last executing test programs: 8.660572171s ago: executing program 1 (id=3408): r0 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000540)=ANY=[@ANYBLOB="b4050000fdff7f006110580000000000c60000000000000095000000000000009f33ef60916e6e713f1eeb0b725ad99b817fd98cd824498949714ffaac8a6f770600dcca55f21f3ca9e822d182054d54d53cd2b6db714e4beb5447000001000000008f2b9000f22425e4097ed62cbc891061017cfa6fa26fa7088c60897d4a6148a1c1e43f00001bde60beac671e8e8fdecb03588aa623fa71f31bf0f871ab5c2ff88afc60027f4e5b5271ed58e835cf0d0000000098b51fe6b1b8d9dbe87dcff414ed000000000000000000000000000000000000000000000000000000b347abe6352a080f8140e5fd10747b6ecdb3540546bf636e3d6e700e5b0500000000000000eb9e1403e6c8f7a187eaf60f3a17f0f046a307a403c19d9829c90bd2114252581567acae715cbe1b57d5cda432c5b910400623d24195405f2e76ccb7b37b41215c184e731fb1"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000)={0x0, 0x4}, 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x94) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0f000000040000000400000012"], 0x48) r2 = bpf$BPF_LINK_CREATE(0x1c, &(0x7f0000000180)={r0, r1, 0x26, 0x0, @void}, 0x10) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_INITMSG(r3, 0x84, 0x2, &(0x7f00000000c0)={0xfffc, 0x0, 0x30, 0x1ff}, 0x8) sendto$inet6(r3, &(0x7f00000004c0)="d7", 0x1, 0x10000, &(0x7f0000000000)={0xa, 0x0, 0x4, @private1, 0x8}, 0x1c) connect$inet6(r3, &(0x7f0000000080)={0xa, 0x4e23, 0x3ff, @dev={0xfe, 0x80, '\x00', 0x1b}, 0x10000}, 0x1c) close(0x3) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x3, 0x4, &(0x7f0000000100)=ANY=[@ANYBLOB="1800000066d4ce1a0b4a523f0ed65c753ab73e7243f26b426bd5ed3ca20400c6351f9c9d7efc60000072013000de32172eb1d01db632513db90bbdc385ecefe625015ac4c2c300003b3f95"], &(0x7f00000000c0)='syzkaller\x00', 0x6, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xc3cb}, 0x94) bpf$BPF_LINK_UPDATE(0x1d, &(0x7f0000000040)={r2, r0, 0x4, r0}, 0x6) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x48403, 0x0) r5 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000002c40)={0x1, 0x17, &(0x7f00000007c0)=@ringbuf={{}, {{0x18, 0x1, 0x1, 0x0, r5}, {}, {}, {0x85, 0x0, 0x0, 0x5}}, {{0x6, 0x0, 0x6}, {0x6, 0x0, 0x0, 0xb}}, [@printk={@p, {0x3, 0x3, 0x3, 0xa, 0x9}, {0x5, 0x1, 0xa, 0x1, 0x9}, {0x7, 0x0, 0x3}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x2}, {0x56}}], {{0x4, 0x1, 0x2, 0x3}, {0x5, 0x0, 0xb, 0x3}, {0x85, 0x0, 0x0, 0x76}}}, &(0x7f0000000780)='syzkaller\x00', 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) unshare(0x2c020400) r6 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r6, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x7}, 0x4) setsockopt$packet_int(r6, 0x107, 0x16, &(0x7f0000000000)=0x4, 0x4) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x2}) ioctl$TUNSETOWNER(r4, 0x400454cc, 0xffffffffffffffff) 8.46273153s ago: executing program 0 (id=3410): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x11, 0x3, &(0x7f0000000080)=@framed={{0xc3, 0xa, 0xa, 0xfe00, 0x0, 0x71, 0x10, 0x1a}}, &(0x7f0000000480)='syzkaller\x00'}, 0x94) r1 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r1, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f0000000200), 0x4) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000600)={0x64, 0x0, 0x1, 0x401, 0x0, 0x1a14, {0x2}, [@CTA_TUPLE_ORIG={0x24, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @multicast1}, {0x8, 0x2, @multicast1}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TUPLE_REPLY={0x24, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @initdev={0xac, 0x1e, 0x0, 0x0}}, {0x8, 0x2, @initdev={0xac, 0x1e, 0x0, 0x0}}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TIMEOUT={0x8, 0x7, 0x1, 0x0, 0xffff639c}]}, 0x64}}, 0x0) sendmsg$IPCTNL_MSG_CT_NEW(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)=ANY=[@ANYBLOB="3800000002011d04000000000000000002000000240001801400018008000100e000000108000200e00000010c000280050001"], 0x38}}, 0x0) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000840)={r0, 0xe0, &(0x7f00000008c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, &(0x7f0000000880)=[0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x5, 0x4, &(0x7f00000005c0)=[0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000600)=[0x0, 0x0, 0x0, 0x0], 0x0, 0x0, &(0x7f0000000640)=[{}, {}], 0x10, 0x10, &(0x7f0000000680), &(0x7f0000000580), 0x8, 0x0, 0x8, 0x8, &(0x7f0000000700)}}, 0x10) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x11, 0x10, &(0x7f0000000300)=@ringbuf={{}, {}, {}, [@call={0x85, 0x0, 0x0, 0x11}], {{}, {}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000400)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000140)={&(0x7f0000000180)='tlb_flush\x00', r3}, 0x10) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = epoll_create1(0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000640)=@newtaction={0x64, 0x30, 0x9e54f29ff072a93b, 0x0, 0x25dfdbfc, {}, [{0x50, 0x1, [@m_csum={0x4c, 0x1, 0x0, 0x0, {{0x9}, {0x30, 0x2, 0x0, 0x1, [@TCA_CSUM_PARMS={0x1c, 0x1, {{0x4}, 0x2d}}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x64}, 0x1, 0x0, 0x0, 0x4}, 0x0) epoll_ctl$EPOLL_CTL_ADD(r6, 0x1, r4, &(0x7f0000003b80)={0x10000001}) write(r5, 0x0, 0x0) ioctl$PPPIOCSDEBUG(0xffffffffffffffff, 0x40047440, &(0x7f00000001c0)=0x6) r7 = bpf$ITER_CREATE(0x21, &(0x7f0000000780), 0x8) accept4$netrom(r7, &(0x7f00000007c0)={{0x3, @null}, [@bcast, @rose, @remote, @null, @bcast, @netrom, @bcast]}, &(0x7f00000009c0)=0x48, 0x80000) socket$alg(0x26, 0x5, 0x0) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000140)={0x1, 0x58, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0}}, 0x10) r9 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000180)={&(0x7f0000001400)=ANY=[], &(0x7f0000000400)=""/4096, 0x68, 0x1000, 0x0, 0x80}, 0x28) bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x4, 0x3, &(0x7f0000000180)=ANY=[], &(0x7f0000000240)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', r8, @fallback=0x2, r9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) bpf$BPF_RAW_TRACEPOINT_OPEN_UNNAMED(0x11, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_TASK_FD_QUERY(0x14, 0x0, 0x0) r10 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f00000008c0)=ANY=[@ANYBLOB="b702000023000000bfa30000000000000703000000feffff7a0af0ff0000000079a4f0ff00000000b7060000ffffffff2d6405000000000065040400010001010404000001007d60b7030000010000006a0a00fe00000000850000000d0000009700000001000000950000000000000075cdc4b57b0c65752a3ad50000007ddd0000000000639100000000000000000000ff7f0000292f17cee19d0001000000000000000000cb04fcbb0ba9918d37b056b9bbd11b6b9f6cf7db6d574620260000000000008062d77e84cef4a2ab938f65aac33c4d620de2c9b7dc10d7d313f9f57606b83b994fb484510bef2e4852f5c2fe6faaf75e5cc4051ade12f41deff6df6a936b4ec3827c739bb39aad16cc75fe369258673b5d053bdec75dca3772be2c9d2d29db3d36dd01797bd3f15aa6aadbeab2a01685108e61aa000000000000000000000000008b798b4f7458d1863cc67d4c6a06e828e5216f601b19db1af1b5d356d0f062137d866d11be4ba3f0151fdbbd4e97d62ecc645e143a60f1b1b71b5f7ec6edc76609073909826151e2b42bf0ed0c8cef3ba2a730a00c87c493db845b10e9468bda6f82881eb8c9cfa72b08eecc972a3fd2c46f3c1cde71a19d1a2982492aba0883783d2831210e00d2bfea3bf97ff8836d000000000000946bdb747e416b3064edb4f5aea06eba207ddab9f9baf98bc5192f23d95d33357fc55f92e5937e10995059f3348f69667b9260d504ba96446e1437af6fa875d9d32fdaaae01e6c74f192a23572ef582b7dd867c163c8cedaa2a2c5baceb37d4a40244c9bdca541cc7e65e20f5b5b735e2f33df9bd0614431d7dc5e47bb31c5b827d51733b64ddad4de1cdadce076d19d62e821b435619fb89fc07f81938200b4ebce83db57a6f5e9b1c2cf4b6ee90772d4865bf448d200e5c4e1e044d3587498128273b65670c02ff5c3c3ca633c41324fdc09e0b2621087db26bb0553612f2be27579ede2344a809e6b27d0044f2337895323357caddb54642dac82ae25deb08e111e0b9fa133c9da85dc50c3454ee0ff915331bd7f32f96fb55c7990334b1a1bc4d5d817b82f9fc278cc4858fbfa4d0f32a863c1ce050caddc5ca3b10c3e63daebba039e9f80fdef113a145ace522e8379474aa8849dcc2501df3ffcb02d29d55a1a2cbe00e836db0e6b0a7ffd680dbcf7b982a956998df3dce0e9091a4d736db69038061e"], &(0x7f0000000340)='syzkaller\x00', 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000100), 0x10}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000800)={0xe, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x40f00, 0x16, '\x00', 0x0, @fallback=0x22, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000007c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r10, 0x1f00, 0x18, 0x19, &(0x7f00000007c0)="9f44948721919580684010a40566", 0x0, 0x7ff, 0x0, 0xb1, 0x0, &(0x7f0000000700)="389ceff69d08b0af1cc71b6262d50660bbaf31a7f8cd6a6f911beb65d5fe6b54bf21a66489121f24fefd198059288c9b735e1898e77a7469489a249292c02a72bc193a3008ebdbf4e9dd4ee8fcceef55402c913c8dd0ebece1330aaa93ece835c5044a246a5967e3acd7c950b3b19f351830e545eb9bc3a9c6dd22ce97f1f857cfe8b68a2370b69ea336006b589368f92deb68f3dfc6f2bfee09f8342da437fce5dcdf658e453e3132bb42067575318c39", &(0x7f0000000380)="8c5911c525f5cf4c4ecf207ad2ec", 0x0, 0x0, 0xffffffff}, 0x23) socket$alg(0x26, 0x5, 0x0) 8.286792844s ago: executing program 0 (id=3412): socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$inet(r0, &(0x7f0000001540)=[{{0x0, 0xfffffffffffffda1, 0x0}}], 0x40001b6, 0x0) r2 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r2, 0x10e, 0xc, &(0x7f0000000180)={0x1, 0x1ff, 0x0, 0x8009}, 0x10) r3 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r3, &(0x7f0000000200)=@nameseq={0x1e, 0x1, 0x0, {0x42}}, 0x10) setsockopt$TIPC_GROUP_JOIN(r3, 0x10f, 0x87, &(0x7f0000000000)={0x42, 0x1}, 0x10) r4 = socket$tipc(0x1e, 0x2, 0x0) bind$tipc(r4, &(0x7f0000000180)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x1, 0x5}}, 0x10) setsockopt$TIPC_GROUP_JOIN(r4, 0x10f, 0x87, &(0x7f0000000240)={0x42, 0x1}, 0x10) bind$tipc(r3, 0x0, 0x0) sendmsg$tipc(r4, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4010}, 0x8820) close(r3) write(r2, &(0x7f0000000000)="240000001a005f0214f9f407000904001f00000000020000000200000800040001000000", 0x24) bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="0600000004000000fd0f000002"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x18, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r5 = socket$unix(0x1, 0x1, 0x0) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000a00), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_COALESCE(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000b00)={&(0x7f0000000680)=ANY=[@ANYBLOB="ea0ce90c770a778157a3011805b75ee718cc0e982e8159c39d8efa3a86c37e6c81e48972d494d35cf54867e09009299ab99a859f59f377e07fbbe8efcbea8c4e29cf55c942c52f39f0ff809ddc0c9246b633f81d1a948d88739df2288a6cde7198ca092f59ea18f3eb9440432cc88209f73fb055eacc9f59092fd9d4022043ba387ae0c0480f31bad96c2773cbc1f20636be3405ac8842e306e6fc6280e92efd1e8dcf6d8df0aa1276f5465447b9b2c194b024a040", @ANYRES16=r6, @ANYBLOB="010000000000fdffffff0200000008000300", @ANYRES32=0x0, @ANYBLOB="0c00990004000000450000000800020000000000"], 0x30}}, 0x20008050) r7 = socket$unix(0x1, 0x1, 0x0) bind$unix(r7, &(0x7f00000001c0)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x56) listen(r7, 0x0) connect$unix(r5, &(0x7f0000000140)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) r8 = socket$unix(0x1, 0x1, 0x0) connect$unix(r8, &(0x7f0000000000)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) bind$bt_sco(r2, &(0x7f0000000380)={0x1f, @none}, 0x8) close(r7) recvmmsg(r1, &(0x7f0000002980)=[{{0x0, 0x0, &(0x7f0000000840)=[{&(0x7f00000004c0)=""/5, 0x5}], 0x1}}], 0x1, 0x12102, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x50) 7.573295337s ago: executing program 2 (id=3417): bpf$PROG_LOAD(0x5, &(0x7f0000001700)={0x6, 0xb, &(0x7f00000002c0)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020782500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000005000000b7030000fcffffff850000007300000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x47, '\x00', 0x0, @fallback=0x21, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000200)='ns/pid_for_children\x00') unshare(0x6a040000) r0 = socket$inet6_sctp(0xa, 0x5, 0x84) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x40001}, 0x4000000) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) unshare(0x6a040000) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, 0x0}, 0x0) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001f40)=ANY=[@ANYRES32=0x0, @ANYRES16=r2, @ANYBLOB="000000000000000000000000000000000000000000000000000000004f689912cf579b55590b65b786dec00085c427ed7898b0e73b302c0397e77365fe3f3b60cda8c5d03bdf06b0b67abad06878db74695442a0f6646ffdf0078f8cc7cd16efe0905278716ec28bce77d355fc18930080ffffc296a9455edc81efca1cbfa1333d"], 0x50) bpf$PROG_LOAD(0x5, 0x0, 0x0) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f0000000140)={0x0, @in={{0x2, 0x0, @empty}}, 0x0, 0x0, 0x3f8, 0x0, 0x32}, 0x9c) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000580)={{}, &(0x7f00000003c0), &(0x7f0000000440)='%pI4 \x00'}, 0xffffffffffffff30) bind$inet6(r3, &(0x7f00004b8fe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendto$inet6(r3, &(0x7f0000847fff)='X', 0xfee4, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendmmsg$inet6(r3, &(0x7f0000004900)=[{{0x0, 0x0, &(0x7f0000000100)}}], 0x1, 0x4048894) setsockopt$SO_VM_SOCKETS_BUFFER_MIN_SIZE(0xffffffffffffffff, 0x28, 0x1, 0x0, 0x0) close(0x3) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000004c0)={0x18, 0x5, &(0x7f0000000100)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x7}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000180)='sched_switch\x00', r4, 0x0, 0xff}, 0x18) bpf$MAP_CREATE(0x600000000000000, &(0x7f0000000000)=ANY=[@ANYBLOB="0f00000004000000040000000200020000000000", @ANYRES32=0x1, @ANYBLOB="fdffffff00000000000000000000000000020000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000040000000000000000000000000000000000000000000000a126efaffad949c7e5da06c89b0d33075df053a7d6118f07b673ce0dbec19804c6dbb705ceb4"], 0x48) socket$nl_generic(0x10, 0x3, 0x10) r5 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), r5) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000380)={'wlan0\x00'}) sendmsg$NL80211_CMD_GET_WIPHY(r5, 0x0, 0x400c4) 7.46243668s ago: executing program 1 (id=3418): r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_STAT_SET(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x20, 0x1410, 0x4, 0x70bd2d, 0x25dfdbfb, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}, @RDMA_NLDEV_ATTR_RES_LQPN={0x8}]}, 0x20}, 0x1, 0x0, 0x0, 0x1}, 0x20000001) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000140), r0) sendmsg$BATADV_CMD_SET_HARDIF(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x34, r1, 0x300, 0x70bd2d, 0x25dfdbfe, {}, [@BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5, 0x37, 0x1}, @BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0x6}, @BATADV_ATTR_GW_MODE={0x5}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5, 0x2f, 0x1}]}, 0x34}, 0x1, 0x0, 0x0, 0x40}, 0x20000010) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000000280)=@raw={'raw\x00', 0x9, 0x3, 0x318, 0x120, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x248, 0xffffffff, 0xffffffff, 0x248, 0xffffffff, 0x3, &(0x7f0000000240), {[{{@ipv6={@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @empty, [0xffffff00, 0xff000000, 0x0, 0xffffffff], [0xffffffff, 0x0, 0x0, 0xff], 'vlan1\x00', 'macsec0\x00', {0xff}, {0xff}, 0x29, 0x4a, 0x5, 0x40}, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}, {0x2}}, @inet=@rpfilter={{0x28}, {0x2}}]}, @common=@inet=@SET1={0x28, 'SET\x00', 0x1, {{0xffffffffffffffff, 0x3, 0x4}, {0x3, 0x0, 0x7}}}}, {{@uncond, 0x0, 0x100, 0x128, 0x0, {}, [@common=@frag={{0x30}, {[0x0, 0x24000], 0x9, 0x3e, 0x3}}, @inet=@rpfilter={{0x28}, {0xb}}]}, @common=@unspec=@MARK={0x28, 'MARK\x00', 0x2, {0x2000000, 0x40}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x378) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000640), 0xffffffffffffffff) sendmsg$NL80211_CMD_DEL_MPATH(r2, &(0x7f0000000700)={&(0x7f0000000600)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f00000006c0)={&(0x7f0000000680)={0x2c, r3, 0x121, 0x70bd2c, 0x25dfdbff, {{}, {@void, @void}}, [@NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @device_b}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4040001}, 0x20004000) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000740)={'vxcan0\x00', 0x0}) bind$can_j1939(0xffffffffffffffff, &(0x7f0000000780)={0x1d, r4, 0x0, {0x2, 0xf}, 0x2}, 0x18) r5 = syz_genetlink_get_family_id$devlink(&(0x7f0000000800), r2) sendmsg$DEVLINK_CMD_TRAP_GROUP_SET(r2, &(0x7f0000000a80)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000a40)={&(0x7f0000000840)={0x1c4, r5, 0x800, 0x70bd25, 0x25dfdbfc, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0xd}, {0x5}}, {@pci={{0x8}, {0x11}}, {0xd}, {0x5}}, {@pci={{0x8}, {0x11}}, {0xd}, {0x5}}, {@pci={{0x8}, {0x11}}, {0xd}, {0x5}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0xd}, {0x5, 0x83, 0x1}}, {@pci={{0x8}, {0x11}}, {0xd}, {0x5, 0x83, 0x4}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0xd}, {0x5, 0x83, 0x1}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0xd}, {0x5}}]}, 0x1c4}, 0x1, 0x0, 0x0, 0x10000080}, 0x0) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000b40)={0xffffffffffffffff, 0x58, &(0x7f0000000ac0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0}}, 0x10) r7 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_RENAME(r8, &(0x7f0000000c40)={&(0x7f0000000b80)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000c00)={&(0x7f0000000bc0)={0x20, 0x5, 0x6, 0x201, 0x0, 0x0, {0x3, 0x0, 0xa}, [@IPSET_ATTR_SETNAME2={0x9, 0x3, 'syz1\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x50}, 0x8014) r9 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_TRIGGER_SCAN(r9, &(0x7f0000002180)={&(0x7f0000000c80)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000002140)={&(0x7f0000000cc0)={0x1474, r3, 0x308, 0x70bd28, 0x25dfdbff, {{}, {@void, @val={0xc, 0x99, {0x7, 0x6b}}}}, [@NL80211_ATTR_SCHED_SCAN_DELAY={0x8, 0xdc, 0x5}, @NL80211_ATTR_SCAN_SUPP_RATES={0x144c, 0x7d, 0x0, 0x1, [@NL80211_BAND_60GHZ={0x52, 0x2, "e1e98ce1280545c111e45a62d788b397ab77bf0795aefbe361511b4fd2f5bf4a3b2ba9237bd477d104df25469fd797e0a7ef3f102cb1fdbc5c868fd7850a968a628be696fed089865a5b557b360b"}, @NL80211_BAND_2GHZ={0xad, 0x0, "41aa5dccb7f90f61dcde60990b981f48d296801f298ae1f47b8d62b3378406ab97ca0411c4a7502b7cd4da43bf31345ee42ec2cf8f67bde3817c4f20768f47109483f670936b8c96593d003cebe19f6d32fb747c6c9410ddafbf734a14cbdf62ee736d47bd562c03bffdff9385cb92c921a1bb31496d2df0d838ef964d2d35f251cbd111e4bec1ec0019368b134a45552b25506ffe7b5161ea612ba27d0632f164e4d24ffd1dc766f2"}, @NL80211_BAND_2GHZ={0xaf, 0x0, "ad3de866a6b8d2c7b7aca4c937b0b71260047621b6f2ca47833c396ab9517c50ddd6e69354e9ef663d01009196f98ac47ae1b72308aa1bcb380e56611f65a9efdbe945a6a803f085d63fda764e90edc4b7ae946908301c813f1214c1be10384b2d8cd3381e69e2b1db6f06da31f0d87928bc4a5722c2ea6eae144ad302eb6ff27f6fcf265e53b0032f23d187ab14a771b60cc61f75922ab223c96553002bfa51493d52a4134fc74e74bf25"}, @NL80211_BAND_5GHZ={0xad, 0x1, "8cdf54bbdbd1826ca46dfc3d98e9b16967e13795f305e4d83ee90ff34acc8e6623f02e6f2fc58f7e9b659bb83e4baa9ddc9c54486f97944fae4d5a7d8625c23e0cc0220bbe5a63f6fe43a8d9a17424b0379ec49ffbc00d707352f31d7fc8e9957f52057186d4c22bd7083aea2bc529e6e95ca69b2150840f8bf69ef4b820e551ba3d6c63df30d3d1817d35523783276fb5aca571a232d615d174a9418380007b765dd0798021156cf5"}, @NL80211_BAND_2GHZ={0xd2, 0x0, "edbdf4557aed8a7e58c7c6ac6c36d040e0db87b79a6f843183d02e51165c9afbf5fd331c5c02e8310d86ac2b7af12a7f1e306d8b82e5e3888839b95ce936fb3e7087954c79d1e7a5e82fdcdb07d4e9a393f39b1f5c0c5f282b5220be497f9bddb8400dff7e45bcc6fefa062133c19f9549336bf2fc3c443161ad182ccf257f2a7395e5bfbdd6eda810faeb851248855b3e21d20de7b4fb2eed8cae8a455e2592f439813c8ea0cf3813b6718dbca580d71223a5e682f527c4cd6e72e678e812910a363b834fdfb3c59b64c79f8717"}, @NL80211_BAND_5GHZ={0x71, 0x1, "8b59e33d8529c181b23efd7611760bad6adf3192bd33ac1fb35969748b5387fba28e6999c982afaa76f52e2d3d64dd03894b48d9c210be07da0e4a7cd263dfab4845350ebb92327ffde987ae16c66fdca089d6c2338461c54aa02014ddad203bc777cd203f64e8cc9123e10668"}, @NL80211_BAND_6GHZ={0x6e, 0x3, "b9c763af08ecd6fbb2ed05f09e7c955227b8fcf09bec3f1f172f672cba883ebe3a98322d51af21f9c39903982fc268b36adb48cd080ca3b31e041859c946ac4073543334c441779735363ab55b51e7881171764decb10c9acf9991c5e65cae036fed13ca9505da45ce1f"}, @NL80211_BAND_6GHZ={0x27, 0x3, "3bdd80b2af26a656ea3ef45b3ada87da0003b67d6630457778b4fa65abb3146f326000"}, @NL80211_BAND_6GHZ={0x1004, 0x3, "94170503dc22ee32ebd2833f07d7013b83d198176bc542279101db86c1287d19ac291827f6629cda0c1c75cc2a3edec3ad90694e8a5d0e73b0cb4ba8339f3830662f0a7acc98ca4599b13026371ecfd8685432d2bbd15ca843b0bab4fccec790c9895291ddf94ee2f2b30e294f11235c7dc6344f96b088d6af978d074008a5e870e15a6b8c0714abee7ea85dd2bc8000f3b71ec62a0d6f410bc68443ad491deec0cc20f432aa99c1f0877347fa3722d24f72a4dcae2a35c9ad0e8f1efa3cb507bdcc862e2c398d71404e5255c19baf2dc235b021f3bbd72fc10dd11315a0b8fe0f2dd40c81d3262136e3a2e670c53b9f1ea9e757761eb83bad1ce24c8cb070eb0e9aba2282a0bd7f2d4c8612c8632e011f6724ecb8d850dcbf995cc99e2d6af575040e27b73afe55dd038e982b42ff903c51109a1c1e2769497f02eeb53cd0e9fae913b92e3e22aad7786ad3c09457b3e1219c95d4b0d54f6e5b33e2653594e04e73019db1ec631adbf0d06e0d654353e35185f42047931864a15e841e7d3f61c15ac9bd9bde8a4be76d9f67168a85784b4f8ca3b0c115cf3d20fda646596a96c66293be5000cfa3c66d8ccee4ce5efa9be008e76bffcbd826d853046bdb3e8b352589334f19e4fc2d5c167cf5f5efa20cad6a02c47f60466e30ea3e95e1b2df94efef395fb1f56f62ef5e81350f635201a75c9674353e016903ecae8924e440b878722e04b7920d6fe2e024c424e6a725c3f60c0a0bb22ef67b38381f6232c893e54e819bbc473eef8a2f62a4e3fc8aca03402588da76dbd690b2b53f822d3d84978bea21f71e2a1fc6e633342cb485e35f94c6ce9d7083abd7f848a68393eccbe72479b8c2e3c121f19b3bba677017b2e78a6d63f414f51bb77692968b7eef7dfb787b57bd22a034da6e88c3fd41ecf12aa8541aaa523b173316d2064ebaeba755ca593b7a06af816d4735c51632d3ebf9354e8fada912538021889dac5e2784ee72e6e1bae2bd8c3402a3168f38bb516a7520e4d8f09394ba6456849ade5f836718f60ad82a4fc4178ebcfb15e1a596b3b61946cff30136e6320cca53fd241f219b8f400df72f89dd4be6e6acf633b35c54215839813f1bfe00db60792ba373abf22345987cf27d48d0f9d3cf8ff5fd4407423c72eb094cc19d45035de10bb79e0fc2f9aefcacbf7876237b7a224be76cef0208da33cc46021373e3a417c31f9e8216678b1d9ecf32eac0abd584b353f0d4dd51099ea35b7ebb3968245ce61cc00f42a8624af2f8aa50a2d4961bbb418d96959a7e276b2036c923c494e63bd605e4d7923d552ab38106d6675e029c0d44eb9e0911c9740bb550ad6a5af68046ed97e63bf3c8840223ee2feee0ff417909e3932d74d2475eebb9212055f1f9151b2711ff6e24d70133227ae00a1329af100bc9b820a8676fc2bed51666aca8082971071a1572b96ec2b516da284d99052809078f0be61d07dde2b6c224382c593c8fa33a3c35ae9b317af6d1501b3851deaeb6a2a6deeb23678765da86ae24e4ec7d67f432e24df8ab42d25466afe3b3143484f837af66b0ab2700475fbbdac3599af3ba9ae7a2af2627d797c94b3c8615aa8d2119ba131a086a0922dd9d1799a2716f9999478e2d8ae05f1d64ae26e95ce6971d1f3e2182ab5f8f2501d3a053cd77b78cb9a84732066afd4f7919ca9a6bccb27403c00001abcaac5afa4ace8331bea361ecd3eb66a6f00a14db72a968d15bfbdb50e8e43b79b685ba6cd07c3df2853a5150140621cc747d1e6142e224be6f42bc51a93b0a170528c99af6bb7f79694644becf29d5b7f783eb483997a13d7801b5c328c63a904b52c23850d188780eeac271c873510a80f945fadf8996cf5c747c2ad0ca680087ff91afaf9fa069d5b88fccf5a303b124827abc2c45d79b06c336e83319332bb70d25528bcf054fa37491ef663944fb920eac3d936e37177bf22c3bda03a1b0028851c36cbee87938f0269e0c375cea023ed8b2d39a5ba0e5ade284a3944fcad0e4bcfe7065c4f91fdf4519ccfd9af9ceda0a474dba0c42cf8092c086ef4a46794da1673c38681d81343d91a19032ec6c7581deae9ebe570f0facff8f2e6a21e0592e71c18e697713035d2543e18e8b1c8a1bd528120ad3871fb978bb353deaf03911049d18e808950180117b5dbd11ee6d86cc3703ff6b1873580e33dbde256462dde2c980843924b4f47d472bea28bf3933c27acadb6b0b3b5e95b8275e0b2ca04f37f4f5a5bee15be2a002d1fd8a7a680aa4d95fb0ab338dd838346566c1863ae82664346f49a220d9a9a2a1dbe842913673ec90f70e57327f780c6e1627b25432e469ecaac7bbb52f62e975341ca6d3d86dfbbe9d9730db96058a2f9fe350ddc487d6b787d907d9e0c5d29c3f929d244a6ce2237af97d1717f5807ca9c1fa1539c5221014a635891b7a623516711e1117eda4c34e12aaa34df7a5bc999df58f531ef647402fc7a8a9f48dbdb94b80fdbedd98abeb4f0f31239c46c68ced1b418cee767bdf818b14d962bfed3ba7e83fb22ace3884b4bb090541117d0987be4868d19aba35bd0e79602bf99981cf2f793e4f8b3151e034ff04dd6183a4a0ae79a6043fb8bc60a55d8b739cdaf4d2884a02911a18b315019dac8cdb0de903b34403005f58d919f2774ca8610a1c5d45718221be0672e84a57e4016fdc32263b05ca8745740805f819a348eb5e799620f84f126e00bc073b37e0ff2c5275bc1b3782880d9c28724fbfa88ca88ee0c366cb99f1cdae528d9c3ec113de05c8f69fc377d63be8721d6d0f067e2ec4783cd0a653cd3359288f9962c4f57d03e518f96fd484ab8c3c8702d142592f02a69bdcce4126b952e826dda92d4d88dd87892f3dfc2e435da50a2f554aef99e1bf5ac82588daa983bdae011ed45f510a33b5f589a6ef63365505e8f99ba7d1446975fd3f27166f581244cdbb79f05a63bb61285eeaffdef5a965e3922548beef0fc02bc94fce16498b44805fd547a8d9c4e40b994fa0aa0221481781ae28e9981ed7703a103a035fc3f18d4b857f83402f81c023544ba1433f969c3ed42b2d5a05f15f6fc7455120df144157ae5c704a69a5376f2f430814be9d621ed8e3d02addf02425dc5be7bd485bff28f7dcf10e5067fd4ef1fd263cf7f5ae76e864b5b9ee0a88d637636632f6ca50ed8812ed44eb2a90038bbcbade20e445c8c5ae6ab11f8cebd1dcd04249236c6299d6cd89cee6f778a15618de402bf000be6fffe9c86f25ae7aa9de52bd562221474acb6c43a3b97001eaabeabe29f3381d983794687b52c60c764bb3b14900a936f141636be25f05505e1d5eb088d9ed77b007ad13ae3b5ee73b82abc944b897072e6c0e4add2a01b7b7c549f6cb175959c19535e481ac24bec41dd82eb7dc521cc2c0a6f320dc20d80baaf4391dd26bed777f19050f5ffafe73df7df3237396a11c36afd1fab36b067306fd0e818571cdcb4a36641cf2ef3a00495bbb29bf3a0faab4f0b92d903427263cb4c1d73bd34bd159e70e6c95d98070b0039824414c92785840e8e02a0f535d7cd86f38efe3f436737166db0b23df15f9bc76e55c1c26c8f200e06e3bc36e59e96c6abb732c0a257e5b6a914cc2129223c731cdc82ec1d24d05b2be0ee82550e5c7c5dbc43227c5798fe47f7360c3cf1e05134dc355fd12153b7a8074c19a9022d7ef384cd1ec9020430906be2e4677186f46d665831ac439e4359dde795b167edf50d3740ee2f6c74dcda5a5508a92614807a5cd352db8139f699a7736cbae27542d34a0d5eec3940410691d1c47ef7b02077deb8ee4ded2e3d46638bde5fe51d427590705bce9da26be92257cbad48a50895201e447147424fb48288c3edaab4b7d044041e938944d0f919ecb4561299c78b2648758cb549916902db92dcc11f3422fc18021bea5b246d94099d798af9db78379479250a6bdda0c127a52221e0e7b14487af409991cddd19261a0c941a7b5c5bb9c24e7178dabd18f9ab410b860be267b3e16268707f4bc47e52089b718bd8f2bb1ba3ab3be7a0f1076eb8089fc26f7938c1aab7dc75a066c469e6ad36bfb5c9be5a7ba19ef29017f60845f55589a36d624f319ae01535a4b58233a683c3573f4bb58ad630bf08715a73a367c1f72faddeacd654c7b1bbb6184ad1661d99d2eded6c62f26ffe76f6e6d7b654d2b8ae16b623feb8be59210c51ff967aa1a19dff00e3328f72503e994dd34801e811ba0ab5aa5dc4959a6a86de6505cb2da0359575d03a9de886decb177d7ef5663b94b1e52fed8e559a9768b2b2c0d4a0516b6c6629c576d77adfa44460dde96bd1e3df54712dd870adaccfc4c7b9c7eda373b4e5725a8fa524a6e06ba87dc7e027ef098066d7dce26fa41ab100a6413518400720db76f666fe81ecc9a429c612650ad731fe82dab19998633f08ce53dffe28213ba540cab5d3596cadba088d73d276e88a60b2615838175c392f2a7268626636598f6401e60bf624371a808012e17f9a51c81d23c478b63e8d976593b8f6d3650dbfce3a0c7fc907cfc15d0ee5012e900cb67e7733006a69eb5e593d49301f064852678d0c083708a20367847faee8eeed205fb76c5cba8391f6f96c92626e8d6d913b97cb2f31ede389478b1e00fa32f452198aeeff18a09f96652f25de0a5d90230d1bbb9c0e134712a7ee1715f1dbc824c777d2c09d377ff1b972e200f20213c5b8602825302593b2627e8fbde787c388fbaf509e4e93a4b1cb178f6b5e377f1d2c117e5b727fad8dc1c585680468094cc5c21ad4928b7a333f13a18aacaf405708eeb8625ab018513aaf4b8142afd08c3ed29892fc8f76aa5e12f8c02e20bac8e23b3c155101078a2ab07e5aca2a17cbe7d48121c074763fa5f21bfbe43ab5f573490b7579cdad459ff56618701c26b8679aafbcd69d61a67e83ce9adaecfa78580d69c31850622143aec6fcad814579fd579231bcfc8ad5a9fb47d6de249467f6807664de1507455ecb53c2004d2a33e6034976d54a28c4ef5524f0eed7af6754797955f5ff8845eb37d7d3e4c0718eebbb74dca86012dd8d499fb514f2cefab439d81169eb1ab803a1849c1bb7ac719a5dfa82ac1e9a997d801eb5536d680e16e4263f59660113b72143241d33576c9b71bc05c425327e527226e0d47a81dec39d3cfa78e6fc581caaf59559f1107e3f799c55321f87d2292842cf3638222b1bd4073f736827f4623e3ae7d9be9782a5d49ad0200211addb5fc8ce51fb058eb25ed3031e9a18a005b86726c3162948c034e293d8a8c66ba96ff38e49bbb177832d7df92974476a23e2563583654dace9a045712f518f8ca3bc012d22f700a98bd3539865e4071b65bcdcc7613ffcb18bcb092ca35bac6ce907c237371dfce86df273028ea50b75c3c4664380eb8e1dde8789d3bfd14dd1833477f6ea3d12e91be7c3abe54a737a620cf87893f2231eb2109682a4fbd21424a603f3297958e809658d3c609f97d2248b9108f847cf7188f5d33edfe8fc6642dd0f5d71bd566478571dca290b37da5c798818cc9c9f5956a66dda21e8e8b5cb0eabf7977dc6d8ee579edc8ac5c1fa40a8d63a4709b11dca7c7255c31819e30bf1a9891f58dbb3a414300d5fdd8fe36350c7dd266b37cb50dd23759e98dd57c3a74303c6137d222788974d53f10a011ae4f1363e1a37f05a1bb06a88901e957d2cb284563e2e2fd825b5968226ebaa4d2216db474ab2f88e1d05240cec23ad0d71b8b0f227256ffa873072fa40914c624f20424"}]}]}, 