last executing test programs: 3.011094098s ago: executing program 0 (id=2638): syz_genetlink_get_family_id$ipvs(&(0x7f0000000340), 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x2a020400) poll(&(0x7f00000002c0), 0x0, 0x6) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000080)=0x1, 0x4) sendmsg$inet(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000006c0)=[{&(0x7f0000000b80)='n', 0x1}], 0x1}, 0x0) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x9, 0x7a8, 0x6}, 0x14) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, &(0x7f0000000680)=@gcm_128={{0x303}, "db57cda808852139", "252432e72844858a068b92a5a810f4dc", "11802ff5", "5aee41448c84afb7"}, 0x28) setsockopt$inet6_group_source_req(r0, 0x29, 0x2e, &(0x7f00000001c0)={0xa5, {{0xa, 0x4e22, 0x5, @loopback, 0x90000}}, {{0xa, 0x4e20, 0x0, @remote}}}, 0x108) ppoll(&(0x7f0000000100)=[{r0, 0x31}, {r0, 0x4}, {r0, 0x8010}], 0x3, &(0x7f0000000140), &(0x7f0000000300)={[0x7]}, 0x8) 2.912036342s ago: executing program 4 (id=2640): r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000700)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0x0}, 0x50) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000900)={0x18, 0x10, &(0x7f0000000840)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x8f, 0x0, 0x0, 0x0, 0x1}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [@jmp={0x5, 0x1, 0x1, 0xa, 0xa}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000080)='GPL\x00', 0x9, 0x1000, &(0x7f0000001cc0)=""/4096, 0x41100, 0xd}, 0x94) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r2, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f00000002c0)=[@in={0x2, 0x0, @local}]}, &(0x7f0000000440)=0x10) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r2, 0x84, 0x73, &(0x7f0000000080)={r3, 0x1, 0x10, 0xfff, 0x55b}, &(0x7f00000000c0)=0x18) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'team0\x00', 0x0}) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000280)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x58, 0x58, 0x9, [@float={0x7, 0x0, 0x0, 0x10, 0x4}, @func_proto={0x0, 0x8, 0x0, 0xd, 0x0, [{0x1, 0x5}, {0x2, 0x3}, {0x3, 0x3}, {0x2, 0x5}, {0x1, 0x3}, {0x2, 0x5}, {0xc, 0x4}, {0x2, 0x2}]}]}, {0x0, [0x30, 0x30, 0x2e, 0x30, 0x0, 0x61, 0x30]}}, &(0x7f00000001c0)=""/189, 0x79, 0xbd, 0x0, 0x1}, 0x28) bpf$PROG_LOAD(0x5, &(0x7f0000000e80)={0x5, 0x3, &(0x7f0000000a00)=@framed={{0x18, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x1}}, &(0x7f0000000a40)='syzkaller\x00', 0x8, 0x85, &(0x7f0000000a80)=""/133, 0x41100, 0x65, '\x00', r4, @fallback=0x8, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000b40)={0x2, 0x1, 0xe, 0x3}, 0x10, 0x0, r1, 0x0, 0x0, 0x0, 0x10, 0x4}, 0x94) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000040)={0x1b, 0x0, 0x0, 0x80000000, 0x0, 0x0, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0xfffffffe}, 0x50) socket$nl_generic(0x10, 0x3, 0x10) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000003c0)={0x18, 0xb, &(0x7f0000000640)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020000000000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], &(0x7f00000004c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000300)='rcu_utilization\x00', r5, 0x0, 0x4}, 0x18) unshare(0x2a020400) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f0000000280)=ANY=[@ANYBLOB="1801000021000000000000003b810000850000006d000000850000000700000095"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000002c0)={&(0x7f0000000000)='ext4_es_lookup_extent_enter\x00', r6}, 0x10) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000300)={0x1b, 0x0, 0x0, 0x1df3, 0x0, 0x1, 0x5, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x1}, 0x50) getsockname$packet(0xffffffffffffffff, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x4000) bpf$BPF_BTF_GET_NEXT_ID(0x17, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0x0, 0x0, 0x0, 0x0}, 0x94) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) writev(0xffffffffffffffff, &(0x7f0000003500)=[{0x0}, {0x0}, {0x0}], 0x3) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f00000005c0)={{}, 0x0, &(0x7f0000000580)='%pK \x00'}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) sendmsg$TIPC_CMD_SHOW_NAME_TABLE(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000006c0)={0x30, 0x0, 0x1, 0x0, 0x25dfdbfc, {{}, {0x0, 0x6}, {0x14}}}, 0x30}, 0x1, 0x0, 0x0, 0x44000}, 0xc4000) r8 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$AUDIT_SIGNAL_INFO(r7, &(0x7f00000009c0)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f00000008c0)={&(0x7f0000000600)={0x10, 0x3f2, 0x8, 0x70bd27, 0x25dfdbfd, "", ["", ""]}, 0x10}, 0x1, 0x0, 0x0, 0x40010}, 0x4048000) r9 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(r8, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000b80)={0xffffffffffffff02, r9, 0x9c3fa077fa966179, 0x78bd29, 0x25dfdbff, {{0x7e}, {@void, @val={0xc, 0x99, {0x916d, 0x15}}}}, [@NL80211_ATTR_DURATION={0x0, 0x57, 0x7fffffff}, @chandef_params=[@NL80211_ATTR_WIPHY_EDMG_BW_CONFIG={0x0, 0x119, 0x6}, @NL80211_ATTR_WIPHY_EDMG_BW_CONFIG={0x0, 0x119, 0xd}], @chandef_params=[@NL80211_ATTR_WIPHY_FREQ_OFFSET={0x0, 0x122, 0x77}, @NL80211_ATTR_WIPHY_EDMG_BW_CONFIG={0x0, 0x119, 0x8}, @NL80211_ATTR_CENTER_FREQ2={0x0, 0xa1, 0x8000}, @NL80211_ATTR_CENTER_FREQ2={0x0, 0xa1, 0x9}], @NL80211_ATTR_DURATION={0x0, 0x57, 0x3}]}, 0x20}}, 0x4008054) 2.807000641s ago: executing program 0 (id=2641): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f00000035c0)={0x0, 0x0, &(0x7f0000003580)={&(0x7f0000000040)=ANY=[@ANYBLOB="44010000100001000000000800000000fc0100000000000000000000000000000a01010000000000000000000000000000000000200000000000202032000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="ffffffff000000000000000000000000000000006c000000ac1414bb00000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000001000000000000000000000100000000000000100000000000000000000000000000000004000000000000000d000000000000000a0000000000000000000000000000000000000000000000000000000a0001070000000000000000480003006465666c61746500000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000b000000000000000000000000000c001c"], 0x144}}, 0x20000000) 2.687942877s ago: executing program 0 (id=2643): r0 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r1) ioctl$IOCTL_GET_NCIDEV_IDX(r0, 0x0, &(0x7f00000000c0)) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)=@updpolicy={0x1bc, 0x19, 0x1, 0x0, 0xfffffffe, {{@in=@private, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x3c, 0x0, 0xffffffffffffffff}, {0x0, 0x0, 0x1, 0x100000000, 0xca8, 0x0, 0x1}, {0x3, 0x0, 0x6}, 0xff, 0x0, 0x2}, [@tmpl={0x104, 0x5, [{{@in6=@dev={0xfe, 0x80, '\x00', 0x20}, 0x4d5, 0x3c}, 0x0, @in6=@mcast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, {{@in6=@remote, 0x4d3, 0x2b}, 0x0, @in6=@dev={0xfe, 0x80, '\x00', 0xd}, 0x0, 0x0, 0x0, 0x0, 0x800, 0x3, 0x4}, {{@in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x0, 0x6c}, 0x0, @in=@local, 0xfffffffc, 0x0, 0x3}, {{@in6=@local, 0x2, 0x33}, 0x0, @in6=@ipv4={'\x00', '\xff\xff', @loopback}, 0x3, 0x4, 0x0, 0x81, 0x8}]}]}, 0x1bc}, 0x1, 0x0, 0x0, 0x4000040}, 0x0) sendmsg$NFC_CMD_DEV_UP(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r2, @ANYBLOB="010026bd70003c0200000200000008000100", @ANYRESHEX], 0x1c}, 0x1, 0x0, 0x0, 0x88c0}, 0x0) write$nci(r0, &(0x7f00000003c0)=ANY=[@ANYBLOB="600608fc03090105040601b8"], 0xc) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0xc1842, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000680)={0x11, 0x3, &(0x7f0000000100)=ANY=[@ANYBLOB="1800000000000000000000000000000195"], 0x0}, 0x94) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000680)={0x11, 0x3, &(0x7f0000000100)=ANY=[], &(0x7f00000000c0)='syzkaller\x00'}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f00000001c0)='inet_sk_error_report\x00', r5}, 0x10) r6 = socket$kcm(0x2, 0x1, 0x106) sendmsg$inet(r6, &(0x7f0000000080)={0x0, 0x3, 0x0}, 0x30004001) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r8 = socket$inet(0x2, 0x3, 0x6) sendmsg$TIPC_CMD_GET_NODES(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000280)={&(0x7f0000000200)={0x1c, 0x0, 0x8, 0x70bd2d, 0x25dfdbfc, {}, ["", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0xd6597fb269de4639}, 0x4004) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r8, 0x89f3, &(0x7f0000000900)={'gre0\x00', &(0x7f0000000880)={'tunl0\x00', 0x0, 0x10, 0x21, 0xe38, 0x36, {{0x5, 0x4, 0x3, 0x4, 0x14, 0x68, 0x0, 0xf0, 0x39, 0x0, @multicast1, @rand_addr=0x64010100}}}}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000100)={'syztnl2\x00', &(0x7f0000000380)={'sit0\x00', 0x0, 0x7, 0x1, 0x0, 0x6, {{0x5, 0x4, 0x2, 0x2d, 0x14, 0x64, 0x0, 0xe0, 0x2f, 0x0, @local, @empty}}}}) r11 = socket$netlink(0x10, 0x3, 0x15) r12 = socket$alg(0x26, 0x5, 0x0) bind$alg(r12, &(0x7f0000000040)={0x26, 'skcipher\x00', 0x0, 0x0, 'adiantum(xts-twofish-avx,camellia-asm,cbcmac(aes))\x00'}, 0x58) sendmsg$DEVLINK_CMD_SB_PORT_POOL_SET(r11, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)=ANY=[@ANYBLOB="04010000100053"], 0x104}, 0x1, 0x0, 0x0, 0x20040890}, 0x200080c0) ioctl$TUNSETIFF(r7, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x1}) r13 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r13, 0x8933, &(0x7f0000000000)={'wlan1\x00'}) syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(r13, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000fc0)={&(0x7f00000004c0)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYBLOB="8c407ac3274a37802c577919782a7980", @ANYBLOB="010000000000004574000200000008000300", @ANYRES32=r9, @ANYBLOB="080026006c0900000800270001000000", @ANYRES16=r10], 0x2c}}, 0x0) socket$inet_udp(0x2, 0x2, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) 2.652787864s ago: executing program 4 (id=2644): r0 = socket$l2tp6(0xa, 0x2, 0x73) r1 = bpf$MAP_CREATE(0x100000000000000, &(0x7f0000000140)=ANY=[@ANYBLOB="0a00000016000000b40000007f"], 0x48) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0xb, &(0x7f0000000040)=ANY=[@ANYBLOB="18080000000000000000000000000000851000000600000018100000", @ANYRES32=r1, @ANYBLOB="00000000000000006100ed0000000000180000000000000000000000000000009500000000000000b50a00000000000095"], &(0x7f0000000000)='GPL\x00', 0x4, 0xee, &(0x7f0000000340)=""/238, 0x0, 0x0, '\x00', 0x0, 0x900, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3}, 0x94) bind$l2tp6(r0, &(0x7f00000003c0)={0xa, 0x0, 0x0, @remote, 0x200, 0x4}, 0x20) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000480), r2) sendmsg$NLBL_CIPSOV4_C_ADD(r2, &(0x7f0000000540)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="07022cbd7000000000000100000008000880040007012c0004800500030001000000050003000000000005000300010000000500030080ff0000050003000200000008000100030000000800020001"], 0x58}}, 0x880) r4 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NLBL_UNLABEL_C_STATICADD(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000140)={0xbc, r4, 0x400, 0x70bd26, 0x25dfdbff, {}, [@NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'bridge_slave_1\x00'}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @remote}, @NLBL_UNLABEL_A_ACPTFLG={0x5}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @private2}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @initdev={0xac, 0x1e, 0x1, 0x0}}, @NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'macvlan0\x00'}, @NLBL_UNLABEL_A_SECCTX={0x23, 0x7, 'system_u:object_r:var_log_t:s0\x00'}, @NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'macvlan0\x00'}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, @NLBL_UNLABEL_A_ACPTFLG={0x5}]}, 0xbc}, 0x1, 0x0, 0x0, 0x4000000}, 0x4000) r5 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) setsockopt$SO_TIMESTAMPING(r5, 0x1, 0x25, &(0x7f0000000100)=0x11, 0x4) bind$bt_hci(r5, &(0x7f0000000040)={0x1f, 0xffffffffffffffff, 0x2}, 0x6) recvmmsg(r5, &(0x7f0000000880)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)=""/54, 0x36}, 0x4fb}], 0x1, 0x12020, 0x0) 2.463021889s ago: executing program 1 (id=2645): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) syz_genetlink_get_family_id$tipc(0x0, 0xffffffffffffffff) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x13, &(0x7f0000000180)=ANY=[@ANYBLOB="180000000000080000000000000000001801000020786c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000002d0000001801000020756c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000002d00000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000600)={&(0x7f00000005c0)='sys_enter\x00', r2}, 0x10) getuid() write$tun(r0, &(0x7f00000001c0)={@val={0x0, 0x8864}, @void, @eth={@multicast, @local, @val={@void, {0x8100, 0x4}}, {@ipv4={0x800, @generic={{0x5, 0x4, 0x1, 0x6, 0x1c, 0xf4, 0x0, 0x41, 0x11, 0x0, @empty, @rand_addr=0x64010100}, "e31120fb0344e91c"}}}}}, 0x32) 2.458462046s ago: executing program 2 (id=2646): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000013c0)={0x18, 0x3, &(0x7f0000000340)=ANY=[@ANYBLOB="180000000000000000000000000000009500000000000000abcad53a4930450d66a36667a031d63145bd6ad9b1041d4d39b2dc1ed8653d20990fdfea9f23a8dbfe400a532ddd8696b3d51b35af440bb640e232eeb4ec95001ecae77424ad15aae919835f32ba6c63200f1cb4f35a1ebb69d6499f554162fabc0c7e29721255f806fdcdc3ae519c156f8bf1e2f8ca4810ecc6648c"], &(0x7f0000000000)='syzkaller\x00'}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000040)='contention_end\x00', r0}, 0x10) socket$nl_route(0x10, 0x3, 0x0) (async) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000200)={'ip6tnl0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000140)=@newqdisc={0x40, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_clsact={0xb}, @TCA_INGRESS_BLOCK={0x8, 0xd, 0x8}, @TCA_EGRESS_BLOCK={0x8, 0xe, 0x8}]}, 0x40}}, 0x0) (async) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000140)=@newqdisc={0x40, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_clsact={0xb}, @TCA_INGRESS_BLOCK={0x8, 0xd, 0x8}, @TCA_EGRESS_BLOCK={0x8, 0xe, 0x8}]}, 0x40}}, 0x0) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(&(0x7f0000000200), r3) (async) syz_genetlink_get_family_id$nl802154(&(0x7f0000000200), r3) sendmsg$NL802154_CMD_GET_WPAN_PHY(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYBLOB], 0x24}, 0x1, 0x0, 0x0, 0x41}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x4, 0x5, &(0x7f0000000240)=ANY=[@ANYBLOB="180200000000000000000000000068008500000087000000850000005000000095"], &(0x7f0000000400)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) (async) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x4, 0x5, &(0x7f0000000240)=ANY=[@ANYBLOB="180200000000000000000000000068008500000087000000850000005000000095"], &(0x7f0000000400)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) unshare(0x26020480) r5 = socket$unix(0x1, 0x2, 0x0) recvmsg$unix(r5, &(0x7f0000000700)={&(0x7f0000000440), 0x6e, &(0x7f0000000300)=[{&(0x7f0000000280)=""/29, 0x1d}, {&(0x7f00000004c0)=""/181, 0xb5}, {&(0x7f00000005c0)=""/85, 0x55}, {&(0x7f0000000640)=""/109, 0x6d}], 0x4, &(0x7f00000006c0)}, 0x1) (async) recvmsg$unix(r5, &(0x7f0000000700)={&(0x7f0000000440), 0x6e, &(0x7f0000000300)=[{&(0x7f0000000280)=""/29, 0x1d}, {&(0x7f00000004c0)=""/181, 0xb5}, {&(0x7f00000005c0)=""/85, 0x55}, {&(0x7f0000000640)=""/109, 0x6d}], 0x4, &(0x7f00000006c0)}, 0x1) bpf$OBJ_PIN_PROG(0x6, &(0x7f00000002c0)=@generic={0x0, r4}, 0x18) (async) bpf$OBJ_PIN_PROG(0x6, &(0x7f00000002c0)=@generic={0x0, r4}, 0x18) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) accept(r6, &(0x7f0000000900)=@alg, &(0x7f0000000740)=0x80) (async) r7 = accept(r6, &(0x7f0000000900)=@alg, &(0x7f0000000740)=0x80) sendmmsg$alg(r7, &(0x7f00000008c0)=[{0x0, 0x0, &(0x7f0000000740), 0x0, &(0x7f0000000a00)=[@iv={0x80, 0x117, 0x2, 0x65, "117dada4221d8c9a20146e2cb35a11fcbf790b661af28fa548a1c2a0774efae5c4b675976f152155eba93837a1be45bcdba15c01fe0e37f0c91f6eafe50c6c04d1149ad1385efc063916e119f5424ae916a364d672996bd434f00262332cdf0a47446fcc2b"}, @op={0x18, 0x117, 0x3, 0x1}, @iv={0x98, 0x117, 0x2, 0x7e, "db50758de17b51f113e13b394896cd659d1fccaca8a638d980ce7580e321447bfe33b17e8777ce9c37cf02d1e4cd6e9522b323e16cf94ee1f4d42e7d090186ac2c67f6124bfe8df561c1b9de6f1e14303239ac02828bb666b59d5ae45d3d71fd582ee3812e67542ae541bf08486e4fee47390f9b1edc01af79b74f654636"}, @assoc={0x18, 