last executing test programs: 9.533518383s ago: executing program 1 (id=5555): r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x41, &(0x7f0000000200)=0x474c, 0x4) (async) bind$inet(0xffffffffffffffff, &(0x7f00000001c0)={0x2, 0x40, @loopback}, 0xfffffffffffffe77) (async) connect$inet(r0, &(0x7f0000000480)={0x2, 0x0, @multicast1}, 0x10) (async) sendmmsg(r0, &(0x7f0000007fc0), 0x800001d, 0x0) (async) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_INITMSG(r1, 0x84, 0x2, &(0x7f0000000400)={0xfffc, 0x0, 0x0, 0x74}, 0x8) setsockopt$inet6_int(r1, 0x29, 0x8, &(0x7f0000000040)=0xb68, 0xe9) (async) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$FITHAW(r2, 0xc0045878) (async) epoll_create(0x1) (async) r3 = socket$inet(0x2, 0x3, 0x6) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r3, 0x89f1, &(0x7f0000001040)={'gre0\x00', &(0x7f0000000380)={'syztnl2\x00', 0x0, 0x2100, 0x80, 0x3, 0x0, {{0x5, 0x4, 0x0, 0x9, 0x14, 0x68, 0x0, 0x0, 0x2f, 0x0, @initdev={0xac, 0x1e, 0x5, 0x0}, @initdev={0xac, 0x1e, 0xfe, 0x0}}}}}) mmap(&(0x7f0000b7b000/0x1000)=nil, 0x1000, 0x0, 0x3032, 0xffffffffffffffff, 0xffffd000) (async) r5 = socket$can_bcm(0x1d, 0x2, 0x2) socket$nl_route(0x10, 0x3, 0x0) r6 = socket(0x15, 0x5, 0x0) (async) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) (async) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_pid(r7, &(0x7f00000004c0), 0x12) (async) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r7, 0x0) getsockopt(r6, 0x200000000114, 0x5, &(0x7f0000c35fff)=""/1, &(0x7f00000000c0)=0x1) (async) mmap$xdp(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x6000008, 0x6e071, 0xffffffffffffffff, 0x80000000) (async) connect$can_bcm(r5, &(0x7f00000002c0), 0x10) readv(r5, 0x0, 0x0) sendmsg$can_bcm(r5, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)=ANY=[@ANYRES64=0x0, @ANYRES64=r5], 0x80}}, 0x0) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r3, 0x89f3, &(0x7f0000000300)={'syztnl2\x00', &(0x7f0000000000)={'tunl0\x00', r4, 0x20, 0x40, 0xb0, 0x6, {{0x5, 0x4, 0x2, 0x6, 0x14, 0x5f, 0x0, 0xf9, 0x2f, 0x0, @local, @empty}}}}) epoll_ctl$EPOLL_CTL_ADD(r7, 0x1, r0, 0x0) (async) socket$inet6_sctp(0xa, 0x1, 0x84) (async) bpf$MAP_CREATE(0x0, 0x0, 0x48) 9.322780616s ago: executing program 1 (id=5559): r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) (async) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000001040)={'wlan1\x00', 0x0}) (async) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) writev(r3, &(0x7f0000000140)=[{&(0x7f0000000180)="a2", 0x1}], 0x1) (async) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, r3, 0x0) (async) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000040)={'wlan1\x00'}) (async) ioctl$sock_SIOCGPGRP(r1, 0x8904, &(0x7f0000000080)=0x0) (async) r5 = gettid() sendmsg$NL80211_CMD_SET_WIPHY_NETNS(r1, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000340)=ANY=[@ANYBLOB="680000008def0208207e26cd3300000000dcd2764f7f4be5cb6945df2e8090b7db575c51bd", @ANYRES16=r0, @ANYBLOB="000826bd7000fbdbdf25310000000c00990009000000090000000800010053000000080001007c0000000800db00", @ANYRES32=r3, @ANYBLOB='\b\x00R\x00', @ANYRES32, @ANYBLOB='\b\x00R\x00', @ANYRES32=r5, @ANYBLOB="08000300", @ANYRES32=r2, @ANYBLOB="08000300", @ANYRES32=r2, @ANYBLOB='\b\x00R\x00', @ANYRES32=r4, @ANYBLOB="08000300", @ANYRES32=r2, @ANYBLOB], 0x68}, 0x1, 0x0, 0x0, 0x8015}, 0x0) (async) sendmsg$NL80211_CMD_SET_TID_CONFIG(r1, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000bc0)={&(0x7f0000000240)={0x48, r0, 0x1, 0x70bd22, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_TID_CONFIG={0x2c, 0x11d, 0x0, 0x1, [{0xc, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_TIDS={0x6, 0x5, 0x5}]}, {0x1c, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_TIDS={0x6, 0x5, 0x30}, @NL80211_TID_CONFIG_ATTR_AMSDU_CTRL={0x5}, @NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE={0x5}]}]}]}, 0x48}}, 0x0) 9.01900189s ago: executing program 2 (id=5562): socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000080)='ns/ipc\x00') unshare(0x6a040000) r0 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r0, 0x84, 0xa, &(0x7f0000000080)={0x800, 0x43c, 0x0, 0xffff0001, 0x7a21, 0xfffffff8, 0x6, 0x2831}, 0x20) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000680)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000002700090025bd7000ffd3008001000000080001"], 0x1c}, 0x1, 0x0, 0x0, 0x4000811}, 0x4000) accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) 8.960390129s ago: executing program 1 (id=5563): r0 = socket$inet6_sctp(0xa, 0x801, 0x84) sendmmsg$inet6(r0, &(0x7f0000000240)=[{{&(0x7f0000000000)={0xa, 0x4e22, 0xfb, @private1, 0x8001}, 0x1c, &(0x7f0000000840)=[{&(0x7f0000000300)="02fd64b3a6e265ad6489156979f71f4add7a9803bb104c52fe27e69131dd", 0x1e}, {&(0x7f0000000480)="82", 0x1}, {&(0x7f0000000500)="e418ebee9253ab86cdc6e84186f5069c2401ece1effffb1be94d9e41136b1954a18cc3e1febaa010d221f4a33515fa1075c404814cdb8d4c86cc846aa1364d13fb2d4a30342f4e3ca0313dcb50176ac30a66e00c40148f702ebb8c9100b469464fcec2a318a68c7e9ad5bb1016ae9ea3c7198b5213e48338f890cfb342295442988da1b0b82d2404df4206344eac8e00433eb8c77466820a6ecac738744e77ceacea6b2bb455db4c63d7807b27b169439aa6e3c21f777a7cdf11", 0xba}, {&(0x7f00000005c0)="d1752f73a5351bb711e793a84af6e1e3bbe280ad2837ef2a8bac0738f13287793bbd4e33a3508fa963ba67c2eea970c86092239dcb4e3273cf33d35e947e0c7c03fa9328c5f87bb270680b5ba6dd15bc9c9807be12d4fa99b312ce587dc7bee7ca5a3cb043ae463197af6db7a28f5e325139f5abd0439fa46d1f16a347e05e3e4cb753ef5ad5986e40d83b316ed6ce273fd775883fb8a877bd23421fd2f297108d6589ae92f66ce23c306f3a5071bfd0660c44e75140b22335196e019e9e6c0271094d3b026671c9", 0xc8}, {&(0x7f00000006c0)="ae405d4bc5bf69e1a482a7e8d15c66e4e0d96aacb4059939d7d121f8b2d00f25ea1883f7412da85dbb70f4de981f507d2e3a33fe8962594d412a13ca07cea6e171cc3148d0f0b3561453b07dc86a21e7116b1a4836d002cbde3b89fd309b749be62b140565245e7e0ecb6af5022e352b3b9524a194e44beb4e1a1e49c4de262997e6a9a421fe08bc544fc378cbdafb5e4a08b7eb3de561cb768147ed52212f0d764dbc2ea30999c3227866dabe3e37a0ad8fd8fe4e4bcf6756138240dcef2e868e3c57ab532aa2e9d5798fb83dca8514e7616f58f2b4f9bc8e742d4bfc2344f1090714788d172989", 0xe8}, {&(0x7f00000007c0)="e66cdd581abdd891852be9baaed0ab333f6dc346ec8ff541d481fd817f124084b24d57f147b533abff8112d2640feeb3db17209907161da5bac41fc9a4a0b8dd620d42403ee177aa84abaa74f72c7d140c85249deb52ea4a49ad27052166cc7c26ae8a079f714180737125324ce3b50468abed", 0x73}], 0x6}}], 0x1, 0x42) shutdown(r0, 0x1) socket(0x5, 0x3, 0x5) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000940)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet_sctp6_SCTP_I_WANT_MAPPED_V4_ADDR(r4, 0x84, 0xc, &(0x7f0000000380), &(0x7f00000003c0)=0x4) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x42082, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) ioctl$TUNSETDEBUG(r5, 0x400454c9, &(0x7f0000001300)=0x1) r6 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0x102, 0x0) close(r6) socket$inet6_sctp(0xa, 0x1, 0x84) ioctl$TUNSETTXFILTER(r5, 0x400454d1, &(0x7f0000000200)=ANY=[@ANYRES16=r6, @ANYRES32=r5]) ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f00000004c0)={'syzkaller0\x00', @multicast}) r7 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r9 = socket$packet(0x11, 0x2, 0x300) sendto$packet(r9, 0x0, 0x0, 0x50040, &(0x7f00000001c0)={0x11, 0x3, r8, 0x1, 0xd8, 0x6, @random="4e9e4e0e6598"}, 0x14) splice(r3, 0x0, r4, 0x0, 0xf3a, 0x0) r10 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r10, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) r12 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(r10, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000400)=ANY=[@ANYBLOB='@\x00\x00\x00', @ANYRES16=r12, @ANYRESDEC=r3, @ANYRES32=r11, @ANYBLOB="0c0099000b0000001f08009f000c00e3ff070026002c0900"/34], 0x40}}, 0x0) sendmsg$NL80211_CMD_SET_REG(r10, &(0x7f0000000340)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r12, @ANYBLOB="000227bd7000ffdbdf251a0000002400228014000080080007000400000000000000ad1bc7790c0000800800060008000000"], 0x38}, 0x1, 0x0, 0x0, 0x20008000}, 0x0) write(r2, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000040)={0x0, 0x10, &(0x7f0000000000)=[@in={0x2, 0x0, @private=0xa010101}]}, &(0x7f0000000080)=0x10) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r1, 0x84, 0x1d, &(0x7f0000000140)={0x1, [0x0]}, &(0x7f0000000240)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000180)={r13, @in6={{0xa, 0x4e21, 0x1000, @empty, 0x697d}}, 0x6, 0x3, 0x20080000, 0x9, 0x2, 0x10, 0x1}, 0x9c) 7.920442183s ago: executing program 1 (id=5566): bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x10, 0x4, &(0x7f0000000700)=@framed={{}, [@generic={0x91, 0x1, 0x1, 0x17}]}, &(0x7f0000000100)='syzkaller\x00', 0x5, 0x0, 0x0, 0x41100, 0x66, '\x00', 0x0, @fallback=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="0a00000007000000060000008c"], 0x50) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000004c0)={r0, &(0x7f0000000340), &(0x7f0000000440)=@tcp6, 0x2}, 0x20) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$NS_GET_OWNER_UID(0xffffffffffffffff, 0xb704, &(0x7f0000000140)=0x0) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) splice(r3, 0x0, 0xffffffffffffffff, 0x0, 0x5, 0xa) openat$cgroup_devices(r3, &(0x7f00000005c0)='devices.allow\x00', 0x2, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000580)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000540)={&(0x7f0000000180)={0x3bc, 0x28, 0x800, 0x70bd2c, 0x25dfdbff, {0x1f}, [@nested={0x2e5, 0xc4, 0x0, 0x1, [@typed={0x8, 0xcf, 0x0, 0x0, @u32=0x8}, @generic="806b88d1e6fd47d74f1d5581e43a15086f7258d16a97f19c865068c3fce89a06a9153b62fa8ed20a7c20033d75c0b26c5f43c24487b09d33ea6590e47e002bdd24e4e799edf56827aacf125adc16feaba4c41f1437e63bc31f0ff1a902629cb0de539c30acb8d739ec79a071831e18c8371604e778e9c20eb2653903dcd08777b30edd0d7a924433913f6eb1cb44bd263d57bd2614d4c190e6", @generic="91393ac43a6f0bdc1841a4bc645963ea57201ff9853f70267e715e4057c3746cf14cb5b9c7afb90bec47f78cfbac353f0c2087d7aae4b6b2f60c504f6c8acea50d820ff88b5494110a814abc1bd76101c2d8dc914e4d665bb164bf737c3c158411482039ecefe003dc1e1f7bd2d3712326fe49c63795a4a654e406a59d0193f485bbe5320c57b5c75851d0658b697a6acf4aa8b624dd3b1879eed5822c7a56ef15d36449d6fe2e40ac423af78632244097fd5d0d51dd8b361a94f8aca55fce5a52280c75deac0f06326b578916a06d1fe36ba387eff7a8cf100138a3663856e163226b3aa83f0e04d264ddd452770a5d18119c8c9db7e459ce7b", @generic="98469a7f272bde3c8527983692347f92cf4c73f86113235f699a39c5957b5f50eb3107931f547dfbc95f8236dec5486c8b1d8c050f8ca5bf82295e7b5bcb9c1d0add35526d9ee52964", @generic="0fdf806777d0b8f6ed1171149d86744d815aaefb21936d204d9867924b403a859e7266cac85e764de7e7536da9bc3e05b3aca2c0c0d76c0d61d091c219825134fec6b0a4e66ec799292cff9cb6cc2247814b8abc6ca47ed9d8a5595d77458562a7875b74776b3e1ca5b18490a3ea28e62b44867ff3553aa4c297de79daaf7234616c48c9fbe1b39568317ce8377e799e2408ddd97f6369077d724c9d2a59a35de20cb4c46976cca2168fcb7d6b8496b47097c73ae25c885d44efc1708451d24e36a3c2d35cf223b07dd3cfa35c9a5e7f7156548e83", @typed={0xc, 0x5b, 0x0, 0x0, @u64=0xebe}, @typed={0x8, 0xb1, 0x0, 0x0, @ipv4=@empty}, @typed={0x8, 0x43, 0x0, 0x0, @uid}, @typed={0xc, 0xb7, 0x0, 0x0, @u64=0x9}]}, @typed={0x8, 0x122, 0x0, 0x0, @uid=r2}, @generic="a1af", @generic="a885fc3fa74ef6ffe38c95387a7678cb795d844d323a728c7b4aa821b75330c8d7a3923d67621d6e6756b66af4a6c4d2f7e9221a04978afb7c863dde9d7371a7c64706a6175af1177c38ee88cf731d8103563a0709495df0676e7b9a3dd39dfed6ca6e89934654ea33b4b034972ad843d2923364382e1a598b9f065f65c9acac30d8ef671dfa5e23f385bb51419efbbb6b6746e34822a2b6454cbdf3b27cb262cdcad7fb6df4fca25cba781c01e920cbaa48294035"]}, 0x3bc}, 0x1, 0x0, 0x0, 0x4000}, 0x4008088) 7.803472028s ago: executing program 1 (id=5568): socket$netlink(0x10, 0x3, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000600)=ANY=[@ANYBLOB="34010000170001000000000000000000640101020000000000000000000000000000000097581e58e0000002000000000000000000000000fc020000000000000000000000000000fe8000000000000000000000000000aa0000004000"/104, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="e00000020000000000000000000000000a01010000000000000000000000000000000000020100030200002000000000", @ANYRES32, @ANYRES32=0x0, @ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000b10f00000000000000000000000000000000000000000000010000000000000000000000000000000000000000000000000000000000000004000000b86b6e000000000000000000feffffff0000000000000000000000000c0008"], 0x134}}, 0x4000) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x3, 0xc, &(0x7f0000000140)=ANY=[@ANYBLOB="18020000fdffffff00000000fdffffff8500000011000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000040000850000007b00000095"], 0x0, 0x1}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000580)={0x16, 0xc, &(0x7f0000000140)=ANY=[], &(0x7f00000001c0)='GPL\x00', 0x7, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x27, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r1, 0x5, 0xe, 0x0, &(0x7f0000000140)="259a00f271a76d1708fff74588a8", 0x0, 0xd0d, 0x2a0, 0x0, 0x0, 0x0, 0x0}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x4, 0x4, &(0x7f0000000240)=ANY=[@ANYBLOB="18000000000000000000000000000008850000007600000095"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x80) r2 = bpf$BPF_BTF_LOAD(0x12, &(0x7f00000002c0)={&(0x7f0000000100)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x7, [@enum={0x5}]}, {0x0, [0x0, 0x0, 0x0, 0x0, 0x61]}}, 0x0, 0x2b, 0x0, 0x1}, 0x28) bpf$MAP_CREATE(0x0, &(0x7f0000001400)=ANY=[@ANYBLOB="0b0000000600000004000000a703000001000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32=r2, @ANYBLOB="000000000100000000000000000000000000000000000000f4dd0000"], 0x48) r3 = socket$key(0xf, 0x3, 0x2) r4 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0xffcc, &(0x7f0000000040)={&(0x7f0000000480)={{0x14}, [@NFT_MSG_NEWRULE={0x54, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2, 0x0, 0xffff}, [@NFTA_RULE_EXPRESSIONS={0x28, 0x4, 0x0, 0x1, [{0x24, 0x1, 0x0, 0x1, @meta={{0x9}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_META_DREG={0x8}, @NFTA_META_KEY={0x8, 0x2, 0x1, 0x0, 0x7}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz1\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x5}}}, 0x7c}}, 0x0) sendmsg$NL80211_CMD_JOIN_MESH(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000004c0)=ANY=[@ANYBLOB='L\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="010027bd7000fcdbdf254400000008000300", @ANYRES32=r6, @ANYBLOB="0a001800030303030303000004005a8020005a8018000080140005"], 0x4c}}, 0x4040810) r7 = socket$inet6(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000040)={'sit0\x00', 0x0}) ioctl$sock_inet6_SIOCSIFDSTADDR(r7, 0x8918, &(0x7f0000000080)={@mcast2={0xff, 0x5}, 0x0, r8}) r9 = socket$nl_route(0x10, 0x3, 0x0) r10 = socket(0x200000000000011, 0x2, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000300), 0x280400, 0x0) syz_emit_ethernet(0x56, &(0x7f0000000000)=ANY=[@ANYBLOB="aaaaaaaaaaaaaa4c77b99cbb86dd60c6ea090000000000000100000000e01f00000000000000ff020000000000220000000000000001e800c204"], 0x0) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000000)={'bridge0\x00', 0x0}) sendmsg$nl_route(r9, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@RTM_NEWMDB={0x18, 0x55, 0x1e5, 0x0, 0xfffffffd, {0x7, r11}}, 0x18}, 0x1, 0x0, 0x0, 0x4}, 0x0) setsockopt$inet6_mreq(r7, 0x29, 0x14, &(0x7f0000000000)={@local, r11}, 0x14) sendmsg(r10, &(0x7f00000024c0)={&(0x7f0000000340)=@x25, 0x80, &(0x7f0000002480)=[{&(0x7f0000001480)="c1edb1b92d02bf3869739ae065c7bd0de1fc5cad016e913622688570ac0ff8311ba98993701aad6bab610aaea506568be3078b1d035d76f929fde88891a32ee09b255eb5da5d952b7fb74c92d5692eb8e41c70663c759ce621e00eabd2815411108bc8b7af8c0596399683e18990c84fb31d405cef5640fc9592ca68bd10bf2e79c6d42c71814f78dfe5ea31b3270a9bb86fb8e9059d1508256b29c6593fe85f9ae7b7addfea880f3331ace75f07ddb809036005b0220c6676c8dcccdb4be6f0f203c6cfd50977f9debfd9662445aa5bacfa8828cff472bc849a87b6cf2a1e401c2b9b6e6c252545ce98af7df81239d96e22dfd5cbda12ce07ae52a725b44468d5b37587ba446028d9f348c259a837eb382d56ca0456daa6dc5e153ac39779ecd4e54a1784bef001208f682170798e41e808ec66846884aa830a429258435e04cf267b67946327d0fd0b0ff5c6f45c4ff2ccd54302bf6bdf6b010d7dd58be76ef1fe5f45f8eb3a9a37b82a7786558573061fd390a116cd33bb23ebf8ed9672db65cd8bbc7d8712670123e4b661d86ffe824ca5a2e0fdced31ec030d776202fd46bc51e7afbdf39527317180b4c3a67a1569d9ac2c94f93ea4c4db7152570fd396dfde3f8eaf3f3d253de858c78a8b898fff7aaa69c616fc4ec9f84295fc41318ad307d455f282eaa0cea2077a5b1a2492900fb0a3a3d6b36a5ec2ae8b6218afb4c804329623a1144f52ced3f70797ee25b67adb63e60bf5d28ee4cd3c3002b7064c3dd9e0ca7bb2f31a20bba8ab333715d87e7a8d62674acbd9a99ab362bebd27f4e20fc8d1b26b655a581dce20079d3a32c70610ad9fde39b8ddab94653c21e3da3850246c1f7d45205e173459299c96b4eac60b38a225d02bd29d6877f86a11d90b344ab4f817895c5d291fe442256e3f1ea8e1af4803b65e9ac755a8fb90a24e0017fff76294d8b6b520640a4d914f0dc2c5af098c65b3381c3ea8da04b772d1e55494fcee5cd80d02e41a6edc0b056ad59d34e2bef88651d46439c38d7325ed3231c27ebda4eaad7d137516960cc88651a82e37430531535b17ab68e113d30e0addaf4c34d9f6751d38aef93d994fead85f44b6ea1880cd2f9c98b566971e6213782c0b55a9d1d015471186e5cd76aedebac927e6340cab859dae5a8f4509df9f653cefb6c43446c1791bd6f045af45e23ecd7a0ea2e65a84ca69126694e8618b32ba56b01d6d7e44f33627e3efa4c946e8a582067d333673fa50abe7e6daeb665311fa48b42ec6bdf9a5015c16ea909f637ac30f90483d7572bd45d48f17c5e597ff241c47e4674df7269b6dfabd6f924043f6b55944e98e927912813cb134f2225452a33fd135df9493f1214529700aff7601c02a1f06bc81bd818c9257ee16ad75a6093f0ac49d4a71c0b37597e0475041af5bff90fdaae4758803dcc91a6e016621cc7a46b2d41fdb41e2f67dbcba3762988ad9aec1f67f8fbeccd4792e1a570e73e40f466925e727143ef686890c8d3e4307a463da12bb4362c860908e7334ad5c1286f2aea30fe8c87f21d51990330913932112f6f55ceb3486a51da37888526e9e4e05a53e7bc201009c4b633cff18b65c92ac424b713348deea3bd29327a32145098763e22ca583e30dcf5955e3c57935048dd861615c53be740bdca068453d3e74fa905b43a2c4d30eb1eedbf6459ef25600b212e25c52cd51c4e5cfc6ac5363fa89a300b2eba2af17e19bfb0d5af688736bb3c3480c9c6b432e24a445a46e1959866c3fdc75ffa6eac17697084cbda9bf8d958be2e37d5165b398084757a43434a6461e0eeec32952ea8bd00d0ae2878fb252e18cf9dff955d853015f2450f552e6a1b600de6bb9d23f4ecb4f49bd6c7a512add6fbaa48754e3b8cacf0bfbe7f241d0ed87d1e96f80f6e236a16bf06153ea5db64e78c9dc522fdfe73f8f3ded9996303fa44628cdd69fe5f2bd3f4c872f1b2541c73138a81efe6eeb58fa7e502e62c1996cf8190655990a9d6c4f995551a51cf1908734d8eced5ebe82c38c3d795b5f518d485c996dc9fe1b6de243d014cf7f6ac4560959cb704d11865cf5ac5fd445b5590a3042621b1bce7558a2c0a7310d9d516ed3898a0347ff0cf7a3bab74a19ad684968b345d3cd982f18a3fe5196fbeeed125a8ecea0b70e963c69059e26db8ca28e51680ed545e84c3e0d0d892e34d897217fffda87ecae246fae1268b581f7858e2b2522d5d3427750e48b0459a33373825afe11c055fc30e542ec773eee655f207e2a1f452b190c7e57fb78efecb5631fe5c638ab64e39cd3386aa806ce7d91905bc04a0eda0759d80a178c5b8cafbf5312fd36f4aa4cf131134bdd98310c68eb602f2e980aec29abf212c408758ceccfc089a6d40c4f3ab852105800581cea68f656adf67d81c79666ad507050ac3cb1df01b70132767ddc8081d5c9fdfb2cd556a5952ead3c3a3ca99848a22fc6e8a1d92a7e44be337196adbc580b232a42e541e158e3593bb4863ca8388fbb8b09cc07eccf228435dd6c5718f8f1f23f81a1e55940ad7cbd54252ecf165049bde9054bb33cf4951c84af9207873c2ef7c439d097e16672ea092af8217e1c88ca0411e96e53478a28f6e56a4e0170897fb9733935cf88676e48fe9f027a1ccad148cc71d3ddb75d7270b0b29ca1cf0dfba4363938a0b48b61fe7f5ab82d0ae85b677189b198ad10293bbacd5d0e3e119d7e2b0cf53c85bff986bead9dacf865a0c71d72c512e762d9e81583f45494e60d5ec63f5170890abdab2b29a60ab5c69685a43558768dedad110583f03380aff4f2558fb591ad03ffb5ba63afacfb0bc52c657d6594040a0636a89cd7fb1a4b8ccf01b82eb388d22a730afbff51750cb3a177be3ecea791ec0f30c3a60397d138c3665565a6bd3de218213c6be8685cc6959afbb0c98dcf030a49d17e936c0592c82957bdce48c30a653770494884d9705697c35a9b39558fe1bcd5af7b87c9f1136cd53f4210dfb941aae3cbe50d5f768203f1f7e67696fd9aa2042d2955a97d5faa3470a9239f99a08dbe3bbae6a7951d242603b09d62bfd19c91c37dbef26dd98296bc877bff978a1035d1b6a171852fd9191eb58271f0eec9ab14cc9b6db4c13537920a3e006f4840110cd4415a591d448c67fcd57ca780d395c1bcc9235836e1648f57509547751b1d105bc0206f481552c6aa4bea0530c9063137ee0774a09c849c0d9ef023a238cb50d07097285c8f8b5f02bfc81ce2d52b53ffa981e71ca7ce6c353c39698265de142654441dfaa2681c66e933abce98b31235d663899bec3090df76ca094fb3e22a20b322fe349143c5f28c7c34a102e3d8446bbf1c65a8791c3de4651a161e551e3f2702d3bd1b499451c646bd1598b3dcbdd73ce118775d42a56323eb22b9611a7d730382729b5d61754e30244942954567e9de6bdeedbc177a33877bdac9ce0fdff678f68fc2e0e9f40194e67ce46e374240212af8590ed8a71ce0baff7ddc1521876cb6713319154957b0811ffaecc2dbd24d0e8f468d3d2c88476b16eb8bb2cc95148ac9c0930d3c7789c0f242782b5e6d6dae8a550a8f5c6a4570b3de56a339ad8ede92136197837068d849362d1ff5c68df5ee8bd10be81d7d63480c8b2609b640178b520044fa12e94a6f06661194d64946637a5809b97ae8e9662248501d31ab9fef0951d494e98cf0b1dc8bdd346c3fe20ffccff75ed4a6ff3f9cf2454d412f608413d737c3dfc0745ad9c458b6106fd63a1280e0519fb85eee41f4ac451a9dc28c142826c064662e350437f4768305cbabca592bba3858a55bb98bddda315a3503a2484740dfc36928b0693997a9f79c535502330ad3bad68150a04334a1b6a32efa50f55f4e1a8b6cf3ab056adaf4cc50a5b3c238e8f1510ede3697a973775a32b55a4dda9f382907a8aef961bef2fe1d607d1a792c0f03e128143ecccfe28d77a363c001ce5b244a5ef3233e97524003c9a56bd593dfb1286a32f161501f9b3a7af3cde154b50e46ddce37ff2d0e86f8ffe167958f5a6e658c26b1e1c535915bb6310255a37019b26c53703e14b64c3c73a56f73851d2f397d3d6c5ddb948c618b4bd2b726e189d46ae0f1fecf384c1842800c73fd3952da38edeaacfa2e5a88a23ef7d9954b76f791643a82a89429becca507ad8a7db5e2172e68b799814a6cef904ba8267cf9a84f81d039994dcfdd7cce863bb5e9d9878dcea850aa7da4b7ace963f94190c07f453d6e1a7182df2a8c3cf66873394d34de0e18787e5d7767ae172900791d3aa39423ae7187df4647eeccc471520b12e2c5b88effeaa572c0fe5a612c1e127bf85f6f567eedeaeae6868c1aecf2894aa2167424baab5dd3832cdefec38614ffac052d1ed3ae6eaee1b7a8104638cfdbf9d2909add13b7d8478bfd1ddf2f505ca0eda7752f4f63cfe666459d6c9b1423e8190f9d1dccf3485f9e1b38dfec6d5665569d2332dbc17318329723e0249a29866f80faa84ee6b39e18877a2f5d47a869405a82b0f63091c4e0abf862b27ea1993ff1717c2e487333109149e12a8b2f827df462c4f78b81373cd6ff204f25bc96aa84cf1168f9d1e3b4b482560c2a34b34bd674b8b080a7c7389d4af3b1a07f1273f17278b8441ee352b30d6acea17e417cc2849b8e4a0941b0d9c161591e68f42f71fdefdbbcd2e890361d9444cb33c35bff4028e78708d7c3315544e6e4a3dc9892a408359119e5377bdb59077df64e4d1beeffbf67ae8946ef17e7c4e723ddd2acd6824b0891544bf572af8e51c77498dc0249c011c538b4a67649de234184c51c743511dcdb635a36475bc7cf6e82eb4c4e34701cf71204f9e0ccbf9d95c0a857fe834266fbfe0c007888a532d10754a78027b6c5dfb38f702d0979bbad248ff23c57f6979c5805e2f19bd2cc310dfcb03f96226a74f6d88014defe49c49ccfda423e6983ed0c830f9e1611d90a17779c739e49a5121463b1288f9f5f046da126837ee71b0949f62066d03f28981076ae742b1ce202db985a5087d88483957fe58a2e1cc8b6e8e1fc71f7de52c6a875ffbb873d9b9a5fa71671d38e2e42b191f45ffa969c3ea5b1272aa6d5b763f90a06bd159b04cb96122dd44e9244b2c44c65945d5d26cf5c906fff90f50f8ab7f1711e5e61815080111076d4ba91349d2d27cbfcff42d2c39315c2846c5a1b90e42b9b622ffcb361ff651339e5126174f70ff6e982439023f0f3cd76d1bf499aedb73bace1f158b3a62c56a158712ca3a7ef7493ef9f0d6bb09d4f4c69d66c9adc05118bbbb67e029d935f9cb006b45a1d89ddfc897aca0302115ff13c54bf2b39f30d2dffdc9c2fa3b6ffb2a03b6f69a87244b2850d433aabddd075c747b844b823e789bf78dfe9f5ee83195ed0c1d801e81a92639015137cd24b7b12f816f189d2ba71a9ae0fe3cfd12cc12d8ae9713d451114810f7f4f04397c7e0db2d18e9816bd107b4e636732fc2aec4744c9d7ea7c8f7569a9f81e591f88a2e000963f96d10112a75668702661d158bf6df3ba39ff50fa1b4479e0b63ea4cb9ffe64809c7d40b374081aa604e86aa9790036b4338823c10339d1eaddcace2ab7eb50be90d5ffa65130ccd70308db826df58d1c37b44976b5734594b928cbd4f32ff5c57faa3944b5b4d7b20226e72d7fab5b21a7504a33689729d838e4ff275c2e899f966bbe4e09808cdf0ce2de1f9ed215577338765f94fbdaa8201c4f94f57142b411289a0b8854c0c2aac8e75a31746c4846f48bde114bd0e5dcf78a65d", 0x1000}], 0x1}, 0x4800) sendmsg$key(r3, &(0x7f0000002a00)={0x0, 0x0, &(0x7f00000029c0)={&(0x7f0000002940)={0x2, 0xa, 0x7, 0x2, 0x7, 0x0, 0x70bd29, 0x25dfdbfd, [@sadb_x_filter={0x5, 0x1a, @in=@remote, @in6=@dev={0xfe, 0x80, '\x00', 0xc}, 0x26, 0x4, 0x9f12443852f025de}]}, 0x38}}, 0x4) r12 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r12, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f0000000a80)=ANY=[@ANYBLOB="fc00000019000100000000000000000000000000000000000000000000000000ff02000000000000000000000000000100000008000000000a00000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000000000000a900000000000000000000000000000001000000000000000000000000000000ffffffffffffffff000000000000000000000000000000000000000000000000000a0000000000000000000000804000020000000000000800000000000000000000000000000000440005000a010101000000000000000000000000000000003c000000000000007f00000100000000000000000000000002000000040300"], 0xfc}}, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) 7.545603246s ago: executing program 1 (id=5571): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00000005c0)={0xa, 0x202, 0x20000200, @empty, 0x7}, 0x1c) sendto$inet6(r0, 0x0, 0x0, 0x200080c0, &(0x7f0000000040)={0xa, 0x2, 0x8000, @loopback, 0x4}, 0x1c) (async) r1 = socket$nl_route(0x10, 0x3, 0x0) (async) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000600)={0x26, 'hash\x00', 0x0, 0x0, 'cbcmac(camellia-generic)\x00'}, 0x58) close(r2) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=ANY=[@ANYBLOB="18000000690061f400002abd7000fbdbdf2500"], 0x18}}, 0x20040000) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000840)='highspeed', 0x9) (async) shutdown(r0, 0x1) 6.60369937s ago: executing program 3 (id=5578): socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_TX_RING(r1, 0x11b, 0x3, &(0x7f0000000140)=0x40, 0x4) r2 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(r2, 0x11b, 0x6, &(0x7f0000000080)=0x1, 0x4) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000580)={'batadv_slave_1\x00'}) setsockopt$XDP_TX_RING(r2, 0x11b, 0x3, &(0x7f0000000600)=0x20000, 0x4) setsockopt$XDP_UMEM_FILL_RING(r2, 0x11b, 0x5, &(0x7f0000000300)=0x2, 0x4) bind$xdp(r1, 0x0, 0x0) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000080)='ns/ipc\x00') unshare(0x6a040000) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="040100001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000240012800b0001006272696467650000140002800800050001200000080001"], 0x104}}, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1e, 0x3, &(0x7f0000000900)=ANY=[@ANYRESDEC=r4], &(0x7f0000000340)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x94) 5.787734463s ago: executing program 2 (id=5581): mmap(&(0x7f0000196000/0x1000)=nil, 0x1000, 0x0, 0x840000000000a132, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='freezer.parent_freezing\x00', 0x275a, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='hugetlb.2MB.rsvd.usage_in_bytes\x00', 0x275a, 0x0) mmap(&(0x7f0000215000/0x1000)=nil, 0x1000, 0x0, 0x6011, r2, 0x0) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000c, 0x11, r2, 0xaa0f4000) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r4 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000000)={'veth0\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=ANY=[@ANYBLOB="3400000015000100fdffffff0000000002180000", @ANYRES32=r5, @ANYBLOB="140003006665746830"], 0x34}}, 0x0) mmap(&(0x7f0000691000/0x4000)=nil, 0x4000, 0x3, 0x28011, r3, 0x0) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) mmap(&(0x7f0000ff4000/0x3000)=nil, 0x3000, 0x2000004, 0x12, r7, 0xe6905000) mmap(&(0x7f0000867000/0x2000)=nil, 0x2000, 0x9, 0x11, r3, 0x1000) mmap(&(0x7f00005d3000/0x4000)=nil, 0x4000, 0x0, 0x12, r0, 0xfffff000) mmap(&(0x7f00008b7000/0x4000)=nil, 0x4000, 0x0, 0x13, r1, 0x0) mmap(&(0x7f00004a3000/0x1000)=nil, 0x1000, 0x0, 0x13, r0, 0x0) mmap(&(0x7f0000071000/0x4000)=nil, 0x4000, 0x0, 0x13, r1, 0x0) mmap(&(0x7f000015b000/0x3000)=nil, 0x3000, 0x800001, 0x10012, r1, 0x0) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x5, 0x3032, 0xffffffffffffffff, 0x0) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_TEST(r8, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000200)={0x44, 