 [ 388.449120][T17887] ? handle_mm_fault+0xf1/0x3750 [ 388.449160][T17887] ? __pfx_handle_mm_fault+0x10/0x10 [ 388.449214][T17887] __get_user_pages+0x1670/0x2750 [ 388.449285][T17887] populate_vma_page_range+0x311/0x3f0 [ 388.449314][T17887] ? __pfx_populate_vma_page_range+0x10/0x10 [ 388.449340][T17887] ? down_read+0x2b9/0x320 [ 388.449361][T17887] ? rwsem_wake+0xe8/0x130 [ 388.449382][T17887] __mm_populate+0x25f/0x390 [ 388.449408][T17887] ? __pfx___mm_populate+0x10/0x10 [ 388.449442][T17887] vm_mmap_pgoff+0x36e/0x520 [ 388.449469][T17887] ? __pfx_vm_mmap_pgoff+0x10/0x10 [ 388.449493][T17887] ? __fget_files+0x2a/0x420 [ 388.449516][T17887] ? __fget_files+0x3a2/0x420 [ 388.449533][T17887] ? __fget_files+0x2a/0x420 [ 388.449556][T17887] ksys_mmap_pgoff+0x4dc/0x760 [ 388.449586][T17887] do_syscall_64+0x166/0x520 [ 388.449604][T17887] ? trace_irq_disable+0x3b/0x140 [ 388.449626][T17887] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 388.449643][T17887] ? clear_bhb_loop+0x70/0xc0 [ 388.449663][T17887] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 388.449679][T17887] RIP: 0033:0x7f94de39f559 [ 388.449695][T17887] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 388.449710][T17887] RSP: 002b:00007f94dc5f6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 388.449727][T17887] RAX: ffffffffffffffda RBX: 00007f94de626360 RCX: 00007f94de39f559 [ 388.449739][T17887] RDX: 0000000000000002 RSI: 0000000000b36000 RDI: 0000200000000000 [ 388.449750][T17887] RBP: 00007f94dc5f6090 R08: 0000000000000003 R09: 0000000000000000 [ 388.449761][T17887] R10: 0000000000022052 R11: 0000000000000246 R12: 0000000000000001 [ 388.449771][T17887] R13: 00007f94de6263f8 R14: 00007f94de626360 R15: 00007ffc90658518 [ 388.449798][T17887] [ 389.021040][T17905] netlink: 'syz.1.2595': attribute type 4 has an invalid length. [ 389.438518][T17913] lo: left promiscuous mode [ 389.614081][T17926] syzkaller0: entered promiscuous mode [ 389.614104][T17926] syzkaller0: entered allmulticast mode [ 389.644176][T17926] tipc: Enabled bearer , priority 0 [ 389.695012][T17926] tipc: Resetting bearer [ 389.937868][T17949] netlink: 'syz.0.2606': attribute type 5 has an invalid length. [ 389.970802][T17932] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 389.970828][T17932] Bluetooth: hci1: Error when powering off device on rfkill (-4) [ 390.088673][T17957] __nla_validate_parse: 1 callbacks suppressed [ 390.088692][T17957] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2607'. [ 390.088715][T17957] netlink: 'syz.1.2607': attribute type 10 has an invalid length. [ 390.088728][T17957] netlink: 32 bytes leftover after parsing attributes in process `syz.1.2607'. [ 390.372647][T17932] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 390.372683][T17932] Bluetooth: hci2: Error when powering off device on rfkill (-4) [ 390.417020][T17962] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2608'. [ 390.418276][T17932] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 390.418297][T17932] Bluetooth: hci3: Error when powering off device on rfkill (-4) [ 390.537829][T17932] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 390.537856][T17932] Bluetooth: hci4: Error when powering off device on rfkill (-4) [ 391.050596][T17987] bond1: (slave lo): Releasing backup interface [ 391.064861][T17987] bond1: (slave lo): last VLAN challenged slave left bond - VLAN blocking is removed [ 391.064919][T17987] lo: left promiscuous mode [ 391.065088][T17987] lo: left allmulticast mode [ 391.095619][T17987] syz_tun: left allmulticast mode [ 391.095836][T17987] bridge0: port 1(syz_tun) entered disabled state [ 391.122424][T17987] bond0: (slave bridge0): Releasing backup interface [ 391.166274][T17987] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 391.181547][T17988] team0: Mode changed to "broadcast" [ 391.488019][T18003] netlink: set zone limit has 4 unknown bytes [ 391.614927][T18006] bond7: option active_slave: mode dependency failed, not supported in mode broadcast(3) [ 391.622156][T18006] bond7 (unregistering): Released all slaves [ 391.689796][T18014] Bluetooth: hci0: invalid length 0, exp 2 for type 18 [ 391.774950][T18015] netlink: 337 bytes leftover after parsing attributes in process `syz.1.2616'. [ 391.830208][T18018] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2613'. [ 392.035817][T18030] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2619'. [ 392.036058][T18029] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2619'. [ 392.041236][T18029] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2619'. [ 392.209501][T18029] 8021q: adding VLAN 0 to HW filter on device bond7 [ 392.324481][ C1] ip6_tunnel: syztnl0 xmit: Local address not yet configured! [ 392.539798][ T31] audit: type=1800 audit(1793461180.991:10): pid=18051 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.2624" name="blkio.bfq.time_recursive" dev="tmpfs" ino=2760 res=0 errno=-22 [ 392.911652][T18069] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2628'. [ 393.477153][T18091] Bluetooth: hci0: invalid length 0, exp 2 for type 18 [ 393.556125][T18109] netlink: 337 bytes leftover after parsing attributes in process `syz.2.2635'. [ 393.603195][T18100] vlan0: entered promiscuous mode [ 393.603216][T18100] bridge0: entered promiscuous mode [ 393.804419][ T7488] netdevsim netdevsim4 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 393.805293][ T7488] netdevsim netdevsim4 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 393.805334][ T7488] netdevsim netdevsim4 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 393.805369][ T7488] netdevsim netdevsim4 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 393.900274][T18124] bond3: (slave lo): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 393.912885][T18124] bond3: (slave lo): Enslaving as an active interface with an up link [ 393.933586][T18124] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 394.244291][ C0] ip6_tunnel: ip6erspan0 xmit: Local address not yet configured! [ 394.244518][ C1] ip6_tunnel: ip6erspan0 xmit: Local address not yet configured! [ 395.418057][T18187] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 395.568086][T18193] syzkaller0: left promiscuous mode [ 395.568114][T18193] syzkaller0: left allmulticast