last executing test programs: 2m45.191838264s ago: executing program 3 (id=1292): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="180000000000e8000000000040d900008500000023000000850000000f00000095"], &(0x7f0000000400)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$SEG6_CMD_SET_TUNSRC(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000280)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010026bd7000ffdbdf25030000001400010000000021001f00000000000000000001"], 0x28}, 0x1, 0x0, 0x0, 0x800}, 0x4) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000500)={&(0x7f0000000140)='mm_page_alloc\x00', r0}, 0x10) (async) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r3, 0x84, 0x6f, &(0x7f0000000280)={0x0, 0x10, &(0x7f0000000000)=[@in={0x2, 0x4e20, @private=0xa010100}]}, &(0x7f00000002c0)=0x10) r4 = socket(0x2, 0x80805, 0x0) (async) r5 = socket$inet(0x2, 0x80001, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r5, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r4, 0x84, 0x74, &(0x7f0000000200)={r6, 0x5, 0x20}, &(0x7f00000001c0)=0x18) r7 = socket$nl_generic(0x10, 0x3, 0x10) (async) r8 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$WG_CMD_SET_DEVICE(r7, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000300)=ANY=[@ANYBLOB="18020000", @ANYRES16=r8, @ANYBLOB="0100fcffffff0000000001000000cc010880781100802c00098028000080060001000a0000001400020000000000000000000000000000000000050003000200000024000200acbf0eb64372a7dea48f1870b2f90e5a6ef9bcee124093fc825200a32053602224000200eff93d58460ea431f2cf4a6894ddb2834088d7445bf5afdd0619ce173f1db71750010080240002007b4326167f79726ecfae0aeee91d38ba98df91957e9dead91c7bebb4db027bf124000100f44da367a88ee6564f020211456727082f5cebee8b1bf5eb7337341b459b3922080003000f0000000800030004000000f400098028000080060001000a000000140002000000000000000000000000000000000005000300020000001c00008006000100020000000800020000000000050003000300000058000080060001000a00000014000200fe8000000000000000000000000000bb0500030002000000060001000200000008000200ac1414bb05000300020000000600010002000000080002007f00000105000300030000000400008028000080060001000a00000014000200fc000000000000000000000000000000050003000000000028000080060001000a00000014000200ff010000000000000000000000000001050003000200000024000300b08073e8d44e91e3da922c22438244bb885c69e269c8e9d835b114293a4ddc6e14000200776730"], 0x218}, 0x1, 0x0, 0x0, 0x4004840}, 0x40000) (async) r9 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$IP6T_SO_SET_ADD_COUNTERS(r9, 0x29, 0x41, &(0x7f0000000500)=ANY=[@ANYBLOB="6d616e676865000000000000000000000000000000000000000000000000000005"], 0x78) (async) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x4c831, 0xffffffffffffffff, 0x0) (async) ioctl$ifreq_SIOCGIFINDEX_vcan(r7, 0x8933, &(0x7f0000000100)={'vxcan0\x00'}) 2m45.042679963s ago: executing program 3 (id=1296): bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000000)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x60, 0x60, 0x5, [@enum={0x5, 0x3, 0x0, 0x6, 0x4, [{0xb, 0x8}, {0x1, 0x200}, {0x7, 0x80000000}]}, @int={0x0, 0x0, 0x0, 0x1, 0x5, 0x8}, @array={0x0, 0x0, 0x0, 0x3, 0x0, {0x2, 0x2}}, @func_proto={0x0, 0x1, 0x0, 0xd, 0x0, [{0x3, 0x3}]}]}, {0x0, [0x0, 0x5f, 0x2e]}}, 0x0, 0x7d}, 0x28) 2m44.977727851s ago: executing program 3 (id=1298): r0 = socket$inet6_udplite(0xa, 0x2, 0x88) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000580)={0x5, 0x5, &(0x7f00000003c0)=ANY=[@ANYBLOB="180000004830000000000000fa40000007010000080020007500feff0000820095"], &(0x7f0000000100)='GPL\x00', 0x4, 0xfa, &(0x7f00000007c0)=""/250}, 0x90) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000040)=@raw={'raw\x00', 0x3c1, 0x3, 0x3a8, 0x0, 0xc8, 0x8, 0x180, 0x5803, 0x2d8, 0x2e8, 0x2e8, 0x2d8, 0x2e8, 0x3, 0x0, {[{{@ipv6={@empty, @private1, [], [], 'pim6reg0\x00', 'wlan0\x00'}, 0x0, 0x118, 0x180, 0x0, {0x0, 0x2000000000000}, [@common=@unspec=@pkttype={{0x28}, {0x7, 0xddad}}, @common=@dst={{0x48}, {0x4}}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x1, 0x0, 0x0, 0x0, 'pptp\x00', 'syz0\x00'}}}, {{@uncond, 0x0, 0x138, 0x158, 0x0, {}, [@common=@unspec=@rateest={{0x68}, {'dvmrp0\x00', 'batadv_slave_1\x00', 0x12, 0x3}}, @inet=@rpfilter={{0x28}}]}, @unspec=@NOTRACK={0x20}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x408) 2m44.85751963s ago: executing program 3 (id=1302): r0 = socket$inet6_udplite(0xa, 0x2, 0x88) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) r2 = socket$packet(0x11, 0x3, 0x300) read(r2, 0x0, 0x0) r3 = socket$netlink(0x10, 0x3, 0x4) r4 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000005c0)=ANY=[@ANYBLOB="020b000102"], 0x10}}, 0x0) sendmsg$key(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000100)={0x2, 0x13, 0xfb, 0x5, 0x2, 0x0, 0x70bd28, 0xeedc}, 0x10}}, 0x4) writev(r3, &(0x7f0000000000)=[{&(0x7f0000000140)="480000001400190d09004beafd0d8c5610a600000000000000000000590000a2bc5603ca00000f7f89000000200000000101ff0000000309ff5bffff00c7e5ed5e00000000000000", 0x48}], 0x1) sendmmsg$inet6(r1, &(0x7f0000019880)=[{{0x0, 0x0, &(0x7f0000000440)=[{&(0x7f0000000740)="006c951444a83336e4947393009a15c4082f1dc601e8ff586266fc7ebb457738876741feb9cbbeb4e76a7e0d130d3ceb0daa803e6d40b9ee364baaa66fe74419ab3b08af76b4e9d0e6124551c395f45688db0062a0", 0x55}], 0x1}}], 0x1, 0x2604082c) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000001300)=@raw={'raw\x00', 0x3c1, 0x3, 0x2b0, 0xc8, 0x18c, 0x203, 0x0, 0x19030000, 0x1e0, 0x2e0, 0x2e0, 0x1e0, 0x2e0, 0x3, 0x0, {[{{@uncond, 0x300, 0xa8, 0xc8}, @unspec=@NOTRACK={0x20}}, {{@uncond, 0x0, 0xd0, 0x118, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@LED={0x48, 'LED\x00', 0x0, {'syz1\x00'}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x310) 2m44.832353693s ago: executing program 3 (id=1304): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="3c020000190001000000000000000000fc0200000000000000000000000000000000000000000000000000000000000000000008000000000200002008000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000000000000000000000000000010000000000000000000000000000000300000000000000000000000000000000000000000000001d00000000000000000000000000000000000000000000000000000000000000dd02000000000000000000000000000001000000000000008401050064010101000000000000000000000000000004d32b00000000000000ac14140c000000000000000000000000000000000500ff00feffffff0000000000000000fc0200008ddd00000000000000000000000000003200000000000000ac1414aa0000000000000000000000000e0000000100000000000000ffffffffffffffff00000000000000000000000000000001000000003c00000002000000fc00000000000000000000000000000100000000010300000000000000000000000000007f000001000000000000000000000000000000003c00000002000000fe88000000000000000000000000000100000000020000000000000003000000286a8b2700000000000000000000000000000000000000003c0000000200000000000000000000000000000000000000fffff054d881"], 0x23c}}, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f0000000200)=0x474c, 0x4) bind$inet(r1, &(0x7f0000000240)={0x2, 0x0, @local}, 0x6f) connect$inet(r1, &(0x7f0000000480)={0x2, 0x0, @multicast2}, 0x10) sendmmsg(r1, &(0x7f0000007fc0), 0x800001d, 0x300) setsockopt$inet_int(r1, 0x0, 0xd, &(0x7f0000000180)=0x1f5, 0x4) setsockopt$inet_int(r1, 0x0, 0x14, &(0x7f0000000000)=0x40, 0x4) recvmmsg(r1, &(0x7f00000008c0)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)=""/157, 0x9d}, 0xfffffffc}], 0x1, 0x45833af92e4b39ff, 0x0) 2m44.728553795s ago: executing program 3 (id=1307): r0 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) (async) r1 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000140)={'netdevsim0\x00', 0x0}) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000380)={0x6, 0x3, &(0x7f0000000000)=ANY=[@ANYBLOB="1800000000000000000000000300000095"], &(0x7f0000000300)='GPL\x00', 0xb, 0x0, 0x0, 0x0, 0x0, '\x00', r2, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffd62}, 0x94) (async, rerun: 32) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x11, 0x5, &(0x7f0000000280)=ANY=[@ANYBLOB="1801000021000000000000003b810000850000006d000000070000000000000095"], &(0x7f0000000040)='GPL\x00', 0x6, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) (rerun: 32) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f00000000c0)='rpc_buf_alloc\x00', r3, 0x0, 0x1}, 0x18) (async, rerun: 32) sendmsg$netlink(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000002580)=[{&(0x7f0000000000)=ANY=[@ANYBLOB="140000002500010000000000f100000006"], 0x14}], 0x1, 0x0, 0x0, 0x40004880}, 0x20004000) (rerun: 32) 2m29.622789765s ago: executing program 32 (id=1307): r0 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) (async) r1 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000140)={'netdevsim0\x00', 0x0}) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000380)={0x6, 0x3, &(0x7f0000000000)=ANY=[@ANYBLOB="1800000000000000000000000300000095"], &(0x7f0000000300)='GPL\x00', 0xb, 0x0, 0x0, 0x0, 0x0, '\x00', r2, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffd62}, 0x94) (async, rerun: 32) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x11, 0x5, &(0x7f0000000280)=ANY=[@ANYBLOB="1801000021000000000000003b810000850000006d000000070000000000000095"], &(0x7f0000000040)='GPL\x00', 0x6, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) (rerun: 32) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f00000000c0)='rpc_buf_alloc\x00', r3, 0x0, 0x1}, 0x18) (async, rerun: 32) sendmsg$netlink(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000002580)=[{&(0x7f0000000000)=ANY=[@ANYBLOB="140000002500010000000000f100000006"], 0x14}], 0x1, 0x0, 0x0, 0x40004880}, 0x20004000) (rerun: 32) 2.639947064s ago: executing program 0 (id=2134): socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000200)='ns/pid_for_children\x00') r0 = socket(0x8, 0x3, 0x0) ioctl$sock_netrom_SIOCADDRT(r0, 0x6180, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000300)='ns/ipc\x00') sendmsg$FOU_CMD_ADD(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)=ANY=[@ANYRESDEC=r1, @ANYBLOB="3904cc9a0d2159b34144761f18008db317f85e5454c34f17f0863ca7c08d24f04e2af5000000a67a905e91c653548dd8a7ec56afc0702ec71fbdbd7e0fb53da33ba4d9de925808630527b417", @ANYBLOB, @ANYRESOCT], 0x38}}, 0x4000) unshare(0x6a040000) r2 = socket$inet_udp(0x2, 0x2, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000240)={0x0, 0xffffffffffffffff, 0x0, 0x7, &(0x7f0000000000)='cgroup\x00'}, 0x30) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) epoll_wait(r3, 0x0, 0x0, 0x5) setsockopt$inet_MCAST_JOIN_GROUP(r2, 0x0, 0x2a, &(0x7f0000000180)={0x2, {{0x2, 0x0, @multicast2}}}, 0x88) setsockopt$inet_MCAST_MSFILTER(r2, 0x0, 0x30, &(0x7f0000000600)=ANY=[], 0x110) setsockopt$inet_group_source_req(r2, 0x0, 0x2b, &(0x7f0000000000)={0x2, {{0x2, 0x4e28, @multicast2}}, {{0x2, 0x2, @multicast1}}}, 0x108) r4 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc2(0x0, 0xffffffffffffffff) socket$l2tp(0x2, 0x2, 0x73) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0x0) sendmsg$TIPC_NL_NET_SET(r4, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000240)=ANY=[], 0x30}}, 0x0) r5 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_TIMESTAMPING(r5, 0x1, 0x41, &(0x7f0000000200)=0x6f9a, 0x4) connect$inet(r5, &(0x7f0000000480)={0x2, 0x0, @local}, 0x10) sendmmsg(r5, &(0x7f0000007fc0), 0x800001d, 0x0) 2.07706724s ago: executing program 2 (id=2147): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) r1 = socket(0x2a, 0x2, 0x0) getsockname$packet(r1, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000001480)=0x14) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)=@newqdisc={0x24, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {0x0, 0x6}, {0xffff, 0xffff}, {0x0, 0xfff1}}}, 0x24}}, 0x0) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000000c0)={0x0}}, 0x0) r3 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$sock_int(r3, 0x1, 0x13, 0x0, &(0x7f00000000c0)) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000740)=@newtfilter={0x2c, 0x2c, 0xd27, 0x70bd2d, 0x0, {0x0, 0x0, 0x0, r2, {0xe, 0xffff}, {0x0, 0xc}, {0x8, 0xffe0}}, [@TCA_RATE={0x6, 0x5, {0xef, 0x3}}]}, 0x2c}}, 0x4000) r4 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r4, &(0x7f00000002c0), 0x40000000000009f, 0x0) writev(r0, &(0x7f0000019880)=[{&(0x7f0000000400)="fb", 0xffffff5c}, {&(0x7f00000197c0)="1902eb02d5e5f29e59e1a7caec33eb76d2430da474d87e367f6598d026438b65eda8341073b6752abdcee080c8e1e876b25227c37d7dd79886ce33f13e857c8eda1cecf6ac36c03dbf54e3cb5136da5a33fee76fb3113f8b6700e9e5fc006b8eed665fed48738d59395ad07438c3610ae3976aac75caf2facafa21c25be3c2", 0x7f}], 0x2) ppoll(&(0x7f0000000380)=[{r0}], 0x1, &(0x7f0000000400), 0x0, 0x0) r5 = socket$l2tp(0x2, 0x2, 0x73) setsockopt$inet_int(r5, 0x0, 0x12, &(0x7f0000000180)=0x1000, 0x3) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x0, 0x13, &(0x7f0000000040)=ANY=[@ANYBLOB="18080000000010000000000000000000851000000600000018000000", @ANYRES16=r0, @ANYRES64=r0], &(0x7f0000000000)='GPL\x00', 0xa, 0xde, &(0x7f0000000340)=""/222, 0x41000, 0x8}, 0x94) sendmsg$NFQNL_MSG_CONFIG(r1, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x30, 0x2, 0x3, 0x585, 0x0, 0x0, {0x7, 0x0, 0x3}, [@NFQA_CFG_FLAGS={0x8}, @NFQA_CFG_PARAMS={0x9, 0x2, {0xf98, 0x2}}, @NFQA_CFG_QUEUE_MAXLEN={0x8, 0x3, 0x1, 0x0, 0x4}]}, 0x30}, 0x1, 0x0, 0x0, 0xe04bc4def0ad2af3}, 0x0) 1.841290753s ago: executing program 0 (id=2149): mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x1, 0x42072, 0xffffffffffffffff, 0x20000000) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = bpf$ITER_CREATE(0x21, &(0x7f0000000040), 0x8) sendmsg$NFT_BATCH(r0, &(0x7f0000000d00)={&(0x7f0000000980)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000cc0)={&(0x7f00000009c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWCHAIN={0xd4, 0x3, 0xa, 0x101, 0x0, 0x0, {0x2, 0x0, 0x6}, [@NFTA_CHAIN_USERDATA={0x96, 0xc, "ab3baf5934c4d95dcc9ac23756b4f8d5f4b3a7211f3f0d9439445522ae1676751ad63f580272262e3d02105495d8f0fdb0c0e8e82056381d837962669a8c55bc8c65c53d6558eeab06dd6177ee4b709d333167f06d8e20948a501ed0b32f2aa7a1b02ed739accd8f95ef2f57daa680608d32b9e0a05fad367386b322cc4c957944788974bbaf6d4a820e453f6aca6885f525"}, @NFTA_CHAIN_POLICY={0x8, 0x5, 0x1, 0x0, 0xffffffffffffffff}, @NFTA_CHAIN_USERDATA={0x1d, 0xc, "ff103d04c4c116080f6f4ef8c44cb19cc02f594b36ce0d3d02"}]}, @NFT_MSG_DELTABLE={0xc8, 0x2, 0xa, 0x101, 0x0, 0x0, {0x0, 0x0, 0x4}, [@NFTA_TABLE_USERDATA={0x79, 0x6, "aac69ca634cdc3a06fa4a3d9e683f09ad04c2b02b21241a91b059bc7b42e146ba7f5b05c15f1ec1a52d5a9302d533d944526a04a8f9469d063c955c88e7f2782744e7357a58c91ccaa231d401187ddd66717e35d3608a3507d91192ad7ae0ff54ae3e2bdf189407305ff46e0c441f714b08a743114"}, @NFTA_TABLE_HANDLE={0xc, 0x4, 0x1, 0x0, 0x4}, @NFTA_TABLE_FLAGS={0x8}, @NFTA_TABLE_NAME={0x9, 0x1, 'syz1\x00'}, @NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}, @NFTA_TABLE_NAME={0x9, 0x1, 'syz1\x00'}]}, @NFT_MSG_NEWFLOWTABLE={0xe8, 0x16, 0xa, 0x401, 0x0, 0x0, {0x3, 0x0, 0x9}, [@NFTA_FLOWTABLE_FLAGS={0x8}, @NFTA_FLOWTABLE_FLAGS={0x8, 0x7, 0x1, 0x0, 0x2}, @NFTA_FLOWTABLE_FLAGS={0x8, 0x7, 0x1, 0x0, 0x3}, @NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_FLOWTABLE_HOOK={0xc, 0x3, 0x0, 0x1, [@NFTA_FLOWTABLE_HOOK_NUM={0x8}]}, @NFTA_FLOWTABLE_FLAGS={0x8, 0x7, 0x1, 0x0, 0x3}, @NFTA_FLOWTABLE_HOOK={0x24, 0x3, 0x0, 0x1, [@NFTA_FLOWTABLE_HOOK_DEVS={0x18, 0x3, 0x0, 0x1, [{0x14, 0x1, 'veth1_virt_wifi\x00'}]}, @NFTA_FLOWTABLE_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x4}]}, @NFTA_FLOWTABLE_FLAGS={0x8, 0x7, 0x1, 0x0, 0x3}, @NFTA_FLOWTABLE_HOOK={0x68, 0x3, 0x0, 0x1, [@NFTA_FLOWTABLE_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x7ab}, @NFTA_FLOWTABLE_HOOK_DEVS={0x54, 0x3, 0x0, 0x1, [{0x14, 0x1, 'xfrm0\x00'}, {0x14, 0x1, 'veth0_macvtap\x00'}, {0x14, 0x1, 'wg2\x00'}, {0x14, 0x1, 'nicvf0\x00'}]}, @NFTA_FLOWTABLE_HOOK_NUM={0x8}]}, @NFTA_FLOWTABLE_FLAGS={0x8, 0x7, 0x1, 0x0, 0x2}]}, @NFT_MSG_NEWCHAIN={0x24, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1, 0x0, 0x5}, [@NFTA_CHAIN_FLAGS={0x8, 0xa, 0x1, 0x0, 0x6}, @NFTA_CHAIN_FLAGS={0x8, 0xa, 0x1, 0x0, 0x2}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x5}}}, 0x2d0}, 0x1, 0x0, 0x0, 0x2000c080}, 0x4064000) socket$inet6_tcp(0xa, 0x1, 0x0) socket(0x10, 0x80002, 0x0) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) r2 = socket$nl_generic(0x10, 0x3, 0x10) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000d40)='./cgroup.net/syz1\x00', 0x200002, 0x0) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_COALESCE_SET(r2, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000180)=ANY=[@ANYBLOB='\\\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010000000000000000001400000008000a00fc00000018000180140002006e657464657673696d300000000000000800080000fcffff08000900fcfc0000080011000000000008000e00800000000800", @ANYRES64=r2], 0x5c}, 0x1, 0x0, 0x0, 0x20008005}, 0x0) sendmsg$rds(r1, &(0x7f0000000940)={&(0x7f0000000080)={0x2, 0x4e23, @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x10, &(0x7f0000000380)=[{&(0x7f00000000c0)=""/232, 0xe8}, {&(0x7f00000001c0)=""/99, 0x63}, {&(0x7f0000000240)=""/22, 0x16}, {&(0x7f0000000280)=""/123, 0x7b}, {&(0x7f0000000300)=""/71, 0x47}], 0x5, &(0x7f0000000740)=[@rdma_map={0x30, 0x114, 0x3, {{&(0x7f0000000400)=""/70, 0x46}, &(0x7f0000000480), 0x10}}, @rdma_dest={0x18, 0x114, 0x2, {0x2, 0x8}}, @cswp={0x58, 0x114, 0x7, {{0x1, 0x8}, &(0x7f00000004c0)=0x7fffffffffffffff, &(0x7f0000000500)=0xc, 0x2, 0x7f, 0x5, 0xd3, 0x1e, 0x3}}, @mask_cswp={0x58, 0x114, 0x9, {{0x0, 0x7a7}, &(0x7f0000000540)=0x5, &(0x7f0000000580)=0x10001, 0xf, 0x0, 0x9, 0x401, 0x1, 0x9}}, @mask_fadd={0x58, 0x114, 0x8, {{0xc974, 0x10000}, &(0x7f00000005c0)=0x24b, &(0x7f0000000600)=0x9, 0xfff, 0x0, 0x1, 0xffffffffffffffff, 0x26, 0x3}}, @mask_cswp={0x58, 0x114, 0x9, {{0x4, 0x6}, &(0x7f0000000640)=0x7ff, &(0x7f0000000680)=0x9, 0xfffffffffffffffd, 0x9, 0x68b, 0x1}}, @fadd={0x58, 0x114, 0x6, {{0x324, 0x81}, &(0x7f00000006c0)=0x80000000, &(0x7f0000000700)=0x5, 0xfffffffffffffc43, 0x7, 0x5, 0x1, 0x40, 0x800}}], 0x200}, 0x801) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1900000004000000040000000500000000000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000003ed4010dd4b062200"/28], 0x48) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xb, 0x14, &(0x7f00000004c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000208500000001000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000001000000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r5, 0x0, 0xe, 0x0, &(0x7f0000000100)="e0b9547ed387dbe9abc89b6f5bec", 0x0, 0xe00, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) setsockopt$inet6_tcp_int(r0, 0x6, 0x24, &(0x7f0000000000)=0xfffffff7, 0x2) 1.719864678s ago: executing program 0 (id=2152): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_INITMSG(r0, 0x84, 0x2, &(0x7f00000000c0)={0xfffd}, 0x8) socket$igmp(0x2, 0x3, 0x2) (async) socket$inet_smc(0x2b, 0x1, 0x0) (async) syz_init_net_socket$netrom(0x6, 0x5, 0x0) (async) syz_init_net_socket$netrom(0x6, 0x5, 0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, &(0x7f00000001c0)) socket(0x11, 0x3, 0x0) (async) r1 = socket$kcm(0x10, 0x2, 0x4) sendmsg$kcm(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000180)="39000000140081ae10003c000500018311001f9f660fcf066505acb612f691f3bd3508abca1be6eeb89c44ebb37358582bdbb7d553b4e921", 0x38}], 0x1}, 0x0) (async) sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x4c001) (async, rerun: 64) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x7a44, 0x1700) (async, rerun: 64) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_type(r3, &(0x7f00000000c0), 0x9) (async) sendfile(r3, r2, 0x0, 0x10000) socket(0x2a, 0x800, 0x0) (async) syz_init_net_socket$llc(0x1a, 0x1, 0x0) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000640)={0x11, 0x8, &(0x7f0000001640)=ANY=[@ANYRES32=r3], &(0x7f0000000380)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x94) (async) r4 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$IPT_SO_SET_REPLACE(r4, 0x0, 0x40, &(0x7f0000000140)=@raw={'raw\x00', 0x8, 0x3, 0x498, 0x320, 0xa, 0x148, 0x368, 0x60, 0x400, 0x2a8, 0x2a8, 0x400, 0x2a8, 0x3, 0x0, {[{{@ip={@multicast2, @multicast2, 0x0, 0x0, 'bridge0\x00', 'rose0\x00'}, 0x0, 0x2f8, 0x368, 0x0, {0x200003ae, 0x7f00}, [@common=@inet=@hashlimit1={{0x58}, {'veth1_to_team\x00', {0x0, 0x0, 0x2, 0x0, 0x0, 0xffffffff, 0x7}}}, @common=@unspec=@bpf1={{0x230, 'bpf\x00', 0x0}, @pinned={0x1, 0x8601, 0x6, './file0\x00'}}]}, @common=@unspec=@NFLOG={0x70, 'NFLOG\x00', 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, "f2f7b9f28413d9d8ad470ad2b60c45cb4ea6e7bf902bdc2ff8a9304d9f655c746adc0bdc773506378bc2d27efd6abb05175089830cc46186074d7de46d5af300"}}}, {{@ip={@empty, @empty, 0x0, 0x0, 'syzkaller0\x00', 'veth0_to_team\x00'}, 0x0, 0x70, 0x98}, @common=@unspec=@MARK={0x28}}], {{'\x00', 0xc8, 0x70, 0x98}, {0x28}}}}, 0x4f8) (async) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000040)={&(0x7f00000003c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x17, 0xc, 0xb, [@fwd={0x8}]}, {0x0, [0x30, 0x2e, 0x0, 0x5f, 0x0, 0x61, 0x30, 0x2e, 0x30]}}, 0x0, 0x2f, 0x0, 0x1, 0x3}, 0x28) (async) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) r6 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r6, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000000)="2e00000010008188e6b62aa73f72cc9f0ba1f848140000005e140602000000000e000a000f000000028000001294", 0x2e}], 0x1}, 0x0) (async, rerun: 64) sendmsg$IPSET_CMD_TEST(r5, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)={0x2c, 0xb, 0x6, 0x201, 0x0, 0x0, {0x5, 0x0, 0x2}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x4}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}]}, 0x2c}}, 0x0) (async, rerun: 64) socket$inet6_sctp(0xa, 0x5, 0x84) (async) r7 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt(r7, 0x84, 0x71, &(0x7f0000000000)="03040000008002ff", 0x8) 1.599983989s ago: executing program 0 (id=2154): r0 = socket$netlink(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RATE_NEW(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000300)={0x14, r1, 0x1, 0x0, 0x25dfdbfb, {0x25}}, 0x14}, 0x1, 0x0, 0x0, 0x41}, 0x48010) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_INITMSG(r2, 0x84, 0x2, &(0x7f0000000000)={0xfbfc, 0x0, 0x0, 0x90f0}, 0x8) sendto$inet6(r2, &(0x7f0000000300)="81", 0x1, 0x10, &(0x7f0000000280)={0xa, 0x0, 0x80000000, @private0={0xfc, 0x0, '\x00', 0x1}, 0x81}, 0x1c) setsockopt$inet6_int(r2, 0x29, 0x4e, 0x0, 0x0) r3 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r3, 0x29, 0x23, &(0x7f00000004c0)={{{@in=@remote, @in6=@private0, 0x0, 0x0, 0x0, 0x0, 0xa}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40000000}, {}, 0x0, 0x0, 0x0, 0x0, 0x3}, {{@in6=@mcast2, 0x0, 0x2b}, 0x0, @in=@empty}}, 0xe8) r4 = openat$ppp(0xffffffffffffff9c, &(0x7f0000001740), 0x101042, 0x0) r5 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) r7 = socket$netlink(0x10, 0x3, 0x4) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r8, 0x8933, &(0x7f00000002c0)={'batadv_slave_1\x00', 0x0}) r10 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r10, &(0x7f0000000780)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000500)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000000008000400", @ANYRES32=r9, @ANYBLOB="06001500070000000c0016800800", @ANYRES8=r7], 0x38}}, 0x10) bind$inet6(r6, &(0x7f00000003c0)={0xa, 0x4e22, 0x0, @empty}, 0x1c) listen(r6, 0x0) accept$inet6(r6, 0x0, 0x0) r11 = socket$netlink(0x10, 0x3, 0x4) accept4(r6, 0x0, &(0x7f00000000c0), 0x80800) r12 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000140), 0x59b0a375fc1de9a4, 0x0) preadv(r12, &(0x7f0000000880)=[{&(0x7f0000000400)=""/167, 0xa7}, {&(0x7f0000000600)=""/254, 0xfe}, {&(0x7f0000000180)=""/97, 0x61}, {&(0x7f00000002c0)=""/9, 0x9}, {&(0x7f0000000340)=""/102, 0x66}, {&(0x7f0000000740)=""/130, 0x82}, {&(0x7f0000000800)=""/91, 0x5b}], 0x7, 0x5, 0x2) writev(r11, &(0x7f0000000080)=[{&(0x7f0000000200)="a10100001500add427323b470c45b4560a067fffffff81004e22000d00ff0028925aa80020007b00090080000efffeffe809000000ff0000f03ac7100003ffffffffffffffffffffffe7ee00000000000000000200000000", 0x1a1}], 0x1) ioctl$sock_SIOCETHTOOL(r5, 0x8946, &(0x7f00000000c0)={'wlan1\x00', &(0x7f0000000080)=@ethtool_stats}) ioctl$PPPIOCNEWUNIT(r4, 0xc004743e, &(0x7f0000000100)) ioctl$PPPIOCSACTIVE(r4, 0x40107446, &(0x7f0000000080)={0x2, &(0x7f00000000c0)=[{0x40, 0x8, 0xfe, 0xff7ffeff}, {0x6, 0xa, 0xfe, 0x8001}]}) 1.490167576s ago: executing program 5 (id=2156): r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000a00)=@newlink={0x40, 0x10, 0x503, 0x4000000, 0x0, {0x0, 0x0, 0x0, 0x0, 0x14615}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @geneve={{0xb}, {0x10, 0x2, 0x0, 0x1, [@IFLA_GENEVE_UDP_ZERO_CSUM6_TX={0x5}, @IFLA_GENEVE_COLLECT_METADATA={0x4}]}}}]}, 0x40}}, 0x20008040) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) r2 = socket(0x2, 0x80805, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f0000000380)=[@in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}]}, &(0x7f0000000180)=0x10) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000580)={0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x87, 0x0, &(0x7f00000003c0)="e0d4a0665df652ffbe22cad46e21930413e8f917fa50532b354ab03b96a02d2ba579fc645ca2db1125ebb6bc81134a0a799a0db21f93221be07add10c285aca6451ff597324243c72b812c6146773348cc8664828c7e795091994a2a6956d2fd08a2daba64b7c8f6f7054f9b963a13478d25daa2d5c7fc4d93a593fc1223538967a853e2905c7f", 0x0, 0x4, 0x0, 0x5}, 0x50) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f0000000400)=@abs={0x1, 0x0, 0x4e20}, 0x6e) getsockopt$inet_sctp_SCTP_MAX_BURST(r2, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000001080)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r1, 0x84, 0x1f, &(0x7f0000000580)={r4, @in6={{0xa, 0x4e21, 0x4, @empty, 0xc}}, 0x0, 0x8}, 0x90) 1.391817405s ago: executing program 4 (id=2157): r0 = socket$l2tp6(0xa, 0x2, 0x73) sendmmsg$inet6(r0, &(0x7f0000000440)=[{{&(0x7f0000000280)={0xa, 0x4e22, 0x8, @empty}, 0x1c, 0x0, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="1100000000000000290000000b00"], 0x18}}], 0x1, 0x4000) r1 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={0x0, 0xffffffffffffffff, 0x0, 0x6, &(0x7f0000000000)='cgroup\x00'}, 0xffffffb4) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x19, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="1800000001000000000000000000000095"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_sockopt=0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f0000000400)={r2, 0x3, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) setsockopt$llc_int(r1, 0x10c, 0x2, &(0x7f00000000c0)=0xffff6a4b, 0x4) bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x16, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x1, 0x2, 0x4, 0x0, 0x1, 0x95}]}, &(0x7f0000000600)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @flow_dissector, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket$l2tp6(0xa, 0x2, 0x73) (async) sendmmsg$inet6(r0, &(0x7f0000000440)=[{{&(0x7f0000000280)={0xa, 0x4e22, 0x8, @empty}, 0x1c, 0x0, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="1100000000000000290000000b00"], 0x18}}], 0x1, 0x4000) (async) syz_init_net_socket$llc(0x1a, 0x1, 0x0) (async) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={0x0, 0xffffffffffffffff, 0x0, 0x6, &(0x7f0000000000)='cgroup\x00'}, 0xffffffb4) (async) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x19, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="1800000001000000000000000000000095"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_sockopt=0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f0000000400)={r2, 0x3, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) (async) setsockopt$llc_int(r1, 0x10c, 0x2, &(0x7f00000000c0)=0xffff6a4b, 0x4) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x16, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x1, 0x2, 0x4, 0x0, 0x1, 0x95}]}, &(0x7f0000000600)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @flow_dissector, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) 1.391262554s ago: executing program 5 (id=2158): r0 = accept4(0xffffffffffffffff, &(0x7f0000000000)=@rxrpc=@in6={0x21, 0x0, 0x2, 0x1c, {0xa, 0x0, 0x0, @mcast2}}, &(0x7f0000000080)=0x80, 0x800) bind$netlink(r0, &(0x7f0000000180)={0x10, 0x0, 0x25dfdbfb, 