0xb, 0x6, 0x801, 0x0, 0x0, {0x2, 0x0, 0x2}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x1c, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0x18, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV6={0x14, 0x2, 0x1, 0x0, @private0}}]}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}]}, 0x44}, 0x1, 0x0, 0x0, 0x48}, 0x4800) unshare(0x6020480) r9 = socket$netlink(0x10, 0x3, 0x0) r10 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x4, 0x4, &(0x7f0000000240)=ANY=[@ANYBLOB="1800000000000000000000000500ac12fd5a03b15590000095"], &(0x7f00000001c0)='GPL\x00', 0x8, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xe468}, 0x94) r11 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r11, &(0x7f0000000040)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) write$bt_hci(r11, &(0x7f0000000500)=ANY=[@ANYBLOB="4c00010002"], 0x8) sendmsg$nl_route_sched(r9, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000340)=@newtaction={0x64, 0x30, 0xffffffffffffffff, 0x0, 0x0, {}, [{0x50, 0x1, [@m_bpf={0x4c, 0x1, 0x0, 0x0, {{0x8}, {0x24, 0x2, 0x0, 0x1, [@TCA_ACT_BPF_PARMS={0x18, 0x2, {0x1, 0x0, 0x10000000, 0xffffffff, 0x4}}, @TCA_ACT_BPF_FD={0x8, 0x5, r10}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x64}}, 0x0) 5.373932467s ago: executing program 2 (id=5583): socket$inet_icmp_raw(0x2, 0x3, 0x1) openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r0 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) bind$netlink(r0, &(0x7f0000514ff4)={0x10, 0x0, 0x1, 0x2ffffffff}, 0xc) close(0x3) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) r1 = socket$inet(0x2, 0x1, 0x0) r2 = socket$inet(0x2, 0x3, 0x0) setsockopt$sock_int(r2, 0x1, 0x2f, &(0x7f0000356ffc)=0xffffff42, 0x4) bind$inet(r2, 0x0, 0x0) r3 = socket$inet(0x2, 0x1, 0x0) setsockopt$sock_int(r3, 0x1, 0xf, &(0x7f0000356ffc)=0xffffffffffffff40, 0x4) bind$inet(r1, &(0x7f0000000080)={0x2, 0x4e21, @loopback}, 0x10) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000356ffc)=0xffffffffffffff40, 0x4) close(0x4) r4 = syz_open_procfs$namespace(0x0, &(0x7f0000000200)='ns/pid_for_children\x00') r5 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_int(r5, 0x0, 0x21, &(0x7f0000000000)=0x2, 0x2) unshare(0x6a040000) syz_genetlink_get_family_id$tipc2(0x0, 0xffffffffffffffff) r6 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$F2FS_IOC_START_ATOMIC_WRITE(r4, 0xf501, 0x0) r7 = syz_genetlink_get_family_id$devlink(&(0x7f00000000c0), 0xffffffffffffffff) r8 = socket(0x28, 0x805, 0x0) setsockopt$pppl2tp_PPPOL2TP_SO_LNSMODE(r8, 0x111, 0x4, 0x0, 0x4) sendmsg$DEVLINK_CMD_RATE_SET(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="fddbdf256e6574646510e70b4b674d702a74eabda7659669f37673696ddd00000f0002006e65"], 0x3c}, 0x1, 0x0, 0x0, 0x800}, 0x20048844) r9 = socket(0x40000000015, 0x5, 0x0) setsockopt$SO_RDS_TRANSPORT(r9, 0x114, 0x8, &(0x7f00000008c0), 0x4) bind$inet(r9, &(0x7f0000000040)={0x2, 0x4e21, @loopback}, 0x10) 4.848437059s ago: executing program 4 (id=5585): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)=ANY=[@ANYBLOB="400000001000010429bd70000000000000000000", @ANYRES32=0x0, @ANYBLOB="2b030000000000002000128008000100677470001400028008000100", @ANYRES32, @ANYBLOB="08000200", @ANYRES32, @ANYBLOB="ed3f0466ae6550d41d0b8a0d513933a1bca580bb1a0a55b2980b260dd232f2f540c45e2dd83519c4f3c97d0e948d110fce9478fc14c5a7541951e0a4125ffe1b245a31d8c94b917a60b16803bd34052b2827a0e4acdc978d17ff831afcb76a5a4d3321d1413a52a2cbbee4a1ffe5f7af1d016db304fc96eb406cc79f56372efb220c8866abf1ac120fc27511eb96522c72aa65f845b635f12aa2ea"], 0x40}}, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_DISASSOCIATE_REQ(r1, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x20, 0x0, 0x4, 0x70bd2b, 0x25dfdbfc, {}, [@IEEE802154_ATTR_COORD_HW_ADDR={0xc, 0x9, {0xaaaaaaaaaaaa0002}}]}, 0x20}, 0x1, 0x0, 0x0, 0x4}, 0x0) r2 = openat$nci(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r3) ioctl$IOCTL_GET_NCIDEV_IDX(r2, 0x0, &(0x7f00000000c0)=0x0) sendmsg$NFC_CMD_DEV_UP(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r4, @ANYBLOB="010026bd7000fcdbdf250200000008000100", @ANYRES32=r5], 0x1c}}, 0x840) ioctl$IOCTL_GET_NCIDEV_IDX(0xffffffffffffffff, 0x0, &(0x7f00000002c0)=0x0) r7 = socket$alg(0x26, 0x5, 0x0) bind$alg(r7, &(0x7f0000000180)={0x26, 'aead\x00', 0x0, 0x0, 'authencesn(wp512-generic,cbc-camellia-aesni-avx2)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r7, 0x117, 0x1, &(0x7f0000000280)="ad56b6c582", 0x56ad) sendmsg$NFC_CMD_LLC_GET_PARAMS(r1, &(0x7f0000000380)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)={0x34, r4, 0x300, 0x70bd2d, 0x25dfdbfd, {}, [@NFC_ATTR_FIRMWARE_NAME={0xa, 0x14, ':[$G-,'}, @NFC_ATTR_FIRMWARE_NAME={0x4}, @NFC_ATTR_FIRMWARE_NAME={0x7, 0x14, '$.&'}, @NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r6}]}, 0x34}, 0x1, 0x0, 0x0, 0x4000009}, 0x4000000) 3.208669863s ago: executing program 3 (id=5589): r0 = socket$nl_route(0x10, 0x3, 0x0) (async) r1 = socket$nl_generic(0x10, 0x3, 0x10) (async) getsockopt$inet_sctp_SCTP_INITMSG(0xffffffffffffffff, 0x84, 0x2, &(0x7f0000000300), &(0x7f0000000340)=0x8) sendmsg$TIPC_CMD_SET_LINK_TOL(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x38, 0x0, 0x2, 0x70bd28, 0x25dfdbfe, {{}, {}, {0x1c, 0x18, {0xec1f, @bearer=@l2={'eth', 0x3a, 'veth0_to_hsr\x00'}}}}, ["", "", "", "", "", "", "", "", "", ""]}, 0x38}, 0x1, 0x0, 0x0, 0x20880}, 0x400a5) (async) r2 = syz_genetlink_get_family_id$gtp(&(0x7f0000000140), r1) sendmsg$GTP_CMD_DELPDP(r1, &(0x7f0000000240)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)={0x44, r2, 0x2, 0x70bd25, 0x25dfdbfb, {}, [@GTPA_TID={0xc, 0x3, 0x4}, @GTPA_FLOW={0x6}, @GTPA_PEER_ADDR6={0x14, 0xb, @mcast2}, @GTPA_FLOW={0x6, 0x6, 0x2}]}, 0x44}, 0x1, 0x0, 0x0, 0x20000000}, 0x20040004) (async) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000c80)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000001200)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000280)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd27, 0x4000000, {0x0, 0x0, 0x0, r3, {0x0, 0x4}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_skbprio={{0xc}, {0x8, 0x2, 0xcb7}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4801}, 0x0) socket$packet(0x11, 0x2, 0x300) 2.700309192s ago: executing program 2 (id=5590): syz_emit_ethernet(0x1056, &(0x7f0000000000)={@multicast, @broadcast, @val={@val={0x88a8, 0x3, 0x1, 0x4}, {0x8100, 0x1, 0x1, 0x2}}, {@ipv4={0x800, @dccp={{0xc, 0x4, 0x3, 0x28, 0x1040, 0x65, 0x0, 0xe, 0x21, 0x0, @private=0xa010101, @rand_addr=0x64010100, {[@ssrr={0x89, 0x17, 0x17, [@multicast1, @remote, @broadcast, @dev={0xac, 0x14, 0x14, 0x30}, @dev={0xac, 0x14, 0x14, 0xb}]}, @noop, @noop]}}, {{0x4e23, 0x4e23, 0x4, 0x1, 0x2, 0x0, 0x0, 0xa, 0x5, "62034d", 0x3, "5225e8"}, "6dbce1175dadb2b993db1adbb23e4c62bf094c7d999ba77f46a0650ea0aaa2c4d0c990eeec7a5000d8f2b0b725dae1f4c73b84988a286209496fe0ec3ff7922f2bfe85761bb85a5f77492ebd3bdd82575778788d60aafc974c393bb5d8cec9718c8ad591f32c571fef1ec1c3ac2c3d8bb151df3a62eb6574621d2dfd6223fd708bc04915a3b20da9a3acc6ae546092b305d3d29c443767e22fbfd4c2a70b8d73fcbbd79534acce608e0baca72436f673ef88394fa2e312a5d52dd2cd04f05c8a5f59e950b770ae3965f9dd36ec5e95b32c93bfdb0391b8c1bdb425b34972ce3f8aae484641dc3c84aeb12ae083acf0ba55b6e8d8abfde1a59c8f6d7c52b5f589e3386d7afbe9e36da219bf8c8779db005bd8fac546dd77ef72166c6e8319228947d93252e6332a34aedc7252cf1642bdf37dd3b869035fdc19a8812707a2fc3ee6b1a842445aba2735988c156d5e7c886ed61d2714f1f6f7868630b85f0db21571555d82f808831d67fae275657b91f168a5e991e96cbe2a6e7b87c6704c434f8d9cdf785f53d62050171aaa8c109b2fd71949626904101278cc5fbb55a33062edf6f966fae7a493e38fef70784d15403b0e0c26937263ab8d9dd02d77912cf8ddbe5d5868c2f5e9cabd022ea9e0eb90829d47ed9f86f798ef3d8a173cbed4b0de38782c906e465f782f86c6651a9429c51dc09ee4b3c6583707eb43a3ee6e5042c426f822677b0c9eadc3dce2aa28181ac3257c3b5a47cfbb0bdd2688a13a5667101a71f57e8f7dbb5c0fd121e503c76af98850005c986f8b4965657ac83a40adbdd0be21dd809c097c4c6337056e18a1e9fe2fd2298c685cafebb2fdb32eea4550ed7bd5c7ab89d3a062e3f7ac70721ebdd2f61e9f87cabecc098220073f61baf993d50c396c971d1e32ada052400b8a11346aa1c25c209030035aa11f40c72e5c8f651ac363885ca68a9b98d7fa88db65835a11f77ef0cd1f44c83e42bfa1cb11a00052ea9252c94f607c59b51cdd49bdf9c043ce375807f7bb6552a6517750ccb3eaa0ad309b45b6ebde78ce72da83b0d5bc64f851751f4df22ed1f28d91e49db2f54ab3135564e3ae107999615ed87c14c8dc350c513a717bc8cd3e3488710313ddedea94adc89841ca841e5466e926ec1e03ae3f4d31e0105843f0248e76b33fca2d3ce14721b629e8126a8390f696957bbb02821d2c76f99f192d8e51500f64fa19b5972f811c3c722cd9b489c23f1633594cb61ea03f0ee5fc1935b84b5010b92a49d435a6301fd99962c433df8eb2fdd96b1686409f46394f9d9026bd325379c45bea92b91d4670b91ea8ae9d4b84a45611bbea0e8c5eeaa94bec6cdd38e87c629415e5ebb094a943cf332847b5a3896c111500ce5115d1c89d05aa7a2835581319ee887022a14776edd62890992e1ceeb0c0a868a5714082a8315fd07d17d0a3088b34050ebd6a7ce733c99ff0c34567ae5ea1f2341026a1a6923f1c36d47c8bd21fd60e3d9f24a9b8ceb626b8f1b363e48383ea52b07e8859ce329f61537d8c490db87db8a67672d819eaab3752247df395184f0cf9cdd780bac5541c8fb8e3370f21caef53dc494246a915768b9f556184523a5f42c413662f1b9addb10cb2e8c9717ab01030caffe1a0b1d4a11015c3b85f7f0c9699a2d4a372f0b04cd3da5a081f038d027e3ebdb53210bc6226a250c34641a4cf4424e708edff8bc7596b029b8e8a706f56961abd0b2ab02f071cea5ed3b2f432b4b08231ee22db8bafc3d9a8321f00feb62308a890bcae92d61b703a7fb8737c4367b6b5048520ff48e052381c4ef2400a187c300cc554d828c722f9595449d6fcac3b89feda40f01530f90127f153b16adcbe84dbfd15f6174ac32b27cec9a3f2cbfa2f1f83daa391609480c839d631294cfb3352e3751db775ddbf2d066fe678680069fd875e2c9cd79149f9fcfd1d736739de934168e56beef088499245b8201a7ecab7ac2853788ae90e4deb7c29c7e267cd184287fbb4baf235fb528b085420ee8d5854f19ece4cf60bd915a9f4a80325649a08862b07d55d773496fc2c1caccd0f064174b67bdc3a8045637e16fc1dd971cb2d16bf20a522203ccd99556b6fccd2085c3a695a50f0200503d1cdcc1775b6117cd4d8641bd95fe9d266394e54b42f65c2102857320502f39cfee435610f65535009c5555a9b3c47a9addce95605e90e45aed13abddc08e509e8f31acbe063d0b37dc95d2745facf7807247907e168fe04336e0931394b9b496f1119dfa122c0b9b1f79242203de86eab17b3d17e5b04d0fa45c1c00112c43cc3da625f9cc909ed4ba3944b35333b2e0c24be19f978fbc915e5713e0ec79786326961d9e935f1709ddbb75d0d6cf8a09cfab120b1996d7a960488fec8abb3b3f8027b2d39d8398fa6161cc1e10f5ae60f76cc28beebb9b7973f0f3ee47e4124e9d8765ef276247ccc140bdc618cbba4a54229634cf40ba9de2272086e939becdec9206b516d83ddfd4a7f1e094f9f12996b70a0bbe7a6c1c8a7b2be23f86276d5e4780b0ae640212536cba8f64c44976b43081d6afd65de17633057f52ac7b719037303131013be74b5ed251cb0bad93c9da49cfdcf85ac3e2d8c36cf7819cf77bd4882af7125ad970a89796bb8030ec5b279d095a6a7e1b8fad8e47b3d8cdaaeb62f30028b2058a8230ce3ba5b660e12bf879ee89aa349de60d48e4d5d248fdf77007d9ed47610bf2d3034693595602924355c0908b8cc132f3c4bddd6a6cfd1c547ad54047ce2974e7a65bef5b1229a716b7b96376097bc43edad0adb0b580383de0507522d229c032effc72e1087dd0af3f429aa234dd0459ef4eaae7837cd6d259130653792a593dd653e6ae626f433ea0ef9a9c1757bcb967629e3654906416f950555f02dedd07d1036588e5fa2f191461a1027b5d8a11205283bafc2ae6760e28e362b7b9e3808537731f7600d85733fd61c6c4d28ce05dd4522b38ca708b51a520e4b5a84a3486695b94a7f09c511fdb2153435d5ee3c8f7c5e5402f3fb148836e8f6b1a60e547321c2e639b7980c341910d0cf2ae3e0e9eb9f644e022d8b6802b84d21133b8719881cd62bb3597ee1e59dd8a97ec95e6a7f047f05724304d67fc9c269c3a6715d89c54452e68497c50858d47728590f7b78833175fdfdd00745a025ab3b508e23e1460a187cc29dd77e021b42070d413cc65eb443f13fe3dc291a1ac12988a2ab61e34e14327f8ed72a9edfce972d91a610f11ddf29706024e73239678b978d788584c975c0d36a2e80bf0c876dfc0f628e777c7837184f83bd3f8df4c9e37d7392e3e05505d7caadd79adf099e104177e6121dd62a2df0c4ac5af96998a7ec0f2de5344df717a97002f9d0140237616c5ff82f1f6482d11be4f237596ba19632dbc1f5c045fc187f869bc70e14d766499de97aff3d2a9b20442ccf45841708fd9aa679a0eca6c9893788648c4ea0715792a1ec4ee9fcdc2e520b4a6fb30843c923831345b7eb14997d27aa7b649b8bec9a15a0f20915b4995029b17c9a353cc9d6de914435849bb8a1e8ea030b0fdedb8106d5ea8f7c3f3babf413db703842ab725cbfde68269bece5e2e62ef165d4808107b21fda792de2dba781771c11934f9bc214b85094ecf75b47c9f5aa7845985491dccdf89ed87180ade1a98a9bfcd6909ffe59822b0d782de18c5e3968d868220a1baec22b68fb120e2c859d7b7680e1cd39120a143ce96e6dcf74352e1d16f2932e3b8f67adafc5f226bde47f4798c4ee57d211f5c8eb2c0ca70ffa7ea6be6e8b84a328a6dea7b5b11765471d2add7b954a8784b169723cb17af7148af44d1f4e3320a9a1c11c9882e2e92f97060710dd20f613faf98e448740205ef098c02777860640cc744a8273d85189b80facaf814e578b154acda921f8db5f7b1f27683b2d9471c1ec9d71ef0afd3e932966f8573189430e5d25d8849e92a4cea2c1aff16132226cfc1ab6a84baad462c25d46c65a99a4713f353baf1fa9d02b8d0bd3cd3811b5209b319880f20446389c26df5ea95890957557749bf0e9b7ccd8c23545e2f0986608369348a2b5e6dc133a4c711f4d2e5102939af2dcc4b22e218771ffac62826b39231ca7d45a0cc2a7a39abc08ef0efa952e6ed17994b9f3e1d60f41668fea6079862bb90071f378f238a24fe1897bf353b54195bbb576889511f0986c74b5757616cc351b129f01992133539b2b385311c3166896e421910365ff40fc8478e416de817be1acc2f42373811d38cc02594bfae54982ed28ef02ad9629818c8226368ffa79667df26778b9cde1db193a3b4a2325d67c599eb0ebbb08e5a51b85203db03023f4529ae897c545c336191d360679416123af465f4f5d72e6b863ae580a905fed2bbadf0df463e965126d9651d93d1a8283fe1425141d2cb44839d4d0d1214b87766021f9774b1ff4234b163453ee187a77931bba5c9541ff90f9c75b33dd3b1b6af9d5457ebd4986b8fcf76e63946ae59c7ed3525bfb347689008de76c15dc507a042fb5ca72750e9be9baf7d9a767b7173ad9cbe11443bdfda4b5e4ef66c36e1a5830ed0877de2aaa7789f15fe4839baa5041bd178bb4618e2b92e602d7b53d267a646829c85356120d7a41d042ea298adc2a68b391ff05c16172e00001abfcafc90b52cd7d43e0b1063eeb99724075707a07e7b59807010285bbfc58e3a608c0abf0a5b7fc9828dbb9167faf81387044524232a8bf3dcbc977e5928088ed1ab2ac68560cffdfc13e4379f926b4b158c88a35fe345d9f16f9842f83ef4a2d2480c2923d8c0d755e3e8c4832f5a9a5ea191b2fc4bb273d802646b7124e099664244bf6dd17a25b9c98356a07916f8d5ac53b246250528b82986d1c92a0fb155deae3b770783a5adecf1a96023ee0b1cd3931d00778ffb758fe3450c32e6cef096dfd16ed052d86620b2cf5b7788959a032cd8752747a778a8d2de2c2157b8b57f5b713e860b147bd509c25271470a92fd1e06e463f3909bae5fd6ef3c7fbfceb9a7e541da155e0e08e3d54c695429766b22652a063be15b054667cb40165a85b88107ba109e8eba32c3bd8cdbf6e4c3dede13df40ab73d95ad539e2c5e30fc191d064765a629dd7697cbd1318c66d17007da9b6a04a228604ec06aaf88212d18d5bbf2aeb7023f7a3034c079a71521a97e1f737df994f21b79c4ad85e326cd9a3cb403c68a00ea7499447cbd8c906bb9146bab463b898814ff478e7498f15cb814a54819c63ab79def2ebff5d0ba7e985bfe08cc8da5efa217a4ea67248a67282d5b2b475397f4dba31468a3b147e6669d88b77283472c175bd3882895b3a5c49a07120610be002f86849c4657806128d6c9096ee49528d1bede84913cf1c12433009638b8b448a5a4a0f5479a2eb3132574493532e413de844322442c59b0b2bfe2135a1841e8c027de58db99850052acc9cd932dbd4a7acebe21daa475ab72b8524a67bd5e0d4fa327956e6f495987f5476ffaf7a62e9ed709acd2323863813a132c69e84783da678cab0321c9979e93dda3a746bf034100ec30185d4d1de1556fc42a7a91bdced590445c061b9711ec7fe7ab86c7ccb3eb7fd7fd467aaa1d667cc1b7451a4ac7587840b4284a4924434aa37d776551b0221eb1ae40fddfff5bed3b94d903042d2f5fd7df11c97480435d1fe66f90181b215b27b7ad47ac0bb29366cf14dfe3c54cc6da1a97220e6bffbf6a63589b40999da3173c426cdd4b0b8e3982a83e73f8ec54e1c271edbefa56"}}}}}, 0x0) (async, rerun: 64) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001080), 0x26a100, 0x0) (rerun: 64) write$tun(r0, &(0x7f00000010c0)={@val={0x0, 0x22eb}, @void, @ipv6=@tipc_packet={0x2, 0x6, '6KN', 0xce, 0x6, 0x0, @ipv4={'\x00', '\xff\xff', @multicast1}, @dev={0xfe, 0x80, '\x00', 0x2d}, {[@fragment={0x0, 0x0, 0x6, 0x1, 0x0, 0x1b, 0x65}, @routing={0x33, 0x4, 0x2, 0x7, 0x0, [@dev={0xfe, 0x80, '\x00', 0x44}, @remote]}, @dstopts={0x6, 0xd, '\x00', [@generic={0x2, 0x3e, "637fbdb0636418eab2f802e7c65a6e7b9987c327c9d656621fe035f95b80b6e081e4e29859c361a65d1ece6b3429cc1f7ef2dde5ba06de64b0354724aae7"}, @pad1, @jumbo={0xc2, 0x4, 0x9}, @jumbo={0xc2, 0x4, 0x80000000}, @pad1, @pad1, @generic={0x2, 0xb, "f4da231048d8309d0f3930"}, @enc_lim={0x4, 0x1, 0xc}, @pad1, @pad1]}], @payload_direct={{{{0x26, 0x0, 0x0, 0x0, 0x0, 0x8, 0x1, 0x2, 0x7, 0x0, 0x2, 0x0, 0x0, 0x3, 0x2468, 0x3, 0x4, 0x4e23, 0x4e23}, 0x1, 0x1}}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}}}}, 0xfa) r1 = socket$vsock_stream(0x28, 0x1, 0x0) ioctl$XFS_IOC_FD_TO_HANDLE(r1, 0xc038586a, &(0x7f00000012c0)={r0, &(0x7f00000011c0)=')}:\x00', 0x20800, &(0x7f0000001200)={@_ha_fsid={[0x9, 0x6]}, {0x1, 0x8, 0x49, 0x5}}, 0xfffffffb, &(0x7f0000001240)={@_ha_fsid}, &(0x7f0000001280)=0xfffffff7}) ioctl$BTRFS_IOC_GET_SUPPORTED_FEATURES(r2, 0x80489439, &(0x7f0000001300)) (async) getsockopt$inet_sctp_SCTP_FRAGMENT_INTERLEAVE(r2, 0x84, 0x12, &(0x7f0000001380), &(0x7f00000013c0)=0x4) (async) getsockopt$TIPC_CONN_TIMEOUT(r2, 0x10f, 0x82, &(0x7f0000001400), &(0x7f0000001440)=0x4) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFBRDADDR(r3, 0x891a, &(0x7f0000001480)={'veth1_to_bond\x00', {0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x3c}}}) syz_genetlink_get_family_id$batadv(&(0x7f00000014c0), r2) (async) sendmsg$IPCTNL_MSG_CT_GET(r2, &(0x7f00000015c0)={&(0x7f0000001500)={0x10, 0x0, 0x0, 0x34f70b4d24799844}, 0xc, &(0x7f0000001580)={&(0x7f0000001540)={0x2c, 0x1, 0x1, 0x101, 0x0, 0x0, {0xa, 0x0, 0x8}, [@CTA_TUPLE_ORIG={0x18, 0x1, 0x0, 0x1, [@CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x2}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x6}}]}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40000}, 0x40800) sendmsg$DEVLINK_CMD_TRAP_POLICER_GET(r2, &(0x7f0000001780)={&(0x7f0000001600)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000001740)={&(0x7f0000001640)={0xd8, 0x0, 0x100, 0x70bd2a, 0x25dfdbfe, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x8e, 0x2}}, {@pci={{0x8}, {0x11}}, {0x8, 0x8e, 0x3}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x8e, 0x2}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x8e, 0x1}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x8e, 0x1}}]}, 0xd8}, 0x1, 0x0, 0x0, 0x4040040}, 0x4004080) (async) r4 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f00000017c0)={0xffffffffffffffff, 0x1, 0x18}, 0xc) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001a00)={0x11, 0x18, &(0x7f0000001800)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x80000001, 0x0, 0x0, 0x0, 0x1000}, {{0x18, 0x1, 0x1, 0x0, r4}}, {}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r2}, {}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}], {{}, {}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f00000018c0)='GPL\x00', 0x8, 0x1f, &(0x7f0000001900)=""/31, 0x40f00, 0x18, '\x00', 0x0, 0x0, r2, 0x8, &(0x7f0000001940)={0x8, 0x1}, 0x8, 0x10, &(0x7f0000001980)={0x0, 0x9, 0x3, 0xda37}, 0x10, 0x0, 0x0, 0x1, 0x0, &(0x7f00000019c0)=[{0x0, 0x5, 0x9, 0x4}], 0x10, 0x27b3}, 0x94) (async) recvfrom$inet6(r2, &(0x7f0000001ac0)=""/85, 0x55, 0x40000020, 0x0, 0x0) (async) ioctl$PPPIOCSDEBUG(r2, 0x40047440, &(0x7f0000001b40)=0xb) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r3, 0x8933, &(0x7f0000001bc0)={'batadv_slave_1\x00', 0x0}) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r2, 0x89f3, &(0x7f0000001c80)={'syztnl1\x00', &(0x7f0000001c00)={'ip6tnl0\x00', 0x0, 0x29, 0x9, 0x0, 0xe, 0x27, @empty, @mcast2, 0x1, 0x7800, 0x5, 0x2000}}) (async, rerun: 32) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r2, 0x89f2, &(0x7f0000001d40)={'ip6_vti0\x00', &(0x7f0000001cc0)={'syztnl1\x00', 0x0, 0x4, 0x0, 0x8, 0x2, 0x2, @ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}, @mcast1, 0x7, 0x7800, 0x9, 0xf}}) (rerun: 32) sendmsg$ETHTOOL_MSG_PAUSE_GET(r2, &(0x7f0000001e40)={&(0x7f0000001b80)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000001e00)={&(0x7f0000001d80)={0x60, 0x0, 0x800, 0x70bd2c, 0x25dfdbfe, {}, [@HEADER={0x4c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vlan0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r5}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r6}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bond0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}]}]}, 0x60}, 0x1, 0x0, 0x0, 0x40000}, 0x24048810) ioctl$sock_inet_udp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000001e80)) sendmsg$RDMA_NLDEV_CMD_RES_GET(r2, &(0x7f0000001f80)={&(0x7f0000001ec0), 0xc, &(0x7f0000001f40)={&(0x7f0000001f00)={0x28, 0x1409, 0x1, 0x70bd27, 0x25dfdbfc, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0x8}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}]}, 0x28}, 0x1, 0x0, 0x0, 0xc005}, 0x4000) (async) r8 = accept4$unix(r1, &(0x7f0000001fc0)=@abs, &(0x7f0000002040)=0x6e, 0x80800) ioctl$OCFS2_IOC_GROUP_ADD(r8, 0x40186f02, &(0x7f0000002080)={0x5a, 0xb19, 0x3, 0x800}) (async, rerun: 64) r9 = syz_genetlink_get_family_id$gtp(&(0x7f0000002100), r2) (rerun: 64) sendmsg$GTP_CMD_DELPDP(r2, &(0x7f0000002200)={&(0x7f00000020c0)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f00000021c0)={&(0x7f0000002140)={0x50, r9, 0x10, 0x70bd26, 0x25dfdbfb, {}, [@GTPA_I_TEI={0x8, 0x8, 0x4}, @GTPA_FLOW={0x6, 0x6, 0x3}, @GTPA_FLOW={0x6, 0x6, 0x2}, @GTPA_MS_ADDRESS={0x8, 0x5, @loopback}, @GTPA_MS_ADDR6={0x14, 0xc, @ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}}, @GTPA_I_TEI={0x8, 0x8, 0x2}]}, 0x50}, 0x1, 0x0, 0x0, 0x8080}, 0x40080) (async) ioctl$XFS_IOC_START_COMMIT(r4, 0x80585882, &(0x7f0000002240)) socket$nl_xfrm(0x10, 0x3, 0x6) (async) sendmsg$IPVS_CMD_GET_DEST(r2, &(0x7f0000002400)={&(0x7f00000022c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f00000023c0)={&(0x7f0000002340)={0x48, 0x0, 0x100, 0x70bd27, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_DEST={0x24, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x6}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0xd97}, @IPVS_DEST_ATTR_TUN_FLAGS={0x6, 0xf, 0x81}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x80}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x587}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0xd}]}, 0x48}, 0x1, 0x0, 0x0, 0x4}, 0x4004004) 1.760466151s ago: executing program 2 (id=5591): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) sendto$inet6(r0, &(0x7f0000000500)="a4", 0x34000, 0x2000c851, &(0x7f0000000140)={0xa, 0x4e23, 0x0, @loopback, 0xffffffff}, 0x1c) setsockopt$sock_timeval(r0, 0x1, 0x15, &(0x7f0000000300)={0x0, 0x2710}, 0x10) r1 = socket$vsock_stream(0x28, 0x1, 0x0) bind$vsock_stream(r1, &(0x7f0000000440), 0x10) ioctl$XFS_IOC_START_COMMIT(r0, 0x80585882, &(0x7f0000000040)={0xffffffffffffffff}) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$TIPC_NL_KEY_SET(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB='h\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="0100000000000000000017000000540006803c00040067636d286165732900000000000000000000000000000000000000000000000014000000e3de3d7b4cd07ec3ee777de774fc7987cca41989140003"], 0x68}, 0x1, 0x0, 0x0, 0x4}, 0x4008014) sendmsg$TIPC_NL_BEARER_SET(r2, &(0x7f0000000980)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000940)={&(0x7f0000000780)={0x184, r4, 0x200, 0x70bd2c, 0x25dfdbfc, {}, [@TIPC_NLA_NET={0x2c, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x10000}, @TIPC_NLA_NET_ID={0x8, 0x1, 0xfffffffe}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x3}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x9}]}, @TIPC_NLA_BEARER={0x78, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_PROP={0x54, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xfffffffa}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8c2a}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xe877}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xffffffff}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1c}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x6}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7}]}, @TIPC_NLA_BEARER_NAME={0xe, 0x1, @l2={'eth', 0x3a, 'xfrm0\x00'}}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @l2={'eth', 0x3a, 'batadv0\x00'}}]}, @TIPC_NLA_MEDIA={0x88, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_PROP={0x4c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x6}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xb}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x2}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x4}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xc}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xcd53}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5}]}, @TIPC_NLA_MEDIA_PROP={0x14, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5}]}, @TIPC_NLA_MEDIA_PROP={0x1c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2cb8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x80}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x19}]}, @TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}]}, @TIPC_NLA_MON={0x44, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_REF={0x8, 0x2, 0x1}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x12}, @TIPC_NLA_MON_REF={0x8, 0x2, 0xffffffff}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x9}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x7}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x6684}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x1d6}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0xfffffff0}]}]}, 0x184}, 0x1, 0x0, 0x0, 0x90}, 0x0) listen(r1, 0x5) r5 = socket$vsock_stream(0x28, 0x1, 0x0) accept4$unix(r1, 0x0, 0x0, 0x0) sendto$packet(r5, &(0x7f0000000600)="5f0efc3e1792a50972d2eb21bdff9ca4ac804c2847689e7fd3f3fe7bf05ddc63ff512d4074687760a5fbd1fc97777a6e55123f04cc8437b15f4b2c6f5027dcea15b6658d", 0xffffff3d, 0x0, 0x0, 0xffffffffffffff10) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0xc0a41, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0x4002}) write$tun(r6, &(0x7f0000000740)=ANY=[@ANYBLOB="00000018030403000700c500"], 0xe7) sendto$inet6(r0, &(0x7f0000000240)="d3", 0x1, 0x81, &(0x7f0000000280)={0xa, 0x4e24, 0x8, @remote, 0x7}, 0x1c) 1.759859163s ago: executing program 0 (id=5592): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0xb, 0x3, 0x8) sendmsg$IPVS_CMD_SET_INFO(r1, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) r3 = openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000040), 0x2, 0x0) r4 = socket$inet6(0xa, 0x5, 0x0) setsockopt$sock_int(r4, 0x1, 0xf, &(0x7f0000fee000)=0x3fa, 0x4) bind$inet6(r4, &(0x7f0000000100)={0xa, 0x4e23, 0x8001, @empty, 0xffffff5d}, 0x1c) listen(r4, 0x50) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000340)={'wpan3\x00', 0x0}) r6 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_DEL_SEC_DEVKEY(0xffffffffffffffff, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000640)={0x44, r6, 0x1, 0x70bd28, 0x25dfdbfd, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r5}, @NL802154_ATTR_SEC_DEVKEY={0x28, 0x2f, 0x0, 0x1, [@NL802154_DEVKEY_ATTR_ID={0x18, 0x3, 0x0, 0x1, [@NL802154_KEY_ID_ATTR_IMPLICIT={0xc, 0x3, 0x0, 0x1, [@NL802154_DEV_ADDR_ATTR_PAN_ID={0x6, 0x1, 0xffff}]}, @NL802154_KEY_ID_ATTR_MODE={0x8}]}, @NL802154_DEVKEY_ATTR_EXTENDED_ADDR={0xc, 0x2, {0xaaaaaaaaaaaa0302}}]}]}, 0x44}, 0x1, 0x0, 0x0, 0x200048c3}, 0x20000094) sendmsg$IEEE802154_LLSEC_DEL_KEY(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000001c0), 0xc, &(0x7f0000000580)={&(0x7f0000000540)={0x3c, 0x0, 0x20, 0x70bd27, 0x25dfdbff, {}, [@IEEE802154_ATTR_LLSEC_KEY_MODE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0102}}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0102}}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r5}]}, 0x3c}, 0x1, 0x0, 0x0, 0x40000}, 0x20008845) r7 = socket$inet6(0xa, 0x5, 0x0) setsockopt$sock_int(r7, 0x1, 0xf, &(0x7f0000fee000)=0x3fa, 0x4) bind$inet6(r7, &(0x7f0000000140)={0xa, 0x4e23, 0x5, @empty, 0x4}, 0x1c) listen(r7, 0x50) close(0x3) write$cgroup_type(r3, &(0x7f0000000140), 0x9) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000600)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c0002000800010005"], 0x3c}}, 0x40010) mmap(&(0x7f0000000000/0x95c000)=nil, 0x95c000, 0x200000b, 0x8c4b815a5465c2b2, r0, 0x2000) r8 = socket$alg(0x26, 0x5, 0x0) bind$alg(r8, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-twofish-3way\x00'}, 0x58) setsockopt$ALG_SET_KEY(r8, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r9 = accept4(r8, 0x0, 0x0, 0x80800) setsockopt$sock_int(r9, 0x1, 0x7, &(0x7f00000014c0)=0x10000b, 0x4) sendmmsg$alg(r9, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) socket$netlink(0x10, 0x3, 0xb) recvmsg(r7, &(0x7f00000002c0)={0x0, 0xfffffffffffffde4, &(0x7f00000001c0)}, 0x0) sendmsg$nl_route(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)=ANY=[@ANYBLOB="54000d0000001ffffcffb80dfd716a91fb7d9bfd", @ANYRES32=0x0, @ANYBLOB="0000010000000000240012800b00010067726574617000001400028008000700ac141428050009000900000008000a00", @ANYRES32=r2, @ANYBLOB="08001f0009000000"], 0x54}, 0x1, 0x0, 0x0, 0x40}, 0x0) 1.759319406s ago: executing program 3 (id=5593): socket$netlink(0x10, 0x3, 0x0) (async) r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x1c}}, 0x0) (async) sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x1c}}, 0x0) r2 = socket(0x10, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x10, 0x803, 0x2) r5 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000380)=ANY=[@ANYBLOB="1400000042000501"], 0x14}}, 0x44014) recvmmsg(r5, &(0x7f0000000000)=[{{0x0, 0x0, &(0x7f0000000040)=[{&(0x7f00000004c0)=""/4082, 0xff2}], 0x1}, 0xfffffffc}], 0x1, 0x2, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), r4) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000003c0)=0x14) (async) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000003c0)=0x14) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0xc, 0x17, &(0x7f0000000500)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x2000000}, {}, {}, [@ringbuf_query={{}, {}, {0x85, 0x0, 0x0, 0x17}}, @ringbuf_query], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x84}}}, 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x6, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmsg$nl_route_sched(r2, &(0x7f0000005840)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000300)=@newqdisc={0x48, 0x24, 0x5820a61ca228651, 0x0, 0x2, {0x0, 0x0, 0x0, r6, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x7fffffff, 0x1}}]}}]}, 0x48}}, 0x8d0) (async) sendmsg$nl_route_sched(r2, &(0x7f0000005840)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000300)=@newqdisc={0x48, 0x24, 0x5820a61ca228651, 0x0, 0x2, {0x0, 0x0, 0x0, r6, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x7fffffff, 0x1}}]}}]}, 0x48}}, 0x8d0) sendmsg$nl_route_sched(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000540)=@newtfilter={0xd8, 0x28, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r6, {0xc}, {0xfff2}, {0xfff1, 0x3d}}, [@filter_kind_options=@f_bpf={{0x8}, {0xac, 0x2, [@TCA_BPF_ACT={0x4c}, @TCA_BPF_NAME={0xc, 0x7, './file0\x00'}]}}]}, 0xd8}}, 0x0) (async) sendmsg$nl_route_sched(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000540)=@newtfilter={0xd8, 0x28, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r6, {0xc}, {0xfff2}, {0xfff1, 0x3d}}, [@filter_kind_options=@f_bpf={{0x8}, {0xac, 0x2, [@TCA_BPF_ACT={0x4c}, @TCA_BPF_NAME={0xc, 0x7, './file0\x00'}]}}]}, 0xd8}}, 0x0) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r7, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000340)={0x5c, 0x2, 0x6, 0x101, 0x0, 0x0, {0x0, 0x0, 0x9}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_DATA={0x14, 0x7, 0x0, 0x1, [@IPSET_ATTR_BUCKETSIZE={0x5, 0x15, 0x16}, @IPSET_ATTR_HASHSIZE={0x8}]}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_REVISION={0x5, 0x4, 0x1}, @IPSET_ATTR_TYPENAME={0xd, 0x3, 'hash:net\x00'}]}, 0x5c}, 0x1, 0x0, 0x0, 0x24004804}, 0x20004000) getsockname$packet(r1, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32=r8, @ANYBLOB="f5ff0f00252155b21c0012000c000100626f6e64000000000c0002000800010001"], 0x3c}}, 0x40000) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000300)=@newlink={0x3c, 0x10, 0x503, 0xfffffffc, 0x700, {0x0, 0x0, 0x0, 0x0, 0x0, 0x1006}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @veth={{0x9}, {0x4, 0x2, 0x0, 0x1, @void}}}, @IFLA_MASTER={0x8, 0xa, r8}]}, 0x3c}, 0x1, 0x0, 0x0, 0x800}, 0x440b0) (async) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000300)=@newlink={0x3c, 0x10, 0x503, 0xfffffffc, 0x700, {0x0, 0x0, 0x0, 0x0, 0x0, 0x1006}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @veth={{0x9}, {0x4, 0x2, 0x0, 0x1, @void}}}, @IFLA_MASTER={0x8, 0xa, r8}]}, 0x3c}, 0x1, 0x0, 0x0, 0x800}, 0x440b0) 1.726937347s ago: executing program 4 (id=5594): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x8890}, 0x20004450) sendmsg$NFT_MSG_GETRULE(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYRES64=r0, @ANYRES16], 0x38}, 0x1, 0x0, 0x0, 0x20040874}, 0x44054) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket$packet(0x11, 0x2, 0x300) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=@base={0x9, 0x7, 0x7fff, 0x7, 0x0, 0x1}, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000001c0)={{r3, 0xffffffffffffffff}, &(0x7f00000002c0), &(0x7f0000000280)}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$sock_attach_bpf(r2, 0x1, 0x32, &(0x7f0000000180)=r5, 0x4) sendmsg$DEVLINK_CMD_RATE_SET(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000500)={0x34, 0x0, 0x1, 0xffffffff, 0x0, {0x2f}, [@handle=@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}]}, 0x34}, 0x1, 0x0, 0x0, 0x20000041}, 0x0) r6 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000300), r1) r7 = socket(0x10, 0x3, 0x0) r8 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000240)={'veth0_virt_wifi\x00', 0x0}) r10 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000006c0)={0x2, 0x4, 0x8, 0x1, 0x80, r3, 0x6, '\x00', r9, 0xffffffffffffffff, 0x2, 0x1, 0x2}, 0x50) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000940)=@bpf_ext={0x1c, 0x10, &(0x7f0000000540)=@framed={{0x18, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x2}, [@generic={0x4, 0x8, 0x6, 0x9, 0x6}, @jmp={0x5, 0x0, 0xd, 0xa, 0x9, 0x80, 0xffffffffffffffff}, @map_idx_val={0x18, 0x8, 0x6, 0x0, 0x2, 0x0, 0x0, 0x0, 0x7f}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r4}}]}, &(0x7f00000005c0)='syzkaller\x00', 0x1800000, 0xf, &(0x7f0000000600)=""/15, 0x41100, 0x0, '\x00', r9, 0x0, r1, 0x8, &(0x7f0000000640)={0x9, 0x1}, 0x8, 0x10, &(0x7f0000000680)={0x3, 0x10, 0xfffffff9, 0x6}, 0x10, 0xadf8, 0xffffffffffffffff, 0x6, &(0x7f0000000740)=[r10], &(0x7f0000000780)=[{0x3, 0x3, 0xf, 0x8}, {0x1, 0x7, 0x6, 0x6}, {0x1, 0x1, 0xa, 0x7}, {0x2, 0x4, 0x10}, {0x1, 0x2, 0x9}, {0x1, 0x2, 0x0, 0x5}], 0x10, 0x7f}, 0x94) sendmsg$nl_route_sched(r7, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=@newqdisc={0x88, 0x24, 0xf0b, 0x70bd26, 0x0, {0x0, 0x0, 0x0, r9, {0x0, 0xfff2}, {0xffff, 0xffff}, {0x8}}, [@qdisc_kind_options=@q_mqprio={{0xb}, {0x58, 0x2, {{0x2, [], 0x0, [0x1, 0x1, 0xfffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5c4, 0x0, 0x0, 0x0, 0x1000], [0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x198e, 0x0, 0x0, 0x0, 0x0, 0x1000]}}}}]}, 0x88}, 0x1, 0x0, 0x0, 0x10}, 0x8) sendmsg$ETHTOOL_MSG_CHANNELS_GET(r1, &(0x7f00000003c0)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x30, r6, 0x100, 0x70bd26, 0x25dfdbfe, {}, [@HEADER={0x1c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r9}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}]}]}, 0x30}, 0x1, 0x0, 0x0, 0x40}, 0x20004015) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000480)={0x18, 0x6, &(0x7f00000002c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x1000}, [@initr0={0x18, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x7}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffffb}, @map_idx_val={0x18, 0x4, 0x6, 0x0, 0x3, 0x0, 0x0, 0x0, 0x2}]}, &(0x7f0000000080)='syzkaller\x00', 0x3, 0x27, &(0x7f0000000000)=""/114}, 0xa8) writev(r1, &(0x7f0000000080)=[{&(0x7f0000000000)=')', 0x1}], 0x1) r11 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), r11) 1.530353177s ago: executing program 0 (id=5595): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000500)=@newqdisc={0x2c, 0x24, 0x700, 0x7ffffffd, 0xffffffff, {0x60, 0x0, 0x0, 0x0, {0xffff, 0x2}, {0xfff2, 0xe}, {0xfff3, 0x9}}, [@TCA_RATE={0x6, 0x5, {0x4, 0x1}}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000050}, 0x2000c8d1) r0 = socket$inet(0xa, 0x1, 0x0) setsockopt$IP_VS_SO_SET_TIMEOUT(r0, 0x0, 0x4, 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000002900)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)={0x60, 0x2, 0x6, 0x5, 0x0, 0x0, {}, [@IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_DATA={0x14, 0x7, 0x0, 0x1, [@IPSET_ATTR_BUCKETSIZE={0x5, 0x15, 0x13}, @IPSET_ATTR_HASHSIZE={0x8}]}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_TYPENAME={0x12, 0x3, 'hash:net,port\x00'}]}, 0x60}}, 0x40000010) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000000)={0x0, 0x0, 0x0, &(0x7f0000010040), 0x0, 0xffffffffffffffff, 0x4}, 0x38) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000940)='hugetlb.2MB.usage_in_bytes\x00', 0x26e1, 0x0) close(r2) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000040), r3) sendmsg$IEEE802154_ADD_IFACE(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)=ANY=[@ANYRESDEC=r4, @ANYRESDEC=r3], 0x34}, 0x1, 0x0, 0x0, 0xb0ab9eb10ef5d9e3}, 0x20048084) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000500)) ioctl$SIOCSIFHWADDR(r2, 0x8b34, &(0x7f0000000000)={'wlan1\x00', @random="000500000020"}) 1.371778156s ago: executing program 4 (id=5596): r0 = socket$kcm(0x21, 0x3, 0xa) (async) r1 = socket$nl_route(0x10, 0x3, 0x0) (async) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='cgroup.controllers\x00', 0x275a, 0x0) close(r2) (async) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$TUNSETNOCSUM(r2, 0x400454c8, 0x1) (async) listen(r3, 0x0) (async) r4 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000440)={&(0x7f0000000340)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x6c, 0x6c, 0xc, [@restrict={0x10, 0x0, 0x0, 0xb, 0x1}, @struct={0x9, 0x6, 0x0, 0x4, 0x0, 0x7, [{0x10, 0x5, 0x2}, {0x5, 0x4, 0x2}, {0xc, 0x3, 0xa}, {0x10, 0x5, 0xff}, {0x0, 0x3, 0x7}, {0x4, 0x0, 0x6}]}, @fwd={0xb}]}, {0x0, [0x2e, 0x61, 0x2e, 0x0, 0x61, 0x30, 0x61, 0x61, 0x61, 0x0]}}, &(0x7f0000000400)=""/28, 0x90, 0x1c, 0x0, 0x3, 0x10000, @value=r2}, 0x28) bpf$MAP_CREATE(0x0, &(0x7f0000000500)=@bloom_filter={0x1e, 0x2, 0x7, 0xe6, 0x10800, r2, 0x6, '\x00', 0x0, r4, 0x1, 0x2, 0x2, 0xb, @void, @value, @value=r2}, 0x50) (async) openat$cgroup_int(r2, &(0x7f0000000140)='net_cls.classid\x00', 0x2, 0x0) (async) r5 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=@base={0xf, 0x4, 0x4, 0x8000012, 0x0, 0xffffffffffffffff, 0xfffffffe}, 0x50) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000a80)={r5, &(0x7f0000000940), &(0x7f0000000a40)=@tcp6=r3}, 0x20) (async) sendmsg$sock(r2, &(0x7f0000000280)={&(0x7f00000000c0)=@nl=@unspec, 0x80, &(0x7f0000000140), 0x0, &(0x7f00000001c0)=[@timestamping={{0x14, 0x1, 0x25, 0x5}}], 0x18}, 0x0) (async) r6 = socket$kcm(0x11, 0x3, 0x0) sendmsg$kcm(r6, &(0x7f00000000c0)={&(0x7f0000000580)=@pppoe={0x18, 0x0, {0x4, @random="681801de1ef8", 'veth0_virt_wifi\x00'}}, 0x80, 0x0}, 0x404) (async) connect$unix(r2, &(0x7f0000000940)=@file={0x0, './file0\x00'}, 0x6e) (async) ioctl$sock_SIOCINQ(r2, 0x541b, &(0x7f0000000040)) (async) syz_emit_ethernet(0xbe, &(0x7f0000000000)={@dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xc}, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0xb0, 0x0, 0x0, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x4e20, 0x9c, 0x0, @wg=@initiation={0x1, 0x0, "7b4b142b7461fd777b1c012bd14efb9f49fcdb8f080c26a04883ad5c8c82b8af", "584cbf2649a50f2dbc43efa8698d0a881c51852e4451b57d037ad3c04594282423424d00", "bcfd56f1375461caaa2f19935e6996c7096ffeeb0300000000000064", {"9a3bfbc1f39cb307b3472eb9cdb042d2", "643fcbb2c5a57df67d544af6e8dafe09"}}}}}}}, 0x0) (async) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r8, 0x1, 0x1a, &(0x7f0000000000)={0x3, &(0x7f00000000c0)=[{0x20, 0x0, 0x0, 0xfffff00c}, {0x20, 0x0, 0x0, 0xfffff038}, {0x6, 0x0, 0x4}]}, 0x10) (async) sendmmsg(r7, &(0x7f0000001100)=[{{0x0, 0x0, &(0x7f0000000d40)=[{&(0x7f0000000680)="3f0dae93", 0x4}], 0x1}}], 0x1, 0x44008000) (async) r9 = socket(0x2, 0x1, 0x0) connect$inet(r9, &(0x7f0000000080)={0x2, 0x4e20, @local}, 0x10) (async) setsockopt(r9, 0x1, 0x9, &(0x7f0000000140)="3f14b0f1", 0x4) setsockopt$inet6_tcp_int(r9, 0x6, 0x4, &(0x7f0000000000)=0x7, 0x4) (async) ioctl$BTRFS_IOC_BALANCE_CTL(r9, 0x40049421, 0x1) (async) sendmsg$nl_route(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="640000001000ffff25bd7000fddbdf2500000000", @ANYRES32=r0, @ANYBLOB="7a0a0500212b0000440012800b000100697036746e6c00003400028014000300ff00000000000002040082620000003f14000200fe80000000000000000000000000000f08000100"], 0x64}}, 0x24000000) 1.357392288s ago: executing program 4 (id=5597): r0 = socket$nl_route(0x10, 0x3, 0x0) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x2000004, 0x3b071, 0xffffffffffffffff, 0x0) pipe(0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000000c0)={'veth0_to_team\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000040)=ANY=[@ANYBLOB="680000001000030500"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000400012800c0001006d6163766c616e00300002800800010010000000100005800a000400aaaaaa30aabb000008000300030000000a000400aaaaaaaab1aa000008000500", @ANYRES32=r2], 0x68}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000040)=ANY=[], 0x68}}, 0x20000880) r3 = socket(0x10, 0x3, 0x0) sendmmsg(r3, &(0x7f0000000000), 0x4000000000001f2, 0x0) ioctl$BTRFS_IOC_QUOTA_CTL(r1, 0xc0109428, &(0x7f0000000100)={0x3, 0xd7}) 1.248377783s ago: executing program 3 (id=5598): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128-generic\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f0000000140)="2c385aa3d49100dc6626c892b6bc436a", 0x10) r3 = accept4(r2, 0x0, 0x0, 0x0) sendmsg$alg(r3, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) recvmmsg(r3, &(0x7f0000002a80)=[{{0x0, 0x0, &(0x7f0000000540)=[{&(0x7f0000001a80)=""/4096, 0x1000}, {&(0x7f00000006c0)=""/57, 0x39}, {&(0x7f0000000300)=""/171, 0xab}, {&(0x7f0000000200)=""/55, 0x37}, {&(0x7f00000003c0)=""/213, 0xd5}, {&(0x7f00000004c0)=""/11, 0xb}, {&(0x7f0000000500)=""/29, 0x1d}], 0x7}, 0x3}, {{0x0, 0x0, &(0x7f00000007c0)=[{&(0x7f0000000900)=""/210, 0xd2}], 0x1}}], 0x2, 0x10100, 0x0) sendmsg$nl_route_sched_retired(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000012100), 0xe078}}, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)={0x30, 0x40, 0x119, 0xfffffffe, 0x25dfdbfb, {0x1, 0x7c}, [@nested={0xc, 0x141, 0x0, 0x1, [@typed={0x8, 0xa, 0x0, 0x0, @str=',\xee^\x00'}]}, @nested={0xc, 0x1, 0x0, 0x1, [@typed={0x6, 0x6, 0x0, 0x0, @str='e1'}]}, @nested={0x4, 0x2}]}, 0x30}, 0x1, 0x0, 0x0, 0x48814}, 0xc000) setsockopt$sock_attach_bpf(r1, 0x1, 0x4c, &(0x7f0000000000), 0x4) sendmsg$inet(r0, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) recvmsg$unix(r1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(r5, 0xff07, 0x0) r6 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000780)={0x6, 0x4, &(0x7f0000000580)=ANY=[@ANYBLOB="18020000000000020000000000000000850000001700000095"], &(0x7f00000005c0)='GPL\x00'}, 0x94) r7 = socket(0x10, 0x803, 0x8) sendmsg$IPVS_CMD_SET_INFO(r7, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x2d}, 0x1, 0x0, 0x0, 0x8801}, 0x8000) r8 = socket$netlink(0x10, 0x3, 0x0) getsockname$packet(r7, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r8, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32=r9, @ANYBLOB="00001000252155b21c0012000c000100626f6e64"], 0x3c}}, 0x40000) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000001c0)={r6, r9, 0x25, 0x0, @void}, 0x10) r10 = socket$netlink(0x10, 0x3, 0x0) r11 = socket(0x10, 0x803, 0x4) sendmsg$IPVS_CMD_SET_INFO(r11, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r11, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x66) sendmsg$nl_route(r10, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000004c0)=@newlink={0x50, 0x10, 0xffffff1f, 0x0, 0x80, {0x0, 0x0, 0x0, 0x0, 0x300, 0x17e05}, [@IFLA_MASTER={0x8, 0xa, r12}, @IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @veth={{0x9}, {0x18, 0x2, 0x0, 0x1, @val=@VETH_INFO_PEER={0x14, 0x1, {{0x0, 0x0, 0x0, 0x0, 0x4000, 0x640}}}}}}]}, 0x50}, 0x1, 0x0, 0x0, 0x2000c0c1}, 0x0) r13 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r13, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000140)=@getchain={0x24, 0x11, 0x1, 0x2000000, 0x0, {0x0, 0x0, 0x0, r9, {}, {0x0, 0x3}, {0x4, 0x9}}}, 0x24}}, 0x0) 1.237911029s ago: executing program 0 (id=5599): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000980)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x50) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x30900, 0x0) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000480)={r0, 0xffffffffffffffff}, 0x4) ioctl$BTRFS_IOC_DEFAULT_SUBVOL(r1, 0x40089413, &(0x7f0000000000)=0x1) r2 = socket$pppl2tp(0x18, 0x1, 0x1) r3 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r2, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r3, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x20}}, 0x2}}, 0x2e) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(r5, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000340)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="010026bd7000fedbdf2505000000080009000200000008000c000000000008000b00000000000600010007"], 0x3c}}, 0x20) r6 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r6, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, 0xffffffffffffffff, {0x2, 0x0, @dev}, 0x2}}, 0x2e) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x4, 0x10, &(0x7f0000000140)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000020000007b8a00fe0000000087080000000000007b8af0ff00000000bda100000000000027000000f8ffffffbfa400000000000007040000f0ffffffb70200000000000018230000", @ANYRES32=r1, @ANYBLOB="0000000000000000b704000008000000850000001a00000095"], &(0x7f0000000440)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, @fallback=0x20, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 963.761351ms ago: executing program 0 (id=5600): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), 0xffffffffffffffff) r3 = socket(0x400000000010, 0x3, 0x0) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)=@deltfilter={0x24, 0x2d, 0x1, 0x70bd2b, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, {0xfff3, 0xfff2}, {0xc, 0x10}, {0x2}}}, 0x24}}, 0x0) r4 = socket(0x2, 0x1, 0x0) setsockopt$inet_opts(r4, 0x0, 0xd, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000001c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000fc0)={&(0x7f0000000600)=ANY=[@ANYBLOB='@\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010000000000000000000200000008000300", @ANYRES32=r5, @ANYBLOB="0c00990000000000000000000800a000ea15000008009f0009000000080026000816"], 0x40}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="02000000040000000800000006"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000001000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000c300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="05"], 0x48) r8 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48) r9 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007300000018110000", @ANYRES32=r8], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0xe, '\x00', 0x0, @fallback=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000080)={r9}, 0xc) sendmsg$nl_route_sched(r6, 0x0, 0x20040084) r10 = socket(0x400000000010, 0x3, 0x0) r11 = socket$kcm(0x10, 0x2, 0x0) syz_emit_ethernet(0x46, &(0x7f0000000440)={@broadcast, @remote, @void, {@ipv6={0x86dd, @udp={0x1, 0x6, "7d52f5", 0x10, 0x11, 0x1, @remote, @local, {[], {0x4e24, 0x4e23, 0x10, 0x0, @gue={{0x2}}}}}}}}, 0x0) ioctl$sock_SIOCETHTOOL(r11, 0x89f1, &(0x7f0000000080)={'tunl0\x00', &(0x7f0000000040)=@ethtool_cmd={0x23, 0x8, 0x0, 0x400, 0x0, 0x7e, 0xe7, 0x0, 0x87, 0x0, 0x80000, 0x0, 0x1, 0x8, 0x0, 0x82000045, [0x2, 0x9]}}) r12 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r12, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r10, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000022c0)=@newtfilter={0x90, 0x2c, 0xd3f, 0x30bd2d, 0x25dfdbfd, {0x0, 0x0, 0x0, r13, {0xb, 0xfff3}, {}, {0x8, 0x300}}, [@filter_kind_options=@f_matchall={{0xd}, {0x5c, 0x2, [@TCA_MATCHALL_ACT={0x58, 0x2, [@m_simple={0x54, 0x1, 0x0, 0x0, {{0xb}, {0x28, 0x2, 0x0, 0x1, [@TCA_DEF_PARMS={0x18, 0x2, {0x40, 0x9, 0x20000000, 0xb, 0x7}}, @TCA_DEF_DATA={0xa, 0x3, 'basic\x00'}]}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x1, 0x3}}}}]}]}}]}, 0x90}, 0x1, 0x0, 0x0, 0x10}, 0x0) 643.519971ms ago: executing program 2 (id=5601): r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000180)=0x20800001, 0x4) setsockopt$inet6_int(r0, 0x29, 0x4e, &(0x7f0000000000)=0x1, 0x4) r1 = bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000500)={0xffffffffffffffff, 0x0, 0x2d, 0x0, @val=@netfilter={0xa, 0x4, 0x600, 0x1}}, 0x20) bpf$ITER_CREATE(0x21, &(0x7f0000000080)={r1}, 0x8) r2 = socket$inet_smc(0x2b, 0x1, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000840)=@newqdisc={0x24, 0x14, 0x300, 0x70bd26, 0x0, {0x2, 0x0, 0x0, 0x0, {0xf, 0xb}, {0x0, 0x9}, {0x8, 0x2}}}, 0xfffffffffffffe37}}, 0x4c811) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000840)=ANY=[@ANYBLOB="3c0000002500010125bd7000fbfffffe0b00000008000300470000001f0050"], 0x3c}, 0x1, 0x0, 0x0, 0x4048957}, 0x28040) r4 = socket(0x8000000010, 0x2, 0x0) write(r4, &(0x7f00000002c0)="fc0000001c000704ab5b2509b868030002ab087a0100000001481093210001c0f0030584050060100000000000039815fa2c53c28648000000b9d95662537a00bc000c00f0ff7f0000b400600033d44000040560916a0033f436313012dafd5a32e273fc83ab82d710f74cec184406f90d435ef8b29d3ef3d92c94170e5bba2e177312e081bea05d3a021e8ca062914a46ccfc510bb73c9455cdc8363ae4f5df77bc4cfd6239ec2a0f0d1bcae5fa0f5f9dcdd51af51af8502943283f4bb102b2b8f5566791cf190201ded815b2ccd243f395ed94e0ad91bd6433802e0784f2013cd1890058a10000c880ac801fe4af000049f0d4796f0000090548de", 0xfc) r5 = socket(0x840000000002, 0x3, 0x100) connect$inet(r5, &(0x7f0000000080)={0x2, 0x0, @local}, 0x10) sendmmsg$inet(r5, &(0x7f0000005240)=[{{0x0, 0x0, 0x0}, 0xfffffdef}], 0x4000095, 0x0) bpf$MAP_CREATE_RINGBUF(0x0, 0x0, 0x0) r6 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSARP(r6, 0x8955, &(0x7f00000003c0)={{0x2, 0x4e20, @empty}, {0x20000010304, @local}, 0x6, {0x2, 0x4e20, @rand_addr=0x64010101}}) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000d80)={0x18, 0x5, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0xb4a02fe0ce239f81, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xa}, 0x94) bpf$PROG_LOAD(0x5, 0x0, 0x0) write(r2, &(0x7f00000000c0)="fe8045c3bbbead06621e35023ec7cb3eba66cbb43f5fd9b0d3a425a20080d5fb73e23bfb9e4f39729aa4e67185c47cc8f896d1f16066b9802faf", 0x3a) ioctl$sock_bt_hci(0xffffffffffffffff, 0x400448c9, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x80, @loopback={0x0, 0xa8aaaafffeaaaa1e}, 0x8000}, 0x1c) listen(r0, 0xfffffffe) 538.792818ms ago: executing program 3 (id=5602): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r1, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c0002000800010006"], 0x3c}}, 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=ANY=[@ANYBLOB="6400000010001fff26e53f6c0fdc86dc742ee0fe2148cabd70000100000000000000", @ANYRES32=0x0, @ANYBLOB="00000000000000003c0012800b00010067656e65766500002c00028005000400010000000500090001000000080001000000000005000c0001000000060005004e20000008000a00", @ANYRES32=r2, @ANYBLOB], 0x64}, 0x1, 0x0, 0x0, 0x40000}, 0x0) 475.88969ms ago: executing program 0 (id=5603): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000340)={0x1c, 0x46, 0x107, 0x70bd28, 0x0, {0x1, 0x7c}, [@nested={0x8, 0x3, 0x0, 0x1, [@nested={0x4, 0x59}]}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4048080}, 0x20000000) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000080)={0x1, 0x4, &(0x7f0000000000)=@framed={{0x18, 0x0, 0x0, 0x0, 0x30}, [@alu={0x4, 0x0, 0x9, 0x0, 0x0, 0x1, 0xffffffffffffffff}]}, &(0x7f00000002c0)='GPL\x00', 0xf}, 0x94) 442.550521ms ago: executing program 4 (id=5604): r0 = socket$pptp(0x18, 0x1, 0x2) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$devlink(&(0x7f0000000380), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RATE_NEW(r1, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000000)={0x3c, r2, 0x905, 0x0, 0x0, {0x24}, [@handle=@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, @DEVLINK_ATTR_PORT_INDEX={0x8, 0x3, 0x1}]}, 0x3c}}, 0x0) mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x800005, 0x32, r0, 0x852ac000) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000001000)=ANY=[@ANYBLOB="b7020000910c0000bfa30000000000000703000000feffff7a0af0ff0d00000079a4f0ff00000000b7060000ffffffff2d6405000000000065040400010001010404000009000000b7030000010000006a0a00fe000000008500000032000000b700000001000000950000000000000075cdc4b57b0c65752a3ad50000007ddd0000cb4500639100002000000000000000ff7f0000b52f17cee19d0001000000000000000000cb04fcbb0b9bafe3ba431351a58a885ba9918d37b056b9bbd11b6b9f6cf7db6d574620260000000000008062d77e84cef4a2ab938f65aac33c4d620de2c9b7dc10d7d313f9f57606b83b994fb484510bef2e4872f5c2fe6faaf75e5cc4051ade12f41deff6df6a936b4ec3827c739bb39aad16cc75fe369258673b5df11cc2afb53611cc32a790bc0b80e80eae8f5e64be2c9d2d29db3d36dd015c7bd3f15aa6aadbeab2a01685108e61aa00000000690e000000000000008b798b4f7458d1863cc67c4c6a06fa28e5216f601b19db1af1b5d356d0f062137d866d11be4ba3f0151fdbbd4e97d62ecc645e143a60f1c6edc7a65d073909826151e2b42bf0ed0c8cef3ba2a730a00c87c493db845b10e9468bda6f82881eb8c9cfa72b08eecc952a3fd2c46f3c1cde71a19d1a2982492a210e00d2bfea3b8d188df2eff8d56aaae7d32a2e183722537395019f02ec4b85f6aad7faca088de9b26797a8446b16c28d85f225992dbdd5bb01ba51508951c7a7d6ca0916c3a12912715649c2b1c7192a4251b59d378d0616a48c7957e122665c8b7e89eddfc3783f6c9129a7c5f8ee5f50579e2f838f7eb12f63be72a3d817b324d6e417b1c2cbfdcada0a16e31790e26cf19588a7e0496ee2782224cf30f810da86cf1a3204f4c9404f5d7321a4fefc4d1c9139ca4b65b99909950000006b42077ca60fdecb2717e21f8f187b1866108b32176066599783568628f0309c3a01716d3706e1fa89917e131f4034a8383e99c3568fd04201b37cd92ca6ebf94a2d8310f7032775cfd75652f87b039d5430b3c6643e9146d247714358d8b170c3b5cad11f72cd9d88e56b95fe9f3de5cfcfa5c1da8ba181580d9db035efe38834de171b64f4b4c1b242786dcc5679e3d0613cdf05b02d7ad4f3b8af27a696e9b8809c2d68fddfcbd451e81d37c11f95094b91fff61ab9e69780b133d1dbca5a78695131c34c855dd793f90ca3973a4bd5606151b3600373d2bbfb7b3638e713e7275af06107949ff5dffe24d3c448ae6e4646b346fe0a21eef1e55d0659eac930d00000000000ff52b98317c45417b900a47c1ae1103c09fc173c1cf28bf7ef7a61523c6b2dbb35f5ae29877bb8e1b3e257056c0d205d391ed7b2089a72a93885b9fc8430ff"], &(0x7f0000000340)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x40, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000100), 0x10}, 0x4a) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r4, 0x1f2f, 0x3253, 0x3253, &(0x7f00000007c0)="9f44948721919580684010a486dd", 0x0, 0x241, 0x0, 0xb1, 0x0, &(0x7f0000000700)="389ceff69d08b0af1cc71b6262d50660bbaf31a7f8cd6a6f911beb65d5fe6b54bf21a66489121f24fefd198059288c9b735e1898e77a7469489a249292c02a72bc193a3008ebdbf4e9dd4ee8fcceef55402c913c8dd0ebece1330aaa93ece835c5044a246a5967e3acd7c950b3b19f351830e545eb9bc3a9c6dd22ce97f1f857cfe8b68a2370b69ea336006b589368f92deb68f3dfc6f2bfee09f8342da437fce5dcdf658e453e3132bb42067575318c39"}, 0x23) getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x20, &(0x7f0000000100)={@multicast1, @loopback, 0x0}, &(0x7f0000000140)=0xc) r6 = bpf$ITER_CREATE(0x21, &(0x7f0000000180), 0x8) r7 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=@bloom_filter={0x1e, 0x0, 0x6, 0x8, 0x4001, r3, 0x8000, '\x00', r5, r6, 0x0, 0x4, 0x1, 0xc}, 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000040)={0x11, 0x8, &(0x7f00000001c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x10}, [@tail_call={{0x18, 0x2, 0x1, 0x0, r7}}]}, &(0x7f00000003c0)='syzkaller\x00', 0x9}, 0x94) 324.206955ms ago: executing program 0 (id=5605): bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005900000095"], 0x0}, 0x90) r0 = socket$packet(0x11, 0x2, 0x300) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="16000000000000000400000001"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000380)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000008000000000000000000018110000", @ANYRES32=r1], 0x0, 0x1}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$sock_attach_bpf(r0, 0x1, 0x32, &(0x7f0000000180)=r2, 0x4) writev(0xffffffffffffffff, &(0x7f0000000040)=[{&(0x7f0000000380)}], 0x1) socketpair$unix(0x1, 0x2, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000002c0)=@newlink={0x38, 0x10, 0x801, 0xfffffffd, 0x8000000, {0x0, 0x0, 0x0, 0x0, 0x0, 0x20421}, [@IFLA_GROUP={0x8}, @IFLA_AF_SPEC={0x10, 0x1a, 0x0, 0x1, [@AF_INET={0x8, 0x2, 0x0, 0x1, {0x4}}, @AF_INET6={0x4, 0x2d}]}]}, 0x38}, 0x1, 0x0, 0x0, 0x4040000}, 0x8024) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_PAUSE_SET(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="310401080000030000001600000018000180140002006e657464657673696d3000000000000005000300010000000500040001000000050002"], 0x44}}, 0x0) mmap(&(0x7f0000200000/0x4000)=nil, 0x4000, 0x4, 0x200000006c832, 0xffffffffffffffff, 0x37000000) 272.421197ms ago: executing program 4 (id=5606): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r1, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={&(0x7f0000000a80)={0x14}, 0x14}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="01000000020000001c0012000c000100626f6e64000000000c0002000800010005"], 0x3c}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000003c0)=@newneigh={0x50, 0x1c, 0x10, 0x70bd29, 0x25dfdbfe, {0x7, 0x0, 0x0, r2, 0xa1995a82decd8443, 0x1, 0xa}, [@NDA_SRC_VNI={0x8, 0xb, 0x2}, @NDA_PROTOCOL={0x5, 0xc, 0x7}, @NDA_VNI={0x8, 0x7, 0x8}, @NDA_DST_MAC={0xa, 0x1, @broadcast}, @NDA_PROBES={0x8, 0x4, 0x3}, @NDA_FLAGS_EXT={0x8, 0xf, 0x1}]}, 0x50}, 0x1, 0x0, 0x0, 0x2000c0c1}, 0x40000) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x1, 0x803, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@newlink={0x58, 0x10, 0x403, 0x1300, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @vlan={{0x9}, {0x18, 0x2, 0x0, 0x1, [@IFLA_VLAN_FLAGS={0xc, 0x2, {0x16, 0x1f}}, @IFLA_VLAN_ID={0x6, 0x1, 0xffc}]}}}, @IFLA_LINK={0x8, 0x5, r6}, @IFLA_MASTER={0x8, 0xa, r6}]}, 0x58}}, 0x40488c4) socket$netlink(0x10, 0x3, 0x0) (async) socket(0x10, 0x803, 0x0) (async) sendmsg$IPVS_CMD_SET_INFO(r1, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={&(0x7f0000000a80)={0x14}, 0x14}}, 0x0) (async) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async) socket$nl_route(0x10, 0x3, 0x0) (async) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="01000000020000001c0012000c000100626f6e64000000000c0002000800010005"], 0x3c}}, 0x0) (async) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000003c0)=@newneigh={0x50, 0x1c, 0x10, 0x70bd29, 0x25dfdbfe, {0x7, 0x0, 0x0, r2, 0xa1995a82decd8443, 0x1, 0xa}, [@NDA_SRC_VNI={0x8, 0xb, 0x2}, @NDA_PROTOCOL={0x5, 0xc, 0x7}, @NDA_VNI={0x8, 0x7, 0x8}, @NDA_DST_MAC={0xa, 0x1, @broadcast}, @NDA_PROBES={0x8, 0x4, 0x3}, @NDA_FLAGS_EXT={0x8, 0xf, 0x1}]}, 0x50}, 0x1, 0x0, 0x0, 0x2000c0c1}, 0x40000) (async) socket$nl_route(0x10, 0x3, 0x0) (async) socket(0x1, 0x803, 0x0) (async) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14) (async) sendmsg$nl_route(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@newlink={0x58, 0x10, 0x403, 0x1300, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @vlan={{0x9}, {0x18, 0x2, 0x0, 0x1, [@IFLA_VLAN_FLAGS={0xc, 0x2, {0x16, 0x1f}}, @IFLA_VLAN_ID={0x6, 0x1, 0xffc}]}}}, @IFLA_LINK={0x8, 0x5, r6}, @IFLA_MASTER={0x8, 0xa, r6}]}, 0x58}}, 0x40488c4) (async) 0s ago: executing program 3 (id=5607): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NOTIFY_RADAR(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r2, 0x1, 0x70bd2a, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r3}, @void}}}, 0x1c}, 0x1, 0x0, 0x0, 0x5}, 0x20000830) r4 = socket$pppl2tp(0x18, 0x1, 0x1) r5 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r4, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, r5, {0x2, 0x0, @local}, 0x2}}, 0x26) sendmmsg$inet(0xffffffffffffffff, &(0x7f0000000780)=[{{0x0, 0x0, &(0x7f0000000340)=[{&(0x7f0000000500)="648a6282c6e91b973836904a4a88affa0c371dd1b9c133c5e594714579d6bb3addfd43e78272aef64427ce5467d6994320cf139092452c7944ddab49e459f7e0c73f890e9e2463bd3390e20b1e472bd2aedb47094547a767a098a94a402e6aba65c0ef07eaa87f8663c763d9bb491243eb129eec434e5603956c8333a6ecdf4d3a601b9c8d3d63e3a4a57b38033e2b004f6c3e45f1645c3b7ca0d5ba5eea059b5aa4f0f80ac66904076cc60e47e1afc7d81ad937dee5efc0580e38d96cf0f53808f37d5a8811b07165e8b9aabceac06e4fa7f7668b8832877783a727a1fa8b972bfaeb232cf3e9b500965820f4adf64f1e5e", 0xf2}], 0x1}}], 0x1, 0x4044805) r6 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000005c0)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="010027bd09000400000005000000080009000200000008000c00a80a000008000b000000000006000100"], 0x3c}}, 0x20) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) r8 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0xc, 0x2, &(0x7f0000000100)=ANY=[@ANYBLOB="850000002200000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x80) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000003c0)={r8, 0xe0, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000001640)=[0x0], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0}}, 0x10) r9 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r9, &(0x7f0000000b00)={0x0, 0x0, 0x0}, 0x0) ioctl$sock_bt_hci(r9, 0x800448ef, &(0x7f00000001c0)="fdd314f8fd7fc5a57075602d75bfd83883849be7ddc3e42d330b854521002f8d425a008f2b44420d627493a6962f0cd6dc928fa2cfc398bf3cc722b9e1c0e585f0e1a747b388ef8f6d6c6ef695fb52b77522ef1b57519f7babf984c04bcbe6153c39aed097a896b605493eb9eb9f6518033a1874628c0e7e9fc3604246172b03e9b6f93a6907b444150a4d13df45f06a812f16f9b635eb39f6db07929a73e8dcdfae2cd7") bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x7, 0x6, &(0x7f0000000500)=ANY=[@ANYBLOB="05000000000000007111ad00000000008510000002000000850000000500000095000000000000009500a505000000005160b53d4aaf0ecda3e967683918fabfc90ec1e06c5f48cb9ce64e815b7b74d0c3e9365f188f6a00591b"], &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x6}, 0x70) kernel console output (not intermixed with test programs): 9.876914][T22713] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4137'. [ 749.886797][T22707] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4135'. [ 749.897392][T22713] netlink: zone id is out of range [ 749.904115][T22713] netlink: zone id is out of range [ 749.910602][T22713] netlink: zone id is out of range [ 749.916121][T22713] netlink: zone id is out of range [ 749.920075][T22717] netlink: 16 bytes leftover after parsing attributes in process `syz.2.4138'. [ 749.927421][T22713] netlink: zone id is out of range [ 749.943453][T22713] netlink: zone id is out of range [ 749.949694][T22713] netlink: zone id is out of range [ 750.072581][T22726] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4141'. [ 750.245558][T13349] netdevsim netdevsim2 eth0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 750.271169][T13349] netdevsim netdevsim2 eth1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 750.289542][T13349] netdevsim netdevsim2 eth2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 750.312370][T22738] net_ratelimit: 5 callbacks suppressed [ 750.312393][T22738] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 750.313919][T13349] netdevsim netdevsim2 eth3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 750.324290][T22738] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 750.366981][T22740] netlink: 'syz.1.4144': attribute type 1 has an invalid length. [ 750.391535][T22746] bridge_slave_0 (unregistering): left allmulticast mode [ 750.393521][T22740] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 750.415574][T22746] bridge_slave_0 (unregistering): left promiscuous mode [ 750.434942][T22746] bridge0: port 1(bridge_slave_0) entered disabled state [ 750.519222][T22750] tipc: Enabled bearer , priority 0 [ 750.527701][T22750] syzkaller0: entered promiscuous mode [ 750.535041][T22750] syzkaller0: entered allmulticast mode [ 750.544587][T22740] netlink: 24 bytes leftover after parsing attributes in process `syz.1.4144'. [ 750.562871][T22750] netem: change failed [ 750.621701][T22750] netlink: 'syz.0.4146': attribute type 1 has an invalid length. [ 750.631412][T22750] netlink: 'syz.0.4146': attribute type 2 has an invalid length. [ 750.641652][T22750] netlink: 'syz.0.4146': attribute type 2 has an invalid length. [ 750.650620][T22750] netlink: 'syz.0.4146': attribute type 2 has an invalid length. [ 750.658912][T22750] netlink: 'syz.0.4146': attribute type 1 has an invalid length. [ 750.761405][T22749] tipc: Resetting bearer [ 750.800905][T22749] tipc: Disabling bearer [ 751.372857][T22775] lo speed is unknown, defaulting to 1000 [ 751.438563][T22777] block nbd1: server does not support multiple connections per device. [ 751.469419][T22781] netlink: 68 bytes leftover after parsing attributes in process `syz.0.4156'. [ 751.478970][T22777] block nbd1: shutting down sockets [ 751.548065][T18692] tipc: Node number set to 2886997007 [ 751.587501][T22785] tipc: Enabling of bearer rejected, failed to enable media [ 751.979351][T22798] ipt_REJECT: ECHOREPLY no longer supported. [ 752.154120][T22795] lo speed is unknown, defaulting to 1000 [ 752.283011][T22806] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci3/hci3:200/input10 [ 752.803917][T22828] sctp: [Deprecated]: syz.4.4169 (pid 22828) Use of int in max_burst socket option deprecated. [ 752.803917][T22828] Use struct sctp_assoc_value instead [ 753.115924][T22835] vlan0: entered allmulticast mode [ 753.123445][T22835] bond0: entered allmulticast mode [ 753.129724][T22835] bond_slave_0: entered allmulticast mode [ 753.135801][T22835] bond_slave_1: entered allmulticast mode [ 753.955382][T22862] tipc: Enabled bearer , priority 0 [ 754.004780][T22862] syzkaller0: entered promiscuous mode [ 754.029621][T22862] syzkaller0: entered allmulticast mode [ 754.163185][T22862] tipc: Resetting bearer [ 754.235345][T22861] tipc: Resetting bearer [ 754.284100][T22861] tipc: Disabling bearer [ 755.008366][T22904] validate_nla: 1 callbacks suppressed [ 755.008387][T22904] netlink: 'syz.2.4186': attribute type 1 has an invalid length. [ 755.035124][T22907] sctp: [Deprecated]: syz.3.4188 (pid 22907) Use of int in max_burst socket option deprecated. [ 755.035124][T22907] Use struct sctp_assoc_value instead [ 755.091352][T22897] bond6: option ad_actor_sys_prio: mode dependency failed, not supported in mode broadcast(3) [ 755.109942][T22897] bond6 (unregistering): Released all slaves [ 755.188227][T22905] tipc: Enabled bearer , priority 0 [ 755.252555][T22905] tipc: Disabling bearer [ 755.467255][T22927] netlink: 'syz.1.4193': attribute type 1 has an invalid length. [ 755.538980][T22927] 8021q: adding VLAN 0 to HW filter on device bond6 [ 755.585157][T22931] bond6: (slave gretap1): making interface the new active one [ 755.610387][T22931] bond6: (slave gretap1): Enslaving as an active interface with an up link [ 755.643217][T22933] __nla_validate_parse: 6 callbacks suppressed [ 755.643234][T22933] netlink: 24 bytes leftover after parsing attributes in process `syz.0.4195'. [ 755.775747][T22935] netlink: 'syz.1.4196': attribute type 1 has an invalid length. [ 755.822778][T22935] veth11: entered promiscuous mode [ 755.833050][T22935] veth11: entered allmulticast mode [ 756.104861][T22955] netlink: 'syz.4.4202': attribute type 8 has an invalid length. [ 756.410383][T22963] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 756.581631][T22974] lo speed is unknown, defaulting to 1000 [ 756.985181][T22996] sctp: [Deprecated]: syz.2.4211 (pid 22996) Use of int in max_burst socket option deprecated. [ 756.985181][T22996] Use struct sctp_assoc_value instead [ 757.267084][T23008] netlink: 16 bytes leftover after parsing attributes in process `syz.4.4215'. [ 757.276557][T23008] netlink: 'syz.4.4215': attribute type 8 has an invalid length. [ 757.285088][T23008] netlink: 96 bytes leftover after parsing attributes in process `syz.4.4215'. [ 757.455572][T22993] lo speed is unknown, defaulting to 1000 [ 757.681410][T23017] netlink: 'syz.0.4217': attribute type 21 has an invalid length. [ 757.700702][T23017] netlink: 'syz.0.4217': attribute type 20 has an invalid length. [ 757.955646][T23027] bridge_slave_1: left allmulticast mode [ 757.973889][T23027] bridge_slave_1: left promiscuous mode [ 757.990566][T23027] bridge0: port 2(bridge_slave_1) entered disabled state [ 758.071487][T23027] bond0: (slave bond_slave_0): Releasing backup interface [ 758.100515][T23038] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4221'. [ 758.168086][T23027] bond0: (slave bond_slave_1): Releasing backup interface [ 758.182190][T23041] netlink: 'syz.0.4220': attribute type 1 has an invalid length. [ 758.204900][T23027] team0: Port device team_slave_0 removed [ 758.220437][T23027] team0: Port device team_slave_1 removed [ 758.230155][T23027] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 758.723744][T23048] lo speed is unknown, defaulting to 1000 [ 759.268592][T23062] xt_hl: Unknown Hop Limit match mode: 206 [ 759.296269][T23062] netlink: 'syz.3.4227': attribute type 1 has an invalid length. [ 759.404197][T23069] sctp: [Deprecated]: syz.0.4229 (pid 23069) Use of int in max_burst socket option deprecated. [ 759.404197][T23069] Use struct sctp_assoc_value instead [ 759.512719][T23062] bond9: entered promiscuous mode [ 759.521288][T23062] 8021q: adding VLAN 0 to HW filter on device bond9 [ 759.552916][T23066] bond9: (slave bridge3): making interface the new active one [ 759.578761][T23066] bridge3: entered promiscuous mode [ 759.599569][T23066] bond9: (slave bridge3): Enslaving as an active interface with an up link [ 759.812116][ T30] audit: type=1800 audit(1778125429.579:16): pid=23074 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.4230" name="blkio.bfq.time_recursive" dev="tmpfs" ino=1200 res=0 errno=0 [ 759.855018][T23073] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4231'. [ 759.894620][T23077] netlink: 20 bytes leftover after parsing attributes in process `syz.2.4230'. [ 759.943400][T23078] bond10: (slave lo): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 760.010177][T23077] netlink: 'syz.2.4230': attribute type 1 has an invalid length. [ 760.055688][T23078] bond10: (slave lo): Enslaving as an active interface with an up link [ 760.074212][T23077] netlink: 'syz.2.4230': attribute type 2 has an invalid length. [ 760.091940][T23078] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 760.383499][T23086] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4232'. [ 760.538770][T23091] ipip0: entered promiscuous mode [ 761.105581][T23087] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for ipip0 [ 761.122192][T23087] gretap1: entered promiscuous mode [ 761.129774][T23087] gretap1: entered allmulticast mode [ 761.163470][T23096] bond0: left promiscuous mode [ 761.178462][T23096] bond_slave_0: left promiscuous mode [ 761.192227][T23096] bond_slave_1: left promiscuous mode [ 761.242178][T23096] bond5: left promiscuous mode [ 761.261862][T23096] bond6: left promiscuous mode [ 761.280046][T23096] ip6gre1: left promiscuous mode [ 761.296050][T23096] ip6gre1: left allmulticast mode [ 761.363764][T23096] bond9: left promiscuous mode [ 761.377008][T23096] bridge3: left promiscuous mode [ 761.956734][T23111] netlink: 52 bytes leftover after parsing attributes in process `syz.2.4236'. [ 762.043816][T23116] netlink: 'syz.0.4238': attribute type 7 has an invalid length. [ 762.061985][T23112] netlink: 160 bytes leftover after parsing attributes in process `syz.3.4237'. [ 762.203410][T23110] netlink: 'syz.3.4237': attribute type 1 has an invalid length. [ 762.348681][T23119] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci3/hci3:200/input11 [ 762.436820][T23122] netlink: 256 bytes leftover after parsing attributes in process `syz.0.4240'. [ 762.450489][T23122] netlink: 256 bytes leftover after parsing attributes in process `syz.0.4240'. [ 762.559419][ T5635] Bluetooth: hci3: command 0x0405 tx timeout [ 762.910842][T23139] sctp: [Deprecated]: syz.2.4243 (pid 23139) Use of int in max_burst socket option deprecated. [ 762.910842][T23139] Use struct sctp_assoc_value instead [ 762.940574][T23135] netlink: 20 bytes leftover after parsing attributes in process `syz.3.4242'. [ 763.584873][T23167] netlink: 56 bytes leftover after parsing attributes in process `syz.3.4252'. [ 763.776295][T23172] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4255'. [ 763.802145][T23172] netlink: 304 bytes leftover after parsing attributes in process `syz.3.4255'. [ 763.994376][T23186] netlink: 'syz.3.4258': attribute type 1 has an invalid length. [ 764.014651][T23173] team0 (unregistering): Port device team_slave_0 removed [ 764.062442][T23173] team0 (unregistering): Port device team_slave_1 removed [ 764.278221][T23197] netlink: 76 bytes leftover after parsing attributes in process `syz.3.4261'. [ 764.427576][T23202] lo speed is unknown, defaulting to 1000 [ 764.673312][T23213] sctp: [Deprecated]: syz.1.4266 (pid 23213) Use of int in max_burst socket option deprecated. [ 764.673312][T23213] Use struct sctp_assoc_value instead [ 764.871534][T23216] geneve2: entered promiscuous mode [ 764.892796][T23218] netlink: 'syz.2.4268': attribute type 5 has an invalid length. [ 764.908841][T12994] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 764.927543][T12994] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 764.937014][T12994] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 764.945469][T23218] netlink: 48 bytes leftover after parsing attributes in process `syz.2.4268'. [ 764.947430][T12994] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 765.059158][T23221] bond0: (slave bond_slave_1): Releasing backup interface [ 765.554720][T23242] netlink: 'syz.0.4272': attribute type 13 has an invalid length. [ 765.564586][T23242] netlink: 'syz.0.4272': attribute type 17 has an invalid length. [ 765.576522][T23235] netlink: 'syz.2.4271': attribute type 1 has an invalid length. [ 765.605809][T23238] bridge0: port 2(bridge_slave_1) entered disabled state [ 765.613514][T23238] bridge0: port 1(bridge_slave_0) entered disabled state [ 765.665625][T23238] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 765.678591][T23238] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 765.816428][T23221] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 766.054070][T23242] 8021q: adding VLAN 0 to HW filter on device bond0 [ 766.071849][T23242] 8021q: adding VLAN 0 to HW filter on device team0 [ 766.106667][T23242] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 766.144398][T23242] bridge0: port 1(bridge_slave_0) entered blocking state [ 766.151759][T23242] bridge0: port 1(bridge_slave_0) entered forwarding state [ 766.166482][T23242] bridge0: port 2(bridge_slave_1) entered blocking state [ 766.173822][T23242] bridge0: port 2(bridge_slave_1) entered forwarding state [ 766.209134][T23242] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 766.222139][T23242] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 766.279058][T23242] veth1_vlan: left promiscuous mode [ 766.286716][T23242] veth0_vlan: left promiscuous mode [ 766.293547][T23242] veth0_vlan: entered promiscuous mode [ 766.308958][T23242] veth1_vlan: entered promiscuous mode [ 766.315012][T23242] macvlan0: left promiscuous mode [ 766.326590][T23242] ipvlan0: left allmulticast mode [ 766.332127][T23242] veth0_vlan: left allmulticast mode [ 766.341804][T23242] veth1_macvtap: left promiscuous mode [ 766.349997][T23242] veth0_macvtap: left promiscuous mode [ 766.357410][T23242] veth0_macvtap: entered promiscuous mode [ 766.374099][T23242] veth1_macvtap: entered promiscuous mode [ 766.395727][T23242] 8021q: adding VLAN 0 to HW filter on device bond1 [ 766.406353][T23242] bond2: left promiscuous mode [ 766.411551][T23242] vcan1: left promiscuous mode [ 766.417254][T23242] 8021q: adding VLAN 0 to HW filter on device bond2 [ 766.426081][T23242] A link change request failed with some changes committed already. Interface batadv1 may have been left with an inconsistent configuration, please check. [ 766.444212][T23235] workqueue: Failed to create a rescuer kthread for wq "bond6": -EINTR [ 766.572777][ T58] netdevsim netdevsim0 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 766.591127][ T58] netdevsim netdevsim0 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 766.634592][T23256] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 766.693462][ T58] netdevsim netdevsim0 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 766.723809][ T58] netdevsim netdevsim0 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 766.770893][T12994] netdevsim netdevsim1 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 766.796166][T12994] netdevsim netdevsim1 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 766.864274][T23259] tipc: Invalid UDP bearer configuration [ 766.864335][T23259] tipc: Enabling of bearer rejected, failed to enable media [ 766.902279][T12994] netdevsim netdevsim1 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 766.936358][T12994] netdevsim netdevsim1 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 767.367759][T23285] sctp: [Deprecated]: syz.4.4283 (pid 23285) Use of int in max_burst socket option deprecated. [ 767.367759][T23285] Use struct sctp_assoc_value instead [ 768.199828][T23314] netlink: 'syz.2.4293': attribute type 1 has an invalid length. [ 768.632226][T23340] __nla_validate_parse: 3 callbacks suppressed [ 768.632249][T23340] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4302'. [ 768.967315][T23357] sctp: [Deprecated]: syz.4.4307 (pid 23357) Use of int in max_burst socket option deprecated. [ 768.967315][T23357] Use struct sctp_assoc_value instead [ 769.032275][T23365] netlink: 24 bytes leftover after parsing attributes in process `syz.0.4310'. [ 769.078921][T23365] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4310'. [ 769.119809][T23359] x_tables: ip_tables: icmp match: only valid for protocol 1 [ 769.420177][T23378] netlink: 'syz.1.4314': attribute type 3 has an invalid length. [ 769.430140][T23378] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4314'. [ 769.843143][T23394] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4318'. [ 769.931400][T23393] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4318'. [ 770.533584][T23422] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4328'. [ 771.033104][T23442] netlink: 'syz.0.4329': attribute type 8 has an invalid length. [ 771.071634][T23442] netlink: 'syz.0.4329': attribute type 9 has an invalid length. [ 771.330217][T23456] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4338'. [ 771.422928][T23456] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4338'. [ 772.162062][T23485] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 772.340679][T23486] lo speed is unknown, defaulting to 1000 [ 773.544872][T23539] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 773.724202][T23561] netlink: 128 bytes leftover after parsing attributes in process `syz.4.4359'. [ 773.748085][T23561] netlink: 20 bytes leftover after parsing attributes in process `syz.4.4359'. [ 774.236806][T23579] netlink: 14 bytes leftover after parsing attributes in process `syz.3.4365'. [ 774.290022][T23579] dummy0 (unregistering): left promiscuous mode [ 774.577215][T23578] lo speed is unknown, defaulting to 1000 [ 774.731957][T23594] netlink: 16 bytes leftover after parsing attributes in process `syz.2.4369'. [ 775.040080][T23605] IPVS: set_ctl: invalid protocol: 94 172.20.20.170:20002 [ 775.089633][ T8573] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 775.098258][ T8573] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 775.290648][T23580] lo speed is unknown, defaulting to 1000 [ 775.292138][T23614] netlink: 'syz.0.4376': attribute type 15 has an invalid length. [ 775.306251][T23614] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4376'. [ 775.327699][ T8573] netdevsim netdevsim0 eth0: set [0, 1] type 1 family 0 port 2816 - 0 [ 775.337732][T23614] netlink: 'syz.0.4376': attribute type 15 has an invalid length. [ 775.346808][ T8573] netdevsim netdevsim0 eth1: set [0, 1] type 1 family 0 port 2816 - 0 [ 775.356002][T23614] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4376'. [ 775.367612][ T8573] netdevsim netdevsim0 eth2: set [0, 1] type 1 family 0 port 2816 - 0 [ 775.376827][ T8573] netdevsim netdevsim0 eth3: set [0, 1] type 1 family 0 port 2816 - 0 [ 775.685420][T23627] netlink: 48 bytes leftover after parsing attributes in process `syz.2.4380'. [ 775.729036][T23625] GUP no longer grows the stack in syz.3.4381 (23625): 200000003000-20000000a000 (200000001000) [ 775.750454][T23625] CPU: 0 UID: 0 PID: 23625 Comm: syz.3.4381 Not tainted syzkaller #0 PREEMPT(full) [ 775.750485][T23625] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 775.750504][T23625] Call Trace: [ 775.750517][T23625] [ 775.750527][T23625] dump_stack_lvl+0xe8/0x150 [ 775.750560][T23625] __get_user_pages+0x2378/0x2720 [ 775.750603][T23625] ? __gup_longterm_locked+0xc4e/0x1630 [ 775.750661][T23625] ? __gup_longterm_locked+0xc4e/0x1630 [ 775.750689][T23625] ? down_read_killable+0x1bb/0x340 [ 775.750748][T23625] __gup_longterm_locked+0xdcf/0x1630 [ 775.750781][T23625] ? lock_acquire+0x106/0x350 [ 775.750842][T23625] gup_fast_fallback+0x1d84/0x20d0 [ 775.750943][T23625] ? __pfx_gup_fast_fallback+0x10/0x10 [ 775.750990][T23625] ? is_valid_gup_args+0x11f/0x200 [ 775.751026][T23625] ? get_user_pages_fast+0x4d/0xb0 [ 775.751057][T23625] __iov_iter_get_pages_alloc+0x370/0xa10 [ 775.751106][T23625] ? __pfx_pipe_clear_nowait+0x10/0x10 [ 775.751145][T23625] iov_iter_get_pages2+0x5e/0xa0 [ 775.751181][T23625] __se_sys_vmsplice+0x7c7/0x1620 [ 775.751242][T23625] ? __pfx___se_sys_vmsplice+0x10/0x10 [ 775.751274][T23625] ? __pfx_futex_wait+0x10/0x10 [ 775.751320][T23625] ? lockdep_hardirqs_on+0x7a/0x110 [ 775.751416][T23625] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 775.751449][T23625] do_syscall_64+0x15f/0xf80 [ 775.751479][T23625] ? trace_irq_disable+0x3b/0x140 [ 775.751515][T23625] ? clear_bhb_loop+0x40/0x90 [ 775.751544][T23625] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 775.751567][T23625] RIP: 0033:0x7f591959cdd9 [ 775.751588][T23625] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 775.751611][T23625] RSP: 002b:00007f591a4be028 EFLAGS: 00000246 ORIG_RAX: 0000000000000116 [ 775.751641][T23625] RAX: ffffffffffffffda RBX: 00007f5919815fa0 RCX: 00007f591959cdd9 [ 775.751657][T23625] RDX: 0000000000000001 RSI: 00002000000000c0 RDI: 0000000000000008 [ 775.751672][T23625] RBP: 00007f5919632d69 R08: 0000000000000000 R09: 0000000000000000 [ 775.751686][T23625] R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000000 [ 775.751700][T23625] R13: 00007f5919816038 R14: 00007f5919815fa0 R15: 00007ffc76e75708 [ 775.751737][T23625] [ 775.937199][T23631] netlink: 24 bytes leftover after parsing attributes in process `syz.2.4383'. [ 776.045821][T23629] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4382'. [ 776.800949][T23639] netlink: 32 bytes leftover after parsing attributes in process `syz.3.4384'. [ 776.823385][T23642] xt_socket: unknown flags 0x8 [ 776.976975][T23645] xt_hashlimit: size too large, truncated to 1048576 [ 777.979274][T23670] netlink: 'syz.0.4391': attribute type 1 has an invalid length. [ 778.303725][T23668] lo speed is unknown, defaulting to 1000 [ 778.707965][T23689] netlink: 'syz.2.4395': attribute type 1 has an invalid length. [ 