last executing test programs: 11.221423195s ago: executing program 4 (id=2683): r0 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000280)={0xffffffff}, 0x10) openat$cgroup_int(0xffffffffffffffff, &(0x7f0000000080)='hugetlb.2MB.limit_in_bytes\x00', 0x2, 0x0) (async) openat$cgroup_int(0xffffffffffffffff, &(0x7f0000000080)='hugetlb.2MB.limit_in_bytes\x00', 0x2, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)={0x20, 0x12, 0xa01, 0x0, 0x0, {0xa}}, 0x26}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) setsockopt$CAN_RAW_FILTER(r0, 0x65, 0x1, &(0x7f00000000c0)=[{{0x3}, {0x2, 0x1}}, {{0x1, 0x1, 0x0, 0x1}, {0x0, 0x1}}], 0x10) (async) setsockopt$CAN_RAW_FILTER(r0, 0x65, 0x1, &(0x7f00000000c0)=[{{0x3}, {0x2, 0x1}}, {{0x1, 0x1, 0x0, 0x1}, {0x0, 0x1}}], 0x10) 11.117746062s ago: executing program 4 (id=2685): sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000d80)=@ipv4_getrule={0x1c, 0x22, 0x1, 0x70bd2a, 0x25dfdbfd, {0x2, 0x20, 0x10, 0x1, 0xfa, 0x0, 0x0, 0x1, 0x10018}}, 0x1c}}, 0x0) (async) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000a00)=ANY=[@ANYBLOB="170000000000000001000000ff01000000000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000000000000000000000000000000000000000000731c07fdc6865ac50a7eb39bbe13fbb8c6621089d6baf34c3dc7cf36eef4f35043ae19cdd7e2b65df5f315fb941289b14255b57d11666a9bfe739bf29ad79b5b2a62767ce6ab2e68233ea5a3cfcbdef95f6152656100a9aa7e9a98b9979acd18615b581647efe30f94f3dfa63978b9386e4e30d5413b6f9dcc1fb4bfd67d3f03c1b288d35ab477c3a8febee405022265a48d0b98fd4cafd3aa438d27f3c60c2adda3fdfcd677c0d6050b34177a9520a4c062723b426f001a94a8d9184b3e28a8fa8b4675bcdb7e1341da1fd7bce053104a"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x2, 0x11, &(0x7f0000000300)=@ringbuf={{}, {{0x18, 0x1, 0x1, 0x0, r0}, {}, {}, {0x85, 0x0, 0x0, 0xbf}}, {}, [@map_val={0x18, 0x0, 0x2, 0x0, r0, 0x0, 0x0, 0x0, 0x40000000}]}, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x16, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) (async) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000001fc0)=@newtaction={0x258, 0x30, 0xc96f2b0dc02612b1, 0x71bd23, 0x25dfdbff, {}, [{0x240, 0x1, [@m_xt={0xc0, 0xa, 0x0, 0x0, {{0x7}, {0x98, 0x2, 0x0, 0x1, [@TCA_IPT_INDEX={0x8, 0x3, 0x800}, @TCA_IPT_HOOK={0x8, 0x2, 0x2}, @TCA_IPT_TABLE={0x24, 0x1, 'filter\x00'}, @TCA_IPT_HOOK={0x8, 0x2, 0x4}, @TCA_IPT_HOOK={0x8, 0x2, 0x2}, @TCA_IPT_INDEX={0x8, 0x3, 0x4}, @TCA_IPT_TABLE={0x24, 0x1, 'filter\x00'}, @TCA_IPT_TABLE={0x24, 0x1, 'raw\x00'}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x2, 0x1}}}}, @m_csum={0xd4, 0x34, 0x0, 0x0, {{0x9}, {0x3c, 0x2, 0x0, 0x1, [@TCA_CSUM_PARMS={0x1c, 0x1, {{0x0, 0xfffffffd, 0x3, 0x8, 0x9}, 0x43}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0x1, 0x85, 0x4, 0x0, 0x136bcb9c}, 0x6c}}]}, {0x6d, 0x6, "576458eea52fd27eec92e713a172e757e1f62fe8475fa8817d9bd39d398251801f64d9b8e312b47b111ff094a2f452e1fd749b169123625c664a63e06baa8402c6b5fe34fbffaf329e5589fe1d00f704d8d13b0100000081ec7a1e9e21427be570631961812505684e"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x3, 0x1}}}}, @m_xt={0x78, 0x11, 0x0, 0x0, {{0x7}, {0x14, 0x2, 0x0, 0x1, [@TCA_IPT_INDEX={0x8, 0x3, 0x8}, @TCA_IPT_INDEX={0x8, 0x3, 0xc}]}, {0x3d, 0x6, "762d0334b577171f9b749a7abb404bcbc6b01ee31883b9e5f270b393ec4ffc5619a0ce9488798f57ae2c906e7ede7996ee5a4742346f9333ce"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x1, 0x3}}}}, @m_vlan={0x30, 0x11, 0x0, 0x0, {{0x9}, {0x4}, {0x4}, {0xc}, {0xc, 0x8, {0x3}}}}]}, {0x4}]}, 0x258}, 0x1, 0x0, 0x0, 0x4004000}, 0x50) (async) r1 = socket(0x10, 0x803, 0x0) (async) r2 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r2, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000180)="d800000010008104687da3aa7143a0b8c81d080b25000000e8fe55a118001500060014c3ff0000120800030043000040a80019000400014006000d00036010fab94dcf5c0461c1d67f6f94007134cf6ee08000a0e408e8d8ef52a9d7c7c0b7a196e6f6d7f3ef48286112c88ac417898516277ce06bbace80177ccbec4c2ee5a7cef4260000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c0aaac99eddc64193071e9f8775730d16a4683f1aeb4edbb57a5025ccca9e00360db70100000040fad95667e006dcdf63951f215ce3bb06000000588a6364", 0xd8}], 0x1}, 0x0) (async) getsockopt$IP_SET_OP_GET_BYINDEX(r1, 0x1, 0x53, &(0x7f0000000040)={0x7, 0x7, 0x3}, &(0x7f0000000080)=0x28) (async) sendto(r1, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x8804, 0x0, 0x0) (async) accept4$x25(r1, &(0x7f00000000c0), &(0x7f0000000100)=0x12, 0x80000) recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x365}, {&(0x7f0000000280)=""/85, 0x7c}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000400)=""/106, 0x645}, {&(0x7f0000000980)=""/73, 0x1b}, {&(0x7f0000000200)=""/77, 0x334}, {&(0x7f00000007c0)=""/154, 0x2c}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0x41}}], 0x4000000000003b4, 0x0, &(0x7f0000003700)={0x77359400}) 11.060155147s ago: executing program 4 (id=2687): r0 = socket$rds(0x15, 0x5, 0x0) (async) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @remote}}, 0x1c) (async) r2 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(r2, 0x1, 0xf, &(0x7f0000000000)=0x100000b3, 0x4) bind$inet(r2, &(0x7f00000000c0)={0x2, 0x4e20, @remote}, 0x10) (async) r3 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(r3, 0x1, 0xf, &(0x7f0000000000)=0x100000b3, 0x4) (async) bind$inet(r3, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10) (async) setsockopt$sock_int(r1, 0x1, 0x35, &(0x7f00000000c0)=0x1, 0x4) (async) r4 = bpf$ITER_CREATE(0x21, &(0x7f0000000040), 0x8) connect$llc(r4, &(0x7f0000000100)={0x1a, 0x30d, 0x1, 0x4, 0xe, 0x6f}, 0x10) (async) r5 = socket(0x2d, 0x2, 0x0) r6 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f00000001c0)={'vlan1\x00', 0x0}) setsockopt$packet_int(r6, 0x107, 0xf, &(0x7f0000000000)=0xf3f, 0x4) (async) sendto$packet(r6, &(0x7f00000000c0)="3f031c000302140006001e0089e9aaa911d7c2290f0089061327c9167c643c4a1b7880610cc9", 0x26, 0x0, &(0x7f0000000540)={0xc9, 0x0, r7, 0x1, 0x0, 0x6, @multicast}, 0x14) (async) bind$inet(r5, &(0x7f0000000080)={0x2, 0x4e24, @rand_addr=0x64010100}, 0x10) ioctl$sock_proto_private(r0, 0x89e1, &(0x7f0000003180)) 10.973766272s ago: executing program 4 (id=2690): r0 = socket$inet6_udp(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f00000002c0)={0xa, 0x0, 0x1, @remote, 0x7}, 0x1c) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='blkio.bfq.io_service_bytes_recursive\x00', 0x275a, 0x0) r2 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000180), 0x121000, 0x0) mmap(&(0x7f0000ae0000/0x3000)=nil, 0x3000, 0xc, 0x40010, r2, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(r0, 0x84, 0x13, &(0x7f0000000040)={0x0, 0x2}, &(0x7f00000000c0)=0x8) (async) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x400, 0x0) ioctl$int_in(r4, 0x5452, &(0x7f00000001c0)=0x2) (async) close(r5) (async) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r6) sendmsg$TIPC_CMD_ENABLE_BEARER(r6, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r7, @ANYRES16=r3], 0x38}}, 0x0) (async) r8 = socket$inet6_mptcp(0xa, 0x1, 0x106) getsockopt$inet6_mptcp_buf(r8, 0x6, 0x1, 0x0, &(0x7f00000000c0)=0x9) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r9 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x100, 0x0) close(r9) socket$unix(0x1, 0x1, 0x0) ioctl$SIOCSIFHWADDR(r9, 0x8922, &(0x7f0000002280)={'syzkaller0\x00', @random="2b0100004ec6"}) (async) getsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r1, 0x84, 0x72, &(0x7f0000000100)={r3, 0xf0f, 0x20}, &(0x7f0000000140)=0xc) (async) connect$pppl2tp(0xffffffffffffffff, &(0x7f0000000080)=@pppol2tpv3in6={0x18, 0x1, {0x0, r0, 0x1, 0x0, 0x0, 0x0, {0xa, 0x0, 0x6, @private0}}}, 0x3a) connect$inet6(r0, &(0x7f0000000480)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @multicast1}}, 0x1c) r10 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) (async) r11 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r11, 0x8933, &(0x7f0000003540)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_JOIN_MESH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000200)={0x28, r10, 0x1, 0x70bd27, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r12}, @void}}, [@NL80211_ATTR_MESH_CONFIG={0xc, 0x23, 0x0, 0x1, [@NL80211_MESHCONF_POWER_MODE={0x8, 0x1a, 0x1}]}]}, 0x28}, 0x1, 0x0, 0x0, 0xc044014}, 0x8004) (async) r13 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r13, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}, 0x1, 0x1}}, 0x2e) 10.880563657s ago: executing program 4 (id=2691): r0 = socket$nl_route(0x10, 0x3, 0x0) syz_genetlink_get_family_id$team(&(0x7f0000000080), 0xffffffffffffffff) (async) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000000c0)) (async) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) socket$alg(0x26, 0x5, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x8946, &(0x7f0000000180)={'veth0\x00', &(0x7f0000000140)=@ethtool_wolinfo={0x6, 0x0, 0xfffffffe, "3a49112253a9"}}) (async) sendto$unix(0xffffffffffffffff, 0x0, 0x0, 0x800, 0x0, 0x0) (async) sendmsg$NL802154_CMD_SET_SEC_PARAMS(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000040}, 0x0) (async) r2 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) (async) sendmsg$TIPC_NL_KEY_SET(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="0100000000000000000003000000300001"], 0x44}}, 0x0) sendmsg$netlink(r2, &(0x7f0000000040)={0x0, 0x20, &(0x7f0000000000)=[{&(0x7f00000001c0)=ANY=[@ANYBLOB="140100002e000100000000000010000004"], 0x114}], 0x1, 0x0, 0x0, 0x1}, 0x0) 10.693899418s ago: executing program 4 (id=2692): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCOUTQNSD(r0, 0x894b, &(0x7f0000000000)) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000240)={0x20, 0x20, 0x9, 0x0, 0x0, {0x2}, [@typed={0xc, 0x3, 0x0, 0x0, @u64=0xffff}]}, 0x20}}, 0x0) (async, rerun: 64) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000880)=ANY=[@ANYBLOB="0900000004000000080000004000000042000000", @ANYRES32=0x1, @ANYBLOB='\x00'/20, @ANYRES16=0x0], 0x50) (rerun: 64) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000040)="5623a989d25ffea0209e82f3c28a86eb99d5d4b3256a88546ba32e0d1e9c0044d9f1cfacd682a97c3581c61a31c5aebfdc", &(0x7f0000000580), 0x201000, r2}, 0x38) (async) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000001600)={r2, &(0x7f0000000580), &(0x7f0000001580)=""/92}, 0x20) (async) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[], 0xab4}, 0x1, 0x0, 0x0, 0x800}, 0x0) 4.911102029s ago: executing program 1 (id=2758): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x3, 0x16, &(0x7f0000000140)=ANY=[@ANYBLOB="61154c00000000006113300000000000bfa00000000000001503000008004e002d35010000000000950000bc000000006916000000000000bf67000000000000350605000fff07206706000005000000160302000ee60060bf500000000000000f650000000000006507f9ff0100000007070000cddfffff1e75000000000000bf54000000000000070400000400f9ffad4501000000000095000000000000001500000000000000950000000000000032ed3c12dc8c27df8ecf264e0f84f9f17d3c30e32f1754558f2278af6d71d79a5e12814cb1d8a5d4601d295c45a6a0b9bdb7dd3997f9c9c4f6f3be4b369289aa6812b8e007e733a9a4f1b0af3dda82ee45a010fb94fe9de57b9d8a81426104000000000000c6c60bf70d742a81762bab8395fa64810b5b40d893ea8fe0185473d51b546ccd3f1d5ab2af27546e7c0700000000000000b555202da2e0ec2871b4a7e65836429a527dc47ebe84a423b6c8d345dc8da3085b0ab71ca1b901627b562ed04ae76002d4519af619e3cca4d69e0dee5eb106774a8f3e6916dfec88158f0200000000c8fb730a5c1bf2b2bb71a629361997a75fd552bdc2300000008ac86d8a297dff0445a15f21dce4de9f29eff65aadc841848c9b562a31e56723888fb126a163f16f920ae2fb494059bba8e3b680324a188076eb685d55c4e9b2ad9bc1172ba7cbebe174aba210d739a018f9bbec63222d20cecac4d03723f1c932b3a6aa57f1ad2e99e0e67ab93716d20000009f0f53acbb40b4f8e2738270b31562ed834f2af97787f696649a462e7ee4bcf8b07a10d6735154beb4000000000000000000000000004000bc00f679629709e7e78f4d08000000ebe6bd9d42ca0140a7afaab43176e65ec1118d50d1e827f3472f4445d253880800000000000000690884f800031e03a651bb96589a7e2e509bcc1d161347623cb5e7ac4629c8ab04871bc47287cd31cc43000000207b40407d000000210000000000000000005f37d83f84e98a523d80bd970d703f37ca364a601ae899a56715a0a62a34c6c94cce6994521629ab028acfc1d926a0f6a5489af8dc2f17923f3c40dfd1970a55c22fe3a5ac000000000000000000000000000000c1eb2d91fb79ea00000000000000bb0d0000000000000000b712c1e47be511fe32fbc90e2364a55e9bb609c64423d2d00fea2594e190deae46e26c596f84eba9000000000000003cc3aa39ee4b1386bab561cda886fa642994cacd4722a11dc3c693962895496d4f6e9cc54db6c7205a6b068fff496d2da7d632bd1f61b007e1ff5f1be1969a1ba791ad46d800000000c7f26a0337302f3b41eae59809fd05d12f6186f117b062df67d3a63f3265dd1410eea68208a3f26b2989b832d8b34a34a4f08b34b3042065acaa10856e858d27adee7daf32903d3fc78700d429a2d4c835d803eb83eecfe4c7ff9e6ab5a52e83d089dad7a8710e0254f1b11cced7bc3c8da0c44d2ebf9f6f3ff3be4d1458077c2253b0c7c7a0a9fdd63bf910dc20e5cb2a88e59febc47f1212a21f631dbaa74f22bad050e9856b48ae3a03a497c37758537650fe6db88aa3c41fdc3d78e046f6160e1741299e8dc29906870e6431ed1eab5d067a183f064b060a8ec12725d42e3a74863d66bee966b1574f8e01b3f34a267ff0afa1e1c758a0079b747067312e9815a21cb3f1f8150d999d788535a4d3114dbc7e2bf2402a75fd7a55733360040855ed5d1c0d634fb9fb38f84d9d87b27f8a5d91217b728f13e3ee20e69e0ffb2780b1a7af137ff7b4ff139604faf0a4da65396174b4563d54b52f06c870edf0c5d744b5272b44c23488b2bdbff947c4dfa108cbb88202eeb81f428a5b3c299848649e1a6bff5af657a67463d7dbf85ae9321fad16ee751cd7dde94ec97549c2b517dc4a29b9cba8ded5de8206c812439ab129ae818837ee1562078fc524b3baf49a0be9bb7d958d5e87c6c09bf71a894bad62934782cc308e936d7637e07c4a2a3bc87b0da23c00d9ef418cf19e7a8c4c328be0ce95798adc2dca871073f6bd61dc18402cde8bf377b2eaa45c940aabc86b94f8cbde4d470667bee722a6a2af483ad0d3415ed0f9db059a6cffb92e2a0cfd81434e00000000000000000000d154ba10a8e51489a614e69722bac30000000000000000000000000000c5c4d188ff555285b9743d3aac000583f42d168613151d681a2f71373f20d92c9048407c91fabecfe8b3f2d5454d127edab14ba61ba1cfc4336324c86f3dcb43e9a58208077e90f6ec1c7ac756f61dcc372cdd30b82507489f0bbfbd3c3f21752e81319c0161e154ceb16e00bc7f5a6962dff317f4d014786e432817064874d69a39cb0da31bcc5f81894d8a5cbb8be3f7741b18007dff12eb95066cc6bc256f0a12282224bb031bbee6d23cef7074f6d718b06ca80b57aa183dd0c3eee45891441f2b89b4c67aa9882281393954972046974f18df232cd7fca610e33f51c2d062020f403d85ff36c26e2f6bd1d82f4d3ceb3472d9a77e0057a3bfe697d9ab7585f4a1b381343d2cf855689232f4fc5135790662dc1419a374be9d7b3e5be2886d23add90d862f1a682ff11c798e338af3e5bb0f9d3952b15bf3e0c618c89d20ca1e18a031397693bf3cfbd8417e5b55e641c898c280356f2da222d5d68919d98158578dcf18efa404e508bcbbb8cfcf70086821ebdf34c9a1dff45af873d0ecdf904c2bdbef81f246d26f4b40df949e12bdac18532f4e11c608cc31d60cb591c40a7b386fa1c753336d7220a35118d4919b45eff32aab684e62c6691de14e97aa7e9dc8ecf0cd50540246d2b746e41e5b4e2c095039dfe0f71db6265f7580d098be40ef36faee5d1695830d4242a23e541e6ce9fa1998d8961cf4fe3c8e8fbb566fffffffffc229614a4b7f80d237b8abc6fd0407de31d6e5532f360d379f20f054e5deb27f7922fe6c14eba96c9af409da03290e4009f872d5aaca63dbe239efb1e02dd4fc07f8c5b070e2ddeb4b5afa6df2e7e162962e334d8553cc56008ddc8277fa9e8f6684513bfa827686b6fb71259743f55f46fa7e6379312e93213faf275f0441d46bc5690181244c44bea45854ed4ccd99f3fd328110ae22ef1504ec0566652d742ed8a7e202539c6531824f7399b486fbb906a91b77f2a6ba27bf97ebc7482cea32278a7acd9f2210e6ed2defcbd112f29a92401c5a37c58835f870b056186ef3971d3d9effa5661cabc2a059689dcfb030dd4ac0fe54db67510d3e9a5d36b900000000000000000000000000000000c9e484cf5f8c0955c11b285de46871d62f9d986e73658d228225b21f694dd2dc80e96ce476496973ee14e3d4fd03507c6f7c0c8ae809ddc9a36b4f30d15d08cc8e72d750f5e529cf4cec823b923d382f3f2c42dcb4b316eba77e7f767ae17d4d3427c9379eadbd040fbbe0c6dd8100f1558354bdd35626052c2e66cc34f4e266cc04218764824533cac2736e236b50ae4d800565910200af9cb11002791a91d834ffcc65a6226ecafe0372e3ace29c2441eca24371857aa9eb9b3910a2eb"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0xffffffffffffffd2}, 0x48) syz_emit_ethernet(0xba, &(0x7f00000000c0)={@broadcast, @random="1704b45adbde", @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0xac, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0xe0, 0x0, 0xe000, {0x24, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x11, 0x0, @empty=0xac1414aa, @remote, {[@lsrr={0x83, 0x3}, @timestamp_prespec={0x44, 0x3c, 0x0, 0x3, 0x0, [{@multicast1}, {@initdev={0xac, 0x1e, 0x0, 0x0}}, {@remote}, {@loopback}, {@initdev={0xac, 0x1e, 0x0, 0x0}}, {@dev}, {@local}]}, @timestamp_prespec={0x44, 0x3c, 0x0, 0x3, 0x0, [{@private}, {@multicast2}, {@local}, {@remote}, {@private}, {@dev}, {@private}]}]}}}}}}}, 0x0) r1 = socket(0x10, 0x3, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=@ipv6_delrule={0x24, 0x21, 0x1, 0x0, 0x0, {}, [@FIB_RULE_POLICY=@FRA_SUPPRESS_PREFIXLEN={0x8}]}, 0x24}}, 0x0) sendmsg$nl_generic(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000001240)={&(0x7f0000000180)={0x6c, 0x18, 0x1, 0x0, 0x0, {0x1d, 0xd601, 0x9}, [@nested={0x4d, 0x12, 0x0, 0x1, [@generic="25b57e35619bf2be9082cfcd8fba0cd0f2934efacde0a223b473fe77f3e5ba760d3793b2b3589c9fb23ff943b7528ea34883bc4a506cf756740574b89d396af9b59638700500000005"]}, @typed={0x5, 0x10a, 0x0, 0x0, @str='\x00'}]}, 0x6c}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xd, 0xb, &(0x7f0000000500)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020642500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b704000000000000850000004600000095"], &(0x7f0000000580)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sock_ops, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x5, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz0\x00'}]}, @NFT_MSG_NEWRULE={0x60, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x38, 0x4, 0x0, 0x1, [{0x34, 0x1, 0x0, 0x1, @match={{0xa}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_MATCH_INFO={0x8, 0x3, "e4edf2b7"}, @NFTA_MATCH_REV={0x8}, @NFTA_MATCH_NAME={0xe, 0x1, 'connlabel\x00'}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0xd4}}, 0x0) 4.705438651s ago: executing program 1 (id=2760): r0 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000001c0)=@newqdisc={0x84, 0x24, 0xf0b, 0x70bd2b, 0xfffffffd, {0x0, 0x0, 0x0, r1, {0x0, 0x2}, {0xffff, 0xffff}, {0x2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x54, 0x2, {{0x7fff, 0x7f, 0x192, 0xf, 0x7fff, 0x205}, [@TCA_NETEM_RATE64={0xc, 0x8, 0x7df9bd2ca29e3677}, @TCA_NETEM_SLOT={0x2c, 0xc, {0x5, 0x1, 0x4, 0x0, 0x1bb, 0x4}}]}}}]}, 0x84}}, 0x0) bpf$TOKEN_CREATE(0x24, &(0x7f0000000080)={0x0, r0}, 0x8) r2 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r2, 0x107, 0xa, &(0x7f0000000000)=0x2, 0x4) setsockopt$packet_tx_ring(r2, 0x107, 0xd, &(0x7f0000000040)=@req3={0x9, 0x100000001, 0x10000, 0x1, 0x0, 0x2}, 0x1c) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000280)={0xc, 0x3, &(0x7f0000000040)=ANY=[@ANYRESDEC=r0], &(0x7f0000000000)='GPL\x00'}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000001c0)='sched_process_wait\x00', r3}, 0x10) r4 = bpf$BPF_LINK_CREATE(0x1c, &(0x7f00000000c0)={r3, 0xffffffffffffffff, 0xd, 0x0, @void}, 0x10) r5 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r4}, 0xffffffffffffff28) bpf$BPF_PROG_DETACH(0x9, &(0x7f00000006c0)=ANY=[@ANYRES32=0x0, @ANYRES32, @ANYBLOB="1100200000", @ANYRES32=r5, @ANYBLOB, @ANYRES64=0x0], 0x20) r6 = socket$alg(0x26, 0x5, 0x0) bind$alg(r6, &(0x7f0000000480)={0x26, 'hash\x00', 0x0, 0x0, 'nhpoly1305-sse2\x00'}, 0x58) setsockopt$ALG_SET_KEY(r6, 0x117, 0x1, &(0x7f0000000000)="8a", 0x440) r7 = accept4(r6, 0x0, 0x0, 0x0) sendmmsg$alg(r7, &(0x7f0000004140)=[{0x0, 0x0, &(0x7f0000000240)=[{&(0x7f00000001c0)="c6", 0x1}, {&(0x7f00000002c0)="41a88d1946fbd923c6d44c3760609693483bd779df9b25776169c9a956ac84c2eed9a3a352980257834242fdcc393d859d0d4f6c800827d1bd99468e4e1c9b39", 0x40}], 0x2}], 0x1, 0x0) ioctl$PPPIOCGIDLE64(r5, 0x8010743f, &(0x7f0000000000)) 4.554830837s ago: executing program 1 (id=2761): bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000280)={&(0x7f00000000c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x18, 0x18, 0x2, [@struct={0x0, 0x1, 0x0, 0xd, 0x1, 0x0, [{0x0, 0x2}]}]}}, &(0x7f0000000180)=""/198, 0x32, 0xc6, 0x1}, 0x20) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)={{0x14, 0x10, 0x4}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x5, 0x0, 0x0, {0x7, 0x0, 0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x3c, 0x9, 0xa, 0x401, 0x0, 0x0, {0x7}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x21}]}, @NFT_MSG_NEWSETELEM={0x64, 0xc, 0xa, 0x301, 0x0, 0x0, {0x7}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x38, 0x3, 0x0, 0x1, [{0x34, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_SET_ELEM_EXPRESSIONS={0x28, 0xb, 0x0, 0x1, [{0x10, 0x1, 0x0, 0x1, @quota={{0xa}, @void}}, {0x14, 0x1, 0x0, 0x1, @limit={{0xa}, @val={0x4}}}]}]}]}]}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x0, 0x84}}}, 0xe8}}, 0x0) 4.389730299s ago: executing program 1 (id=2762): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000006300)={0x6, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="18020000390000000000000000000000850000004100000085000000a000000095"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, @fallback=0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3}, 0x94) socket$nl_netfilter(0x10, 0x3, 0xc) openat$ppp(0xffffffffffffff9c, 0x0, 0x0, 0x0) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000280)={r4, r3, 0x25, 0x0, @val=@uprobe_multi={0x0, 0x0, 0x0, 0x6, 0x0, 0x1}}, 0x40) syz_emit_ethernet(0xfdef, &(0x7f0000000580)=ANY=[], 0x0) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000340)=@newnexthop={0x18, 0x68, 0x401, 0x70bd29, 0x25dfdbfd, {0x0, 0x0, 0x4, 0x0, 0x10}}, 0x18}, 0x1, 0x0, 0x0, 0x4004}, 0x800) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000002c0)=@newlink={0x5c, 0x10, 0x439, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x3c, 0x12, 0x0, 0x1, @ipip6={{0xb}, {0x2c, 0x2, 0x0, 0x1, [@IFLA_IPTUN_REMOTE={0x14, 0x3, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @IFLA_IPTUN_LOCAL={0x14, 0x2, @private2={0xfc, 0x2, '\x00', 0x1}}]}}}]}, 0x5c}}, 0x0) syz_open_procfs$namespace(0xffffffffffffffff, 0x0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0x1c, 0x0, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) bind$netlink(r5, &(0x7f0000000000)={0x10, 0x0, 0x0, 0x80065c9}, 0xc) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000380)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a05000000000000000000010000000900010073797a30000000002c000000030a01020000000000000000010000000900010073797a30000000000900030073797a310000000084000000060a010400000000000000000100000008000b40000000005c0004802c000180090001007866726d000000001c0002800800024000000004050003000000000008000140000000092c00018008000100636d7000200002800c00038005000100ac000000080001400000000c08000240000000000900010073797a300000000014000000110001"], 0xf8}, 0x1, 0x0, 0x0, 0x40010}, 0x0) 4.126106421s ago: executing program 1 (id=2763): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000180)=0x100000001, 0x4) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000540), 0x3c) getsockopt$inet6_tcp_int(r0, 0x6, 0x7, 0x0, &(0x7f00000003c0)) r1 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000540)={0x3, 0x4, 0x4, 0xa, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000005c0)={{r1}, &(0x7f0000000600)=0xa00, &(0x7f0000000640)}, 0x1c) 3.970490238s ago: executing program 1 (id=2764): socket$inet_icmp_raw(0x2, 0x3, 0x1) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000080)='ns/ipc\x00') mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x5, 0x3032, 0xffffffffffffffff, 0x0) r1 = socket$inet_icmp(0x2, 0x2, 0x1) ioctl$IOCTL_GET_NCIDEV_IDX(r1, 0x0, &(0x7f0000000000)=0x0) recvfrom(r0, &(0x7f0000000180)=""/241, 0xf1, 0x100, &(0x7f0000000340)=@nfc_llcp={0x27, r2, 0xffffffffffffffff, 0xc28d2aef3f84a600, 0xa6, 0x2, "40306843adee1f786ad031e47f21e599244b8558292bc61d96f4b2b49b62750b7cc203635b1d84042b711df003ba0497e78de2ac440ccbf2e62f465c673f51", 0x37}, 0x80) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000280)=@bpf_lsm={0x6, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="180000000400000000000000000000f195"], &(0x7f0000000140)='GPL\x00', 0x0, 0x0, 0x0, 0x41100}, 0x94) sendmsg$nl_route(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=@newlink={0x34, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r4}]}, @IFLA_GROUP={0x8}]}, 0x34}}, 0x0) 2.099434715s ago: executing program 3 (id=2781): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000001ac0)={&(0x7f0000000080)=ANY=[@ANYBLOB="2c0000002d00010026bd7000fcdbdf250400000004000d", @ANYRES16=r0], 0x2c}, 0x1, 0x0, 0x0, 0x4000d}, 0x20000000) syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r0) 1.790975765s ago: executing program 3 (id=2785): r0 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) (async) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nfc(&(0x7f00000001c0), r1) (async) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000140)={'wpan3\x00'}) (async) ioctl$IOCTL_GET_NCIDEV_IDX(r0, 0x0, &(0x7f00000000c0)=0x0) (async) r4 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000380)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0xe2, '\x00', 0x0, 0xffffffffffffffff, 0x5, 0x0, 0x1}, 0x50) mmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1000000, 0x40010, r4, 0xa5b3c000) (async) sendmsg$NFC_CMD_DEV_UP(r1, &(0x7f0000000200)={0x0, 0xffffff3d, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB="1c000000b8965cb551b178d9a9c33ce63dd98c5f2419ce1ee466fd505a14bab3300cf211d4c338230290002e795a4900"/64, @ANYRES16=r2, @ANYBLOB="010026bd7000fcdbdf250200000008000100", @ANYRES32=r3, @ANYBLOB], 0x1c}}, 0x0) r5 = socket$can_raw(0x1d, 0x3, 0x1) setsockopt$CAN_RAW_RECV_OWN_MSGS(r5, 0x65, 0x4, 0x0, 0x0) (async) r6 = socket$kcm(0x10, 0x2, 0x4) sendmsg$inet(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000001880)="5c00000012006b949e3de3d86e6c1dffff137e03000000000000fcce1ef0f8001d000a00a0e6b1e517d34460bc24eab556a7e6241e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f408000300060100000800030011000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) (async) write$nci(r0, &(0x7f0000000740)=ANY=[@ANYBLOB="7105050302f70101010603012c040ffc700173"], 0x13) r7 = bpf$MAP_CREATE(0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="1e00000000000000008000000700000000000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000000000000000000000000000000000000000000000000000d706686176893ba1b7ae027137620d83f64f5e3430cdb2dfdeb983446f606f1eabc755fba011e5a5a56c281023e5a847abfdfbf45d06d9eca85747dcfd95d2ed87887305354b0d35710fc62f1d7052143133b2c2ea5d28b632949800"/128], 0x48) bpf$MAP_LOOKUP_ELEM(0x2, &(0x7f0000001740)={r7, 0x0, &(0x7f0000001700)=""/53}, 0x20) (async, rerun: 32) r8 = syz_init_net_socket$x25(0x9, 0x5, 0x0) (rerun: 32) ioctl$SIOCX25GCAUSEDIAG(r8, 0x89e6, &(0x7f0000000080)) (async) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001740)={r7, 0x0, &(0x7f0000001700)=""/53}, 0x20) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) 1.726911155s ago: executing program 2 (id=2786): r0 = socket$nl_generic(0x10, 0x3, 0x10) socketpair(0xa, 0x4, 0x8, &(0x7f0000000000)={0xffffffffffffffff}) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f00000002c0), r0) sendmsg$NL80211_CMD_TRIGGER_SCAN(r1, &(0x7f0000000380)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)={0x34, r2, 0x200, 0x70bd29, 0x25dfdbfc, {{}, {@void, @void}}, [@NL80211_ATTR_BG_SCAN_PERIOD={0x6, 0x98, 0x9}, @NL80211_ATTR_SCHED_SCAN_DELAY={0x8, 0xdc, 