mode [ 395.833938][T18199] netlink: 'syz.2.2653': attribute type 1 has an invalid length. [ 395.887060][T18210] netlink: 'syz.0.2654': attribute type 10 has an invalid length. [ 395.887084][T18210] __nla_validate_parse: 3 callbacks suppressed [ 395.887096][T18210] netlink: 55 bytes leftover after parsing attributes in process `syz.0.2654'. [ 395.889066][T18199] 8021q: adding VLAN 0 to HW filter on device bond8 [ 395.935941][T18212] netlink: 6 bytes leftover after parsing attributes in process `syz.3.2656'. [ 396.187435][T18218] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2655'. [ 396.270159][T18220] FAULT_INJECTION: forcing a failure. [ 396.270159][T18220] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 396.270192][T18220] CPU: 0 UID: 0 PID: 18220 Comm: syz.1.2655 Not tainted syzkaller #0 PREEMPT(full) [ 396.270212][T18220] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 396.270223][T18220] Call Trace: [ 396.270231][T18220] [ 396.270240][T18220] dump_stack_lvl+0xe8/0x150 [ 396.270274][T18220] should_fail_ex+0x3eb/0x540 [ 396.270303][T18220] prepare_alloc_pages+0x21e/0x5f0 [ 396.270335][T18220] __alloc_frozen_pages_noprof+0x17c/0x410 [ 396.270365][T18220] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 396.270395][T18220] ? __pfx_try_charge_memcg+0x10/0x10 [ 396.270430][T18220] ? policy_nodemask+0x31b/0x980 [ 396.270463][T18220] alloc_pages_mpol+0x21e/0x390 [ 396.270498][T18220] alloc_pages_noprof+0xb1/0x2b0 [ 396.270529][T18220] pte_alloc_one+0x22/0x370 [ 396.270560][T18220] __do_fault+0xd1/0x2a0 [ 396.270587][T18220] do_pte_missing+0xfc9/0x3570 [ 396.270620][T18220] ? mtree_range_walk+0x707/0x8b0 [ 396.270656][T18220] handle_mm_fault+0x1a53/0x3750 [ 396.270687][T18220] ? mt_find+0x186/0x630 [ 396.270722][T18220] ? handle_mm_fault+0xf1/0x3750 [ 396.270771][T18220] ? __pfx_handle_mm_fault+0x10/0x10 [ 396.270798][T18220] ? hrtimer_start_range_ns_common+0x7cd/0xb60 [ 396.270846][T18220] __get_user_pages+0x1670/0x2750 [ 396.270901][T18220] populate_vma_page_range+0x311/0x3f0 [ 396.270929][T18220] ? __pfx_populate_vma_page_range+0x10/0x10 [ 396.270957][T18220] ? down_read+0x2b9/0x320 [ 396.270980][T18220] ? preempt_schedule_thunk+0x16/0x40 [ 396.271020][T18220] __mm_populate+0x25f/0x390 [ 396.271048][T18220] ? __pfx___mm_populate+0x10/0x10 [ 396.271087][T18220] vm_mmap_pgoff+0x36e/0x520 [ 396.271118][T18220] ? __pfx_vm_mmap_pgoff+0x10/0x10 [ 396.271144][T18220] ? __fget_files+0x2a/0x420 [ 396.271172][T18220] ? __fget_files+0x3a2/0x420 [ 396.271194][T18220] ? __fget_files+0x2a/0x420 [ 396.271221][T18220] ksys_mmap_pgoff+0x4dc/0x760 [ 396.271257][T18220] do_syscall_64+0x166/0x520 [ 396.271279][T18220] ? trace_irq_disable+0x3b/0x140 [ 396.271305][T18220] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 396.271326][T18220] ? clear_bhb_loop+0x70/0xc0 [ 396.271350][T18220] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 396.271370][T18220] RIP: 0033:0x7fc04a39f559 [ 396.271390][T18220] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 396.271408][T18220] RSP: 002b:00007fc04b1ca028 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 396.271429][T18220] RAX: ffffffffffffffda RBX: 00007fc04a626360 RCX: 00007fc04a39f559 [ 396.271444][T18220] RDX: 0000000000000002 RSI: 0000000000b36000 RDI: 0000200000000000 [ 396.271457][T18220] RBP: 00007fc04b1ca090 R08: 0000000000000003 R09: 0000000000000000 [ 396.271469][T18220] R10: 0000000000022052 R11: 0000000000000246 R12: 0000000000000002 [ 396.271481][T18220] R13: 00007fc04a6263f8 R14: 00007fc04a626360 R15: 00007ffd5440c0a8 [ 396.271515][T18220] [ 396.607072][T18222] Bluetooth: hci0: invalid length 0, exp 2 for type 18 [ 396.618999][T18222] Cannot find map_set index 135 as target [ 396.681022][T18222] netlink: 337 bytes leftover after parsing attributes in process `syz.4.2657'. [ 396.945405][T18226] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2658'. [ 396.973406][T18212] netdevsim netdevsim3 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 396.973447][T18212] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 396.973478][T18212] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 1] type 2 family 0 port 20000 - 0 [ 397.082868][T18233] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2660'. [ 397.121729][T18233] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2660'. [ 397.197504][T18212] netdevsim netdevsim3 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 397.197542][T18212] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 397.197570][T18212] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 1] type 2 family 0 port 20000 - 0 [ 397.499781][T18212] netdevsim netdevsim3 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 397.499821][T18212] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 397.499848][T18212] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 1] type 2 family 0 port 20000 - 0 [ 397.568580][T18250] netlink: 60 bytes leftover after parsing attributes in process `syz.2.2663'. [ 397.571247][T18252] netlink: 60 bytes leftover after parsing attributes in process `syz.2.2663'. [ 397.643084][T18256] ipt_REJECT: TCP_RESET invalid for non-tcp [ 397.690529][T18212] netdevsim netdevsim3 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 397.690611][T18212] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 397.690639][T18212] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 1] type 2 family 0 port 20000 - 0 [ 397.930309][T18263] syzkaller0: left promiscuous mode [ 397.930333][T18263] syzkaller0: left allmulticast mode [ 398.069305][ T3019] netdevsim netdevsim3 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 398.069334][ T3019] netdevsim netdevsim3 eth1: set [1, 0] type 2 family 0 port 20000 - 0 [ 398.069351][ T3019] netdevsim netdevsim3 eth1: set [1, 1] type 2 family 0 port 6081 - 0 [ 398.085125][ T3019] netdevsim netdevsim3 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 398.085169][ T3019] netdevsim netdevsim3 eth0: set [1, 0] type 2 family 0 port 20000 - 0 [ 398.085209][ T3019] netdevsim netdevsim3 eth0: set [1, 1] type 2 family 0 port 6081 - 0 [ 398.203940][ T3019] netdevsim netdevsim3 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 398.203976][ T3019] netdevsim netdevsim3 eth3: set [1, 0] type 2 family 