0x800000}, 0xc) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f00000000c0)={0x0, 0x5}, &(0x7f0000000100)=0x8) setsockopt$inet_sctp6_SCTP_RTOINFO(r0, 0x84, 0x0, &(0x7f0000000140)={r1, 0x6, 0xc2de, 0x9}, 0x10) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f00000026c0)={0x0, 0x0, &(0x7f0000002680)={&(0x7f0000002640)=ANY=[@ANYBLOB="14000000380001002cbd7000ffdbdf250f"], 0x14}, 0x1, 0x0, 0x0, 0x8001}, 0xc804) 1.344958932s ago: executing program 4 (id=2159): r0 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3) pipe(&(0x7f0000000000)={0xffffffffffffffff}) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000140)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_CONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)=ANY=[@ANYBLOB="a16575f6e857bcc9a71a7f625dfa8676a6da9c8b245ab4fd925b92f471e256d011d5a4d3e76130f74e83effd257cf738443d4a701972e2cd111e1cb8b59752496f2263875d798590fa86324f188f5ce02020f718ef8057094e9f2578", @ANYRES16=r3, @ANYBLOB="050025bd7000fddbdf252e00000008000300", @ANYRES32=r4, @ANYBLOB="050034008b00000004004c00"], 0x28}, 0x1, 0x0, 0x0, 0x20000840}, 0x488c0) sendmsg$NL80211_CMD_SET_MULTICAST_TO_UNICAST(r1, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f00000000c0)={&(0x7f0000000180)={0x1c, 0x0, 0x80b0f2d2adf7671f, 0x70bd29, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r4}, @void}}}, 0x1c}, 0x1, 0x0, 0x0, 0x24040080}, 0x10) accept4(r0, 0x0, 0x0, 0x80000) 1.341551695s ago: executing program 5 (id=2160): socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000200)='ns/pid_for_children\x00') r0 = socket(0x8, 0x3, 0x0) ioctl$sock_netrom_SIOCADDRT(r0, 0x6180, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000300)='ns/ipc\x00') sendmsg$FOU_CMD_ADD(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)=ANY=[@ANYRESDEC=r1, @ANYBLOB="3904cc9a0d2159b34144761f18008db317f85e5454c34f17f0863ca7c08d24f04e2af5000000a67a905e91c653548dd8a7ec56afc0702ec71fbdbd7e0fb53da33ba4d9de925808630527b417", @ANYBLOB, @ANYRESOCT], 0x38}}, 0x4000) unshare(0x6a040000) r2 = socket$inet_udp(0x2, 0x2, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000240)={0x0, 0xffffffffffffffff, 0x0, 0x7, &(0x7f0000000000)='cgroup\x00'}, 0x30) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) epoll_wait(r3, 0x0, 0x0, 0x5) setsockopt$inet_MCAST_JOIN_GROUP(r2, 0x0, 0x2a, &(0x7f0000000180)={0x2, {{0x2, 0x0, @multicast2}}}, 0x88) setsockopt$inet_MCAST_MSFILTER(r2, 0x0, 0x30, &(0x7f0000000600)=ANY=[], 0x110) setsockopt$inet_group_source_req(r2, 0x0, 0x2b, 0x0, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc2(0x0, 0xffffffffffffffff) socket$l2tp(0x2, 0x2, 0x73) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0x0) sendmsg$TIPC_NL_NET_SET(r4, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000240)=ANY=[], 0x30}}, 0x0) r5 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_TIMESTAMPING(r5, 0x1, 0x41, &(0x7f0000000200)=0x6f9a, 0x4) connect$inet(r5, &(0x7f0000000480)={0x2, 0x0, @local}, 0x10) sendmmsg(r5, &(0x7f0000007fc0), 0x800001d, 0x0) 1.232023038s ago: executing program 4 (id=2162): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r1, &(0x7f0000000000)=[{{&(0x7f0000000f40)=@abs={0x0, 0x0, 0x4e20}, 0xff84, 0x0, 0x0, &(0x7f0000001400)=ANY=[@ANYBLOB="14000000000000000100000001000000", @ANYRES32=r0, @ANYBLOB="000000001c000000000007e8e3ffffff01ba9000", @ANYRES32, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00'], 0x38, 0x2000c851}}], 0x1, 0x12) 1.211634923s ago: executing program 4 (id=2164): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000500)=@base={0xa, 0x4, 0x4, 0xc, 0x0, 0xffffffffffffffff, 0x6}, 0x50) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0xf0, &(0x7f0000000100)={&(0x7f0000000280)=@newlink={0x20, 0x10, 0x401, 0x0, 0x0, {0x0, 0x48, 0x0, r2, 0x21eae}}, 0x20}}, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x15, 0xd, &(0x7f0000000040)=ANY=[@ANYBLOB="18000000000000000000000000000000850000007b00000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000010b704000000000000850000000100000095"], &(0x7f00000001c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', r2, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000000)='mmap_lock_acquire_returned\x00', r3}, 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0xe, 0x6, &(0x7f0000000000)=@framed={{0x5, 0x0, 0x0, 0x0, 0x0, 0x69, 0x11, 0x32}, [@func={0x85, 0x0, 0x1, 0x0, 0x2}, @call={0x85, 0x0, 0x0, 0x5}, @exit], {0x95, 0x0, 0x5a5}}, &(0x7f0000000080)='GPL\x00', 0x3, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x6}, 0x94) ioctl$FS_IOC_FSSETXATTR(r3, 0x401c5820, &(0x7f0000000240)={0x7, 0x9, 0x6f, 0x80, 0xfffffffd}) 1.165123571s ago: executing program 2 (id=2165): socket$nl_netfilter(0x10, 0x3, 0xc) r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000340)=ANY=[@ANYBLOB="3c00000010003904000000000000000000000000527d0366f1b735d6f4a7b6cc602fcb7232d53b04e89043fdfd6ae6ab27652207b0c46d310162969cdacedd52f900e3c4db0268d4a56ef2fdb3913795cf2ccd9e6661b646ff6694dfd5d50a00470f3ef9004ad0753f1d8d90b5d754681b75c59602593f6cbea9233cb019f0fb43d0380a09a58eaab77ef4d525185ec12a78b82594e74032de72ce7505e3e49e7b7bdd7fcbd533e551f55fa6f6f22e435fe4a4882cf9ee5beab646b321a3fcf7fd9f7d8f96da4a7c56ef8d12997dc6e8db33586687bad0044cd19efc0a3d9ad197a68a2c8ed702b222d1386408c7d6d841fb578a2f087b38424f7b6edf1a368b5dd72a", @ANYRES32=r1, @ANYBLOB="21010000000000001c0012800b00010062726964676500000c0002800800020002000000"], 0x3c}, 0x1, 0x0, 0x0, 0x400d4}, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x19, 0x3, &(0x7f00000003c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_sockopt=0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) r5 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000000)='memory.events.local\x00', 0x0, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000280)={{r5}, &(0x7f0000000200), &(0x7f0000000240)=r3}, 0x20) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000500)={r6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) r7 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TUNSETOFFLOAD(r7, 0xc004743e, 0x110e22fff6) r8 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x1a3201, 0x0) ioctl$TUNSETOFFLOAD(r8, 0x4004743d, 0x110e22fff6) socket$packet(0x11, 0x3, 0x300) r9 = syz_init_net_socket$rose(0xb, 0x5, 0x0) ioctl$SIOCRSSL2CALL(r9, 0x89e2, &(0x7f0000000580)=@bcast) close(r7) r10 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r10, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) sendmsg$TIPC_CMD_GET_NETID(0xffffffffffffffff, &(0x7f00000004c0)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000480)={&(0x7f0000000440)={0x1c, 0x0, 0x2, 0x70bd25, 0x25dfdbfd}, 0x1c}}, 0x40014) writev(r8, &(0x7f0000000340)=[{&(0x7f0000000000)="df2d81c437896fea516477f772976906d5ad4be28f856b0977176456bce49bc02bace0a62efaa196eb3a302ada126e192675daed5fe39bfcaad1215bae281156d9870bc665075426ba03adb0d27626", 0x4f}, {&(0x7f0000000140)="448ed536c85269e062c37ea499d9a1e699b0195b56e46ebc4527feaf6e4b", 0x1e}, {&(0x7f0000000180)="6a10f5e8a667cfb4aa3908a4ec60396a088ab30650653b795486831f84e0b981deb576b841ea3fdcd088ccf4ee1fc0b31fa2ad717246530790c8f93ef1f8f0f3382bd1c5763a73ddec8e48ae52aae94dc51eb8b0c48e4f8fd112", 0x5a}, {&(0x7f0000000240)="a44c3e3846ce368d3740ea25cbe2f82db316f0f39de15e1703", 0x19}, {&(0x7f0000000280)="a3626693e5d36d294d5514995aa564d3621f3600cd22c392fe7b5dabf90f6ce0fdecd4cadac6c56ed84a3d6a26a7c3564fc492b110c1121ae8d8d5e44005bd013982a69499fdd9c062ec113481fcc478a73bbfaabd9a4e71ecf83f72398771ed50bff7", 0x63}, {&(0x7f0000000300)="095ecfa80179f4f30cfa1688ed63e9e77db00b0f765b6f818159c93834b89da6731178df90", 0x25}], 0x6) sendmsg$IPSET_CMD_ADD(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000500)=ANY=[@ANYBLOB="48000000090605000000000000010007000000100008800c0007800800064000000a8a080009400000be1a08000940000000070900020073797a3100000000"], 0x48}, 0x1, 0x0, 0x0, 0x11}, 0x20000000) 1.075667096s ago: executing program 4 (id=2166): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000bc0)=ANY=[@ANYBLOB="fc01000013000100000000000000000000000000000000000000000000000001fc0200000000000000000000000000014e24000d040000090a00000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="020000010000000000000000000000000000000000000000ffffffffffffffff00000000000000000300000000000000090000000000000000000000000000000000000000000000010000000000000000000000000000000000000000000000feffffff00000000000000000000000044010500e0000002000000000000000000000000000004d6320000000a000000ac1414aa000000000000000000000000053500000303030009000000b4000000070000007f000001000000000000000000000000000004d36c00000000000000fc0100000000000006000000000000000000000000000900010000000080000008000000ac1414aa000000000000000000000000000004d2330000000a000000ac1414bb0000000000000000ddffffff023500000002fa00070000000a00000002000000fe80000000000000000000000000000f000004d43c"], 0x1fc}, 0x1, 0x0, 0x0, 0x11}, 0x0) (async) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0xf, 0x0, 0x0) (async) r1 = socket$kcm(0x10, 0x2, 0x0) (async, rerun: 32) r2 = socket$nl_generic(0x10, 0x3, 0x10) (rerun: 32) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xd, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4000000fd0800006114ac000000000004000000000000009500000000000000"], &(0x7f0000003ff6)='GPL\x00', 0xe, 0xfd90, &(0x7f000000cf3d)=""/195, 0x40f00, 0x0, '\x00', 0x0, @sock_ops, 0xffffffffffffffff, 0x8, 0x0, 0xfffffffffffffe40}, 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000400)={0x11, 0xc, &(0x7f0000000d40)=ANY=[@ANYBLOB="18000000000000000000000000000000850000007b000000180100002020642500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007000000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000001c0)=ANY=[@ANYBLOB="4c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000002c00128009000100626f6e64000000001c0002800a001a"], 0x4c}, 0x1, 0x0, 0x0, 0x20004000}, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000600)={&(0x7f00000005c0)='sys_enter\x00', r3}, 0x10) (async) sendmsg$nl_generic(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000001ac0)={&(0x7f0000000000)=ANY=[@ANYBLOB="140000002d00010026bd7000fcdbdf2514000000"], 0x14}, 0x1, 0x0, 0x0, 0x4000d}, 0x20000000) (async) r5 = socket$kcm(0x10, 0x2, 0x0) r6 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_int(r6, 0x11, 0x11, 0x0, &(0x7f0000000140)) (async) bpf$ITER_CREATE(0x21, &(0x7f0000000180), 0x8) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000580)={r3, 0xe0, &(0x7f0000000640)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000280)=[0x0, 0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x9, 0x9, &(0x7f00000002c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000340)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0x3c, &(0x7f00000003c0)=[{}, {}, {}], 0x18, 0x10, &(0x7f00000004c0), &(0x7f0000000500), 0x8, 0xf5, 0x8, 0x8, &(0x7f0000000540)}}, 0x10) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000740)={@fallback, 0xffffffffffffffff, 0x36, 0x4000}, 0x20) r7 = socket(0x10, 0x3, 0x0) (async) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) ioctl$FS_IOC_SETFLAGS(r8, 0x40086602, &(0x7f0000000040)=0x20) (async, rerun: 64) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) (rerun: 64) sendmsg$nl_route(r7, &(0x7f0000000080)={0xffffffffffffffff, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="240000006800010000000000000000000200000000000000080006000100000004000b"], 0x24}}, 0x4004094) (async) r9 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000200)='./cgroup.net/syz0\x00', 0x200002, 0x0) openat$cgroup_ro(r9, &(0x7f00000000c0)='memory.events\x00', 0x0, 0x0) r10 = socket$inet_sctp(0x2, 0x5, 0x84) sendmmsg$inet_sctp(r10, &(0x7f0000000d40)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000b00)=[@prinfo={0x18, 0x84, 0x5, {0x70}}], 0x18, 0x4}], 0x1, 0x800) (async, rerun: 64) bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0x1, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b702000000090001db120a000000000007000000000000009500000000000a6682f0a61b01e4c027d252f602901b7cbbd5b9097bb8334a5541cf9e345af317e35f2ad53d857708f974879196ac07622b10548ccd2028eaf7610ae297a58e413b22d81494fcb1dbd1e9cb784c590ddd3d400ac1949839f92232e7684f2305d906ee929a27a5dedf301650960d8ae1cf339f6bda65bf6594c2839dcea6e419c9b8b7d17b9e49f392c832ffa41c17b82700789b163bbc8507f171b46d2c569e75810e60a06b6f69ef41ca39a2e8c2f369545d761d74"], &(0x7f0000003ff6)='GPL\x00', 0x5, 0xc3, &(0x7f000000cf3d)=""/195}, 0x94) (async, rerun: 64) sendmsg$kcm(r5, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)=[{&(0x7f0000000380)="2e00000010008188e6b62aa73772cc9f1ba1f848110000005e140602000000000e000a001000000002900000121f", 0x2e}], 0x1}, 0x0) (async, rerun: 64) sendmsg$kcm(r1, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000040)="2e00000010008188040f80ec59acbc0413a1f848110000005e140602000000000e000a000f00000002800000121f", 0x2e}], 0x1}, 0x0) (rerun: 64) 927.422924ms ago: executing program 5 (id=2167): r0 = socket$inet6(0xa, 0x800000000000002, 0x0) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x41, &(0x7f0000000200)=0x590, 0x4) sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f0000000240)={0xa, 0x4e23, 0x0, @ipv4={'\x00', '\xff\xff', @empty}}, 0x1c) recvmmsg(r0, &(0x7f00000053c0)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)=""/21, 0x15}, 0x1}], 0x1, 0x2000, 0x0) socket$inet6_mptcp(0xa, 0x1, 0x106) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000004c0)=@updpolicy={0x1fc, 0x19, 0x1, 0x0, 0x1, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0xfffffffffffffffc}}, [@tmpl={0x144, 0x5, [{{@in=@local, 0x0, 0x3c}, 0x0, @in=@broadcast, 0xfffffffe, 0x2, 0x0, 0x0, 0x0, 0x0, 0x40}, {{@in6=@mcast1, 0x4, 0x3c}, 0x2, @in6=@dev}, {{@in=@empty, 0x4d2, 0x6c}, 0x0, @in=@local}, {{@in6=@local, 0x0, 0x3c}, 0x0, @in=@empty, 0xffffffff}, {{@in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x0, 0x6c}, 0x0, @in=@rand_addr=0x64010101, 0x0, 0x4}]}]}, 0x1fc}, 0x1, 0x0, 0x0, 0x1}, 0x84) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000f00), 0xffffffffffffffff) r4 = socket$unix(0x1, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_REGISTER_FRAME(r2, &(0x7f0000002000)={0x0, 0x0, &(0x7f0000001fc0)={&(0x7f0000000f80)={0x28, r3, 0x1, 0x70bd29, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r5}, @void}}, [@NL80211_ATTR_FRAME_MATCH={0x4}, @NL80211_ATTR_FRAME_TYPE={0x6, 0x65, 0x1}]}, 0x28}}, 0x44) 845.345571ms ago: executing program 1 (id=2168): r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000f00), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000f40)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_REGISTER_FRAME(r1, &(0x7f0000002000)={0x0, 0x0, &(0x7f0000001fc0)={&(0x7f0000000f80)={0x28, r2, 0x1, 0x70bd29, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_FRAME_MATCH={0x4}, @NL80211_ATTR_FRAME_TYPE={0x6, 0x65, 0x1}]}, 0x28}}, 0x44) 759.640681ms ago: executing program 2 (id=2169): sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=ANY=[@ANYBLOB="24000000200000032cbd7000fcdbdf2502000000000000000100010008000b1001000000"], 0x24}, 0x1, 0x0, 0x0, 0x10}, 0x4) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000200)=ANY=[@ANYBLOB="2800000021000100"], 0x28}}, 0x0) r1 = bpf$MAP_CREATE(0x1900000000000000, &(0x7f0000000680)=ANY=[@ANYBLOB="1b00000000000000000000000020", @ANYRESOCT, @ANYRES16=r0], 0x50) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={0xffffffffffffffff, 0xfeffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffffffffe16, &(0x7f0000000140)="06f7", 0x0}, 0xffffffffffffff3a) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000840)=ANY=[@ANYRES16=r1], &(0x7f0000000180)='GPL\x00'}, 0x94) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$inet6(0xa, 0x80002, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$fou(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$FOU_CMD_ADD(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=ANY=[@ANYBLOB="14ec8e00", @ANYRES16=r6, @ANYBLOB="0100000000001000000001000000"], 0x14}}, 0x0) setsockopt$inet6_udp_int(r4, 0x11, 0x67, &(0x7f0000000040)=0x8, 0x4) setsockopt$sock_linger(r4, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8) connect$inet6(r4, &(0x7f0000000000)={0xa, 0x4e27, 0xffffffff, @mcast2, 0x7}, 0x1c) ioctl$F2FS_IOC_MOVE_RANGE(r4, 0xc020f509, &(0x7f00000001c0)={r2, 0x8, 0x1}) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r7, 0x89f3, &(0x7f0000000300)={'tunl0\x00', &(0x7f00000005c0)={'gretap0\x00', 0x0, 0x40, 0x8, 0xf, 0x7fffffff, {{0x20, 0x4, 0x0, 0x1, 0x80, 0x68, 0x0, 0x81, 0x4, 0x0, @loopback, @broadcast, {[@lsrr={0x83, 0x27, 0x4, [@local, @initdev={0xac, 0x1e, 0x0, 0x0}, @rand_addr=0x64010101, @multicast1, @remote, @rand_addr=0x64010100, @loopback, @local, @multicast2]}, @timestamp_addr={0x44, 0x44, 0x63, 0x1, 0x9, [{@local, 0xff}, {@empty, 0x62b}, {@dev={0xac, 0x14, 0x14, 0x23}, 0x10000}, {@local, 0xb}, {@remote, 0xb}, {@multicast2, 0xfffffffd}, {@rand_addr=0x64010100, 0x5}, {@rand_addr=0x64010102, 0x6}]}]}}}}}) sendmmsg$inet6(r4, &(0x7f0000003cc0)=[{{0x0, 0x0, &(0x7f0000003980), 0x10000000000002b1}}], 0x400000000000172, 0x4001c00) r8 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000c80)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)=@newqdisc={0x40, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r9, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_fq={{0x7}, {0x14, 0x2, [@TCA_FQ_FLOW_MAX_RATE={0x8, 0x2}, @TCA_FQ_PLIMIT={0x8, 0x1, 0x5}]}}]}, 0x40}}, 0x0) r10 = socket$nl_sock_diag(0x10, 0x3, 0x4) sendmsg$TCPDIAG_GETSOCK(r10, &(0x7f0000000100)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000000c0)={&(0x7f00000003c0)=ANY=[@ANYBLOB="000200001200100025bd7000fbdbdf25059005104e224e20bc000000090000000030000004000000f4ffffff030000000600000003000000", @ANYRES32=r9, @ANYBLOB="09000000faffffff7e0e2f4401000000c0000100b10332fc109fe01fa91fc30bffe48ec7b69f94fbc5a17850ab92aee567b5f1f606805c12cc138d794073cb4556f15f3eabaf4080c6dbd5019ebbd8b0fcb53f3cedbe1dd1d7cf4b45a55d3231f221cc726f59c724bfbe387bc77cf50f9ba6c769bb25040c05341d9b6ed455f0e168caeae885303ed354076cbe2fafd631e23270df34ce1b40a0f6bc7eed4174bad70535182c2f62660db7c9c92c73b98c6570e5ebbbf2d610dc18370355c01c6d0fd21a203aa54547c57eef637ea8d50d000100c1f4349881d59e570a000000e300010070747755148dba85557b655494b948c3ea66568be7a7e2f1ee7fb1543b7c17e30929a38c8bd4bfb74b9a719847a0608028257277a9fc7d641f363e901e1b114443cf2900bdc550ddf6c2441aabcce2b62dd7f702ba81e8f50c0eef62b8b6c1b7838e09bd6f8a9fb259f863bfd0556116e0d46b8cac3b0c33b83055a76d8d9c41d5bd99490626b35dcc445f5e739eacf79797192ed13fe9ed892fc0bf9d3793d5d31f1659c7d193719ac3b7e1b7740ea900e3936818f823230eadabae21d64fff57db40105bc1473d870b5bb3981ce21c120db5947b2ea71bdbb85ad25fe37100"], 0x200}, 0x1, 0x0, 0x0, 0x20048004}, 0xc801) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x3, 0x4, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000000), 0x10}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000280)={r2, 0xfeffff, 0x113, 0x3f00f000, &(0x7f0000000700)="c45c573d395de5b2891a7d637a223920f181c2e57d71483cfb2d075a3fa67258e080a194805cdb0c26d3f7ffb1e0d9cf4fa36dcb2168b72de48ac8f93e6804f1c4d70898d0810e044d7e1778eaac5dfdcc9f1208905522025bcfdf1b6f969b094d5c022c2b7ffefde71e0627b9a2069cc1e0175c4b8860aad4b0a103c589f676b6c4e85eb3950c533b6e62c39ccf9ae9bfe54ee5887358d44f46337fbe090d7c7e55847edee8130ffd3d1e719e01a68b0e691c0d35b0b56e0b514036342fd56f08ac0083f3c2fe41a1295a3d23cf3d160d4fd90f66beba68860456ed41272e1e68d16c2564c85f5556e18784113c493d13253e14d6eb891707fba3c30d07d5ee8619e4426cafec4cf6a3723c455d09b586b248", 0x0, 0xf0, 0x0, 0x4a, 0xffffff0c}, 0x40) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001240)={0x8, 0xf, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000000000000000000000020000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000005000000bf0900000000000045090100000003709500000000000000bf91000000000000b7030000000000008500000000000000b7000000000000009500000000000000"], &(0x7f0000000200)='syzkaller\x00', 0x9, 0x100b, &(0x7f0000001e40)=""/4107, 0x40f00, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x100}, 0x94) r11 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r11, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000880)=ANY=[@ANYBLOB="4000000010000d042abd7000fbdbdf25000000005171fd9b1b500bd60e7ddaf4bc43ad0cb5b870e702ea61ae5a67c46961608ba9425786d6ddd4e45dce6c91f1c3b84e5909365cfb5ac5c9fa3a7bca2d176ab56dadd787a1105311fff545b8510746935e22f764b9f7f0f29295ec2ef4a6f38e9b1d22fd06fe04ea463f05c0de1fc06e11db551962f0dbf3e517eddc1e4a0a36ada6a5f3562395fc8808d6a8e3809bfdcbab08e77654b8b0109165393d79789f7838901a0f4a5bf1e64ee419f32ec7fb4ce541aa3a584522d9c7ffffffff00000000e0b0e31c", @ANYRES32=0x0, @ANYBLOB="2009000040000000200012800e00010069703665727370616e0000000c0002800600030002000000"], 0x40}, 0x1, 0x0, 0x0, 0x8000}, 0x8000) r12 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="06000000040000006c0f00000a"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r12, @ANYBLOB="0000000000000000b7080000b2e900007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b70400000000000085000000c300000095"], 0x0, 0x4, 0x0, 0x0, 0x0, 0x44, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x38, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 759.246695ms ago: executing program 5 (id=2170): r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000f00), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000f40)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_REGISTER_FRAME(r1, &(0x7f0000002000)={0x0, 0x0, &(0x7f0000001fc0)={&(0x7f0000000f80)={0x28, r2, 0x1, 0x70bd29, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_FRAME_MATCH={0x4}, @NL80211_ATTR_FRAME_TYPE={0x6, 0x65, 0x1}]}, 0x28}}, 0x44) (fail_nth: 1) 745.259973ms ago: executing program 1 (id=2171): bpf$PROG_LOAD(0x5, &(0x7f0000000580)={0x0, 0xc, &(0x7f0000000440)=@framed={{}, [@ringbuf_output={{}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffad, 0x0, 0x0, 0x0}, 0x90) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r0, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000680)={0x10, 0x4, &(0x7f0000000380)=ANY=[@ANYBLOB="1802000000c400000000000000000000850000003e00000095"], &(0x7f00000000c0)='GPL\x00'}, 0x90) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000023c0)=ANY=[@ANYBLOB="1200000004000000080000000b"], 0x48) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000540)=ANY=[@ANYRES32=r2, @ANYRES32=r1, @ANYBLOB='\a'], 0x10) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000100)={r2, &(0x7f0000000240), &(0x7f0000000140)=@tcp6=r0}, 0x20) sendmmsg$inet6(r0, &(0x7f0000002440)=[{{0x0, 0x0, &(0x7f0000000980)=[{&(0x7f0000000600)="e2", 0x11}], 0x1}}, {{0x0, 0x1, &(0x7f0000000480), 0x14}}], 0x400, 0x10) 716.683072ms ago: executing program 5 (id=2172): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x10, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="1800000000000000000000000000000071101c000000000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x94) r0 = socket$kcm(0x29, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000240)=@xdp, 0x80, &(0x7f0000000580)=[{&(0x7f00000002c0)="99c0c8a64944a05e9c346de4d3d3a9bb39a0f78b255ad412db84b364a11507d57ebe76f665aa34319949d11ac4742b1e21768d7255e6fadbe63c5361ffa11811d2b17ec2289c7a18786e0a226f6fe59ee2ffdbf142cf0477b841c9457ee2ea08ae81d4a3", 0x64}, {&(0x7f0000000340)="e85adb6a4d1a8746eac7dfbfc4425e242d0b83bf6a5d7eddee7f42ebd47e3e45498f220f7a0a57909dcf6199cbcad1a4310a9164af92b63381eb4ec1585cf5ce4b7b56ac8e2bb8c522148434f8794629edc06d69", 0x54}, {&(0x7f00000003c0)="58eb2c5f4861f02f200c15a24904c3bee774847f569bed51040025a08a0191a5eb14d91b8c8c510d600553f4ed0ee0a928e2ccbd303cff39", 0xffffffd8}, {&(0x7f0000000400)="51380ec09bd99ead10314c60dd84ede5853a989a50373ac712415d8507e6932ddee21ea42c5a23ae95e79250499276fccb9664194c8cd6c2fae81193d8b3b9be16f971daedea10580316cb74311dc5554dda3033aef6740c3e40681e462f186b9ea4f4492a52a98681e1b274cf9426a421b972aa87496a4dcde29945", 0x7c}, {&(0x7f0000000480)="4cd39417fd88dab33f389d56159dd2ba0c3121fc76d126adb79cb5d48ac2b8ba46342a9cb6c73090f4198a6e47bcb95da97e980783892369896001917cd145f40642879a25a833fdf010de49638e89077f67f3e8daa41587b11f7dad846e3df25f85f8b7b441abf566cf3573223448c7e338f747494818815250f682330701dab144969e7f01f37b6c76040b7293abf700cd4273f5a67194394245d8855d48b104a8e79e7591c7510af76a59182c39a7c8ededce3ee8121afe4a110e6725f0acec8de26e557effc6d7e853d1d6dc115c9cc38be97879e7e0b046466ce56d6d7a4d980b0413ff128f35d5e489adbfa4cb4cd88377c7f2e68b4a7e0c", 0xfb}], 0x5, &(0x7f0000000600)=[{0x1010, 0x0, 