0x8}, @NL80211_ATTR_SCAN_FLAGS={0x8, 0x9e, 0x141}, @NL80211_ATTR_SCHED_SCAN_DELAY={0x8, 0xdc, 0x2}]}, 0x34}, 0x1, 0x0, 0x0, 0x8841}, 0x94) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff) r4 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) getsockopt$netrom_NETROM_T1(r4, 0x103, 0x1, 0x0, &(0x7f00000000c0)) r5 = syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f0000000080)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_GET_WOWLAN(r0, &(0x7f0000000e00)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)={0x28, r3, 0x301, 0x70bd2b, 0x25dfdbfc, {{0x5}, {@void, @val={0x8, 0x3, r6}, @val={0xc, 0x99, {0x6, 0x78}}}}}, 0x28}, 0x1, 0x0, 0x0, 0x24004000}, 0x20000010) r7 = socket$inet6_sctp(0xa, 0x1, 0x84) sendmmsg$inet6(r7, &(0x7f0000001c00)=[{{&(0x7f0000000040)={0xa, 0x4e23, 0x5, @private1, 0x2}, 0x1c, &(0x7f0000001780)=[{&(0x7f0000000100)="630e71", 0x3}], 0x1}}], 0x1, 0x24044005) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r7, 0x84, 0x7c, &(0x7f0000000080)={0x0, 0x0, 0x1}, 0x8) write(r7, &(0x7f0000000200)="9b54692fafbf33596fbb8bd6310f7e941abc0da81ef0c375dd0729f7a37f694e54c243642b80eddeb10be65f9e7cdd8935cc6fcf5b9334c4dca324253fc9c034eb15db998542ee61f4e3b58b1a7f404f2499a0d35605f1db9ad53be988fc1939c390daac3cc61301bc08d13f13f2d20eb09a215eccaff0da4b50cbe8d6aab71652ed376349eb0ca5f4958611be8663de743003559e4c4073de70", 0x9a) 1.726256441s ago: executing program 3 (id=2787): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [@NFT_MSG_NEWSET={0xa0, 0x9, 0xa, 0x401, 0x0, 0x0, {0x7, 0x0, 0x5}}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x101, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}]}, @NFT_MSG_NEWRULE={0x14, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x108}}, 0x0) 1.649777737s ago: executing program 0 (id=2788): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000380)={0x2, 0x4e22, @multicast1}, 0x10) setsockopt$sock_int(r0, 0x1, 0x800000000f, &(0x7f0000000080)=0x7, 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(r1, 0x29, 0x1a, &(0x7f0000000100)=0x401, 0x4) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000000180)=0x800001, 0x4) bind$inet6(r1, &(0x7f0000000140)={0xa, 0x4e22, 0x0, @empty, 0xffffffff}, 0x1c) listen(r0, 0x0) listen(r1, 0x4) r2 = socket$packet(0x11, 0x3, 0x300) socket$packet(0x11, 0xa, 0x300) getsockname$packet(r2, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendto$packet(r2, &(0x7f0000000000)="bb2c4b13fbd0573aba4abf089cdb83a7c7a8d6eafed4d8aeeddcc6e225c52f1b2f6b8988932b646b72e571fed069", 0x2e, 0x24000000, &(0x7f0000000140)={0x11, 0x1b, r3, 0x1, 0x0, 0x6, @multicast}, 0x14) sendmsg$RDMA_NLDEV_CMD_RES_CM_ID_GET(0xffffffffffffffff, &(0x7f0000000280)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x9dfd3933ce8af959}, 0xc, &(0x7f0000000240)={&(0x7f00000002c0)=ANY=[@ANYBLOB="280228bd7000e5dbdf2508000100000000000800000800000000089dcafa808d3e721d102b95000300040000a9e328195d7ce3c882b92eb25d4bd4e92b2ea11c034f44000000000000"], 0x28}, 0x1, 0x0, 0x0, 0x4}, 0x40) r4 = socket(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x3, 0xe, &(0x7f0000000200)=ANY=[@ANYBLOB="b700000034000000bca30000000000002403000040feffff720af0ff0000000071a4f0ff000000001f030000000000002e0a0200000000002600000000ff000e61145b00000000001d430000000000007a0a00fe00581c1f6114140000000000b503f7fff80000009500000000000000033bc065b78111c6dfa041b63af4a3912435f1a864a7aad58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a7168e5181554a090f30002af51efd601b6bf01c8e8b1fee5bef7af9aa0d7d600c095199fe3ff3128e599b0eaebbdbd732c9cc00eec363e4a8f6456e2cc21557c0afc646cb7798b3e6440c2fbdb00a3e35208b0bb0d2cd829e65440000000000000000028610643a98d9ec21ead2ed51b104d4d91af25b845b9f7d08d123deda88c658d42ecbf28bf7076c15b463bebc72f526dd70252e79166d858fcd0e06dd31af9612fa402d0b11008e59a5923906f88b53987ad1714e72ba7d06a59ff616236fd9aa58f0177184b6a89adaf17b0a6041bdef728f5089048ddff6da40f9411fe7226a40409d6e37c4f46756d31cb467600ade70063e5291569b33d21dae356e1c51f03a801be8189679a16da18ec0ae564162a27afea62d84f3a10076443d643649393bf52d2105bd901128c7e0ec82701c8204a1deeed4155617572652d950ad31928b0b036dc2869f478341d02d0f5ad94b081fcd507acb4b9c67382f13d000000225d85ae49cee383dc5049076b98fb6853ab39a21514da60d2ae20cfb91d6a49964757cdf538f9ce2bdbb9893a5de817101ab062cd54e67051d355d84ce97bb0c6b6a595e487a2cc47c0efbb2d71cde2c10f0bc6980fe78683ac5c0c31032599dd273863be9261eee52216d009f4c52048ef8c126aeef5f510a8f1aded94a129e4aec6e8d9ab06faffc3a15d91c2ea3e2e04cfe031b287539d0540059fe6c7fe7cd8697502c7596566de74e425da5e7f009602a9f61d3804b3e0a1053abdc31282dfb15eb6841bb64a1b3045024a982f3c48b936e6f9e0fcda88fe4413537528fdb6153baae244e7bf573eac34b781337ad5901a4cad2422ee965a38f7defbd2960242b104e20dc2d9b0c35608d402ccdd9069bd50b994fda7a9de44022a579dfc0229cc0dc98816106dec28eaeb883418f562ae00003ea96d10f172c0374d6eed826416050000000bfe9b4a9c5a90ff59d54d1f92ecc48899b212c55318294270a1ad10c80fef7c24d47afcc829ba0f85da6d888f18ea40ab959f6074ab2a40d85d1501783a7ab51380d7b4ead35a385e0b4a26b602396df7e0c1e02b88c114f244a9bf93f04bf072f0861f5c0b000000000000eedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba3401e6a52acb1188883ad2a3b1832371fe5bc621426d1ed01b389708165b9cdbae2ed9dc7358f0ebadde0b727f27feeb7464dcc536cbae2f5c7d951680f6f2f9a6a8346962a350845ffa0d82884f79adc287906943408e6df3c391e97ba48db0a5adbfd03aac93df8866fb010ae20e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00000000c95265b2bd83d648532869d701723fedcbada1ee7baa19faf67256b56a41fd355b6a686b50f0937f778af083e055f6138a757ebd0ed91124a6b244f9acf41ac5d73a008364e0606a594817031fc2654026c6ea08b83b123145ab5703dad844ceb201efeb6dc5f6a9037d2283c42efc54dd84323afc4c10eff46248843187f1dd48ef0900000000000000ff0f4000000000f00700003c17888e1cdba94a6ea80c33ead5722c3293a493f1479531dd88261458f40d31fe8df15efaaeea831555877f9538c6ee6ba65893ff1f908ba7554ba583ec7932f5954f31a878e2fae6691d1aee1da02ba516467df3e7d1daac43738612e4fee18a22da19fcdb4c1011e32f808890205f0e6da2819d2f9e77c7c64affa54fec0136cbafa5f62e96753b639a924599c1f69219927ea5301fff0a6063d427180d61542c2571f983e96635600000554f327a3535e7c7542799493c31ac05a7b57f03ca91a01ba2a30ca99e969d6fd09dc28ebc15edb4d91675767999d146aef7799738b292fd64bbca48568325b2969e2b15f36b788bce5ccdbaf75c94cb93499f6947a967a794963442aece449a0d80010f5c653d22d49030a8c2a4ab595bf4238f18ca428dafc7ac96d404607a0000000051a2104f22e6db5a62b5089c1b45282d38864daa3ae81d6b0968d1d2869291b7d12096833d6864da40b54783a17aaeb6737c323f9f98e354cc98dcfe23ad01bd1c61563e69ffe1c2c73e16e637d4219ef7ec61261173f359e93d2c5e424c17998809ec8f0232b3955e052a4cecd89008f70314a0bdd491ecab5d232f89fe0120f64c62e8e3ed8bcb45202c204bbec8d722824c0ebca8db1ea4a05e41f6016ab5bbe4fe7ff5d785d0128171c90d9900ca2532b0f9d01c4b45294fbba468df3e1b393cb4e62e753b4172ba7ac1f2b51c94bc5d047899fd219f448bf9189c65c9d91eda6b52a373803a9efe44f86909bc90addbc4b3093c91b8068c5adfcb0d7fd849904568916694d461b76a58d88cf0f520310a1e9fdc18cde98d662eee077515d0a881192292ffff5392ab3d1311b82432662806add87047f601fa888400000000000000000000000000006acc19808d7cf29bc974b0ea92499a41b9b9a7c2bca311a28ee4952f2d325a56397c78f12205db653a536f0100e0eda300a43a13bd1b9f3322405d1efd78e578dc6b3fb84f3738a4b6caa800000087efa51c5d95ecba4e50e529d1e8c89600e809dc3d0a2f65579e23457949a50f2d0455cf699b3746979f99f6a1527f004f37e84fb478199dc1020f4beb98b8074bf7df8b5e783637daf121f175a81cffff4ac55a4385e9a617aa6c8e10d4202c5afeb06e2f9115558ea12f92d7ae543d44086b3f03b20d546fa66a72e38207c9d20035abc46271a30f1240de52536941242d23896ab74a3c6670fdc49c14f34fc4eadd6db8d80aba439772bf60a1db18c472dafc5569adc2c406f39f82928d2a1ffe29f1a57d3f18f4edaeb5d37918e6fddcd821da67a0785585a4443440dc65600e64a4a274000000000000000000000000000000000000000000000009dd14b38f2f5426d7cf5075047c31f6ce6adddfe3ac649c0643c8bfbeb14ba1fd7a485aa893915cf81e29aaf375e904bbe52691a4120260ffcd030000006d291ebcef893e1b9ccb6797d0646fe0e7274434f28efb43e06e64f0698caca42f4e6018a455736c482a017e2b13dac4a90faa109f0e87cc94e3efb649692456463ca74aa6ad4bf50c1acb3928143be1c1023a375e528285544d0064b98646f3109e9a4942ce42c6e7ec84b664f6c2770803f10b0a1fcbfc309381aeba191950bae71f37f1eb7ceeffb3c0547ac6571603adbfde4c8b5f8d7f4b854441613633b48865b65bdc415e1e0dcf672d68cf4cebf04f4bc1eebf560a26d3b332240d450fdb0a9a69f432e277f3a0386eb2bd1305c821c64757f786b79fef54dbe64c67d73934bc80b2133fb3c04cc7ea48bf97a6243c9f95dcbddecf45f008f1822c7868e1ff5a3cff5d6b6898335792749df7b1f51e91f8c1c3b1b93b33aaa3fab69cef08a9f6f6cf39dea3d878b2ed42545421970cc426e644332bc956d1c6adefdf0ede2c5c94aa632646ae225accdf031f611d01622921f1b922a5ac887cca3136133dce8d9f5f4da7bed2ea5d94362200000000000000000000f296b0c1484e5f781ad26bff696b05ff0a5e2270e07e18b04273bd4075ea38ab463bfa6a38e7c537498ba3e4df8dfc9e8c0a0d213c3ffad44d2a376def42e41e9fc3167a257e040fa7cf32c221aaac6cfdeb33c27500001a0000000000000000000017350000c11ae694b0c69c2c03f6790044a357e785af6e153d5f1ea460af92c7cbbd6295afe740f5e154346d483e0d10522a7a945b93fb705b95b6aae27a8fab1e6984c8bdc12360627137ab6737b68ab08a1a4b94cb29a74dc36b51209cfbc87f61182bbeb2772e9d5a1ffc477179be481ffe46a4ce86be0b1f8eee42a611a3d44ca450b14586ed63dd92005c79e4a8ab8a94f0b74903580ac98708007c80d6c7d0de4614195e40d797c0348dd70f36a220e8b3710fb5358c27e90793bcb9ee6319342c4b239ca8cbc6fc83d32e6eb62ad92e43991f2447be9c2a1ae1119eafb901a43d57e885116d19aa152bfb89f8d0b2516f80120a1cddff771657f3d0288ec3899f1e3ba0151c4037148fb479de703fc52b6573349c28d1b107d859b4961324c17756dde99de1924a1d2b7095d34a55060f47f4407d89acf9f1d2156befec432e8e993c79027b7ef285b20c2e6b3d0491d0d3591b0d94713332b6b79c8297117b0d14eff64e0aca8a4b4aa773d8fba1217e9519952419bb9dd998d0ec870ff00b6d556018602738fbc6cec89d6dd13cf55b96f6fe9a137d2d6a56ad78e52c23ed080000000000002bc261a781fd14126c146a0aac4221839a4b9bbf61e4bba695a41e2109eba8e40c370267cc51ffadbd15cafc97a4d3edfdcb9b5729307c6bdaf7b69325fb05fa8a9869de0600ee477d71bf3e36d1d9019edfa27aae24b632f251df210c86a18fae731ecb8b0d48357378caf2b6789509b1bacfd4fa812dc341875cfa5e798bbf59770000000000000000c8a594ea3c3347962d9113b1fecdfad5a8da641053f02e49456f5d21674521e67a5b18ea451eccf69dd6af928d2d68da9304a296c22fdc0500000000000000b1aade386b113045033a6188d56e675564d8cb8d5b40114b0f5bf15dd64c9ece60b8588ee8777d0ea8f4713b258427c7d90f9e93348e17723ba9ab8ae790f74cc41ae5795835f3cec40dff485d2802c08611454d9ea784a205bcc07ec26f906f3cf45bb37014ab6f22af6213618e242b283ea9d3f0677ee598072ec06f7170009d92bb87d9d12c378dfd3e74ec056ee83eef666423d934fc5908c9ff98715218a5964f1e00000000426ac9588e27aefe307f49662990ee823568bbc2f89596ced7c6c52d76b8096f1848410843b93fd404f535be474f456778b5ef85abb8fc2336abd5ea64a6efea8a5aca0015499b88ae780a7bae4df603bd3c72808cf300440b1b638a6640f7de8d0d82f359ca2f779cd48cd8d3603f4f69e47f386988c9b7b5d6dd3d48a1fdca780049d7c87bea42161a4c0d7cf0125b43dc9d8845f3c05a08acda647e7143d0e0aee2949a45e28488b0522c2288072467d2afe269f589fb7e034b92d3ca245b16b71998711bfe206c9690b6d0eebb06a29349229eb45ff15c63aa2c82c56d7420738cd1b04eb16e87cb524315d7361ea3635d3799bb7fcc56aa5e1dbe031a7a12554dee6754b72f43a6fddf427f32ec3df274a88097725679769beebf1aa6eb09d5154e4900000000000d0f7160a05911d969879953d3d4702b2676c07bb0fd14020a66718378825d5ed789711b77d40dc31e0b8fc651b45559da463f0000000000000000000000000052d42124e9c26aba885015e69d42ecd710342ac597ebea576ae15fdf611356f622e831741ab15549e0d7a2bd0324e2b3b48a10551607492c19eaf58485feb4cab19c303b30ba2ddea0d792d77724c9fa4ed58b93668fc20484f141ee2b6a0029e88fdc853189b4dafd36ff23b11967090e508f45e3f10857038a52ef275cf9e3e4b5d30b12d138dfa70930c603b5e3f4b7be67be3dba3cbd8d4d143195af0697d779445d67dcfbd922d12a8b49f93eac7a72faacf80346b3b669615f2710eb8df39fc8c04d2c9c196fa6facfea613569a35cde6451f2edf55ce25c7d72ec7ea85a92458c0559ca3a94727d495bd4671a55a70bc544d71d8e0257707a31936f1adf224077310a86bf447ec92c650acca8c6b0721020894b06178c32f4472d17174d6eb2b067030c5d2c12583f46d2da7fba42d4083259c7cdc8bf1f4299c248865d3c809356c3ed"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0xffffffffffffff97, 0x10, &(0x7f00000000c0), 0xffffffffffffffc2}, 0x48) r5 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000340)={'bridge0\x00'}) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[], 0x44}, 0x1, 0x0, 0x0, 0x40010}, 0x4) r6 = socket$inet6(0xa, 0x800000000000002, 0x0) setsockopt$sock_linger(r6, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000840)=ANY=[@ANYBLOB="240000001800010300000000000000000a0000000003"], 0x24}}, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r7, 0x10e, 0xc, &(0x7f0000000640)=0x4, 0x4) sendmsg$netlink(r7, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000840)=ANY=[@ANYBLOB="1c00000022"], 0x1c}], 0x1}, 0x0) sendto$inet6(r6, 0x0, 0x0, 0x4c881, &(0x7f0000000540)={0xa, 0x4e24, 0x0, @mcast2}, 0x1c) sendmmsg$inet6(r6, &(0x7f0000005440)=[{{0x0, 0x0, &(0x7f0000000080)=[{&(0x7f00000003c0)="90dc2ce02bef96759f6e5844549cc79f269a2d7ee53057f16c79ba4318e6742bb4f3da73c2ef71c1d5a670f4d0a6e4697880c3ace0435e3484a492e2c2826f396d2c7cadc6c4cc7cc164e54e8ce1623fe8cc5897f67c5c2fb41db638549dd16ff6ea3582854a66995cb2f88db539ee7fa4fe277d15fcb3f4ef488e7d691d6c4695746b9fc34df495a731c97a4d1d55f50ddce933fc4b57aec10146e895cb25d2989e5b227dd1c60545dad1a452f15a5643a20516aa2f17787c1134dfb4810faecd99a258de8df9a461dac87b88012da74ec47922e002dee4da2f3b101705e1b580a285b0aca8d66e65039f5bc61e39ad3d71a15f8184800c032103b3150be70c77039246f6a9138e14a5637aa941f426bb1a56c54528a71fdec899f1e40fd5dc7d59390fcee4f3a81edf13c7090e1d2a", 0x130}], 0x1}}], 0x1, 0x400c404) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r5, 0x89f3, &(0x7f00000000c0)={'ip_vti0\x00', &(0x7f0000000680)={'syztnl1\x00', r3, 0x7800, 0x8021, 0x6, 0x2, {{0x2f, 0x4, 0x3, 0x1c, 0xbc, 0x68, 0x0, 0x7, 0x4, 0x0, @empty, @loopback, {[@timestamp_prespec={0x44, 0x14, 0xee, 0x3, 0x6, [{@multicast2, 0x9}, {@broadcast, 0x10}]}, @noop, @rr={0x7, 0x1f, 0xdd, [@initdev={0xac, 0x1e, 0x0, 0x0}, @loopback, @dev={0xac, 0x14, 0x14, 0x37}, @loopback, @remote, @multicast2, @broadcast]}, @generic={0x89, 0xf, "3ed3e35df737a1357c1c2012d7"}, @rr={0x7, 0xb, 0xdb, [@multicast2, @rand_addr=0x64010100]}, @lsrr={0x83, 0x13, 0x57, [@rand_addr=0x64010102, @local, @multicast1, @broadcast]}, @end, @generic={0x0, 0xc, "ae4f936d23c8d81ea50a"}, @lsrr={0x83, 0x1b, 0x14, [@dev={0xac, 0x14, 0x14, 0x27}, @initdev={0xac, 0x1e, 0x1, 0x0}, @dev={0xac, 0x14, 0x14, 0x2f}, @initdev={0xac, 0x1e, 0x0, 0x0}, @remote, @dev={0xac, 0x14, 0x14, 0x42}]}, @rr={0x7, 0x1f, 0x3b, [@empty, @loopback, @dev={0xac, 0x14, 0x14, 0x1e}, @broadcast, @remote, @loopback, @remote]}]}}}}}) ioctl$TUNSETCARRIER(0xffffffffffffffff, 0x400454e2, &(0x7f0000000500)=0x1) sendmmsg$inet6(r6, &(0x7f0000003640)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4040005) 1.500044205s ago: executing program 3 (id=2789): socket$packet(0x11, 0x3, 0x300) r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x1d, 0x2, 0x6) epoll_create(0x9660) socket$inet6_udplite(0xa, 0x2, 0x88) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$inet6_mtu(r1, 0x29, 0x17, &(0x7f0000000080), &(0x7f0000000100)=0x4) setsockopt$inet6_tcp_int(r2, 0x6, 0x1e, &(0x7f0000000180)=0x400000001, 0xc2) setsockopt$inet6_tcp_int(r2, 0x6, 0x2000000000000022, &(0x7f0000000040)=0x1, 0x4) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4, 0x0, @mcast2, 0x20}, 0x1c) sendto$inet6(r2, 0x0, 0x0, 0x800, 0x0, 0x0) writev(r2, &(0x7f0000001540)=[{&(0x7f0000000340)="ddbb59c9ec", 0x5}], 0x1) sendmsg$nl_route_sched(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000007c0)=@newqdisc={0x54, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {0x9}, {0xf}, {0xe, 0xd}}, [@TCA_RATE={0x6, 0x5, {0x9, 0x1}}, @TCA_STAB={0x28, 0x8, 0x0, 0x1, [{{0x1c, 0x1a, {0x0, 0x0, 0x691, 0x0, 0x0, 0x0, 0x0, 0x2}}, {0x8, 0x1b, [0x0, 0x0]}}]}]}, 0x54}, 0x1, 0x0, 0x0, 0x8c0}, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$ieee802154(&(0x7f00000000c0), r4) sendmsg$IEEE802154_ADD_IFACE(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000040)={0x2c, r5, 0x4a3e4f761dcd662d, 0x0, 0x0, {}, [@IEEE802154_ATTR_PHY_NAME={0x9, 0x1f, 'phy0\x00'}, @IEEE802154_ATTR_DEV_NAME={0x9, 0x1, 'wpan1\x00'}]}, 0x2c}}, 0x0) r6 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}) write$tun(r3, &(0x7f00000001c0)={@val={0x0, 0x883e}, @void, @eth={@broadcast, @remote, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x88, 0x0, 0x0, 0x0, 0x2f, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @multicast1}, {0x0, 0x6558, 0x74, 0x0, @wg=@data={0x4, 0xfffffffd, 0x5865, "0ad79a9e4f9369c659e976fdd9c85f4ebaf9851dc71b5693acba138b04d91c5c832b306d90c66b58ec9d5c24008000000000000019e3506ada343c3b9955dd84945a84e0f03de6ba643d673b51bd24073dd9a89439dc902e796ec475"}}}}}}}, 0x9a) 1.472503788s ago: executing program 0 (id=2790): r0 = socket$nl_route(0x10, 0x3, 0x0) (async) r1 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000c80)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000600)=@newqdisc={0x60, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x332, 0x0, 0x2, 0x9a, 0x6, 0x101, 0x834e, 0x6, 0x6}}}}, @TCA_INGRESS_BLOCK={0x8}]}, 0x60}}, 0x0) (async) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000000c0)={0xa, 0x4, &(0x7f0000000080)=@framed={{}, [@ldst={0x2, 0x0, 0x3, 0x1, 0x0, 0x7a}]}, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xf}, 0x90) 1.297962346s ago: executing program 0 (id=2791): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000000c0)=@newtaction={0x48, 0x32, 0x1, 0x80, 0x25dfdbfe, {}, [{0x34, 0x1, [@m_vlan={0x30, 0x1, 0x0, 0x0, {{0x9, 0x3}, {0xfffffffffffffd97}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc}}}]}]}, 0x48}}, 0x0) r1 = socket(0x11, 0xa, 0x10000) sendto(r1, 0x0, 0x0, 0x0, 0x0, 0x0) (async, rerun: 64) r2 = socket(0x840000000002, 0x3, 0xff) (rerun: 64) sendmmsg$inet(r2, &(0x7f0000000280)=[{{&(0x7f00000001c0)={0x2, 0x4e20, @loopback}, 0x10, &(0x7f0000000400)=[{&(0x7f0000000240)="00000000e5c06417e58f2aaa43f325e4ae709296", 0x14}], 0x1}}, {{&(0x7f0000000040)={0x2, 0x4e21, @loopback}, 0x10, 0x0, 0x0, &(0x7f0000000440)=[@ip_tos_int={{0x14, 0x0, 0x1, 0xffff}}], 0x18}}], 0x2, 0x4896) (async) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1a, 0x4, 0x0, 0x1, 0x8000, 0x1, 0xffffffff, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x4}, 0x50) (async) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'ghash-generic\x00'}, 0x58) r4 = accept4(r3, 0x0, 0x0, 0x0) accept4$unix(r4, 0x0, 0x0, 0x0) 1.133020241s ago: executing program 0 (id=2792): r0 = socket$key(0xf, 0x3, 0x2) r1 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={0x0, 0x14}}, 0x0) getsockname$packet(r1, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) syz_emit_ethernet(0xe, &(0x7f0000000340)={@broadcast, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}, @void, {@generic={0xf7}}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="480000001000050700000086d7c0d6c878f064eb", @ANYRES32=r2, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={0x0}, 0x1, 0x0, 0x0, 0x4000001}, 0x8000) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) socket$inet6_sctp(0xa, 0x1, 0x84) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r4, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r5}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_CONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)={0x30, r4, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r5}, @void}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ibss_ssid}, @NL80211_ATTR_USE_MFP={0x8, 0x42, 0x2}]}, 0x30}, 0x1, 0x0, 0x0, 0x40010}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket(0x10, 0x3, 0x0) r9 = socket(0x10, 0x803, 0x2) syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), r9) getsockname$packet(r9, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000003c0)=0x14) sendmsg$nl_route_sched(r8, &(0x7f0000005840)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=@newqdisc={0x2c, 0x24, 0x5820a61ca228651, 0x0, 0x0, {0x0, 0x0, 0x0, r10, {0x0, 0x6}, {0xffff, 0xffff}, {0x0, 0x10}}, [@qdisc_kind_options=@q_qfg={0x8}]}, 0x2c}}, 0x0) sendmsg$nl_route_sched(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000003200)=@newtfilter={0x34, 0x28, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r10}, [@filter_kind_options=@f_basic={{0xa}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x8000}, 0x0) sendmmsg(r6, &(0x7f00000002c0), 0x40000000000009f, 0x0) sendmsg$key(r0, &(0x7f0000000040)={0xa, 0x0, &(0x7f0000000340)={&(0x7f0000000180)=ANY=[@ANYBLOB="020300090b000000000000000000000003000600000000000200000000000000000000000000000002000100000000000000fb0200000000030005000000000002000000ac1414aa0000000000000000010008000029"], 0x58}, 0x1, 0x7}, 0x0) r11 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000000400)=ANY=[@ANYBLOB="b702000003000000bfa30000000000000703000000feffff7a0af0fff9ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe00010000850000000d000000b7000000000000009500000000000000496cf2827fb43a431ca711fcd0cdfa146ec56175037958e271f60d25b7937f02c8695e5a1b24df41dc10d1e8bf076d83923dd29c034055b67dafe6c8dc3d5d78c07fa1f7e655ce34e4d5b318e2ec0e1a00897a74a0091ff110026e6d2ef831ab7ea0c34f17efd36ef3bb622003b538dfd8e012e79578e51bc53099e90fbdb2ca8eeb9c15ab3a14817ac61e4dd11183a13477bf7e060e3670ef0e789f93781965f1328d6704902cbe7bc0cb82d2789cb132b8667c21476619f28d9961b63e1a9cf6c2a660a1fe3c184b751c51160fbce841f8a97be6148ba532e6ea09c346dfebd31a08b32808b80200000000009dd27080e71113610e1019c12a73748b049604fa72c64ed858e8327ef01fb6c86adac12233f9a1fb9c2aec61ce63a3462fd50117b89a9ab359b4eea0c6e95767d42b4e54861d0227dbfd2ed8576a3f7f3deadd7130856f756436303767d2e24f29e5dad9796edb697a6e97180aabc18cae2ed4b4390af9a9ceafd07ed00b0000002cab154ad029a119ca3c972780870014601c3c975d5aec84222fff0d7216fdb0d3a0ec4be3e563112f4b39501aafe234870072858dc06e7c337642d3e5a815232f5e16c1b30c3a2a71bc85018e5ff2c910496f19afc91b47683db01a469398685211bbae0e7313bff5d4c391ddece00fc772dd6b4d4de2a41990f05ca3bde792c88c5b8dcdcc22ee17476d738992533ac2a9f5a699593f084419cae0b4183fb01c73f99857399537f5dc2acb72c7eae993fc9eb22d130665b6341da114f08cd0509d380578673fffffffd7917f23837a6b24db0e067345560942fa629fbef2461c96a08707671315c302fae29187d4f5c06a960fd37c10223fdae7ed04935c3c90d3add8eebc8619d73415e6adcda2130f5011e48455b588b90dfae158b94f50adab988dd8e12baf5cc9398c88607a08009c2977aab37d9a44cfc1c7b4000000000000fa47742f6c5b9c4b11e7d7262a1457c39495c826b956ba859ac8e3c177b91bd7d5ca1664fe2f3ced8468911806e8916dc15e21644db60c2498d5d16d7d915836ab26c169482008ef069dc42749289f854797f2f900c2a12d8c38a967c1bbe09315c29877a331bcc87dc3addb08141bdee5d27874b2f663ddeef0005b3d96c7aabf4df517d90bdc01e73835d4a3e1a9e90d76c1993e0799d4894ee7f8249dc1e342892129369ee1b85afa1a5be5f6eb2eea0d0df414b315f651c8412392191fa83ee830548f11e1038debd64cbe359454a3f2239cfe35f81b7aded448859968ff0e90500d0b07c0dd00490f167e6d5c1109681739dc33f75b20428d6474a0a91ee90b8de802c6b538622e6bbcb80f87b415263c401e64ed69a2f75409000000000000001d695c4559b82cabac3cccadc1e1c19af4e03020abf5ff0433d660f20898d2a045d009a0ffb20a77c9af2b80c05184a66d30bbea2ca45a4d6d6d1e6e79aef42355b17402a500587b603306a5af8d867d80a07f10b854b1c8c768c001496fa99ce5b5040be9194123e918914a71ad5a8521fb956dbc60f7d9719b55b3abb6bba3d113a680a8d46fe074c83fbe378a3889e8145b2eaceab05ef932c6e4f8ef0ed0d818a7b76d839cf3c6775e19f0b7e70803000000b168c38fa32e49563cfee3a7f0fc18bfa32c418cef875fb49e2989172a1bcd1e30280bc586e79a5dd8076c248e7d6e97b3ce267dd4e27b6ef206660090bb2164474cef378f97ca33fccf363361dcdba10c1547053453d0c9aec91a24079b21d52fb5516bf0c28ef37aa76442f6083dc99cd61afaf6be45d7b00d3639f2f10ac2d5c759c3e5468f5874c24411d415b6b085fb73a2d7c3852e0e658ffeb4e863428a792bee94f6cd895424360e0464f9d7ea425f2fa6aa0000000000000000532ff181c985f54b7ae20aa5e63055b4d6a36fa98a44e379d2bccf977c3e88538f406b598307c9912fb097601f3f88a2ea6fd1f9320cfe7f09aed4d1e72d26e5c7a93854c8e9f7f15f02e177ce23f43a154b42e26f037e8a01377cbd3f509e6e540c9ba9c2a589ac5d8ad67a65e9a44c576dc24452eaa9d819e2b04bdd1c000000070000000000000000000000005333c6199c12dcd92689192727a7267c47cf897853d160100b39b613faefe16bd91fc105dddd77ab929b95032d3717fa9fbdc2bdc0e98ae2c3f23a6131e2879f0484ee3bfe30b92dd493be66c2242f8184733b80ba28e824910844df31f3d4bb2f89049c5f6d63956995747639964217aacfe548fc869098aa8e07e51dbc9e2d4db3c5f79fd355222ec2a00cf7f2ccd6dd6d2dc2a815d8314221a5472f1318a9dfbec5a759579caf3262129b14e99040b5d91398e17df85c25ccae973eecc7d187168d5c9cd848d566cc1758763f0000009c927da38d83314480b15e23138c5b877a72bd4cf74a299df4fbfc8e6ea96939f15d254d9033c5a45706bda78ab602000000000000000000113a3065a478d1de98be3a66f6fbf68f2f5693050fa56db62e2f99cf916059ee364dad078fc88d17cbde37a2270f90a60afe8548f4c579b09c333382c6e7a316ac03aa23d379836b96173a5541fa96c27e7fb6d2585d828aa330f3438d8487912bb7742be1502e706644f7a937451beb7a5f6ca3ef21e8cb8f841af6d54334d82a8b816b6daccf0c66162f897623ee325d714f9f10636a7573582ff31c7f9c6f767c806ef4af486cc19a5355bdc814cb5557c6fa6404179c865980b0815b907a7f268e97828c196f5ac033d395a217b4e1e45663023a0292003c36a3b7461fc2c8566e0f3f693bfacae26aa2b7d17962989ccb943633c080aacc9b7d311c251686fc66aa80bf41a5bf6cd72d5aa995820fb318fad61a79a61d0a969fd6018ac9f131fe02fe31d565723cbf9b63841e21417fc29a3e7a03886d80566ae001861799a4aad91c72139e681ced8625b675dfbd6d458d4b2d9e6d565430248172ad942cdb41639f4113896827c8806e049218cd1eef89d6b9b14dd707da40705c07f878263ff9b71ccf28ec50178c7aac83bef7bd1045a5e4bcb6cfe05e2ac3e17c1f8f12ddf5b6770ce0da8cb3aba3a935a6b737b6d3ebf2c715dcc11c5759bd0acdecf333f2b77c52fb2251336bbd92f73ad1a30bb9162bd9d699c49d824b827f3e7c1096354946e09922db25904c83262c6dcb87457e4abefa0e9dcb17d79c173895b74aae2ed4419662690a16494e7b27d0d2688c69b4be3d21b783195f6a5e5dc5c07c73f0d0f0670db10ac9ef5b8295ff88df734e3c6ab8555c0390f962cbf559bce9c42e1034dba78997b2877b485d9d4ae2fcd3e757b84319879d0337785773c940af6e57d162f4606d101def01199325c8676a32e26303560271b720216d95e0013265a45b02bd2414bebda89b7b5e71e70e0000000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r11, 0x18000000000002a0, 0xe40, 0x10000000, &(0x7f0000000100)="b9ff03006044238cb89e14f088a81bffffff00004000632f77fbac14140be934a0a662079f4b4d2f87e5feca6aab845013f288a81a3901050b038da1880b25181aa59d943be3f4aed50ea5a6b8686731cb89ef77123c899b699eeaa8eaa0073461119663906400f30c0600000000000059b6d3296e8ca31bce1d8392078b72f24996ae17dffc2e43c8174b54b620636894aaacf28ff62616363c70a440aec4014caf28c0adc043084617d7ecf41e9d134589d46e5dfc4ca5780d38cae870b9a1df48b238190da450296b0ac01496ace23eefc9d4246dd14afbf79a2283a0bb7e1d235f3df126c3acc240d75a058f6efa6d1f5f7ff4000000000000000000", 0x0, 0xfe, 0x60000000, 0x0, 0x6}, 0x2c) 1.049859776s ago: executing program 3 (id=2793): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in=@multicast1=0xe0000002, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x87}, {0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffb}, {0xfffffffffffffffd}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}}, 0xb8}}, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000008c0)=@updpolicy={0xb8, 0x15, 0x1, 0x800000, 0x300, {{@in=@multicast1=0xe0000002, @in6=@ipv4={'\x00', '\xff\xff', @private=0xa010101}, 0x0, 0x7, 0x0, 0x0, 0xa}, {0x0, 0x0, 0x0, 0x7fffffff, 0x0, 0xfffffffffffffffc, 0x5}, {0x81}}}, 0xb8}}, 0x90) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newtaction={0x70, 0x30, 0x0, 0x870bd2d, 0x0, {0x9}, [{0x5c, 0x1, [@m_sample={0x58, 0x0, 0x0, 0x0, {{0xb}, {0x2c, 0x2, 0x0, 0x1, [@TCA_SAMPLE_RATE={0x8, 0x3, 0x5}, @TCA_SAMPLE_RATE={0x8, 0x3, 0xfff}, @TCA_SAMPLE_PARMS={0x18, 0x2, {0x0, 0x4000000, 0x5, 0x1ff}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x1}}}}]}]}, 0x70}}, 0x20048000) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_DEL_MPATH(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x34, r3, 