last executing test programs: 2m39.645580779s ago: executing program 1 (id=545): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000000080), r1) r2 = epoll_create1(0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r5 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r4, &(0x7f0000000100)={0x20000014}) epoll_ctl$EPOLL_CTL_ADD(r5, 0x1, r2, &(0x7f0000000000)={0xa0000001}) epoll_ctl$EPOLL_CTL_ADD(r5, 0x1, r4, &(0x7f0000000040)={0x2004}) epoll_wait(r5, &(0x7f00000000c0)=[{}], 0x1, 0x1fffc002) sendmsg$ETHTOOL_MSG_TSINFO_GET(r1, 0x0, 0x2000c800) r6 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) setsockopt$bt_l2cap_L2CAP_OPTIONS(r6, 0x6, 0x1, &(0x7f0000000000)={0x4fc0, 0x80, 0x6, 0x0, 0x8, 0x80, 0x7}, 0xc) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r7, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=@updpolicy={0xb8, 0x19, 0x1, 0x70bd2d, 0x0, {{@in6=@mcast2, @in, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x87}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffb}, {0x0, 0x0, 0x200000000000000}, 0x9}}, 0xb8}}, 0x2c000010) sendmsg$nl_xfrm(r7, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=@updpolicy={0xb4, 0x15, 0x1, 0x0, 0x0, {{@in=@multicast1=0xe0000002, @in6=@empty, 0x0, 0x0, 0x0, 0x0, 0xa, 0x10}, {0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0xffffffff}, {}, 0x0, 0x6e6bb5}}, 0xb4}, 0x1, 0x0, 0x0, 0x810}, 0x0) recvmsg(r0, &(0x7f0000001840)={&(0x7f00000018c0)=@generic, 0x80, &(0x7f00000007c0)=[{&(0x7f0000000380)=""/210, 0xd2}, {0x0}, {&(0x7f0000000600)=""/104, 0x68}, {&(0x7f0000000680)=""/255, 0xff}, {&(0x7f0000001880)=""/15, 0xf}], 0x5, &(0x7f0000000840)=""/4096, 0x1000}, 0x142) bind$bt_l2cap(r6, &(0x7f00000002c0)={0x1f, 0x0, @any, 0xfffa}, 0xe) connect$bt_l2cap(r6, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r8, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000040)={{0x14}, [@NFT_MSG_NEWRULE={0x60, 0x6, 0xa, 0x160b, 0x0, 0x0, {0x2, 0x0, 0x8}, [@NFTA_RULE_EXPRESSIONS={0x34, 0x4, 0x0, 0x1, [{0x18, 0x1, 0x0, 0x1, @osf={{0x8}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_OSF_DREG={0x8, 0x1, 0x1, 0x0, 0x4}]}}}, {0x18, 0x1, 0x0, 0x1, @dup_ipv6={{0x8}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_DUP_SREG_ADDR={0x8, 0x1, 0x1, 0x0, 0x16}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0x88}, 0x1, 0x0, 0x0, 0x840}, 0x4040080) r9 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r9, &(0x7f0000000200)=0x10001, 0x12) sendfile(r9, 0xffffffffffffffff, 0x0, 0xf03a0005) sendmmsg(r6, &(0x7f0000004280)=[{{0x0, 0x0, &(0x7f0000000140)}}], 0x1, 0x4004004) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000000c0)=@newlink={0x44, 0x10, 0x403, 0xfffffffd, 0x0, {0x0, 0x0, 0x0, 0x0, 0x647e4, 0x64da0}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @veth={{0x9}, {0x4, 0x2, 0x0, 0x1, @void}}}, @IFLA_NUM_RX_QUEUES={0x8, 0x20, 0x9}, @IFLA_NUM_TX_QUEUES={0x8, 0x1f, 0x4}]}, 0x44}, 0x1, 0xba01}, 0x0) 2m38.3667505s ago: executing program 1 (id=555): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="010000060000000c000000000000002c9b5573f42b4ff2468c38a88c9f42b86017c68deca5a67f73dcd5344ca7463e4fbdccf1a2aa2cdc13d8b8afb426082c7ff153cdf4a9d28856936cfc9c16acdad96827c13673f5cdc4c20256ef7804d970c9e368a9889ed35e2515dae2ce8184cd23115166742573f29e7cf98c62fa67093dac4ee7acb9ba2b88927a1a915a37da11390f9d09112739fdbfd55cfdcf9f670f944f407fdc6755f00aedebd3d14399b2bb79b9262b8f973e5ca308da6fb969f8e64c03d05b7250576521348460ab6e00d4ce9d600a7e0a63", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) close(0x3) socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x6, &(0x7f0000000200)=0x80, 0x4) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x15, 0x4, &(0x7f0000000440)=ANY=[@ANYBLOB="b40520feffffff00791030ffff00000000000000009508000000080000e3cf4cd2adcd396876578a7196c14a3d4660492f27a7aac07f1a3abbd8ef0a9f9dfa8ea0d4704cba827e13508b9394ad75913cf7477e20c4e8de99587e6086de81b2b04a2b4b053fc6e6398890efba160cc7c40c2896f20e042bdefdf9b70ccf647ec2297064a7ea51dea84ad7572caf441db69679ac2f048a4a743cccaa3721e632d2a7b7a31a795baaa54b92f8230bb07455568d4d45964ff4f75acdb8b9fd080bc4319d9c25588e05654f8511faee2d2586bc08"], &(0x7f0000003ff6)='GPL\x00', 0x5, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_reuseport, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0x1dd}, 0x48) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0e000000040000000800000007"], 0x50) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, &(0x7f0000000280)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000500000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000880)={&(0x7f0000000000)='percpu_alloc_percpu\x00', r2}, 0x10) r3 = socket(0x2, 0x80805, 0x0) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) getsockopt$inet_sctp6_SCTP_MAX_BURST(r3, 0x84, 0x83, &(0x7f0000000000)=@assoc_value, &(0x7f0000000300)=0x8) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x1e, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x1, 0x2, 0x3, 0x2, 0x1, 0x2a}]}, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, 0x24}, 0x94) socket$nl_netfilter(0x10, 0x3, 0xc) 2m38.12616027s ago: executing program 1 (id=557): r0 = socket$netlink(0x10, 0x3, 0x0) pselect6(0x0, 0x0, 0x0, 0x0, &(0x7f0000000300)={0x0, 0x3938700}, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000500)=@newlink={0x38, 0x10, 0x503, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x115, 0x2081}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @gtp={{0x8}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GTP_PDP_HASHSIZE={0x8, 0x3, 0xfffffffe}]}}}]}, 0x38}}, 0x28000000) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x32, 0xffffffffffffffff, 0x739ef000) socket$inet6_sctp(0xa, 0x1, 0x84) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000e00)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000400)=ANY=[@ANYBLOB="300000001900010000000b8d01283bc90aa9900015110005000000000c00090008001100", @ANYRES32=0x0, @ANYBLOB="080001"], 0x30}}, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0xf, 0x11, r0, 0xc98e5000) socket$netlink(0x10, 0x3, 0x0) (async) pselect6(0x0, 0x0, 0x0, 0x0, &(0x7f0000000300)={0x0, 0x3938700}, 0x0) (async) socket$netlink(0x10, 0x3, 0x0) (async) sendmsg$nl_route(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000500)=@newlink={0x38, 0x10, 0x503, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x115, 0x2081}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @gtp={{0x8}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GTP_PDP_HASHSIZE={0x8, 0x3, 0xfffffffe}]}}}]}, 0x38}}, 0x28000000) (async) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x32, 0xffffffffffffffff, 0x739ef000) (async) socket$inet6_sctp(0xa, 0x1, 0x84) (async) socket$nl_route(0x10, 0x3, 0x0) (async) sendmsg$nl_route(r2, &(0x7f0000000e00)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000400)=ANY=[@ANYBLOB="300000001900010000000b8d01283bc90aa9900015110005000000000c00090008001100", @ANYRES32=0x0, @ANYBLOB="080001"], 0x30}}, 0x0) (async) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0xf, 0x11, r0, 0xc98e5000) (async) 2m37.818552583s ago: executing program 1 (id=560): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x7a05, 0x1700) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r2, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) r3 = syz_init_net_socket$rose(0xb, 0x5, 0x0) close(r3) bind$inet(r2, &(0x7f0000000080)={0x2, 0x4e23, @local}, 0x10) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, 0x0, 0x0) sendto$inet(r2, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r2, 0x6, 0xd, &(0x7f0000000000)='htcp', 0x4) sendto$inet(r2, &(0x7f0000000580)="17", 0x1d4c, 0x10048095, 0x0, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)=ANY=[@ANYBLOB="44000000100001040c000000000000000000000053cafb6a14009bbb02bfb63d3e99a7c2e855329bb4f25e023b9e65d01ef395fb751b923801e9e9ed82a5654aa4e50298e4f5fbf53d0d5f05cb986b1ed0092ccae688e8ca66da72884118c6cd2d2c6780cf97861a2e7cd99130f464340b91dd87cc57127f7311382d47b0d1b8d027fd8460bf499a5ab12fe026d46d88722f2a47daac4209eca7438e3abb06c721995f2392cdd42e", @ANYRES32=0x0, @ANYBLOB="4400000000000000140003007369743000000000000000000000000010001280080001007369740004000280"], 0x44}, 0x1, 0x0, 0x0, 0x200080d0}, 0x4) write$cgroup_int(r1, &(0x7f0000000200), 0x806000) r5 = socket(0x10, 0x803, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000756c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b7030000fcffffff850000002d000000850000000f0000009500000000000000f278f2fcdfbe5160e8a0ac120186967cc843dc57216b817ee602c7826124f350f3d3e542650e57f67560a70d2e7d5f5590521a010572720867d2c38c19137557ee1d31dbc73ac836fe07b30b5e530be03ae7ff24594e91213eba3c33f28b0e586b8d580f5b86fc52f85fba3ca0cbabeeca7c4d762fe7be093eb360e583f1ae84825f804eebd4b459c9cf883e58f0e50163a84e090931867ab5146b5b4d8291dc4b27b6b8"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f00000007c0)={r6}, 0x9) syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), r5) getsockname$packet(r5, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000000c0)=0x14) sendmsg$nl_route(r5, &(0x7f0000000440)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)=@newlink={0x40, 0x10, 0x437, 0x2, 0x25dfdbff, {0x0, 0x0, 0x0, r7, 0x50483}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @sit={{0x8}, {0x14, 0x2, 0x0, 0x1, [@IFLA_IPTUN_LINK={0x8, 0x1, r7}, @IFLA_IPTUN_REMOTE={0x8, 0x3, @multicast2}]}}}]}, 0x40}, 0x1, 0x0, 0x0, 0x4009004}, 0x4040004) ioctl$FS_IOC_RESVSP(r1, 0x40305829, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x9ffffc}) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000003, 0x12, r0, 0x0) ioctl$sock_bt_hidp_HIDPCONNDEL(r1, 0x400448c9, &(0x7f0000000000)={@any, 0xc}) sendmsg$RDMA_NLDEV_CMD_STAT_SET(0xffffffffffffffff, &(0x7f0000002300)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20000004}, 0x0) 2m36.723738219s ago: executing program 1 (id=574): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000200)=ANY=[@ANYBLOB="9feb010018000000000000003c0000003c00000006000000040000000000000e0400000000000000000000000100000d0400000004000000040000000000000000000010040000000000000000000009030000000000000061"], 0x0, 0x5a, 0x0, 0x4, 0x80000}, 0x20) setsockopt$inet6_tcp_int(r1, 0x6, 0x24, &(0x7f0000000080), 0x4) r2 = socket$netlink(0x10, 0x3, 0x10) setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r2, 0x10e, 0x8, &(0x7f0000000100)=0x9, 0x4) syz_genetlink_get_family_id$mptcp(&(0x7f0000000140), r2) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)=ANY=[@ANYRESOCT=r1, @ANYRES8=0x0], 0x2c}, 0x1, 0x0, 0x0, 0x804}, 0xc044) socket(0x11, 0x15d44f2449b8843e, 0x6) 2m36.52950397s ago: executing program 1 (id=578): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f0000000380)=ANY=[@ANYBLOB="1801000021000000000000003b810000850000006d000000070000000000000095"], &(0x7f0000000040)='GPL\x00', 0x6, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x11, 0x5, &(0x7f0000000280)=ANY=[@ANYBLOB="1801000021000000000000003b810000850000006d000000070000000000000095"], &(0x7f0000000140)='syzkaller\x00', 0x6, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x8}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f00000000c0)='rpc_buf_alloc\x00', r1, 0x0, 0x1}, 0x18) r2 = socket$inet6(0xa, 0x80002, 0x0) bind$inet6(r2, &(0x7f0000000140)={0xa, 0x0, 0x0, @dev, 0x6}, 0x1c) bind$inet6(r2, &(0x7f0000000000)={0xa, 0x24, 0x8, @mcast2}, 0x18) r3 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) r4 = bpf$ITER_CREATE(0x21, &(0x7f0000000240), 0x8) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x5, &(0x7f0000000280)=ANY=[], &(0x7f0000000300)='GPL\x00', 0x20009, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, 0x2}, 0x94) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_GET_ADDR(r6, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000002c0)={0x1c, r7, 0x205, 0x70bd2a, 0x25dfdbff, {}, [@MPTCP_PM_ATTR_LOC_ID={0x5, 0x5, 0x80}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x2000081) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f00000000c0)='rpc_buf_alloc\x00', r5, 0x0, 0x1}, 0x18) sendmsg$netlink(r3, &(0x7f0000000040)={0x0, 0x2f, &(0x7f0000002580)=[{&(0x7f0000000000)=ANY=[@ANYBLOB="140000002500010000000000f100000006"], 0x14}], 0x1, 0x0, 0x0, 0x400048c0}, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000880)={&(0x7f0000000080)='rpc_clnt_new\x00', r0, 0x0, 0xb9b}, 0x18) r8 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f0000000380)=ANY=[], &(0x7f0000000040)='GPL\x00', 0x6, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000880)={&(0x7f0000000080)='rpc_clnt_new\x00', r8, 0x0, 0xb9b}, 0x18) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000000040)={@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x4, 0x0, 0x0, 0x8, 0x0, 0x4}, 0x20) ioctl$F2FS_IOC_FLUSH_DEVICE(r4, 0x4008f50a, &(0x7f0000000340)={0x4, 0x4}) sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0x800) bpf$BPF_PROG_ATTACH(0x9, &(0x7f0000000140)={@cgroup, 0xffffffffffffffff, 0x11}, 0x11) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wlan0\x00'}) r9 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) sendmsg$NL80211_CMD_JOIN_MESH(0xffffffffffffffff, 0x0, 0x20000884) ioctl(r9, 0x8b32, &(0x7f0000000040)) r10 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r10, &(0x7f0000000040)={0x0, 0x20, &(0x7f0000002580)=[{&(0x7f0000000000)=ANY=[@ANYBLOB="140000002500010000000000f100000006"], 0x14}], 0x1, 0x0, 0x0, 0x400048c0}, 0x0) 2m21.382190275s ago: executing program 32 (id=578): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f0000000380)=ANY=[@ANYBLOB="1801000021000000000000003b810000850000006d000000070000000000000095"], &(0x7f0000000040)='GPL\x00', 0x6, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x11, 0x5, &(0x7f0000000280)=ANY=[@ANYBLOB="1801000021000000000000003b810000850000006d000000070000000000000095"], &(0x7f0000000140)='syzkaller\x00', 0x6, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x8}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f00000000c0)='rpc_buf_alloc\x00', r1, 0x0, 0x1}, 0x18) r2 = socket$inet6(0xa, 0x80002, 0x0) bind$inet6(r2, &(0x7f0000000140)={0xa, 0x0, 0x0, @dev, 0x6}, 0x1c) bind$inet6(r2, &(0x7f0000000000)={0xa, 0x24, 0x8, @mcast2}, 0x18) r3 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) r4 = bpf$ITER_CREATE(0x21, &(0x7f0000000240), 0x8) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x5, &(0x7f0000000280)=ANY=[], &(0x7f0000000300)='GPL\x00', 0x20009, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, 0x2}, 0x94) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_GET_ADDR(r6, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000002c0)={0x1c, r7, 0x205, 0x70bd2a, 0x25dfdbff, {}, [@MPTCP_PM_ATTR_LOC_ID={0x5, 0x5, 0x80}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x2000081) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f00000000c0)='rpc_buf_alloc\x00', r5, 0x0, 0x1}, 0x18) sendmsg$netlink(r3, &(0x7f0000000040)={0x0, 0x2f, &(0x7f0000002580)=[{&(0x7f0000000000)=ANY=[@ANYBLOB="140000002500010000000000f100000006"], 0x14}], 0x1, 0x0, 0x0, 0x400048c0}, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000880)={&(0x7f0000000080)='rpc_clnt_new\x00', r0, 0x0, 0xb9b}, 0x18) r8 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f0000000380)=ANY=[], &(0x7f0000000040)='GPL\x00', 0x6, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000880)={&(0x7f0000000080)='rpc_clnt_new\x00', r8, 0x0, 0xb9b}, 0x18) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000000040)={@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x4, 0x0, 0x0, 0x8, 0x0, 0x4}, 0x20) ioctl$F2FS_IOC_FLUSH_DEVICE(r4, 0x4008f50a, &(0x7f0000000340)={0x4, 0x4}) sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0x800) bpf$BPF_PROG_ATTACH(0x9, &(0x7f0000000140)={@cgroup, 0xffffffffffffffff, 0x11}, 0x11) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wlan0\x00'}) r9 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) sendmsg$NL80211_CMD_JOIN_MESH(0xffffffffffffffff, 0x0, 0x20000884) ioctl(r9, 0x8b32, &(0x7f0000000040)) r10 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r10, &(0x7f0000000040)={0x0, 0x20, &(0x7f0000002580)=[{&(0x7f0000000000)=ANY=[@ANYBLOB="140000002500010000000000f100000006"], 0x14}], 0x1, 0x0, 0x0, 0x400048c0}, 0x0) 1m9.371956484s ago: executing program 5 (id=1363): r0 = socket$inet6_sctp(0xa, 0x801, 0x84) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) r2 = socket(0x2a, 0x2, 0x0) socket$inet_mptcp(0x2, 0x1, 0x106) r3 = socket$phonet_pipe(0x23, 0x5, 0x2) listen(r3, 0x6) r4 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x11, 0xf, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000800000000bf91000000000000b702000043e7b5538500000085000000b70000000000000095"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x36, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000280)='cq_drain_complete\x00', r5}, 0x18) r6 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f0000000200)={'wlan0\x00'}) sendmsg$NL80211_CMD_GET_WOWLAN(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000440)=ANY=[], 0x1c}, 0x1, 0x0, 0x0, 0x400c001}, 0x20000090) syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), r6) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000140)='kmem_cache_free\x00', r5}, 0x10) ppoll(&(0x7f0000000500)=[{r4}], 0x1, 0x0, 0x0, 0x0) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x0, 0x7, 0xfffffffffffffffd}, 0x0, &(0x7f00000002c0)={0x3ff, 0x4, 0x0, 0x9, 0x0, 0x0, 0x7fffffff}, 0x0, 0x0) r7 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[], 0x48) socketpair$unix(0x1, 0x1, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=@base={0x12, 0x7, 0x4, 0x2, 0x38f1df5e00aafedf, r7, 0x40}, 0x50) r8 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000002c0)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x7fffffff, '\x00', 0x0, 0x0, 0xfffffffd, 0x0, 0x2}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0xa, 0x1c, &(0x7f0000000d80)=@ringbuf={{0x18, 0x8}, {{0x18, 0x1, 0x1, 0x0, r8}, {}, {}, {0x85, 0x0, 0x0, 0x5}, {0x4}}, {{0x5, 0x0, 0x3}}, [@snprintf={{0x7, 0x0, 0xb, 0x2}, {0x3, 0x3, 0x3, 0xa, 0x9}, {0x5, 0x0, 0xb, 0x9, 0x0, 0xb}, {0x3, 0x3, 0x3, 0xa, 0xa}, {0x7, 0x1, 0xb, 0x7, 0x8}, {0x7, 0x0, 0x0, 0x8, 0x0, 0x0, 0xfffffdff}, {0x4}, {0x7, 0x0, 0xa}, {0x4, 0x0, 0x7, 0x2, 0x0, 0x0, 0x1d}, {0x18, 0x9, 0x2, 0x0, r8}, {}, {0x46, 0x8, 0xfff0, 0x76}}], {{0x7, 0x1, 0xc, 0x9, 0x4}, {0x6, 0x0, 0x5, 0x8}}}, &(0x7f0000000980)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x2e, '\x00', 0x0, @fallback=0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, 0x94) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x40000000000, 0x3, 0x4, 0x0, 0x0, 0x3}, 0x0, &(0x7f00000002c0)={0x3ff, 0x4, 0x0, 0x9, 0x0, 0x0, 0x80000003}, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) close(0x4) shutdown(r1, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x1c, &(0x7f00000000c0)=[@in6={0xa, 0x0, 0x0, @private2}]}, &(0x7f0000000180)=0x10) r9 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r9, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r0, 0x84, 0x18, &(0x7f0000000000)={r10, 0x4}, &(0x7f0000000040)=0x8) 1m8.256085293s ago: executing program 5 (id=1377): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r2) sendmsg$TIPC_CMD_ENABLE_BEARER(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x100, 0x0) close(r4) r5 = socket$unix(0x1, 0x1, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000740)=@newqdisc={0x68, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r7, {0x0, 0xb}, {0xffff, 0xffff}, {0x0, 0xfff1}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x3c, 0x2, [@TCA_TBF_PBURST={0x8, 0x7, 0xb86}, @TCA_TBF_PARMS={0x28, 0x1, {{0xa, 0x2, 0xffff, 0x7, 0xcc, 0x3}, {0x0, 0x1, 0x7, 0x8, 0x7f, 0x9}, 0xa6, 0x7, 0x1bb6}}, @TCA_TBF_BURST={0x8, 0x6, 0x7f}]}}]}, 0x68}, 0x1, 0x0, 0x0, 0x20000001}, 0x0) sendmsg$nl_route_sched(r6, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000300)=@newqdisc={0x24, 0x24, 0x4ee4e6a52ff56541, 0x70b923, 0x80000, {0x0, 0x0, 0x0, r7, {0x0, 0x4}, {0x0, 0xb}, {0xd, 0xfff3}}}, 0x24}}, 0x4008000) r8 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) ioctl$TUNSETIFF(r8, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) write$tun(r8, &(0x7f0000000100)={@val={0x0, 0x6003}, @void, @eth={@broadcast, @broadcast, @val={@void, {0x8100, 0x5, 0x0, 0x2}}, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x68, 0x2000, 0xfc, 0x2f, 0x0, @private=0xa010100, @multicast1}, {0x8000, 0x6558, 0x8}}}}}}, 0x32) r9 = getgid() bpf$PROG_LOAD_XDP(0x5, &(0x7f00000000c0)={0x3, 0x4, &(0x7f0000000080)=@framed={{}, [@ldst={0x2, 0x2, 0x3, 0x1, 0x0, 0x40}]}, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xf}, 0x94) ioctl$TUNSETGROUP(r8, 0x400454ce, r9) ioctl$SIOCSIFHWADDR(r4, 0x8922, &(0x7f0000002280)={'syzkaller0\x00', @random="2b0100004ec6"}) 1m7.884642286s ago: executing program 5 (id=1384): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_route(0x10, 0x3, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$rds(0x15, 0x5, 0x0) r2 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x11, 0xf, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000800000000bf91000000000000b702000043e7b5538500000085000000b70000000000000095"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000013c0)={0x18, 0x3, &(0x7f0000000080)=@framed, &(0x7f0000000000)='syzkaller\x00'}, 0x90) getsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(0xffffffffffffffff, 0x84, 0x22, &(0x7f00000002c0)={0x0, 0x2, 0x0, 0x10}, &(0x7f0000000300)=0x10) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000140)='kmem_cache_free\x00', r3}, 0x10) pselect6(0xe, 0x0, 0x0, &(0x7f0000000100)={0x3ff, 0xee, 0xffffffffffffffff, 0x9, 0x0, 0x0, 0x7fffffff}, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000001540)={0x0, 0x0, &(0x7f0000001500)={&(0x7f0000000180)={0x14, 0x25, 0x1, 0x70bd2c, 0x259fdbfb, {0x8}}, 0x14}, 0x1, 0x0, 0x0, 0x80}, 0x10) close(0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000007, 0x8010, r0, 0xffffe000) bind$rds(r1, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) ioctl$SIOCSIFHWADDR(r0, 0x8924, &(0x7f00000001c0)={'geneve0\x00'}) r4 = socket$alg(0x26, 0x5, 0x0) bind$alg(r4, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-asm\x00'}, 0x58) setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r5 = accept4(r4, 0x0, 0x0, 0x800) sendmmsg$alg(r5, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000640)=[{&(0x7f0000000540)=""/63, 0x3f}, {&(0x7f0000000580)=""/184, 0xb8}], 0x2}, 0xc0000161) bind$inet(r5, &(0x7f0000000200)={0x2, 0x4e21, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000009, 0x8031, 0xffffffffffffffff, 0x0) sendmsg$rds(r1, &(0x7f0000001600)={&(0x7f0000000000)={0x2, 0x0, @remote}, 0x10, 0x0, 0x0, &(0x7f0000000780)=[@rdma_args={0x48, 0x114, 0x1, {{}, {0x0, 0x2c}, &(0x7f00000006c0)=[{&(0x7f0000000100)=""/44, 0x410200}], 0x1}}], 0x48}, 0x0) socket$pppoe(0x18, 0x1, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000d00)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01020000000000000000010000000900010073797a30000000002c000000030a01080000000000000000010000000900030073797a32000000000900010073797a30000000005c000000060a010400000000000000000100000008000b40000000000900010073797a300000000034000480300001800a0001006d617463680000002000028008000300b07346e30a0001007374617465000000080002"], 0xd0}}, 0x0) 1m6.50021663s ago: executing program 5 (id=1391): r0 = socket$kcm(0x29, 0x5, 0x0) write$cgroup_pressure(r0, &(0x7f0000000140)={'full'}, 0xfffffdef) setsockopt$sock_int(r0, 0x1, 0x9, &(0x7f0000000180)=0x9, 0x64) (async) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r2 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r2, 0x11b, 0x4, &(0x7f00000000c0)={0x0, 0x0, 0x1000, 0x0, 0x1}, 0x20) (async) r3 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r1) sendmsg$NFC_CMD_FW_DOWNLOAD(r1, &(0x7f0000002ec0)={0x0, 0x0, &(0x7f0000002e80)={&(0x7f0000000140)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="192c2fbd7000fcdbdf2515000000080014006e6663100800010080"], 0x24}, 0x1, 0x0, 0x0, 0x8800}, 0x840) 1m6.250317796s ago: executing program 5 (id=1393): bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="21000000400000000200000000020000cbf11745", @ANYRES32, @ANYBLOB="fcffbfff00"/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000005000000000000000600000000000000", @ANYRES32, @ANYBLOB, @ANYRES32, @ANYBLOB="12041e3c0594ff3217cda871759c21a70111b158a7b9ca2b7b255231b4de536b549f5943ede51ae7dce18e97ff99b049e51a7f3340bb5914b7"], 0x48) 1m6.056207715s ago: executing program 5 (id=1394): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f0000000280)=ANY=[@ANYBLOB="1801000021000000000000003b810000850000006d000000070000000000000095"], 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) r0 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f00000000c0)={0x2, &(0x7f0000000080)=[{0x5, 0x5, 0x5, 0xfffffa47}, {0x6, 0x7, 0x7, 0xfffff3c8}]}, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f0000000280)=ANY=[], &(0x7f0000000040)='GPL\x00', 0x6, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) sendmsg$netlink(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000002580)=[{&(0x7f0000000000)=ANY=[@ANYBLOB="1400000025000100000000000000040006"], 0x14}], 0x1, 0x0, 0x0, 0x400048c0}, 0x0) 50.530920637s ago: executing program 33 (id=1394): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f0000000280)=ANY=[@ANYBLOB="1801000021000000000000003b810000850000006d000000070000000000000095"], 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) r0 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f00000000c0)={0x2, &(0x7f0000000080)=[{0x5, 0x5, 0x5, 0xfffffa47}, {0x6, 0x7, 0x7, 0xfffff3c8}]}, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f0000000280)=ANY=[], &(0x7f0000000040)='GPL\x00', 0x6, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) sendmsg$netlink(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000002580)=[{&(0x7f0000000000)=ANY=[@ANYBLOB="1400000025000100000000000000040006"], 0x14}], 0x1, 0x0, 0x0, 0x400048c0}, 0x0) 3.004212419s ago: executing program 0 (id=1978): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=ANY=[@ANYBLOB="3000000010000100"/20, @ANYRES32=0x0, @ANYRES32, @ANYRES32=r0, @ANYBLOB="a71814e09e0402dd8f830eccb08df919c773", @ANYRES32=r0, @ANYRES16=r0], 0x30}, 0x1, 0x0, 0x0, 0x40040}, 0x0) (async) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$team(&(0x7f00000044c0), 0xffffffffffffffff) (async) ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f0000004700)={'team0\x00', 0x0}) (async) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x200440e5}, 0x0) (async) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), r1) sendmsg$NL80211_CMD_REGISTER_BEACONS(r1, &(0x7f0000000340)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x28, r4, 0x200, 0x70bd26, 0x25dfdbff, {{}, {@val={0x8, 0x1, 0x19}, @void, @val={0xc, 0x99, {0x200, 0x62}}}}, ["", "", "", "", "", ""]}, 0x28}, 0x1, 0x0, 0x0, 0x41}, 0x240080c6) r5 = socket$netlink(0x10, 0x3, 0x10) (async) bpf$MAP_CREATE(0x0, 0x0, 0x48) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) bpf$OBJ_GET_PROG(0x9, 0x0, 0x0) (async) bpf$PROG_LOAD(0x5, 0x0, 0xfffffe96) (async) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) (async) r6 = getpid() (async) r7 = socket$nl_generic(0x10, 0x3, 0x10) (async) r8 = syz_genetlink_get_family_id$devlink(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RELOAD(r7, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)={0x3c, r8, 0x1, 0x70bd27, 0x25dfdbfb, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, @DEVLINK_ATTR_NETNS_PID={0x8, 0x8b, r6}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4040010}, 0x30) (async) r9 = socket$unix(0x1, 0x1, 0x0) bind$unix(r9, &(0x7f0000000180)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) (async) listen(r9, 0x0) (async) r10 = socket$unix(0x1, 0x1, 0x0) connect$unix(r10, &(0x7f00000006c0)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) sendmmsg$unix(r10, &(0x7f0000002640)=[{{0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000640)="b2", 0x1}], 0x1, &(0x7f0000000100)=ANY=[@ANYBLOB="14000000000000000100000001000000", @ANYRES32=r9], 0x18, 0x20040801}}], 0x1, 0x0) accept4$unix(r9, 0x0, 0x0, 0x80800) (async) syz_open_procfs$namespace(r6, 0xfffffffffffffffe) bind$netlink(r5, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$sock_int(r5, 0x1, 0x8, &(0x7f0000000000), 0x4) (async) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r5, 0x10e, 0x4, &(0x7f0000000640)=0x1800, 0x4) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f0000004bc0)={0x0, 0x0, &(0x7f0000004b80)={&(0x7f0000000500)=ANY=[@ANYBLOB="a0000000", @ANYRES16=r2, @ANYBLOB="050424bd7000fedbdf250100000008000100", @ANYRES32=r3, @ANYBLOB, @ANYRES32, @ANYBLOB], 0xa0}, 0x1, 0x0, 0x0, 0x4040800}, 0x24040084) 2.826038356s ago: executing program 0 (id=1980): r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x13, &(0x7f0000000240)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000003000083850000002d0000001801000020696c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000700000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000000)='kfree\x00', r0}, 0x10) (async) openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040), 0x801, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000480)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="b800000019000100000000000000000000000000000000000000000000000000fe8000000000000000833449155bf3c2640000000000000002000010"], 0xb8}}, 0x0) sendmsg$nl_xfrm(r1, &(0x7f0000000480)={0x0, 0x10, &(0x7f0000000440)={&(0x7f0000000000)=ANY=[@ANYBLOB="6501000014"], 0x188}}, 0x0) 2.744307659s ago: executing program 2 (id=1981): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000480)=@newlink={0x40, 0x10, 0x403, 0x0, 0x25dfdbfe, {0x0, 0x0, 0x74, 0x0, 0x800, 0x55007}, [@IFLA_ADDRESS={0xa}, @IFLA_IFNAME={0x14, 0x3, 'vlan1\x00'}]}, 0x40}, 0x1, 0x0, 0x0, 0x20000801}, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000000000000000000400000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000500)=ANY=[@ANYBLOB="140000001000010000000000000000000500000ac4010000060a0b040000000000000000020000004c000480340001800b000100746172676574000024000280090001004d41524b000000000c00030002b51112d439c5920800024000000002140001800b0001006c6f6f6b75700000040002800900010073797a30000000000900020073797a3200000000f70007404884b24b02a8a7758a688958ed60ecfd057e10926ba77e5596b13e43cd4488e4aa68a75f7236ec205b6e4cac2a0d86c336bf07dbe861f4f57bcef92dcf818d532d4475b5daa4dadc1690f228e860bba5a0b5d9bde86862e8f7fc08f0debd4974c6fae7d737a0007ec948ac4d8714ebff6b25648fb910e0d6d07f023cf5fa4051627b9c5b69e265538f9ba683bf172a5ff815afa543c12e550a1bcc9287080c7c12cc89d216c56febb0b06134672ea6b0077c846396169475f271319988f49ec94f2996e5d0e1cb151fb223e556f10fb681d068e055eb34e5f8fc7a524ffe5f4632a6c74ad0fe0b1542497d76a5a4416c47805e001c0005800800014000000008080002"], 0x1ec}}, 0x0) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r2, 0x0, 0x0) r3 = syz_init_net_socket$bt_bnep(0x1f, 0x3, 0x4) accept4(r3, 0x0, 0x0, 0x80000) 2.696768157s ago: executing program 4 (id=1982): socket(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="01000001"], 0x48) socket(0xa, 0x3, 0x3a) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-twofish-3way\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r2 = accept4(r1, 0x0, 0x0, 0x80800) sendmsg$DEVLINK_CMD_SB_OCC_MAX_CLEAR(r2, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000700)={0x0}, 0x1, 0x0, 0x0, 0x40000}, 0x8000) setsockopt$sock_int(r2, 0x1, 0x21, &(0x7f0000000940)=0x8, 