0x0, "29c4c3474479bb34441dee598c29a6fc29ccabf33c1078b9f65f93219d8ee3f95f355fdd7104db312951579a0b9b66138fcf0acc3d4b33729f73c417e96d91d2eb5e0319bfd1b9a0cf7190a1216b93faddafd420a887bc958b3fd15066b89294ca9df3fbebcab8cc156f00020f44de7a57ff9a0044c666525947e889fd7dca04cf13a9537702537d305dd2c25744230700a06e7e519b816c6469fdd4ab4e929df381a43607a6695e534eadab5d5d054bd0619358ab113c5f4752ef7f7329fcec35aad7631bc72b44a0d99bc3177d60cb840725520ade4a8eaed4d14b84511894f0e193a6496a5b53ff8731a6544b3adaa2763269919452d2aa2ff727a42215942132105c51a0c0de3c41bc9fa714881ec211d6571ff733794b3e8ec9477639ffff3f981f245ad5cd06d18fc7cf9403f0379f9e7d24a11d46cfcd45a0c45e45ec9471827f9cd272d79358e56e9e33d8df9fcdf749a35bcd057464898d29fb1ed2337b05eabd7a41c8c7ad3c47218c664a317f727ebea385ff01400cb6c940d5d394e16de2bcfe2410d0f24e6b1321e75364d1a42624bdf659c0b7f8f76b8a421417dee9d10cdba301d35852d879c1d643bc702e29a54598c9e34b0562ed09536b1b06d4b58df3d91f973f9a38c88caa4e3c2c2d0b6a1da2dc8836781ac50af9cc42891398e6b5d64b5bf047c6f2f6e651d736ba1903921c5ffbe726a6371b9c44d20cd04a96ca3b1bbf97fd350fb63c13df32407782424cac6b1eaf111da7db600715e2ac333154cf3cd62706432e57e94645ac7e8c92d5236612d5a3c6e22438c51b294b3cc96c6a1f52450d92abe9906ba0798fc97e421c2f1ab36d20fbfb01a462143bc25f8f112263be15b7d0f8479fde6f42fa363437275acedad60486c57f905de48399d4ae5058da17522f5365a29eaeab2def70c383940a38d9a5f3d2b168eb64f8dd5ec6cb50581963fe8520c4ecff9158c8702f40a4a9b8900c55a0e0b06c1af35d12ad39e44e14a7cc83aa6bb606197cf34633667fc997b592907a62e67fa40dbe9ad23a5bf9d05fe812f96db107653368213bb559c5f3158593d9d37b6cc2bf6df06fada99384043d676da665657b5cd22a836eae16705e0ca272beb6955c3fad86ec8506e2c78f7d7260682c68ed8b7ebf02a30d22ac585cc347cbdaecf6e9e7e5d5aa97b92aef01bcc6aff785badf8f9b1699167ae930a83f0bc27bfdca2f895d7e5eebb95b82a819be127ab93433f5d8db50b12d058cf0d0f88737fd949dd0043a08b6219e6edaf4bd641e0e8285a0dfa47c96f89e75971ce7d6241e4b7d9fc7041c6902a86cb18492a0a8b18fbfc5e3d22a54de821581d1b99ccad7bc0c9a9138dc7cecca45f6568620532e2abe785c13ed459a18547c9f178cd998c317a0031625b5ebdcb99ce5f54b060da36203175b893253645ba2fd2ad856831440d769f59307313eb4ebc84f4a02a412075837d4bbb30b818d57a883747a1af26f35f1c2c208e7defc085bdf9eebc10079e18a0f23fd21a7d2884ab5ea7bc44ea261c91bf2ebd415a23eae9a7e85f3f0880547e1bcd13ef0468b458ed37f421b851bab5aae964b899f6cbc1f3d02f3800c7b35c89d0efdd6025e0921d3f526ed6587c415b177b87134e3da173d33b68a2672f36a4cde5ae8809212b9d88e6a4b4bf20afef7c1a48b4a5f2887874fb4e7cac0bcf71ed0d622a367b329f4b5e474ee4fd70636e86995520ec970970b0cd1f340d2b892aa56c2cfcbbbd6167e37b1c39327ad6cc85dec48a7e142b63a84c5b3886487ab2fedc582ac6f965d376b0581c0cae3abe24cb662e0c3c116d7e8dbddb107aa993cbfc24a0a8ca900b61c986f190671b809c8b34d110113397a9397e6b56858428ca09d708d83bdc51d90cfbe14b4c56a1ccd8190e581b766f2e0f8b6c49c7e74b8dfe99a35188115ea48b35d7975f58a5055422eaef9ebf438fb9eedaf9e1909c507a99542de7ad5d35e332d9267bbce80d58d5475bf714e3be2b26b258a6823d42410cdf72aa6f12a299f720c479e02060849e93d59c1b15d484adae609a31471abd4338a6aea03851ae370273f1ae3d72c59cbbd25c5a3aee91869c72a27b763eef686230650a895a0a9a2f77bdb6fb349c59cc48820f42500bc51a237a3436567d384648fb867d48602657a8c81f0aed85977073e103f0fc62aca6492f4378a646238349a5f8bee94f4766ee9e327860704b8a090adfc2ee0db11cc2df4b652211d30ed298dedd23eab38eacc8e0d2e69593a5682cec4d2c0f2d3d66f3df7be8028238d0f590ee90621d020b93085a5f694d563856284bafd4f0b954e30a896d1e399d6316d660e2b6ad3df716122f0a303b2f0217c6697d4d815b8a28ab8f028a8159f2aa9ed128a851334407d54f7e9c64e7b92a82ce51ab2a5b9ed047040f74fd42fcb2c41f379ce658641b73a60fb4b41f0a9a8edf605265fa6efdd28e1ae2fb8d4def9bbca9c4f9f2edcdc9e6fd423d9613a43845f20c61b9661c8b9c99bc958af7e61af5e704baf5ca12e65e8f0b133acec17081cbb50c22272ab51c7d17cc12a3033c52483b47aa16ac9dda11fb77001a4316b98bf873448267c8e7e49d6d07477a62b33e0a46e387999bc143f69c41130dfc77198f1339c7177befbf3eb06a9ecdf062fd842b29dba1b204474e309e64e2631f6c5e4d3d7ca536d4467419e620c8619a1526c691206063971491ff49aea6be8faa611203c37b3eec38d149035aee79af66693edc97d0da78671b88d9757919bce0b404ab0b2b43534e184fc67fca7937499782c1aaf7754c68225fdce1bc0643c91667d04a04a7c410a908d206a7e7c4c2a33b9c761be5dfe6e03a477462d359e7c07752a9700b1c37fa21b04072b6eaeff92d3633564cec2128406b1712fbff8a94b32b800b6a010bd243b9e96ef9c22ff2c77023c55837d219c3ae7f0d3e2af3cec7ba5c8222ccb97a6da76524dc70b41627eb024962fd743e59b58956bcb2bf03247a6dcbdfe23e8c3ce54ca98b34e74fd6cc01e622696556bf245b92ceecc5aa2a74591f1a584a6ad18a346da14c5ea3b52bcbbf2da744920e22e0f09b4fa7c63399606bd595b8e7a0d1d28d73d26a5defbedca45e1571dc76a120472ba5be9396a5d0775cb28af94469cf1657aa2efdc6104e1385a2cc8b7e782ca816291c4a50d7a4b580e26a91cfb2e3b81ce8fa76545ef66c23b2045bc81ae9cd01650243feb5b521aae85a683a2cf20333fbf24903cb5a7ebf89b89ce1dadad33118861a44cc067a5a4c511e7b4d2ddb22338c60fd174703b169b5bfe14e44783e5a1495fd267df653731add97119e0ac9e7efedc1b5881679101ef710714bad7ace7d25df8e078dd5fcba19b9519ba45ca3c779f8ee8d541a5efd41b6fba6bd3b46f9e361fde6b6f2af713179622787f507281d444110f6f93c53b17aebcd5b272d44c1f8479384970234b199559d53a3d959eea9bb230c2d199c5538c3efdf049d617d97b6d658840d543237157f20ba1929d9cd7247827ba400bb87b95c3225b3f86c2b42b584e7dc16d6619f408e322b4fd2db7148185c958469eb6e69a237c75a1c8a17da35586c835d5f22f9637c77ce412086868f9a11f3e341af960bc014b006e41ef6adc1fd91f86361a5541a8aa018dbffb38bb6c27ea0eb5cf9242efb49f431371beed7c202ce91e7f63c3d00fd4022634253c64a5355150b746164a1a857306b258332a11a30a750e402885ab7aa5c02e4446a07250a74d0649793d7387aa588f9e7552621410b906a907f5b49c16385c34eeed4b944dfe86f65b2e8c5ffd790d333b3b2b6b158d010a9cbeb436cacfa80f6821b409e6722ac5a1662ec7e591786f2ee5b95c93a756d6b13ebdd383999ad08b1f964036692a83e1d7fb3544e268161eab60ed235cc26fd7e7467bd97f6f1d32c3c6e2509528febdde9e1736c4bdd1dbe057d253bcdebed84a21549db56bc284ada3909fe8f7a15092b0b64e6f0fde332150b485d00c5edb5ff12861732227c408e8910708009bb7d26c4f0e070a5346e21643e63df15061d2971ae4337a34fa0dc1ddae98bb507914f44ec05e794fd4c20b28d72171eb86d66fabc229ad9e50ceb4e0c1b7224252b1e650c66528d3e90bb159047a2ab96cb10382581ec8cab511ae6028f4008a8fa93f136e7d17c26b209a240666df3394d92d687a56fb74c53d2a9c722a47d8b78490122fab47866e34c2509e002c6f8fdddecd56ce66b9151dbad5cc4e12298a20dcf4f3620409fa8332add659e2aad35359d07956f1d8a9e3e6779ce03174e1ab3465ff52b8b88e550ee077a96b633b527d89b3e9f47fa374a6aa5e92b9cf07ae61fbd00b1af4035af0c701f7db0243e32f4c8d72e73698742d092f1a932eba1ae5b4dc8dcb70a486764eabfb11e4bd6bd0990622888f1c9f28b4faccd814ccd7735fbb62d6cfbac24297cfde2ef217f6f8065729c772f0f3013f43d1822decd2d7deecb19389be2aee3b16db0c64eafcb2740fc19ee34010f5c00fd30d6ca921504796caddb546d53d977fa858c45a9e7e423aa3a354261156ec74beadf57eaf5ea16e2daf2e9fd6e13411816b705e62fe36d25ef08e26e0846a9da549a5ad03658826e56ddb0c7732ca8fd2f71a1f3ebcf32d5097f3f7451880ab5d4f3dd860b25749868a2d13d44ffc059debce3295e2ff35a86220d9425ef553a26e0cc96a1a631a2b5922655dd13a51b5686a0dc582e5946adba613999b26312c7abcda3e18742ef68906e2f9615165f2896b160096bf334babfd336b68c6e4d3f9cec25c83065dc3f4636f73717c70d98ab05fee2b101527255b7c5e52e280c6807f84c7ac46766607fb9440a7861050305d8cdefa39510ed85892a6bcf5431677c436574bc17b1915e5c65653dbfd00246e3e403b357a11ffd7c208b2eb2f3af8d1d84fed3ea0b3f37717313a2d0ee5a933cbed5a20ca1ccb00fd54b7a3ec34c3bd2245b2c49cfa31d999d73a89e4c75fb557b086bea6eeb022edbad85bbf905c86c45f512b714412031492691ee68a90e41605c82dad45fb4f6a3d70c1274d76a252c3a712aa7c2ed1549b92fdf58012feeaa738713180e56e401f329d8864def28beab976489974d5294546728013d64e10330e92ca20ce32eac971fd3196676a174a659512ec043952424ce06f4f3635213fe536f0514397d8161ed00e2aa8925fc1e9fc1c301b28b56d2654d95bc8c362b41439b95e9da06fc149d7a0a47eea787292d6c61c7e7ddf08f567f055fa352f06f052e304a83284ef0a4ea8d515f146b2a0f79751e1b99905a082ca5d2c0fc7d05645686725e36b18717dff90139605a2cb46d25ea6892aeb8fcd7ff998aeb9d4b9c2863ade72e98f98495cf13409d6a7f71d8883a3f7f72a5257031854b72542a18ccf149939146a7fdedc94800e9475a6375a5c749b264c72824292bdd50451f97a709a0a54b2d9052fa23f26bf024f2f5e579e5cf1e572eac2707f7efe3148dde6c6df8c6b1b41c5f2d0d050aeaec38b5818544de20739c5769b1d659900fa499b3e740cdd7cb1389f83de5c009f3ca200614974a8f4a9506f857794b557e1a67e66f7d72ec2519457805417a2017a28432f42647f99d013afca2a0f95eb0e31c621721ab2e848cfd93bea24bd91b20d4e16d76718a6f66c7b27338674e071c2b61ebdac5e18ece820494adcb1d77417ccac6f63ba24139f81cd30ed9f74ffdb1d54abb7382fe7e0d3e4f6bdcf05059535db9c1fa5c83d6a95498160724a"}, {0x28, 0x0, 0x0, "8192fbea2c061381413fc28cb06b4e988dc486c74cfc"}, {0x18, 0x0, 0x0, "4fdf1ab71595"}, {0x18, 0x0, 0x0, "f47d"}, {0xe0, 0x0, 0x0, "06435d82744e2bd9e2a1fe8560ac7d60b467b377f0399e14a4b82078fbecc311bfb75da80df4176c4561790eae2e1f95dd46a7d7add48146b7b5c82746d8d36469209f1157ef17dbcd007409c3146b57a228d6100cf363fe754e480ace4546319526df51a444b225ac6df534283e28711f46fc77e9fda0596f402ec4c67aa5d0c5e535ca6edfe639e562cb3f41c27b110d3f65ecadd12a490fd27c6eea3f254c1a651207d6a239d3289641254ed028de2cedd5f658793983cea494d38b136b5f72a624ea0975c31041f46ca0"}], 0x1148}, 0x0) setsockopt$kcm_KCM_RECV_DISABLE(r0, 0x119, 0x1, &(0x7f00000000c0), 0x4) r1 = socket$inet_mptcp(0x2, 0x1, 0x106) ioctl$int_in(r1, 0x5452, &(0x7f0000000180)=0x401) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$tun(r2, &(0x7f0000000000)=ANY=[], 0x38) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x10012, r2, 0x0) ioctl$sock_SIOCSPGRP(r1, 0x8902, &(0x7f0000000000)=0xffffffffffffffff) connect$inet(r1, &(0x7f0000000200)={0x2, 0x4e20, @loopback}, 0x10) r3 = socket$l2tp6(0xa, 0x2, 0x73) ioctl$sock_TIOCINQ(r3, 0x541b, &(0x7f0000001180)) recvfrom(r3, &(0x7f0000000080)=""/153, 0x99, 0x10100, 0x0, 0x0) 431.179588ms ago: executing program 1 (id=2173): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000001c0), 0xffffffffffffffff) sendmsg$TIPC_NL_MEDIA_SET(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000040)={0x34, r1, 0x801, 0x709d2c, 0x25dfdbfe, {}, [@TIPC_NLA_MEDIA={0x20, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_PROP={0x14, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x96a}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x6}]}]}]}, 0x34}, 0x1, 0x0, 0x0, 0x24008000}, 0x8040) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000300)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x3}}, [@NFT_MSG_NEWOBJ={0x20, 0x12, 0xa, 0x201, 0x0, 0x0, {0x3, 0x0, 0xa}, @NFT_OBJECT_CT_EXPECT=@NFTA_OBJ_NAME={0x9, 0x2, 'syz2\x00'}}, @NFT_MSG_NEWSET={0x20, 0x9, 0xa, 0xb03, 0x0, 0x0, {0x1, 0x0, 0x9}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}]}, @NFT_MSG_DELTABLE={0x118, 0x2, 0xa, 0x5, 0x0, 0x0, {0x3}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}, @NFTA_TABLE_HANDLE={0xc, 0x4, 0x1, 0x0, 0x4}, @NFTA_TABLE_USERDATA={0xdf, 0x6, "f372b3bac7e64fd873c240a798e8b29ffe55b47a71e2af0b0d629d4e6f89f59a85919afb398b6a75dc68edac2f9924fa38a91167943191a9e30b8f0ae85197f61f8478e174a736bb2fce0a419c170ae1eef87326322fbb8bb423ff7b6cf61b0cc7274434129f92cf70d2355170722b7caeaf8dc19002740883a996ab52bb8d805a9541607bf297c899c4194e7c8bfe0b51ce3c43138b03ec4d71de6c84d1274e29a81a6452bcca1180970179d18d052711d21bdeecb6f25ce4c8a8154da503c57ef7820a1a86f1f818a7db7955745807b98f3e2a9ee3971af60c7b"}, @NFTA_TABLE_NAME={0x9, 0x1, 'syz1\x00'}]}, @NFT_MSG_DELSET={0x140, 0xb, 0xa, 0x401, 0x0, 0x0, {0x3, 0x0, 0x3}, [@NFTA_SET_HANDLE={0xc, 0x10, 0x1, 0x0, 0x3}, @NFTA_SET_OBJ_TYPE={0x8, 0xf, 0x1, 0x0, 0x7}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x31}, @NFTA_SET_TIMEOUT={0xc}, @NFTA_SET_GC_INTERVAL={0x8, 0xc, 0x1, 0x0, 0x6}, @NFTA_SET_EXPRESSIONS={0xe4, 0x12, 0x0, 0x1, [{0x10, 0x1, 0x0, 0x1, @objref={{0xb}, @void}}, {0x18, 0x1, 0x0, 0x1, @ct={{0x7}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_CT_SREG={0x8, 0x4, 0x1, 0x0, 0xc}]}}}, {0x30, 0x1, 0x0, 0x1, @fwd={{0x8}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_FWD_NFPROTO={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_FWD_NFPROTO={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_FWD_SREG_DEV={0x8, 0x1, 0x1, 0x0, 0xe}, @NFTA_FWD_SREG_ADDR={0x8, 0x2, 0x1, 0x0, 0x13}]}}}, {0xc, 0x1, 0x0, 0x1, @osf={{0x8}, @void}}, {0x28, 0x1, 0x0, 0x1, @last={{0x9}, @val={0x18, 0x2, 0x0, 0x1, [@NFTA_LAST_MSECS={0xc, 0x2, 0x1, 0x0, 0x8}, @NFTA_LAST_SET={0x8, 0x1, 0x1, 0x0, 0xa6}]}}}, {0x44, 0x1, 0x0, 0x1, @tproxy={{0xb}, @val={0x34, 0x2, 0x0, 0x1, [@NFTA_TPROXY_FAMILY={0x8}, @NFTA_TPROXY_FAMILY={0x8}, @NFTA_TPROXY_REG_ADDR={0x8, 0x2, 0x1, 0x0, 0x8}, @NFTA_TPROXY_REG_PORT={0x8, 0x3, 0x1, 0x0, 0x1}, @NFTA_TPROXY_REG_PORT={0x8, 0x3, 0x1, 0x0, 0x4}, @NFTA_TPROXY_REG_ADDR={0x8, 0x2, 0x1, 0x0, 0x11}]}}}, {0x10, 0x1, 0x0, 0x1, @queue={{0xa}, @void}}]}, @NFTA_SET_POLICY={0x8}, @NFTA_SET_DATA_TYPE={0x8}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x7}]}, @NFT_MSG_DELCHAIN={0x28, 0x5, 0xa, 0x301, 0x0, 0x0, {0x7, 0x0, 0x8}, [@NFTA_CHAIN_FLAGS={0x8, 0xa, 0x1, 0x0, 0x6}, @NFTA_CHAIN_HANDLE={0xc, 0x2, 0x1, 0x0, 0x4}]}, @NFT_MSG_DELCHAIN={0x34, 0x5, 0xa, 0x3, 0x0, 0x0, {0x2, 0x0, 0x7}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_CHAIN_TYPE={0xb, 0x7, 'filter\x00'}, @NFTA_CHAIN_ID={0x8, 0xb, 0x1, 0x0, 0x1}]}, @NFT_MSG_DELSETELEM={0xa24, 0xe, 0xa, 0x5, 0x0, 0x0, {0x2, 0x0, 0x3}, [@NFTA_SET_ELEM_LIST_ELEMENTS={0x638, 0x3, 0x0, 0x1, [{0x2a8, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_EXPR={0x34, 0x7, 0x0, 0x1, @redir={{0xa}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_REDIR_FLAGS={0x8, 0x3, 0x1, 0x0, 0x60}, @NFTA_REDIR_REG_PROTO_MIN={0x8, 0x1, 0x1, 0x0, 0x8}, @NFTA_REDIR_FLAGS={0x8, 0x3, 0x1, 0x0, 0x44}, @NFTA_REDIR_FLAGS={0x8}]}}}, @NFTA_SET_ELEM_EXPIRATION={0xc, 0x5, 0x1, 0x0, 0x80}, @NFTA_SET_ELEM_DATA={0x244, 0x2, 0x0, 0x1, [@NFTA_DATA_VALUE={0xf2, 0x1, "ce574c8274dbca78a14965bf3ccc0c2d0e9086ef553400790fe15ab3ced6fa58ff5179b7e3b5293a07aebafc0c346fe00e01c159ae578d01a8406e037c56347ac1bdc35bc3ed07e2be06ab5fc65fd43d5d6b7d100ba6e347cdc218f753b3670c7fadf5c6c1e497c1df92f4637583a1171d9f69908dbfc9962506e7f96fcf1a36baf16e46ec0442fee1c75cea814b5d5c7aa4c6ca010b2e363928df68d1b7ea6a0f486c94eae1c1853cd885247036f747bdd87d063af43812a2415c6b12810260cb23662975b8bb76d90eab98f8c07d7af7514f207bf4da5d7dce62c4b558913416a2eb266380364de69818046186"}, @NFTA_DATA_VALUE={0x34, 0x1, "68a20f2779f3326f08e5aaf032e5260c8e91c23753f2903377446de575bb1460f3ca822ff308843b37bc3dfdbd3bbe6c"}, @NFTA_DATA_VERDICT={0x6c, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffb}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0x7}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x1}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xffffffffffffffff}]}, @NFTA_DATA_VERDICT={0x28, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x3}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffb}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xffffffffffffffff}]}, @NFTA_DATA_VERDICT={0xc, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0x3}]}, @NFTA_DATA_VALUE={0x63, 0x1, "3f1655bb835f33931878004ad9b0becec55886b081a6b6db0dc3e9997a337f88ec18b91629a317a3139ed940b64f19c8f6da2acd182499ec7e904cafda1ea7f2b1a9b614e653b5324b43e2be07ee596b9e9c40c3d65898a02802cd55c24f65"}, @NFTA_DATA_VERDICT={0x14, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x1}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x3}]}]}, @NFTA_SET_ELEM_EXPR={0x20, 0x7, 0x0, 0x1, @immediate={{0xe}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_IMMEDIATE_DREG={0x8, 0x1, 0x1, 0x0, 0x13}]}}}]}, {0x174, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_DATA={0x128, 0x2, 0x0, 0x1, [@NFTA_DATA_VERDICT={0x48, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x3}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffe}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x3}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x3}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}]}, @NFTA_DATA_VERDICT={0x10, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}]}, @NFTA_DATA_VERDICT={0x3c, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffe}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xffffffffffffffff}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x2}]}, @NFTA_DATA_VERDICT={0x40, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x3}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffc}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x1}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffe}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x4}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}]}, @NFTA_DATA_VERDICT={0x50, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x3}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x4}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}]}]}, @NFTA_SET_ELEM_EXPRESSIONS={0x48, 0xb, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, @cmp={{0x8}, @void}}, {0x38, 0x1, 0x0, 0x1, @log={{0x8}, @val={0x2c, 0x2, 0x0, 0x1, [@NFTA_LOG_GROUP={0x6, 0x1, 0x1, 0x0, 0xff}, @NFTA_LOG_FLAGS={0x8, 0x6, 0x1, 0x0, 0x24}, @NFTA_LOG_FLAGS={0x8, 0x6, 0x1, 0x0, 0x20}, @NFTA_LOG_SNAPLEN={0x8, 0x3, 0x1, 0x0, 0xc}, @NFTA_LOG_LEVEL={0x8, 0x5, 0x1, 0x0, 0x95a}]}}}]}]}, {0x1b8, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_EXPR={0x10, 0x7, 0x0, 0x1, @socket={{0xb}, @void}}, @NFTA_SET_ELEM_EXPR={0x10, 0x7, 0x0, 0x1, @bitwise={{0xc}, @void}}, @NFTA_SET_ELEM_USERDATA={0xce, 0x6, 0x1, 0x0, "052e61a40ddfb24c7d62ea9079635daaa76bf682571f1d7653f6c47b45b9ac72505dac0bd77be873aaeb57546a03ba9964d1a2d36465ecc1e77024200e786be87e410f5a9b90bc230b15a8b27c7582dc644defb7d2f518a146eaa9390cf76480ed5b939c64bd5d415dbd8006d849cb9132ac035af5510f1d38766a910425e9b24acf48842a3a0287466272939fe13e9194e85e34b2915a15a078413ea3975271a39215730d139f26e719b376be81a4afb2e70b09d05bb360dc6cdc320069101c81cefcd2530442ceac3f"}, @NFTA_SET_ELEM_EXPR={0x28, 0x7, 0x0, 0x1, @flow_offload={{0x11}, @val={0x10, 0x2, 0x0, 0x1, [@NFTA_FLOW_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}}}, @NFTA_SET_ELEM_USERDATA={0x41, 0x6, 0x1, 0x0, "14527f5111083e22b7e607733f07189b2df16ec0666334faaa8e124d97cd99c482c12e43bc7ea0ab779beb28be7f4b70f6ef83e9b72881b22eece626fd"}, @NFTA_SET_ELEM_KEY={0x4c, 0x1, 0x0, 0x1, [@NFTA_DATA_VERDICT={0x4}, @NFTA_DATA_VERDICT={0x44, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffe}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffd}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x3}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CODE={0x8}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffd}]}]}, @NFTA_SET_ELEM_OBJREF={0x9, 0x9, 'syz0\x00'}]}, {0x60, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_TIMEOUT={0xc}, @NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x3}, @NFTA_SET_ELEM_USERDATA={0x47, 0x6, 0x1, 0x0, "8701b042e7d81aa32364b648b272084b6f7a9c95097f6653d5b7fd6da9a041565d599dcfe9708e35dad39e38103d14339ca6c8d3cb34f043a3e9f71ac762d5b9495cb6"}]}]}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_SET_ID={0x8, 0x4, 0x1, 0x0, 0x2}, @NFTA_SET_ELEM_LIST_SET_ID={0x8, 0x4, 0x1, 0x0, 0x3}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x3bc, 0x3, 0x0, 0x1, [{0x3b8, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_TIMEOUT={0xc, 0x4, 0x1, 0x0, 0x9}, @NFTA_SET_ELEM_EXPIRATION={0xc, 0x5, 0x1, 0x0, 0x99}, @NFTA_SET_ELEM_TIMEOUT={0xc, 0x4, 0x1, 0x0, 0x5}, @NFTA_SET_ELEM_EXPRESSIONS={0x6c, 0xb, 0x0, 0x1, [{0x5c, 0x1, 0x0, 0x1, @socket={{0xb}, @val={0x4c, 0x2, 0x0, 0x1, [@NFTA_SOCKET_LEVEL={0x8, 0x3, 0x3a}, @NFTA_SOCKET_DREG={0x8, 0x2, 0x1, 0x0, 0x2}, @NFTA_SOCKET_DREG={0x8, 0x2, 0x1, 0x0, 0x15}, @NFTA_SOCKET_DREG={0x8, 0x2, 0x1, 0x0, 0x12}, @NFTA_SOCKET_KEY={0x8, 0x1, 0x1, 0x0, 0x2}, @NFTA_SOCKET_LEVEL={0x8, 0x3, 0x34}, @NFTA_SOCKET_DREG={0x8, 0x2, 0x1, 0x0, 0x13}, @NFTA_SOCKET_LEVEL={0x8, 0x3, 0xb7}, @NFTA_SOCKET_LEVEL={0x8, 0x3, 0xf8}]}}}, {0xc, 0x1, 0x0, 0x1, @dup_ipv6={{0x8}, @void}}]}, @NFTA_SET_ELEM_DATA={0xe4, 0x2, 0x0, 0x1, [@NFTA_DATA_VERDICT={0x10, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}]}, @NFTA_DATA_VERDICT={0x1c, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}]}, @NFTA_DATA_VALUE={0x3c, 0x1, "2417bff7034270b5365069108de1ae62ee97fbd5f3c216fb10462e0e3bb31d69ca42ea188e92f8d8f004ab5bd4a70ee0cc11321d3e7397b8"}, @NFTA_DATA_VERDICT={0x50, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffd}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffb}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffc}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0x1}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffd}]}, @NFTA_DATA_VERDICT={0x28, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xffffffffffffffff}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x3}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}]}]}, @NFTA_SET_ELEM_KEY={0x208, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0xe1, 0x1, "5cfdf16198150f023e6f3e1eb0b4781b3a2fff78310106efc51d7e477a60e3333639b781a7a5cd6fa7505945a6d00af07b138397f1ea25c780e481abf337e0041d594e22ac59fc7e573af97f0f44bef719b3e07ba2e97ba373984c6cfd68c12f52a093feccd104f2b0c2b400377d36b1b62fb52deff78a3261babe5beb6392996ae97ddbb6168b821eb282818562934556444dfa467eb91feeb67e91d442796dd4b340945b4837ccf9a011037d997b38f58e58a86e4a2346664e16ed8b6b968edb6f37c9817597a407102378cd00aba74b85ec22da70fa11708c5ce37e"}, @NFTA_DATA_VERDICT={0x30, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffb}, @NFTA_VERDICT_CODE={0x8}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xffffffffffffffff}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x1}]}, @NFTA_DATA_VALUE={0x90, 0x1, "4532d419801b0fb0573437b9666321eda79b3f9f5a0dec61bd7633e239c316e726571a1114acc8825852657ddac89fa80496a2815a929c68a0f2fc6ad6e84ee3315a9698ea15ab8e312e2f568007520b6925623620b8a89ed15b84cf7e6f0e00ad4af4306a0ea10c7aba4d43fb26490b8cee0c569d63f00ab72610a71dd3602853b8411e44be90519a94f49c"}, @NFTA_DATA_VERDICT={0x20, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffd}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffb}]}, @NFTA_DATA_VERDICT={0x40, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x3}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffe}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffc}]}]}, @NFTA_SET_ELEM_EXPIRATION={0xc, 0x5, 0x1, 0x0, 0x174}, @NFTA_SET_ELEM_DATA={0x2c, 0x2, 0x0, 0x1, [@NFTA_DATA_VERDICT={0x1c, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}]}, @NFTA_DATA_VERDICT={0xc, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffc}]}]}]}]}]}, @NFT_MSG_DELCHAIN={0x64, 0x5, 0xa, 0x201, 0x0, 0x0, {0xa, 0x0, 0x7}, [@NFTA_CHAIN_ID={0x8, 0xb, 0x1, 0x0, 0x1}, @NFTA_CHAIN_ID={0x8, 0xb, 0x1, 0x0, 0x2}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz0\x00'}, @NFTA_CHAIN_FLAGS={0x8}, @NFTA_CHAIN_ID={0x8, 0xb, 0x1, 0x0, 0x4}, @NFTA_CHAIN_FLAGS={0x8, 0xa, 0x1, 0x0, 0x4}, @NFTA_CHAIN_POLICY={0x8}, @NFTA_CHAIN_POLICY={0x8, 0x5, 0x1, 0x0, 0xfffffffffffffffc}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x7}}}, 0xda4}, 0x1, 0x0, 0x0, 0x4000}, 0x4040) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01010000000000000000010000000900010073797a30000000002c000000030a01020000000000000000010000000900010073797a30000000000900030073797a310000000034000000030a01040000000000000000010000010900030073797a320000000008000b40000000040900010073797a300000000014000000110001"], 0xa8}, 0x1, 0x0, 0x0, 0x8040}, 0x0) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f00000035c0)={0x0, 0x0, &(0x7f0000003580)={&(0x7f0000000340)=@newsa={0xf0, 0x10, 0x1, 0x0, 0x0, {{@in=@initdev={0xac, 0x1e, 0x1, 0x0}, @in6=@local, 0x0, 0x0, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x5c, 0x0, 0xffffffffffffffff}, {@in6=@remote, 0x14, 0x6c}, @in=@empty=0x14, {0x0, 0x800000000, 0x0, 0xfffffff7ffffffff, 0x0, 0x0, 0x1000000000000000}, {0x0, 0x4}, {}, 0x80000000, 0x0, 0x2, 0x1, 0x6, 0x2c}}, 0xf0}, 0x1, 0x0, 0x0, 0x4004050}, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)={0x38, 0x3e, 0x107, 0xfffffffe, 0x0, {0x1, 0x7c}, [@nested={0x4, 0x142}, @nested={0xc, 0x1, 0x0, 0x1, [@typed={0x6, 0x6, 0x0, 0x0, @str='\x80\n'}]}, @nested={0x11, 0x2, 0x0, 0x1, [@nested={0xc, 0x14, 0x0, 0x1, [@typed={0x8, 0x18, 0x0, 0x0, @u32=0x9}]}, @generic='V']}]}, 0x38}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) 411.52829ms ago: executing program 1 (id=2174): r0 = accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @initdev}, &(0x7f0000000040)=0x1c) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e24, 0x7, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x101}, 0x1c) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) r2 = accept$inet(0xffffffffffffffff, &(0x7f00000000c0)={0x2, 0x0, @broadcast}, &(0x7f0000000100)=0x10) connect$inet(r2, &(0x7f0000000140)={0x2, 0x4e22, @multicast2}, 0x10) r3 = accept4$ax25(0xffffffffffffffff, &(0x7f0000000180)={{0x3, @default}, [@null, @null, @bcast, @bcast, @netrom, @rose, @rose, @bcast]}, &(0x7f0000000200)=0x48, 0x100800) ppoll(&(0x7f0000000240)=[{r3, 0x962}, {r0, 0x4022}, {r0, 0x1}, {r0, 0x1004}, {r1, 0x244}, {r2, 0x400}, {r0}, {0xffffffffffffffff, 0x34ac179a2116e2de}, {r2, 0xa1e0}], 0x9, &(0x7f00000002c0)={0x77359400}, &(0x7f0000000300)={[0xfffffffffffffffd]}, 0x8) r4 = socket$phonet(0x23, 0x2, 0x1) sendto$phonet(r4, &(0x7f0000000340)="672cb2b933559764823a08278d79d06e44bd83b0e8dd0e7c95fd4df3e7e281a2257b00ac030e613cea76842e31c69d770b3289e72e4c43565ff2fb8960", 0x3d, 0x40000, &(0x7f0000000380)={0x23, 0xc2, 0x8, 0x9}, 0x10) socket$inet_mptcp(0x2, 0x1, 0x106) r5 = bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=@base={0xb, 0x1, 0xea, 0x7f, 0x10, 0xffffffffffffffff, 0x0, '\x00', 0x0, r1, 0x0, 0x2, 0x1}, 0x50) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000640)={0x1a, 0x10, &(0x7f0000000480)=@framed={{0x18, 0x0, 0x0, 0x0, 0x7fffffff, 0x0, 0x0, 0x0, 0xc0c}, [@map_idx={0x18, 0x0, 0x5, 0x0, 0x3}, @cb_func={0x18, 0x6, 0x4, 0x0, 0xfffffffffffffffb}, @ringbuf_output={{}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x79b3}}]}, &(0x7f0000000500)='syzkaller\x00', 0xb, 0x21, &(0x7f0000000540)=""/33, 0x41000, 0x20, '\x00', 0x0, @fallback=0x28, r3, 0x8, &(0x7f0000000580)={0x0, 0x1}, 0x8, 0x10, &(0x7f00000005c0)={0x4, 0xd, 0x3, 0x1}, 0x10, 0xffffffffffffffff, 0xffffffffffffffff, 0x1, 0x0, &(0x7f0000000600)=[{0x3, 0x3, 0x10, 0x5}], 0x10, 0x9742}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000740)={{r5}, &(0x7f0000000440), &(0x7f0000000700)=r6}, 0x20) socket$nl_netfilter(0x10, 0x3, 0xc) pipe(&(0x7f0000000780)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$AUDIT_TTY_GET(r8, &(0x7f0000000880)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000840)={&(0x7f0000000800)={0x10, 0x3f8, 0x200, 0x70bd2a, 0x25dfdbfb, "", ["", "", "", ""]}, 0x10}, 0x1, 0x0, 0x0, 0x4008000}, 0x0) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(0xffffffffffffffff, 0x84, 0x7b, &(0x7f00000008c0)={0x0, 0x80}, &(0x7f0000000900)=0x8) getsockopt$inet_sctp_SCTP_GET_PEER_ADDRS(r2, 0x84, 0x6c, &(0x7f0000000940)={r9, 0xe9, "a22fd06f3905e59b7747d0c8d4d3b878fc00c5e132143a077e6f016c1c5007e7d1c1ad2282c6b3d929dacd832bb8eeeb53703e85879e44067c4801622314712f68fb93fe2ccf6939ec0521f89eeb4148c930ca1e1c15743a7f0ebbf41c5b295b5059ad4e8bda69a2e11ed0f150117f008a063761cd56770ffab8181576530d8ccedd1db1b8582860dbe614d54937508984fec0cb77caef6569295387ef294d11f70c404687a11acbcc970ebac05d8f279018ab9934384b14c53f122d110513c839995f893c52990ba9f786f4dd0a05bd908b9a3e1851ef8ea46b88fb669cd00c996244b3c3223ef48e"}, &(0x7f0000000a40)=0xf1) ioctl$sock_bt_hidp_HIDPCONNDEL(r7, 0x400448c9, &(0x7f0000000a80)={@any, 0x9}) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000ac0)={'wlan0\x00'}) getpeername$inet(r8, &(0x7f0000000b00)={0x2, 0x0, @multicast2}, &(0x7f0000000b40)=0x10) r11 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000bc0), r7) sendmsg$MPTCP_PM_CMD_SUBFLOW_DESTROY(r8, &(0x7f0000000c80)={&(0x7f0000000b80)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000c40)={&(0x7f0000000c00)={0x24, r11, 0x100, 0x70bd28, 0x25dfdbff, {}, [@MPTCP_PM_ATTR_TOKEN={0x8, 0x4, 0x5}, @MPTCP_PM_ATTR_TOKEN={0x8, 0x4, 0x7}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000000}, 0x20004005) shutdown(r4, 0x0) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000cc0)) socket$alg(0x26, 0x5, 0x0) sendto$rose(r7, &(0x7f0000000d00)="939b520992f30687e4b93573726aa52fdcf6d746d2aca27c70129a9d8417a94ddf7c4c3f9b8673d655b87bb1506937f625557ad01787daafd2c8c16735c5a675858f756ce559ada99f0b8a864b31e65707692e", 0x53, 0x4000000, &(0x7f0000000d80)=@full={0xb, @dev={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, 0x0, [@netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @default]}, 0x40) syz_genetlink_get_family_id$ethtool(&(0x7f0000000dc0), r8) setsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, &(0x7f0000000e00)={r10, 0x5, 0x7, [0xfffd, 0xe5b, 0x400, 0x1, 0xfffb, 0x86e3, 0x9]}, 0x16) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r8, &(0x7f0000000f40)={&(0x7f0000000e40)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000f00)={&(0x7f0000000e80)={0x48, r11, 0x1, 0x70bd27, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_TOKEN={0x8, 0x4, 0x2}, @MPTCP_PM_ATTR_TOKEN={0x8, 0x4, 0x7}, @MPTCP_PM_ATTR_ADDR_REMOTE={0x4}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x5}, @MPTCP_PM_ATTR_TOKEN={0x8, 0x4, 0xffffffff}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x6}, @MPTCP_PM_ATTR_TOKEN={0x8, 0x4, 0x6}]}, 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x4006000) 354.524462ms ago: executing program 2 (id=2175): mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x0, 0x41071, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xa000)=nil, 0xa000, 0x2, 0x2172, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="01000000030000000200000004"], 0x48) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1b00000000000000000000000080000000000000", @ANYRES32, @ANYBLOB="000000000000000000000000000000000000000063cb822755a619d6c1481536a886cbea663808c0eef656ec3f2653216cafdb122c63cb947fee4a5be0ffa38c13e96aa1295c101ab618e87a47a8e595b997cc78f6aab3679e05e1ef66dc0e8c4f", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x10, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000008900000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000fdffffff7b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b702000000000000850000007500000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000b00)={&(0x7f0000000ac0)='mm_page_free_batched\x00', r2}, 0x10) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x300000d, 0x6052, r3, 0x1000) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x5, 0x20000000ec071, 0xffffffffffffffff, 0x0) 284.639265ms ago: executing program 4 (id=2176): socket$nl_netfilter(0x10, 0x3, 0xc) r0 = socket$alg(0x26, 0x5, 0x0) unshare(0x2c020400) bind$alg(r0, &(0x7f0000000280)={0x26, 'hash\x00', 0x0, 0x0, 'sha384-generic\x00'}, 0x58) r1 = accept4(r0, 0x0, 0x0, 0x80800) recvmmsg$unix(r1, 0x0, 0x0, 0x0, 0x0) socket$inet_sctp(0x2, 0x5, 0x84) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f0000000280)={0x0, 0x1c, &(0x7f0000000000)=[@in6={0xa, 0x0, 0x0, @private0={0xfc, 0x0, '\x00', 0x1}, 0x9}]}, &(0x7f00000002c0)=0x10) getsockopt$inet_sctp6_SCTP_MAX_BURST(r2, 0x84, 0x83, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000300)=0x8) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r1, 0x84, 0x6, &(0x7f0000000000)={r3, @in6={{0xa, 0x4e20, 0xdc2, @local}}}, &(0x7f0000000180)=0x84) 267.566447ms ago: executing program 1 (id=2177): socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000200)='ns/pid_for_children\x00') r0 = socket(0x8, 0x3, 0x0) ioctl$sock_netrom_SIOCADDRT(r0, 0x6180, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000300)='ns/ipc\x00') sendmsg$FOU_CMD_ADD(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)=ANY=[@ANYRESDEC=r1, @ANYBLOB="3904cc9a0d2159b34144761f18008db317f85e5454c34f17f0863ca7c08d24f04e2af5000000a67a905e91c653548dd8a7ec56afc0702ec71fbdbd7e0fb53da33ba4d9de925808630527b417", @ANYBLOB, @ANYRESOCT], 0x38}}, 0x4000) unshare(0x6a040000) r2 = socket$inet_udp(0x2, 0x2, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000240)={0x0, 0xffffffffffffffff, 0x0, 0x7, &(0x7f0000000000)='cgroup\x00'}, 0x30) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) epoll_wait(r3, 0x0, 0x0, 0x5) setsockopt$inet_MCAST_JOIN_GROUP(r2, 0x0, 0x2a, &(0x7f0000000180)={0x2, {{0x2, 0x0, @multicast2}}}, 0x88) setsockopt$inet_MCAST_MSFILTER(r2, 0x0, 0x30, &(0x7f0000000600)=ANY=[], 0x110) setsockopt$inet_group_source_req(r2, 0x0, 0x2b, 