0x1, 0x70bd29, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r4}, @void}}, [@NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @broadcast}]}, 0x34}, 0x1, 0x0, 0x0, 0x2810}, 0x24000000) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r2, 0x8933, &(0x7f0000000100)={'batadv_slave_1\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB="9000000010000305000000000000000000000700", @ANYRES32=0x0, @ANYBLOB="996e06004d4c0700540012800800010068737200480002800500030008000000050003000500000005000300fd00000008000200", @ANYRES32=r5, @ANYBLOB="08000100", @ANYRES32=r6], 0x90}, 0x1, 0x0, 0x0, 0x800}, 0x0) 777.747924ms ago: executing program 2 (id=2794): r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r0, 0x107, 0x8, &(0x7f00000000c0)=0x2, 0xfffffffffffffe86) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(aes-generic)\x00'}, 0x58) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000004c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01010000000000000000020000000900010073797a300000000040000000030a09020000000000000000020000000900010073797a30000000000900030073797a3200000000140004800800014000000000080002400000000014000000110001"], 0x88}}, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000b00)={&(0x7f0000000b80)={{0x14}, [@NFT_MSG_DELCHAIN={0x30, 0x5, 0xa, 0x401, 0x0, 0x0, {0x2, 0x0, 0x4}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}, @NFTA_CHAIN_HOOK={0x4}]}], {0x14}}, 0x58}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x13, 0xe, 0x0, 0x0}, 0x94) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x14, 0x4, 0x4, 0x3}, 0x48) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000100)={r3, &(0x7f0000000080)}, 0x20) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000480)="b19ccccf84f531d9ec214627c11430c1", 0x18) setsockopt$packet_tx_ring(r0, 0x107, 0x5, &(0x7f0000000080)=@req3={0x48000, 0x6, 0x300, 0xfc}, 0x1c) syz_genetlink_get_family_id$nl802154(&(0x7f0000000e00), 0xffffffffffffffff) 669.043074ms ago: executing program 3 (id=2795): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x275a, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0x13, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000007200000018010000202070250000000080"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=ANY=[@ANYBLOB="2000000076000104000000000002000000000000", @ANYRES32=0x0, @ANYBLOB="080001"], 0x20}}, 0x0) socket$packet(0x11, 0xa, 0x300) unshare(0x22020600) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000000c0)={0xe, 0x4, &(0x7f0000000180)=ANY=[@ANYBLOB="18020000801000000000000004000000850000008b00000095"], &(0x7f0000000000)='GPL\x00'}, 0x90) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="02000000040000000400000009"], 0x48) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="0d000000069a0000040000000100000000000000869807947e71689d9e0ecb2f0ae7bf045f05f308f9ce1cd11d58212ff41dbdd9f7428702786081493b94dcf7b076983820efa78e19b8ccdd5c8892d1b96ae71989edd2dbaf8a6a853ce1fc8359a9fe8b2506d3af86426d5357138153405e66d1669d838a84cc76b13a98f925f77b4194f1cd43d2fecff8abd67eb0efa417c01ca845d52af5076075fd0fd703ed130a0bc947c72e4be3889c8db89f45ea542a227e2dd036e084e107808e051444f70bc663a6a83912d2179afb39ebef67fd3e3f5f6c66c2123fbd8c4599bc0338db28a307cdf3cb50705914014823b63c75ebd60b5ceb6dec7da13363ff3e9aa56055d185333b", @ANYRES32=r2, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000380)={{r3}, &(0x7f0000000300), &(0x7f0000000340)=r2, 0x1000000}, 0x20) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000001c0)={0x10, 0x4, &(0x7f0000001300)=ANY=[@ANYBLOB="1800000000000000000000000000000071103500000000009500000000000000"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x9}, 0x80) r4 = socket$inet6(0xa, 0x800000000000002, 0x0) r5 = socket$inet6_sctp(0xa, 0x1, 0x84) sendto$inet6(r5, &(0x7f0000847fff)='X', 0x34000, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) shutdown(r5, 0x2) setsockopt$inet_sctp6_SCTP_RESET_ASSOC(r5, 0x84, 0x78, &(0x7f0000000140), 0x4) setsockopt$sock_linger(r4, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={0x0}, 0x1, 0x0, 0x0, 0x4000811}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000001c80)=@newtaction={0x6c, 0x30, 0x871a15abc695fb3d, 0x0, 0x80000, {}, [{0x58, 0x1, [@m_vlan={0x54, 0x1, 0x0, 0x0, {{0x9}, {0x28, 0x2, 0x0, 0x1, [@TCA_VLAN_PUSH_VLAN_ID={0x6, 0x3, 0x7ea}, @TCA_VLAN_PARMS={0x1c, 0x2, {{0xfffff800, 0x40, 0x1, 0x3, 0x80000001}, 0x2}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x1, 0x3}}}}]}]}, 0x6c}, 0x1, 0x0, 0x0, 0x4000044}, 0x0) sendmmsg(r6, &(0x7f00000002c0), 0x40000000000009f, 0x0) sendto$inet6(r4, 0x0, 0x0, 0x4c881, &(0x7f0000000540)={0xa, 0x4e24, 0x0, @mcast2}, 0x1c) r7 = socket(0x25, 0x1, 0x0) sendmsg$nl_route_sched(r7, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000340)=@newqdisc={0x24, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {0xffff, 0xffff}}}, 0x24}}, 0x0) sendmmsg$inet6(r4, &(0x7f0000005440)=[{{0x0, 0x0, &(0x7f0000000080)=[{&(0x7f00000000c0)='+', 0x1}], 0x1}}], 0x1, 0x400c404) sendmmsg$inet6(r4, &(0x7f0000003640)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4040005) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000009, 0x12, r0, 0x86b2d000) r8 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$SO_TIMESTAMPING(r8, 0x1, 0x25, &(0x7f0000000140)=0x10cc, 0x4) 651.891131ms ago: executing program 2 (id=2796): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000000000000000000400000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) socket$nl_route(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_attach_bpf(r3, 0x1, 0x4c, &(0x7f0000000000), 0x4) sendmsg$inet(r2, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) recvmsg$unix(r3, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000300)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x2000) socket$tipc(0x1e, 0x2, 0x0) socket(0x27, 0x80000, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f00000003c0), 0x0, 0x0) socket$nl_sock_diag(0x10, 0x3, 0x4) r5 = socket$nl_generic(0x10, 0x3, 0x10) syz_emit_ethernet(0x7a, &(0x7f00000002c0)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaaaa86dd6002173600442b00fc0206000000000000000000000000010420880b0000000000000800000086dd"], 0x0) r6 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r6, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000002c0)=ANY=[@ANYBLOB="3800000056000100000000000000000007020000", @ANYRES32=r5, @ANYBLOB="200001"], 0x38}}, 0x40004010) r7 = syz_genetlink_get_family_id$ethtool(&(0x7f00000002c0), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="01000000ddffffffffff2b00000018000180140002007665746830"], 0x2c}}, 0x0) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r8, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$IPCTNL_MSG_TIMEOUT_GET(r0, &(0x7f0000001540)={&(0x7f0000001480)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000001500)={&(0x7f00000014c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00'], 0x14}, 0x1, 0x0, 0x0, 0x842}, 0x804) sendmsg$NFT_BATCH(r8, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000002100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a5c000000090a010400000000000000000a0000040900010073797a310000000008000540000000040900020073797a310000000008000a40fffffffc200011800e000100636f6e6e6c696d69740000000c00028008000140fffff27414000000110001"], 0x84}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$NFT_MSG_GETSETELEM(r8, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[@ANYBLOB="30000f8499923cbdce9e4b888bd300000d0a011e00000000000000000a000001040003800900010073797a31000000000900020073797a3200000000"], 0x30}, 0x1, 0x0, 0x0, 0x240408c1}, 0x8000) syz_emit_ethernet(0x276, &(0x7f0000001880)=ANY=[@ANYBLOB="aaaaaaaaaabb5cdd1a22a6fa8100100086dd61ec223c023c110100000000000000000000000000000000fe8000000000000000000000000000aa0014040a0508e4000000000000000000000000000000000000000000000000000000ffff64010100fe8000000000000000000000000000bb0000000000000000000000000000000100000000000000000000000000000000fe8000000000000000000000000000330c81000000000000000000000000000bfe800000000000000000030000000041fe800000000000000000000000000035fe80000000000000000000000000000f11080404f7080500fe8000000000000000000000000000bbfe8000000000000000000000000000bb00000000000000000000ffffe000000120010000000000000000000000000002160404020120080000000000000000000000000000000000ff0200000000000000000000000000016702000000000000000100010600000000000000010005020009000000000000320c0406096802000000000000000000000000000000000120010000000000000000000000000001fc000000000000000000000000000000ff020000000000000000000000000001fe8000000000000000000000000000aafc0200000000000000000000000000014e224e23009c907801000000040000000a1acdb1f4a13134eb3e6ed1022b0697b7ec6a452bce297c2e5782931d8edc0f91640c758705dababb0b8a4d53ca9820ac4ebfdba7c27bff44deecb40afd8d0ae0a2651aaaebd95ca972872c76fdf5366af78f89c033604e78c03b4b809494b386705fad41c8efed4c99a2957ffb89f04dd6e6aef4c45fa2260ce28d07d03710392a7b661dc30008c9d1b6f9"], &(0x7f0000000080)={0x1, 0x1, [0x276, 0x805, 0xf65, 0xd4b]}) bpf$PROG_LOAD(0x5, &(0x7f0000001580)={0x3, 0xe, &(0x7f0000002180)=ANY=[@ANYBLOB="b700000034000000bca30000000000002403000040feffff720af0ff0000000071a4f0ff000000001f030000000000002e0a0200000000002600000000ff000e61145b00000000001d430000000000007a0a00fe00581c1f6114140000000000b503f7fff80000009500000000000000033bc065b78111c6dfa041b63af4a3912435f1a864a7aad58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a7168e5181554a090f30002af51efd601b6bf01c8e8b1fee5bef7af9aa0d7d600c095199fe3ff3128e599b0eaebbdbd732c9cc00eec363e4a8f6456e2cc21557c0afc646cb7798b3e6440c2fbdb00a3e35208b0bb0d2cd829e65440000000000000000028610643a98d9ec21ead2ed51b104d4d91af25b845b9f7d08d123deda88c658d42ecbf28bf7076c15b463bebc72f526dd70252e79166d858fcd0e06dd31af9612fa402d0b11008e59a5923906f88b53987ad1714e72ba7d06a59ff616236fd9aa58f0177184b6a89adaf17b0a6041bdef728f5089048ddff6da40f9411fe7226a40409d6e37c4f46756d31cb467600ade70063e5291569b33d21dae356e1c51f03a801be8189679a16da18ec0ae564162a27afea62d84f3a10076443d643649393bf52d2105bd901128c7e0ec82701c8204a1deeed4155617572652d950ad31928b0b036dc2869f478341d02d0f5ad94b081fcd507acb4b9c67382f13d000000225d85ae49cee383dc5049076b98fb6853ab39a21514da60d2ae20cfb91d6a49964757cdf538f9ce2bdbb9893a5de817101ab062cd54e67051d355d84ce97bb0c6b6a595e487a2cc47c0efbb2d71cde2c10f0bc6980fe78683ac5c0c31032599dd273863be9261eee52216d009f4c52048ef8c126aeef5f510a8f1aded94a129e4aec6e8d9ab06faffc3a15d91c2ea3e2e04cfe031b287539d0540059fe6c7fe7cd8697502c7596566de74e425da5e7f009602a9f61d3804b3e0a1053abdc31282dfb15eb6841bb64a1b3045024a982f3c48b936e6f9e0fcda88fe4413537528fdb6153baae244e7bf573eac34b781337ad5901a4cad2422ee965a38f7defbd2960242b104e20dc2d9b0c35608d402ccdd9069bd50b994fda7a9de44022a579dfc0229cc0dc98816106dec28eaeb883418f562ae00003ea96d10f172c0374d6eed826416050000000bfe9b4a9c5a90ff59d54d1f92ecc48899b212c55318294270a1ad10c80fef7c24d47afcc829ba0f85da6d888f18ea40ab959f6074ab2a40d85d1501783a7ab51380d7b4ead35a385e0b4a26b602396df7e0c1e02b88c114f244a9bf93f04bf072f0861f5c0b000000000000eedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba3401e6a52acb1188883ad2a3b1832371fe5bc621426d1ed01b389708165b9cdbae2ed9dc7358f0ebadde0b727f27feeb7464dcc536cbae2f5c7d951680f6f2f9a6a8346962a350845ffa0d82884f79adc287906943408e6df3c391e97ba48db0a5adbfd03aac93df8866fb010ae20e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00000000c95265b2bd83d648532869d701723fedcbada1ee7baa19faf67256b56a41fd355b6a686b50f0937f778af083e055f6138a757ebd0ed91124a6b244f9acf41ac5d73a008364e0606a594817031fc2654026c6ea08b83b123145ab5703dad844ceb201efeb6dc5f6a9037d2283c42efc54dd84323afc4c10eff46248843187f1dd48ef0900000000000000ff0f4000000000f00700003c17888e1cdba94a6ea80c33ead5722c3293a493f1479531dd88261458f40d31fe8df15efaaeea831555877f9538c6ee6ba65893ff1f908ba7554ba583ec7932f5954f31a878e2fae6691d1aee1da02ba516467df3e7d1daac43738612e4fee18a22da19fcdb4c1011e32f808890205f0e6da2819d2f9e77c7c64affa54fec0136cbafa5f62e96753b639a924599c1f69219927ea5301fff0a6063d427180d61542c2571f983e96635600000554f327a3535e7c7542799493c31ac05a7b57f03ca91a01ba2a30ca99e969d6fd09dc28ebc15edb4d91675767999d146aef7799738b292fd64bbca48568325b2969e2b15f36b788bce5ccdbaf75c94cb93499f6947a967a794963442aece449a0d80010f5c653d22d49030a8c2a4ab595bf4238f18ca428dafc7ac96d404607a0000000051a2104f22e6db5a62b5089c1b45282d38864daa3ae81d6b0968d1d2869291b7d12096833d6864da40b54783a17aaeb6737c323f9f98e354cc98dcfe23ad01bd1c61563e69ffe1c2c73e16e637d4219ef7ec61261173f359e93d2c5e424c17998809ec8f0232b3955e052a4cecd89008f70314a0bdd491ecab5d232f89fe0120f64c62e8e3ed8bcb45202c204bbec8d722824c0ebca8db1ea4a05e41f6016ab5bbe4fe7ff5d785d0128171c90d9900ca2532b0f9d01c4b45294fbba468df3e1b393cb4e62e753b4172ba7ac1f2b51c94bc5d047899fd219f448bf9189c65c9d91eda6b52a373803a9efe44f86909bc90addbc4b3093c91b8068c5adfcb0d7fd849904568916694d461b76a58d88cf0f520310a1e9fdc18cde98d662eee077515d0a881192292ffff5392ab3d1311b82432662806add87047f601fa888400000000000000000000000000006acc19808d7cf29bc974b0ea92499a41b9b9a7c2bca311a28ee4952f2d325a56397c78f12205db653a536f0100e0eda300a43a13bd1b9f3322405d1efd78e578dc6b3fb84f3738a4b6caa800000087efa51c5d95ecba4e50e529d1e8c89600e809dc3d0a2f65579e23457949a50f2d0455cf699b3746979f99f6a1527f004f37e84fb478199dc1020f4beb98b8074bf7df8b5e783637daf121f175a81cffff4ac55a4385e9a617aa6c8e10d4202c5afeb06e2f9115558ea12f92d7ae543d44086b3f03b20d546fa66a72e38207c9d20035abc46271a30f1240de52536941242d23896ab74a3c6670fdc49c14f34fc4eadd6db8d80aba439772bf60a1db18c472dafc5569adc2c406f39f82928d2a1ffe29f1a57d3f18f4edaeb5d37918e6fddcd821da67a0785585a4443440dc65600e64a4a274000000000000000000000000000000000000000000000009dd14b38f2f5426d7cf5075047c31f6ce6adddfe3ac649c0643c8bfbeb14ba1fd7a485aa893915cf81e29aaf375e904bbe52691a4120260ffcd030000006d291ebcef893e1b9ccb6797d0646fe0e7274434f28efb43e06e64f0698caca42f4e6018a455736c482a017e2b13dac4a90faa109f0e87cc94e3efb649692456463ca74aa6ad4bf50c1acb3928143be1c1023a375e528285544d0064b98646f3109e9a4942ce42c6e7ec84b664f6c2770803f10b0a1fcbfc309381aeba191950bae71f37f1eb7ceeffb3c0547ac6571603adbfde4c8b5f8d7f4b854441613633b48865b65bdc415e1e0dcf672d68cf4cebf04f4bc1eebf560a26d3b332240d450fdb0a9a69f432e277f3a0386eb2bd1305c821c64757f786b79fef54dbe64c67d73934bc80b2133fb3c04cc7ea48bf97a6243c9f95dcbddecf45f008f1822c7868e1ff5a3cff5d6b6898335792749df7b1f51e91f8c1c3b1b93b33aaa3fab69cef08a9f6f6cf39dea3d878b2ed42545421970cc426e644332bc956d1c6adefdf0ede2c5c94aa632646ae225accdf031f611d01622921f1b922a5ac887cca3136133dce8d9f5f4da7bed2ea5d94362200000000000000000000f296b0c1484e5f781ad26bff696b05ff0a5e2270e07e18b04273bd4075ea38ab463bfa6a38e7c537498ba3e4df8dfc9e8c0a0d213c3ffad44d2a376def42e41e9fc3167a257e040fa7cf32c221aaac6cfdeb33c27500001a0000000000000000000017350000c11ae694b0c69c2c03f6790044a357e785af6e153d5f1ea460af92c7cbbd6295afe740f5e154346d483e0d10522a7a945b93fb705b95b6aae27a8fab1e6984c8bdc12360627137ab6737b68ab08a1a4b94cb29a74dc36b51209cfbc87f61182bbeb2772e9d5a1ffc477179be481ffe46a4ce86be0b1f8eee42a611a3d44ca450b14586ed63dd92005c79e4a8ab8a94f0b74903580ac98708007c80d6c7d0de4614195e40d797c0348dd70f36a220e8b3710fb5358c27e90793bcb9ee6319342c4b239ca8cbc6fc83d32e6eb62ad92e43991f2447be9c2a1ae1119eafb901a43d57e885116d19aa152bfb89f8d0b2516f80120a1cddff771657f3d0288ec3899f1e3ba0151c4037148fb479de703fc52b6573349c28d1b107d859b4961324c17756dde99de1924a1d2b7095d34a55060f47f4407d89acf9f1d2156befec432e8e993c79027b7ef285b20c2e6b3d0491d0d3591b0d94713332b6b79c8297117b0d14eff64e0aca8a4b4aa773d8fba1217e9519952419bb9dd998d0ec870ff00b6d556018602738fbc6cec89d6dd13cf55b96f6fe9a137d2d6a56ad78e52c23ed080000000000002bc261a781fd14126c146a0aac4221839a4b9bbf61e4bba695a41e2109eba8e40c370267cc51ffadbd15cafc97a4d3edfdcb9b5729307c6bdaf7b69325fb05fa8a9869de0600ee477d71bf3e36d1d9019edfa27aae24b632f251df210c86a18fae731ecb8b0d48357378caf2b6789509b1bacfd4fa812dc341875cfa5e798bbf59770000000000000000c8a594ea3c3347962d9113b1fecdfad5a8da641053f02e49456f5d21674521e67a5b18ea451eccf69dd6af928d2d68da9304a296c22fdc0500000000000000b1aade386b113045033a6188d56e675564d8cb8d5b40114b0f5bf15dd64c9ece60b8588ee8777d0ea8f4713b258427c7d90f9e93348e17723ba9ab8ae790f74cc41ae5795835f3cec40dff485d2802c08611454d9ea784a205bcc07ec26f906f3cf45bb37014ab6f22af6213618e242b283ea9d3f0677ee598072ec06f7170009d92bb87d9d12c378dfd3e74ec056ee83eef666423d934fc5908c9ff98715218a5964f1e00000000426ac9588e27aefe307f49662990ee823568bbc2f89596ced7c6c52d76b8096f1848410843b93fd404f535be474f456778b5ef85abb8fc2336abd5ea64a6efea8a5aca0015499b88ae780a7bae4df603bd3c72808cf300440b1b638a6640f7de8d0d82f359ca2f779cd48cd8d3603f4f69e47f386988c9b7b5d6dd3d48a1fdca780049d7c87bea42161a4c0d7cf0125b43dc9d8845f3c05a08acda647e7143d0e0aee2949a45e28488b0522c2288072467d2afe269f589fb7e034b92d3ca245b16b71998711bfe206c9690b6d0eebb06a29349229eb45ff15c63aa2c82c56d7420738cd1b04eb16e87cb524315d7361ea3635d3799bb7fcc56aa5e1dbe031a7a12554dee6754b72f43a6fddf427f32ec3df274a88097725679769beebf1aa6eb09d5154e4900000000000d0f7160a05911d969879953d3d4702b2676c07bb0fd14020a66718378825d5ed789711b77d40dc31e0b8fc651b45559da463f0000000000000000000000000052d42124e9c26aba885015e69d42ecd710342ac597ebea576ae15fdf611356f622e831741ab15549e0d7a2bd0324e2b3b48a10551607492c19eaf58485feb4cab19c303b30ba2ddea0d792d77724c9fa4ed58b93668fc20484f141ee2b6a0029e88fdc853189b4dafd36ff23b11967090e508f45e3f10857038a52ef275cf9e3e4b5d30b12d138dfa70930c603b5e3f4b7be67be3dba3cbd8d4d143195af0697d779445d67dcfbd922d12a8b49f93eac7a72faacf80346b3b669615f2710eb8df39fc8c04d2c9c196fa6facfea613569a35cde6451f2edf55ce25c7d72ec7ea85a92458c0559ca3a94727d495bd4671a55a70bc544d71d8e0257707a31936f1adf224077310a86bf447ec92c650acca8c6b0721020894b06178c32f4472d17174d6eb2b067030c5d2c12583f46d2da7fba42d4083259c7cdc8bf1f4299c248865d3c809356c3ed", @ANYRES32=r4], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f00000000c0), 0x10}, 0x94) r9 = syz_genetlink_get_family_id$mptcp(&(0x7f0000001300), r1) sendmsg$MPTCP_PM_CMD_GET_LIMITS(r1, &(0x7f00000013c0)={&(0x7f00000012c0)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000001380)={&(0x7f0000001340)=ANY=[@ANYBLOB='\x00\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="00042cbd7000fbdbdf25060000000800020006000000"], 0x1c}}, 0x4) sendmsg$NFT_BATCH(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000500)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a68000000060a0b040000000000000000020000003c000480380001800b000100746172676574000028000280090001004d41524b0000000008000240000000020d000300a1784b8550b226ffffffff000900010073797a30000900020073797a3200000000140000001100010000000000160000000000000a000000"], 0x90}}, 0x0) 573.950608ms ago: executing program 0 (id=2797): r0 = socket$pppoe(0x18, 0x1, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) getsockopt$sock_buf(r1, 0x1, 0x1c, 0x0, &(0x7f00000005c0)) connect$pppoe(r0, &(0x7f0000000040)={0x18, 0x0, {0x3, @random="00ff00", 'bond0\x00'}}, 0x1e) r2 = socket$netlink(0x10, 0x3, 0x9) ioctl$sock_SIOCETHTOOL(r2, 0x8946, &(0x7f0000001380)={'veth0\x00', &(0x7f0000001340)=@ethtool_cmd={0x9, 0x1ff, 0xffff38ce, 0x5, 0x9, 0x7f, 0x2, 0x3, 0x3, 0x3, 0x9, 0x2, 0x6, 0xb4, 0x3, 0x6, [0x9, 0x1]}}) r3 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r3, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000340)={&(0x7f0000000140)={0x2, 0x2, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, [@sadb_address={0x3, 0x6, 0x0, 0x0, 0x0, @in={0x2, 0x0, @broadcast}}, @sadb_sa={0x2, 0x1, 0x0, 0x0, 0x0, 0x0, 0xfe}, @sadb_address={0x3, 0x5, 0x0, 0x0, 0x0, @in={0x2, 0x0, @local}}]}, 0x50}, 0x1, 0x7}, 0x0) sendmmsg(r0, &(0x7f0000002340)=[{{0x0, 0x0, 0x0}}], 0x3e8, 0x0) r4 = socket(0x400000000010, 0x3, 0x0) r5 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0x25dfdbfd, {0x0, 0x0, 0x0, r6, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x1, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x28}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r4, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000140)=@newtfilter={0x3c, 0x2c, 0xd27, 0x70bd28, 0x25dfdbfe, {0x0, 0x0, 0x0, r6, {0xd, 0xffe0}, {}, {0xa, 0xfff3}}, [@filter_kind_options=@f_flower={{0xb}, {0xc, 0x2, [@TCA_FLOWER_FLAGS={0x8, 0x16, 0x16}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x22044028}, 0x40040) connect$l2tp(r4, &(0x7f00000000c0)={0x2, 0x0, @rand_addr=0x64010102, 0x2}, 0x10) getsockopt$IP_VS_SO_GET_TIMEOUT(r0, 0x0, 0x486, &(0x7f0000000000), &(0x7f0000000080)=0xc) 339.116142ms ago: executing program 2 (id=2798): r0 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)=ANY=[@ANYBLOB="540000001400b595010000000000003b00000000", @ANYRES32, @ANYBLOB="140001000040000000000000000000000000000014000200fe8000000000000000000000000000aa140006"], 0x54}, 0x1, 0x0, 0x0, 0x800}, 0x20000080) sendmsg$TIPC_NL_LINK_SET(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000140)=ANY=[], 0x50}}, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x0) 204.519734ms ago: executing program 2 (id=2799): r0 = socket$kcm(0x11, 0x3, 0x0) sendmsg$kcm(r0, &(0x7f0000000200)={&(0x7f0000000100)=@phonet={0x23, 0x0, 0x0, 0x3a}, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000340)="27050200d40f00000600de2e0000", 0xe}], 0x1}, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=@newtaction={0x5c, 0x30, 0x1, 0x0, 0x0, {}, [{0x48, 0x1, [@m_ct={0x44, 0x1, 0x0, 0x0, {{0x7}, {0x1c, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0x0, 0x0, 0x20000000}}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x5c}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="5c0000001000030500"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000340012800e00010069703665727370616e0000002000028006000200300000001400060000000000000000000000ffff7f00000108000a00", @ANYRESOCT], 0x5c}}, 0x0) 1.197113ms ago: executing program 0 (id=2800): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000010000000900010073797a300000000040000000160a01020000000000000000010000000900010073797a30000000000900020073797a3000000000140003800800024000000000080001400000000040000000160a01010000000000000000010000000900020073797a30000000000900010073797a30000000001400038008000240000000ab040001"], 0xc8}}, 0x0) r1 = socket$inet_sctp(0x2, 0x400000000001, 0x84) sendto$inet(r1, &(0x7f0000000800)='u', 0x1, 0x801, &(0x7f0000000040)={0x2, 0x4e23, @private=0xa010100}, 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0xb, 0x4, &(0x7f0000000400)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x69, 0x10, 0x5d}, [@ldst={0x4}]}, &(0x7f0000000080)='GPL\x00', 0x2, 0x3f7, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0xfffffffffffffe1b, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xfffffffffffffd81}, 0x48) listen(r1, 0xda8c) r2 = accept4(r1, &(0x7f0000000340)=@nfc, 0x0, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000000)=@newlink={0x78, 0x10, 0x503, 0x70bd29, 0x1000000, {0x0, 0x0, 0x0, 0x0, 0x0, 0x6230}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x10}}}, @IFLA_LINKINFO={0x38, 0x12, 0x0, 0x1, @ip6gre={{0xb}, {0x28, 0x2, 0x0, 0x1, [@IFLA_GRE_IKEY={0x8, 0x4, 0xffffffff}, @IFLA_GRE_ERSPAN_HWID={0x6, 0x18, 0x7fff}, @IFLA_GRE_COLLECT_METADATA={0x4}, @IFLA_GRE_FWMARK={0x8}, @IFLA_GRE_OFLAGS={0x6, 0x3, 0x758}]}}}]}, 0xe}}, 0x4011) r4 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000580)={0x11, 0xf, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b702000014000000b7030000010000008500000083000000bf0900000000000055090100000000009500000000000000bf91000000000000b7020000000000008500000084000000b70000000000000095"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000140)='kmem_cache_free\x00', r5}, 0x10) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = bpf$MAP_CREATE(0x0, &(0x7f0000000c40)=ANY=[@ANYBLOB="0f000000040000000400000012"], 0x48) r9 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0xe, 0x4, &(0x7f0000000400)=ANY=[@ANYBLOB="18020000801000000000000004000000850000002700000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00}, 0x80) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x44, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r10 = socket$netlink(0x10, 0x3, 0x10) r11 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RATE_NEW(r10, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)={0x34, r11, 0x1, 0x0, 0x25dfdbfb, {0x25}, [@handle=@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}]}, 0x34}, 0x1, 0x0, 0x0, 0x41}, 0x8000) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="01000000120000007f00000001"], 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) bpf$MAP_GET_NEXT_KEY(0x4, 0x0, 0x0) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000900)=ANY=[@ANYRES32=r8, @ANYRES32=r9, @ANYBLOB="05"], 0x10) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000740)={{r8}, &(0x7f00000006c0), &(0x7f0000000700)=r7}, 0x20) sendmsg$inet(r6, &(0x7f0000000440)={0x0, 0x0, 0x0}, 0x4040086) getsockopt$PNPIPE_IFINDEX(r2, 0x113, 0x2, &(0x7f0000000080)=0x0, &(0x7f00000000c0)=0x4) ioctl$sock_SIOCETHTOOL(r2, 0x8946, &(0x7f0000000700)={'tunl0\x00', &(0x7f0000000840)=@ethtool_per_queue_op={0x4b, 0xe, [0x6, 0x9, 0xff, 0x4, 0x1ff, 0x7, 0x3, 0x8, 0x7fffffff, 0xa, 0x9, 0x5, 0x7, 0x4, 0xffffff00, 0x4448, 0x7, 0x1, 0x8890, 0x6, 0xe, 0x6, 0x951, 0xe840, 0xfffffffb, 0x0, 0x93fd, 0x5, 0x8, 0x9, 0x7e3d, 0xf15, 0x1, 0x2, 0x9, 0x5, 0x561, 0xb3de, 0xfffffffe, 0x3, 0x5, 0x7, 0x5, 0x4, 0x7, 0x5, 0xa, 0x3ff, 0x4, 0x1, 0xd, 0x4b5, 0x2, 0x2, 0x1, 0x4, 0x7, 0x4, 0x6, 0xcad1, 0x5, 0x4, 0x5, 0x9, 0x9f, 0xd, 0x6, 0x8, 0xfffffffe, 0x9, 0x58c, 0x1812, 0xaf2, 0x1, 0x4, 0x0, 0x7fffffff, 0x40, 0x2, 0x6, 0x4, 0x7, 0x6, 0x1, 0x1, 0x3, 0x3, 0x43d, 0x9, 0x2, 0xfff, 0x4, 0x4, 0x6, 0x2, 0x4a80, 0x8, 0x80000, 0x2b21, 0x4c, 0x2, 0xfffffeff, 0xd, 0x7fffffff, 0xffffffff, 0x5, 0x1, 0x2, 0x8, 0x49, 0x2, 0x9, 0x800, 0x3, 0x9, 0x9, 0x5, 0x6, 0xd, 0x0, 0x3, 0x180000, 0x3, 0xffff, 0x9, 0x0, 0x8, 0x3], "b31cf7e734c104357d3562e1f20d6e08a6609e85ee1dfaa07948ac14a0d3ab4bd2cceb403b459cff3225e3bad77e0a921bcb20a2bea77f7339ba2015a029e39e2391835cf98c08865e8fde4e4270c39f7102"}}) sendmsg$sock(r1, &(0x7f00000006c0)={&(0x7f0000000100)=@ll={0x11, 0x16, r12, 0x1, 0x3, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x30}}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000180)="1341120886f3652fdd0df7d84103818891638ef93ba9568338ded58d2f5dcd020586ce84fba688d56e608dd5ff03400f37f32de4eaf2b7533e617a9a5a3c57d0fadd4881f71d61d9c92a80447b21c4dce3570d24f71ded53fc92321393b39b9909cc07c4cd", 0x65}, {&(0x7f00000003c0)="8b5836dfe5609bf774a0e9ad564c7d5a6b52654e9abd633143755bbac0fcc678982da79c2db41dd77f74bb378d421d7bcb283b34ebcd6f62d23ca3175004e0acb354fb50291e4e8e398c546cc64c57735cf2589b0c319b2d85ac535e494b7a44bf6f452fdbf213b8f9c68573cc898dc156786fa6ec7ef24d3d37fab88df9525fb30dbbad1c4540fbb880a0c410471c2d6f9d345b1be4462a2138c0e4f6c6a6be94dc6dde35c7a8e7f3f077369ce8c4939b5222fe82daba5c19cca7f681ec10216f4999642a4f0909d8fd2af6771b2adf30347c008f1b2cb6d4d28e", 0xdb}, {&(0x7f0000000200)="0c1d00224ad72f903db443888c146453040832421fc74960e77f98852023a53653016b573915454e", 0x28}, {&(0x7f00000002c0)="0ea0ae013ebd1dcbaa9b724e0a46d9102d3b0af0c7202ff9365c8ae8527de71add0a0df475201e775ab04983ee2a1f45d2478df056599dcc5d506b9d6fdf18c817e8b9", 0x43}, {&(0x7f0000000240)="034898e58392deba4e05d36480ff4632d3ab5aa62a7f8f2c5c61ce4575cedc946403c9f454b865b96189c51ace1830eb6cc0cd9a0e0694e582dcb79a7cca", 