0x1474}, 0x1, 0x0, 0x0, 0x40}, 0x20000010) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000002200)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_GET_WIPHY(r2, &(0x7f00000022c0)={&(0x7f00000021c0)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000002280)={&(0x7f0000002240)={0x24, r3, 0x801, 0x70bd2b, 0x25dfdbff, {{}, {@val={0x8, 0x1, 0x3}, @val={0x8, 0x3, r10}, @void}}, ["", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x1}, 0x48800) r11 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r11, &(0x7f00000023c0)={&(0x7f0000002300)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000002380)={&(0x7f0000002340)=@newchain={0x2c, 0x64, 0x2, 0x70bd29, 0x25dfdbfc, {0x0, 0x0, 0x0, r4, {0xfff1, 0x4}, {0x3, 0x5}, {0xf, 0xe}}, [@TCA_RATE={0x6}]}, 0x2c}, 0x1, 0x0, 0x0, 0x20000000}, 0x8004) setsockopt$netlink_NETLINK_PKTINFO(r0, 0x10e, 0x3, &(0x7f0000002400)=0x10000, 0x4) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, &(0x7f0000002440)={r7}) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000002500)={0xffffffffffffffff, 0x58, &(0x7f0000002480)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0}}, 0x10) sendmsg$can_raw(r12, &(0x7f0000002600)={&(0x7f0000002540)={0x1d, r13}, 0x10, &(0x7f00000025c0)={&(0x7f0000002580)=@can={{0x3, 0x1, 0x0, 0x1}, 0x7, 0x1, 0x0, 0x0, "2f793db1b7856716"}, 0x10}, 0x1, 0x0, 0x0, 0x20000801}, 0x10080) getsockopt$TIPC_SRC_DROPPABLE(r12, 0x10f, 0x80, &(0x7f0000002640), &(0x7f0000002680)=0x4) sendmsg$NL80211_CMD_GET_SCAN(r9, &(0x7f0000002780)={&(0x7f00000026c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000002740)={&(0x7f0000002700)={0x20, r3, 0x300, 0x70bd2b, 0x25dfdbff, {{}, {@void, @val={0xc, 0x99, {0x2, 0x65}}}}, ["", "", "", "", ""]}, 0x20}, 0x1, 0x0, 0x0, 0x4048085}, 0x8040) sendmsg$NFQNL_MSG_CONFIG(r8, &(0x7f00000028c0)={&(0x7f00000027c0)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000002880)={&(0x7f0000002800)={0x44, 0x2, 0x3, 0x801, 0x0, 0x0, {0xb, 0x0, 0x4}, [@NFQA_CFG_PARAMS={0x9, 0x2, {0x8, 0x2}}, @NFQA_CFG_CMD={0x8, 0x1, {0x3, 0x0, 0x10}}, @NFQA_CFG_FLAGS={0x8, 0x5, 0x1, 0x0, 0x20}, @NFQA_CFG_PARAMS={0x9, 0x2, {0xd1}}, @NFQA_CFG_QUEUE_MAXLEN={0x8, 0x3, 0x1, 0x0, 0x7}]}, 0x44}, 0x1, 0x0, 0x0, 0x20040000}, 0x0) setsockopt$packet_add_memb(r12, 0x107, 0x1, &(0x7f0000002900)={r6, 0x1, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}, 0x10) 7.359194367s ago: executing program 0 (id=3420): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000840)=ANY=[@ANYBLOB="fc00000019000100000000000000000000000000000000000000000000000000fe8000000000000000000000000000bb00000000000000000200000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000000000000007000000000000000000000000000000000000000000000000000000000000000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000001000000000000004400050020010000000000000000000000000000000000022b00"], 0xfc}, 0x1, 0x0, 0x0, 0x20008000}, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r1, &(0x7f0000000100)={0x2, 0x0, @local}, 0x10) connect$inet(r1, &(0x7f0000000280)={0x2, 0x0, @broadcast}, 0x10) unshare(0x6a040000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0xf2e8a000) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) r2 = socket(0x2b, 0x80801, 0x1) setsockopt$sock_int(r2, 0x1, 0x21, &(0x7f0000000100)=0xffff8000, 0x4) connect$inet6(r2, &(0x7f00000001c0)={0xa, 0x4e23, 0x3ff, @empty, 0xfffffffe}, 0x1c) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=ANY=[@ANYBLOB="240000002000010327bd7000ffdbdf2e02"], 0x24}, 0x1, 0x0, 0x0, 0x240480d4}, 0x0) sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000200)=ANY=[@ANYBLOB="2800000021000100"], 0x28}}, 0x0) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, &(0x7f0000003900)=ANY=[@ANYBLOB="620af8ff0c200021bfa100000000000007010000f8ffffffb702000003000000bd120000000000008500000006000000b70000000000000095000000000000003faf4f1e7f2aa3d9b18ed81c0c869b51ec6c0af4e0e4a9446c7670568982b4e020f698393aa0f3881f9c24aa56f15199fad0093c59d66b5ece9f36c70d0f13905ea23c22624c9f87f9793f50bb546040677b0c5077da80fb982c1e9400e693146cea484a415b76966118b64f751a0f241b07080008002d75593a286cecc93e64c227c95aa0b784625704f07a72c234664c0af9360a1f7a5e6b607130c89f18c0c1089d8b853289e01aa27ae8b09e00e79ab20b0b8e1148f49faf2ad0000000000000006fa03c6468972089b302d7bf6023cdcedb5e0125ebbc08dee510cb2364149215108333719acd97cfa107d40224edc5465a932b77e74e802a0d42bc6099ad2300000080006ef6c1ff0900000000000010c63a949e8b7955394ffa82b8e942c89112f4ab87b1bfeda7be586602d985430cea0162ab3fcf4591c926abfb0767192302000000b0eea24492a660583eecb42cbcd3de3a83209da17a0faf60fd6ad9b97aa5fa68480366c9c6fd6fa5043aa3926b81e3b59c95c25a573dc2edcaea2b1a52496dfcaf99431412fd134a996382a1a04d5bb924cfe5f3185418d605ffff9c4d2ec7c32f2095e63c80aff9fa740b5b7632f32030916f89c6dad7603f2ba2a790d62d6faec2fed44da4928b30142ba11de6c5d50b83bae613402216b5054d1e7c13b1355d6f4a8245ffa4997da9c77af4c0eb97fca585ec6bf5af51d564beb6d952aab9c70764b0a8a7583c90b3433b809bdb9fbd48bc873495cbff8a326eea31ae4e0f7505ebf6c9d13330ca005ace1a84521f14518c9b476fccbd6c712016219848624b87cec2dbe98223a0eb4fa39f6b5c02e6d6d90756ff57902a8f57000000009700cf0b4b8bc2294133000000000000000000030000000000000000000000000010008bc0d9559711e6e8861c46495ba585a4b2d02edc3e28dd271c896249ed85b980680b00002b435ac15fc0288d9b2a169cdcacc413038dafb7a2c8cb482bac0ac502d9ba96ffffff7f0000100000000000007d5ad897ef3b7cda42013d53046da21b40216e14ba2d6ad5656bfff17addaedab25b30002abbba7fa725f38400be7c1f001b2cd317902f19e385be9e48dccff729433282830689da6b53b263339863297771429d120000003341bf4abacac95900fca0493cf29b33dcc9ffffffffffffffd39fec2271ff01589646efd1cf870cd7bb2366fde41f94290c2a5ff870ce41fd3467decb05cfd9fcb32c8ed1dbd9d10a64c1083d5e71b5565b1768ee58969c41595229df17bcad70fb4021428ce970275d13b78100788f11f76161d46ea3abe0fa4d30dc94ef241875f3b4ce0232fcea69c271d7fa29822aea68a660e717a04becff0f719197724f4fce1093b62d7e8c7123d8ec571be54c72d978cf906df0042e36acd37d7f9e119f2c06f815312e0cfe222a06f56dd022c074eb8a322fb0bf47c0a8d154b405c37feaf3dd95f6ef2ae582786105c7df8be5877050c91301bb997316dbf17866fb84d4173731efe895ff2e1c5560926e90109b598502d3e959efc71f665c4d75cf2458e3546c1c776da64fb5abee0acfd235f2f4632c9062ece84c99a061887a20639b41c8c12ee86c50804042b3fb5aac518a75f9e7d7101d5e186c489b3a06fb99e0aa7f23a054de2f4d92d6bd72ee2c9fdc75aaaf1e3e483b4ad05573af40326993947d9a631bcbf3583784acbda216550d7aec6b79e30cbd128f54c2d3335457acf37331766e472391e358c3b377327ac9ecc34f24c9ae153ec60ac0694dc55bff9f5f45f90400000000000000d6b2c5ea1393fdf24285bf16b99c9cc0ad1857216f1a985f369191ae954febb3df464bfe0f7f3ee9afe7befb89d2777399f5874c553aeb3729cffe86e66964ae09bb6d163118e4cbe024fd4500f8ff0700000000cc9d8046c216c1f895778cb25122a2a9f9b444aeadea2a40da8daccf080842a486721737390cbf3a74cb2003016f1514216bdf57d2a40d40b51ab63e96ec8485b3b8a8c9ae3d14f93100c2e0893862eef552fcde2981f48c482bde8a168c3f5db2fea6f26e4a4304e50c349f4f9ecee27defc93871c5f99b355b72d538ba4958ea8e4aa37094191e10096e7e60fc3541a2c905a1a95e9571bf38ae1981c4238ecaee6f75cd0a6881bd1517a8250ddc8674152f94e3a409e2a3bce109b60000000000000000d6d5210d7503000000a87a27602b81f76386f1535bef1497f92186086e29c6bc5a1fad6ec9a31137abf9a404abde7750898b1bd627e873f8703be8672d70d1ab57075228a9f46ed9bd1f08fb8191bbab2dc51de3a61f0868afc4294859323e6c257a45319f18101288d139bd3da20fed05a8fe64680b0a3fc22dd70400000000946912d6c98cd1a9fbe1e7d58c08acaf30235b918a31d2eca55f74a23641f61f2d5b308cf0d031b0c7f0ced69993e9960ff5f76015e6009556237badf4e7965bbe2777e808fcba821aa8e8c5c39609ff854352cb4900000000000000000000000000c1fee30a3f7a85d1b29e58c77685efc0ceb1c8e5729c66418d169fc03aa188546b3ad2a182068e1e3a0e2505bc7f41019645466a53f1c96e0d4b3bc19faa5449209b083dbd334b47f067bbab40743b2a42010082008df75cf43f8ecc8d3726602111b40e761fd21081920382f14d12ca3c3431ee97471c7868dcda7eaa69eb7f7f80572fdd11bb1d0d1280fbc22bf73468788df51710d7d31c632fc5ed1762eb0b428ee751c47d8e894f745a868404a0bf35f0121008b722b1eaa6aedfa1bf2e7ccb2d61d5d76331945ecefa26b8471d42645288d7226bbd9ccd628ab84875f2c50ba891cea592b0430a537a395dc73bda367bf12cb7d81691a5fe8c47be395656a297e9df0e71f96756ea5cce7daac4be290159f6bcd75f0dda9de5532e71ae9e48b0ed0254a83100000000f6fbb869604d51a36a54c832e45b2569dc0d90b075225fde44c4e0973171ad47d6b0fdf9743af932cd6db49a47613808bad959710300000000000000832d0a45fa4242e24c7e800003c9e8095e02985f28e678f66422436f949e2ab8f162d7e3f855e378f4a1f40b0c6fb2d4b205a800b6d713acebc5b014e61a543a5a194f9ac18d76b5440e3b1a569e7397f6cafa86966d7ba19e720413267a6ccea9c439671d2c680f2753ca184eeeb843450368acb4383a01d25eb3d1e23e0f2645d1cdfa9fa410632f95a5f622f851c66ee7e30393cd7a4d67ff2a49c4f93c0984b5c2d4523497e4d64f95f08493564a1df87111c9bf3194fef97dcecc467ace45feeb685c5870d05f88a0f463db88d377442e1349acaf766218b54a9d624778e1c4e064c98e494198276eb2df7766411bef0ebb5000000000006065d635b0b7a00ee767221d8af9753387e0cd8d718f54a29df6eba3bd4c440e6e2172e3fcc01b8babb757b5c59217b80d0db3ba582814a604e4ef7a803e9ca7c85b35c9b93a9e0885e238b44ae1c2e64cce3b27083b8246829e64056000302bffff15405bd5f2eba20000000000000000000000000000000000009a9823fd8fbc5aa16509945ed032b48ea12d8e0588dc52702e4084913a06d468d0928bad76d697e1f85ab030e788d38788ee5b5428d4a971cc97db9fd231088e570735ce129e7e77fc2777692664a1488fd8d6dff4dad618fd54f529d4555c6507009ee69dd1bc55258789b24052137e9637f3efbab71720f88c3c44b3b7486f979e8a3174b531f573fe0e5239c000be2733c49546f6e8a9175ec6f14dbf72cac91643b2fd99c29eca28a3c2e60d5e5b8795fae16a7c3ea57e728eca35eaf0155a39f97580e079175426c088a0208040982a0000000000000000000000000051ceaaf0159fe61f2eade7603d0a7a56fb09cd119ac06adb6597155ae47846892bb423c024d8cbe9240b71ec6dc2124d3a19e2d714b273d95d1d3aa737cb04a33615ff2a730e51067d5d675d7122361c37c61a43b5afd865b60d4cae891b73220f17d25985a7f76834995e53a93a1c7b9eef267df691ca983a0b15bda7f6c5c1ca7aa50261a3089a1ebf0734c9b07e8951ff023263ad5aed8cfb49b49e128c697724c057d22c5df5aef27ce3db11d5ad5527d149d076e1a87e2df27c0cb8a67ad026bf953e88f10447e125c2c0f1aebee1f3390a9e3ddad4e2a6e0f6e4569fdefa19e870e04acf9493b963f98e23cfc665e4f465fa3f801e1957c399e45f61d3459b1c606204368bb931345af2823c487d2fd99db6ea6e008e7ffa06ca861551189d155bd077a79fe2c7e961352e56824f727d21d41eae78bfec4a2d7a7edbc8ef958c5ea599f7c25bf71c2340558aa12fdd24a88aaad5921aee7dae6a2f3009d9cb43ab4898d0f0aa565431b6abe585d75db04d1c9ba0b9de4ae8b0d3132bc6810cc9a693979f55174a72e1df9fdef35bc470f9e6e591982757f45c52c645d891bf63bb21fb66926ebe1a8525611fc3e8bb8795c36dc2a86b5ab46ff33cc74f61751b2dae92676db85c8d0c721b7ea4544bf51c95c86fcac1f434d09d1ee4928aafe23de66fed972e0dddfb33f64e48701b049239e7f552d816441d11c4c2647c014462344359198d97c4b6e9ed31ca18987b64de079b2bed641e8a92f13ca70844c65cb423d01950b0ebf44bd28e09c05d9ae5dd689fb880fb18d042219f5ac60c3a03b085abf3e8e3efc842a8d328733461f04c99607061c65ed14c61322a5ac2d371a95b8ad867ec92d13a4fa4ae033a09673866cd77f4bcdaaa05207166b19a8758d8855400d8c6a7242dc207251e8797eca24ea4f487663e60f2f5e1f1424958fd148f846830e88a42d93e1fe9c0b4a4a268921738938aa9f3cb3811ac87c54c8ebc8bcfb4613cc3a997ff1579edbd4ade8020e3ad001b072b1a751b588ac4639f35a58e00a50c0270608c7a7f10132b1c25b9ea81232fbef665f6212f875b2a0000000000000000000000000000cf7b6c4ba9bec153d6834bfef080df374703a8ff56a63ec1fe5f2e05a79e3cace7283dd68d41e94420c325fe4dae144fde5ec25a87d625cab20753a77b323fa3783c8b675859b9012647885a242adfee2fe812ecbe5191e0a15142f7349e7627cc39d724e2e34e7a24154f26ae3125b36d0504965295d0453902ac7079b11a3a1e655e482331e3dc35b2e7e4e3ea99064fe5b9c8ae0ca3e5fd653f3286a99d81ce4eba765c38d097391ad4babac38ce5b4344e24a361cd54e5"], &(0x7f0000000380)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x2e) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000540)='rcu_utilization\x00', r4}, 0x10) r5 = socket$tipc(0x1e, 0x4, 0x0) bind$tipc(r5, &(0x7f0000000000)=@nameseq={0x1e, 0x1, 0x0, {0x41}}, 0x10) r6 = socket$tipc(0x1e, 0x5, 0x0) sendmsg$tipc(r6, &(0x7f0000000240)={&(0x7f00000001c0)=@name={0x1e, 0x2, 0x0, {{0x41}}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x1000a8d0}, 0x0) close(0x4) socket$nl_route(0x10, 0x3, 0x0) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(r7, 0x29, 0x33, &(0x7f0000000000)=0x7, 0x4) setsockopt$inet6_int(r7, 0x29, 0x31, &(0x7f0000000240)=0xf2b, 0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f05ebbee1, 0x8031, 0xffffffffffffffff, 0x0) getsockopt$inet6_buf(r7, 0x29, 0x6, &(0x7f0000000140)=""/41, &(0x7f0000000080)=0x29) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r8, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r8, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)={{0x14}, [@NFT_MSG_NEWRULE={0x58, 0x6, 0xa, 0x409, 0x0, 0x0, {0x2}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_RULE_EXPRESSIONS={0x2c, 0x4, 0x0, 0x1, [{0x28, 0x1, 0x0, 0x1, @dynset={{0xb}, @val={0x18, 0x2, 0x0, 0x1, [@NFTA_DYNSET_SET_NAME={0x9, 0x1, 'syz2\x00'}, @NFTA_DYNSET_OP={0x8}]}}}]}]}], {0x14}}, 0x80}}, 0x0) 7.211025718s ago: executing program 1 (id=3422): socket$inet6_sctp(0xa, 0x5, 0x84) (async) r0 = socket$inet6_sctp(0xa, 0x5, 0x84) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$batadv(&(0x7f0000000400), 0xffffffffffffffff) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000700)=[{&(0x7f0000000000)="2e00000010008188e6b62aa73772cc9f1ba1f848430000005e140602000000000e000a001400000002", 0x29}], 0x1}, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r1, 0x8933, &(0x7f0000000440)) (async) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r1, 0x8933, &(0x7f0000000440)={'batadv0\x00', 0x0}) sendmsg$BATADV_CMD_SET_MESH(r1, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000000)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010028bd7000010000000f000000080034000400164b08000300", @ANYRES32=r3, @ANYBLOB="050033"], 0x2c}}, 0x80) syz_genetlink_get_family_id$ipvs(&(0x7f00000001c0), r1) (async) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f00000001c0), r1) sendmsg$IPVS_CMD_SET_SERVICE(r1, &(0x7f0000000280)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000240)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c9f1a000200", @ANYRES16=r4, @ANYBLOB="000428bd7000fbdbdf25020000000800050007000000"], 0x1c}, 0x1, 0x0, 0x0, 0x8000}, 0x4c084) sendmmsg(r0, &(0x7f0000000140)=[{{&(0x7f00000000c0)=@l2tp6={0xa, 0x0, 0x8, @local, 0x8, 0x4}, 0x80, &(0x7f0000000080)=[{&(0x7f00000005c0)='l', 0x1}], 0x1}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="07000000000000008440000001000000"], 0x10}}], 0x2, 0x40000050) 7.141805035s ago: executing program 3 (id=3423): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000004c0)={'pim6reg\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=@ipv4_newaddr={0x20, 0x14, 0x309, 0x70bd2a, 0x25dfdbfe, {0x2, 0x18, 0x8c, 0xfe, r1}, [@IFA_LOCAL={0x8, 0x2, @dev={0xac, 0x14, 0x14, 0x22}}]}, 0x20}, 0x1, 0x0, 0x0, 0x4000800}, 0x0) 7.109124113s ago: executing program 1 (id=3424): r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) getsockopt$X25_QBITINCL(0xffffffffffffffff, 0x106, 0x1, 0x0, 0x0) close(0x4) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000080)={0x0}, &(0x7f00000000c0)=0xc) syz_open_procfs$namespace(r2, &(0x7f0000000140)='ns/pid\x00') syz_open_procfs$namespace(0x0, &(0x7f0000000200)='ns/pid_for_children\x00') ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000180)={'wlan1\x00'}) syz_init_net_socket$ax25(0x3, 0x5, 0xca) socket$inet6_sctp(0xa, 0x1, 0x84) r3 = socket$inet6(0x10, 0x2, 0x4) r4 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) sendto$inet(r4, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r4, 0x6, 0xd, &(0x7f0000000000)='westwood', 0x8) sendto$inet6(r3, &(0x7f0000000080)="4c00000012001f15b9409b8400feffffffffffff000000000017030038c88cc055c5ac27a6c5b068d0bf46d323452536005ad94acc000000000000000000000051d1ec0cffc8792cd8000080", 0x4c, 0x0, 0x0, 0x0) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='blkio.bfq.sectors\x00', 0x26e1, 0x0) close(r5) socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$SIOCSIFHWADDR(r5, 0x8b26, &(0x7f0000000100)={'wlan1\x00', @random='\x00\x00\x00\v\x00'}) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffffff, 0x84, 0x6c, 0x0, &(0x7f0000000140)) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000300)=ANY=[@ANYBLOB="500000000206050000000000000000000000000005000400000000000900020073797a31000000000500010007000000050005000a00000015000300686173683a69702c706f72742c6e657400000000658cd8c1fa8d863bae20db169c17553861"], 0x50}}, 0x0) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r7, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000780)=ANY=[@ANYBLOB="74000000090601020000000000000000030000000900020073797a310000000005000100070000004c0007801800018014000240fe8000000000000000000000000000aa1800148014000240fc000000000000000000000000000000060004404e1f000005000700840000000600054005"], 0x74}, 0x1, 0x0, 0x0, 0x10040003}, 0x0) unshare(0x62040400) syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) socket$kcm(0x10, 0x400000007, 0x0) 6.769860512s ago: executing program 3 (id=3427): r0 = socket$nl_route(0x10, 0x3, 0x0) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000010073797a300000000468000000090a010400000000200000000100000008000a40000000000900020073797a32000000000900010073797a300000000008000540000000212c001180090001006d657461000000001c0002800800034000000016080002400000002208000140000000"], 0xb0}, 0x1, 0x0, 0x0, 0x44001}, 0x0) r2 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_PIM(r2, 0x0, 0xcf, 0x0, 0x0) r3 = socket(0x200000000000011, 0x2, 0x0) socket(0x1, 0x803, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000740)=ANY=[@ANYBLOB="7000000010000304000080000000000000007400", @ANYRES32, @ANYBLOB="0000000003120100500012800b000100627269646765000040000280080005000100000006002700000000000800010015000800050025000000000008000400000000000c002e"], 0x70}, 0x1, 0x0, 0x0, 0x800}, 0x40) 6.536330203s ago: executing program 3 (id=3429): unshare(0x20000400) r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TLS_TX(r1, 0x6, 0x1, &(0x7f00000000c0)=@gcm_256={{0x303}, "0000000000000208", "5171bb74cd3660dab9e2f76d240500d7a03b00", "d8a024e5", "20000926000200"}, 0x38) setsockopt$inet6_tcp_TCP_MD5SIG(r1, 0x6, 0xe, &(0x7f0000000200)={@in6={{0xa, 0x4e23, 0x0, @private2={0xfc, 0x2, '\x00', 0x1}, 0xb}}, 0x0, 0x0, 0x50, 0x0, "a27eeb1839106138172ad1ed7d1d9bfbaeed4520662584241c0e774a4cad546325b89dfb9d33f6fb7f45545dc77c8dcbab7120d7aa88e3f6d21c20b0f00807c80cb089d6c97b63f247377bbfad8c40a1"}, 0xd8) r2 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=ANY=[@ANYBLOB="380000001800dd8d00000000000000000200000000000006000000000600150004000000140016"], 0x38}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) sendmmsg(r2, &(0x7f0000000000), 0x4000000000001f2, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x2000000000000020, &(0x7f0000000040)=0xa, 0x1959cc36) setsockopt$inet6_tcp_TCP_MD5SIG(r1, 0x6, 0xe, &(0x7f0000000700)={@in={{0x2, 0x4e24, @empty}}, 0x0, 0x0, 0x35, 0x0, "f5fe9c103abe0b65544e0980519f38f54dd5f87ecc377210bd44fe7e1375550831c5f6dd769f5a1d175f47a8b941c8e568ca41e8da841f4f18f1ea6b206d495119ac37c29f4b384d0a9181566cfc4a1b"}, 0xd8) ioctl$TUNSETOFFLOAD(r0, 0x4004743d, 0x110e22fff6) 6.351197266s ago: executing program 4 (id=3430): unshare(0x20000400) mmap(&(0x7f0000000000/0x95c000)=nil, 0x95c000, 0x200000b, 0x8c4b815a5465c2b2, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'sha512\x00'}, 0x58) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f0000000640)=[{0x0, 0x0, &(0x7f0000000380)=[{&(0x7f0000000140)="b57523cb1a2c90d8acad2e2d98dfc9ea7a5843c3b63b683ced2b3266175599b779617e66e6b3e15c042be90635a2d36160bbf9a2edcacc0bbe015b84150a1928de94397894ff36aa430fc2a0814ba634308d6d0837250dfd1eca5383f9d151449743b1a0c4ffc51242a229c5d6d06f147a61d797ea7ffeda95b76f5623", 0x7d}, {&(0x7f00000001c0)="66f7", 0x3}, {&(0x7f0000000300)='l3', 0x7fffef80}], 0x3}], 0x1, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r3 = socket(0x400000000010, 0x3, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0xffffffff, {0x0, 0x0, 0x0, r5, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x1, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x28}}}]}, 0x38}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000b80)={0x6, 0x4, &(0x7f0000000100)=@framed={{0x18, 0x2, 0x0, 0x0, 0x800000e2, 0x0, 0x0, 0x0, 0x2000000}, [@call={0x85, 0x0, 0x0, 0xbc}]}, &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x5c298795369ca04f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r6, 0x6, 0x5, &(0x7f0000000600)=0x2f, 0x4) getsockopt$inet6_tcp_int(r6, 0x6, 0x5, 0x0, &(0x7f00000022c0)) sendmsg$nl_route_sched(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000480)=@newtfilter={0x50, 0x2c, 0xd27, 0x70bd25, 0x8000, {0x0, 0x0, 0x0, r5, {0x0, 0x7}, {}, {0xffff, 0x2}}, [@filter_kind_options=@f_flower={{0xb}, {0x20, 0x2, [@TCA_FLOWER_KEY_ETH_TYPE={0x6, 0x8, 0x806}, @TCA_FLOWER_KEY_IPV6_SRC={0x14, 0xe, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}]}}]}, 0x50}}, 0x800) 6.349812131s ago: executing program 3 (id=3431): r0 = socket$nl_route(0x10, 0x3, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000700)=ANY=[@ANYBLOB], 0x48) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000100)={0x1f, 0xd, &(0x7f0000000040)=ANY=[], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x11}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000500)={r1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000010c0)=ANY=[@ANYBLOB="5000000010000305ed6bace8ce6d1dcf0000000083151f9d00000000", @ANYRES32=0x0, @ANYBLOB="0100000000000000300012800e00010069703665727370616e0000001c000280050016000200000006000200300000000500170001000000"], 0x50}, 0x1, 0x0, 0x0, 0x4040080}, 0x0) r2 = socket$packet(0x11, 0x3, 0x300) bpf$MAP_CREATE(0x0, 0x0, 0x48) setsockopt$packet_int(r2, 0x107, 0x8, &(0x7f0000000100)=0x40049, 0x4) recvmmsg(r2, &(0x7f0000000480)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000001300)=""/17, 0x11}}], 0x1, 0x0, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001400)=@gettaction={0xa0, 0x32, 0x4, 0x70bd27, 0x25dfdbfd, {}, [@action_dump_flags=@TCA_ROOT_FLAGS={0xc}, @action_dump_flags=@TCA_ROOT_TIME_DELTA={0x8, 0x4, 0x200}, @action_gd=@TCA_ACT_TAB={0x3c, 0x1, [{0x14, 0x13, 0x0, 0x0, @TCA_ACT_KIND={0xd, 0x1, 'connmark\x00'}}, {0xc, 0xc, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0xb}}, {0xc, 0x7, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x5c02e01}}, {0xc, 0x16, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x7}}]}, @action_gd=@TCA_ACT_TAB={0x3c, 0x1, [{0xc, 0x1c, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x1}}, {0xc, 0x8, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x77a}}, {0xc, 0x6, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x8}}, {0x14, 0x5, 0x0, 0x0, @TCA_ACT_KIND={0xf, 0x1, 'tunnel_key\x00'}}]}]}, 0xa0}}, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x3, 0x20000000ec071, 0xffffffffffffffff, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r4, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x10) connect$inet(r4, &(0x7f0000000480)={0x2, 0x0, @multicast1}, 0x10) sendmmsg(r4, &(0x7f0000007fc0), 0x800001d, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) unshare(0x24020400) socket$phonet_pipe(0x23, 0x5, 0x2) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f00000000c0)={'wlan0\x00'}) getsockopt$bt_hci(0xffffffffffffffff, 0x84, 0x1b, &(0x7f0000000000)=""/4087, &(0x7f0000001080)=0xff7) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(0xffffffffffffffff, 0x6, 0x23, &(0x7f0000001000)={&(0x7f0000ecc000/0x2000)=nil, 0x2000, 0x0, 0x0, 0x0, &(0x7f0000001140)=""/196, 0xc4, 0x0, &(0x7f0000001240)=""/112, 0x70}, &(0x7f00000012c0)=0x40) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0xa, 0x3, &(0x7f0000000340)=ANY=[@ANYBLOB], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_ORIGINATORS(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000001340)={&(0x7f00000000c0)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="20002cbd70001edcdf250800000008003200000000000500370001000000"], 0x24}, 0x1, 0x0, 0x0, 0x4004015}, 0x4) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(&(0x7f0000001040), 0xffffffffffffffff) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(&(0x7f0000000280), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(r6, 0x8933, 0x0) 5.818851454s ago: executing program 4 (id=3432): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$packet(0x11, 0x2, 0x300) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'vcan0\x00'}) r2 = socket(0x1, 0x803, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)) r4 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000480)=ANY=[@ANYBLOB="500000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="7fff0000000000002800128009000100766c616e000000001800028006000100340200000c0002001f0000001e00000008000500", @ANYRES32=r3], 0x50}}, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket(0x1, 0x803, 0x0) getsockname$packet(r6, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) unshare(0x62040200) r8 = socket$nl_route(0x10, 0x3, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_route(r8, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000200)=ANY=[@ANYRES64], 0x1c}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000300)=ANY=[], 0x24}, 0x1, 0x0, 0x0, 0x24008000}, 0x4000) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=ANY=[@ANYBLOB], 0x24}, 0x1, 0x0, 0x0, 0x4a044}, 0x4010) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000640)=ANY=[@ANYBLOB="500000001000210400000000fedbdf2500000000", @ANYRES32=0x0, @ANYBLOB="adffa888e16000002800128009000100766c616e00000000180002800c0002000e0000000a000000060001000001000008000500", @ANYRES32=r7], 0x50}}, 0x2) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'veth1_to_hsr\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000004c00)=@newtfilter={0x24, 0x11, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x74, r9}}, 0x24}, 0x1, 0xf0ffffffffffff}, 0x0) 5.331394801s ago: executing program 3 (id=3433): openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x141241, 0x0) socket$netlink(0x10, 0x3, 0xf) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) unshare(0x62040400) unshare(0x4e040400) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r0) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x1000001}, 0x1c) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r3, &(0x7f00000002c0)=ANY=[], 0x32600) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r5, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$sock_inet_tcp_SIOCATMARK(r4, 0x8905, &(0x7f0000000380)) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x200000b, 0x10010, r3, 0x0) r6 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x161042, 0x0) read(r6, &(0x7f0000000000)=""/147, 0x93) connect$inet(r2, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="500000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="400d0000000000003000128008000100687372"], 0x50}, 0x1, 0x0, 0x0, 0x40000}, 0x8000) r7 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r7, &(0x7f00000002c0), 0x40000000000009f, 0x0) r8 = accept(r0, 0x0, 0x0) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r9, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="5400000002060568d76b815f82d1d848f3e983a6000000000000000000000e5f2b044f9ace4098af48bb8c2a3b0c000780d2be0000000000000500014c8500080006000000050005000200000005000400000000000900020073797a3100000000100003002861"], 