0x117, 0x4, 0x7}], 0x148, 0x4}], 0x1, 0x80) (async) sendmmsg$alg(r7, &(0x7f00000008c0)=[{0x0, 0x0, &(0x7f0000000740), 0x0, &(0x7f0000000a00)=[@iv={0x80, 0x117, 0x2, 0x65, "117dada4221d8c9a20146e2cb35a11fcbf790b661af28fa548a1c2a0774efae5c4b675976f152155eba93837a1be45bcdba15c01fe0e37f0c91f6eafe50c6c04d1149ad1385efc063916e119f5424ae916a364d672996bd434f00262332cdf0a47446fcc2b"}, @op={0x18, 0x117, 0x3, 0x1}, @iv={0x98, 0x117, 0x2, 0x7e, "db50758de17b51f113e13b394896cd659d1fccaca8a638d980ce7580e321447bfe33b17e8777ce9c37cf02d1e4cd6e9522b323e16cf94ee1f4d42e7d090186ac2c67f6124bfe8df561c1b9de6f1e14303239ac02828bb666b59d5ae45d3d71fd582ee3812e67542ae541bf08486e4fee47390f9b1edc01af79b74f654636"}, @assoc={0x18, 0x117, 0x4, 0x7}], 0x148, 0x4}], 0x1, 0x80) sendmsg$nl_xfrm(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in=@multicast1=0xe0000002, @in6=@loopback, 0xfffd, 0x0, 0xfffe, 0x0, 0xa, 0x80, 0x80, 0x87}, {0x0, 0x0, 0x3, 0x0, 0x6, 0x0, 0x0, 0x7ff}, {0xfffffffffffffffd}, 0x9, 0x0, 0x0, 0x0, 0x0, 0x1}}, 0xb8}}, 0x0) r8 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0100000004001000040122000b00000001000000", @ANYRES32, @ANYBLOB="0000008000"/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f00000009c0)={0x0, 0x0, &(0x7f0000000380), &(0x7f0000000380), 0x2, r8}, 0x38) bpf$BPF_MAP_LOOKUP_AND_DELETE_BATCH(0x19, &(0x7f0000000080)={0x0, &(0x7f00000001c0)=""/40, &(0x7f00000001c0), &(0x7f00000000c0), 0x1, r8}, 0x38) r9 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r9, 0x8933, &(0x7f0000000000)) (async) ioctl$ifreq_SIOCGIFINDEX_team(r9, 0x8933, &(0x7f0000000000)={'team0\x00', 0x0}) sendmsg$nl_route(r9, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000006c0)=ANY=[@ANYBLOB="4c0000001000010025bd7000fedbdf2500000000", @ANYRES32=r10, @ANYBLOB="10080400000000002c002b8008000800", @ANYRES32, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB='\b\x00\b\x00', @ANYRES32, @ANYBLOB='\b\x00\b\x00', @ANYRES32, @ANYBLOB="08000300010096"], 0x4c}, 0x1, 0x0, 0x0, 0x20000000}, 0x4000000) bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0x12, 0x4, &(0x7f0000000140)=ANY=[@ANYBLOB="1800000001000000000000008d08000071122d0000000000"], 0x0, 0x3, 0x0, 0x0, 0x41100, 0x8, '\x00', 0x0, @cgroup_sock_addr=0xf, 0xffffffffffffffff, 0xf00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xa}, 0x94) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) r11 = socket$netlink(0x10, 0x3, 0x0) r12 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x4, 0x4, &(0x7f0000000240)=ANY=[@ANYBLOB="18000000000000000000000000000008850000007600000095"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x80) sendmsg$nl_route_sched(r11, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000480)={&(0x7f00000004c0)=@newtaction={0x70, 0x30, 0xffffffffffffffff, 0x0, 0x0, {}, [{0x5c, 0x1, [@m_bpf={0x58, 0x1, 0x0, 0x0, {{0x8}, {0x31, 0x2, 0x0, 0x1, [@TCA_ACT_BPF_PARMS={0x18, 0x2, {0x1}}, @TCA_ACT_BPF_FD={0x8, 0x5, r12}, @TCA_ACT_BPF_NAME={0xc, 0x6, './file0\x00'}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x70}}, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) (async) r13 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r13, 0x0, 0x4004) 2.455814877s ago: executing program 4 (id=2647): r0 = socket(0x840000000002, 0x3, 0x100) r1 = socket$inet(0xa, 0x801, 0x84) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(0xffffffffffffffff, 0x84, 0x1f, 0x0, 0x0) connect$inet(r1, &(0x7f0000000340)={0x2, 0xfffd, @private=0xa010100}, 0x10) bpf$MAP_CREATE(0x0, 0x0, 0x48) socket$unix(0x1, 0x1, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000500)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000786c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000002d00000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000080)='sched_switch\x00', r2}, 0x10) r3 = socket$unix(0x1, 0x1, 0x0) connect$unix(r3, &(0x7f0000000000)=@file={0x1}, 0x6e) connect$unix(r3, &(0x7f0000000080)=@file={0x1}, 0x6e) r4 = accept4(r1, 0x0, 0x0, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(r4, 0x84, 0x14, &(0x7f0000000440), &(0x7f0000000700)=0x4) r5 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r5, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10) syz_emit_ethernet(0x2a, &(0x7f00000001c0)={@local, @empty, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x4e20, 0x8}}}}}, 0x0) setsockopt$inet_int(r5, 0x0, 0xc, &(0x7f00000000c0)=0x4, 0x4) recvmmsg(r5, &(0x7f0000008100)=[{{0x0, 0x0, 0x0}, 0x9}], 0x1, 0x2, 0x0) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @remote}, 0x10) sendmmsg$inet(r0, &(0x7f0000005240), 0x4000095, 0x0) bpf$BPF_MAP_LOOKUP_AND_DELETE_BATCH(0x1b, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000240), 0x0, 0x2}, 0x38) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000002c0)={{{@in=@loopback, @in=@dev={0xac, 0x14, 0x14, 0x3b}, 0x4e21, 0x90, 0x4e22, 0xa3, 0xa, 0x10, 0x20, 0x2b}, {0x10, 0x1, 0xa173, 0x2000000000000006, 0xfffffffffffffffb, 0x7b, 0xeb, 0xb9d}, {0x8d, 0x7, 0xa4, 0x101}, 0x5, 0x6e6bbf, 0x2, 0x1, 0x2, 0x1}, {{@in6=@empty, 0x4d6, 0x32}, 0xa, @in=@loopback, 0x34ff, 0x5, 0x0, 0xc7, 0x4, 0x10000}}, 0xe8) r6 = socket(0x2b, 0x80801, 0x1) setsockopt$IP_VS_SO_SET_STARTDAEMON(r6, 0x0, 0x48b, &(0x7f0000000040)={0x2, 'lo\x00', 0x3}, 0x18) writev(r0, &(0x7f0000000240)=[{&(0x7f0000000180)="333d7e88ff9e795a35034598d8", 0xd}, {&(0x7f0000000200)="4f4ee2e98bc498576205d9a1fbc52410c8079052689e8db838cdba1214a005a147d4fdb7a0a8644dab9f23f123eea7", 0x2f}], 0x2) 2.22713856s ago: executing program 2 (id=2648): r0 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0xe, 0x4, &(0x7f0000000400)=ANY=[], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00}, 0x94) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000080)=ANY=[@ANYRES32, @ANYRES32=r0, @ANYBLOB="0500000002"], 0x10) socket$inet(0x2, 0x1, 0x2000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = socket$nl_route(0x10, 0x3, 0x0) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) (async) r4 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) r5 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0x2a0840, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000380)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0}, 0x94) socket$inet6(0xa, 0x2, 0x0) (async) r6 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r6, &(0x7f0000f5dfe4)={0xa, 0x4e20}, 0x1c) r7 = bpf$MAP_CREATE(0x0, &(0x7f0000000540)=@bloom_filter={0x1e, 0xfc, 0x2, 0x1000, 0x20, 0xffffffffffffffff, 0xa, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x1, 0x1, 0x1}, 0x50) ioctl$F2FS_IOC_MOVE_RANGE(r6, 0xc020f509, &(0x7f0000000240)={r1, 0x6, 0xfffffffffffffffb, 0x8}) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000840)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x10000, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x5, 0x1}, 0x50) (async) r9 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000840)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x10000, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x5, 0x1}, 0x50) r10 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000008c0)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0xfc, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x2, 0x3}, 0x50) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000980)={0x6, 0x16, &(0x7f00000006c0)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x9}, {{0x18, 0x1, 0x1, 0x0, r7}}, {}, [@func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffffe}, @tail_call={{0x18, 0x2, 0x1, 0x0, r3}}, @alu={0x4, 0x1, 0x0, 0x6, 0x7, 0xffffffffffffffff, 0xa}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000180)='syzkaller\x00', 0x1, 0xb8, &(0x7f0000000780)=""/184, 0x41100, 0x8, '\x00', 0x0, 0x25, r8, 0x8, &(0x7f0000000300)={0x9, 0x3}, 0x8, 0x10, 0x0, 0x0, 0x0, 0x0, 0x2, &(0x7f0000000440)=[r9, r10], &(0x7f00000005c0)=[{0x1, 0x5, 0x3, 0x8}, {0x2, 0x3, 0xd, 0x8}], 0x10, 0x6}, 0x94) syz_emit_ethernet(0xbe, &(0x7f0000000000)={@local, @link_local, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0xb0, 0x0, 0x0, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x4e20, 0x9c, 0x0, @wg=@initiation={0x1, 0x0, "7b4b143b7461fd777b1c012bd14efb9f49fcdb8f080c26a04883ad5c8c82b8af", "584cbf2649a50f2dbc43efa8698dfa871c51852e4451b57d037ad3c045942824251d7d17b5191584cdd4fbe40a27424d", "bcfd56f1373669caaa2f19935e6996c7096ffe4f3a4745a8f762b964", {"9a3bfbc1f39cb307b3472eb9cdb042d2", "643fcbb2c5a57df67d544af6e8dafe09"}}}}}}}, 0x0) (async) syz_emit_ethernet(0xbe, &(0x7f0000000000)={@local, @link_local, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0xb0, 0x0, 0x0, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x4e20, 0x9c, 0x0, @wg=@initiation={0x1, 0x0, "7b4b143b7461fd777b1c012bd14efb9f49fcdb8f080c26a04883ad5c8c82b8af", "584cbf2649a50f2dbc43efa8698dfa871c51852e4451b57d037ad3c045942824251d7d17b5191584cdd4fbe40a27424d", "bcfd56f1373669caaa2f19935e6996c7096ffe4f3a4745a8f762b964", {"9a3bfbc1f39cb307b3472eb9cdb042d2", "643fcbb2c5a57df67d544af6e8dafe09"}}}}}}}, 0x0) r11 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00', 0x7}, 0x94) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000040)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x0, 0x0, 0x2}}, 0x0, 0x1a}, 0x28) (async) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000040)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x0, 0x0, 0x2}}, 0x0, 0x1a}, 0x28) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r11, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) (async) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r11, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) recvmmsg(r6, &(0x7f00000057c0)=[{{0x0, 0x0, 0x0}, 0x3}, {{0x0, 0x0, &(0x7f0000002cc0)=[{0x0}], 0x1}, 0xa1}], 0x2, 0x0, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000200), 0x0) (async) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000200), 0x0) sendmsg$netlink(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000400)=[{&(0x7f0000004780)={0x358, 0x1f, 0x2, 0x0, 0x0, "", [@nested={0x348, 0x0, 0x0, 0x1, [@typed={0xc, 0x1, 0x0, 0x0, @u64=0x3}, @typed={0x14, 0x0, 0x0, 0x0, @ipv6=@rand_addr=' \x01\x00'}, @generic="50bb2d6f67c59d6fabadb107d0def49c88ea04abde1d5e8d3fb22a1b5046778bdafefc46b0449ade68bf84b36ec72dd71265fc2e882348c26c2126237dd5b37f5ae655b1086cda40e00aec58d567754734be31d750351dc002eb43d9621dc08c029d1608a487f26fbe8101000000010000008b9482565856555ee923c65973deb0a99b962bc0fe94a37cae3697bd7b85b3a682167c43dbf137115a40ebddcad74875ec58e9a3ddb9ad02a078cf0d972df9e99f079767734f69ce475f55ac64337803f5eb", @nested={0xc4, 0x17, 0x0, 0x1, [@generic="019d1035435e43932e886da0b495e8d4c9b065e24fef0cb119c6f8b05ba7c6515581ad4294c3a1e65b6664f164e805b87cac5ff4d5b30ef2e1cf57d29345a99117475dbd5c802345c0436193b36db3037194f215534da4335d85f4eaa6eb9dfece5319835c2ecfbafe734a298d35980cc75dbfc42fcca8d25e81a808fd8f81e6b4e2ad0d3ef05c268a3d76e57ea043aa4cd60fc7f2199bf7062ea6248ad57837abda5e471a2ba813b57b3049dac6c287f809cca714cf16c6", @typed={0x8, 0x137, 0x0, 0x0, @ipv4=@local}]}, @typed={0x8, 0x3a, 0x0, 0x0, @u32=0x6f0}, @nested={0x18d, 0x101, 0x0, 0x1, [@generic="57f18fd504d8c24a3f71d02a432845380c3e8e840b786fee73a51898ee2cf7ca9bdae391ad50afbf9d462b90b091104445ec91abe6696c44d762cbb335525d09870de44047199f920d1489980777d62d48758cb8adf66cfa5546d5ee795f26f474ca05c7fec47579cfb45e536337f7afa7187ea3bfcbf21d54970a91b6b484c1fcebf7279def8d38cab13e29f2adaabccf75b599688df359e0688462da605fd551121f02db64c0c01a5d1712fdf0f1ffa98802d945b5b77e31f8414361ed619d2701d1cda95494cc04246ec7fd4d478c3e655aee6e", @typed={0x8, 0x62, 0x0, 0x0, @uid=0xee00}, @typed={0x8, 0x107, 0x0, 0x0, @fd=r5}, @typed={0x8, 0xa3, 0x0, 0x0, @u32=0x2}, @generic="2cf88e6abaade6aff0130f0557929358a7d45d30fe5049bea81f782372d0753f3a220fb7dcecfc16e4b3caaceeb6c8ba8296ff000b7bd6148e3b1b876dcb21993175f80a0a8b8a34310d8daf61157f9bb0d38d26deb2034d5f1550bda857742569112173ca972ccd329c0feb25ed4fe02d566b3a97bf87f238e58f7914a109fa43faa43bb79dc404851f20a236e4c68db6dfd555", @nested={0x8, 0xd8, 0x0, 0x1, [@nested={0x4, 0xaf}]}]}, @nested={0x4, 0xe1}]}]}, 0x358}], 0x1, 0x0, 0x0, 0x10004040}, 0x0) sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000940)={&(0x7f00000013c0)=ANY=[@ANYBLOB="640000001000030400"/20, @ANYRES32=0x0, @ANYBLOB="e5fda988000000002800128009000100766c616e00000000180002800c0002001c0000001f000000060001000000000008000500", @ANYRES32=r2, @ANYBLOB='\b\x00\n\x00', @ANYRES32, @ANYBLOB="0a000100000070"], 0x64}, 0x1, 0x0, 0x0, 0x8811}, 0x0) (async) sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000940)={&(0x7f00000013c0)=ANY=[@ANYBLOB="640000001000030400"/20, @ANYRES32=0x0, @ANYBLOB="e5fda988000000002800128009000100766c616e00000000180002800c0002001c0000001f000000060001000000000008000500", @ANYRES32=r2, @ANYBLOB='\b\x00\n\x00', @ANYRES32, @ANYBLOB="0a000100000070"], 0x64}, 0x1, 0x0, 0x0, 0x8811}, 0x0) setsockopt$IP_VS_SO_SET_ADDDEST(0xffffffffffffffff, 0x0, 0x487, &(0x7f00000000c0)={{0x6, @loopback, 0x4e21, 0x4, 'wlc\x00', 0x0, 0xfffffffc, 0x18}, {@loopback, 0x4e20, 0x2, 0x7ff, 0x4, 0x6}}, 0x44) 1.870843274s ago: executing program 2 (id=2650): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000007c0)={0x3, 0x4, &(0x7f0000000980)=@framed={{0x18, 0x2, 0x0, 0x0, 0xfffff610, 0x0, 0x0, 0x0, 0x7fb}, [@call={0x85, 0x0, 0x0, 0x7a}]}, &(0x7f0000000100)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x8}, 0x94) r0 = syz_init_net_socket$ax25(0x3, 0x3, 0xc3) setsockopt$ax25_int(r0, 0x101, 0x9, 0x0, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) unshare(0x22020600) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, 0x0) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x3, 0xc, &(0x7f0000000140)=ANY=[@ANYBLOB="18020000000000000000000000000000850000002e0000001801000020696c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000009b00000095"], &(0x7f0000000bc0)='GPL\x00', 0x2, 0x0, 0x0, 0x41100}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r3, 0x0, 0xe, 0x0, &(0x7f0000000100)="e0b9547ed387dbe9abc89b6f5bec", 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000d00)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01020000000000000000010000000900010073797a30000000002c000000030a01080000000000000000010000000900030073797a32000000000900010073797a30000000005c000000060a010400000000000000000100000008000b40000000000900010073797a300000000034000480300001800a0001006d617463680000002000028008000300b07346e30a0001007374617465000000080002"], 0xd0}}, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000440), r5) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f0000000100)={'wlan0\x00'}) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$fou(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$FOU_CMD_GET(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x14, r7, 0x1}, 0x14}}, 0x0) r8 = socket$kcm(0x29, 0x5, 0x0) setsockopt$kcm_KCM_RECV_DISABLE(r8, 0x119, 0x2, 0x0, 0x0) r9 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000800), r1) sendmsg$NLBL_UNLABEL_C_STATICREMOVEDEF(r1, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000840)=ANY=[@ANYBLOB='\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="010029bd7000fcdbdf250700000014000200ff020000000000000000000000000001080004006401010214000300fe8000000000000000000000000000aa"], 0x44}, 0x1, 0x0, 0x0, 0x20000801}, 0x448c0) 1.839359187s ago: executing program 1 (id=2651): bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000000dc0)=ANY=[@ANYBLOB="b7000000a5517f5fbfa30000000000000703000028feffff720af0fff8ffffff71a4f0ff7fff0000b7060000000000012e400300000000006506020001cd00007118540000000000c3640000000000006b0a00fe00000000850000002e000000b7000000000000009500000000000000023bc065b7a379d179fc9e94af69912435f1b6a693172e6191a12bebf9f9804ea033388cd15b65877ad4b200000000000000000beca090f32050e436fe275daf51efd601b6bf01c8e8b1abe4fef3bef7074815ae98743d1ace4c46631256dd19aed0d600c0b6199fe3ff3128e599b0eaebbdbd7359a48f5b0afc3996792043a6787bac46aa7aa400000000000069669622208266f896ba2c9e73c2efeec2dc565fbafb2cb63f5fef9ab79ff8abaa8a08f54a062107e9bb3e980fff675c8d3e91df6648a7a6aebcb63e0867b75690152af27711f0cbb9c06018d21bf3f87b8eb65323b4267a526d53442db8e48dbc5ce47d67d07441a7975d5e41b14fd0154a8246249952a8b61633ce068220defe09d3b1136af6d03e9cf996c13d1bfcdc54567a9ca80dec2e943fe4ae7c617cc071f7add70cfbd48f8f6b50fe6a8297d88efa73e7e601040000b4a685969f28902bdecf66ef39755de79ed2c711477febc96231a53984d00877301d0ec62427a8e38618fdd1ce9aaed569ebc5f2e58d6028e66139a737cc7146a131d47dcebb32ed67021d76e983223c998aec22242ae54e87f438d26982876b58f9134366952f7399a733f07138a736924f3709000000e97f0c117ec439c6b7b965752bbc06eced08d97a32ae4b1ad4d11c5b6f68ee841975233e4cea13f3ef04b2cab9cc256d4539dbafd888c7097c1169e0bebcc81ca3da40bf34b6c9c1da2d6ed8acaf2a8091820ff4cf6be74ddca8bf2eed0e11b2139e8c3ec95436af5269d5792decda7d8b5dcf8640b504ba23c6d0a7f67cdfd27328100ebf9319a56f0f9cee17deecf747f3493f1dc39551f4c9a40b3e93fa80b8234ccbf39a9ef09bd97321f0dc20956f44ba2c5ec2e7569b05cf4690ddc189f174046a8b214acf23f42fb51ed4819e6b4cb5a8bf2b559d0c198fe0315483b8beb9801d06c58b22dd713fe3b7ef18e21081aacfd091b754125a488cea18255f79bebcb3051f622f8a1d9af1908e88a58774a24f35a4ccdbedea6212286c23dd89c2b4b90647f17231472af8dda7f3ab20f093aad3ce875f7458039ee6d0a50deb7bc8eb393f056a5e7725531c5485278e0362338e2e2710fe00465e0d182a322091022cf5b814eeb9b3cab21196581e4d92d0b6fe5525285eea359274f1f21d69233bbe94941f10ba292100000000000000000000000000000000c18e93a0c5231779f2ee201e9fe7e63e84b57b5f05ecd278919bad330ffcb594b8255b3085b352ca9533d6c31c1a30158c30352f8a126a65cb6582e58aa641007418611df53a601c3a8fb8d2286e86abf98136f345446730f68f5d6d1817a9e1b09e5650d2599fbe719a45337d29eb3fef5f7f565457660dec6fe903a1c2ea4f40a8ea1c179892afa219fc69a44163f0d731de418e9fd82a8c4661caea674b19242d1840d047882f640ea248457288c5ffb63e857da03ff5c0475c3cfff41c4806f1dc750eb1c45ec3a2a0b064834010604d6f88a29e8e9bda2bc9c18d1b53a08f25d62ccaa46bc0235c830a7b3fe64bc6031b431bcad6b698a1ba6027870ea9e55fafbbf140c5f82a33ee4ac793b989c12a5827a7957f4d8136cf918b7cbf5bc5fc64c8001992536584586edded6f65bdd371ac84fd5cc60ab79b84e9e85a1c54d5666a5d133e95eff121621dff14b9de7a188b8c5387f9da63c2cce405bc44079e34e2db2b275bfbb54841d647338cad74be91144b780cf381a6860f641446ef73bd11d45f5e4df8f3c6440d8425fd7382225cf8c2cada01bf3cd5cbc6a403173e0c89a491c75efc3c21b7825a521c6011945eef94abc3000000000000000000000000000000d71b794e9b4c145caf050429937eef4364d9e1cbe9150bccd9b2e73757f1f5e8ac50736cd3cbc029ede2869642841371bb4b9c1aaa8826889a909e6716b60e4b568b6761f8ccc7d35b0e66357746b10fc481b47e67f1e14408c1ef3e018a5e647e3f607654f3bf82bcfb42be038a272d82f8362944f608b3810000000019fda0b1b607f1ab34194ed954973f7a5accc0938d3364ab07574d0b32fc30f3ab73d012b63ee905e98ab6989ec2c840cd216eb18fedfb3b204e94e170bae930660368d3799c9b1bf7556ac57164966791626f06ad2e332341965f72141ec140b80efd7720ccdaa890b79bc4523386bd66553121543c9a35b7adcf2f6b257fefef1d6e1da2ee94d3f822bf45aad21e5b5a3788ab584090664065af39b0f43968dcd7c5f8e5a8dc6298691423fbf7e8e012260bc62f9422434a547ef7ca37953d435098d9b71edd1a03e46d0ade465d0c0db0a51f9e29cac05e5a04f94e"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0x45}, 0x48) 1.792631952s ago: executing program 0 (id=2652): r0 = socket$inet6(0xa, 0x80002, 0x0) setsockopt$sock_linger(r0, 0x1, 0x3c, &(0x7f0000000340)={0x1, 0x6d}, 0x8) sendmmsg$inet6(r0, &(0x7f00000011c0)=[{{&(0x7f0000000200)={0xa, 0x4e21, 0x0, @empty}, 0x1c, 0x0}}, {{&(0x7f0000000280)={0xa, 0x4e23, 0x0, @mcast2, 0x3}, 0x1c, &(0x7f0000000e00)=[{&(0x7f0000000940)="22b50d3b31160722de6ef2c0e20c330618268793ae64f4b555d44ed7e926f4c71d9d3e541d016c4c42c9110b1c13fd9d6baa6129152dca03765ceeb286fd4f6214be0f9669398157d2e27a7ac90785c9aff6b7", 0x53}, {&(0x7f00000009c0)="fe06efd4f23c0f8be13b76e0c83f33e1977e217a2620b1026488f6b5bd26c34930dfdd38e743cb8b62aca6f3ed80bc5040fb90384531b74ad1b10d2ba9609847c8017457b503b1c2a2caf49ce2aa210cd3d923aec5047bf53ae32a2eed8959f2e0b9f99ee42acade3be39b7d80673f740536eed72d10406c7f320669bb4400e536e0a08d1cb67d59719a967251088fb2405d3e0b9cb7449a169c9e8df48c8d0fa1d0a2599ace558150936ae0bbb0c68797279f728428038fd58ed496f1af916c0f64f7984f86fb4b82078294968cd1d2c0f9f83b4820306e87c3d813f4da82db918bd6d87e", 0xe5}, {&(0x7f0000000ac0)="1d8c788d297b710d6537f789f8e885d49d62344cdd42ddd4b6ea75b72dcd99cec8bb1b5d9e4ac3c93066fba090dc21baec77154d71725ecd237e14f9d817a5edeedde1957d0aa95dfa788d97f5d4d33a1a904eb780f1b8773a300d01ef61b796d7624a49198809ae5f68d5a24ac0af69c27cf70227d501082adeb128c90749ab545997f641c44a1b", 0x88}, {&(0x7f0000000b80)="9f15a81f0a7256b812e8158850d3ec2bafa947e744459e8381a0cc62125a8d927059d038044e8e3ce1d0fb3ac6a4847dc43bcde96088d5e3a30090462d1925702408e42e08937cb05ba2b33ad7f05e0fb2c9f4e33b49958bafa184cc91d20dea8e763befb2082a87c2c16822e52696688f18e929c00cd5743eaeb4af4830923cca29ebf57828803696a8bf5f5b1b4e725ef02fdf4628bf1841870e58e5f6945968780fdaccd5e0e2a2f04cafb87f853a49777a021682091553a18e73cb1a65482605f52ba28b5a8842be9337746071d57c4a7cd2229d2f4e5d4dea2b3ace0d13877cb9693d608658019d956d08b44f", 0xef}, {&(0x7f0000002300)="7b0aae334a0e541c040d7bfa7594e7e3e13481b61849a593a565c84b642571e16092b9f553c92de239142a13cfe447740b92dacf432b1e8bf1080da0c83242c9b7c32344b203d02d598227e713c4544ed2c36aeb2ff930c2e1273f0dde363cc30960626e50fe46f4a1690271729b0644f395614d9e9dd8cb511a634264a105475d833f5dab6268ca3bc45119d3ecd7987f6c450c9361f1476f46f782bbc1f786f3bfb5d4fc550af1197b684aee2da9ee735a5cd35774792ec11f6fb277c18269a8e98ada5a1d092d246a0556f13ec6391b7e482f03e7b1bd2fa09cac57fbcd65cf506f84d17b2b9f2bbee22544c44055158732f97be3f74c615e9d6eaff0cda500143808ba86ce32a028da179b4531eeee68f98c14e08c5fc66208f3880d89bcb61c4f1204cfca974b1ca0f9586514d398f7691b409ce2b5ebe77393e9712e0823755557c64653f38dfa32eb51f1fc4a1362177cdca9459477751a83e7b3dafc6edc35c0a442e2454b31fb2b398edf84ab4ea601f1d19f1356b4c49003e3f5d67cf8e3f08a806dd40518bfe7bf29ddd330be0c14404e63f91169de7689f7f4bbc78800c1bcee03a482463756926e8aeb6a2f084a60acf68ebdaa4d76347ca4e4de2662875b1936e151a645061b06da6c9268f5604e99cbbddd6d9a9893bb68b12f93a7c8659a90711d8bbbeb1fb6ebfd4515782f9d130339f810b5777fac3c4f2fe25c12db1dd443fb19dd23a8f96848a81796421d0e285da66b424060c14a271a90f45314579e1f963bc279c80557068ed8b97e60611cb4c385ebad0ce0e2cd3cd657f074413a7822f39bc2d0b1508854b41a8eb48788adaa26817d44283a7855c295628b31c54aa2f2708f17ce97bb31", 0x271}], 0x5}}], 0x2, 0x4004000) 1.691770772s ago: executing program 1 (id=2653): r0 = socket(0x1d, 0x2, 0x6) r1 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'erspan0\x00', 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000580)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_CONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x44, r4, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r5}, @void}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_MAC={0xa, 0x6, @from_mac}, @NL80211_ATTR_AUTH_TYPE={0x8}, @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}]]}, 0x44}}, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000080)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_VENDOR(r0, &(0x7f0000000280)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000140)={0x114, r4, 0x1, 0x70bd25, 0x25dfdbff, {{}, {@void, @val={0x8, 0x3, r6}, @val={0xc, 0x99, {0x7, 0x13}}}}, [@NL80211_ATTR_VENDOR_DATA={0xeb, 0xc5, "4873ec1218cebf673582c003970cb11b8412be896d949d547b6bbe0fdb26275517687a579967913892f76840c8895beff920963cc215e40ac049dfe5ea11ea9184909ecb43ad762fb2b1530819868cfe536d3b988f79f4f19ed3ca8917561bbb11b9fad96303f8e79af865ada43aff6a74575bf4f80486db00d1392bc93dfe6a18f2db38694d8594b61835990c01f7e6447f4a9f315f5e5bfc949863cf47a4b2d141c812a3aad78e3e7cbc7f02680a69c3aa0a55862cfba2326195dd573cfa6fdbd1ab8c65fbfbfc10e169e864039962c4fb73a89de26398bc9888a6f650e3ea51e0b3beae3959"}]}, 0x114}, 0x1, 0x0, 0x0, 0x4000801}, 0x0) bind$can_j1939(r0, &(0x7f0000000100)={0x1d, r2, 0x2, {0x1, 0xf0, 0x1}, 0xfe}, 0x18) 1.687201797s ago: executing program 2 (id=2655): r0 = syz_init_net_socket$x25(0x9, 0x5, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000002c0)=ANY=[], 0x78}, 0x1, 0x0, 0x0, 0x24048894}, 0x40) setsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1c, &(0x7f0000000240)={@remote}, 0x14) bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYRESHEX=r0, @ANYRESDEC, @ANYRES32=0x0, @ANYRESDEC=r0, @ANYBLOB='\x00'/28], 0x48) r3 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) connect$llc(r3, &(0x7f0000000180)={0x1a, 0x0, 0xf9, 0x8, 0x0, 0x0, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x3e}}, 0x10) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_FEATURES_SET(r4, &(0x7f0000002540)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='@\x00\x00\x00', @ANYRES16=0x0, @ANYRESOCT], 0x40}, 0x1, 0x0, 0x0, 0x40001}, 0x0) sendmmsg(r3, &(0x7f0000001380), 0x3fffffffffffeed, 0x0) getsockopt$IP_VS_SO_GET_DAEMON(r3, 0x0, 0x487, 0x0, 0x0) recvfrom$llc(r3, &(0x7f0000000000)=""/248, 0xf8, 0x40010001, 0x0, 0x0) listen(r3, 0xd) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f00000001c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRESOCT], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x29, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000340)={&(0x7f0000000400)='virtio_transport_alloc_pkt\x00', r5}, 0x18) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000580)={0x0, @in={{0x2, 0x4e23, @remote}}, 0xbbae, 0x4, 0x8001, 0x10, 0x4, 0xfffffff9, 0x5}, 0x9c) r6 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r6, &(0x7f0000000140), 0x10) setsockopt$SO_BINDTODEVICE_wg(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000040)='wg2\x00', 0x4) ioctl$SIOCPNGETOBJECT(0xffffffffffffffff, 0x89e0, &(0x7f0000000480)) bind$inet(r1, &(0x7f0000000400)={0x2, 0x4e23, @loopback}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f0000000000)={0x2, 0x24e23, @loopback}, 0x10) sendmmsg$inet(r1, &(0x7f0000003f40)=[{{0x0, 0x0, &(0x7f0000000100)}}, {{0x0, 0x0, &(0x7f00000003c0)=[{&(0x7f0000000540)="463fa56163dd", 0x6}], 0x1}}], 0x2, 0x4000000) ioctl$sock_ifreq(r0, 0x8990, &(0x7f0000000180)={'bond0\x00', @ifru_names='rose0\x00'}) r7 = syz_init_net_socket$rose(0xb, 0x5, 0x0) bind$rose(r7, 0x0, 0x0) sendto$rose(r7, 0x0, 0x0, 0xc0, 0x0, 0x0) sendmsg$ETHTOOL_MSG_FEATURES_SET(r4, &(0x7f00000035c0)={0x0, 0x0, &(0x7f0000003580)={&(0x7f0000000100)=ANY=[@ANYBLOB="06000000", @ANYRES16=0x0, @ANYBLOB="00012bbd7000fddbdf250c000000"], 0x14}, 0x1, 0x0, 0x0, 0x4810}, 0x10) 1.59908263s ago: executing program 0 (id=2656): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newlink={0x44, 0x10, 0x401, 0x600, 0x0, {0x0, 0x0, 0x0, 0x0, 0x5b5d}, [@IFLA_AF_SPEC={0x1c, 0x1a, 0x0, 0x1, [@AF_INET6={0x18, 0xa, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @private2={0xfc, 0x2, '\x00', 0x1}}]}]}, @IFLA_LINK={0x8}]}, 0x44}, 0x1, 0x0, 0x0, 0x58840}, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0xc0241, 0x0) (async) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1a, &(0x7f0000000700)={0x0, 0x9b5, "032ba49a2d97669bd45485e3d3d8513f925177539c5b019526db01d576372b2db76771ae831cb3263c15ac4fb61a7ad9a007deb7ecd96651bc9f2a911f79e353f1e567ea553c610e413436e441bdded8a13308266e5d2861ee7a7dbfd122f46f3b55e43c4683ca55c52ff34a9b10d40570228ad11077a74dec5d9adb98a16ad009a468fbcfa1c230eba52619d84ad1f22ede2d338bc6711287db7f227aed77b4358e2dbe405901768b50fcee96f8bb0cba167d30de0ec11371dde1f65beb5051e3cc4008809e5f9f7b40e3c89f31010f319b4d6aa00e431265a5505b78fbe87651906158d33fad153d0a5d18c9d6674e9d51fe5b38b03bb73a626de6ce049e19e7432513b95bd492135773160021adcefe879eaa93c08d0fba40bf2b5381cbf6819bd712a5c1037448d59d183332d0b0d80a168ade2e7ac84f895f93cd3b6123bd1f5b87f6011b0f0cbd8c08a0c5fd9d01df6f511fcb822ec67868b3f2ca19ff418c3d843e5e7fea92146ee4169ad162b1f9ad19062ed7e9d16e271390b086ccea42225cb7d08297b1d190a4cce36b5db3825e7817ced20d15af40110c138a8dad1603e2f86653b203689a04aaf8ca9ca71c3d20433ba34493fd5e92647b913308c858db91c41574ba716c46e7c362e84d21f2c5a90bd5248a3f936dd5b1230960a3f630cd4ca9fca77aab102a8b51f9e3f9b554635a6ba833796378b38dd6c839ce3e5e1f2270a203dc658f388a24ae57af4811c22628ad1e71f07dcf5badbb166580b88452bf4d70c6b0d99e8d793ef86b401e2ba13381708b5e2d919680b86acf8126507a4670e91bc37367c5a6372f9a146c28dda43c868999c5cbb44f01c8a5799ce8866656824c5b3c8c430aab51b8e0d9e03ff4a6c593e9e51c42c789ca23a83036b95514ff7dbede2e0b8a27d4c8f90f351e213f36db62b01db0365c421b6db4b578dd13424b9382ceeaeb2bc1b53c714020c7412c80286c269f6705f18c5883a40e9069748747faa339800255939a6953381201d2554d04e751946c8db51cc2666b3cc0cab1596cb7a7a451e88dd782f63e5f30d8269c26fea140878711b7f5ae64d1f7f93068fa706e9991dfb7fe1d6de136e27fe4d3c07a88dc087b98b7c9af22c6a3ee013990afd16bdf5763cf20c7c76424f2c02228d48704cacf5ac4145ed8b6718bcea32703f8e41e09692bb9d68c3281d35602917705de8d7a54aecec8fd70b894f99f99e679824e88664f0c5c769621964178afbd57398c4729ca859ae4b43c7b63ab1d18edf2a094e1ad865fb082a59d5e118b1a8f2e47463050f011512e2efcc2e403751b4d383bb16c8c7f37a7a38cabff864de7ea2db7fe3a7ad0bf0b59569b653e06f80219ff9ea55fb17cf762d79c9ad7ab29066a4478ef513ad5d0c3d263f91ae753af47eeeb2e33913979516f0bc2657f42355167ec6fd0e94af06299722a471ec83ee8a3c431fb3152a964f458c2cd7501a2a25a389390e28255f154ec2abb84dc70292a6d5d61d4854651e3826e0f42d3dbcb824d949d6d70c30b9e9ed14cb42580e7c384af276eca81eaebef4657b4dac11eed48c74bdc472e355e38e63a1c9cb4363dc36670f4f1ab8e2985776ff5943498b3081ed35f1bc306e7461b163c379532f88848f526ce6524c7da913db399a55d701507fe01a5216bc061d17850c0c75ee25b9d79ceb68eb4b79587b0b8c51c15deb54e5513e68d29f0e7e78bc957933be598d81bbac465d1ed3f808281ce82cc3da7cfdb190690f6e0957ac9e33550db323e8824705b14069f351317ca1eaff2635ba0e3ac6e4dbb9d038d90506b6ef707a35daff0b08c1ce3c1df51e686ce2f74fc47d609c1bb1dec3b526507f504f735f4a1e6c8f4832846a1f0120c1849fddf4630c4cd114611023cee26b7e624c4595ad08adbcca09b313bc4cfeef4ac08f87b7a5e8c3fc17a1a54e9b6c54e6ca0d5eb65352c1229ae1931f960c2f8a42fcef58d1592bb95998f6316274060738bfc8329e59bc340b6c7096fef9d4002648dbc9ca7cedd3ff0f26b01953698b7afc69bcede8a3326f4c2c2f3497e2f4e41b2902965763e6e22ae572f6e293b14a47c2dc2aacba908246b6896a5e303e3db65b01d73ff6e01e134985d996f746f16adea2e2e8c9bab2e55f1219458117d970b822f99759e8a11c9843988331857eba4d0e8201a5312d9669c89da773a9826f6411e2d6ffc0ae2b74800e64ae89fcdce195bf952012493b98713fe8f0d5f49702446dbbc98b8568b3fbcd866bc5f37e90e79c1fe4662b61cc4a26e69ec378cb0c92ab9d5cb2e390e5b82e2982cdc50cc2a76abb035a4b6d2dd215fb867f1c6d8697b47b782037d9a44ec7d3d3322cf9d2c57629bd90c781bfe7258fa1b2bf6d9902096555fcedf54985623151e28c5e93de30b714fc72bdf39c2b670f7b6a4f78ee6aa25b968842da8fd0fe533668c0518011e5621cc98a825c625025ed4c7ad9b0121c68eb0ef6b877fd3dc7836db63ada644416493c9bbc6d6103315d1df2bb5e92fd4ad076c90276a72551f705ff2a8fcfd50035241a75134f14e4f2d35a0f225fc07a87d02c04e2853310b767ebece5dd8f2d4cdf72238ca81b4ccb5dc759ef574ffe3f704293450f634dfe89288f849b637d19f588c9e5786f715aec3938af1262f4b02ffb9a955f2dad7e33e300d791b6a61e811faedad6968665b504c1400806d6b5391f125432854bc5f26bb7a4f443b3baa491f8b57f99586310215cef02573e1ea0fb50a25293f1fdf8550aa1bfb63f6faff1b18684418c2262141639b6f4a33cae27fc9ef8805dc988c905cc313bc4f6782b62609c0088a623482922e93d9ebbb5cfbbe4c068576ead04bd6809de4074477f9da761d14dfddc498ff54742281558634bd5b0ca8eac4987bfa937363faa2c92f8370e9a2a46122f01b0e723cbf260098d7bf5e2c62f4aa63639df0a60fcce96b57f30b5615e6dc2edc425c47f3b602907fd13af524e262c7a3cd810fab114df54ac9a908b176f415b792be55c1e268dcc5278a9e4e0152937caa0c794124699c4283cc2d72fdd9804e3be8177543a05afad4f75108342a6aa70d538191ff0d180524d236b406d04b01550cddf4913689db63bdb6f5be1b108f8fef6cd59707d357798f1676ab8f4e7b64f0c7912f095b9dfa0070f412f34cb80f4ba5efe99cc0a028a7f0f7a371f50ca47a95bfcd02c6a3a446f32a590061d9f4c96ce664d75b6e174722b16cc4616b6dd6fcb2e699104ffe8c3b3da4c6017c0bc6c4e9ac35bff773cc035f8fbb2661a4b92dcb7fcf722c92561c0830673bf13a64940857cf265efcc1bc002aa1456584647f56ff3770ea2bd0848df1498ad42083c1dabd71c86690044fc6030e18b0d3a12e1618a17460bd1fc97811689d11b4e2c2a8038aba10b675dacc83a245b879b2b5f744e5b7c496b5d8a3f0bca8dd272dbde46c66d8257b89c406e5a9c85f1b0d367995284169fc59b21f468ec894b88dde"}, 0x0) (async) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = socket$kcm(0x10, 0x2, 0x4) sendmsg$kcm(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000180)="89000000120081ae08060cdc030ec0007f03e3f70000000000e2ffca1b1f0000000004c00e72f750375ed08a56331dbf9ed7815e381ad6e747033a0093b837dc6cc01e32efaec8c7a6ec08123d000200390001400400446b9bbc7a46e3988285dcdf12f21308f868fece01955fed0009d78f0a947ee2b49e33538afa8af92347514f0b56a20ff27fff", 0x89}], 0x1}, 