0x3e}, {&(0x7f00000004c0)="ec0c741de21c70bd37e5b448c6cae265febb315b12b0e95e82275f81086e3f0f9e5531daf108de6c4b6a0b7650731662e22b55b543e997e028bef34e531f96fce3254f62bb778e85e437daa594852553806843e14a1daa079ca488cc760964b1d76a3bc854fbf550f655911307ca83e215291a60cbcbe979e3267f5cccfbba8ce041e468731251cc2112929c5489132c7e58809b768e1a7ecd3d1225fca71b5e9074d0b7c6", 0xa5}], 0x6, &(0x7f0000000600)=[@mark={{0x14, 0x1, 0x24, 0x60e}}, @txtime={{0x18, 0x1, 0x3d, 0x6}}, @timestamping={{0x14, 0x1, 0x25, 0x1c5}}, @timestamping={{0x14, 0x1, 0x25, 0x2}}, @mark={{0x14, 0x1, 0x24, 0x3}}, @mark={{0x14, 0x1, 0x24, 0x1}}], 0x90}, 0x20000000) 0s ago: executing program 2 (id=2801): ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) setsockopt$inet_int(0xffffffffffffffff, 0x0, 0x18, &(0x7f0000000080)=0x5, 0x4) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000007c0)={0x18, 0x14, &(0x7f0000000880)=ANY=[@ANYBLOB="1800000006000000000000000d0000008520000005000000180100002020782500000000002020207b1af8ff00000000bfa100000007010000f8ffffffb702000008000000b70300000200000085000000060000001811000000000016c5b948b06140a058a22277521a26cefedf4f374b17a87c50d1a2f59ccb38e080e664385a1d1f65a4f6cd76db8ed2f0d25ebebb16f6504c0e44fd23fc5afdc9844f9500a9fa9d7c75d7192d6fec43f2ec7c165d8309e44b", @ANYRES32=0x1, @ANYBLOB="0000000000000000b7020000000000008500000086000000"], 0x0, 0x7fff, 0x0, 0x0, 0x41000, 0x13, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f00000004c0)={0x4, 0xd, 0xfffff469}, 0x10, 0x0, 0x0, 0x0, &(0x7f0000000200)=[0x1, 0xffffffffffffffff, 0xffffffffffffffff], &(0x7f00000005c0), 0x10, 0x3fd}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000740)={&(0x7f0000000240)='bcache_invalidate\x00', r0, 0x0, 0x3}, 0x18) r1 = socket$inet_mptcp(0x2, 0x1, 0x106) listen(r1, 0x0) socket$can_bcm(0x1d, 0x2, 0x2) poll(&(0x7f0000000180)=[{r1, 0x224}], 0x1, 0x11ff) shutdown(r1, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_CIPSOV4_C_ADD(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000006040)=ANY=[@ANYRES16, @ANYRESOCT=r1], 0x174}}, 0x0) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x12, 0xffffffffffffffff, 0xbdd94000) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f00000001c0)={0x1, &(0x7f0000000040)=[{0x6}]}, 0x10) r2 = syz_init_net_socket$x25(0x9, 0x5, 0x0) r3 = syz_init_net_socket$x25(0x9, 0x5, 0x0) bind$x25(r3, &(0x7f0000000780), 0x12) bind$x25(r2, &(0x7f0000000080), 0x12) r4 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r4, 0x8914, &(0x7f0000000700)={'bond0\x00'}) kernel console output (not intermixed with test programs): ][ T7950] netlink: 'syz.1.511': attribute type 10 has an invalid length. [ 140.836936][ T7950] bridge0: port 2(bridge_slave_1) entered disabled state [ 140.891835][ T7950] bridge_slave_1: left allmulticast mode [ 140.910983][ T7950] bridge_slave_1: left promiscuous mode [ 140.952490][ T7950] bridge0: port 2(bridge_slave_1) entered disabled state [ 141.264733][ T7950] bridge_slave_1: entered promiscuous mode [ 141.271575][ T7950] bond0: (slave bridge_slave_1): Enslaving as an active interface with an up link [ 141.507549][ T7977] netlink: 28 bytes leftover after parsing attributes in process `syz.4.517'. [ 141.570117][ T7978] openvswitch: netlink: IPv4 tun info is not correct [ 142.108534][ T7996] netlink: 28 bytes leftover after parsing attributes in process `syz.2.522'. [ 142.393495][ T7999] veth0_to_team: entered promiscuous mode [ 142.401066][ T7999] veth0_to_team: entered allmulticast mode [ 142.726040][ T8029] netlink: 804 bytes leftover after parsing attributes in process `syz.4.529'. [ 142.738469][ T8034] netlink: 'syz.0.530': attribute type 1 has an invalid length. [ 142.969799][ T8034] 8021q: adding VLAN 0 to HW filter on device bond1 [ 143.062187][ T8048] netlink: 'syz.2.532': attribute type 23 has an invalid length. [ 143.223401][ T8057] rdma_rxe: rxe_newlink: rxe creation allowed on top of a real device only [ 143.449126][ T8052] bridge0: port 1(bridge_slave_0) entered disabled state [ 143.576364][ T8052] wg2: left promiscuous mode [ 143.582420][ T8052] wg2: left allmulticast mode [ 143.595865][ T8052] bridge_slave_0: left allmulticast mode [ 143.604973][ T8052] bridge_slave_0: left promiscuous mode [ 143.611611][ T8052] bridge0: port 1(bridge_slave_0) entered disabled state [ 143.632218][ T8052] bond0: (slave bridge_slave_1): Releasing backup interface [ 143.654444][ T8052] bridge_slave_1: left promiscuous mode [ 143.700321][ T8052] bond0: (slave bond_slave_0): Releasing backup interface [ 143.718783][ T8052] bond_slave_0: left promiscuous mode [ 143.763100][ T8052] bond0: (slave bond_slave_1): Releasing backup interface [ 143.777822][ T8052] bond_slave_1: left promiscuous mode [ 143.792807][ T8052] team_slave_0: left promiscuous mode [ 143.800323][ T8052] team0: Port device team_slave_0 removed [ 143.820670][ T8052] team_slave_1: left promiscuous mode [ 143.833129][ T8052] team0: Port device team_slave_1 removed [ 143.864779][ T8052] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 143.916213][ T8052] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 143.942262][ T8052] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 143.961731][ T8052] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 144.059304][ T8052] geneve1: left allmulticast mode [ 144.114172][ T8052] ip6gre1: left allmulticast mode [ 144.201239][ T8076] netlink: 52 bytes leftover after parsing attributes in process `syz.4.536'. [ 144.233467][ T13] netdevsim netdevsim1 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 144.281831][ T1161] netdevsim netdevsim1 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 144.328644][ T1161] netdevsim netdevsim1 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 144.380601][ T1161] netdevsim netdevsim1 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 145.186009][ T8139] netlink: 12 bytes leftover after parsing attributes in process `syz.4.545'. [ 145.215899][ T8159] netlink: 300 bytes leftover after parsing attributes in process `syz.0.549'. [ 145.313776][ T8165] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 145.620347][ T8181] netlink: 20 bytes leftover after parsing attributes in process `syz.1.554'. [ 145.630991][ T8182] netlink: 20 bytes leftover after parsing attributes in process `syz.3.552'. [ 145.666985][ T8181] netlink: 12 bytes leftover after parsing attributes in process `syz.1.554'. [ 145.706547][ T8181] IPVS: Error connecting to the multicast addr [ 145.749849][ T8185] Dead loop on virtual device ip6_vti0, fix it urgently! [ 145.770298][ T8181] openvswitch: netlink: Multiple metadata blocks provided [ 145.882983][ T8197] netlink: 152 bytes leftover after parsing attributes in process `syz.0.556'. [ 146.113121][ T8211] netlink: 144 bytes leftover after parsing attributes in process `syz.3.559'. [ 146.167196][ T8213] netlink: 20 bytes leftover after parsing attributes in process `syz.3.559'. [ 146.352400][ T8219] openvswitch: netlink: IP tunnel attribute has 16 unknown bytes. [ 147.090443][ T8256] netlink: 12 bytes leftover after parsing attributes in process `syz.2.572'. [ 147.131541][ T8256] netlink: 'syz.2.572': attribute type 20 has an invalid length. [ 147.196639][ T13] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 147.206547][ T8256] netlink: 12 bytes leftover after parsing attributes in process `syz.2.572'. [ 147.236450][ T13] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 147.247345][ T8256] netlink: 'syz.2.572': attribute type 20 has an invalid length. [ 147.271045][ T13] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 147.312207][ T13] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 148.539903][ T8327] xfrm1: entered promiscuous mode [ 148.571348][ T8327] xfrm1: entered allmulticast mode [ 149.272374][ T8366] netlink: 'syz.2.601': attribute type 10 has an invalid length. [ 149.311388][ T8366] team0: Device hsr_slave_0 failed to register rx_handler [ 149.528688][ T8374] netlink: 'syz.3.602': attribute type 32 has an invalid length. [ 149.579186][ T8374] (unnamed net_device) (uninitialized): option coupled_control: invalid value (52) [ 149.663371][ T8085] IPVS: starting estimator thread 0... [ 149.782308][ T8380] IPVS: using max 24 ests per chain, 57600 per kthread [ 150.052613][ T8400] netlink: 'syz.0.612': attribute type 1 has an invalid length. [ 150.357976][ T8421] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 150.456662][ T8425] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 150.522740][ T8425] netlink: 'syz.3.620': attribute type 1 has an invalid length. [ 150.699477][ T8440] __nla_validate_parse: 8 callbacks suppressed [ 150.699496][ T8440] netlink: 4 bytes leftover after parsing attributes in process `syz.1.624'. [ 150.751631][ T8427] bond3: (slave ipvlan2): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 150.792647][ T8427] bond3: (slave ipvlan2): The slave device specified does not support setting the MAC address [ 150.832319][ T8427] bond3: (slave ipvlan2): Setting fail_over_mac to active for active-backup mode [ 150.976150][ T8456] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 150.981042][ T8448] 8021q: adding VLAN 0 to HW filter on device bond2 [ 151.017484][ T8450] bond2: (slave ip6gretap1): Enslaving as an active interface with an up link [ 151.111068][ T8462] netlink: 32 bytes leftover after parsing attributes in process `syz.1.630'. [ 151.274966][ T8466] bridge0: port 2(syz_tun) entered blocking state [ 151.277069][ T8472] netlink: 20 bytes leftover after parsing attributes in process `syz.0.633'. [ 151.283295][ T8466] bridge0: port 2(syz_tun) entered disabled state [ 151.298819][ T8466] syz_tun: entered allmulticast mode [ 151.306018][ T8466] syz_tun: entered promiscuous mode [ 151.316711][ T8466] bridge0: port 2(syz_tun) entered blocking state [ 151.323646][ T8466] bridge0: port 2(syz_tun) entered forwarding state [ 151.344521][ T8475] netlink: 'syz.3.631': attribute type 10 has an invalid length. [ 151.374893][ T8475] bridge0: port 2(syz_tun) entered disabled state [ 151.381662][ T8475] bridge0: port 1(bridge_slave_0) entered disabled state [ 151.478788][ T8475] bridge0: port 2(syz_tun) entered blocking state [ 151.485561][ T8475] bridge0: port 2(syz_tun) entered forwarding state [ 151.492581][ T8475] bridge0: port 1(bridge_slave_0) entered blocking state [ 151.499806][ T8475] bridge0: port 1(bridge_slave_0) entered forwarding state [ 151.565990][ T8475] bond0: (slave bridge0): Enslaving as an active interface with an up link [ 151.589093][ T8487] tipc: Enabling of bearer rejected, failed to enable media [ 151.743846][ T8492] tipc: Started in network mode [ 151.755398][ T8492] tipc: Node identity ee2f78c238ae, cluster identity 1 [ 151.768814][ T8492] tipc: Enabled bearer , priority 0 [ 151.781246][ T8499] netlink: 'syz.0.641': attribute type 8 has an invalid length. [ 151.783238][ T8500] netlink: 'syz.0.641': attribute type 8 has an invalid length. [ 151.799693][ T8492] syzkaller0: entered promiscuous mode [ 151.805214][ T8492] syzkaller0: entered allmulticast mode [ 151.933400][ T8503] tipc: Resetting bearer [ 151.947497][ T8492] syzkaller1: entered promiscuous mode [ 151.978443][ T8492] syzkaller1: entered allmulticast mode [ 152.018320][ T8491] tipc: Resetting bearer [ 152.076349][ T8491] tipc: Disabling bearer [ 152.157754][ T8516] syzkaller0: entered promiscuous mode [ 152.166241][ T8516] syzkaller0: entered allmulticast mode [ 152.504809][ T8540] netlink: 104 bytes leftover after parsing attributes in process `syz.0.651'. [ 152.514254][ T8539] netlink: 'syz.1.650': attribute type 9 has an invalid length. [ 152.541290][ T8538] netlink: 'syz.1.650': attribute type 9 has an invalid length. [ 152.735829][ T8556] netlink: 'syz.1.655': attribute type 1 has an invalid length. [ 153.051375][ T8577] netlink: 4 bytes leftover after parsing attributes in process `syz.2.659'. [ 153.061381][ T8563] pim6reg: entered allmulticast mode [ 153.520852][ T8597] netlink: 16178 bytes leftover after parsing attributes in process `syz.1.665'. [ 153.610503][ T8595] netlink: 'syz.4.664': attribute type 1 has an invalid length. [ 153.744138][ T8615] netlink: 'syz.1.669': attribute type 58 has an invalid length. [ 153.752231][ T8615] netlink: 20 bytes leftover after parsing attributes in process `syz.1.669'. [ 153.987142][ T8627] netlink: 8 bytes leftover after parsing attributes in process `syz.4.672'. [ 154.000859][ T8627] netlink: 24 bytes leftover after parsing attributes in process `syz.4.672'. [ 154.012570][ T8627] netlink: 24 bytes leftover after parsing attributes in process `syz.4.672'. [ 154.063633][ T8627] pim6reg1: entered promiscuous mode [ 154.070100][ T8627] pim6reg1: entered allmulticast mode [ 154.628115][ T8651] netlink: 'syz.4.683': attribute type 7 has an invalid length. [ 154.956338][ T8671] netlink: 'syz.1.688': attribute type 39 has an invalid length. [ 155.764699][ T8711] __nla_validate_parse: 2 callbacks suppressed [ 155.764717][ T8711] netlink: 40 bytes leftover after parsing attributes in process `syz.3.699'. [ 155.881914][ T8717] netlink: 32 bytes leftover after parsing attributes in process `syz.2.701'. [ 155.908317][ T30] audit: type=1804 audit(1758768831.030:2): pid=8722 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.0.702" name="/newroot/143/cgroup.controllers" dev="tmpfs" ino=741 res=1 errno=0 [ 155.941571][ T30] audit: type=1800 audit(1758768831.030:3): pid=8722 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.702" name="cgroup.controllers" dev="tmpfs" ino=741 res=0 errno=0 [ 155.964681][ T8722] netlink: 12 bytes leftover after parsing attributes in process `syz.0.702'. [ 156.103167][ T8732] netlink: 12 bytes leftover after parsing attributes in process `syz.1.706'. [ 156.136398][ T8735] vlan2: entered promiscuous mode [ 156.149734][ T8735] vlan2: entered allmulticast mode [ 156.222790][ T8740] netlink: 8 bytes leftover after parsing attributes in process `syz.4.709'. [ 156.236756][ T8742] netlink: 3 bytes leftover after parsing attributes in process `syz.0.708'. [ 156.275682][ T8742] openvswitch: netlink: Actions may not be safe on all matching packets [ 156.361161][ T8732] netlink: 'syz.1.706': attribute type 1 has an invalid length. [ 156.388645][ T8738] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 156.568769][ T8757] netlink: 28 bytes leftover after parsing attributes in process `syz.0.713'. [ 156.632564][ T8761] netlink: 28 bytes leftover after parsing attributes in process `syz.4.716'. [ 156.673992][ T8762] netlink: 5 bytes leftover after parsing attributes in process `syz.1.715'. [ 156.683998][ T8762] 0ªî{X¹¦: renamed from gretap0 [ 156.694079][ T8762] 0ªî{X¹¦: entered allmulticast mode [ 156.728163][ T8762] A link change request failed with some changes committed already. Interface 30ªî{X¹¦ may have been left with an inconsistent configuration, please check. [ 157.526146][ T8794] netlink: 'syz.4.724': attribute type 17 has an invalid length. [ 157.605487][ T8794] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 157.622770][ T8794] netlink: 'syz.4.724': attribute type 17 has an invalid length. [ 157.656775][ T8794] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 157.677415][ T8794] netlink: 'syz.4.724': attribute type 17 has an invalid length. [ 157.725867][ T8794] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 157.767359][ T8794] netlink: 'syz.4.724': attribute type 17 has an invalid length. [ 157.834405][ T8794] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 157.856703][ T8794] netlink: 'syz.4.724': attribute type 17 has an invalid length. [ 157.954604][ T8810] netlink: 36 bytes leftover after parsing attributes in process `syz.2.728'. [ 158.005767][ T8794] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 158.022212][ T8807] netdevsim netdevsim1 netdevsim0: entered promiscuous mode [ 158.022617][ T8794] netlink: 'syz.4.724': attribute type 17 has an invalid length. [ 158.132169][ T8794] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 158.153547][ T8794] netlink: 'syz.4.724': attribute type 17 has an invalid length. [ 158.216646][ T8794] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 158.233478][ T8794] netlink: 'syz.4.724': attribute type 17 has an invalid length. [ 158.316628][ T8794] netlink: 'syz.4.724': attribute type 17 has an invalid length. [ 158.332020][ T8824] tipc: Enabling of bearer rejected, failed to enable media [ 158.405322][ T8800] Bluetooth: hci0: Opcode 0x0401 failed: -4 [ 159.011032][ T8852] x_tables: ip_tables: udp match: only valid for protocol 17 [ 159.359348][ T8870] netlink: 'syz.4.747': attribute type 1 has an invalid length. [ 159.462982][ T8099] IPVS: starting estimator thread 0... [ 159.567983][ T8876] IPVS: using max 29 ests per chain, 69600 per kthread [ 159.743571][ T8893] Bluetooth: MGMT ver 1.23 [ 159.798592][ T5870] Bluetooth: hci0: command 0x0c1a tx timeout [ 160.296190][ T8921] sch_fq: defrate 0 ignored. [ 160.837841][ T8957] __nla_validate_parse: 12 callbacks suppressed [ 160.869104][ T8957] netlink: 212376 bytes leftover after parsing attributes in process `syz.4.774'. [ 161.405665][ T8984] sctp: [Deprecated]: syz.2.783 (pid 8984) Use of int in maxseg socket option. [ 161.405665][ T8984] Use struct sctp_assoc_value instead [ 161.983460][ T9008] bond3: (slave ip6gretap2): Enslaving as a backup interface with an up link [ 162.086435][ T8085] hid-generic 0005:16BF:5505.0001: hidraw0: BLUETOOTH HID vc3.b8 Device [syz0] on aa:aa:aa:aa:aa:aa [ 162.157632][ T9002] veth5: entered promiscuous mode [ 162.221397][ T9002] bond3: (slave veth5): Enslaving as a backup interface with a down link [ 162.541593][ T9028] netlink: 4 bytes leftover after parsing attributes in process `syz.0.792'. [ 162.631476][ T9041] validate_nla: 3 callbacks suppressed [ 162.631582][ T9041] netlink: 'syz.0.792': attribute type 1 has an invalid length. [ 162.699082][ T9041] netlink: 4 bytes leftover after parsing attributes in process `syz.0.792'. [ 162.783287][ T9047] netlink: 132 bytes leftover after parsing attributes in process `syz.4.797'. [ 163.156340][ T9066] netlink: 36 bytes leftover after parsing attributes in process `syz.2.800'. [ 163.233263][ T9063] netlink: 36 bytes leftover after parsing attributes in process `syz.2.800'. [ 163.346437][ T9086] netlink: 12 bytes leftover after parsing attributes in process `syz.4.805'. [ 163.393417][ T9087] netlink: 12 bytes leftover after parsing attributes in process `syz.4.805'. [ 163.409955][ T9086] netlink: 24 bytes leftover after parsing attributes in process `syz.4.805'. [ 163.445249][ T9087] netlink: 24 bytes leftover after parsing attributes in process `syz.4.805'. [ 163.527600][ T9092] IPVS: set_ctl: invalid protocol: 1 127.0.0.1:20002 [ 163.556007][ T9094] netlink: 'syz.3.808': attribute type 1 has an invalid length. [ 163.596148][ T9096] netlink: 'syz.3.808': attribute type 1 has an invalid length. [ 163.721908][ T9096] 8021q: adding VLAN 0 to HW filter on device bond5 [ 165.290903][ T9177] sctp: [Deprecated]: syz.3.826 (pid 9177) Use of int in max_burst socket option deprecated. [ 165.290903][ T9177] Use struct sctp_assoc_value instead [ 166.110419][ T1161] nci: nci_ntf_packet: unsupported ntf opcode 0xf05 [ 166.232779][ T9241] bond0: option active_slave: mode dependency failed, not supported in mode balance-rr(0) [ 166.306744][ T9246] IPv6: sit1: Disabled Multicast RS [ 166.314611][ T9246] sit1: entered allmulticast mode [ 166.906278][ T9260] netlink: 'syz.0.849': attribute type 21 has an invalid length. [ 166.915906][ T9260] (unnamed net_device) (uninitialized): option lacp_rate: mode dependency failed, not supported in mode broadcast(3) [ 166.977413][ T9255] __nla_validate_parse: 11 callbacks suppressed [ 166.977433][ T9255] netlink: 72 bytes leftover after parsing attributes in process `syz.4.847'. [ 167.023120][ T9266] netlink: 20 bytes leftover after parsing attributes in process `syz.2.851'. [ 167.170724][ T9277] netlink: 20 bytes leftover after parsing attributes in process `syz.2.854'. [ 167.343303][ T9285] dvmrp0: entered allmulticast mode [ 167.361620][ T9285] dvmrp0: left allmulticast mode [ 167.421174][ T9292] netlink: 8 bytes leftover after parsing attributes in process `syz.0.856'. [ 167.771687][ T9304] netlink: 12 bytes leftover after parsing attributes in process `syz.4.860'. [ 167.812313][ T9310] netlink: 'syz.1.862': attribute type 1 has an invalid length. [ 167.911360][ T9312] bond2: (slave gretap0): making interface the new active one [ 167.922271][ T9312] bond2: (slave gretap0): Enslaving as an active interface with an up link [ 167.944304][ T9310] netlink: 28 bytes leftover after parsing attributes in process `syz.1.862'. [ 168.032372][ T9310] 8021q: adding VLAN 0 to HW filter on device bond2 [ 168.067149][ T30] audit: type=1800 audit(1758768843.200:4): pid=9315 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.864" name=4996AE17DFFC2E43C8174B54B620636894AAACF28FF62616363C70A440AEC4014CAF28C0ADC04308 dev="tmpfs" ino=899 res=0 errno=0 [ 168.068256][ T9319] netlink: 64 bytes leftover after parsing attributes in process `syz.4.866'. [ 168.195623][ T9324] sctp: [Deprecated]: syz.3.868 (pid 9324) Use of int in max_burst socket option. [ 168.195623][ T9324] Use struct sctp_assoc_value instead [ 168.648760][ T36] nci: nci_rf_intf_activated_ntf_packet: unsupported activation_rf_tech_and_mode 0xc8 [ 168.702066][ T9343] net_ratelimit: 2 callbacks suppressed [ 168.702088][ T9343] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 168.784098][ T9360] netlink: 'syz.2.877': attribute type 1 has an invalid length. [ 168.835537][ T9360] workqueue: Failed to create a rescuer kthread for wq "bond2": -EINTR [ 169.002040][ T9371] netlink: 20 bytes leftover after parsing attributes in process `syz.0.879'. [ 191.300627][ T9396] netlink: 24 bytes leftover after parsing attributes in process `syz.0.884'. [ 191.302221][ T9403] netlink: 88 bytes leftover after parsing attributes in process `syz.3.887'. [ 191.347489][ T9404] netlink: 88 bytes leftover after parsing attributes in process `syz.3.887'. [ 191.351313][ T9402] netlink: 8 bytes leftover after parsing attributes in process `syz.4.888'. [ 191.691713][ T9419] netlink: 8 bytes leftover after parsing attributes in process `syz.0.889'. [ 192.005880][ T9437] netlink: 28 bytes leftover after parsing attributes in process `syz.4.892'. [ 192.062082][ T8071] IPVS: starting estimator thread 0... [ 192.159524][ T9440] IPVS: using max 25 ests per chain, 60000 per kthread [ 192.901114][ T9467] tipc: Started in network mode [ 192.906179][ T9467] tipc: Node identity 6a55aa0a9f18, cluster identity 4711 [ 192.916129][ T9467] tipc: Enabled bearer , priority 0 [ 192.957070][ T9467] syzkaller0: entered promiscuous mode [ 192.974893][ T9467] syzkaller0: entered allmulticast mode [ 193.004820][ T9467] tipc: Resetting bearer [ 193.033794][ T9466] tipc: Resetting bearer [ 193.092979][ T9466] tipc: Disabling bearer [ 193.602786][ T9492] netlink: 4 bytes leftover after parsing attributes in process `syz.1.912'. [ 193.620683][ T9493] netlink: 8 bytes leftover after parsing attributes in process `syz.3.911'. [ 193.658000][ T9493] netlink: 44 bytes leftover after parsing attributes in process `syz.3.911'. [ 193.721174][ T9499] Unsupported ieee802154 address type: 0 [ 193.941511][ T9511] netlink: 'syz.2.918': attribute type 10 has an invalid length. [ 193.951075][ T9511] veth1_macvtap: left promiscuous mode [ 193.962161][ T9511] team0: Device veth1_macvtap failed to register rx_handler [ 194.249740][ T9522] netlink: 32 bytes leftover after parsing attributes in process `syz.2.923'. [ 194.282689][ T1307] ieee802154 phy0 wpan0: encryption failed: -22 [ 194.354291][ T9526] netlink: 'syz.3.925': attribute type 1 has an invalid length. [ 194.495016][ T9531] 8021q: adding VLAN 0 to HW filter on device bond7 [ 194.513026][ T9531] bond6: (slave bond7): making interface the new active one [ 194.534409][ T9531] bond6: (slave bond7): Enslaving as an active interface with an up link [ 194.560115][ T9526] bridge0: Device is already in use. [ 195.719110][ T9607] geneve2: entered promiscuous mode [ 195.854892][ T9614] netlink: 'syz.4.950': attribute type 12 has an invalid length. [ 195.867420][ T9614] netlink: 'syz.4.950': attribute type 12 has an invalid length. [ 197.099861][ T9669] tipc: Enabling of bearer rejected, failed to enable media [ 197.330818][ T9674] netlink: 'syz.3.964': attribute type 11 has an invalid length. [ 197.368302][ T9674] netlink: 'syz.3.964': attribute type 11 has an invalid length. [ 197.376167][ T9674] __nla_validate_parse: 4 callbacks suppressed [ 197.376183][ T9674] netlink: 152 bytes leftover after parsing attributes in process `syz.3.964'. [ 197.529436][ T9682] netlink: 4 bytes leftover after parsing attributes in process `syz.4.966'. [ 198.479941][ T9713] netlink: 8 bytes leftover after parsing attributes in process `syz.0.972'. [ 199.478191][ T9753] netlink: 'syz.2.982': attribute type 39 has an invalid length. [ 199.609530][ T9760] netlink: 48 bytes leftover after parsing attributes in process `syz.4.987'. [ 199.823798][ T9770] netlink: 'syz.4.990': attribute type 12 has an invalid length. [ 199.834559][ T9769] netlink: 12 bytes leftover after parsing attributes in process `syz.3.989'. [ 199.866960][ T9770] netlink: 80 bytes leftover after parsing attributes in process `syz.4.990'. [ 199.872962][ T9769] netlink: 'syz.3.989': attribute type 2 has an invalid length. [ 199.903362][ T9770] netlink: 80 bytes leftover after parsing attributes in process `syz.4.990'. [ 200.087492][ T9778] netlink: 92 bytes leftover after parsing attributes in process `syz.2.993'. [ 200.133595][ T9783] netlink: 68 bytes leftover after parsing attributes in process `syz.3.994'. [ 200.241523][ T9786] macvtap1: entered allmulticast mode [ 200.256056][ T9786] veth0_macvtap: entered allmulticast mode [ 200.489491][ T9803] openvswitch: netlink: EtherType 50a is less than min 600 [ 200.889223][ T9826] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1004'. [ 200.906063][ T9829] netlink: 'syz.4.1006': attribute type 23 has an invalid length. [ 201.172783][ T9823] 8021q: adding VLAN 0 to HW filter on device bond0 [ 201.234580][ T9823] 8021q: adding VLAN 0 to HW filter on device team0 [ 201.272029][ T9823] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 201.371696][ T8082] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 201.431425][ T1151] bond0: (slave bond_slave_0): link status definitely down, disabling slave [ 201.478277][ T1151] bond0: (slave bond_slave_1): link status definitely down, disabling slave [ 201.494028][ T1151] bond0: now running without any active interface! [ 202.368456][ T12] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 202.441891][ T8087] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 202.517391][ T9899] __nla_validate_parse: 3 callbacks suppressed [ 202.517410][ T9899] netlink: 24 bytes leftover after parsing attributes in process `syz.4.1018'. [ 202.548285][ T9899] netlink: 10 bytes leftover after parsing attributes in process `syz.4.1018'. [ 202.678512][ T9908] netlink: 'syz.3.1020': attribute type 16 has an invalid length. [ 202.686753][ T9908] netlink: 'syz.3.1020': attribute type 17 has an invalid length. [ 