0x4) sendmmsg$alg(r2, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r2, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r3 = socket(0x3c30652c1a025cf8, 0x80000, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f00000005c0)={'gre0\x00', 0x0}) bind$packet(r3, &(0x7f0000000180)={0x11, 0x0, r5, 0x1, 0x0, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}, 0x14) setsockopt$packet_int(r3, 0x107, 0xf, &(0x7f0000000240)=0xe9, 0x4) sendmsg$netlink(r3, &(0x7f0000002ac0)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000380)=ANY=[@ANYRES8=r4, @ANYRES16=r0, @ANYRESOCT], 0xdd12}], 0x1, 0x0, 0x0, 0x4008084}, 0x10) socket(0x10, 0x3, 0x0) (async) socket$nl_route(0x10, 0x3, 0x0) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="01000001"], 0x48) (async) socket(0xa, 0x3, 0x3a) (async) socket$alg(0x26, 0x5, 0x0) (async) bind$alg(r1, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-twofish-3way\x00'}, 0x58) (async) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) (async) accept4(r1, 0x0, 0x0, 0x80800) (async) sendmsg$DEVLINK_CMD_SB_OCC_MAX_CLEAR(r2, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000700)={0x0}, 0x1, 0x0, 0x0, 0x40000}, 0x8000) (async) setsockopt$sock_int(r2, 0x1, 0x21, &(0x7f0000000940)=0x8, 0x4) (async) sendmmsg$alg(r2, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) (async) recvmsg(r2, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) (async) socket(0x3c30652c1a025cf8, 0x80000, 0x0) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f00000005c0)={'gre0\x00'}) (async) bind$packet(r3, &(0x7f0000000180)={0x11, 0x0, r5, 0x1, 0x0, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}, 0x14) (async) setsockopt$packet_int(r3, 0x107, 0xf, &(0x7f0000000240)=0xe9, 0x4) (async) sendmsg$netlink(r3, &(0x7f0000002ac0)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000380)=ANY=[@ANYRES8=r4, @ANYRES16=r0, @ANYRESOCT], 0xdd12}], 0x1, 0x0, 0x0, 0x4008084}, 0x10) (async) 2.58423459s ago: executing program 0 (id=1984): bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000180)={0x0, 0xffffffffffffffff, 0x0, 0x7, &(0x7f0000000000)='cgroup\x00'}, 0x30) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$tun(r0, &(0x7f0000000000)=ANY=[], 0x38) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x13, r0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), r1) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000100)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000008c0)=ANY=[@ANYBLOB="98000000", @ANYRES16=r2, @ANYBLOB="010000000000000000003900000008000300", @ANYRES32=r3, @ANYBLOB="7c005a807400008005000700020000001e0001000a300c9f4816161b091b030430300109093006220b5112093003000007000100182418"], 0x98}, 0x1, 0x0, 0x0, 0x40080}, 0x20008840) openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0x60702, 0x0) 2.582051083s ago: executing program 4 (id=1985): r0 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000100)={'vcan0\x00', 0x0}) bind$can_raw(r0, &(0x7f00000001c0)={0x1d, r1}, 0x10) r2 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_buf(r2, 0x0, 0x29, &(0x7f00000000c0)="20e1b5d4ca774ff66b795ea456d05ae0", 0x10) sendmsg$can_raw(r0, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000140)=@can={{}, 0x0, 0x1, 0x0, 0x0, "0000000000000003"}, 0x10}}, 0x20000000) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002c80)={0x3, 0x4, &(0x7f0000000240)=@framed={{0x18, 0x2, 0x0, 0x0, 0x100}, [@call={0x85, 0x0, 0x0, 0xc2}]}, &(0x7f0000000100)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x9fd}, 0x94) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000200000a20000000000a01080000000000000000010000000900010073797a300000000038000000160a01020000000000000000010000070c00038008000140000000000900020073797a32000000000900010073797a3000000000140000001100010000000000000000000000000a079749279051b4df2947bcd61dcf4b930587aad9976b28982db278dbcb09e568fd82b91f0151f7a39d671ea6d9c1a56c1df82f93fae5dd7cc0fb3ebf814d35f87c762a68c378d0cf9763d12b525f4abee8c52a5856e7f02e20dd9637c58bf90dcb898586f864c066c157876d704b22b4a0d2b669185b7eca19c708132ab4c67db46bcc4d57249ff75b018a89da99e09ce1b85363734b8417a02f780663ef39e72ca860b6f622c2a667902567eb2fa12c989c2d6c86a005ccf49e9c6d0ec1fd2fcbf91ff018d735"], 0x80}, 0x1, 0x0, 0x0, 0x4}, 0x40050) r4 = socket$packet(0x11, 0x3, 0x300) r5 = epoll_create1(0x0) r6 = socket$inet_sctp(0x2, 0x5, 0x84) epoll_ctl$EPOLL_CTL_ADD(r5, 0x1, r6, &(0x7f0000000140)={0x10000010}) setsockopt$SO_ATTACH_FILTER(r4, 0x1, 0x1a, &(0x7f0000000040)={0x0, &(0x7f0000000400)}, 0x10) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = epoll_create1(0x0) ioctl$FS_IOC_SETFLAGS(r8, 0x40088a01, &(0x7f0000000000)=0x100) r9 = syz_init_net_socket$x25(0x9, 0x5, 0x0) ioctl$SIOCX25SENDCALLACCPT(r9, 0x89e9) epoll_ctl$EPOLL_CTL_ADD(r8, 0x1, r7, &(0x7f0000000400)={0x80002005}) bpf$BPF_LINK_CREATE(0x1c, &(0x7f0000000000)={r4, r7, 0x25, 0x0, @val=@netfilter={0x1, 0x1, 0x1, 0x1}}, 0x20) 2.550451271s ago: executing program 2 (id=1986): mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x200000c, 0x3032, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) ioctl$BTRFS_IOC_GET_SUPPORTED_FEATURES(r0, 0x80489439, &(0x7f0000000140)) mmap$xdp(&(0x7f0000800000/0x800000)=nil, 0x800006, 0x7000001, 0x6e073, 0xffffffffffffffff, 0x0) r1 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000380)={&(0x7f0000000080)=ANY=[@ANYBLOB="9feb010018000000000000001c0000001c00000003000000010000000000000e0200000000000000000000000000000404000000002e"], 0x0, 0x37}, 0x20) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000480)="5c00000012006bab9a3fe3d86e17aa0b046b876c1d0048380019001931a0e69ee517d34460bc06000000a701251e6182949a3651f60a84c9f4d4938037e70e4509c51c268811000000000000000000002571cd53b9851b30599980bc", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) recvmsg$kcm(r3, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000e40)=[{&(0x7f0000000300)=""/270, 0x10e}], 0x1}, 0x40002102) sendmsg$nl_xfrm(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)=ANY=[@ANYBLOB="6c0100001a0013"], 0x16c}, 0x1, 0x0, 0x0, 0x200000d0}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000280)=@base={0x9, 0x4, 0x4, 0xa, 0x20036, 0xffffffffffffffff, 0x0, '\x00', 0x0, r1, 0x2, 0x1}, 0x50) mmap(&(0x7f00001d4000/0x4000)=nil, 0x4000, 0x2, 0x30, 0xffffffffffffffff, 0x3000) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x200000c, 0x3032, 0xffffffffffffffff, 0x0) (async) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)) (async) ioctl$BTRFS_IOC_GET_SUPPORTED_FEATURES(r0, 0x80489439, &(0x7f0000000140)) (async) mmap$xdp(&(0x7f0000800000/0x800000)=nil, 0x800006, 0x7000001, 0x6e073, 0xffffffffffffffff, 0x0) (async) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000380)={&(0x7f0000000080)=ANY=[@ANYBLOB="9feb010018000000000000001c0000001c00000003000000010000000000000e0200000000000000000000000000000404000000002e"], 0x0, 0x37}, 0x20) (async) socket$nl_xfrm(0x10, 0x3, 0x6) (async) socket$kcm(0x10, 0x2, 0x0) (async) sendmsg$inet(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000480)="5c00000012006bab9a3fe3d86e17aa0b046b876c1d0048380019001931a0e69ee517d34460bc06000000a701251e6182949a3651f60a84c9f4d4938037e70e4509c51c268811000000000000000000002571cd53b9851b30599980bc", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) (async) recvmsg$kcm(r3, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000e40)=[{&(0x7f0000000300)=""/270, 0x10e}], 0x1}, 0x40002102) (async) sendmsg$nl_xfrm(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)=ANY=[@ANYBLOB="6c0100001a0013"], 0x16c}, 0x1, 0x0, 0x0, 0x200000d0}, 0x0) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000280)=@base={0x9, 0x4, 0x4, 0xa, 0x20036, 0xffffffffffffffff, 0x0, '\x00', 0x0, r1, 0x2, 0x1}, 0x50) (async) mmap(&(0x7f00001d4000/0x4000)=nil, 0x4000, 0x2, 0x30, 0xffffffffffffffff, 0x3000) (async) 2.267976833s ago: executing program 4 (id=1987): socketpair$tipc(0x1e, 0x0, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000040)={'wlan1\x00', 0x0}) ioctl$SIOCGETLINKNAME(r1, 0x89e0, &(0x7f0000000080)={0x4, 0x1}) sendmsg$NL80211_CMD_JOIN_IBSS(r1, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x40400880}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x44, 0x0, 0x0, 0x70bd2c, 0x25dfdbfb, {{}, {@void, @val={0xc, 0x99, {0x2, 0x57}}}}, [@NL80211_ATTR_PRIVACY={0x4}, @NL80211_ATTR_SOCKET_OWNER={0x4}, @NL80211_ATTR_BSS_BASIC_RATES={0x19, 0x24, [{0x4}, {0x36}, {0x60}, {0x1b, 0x1}, {0x16, 0x1}, {0x3, 0x1}, {0x60, 0x1}, {0xc, 0x1}, {0x1e, 0x1}, {0x68}, {0xb}, {0x2, 0x1}, {0x2}, {0x4, 0x1}, {0x12}, {0x16, 0x1}, {0x6c, 0x1}, {0xb}, {0x36, 0x1}, {0x48}, {0x3}]}]}, 0x44}, 0x1, 0x0, 0x0, 0x20040000}, 0x40800) getsockopt$bt_hci(r1, 0x0, 0x2, &(0x7f0000000240)=""/47, &(0x7f0000000280)=0x2f) socket$nl_netfilter(0x10, 0x3, 0xc) r3 = syz_init_net_socket$ax25(0x3, 0x2, 0xcf) r4 = syz_genetlink_get_family_id$nbd(&(0x7f0000000300), 0xffffffffffffffff) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000340)={0xffffffffffffffff}) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000380)={0xffffffffffffffff}) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000003c0)={0xffffffffffffffff}) r8 = accept4(r3, &(0x7f0000000400)=@nfc_llcp, &(0x7f0000000480)=0x80, 0x800) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000004c0)={0xffffffffffffffff}) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f00000005c0)={&(0x7f0000000500)={0xa4, r4, 0x0, 0x70bd2a, 0x25dfdbfe, {}, [@NBD_ATTR_SERVER_FLAGS={0xc}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x8}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, {0x8}}, {0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r5}}, {0xc, 0x1, 0x0, 0x1, {0x8}}, {0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r6}}]}, @NBD_ATTR_SOCKETS={0x28, 0x7, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r7}}, {0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r8}}, {0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r9}}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x6}, @NBD_ATTR_BACKEND_IDENTIFIER={0x4}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x4}]}, 0xa4}, 0x1, 0x0, 0x0, 0x800}, 0x4000054) r10 = syz_genetlink_get_family_id$gtp(&(0x7f0000000680), r8) sendmsg$GTP_CMD_NEWPDP(r8, &(0x7f0000000740)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000700)={&(0x7f00000006c0)={0x28, r10, 0x20, 0x70bd28, 0x25dfdbfc, {}, [@GTPA_TID={0xc, 0x3, 0x4}, @GTPA_O_TEI={0x8, 0x9, 0x2}]}, 0x28}, 0x1, 0x0, 0x0, 0x4800}, 0x800) r11 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000780)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0xfffffc00, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x5, 0x2}, 0x50) r12 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000c40)={0x11, 0x36, &(0x7f0000000840)=@raw=[@printk={@u, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xf}}, @snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x6}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, 0x1}}, @cb_func={0x18, 0x2, 0x4, 0x0, 0x6}, @map_val={0x18, 0x1, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x5}, @cb_func={0x18, 0x9, 0x4, 0x0, 0xfffffffffffffffe}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, 0x1}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x4}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x2}}, @map_idx={0x18, 0x8, 0x5, 0x0, 0x3}, @snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x80}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r1}}, @cb_func={0x18, 0x1, 0x4, 0x0, 0xfffffffffffffff9}, @alu={0x4, 0x1, 0x9, 0x8, 0x8, 0xfffffffffffffff8, 0x41bc37f0de68504}], &(0x7f0000000a00)='syzkaller\x00', 0x8, 0xb2, &(0x7f0000000a40)=""/178, 0x41000, 0x4, '\x00', 0x0, 0x0, r3, 0x8, &(0x7f0000000b00)={0x5, 0x2}, 0x8, 0x10, &(0x7f0000000b40)={0x0, 0x1, 0x8, 0x7fffffff}, 0x10, 0x0, 0x0, 0x5, &(0x7f0000000b80)=[0x1, 0xffffffffffffffff], &(0x7f0000000bc0)=[{0x1, 0x2, 0x8, 0x8}, {0x4, 0x1, 0xc, 0x8}, {0x5, 0x4, 0x5, 0x9}, {0x1, 0x1, 0x8, 0x1}, {0x4, 0x63182e75, 0xb, 0x7}], 0x10, 0xc933}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000d40)={{r11}, &(0x7f0000000800), &(0x7f0000000d00)=r12}, 0x20) ioctl$F2FS_IOC_MOVE_RANGE(r12, 0xc020f509, &(0x7f0000000d80)={r1, 0x44, 0x0, 0x9}) ioctl$PPPIOCSDEBUG(r13, 0x40047440, &(0x7f0000000dc0)=0xe46) vmsplice(r8, &(0x7f0000001280)=[{&(0x7f0000000e00)="afd049e7d15e3ce670feedf6fcfd7cc568abb833cb0afdf4cd074ae9df68a4c5b29124bd130a3670bd04a60f0236871099093820a1105cc9da892628f73dfe6999cccdfa48d91cff612beba6b231a227b6f7b0bf20511e6a551ad81c8cd53376a0f76c16759ffe65f264c9389c50fbb503ccda56fafd108713a8c539029f14330bd2f81e59a7d0e7b089e1dfd164621ed85fa1a3c48915219a6e943bdadda0d40db8a9a8e96eb73f25efb020ad3cc58da1f7b4569a8c9b108279c65fc2c54f19cb634ae2c9024d3bc6fb4c8bbcb32f6ec8b6d552", 0xd4}, {&(0x7f0000000f00)="93a091374d2a7a90cb4875971fc5b2125a5353f5339c730ad6b0e0834b881cfe4415388264", 0x25}, {&(0x7f0000000f40)="51dcbccb711233b193c5bd01", 0xc}, {&(0x7f0000000f80)="36e2ac2e8b2b1702407c063cb093d9aeb741233fe58fe81242bac1a15d6fde848424f4484a3ed80f37330a17eb50b394a4f1b657c09bc58b8de158648f69cc6e1e91cce4b9c8e1d5d4a405ba90e54b35849743b5c887f571545bb94b208a084f46525b79331bbfe1fdd6a495f4d57ed1989b0df60a98245145f290d2a051d8a6932d35d640d895c9860a8920bea1ac76c9df9081d5a4427695caf2295f8646c3e95f58f06d398daf6c3425cf909a31c116504d9c32f9fd3f6e5574301406686b03cdfe3f976d6553337caee7cb875918128b86c08a7ee5f7c5069ea741ee306a675901f4cb1a3bd8ca908ca793ef19b8a761", 0xf2}, {&(0x7f0000001080)="02d5792766723470c3d46b8f7f570195d0ea0b19466a10b7c8b000083a34e93825812977", 0x24}, {&(0x7f00000010c0)="e80198c309f0ed94f1858d74a7eca25e76959c5aaee13acc560d5b3424876ad30dfa272432e223e917a95a1ca95f6328818b4eb142cd6116cb8a261ebb44a3f3b18de2c7fbec43fce89392f3652162043500f3ad15f9e37f374625f651badb4ba4f60c05e231a54617aba8801a207bb6fa988fd70f2df902d189b2b2c9e8", 0x7e}, {&(0x7f0000001140)="70d34e9d7fd74040f6f660e1ebe5ca46eb5c79398a57c406e2d88c145e99ee072deb2d76191d27f22cf60dc682fd396a16a57c9e0ea0f65df114353be40690c69cecbb37ebeb27644e07fb19607533e21cccd03e7412ab9db588f317f07f3cc7412bdf4548584660bf8f718aa9df3994328923845be3a1e45fd23747e042b79b737cdf6fd0f0093c0160a6bd17c657cb127c298e526584b4b7389fcefa4097921209a6305ec1be18df29597839bfec388b6934750e9eee5b29dd0bb06e1d6534337e8494effc", 0xc6}, {&(0x7f0000001240)}], 0x8, 0xa) r14 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r15 = syz_genetlink_get_family_id$nbd(&(0x7f0000001340), 0xffffffffffffffff) sendmsg$NBD_CMD_RECONFIGURE(r14, &(0x7f0000001400)={&(0x7f0000001300)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f00000013c0)={&(0x7f0000001380)={0x30, r15, 0x400, 0x70bd2d, 0x25dfdbff, {}, [@NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r6}}, {0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r7}}]}]}, 0x30}, 0x1, 0x0, 0x0, 0x2c008041}, 0x40000) sendmsg$NFC_CMD_LLC_GET_PARAMS(r14, &(0x7f0000001500)={&(0x7f0000001440)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f00000014c0)={&(0x7f0000001480)={0x1c, 0x0, 0x400, 0x70bd26, 0x25dfdbff, {}, [@NFC_ATTR_FIRMWARE_NAME={0x5, 0x14, '-'}]}, 0x1c}, 0x1, 0x0, 0x0, 0x10}, 0x48084) r16 = socket$phonet(0x23, 0x2, 0x1) ioctl$FS_IOC_ENABLE_VERITY(r16, 0x40806685, &(0x7f0000001680)={0x1, 0x3, 0x1000, 0xe5, &(0x7f0000001540)="3486bfc9d93413c30c049bbb3f69551f4e458bf6b31eae18454dc14f8539560f6e33580cd6983b19447ae4932fdfc0c37cbd931a82a00f3bf9e195c59b06976e78497bcaf3dc3df1d119cbf9c154543dd9a24429dd1d325a29cd6b1ea06c0548fd509baf143bd105bd15903e049885d08ce1b56eca27d36897985c7b0e4f351a1acd66a3d6b66982a58383753acb3505c1b1347208adb7c207a788abd6d1c016a21840875b6b62bdb67953c22bc83dc225795b4dbad7b8356bc580c338440be5793b9b917af86b237eeeeaba868daa2ab0c47a561df4c98f1d1286228ea12312ccbb57943b", 0x28, 0x0, &(0x7f0000001640)="e3a7f3b0966815b38b11f96008c8a5505fe3f99f25026238307b54976ff494917c7cd695d21b49ab"}) r17 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001740), r13) sendmsg$NL80211_CMD_SET_STATION(r8, &(0x7f0000001880)={&(0x7f0000001700)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000001840)={&(0x7f00000017c0)={0x48, r17, 0x400, 0x70bd2c, 0x25dfdbff, {{}, {@void, @val={0xc, 0x99, {0xc725, 0x69}}}}, [@NL80211_ATTR_STA_VLAN={0x8, 0x14, r2}, @NL80211_ATTR_STA_VLAN={0x8}, @NL80211_ATTR_REASON_CODE={0x6, 0x36, 0x3ff}, @NL80211_ATTR_MESH_PEER_AID={0x6, 0xed, 0x37b}, @NL80211_ATTR_PEER_AID={0x6, 0xb5, 0x277}]}, 0x48}, 0x1, 0x0, 0x0, 0x20000001}, 0x6048801) 2.215594271s ago: executing program 0 (id=1988): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=ANY=[@ANYBLOB="280000001800090000000000000000001c140000fe000001000000000c0005"], 0x28}}, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f00000000c0), 0x4) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000340)=@gcm_256={{0x303}, "0200", "ec094ea7c597058c35040000000009000000000000000000bd47a3ad00", "cf00", "fffffffffffffffd"}, 0x38) setsockopt$inet6_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000200)=0xffffffffffffffff, 0x4) writev(r0, &(0x7f0000000080)=[{&(0x7f00000002c0)="ec", 0xfdef}], 0x1) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) unshare(0x22020600) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, 0xffffffffffffffff, 0x0, 0x7, &(0x7f0000000000)='cgroup\x00'}, 0x30) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) splice(r3, 0x0, 0xffffffffffffffff, 0x0, 0x70, 0x6) socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)={0x14, 0x3e, 0x107, 0xfffffffc, 0x0, {0x1, 0x7c}}, 0x14}, 0x1, 0x0, 0x0, 0x404c0c0}, 0x2000c000) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f00000001c0), r4) sendmsg$NLBL_MGMT_C_ADDDEF(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[@ANYBLOB='L\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="01000000000000000000040000001400050003030000000a0000005dc00000000001080002000500000014000600ff01000a00f2f3f31f000a0000000001060001"], 0x4c}, 0x1, 0x0, 0x0, 0x8004}, 0x4040000) sendmsg$NFT_BATCH(r2, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a300000001f0900030073797a320000000014000000110001"], 0x7c}}, 0x0) ioctl$FIOCLEX(r2, 0x5451) sendmsg$NFT_BATCH(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="14000000104bb35c30dc3400010000000000000000000000000a60000000060a0104000000000000000002000000340004803000018008000100636d70002400028008000240000000000800014000000008100003800900010042f6cd04750000000900010073797a30000000000900020073797a3200000000140000001100010000000000000000000000000ac99a876c8d784cc1e7f773f05aa035725ac1d23b144424faf1eb36ed35e170ec3bb307b1e62b0324caf32f78e7e765b59667174bd9ae71fc4d90a5d80fd8ae83205d97e401"], 0x88}}, 0x0) 2.055669808s ago: executing program 2 (id=1989): syz_emit_ethernet(0x4e, &(0x7f00000002c0)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaaaa86dd6000000000180001fe800000000000000000000000000014fe8000000000000000000000000000bb2f0100000000000004017f01036d5ff919"], 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)={{0x14, 0x34}, [@NFT_MSG_NEWTABLE={0x14, 0x0, 0xa, 0x3, 0x0, 0x0, {0x7}}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x0, 0x84}}}, 0x3c}}, 0x20050800) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$inet6(0xa, 0x1, 0x6) setsockopt$MRT6_DEL_MFC(r2, 0x29, 0xcd, &(0x7f00000003c0)={{0xa, 0x4e21, 0x3, @loopback, 0x1}, {0xa, 0x4e21, 0x97, @private0={0xfc, 0x0, '\x00', 0x1}, 0xfffffffd}, 0xfffd, {[0x2, 0x0, 0x3, 0x7055, 0x2, 0x2, 0x6, 0x1]}}, 0x5c) r3 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x3) connect$bt_l2cap(r3, &(0x7f0000000380), 0xe) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)=ANY=[@ANYBLOB="7800000010000304000000000000000000007400", @ANYRES32=0x0, @ANYBLOB="00000000600000005800128008000100677470004c00028008000100", @ANYRES32, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="0800030002000000080007006401010108000700ac1414bb0800020003"], 0x78}}, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000001c0)={0x7, 0x4, &(0x7f0000001300)=ANY=[@ANYBLOB="180000000000000000000000000000006110b5000000000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xe}, 0x94) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r1, 0x10e, 0x4, &(0x7f0000000000)=0xb, 0x4) 2.021020538s ago: executing program 4 (id=1991): r0 = socket$inet6_udp(0xa, 0x2, 0x0) sendmsg$inet6(r0, &(0x7f0000000000)={&(0x7f00000000c0)={0xa, 0x4e20, 0x0, @loopback}, 0x1c, 0x0, 0x0, &(0x7f0000000280)=[@rthdr_2292={{0x28, 0x29, 0x5, {0x0, 0x2, 0x2, 0x1, 0x0, [@remote]}}}, @hopopts_2292={{0x18, 0x29, 0x36, {0x32}}}], 0x40}, 0x0) socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x40000000015, 0x805, 0x0) getsockopt(r1, 0x114, 0x2714, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket$kcm(0x10, 0x2, 0x0) setsockopt$bt_BT_POWER(r1, 0x112, 0x9, &(0x7f0000000040)=0x3, 0x1) bpf$PROG_LOAD(0x5, 0x0, 0x0) pselect6(0x0, 0x0, &(0x7f0000000280)={0x401, 0x1, 0x8, 0x3, 0x0, 0x5, 0x2, 0x3b9e}, &(0x7f0000000400)={0x0, 0x9, 0x2, 0x8, 0x8, 0x2, 0x7, 0x7}, 0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x48) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000440)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x800}, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000680)=ANY=[@ANYBLOB="14000000100001000000000000b890c1a000000a80000000160a01030000000000000000020000000900020073797a30000000000900010073797a30000000005400038008000240000000000800014000000000400003801400010076657468315f746f5f6272696467650014000100776732000000000000000000000000001400010076657468305f746f5f7465616d00000014000000110001"], 0xa8}}, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r3, 0x8923, &(0x7f0000000140)={'wg2\x00', @local}) 1.884072612s ago: executing program 0 (id=1992): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) sendmmsg$inet6(r3, &(0x7f0000000e80)=[{{&(0x7f0000000000)={0xa, 0x4e21, 0x7ffb, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x1}, 0x1c, &(0x7f00000002c0)=[{&(0x7f0000000380)='1$', 0x2}], 0x1, &(0x7f00000005c0)=ANY=[@ANYBLOB="28000000000000002900000039000000ff02000700000000fe880000000000000000000000000101880000000000000029000000390000003c0e010500000000fc000000000000000000000000000001ff010000000000000000000000000001fc020000000000000000000000000000fe8000000000000000000000000000bbff0200000000000000000000000000010000000000000000000000000000000000000000000000000000000000000000b80000000000000029000000390000000614010b0000000000000000000000000000000000000001fe880000000000000000000000000001fe8000000000000000000000000000aa20010000000000000000000000000002fe88000000000000000000000000000100000000000000000000ffff00000000fc000000000000000000000000000001fe880000000000000000000000000101fe8000000000000000000000000000aafe8000000000000000000000000000bb1400000000000000290000003e0000000400000000000000500000000000000029000000360000009e06000000000000010900000000000000000001000718000000000409090006000000000000000400000000000000c2040000000305026e1a0000000000000058000000000000002900000039000000110802050000000000000000000000000000ffff0a01010120010000000000000000000000000000fe80000000000000000000000000003e000000000000000000000000ff00000028000000000000002900000004000000020100000000000005020001c2040001000000010000000014000000000000002900000008000000050000000000000014"], 0x280}}], 0x1, 0x40048d1) setsockopt(r3, 0x84, 0x11, &(0x7f0000000040)="020000000980ffff", 0x8) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(r2, 0xd000943d, &(0x7f00000013c0)={0x100, [{}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0}], 0x8, "0b68f68222a6fa"}) ioctl$BTRFS_IOC_INO_LOOKUP(r0, 0xd0009412, &(0x7f00000023c0)={r4, 0x3}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r5, {0x0, 0x1}, {0xffff, 0xffff}, {0x0, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000600)=@newtfilter={0x38, 0x2c, 0xd27, 0x30bd29, 0x25dfdbfc, {0x0, 0x0, 0x0, r5, {0x0, 0xf}, {}, {0xfff2, 0xffe0}}, [@filter_kind_options=@f_u32={{0x8}, {0xc, 0x2, [@TCA_U32_HASH={0x8, 0x2, 0x80000001}]}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4004000}, 0x2008c014) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000005580)={0x6, 0xf, &(0x7f00000012c0)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x3}, {}, {}, [], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000001340)='syzkaller\x00', 0x1, 0x1d, &(0x7f0000001380)=""/29, 0x41000, 0x1, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3}, 0x94) 1.751924898s ago: executing program 2 (id=1993): r0 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000040)={0x80}, 0x10) sendmsg$nl_route(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000007c0)={&(0x7f0000000680)=ANY=[@ANYBLOB="440000001a00010000000000fbdbdf250a8080fc0000000000000000080001000000000008000100ffffffff08000400", @ANYRES32=0x0, @ANYBLOB="08001f00", @ANYRES32=0x0, @ANYBLOB="08000f"], 0x44}}, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000800)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={r1, 0x2000000, 0x10, 0x0, &(0x7f0000000540)="630b070046dc3ff1da33c9128d808619", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x2}, 0x50) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000280)={r1, 0x0, 0x6, 0xcb, &(0x7f0000000000)="617fb7361397", &(0x7f0000000080)=""/203, 0x16, 0x0, 0xee, 0xbd, &(0x7f0000000180)="a6addfe9146a8f580d4b48cb3c5fdda94337a48ae03195bebe0266b8034213675ea7938484ae37bfe38e23d31871dc5e88a6f8f8bb103405c53b2f14dd9460c43cbdc0e1835876501b0cf8f83a622dcff9167ad1adc1cdf2deffc48f6f6f73a4b132b469262d3d1dfab1280fc6490207b5c17955b428a6274c92153f9161c3b493d5773206660c33cadd06d80a10eb7855406939c67ee1de7f27b1da739c877a8e286e25c7a876c398f7f8be29d2d886dc94f0b938faee9ae1633ddf3f9463dfc836baab452408e69b8f7edee013b0b20435268bf425bb50ad1f7ebfe83661d1d671d4a925cca06a715e13e9e576", &(0x7f0000000340)="ca597ef8783500be4dcc0585f46c5a22407cc57df4c5f7b7f07bfd4417d080152b9981c3c92d09c7687ca7f2399e313c9335e08b530f6f6ff014de41996d479c9f1b6d930a6c25f5128d985e4be2de104dc6f618b4317b9a5738352808bab4e455296f2d1942f4c1ce91a9e5f2485cc2889af50dbfb07dbdec949084cf5e1671abe28983b085d04fa4371b983439ac88ab3a55ada757de65557659ab5554c55b0cb54e6b734a03b073829d6379bcac606a66379b37b09266e7e3c514f6", 0x7, 0x0, 0x5b}, 0x50) 1.637252868s ago: executing program 0 (id=1996): r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) r1 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_STAT_SET(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="30000000101401002cbd7000fedbdf25080003000100000008004a0001080000080001000000000008004b"], 0x30}, 0x1, 0x0, 0x0, 0x24044836}, 0xc094) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000200)='ns/pid_for_children\x00') bpf$MAP_CREATE(0x0, 0x0, 0x0) unshare(0x6a040000) ioctl$SIOCGSTAMPNS(r0, 0x8907, &(0x7f0000000000)) r2 = socket(0x8, 0x3, 0x0) ioctl$sock_netrom_SIOCADDRT(r2, 0x6180, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, 0x0, 0x0) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128\x00'}, 0x58) r4 = accept4(r3, 0x0, 0x0, 0x0) r5 = epoll_create1(0x80000) epoll_ctl$EPOLL_CTL_ADD(r5, 0x1, r4, &(0x7f0000000040)={0x7000000a}) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xb, 0xc3072, 0xffffffffffffffff, 0x0) r6 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r6, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/74, 0x328000, 0x1000}, 0x1c) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xb, 0xc3072, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x0, 0x42073, 0xffffffffffffffff, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(r2, 0x29, 0x22, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'ip6_vti0\x00'}) socket(0x10, 0x803, 0x0) sendmsg$netlink(r2, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000240)=ANY=[@ANYBLOB="3c0300001100000107000000fbdbdf252c032530c6fd3d025b948c762faf1afd2d36e700d33c32efdc67e98b982afa40f5a059f72137e95cf5e8d621dce3fbf7ff31b2d08bd885e853b24f4c0eeab854bcc9e156e94abc7dd58bba72a069cac8cc5d5ad5d312bd15ac3336c39662e226a2b076b7edc1e2028a1ea331df3290d4dc1dad9433690adc0e44ebb58bb885a974789d9328017242c14636ceaf0ee95b2660d3bc327e4c879f1304da51b1c70bb4c26238f9a3324d7c9a73a6f14e091cf0d1c1b3efd50f120b4747fc20b08e39e845153021ab3672be2903fa0ca38dafb60dd6dfe01e50dee3929364bb8bc4b3868599619f2db2061ab570d1539a90fda4ddaa17c4011b8e3f1458be94792b5fb2dfdd13a62413cf2f8ee950b58a45cf209dfa4875f1964839c1eb2d2f70731a2c2aee1d754a16df8b6d656a1234f31b6794770baa95d9496ca17f089abddaeb81330a0a71d0e6d6d9086fd84236bacf1157a40c2eb3a340552a98c8b760cf65e7b2be4e0405196ac88da06e562ce68223dae074e9de08cc03f9bfb6b010471e395c1f7dfeb30b38eca2d0beb19bc15070dba5152ab3004e89562bcd4468a67a2cb613b5c47e7b8f9f1990fca7d8e5d6d49b0ce79ce7d5e2ae83515b44c8bd441433794a9699e5c23d718281f6275c6a04547860b9cbc1f93a98f43dee20f013bdfb24eb37ce10fa97aac0487f3ecce790dda2f59a5ec652e494407a20219b961567f5e69b0f1b0a358bf8e72bd3b1c04c1f8e2f0dbd3114cc4627ec7f9c1886482e5d38c81e9c7101b45d2e3707b8ed5b068509e65cb9457a345b555cf9f240d51a878263da6bd6fcb681595e57bc690ae6f690886b0a6cb5fed5e1a0c777d25efd9ccfb2918b37f4f6d1b2183898619cc5514edc237cd102abd23bfeb5da1a9c99ab074650ec2caa56839c5fea3ceedfa86aef7d1a52318e5fe731d5da44c9cb360e3073d8868ce7c7819427c2d5dc265f89fe87874b52faa87ee95f01a2d2318dd59c9962c1c7adb3a075f30628270e1c7cd1d0e2a1e7a1612b0e83407067a34bd87c167391b857699755af0e9c8512f9474a81a9f3159c98cdac43ed573b31c8293e8b68d71ae4bbab2226517c881997b90d0000000000000000000020000041d540dc3e0178fd70d88333ae7a33115fe8b9fc1a3fe5cd5cb01de6ea0ffd61870de88d6f764eabef8daff956e3de33ce12db14e44e5ffc60dbba6c479df4cb973bd5dbe4aa840a2a17145dc5ad2b1a36f88d3a3cc939056f2878a52bfe5594ba3e21c58aa1bd57f187a786fd7e97b3cc7f2f5aac4ba149af71776ceb958b0cc3c09dc41608ed537419384f65628141"], 0x33c}], 0x1, 0x0, 0x0, 0x40}, 0x220448c1) 1.615607629s ago: executing program 2 (id=1997): bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2b, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000001280)={0x0, 0xa, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000f00000018010000646c6c2500000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], 0x0, 0x0, 0x0, 0x0, 0x61980, 0x0, '\x00', 0x0, @fallback=0x1, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x8000}, 0x94) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0a000000050000000200000007"], 0x48) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) bpf$PROG_LOAD(0x5, &(0x7f00000009c0)={0x1f, 0x4, &(0x7f0000000280)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0xdc, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) syz_genetlink_get_family_id$mptcp(0x0, 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_SET_LIMITS(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0, 0x24}, 0x1, 0x0, 0x0, 0x4015}, 0x40000c0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000001000)={0x0, 0x0, 0x0, &(0x7f0000001340), 0xede8, r0}, 0x38) sendmsg$tipc(0xffffffffffffffff, 0x0, 0x0) r2 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(r2, 0x107, 0xd, &(0x7f00000002c0)=@req3={0x10000, 0x1, 0x100, 0x100, 0x80000000, 0x0, 0x3}, 0x1c) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128-generic\x00'}, 0x58) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, &(0x7f0000000140)="2c385aa3d49100dc6626c892b6bc436a", 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), r1) r4 = accept4(r3, 0x0, 0x0, 0x0) sendmmsg$unix(r4, &(0x7f00000053c0)=[{{0x0, 0x0, &(0x7f00000003c0)=[{&(0x7f0000000100)="ab0afcd235388da8596affbe3db889f3c6fc4eaf82168b3f72c81691bc66785b6c528172", 0x24}, {&(0x7f0000000280)="9699901e28241dcaa7f5fb6ab6ab33d94c889890d748eebd0c20b7913bfdd56e32e7742876e45778c243198a4e2e688cf5aa5bbdcc7ddceabcce436e0d763d7e0854c2568840b07e9e2fe100048ae11f2e5ec2841625e5b2906ee4e4ad625c90ab6cebe2c5b2d3825e3e0be2a8a6d171c39dcbd89acb732d4bf6b4571344dfff", 