0x0, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc2(0x0, 0xffffffffffffffff) socket$l2tp(0x2, 0x2, 0x73) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0x0) sendmsg$TIPC_NL_NET_SET(r4, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000240)=ANY=[], 0x30}}, 0x0) r5 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_TIMESTAMPING(r5, 0x1, 0x41, &(0x7f0000000200)=0x6f9a, 0x4) connect$inet(r5, &(0x7f0000000480)={0x2, 0x0, @local}, 0x10) sendmmsg(r5, &(0x7f0000007fc0), 0x800001d, 0x0) 266.629804ms ago: executing program 0 (id=2178): socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) r0 = socket(0x840000000002, 0x3, 0xfa) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_SWAP(r1, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f00000003c0)={0x1c, 0x6, 0x6, 0x401, 0x0, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}}, 0x0) connect$inet(r0, &(0x7f0000000140)={0x2, 0x0, @remote}, 0x10) sendmmsg$inet(r0, &(0x7f0000005240), 0x4000095, 0x0) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0xfffffffffefffff6, 0x20031, 0xffffffffffffffff, 0x0) epoll_wait(0xffffffffffffffff, 0x0, 0x0, 0x7fff) r2 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x100002, 0x0) write$cgroup_type(r2, 0x0, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r4, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r5}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x3}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_START_AP(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x74, r4, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r5}, @void}}, [@beacon=[@NL80211_ATTR_BEACON_HEAD={0x28, 0xe, {{{}, {}, @broadcast, @device_a, @from_mac}, 0x0, @default, 0x1, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}}], @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}], @NL80211_ATTR_BEACON_INTERVAL={0x8}, @NL80211_ATTR_DTIM_PERIOD={0x8}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_AUTH_TYPE={0x8}, @NL80211_ATTR_EXTERNAL_AUTH_SUPPORT={0x4}]}, 0x74}}, 0x0) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000080)='ns/ipc\x00') unshare(0x6a040000) r6 = socket(0x8, 0x3, 0x0) unshare(0x0) ioctl$IMGETCOUNT(r6, 0x40106183, 0x0) 51.924559ms ago: executing program 2 (id=2179): bpf$PROG_LOAD(0x5, &(0x7f0000000580)={0x0, 0xc, &(0x7f0000000440)=@framed={{}, [@ringbuf_output={{}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffad, 0x0, 0x0, 0x0}, 0x90) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r0, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000680)={0x10, 0x4, &(0x7f0000000380)=ANY=[@ANYBLOB="1802000000c400000000000000000000850000003e00000095"], &(0x7f00000000c0)='GPL\x00'}, 0x90) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000023c0)=ANY=[@ANYBLOB="1200000004000000080000000b"], 0x48) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000540)=ANY=[@ANYRES32=r2, @ANYRES32=r1, @ANYBLOB='\a'], 0x10) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000100)={r2, &(0x7f0000000240), &(0x7f0000000140)=@tcp6=r0}, 0x20) sendmmsg$inet6(r0, &(0x7f0000002440)=[{{0x0, 0x0, &(0x7f0000000980)=[{&(0x7f0000000600)="e2", 0x1}], 0x1}}, {{0x0, 0x1, &(0x7f0000000480), 0x14}}], 0x400, 0x10) (fail_nth: 4) 49.700087ms ago: executing program 2 (id=2180): r0 = socket$kcm(0x10, 0x400000002, 0x0) (async) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r2 = socket(0x400000000010, 0x3, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0xd, 0x5, &(0x7f0000000040)=@framed={{0xa6, 0xa, 0x0, 0x0, 0x0, 0x61, 0x11, 0xc}, [@initr0]}, &(0x7f0000000000)='GPL\x00'}, 0x80) syz_genetlink_get_family_id$ethtool(&(0x7f0000000380), r3) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x4e23, @local}, 0x10) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) r5 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r5, 0x29, 0x20, &(0x7f0000000080)={@private0, 0x8000000, 0x0, 0xff, 0x1}, 0x20) (async) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r5, 0x29, 0x20, &(0x7f0000000180)={@local, 0x8000000, 0x2, 0x0, 0x0, 0x9}, 0x20) (async) getsockopt$bt_hci(r4, 0x84, 0x1f, &(0x7f0000000080)=""/4057, &(0x7f0000001180)=0xfd9) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000001440)={0xffffffffffffffff, 0x0, 0x0}, 0x10) (async) ioctl$ifreq_SIOCGIFINDEX_team(r3, 0x8933, 0x0) sendmsg$nl_generic(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000001700)=ANY=[@ANYBLOB], 0x18}, 0x1, 0x0, 0x0, 0x8001}, 0x4000) recvmmsg(r3, &(0x7f0000000e40), 0x0, 0x40010000, 0x0) (async) r6 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0x25dfdbfb, {0x0, 0x0, 0x0, r7, {0x0, 0x1}, {0xffff, 0xffff}, {0xffff, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x4000) (async) sendmsg$nl_route_sched(r2, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000140)=@newtfilter={0x34, 0x2c, 0xd27, 0x30bd29, 0x25dfdbfc, {0x0, 0x0, 0x0, r7, {0x0, 0xf}, {}, {0x7, 0x9}}, [@filter_kind_options=@f_flower={{0xb}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x24000014}, 0x20084084) (async) recvfrom(r0, 0x0, 0x0, 0x40000000, 0x0, 0x0) (async) r8 = socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) (async) r10 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), r8) ioctl$sock_SIOCGIFINDEX_80211(r9, 0x8933, &(0x7f0000000240)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r8, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)={0x28, r10, 0x1, 0x70bd29, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r11}, @void}}, [@NL80211_ATTR_BSSID={0xa, 0xf5, @random="0c1a0d1000"}]}, 0x28}, 0x1, 0x0, 0x0, 0x40000}, 0x816) (async) sendmsg$inet(r0, &(0x7f0000000100)={0x0, 0x2, &(0x7f0000000080)=[{&(0x7f0000000140)="600000002e000d190a762d7f089e", 0xfca2}, {&(0x7f0000000280)="68cabf2dfb58fc0a1d6b689866f05d490d010088a8ffff0200258f2e4409b8f9e6aaeb88bea123dc2c6726e89b1ae2f6e8bcb5ee52dcd7298d39093c510293bca0b646a3ce904f6e6b788b3204c233e60ddc", 0x52}], 0x2}, 0x0) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x5, 0x5, &(0x7f00000000c0)=ANY=[@ANYBLOB="18020000000000000000000000000000870a000000000000637e00000000000095"], &(0x7f0000000040)='syzkaller\x00', 0x6}, 0x94) 15.619601ms ago: executing program 0 (id=2181): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000002640)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000480)=ANY=[@ANYBLOB="180000090007010427bd7000fddbdf2501000002a3870000805599e5bdbf05bd6b191d46dfada3157460c93bf354932cdfa7821097bfb3eea3166fba70"], 0x18}, 0x1, 0x0, 0x0, 0x81}, 0x2004c8d0) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$EXT4_IOC_SWAP_BOOT(r1, 0x6611) socket$inet(0x2, 0x3, 0x7) socket$nl_generic(0x10, 0x3, 0x10) r2 = epoll_create1(0x0) syz_emit_ethernet(0x11, &(0x7f0000000700)=ANY=[@ANYBLOB], 0x0) r3 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000480)=ANY=[@ANYBLOB], 0x48) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x11, 0xf, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000800000000bf91000000000000b702000043e7b5538500000085000000b70000000000000095"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000140)='kmem_cache_free\x00', r4}, 0x10) socket$xdp(0x2c, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x4, 0x16, &(0x7f0000000140)=ANY=[@ANYBLOB="61124c00000000006113500000000000bf2000000000000007000000080000002d0301000000000095000000000000006926000000000000bf67000000000000150600000fff070067060000200000006a0200000ee60000bf050000000000004e350000000000006507000002000000070700004a0000000f75000000000000bf54000000000000070400000400f9ff3d53010000000000840400000000000073720000000000009500000000000000db13d5d8b741f2cdaabc8383caf56b8c2b84a8d09535a157f9005bd38addaa65b925f1ffed25b8b9e2a095d2c51ef45c5588ec78c7f32946b17cecfe54c53ab530c58b67851b7e0e82452a083b98a6aa766401047d150203b0417edef332233b081df18961d6822d133bf72a4de1c2ea17f04537fc211576846ac629d1d93265ba4580047a9dc88de358ce795731891a2031de4e09740c64e5506f991ed4785a9773a433e0db9c1a7d4ab9d658ce9cfdb4db3bed62bcb2bc91ddcdfadfe6d4421c49fb6641cbf56914e76702f673b586c767562a90a3967093b000e3806f825f1d0da2a304e06543b56d35235d78b7a7fe912971aab876022e96f5143b6234f5a6b701690b07fb664a44e22b72e843e7cf55f394cf75d1cd3ee79a25fb98cc45b3fde43e42e150d4a2fddd9a97677400ef0bd697d135324ce480c2960344de346bd511dea4ff7a07400b2d12dd1a8c4c300aee5f948777085ca142b79dfc3aca5fadaa0532ab0572169f68584ff2ee063bc7e75ecd5cc8973464629ba236e3ff97f6033d0800000000000000cef54a60aff12590a50ef147e3e640193d00263003a4ef412420a070dd0327e47c8c7abb77b4b53874788d7e2e5d554de4713db957afb56d4673f1b904c5a317d3670003000000183fb7d36e173044f4ab34"], &(0x7f0000000100)='GPL\x00'}, 0x48) ppoll(&(0x7f0000000500)=[{r3}], 0x1, 0x0, 0x0, 0x0) r5 = socket(0x2a, 0x2, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000580)=@gettaction={0x14, 0x32, 0x1, 0x70bd2c, 0x25dfdbfb}, 0x14}}, 0x0) getsockname$packet(r5, &(0x7f0000000540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000004c0)='./cgroup.cpu/syz0\x00', 0x200002, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000440)=@newqdisc={0x24, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r6, {0x0, 0x1}, {0xffff, 0xffff}}}, 0x24}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000680)=@newtfilter={0x38, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r6, {0xfffa, 0x4}, {}, {0x1c, 0xfff9}}, [@filter_kind_options=@f_fw={{0x7}, {0xc, 0x2, [@TCA_FW_CLASSID={0x8, 0x1, {0x4, 0xe}}]}}]}, 0x38}}, 0x24000000) r7 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r7, &(0x7f00000002c0), 0x40000000000009f, 0x0) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x40000000000, 0x3, 0x4, 0x0, 0x0, 0x3}, 0x0, &(0x7f00000002c0)={0x3ff, 0x0, 0x0, 0x9, 0x0, 0x0, 0x7fffffff}, 0x0, 0x0) r8 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TLS_TX(r8, 0x6, 0x1, 0x0, 0x0) bpf$MAP_CREATE(0x100000000000000, &(0x7f0000000140)=@base={0xa, 0x16, 0xb3, 0x7f, 0x0, 0xffffffffffffffff, 0x0, '\x00', r6, 0xffffffffffffffff, 0x20000}, 0x50) epoll_pwait(r2, &(0x7f0000000200)=[{}, {}, {}, {}, {}, {}], 0x6, 0x0, &(0x7f0000000040)={[0xc23]}, 0x8) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) close(0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0xfffff000) 0s ago: executing program 1 (id=2182): r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000f00), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000f40)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_REGISTER_FRAME(r1, &(0x7f0000002000)={0x0, 0x0, &(0x7f0000001fc0)={&(0x7f0000000f80)={0x28, r2, 0x1, 0x70bd29, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_FRAME_MATCH={0x4}, @NL80211_ATTR_FRAME_TYPE={0x6, 0x65, 0x1}]}, 0x28}}, 0x44) kernel console output (not intermixed with test programs): ] ? aa_file_perm+0x3e7/0xed0 [ 106.628082][ T8088] ? ref_tracker_alloc+0x318/0x460 [ 106.628096][ T8088] ? __lock_acquire+0xab9/0xd20 [ 106.628108][ T8088] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 106.628129][ T8088] ? tun_get+0x1c/0x2f0 [ 106.628145][ T8088] ? tun_get+0x1c/0x2f0 [ 106.628164][ T8088] ? tun_get+0x1c/0x2f0 [ 106.628180][ T8088] tun_chr_write_iter+0x113/0x200 [ 106.628195][ T8088] vfs_write+0x54b/0xa90 [ 106.628213][ T8088] ? __pfx_tun_chr_write_iter+0x10/0x10 [ 106.628227][ T8088] ? __pfx_vfs_write+0x10/0x10 [ 106.628246][ T8088] ? __fget_files+0x2a/0x420 [ 106.628268][ T8088] ksys_write+0x145/0x250 [ 106.628282][ T8088] ? __pfx_ksys_write+0x10/0x10 [ 106.628293][ T8088] ? rcu_is_watching+0x15/0xb0 [ 106.628310][ T8088] ? do_syscall_64+0xbe/0x3b0 [ 106.628327][ T8088] do_syscall_64+0xfa/0x3b0 [ 106.628340][ T8088] ? lockdep_hardirqs_on+0x9c/0x150 [ 106.628355][ T8088] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 106.628366][ T8088] ? clear_bhb_loop+0x60/0xb0 [ 106.628381][ T8088] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 106.628392][ T8088] RIP: 0033:0x7f767198e929 [ 106.628404][ T8088] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 106.628412][ T8088] RSP: 002b:00007f76728dd038 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 106.628425][ T8088] RAX: ffffffffffffffda RBX: 00007f7671bb5fa0 RCX: 00007f767198e929 [ 106.628433][ T8088] RDX: 0000000000000036 RSI: 0000200000000100 RDI: 0000000000000003 [ 106.628439][ T8088] RBP: 00007f76728dd090 R08: 0000000000000000 R09: 0000000000000000 [ 106.628445][ T8088] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 106.628451][ T8088] R13: 0000000000000000 R14: 00007f7671bb5fa0 R15: 00007ffeaf35b238 [ 106.628468][ T8088] [ 107.294792][ T8119] netlink: 4 bytes leftover after parsing attributes in process `syz.3.569'. [ 107.952789][ T8110] netlink: 'syz.3.569': attribute type 1 has an invalid length. [ 107.966413][ T8110] netlink: 1 bytes leftover after parsing attributes in process `syz.3.569'. [ 108.036852][ T8117] lo speed is unknown, defaulting to 1000 [ 108.154067][ T8134] netlink: 12 bytes leftover after parsing attributes in process `syz.3.576'. [ 108.368950][ T8154] netlink: 12 bytes leftover after parsing attributes in process `syz.3.581'. [ 108.369578][ T8155] netlink: 16402 bytes leftover after parsing attributes in process `syz.1.580'. [ 108.402418][ T8150] netlink: 16402 bytes leftover after parsing attributes in process `syz.1.580'. [ 108.447716][ T8155] IPVS: set_ctl: invalid protocol: 8345 172.30.1.2:20003 [ 108.478937][ T8150] Cannot find add_set index 3 as target [ 108.551633][ T8160] ref_tracker: memory allocation failure, unreliable refcount tracker. [ 108.551991][ T8150] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 108.738031][ T8175] netlink: 16 bytes leftover after parsing attributes in process `syz.0.588'. [ 109.536474][ T8180] netlink: 8 bytes leftover after parsing attributes in process `syz.1.589'. [ 109.569007][ T8181] bond0: entered promiscuous mode [ 109.576969][ T8181] bond_slave_0: entered promiscuous mode [ 109.584394][ T8181] bond_slave_1: entered promiscuous mode [ 109.595868][ T8181] bond2: entered promiscuous mode [ 109.620889][ T8181] bond0: left promiscuous mode [ 109.626050][ T8181] bond_slave_0: left promiscuous mode [ 109.632787][ T8181] bond_slave_1: left promiscuous mode [ 109.638458][ T8181] bond2: left promiscuous mode [ 109.648879][ T8171] lo speed is unknown, defaulting to 1000 [ 109.666308][ T8186] netlink: 32 bytes leftover after parsing attributes in process `syz.3.592'. [ 109.669407][ T8175] lo speed is unknown, defaulting to 1000 [ 109.769710][ T8195] netlink: 'syz.1.595': attribute type 1 has an invalid length. [ 109.780571][ T8195] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 109.846333][ T8195] sch_tbf: burst 0 is lower than device veth0_to_team mtu (1514) ! [ 110.085246][ T8214] FAULT_INJECTION: forcing a failure. [ 110.085246][ T8214] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 110.098654][ T8214] CPU: 0 UID: 0 PID: 8214 Comm: syz.3.602 Not tainted 6.16.0-rc5-syzkaller-01400-g8c2e602225f0 #0 PREEMPT(full) [ 110.098673][ T8214] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 110.098680][ T8214] Call Trace: [ 110.098684][ T8214] [ 110.098689][ T8214] dump_stack_lvl+0x189/0x250 [ 110.098709][ T8214] ? __pfx____ratelimit+0x10/0x10 [ 110.098724][ T8214] ? __pfx_dump_stack_lvl+0x10/0x10 [ 110.098738][ T8214] ? __pfx__printk+0x10/0x10 [ 110.098762][ T8214] should_fail_ex+0x414/0x560 [ 110.098782][ T8214] _copy_to_user+0x31/0xb0 [ 110.098797][ T8214] simple_read_from_buffer+0xe1/0x170 [ 110.098815][ T8214] proc_fail_nth_read+0x1df/0x250 [ 110.098832][ T8214] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 110.098850][ T8214] ? rw_verify_area+0x258/0x650 [ 110.098861][ T8214] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 110.098877][ T8214] vfs_read+0x200/0x980 [ 110.098894][ T8214] ? __pfx___mutex_lock+0x10/0x10 [ 110.098910][ T8214] ? __pfx_vfs_read+0x10/0x10 [ 110.098923][ T8214] ? __fget_files+0x2a/0x420 [ 110.098941][ T8214] ? __fget_files+0x3a0/0x420 [ 110.098954][ T8214] ? __fget_files+0x2a/0x420 [ 110.098974][ T8214] ksys_read+0x145/0x250 [ 110.098989][ T8214] ? __pfx_ksys_read+0x10/0x10 [ 110.098999][ T8214] ? rcu_is_watching+0x15/0xb0 [ 110.099017][ T8214] ? do_syscall_64+0xbe/0x3b0 [ 110.099035][ T8214] do_syscall_64+0xfa/0x3b0 [ 110.099048][ T8214] ? lockdep_hardirqs_on+0x9c/0x150 [ 110.099062][ T8214] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 110.099073][ T8214] ? clear_bhb_loop+0x60/0xb0 [ 110.099087][ T8214] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 110.099097][ T8214] RIP: 0033:0x7f0319f8d33c [ 110.099115][ T8214] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 110.099124][ T8214] RSP: 002b:00007f031ad93030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 110.099137][ T8214] RAX: ffffffffffffffda RBX: 00007f031a1b5fa0 RCX: 00007f0319f8d33c [ 110.099145][ T8214] RDX: 000000000000000f RSI: 00007f031ad930a0 RDI: 0000000000000005 [ 110.099152][ T8214] RBP: 00007f031ad93090 R08: 0000000000000000 R09: 0000000000000000 [ 110.099159][ T8214] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 110.099165][ T8214] R13: 0000000000000000 R14: 00007f031a1b5fa0 R15: 00007ffc9c220638 [ 110.099185][ T8214] [ 111.275337][ T8235] __nla_validate_parse: 1 callbacks suppressed [ 111.275351][ T8235] netlink: 8 bytes leftover after parsing attributes in process `syz.1.606'. [ 111.353812][ T8231] lo speed is unknown, defaulting to 1000 [ 111.357714][ T8239] veth0_to_bridge: entered promiscuous mode [ 111.425295][ T8229] veth0_to_bridge: left promiscuous mode [ 111.748948][ T8259] syzkaller0: entered allmulticast mode [ 111.762294][ T8259] syzkaller0 (unregistering): left allmulticast mode [ 111.799585][ T8257] lo speed is unknown, defaulting to 1000 [ 111.814224][ T8261] ipvlan0: entered promiscuous mode [ 111.822165][ T8261] 8021q: adding VLAN 0 to HW filter on device ipvlan0 [ 111.829560][ T8261] bond0: (slave ipvlan0): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 111.968774][ T8274] netlink: 52 bytes leftover after parsing attributes in process `syz.2.620'. [ 111.978938][ T8274] netlink: 52 bytes leftover after parsing attributes in process `syz.2.620'. [ 111.988047][ T8274] netlink: 52 bytes leftover after parsing attributes in process `syz.2.620'. [ 112.000225][ T8274] netlink: 16 bytes leftover after parsing attributes in process `syz.2.620'. [ 112.017438][ T8275] netlink: 16 bytes leftover after parsing attributes in process `syz.1.619'. [ 112.224984][ T8286] netlink: 56 bytes leftover after parsing attributes in process `syz.0.623'. [ 112.335288][ T5843] Bluetooth: hci4: link tx timeout [ 112.337642][ T8290] netlink: zone id is out of range [ 112.341032][ T5843] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 112.347283][ T8290] netlink: zone id is out of range [ 112.363620][ T8290] netlink: zone id is out of range [ 112.368885][ T8290] netlink: zone id is out of range [ 112.377423][ T8290] netlink: zone id is out of range [ 112.388552][ T8290] netlink: zone id is out of range [ 112.395028][ T8290] netlink: zone id is out of range [ 112.400525][ T8290] netlink: zone id is out of range [ 112.405691][ T8290] netlink: zone id is out of range [ 112.459821][ T8298] netlink: 8 bytes leftover after parsing attributes in process `syz.2.627'. [ 112.567115][ T8304] netlink: 'syz.2.629': attribute type 30 has an invalid length. [ 112.721414][ T8310] netlink: 'syz.2.630': attribute type 10 has an invalid length. [ 112.735367][ T8310] team0: Port device dummy0 added [ 112.741611][ T8310] netlink: 'syz.2.630': attribute type 10 has an invalid length. [ 112.754161][ T8310] team0: Port device dummy0 removed [ 112.765867][ T8310] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 112.877291][ T8327] netlink: 104 bytes leftover after parsing attributes in process `syz.1.636'. [ 113.173554][ T8360] netlink: 16 bytes leftover after parsing attributes in process `syz.0.644'. [ 113.237983][ T8362] lo speed is unknown, defaulting to 1000 [ 113.287289][ T8373] xt_hashlimit: size too large, truncated to 1048576 [ 113.318875][ T8372] batadv_slave_0: entered allmulticast mode [ 113.331379][ T8371] x_tables: duplicate underflow at hook 2 [ 113.337184][ T8371] x_tables: duplicate underflow at hook 2 [ 113.345687][ T8371] x_tables: duplicate underflow at hook 2 [ 113.351544][ T8371] x_tables: duplicate underflow at hook 2 [ 113.357396][ T8371] x_tables: duplicate underflow at hook 2 [ 113.363880][ T8371] x_tables: duplicate underflow at hook 2 [ 113.372465][ T8371] x_tables: duplicate underflow at hook 2 [ 113.401333][ T8371] x_tables: duplicate underflow at hook 2 [ 113.414071][ T8371] x_tables: duplicate underflow at hook 2 [ 113.444837][ T8371] x_tables: duplicate underflow at hook 2 [ 113.554567][ T8378] tipc: Resetting bearer [ 113.645889][ T8378] tipc: Resetting bearer [ 113.697856][ T8378] bond0: left allmulticast mode [ 113.706030][ T8378] bond0: left promiscuous mode [ 113.733331][ T7551] netdevsim netdevsim4 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 113.753413][ T12] netdevsim netdevsim4 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 113.770727][ T12] netdevsim netdevsim4 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 113.783095][ T12] netdevsim netdevsim4 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 113.873028][ T8396] lo speed is unknown, defaulting to 1000 [ 113.952673][ T8402] C: renamed from team_slave_0 [ 114.096532][ T8415] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 114.128641][ T8403] netlink: 'syz.1.654': attribute type 39 has an invalid length. [ 114.255382][ T8436] IPVS: sync thread started: state = BACKUP, mcast_ifn = vlan0, syncid = 1, id = 0 [ 114.265332][ T8432] IPVS: stopping backup sync thread 8436 ... [ 114.288406][ T8431] lo speed is unknown, defaulting to 1000 [ 114.430212][ T51] Bluetooth: hci4: command 0x0405 tx timeout [ 114.605283][ T8448] lo speed is unknown, defaulting to 1000 [ 114.973018][ T8466] 8021q: adding VLAN 0 to HW filter on device bond5 [ 115.193104][ T8473] veth5: entered promiscuous mode [ 115.222090][ T8473] bond5: (slave veth5): Enslaving as an active interface with an up link [ 115.280954][ T8465] lo speed is unknown, defaulting to 1000 [ 115.489882][ T8497] netlink: 'syz.3.685': attribute type 16 has an invalid length. [ 115.497672][ T8497] netlink: 'syz.3.685': attribute type 17 has an invalid length. [ 115.649772][ T8515] IPv6: NLM_F_REPLACE set, but no existing node found! [ 115.676370][ T8497] bridge0: port 2(bridge_slave_1) entered disabled state [ 115.684031][ T8497] bridge0: port 1(bridge_slave_0) entered disabled state [ 115.697076][ T8517] netlink: 'syz.4.691': attribute type 21 has an invalid length. [ 115.790272][ T8497] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 115.802975][ T8497] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 115.919943][ T6012] lo speed is unknown, defaulting to 1000 [ 115.922511][ T8528] IPVS: sync thread started: state = BACKUP, mcast_ifn = vlan0, syncid = 1, id = 0 [ 115.929340][ T6012] syz2: Port: 1 Link DOWN [ 115.964199][ T8517] netlink: 'syz.4.691': attribute type 5 has an invalid length. [ 115.979988][ T8517] netlink: 'syz.4.691': attribute type 6 has an invalid length. [ 115.998473][ T13] netdevsim netdevsim3 eth0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 116.018764][ T13] netdevsim netdevsim3 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 116.039896][ T13] netdevsim netdevsim3 eth1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 116.053162][ T13] netdevsim netdevsim3 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 116.073196][ T13] netdevsim netdevsim3 eth2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 116.089651][ T13] netdevsim netdevsim3 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 116.098270][ T8532] netlink: 'syz.1.694': attribute type 1 has an invalid length. [ 116.102237][ T13] netdevsim netdevsim3 eth3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 116.114813][ T13] netdevsim netdevsim3 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 116.365130][ T8556] lo speed is unknown, defaulting to 1000 [ 116.437106][ T8557] __nla_validate_parse: 15 callbacks suppressed [ 116.437147][ T8557] netlink: 72 bytes leftover after parsing attributes in process `syz.2.704'. [ 116.555808][ T8561] lo speed is unknown, defaulting to 1000 [ 116.686319][ T8577] netlink: 8 bytes leftover after parsing attributes in process `syz.4.707'. [ 116.834915][ T8582] Cannot find add_set index 0 as target [ 116.847839][ T8582] Cannot find add_set index 0 as target [ 117.245433][ T8604] bridge0: entered promiscuous mode [ 117.501627][ T8621] lo speed is unknown, defaulting to 1000 [ 117.536804][ T8626] netlink: 4 bytes leftover after parsing attributes in process `syz.2.722'. [ 117.592778][ T8631] tap0: tun_chr_ioctl cmd 1074025676 [ 117.598187][ T8631] tap0: owner set to 0 [ 117.839158][ T8650] netlink: 'syz.0.728': attribute type 1 has an invalid length. [ 117.845045][ T8653] netlink: 44 bytes leftover after parsing attributes in process `syz.4.730'. [ 117.887801][ T8650] netlink: 1 bytes leftover after parsing attributes in process `syz.0.728'. [ 117.918126][ T8650] netlink: 4 bytes leftover after parsing attributes in process `syz.0.728'. [ 118.045901][ T8660] netlink: 'syz.2.731': attribute type 10 has an invalid length. [ 118.055209][ T8660] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 118.088080][ T8660] bond0: (slave batadv0): Enslaving as an active interface with an up link [ 118.452612][ T8693] netlink: 'syz.1.741': attribute type 1 has an invalid length. [ 118.473682][ T8693] netlink: 44 bytes leftover after parsing attributes in process `syz.1.741'. [ 118.593106][ T8695] netlink: 12 bytes leftover after parsing attributes in process `syz.3.742'. [ 118.644701][ T8697] netlink: 16 bytes leftover after parsing attributes in process `syz.3.742'. [ 118.653785][ T8697] netlink: 4 bytes leftover after parsing attributes in process `syz.3.742'. [ 118.722350][ T8695] 8021q: adding VLAN 0 to HW filter on device bond2 [ 118.834369][ T8703] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 119.160207][ T8725] validate_nla: 1 callbacks suppressed [ 119.167387][ T8725] netlink: 'syz.3.753': attribute type 62 has an invalid length. [ 119.200773][ T8727] netlink: 'syz.1.751': attribute type 3 has an invalid length. [ 119.219599][ T8727] netlink: 'syz.1.751': attribute type 2 has an invalid length. [ 119.240612][ T8727] netlink: 'syz.1.751': attribute type 2 has an invalid length. [ 119.309295][ T8729] 8021q: adding VLAN 0 to HW filter on device bond3 [ 119.317255][ T8737] netlink: 'syz.1.751': attribute type 3 has an invalid length. [ 119.326087][ T8737] netlink: 'syz.1.751': attribute type 4 has an invalid length. [ 119.334010][ T8735] veth0: entered promiscuous mode [ 119.342468][ T8737] netlink: 'syz.1.751': attribute type 5 has an invalid length. [ 119.345750][ T8736] macvlan4: entered promiscuous mode [ 119.350401][ T8737] netlink: 'syz.1.751': attribute type 6 has an invalid length. [ 119.350413][ T8737] netlink: 'syz.1.751': attribute type 7 has an invalid length. [ 119.357016][ T8736] macvlan4: entered allmulticast mode [ 119.363522][ T8737] netlink: 'syz.1.751': attribute type 7 has an invalid length. [ 119.393114][ T8736] bond0: entered allmulticast mode [ 119.435491][ T8736] bond0: entered promiscuous mode [ 119.454750][ T8736] 8021q: adding VLAN 0 to HW filter on device macvlan4 [ 119.467457][ T8736] bond3: (slave macvlan4): Enslaving as an active interface with an up link [ 119.502276][ T8734] veth0: left promiscuous mode [ 119.598428][ T8754] sctp: [Deprecated]: syz.3.759 (pid 8754) Use of int in max_burst socket option deprecated. [ 119.598428][ T8754] Use struct sctp_assoc_value instead [ 119.770304][ T30] audit: type=1804 audit(1752432654.561:4): pid=8766 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.1.764" name="/newroot/166/cgroup.controllers" dev="tmpfs" ino=874 res=1 errno=0 [ 119.834653][ T30] audit: type=1800 audit(1752432654.561:5): pid=8766 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.764" name="cgroup.controllers" dev="tmpfs" ino=874 res=0 errno=0 [ 119.923438][ T8779] lo speed is unknown, defaulting to 1000 [ 120.341564][ T8814] net_ratelimit: 9 callbacks suppressed [ 120.341580][ T8814] openvswitch: netlink: IP tunnel attribute has 12 unknown bytes. [ 121.386391][ T8831] netlink: zone id is out of range [ 121.392761][ T8831] netlink: zone id is out of range [ 