202.697105][ T9906] netlink: 108 bytes leftover after parsing attributes in process `syz.2.1021'. [ 202.894933][ T9908] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 203.084475][ T9919] bond0: option active_slave: mode dependency failed, not supported in mode balance-rr(0) [ 203.434680][ T9937] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1031'. [ 203.469418][ T9934] bridge4: trying to set multicast query interval below minimum, setting to 100 (1000ms) [ 203.478001][ T9937] netlink: 'syz.4.1031': attribute type 5 has an invalid length. [ 203.487064][ T9937] netlink: 20 bytes leftover after parsing attributes in process `syz.4.1031'. [ 203.509571][ T13] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 203.517789][ T13] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 203.535840][ T9942] netlink: 260 bytes leftover after parsing attributes in process `syz.0.1032'. [ 203.555828][ T9937] geneve3: entered promiscuous mode [ 203.561899][ T9937] geneve3: entered allmulticast mode [ 203.578287][ T1089] netdevsim netdevsim4 ÿÿÿÿÿÿ: set [1, 1] type 2 family 0 port 256 - 0 [ 203.629476][ T1089] netdevsim netdevsim4 netdevsim1: set [1, 1] type 2 family 0 port 256 - 0 [ 203.666670][ T1089] netdevsim netdevsim4 netdevsim2: set [1, 1] type 2 family 0 port 256 - 0 [ 203.679704][ T9944] netlink: 32 bytes leftover after parsing attributes in process `syz.1.1033'. [ 203.696217][ T1089] netdevsim netdevsim4 netdevsim3: set [1, 1] type 2 family 0 port 256 - 0 [ 203.799792][ T9952] netlink: 'syz.4.1036': attribute type 1 has an invalid length. [ 203.811685][ T9949] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1035'. [ 203.830416][ T9952] netlink: 'syz.4.1036': attribute type 3 has an invalid length. [ 203.867932][ T9952] netlink: 224 bytes leftover after parsing attributes in process `syz.4.1036'. [ 203.929405][ T9952] NCSI netlink: No device for ifindex 131080 [ 204.360156][ T8082] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 204.405584][ T9985] netlink: 'syz.0.1043': attribute type 30 has an invalid length. [ 204.648771][ T9999] netlink: 'syz.1.1050': attribute type 9 has an invalid length. [ 204.657104][ T9999] netlink: 'syz.1.1050': attribute type 6 has an invalid length. [ 204.683995][ T9999] netlink: 'syz.1.1050': attribute type 7 has an invalid length. [ 204.695190][ T9999] netlink: 'syz.1.1050': attribute type 8 has an invalid length. [ 204.721669][T10004] netlink: 'syz.3.1047': attribute type 4 has an invalid length. [ 204.762834][T10009] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1048'. [ 204.802577][T10009] xfrm1: entered promiscuous mode [ 204.809373][T10009] xfrm1: entered allmulticast mode [ 204.845828][T10014] macsec0: entered promiscuous mode [ 204.892803][T10014] macsec0: entered allmulticast mode [ 204.949339][T10020] veth1_macvtap: entered allmulticast mode [ 204.968651][T10020] macsec0: left promiscuous mode [ 204.988207][T10020] macsec0: left allmulticast mode [ 204.993329][T10020] veth1_macvtap: left allmulticast mode [ 205.043297][T10023] netlink: 'syz.3.1052': attribute type 5 has an invalid length. [ 205.295051][T10037] netlink: 'syz.4.1055': attribute type 3 has an invalid length. [ 205.307619][T10043] netlink: 'syz.3.1056': attribute type 8 has an invalid length. [ 205.576381][T10053] netlink: 'syz.1.1060': attribute type 9 has an invalid length. [ 206.039846][T10071] workqueue: Failed to create a rescuer kthread for wq "bond4": -EINTR [ 206.233446][T10087] netlink: 'syz.3.1069': attribute type 16 has an invalid length. [ 206.303834][T10087] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 206.755009][T10114] netem: incorrect gi model size [ 206.761536][T10114] netem: change failed [ 207.478152][ C1] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 207.518450][T10151] __nla_validate_parse: 17 callbacks suppressed [ 207.518470][T10151] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1088'. [ 207.561006][T10152] netlink: 20 bytes leftover after parsing attributes in process `syz.0.1089'. [ 207.805069][T10165] batadv_slave_1: entered promiscuous mode [ 207.848387][T10164] batadv_slave_1: left promiscuous mode [ 207.964634][T10170] netlink: 16 bytes leftover after parsing attributes in process `syz.4.1095'. [ 208.212370][T10183] openvswitch: netlink: Actions may not be safe on all matching packets [ 208.240126][T10183] netlink: 'syz.3.1101': attribute type 11 has an invalid length. [ 208.266487][T10187] netlink: 20 bytes leftover after parsing attributes in process `syz.0.1100'. [ 208.331383][T10183] openvswitch: netlink: Actions may not be safe on all matching packets [ 208.681689][T10214] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1106'. [ 208.692217][T10198] team0 (unregistering): Port device team_slave_0 removed [ 208.701239][T10198] team0 (unregistering): Port device team_slave_1 removed [ 208.724214][T10205] netlink: 156 bytes leftover after parsing attributes in process `syz.3.1107'. [ 208.735196][T10205] netlink: 156 bytes leftover after parsing attributes in process `syz.3.1107'. [ 208.744966][T10210] netlink: 2 bytes leftover after parsing attributes in process `syz.1.1106'. [ 208.776735][T10214] macsec1: entered promiscuous mode [ 208.794134][T10214] bridge0: entered promiscuous mode [ 208.808111][T10214] macsec1: entered allmulticast mode [ 208.813470][T10214] bridge0: entered allmulticast mode [ 208.865187][T10214] bridge0: port 1(macsec1) entered blocking state [ 208.888297][T10214] bridge0: port 1(macsec1) entered disabled state [ 208.937178][T10214] bridge0: left allmulticast mode [ 208.942945][T10214] bridge0: left promiscuous mode [ 209.005650][T10178] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 209.013151][T10178] Bluetooth: hci3: Error when powering off device on rfkill (-4) [ 209.177476][T10235] syz.1.1117: vmalloc error: size 8589938688, exceeds total pages, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 209.200421][T10228] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 209.246258][T10235] CPU: 0 UID: 0 PID: 10235 Comm: syz.1.1117 Not tainted syzkaller #0 PREEMPT(full) [ 209.246307][T10235] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 209.246337][T10235] Call Trace: [ 209.246346][T10235] [ 209.246356][T10235] dump_stack_lvl+0x189/0x250 [ 209.246400][T10235] ? __pfx_dump_stack_lvl+0x10/0x10 [ 209.246426][T10235] ? __pfx__printk+0x10/0x10 [ 209.246456][T10235] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 209.246482][T10235] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 209.246508][T10235] ? cpuset_print_current_mems_allowed+0x2ee/0x360 [ 209.246536][T10235] warn_alloc+0x214/0x310 [ 209.246570][T10235] ? stack_depot_save_flags+0x40/0x860 [ 209.246605][T10235] ? __pfx_warn_alloc+0x10/0x10 [ 209.246639][T10235] ? kasan_save_track+0x4f/0x80 [ 209.246667][T10235] ? xskq_create+0x56/0x170 [ 209.246685][T10235] ? xsk_init_queue+0xb0/0x110 [ 209.246702][T10235] ? xsk_setsockopt+0x4dc/0x8d0 [ 209.246731][T10235] ? do_sock_setsockopt+0x179/0x1b0 [ 209.246753][T10235] ? __x64_sys_setsockopt+0x13f/0x1b0 [ 209.246775][T10235] ? do_syscall_64+0xfa/0x3b0 [ 209.246796][T10235] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 209.246827][T10235] __vmalloc_node_range_noprof+0x125/0x12f0 [ 209.246892][T10235] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 209.246924][T10235] ? xskq_create+0x56/0x170 [ 209.246947][T10235] ? __kasan_kmalloc+0x93/0xb0 [ 209.246979][T10235] vmalloc_user_noprof+0xad/0xf0 [ 209.247010][T10235] ? xskq_create+0xbf/0x170 [ 209.247031][T10235] xskq_create+0xbf/0x170 [ 209.247064][T10235] xsk_init_queue+0xb0/0x110 [ 209.247088][T10235] xsk_setsockopt+0x4dc/0x8d0 [ 209.247123][T10235] ? __pfx_xsk_setsockopt+0x10/0x10 [ 209.247155][T10235] ? __pfx_aa_sk_perm+0x10/0x10 [ 209.247192][T10235] ? aa_sock_opt_perm+0xff/0x1b0 [ 209.247217][T10235] ? bpf_lsm_socket_setsockopt+0x9/0x20 [ 209.247239][T10235] ? __pfx_xsk_setsockopt+0x10/0x10 [ 209.247273][T10235] do_sock_setsockopt+0x179/0x1b0 [ 209.247303][T10235] __x64_sys_setsockopt+0x13f/0x1b0 [ 209.247335][T10235] do_syscall_64+0xfa/0x3b0 [ 209.247356][T10235] ? lockdep_hardirqs_on+0x9c/0x150 [ 209.247377][T10235] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 209.247398][T10235] ? clear_bhb_loop+0x60/0xb0 [ 209.247423][T10235] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 209.247450][T10235] RIP: 0033:0x7f78b618eec9 [ 209.247480][T10235] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 209.247496][T10235] RSP: 002b:00007f78b7023038 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 209.247518][T10235] RAX: ffffffffffffffda RBX: 00007f78b63e5fa0 RCX: 00007f78b618eec9 [ 209.247533][T10235] RDX: 0000000000000006 RSI: 000000000000011b RDI: 0000000000000003 [ 209.247544][T10235] RBP: 00007f78b6211f91 R08: 0000000000000004 R09: 0000000000000000 [ 209.247557][T10235] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000000 [ 209.247570][T10235] R13: 00007f78b63e6038 R14: 00007f78b63e5fa0 R15: 00007ffe867df048 [ 209.247604][T10235] [ 209.247617][T10235] Mem-Info: [ 209.658079][T10235] active_anon:8069 inactive_anon:0 isolated_anon:0 [ 209.658079][T10235] active_file:3106 inactive_file:39944 isolated_file:0 [ 209.658079][T10235] unevictable:768 dirty:337 writeback:0 [ 209.658079][T10235] slab_reclaimable:11528 slab_unreclaimable:116593 [ 209.658079][T10235] mapped:32216 shmem:3125 pagetables:1256 [ 209.658079][T10235] sec_pagetables:0 bounce:0 [ 209.658079][T10235] kernel_misc_reclaimable:0 [ 209.658079][T10235] free:1307298 free_pcp:14395 free_cma:0 [ 209.743038][T10245] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 209.764146][T10245] bond0: (slave batadv0): Enslaving as an active interface with an up link [ 209.778480][T10235] Node 0 active_anon:33376kB inactive_anon:0kB active_file:12424kB inactive_file:159572kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:130064kB dirty:1344kB writeback:0kB shmem:12064kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:13312kB pagetables:4876kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 209.798620][T10246] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 209.841360][T10246] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 209.861363][T10235] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:4kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:48kB pagetables:148kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 209.908285][T10235] Node 0 DMA free:15360kB boost:0kB min:204kB low:252kB high:300kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 209.947653][T10235] lowmem_reserve[]: 0 2497 2499 2499 2499 [ 209.955523][T10235] Node 0 DMA32 free:1328172kB boost:0kB min:34248kB low:42808kB high:51368kB reserved_highatomic:0KB free_highatomic:0KB active_anon:36712kB inactive_anon:0kB active_file:12424kB inactive_file:158000kB unevictable:1536kB writepending:1344kB present:3129332kB managed:2557412kB mlocked:0kB bounce:0kB free_pcp:38704kB local_pcp:23440kB free_cma:0kB [ 209.992559][T10235] lowmem_reserve[]: 0 0 1 1 1 [ 210.004905][T10235] Node 0 Normal free:12kB boost:0kB min:20kB low:24kB high:28kB reserved_highatomic:0KB free_highatomic:0KB active_anon:44kB inactive_anon:0kB active_file:0kB inactive_file:1572kB unevictable:0kB writepending:0kB present:1048580kB managed:1644kB mlocked:0kB bounce:0kB free_pcp:16kB local_pcp:8kB free_cma:0kB [ 210.097540][T10235] lowmem_reserve[]: 0 0 0 0 0 [ 210.111520][T10235] Node 1 Normal free:3885524kB boost:0kB min:55632kB low:69540kB high:83448kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:1536kB writepending:4kB present:4194300kB managed:4111100kB mlocked:0kB bounce:0kB free_pcp:16384kB local_pcp:6176kB free_cma:0kB [ 210.179342][T10235] lowmem_reserve[]: 0 0 0 0 0 [ 210.185080][T10235] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 210.204146][T10235] Node 0 DMA32: 2*4kB (UM) 6*8kB (M) 96*16kB (M) 48*32kB (M) 11*64kB (ME) 8*128kB (ME) 5*256kB (M) 4*512kB (ME) 3*1024kB (UME) 3*2048kB (M) 320*4096kB (M) = 1328120kB [ 210.225576][T10235] Node 0 Normal: 1*4kB (M) 1*8kB (M) 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 12kB [ 210.242153][T10235] Node 1 Normal: 223*4kB (UME) 63*8kB (UME) 50*16kB (UME) 128*32kB (UME) 29*64kB (UME) 8*128kB (UME) 6*256kB (UM) 2*512kB (M) 3*1024kB (UME) 2*2048kB (UE) 944*4096kB (M) = 3885524kB [ 210.264763][T10235] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 210.277044][T10235] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 210.293957][T10246] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 210.310433][T10246] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 210.317899][T10235] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 210.344836][T10235] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 210.368109][T10235] 47267 total pagecache pages [ 210.373135][T10235] 0 pages in swap cache [ 210.377410][T10235] Free swap = 124996kB [ 210.386644][T10235] Total swap = 124996kB [ 210.391617][T10235] 2097051 pages RAM [ 210.395590][T10235] 0 pages HighMem/MovableOnly [ 210.404824][T10235] 425672 pages reserved [ 210.410585][T10235] 0 pages cma reserved [ 210.531010][T10246] bond0: (slave batadv0): Releasing backup interface [ 210.556987][T10248] gtp1: entered promiscuous mode [ 210.562442][T10248] gtp1: entered allmulticast mode [ 210.782477][T10261] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 210.963785][T10273] netlink: 108 bytes leftover after parsing attributes in process `syz.0.1125'. [ 210.983167][T10273] netlink: 108 bytes leftover after parsing attributes in process `syz.0.1125'. [ 211.262443][T10286] ieee802154 phy0 wpan0: encryption failed: -22 [ 211.571463][T10302] vlan2: entered promiscuous mode [ 211.576570][T10302] bridge0: entered promiscuous mode [ 211.585860][T10302] validate_nla: 4 callbacks suppressed [ 211.585886][T10302] netlink: 'syz.4.1134': attribute type 10 has an invalid length. [ 211.637463][T10301] veth7: entered allmulticast mode [ 211.698612][T10305] tipc: Started in network mode [ 211.703544][T10305] tipc: Node identity 2ad6c9918064, cluster identity 4711 [ 211.718421][ T5876] Bluetooth: hci0: command 0x0c1a tx timeout [ 211.724725][ T5876] Bluetooth: hci1: command 0x0406 tx timeout [ 211.738220][ T5873] Bluetooth: hci2: command 0x0406 tx timeout [ 211.749907][T10305] tipc: Enabled bearer , priority 0 [ 211.792500][T10305] syzkaller0: entered promiscuous mode [ 211.825347][T10305] syzkaller0: entered allmulticast mode [ 211.873760][T10316] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 211.909342][T10317] tipc: Resetting bearer [ 211.927658][T10304] tipc: Resetting bearer [ 211.931593][T10323] workqueue: Failed to create a rescuer kthread for wq "nfc2_nci_rx_wq": -EINTR [ 211.960267][T10313] IPVS: persistence engine module ip_vs_pe_À not found [ 211.994834][T10304] tipc: Disabling bearer [ 212.285816][T10350] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 212.293451][T10350] IPv6: NLM_F_CREATE should be set when creating new route [ 213.381904][T10401] __nla_validate_parse: 7 callbacks suppressed [ 213.381924][T10401] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1158'. [ 213.396657][T10399] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1158'. [ 213.420776][T10396] netlink: 40 bytes leftover after parsing attributes in process `syz.2.1159'. [ 213.431298][T10403] netlink: 60 bytes leftover after parsing attributes in process `syz.4.1161'. [ 213.451901][T10403] netlink: 60 bytes leftover after parsing attributes in process `syz.4.1161'. [ 213.463205][T10399] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1158'. [ 213.475899][T10399] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1158'. [ 213.476152][T10404] bridge0: Device is already in use. [ 213.499088][T10399] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1158'. [ 213.535873][T10399] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1158'. [ 213.556339][T10410] netlink: 'syz.1.1163': attribute type 2 has an invalid length. [ 213.588320][T10399] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1158'. [ 214.315692][T10459] netlink: 'syz.2.1175': attribute type 1 has an invalid length. [ 214.344023][T10459] netlink: 'syz.2.1175': attribute type 4 has an invalid length. [ 214.666414][T10477] netlink: 'syz.0.1179': attribute type 10 has an invalid length. [ 214.718179][T10476] netlink: 'syz.0.1179': attribute type 10 has an invalid length. [ 214.748650][T10484] bridge0: received packet on syz_tun with own address as source address (addr:aa:aa:aa:aa:aa:aa, vlan:0) [ 214.781148][T10476] batadv0: left allmulticast mode [ 214.804699][T10477] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 214.849598][T10477] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 215.398123][ C1] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 216.071294][T10546] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 216.078618][T10546] IPv6: NLM_F_CREATE should be set when creating new route [ 216.109798][T10546] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 216.797748][T10588] nbd: must specify a size in bytes for the device [ 217.066964][T10605] netlink: 'syz.2.1211': attribute type 10 has an invalid length. [ 217.360655][T10622] netlink: 'syz.3.1218': attribute type 1 has an invalid length. [ 217.623675][T10627] 8021q: adding VLAN 0 to HW filter on device bond9 [ 217.632926][T10627] bond8: (slave bond9): making interface the new active one [ 217.641217][T10627] bond8: (slave bond9): Enslaving as an active interface with an up link [ 217.650471][T10633] bridge0: Device is already in use. [ 217.838873][T10650] mac80211_hwsim hwsim5 wlan1: left allmulticast mode [ 217.863908][T10649] netlink: 'syz.4.1223': attribute type 1 has an invalid length. [ 218.144276][T10649] veth3: entered promiscuous mode [ 218.256219][T10677] netlink: 'syz.2.1231': attribute type 10 has an invalid length. [ 218.375889][T10681] gtp0: entered promiscuous mode [ 218.398327][T10681] gtp0: entered allmulticast mode [ 218.457121][T10681] netlink: 'syz.4.1232': attribute type 2 has an invalid length. [ 218.625824][T10713] __nla_validate_parse: 85 callbacks suppressed [ 218.625844][T10713] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1235'. [ 218.731479][T10718] netlink: 20 bytes leftover after parsing attributes in process `syz.3.1235'. [ 218.935117][T10721] pim6reg1: entered promiscuous mode [ 218.940932][T10721] pim6reg1: entered allmulticast mode [ 219.489668][ T5533] veth0_macvtap: left promiscuous mode [ 219.586315][T10753] netlink: 128 bytes leftover after parsing attributes in process `syz.2.1248'. [ 219.619467][T10756] netlink: 44 bytes leftover after parsing attributes in process `syz.0.1249'. [ 220.009619][T10767] netlink: 24 bytes leftover after parsing attributes in process `syz.4.1253'. [ 220.186994][T10774] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1256'. [ 220.335211][T10795] netlink: 'syz.4.1258': attribute type 29 has an invalid length. [ 220.410148][T10787] tipc: Enabled bearer , priority 0 [ 220.436517][T10787] syzkaller0: entered promiscuous mode [ 220.457085][T10787] syzkaller0: entered allmulticast mode [ 220.512709][T10787] tipc: Resetting bearer [ 220.548103][T10801] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1263'. [ 220.576583][T10802] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1263'. [ 220.636226][T10810] netlink: 32 bytes leftover after parsing attributes in process `syz.1.1264'. [ 220.694922][T10810] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1264'. [ 220.706122][T10816] openvswitch: netlink: Unexpected mask (mask=240, allowed=10048) [ 221.033328][T10777] tipc: Resetting bearer [ 221.091300][T10777] tipc: Disabling bearer [ 221.166442][T10842] sctp: [Deprecated]: syz.1.1271 (pid 10842) Use of struct sctp_assoc_value in delayed_ack socket option. [ 221.166442][T10842] Use struct sctp_sack_info instead [ 221.273772][T10851] netem: change failed [ 221.352539][T10853] netem: change failed [ 221.604452][T10862] syz.1.1276: vmalloc error: size 8589938688, exceeds total pages, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 221.675086][T10862] CPU: 0 UID: 0 PID: 10862 Comm: syz.1.1276 Not tainted syzkaller #0 PREEMPT(full) [ 221.675117][T10862] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 221.675130][T10862] Call Trace: [ 221.675137][T10862] [ 221.675146][T10862] dump_stack_lvl+0x189/0x250 [ 221.675178][T10862] ? __pfx_dump_stack_lvl+0x10/0x10 [ 221.675202][T10862] ? __pfx__printk+0x10/0x10 [ 221.675231][T10862] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 221.675256][T10862] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 221.675281][T10862] ? cpuset_print_current_mems_allowed+0x2ee/0x360 [ 221.675308][T10862] warn_alloc+0x214/0x310 [ 221.675340][T10862] ? stack_depot_save_flags+0x40/0x860 [ 221.675375][T10862] ? __pfx_warn_alloc+0x10/0x10 [ 221.675407][T10862] ? kasan_save_track+0x4f/0x80 [ 221.675433][T10862] ? xskq_create+0x56/0x170 [ 221.675451][T10862] ? xsk_init_queue+0xb0/0x110 [ 221.675466][T10862] ? xsk_setsockopt+0x4dc/0x8d0 [ 221.675493][T10862] ? do_sock_setsockopt+0x179/0x1b0 [ 221.675515][T10862] ? __x64_sys_setsockopt+0x13f/0x1b0 [ 221.675536][T10862] ? do_syscall_64+0xfa/0x3b0 [ 221.675556][T10862] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 221.675583][T10862] __vmalloc_node_range_noprof+0x125/0x12f0 [ 221.675663][T10862] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 221.675701][T10862] ? __kasan_kmalloc+0x93/0xb0 [ 221.675745][T10862] vmalloc_user_noprof+0xad/0xf0 [ 221.675774][T10862] ? xskq_create+0xbf/0x170 [ 221.675794][T10862] xskq_create+0xbf/0x170 [ 221.675817][T10862] xsk_init_queue+0xb0/0x110 [ 221.675839][T10862] xsk_setsockopt+0x4dc/0x8d0 [ 221.675872][T10862] ? __pfx_xsk_setsockopt+0x10/0x10 [ 221.675902][T10862] ? __pfx_aa_sk_perm+0x10/0x10 [ 221.675937][T10862] ? aa_sock_opt_perm+0xff/0x1b0 [ 221.675969][T10862] ? bpf_lsm_socket_setsockopt+0x9/0x20 [ 221.675990][T10862] ? __pfx_xsk_setsockopt+0x10/0x10 [ 221.676022][T10862] do_sock_setsockopt+0x179/0x1b0 [ 221.676051][T10862] __x64_sys_setsockopt+0x13f/0x1b0 [ 221.676082][T10862] do_syscall_64+0xfa/0x3b0 [ 221.676102][T10862] ? lockdep_hardirqs_on+0x9c/0x150 [ 221.676122][T10862] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 221.676142][T10862] ? clear_bhb_loop+0x60/0xb0 [ 221.676166][T10862] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 221.676184][T10862] RIP: 0033:0x7f78b618eec9 [ 221.676202][T10862] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 221.676217][T10862] RSP: 002b:00007f78b7023038 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 221.676238][T10862] RAX: ffffffffffffffda RBX: 00007f78b63e5fa0 RCX: 00007f78b618eec9 [ 221.676251][T10862] RDX: 0000000000000006 RSI: 000000000000011b RDI: 0000000000000006 [ 221.676263][T10862] RBP: 00007f78b6211f91 R08: 0000000000000004 R09: 0000000000000000 [ 221.676274][T10862] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000000 [ 221.676286][T10862] R13: 00007f78b63e6038 R14: 00007f78b63e5fa0 R15: 00007ffe867df048 [ 221.676318][T10862] [ 221.676325][T10862] Mem-Info: [ 221.730875][T10869] netlink: 'syz.0.1277': attribute type 1 has an invalid length. [ 221.741308][T10862] active_anon:3865 inactive_anon:0 isolated_anon:0 [ 221.741308][T10862] active_file:3106 inactive_file:39948 isolated_file:0 [ 221.741308][T10862] unevictable:768 dirty:330 writeback:0 [ 221.741308][T10862] slab_reclaimable:11580 slab_unreclaimable:114832 [ 221.741308][T10862] mapped:29040 shmem:1379 pagetables:950 [ 221.741308][T10862] sec_pagetables:0 bounce:0 [ 221.741308][T10862] kernel_misc_reclaimable:0 [ 221.741308][T10862] free:1313965 free_pcp:15838 free_cma:0 [ 222.035336][T10862] Node 0 active_anon:16776kB inactive_anon:0kB active_file:12420kB inactive_file:159588kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:124384kB dirty:1320kB writeback:0kB shmem:4924kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:12804kB pagetables:3896kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 222.067588][T10862] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:48kB pagetables:148kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 222.099436][T10862] Node 0 DMA free:15360kB boost:0kB min:204kB low:252kB high:300kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 222.129310][T10862] lowmem_reserve[]: 0 2497 2499 2499 2499 [ 222.135144][T10862] Node 0 DMA32 free:1356424kB boost:0kB min:34248kB low:42808kB high:51368kB reserved_highatomic:0KB free_highatomic:0KB active_anon:17232kB inactive_anon:0kB active_file:12420kB inactive_file:158016kB unevictable:1536kB writepending:1320kB present:3129332kB managed:2557412kB mlocked:0kB bounce:0kB free_pcp:41836kB local_pcp:21400kB free_cma:0kB [ 222.170499][T10862] lowmem_reserve[]: 0 0 1 1 1 [ 222.175287][T10862] Node 0 Normal free:12kB boost:0kB min:20kB low:24kB high:28kB reserved_highatomic:0KB free_highatomic:0KB active_anon:44kB inactive_anon:0kB active_file:0kB inactive_file:1572kB unevictable:0kB writepending:0kB present:1048580kB managed:1644kB mlocked:0kB bounce:0kB free_pcp:16kB local_pcp:8kB free_cma:0kB [ 222.259474][T10862] lowmem_reserve[]: 0 0 0 0 0 [ 222.268847][T10862] Node 1 Normal free:3885524kB boost:0kB min:55632kB low:69540kB high:83448kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:1536kB writepending:0kB present:4194300kB managed:4111100kB mlocked:0kB bounce:0kB free_pcp:16388kB local_pcp:10208kB free_cma:0kB [ 222.336917][T10862] lowmem_reserve[]: 0 0 0 0 0 [ 222.347725][T10862] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 222.363906][T10862] Node 0 DMA32: 403*4kB (UE) 873*8kB (UM) 343*16kB (UME) 253*32kB (UME) 40*64kB (UME) 14*128kB (UM) 8*256kB (UME) 4*512kB (UM) 5*1024kB (ME) 3*2048kB (M) 320*4096kB (M) = 1352612kB [ 222.386998][T10862] Node 0 Normal: 1*4kB (M) 1*8kB (M) 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 12kB [ 222.421776][T10862] Node 1 Normal: 223*4kB (UME) 63*8kB (UME) 50*16kB (UME) 128*32kB (UME) 29*64kB (UME) 8*128kB (UME) 6*256kB (UM) 2*512kB (M) 3*1024kB (UME) 2*2048kB (UE) 944*4096kB (M) = 3885524kB [ 222.443964][T10862] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 222.453692][T10862] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 222.467663][T10862] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 222.477789][T10862] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 222.489977][T10862] 47715 total pagecache pages [ 222.495065][T10862] 0 pages in swap cache [ 222.501335][T10862] Free swap = 124996kB [ 222.505585][T10862] Total swap = 124996kB [ 222.512753][T10862] 2097051 pages RAM [ 222.516658][T10862] 0 pages HighMem/MovableOnly [ 222.523129][T10862] 425672 pages reserved [ 222.527373][T10862] 0 pages cma reserved [ 222.538470][T10869] workqueue: Failed to create a rescuer kthread for wq "bond5": -EINTR [ 222.611520][T10893] tipc: New replicast peer: 255.255.255.255 [ 222.641076][T10893] tipc: Enabled bearer , priority 10 [ 222.667712][T10886] netlink: 'syz.4.1280': attribute type 1 has an invalid length. [ 222.678955][T10886] netlink: 'syz.4.1280': attribute type 1 has an invalid length. [ 222.700530][T10897] netlink: 'syz.2.1282': attribute type 