0x54}}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r8, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000100)=ANY=[], 0xfffffdef}, 0x1, 0x0, 0x0, 0xc000}, 0x10) recvfrom(r2, &(0x7f0000000180)=""/60, 0xfffffffffffffecb, 0x4100, 0x0, 0x0) 1.140520678s ago: executing program 2 (id=3434): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x2, 0x13, &(0x7f0000000080)=ANY=[@ANYBLOB="18080000000400000000000000fd0020851000000600000018000000", @ANYRES32, @ANYBLOB="00000000000000016608fffffff3f800180000ffffffffffffff8000001000009500000000000000360a020000000000180100002020782500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b50a000000000000850000000600000095"], &(0x7f0000000000)='GPL\x00', 0x2, 0x5, &(0x7f0000000340)=""/222, 0x0, 0x1e}, 0x94) 1.02839376s ago: executing program 2 (id=3435): r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0) r1 = syz_init_net_socket$nfc_raw(0x27, 0x3, 0x0) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x41, &(0x7f0000000000)=0x189, 0x4) (async) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) (async) connect$inet6(r2, &(0x7f0000000100)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x1}, 0x1c) (async) setsockopt$inet6_tcp_TCP_ULP(r2, 0x6, 0x1f, &(0x7f00000002c0), 0x4) (async) setsockopt$inet6_tcp_TLS_TX(r2, 0x11a, 0x1, &(0x7f0000000080)=@ccm_128={{0x304}, "f64e40992f79ecf0", "53c272d8b763f690b35605dff8a4a8d2", "3da2d199", "72392a24199b5903"}, 0x28) (async) setsockopt$sock_int(r2, 0x1, 0x7, &(0x7f0000000100)=0x104c8e1a, 0x4) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000002c0)={'rose0\x00', 0x1}) 1.014587371s ago: executing program 0 (id=3436): r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) connect$inet6(r1, &(0x7f0000000100)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x1}, 0x1c) r2 = socket$rxrpc(0x21, 0x2, 0x2) connect$rxrpc(r2, &(0x7f0000000000)=@in4={0x21, 0x3, 0x2, 0x10, {0x2, 0x4e22, @loopback}}, 0x24) setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f00000002c0), 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000240)=0x2, 0x4) setsockopt$inet6_tcp_TLS_TX(r1, 0x11a, 0x2, &(0x7f0000000180)=@gcm_256={{0x304}, "32f058ec27d46898", "d40f86fd02541c95afec379bdb3cc0d5646e20975202603a18fe7474dc4c3d7b", '\"\vEX', "010000000100"}, 0x38) ioctl$int_in(r1, 0x5452, &(0x7f0000000080)=0x8) syz_genetlink_get_family_id$ethtool(&(0x7f0000000200), r1) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000180)={'sit0\x00', 0x0}) 886.926742ms ago: executing program 2 (id=3437): r0 = socket$nl_sock_diag(0x10, 0x3, 0x4) sendmsg$TCPDIAG_GETSOCK(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)={0x54, 0x12, 0x1, 0x0, 0x0, {0xa, 0x3, 0x0, 0x0, {0x0, 0x4e22, [0x10000, 0xffff], [], 0x0, [0x5, 0x3]}, 0x8}, [@INET_DIAG_REQ_BYTECODE={0x8, 0x3, "11000000"}]}, 0x54}}, 0x20004010) r1 = socket(0x1a, 0x1, 0xff) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000100), 0xffffffffffffffff) r3 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000020000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a6c000000060a090400000000000000000200000040000480100001800c0001006e6f747261636b002c0001800e000100696d6d656469617465000000180002800c00028005000100c402000008000140000000080900010073797a30000000000900020073797a320000000014000000110001"], 0x94}}, 0x0) close(r4) connect$netrom(r3, &(0x7f0000000380)={{0x6, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, 0xa}, [@rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @bcast, @null, @bcast, @null, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}]}, 0x48) sendmsg$TIPC_NL_MON_GET(r1, &(0x7f00000002c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000140)={&(0x7f00000001c0)={0xcc, r2, 0x10, 0x70bd29, 0x25dfdbfd, {}, [@TIPC_NLA_BEARER={0x64, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x4e24, @broadcast}}, {0x14, 0x2, @in={0x2, 0x4e23, @rand_addr=0x64010100}}}}, @TIPC_NLA_BEARER_NAME={0xf, 0x1, @l2={'eth', 0x3a, 'vxcan1\x00'}}, @TIPC_NLA_BEARER_PROP={0x24, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xd}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x5}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x5}]}]}, @TIPC_NLA_SOCK={0x48, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_REF={0x8, 0x2, 0xffffffff}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x1}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_CON={0x24, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_NODE={0x8, 0x2, 0x8000}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x9ed}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x9}, @TIPC_NLA_CON_NODE={0x8}]}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x1}]}, @TIPC_NLA_PUBL={0xc, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x2}]}]}, 0xcc}, 0x1, 0x0, 0x0, 0x20008840}, 0x40000) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'bridge0\x00', 0x0}) r8 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0x503, 0x0, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, 0x14615, 0xef}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @gtp={{0x8}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GTP_FD1={0x8}]}}}, @IFLA_MASTER={0x8, 0xa, r7}]}, 0x40}}, 0x0) r9 = socket$inet_tcp(0x2, 0x1, 0x0) socket$netlink(0x10, 0x3, 0x2) getsockopt$inet_int(r9, 0x0, 0x18, 0x0, &(0x7f0000000040)) sendmsg$nl_route(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=@newlink={0x40, 0x10, 0x401, 0x8010, 0x0, {0x0, 0x0, 0x0, 0x0, 0x3}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x10, 0x2, 0x0, 0x1, [@IFLA_BR_MCAST_QUERY_INTVL={0xc, 0x21, 0xb0}]}}}]}, 0x40}}, 0x0) ioctl$sock_netrom_SIOCDELRT(r3, 0x890c, &(0x7f0000000300)={0x1, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @rose={'rose', 0x0}, 0xba77, 'syz0\x00', @null, 0x2, 0x4, [@bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @null, @null, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}]}) 886.347891ms ago: executing program 0 (id=3438): sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)=ANY=[@ANYBLOB="400000001435010026bd0c333c84df250a4022fe", @ANYRES32, @ANYBLOB="140006000000000005"], 0x40}, 0x1, 0x0, 0x0, 0x811}, 0x0) r0 = socket$inet6(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000180)={'wlan0\x00', 0x0}) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFULNL_MSG_CONFIG(r5, &(0x7f0000000a80)={&(0x7f00000009c0)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000a40)={&(0x7f0000000a00)={0x34, 0x1, 0x4, 0x3, 0x0, 0x0, {0x1, 0x0, 0x2}, [@NFULA_CFG_QTHRESH={0x8, 0x5, 0x1, 0x0, 0x9}, @NFULA_CFG_QTHRESH={0x8}, @NFULA_CFG_NLBUFSIZ={0x8, 0x3, 0x1, 0x0, 0x1000}, @NFULA_CFG_FLAGS={0x6, 0x6, 0x1, 0x0, 0x1}]}, 0x34}, 0x1, 0x0, 0x0, 0x4008005}, 0x48080) sendmsg$NL80211_CMD_PROBE_MESH_LINK(0xffffffffffffffff, &(0x7f0000000980)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f00000001c0)={&(0x7f00000002c0)={0x6a8, r3, 0x2, 0x70bd2d, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r4}, @void}}, [@NL80211_ATTR_FRAME={0x4fc, 0x33, @data_frame={@msdu=@type10={{0x0, 0x2, 0x3, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1}, {0x80}, @random="a8818cdaf728", @device_a, @device_b, {0x9, 0x8}}, @a_msdu=[{@device_a, @broadcast, 0x53, "07a9f5f18df6c64a690fc87b4e0ebee09f90845299cd05b8c4dcdb0a4c18a78a0a335f4626b4eb2a968e1e6a34aa3a635cd78d02ee5b1e5acd22125eea48d73a43ab1d8a82e2fe6d4496a3d77090cad1007a8e"}, {@device_a, @device_a, 0xf1, "001c5c2ad975dcb15266475e69a9ec8aae429ffc15d8e56f7cd28d19b92c1d6e3ace3d6bced625634f6f1fe99f38b974408fbc8d4775e20cc6937e772eb34b0f510e36813ed5ddd37c8004b0a13f8f328d9f277dc11000669519cf79b312ee344f9a57f7e81c45998f88b54242267cfc712801767e193d246e735a708817f5418a40977fb98192ffdc9fb54a4152d1fbc82dc76dca27e7b72c14931bfbe8dfc0c51445808da103c8ff2e6721c3e5a3244915d1f8114fe40022d422302fa9fdea7c06b32643196468a66eab5533e368d88130a3d67ce42dda14914c2317f11a7e5827586392db65a684759b55a478439eb7"}, {@broadcast, @device_a, 0xf1, "de7128c1f4f5b492e476d8d1c7b01b11c0d7dd7af85564fbe41d978600829545b481d753d292793d91116cc15f12af8dbd45a629d21c1a9e3d91550cd7b55eab85d11bcce49729e9e694dffcdce9e2ed547ee511fea9bcda5c977adea0c9dac56161c143f7da60e35a7a59a74cb6441b8c34043069e2c80b24d9469cb5e7bf1ea21b5cc5a7c7e195d8ade0849799920f4580a454bb69e609942ec2af0b1ab27d6f3ce8fb31571516b9a7fa299f5557b6ffbe2e9438f4abce969fe41cf2551a8737e7f32599bbf53c3b4a2944a2043dfc4bc677548c9d8164547020528c3f4832eee72ae0a65f878708c845c6f08ca031ee"}, {@broadcast, @device_b, 0xf5, "a4a4cb11a70a046bce7c8ee3e80c78f996ea884372ce751d7411503179d2b6e682ab592edfe89a42ff2acfa1776dfe4bef31009ce173620aceadec3f8c0ab219b92d29bba7fbe0ca475ac820a17db6d50a76bc985f771e369fa782bf14c6e96e1a0be754d8769fb35972b8267f60a00d6a1dcb5db3d608793eb677b4c708a161844c6e08bcf8a4628f298a0806924a220fe57a5ea8830884bee482f18b7baf46ff9b09183d9c11df0e741b0c1423ccea1d3118e63df93049ef9050ecbcedacd296a448464722a66166581c94d8fe0eec079a03e6393b14da726020c770a968dbe17239ad722bba201e7a21ba39d1c415b576a5dfb0"}, {@broadcast, @device_b, 0xdb, "31ca86df2be7b25883d1f50c34bbb488e91b357c8c8ede83649026ec8a920cd2458d11502d3cdf390fd15944c7876c581273059c02e68f8096d535930edd5b6393750f22c3322e580a82cc854adeeefc8800d0d82dca0ad3ab81e2ff5e72a5ac004d963dd35a4d4d157431682183277d19ab8009bc9e01fe81bf26a026bbc5194995a077b504084e3b62e3b3599dbff2384e089a9b1b9f155ddaca1b0b54ef4d6f3131d8ae65c14d77cf6a8038672f43b59dbe6f13d830e62fe9151985f3cc62f3011d13cc88c479c993c4dec20a0f51f1122fb4c70cb6f11fa1ee"}, {@device_a, @device_a, 0x7c, "f28c20c541e0d6f72b734982ee23d3f9147c7c8d17704970ba2019310ac44d2f63fbc50ff53aaa1e4aa5688ebcd284c330171ac6b73640fe6b007dfa95628b71b44717af6e70385c742348ad1842a41943ba39b3aa0b23781a833915fb490483b81e89c7923a844ae3f0b628c1d357104a4abd55b5814ab937204f48"}]}}, @NL80211_ATTR_FRAME={0x98, 0x33, @ctrl_frame=@ba={{}, {0x2}, @device_b, @device_b, @basic={{0x1}, {0xf, 0x26}, "af927d37ef3e495b2d61a7c1e225e594bac0039fc3a43609eb1dd646be274bac32c458bbb45448c8d005d5aae553aeb86d11aee8aeb8db7ee5d64789b6d70eb203ca64a7de2ee3173b085fb4cdde6685887261bd2037a68fd67c69cc5700c18606b91bd1154b5924f9db9a92f5681407fb92b21064f0bb72891ccc8a73e1b77b"}}}, @NL80211_ATTR_FRAME={0xec, 0x33, @data_frame={@msdu=@type00={{0x0, 0x2, 0x6, 0x0, 0x0, 0x0, 0x1}, {0x4449}, @broadcast, @device_b, @random="78d2605a5c83", {0x5, 0x7}}, @a_msdu=[{@device_a, @broadcast, 0x67, "7fa472585a8ba7effbf0c3a16efa0794324214d09d819d33a33d09155c7d78c673f9f853edfef1ac56d3670b3f167977ff35c1a139874b17a255a7ebcc092ef2eea7ebb52f801d7ebfdf3163f4b59e3d89780ac9e3c7d2f1fc418bb8a22125ac23d4ad039d8685"}, {@device_a, @device_a, 0x4a, "b205331d8bffae05044f8242fb06f1f2173f680cde55275d84d32046e02d65d761a8866f92f8af1a29ea17c22985e1f2ba30c26a17f3f9d50e54b6ecb460b7fec4f6a5e6e5b583382d6b"}]}}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}]}, 0x6a8}, 0x1, 0x0, 0x0, 0x400c0}, 0x8080) r6 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0a00000004000000040000000c"], 0x50) r7 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, &(0x7f0000000040)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000018110000", @ANYRES32=r6, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000010b704000000000000850000000100000095"], &(0x7f00000001c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r8 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r8, 0x8933, &(0x7f0000000080)={'wlan1\x00', 0x0}) r10 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_CQM(r8, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000340)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r10, @ANYBLOB="010000000000000000003f00000008000300", @ANYRES32=r9, @ANYBLOB="14005e800500010000000000080002"], 0x30}}, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000000)='tlb_flush\x00', r7}, 0x10) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000000)='tlb_flush\x00', r7}, 0x18) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r2, 0x8933, &(0x7f0000000c80)={'batadv_slave_1\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000d40)={&(0x7f0000000000)=@ipv4_newaddr={0x40, 0x14, 0x509, 0x70bd27, 0x25dfdbfd, {0x2, 0x1f, 0x0, 0xcb, r11}, [@IFA_BROADCAST={0x8, 0x4, @rand_addr=0x64010102}, @IFA_FLAGS={0x8, 0x8, 0x100}, @IFA_LOCAL={0x8, 0x2, @dev={0xac, 0x14, 0x14, 0x3a}}, @IFA_LOCAL={0x8, 0x2, @private=0xa010102}, @IFA_LOCAL={0x8, 0x2, @rand_addr=0x64010101}]}, 0x40}, 0x1, 0x0, 0x0, 0x4040014}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000040)=ANY=[@ANYBLOB="1800"], 0x18}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, 0x0, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r12 = bpf$MAP_CREATE(0x0, &(0x7f0000001700)=@base={0x16, 0x0, 0xb161, 0x2}, 0x48) unshare(0x28000600) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000080)={{r12, 0xffffffffffffffff}, 0x0, &(0x7f0000000040)}, 0x20) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001200)={r13, 0x0, &(0x7f0000001780)=""/4096}, 0x20) sendto$inet6(r0, &(0x7f0000000000)='s', 0x10a73, 0x800, 0x0, 0x4b6ae4f95a5de35b) 869.178001ms ago: executing program 4 (id=3439): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r2 = socket(0x400000000010, 0x3, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0xffffffff, {0x0, 0x0, 0x0, r4, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x1, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x28}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000001580)=@newtfilter={0x44, 0x2c, 0xd27, 0x70bd25, 0x25dfdbfb, {0x0, 0x0, 0x0, r4, {0x0, 0x7}, {}, {0x7, 0x2}}, [@filter_kind_options=@f_flow={{0x9}, {0x14, 0x2, [@TCA_FLOW_BASECLASS={0x8, 0x3, {0x8, 0x9}}, @TCA_FLOW_BASECLASS={0xd, 0x3, {0x9, 0xa}}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x400d0}, 0x800) close(0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'bridge0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0x44b, 0x0, 0x25dfdbfc, {0x7a, 0x0, 0x0, r5}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bridge={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BR_AGEING_TIME={0x8, 0x8, 0xffffa888}]}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0xc0}, 0x0) 823.49556ms ago: executing program 1 (id=3440): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x4, 0x5, &(0x7f0000000000)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x61}, @call={0x85, 0x0, 0x0, 0x7d}]}, &(0x7f00000000c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x46) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r0, 0x0, 0xe, 0x0, &(0x7f0000000100)="e0274239ed0d85df9774992f0800", 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r1 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r1, 0x10f, 0x87, &(0x7f0000000140)=@req3={0x7813, 0x3, 0x0, 0x81, 0x1ff, 0x1, 0x1}, 0x1c) recvmmsg$unix(r1, &(0x7f0000006cc0)=[{{0x0, 0x0, &(0x7f0000000340)=[{&(0x7f0000000980)=""/4096, 0x1000}], 0x1}}, {{0x0, 0x0, &(0x7f0000002780)=[{&(0x7f0000003100)=""/4096, 0x1000}], 0x1}}, {{0x0, 0x0, &(0x7f0000002b00)=[{&(0x7f00000028c0)=""/191, 0xfc29}], 0x1}}], 0x3, 0x400122a0, 0x0) sendmmsg(r1, &(0x7f00000030c0)=[{{0x0, 0xa9cc7003, &(0x7f0000000400)=[{&(0x7f00000000c0)="ee", 0x101d0}], 0x1}}], 0x400000000000181, 0x9200000000000000) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nbd(&(0x7f0000000040), r2) 643.274721ms ago: executing program 0 (id=3441): r0 = socket$nl_route(0x10, 0x3, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$rds(0x15, 0x5, 0x0) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x11, 0xf, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES64=r0, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000800000000bf91000000000000b702000043e7b5538500000085000000b70000000000000095"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x1f00, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000013c0)={0x18, 0x3, &(0x7f0000000080)=@framed, &(0x7f0000000000)='syzkaller\x00'}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000040)='contention_end\x00', r3}, 0x10) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000140)='kmem_cache_free\x00', r2}, 0x10) pselect6(0xe, 0x0, 0x0, &(0x7f0000000100)={0x3ff, 0xee, 0xffffffffffffffff, 0x9, 0x0, 0x0, 0x7fffffff}, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x0, 0x100010, 0xffffffffffffffff, 0x0) close(0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0xfffff000) bind$rds(r1, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) sendmsg$rds(r1, &(0x7f0000001600)={&(0x7f0000000000)={0x2, 0x0, @remote}, 0x10, 0x0, 0x0, &(0x7f0000000780)=[@rdma_args={0x48, 0x114, 0x1, {{}, {0x0, 0x2c}, &(0x7f00000006c0)=[{&(0x7f0000000100)=""/44, 0x410200}], 0x1}}], 0x48}, 0x0) socket$pppoe(0x18, 0x1, 0x0) 625.353791ms ago: executing program 2 (id=3442): r0 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f00000002c0)={'ip6_vti0\x00', &(0x7f00000000c0)={'syztnl0\x00', 0x0, 0x579b0cf1930a90d0, 0x3, 0xc, 0x7, 0x68, @private2={0xfc, 0x2, '\x00', 0x1}, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x7, 0x80, 0x7}}) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000340)={&(0x7f0000000080)=ANY=[@ANYBLOB="02030003300000002cbd7000fbdbdf25010009000000000005000600000000000a00000000000000000000000000000000000000000000010200000000000000020001000000000000fc070c0000000005000500000000000a00000000000000fc0100000000000000000000000000010700ddffffff000021000800f00700001cb5356fd9e614d0df8ee9ad873d8c27bcbe2ce396e3216d9abf6acab710d75c6da8c28d9e9de96d70b8af314093150fb11326fef317637c355ff8b093715a61b9c9958bf4b3b73c235a465132b9ceed435a390d4c21561add0c8747be29c6ace18e27def05ec4b2babb60f5c8047af8fff3bb2009a5354b5c29641bf31670df1ff916674ebba3c8f0c61030c9d3a1a0223080f5988e5270873c2f4ae7f1c26ab065fc5a3eac24a349be125b904ca92645deb0f7d16ac7e15aed3b3e6a15b662c5d5769051c71abf76b950e592fa1607f0f0dae7ece045ab2777da4fa0fdce5d1deb517d9f0de80c60696a9305cb177c3520c63d6023e10585e5341100000000"], 0x180}, 0x1, 0x7}, 0x0) 569.375578ms ago: executing program 1 (id=3443): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1e, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="18000000010000000000000000"], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x24}, 0x94) r1 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, 0x0, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_NEW_INTERFACE(r2, 0x0, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x11, 0x6, &(0x7f0000001c40)=ANY=[@ANYBLOB="050000000000000061110c00000000008510000002000000850000000500000095000000000000009500a5050000000077d8f3b423cdac8d80000000000000002be16ad10a48b243ccc42606d25dfd73a015e0ca7fc2506a0f7535f7866907dc6751dfb265a0e3ccae669e17fd6587d452d6453559c3421eed73d56615fe6c54c3b3ffe1b4ce25d7c983c044c03bf3a48dfe47ec9dd6c091c30b93bfae76d9ebacd3ed3e26e7a23129d6606fd28a69989d552af9cc9e5ef6bda9df2c3af36effff9af2551ce935b0f327cb3f011a2fd52347125907000000000000003ed38ae89d24e1cebfba2f87925bfacba83109751fe6c05405d027edd68149ee99eef6a6992308a4fc0b7c70bc677d6dd4aed4af7511d7900a820b6347184e9a217b5614cd50cbe43a1ed2526814bc0000e9e086ce48e90defb6670c3df262ad0a97aec7291c25447c106a99893e10db21901eb397b2f5fd71d20fa7a050fbbef9e326ea27e513e96068fd1e8a43e89f9c85c822a961546ed5363c17ff1432d08806bc376e3e49ee52b59d13182e1f24ed200ada12f7a1525320e716660000000000b02b001500a710eb1affb87ba55b2d72078e9f40b4ae7d01000000d11cd22c35d3294000000000000000000000000000000000000000000000000000000000000000000000000c52f4ebd2c893bb97a068bd10738d3c9f7a98eccb26f7e2df3ad37b729ac83b0dcb4f48f3c3356b9997fc455a17690b6f7f9ccbe4b1701941b18a904c0e585a66c3b84b138efc20a546d3d5227e23b03f2a834391ad24fe977076ce7d9b20cf92cb151763d41f5c76e2ff3e93ee296c4082ee73e7e197253a2b66c353312c9d75711ce1623e9c54bdff59d1a69dcb7d84c235b23a4480c2461b405cfd1a38992f295ad3adc94cd07c850d1c77a211bfa02c24e9280333152fb794e4ddea02017a6c139b50101caecaf2abc084075ad10727522934a87a4ddcdb112754ca5bdec0ead14b6c0f19a4b126bbe0c2b8c9ff68236c8600000000000000000000000066e034c81c3cab4e33fc8dc55ce0ada18dcb1a47a87baf63e4edf11c6e82893add3bee3e10fc873d1d922b0877cbcd95b839d3059d5140a1f742f6e75741e39e5cb6a193e06a1043375b0f61b5d4e17c81baa31b924d84f2243471221c158ae8f44bfbfa7c2730302b66a99f66705b71e6205e7cbf36435e1eabb9a63fcd604d5cc27e1317ad94cf438d7187a2fe4e06fa6cbf84ef1efa82cb2c4af6bd1370616cdbe2b98fd89b79824ba089df1f81e6fcef073059f5f1d6a221d791839d7826ed1759c2153532c393fd1bd7be2e7f5abf2f0800000000ea46c07adee10d0f2bc85cf37182256e4fd8f56942726efc07180eaa5421d697665c8bacd39cdb392e6153af80bc1a69e3bfab032e78c9a96eab13be845a0d44ef2a4ab414ac2e4802a3b5d3aa2a4a4fc259206d97d0cc1602d6b45ff414c53fc9f5f68438f0423e168a97923ca0464b40b2f797841fb2bb2e5ad9feff37220ab7c34f4c382c247e7735adb55c209f7c0f8880733dbd3f5a095cc6a2"], &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x6}, 0x70) ioctl$BTRFS_IOC_SCRUB(r1, 0xc400941b, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000080)='sched_switch\x00', r3}, 0x10) r4 = socket$inet_udp(0x2, 0x2, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000340)=ANY=[@ANYRES32=r1, @ANYRES16, @ANYBLOB="0100000000000000000005000000180001801400020073797a5f74756e"], 0x44}}, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$SEG6_CMD_SETHMAC(r5, &(0x7f0000000580)={&(0x7f0000000140), 0xc, &(0x7f0000000180)={&(0x7f0000000500)={0x50, 0x0, 0x1000, 0x70bd25, 0x25dfdbfe, {}, [@SEG6_ATTR_HMACKEYID={0x8, 0x3, 0xf5}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0x4}, @SEG6_ATTR_SECRET={0x8, 0x4, [0xa05]}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0x6c}, @SEG6_ATTR_SECRET={0x14, 0x4, [0xc, 0x10000, 0x40000, 0x6]}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0x100}]}, 0x50}, 0x1, 0x0, 0x0, 0x4008014}, 0x80) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$fou(&(0x7f0000000200), 0xffffffffffffffff) sendmsg$FOU_CMD_ADD(r7, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000001c0)={0x1c, r8, 0x1, 0x0, 0x0, {}, [@FOU_ATTR_TYPE={0x5, 0x4, 0x1}]}, 0x1c}}, 0x0) sendmsg$FOU_CMD_DEL(r6, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000001c0)={0x14, r8, 0x1}, 0x14}}, 0x0) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000004c0)={0x38, 0x0, 0x7, 0x0, 0x0, {}, [@ETHTOOL_A_LINKMODES_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'syz_tun\x00'}]}, @ETHTOOL_A_LINKMODES_OURS={0xc, 0x3, 0x0, 0x1, [@ETHTOOL_A_BITSET_BITS={0x4}, @ETHTOOL_A_BITSET_NOMASK={0x4}]}]}, 0x38}}, 0x0) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) r9 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r9, &(0x7f0000000000)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="0207000902"], 0x10}}, 0x0) bind$inet(r4, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16) connect$inet(r4, &(0x7f0000000480)={0x2, 0x4e23, @multicast2}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r4, 0x0, 0x11, &(0x7f00000002c0)={{{@in6=@dev={0xfe, 0x80, '\x00', 0x4}, @in6=@empty, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe}, {}, 0x0, 0x0, 0x1}, {{@in6=@dev, 0x0, 0x32}, 0x0, @in=@private=0xa010100, 0x0, 0x0, 0x0, 0xb7, 0x2, 0xfffffffe}}, 0xe8) sendmmsg(r4, &(0x7f0000007fc0), 0x800001d, 0x1c) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1e, 0x3, &(0x7f00000000c0)=ANY=[], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x94) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @local}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) sendmmsg$inet(r0, &(0x7f0000005900)=[{{0x0, 0x0, &(0x7f0000000800)=[{&(0x7f0000000640)="3246e1de388f74f98f688f95a44120ee1c15afb1b237b1c44988fe1e1481ab985cde07779645a9540bd6835a900e13d7637d5cd146b6806df51fcfb7029b1d8655fe61b2e0240c998baa7cb19a1e0861ec0dc19f2b3b52fafe9f729c4568a4ff6dff11580a8c018a246c", 0x6a}], 0x1}}], 0x1, 0x40000d0) close(0x3) 419.376107ms ago: executing program 2 (id=3444): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r0, 0x84, 0x6e, &(0x7f0000000140)=[@in6={0xa, 0x6e24, 0x2, @private2={0xfc, 0x2, '\x00', 0x1}, 0x3}], 0x1c) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r1, 0x0) socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$IPT_SO_GET_REVISION_TARGET(r1, 0x0, 0x43, &(0x7f0000000100)={'NETMAP\x00'}, &(0x7f0000000180)=0x1e) r2 = socket$inet(0xa, 0x801, 0x84) connect$inet(r2, &(0x7f0000004cc0)={0x2, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x10) listen(r2, 0x8) accept4(r2, 0x0, 0x0, 0x0) r3 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_AUTO_ASCONF(r3, 0x84, 0x1e, &(0x7f0000000080), &(0x7f00000000c0)=0x4) 367.547717ms ago: executing program 4 (id=3445): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000200)={'ip6_vti0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {0x0, 0x3f}, {0xfff1, 0xffff}, {0x0, 0xfff1}}, [@TCA_RATE={0x6, 0x5, {0x9, 0x8}}, @qdisc_kind_options=@q_ingress={0xc}]}, 0x38}}, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r2, &(0x7f0000000040)={0x18, 0x0, {0x4, @remote, 'ip6gre0\x00'}}, 0x1e) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="05000000050000000200000004", @ANYRES16=r1, @ANYRES32, @ANYBLOB="4ef69228c8b736cbc56eb9b8526c408092d00570e138e8003cb29cfc9b6deff491d03963f8561a4ae5540dde8a9d1336228cb23576c8238333feea49bd2bf6fc1a7503a18390ae4af6870b571285af2a0bd9fd0300882bae25be65a1e00c8fd64a7e6f7d27d8799b507b34d9151c44ce91bb09543d2ab754b022f444b2ac099ff39d1ca9d644537f5fd8de7d1c6fa4ea56350c46544f29f8253713b65e360e44eff89c914a0c25c22aaaa44c3f6c575a19628b6cef9fb0b05bbe211be7fa749abc8ec1", @ANYRES8=r0, @ANYRES8=r2], 0x48) close(0x3) bpf$MAP_CREATE(0x0, &(0x7f0000000600)=ANY=[@ANYBLOB="0b0000000700000001000fc1e5010009000000010000005a387d3f3a4e14e8aa766567c0ecef4f079ecefc38e4d20be516b0fdf60345b989349c5d86b3f367e9963883320c9d764d891fc4f1610190287de3cf053ca45bae02000069c0e6d3001000ac6b0f1c01faab4ee99ecf7a780a12ef0d0a2e61f31d317fa1ee5c90b29cb75b62c6db6b9efc621b4ebfbff2ce31e1822e53c6fa9c599c6cc3a286a1ce5832103f0f0c929be43d251258604b40dfc936d5ea2444bd0ed54df2d5a319ea212ed81c8efcd25b455317b80245bde071", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x14, &(0x7f0000000000)=ANY=[@ANYBLOB="1802000000000000000000000000000018010000786c6c2500000000070000007b1af8ff00000000bfa100000000000007010000f8ffffffb700000000000000b703000000000000850000002d00000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) preadv(r5, &(0x7f00000008c0)=[{0x0}], 0x1, 0x3, 0x1) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000004c0)={&(0x7f0000000300)='tlb_flush\x00', r4}, 0x10) 124.083235ms ago: executing program 3 (id=3446): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = epoll_create1(0x0) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r2, 0x84, 0x76, &(0x7f0000000200)={0x0, 0x7}, 0x8) sendmmsg$inet6(r2, &(0x7f0000000440)=[{{&(0x7f0000000080)={0xa, 0x4e23, 0x0, @loopback, 0x280020}, 0x1c, &(0x7f00000004c0)=[{&(0x7f0000000100)}], 0x1}}], 0x1, 0x20008050) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x11, 0xf, &(0x7f0000000580)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000800000000bf91000000000000b702000043e7b5538500000085000000b70000000000000095"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x24, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000140)='kmem_cache_free\x00', r6}, 0x10) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x11, 