121.398073][ T8831] netlink: zone id is out of range [ 121.412264][ T8831] netlink: zone id is out of range [ 121.417861][ T8831] netlink: zone id is out of range [ 121.425409][ T8831] netlink: zone id is out of range [ 121.430904][ T8831] netlink: zone id is out of range [ 121.437317][ T8831] netlink: zone id is out of range [ 121.448628][ T8831] netlink: zone id is out of range [ 122.029531][ T8823] lo speed is unknown, defaulting to 1000 [ 122.277880][ T8844] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 122.295871][ T8844] batadv0: entered promiscuous mode [ 122.327357][ T8844] batadv0: entered allmulticast mode [ 122.336782][ T8844] bond0: (slave batadv0): Enslaving as an active interface with an up link [ 122.778928][ T8857] team0 (unregistering): Port device team_slave_0 removed [ 122.787545][ T8857] team0 (unregistering): Port device team_slave_1 removed [ 123.055286][ T8872] : renamed from bond_slave_0 [ 123.325581][ T8891] __nla_validate_parse: 15 callbacks suppressed [ 123.325594][ T8891] netlink: 52 bytes leftover after parsing attributes in process `syz.4.797'. [ 123.850711][ T8911] netlink: 48 bytes leftover after parsing attributes in process `syz.2.803'. [ 123.866383][ T8914] netlink: 212408 bytes leftover after parsing attributes in process `syz.4.805'. [ 123.883578][ T8914] IPVS: set_ctl: invalid protocol: 60 100.1.1.2:20004 [ 123.924515][ T8917] netlink: 8 bytes leftover after parsing attributes in process `syz.0.806'. [ 123.978232][ T8921] pim6reg: entered allmulticast mode [ 124.172490][ T8931] netlink: 248 bytes leftover after parsing attributes in process `syz.2.810'. [ 125.150943][ T8961] netlink: 20 bytes leftover after parsing attributes in process `syz.3.818'. [ 125.371193][ T8963] lo speed is unknown, defaulting to 1000 [ 125.411393][ T8968] sit0: entered promiscuous mode [ 125.419526][ T8968] validate_nla: 6 callbacks suppressed [ 125.419538][ T8968] netlink: 'syz.2.821': attribute type 1 has an invalid length. [ 125.434877][ T8968] netlink: 1 bytes leftover after parsing attributes in process `syz.2.821'. [ 125.445024][ T8971] netlink: 12 bytes leftover after parsing attributes in process `syz.3.822'. [ 125.497408][ T8975] netlink: 8 bytes leftover after parsing attributes in process `syz.3.822'. [ 125.520043][ T8971] 8021q: adding VLAN 0 to HW filter on device bond3 [ 125.671030][ T8984] netlink: 212376 bytes leftover after parsing attributes in process `syz.3.826'. [ 125.742633][ T8987] netlink: 'syz.2.828': attribute type 13 has an invalid length. [ 126.631616][ T9004] netlink: 'syz.4.831': attribute type 1 has an invalid length. [ 126.639411][ T9004] netlink: 'syz.4.831': attribute type 3 has an invalid length. [ 126.655611][ T9004] NCSI netlink: No device for ifindex 246 [ 126.683190][ T9010] netlink: 'syz.0.833': attribute type 1 has an invalid length. [ 126.856724][ T9022] tipc: Enabling of bearer rejected, media not registered [ 126.911525][ T9023] lo speed is unknown, defaulting to 1000 [ 126.925548][ T9022] syzkaller1: entered promiscuous mode [ 126.932596][ T9022] syzkaller1: entered allmulticast mode [ 127.949277][ T9122] lo speed is unknown, defaulting to 1000 [ 128.028440][ T9124] (unnamed net_device) (uninitialized): option downdelay: invalid value (18446744073709551615) [ 128.050255][ T9124] (unnamed net_device) (uninitialized): option downdelay: allowed values 0 - 2147483647 [ 128.247677][ T9142] geneve2: entered promiscuous mode [ 128.253034][ T9142] geneve2: entered allmulticast mode [ 128.390790][ T9152] xt_ecn: cannot match TCP bits for non-tcp packets [ 128.411592][ T9155] __nla_validate_parse: 8 callbacks suppressed [ 128.411604][ T9155] netlink: 72 bytes leftover after parsing attributes in process `syz.0.878'. [ 128.437352][ T9155] netlink: 12 bytes leftover after parsing attributes in process `syz.0.878'. [ 128.447066][ T9155] netlink: 16 bytes leftover after parsing attributes in process `syz.0.878'. [ 128.463237][ T9158] netlink: 24 bytes leftover after parsing attributes in process `syz.4.876'. [ 128.477479][ T9160] netlink: 20 bytes leftover after parsing attributes in process `syz.1.880'. [ 128.505672][ T9158] lo speed is unknown, defaulting to 1000 [ 128.519094][ T9155] syzkaller1: entered promiscuous mode [ 128.542389][ T9155] syzkaller1: entered allmulticast mode [ 128.564751][ T9163] netlink: 48 bytes leftover after parsing attributes in process `syz.3.882'. [ 128.812240][ T9174] netlink: 140 bytes leftover after parsing attributes in process `syz.1.885'. [ 128.959019][ T9190] sit3: entered promiscuous mode [ 128.966642][ T9189] netlink: 48 bytes leftover after parsing attributes in process `syz.0.891'. [ 129.248424][ T9203] pimreg: entered allmulticast mode [ 129.257058][ T9203] netlink: 24 bytes leftover after parsing attributes in process `syz.0.895'. [ 129.574403][ T9212] pimreg: left allmulticast mode [ 129.667101][ T9230] netlink: 16 bytes leftover after parsing attributes in process `syz.4.900'. [ 129.668179][ T9231] batadv_slave_1: entered promiscuous mode [ 129.687852][ T9229] batadv_slave_1: left promiscuous mode [ 130.100317][ T30] audit: type=1800 audit(1752432664.881:6): pid=9248 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.905" name="memory.events" dev="tmpfs" ino=994 res=0 errno=0 [ 130.598917][ T9278] batadv_slave_1: entered promiscuous mode [ 130.632766][ T9272] vlan2: entered allmulticast mode [ 130.648328][ T9272] bond5: entered allmulticast mode [ 130.693850][ T9285] batadv_slave_1: left promiscuous mode [ 130.732184][ T9278] netlink: 'syz.0.916': attribute type 39 has an invalid length. [ 131.159534][ T9283] lo speed is unknown, defaulting to 1000 [ 131.512841][ T9323] net_ratelimit: 12 callbacks suppressed [ 131.512863][ T9323] openvswitch: netlink: VXLAN extension message has 4 unknown bytes. [ 131.674469][ T9331] netlink: 'syz.1.932': attribute type 7 has an invalid length. [ 131.682349][ T9331] netlink: 'syz.1.932': attribute type 8 has an invalid length. [ 131.761801][ T9334] tipc: Started in network mode [ 131.766689][ T9334] tipc: Node identity 00000000000000000000000000000001, cluster identity 4711 [ 131.775924][ T9334] tipc: Enabling of bearer rejected, failed to enable media [ 131.841594][ T9340] sit0: left promiscuous mode [ 131.883544][ T9340] bridge0: port 2(bridge_slave_1) entered disabled state [ 131.891137][ T9340] bridge0: port 1(bridge_slave_0) entered disabled state [ 131.997346][ T9340] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 132.011725][ T9340] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 132.193894][ T9340] veth3: left promiscuous mode [ 132.260565][ T9340] veth5: left promiscuous mode [ 132.266717][ T9336] lo speed is unknown, defaulting to 1000 [ 132.275837][ T1301] ieee802154 phy0 wpan0: encryption failed: -22 [ 132.275921][ T1301] ieee802154 phy1 wpan1: encryption failed: -22 [ 132.410834][ T9371] xt_TCPMSS: Only works on TCP SYN packets [ 132.445267][ T9360] A link change request failed with some changes committed already. Interface veth1_to_bond may have been left with an inconsistent configuration, please check. [ 132.471373][ T36] netdevsim netdevsim1 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 132.480078][ T36] netdevsim netdevsim1 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 132.510285][ T9363] macsec0: entered allmulticast mode [ 132.517341][ T9366] veth1_macvtap: entered allmulticast mode [ 132.540370][ T9366] macsec0: left allmulticast mode [ 132.545415][ T9366] veth1_macvtap: left allmulticast mode [ 132.603312][ T9355] lo speed is unknown, defaulting to 1000 [ 132.633575][ T36] netdevsim netdevsim1 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 132.652659][ T36] netdevsim netdevsim1 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 132.723326][ T36] netdevsim netdevsim1 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 132.750602][ T36] netdevsim netdevsim1 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 132.769763][ T36] netdevsim netdevsim1 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 132.790325][ T36] netdevsim netdevsim1 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 133.328935][ T9422] lo speed is unknown, defaulting to 1000 [ 133.362438][ T9423] lo speed is unknown, defaulting to 1000 [ 133.472536][ T9447] veth0: entered promiscuous mode [ 133.984483][ T5906] hid-generic 0005:0C45:1012.0001: item fetching failed at offset 0/1 [ 133.998443][ T5906] hid-generic 0005:0C45:1012.0001: probe with driver hid-generic failed with error -22 [ 134.092653][ T9495] netlink: 'syz.0.964': attribute type 13 has an invalid length. [ 134.100832][ T9495] netlink: 'syz.0.964': attribute type 17 has an invalid length. [ 134.143326][ T9499] xt_CT: No such helper "pptp" [ 134.231203][ T9506] __nla_validate_parse: 22 callbacks suppressed [ 134.231217][ T9506] netlink: 16 bytes leftover after parsing attributes in process `syz.1.967'. [ 134.277495][ T9495] sit0: left promiscuous mode [ 134.307764][ T9510] netlink: 16 bytes leftover after parsing attributes in process `syz.0.964'. [ 134.328936][ T9495] 8021q: adding VLAN 0 to HW filter on device bond0 [ 134.345896][ T9495] 8021q: adding VLAN 0 to HW filter on device team0 [ 134.365783][ T9495] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 134.381673][ T9516] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 134.408188][ T9439] veth0: left promiscuous mode [ 134.454284][ T9503] lo speed is unknown, defaulting to 1000 [ 134.506650][ T9507] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 134.575257][ T9495] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 134.611826][ T9520] openvswitch: netlink: Unexpected mask (mask=1040, allowed=10048) [ 134.615423][ T9523] vlan3: entered promiscuous mode [ 134.627932][ T9523] veth0: entered promiscuous mode [ 134.643788][ T9527] netlink: 8 bytes leftover after parsing attributes in process `syz.3.972'. [ 134.652996][ T9527] netlink: 4 bytes leftover after parsing attributes in process `syz.3.972'. [ 134.664751][ T9527] netlink: 16 bytes leftover after parsing attributes in process `syz.3.972'. [ 134.668383][ T9524] vlan3: entered promiscuous mode [ 135.210530][ T9531] netlink: 4 bytes leftover after parsing attributes in process `syz.1.973'. [ 135.709945][ T9520] lo speed is unknown, defaulting to 1000 [ 135.835229][ T9538] netlink: 56 bytes leftover after parsing attributes in process `syz.4.976'. [ 135.868945][ T9541] netlink: 3 bytes leftover after parsing attributes in process `syz.3.977'. [ 136.004848][ T9541] 0X: renamed from caif0 [ 136.025337][ T9541] 0X: entered allmulticast mode [ 136.031919][ T9541] A link change request failed with some changes committed already. Interface 60X may have been left with an inconsistent configuration, please check. [ 136.396310][ T9553] lo speed is unknown, defaulting to 1000 [ 136.402377][ T9566] netlink: 4 bytes leftover after parsing attributes in process `syz.0.983'. [ 136.417902][ T9555] sit0: entered promiscuous mode [ 136.443794][ T9555] netlink: 'syz.0.983': attribute type 1 has an invalid length. [ 136.460448][ T9555] netlink: 1 bytes leftover after parsing attributes in process `syz.0.983'. [ 136.883391][ T9589] lo speed is unknown, defaulting to 1000 [ 136.981197][ T9591] lo speed is unknown, defaulting to 1000 [ 137.060070][ T9604] lo: entered allmulticast mode [ 137.129911][ T9607] lo: entered allmulticast mode [ 137.135874][ T9601] lo: left allmulticast mode [ 137.156285][ T9609] Unsupported ieee802154 address type: 0 [ 137.200698][ T9607] lo: left allmulticast mode [ 137.674796][ T9628] lo speed is unknown, defaulting to 1000 [ 137.844647][ T9640] lo speed is unknown, defaulting to 1000 [ 137.996970][ T9645] lo speed is unknown, defaulting to 1000 [ 138.189294][ T9646] lo speed is unknown, defaulting to 1000 [ 138.475495][ T9673] xfrm1: entered allmulticast mode [ 138.629806][ T9675] netlink: 'syz.3.1014': attribute type 1 has an invalid length. [ 138.806466][ T9694] sch_tbf: peakrate 12 is lower than or equals to rate 6561010854487373889 ! [ 138.974463][ T9706] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 139.136063][ T9717] FAULT_INJECTION: forcing a failure. [ 139.136063][ T9717] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 139.149436][ T9717] CPU: 0 UID: 0 PID: 9717 Comm: syz.1.1025 Not tainted 6.16.0-rc5-syzkaller-01400-g8c2e602225f0 #0 PREEMPT(full) [ 139.149455][ T9717] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 139.149462][ T9717] Call Trace: [ 139.149466][ T9717] [ 139.149471][ T9717] dump_stack_lvl+0x189/0x250 [ 139.149490][ T9717] ? __pfx____ratelimit+0x10/0x10 [ 139.149505][ T9717] ? __pfx_dump_stack_lvl+0x10/0x10 [ 139.149518][ T9717] ? __pfx__printk+0x10/0x10 [ 139.149541][ T9717] ? __might_fault+0xb0/0x130 [ 139.149563][ T9717] should_fail_ex+0x414/0x560 [ 139.149581][ T9717] _copy_from_iter+0x1db/0x16f0 [ 139.149597][ T9717] ? rcu_is_watching+0x15/0xb0 [ 139.149612][ T9717] ? kmem_cache_alloc_node_noprof+0x217/0x3c0 [ 139.149627][ T9717] ? __pfx__copy_from_iter+0x10/0x10 [ 139.149639][ T9717] ? __build_skb_around+0x257/0x3e0 [ 139.149656][ T9717] ? netlink_sendmsg+0x642/0xb30 [ 139.149671][ T9717] ? skb_put+0x11b/0x210 [ 139.149689][ T9717] netlink_sendmsg+0x6b2/0xb30 [ 139.149710][ T9717] ? __pfx_netlink_sendmsg+0x10/0x10 [ 139.149727][ T9717] ? aa_sock_msg_perm+0x94/0x160 [ 139.149745][ T9717] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 139.149761][ T9717] ? __pfx_netlink_sendmsg+0x10/0x10 [ 139.149776][ T9717] __sock_sendmsg+0x219/0x270 [ 139.149792][ T9717] sock_write_iter+0x258/0x330 [ 139.149804][ T9717] ? __pfx_sock_write_iter+0x10/0x10 [ 139.149822][ T9717] ? __pfx_aa_file_perm+0x10/0x10 [ 139.149835][ T9717] do_iter_readv_writev+0x56b/0x7f0 [ 139.149850][ T9717] ? __pfx_do_iter_readv_writev+0x10/0x10 [ 139.149864][ T9717] ? bpf_lsm_file_permission+0x9/0x20 [ 139.149873][ T9717] ? security_file_permission+0x75/0x290 [ 139.149888][ T9717] ? rw_verify_area+0x258/0x650 [ 139.149902][ T9717] vfs_writev+0x31a/0x960 [ 139.149916][ T9717] ? vfs_write+0x8d8/0xa90 [ 139.149933][ T9717] ? __pfx_vfs_writev+0x10/0x10 [ 139.149946][ T9717] ? vfs_write+0x8d8/0xa90 [ 139.149981][ T9717] do_writev+0x14d/0x2d0 [ 139.149997][ T9717] ? __pfx_do_writev+0x10/0x10 [ 139.150009][ T9717] ? rcu_is_watching+0x15/0xb0 [ 139.150025][ T9717] ? do_syscall_64+0xbe/0x3b0 [ 139.150042][ T9717] do_syscall_64+0xfa/0x3b0 [ 139.150055][ T9717] ? lockdep_hardirqs_on+0x9c/0x150 [ 139.150069][ T9717] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 139.150080][ T9717] ? clear_bhb_loop+0x60/0xb0 [ 139.150096][ T9717] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 139.150106][ T9717] RIP: 0033:0x7f767198e929 [ 139.150118][ T9717] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 139.150126][ T9717] RSP: 002b:00007f76728dd038 EFLAGS: 00000246 ORIG_RAX: 0000000000000014 [ 139.150139][ T9717] RAX: ffffffffffffffda RBX: 00007f7671bb5fa0 RCX: 00007f767198e929 [ 139.150146][ T9717] RDX: 0000000000000001 RSI: 00002000000000c0 RDI: 0000000000000005 [ 139.150153][ T9717] RBP: 00007f76728dd090 R08: 0000000000000000 R09: 0000000000000000 [ 139.150159][ T9717] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 139.150165][ T9717] R13: 0000000000000000 R14: 00007f7671bb5fa0 R15: 00007ffeaf35b238 [ 139.150184][ T9717] [ 139.472315][ T9717] __nla_validate_parse: 7 callbacks suppressed [ 139.472328][ T9717] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1025'. [ 139.568467][ T9723] lo: entered promiscuous mode [ 139.594840][ T9727] : entered promiscuous mode [ 139.599660][ T9729] netlink: 28 bytes leftover after parsing attributes in process `syz.4.1028'. [ 139.612919][ T9723] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1027'. [ 139.622077][ T9729] netlink: 28 bytes leftover after parsing attributes in process `syz.4.1028'. [ 139.633005][ T9729] netlink: 'syz.4.1028': attribute type 6 has an invalid length. [ 139.657498][ T9722] lo: left promiscuous mode [ 139.709154][ T9733] xt_TCPMSS: Only works on TCP SYN packets [ 139.792252][ T9744] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1034'. [ 139.802528][ T9733] netlink: 'syz.0.1031': attribute type 17 has an invalid length. [ 139.826590][ T9733] netlink: 56 bytes leftover after parsing attributes in process `syz.0.1031'. [ 139.864152][ T9752] netlink: 256 bytes leftover after parsing attributes in process `syz.1.1038'. [ 139.875672][ T9753] RDS: rds_bind could not find a transport for ::ffff:100.1.1.1, load rds_tcp or rds_rdma? [ 140.033311][ T9762] workqueue: Failed to create a rescuer kthread for wq "nfc2_nci_cmd_wq": -EINTR [ 140.769998][ T9759] lo speed is unknown, defaulting to 1000 [ 140.787157][ T9749] lo speed is unknown, defaulting to 1000 [ 140.816029][ T9760] lo speed is unknown, defaulting to 1000 [ 140.855719][ T9770] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1041'. [ 141.055666][ T9776] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1044'. [ 141.076907][ T9776] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1044'. [ 141.308513][ T9791] macvlan0: left promiscuous mode [ 141.314123][ T9791] netlink: 'syz.0.1049': attribute type 2 has an invalid length. [ 141.405654][ T9793] gtp0: entered promiscuous mode [ 141.411665][ T9793] gtp0: entered allmulticast mode [ 141.494427][ T9799] sctp: [Deprecated]: syz.0.1053 (pid 9799) Use of int in max_burst socket option deprecated. [ 141.494427][ T9799] Use struct sctp_assoc_value instead [ 141.659148][ T9806] xt_CT: No such helper "pptp" [ 141.710374][ T9815] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 141.773581][ T9819] netlink: 'syz.2.1055': attribute type 9 has an invalid length. [ 141.785998][ T9820] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 141.805795][ T9815] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 141.861156][ T9824] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci4/hci4:200/input5 [ 143.007691][ T9807] lo speed is unknown, defaulting to 1000 [ 143.066627][ T9841] lo speed is unknown, defaulting to 1000 [ 143.463149][ T9877] bridge_slave_0: left allmulticast mode [ 143.479168][ T9877] bridge_slave_0: left promiscuous mode [ 143.491631][ T9877] bridge0: port 1(bridge_slave_0) entered disabled state [ 143.544916][ T9877] bridge_slave_1: left allmulticast mode [ 143.551020][ T9877] bridge_slave_1: left promiscuous mode [ 143.580349][ T9877] bridge0: port 2(bridge_slave_1) entered disabled state [ 143.597495][ T9877] veth0_to_bond: left allmulticast mode [ 143.603435][ T9877] veth0_to_bond: left promiscuous mode [ 143.609107][ T9877] bridge2: port 1(veth0_to_bond) entered disabled state [ 143.634918][ T9877] bond0: (slave bond_slave_0): Releasing backup interface [ 143.644087][ T9877] bond0: (slave bond_slave_1): Releasing backup interface [ 143.653879][ T9877] team_slave_0: left promiscuous mode [ 143.659681][ T9877] team0: Failed to send options change via netlink (err -105) [ 143.667343][ T9877] team0: Failed to send port change of device team_slave_0 via netlink (err -105) [ 143.676868][ T9877] team0: Port device team_slave_0 removed [ 143.683247][ T9877] team_slave_1: left promiscuous mode [ 143.689053][ T9877] team0: Failed to send options change via netlink (err -105) [ 143.696717][ T9877] team0: Failed to send port change of device team_slave_1 via netlink (err -105) [ 143.706456][ T9877] team0: Port device team_slave_1 removed [ 143.712680][ T9877] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 143.721353][ T9877] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 143.729434][ T9877] bond0: (slave bond2): Releasing backup interface [ 143.737200][ T9877] bond5: (slave veth5): Releasing backup interface [ 143.778896][ T9857] lo speed is unknown, defaulting to 1000 [ 143.789567][ T9874] lo speed is unknown, defaulting to 1000 [ 143.836824][ T9891] tc_dump_action: action bad kind [ 143.859194][ T9892] tc_dump_action: action bad kind [ 143.927021][ T9892] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 143.947410][ T9892] team0: Failed to send port change of device batadv0 via netlink (err -105) [ 143.958778][ T9892] team0: Failed to send options change via netlink (err -105) [ 143.966377][ T9892] team0: Port device batadv0 added [ 143.981873][ T9895] 8021q: adding VLAN 0 to HW filter on device batadv1 [ 143.989927][ T9895] team0: Failed to send port change of device batadv1 via netlink (err -105) [ 144.006047][ T9895] team0: Failed to send options change via netlink (err -105) [ 144.015269][ T9895] team0: Port device batadv1 added [ 144.426653][ T9922] SET target dimension over the limit! [ 145.365345][ T9937] tipc: Enabled bearer , priority 0 [ 145.379118][ T9940] syzkaller0: entered promiscuous mode [ 145.403021][ T9940] syzkaller0: entered allmulticast mode [ 145.435628][ T9945] tipc: Resetting bearer [ 145.462988][ T9954] __nla_validate_parse: 7 callbacks suppressed [ 145.463002][ T9954] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1088'. [ 145.615189][ T9959] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1089'. [ 145.649097][ T9945] tipc: Resetting bearer [ 145.674801][ T9945] tipc: Disabling bearer [ 145.760055][ T9964] lo speed is unknown, defaulting to 1000 [ 145.835396][ T9981] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1094'. [ 146.153802][T10001] sctp: [Deprecated]: syz.4.1103 (pid 10001) Use of struct sctp_assoc_value in delayed_ack socket option. [ 146.153802][T10001] Use struct sctp_sack_info instead [ 146.209341][T10003] xt_ecn: cannot match TCP bits for non-tcp packets [ 146.210345][T10007] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1105'. [ 146.228477][T10003] netlink: 48 bytes leftover after parsing attributes in process `syz.3.1102'. [ 146.231144][T10007] veth1: entered promiscuous mode [ 146.246169][T10007] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1105'. [ 146.256834][T10007] A link change request failed with some changes committed already. Interface veth1 may have been left with an inconsistent configuration, please check. [ 146.288584][T10008] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1104'. [ 146.370021][T10012] netlink: 36 bytes leftover after parsing attributes in process `syz.0.1107'. [ 146.529194][T10033] tipc: Enabled bearer , priority 0 [ 146.544235][T10026] netlink: 240 bytes leftover after parsing attributes in process `syz.2.1109'. [ 146.563319][T10033] syzkaller0: entered promiscuous mode [ 146.568800][T10033] syzkaller0: entered allmulticast mode [ 146.585892][T10033] tipc: Resetting bearer [ 146.614054][T10029] tipc: Resetting bearer [ 146.627455][T10029] tipc: Disabling bearer [ 146.696525][T10044] netlink: 'syz.2.1118': attribute type 1 has an invalid length. [ 146.709205][T10044] netlink: 1 bytes leftover after parsing attributes in process `syz.2.1118'. [ 146.749363][T10042] syzkaller0: entered promiscuous mode [ 146.760609][T10042] syzkaller0: entered allmulticast mode [ 147.595666][T10075] tipc: Enabled bearer , priority 10 [ 147.719393][T10082] netlink: 'syz.0.1131': attribute type 8 has an invalid length. [ 147.813188][T10084] lo speed is unknown, defaulting to 1000 [ 147.892810][ T9458] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 147.903264][ T9458] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 147.915042][ T9458] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 147.924048][ T9458] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 148.255419][T10102] netlink: 'syz.2.1138': attribute type 303 has an invalid length. [ 148.367949][T10108] netlink: 'syz.3.1139': attribute type 9 has an invalid length. [ 148.384328][T10108] macvlan2: entered promiscuous mode [ 148.389629][T10108] hsr0: entered promiscuous mode [ 148.399086][T10108] macvlan2: entered allmulticast mode [ 148.404527][T10108] hsr0: entered allmulticast mode [ 148.409550][T10108] hsr_slave_0: entered allmulticast mode [ 148.418134][T10108] hsr_slave_1: entered allmulticast mode [ 148.473734][T10112] team0: Port device bond0 removed [ 148.479065][T10112] bridge_slave_0: left allmulticast mode [ 148.485432][T10112] bridge_slave_0: left promiscuous mode [ 148.491322][T10112] bridge0: port 1(bridge_slave_0) entered disabled state [ 148.502434][T10112] bridge_slave_1: left allmulticast mode [ 148.508268][T10112] bridge_slave_1: left promiscuous mode [ 148.514641][T10112] bridge0: port 2(bridge_slave_1) entered disabled state [ 148.525207][T10112] bond0: (slave bond_slave_0): Releasing backup interface [ 148.534347][T10112] bond0: (slave bond_slave_1): Releasing backup interface [ 148.545152][T10112] team0: Port device team_slave_0 removed [ 148.556159][T10112] team0: Port device team_slave_1 removed [ 148.563229][T10112] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 148.572565][T10112] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 148.710422][ T6022] tipc: Node number set to 783589439 [ 148.718353][T10121] netlink: 'syz.0.1144': attribute type 16 has an invalid length. [ 148.726770][T10121] netlink: 'syz.0.1144': attribute type 17 has an invalid length. [ 148.891352][T10136] tipc: Enabling of bearer rejected, failed to enable media [ 148.934432][T10136] syzkaller0: entered promiscuous mode [ 148.966591][T10136] syzkaller0: entered allmulticast mode [ 149.215083][T10165] netlink: 'syz.0.1156': attribute type 1 has an invalid length. [ 149.552022][T10192] lo speed is unknown, defaulting to 1000 [ 149.889659][T10220] netlink: 'syz.0.1171': attribute type 10 has an invalid length. [ 150.123189][T10234] netlink: 'syz.4.1174': attribute type 1 has an invalid length. [ 150.339123][T10245] veth1_to_bond: entered allmulticast mode [ 150.348580][T10245] bond_slave_1: entered promiscuous mode [ 150.355163][T10244] bond_slave_1: left promiscuous mode [ 150.361247][T10244] veth1_to_bond: left allmulticast mode [ 150.394043][T10243] netlink: 'syz.0.1177': attribute type 11 has an invalid length. [ 150.498928][T10243] __nla_validate_parse: 19 callbacks suppressed [ 150.498942][T10243] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1177'. [ 150.588061][T10258] bond0: option ad_user_port_key: mode dependency failed, not supported in mode balance-rr(0) [ 150.896517][T10280] IPVS: Error connecting to the multicast addr [ 150.922591][T10282] netlink: 'syz.0.1187': attribute type 1 has an invalid length. [ 150.930443][T10282] netlink: 1 bytes leftover after parsing attributes in process `syz.0.1187'. [ 150.941308][T10282] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1187'. [ 151.160487][T10302] IPVS: sync thread started: state = BACKUP, mcast_ifn = vlan0, syncid = 1, id = 0 [ 151.169847][T10301] IPVS: stopping backup sync thread 10302 ... [ 151.254042][T10309] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1193'. [ 151.397887][T10314] netlink: 68 bytes leftover after parsing attributes in process `syz.3.1197'. [ 151.401644][T10312] netlink: 'syz.2.1196': attribute type 1 has an invalid length. [ 151.417720][T10312] netlink: 1 bytes leftover after parsing attributes in process `syz.2.1196'. [ 152.369990][ T5957] lo speed is unknown, defaulting to 1000 [ 152.377841][ T5957] syz2: Port: 1 Link ACTIVE [ 152.456350][T10334] netlink: 1 bytes leftover after parsing attributes in process `syz.2.1202'. [ 152.483117][T10334] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1202'. [ 152.557758][T10340] lo speed is unknown, defaulting to 1000 [ 152.604026][T10336] eql: refused to change device tx_queue_len [ 152.610034][T10336] A link change request failed with some changes committed already. Interface eql may have been left with an inconsistent configuration, please check. [ 152.803633][T10352] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 152.854316][T10360] validate_nla: 5 callbacks suppressed [ 152.854331][T10360] netlink: 'syz.0.1211': attribute type 16 has an invalid length. [ 152.868698][T10360] netlink: 'syz.0.1211': attribute type 17 has an invalid length. [ 152.924640][T10360] 8021q: adding VLAN 0 to HW filter on device bond0 [ 152.933735][T10360] 8021q: adding VLAN 0 to HW filter on device team0 [ 152.949397][T10360] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 153.024723][T10363] netlink: 'syz.4.1212': attribute type 1 has an invalid length. [ 153.032536][T10363] netlink: 1 