24 has an invalid length. [ 222.723462][T10901] netlink: 'syz.1.1283': attribute type 1 has an invalid length. [ 222.836434][T10903] xt_l2tp: v2 tid > 0xffff: 1114244 [ 223.129917][T10919] tipc: Enabling of bearer rejected, media not registered [ 223.299713][ T8082] IPVS: starting estimator thread 0... [ 223.428354][T10945] IPVS: using max 26 ests per chain, 62400 per kthread [ 223.769706][T10962] __nla_validate_parse: 5 callbacks suppressed [ 223.769724][T10962] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1297'. [ 223.779817][ T8072] tipc: Node number set to 2401281378 [ 224.803057][T10946] (unnamed net_device) (uninitialized): option ad_actor_sys_prio: mode dependency failed, not supported in mode balance-rr(0) [ 224.817164][T10947] (unnamed net_device) (uninitialized): option ad_actor_sys_prio: mode dependency failed, not supported in mode balance-rr(0) [ 224.976489][T10982] openvswitch: netlink: Missing key (keys=40, expected=200000) [ 225.042435][T10974] pimreg3: entered allmulticast mode [ 225.852472][T11042] nbd: device at index 4 is going down [ 225.930456][T11048] netlink: 16 bytes leftover after parsing attributes in process `syz.3.1320'. [ 225.976913][T11053] netlink: 'syz.2.1321': attribute type 18 has an invalid length. [ 225.998699][T11055] netlink: 84 bytes leftover after parsing attributes in process `syz.1.1322'. [ 226.237244][ T1089] nci: nci_extract_activation_params_nfc_dep: unsupported activation_rf_tech_and_mode 0x6 [ 226.263671][T11071] netlink: 'syz.2.1326': attribute type 1 has an invalid length. [ 226.397031][T11079] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1326'. [ 226.414778][T11071] 8021q: adding VLAN 0 to HW filter on device bond2 [ 226.424502][T11077] openvswitch: netlink: Unexpected mask (mask=200040, allowed=10048) [ 226.536901][T11085] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1328'. [ 226.574299][T11085] openvswitch: netlink: nsh attribute has 65532 unknown bytes. [ 226.619026][T11094] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1330'. [ 226.627545][T11085] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 226.636612][T11094] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1330'. [ 226.780565][T11094] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1330'. [ 226.797331][T11094] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1330'. [ 226.805796][T11103] tipc: Started in network mode [ 226.812202][T11100] iwpm_register_pid: Unable to send a nlmsg (client = 2) [ 226.826490][T11105] netlink: 'syz.1.1332': attribute type 2 has an invalid length. [ 226.826736][T11103] tipc: Node identity cae7525cff47, cluster identity 4711 [ 226.844737][T11103] tipc: Enabled bearer , priority 0 [ 226.846868][T11105] netlink: 'syz.1.1332': attribute type 1 has an invalid length. [ 226.854253][T11103] syzkaller0: entered promiscuous mode [ 226.865482][T11103] syzkaller0: entered allmulticast mode [ 226.868130][T11100] infiniband syz2: RDMA CMA: cma_listen_on_dev, error -98 [ 226.876582][T11103] netlink: 'syz.0.1333': attribute type 1 has an invalid length. [ 226.887622][T11105] netlink: 'syz.1.1332': attribute type 2 has an invalid length. [ 226.909770][T11104] erspan0: entered promiscuous mode [ 226.915501][T11104] vlan2: entered promiscuous mode [ 226.979116][T11103] netlink: 76 bytes leftover after parsing attributes in process `syz.0.1333'. [ 227.017108][T11103] tipc: Resetting bearer [ 227.074563][T11101] tipc: Resetting bearer [ 227.118816][T11101] tipc: Disabling bearer [ 227.278305][T11123] openvswitch: netlink: ufid size 3068 bytes exceeds the range (1, 16) [ 227.345410][T11123] openvswitch: netlink: Duplicate key (type 0). [ 227.375077][T11133] Bluetooth: MGMT ver 1.23 [ 227.436220][T11136] tipc: Enabled bearer , priority 0 [ 227.470926][T11136] syzkaller0: entered promiscuous mode [ 227.476465][T11136] syzkaller0: entered allmulticast mode [ 227.513593][T11136] sch_tbf: burst 4 is lower than device syzkaller0 mtu (1514) ! [ 227.569447][T11136] tipc: Resetting bearer [ 227.577700][T11134] tipc: Resetting bearer [ 227.613081][T11134] tipc: Disabling bearer [ 227.634544][T11147] tc_dump_action: action bad kind [ 227.792942][T11158] netlink: 'syz.3.1352': attribute type 11 has an invalid length. [ 228.350571][T11183] validate_nla: 1 callbacks suppressed [ 228.350593][T11183] netlink: 'syz.2.1357': attribute type 10 has an invalid length. [ 228.771227][T11208] openvswitch: netlink: nsh attr 8196 is out of range max 3 [ 228.788337][T11208] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 228.873196][T11216] __nla_validate_parse: 7 callbacks suppressed [ 228.873218][T11216] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1370'. [ 228.966062][T11224] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1372'. [ 229.086138][T11227] netlink: 348 bytes leftover after parsing attributes in process `syz.0.1373'. [ 229.247461][T11240] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1375'. [ 229.541144][T11250] netlink: 144 bytes leftover after parsing attributes in process `syz.2.1378'. [ 230.084700][T11282] tipc: Enabling of bearer rejected, failed to enable media [ 230.174538][T11278] "syz.3.1388" (11278) uses obsolete ecb(arc4) skcipher [ 230.228671][T11290] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1391'. [ 230.758081][ C1] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 230.770115][T11322] sctp: [Deprecated]: syz.3.1399 (pid 11322) Use of int in maxseg socket option. [ 230.770115][T11322] Use struct sctp_assoc_value instead [ 230.966733][T11337] openvswitch: netlink: IP tunnel dst address not specified [ 231.151388][T11351] syzkaller0: entered promiscuous mode [ 231.156920][T11351] syzkaller0: entered allmulticast mode [ 231.420093][T11367] netlink: 36 bytes leftover after parsing attributes in process `syz.3.1413'. [ 231.903435][T11397] vxcan1: tx address claim with different name [ 232.115643][T11415] gre0: entered promiscuous mode [ 232.161229][T11418] netlink: 40 bytes leftover after parsing attributes in process `syz.2.1426'. [ 232.546576][T11441] netlink: 44 bytes leftover after parsing attributes in process `syz.2.1434'. [ 232.558784][T11441] netlink: 44 bytes leftover after parsing attributes in process `syz.2.1434'. [ 232.769892][T11453] netlink: 'syz.2.1440': attribute type 21 has an invalid length. [ 232.804950][T11453] IPv6: NLM_F_CREATE should be specified when creating new route [ 233.159189][T11468] delete_channel: no stack [ 233.277181][T11486] netlink: 'syz.2.1448': attribute type 16 has an invalid length. [ 233.286091][T11486] netlink: 'syz.2.1448': attribute type 17 has an invalid length. [ 233.294732][ T8072] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 233.303230][T11486] tunl0: left promiscuous mode [ 233.309297][T11486] gre0: left promiscuous mode [ 233.336815][T11486] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 233.358704][ T8072] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 233.375838][T11486] veth0_to_team: left promiscuous mode [ 233.381847][T11486] veth0_to_team: left allmulticast mode [ 233.392865][T11486] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 233.403522][T11486] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 233.416503][T11486] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 233.427228][T11486] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 233.445644][T11486] veth0_macvtap: left promiscuous mode [ 233.453034][T11486] veth0_macvtap: entered promiscuous mode [ 233.460109][T11486] veth1_macvtap: entered promiscuous mode [ 233.485983][T11486] 8021q: adding VLAN 0 to HW filter on device bond1 [ 233.494703][T11447] Bluetooth: hci0: Opcode 0x0401 failed: -4 [ 233.506833][T11486] A link change request failed with some changes committed already. Interface pim6reg0 may have been left with an inconsistent configuration, please check. [ 233.557677][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 233.564900][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 233.574287][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 233.581493][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 233.630075][ T36] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 233.643082][ T36] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 233.653890][ T36] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 233.666159][ T36] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 233.689156][T11493] netlink: 'syz.2.1451': attribute type 83 has an invalid length. [ 233.741170][T11496] netlink: 'syz.3.1450': attribute type 29 has an invalid length. [ 233.764745][T11496] netlink: 'syz.3.1450': attribute type 29 has an invalid length. [ 233.825530][T11498] tipc: Enabled bearer , priority 0 [ 233.904088][T11509] syzkaller0: entered promiscuous mode [ 233.921215][T11509] syzkaller0: entered allmulticast mode [ 233.951707][T11511] __nla_validate_parse: 6 callbacks suppressed [ 233.951728][T11511] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1454'. [ 233.996731][T11509] tipc: Resetting bearer [ 234.120417][ T8072] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 234.152850][T11497] tipc: Resetting bearer [ 234.247598][T11497] tipc: Disabling bearer [ 234.655564][T11552] netlink: 28 bytes leftover after parsing attributes in process `syz.3.1463'. [ 234.758078][ T51] Bluetooth: hci0: command 0x0c1a tx timeout [ 234.816102][T11565] A link change request failed with some changes committed already. Interface xfrm0 may have been left with an inconsistent configuration, please check. [ 235.250383][T10715] bond0: (slave bond_slave_0): link status definitely up, 10000 Mbps full duplex [ 235.273871][T11590] netlink: 224 bytes leftover after parsing attributes in process `syz.3.1476'. [ 235.285918][T10715] bond0: (slave bond_slave_1): link status definitely up, 10000 Mbps full duplex [ 235.314552][T10715] bond0: active interface up! [ 236.052709][T11626] vlan1: entered allmulticast mode [ 236.064386][T11626] bond0: entered allmulticast mode [ 236.240739][T11633] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1493'. [ 236.451407][T11641] nft_compat: unsupported protocol 0 [ 236.467324][T11640] (unnamed net_device) (uninitialized): down delay (33554432) is not a multiple of miimon (640), value rounded to 33553920 ms [ 236.520289][T11653] netlink: 'syz.2.1497': attribute type 1 has an invalid length. [ 236.728426][T11672] openvswitch: netlink: Duplicate or invalid key (type 0). [ 236.747999][T11672] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 236.936106][T11680] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1508'. [ 236.974563][T11680] openvswitch: netlink: Flow key attr not present in new flow. [ 237.196529][T11702] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1514'. [ 237.376706][T11715] vxcan1: tx address claim with dest, not broadcast [ 237.395646][T11716] openvswitch: netlink: Key type 16144 is out of range max 32 [ 237.485333][T11719] netlink: 248 bytes leftover after parsing attributes in process `syz.0.1520'. [ 237.499633][T11719] netlink: 44 bytes leftover after parsing attributes in process `syz.0.1520'. [ 237.512232][T11723] netlink: 20 bytes leftover after parsing attributes in process `syz.4.1522'. [ 237.523360][T11723] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1522'. [ 239.199106][T11830] __nla_validate_parse: 1 callbacks suppressed [ 239.199126][T11830] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1547'. [ 239.394637][T11841] netlink: 16 bytes leftover after parsing attributes in process `syz.3.1552'. [ 239.873819][T11863] veth0_to_bond: entered allmulticast mode [ 239.996033][T11834] netlink: 20 bytes leftover after parsing attributes in process `syz.2.1550'. [ 240.050045][T11876] netlink: 'syz.1.1563': attribute type 1 has an invalid length. [ 240.171133][T11876] 8021q: adding VLAN 0 to HW filter on device bond4 [ 240.259455][T11881] 8021q: adding VLAN 0 to HW filter on device bond4 [ 240.278785][T11881] bond4: (slave vxcan3): The slave device specified does not support setting the MAC address [ 240.291710][T11888] netlink: 'syz.0.1554': attribute type 1 has an invalid length. [ 240.299532][T11881] bond4: (slave vxcan3): Error -95 calling set_mac_address [ 240.314810][T11888] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 240.715194][T11905] netlink: 36 bytes leftover after parsing attributes in process `syz.1.1568'. [ 240.888562][T11913] netlink: 'syz.1.1571': attribute type 83 has an invalid length. [ 240.961764][T11921] netlink: 32 bytes leftover after parsing attributes in process `syz.3.1572'. [ 241.087290][T11925] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1573'. [ 241.112256][T11925] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1573'. [ 241.348347][T11933] 8021q: adding VLAN 0 to HW filter on device ipvlan2 [ 241.355878][T11933] bond0: (slave ipvlan2): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 241.472589][T11939] netlink: 36 bytes leftover after parsing attributes in process `syz.1.1579'. [ 241.748656][T11962] netlink: 108 bytes leftover after parsing attributes in process `syz.3.1588'. [ 241.771314][T11962] netlink: 108 bytes leftover after parsing attributes in process `syz.3.1588'. [ 241.787352][T11962] netlink: 'syz.3.1588': attribute type 11 has an invalid length. [ 241.859192][T11968] veth0_to_bridge: left allmulticast mode [ 241.864999][T11968] veth0_to_bridge: left promiscuous mode [ 241.878551][T11968] bridge0: port 1(veth0_to_bridge) entered disabled state [ 241.923531][T11968] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 242.091820][T11983] netlink: zone id is out of range [ 242.152322][T11983] netlink: del zone limit has 4 unknown bytes [ 243.293347][T12058] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 243.429730][T12067] syzkaller1: entered promiscuous mode [ 243.435344][T12067] syzkaller1: entered allmulticast mode [ 243.604499][T12079] netlink: 'syz.2.1625': attribute type 1 has an invalid length. [ 243.736770][T12091] netlink: 'syz.2.1625': attribute type 1 has an invalid length. [ 243.762009][T12079] bond3: entered promiscuous mode [ 243.797669][T12079] 8021q: adding VLAN 0 to HW filter on device bond3 [ 243.831554][T12100] bridge0: received packet on syz_tun with own address as source address (addr:aa:aa:aa:aa:aa:aa, vlan:0) [ 243.844845][T12098] x_tables: ip6_tables: quota.0 match: invalid size 24 (kernel) != (user) 144 [ 243.862376][T12101] netlink: 'syz.1.1631': attribute type 11 has an invalid length. [ 243.873282][T12079] openvswitch: netlink: Unexpected mask (mask=200040, allowed=10048) [ 243.886936][T12104] netlink: 'syz.0.1632': attribute type 1 has an invalid length. [ 243.911887][T12086] 8021q: adding VLAN 0 to HW filter on device bond3 [ 243.922072][T12104] netlink: 'syz.0.1632': attribute type 10 has an invalid length. [ 243.932974][T12086] bond3: (slave wireguard0): The slave device specified does not support setting the MAC address [ 243.947212][T12104] netlink: 'syz.0.1632': attribute type 4 has an invalid length. [ 243.963594][T12086] bond3: (slave wireguard0): Setting fail_over_mac to active for active-backup mode [ 243.983799][T12086] bond3: (slave wireguard0): making interface the new active one [ 243.994502][T12086] wireguard0: entered promiscuous mode [ 244.002884][T12086] bond3: (slave wireguard0): Enslaving as an active interface with an up link [ 244.172156][T12112] tipc: Enabled bearer , priority 0 [ 244.215269][T12112] syzkaller0: entered promiscuous mode [ 244.221130][T12112] syzkaller0: entered allmulticast mode [ 244.255887][T12119] syzkaller0: entered promiscuous mode [ 244.264270][T12119] syzkaller0: entered allmulticast mode [ 244.310812][T12112] tipc: Resetting bearer [ 244.320541][T12119] syzkaller0: mtu less than device minimum [ 244.330634][T12111] tipc: Resetting bearer [ 244.393084][T12111] tipc: Disabling bearer [ 244.522684][T12130] __nla_validate_parse: 18 callbacks suppressed [ 244.522704][T12130] netlink: 240 bytes leftover after parsing attributes in process `syz.4.1637'. [ 244.650002][T12135] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1642'. [ 244.711008][T12135] netlink: 'syz.0.1642': attribute type 21 has an invalid length. [ 244.749537][T12135] netlink: 132 bytes leftover after parsing attributes in process `syz.0.1642'. [ 244.941167][T12154] netlink: 32 bytes leftover after parsing attributes in process `syz.0.1649'. [ 245.254273][T12176] netlink: 'syz.2.1658': attribute type 1 has an invalid length. [ 245.263850][T12178] netlink: 'syz.3.1656': attribute type 1 has an invalid length. [ 245.277046][T12176] netlink: 184 bytes leftover after parsing attributes in process `syz.2.1658'. [ 245.286362][T12178] netlink: 'syz.3.1656': attribute type 11 has an invalid length. [ 245.302291][T12176] netlink: 'syz.2.1658': attribute type 1 has an invalid length. [ 245.312357][T12178] netlink: 224 bytes leftover after parsing attributes in process `syz.3.1656'. [ 245.334777][T12186] netlink: 100 bytes leftover after parsing attributes in process `syz.1.1661'. [ 245.384816][T12186] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1661'. [ 245.407560][ T36] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 245.427379][T12192] netlink: 100 bytes leftover after parsing attributes in process `syz.1.1661'. [ 245.440664][ T8072] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 245.450541][ T36] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 245.474197][T12193] netlink: 16 bytes leftover after parsing attributes in process `syz.4.1662'. [ 245.964911][T12237] netlink: 'syz.3.1674': attribute type 1 has an invalid length. [ 246.013303][T12235] netlink: 'syz.2.1675': attribute type 25 has an invalid length. [ 246.104367][T12237] 8021q: adding VLAN 0 to HW filter on device bond10 [ 246.119284][ T8072] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 246.122917][T12229] bridge0: port 1(bridge_slave_0) entered disabled state [ 246.358155][ T8072] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 246.369950][T12256] netlink: 'syz.2.1680': attribute type 1 has an invalid length. [ 246.507698][T12256] 8021q: adding VLAN 0 to HW filter on device bond4 [ 246.552704][T12256] netlink: 'syz.2.1680': attribute type 39 has an invalid length. [ 246.696254][T12256] veth7: entered promiscuous mode [ 246.811525][T12286] netlink: 'syz.2.1688': attribute type 1 has an invalid length. [ 247.115063][T12303] netlink: 'syz.2.1692': attribute type 23 has an invalid length. [ 247.240643][T12310] netdevsim netdevsim2 ÿÿÿÿÿÿ: renamed from netdevsim0 (while UP) [ 248.125774][T12365] tipc: Enabling of bearer rejected, failed to enable media [ 248.154032][T12365] tipc: Enabling of bearer rejected, failed to enable media [ 248.171779][T12365] tipc: Enabling of bearer rejected, failed to enable media [ 248.182614][T12365] tipc: Enabling of bearer rejected, failed to enable media [ 248.194099][T12365] tipc: Enabling of bearer rejected, failed to enable media [ 248.215561][T12365] tipc: Enabling of bearer rejected, failed to enable media [ 248.245700][T12346] can: request_module (can-proto-5) failed. [ 248.275784][T12365] tipc: Enabling of bearer rejected, failed to enable media [ 248.305782][T12365] tipc: Enabling of bearer rejected, failed to enable media [ 248.316343][T12365] tipc: Enabling of bearer rejected, failed to enable media [ 248.384725][T12365] tipc: Enabling of bearer rejected, failed to enable media [ 248.399705][T12365] tipc: Enabling of bearer rejected, failed to enable media [ 248.411200][T12365] tipc: Enabling of bearer rejected, failed to enable media [ 248.421965][T12365] tipc: Enabling of bearer rejected, failed to enable media [ 248.433244][T12365] tipc: Enabling of bearer rejected, failed to enable media [ 248.479417][T12365] tipc: Enabling of bearer rejected, failed to enable media [ 248.494438][T12365] tipc: Enabling of bearer rejected, failed to enable media [ 248.512222][T12365] tipc: Enabling of bearer rejected, failed to enable media [ 248.567072][T12365] tipc: Enabling of bearer rejected, failed to enable media [ 248.576652][T12365] tipc: Enabling of bearer rejected, failed to enable media [ 248.592357][T12365] tipc: Enabling of bearer rejected, failed to enable media [ 248.613025][T12365] tipc: Enabling of bearer rejected, failed to enable media [ 248.623891][T12365] tipc: Enabling of bearer rejected, failed to enable media [ 248.636524][T12379] syzkaller1: entered promiscuous mode [ 248.643912][T12379] syzkaller1: entered allmulticast mode [ 248.658767][T12365] tipc: Enabling of bearer rejected, failed to enable media [ 248.670206][T12365] tipc: Enabling of bearer rejected, failed to enable media [ 248.695442][T12365] tipc: Enabling of bearer rejected, failed to enable media [ 248.720372][T12365] tipc: Enabling of bearer rejected, failed to enable media [ 248.738791][T12365] tipc: Enabling of bearer rejected, failed to enable media [ 248.801574][T12365] tipc: Enabling of bearer rejected, failed to enable media [ 248.831797][T12365] tipc: Enabling of bearer rejected, failed to enable media [ 248.847044][T12365] tipc: Enabling of bearer rejected, failed to enable media [ 248.879809][T12365] tipc: Enabling of bearer rejected, failed to enable media [ 248.910142][T12365] tipc: Enabling of bearer rejected, failed to enable media [ 249.238032][ C0] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 249.679583][T12431] __nla_validate_parse: 16 callbacks suppressed [ 249.679605][T12431] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1732'. [ 249.815985][T12433] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for gretap1 [ 249.842595][T12433] gretap1: default qdisc (pfifo_fast) fail, fallback to noqueue [ 249.852348][T12433] gretap1: entered promiscuous mode [ 249.857702][T12433] gretap1: entered allmulticast mode [ 249.894089][T12428] netlink: 56 bytes leftover after parsing attributes in process `syz.1.1732'. [ 250.213473][T12451] 8021q: adding VLAN 0 to HW filter on device bond4 [ 250.237352][T12455] veth5: entered promiscuous mode [ 250.246809][T12455] bond4: (slave veth5): Enslaving as an active interface with a down link [ 250.266795][T12451] vlan0: entered allmulticast mode [ 250.272636][T12451] bond4: entered allmulticast mode [ 250.280404][T12451] bond4: (slave vlan0): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 250.578909][ T51] Bluetooth: hci4: link tx timeout [ 250.584685][ T51] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 250.594509][ T51] Bluetooth: hci4: link tx timeout [ 250.601613][ T51] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 250.801475][T12491] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 250.818766][T12489] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1747'. [ 250.844063][T12494] nbd: must specify at least one socket [ 250.850361][T12495] nbd: must specify at least one socket [ 251.172616][T12516] validate_nla: 4 callbacks suppressed [ 251.172637][T12516] netlink: 'syz.0.1756': attribute type 1 has an invalid length. [ 251.291601][T12521] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1757'. [ 251.308993][T12521] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1757'. [ 251.676879][T12556] syzkaller0: entered promiscuous mode [ 251.696673][T12556] syzkaller0: entered allmulticast mode [ 251.858737][T12569] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1770'. [ 251.993224][T12574] team0: Mode changed to "loadbalance" [ 252.017183][T12578] netlink: 'syz.2.1773': attribute type 1 has an invalid length. [ 252.055968][T12578] 8021q: adding VLAN 0 to HW filter on device bond5 [ 252.129906][T12578] 8021q: adding VLAN 0 to HW filter on device bond5 [ 252.157712][T12578] bond5: (slave vxcan3): The slave device specified does not support setting the MAC address [ 252.180067][T12578] bond5: (slave vxcan3): Error -95 calling set_mac_address [ 252.219949][T12591] ip6gre1: entered allmulticast mode [ 252.226355][T12588] netlink: 'syz.4.1777': attribute type 1 has an invalid length. [ 252.234938][T12588] netlink: 244 bytes leftover after parsing attributes in process `syz.4.1777'. [ 252.323195][T12600] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1780'. [ 252.513165][T12618] netlink: 44 bytes leftover after parsing attributes in process `syz.3.1784'. [ 252.554980][T12611] llcp: llcp_sock_recvmsg: Recv datagram failed state 3 -6 0 [ 252.680581][ T5188] Bluetooth: hci4: command 0x0405 tx timeout [ 252.793190][ T8084] IPVS: starting estimator thread 0... [ 252.800086][T12633] IPVS: dh: FWM 3 0x00000003 - no destination available [ 252.809627][T12633] IPVS: dh: FWM 3 0x00000003 - no destination available [ 252.831547][T12628] netlink: 256 bytes leftover after parsing attributes in process `syz.2.1789'. [ 252.898897][T12634] IPVS: using max 27 ests per chain, 64800 per kthread [ 253.042102][T12650] bridge: RTM_NEWNEIGH with invalid state 0x8 [ 253.167278][T12662] netlink: 'syz.4.1802': attribute type 1 has an invalid length. [ 253.374076][T12679] netlink: 'syz.2.1804': attribute type 21 has an invalid length. [ 253.385198][T12679] (unnamed net_device) (uninitialized): option lacp_rate: mode dependency failed, not supported in mode broadcast(3) [ 253.486808][T12689] 8021q: adding VLAN 0 to HW filter on device bond6 [ 254.259276][T12698] netlink: 'syz.3.1810': attribute type 47 has an invalid length. [ 254.456935][T12715] unsupported nlmsg_type 40 [ 254.469131][T12712] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for gretap2 [ 254.486956][T12712] gretap2: default qdisc (pfifo_fast) fail, fallback to noqueue [ 254.495685][T12712] gretap2: entered promiscuous mode [ 254.502827][T12712] gretap2: entered allmulticast mode [ 254.822063][T12734] net veth1_virt_wifi .: renamed from virt_wifi0 [ 255.030892][ T36] netdevsim netdevsim3 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 255.049299][ T36] netdevsim netdevsim3 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 255.067138][ T36] netdevsim netdevsim3 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 255.093779][ T36] netdevsim netdevsim3 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 255.103336][T12754] __nla_validate_parse: 9 callbacks suppressed [ 255.103354][T12754] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1826'. [ 255.120371][T12754] netlink: 92 bytes leftover after parsing attributes in process `syz.2.1826'. [ 255.132893][T12757] netlink: 64 bytes leftover after parsing attributes in process `syz.1.1828'. [ 255.134125][T12754] lo speed is unknown, defaulting to 1000 [ 255.149969][T12754] lo speed is unknown, defaulting to 1000 [ 255.160795][T12754] lo speed is unknown, defaulting to 1000 [ 255.161584][T12757] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1828'. [ 255.185874][T12754] infiniband syz2: RDMA CMA: cma_listen_on_dev, error -98 [ 255.240675][T12754] lo speed is unknown, defaulting to 1000 [ 255.252312][T12754] lo speed is unknown, defaulting to 1000 [ 255.264972][T12754] lo speed is unknown, defaulting to 1000 [ 255.315316][T12762] 8021q: adding VLAN 0 to HW filter on device bond7 [ 255.326414][T12754] lo speed is unknown, defaulting to 1000 [ 255.332538][T12762] netlink: 160 bytes leftover after parsing