0x6, &(0x7f0000000cc0)=ANY=[@ANYBLOB="050000000000000061110c00000000008510000002000000850000000500000095000000000000009500a5050000000077d8f3b423cdac8d80000000000000002be16ad10a48b243ccc42606d25dfd73a015e0ca7fc2506a0f7535f7866907dc0200000000000000ae669e17fd6587d452d6453559c3421eed73d56615fe6c54c3b3ffe1b4ce25d7c983c044c03bf3a48dfe47ec9dd6c091c30b93bfae76d9ebacd3ed3e26e7a23129d6606fd28a69989d552af6bda9df2c3af36effff9af2551ce896165127cb3f011a7d06602e2fc40848228567ffb400000000003ed38ae89d24e1cebfba2f87925bfacba83109751fe6c05405d027edd68149ee99eef6a6992308a4fc0b7c70bc677d6dd4aed4af7500d7900a820b6347184e9a217b5614cd50cbe43a1ed2526814bc0000e9e086ce48e90defb6670c3df2624f56da648d28ad0a97aec7291c25447c106a99893e10db21901eb397b2f5fd71400fa7a050fbbef9e326ea27e513e96068fd1e8a43e89f9c85c822a961546ed5363c17ff1432d08806bc376e3e49ee52b59d13182e1f24ed200ada10eb1affb87ba55b2d72078e9f40b4ae7d01000000d11cd22c35d32940000088dde499000000fdffffff00000000000f000000ef0000000000000000000000000c52f4ebd2c893bb97a068bd10734a83584898eccb26f7b789cfc4cd995fa3e11a5c74c85404e2df3ad37b729ac83b0dcb4f48f3c3356b9997fc455a17690b6f7f9ccbe4b1701941b18aba6b16455a66c3b84b138efc20a546d3d5227e23b03f2a834391ade2ff3e93ee296c4082ee73e7c353312c9d75711ce1623e9c54bdff59d2a69dcb7d84c235b23a4480c2461b405cfd1a38992f295ad3adc94cd07c850d1ce6d0b2fea02c24e9280333152fb794e4ddea02017a6c139b50101caecaf2abc0847a1ff2f7fc3c2b99a96fc4275ad107274e2934a87a4ddcdb112754ca5bdec0ead14b6c0f19a43a2f05c7f0be31491eb8c9ff68236c8600040000000000000000000066e034c81c3cab64e4fc8dc55ce0ada18dcbf31c6e82893add3bee3e10fc873d1d922b0877cbcd95b839d3059d5140a1f742f6e75741e39e5cb6a193e06a1043375b0f61b5d4e17c81baa31b924d84f224baf1221c15fa12313ffbfa7c2730309f66705b71e6205e7cbf3643561eabb9a63fcd604d5cc27e1317ad94cf438d71873e540be16b6ca205081173bd03c4754fc4674812daab482fd390a1c903b5d28a1eb247b5837d7603b92495d5c569f6433c3fca5206cb0000003fdbbd3892c52c2e7612e05de32322e980a3d69931e2c9312dd517c96f2ee90362476ed853c4c9b7d4ebf13cbaa795860e92a3d7d004f2c491db38eb769f094d5d48b262cc35c40682138cf13a49aa9f27abec00002f01ba1251aaf2385416ca719300"], &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x6}, 0x70) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000080)='sched_switch\x00', r7}, 0x10) ppoll(&(0x7f0000000500)=[{r5}], 0x1, 0x0, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[], 0x48}, 0x1, 0x0, 0x0, 0x20040884}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f0000000280)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r8, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000240)=@dellink={0x34, 0x11, 0x1, 0x70bd27, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, 0x1020, 0x40000}, [@IFLA_IFNAME={0x14, 0x3, 'veth1_vlan\x00'}]}, 0x34}, 0x1, 0x0, 0x0, 0x801}, 0x4000000) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff) r9 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r9, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000002c0)=@updpolicy={0x17c, 0x19, 0x1, 0x0, 0x3, {{@in=@multicast2, @in6=@local, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x80}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001}, {}, 0x0, 0x200}, [@tmpl={0xc4, 0x5, [{{@in=@multicast1, 0x4d5, 0x3c}, 0x2, @in=@multicast1, 0x3507, 0x4, 0x3, 0x7, 0x8, 0x4, 0x2}, {{@in6=@dev={0xfe, 0x80, '\x00', 0xc}, 0x4d3, 0x6c}, 0x2, @in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x3501, 0x2, 0x0, 0x73, 0x8000, 0x4, 0x7}, {{@in=@multicast2, 0x80000001, 0x3c}, 0xa, @in=@remote, 0x0, 0x1, 0x1, 0x9, 0x8, 0x0, 0x7}]}]}, 0x17c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) preadv(0xffffffffffffffff, &(0x7f0000000100), 0xa, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r4, &(0x7f0000000100)={0x20000014}) r10 = socket$netlink(0x10, 0x3, 0x6) writev(r10, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000010880)=@base={0x5, 0x4, 0x8, 0xc}, 0x50) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f00000008c0)={'veth1_to_bridge\x00', 0x0}) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000010c0)={r6, 0xe0, &(0x7f0000000bc0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, &(0x7f0000000900)=[0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x1, 0x4, &(0x7f0000000940)=[0x0], &(0x7f0000000980)=[0x0, 0x0, 0x0, 0x0], 0x0, 0xf5, &(0x7f0000000a00)=[{}], 0x8, 0x10, &(0x7f0000000a40), &(0x7f0000000a80), 0x8, 0x7d, 0x8, 0x8, &(0x7f0000000ac0)}}, 0x10) sendmsg$ETHTOOL_MSG_CHANNELS_GET(0xffffffffffffffff, &(0x7f0000001240)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000001200)={&(0x7f0000000700)={0xfc, 0x0, 0x0, 0x70bd25, 0x25dfdbfd, {}, [@HEADER={0x38, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1_to_bond\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}]}, @HEADER={0x3c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'pimreg0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'batadv_slave_1\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}]}, @HEADER={0x54, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r11}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'batadv0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r12}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1_to_team\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}]}, @HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}]}, @HEADER={0x14, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}]}]}, 0xfc}, 0x1, 0x0, 0x0, 0x4400c000}, 0x4000000) bpf$PROG_LOAD(0x5, &(0x7f0000010400)={0x11, 0x13, &(0x7f0000000640)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x7}, {{0x18, 0x1, 0x1, 0x0, r5}}, {}, [@map_idx={0x18, 0xb}, @btf_id={0x18, 0x6, 0x3, 0x0, 0x1}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x2d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000200)=@newlink={0x50, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x5b5d}, [@IFLA_AF_SPEC={0x1c, 0x1a, 0x0, 0x1, [@AF_INET6={0x18, 0xa, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @rand_addr=' \x01\x00'}]}]}, @IFLA_ALT_IFNAME={0x14, 0x35, 'wg1\x00'}]}, 0x50}}, 0x0) 120.431688ms ago: executing program 4 (id=3447): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x301, 0x0, 0x0, {0x1, 0x0, 0x5}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x40, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}, @NFTA_CHAIN_HOOK={0x14, 0x4, 0x0, 0x1, [@NFTA_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x75031b34}, @NFTA_HOOK_HOOKNUM={0x8}]}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWRULE={0x40, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_EXPRESSIONS={0x18, 0x4, 0x0, 0x1, [{0x14, 0x1, 0x0, 0x1, @last={{0x9}, @val={0x4}}}]}]}], {0x14}}, 0xc8}}, 0x0) syz_emit_ethernet(0x46, &(0x7f0000000140)={@link_local, @random="f6e60800", @void, {@ipv6={0x86dd, @udp={0x0, 0x6, "050100", 0x10, 0x11, 0x0, @remote, @local, {[], {0x3, 0xe22, 0x10, 0x0, @gue={{0x2, 0x0, 0x0, 0x3}}}}}}}}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x1e, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x1, 0x2, 0x3, 0x2, 0x1, 0x1e}]}, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x24}, 0x94) 0s ago: executing program 4 (id=3448): bpf$PROG_LOAD(0x5, &(0x7f0000001700)={0x6, 0xb, &(0x7f00000002c0)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020782500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000005000000b7030000fcffffff850000007300000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x47, '\x00', 0x0, @fallback=0x21, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000200)='ns/pid_for_children\x00') unshare(0x6a040000) r0 = socket$inet6_sctp(0xa, 0x5, 0x84) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x40001}, 0x4000000) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) unshare(0x6a040000) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, 0x0}, 0x0) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001f40)=ANY=[@ANYRES32=0x0, @ANYRES16=r2, @ANYBLOB="000000000000000000000000000000000000000000000000000000004f689912cf579b55590b65b786dec00085c427ed7898b0e73b302c0397e77365fe3f3b60cda8c5d03bdf06b0b67abad06878db74695442a0f6646ffdf0078f8cc7cd16efe0905278716ec28bce77d355fc18930080ffffc296a9455edc81efca1cbfa1333d"], 0x50) bpf$PROG_LOAD(0x5, 0x0, 0x0) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f0000000140)={0x0, @in={{0x2, 0x0, @empty}}, 0x0, 0x0, 0x3f8, 0x0, 0x32}, 0x9c) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000580)={{}, &(0x7f00000003c0), &(0x7f0000000440)='%pI4 \x00'}, 0xffffffffffffff30) bind$inet6(r3, &(0x7f00004b8fe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendto$inet6(r3, &(0x7f0000847fff)='X', 0xfee4, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendmmsg$inet6(r3, &(0x7f0000004900)=[{{0x0, 0x0, &(0x7f0000000100)}}], 0x1, 0x4048894) setsockopt$SO_VM_SOCKETS_BUFFER_MIN_SIZE(0xffffffffffffffff, 0x28, 0x1, 0x0, 0x0) close(0x3) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000004c0)={0x18, 0x5, &(0x7f0000000100)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x7}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000180)='sched_switch\x00', r4, 0x0, 0xff}, 0x18) bpf$MAP_CREATE(0x600000000000000, &(0x7f0000000000)=ANY=[@ANYBLOB="0f00000004000000040000000200020000000000", @ANYRES32=0x1, @ANYBLOB="fdffffff00000000000000000000000000000200", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000040000000000000000000000000000000000000000000000a126efaffad949c7e5da06c89b0d33075df053a7d6118f07b673ce0dbec19804c6dbb705ceb4"], 0x48) socket$nl_generic(0x10, 0x3, 0x10) r5 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), r5) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000380)={'wlan0\x00'}) sendmsg$NL80211_CMD_GET_WIPHY(r5, 0x0, 0x400c4) kernel console output (not intermixed with test programs): 1000 [ 349.222490][T13717] __nla_validate_parse: 5 callbacks suppressed [ 349.222508][T13717] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2117'. [ 349.329324][T13717] batman_adv: batadv0: Removing interface: vlan3 [ 349.374427][T13717] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 349.469123][T13737] netlink: 'syz.4.2122': attribute type 32 has an invalid length. [ 349.702314][T13729] netlink: 28 bytes leftover after parsing attributes in process `syz.3.2118'. [ 349.856733][T13755] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2126'. [ 350.082882][T13761] tipc: Enabled bearer , priority 0 [ 350.104751][T13761] syzkaller0: entered promiscuous mode [ 350.122456][T13761] syzkaller0: entered allmulticast mode [ 350.163743][T13761] netlink: 44 bytes leftover after parsing attributes in process `syz.1.2129'. [ 350.386350][T13776] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2133'. [ 350.755994][T13760] tipc: Resetting bearer [ 350.772682][T13789] netlink: 'syz.0.2135': attribute type 13 has an invalid length. [ 350.801509][T13789] netlink: 76 bytes leftover after parsing attributes in process `syz.0.2135'. [ 350.832870][T13760] tipc: Disabling bearer [ 350.867228][T13789] syz_tun: refused to change device tx_queue_len [ 351.281326][T13819] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2145'. [ 351.557577][T13831] netlink: 1 bytes leftover after parsing attributes in process `syz.1.2149'. [ 351.569830][T13831] netlink: 80 bytes leftover after parsing attributes in process `syz.1.2149'. [ 351.580674][T13831] xt_CHECKSUM: CHECKSUM should be avoided. If really needed, restrict with "-p udp" and only use in OUTPUT [ 351.592636][T13831] x_tables: ip_tables: TPROXY target: used from hooks FORWARD, but only usable from PREROUTING [ 352.330185][T13859] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2155'. [ 352.648534][T13866] netlink: 'syz.2.2157': attribute type 1 has an invalid length. [ 352.792839][T13866] 8021q: adding VLAN 0 to HW filter on device bond0 [ 352.912989][T13876] bond0: (slave geneve0): making interface the new active one [ 352.952064][T13876] bond0: (slave geneve0): Enslaving as an active interface with an up link [ 352.978119][T13886] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 353.017668][T13704] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 20000 - 0 [ 353.041571][T13704] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 20000 - 0 [ 353.102196][T13704] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 20000 - 0 [ 353.120783][T13704] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 20000 - 0 [ 353.317637][T13899] ip6_vti0 speed is unknown, defaulting to 1000 [ 353.377413][T13896] can: request_module (can-proto-5) failed. [ 353.618414][T13916] bond3: entered promiscuous mode [ 353.623757][T13916] bond3: entered allmulticast mode [ 353.629798][T13916] 8021q: adding VLAN 0 to HW filter on device bond3 [ 354.093559][T13893] ip6_vti0 speed is unknown, defaulting to 1000 [ 354.105025][T13899] wg1 speed is unknown, defaulting to 1000 [ 354.455695][T13945] netlink: 'syz.0.2175': attribute type 1 has an invalid length. [ 354.571908][T13945] 8021q: adding VLAN 0 to HW filter on device bond18 [ 354.665216][T13946] bond18: (slave geneve2): making interface the new active one [ 354.691621][T13946] bond18: (slave geneve2): Enslaving as an active interface with an up link [ 354.712169][T13893] wg1 speed is unknown, defaulting to 1000 [ 354.735176][ T60] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 20000 - 0 [ 354.780781][ T60] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 20000 - 0 [ 354.825460][ T60] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 20000 - 0 [ 354.845826][ T60] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 20000 - 0 [ 355.278164][T13974] __nla_validate_parse: 5 callbacks suppressed [ 355.278185][T13974] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2182'. [ 355.318674][T13974] netlink: 348 bytes leftover after parsing attributes in process `syz.4.2182'. [ 355.448054][T13977] netlink: 80 bytes leftover after parsing attributes in process `syz.0.2183'. [ 355.945552][T13994] ieee802154 phy1 wpan1: encryption failed: -22 [ 355.971895][T13996] netlink: 'syz.4.2190': attribute type 1 has an invalid length. [ 356.007659][ T3502] netdevsim netdevsim4 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 356.030928][ T3502] netdevsim netdevsim4 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 356.039236][ T3502] netdevsim netdevsim4 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 356.048661][ T3502] netdevsim netdevsim4 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 356.284997][T14018] netlink: 'syz.3.2198': attribute type 13 has an invalid length. [ 356.319125][T14019] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2194'. [ 356.607793][T14032] netlink: 'syz.4.2203': attribute type 32 has an invalid length. [ 356.619209][T14032] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2203'. [ 356.705523][T14032] bond4: Setting coupled_control to off (0) [ 357.156559][T14054] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2209'. [ 357.470583][T14046] netlink: 40 bytes leftover after parsing attributes in process `syz.0.2205'. [ 357.493723][T14061] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2205'. [ 357.572407][T14052] netlink: 48 bytes leftover after parsing attributes in process `syz.3.2208'. [ 357.790403][T14068] netlink: 48 bytes leftover after parsing attributes in process `syz.2.2212'. [ 357.829257][T14068] netlink: 'syz.2.2212': attribute type 13 has an invalid length. [ 357.845719][T14070] bond7: option arp_validate: invalid value (18446744073491447809) [ 357.871417][T14070] bond7 (unregistering): Released all slaves [ 358.024722][T14068] veth0_macvtap: left allmulticast mode [ 358.106734][ T49] netdevsim netdevsim2 eth0: unset [1, 0] type 2 family 0 port 20000 - 0 [ 358.162506][ T49] netdevsim netdevsim2 eth1: unset [1, 0] type 2 family 0 port 20000 - 0 [ 358.180508][ T49] netdevsim netdevsim2 eth2: unset [1, 0] type 2 family 0 port 20000 - 0 [ 358.188987][ T49] netdevsim netdevsim2 eth3: unset [1, 0] type 2 family 0 port 20000 - 0 [ 358.293579][T14085] IPVS: set_ctl: invalid protocol: 98 224.0.0.2:20004 [ 358.333547][T14079] ip6_vti0 speed is unknown, defaulting to 1000 [ 358.920312][T14087] ip6_vti0 speed is unknown, defaulting to 1000 [ 358.943929][T14079] wg1 speed is unknown, defaulting to 1000 [ 359.378225][T14087] wg1 speed is unknown, defaulting to 1000 [ 359.990030][T14132] netlink: 'syz.3.2229': attribute type 2 has an invalid length. [ 360.254175][T14137] ip6_vti0 speed is unknown, defaulting to 1000 [ 360.541593][T14154] __nla_validate_parse: 6 callbacks suppressed [ 360.541612][T14154] netlink: 44 bytes leftover after parsing attributes in process `syz.2.2235'. [ 360.717870][T14137] wg1 speed is unknown, defaulting to 1000 [ 360.724832][T14139] ip6_vti0 speed is unknown, defaulting to 1000 [ 361.022498][T14139] wg1 speed is unknown, defaulting to 1000 [ 361.374316][T14172] bond6: invalid ARP target 0.0.0.0 specified for addition [ 361.391031][T14172] bond6: option arp_ip_target: invalid value (0) [ 361.411066][T14172] bond6 (unregistering): Released all slaves [ 361.448012][T14173] gtp0: entered promiscuous mode [ 361.456540][T14173] gtp0: entered allmulticast mode [ 361.462704][T14178] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2239'. [ 361.520228][T14178] netlink: 264 bytes leftover after parsing attributes in process `syz.0.2239'. [ 361.543079][T14178] netlink: 56 bytes leftover after parsing attributes in process `syz.0.2239'. [ 361.801133][T14184] netlink: 'syz.3.2241': attribute type 1 has an invalid length. [ 361.808921][T14184] netlink: 'syz.3.2241': attribute type 3 has an invalid length. [ 361.817299][T14184] netlink: 212 bytes leftover after parsing attributes in process `syz.3.2241'. [ 361.818376][T14186] netlink: 'syz.2.2242': attribute type 1 has an invalid length. [ 361.871186][T14187] netlink: 'syz.2.2242': attribute type 1 has an invalid length. [ 361.878961][T14187] netlink: 16150 bytes leftover after parsing attributes in process `syz.2.2242'. [ 361.965363][T14186] netlink: 16150 bytes leftover after parsing attributes in process `syz.2.2242'. [ 362.158077][T14195] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2244'. [ 362.255118][T14202] A link change request failed with some changes committed already. Interface ip6gretap0 may have been left with an inconsistent configuration, please check. [ 362.280830][ T5840] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 362.314005][T14202] netlink: 72 bytes leftover after parsing attributes in process `syz.0.2246'. [ 362.548824][T14215] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2250'. [ 362.734840][T14224] openvswitch: netlink: Message has 4 unknown bytes. [ 362.750827][ T5919] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 362.938743][T14232] netlink: 'syz.0.2254': attribute type 9 has an invalid length. [ 363.686950][T14253] bridge4: entered allmulticast mode [ 363.955028][T14262] ip6_vti0 speed is unknown, defaulting to 1000 [ 364.262529][T14277] IPVS: set_ctl: invalid protocol: 12 172.30.1.5:20004 [ 364.897357][T14260] ip6_vti0 speed is unknown, defaulting to 1000 [ 364.897469][T14262] wg1 speed is unknown, defaulting to 1000 [ 365.611904][T14308] ip6_vti0 speed is unknown, defaulting to 1000 [ 366.037105][T14308] wg1 speed is unknown, defaulting to 1000 [ 366.053393][T14343] __nla_validate_parse: 3 callbacks suppressed [ 366.053410][T14343] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2281'. [ 366.113454][T14260] wg1 speed is unknown, defaulting to 1000 [ 366.308633][T14347] raw_sendmsg: syz.4.2280 forgot to set AF_INET. Fix it! [ 367.343919][T14373] x_tables: duplicate underflow at hook 1 [ 367.825229][T14385] netlink: 32 bytes leftover after parsing attributes in process `syz.3.2292'. [ 368.340217][T14397] netlink: 'syz.2.2295': attribute type 7 has an invalid length. [ 369.418893][T14471] xt_TPROXY: Can be used only with -p tcp or -p udp [ 369.441730][T14471] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2316'. [ 369.766332][T14486] netlink: 20 bytes leftover after parsing attributes in process `syz.4.2322'. [ 369.800616][T14486] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2322'. [ 369.943991][T14502] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2327'. [ 370.487953][T14533] netlink: 60 bytes leftover after parsing attributes in process `syz.4.2338'. [ 370.514588][T14532] netlink: 'syz.0.2337': attribute type 4 has an invalid length. [ 370.729880][T14538] tipc: Enabled bearer , priority 10 [ 371.001245][T14552] x_tables: ip_tables: rpfilter match: used from hooks FORWARD, but only valid from PREROUTING [ 371.225035][T14565] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2346'. [ 371.259364][T14555] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2345'. [ 371.266370][T14567] netlink: 28 bytes leftover after parsing attributes in process `syz.3.2347'. [ 371.272019][T14555] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2345'. [ 371.315820][T14560] ip6_vti0 speed is unknown, defaulting to 1000 [ 371.322523][T14567] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2347'. [ 371.339392][T14567] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2347'. [ 371.357660][T14567] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2347'. [ 371.375241][T14567] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2347'. [ 371.384502][T14567] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2347'. [ 371.393570][T14567] netlink: 6236 bytes leftover after parsing attributes in process `syz.3.2347'. [ 371.564407][T14581] netlink: 'syz.3.2350': attribute type 12 has an invalid length. [ 371.705276][T14560] wg1 speed is unknown, defaulting to 1000 [ 371.712673][T14577] ip6_vti0 speed is unknown, defaulting to 1000 [ 371.922795][T14599] netlink: 'syz.1.2356': attribute type 1 has an invalid length. [ 372.032219][T14599] 8021q: adding VLAN 0 to HW filter on device bond5 [ 372.098177][T14604] 8021q: adding VLAN 0 to HW filter on device bond5 [ 372.107710][T14604] bond5: (slave vxcan5): The slave device specified does not support setting the MAC address [ 372.118880][T14604] bond5: (slave vxcan5): Error -95 calling set_mac_address [ 372.142073][T14575] ip6_vti0 speed is unknown, defaulting to 1000 [ 372.161545][T14577] wg1 speed is unknown, defaulting to 1000 [ 372.192414][T14607] mac80211_hwsim hwsim6 syzkaller0: left promiscuous mode [ 372.210794][T14607] mac80211_hwsim hwsim6 syzkaller0: left allmulticast mode [ 372.640591][T14621] batadv_slave_1: entered promiscuous mode [ 372.703741][T14620] batadv_slave_1: left promiscuous mode [ 372.798148][T14575] wg1 speed is unknown, defaulting to 1000 [ 372.952279][T14633] ip6_vti0 speed is unknown, defaulting to 1000 [ 373.967578][T14633] wg1 speed is unknown, defaulting to 1000 [ 374.165800][T14694] xt_hashlimit: max too large, truncated to 1048576 [ 374.506618][T14708] tipc: Enabling of bearer rejected, failed to enable media [ 374.610051][T14710] netlink: 'syz.3.2380': attribute type 1 has an invalid length. [ 374.618372][T14711] netlink: 'syz.3.2380': attribute type 1 has an invalid length. [ 374.886790][T14721] ip6_vti0 speed is unknown, defaulting to 1000 [ 375.247069][T14721] wg1 speed is unknown, defaulting to 1000 [ 375.414732][T14752] netlink: 'syz.4.2390': attribute type 12 has an invalid length. [ 375.423796][T14752] netlink: 'syz.4.2390': attribute type 1 has an invalid length. [ 375.679338][T14753] ip6_vti0 speed is unknown, defaulting to 1000 [ 375.936010][T14760] ip6_vti0 speed is unknown, defaulting to 1000 [ 375.998939][T14774] 8021q: adding VLAN 0 to HW filter on device macvlan0 [ 376.202877][T14760] wg1 speed is unknown, defaulting to 1000 [ 376.260276][T14753] wg1 speed is unknown, defaulting to 1000 [ 376.689412][T14806] netlink: 'syz.4.2405': attribute type 13 has an invalid length. [ 377.054545][T14824] openvswitch: netlink: Message has -2 unknown bytes. [ 377.361065][ T1315] netdevsim netdevsim4 eth0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 377.369710][ T1315] netdevsim netdevsim4 eth1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 377.415593][T14804] ip6_vti0 speed is unknown, defaulting to 1000 [ 377.441704][ T1315] netdevsim netdevsim4 eth2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 377.464710][ T1315] netdevsim netdevsim4 eth3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 377.664589][T14837] __nla_validate_parse: 7 callbacks suppressed [ 377.664607][T14837] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2413'. [ 377.742462][T14804] wg1 speed is unknown, defaulting to 1000 [ 378.194753][T14856] workqueue: Failed to create a rescuer kthread for wq "bond5": -EINTR [ 378.378436][T14867] netlink: 28 bytes leftover after parsing attributes in process `syz.0.2420'. [ 378.431288][T14867] netlink: 28 bytes leftover after parsing attributes in process `syz.0.2420'. [ 378.469227][T14876] netlink: 60 bytes leftover after parsing attributes in process `syz.2.2423'. [ 378.484408][ T1300] aoe: packet could not be sent on bond0. consider increasing tx_queue_len [ 378.493888][ T1300] ieee802154 phy1 wpan1: encryption failed: -22 [ 378.728126][T14880] bridge0: entered promiscuous mode [ 378.735440][T14880] bridge0: port 3(macvtap1) entered blocking state [ 378.756898][T14880] bridge0: port 3(macvtap1) entered disabled state [ 378.765078][T14880] macvtap1: entered allmulticast mode [ 378.770838][T14880] bridge0: entered allmulticast mode [ 378.779163][T14880] macvtap1: left allmulticast mode [ 378.784612][T14880] bridge0: left allmulticast mode [ 378.810858][T14880] bridge0: left promiscuous mode [ 378.987568][T14892] ip6_vti0 speed is unknown, defaulting to 1000 [ 379.474055][T14892] wg1 speed is unknown, defaulting to 1000 [ 379.474241][T14898] ip6_vti0 speed is unknown, defaulting to 1000 [ 379.798652][T14904] ip6_vti0 speed is unknown, defaulting to 1000 [ 379.801869][T14898] wg1 speed is unknown, defaulting to 1000 [ 380.201908][T14918] ip6_vti0 speed is unknown, defaulting to 1000 [ 380.410694][T14948] netlink: 20 bytes leftover after parsing attributes in process `syz.4.2439'. [ 380.420013][T14948] netlink: 1 bytes leftover after parsing attributes in process `syz.4.2439'. [ 380.438660][T14916] ip6_vti0 speed is unknown, defaulting to 1000 [ 380.696303][T14904] wg1 speed is unknown, defaulting to 1000 [ 380.746157][T14918] wg1 speed is unknown, defaulting to 1000 [ 380.900996][T14916] wg1 speed is unknown, defaulting to 1000 [ 380.959600][T14956] ip6_vti0 speed is unknown, defaulting to 1000 [ 381.110399][T14963] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2444'. [ 381.443564][T14956] wg1 speed is unknown, defaulting to 1000 [ 381.697708][T14966] netlink: 'syz.3.2445': attribute type 1 has an invalid length. [ 381.826670][T14969] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2445'. [ 381.936004][T14966] 8021q: adding VLAN 0 to HW filter on device bond7 [ 382.005048][T14968] 8021q: adding VLAN 0 to HW filter on device batadv2 [ 382.029448][T14968] bond7: (slave batadv2): making interface the new active one [ 382.039939][T14968] bond7: (slave batadv2): Enslaving as an active interface with an up link [ 382.167937][T14969] bond7 (unregistering): (slave batadv2): Releasing active interface [ 382.179162][T14969] bond7 (unregistering): Released all slaves [ 383.730697][T15031] ip6_vti0 speed is unknown, defaulting to 1000 [ 383.921635][T15038] netlink: 'syz.3.2464': attribute type 1 has an invalid length. [ 384.069756][T15040] bond7: (slave vxcan5): The slave device specified does not support setting the MAC address [ 384.081933][T15040] bond7: (slave vxcan5): Error -95 calling set_mac_address [ 384.212780][T15038] bond7: (slave bridge5): Enslaving as an active interface with a down link [ 384.224681][T15028] ip6_vti0 speed is unknown, defaulting to 1000 [ 384.232115][T15031] wg1 speed is unknown, defaulting to 1000 [ 384.647932][T15057] gretap1: entered allmulticast mode [ 384.688206][T15028] wg1 speed is unknown, defaulting to 1000 [ 385.415621][T15085] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2475'. [ 389.350675][ C0] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 399.228716][T15098] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2478'. [ 399.233473][T15102] netlink: 'syz.2.2480': attribute type 1 has an invalid length. [ 399.248308][T15103] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2481'. [ 399.319801][T15102] 8021q: adding VLAN 0 to HW filter on device bond7 [ 399.346462][T15109] team0: Device gre2 is of different type [ 399.392460][T15112] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2481'. [ 399.471170][T15102] veth15: entered promiscuous mode [ 399.482366][T15097] ip6_vti0 speed is unknown, defaulting to 1000 [ 399.491096][T15106] erspan0: entered allmulticast mode [ 399.580974][T15106] bond7: (slave erspan0): making interface the new active one [ 399.632992][T15106] bond7: (slave erspan0): Enslaving as an active