0x80}, {&(0x7f0000000300)="e83bc4a556d71f44ba70f8d71d7b80b215f00b86749e87b0d2496a83379e7f0dd4e086dab0b9bede62be28608ad71c80e3ae38559c70a9f859e51181f69778776583e2059e09445900b4a1aee8e7cbd99745d0ecd482dca556f8dd7973d443a5a72eefc7bc0ae82ee1b706dcbd623fc13d0d0c961e70903cda3882005d3f66c9a4b59984524081be93e1f08358d1928aa0f0c05f3b1b37a0038c431ccf9772ee5bd561c468c91d30ec3802fb15a8b182efd737bccc62da", 0xb7}, {&(0x7f00000004c0)="cbf112190657eb676dcdd7fe41bd7ccb314b200e1482a1c4fc329f4152f84e9dd16c5173eeb43e8a1f4af860972f91b2607da26382011f5f236d755a178c91d58f26129088422edd69c8510c49be560ebab048432c44cd73afc2e3477f77f6add063962cfb18feec5606a6d2d2a79f2b05907463042de305fed3e1da822fe93d3a5474", 0x83}, {&(0x7f0000000140)="b6a25e9783f44f17a691e1417a243fd2375f0f3c877a7222b2ff66bf81ebd93664222f3027233a0d2c550003ea", 0x2d}, {&(0x7f0000000580)="097647d70e8eb61d9c0101dfcbcc94ba4ad4589bd1784bcb2faa9f159763e05858957532c85b5ada5cfe41aaba299f671c16810c0ead0ba644fdfe7c95229a8f4e260fe1e913d4190221718fa46e12b1412c8fc1af935e29a4f89a573185e21ce8a7cde5294350c22fae2eb2e2ba9f32abc6e1c7d9953cbdaffad1aab9d90c7e8c8778dc561817296b8e87ceaf8ad8aa7803b69b2fb973a2dabf3e1c1bbdec450eacba54852050b7cccd4b38b89d0583cc0e232e6112287f7b818ff092f4ef7f2e24d1089715b7b6540287963be04ee6f395d981321fe564d7900fab1711a16fc782168be279a8a62beb70e1838edc28", 0xf0}], 0x6}}, {{0x0, 0x0, &(0x7f0000001940)=[{&(0x7f0000000700)="7ce3d08f51f791cc6d19dcc5628bb6e84c7868832af40c7a70a4b0402c95ad10da45db3a9a143c0db45a8ffeac2992860237aced02558eea52619e21777151d8c741be3eeeccebd142b5d108fe2ef1e33050be4dc3ae323fd0386126f8f797974f86d1812b2026aa02e3a42031878474453f236c251de211354049f316a0412bc86754ee4be0a5734804616d8a9d76610cc782b0bf83fd0aaee926a6b151352214d7ad7b799152c6ddcd83fe196c47cc1fa648c840c270b30b771c4dede06380a82d0a4d6eca692e444869b47f2afabde26d4616024fdb4aac763a67b7213ca054cf4d314a68982b38ffb5e59bb824b0d2a99bbebfe8ad931db5da630e6caf36199ddb7d774f76a05573375c264d9ba69760e8ce6233d214fc57571619d7614d15021bc71aade95b9116369182a7baece212a5eb77218eae30665af5bd2d156bbc6759db1d2a78c8f77fb79f2561e060c9d0b80516fc5ba2efdeb7d2e7cafa869d7b2416e994267d0affe3013c8f5b78efa71b47b4f47b80855fe1e5cbecb023db6155a47833cbedb77a3e476facc2dcbb168e63cf34f47a8d4b26d3fd2f0c89124ef411726f165c3352e1c0fee2d6173efc7f7a60a2d5a2880d7cb2b0fb26e6ffcb6c29901a58ac71ba72eef7a6b970ff35b4822ac5e28158b0d7f1832eb4d2685b71fcb232084fec86367883d3df29e6627b0885d089e9e304cd011e545529339fb7bfec20fbd61299366954a0619eb548c2ac850e642e57aa75bff2622eea8d8af6c14f9552b778d3e766c231e903bddc843153fd279202bc01a67305359615f10eab518bc74edbc3113079f72eb45ae3d7027febd94cd54e1590d8c8cb5d43995f0afda7c8c8bbcba31a5e9eb247ff06fe4e0af50e9722bb401096e99f35becbe2b65bf1012fdb145d8e0f5d72b35a884e58fa071e1e4f569cb5b9c1858a1d79547c30ba06372f5f532501ef123cdad09bb8c0a4aee7959579d9b89679259e107eab9a874cd7852c2ead3934706b2623379247722c8dedbaad888e38d281d753230063d0392b85b91e628ef990c19aea0b3180af3db738132de7cab9f5f40093ddf59ad79667b76602e66d652175d07b68f8825cd4064d2fe6234ab7210accbf963177ef3da976c15ff4e9ec1f1158d3a1f9112bdffe2eb33b9f88ffd13dd30b0ecf99ec295f91b7a29d5f97b50740b1afcd94fe1ee503b627209d292d485136604e51f68b2fbf0cab3cde746e63be2c68c23dcfbbc41f12e2bcf1c0ecc7491ace19fcf351a0ae584dc3b751d6824864b759d8eaa0329635091bbb24c92f1ab3646b8272d0169d06f5c1179a214e5ad67f6a788b5df515e7313bf0fc76b0b7fee6854de721b9e67896b669130e69cdba57329f1608d1376712f99aea584ccd7cc7afc5135fe3082c021d3451158d9866b7f235584ac776ac8c1b919a83a20f8ffc7ea0970c700919d42ccaa0d133f1800e3e97707a1f743318b3e2944c20403ca5f812da0945c1c01dddca0328213f8142c0f6597095594eb2e2239ebf886dcad0532c197bcc85652cbe726728b89f4f1493a022d50c645eb8c0f1b5c1e9a7f8709bed8fd4307f39207bc1fec7e39013e2e65cb524e2d935cb9d9e0d5ffcedb4eeb8578f8734980778a5eedac3a9a4ce4b21162386535db0ffc0c8ede8ec73570f08e4a0387bf5a8668213ead82413f1b5e3565bbea564b297ce8ae3f764e7bae07c12405418c1b9018fd9a24375b6b64df17b5b7e447527892da00849cd35af71b323a146e3e594f521570c9db2d41bd4c1b7e431af3aa4e2bbdebadb3306ece2e8ad3b8f7a26cad18e0aa3d75d73ab47bc224f7ea10583f38dc244c670436f2ba9c5e448004ca3e152e85200734378ceed6a3e68f7006e48ac169c8500756281a6912f85f64f77b041dcb360597279fb500369d0b3dfb34df678675b284c7d44ae6b368a8d7367452626122b91640ff1f2f8c2962260655d6a33e20894a3274459d59a5f9ba3382ab58abe1fb7cf8eadffe3378eb5e8d3a600a4c01896b5b39ee50e3f83170bff4d5f587ef5299d2324a30702853c321cc803ab41332a5a744007dae28a7eb20fee7642f846b691507d1d4bce05732ba376f350c56a8d8f85cf49e5ccfc2d9dc2eb407e778b9231ec09499ec3d3dd18efafb146213cb8663887573487faceb63066fa56ff08360985575a730a30a4625705c28b80548e5c5a3094a44409651a9c3a5ca1d1ae932a9ba1cabfcdb57f675e9d7b3c409ecdef0b289400ca227023028b7dfe2b2a1d662c55b7fedcf7fca2dc9341db60566fe86ef79ce80fd9dacdb3df1797499b4ca95abcdb1ee655fec08b1a27ba73336cce0a0703cd020758e27e43286e5b034815e6e73bb3462fb9e9561a4e5449468c82a0e1d9185f03141b14921868cc78b7e5c9473e08e44ce776c4c03f1519679c210ebe1233dc330476529889027324c43d3d5a9dbdfec564b47ead8c84a1f5336a7f08d5add2029d7ba34964cd136f0f5cdaa7e56c6b2059dd9d83b32e6763fee941f5ede9d73fc9857f72c29c1f454faa1c1cdeb3f32d5f804dfef0dd4e64eff1ea026a9bc723f15e63e7df65cef60a44aa4bacf023887e8da3c9da64ea9ee3439b4ec56c05b19b135d80f588daf373e9c4cddf7831795c1406be6a37da5e310a481402f28d561dc6746a9de5b2bec91b302b19eb66b0df5ec040a15c5eb9debcd40382bf66e6a1a2a1de037abae677e49cf7714235f907c62b2b5ac4f35c79aa978c796b393c7f309a97f702b4a3b9057df1e443e912e2c7680b0a80c4f5c4352a77b3759271bf4fbbebe65241aaccab1201b7d4caff946ad4bccb6c0b08c8eb829730371c99699dde33384ba359c4c2177eec0c3c88ea7121a4ed24e6aa25c2fbc0b525f0832b592bfcdb32239001220ee5fcf06e1372e64e831e03cf4aa0c4ea24f6c03d71df6f6fc441e92304f53f6e084d38a13b4e95d45738a5d05c859013f33178ed50264178e44852f07dd0cf4ce5ed8940e2ca8bc30ec716c4935aac701b016773002f8d7a0014693f1068b762a3880d2332b875cc36f51e39411a244cc5cf5df5cbcb7c981ce1730af2e4795d9fc34f75e54e003f1d1b431988d5830d31f83b64a61d0a52a92986ef11c2a5004e8a556235df5bc3dc735758248c27fc1ad9f41dc4df96a680a2531b109e1ef1069699ca91314b6ae3a55a86ad78d7b216ceb9dc22e213adfc2b2770531dafd3bd4b7667d583bfb82c8882912fdb65a4f1974b1050a3ff033a0db99c9d90ee0939c89971d7f9f0196a12f49abfb20fe12118d824738ac47ed78592289488dd1e88e1f585a2255d1cfc48e2de576e744843b51f3a3fb7f2df38244b15dfb86037f9609c98462dc3c42b12afb6ee6611c43acec4c9096849fe86abe75c143d76c94ecef594d2807d8b6add63ce2f0152b9cc3e503015901c5dab9bc4144485c46ff8b6f3e674586e457381cc12ed3580c8230bc80111f9ab8135a5f6378c719950eca92ab4c1ba23c9bde004e5201b0aba034018ab7ffc53c561c226152240bd5316063fa5fc229fd748dc000dfacc722273c6fc7f6c33d3296d5d6040fd9215cf245804b3e4e90d3e08c11e83e9feb53b4c2884b3e6061e57af2e3c254a3559568934815df2180c0a0dbad1af61d3ba66bdaf5a0a3127b5db00bd539e666ac41098f6e3d8b9dd5e814a44909af17f0a754fc0fe8eef3f04905547ec3ca21986f33450f2a725b0d897cc5d0bf63aa2b320ed1e5020c49f59c09f5e353fb71075f6c12a3dd83befb6cc1c8a7b31fcd8289bc00f0c667341f041cc530067c36f705b0604df8c7fab657395516b2199d599b8a171a3430db5d0528dc57149e2bd8165b5ad4cabcb9dbdba484b69899139e2b552531d2ae44e3524de2620154dd77ead4310644b64f4c88abb80fc6730468c822374fb0b7078babcb8bce6f2f1732a11e5c33be2cd6d73f045b176e916819f46c75fbdaad0ef3cb7688eb02f458ffe03c6a18bba9241cafaca068761b27232742f7d51453d89bf8cad61d5e24d7fc4c0fc567aeb3c7c9198815a4300173e1ddbdf52d206bacc8b5aad71b5e4b8a053c8c0c627d412aef73119d7d91c1708bd788b7f60434b24b313a486f9a88628acede886902819b5b9c4d294f8f4f1c7f2960f9a4fb062006e8e52afb20fb9daf7b17cb595ae8cd05eec8aaf3257d638b7b311263f1e43718a9e98e1664bd9fa0c92183e0aea71d07afc653c7b60b0f382bb3379775514149b43652fa77dc70802318347e8efab61daa00141f55017a0904aec934179db81527426809440edf4b68538165b6f63dfbe2d3d85ced428713c4e1daec44ddc79eea8953be8035aafd18cf0f1147e65f4b8f9976d73d04b504a0144df4d0ab6e6072cbdf11baaa16fc5487a6e224e67dd600869ae6ecfaec0a23886f9d5e61f10a6fef6e29a41932c0d4133e405b7f0c80b931ccbf59ee26ddc9ff144790eda3006a66055fd2351715e46ac0cdd525b582fc1cd75355b7c408f699c4391c14fcf91b98125325e5fb6d78a8df272088ec082b8d2e249a48fc34f46717b4384ee9161b33376ebd5715d2cec0303ce64ce1c0857fba3d7a0ee8d1af9b1695ece8aca91195a9a7c337126e943e67152b345cae1b8cee060a455f0a3c24090ae5b309ba2a6f402a9b8bf87fb974fcb20c12441f5e7c592a12e1587ad57f6dc5968", 0xd06}, {0x0}], 0x2, 0x0, 0x0, 0x20044810}}], 0x2, 0x8004) setsockopt$packet_int(r2, 0x107, 0xc, &(0x7f0000000000), 0x4) socket$inet_icmp_raw(0x2, 0x3, 0x1) unshare(0x6a040000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, 0x0, 0x0) socket(0x200000000000011, 0x2, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) 1.52023219s ago: executing program 6 (id=1998): r0 = socket$kcm(0x10, 0x2, 0x10) recvmsg(r0, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000980)=""/70, 0x46}, {&(0x7f00000001c0)=""/172, 0xac}, {&(0x7f0000001c80)=""/4114, 0x1012}, {&(0x7f0000000680)=""/194, 0xc2}, {&(0x7f0000000180)=""/45, 0x2d}, {&(0x7f0000000280)=""/21, 0x15}, {&(0x7f0000000040)=""/17, 0x11}], 0x7}, 0x40012102) r1 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4000000000000007910480000000000610400000000000095000000"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x48) close(r1) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000029c0)={0xffffffffffffffff}) bpf$TOKEN_CREATE(0x24, &(0x7f00000003c0)={0x0, r0}, 0x8) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000580)={0xe, 0x4, &(0x7f0000000800)=ANY=[@ANYRES32=r2, @ANYBLOB="3baff006a51b3e4650a03fe2f28fd22c26b88a31a19c4191b8ace62d98d03a90c3c984cfca7d222743e273eb1e0958d88a4cd37b39133e23faf7ed38e222ba1e3642321c9a33a6b0aac803916a1cddcc0959370c351455495ae998d3f7e1ae6152a1d08fc542616f5b5306ad52e3253ef0b1f265852a333362a8a5c1d51e34da99ca7c5378dc2ef2505c296552478b44aa08ca3215f26f17f0ec7b3e0bb2e9fa1925bbc6141ac57babba38a263474f2c28387ce6c76f1e4e8cfa243871ddba64c95a4fe633b3a0"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x94) syz_emit_ethernet(0x82, &(0x7f0000000100)={@multicast, @remote, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x74, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x3, 0x5, 0x0, 0x3, 0x0, 0x0, {0x16, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5e, 0x9, @dev, @remote, {[@timestamp_addr={0x44, 0x44, 0x0, 0x1, 0x0, [{}, {@remote}, {@dev}, {}, {@multicast2}, {@loopback, 0x5}, {@local, 0x4}, {@multicast1, 0x6}]}]}}}}}}}, 0x0) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="0f000000040000000400000012"], 0x48) r5 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r5, 0x10f, 0x87, &(0x7f0000000040)=@req={0x3fc, 0xfffffffc, 0x0, 0x6}, 0x10) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000300), r6) sendmsg$SEG6_CMD_SET_TUNSRC(r6, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000400)={0x28, r7, 0x821, 0x70bd27, 0x25dfdbfd, {}, [@SEG6_ATTR_DST={0x14, 0x1, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010902}}]}, 0x28}, 0x1, 0x0, 0x0, 0x41}, 0x88efa964645774f0) sendmsg$SEG6_CMD_DUMPHMAC(r5, &(0x7f0000000380)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)={0x24, r7, 0x20, 0x70bd2d, 0x25dfdbfc, {}, [@SEG6_ATTR_SECRET={0x10, 0x4, [0x80, 0x3, 0x2f5]}]}, 0x24}, 0x1, 0x0, 0x0, 0x4000800}, 0x1) bpf$BPF_PROG_DETACH(0x8, &(0x7f00000007c0)=ANY=[@ANYRES32=r4, @ANYRES32=r3, @ANYBLOB='&'], 0x10) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000000c0)={{r4}, &(0x7f0000000000), &(0x7f00000002c0)=r1}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000009c0)={{r4}, &(0x7f0000000940), &(0x7f0000000980)=r1}, 0x20) sendmsg$kcm(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000480)=[{&(0x7f0000000000)="1400000010003507d25a806f8c6394f90324fc60", 0x14}], 0x1}, 0x0) 1.380665441s ago: executing program 3 (id=2000): r0 = syz_init_net_socket$ax25(0x3, 0x2, 0xcc) r1 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000440)=[{&(0x7f00000000c0)="cb000000150081054e81f782db44b904021f08010a000000040000a118000200ac14000000000d1208000f0100810401880016ea1f0006ea7f400303000803600cfab94dcf5c046181d67f6f94007134cf6ee080005c4ab0f45312b3429fa0e408f456211bef32d4760000000000cb090000001fb791643a5ee4001b146218a07445d6d930dfa1d7071b8b08a24211d2530205e1d9d322fe7c9fd60100730d16a4683f5aeb4edbb57a5025ccca9e00360db70100000040fad95667e0060000000000000080bb9ad809d5e1", 0xcb}], 0x1, 0x0, 0x0, 0x7400}, 0x2400c804) r2 = socket$xdp(0x2c, 0x3, 0x0) r3 = socket$xdp(0x2c, 0x3, 0x0) close(r3) ioctl$sock_ax25_SIOCADDRT(r0, 0x891e, 0x0) accept4(r2, &(0x7f0000000000)=@phonet, &(0x7f0000000080)=0x80, 0xc0800) 1.324071273s ago: executing program 6 (id=2001): r0 = syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) bind(r0, &(0x7f0000000580)=@hci={0x1f, 0xffffffffffffffff, 0x3}, 0x80) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0x9, 0x4, 0x8, 0xe, 0x0, 0xffffffffffffffff, 0x8}, 0x50) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000006020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b70300000000ecff850000000400000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x33, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) unshare(0x400) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r3, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_rx_ring(r3, 0x107, 0x5, &(0x7f0000000140)=@req3={0x1000, 0x3a, 0x1000, 0x3a, 0x7ff, 0xf83, 0x3}, 0x1c) r4 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000440), r4) r5 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r5, 0x1, r3, &(0x7f0000000000)={0x2}) r6 = bpf$PROG_LOAD(0x5, 0x0, 0x0) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r7, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={0x0, 0xfc}}, 0x0) r8 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0a00000004000000040000001200000000000000", @ANYRES32=0x1, @ANYBLOB="000000000000000000000000000000ffffffe800", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) bpf$BPF_LINK_CREATE(0x1c, &(0x7f00000001c0)={r6, r8, 0x26, 0x0, @void}, 0x10) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000005c0)={&(0x7f0000000080)='kfree\x00', r2}, 0x10) socketpair(0x11, 0xa, 0x0, &(0x7f0000001080)={0xffffffffffffffff, 0xffffffffffffffff}) bind$alg(r10, &(0x7f00000003c0)={0x26, 'hash\x00', 0x0, 0x0, 'sha3-224-generic\x00'}, 0x58) sendmsg$WG_CMD_SET_DEVICE(0xffffffffffffffff, &(0x7f0000000d00)={0x0, 0x0, &(0x7f0000000cc0)={&(0x7f0000000140)=ANY=[@ANYBLOB="1c0200", @ANYBLOB="0100000000000000000001"], 0x21c}, 0x1, 0x0, 0x0, 0x20040010}, 0x4008804) r11 = socket$inet6(0xa, 0x3, 0x5) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r11, 0x29, 0x20, &(0x7f00000000c0)={@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x800, 0x0, 0x3, 0x9}, 0x20) setsockopt$inet6_int(r11, 0x29, 0x1000000000021, &(0x7f0000000000)=0xffffffc3, 0x4) sendmmsg(r11, &(0x7f0000001500)=[{{&(0x7f0000000040)=@l2tp6={0xa, 0x0, 0x7080000, @dev={0xfe, 0x80, '\x00', 0x31}, 0x4, 0x1}, 0x80, 0x0, 0x0, &(0x7f0000000140)=ANY=[], 0x28}}], 0x1, 0x40) socket(0x27, 0x0, 0x7fffffff) r12 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000040), r9) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r9, &(0x7f0000000380)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000340)={&(0x7f0000000200)={0x2c, r12, 0x200, 0x70bd29, 0x25dfdbfc, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x4}, @MPTCP_PM_ATTR_TOKEN={0x8, 0x4, 0xfffffffc}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x30000801}, 0x4004810) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)) openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x8, 0x0) 1.286328476s ago: executing program 3 (id=2002): socket$nl_netfilter(0x10, 0x3, 0xc) (async) socket$nl_netfilter(0x10, 0x3, 0xc) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000780)=ANY=[@ANYBLOB="18000000002cd87e380000000000000085000000b40000001801008c6ffddf7d00000080000000007b0af8ff00000000bfa100000000000007010000f8ffffffb70200bc74a0fd9800080000000900000a00000000850000fa323a4b0095"], &(0x7f0000000440)='GPL\x00', 0x1, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x1e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40}, 0x94) (async) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000780)=ANY=[@ANYBLOB="18000000002cd87e380000000000000085000000b40000001801008c6ffddf7d00000080000000007b0af8ff00000000bfa100000000000007010000f8ffffffb70200bc74a0fd9800080000000900000a00000000850000fa323a4b0095"], &(0x7f0000000440)='GPL\x00', 0x1, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x1e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40}, 0x94) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) socket$inet_icmp_raw(0x2, 0x3, 0x1) (async) r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x16, 0x3, &(0x7f0000000000)=ANY=[@ANYBLOB="dbaa00fea0000000711097000000000095"], &(0x7f0000000480)='syzkaller\x00', 0x5, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x790f}, 0x94) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) (async) close(0x4) r2 = syz_open_procfs$namespace(0x0, &(0x7f0000000080)='ns/ipc\x00') r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r4 = socket$kcm(0x2, 0xa, 0x2) sendmsg$NFULNL_MSG_CONFIG(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000700)=ANY=[@ANYBLOB="1c000000010483060900000000000000000000000600064000000000b48268cf4da3102fef0bc0105dacd2a4fef21678886eb99e2a85e7c188fe015b10a8d35d5f0848efbd4a4a064b8f6058f87761ce6aad3811d2a9eda7d8c2e682d6e3ad4fcc7d701bc09b359f"], 0x1c}}, 0x0) (async) sendmsg$NFULNL_MSG_CONFIG(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000700)=ANY=[@ANYBLOB="1c000000010483060900000000000000000000000600064000000000b48268cf4da3102fef0bc0105dacd2a4fef21678886eb99e2a85e7c188fe015b10a8d35d5f0848efbd4a4a064b8f6058f87761ce6aad3811d2a9eda7d8c2e682d6e3ad4fcc7d701bc09b359f"], 0x1c}}, 0x0) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r3, &(0x7f0000000040)=ANY=[@ANYBLOB="034886dd0100000000001400000060"], 0xfdef) bpf$MAP_CREATE(0x0, &(0x7f0000000840)=ANY=[@ANYRESHEX=r2], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000010c0)={0x16, 0xc, &(0x7f00000004c0)=ANY=[@ANYRES32=r0], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x19, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000300)={r5, 0x2000000, 0xe, 0x0, &(0x7f0000000600)="c9f7b98600"/14, 0x0, 0x7ffd, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) write$bt_hci(r1, &(0x7f0000000dc0)=ANY=[@ANYBLOB="011220070300000000000036d0875137b479a1a8dfa4d745868450988494e4b86a782c651a8b4ad2a6b7f000000000000000000000000000000000000000657f4dd9acb2733966370124f5c1ffe42e18e39a0cb01dc92ca69b6be73025ba2a7c2da438e8a2326e1bfdb858d264f340804875171dc2640839e5eddf676ce19f8b4f38fc6f50eadc4cc39ead7f84e6f2a1fb697aaae28eba6f89f8cd23bf4b0df8d71a06120600a95ea883ac1a7cd504635fb64120f7e3fe02007053e13fb1b9bdbf6bf7ebdd96185aeafe34233a50ddcdc5492c3d686ac97e78358e65ccd0c6a4d5b57bffaade70430a5e1e31b8d42f33ab4efc64c3ac4c490fc0f053a42790a12cd646e295f86beaf30a0a593677af21d7d95109136056743ed2c59b7d07cbe7b4e8353321775105901b4999b07f59d051e4ab0f30d4973f15910741b6e2ec373ac0617087"], 0xb) (async) write$bt_hci(r1, &(0x7f0000000dc0)=ANY=[@ANYBLOB="011220070300000000000036d0875137b479a1a8dfa4d745868450988494e4b86a782c651a8b4ad2a6b7f000000000000000000000000000000000000000657f4dd9acb2733966370124f5c1ffe42e18e39a0cb01dc92ca69b6be73025ba2a7c2da438e8a2326e1bfdb858d264f340804875171dc2640839e5eddf676ce19f8b4f38fc6f50eadc4cc39ead7f84e6f2a1fb697aaae28eba6f89f8cd23bf4b0df8d71a06120600a95ea883ac1a7cd504635fb64120f7e3fe02007053e13fb1b9bdbf6bf7ebdd96185aeafe34233a50ddcdc5492c3d686ac97e78358e65ccd0c6a4d5b57bffaade70430a5e1e31b8d42f33ab4efc64c3ac4c490fc0f053a42790a12cd646e295f86beaf30a0a593677af21d7d95109136056743ed2c59b7d07cbe7b4e8353321775105901b4999b07f59d051e4ab0f30d4973f15910741b6e2ec373ac0617087"], 0xb) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="180100001c0000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f00000003c0)='sys_enter\x00', r6}, 0x18) (async) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f00000003c0)='sys_enter\x00', r6}, 0x18) pselect6(0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={0x0, 0x3938700}, &(0x7f00000002c0)={&(0x7f0000000280), 0x8}) bpf$OBJ_PIN_PROG(0x6, 0x0, 0x0) (async) bpf$OBJ_PIN_PROG(0x6, 0x0, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r7, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB="18000000240001030000000000000000010000000400ae"], 0x18}, 0x1, 0x0, 0x0, 0x48041}, 0x4000) syz_genetlink_get_family_id$mptcp(&(0x7f0000000080), r7) recvmmsg(r7, &(0x7f0000008200)=[{{0x0, 0x0, 0x0}, 0x101}, {{0x0, 0x0, &(0x7f0000000500)}, 0x6}, {{0x0, 0x0, 0x0}, 0xfffffff8}, {{0x0, 0x0, &(0x7f0000000280)=[{&(0x7f0000000380)=""/172, 0xac}, {&(0x7f0000000540)=""/224, 0xe0}, {&(0x7f0000000980)=""/50, 0x32}, {&(0x7f00000008c0)=""/85, 0x55}, {&(0x7f0000001180)=""/4130, 0x1022}, {&(0x7f0000000640)=""/68, 0x44}, {&(0x7f0000000ac0)=""/240, 0xf0}, {&(0x7f0000000cc0)=""/251, 0xfb}], 0x8}, 0x80000000}, {{0x0, 0x0, 0x0}, 0x27}], 0x5, 0x12002, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000009c0)={0x3, 0x3, &(0x7f0000000500)=ANY=[@ANYBLOB="7a0a00ff000000007110790400000000950000be5f08822a724eceda1bc9590f32"], &(0x7f0000000000)='syzkaller\x00'}, 0x94) socket$inet6_sctp(0xa, 0x5, 0x84) (async) r8 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_INITMSG(r8, 0x84, 0x2, &(0x7f00000000c0)={0xfffc, 0xc}, 0x8) (async) setsockopt$inet_sctp6_SCTP_INITMSG(r8, 0x84, 0x2, &(0x7f00000000c0)={0xfffc, 0xc}, 0x8) 1.207323344s ago: executing program 6 (id=2003): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x5, 0xb, &(0x7f0000000340)=ANY=[], &(0x7f0000000040)='syzkaller\x00'}, 0x94) 1.08701158s ago: executing program 6 (id=2004): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000001ac0)={&(0x7f0000000100)=ANY=[@ANYBLOB="180000002d00010026bdf000fcdbdf25041a0000040010"], 0x18}, 0x1, 0x0, 0x0, 0x4000d}, 0x20000000) r1 = socket$packet(0x11, 0x2, 0x300) r2 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, 0x0) r3 = socket(0x2, 0x80805, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(r4, 0x8982, &(0x7f0000000080)) r5 = gettid() socket$inet6(0xa, 0x2, 0x3a) syz_open_procfs$namespace(r5, &(0x7f0000000340)) getsockopt$inet6_IPV6_XFRM_POLICY(r3, 0x29, 0x23, &(0x7f0000000680)={{{@in6=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@broadcast}}}, &(0x7f0000000040)=0x1ec7e61fd14509d3) sendmsg$nl_generic(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002300)=ANY=[@ANYBLOB="c05100003d0007012bbd700000000000027c0000ab513d8008002e00", @ANYBLOB="10004c800400618008008600e000000239004b802ecec93a090bc94759d8953e05de4a4d3c9290b77a22a93a472ed548246a253d41dfc4cadafbf0f274b972ad6ed50d0e3d267d06300000002d71dc6ade6567b191d5f6533a27fe160a4219041ff0d86157189c0a8ddc9fdaa8926556c679b97a7333b9b6b1647a6c9437ffbf59766e06aef96bff353465236b915beb0c4b55ccfe8621d74d72b6a6ad2e7911962ed79454ba461064e9a9271a1c20be020ccb8a969f718d089c3f5bb02d90f3298e9a46e86c35de2b02fee798743fa4b0998fc5a77524dda2d0bb4a47a6de4a0bd58abed5de04aa2673855bbb67edeb8ff72a209f347370c6af8e616d9f590c8938674c64ffbb6e0bee49623fe43b02104a08f0d87e68a7f6f39ff00ae2a75c7a8b901ff2e3f092dae1c06a5656a8f82a6436b6b639a5df67429b0c00de0069705f76746930001000ad800400e48004007b8004005b80ad027f8030917e5e4db12810b5e5ef7f102e1df76fa5e488a5365220514f48cfbf91e9e779998c7849a82b7c7fc53862230f37b8e3c059a517096b5888a9e2d55fafe724e22b2657916d11e38ddbb52537bf885e313041d6601a968ed7eef7b6735c57b2abe85de6a77e98d2e62f59b4e0fd9d3a55683c88a20654b7a52b4a7756368beb536592a1d7b749d18a0a6dbde45a805a48483d9ae623ab6ee3a0c99bd2a18d36ef39abae478e7699335bc1a96060ca67b8811be57928b9db7f63a51200378acee4ba1f8d0971f5d6d843a47d6c0732bd1c9a9b5da1070bb63f3a147b5d8be28af9c3140b568742b69f61db01394cd2adb27b3a884676c5d5be0477b0741b5a5a0443d8f7a42fba77329352fc39e5b073489cf5e9e61497ce365422ae8313918354f914dce9f97d05dde5f0aa6b8bf40bd670b961977a468b0fe317b20f54dd04005e800400178008008c000600000093005c00d259872228ba90e57c705fe4b09e089b1b3d1cbaccbe749e6c373f8c8cfa93e07bbcbda5a0eabfc7ca1dd949d74a10662be384f0b6e536bf034ca09f96abfa78c87461bd3aa7c594a94ed82e3b354489a130e7610bf2a88c0bdd4f3a38fb6c7a4f3f26e2836254c48c1e6c437475d5edad9c7823107fc024399df650990a6e82cc84cf2a938908516643ff0f193bd900313c482c2629a19f565fdf0d42d18c4f2112b5e49035f664e02aacd6964efcb1437f53a180a7ad7eaa6e7ebef4f14f78935d08002400ffffffff08003200", @ANYRESOCT=r0, @ANYBLOB="82004700b9acf7b8a44cc5f0f49539752e78cc4522ec0dd7a27ac972fc8a01c17eadbaabb72a528d0f70a018613a6b7f0284ad90fd10fbb77ff9322c53844b0c8a52ce12e49f5db09bead901d5febad8b4fe40b8cc807ab74737765da922f1b719ae96b7c594ce19d07ec1cc3da275058b36495dde732ed3ebd028efef19b0496adcd2578293616e9a03d00000000000874d268018ae6bdd1083e714391ac30f2bd0a0e25022a75ce5f4c00c71c834a448198a36a1ea38309673e2d2075f12a027000000000000000403c31c3ce9451515e1f7a6bd9150adfde10a95166207a1fa0e2e133bf29a8157744c181f4faf0c4c9033ad1a07776d11a74146eb52223a81a229847a45b8a9a8b7309b690dfd8bfb06af2fa6a7efb4c1b169745a3ed70884815a797463e4b3fcbac69eceb5f474bc41c8e94057c4f8bbef", @ANYRES32=r3, @ANYBLOB="c41520808aed75ebcc6f5be82472449abab77d0248e20035da934093c2ff654ae59f602aa3880c1bd42dae83bdd58e23ec3c69515dd0c2cd08393269acfeaa213b88cb73cca3990942db0747c872592a65d4d5443d6c377e5c6a47e0ee2696a33694685c52cf9290c3ff00e889dc33263ade5a4c6f081877a680b43247932456aaa38a722a75337730e934da07ec9b908dc45b23ceffa3a1f9d5c16328fa2e220da58478fd6fd93082f98018f5690d11b7369cece001902233a6cf931741ec6702148018003c8014002400ff0100000000000000000000000000010c003c006e6c3830323131000800b400", @ANYRES32=r3, @ANYRESDEC=r3, @ANYRES32=r0, @ANYRES8=r0, @ANYRES32=r5, @ANYBLOB="0800e3ae483d2f371e6e819c40c64ca059df00fbcb37c83b0004e9900f470a2d5df0394705a937f31d5eb9e7c16395", @ANYRES32=r5, @ANYRES8=r4, @ANYRES32=r2, @ANYBLOB="1200d20076657468305f746f5f626f6e640000000800b300d20b0000c1aaffbd86ed7a1f743f7cd91f509cb5db068cc65674e82189508d5c03ed83992b222cd96c356abfd7f3438fafb9bd1aa247bb153551acd4230891362567e6e02356d9dd81f9e31d1f085eff3dfb431bc5dbfd4d12cd2d88b9ce24727b16d2c7b4d943a1232b72a5b441673b04f2ee94cd415274392c5132897e0e681f48f41ba2b88584bbce9598da0d0aee4747d2549fba2c73c1cd699719861b637278753c858d702308003f0000000000e37e423dc16f237ee0bee1cea18ab1831273492f4228fdfad11fe1e0b71ee89258554360c7c026ae286ee8e934175c3359c89cabde4f1b1afdb786b120c01359add9103ef80e1ca27d7a47b4bfadc66b0824e5e73f8c60f318ba2761b49fa412c7ffb6e047befd492b13a5336ddc9062a0486be7260d6de7ea18a0452dd0b1bf86bbb9c889d39bf76abe840221e101692850d79ebee3f340f8758e4cea085cb9ce650092e804000d00000000f2df7d1b0d4be08ae7beaa9d19ef98d9f3cd31407329e9e16f1f3ef6f274231f821ec6aec0931574499e39a7b5302cd71aeb9901c9a1ae9b538a11977bb18c453b9947d651923730ae432f86021c41a3770e23401a39dc5999a4a63594", @ANYRES32=r1, @ANYBLOB="0800963c86b3c80e612f", @ANYRES32=r6, @ANYBLOB="d286f08aa14cdf3bac468a4a9300"], 0x51c0}, 0x1, 0x0, 0x0, 0x2c00c095}, 0xc000) r7 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r7, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$sock_int(r7, 0x1, 0x8, &(0x7f0000000000), 0x4) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r7, 0x10e, 0x4, &(0x7f0000000440)=0x1800, 0x4) r8 = socket$kcm(0x10, 0x2, 0x0) r9 = socket$nl_generic(0x10, 0x3, 0x10) r10 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), r9) accept$netrom(r3, &(0x7f0000000200)={{0x3, @rose}, [@default, @bcast, @default, @netrom, @default, @netrom, @rose, @default]}, &(0x7f0000000400)=0x48) ioctl$sock_SIOCGIFINDEX_80211(r9, 0x8933, &(0x7f00000008c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r9, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000980)={&(0x7f0000000000)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r10, @ANYBLOB="010000000000000000000700000008000300", @ANYRES32=r11, @ANYBLOB="140004006e696376663000ffffffff00000000000800050008000000"], 0x38}, 0x1, 0x0, 0x0, 0x10}, 0x240048d0) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x10, 0xe, &(0x7f0000000a80)=ANY=[@ANYBLOB="b7000000639d0000bca30000000000002403000030feffff720af0ffa4ffffff71a4f0ff000000001f030000000000002e100200000000002604f8ffffff000414010000000300001d130000000000007a0a00fe0020001f0f14000000000000b503f7fff80000009500000000000000033bc065b78111c6dfa041b63af4a3912435f1a864a7aad58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50becb150c537bf2085651d6dd6ce9bc461e91a7168e5181554a090f300020000fe275daf51efd601b6bf0134c8e8b1b526375ee4dd6fcd82e4fee5bef7af9aa0d7d600c095199fe3ff3128e599b0eaebbdbd732c9cc00eec363e4a8f6456e2cc21557c0afc646cb7798b3e6440c2fbdb00a3e35208b0bb0d2cd829e65440000000000000000028610643a98d9ec21ead2ed51b104d4d91af25b845b9f7d08d123deda88c658d42ecbf28bf7076c15b463bebc72f526dd70252e79166d858fcd0e06dd31af9612fa402d0b11008e59a5923906f88b53987ad1714e72ba7a54f0c33d39000d06a59ff61623604000000000000006a89adaf17b0a6041bdeebdfd1f5089048ddff6da40f9411fe7226a40409d6e37c4f46756d31cb467600ade70063e5291569b33d21dae356e1c51f03a801be8189679a16da18ec0ae564162a27afea62d84f3a10076443d643649393bf52d2105bd901128c7e0ec82701c8204a1deeed4136dc2869f478341d02d0f5ad94b081fcd507acb4b9c67382f13d000000225d85ae49cee383dc5049076b98fb6853ab39a21514da60d2ae20cfb91d6a49964757cdf538f9ce2bdbb9893a5de817101ab062cd54e67051d355d84ce97bb0c6b6a595e487a2cc47c0efbb2d71cde2c10f0bc6980fe78683ac5c0c31032599dd273863be9261eee52216d009f4c52048ef8c126aeef5f510a8f1aded94a129e4aec6e8d9ab06faffc3a15d91ff073e2e04cfe031b287539d0540059fe6c7fe7cd8697502c7596566d674e425da5e7f009602a9f61d3804b3e0a1053abdc31282dfb15eb6841bb64a1b3045024a982f3c48153baae244e7bf573eac34b781337ad5905c6bbf1137548c7f1a4cad2422ee965a38f7defbd2960242b104e20dc2d9b0c35608d402ccdd9069bd50b994fda7a9de44022a579dfc0229cc0dc98816106dec28eaeb883418f562ae00003ea96d10f172c0374d6eed826416050000000bfe9b4a9c5a90ff59d54d1f92ecc48899b212c55318294270a1ad10c80fef7c24d47afcc829ba0f85da6d888f18ea40ab959f6074ab2a40d85d1501783a7ab51380d7b4ead35a385e0b4a26b702396df7e0c1e02b88c114f244a9bf93f04bf072f0861f5c0b000000000000eedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba3401e6a52acb11883ad2a3b1832371fe5bc621426d1ed01b389708165b9cdbae2ed9dc7358f0ebadde0b727f27feeb7464dcd857ab15e355713767c536cbae2f5c7d951680f6f2f9a6a8346962a350845ffa0d82884f79adc287906943408e6df3c391e97ba48db0a5adbfd03aac93df8866fb010ae20e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00000000c95265b2bd83d64a532869d701723fedcbada1ee7baa19faf67256b56a41fd355b6a686b50f0937f778af083e055f6138a757ebd0ed91124a6b244f9acf41ac5d73a008364e0606a594817031fc2f52c8785fe0721719b3d654026c6ea08b83b123145ab5703dad844ced301efeb6dc5f6a9037d2283c42efc54fa84323afc4c10eff462c8843187f1dd48ef0900000000000000ff0f40b1888e1cdba94a6ea80c33ead5722c3293a493f1479531dd88261458f40d31fe8df15efaaeea831555877f9538c6ee6ba65893ff1f908ba7554ba583ec7932f5954f31a878e2fae6691d1aee1da02ba516467df3e7d1daac43738612e4fee18a22da19fc08001011e32f808890205f3a6da2819d2f9e77c7c64affa54fec0136cbafa5f62e3f753b639a924599c1f69219927ea5301fff0a6063d427180d61542c2571f983e96635600000554f327a3535e7c7542799493c31ac05a7b57f03ca91a01ba2a30c1675767999d146aef7799738b292fd64bb25b2969e2b15f36b788bce5ccdbaf75c94cb93499f6947a967a794963342aece449a0d80010f5c653d22d49030a8c2a4ab000000000000003f8dafc7ac96d404607a0000000051a2104f22e6db5a62b5089c1b45282d38864daa3ae81d6b0968d1d2867b91b7d12096833d6864da40b54783a17aaeb6737c323f9f98e354cc090000000000000061563e69ffe1c2c73e1661261173f359e93d2c5e424c17998809ec8f0232b3955e052a4cecd89008f70314a0bdd491ecab5d232f89fe0120f64c62e8e3ed8bcb45202c204bbec8d722824c0ebca8db1ea4a05e41f6016ab5bbe4fe7ff5d785d0128171c90d9901010000b0f9d01c4b45294fbba468df3e1b393cb4e62e753b4172ba435926b61c94bc5d047899fd219f448bf9189c65c9d91eda6b52a373803a9efe44f86909bc90addb7b9aee813df534aac4b3093c91b8068cd849904568916694d461b76a58d88cf0f520310a1e9fdc18cde98d662eee077515d0aa81192292ffff5392ab3d1311b82432662806add87047f601fa888400000000000000000000000000006acc19808d7cf29bc974b0ea92499a41b9b9a7c2bca311a28ee4952f2d325a56397c78f12205db653a536f0100e0eda300a43a13bd1b9f3322405d1efd78e5789c6b3fb84f3738a4b6caa800000087efa51c5d95ecba4e50e529d1e8c89600e809dc3d0a2f65579e23457949a50f2d0455cf79a43746979f99f6a1527f004f1e37a3926937e84fb478199dc1020f4beb98b8074bf7df8b5e783637da740800000000000000c55a4385e9a617aa6c8e10d4202c5afeb06eef98aee88ea12f92d7ae633d44086b3f03b20d546fa66a72e38207c9d20035abc46271a30f1240de52536941242d23896ab74a3c6670fdc49c14f34fc4eadd6db8d80eba439772bf60a1db18c472dafc5569adc282928d2a1ffe29f1a57d3f18f4edaeb5d37918e6fddcd821da67a0785585a4443440dc65600e64a6a274000000000000000000000000000000000000000000000009dd14b38f2f4426d7cf5075047c31f6ce6adddfe3ac649c0643c8bfbeb14ba1fd7a485aa893915cf81e29aaf375e904bbe52691a4100260ffcd8f1d04166d291ebcef893e1b9ccb6797d0646fe0e7274434f28efb43e06ee0ff698caca42f4e6018a455736c482a017e2b13dac4a90faa109f0e87cc94e3efb649692456463ca74aa6ad4bf50c1acb3928143be1c1023a375e528285544d0064b98646f3109e9a4942ce42c6e7ec84b664f6c2770803f10baa804a707f0a1fcbfc309381aeba191950bae71f37f1eb7ceeffb3c0547ac6571603adbfde4c8b5f8d7f4b854441613633b48865b65bdc415e1e0dcf672d68cf4cebf04f4bc1eebf560a26d34d3757b1450fdb0a9a69f432e277f3a0386eb2bd3305c821c64757f786b79fef54dbe64c67d73934bc80b2133fb3c04cc7ea48bf97a6243c9f95dcbddecf45f008f1822c7868e1ff5a3cff5d6b6898335792749df7b1f51e913ac1c3b1b93b33aaa3fab69cef08a9f6f6cf39dea3d878b2ed42545421970cc426e644332bc956d1c6adefdf0ede2c5c94aa632646ae225accdf031f611d01622921f1b922a5ac887cca3136133dce8d9f5f4da7bed2ea5d94362200000000000000000000f296b0c1484e5f781ad26bff696b05ff0a5e2270e07618b04273bd4075ea38ab463bfa6a38e7c537498ba3e4df8dfc9e040000003c3ffad44d2a376def42e41e9fc31678257e040fa7cf32c221aaac08000000000000001a00000000000000000000173570f0c11ae694b0f7a4f9c2f6790044a357e785af6e153d5f1ea460af92c7cbbd6295afe740f5e154346d483e0d641ef02e495295d756e110522a7a945b93fb705b95b6aae27a8fb33732ce1da1c0b1af8eb9222a06e984ab1e6984c8bdc12360627137ab67b6b68ab08acb29a74dc36b51209cfbc87f61182bbeb2772e9d5a1ffc477179be481efe46a4ce86be0b1d8eee42a611a3d44ca450b14586ed63dd92005c79e4a8ab8a94f0c6cb4bed8594a39bd76d3ef8a7ab014e787596db796bd93a36c2880423291e3bccc86f66ba792ff4d87b3f80e5908779e51c5e9055fc5b23605cd000c723187ef09dcf4b07b06a9342f3f62ee7acddff292082c1f4d8eb9561f80873a09a1ae0c9af1121175e5600f43a1179484502009759264a5729f07c2b218fa36ba2316a99aaad0130df83d0bda1e711290f78c143ea143967b00adcd77e6ad5e48d839ea61aadb83e4d071c54691924a3830d3e7b5c198bb0ed623153590000060000000000004b985ea1702f34f2f85b168c083e810ed567e3f1979b9ed1a4bf6a10dac825c96a0828b335de445a4880bb6474157efd1a72ca46ae4cbe3ab648c9bc4867a5a4cb87d7d6d55475b34b3cb6aa9e2337d4e04a37e35109752522ac9b186ddd80c47da6a2f4ef7bb909c97552606ffff97e86dc995604346262a177b06c634969a31b5717c416f8224662f4dd46d6081cb96dd607410ee222ec8f206c4b"], &(0x7f00000001c0)='GPL\x00', 