bytes leftover after parsing attributes in process `syz.4.1212'. [ 153.044397][T10363] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1212'. [ 153.264010][T10374] lo speed is unknown, defaulting to 1000 [ 153.396484][T10379] netlink: 'syz.4.1216': attribute type 1 has an invalid length. [ 153.418051][ T5957] hid-generic 0005:04F3:8002.0002: collection stack underflow [ 153.438452][ T5957] hid-generic 0005:04F3:8002.0002: item 0 0 0 12 parsing failed [ 153.475997][ T5957] hid-generic 0005:04F3:8002.0002: probe with driver hid-generic failed with error -22 [ 153.584643][T10390] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 153.664352][T10408] netlink: 'syz.3.1223': attribute type 1 has an invalid length. [ 153.721529][T10410] C: renamed from team_slave_0 [ 153.733031][T10410] netlink: 'syz.1.1225': attribute type 3 has an invalid length. [ 153.744458][T10410] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check. [ 153.762868][T10415] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 153.770141][T10415] IPv6: NLM_F_CREATE should be set when creating new route [ 153.784326][T10410] veth1_to_batadv: entered promiscuous mode [ 153.799742][T10410] veth1_to_batadv: entered allmulticast mode [ 153.820311][T10413] bridge4: entered promiscuous mode [ 153.839911][T10413] sctp: [Deprecated]: syz.0.1227 (pid 10413) Use of int in max_burst socket option. [ 153.839911][T10413] Use struct sctp_assoc_value instead [ 153.853411][T10421] netlink: 'syz.3.1229': attribute type 1 has an invalid length. [ 153.992720][T10431] (unnamed net_device) (uninitialized): up delay (1024) is not a multiple of miimon (100), value rounded to 1000 ms [ 154.010147][T10431] (unnamed net_device) (uninitialized): down delay (4) is not a multiple of miimon (100), value rounded to 0 ms [ 154.045444][T10437] netlink: 'syz.0.1235': attribute type 1 has an invalid length. [ 154.108717][T10439] netlink: 'syz.0.1236': attribute type 8 has an invalid length. [ 154.119082][T10441] netlink: 'syz.3.1237': attribute type 1 has an invalid length. [ 154.189791][T10445] veth3: entered promiscuous mode [ 154.205251][T10445] vxcan2: entered promiscuous mode [ 154.643359][T10460] ipt_ECN: cannot use operation on non-tcp rule [ 154.800883][T10460] syzkaller0: entered allmulticast mode [ 154.819746][T10460] syzkaller0 (unregistering): left allmulticast mode [ 154.921456][T10476] 8021q: adding VLAN 0 to HW filter on device macvlan0 [ 155.228774][T10501] (unnamed net_device) (uninitialized): option ad_actor_system: mode dependency failed, not supported in mode balance-rr(0) [ 156.086966][T10522] lo speed is unknown, defaulting to 1000 [ 156.167627][T10525] __nla_validate_parse: 24 callbacks suppressed [ 156.167649][T10525] netlink: 1 bytes leftover after parsing attributes in process `syz.0.1264'. [ 156.181002][T10528] x_tables: ip6_tables: rpfilter match: used from hooks OUTPUT, but only valid from PREROUTING [ 156.236351][T10525] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1264'. [ 156.356117][T10543] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 156.381549][T10545] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1271'. [ 156.395569][T10546] IPVS: sync thread started: state = BACKUP, mcast_ifn = vlan0, syncid = 1, id = 0 [ 156.395782][T10543] IPVS: stopping backup sync thread 10546 ... [ 156.407810][T10545] bond0: entered promiscuous mode [ 156.417251][T10545] bond0: entered allmulticast mode [ 156.432933][T10545] 8021q: adding VLAN 0 to HW filter on device bond0 [ 156.465042][T10549] lo speed is unknown, defaulting to 1000 [ 156.490334][T10550] netlink: 64 bytes leftover after parsing attributes in process `syz.0.1272'. [ 156.621161][T10559] netlink: 16 bytes leftover after parsing attributes in process `syz.3.1274'. [ 156.815770][T10572] netlink: 1 bytes leftover after parsing attributes in process `syz.4.1279'. [ 156.826101][T10572] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1279'. [ 157.039873][T10583] : entered promiscuous mode [ 157.192190][T10595] batman_adv: batadv0: Adding interface: macvlan5 [ 157.198642][T10595] batman_adv: batadv0: The MTU of interface macvlan5 is too small (1462) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 157.229592][T10596] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1288'. [ 157.251554][T10595] batman_adv: batadv0: Interface activated: macvlan5 [ 157.324906][T10600] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 157.414109][T10608] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1291'. [ 157.769499][T10646] sit0: entered promiscuous mode [ 157.775069][T10646] netlink: 1 bytes leftover after parsing attributes in process `syz.1.1303'. [ 158.223347][T10675] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 158.245442][T10675] validate_nla: 12 callbacks suppressed [ 158.245457][T10675] netlink: 'syz.0.1312': attribute type 1 has an invalid length. [ 158.479030][T10681] netlink: 'syz.0.1315': attribute type 39 has an invalid length. [ 158.520401][T10683] netlink: 'syz.0.1315': attribute type 39 has an invalid length. [ 158.631759][T10696] lo speed is unknown, defaulting to 1000 [ 158.909868][ T5957] IPVS: starting estimator thread 0... [ 158.917091][T10701] netlink: 'syz.4.1320': attribute type 1 has an invalid length. [ 159.003795][T10704] IPVS: using max 55 ests per chain, 132000 per kthread [ 159.039993][T10710] netlink: 'syz.4.1323': attribute type 5 has an invalid length. [ 159.111469][T10717] lo speed is unknown, defaulting to 1000 [ 159.258734][T10723] xt_CT: No such helper "pptp" [ 159.382325][T10737] geneve2: entered promiscuous mode [ 159.388963][ T9455] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 159.397976][ T9455] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 159.406989][ T9455] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 159.416212][ T9465] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 159.568149][T10760] lo speed is unknown, defaulting to 1000 [ 159.722580][T10760] geneve0: entered promiscuous mode [ 159.925791][T10778] bridge6: entered promiscuous mode [ 159.950435][T10778] bridge6: entered allmulticast mode [ 159.968495][T10778] team0: Port device bridge6 added [ 160.268755][T10802] netlink: 'syz.4.1348': attribute type 1 has an invalid length. [ 160.349588][T10810] netlink: 'syz.4.1350': attribute type 1 has an invalid length. [ 160.793006][T10856] ipt_ECN: cannot use operation on non-tcp rule [ 161.017274][T10872] x_tables: ip_tables: ah match: only valid for protocol 51 [ 161.127372][T10877] macvlan6: entered allmulticast mode [ 161.137468][T10877] veth1_vlan: entered allmulticast mode [ 161.153194][T10877] veth1_vlan: left allmulticast mode [ 161.229600][T10881] lo speed is unknown, defaulting to 1000 [ 161.454525][T10898] syz.0.1376: vmalloc error: size 8589938688, exceeds total pages, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 161.469824][T10898] CPU: 1 UID: 0 PID: 10898 Comm: syz.0.1376 Not tainted 6.16.0-rc5-syzkaller-01400-g8c2e602225f0 #0 PREEMPT(full) [ 161.469844][T10898] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 161.469851][T10898] Call Trace: [ 161.469857][T10898] [ 161.469861][T10898] dump_stack_lvl+0x189/0x250 [ 161.469884][T10898] ? __pfx_dump_stack_lvl+0x10/0x10 [ 161.469899][T10898] ? __pfx__printk+0x10/0x10 [ 161.469916][T10898] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 161.469932][T10898] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 161.469947][T10898] ? cpuset_print_current_mems_allowed+0x2ee/0x360 [ 161.469962][T10898] warn_alloc+0x214/0x310 [ 161.469978][T10898] ? stack_depot_save_flags+0x40/0x900 [ 161.469996][T10898] ? __pfx_warn_alloc+0x10/0x10 [ 161.470013][T10898] ? kasan_save_track+0x4f/0x80 [ 161.470026][T10898] ? xskq_create+0x56/0x170 [ 161.470039][T10898] ? xsk_init_queue+0xb0/0x110 [ 161.470050][T10898] ? xsk_setsockopt+0x4dc/0x8d0 [ 161.470061][T10898] ? do_sock_setsockopt+0x257/0x3e0 [ 161.470080][T10898] ? __x64_sys_setsockopt+0x18b/0x220 [ 161.470095][T10898] ? do_syscall_64+0xfa/0x3b0 [ 161.470109][T10898] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 161.470127][T10898] __vmalloc_node_range_noprof+0x125/0x12f0 [ 161.470164][T10898] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 161.470183][T10898] ? __kasan_kmalloc+0x93/0xb0 [ 161.470200][T10898] vmalloc_user_noprof+0xad/0xf0 [ 161.470216][T10898] ? xskq_create+0xbf/0x170 [ 161.470231][T10898] xskq_create+0xbf/0x170 [ 161.470249][T10898] xsk_init_queue+0xb0/0x110 [ 161.470273][T10898] xsk_setsockopt+0x4dc/0x8d0 [ 161.470290][T10898] ? __pfx_xsk_setsockopt+0x10/0x10 [ 161.470304][T10898] ? __pfx_aa_sk_perm+0x10/0x10 [ 161.470320][T10898] ? __lock_acquire+0xab9/0xd20 [ 161.470338][T10898] ? aa_sock_opt_perm+0x74/0x110 [ 161.470355][T10898] ? bpf_lsm_socket_setsockopt+0x9/0x20 [ 161.470372][T10898] ? __pfx_xsk_setsockopt+0x10/0x10 [ 161.470387][T10898] do_sock_setsockopt+0x257/0x3e0 [ 161.470407][T10898] ? __pfx_do_sock_setsockopt+0x10/0x10 [ 161.470429][T10898] ? __fget_files+0x2a/0x420 [ 161.470451][T10898] __x64_sys_setsockopt+0x18b/0x220 [ 161.470472][T10898] do_syscall_64+0xfa/0x3b0 [ 161.470482][T10898] ? lockdep_hardirqs_on+0x9c/0x150 [ 161.470494][T10898] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 161.470503][T10898] ? clear_bhb_loop+0x60/0xb0 [ 161.470517][T10898] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 161.470528][T10898] RIP: 0033:0x7f4a2c18e929 [ 161.470540][T10898] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 161.470550][T10898] RSP: 002b:00007f4a2d05b038 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 161.470564][T10898] RAX: ffffffffffffffda RBX: 00007f4a2c3b5fa0 RCX: 00007f4a2c18e929 [ 161.470574][T10898] RDX: 0000000000000006 RSI: 000000000000011b RDI: 000000000000000c [ 161.470580][T10898] RBP: 00007f4a2c210b39 R08: 0000000000000004 R09: 0000000000000000 [ 161.470588][T10898] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000000 [ 161.470596][T10898] R13: 0000000000000000 R14: 00007f4a2c3b5fa0 R15: 00007fff78c20908 [ 161.470616][T10898] [ 161.782292][T10898] Mem-Info: [ 161.785467][T10898] active_anon:7205 inactive_anon:0 isolated_anon:0 [ 161.785467][T10898] active_file:1693 inactive_file:39866 isolated_file:0 [ 161.785467][T10898] unevictable:768 dirty:252 writeback:0 [ 161.785467][T10898] slab_reclaimable:11784 slab_unreclaimable:110202 [ 161.785467][T10898] mapped:32133 shmem:4206 pagetables:1174 [ 161.785467][T10898] sec_pagetables:0 bounce:0 [ 161.785467][T10898] kernel_misc_reclaimable:0 [ 161.785467][T10898] free:1310243 free_pcp:16562 free_cma:0 [ 161.835379][T10898] Node 0 active_anon:29120kB inactive_anon:0kB active_file:6772kB inactive_file:159260kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:128532kB dirty:1008kB writeback:0kB shmem:15288kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:13356kB pagetables:4656kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 161.885614][T10898] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:48kB pagetables:140kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 161.917564][T10898] Node 0 DMA free:15360kB boost:0kB min:204kB low:252kB high:300kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 161.946472][T10898] lowmem_reserve[]: 0 2498 2499 2499 2499 [ 161.952373][T10898] Node 0 DMA32 free:1319992kB boost:0kB min:34248kB low:42808kB high:51368kB reserved_highatomic:0KB free_highatomic:0KB active_anon:33172kB inactive_anon:0kB active_file:6772kB inactive_file:157684kB unevictable:1536kB writepending:1008kB present:3129332kB managed:2558272kB mlocked:0kB bounce:0kB free_pcp:37260kB local_pcp:13524kB free_cma:0kB [ 161.984913][T10898] lowmem_reserve[]: 0 0 1 1 1 [ 161.989620][T10898] Node 0 Normal free:12kB boost:0kB min:20kB low:24kB high:28kB reserved_highatomic:0KB free_highatomic:0KB active_anon:48kB inactive_anon:0kB active_file:0kB inactive_file:1576kB unevictable:0kB writepending:0kB present:1048580kB managed:1644kB mlocked:0kB bounce:0kB free_pcp:8kB local_pcp:0kB free_cma:0kB [ 162.018926][T10898] lowmem_reserve[]: 0 0 0 0 0 [ 162.024049][T10898] Node 1 Normal free:3895020kB boost:0kB min:55632kB low:69540kB high:83448kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:1536kB writepending:0kB present:4194300kB managed:4111164kB mlocked:0kB bounce:0kB free_pcp:20736kB local_pcp:12928kB free_cma:0kB [ 162.055572][T10898] lowmem_reserve[]: 0 0 0 0 0 [ 162.061356][T10898] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 162.074295][T10898] Node 0 DMA32: 491*4kB (UE) 1760*8kB (UME) 644*16kB (UM) 735*32kB (UME) 676*64kB (UME) 404*128kB (UME) 399*256kB (UM) 298*512kB (UME) 158*1024kB (UM) 8*2048kB (UM) 181*4096kB (UM) = 1319116kB [ 162.100812][T10898] Node 0 Normal: 1*4kB (M) 1*8kB (M) 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 12kB [ 162.118309][T10898] Node 1 Normal: 151*4kB (UE) 42*8kB (UME) 50*16kB (UME) 89*32kB (UME) 18*64kB (UME) 7*128kB (UME) 3*256kB (UM) 3*512kB (UM) 3*1024kB (UME) 2*2048kB (UE) 947*4096kB (M) = 3895020kB [ 162.157083][T10898] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 162.177308][T10898] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 162.220880][T10898] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 162.236302][T10914] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 162.245812][T10898] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 162.292059][T10898] 42903 total pagecache pages [ 162.296753][T10898] 0 pages in swap cache [ 162.328981][T10898] Free swap = 124996kB [ 162.349232][T10898] Total swap = 124996kB [ 162.360874][T10898] 2097051 pages RAM [ 162.365597][T10898] 0 pages HighMem/MovableOnly [ 162.377012][T10898] 425441 pages reserved [ 162.381645][T10898] 0 pages cma reserved [ 162.721504][T10938] __nla_validate_parse: 20 callbacks suppressed [ 162.721517][T10938] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1386'. [ 163.277476][T10915] vlan2: entered promiscuous mode [ 163.282901][T10915] bond0: entered promiscuous mode [ 163.299670][T10936] netlink: 'syz.4.1386': attribute type 1 has an invalid length. [ 163.308682][T10936] netlink: 1 bytes leftover after parsing attributes in process `syz.4.1386'. [ 163.609931][T10965] netlink: 32 bytes leftover after parsing attributes in process `syz.0.1389'. [ 163.636052][T10959] sit0: left promiscuous mode [ 163.660951][T10949] netlink: 'syz.0.1389': attribute type 15 has an invalid length. [ 163.666072][T10959] bond0: left promiscuous mode [ 163.677397][T10969] xt_hashlimit: overflow, try lower: 18446744073709551615/7 [ 163.706372][T10959] bond0: left allmulticast mode [ 163.721639][T10959] 8021q: adding VLAN 0 to HW filter on device team0 [ 163.733621][T10959] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 163.761385][T10972] tipc: Enabled bearer , priority 0 [ 163.769856][T10976] mac80211_hwsim hwsim5 syzkaller0: entered promiscuous mode [ 163.777700][T10976] mac80211_hwsim hwsim5 syzkaller0: entered allmulticast mode [ 163.790892][T10976] tipc: Resetting bearer [ 163.938184][T10985] mac80211_hwsim hwsim5 syzkaller0: left promiscuous mode [ 163.945727][T10985] mac80211_hwsim hwsim5 syzkaller0: left allmulticast mode [ 163.965459][T10985] tipc: Resetting bearer [ 163.971845][T10986] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1399'. [ 164.211794][T10992] netlink: 20 bytes leftover after parsing attributes in process `syz.2.1400'. [ 164.369404][ T9465] tipc: Resetting bearer [ 164.377998][T10990] lo speed is unknown, defaulting to 1000 [ 164.547996][T11003] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1402'. [ 164.557340][T11003] netlink: 'syz.2.1402': attribute type 30 has an invalid length. [ 164.631701][T11003] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1402'. [ 164.652170][T11003] netlink: 'syz.2.1402': attribute type 30 has an invalid length. [ 164.678066][T11010] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 164.685324][T11010] IPv6: NLM_F_CREATE should be set when creating new route [ 164.693825][T11010] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1406'. [ 164.790411][ T6022] tipc: Node number set to 1 [ 164.958379][T11028] lo speed is unknown, defaulting to 1000 [ 164.977459][T11032] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1409'. [ 165.224602][T11028] IPVS: set_ctl: invalid protocol: 51 224.0.0.1:20001 [ 165.261267][T11050] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1414'. [ 165.348536][T11055] xfrm2: entered promiscuous mode [ 165.381503][T11055] xfrm2: entered allmulticast mode [ 165.399076][T11050] "syz.2.1414" (11050) uses obsolete ecb(arc4) skcipher [ 165.668291][T11072] netlink: 'syz.0.1420': attribute type 10 has an invalid length. [ 165.684979][T11072] team0: Device ipvlan1 failed to register rx_handler [ 166.107109][T11111] tipc: Enabled bearer , priority 0 [ 166.116553][T11111] syzkaller0: entered promiscuous mode [ 166.127272][T11111] syzkaller0: entered allmulticast mode [ 166.175467][T11111] xt_nfacct: accounting object `syz1' does not exists [ 166.196085][T11111] tipc: Resetting bearer [ 166.223790][T11110] tipc: Resetting bearer [ 166.255910][T11110] tipc: Disabling bearer [ 166.265970][T11125] netlink: 'syz.0.1437': attribute type 1 has an invalid length. [ 166.279756][T11127] netlink: 'syz.0.1437': attribute type 1 has an invalid length. [ 166.435811][T11141] IPVS: sync thread started: state = BACKUP, mcast_ifn = dummy0, syncid = 3, id = 0 [ 167.164237][T11168] lo speed is unknown, defaulting to 1000 [ 167.405772][T11185] netlink: 'syz.4.1452': attribute type 12 has an invalid length. [ 167.515546][T11187] xt_physdev: --physdev-out and --physdev-is-out only supported in the FORWARD and POSTROUTING chains with bridged traffic [ 167.584243][T11196] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 167.719072][T11203] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci4/hci4:200/input6 [ 167.804583][T11207] __nla_validate_parse: 8 callbacks suppressed [ 167.804596][T11207] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1460'. [ 167.813964][T11210] IPVS: set_ctl: invalid protocol: 255 0.0.0.0:20002 [ 167.898091][T11218] netlink: 'syz.0.1462': attribute type 1 has an invalid length. [ 167.927596][T11218] workqueue: Failed to create a rescuer kthread for wq "bond1": -EINTR [ 167.976068][T11224] netlink: 'syz.4.1464': attribute type 1 has an invalid length. [ 168.001437][T11224] netlink: 224 bytes leftover after parsing attributes in process `syz.4.1464'. [ 168.014677][T11224] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1464'. [ 168.079535][T11228] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1466'. [ 168.100821][T11228] pim6reg: entered allmulticast mode [ 168.107457][T11228] pim6reg: left allmulticast mode [ 168.142291][T11226] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1465'. [ 168.211649][T11232] netlink: 216 bytes leftover after parsing attributes in process `syz.4.1467'. [ 168.224932][T11232] netlink: 24 bytes leftover after parsing attributes in process `syz.4.1467'. [ 168.234437][T11232] netlink: 16 bytes leftover after parsing attributes in process `syz.4.1467'. [ 168.385075][T11234] lo speed is unknown, defaulting to 1000 [ 168.414083][T11237] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1469'. [ 168.503554][T11242] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1470'. [ 168.542372][T11242] vlan2: entered promiscuous mode [ 168.547476][T11242] dummy0: entered promiscuous mode [ 168.592331][T11245] lo speed is unknown, defaulting to 1000 [ 168.939659][T11271] validate_nla: 1 callbacks suppressed [ 168.939673][T11271] netlink: 'syz.2.1475': attribute type 1 has an invalid length. [ 168.990028][T11267] lo speed is unknown, defaulting to 1000 [ 169.005442][T11273] netlink: 'syz.0.1476': attribute type 4 has an invalid length. [ 169.048045][T11275] netlink: 'syz.2.1477': attribute type 29 has an invalid length. [ 169.067009][T11275] netlink: 'syz.2.1477': attribute type 29 has an invalid length. [ 169.263094][T11283] batadv1: entered promiscuous mode [ 169.281275][T11283] batadv1: entered allmulticast mode [ 169.327356][T11292] delete_channel: no stack [ 169.593600][T11308] netlink: 'syz.2.1483': attribute type 1 has an invalid length. [ 169.858052][T11328] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 169.890498][T11324] lo speed is unknown, defaulting to 1000 [ 170.120211][ T51] Bluetooth: hci4: command 0x0405 tx timeout [ 170.285376][T11359] pimreg: tun_chr_ioctl cmd 2147767506 [ 170.444598][T11368] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 170.527897][T11373] netlink: 'syz.4.1503': attribute type 32 has an invalid length. [ 170.623481][T11384] netlink: 'syz.4.1508': attribute type 6 has an invalid length. [ 170.641854][T11381] lo speed is unknown, defaulting to 1000 [ 170.801271][T11389] IPVS: set_ctl: invalid protocol: 8345 172.30.1.5:20003 [ 170.809248][T11389] Cannot find add_set index 3 as target [ 170.819267][ T9458] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 170.834081][T11399] ipvlan2: entered promiscuous mode [ 170.839322][ T9458] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 170.848063][T11399] ipvlan2: entered allmulticast mode [ 170.853682][T11399] hsr0: entered allmulticast mode [ 170.858891][T11399] hsr_slave_0: entered allmulticast mode [ 170.867539][T11399] hsr_slave_1: entered allmulticast mode [ 170.868048][T11393] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 171.039215][T11405] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 171.274990][T11418] netlink: 'syz.1.1517': attribute type 7 has an invalid length. [ 171.274990][T11417] netlink: 'syz.1.1517': attribute type 7 has an invalid length. [ 171.279289][T11417] : entered promiscuous mode [ 171.364726][T11415] bridge3: entered promiscuous mode [ 171.383180][T11415] bridge3: entered allmulticast mode [ 171.468610][T11429] x_tables: ip_tables: REDIRECT target: used from hooks POSTROUTING, but only usable from PREROUTING/OUTPUT [ 171.539526][T11435] lo speed is unknown, defaulting to 1000 [ 171.648388][T11444] lo speed is unknown, defaulting to 1000 [ 172.023424][T11460] lo speed is unknown, defaulting to 1000 [ 172.175469][T11466] lo speed is unknown, defaulting to 1000 [ 172.470413][T11476] lo speed is unknown, defaulting to 1000 [ 172.852469][T11509] __nla_validate_parse: 27 callbacks suppressed [ 172.852482][T11509] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1541'. [ 172.900355][T11509] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1541'. [ 172.949214][T11509] netlink: 'syz.2.1541': attribute type 11 has an invalid length. [ 173.054322][T11517] 8021q: adding VLAN 0 to HW filter on device bond1 [ 173.062272][T11517] bond1: entered promiscuous mode [ 173.067921][T11517] bond0: (slave bond1): Enslaving as an active interface with a down link [ 173.317886][T11537] netlink: 96 bytes leftover after parsing attributes in process `syz.4.1552'. [ 173.385055][ T5846] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 173.393896][ T5846] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 173.403773][ T5846] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 173.412619][ T5846] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 173.420732][ T5846] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 173.457065][T11541] lo speed is unknown, defaulting to 1000 [ 173.688395][T11541] chnl_net:caif_netlink_parms(): no params data found [ 173.801963][T11541] bridge0: port 1(bridge_slave_0) entered blocking state [ 173.809910][T11541] bridge0: port 1(bridge_slave_0) entered disabled state [ 173.821515][T11541] bridge_slave_0: entered allmulticast mode [ 173.834474][T11541] bridge_slave_0: entered promiscuous mode [ 173.871254][T11541] bridge0: port 2(bridge_slave_1) entered blocking state [ 173.878377][T11541] bridge0: port 2(bridge_slave_1) entered disabled state [ 173.908951][T11541] bridge_slave_1: entered allmulticast mode [ 173.926893][T11541] bridge_slave_1: entered promiscuous mode [ 173.934188][T11578] pim6reg: left allmulticast mode [ 173.996956][T11541] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 174.009929][T11541] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 174.045999][T11541] team0: Port device team_slave_0 added [ 174.055640][T11541] team0: Port device team_slave_1 added [ 174.128519][T11541] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 174.138248][T11541] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 174.166553][T11541] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 174.182445][T11541] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 174.190225][T11541] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 174.218410][T11541] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 174.266319][T11541] hsr_slave_0: entered promiscuous mode [ 174.273582][T11541] hsr_slave_1: entered promiscuous mode [ 174.279762][T11541] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 174.289137][T11541] Cannot create hsr debugfs directory [ 174.478773][T11541] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 174.510022][T11541] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 174.533004][T11541] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 174.553083][T11597] lo speed is unknown, defaulting to 1000 [ 174.553312][T11541] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 174.658874][T11541] bridge0: port 2(bridge_slave_1) entered blocking state [ 174.665982][T11541] bridge0: port 2(bridge_slave_1) entered forwarding state [ 174.673557][T11541] bridge0: port 1(bridge_slave_0) entered blocking state [ 174.680723][T11541] bridge0: port 1(bridge_slave_0) entered forwarding state [ 174.741649][T11608] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1571'. [ 174.751207][T11608] netlink: 108 bytes leftover after parsing attributes in process `syz.2.1571'. [ 174.783932][T11608] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1571'. [ 174.826800][ T9465] bridge0: port 1(bridge_slave_0) entered disabled state [ 174.856040][ T9465] bridge0: port 2(bridge_slave_1) entered disabled state [ 175.002612][T11628] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1575'. [ 175.032616][T11541] 8021q: adding VLAN 0 to HW filter on device bond0 [ 175.065383][T11541] 8021q: adding VLAN 0 to HW filter on device team0 [ 175.097893][ T9453] bridge0: port 1(bridge_slave_0) entered blocking state [ 175.104971][ T9453] bridge0: port 1(bridge_slave_0) entered forwarding state [ 175.136812][ T9458] bridge0: port 2(bridge_slave_1) entered blocking state [ 175.144035][ T9458] bridge0: port 2(bridge_slave_1) entered forwarding state [ 175.177061][T11631] bond0: option ad_user_port_key: mode dependency failed, not supported in mode balance-rr(0) [ 175.313643][ T5846] Bluetooth: hci2: command 0x0406 tx timeout [ 175.319914][ T5841] Bluetooth: hci3: command 0x0406 tx timeout [ 175.326042][ T5167] Bluetooth: hci1: command 0x0406 tx timeout [ 175.472513][ T5843] Bluetooth: hci5: command tx timeout [ 175.608353][T11541] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 175.818596][T11651] xt_CONNSECMARK: only valid in 'mangle' or 'security' table, not 'raw' [ 175.849823][T11648] xt_CT: No such helper "pptp" [ 176.008844][T11664] netlink: 28 bytes leftover after parsing attributes in process `syz.4.1584'. [ 176.048387][T11664] A link change request failed with some changes committed already. Interface wlan0 may have been left with an inconsistent configuration, please check. [ 176.086877][T11541] veth0_vlan: entered promiscuous mode [ 176.126949][T11541] veth1_vlan: entered promiscuous mode [ 176.218799][T11678] netlink: 224 bytes leftover after parsing attributes in process `syz.4.1588'. [ 176.228933][T11541] veth0_macvtap: entered promiscuous mode [ 176.255388][T11541] veth1_macvtap: entered promiscuous mode [ 176.308668][T11541] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 176.342664][T11541] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 176.394596][T11685] lo speed is unknown, defaulting to 1000 [ 176.394611][ T9458] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 176.419752][ T9458] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 176.462919][ T9458] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 176.481517][ T9458] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 176.536635][T11682] lo speed is unknown, defaulting to 1000 [ 176.836638][ T9468] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 176.845630][ T9468] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 176.925316][T11718] validate_nla: 4 callbacks suppressed [ 176.925331][T11718] netlink: 'syz.2.1597': attribute type 12 has an invalid length. [ 176.995867][T11722] netlink: 92 bytes leftover after parsing attributes in process `syz.0.1598'. [ 177.006176][ T9465] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 177.016248][ T9465] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 177.471368][T11757] netlink: 'syz.2.1605': attribute type 11 has an invalid length. [ 177.552189][ T5843] Bluetooth: hci5: command tx timeout [ 177.672923][T11771] openvswitch: netlink: Unexpected mask (mask=c0, allowed=10048) [ 178.038759][T11797] lo speed is unknown, defaulting to 1000 [ 178.328693][T11821] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 178.468321][T11825] netlink: 'syz.1.1630': attribute type 4 has an invalid length. [ 178.559202][T11832] netlink: 'syz.2.1633': attribute type 15 has an invalid length. [ 178.568399][T11832] netlink: 'syz.2.1633': attribute type 7 has an invalid length. [ 178.576832][T11832] __nla_validate_parse: 2 callbacks suppressed [ 178.576846][T11832] netlink: 52 bytes leftover after parsing attributes in process `syz.2.1633'. [ 178.636729][T11837] netlink: 212408 bytes leftover after parsing attributes in process `syz.2.1635'. [ 178.648844][T11837] netlink: zone id is out of range [ 178.654410][T11837] netlink: get zone limit has 8 unknown bytes [ 178.683079][T11840] netlink: 14 bytes leftover after parsing attributes in process `syz.2.1636'. [ 178.700734][T11840] bond1: (slave macvlan2): Releasing backup interface [ 178.718431][T11840] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 178.728894][T11840] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 178.741427][T11840] bond0 (unregistering): (slave dummy0): Releasing backup interface [ 178.752243][T11840] bond0 (unregistering): (slave batadv0): Releasing backup interface [ 178.762452][T11840] bond0 (unregistering): Released all slaves [ 179.266787][T11877] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1646'. [ 179.316895][T11887] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 179.353974][T11821] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 179.429908][T11821] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 179.506211][T11902] netlink: 9 bytes leftover after parsing attributes in process `syz.1.1653'. [ 179.525291][T11821] netdevsim netdevsim5 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 179.542389][T11902] gretap0: entered promiscuous mode [ 179.555099][T11902] netlink: 5 bytes leftover after parsing attributes in process `syz.1.1653'. [ 179.573049][T11902] 0XD: renamed from gretap0 [ 179.581073][T11902] 0XD: left promiscuous mode [ 179.585985][T11902] 0XD: entered allmulticast mode [ 179.592699][T11902] A link change request failed with some changes committed already. Interface 30XD may have been left with an inconsistent configuration, please check. [ 179.607602][T11905] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1653'. [ 179.633020][ T5843] Bluetooth: hci5: command tx timeout [ 179.661326][ T9453] netdevsim netdevsim5 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 179.697314][ T9453] netdevsim netdevsim5 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 179.777778][ T9453] netdevsim netdevsim5 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 179.844616][ T9453] netdevsim netdevsim5 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 179.853666][T11918] veth0: entered promiscuous mode [ 179.884233][T11913] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1654'. [ 180.093326][T11913] veth0 (unregistering): left promiscuous mode [ 180.174125][T11935] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1656'. [ 180.225035][T11942] netlink: 'syz.0.1659': attribute type 1 has an invalid length. [ 180.245705][T11933] bridge0: port 1(erspan0) entered blocking state [ 180.256386][T11933] bridge0: port 1(erspan0) entered disabled state [ 180.263313][T11933] erspan0: entered allmulticast mode [ 180.271471][T11943] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1660'. [ 180.282581][T11933] erspan0: entered promiscuous mode [ 180.289487][T11933] bridge0: port 1(erspan0) entered blocking state [ 180.295973][T11933] bridge0: port 1(erspan0) entered forwarding state [ 180.306867][T11935] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 180.348239][T11935] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 180.397704][T11942] erspan0: left allmulticast mode [ 180.409019][T11942] erspan0: left promiscuous mode [ 180.416126][T11942] bridge0: port 1(erspan0) entered disabled state [ 180.440556][T11950] gtp0: entered promiscuous mode [ 180.446328][T11950] gtp0: entered allmulticast mode [ 180.463550][T11944] lo speed is unknown, defaulting to 1000 [ 180.696000][T11958] can: request_module (can-proto-3) failed. [ 180.919896][T11964] tap0: tun_chr_ioctl cmd 1074025677 [ 180.929862][T11964] tap0: linktype set to 0 [ 181.394639][T11979] x_tables: arp_tables: CLASSIFY target: used from hooks INPUT, but only usable from FORWARD/OUTPUT [ 181.447652][T11990] netlink: 'syz.4.1673': attribute type 1 has an invalid length. [ 181.488853][T11992] FAULT_INJECTION: forcing a failure. [ 181.488853][T11992] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 181.504568][T11992] CPU: 1 UID: 0 PID: 11992 Comm: syz.1.1675 Not tainted 6.16.0-rc5-syzkaller-01400-g8c2e602225f0 #0 PREEMPT(full) [ 181.504589][T11992] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 181.504596][T11992] Call Trace: [ 181.504601][T11992] [ 181.504606][T11992] dump_stack_lvl+0x189/0x250 [ 181.504626][T11992] ? __pfx____ratelimit+0x10/0x10 [ 181.504642][T11992] ? __pfx_dump_stack_lvl+0x10/0x10 [ 181.504656][T11992] ? __pfx__printk+0x10/0x10 [ 181.504672][T11992] ? __might_fault+0xb0/0x130 [ 181.504695][T11992] should_fail_ex+0x414/0x560 [ 181.504715][T11992] _copy_from_user+0x2d/0xb0 [ 181.504729][T11992] __sys_bpf+0x1ed/0x860 [ 181.504749][T11992] ? __pfx___sys_bpf+0x10/0x10 [ 181.504776][T11992] ? ksys_write+0x22a/0x250 [ 181.504792][T11992] ? __pfx_ksys_write+0x10/0x10 [ 181.504804][T11992] ? rcu_is_watching+0x15/0xb0 [ 181.504824][T11992] __x64_sys_bpf+0x7c/0x90 [ 181.504840][T11992] do_syscall_64+0xfa/0x3b0 [ 181.504855][T11992] ? lockdep_hardirqs_on+0x9c/0x150 [ 181.504871][T11992] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 181.504881][T11992] ? clear_bhb_loop+0x60/0xb0 [ 181.504895][T11992] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 181.504906][T11992] RIP: 0033:0x7f767198e929 [ 181.504924][T11992] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 181.504939][T11992] RSP: 002b:00007f76728dd038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 181.504953][T11992] RAX: ffffffffffffffda RBX: 00007f7671bb5fa0 RCX: 00007f767198e929 [ 181.504961][T11992] RDX: 0000000000000020 RSI: 0000200000000200 RDI: 0000000000000002 [ 181.504969][T11992] RBP: 00007f76728dd090 R08: 0000000000000000 R09: 0000000000000000 [ 181.504976][T11992] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 181.504983][T11992] R13: 0000000000000000 R14: 00007f7671bb5fa0 R15: 00007ffeaf35b238 [ 181.505004][T11992] [ 181.519841][T11995] netlink: 'syz.0.1677': attribute type 29 has an invalid length. [ 181.714750][ T5843] Bluetooth: hci5: command tx timeout [ 181.766815][T12006] workqueue: Failed to create a rescuer kthread for wq "nfc2_nci_cmd_wq": -EINTR [ 181.848129][T12014] lo speed is unknown, defaulting to 1000 [ 181.929784][T12027] team0: Port device batadv0 removed [ 181.936976][T12027] team0: Port device batadv1 removed [ 181.946127][T12027] team0: Port device bridge6 removed [ 181.953472][T12027] bond0: (slave bond1): Releasing backup interface [ 181.961624][T12027] bond1: left promiscuous mode [ 182.022799][T12030] sctp: [Deprecated]: syz.4.1685 (pid 12030) Use of int in maxseg socket option. [ 182.022799][T12030] Use struct sctp_assoc_value instead [ 182.231805][T12040] Bluetooth: hci4: Opcode 0x0401 failed: -4 [ 182.414462][T12059] xt_CONNSECMARK: only valid in 'mangle' or 'security' table, not 'raw' [ 182.425204][T12059] xt_l2tp: invalid flags combination: 4 [ 182.587328][T12066] netlink: 'syz.4.1696': attribute type 10 has an invalid length. [ 182.597546][T12066] bridge0: entered promiscuous mode [ 182.604103][T12066] bridge0: entered allmulticast mode [ 182.612273][T12066] bond0: (slave bridge0): Enslaving as an active interface with a down link [ 182.657188][T12068] lo speed is unknown, defaulting to 1000 [ 182.918916][T12085] FAULT_INJECTION: forcing a failure. [ 182.918916][T12085] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 182.971264][T12085] CPU: 0 UID: 0 PID: 12085 Comm: syz.0.1701 Not tainted 6.16.0-rc5-syzkaller-01400-g8c2e602225f0 #0 PREEMPT(full) [ 182.971285][T12085] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 182.971293][T12085] Call Trace: [ 182.971298][T12085] [ 182.971304][T12085] dump_stack_lvl+0x189/0x250 [ 182.971323][T12085] ? __pfx____ratelimit+0x10/0x10 [ 182.971338][T12085] ? __pfx_dump_stack_lvl+0x10/0x10 [ 182.971351][T12085] ? __pfx__printk+0x10/0x10 [ 182.971377][T12085] should_fail_ex+0x414/0x560 [ 182.971395][T12085] _copy_from_user+0x2d/0xb0 [ 182.971409][T12085] ___bpf_copy_key+0xa5/0x110 [ 182.971423][T12085] map_update_elem+0x200/0x750 [ 182.971436][T12085] ? bpf_lsm_bpf+0x9/0x20 [ 182.971451][T12085] __sys_bpf+0x6a9/0x860 [ 182.971469][T12085] ? __pfx___sys_bpf+0x10/0x10 [ 182.971496][T12085] ? ksys_write+0x22a/0x250 [ 182.971511][T12085] ? __pfx_ksys_write+0x10/0x10 [ 182.971522][T12085] ? rcu_is_watching+0x15/0xb0 [ 182.971541][T12085] __x64_sys_bpf+0x7c/0x90 [ 182.971558][T12085] do_syscall_64+0xfa/0x3b0 [ 182.971571][T12085] ? lockdep_hardirqs_on+0x9c/0x150 [ 182.971584][T12085] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 182.971593][T12085] ? clear_bhb_loop+0x60/0xb0 [ 182.971607][T12085] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 182.971616][T12085] RIP: 0033:0x7f4a2c18e929 [ 182.971628][T12085] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 182.971637][T12085] RSP: 002b:00007f4a2d05b038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 182.971650][T12085] RAX: ffffffffffffffda RBX: 00007f4a2c3b5fa0 RCX: 00007f4a2c18e929 [ 182.971658][T12085] RDX: 0000000000000020 RSI: 0000200000000200 RDI: 0000000000000002 [ 182.971665][T12085] RBP: 00007f4a2d05b090 R08: 0000000000000000 R09: 0000000000000000 [ 182.971672][T12085] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 182.971678][T12085] R13: 0000000000000000 R14: 00007f4a2c3b5fa0 R15: 00007fff78c20908 [ 182.971698][T12085] [ 183.646426][T12120] netlink: 'syz.4.1712': attribute type 1 has an invalid length. [ 183.654679][T12120] __nla_validate_parse: 10 callbacks suppressed [ 183.654692][T12120] netlink: 1 bytes leftover after parsing attributes in process `syz.4.1712'. [ 183.694871][T12120] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1712'. [ 183.803386][T12130] lo speed is unknown, defaulting to 1000 [ 183.871833][T12135] 8021q: adding VLAN 0 to HW filter on device bond3 [ 183.949301][T12137] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1716'. [ 184.094351][T12142] ipvlan0: entered promiscuous mode [ 184.099580][T12142] ipvlan0: entered allmulticast mode [ 184.108818][T12142] hsr0: entered allmulticast mode [ 184.114087][T12142] hsr_slave_0: entered allmulticast mode [ 184.119919][T12142] hsr_slave_1: entered allmulticast mode [ 184.139611][T12147] netlink: 47 bytes leftover after parsing attributes in process `syz.4.1719'. [ 184.194338][ T5843] Bluetooth: hci4: command 0x0405 tx timeout [ 184.308992][T12160] lo speed is unknown, defaulting to 1000 [ 184.375748][T12164] lo speed is unknown, defaulting to 1000 [ 184.393421][T12168] FAULT_INJECTION: forcing a failure. [ 184.393421][T12168] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 184.406981][T12168] CPU: 0 UID: 0 PID: 12168 Comm: syz.4.1725 Not tainted 6.16.0-rc5-syzkaller-01400-g8c2e602225f0 #0 PREEMPT(full) [ 184.406999][T12168] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 184.407006][T12168] Call Trace: [ 184.407011][T12168] [ 184.407015][T12168] dump_stack_lvl+0x189/0x250 [ 184.407034][T12168] ? __pfx____ratelimit+0x10/0x10 [ 184.407051][T12168] ? __pfx_dump_stack_lvl+0x10/0x10 [ 184.407064][T12168] ? __pfx__printk+0x10/0x10 [ 184.407079][T12168] ? __might_fault+0xb0/0x130 [ 184.407108][T12168] should_fail_ex+0x414/0x560 [ 184.407128][T12168] _copy_from_user+0x2d/0xb0 [ 184.407142][T12168] map_update_elem+0x4a6/0x750 [ 184.407162][T12168] __sys_bpf+0x6a9/0x860 [ 184.407182][T12168] ? __pfx___sys_bpf+0x10/0x10 [ 184.407208][T12168] ? ksys_write+0x22a/0x250 [ 184.407223][T12168] ? __pfx_ksys_write+0x10/0x10 [ 184.407232][T12168] ? rcu_is_watching+0x15/0xb0 [ 184.407252][T12168] __x64_sys_bpf+0x7c/0x90 [ 184.407267][T12168] do_syscall_64+0xfa/0x3b0 [ 184.407280][T12168] ? lockdep_hardirqs_on+0x9c/0x150 [ 184.407294][T12168] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 184.407304][T12168] ? clear_bhb_loop+0x60/0xb0 [ 184.407319][T12168] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 184.407329][T12168] RIP: 0033:0x7fd23918e929 [ 184.407341][T12168] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 184.407350][T12168] RSP: 002b:00007fd23a094038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 184.407363][T12168] RAX: ffffffffffffffda RBX: 00007fd2393b5fa0 RCX: 00007fd23918e929 [ 184.407370][T12168] RDX: 0000000000000020 RSI: 0000200000000200 RDI: 0000000000000002 [ 184.407378][T12168] RBP: 00007fd23a094090 R08: 0000000000000000 R09: 0000000000000000 [ 184.407384][T12168] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 184.407391][T12168] R13: 0000000000000000 R14: 00007fd2393b5fa0 R15: 00007ffcdbecea98 [ 184.407410][T12168] [ 184.657434][T12173] netlink: 'syz.4.1727': attribute type 21 has an invalid length. [ 184.668074][T12173] netlink: 36 bytes leftover after parsing attributes in process `syz.4.1727'. [ 184.689098][T12173] Unknown status report in ack skb [ 184.786581][T12181] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1730'. [ 184.807557][T12181] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1730'. [ 184.822373][T12181] vlan0: entered promiscuous mode [ 184.838079][T12181] syz.0.1730 (12181) used obsolete PPPIOCDETACH ioctl [ 184.897842][T12188] netlink: 'syz.2.1729': attribute type 13 has an invalid length. [ 184.910520][T12188] netlink: 'syz.2.1729': attribute type 17 has an invalid length. [ 184.958193][T12188] sit0: left promiscuous mode [ 184.998459][T12188] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 185.052405][T12190] lo speed is unknown, defaulting to 1000 [ 185.069234][T12182] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 185.156051][T12188] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 185.218854][T12182] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 185.455934][T12201] bridge1: entered promiscuous mode [ 185.679152][T12216] netlink: 248 bytes leftover after parsing attributes in process `syz.5.1739'. [ 187.471209][ T51] Bluetooth: hci5: command 0x0405 tx timeout [ 193.722976][ T1301] ieee802154 phy1 wpan1: encryption failed: -22 [ 255.154978][ T1301] ieee802154 phy1 wpan1: encryption failed: -22 [ 299.052900][T12230] netlink: 720 bytes leftover after parsing attributes in process `syz.1.1744'. [ 299.080015][T12232] lo speed is unknown, defaulting to 1000 [ 299.082802][T12230] (unnamed net_device) (uninitialized): option packets_per_slave: invalid value (5001287) [ 299.099511][T12230] (unnamed net_device) (uninitialized): option packets_per_slave: allowed values 0 - 65535 [ 299.245618][T12237] bond0: left allmulticast mode [ 299.252913][T12237] batadv0: left allmulticast mode [ 299.257949][T12237] bridge0: left allmulticast mode [ 299.265890][T12237] bond0: left promiscuous mode [ 299.271460][T12237] batadv0: left promiscuous mode [ 299.276553][T12237] bridge0: left promiscuous mode [ 299.289639][T12237] batman_adv: batadv0: Interface deactivated: macvlan5 [ 299.322176][T12230] dvmrp1: entered allmulticast mode [ 299.390298][T12248] workqueue: name exceeds WQ_NAME_LEN. Truncating to: !>y[&wuk 'rf! [ 299.417836][T12251] lo speed is unknown, defaulting to 1000 [ 299.440474][T12257] netlink: 'syz.4.1750': attribute type 5 has an invalid length. [ 299.476086][T12257] netlink: 'syz.4.1750': attribute type 1 has an invalid length. [ 299.492467][T12257] netlink: 199820 bytes leftover after parsing attributes in process `syz.4.1750'. [ 299.512903][T12259] netlink: 104 bytes leftover after parsing attributes in process `syz.4.1750'. [ 299.634556][T12266] netlink: 'syz.1.1751': attribute type 11 has an invalid length. [ 299.687258][T12268] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1753'. [ 299.772531][T12262] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1752'. [ 299.824354][T12275] lo speed is unknown, defaulting to 1000 [ 299.842065][T12278] netlink: 20 bytes leftover after parsing attributes in process `syz.5.1755'. [ 299.857780][T12269] lo speed is unknown, defaulting to 1000 [ 300.116026][T12289] wg0: entered promiscuous mode [ 300.140176][T12289] wg0: entered allmulticast mode [ 300.202277][T12295] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1758'. [ 300.325454][T12298] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci5/hci5:200/input7 [ 300.451747][T12278] lo speed is unknown, defaulting to 1000 [ 300.507494][T12308] netlink: 36 bytes leftover after parsing attributes in process `syz.1.1762'. [ 300.619327][T12316] netlink: 76 bytes leftover after parsing attributes in process `syz.1.1764'. [ 300.639009][T12316] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1764'. [ 300.681535][T12316] ip6gretap0: entered promiscuous mode [ 300.681555][T12318] netlink: 'syz.0.1765': attribute type 11 has an invalid length. [ 300.705822][T12316] ip6gretap0: left promiscuous mode [ 300.713470][T12318] netlink: 'syz.0.1765': attribute type 11 has an invalid length. [ 300.766174][T12320] bond0: option ad_select: unable to set because the bond device is up [ 301.115056][T12348] bond0 (unregistering): Released all slaves [ 301.199138][T12360] netlink: 'syz.0.1777': attribute type 1 has an invalid length. [ 301.341221][T12366] lo speed is unknown, defaulting to 1000 [ 301.408320][ T6022] hid-generic 0005:16C0:5505.0003: hidraw0: BLUETOOTH HID v0.8b Device [syz0] on aa:aa:aa:aa:aa:aa [ 301.927661][T12403] netlink: 'syz.1.1789': attribute type 303 has an invalid length. [ 302.126404][T12414] gtp0: entered promiscuous mode [ 302.132003][T12414] gtp0: entered allmulticast mode [ 302.143592][T12411] IPv6: sit1: Disabled Multicast RS [ 302.257079][T12422] lo speed is unknown, defaulting to 1000 [ 302.540561][T12438] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci5/hci5:200/input8 [ 302.696513][T12457] netlink: 'syz.5.1804': attribute type 39 has an invalid length. [ 302.715171][T12459] netlink: 'syz.1.1805': attribute type 21 has an invalid length. [ 302.779762][T12462] tap0: tun_chr_ioctl cmd 1074812118 [ 302.937915][T12479] xt_recent: hitcount (262143) is larger than allowed maximum (65535) [ 302.993155][T12484] (unnamed net_device) (uninitialized): option ad_user_port_key: mode dependency failed, not supported in mode balance-rr(0) [ 303.092097][T12497] netlink: 'syz.5.1815': attribute type 10 has an invalid length. [ 303.115696][T12497] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 303.126287][T12497] bond0: (slave batadv0): Enslaving as an active interface with an up link [ 303.546642][T12532] netlink: 'syz.4.1827': attribute type 6 has an invalid length. [ 303.563161][T12530] lo speed is unknown, defaulting to 1000 [ 303.632457][ T5843] Bluetooth: hci5: command 0x0405 tx timeout [ 303.888693][T12544] syzkaller0: entered promiscuous mode [ 303.901189][T12544] syzkaller0: entered allmulticast mode [ 303.929742][T12544] netlink: 'syz.1.1830': attribute type 1 has an invalid length. [ 304.087060][T12563] FAULT_INJECTION: forcing a failure. [ 304.087060][T12563] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 304.117070][T12563] CPU: 1 UID: 0 PID: 12563 Comm: syz.0.1837 Not tainted 6.16.0-rc5-syzkaller-01400-g8c2e602225f0 #0 PREEMPT(full) [ 304.117091][T12563] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 304.117099][T12563] Call Trace: [ 304.117104][T12563] [ 304.117109][T12563] dump_stack_lvl+0x189/0x250 [ 304.117128][T12563] ? __pfx____ratelimit+0x10/0x10 [ 304.117144][T12563] ? __pfx_dump_stack_lvl+0x10/0x10 [ 304.117158][T12563] ? __pfx__printk+0x10/0x10 [ 304.117183][T12563] should_fail_ex+0x414/0x560 [ 304.117203][T12563] _copy_to_user+0x31/0xb0 [ 304.117219][T12563] simple_read_from_buffer+0xe1/0x170 [ 304.117237][T12563] proc_fail_nth_read+0x1df/0x250 [ 304.117255][T12563] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 304.117272][T12563] ? rw_verify_area+0x258/0x650 [ 304.117284][T12563] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 304.117300][T12563] vfs_read+0x200/0x980 [ 304.117319][T12563] ? __pfx_vfs_read+0x10/0x10 [ 304.117330][T12563] ? rcu_is_watching+0x15/0xb0 [ 304.117343][T12563] ? do_sock_setsockopt+0x267/0x3e0 [ 304.117359][T12563] ? kfree+0x4d/0x440 [ 304.117369][T12563] ? sock_common_setsockopt+0x36/0xc0 [ 304.117384][T12563] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 304.117399][T12563] ? do_sock_setsockopt+0x267/0x3e0 [ 304.117422][T12563] ksys_read+0x145/0x250 [ 304.117436][T12563] ? __pfx_ksys_read+0x10/0x10 [ 304.117452][T12563] ? do_syscall_64+0xbe/0x3b0 [ 304.117473][T12563] do_syscall_64+0xfa/0x3b0 [ 304.117486][T12563] ? lockdep_hardirqs_on+0x9c/0x150 [ 304.117500][T12563] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 304.117511][T12563] ? clear_bhb_loop+0x60/0xb0 [ 304.117524][T12563] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 304.117535][T12563] RIP: 0033:0x7f4a2c18d33c [ 304.117546][T12563] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 304.117555][T12563] RSP: 002b:00007f4a2d05b030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 304.117574][T12563] RAX: ffffffffffffffda RBX: 00007f4a2c3b5fa0 RCX: 00007f4a2c18d33c [ 304.117582][T12563] RDX: 000000000000000f RSI: 00007f4a2d05b0a0 RDI: 0000000000000004 [ 304.117588][T12563] RBP: 00007f4a2d05b090 R08: 0000000000000000 R09: 0000000000000000 [ 304.117595][T12563] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 304.117602][T12563] R13: 0000000000000000 R14: 00007f4a2c3b5fa0 R15: 00007fff78c20908 [ 304.117622][T12563] [ 304.566756][T12555] __nla_validate_parse: 17 callbacks suppressed [ 304.566772][T12555] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1834'. [ 304.683746][T12587] netlink: 40 bytes leftover after parsing attributes in process `syz.5.1843'. [ 305.585110][T12564] lo speed is unknown, defaulting to 1000 [ 305.828909][T12607] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 306.047695][T12632] lo speed is unknown, defaulting to 1000 [ 306.127664][T12647] sch_tbf: burst 0 is lower than device veth0_to_team mtu (1514) ! [ 306.417116][T12662] lo speed is unknown, defaulting to 1000 [ 306.476388][T12668] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1865'. [ 306.502386][T12668] netlink: 32 bytes leftover after parsing attributes in process `syz.4.1865'. [ 306.585759][T12675] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1866'. [ 306.652679][T12675] bridge_slave_1: left allmulticast mode [ 306.672771][T12675] bridge_slave_1: left promiscuous mode [ 306.693204][T12675] bridge0: port 2(bridge_slave_1) entered disabled state [ 306.728050][T12675] bridge_slave_0: left allmulticast mode [ 306.751645][T12675] bridge_slave_0: left promiscuous mode [ 306.761808][T12675] bridge0: port 1(bridge_slave_0) entered disabled state [ 306.776964][T12678] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1869'. [ 306.949357][T12686] lo speed is unknown, defaulting to 1000 [ 307.035547][T12701] batadv_slave_1: entered promiscuous mode [ 307.105314][T12703] netlink: 'syz.0.1873': attribute type 142 has an invalid length. [ 307.116365][T12700] batadv_slave_1: left promiscuous mode [ 307.241225][T12710] lo speed is unknown, defaulting to 1000 [ 307.334344][T12721] netlink: 'syz.5.1878': attribute type 12 has an invalid length. [ 307.351267][T12721] netlink: 132 bytes leftover after parsing attributes in process `syz.5.1878'. [ 307.357450][T12727] netlink: 16 bytes leftover after parsing attributes in process `syz.5.1878'. [ 307.424917][T12729] netlink: 244 bytes leftover after parsing attributes in process `syz.0.1880'. [ 307.460369][T12726] netlink: 244 bytes leftover after parsing attributes in process `syz.0.1880'. [ 307.462637][T12732] IPVS: sync thread started: state = BACKUP, mcast_ifn = batadv0, syncid = 0, id = 0 [ 307.758164][T12744] lo speed is unknown, defaulting to 1000 [ 308.640828][T12813] tc_dump_action: action bad kind [ 308.664378][T12823] (unnamed net_device) (uninitialized): Removing last arp target with arp_interval on [ 308.701290][T12823] bond2: entered promiscuous mode [ 308.706499][T12823] bond2: entered allmulticast mode [ 308.712065][T12823] 8021q: adding VLAN 0 to HW filter on device bond2 [ 308.751514][T12824] lo speed is unknown, defaulting to 1000 [ 309.214399][T12860] netlink: 'syz.5.1926': attribute type 5 has an invalid length. [ 309.223648][T12862] netlink: 'syz.0.1925': attribute type 4 has an invalid length. [ 309.238284][T12862] : renamed from bond0 (while UP) [ 309.253512][T12862] netlink: 'syz.0.1925': attribute type 4 has an invalid length. [ 309.370361][ T5906] IPVS: starting estimator thread 0... [ 309.401681][T12874] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 309.418436][T12875] netdevsim netdevsim2 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 309.490487][T12871] IPVS: using max 44 ests per chain, 105600 per kthread [ 309.541870][T12875] netdevsim netdevsim2 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 309.593744][T12882] lo speed is unknown, defaulting to 1000 [ 309.680703][T12875] netdevsim netdevsim2 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 309.734171][T12895] netlink: 'syz.0.1936': attribute type 21 has an invalid length. [ 309.743593][T12892] lo speed is unknown, defaulting to 1000 [ 309.758709][T12875] netdevsim netdevsim2 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 309.815235][T12899] __nla_validate_parse: 12 callbacks suppressed [ 309.815249][T12899] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1936'. [ 309.891110][T12895] netlink: 'syz.0.1936': attribute type 6 has an invalid length. [ 309.904299][T12895] netlink: 64 bytes leftover after parsing attributes in process `syz.0.1936'. [ 309.920598][T12907] openvswitch: netlink: VXLAN extension message has 1 unknown bytes. [ 309.942264][T12902] netdevsim netdevsim1: Direct firmware load for ./file0 failed with error -2 [ 309.954206][T12905] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1936'. [ 309.992481][T12905] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1936'. [ 310.017215][T12902] netdevsim netdevsim1: Falling back to sysfs fallback for: ./file0 [ 310.065799][T12911] netlink: 16 bytes leftover after parsing attributes in process `syz.5.1940'. [ 310.138699][ T9455] netdevsim netdevsim2 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 310.149922][ T9455] netdevsim netdevsim2 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 310.194030][ T9455] netdevsim netdevsim2 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 310.207067][ T9455] netdevsim netdevsim2 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 310.358442][T12930] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1945'. [ 310.361052][T12929] netlink: 44 bytes leftover after parsing attributes in process `syz.0.1946'. [ 310.367904][T12930] netlink: 224 bytes leftover after parsing attributes in process `syz.2.1945'. [ 310.673058][T12946] netlink: 44 bytes leftover after parsing attributes in process `syz.2.1952'. [ 310.682846][T12946] netlink: 59 bytes