interface with an up link [ 399.680823][T15115] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2484'. [ 399.690364][T15115] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2484'. [ 399.760963][T15114] 8021q: adding VLAN 0 to HW filter on device ipvlan2 [ 399.819387][T15122] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 399.835643][T15124] netlink: 48 bytes leftover after parsing attributes in process `syz.3.2487'. [ 399.846007][T15122] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2486'. [ 399.879031][T15124] netlink: 40 bytes leftover after parsing attributes in process `syz.3.2487'. [ 400.046534][T15135] netlink: 48 bytes leftover after parsing attributes in process `syz.3.2490'. [ 400.081661][T15135] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2490'. [ 400.088297][T15097] wg1 speed is unknown, defaulting to 1000 [ 400.100864][T15135] bridge_slave_1: left allmulticast mode [ 400.112602][T15135] bridge_slave_1: left promiscuous mode [ 400.131414][T15135] bridge0: port 2(bridge_slave_1) entered disabled state [ 400.156901][T15135] bridge_slave_0: left allmulticast mode [ 400.163440][T15135] bridge_slave_0: left promiscuous mode [ 400.170315][T15135] bridge0: port 1(bridge_slave_0) entered disabled state [ 400.221698][T15135] bridge0 (unregistering): left promiscuous mode [ 400.232221][T15135] team0: Port device bridge0 removed [ 400.412645][T15134] ip6_vti0 speed is unknown, defaulting to 1000 [ 400.532970][T15145] bond8: option arp_validate: mode dependency failed, not supported in mode 802.3ad(4) [ 400.551688][T15145] bond8 (unregistering): Released all slaves [ 400.982977][T15138] ip6_vti0 speed is unknown, defaulting to 1000 [ 401.501464][T15138] wg1 speed is unknown, defaulting to 1000 [ 401.532162][T15134] wg1 speed is unknown, defaulting to 1000 [ 402.174571][T15180] ip6_vti0 speed is unknown, defaulting to 1000 [ 402.451471][T15186] ip6_vti0 speed is unknown, defaulting to 1000 [ 402.510149][T15189] x_tables: duplicate underflow at hook 1 [ 402.549728][T15189] xt_cgroup: path and classid specified [ 402.945887][T15180] wg1 speed is unknown, defaulting to 1000 [ 402.983727][T15186] wg1 speed is unknown, defaulting to 1000 [ 403.868294][T15224] dvmrp0: entered allmulticast mode [ 403.903124][T15227] netlink: 'syz.1.2518': attribute type 3 has an invalid length. [ 403.989929][T15231] x_tables: ip_tables: osf match: only valid for protocol 6 [ 404.223962][T15244] netlink: 'syz.2.2523': attribute type 13 has an invalid length. [ 404.232478][T15244] netlink: 'syz.2.2523': attribute type 17 has an invalid length. [ 404.255166][T15244] erspan0: left allmulticast mode [ 404.288001][T15244] 8021q: adding VLAN 0 to HW filter on device team0 [ 404.335450][T15248] __nla_validate_parse: 12 callbacks suppressed [ 404.335465][T15248] netlink: 20 bytes leftover after parsing attributes in process `syz.4.2524'. [ 404.381155][T15244] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 404.398979][T15248] netlink: 32 bytes leftover after parsing attributes in process `syz.4.2524'. [ 404.621192][T15260] bond0: (slave erspan0): Error: Device type is different from other slaves [ 404.720274][T15261] ip6_vti0 speed is unknown, defaulting to 1000 [ 404.774031][T15273] bond0: Device is already in use. [ 404.838149][T15270] netlink: 19 bytes leftover after parsing attributes in process `syz.4.2527'. [ 405.177783][T15261] wg1 speed is unknown, defaulting to 1000 [ 405.192240][T15269] ip6_vti0 speed is unknown, defaulting to 1000 [ 405.547572][T15278] ip6_vti0 speed is unknown, defaulting to 1000 [ 405.553949][T15269] wg1 speed is unknown, defaulting to 1000 [ 405.633402][T15288] netlink: 20 bytes leftover after parsing attributes in process `syz.1.2533'. [ 405.650568][T15288] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2533'. [ 405.982027][T15283] ip6_vti0 speed is unknown, defaulting to 1000 [ 406.176051][T15283] wg1 speed is unknown, defaulting to 1000 [ 406.198501][T15304] ip6_vti0 speed is unknown, defaulting to 1000 [ 406.204951][T15278] wg1 speed is unknown, defaulting to 1000 [ 407.030082][T15316] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 407.158642][T15304] wg1 speed is unknown, defaulting to 1000 [ 407.469886][T15329] xt_TPROXY: Can be used only with -p tcp or -p udp [ 407.568638][T15333] netlink: 148 bytes leftover after parsing attributes in process `syz.0.2543'. [ 407.607109][T15333] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2543'. [ 407.640196][T15333] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2543'. [ 408.528182][T15359] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2548'. [ 408.824840][T15371] netlink: 'syz.2.2554': attribute type 12 has an invalid length. [ 409.066050][T15385] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2553'. [ 409.075334][ T1142] netdevsim netdevsim1 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 409.090765][ T1142] netdevsim netdevsim1 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 409.122049][ T1142] netdevsim netdevsim1 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 409.131002][ T1142] netdevsim netdevsim1 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 409.267585][T15396] mac80211_hwsim hwsim6 syzkaller0: entered promiscuous mode [ 409.285402][T15396] mac80211_hwsim hwsim6 syzkaller0: entered allmulticast mode [ 409.367650][T15403] netlink: 'syz.3.2559': attribute type 4 has an invalid length. [ 409.379430][T15403] netlink: 'syz.3.2559': attribute type 4 has an invalid length. [ 409.393596][T15400] tipc: Enabled bearer , priority 0 [ 409.401227][T15400] syzkaller0: entered promiscuous mode [ 409.406721][T15400] syzkaller0: entered allmulticast mode [ 409.502705][T15402] tipc: Enabling not permitted [ 409.526971][T15402] tipc: Enabling of bearer rejected, failed to enable media [ 409.549216][T15399] tipc: Resetting bearer [ 409.597351][T15399] tipc: Disabling bearer [ 409.637991][T15416] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2566'. [ 409.802262][T15432] netlink: 64 bytes leftover after parsing attributes in process `syz.2.2569'. [ 409.814436][T15432] block nbd0: not configured, cannot reconfigure [ 410.197298][T15440] netlink: 72 bytes leftover after parsing attributes in process `syz.0.2572'. [ 410.226078][T15441] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2573'. [ 410.303680][T15453] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2576'. [ 410.506460][T15460] x_tables: duplicate underflow at hook 2 [ 411.085480][T15491] bond6: option lacp_active: mode dependency failed, not supported in mode balance-rr(0) [ 411.139136][T15491] bond6 (unregistering): Released all slaves [ 411.147232][T15500] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2584'. [ 411.241142][T15484] ip6_vti0 speed is unknown, defaulting to 1000 [ 411.348927][T15508] netlink: 48 bytes leftover after parsing attributes in process `syz.2.2587'. [ 411.459641][T15513] netlink: 20 bytes leftover after parsing attributes in process `syz.4.2589'. [ 411.476339][T15512] Set syz1 is full, maxelem 9 reached [ 411.662166][T15484] wg1 speed is unknown, defaulting to 1000 [ 412.037974][T15535] tipc: Enabled bearer , priority 0 [ 412.097983][T15535] syzkaller0: Caught tx_queue_len zero misconfig [ 412.121017][T15535] tipc: Resetting bearer [ 412.412134][T15544] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2598'. [ 412.459048][T15536] syzkaller1: entered promiscuous mode [ 412.464730][T15536] syzkaller1: entered allmulticast mode [ 412.552192][T15553] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2600'. [ 413.111030][ T9] tipc: Node number set to 4157579625 [ 413.279267][T15583] tun0: tun_chr_ioctl cmd 1074025675 [ 413.295775][T15583] tun0: persist disabled [ 413.590240][T15594] ip6_vti0 speed is unknown, defaulting to 1000 [ 413.695054][T15601] xt_NFQUEUE: number of queues (1024) out of range (got 66558) [ 414.106893][T15594] wg1 speed is unknown, defaulting to 1000 [ 414.666651][T15643] __nla_validate_parse: 4 callbacks suppressed [ 414.666670][T15643] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2621'. [ 415.115149][T15659] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2626'. [ 415.158330][T15659] netlink: 48 bytes leftover after parsing attributes in process `syz.4.2626'. [ 415.330610][T15655] ip6_vti0 speed is unknown, defaulting to 1000 [ 415.442764][T15669] Cannot find del_set index 4 as target [ 415.607758][T15680] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2634'. [ 415.640391][T15682] xt_HMARK: proto mask must be zero with L3 mode [ 415.668233][T15685] xt_HMARK: proto mask must be zero with L3 mode [ 415.702328][T15686] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2634'. [ 415.775433][T15655] wg1 speed is unknown, defaulting to 1000 [ 415.775433][T15662] ip6_vti0 speed is unknown, defaulting to 1000 [ 416.052866][T15695] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2637'. [ 416.300093][T15710] netlink: 6 bytes leftover after parsing attributes in process `syz.3.2640'. [ 416.319023][T15710] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 416.339231][T15662] wg1 speed is unknown, defaulting to 1000 [ 416.655895][T15728] netlink: 28 bytes leftover after parsing attributes in process `syz.3.2644'. [ 416.855017][T15735] netlink: 10 bytes leftover after parsing attributes in process `syz.4.2646'. [ 416.929420][T15734] ip6_vti0 speed is unknown, defaulting to 1000 [ 416.978093][T15739] ip6gre2: left promiscuous mode [ 416.998277][T15740] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2647'. [ 417.083703][T15740] hsr_slave_0: left promiscuous mode [ 417.093784][T15740] hsr_slave_1: left promiscuous mode [ 417.145320][T15743] bond8: (slave ip6gretap4): Enslaving as an active interface with an up link [ 417.300175][T15751] vlan0: entered allmulticast mode [ 417.334067][T15751] veth1: entered allmulticast mode [ 417.380213][T15734] wg1 speed is unknown, defaulting to 1000 [ 417.893984][T15776] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 418.075906][T15787] unsupported nlmsg_type 40 [ 418.129529][T15784] vlan0: entered promiscuous mode [ 418.135382][T15784] bond0: entered promiscuous mode [ 418.141763][T15784] vlan0: entered allmulticast mode [ 418.147027][T15784] bond0: entered allmulticast mode [ 418.561197][T15804] netlink: 'syz.4.2667': attribute type 10 has an invalid length. [ 418.883900][T15818] veth0: entered promiscuous mode [ 418.915026][T15817] veth0: left promiscuous mode [ 419.699248][T15846] netlink: 'syz.2.2681': attribute type 10 has an invalid length. [ 419.762454][T15847] ip6_vti0 speed is unknown, defaulting to 1000 [ 419.817525][T15855] __nla_validate_parse: 11 callbacks suppressed [ 419.817545][T15855] netlink: 20 bytes leftover after parsing attributes in process `syz.1.2680'. [ 419.881370][T15853] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2682'. [ 420.208406][T15874] netlink: 48 bytes leftover after parsing attributes in process `syz.4.2687'. [ 420.444385][T15847] wg1 speed is unknown, defaulting to 1000 [ 420.444447][T15849] ip6_vti0 speed is unknown, defaulting to 1000 [ 420.950674][T15919] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2694'. [ 420.966322][T15914] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2693'. [ 421.452362][T15849] wg1 speed is unknown, defaulting to 1000 [ 421.893514][T15929] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2700'. [ 421.902713][T15929] netlink: 24 bytes leftover after parsing attributes in process `syz.4.2700'. [ 422.776493][T15947] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2705'. [ 422.805806][T15949] netlink: 'syz.2.2706': attribute type 16 has an invalid length. [ 422.815494][T15949] netlink: 64138 bytes leftover after parsing attributes in process `syz.2.2706'. [ 422.838261][ T5834] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 422.852032][ T5834] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 422.859788][ T5834] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 422.886517][ T5834] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 422.894831][ T5834] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 423.008302][T15950] ip6_vti0 speed is unknown, defaulting to 1000 [ 423.522164][T15950] wg1 speed is unknown, defaulting to 1000 [ 423.544409][T15955] ip6_vti0 speed is unknown, defaulting to 1000 [ 423.619007][T15962] netlink: 360 bytes leftover after parsing attributes in process `syz.1.2710'. [ 424.169831][T15950] chnl_net:caif_netlink_parms(): no params data found [ 424.379439][T15955] wg1 speed is unknown, defaulting to 1000 [ 424.509312][T15950] bridge0: port 1(bridge_slave_0) entered blocking state [ 424.534759][T15950] bridge0: port 1(bridge_slave_0) entered disabled state [ 424.551306][T15950] bridge_slave_0: entered allmulticast mode [ 424.575485][T15950] bridge_slave_0: entered promiscuous mode [ 424.588867][T15950] bridge0: port 2(bridge_slave_1) entered blocking state [ 424.597496][T15950] bridge0: port 2(bridge_slave_1) entered disabled state [ 424.610029][T15950] bridge_slave_1: entered allmulticast mode [ 424.618828][T15950] bridge_slave_1: entered promiscuous mode [ 424.759603][T15950] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 424.799258][T15950] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 424.920261][T15997] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2715'. [ 424.950931][ T5834] Bluetooth: hci3: command tx timeout [ 425.095679][T15950] team0: Port device team_slave_0 added [ 425.124241][T15950] team0: Port device team_slave_1 added [ 425.363011][T16013] ieee802154 phy1 wpan1: encryption failed: -22 [ 425.385015][T15950] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 425.416790][T15950] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 425.509033][T15950] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 425.569485][T15950] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 425.592469][T15950] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 425.623290][T15950] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 425.654466][T16007] ip6_vti0 speed is unknown, defaulting to 1000 [ 425.907888][T15950] hsr_slave_0: entered promiscuous mode [ 425.924602][T15950] hsr_slave_1: entered promiscuous mode [ 425.937721][T15950] debugfs: 'hsr0' already exists in 'hsr' [ 425.950629][T15950] Cannot create hsr debugfs directory [ 426.199627][T16007] wg1 speed is unknown, defaulting to 1000 [ 426.352218][T16037] IPVS: set_ctl: invalid protocol: 22 224.0.0.1:20001 [ 426.421577][T16037] netlink: 'syz.4.2722': attribute type 4 has an invalid length. [ 426.466726][T16037] netlink: 'syz.4.2722': attribute type 4 has an invalid length. [ 426.537138][T16039] netlink: 'syz.0.2723': attribute type 4 has an invalid length. [ 426.587895][T16039] netlink: 'syz.0.2723': attribute type 4 has an invalid length. [ 426.839817][T15950] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 426.855631][T15950] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 426.878636][T15950] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 426.893826][T15950] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 426.904563][T16044] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2725'. [ 427.010201][T15950] 8021q: adding VLAN 0 to HW filter on device bond0 [ 427.033359][ T5834] Bluetooth: hci3: command tx timeout [ 427.039043][T16056] netlink: 'syz.1.2726': attribute type 23 has an invalid length. [ 427.076935][T15950] 8021q: adding VLAN 0 to HW filter on device team0 [ 427.092985][T15834] bridge0: port 1(bridge_slave_0) entered blocking state [ 427.100205][T15834] bridge0: port 1(bridge_slave_0) entered forwarding state [ 427.119953][T15834] bridge0: port 2(bridge_slave_1) entered blocking state [ 427.127125][T15834] bridge0: port 2(bridge_slave_1) entered forwarding state [ 427.262778][T16068] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2730'. [ 427.443785][T16079] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2728'. [ 428.059599][T15950] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 428.192261][T15950] veth0_vlan: entered promiscuous mode [ 428.212652][T15950] veth1_vlan: entered promiscuous mode [ 428.230371][ T30] audit: type=1800 audit(1763458072.320:4): pid=16089 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.2736" name=CB dev="tmpfs" ino=2654 res=0 errno=0 [ 428.313983][T15950] veth0_macvtap: entered promiscuous mode [ 428.339272][T15950] veth1_macvtap: entered promiscuous mode [ 428.395861][T15950] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 428.426130][T15950] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 428.458531][ T1142] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 428.469961][ T1142] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 428.511132][ T1142] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 428.520262][ T1142] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 428.698962][T16106] netlink: 'syz.1.2740': attribute type 12 has an invalid length. [ 428.922997][T16110] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2743'. [ 428.952023][ T1142] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 428.967225][ T1142] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 428.991139][T16110] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2743'. [ 429.019343][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 429.021351][T16112] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2744'. [ 429.040740][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 429.110773][ T5834] Bluetooth: hci3: command tx timeout [ 429.183844][T16124] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2747'. [ 429.295688][T16124] netlink: 24 bytes leftover after parsing attributes in process `syz.1.2747'. [ 429.324713][T16127] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2747'. [ 429.344433][T16132] tipc: Enabling of bearer rejected, already enabled [ 429.575916][T16151] ip6_vti0 speed is unknown, defaulting to 1000 [ 429.797203][T16156] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 429.822299][ T9] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 429.914458][T16159] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 429.940645][ T5922] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 430.079564][T16168] netlink: 'syz.4.2759': attribute type 11 has an invalid length. [ 430.097935][T16168] netlink: 199820 bytes leftover after parsing attributes in process `syz.4.2759'. [ 430.121402][T16171] tipc: Enabling of bearer rejected, already enabled [ 430.249089][T16175] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2762'. [ 430.306884][T16151] wg1 speed is unknown, defaulting to 1000 [ 430.375035][ T5922] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 430.552441][T16189] netlink: 72 bytes leftover after parsing attributes in process `syz.4.2764'. [ 431.241859][ T5834] Bluetooth: hci3: command tx timeout [ 431.499479][T16208] ip6_vti0 speed is unknown, defaulting to 1000 [ 431.657629][T16221] tipc: Enabled bearer , priority 0 [ 431.901581][T16221] syzkaller0: entered promiscuous mode [ 431.933921][T16221] syzkaller0: entered allmulticast mode [ 431.960634][T16221] tipc: Resetting bearer [ 431.998515][T16220] tipc: Resetting bearer [ 432.187422][T16248] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2779'. [ 433.475097][T16220] tipc: Disabling bearer [ 433.486864][T16208] wg1 speed is unknown, defaulting to 1000 [ 433.486899][T16211] ip6_vti0 speed is unknown, defaulting to 1000 [ 433.630088][T16259] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2781'. [ 433.808671][T16247] ip6_vti0 speed is unknown, defaulting to 1000 [ 433.950684][T16270] netlink: 'syz.2.2784': attribute type 10 has an invalid length. [ 433.972002][T16270] netlink: 2 bytes leftover after parsing attributes in process `syz.2.2784'. [ 433.990502][T16270] team0: entered promiscuous mode [ 434.002991][T16270] bridge0: port 1(team0) entered blocking state [ 434.019719][T16270] bridge0: port 1(team0) entered disabled state [ 434.029960][T16270] team0: entered allmulticast mode [ 434.040306][T16261] ip6_vti0 speed is unknown, defaulting to 1000 [ 434.274910][T16261] wg1 speed is unknown, defaulting to 1000 [ 434.330873][T16211] wg1 speed is unknown, defaulting to 1000 [ 434.358000][T16247] wg1 speed is unknown, defaulting to 1000 [ 434.914335][T16275] bridge: RTM_NEWNEIGH with invalid ether address [ 435.982575][T16291] tipc: Started in network mode [ 435.989880][T16296] netlink: 200 bytes leftover after parsing attributes in process `syz.1.2794'. [ 435.997735][T16291] tipc: Node identity 5e5b3f85a59c, cluster identity 4711 [ 436.003250][T16296] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2794'. [ 436.021361][T16291] tipc: Enabled bearer , priority 0 [ 436.047479][T16291] syzkaller0: entered promiscuous mode [ 436.080964][T16291] syzkaller0: entered allmulticast mode [ 436.162445][T16291] tipc: Resetting bearer [ 436.182993][T16305] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2792'. [ 436.250656][T16288] tipc: Resetting bearer [ 436.290043][T16288] tipc: Disabling bearer [ 436.437700][T16298] ip6_vti0 speed is unknown, defaulting to 1000 [ 436.587013][T16322] team0: Port device dummy0 removed [ 436.773036][T16316] bond5 (unregistering): Released all slaves [ 437.088766][T16337] netlink: 20 bytes leftover after parsing attributes in process `syz.3.2803'. [ 437.092084][T16298] wg1 speed is unknown, defaulting to 1000 [ 437.136628][T16315] ip6_vti0 speed is unknown, defaulting to 1000 [ 437.547920][T16358] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2809'. [ 437.741838][T16366] netlink: 24 bytes leftover after parsing attributes in process `syz.1.2813'. [ 437.753610][T16315] wg1 speed is unknown, defaulting to 1000 [ 437.893821][T16366] tap0: tun_chr_ioctl cmd 35111 [ 437.899501][T16367] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2811'. [ 438.634319][T16388] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2816'. [ 438.687955][T16386] ip6_vti0 speed is unknown, defaulting to 1000 [ 439.017849][T16395] netlink: 88 bytes leftover after parsing attributes in process `syz.4.2819'. [ 439.424740][T16406] netlink: 56 bytes leftover after parsing attributes in process `syz.1.2823'. [ 439.617906][T16399] ip6_vti0 speed is unknown, defaulting to 1000 [ 439.628714][T16414] tipc: Enabling of bearer rejected, already enabled [ 439.671583][T16386] wg1 speed is unknown, defaulting to 1000 [ 439.906790][T16426] netlink: 'syz.0.2826': attribute type 9 has an invalid length. [ 439.921077][ T1300] aoe: packet could not be sent on bond0. consider increasing tx_queue_len [ 439.930138][ T1300] ieee802154 phy1 wpan1: encryption failed: -22 [ 439.939339][T16426] netlink: 'syz.0.2826': attribute type 9 has an invalid length. [ 440.019596][T16426] netdevsim netdevsim0 eth3 (unregistering): unset [1, 0] type 2 family 0 port 20000 - 0 [ 440.303159][ T1315] bond2 (unregistering): (slave erspan0): Releasing active interface [ 440.317081][ T1315] bond2 (unregistering): (slave erspan0): the permanent HWaddr of slave - aa:aa:aa:aa:aa:16 - is still in use by bond - set the HWaddr of slave to a different address to avoid conflicts [ 440.581902][ T1315] bond7 (unregistering): (slave bridge5): Releasing active interface [ 440.774159][ T1315] bond0 (unregistering): left promiscuous mode [ 440.780524][ T1315] bond_slave_0: left promiscuous mode [ 440.786130][ T1315] bond_slave_1: left promiscuous mode [ 440.791931][ T1315] team0: left promiscuous mode [ 440.796726][ T1315] team_slave_0: left promiscuous mode [ 440.802624][ T1315] team_slave_1: left promiscuous mode [ 440.810857][ T1315] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 440.821514][ T1315] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 440.832922][ T1315] bond0 (unregistering): (slave team0): Releasing backup interface [ 440.841806][ T1315] bond0 (unregistering): Released all slaves [ 440.856671][ T1315] bond1 (unregistering): (slave vcan1): Releasing backup interface [ 440.866664][ T1315] bond1 (unregistering): (slave vcan2): Releasing backup interface [ 440.877738][ T1315] bond1 (unregistering): Released all slaves [ 440.966095][ T1315] bond2 (unregistering): (slave veth5): Releasing active interface [ 440.974961][ T1315] bond2 (unregistering): Released all slaves [ 441.062736][ T1315] bond3 (unregistering): Released all slaves [ 441.077234][ T1315] bond4 (unregistering): Released all slaves [ 441.162893][ T1315] bond5 (unregistering): Released all slaves [ 441.178184][ T1315] bond6 (unregistering): Released all slaves [ 441.192323][ T1315] bond7 (unregistering): Released all slaves [ 441.209420][T16426] netdevsim netdevsim0 eth2 (unregistering): unset [1, 0] type 2 family 0 port 20000 - 0 [ 441.227071][T16399] wg1 speed is unknown, defaulting to 1000 [ 441.227124][T16406] ip6_vti0 speed is unknown, defaulting to 1000 [ 441.308425][T16426] netdevsim netdevsim0 eth1 (unregistering): unset [1, 0] type 2 family 0 port 20000 - 0 [ 441.336448][ T1315] tipc: Left network mode [ 441.417282][T16426] netdevsim netdevsim0 eth0 (unregistering): unset [1, 0] type 2 family 0 port 20000 - 0 [ 441.609309][T16406] wg1 speed is unknown, defaulting to 1000 [ 442.652080][T16453] ip6_vti0 speed is unknown, defaulting to 1000 [ 442.859014][T16470] __nla_validate_parse: 3 callbacks suppressed [ 442.859046][T16470] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2835'. [ 442.923039][T16472] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2835'. [ 443.379859][T16453] wg1 speed is unknown, defaulting to 1000 [ 443.648695][T16488] netlink: 1 bytes leftover after parsing attributes in process `syz.1.2840'. [ 443.864559][T16489] ip6_vti0 speed is unknown, defaulting to 1000 [ 443.902459][ T1315] batadv0: left promiscuous mode [ 443.952428][ T1315] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 443.961865][T16495] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2838'. [ 443.994078][ T1315] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 444.487330][T16512] netlink: 24 bytes leftover after parsing attributes in process `syz.1.2844'. [ 444.646084][ T1315] team0 (unregistering): Port device team_slave_1 removed [ 444.679447][ T1315] team0 (unregistering): Port device team_slave_0 removed [ 444.995440][T16489] wg1 speed is unknown, defaulting to 1000 [ 445.258179][T16517] netlink: 40 bytes leftover after parsing attributes in process `syz.1.2846'. [ 445.326970][T16521] ip6_vti0 speed is unknown, defaulting to 1000 [ 445.392752][T16526] IPVS: set_ctl: invalid protocol: 103 100.1.1.2:20003 [ 445.792781][T16521] wg1 speed is unknown, defaulting to 1000 [ 446.422193][T16548] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2854'. [ 446.787453][T16559] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 446.797014][T16558] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 447.169715][T16582] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2858'. [ 447.195039][T16580] netlink: 'syz.0.2862': attribute type 11 has an invalid length. [ 447.595302][T16587] Bluetooth: MGMT ver 1.23 [ 447.942646][T16616] netlink: 'syz.3.2869': attribute type 13 has an invalid length. [ 447.975972][T16616] netlink: 'syz.3.2869': attribute type 17 has an invalid length. [ 448.014953][T16611] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2870'. [ 448.270796][T16616] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 448.438016][T16619] ip6_vti0 speed is unknown, defaulting to 1000 [ 448.713781][T16633] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2874'. [ 448.921434][T16633] 8021q: adding VLAN 0 to HW filter on device bond9 [ 448.989917][T16624] ip6_vti0 speed is unknown, defaulting to 1000 [ 448.989917][T16619] wg1 speed is unknown, defaulting to 1000 [ 449.260589][ T52] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 