0x0) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000300), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000340)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000001080)=ANY=[@ANYBLOB='@\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="010000000000020000003900000008000300", @ANYRES32=r5, @ANYBLOB="24005a80200004801400050018002948d1b5062009abbdf00600880305000400"], 0x40}, 0x1, 0x0, 0x0, 0x200440c0}, 0x0) (async) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x11, 0x3, &(0x7f0000000600)=ANY=[@ANYBLOB="1800eb930400ffff0000001200000000950000000000000023368e078f391ae781f59167b2e33a096e22040be068365dba267e716c47730e7898699cafb151a88762f0afce65b374adb144c291d1fd30b3494517ef7279353e54e251b2cf291fb47aaa5c17dda1972ba4c5337fa65c1ed2b7cad2b2413c3e0bdb2ff2c87eb39bf0f63e7530048563672c3db1c0c8bb8b14c38a5f4e000f4e3c956961ea1772e6da482cee51b710a10f589353a74900"/186], &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x32, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f00000000c0)='sys_exit\x00', r6}, 0x18) (async) socket$inet_udplite(0x2, 0x2, 0x88) (async) socket$netlink(0x10, 0x3, 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0) (async) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) (async) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xb, 0xc3072, 0xffffffffffffffff, 0x0) (async) mmap(&(0x7f0000400000/0x3000)=nil, 0x3000, 0x2000009, 0x4d032, 0xffffffffffffffff, 0x0) (async) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000140)=@req3={0x1000, 0x3a, 0x1000, 0x3a, 0x7ff, 0xf83, 0x3}, 0x1c) connect$inet6(0xffffffffffffffff, 0x0, 0x0) (async) syz_emit_ethernet(0xad, 0x0, 0x0) (async) r7 = socket$packet(0x11, 0x3, 0x300) (async) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000040)={'hsr0\x00', 0x0}) sendto$packet(r7, &(0x7f0000000140)="33aaf14f564b1bf220cb1137d54b", 0xe, 0x40, &(0x7f0000000200)={0x11, 0x0, r9, 0x1, 0x8, 0x6, @multicast}, 0x14) (async) bpf$LINK_GET_FD_BY_ID(0x1e, &(0x7f0000000080), 0x4) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0}, 0x50) (async) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000000000)={0x0, @multicast1, @broadcast}, &(0x7f0000000040)=0xc) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', r10, 0x0}, 0x50) 1.530956294s ago: executing program 1 (id=2657): socket(0x2a, 0x2, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) socket$inet6_mptcp(0xa, 0x1, 0x106) r0 = socket$inet_mptcp(0x2, 0x1, 0x106) ioctl$sock_SIOCETHTOOL(r0, 0x89f1, &(0x7f00000002c0)={'ip6gre0\x00', &(0x7f0000000300)=@ethtool_rxnfc={0x2f, 0x2, 0x6, {0xe, @usr_ip6_spec={@empty, @dev={0xfe, 0x80, '\x00', 0x24}, 0xfffffff8, 0x3d, 0xe}, {0x0, @remote, 0xe, 0x4, [0x7, 0x6]}, @ah_ip4_spec={@remote, @initdev={0xac, 0x1e, 0x0, 0x0}, 0x0, 0x5}, {0x0, @broadcast, 0x8, 0x5, [0xf, 0x9]}, 0xff, 0x3}}}) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) r2 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) socket$rds(0x15, 0x5, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x11, 0xf, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000800000000bf91000000000000b702000043e7b5538500000085000000b70000000000000095"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x36, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000140)='kmem_cache_free\x00', r3}, 0x10) ppoll(&(0x7f0000000500)=[{r2}], 0x1, 0x0, 0x0, 0x0) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x0, 0x3, 0xfffffffffffffffd}, 0x0, &(0x7f00000002c0)={0x3ff, 0x0, 0x0, 0x9, 0x0, 0x0, 0x7fffffff}, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r4 = socket$inet_udplite(0x2, 0x2, 0x88) r5 = socket$inet(0xa, 0x801, 0x84) connect$inet(r5, &(0x7f0000004cc0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) listen(r1, 0x8) setsockopt(0xffffffffffffffff, 0x84, 0x7f, &(0x7f00000001c0)="020000000980ffff", 0x8) recvmmsg(0xffffffffffffffff, &(0x7f0000003dc0)=[{{0x0, 0x0, &(0x7f0000000640)=[{&(0x7f0000000040)=""/94, 0x5e}], 0x1}, 0x5076}], 0x1, 0x20, 0x0) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r4, 0x89f3, &(0x7f0000000040)={'syztnl2\x00', &(0x7f0000000200)={'sit0\x00', 0x0, 0x40, 0x7800, 0x7, 0x7, {{0x1b, 0x4, 0x1, 0x1, 0x6c, 0x64, 0x0, 0x1, 0x4, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}, @dev={0xac, 0x14, 0x14, 0x15}, {[@lsrr={0x83, 0x23, 0x6b, [@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast1, @remote, @multicast1, @broadcast, @initdev={0xac, 0x1e, 0x0, 0x0}, @broadcast, @multicast2]}, @ssrr={0x89, 0xb, 0x9, [@multicast1, @local]}, @timestamp={0x44, 0xc, 0x8e, 0x0, 0x2, [0x9, 0x6]}, @rr={0x7, 0xb, 0x78, [@multicast1, @local]}, @timestamp={0x44, 0x10, 0x79, 0x0, 0x4, [0x0, 0x0, 0xfff]}]}}}}}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) r6 = socket$inet_sctp(0x2, 0x5, 0x84) close(r6) r7 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r7, 0x84, 0x1d, &(0x7f0000000140)={0x1, [0x0]}, &(0x7f0000000240)=0x8) sendmsg$inet_sctp(r6, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000180)=[{0x0, 0x201}, {&(0x7f0000000280)="05", 0x1}], 0x2, &(0x7f0000000540)=ANY=[@ANYBLOB="200000000000000084000000020000000a000400280000000b0001027fb10cf8d3cc319e2433df1feb4f30f9907b4f9848fb687f5637c6dde44066ce9150d1702ee6a3fb304cdfeeb912af8f8f8e3af77bd7e1276f605e2acec7188b4e460fc631aa344f27bd5846b06b04adfe7f7ce4193cdb7d4500772bf8711b7ac7d4e16d59b1d626242f7f53c0fbd83720df0c6649fce6b617592fa9700e2a9605e9ad213a2ff31c929120d86ee246cf01f336bf176cafd0d1da99d3baf708472e55302f30475da4ba12f3c6dc294f80fc00000000000000", @ANYRES32=r8], 0x20, 0x2400e044}, 0x0) 1.517844862s ago: executing program 4 (id=2658): socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000380)={'vcan0\x00', 0x0}) r2 = socket$can_j1939(0x1d, 0x2, 0x7) bind$can_j1939(r2, &(0x7f0000000080)={0x1d, r1, 0x0, {0x0, 0x0, 0x3}, 0x1}, 0x18) sendmsg$can_j1939(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)="92", 0x1}}, 0xee) 1.500264865s ago: executing program 3 (id=2659): setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000000040)=@mangle={'mangle\x00', 0x64, 0x6, 0x500, 0x0, 0x3d0, 0xd0, 0xd0, 0xd0, 0x578, 0x578, 0x578, 0x578, 0x578, 0x6, 0x0, {[{{@ipv6={@private0, @private1, [], [], 'veth1\x00', 'veth1_vlan\x00'}, 0x0, 0xa8, 0xd0, 0x0, {0x0, 0x3a010000}}, @HL={0x28}}, {{@ipv6={@private1, @loopback, [], [], 'tunl0\x00', 'bridge_slave_1\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0x3d0}}, {{@ipv6={@private0, @remote, [], [], 'veth0_to_team\x00', 'tunl0\x00', {}, {}, 0x11, 0x0, 0x3, 0x44}, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@inet=@SYNPROXY={0x28}}, {{@ipv6={@loopback, @private2, [], [], 'syzkaller1\x00', 'veth0_to_batadv\x00'}, 0x0, 0xa8, 0xf0}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv4=@initdev={0xac, 0x1e, 0x0, 0x0}, 'vlan0\x00'}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x560) r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f00000014c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x2, 0xd, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, [@sadb_x_policy={0x8, 0x12, 0x2, 0x2, 0x0, 0x700, 0x0, {0x10, 0x32, 0x3, 0x0, 0x0, 0x0, 0x0, @in=@rand_addr=0x10002b00, @in6=@private2}}, @sadb_address={0x3, 0x5, 0x0, 0x0, 0x0, @in={0x2, 0x0, @local}}, @sadb_address={0x3, 0x6, 0x0, 0x0, 0x0, @in={0x2, 0x0, @private}}]}, 0x80}}, 0x0) 1.371140771s ago: executing program 0 (id=2660): socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) unshare(0x6a040000) socket(0x8, 0x1, 0x0) 1.140261315s ago: executing program 3 (id=2661): mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0x13, &(0x7f0000000080)=ANY=[@ANYBLOB="18080000000010000000100000000000851000000600000018000000", @ANYRES32, @ANYBLOB="00000000000000116608000000040600180000000000000000000000000000009500000000000000360a020000000000180100002020782500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b50a00000000000085000000060000009500000000000000"], &(0x7f0000000000)='GPL\x00', 0xa, 0xff5c, &(0x7f0000000340)=""/222, 0x0, 0x8}, 0x78) 868.200125ms ago: executing program 4 (id=2662): r0 = socket$inet(0xa, 0x801, 0x84) connect$inet(r0, &(0x7f0000004cc0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) listen(r0, 0x8) r1 = accept4(r0, 0x0, 0x0, 0x0) sendto$inet(r1, &(0x7f00000002c0)="cc", 0x1, 0x0, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r1, 0x84, 0x7b, &(0x7f0000000140)={0x0, 0x1}, 0x8) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r1, 0x84, 0x7c, &(0x7f0000000480)={0x0, 0x0, 0x7a}, 0x8) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r1, 0x84, 0x7c, &(0x7f00000005c0)={0x0, 0x2, 0x7a}, 0x8) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1a, 0xc, &(0x7f0000000000)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000d1000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000003100000095"], &(0x7f0000000300)='syzkaller\x00', 0x8, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0xa, 0x4, &(0x7f0000000040)=@framed={{}, [@ldst={0x1, 0x0, 0x3, 0x0, 0x1, 0x9b}], {0x95, 0x0, 0x700}}, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xd}, 0x80) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r3) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r4) sendmsg$TIPC_CMD_ENABLE_BEARER(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}}, 0x0) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x100, 0x0) close(r6) r7 = socket$unix(0x1, 0x1, 0x0) r8 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r10 = socket$unix(0x1, 0x1, 0x0) r11 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r11, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000440)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x0, 0xffffffff, {0x0, 0x0, 0x0, r12, {0x0, 0xb}, {0xffff, 0xffff}, {0xb}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0xa, 0x7f61, 0xfffffffd, 0xc5, 0xe23, 0x1, 0x1, 0x7fff, 0x1}}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x20008001}, 0x0) sendmsg$nl_route_sched(r8, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x2400c043}, 0x0) sendmsg$nl_route_sched(r8, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000380)=@newqdisc={0x78, 0x24, 0x4ee4e6a52ff56541, 0x70b923, 0x80000, {0x0, 0x0, 0x0, r9, {}, {0x2, 0xb}, {0x9, 0xb}}, [@qdisc_kind_options=@q_sfq={{0x8}, {0x4c, 0x2, {{0x7f, 0x0, 0x5, 0x1, 0xc}, 0xb, 0x0, 0x8, 0x5, 0x5f82, 0x2, 0x9, 0xd, 0x8, 0x1, {0xffff1c72, 0x3, 0x1000, 0x101, 0x0, 0x5}}}}]}, 0x78}, 0x1, 0x0, 0x0, 0x2000c061}, 0x4008000) ioctl$SIOCSIFHWADDR(r6, 0x8922, &(0x7f0000002280)={'syzkaller0\x00', @random="2b0100004ec6"}) 783.020082ms ago: executing program 3 (id=2663): socket$nl_generic(0x10, 0x3, 0x10) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=@newlink={0x3c, 0x10, 0x44b, 0x0, 0x0, {0x7a}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bridge={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BR_MCAST_ROUTER={0x5, 0x16, 0x2}]}}}]}, 0x3c}}, 0x4) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r2 = socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @broadcast}) write$tun(r1, &(0x7f0000000240)={@val={0x8, 0x800}, @val={0x7, 0x0, 0x0, 0x300, 0x14}, @ipv4=@tcp={{0x5, 0x4, 0x0, 0x3c, 0x3a, 0x400, 0x0, 0xd9, 0x2f, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, {{0x2200, 0x22eb, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}, {"4adcda08f6e83e2aa00e133f88a8349f88a8"}}}}, 0x48) socket$nl_route(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x4e63c1, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x80, 0x0) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) r3 = socket$alg(0x26, 0x5, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="9feb01021800"], 0x0, 0x26}, 0x28) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000940)={&(0x7f00000013c0)=ANY=[@ANYBLOB="640000001000030400"/20, @ANYRES32=0x0, @ANYBLOB="e5fda988000000002800128009000100766c616e00000000180002800c0002001c0000001f000000060001000000000008000500", @ANYRES32=r3, @ANYBLOB='\b\x00\n\x00', @ANYRES32, @ANYBLOB="0a000100000070"], 0x64}, 0x1, 0x0, 0x0, 0x8811}, 0x0) 476.697236ms ago: executing program 2 (id=2664): bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x1, 0x4, &(0x7f0000000340)=@framed={{}, [@call={0x85, 0x0, 0x0, 0x89}]}, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x2, '\x00', 0x0, @fallback=0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000}, 0x94) r0 = socket$inet(0x2b, 0x801, 0x0) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x48f, &(0x7f0000000000)={0x11, @private, 0x4e20, 0x0, 'lc\x00', 0x0, 0x6000000}, 0x2c) r1 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) sendmsg(r1, &(0x7f0000000c80)={&(0x7f0000000a40)=@qipcrtr={0x2a, 0x2, 0x8000}, 0x80, &(0x7f0000000b80)=[{&(0x7f0000000ac0)="d5c762", 0x3}, {0x0}], 0x2}, 0x4040044) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f00000002c0), r2) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="640000000001010400000000141a000002000000240001801400018008000100e000000108000200e00000010c00028005000100000000002400028014000180080001000000000008000200ac1e00010c00028005000100000000000800074000000001"], 0x64}}, 0x0) sendmsg$IPCTNL_MSG_CT_NEW(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000009c0)=ANY=[@ANYBLOB="48000000000101040000ff0f0000000002000000240001801400018008000100e000000108000200e00000010c000280050001000000000010000580090001"], 0x48}}, 0x40004) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$nl802154(&(0x7f00000006c0), r6) ioctl$sock_SIOCGIFINDEX_802154(r6, 0x8933, &(0x7f0000000700)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_DEL_SEC_DEV(r7, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000740)=ANY=[@ANYBLOB="e3713117", @ANYRES16=r8, @ANYBLOB="030027bd7000fddbdf251b00000010002e800c000400000000000000000008000300", @ANYRES32=r9, @ANYBLOB], 0x2c}, 0x1, 0x0, 0x0, 0x8000}, 0x200000c0) r10 = socket$packet(0x11, 0x3, 0x300) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000280)={{0x14}, [@NFT_MSG_NEWRULE={0x40, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x20, 0x4, 0x0, 0x1, [{0x1c, 0x1, 0x0, 0x1, @quota={{0xa}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_QUOTA_FLAGS={0x8, 0x2, 0x1, 0x0, 0x3}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0x68}}, 0x0) r11 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r11, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01040000000000000000010000000900010073797a3100000000ac000000030a010300000000000000000100000014000480080002400000000008000140000000050900030073797a30000000000900010073797a310000000008000b4000000003640008800c00014000000000800000000c00014000000000000000010c00014000000000000000050c"], 0x92fc}}, 0x0) getsockopt$packet_int(r10, 0x107, 0xb, 0x0, &(0x7f0000000240)=0x47ee917f) sendmsg$IEEE802154_LIST_IFACE(r5, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000180)={&(0x7f0000000240)={0x58, 0x0, 0x200, 0x70bd25, 0x25dfdbfd, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan3\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan3\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r9}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}]}, 0x58}, 0x1, 0x0, 0x0, 0x4c010}, 0x40) sendmsg$NLBL_CIPSOV4_C_ADD(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB='Z\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010027bd7000fbdbdf25010000000800010003000000340004800500030001000000050003000100000005000300010000000500030002000000050003000500000005000300070000000800020002000000"], 0x58}}, 0x0) 363.531971ms ago: executing program 3 (id=2665): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000007c0)={0x3, 0x4, &(0x7f0000000980)=@framed={{0x18, 0x2, 0x0, 0x0, 0xfffff610, 0x0, 0x0, 0x0, 0x7fb}, [@call={0x85, 0x0, 0x0, 0x7a}]}, &(0x7f0000000100)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x8}, 0x94) r0 = syz_init_net_socket$ax25(0x3, 0x3, 0xc3) setsockopt$ax25_int(r0, 0x101, 0x9, 0x0, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) unshare(0x22020600) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, 0x0) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x3, 0xc, &(0x7f0000000140)=ANY=[@ANYBLOB="18020000000000000000000000000000850000002e0000001801000020696c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000009b00000095"], &(0x7f0000000bc0)='GPL\x00', 0x2, 0x0, 0x0, 0x41100}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r3, 0x0, 0xe, 0x0, &(0x7f0000000100)="e0b9547ed387dbe9abc89b6f5bec", 