leftover after parsing attributes in process `syz.2.1952'. [ 310.776870][T12955] dvmrp8: entered allmulticast mode [ 310.837647][T12961] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 310.978769][T12954] dvmrp8: left allmulticast mode [ 311.040570][T12974] bridge3: entered allmulticast mode [ 311.193622][T12996] sch_fq: defrate 257 ignored. [ 311.221951][T13003] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 311.314192][T13011] macsec1: entered allmulticast mode [ 311.319496][T13011] syz_tun: entered allmulticast mode [ 311.361787][T13011] syz_tun: left allmulticast mode [ 311.649531][T13042] pim6reg: entered allmulticast mode [ 311.828933][T13051] xt_CT: No such helper "pptp" [ 311.903175][T13051] lo speed is unknown, defaulting to 1000 [ 312.063881][T13061] 8021q: VLANs not supported on vxcan0 [ 312.440795][T13094] macsec1: entered promiscuous mode [ 312.446189][T13094] macsec1: entered allmulticast mode [ 312.727995][T13117] tipc: Enabled bearer , priority 0 [ 312.755242][T13117] tipc: Resetting bearer [ 312.779554][T13116] tipc: Disabling bearer [ 312.868321][T13128] netlink: 'syz.1.2012': attribute type 1 has an invalid length. [ 312.881487][T13128] netlink: 'syz.1.2012': attribute type 2 has an invalid length. [ 312.891840][T13128] netlink: 'syz.1.2012': attribute type 1 has an invalid length. [ 312.904705][T13128] netlink: 'syz.1.2012': attribute type 2 has an invalid length. [ 312.923507][T13133] netlink: 'syz.2.2013': attribute type 5 has an invalid length. [ 313.069361][T13153] ieee802154 phy1 wpan1: encryption failed: -22 [ 313.100727][T13158] ieee802154 phy1 wpan1: encryption failed: -22 [ 313.519802][T13196] infiniband syz1: RDMA CMA: cma_listen_on_dev, error -98 [ 313.575449][T13200] netlink: 'syz.0.2035': attribute type 2 has an invalid length. [ 313.617527][T13200] : entered promiscuous mode [ 313.653494][T13197] lo speed is unknown, defaulting to 1000 [ 314.494235][T13201] syz.4.2033: vmalloc error: size 268435456, failed to allocated page array size 524288, mode:0xdc2(GFP_KERNEL|__GFP_HIGHMEM|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 314.530096][T13201] CPU: 0 UID: 0 PID: 13201 Comm: syz.4.2033 Not tainted 6.16.0-rc5-syzkaller-01400-g8c2e602225f0 #0 PREEMPT(full) [ 314.530119][T13201] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 314.530126][T13201] Call Trace: [ 314.530132][T13201] [ 314.530138][T13201] dump_stack_lvl+0x189/0x250 [ 314.530160][T13201] ? __pfx_dump_stack_lvl+0x10/0x10 [ 314.530175][T13201] ? __pfx__printk+0x10/0x10 [ 314.530192][T13201] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 314.530208][T13201] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 314.530224][T13201] ? cpuset_print_current_mems_allowed+0x2ee/0x360 [ 314.530241][T13201] warn_alloc+0x214/0x310 [ 314.530263][T13201] ? __pfx_warn_alloc+0x10/0x10 [ 314.530285][T13201] ? __get_vm_area_node+0x28f/0x300 [ 314.530300][T13201] ? __do_replace+0xb4/0xaa0 [ 314.530314][T13201] __vmalloc_node_range_noprof+0x67e/0x12f0 [ 314.530329][T13201] ? stack_depot_save_flags+0x40/0x900 [ 314.530365][T13201] ? translate_table+0x1b4d/0x1f90 [ 314.530379][T13201] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 314.530401][T13201] ? __do_replace+0xb4/0xaa0 [ 314.530413][T13201] vzalloc_noprof+0xb2/0xf0 [ 314.530429][T13201] ? __do_replace+0xb4/0xaa0 [ 314.530442][T13201] __do_replace+0xb4/0xaa0 [ 314.530456][T13201] ? __pfx_translate_table+0x10/0x10 [ 314.530479][T13201] ? __pfx___do_replace+0x10/0x10 [ 314.530498][T13201] ? _copy_from_user+0x94/0xb0 [ 314.530517][T13201] do_arpt_set_ctl+0xa2a/0xf10 [ 314.530532][T13201] ? __mutex_trylock_common+0x153/0x260 [ 314.530551][T13201] ? __pfx_do_arpt_set_ctl+0x10/0x10 [ 314.530567][T13201] ? rcu_is_watching+0x15/0xb0 [ 314.530595][T13201] ? __mutex_unlock_slowpath+0x1cd/0x700 [ 314.530617][T13201] ? __pfx___mutex_lock+0x10/0x10 [ 314.530633][T13201] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 314.530648][T13201] ? aa_sk_perm+0x81e/0x950 [ 314.530668][T13201] ? __pfx_aa_sk_perm+0x10/0x10 [ 314.530690][T13201] nf_setsockopt+0x26c/0x290 [ 314.530710][T13201] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 314.530726][T13201] do_sock_setsockopt+0x257/0x3e0 [ 314.530747][T13201] ? __pfx_do_sock_setsockopt+0x10/0x10 [ 314.530770][T13201] ? __fget_files+0x2a/0x420 [ 314.530792][T13201] __x64_sys_setsockopt+0x18b/0x220 [ 314.530815][T13201] do_syscall_64+0xfa/0x3b0 [ 314.530830][T13201] ? lockdep_hardirqs_on+0x9c/0x150 [ 314.530843][T13201] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 314.530855][T13201] ? clear_bhb_loop+0x60/0xb0 [ 314.530868][T13201] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 314.530878][T13201] RIP: 0033:0x7fd23918e929 [ 314.530891][T13201] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 314.530900][T13201] RSP: 002b:00007fd23a052038 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 314.530913][T13201] RAX: ffffffffffffffda RBX: 00007fd2393b6160 RCX: 00007fd23918e929 [ 314.530922][T13201] RDX: 0000000000000060 RSI: 0000000000000000 RDI: 0000000000000003 [ 314.530930][T13201] RBP: 00007fd239210b39 R08: 0000000000000068 R09: 0000000000000000 [ 314.530937][T13201] R10: 0000200000000180 R11: 0000000000000246 R12: 0000000000000000 [ 314.530944][T13201] R13: 0000000000000000 R14: 00007fd2393b6160 R15: 00007ffcdbecea98 [ 314.530966][T13201] [ 314.530971][T13201] Mem-Info: [ 314.790159][T13201] active_anon:10474 inactive_anon:0 isolated_anon:0 [ 314.790159][T13201] active_file:1761 inactive_file:39919 isolated_file:0 [ 314.790159][T13201] unevictable:768 dirty:317 writeback:0 [ 314.790159][T13201] slab_reclaimable:12379 slab_unreclaimable:123810 [ 314.790159][T13201] mapped:41242 shmem:7101 pagetables:1369 [ 314.790159][T13201] sec_pagetables:0 bounce:0 [ 314.790159][T13201] kernel_misc_reclaimable:0 [ 314.790159][T13201] free:1265032 free_pcp:20354 free_cma:0 [ 314.906797][T13201] Node 0 active_anon:41796kB inactive_anon:0kB active_file:7044kB inactive_file:159472kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:164968kB dirty:1268kB writeback:0kB shmem:26868kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:14004kB pagetables:5436kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 315.000158][T13201] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:48kB pagetables:140kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 315.064410][T13201] Node 0 DMA free:15360kB boost:0kB min:204kB low:252kB high:300kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 315.107541][T13201] lowmem_reserve[]: 0 2498 2499 2499 2499 [ 315.123627][T13201] Node 0 DMA32 free:1150604kB boost:0kB min:34248kB low:42808kB high:51368kB reserved_highatomic:0KB free_highatomic:0KB active_anon:30048kB inactive_anon:0kB active_file:7044kB inactive_file:157896kB unevictable:1536kB writepending:1268kB present:3129332kB managed:2558272kB mlocked:0kB bounce:0kB free_pcp:73464kB local_pcp:52072kB free_cma:0kB [ 315.173352][T13255] IPVS: stopping backup sync thread 11141 ... [ 315.182361][T13201] lowmem_reserve[]: 0 0 1 1 1 [ 315.187143][T13201] Node 0 Normal free:12kB boost:0kB min:20kB low:24kB high:28kB reserved_highatomic:0KB free_highatomic:0KB active_anon:48kB inactive_anon:0kB active_file:0kB inactive_file:1576kB unevictable:0kB writepending:0kB present:1048580kB managed:1644kB mlocked:0kB bounce:0kB free_pcp:8kB local_pcp:8kB free_cma:0kB [ 315.222249][T13201] lowmem_reserve[]: 0 0 0 0 0 [ 315.226967][T13201] Node 1 Normal free:3895108kB boost:0kB min:55632kB low:69540kB high:83448kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:1536kB writepending:0kB present:4194300kB managed:4111164kB mlocked:0kB bounce:0kB free_pcp:20592kB local_pcp:8240kB free_cma:0kB [ 315.267513][T13201] lowmem_reserve[]: 0 0 0 0 0 [ 315.273109][T13201] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 315.316008][T13266] netlink: 'syz.0.2054': attribute type 2 has an invalid length. [ 315.325508][T13201] Node 0 DMA32: 2*4kB (E) 1*8kB (M) 1*16kB (M) 1*32kB (E) 2*64kB (UM) 241*128kB (UM) 377*256kB (UME) 284*512kB (UM) 159*1024kB (UM) 7*2048kB (UME) 171*4096kB (UM) = 1150528kB [ 315.346724][T13260] netlink: 'syz.2.2055': attribute type 1 has an invalid length. [ 315.355497][T13260] netlink: 'syz.2.2055': attribute type 4 has an invalid length. [ 315.363887][T13260] __nla_validate_parse: 15 callbacks suppressed [ 315.363898][T13260] netlink: 9462 bytes leftover after parsing attributes in process `syz.2.2055'. [ 315.399672][T13266] netlink: 'syz.0.2054': attribute type 2 has an invalid length. [ 315.408791][T13201] Node 0 Normal: 1*4kB (M) 1*8kB (M) 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB [ 315.408886][T13260] netlink: 188 bytes leftover after parsing attributes in process `syz.2.2055'. [ 315.429257][T13261] netlink: 188 bytes leftover after parsing attributes in process `syz.2.2055'. [ 315.439064][T13268] SET target dimension over the limit! [ 315.462594][T13201] 0*4096kB = 12kB [ 315.466254][T13201] Node 1 Normal: 2*4kB (UE) 18*8kB (UME) 50*16kB (UME) 110*32kB (UME) 22*64kB (UME) 7*128kB (UME) 3*256kB (UM) 3*512kB (UM) 3*1024kB (UME) 2*2048kB (UE) 947*4096kB (M) = 3895160kB [ 315.528990][T13201] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 315.545769][T13201] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 315.561404][T13201] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 315.601423][T13201] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 315.623451][T13201] 45910 total pagecache pages [ 315.640672][T13201] 0 pages in swap cache [ 315.644885][T13201] Free swap = 124996kB [ 315.649028][T13201] Total swap = 124996kB [ 315.664684][T13201] 2097051 pages RAM [ 315.668503][T13201] 0 pages HighMem/MovableOnly [ 315.674176][T13201] 425441 pages reserved [ 315.692138][T13201] 0 pages cma reserved [ 315.788907][T13289] netlink: 76 bytes leftover after parsing attributes in process `syz.0.2061'. [ 315.794549][T13290] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2062'. [ 315.860085][T13289] netlink: 76 bytes leftover after parsing attributes in process `syz.0.2061'. [ 315.870930][ T51] Bluetooth: hci0: Opcode 0x0c03 failed: -110 [ 316.032493][T13300] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2064'. [ 316.116590][T13304] bridge7: port 1(ip6gretap1) entered blocking state [ 316.152308][T13304] bridge7: port 1(ip6gretap1) entered disabled state [ 316.173255][T13304] ip6gretap1: entered allmulticast mode [ 316.179553][T13309] netlink: 64 bytes leftover after parsing attributes in process `syz.4.2066'. [ 316.194666][T13304] ip6gretap1: entered promiscuous mode [ 316.224079][T13300] veth3: entered promiscuous mode [ 316.229348][T13300] bridge7: port 2(veth3) entered blocking state [ 316.236444][T13300] bridge7: port 2(veth3) entered disabled state [ 316.260979][T13300] veth3: entered allmulticast mode [ 316.268176][ T51] Bluetooth: hci5: link tx timeout [ 316.274641][ T51] Bluetooth: hci5: killing stalled connection 11:aa:aa:aa:aa:aa [ 316.276157][T13303] lo speed is unknown, defaulting to 1000 [ 316.290201][ T51] Bluetooth: hci5: link tx timeout [ 316.296471][ T51] Bluetooth: hci5: killing stalled connection 11:aa:aa:aa:aa:aa [ 316.313533][ T51] Bluetooth: hci5: link tx timeout [ 316.318816][ T51] Bluetooth: hci5: killing stalled connection 11:aa:aa:aa:aa:aa [ 316.326764][ T51] Bluetooth: hci5: link tx timeout [ 316.332312][ T51] Bluetooth: hci5: killing stalled connection 11:aa:aa:aa:aa:aa [ 316.343761][ T51] Bluetooth: hci5: link tx timeout [ 316.348883][ T51] Bluetooth: hci5: killing stalled connection 11:aa:aa:aa:aa:aa [ 316.360498][ T51] Bluetooth: hci5: link tx timeout [ 316.365884][ T51] Bluetooth: hci5: killing stalled connection 11:aa:aa:aa:aa:aa [ 316.432194][T13324] netlink: 168 bytes leftover after parsing attributes in process `syz.1.2070'. [ 316.592545][ T1301] ieee802154 phy1 wpan1: encryption failed: -22 [ 316.775339][T13345] lo speed is unknown, defaulting to 1000 [ 316.963213][T13351] lo speed is unknown, defaulting to 1000 [ 317.119521][T13361] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2080'. [ 317.225055][T13361] ip6tnl2: entered promiscuous mode [ 317.231677][T13361] ip6tnl2: entered allmulticast mode [ 317.561763][T13382] tipc: Enabled bearer , priority 0 [ 317.624432][T13382] syzkaller0: entered allmulticast mode [ 317.649138][T13381] tipc: Disabling bearer [ 317.901233][ T9467] netdevsim netdevsim0 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 317.922202][ T9467] netdevsim netdevsim0 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 317.940265][ T9467] netdevsim netdevsim0 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 317.965714][ T9467] netdevsim netdevsim0 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 318.350444][ T51] Bluetooth: hci5: command 0x0405 tx timeout [ 318.546118][T13452] bridge0: entered promiscuous mode [ 318.835013][ C1] vcan0: j1939_tp_rxtimer: 0xffff88805a07b000: rx timeout, send abort [ 318.844488][ C1] vcan0: j1939_xtp_rx_abort_one: 0xffff88805a07b000: 0x40000: (3) A timeout occurred and this is the connection abort to close the session. [ 318.903773][T13463] xt_CT: No such helper "syz0" [ 319.118951][T13475] lo speed is unknown, defaulting to 1000 [ 319.798596][T13524] validate_nla: 12 callbacks suppressed [ 319.798611][T13524] netlink: 'syz.1.2131': attribute type 29 has an invalid length. [ 320.026280][T13538] tun0: tun_chr_ioctl cmd 2148553947 [ 320.088852][T13546] lo speed is unknown, defaulting to 1000 [ 320.195979][T13556] netlink: 'syz.5.2141': attribute type 1 has an invalid length. [ 320.232900][T13556] 8021q: adding VLAN 0 to HW filter on device bond1 [ 320.280311][T13556] 8021q: adding VLAN 0 to HW filter on device bond1 [ 320.302282][T13556] bond1: (slave vxcan3): The slave device specified does not support setting the MAC address [ 320.313974][T13556] bond1: (slave vxcan3): Error -95 calling set_mac_address [ 320.395408][T13567] gretap1: entered promiscuous mode [ 320.418114][T13570] netlink: 'syz.1.2144': attribute type 10 has an invalid length. [ 320.439807][T13567] bond1: (slave gretap1): making interface the new active one [ 320.456046][T13567] bond1: (slave gretap1): Enslaving as an active interface with an up link [ 320.477561][T13556] macvlan0: entered promiscuous mode [ 320.490881][T13556] macvlan0: entered allmulticast mode [ 320.528061][T13556] bond1: entered promiscuous mode [ 320.551531][T13556] 8021q: adding VLAN 0 to HW filter on device macvlan0 [ 320.585099][T13556] bond1: (slave macvlan0): the slave hw address is in use by the bond; giving it the hw address of gretap1 [ 320.653842][T13556] bond1: left promiscuous mode [ 321.354969][T13618] xt_ecn: cannot match TCP bits for non-tcp packets [ 321.392275][T13612] lo speed is unknown, defaulting to 1000 [ 321.455191][T13624] mac80211_hwsim hwsim11 wlan1: entered allmulticast mode [ 321.506196][T13626] __nla_validate_parse: 5 callbacks suppressed [ 321.506209][T13626] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2165'. [ 321.662157][T13626] netlink: 52 bytes leftover after parsing attributes in process `syz.2.2165'. [ 321.687807][T13632] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2166'. [ 321.779378][T13632] (unnamed net_device) (uninitialized): option ad_actor_system: mode dependency failed, not supported in mode balance-rr(0) [ 321.847831][T13639] netlink: 'syz.4.2166': attribute type 10 has an invalid length. [ 321.856689][T13631] netlink: 'syz.4.2166': attribute type 10 has an invalid length. [ 321.871852][T13641] FAULT_INJECTION: forcing a failure. [ 321.871852][T13641] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 321.881714][T13638] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2169'. [ 321.885338][T13641] CPU: 0 UID: 0 PID: 13641 Comm: syz.5.2170 Not tainted 6.16.0-rc5-syzkaller-01400-g8c2e602225f0 #0 PREEMPT(full) [ 321.885354][T13641] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 321.885366][T13641] Call Trace: [ 321.885371][T13641] [ 321.885376][T13641] dump_stack_lvl+0x189/0x250 [ 321.885393][T13641] ? __pfx____ratelimit+0x10/0x10 [ 321.885406][T13641] ? __pfx_dump_stack_lvl+0x10/0x10 [ 321.885418][T13641] ? __pfx__printk+0x10/0x10 [ 321.885432][T13641] ? __might_fault+0xb0/0x130 [ 321.885451][T13641] should_fail_ex+0x414/0x560 [ 321.885469][T13641] _copy_from_user+0x2d/0xb0 [ 321.885482][T13641] ___sys_sendmsg+0x158/0x2a0 [ 321.885494][T13641] ? __pfx____sys_sendmsg+0x10/0x10 [ 321.885527][T13641] ? __fget_files+0x2a/0x420 [ 321.885539][T13641] ? __fget_files+0x3a0/0x420 [ 321.885558][T13641] __x64_sys_sendmsg+0x19b/0x260 [ 321.885570][T13641] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 321.885588][T13641] ? rcu_is_watching+0x15/0xb0 [ 321.885601][T13641] ? trace_sys_enter+0x25/0x120 [ 321.885614][T13641] do_syscall_64+0xfa/0x3b0 [ 321.885627][T13641] ? lockdep_hardirqs_on+0x9c/0x150 [ 321.885639][T13641] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 321.885649][T13641] ? clear_bhb_loop+0x60/0xb0 [ 321.885661][T13641] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 321.885671][T13641] RIP: 0033:0x7fc95f18e929 [ 321.885681][T13641] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 321.885690][T13641] RSP: 002b:00007fc96004c038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 321.885702][T13641] RAX: ffffffffffffffda RBX: 00007fc95f3b5fa0 RCX: 00007fc95f18e929 [ 321.885709][T13641] RDX: 0000000000000044 RSI: 0000200000002000 RDI: 0000000000000004 [ 321.885716][T13641] RBP: 00007fc96004c090 R08: 0000000000000000 R09: 0000000000000000 [ 321.885722][T13641] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 321.885728][T13641] R13: 0000000000000000 R14: 00007fc95f3b5fa0 R15: 00007fffbbc390c8 [ 321.885746][T13641] [ 322.113532][T13639] bond0: (slave 0!): Enslaving as an active interface with an up link [ 322.119992][T13648] netlink: 32 bytes leftover after parsing attributes in process `syz.2.2169'. [ 322.122666][T13639] netlink: 'syz.4.2166': attribute type 10 has an invalid length. [ 322.156255][T13631] netlink: 'syz.4.2166': attribute type 10 has an invalid length. [ 322.166980][T13650] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 322.196520][T13631] netlink: 'syz.4.2166': attribute type 10 has an invalid length. [ 322.196520][T13639] netlink: 'syz.4.2166': attribute type 10 has an invalid length. [ 322.196599][T13631] netlink: 'syz.4.2166': attribute type 10 has an invalid length. [ 322.447808][T13656] lo speed is unknown, defaulting to 1000 [ 322.502285][T13659] lo speed is unknown, defaulting to 1000 [ 322.643046][ C1] ------------[ cut here ]------------ [ 322.648739][ C1] WARNING: CPU: 1 PID: 13675 at net/ipv4/af_inet.c:156 inet_sock_destruct+0x623/0x730 [ 322.658319][ C1] Modules linked in: [ 322.662423][ C1] CPU: 1 UID: 0 PID: 13675 Comm: syz.1.2182 Not tainted 6.16.0-rc5-syzkaller-01400-g8c2e602225f0 #0 PREEMPT(full) [ 322.674509][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 322.684591][ C1] RIP: 0010:inet_sock_destruct+0x623/0x730 [ 322.690430][ C1] Code: 0f 0b 90 e9 62 fe ff ff e8 6a 8a c8 f7 90 0f 0b 90 e9 95 fe ff ff e8 5c 8a c8 f7 90 0f 0b 90 e9 bb fe ff ff e8 4e 8a c8 f7 90 <0f> 0b 90 e9 e1 fe ff ff 89 f9 80 e1 07 80 c1 03 38 c1 0f 8c 9f fc [ 322.710092][ C1] RSP: 0018:ffffc90000a08be8 EFLAGS: 00010246 [ 322.716155][ C1] RAX: ffffffff89f7ad82 RBX: dffffc0000000000 RCX: ffff888059368000 [ 322.724122][ C1] RDX: 0000000000000100 RSI: 0000000000000fff RDI: 0000000000000000 [ 322.732091][ C1] RBP: 0000000000000fff R08: ffff88803bc1029f R09: 1ffff11007782053 [ 322.740106][ C1] R10: dffffc0000000000 R11: ffffed1007782054 R12: ffff88803bc10000 [ 322.748070][ C1] R13: dffffc0000000000 R14: ffff88803bc10284 R15: 1ffff11007782002 [ 322.756072][ C1] FS: 0000555560adc500(0000) GS:ffff888125d11000(0000) knlGS:0000000000000000 [ 322.765018][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 322.771615][ C1] CR2: 0000555560aef588 CR3: 0000000079c6a000 CR4: 00000000003526f0 [ 322.779680][ C1] Call Trace: [ 322.782973][ C1] [ 322.785816][ C1] ? inet6_cleanup_sock+0x197/0x230 [ 322.791035][ C1] ? __pfx_inet6_sock_destruct+0x10/0x10 [ 322.796666][ C1] __sk_destruct+0x89/0x660 [ 322.801174][ C1] ? __pfx___sk_destruct+0x10/0x10 [ 322.806287][ C1] ? rcu_core+0xc34/0x1710 [ 322.810725][ C1] rcu_core+0xca8/0x1710 [ 322.814982][ C1] ? __pfx_rcu_core+0x10/0x10 [ 322.819659][ C1] ? seqcount_lockdep_reader_access+0x15f/0x1c0 [ 322.825924][ C1] ? kvm_sched_clock_read+0x11/0x20 [ 322.831145][ C1] ? sched_clock_cpu+0x74/0x430 [ 322.835998][ C1] ? __pfx_sched_clock_cpu+0x10/0x10 [ 322.841301][ C1] ? __pfx___local_bh_disable_ip+0x10/0x10 [ 322.847102][ C1] ? handle_softirqs+0x717/0x870 [ 322.852072][ C1] handle_softirqs+0x286/0x870 [ 322.856835][ C1] ? do_softirq+0xec/0x180 [ 322.861273][ C1] ? __pfx_handle_softirqs+0x10/0x10 [ 322.866562][ C1] ? fpu_clone+0x27c/0xa50 [ 322.871007][ C1] do_softirq+0xec/0x180 [ 322.875281][ C1] [ 322.878211][ C1] [ 322.881166][ C1] ? __pfx_do_softirq+0x10/0x10 [ 322.886022][ C1] ? lockdep_softirqs_on+0x13b/0x1c0 [ 322.891323][ C1] __local_bh_enable_ip+0x17d/0x1c0 [ 322.896517][ C1] ? __pfx___local_bh_enable_ip+0x10/0x10 [ 322.902255][ C1] ? xfd_validate_state+0x6d/0x150 [ 322.907370][ C1] ? save_fpregs_to_fpstate+0x17a/0x210 [ 322.912936][ C1] ? fpu_clone+0x27c/0xa50 [ 322.917350][ C1] fpu_clone+0x44c/0xa50 [ 322.921628][ C1] copy_thread+0x3f5/0x9a0 [ 322.926048][ C1] ? copy_process+0x978/0x3b80 [ 322.930833][ C1] copy_process+0x187b/0x3b80 [ 322.935687][ C1] ? copy_process+0x978/0x3b80 [ 322.940482][ C1] ? __pfx_copy_process+0x10/0x10 [ 322.945518][ C1] kernel_clone+0x21e/0x870 [ 322.950053][ C1] ? __pfx_kernel_clone+0x10/0x10 [ 322.955083][ C1] ? __lock_acquire+0xab9/0xd20 [ 322.959936][ C1] __se_sys_clone3+0x256/0x2d0 [ 322.964727][ C1] ? __might_fault+0xb0/0x130 [ 322.969408][ C1] ? __pfx___se_sys_clone3+0x10/0x10 [ 322.974724][ C1] ? _copy_to_user+0x8a/0xb0 [ 322.979326][ C1] ? do_user_addr_fault+0xc8a/0x1390 [ 322.984634][ C1] ? do_syscall_64+0xbe/0x3b0 [ 322.989323][ C1] do_syscall_64+0xfa/0x3b0 [ 322.993843][ C1] ? lockdep_hardirqs_on+0x9c/0x150 [ 322.999044][ C1] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 323.005127][ C1] ? clear_bhb_loop+0x60/0xb0 [ 323.009808][ C1] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 323.015720][ C1] RIP: 0033:0x7f76719c3189 [ 323.020146][ C1] Code: c3 08 00 48 8d 3d fc c3 08 00 e8 02 29 f6 ff 66 90 b8 ea ff ff ff 48 85 ff 74 2c 48 85 d2 74 27 49 89 c8 b8 b3 01 00 00 0f 05 <48> 85 c0 7c 18 74 01 c3 31 ed 48 83 e4 f0 4c 89 c7 ff d2 48 89 c7 [ 323.039774][ C1] RSP: 002b:00007ffeaf35b108 EFLAGS: 00000206 ORIG_RAX: 00000000000001b3 [ 323.048210][ C1] RAX: ffffffffffffffda RBX: 00007f7671945590 RCX: 00007f76719c3189 [ 323.056204][ C1] RDX: 00007f7671945590 RSI: 0000000000000058 RDI: 00007ffeaf35b150 [ 323.064200][ C1] RBP: 00007f76728dd6c0 R08: 00007f76728dd6c0 R09: 00007ffeaf35b237 [ 323.072198][ C1] R10: 0000000000000008 R11: 0000000000000206 R12: ffffffffffffffa8 [ 323.080191][ C1] R13: 000000000000004d R14: 00007ffeaf35b150 R15: 00007ffeaf35b238 [ 323.088177][ C1] [ 323.091218][ C1] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 323.098501][ C1] CPU: 1 UID: 0 PID: 13675 Comm: syz.1.2182 Not tainted 6.16.0-rc5-syzkaller-01400-g8c2e602225f0 #0 PREEMPT(full) [ 323.110560][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 323.120622][ C1] Call Trace: [ 323.123900][ C1] [ 323.126742][ C1] dump_stack_lvl+0x99/0x250 [ 323.131331][ C1] ? __asan_memcpy+0x40/0x70 [ 323.135913][ C1] ? __pfx_dump_stack_lvl+0x10/0x10 [ 323.141108][ C1] ? __pfx__printk+0x10/0x10 [ 323.145706][ C1] panic+0x2db/0x790 [ 323.149692][ C1] ? __pfx_panic+0x10/0x10 [ 323.154100][ C1] ? show_trace_log_lvl+0x4fb/0x550 [ 323.159428][ C1] __warn+0x31b/0x4b0 [ 323.163413][ C1] ? inet_sock_destruct+0x623/0x730 [ 323.168622][ C1] ? inet_sock_destruct+0x623/0x730 [ 323.173827][ C1] report_bug+0x2be/0x4f0 [ 323.178132][ C1] ? inet_sock_destruct+0x623/0x730 [ 323.183304][ C1] ? inet_sock_destruct+0x623/0x730 [ 323.188503][ C1] ? inet_sock_destruct+0x625/0x730 [ 323.193673][ C1] handle_bug+0x84/0x160 [ 323.197892][ C1] exc_invalid_op+0x1a/0x50 [ 323.202368][ C1] asm_exc_invalid_op+0x1a/0x20 [ 323.207188][ C1] RIP: 0010:inet_sock_destruct+0x623/0x730 [ 323.212968][ C1] Code: 0f 0b 90 e9 62 fe ff ff e8 6a 8a c8 f7 90 0f 0b 90 e9 95 fe ff ff e8 5c 8a c8 f7 90 0f 0b 90 e9 bb fe ff ff e8 4e 8a c8 f7 90 <0f> 0b 90 e9 e1 fe ff ff 89 f9 80 e1 07 80 c1 03 38 c1 0f 8c 9f fc [ 323.232561][ C1] RSP: 0018:ffffc90000a08be8 EFLAGS: 00010246 [ 323.238619][ C1] RAX: ffffffff89f7ad82 RBX: dffffc0000000000 RCX: ffff888059368000 [ 323.246569][ C1] RDX: 0000000000000100 RSI: 0000000000000fff RDI: 0000000000000000 [ 323.254782][ C1] RBP: 0000000000000fff R08: ffff88803bc1029f R09: 1ffff11007782053 [ 323.262729][ C1] R10: dffffc0000000000 R11: ffffed1007782054 R12: ffff88803bc10000 [ 323.270674][ C1] R13: dffffc0000000000 R14: ffff88803bc10284 R15: 1ffff11007782002 [ 323.278629][ C1] ? inet_sock_destruct+0x622/0x730 [ 323.283810][ C1] ? inet_sock_destruct+0x622/0x730 [ 323.288979][ C1] ? inet6_cleanup_sock+0x197/0x230 [ 323.294150][ C1] ? __pfx_inet6_sock_destruct+0x10/0x10 [ 323.299767][ C1] __sk_destruct+0x89/0x660 [ 323.304243][ C1] ? __pfx___sk_destruct+0x10/0x10 [ 323.309333][ C1] ? rcu_core+0xc34/0x1710 [ 323.313722][ C1] rcu_core+0xca8/0x1710 [ 323.317952][ C1] ? __pfx_rcu_core+0x10/0x10 [ 323.322603][ C1] ? seqcount_lockdep_reader_access+0x15f/0x1c0 [ 323.328823][ C1] ? kvm_sched_clock_read+0x11/0x20 [ 323.334002][ C1] ? sched_clock_cpu+0x74/0x430 [ 323.338834][ C1] ? __pfx_sched_clock_cpu+0x10/0x10 [ 323.344097][ C1] ? __pfx___local_bh_disable_ip+0x10/0x10 [ 323.349877][ C1] ? handle_softirqs+0x717/0x870 [ 323.354795][ C1] handle_softirqs+0x286/0x870 [ 323.359536][ C1] ? do_softirq+0xec/0x180 [ 323.363928][ C1] ? __pfx_handle_softirqs+0x10/0x10 [ 323.369189][ C1] ? fpu_clone+0x27c/0xa50 [ 323.373590][ C1] do_softirq+0xec/0x180 [ 323.377810][ C1] [ 323.380729][ C1] [ 323.383659][ C1] ? __pfx_do_softirq+0x10/0x10 [ 323.388513][ C1] ? lockdep_softirqs_on+0x13b/0x1c0 [ 323.393787][ C1] __local_bh_enable_ip+0x17d/0x1c0 [ 323.398969][ C1] ? __pfx___local_bh_enable_ip+0x10/0x10 [ 323.404662][ C1] ? xfd_validate_state+0x6d/0x150 [ 323.409753][ C1] ? save_fpregs_to_fpstate+0x17a/0x210 [ 323.415275][ C1] ? fpu_clone+0x27c/0xa50 [ 323.419756][ C1] fpu_clone+0x44c/0xa50 [ 323.423982][ C1] copy_thread+0x3f5/0x9a0 [ 323.428376][ C1] ? copy_process+0x978/0x3b80 [ 323.433118][ C1] copy_process+0x187b/0x3b80 [ 323.437776][ C1] ? copy_process+0x978/0x3b80 [ 323.442526][ C1] ? __pfx_copy_process+0x10/0x10 [ 323.447533][ C1] kernel_clone+0x21e/0x870 [ 323.452015][ C1] ? __pfx_kernel_clone+0x10/0x10 [ 323.457019][ C1] ? __lock_acquire+0xab9/0xd20 [ 323.461850][ C1] __se_sys_clone3+0x256/0x2d0 [ 323.466588][ C1] ? __might_fault+0xb0/0x130 [ 323.471239][ C1] ? __pfx___se_sys_clone3+0x10/0x10 [ 323.476509][ C1] ? _copy_to_user+0x8a/0xb0 [ 323.481081][ C1] ? do_user_addr_fault+0xc8a/0x1390 [ 323.486342][ C1] ? do_syscall_64+0xbe/0x3b0 [ 323.490998][ C1] do_syscall_64+0xfa/0x3b0 [ 323.495477][ C1] ? lockdep_hardirqs_on+0x9c/0x150 [ 323.500655][ C1] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 323.506694][ C1] ? clear_bhb_loop+0x60/0xb0 [ 323.511346][ C1] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 323.517215][ C1] RIP: 0033:0x7f76719c3189 [ 323.521608][ C1] Code: c3 08 00 48 8d 3d fc c3 08 00 e8 02 29 f6 ff 66 90 b8 ea ff ff ff 48 85 ff 74 2c 48 85 d2 74 27 49 89 c8 b8 b3 01 00 00 0f 05 <48> 85 c0 7c 18 74 01 c3 31 ed 48 83 e4 f0 4c 89 c7 ff d2 48 89 c7 [ 323.541189][ C1] RSP: 002b:00007ffeaf35b108 EFLAGS: 00000206 ORIG_RAX: 00000000000001b3 [ 323.549577][ C1] RAX: ffffffffffffffda RBX: 00007f7671945590 RCX: 00007f76719c3189 [ 323.557524][ C1] RDX: 00007f7671945590 RSI: 0000000000000058 RDI: 00007ffeaf35b150 [ 323.565473][ C1] RBP: 00007f76728dd6c0 R08: 00007f76728dd6c0 R09: 00007ffeaf35b237 [ 323.573431][ C1] R10: 0000000000000008 R11: 0000000000000206 R12: ffffffffffffffa8 [ 323.581406][ C1] R13: 000000000000004d R14: 00007ffeaf35b150 R15: 00007ffeaf35b238 [ 323.589385][ C1] [ 323.592573][ C1] Kernel Offset: disabled [ 323.596869][ C1] Rebooting in 86400 seconds..