attributes in process `syz.1.1830'. [ 255.342290][T12763] netlink: 160 bytes leftover after parsing attributes in process `syz.1.1830'. [ 255.351515][T12754] lo speed is unknown, defaulting to 1000 [ 255.367176][T12763] bond7: (slave gretap1): Enslaving as an active interface with an up link [ 255.388499][T12769] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1831'. [ 255.413189][T12769] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1831'. [ 255.446968][T12769] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1831'. [ 255.526329][T12775] netlink: 32 bytes leftover after parsing attributes in process `syz.2.1833'. [ 255.723239][ T1307] ieee802154 phy0 wpan0: encryption failed: -22 [ 255.964123][T12800] netlink: 'syz.3.1839': attribute type 4 has an invalid length. [ 256.012179][T12807] netlink: 'syz.0.1840': attribute type 8 has an invalid length. [ 256.037758][T12806] nftables ruleset with unbound set [ 256.083474][T12815] openvswitch: netlink: Message has 4 unknown bytes. [ 256.094766][T12815] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 256.334389][T12829] bond0: entered promiscuous mode [ 256.358022][ C0] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 256.369794][T12829] bond0: left promiscuous mode [ 258.017121][T12943] gtp0: entered promiscuous mode [ 258.040122][T12943] gtp0: entered allmulticast mode [ 258.193973][T12957] veth0: entered promiscuous mode [ 258.201803][T12959] netlink: 'syz.0.1879': attribute type 1 has an invalid length. [ 258.292080][T12959] 8021q: adding VLAN 0 to HW filter on device bond8 [ 258.380895][T12963] veth11: entered promiscuous mode [ 258.393800][T12963] bond8: (slave veth11): Enslaving as an active interface with an up link [ 258.503205][T12954] veth0: left promiscuous mode [ 258.524565][T12952] lo speed is unknown, defaulting to 1000 [ 259.855230][T13045] netlink: 'syz.1.1901': attribute type 2 has an invalid length. [ 259.877368][T13046] netlink: 'syz.0.1902': attribute type 1 has an invalid length. [ 259.945603][T13048] netlink: 'syz.3.1898': attribute type 4 has an invalid length. [ 259.996728][T13055] netlink: 'syz.3.1898': attribute type 4 has an invalid length. [ 260.117710][T13064] veth13: entered promiscuous mode [ 260.230118][T13068] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 260.277148][T13073] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 260.457967][T13087] openvswitch: netlink: ERSPAN option length err (len 256, max 255). [ 260.764030][T13107] (unnamed net_device) (uninitialized): option mode: invalid value (133) [ 260.827583][T13112] netlink: 'syz.2.1918': attribute type 32 has an invalid length. [ 260.846631][T13112] __nla_validate_parse: 23 callbacks suppressed [ 260.847032][T13112] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1918'. [ 260.961967][T13116] lo speed is unknown, defaulting to 1000 [ 260.968574][T13112] (unnamed net_device) (uninitialized): Setting coupled_control to off (0) [ 260.980819][T13112] workqueue: Failed to create a rescuer kthread for wq "bond7": -EINTR [ 261.066861][T13122] macsec0: entered promiscuous mode [ 261.112503][T13122] macsec0: left promiscuous mode [ 261.117677][T13122] macsec0: left allmulticast mode [ 261.123973][T13126] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1922'. [ 261.517102][T13147] netlink: 'syz.0.1925': attribute type 21 has an invalid length. [ 261.529809][T13147] netlink: 156 bytes leftover after parsing attributes in process `syz.0.1925'. [ 261.795002][T13175] netlink: 28 bytes leftover after parsing attributes in process `syz.4.1933'. [ 261.834306][T13177] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1934'. [ 262.065240][T13193] netlink: 64138 bytes leftover after parsing attributes in process `syz.0.1939'. [ 262.118414][ C1] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 262.149008][T13198] sctp: [Deprecated]: syz.3.1940 (pid 13198) Use of int in maxseg socket option. [ 262.149008][T13198] Use struct sctp_assoc_value instead [ 262.185675][T13200] netlink: 32 bytes leftover after parsing attributes in process `syz.0.1941'. [ 262.233420][T13202] veth0: entered promiscuous mode [ 262.240924][T13202] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1942'. [ 262.347252][T13202] veth0 (unregistering): left promiscuous mode [ 262.536299][T13217] netlink: 'syz.0.1945': attribute type 33 has an invalid length. [ 262.933762][T13250] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1953'. [ 263.138642][T13260] mac80211_hwsim hwsim10 syzkaller0: entered promiscuous mode [ 263.162581][T13260] mac80211_hwsim hwsim10 syzkaller0: entered allmulticast mode [ 263.219685][ T8072] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 263.240635][T13263] xfrm1: left allmulticast mode [ 263.263986][T13263] gtp0: left allmulticast mode [ 263.273682][ T8071] lo speed is unknown, defaulting to 1000 [ 263.355613][T13278] netlink: 48 bytes leftover after parsing attributes in process `syz.2.1961'. [ 263.406590][T13280] netlink: 'syz.1.1962': attribute type 1 has an invalid length. [ 263.613560][T13293] netlink: 'syz.4.1965': attribute type 16 has an invalid length. [ 263.659342][T13293] netlink: 'syz.4.1965': attribute type 17 has an invalid length. [ 263.713685][T13293] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 263.841704][ T8071] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 263.872174][T13312] netlink: 'syz.1.1971': attribute type 12 has an invalid length. [ 264.146764][T13320] gtp2: entered promiscuous mode [ 264.153681][T13320] gtp2: entered allmulticast mode [ 264.916548][T13381] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 265.779521][T13440] tipc: Enabled bearer , priority 0 [ 265.789074][T13440] syzkaller0: entered promiscuous mode [ 265.794590][T13440] syzkaller0: entered allmulticast mode [ 265.856615][T13440] tipc: Resetting bearer [ 265.884536][T13439] tipc: Resetting bearer [ 265.911619][T13457] __nla_validate_parse: 11 callbacks suppressed [ 265.911642][T13457] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2013'. [ 265.953386][T13439] tipc: Disabling bearer [ 266.091911][T13463] netlink: 52 bytes leftover after parsing attributes in process `syz.3.2016'. [ 266.115137][T13467] netlink: 24 bytes leftover after parsing attributes in process `syz.1.2018'. [ 266.255932][T13472] tipc: Enabled bearer , priority 0 [ 266.283347][T13472] syzkaller0: entered promiscuous mode [ 266.291218][T13472] syzkaller0: entered allmulticast mode [ 266.492000][T13490] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2023'. [ 266.544198][T13487] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2024'. [ 266.606861][T13490] bond0: (slave bridge_slave_1): Releasing backup interface [ 266.695457][T13492] bond4: (slave veth5): Releasing active interface [ 266.708829][T13469] tipc: Resetting bearer [ 266.732300][T13469] tipc: Disabling bearer [ 266.767418][T13487] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2024'. [ 266.794950][T13504] IPVS: set_ctl: invalid protocol: 46 10.1.1.1:20000 [ 266.816576][T13505] IPVS: sync thread started: state = BACKUP, mcast_ifn = wg1, syncid = 0, id = 0 [ 267.102275][T13522] netlink: 'syz.3.2034': attribute type 2 has an invalid length. [ 267.119747][T13522] netlink: 244 bytes leftover after parsing attributes in process `syz.3.2034'. [ 267.554915][T13547] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 268.186854][T13567] netlink: 40 bytes leftover after parsing attributes in process `syz.3.2050'. [ 268.492522][T13595] netlink: 'syz.0.2054': attribute type 1 has an invalid length. [ 268.655418][T13607] netlink: 340 bytes leftover after parsing attributes in process `syz.2.2057'. [ 268.692777][T13611] netlink: 340 bytes leftover after parsing attributes in process `syz.2.2057'. [ 268.815181][T13621] sch_tbf: burst 19872 is lower than device lo mtu (11337746) ! [ 268.959051][T13619] delete_channel: no stack [ 269.208623][T13649] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 269.693597][T13676] sctp: [Deprecated]: syz.2.2077 (pid 13676) Use of int in max_burst socket option deprecated. [ 269.693597][T13676] Use struct sctp_assoc_value instead [ 270.142734][T13713] openvswitch: netlink: Flow key attr not present in new flow. [ 270.337462][T13693] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 270.376209][T13693] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 270.395450][T13693] bond0 (unregistering): Released all slaves [ 270.447985][ C0] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 270.841389][T13727] xfrm1: left promiscuous mode [ 270.852587][T13727] team0: left promiscuous mode [ 270.863508][T13727] veth0_macvtap: left allmulticast mode [ 270.871719][T13727] geneve3: left promiscuous mode [ 270.878695][T13727] vlan2: left promiscuous mode [ 270.883503][T13727] bridge0: left promiscuous mode [ 270.888983][T13727] veth3: left promiscuous mode [ 270.894399][T13727] gtp0: left promiscuous mode [ 270.904759][T13727] mac80211_hwsim hwsim10 syzkaller0: left promiscuous mode [ 270.913623][T13727] veth5: left promiscuous mode [ 270.950261][ T1151] netdevsim netdevsim4 ÿÿÿÿÿÿ: unset [0, 0] type 1 family 0 port 8472 - 0 [ 270.978101][ T1151] netdevsim netdevsim4 ÿÿÿÿÿÿ: unset [1, 0] type 2 family 0 port 6081 - 0 [ 270.997305][ T1151] netdevsim netdevsim4 ÿÿÿÿÿÿ: unset [1, 1] type 2 family 0 port 256 - 0 [ 271.016048][ T1151] netdevsim netdevsim4 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 271.036156][ T1151] netdevsim netdevsim4 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 271.046461][ T1151] netdevsim netdevsim4 netdevsim1: unset [1, 1] type 2 family 0 port 256 - 0 [ 271.068678][T13742] netem: change failed [ 271.124500][ T1151] netdevsim netdevsim4 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 271.168299][ T1151] netdevsim netdevsim4 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 271.236627][ T1151] netdevsim netdevsim4 netdevsim2: unset [1, 1] type 2 family 0 port 256 - 0 [ 271.258931][ T1151] netdevsim netdevsim4 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 271.303488][ T1151] netdevsim netdevsim4 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 271.354670][ T1151] netdevsim netdevsim4 netdevsim3: unset [1, 1] type 2 family 0 port 256 - 0 [ 271.379636][T13762] __nla_validate_parse: 13 callbacks suppressed [ 271.379664][T13762] netlink: 56 bytes leftover after parsing attributes in process `syz.2.2101'. [ 271.435718][T13764] netlink: 232 bytes leftover after parsing attributes in process `syz.4.2102'. [ 271.489144][T13762] netlink: 56 bytes leftover after parsing attributes in process `syz.2.2101'. [ 271.766494][T13783] netlink: 20 bytes leftover after parsing attributes in process `syz.0.2107'. [ 271.824806][T13785] netlink: 52 bytes leftover after parsing attributes in process `syz.2.2106'. [ 272.357598][T13818] syzkaller1: entered promiscuous mode [ 272.375652][T13818] syzkaller1: entered allmulticast mode [ 272.429911][T13823] openvswitch: netlink: Missing key (keys=40, expected=200000) [ 273.106764][T13854] netlink: 'syz.2.2123': attribute type 3 has an invalid length. [ 273.385017][T13873] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2129'. [ 273.403039][T13873] netlink: 'syz.0.2129': attribute type 20 has an invalid length. [ 273.412730][T13873] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2129'. [ 273.423503][T13873] netlink: 'syz.0.2129': attribute type 20 has an invalid length. [ 273.546471][T13881] netlink: 28 bytes leftover after parsing attributes in process `syz.0.2134'. [ 273.801728][T13898] openvswitch: netlink: IP tunnel TTL not specified. [ 273.949026][ T8082] lo speed is unknown, defaulting to 1000 [ 273.954907][ T8082] syz2: Port: 1 Link DOWN [ 274.115432][T13915] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2147'. [ 274.294378][T13926] netlink: 40 bytes leftover after parsing attributes in process `syz.4.2150'. [ 274.409768][T13928] veth1_macvtap: left promiscuous mode [ 274.419606][T13928] macsec0: entered promiscuous mode [ 274.424864][T13928] macsec0: entered allmulticast mode [ 274.472662][T13944] veth1_macvtap: entered promiscuous mode [ 274.482659][T13944] veth1_macvtap: entered allmulticast mode [ 274.509885][T13944] macsec0: left promiscuous mode [ 274.515102][T13944] macsec0: left allmulticast mode [ 274.530011][T13944] veth1_macvtap: left allmulticast mode [ 274.730195][T13960] netem: unknown loss type 0 [ 274.746407][T13960] netem: change failed [ 274.939682][T13973] IPv6: sit1: Disabled Multicast RS [ 274.960621][T13973] sit1: entered allmulticast mode [ 275.183106][T13988] netlink: 'syz.3.2171': attribute type 1 has an invalid length. [ 275.330101][T13996] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for gretap3 [ 275.343037][T13996] gretap3: entered promiscuous mode [ 276.101307][T14045] mac80211_hwsim hwsim10 syzkaller0: left allmulticast mode [ 276.260594][T14057] netlink: 'syz.4.2191': attribute type 4 has an invalid length. [ 276.683932][T14082] netlink: 'syz.1.2200': attribute type 1 has an invalid length. [ 276.721993][T14082] 8021q: adding VLAN 0 to HW filter on device bond10 [ 276.752905][T14082] 8021q: adding VLAN 0 to HW filter on device bond10 [ 276.761597][T14082] bond10: (slave vxcan5): The slave device specified does not support setting the MAC address [ 276.779983][T14082] bond10: (slave vxcan5): Error -95 calling set_mac_address [ 276.815841][T14086] __nla_validate_parse: 7 callbacks suppressed [ 276.815862][T14086] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2201'. [ 277.115256][T14105] netlink: 'syz.0.2207': attribute type 1 has an invalid length. [ 277.124019][T14106] netlink: 'syz.0.2207': attribute type 1 has an invalid length. [ 277.405294][T14118] sctp: [Deprecated]: syz.3.2210 (pid 14118) Use of struct sctp_assoc_value in delayed_ack socket option. [ 277.405294][T14118] Use struct sctp_sack_info instead [ 277.498168][T14125] openvswitch: netlink: Unexpected mask (mask=240, allowed=10048) [ 277.543336][T14124] netlink: 68 bytes leftover after parsing attributes in process `syz.0.2211'. [ 277.875719][T14144] mac80211_hwsim hwsim5 ÿ: renamed from wlan1 [ 277.968837][T14144] vlan3: entered promiscuous mode [ 277.974555][T14144] bridge0: entered promiscuous mode [ 277.984008][T14147] netlink: 'syz.0.2217': attribute type 5 has an invalid length. [ 278.298674][T14160] delete_channel: no stack [ 278.523768][T14182] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2227'. [ 278.599960][T14187] netlink: 'syz.1.2227': attribute type 1 has an invalid length. [ 278.672927][T14187] 8021q: adding VLAN 0 to HW filter on device bond11 [ 278.720997][T14190] vlan0: entered promiscuous mode [ 278.726582][T14190] bond11: entered promiscuous mode [ 278.733012][T14190] vlan0: entered allmulticast mode [ 278.738608][T14190] bond11: entered allmulticast mode [ 278.764189][T14196] openvswitch: netlink: IP tunnel attribute has 12 unknown bytes. [ 278.981329][T14215] netlink: 212408 bytes leftover after parsing attributes in process `syz.2.2238'. [ 279.055973][T14222] netlink: 52 bytes leftover after parsing attributes in process `syz.1.2237'. [ 279.065679][T14223] netlink: 52 bytes leftover after parsing attributes in process `syz.1.2237'. [ 279.355261][T14244] ieee802154 phy0 wpan0: encryption failed: -22 [ 280.643142][T14313] tipc: Enabling of bearer rejected, failed to enable media [ 280.766547][T14321] bridge0: received packet on syz_tun with own address as source address (addr:aa:aa:aa:aa:aa:aa, vlan:0) [ 280.785450][T14320] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2268'. [ 280.801362][T14320] openvswitch: netlink: nsh attr 8196 is out of range max 3 [ 280.808950][T14320] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 280.855985][T14320] netlink: 212 bytes leftover after parsing attributes in process `syz.1.2268'. [ 281.109507][T14321] syz.3.2267 (14321) used greatest stack depth: 16680 bytes left [ 281.256702][T14344] netlink: 64 bytes leftover after parsing attributes in process `syz.1.2273'. [ 281.351416][T14348] netlink: 4552 bytes leftover after parsing attributes in process `syz.2.2276'. [ 282.251705][T14393] netlink: 'syz.4.2290': attribute type 17 has an invalid length. [ 282.276896][T14393] __nla_validate_parse: 3 callbacks suppressed [ 282.276917][T14393] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2290'. [ 282.335988][T14393] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2290'. [ 282.436045][T14397] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2291'. [ 282.457647][T14393] gretap0: entered promiscuous mode [ 282.471291][T14399] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2292'. [ 282.481523][T14393] gretap0: left promiscuous mode [ 282.487674][T14399] netlink: 'syz.3.2292': attribute type 5 has an invalid length. [ 282.496475][T14399] netlink: 20 bytes leftover after parsing attributes in process `syz.3.2292'. [ 282.857585][T14421] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2298'. [ 282.866758][T14422] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2298'. [ 282.987240][T14431] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2301'. [ 283.176913][T14455] netlink: 152 bytes leftover after parsing attributes in process `syz.3.2303'. [ 283.956088][T14487] netlink: 28 bytes leftover after parsing attributes in process `syz.3.2311'. [ 285.142495][T14543] netlink: 'syz.1.2326': attribute type 64 has an invalid length. [ 285.435374][T14562] netlink: 'syz.1.2331': attribute type 1 has an invalid length. [ 286.366467][T14608] netlink: 'syz.3.2343': attribute type 10 has an invalid length. [ 286.792919][ T13] netdevsim netdevsim0 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 286.802637][ T13] netdevsim netdevsim0 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 286.822198][ T13] netdevsim netdevsim0 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 286.845970][ T13] netdevsim netdevsim0 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 287.401777][T14662] openvswitch: netlink: IP tunnel attribute has 8 unknown bytes. [ 287.548098][T14670] IPVS: Unknown mcast interface: team0 [ 287.822110][T14692] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 287.900194][T14697] __nla_validate_parse: 5 callbacks suppressed [ 287.900216][T14697] netlink: 212364 bytes leftover after parsing attributes in process `syz.4.2371'. [ 287.917529][T14697] openvswitch: netlink: Message has 5 unknown bytes. [ 288.064176][T14704] netlink: 'syz.0.2373': attribute type 16 has an invalid length. [ 288.092981][T14704] netlink: 'syz.0.2373': attribute type 17 has an invalid length. [ 288.146862][T14704] lo: left allmulticast mode [ 288.187365][T14704] tunl0: left allmulticast mode [ 288.220245][T14704] gre0: left allmulticast mode [ 288.267188][T14704] gretap0: left allmulticast mode [ 288.290529][T14704] erspan0: left allmulticast mode [ 288.322065][T14704] ip_vti0: left allmulticast mode [ 288.344435][T14704] ip6_vti0: left allmulticast mode [ 288.361115][T14704] sit0: left allmulticast mode [ 288.374158][T14704] ip6tnl0: left allmulticast mode [ 288.386928][T14704] ip6gre0: left allmulticast mode [ 288.394637][T14704] ip6gretap0: left allmulticast mode [ 288.425140][T14704] bridge0: left allmulticast mode [ 288.435875][T14704] bond0: left allmulticast mode [ 288.444565][T14704] 8021q: adding VLAN 0 to HW filter on device bond0 [ 288.448231][T14724] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2380'. [ 288.453998][T14704] team0: left allmulticast mode [ 288.468867][T14704] 8021q: adding VLAN 0 to HW filter on device team0 [ 288.476316][T14704] dummy0: left allmulticast mode [ 288.485655][T14704] nlmon0: left allmulticast mode [ 288.506703][T14704] caif0: left allmulticast mode [ 288.512124][T14732] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2380'. [ 288.520759][T14704] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 288.680769][T14724] netlink: 52 bytes leftover after parsing attributes in process `syz.1.2380'. [ 288.691224][T14724] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2380'. [ 288.703830][ T8071] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 288.776394][T14744] netlink: 'syz.3.2385': attribute type 7 has an invalid length. [ 289.008616][ T8072] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 289.058948][ T36] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 289.084164][T14769] netlink: 64985 bytes leftover after parsing attributes in process `syz.4.2390'. [ 290.119486][ T1089] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 290.158637][ T1089] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 290.177674][T14806] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2404'. [ 290.510054][T14835] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2409'. [ 290.552246][T14840] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2410'. [ 290.651610][T14830] 8021q: adding VLAN 0 to HW filter on device bond0 [ 290.671137][T14830] 8021q: adding VLAN 0 to HW filter on device team0 [ 290.701460][T14830] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 290.755978][T14839] macsec0: entered promiscuous mode [ 290.765123][T14839] macsec0: entered allmulticast mode [ 290.787423][T14844] macsec0: left promiscuous mode [ 290.834314][T14844] macsec0: left allmulticast mode [ 291.039553][T14863] netlink: 240 bytes leftover after parsing attributes in process `syz.3.2416'. [ 292.591803][T14939] sctp: [Deprecated]: syz.1.2436 (pid 14939) Use of struct sctp_assoc_value in delayed_ack socket option. [ 292.591803][T14939] Use struct sctp_sack_info instead [ 292.924816][T14959] __nla_validate_parse: 5 callbacks suppressed [ 292.924838][T14959] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2444'. [ 293.039916][T14963] netlink: 28 bytes leftover after parsing attributes in process `syz.3.2446'. [ 293.054988][T14963] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2446'. [ 293.129314][T14964] netlink: 'syz.0.2447': attribute type 1 has an invalid length. [ 293.138589][T14964] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2447'. [ 293.149654][T14964] netlink: 'syz.0.2447': attribute type 1 has an invalid length. [ 293.157412][T14964] netlink: 16150 bytes leftover after parsing attributes in process `syz.0.2447'. [ 293.178023][T14964] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2447'. [ 293.227355][T14972] netlink: 6 bytes leftover after parsing attributes in process `syz.3.2451'. [ 293.285959][T14977] netlink: 'syz.4.2452': attribute type 1 has an invalid length. [ 293.565646][T15004] netlink: 'syz.1.2458': attribute type 4 has an invalid length. [ 293.672296][T15012] netlink: 'syz.3.2460': attribute type 10 has an invalid length. [ 293.755219][T15022] netlink: 'syz.2.2461': attribute type 1 has an invalid length. [ 293.823467][T15022] bond0: (slave ipvlan0): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 293.837082][T15022] bond0: (slave ipvlan0): The slave device specified does not support setting the MAC address [ 293.848720][T15022] bond0: (slave ipvlan0): Setting fail_over_mac to active for active-backup mode [ 293.928625][T15025] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2464'. [ 293.938262][T15025] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2464'. [ 294.019628][ T1151] netdevsim netdevsim1 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 294.030066][ T1151] netdevsim netdevsim1 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 294.047472][T15025] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2464'. [ 294.048667][ T1151] netdevsim netdevsim1 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 294.082339][ T1151] netdevsim netdevsim1 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 294.174919][T15041] 8021q: adding VLAN 0 to HW filter on device ipvlan0 [ 294.187252][T15041] bond0: (slave ipvlan0): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 294.286771][T15050] ieee802154 phy0 wpan0: encryption failed: -22 [ 294.288181][ C1] net_ratelimit: 1 callbacks suppressed [ 294.288201][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 294.385597][T15047] syzkaller0: tun_chr_ioctl cmd 1074025677 [ 294.393190][T15047] syzkaller0: linktype set to 778 [ 294.457105][T15055] netlink: 'syz.4.2472': attribute type 3 has an invalid length. [ 294.624992][T15066] netlink: 'syz.2.2477': attribute type 4 has an invalid length. [ 294.923051][T15080] sctp: [Deprecated]: syz.2.2481 (pid 15080) Use of struct sctp_assoc_value in delayed_ack socket option. [ 294.923051][T15080] Use struct sctp_sack_info instead [ 294.963547][T15083] netlink: 'syz.1.2482': attribute type 18 has an invalid length. [ 294.988726][T15083] netlink: 'syz.1.2482': attribute type 18 has an invalid length. [ 295.307965][T15103] openvswitch: netlink: Key type 107 is out of range max 32 [ 296.291461][T15168] openvswitch: netlink: Geneve option length err (len 256, max 255). [ 296.361163][T15171] bridge: RTM_NEWNEIGH with unconfigured vlan 3 on bridge_slave_0 [ 296.568738][T15185] sch_tbf: burst 0 is lower than device lo mtu (11337746) ! [ 297.317952][ C0] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 297.494469][T15241] lo: entered promiscuous mode [ 297.501460][T15241] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 297.622347][T15244] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 298.025443][T15271] __nla_validate_parse: 12 callbacks suppressed [ 298.025463][T15271] netlink: 52 bytes leftover after parsing attributes in process `syz.4.2533'. [ 298.386797][T15291] netlink: 92 bytes leftover after parsing attributes in process `syz.3.2542'. [ 298.640317][T15306] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 298.960707][T15322] netlink: 48 bytes leftover after parsing attributes in process `syz.0.2548'. [ 299.039404][T15329] netlink: 15 bytes leftover after parsing attributes in process `syz.2.2551'. [ 299.050218][T15329] netlink: 44 bytes leftover after parsing attributes in process `syz.2.2551'. [ 299.060999][T15334] openvswitch: netlink: Unexpected mask (mask=40040, allowed=10048) [ 299.228138][T15346] netlink: 248 bytes leftover after parsing attributes in process `syz.3.2557'. [ 299.464522][T15364] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2559'. [ 299.552733][T15370] netlink: 48 bytes leftover after parsing attributes in process `syz.0.2564'. [ 300.240772][T15398] netlink: 92 bytes leftover after parsing attributes in process `syz.3.2571'. [ 300.378460][T15415] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 300.663350][T15432] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2581'. [ 300.685826][T15432] validate_nla: 6 callbacks suppressed [ 300.685848][T15432] netlink: 'syz.4.2581': attribute type 2 has an invalid length. [ 300.734582][T15437] tc_dump_action: action bad kind [ 301.055943][T15442] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for ip6gretap0 [ 301.824610][T15502] workqueue: Failed to create a rescuer kthread for wq "nfc4_nci_rx_wq": -EINTR [ 302.448258][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 302.509878][T15565] tipc: Enabled bearer , priority 0 [ 302.539928][T15565] syzkaller0: entered promiscuous mode [ 302.545576][T15565] syzkaller0: entered