449.269537][ T52] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 449.297568][ T52] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 449.306432][ T52] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 449.315327][ T52] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 449.486389][T16624] wg1 speed is unknown, defaulting to 1000 [ 449.587708][T16642] ip6_vti0 speed is unknown, defaulting to 1000 [ 450.048229][T16642] wg1 speed is unknown, defaulting to 1000 [ 450.065333][T16655] ip6_vti0 speed is unknown, defaulting to 1000 [ 450.151283][ C0] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 450.320085][T16668] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2882'. [ 450.717581][T16655] wg1 speed is unknown, defaulting to 1000 [ 450.739468][T16642] chnl_net:caif_netlink_parms(): no params data found [ 450.915921][T16689] netlink: 208 bytes leftover after parsing attributes in process `syz.4.2886'. [ 451.054663][T16695] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2887'. [ 451.289786][T16642] bridge0: port 1(bridge_slave_0) entered blocking state [ 451.362120][ T5834] Bluetooth: hci4: command tx timeout [ 451.405670][T16642] bridge0: port 1(bridge_slave_0) entered disabled state [ 451.418745][T16642] bridge_slave_0: entered allmulticast mode [ 451.438175][T16642] bridge_slave_0: entered promiscuous mode [ 451.459235][T16642] bridge0: port 2(bridge_slave_1) entered blocking state [ 451.473064][T16642] bridge0: port 2(bridge_slave_1) entered disabled state [ 451.488204][T16642] bridge_slave_1: entered allmulticast mode [ 451.508736][T16642] bridge_slave_1: entered promiscuous mode [ 451.630383][T16642] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 451.687430][T16642] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 451.708313][T16699] netlink: 'syz.2.2890': attribute type 16 has an invalid length. [ 451.795831][T16642] team0: Port device team_slave_0 added [ 451.814627][T16642] team0: Port device team_slave_1 added [ 451.849573][T16709] No such timeout policy "syz1" [ 451.963734][T16642] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 451.983233][T16642] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 452.035680][T16642] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 452.065164][T16642] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 452.072647][T16642] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 452.131320][T16642] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 452.212328][T16720] netlink: 68 bytes leftover after parsing attributes in process `syz.3.2896'. [ 452.376635][T16642] hsr_slave_0: entered promiscuous mode [ 452.389872][T16642] hsr_slave_1: entered promiscuous mode [ 452.400187][T16642] debugfs: 'hsr0' already exists in 'hsr' [ 452.406943][T16642] Cannot create hsr debugfs directory [ 452.412772][T16729] lo: entered promiscuous mode [ 452.417636][T16729] lo: entered allmulticast mode [ 452.585150][ T9] IPVS: starting estimator thread 0... [ 452.690687][T16737] IPVS: using max 26 ests per chain, 62400 per kthread [ 452.717399][T16740] dvmrp1: tun_chr_ioctl cmd 1074812118 [ 452.736380][T16739] netlink: 'syz.3.2902': attribute type 13 has an invalid length. [ 452.755088][T16740] netlink: 'syz.3.2902': attribute type 13 has an invalid length. [ 452.770884][T16739] netlink: 52 bytes leftover after parsing attributes in process `syz.3.2902'. [ 452.801488][T16740] netlink: 52 bytes leftover after parsing attributes in process `syz.3.2902'. [ 452.805172][T16744] xt_policy: neither incoming nor outgoing policy selected [ 452.818873][T16739] lo: left promiscuous mode [ 452.826420][T16739] lo: left allmulticast mode [ 452.906169][T16642] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 452.919418][T16642] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 452.965531][T16642] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 452.996264][T16642] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 453.037411][T16754] netlink: 7016 bytes leftover after parsing attributes in process `syz.3.2906'. [ 453.053021][T16754] openvswitch: netlink: Message has 8 unknown bytes. [ 453.069252][T16755] syzkaller0: entered promiscuous mode [ 453.074960][T16755] syzkaller0: entered allmulticast mode [ 453.084446][T16755] sctp: [Deprecated]: syz.1.2905 (pid 16755) Use of struct sctp_assoc_value in delayed_ack socket option. [ 453.084446][T16755] Use struct sctp_sack_info instead [ 453.289860][T16767] bond7: (slave erspan0): Releasing active interface [ 453.300076][T16765] netlink: 28 bytes leftover after parsing attributes in process `syz.3.2908'. [ 453.336483][T16767] team0: left allmulticast mode [ 453.341695][T16767] bridge0: port 1(team0) entered disabled state [ 453.380978][T16767] bond0: (slave geneve0): Releasing active interface [ 453.402085][T16767] bond8: (slave ip6gretap4): Releasing backup interface [ 453.430743][ T5834] Bluetooth: hci4: command tx timeout [ 453.447448][T16642] 8021q: adding VLAN 0 to HW filter on device bond0 [ 453.470239][T16642] 8021q: adding VLAN 0 to HW filter on device team0 [ 453.488724][ T49] bridge0: port 1(bridge_slave_0) entered blocking state [ 453.495943][ T49] bridge0: port 1(bridge_slave_0) entered forwarding state [ 453.534873][ T1142] bridge0: port 2(bridge_slave_1) entered blocking state [ 453.542044][ T1142] bridge0: port 2(bridge_slave_1) entered forwarding state [ 453.814477][T16793] netlink: 28 bytes leftover after parsing attributes in process `syz.3.2914'. [ 453.840916][T16793] netlink: 28 bytes leftover after parsing attributes in process `syz.3.2914'. [ 453.894026][T16799] netlink: 36 bytes leftover after parsing attributes in process `syz.4.2916'. [ 453.932537][T16803] x_tables: ip6_tables: mh match: only valid for protocol 135 [ 454.052519][T16812] ip6_vti0 speed is unknown, defaulting to 1000 [ 454.238251][T16642] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 454.330219][T16642] veth0_vlan: entered promiscuous mode [ 454.361309][T16642] veth1_vlan: entered promiscuous mode [ 454.407697][T16642] veth0_macvtap: entered promiscuous mode [ 454.418867][T16642] veth1_macvtap: entered promiscuous mode [ 454.449758][T16642] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 454.474127][T16642] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 454.492407][T16812] wg1 speed is unknown, defaulting to 1000 [ 454.503717][ T1142] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 454.512728][ T1142] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 454.538566][ T1142] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 454.547745][ T1142] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 454.716354][ T1315] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 454.739445][ T1315] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 454.773015][ T1315] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 454.781589][ T1315] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 454.866963][T16831] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2924'. [ 454.877185][T16831] netlink: 32 bytes leftover after parsing attributes in process `syz.1.2924'. [ 454.886282][T16831] netlink: 32 bytes leftover after parsing attributes in process `syz.1.2924'. [ 454.988028][T16836] syz_tun: entered allmulticast mode [ 454.998337][T16831] netlink: 32 bytes leftover after parsing attributes in process `syz.1.2924'. [ 455.000833][T16838] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2923'. [ 455.520565][ T5834] Bluetooth: hci4: command tx timeout [ 455.640959][T16858] netlink: 'syz.1.2929': attribute type 4 has an invalid length. [ 455.694739][T16865] A link change request failed with some changes committed already. Interface bond0 may have been left with an inconsistent configuration, please check. [ 455.817740][T16835] syz_tun: left allmulticast mode [ 456.481282][T16895] 8021q: adding VLAN 0 to HW filter on device bond5 [ 456.611554][T16900] bond5: (slave lo): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 456.654056][T16900] 8021q: adding VLAN 0 to HW filter on device bond5 [ 456.684065][T16900] bond5: (slave lo): Enslaving as an active interface with an up link [ 457.028474][T16895] bond5 (unregistering): (slave lo): Releasing backup interface [ 457.037360][T16895] bond5 (unregistering): (slave lo): last VLAN challenged slave left bond - VLAN blocking is removed [ 457.061803][T16895] bond5 (unregistering): Released all slaves [ 457.298481][T16923] ip6_vti0 speed is unknown, defaulting to 1000 [ 457.478609][T16930] nbd: device at index 64 is going down [ 457.591764][ T5834] Bluetooth: hci4: command tx timeout [ 457.907124][T16923] wg1 speed is unknown, defaulting to 1000 [ 458.167542][ C1] vcan0: j1939_tp_rxtimer: 0xffff88807e395400: rx timeout, send abort [ 458.176063][ C1] vcan0: j1939_xtp_rx_abort_one: 0xffff88807e395400: 0x2f000: (3) A timeout occurred and this is the connection abort to close the session. [ 458.860010][T16963] __nla_validate_parse: 9 callbacks suppressed [ 458.860029][T16963] netlink: 464 bytes leftover after parsing attributes in process `syz.1.2956'. [ 458.911035][T16967] xt_socket: unknown flags 0x50 [ 459.131335][T16975] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2961'. [ 459.219925][T16975] netlink: 'syz.1.2961': attribute type 2 has an invalid length. [ 459.246479][T16986] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 459.253796][T16986] IPv6: NLM_F_CREATE should be set when creating new route [ 459.261064][T16986] IPv6: NLM_F_CREATE should be set when creating new route [ 459.429730][T16975] ip6_vti0 speed is unknown, defaulting to 1000 [ 459.531955][T17003] netlink: 44 bytes leftover after parsing attributes in process `syz.0.2967'. [ 459.636581][T17009] netlink: 'syz.3.2970': attribute type 2 has an invalid length. [ 459.857509][T17014] netlink: 16 bytes leftover after parsing attributes in process `syz.0.2969'. [ 459.981780][T17023] IPv6: sit3: Disabled Multicast RS [ 460.185081][T16975] wg1 speed is unknown, defaulting to 1000 [ 460.185173][T17011] ip6_vti0 speed is unknown, defaulting to 1000 [ 460.405244][T17033] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2974'. [ 460.676636][T17011] wg1 speed is unknown, defaulting to 1000 [ 460.986528][T17048] ip6_vti0 speed is unknown, defaulting to 1000 [ 461.127972][T17058] netlink: 44 bytes leftover after parsing attributes in process `syz.2.2979'. [ 461.465570][T17049] ip6_vti0 speed is unknown, defaulting to 1000 [ 461.764522][T17044] ip6_vti0 speed is unknown, defaulting to 1000 [ 462.057337][T17044] wg1 speed is unknown, defaulting to 1000 [ 462.134783][T17049] wg1 speed is unknown, defaulting to 1000 [ 462.202772][T17088] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2986'. [ 462.235397][T17048] wg1 speed is unknown, defaulting to 1000 [ 462.833890][T17099] netlink: 44 bytes leftover after parsing attributes in process `syz.2.2990'. [ 462.991736][T17105] netlink: 'syz.2.2992': attribute type 12 has an invalid length. [ 462.999683][T17105] netlink: 132 bytes leftover after parsing attributes in process `syz.2.2992'. [ 463.498766][T17120] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2995'. [ 463.685174][T17135] netlink: 'syz.4.2999': attribute type 8 has an invalid length. [ 463.825255][T17139] syzkaller0: entered promiscuous mode [ 463.842122][T17139] syzkaller0: entered allmulticast mode [ 464.205829][T17151] __nla_validate_parse: 3 callbacks suppressed [ 464.205847][T17151] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3005'. [ 464.239510][T17151] netlink: 'syz.2.3005': attribute type 1 has an invalid length. [ 464.342173][T17160] netlink: 20 bytes leftover after parsing attributes in process `syz.2.3005'. [ 464.360951][T17160] x_tables: (null)_tables: SNAT target: only valid in nat table, not syz0 [ 464.386046][T17159] ip6_vti0 speed is unknown, defaulting to 1000 [ 465.215341][T17159] wg1 speed is unknown, defaulting to 1000 [ 465.300664][T17210] FAULT_INJECTION: forcing a failure. [ 465.300664][T17210] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 465.314097][T17210] CPU: 1 UID: 0 PID: 17210 Comm: syz.2.3021 Not tainted syzkaller #0 PREEMPT(full) [ 465.314123][T17210] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 465.314141][T17210] Call Trace: [ 465.314148][T17210] [ 465.314157][T17210] dump_stack_lvl+0x189/0x250 [ 465.314191][T17210] ? __pfx____ratelimit+0x10/0x10 [ 465.314223][T17210] ? __pfx_dump_stack_lvl+0x10/0x10 [ 465.314251][T17210] ? __pfx__printk+0x10/0x10 [ 465.314288][T17210] should_fail_ex+0x414/0x560 [ 465.314337][T17210] _copy_from_user+0x2d/0xb0 [ 465.314362][T17210] __copy_msghdr+0x3c5/0x5b0 [ 465.314389][T17210] ___sys_sendmsg+0x1a5/0x2a0 [ 465.314414][T17210] ? __pfx____sys_sendmsg+0x10/0x10 [ 465.314474][T17210] ? __fget_files+0x2a/0x420 [ 465.314491][T17210] ? __fget_files+0x3a0/0x420 [ 465.314520][T17210] __sys_sendmmsg+0x227/0x430 [ 465.314547][T17210] ? __pfx___sys_sendmmsg+0x10/0x10 [ 465.314580][T17210] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 465.314619][T17210] ? ksys_write+0x22a/0x250 [ 465.314649][T17210] ? __pfx_ksys_write+0x10/0x10 [ 465.314681][T17210] __x64_sys_sendmmsg+0xa0/0xc0 [ 465.314705][T17210] do_syscall_64+0xfa/0xfa0 [ 465.314722][T17210] ? lockdep_hardirqs_on+0x9c/0x150 [ 465.314740][T17210] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 465.314760][T17210] ? clear_bhb_loop+0x60/0xb0 [ 465.314783][T17210] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 465.314811][T17210] RIP: 0033:0x7fb013b8f6c9 [ 465.314828][T17210] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 465.314844][T17210] RSP: 002b:00007fb014a9c038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 465.314864][T17210] RAX: ffffffffffffffda RBX: 00007fb013de5fa0 RCX: 00007fb013b8f6c9 [ 465.314878][T17210] RDX: 0000000000000002 RSI: 0000200000000240 RDI: 0000000000000004 [ 465.314890][T17210] RBP: 00007fb014a9c090 R08: 0000000000000000 R09: 0000000000000000 [ 465.314901][T17210] R10: 0000000004004040 R11: 0000000000000246 R12: 0000000000000001 [ 465.314912][T17210] R13: 00007fb013de6038 R14: 00007fb013de5fa0 R15: 00007ffc64b096c8 [ 465.314945][T17210] [ 465.621454][T17203] netlink: 20 bytes leftover after parsing attributes in process `syz.1.3018'. [ 465.846091][T17216] ip6_vti0 speed is unknown, defaulting to 1000 [ 466.359413][T17244] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3029'. [ 466.361760][T17232] ip6_vti0 speed is unknown, defaulting to 1000 [ 466.375154][T17216] wg1 speed is unknown, defaulting to 1000 [ 466.857887][T17234] ip6_vti0 speed is unknown, defaulting to 1000 [ 467.050762][T17244] ip6_vti0 speed is unknown, defaulting to 1000 [ 467.197689][T17232] wg1 speed is unknown, defaulting to 1000 [ 467.210700][T17244] wg1 speed is unknown, defaulting to 1000 [ 467.285299][T17234] wg1 speed is unknown, defaulting to 1000 [ 467.494200][T17270] FAULT_INJECTION: forcing a failure. [ 467.494200][T17270] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 467.516598][T17270] CPU: 1 UID: 0 PID: 17270 Comm: syz.3.3033 Not tainted syzkaller #0 PREEMPT(full) [ 467.516626][T17270] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 467.516639][T17270] Call Trace: [ 467.516648][T17270] [ 467.516657][T17270] dump_stack_lvl+0x189/0x250 [ 467.516691][T17270] ? __pfx____ratelimit+0x10/0x10 [ 467.516724][T17270] ? __pfx_dump_stack_lvl+0x10/0x10 [ 467.516753][T17270] ? __pfx__printk+0x10/0x10 [ 467.516789][T17270] should_fail_ex+0x414/0x560 [ 467.516828][T17270] _copy_to_user+0x31/0xb0 [ 467.516857][T17270] simple_read_from_buffer+0xe1/0x170 [ 467.516896][T17270] proc_fail_nth_read+0x1b3/0x220 [ 467.516927][T17270] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 467.516958][T17270] ? rw_verify_area+0x2a6/0x4d0 [ 467.516986][T17270] ? __lock_acquire+0xab9/0xd20 [ 467.517004][T17270] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 467.517033][T17270] vfs_read+0x200/0xa30 [ 467.517061][T17270] ? fdget_pos+0x247/0x320 [ 467.517087][T17270] ? __pfx___mutex_lock+0x10/0x10 [ 467.517111][T17270] ? __pfx_vfs_read+0x10/0x10 [ 467.517141][T17270] ? __fget_files+0x2a/0x420 [ 467.517166][T17270] ? __fget_files+0x3a0/0x420 [ 467.517185][T17270] ? __fget_files+0x2a/0x420 [ 467.517216][T17270] ksys_read+0x145/0x250 [ 467.517248][T17270] ? __pfx_ksys_read+0x10/0x10 [ 467.517291][T17270] ? do_syscall_64+0xbe/0xfa0 [ 467.517316][T17270] do_syscall_64+0xfa/0xfa0 [ 467.517335][T17270] ? lockdep_hardirqs_on+0x9c/0x150 [ 467.517355][T17270] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 467.517376][T17270] ? clear_bhb_loop+0x60/0xb0 [ 467.517402][T17270] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 467.517422][T17270] RIP: 0033:0x7f543dd8e0dc [ 467.517440][T17270] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 467.517470][T17270] RSP: 002b:00007f543ec58030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 467.517491][T17270] RAX: ffffffffffffffda RBX: 00007f543dfe5fa0 RCX: 00007f543dd8e0dc [ 467.517506][T17270] RDX: 000000000000000f RSI: 00007f543ec580a0 RDI: 0000000000000005 [ 467.517519][T17270] RBP: 00007f543ec58090 R08: 0000000000000000 R09: 0000000000000000 [ 467.517531][T17270] R10: 0000000004004040 R11: 0000000000000246 R12: 0000000000000001 [ 467.517543][T17270] R13: 00007f543dfe6038 R14: 00007f543dfe5fa0 R15: 00007ffdd0626d38 [ 467.517579][T17270] [ 467.539861][T17269] netlink: 'syz.1.3034': attribute type 1 has an invalid length. [ 467.656353][T17274] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3035'. [ 468.179499][T17280] netlink: 120 bytes leftover after parsing attributes in process `syz.1.3038'. [ 468.205211][T17280] netlink: 120 bytes leftover after parsing attributes in process `syz.1.3038'. [ 468.237698][T17285] tipc: Enabled bearer , priority 0 [ 468.283870][T17283] syzkaller0: entered promiscuous mode [ 468.311240][T17283] syzkaller0: entered allmulticast mode [ 468.400643][T17283] bond0: (slave sit0): Error: Device type is different from other slaves [ 468.610976][T17282] tipc: Resetting bearer [ 468.690088][T17282] tipc: Disabling bearer [ 469.007556][T17303] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3044'. [ 469.062613][T17304] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3045'. [ 469.129813][T17304] batadv0: entered promiscuous mode [ 469.137000][T17304] macvtap1: entered allmulticast mode [ 469.142668][T17304] batadv0: entered allmulticast mode [ 469.149661][T17304] 8021q: adding VLAN 0 to HW filter on device macvtap1 [ 469.185973][T17304] batadv0: left allmulticast mode [ 469.191972][T17304] batadv0: left promiscuous mode [ 469.603192][T17312] netlink: 'syz.3.3048': attribute type 4 has an invalid length. [ 469.789491][ T52] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 469.799444][ T52] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 469.811692][ T52] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 469.826328][ T52] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 469.858605][ T52] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 470.084983][T17318] ip6_vti0 speed is unknown, defaulting to 1000 [ 470.183929][T17323] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3051'. [ 470.367965][T17323] bridge0: port 2(bridge_slave_1) entered disabled state [ 470.376464][T17323] bridge0: port 1(bridge_slave_0) entered disabled state [ 470.505475][T17318] wg1 speed is unknown, defaulting to 1000 [ 470.566353][T17342] smc: net device bond0 applied user defined pnetid SYZ0 [ 470.605273][T17344] smc: net device bond0 erased user defined pnetid SYZ0 [ 471.157117][T17351] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3057'. [ 471.336025][T17356] netlink: 'syz.1.3058': attribute type 10 has an invalid length. [ 471.347487][T17356] netlink: 40 bytes leftover after parsing attributes in process `syz.1.3058'. [ 471.481978][T17359] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3059'. [ 471.591102][ T3502] bond2 (unregistering): (slave ip6gretap1): Releasing backup interface [ 471.603735][ T3502] ip6gretap1 (unregistering): left allmulticast mode [ 471.955773][ T3502] bond1 (unregistering): (slave geneve2): Releasing active interface [ 471.990640][ T52] Bluetooth: hci0: command tx timeout [ 472.005854][ T3502] team0: Port device geneve0 removed [ 472.279272][ T3502] bond0 (unregistering): Released all slaves [ 472.294004][ T3502] bond1 (unregistering): Released all slaves [ 472.309033][ T3502] bond2 (unregistering): Released all slaves [ 472.416504][ T3502] bond3 (unregistering): Released all slaves [ 472.433082][ T3502] bond4 (unregistering): Released all slaves [ 472.460048][T17356] geneve0: entered promiscuous mode [ 472.466987][T17356] team0: Port device geneve0 added [ 472.522673][T17368] tipc: Enabled bearer , priority 0 [ 472.529548][T15834] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 472.572748][T15834] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 472.658146][T17368] tipc: Disabling bearer [ 472.705322][T15834] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 472.727499][T15834] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 472.736181][T17318] chnl_net:caif_netlink_parms(): no params data found [ 472.745582][T17377] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3065'. [ 472.758693][T17377] 8021q: VLANs not supported on vxcan1 [ 472.775047][T17374] team0: left promiscuous mode [ 472.783619][T17374] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 472.815285][T17374] ieee802154 phy1 wpan1: encryption failed: -90 [ 472.843092][T17379] netlink: 44 bytes leftover after parsing attributes in process `syz.3.3066'. [ 472.852942][T17379] netlink: 43 bytes leftover after parsing attributes in process `syz.3.3066'. [ 472.867634][T17379] netlink: 'syz.3.3066': attribute type 6 has an invalid length. [ 472.876096][T17379] netlink: 'syz.3.3066': attribute type 5 has an invalid length. [ 472.885107][T17379] netlink: 43 bytes leftover after parsing attributes in process `syz.3.3066'. [ 472.947130][T17384] netlink: 'syz.0.3067': attribute type 4 has an invalid length. [ 472.969232][T17384] netlink: 'syz.0.3067': attribute type 1 has an invalid length. [ 472.980496][T17384] netlink: 228 bytes leftover after parsing attributes in process `syz.0.3067'. [ 473.042064][T17318] bridge0: port 1(bridge_slave_0) entered blocking state [ 473.055337][T17318] bridge0: port 1(bridge_slave_0) entered disabled state [ 473.066033][T17318] bridge_slave_0: entered allmulticast mode [ 473.075137][T17318] bridge_slave_0: entered promiscuous mode [ 473.083681][T17386] bridge: RTM_NEWNEIGH bridge0 with NTF_USE is not supported [ 473.095086][T17318] bridge0: port 2(bridge_slave_1) entered blocking state [ 473.109618][T17388] netlink: 'syz.0.3069': attribute type 3 has an invalid length. [ 473.116056][T17318] bridge0: port 2(bridge_slave_1) entered disabled state [ 473.126432][T17318] bridge_slave_1: entered allmulticast mode [ 473.134940][T17318] bridge_slave_1: entered promiscuous mode [ 473.206926][T17318] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 473.237560][T17318] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 473.305331][T17318] team0: Port device team_slave_0 added [ 473.317766][T17318] team0: Port device team_slave_1 added [ 473.388476][T17409] netlink: 44 bytes leftover after parsing attributes in process `syz.3.3075'. [ 473.429449][T17318] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 473.437596][T17318] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 473.465164][T17318] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 473.500244][T17398] ip6_vti0 speed is unknown, defaulting to 1000 [ 473.529672][T17318] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 473.557132][T17318] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 473.605063][T17318] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 473.854204][T17398] wg1 speed is unknown, defaulting to 1000 [ 473.854754][T17407] ip6_vti0 speed is unknown, defaulting to 1000 [ 473.967782][T17318] hsr_slave_0: entered promiscuous mode [ 473.992663][T17318] hsr_slave_1: entered promiscuous mode [ 474.015260][T17318] debugfs: 'hsr0' already exists in 'hsr' [ 474.053006][T17318] Cannot create hsr debugfs directory [ 474.079287][ T52] Bluetooth: hci0: command tx timeout [ 474.282447][T17407] wg1 speed is unknown, defaulting to 1000 [ 474.598826][T17450] ieee802154 phy1 wpan1: encryption failed: -22 [ 474.650549][T17457] sctp: [Deprecated]: syz.0.3090 (pid 17457) Use of int in maxseg socket option. [ 474.650549][T17457] Use struct sctp_assoc_value instead [ 474.696384][T17457] A link change request failed with some changes committed already. Interface ip6gretap0 may have been left with an inconsistent configuration, please check. [ 474.719107][T17459] A link change request failed with some changes committed already. Interface ip6gretap0 may have been left with an inconsistent configuration, please check. [ 474.826771][T17460] ip6_vti0 speed is unknown, defaulting to 1000 [ 475.149085][T17318] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 475.194407][T17318] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 475.224846][T17460] wg1 speed is unknown, defaulting to 1000 [ 475.225456][T17318] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 475.265436][T17318] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 475.403247][T17485] ip6_vti0 speed is unknown, defaulting to 1000 [ 475.507554][T17498] __nla_validate_parse: 7 callbacks suppressed [ 475.507574][T17498] netlink: 44 bytes leftover after parsing attributes in process `syz.0.3098'. [ 475.730247][T17509] xt_hashlimit: size too large, truncated to 1048576 [ 475.756342][T17318] 8021q: adding VLAN 0 to HW filter on device bond0 [ 475.809298][T17318] 8021q: adding VLAN 0 to HW filter on device team0 [ 475.817983][T17511] netlink: 20 bytes leftover after parsing attributes in process `syz.1.3100'. [ 475.856333][T17485] wg1 speed is unknown, defaulting to 1000 [ 475.856489][T17477] ip6_vti0 speed is unknown, defaulting to 1000 [ 475.915166][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 475.922391][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 475.977765][T17517] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3100'. [ 476.150603][ T52] Bluetooth: hci0: command tx timeout [ 476.283449][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 476.290754][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 476.417880][T17477] wg1 speed is unknown, defaulting to 1000 [ 476.432488][T17503] ip6_vti0 speed is unknown, defaulting to 1000 [ 476.809750][T17503] wg1 speed is unknown, defaulting to 1000 [ 476.922627][T17533] erspan0: entered promiscuous mode [ 476.936801][T17533] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3106'. [ 477.025520][T17538] IPVS: set_ctl: invalid protocol: 135 172.30.1.3:20000 [ 477.101883][T17318] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 477.359239][T17549] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3109'. [ 477.527785][T17552] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3110'. [ 477.638985][T17556] netlink: 96 bytes leftover after parsing attributes in process `syz.0.3111'. [ 477.821138][T17558] netlink: 'syz.2.3112': attribute type 1 has an invalid length. [ 477.832636][T17318] veth0_vlan: entered promiscuous mode [ 477.849068][T17563] netlink: 44 bytes leftover after parsing attributes in process `syz.0.3114'. [ 477.878663][T17558] 8021q: adding VLAN 0 to HW filter on device bond10 [ 477.913449][T17318] veth1_vlan: entered promiscuous mode [ 477.975183][T17318] veth0_macvtap: entered promiscuous mode [ 477.986182][T17318] veth1_macvtap: entered promiscuous mode [ 478.030765][T17318] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 478.049825][T17318] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 