0 port 20000 - 0 [ 398.204001][ T3019] netdevsim netdevsim3 eth3: set [1, 1] type 2 family 0 port 6081 - 0 [ 398.204052][ T3019] netdevsim netdevsim3 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 398.204076][ T3019] netdevsim netdevsim3 eth2: set [1, 0] type 2 family 0 port 20000 - 0 [ 398.204107][ T3019] netdevsim netdevsim3 eth2: set [1, 1] type 2 family 0 port 6081 - 0 [ 398.222789][T18269] Bluetooth: hci0: invalid length 0, exp 2 for type 18 [ 398.228900][T18269] Cannot find map_set index 135 as target [ 398.342320][T18281] netlink: 337 bytes leftover after parsing attributes in process `syz.4.2669'. [ 400.147466][T18354] bond9: Unable to set up delay as MII monitoring is disabled [ 400.224531][T18357] netlink: 'syz.0.2684': attribute type 3 has an invalid length. [ 402.938265][T18354] bond9 (unregistering): Released all slaves [ 402.991131][T18352] bond1: option mode: unable to set because the bond device has slaves [ 402.991348][T18356] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 403.076571][T18375] Bluetooth: hci0: invalid length 0, exp 2 for type 18 [ 403.078670][T18375] Cannot find map_set index 135 as target [ 403.168541][T18378] __nla_validate_parse: 3 callbacks suppressed [ 403.168564][T18378] netlink: 337 bytes leftover after parsing attributes in process `syz.4.2686'. [ 403.346230][ T5754] bridge0: entered promiscuous mode [ 403.352953][T18379] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2687'. [ 403.373230][T18388] netlink: 'syz.0.2690': attribute type 1 has an invalid length. [ 403.383677][T18388] netlink: 28 bytes leftover after parsing attributes in process `syz.0.2690'. [ 403.399734][T18390] netlink: 52 bytes leftover after parsing attributes in process `syz.2.2688'. [ 403.422682][T18392] FAULT_INJECTION: forcing a failure. [ 403.422682][T18392] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 403.422718][T18392] CPU: 0 UID: 0 PID: 18392 Comm: syz.3.2687 Not tainted syzkaller #0 PREEMPT(full) [ 403.422765][T18392] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 403.422789][T18392] Call Trace: [ 403.422805][T18392] [ 403.422821][T18392] dump_stack_lvl+0xe8/0x150 [ 403.422858][T18392] should_fail_ex+0x3eb/0x540 [ 403.422888][T18392] prepare_alloc_pages+0x21e/0x5f0 [ 403.422922][T18392] __alloc_frozen_pages_noprof+0x17c/0x410 [ 403.422953][T18392] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 403.422988][T18392] ? policy_nodemask+0x31b/0x980 [ 403.423018][T18392] ? __lock_acquire+0x747/0x2de0 [ 403.423046][T18392] alloc_pages_mpol+0x21e/0x390 [ 403.423081][T18392] folio_alloc_mpol_noprof+0x39/0x160 [ 403.423113][T18392] vma_alloc_folio_noprof+0xe1/0x1e0 [ 403.423145][T18392] ? __pfx_vma_alloc_folio_noprof+0x10/0x10 [ 403.423182][T18392] ? vma_has_anon_rmap+0x95/0x270 [ 403.423212][T18392] do_pte_missing+0x559/0x3570 [ 403.423250][T18392] ? handle_mm_fault+0xf1/0x3750 [ 403.423284][T18392] handle_mm_fault+0x1a53/0x3750 [ 403.423325][T18392] ? handle_mm_fault+0xf1/0x3750 [ 403.423373][T18392] ? __pfx_handle_mm_fault+0x10/0x10 [ 403.423404][T18392] ? follow_page_pte+0x748/0xf10 [ 403.423442][T18392] ? __pfx_follow_page_pte+0x10/0x10 [ 403.423481][T18392] __get_user_pages+0x1670/0x2750 [ 403.423540][T18392] populate_vma_page_range+0x311/0x3f0 [ 403.423580][T18392] ? __pfx_populate_vma_page_range+0x10/0x10 [ 403.423619][T18392] ? down_read+0x2b9/0x320 [ 403.423649][T18392] __mm_populate+0x25f/0x390 [ 403.423678][T18392] ? __pfx___mm_populate+0x10/0x10 [ 403.423714][T18392] vm_mmap_pgoff+0x36e/0x520 [ 403.423739][T18392] ? __pfx_vm_mmap_pgoff+0x10/0x10 [ 403.423763][T18392] ? __fget_files+0x2a/0x420 [ 403.423789][T18392] ? __fget_files+0x3a2/0x420 [ 403.423811][T18392] ? __fget_files+0x2a/0x420 [ 403.423839][T18392] ksys_mmap_pgoff+0x4dc/0x760 [ 403.423876][T18392] do_syscall_64+0x166/0x520 [ 403.423898][T18392] ? trace_irq_disable+0x3b/0x140 [ 403.423924][T18392] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 403.423945][T18392] ? clear_bhb_loop+0x70/0xc0 [ 403.423970][T18392] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 403.423990][T18392] RIP: 0033:0x7f38b319f559 [ 403.424009][T18392] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 403.424027][T18392] RSP: 002b:00007f38b40b5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 403.424048][T18392] RAX: ffffffffffffffda RBX: 00007f38b3426270 RCX: 00007f38b319f559 [ 403.424063][T18392] RDX: 0000000000000002 RSI: 0000000000b36000 RDI: 0000200000000000 [ 403.424076][T18392] RBP: 00007f38b40b5090 R08: 0000000000000003 R09: 0000000000000000 [ 403.424089][T18392] R10: 0000000000022052 R11: 0000000000000246 R12: 0000000000000002 [ 403.424101][T18392] R13: 00007f38b3426308 R14: 00007f38b3426270 R15: 00007fff5ed75748 [ 403.424135][T18392] [ 403.872295][T18400] netlink: 'syz.2.2693': attribute type 1 has an invalid length. [ 403.872350][T18400] netlink: 244 bytes leftover after parsing attributes in process `syz.2.2693'. [ 404.030337][T18404] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2693'. [ 404.241773][T18406] bond3: option mode: unable to set because the bond device has slaves [ 404.271616][T18406] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 404.377475][T18404] xt_IDLETIMER: timeout value is zero [ 404.476934][T18428] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2697'. [ 404.606602][T18422] udevd[18422]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 404.626027][T18421] udevd[18421]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 404.791872][T18437] bond1: option mode: unable to set because the bond device is up [ 404.796814][T18437] bond1: (slave lo): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 404.818501][T18437] lo: entered promiscuous mode [ 404.818680][T18437] lo: entered allmulticast mode [ 404.822435][T18437] bond1: (slave lo): Enslaving as an active interface with an up link [ 404.831184][T18437] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 404.852519][T18442] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2699'. [ 405.183022][T18464] netlink: 20 bytes leftover after parsing attributes in process `syz.4.2704'. [ 405.200410][T18464] netlink: 20 bytes leftover after parsing attributes in process `syz.4.2704'. [ 405.221708][T18461] Bluetooth: hci0: invalid length 0, exp 2 