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000d00)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01020000000000000000010000000900010073797a30000000002c000000030a01080000000000000000010000000900030073797a32000000000900010073797a30000000005c000000060a010400000000000000000100000008000b40000000000900010073797a300000000034000480300001800a0001006d617463680000002000028008000300b07346e30a0001007374617465000000080002"], 0xd0}}, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000440), r5) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f0000000100)={'wlan0\x00'}) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$fou(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$FOU_CMD_GET(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x14, r7, 0x1}, 0x14}}, 0x0) r8 = socket$kcm(0x29, 0x5, 0x0) setsockopt$kcm_KCM_RECV_DISABLE(r8, 0x119, 0x2, 0x0, 0x0) r9 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000800), r1) sendmsg$NLBL_UNLABEL_C_STATICREMOVEDEF(r1, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000840)=ANY=[@ANYBLOB='\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="010029bd7000fcdbdf250700000014000200ff020000000000000000000000000001080004006401010214000300fe8000000000000000000000000000aa"], 0x44}, 0x1, 0x0, 0x0, 0x20000801}, 0x448c0) 188.378638ms ago: executing program 1 (id=2666): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0x6, &(0x7f0000000040)=ANY=[@ANYBLOB="1808000000000000000000000000000018000000000600000000000000000000d31800000001000095"], &(0x7f0000000000)='GPL\x00', 0x6, 0x0, 0x0, 0x0, 0x44, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x10000000}, 0x94) r1 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000180)={{{@in=@dev={0xac, 0x14, 0x14, 0x24}, @in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x8, 0x0, 0xfffc, 0x41, 0x2}, {0x10000005, 0x3, 0xfffffffffffffffe, 0x0, 0x4, 0x0, 0x80000000000000}, {0x400, 0x3, 0x0, 0x800}, 0x8, 0x0, 0x1, 0x0, 0x2}, {{@in=@dev={0xac, 0x14, 0x14, 0x11}, 0x10000000, 0x2b}, 0x2, @in=@empty, 0xff7fffff, 0x4, 0x0, 0x0, 0xfffffffe, 0x0, 0xfffffffe}}, 0xe8) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0xb5}}}, 0x1c) (async) r2 = socket$nl_route(0x10, 0x3, 0x0) (async) r3 = socket$l2tp(0x2, 0x2, 0x73) recvfrom$l2tp(r3, 0x0, 0x0, 0x40000142, 0x0, 0x0) (async) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@ipv4_newroute={0x2c, 0x18, 0xaba64f4add525e83, 0x1, 0x0, {0x2, 0x0, 0x0, 0x0, 0xfd, 0x0, 0xfe, 0x3}, [@RTA_OIF={0x8, 0x4, r5}, @RTA_PREFSRC={0x8, 0x7, @broadcast}]}, 0x2c}, 0x1, 0xffffff7f}, 0x84) (async) r6 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1b, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r6, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000001600000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8c}, 0x94) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000023c0)={0x0, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18020000660000000000"], 0x0, 0x7ff}, 0x94) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000002c0)={&(0x7f0000000700)='signal_generate\x00', r7}, 0x10) (async) syz_genetlink_get_family_id$tipc2(0x0, 0xffffffffffffffff) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x10, 0x1c, &(0x7f0000000040)=@ringbuf={{0x18, 0x8}, {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1c}, {}, {0x85, 0x0, 0x0, 0x5}, {0x4, 0x1, 0xb, 0x9, 0xa}}, {{0x5, 0x0, 0x3, 0x9, 0x0, 0x1, 0x18}}, [@snprintf={{0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x4}, {0x3, 0x0, 0x3, 0xa, 0x2}, {0x5, 0x0, 0xb, 0x9, 0x0, 0x0, 0x1a}, {0x3, 0x0, 0x6, 0xa, 0xa, 0xfff8, 0xf1}, {0x7, 0x1, 0xb, 0x6, 0x8}, {0x7, 0x0, 0x0, 0x8}, {}, {}, {0x4, 0x0, 0xa, 0x9}, {0x18, 0x2, 0x2, 0x0, r0}, {}, {0x46, 0x8, 0xfff0, 0x76}}], {{0x7, 0x1, 0xb, 0x8}, {0x6, 0x0, 0x5, 0x8}, {0x85, 0x0, 0x0, 0x7}}}, &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_msg, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfff}, 0x94) 177.897948ms ago: executing program 3 (id=2667): r0 = bpf$MAP_CREATE(0x100000000000000, &(0x7f0000000140)=ANY=[@ANYBLOB="0a00000016000000b30000007f"], 0x48) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0x13, &(0x7f0000000080)=ANY=[@ANYBLOB="18080000000000000000000000000000851000000600000018100000", @ANYRES32=r0, @ANYBLOB="00000000000000006608000000000000180000000800000000000000000000009500000000000000c60a000000000000180100002020752500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b5020000000000008500"], &(0x7f0000000000)='GPL\x00'}, 0x94) 134.619974ms ago: executing program 4 (id=2668): r0 = socket$l2tp6(0xa, 0x2, 0x73) recvfrom$l2tp6(r0, 0x0, 0x0, 0x61, 0x0, 0x0) (async) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000140)={'macsec0\x00', 0x0}) (async) r3 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000001180)=@newlink={0x48, 0x10, 0x503, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x14615}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macsec={{0xb}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r2}, @IFLA_ADDRESS={0xa, 0x1, @multicast}]}, 0x48}, 0x1, 0x0, 0x0, 0x4000880}, 0x10) 55.084844ms ago: executing program 2 (id=2669): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f00000035c0)={0x0, 0x0, &(0x7f0000003580)={&(0x7f0000000040)=ANY=[@ANYBLOB="44010000100001000000000800000000fc0100000000000000000000000000000a01010000000000000000000000000000000000200000000000202032000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="ffffffff000000000000000000000000000000006c000000ac1414bb00000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000001000000000000000000000800000000000000100000000000000000000000000000000004000000000000000d000000000000000a0000000000000000000000000000000000000000000000000000000a0001070000000000000000480003006465666c61746500000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000b000000000000000000000000000c001c"], 0x144}}, 0x20000000) 47.222194ms ago: executing program 3 (id=2670): unshare(0x22020600) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x3a0ffffffff) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x11, 0x5, &(0x7f0000000280)=ANY=[@ANYBLOB="1801000021000000000000004b74ffec850000006d000000850000000700000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) r2 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000740)={&(0x7f0000000000)='mm_lru_insertion\x00', r1}, 0x10) r3 = epoll_create1(0x0) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0xfffffffffefffff6, 0x20031, 0xffffffffffffffff, 0x0) epoll_wait(r3, &(0x7f000000affb)=[{}], 0x1, 0x7fff) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000580)='memory.events\x00', 0x100002, 0x0) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x8, 0x3, 0x600, 0x198, 0xffffffff, 0xffffffff, 0x198, 0xffffffff, 0x268, 0xffffff7a, 0xffffffff, 0x268, 0xffffffff, 0x7fffffe, 0x0, {[{{@ip={@broadcast, @loopback, 0x0, 0x0, 'veth1\x00', 'veth0_to_team\x00', {}, {}, 0x0, 0x0, 0x41}, 0x6, 0x130, 0x198, 0x0, {}, [@common=@unspec=@string={{0xc0}, {0x0, 0x0, 'bm\x00', "00000100cbd047da9ca965f96ad5801f0514d363ee84bb895919d9490f6785fba3c4a44f1e25ecefef2a2d6054f5260ece5ce1a56a5ef73be11d65bfe8c37674024c183ebacdf741cea92ded3a9ca54de15dd9ec8ef62f9e000000000000000000ffffff7f00", 0x7d}}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x1000000, 0x0, 'snmp_trap\x00', 'syz1\x00'}}}, {{@uncond, 0x0, 0x70, 0xd0}, @common=@SET={0x60}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x360) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f00000002c0)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) write$cgroup_type(r4, &(0x7f0000000180), 0x40010) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x13, &(0x7f0000000240)=ANY=[@ANYBLOB="180000008000000000000000000000001801000020756c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000c44185000000040000001801000020646c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb70200000a000000b703000000000000850000007500000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000400)={&(0x7f0000000040)='sys_enter\x00', r5}, 0x10) r6 = socket$kcm(0x11, 0x200000000000003, 0x300) unshare(0x60600) recvmsg$kcm(r6, 0x0, 0x0) socket$packet(0x11, 0x3, 0x300) socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$inet_mreqn(r0, 0x0, 0x24, &(0x7f00000004c0)={@loopback, @private}, &(0x7f0000000500)=0xc) ioctl$FS_IOC_GETFLAGS(r2, 0x80086601, &(0x7f0000000040)) sendmsg$IPSET_CMD_ADD(r0, &(0x7f0000000240)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000780)=ANY=[@ANYBLOB="8c010000090601030000000000000000000000030900020073797a32000000f3620007800500030003000000060004404e21000008001a0023275ef151505600ffffffffffff0000050003000300000005000700320000000c00148008000140ffffffff5800078008001c4000000cf2080009400000000208000940000000081800148014000240fc0200000000000000000000000000010800084000000089140017006e72300000000000000000000000000005001a000000000008000940000000014c0008800c00078008001a002d2824000c00078008000a40000000ff18000780140017006c6f00000000000000000000000000000c000780080008400000004d0c00078008000b400000080034000780080008400000006e0900120073797a3100000000080009400000000605000300070000000c00184000000000000004670900020073797a3100000000080009403400078018000180140002400000000000000000000000000000000005000300a400000006001d4000060000060005404e2400006d8e1ff7f0c219bf7c69166d52cc4fd026ea514fcef2414f4e9168913816f46050fe8c4a59793916934b2070a6da10dc5419eedb8d0f5cc60ee91faee60f763d8ab848aa1ab4dda0755b812402878ab1c7fdeb37d88f4f9bc196b1394268ab60f5a8b1a8b6cc8582020b86dab170a457010c42e862543add7b7e3ed402a94f43794d6900d69587d570b2436b1ab8f51703da5ab864fb0e0b97ee48fa8e463b7bf675028a651dcb327f8e08d889f73373a6b0173d7362ac9abbcb72619765102bbc2ef9251fc6365df13a2fb08fc4375c8ef17fbafb83f8af6c3f14a39c7158b1e1ad0945b1fb96938215e8e9fc"], 0x18c}, 0x1, 0x0, 0x0, 0x80}, 0x4) 0s ago: executing program 1 (id=2671): socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$inet(0x2, 0xa, 0x0) r2 = socket(0x10, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), r4) sendmsg$NFQNL_MSG_CONFIG(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)={0x14, 0x2, 0x3, 0x401, 0x0, 0x0, {0x0, 0x0, 0x10}}, 0x14}, 0x1, 0x0, 0x0, 0x40040}, 0x85) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r5, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="d80000001b00010000000000fdfffffffc000000000000000000000000000000200100000000000000000000000000004e240000000000010000000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000000000000ffffffffffffff7ffcffffffffffffff04000000000000000000000000000000fdffffffffffffff00000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000006fcffff00000000000003000000000000000000000000000c0008"], 0xd8}}, 0x20008004) r6 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) sendmsg$nl_route(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000300)=@newlink={0x44, 0x10, 0x503, 0x0, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, 0x115}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r7}, @IFLA_MASTER={0x8, 0xa, r7}]}, 0x44}}, 0x0) sendmsg$nl_route(r3, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x10008}, 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@ipv6_getaddr={0x64, 0x16, 0x2, 0x70bd26, 0x25dfdbfb, {0xa, 0x1, 0x70, 0xff, r7}, [@IFA_RT_PRIORITY={0x8, 0x9, 0x3}, @IFA_CACHEINFO={0x14, 0x6, {0x7, 0xd8, 0x1, 0x3}}, @IFA_CACHEINFO={0x14, 0x6, {0x10, 0x1d09a7f2, 0x401, 0xffffffc4}}, @IFA_RT_PRIORITY={0x8, 0x9, 0xe}, @IFA_LOCAL={0x14, 0x2, @mcast2}]}, 0x64}, 0x1, 0x0, 0x0, 0x4040080}, 0x1) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffff11feffffff000000", @ANYRES32=r8, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000005840)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000001240)=@newqdisc={0x78, 0x24, 0x5820a61ca228651, 0x0, 0x0, {0x0, 0x0, 0x0, r8, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_sfq={{0x8}, {0x4c}}]}, 0x78}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)=@newtfilter={0x3c, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r8, {}, {}, {0xd}}, [@filter_kind_options=@f_basic={{0xa}, {0xc, 0x2, [@TCA_BASIC_CLASSID={0x8, 0x1, {0x0, 0x9}}]}}]}, 0x3c}}, 0x0) shutdown(r1, 0x0) r9 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="12000000050000000400000001"], 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000002500)={{r9}, &(0x7f0000002480), &(0x7f0000000080)=r0}, 0x20) r10 = socket$inet_udp(0x2, 0x2, 0x0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000200)={r9, &(0x7f0000000180), &(0x7f0000000040)=@udp=r10}, 0x20) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x1, 0x31, 0xffffffffffffffff, 0x8871b000) r11 = socket$inet_sctp(0x2, 0x5, 0x84) getsockopt$ARPT_SO_GET_INFO(r11, 0x0, 0x60, 0x0, &(0x7f0000000200)) ioctl$BTRFS_IOC_QUOTA_RESCAN(r11, 0x4040942c, &(0x7f0000000000)={0x0, 0x100, [0x7, 0x6, 0x0, 0xffffffffffffffff, 0x3e, 0x100000000]}) kernel console output (not intermixed with test programs): ributes in process `syz.4.939'. [ 208.139465][ T9411] netlink: 4 bytes leftover after parsing attributes in process `syz.4.939'. [ 208.467880][ T9419] netlink: 8 bytes leftover after parsing attributes in process `syz.2.942'. [ 208.788546][ T9421] lo speed is unknown, defaulting to 1000 [ 208.982734][ T9430] netlink: 8 bytes leftover after parsing attributes in process `syz.2.946'. [ 209.551723][ T9449] netlink: 32 bytes leftover after parsing attributes in process `syz.2.951'. [ 209.594282][ T9449] netlink: 'syz.2.951': attribute type 2 has an invalid length. [ 209.609896][ T9449] þ: entered promiscuous mode [ 209.632489][ T9453] netlink: del zone limit has 4 unknown bytes [ 209.974874][ T9459] netlink: 'syz.2.952': attribute type 1 has an invalid length. [ 210.150012][ T9464] netlink: 8 bytes leftover after parsing attributes in process `syz.0.955'. [ 210.485464][ T9470] IPVS: length: 137 != 8 [ 211.295525][ T9493] bpq0: entered promiscuous mode [ 211.312938][ T9497] netlink: 28 bytes leftover after parsing attributes in process `syz.0.966'. [ 211.350769][ T9493] bpq0: entered allmulticast mode [ 211.414705][ T9490] netlink: 'syz.2.965': attribute type 1 has an invalid length. [ 211.422930][ T9490] netlink: 184 bytes leftover after parsing attributes in process `syz.2.965'. [ 211.432309][ T9490] netlink: 'syz.2.965': attribute type 1 has an invalid length. [ 211.457055][ T9505] netlink: 8 bytes leftover after parsing attributes in process `syz.4.969'. [ 211.481763][ T9486] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 211.496954][ T9486] netlink: 100 bytes leftover after parsing attributes in process `syz.2.965'. [ 211.576674][ T9506] IPVS: lblc: UDP 224.0.0.2:0 - no destination available [ 211.767497][ T9506] lo speed is unknown, defaulting to 1000 [ 211.798818][ T9515] FAULT_INJECTION: forcing a failure. [ 211.798818][ T9515] name failslab, interval 1, probability 0, space 0, times 0 [ 211.854277][ T9515] CPU: 1 UID: 0 PID: 9515 Comm: syz.0.971 Not tainted 6.16.0-rc6-syzkaller-01646-g56613001dfc9 #0 PREEMPT(full) [ 211.854308][ T9515] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 211.854318][ T9515] Call Trace: [ 211.854325][ T9515] [ 211.854333][ T9515] dump_stack_lvl+0x189/0x250 [ 211.854361][ T9515] ? __pfx____ratelimit+0x10/0x10 [ 211.854381][ T9515] ? __pfx_dump_stack_lvl+0x10/0x10 [ 211.854401][ T9515] ? __pfx__printk+0x10/0x10 [ 211.854432][ T9515] ? __pfx___might_resched+0x10/0x10 [ 211.854473][ T9515] should_fail_ex+0x414/0x560 [ 211.854498][ T9515] should_failslab+0xa8/0x100 [ 211.854527][ T9515] __kmalloc_cache_node_noprof+0x73/0x3d0 [ 211.854553][ T9515] ? __get_vm_area_node+0x13f/0x300 [ 211.854584][ T9515] __get_vm_area_node+0x13f/0x300 [ 211.854617][ T9515] __vmalloc_node_range_noprof+0x301/0x12f0 [ 211.854644][ T9515] ? bpf_prog_alloc_no_stats+0x4a/0x4b0 [ 211.854666][ T9515] ? is_bpf_text_address+0x26/0x2b0 [ 211.854721][ T9515] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 211.854746][ T9515] ? __might_fault+0xb0/0x130 [ 211.854770][ T9515] ? __pfx_aa_get_newest_label+0x10/0x10 [ 211.854789][ T9515] ? _parse_integer_limit+0x1ae/0x1f0 [ 211.854816][ T9515] ? bpf_prog_alloc_no_stats+0x4a/0x4b0 [ 211.854833][ T9515] __vmalloc_noprof+0xb1/0xf0 [ 211.854860][ T9515] ? bpf_prog_alloc_no_stats+0x4a/0x4b0 [ 211.854883][ T9515] bpf_prog_alloc_no_stats+0x4a/0x4b0 [ 211.854908][ T9515] bpf_prog_alloc+0x3c/0x1a0 [ 211.854931][ T9515] bpf_prog_load+0x735/0x1930 [ 211.854962][ T9515] ? __pfx_bpf_prog_load+0x10/0x10 [ 211.855007][ T9515] ? bpf_lsm_bpf+0x9/0x20 [ 211.855027][ T9515] ? security_bpf+0x7e/0x300 [ 211.855048][ T9515] __sys_bpf+0x5f1/0x860 [ 211.855078][ T9515] ? __pfx___sys_bpf+0x10/0x10 [ 211.855121][ T9515] ? ksys_write+0x22a/0x250 [ 211.855148][ T9515] ? __pfx_ksys_write+0x10/0x10 [ 211.855169][ T9515] ? rcu_is_watching+0x15/0xb0 [ 211.855200][ T9515] __x64_sys_bpf+0x7c/0x90 [ 211.855223][ T9515] do_syscall_64+0xfa/0x3b0 [ 211.855241][ T9515] ? lockdep_hardirqs_on+0x9c/0x150 [ 211.855259][ T9515] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 211.855277][ T9515] ? clear_bhb_loop+0x60/0xb0 [ 211.855301][ T9515] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 211.855318][ T9515] RIP: 0033:0x7f933bd8e9a9 [ 211.855336][ T9515] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 211.855351][ T9515] RSP: 002b:00007f933cbfa038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 211.855372][ T9515] RAX: ffffffffffffffda RBX: 00007f933bfb5fa0 RCX: 00007f933bd8e9a9 [ 211.855385][ T9515] RDX: 0000000000000078 RSI: 0000200000000440 RDI: 0000000000000005 [ 211.855396][ T9515] RBP: 00007f933cbfa090 R08: 0000000000000000 R09: 0000000000000000 [ 211.855407][ T9515] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 211.855418][ T9515] R13: 0000000000000000 R14: 00007f933bfb5fa0 R15: 00007ffc52a99968 [ 211.855448][ T9515] [ 211.855498][ T9515] syz.0.971: vmalloc error: size 4096, vm_struct allocation failed, mode:0x500dc0(GFP_USER|__GFP_ZERO|__GFP_ACCOUNT), nodemask=(null) [ 211.862957][ T9512] tipc: Enabled bearer , priority 0 [ 211.891724][ T9515] ,cpuset= [ 211.923337][ T5852] Bluetooth: hci1: command 0x0406 tx timeout [ 211.927008][ T9515] / [ 211.929812][ T5852] Bluetooth: hci2: command 0x0401 tx timeout [ 211.937807][ T9512] syzkaller0: entered promiscuous mode [ 211.942052][ T5852] Bluetooth: hci3: command 0x0406 tx timeout [ 212.012545][ T9515] ,mems_allowed=0-1 [ 212.020581][ T9512] syzkaller0: entered allmulticast mode [ 212.131162][ T9515] [ 212.276805][ T9515] CPU: 1 UID: 0 PID: 9515 Comm: syz.0.971 Not tainted 6.16.0-rc6-syzkaller-01646-g56613001dfc9 #0 PREEMPT(full) [ 212.276834][ T9515] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 212.276844][ T9515] Call Trace: [ 212.276860][ T9515] [ 212.276868][ T9515] dump_stack_lvl+0x189/0x250 [ 212.276897][ T9515] ? __pfx_rcu_read_unlock_special+0x10/0x10 [ 212.276928][ T9515] ? __pfx_dump_stack_lvl+0x10/0x10 [ 212.276948][ T9515] ? __pfx__printk+0x10/0x10 [ 212.276970][ T9515] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 212.276992][ T9515] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 212.277020][ T9515] warn_alloc+0x214/0x310 [ 212.277043][ T9515] ? __pfx_warn_alloc+0x10/0x10 [ 212.277062][ T9515] ? __get_vm_area_node+0x13f/0x300 [ 212.277090][ T9515] ? __get_vm_area_node+0x2b5/0x300 [ 212.277123][ T9515] __vmalloc_node_range_noprof+0x326/0x12f0 [ 212.277151][ T9515] ? is_bpf_text_address+0x26/0x2b0 [ 212.277200][ T9515] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 212.277222][ T9515] ? __might_fault+0xb0/0x130 [ 212.277244][ T9515] ? __pfx_aa_get_newest_label+0x10/0x10 [ 212.277261][ T9515] ? _parse_integer_limit+0x1ae/0x1f0 [ 212.277287][ T9515] ? bpf_prog_alloc_no_stats+0x4a/0x4b0 [ 212.277303][ T9515] __vmalloc_noprof+0xb1/0xf0 [ 212.277330][ T9515] ? bpf_prog_alloc_no_stats+0x4a/0x4b0 [ 212.277351][ T9515] bpf_prog_alloc_no_stats+0x4a/0x4b0 [ 212.277375][ T9515] bpf_prog_alloc+0x3c/0x1a0 [ 212.277396][ T9515] bpf_prog_load+0x735/0x1930 [ 212.277427][ T9515] ? __pfx_bpf_prog_load+0x10/0x10 [ 212.277483][ T9515] ? bpf_lsm_bpf+0x9/0x20 [ 212.277503][ T9515] ? security_bpf+0x7e/0x300 [ 212.277522][ T9515] __sys_bpf+0x5f1/0x860 [ 212.277548][ T9515] ? __pfx___sys_bpf+0x10/0x10 [ 212.277585][ T9515] ? ksys_write+0x22a/0x250 [ 212.277607][ T9515] ? __pfx_ksys_write+0x10/0x10 [ 212.277625][ T9515] ? rcu_is_watching+0x15/0xb0 [ 212.277651][ T9515] __x64_sys_bpf+0x7c/0x90 [ 212.277674][ T9515] do_syscall_64+0xfa/0x3b0 [ 212.277691][ T9515] ? lockdep_hardirqs_on+0x9c/0x150 [ 212.277707][ T9515] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 212.277722][ T9515] ? clear_bhb_loop+0x60/0xb0 [ 212.277742][ T9515] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 212.277757][ T9515] RIP: 0033:0x7f933bd8e9a9 [ 212.277773][ T9515] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 212.277786][ T9515] RSP: 002b:00007f933cbfa038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 212.277805][ T9515] RAX: ffffffffffffffda RBX: 00007f933bfb5fa0 RCX: 00007f933bd8e9a9 [ 212.277816][ T9515] RDX: 0000000000000078 RSI: 0000200000000440 RDI: 0000000000000005 [ 212.277826][ T9515] RBP: 00007f933cbfa090 R08: 0000000000000000 R09: 0000000000000000 [ 212.277836][ T9515] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 212.277846][ T9515] R13: 0000000000000000 R14: 00007f933bfb5fa0 R15: 00007ffc52a99968 [ 212.277875][ T9515] [ 212.277882][ T9515] Mem-Info: [ 212.486652][ T9524] IPVS: length: 137 != 8 [ 212.499601][ T9515] active_anon:6129 inactive_anon:0 isolated_anon:0 [ 212.499601][ T9515] active_file:1652 inactive_file:39879 isolated_file:0 [ 212.499601][ T9515] unevictable:768 dirty:259 writeback:0 [ 212.499601][ T9515] slab_reclaimable:11277 slab_unreclaimable:122392 [ 212.499601][ T9515] mapped:30882 shmem:3021 pagetables:937 [ 212.499601][ T9515] sec_pagetables:0 bounce:0 [ 212.499601][ T9515] kernel_misc_reclaimable:0 [ 212.499601][ T9515] free:1299583 free_pcp:15638 free_cma:0 [ 212.653575][ T9511] tipc: Resetting bearer [ 212.740033][ T9515] Node 0 active_anon:26016kB inactive_anon:0kB active_file:6608kB inactive_file:159316kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:124928kB dirty:1032kB writeback:0kB shmem:12048kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:11880kB pagetables:3520kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 212.800001][ T9515] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:4kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:48kB pagetables:128kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 212.834212][ T9511] tipc: Disabling bearer [ 212.851256][ T9515] Node 0 DMA free:15360kB boost:0kB min:204kB low:252kB high:300kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 212.892139][ T9515] lowmem_reserve[]: 0 2498 2499 2499 2499 [ 212.897997][ T9515] Node 0 DMA32 free:1289688kB boost:0kB min:34248kB low:42808kB high:51368kB reserved_highatomic:0KB free_highatomic:0KB active_anon:28672kB inactive_anon:0kB active_file:6608kB inactive_file:157744kB unevictable:1536kB writepending:1032kB present:3129332kB managed:2558316kB mlocked:0kB bounce:0kB free_pcp:33000kB local_pcp:18600kB free_cma:0kB [ 212.962311][ T9515] lowmem_reserve[]: 0 0 1 1 1 [ 212.967197][ T9515] Node 0 Normal free:12kB boost:0kB min:20kB low:24kB high:28kB reserved_highatomic:0KB free_highatomic:0KB active_anon:44kB inactive_anon:0kB active_file:0kB inactive_file:1572kB unevictable:0kB writepending:0kB present:1048580kB managed:1644kB mlocked:0kB bounce:0kB free_pcp:16kB local_pcp:8kB free_cma:0kB [ 213.027897][ T9515] lowmem_reserve[]: 0 0 0 0 0 [ 213.033680][ T9515] Node 1 Normal free:3893272kB boost:0kB min:55632kB low:69540kB high:83448kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:1536kB writepending:4kB present:4194300kB managed:4111164kB mlocked:0kB bounce:0kB free_pcp:24128kB local_pcp:12544kB free_cma:0kB [ 213.106987][ T9515] lowmem_reserve[]: 0 0 0 0 0 [ 213.141822][ T9515] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 213.203777][ T9515] Node 0 DMA32: 1301*4kB (UME) 525*8kB (UME) 160*16kB (UME) 532*32kB (UME) 117*64kB (UME) 48*128kB (UME) 33*256kB (UM) 17*512kB (UME) 13*1024kB (UME) 6*2048kB (UM) 294*4096kB (UM) = 1289596kB [ 213.268181][ T9515] Node 0 Normal: 1*4kB (M) 1*8kB (M) 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 12kB [ 213.310080][ T9515] Node 1 Normal: 232*4kB (UME) 63*8kB (UME) 44*16kB (UME) 98*32kB (UME) 30*64kB (UME) 8*128kB (UME) 4*256kB (UME) 2*512kB (M) 2*1024kB (ME) 1*2048kB (E) 947*4096kB (UM) = 3893272kB [ 213.417196][ T9515] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 213.461969][ T9515] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 213.492285][ T9515] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 213.524405][ T9515] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 213.553326][ T9515] 46004 total pagecache pages [ 213.578260][ T9515] 0 pages in swap cache [ 213.592756][ T9515] Free swap = 124996kB [ 213.602145][ T9515] Total swap = 124996kB [ 213.616987][ T9515] 2097051 pages RAM [ 213.627127][ T9515] 0 pages HighMem/MovableOnly [ 213.643570][ T9548] netlink: 8 bytes leftover after parsing attributes in process `syz.4.978'. [ 213.658419][ T9515] 425430 pages reserved [ 213.668610][ T9515] 0 pages cma reserved [ 213.983257][ T9554] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 214.269045][ T9565] netlink: 60 bytes leftover after parsing attributes in process `syz.3.982'. [ 214.483437][ T9568] lo speed is unknown, defaulting to 1000 [ 214.586132][ T9577] IPVS: length: 137 != 8 [ 215.140509][ T9599] netlink: 24 bytes leftover after parsing attributes in process `syz.4.992'. [ 215.606520][ T9603] lo speed is unknown, defaulting to 1000 [ 216.790851][ T9634] netlink: 'syz.1.999': attribute type 1 has an invalid length. [ 216.906858][ T9634] 8021q: adding VLAN 0 to HW filter on device bond5 [ 216.934306][ T9639] bond5: (slave gretap2): making interface the new active one [ 216.945615][ T9639] bond5: (slave gretap2): Enslaving as an active interface with an up link [ 217.124995][ T9610] lo speed is unknown, defaulting to 1000 [ 217.139885][ T9645] netlink: 'syz.1.1002': attribute type 10 has an invalid length. [ 217.159791][ T9645] netlink: 40 bytes leftover after parsing attributes in process `syz.1.1002'. [ 217.185338][ T9645] A link change request failed with some changes committed already. Interface geneve0 may have been left with an inconsistent configuration, please check. [ 217.210551][ T9647] !: renamed from dummy0 [ 217.216848][ T9645] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1002'. [ 217.230315][ T9645] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1002'. [ 217.284860][ T9645] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for gretap3 [ 217.525044][ T9656] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1004'. [ 217.915944][ T9652] lo speed is unknown, defaulting to 1000 [ 219.139565][ T59] netdevsim netdevsim1 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 219.158111][ T59] netdevsim netdevsim1 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 219.181109][ T59] netdevsim netdevsim1 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 219.318202][ T9677] (unnamed net_device) (uninitialized): Unable to set peer notification delay as MII monitoring is disabled [ 219.957364][ T9694] x_tables: ip6_tables: rpfilter match: used from hooks OUTPUT, but only valid from PREROUTING [ 220.019853][ T9694] netlink: 256 bytes leftover after parsing attributes in process `syz.2.1012'. [ 220.153700][ T9700] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1013'. [ 220.178320][ T9700] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1013'. [ 220.209803][ T9700] netlink: 38 bytes leftover after parsing attributes in process `syz.0.1013'. [ 220.474709][ T9708] Cannot find add_set index 2 as target [ 220.832334][ T9723] tipc: Enabled bearer , priority 0 [ 220.858287][ T9723] syzkaller0: entered promiscuous mode [ 220.891870][ T9723] syzkaller0: entered allmulticast mode [ 220.934437][ T9675] netdevsim netdevsim1 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 221.014830][ T9723] tipc: Resetting bearer [ 221.036251][ T9721] tipc: Resetting bearer [ 221.113664][ T9721] tipc: Disabling bearer [ 221.270626][ T9675] netdevsim netdevsim1 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 221.309016][ T9730] lo speed is unknown, defaulting to 1000 [ 221.347897][ T9675] netdevsim netdevsim1 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 221.461606][ T9746] dvmrp0: entered allmulticast mode [ 221.608157][ T6240] netdevsim netdevsim1 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 221.757350][ T6199] netdevsim netdevsim1 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 221.778058][ T6199] netdevsim netdevsim1 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 221.882293][ T6234] netdevsim netdevsim1 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 222.046924][ T9758] netlink: 'syz.4.1026': attribute type 13 has an invalid length. [ 222.092480][ T9758] netlink: 'syz.4.1026': attribute type 17 has an invalid length. [ 222.162736][ T9758] erspan0: left allmulticast mode [ 222.854251][ T9758] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 222.968345][ T9764] lo speed is unknown, defaulting to 1000 [ 223.176091][ T9795] dvmrp0: entered allmulticast mode [ 223.246513][ T9798] netlink: 52 bytes leftover after parsing attributes in process `syz.1.1036'. [ 223.545931][ T9805] IPVS: length: 137 != 8 [ 223.905120][ T9815] bond0: (slave bond_slave_0): Releasing backup interface [ 223.949269][ T9821] ipt_ECN: cannot use operation on non-tcp rule [ 224.115513][ T9815] bond0: (slave bond_slave_1): Releasing backup interface [ 224.166495][ T9815] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 224.237454][ T9815] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 225.206840][ T9849] IPVS: length: 137 != 8 [ 225.216900][ T9847] netlink: 52 bytes leftover after parsing attributes in process `syz.0.1048'. [ 225.533765][ T9863] lo speed is unknown, defaulting to 1000 [ 225.635209][ T9866] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 226.226972][ T9898] IPVS: lblc: UDP 224.0.0.2:0 - no destination available [ 226.227899][ T9895] Cannot find add_set index 2 as target [ 226.247123][ T9866] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 226.310473][ T9899] IPVS: length: 137 != 8 [ 226.513630][ T9907] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1064'. [ 226.727404][ T9915] netlink: 'syz.2.1065': attribute type 8 has an invalid length. [ 226.727973][ T9916] netlink: 28 bytes leftover after parsing attributes in process `syz.3.1064'. [ 226.748127][ T9866] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 226.886226][ T9907] netlink: 132 bytes leftover after parsing attributes in process `syz.3.1064'. [ 227.429767][ T9866] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 227.525027][ T9940] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 227.538259][ T9898] lo speed is unknown, defaulting to 1000 [ 227.788265][ T49] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 227.940337][ T49] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 228.020840][ T49] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 228.035183][ T9954] Cannot find add_set index 2 as target [ 228.096706][ T49] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 228.316233][ T9961] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1078'. [ 228.339814][ T9961] netlink: 20 bytes leftover after parsing attributes in process `syz.2.1078'. [ 228.629490][ T9971] openvswitch: netlink: IP tunnel dst address not specified [ 229.278311][ T9995] Cannot find add_set index 2 as target [ 229.710102][T10010] netlink: 'syz.0.1093': attribute type 1 has an invalid length. [ 229.789947][T10010] 8021q: adding VLAN 0 to HW filter on device bond3 [ 229.888774][T10017] netlink: 16 bytes leftover after parsing attributes in process `syz.4.1094'. [ 229.955363][T10017] netlink: 20 bytes leftover after parsing attributes in process `syz.4.1094'. [ 230.067678][T10027] netlink: 'syz.2.1099': attribute type 3 has an invalid length. [ 230.099651][T10026] Can not set IPV6_FL_F_REFLECT if flowlabel_consistency sysctl is enable [ 230.130330][T10024] lo speed is unknown, defaulting to 1000 [ 230.330844][T10033] xt_CHECKSUM: CHECKSUM should be avoided. If really needed, restrict with "-p udp" and only use in OUTPUT [ 230.347710][T10036] netlink: 104 bytes