478.106509][T17570] xt_CT: No such helper "snmp" [ 478.136852][ T1142] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 478.159556][ T1142] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 478.196841][T15834] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 478.220153][T15834] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 478.230930][ T52] Bluetooth: hci0: command tx timeout [ 478.314402][T15834] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 478.342779][T15834] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 478.382611][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 478.401543][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 478.551052][T17586] netlink: 'syz.1.3121': attribute type 21 has an invalid length. [ 478.558984][T17586] netlink: 156 bytes leftover after parsing attributes in process `syz.1.3121'. [ 478.865116][T17598] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3123'. [ 478.885142][T17598] tipc: Invalid UDP bearer configuration [ 478.885206][T17598] tipc: Enabling of bearer rejected, failed to enable media [ 479.267592][ T5834] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 479.278710][ T5834] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 479.286836][ T5834] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 479.295377][ T5834] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 479.303577][ T5834] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 479.376606][T17605] ip6_vti0 speed is unknown, defaulting to 1000 [ 479.561307][T17608] xt_hashlimit: size too large, truncated to 1048576 [ 480.041317][T17605] wg1 speed is unknown, defaulting to 1000 [ 480.494357][T17637] ip6_vti0 speed is unknown, defaulting to 1000 [ 480.518215][T17644] __nla_validate_parse: 2 callbacks suppressed [ 480.518233][T17644] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3135'. [ 480.853599][T17605] chnl_net:caif_netlink_parms(): no params data found [ 480.973016][T17655] bridge0: port 2(bridge_slave_1) entered disabled state [ 481.276111][T17667] openvswitch: netlink: Flow key attribute not present in set flow. [ 481.312157][T17605] bridge0: port 1(bridge_slave_0) entered blocking state [ 481.337399][T17605] bridge0: port 1(bridge_slave_0) entered disabled state [ 481.348030][T17605] bridge_slave_0: entered allmulticast mode [ 481.358107][T17605] bridge_slave_0: entered promiscuous mode [ 481.364077][ T5834] Bluetooth: hci5: command tx timeout [ 481.377962][T17605] bridge0: port 2(bridge_slave_1) entered blocking state [ 481.385256][T17605] bridge0: port 2(bridge_slave_1) entered disabled state [ 481.394956][T17605] bridge_slave_1: entered allmulticast mode [ 481.404868][T17605] bridge_slave_1: entered promiscuous mode [ 481.414677][T17637] wg1 speed is unknown, defaulting to 1000 [ 481.485026][T17605] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 481.540073][T17605] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 481.628082][T17678] Cannot find add_set index 0 as target [ 481.632054][T17605] team0: Port device team_slave_0 added [ 481.660600][T17685] sctp: [Deprecated]: syz.0.3145 (pid 17685) Use of int in maxseg socket option. [ 481.660600][T17685] Use struct sctp_assoc_value instead [ 481.709991][T17605] team0: Port device team_slave_1 added [ 481.809371][T17605] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 481.816699][T17605] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 481.846669][T17605] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 481.865956][T17698] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3148'. [ 481.932417][T17605] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 481.946855][T17605] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 481.978407][T17605] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 482.000590][T17694] tipc: Started in network mode [ 482.005602][T17694] tipc: Node identity b29c2c3018dc, cluster identity 4711 [ 482.013324][T17694] tipc: Enabled bearer , priority 0 [ 482.034227][T17697] syzkaller0: entered promiscuous mode [ 482.039788][T17697] syzkaller0: entered allmulticast mode [ 482.046220][T17694] netlink: 'syz.0.3147': attribute type 21 has an invalid length. [ 482.055995][T17694] netlink: 156 bytes leftover after parsing attributes in process `syz.0.3147'. [ 482.094493][T17701] netlink: 'syz.3.3149': attribute type 1 has an invalid length. [ 482.134469][T17701] 8021q: adding VLAN 0 to HW filter on device bond1 [ 482.153423][T17605] hsr_slave_0: entered promiscuous mode [ 482.159852][T17605] hsr_slave_1: entered promiscuous mode [ 482.167550][T17605] debugfs: 'hsr0' already exists in 'hsr' [ 482.173331][T17605] Cannot create hsr debugfs directory [ 482.182842][T17693] tipc: Resetting bearer [ 482.200071][T17693] tipc: Disabling bearer [ 482.517593][T17716] netlink: 92 bytes leftover after parsing attributes in process `syz.4.3153'. [ 482.681977][T17728] netlink: 60 bytes leftover after parsing attributes in process `syz.4.3156'. [ 482.765685][T17734] netlink: 'syz.1.3157': attribute type 1 has an invalid length. [ 482.776059][T17726] syzkaller0: entered promiscuous mode [ 482.781764][T17726] syzkaller0: entered allmulticast mode [ 482.839323][T17736] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3158'. [ 482.853735][T17736] bridge0: port 2(bridge_slave_1) entered disabled state [ 482.861379][T17736] bridge0: port 1(bridge_slave_0) entered disabled state [ 482.978178][T17739] bond6: (slave vcan1): The slave device specified does not support setting the MAC address [ 482.988527][T17739] bond6: (slave vcan1): Setting fail_over_mac to active for active-backup mode [ 483.000245][T17739] bond6: (slave vcan1): making interface the new active one [ 483.009563][T17739] bond6: (slave vcan1): Enslaving as an active interface with an up link [ 483.044792][T17734] 8021q: adding VLAN 0 to HW filter on device bond6 [ 483.207009][T17749] ip6_vti0 speed is unknown, defaulting to 1000 [ 483.435142][ T5834] Bluetooth: hci5: command tx timeout [ 483.506073][T17605] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 483.545763][T17605] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 483.558009][T17605] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 483.587568][T17605] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 483.714537][T17605] 8021q: adding VLAN 0 to HW filter on device bond0 [ 483.757720][T17605] 8021q: adding VLAN 0 to HW filter on device team0 [ 483.781912][T17749] wg1 speed is unknown, defaulting to 1000 [ 483.789519][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 483.796709][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 483.848520][T17773] netlink: 'syz.0.3165': attribute type 1 has an invalid length. [ 483.857651][T17773] netlink: 16150 bytes leftover after parsing attributes in process `syz.0.3165'. [ 483.885263][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 483.892502][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 484.268414][T17791] ip6_vti0 speed is unknown, defaulting to 1000 [ 484.306079][T17798] netlink: 60 bytes leftover after parsing attributes in process `syz.0.3170'. [ 484.505871][T17605] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 484.597319][T17804] bond1: option tlb_dynamic_lb: invalid value (44) [ 484.606186][T17804] bond1 (unregistering): Released all slaves [ 484.656068][T17811] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3173'. [ 484.744350][T17605] veth0_vlan: entered promiscuous mode [ 484.769985][T17605] veth1_vlan: entered promiscuous mode [ 484.829779][T17605] veth0_macvtap: entered promiscuous mode [ 484.848176][T17605] veth1_macvtap: entered promiscuous mode [ 484.898266][T17605] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 484.923647][T17605] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 484.942605][T17793] ip6_vti0 speed is unknown, defaulting to 1000 [ 484.942986][T17791] wg1 speed is unknown, defaulting to 1000 [ 484.964958][T15834] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 484.974083][T15834] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 485.036120][T15834] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 485.055295][T15834] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 485.217740][ T49] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 485.227242][ T49] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 485.356472][T15834] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 485.366805][T15834] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 485.513642][ T5834] Bluetooth: hci5: command tx timeout [ 485.627031][T17808] ip6_vti0 speed is unknown, defaulting to 1000 [ 485.794898][T17828] netlink: 64 bytes leftover after parsing attributes in process `syz.4.3178'. [ 486.145488][ T52] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 486.161661][ T52] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 486.169964][ T52] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 486.179080][ T52] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 486.204698][ T52] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 486.249780][T17836] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3180'. [ 486.267600][T17793] wg1 speed is unknown, defaulting to 1000 [ 486.267632][T17823] ip6_vti0 speed is unknown, defaulting to 1000 [ 486.283608][T17836] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 486.356575][T17808] wg1 speed is unknown, defaulting to 1000 [ 486.367218][T17836] netlink: 'syz.4.3180': attribute type 1 has an invalid length. [ 486.433346][T17839] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3180'. [ 486.617999][T17841] bridge1: entered allmulticast mode [ 486.719332][T17833] ip6_vti0 speed is unknown, defaulting to 1000 [ 486.911183][T17833] wg1 speed is unknown, defaulting to 1000 [ 487.038910][T17823] wg1 speed is unknown, defaulting to 1000 [ 487.123838][T17851] netlink: 224 bytes leftover after parsing attributes in process `syz.4.3184'. [ 487.210222][T17853] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3185'. [ 487.596094][ T5834] Bluetooth: hci5: command tx timeout [ 487.780890][T17833] chnl_net:caif_netlink_parms(): no params data found [ 487.906204][T17864] ip6_vti0 speed is unknown, defaulting to 1000 [ 488.105162][T17833] bridge0: port 1(bridge_slave_0) entered blocking state [ 488.114166][T17833] bridge0: port 1(bridge_slave_0) entered disabled state [ 488.122878][T17833] bridge_slave_0: entered allmulticast mode [ 488.131812][T17833] bridge_slave_0: entered promiscuous mode [ 488.149009][T17833] bridge0: port 2(bridge_slave_1) entered blocking state [ 488.158028][T17833] bridge0: port 2(bridge_slave_1) entered disabled state [ 488.165497][T17833] bridge_slave_1: entered allmulticast mode [ 488.174710][T17833] bridge_slave_1: entered promiscuous mode [ 488.253527][T17833] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 488.267923][T17833] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 488.311262][ T5834] Bluetooth: hci1: command tx timeout [ 488.343525][T17862] ip6_vti0 speed is unknown, defaulting to 1000 [ 488.350625][T17864] wg1 speed is unknown, defaulting to 1000 [ 488.359978][T17833] team0: Port device team_slave_0 added [ 488.410251][T17833] team0: Port device team_slave_1 added [ 488.546212][T17833] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 488.570527][T17833] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 488.611738][T17833] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 488.636502][T17833] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 488.657063][T17833] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 488.753338][T17833] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 488.900059][T17869] ip6_vti0 speed is unknown, defaulting to 1000 [ 488.900103][T17862] wg1 speed is unknown, defaulting to 1000 [ 488.988989][T17899] FAULT_INJECTION: forcing a failure. [ 488.988989][T17899] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 489.038639][T17899] CPU: 1 UID: 0 PID: 17899 Comm: syz.2.3195 Not tainted syzkaller #0 PREEMPT(full) [ 489.038666][T17899] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 489.038679][T17899] Call Trace: [ 489.038688][T17899] [ 489.038696][T17899] dump_stack_lvl+0x189/0x250 [ 489.038729][T17899] ? __pfx____ratelimit+0x10/0x10 [ 489.038761][T17899] ? __pfx_dump_stack_lvl+0x10/0x10 [ 489.038789][T17899] ? __pfx__printk+0x10/0x10 [ 489.038810][T17899] ? __might_fault+0xb0/0x130 [ 489.038852][T17899] should_fail_ex+0x414/0x560 [ 489.038896][T17899] _copy_from_iter+0x1de/0x1790 [ 489.038926][T17899] ? rcu_is_watching+0x15/0xb0 [ 489.038953][T17899] ? kmalloc_reserve+0xbd/0x290 [ 489.038975][T17899] ? __pfx__copy_from_iter+0x10/0x10 [ 489.039000][T17899] ? __build_skb_around+0x262/0x3f0 [ 489.039023][T17899] ? netlink_sendmsg+0x642/0xb30 [ 489.039044][T17899] ? skb_put+0x11b/0x210 [ 489.039068][T17899] netlink_sendmsg+0x6b2/0xb30 [ 489.039101][T17899] ? __pfx_netlink_sendmsg+0x10/0x10 [ 489.039128][T17899] ? aa_sock_msg_perm+0xf1/0x1d0 [ 489.039160][T17899] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 489.039180][T17899] ? __pfx_netlink_sendmsg+0x10/0x10 [ 489.039203][T17899] __sock_sendmsg+0x21c/0x270 [ 489.039235][T17899] ____sys_sendmsg+0x505/0x830 [ 489.039265][T17899] ? __pfx_____sys_sendmsg+0x10/0x10 [ 489.039299][T17899] ? import_iovec+0x74/0xa0 [ 489.039328][T17899] ___sys_sendmsg+0x21f/0x2a0 [ 489.039355][T17899] ? __pfx____sys_sendmsg+0x10/0x10 [ 489.039419][T17899] ? __fget_files+0x2a/0x420 [ 489.039436][T17899] ? __fget_files+0x3a0/0x420 [ 489.039468][T17899] __x64_sys_sendmsg+0x19b/0x260 [ 489.039495][T17899] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 489.039529][T17899] ? __pfx_ksys_write+0x10/0x10 [ 489.039562][T17899] ? do_syscall_64+0xbe/0xfa0 [ 489.039586][T17899] do_syscall_64+0xfa/0xfa0 [ 489.039605][T17899] ? lockdep_hardirqs_on+0x9c/0x150 [ 489.039624][T17899] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 489.039644][T17899] ? clear_bhb_loop+0x60/0xb0 [ 489.039668][T17899] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 489.039688][T17899] RIP: 0033:0x7fc3f7d8f6c9 [ 489.039705][T17899] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 489.039721][T17899] RSP: 002b:00007fc3f8b70038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 489.039743][T17899] RAX: ffffffffffffffda RBX: 00007fc3f7fe5fa0 RCX: 00007fc3f7d8f6c9 [ 489.039757][T17899] RDX: 0000000004048040 RSI: 0000200000000140 RDI: 0000000000000003 [ 489.039770][T17899] RBP: 00007fc3f8b70090 R08: 0000000000000000 R09: 0000000000000000 [ 489.039782][T17899] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 489.039794][T17899] R13: 00007fc3f7fe6038 R14: 00007fc3f7fe5fa0 R15: 00007ffca6f20608 [ 489.039829][T17899] [ 489.409401][T17833] hsr_slave_0: entered promiscuous mode [ 489.416287][T17833] hsr_slave_1: entered promiscuous mode [ 489.422765][T17833] debugfs: 'hsr0' already exists in 'hsr' [ 489.428514][T17833] Cannot create hsr debugfs directory [ 489.489341][T17904] netlink: 64 bytes leftover after parsing attributes in process `syz.2.3197'. [ 489.546005][T17904] team0: No ports can be present during mode change [ 489.555375][T17903] netlink: 64 bytes leftover after parsing attributes in process `syz.2.3197'. [ 489.569937][T17903] team0: No ports can be present during mode change [ 489.584193][T17867] ip6_vti0 speed is unknown, defaulting to 1000 [ 489.688791][T17833] netdevsim netdevsim1 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 489.709840][T17833] netdevsim netdevsim1 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 489.781631][T17833] netdevsim netdevsim1 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 489.800576][T17833] netdevsim netdevsim1 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 489.841267][T17916] dvmrp1: tun_chr_ioctl cmd 1074025677 [ 489.846989][T17916] dvmrp1: linktype set to 769 [ 489.862487][T17916] dvmrp1: tun_chr_ioctl cmd 1074025673 [ 489.871731][T17917] dvmrp1: tun_chr_ioctl cmd 1074025677 [ 489.914842][T17917] dvmrp1: linktype set to 769 [ 489.933718][T17833] netdevsim netdevsim1 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 489.962968][T17833] netdevsim netdevsim1 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 489.982713][T17867] wg1 speed is unknown, defaulting to 1000 [ 490.030695][T17869] wg1 speed is unknown, defaulting to 1000 [ 490.076804][T17833] netdevsim netdevsim1 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 490.103532][T17833] netdevsim netdevsim1 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 490.218471][T17922] netlink: 'syz.2.3201': attribute type 21 has an invalid length. [ 490.338979][T17922] netlink: 132 bytes leftover after parsing attributes in process `syz.2.3201'. [ 490.394262][ T5834] Bluetooth: hci1: command tx timeout [ 490.632029][T17927] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3203'. [ 490.641368][T17927] netlink: 11 bytes leftover after parsing attributes in process `syz.2.3203'. [ 490.854106][T17932] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci1/hci1:200/input8 [ 490.903710][T17933] netlink: 68 bytes leftover after parsing attributes in process `syz.2.3204'. [ 490.970161][T17929] ip6_vti0 speed is unknown, defaulting to 1000 [ 490.985126][T17936] FAULT_INJECTION: forcing a failure. [ 490.985126][T17936] name failslab, interval 1, probability 0, space 0, times 0 [ 490.998287][T17936] CPU: 0 UID: 0 PID: 17936 Comm: syz.4.3206 Not tainted syzkaller #0 PREEMPT(full) [ 490.998328][T17936] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 490.998349][T17936] Call Trace: [ 490.998362][T17936] [ 490.998371][T17936] dump_stack_lvl+0x189/0x250 [ 490.998404][T17936] ? __pfx____ratelimit+0x10/0x10 [ 490.998435][T17936] ? __pfx_dump_stack_lvl+0x10/0x10 [ 490.998463][T17936] ? __pfx__printk+0x10/0x10 [ 490.998490][T17936] ? __lock_acquire+0xab9/0xd20 [ 490.998518][T17936] should_fail_ex+0x414/0x560 [ 490.998555][T17936] should_failslab+0xa8/0x100 [ 490.998578][T17936] kmem_cache_alloc_noprof+0x74/0x6e0 [ 490.998607][T17936] ? skb_clone+0x212/0x3a0 [ 490.998638][T17936] skb_clone+0x212/0x3a0 [ 490.998675][T17936] __netlink_deliver_tap+0x404/0x850 [ 490.998713][T17936] ? netlink_deliver_tap+0x2e/0x1b0 [ 490.998737][T17936] netlink_deliver_tap+0x19c/0x1b0 [ 490.998760][T17936] netlink_unicast+0x7fa/0x9e0 [ 490.998810][T17936] ? __pfx_netlink_unicast+0x10/0x10 [ 490.998844][T17936] ? netlink_sendmsg+0x642/0xb30 [ 490.998863][T17936] ? skb_put+0x11b/0x210 [ 490.998889][T17936] netlink_sendmsg+0x805/0xb30 [ 490.998922][T17936] ? __pfx_netlink_sendmsg+0x10/0x10 [ 490.998948][T17936] ? aa_sock_msg_perm+0xf1/0x1d0 [ 490.998981][T17936] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 490.999001][T17936] ? __pfx_netlink_sendmsg+0x10/0x10 [ 490.999024][T17936] __sock_sendmsg+0x21c/0x270 [ 490.999056][T17936] ____sys_sendmsg+0x505/0x830 [ 490.999086][T17936] ? __pfx_____sys_sendmsg+0x10/0x10 [ 490.999121][T17936] ? import_iovec+0x74/0xa0 [ 490.999150][T17936] ___sys_sendmsg+0x21f/0x2a0 [ 490.999177][T17936] ? __pfx____sys_sendmsg+0x10/0x10 [ 490.999245][T17936] ? __fget_files+0x2a/0x420 [ 490.999264][T17936] ? __fget_files+0x3a0/0x420 [ 490.999296][T17936] __x64_sys_sendmsg+0x19b/0x260 [ 490.999323][T17936] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 490.999358][T17936] ? __pfx_ksys_write+0x10/0x10 [ 490.999391][T17936] ? do_syscall_64+0xbe/0xfa0 [ 490.999416][T17936] do_syscall_64+0xfa/0xfa0 [ 490.999433][T17936] ? lockdep_hardirqs_on+0x9c/0x150 [ 490.999454][T17936] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 490.999473][T17936] ? clear_bhb_loop+0x60/0xb0 [ 490.999498][T17936] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 490.999517][T17936] RIP: 0033:0x7f3c90b8f6c9 [ 490.999535][T17936] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 490.999552][T17936] RSP: 002b:00007f3c91a26038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 490.999572][T17936] RAX: ffffffffffffffda RBX: 00007f3c90de5fa0 RCX: 00007f3c90b8f6c9 [ 490.999586][T17936] RDX: 0000000004048040 RSI: 0000200000000140 RDI: 0000000000000003 [ 490.999599][T17936] RBP: 00007f3c91a26090 R08: 0000000000000000 R09: 0000000000000000 [ 490.999611][T17936] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 490.999623][T17936] R13: 00007f3c90de6038 R14: 00007f3c90de5fa0 R15: 00007ffc19c613c8 [ 490.999660][T17936] [ 490.999848][T17936] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3206'. [ 491.081254][T17833] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 491.376652][T17833] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 491.437569][T17833] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 491.519552][T17833] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 491.623280][T17948] netlink: 28 bytes leftover after parsing attributes in process `syz.4.3208'. [ 491.811678][T17929] wg1 speed is unknown, defaulting to 1000 [ 492.147490][T17961] ip6_vti0 speed is unknown, defaulting to 1000 [ 492.178431][T17833] 8021q: adding VLAN 0 to HW filter on device bond0 [ 492.219189][T17833] 8021q: adding VLAN 0 to HW filter on device team0 [ 492.256557][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 492.263818][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 492.301670][ T49] bridge0: port 2(bridge_slave_1) entered blocking state [ 492.309163][ T49] bridge0: port 2(bridge_slave_1) entered forwarding state [ 492.330586][T17971] Can't find ip_set type hash:ip$mec [ 492.470884][ T5834] Bluetooth: hci1: command tx timeout [ 492.499073][T17833] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 492.808029][T17979] sctp: [Deprecated]: syz.0.3214 (pid 17979) Use of struct sctp_assoc_value in delayed_ack socket option. [ 492.808029][T17979] Use struct sctp_sack_info instead [ 493.119622][T17833] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 493.245810][T17833] veth0_vlan: entered promiscuous mode [ 493.265539][T17833] veth1_vlan: entered promiscuous mode [ 493.314584][T18004] FAULT_INJECTION: forcing a failure. [ 493.314584][T18004] name failslab, interval 1, probability 0, space 0, times 0 [ 493.341931][T18004] CPU: 1 UID: 0 PID: 18004 Comm: syz.2.3217 Not tainted syzkaller #0 PREEMPT(full) [ 493.341956][T18004] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 493.341968][T18004] Call Trace: [ 493.341975][T18004] [ 493.341983][T18004] dump_stack_lvl+0x189/0x250 [ 493.342014][T18004] ? __pfx____ratelimit+0x10/0x10 [ 493.342044][T18004] ? __pfx_dump_stack_lvl+0x10/0x10 [ 493.342069][T18004] ? __pfx__printk+0x10/0x10 [ 493.342092][T18004] ? __pfx___might_resched+0x10/0x10 [ 493.342113][T18004] ? fs_reclaim_acquire+0x7d/0x100 [ 493.342137][T18004] should_fail_ex+0x414/0x560 [ 493.342171][T18004] should_failslab+0xa8/0x100 [ 493.342192][T18004] __kmalloc_cache_noprof+0x6f/0x6f0 [ 493.342219][T18004] ? __schedule+0x17ae/0x4cc0 [ 493.342263][T18004] ? rtnl_newlink+0xfb/0x1c80 [ 493.342290][T18004] rtnl_newlink+0xfb/0x1c80 [ 493.342308][T18004] ? ___sys_sendmsg+0x21f/0x2a0 [ 493.342328][T18004] ? __x64_sys_sendmsg+0x19b/0x260 [ 493.342350][T18004] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 493.342397][T18004] ? __pfx_rtnl_newlink+0x10/0x10 [ 493.342420][T18004] ? __pfx___schedule+0x10/0x10 [ 493.342471][T18004] ? preempt_schedule+0xae/0xc0 [ 493.342501][T18004] ? __dev_queue_xmit+0x284/0x3740 [ 493.342530][T18004] ? preempt_schedule_common+0x83/0xd0 [ 493.342562][T18004] ? preempt_schedule+0xae/0xc0 [ 493.342593][T18004] ? __pfx_preempt_schedule+0x10/0x10 [ 493.342622][T18004] ? nlmon_xmit+0xb0/0x100 [ 493.342659][T18004] ? preempt_schedule_notrace_thunk+0x16/0x30 [ 493.342687][T18004] ? preempt_schedule_thunk+0x16/0x30 [ 493.342717][T18004] ? __local_bh_enable_ip+0x13e/0x1c0 [ 493.342740][T18004] ? __pfx___local_bh_enable_ip+0x10/0x10 [ 493.342768][T18004] ? __dev_queue_xmit+0x284/0x3740 [ 493.342797][T18004] ? __dev_queue_xmit+0x284/0x3740 [ 493.342823][T18004] ? __dev_queue_xmit+0x1bfb/0x3740 [ 493.342859][T18004] ? __lock_acquire+0xab9/0xd20 [ 493.342909][T18004] ? __pfx_rtnl_newlink+0x10/0x10 [ 493.342928][T18004] rtnetlink_rcv_msg+0x7cf/0xb70 [ 493.342953][T18004] ? rtnetlink_rcv_msg+0x1ab/0xb70 [ 493.342972][T18004] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 493.343000][T18004] ? __pfx_rcu_preempt_deferred_qs_irqrestore+0x10/0x10 [ 493.343044][T18004] netlink_rcv_skb+0x208/0x470 [ 493.343064][T18004] ? rcu_is_watching+0x15/0xb0 [ 493.343089][T18004] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 493.343111][T18004] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 493.343147][T18004] ? netlink_deliver_tap+0x2e/0x1b0 [ 493.343178][T18004] netlink_unicast+0x82f/0x9e0 [ 493.343221][T18004] ? __pfx_netlink_unicast+0x10/0x10 [ 493.343256][T18004] ? netlink_sendmsg+0x642/0xb30 [ 493.343277][T18004] ? skb_put+0x11b/0x210 [ 493.343302][T18004] netlink_sendmsg+0x805/0xb30 [ 493.343336][T18004] ? __pfx_netlink_sendmsg+0x10/0x10 [ 493.343363][T18004] ? aa_sock_msg_perm+0xf1/0x1d0 [ 493.343397][T18004] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 493.343418][T18004] ? __pfx_netlink_sendmsg+0x10/0x10 [ 493.343442][T18004] __sock_sendmsg+0x21c/0x270 [ 493.343476][T18004] ____sys_sendmsg+0x505/0x830 [ 493.343506][T18004] ? __pfx_____sys_sendmsg+0x10/0x10 [ 493.343541][T18004] ? import_iovec+0x74/0xa0 [ 493.343572][T18004] ___sys_sendmsg+0x21f/0x2a0 [ 493.343599][T18004] ? __pfx____sys_sendmsg+0x10/0x10 [ 493.343672][T18004] ? __fget_files+0x2a/0x420 [ 493.343692][T18004] ? __fget_files+0x3a0/0x420 [ 493.343724][T18004] __x64_sys_sendmsg+0x19b/0x260 [ 493.343764][T18004] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 493.343798][T18004] ? __pfx_ksys_write+0x10/0x10 [ 493.343831][T18004] ? do_syscall_64+0xbe/0xfa0 [ 493.343855][T18004] do_syscall_64+0xfa/0xfa0 [ 493.343873][T18004] ? lockdep_hardirqs_on+0x9c/0x150 [ 493.343893][T18004] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 493.343913][T18004] ? clear_bhb_loop+0x60/0xb0 [ 493.343938][T18004] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 493.343957][T18004] RIP: 0033:0x7fc3f7d8f6c9 [ 493.343975][T18004] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 493.343992][T18004] RSP: 002b:00007fc3f8b70038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 493.344014][T18004] RAX: ffffffffffffffda RBX: 00007fc3f7fe5fa0 RCX: 00007fc3f7d8f6c9 [ 493.344029][T18004] RDX: 0000000004048040 RSI: 0000200000000140 RDI: 0000000000000003 [ 493.344042][T18004] RBP: 00007fc3f8b70090 R08: 0000000000000000 R09: 0000000000000000 [ 493.344054][T18004] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 493.344066][T18004] R13: 00007fc3f7fe6038 R14: 00007fc3f7fe5fa0 R15: 00007ffca6f20608 [ 493.344102][T18004] [ 493.821994][T17833] veth0_macvtap: entered promiscuous mode [ 493.834113][T17961] wg1 speed is unknown, defaulting to 1000 [ 493.837860][T17833] veth1_macvtap: entered promiscuous mode [ 493.870000][T17833] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 493.884248][T17833] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 493.932812][T18010] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3219'. [ 494.058111][T13704] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 494.071871][T13704] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 494.081490][T13704] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 494.131315][T13704] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 494.297310][T18029] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 494.415281][T18016] team0 (unregistering): Port device team_slave_0 removed [ 494.431979][T18016] team0 (unregistering): Port device team_slave_1 removed [ 494.494306][T18026] pim6reg1: entered promiscuous mode [ 494.501556][T18026] pim6reg1: entered allmulticast mode [ 494.551806][ T5834] Bluetooth: hci1: command tx timeout [ 