for type 18 [ 405.232092][T18461] Cannot find map_set index 135 as target [ 405.775803][T18487] IPVS: Scheduler module ip_vs_mh not found [ 405.922782][T18498] syzkaller0: left promiscuous mode [ 405.922803][T18498] syzkaller0: left allmulticast mode [ 406.295673][T18517] ip_tables: iptables: counters copy to user failed while replacing table [ 406.367426][T18512] 8021q: adding VLAN 0 to HW filter on device bond9 [ 406.382930][T18520] bond1: option mode: unable to set because the bond device has slaves [ 406.396843][T18520] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 406.396886][T18520] FAULT_INJECTION: forcing a failure. [ 406.396886][T18520] name failslab, interval 1, probability 0, space 0, times 0 [ 406.396907][T18520] CPU: 1 UID: 0 PID: 18520 Comm: syz.4.2720 Not tainted syzkaller #0 PREEMPT(full) [ 406.396926][T18520] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 406.396937][T18520] Call Trace: [ 406.396943][T18520] [ 406.396950][T18520] dump_stack_lvl+0xe8/0x150 [ 406.396985][T18520] should_fail_ex+0x3eb/0x540 [ 406.397011][T18520] ? __alloc_skb+0x1db/0x7a0 [ 406.397038][T18520] should_failslab+0xa8/0x100 [ 406.397066][T18520] ? __alloc_skb+0x1db/0x7a0 [ 406.397091][T18520] kmem_cache_alloc_node_noprof+0x9c/0x600 [ 406.397114][T18520] ? __alloc_skb+0x18d/0x7a0 [ 406.397143][T18520] ? __alloc_skb+0x1db/0x7a0 [ 406.397178][T18520] __alloc_skb+0x1db/0x7a0 [ 406.397210][T18520] netlink_ack+0x136/0xb30 [ 406.397233][T18520] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 406.397254][T18520] ? __lock_acquire+0x747/0x2de0 [ 406.397290][T18520] netlink_rcv_skb+0x2a4/0x4a0 [ 406.397329][T18520] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 406.397350][T18520] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 406.397390][T18520] ? netlink_deliver_tap+0x2e/0x1b0 [ 406.397416][T18520] ? netlink_deliver_tap+0x2e/0x1b0 [ 406.397448][T18520] netlink_unicast+0x8ef/0xa80 [ 406.397490][T18520] netlink_sendmsg+0x7f0/0xb20 [ 406.397524][T18520] ? __pfx_netlink_sendmsg+0x10/0x10 [ 406.397555][T18520] ? aa_sock_msg_perm+0x144/0x210 [ 406.397580][T18520] ? apparmor_socket_sendmsg+0x98/0x360 [ 406.397609][T18520] ? __pfx_netlink_sendmsg+0x10/0x10 [ 406.397635][T18520] sock_sendmsg_nosec+0x14e/0x190 [ 406.397681][T18520] ____sys_sendmsg+0x54e/0x850 [ 406.397708][T18520] ? __pfx_____sys_sendmsg+0x10/0x10 [ 406.397739][T18520] ? import_iovec+0x73/0xa0 [ 406.397766][T18520] ___sys_sendmsg+0x2a5/0x360 [ 406.397786][T18520] ? __lock_acquire+0x747/0x2de0 [ 406.397812][T18520] ? __pfx____sys_sendmsg+0x10/0x10 [ 406.397864][T18520] ? __fget_files+0x3a2/0x420 [ 406.397886][T18520] ? __fget_files+0x2a/0x420 [ 406.397919][T18520] __x64_sys_sendmsg+0x1b1/0x290 [ 406.397943][T18520] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 406.397985][T18520] do_syscall_64+0x166/0x520 [ 406.398007][T18520] ? trace_irq_disable+0x3b/0x140 [ 406.398036][T18520] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 406.398057][T18520] ? clear_bhb_loop+0x70/0xc0 [ 406.398081][T18520] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 406.398100][T18520] RIP: 0033:0x7f81be79f559 [ 406.398119][T18520] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 406.398136][T18520] RSP: 002b:00007f81bf5e3028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 406.398156][T18520] RAX: ffffffffffffffda RBX: 00007f81bea25fa0 RCX: 00007f81be79f559 [ 406.398171][T18520] RDX: 0000000000000000 RSI: 0000200000000800 RDI: 0000000000000006 [ 406.398184][T18520] RBP: 00007f81bf5e3090 R08: 0000000000000000 R09: 0000000000000000 [ 406.398202][T18520] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 406.398213][T18520] R13: 00007f81bea26038 R14: 00007f81bea25fa0 R15: 00007fffde6184a8 [ 406.398246][T18520] [ 406.919000][T18525] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 406.942605][T18525] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 407.201648][T18536] x_tables: duplicate underflow at hook 2 [ 407.201726][T18536] x_tables: duplicate underflow at hook 2 [ 407.202282][T18536] x_tables: duplicate underflow at hook 2 [ 407.202359][T18536] x_tables: duplicate underflow at hook 2 [ 407.202427][T18536] x_tables: duplicate underflow at hook 2 [ 407.202494][T18536] x_tables: duplicate underflow at hook 2 [ 407.202559][T18536] x_tables: duplicate underflow at hook 2 [ 407.202622][T18536] x_tables: duplicate underflow at hook 2 [ 407.202691][T18536] x_tables: duplicate underflow at hook 2 [ 407.202776][T18536] x_tables: duplicate underflow at hook 2 [ 407.231009][T18539] mac80211_hwsim hwsim11 ..ãc¤±: renamed from wlan1 [ 407.321148][T18546] netlink: 'syz.0.2727': attribute type 10 has an invalid length. [ 407.338455][ T31] audit: type=1804 audit(1793461195.791:11): pid=18547 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.2.2726" name="/newroot/554/cgroup.controllers" dev="tmpfs" ino=2852 res=1 errno=0 [ 407.338702][ T31] audit: type=1800 audit(1793461195.791:12): pid=18547 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.2726" name="cgroup.controllers" dev="tmpfs" ino=2852 res=0 errno=-22 [ 407.363198][T18544] erspan0: entered promiscuous mode [ 407.365156][T18544] gretap0: entered promiscuous mode [ 407.488431][T18552] Bluetooth: hci0: invalid length 0, exp 2 for type 18 [ 407.488897][T18552] Cannot find map_set index 135 as target [ 407.699532][T18562] bond1: option mode: unable to set because the bond device has slaves [ 407.700340][T18562] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 408.627020][T18603] bond3: option mode: unable to set because the bond device has slaves [ 408.629072][T18603] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 408.732449][T18608] bond1: option mode: unable to set because the bond device has slaves [ 408.732695][T18609] __nla_validate_parse: 109 callbacks suppressed [ 408.732710][T18609] netlink: 136 bytes leftover after parsing attributes in process `syz.4.2745'. [ 408.742322][T18608] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 408.742362][T18608] FAULT_INJECTION: forcing a failure. [ 408.742362][T18608] name failslab, interval 1, probability 0, space 0, times 0 [ 408.742385][T18608] CPU: 0 UID: 0 PID: 18608 Comm: syz.2.2744 Not tainted syzkaller #0 PREEMPT(full) [ 