778.808766][T13349] bridge_slave_1: left allmulticast mode [ 778.828686][T13349] bridge_slave_1: left promiscuous mode [ 778.835132][T13349] bridge0: port 2(bridge_slave_1) entered disabled state [ 779.055717][T23698] __nla_validate_parse: 4 callbacks suppressed [ 779.055740][T23698] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4398'. [ 779.179776][T13349] batman_adv: batadv0: Removing interface: vlan5 [ 779.599184][T13349] bond0 (unregistering): (slave 07ÿ): Releasing backup interface [ 779.610393][T13349] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 779.623680][T13349] bond0 (unregistering): Released all slaves [ 779.641288][T13349] bond1 (unregistering): Released all slaves [ 779.664286][T13349] bond2 (unregistering): Released all slaves [ 779.702962][T13349] bond3 (unregistering): Released all slaves [ 779.722241][T13349] bond4 (unregistering): Released all slaves [ 779.742868][T13349] bond5 (unregistering): Released all slaves [ 779.767288][T13349] bond6 (unregistering): Released all slaves [ 779.783802][T13349] bond8 (unregistering): Released all slaves [ 779.801379][T13349] bond7 (unregistering): Released all slaves [ 780.053980][T13349] tipc: Left network mode [ 780.059326][T23712] netlink: 32 bytes leftover after parsing attributes in process `syz.1.4400'. [ 781.903883][T23703] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 782.150137][T13349] hsr_slave_0: left promiscuous mode [ 782.161118][T13349] hsr_slave_1: left promiscuous mode [ 782.167514][T13349] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 782.177095][T13349] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 782.191832][T13349] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 782.206806][T13349] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 782.439467][T13349] veth0_virt_wifi: left allmulticast mode [ 782.447172][T13349] veth0_virt_wifi: left promiscuous mode [ 782.622825][T23745] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 782.630192][T23745] IPv6: NLM_F_CREATE should be set when creating new route [ 782.637598][T23745] IPv6: NLM_F_CREATE should be set when creating new route [ 782.657311][T23745] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 782.667730][T23745] netlink: 9 bytes leftover after parsing attributes in process `syz.4.4410'. [ 783.122769][T23730] workqueue: Failed to create a rescuer kthread for wq "bond7": -EINTR [ 783.124180][T23745] 0·: renamed from hsr0 (while UP) [ 783.152200][T23745] 0·: entered allmulticast mode [ 783.157363][T23745] hsr_slave_0: entered allmulticast mode [ 783.172544][T23745] hsr_slave_1: entered allmulticast mode [ 783.187633][T23745] A link change request failed with some changes committed already. Interface c0· may have been left with an inconsistent configuration, please check. [ 783.241786][T23758] syzkaller1: entered promiscuous mode [ 783.264907][T23758] syzkaller1: entered allmulticast mode [ 783.745037][T23784] netlink: 64 bytes leftover after parsing attributes in process `syz.3.4421'. [ 783.763797][T13349] IPVS: stop unused estimator thread 0... [ 783.845281][T23787] netlink: 'syz.2.4422': attribute type 2 has an invalid length. [ 783.877454][T23787] netlink: 'syz.2.4422': attribute type 2 has an invalid length. [ 784.092655][T23794] mac80211_hwsim hwsim37 syzkaller0: entered promiscuous mode [ 784.104947][T23794] mac80211_hwsim hwsim37 syzkaller0: entered allmulticast mode [ 784.119164][T23794] tipc: Enabled bearer , priority 0 [ 784.143511][T23781] sctp: [Deprecated]: syz.4.4417 (pid 23781) Use of int in max_burst socket option. [ 784.143511][T23781] Use struct sctp_assoc_value instead [ 784.304993][T23797] lo speed is unknown, defaulting to 1000 [ 784.311222][T23801] sctp: [Deprecated]: syz.2.4426 (pid 23801) Use of int in max_burst socket option deprecated. [ 784.311222][T23801] Use struct sctp_assoc_value instead [ 784.750804][T23812] mac80211_hwsim hwsim35 ªªªªª;: renamed from wlan0 (while UP) [ 785.046650][T23822] netlink: 240 bytes leftover after parsing attributes in process `syz.0.4432'. [ 785.301454][T23830] netlink: 'syz.2.4436': attribute type 13 has an invalid length. [ 785.338008][T23830] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4436'. [ 785.632164][T23840] netlink: 'syz.2.4438': attribute type 8 has an invalid length. [ 785.784919][T23842] netlink: 11562 bytes leftover after parsing attributes in process `syz.2.4438'. [ 785.806315][T23842] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4438'. [ 785.947510][T23845] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4439'. [ 786.004997][T23847] tipc: Enabling of bearer rejected, failed to enable media [ 786.639979][T23510] wlan0: Trigger new scan to find an IBSS to join [ 786.720469][T23879] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4452'. [ 786.913739][T23888] lo speed is unknown, defaulting to 1000 [ 787.277648][T23907] netlink: 228 bytes leftover after parsing attributes in process `syz.1.4460'. [ 787.379277][T23909] netlink: 44 bytes leftover after parsing attributes in process `syz.1.4462'. [ 787.808331][T23934] xt_TCPMSS: Only works on TCP SYN packets [ 787.858895][T23928] syzkaller1: entered promiscuous mode [ 787.864638][T23928] syzkaller1: entered allmulticast mode [ 788.000917][T23939] netlink: 'syz.1.4469': attribute type 1 has an invalid length. [ 788.011895][T23934] lo speed is unknown, defaulting to 1000 [ 789.602497][T13348] wlan0: Trigger new scan to find an IBSS to join [ 790.889498][T23958] netlink: 'syz.2.4476': attribute type 1 has an invalid length. [ 790.897594][T23958] netlink: 64399 bytes leftover after parsing attributes in process `syz.2.4476'. [ 790.916071][T23960] netlink: 'syz.1.4477': attribute type 1 has an invalid length. [ 790.948909][T23960] bond7: entered promiscuous mode [ 790.954464][T23960] 8021q: adding VLAN 0 to HW filter on device bond7 [ 791.015703][T23960] 8021q: adding VLAN 0 to HW filter on device bond7 [ 791.023056][T23960] bond7: (slave ip6gre1): The slave device specified does not support setting the MAC address [ 791.040263][T23960] bond7: (slave ip6gre1): Setting fail_over_mac to active for active-backup mode [ 791.058156][T23960] bond7: (slave ip6gre1): making interface the new active one [ 791.066015][T23960] ip6gre1: entered promiscuous mode [ 791.075392][T23960] bond7: (slave ip6gre1): Enslaving as an active interface with an up link [ 791.218408][T23967] netlink: 20 bytes leftover after parsing attributes in process `syz.1.4479'. [ 791.304190][T23974] netlink: 32 bytes leftover after parsing attributes in process `syz.1.4481'. [ 791.507529][T23980] netlink: 44 bytes leftover after parsing attributes in process `syz.1.4482'. [ 791.629150][T23949] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 791.913386][T23990] Unknown options in mask 6 [ 791.918967][T23991] Unknown options in mask 6 [ 792.329307][T24014] netlink: 'syz.0.4493': attribute type 2 has an invalid length. [ 792.379934][T24013] bond6: entered promiscuous mode [ 792.385510][T24013] 8021q: adding VLAN 0 to HW filter on device bond6 [ 792.535191][T24021] netlink: zone id is out of range [ 792.626346][T24024] FAULT_INJECTION: forcing a failure. [ 792.626346][T24024] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 792.638749][T23510] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 792.658597][T24024] CPU: 1 UID: 0 PID: 24024 Comm: syz.2.4499 Not tainted syzkaller #0 PREEMPT(full) [ 792.658628][T24024] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 792.658641][T24024] Call Trace: [ 792.658650][T24024] [ 792.658659][T24024] dump_stack_lvl+0xe8/0x150 [ 792.658689][T24024] should_fail_ex+0x412/0x560 [ 792.658723][T24024] _copy_to_user+0x31/0xb0 [ 792.658757][T24024] simple_read_from_buffer+0xe1/0x170 [ 792.658796][T24024] proc_fail_nth_read+0x1bb/0x230 [ 792.658828][T24024] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 792.658859][T24024] ? rw_verify_area+0x2a6/0x4d0 [ 792.658898][T24024] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 792.658927][T24024] vfs_read+0x20c/0xa70 [ 792.658963][T24024] ? __pfx___mutex_lock+0x10/0x10 [ 792.658995][T24024] ? __pfx_vfs_read+0x10/0x10 [ 792.659026][T24024] ? __fget_files+0x2a/0x420 [ 792.659093][T24024] ? __fget_files+0x3a0/0x420 [ 792.659117][T24024] ? __fget_files+0x2a/0x420 [ 792.659163][T24024] ksys_read+0x150/0x270 [ 792.659196][T24024] ? __pfx_ksys_read+0x10/0x10 [ 792.659235][T24024] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 792.659259][T24024] do_syscall_64+0x15f/0xf80 [ 792.659287][T24024] ? trace_irq_disable+0x3b/0x140 [ 792.659321][T24024] ? clear_bhb_loop+0x40/0x90 [ 792.659348][T24024] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 792.659370][T24024] RIP: 0033:0x7f0a4d35d60e [ 792.659392][T24024] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 792.659409][T24024] RSP: 002b:00007f0a4e1a1fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 792.659432][T24024] RAX: ffffffffffffffda RBX: 00007f0a4e1a26c0 RCX: 00007f0a4d35d60e [ 792.659448][T24024] RDX: 000000000000000f RSI: 00007f0a4e1a20a0 RDI: 0000000000000004 [ 792.659461][T24024] RBP: 00007f0a4e1a2090 R08: 0000000000000000 R09: 0000000000000000 [ 792.659473][T24024] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 792.659484][T24024] R13: 00007f0a4d616038 R14: 00007f0a4d615fa0 R15: 00007ffe712cc3e8 [ 792.659568][T24024] [ 793.025112][T24033] netlink: 20 bytes leftover after parsing attributes in process `syz.3.4502'. [ 793.035473][T24033] netlink: 20 bytes leftover after parsing attributes in process `syz.3.4502'. [ 793.763732][T24073] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 793.854451][T24074] netlink: 212408 bytes leftover after parsing attributes in process `syz.3.4514'. [ 793.902373][T24076] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4515'. [ 794.212245][T24054] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 794.481174][T24089] netlink: 32 bytes leftover after parsing attributes in process `syz.4.4517'. [ 794.500476][T24089] netlink: 24 bytes leftover after parsing attributes in process `syz.4.4517'. [ 794.817944][T24102] lo speed is unknown, defaulting to 1000 [ 795.001776][T24112] hmó3)ó: entered promiscuous mode [ 795.382683][T24123] lo speed is unknown, defaulting to 1000 [ 795.676182][ T30] audit: type=1800 audit(1778125465.439:17): pid=24144 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.4532" name="memory.events" dev="tmpfs" ino=1253 res=0 errno=0 [ 795.866144][T24149] sctp: [Deprecated]: syz.4.4533 (pid 24149) Use of int in max_burst socket option deprecated. [ 795.866144][T24149] Use struct sctp_assoc_value instead [ 796.470772][T24160] __nla_validate_parse: 4 callbacks suppressed [ 796.470789][T24160] netlink: 52 bytes leftover after parsing attributes in process `syz.3.4538'. [ 796.873284][T24163] 8021q: adding VLAN 0 to HW filter on device bond0 [ 796.910265][T24163] 8021q: adding VLAN 0 to HW filter on device team0 [ 796.934897][T24163] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 797.053969][T24163] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 797.082167][T24163] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 797.106006][T24163] hsr0: A HSR master's MTU cannot be greater than the smallest MTU of its slaves minus the HSR Tag length (6 octets). [ 797.293394][T24168] veth0_to_team: left promiscuous mode [ 797.343767][T24168] 8021q: adding VLAN 0 to HW filter on device bond1 [ 797.357754][T24168] macvlan2: left promiscuous mode [ 797.372721][T24168] 8021q: adding VLAN 0 to HW filter on device bond2 [ 797.383474][T24168] bridge0: port 3(vlan2) entered blocking state [ 797.389961][T24168] bridge0: port 3(vlan2) entered forwarding state [ 797.412453][T24168] 8021q: adding VLAN 0 to HW filter on device eth0 [ 797.425497][T24168] 8021q: adding VLAN 0 to HW filter on device eth1 [ 797.439344][T24168] 8021q: adding VLAN 0 to HW filter on device eth2 [ 797.453098][T24168] 8021q: adding VLAN 0 to HW filter on device eth3 [ 797.469035][T24168] 8021q: adding VLAN 0 to HW filter on device bond3 [ 797.514441][T24168] 8021q: adding VLAN 0 to HW filter on device batadv1 [ 797.529487][T24168] 8021q: adding VLAN 0 to HW filter on device batadv2 [ 797.573049][ T8573] bridge0: port 1(bridge_slave_0) entered blocking state [ 797.580332][ T8573] bridge0: port 1(bridge_slave_0) entered forwarding state [ 797.595068][ T8573] bridge0: port 2(bridge_slave_1) entered blocking state [ 797.602380][ T8573] bridge0: port 2(bridge_slave_1) entered forwarding state [ 797.825916][T12989] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 798.457568][T24192] netdevsim netdevsim4 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 798.490600][T24192] netdevsim netdevsim4 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 798.538164][T24194] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 798.552250][T24194] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 798.569420][T24194] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 798.587005][T24194] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 798.714646][T24192] netdevsim netdevsim4 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 798.725370][T24192] netdevsim netdevsim4 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 798.855969][T24192] netdevsim netdevsim4 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 798.866273][T24192] netdevsim netdevsim4 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 799.540198][T24192] netdevsim netdevsim4 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 799.551207][T24192] netdevsim netdevsim4 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 799.649556][T24227] netlink: set zone limit has 8 unknown bytes [ 799.862918][T12989] netdevsim netdevsim4 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 799.871727][T12989] netdevsim netdevsim4 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 799.883334][T24238] bond10: (slave lo): Releasing backup interface [ 799.893663][T24238] bond10: (slave lo): last VLAN challenged slave left bond - VLAN blocking is removed [ 799.911100][T24238] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 799.953080][T13348] netdevsim netdevsim4 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 799.970880][T13348] netdevsim netdevsim4 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 800.010916][T23510] netdevsim netdevsim4 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 800.025677][T23510] netdevsim netdevsim4 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 800.049539][T23510] netdevsim netdevsim4 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 800.059257][T23510] netdevsim netdevsim4 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 800.412751][T24220] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 800.605827][T24264] xt_hashlimit: size too large, truncated to 1048576 [ 800.641212][T24266] netlink: 36 bytes leftover after parsing attributes in process `syz.4.4565'. [ 800.687768][ T5612] IPVS: starting estimator thread 0... [ 800.725229][T24276] IPVS: sed: FWM 3 0x00000003 - no destination available [ 800.729733][T24275] netlink: 'syz.4.4565': attribute type 10 has an invalid length. [ 800.780685][T24268] netlink: 212368 bytes leftover after parsing attributes in process `syz.3.4564'. [ 800.868016][T24270] IPVS: using max 30 ests per chain, 72000 per kthread [ 801.010362][T24284] xt_TCPMSS: Only works on TCP SYN packets [ 801.019369][T24275] tipc: Enabled bearer , priority 10 [ 801.029218][T24284] xt_TCPMSS: Only works on TCP SYN packets [ 801.035602][T24281] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4567'. [ 801.047614][T24285] netlink: 24 bytes leftover after parsing attributes in process `syz.3.4569'. [ 801.063953][T24281] netlink: 'syz.2.4567': attribute type 11 has an invalid length. [ 801.114259][T24281] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4567'. [ 801.139326][T24281] netlink: 'syz.2.4567': attribute type 11 has an invalid length. [ 801.330707][T24299] syzkaller0: entered promiscuous mode [ 801.336445][T24299] syzkaller0: entered allmulticast mode [ 801.698517][T24313] lo speed is unknown, defaulting to 1000 [ 801.918088][ C0] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 801.974538][T24320] lo speed is unknown, defaulting to 1000 [ 802.126506][T24326] netlink: 68 bytes leftover after parsing attributes in process `syz.1.4580'. [ 802.137911][ T5612] tipc: Node number set to 520150553 [ 802.461316][T24338] netlink: 16 bytes leftover after parsing attributes in process `syz.1.4582'. [ 802.772404][T24350] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4584'. [ 802.795099][T24350] netlink: 40 bytes leftover after parsing attributes in process `syz.1.4584'. [ 802.819891][T24350] IPVS: Unknown mcast interface: pim6reg0 [ 803.022560][T24356] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4587'. [ 803.165048][T24356] bond4: option broadcast_neighbor: mode dependency failed, not supported in mode balance-rr(0) [ 803.181561][T24356] bond4 (unregistering): Released all slaves [ 803.400020][T24360] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4588'. [ 803.419867][T24360] netlink: 16 bytes leftover after parsing attributes in process `syz.0.4588'. [ 804.235283][T24383] netlink: 'syz.3.4595': attribute type 11 has an invalid length. [ 804.498512][T24393] netlink: 24 bytes leftover after parsing attributes in process `syz.0.4597'. [ 804.514156][T24393] bridge: RTM_NEWNEIGH with unconfigured vlan 1 on bridge0 [ 804.523573][T24403] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4600'. [ 804.653556][T24409] netlink: 'syz.0.4602': attribute type 1 has an invalid length. [ 804.662351][T24409] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 804.690268][T24409] netlink: 'syz.0.4602': attribute type 1 has an invalid length. [ 804.700048][T24409] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 804.730519][T24407] FAULT_INJECTION: forcing a failure. [ 804.730519][T24407] name failslab, interval 1, probability 0, space 0, times 0 [ 804.759895][T24407] CPU: 0 UID: 0 PID: 24407 Comm: syz.3.4603 Not tainted syzkaller #0 PREEMPT(full) [ 804.759929][T24407] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 804.759945][T24407] Call Trace: [ 804.759955][T24407] [ 804.759966][T24407] dump_stack_lvl+0xe8/0x150 [ 804.760004][T24407] should_fail_ex+0x412/0x560 [ 804.760041][T24407] should_failslab+0xa8/0x100 [ 804.760082][T24407] kmem_cache_alloc_node_noprof+0x8f/0x690 [ 804.760117][T24407] ? __alloc_skb+0x186/0x7d0 [ 804.760147][T24407] ? __alloc_skb+0x1d0/0x7d0 [ 804.760173][T24407] ? __local_bh_enable_ip+0xd0/0x130 [ 804.760205][T24407] __alloc_skb+0x1d0/0x7d0 [ 804.760235][T24407] ? netlink_ack_tlv_len+0x6c/0x210 [ 804.760271][T24407] netlink_ack+0x146/0xa50 [ 804.760300][T24407] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 804.760333][T24407] ? __lock_acquire+0x6b5/0x2cf0 [ 804.760375][T24407] netlink_rcv_skb+0x2b6/0x4b0 [ 804.760409][T24407] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 804.760442][T24407] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 804.760491][T24407] ? netlink_deliver_tap+0x2e/0x1b0 [ 804.760523][T24407] ? netlink_deliver_tap+0x2e/0x1b0 [ 804.760563][T24407] netlink_unicast+0x75c/0x8e0 [ 804.760605][T24407] netlink_sendmsg+0x813/0xb40 [ 804.760650][T24407] ? __pfx_netlink_sendmsg+0x10/0x10 [ 804.760688][T24407] ? aa_sock_msg_perm+0xf1/0x1b0 [ 804.760722][T24407] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 804.760759][T24407] ____sys_sendmsg+0x972/0x9f0 [ 804.760794][T24407] ? __might_fault+0xaf/0x130 [ 804.760843][T24407] ? __pfx_____sys_sendmsg+0x10/0x10 [ 804.760889][T24407] ? import_iovec+0x73/0xa0 [ 804.760929][T24407] ___sys_sendmsg+0x2a5/0x360 [ 804.760963][T24407] ? __lock_acquire+0x6b5/0x2cf0 [ 804.760995][T24407] ? __pfx____sys_sendmsg+0x10/0x10 [ 804.761069][T24407] ? __fget_files+0x2a/0x420 [ 804.761099][T24407] ? __fget_files+0x3a0/0x420 [ 804.761140][T24407] __x64_sys_sendmsg+0x1bd/0x2a0 [ 804.761179][T24407] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 804.761226][T24407] ? __pfx_ksys_write+0x10/0x10 [ 804.761272][T24407] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 804.761300][T24407] do_syscall_64+0x15f/0xf80 [ 804.761333][T24407] ? trace_irq_disable+0x3b/0x140 [ 804.761370][T24407] ? clear_bhb_loop+0x40/0x90 [ 804.761403][T24407] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 804.761429][T24407] RIP: 0033:0x7f591959cdd9 [ 804.761452][T24407] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 804.761475][T24407] RSP: 002b:00007f591a4be028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 804.761502][T24407] RAX: ffffffffffffffda RBX: 00007f5919815fa0 RCX: 00007f591959cdd9 [ 804.761519][T24407] RDX: 0000000000000040 RSI: 0000200000000140 RDI: 0000000000000003 [ 804.761534][T24407] RBP: 00007f591a4be090 R08: 0000000000000000 R09: 0000000000000000 [ 804.761549][T24407] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 804.761563][T24407] R13: 00007f5919816038 R14: 00007f5919815fa0 R15: 00007ffc76e75708 [ 804.761603][T24407] [ 805.513830][T24433] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4610'. [ 805.689049][T24442] batadv0: entered promiscuous mode [ 805.998639][T24461] FAULT_INJECTION: forcing a failure. [ 805.998639][T24461] name failslab, interval 1, probability 0, space 0, times 0 [ 806.022749][T24461] CPU: 0 UID: 0 PID: 24461 Comm: syz.0.4617 Not tainted syzkaller #0 PREEMPT(full) [ 806.022781][T24461] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 806.022796][T24461] Call Trace: [ 806.022804][T24461] [ 806.022814][T24461] dump_stack_lvl+0xe8/0x150 [ 806.022845][T24461] should_fail_ex+0x412/0x560 [ 806.022880][T24461] should_failslab+0xa8/0x100 [ 806.022916][T24461] __kmalloc_noprof+0xe8/0x760 [ 806.022947][T24461] ? tcf_idr_create+0x5d/0x6b0 [ 806.022967][T24461] ? tcf_idr_check_alloc+0xc8/0x7f0 [ 806.022995][T24461] tcf_idr_create+0x5d/0x6b0 [ 806.023016][T24461] ? tcf_idr_check_alloc+0xc8/0x7f0 [ 806.023045][T24461] tcf_idr_create_from_flags+0x60/0x80 [ 806.023076][T24461] tcf_ct_init+0x4d4/0xb10 [ 806.023108][T24461] ? __pfx_tcf_ct_init+0x10/0x10 [ 806.023158][T24461] ? nla_memcpy+0x5b/0xc0 [ 806.023198][T24461] tcf_action_init_1+0x4ba/0x740 [ 806.023231][T24461] ? __pfx_tcf_action_init_1+0x10/0x10 [ 806.023255][T24461] ? _raw_read_unlock+0x28/0x50 [ 806.023281][T24461] ? tc_action_load_ops+0x247/0x540 [ 806.023321][T24461] ? is_bpf_text_address+0x292/0x2b0 [ 806.023353][T24461] ? __nla_parse+0x40/0x60 [ 806.023387][T24461] tcf_action_init+0x31e/0xb40 [ 806.023424][T24461] ? __pfx_tcf_action_init+0x10/0x10 [ 806.023474][T24461] ? netlink_sendmsg+0x813/0xb40 [ 806.023527][T24461] ? ____sys_sendmsg+0x972/0x9f0 [ 806.023558][T24461] ? __pfx___nla_validate_parse+0x10/0x10 [ 806.023588][T24461] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 806.023650][T24461] tc_ctl_action+0x43b/0xc70 [ 806.023689][T24461] ? __pfx_tc_ctl_action+0x10/0x10 [ 806.023727][T24461] ? trace_contention_end+0x3d/0x140 [ 806.023805][T24461] ? __pfx_tc_ctl_action+0x10/0x10 [ 806.023830][T24461] rtnetlink_rcv_msg+0x77e/0xbe0 [ 806.023861][T24461] ? rtnetlink_rcv_msg+0x1b9/0xbe0 [ 806.023887][T24461] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 806.023913][T24461] ? ref_tracker_free+0x693/0x840 [ 806.023945][T24461] ? __pfx_ref_tracker_free+0x10/0x10 [ 806.023986][T24461] netlink_rcv_skb+0x232/0x4b0 [ 806.024017][T24461] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 806.024046][T24461] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 806.024089][T24461] ? netlink_deliver_tap+0x2e/0x1b0 [ 806.024118][T24461] ? netlink_deliver_tap+0x2e/0x1b0 [ 806.024153][T24461] netlink_unicast+0x75c/0x8e0 [ 806.024192][T24461] netlink_sendmsg+0x813/0xb40 [ 806.024232][T24461] ? __pfx_netlink_sendmsg+0x10/0x10 [ 806.024265][T24461] ? aa_sock_msg_perm+0xf1/0x1b0 [ 806.024296][T24461] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 806.024331][T24461] ____sys_sendmsg+0x972/0x9f0 [ 806.024361][T24461] ? __might_fault+0xaf/0x130 [ 806.024396][T24461] ? __pfx_____sys_sendmsg+0x10/0x10 [ 806.024438][T24461] ? import_iovec+0x73/0xa0 [ 806.024472][T24461] ___sys_sendmsg+0x2a5/0x360 [ 806.024501][T24461] ? __lock_acquire+0x6b5/0x2cf0 [ 806.024530][T24461] ? __pfx____sys_sendmsg+0x10/0x10 [ 806.024600][T24461] ? __fget_files+0x2a/0x420 [ 806.024625][T24461] ? __fget_files+0x3a0/0x420 [ 806.024662][T24461] __x64_sys_sendmsg+0x1bd/0x2a0 [ 806.024696][T24461] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 806.024745][T24461] ? __pfx_ksys_write+0x10/0x10 [ 806.024786][T24461] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 806.024809][T24461] do_syscall_64+0x15f/0xf80 [ 806.024836][T24461] ? trace_irq_disable+0x3b/0x140 [ 806.024870][T24461] ? clear_bhb_loop+0x40/0x90 [ 806.024896][T24461] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 806.024918][T24461] RIP: 0033:0x7f06d119cdd9 [ 806.024939][T24461] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 806.024958][T24461] RSP: 002b:00007f06d20db028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 806.024981][T24461] RAX: ffffffffffffffda RBX: 00007f06d1415fa0 RCX: 00007f06d119cdd9 [ 806.024997][T24461] RDX: 0000000000000040 RSI: 0000200000000140 RDI: 0000000000000003 [ 806.025011][T24461] RBP: 00007f06d20db090 R08: 0000000000000000 R09: 0000000000000000 [ 806.025024][T24461] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 806.025037][T24461] R13: 00007f06d1416038 R14: 00007f06d1415fa0 R15: 00007ffcf1558ed8 [ 806.025073][T24461] [ 806.454580][T24463] netlink: 'syz.2.4619': attribute type 1 has an invalid length. [ 806.463355][T24463] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 806.481007][T24436] batadv0: left promiscuous mode [ 806.870583][T24481] Cannot find del_set index 14804 as target [ 807.719571][T24515] __nla_validate_parse: 4 callbacks suppressed [ 807.719601][T24515] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4633'. [ 807.910068][T24527] netlink: 'syz.0.4636': attribute type 1 has an invalid length. [ 808.156629][T24538] netlink: 20 bytes leftover after parsing attributes in process `syz.0.4636'. [ 808.384559][T24530] bond4: (slave vxcan3): The slave device specified does not support setting the MAC address [ 808.415742][T24530] bond4: (slave vxcan3): Error -95 calling set_mac_address [ 808.566833][T24538] bond4: (slave bridge3): Enslaving as an active interface with a down link [ 808.634865][T24539] ip6gretap0: entered promiscuous mode [ 808.647224][T24539] ip6gretap0: entered allmulticast mode [ 808.660237][T24539] bond4: (slave ip6gretap0): making interface the new active one [ 808.673127][T24539] bond4: (slave ip6gretap0): Enslaving as an active interface with an up link [ 808.686236][T24550] netlink: 'syz.3.4640': attribute type 10 has an invalid length. [ 808.897748][T24565] netlink: 64 bytes leftover after parsing attributes in process `syz.4.4642'. [ 809.380323][T24594] netlink: 24 bytes leftover after parsing attributes in process `syz.2.4650'. [ 809.611812][T24614] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4652'. [ 809.848868][T24624] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4656'. [ 809.869869][T24624] netdevsi: renamed from gretap0 (while UP) [ 809.887394][T24624] netdevsi: entered allmulticast mode [ 809.909448][T24624] A link change request failed with some changes committed already. Interface netdevsi may have been left with an inconsistent configuration, please check. [ 809.967187][T24628] x_tables: duplicate underflow at hook 1 [ 810.120586][T24630] xt_CHECKSUM: unsupported CHECKSUM operation 68 [ 810.172223][T24635] lo speed is unknown, defaulting to 1000 [ 810.579046][ T8454] IPVS: starting estimator thread 0... [ 810.678047][T24655] IPVS: using max 28 ests per chain, 67200 per kthread [ 810.718939][ C0] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 811.443160][T24673] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4674'. [ 811.587626][T24675] netlink: 'syz.3.4672': attribute type 1 has an invalid length. [ 811.629129][T24675] netlink: 224 bytes leftover after parsing attributes in process `syz.3.4672'. [ 811.900325][T24696] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4679'. [ 811.992148][T24696] bond9: entered promiscuous mode [ 812.005859][T24696] 8021q: adding VLAN 0 to HW filter on device bond9 [ 812.030978][T24696] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4679'. [ 812.130694][T24698] bridge8: entered promiscuous mode [ 812.137631][T24698] bond9: (slave bridge8): Enslaving as an active interface with an up link [ 812.278561][T24701] syzkaller1: entered promiscuous mode [ 812.284154][T24701] syzkaller1: entered allmulticast mode [ 812.630786][T24709] ip6gre2: entered promiscuous mode [ 812.640218][T24709] ip6gre2: entered allmulticast mode [ 812.688984][T24716] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 812.742604][T24717] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4686'. [ 812.786154][T24717] netlink: 121 bytes leftover after parsing attributes in process `syz.4.4686'. [ 812.843730][T24724] netlink: 44 bytes leftover after parsing attributes in process `syz.3.4689'. [ 812.857659][T24725] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4687'. [ 812.948904][T24727] Bluetooth: MGMT ver 1.23 [ 813.151076][T24732] IPVS: set_ctl: invalid protocol: 2 0.0.0.0:20002 [ 813.319757][T24746] netlink: 76 bytes leftover after parsing attributes in process `syz.0.4697'. [ 813.407727][T24744] bridge6: entered promiscuous mode [ 813.422243][T24744] bridge6: entered allmulticast mode [ 813.429302][T24746] syzkaller0: entered promiscuous mode [ 813.435657][T24746] syzkaller0: entered allmulticast mode [ 813.453865][T24747] tc action pedit offset must be on 32 bit boundaries [ 813.462960][T24747] tc action pedit offset must be on 32 bit boundaries [ 813.470033][T24747] tc action pedit offset must be on 32 bit boundaries [ 813.477372][T24747] tc action pedit offset must be on 32 bit boundaries [ 813.484223][T24747] tc action pedit offset must be on 32 bit boundaries [ 813.491088][T24747] tc action pedit offset must be on 32 bit boundaries [ 813.497930][T24747] tc action pedit offset must be on 32 bit boundaries [ 813.504782][T24747] tc action pedit offset must be on 32 bit boundaries [ 813.511648][T24747] tc action pedit offset must be on 32 bit boundaries [ 813.518488][T24747] tc action pedit offset must be on 32 bit boundaries [ 813.525344][T24747] 0: reclassify loop, rule prio 0, protocol 800 [ 813.900529][T24765] ip6erspan2: entered allmulticast mode [ 814.093714][T24772] xt_CHECKSUM: unsupported CHECKSUM operation 68 [ 814.121693][T24771] lo speed is unknown, defaulting to 1000 [ 814.129476][T24774] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4703'. [ 814.150488][T24774] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4703'. [ 814.184607][T24774] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4703'. [ 814.223216][T24774] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4703'. [ 814.281954][T24784] netlink: 'syz.4.4703': attribute type 13 has an invalid length. [ 814.291320][T24784] netlink: 'syz.4.4703': attribute type 17 has an invalid length. [ 814.299893][T24784] netlink: 'syz.4.4703': attribute type 27 has an invalid length. [ 814.364370][T24779] bridge0: port 3(vlan2) entered disabled state [ 814.370966][T24779] bridge0: port 2(bridge_slave_1) entered disabled state [ 814.378756][T24779] bridge0: port 1(bridge_slave_0) entered disabled state [ 814.595485][T24779] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 814.613456][T24779] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 814.628275][T24779] tipc: Resetting bearer [ 815.464097][T24779] erspan0: left allmulticast mode [ 815.626034][T24769] lo speed is unknown, defaulting to 1000 [ 815.633470][ T5612] syz2: Port: 1 Link DOWN [ 815.652293][ T13] netdevsim netdevsim4 eth0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 815.678591][ T13] netdevsim netdevsim4 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 815.710307][ T13] netdevsim netdevsim4 eth1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 815.737962][ T13] netdevsim netdevsim4 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 815.766944][ T13] netdevsim netdevsim4 eth2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 815.787030][ T13] netdevsim netdevsim4 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 815.806621][ T13] netdevsim netdevsim4 eth3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 815.815682][T24798] sctp: [Deprecated]: syz.1.4710 (pid 24798) Use of struct sctp_assoc_value in delayed_ack socket option. [ 815.815682][T24798] Use struct sctp_sack_info instead [ 815.834146][ T13] netdevsim netdevsim4 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 816.519353][T24823] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4716'. [ 816.571699][ T5635] block nbd1: Receive control failed (result -1) [ 818.351195][T24858] netlink: 'syz.2.4725': attribute type 89 has an invalid length. [ 818.399364][T24860] netlink: 'syz.0.4726': attribute type 1 has an invalid length. [ 818.411778][T24860] netlink: 128 bytes leftover after parsing attributes in process `syz.0.4726'. [ 818.849678][T24885] netlink: 'syz.0.4733': attribute type 1 has an invalid length. [ 818.861383][T24884] netlink: 40 bytes leftover after parsing attributes in process `syz.3.4734'. [ 818.875211][T24884] A link change request failed with some changes committed already. Interface team0 may have been left with an inconsistent configuration, please check. [ 819.221374][T24903] Cannot find set identified by id 0 to match [ 819.807248][T24924] netlink: 64 bytes leftover after parsing attributes in process `syz.2.4744'. [ 819.834845][T24926] netlink: 28 bytes leftover after parsing attributes in process `syz.4.4746'. [ 819.861533][T24926] netlink: 'syz.4.4746': attribute type 13 has an invalid length. [ 820.111930][T24935] syzkaller1: entered promiscuous mode [ 820.130117][T24935] syzkaller1: entered allmulticast mode [ 820.451258][T24956] netlink: 20 bytes leftover after parsing attributes in process `syz.4.4754'. [ 820.465708][T24951] netlink: 'syz.1.4741': attribute type 27 has an invalid length. [ 820.483289][T24951] netlink: 'syz.1.4741': attribute type 4 has an invalid length. [ 820.506428][T24956] veth0_to_team: left allmulticast mode [ 820.530555][T24956] 0·: left allmulticast mode [ 820.542484][T24951] netlink: 152 bytes leftover after parsing attributes in process `syz.1.4741'. [ 820.552426][T24952] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4752'. [ 820.569611][T24956] hsr_slave_0: left allmulticast mode [ 820.578334][T24956] hsr_slave_1: left allmulticast mode [ 820.587650][T24956] macvlan2: left allmulticast mode [ 820.602328][T24956] ip6erspan2: left allmulticast mode [ 820.621280][T24952] sctp: [Deprecated]: syz.2.4752 (pid 24952) Use of struct sctp_assoc_value in delayed_ack socket option. [ 820.621280][T24952] Use struct sctp_sack_info instead [ 820.648865][T24961] netlink: 28 bytes leftover after parsing attributes in process `syz.3.4755'. [ 820.718625][T24965] lo speed is unknown, defaulting to 1000 [ 820.732041][T24958] netlink: 'syz.2.4752': attribute type 1 has an invalid length. [ 820.751471][T24958] netlink: 224 bytes leftover after parsing attributes in process `syz.2.4752'. [ 821.012850][T24978] syzkaller0: entered promiscuous mode [ 821.029950][T24978] syzkaller0: entered allmulticast mode [ 821.451088][T24991] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4762'. [ 821.648705][T24995] netlink: 'syz.2.4763': attribute type 15 has an invalid length. [ 821.972320][T22810] udevd[22810]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 822.683085][T25038] netlink: 'syz.2.4773': attribute type 10 has an invalid length. [ 823.484249][T25036] bridge0: port 2(bridge_slave_1) entered disabled state [ 823.491753][T25036] bridge0: port 1(bridge_slave_0) entered disabled state [ 823.576165][T25063] __nla_validate_parse: 4 callbacks suppressed [ 823.576189][T25063] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4779'. [ 823.700818][ T5635] block nbd3: Receive control failed (result -107) [ 823.762402][T25064] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4779'. [ 823.854264][ T5635] block nbd5: Receive control failed (result -32) [ 823.873606][T25067] netlink: 'syz.4.4780': attribute type 1 has an invalid length. [ 824.261280][T25076] netlink: 'syz.1.4781': attribute type 142 has an invalid length. [ 824.271360][T25076] xt_l2tp: missing protocol rule (udp|l2tpip) [ 824.621843][T25036] bond3: left promiscuous mode [ 824.628983][T25036] ipip0: left promiscuous mode [ 824.639909][T25036] gretap1: left promiscuous mode [ 824.646321][T25036] gretap1: left allmulticast mode [ 824.651838][T25036] geneve2: left promiscuous mode [ 824.679601][T25036] ip6gretap0: left promiscuous mode [ 824.690500][T25036] ip6gretap0: left allmulticast mode [ 824.696911][T25036] ip6gre2: left promiscuous mode [ 824.709928][T25036] ip6gre2: left allmulticast mode [ 824.723715][T25038] team0: Port device dummy0 added [ 824.729400][T25047] veth1_to_bond: entered allmulticast mode [ 824.748052][T25047] veth1_to_bond: left allmulticast mode [ 824.785633][T25067] workqueue: Failed to create a rescuer kthread for wq "bond5": -EINTR [ 824.876341][ T8573] netdevsim netdevsim0 eth0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 824.923268][ T8573] netdevsim netdevsim0 eth0: unset [0, 1] type 1 family 0 port 2816 - 0 [ 824.947021][ T8573] netdevsim netdevsim0 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 824.969046][ T8573] netdevsim netdevsim0 eth1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 825.010639][T25084] netlink: 16 bytes leftover after parsing attributes in process `syz.0.4783'. [ 825.019910][ T8573] netdevsim netdevsim0 eth1: unset [0, 1] type 1 family 0 port 2816 - 0 [ 825.042063][ T8573] netdevsim netdevsim0 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 825.078399][T25083] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4783'. [ 825.121501][ T8573] netdevsim netdevsim0 eth2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 825.134114][ T8573] netdevsim netdevsim0 eth2: unset [0, 1] type 1 family 0 port 2816 - 0 [ 825.143432][ T8573] netdevsim netdevsim0 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 825.165283][ T8573] netdevsim netdevsim0 eth3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 825.196343][ T8573] netdevsim netdevsim0 eth3: unset [0, 1] type 1 family 0 port 2816 - 0 [ 825.225598][ T8573] netdevsim netdevsim0 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 825.353298][T25102] batadv1: entered promiscuous mode [ 825.360790][T25102] batadv1: entered allmulticast mode [ 825.404334][T25092] lo speed is unknown, defaulting to 1000 [ 825.550175][T25102] netlink: 'syz.2.4788': attribute type 1 has an invalid length. [ 825.618086][T25110] bridge0: port 3(erspan0) entered blocking state [ 825.637144][T25110] bridge0: port 3(erspan0) entered disabled state [ 825.657309][T25110] erspan0: entered allmulticast mode [ 825.665401][T25110] erspan0: entered promiscuous mode [ 825.674790][T25112] erspan0: left allmulticast mode [ 825.680881][T25112] erspan0: left promiscuous mode [ 825.689724][T25112] bridge0: port 3(erspan0) entered disabled state [ 826.404345][T25136] x_tables: arp_tables: NFQUEUE target: not valid for this family [ 827.030171][T25160] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 827.066955][T25158] netlink: 'syz.2.4800': attribute type 7 has an invalid length. [ 827.173725][T23510] netdevsim netdevsim2 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 827.191272][T23510] netdevsim netdevsim2 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 827.200894][T23510] netdevsim netdevsim2 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 827.212792][T23510] netdevsim netdevsim2 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 827.257254][T25167] netlink: 'syz.0.4805': attribute type 1 has an invalid length. [ 827.294370][T25170] netlink: 'syz.0.4805': attribute type 1 has an invalid length. [ 827.477548][T25179] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4808'. [ 827.504246][T25177] netlink: 16 bytes leftover after parsing attributes in process `syz.0.4807'. [ 827.776908][T25190] hmac(sha224: entered promiscuous mode [ 828.032591][T25205] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4815'. [ 828.057933][T25205] netlink: 'syz.2.4815': attribute type 11 has an invalid length. [ 828.077103][T25205] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4815'. [ 828.106929][T25205] netlink: 'syz.2.4815': attribute type 11 has an invalid length. [ 828.125870][T25210] IPVS: set_ctl: invalid protocol: 12 127.0.0.1:20004 [ 828.379891][T25198] netlink: 68 bytes leftover after parsing attributes in process `syz.0.4812'. [ 829.091911][T25229] netlink: 16 bytes leftover after parsing attributes in process `syz.3.4821'. [ 829.120057][T25229] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4821'. [ 829.168637][T25229] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 829.314529][T25243] netlink: 'syz.2.4824': attribute type 1 has an invalid length. [ 829.324344][T25245] netlink: 24 bytes leftover after parsing attributes in process `syz.0.4825'. [ 829.408984][T25243] bond8: entered promiscuous mode [ 829.429086][T25243] 8021q: adding VLAN 0 to HW filter on device bond8 [ 829.497075][T25250] 8021q: adding VLAN 0 to HW filter on device bond8 [ 829.515949][T25243] netlink: 2120 bytes leftover after parsing attributes in process `syz.2.4824'. [ 829.529436][T25262] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4828'. [ 829.541314][T25250] bond8: (slave wireguard0): The slave device specified does not support setting the MAC address [ 829.566916][T25250] bond8: (slave wireguard0): Setting fail_over_mac to active for active-backup mode [ 829.586902][T25250] bond8: (slave wireguard0): making interface the new active one [ 829.596997][T25250] wireguard0: entered promiscuous mode [ 829.605483][T25250] bond8: (slave wireguard0): Enslaving as an active interface with an up link [ 829.764702][T25268] syzkaller1: entered promiscuous mode [ 829.781821][T25268] syzkaller1: entered allmulticast mode [ 829.902499][T25270] sit3: entered allmulticast mode [ 830.244162][T25288] netlink: 6188 bytes leftover after parsing attributes in process `syz.2.4837'. [ 830.491034][T25305] netlink: 20 bytes leftover after parsing attributes in process `syz.2.4841'. [ 830.882024][T25320] netlink: 'syz.1.4844': attribute type 1 has an invalid length. [ 830.929755][T25323] netlink: 28 bytes leftover after parsing attributes in process `syz.2.4845'. [ 830.952035][T25323] netlink: 32 bytes leftover after parsing attributes in process `syz.2.4845'. [ 830.966579][T25323] netlink: 28 bytes leftover after parsing attributes in process `syz.2.4845'. [ 830.999728][T25320] bond10: (slave vxcan1): The slave device specified does not support setting the MAC address [ 831.012565][T25320] bond10: (slave vxcan1): Error -95 calling set_mac_address [ 831.122003][T25326] bond10: (slave bridge10): Enslaving as an active interface with a down link [ 831.139591][T25330] A link change request failed with some changes committed already. Interface 26±ÿ may have been left with an inconsistent configuration, please check. [ 831.169907][T25320] ip6gretap2: entered promiscuous mode [ 831.175642][T25320] ip6gretap2: entered allmulticast mode [ 831.186576][T25320] bond10: (slave ip6gretap2): making interface the new active one [ 831.195853][T25320] bond10: (slave ip6gretap2): Enslaving as an active interface with an up link [ 831.347024][T25341] tipc: Enabling of bearer rejected, failed to enable media [ 831.366044][T25341] bond0: entered promiscuous mode [ 831.371532][T25341] bond_slave_0: entered promiscuous mode [ 831.377540][T25341] bond_slave_1: entered promiscuous mode [ 831.496051][T25345] netlink: 'syz.3.4851': attribute type 13 has an invalid length. [ 831.504844][T25345] netlink: 'syz.3.4851': attribute type 17 has an invalid length. [ 831.655378][T25345] 8021q: adding VLAN 0 to HW filter on device bond0 [ 831.688668][T25345] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 831.755373][T25345] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 831.774483][T25345] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 831.812835][T25345] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 831.831835][T25345] veth1_macvtap: left promiscuous mode [ 831.842592][T25345] veth0_macvtap: left promiscuous mode [ 831.850467][T25360] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 831.862337][T25345] veth0_macvtap: entered promiscuous mode [ 831.870151][T25345] veth1_macvtap: entered promiscuous mode [ 831.891091][T25345] 8021q: adding VLAN 0 to HW filter on device bond2 [ 831.900236][T25345] 8021q: adding VLAN 0 to HW filter on device bond3 [ 831.910890][T25345] 8021q: adding VLAN 0 to HW filter on device bond1 [ 831.919252][T25345] hsr1: Slave B (team0) is not up; please bring it up to get a fully working HSR network [ 831.950133][T25345] 8021q: adding VLAN 0 to HW filter on device bond4 [ 832.003115][T25345] 8021q: adding VLAN 0 to HW filter on device bond5 [ 832.013143][T25345] 8021q: adding VLAN 0 to HW filter on device bond6 [ 832.041977][T25345] 8021q: adding VLAN 0 to HW filter on device eth0 [ 832.057708][T25345] 8021q: adding VLAN 0 to HW filter on device eth1 [ 832.075696][T25345] 8021q: adding VLAN 0 to HW filter on device eth2 [ 832.093182][T25345] 8021q: adding VLAN 0 to HW filter on device eth3 [ 832.123971][T25345] 8021q: adding VLAN 0 to HW filter on device bond7 [ 832.146478][T25345] 8021q: adding VLAN 0 to HW filter on device bond8 [ 832.157414][T25345] 8021q: adding VLAN 0 to HW filter on device bond9 [ 832.174454][T25345] 8021q: adding VLAN 0 to HW filter on device bond10 [ 832.192457][T25345] 8021q: adding VLAN 0 to HW filter on device bond11 [ 832.213608][T25345] bridge6: left promiscuous mode [ 832.220277][T25345] bridge6: left allmulticast mode [ 832.237309][T25350] bridge0: port 2(bridge_slave_1) entered disabled state [ 832.268526][T13349] bridge0: port 1(bridge_slave_0) entered blocking state [ 832.275757][T13349] bridge0: port 1(bridge_slave_0) entered forwarding state [ 832.401765][ T8573] netdevsim netdevsim3 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 832.413072][ T8573] netdevsim netdevsim3 eth0: set [0, 1] type 1 family 0 port 2816 - 0 [ 832.426491][ T8573] netdevsim netdevsim3 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 832.442515][ T8573] netdevsim netdevsim3 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 832.468381][ T8573] netdevsim netdevsim3 eth1: set [0, 1] type 1 family 0 port 2816 - 0 [ 832.492642][ T8573] netdevsim netdevsim3 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 832.511007][ T8573] netdevsim netdevsim3 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 832.522869][ T8573] netdevsim netdevsim3 eth2: set [0, 1] type 1 family 0 port 2816 - 0 [ 832.532166][ T8573] netdevsim netdevsim3 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 832.586057][ T8573] netdevsim netdevsim3 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 832.596306][ T8573] netdevsim netdevsim3 eth3: set [0, 1] type 1 family 0 port 2816 - 0 [ 832.605827][ T8573] netdevsim netdevsim3 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 832.923171][T23510] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 833.037390][T25386] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 833.623315][T25406] bridge0: port 3(syz_tun) entered blocking state [ 833.639912][T25406] bridge0: port 3(syz_tun) entered disabled state [ 833.655537][T25406] syz_tun: entered allmulticast mode [ 833.671691][T25406] syz_tun: entered promiscuous mode [ 833.688767][T25406] bridge0: port 3(syz_tun) entered blocking state [ 833.695414][T25406] bridge0: port 3(syz_tun) entered forwarding state [ 834.526498][T25412] netlink: 'syz.0.4871': attribute type 32 has an invalid length. [ 834.536486][T25412] __nla_validate_parse: 6 callbacks suppressed [ 834.536505][T25412] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4871'. [ 834.590679][T25434] netlink: 68 bytes leftover after parsing attributes in process `syz.1.4875'. [ 834.666049][T25412] bond5: Setting coupled_control to off (0) [ 834.712813][T25433] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 834.732051][T25439] netlink: 236 bytes leftover after parsing attributes in process `syz.4.4878'. [ 834.893122][T25448] netlink: 'syz.2.4879': attribute type 1 has an invalid length. [ 834.913442][T25447] netlink: 64 bytes leftover after parsing attributes in process `syz.4.4880'. [ 834.937318][T25450] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4881'. [ 835.025502][T25452] pimreg0: tun_chr_ioctl cmd 1074025681 [ 835.691729][T25484] Bluetooth: MGMT ver 1.23 [ 835.818083][T25489] netlink: 40 bytes leftover after parsing attributes in process `syz.4.4892'. [ 836.028831][T25495] Bluetooth: MGMT ver 1.23 [ 836.074567][T25495] syzkaller1: entered promiscuous mode [ 836.081853][T25495] syzkaller1: entered allmulticast mode [ 836.245595][T25495] openvswitch: netlink: IPv4 tun info is not correct [ 836.349398][T25505] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4895'. [ 836.369832][T25505] A link change request failed with some changes committed already. Interface team0 may have been left with an inconsistent configuration, please check. [ 836.629516][ T30] audit: type=1800 audit(1778125506.389:18): pid=25488 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.4891" name="memory.events" dev="tmpfs" ino=1632 res=0 errno=0 [ 836.674688][T25520] netlink: 'syz.0.4897': attribute type 4 has an invalid length. [ 836.731911][T25524] netlink: 'syz.0.4897': attribute type 4 has an invalid length. [ 837.038247][ C0] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 837.239820][T25549] netlink: 24 bytes leftover after parsing attributes in process `syz.3.4906'. [ 837.521065][T25553] syzkaller0: entered promiscuous mode [ 837.539500][T25553] syzkaller0: entered allmulticast mode [ 837.901278][T25575] erspan0: entered promiscuous mode [ 837.959619][T25575] bridge0: left promiscuous mode [ 837.996110][T25575] 8021q: adding VLAN 0 to HW filter on device bond0 [ 838.025550][T25575] 8021q: adding VLAN 0 to HW filter on device team0 [ 838.050043][T25575] batadv0: left promiscuous mode [ 838.059581][T25584] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4913'. [ 838.071552][T25575] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 838.132148][T25588] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4912'. [ 838.165797][T25575] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 838.207200][T25575] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 838.231427][T25575] veth1_vlan: left promiscuous mode [ 838.238940][T25575] veth0_vlan: left promiscuous mode [ 838.245363][T25575] veth0_vlan: entered promiscuous mode [ 838.255156][T25575] veth1_vlan: entered promiscuous mode [ 838.276568][T25594] sctp: [Deprecated]: syz.0.4915 (pid 25594) Use of int in max_burst socket option deprecated. [ 838.276568][T25594] Use struct sctp_assoc_value instead [ 838.301923][T25575] 8021q: adding VLAN 0 to HW filter on device bond1 [ 838.319916][T25575] 8021q: adding VLAN 0 to HW filter on device bond2 [ 838.399533][T25575] batadv0: entered promiscuous mode [ 838.405467][T25575] 8021q: adding VLAN 0 to HW filter on device macsec1 [ 838.419706][T25575] A link change request failed with some changes committed already. Interface vxlan0 may have been left with an inconsistent configuration, please check. [ 838.473803][T25579] veth1_to_batadv: entered allmulticast mode [ 838.604870][T23510] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 838.665939][T23510] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 838.703902][T23510] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 838.723738][T23510] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 838.769511][T25605] d: renamed from syzkaller0 [ 838.943027][T25619] netlink: 'syz.2.4922': attribute type 1 has an invalid length. [ 838.952130][T25619] netlink: 'syz.2.4922': attribute type 7 has an invalid length. [ 838.966154][T25619] netlink: 'syz.2.4922': attribute type 8 has an invalid length. [ 838.976558][T25619] NCSI netlink: No device for ifindex 1073545264 [ 839.191894][T25627] netlink: 'syz.3.4925': attribute type 13 has an invalid length. [ 839.209919][T25627] netlink: 'syz.3.4925': attribute type 4 has an invalid length. [ 839.462712][T23510] wlan0: Selected IBSS BSSID 50:50:50:50:50:50 based on configured SSID [ 839.673368][T25648] __nla_validate_parse: 4 callbacks suppressed [ 839.673390][T25648] netlink: 16 bytes leftover after parsing attributes in process `syz.3.4932'. [ 839.832304][T25657] xt_hashlimit: size too large, truncated to 1048576 [ 839.961318][T25663] tipc: Enabling of bearer rejected, media not registered [ 840.095461][T25666] netlink: 24 bytes leftover after parsing attributes in process `syz.4.4934'. [ 840.187929][T25673] sctp: [Deprecated]: syz.2.4939 (pid 25673) Use of struct sctp_assoc_value in delayed_ack socket option. [ 840.187929][T25673] Use struct sctp_sack_info instead [ 840.383531][T25683] xt_time: invalid argument - start or stop time greater than 23:59:59 [ 840.422117][T25682] pim6reg1: entered promiscuous mode [ 840.444203][T25682] pim6reg1: entered allmulticast mode [ 841.147258][T25718] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4950'. [ 841.312943][T25712] netlink: 'syz.0.4950': attribute type 1 has an invalid length. [ 841.334825][T25712] netlink: 34767 bytes leftover after parsing attributes in process `syz.0.4950'. [ 841.468967][T25732] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4955'. [ 841.503561][T25736] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4955'. [ 841.542893][T25738] bridge4: trying to set multicast query interval above maximum, setting to 8640000 (86400000ms) [ 841.614814][T25740] netlink: 20 bytes leftover after parsing attributes in process `syz.3.4957'. [ 841.981874][T25758] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4962'. [ 842.279739][T25769] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4967'. [ 842.418680][T25774] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4968'. [ 842.920191][T25811] žÿ: renamed from team_slave_1 (while UP) [ 843.003070][T25812] lo speed is unknown, defaulting to 1000 [ 844.047553][T25826] lo speed is unknown, defaulting to 1000 [ 844.131162][T25835] sctp: [Deprecated]: syz.2.4982 (pid 25835) Use of struct sctp_assoc_value in delayed_ack socket option. [ 844.131162][T25835] Use struct sctp_sack_info instead [ 844.154081][T25835] sctp: [Deprecated]: syz.2.4982 (pid 25835) Use of struct sctp_assoc_value in delayed_ack socket option. [ 844.154081][T25835] Use struct sctp_sack_info instead [ 844.205599][T25835] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 844.250252][T25835] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 844.807401][T25851] __nla_validate_parse: 2 callbacks suppressed [ 844.807426][T25851] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4986'. [ 844.829921][T25851] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4986'. [ 845.024144][T25858] netlink: 36 bytes leftover after parsing attributes in process `syz.2.4988'. [ 845.580625][T25873] netlink: 36 bytes leftover after parsing attributes in process `syz.2.4993'. [ 845.604694][T25873] xt_hashlimit: size too large, truncated to 1048576 [ 845.766563][T25875] bond11 (unregistering): Released all slaves [ 845.919372][ C0] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 846.437361][T25899] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4996'. [ 846.524616][T25885] syzkaller1: entered promiscuous mode [ 846.542176][T25885] syzkaller1: entered allmulticast mode [ 846.552847][T25905] netlink: 16 bytes leftover after parsing attributes in process `syz.0.4997'. [ 846.800552][T25909] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4999'. [ 846.909079][T25909] ipvlan2: entered allmulticast mode [ 846.925346][T25909] syz_tun: entered allmulticast mode [ 847.366115][T25925] netlink: 'syz.2.5004': attribute type 1 has an invalid length. [ 847.762946][T25944] xt_hashlimit: size too large, truncated to 1048576 [ 847.859339][T25949] netlink: 10 bytes leftover after parsing attributes in process `syz.4.5007'. [ 848.007096][T25955] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5009'. [ 848.260160][T25970] netlink: 28 bytes leftover after parsing attributes in process `syz.3.5014'. [ 848.272063][T25968] faux_driver regulatory: loading /lib/firmware/regulatory.db.p7s failed with error -4 [ 848.302736][T25968] faux_driver regulatory: Direct firmware load for regulatory.db.p7s failed with error -4 [ 848.338075][T25968] faux_driver regulatory: Falling back to sysfs fallback for: regulatory.db.p7s [ 848.424571][T25975] netlink: 'syz.2.5015': attribute type 2 has an invalid length. [ 848.451609][T25981] RDS: rds_bind could not find a transport for fe80::1a, load rds_tcp or rds_rdma? [ 849.471081][T26027] veth0: entered promiscuous mode [ 849.504912][T26026] veth0: left promiscuous mode [ 849.593402][T26036] netlink: Unknown conntrack attr (type=2304, max=9) [ 849.654661][T26039] A link change request failed with some changes committed already. Interface 26±ÿ may have been left with an inconsistent configuration, please check. [ 849.750093][T26041] lo speed is unknown, defaulting to 1000 [ 849.851957][T26046] __nla_validate_parse: 5 callbacks suppressed [ 849.851981][T26046] netlink: 140 bytes leftover after parsing attributes in process `syz.3.5036'. [ 850.191193][T26062] netlink: 20 bytes leftover after parsing attributes in process `syz.4.5041'. [ 850.210349][T26062] tipc: Enabling of bearer rejected, failed to enable media [ 850.237712][T26062] netlink: 'syz.4.5041': attribute type 27 has an invalid length. [ 850.708928][T26080] vlan2: entered allmulticast mode [ 850.728007][T26080] veth0_to_bond: entered allmulticast mode [ 850.770454][ T5635] Bluetooth: hci3: link tx timeout [ 850.775726][ T5635] Bluetooth: hci3: killing stalled connection 10:aa:aa:aa:aa:aa [ 850.994375][T26088] x_tables: duplicate underflow at hook 2 [ 851.080823][T26088] syzkaller0: entered promiscuous mode [ 851.092241][T26088] syzkaller0: entered allmulticast mode [ 851.194439][T26092] netlink: 112 bytes leftover after parsing attributes in process `syz.1.5047'. [ 851.229406][T26088] tipc: Enabled bearer , priority 0 [ 851.291288][T26087] tipc: Resetting bearer [ 851.354464][T26087] tipc: Disabling bearer [ 851.425846][T26100] netlink: 'syz.3.5051': attribute type 1 has an invalid length. [ 851.443716][T26100] netlink: 'syz.3.5051': attribute type 2 has an invalid length. [ 851.524332][T26104] netlink: 212 bytes leftover after parsing attributes in process `syz.4.5052'. [ 851.565333][T26104] netlink: 12 bytes leftover after parsing attributes in process `syz.4.5052'. [ 851.722454][T26104] ipvlan2: entered allmulticast mode [ 851.741724][T26104] syz_tun: entered allmulticast mode [ 851.845115][T26117] netlink: 24 bytes leftover after parsing attributes in process `syz.1.5056'. [ 852.096854][T26126] netlink: 24 bytes leftover after parsing attributes in process `syz.1.5058'. [ 852.132305][T26126] netlink: 32 bytes leftover after parsing attributes in process `syz.1.5058'. [ 852.273939][T26137] vlan2: entered allmulticast mode [ 852.289712][T26137] bond0: entered allmulticast mode [ 852.301499][T26137] bond_slave_0: entered allmulticast mode [ 852.316367][T26137] bond_slave_1: entered allmulticast mode [ 852.363747][T26138] openvswitch: netlink: Message has 16 unknown bytes. [ 852.596626][T26146] netlink: 'syz.4.5064': attribute type 7 has an invalid length. [ 852.633404][T26146] netlink: 209840 bytes leftover after parsing attributes in process `syz.4.5064'. [ 852.674866][T26150] netlink: 12 bytes leftover after parsing attributes in process `syz.0.5063'. [ 852.811598][ T5635] Bluetooth: hci3: command 0x0405 tx timeout [ 852.974287][T26160] syzkaller0: entered promiscuous mode [ 852.980706][T26160] syzkaller0: entered allmulticast mode [ 853.026271][T26160] tipc: Enabled bearer , priority 0 [ 853.036140][T26160] 8021q: VLANs not supported on sit0 [ 853.055718][T26159] tipc: Resetting bearer [ 853.091126][T26159] tipc: Disabling bearer [ 853.526002][T26185] bond0: option primary: mode dependency failed, not supported in mode balance-rr(0) [ 853.708948][T26199] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 853.743593][T26197] netlink: 'syz.4.5078': attribute type 1 has an invalid length. [ 853.995620][T26204] bond5: (slave vxcan3): The slave device specified does not support setting the MAC address [ 854.023622][T26204] bond5: (slave vxcan3): Error -95 calling set_mac_address [ 854.104105][T26206] bond5: (slave gretap2): making interface the new active one [ 854.121785][T26206] bond5: (slave gretap2): Enslaving as an active interface with an up link [ 854.203954][T26197] bond5: (slave bridge5): Enslaving as an active interface with a down link [ 854.291754][T26204] macvlan3: entered promiscuous mode [ 854.297181][T26204] macvlan3: entered allmulticast mode [ 854.304118][T26204] bond5: entered promiscuous mode [ 854.309359][T26204] gretap2: entered promiscuous mode [ 854.315489][T26204] 8021q: adding VLAN 0 to HW filter on device macvlan3 [ 854.335035][T26204] bond5: (slave macvlan3): the slave hw address is in use by the bond; giving it the hw address of gretap2 [ 854.350461][T26204] bond5: left promiscuous mode [ 854.355607][T26204] gretap2: left promiscuous mode [ 854.437026][T26222] bond6: entered promiscuous mode [ 854.447219][T26222] bond6: entered allmulticast mode [ 854.453409][T26225] netlink: 'syz.3.5084': attribute type 1 has an invalid length. [ 854.466862][T26222] 8021q: adding VLAN 0 to HW filter on device bond6 [ 854.934245][T26249] __nla_validate_parse: 12 callbacks suppressed [ 854.934267][T26249] netlink: 72 bytes leftover after parsing attributes in process `syz.4.5092'. [ 854.950007][T26249] netlink: 'syz.4.5092': attribute type 1 has an invalid length. [ 855.030551][T26250] netlink: 'syz.4.5092': attribute type 4 has an invalid length. [ 855.090763][T26254] ipvlan2: entered promiscuous mode [ 855.296315][T26256] bond11: entered promiscuous mode [ 855.325687][T26256] 8021q: adding VLAN 0 to HW filter on device bond11 [ 856.123877][T26310] bond12: option lacp_active: invalid value (8) [ 856.142901][T26310] bond12 (unregistering): Released all slaves [ 856.334751][T26320] IPv6: NLM_F_CREATE should be specified when creating new route [ 856.347298][T26320] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 856.354782][T26320] IPv6: NLM_F_CREATE should be set when creating new route [ 856.362176][T26320] IPv6: NLM_F_CREATE should be set when creating new route [ 856.369488][T26320] IPv6: NLM_F_CREATE should be set when creating new route [ 856.742542][T26340] netlink: 'syz.1.5111': attribute type 13 has an invalid length. [ 856.892171][T26350] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5115'. [ 856.956990][T26356] netlink: 62967 bytes leftover after parsing attributes in process `syz.1.5118'. [ 857.928997][T26376] lo speed is unknown, defaulting to 1000 [ 859.060047][T26393] netlink: 'syz.0.5125': attribute type 1 has an invalid length. [ 859.093803][T26393] bond7: entered promiscuous mode [ 859.100057][T26393] 8021q: adding VLAN 0 to HW filter on device bond7 [ 859.129108][T26393] bond7: (slave veth5): making interface the new active one [ 859.136507][T26393] veth5: entered promiscuous mode [ 859.145275][T26393] bond7: (slave veth5): Enslaving as an active interface with an up link [ 859.732386][T26339] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 859.947228][T26400] netlink: 20 bytes leftover after parsing attributes in process `syz.4.5129'. [ 860.029401][T26415] netlink: 52 bytes leftover after parsing attributes in process `syz.3.5130'. [ 860.172827][T26420] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5133'. [ 860.500717][T26447] netlink: 28 bytes leftover after parsing attributes in process `syz.3.5140'. [ 860.518793][T26447] netlink: 'syz.3.5140': attribute type 7 has an invalid length. [ 860.558809][T26447] netlink: 'syz.3.5140': attribute type 8 has an invalid length. [ 860.590974][T26447] netlink: 4 bytes leftover after parsing attributes in process `syz.3.5140'. [ 860.667129][T26444] syzkaller0: entered promiscuous mode [ 860.672794][T26444] syzkaller0: entered allmulticast mode [ 860.738498][T26439] lo speed is unknown, defaulting to 1000 [ 861.412616][T26469] IPVS: set_ctl: invalid protocol: 0 172.20.20.187:20003 [ 862.558651][ C0] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 865.264929][T26495] netlink: 12 bytes leftover after parsing attributes in process `syz.1.5151'. [ 865.284662][T26494] netlink: 'syz.4.5150': attribute type 10 has an invalid length. [ 865.295523][T26494] netlink: 228 bytes leftover after parsing attributes in process `syz.4.5150'. [ 865.360554][T26495] 8021q: adding VLAN 0 to HW filter on device bond12 [ 865.415396][T26493] bond12: entered promiscuous mode [ 865.421012][T26493] bond12: entered allmulticast mode [ 865.429751][T26493] 8021q: adding VLAN 0 to HW filter on device bond12 [ 865.438925][T26493] team0: Port device bond12 added [ 865.579343][T26503] netlink: 28 bytes leftover after parsing attributes in process `syz.3.5152'. [ 865.970373][T26532] xt_addrtype: ipv6 PROHIBIT (THROW, NAT ..) matching not supported [ 866.087388][T26536] netlink: 28 bytes leftover after parsing attributes in process `syz.0.5158'. [ 866.186068][T26541] netlink: 12 bytes leftover after parsing attributes in process `syz.3.5159'. [ 866.312435][T26546] netlink: 'syz.4.5160': attribute type 1 has an invalid length. [ 866.334864][T26550] netlink: 4 bytes leftover after parsing attributes in process `syz.3.5159'. [ 866.359184][T26546] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 866.369855][T26541] 8021q: adding VLAN 0 to HW filter on device bond12 [ 866.530569][T26562] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5163'. [ 866.595140][T26547] 8021q: adding VLAN 0 to HW filter on device bond13 [ 866.612042][T26547] bond12: (slave bond13): Enslaving as an active interface with an up link [ 866.711507][T26550] bond12 (unregistering): (slave bond13): Releasing backup interface [ 866.766355][T26550] bond12 (unregistering): Released all slaves [ 866.813673][T26570] netlink: 'syz.4.5165': attribute type 15 has an invalid length. [ 866.895300][T26562] team0: Failed to send options change via netlink (err -105) [ 866.932940][T26562] team0: Failed to send port change of device team_slave_0 via netlink (err -105) [ 866.950473][T26562] team0: Port device team_slave_0 removed [ 867.102114][T26570] lo speed is unknown, defaulting to 1000 [ 867.150110][T26577] bridge0: received packet on syz_tun with own address as source address (addr:aa:aa:aa:aa:aa:aa, vlan:0) [ 867.165704][T26577] sctp: [Deprecated]: syz.3.5166 (pid 26577) Use of int in max_burst socket option deprecated. [ 867.165704][T26577] Use struct sctp_assoc_value instead [ 867.585877][T26589] netlink: 12 bytes leftover after parsing attributes in process `syz.1.5169'. [ 868.554586][T26628] lo speed is unknown, defaulting to 1000 [ 868.883250][T26602] Bluetooth: hci3: Opcode 0x0401 failed: -4 [ 869.022247][T26649] netlink: 28 bytes leftover after parsing attributes in process `syz.3.5182'. [ 869.182847][T26654] sctp: [Deprecated]: syz.2.5183 (pid 26654) Use of int in max_burst socket option deprecated. [ 869.182847][T26654] Use struct sctp_assoc_value instead [ 869.815540][T26666] netlink: 1484 bytes leftover after parsing attributes in process `syz.0.5187'. [ 870.157932][T17150] Bluetooth: hci3: command 0x0405 tx timeout [ 870.699541][T26687] netdevsim netdevsim2 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 870.717479][T26687] netdevsim netdevsim2 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 870.793352][T26692] __nla_validate_parse: 1 callbacks suppressed [ 870.793376][T26692] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5190'. [ 870.928519][T26687] netdevsim netdevsim2 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 870.957292][T26687] netdevsim netdevsim2 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 871.129141][T26687] netdevsim netdevsim2 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 871.140539][T26687] netdevsim netdevsim2 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 871.233138][T26687] netdevsim netdevsim2 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 871.253098][T26687] netdevsim netdevsim2 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 871.569585][T23510] netdevsim netdevsim2 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 871.593535][T23510] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 871.690944][T12995] netdevsim netdevsim2 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 871.725836][T12995] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 871.773393][T26732] netlink: 'syz.3.5206': attribute type 4 has an invalid length. [ 871.797655][T12995] netdevsim netdevsim2 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 871.816596][T12995] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 871.945798][T26687] netdevsim netdevsim2 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 871.989548][T26687] netdevsim netdevsim2 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 872.026613][T26747] netlink: 12 bytes leftover after parsing attributes in process `syz.0.5209'. [ 872.149606][T26735] lo speed is unknown, defaulting to 1000 [ 872.201975][T17150] block nbd6: Receive control failed (result -107) [ 872.231525][T26687] netdevsim netdevsim2 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 872.236547][T26746] netlink: 12 bytes leftover after parsing attributes in process `syz.0.5209'. [ 872.270520][T26687] netdevsim netdevsim2 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 872.295187][T17150] block nbd7: Receive control failed (result -32) [ 872.351461][T26756] netlink: 64 bytes leftover after parsing attributes in process `syz.1.5212'. [ 872.376008][T26687] netdevsim netdevsim2 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 872.395314][T26687] netdevsim netdevsim2 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 872.572524][T26760] netlink: 12 bytes leftover after parsing attributes in process `syz.0.5213'. [ 873.270228][T26779] netlink: 12 bytes leftover after parsing attributes in process `syz.3.5218'. [ 873.380124][T26781] netem: change failed [ 873.422066][T26779] netlink: 76 bytes leftover after parsing attributes in process `syz.3.5218'. [ 873.432155][T26779] A link change request failed with some changes committed already. Interface team0 may have been left with an inconsistent configuration, please check. [ 873.452528][T26783] syzkaller0: entered promiscuous mode [ 873.460027][T26783] syzkaller0: entered allmulticast mode [ 873.792559][T26791] rdma_rxe: rxe_newlink: failed to add lo [ 874.194965][T26795] netlink: 'syz.1.5223': attribute type 1 has an invalid length. [ 874.231841][T26795] netlink: 13 bytes leftover after parsing attributes in process `syz.1.5223'. [ 874.251209][T26800] netlink: 12 bytes leftover after parsing attributes in process `syz.3.5224'. [ 874.266834][T26800] netlink: 4 bytes leftover after parsing attributes in process `syz.3.5224'. [ 874.459174][T26802] geneve2: entered promiscuous mode [ 874.468674][T26802] geneve2: entered allmulticast mode [ 874.500606][T26615] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 874.516301][T26615] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 874.535870][T26615] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 874.615143][T26615] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 875.063573][T26828] openvswitch: netlink: Flow key attr not present in new flow. [ 875.186711][T26830] xt_bpf: check failed: parse error [ 875.342858][T26836] xt_CT: You must specify a L4 protocol and not use inversions on it [ 875.599832][T23510] tipc: Resetting bearer [ 875.664760][T26846] geneve3: entered promiscuous mode [ 875.690518][T26848] IPVS: set_ctl: invalid protocol: 2 0.0.0.0:20002 [ 875.693598][T26846] geneve3: entered allmulticast mode [ 876.317306][T26874] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 876.340974][T26868] __nla_validate_parse: 5 callbacks suppressed [ 876.340998][T26868] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5246'. [ 876.394614][T26876] syzkaller0: entered promiscuous mode [ 876.422476][T26876] syzkaller0: entered allmulticast mode [ 876.472064][T26868] vlan1: entered promiscuous mode [ 876.504672][T26868] geneve1: entered promiscuous mode [ 876.520774][T26868] vlan1: entered allmulticast mode [ 876.539819][T26868] geneve1: entered allmulticast mode [ 877.320133][T26910] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5257'. [ 877.462547][T26909] bridge0: port 2(bridge_slave_1) entered disabled state [ 877.470318][T26909] bridge0: port 1(bridge_slave_0) entered disabled state [ 877.503331][T26920] netlink: 52 bytes leftover after parsing attributes in process `syz.0.5259'. [ 877.514343][T26920] netlink: 52 bytes leftover after parsing attributes in process `syz.0.5259'. [ 877.524998][T26920] netlink: 52 bytes leftover after parsing attributes in process `syz.0.5259'. [ 877.539668][T26921] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 877.636037][T26926] netlink: 'syz.0.5261': attribute type 1 has an invalid length. [ 877.657145][T26925] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5260'. [ 877.676287][T26909] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 877.726660][T26909] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 877.834287][T26934] netlink: 28 bytes leftover after parsing attributes in process `syz.0.5264'. [ 877.855108][T26935] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5263'. [ 877.871810][T26935] openvswitch: netlink: Geneve opt len 1 is not a multiple of 4. [ 877.941712][T23510] netdevsim netdevsim1 eth0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 877.965433][T23510] netdevsim netdevsim1 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 877.985647][T23510] netdevsim netdevsim1 eth1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 878.005647][T23510] netdevsim netdevsim1 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 878.061211][T26934] x_tables: arp_tables: NFQUEUE target: not valid for this family [ 878.096297][T23510] netdevsim netdevsim1 eth2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 878.131150][T23510] netdevsim netdevsim1 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 878.160839][T23510] netdevsim netdevsim1 eth3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 878.186053][T23510] netdevsim netdevsim1 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 878.316950][ T30] audit: type=1804 audit(1778125548.079:19): pid=26956 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.1.5267" name="/newroot/531/cgroup.controllers" dev="tmpfs" ino=2740 res=1 errno=0 [ 878.376784][ T30] audit: type=1800 audit(1778125548.079:20): pid=26956 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.5267" name="cgroup.controllers" dev="tmpfs" ino=2740 res=0 errno=0 [ 878.510395][T26961] netlink: 212368 bytes leftover after parsing attributes in process `syz.2.5271'. [ 878.536820][T26961] openvswitch: netlink: Key type 769 is out of range max 32 [ 878.828645][T26972] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 879.401425][T26989] lo speed is unknown, defaulting to 1000 [ 879.512231][T27010] netlink: 20 bytes leftover after parsing attributes in process `syz.1.5284'. [ 879.904489][T27023] ip6gre3: entered promiscuous mode [ 879.917447][T27023] ip6gre3: entered allmulticast mode [ 880.248112][T27004] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 881.115172][T27086] netlink: 'syz.1.5303': attribute type 1 has an invalid length. [ 881.152261][T27087] erspan2: entered allmulticast mode [ 881.265175][T27086] 8021q: adding VLAN 0 to HW filter on device bond13 [ 881.506552][T27104] netlink: 'syz.1.5307': attribute type 4 has an invalid length. [ 881.537694][T27105] __nla_validate_parse: 8 callbacks suppressed [ 881.537716][T27105] netlink: 12 bytes leftover after parsing attributes in process `syz.4.5304'. [ 881.563813][T27098] bond6: Unable to set peer notification delay as MII monitoring is disabled [ 881.584597][T27098] bond6 (unregistering): Released all slaves [ 881.882956][T27120] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5309'. [ 882.019063][T27126] netlink: 28 bytes leftover after parsing attributes in process `syz.4.5304'. [ 882.060540][T27120] netlink: 'syz.2.5309': attribute type 15 has an invalid length. [ 882.068737][T27126] netlink: 28 bytes leftover after parsing attributes in process `syz.4.5304'. [ 882.133646][T27126] bridge0: entered promiscuous mode [ 882.153723][T27126] ip6gretap0: entered promiscuous mode [ 882.193047][T27126] debugfs: 'hsr0' already exists in 'hsr' [ 882.216659][T27126] Cannot create hsr debugfs directory [ 882.240657][T27126] hsr0: Slave A (bridge0) is not up; please bring it up to get a fully working HSR network [ 882.276114][T27126] hsr0: Slave B (ip6gretap0) is not up; please bring it up to get a fully working HSR network [ 882.511218][T27113] bond6: option arp_interval: invalid value (18446744073709551615) [ 882.519571][T27113] bond6: option arp_interval: allowed values 0 - 2147483647 [ 882.531470][T27113] bond6 (unregistering): Released all slaves [ 882.777574][T27135] syzkaller0: entered promiscuous mode [ 882.785694][T27135] syzkaller0: entered allmulticast mode [ 883.117222][T27144] netlink: 128 bytes leftover after parsing attributes in process `syz.4.5314'. [ 883.339111][T27152] tap0: tun_chr_ioctl cmd 1074025677 [ 883.357126][T27152] tap0: linktype set to 778 [ 883.513790][T27160] netlink: 'syz.4.5319': attribute type 10 has an invalid length. [ 883.656666][T27165] netlink: 'syz.4.5320': attribute type 4 has an invalid length. [ 884.136678][T27176] dvmrp0: entered allmulticast mode [ 884.158424][T27183] netlink: 76 bytes leftover after parsing attributes in process `syz.0.5324'. [ 884.203657][T27183] netlink: 76 bytes leftover after parsing attributes in process `syz.0.5324'. [ 884.539949][T27199] netlink: 'syz.0.5328': attribute type 21 has an invalid length. [ 884.556638][T27191] bond14: option ad_actor_sys_prio: mode dependency failed, not supported in mode balance-rr(0) [ 884.597921][T27191] bond14 (unregistering): Released all slaves [ 884.701099][T27199] netlink: 'syz.0.5328': attribute type 6 has an invalid length. [ 884.728601][T27199] netlink: 132 bytes leftover after parsing attributes in process `syz.0.5328'. [ 884.912782][T27216] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5332'. [ 884.933382][T27203] netlink: 'syz.3.5327': attribute type 1 has an invalid length. [ 885.172797][T27228] netlink: 36 bytes leftover after parsing attributes in process `syz.1.5335'. [ 885.362144][T27237] TC_ACT_REPEAT abuse ? [ 885.811253][T27250] block nbd0: NBD_DISCONNECT [ 885.825584][T27250] block nbd0: Send disconnect failed -32 [ 885.846913][T27250] block nbd0: shutting down sockets [ 886.073802][T27259] lo speed is unknown, defaulting to 1000 [ 886.581144][T27286] __nla_validate_parse: 7 callbacks suppressed [ 886.581165][T27286] netlink: 144 bytes leftover after parsing attributes in process `syz.0.5351'. [ 886.672952][T27286] netlink: 'syz.0.5351': attribute type 3 has an invalid length. [ 886.967708][T27310] lo speed is unknown, defaulting to 1000 [ 886.998391][T27313] tipc: Enabled bearer , priority 10 [ 887.205643][T27322] bridge_slave_0 (unregistering): left allmulticast mode [ 887.238009][T27322] bridge_slave_0 (unregistering): left promiscuous mode [ 887.251227][T27322] bridge0: port 1(bridge_slave_0) entered disabled state [ 887.592257][T27335] tipc: Resetting bearer [ 887.978037][T27341] macsec2: entered promiscuous mode [ 887.983591][T27341] batadv_slave_1: entered promiscuous mode [ 887.993670][T27341] macsec2: entered allmulticast mode [ 888.004221][T27341] batadv_slave_1: entered allmulticast mode [ 888.018225][T27341] batadv_slave_1: left allmulticast mode [ 888.024124][T27341] batadv_slave_1: left promiscuous mode [ 888.228148][T27344] IPVS: ovf: UDP 224.0.0.2:0 - no destination available [ 888.317161][T27347] netlink: 'syz.0.5368': attribute type 1 has an invalid length. [ 888.483892][T27352] netlink: 4 bytes leftover after parsing attributes in process `syz.3.5369'. [ 888.764942][T27356] bond0: left promiscuous mode [ 888.773110][T27356] bond_slave_0: left promiscuous mode [ 888.779104][T27356] bond_slave_1: left promiscuous mode [ 888.787724][T27356] 8021q: adding VLAN 0 to HW filter on device bond0 [ 888.835542][T27356] 8021q: adding VLAN 0 to HW filter on device team0 [ 889.104181][T27356] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 889.138147][T27356] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 889.186512][T27356] veth1_vlan: left promiscuous mode [ 889.215028][T27356] veth0_vlan: left promiscuous mode [ 889.233412][T27356] veth0_vlan: entered promiscuous mode [ 889.274306][T27356] veth1_vlan: entered promiscuous mode [ 889.315947][T27356] veth1_macvtap: left promiscuous mode [ 889.341112][T27356] veth0_macvtap: left promiscuous mode [ 889.374079][T27356] veth0_macvtap: entered promiscuous mode [ 889.394510][T27356] veth1_macvtap: entered promiscuous mode [ 889.463233][T27356] mac80211_hwsim hwsim40 wlan1: entered promiscuous mode [ 889.497325][T27356] 8021q: adding VLAN 0 to HW filter on device bond1 [ 889.522253][T27356] 8021q: adding VLAN 0 to HW filter on device bond2 [ 889.532441][T27356] A link change request failed with some changes committed already. Interface batadv1 may have been left with an inconsistent configuration, please check. [ 889.558264][T13348] bridge0: port 2(bridge_slave_1) entered blocking state [ 889.565712][T13348] bridge0: port 2(bridge_slave_1) entered forwarding state [ 889.709738][T26615] netdevsim netdevsim0 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 889.731381][T26615] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 889.758889][T26615] netdevsim netdevsim0 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 889.782204][T26615] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 889.854200][T26615] netdevsim netdevsim0 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 889.865772][T26615] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 889.874728][T26615] netdevsim netdevsim0 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 889.883701][T26615] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 890.093337][T27384] netlink: 'syz.0.5376': attribute type 1 has an invalid length. [ 890.385086][T27383] bond8: (slave ip6gretap1): Enslaving as a backup interface with an up link [ 890.439701][T27386] veth7: entered promiscuous mode [ 890.535563][T27405] lo speed is unknown, defaulting to 1000 [ 890.549716][T27408] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 890.583518][T27410] syz_tun: entered allmulticast mode [ 891.210673][T27425] netlink: 'syz.2.5388': attribute type 10 has an invalid length. [ 