allmulticast mode [ 302.583664][T15568] bridge5: trying to set multicast query interval below minimum, setting to 100 (1000ms) [ 302.628956][T15576] netlink: 'syz.4.2617': attribute type 42 has an invalid length. [ 302.642785][T15565] tipc: Resetting bearer [ 302.774079][T15564] tipc: Resetting bearer [ 302.811661][T15587] sctp: [Deprecated]: syz.4.2621 (pid 15587) Use of int in maxseg socket option. [ 302.811661][T15587] Use struct sctp_assoc_value instead [ 302.839053][T15564] tipc: Disabling bearer [ 303.135580][T15613] pim6reg: entered allmulticast mode [ 303.184913][T15618] GUP no longer grows the stack in syz.4.2632 (15618): 200000006000-200000008000 (200000005000) [ 303.198206][T15618] CPU: 1 UID: 0 PID: 15618 Comm: syz.4.2632 Not tainted syzkaller #0 PREEMPT(full) [ 303.198240][T15618] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 303.198266][T15618] Call Trace: [ 303.198275][T15618] [ 303.198284][T15618] dump_stack_lvl+0x189/0x250 [ 303.198320][T15618] ? __pfx_dump_stack_lvl+0x10/0x10 [ 303.198345][T15618] ? __pfx__printk+0x10/0x10 [ 303.198371][T15618] ? find_vma+0xe7/0x160 [ 303.198416][T15618] __get_user_pages+0x24d0/0x2ce0 [ 303.198439][T15618] ? __lock_acquire+0xab9/0xd20 [ 303.198498][T15618] ? __gup_longterm_locked+0xc68/0x1660 [ 303.198541][T15618] __gup_longterm_locked+0xde9/0x1660 [ 303.198584][T15618] ? sanity_check_pinned_pages+0x123a/0x1300 [ 303.198630][T15618] gup_fast_fallback+0x1e6a/0x2010 [ 303.198692][T15618] ? __pfx_gup_fast_fallback+0x10/0x10 [ 303.198731][T15618] ? pin_user_pages_fast+0x4d/0xb0 [ 303.198758][T15618] iov_iter_extract_pages+0x35a/0x5e0 [ 303.198794][T15618] extract_iter_to_sg+0xe46/0x24e0 [ 303.198834][T15618] ? __pfx_extract_iter_to_sg+0x10/0x10 [ 303.198855][T15618] ? __local_bh_enable_ip+0x12d/0x1c0 [ 303.198876][T15618] ? lockdep_hardirqs_on+0x9c/0x150 [ 303.198898][T15618] ? __local_bh_enable_ip+0x12d/0x1c0 [ 303.198917][T15618] ? __pfx___local_bh_enable_ip+0x10/0x10 [ 303.198942][T15618] ? __asan_memset+0x22/0x50 [ 303.198968][T15618] hash_sendmsg+0x4f4/0x11d0 [ 303.199021][T15618] ? __pfx_hash_sendmsg+0x10/0x10 [ 303.199048][T15618] __sock_sendmsg+0x219/0x270 [ 303.199082][T15618] ____sys_sendmsg+0x52d/0x830 [ 303.199112][T15618] ? __pfx_____sys_sendmsg+0x10/0x10 [ 303.199147][T15618] ? import_iovec+0x74/0xa0 [ 303.199176][T15618] ___sys_sendmsg+0x21f/0x2a0 [ 303.199203][T15618] ? __pfx____sys_sendmsg+0x10/0x10 [ 303.199273][T15618] ? __fget_files+0x2a/0x420 [ 303.199289][T15618] ? __fget_files+0x3a0/0x420 [ 303.199318][T15618] __sys_sendmmsg+0x227/0x430 [ 303.199349][T15618] ? __pfx___sys_sendmmsg+0x10/0x10 [ 303.199383][T15618] ? count_memcg_event_mm+0x21/0x260 [ 303.199407][T15618] ? count_memcg_event_mm+0x21/0x260 [ 303.199445][T15618] ? exc_page_fault+0x76/0xf0 [ 303.199478][T15618] __x64_sys_sendmmsg+0xa0/0xc0 [ 303.199505][T15618] do_syscall_64+0xfa/0x3b0 [ 303.199525][T15618] ? lockdep_hardirqs_on+0x9c/0x150 [ 303.199550][T15618] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 303.199570][T15618] ? clear_bhb_loop+0x60/0xb0 [ 303.199594][T15618] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 303.199612][T15618] RIP: 0033:0x7fed1078eec9 [ 303.199649][T15618] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 303.199667][T15618] RSP: 002b:00007fed115cb038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 303.199689][T15618] RAX: ffffffffffffffda RBX: 00007fed109e6090 RCX: 00007fed1078eec9 [ 303.199704][T15618] RDX: 0000000000000001 RSI: 0000200000000640 RDI: 0000000000000005 [ 303.199717][T15618] RBP: 00007fed10811f91 R08: 0000000000000000 R09: 0000000000000000 [ 303.199729][T15618] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 303.199741][T15618] R13: 00007fed109e6128 R14: 00007fed109e6090 R15: 00007ffc017e5f08 [ 303.199776][T15618] [ 303.251970][T15622] __nla_validate_parse: 5 callbacks suppressed [ 303.251990][T15622] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2634'. [ 303.862873][T15656] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2646'. [ 303.878347][T15659] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2646'. [ 303.901044][T15660] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2644'. [ 304.037597][T15669] netlink: 'syz.2.2648': attribute type 1 has an invalid length. [ 304.135464][T15675] netlink: 'syz.1.2651': attribute type 10 has an invalid length. [ 304.292548][T15686] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2653'. [ 304.412923][T15694] tipc: Enabled bearer , priority 0 [ 304.424919][T15694] syzkaller0: entered promiscuous mode [ 304.439530][T15694] syzkaller0: entered allmulticast mode [ 304.465491][T15702] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2656'. [ 304.476540][T15694] tipc: Resetting bearer [ 304.507114][T15693] tipc: Resetting bearer [ 304.545433][T15693] tipc: Disabling bearer [ 304.924303][T15733] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2666'. [ 304.942001][T15725] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 304.966598][T15733] bridge0: port 2(syz_tun) entered disabled state [ 304.994686][T15733] syz_tun (unregistering): left allmulticast mode [ 305.010650][T15733] syz_tun (unregistering): left promiscuous mode [ 305.017198][T15733] bridge0: port 2(syz_tun) entered disabled state [ 305.084372][T15738] netlink: 20 bytes leftover after parsing attributes in process `syz.0.2670'. [ 305.151508][T15741] IPVS: set_ctl: invalid protocol: 103 100.1.1.0:20003 [ 305.386360][T15766] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 305.400158][T15768] netlink: 48 bytes leftover after parsing attributes in process `syz.4.2679'. [ 305.632524][T15784] C: renamed from team_slave_0 [ 305.645138][T15784] netlink: 'syz.4.2685': attribute type 1 has an invalid length. [ 305.654205][T15784] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check. [ 305.821969][T15802] mac80211_hwsim hwsim10 syzkaller0: entered promiscuous mode [ 305.830298][T15802] mac80211_hwsim hwsim10 syzkaller0: entered allmulticast mode [ 305.860513][T15805] netlink: 'syz.2.2688': attribute type 2 has an invalid length. [ 306.132196][T15822] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2694'. [ 307.688989][T15909] netlink: 'syz.2.2717': attribute type 1 has an invalid length. [ 308.270645][T15935] netlink: 'syz.1.2722': attribute type 33 has an invalid length. [ 308.290791][T15933] openvswitch: netlink: IPv6 tunnel dst address is zero [ 308.301951][T15935] __nla_validate_parse: 7 callbacks suppressed [ 308.301971][T15935] netlink: 152 bytes leftover after parsing attributes in process `syz.1.2722'. [ 308.353878][T15928] sctp: [Deprecated]: syz.1.2722 (pid 15928) Use of struct sctp_assoc_value in delayed_ack socket option. [ 308.353878][T15928] Use struct sctp_sack_info instead [ 308.397722][T15942] tipc: Enabling of bearer rejected, failed to enable media [ 308.507605][T15945] netlink: 'syz.3.2727': attribute type 15 has an invalid length. [ 308.526192][T15945] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2727'. [ 308.561047][T15945] netlink: 'syz.3.2727': attribute type 6 has an invalid length. [ 308.578080][T15945] netlink: 199836 bytes leftover after parsing attributes in process `syz.3.2727'. [ 308.669151][T15948] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2727'. [ 308.690353][T15948] netlink: 20 bytes leftover after parsing attributes in process `syz.3.2727'. [ 308.701440][T15951] gre0 speed is unknown, defaulting to 1000 [ 308.755335][T15951] gre0 speed is unknown, defaulting to 1000 [ 308.796098][T15951] gre0 speed is unknown, defaulting to 1000 [ 309.405229][T15951] infiniband syz1: set active [ 309.410668][T15951] infiniband syz1: added gre0 [ 309.416533][ T8071] gre0 speed is unknown, defaulting to 1000 [ 309.486180][T15951] RDS/IB: syz1: added [ 309.519333][T15951] smc: adding ib device syz1 with port count 1 [ 309.553731][T15951] smc: ib device syz1 port 1 has pnetid [ 309.569406][T15973] netlink: 56 bytes leftover after parsing attributes in process `syz.3.2736'. [ 309.595656][T15978] gre0 speed is unknown, defaulting to 1000 [ 309.603765][ T8071] gre0 speed is unknown, defaulting to 1000 [ 309.740437][T15984] netlink: 40 bytes leftover after parsing attributes in process `syz.1.2739'. [ 310.019645][T15951] gre0 speed is unknown, defaulting to 1000 [ 310.504922][T15951] gre0 speed is unknown, defaulting to 1000 [ 310.867450][T15951] gre0 speed is unknown, defaulting to 1000 [ 311.074127][T16017] netlink: 22 bytes leftover after parsing attributes in process `syz.1.2752'. [ 311.246382][T15951] gre0 speed is unknown, defaulting to 1000 [ 311.425507][T16009] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 311.611274][T16026] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2756'. [ 311.618562][T15951] gre0 speed is unknown, defaulting to 1000 [ 311.742442][T16028] netlink: 'syz.3.2757': attribute type 10 has an invalid length. [ 311.750737][T16028] netlink: 40 bytes leftover after parsing attributes in process `syz.3.2757'. [ 311.765834][T16028] A link change request failed with some changes committed already. Interface geneve0 may have been left with an inconsistent configuration, please check. [ 311.979274][T16031] Unknown options in mask b7f2 [ 312.112790][T15951] gre0 speed is unknown, defaulting to 1000 [ 313.001560][T16051] A link change request failed with some changes committed already. Interface bond0 may have been left with an inconsistent configuration, please check. [ 313.180312][T16056] bridge0: port 1(bridge_slave_0) entered forwarding state [ 314.081670][ T51] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 314.093237][ T51] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 314.101227][ T51] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 314.110304][ T51] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 314.118635][ T51] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 314.280735][T16090] gre0 speed is unknown, defaulting to 1000 [ 314.592403][T16112] netlink: 'syz.0.2779': attribute type 39 has an invalid length. [ 314.754977][T16118] netlink: 20 bytes leftover after parsing attributes in process `syz.3.2781'. [ 314.997637][T16136] workqueue: Failed to create a rescuer kthread for wq "nfc2_nci_cmd_wq": -EINTR [ 315.126695][T16148] netlink: 56 bytes leftover after parsing attributes in process `syz.3.2787'. [ 315.314754][T16090] chnl_net:caif_netlink_parms(): no params data found [ 315.363170][T16157] netlink: 'syz.3.2789': attribute type 13 has an invalid length. [ 315.441927][T16157] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 315.486117][T16162] netlink: 'syz.0.2791': attribute type 3 has an invalid length. [ 315.505774][T16162] netlink: 32 bytes leftover after parsing attributes in process `syz.0.2791'. [ 315.640983][T16090] bridge0: port 1(bridge_slave_0) entered blocking state [ 315.649015][T16090] bridge0: port 1(bridge_slave_0) entered disabled state [ 315.656365][T16090] bridge_slave_0: entered allmulticast mode [ 315.667185][T16090] bridge_slave_0: entered promiscuous mode [ 315.677101][T16090] bridge0: port 2(bridge_slave_1) entered blocking state [ 315.687254][T16090] bridge0: port 2(bridge_slave_1) entered disabled state [ 315.694658][T16090] bridge_slave_1: entered allmulticast mode [ 315.704813][T16090] bridge_slave_1: entered promiscuous mode [ 315.781386][T16170] netlink: 104 bytes leftover after parsing attributes in process `syz.3.2793'. [ 315.791835][T16090] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 315.809303][T16170] netlink: 28 bytes leftover after parsing attributes in process `syz.3.2793'. [ 315.820797][T16090] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 315.831766][T16170] netlink: 'syz.3.2793': attribute type 7 has an invalid length. [ 315.848957][T16170] netlink: 'syz.3.2793': attribute type 8 has an invalid length. [ 315.865495][T16170] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2793'. [ 316.057494][T16090] team0: Port device team_slave_0 added [ 316.109126][T16090] team0: Port device team_slave_1 added [ 316.202010][T16090] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 316.207986][ T5188] Bluetooth: hci0: command tx timeout [ 316.216513][T16090] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 316.273811][T16183] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2796'. [ 316.287554][T16090] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 316.346353][T16090] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 316.372166][T16090] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 316.449322][T16090] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 316.617951][T16090] hsr_slave_0: entered promiscuous mode [ 316.633128][T16090] hsr_slave_1: entered promiscuous mode [ 316.644846][T16090] debugfs: 'hsr0' already exists in 'hsr' [ 316.650847][T16090] Cannot create hsr debugfs directory [ 316.833622][T16194] netlink: 'syz.0.2800': attribute type 1 has an invalid length. [ 316.945447][T16090] netdevsim netdevsim1 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 316.977258][T16194] netdevsim netdevsim0 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 317.004215][T16196] [ 317.006575][T16196] ====================================================== [ 317.013591][T16196] WARNING: possible circular locking dependency detected [ 317.020624][T16196] syzkaller #0 Not tainted [ 317.025042][T16196] ------------------------------------------------------ [ 317.032057][T16196] syz.2.2801/16196 is trying to acquire lock: [ 317.038119][T16196] ffffffff8f68f7b8 (nr_node_list_lock){+...}-{3:3}, at: nr_rt_device_down+0xa9/0x720 [ 317.047637][T16196] [ 317.047637][T16196] but task is already holding lock: [ 317.055001][T16196] ffffffff8f68f758 (nr_neigh_list_lock){+...}-{3:3}, at: nr_rt_device_down+0x28/0x720 [ 317.064599][T16196] [ 317.064599][T16196] which lock already depends on the new lock. [ 317.064599][T16196] [ 317.075012][T16196] [ 317.075012][T16196] the existing dependency chain (in reverse order) is: [ 317.084040][T16196] [ 317.084040][T16196] -> #2 (nr_neigh_list_lock){+...}-{3:3}: [ 317.091969][T16196] lock_acquire+0x120/0x360 [ 317.097012][T16196] _raw_spin_lock_bh+0x36/0x50 [ 317.102314][T16196] nr_rt_ioctl+0x390/0xd50 [ 317.107272][T16196] sock_do_ioctl+0xdc/0x300 [ 317.112318][T16196] sock_ioctl+0x576/0x790 [ 317.117182][T16196] __se_sys_ioctl+0xfc/0x170 [ 317.122302][T16196] do_syscall_64+0xfa/0x3b0 [ 317.127336][T16196] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 317.133755][T16196] [ 317.133755][T16196] -> #1 (&nr_node->node_lock){+...}-{3:3}: [ 317.141768][T16196] lock_acquire+0x120/0x360 [ 317.146802][T16196] _raw_spin_lock_bh+0x36/0x50 [ 317.152107][T16196] nr_rt_ioctl+0x193/0xd50 [ 317.157062][T16196] sock_do_ioctl+0xdc/0x300 [ 317.162103][T16196] sock_ioctl+0x576/0x790 [ 317.166994][T16196] __se_sys_ioctl+0xfc/0x170 [ 317.172114][T16196] do_syscall_64+0xfa/0x3b0 [ 317.177160][T16196] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 317.183575][T16196] [ 317.183575][T16196] -> #0 (nr_node_list_lock){+...}-{3:3}: [ 317.191402][T16196] validate_chain+0xb9b/0x2140 [ 317.196780][T16196] __lock_acquire+0xab9/0xd20 [ 317.201997][T16196] lock_acquire+0x120/0x360 [ 317.207034][T16196] _raw_spin_lock_bh+0x36/0x50 [ 317.212328][T16196] nr_rt_device_down+0xa9/0x720 [ 317.217819][T16196] nr_device_event+0x137/0x150 [ 317.223116][T16196] notifier_call_chain+0x1b3/0x3e0 [ 317.228750][T16196] netif_close_many+0x29c/0x410 [ 317.234119][T16196] netif_close+0x158/0x210 [ 317.239054][T16196] dev_close+0x10a/0x220 [ 317.243814][T16196] bpq_device_event+0x377/0x6a0 [ 317.249185][T16196] notifier_call_chain+0x1b3/0x3e0 [ 317.254834][T16196] __dev_notify_flags+0x18d/0x2e0 [ 317.260387][T16196] netif_change_flags+0xe8/0x1a0 [ 317.265873][T16196] dev_change_flags+0x130/0x260 [ 317.271244][T16196] dev_ioctl+0x7b4/0x1150 [ 317.276206][T16196] sock_do_ioctl+0x22c/0x300 [ 317.281330][T16196] sock_ioctl+0x576/0x790 [ 317.286185][T16196] __se_sys_ioctl+0xfc/0x170 [ 317.291301][T16196] do_syscall_64+0xfa/0x3b0 [ 317.296327][T16196] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 317.302743][T16196] [ 317.302743][T16196] other info that might help us debug this: [ 317.302743][T16196] [ 317.312970][T16196] Chain exists of: [ 317.312970][T16196] nr_node_list_lock --> &nr_node->node_lock --> nr_neigh_list_lock [ 317.312970][T16196] [ 317.326802][T16196] Possible unsafe locking scenario: [ 317.326802][T16196] [ 317.334262][T16196] CPU0 CPU1 [ 317.339626][T16196] ---- ---- [ 317.344985][T16196] lock(nr_neigh_list_lock); [ 317.349666][T16196] lock(&nr_node->node_lock); [ 317.356957][T16196] lock(nr_neigh_list_lock); [ 317.364279][T16196] lock(nr_node_list_lock); [ 317.368881][T16196] [ 317.368881][T16196] *** DEADLOCK *** [ 317.368881][T16196] [ 317.377016][T16196] 2 locks held by syz.2.2801/16196: [ 317.382210][T16196] #0: ffffffff8f53a088 (rtnl_mutex){+.+.}-{4:4}, at: dev_ioctl+0x7a4/0x1150 [ 317.391021][T16196] #1: ffffffff8f68f758 (nr_neigh_list_lock){+...}-{3:3}, at: nr_rt_device_down+0x28/0x720 [ 317.401038][T16196] [ 317.401038][T16196] stack backtrace: [ 317.406925][T16196] CPU: 0 UID: 0 PID: 16196 Comm: syz.2.2801 Not tainted syzkaller #0 PREEMPT(full) [ 317.406944][T16196] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 317.406954][T16196] Call Trace: [ 317.406962][T16196] [ 317.406971][T16196] dump_stack_lvl+0x189/0x250 [ 317.406993][T16196] ? __pfx_dump_stack_lvl+0x10/0x10 [ 317.407012][T16196] ? __pfx__printk+0x10/0x10 [ 317.407035][T16196] ? print_lock_name+0xde/0x100 [ 317.407057][T16196] print_circular_bug+0x2ee/0x310 [ 317.407076][T16196] check_noncircular+0x134/0x160 [ 317.407095][T16196] validate_chain+0xb9b/0x2140 [ 317.407113][T16196] ? rt6_disable_ip+0x6b3/0x720 [ 317.407130][T16196] ? __lock_acquire+0xab9/0xd20 [ 317.407152][T16196] __lock_acquire+0xab9/0xd20 [ 317.407176][T16196] ? nr_rt_device_down+0xa9/0x720 [ 317.407196][T16196] lock_acquire+0x120/0x360 [ 317.407216][T16196] ? nr_rt_device_down+0xa9/0x720 [ 317.407244][T16196] ? nr_rt_device_down+0xa9/0x720 [ 317.407264][T16196] _raw_spin_lock_bh+0x36/0x50 [ 317.407287][T16196] ? nr_rt_device_down+0xa9/0x720 [ 317.407308][T16196] nr_rt_device_down+0xa9/0x720 [ 317.407329][T16196] ? do_raw_spin_unlock+0x122/0x240 [ 317.407349][T16196] nr_device_event+0x137/0x150 [ 317.407370][T16196] notifier_call_chain+0x1b3/0x3e0 [ 317.407390][T16196] netif_close_many+0x29c/0x410 [ 317.407408][T16196] ? __pfx_netif_close_many+0x10/0x10 [ 317.407424][T16196] ? bond_netdev_event+0x227/0xe80 [ 317.407446][T16196] netif_close+0x158/0x210 [ 317.407460][T16196] ? __pfx_netif_close+0x10/0x10 [ 317.407473][T16196] ? tun_device_event+0x77/0x1020 [ 317.407494][T16196] ? __pfx___neigh_ifdown+0x10/0x10 [ 317.407515][T16196] ? macsec_notify+0x104/0x660 [ 317.407536][T16196] dev_close+0x10a/0x220 [ 317.407554][T16196] bpq_device_event+0x377/0x6a0 [ 317.407570][T16196] notifier_call_chain+0x1b3/0x3e0 [ 317.407589][T16196] __dev_notify_flags+0x18d/0x2e0 [ 317.407608][T16196] ? __pfx___dev_notify_flags+0x10/0x10 [ 317.407624][T16196] ? __dev_change_flags+0x4cc/0x6d0 [ 317.407643][T16196] ? __pfx___dev_change_flags+0x10/0x10 [ 317.407661][T16196] ? full_name_hash+0x92/0xe0 [ 317.407679][T16196] netif_change_flags+0xe8/0x1a0 [ 317.407699][T16196] dev_change_flags+0x130/0x260 [ 317.407717][T16196] dev_ioctl+0x7b4/0x1150 [ 317.407733][T16196] sock_do_ioctl+0x22c/0x300 [ 317.407756][T16196] ? __pfx_sock_do_ioctl+0x10/0x10 [ 317.407781][T16196] ? __lock_acquire+0xab9/0xd20 [ 317.407818][T16196] sock_ioctl+0x576/0x790 [ 317.407844][T16196] ? __pfx_sock_ioctl+0x10/0x10 [ 317.407870][T16196] ? __fget_files+0x2a/0x420 [ 317.407886][T16196] ? __fget_files+0x3a0/0x420 [ 317.407901][T16196] ? __fget_files+0x2a/0x420 [ 317.407918][T16196] ? bpf_lsm_file_ioctl+0x9/0x20 [ 317.407942][T16196] ? __pfx_sock_ioctl+0x10/0x10 [ 317.407967][T16196] __se_sys_ioctl+0xfc/0x170 [ 317.407991][T16196] do_syscall_64+0xfa/0x3b0 [ 317.408011][T16196] ? lockdep_hardirqs_on+0x9c/0x150 [ 317.408030][T16196] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 317.408048][T16196] ? clear_bhb_loop+0x60/0xb0 [ 317.408069][T16196] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 317.408087][T16196] RIP: 0033:0x7f7e6238eec9 [ 317.408104][T16196] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 317.408120][T16196] RSP: 002b:00007f7e6329e038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 317.408138][T16196] RAX: ffffffffffffffda RBX: 00007f7e625e5fa0 RCX: 00007f7e6238eec9 [ 317.408152][T16196] RDX: 0000200000000700 RSI: 0000000000008914 RDI: 0000000000000009 [ 317.408163][T16196] RBP: 00007f7e62411f91 R08: 0000000000000000 R09: 0000000000000000 [ 317.408172][T16196] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 317.408181][T16196] R13: 00007f7e625e6038 R14: 00007f7e625e5fa0 R15: 00007ffc32b15228 [ 317.408200][T16196] [ 317.779232][ T1307] ieee802154 phy0 wpan0: encryption failed: -22 SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 317.810650][T16090] netdevsim netdevsim1 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 318.184519][T16194] netdevsim netdevsim0 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 318.264522][T16090] netdevsim netdevsim1 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 318.278223][ T5188] Bluetooth: hci0: command tx timeout [ 318.291725][T16194] netdevsim netdevsim0 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 318.368901][T16090] netdevsim netdevsim1 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 318.417464][T16194] netdevsim netdevsim0 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 318.438116][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 318.470900][T16121] netdevsim netdevsim2 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 318.481456][T16121] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 318.562932][T16119] netdevsim netdevsim0 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 318.599759][T16119] netdevsim netdevsim0 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 318.618197][T16119] netdevsim netdevsim0 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 318.633412][T16119] netdevsim netdevsim0 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 318.670800][T16121] netdevsim netdevsim2 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 318.684370][T16121] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 318.816947][T16121] netdevsim netdevsim2 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 318.837109][T16121] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 318.910995][T16121] netdevsim netdevsim2 ÿÿÿÿÿÿ (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 318.922164][T16121] netdevsim netdevsim2 ÿÿÿÿÿÿ (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 318.982921][ T36] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 318.999345][ T12] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 319.013614][ T36] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 319.029481][ T36] netdevsim netdevsim2 eth4: set [1, 0] type 2 family 0 port 6081 - 0 [ 319.038349][T16121] bridge_slave_1: left allmulticast mode [ 319.044017][T16121] bridge_slave_1: left promiscuous mode [ 319.051589][T16121] bridge0: port 2(bridge_slave_1) entered disabled state [ 319.060307][T16121] bridge_slave_0: left allmulticast mode [ 319.065963][T16121] bridge_slave_0: left promiscuous mode [ 319.072773][T16121] bridge0: port 1(bridge_slave_0) entered disabled state [ 319.295696][T16119] smc: removing ib device syz1 [ 319.989150][T16121] bond1 (unregistering): Released all slaves [ 320.125761][T16121] bond2 (unregistering): Released all slaves [ 320.233654][T16121] bond3 (unregistering): (slave wireguard0): Releasing backup interface [ 320.244706][T16121] wireguard0: left promiscuous mode [ 320.251203][T16121] bond3 (unregistering): Released all slaves [ 320.353226][T16121] bond4 (unregistering): Released all slaves [ 320.458692][T16121] bond5 (unregistering): Released all slaves [ 320.470402][T16121] bond6 (unregistering): Released all slaves [ 320.481588][T16121] bond0 (unregistering): Released all slaves [ 320.492885][T16121] bond7 (unregistering): Released all slaves [ 320.506147][T16121] bond8 (unregistering): Released all slaves [ 320.531824][T16121] bond9 (unregistering): Released all slaves [ 320.542381][ T8097] gre0 speed is unknown, defaulting to 1000 [ 320.548515][ T8097] syz1: Port: 1 Link DOWN [ 320.664627][T16121] tipc: Left network mode [ 321.167205][T16121] hsr_slave_0: left promiscuous mode [ 321.173666][T16121] hsr_slave_1: left promiscuous mode [ 321.180291][T16121] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 321.187704][T16121] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 321.197059][T16121] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 321.205785][T16121] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 321.216945][T16121] veth1_macvtap: left promiscuous mode [ 321.224161][T16121] veth0_macvtap: left promiscuous mode [ 322.092854][T16121] IPVS: stop unused estimator thread 0... [ 322.336016][T10715] netdevsim netdevsim4 eth5: set [1, 0] type 2 family 0 port 6081 - 0 [ 322.348358][T16119] netdevsim netdevsim4 eth6: set [1, 0] type 2 family 0 port 6081 - 0 [ 322.362906][T16119] netdevsim netdevsim4 eth7: set [1, 0] type 2 family 0 port 6081 - 0 [ 322.375010][T16119] netdevsim netdevsim4 eth8: set [1, 0] type 2 family 0 port 6081 - 0 [ 322.387182][T16121] bridge_slave_1: left allmulticast mode [ 322.393022][T16121] bridge_slave_1: left promiscuous mode [ 322.398871][T16121] bridge0: port 2(bridge_slave_1) entered disabled state [ 322.406891][T16121] bridge_slave_0: left allmulticast mode [ 322.412647][T16121] bridge_slave_0: left promiscuous mode [ 322.418580][T16121] bridge0: port 1(bridge_slave_0) entered disabled state [ 322.876779][T16121] bond0 (unregistering): Released all slaves [ 322.886706][T16121] bond1 (unregistering): Released all slaves [ 322.896351][T16121] bond2 (unregistering): Released all slaves [ 322.906208][T16121] bond3 (unregistering): Released all slaves [ 322.985396][T16121] bond4 (unregistering): Released all slaves [ 323.037527][T16121] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 323.047545][T16121] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 323.057081][T16121] bond0 (unregistering): Released all slaves [ 323.121253][T16121] tipc: Disabling bearer [ 323.126592][T16121] tipc: Left network mode [ 323.145245][T16121] IPVS: stopping backup sync thread 13505 ... [ 323.310034][T16121] hsr_slave_0: left promiscuous mode [ 323.316137][T16121] hsr_slave_1: left promiscuous mode [ 323.324938][T16121] hsr_slave_0: left promiscuous mode [ 323.330829][T16121] hsr_slave_1: left promiscuous mode [ 323.336637][T16121] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 323.344280][T16121] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 323.386672][T16121] pim6reg (unregistering): left allmulticast mode [ 323.795984][T16121] team0 (unregistering): Port device team_slave_1 removed [ 323.809920][T16121] team0 (unregistering): Port device team_slave_0 removed [ 324.265430][T16121] IPVS: stop unused estimator thread 0...