408.742407][T18608] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 408.742417][T18608] Call Trace: [ 408.742425][T18608] [ 408.742432][T18608] dump_stack_lvl+0xe8/0x150 [ 408.742468][T18608] should_fail_ex+0x3eb/0x540 [ 408.742495][T18608] ? __alloc_skb+0x1db/0x7a0 [ 408.742523][T18608] should_failslab+0xa8/0x100 [ 408.742564][T18608] ? __alloc_skb+0x1db/0x7a0 [ 408.742589][T18608] kmem_cache_alloc_node_noprof+0x9c/0x600 [ 408.742612][T18608] ? __alloc_skb+0x18d/0x7a0 [ 408.742639][T18608] ? __alloc_skb+0x1db/0x7a0 [ 408.742674][T18608] __alloc_skb+0x1db/0x7a0 [ 408.742706][T18608] netlink_ack+0x136/0xb30 [ 408.742729][T18608] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 408.742752][T18608] ? __copy_skb_header+0xa3/0x4a0 [ 408.742783][T18608] netlink_rcv_skb+0x2a4/0x4a0 [ 408.742810][T18608] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 408.742831][T18608] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 408.742870][T18608] ? netlink_deliver_tap+0x2e/0x1b0 [ 408.742895][T18608] ? netlink_deliver_tap+0x2e/0x1b0 [ 408.742930][T18608] netlink_unicast+0x8ef/0xa80 [ 408.742971][T18608] netlink_sendmsg+0x7f0/0xb20 [ 408.743003][T18608] ? __pfx_netlink_sendmsg+0x10/0x10 [ 408.743033][T18608] ? aa_sock_msg_perm+0x144/0x210 [ 408.743056][T18608] ? apparmor_socket_sendmsg+0x98/0x360 [ 408.743085][T18608] ? __pfx_netlink_sendmsg+0x10/0x10 [ 408.743111][T18608] sock_sendmsg_nosec+0x14e/0x190 [ 408.743138][T18608] ____sys_sendmsg+0x54e/0x850 [ 408.743163][T18608] ? __pfx_____sys_sendmsg+0x10/0x10 [ 408.743193][T18608] ? import_iovec+0x73/0xa0 [ 408.743220][T18608] ___sys_sendmsg+0x2a5/0x360 [ 408.743238][T18608] ? __lock_acquire+0x747/0x2de0 [ 408.743267][T18608] ? __pfx____sys_sendmsg+0x10/0x10 [ 408.743323][T18608] ? __fget_files+0x3a2/0x420 [ 408.743345][T18608] ? __fget_files+0x2a/0x420 [ 408.743376][T18608] __x64_sys_sendmsg+0x1b1/0x290 [ 408.743399][T18608] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 408.743435][T18608] do_syscall_64+0x166/0x520 [ 408.743455][T18608] ? trace_irq_disable+0x3b/0x140 [ 408.743479][T18608] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 408.743496][T18608] ? clear_bhb_loop+0x70/0xc0 [ 408.743518][T18608] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 408.743545][T18608] RIP: 0033:0x7fe16639f559 [ 408.743563][T18608] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 408.743579][T18608] RSP: 002b:00007fe16726b028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 408.743600][T18608] RAX: ffffffffffffffda RBX: 00007fe166625fa0 RCX: 00007fe16639f559 [ 408.743614][T18608] RDX: 0000000000000000 RSI: 0000200000000800 RDI: 0000000000000006 [ 408.743626][T18608] RBP: 00007fe16726b090 R08: 0000000000000000 R09: 0000000000000000 [ 408.743638][T18608] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 408.743649][T18608] R13: 00007fe166626038 R14: 00007fe166625fa0 R15: 00007ffd11946458 [ 408.743681][T18608] [ 408.922122][T18612] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2746'. [ 408.922159][T18612] netlink: 24 bytes leftover after parsing attributes in process `syz.1.2746'. [ 408.922384][T18612] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2746'. [ 408.922398][T18612] netlink: 24 bytes leftover after parsing attributes in process `syz.1.2746'. [ 408.978944][T18614] IPVS: sync thread started: state = MASTER, mcast_ifn = veth1_to_bridge, syncid = 32, id = 0 [ 409.158922][T18618] sctp: [Deprecated]: syz.2.2748 (pid 18618) Use of int in max_burst socket option. [ 409.158922][T18618] Use struct sctp_assoc_value instead [ 409.221305][T18616] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2747'. [ 409.409488][T18624] syzkaller0: entered promiscuous mode [ 409.409510][T18624] syzkaller0: entered allmulticast mode [ 409.606226][T18633] Bluetooth: hci0: invalid length 0, exp 2 for type 18 [ 409.606683][T18633] Cannot find map_set index 135 as target [ 409.711656][T18638] netlink: 337 bytes leftover after parsing attributes in process `syz.0.2753'. [ 409.823375][T18640] netlink: 44 bytes leftover after parsing attributes in process `syz.2.2754'. [ 409.833561][T18640] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2754'. [ 409.833609][T18640] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2754'. [ 410.675770][T18677] erspan0: entered promiscuous mode [ 410.687912][T18677] macsec2: entered promiscuous mode [ 410.719348][T18677] erspan0: left promiscuous mode [ 410.941799][T18677] erspan0: entered promiscuous mode [ 410.941922][T18677] macsec2: entered promiscuous mode [ 410.963609][T18677] erspan0: left promiscuous mode [ 411.100075][T18677] erspan0: entered promiscuous mode [ 411.105683][T18677] macsec2: entered promiscuous mode [ 411.119579][T18677] erspan0: left promiscuous mode [ 411.229743][T18698] netlink: 'syz.1.2764': attribute type 4 has an invalid length. [ 411.271986][T18677] erspan0: entered promiscuous mode [ 411.273618][T18677] macsec2: entered promiscuous mode [ 411.291666][T18677] erspan0: left promiscuous mode [ 411.695416][T18709] bond1: option mode: unable to set because the bond device has slaves [ 411.695870][T18709] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 411.896905][T18695] syzkaller1: entered promiscuous mode [ 411.896929][T18695] syzkaller1: entered allmulticast mode [ 412.186632][T18737] Bluetooth: hci0: invalid length 0, exp 2 for type 18 [ 412.188101][T18737] Cannot find map_set index 135 as target [ 412.263640][T18739] tipc: Enabled bearer , priority 0 [ 412.421194][T18745] xt_hashlimit: size too large, truncated to 1048576 [ 413.041209][T18764] bond1: option mode: unable to set because the bond device has slaves [ 413.070288][T18764] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 413.315336][T18779] bond3: option mode: unable to set because the bond device has slaves [ 413.325682][T18779] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 413.379011][ T5639] tipc: Node number set to 1 [ 413.458648][T18784] Bluetooth: hci0: invalid length 0, exp 2 for type 18 [ 413.462400][T18784] Cannot find map_set index 135 as target [ 414.066189][T18770] __nla_validate_parse: 11 callbacks suppressed [ 414.066210][T18770] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2779'. [ 414.083029][T18810] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2786'. [ 