0x6, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_msg, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f00000000c0)={0x0, 0x0, 0xfffffffd}, 0x10}, 0x94) syz_genetlink_get_family_id$nl802154(&(0x7f00000003c0), 0xffffffffffffffff) sendmsg$NL802154_CMD_GET_SEC_DEV(0xffffffffffffffff, 0x0, 0x0) sendmsg$kcm(r8, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000080)}, 0x0) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r4, 0x8982, 0x0) r12 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_GET_CHARDEV(r12, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)=ANY=[@ANYBLOB="200000000f14b9"], 0x20}, 0x1, 0x0, 0x0, 0x24004000}, 0x41844) 893.459848ms ago: executing program 4 (id=2005): r0 = socket$rds(0x15, 0x5, 0x0) shutdown(r0, 0x1) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) listen(r2, 0x0) r3 = syz_genetlink_get_family_id$devlink(&(0x7f0000000f00), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_TRAP_SET(r1, &(0x7f000000b100)={0x0, 0x0, &(0x7f000000b0c0)={&(0x7f000000af00)={0x58, r3, 0x1, 0x70bd2c, 0x25dfdbff, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x4b}, {0x5}}]}, 0x58}, 0x1, 0x0, 0x0, 0x64000840}, 0x2000c044) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0200000004000000080000000b00000000000000", @ANYRES32=0x1, @ANYBLOB="902fb80180ffff000000006430e7ef4e3831f4e2", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000200"/28], 0x50) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000100)={0x54, 0x2, 0x6, 0x801, 0x0, 0x0, {0x7, 0x0, 0x5}, [@IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_BUCKETSIZE={0x5, 0x15, 0x5}]}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_REVISION={0x5, 0x4, 0x2}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_TYPENAME={0xd, 0x3, 'hash:net\x00'}]}, 0x54}, 0x1, 0x0, 0x0, 0x4000004}, 0x0) 892.319143ms ago: executing program 4 (id=2006): socket(0x28, 0x2, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) socket$inet6_mptcp(0xa, 0x1, 0x106) r0 = socket$inet_mptcp(0x2, 0x1, 0x106) ioctl$sock_SIOCETHTOOL(r0, 0x89f1, &(0x7f00000002c0)={'ip6gre0\x00', &(0x7f0000000300)=@ethtool_rxnfc={0x2f, 0x2, 0x6, {0xe, @usr_ip6_spec={@empty, @dev={0xfe, 0x80, '\x00', 0x24}, 0xfffffff8, 0x3d, 0xe}, {0x0, @remote, 0xe, 0x4, [0x7, 0x6]}, @ah_ip4_spec={@remote, @initdev={0xac, 0x1e, 0x40, 0x0}, 0x0, 0x5}, {0x0, @broadcast, 0x8, 0x5, [0xf, 0x9]}, 0xff, 0x3}}}) socket$inet6_mptcp(0xa, 0x1, 0x106) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000240)={'syztnl0\x00', &(0x7f0000000400)={'syztnl1\x00', 0x0, 0x10, 0x8, 0xfb, 0x8001, {{0x5, 0x4, 0x3, 0x5, 0x14, 0x65, 0x0, 0x2, 0x29, 0x0, @multicast2, @initdev={0xac, 0x1e, 0x0, 0x0}}}}}) getsockname$packet(0xffffffffffffffff, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000000)=0x14) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000480)={'ip6_vti0\x00', &(0x7f0000000400)={'syztnl0\x00', r1, 0x29, 0x9, 0x8, 0x800, 0x5, @private0={0xfc, 0x0, '\x00', 0x1}, @dev={0xfe, 0x80, '\x00', 0x2e}, 0x10, 0x0, 0xe7, 0x2}}) r2 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) socket$rds(0x15, 0x5, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x11, 0xf, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000800000000bf91000000000000b702000043e7b5538500000085000000b70000000000000095"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x36, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000140)='kmem_cache_free\x00', r3}, 0x10) ppoll(&(0x7f0000000500)=[{r2}], 0x1, 0x0, 0x0, 0x0) pselect6(0x40, &(0x7f0000000440)={0x0, 0x0, 0x3, 0xfffffffffffffff9, 0x9, 0x0, 0x8000000000, 0x800000000}, 0x0, &(0x7f00000002c0)={0x3ff, 0x0, 0x0, 0x4, 0x0, 0x0, 0x7fffffff}, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000480)='cgroup.controllers\x00', 0x275a, 0x0) r4 = socket$inet_udplite(0x2, 0x2, 0x88) r5 = socket$inet(0xa, 0x801, 0x84) connect$inet(r5, &(0x7f0000004cc0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) r6 = accept4(r5, 0x0, 0x0, 0x80000) setsockopt(r6, 0x84, 0x7f, &(0x7f00000001c0)="02000000", 0x4) r7 = socket$can_raw(0x1d, 0x3, 0x1) setsockopt$CAN_RAW_FILTER(r7, 0x65, 0x1, &(0x7f0000000180)=[{{0x0, 0x1, 0x0, 0x1}, {0x1, 0x0, 0x1}}, {{0x4, 0x1, 0x1}, {0x1, 0x0, 0x0, 0x1}}], 0x10) bind$can_raw(r7, &(0x7f0000000040), 0x10) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r4, 0x89f3, &(0x7f0000000040)={'syztnl2\x00', &(0x7f0000000540)={'sit0\x00', 0x0, 0x40, 0x7800, 0x7, 0x7, {{0xf, 0x4, 0x1, 0x1, 0x3c, 0x64, 0x0, 0x1, 0x4, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}, @dev={0xac, 0x14, 0x14, 0x15}, {[@generic={0x94, 0x2}, @end, @ssrr={0x89, 0x13, 0x3e, [@multicast2, @empty, @dev={0xac, 0x14, 0x14, 0x42}, @loopback]}, @rr={0x7, 0xb, 0x37, [@multicast1, @local]}, @ra={0x94, 0x4}]}}}}}) ioctl$sock_inet_SIOCSARP(r0, 0x8955, &(0x7f0000000600)={{0x2, 0x4e24, @initdev={0xac, 0x1e, 0x0, 0x0}}, {0x306, @multicast}, 0x14, {0x2, 0x4e21, @initdev={0xac, 0x1e, 0x0, 0x0}}, 'team0\x00'}) unshare(0x62040200) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x10, 0xffffffffffffffff, 0x0) 772.466849ms ago: executing program 3 (id=2007): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0xc1842, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) (async) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-aesni-avx2\x00'}, 0x58) (async) bind$alg(r1, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-aesni-avx2\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) accept4(r1, 0x0, 0x0, 0x800) (async) r2 = accept4(r1, 0x0, 0x0, 0x800) sendmmsg$alg(r2, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb3", 0x43}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1", 0x1d}], 0x2, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x6}, {&(0x7f0000000200)=""/101, 0x61}], 0x2}, 0x2120) write$cgroup_devices(r0, &(0x7f0000000840)=ANY=[@ANYBLOB="1e0308004d"], 0xffdd) (async) write$cgroup_devices(r0, &(0x7f0000000840)=ANY=[@ANYBLOB="1e0308004d"], 0xffdd) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) (async) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r3 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r3, &(0x7f0000000280)={0x2, 0x4e21, @local}, 0x10) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000040)={0x5, 0x0, 0x0, 0x0, 0x8001000d}, 0x94) r4 = socket$inet6(0xa, 0x3, 0x2f) setsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f00000000c0)={{{@in, @in=@multicast2, 0x0, 0x8, 0x0, 0x0, 0xa, 0x50, 0x0, 0x3c}, {0x0, 0x3}, {0x0, 0x0, 0x0, 0xe0}, 0x0, 0x0, 0x1}, {{@in6=@dev={0xfe, 0x80, '\x00', 0x2}, 0x40, 0x6c}, 0x0, @in6=@mcast1, 0x0, 0x0, 0x0, 0x0, 0x400000}}, 0xe8) (async) setsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f00000000c0)={{{@in, @in=@multicast2, 0x0, 0x8, 0x0, 0x0, 0xa, 0x50, 0x0, 0x3c}, {0x0, 0x3}, {0x0, 0x0, 0x0, 0xe0}, 0x0, 0x0, 0x1}, {{@in6=@dev={0xfe, 0x80, '\x00', 0x2}, 0x40, 0x6c}, 0x0, @in6=@mcast1, 0x0, 0x0, 0x0, 0x0, 0x400000}}, 0xe8) connect$inet6(r4, &(0x7f0000000040)={0xa, 0x0, 0x0, @loopback}, 0x1c) (async) connect$inet6(r4, &(0x7f0000000040)={0xa, 0x0, 0x0, @loopback}, 0x1c) connect$inet(r3, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) r5 = socket$nl_route(0x10, 0x3, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) (async) r6 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000040)={'lo\x00', 0x0}) socket$inet6_sctp(0xa, 0x5, 0x84) (async) r8 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt(r8, 0x84, 0x80, &(0x7f0000000000)='\x00\x00\x00\x00\t\x00\x00\x00', 0x8) r9 = socket(0x2, 0x80805, 0x0) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r9, 0x84, 0x1d, &(0x7f0000000000)={0x1, [0x0]}, &(0x7f0000000380)=0x8) setsockopt$inet_sctp6_SCTP_SET_PEER_PRIMARY_ADDR(r4, 0x84, 0x5, &(0x7f00000001c0)={r10, @in6={{0xa, 0x4e21, 0x4, @ipv4={'\x00', '\xff\xff', @local}, 0x3ff}}}, 0x84) sendmsg$nl_route_sched(r5, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x25dfdbfc, {0x0, 0x0, 0x0, r7, {}, {0xffff, 0xffff}, {0xffe0, 0xd}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x0, 0x200000, 0xfffffffd, 0xc, 0xffffffff, 0x8003}}}}]}, 0x4c}}, 0x0) (async) sendmsg$nl_route_sched(r5, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x25dfdbfc, {0x0, 0x0, 0x0, r7, {}, {0xffff, 0xffff}, {0xffe0, 0xd}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x0, 0x200000, 0xfffffffd, 0xc, 0xffffffff, 0x8003}}}}]}, 0x4c}}, 0x0) bind$inet(0xffffffffffffffff, 0x0, 0x0) sendto$inet(r3, &(0x7f0000000000), 0xffffffffffffff94, 0x12, 0x0, 0x12) r11 = syz_genetlink_get_family_id$devlink(&(0x7f0000000300), r9) sendmsg$DEVLINK_CMD_TRAP_POLICER_SET(r9, &(0x7f0000000540)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000580)=ANY=[@ANYBLOB="50010000", @ANYRES16=r11, @ANYBLOB="2a012dbd7000fedbdf25460000000e0001006e657464657673696d0000000f0002006e657464657673696d30000008008e00447ea4200c008f0002000000000000000c0090000700000000000000080001007063690011000200303030303a30303a31302e30000c008f0000000000000000000c00900006000000000000000e0001006e657464657673696d0000000f0002006e657464657673696d30000008008e00030000000c008f0000000000000000008e43c0b45b9e95f9f6ec87530c00900002000000000000000e0001006e657464657673696d0000000f0002006e657464657673696d30000008008e00010000000c008f0037f10000000000000c00900045070000000000000e0001006e657464657673696d0000000f0002006e657464657673696d30000008008e00000000000c008f007f000000000000000c0090008998000000e000007267d458c55cb0b4af707f513932614a68fcee6b3f000c0d043da4d4b9bfe9b77d767b9362ca85fa5720e31398637f22ab5ed5baf98e1877e8ce53f677ce64570659d862737a1f2aaf9800"/416], 0x150}, 0x1, 0x0, 0x0, 0x800}, 0x880) 587.486841ms ago: executing program 6 (id=2008): r0 = socket$inet_mptcp(0x2, 0x1, 0x106) ioctl$sock_SIOCETHTOOL(r0, 0x89f1, &(0x7f00000002c0)={'ip6_vti0\x00', &(0x7f0000000300)=@ethtool_rxnfc={0x2f, 0x2, 0x6, {0xe, @usr_ip6_spec={@empty, @dev={0xfe, 0x80, '\x00', 0x24}, 0xfffffff8, 0x3d, 0xe}, {0x0, @remote, 0xe, 0x4, [0x7, 0x6]}, @ah_ip4_spec={@remote, @remote, 0x0, 0x5}, {0x0, @broadcast, 0x8, 0x0, [0xf, 0x9]}, 0xff, 0x3}}}) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000000)={'ip6tnl0\x00', &(0x7f0000000140)={'syztnl0\x00', 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, @mcast1={0xff, 0x0}, @loopback={0x0, 0xffff888101827518}}}) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000096c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=@newtaction={0x6c, 0x30, 0x1, 0x0, 0x0, {}, [{0x58, 0x1, [@m_vlan={0x54, 0x1, 0x0, 0x0, {{0x9}, {0x28, 0x2, 0x0, 0x1, [@TCA_VLAN_PUSH_VLAN_ID={0x6, 0x3, 0x1000}, @TCA_VLAN_PARMS={0x1c, 0x2, {{0x0, 0x0, 0x5}, 0x2}}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x6c}}, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000300)=ANY=[@ANYBLOB="380000004900010000000700000000000a008000", @ANYRES32=r2, @ANYBLOB="0000000008000200cf010000140001"], 0x38}}, 0x0) r3 = socket$inet_mptcp(0x2, 0x1, 0x106) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f0000000c40)={0x0, 0x0, &(0x7f0000000c00)={&(0x7f0000000300)=ANY=[@ANYBLOB="140000001000010000000000000000000300000a14000000140a01030000000000000000070000082000f4ffff0901020000000000000000020000090900010073797a300000000058000000160a030000000000000000000200000a2c00038008000140000000000800024000000002180003801400ffff70696d367265670000000000000000000900020073797a31000000000900020073797a30000000001400000011000100000000000000000003ffff0abbbd19b1f5ea6f60f3475afbf6c74fdae7a98aa12bf266bba83134476870250a17d9644db32853594e85a5161d2ee44b19936ac3df6b993e336d2bc3f3f5bf54317c32afb0209557fdd7e4a2ca17a42d2503b855d9286bc43fd7098a2c1be478cfe408e2b66ce97c44cd7be03fce004816251131ae60a6a19bbd52a5"], 0xb4}, 0x1, 0x0, 0x0, 0x4000000}, 0x80) r5 = accept$inet(r3, &(0x7f0000000040)={0x2, 0x0, @dev}, &(0x7f0000000080)=0x10) setsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(r5, 0x84, 0x13, &(0x7f00000000c0)=0x9a, 0x4) ioctl$sock_SIOCETHTOOL(r3, 0x89f1, &(0x7f00000002c0)={'ip6tnl0\x00', &(0x7f0000000140)=@ethtool_cmd={0x0, 0x0, 0x0, 0x200, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0xfffff7fc, 0x0, 0x0, 0x0, 0x47, [0xfffffffc, 0x80]}}) 316.004507ms ago: executing program 6 (id=2009): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000600)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x2c) r1 = socket(0x40000000015, 0x5, 0x0) bind$inet(r1, &(0x7f00008a5ff0)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r1, 0x0, 0x1a000, 0x0, &(0x7f0000000240)={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x6, 0x1b, &(0x7f0000001800)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000014000000b7030000546439f08500000083000000bf090000000000005509010000000000950000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7020000000000008500000017000000180100002020690000000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000006000000bf91000000000000b7020000000000008500000084000000b70000000000000095"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x31, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000700)={r2, r4, 0x25, 0x0, @val=@perf_event}, 0x18) syz_emit_ethernet(0x66, &(0x7f0000000cc0)=ANY=[], 0x0) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'morus640\x00'}, 0x58) setsockopt$ALG_SET_KEY(r5, 0x117, 0x1, &(0x7f0000000140)="2c385aa3d49100dc6626c892b6bc436a", 0x10) r6 = accept4(r5, 0x0, 0x0, 0x0) syz_genetlink_get_family_id$ipvs(&(0x7f00000000c0), r6) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$tun(r7, &(0x7f0000000000)=ANY=[], 0x38) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x10012, r7, 0x0) epoll_ctl$EPOLL_CTL_ADD(r7, 0x1, r5, &(0x7f0000000000)={0x80004001}) 312.577227ms ago: executing program 3 (id=2010): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000001300)={0xa, 0x0, 0x0, @dev, 0x6}, 0x1c) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e22, 0x100, @ipv4={'\x00', '\xff\xff', @empty}, 0x3}, 0x1c) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000140)={0xa, 0x0, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x7d1}, 0x1c) bind$inet6(r1, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) listen(r0, 0x6) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000100)={0x18, 0x4, &(0x7f0000000400)=ANY=[@ANYBLOB="dc010000100000001800000000000000000000000000000095000000000000008d9062820b805b34b78cd182a01ecb91883b0a35102f01324235980ad30eec31c3ef5aa5f388d90180b341fe855c2dd81ed8f08c8d0a5e7e73f550d9461d75cb56882bcd494988742cec70bccbc32951d3f9d772b8a3d31048f518cc3e2ac4b79c989dd9a916d196984bd6d75f6f1a8931038fafd5a689297fee3cca9cc34c2a263835e34e09ae067cea299ac864ec133ab03255cd082d9d5386e5b6a48cec6913e6ea6e7c8a7df69b8e5bdeafa1a00934784c00"], &(0x7f00000003c0)='syzkaller\x00', 0x5, 0x9c, &(0x7f0000000540)=""/156, 0x0, 0x4}, 0x2f) socket$inet6_tcp(0xa, 0x1, 0x0) (async) bind$inet6(r0, &(0x7f0000001300)={0xa, 0x0, 0x0, @dev, 0x6}, 0x1c) (async) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e22, 0x100, @ipv4={'\x00', '\xff\xff', @empty}, 0x3}, 0x1c) (async) socket$inet6_tcp(0xa, 0x1, 0x0) (async) bind$inet6(r1, &(0x7f0000000140)={0xa, 0x0, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x7d1}, 0x1c) (async) bind$inet6(r1, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) (async) listen(r0, 0x6) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000100)={0x18, 0x4, &(0x7f0000000400)=ANY=[@ANYBLOB="dc010000100000001800000000000000000000000000000095000000000000008d9062820b805b34b78cd182a01ecb91883b0a35102f01324235980ad30eec31c3ef5aa5f388d90180b341fe855c2dd81ed8f08c8d0a5e7e73f550d9461d75cb56882bcd494988742cec70bccbc32951d3f9d772b8a3d31048f518cc3e2ac4b79c989dd9a916d196984bd6d75f6f1a8931038fafd5a689297fee3cca9cc34c2a263835e34e09ae067cea299ac864ec133ab03255cd082d9d5386e5b6a48cec6913e6ea6e7c8a7df69b8e5bdeafa1a00934784c00"], &(0x7f00000003c0)='syzkaller\x00', 0x5, 0x9c, &(0x7f0000000540)=""/156, 0x0, 0x4}, 0x2f) (async) 204.848229ms ago: executing program 2 (id=2011): socket(0x40000000015, 0x5, 0x0) (async) r0 = socket(0x40000000015, 0x5, 0x0) connect$inet(r0, &(0x7f0000000040)={0x2, 0x4e1c, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000002f40)=ANY=[@ANYBLOB="500000001000370400"/20, @ANYRES32=r1, @ANYBLOB="8b04040000000000300012800b00010065727370616e0000200002800400120006001800000040000500160002000000050017"], 0x50}, 0x1, 0x0, 0x0, 0x840}, 0x40000) (async) sendmsg$nl_route(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000002f40)=ANY=[@ANYBLOB="500000001000370400"/20, @ANYRES32=r1, @ANYBLOB="8b04040000000000300012800b00010065727370616e0000200002800400120006001800000040000500160002000000050017"], 0x50}, 0x1, 0x0, 0x0, 0x840}, 0x40000) setsockopt$SO_RDS_TRANSPORT(r0, 0x114, 0x8, &(0x7f00000008c0)=0x2, 0x4) bind$inet(r0, &(0x7f0000000340)={0x2, 0x4e20, @loopback}, 0x57) (async) bind$inet(r0, &(0x7f0000000340)={0x2, 0x4e20, @loopback}, 0x57) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1e00000700000000008000b64bd2dd0fc24617d7", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001740)={r2, 0x0, 0x0}, 0x20) r3 = bpf$TOKEN_CREATE(0x24, &(0x7f0000000000), 0x8) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="1e0000000000010000100000400000000c260100", @ANYRES32=r2, @ANYBLOB='\t\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0300000005000000000000000c0200000000000000000000d4f52ccdd6cc2e908577e6cd", @ANYRES32=r3, @ANYBLOB], 0x50) sendmsg$NL80211_CMD_JOIN_MESH(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[], 0x30}}, 0x40) r4 = socket(0x40000000015, 0x5, 0x0) getsockopt(r4, 0x200000000114, 0x271c, 0x0, &(0x7f0000000040)) (async) getsockopt(r4, 0x200000000114, 0x271c, 0x0, &(0x7f0000000040)) 72.16063ms ago: executing program 3 (id=2012): mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x20000000ed071, 0xffffffffffffffff, 0xfffff000) r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, &(0x7f0000000040)={'vlan0\x00', 0x800000}) ioctl(r0, 0x8b20, &(0x7f0000000040)) mmap$xdp(&(0x7f0000800000/0x800000)=nil, 0x800006, 0x7000001, 0x6e073, 0xffffffffffffffff, 0x2000) 0s ago: executing program 3 (id=2013): r0 = socket$kcm(0x10, 0x2, 0x0) r1 = socket(0xa, 0x2, 0x0) getpeername$packet(r1, &(0x7f0000000200), 0x0) (async) getpeername$packet(r1, &(0x7f0000000200)={0x11, 0x0, 0x0}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x6, 0x4, 0x8, 0x5, 0x0, 0xffffffffffffffff, 0x0, '\x00', r2}, 0x50) (async) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x6, 0x4, 0x8, 0x5, 0x0, 0xffffffffffffffff, 0x0, '\x00', r2}, 0x50) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f00000002c0)={0xffffffffffffffff, 0x20, &(0x7f0000000280)={&(0x7f0000000a40)=""/4096, 0x1000, 0x0, 0x0}}, 0x10) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x7a44, 0x1700) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_type(r6, &(0x7f00000000c0), 0x9) sendfile(r6, r5, 0x0, 0x10000) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x6, 0xc, &(0x7f0000000000)=@framed={{0x18, 0x0, 0x0, 0x0, 0x200, 0x0, 0x0, 0x0, 0x800000}, [@ringbuf_output={{0x18, 0x5, 0x1, 0x0, r3}, {}, {}, {}, {0x7, 0x0, 0x0, 0x2, 0x0, 0x0, 0xfffffe00}, {}, {}, {0x85, 0x0, 0x0, 0x55}}]}, &(0x7f0000000300)='syzkaller\x00', 0x5b8c, 0x0, 0x0, 0x41000, 0x20, '\x00', 0x0, @xdp, r5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r4, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000040)=r4, 0x4) r7 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_int(r7, 0x29, 0x48, &(0x7f0000000000)=0xfffffcf5, 0x4) (async) setsockopt$inet6_int(r7, 0x29, 0x48, &(0x7f0000000000)=0xfffffcf5, 0x4) sendmsg$inet(r0, &(0x7f0000000080)={0x0, 0x74, &(0x7f0000000100)=[{&(0x7f00000001c0)="5c00000012006bab9a3fe3d86e17aa0a046b876c1d0048007ea60864160af36504001a0038001d001931a0e69ee517d34460bc06000000a705251e6182949a3651f60a84c9f4d4938037e70e4509c5bb", 0x33fe0}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) (async) sendmsg$inet(r0, &(0x7f0000000080)={0x0, 0x74, &(0x7f0000000100)=[{&(0x7f00000001c0)="5c00000012006bab9a3fe3d86e17aa0a046b876c1d0048007ea60864160af36504001a0038001d001931a0e69ee517d34460bc06000000a705251e6182949a3651f60a84c9f4d4938037e70e4509c5bb", 0x33fe0}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) recvmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000004140)=[{&(0x7f0000000240)=""/212, 0xd4}], 0x1}, 0x0) (async) recvmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000004140)=[{&(0x7f0000000240)=""/212, 0xd4}], 0x1}, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) (async) r8 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000180)=@newsa={0x168, 0x10, 0x1, 0x0, 0x0, {{@in=@remote, @in=@dev={0xac, 0x14, 0x14, 0x26}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x30}, {@in=@broadcast, 0x0, 0x33}, @in=@remote, {0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x1ff}, {}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'sha256\x00'}}}, @encap={0x1c, 0x4, {0x1, 0x4e22, 0x4e24, @in6=@dev={0xfe, 0x80, '\x00', 0x38}}}, @coaddr={0x14, 0xe, @in=@loopback}]}, 0x168}}, 0x0) sendmsg$nl_xfrm(r8, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f00000001c0)=ANY=[@ANYBLOB="4c030000160001000000000000000000fc010000000000000000000000000000fe88000000000000000000000000000100"/64, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="ac141400000000000000000000000000000000006c"], 0x34c}}, 0x0) kernel console output (not intermixed with test programs): 2] bridge0: port 3(team0) entered blocking state [ 117.566576][ T6902] bridge0: port 3(team0) entered disabled state [ 117.573525][ T6902] team0: entered allmulticast mode [ 117.578883][ T6902] team_slave_1: entered allmulticast mode [ 117.586930][ T6904] netlink: 'syz.3.192': attribute type 4 has an invalid length. [ 117.654410][ T6874] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 117.698311][ T6904] netlink: 6 bytes leftover after parsing attributes in process `syz.3.192'. [ 117.721702][ T6904] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 117.831518][ T13] netdevsim netdevsim4 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 117.868706][ T13] netdevsim netdevsim4 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 117.914771][ T13] netdevsim netdevsim4 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 117.949578][ T12] netdevsim netdevsim4 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 118.118072][ T6917] netlink: 'syz.4.197': attribute type 4 has an invalid length. [ 118.133947][ T6917] netlink: 6 bytes leftover after parsing attributes in process `syz.4.197'. [ 118.169967][ T6917] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 118.217487][ T6914] netlink: 4 bytes leftover after parsing attributes in process `syz.2.196'. [ 118.347184][ T6922] netlink: 308 bytes leftover after parsing attributes in process `syz.3.199'. [ 118.374938][ T6922] netlink: 8 bytes leftover after parsing attributes in process `syz.3.199'. [ 118.400470][ T6922] A link change request failed with some changes committed already. Interface vlan0 may have been left with an inconsistent configuration, please check. [ 118.590725][ T6931] syz_tun: entered allmulticast mode [ 118.640529][ T6931] dvmrp8: entered allmulticast mode [ 118.694185][ T6931] syz_tun: left allmulticast mode [ 118.700157][ T6931] dvmrp8: left allmulticast mode [ 119.520933][ T6958] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 119.552756][ T6959] netlink: 20 bytes leftover after parsing attributes in process `syz.3.209'. [ 120.295582][ T6977] ip6tnl1: entered promiscuous mode [ 120.343932][ T6977] ip6tnl1: entered allmulticast mode [ 121.271678][ T7016] nbd: must specify at least one socket [ 121.780602][ T7034] netlink: 'syz.4.231': attribute type 1 has an invalid length. [ 122.399322][ T51] Bluetooth: hci4: command tx timeout [ 122.553947][ T7034] 8021q: adding VLAN 0 to HW filter on device bond2 [ 127.282419][ T7086] raw_sendmsg: syz.4.242 forgot to set AF_INET. Fix it! [ 127.902275][ T7109] netlink: 'syz.3.246': attribute type 2 has an invalid length. [ 127.928318][ T7109] __nla_validate_parse: 4 callbacks suppressed [ 127.928335][ T7109] netlink: 24 bytes leftover after parsing attributes in process `syz.3.246'. [ 127.954301][ T7110] netlink: 'syz.2.245': attribute type 3 has an invalid length. [ 127.962238][ T7110] netlink: 132 bytes leftover after parsing attributes in process `syz.2.245'. [ 128.284092][ T7123] netlink: 100 bytes leftover after parsing attributes in process `syz.4.249'. [ 128.329892][ T7123] netlink: 100 bytes leftover after parsing attributes in process `syz.4.249'. [ 128.402570][ T7124] netlink: 'syz.4.249': attribute type 23 has an invalid length. [ 128.499787][ T7128] lo: entered allmulticast mode [ 128.575004][ T7130] syz_tun: entered allmulticast mode [ 128.690692][ T7127] lo: left allmulticast mode [ 128.852217][ T7136] tun0: tun_chr_ioctl cmd 2147767521 [ 128.858218][ T7136] netlink: 24 bytes leftover after parsing attributes in process `syz.0.253'. [ 128.920988][ T7132] netlink: 4 bytes leftover after parsing attributes in process `syz.2.252'. [ 129.278004][ T7146] netlink: 8 bytes leftover after parsing attributes in process `syz.1.255'. [ 129.526682][ T7163] netlink: 24 bytes leftover after parsing attributes in process `syz.1.258'. [ 129.543277][ T7162] netlink: 24 bytes leftover after parsing attributes in process `syz.1.258'. [ 129.974352][ T7169] netlink: 8 bytes leftover after parsing attributes in process `syz.1.260'. [ 130.006205][ T7169] A link change request failed with some changes committed already. Interface team0 may have been left with an inconsistent configuration, please check. [ 132.113513][ T7219] netlink: 'syz.2.272': attribute type 1 has an invalid length. [ 132.210673][ T7223] erspan0: entered allmulticast mode [ 132.255409][ T7223] netlink: 'syz.2.272': attribute type 1 has an invalid length. [ 133.009284][ T1301] ieee802154 phy0 wpan0: encryption failed: -22 [ 133.017704][ T1301] ieee802154 phy1 wpan1: encryption failed: -22 [ 135.827215][ T7275] syz_tun: entered allmulticast mode [ 135.862255][ T7273] syz_tun: left allmulticast mode [ 135.945433][ T7282] netlink: 'syz.2.285': attribute type 1 has an invalid length. [ 136.326639][ T7297] __nla_validate_parse: 3 callbacks suppressed [ 136.326667][ T7297] netlink: 12 bytes leftover after parsing attributes in process `syz.2.288'. [ 136.537520][ T7301] netlink: 20 bytes leftover after parsing attributes in process `syz.3.290'. [ 137.101409][ T7313] tipc: Started in network mode [ 137.115708][ T7313] tipc: Node identity 4e0d04b50e73, cluster identity 4711 [ 137.137816][ T7313] tipc: Enabled bearer , priority 0 [ 137.176844][ T7315] syzkaller0: entered promiscuous mode [ 137.190299][ T7315] syzkaller0: entered allmulticast mode [ 137.391287][ T7311] tipc: Resetting bearer [ 137.421026][ T7311] tipc: Disabling bearer [ 137.593578][ T7327] netlink: 'syz.2.299': attribute type 31 has an invalid length. [ 138.616509][ T7360] netlink: 44 bytes leftover after parsing attributes in process `syz.2.307'. [ 138.652949][ T7357] A link change request failed with some changes committed already. Interface eth0 may have been left with an inconsistent configuration, please check. [ 138.904656][ T7370] netlink: 'syz.2.311': attribute type 2 has an invalid length. [ 138.925446][ T7370] netlink: 132 bytes leftover after parsing attributes in process `syz.2.311'. [ 139.006713][ T7371] netlink: 'syz.2.311': attribute type 27 has an invalid length. [ 139.036353][ T7371] netlink: 276 bytes leftover after parsing attributes in process `syz.2.311'. [ 139.306102][ T5879] udevd[5879]: inotify_add_watch(7, /dev/nbd3, 10) failed: No such file or directory [ 139.397504][ T7387] netlink: 'syz.3.314': attribute type 1 has an invalid length. [ 139.584429][ T7395] netlink: 8 bytes leftover after parsing attributes in process `syz.2.317'. [ 139.858718][ T7401] netlink: 'syz.4.318': attribute type 1 has an invalid length. [ 139.928721][ T7401] bond3 (unregistering): Released all slaves [ 140.005780][ T7407] tipc: Enabled bearer , priority 0 [ 140.050552][ T7407] syzkaller0: entered promiscuous mode [ 140.056193][ T7407] syzkaller0: entered allmulticast mode [ 140.063695][ T7407] tipc: Resetting bearer [ 140.075255][ T7406] tipc: Resetting bearer [ 140.197973][ T7410] netlink: 32 bytes leftover after parsing attributes in process `syz.3.320'. [ 140.716126][ T7417] Bluetooth: MGMT ver 1.23 [ 141.509078][ T7406] tipc: Disabling bearer [ 141.543205][ T7414] geneve2: entered promiscuous mode [ 141.587842][ T36] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 20000 - 0 [ 141.609235][ T36] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 20000 - 0 [ 141.646333][ T36] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 20000 - 0 [ 141.680053][ T36] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 20000 - 0 [ 141.923793][ T7433] netlink: 8 bytes leftover after parsing attributes in process `syz.0.328'. [ 141.944550][ T7431] netlink: 24 bytes leftover after parsing attributes in process `syz.4.327'. [ 141.961646][ T7433] netlink: 8 bytes leftover after parsing attributes in process `syz.0.328'. [ 141.984033][ T7433] netlink: 8 bytes leftover after parsing attributes in process `syz.0.328'. [ 142.007962][ T7433] netlink: 8 bytes leftover