leftover after parsing attributes in process `syz.4.1101'. [ 230.354520][T10033] Cannot find set identified by id 0 to match [ 230.733323][T10028] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1097'. [ 230.892445][T10028] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1097'. [ 231.229339][T10067] IPVS: lblc: UDP 224.0.0.2:0 - no destination available [ 231.232348][T10054] lo speed is unknown, defaulting to 1000 [ 231.805585][T10067] lo speed is unknown, defaulting to 1000 [ 232.218762][T10091] IPVS: length: 137 != 8 [ 232.908774][T10110] netlink: 'syz.4.1120': attribute type 29 has an invalid length. [ 232.995036][T10112] netlink: 508 bytes leftover after parsing attributes in process `syz.4.1120'. [ 233.061737][T10110] netlink: 'syz.4.1120': attribute type 29 has an invalid length. [ 233.486662][T10121] netlink: 87 bytes leftover after parsing attributes in process `syz.4.1124'. [ 233.500249][T10123] netlink: 248 bytes leftover after parsing attributes in process `syz.3.1125'. [ 233.665096][T10123] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1125'. [ 233.990469][T10143] IPVS: length: 137 != 8 [ 234.080874][T10148] netlink: 'syz.4.1133': attribute type 1 has an invalid length. [ 234.099066][T10148] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1133'. [ 234.109171][T10148] netlink: 45 bytes leftover after parsing attributes in process `syz.4.1133'. [ 234.130315][T10150] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1134'. [ 234.167814][T10150] netlink: 68 bytes leftover after parsing attributes in process `syz.3.1134'. [ 234.180446][T10150] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1134'. [ 234.197310][T10150] netlink: 68 bytes leftover after parsing attributes in process `syz.3.1134'. [ 234.370732][T10169] IPVS: lblc: UDP 224.0.0.2:0 - no destination available [ 234.448857][T10172] netlink: 1041 bytes leftover after parsing attributes in process `syz.0.1137'. [ 234.655784][T10169] lo speed is unknown, defaulting to 1000 [ 235.243022][T10197] tipc: Enabling of bearer rejected, failed to enable media [ 235.950884][T10224] xt_addrtype: ipv6 PROHIBIT (THROW, NAT ..) matching not supported [ 236.014043][T10175] lo speed is unknown, defaulting to 1000 [ 236.279185][T10232] netlink: 'syz.0.1150': attribute type 1 has an invalid length. [ 236.291985][T10232] NCSI netlink: No device for ifindex 0 [ 236.378433][T10234] A link change request failed with some changes committed already. Interface wlan0 may have been left with an inconsistent configuration, please check. [ 236.614412][T10236] lo speed is unknown, defaulting to 1000 [ 236.845059][T10242] netlink: 'syz.3.1154': attribute type 6 has an invalid length. [ 237.460765][T10260] netlink: 'syz.3.1159': attribute type 4 has an invalid length. [ 237.760195][T10265] lo speed is unknown, defaulting to 1000 [ 238.936533][T10284] __nla_validate_parse: 21 callbacks suppressed [ 238.936556][T10284] netlink: 248 bytes leftover after parsing attributes in process `syz.0.1167'. [ 238.973262][T10284] netlink: 48 bytes leftover after parsing attributes in process `syz.0.1167'. [ 238.988193][T10285] pimreg: left allmulticast mode [ 239.064946][T10292] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1168'. [ 239.097360][T10292] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1168'. [ 239.171904][T10284] rdma_rxe: rxe_newlink: failed to add lo [ 239.223001][T10284] erspan0: left allmulticast mode [ 239.273026][T10296] netlink: 'syz.4.1169': attribute type 9 has an invalid length. [ 239.326838][T10284] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 239.351411][T10296] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1169'. [ 239.532807][T10285] netlink: 32 bytes leftover after parsing attributes in process `syz.0.1167'. [ 239.602271][T10296] hsr0: entered promiscuous mode [ 239.626332][T10296] macvlan0: entered promiscuous mode [ 239.646846][T10296] macvlan0: entered allmulticast mode [ 239.696450][T10296] hsr0: entered allmulticast mode [ 239.722915][T10296] hsr_slave_0: entered allmulticast mode [ 239.729245][T10296] hsr_slave_1: entered allmulticast mode [ 240.514906][T10325] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 240.522244][T10325] IPv6: NLM_F_CREATE should be set when creating new route [ 241.152707][T10328] ieee802154 phy1 wpan1: encryption failed: -22 [ 241.994815][T10341] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1184'. [ 242.679256][T10362] lo speed is unknown, defaulting to 1000 [ 243.200542][T10384] geneve2: entered promiscuous mode [ 243.209373][T10384] geneve2: entered allmulticast mode [ 243.218333][ T1093] netdevsim netdevsim3 eth0: set [1, 0] type 2 family 0 port 35561 - 0 [ 243.233915][ T1093] netdevsim netdevsim3 eth0: set [1, 1] type 2 family 0 port 60555 - 0 [ 243.272785][ T1093] netdevsim netdevsim3 eth1: set [1, 0] type 2 family 0 port 35561 - 0 [ 243.296908][ T1093] netdevsim netdevsim3 eth1: set [1, 1] type 2 family 0 port 60555 - 0 [ 243.325350][ T1093] netdevsim netdevsim3 eth2: set [1, 0] type 2 family 0 port 35561 - 0 [ 243.341904][ T1093] netdevsim netdevsim3 eth2: set [1, 1] type 2 family 0 port 60555 - 0 [ 243.356350][ T1093] netdevsim netdevsim3 eth3: set [1, 0] type 2 family 0 port 35561 - 0 [ 243.364831][ T1093] netdevsim netdevsim3 eth3: set [1, 1] type 2 family 0 port 60555 - 0 [ 243.432043][T10391] netlink: 'syz.1.1198': attribute type 1 has an invalid length. [ 243.644349][T10397] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1200'. [ 244.009673][T10409] syzkaller1: entered promiscuous mode [ 244.030560][T10409] syzkaller1: entered allmulticast mode [ 244.050157][T10414] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1207'. [ 244.063601][T10414] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1207'. [ 244.075836][T10413] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1207'. [ 244.085816][T10413] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1207'. [ 244.172996][T10423] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1208'. [ 244.538225][T10433] siw: device registration error -23 [ 244.743309][T10436] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1213'. [ 244.795923][ T6199] netdevsim netdevsim0 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 244.801638][T10436] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1213'. [ 244.808194][ T6199] netdevsim netdevsim0 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 244.829714][ T6199] netdevsim netdevsim0 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 244.854096][ T6199] netdevsim netdevsim0 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 244.869359][T10440] netlink: 32 bytes leftover after parsing attributes in process `syz.2.1215'. [ 244.884590][T10442] Cannot find add_set index 2 as target [ 244.898955][T10440] netlink: 71 bytes leftover after parsing attributes in process `syz.2.1215'. [ 244.958364][T10440] tipc: Enabling of bearer rejected, failed to enable media [ 245.016777][T10445] Cannot find add_set index 2 as target [ 245.494394][T10466] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1223'. [ 245.759289][T10477] netdevsim netdevsim1 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 245.868369][T10481] netlink: 'syz.0.1228': attribute type 1 has an invalid length. [ 245.869622][T10477] netdevsim netdevsim1 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 245.884331][T10486] sctp: [Deprecated]: syz.0.1228 (pid 10486) Use of struct sctp_assoc_value in delayed_ack socket option. [ 245.884331][T10486] Use struct sctp_sack_info instead [ 245.901515][T10480] netlink: 'syz.1.1227': attribute type 1 has an invalid length. [ 245.904097][T10481] sctp: [Deprecated]: syz.0.1228 (pid 10481) Use of struct sctp_assoc_value in delayed_ack socket option. [ 245.904097][T10481] Use struct sctp_sack_info instead [ 245.967945][T10483] netlink: 'syz.0.1228': attribute type 3 has an invalid length. [ 246.068491][T10477] netdevsim netdevsim1 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 246.142884][T10491] Cannot find add_set index 2 as target [ 246.179844][T10477] netdevsim netdevsim1 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 246.316066][ T49] netdevsim netdevsim1 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 246.356460][ T49] netdevsim netdevsim1 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 246.393350][ T49] netdevsim netdevsim1 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 246.436467][ T1145] netdevsim netdevsim1 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 246.606106][T10507] tipc: Enabled bearer , priority 0 [ 246.638399][T10507] syzkaller0: entered promiscuous mode [ 246.665184][T10507] syzkaller0: entered allmulticast mode [ 246.704482][T10516] syzkaller1: entered promiscuous mode [ 246.721112][T10516] syzkaller1: entered allmulticast mode [ 246.884507][T10507] tipc: Resetting bearer [ 246.951843][T10506] tipc: Resetting bearer [ 247.042937][T10506] tipc: Disabling bearer [ 247.291397][T10552] Cannot find add_set index 2 as target [ 247.312040][ T1145] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 247.320303][ T1145] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 247.397399][T10551] lo speed is unknown, defaulting to 1000 [ 247.669231][T10572] IPVS: lblc: UDP 224.0.0.2:0 - no destination available [ 248.272207][T10585] netlink: 'syz.2.1254': attribute type 4 has an invalid length. [ 248.759129][T10595] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 248.809814][T10572] lo speed is unknown, defaulting to 1000 [ 249.386454][T10612] lo speed is unknown, defaulting to 1000 [ 249.943524][T10603] rdma_rxe: rxe_newlink: failed to add lo [ 250.867607][T10620] bond0: entered promiscuous mode [ 250.877698][T10620] bond_slave_0: entered promiscuous mode [ 250.925673][T10620] bond_slave_1: entered promiscuous mode [ 250.941456][T10620] mac80211_hwsim hwsim3 wlan1: entered promiscuous mode [ 250.957397][T10620] !: entered promiscuous mode [ 250.972459][T10620] bond0: left promiscuous mode [ 250.977466][T10620] bond_slave_0: left promiscuous mode [ 250.994111][T10620] bond_slave_1: left promiscuous mode [ 251.010006][T10620] mac80211_hwsim hwsim3 wlan1: left promiscuous mode [ 251.032469][T10620] !: left promiscuous mode [ 251.300279][T10638] __nla_validate_parse: 12 callbacks suppressed [ 251.300301][T10638] netlink: 96 bytes leftover after parsing attributes in process `syz.1.1266'. [ 251.909002][T10650] tipc: Enabled bearer , priority 0 [ 251.954590][T10650] syzkaller0: entered promiscuous mode [ 251.960283][T10650] syzkaller0: entered allmulticast mode [ 252.114143][T10654] netlink: 'syz.3.1269': attribute type 1 has an invalid length. [ 252.140811][T10653] tipc: Resetting bearer [ 252.553235][T10649] tipc: Resetting bearer [ 252.637525][T10649] tipc: Disabling bearer [ 252.663255][T10666] netlink: 36 bytes leftover after parsing attributes in process `syz.1.1274'. [ 252.904905][T10676] netlink: 'syz.3.1277': attribute type 13 has an invalid length. [ 252.922413][T10678] smc: net device bond0 erased user defined pnetid SYZ2 [ 252.932136][T10676] netlink: 40 bytes leftover after parsing attributes in process `syz.3.1277'. [ 252.971706][T10676] net veth1_virt_wifi virt_wifi0: refused to change device tx_queue_len [ 253.647507][T10678] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 253.714895][T10678] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 253.783421][T10678] bond0 (unregistering): (slave wlan1): Releasing backup interface [ 253.959035][T10678] bond0 (unregistering): Released all slaves [ 254.092592][T10693] bond0: Unable to set peer notification delay as MII monitoring is disabled [ 254.425725][T10710] netlink: 'syz.0.1286': attribute type 83 has an invalid length. [ 254.494409][T10704] netlink: 163948 bytes leftover after parsing attributes in process `syz.3.1284'. [ 254.623434][T10713] netlink: 212376 bytes leftover after parsing attributes in process `syz.2.1287'. [ 255.118987][T10734] netlink: 'syz.3.1294': attribute type 1 has an invalid length. [ 255.456616][T10734] 8021q: adding VLAN 0 to HW filter on device bond1 [ 255.874575][T10751] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1298'. [ 255.896221][ T1301] ieee802154 phy1 wpan1: encryption failed: -22 [ 256.195349][T10760] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1302'. [ 256.336819][T10760] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1302'. [ 256.423903][T10574] Set syz1 is full, maxelem 65536 reached [ 256.446948][T10696] Cannot find add_set index 2 as target [ 256.490043][T10770] lo speed is unknown, defaulting to 1000 [ 256.972712][T10793] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1310'. [ 257.007510][T10796] netlink: 'syz.4.1311': attribute type 1 has an invalid length. [ 257.060895][T10799] netlink: 144 bytes leftover after parsing attributes in process `syz.4.1311'. [ 257.245518][T10796] 8021q: adding VLAN 0 to HW filter on device bond3 [ 257.532611][T10802] veth3: entered promiscuous mode [ 257.675032][T10820] netlink: 'syz.1.1315': attribute type 10 has an invalid length. [ 258.146790][T10790] lo speed is unknown, defaulting to 1000 [ 258.158186][T10828] workqueue: Failed to create a rescuer kthread for wq "nfc2_nci_cmd_wq": -EINTR [ 258.627659][T10842] Cannot find add_set index 2 as target [ 258.897468][T10814] lo speed is unknown, defaulting to 1000 [ 259.547150][T10870] netlink: 'syz.2.1324': attribute type 1 has an invalid length. [ 259.675241][T10870] bond2: entered promiscuous mode [ 259.680812][T10870] 8021q: adding VLAN 0 to HW filter on device bond2 [ 259.710769][T10844] lo speed is unknown, defaulting to 1000 [ 259.983165][T10890] netlink: 'syz.2.1328': attribute type 1 has an invalid length. [ 260.054563][T10890] 8021q: adding VLAN 0 to HW filter on device bond3 [ 260.151606][T10890] erspan0: entered allmulticast mode [ 260.230497][T10890] bond3: (slave erspan0): making interface the new active one [ 260.243546][T10890] bond3: (slave erspan0): Enslaving as an active interface with an up link [ 260.398980][T10895] netlink: 36 bytes leftover after parsing attributes in process `syz.0.1329'. [ 260.494976][T10900] rdma_op ffff88802833f9f0 conn xmit_rdma 0000000000000000 [ 260.577520][T10895] syzkaller0: entered promiscuous mode [ 260.599761][T10903] Cannot find add_set index 2 as target [ 260.618280][T10895] syzkaller0: entered allmulticast mode [ 261.091452][T10915] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1334'. [ 261.736192][T10933] netlink: 28 bytes leftover after parsing attributes in process `syz.3.1338'. [ 262.263474][T10947] lo speed is unknown, defaulting to 1000 [ 262.434198][T10944] IPVS: set_ctl: invalid protocol: 0 0.0.0.0:0 [ 263.277480][T10971] IPVS: length: 137 != 8 [ 263.336633][T10969] mac80211_hwsim hwsim7 wlan1: entered allmulticast mode [ 263.457195][T10981] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1353'. [ 263.504058][T10983] netlink: 'syz.0.1354': attribute type 2 has an invalid length. [ 263.545752][T10983] netlink: 44 bytes leftover after parsing attributes in process `syz.0.1354'. [ 263.600666][T10983] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1354'. [ 263.710016][T10983] openvswitch: netlink: Key type 13058 is out of range max 32 [ 264.158740][T10997] netlink: 'syz.0.1359': attribute type 1 has an invalid length. [ 264.235450][T11005] netlink: 40 bytes leftover after parsing attributes in process `syz.3.1361'. [ 264.495318][T11016] IPVS: length: 137 != 8 [ 264.770688][T11020] netlink: 'syz.0.1365': attribute type 1 has an invalid length. [ 264.781998][T11026] netlink: 'syz.4.1367': attribute type 2 has an invalid length. [ 264.810031][T11020] netlink: 244 bytes leftover after parsing attributes in process `syz.0.1365'. [ 264.827895][T11025] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1367'. [ 265.279230][T11044] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1372'. [ 265.327528][T11046] netlink: 3 bytes leftover after parsing attributes in process `syz.0.1373'. [ 265.430516][T11046] netlink: 'syz.0.1373': attribute type 1 has an invalid length. [ 265.438854][T11054] smc: net device bond0 applied user