414.475417][T18819] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2789'. [ 414.475457][T18819] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2789'. [ 414.545763][T18826] netlink: 6024 bytes leftover after parsing attributes in process `syz.4.2790'. [ 414.896295][T18834] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2792'. [ 414.936850][T18832] bond3: option mode: unable to set because the bond device has slaves [ 414.937418][T18832] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 415.053690][ C0] syzkaller0: 00:aa:bb:cc:dd:ee migrated from 127.0.0.1 to 172.20.20.14 [ 415.273391][T18841] bond3: option mode: unable to set because the bond device has slaves [ 415.285642][T18841] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 415.622001][T18854] Bluetooth: hci0: invalid length 0, exp 2 for type 18 [ 415.622607][T18854] Cannot find map_set index 135 as target [ 415.678268][T18859] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2799'. [ 415.704385][T18860] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2800'. [ 415.710246][T18863] netlink: 337 bytes leftover after parsing attributes in process `syz.4.2798'. [ 415.840055][T18865] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2797'. [ 416.004117][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 417.041115][T18916] lo: entered allmulticast mode [ 417.640188][T18943] Bluetooth: hci0: invalid length 0, exp 2 for type 18 [ 417.640684][T18943] Cannot find map_set index 135 as target [ 417.764762][T18945] bond1: option mode: unable to set because the bond device has slaves [ 417.989005][T18956] IPv6: NLM_F_REPLACE set, but no existing node found! [ 418.041406][T18962] tap0: tun_chr_ioctl cmd 2152240185 [ 418.724794][T19001] nbd2: detected capacity change from 0 to 63 [ 418.741331][T19001] block nbd2: NBD_DISCONNECT [ 418.758004][T19001] block nbd2: Disconnected due to user request. [ 418.762008][T19001] block nbd2: shutting down sockets [ 418.792425][ C0] I/O error, dev nbd2, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 418.792658][ C0] Buffer I/O error on dev nbd2, logical block 0, async page read [ 418.792689][ C0] I/O error, dev nbd2, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 418.792765][ C0] Buffer I/O error on dev nbd2, logical block 1, async page read [ 418.792785][ C0] I/O error, dev nbd2, sector 4 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 418.792853][ C0] Buffer I/O error on dev nbd2, logical block 2, async page read [ 418.792872][ C0] I/O error, dev nbd2, sector 6 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 418.792943][ C0] Buffer I/O error on dev nbd2, logical block 3, async page read [ 418.793151][ T2006] I/O error, dev nbd2, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 418.793178][ T2006] Buffer I/O error on dev nbd2, logical block 0, async page read [ 418.793506][ T2006] I/O error, dev nbd2, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 418.793531][ T2006] Buffer I/O error on dev nbd2, logical block 1, async page read [ 418.793629][ T2006] I/O error, dev nbd2, sector 4 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 418.793652][ T2006] Buffer I/O error on dev nbd2, logical block 2, async page read [ 418.804364][ T2006] I/O error, dev nbd2, sector 6 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 418.804401][ T2006] Buffer I/O error on dev nbd2, logical block 3, async page read [ 418.848369][ T11] I/O error, dev nbd2, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 418.848403][ T11] Buffer I/O error on dev nbd2, logical block 0, async page read [ 418.850255][ T11] I/O error, dev nbd2, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 3 prio class 2 [ 418.850296][ T11] Buffer I/O error on dev nbd2, logical block 1, async page read [ 418.859170][T18930] ldm_validate_partition_table(): Disk read failed. [ 418.861313][T18930] Dev nbd2: unable to read RDB block 0 [ 418.863317][T18930] nbd2: unable to read partition table [ 418.914377][T18930] ldm_validate_partition_table(): Disk read failed. [ 418.915009][T18930] Dev nbd2: unable to read RDB block 0 [ 418.918724][T18930] nbd2: unable to read partition table [ 419.112043][T19015] __nla_validate_parse: 7 callbacks suppressed [ 419.112066][T19015] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2834'. [ 419.200110][T19021] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2833'. [ 419.518326][T19032] tipc: Resetting bearer [ 419.641260][T19036] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2837'. [ 419.641287][T19036] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2837'. [ 419.788808][T19043] netlink: 'syz.2.2839': attribute type 1 has an invalid length. [ 419.857312][T19043] [ 419.859687][T19043] ====================================================== [ 419.866715][T19043] WARNING: possible circular locking dependency detected [ 419.867715][T19045] Bluetooth: hci0: invalid length 0, exp 2 for type 18 [ 419.874425][T19045] Cannot find map_set index 135 as target [ 419.878028][T19045] netlink: 337 bytes leftover after parsing attributes in process `syz.3.2841'. [ 419.895317][T19043] syzkaller #0 Not tainted [ 419.899743][T19043] ------------------------------------------------------ [ 419.906765][T19043] syz.2.2839/19043 is trying to acquire lock: [ 419.912840][T19043] ffff88802d8ea098 (set->srcu){.+.+}-{0:0}, at: __synchronize_srcu+0xb6/0x2f0 [ 419.921756][T19043] [ 419.921756][T19043] but task is already holding lock: [ 419.929159][T19043] ffff88803047f548 (&q->elevator_lock){+.+.}-{4:4}, at: elevator_change+0x1af/0x480 [ 419.938577][T19043] [ 419.938577][T19043] which lock already depends on the new lock. [ 419.938577][T19043] [ 419.948977][T19043] [ 419.948977][T19043] the existing dependency chain (in reverse order) is: [ 419.957981][T19043] [ 419.957981][T19043] -> #6 (&q->elevator_lock){+.+.