after parsing attributes in process `syz.0.328'. [ 142.052307][ T7433] netlink: 8 bytes leftover after parsing attributes in process `syz.0.328'. [ 142.081683][ T7433] netlink: 8 bytes leftover after parsing attributes in process `syz.0.328'. [ 142.114150][ T7433] netlink: 8 bytes leftover after parsing attributes in process `syz.0.328'. [ 142.160622][ T7433] netlink: 8 bytes leftover after parsing attributes in process `syz.0.328'. [ 142.171988][ T7433] netlink: 8 bytes leftover after parsing attributes in process `syz.0.328'. [ 142.189051][ T7433] 8021q: adding VLAN 0 to HW filter on device bond0 [ 142.200933][ T7433] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 142.230789][ T7434] sch_tbf: burst 88 is lower than device veth3 mtu (1514) ! [ 143.563261][ T7473] IPVS: length: 24 != 1272 [ 143.700982][ T7480] netlink: 'syz.3.342': attribute type 3 has an invalid length. [ 144.142194][ T7492] netlink: 'syz.4.344': attribute type 15 has an invalid length. [ 144.376182][ T7511] sctp: [Deprecated]: syz.1.349 (pid 7511) Use of struct sctp_assoc_value in delayed_ack socket option. [ 144.376182][ T7511] Use struct sctp_sack_info instead [ 144.693299][ T7516] ip6gre1: entered allmulticast mode [ 145.026475][ T7527] vlan2: entered promiscuous mode [ 145.054401][ T7527] bond0: entered promiscuous mode [ 145.073159][ T7527] bond_slave_0: entered promiscuous mode [ 145.079181][ T7527] bond_slave_1: entered promiscuous mode [ 145.084743][ T7535] netlink: 'syz.3.358': attribute type 2 has an invalid length. [ 145.485870][ T7557] netlink: 'syz.3.366': attribute type 2 has an invalid length. [ 146.355253][ T7583] dvmrp0: entered allmulticast mode [ 146.506357][ T7597] Bluetooth: MGMT ver 1.23 [ 146.556625][ T7609] netlink: 'syz.1.378': attribute type 1 has an invalid length. [ 146.645681][ T7609] 8021q: adding VLAN 0 to HW filter on device bond1 [ 146.735044][ T7611] bond1: (slave geneve2): making interface the new active one [ 146.789682][ T7611] bond1: (slave geneve2): Enslaving as an active interface with an up link [ 146.838347][ T36] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 146.856379][ T36] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 146.885720][ T36] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 146.904833][ T7614] netlink: 'syz.4.380': attribute type 11 has an invalid length. [ 146.913978][ T36] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 146.930076][ T5930] IPVS: starting estimator thread 0... [ 147.039899][ T7616] IPVS: using max 25 ests per chain, 60000 per kthread [ 147.303724][ T7629] netlink: 'syz.1.384': attribute type 2 has an invalid length. [ 147.312159][ T7629] __nla_validate_parse: 19 callbacks suppressed [ 147.312175][ T7629] netlink: 12 bytes leftover after parsing attributes in process `syz.1.384'. [ 147.672519][ T7652] netlink: 6 bytes leftover after parsing attributes in process `syz.1.387'. [ 147.676558][ T7646] netlink: 8 bytes leftover after parsing attributes in process `syz.4.386'. [ 148.305521][ T7688] netlink: 824 bytes leftover after parsing attributes in process `syz.4.395'. [ 148.356976][ T7689] netlink: 1372 bytes leftover after parsing attributes in process `syz.4.395'. [ 148.973676][ T7699] netlink: 12 bytes leftover after parsing attributes in process `syz.3.397'. [ 149.038469][ T7702] netlink: 24 bytes leftover after parsing attributes in process `syz.3.397'. [ 149.096263][ T7703] netlink: 16 bytes leftover after parsing attributes in process `syz.3.397'. [ 151.411865][ T7713] netlink: 28 bytes leftover after parsing attributes in process `syz.0.401'. [ 151.430091][ T7713] netlink: 28 bytes leftover after parsing attributes in process `syz.0.401'. [ 151.637250][ T7728] tipc: Can't bind to reserved service type 1 [ 151.644550][ T7728] netlink: 'syz.0.405': attribute type 39 has an invalid length. [ 151.700086][ T7730] netlink: 'syz.0.405': attribute type 5 has an invalid length. [ 151.884454][ T7739] netlink: 'syz.2.408': attribute type 13 has an invalid length. [ 151.893624][ T7739] netlink: 'syz.2.408': attribute type 17 has an invalid length. [ 151.975339][ T7730] vlan3: entered allmulticast mode [ 152.431386][ T7739] erspan0: left allmulticast mode [ 152.531059][ T7739] 8021q: adding VLAN 0 to HW filter on device bond0 [ 152.542562][ T7739] 8021q: adding VLAN 0 to HW filter on device team0 [ 152.555586][ T7739] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 152.573250][ T7742] xfrm0: entered promiscuous mode [ 152.578292][ T7742] xfrm0: entered allmulticast mode [ 152.938113][ T7768] (unnamed net_device) (uninitialized): option active_slave: mode dependency failed, not supported in mode balance-rr(0) [ 153.007084][ T7772] netlink: 'syz.1.414': attribute type 1 has an invalid length. [ 153.027957][ T7772] netlink: 'syz.1.414': attribute type 2 has an invalid length. [ 153.046236][ T7775] __nla_validate_parse: 6 callbacks suppressed [ 153.046255][ T7775] netlink: 4 bytes leftover after parsing attributes in process `syz.3.412'. [ 153.085954][ T7774] netlink: 156 bytes leftover after parsing attributes in process `syz.4.415'. [ 153.102155][ T7772] netlink: 4 bytes leftover after parsing attributes in process `syz.1.414'. [ 153.368552][ T7790] netlink: 8 bytes leftover after parsing attributes in process `syz.1.417'. [ 153.389013][ T7775] bridge_slave_1: left allmulticast mode [ 153.409274][ T7775] bridge_slave_1: left promiscuous mode [ 153.417817][ T7790] netlink: 4 bytes leftover after parsing attributes in process `syz.1.417'. [ 153.438148][ T7775] bridge0: port 2(bridge_slave_1) entered disabled state [ 153.491257][ T7775] bridge_slave_0: left allmulticast mode [ 153.536847][ T7775] bridge_slave_0: left promiscuous mode [ 153.578916][ T7775] bridge0: port 1(bridge_slave_0) entered disabled state [ 153.933232][ T7812] netlink: 24 bytes leftover after parsing attributes in process `syz.1.422'. [ 155.230900][ T7856] netlink: 4 bytes leftover after parsing attributes in process `syz.2.432'. [ 155.339788][ T7860] Bluetooth: MGMT ver 1.23 [ 155.395544][ T7862] netlink: 32 bytes leftover after parsing attributes in process `syz.3.434'. [ 155.495152][ T7872] netlink: 4 bytes leftover after parsing attributes in process `syz.0.435'. [ 155.908395][ T7893] netlink: 'syz.3.442': attribute type 5 has an invalid length. [ 155.953464][ T7888] netlink: 412 bytes leftover after parsing attributes in process `syz.0.440'. [ 155.960111][ T5884] Bluetooth: hci4: command 0x0405 tx timeout [ 156.916981][ T7931] netlink: 'syz.1.449': attribute type 83 has an invalid length. [ 156.984098][ T7933] syzkaller1: entered allmulticast mode [ 157.259341][ T7946] geneve2: entered promiscuous mode [ 157.265956][ T7946] geneve2: entered allmulticast mode [ 157.281055][ T49] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 157.300435][ T49] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 157.319974][ T49] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 157.340084][ T49] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 157.637927][ T7925] Bluetooth: hci0: Opcode 0x0401 failed: -4 [ 158.810206][ T8006] nft_compat: unsupported protocol 0 [ 158.919680][ T51] Bluetooth: hci0: command 0x0401 tx timeout [ 159.175205][ T8015] __nla_validate_parse: 6 callbacks suppressed [ 159.175224][ T8015] netlink: 8 bytes leftover after parsing attributes in process `syz.3.471'. [ 159.194180][ T8015] netlink: 24 bytes leftover after parsing attributes in process `syz.3.471'. [ 159.206450][ T8015] netlink: 8 bytes leftover after parsing attributes in process `syz.3.471'. [ 159.234313][ T8015] netlink: 'syz.3.471': attribute type 5 has an invalid length. [ 159.282746][ T8018] netlink: 8 bytes leftover after parsing attributes in process `syz.2.472'. [ 159.934503][ T8048] netlink: 36 bytes leftover after parsing attributes in process `syz.1.479'. [ 160.002991][ T8048] netlink: 4 bytes leftover after parsing attributes in process `syz.1.479'. [ 160.050432][ T8053] netlink: 40 bytes leftover after parsing attributes in process `syz.2.480'. [ 160.135985][ T8055] netlink: 12 bytes leftover after parsing attributes in process `syz.2.480'. [ 160.246132][ T8056] netlink: 48 bytes leftover after parsing attributes in process `syz.0.482'. [ 160.252500][ T8053] ÿ: renamed from bond_slave_0 [ 160.256645][ T8061] netlink: 12 bytes leftover after parsing attributes in process `syz.3.483'. [ 160.347216][ T8061] 8021q: adding VLAN 0 to HW filter on device bond1 [ 161.123434][ T8094] netlink: 'syz.1.489': attribute type 1 has an invalid length. [ 161.353011][ T8098] bond2: (slave gretap1): making interface the new active one [ 161.390858][ T8098] bond2: (slave gretap1): Enslaving as an active interface with an up link [ 161.499711][ T8111] netlink: 'syz.4.494': attribute type 2 has an invalid length. [ 162.229107][ T8135] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 20000 - 0 [ 162.356945][ T8135] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 20000 - 0 [ 162.420369][ T8135] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 20000 - 0 [ 162.483628][ T8135] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 20000 - 0 [ 162.551616][ T36] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 20000 - 0 [ 162.570814][ T36] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 20000 - 0 [ 162.586978][ T36] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 20000 - 0 [ 162.603703][ T36] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 20000 - 0 [ 162.927387][ T8159] IPv6: sit1: Disabled Multicast RS [ 162.934849][ T8159] sit1: entered allmulticast mode [ 163.116655][ T8161] netlink: 'syz.3.510': attribute type 1 has an invalid length. [ 163.211601][ T8163] netlink: 'syz.2.511': attribute type 1 has an invalid length. [ 163.323575][ T8172] netlink: 'syz.3.513': attribute type 10 has an invalid length. [ 163.376855][ T8172] 8021q: adding VLAN 0 to HW filter on device team0 [ 163.443701][ T8172] bond0: (slave team0): Enslaving as an active interface with an up link [ 164.289090][ T8205] netlink: 'syz.3.524': attribute type 3 has an invalid length. [ 164.593083][ T8220] __nla_validate_parse: 14 callbacks suppressed [ 164.593101][ T8220] netlink: 8 bytes leftover after parsing attributes in process `syz.4.528'. [ 164.973775][ T8234] netlink: 336 bytes leftover after parsing attributes in process `syz.3.533'. [ 165.004087][ T8231] netlink: 8 bytes leftover after parsing attributes in process `syz.2.532'. [ 165.013477][ T8231] netlink: 4 bytes leftover after parsing attributes in process `syz.2.532'. [ 165.129670][ T8258] sock: sock_timestamping_bind_phc: sock not bind to device [ 165.231723][ T8231] netlink: 8 bytes leftover after parsing attributes in process `syz.2.532'. [ 165.244937][ T59] netdevsim netdevsim2 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 165.340200][ T59] netdevsim netdevsim2 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 165.365149][ T8231] netlink: 4 bytes leftover after parsing attributes in process `syz.2.532'. [ 165.423103][ T59] netdevsim netdevsim2 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 165.510784][ T59] netdevsim netdevsim2 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 165.563741][ T8265] syz_tun: entered allmulticast mode [ 165.656686][ T8273] dvmrp8: entered allmulticast mode [ 165.965463][ T8291] netlink: 'syz.4.542': attribute type 1 has an invalid length. [ 165.993701][ T8291] netlink: 'syz.4.542': attribute type 2 has an invalid length. [ 166.342497][ T8309] netlink: 100 bytes leftover after parsing attributes in process `syz.1.545'. [ 166.641879][ T8323] netlink: 28 bytes leftover after parsing attributes in process `syz.2.546'. [ 166.723180][ T8309] veth7: entered promiscuous mode [ 166.959260][ T8264] syz_tun: left allmulticast mode [ 166.967660][ T8264] dvmrp8: left allmulticast mode [ 167.361838][ T8334] netlink: 'syz.4.552': attribute type 15 has an invalid length. [ 167.782291][ T8362] netlink: 'syz.2.558': attribute type 23 has an invalid length. [ 168.044786][ T8376] netlink: 36 bytes leftover after parsing attributes in process `syz.1.560'. [ 168.529908][ T8395] xt_limit: Overflow, try lower: 271964/0 [ 168.573633][ T8395] netlink: 4 bytes leftover after parsing attributes in process `syz.2.566'. [ 169.008086][ T8408] tipc: Enabling of bearer <“dp:s> rejected, media not registered [ 169.268308][ T8426] mac80211_hwsim hwsim11 wlan1: entered allmulticast mode [ 169.307297][ T8426] netlink: 'syz.2.579': attribute type 10 has an invalid length. [ 169.316564][ T8426] mac80211_hwsim hwsim11 wlan1: left allmulticast mode [ 169.329243][ T8426] 8021q: adding VLAN 0 to HW filter on device bond0 [ 169.341966][ T8426] bond0: (slave wlan1): Enslaving as an active interface with an up link [ 169.409324][ T8426] syz.2.579 (8426) used greatest stack depth: 17864 bytes left [ 170.242973][ T8466] __nla_validate_parse: 2 callbacks suppressed [ 170.242990][ T8466] netlink: 76 bytes leftover after parsing attributes in process `syz.0.590'. [ 170.644910][ T8488] 8021q: adding VLAN 0 to HW filter on device bond2 [ 171.099885][ T8518] netlink: 8 bytes leftover after parsing attributes in process `syz.4.601'. [ 171.119723][ T8518] netlink: 212392 bytes leftover after parsing attributes in process `syz.4.601'. [ 171.130888][ T8518] netlink: zone id is out of range [ 171.136580][ T8518] netlink: zone id is out of range [ 171.147427][ T8518] netlink: zone id is out of range [ 171.156721][ T8518] netlink: zone id is out of range [ 171.163211][ T8518] netlink: get zone limit has 8 unknown bytes [ 171.305328][ T6081] hid-generic 0005:16BF:5505.0001: unknown main item tag 0x0 [ 171.314230][ T6081] hid-generic 0005:16BF:5505.0001: unknown main item tag 0x0 [ 171.356117][ T6081] hid-generic 0005:16BF:5505.0001: hidraw0: BLUETOOTH HID vc3.b8 Device [syz0] on aa:aa:aa:aa:aa:aa [ 171.593536][ T8538] netlink: 124 bytes leftover after parsing attributes in process `syz.0.605'. [ 171.622858][ T8529] fido_id[8529]: Failed to open report descriptor at '/sys/devices/virtual/bluetooth/hci4/hci4:200/report_descriptor': No such file or directory [ 171.739841][ T8538] nbd4: detected capacity change from 0 to 63 [ 171.759989][ T8540] nbd: couldn't find device at index 0 [ 171.863915][ T8538] bond2: entered promiscuous mode [ 171.869192][ T8538] bond2: entered allmulticast mode [ 171.878423][ T8538] 8021q: adding VLAN 0 to HW filter on device bond2 [ 171.904186][ T51] block nbd4: Receive control failed (result -104) [ 172.421995][ T8556] netlink: 4 bytes leftover after parsing attributes in process `syz.0.610'. [ 173.052495][ T8590] netlink: 8 bytes leftover after parsing attributes in process `syz.4.618'. [ 173.069408][ T8590] netlink: 4 bytes leftover after parsing attributes in process `syz.4.618'. [ 173.133113][ T8590] netlink: 8 bytes leftover after parsing attributes in process `syz.4.618'. [ 173.150045][ T59] netdevsim netdevsim4 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 173.161412][ T8590] netlink: 4 bytes leftover after parsing attributes in process `syz.4.618'. [ 173.230956][ T59] netdevsim netdevsim4 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 173.332002][ T59] netdevsim netdevsim4 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 173.356733][ T59] netdevsim netdevsim4 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 174.048946][ T8627] netlink: 12 bytes leftover after parsing attributes in process `syz.2.628'. [ 175.380638][ T8658] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 175.491476][ T8658] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 175.646841][ T8658] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 175.752093][ T8658] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 175.906091][ T49] netdevsim netdevsim3 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 176.002557][ T49] netdevsim netdevsim3 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 176.055189][ T49] netdevsim netdevsim3 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 176.188314][ T49] netdevsim netdevsim3 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 176.352417][ T8680] IPVS: Error connecting to the multicast addr [ 176.438655][ T8682] __nla_validate_parse: 2 callbacks suppressed [ 176.438672][ T8682] netlink: 8 bytes leftover after parsing attributes in process `syz.3.644'. [ 177.315863][ T6079] IPVS: starting estimator thread 0... [ 177.430702][ T8708] IPVS: using max 30 ests per chain, 72000 per kthread [ 177.507988][ T8716] netlink: 4 bytes leftover after parsing attributes in process `syz.0.651'. [ 177.728825][ T8726] netlink: 12 bytes leftover after parsing attributes in process `syz.0.653'. [ 177.751695][ T8727] netlink: 12 bytes leftover after parsing attributes in process `syz.0.653'. [ 177.798614][ T8726] bridge0: port 3(team0) entered disabled state [ 178.019129][ T8737] netlink: 12 bytes leftover after parsing attributes in process `syz.2.655'. [ 178.071010][ T8740] netlink: 'syz.2.655': attribute type 39 has an invalid length. [ 178.158310][ T8743] netlink: 4 bytes leftover after parsing attributes in process `syz.0.656'. [ 178.290047][ T8748] netlink: 'syz.0.657': attribute type 12 has an invalid length. [ 178.298140][ T8748] netlink: 9472 bytes leftover after parsing attributes in process `syz.0.657'. [ 179.513975][ T8788] netlink: 8 bytes leftover after parsing attributes in process `syz.3.667'. [ 179.621993][ T8793] netlink: 132 bytes leftover after parsing attributes in process `syz.2.670'. [ 179.704101][ T8795] netlink: 8 bytes leftover after parsing attributes in process `syz.4.669'. [ 180.192480][ T8822] erspan0: entered promiscuous mode [ 180.201331][ T8822] erspan0: left promiscuous mode [ 180.348078][ T8830] geneve2: entered promiscuous mode [ 180.499818][ T8840] A link change request failed with some changes committed already. Interface gre0 may have been left with an inconsistent configuration, please check. [ 180.841114][ T55] block nbd4: Possible stuck request ffff888025617000: control (read@0,1024B). Runtime 9 seconds [ 180.852033][ T55] block nbd4: Possible stuck request ffff8880256171c0: control (read@1024,1024B). Runtime 9 seconds [ 180.862899][ T55] block nbd4: Possible stuck request ffff888025617380: control (read@2048,1024B). Runtime 9 seconds [ 180.873873][ T55] block nbd4: Possible stuck request ffff888025617540: control (read@3072,1024B). Runtime 9 seconds [ 181.262508][ T8887] tipc: Started in network mode [ 181.277741][ T8887] tipc: Node identity , cluster identity 4711 [ 181.286168][ T8887] tipc: Failed to set node id, please configure manually [ 181.293833][ T8887] tipc: Enabling of bearer rejected, failed to enable media [ 182.727198][ T8937] __nla_validate_parse: 5 callbacks suppressed [ 182.727217][ T8937] netlink: 36 bytes leftover after parsing attributes in process `syz.0.708'. [ 182.810977][ T51] Bluetooth: hci4: link tx timeout [ 182.818299][ T51] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 182.825511][ T8937] macsec1: entered promiscuous mode [ 182.905084][ T8937] macsec1: entered allmulticast mode [ 182.968982][ T8950] netlink: 36 bytes leftover after parsing attributes in process `syz.3.710'. [ 182.992434][ T8950] netlink: 36 bytes leftover after parsing attributes in process `syz.3.710'. [ 183.002115][ T8950] netlink: 36 bytes leftover after parsing attributes in process `syz.3.710'. [ 183.020286][ T8950] netlink: 36 bytes leftover after parsing attributes in process `syz.3.710'. [ 183.030071][ T8950] netlink: 36 bytes leftover after parsing attributes in process `syz.3.710'. [ 183.052828][ T8950] netlink: 36 bytes leftover after parsing attributes in process `syz.3.710'. [ 183.065562][ T8950] netlink: 36 bytes leftover after parsing attributes in process `syz.3.710'. [ 183.082483][ T8950] netlink: 36 bytes leftover after parsing attributes in process `syz.3.710'. [ 183.092109][ T8950] netlink: 36 bytes leftover after parsing attributes in process `syz.3.710'. [ 183.304768][ T8950] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 183.321061][ T8950] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 183.499649][ T6551] netdevsim netdevsim3 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 183.509591][ T6551] netdevsim netdevsim3 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 183.600574][ T8960] FAULT_INJECTION: forcing a failure. [ 183.600574][ T8960] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 183.622778][ T8960] CPU: 1 UID: 0 PID: 8960 Comm: syz.3.711 Not tainted syzkaller #0 PREEMPT(full) [ 183.622804][ T8960] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 183.622819][ T8960] Call Trace: [ 183.622829][ T8960] [ 183.622838][ T8960] dump_stack_lvl+0x189/0x250 [ 183.622869][ T8960] ? __pfx____ratelimit+0x10/0x10 [ 183.622891][ T8960] ? __pfx_dump_stack_lvl+0x10/0x10 [ 183.622912][ T8960] ? __pfx__printk+0x10/0x10 [ 183.622937][ T8960] ? __might_fault+0xb0/0x130 [ 183.622974][ T8960] should_fail_ex+0x414/0x560 [ 183.623007][ T8960] _copy_from_user+0x2d/0xb0 [ 183.623031][ T8960] ____sys_sendmsg+0x2fe/0x830 [ 183.623064][ T8960] ? __pfx_____sys_sendmsg+0x10/0x10 [ 183.623099][ T8960] ? import_iovec+0x74/0xa0 [ 183.623126][ T8960] ___sys_sendmsg+0x21f/0x2a0 [ 183.623162][ T8960] ? __pfx____sys_sendmsg+0x10/0x10 [ 183.623224][ T8960] ? __fget_files+0x2a/0x420 [ 183.623251][ T8960] ? __fget_files+0x3a0/0x420 [ 183.623288][ T8960] __x64_sys_sendmsg+0x19b/0x260 [ 183.623316][ T8960] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 183.623352][ T8960] ? __pfx_ksys_write+0x10/0x10 [ 183.623374][ T8960] ? rcu_is_watching+0x15/0xb0 [ 183.623395][ T8960] ? do_syscall_64+0xbe/0x3b0 [ 183.623421][ T8960] do_syscall_64+0xfa/0x3b0 [ 183.623442][ T8960] ? lockdep_hardirqs_on+0x9c/0x150 [ 183.623462][ T8960] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 183.623481][ T8960] ? clear_bhb_loop+0x60/0xb0 [ 183.623504][ T8960] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 183.623523][ T8960] RIP: 0033:0x7fcfb0b8eec9 [ 183.623544][ T8960] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 183.623561][ T8960] RSP: 002b:00007fcfb19f1038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 183.623584][ T8960] RAX: ffffffffffffffda RBX: 00007fcfb0de5fa0 RCX: 00007fcfb0b8eec9 [ 183.623598][ T8960] RDX: 0000000000000000 RSI: 0000200000000400 RDI: 0000000000000003 [ 183.623610][ T8960] RBP: 00007fcfb19f1090 R08: 0000000000000000 R09: 0000000000000000 [ 183.623622][ T8960] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 183.623633][ T8960] R13: 00007fcfb0de6038 R14: 00007fcfb0de5fa0 R15: 00007ffcd1b27458 [ 183.623664][ T8960] [ 183.881497][ T6551] netdevsim netdevsim3 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 183.919131][ T6551] netdevsim netdevsim3 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 183.937074][ T8962] netlink: 'syz.4.712': attribute type 1 has an invalid length. [ 184.113021][ T8969] gtp0: entered promiscuous mode [ 184.118188][ T8969] gtp0: entered allmulticast mode [ 184.174072][ T6567] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 184.192942][ T6567] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 184.426642][ T8979] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 184.528039][ T8979] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 184.585484][ T8989] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 184.655846][ T8979] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 184.752340][ T8979] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 184.768079][ T5881] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 184.779540][ T5881] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 184.788802][ T5881] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 184.799742][ T5881] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 184.807606][ T5881] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 184.841020][ T51] Bluetooth: hci4: command 0x0405 tx timeout [ 184.940645][ T6553] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 184.972411][ T6553] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 185.032834][ T6553] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 185.075954][ T4334] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 185.181795][ T8995] tipc: Started in network mode [ 185.186761][ T8995] tipc: Node identity 5ac69d8e0136, cluster identity 4711 [ 185.214649][ T8995] tipc: Enabled bearer , priority 0 [ 185.236670][ T8996] syzkaller0: entered promiscuous mode [ 185.246146][ T8996] syzkaller0: entered allmulticast mode [ 185.303074][ T8994] tipc: Resetting bearer [ 185.381644][ T8994] tipc: Disabling bearer [ 185.855091][ T9023] netlink: 'syz.3.728': attribute type 30 has an invalid length. [ 185.917562][ T9030] A link change request failed with some changes committed already. Interface macsec0 may have been left with an inconsistent configuration, please check. [ 185.998511][ T8991] chnl_net:caif_netlink_parms(): no params data found [ 186.328446][ T8991] bridge0: port 1(bridge_slave_0) entered blocking state [ 186.335938][ T8991] bridge0: port 1(bridge_slave_0) entered disabled state [ 186.348918][ T8991] bridge_slave_0: entered allmulticast mode [ 186.357956][ T8991] bridge_slave_0: entered promiscuous mode [ 186.368035][ T8991] bridge0: port 2(bridge_slave_1) entered blocking state [ 186.394248][ T8991] bridge0: port 2(bridge_slave_1) entered disabled state [ 186.414294][ T8991] bridge_slave_1: entered allmulticast mode [ 186.424034][ T8991] bridge_slave_1: entered promiscuous mode [ 186.543862][ T8991] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 186.587147][ T8991] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 186.839544][ T5884] Bluetooth: hci5: command tx timeout [ 186.904648][ T8991] team0: Port device team_slave_0 added [ 186.959273][ T8991] team0: Port device team_slave_1 added [ 187.016064][ T9072] netlink: 'syz.4.738': attribute type 10 has an invalid length. [ 187.086068][ T8991] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 187.103794][ T8991] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 187.135049][ T8991] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 187.168433][ T8991] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 187.186455][ T8991] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 187.260380][ T8991] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 187.483160][ T8991] hsr_slave_0: entered promiscuous mode [ 187.494186][ T8991] hsr_slave_1: entered promiscuous mode [ 187.507159][ T8991] debugfs: 'hsr0' already exists in 'hsr' [ 187.516255][ T8991] Cannot create hsr debugfs directory [ 187.706243][ T9118] syzkaller1: entered promiscuous mode [ 187.717599][ T9118] syzkaller1: entered allmulticast mode [ 187.939044][ T8991] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 187.951793][ T8991] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 187.963015][ T8991] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 187.976994][ T6076] IPVS: starting estimator thread 0... [ 187.998381][ T8991] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 188.069472][ T9122] IPVS: using max 28 ests per chain, 67200 per kthread [ 188.271972][ T9112] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 188.399008][ T8991] 8021q: adding VLAN 0 to HW filter on device bond0 [ 188.458310][ T8991] 8021q: adding VLAN 0 to HW filter on device team0 [ 188.486034][ T6555] bridge0: port 1(bridge_slave_0) entered blocking state [ 188.493221][ T6555] bridge0: port 1(bridge_slave_0) entered forwarding state [ 188.545706][ T6567] bridge0: port 2(bridge_slave_1) entered blocking state [ 188.552918][ T6567] bridge0: port 2(bridge_slave_1) entered forwarding state [ 188.615443][ T9141] vlan0: entered promiscuous mode [ 188.622916][ T9141] macvtap0: entered promiscuous mode [ 188.674584][ T9146] netlink: 'syz.0.754': attribute type 15 has an invalid length. [ 188.685642][ T9146] __nla_validate_parse: 159 callbacks suppressed [ 188.685670][ T9146] netlink: 104 bytes leftover after parsing attributes in process `syz.0.754'. [ 188.735836][ T9149] netlink: 12 bytes leftover after parsing attributes in process `syz.2.757'. [ 188.905373][ T9158] netlink: 'syz.0.760': attribute type 3 has an invalid length. [ 188.920999][ T5884] Bluetooth: hci5: command 0x041b tx timeout [ 189.303315][ T9175] netlink: 3 bytes leftover after parsing attributes in process `syz.2.761'. [ 189.424456][ T9179] netlink: 'syz.2.761': attribute type 6 has an invalid length. [ 189.440065][ T9179] netlink: 'syz.2.761': attribute type 7 has an invalid length. [ 189.468157][ T9179] netlink: 'syz.2.761': attribute type 8 has an invalid length. [ 189.478250][ T9179] netlink: 'syz.2.761': attribute type 15 has an invalid length. [ 189.507444][ T9181] netlink: 'syz.2.761': attribute type 13 has an invalid length. [ 189.550499][ T9181] netlink: 36 bytes leftover after parsing attributes in process `syz.2.761'. [ 189.672356][ T8991] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 189.879927][ T55] block nbd4: Possible stuck request ffff888025617000: control (read@0,1024B). Runtime 18 seconds [ 189.890814][ T55] block nbd4: Possible stuck request ffff8880256171c0: control (read@1024,1024B). Runtime 18 seconds [ 189.902177][ T55] block nbd4: Possible stuck request ffff888025617380: control (read@2048,1024B). Runtime 18 seconds [ 189.913504][ T55] block nbd4: Possible stuck request ffff888025617540: control (read@3072,1024B). Runtime 18 seconds [ 190.425510][ T8991] veth0_vlan: entered promiscuous mode [ 190.486693][ T8991] veth1_vlan: entered promiscuous mode [ 190.630953][ T8991] veth0_macvtap: entered promiscuous mode [ 190.654137][ T8991] veth1_macvtap: entered promiscuous mode [ 190.758160][ T8991] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 190.817123][ T8991] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 190.841305][ T6551] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 190.887439][ T6551] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 190.910156][ T6551] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 190.951935][ T6551] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 191.000291][ T51] Bluetooth: hci5: command 0x041b tx timeout [ 191.168416][ T59] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 191.190259][ T59] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 191.230041][ T9200] syzkaller1: entered promiscuous mode [ 191.240154][ T9200] syzkaller1: entered allmulticast mode [ 191.392071][ T6567] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 191.439437][ T6567] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 191.703721][ T9213] netlink: 'syz.0.768': attribute type 13 has an invalid length. [ 192.239961][ T9238] netlink: 4 bytes leftover after parsing attributes in process `syz.0.772'. [ 192.258861][ T9236] netlink: 8 bytes leftover after parsing attributes in process `syz.3.771'. [ 193.080055][ T51] Bluetooth: hci5: command 0x041b tx timeout [ 193.160499][ T9273] netlink: 12 bytes leftover after parsing attributes in process `syz.3.780'. [ 193.193874][ T9286] tipc: Started in network mode [ 193.198864][ T9286] tipc: Node identity ac14140f, cluster identity 4711 [ 193.227479][ T9286] tipc: New replicast peer: 255.255.255.255 [ 193.277920][ T9286] tipc: Enabled bearer , priority 10 [ 193.388185][ T9295] netlink: 8 bytes leftover after parsing attributes in process `syz.0.783'. [ 193.429281][ T9295] netlink: 4 bytes leftover after parsing attributes in process `syz.0.783'. [ 193.671197][ T9314] netlink: 8 bytes leftover after parsing attributes in process `syz.5.788'. [ 193.731281][ T9314] netlink: 8 bytes leftover after parsing attributes in process `syz.5.788'. [ 193.759637][ T9314] netlink: 8 bytes leftover after parsing attributes in process `syz.5.788'. [ 193.952297][ T9333] netlink: 8 bytes leftover after parsing attributes in process `syz.3.791'. [ 193.964213][ T9328] netlink: 65039 bytes leftover after parsing attributes in process `syz.0.790'. [ 194.020647][ T9333] netlink: 4 bytes leftover after parsing attributes in process `syz.3.791'. [ 194.046320][ T9333] netlink: 'syz.3.791': attribute type 13 has an invalid length. [ 194.387294][ T9346] netlink: 12 bytes leftover after parsing attributes in process `syz.5.796'. [ 194.389932][ T24] tipc: Node number set to 2886997007 [ 194.429619][ T6567] netdevsim netdevsim5 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 194.442767][ T9346] netlink: 12 bytes leftover after parsing attributes in process `syz.5.796'. [ 194.456580][ T1301] ieee802154 phy1 wpan1: encryption failed: -22 [ 194.467658][ T1301] clip:clip_start_xmit: skb_dst(skb) == NULL [ 194.477462][ T6567] netdevsim netdevsim5 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 194.631697][ T9351] netlink: 'syz.3.798': attribute type 3 has an invalid length. [ 194.691081][ T6567] netdevsim netdevsim5 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 194.709544][ T6567] netdevsim netdevsim5 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 194.732076][ T9355] netlink: 96 bytes leftover after parsing attributes in process `syz.4.797'. [ 194.752446][ T9357] netlink: 6 bytes leftover after parsing attributes in process `syz.4.797'. [ 194.801453][ T9357] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 194.808548][ T9359] sctp: [Deprecated]: syz.3.800 (pid 9359) Use of int in max_burst socket option deprecated. [ 194.808548][ T9359] Use struct sctp_assoc_value instead [ 195.039940][ T9328] netlink: 'syz.0.790': attribute type 1 has an invalid length. [ 195.052656][ T9328] netlink: 'syz.0.790': attribute type 3 has an invalid length. [ 195.099596][ T9328] netlink: 'syz.0.790': attribute type 1 has an invalid length. [ 195.128980][ T9328] netlink: 204 bytes leftover after parsing attributes in process `syz.0.790'. [ 195.169468][ T51] Bluetooth: hci5: command 0x041b tx timeout [ 195.218618][ T9328] NCSI netlink: No device for ifindex 0 [ 195.485001][ T9391] af_packet: tpacket_rcv: packet too big, clamped from 3956 to 3952. macoff=96 [ 195.557894][ T9394] IPVS: set_ctl: invalid protocol: 12 127.0.0.1:20004 [ 195.876157][ T9408] netlink: 'syz.3.811': attribute type 13 has an invalid length. [ 198.919687][ T55] block nbd4: Possible stuck request ffff888025617000: control (read@0,1024B). Runtime 27 seconds [ 198.930626][ T55] block nbd4: Possible stuck request ffff8880256171c0: control (read@1024,1024B). Runtime 27 seconds [ 198.942047][ T55] block nbd4: Possible stuck request ffff888025617380: control (read@2048,1024B). Runtime 27 seconds [ 198.953635][ T55] block nbd4: Possible stuck request ffff888025617540: control (read@3072,1024B). Runtime 27 seconds [ 199.527738][ T9537] __nla_validate_parse: 21 callbacks suppressed [ 199.527757][ T9537] netlink: 68 bytes leftover after parsing attributes in process `syz.4.837'. [ 199.990528][ T9557] sctp: [Deprecated]: syz.2.843 (pid 9557) Use of int in max_burst socket option deprecated. [ 199.990528][ T9557] Use struct sctp_assoc_value instead [ 200.027456][ T9555] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 200.246577][ T9568] netlink: 24 bytes leftover after parsing attributes in process `syz.2.845'. [ 200.304862][ T9570] tipc: Enabled bearer , priority 0 [ 200.332581][ T9570] syzkaller0: entered promiscuous mode [ 200.338476][ T9570] syzkaller0: entered allmulticast mode [ 200.463564][ T9570] tipc: Resetting bearer [ 200.542188][ T9569] tipc: Resetting bearer [ 200.563277][ T9569] tipc: Disabling bearer [ 200.614409][ T9581] netlink: 28 bytes leftover after parsing attributes in process `syz.4.850'. [ 200.875892][ T9587] netlink: 4 bytes leftover after parsing attributes in process `syz.4.852'. [ 200.937561][ T9587] netlink: 'syz.4.852': attribute type 27 has an invalid length. [ 201.049324][ T9587] bridge0: port 2(bridge_slave_1) entered disabled state [ 201.058023][ T9587] bridge0: port 1(bridge_slave_0) entered disabled state [ 201.201733][ T9587] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 201.217591][ T9587] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 201.323236][ T9587] ip6tnl1: left promiscuous mode [ 201.328208][ T9587] ip6tnl1: left allmulticast mode [ 201.384533][ T6553] netdevsim netdevsim4 eth0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 201.417154][ T6553] netdevsim netdevsim4 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 201.493086][ T6553] netdevsim netdevsim4 eth1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 201.513102][ T6553] netdevsim netdevsim4 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 201.552699][ T6553] netdevsim netdevsim4 eth2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 201.553287][ T9599] netlink: 'syz.3.855': attribute type 11 has an invalid length. [ 201.570181][ T6553] netdevsim netdevsim4 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 201.581680][ T9606] netlink: 24 bytes leftover after parsing attributes in process `syz.0.856'. [ 201.719229][ T6553] netdevsim netdevsim4 eth3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 201.728831][ T6553] netdevsim netdevsim4 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 201.797049][ T9617] netlink: 24 bytes leftover after parsing attributes in process `syz.4.859'. [ 201.921292][ T9620] netlink: 'syz.5.861': attribute type 21 has an invalid length. [ 201.929058][ T9620] netlink: 60 bytes leftover after parsing attributes in process `syz.5.861'. [ 202.036205][ T9621] netlink: 16 bytes leftover after parsing attributes in process `syz.4.859'. [ 202.536250][ T9654] netlink: 5 bytes leftover after parsing attributes in process `syz.3.866'. [ 203.052735][ T9678] netlink: 36 bytes leftover after parsing attributes in process `syz.3.873'. [ 203.205667][ T9688] sctp: [Deprecated]: syz.5.875 (pid 9688) Use of int in maxseg socket option. [ 203.205667][ T9688] Use struct sctp_assoc_value instead [ 203.256837][ T9682] bond3: entered promiscuous mode [ 203.264063][ T9682] bond3: entered allmulticast mode [ 203.271131][ T9682] 8021q: adding VLAN 0 to HW filter on device bond3 [ 205.030216][ T9753] __nla_validate_parse: 3 callbacks suppressed [ 205.030235][ T9753] netlink: 4 bytes leftover after parsing attributes in process `syz.4.891'. [ 205.178564][ T9762] macvtap1: entered allmulticast mode [ 205.189721][ T9762] veth0_macvtap: entered allmulticast mode [ 205.247811][ T9772] netlink: 'syz.0.888': attribute type 12 has an invalid length. [ 206.153108][ T9812] netlink: 4 bytes leftover after parsing attributes in process `syz.2.899'. [ 206.188700][ T9812] netlink: 4 bytes leftover after parsing attributes in process `syz.2.899'. [ 206.214074][ T9810] netlink: 'syz.3.900': attribute type 1 has an invalid length. [ 206.246661][ T9810] netlink: 28 bytes leftover after parsing attributes in process `syz.3.900'. [ 206.808737][ T9839] netlink: 'syz.3.905': attribute type 4 has an invalid length. [ 206.817079][ T9840] netlink: 'syz.3.905': attribute type 4 has an invalid length. [ 206.880151][ T9840] netlink: 36 bytes leftover after parsing attributes in process `syz.3.905'. [ 207.188523][ T9846] batadv_slave_1: entered promiscuous mode [ 207.322898][ T9845] batadv_slave_1: left promiscuous mode [ 207.457842][ T9852] netlink: 'syz.5.909': attribute type 16 has an invalid length. [ 207.465946][ T9852] netlink: 'syz.5.909': attribute type 17 has an invalid length. [ 207.512047][ T9856] netlink: 64 bytes leftover after parsing attributes in process `syz.5.909'. [ 207.973000][ T55] block nbd4: Possible stuck request ffff888025617000: control (read@0,1024B). Runtime 36 seconds [ 207.984483][ T55] block nbd4: Possible stuck request ffff8880256171c0: control (read@1024,1024B). Runtime 36 seconds [ 207.990572][ T9852] bridge0: port 2(bridge_slave_1) entered disabled state [ 207.996032][ T55] block nbd4: Possible stuck request ffff888025617380: control (read@2048,1024B). Runtime 36 seconds [ 208.003095][ T9852] bridge0: port 1(bridge_slave_0) entered disabled state [ 208.014375][ T55] block nbd4: Possible stuck request ffff888025617540: control (read@3072,1024B). Runtime 36 seconds [ 208.240836][ T9852] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 208.259339][ T9852] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 208.610809][ T9856] netlink: 4 bytes leftover after parsing attributes in process `syz.5.909'. [ 208.643426][ T6567] netdevsim netdevsim5 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 208.652902][ T6567] netdevsim netdevsim5 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 208.663394][ T6567] netdevsim netdevsim5 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 208.673354][ T6567] netdevsim netdevsim5 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 208.711589][ T9861] netlink: 8 bytes leftover after parsing attributes in process `syz.5.911'. [ 208.745791][ T9862] netlink: 8 bytes leftover after parsing attributes in process `syz.5.911'. [ 208.751313][ T6567] netdevsim netdevsim5 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 208.764480][ T6567] netdevsim netdevsim5 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 208.793922][ T6567] netdevsim netdevsim5 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 208.804231][ T6567] netdevsim netdevsim5 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 209.539019][ T9881] netlink: 40 bytes leftover after parsing attributes in process `syz.4.915'. [ 209.580294][ T9881] netlink: 'syz.4.915': attribute type 1 has an invalid length. [ 210.260815][ T9888] netlink: 24 bytes leftover after parsing attributes in process `syz.5.918'. [ 210.470950][ T9893] netlink: 'syz.4.919': attribute type 1 has an invalid length. [ 210.551072][ T9893] bond4: (slave vti0): The slave device specified does not support setting the MAC address [ 210.576382][ T9893] bond4: (slave vti0): Setting fail_over_mac to active for active-backup mode [ 210.623407][ T9893] bond4: (slave vti0): making interface the new active one [ 210.662138][ T9893] bond4: (slave vti0): Enslaving as an active interface with an up link [ 210.683376][ T9896] (unnamed net_device) (uninitialized): ARP target 9.0.0.0 is already present [ 210.709682][ T9896] (unnamed net_device) (uninitialized): option arp_ip_target: invalid value (9) [ 211.165995][ T9923] sch_fq: defrate 2 ignored. [ 211.495702][ T9948] netlink: 12 bytes leftover after parsing attributes in process `syz.4.936'. [ 211.540859][ T9948] netlink: 104 bytes leftover after parsing attributes in process `syz.4.936'. [ 211.650514][ T9962] syzkaller0: entered promiscuous mode [ 211.663700][ T9962] syzkaller0: entered allmulticast mode [ 211.774807][ T9971] netlink: 88 bytes leftover after parsing attributes in process `syz.0.944'. [ 211.882309][ T5874] Bluetooth: hci1: command 0x0406 tx timeout [ 211.888481][ T5871] Bluetooth: hci3: command 0x0406 tx timeout [ 211.888497][ T5181] Bluetooth: hci2: command 0x0406 tx timeout [ 211.929142][ T9978] netlink: 4 bytes leftover after parsing attributes in process `syz.0.944'. [ 212.047625][ T9978] team0: left allmulticast mode [ 212.086707][ T9978] team_slave_1: left allmulticast mode [ 212.103534][ T9978] team0: left promiscuous mode [ 212.117313][ T9985] netlink: 4 bytes leftover after parsing attributes in process `syz.4.947'. [ 212.118997][ T9978] team_slave_1: left promiscuous mode [ 212.134412][ T9978] bridge0: port 3(team0) entered disabled state [ 212.143886][ T9978] bridge_slave_1: left allmulticast mode [ 212.151885][ T9978] bridge_slave_1: left promiscuous mode [ 212.157904][ T9978] bridge0: port 2(bridge_slave_1) entered disabled state [ 212.168330][ T9978] bridge_slave_0: left promiscuous mode [ 212.179212][ T9978] bridge0: port 1(bridge_slave_0) entered disabled state [ 212.282519][ T9987] netlink: 48 bytes leftover after parsing attributes in process `syz.5.948'. [ 212.560635][ T9994] netlink: 'syz.2.949': attribute type 6 has an invalid length. [ 212.941344][T10014] netlink: 'syz.4.957': attribute type 4 has an invalid length. [ 213.295603][ T51] block nbd5: Receive control failed (result -32) [ 213.644217][T10048] netlink: 4 bytes leftover after parsing attributes in process `syz.0.964'. [ 213.793527][T10045] ip6gre1: left allmulticast mode [ 213.820072][T10045] vlan2: left promiscuous mode [ 213.824877][T10045] bond0: left promiscuous mode [ 213.841053][T10045] bond_slave_0: left promiscuous mode [ 213.850853][T10045] bond_slave_1: left promiscuous mode [ 213.880707][T10045] geneve2: left promiscuous mode [ 213.900740][T10045] geneve2: left allmulticast mode [ 213.968961][T10045] bond2: left promiscuous mode [ 213.978082][T10045] bond2: left allmulticast mode [ 213.993091][T10045] macsec1: left promiscuous mode [ 214.008677][T10045] macsec1: left allmulticast mode [ 214.025093][T10048] hsr_slave_0: left promiscuous mode [ 214.052393][T10048] hsr_slave_1: left promiscuous mode [ 214.170132][ T6553] netdevsim netdevsim0 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 214.200156][ T6553] netdevsim netdevsim0 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 214.256147][ T6553] netdevsim netdevsim0 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 214.297943][ T6553] netdevsim netdevsim0 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 214.559136][T10074] netlink: 8 bytes leftover after parsing attributes in process `syz.4.974'. [ 214.580515][T10074] netlink: 4 bytes leftover after parsing attributes in process `syz.4.974'. [ 215.826295][T10103] __nla_validate_parse: 2 callbacks suppressed [ 215.826322][T10103] netlink: 16 bytes leftover after parsing attributes in process `syz.3.983'. [ 215.944993][T10108] netlink: 32 bytes leftover after parsing attributes in process `syz.4.984'. [ 216.007462][T10108] netlink: 7 bytes leftover after parsing attributes in process `syz.4.984'. [ 216.379899][T10120] netlink: 'syz.4.986': attribute type 16 has an invalid length. [ 216.409770][T10120] netlink: 'syz.4.986': attribute type 17 has an invalid length. [ 216.438809][T10115] netlink: 4 bytes leftover after parsing attributes in process `syz.4.986'. [ 216.884096][T10127] dvmrp8: entered allmulticast mode [ 217.000750][ T55] block nbd4: Possible stuck request ffff888025617000: control (read@0,1024B). Runtime 45 seconds [ 217.012129][ T55] block nbd4: Possible stuck request ffff8880256171c0: control (read@1024,1024B). Runtime 45 seconds [ 217.040377][ T55] block nbd4: Possible stuck request ffff888025617380: control (read@2048,1024B). Runtime 45 seconds [ 217.051920][ T55] block nbd4: Possible stuck request ffff888025617540: control (read@3072,1024B). Runtime 45 seconds [ 217.518508][T10143] netlink: 16 bytes leftover after parsing attributes in process `syz.3.994'. [ 217.558358][T10137] netlink: 'syz.5.992': attribute type 4 has an invalid length. [ 217.568802][T10137] netlink: 244 bytes leftover after parsing attributes in process `syz.5.992'. [ 217.596343][T10143] ip6gretap1: entered promiscuous mode [ 217.777504][T10126] dvmrp8: left allmulticast mode [ 218.151046][ T24] IPVS: starting estimator thread 0... [ 218.265381][T10171] IPVS: using max 29 ests per chain, 69600 per kthread [ 218.289978][T10178] netlink: 'syz.2.1001': attribute type 1 has an invalid length. [ 218.464322][T10186] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 218.471952][T10186] IPv6: NLM_F_CREATE should be set when creating new route [ 218.514467][T10186] netlink: 28 bytes leftover after parsing attributes in process `syz.2.1004'. [ 218.724435][T10192] netlink: 64 bytes leftover after parsing attributes in process `syz.2.1005'. [ 218.951771][T10200] geneve3: entered promiscuous mode [ 218.970589][T10200] geneve3: entered allmulticast mode [ 219.354986][T10196] netlink: 24 bytes leftover after parsing attributes in process `syz.5.1006'. [ 219.609917][T10217] netlink: 'syz.0.1012': attribute type 10 has an invalid length. [ 219.637307][T10217] 8021q: adding VLAN 0 to HW filter on device team0 [ 219.706137][T10217] bond0: (slave team0): Enslaving as an active interface with an up link [ 219.772440][T10227] netlink: 'syz.4.1014': attribute type 21 has an invalid length. [ 219.789871][T10227] IPv6: NLM_F_CREATE should be specified when creating new route [ 219.808167][T10227] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 219.815455][T10227] IPv6: NLM_F_CREATE should be set when creating new route [ 219.822780][T10227] IPv6: NLM_F_CREATE should be set when creating new route [ 219.830108][T10227] IPv6: NLM_F_CREATE should be set when creating new route [ 220.801708][T10259] pim6reg: entered allmulticast mode [ 220.844682][T10257] pim6reg: left allmulticast mode [ 220.909805][T10265] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1024'. [ 220.967639][T10265] netlink: 'syz.4.1024': attribute type 20 has an invalid length. [ 220.982234][T10265] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1024'. [ 221.051143][T10263] erspan0: entered promiscuous mode [ 221.070320][T10263] erspan0: left promiscuous mode [ 221.225813][T10272] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1025'. [ 221.227200][T10274] netlink: 92 bytes leftover after parsing attributes in process `syz.0.1027'. [ 221.253532][T10274] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1027'. [ 221.263660][T10274] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1027'. [ 221.281243][T10276] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1027'. [ 221.324972][T10274] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1027'. [ 221.402600][T10276] netlink: 32 bytes leftover after parsing attributes in process `syz.0.1027'. [ 221.495199][T10287] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1030'. [ 221.836977][T10304] tipc: Started in network mode [ 221.864572][T10304] tipc: Node identity de588572ed58, cluster identity 4711 [ 221.886519][T10304] tipc: Enabled bearer , priority 0 [ 221.915283][T10304] syzkaller0: entered promiscuous mode [ 221.941849][T10304] syzkaller0: entered allmulticast mode [ 221.976203][T10304] A link change request failed with some changes committed already. Interface veth1_to_bond may have been left with an inconsistent configuration, please check. [ 222.225475][T10317] pim6reg: entered allmulticast mode [ 222.417537][T10301] tipc: Resetting bearer [ 222.436438][T10301] tipc: Disabling bearer [ 222.914439][T10357] IPVS: set_ctl: invalid protocol: 22 224.0.0.2:20001 [ 223.016852][T10361] netlink: 'syz.0.1050': attribute type 10 has an invalid length. [ 223.076498][T10361] netlink: 'syz.0.1050': attribute type 10 has an invalid length. [ 223.112473][T10361] netlink: 'syz.0.1050': attribute type 10 has an invalid length. [ 223.128491][T10368] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci5/hci5:200/input6 [ 223.139723][T10361] netlink: 'syz.0.1050': attribute type 10 has an invalid length. [ 223.160893][T10361] netlink: 'syz.0.1050': attribute type 10 has an invalid length. [ 223.175040][T10361] netlink: 'syz.0.1050': attribute type 10 has an invalid length. [ 224.010920][T10418] macsec0: entered promiscuous mode [ 224.016178][T10418] macsec0: entered allmulticast mode [ 224.084796][T10418] veth1_macvtap: entered allmulticast mode [ 224.107440][T10418] macsec0: left promiscuous mode [ 224.117584][T10418] macsec0: left allmulticast mode [ 224.130820][T10418] veth1_macvtap: left allmulticast mode [ 224.300989][T10429] dvmrp0: entered allmulticast mode [ 225.191822][T10450] ip6tnl1: entered promiscuous mode [ 225.197110][T10450] ip6tnl1: entered allmulticast mode [ 226.411881][T10489] __nla_validate_parse: 47 callbacks suppressed [ 226.411899][T10489] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1080'. [ 226.441170][ T55] block nbd4: Possible stuck request ffff888025617000: control (read@0,1024B). Runtime 54 seconds [ 226.452803][ T55] block nbd4: Possible stuck request ffff8880256171c0: control (read@1024,1024B). Runtime 54 seconds [ 226.465427][ T55] block nbd4: Possible stuck request ffff888025617380: control (read@2048,1024B). Runtime 54 seconds [ 226.477335][ T55] block nbd4: Possible stuck request ffff888025617540: control (read@3072,1024B). Runtime 54 seconds [ 226.510303][T10489] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1080'. [ 226.529657][T10492] netlink: 830 bytes leftover after parsing attributes in process `syz.5.1082'. [ 226.773352][T10501] tipc: Enabled bearer , priority 0 [ 226.798078][T10499] syzkaller0: entered promiscuous mode [ 226.809881][T10499] syzkaller0: entered allmulticast mode [ 226.926816][T10500] tipc: Resetting bearer [ 227.105930][T10500] tipc: Disabling bearer [ 227.754171][T10545] IPv6: addrconf: prefix option has invalid lifetime [ 227.837616][T10548] syzkaller1: entered promiscuous mode [ 227.862431][T10548] syzkaller1: entered allmulticast mode [ 227.953022][T10552] FAULT_INJECTION: forcing a failure. [ 227.953022][T10552] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 227.987822][T10552] CPU: 1 UID: 0 PID: 10552 Comm: syz.0.1097 Not tainted syzkaller #0 PREEMPT(full) [ 227.987854][T10552] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 227.987874][T10552] Call Trace: [ 227.987881][T10552] [ 227.987890][T10552] dump_stack_lvl+0x189/0x250 [ 227.987916][T10552] ? __pfx____ratelimit+0x10/0x10 [ 227.987936][T10552] ? __pfx_dump_stack_lvl+0x10/0x10 [ 227.987956][T10552] ? __pfx__printk+0x10/0x10 [ 227.987979][T10552] ? __might_fault+0xb0/0x130 [ 227.988013][T10552] should_fail_ex+0x414/0x560 [ 227.988046][T10552] _copy_from_user+0x2d/0xb0 [ 227.988069][T10552] __sys_bpf+0x1ed/0x870 [ 227.988093][T10552] ? __pfx___sys_bpf+0x10/0x10 [ 227.988125][T10552] ? ksys_write+0x22a/0x250 [ 227.988150][T10552] ? __pfx_ksys_write+0x10/0x10 [ 227.988176][T10552] __x64_sys_bpf+0x7c/0x90 [ 227.988198][T10552] do_syscall_64+0xfa/0x3b0 [ 227.988219][T10552] ? lockdep_hardirqs_on+0x9c/0x150 [ 227.988238][T10552] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 227.988256][T10552] ? clear_bhb_loop+0x60/0xb0 [ 227.988280][T10552] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 227.988299][T10552] RIP: 0033:0x7fdf8d78eec9 [ 227.988316][T10552] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 227.988331][T10552] RSP: 002b:00007fdf8e585038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 227.988350][T10552] RAX: ffffffffffffffda RBX: 00007fdf8d9e5fa0 RCX: 00007fdf8d78eec9 [ 227.988364][T10552] RDX: 0000000000000020 RSI: 00002000000004c0 RDI: 0000000000000009 [ 227.988376][T10552] RBP: 00007fdf8e585090 R08: 0000000000000000 R09: 0000000000000000 [ 227.988387][T10552] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 227.988398][T10552] R13: 00007fdf8d9e6038 R14: 00007fdf8d9e5fa0 R15: 00007ffed6309058 [ 227.988428][T10552] [ 228.174193][T10563] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1095'. [ 228.308411][T10568] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1103'. [ 228.537495][T10578] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1104'. [ 229.107754][T10604] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1111'. [ 229.613404][T10622] netlink: 260 bytes leftover after parsing attributes in process `syz.0.1114'. [ 229.695044][T10619] syzkaller1: entered promiscuous mode [ 229.712396][T10619] syzkaller1: entered allmulticast mode [ 230.290222][T10639] netlink: 96 bytes leftover after parsing attributes in process `syz.3.1118'. [ 230.362389][T10642] tipc: Enabled bearer , priority 0 [ 230.391970][T10636] syzkaller0: entered promiscuous mode [ 230.397488][T10636] syzkaller0: entered allmulticast mode [ 230.404000][T10650] netlink: 32 bytes leftover after parsing attributes in process `syz.2.1122'. [ 230.474196][T10636] tipc: Resetting bearer [ 230.517648][T10635] tipc: Resetting bearer [ 230.541095][T10635] tipc: Disabling bearer [ 231.001623][T10671] validate_nla: 27 callbacks suppressed [ 231.001641][T10671] netlink: 'syz.3.1128': attribute type 19 has an invalid length. [ 231.013051][T10670] batman_adv: batadv0: Adding interface: macsec1 [ 231.017306][T10671] netlink: 'syz.3.1128': attribute type 20 has an invalid length. [ 231.045578][T10670] batman_adv: batadv0: The MTU of interface macsec1 is too small (1468) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 231.072268][T10670] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 231.098975][T10670] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 231.109327][T10670] batman_adv: batadv0: Interface activated: macsec1 [ 231.763587][T10683] 8021q: adding VLAN 0 to HW filter on device bond1 [ 231.927668][T10705] __nla_validate_parse: 4 callbacks suppressed [ 231.927687][T10705] netlink: 48 bytes leftover after parsing attributes in process `syz.4.1137'. [ 232.042475][T10711] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1137'. [ 232.152638][T10711] hsr_slave_1 (unregistering): left promiscuous mode [ 232.174343][T10705] netlink: 24 bytes leftover after parsing attributes in process `syz.4.1137'. [ 232.221799][ T49] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 232.250840][ T49] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 232.536846][T10736] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1145'. [ 232.560411][T10736] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1145'. [ 232.584891][T10739] netlink: 28 bytes leftover after parsing attributes in process `syz.2.1146'. [ 232.594231][T10739] netlink: 28 bytes leftover after parsing attributes in process `syz.2.1146'. [ 232.727730][T10745] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1148'. [ 233.668261][T10793] netlink: 96 bytes leftover after parsing attributes in process `syz.2.1157'. [ 233.702782][T10793] veth1_to_bond: entered allmulticast mode [ 233.745894][T10793] veth1_to_bond: entered promiscuous mode [ 233.768218][T10792] veth1_to_bond: left promiscuous mode [ 233.774958][T10792] veth1_to_bond: left allmulticast mode [ 233.952267][T10805] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1159'. [ 235.022404][T10845] nbd: must specify a size in bytes for the device [ 235.261852][T10854] pimreg: tun_chr_ioctl cmd 2147767506 [ 235.387593][T10859] syzkaller0: entered promiscuous mode [ 235.393445][T10859] syzkaller0: entered allmulticast mode [ 235.479673][ T55] block nbd4: Possible stuck request ffff888025617000: control (read@0,1024B). Runtime 63 seconds [ 235.490439][ T55] block nbd4: Possible stuck request ffff8880256171c0: control (read@1024,1024B). Runtime 63 seconds [ 235.501698][ T55] block nbd4: Possible stuck request ffff888025617380: control (read@2048,1024B). Runtime 63 seconds [ 235.512988][ T55] block nbd4: Possible stuck request ffff888025617540: control (read@3072,1024B). Runtime 63 seconds [ 235.821437][T10887] netdevsim netdevsim5 ÿÿÿÿÿÿ: renamed from netdevsim0 [ 236.139062][T10910] syzkaller0: entered promiscuous mode [ 236.168256][T10910] syzkaller0: entered allmulticast mode [ 237.017559][T10936] __nla_validate_parse: 10 callbacks suppressed [ 237.017579][T10936] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1201'. [ 237.066566][T10947] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1206'. [ 237.361461][T10959] ip6gre0: entered allmulticast mode [ 237.381496][T10964] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1211'. [ 237.437437][T10970] netlink: 'syz.5.1209': attribute type 1 has an invalid length. [ 237.446051][T10970] netlink: 168 bytes leftover after parsing attributes in process `syz.5.1209'. [ 237.681271][T10981] netlink: 36 bytes leftover after parsing attributes in process `syz.5.1217'. [ 237.717802][T10981] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1217'. [ 237.962492][T10999] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1222'. [ 238.114183][T11012] netlink: 'syz.5.1226': attribute type 13 has an invalid length. [ 238.401703][T11012] batman_adv: batadv0: Interface deactivated: macsec1 [ 238.412226][T11030] netlink: 20 bytes leftover after parsing attributes in process `syz.2.1229'. [ 238.612203][ T5873] udevd[5873]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 238.833634][T11045] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1231'. [ 238.886317][T11045] nbd: socks must be embedded in a SOCK_ITEM attr [ 238.902495][T11045] block nbd6: shutting down sockets [ 239.025882][T11056] netlink: 28 bytes leftover after parsing attributes in process `syz.4.1235'. [ 239.571832][T11053] netlink: 'syz.5.1234': attribute type 1 has an invalid length. [ 239.936547][T11081] tipc: Enabled bearer , priority 0 [ 241.360084][T11081] syzkaller0: entered promiscuous mode [ 241.365566][T11081] syzkaller0: entered allmulticast mode [ 241.371605][T11081] tipc: Resetting bearer [ 243.356802][ T5231] udevd[5231]: worker [5879] /devices/virtual/block/nbd4 is taking a long time [ 243.414401][T11093] tipc: Resetting bearer [ 243.664045][T11112] syzkaller1: entered promiscuous mode [ 243.669722][T11112] syzkaller1: entered allmulticast mode [ 244.520820][ T55] block nbd4: Possible stuck request ffff888025617000: control (read@0,1024B). Runtime 72 seconds [ 244.531855][ T55] block nbd4: Possible stuck request ffff8880256171c0: control (read@1024,1024B). Runtime 72 seconds [ 244.543092][ T55] block nbd4: Possible stuck request ffff888025617380: control (read@2048,1024B). Runtime 72 seconds [ 244.554870][ T55] block nbd4: Possible stuck request ffff888025617540: control (read@3072,1024B). Runtime 72 seconds [ 244.963838][T11145] __nla_validate_parse: 4 callbacks suppressed [ 244.963856][T11145] netlink: 16 bytes leftover after parsing attributes in process `syz.5.1253'. [ 244.991558][T11145] netlink: 32 bytes leftover after parsing attributes in process `syz.5.1253'. [ 245.043070][T11149] netlink: 'syz.4.1254': attribute type 30 has an invalid length. [ 245.254180][T11153] netlink: 24 bytes leftover after parsing attributes in process `syz.4.1256'. [ 245.451198][T11166] netlink: 24 bytes leftover after parsing attributes in process `syz.5.1261'. [ 245.532839][T11172] netlink: 'syz.4.1263': attribute type 10 has an invalid length. [ 245.540909][T11172] netlink: 40 bytes leftover after parsing attributes in process `syz.4.1263'. [ 245.569509][T11173] netlink: 9 bytes leftover after parsing attributes in process `syz.5.1261'. [ 245.959680][ T51] Bluetooth: hci5: command 0x041b tx timeout [ 248.280416][T11172] dummy0: entered promiscuous mode [ 248.294298][T11172] bridge0: port 4(dummy0) entered blocking state [ 248.300999][T11172] bridge0: port 4(dummy0) entered disabled state [ 248.307515][T11172] dummy0: entered allmulticast mode [ 248.323233][T11173] ..0·: renamed from hsr0 [ 248.347624][T11173] ..0·: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 248.379871][T11173] ..0·: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 248.409527][T11173] ..0·: entered allmulticast mode [ 248.414654][T11173] hsr_slave_0: entered allmulticast mode [ 248.434499][T11173] hsr_slave_1: entered allmulticast mode [ 248.448997][T11173] A link change request failed with some changes committed already. Interface ..0· may have been left with an inconsistent configuration, please check. [ 248.657476][T11201] tipc: Started in network mode [ 248.672576][T11201] tipc: Node identity 4, cluster identity 4711 [ 248.685524][T11201] tipc: Node number set to 4 [ 248.886932][T11216] netlink: 'syz.5.1274': attribute type 1 has an invalid length. [ 249.105042][T11233] sock: sock_timestamping_bind_phc: sock not bind to device [ 249.396056][T11247] net veth1_virt_wifi ªªªªª: renamed from virt_wifi0 [ 249.592882][T11261] netlink: 152 bytes leftover after parsing attributes in process `syz.4.1288'. [ 249.647501][T11261] netlink: 20 bytes leftover after parsing attributes in process `syz.4.1288'. [ 249.674212][T11263] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1287'. [ 249.842134][T11280] trusted_key: syz.4.1292 sent an empty control message without MSG_MORE. [ 249.883786][T11283] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1294'. [ 249.909748][T11284] vlan2: entered promiscuous mode [ 249.914825][T11284] bond0: entered promiscuous mode [ 249.921356][T11284] bond_slave_0: entered promiscuous mode [ 249.927235][T11284] bond_slave_1: entered promiscuous mode [ 250.105714][T11291] IPv6: Can't replace route, no match found [ 250.114642][T11293] netlink: 'syz.4.1297': attribute type 13 has an invalid length. [ 250.131917][T11293] netlink: 'syz.4.1297': attribute type 17 has an invalid length. [ 250.140232][T11293] netlink: 'syz.4.1297': attribute type 5 has an invalid length. [ 250.155933][T11295] syzkaller1: entered promiscuous mode [ 250.162993][T11295] syzkaller1: entered allmulticast mode [ 250.386790][T11303] 8021q: adding VLAN 0 to HW filter on device bond0 [ 250.446889][T11303] bond0: (slave rose0): Error: Slave does not support XDP [ 251.105842][T11342] vxcan1: entered allmulticast mode [ 251.139692][T11342] vxcan1: left allmulticast mode [ 251.146024][T11342] pim6reg: left allmulticast mode [ 252.007022][T11398] netlink: 'syz.5.1319': attribute type 1 has an invalid length. [ 252.191398][T11407] tipc: Resetting bearer [ 252.250757][T11407] tipc: Resetting bearer [ 252.275648][T11407] tipc: Resetting bearer [ 252.390451][T11403] tipc: Resetting bearer [ 252.449024][T11419] __nla_validate_parse: 1 callbacks suppressed [ 252.449043][T11419] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1325'. [ 252.684046][ T13] tipc: Resetting bearer [ 252.789776][T11432] netlink: 60 bytes leftover after parsing attributes in process `syz.3.1328'. [ 252.828940][T11438] netlink: 48 bytes leftover after parsing attributes in process `syz.5.1329'. [ 252.855015][T11438] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1329'. [ 252.892834][T11438] netlink: 'syz.5.1329': attribute type 2 has an invalid length. [ 253.134432][T11452] netlink: 'syz.5.1333': attribute type 10 has an invalid length. [ 253.158018][T11452] bridge0: entered promiscuous mode [ 253.204911][T11452] bond0: (slave bridge0): Enslaving as an active interface with an up link [ 253.228511][T11455] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1333'. [ 253.258469][T11455] bridge_slave_1: left allmulticast mode [ 253.270667][T11457] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1335'. [ 253.295322][T11455] bridge_slave_1: left promiscuous mode [ 253.311196][T11455] bridge0: port 2(bridge_slave_1) entered disabled state [ 253.340632][T11455] bridge_slave_0: left allmulticast mode [ 253.351567][T11455] bridge_slave_0: left promiscuous mode [ 253.357482][T11455] bridge0: port 1(bridge_slave_0) entered disabled state [ 253.405306][T11455] bond0: (slave bridge0): Releasing backup interface [ 253.414025][T11455] bridge0 (unregistering): left promiscuous mode [ 253.562997][ T55] block nbd4: Possible stuck request ffff888025617000: control (read@0,1024B). Runtime 81 seconds [ 253.574525][ T55] block nbd4: Possible stuck request ffff8880256171c0: control (read@1024,1024B). Runtime 81 seconds [ 253.586388][ T55] block nbd4: Possible stuck request ffff888025617380: control (read@2048,1024B). Runtime 81 seconds [ 253.622940][ T55] block nbd4: Possible stuck request ffff888025617540: control (read@3072,1024B). Runtime 81 seconds [ 254.102078][T11488] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1340'. [ 254.139751][T11492] IPv6: NLM_F_CREATE should be specified when creating new route [ 254.148320][T11487] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1340'. [ 254.437297][T11498] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1343'. [ 254.694601][T11511] netlink: 20 bytes leftover after parsing attributes in process `syz.5.1345'. [ 254.703983][T11511] nbd: must specify at least one socket [ 254.736548][T11512] macsec2: entered promiscuous mode [ 254.743177][T11512] ip6gretap0: entered promiscuous mode [ 254.854066][T11518] tipc: Resetting bearer [ 254.902123][T11523] tipc: New replicast peer: 255.255.255.255 [ 254.908715][T11523] tipc: Enabled bearer , priority 10 [ 255.351452][T11538] lo speed is unknown, defaulting to 1000 [ 255.370707][T11538] lo speed is unknown, defaulting to 1000 [ 255.388136][T11538] lo speed is unknown, defaulting to 1000 [ 255.408215][T11538] iwpm_register_pid: Unable to send a nlmsg (client = 2) [ 255.457778][T11538] infiniband syz2: RDMA CMA: cma_listen_on_dev, error -98 [ 255.563402][T11549] syz_tun: entered allmulticast mode [ 255.577736][T11538] lo speed is unknown, defaulting to 1000 [ 255.596398][T11538] lo speed is unknown, defaulting to 1000 [ 255.607621][T11538] lo speed is unknown, defaulting to 1000 [ 255.623074][T11538] lo speed is unknown, defaulting to 1000 [ 255.642358][T11538] lo speed is unknown, defaulting to 1000 [ 255.650223][T11553] syz_tun: left allmulticast mode [ 255.657495][T11553] netlink: 'syz.3.1355': attribute type 10 has an invalid length. [ 255.684699][T11538] lo speed is unknown, defaulting to 1000 [ 255.693462][T11517] tipc: Resetting bearer [ 255.746147][ T6571] tipc: Resetting bearer [ 255.884974][ T1301] ieee802154 phy1 wpan1: encryption failed: -22 [ 255.894972][ T1301] clip:clip_start_xmit: skb_dst(skb) == NULL [ 255.926931][T11562] tipc: Enabled bearer , priority 0 [ 255.975165][T11558] syzkaller0: entered promiscuous mode [ 256.046350][T11558] syzkaller0: entered allmulticast mode [ 256.148437][T11575] tipc: Resetting bearer [ 256.174345][T11557] tipc: Resetting bearer [ 256.210514][T11557] tipc: Disabling bearer [ 256.529318][T11567] lo speed is unknown, defaulting to 1000 [ 256.887514][T11607] veth0_macvtap: left allmulticast mode [ 257.477883][T11636] tipc: Enabling of bearer rejected, already enabled [ 257.633869][T11640] macvtap1: entered promiscuous mode [ 257.639307][T11640] batadv0: entered promiscuous mode [ 257.648541][T11640] 8021q: adding VLAN 0 to HW filter on device macvtap1 [ 257.681905][T11640] batadv0: left promiscuous mode [ 257.986584][T11662] netlink: 'syz.4.1385': attribute type 13 has an invalid length. [ 257.996548][T11662] netlink: 'syz.4.1385': attribute type 17 has an invalid length. [ 258.250039][T11669] __nla_validate_parse: 6 callbacks suppressed [ 258.250059][T11669] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1386'. [ 258.304669][T11662] bridge0: port 4(dummy0) entered blocking state [ 258.311236][T11662] bridge0: port 4(dummy0) entered forwarding state [ 258.333802][T11662] 8021q: adding VLAN 0 to HW filter on device bond0 [ 258.344501][T11662] 8021q: adding VLAN 0 to HW filter on device team0 [ 258.358537][T11662] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 258.376612][T11665] xfrm0: entered promiscuous mode [ 258.427000][T11665] xfrm0: entered allmulticast mode [ 258.446007][ T6571] bond0: (slave bond_slave_0): link status definitely down, disabling slave [ 258.458784][ T6571] bond0: (slave bond_slave_1): link status definitely down, disabling slave [ 258.477319][ T6571] bond0: now running without any active interface! [ 258.844990][T11673] lo speed is unknown, defaulting to 1000 [ 259.087558][T11681] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1388'. [ 259.212963][T11686] netlink: 'syz.3.1390': attribute type 1 has an invalid length. [ 259.518005][T11702] netlink: 'syz.2.1389': attribute type 1 has an invalid length. [ 259.546537][T11702] netlink: 224 bytes leftover after parsing attributes in process `syz.2.1389'. [ 259.641013][T11666] lo speed is unknown, defaulting to 1000 [ 260.131451][T11719] tipc: Cannot configure node identity twice [ 260.190464][T11721] netlink: 32 bytes leftover after parsing attributes in process `syz.0.1397'. [ 260.199853][T11700] lo speed is unknown, defaulting to 1000 [ 261.015510][T11743] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1403'. [ 261.034968][T11743] netlink: 'syz.2.1403': attribute type 5 has an invalid length. [ 261.085371][T11748] netlink: 'syz.2.1403': attribute type 1 has an invalid length. [ 261.093744][T11743] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1403'. [ 261.114542][T11747] netlink: 36 bytes leftover after parsing attributes in process `syz.4.1407'. [ 261.125082][T11747] netlink: 16 bytes leftover after parsing attributes in process `syz.4.1407'. [ 261.127471][T11746] 8021q: VLANs not supported on ip6tnl0 [ 261.138049][T11747] netlink: 36 bytes leftover after parsing attributes in process `syz.4.1407'. [ 261.150766][T11747] netlink: 36 bytes leftover after parsing attributes in process `syz.4.1407'. [ 261.496553][T11762] ip6gre1: entered allmulticast mode [ 261.858485][T11773] tipc: Enabled bearer , priority 0 [ 261.881360][T11773] syzkaller0: entered promiscuous mode [ 261.919689][T11773] syzkaller0: entered allmulticast mode [ 261.966691][T11773] tipc: Resetting bearer [ 262.061035][T11772] tipc: Resetting bearer [ 262.093124][T11772] tipc: Disabling bearer [ 262.234995][T11759] lo speed is unknown, defaulting to 1000 [ 262.255306][T11780] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 262.599752][ T55] block nbd4: Possible stuck request ffff888025617000: control (read@0,1024B). Runtime 90 seconds [ 262.610603][ T55] block nbd4: Possible stuck request ffff8880256171c0: control (read@1024,1024B). Runtime 90 seconds [ 262.630481][ T55] block nbd4: Possible stuck request ffff888025617380: control (read@2048,1024B). Runtime 90 seconds [ 262.641580][ T55] block nbd4: Possible stuck request ffff888025617540: control (read@3072,1024B). Runtime 90 seconds [ 263.366220][T11793] __nla_validate_parse: 3 callbacks suppressed [ 263.366240][T11793] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1419'. [ 263.500000][T11784] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 263.532808][T11779] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 263.674667][T11776] lo speed is unknown, defaulting to 1000 [ 263.754126][T11775] lo speed is unknown, defaulting to 1000 [ 264.803276][T11824] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1428'. [ 264.877684][T11826] netlink: 47 bytes leftover after parsing attributes in process `syz.3.1429'. [ 264.987857][T11180] nci: nci_add_new_protocol: the target found does not have the desired protocol [ 265.790657][T11855] netlink: 144 bytes leftover after parsing attributes in process `syz.4.1436'. [ 265.821037][T11855] netlink: 'syz.4.1436': attribute type 3 has an invalid length. [ 265.877955][T11855] infiniband syz0: RDMA CMA: cma_listen_on_dev, error -98 [ 265.914983][T11861] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 266.558931][T11875] lo speed is unknown, defaulting to 1000 [ 266.592481][T11877] netlink: 20 bytes leftover after parsing attributes in process `syz.2.1442'. [ 267.324400][T11907] A link change request failed with some changes committed already. Interface batadv_slave_1 may have been left with an inconsistent configuration, please check. [ 267.433967][T11907] A link change request failed with some changes committed already. Interface batadv_slave_1 may have been left with an inconsistent configuration, please check. [ 267.644169][T11901] lo speed is unknown, defaulting to 1000 [ 267.788747][T11937] vlan2: entered allmulticast mode [ 267.794918][T11937] bridge_slave_0: entered allmulticast mode [ 267.825776][T11939] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1458'. [ 267.902280][T11949] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1458'. [ 267.933513][T11939] IPVS: Unknown mcast interface: vcan0 [ 268.133608][T11178] nci: nci_rf_discover_ntf_packet: unsupported rf_tech_and_mode 0x4 [ 268.267950][T11975] netlink: 20 bytes leftover after parsing attributes in process `syz.2.1465'. [ 268.318750][T11975] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1465'. [ 268.362444][T11951] lo speed is unknown, defaulting to 1000 [ 268.717310][T11991] syzkaller0: entered promiscuous mode [ 268.723937][T11991] syzkaller0: entered allmulticast mode [ 268.732910][T11989] netlink: 16 bytes leftover after parsing attributes in process `syz.4.1470'. [ 269.145950][T11998] ip6gretap0: entered promiscuous mode [ 269.163127][ T5881] Bluetooth: hci5: command 0x041b tx timeout [ 269.177612][T11998] macsec0: entered promiscuous mode [ 269.191476][T11998] ip6gretap0: left promiscuous mode [ 269.222910][T12002] netlink: 'syz.3.1473': attribute type 13 has an invalid length. [ 269.235279][T12002] netlink: 'syz.3.1473': attribute type 17 has an invalid length. [ 269.340775][T12004] netlink: 'syz.4.1474': attribute type 2 has an invalid length. [ 269.348726][T12004] netlink: 119 bytes leftover after parsing attributes in process `syz.4.1474'. [ 269.368243][T12002] 8021q: adding VLAN 0 to HW filter on device bond0 [ 269.376755][T12002] 8021q: adding VLAN 0 to HW filter on device team0 [ 269.387813][T12002] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 269.528607][T12012] netlink: 332 bytes leftover after parsing attributes in process `syz.2.1477'. [ 269.538164][T12012] netlink: 104 bytes leftover after parsing attributes in process `syz.2.1477'. [ 269.548631][T12012] netlink: 32 bytes leftover after parsing attributes in process `syz.2.1477'. [ 269.724925][T12024] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1478'. [ 269.819621][T12017] delete_channel: no stack [ 270.020175][T12036] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1484'. [ 270.213088][T12030] lo speed is unknown, defaulting to 1000 [ 270.265939][T12047] netlink: 36 bytes leftover after parsing attributes in process `syz.0.1487'. [ 270.281484][T12045] xfrm0: entered promiscuous mode [ 270.289178][T12045] xfrm0: entered allmulticast mode [ 270.591494][T12058] netlink: 36 bytes leftover after parsing attributes in process `syz.4.1489'. [ 270.631596][T12058] netlink: 64 bytes leftover after parsing attributes in process `syz.4.1489'. [ 270.798302][T12045] lo speed is unknown, defaulting to 1000 [ 271.074702][T12073] netlink: 'syz.2.1493': attribute type 11 has an invalid length. [ 271.108918][T12073] IPVS: set_ctl: invalid protocol: 43 0.0.0.0:20002 [ 271.545604][T12100] sctp: [Deprecated]: syz.2.1500 (pid 12100) Use of struct sctp_assoc_value in delayed_ack socket option. [ 271.545604][T12100] Use struct sctp_sack_info instead [ 271.839622][T12098] lo speed is unknown, defaulting to 1000 [ 271.909696][ T55] block nbd4: Possible stuck request ffff888025617000: control (read@0,1024B). Runtime 99 seconds [ 271.920625][ T55] block nbd4: Possible stuck request ffff8880256171c0: control (read@1024,1024B). Runtime 99 seconds [ 271.932432][ T55] block nbd4: Possible stuck request ffff888025617380: control (read@2048,1024B). Runtime 99 seconds [ 271.945150][ T55] block nbd4: Possible stuck request ffff888025617540: control (read@3072,1024B). Runtime 99 seconds [ 272.238244][T12121] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 272.270065][T12134] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 272.405293][T12144] netlink: 'syz.2.1509': attribute type 1 has an invalid length. [ 272.583877][T12152] openvswitch: netlink: Message has 4 unknown bytes. [ 272.651321][T12124] lo speed is unknown, defaulting to 1000 [ 273.131657][T12174] veth0: entered promiscuous mode [ 273.283960][T12169] veth0: left promiscuous mode [ 273.754717][T12184] lo speed is unknown, defaulting to 1000 [ 273.780396][T12203] block nbd3: server does not support multiple connections per device. [ 273.790897][T12203] block nbd3: shutting down sockets [ 273.869129][T12209] __nla_validate_parse: 5 callbacks suppressed [ 273.869149][T12209] netlink: 20 bytes leftover after parsing attributes in process `syz.0.1529'. [ 274.033565][T12211] vlan1: entered promiscuous mode [ 274.049074][T12211] vlan1: entered allmulticast mode [ 274.055222][T12211] veth0_vlan: entered allmulticast mode [ 274.266478][T12197] lo speed is unknown, defaulting to 1000 [ 274.454799][T12228] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1534'. [ 274.491433][T12228] netlink: 'syz.3.1534': attribute type 10 has an invalid length. [ 275.093367][T12237] lo speed is unknown, defaulting to 1000 [ 275.494926][T12262] netlink: 164 bytes leftover after parsing attributes in process `syz.0.1541'. [ 275.528633][T12262] netlink: 164 bytes leftover after parsing attributes in process `syz.0.1541'. [ 275.545317][T12262] netlink: 60 bytes leftover after parsing attributes in process `syz.0.1541'. [ 275.874143][ T51] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 275.884823][ T51] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 275.894111][ T51] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 275.903116][ T51] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 275.913277][ T51] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 275.928675][T12271] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1544'. [ 276.079323][T12279] netlink: del zone limit has 8 unknown bytes [ 276.226353][T12281] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1547'. [ 276.245428][T12282] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1547'. [ 276.441951][T12272] lo speed is unknown, defaulting to 1000 [ 276.534040][T12296] netlink: 'syz.2.1551': attribute type 3 has an invalid length. [ 276.729522][T12272] chnl_net:caif_netlink_parms(): no params data found [ 276.940808][T12272] bridge0: port 1(bridge_slave_0) entered blocking state [ 276.958101][T12272] bridge0: port 1(bridge_slave_0) entered disabled state [ 276.979896][T12272] bridge_slave_0: entered allmulticast mode [ 276.993887][T12272] bridge_slave_0: entered promiscuous mode [ 277.017198][T12272] bridge0: port 2(bridge_slave_1) entered blocking state [ 277.026549][T12272] bridge0: port 2(bridge_slave_1) entered disabled state [ 277.035031][T12272] bridge_slave_1: entered allmulticast mode [ 277.052589][T12272] bridge_slave_1: entered promiscuous mode [ 277.173236][T12304] lo speed is unknown, defaulting to 1000 [ 277.321419][T12272] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 277.356903][T12272] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 277.546233][T12320] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 277.575418][T12272] team0: Port device team_slave_0 added [ 277.614334][T12272] team0: Port device team_slave_1 added [ 277.842920][T12272] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 277.870249][T12272] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 277.911357][T12334] netlink: 16 bytes leftover after parsing attributes in process `syz.4.1558'. [ 277.959680][ T5881] Bluetooth: hci6: command tx timeout [ 277.993711][T12272] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 278.069043][ T6571] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 278.110894][ T980] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 278.118983][ T6571] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 278.181418][T12272] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 278.189127][T12272] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 278.260159][ T980] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 278.288084][T12272] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 278.411755][ T980] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 278.531455][T12272] hsr_slave_0: entered promiscuous mode [ 278.588840][T12272] hsr_slave_1: entered promiscuous mode [ 278.647630][T12337] netlink: 'syz.3.1562': attribute type 1 has an invalid length. [ 278.736344][T12337] bond6 (unregistering): Released all slaves [ 278.768110][T12347] ieee802154 phy1 wpan1: encryption failed: -22 [ 278.785107][T12346] netlink: 788 bytes leftover after parsing attributes in process `syz.2.1563'. [ 279.191101][T12272] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 279.206470][T12272] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 279.237816][T12272] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 279.263738][T12356] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1566'. [ 279.280777][T12272] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 279.303864][T12346] IPVS: lblc: SCTP 172.20.20.187:0 - no destination available [ 279.515365][T12368] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1567'. [ 279.580632][T12368] hsr0: entered allmulticast mode [ 279.585709][T12368] hsr_slave_0: entered allmulticast mode [ 279.591603][T12368] hsr_slave_1: entered allmulticast mode [ 279.601317][T12368] netlink: 36 bytes leftover after parsing attributes in process `syz.3.1567'. [ 279.610995][T12368] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1567'. [ 279.701503][T12371] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci6/hci6:200/input7 [ 279.743934][T12272] 8021q: adding VLAN 0 to HW filter on device bond0 [ 279.821883][T12272] 8021q: adding VLAN 0 to HW filter on device team0 [ 279.874287][ T6571] bridge0: port 1(bridge_slave_0) entered blocking state [ 279.881481][ T6571] bridge0: port 1(bridge_slave_0) entered forwarding state [ 279.917659][T12377] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1570'. [ 279.923988][ T6571] bridge0: port 2(bridge_slave_1) entered blocking state [ 279.933847][ T6571] bridge0: port 2(bridge_slave_1) entered forwarding state [ 279.961202][T12377] netlink: 'syz.2.1570': attribute type 2 has an invalid length. [ 279.973495][T12377] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1570'. [ 280.000046][T12378] netlink: 'syz.2.1570': attribute type 2 has an invalid length. [ 280.039758][ T5881] Bluetooth: hci6: command tx timeout [ 280.292611][T12382] netlink: 'syz.2.1571': attribute type 1 has an invalid length. [ 280.575117][T12397] IPv6: NLM_F_CREATE should be specified when creating new route [ 280.580417][T12272] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 280.754109][T12390] lo speed is unknown, defaulting to 1000 [ 280.845966][T12403] netlink: 72 bytes leftover after parsing attributes in process `syz.4.1575'. [ 280.998923][T12407] netlink: 'syz.3.1576': attribute type 4 has an invalid length. [ 281.008076][ T55] block nbd4: Possible stuck request ffff888025617000: control (read@0,1024B). Runtime 108 seconds [ 281.019312][ T55] block nbd4: Possible stuck request ffff8880256171c0: control (read@1024,1024B). Runtime 108 seconds [ 281.030989][ T55] block nbd4: Possible stuck request ffff888025617380: control (read@2048,1024B). Runtime 108 seconds [ 281.043734][ T55] block nbd4: Possible stuck request ffff888025617540: control (read@3072,1024B). Runtime 108 seconds [ 281.050367][T12407] netlink: 'syz.3.1576': attribute type 4 has an invalid length. [ 281.268759][T12272] veth0_vlan: entered promiscuous mode [ 281.326677][T12272] veth1_vlan: entered promiscuous mode [ 281.424469][T12429] tipc: Enabled bearer , priority 0 [ 281.481837][T12429] syzkaller0: entered promiscuous mode [ 281.489071][T12435] netlink: 'syz.0.1584': attribute type 10 has an invalid length. [ 281.510650][T12429] syzkaller0: entered allmulticast mode [ 281.527620][T12435] bond0: (slave team0): Releasing backup interface [ 281.545676][T12435] team0: Cannot enslave team device to itself [ 281.704822][T12272] veth0_macvtap: entered promiscuous mode [ 281.739109][T12429] tipc: Resetting bearer [ 281.751230][T12426] tipc: Resetting bearer [ 281.773299][T12426] tipc: Disabling bearer [ 281.792605][T12272] veth1_macvtap: entered promiscuous mode [ 281.851433][T12272] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 281.883094][T12272] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 281.923622][T12452] netlink: 'syz.4.1589': attribute type 1 has an invalid length. [ 281.953032][T12452] netlink: 'syz.4.1589': attribute type 2 has an invalid length. [ 281.987584][T11178] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 282.064507][T12458] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1590'. [ 282.091361][T12458] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1590'. [ 282.121299][ T5881] Bluetooth: hci6: command tx timeout [ 282.178684][T12451] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1588'. [ 282.220798][T11179] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 282.250069][T12447] lo speed is unknown, defaulting to 1000 [ 282.348445][T11179] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 282.369746][ C0] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 282.476655][T11179] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 282.765846][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 282.799548][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 282.990161][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 283.011960][T12497] syzkaller0: entered promiscuous mode [ 283.019607][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 283.020827][T12497] syzkaller0: entered allmulticast mode [ 283.436071][T12523] netlink: 'syz.3.1606': attribute type 1 has an invalid length. [ 283.761889][T12521] lo speed is unknown, defaulting to 1000 [ 283.992020][T12516] lo speed is unknown, defaulting to 1000 [ 284.199727][ T5881] Bluetooth: hci6: command tx timeout [ 284.247857][T12546] 8021q: VLANs not supported on ipvlan1 [ 284.306070][T12542] lo speed is unknown, defaulting to 1000 [ 284.794110][T12580] __nla_validate_parse: 7 callbacks suppressed [ 284.794130][T12580] netlink: 35 bytes leftover after parsing attributes in process `syz.4.1619'. [ 284.794466][T12567] veth0_to_bond: left allmulticast mode [ 284.821503][T12567] xfrm0: left promiscuous mode [ 284.826418][T12567] xfrm0: left allmulticast mode [ 284.833216][T12567] hsr0: left allmulticast mode [ 284.838144][T12567] hsr_slave_0: left allmulticast mode [ 284.846230][T12567] hsr_slave_1: left allmulticast mode [ 284.853692][T12567] vlan1: left promiscuous mode [ 284.858892][T12567] vlan1: left allmulticast mode [ 284.864346][T12567] veth0_vlan: left allmulticast mode [ 284.880348][T12567] geneve2: left promiscuous mode [ 284.885662][T12567] gtp0: left promiscuous mode [ 284.891337][T12567] gtp0: left allmulticast mode [ 284.897260][T12567] macvtap1: left allmulticast mode [ 284.903271][T12567] ip6gretap1: left promiscuous mode [ 284.913350][T12567] ip6gre1: left allmulticast mode [ 285.545093][ T30] audit: type=1800 audit(1759130372.440:2): pid=12602 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.1623" name="memory.events" dev="tmpfs" ino=1786 res=0 errno=0 [ 285.568000][ T30] audit: type=1804 audit(1759130372.450:3): pid=12602 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.2.1623" name="/newroot/344/memory.events" dev="tmpfs" ino=1786 res=1 errno=0 [ 285.621057][T12594] netdevsim netdevsim2 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 285.631769][T12594] netdevsim netdevsim2 eth3 (unregistering): unset [1, 0] type 2 family 0 port 20000 - 0 [ 285.974545][T12594] netdevsim netdevsim2 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 285.985121][T12594] netdevsim netdevsim2 eth2 (unregistering): unset [1, 0] type 2 family 0 port 20000 - 0 [ 286.007426][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 286.016315][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 286.081079][T12612] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1628'. [ 286.191982][T12594] netdevsim netdevsim2 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 286.229914][T12594] netdevsim netdevsim2 eth1 (unregistering): unset [1, 0] type 2 family 0 port 20000 - 0 [ 286.306279][T12594] netdevsim netdevsim2 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 286.320625][T12594] netdevsim netdevsim2 eth0 (unregistering): unset [1, 0] type 2 family 0 port 20000 - 0 [ 286.470130][T11180] netdevsim netdevsim2 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 286.491423][T11180] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 20000 - 0 [ 286.514855][T11180] netdevsim netdevsim2 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 286.524312][T11180] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 20000 - 0 [ 286.545225][T11180] netdevsim netdevsim2 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 286.563598][T11180] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 20000 - 0 [ 286.582453][T11180] netdevsim netdevsim2 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 286.621122][T11180] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 20000 - 0 [ 287.528496][T12653] lo speed is unknown, defaulting to 1000 [ 287.593130][T12696] netlink: 'syz.4.1645': attribute type 2 has an invalid length. [ 287.674771][T12696] : entered promiscuous mode [ 288.245913][T12684] lo speed is unknown, defaulting to 1000 [ 288.255777][T12654] lo speed is unknown, defaulting to 1000 [ 289.015349][T12732] netlink: 'syz.2.1654': attribute type 10 has an invalid length. [ 289.279580][T12743] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1659'. [ 289.280789][T12742] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 289.344782][T12746] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1659'. [ 289.631600][T12760] netlink: 'syz.0.1664': attribute type 1 has an invalid length. [ 289.663920][T12760] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1664'. [ 289.683229][T12760] A link change request failed with some changes committed already. Interface team0 may have been left with an inconsistent configuration, please check. [ 290.032658][T12780] netlink: 'syz.4.1669': attribute type 13 has an invalid length. [ 290.059612][ T55] block nbd4: Possible stuck request ffff888025617000: control (read@0,1024B). Runtime 117 seconds [ 290.060471][T12780] netlink: 'syz.4.1669': attribute type 17 has an invalid length. [ 290.070467][ T55] block nbd4: Possible stuck request ffff8880256171c0: control (read@1024,1024B). Runtime 117 seconds [ 290.070502][ T55] block nbd4: Possible stuck request ffff888025617380: control (read@2048,1024B). Runtime 117 seconds [ 290.078905][T12781] sctp: [Deprecated]: syz.6.1668 (pid 12781) Use of struct sctp_assoc_value in delayed_ack socket option. [ 290.078905][T12781] Use struct sctp_sack_info instead [ 290.089697][ T55] block nbd4: Possible stuck request ffff888025617540: control (read@3072,1024B). Runtime 117 seconds [ 290.472229][T12780] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 290.492277][T12783] (unnamed net_device) (uninitialized): option packets_per_slave: invalid value (1802723700) [ 290.509827][T12783] (unnamed net_device) (uninitialized): option packets_per_slave: allowed values 0 - 65535 [ 290.652319][T12789] netlink: 20 bytes leftover after parsing attributes in process `syz.6.1672'. [ 290.660039][T12787] (unnamed net_device) (uninitialized): option lacp_active: mode dependency failed, not supported in mode balance-rr(0) [ 290.686737][T12787] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1670'. [ 290.741286][T12787] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1670'. [ 290.834039][T12771] lo speed is unknown, defaulting to 1000 [ 290.856781][T12806] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1673'. [ 291.083559][ C0] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 291.392433][T12789] lo speed is unknown, defaulting to 1000 [ 291.517174][T12835] netlink: 'syz.0.1678': attribute type 10 has an invalid length. [ 291.728500][T12790] lo speed is unknown, defaulting to 1000 [ 291.906098][T12774] ip6tnl5: entered promiscuous mode [ 292.497683][T12861] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1686'. [ 292.517408][T12861] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1686'. [ 292.541696][T12861] netlink: 2 bytes leftover after parsing attributes in process `syz.4.1686'. [ 292.573991][T12864] netlink: 20 bytes leftover after parsing attributes in process `syz.3.1687'. [ 292.733050][T12873] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1689'. [ 292.788866][T12876] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1689'. [ 292.854629][T12874] syz_tun: entered allmulticast mode [ 293.061169][T12882] IPVS: wrr: UDP 224.0.0.2:0 - no destination available [ 293.132594][T12888] A link change request failed with some changes committed already. Interface team0 may have been left with an inconsistent configuration, please check. [ 293.246282][T12890] syzkaller0: entered promiscuous mode [ 293.252766][T12890] syzkaller0: entered allmulticast mode [ 293.645103][ T5881] Bluetooth: hci6: command tx timeout [ 293.891412][T12911] netlink: 'syz.3.1702': attribute type 1 has an invalid length. [ 294.604858][T12920] lo speed is unknown, defaulting to 1000 [ 295.768720][T12947] lo speed is unknown, defaulting to 1000 [ 296.460730][T12961] lo speed is unknown, defaulting to 1000 [ 296.582154][T12960] lo speed is unknown, defaulting to 1000 [ 296.751400][T12983] 8021q: adding VLAN 0 to HW filter on device bond5 [ 296.837545][T12986] macvlan0: entered promiscuous mode [ 296.851780][T12986] macvlan0: entered allmulticast mode [ 296.859170][T12986] veth0: entered allmulticast mode [ 296.864940][T12986] veth0: entered promiscuous mode [ 296.883474][T12986] bond5: (slave macvlan0): making interface the new active one [ 296.895252][T12986] bond5: (slave macvlan0): Enslaving as an active interface with an up link [ 297.384089][T12984] lo speed is unknown, defaulting to 1000 [ 298.617492][T13015] netlink: 'syz.0.1727': attribute type 1 has an invalid length. [ 298.648685][T13015] 8021q: adding VLAN 0 to HW filter on device bond6 [ 298.665665][T13015] __nla_validate_parse: 17 callbacks suppressed [ 298.665687][T13015] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1727'. [ 298.699550][T13015] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1727'. [ 298.771512][T13018] veth9: entered promiscuous mode [ 298.794625][T13018] bond6: (slave veth9): Enslaving as an active interface with a down link [ 298.857260][T13027] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1730'. [ 298.868386][T13020] syzkaller0: entered promiscuous mode [ 298.876217][T13020] syzkaller0: entered allmulticast mode [ 298.886144][T13025] tipc: Started in network mode [ 298.907207][T13025] tipc: Node identity b65af4c7c446, cluster identity 4711 [ 298.946454][T13025] tipc: Enabled bearer , priority 0 [ 298.974372][T13032] pim6reg: entered allmulticast mode [ 299.041220][T13025] tipc: Resetting bearer [ 299.079896][ T55] block nbd4: Possible stuck request ffff888025617000: control (read@0,1024B). Runtime 126 seconds [ 299.090740][ T55] block nbd4: Possible stuck request ffff8880256171c0: control (read@1024,1024B). Runtime 126 seconds [ 299.117165][ T55] block nbd4: Possible stuck request ffff888025617380: control (read@2048,1024B). Runtime 126 seconds [ 299.139714][ T55] block nbd4: Possible stuck request ffff888025617540: control (read@3072,1024B). Runtime 126 seconds [ 299.176711][T13025] tipc: Disabling bearer [ 299.305322][T13055] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 299.312625][T13055] IPv6: NLM_F_CREATE should be set when creating new route [ 299.320003][T13055] IPv6: NLM_F_CREATE should be set when creating new route [ 299.327246][T13055] IPv6: NLM_F_CREATE should be set when creating new route [ 299.358130][T13055] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 299.375383][T13055] netlink: 16 bytes leftover after parsing attributes in process `syz.4.1739'. [ 299.384820][T13055] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1739'. [ 299.408548][T13057] pimreg3: entered allmulticast mode [ 299.414329][T13055] vdth0_virt_wifi: renamed from veth1_vlan [ 299.530987][T13063] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1742'. [ 299.559677][T13063] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1742'. [ 299.581754][T13063] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1742'. [ 299.603570][T13063] tipc: Enabling of bearer rejected, failed to enable media [ 299.822822][T13090] netlink: 'syz.6.1746': attribute type 21 has an invalid length. [ 299.849671][T13090] netlink: 156 bytes leftover after parsing attributes in process `syz.6.1746'. [ 300.579074][T13130] netlink: 'syz.6.1760': attribute type 30 has an invalid length. [ 300.630969][ T10] hid-generic 0005:16BF:5505.0002: unknown main item tag 0x0 [ 300.638400][ T10] hid-generic 0005:16BF:5505.0002: unknown main item tag 0x0 [ 300.727865][T13122] lo speed is unknown, defaulting to 1000 [ 300.733498][ T10] hid-generic 0005:16BF:5505.0002: hidraw0: BLUETOOTH HID vc3.b8 Device [syz0] on aa:aa:aa:aa:aa:aa [ 301.179334][T13153] netlink: 'syz.6.1764': attribute type 10 has an invalid length. [ 301.195178][T13151] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 301.225703][T13155] netlink: 1 bytes leftover after parsing attributes in process `syz.3.1765'. [ 301.255604][ T24] lo speed is unknown, defaulting to 1000 [ 301.295943][T13153] team0: Port device netdevsim0 added [ 301.381032][T13163] vlan5: entered promiscuous mode [ 301.406748][T13163] geneve1: entered promiscuous mode [ 301.427704][T13163] vlan5: entered allmulticast mode [ 301.442555][T13163] geneve1: entered allmulticast mode [ 302.201284][T13167] lo speed is unknown, defaulting to 1000 [ 302.366683][T13188] lo speed is unknown, defaulting to 1000 [ 303.570328][T13200] lo speed is unknown, defaulting to 1000 [ 304.027619][T13229] __nla_validate_parse: 3 callbacks suppressed [ 304.027652][T13229] netlink: 32 bytes leftover after parsing attributes in process `syz.6.1781'. [ 304.153834][T13232] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1783'. [ 304.201123][T13232] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1783'. [ 305.611288][T13241] lo speed is unknown, defaulting to 1000 [ 305.736097][T13267] netlink: 'syz.3.1793': attribute type 1 has an invalid length. [ 305.849622][T13267] 8021q: adding VLAN 0 to HW filter on device bond6 [ 305.963646][T13269] 8021q: adding VLAN 0 to HW filter on device bond6 [ 305.980074][T13269] bond6: (slave vxcan3): The slave device specified does not support setting the MAC address [ 306.041260][T13269] bond6: (slave vxcan3): Error -95 calling set_mac_address [ 306.310602][T13270] veth11: entered promiscuous mode [ 306.445493][T13245] lo speed is unknown, defaulting to 1000 [ 306.497745][T13280] atomic_op ffff88804d8b7998 conn xmit_atomic 0000000000000000 [ 306.513128][T13282] netlink: 'syz.2.1795': attribute type 1 has an invalid length. [ 306.533747][T13280] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1796'. [ 306.675344][T13282] 8021q: adding VLAN 0 to HW filter on device bond2 [ 306.762484][T13290] netlink: 20 bytes leftover after parsing attributes in process `syz.3.1797'. [ 306.776139][T13290] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1797'. [ 307.363882][T13314] bond1: entered promiscuous mode [ 307.486250][T13324] netlink: 24 bytes leftover after parsing attributes in process `syz.4.1810'. [ 307.582007][T13332] netlink: 44 bytes leftover after parsing attributes in process `syz.0.1811'. [ 307.600901][T13322] netlink: 8 bytes leftover after parsing attributes in process `syz.6.1809'. [ 307.614358][T13328] netlink: 44 bytes leftover after parsing attributes in process `syz.0.1811'. [ 308.026972][T13329] lo speed is unknown, defaulting to 1000 [ 308.359708][ C0] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 308.367608][ T55] block nbd4: Possible stuck request ffff888025617000: control (read@0,1024B). Runtime 135 seconds [ 308.378731][ T55] block nbd4: Possible stuck request ffff8880256171c0: control (read@1024,1024B). Runtime 135 seconds [ 308.392830][ T55] block nbd4: Possible stuck request ffff888025617380: control (read@2048,1024B). Runtime 135 seconds [ 308.403909][ T55] block nbd4: Possible stuck request ffff888025617540: control (read@3072,1024B). Runtime 135 seconds [ 308.659003][T13373] syz_tun: entered allmulticast mode [ 308.674821][T13373] dvmrp8: entered allmulticast mode [ 308.748113][T13375] netlink: 'syz.6.1818': attribute type 23 has an invalid length. [ 308.860453][T13356] netlink: 'syz.0.1816': attribute type 10 has an invalid length. [ 308.869016][T13377] netlink: 'syz.0.1816': attribute type 10 has an invalid length. [ 309.116371][T13386] netlink: 'syz.0.1819': attribute type 13 has an invalid length. [ 309.160355][ T51] Bluetooth: hci4: command 0x0405 tx timeout [ 309.191199][T13386] ip6gretap0: left promiscuous mode [ 309.220226][T13386] veth0: left allmulticast mode [ 309.225249][T13386] veth0: left promiscuous mode [ 309.503170][T13401] ieee802154 phy1 wpan1: encryption failed: -22 [ 309.595938][T13340] lo speed is unknown, defaulting to 1000 [ 309.609230][T13331] lo speed is unknown, defaulting to 1000 [ 309.645443][T13337] lo speed is unknown, defaulting to 1000 [ 309.862690][T13408] vlan0: entered promiscuous mode [ 309.867830][T13408] bond0: entered promiscuous mode [ 309.873490][T13408] bond_slave_0: entered promiscuous mode [ 309.885796][T13408] bond_slave_1: entered promiscuous mode [ 309.911003][T13412] geneve4: entered promiscuous mode [ 309.924620][ T13] netdevsim netdevsim2 eth0: set [1, 1] type 2 family 0 port 6081 - 0 [ 309.939061][ T13] netdevsim netdevsim2 eth1: set [1, 1] type 2 family 0 port 6081 - 0 [ 310.120520][T13418] __nla_validate_parse: 2 callbacks suppressed [ 310.120541][T13418] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1825'. [ 310.313818][T13373] lo speed is unknown, defaulting to 1000 [ 310.313842][ T13] netdevsim netdevsim2 eth2: set [1, 1] type 2 family 0 port 6081 - 0 [ 310.375856][ T13] netdevsim netdevsim2 eth3: set [1, 1] type 2 family 0 port 6081 - 0 [ 311.257488][T13431] rdma_rxe: rxe_newlink: failed to add vxcan1 [ 311.278272][T13433] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1831'. [ 311.297516][T13433] netlink: 32 bytes leftover after parsing attributes in process `syz.3.1831'. [ 311.456475][T13438] netlink: 84 bytes leftover after parsing attributes in process `syz.2.1833'. [ 311.477384][T13435] netlink: 184 bytes leftover after parsing attributes in process `syz.3.1832'. [ 311.764649][T13458] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1839'. [ 311.964200][T13461] netlink: 'syz.0.1840': attribute type 64 has an invalid length. [ 311.974506][T13465] netlink: 20 bytes leftover after parsing attributes in process `syz.4.1842'. [ 312.415259][T13474] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1845'. [ 312.552349][T13454] lo speed is unknown, defaulting to 1000 [ 312.824207][T13484] bond0: (slave wlan1): Releasing backup interface [ 312.892066][T13484] bridge: RTM_NEWNEIGH bridge0 without NUD_PERMANENT [ 312.987474][T13464] lo speed is unknown, defaulting to 1000 [ 313.490006][T13507] netlink: 32 bytes leftover after parsing attributes in process `syz.6.1854'. [ 313.557061][T13502] netlink: 36 bytes leftover after parsing attributes in process `syz.2.1853'. [ 313.647992][T13512] netlink: 'syz.6.1857': attribute type 1 has an invalid length. [ 313.767656][T13515] tipc: Enabled bearer , priority 10 [ 313.970011][T13531] siw: device registration error -23 [ 313.979318][T13529] siw: device registration error -23 [ 314.725315][T13540] lo speed is unknown, defaulting to 1000 [ 314.881685][ T6084] tipc: Node number set to 855672178 [ 314.977281][T13570] delete_channel: no stack [ 315.116597][T13567] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 315.410612][T13585] 8021q: VLANs not supported on bond0 [ 315.825435][T13605] batadv1: entered promiscuous mode [ 316.336516][T13623] 8021q: adding VLAN 0 to HW filter on device ipvlan2 [ 316.376860][T13632] netlink: 'syz.4.1891': attribute type 10 has an invalid length. [ 316.390522][T13632] bridge0: port 4(dummy0) entered disabled state [ 316.404472][T13632] dummy0: left allmulticast mode [ 316.410385][T13632] dummy0: left promiscuous mode [ 316.421558][T13632] bridge0: port 4(dummy0) entered disabled state [ 316.435289][T13634] netlink: 'syz.4.1891': attribute type 10 has an invalid length. [ 316.451938][T13632] team0: Port device dummy0 added [ 316.467734][T13627] 8021q: adding VLAN 0 to HW filter on device ipvlan2 [ 316.514883][T13634] team0: Port device dummy0 removed [ 316.533890][T13634] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 316.609879][T13636] 8021q: adding VLAN 0 to HW filter on device bond7 [ 316.646714][T13638] macvlan1: entered promiscuous mode [ 316.652506][T13638] macvlan1: entered allmulticast mode [ 316.659024][T13638] bond7: entered promiscuous mode [ 316.665662][T13638] 8021q: adding VLAN 0 to HW filter on device macvlan1 [ 316.675191][T13638] bond7: left promiscuous mode [ 316.724590][T13650] __nla_validate_parse: 7 callbacks suppressed [ 316.724610][T13650] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1895'. [ 316.742976][T13648] sctp: [Deprecated]: syz.6.1894 (pid 13648) Use of int in maxseg socket option. [ 316.742976][T13648] Use struct sctp_assoc_value instead [ 316.784120][T13653] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1895'. [ 316.991850][T13659] vlan1: entered allmulticast mode [ 316.997211][T13659] bridge_slave_0: entered allmulticast mode [ 317.113368][T13640] lo speed is unknown, defaulting to 1000 [ 317.256091][T13679] netlink: 248 bytes leftover after parsing attributes in process `syz.3.1902'. [ 317.284837][T13683] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1901'. [ 317.322660][T13683] netlink: 'syz.4.1901': attribute type 1 has an invalid length. [ 317.331390][ T1301] ieee802154 phy1 wpan1: encryption failed: -22 [ 317.340053][T13683] netlink: 'syz.4.1901': attribute type 2 has an invalid length. [ 317.342210][ T1301] clip:clip_start_xmit: skb_dst(skb) == NULL [ 317.411216][ T55] block nbd4: Possible stuck request ffff888025617000: control (read@0,1024B). Runtime 144 seconds [ 317.422143][ T55] block nbd4: Possible stuck request ffff8880256171c0: control (read@1024,1024B). Runtime 144 seconds [ 317.433223][ T55] block nbd4: Possible stuck request ffff888025617380: control (read@2048,1024B). Runtime 144 seconds [ 317.444609][ T55] block nbd4: Possible stuck request ffff888025617540: control (read@3072,1024B). Runtime 144 seconds [ 317.538279][T13690] netlink: 'syz.4.1906': attribute type 2 has an invalid length. [ 317.564684][T13690] netlink: 'syz.4.1906': attribute type 1 has an invalid length. [ 317.582157][T13690] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1906'. [ 317.680798][T13703] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1904'. [ 317.846726][T13706] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1910'. [ 317.976191][T13708] dvmrp1: tun_chr_ioctl cmd 1074025677 [ 317.982056][T13708] dvmrp1: linktype set to 773 [ 318.244467][T13719] netlink: 4 bytes leftover after parsing attributes in process `syz.6.1914'. [ 318.302565][T13722] netlink: 8 bytes leftover after parsing attributes in process `syz.6.1914'. [ 318.497594][T13726] netlink: 28 bytes leftover after parsing attributes in process `syz.2.1916'. [ 318.616866][T13737] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 318.730268][T13737] tipc: Enabling of bearer rejected, failed to enable media [ 318.784898][T13744] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 319.067447][T13754] pim6reg1: entered promiscuous mode [ 319.081933][T13754] pim6reg1: entered allmulticast mode [ 319.095094][T13756] batadv_slave_0: entered promiscuous mode [ 319.371162][T13766] netlink: 'syz.2.1925': attribute type 3 has an invalid length. [ 319.379272][T13766] netlink: 'syz.2.1925': attribute type 1 has an invalid length. [ 319.748996][T13786] 8021q: adding VLAN 0 to HW filter on device bond2 [ 319.791992][T13786] bond2: entered promiscuous mode [ 320.344149][T13823] syzkaller1: entered promiscuous mode [ 320.354828][T13823] syzkaller1: entered allmulticast mode [ 320.871118][T13846] tipc: Invalid UDP bearer configuration [ 320.871160][T13846] tipc: Enabling of bearer rejected, failed to enable media [ 320.892114][T13833] lo speed is unknown, defaulting to 1000 [ 321.170250][T13857] netlink: 'syz.6.1953': attribute type 2 has an invalid length. [ 321.529635][T13873] pim6reg: left allmulticast mode [ 321.676069][T13882] pimreg3: entered allmulticast mode [ 322.253119][T13926] IPVS: length: 30 != 24 [ 322.313496][T13931] __nla_validate_parse: 17 callbacks suppressed [ 322.313513][T13931] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1975'. [ 322.436459][T13931] bridge0: port 1(erspan0) entered blocking state [ 322.445324][T13931] bridge0: port 1(erspan0) entered disabled state [ 322.470178][T13931] erspan0: entered allmulticast mode [ 322.499071][T13931] erspan0: entered promiscuous mode [ 322.530479][T13944] erspan0: left allmulticast mode [ 322.535539][T13944] erspan0: left promiscuous mode [ 322.543170][T13944] bridge0: port 1(erspan0) entered disabled state [ 322.717085][T13947] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1978'. [ 322.763633][T13950] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1979'. [ 322.916081][T13955] netlink: 277 bytes leftover after parsing attributes in process `syz.0.1980'. [ 322.942705][T13958] netlink: 56 bytes leftover after parsing attributes in process `syz.2.1981'. [ 322.966336][T13958] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1981'. [ 323.045022][T13938] lo speed is unknown, defaulting to 1000 [ 323.368736][T13973] netlink: 60 bytes leftover after parsing attributes in process `syz.2.1986'. [ 323.394297][T13976] netlink: 60 bytes leftover after parsing attributes in process `syz.2.1986'. [ 323.406960][T13973] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1986'. [ 323.439269][T13979] Bluetooth: hci0: Opcode 0x080f failed: -22 [ 323.562293][ T12] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 323.587983][ T12] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 323.598940][ T6084] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 323.765037][T13995] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1989'. [ 323.817014][T13996] ªªªªªª: renamed from wg2 [ 323.996820][T14004] netlink: 'syz.3.1994': attribute type 1 has an invalid length. [ 324.083624][ T6084] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 324.130257][ T6084] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 324.355635][T14027] netlink: 'syz.3.2000': attribute type 2 has an invalid length. [ 324.770615][T14016] lo speed is unknown, defaulting to 1000 [ 325.483390][ T51] Bluetooth: hci0: command tx timeout [ 325.568393][T14055] lo speed is unknown, defaulting to 1000 [ 325.611773][T14013] lo speed is unknown, defaulting to 1000 [ 325.640240][ T31] INFO: task syz.1.578:8431 blocked for more than 143 seconds. [ 325.688684][ T31] Not tainted syzkaller #0 [ 325.701499][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 325.717967][ T31] task:syz.1.578 state:D stack:25864 pid:8431 tgid:8421 ppid:5865 task_flags:0x400140 flags:0x00004004 [ 325.753467][ T31] Call Trace: [ 325.760932][ T31] [ 325.764867][ T31] __schedule+0x1798/0x4cc0 [ 325.774734][ T31] ? __lock_acquire+0xab9/0xd20 [ 325.780379][ T31] ? __lock_acquire+0xab9/0xd20 [ 325.785451][ T31] ? __pfx___schedule+0x10/0x10 [ 325.791327][ T31] ? schedule+0x91/0x360 [ 325.795755][ T31] schedule+0x165/0x360 [ 325.802995][ T31] schedule_preempt_disabled+0x13/0x30 [ 325.808639][ T31] __mutex_lock+0x7e6/0x1350 [ 325.817093][ T31] ? __mutex_lock+0x5bb/0x1350 [ 325.822882][ T31] ? nfsd_nl_listener_set_doit+0x137/0x1690 [ 325.828965][ T31] ? __pfx___mutex_lock+0x10/0x10 [ 325.834635][ T31] ? __asan_memset+0x22/0x50 [ 325.841345][ T31] ? ____sys_sendmsg+0x505/0x830 [ 325.846477][ T31] ? ___sys_sendmsg+0x21f/0x2a0 [ 325.851896][ T31] ? __x64_sys_sendmsg+0x19b/0x260 [ 325.857540][ T31] nfsd_nl_listener_set_doit+0x137/0x1690 [ 325.865855][ T31] ? __pfx___nla_validate_parse+0x10/0x10 [ 325.872492][ T31] ? __pfx_nfsd_nl_listener_set_doit+0x10/0x10 [ 325.878844][ T31] ? __nla_parse+0x40/0x60 [ 325.884555][ T31] ? genl_family_rcv_msg_attrs_parse+0x1c9/0x2a0 [ 325.891794][ T31] genl_family_rcv_msg_doit+0x215/0x300 [ 325.897555][ T31] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 325.905961][ T31] ? bpf_lsm_capable+0x9/0x20 [ 325.913021][ T31] ? security_capable+0x7e/0x2e0 [ 325.918164][ T31] genl_rcv_msg+0x60e/0x790 [ 325.923765][ T31] ? __pfx_genl_rcv_msg+0x10/0x10 [ 325.929024][ T31] ? __pfx_nfsd_nl_listener_set_doit+0x10/0x10 [ 325.936306][ T31] netlink_rcv_skb+0x205/0x470 [ 325.942633][ T31] ? __lock_acquire+0xab9/0xd20 [ 325.947695][ T31] ? __pfx_genl_rcv_msg+0x10/0x10 [ 325.954012][ T31] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 325.960947][ T31] ? down_read+0x1ad/0x2e0 [ 325.965473][ T31] genl_rcv+0x28/0x40 [ 325.969966][ T31] netlink_unicast+0x82f/0x9e0 [ 325.974737][ T31] ? __pfx_netlink_unicast+0x10/0x10 [ 325.980687][ T31] ? netlink_sendmsg+0x642/0xb30 [ 325.985648][ T31] ? skb_put+0x11b/0x210 [ 325.990407][ T31] netlink_sendmsg+0x805/0xb30 [ 325.995201][ T31] ? __pfx_netlink_sendmsg+0x10/0x10 [ 326.001031][ T31] ? aa_sock_msg_perm+0xf1/0x1d0 [ 326.005995][ T31] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 326.011825][ T31] ? __pfx_netlink_sendmsg+0x10/0x10 [ 326.017107][ T31] __sock_sendmsg+0x21c/0x270 [ 326.022262][ T31] ____sys_sendmsg+0x505/0x830 [ 326.027038][ T31] ? __pfx_____sys_sendmsg+0x10/0x10 [ 326.032574][ T31] ? import_iovec+0x74/0xa0 [ 326.037100][ T31] ___sys_sendmsg+0x21f/0x2a0 [ 326.042107][ T31] ? __pfx____sys_sendmsg+0x10/0x10 [ 326.047530][ T31] ? __fget_files+0x2a/0x420 [ 326.052820][ T31] ? __fget_files+0x3a0/0x420 [ 326.057569][ T31] __x64_sys_sendmsg+0x19b/0x260 [ 326.063385][ T31] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 326.068871][ T31] ? rcu_is_watching+0x15/0xb0 [ 326.074238][ T31] ? do_syscall_64+0xbe/0x3b0 [ 326.078919][ T31] do_syscall_64+0xfa/0x3b0 [ 326.083992][ T31] ? lockdep_hardirqs_on+0x9c/0x150 [ 326.089204][ T31] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 326.095793][ T31] ? clear_bhb_loop+0x60/0xb0 [ 326.100978][ T31] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 326.106875][ T31] RIP: 0033:0x7f785198eec9 [ 326.111780][ T31] RSP: 002b:00007f785282a038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 326.121055][ T31] RAX: ffffffffffffffda RBX: 00007f7851be6090 RCX: 00007f785198eec9 [ 326.129166][ T31] RDX: 0000000000000000 RSI: 0000200000000040 RDI: 000000000000000c [ 326.137560][ T31] RBP: 00007f7851a11f91 R08: 0000000000000000 R09: 0000000000000000 [ 326.146461][ T31] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 326.154866][ T31] R13: 00007f7851be6128 R14: 00007f7851be6090 R15: 00007fff96f2caf8 [ 326.163338][ T31] [ 326.166509][ T31] [ 326.166509][ T31] Showing all locks held in the system: [ 326.181147][ T31] 7 locks held by kworker/u8:0/12: [ 326.192816][ T31] 1 lock held by khungtaskd/31: [ 326.199332][T14079] netlink: 'syz.3.2013': attribute type 29 has an invalid length. [ 326.208056][ T31] #0: ffffffff8e13a0e0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 [ 326.219191][ T31] 2 locks held by getty/5624: [ 326.224504][ T31] #0: ffff88814e24e0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 [ 326.237498][ T31] #1: ffffc900036bb2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x43e/0x1400 [ 326.248388][ T31] 1 lock held by udevd/5879: [ 326.253477][ T31] #0: ffff8881433a9358 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_open+0xe0/0xd30 [ 326.263505][ T31] 2 locks held by syz.1.578/8423: [ 326.268537][ T31] #0: ffffffff8f5a08d0 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 [ 326.277220][ T31] #1: ffffffff8e418b48 (nfsd_mutex){+.+.}-{4:4}, at: nfsd_nl_listener_set_doit+0x137/0x1690 [ 326.288168][ T31] 2 locks held by syz.1.578/8431: [ 326.293931][ T31] #0: ffffffff8f5a08d0 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 [ 326.302614][ T31] #1: ffffffff8e418b48 (nfsd_mutex){+.+.}-{4:4}, at: nfsd_nl_listener_set_doit+0x137/0x1690 [ 326.313268][ T31] 4 locks held by kworker/u8:22/11177: [ 326.318731][ T31] #0: ffff88801b2fe948 ((wq_completion)netns){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x17b0 [ 326.330147][ T31] #1: ffffc90004b97bc0 (net_cleanup_work){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x17b0 [ 326.340988][ T31] #2: ffffffff8f52df10 (pernet_ops_rwsem){++++}-{4:4}, at: cleanup_net+0xf7/0x800 [ 326.350707][ T31] #3: ffffffff8f53adc8 (rtnl_mutex){+.+.}-{4:4}, at: default_device_exit_batch+0xdc/0x890 [ 326.361117][ T31] 2 locks held by syz.5.1394/11709: [ 326.366306][ T31] #0: ffffffff8f5a08d0 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 [ 326.374943][ T31] #1: ffffffff8e418b48 (nfsd_mutex){+.+.}-{4:4}, at: nfsd_nl_listener_set_doit+0x137/0x1690 [ 326.385502][ T31] 2 locks held by syz.0.1996/14013: [ 326.391101][ T31] #0: ffffffff8f52df10 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x304/0x4d0 [ 326.401294][ T31] #1: ffffffff8f53adc8 (rtnl_mutex){+.+.}-{4:4}, at: ip_tunnel_init_net+0x2ab/0x800 [ 326.411429][ T31] 3 locks held by syz.4.2006/14055: [ 326.416639][ T31] #0: ffffffff8f52df10 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x304/0x4d0 [ 326.426626][ T31] #1: ffffffff8f53adc8 (rtnl_mutex){+.+.}-{4:4}, at: ops_undo_list+0x2a4/0x990 [ 326.436134][ T31] #2: ffffffff8e13fb78 (rcu_state.exp_mutex){+.+.}-{4:4}, at: synchronize_rcu_expedited+0x2f6/0x730 [ 326.447769][ T55] block nbd4: Possible stuck request ffff888025617000: control (read@0,1024B). Runtime 153 seconds [ 326.459281][ T55] block nbd4: Possible stuck request ffff8880256171c0: control (read@1024,1024B). Runtime 153 seconds [ 326.470336][ T55] block nbd4: Possible stuck request ffff888025617380: control (read@2048,1024B). Runtime 153 seconds [ 326.482687][ T31] [ 326.485024][ T31] ============================================= [ 326.485024][ T31] [ 326.494136][ T55] block nbd4: Possible stuck request ffff888025617540: control (read@3072,1024B). Runtime 153 seconds [ 326.505638][ T31] NMI backtrace for cpu 0 [ 326.505662][ T31] CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) [ 326.505684][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 326.505695][ T31] Call Trace: [ 326.505703][ T31] [ 326.505712][ T31] dump_stack_lvl+0x189/0x250 [ 326.505742][ T31] ? __pfx_dump_stack_lvl+0x10/0x10 [ 326.505764][ T31] ? __pfx__printk+0x10/0x10 [ 326.505801][ T31] nmi_cpu_backtrace+0x39e/0x3d0 [ 326.505834][ T31] ? __pfx_nmi_cpu_backtrace+0x10/0x10 [ 326.505865][ T31] ? __pfx__printk+0x10/0x10 [ 326.505895][ T31] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 326.505926][ T31] nmi_trigger_cpumask_backtrace+0x17a/0x300 [ 326.505958][ T31] watchdog+0xf93/0xfe0 [ 326.505988][ T31] ? watchdog+0x1de/0xfe0 [ 326.506020][ T31] kthread+0x70e/0x8a0 [ 326.506045][ T31] ? __pfx_watchdog+0x10/0x10 [ 326.506069][ T31] ? __pfx_kthread+0x10/0x10 [ 326.506093][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 326.506112][ T31] ? lockdep_hardirqs_on+0x9c/0x150 [ 326.506131][ T31] ? __pfx_kthread+0x10/0x10 [ 326.506153][ T31] ret_from_fork+0x439/0x7d0 [ 326.506174][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 326.506199][ T31] ? __switch_to_asm+0x39/0x70 [ 326.506221][ T31] ? __switch_to_asm+0x33/0x70 [ 326.506243][ T31] ? __pfx_kthread+0x10/0x10 [ 326.506266][ T31] ret_from_fork_asm+0x1a/0x30 [ 326.506306][ T31] [ 326.506313][ T31] Sending NMI from CPU 0 to CPUs 1: [ 326.660834][ C1] NMI backtrace for cpu 1 [ 326.660853][ C1] CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Not tainted syzkaller #0 PREEMPT(full) [ 326.660872][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 326.660882][ C1] RIP: 0010:pv_native_safe_halt+0x13/0x20 [ 326.660905][ C1] Code: 53 e8 02 00 cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d b3 59 14 00 f3 0f 1e fa fb f4 cc cc cc cc cc cc cc cc cc cc cc cc 90 90 90 90 90 90 90 90 90 [ 326.660925][ C1] RSP: 0018:ffffc90000197de0 EFLAGS: 000002c2 [ 326.660941][ C1] RAX: a2e58e8aafd2c600 RBX: ffffffff81968528 RCX: a2e58e8aafd2c600 [ 326.660954][ C1] RDX: 0000000000000001 RSI: ffffffff8d9b1ac6 RDI: ffffffff8be33f80 [ 326.660965][ C1] RBP: ffffc90000197f20 R08: ffff8880b8732f9b R09: 1ffff110170e65f3 [ 326.660978][ C1] R10: dffffc0000000000 R11: ffffed10170e65f4 R12: ffffffff8fa30630 [ 326.660990][ C1] R13: 0000000000000001 R14: 0000000000000001 R15: 1ffff110039d5b40 [ 326.661001][ C1] FS: 0000000000000000(0000) GS:ffff888125d39000(0000) knlGS:0000000000000000 [ 326.661015][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 326.661026][ C1] CR2: 0000000000000000 CR3: 000000007c524000 CR4: 00000000003526f0 [ 326.661040][ C1] Call Trace: [ 326.661046][ C1] [ 326.661052][ C1] default_idle+0x13/0x20 [ 326.661072][ C1] default_idle_call+0x74/0xb0 [ 326.661093][ C1] do_idle+0x1e8/0x510 [ 326.661120][ C1] ? __pfx_do_idle+0x10/0x10 [ 326.661149][ C1] ? do_idle+0xa/0x510 [ 326.661173][ C1] cpu_startup_entry+0x44/0x60 [ 326.661196][ C1] start_secondary+0x101/0x110 [ 326.661219][ C1] common_startup_64+0x13e/0x147 [ 326.661246][ C1] [ 326.664602][ T31] Kernel panic - not syncing: hung_task: blocked tasks [ 326.834860][ T31] CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) [ 326.844054][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 326.854108][ T31] Call Trace: [ 326.857383][ T31] [ 326.860308][ T31] dump_stack_lvl+0x99/0x250 [ 326.864901][ T31] ? __asan_memcpy+0x40/0x70 [ 326.869488][ T31] ? __pfx_dump_stack_lvl+0x10/0x10 [ 326.874691][ T31] ? __pfx__printk+0x10/0x10 [ 326.879291][ T31] vpanic+0x281/0x750 [ 326.883346][ T31] ? __pfx_vpanic+0x10/0x10 [ 326.887841][ T31] ? __x2apic_send_IPI_mask+0x1e4/0x260 [ 326.893380][ T31] ? preempt_schedule+0xae/0xc0 [ 326.898224][ T31] ? preempt_schedule_common+0x83/0xd0 [ 326.903681][ T31] panic+0xb9/0xc0 [ 326.907401][ T31] ? __pfx_panic+0x10/0x10 [ 326.911818][ T31] ? preempt_schedule_thunk+0x16/0x30 [ 326.917190][ T31] ? nmi_trigger_cpumask_backtrace+0x2bb/0x300 [ 326.923349][ T31] watchdog+0xfd2/0xfe0 [ 326.927503][ T31] ? watchdog+0x1de/0xfe0 [ 326.931859][ T31] kthread+0x70e/0x8a0 [ 326.935929][ T31] ? __pfx_watchdog+0x10/0x10 [ 326.940607][ T31] ? __pfx_kthread+0x10/0x10 [ 326.945193][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 326.950391][ T31] ? lockdep_hardirqs_on+0x9c/0x150 [ 326.955606][ T31] ? __pfx_kthread+0x10/0x10 [ 326.960215][ T31] ret_from_fork+0x439/0x7d0 [ 326.964812][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 326.969923][ T31] ? __switch_to_asm+0x39/0x70 [ 326.974682][ T31] ? __switch_to_asm+0x33/0x70 [ 326.979438][ T31] ? __pfx_kthread+0x10/0x10 [ 326.984028][ T31] ret_from_fork_asm+0x1a/0x30 [ 326.988800][ T31] [ 326.992081][ T31] Kernel Offset: disabled [ 326.996507][ T31] Rebooting in 86400 seconds..