891.329206][T27428] veth0: entered promiscuous mode [ 891.373618][T27428] bond0: entered promiscuous mode [ 891.825234][T27424] bond0: left promiscuous mode [ 891.849398][T27424] veth0: left promiscuous mode [ 892.118600][T27455] tipc: Enabling of bearer rejected, already enabled [ 892.152374][T27455] tipc: Resetting bearer [ 892.316986][T27455] tipc: Resetting bearer [ 892.362144][T27466] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5398'. [ 892.381283][T27466] netlink: 28 bytes leftover after parsing attributes in process `syz.4.5398'. [ 893.125713][T27482] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5402'. [ 893.428885][T27488] netlink: 40 bytes leftover after parsing attributes in process `syz.1.5404'. [ 893.441380][T27488] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5404'. [ 893.491309][T27492] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5405'. [ 893.942665][T27499] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5407'. [ 893.955397][T27499] netlink: 'syz.2.5407': attribute type 20 has an invalid length. [ 893.963802][T27499] netlink: 'syz.2.5407': attribute type 21 has an invalid length. [ 893.986046][T27499] netlink: 'syz.2.5407': attribute type 1 has an invalid length. [ 894.013178][T27499] bond9 (unregistering): Released all slaves [ 895.056105][T27456] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 895.440386][T27508] netdevsim netdevsim3 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 895.473655][T27508] netdevsim netdevsim3 eth3 (unregistering): unset [0, 1] type 1 family 0 port 2816 - 0 [ 895.483702][T27508] netdevsim netdevsim3 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 895.656415][T27528] netlink: 'syz.0.5413': attribute type 1 has an invalid length. [ 895.730382][T27508] netdevsim netdevsim3 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 895.740675][T27508] netdevsim netdevsim3 eth2 (unregistering): unset [0, 1] type 1 family 0 port 2816 - 0 [ 895.752537][T27508] netdevsim netdevsim3 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 895.822832][T27528] bond9: entered promiscuous mode [ 895.834317][T27528] bond9: entered allmulticast mode [ 895.878912][T27528] 8021q: adding VLAN 0 to HW filter on device bond9 [ 895.898892][T27529] erspan2: entered allmulticast mode [ 895.910483][T27529] bond9: (slave erspan2): making interface the new active one [ 895.920917][T27529] erspan2: entered promiscuous mode [ 895.950073][T27529] bond9: (slave erspan2): Enslaving as an active interface with an up link [ 896.040266][T27508] netdevsim netdevsim3 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 896.055383][T27508] netdevsim netdevsim3 eth1 (unregistering): unset [0, 1] type 1 family 0 port 2816 - 0 [ 896.066478][T27508] netdevsim netdevsim3 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 896.201561][T27508] netdevsim netdevsim3 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 896.213143][T27508] netdevsim netdevsim3 eth0 (unregistering): unset [0, 1] type 1 family 0 port 2816 - 0 [ 896.223483][T27508] netdevsim netdevsim3 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 896.366166][T12993] netdevsim netdevsim3 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 896.376641][T12993] netdevsim netdevsim3 eth0: set [0, 1] type 1 family 0 port 2816 - 0 [ 896.385311][T12993] netdevsim netdevsim3 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 896.414881][T23510] netdevsim netdevsim3 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 896.438197][T23510] netdevsim netdevsim3 eth1: set [0, 1] type 1 family 0 port 2816 - 0 [ 896.446539][T23510] netdevsim netdevsim3 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 896.478771][ C0] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 896.504641][T12993] netdevsim netdevsim3 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 896.513526][T12993] netdevsim netdevsim3 eth2: set [0, 1] type 1 family 0 port 2816 - 0 [ 896.522289][T12993] netdevsim netdevsim3 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 896.552917][T12993] netdevsim netdevsim3 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 896.562355][T12993] netdevsim netdevsim3 eth3: set [0, 1] type 1 family 0 port 2816 - 0 [ 896.571177][T12993] netdevsim netdevsim3 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 896.710787][T27541] netlink: 'syz.0.5416': attribute type 1 has an invalid length. [ 896.720572][T27541] workqueue: Failed to create a rescuer kthread for wq "bond10": -EINTR [ 896.794379][T27547] netlink: 16162 bytes leftover after parsing attributes in process `syz.0.5417'. [ 896.813857][T27548] netlink: 16162 bytes leftover after parsing attributes in process `syz.0.5417'. [ 898.252526][T27505] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 898.278551][T27557] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5419'. [ 898.550113][T27559] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5419'. [ 898.730105][T27591] netlink: 'syz.4.5428': attribute type 1 has an invalid length. [ 898.797276][T27594] netlink: 60 bytes leftover after parsing attributes in process `syz.0.5426'. [ 898.852942][T23510] nci: nci_rx_work: unknown MT 0x7 [ 899.397315][T27625] netlink: 'syz.1.5433': attribute type 9 has an invalid length. [ 901.659321][T27596] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 901.943577][T27642] netlink: 20 bytes leftover after parsing attributes in process `syz.2.5435'. [ 901.968835][T27642] openvswitch: netlink: Flow get message rejected, Key attribute missing. [ 902.019854][T27646] netlink: 32 bytes leftover after parsing attributes in process `syz.4.5439'. [ 902.051966][T27646] netlink: 16 bytes leftover after parsing attributes in process `syz.4.5439'. [ 902.184664][T27657] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5442'. [ 902.364947][T27671] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5444'. [ 902.387272][T27671] netlink: 72 bytes leftover after parsing attributes in process `syz.3.5444'. [ 902.421641][T27674] x_tables: unsorted entry at hook 2 [ 902.457219][T27674] netlink: 'syz.0.5445': attribute type 11 has an invalid length. [ 902.466626][T27674] netlink: 'syz.0.5445': attribute type 4 has an invalid length. [ 902.481227][T27671] vlan0: entered allmulticast mode [ 902.498373][T27671] veth0_to_bond: entered allmulticast mode [ 902.508649][T27674] netlink: 199780 bytes leftover after parsing attributes in process `syz.0.5445'. [ 903.126684][T27700] syzkaller0: entered promiscuous mode [ 903.147700][T27700] syzkaller0: entered allmulticast mode [ 903.162892][T27708] netlink: 'syz.3.5455': attribute type 21 has an invalid length. [ 903.192043][T27708] IPv6: NLM_F_CREATE should be specified when creating new route [ 903.370248][T27725] __nla_validate_parse: 3 callbacks suppressed [ 903.370271][T27725] netlink: 36 bytes leftover after parsing attributes in process `syz.2.5460'. [ 903.422289][T27728] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5460'. [ 907.019988][T27709] lo speed is unknown, defaulting to 1000 [ 907.573215][T27758] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5468'. [ 907.599894][T27758] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5468'. [ 907.602283][T27765] netlink: 88 bytes leftover after parsing attributes in process `syz.3.5470'. [ 907.656581][T27765] netlink: 36 bytes leftover after parsing attributes in process `syz.3.5470'. [ 907.674358][T27765] netlink: 36 bytes leftover after parsing attributes in process `syz.3.5470'. [ 907.698391][T27765] netlink: 36 bytes leftover after parsing attributes in process `syz.3.5470'. [ 907.734459][T27765] netlink: 36 bytes leftover after parsing attributes in process `syz.3.5470'. [ 907.751118][T27765] netlink: 36 bytes leftover after parsing attributes in process `syz.3.5470'. [ 908.126203][T27754] Bluetooth: hci1: Opcode 0x0401 failed: -4 [ 908.185486][T27765] bridge0: port 3(syz_tun) entered disabled state [ 908.217716][T27765] bridge0: port 1(bridge_slave_0) entered disabled state [ 908.271386][T27771] netlink: 'syz.2.5472': attribute type 1 has an invalid length. [ 908.629023][T27775] syzkaller0: entered promiscuous mode [ 908.636174][T27775] syzkaller0: entered allmulticast mode [ 908.749880][T27783] nbd: must specify a size in bytes for the device [ 908.890906][T27785] IPv4: Oversized IP packet from 127.202.26.0 [ 908.906590][T27787] __nla_validate_parse: 26 callbacks suppressed [ 908.906614][T27787] netlink: 84 bytes leftover after parsing attributes in process `syz.0.5479'. [ 909.445960][T17150] Bluetooth: hci1: command 0x0406 tx timeout [ 909.601034][T27798] IPVS: set_ctl: invalid protocol: 47608 3.129.211.222:5551 [ 913.083823][T27799] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5481'. [ 913.096735][T27799] netlink: 4 bytes leftover after parsing attributes in process `syz.3.5481'. [ 913.105837][T27799] netlink: 'syz.3.5481': attribute type 6 has an invalid length. [ 913.286822][T27817] netlink: 112 bytes leftover after parsing attributes in process `syz.3.5485'. [ 913.666547][T27840] netlink: 20 bytes leftover after parsing attributes in process `syz.4.5490'. [ 913.702373][T27840] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5490'. [ 913.740832][T27843] netlink: 'syz.1.5491': attribute type 21 has an invalid length. [ 913.762782][T27843] netlink: 156 bytes leftover after parsing attributes in process `syz.1.5491'. [ 913.820350][T27843] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5491'. [ 914.264945][T27871] netlink: 12 bytes leftover after parsing attributes in process `syz.0.5500'. [ 914.705149][T27881] syzkaller0: entered promiscuous mode [ 914.736584][T27881] syzkaller0: entered allmulticast mode [ 914.779790][T27891] netlink: 36 bytes leftover after parsing attributes in process `syz.4.5505'. [ 914.852121][T27894] A link change request failed with some changes committed already. Interface bridge_slave_1 may have been left with an inconsistent configuration, please check. [ 914.926662][T27891] erspan0: left promiscuous mode [ 915.355082][T27925] dvmrp0: entered allmulticast mode [ 915.455224][T27932] netlink: 'syz.1.5514': attribute type 3 has an invalid length. [ 915.470116][T27932] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5514'. [ 915.590664][T27936] tipc: Enabling of bearer rejected, failed to enable media [ 915.708753][T27938] lo speed is unknown, defaulting to 1000 [ 916.497156][T27957] netlink: 76 bytes leftover after parsing attributes in process `syz.0.5521'. [ 917.041528][T27973] netlink: 20 bytes leftover after parsing attributes in process `syz.2.5522'. [ 917.288192][T27297] ip6_tunnel: ip6gretap2 xmit: Local address not yet configured! [ 917.648584][T27990] tipc: Resetting bearer [ 917.826582][T28001] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5530'. [ 917.858758][T28001] 8021q: adding VLAN 0 to HW filter on device bond0 [ 917.999464][ T8573] ip6_tunnel: ip6gretap2 xmit: Local address not yet configured! [ 918.158146][T27297] ip6_tunnel: ip6gretap2 xmit: Local address not yet configured! [ 918.434224][T28014] netlink: 'syz.2.5534': attribute type 1 has an invalid length. [ 918.454865][T28014] netlink: 240 bytes leftover after parsing attributes in process `syz.2.5534'. [ 918.499758][T28019] netlink: 'syz.2.5534': attribute type 3 has an invalid length. [ 918.699885][T28031] netlink: 207952 bytes leftover after parsing attributes in process `syz.2.5534'. [ 918.827894][T28032] lo speed is unknown, defaulting to 1000 [ 919.045613][T26615] ip6_tunnel: ip6gretap2 xmit: Local address not yet configured! [ 919.068667][T26615] ip6_tunnel: ip6gretap2 xmit: Local address not yet configured! [ 919.190450][T18697] ip6_tunnel: ip6gretap2 xmit: Local address not yet configured! [ 919.222053][T28053] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 919.389681][T28060] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5549'. [ 919.632087][T28077] netlink: 'syz.4.5551': attribute type 1 has an invalid length. [ 919.973449][T28091] syzkaller0: entered promiscuous mode [ 919.984916][T28091] syzkaller0: entered allmulticast mode [ 920.523937][T28113] mac80211_hwsim hwsim31 syzkaller0: entered promiscuous mode [ 920.540464][T28113] mac80211_hwsim hwsim31 syzkaller0: entered allmulticast mode [ 920.605057][T28119] lo speed is unknown, defaulting to 1000 [ 921.648654][T28143] netlink: 4 bytes leftover after parsing attributes in process `syz.4.5570'. [ 921.670542][T28143] netlink: 12 bytes leftover after parsing attributes in process `syz.4.5570'. [ 921.922760][T28150] netlink: 'syz.3.5573': attribute type 12 has an invalid length. [ 922.320610][ T5635] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 922.342688][ T5635] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 922.353609][ T5635] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 922.378033][ T5635] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 922.414543][ T5635] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 922.881176][T28177] netlink: 192 bytes leftover after parsing attributes in process `syz.3.5578'. [ 923.137456][T28186] netlink: 12 bytes leftover after parsing attributes in process `syz.4.5580'. [ 923.157554][T28182] lo speed is unknown, defaulting to 1000 [ 923.358134][ C1] ip6_tunnel: ip6gretap2 xmit: Local address not yet configured! [ 923.492011][T28193] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5581'. [ 923.517488][ T30] audit: type=1804 audit(1778125593.279:21): pid=28193 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.2.5581" name="/newroot/519/cgroup.controllers" dev="tmpfs" ino=2666 res=1 errno=0 [ 923.587893][ T30] audit: type=1800 audit(1778125593.279:22): pid=28193 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.5581" name="cgroup.controllers" dev="tmpfs" ino=2666 res=0 errno=0 [ 923.829844][T28161] lo speed is unknown, defaulting to 1000 [ 924.244648][T28210] A link change request failed with some changes committed already. Interface veth1_to_bond may have been left with an inconsistent configuration, please check. [ 924.421680][T28213] gtp2: entered promiscuous mode [ 924.426716][T28213] gtp2: entered allmulticast mode [ 924.434552][T28208] lo speed is unknown, defaulting to 1000 [ 924.558008][ T5635] Bluetooth: hci2: command tx timeout [ 925.596451][T28161] bridge0: port 1(bridge_slave_0) entered blocking state [ 925.603970][T28161] bridge0: port 1(bridge_slave_0) entered disabled state [ 925.612579][T28161] bridge_slave_0: entered allmulticast mode [ 925.621761][T28161] bridge_slave_0: entered promiscuous mode [ 925.633017][T28161] bridge0: port 2(bridge_slave_1) entered blocking state [ 925.655110][T28161] bridge0: port 2(bridge_slave_1) entered disabled state [ 925.680444][T28161] bridge_slave_1: entered allmulticast mode [ 925.711730][T28161] bridge_slave_1: entered promiscuous mode [ 925.915308][T28161] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 925.946233][T28161] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 926.205510][T28161] team0: Port device team_slave_0 added [ 926.215189][T28161] team0: Port device team_slave_1 added [ 926.280616][T28161] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 926.290996][T28161] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 926.323686][T28161] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 926.339915][T28161] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 926.347276][T28161] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 926.373478][T28161] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 926.439720][T28161] hsr_slave_0: entered promiscuous mode [ 926.446537][T28161] hsr_slave_1: entered promiscuous mode [ 926.453179][T28161] debugfs: 'hsr0' already exists in 'hsr' [ 926.459242][T28161] Cannot create hsr debugfs directory [ 926.638210][ T5635] Bluetooth: hci2: command tx timeout [ 927.368497][T28213] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 927.498600][T28161] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 927.541226][T28161] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 927.576442][T28161] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 927.602627][T28161] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 927.612416][T28161] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 927.629872][T28161] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 927.641677][T28257] netlink: 'syz.3.5593': attribute type 1 has an invalid length. [ 927.653616][T28161] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 927.665359][T28161] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 927.723032][T28257] bond14: entered promiscuous mode [ 927.729111][T28257] 8021q: adding VLAN 0 to HW filter on device bond14 [ 927.791620][T28259] bond14: (slave veth9): making interface the new active one [ 927.814932][T28259] veth9: entered promiscuous mode [ 927.864852][T28259] bond14: (slave veth9): Enslaving as an active interface with an up link [ 927.915378][T28264] bond14: (slave veth11): Enslaving as a backup interface with an up link [ 928.137682][T28161] 8021q: adding VLAN 0 to HW filter on device bond0 [ 928.142673][T28284] netlink: 12 bytes leftover after parsing attributes in process `syz.3.5598'. [ 928.204330][T28161] 8021q: adding VLAN 0 to HW filter on device team0 [ 928.282174][T28284] veth13: entered allmulticast mode [ 928.304941][T28284] bond15: (slave veth13): Enslaving as an active interface with an up link [ 928.378966][T28287] bond15 (unregistering): (slave veth13): Releasing backup interface [ 928.408340][T28287] bond15 (unregistering): Released all slaves [ 928.471045][T26617] bridge0: port 1(bridge_slave_0) entered blocking state [ 928.478288][T26617] bridge0: port 1(bridge_slave_0) entered forwarding state [ 928.542124][T26617] bridge0: port 2(bridge_slave_1) entered blocking state [ 928.549376][T26617] bridge0: port 2(bridge_slave_1) entered forwarding state [ 928.720451][ T5635] Bluetooth: hci2: command tx timeout [ 928.773242][T28296] netlink: 'syz.2.5601': attribute type 12 has an invalid length. [ 928.866600][T28302] netlink: 'syz.3.5602': attribute type 1 has an invalid length. [ 928.950276][T28307] netlink: 68 bytes leftover after parsing attributes in process `syz.3.5602'. [ 929.012585][T28309] netlink: 'syz.4.5606': attribute type 1 has an invalid length. [ 929.075500][T28302] 8021q: adding VLAN 0 to HW filter on device bond15 [ 929.288710][T13348] [ 929.291122][T13348] ============================================ [ 929.297304][T13348] WARNING: possible recursive locking detected [ 929.303509][T13348] syzkaller #0 Not tainted [ 929.307968][T13348] -------------------------------------------- [ 929.314148][T13348] kworker/u8:27/13348 is trying to acquire lock: [ 929.320511][T13348] ffff88807d5c5558 (&qdisc_xmit_lock_key#3){+.-.}-{3:3}, at: sch_direct_xmit+0x15f/0x4c0 [ 929.330436][T13348] [ 929.330436][T13348] but task is already holding lock: [ 929.337844][T13348] ffff888058b29158 (&qdisc_xmit_lock_key#3){+.-.}-{3:3}, at: sch_direct_xmit+0x15f/0x4c0 [ 929.347753][T13348] [ 929.347753][T13348] other info that might help us debug this: [ 929.355937][T13348] Possible unsafe locking scenario: [ 929.355937][T13348] [ 929.363428][T13348] CPU0 [ 929.366744][T13348] ---- [ 929.370060][T13348] lock(&qdisc_xmit_lock_key#3); [ 929.375315][T13348] lock(&qdisc_xmit_lock_key#3); [ 929.380400][T13348] [ 929.380400][T13348] *** DEADLOCK *** [ 929.380400][T13348] [ 929.388600][T13348] May be due to missing lock nesting notation [ 929.388600][T13348] [ 929.396957][T13348] 11 locks held by kworker/u8:27/13348: [ 929.402542][T13348] #0: ffff88809aa1e140 ((wq_completion)bond9#3){+.+.}-{0:0}, at: process_scheduled_works+0xa35/0x1860 [ 929.413765][T13348] #1: ffffc9001b22fc40 ((work_completion)(&(&bond->alb_work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0xa70/0x1860 [ 929.426718][T13348] #2: ffffffff8e95cd60 (rcu_read_lock){....}-{1:3}, at: bond_alb_monitor+0xf8/0x17e0 [ 929.436378][T13348] #3: ffffffff8e95cdc0 (rcu_read_lock_bh){....}-{1:3}, at: __dev_queue_xmit+0x2b6/0x3950 [ 929.446391][T13348] #4: ffff888034884228 (dev->qdisc_tx_busylock ?: &qdisc_tx_busylock#5){+...}-{3:3}, at: __dev_queue_xmit+0x11a6/0x3950 [ 929.459109][T13348] #5: ffff888058b29158 (&qdisc_xmit_lock_key#3){+.-.}-{3:3}, at: sch_direct_xmit+0x15f/0x4c0 [ 929.468874][T28321] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5607'. [ 929.469456][T13348] #6: ffffffff8e95cd60 (rcu_read_lock){....}-{1:3}, at: ip_output+0x5b/0x450 [ 929.487267][T13348] #7: ffffffff8e95cd60 (rcu_read_lock){....}-{1:3}, at: ip_finish_output2+0x3c2/0x1070 [ 929.497088][T13348] #8: ffffffff8e95cd60 (rcu_read_lock){....}-{1:3}, at: arp_xmit+0x23/0x270 [ 929.505972][T13348] #9: ffffffff8e95cdc0 (rcu_read_lock_bh){....}-{1:3}, at: __dev_queue_xmit+0x2b6/0x3950 [ 929.515993][T13348] #10: ffff888054614228 (dev->qdisc_tx_busylock ?: &qdisc_tx_busylock#5){+...}-{3:3}, at: __dev_queue_xmit+0x11a6/0x3950 [ 929.529179][T13348] [ 929.529179][T13348] stack backtrace: [ 929.535105][T13348] CPU: 0 UID: 0 PID: 13348 Comm: kworker/u8:27 Not tainted syzkaller #0 PREEMPT(full) [ 929.535127][T13348] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 929.535139][T13348] Workqueue: bond9 bond_alb_monitor [ 929.535164][T13348] Call Trace: [ 929.535173][T13348] [ 929.535181][T13348] dump_stack_lvl+0xe8/0x150 [ 929.535199][T13348] print_deadlock_bug+0x279/0x290 [ 929.535221][T13348] __lock_acquire+0x253f/0x2cf0 [ 929.535241][T13348] ? unwind_next_frame+0xa6/0x2550 [ 929.535269][T13348] ? sch_direct_xmit+0x15f/0x4c0 [ 929.535287][T13348] lock_acquire+0x106/0x350 [ 929.535302][T13348] ? sch_direct_xmit+0x15f/0x4c0 [ 929.535325][T13348] _raw_spin_lock+0x2e/0x40 [ 929.535343][T13348] ? sch_direct_xmit+0x15f/0x4c0 [ 929.535366][T13348] sch_direct_xmit+0x15f/0x4c0 [ 929.535411][T13348] ? __pfx_sch_direct_xmit+0x10/0x10 [ 929.535436][T13348] ? arp_create+0xa0/0x980 [ 929.535469][T13348] __dev_queue_xmit+0x180f/0x3950 [ 929.535508][T13348] ? __dev_queue_xmit+0x2b6/0x3950 [ 929.535550][T13348] ? arpt_do_table+0x256/0x1e30 [ 929.535571][T13348] ? __pfx___dev_queue_xmit+0x10/0x10 [ 929.535598][T13348] ? __pfx_arpt_do_table+0x10/0x10 [ 929.535618][T13348] ? trace_kmem_cache_alloc+0x29/0xe0 [ 929.535646][T13348] ? NF_HOOK+0xa2/0x3c0 [ 929.535669][T13348] NF_HOOK+0x33a/0x3c0 [ 929.535691][T13348] ? __pfx_arp_xmit_finish+0x10/0x10 [ 929.535715][T13348] ? NF_HOOK+0xa2/0x3c0 [ 929.535736][T13348] ? __pfx_NF_HOOK+0x10/0x10 [ 929.535756][T13348] ? lock_acquire+0x106/0x350 [ 929.535772][T13348] ? __pfx_arp_xmit_finish+0x10/0x10 [ 929.535795][T13348] ? inet_addr_type_dev_table+0x25/0x190 [ 929.535821][T13348] arp_xmit+0x16c/0x270 [ 929.535843][T13348] ? arp_xmit+0x23/0x270 [ 929.535864][T13348] arp_solicit+0xbe0/0xe40 [ 929.535890][T13348] ? arp_solicit+0x119/0xe40 [ 929.535913][T13348] ? __pfx_arp_solicit+0x10/0x10 [ 929.535940][T13348] ? __pfx_arp_solicit+0x10/0x10 [ 929.535961][T13348] __neigh_event_send+0xf05/0x14d0 [ 929.535985][T13348] neigh_resolve_output+0x198/0x750 [ 929.536003][T13348] ? __pfx_ip_neigh_gw4+0x10/0x10 [ 929.536022][T13348] ? ip_finish_output2+0x3c2/0x1070 [ 929.536035][T13348] ip_finish_output2+0xca9/0x1070 [ 929.536048][T13348] ? ip_skb_dst_mtu+0x80b/0xa50 [ 929.536071][T13348] ? ip_finish_output+0x40e/0x530 [ 929.536093][T13348] ip_output+0x29f/0x450 [ 929.536114][T13348] ? ip_output+0x5b/0x450 [ 929.536135][T13348] iptunnel_xmit+0x621/0xd10 [ 929.536157][T13348] ip_tunnel_xmit+0x193a/0x1f20 [ 929.536187][T13348] ? __pfx_ip_tunnel_xmit+0x10/0x10 [ 929.536210][T13348] ? __pfx_gre_build_header+0x10/0x10 [ 929.536234][T13348] __gre_xmit+0x19e/0x240 [ 929.536253][T13348] ? __pfx___gre_xmit+0x10/0x10 [ 929.536276][T13348] erspan_xmit+0xa41/0x14d0 [ 929.536296][T13348] ? dev_queue_xmit_nit+0x2d/0xad0 [ 929.536317][T13348] ? __pfx_erspan_xmit+0x10/0x10 [ 929.536341][T13348] dev_hard_start_xmit+0x2cd/0x830 [ 929.536375][T13348] sch_direct_xmit+0x251/0x4c0 [ 929.536396][T13348] ? __pfx_sch_direct_xmit+0x10/0x10 [ 929.536414][T13348] ? kthread+0x370/0x470 [ 929.536436][T13348] __dev_queue_xmit+0x180f/0x3950 [ 929.536461][T13348] ? __dev_queue_xmit+0x2b6/0x3950 [ 929.536489][T13348] ? __pfx___dev_queue_xmit+0x10/0x10 [ 929.536532][T13348] ? rcu_is_watching+0x15/0xb0 [ 929.536558][T13348] ? trace_kmem_cache_alloc+0x29/0xe0 [ 929.536587][T13348] ? kmem_cache_alloc_node_noprof+0x3ce/0x690 [ 929.536627][T13348] ? alb_send_lp_vid+0x14e/0x550 [ 929.536661][T13348] alb_send_lp_vid+0x348/0x550 [ 929.536684][T13348] ? __pfx_alb_send_lp_vid+0x10/0x10 [ 929.536710][T13348] alb_send_learning_packets+0x12c/0x300 [ 929.536731][T13348] ? __pfx_alb_send_learning_packets+0x10/0x10 [ 929.536751][T13348] ? bond_alb_monitor+0xf8/0x17e0 [ 929.536772][T13348] ? netdev_lower_get_next_private_rcu+0x9f/0x100 [ 929.536800][T13348] bond_alb_monitor+0x3d5/0x17e0 [ 929.536821][T13348] ? bond_alb_monitor+0xf8/0x17e0 [ 929.536841][T13348] ? __pfx_bond_alb_monitor+0x10/0x10 [ 929.536861][T13348] ? process_scheduled_works+0xa70/0x1860 [ 929.536876][T13348] ? process_scheduled_works+0xa70/0x1860 [ 929.536892][T13348] process_scheduled_works+0xb5d/0x1860 [ 929.536920][T13348] ? __pfx_process_scheduled_works+0x10/0x10 [ 929.536938][T13348] ? assign_work+0x3d5/0x5e0 [ 929.536955][T13348] worker_thread+0xa53/0xfc0 [ 929.536982][T13348] kthread+0x388/0x470 [ 929.537001][T13348] ? __pfx_worker_thread+0x10/0x10 [ 929.537016][T13348] ? __pfx_kthread+0x10/0x10 [ 929.537036][T13348] ret_from_fork+0x514/0xb70 [ 929.537053][T13348] ? __pfx_ret_from_fork+0x10/0x10 [ 929.537069][T13348] ? __switch_to+0xc79/0x1410 [ 929.537092][T13348] ? __pfx_kthread+0x10/0x10 [ 929.537112][T13348] ret_from_fork_asm+0x1a/0x30 [ 929.537137][T13348] [ 930.146216][T28312] bridge0: port 2(bridge_slave_1) entered disabled state [ 930.797938][ T5635] Bluetooth: hci2: command tx timeout [ 930.984446][T12995] netdevsim netdevsim0 eth0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 930.998184][T12995] netdevsim netdevsim0 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 931.021069][T12995] netdevsim netdevsim0 eth1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 931.032433][T12995] netdevsim netdevsim0 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 931.045744][T12993] netdevsim netdevsim0 eth2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 931.055748][T12993] netdevsim netdevsim0 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 931.064517][T12993] netdevsim netdevsim0 eth3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 931.073270][T12993] netdevsim netdevsim0 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 931.233831][T28161] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 931.266277][T28161] veth0_vlan: entered promiscuous mode [ 931.276198][T28161] veth1_vlan: entered promiscuous mode [ 931.302736][T28161] veth0_macvtap: entered promiscuous mode [ 931.311914][T28161] veth1_macvtap: entered promiscuous mode [ 931.327374][T28161] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 931.342340][T28161] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 931.354706][T13348] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 931.364258][T13348] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 931.374033][T13348] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 931.384407][T13348] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 931.411171][T28161] ieee80211 phy83: Selected rate control algorithm 'minstrel_ht' [ 931.444022][T23510] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 931.452570][T28161] ieee80211 phy84: Selected rate control algorithm 'minstrel_ht' [ 931.461154][T23510] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 931.492671][T26615] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 931.500790][T26615] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50