}-{4:4}: [ 419.965797][T19043] __mutex_lock+0x197/0x15a0 [ 419.970906][T19043] elevator_change+0x1af/0x480 [ 419.976190][T19043] elevator_set_none+0xb5/0x140 [ 419.981560][T19043] blk_mq_update_nr_hw_queues+0x5ef/0x19e0 [ 419.987879][T19043] nbd_start_device+0x189/0xb30 [ 419.993276][T19043] nbd_genl_connect+0x167d/0x1cd0 [ 419.998821][T19043] genl_family_rcv_msg_doit+0x233/0x340 [ 420.004886][T19043] genl_rcv_msg+0x614/0x7a0 [ 420.009902][T19043] netlink_rcv_skb+0x226/0x4a0 [ 420.015191][T19043] genl_rcv+0x28/0x40 [ 420.019685][T19043] netlink_unicast+0x8ef/0xa80 [ 420.024964][T19043] netlink_sendmsg+0x7f0/0xb20 [ 420.030250][T19043] sock_sendmsg_nosec+0x14e/0x190 [ 420.035794][T19043] ____sys_sendmsg+0x54e/0x850 [ 420.041068][T19043] ___sys_sendmsg+0x2a5/0x360 [ 420.046254][T19043] __x64_sys_sendmsg+0x1b1/0x290 [ 420.051706][T19043] do_syscall_64+0x166/0x520 [ 420.056816][T19043] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 420.063219][T19043] [ 420.063219][T19043] -> #5 (&q->q_usage_counter(io)#49){++++}-{0:0}: [ 420.071820][T19043] blk_alloc_queue+0x544/0x690 [ 420.077105][T19043] __blk_mq_alloc_disk+0x194/0x390 [ 420.082732][T19043] nbd_dev_add+0x494/0xb60 [ 420.087666][T19043] nbd_init+0x168/0x1f0 [ 420.092335][T19043] do_one_initcall+0x250/0x870 [ 420.097612][T19043] do_initcall_level+0x10a/0x1a0 [ 420.103067][T19043] do_initcalls+0x59/0xa0 [ 420.107918][T19043] kernel_init_freeable+0x29d/0x3e0 [ 420.113643][T19043] kernel_init+0x22/0x1d0 [ 420.118518][T19043] ret_from_fork+0x514/0xb70 [ 420.123629][T19043] ret_from_fork_asm+0x1a/0x30 [ 420.128917][T19043] [ 420.128917][T19043] -> #4 (fs_reclaim){+.+.}-{0:0}: [ 420.136231][T19043] fs_reclaim_acquire+0x71/0x100 [ 420.141700][T19043] __kmalloc_cache_node_noprof+0x66/0x620 [ 420.147937][T19043] create_worker+0x112/0x7c0 [ 420.153048][T19043] workqueue_prepare_cpu+0xe4/0x170 [ 420.158796][T19043] cpuhp_invoke_callback+0x434/0x810 [ 420.164622][T19043] _cpu_up+0x2ce/0x5b0 [ 420.169222][T19043] cpu_up+0x1d2/0x220 [ 420.173734][T19043] cpuhp_bringup_mask+0xb2/0x1a0 [ 420.179203][T19043] cpuhp_bringup_cpus_parallel+0x109/0x120 [ 420.185541][T19043] bringup_nonboot_cpus+0x17/0x30 [ 420.191085][T19043] smp_init+0x32/0x110 [ 420.195675][T19043] kernel_init_freeable+0x27f/0x3e0 [ 420.201397][T19043] kernel_init+0x22/0x1d0 [ 420.206243][T19043] ret_from_fork+0x514/0xb70 [ 420.211344][T19043] ret_from_fork_asm+0x1a/0x30 [ 420.216623][T19043] [ 420.216623][T19043] -> #3 (cpu_hotplug_lock){++++}-{0:0}: [ 420.224348][T19043] cpus_read_lock+0x3d/0x160 [ 420.229473][T19043] static_key_slow_inc+0x12/0x30 [ 420.234928][T19043] nbd_genl_reconnect_sock_cb+0x69a/0xbb0 [ 420.241159][T19043] nbd_genl_foreach_sock+0x265/0x450 [ 420.246952][T19043] nbd_genl_reconfigure+0xbbb/0x1040 [ 420.252755][T19043] genl_family_rcv_msg_doit+0x233/0x340 [ 420.258810][T19043] genl_rcv_msg+0x614/0x7a0 [ 420.263822][T19043] netlink_rcv_skb+0x226/0x4a0 [ 420.269099][T19043] genl_rcv+0x28/0x40 [ 420.273586][T19043] netlink_unicast+0x8ef/0xa80 [ 420.278858][T19043] netlink_sendmsg+0x7f0/0xb20 [ 420.284150][T19043] sock_sendmsg_nosec+0x14e/0x190 [ 420.289710][T19043] ____sys_sendmsg+0x54e/0x850 [ 420.294990][T19043] ___sys_sendmsg+0x2a5/0x360 [ 420.300181][T19043] __x64_sys_sendmsg+0x1b1/0x290 [ 420.305630][T19043] do_syscall_64+0x166/0x520 [ 420.310736][T19043] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 420.317141][T19043] [ 420.317141][T19043] -> #2 (&nsock->tx_lock){+.+.}-{4:4}: [ 420.324782][T19043] __mutex_lock+0x197/0x15a0 [ 420.329914][T19043] nbd_queue_rq+0x373/0xff0 [ 420.334926][T19043] blk_mq_dispatch_rq_list+0x499/0x1990 [ 420.340989][T19043] __blk_mq_sched_dispatch_requests+0xd36/0x1580 [ 420.347827][T19043] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 420.354318][T19043] blk_mq_run_work_fn+0x167/0x2f0 [ 420.359853][T19043] process_scheduled_works+0xc3d/0x1630 [ 420.365920][T19043] worker_thread+0xa47/0xfb0 [ 420.371029][T19043] kthread+0x38b/0x480 [ 420.375617][T19043] ret_from_fork+0x514/0xb70 [ 420.380723][T19043] ret_from_fork_asm+0x1a/0x30 [ 420.385997][T19043] [ 420.385997][T19043] -> #1 (&cmd->lock){+.+.}-{4:4}: [ 420.393199][T19043] __mutex_lock+0x197/0x15a0 [ 420.398306][T19043] nbd_queue_rq+0xc1/0xff0 [ 420.403251][T19043] blk_mq_dispatch_rq_list+0x499/0x1990 [ 420.409328][T19043] __blk_mq_sched_dispatch_requests+0xd36/0x1580 [ 420.416328][T19043] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 420.422836][T19043] blk_mq_run_work_fn+0x167/0x2f0 [ 420.428387][T19043] process_scheduled_works+0xc3d/0x1630 [ 420.434455][T19043] worker_thread+0xa47/0xfb0 [ 420.439591][T19043] kthread+0x38b/0x480 [ 420.444178][T19043] ret_from_fork+0x514/0xb70 [ 420.449291][T19043] ret_from_fork_asm+0x1a/0x30 [ 420.454567][T19043] [ 420.454567][T19043] -> #0 (set->srcu){.+.+}-{0:0}: [ 420.461677][T19043] __lock_acquire+0x164c/0x2de0 [ 420.467041][T19043] lock_sync+0xb3/0x130 [ 420.471707][T19043] __synchronize_srcu+0xca/0x2f0 [ 420.477157][T19043] elevator_switch+0x1e8/0x7b0 [ 420.482438][T19043] elevator_change+0x2fa/0x480 [ 420.487722][T19043] elevator_set_default+0x375/0x440 [ 420.493450][T19043] blk_register_queue+0x404/0x4f0 [ 420.498991][T19043] __add_disk+0x6b8/0xdb0 [ 420.503836][T19043] add_disk_fwnode+0x100/0x3a0 [ 420.509126][T19043] nbd_dev_add+0x733/0xb60 [ 420.514057][T19043] nbd_genl_connect+0x96c/0x1cd0 [ 420.519529][T19043] genl_family_rcv_msg_doit+0x233/0x340 [ 420.525592][T19043] genl_rcv_msg+0x614/0x7a0 [ 420.530611][T19043] netlink_rcv_skb+0x226/0x4a0 [ 420.535897][T19043] genl_rcv+0x28/0x40 [ 420.540429][T19043] netlink_unicast+0x8ef/0xa80 [ 420.545718][T19043] netlink_sendmsg+0x7f0/0xb20 [ 420.551099][T19043] sock_sendmsg_nosec+0x14e/0x190 [ 420.556662][T19043] ____sys_sendmsg+0x54e/0x850 [ 420.561948][T19043] ___sys_sendmsg+0x2a5/0x360 [ 420.567133][T19043] __x64_sys_sendmsg+0x1b1/0x290 [ 420.572586][T19043] do_syscall_64+0x166/0x520 [ 420.577702][T19043] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 420.584112][T19043] [ 420.584112][T19043] other info that might help us debug this: [ 420.584112][T19043] [ 420.594334][T19043] Chain exists of: [ 420.594334][T19043] set->srcu --> &q->q_usage_counter(io)#49 --> &q->elevator_lock [ 420.594334][T19043] [ 420.607979][T19043] Possible unsafe locking scenario: [ 420.607979][T19043] [ 420.615431][T19043] CPU0 CPU1 [ 420.620784][T19043] ---- ---- [ 420.626136][T19043] lock(&q->elevator_lock); [ 420.630715][T19043] lock(&q->q_usage_counter(io)#49); [ 420.638601][T19043] lock(&q->elevator_lock); [ 420.645703][T19043] sync(set->srcu); [ 420.649588][T19043] [ 420.649588][T19043] *** DEADLOCK *** [ 420.649588][T19043] [ 420.657718][T19043] locks held by syz.2.2839/19043: 6, last CPU#0: [ 420.664051][T19043] #0: ffffffff914f05a8 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 [ 420.672246][T19043] #1: ffffffff914f03e0 (genl_mutex){+.