494.771045][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 494.796087][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 494.978667][T18044] netlink: 244 bytes leftover after parsing attributes in process `syz.2.3228'. [ 495.002336][T13704] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 495.010277][T13704] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 495.240506][T18056] netlink: 'syz.1.3176': attribute type 2 has an invalid length. [ 495.248277][T18056] netlink: 64 bytes leftover after parsing attributes in process `syz.1.3176'. [ 495.296717][T18045] vxcan1: tx address claim with dest, not broadcast [ 495.346540][T18058] ip6_vti0 speed is unknown, defaulting to 1000 [ 495.459037][T18067] team0: Device veth0_to_bridge is up. Set it down before adding it as a team port [ 495.814536][T18074] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3235'. [ 495.894758][T18083] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3236'. [ 495.962984][T18082] tipc: Started in network mode [ 495.967897][T18082] tipc: Node identity ac14140f, cluster identity 4711 [ 496.011466][T18082] tipc: New replicast peer: 255.255.255.255 [ 496.027271][T18082] tipc: Enabled bearer , priority 10 [ 496.053452][T18081] netlink: 224 bytes leftover after parsing attributes in process `syz.1.3236'. [ 496.131462][T18058] wg1 speed is unknown, defaulting to 1000 [ 496.138074][T18061] ip6_vti0 speed is unknown, defaulting to 1000 [ 496.533493][T18115] netlink: 32 bytes leftover after parsing attributes in process `syz.1.3246'. [ 496.783981][T18128] netlink: 260 bytes leftover after parsing attributes in process `syz.1.3249'. [ 496.924885][T18131] netlink: 44 bytes leftover after parsing attributes in process `syz.1.3249'. [ 497.026436][T18130] ip6_vti0 speed is unknown, defaulting to 1000 [ 497.140529][ T980] tipc: Node number set to 2886997007 [ 497.441141][T18126] ip6_vti0 speed is unknown, defaulting to 1000 [ 497.441656][T18061] wg1 speed is unknown, defaulting to 1000 [ 497.496949][T18130] wg1 speed is unknown, defaulting to 1000 [ 497.748797][T18142] syzkaller0: entered promiscuous mode [ 497.758945][T18142] syzkaller0: entered allmulticast mode [ 497.834040][T18141] tipc: Enabled bearer , priority 0 [ 497.985571][T18141] tipc: Resetting bearer [ 498.025263][T18138] tipc: Resetting bearer [ 498.047032][T18147] sctp: [Deprecated]: syz.2.3252 (pid 18147) Use of int in maxseg socket option. [ 498.047032][T18147] Use struct sctp_assoc_value instead [ 498.090940][T18138] tipc: Disabling bearer [ 498.212774][T18126] wg1 speed is unknown, defaulting to 1000 [ 498.497917][T18164] netlink: 44 bytes leftover after parsing attributes in process `syz.3.3257'. [ 498.513351][T18149] ip6_vti0 speed is unknown, defaulting to 1000 [ 498.572210][T18166] netlink: 'syz.2.3256': attribute type 10 has an invalid length. [ 498.608616][T18162] xt_CT: No such helper "snmp" [ 498.682192][T18166] 8021q: adding VLAN 0 to HW filter on device team0 [ 498.721797][T18166] bond0: (slave team0): Enslaving as an active interface with an up link [ 498.757688][T18171] netlink: 20 bytes leftover after parsing attributes in process `syz.3.3258'. [ 499.069121][T18161] ip6_vti0 speed is unknown, defaulting to 1000 [ 499.283054][T18161] wg1 speed is unknown, defaulting to 1000 [ 499.293010][T18149] wg1 speed is unknown, defaulting to 1000 [ 499.781720][T18198] IPVS: Error connecting to the multicast addr [ 500.075545][T18203] bond1: option lacp_rate: invalid value (149) [ 500.095293][T18203] bond1 (unregistering): Released all slaves [ 500.434714][T18222] bridge0: port 1(bridge_slave_0) entered disabled state [ 500.592275][T18222] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 500.610830][T18222] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 500.812188][ T13] netdevsim netdevsim0 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 500.826867][ T13] netdevsim netdevsim0 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 500.868232][ T13] netdevsim netdevsim0 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 500.900320][ T13] netdevsim netdevsim0 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 500.983861][T18243] openvswitch: netlink: Flow actions attr not present in new flow. [ 501.079881][T18251] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 501.145924][T18253] netlink: 'syz.2.3282': attribute type 1 has an invalid length. [ 501.180496][T18253] netlink: 52 bytes leftover after parsing attributes in process `syz.2.3282'. [ 501.360146][ T1300] aoe: packet could not be sent on bond0. consider increasing tx_queue_len [ 501.373345][ T1300] ieee802154 phy1 wpan1: encryption failed: -22 [ 501.623338][T18255] dvmrp0: entered allmulticast mode [ 501.855550][T18295] batadv_slave_0: entered promiscuous mode [ 501.876258][T18295] batman_adv: batadv0: Adding interface: macsec1 [ 501.895576][T18295] batman_adv: batadv0: The MTU of interface macsec1 is too small (1468) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 501.946439][T18295] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 501.999287][T18295] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 502.034410][T18295] batman_adv: batadv0: Interface activated: macsec1 [ 502.247492][T18286] infiniband syz1: set down [ 502.258768][T18286] infiniband syz1: added ipvlan0 [ 502.362697][T18286] RDS/IB: syz1: added [ 502.376928][T18286] smc: adding ib device syz1 with port count 1 [ 502.387632][T18286] smc: ib device syz1 port 1 has no pnetid [ 502.528810][T18321] A link change request failed with some changes committed already. Interface batadv_slave_0 may have been left with an inconsistent configuration, please check. [ 502.559034][T18321] syzkaller1: entered promiscuous mode [ 502.564803][T18321] syzkaller1: entered allmulticast mode [ 502.671126][T18322] netlink: 84 bytes leftover after parsing attributes in process `syz.1.3298'. [ 502.857986][T18330] ip6_vti0 speed is unknown, defaulting to 1000 [ 502.886442][T18332] netlink: 'syz.0.3301': attribute type 10 has an invalid length. [ 502.894584][T18332] macvlan0: entered promiscuous mode [ 502.899981][T18332] macvlan0: entered allmulticast mode [ 502.907936][T18332] veth1_vlan: entered allmulticast mode [ 502.919340][T18332] bond0: (slave macvlan0): Enslaving as an active interface with an up link [ 503.296639][T18330] wg1 speed is unknown, defaulting to 1000 [ 503.325115][T18343] ip6_vti0 speed is unknown, defaulting to 1000 [ 503.501586][T18350] sctp: [Deprecated]: syz.1.3306 (pid 18350) Use of int in max_burst socket option. [ 503.501586][T18350] Use struct sctp_assoc_value instead [ 503.849876][T18343] wg1 speed is unknown, defaulting to 1000 [ 503.849912][T18341] ip6_vti0 speed is unknown, defaulting to 1000 [ 504.263828][T18341] wg1 speed is unknown, defaulting to 1000 [ 504.280709][T18372] netlink: 45 bytes leftover after parsing attributes in process `syz.4.3312'. [ 504.290928][T18362] ip6_vti0 speed is unknown, defaulting to 1000 [ 504.640755][T18380] netlink: 'syz.4.3315': attribute type 142 has an invalid length. [ 504.825035][T18384] netlink: 'syz.4.3317': attribute type 1 has an invalid length. [ 504.826948][T18386] netlink: 28 bytes leftover after parsing attributes in process `syz.4.3317'. [ 504.933387][T18362] wg1 speed is unknown, defaulting to 1000 [ 505.224361][T18397] tipc: Enabling of bearer rejected, failed to enable media [ 505.249644][T18397] netlink: 16 bytes leftover after parsing attributes in process `syz.0.3320'. [ 505.266875][T18397] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3320'. [ 505.283581][T18397] macvlan0: left promiscuous mode [ 505.355951][T18400] veth3: entered promiscuous mode [ 505.494309][T18405] sch_fq: defrate 0 ignored. [ 505.917326][T18419] xt_l2tp: wrong L2TP version: 1 [ 506.258484][T18429] netlink: 'syz.0.3330': attribute type 4 has an invalid length. [ 506.277766][ T30] audit: type=1800 audit(1763458150.370:5): pid=18429 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.3330" name="blkio.bfq.time_recursive" dev="tmpfs" ino=488 res=0 errno=0 [ 506.324164][T18429] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3330'. [ 506.422329][T18431] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3331'. [ 506.789260][T18441] sch_tbf: peakrate 7 is lower than or equals to rate 6829859379779001161 ! [ 506.873975][T18444] ipvlan2: entered promiscuous mode [ 506.880276][T18444] bridge0: port 3(ipvlan2) entered blocking state [ 506.887077][T18444] bridge0: port 3(ipvlan2) entered disabled state [ 506.893805][T18444] ipvlan2: entered allmulticast mode [ 506.899114][T18444] bridge0: entered allmulticast mode [ 506.907233][T18444] ipvlan2: left allmulticast mode [ 506.914173][T18444] bridge0: left allmulticast mode [ 507.596929][T18464] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3338'. [ 508.013136][T18475] netlink: 'syz.0.3341': attribute type 1 has an invalid length. [ 508.031049][T18475] netlink: 224 bytes leftover after parsing attributes in process `syz.0.3341'. [ 508.054517][T18475] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3341'. [ 508.103616][T18475] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3341'. [ 508.408996][T18483] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 509.001051][T18488] ip6_vti0 speed is unknown, defaulting to 1000 [ 509.337906][T18498] netlink: 72 bytes leftover after parsing attributes in process `syz.4.3345'. [ 509.623624][T18505] netlink: 28 bytes leftover after parsing attributes in process `syz.4.3349'. [ 509.706200][T18505] netlink: 204 bytes leftover after parsing attributes in process `syz.4.3349'. [ 510.208653][T18521] netlink: 'syz.3.3354': attribute type 7 has an invalid length. [ 510.212091][T18520] netlink: 32 bytes leftover after parsing attributes in process `syz.4.3355'. [ 510.217647][T18521] netlink: 'syz.3.3354': attribute type 8 has an invalid length. [ 510.997517][T18526] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 511.017004][T18526] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 511.139973][T18488] wg1 speed is unknown, defaulting to 1000 [ 511.177779][T18527] geneve2: entered promiscuous mode [ 511.193826][T18527] geneve2: entered allmulticast mode [ 511.485147][T18542] __nla_validate_parse: 1 callbacks suppressed [ 511.485164][T18542] netlink: 28 bytes leftover after parsing attributes in process `syz.3.3359'. [ 511.538467][T18539] ip6_vti0 speed is unknown, defaulting to 1000 [ 512.011421][T18550] netlink: 116 bytes leftover after parsing attributes in process `syz.2.3362'. [ 512.013913][T18539] wg1 speed is unknown, defaulting to 1000 [ 512.063650][T18550] xt_hashlimit: overflow, try lower: 0/0 [ 512.256619][T18556] can: request_module (can-proto-3) failed. [ 512.359027][T18562] xt_TCPMSS: Only works on TCP SYN packets [ 512.831366][T18581] netlink: 388 bytes leftover after parsing attributes in process `syz.2.3372'. [ 513.886296][T18618] ip6_vti0 speed is unknown, defaulting to 1000 [ 513.940628][T18625] netlink: 48 bytes leftover after parsing attributes in process `syz.1.3383'. [ 514.255016][T18637] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 514.334976][T18637] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 514.407061][T18637] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 514.469415][T18637] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 514.556632][T18618] wg1 speed is unknown, defaulting to 1000 [ 514.561334][T18626] ip6_vti0 speed is unknown, defaulting to 1000 [ 514.616249][ T12] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 514.669626][ T12] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 514.704691][ T13] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 514.754355][T18651] bridge0: port 2(bridge_slave_1) entered blocking state [ 514.761653][T18651] bridge0: port 2(bridge_slave_1) entered listening state [ 514.769117][T18651] bridge0: port 1(bridge_slave_0) entered blocking state [ 514.776310][T18651] bridge0: port 1(bridge_slave_0) entered listening state [ 514.829213][T18651] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 514.851683][ T12] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 515.110103][T18661] bridge0: entered promiscuous mode [ 515.115811][T18661] macsec1: entered promiscuous mode [ 515.123767][T18661] bridge0: port 3(macsec1) entered blocking state [ 515.130622][T18661] bridge0: port 3(macsec1) entered disabled state [ 515.137398][T18661] macsec1: entered allmulticast mode [ 515.144996][T18661] bridge0: entered allmulticast mode [ 515.166279][T18661] macsec1: left allmulticast mode [ 515.174549][T18661] bridge0: left allmulticast mode [ 515.181284][T18661] bridge0: left promiscuous mode [ 515.228569][T18626] wg1 speed is unknown, defaulting to 1000 [ 515.244551][T18633] ip6_vti0 speed is unknown, defaulting to 1000 [ 515.551380][T18670] netlink: 'syz.2.3392': attribute type 13 has an invalid length. [ 515.579636][T18670] netlink: 'syz.2.3392': attribute type 17 has an invalid length. [ 515.787510][T18670] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 515.913074][T18633] wg1 speed is unknown, defaulting to 1000 [ 515.982692][T18665] ip6_vti0 speed is unknown, defaulting to 1000 [ 516.365271][T18695] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3398'. [ 516.694811][T18665] wg1 speed is unknown, defaulting to 1000 [ 516.828640][T18701] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 517.708402][T18716] x_tables: ip6_tables: mh match: only valid for protocol 135 [ 518.250626][T18738] tipc: Failed to remove unknown binding: 66,1,1/0:2877494009/2877494011 [ 518.312680][T18738] tipc: Failed to remove unknown binding: 66,1,1/0:2877494009/2877494011 [ 518.344109][T18738] tipc: Failed to remove unknown binding: 66,1,1/0:2877494009/2877494011 [ 518.574601][T18745] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3414'. [ 518.587141][T18745] bridge_slave_1: left allmulticast mode [ 518.594344][T18745] bridge_slave_1: left promiscuous mode [ 518.597323][T18747] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3415'. [ 518.600440][T18745] bridge0: port 2(bridge_slave_1) entered disabled state [ 518.618805][T18745] bridge_slave_0: left allmulticast mode [ 518.624640][T18745] bridge_slave_0: left promiscuous mode [ 518.630984][T18745] bridge0: port 1(bridge_slave_0) entered disabled state [ 518.683001][T18748] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3415'. [ 519.085240][T18763] ip6_vti0 speed is unknown, defaulting to 1000 [ 519.498605][T18530] IPVS: starting estimator thread 0... [ 519.511176][T18787] tipc: Started in network mode [ 519.521766][T18787] tipc: Node identity ac1414aa, cluster identity 4711 [ 519.534026][T18787] tipc: Enabled bearer , priority 10 [ 519.591558][T18790] IPVS: using max 27 ests per chain, 64800 per kthread [ 519.759315][T18794] netlink: 40 bytes leftover after parsing attributes in process `syz.4.3426'. [ 519.780962][T18796] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3427'. [ 519.816708][T18796] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3427'. [ 519.872961][T18763] wg1 speed is unknown, defaulting to 1000 [ 519.901758][T18759] ip6_vti0 speed is unknown, defaulting to 1000 [ 520.000277][T18801] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3429'. [ 520.005773][T18773] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3420'. [ 520.041489][T18801] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3429'. [ 520.056869][T18797] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3420'. [ 520.661053][ T10] tipc: Node number set to 2886997162 [ 520.751028][T18810] vlan2: entered promiscuous mode [ 520.756295][T18810] vlan2: entered allmulticast mode [ 520.770903][T18810] hsr_slave_1: entered allmulticast mode [ 521.294729][T18759] wg1 speed is unknown, defaulting to 1000 [ 521.300618][T18771] ip6_vti0 speed is unknown, defaulting to 1000 [ 521.749324][T18789] ip6_vti0 speed is unknown, defaulting to 1000 [ 522.044830][T18810] ip6_vti0 speed is unknown, defaulting to 1000 [ 522.215864][T18814] ip6_vti0 speed is unknown, defaulting to 1000 [ 522.353869][T18815] ip6_vti0 speed is unknown, defaulting to 1000 [ 522.495573][T18815] wg1 speed is unknown, defaulting to 1000 [ 522.518657][T18771] wg1 speed is unknown, defaulting to 1000 [ 522.526962][T18789] wg1 speed is unknown, defaulting to 1000 [ 522.544045][T18810] wg1 speed is unknown, defaulting to 1000 [ 522.556098][T18814] wg1 speed is unknown, defaulting to 1000 [ 525.637006][T18838] __nla_validate_parse: 3 callbacks suppressed [ 525.637031][T18838] netlink: 51 bytes leftover after parsing attributes in process `syz.0.3438'. [ 525.867424][T18841] netlink: 'syz.4.3439': attribute type 8 has an invalid length. [ 526.647297][ T12] smc: removing ib device syz1 [ 526.750611][T18879] wg1: entered promiscuous mode [ 526.765953][T18879] wg1: entered allmulticast mode [ 526.786669][ T43] ================================================================== [ 526.794843][ T43] BUG: KASAN: slab-use-after-free in __ethtool_get_link_ksettings+0x6e/0x190 [ 526.803640][ T43] Read of size 8 at addr ffff888053ef22e8 by task kworker/1:1/43 [ 526.811365][ T43] [ 526.813705][ T43] CPU: 1 UID: 0 PID: 43 Comm: kworker/1:1 Not tainted syzkaller #0 PREEMPT(full) [ 526.813742][ T43] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 526.813754][ T43] Workqueue: events smc_ib_port_event_work [ 526.813787][ T43] Call Trace: [ 526.813794][ T43] [ 526.813802][ T43] dump_stack_lvl+0x189/0x250 [ 526.813829][ T43] ? rcu_is_watching+0x15/0xb0 [ 526.813851][ T43] ? __kasan_check_byte+0x12/0x40 [ 526.813870][ T43] ? __pfx_dump_stack_lvl+0x10/0x10 [ 526.813894][ T43] ? rcu_is_watching+0x15/0xb0 [ 526.813915][ T43] ? lock_release+0x4b/0x3e0 [ 526.813936][ T43] ? __virt_addr_valid+0x1c8/0x5c0 [ 526.813961][ T43] ? __virt_addr_valid+0x4a5/0x5c0 [ 526.813989][ T43] print_report+0xca/0x240 [ 526.814011][ T43] ? __ethtool_get_link_ksettings+0x6e/0x190 [ 526.814035][ T43] kasan_report+0x118/0x150 [ 526.814054][ T43] ? __ethtool_get_link_ksettings+0x6e/0x190 [ 526.814083][ T43] __ethtool_get_link_ksettings+0x6e/0x190 [ 526.814109][ T43] ib_get_eth_speed+0x15e/0x7b0 [ 526.814139][ T43] ? __pfx_ib_get_eth_speed+0x10/0x10 [ 526.814170][ T43] ? do_raw_spin_unlock+0x122/0x240 [ 526.814202][ T43] rxe_query_port+0x93/0x3b0 [ 526.814228][ T43] ib_query_port+0x170/0x830 [ 526.814248][ T43] smc_ib_port_event_work+0x15a/0x940 [ 526.814281][ T43] ? _raw_spin_unlock_irq+0x23/0x50 [ 526.814308][ T43] ? process_scheduled_works+0x9ef/0x17b0 [ 526.814328][ T43] ? process_scheduled_works+0x9ef/0x17b0 [ 526.814349][ T43] process_scheduled_works+0xae1/0x17b0 [ 526.814384][ T43] ? __pfx_process_scheduled_works+0x10/0x10 [ 526.814414][ T43] worker_thread+0x8a0/0xda0 [ 526.814435][ T43] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 526.814468][ T43] ? __kthread_parkme+0x7b/0x200 [ 526.814495][ T43] kthread+0x711/0x8a0 [ 526.814521][ T43] ? __pfx_worker_thread+0x10/0x10 [ 526.814540][ T43] ? __pfx_kthread+0x10/0x10 [ 526.814566][ T43] ? _raw_spin_unlock_irq+0x23/0x50 [ 526.814592][ T43] ? lockdep_hardirqs_on+0x9c/0x150 [ 526.814615][ T43] ? __pfx_kthread+0x10/0x10 [ 526.814640][ T43] ret_from_fork+0x4bc/0x870 [ 526.814661][ T43] ? __pfx_ret_from_fork+0x10/0x10 [ 526.814683][ T43] ? __switch_to_asm+0x39/0x70 [ 526.814699][ T43] ? __switch_to_asm+0x33/0x70 [ 526.814714][ T43] ? __pfx_kthread+0x10/0x10 [ 526.814738][ T43] ret_from_fork_asm+0x1a/0x30 [ 526.814763][ T43] [ 526.814770][ T43] [ 527.047964][ T43] Allocated by task 15950: [ 527.052376][ T43] kasan_save_track+0x3e/0x80 [ 527.057095][ T43] __kasan_kmalloc+0x93/0xb0 [ 527.061680][ T43] __kvmalloc_node_noprof+0x5cd/0x910 [ 527.067057][ T43] alloc_netdev_mqs+0xa6/0x11b0 [ 527.071908][ T43] rtnl_create_link+0x31f/0xd10 [ 527.076758][ T43] rtnl_newlink_create+0x25c/0xb00 [ 527.081883][ T43] rtnl_newlink+0x16e4/0x1c80 [ 527.086560][ T43] rtnetlink_rcv_msg+0x7cf/0xb70 [ 527.091494][ T43] netlink_rcv_skb+0x208/0x470 [ 527.096260][ T43] netlink_unicast+0x82f/0x9e0 [ 527.101025][ T43] netlink_sendmsg+0x805/0xb30 [ 527.105784][ T43] __sock_sendmsg+0x21c/0x270 [ 527.110461][ T43] __sys_sendto+0x3bd/0x520 [ 527.114959][ T43] __x64_sys_sendto+0xde/0x100 [ 527.119714][ T43] do_syscall_64+0xfa/0xfa0 [ 527.124212][ T43] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 527.130098][ T43] [ 527.132439][ T43] Freed by task 18874: [ 527.136503][ T43] kasan_save_track+0x3e/0x80 [ 527.141181][ T43] __kasan_save_free_info+0x46/0x50 [ 527.146372][ T43] __kasan_slab_free+0x5c/0x80 [ 527.151138][ T43] kfree+0x19a/0x6d0 [ 527.155032][ T43] device_release+0x9c/0x1c0 [ 527.159623][ T43] kobject_put+0x22b/0x480 [ 527.164043][ T43] netdev_run_todo+0xd2e/0xea0 [ 527.168807][ T43] rtnl_dellink+0x5aa/0x700 [ 527.173306][ T43] rtnetlink_rcv_msg+0x7cf/0xb70 [ 527.178236][ T43] netlink_rcv_skb+0x208/0x470 [ 527.182993][ T43] netlink_unicast+0x82f/0x9e0 [ 527.187762][ T43] netlink_sendmsg+0x805/0xb30 [ 527.192528][ T43] __sock_sendmsg+0x21c/0x270 [ 527.197214][ T43] ____sys_sendmsg+0x505/0x830 [ 527.201975][ T43] ___sys_sendmsg+0x21f/0x2a0 [ 527.206650][ T43] __x64_sys_sendmsg+0x19b/0x260 [ 527.211586][ T43] do_syscall_64+0xfa/0xfa0 [ 527.216091][ T43] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 527.221979][ T43] [ 527.224295][ T43] The buggy address belongs to the object at ffff888053ef2000 [ 527.224295][ T43] which belongs to the cache kmalloc-cg-4k of size 4096 [ 527.238599][ T43] The buggy address is located 744 bytes inside of [ 527.238599][ T43] freed 4096-byte region [ffff888053ef2000, ffff888053ef3000) [ 527.252486][ T43] [ 527.254804][ T43] The buggy address belongs to the physical page: [ 527.261224][ T43] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x53ef0 [ 527.269980][ T43] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 527.278471][ T43] memcg:ffff88807751c881 [ 527.282704][ T43] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 527.290247][ T43] page_type: f5(slab) [ 527.294232][ T43] raw: 00fff00000000040 ffff88801a030500 dead000000000122 0000000000000000 [ 527.302815][ T43] raw: 0000000000000000 0000000000040004 00000000f5000000 ffff88807751c881 [ 527.311402][ T43] head: 00fff00000000040 ffff88801a030500 dead000000000122 0000000000000000 [ 527.320067][ T43] head: 0000000000000000 0000000000040004 00000000f5000000 ffff88807751c881 [ 527.328731][ T43] head: 00fff00000000003 ffffea00014fbc01 00000000ffffffff 00000000ffffffff [ 527.337395][ T43] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 527.346065][ T43] page dumped because: kasan: bad access detected [ 527.352479][ T43] page_owner tracks the page as allocated [ 527.358190][ T43] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 15950, tgid 15950 (syz-executor), ts 426009580879, free_ts 425957098447 [ 527.379892][ T43] post_alloc_hook+0x240/0x2a0 [ 527.384663][ T43] get_page_from_freelist+0x2365/0x2440 [ 527.390222][ T43] __alloc_frozen_pages_noprof+0x181/0x370 [ 527.396025][ T43] alloc_pages_mpol+0x232/0x4a0 [ 527.400871][ T43] allocate_slab+0x96/0x350 [ 527.405373][ T43] ___slab_alloc+0xf56/0x1990 [ 527.410042][ T43] __slab_alloc+0x65/0x100 [ 527.414453][ T43] __kmalloc_noprof+0x471/0x7f0 [ 527.419306][ T43] __register_sysctl_table+0x72/0x1340 [ 527.424768][ T43] __addrconf_sysctl_register+0x328/0x4c0 [ 527.430498][ T43] addrconf_sysctl_register+0x168/0x1c0 [ 527.436052][ T43] ipv6_add_dev+0xd46/0x1370 [ 527.440642][ T43] addrconf_notify+0x794/0x1010 [ 527.445488][ T43] notifier_call_chain+0x1b6/0x3e0 [ 527.450601][ T43] register_netdevice+0x1608/0x1ae0 [ 527.455805][ T43] virt_wifi_newlink+0x428/0x860 [ 527.460749][ T43] page last free pid 16007 tgid 16003 stack trace: [ 527.467239][ T43] __free_frozen_pages+0xbc4/0xd30 [ 527.472358][ T43] __slab_free+0x2e7/0x390 [ 527.476791][ T43] qlist_free_all+0x97/0x140 [ 527.481385][ T43] kasan_quarantine_reduce+0x148/0x160 [ 527.486849][ T43] __kasan_slab_alloc+0x22/0x80 [ 527.491703][ T43] __kmalloc_node_track_caller_noprof+0x519/0x800 [ 527.498119][ T43] kstrdup+0x42/0x100 [ 527.502104][ T43] __kernfs_new_node+0x9c/0x7e0 [ 527.506958][ T43] kernfs_new_node+0x102/0x210 [ 527.511721][ T43] __kernfs_create_file+0x4b/0x2e0 [ 527.516829][ T43] sysfs_add_file_mode_ns+0x238/0x300 [ 527.522195][ T43] internal_create_group+0x66d/0x1110 [ 527.527569][ T43] sysfs_create_groups+0x59/0x120 [ 527.532601][ T43] ib_setup_port_attrs+0x140c/0x2070 [ 527.537887][ T43] add_one_compat_dev+0x3d6/0x5c0 [ 527.542910][ T43] rdma_dev_init_net+0x1dd/0x270 [ 527.547845][ T43] [ 527.550162][ T43] Memory state around the buggy address: [ 527.555785][ T43] ffff888053ef2180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 527.563840][ T43] ffff888053ef2200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 527.571893][ T43] >ffff888053ef2280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 527.579950][ T43] ^ [ 527.587396][ T43] ffff888053ef2300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 527.595454][ T43] ffff888053ef2380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 527.603521][ T43] ================================================================== [ 527.700519][ T43] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 527.707783][ T43] CPU: 1 UID: 0 PID: 43 Comm: kworker/1:1 Not tainted syzkaller #0 PREEMPT(full) [ 527.716995][ T43] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 527.727071][ T43] Workqueue: events smc_ib_port_event_work [ 527.732916][ T43] Call Trace: [ 527.736212][ T43] [ 527.739149][ T43] dump_stack_lvl+0x99/0x250 [ 527.743752][ T43] ? __asan_memcpy+0x40/0x70 [ 527.748347][ T43] ? __pfx_dump_stack_lvl+0x10/0x10 [ 527.753558][ T43] ? __pfx__printk+0x10/0x10 [ 527.758181][ T43] vpanic+0x237/0x6d0 [ 527.762166][ T43] ? __pfx_vpanic+0x10/0x10 [ 527.766672][ T43] ? preempt_schedule+0xae/0xc0 [ 527.771524][ T43] ? __pfx_preempt_schedule+0x10/0x10 [ 527.776912][ T43] panic+0xb9/0xc0 [ 527.780643][ T43] ? __pfx_panic+0x10/0x10 [ 527.785071][ T43] ? _raw_spin_unlock_irqrestore+0xfd/0x110 [ 527.790985][ T43] ? __ethtool_get_link_ksettings+0x6e/0x190 [ 527.796978][ T43] check_panic_on_warn+0x89/0xb0 [ 527.801934][ T43] ? __ethtool_get_link_ksettings+0x6e/0x190 [ 527.807922][ T43] end_report+0x78/0x160 [ 527.812160][ T43] kasan_report+0x129/0x150 [ 527.816665][ T43] ? __ethtool_get_link_ksettings+0x6e/0x190 [ 527.822679][ T43] __ethtool_get_link_ksettings+0x6e/0x190 [ 527.828502][ T43] ib_get_eth_speed+0x15e/0x7b0 [ 527.833367][ T43] ? __pfx_ib_get_eth_speed+0x10/0x10 [ 527.838755][ T43] ? do_raw_spin_unlock+0x122/0x240 [ 527.843964][ T43] rxe_query_port+0x93/0x3b0 [ 527.848562][ T43] ib_query_port+0x170/0x830 [ 527.853159][ T43] smc_ib_port_event_work+0x15a/0x940 [ 527.858551][ T43] ? _raw_spin_unlock_irq+0x23/0x50 [ 527.863749][ T43] ? process_scheduled_works+0x9ef/0x17b0 [ 527.869467][ T43] ? process_scheduled_works+0x9ef/0x17b0 [ 527.875213][ T43] process_scheduled_works+0xae1/0x17b0 [ 527.880771][ T43] ? __pfx_process_scheduled_works+0x10/0x10 [ 527.886761][ T43] worker_thread+0x8a0/0xda0 [ 527.891355][ T43] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 527.897692][ T43] ? __kthread_parkme+0x7b/0x200 [ 527.902640][ T43] kthread+0x711/0x8a0 [ 527.906734][ T43] ? __pfx_worker_thread+0x10/0x10 [ 527.911936][ T43] ? __pfx_kthread+0x10/0x10 [ 527.916532][ T43] ? _raw_spin_unlock_irq+0x23/0x50 [ 527.921741][ T43] ? lockdep_hardirqs_on+0x9c/0x150 [ 527.926938][ T43] ? __pfx_kthread+0x10/0x10 [ 527.931536][ T43] ret_from_fork+0x4bc/0x870 [ 527.936125][ T43] ? __pfx_ret_from_fork+0x10/0x10 [ 527.941236][ T43] ? __switch_to_asm+0x39/0x70 [ 527.945992][ T43] ? __switch_to_asm+0x33/0x70 [ 527.950758][ T43] ? __pfx_kthread+0x10/0x10 [ 527.955350][ T43] ret_from_fork_asm+0x1a/0x30 [ 527.960114][ T43] [ 527.963434][ T43] Kernel Offset: disabled [ 527.967753][ T43] Rebooting in 86400 seconds..