+.}-{4:4}, at: genl_rcv_msg+0x10b/0x7a0 [ 420.681205][T19043] #2: ffff88807843a178 (&set->update_nr_hwq_lock){++++}-{4:4}, at: add_disk_fwnode+0xea/0x3a0 [ 420.691554][T19043] #3: ffff88803047f5d0 (&q->sysfs_lock){+.+.}-{4:4}, at: blk_register_queue+0x10d/0x4f0 [ 420.701387][T19043] #4: ffff88803047f058 (&q->q_usage_counter(queue)#54){+.+.}-{0:0}, at: elevator_change+0x194/0x480 [ 420.712281][T19043] #5: ffff88803047f548 (&q->elevator_lock){+.+.}-{4:4}, at: elevator_change+0x1af/0x480 [ 420.722118][T19043] [ 420.722118][T19043] stack backtrace: [ 420.728052][T19043] CPU: 0 UID: 0 PID: 19043 Comm: syz.2.2839 Not tainted syzkaller #0 PREEMPT(full) [ 420.737455][T19043] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 420.747504][T19043] Call Trace: [ 420.750776][T19043] [ 420.753695][T19043] dump_stack_lvl+0xe8/0x150 [ 420.758295][T19043] print_circular_bug+0x2e2/0x300 [ 420.763322][T19043] check_noncircular+0x12f/0x150 [ 420.768267][T19043] __lock_acquire+0x164c/0x2de0 [ 420.773124][T19043] ? lockdep_unlock+0x5c/0xd0 [ 420.777789][T19043] ? __lock_acquire+0x1511/0x2de0 [ 420.782867][T19043] lock_sync+0xb3/0x130 [ 420.787024][T19043] ? __synchronize_srcu+0xb6/0x2f0 [ 420.792155][T19043] ? __synchronize_srcu+0xb6/0x2f0 [ 420.797259][T19043] __synchronize_srcu+0xca/0x2f0 [ 420.802198][T19043] ? __pfx___synchronize_srcu+0x10/0x10 [ 420.807736][T19043] ? do_raw_spin_lock+0x12b/0x2f0 [ 420.812760][T19043] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 420.818554][T19043] ? ktime_get_mono_fast_ns+0x2d2/0x2f0 [ 420.824100][T19043] ? synchronize_srcu+0x20c/0x270 [ 420.829130][T19043] elevator_switch+0x1e8/0x7b0 [ 420.833894][T19043] ? blk_mq_cancel_work_sync+0xa5/0xe0 [ 420.839346][T19043] elevator_change+0x2fa/0x480 [ 420.844112][T19043] ? do_raw_spin_unlock+0xf5/0x200 [ 420.849234][T19043] elevator_set_default+0x375/0x440 [ 420.854431][T19043] ? __pfx_elevator_set_default+0x10/0x10 [ 420.860153][T19043] ? disk_register_independent_access_ranges+0x2d8/0x380 [ 420.867172][T19043] ? blk_crypto_sysfs_register+0x11c/0x170 [ 420.872981][T19043] blk_register_queue+0x404/0x4f0 [ 420.878019][T19043] __add_disk+0x6b8/0xdb0 [ 420.882350][T19043] add_disk_fwnode+0x100/0x3a0 [ 420.887108][T19043] nbd_dev_add+0x733/0xb60 [ 420.891514][T19043] ? __pfx_nbd_dev_add+0x10/0x10 [ 420.896448][T19043] ? __pfx_nbd_genl_foreach_sock+0x10/0x10 [ 420.902243][T19043] ? security_capable+0x7e/0x2c0 [ 420.907180][T19043] ? radix_tree_lookup+0x240/0x290 [ 420.912283][T19043] nbd_genl_connect+0x96c/0x1cd0 [ 420.917223][T19043] ? __pfx_nbd_genl_connect+0x10/0x10 [ 420.922594][T19043] ? rcu_is_watching+0x16/0xb0 [ 420.927355][T19043] ? trace_kmalloc+0x2a/0xf0 [ 420.931955][T19043] ? __kmalloc_noprof+0x387/0x710 [ 420.936970][T19043] ? __nla_parse+0x40/0x60 [ 420.941388][T19043] ? genl_family_rcv_msg_attrs_parse+0x20b/0x2f0 [ 420.947707][T19043] ? genl_family_rcv_msg_attrs_parse+0x265/0x2f0 [ 420.954036][T19043] genl_family_rcv_msg_doit+0x233/0x340 [ 420.959624][T19043] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 420.965690][T19043] ? __lock_acquire+0x747/0x2de0 [ 420.970624][T19043] genl_rcv_msg+0x614/0x7a0 [ 420.975119][T19043] ? __pfx_genl_rcv_msg+0x10/0x10 [ 420.980140][T19043] ? __pfx_nbd_genl_connect+0x10/0x10 [ 420.985516][T19043] netlink_rcv_skb+0x226/0x4a0 [ 420.990278][T19043] ? __pfx_genl_rcv_msg+0x10/0x10 [ 420.995294][T19043] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 421.000607][T19043] ? down_read+0x2b9/0x320 [ 421.005038][T19043] genl_rcv+0x28/0x40 [ 421.009029][T19043] netlink_unicast+0x8ef/0xa80 [ 421.013809][T19043] netlink_sendmsg+0x7f0/0xb20 [ 421.018593][T19043] ? __pfx_netlink_sendmsg+0x10/0x10 [ 421.023886][T19043] ? aa_sock_msg_perm+0x144/0x210 [ 421.028918][T19043] ? apparmor_socket_sendmsg+0x98/0x360 [ 421.034473][T19043] ? __pfx_netlink_sendmsg+0x10/0x10 [ 421.039781][T19043] sock_sendmsg_nosec+0x14e/0x190 [ 421.044809][T19043] ____sys_sendmsg+0x54e/0x850 [ 421.049573][T19043] ? __pfx_____sys_sendmsg+0x10/0x10 [ 421.054852][T19043] ? import_iovec+0x73/0xa0 [ 421.059356][T19043] ___sys_sendmsg+0x2a5/0x360 [ 421.064034][T19043] ? __lock_acquire+0x747/0x2de0 [ 421.068985][T19043] ? __pfx____sys_sendmsg+0x10/0x10 [ 421.074183][T19043] ? futex_wait+0x2a2/0x390 [ 421.078699][T19043] ? __fget_files+0x3a2/0x420 [ 421.083368][T19043] ? __fget_files+0x2a/0x420 [ 421.087964][T19043] __x64_sys_sendmsg+0x1b1/0x290 [ 421.092898][T19043] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 421.098357][T19043] do_syscall_64+0x166/0x520 [ 421.102975][T19043] ? trace_irq_disable+0x3b/0x140 [ 421.108096][T19043] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 421.114161][T19043] ? clear_bhb_loop+0x70/0xc0 [ 421.118839][T19043] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 421.124725][T19043] RIP: 0033:0x7fe16639f559 [ 421.129144][T19043] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 421.148745][T19043] RSP: 002b:00007fe167208028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 421.157189][T19043] RAX: ffffffffffffffda RBX: 00007fe166626270 RCX: 00007fe16639f559 [ 421.165164][T19043] RDX: 0000000000000004 RSI: 0000200000001ac0 RDI: 0000000000000004 [ 421.173152][T19043] RBP: 00007fe166436b50 R08: 0000000000000000 R09: 0000000000000000 [ 421.181118][T19043] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 421.189091][T19043] R13: 00007fe166626308 R14: 00007fe166626270 R15: 00007ffd11946458 [ 421.197098][T19043] [ 421.738099][T19037] syzkaller0: left promiscuous mode [ 421.738123][T19037] syzkaller0: left allmulticast mode [ 421.745950][ T1025] netdevsim netdevsim1 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 421.755986][ T1025] netdevsim netdevsim1 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 421.756069][ T1025] netdevsim netdevsim1 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 421.756133][ T1025] netdevsim netdevsim1 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 426.884122][ C1] ip6_tunnel: syztnl0 xmit: Local address not yet configured! [ 427.523899][ C0] ip6_tunnel: ip6erspan0 xmit: Local address not yet configured!