defined pnetid SYZ2 [ 265.447932][T11054] netlink: 14 bytes leftover after parsing attributes in process `syz.3.1376'. [ 265.537636][T11056] lo speed is unknown, defaulting to 1000 [ 265.614882][T11060] Cannot find add_set index 2 as target [ 265.793604][T11068] IPVS: length: 137 != 8 [ 265.989671][T11054] smc: removing net device bond0 with user defined pnetid SYZ2 [ 266.021985][T11054] bond0 (unregistering): Released all slaves [ 266.675430][T11094] netlink: 'syz.3.1388': attribute type 21 has an invalid length. [ 266.780436][T11094] IPv6: NLM_F_CREATE should be specified when creating new route [ 266.965635][T11103] Cannot find add_set index 2 as target [ 267.033323][T11107] __nla_validate_parse: 2 callbacks suppressed [ 267.033345][T11107] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1393'. [ 267.099499][T11107] openvswitch: netlink: Flow key attr not present in new flow. [ 267.420735][T11107] lo speed is unknown, defaulting to 1000 [ 267.879396][T11126] tipc: Enabled bearer , priority 0 [ 267.964609][T11124] netlink: 136 bytes leftover after parsing attributes in process `syz.1.1399'. [ 268.002621][T11124] A link change request failed with some changes committed already. Interface sit0 may have been left with an inconsistent configuration, please check. [ 268.234613][T11129] syzkaller0: entered promiscuous mode [ 268.251070][T11129] syzkaller0: entered allmulticast mode [ 268.301811][T11123] tipc: Resetting bearer [ 268.357328][T11123] tipc: Disabling bearer [ 268.509630][T11119] lo speed is unknown, defaulting to 1000 [ 268.629686][T11146] netlink: 'syz.2.1404': attribute type 10 has an invalid length. [ 268.650183][T11147] netlink: 40 bytes leftover after parsing attributes in process `syz.1.1403'. [ 268.759876][T11146] batman_adv: batadv0: Adding interface: netdevsim0 [ 268.771629][T11146] batman_adv: batadv0: The MTU of interface netdevsim0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 268.804768][T11146] batman_adv: batadv0: Not using interface netdevsim0 (retrying later): interface not active [ 268.963955][T11156] IPVS: length: 137 != 8 [ 269.151797][T11161] SET target dimension over the limit! [ 269.243755][T11165] netlink: 44 bytes leftover after parsing attributes in process `syz.1.1410'. [ 269.397632][T11174] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1408'. [ 270.088710][T11186] netlink: 'syz.1.1414': attribute type 10 has an invalid length. [ 270.465029][T11196] netlink: 56 bytes leftover after parsing attributes in process `syz.2.1416'. [ 271.122509][T11201] lo speed is unknown, defaulting to 1000 [ 271.220680][T11210] netlink: 'syz.1.1418': attribute type 4 has an invalid length. [ 271.251894][T11210] netlink: 'syz.1.1418': attribute type 6 has an invalid length. [ 271.279184][T11210] netlink: 204 bytes leftover after parsing attributes in process `syz.1.1418'. [ 271.594423][T11221] tipc: Started in network mode [ 271.599662][T11221] tipc: Node identity 4, cluster identity 4711 [ 271.619683][T11221] tipc: Node number set to 4 [ 271.861369][T11228] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1424'. [ 271.955221][T11232] netlink: 48 bytes leftover after parsing attributes in process `syz.4.1426'. [ 272.196215][T11228] bridge_slave_1: left allmulticast mode [ 272.207069][T11228] bridge_slave_1: left promiscuous mode [ 272.219912][T11228] bridge0: port 2(bridge_slave_1) entered disabled state [ 272.243314][T11228] bridge_slave_0: left allmulticast mode [ 272.258168][T11228] bridge_slave_0: left promiscuous mode [ 272.266659][T11239] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1427'. [ 272.272337][T11228] bridge0: port 1(bridge_slave_0) entered disabled state [ 272.447297][T11242] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1427'. [ 272.498614][T11169] lo speed is unknown, defaulting to 1000 [ 272.561758][T11238] veth0_to_bridge: entered promiscuous mode [ 272.738013][T11235] veth0_to_bridge: left promiscuous mode [ 273.433751][T11252] lo speed is unknown, defaulting to 1000 [ 273.827526][T11269] netlink: 'syz.3.1433': attribute type 3 has an invalid length. [ 274.700794][T11281] netlink: 16 bytes leftover after parsing attributes in process `syz.3.1437'. [ 274.732447][T11281] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1437'. [ 274.742211][T11281] netlink: 32 bytes leftover after parsing attributes in process `syz.3.1437'. [ 275.086059][T11286] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 275.137394][T11286] netlink: 28 bytes leftover after parsing attributes in process `syz.3.1438'. [ 275.153360][T11291] xt_HMARK: spi-set and port-set can't be combined [ 275.218970][T11292] xt_HMARK: spi-set and port-set can't be combined [ 275.478540][T11298] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1441'. [ 275.570857][T11298] macvlan2: entered promiscuous mode [ 275.590386][T11298] bond0: entered promiscuous mode [ 275.620761][T11298] bond_slave_0: entered promiscuous mode [ 275.627654][T11298] bond_slave_1: entered promiscuous mode [ 275.634474][T11298] mac80211_hwsim hwsim3 wlan1: entered promiscuous mode [ 275.651692][T11298] !: entered promiscuous mode [ 276.203248][T11315] netlink: 68 bytes leftover after parsing attributes in process `syz.1.1447'. [ 276.627531][T11335] IPVS: length: 137 != 8 [ 276.855930][T11334] lo speed is unknown, defaulting to 1000 [ 276.904254][T11345] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1453'. [ 276.973447][T11345] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1453'. [ 278.032306][T11382] IPVS: length: 137 != 8 [ 278.147971][T11386] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1465'. [ 278.161124][T11386] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1465'. [ 278.200015][T11389] netlink: 'syz.2.1464': attribute type 10 has an invalid length. [ 278.294477][T11372] bridge0: port 2(bridge_slave_1) entered disabled state [ 278.302544][T11372] bridge0: port 1(bridge_slave_0) entered disabled state [ 278.712632][T11372] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 279.002547][T11372] mac80211_hwsim hwsim4 wlan0: left promiscuous mode [ 279.025039][T11372] xfrm1: left promiscuous mode [ 279.035887][T11372] xfrm1: left allmulticast mode [ 279.237569][ T6240] netdevsim netdevsim0 eth0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 279.254509][T11401] Cannot find add_set index 2 as target [ 279.260471][ T6240] netdevsim netdevsim0 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 279.295121][ T6240] netdevsim netdevsim0 eth1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 279.311015][ T6240] netdevsim netdevsim0 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 279.345090][T11407] netlink: 892 bytes leftover after parsing attributes in process `syz.2.1468'. [ 279.394444][ T6240] netdevsim netdevsim0 eth2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 279.431278][ T6240] netdevsim netdevsim0 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 279.458586][ T6240] netdevsim netdevsim0 eth3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 279.488072][ T6240] netdevsim netdevsim0 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 279.500689][T11411] netlink: 16 bytes leftover after parsing attributes in process `syz.3.1470'. [ 279.556334][T11412] netlink: 16 bytes leftover after parsing attributes in process `syz.3.1470'. [ 279.702793][T11414] lo speed is unknown, defaulting to 1000 [ 280.379370][T11438] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1476'. [ 280.543172][T11422] lo speed is unknown, defaulting to 1000 [ 280.932909][T11445] IPVS: length: 137 != 8 [ 281.096903][T11458] SET target dimension over the limit! [ 281.444784][T11470] 8021q: adding VLAN 0 to HW filter on device bond4 [ 281.598179][T11482] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1487'. [ 281.783761][T11483] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1487'. [ 281.969595][T11495] netlink: 'syz.1.1491': attribute type 2 has an invalid length. [ 282.001917][T11495] netlink: 1184 bytes leftover after parsing attributes in process `syz.1.1491'. [ 282.106253][T11499] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1493'. [ 282.165553][T11501] netlink: 'syz.2.1492': attribute type 9 has an invalid length. [ 282.635172][T11506] lo speed is unknown, defaulting to 1000 [ 282.688517][T11516] Cannot find add_set index 2 as target [ 282.864471][T11519] netlink: 'syz.0.1498': attribute type 10 has an invalid length. [ 282.873630][T11519] netlink: 'syz.0.1498': attribute type 10 has an invalid length. [ 283.163530][T11527] veth0: entered promiscuous mode [ 283.178993][T11527] __nla_validate_parse: 2 callbacks suppressed [ 283.179024][T11527] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1500'. [ 283.256202][T11531] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1502'. [ 283.710243][T11509] lo speed is unknown, defaulting to 1000 [ 283.772831][T11547] (unnamed net_device) (uninitialized): option packets_per_slave: invalid value (18446744073709551615) [ 283.791480][T11547] (unnamed net_device) (uninitialized): option packets_per_slave: allowed values 0 - 65535 [ 283.840800][ T30] audit: type=1800 audit(1753270162.791:10): pid=11550 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.1508" name=33FFFF dev="tmpfs" ino=1594 res=0 errno=0 [ 284.112608][T11557] dvmrp8: entered allmulticast mode [ 284.136110][T11555] Cannot find add_set index 2 as target [ 284.290036][T11557] dvmrp8: left allmulticast mode [ 284.670234][T11569] lo speed is unknown, defaulting to 1000 [ 284.692877][T11575] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1515'. [ 285.405497][T11586] tipc: Enabled bearer , priority 0 [ 285.522488][T11586] syzkaller0: entered promiscuous mode [ 285.538361][T11586] syzkaller0: entered allmulticast mode [ 285.556352][T11586] tipc: Resetting bearer [ 285.562291][T11592] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1518'. [ 285.719391][T11596] netlink: 204 bytes leftover after parsing attributes in process `syz.1.1519'. [ 285.754095][ T1093] tipc: Resetting bearer [ 285.765456][T11585] tipc: Resetting bearer [ 286.486577][ T24] tipc: Node number set to 932430727 [ 287.248211][T11585] tipc: Disabling bearer [ 287.264719][T11576] lo speed is unknown, defaulting to 1000 [ 287.939678][T11607] lo speed is unknown, defaulting to 1000 [ 287.963712][T11615] Cannot find add_set index 2 as target [ 288.038799][ T5855] Bluetooth: hci4: link tx timeout [ 288.038907][T11616] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1524'. [ 288.044601][ T5855] Bluetooth: hci4: killing stalled connection 10:aa:aa:aa:aa:aa [ 288.072967][ T5861] Bluetooth: hci4: link tx timeout [ 288.078378][ T5861] Bluetooth: hci4: killing stalled connection 10:aa:aa:aa:aa:aa [ 288.086697][ T5861] Bluetooth: hci4: link tx timeout [ 288.092454][ T5861] Bluetooth: hci4: killing stalled connection 10:aa:aa:aa:aa:aa [ 288.100227][ T5861] Bluetooth: hci4: link tx timeout [ 288.105934][ T5861] Bluetooth: hci4: killing stalled connection 10:aa:aa:aa:aa:aa [ 288.114328][ T5861] Bluetooth: hci4: link tx timeout [ 288.119557][ T5861] Bluetooth: hci4: killing stalled connection 10:aa:aa:aa:aa:aa [ 288.127983][ T5861] Bluetooth: hci4: link tx timeout [ 288.133672][ T5861] Bluetooth: hci4: killing stalled connection 10:aa:aa:aa:aa:aa [ 288.696359][T11629] mac80211_hwsim hwsim11 wlan1: entered promiscuous mode [ 288.720053][T11629] macvtap0: entered promiscuous mode [ 288.739650][T11629] mac80211_hwsim hwsim11 wlan1: left promiscuous mode [ 288.874156][T11626] lo speed is unknown, defaulting to 1000 [ 289.556080][T11649] netlink: 'syz.4.1530': attribute type 16 has an invalid length. [ 289.574228][T11649] netlink: 20 bytes leftover after parsing attributes in process `syz.4.1530'. [ 289.665433][T11651] netlink: 'syz.3.1532': attribute type 10 has an invalid length. [ 289.699990][T11651] netlink: 'syz.3.1532': attribute type 10 has an invalid length. [ 290.136785][ T5861] Bluetooth: hci4: command 0x0406 tx timeout [ 290.725915][T11669] tipc: Enabled bearer , priority 0 [ 291.844214][ T5986] tipc: Node number set to 3100469452 [ 292.304194][T11669] tipc: Disabling bearer [ 292.476120][T11675] Cannot find add_set index 2 as target [ 292.498018][T11677] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1536'. [ 292.575509][T11681] netlink: 176 bytes leftover after parsing attributes in process `syz.2.1538'. [ 292.620914][T11681] ip6gretap0: entered promiscuous mode [ 292.639158][T11682] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1538'. [ 293.228115][T11703] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 293.368244][T11696] lo speed is unknown, defaulting to 1000 [ 293.459174][T11703] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 293.628296][T11717] 8021q: adding VLAN 0 to HW filter on device bond6 [ 293.755500][T11718] bond6: (slave macvlan3): Enslaving as a backup interface with an up link [ 293.806086][T11719] bond0: (slave 0!): Releasing backup interface [ 293.842292][T11719] !: left promiscuous mode [ 293.848170][ T6199] bond6: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 293.877379][T11719] bond0: (slave bond_slave_0): Releasing backup interface [ 293.893248][T11719] bond_slave_0: left promiscuous mode [ 293.902587][T11719] bond0: (slave bond_slave_1): Releasing backup interface [ 293.911547][T11719] bond_slave_1: left promiscuous mode [ 293.919746][T11719] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 293.928489][T11719] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 293.978079][T11719] bond0: (slave wlan1): Releasing backup interface [ 293.985798][ T1145] bond6: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 293.986616][T11719] mac80211_hwsim hwsim3 wlan1: left promiscuous mode [ 294.021964][T11719] bond5: (slave gretap2): Releasing active interface [ 294.055774][T11719] bond6: (slave macvlan3): Removing an active aggregator [ 294.064357][T11719] bond6: (slave macvlan3): Releasing backup interface [ 294.159404][T11703] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 294.239581][T11709] lo speed is unknown, defaulting to 1000 [ 294.250403][T11738] netlink: 60 bytes leftover after parsing attributes in process `syz.1.1553'. [ 294.280394][T11738] netlink: 35 bytes leftover after parsing attributes in process `syz.1.1553'. [ 294.324170][T11703] batman_adv: batadv0: Removing interface: netdevsim0 [ 294.354301][T11703] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 294.639172][ T1145] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 294.782327][T11753] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1555'. [ 294.995103][T11753] 8021q: adding VLAN 0 to HW filter on device ipvlan2 [ 295.012813][ T1093] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 295.094007][ T1093] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 295.152926][ T1093] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 295.181672][T11759] smc: net device bond0 applied user defined pnetid SYZ2 [ 295.195064][T11762] netlink: 'syz.4.1560': attribute type 10 has an invalid length. [ 295.202768][T11759] smc: net device bond0 erased user defined pnetid SYZ2 [ 295.420196][T11762] bond0: (slave wlan1): Enslaving as an active interface with an up link [ 295.438366][T11759] tipc: Enabled bearer , priority 0 [ 295.467222][T11759] netlink: 92 bytes leftover after parsing attributes in process `syz.3.1559'. [ 295.484497][T11774] netlink: 44 bytes leftover after parsing attributes in process `syz.2.1562'. [ 295.613130][T11780] netlink: 'syz.2.1562': attribute type 4 has an invalid length. [ 295.629245][T11780] netlink: 152 bytes leftover after parsing attributes in process `syz.2.1562'. [ 295.700734][T11760] syzkaller0: entered promiscuous mode [ 295.714393][T11760] syzkaller0: entered allmulticast mode [ 295.750771][T11765] bridge_slave_0: left allmulticast mode [ 295.764732][T11765] bridge_slave_0: left promiscuous mode [ 295.779182][T11765] bridge0: port 1(bridge_slave_0) entered disabled state [ 295.797805][T11765] bridge_slave_1: left allmulticast mode [ 295.803877][T11765] bridge_slave_1: left promiscuous mode [ 295.809987][T11765] bridge0: port 2(bridge_slave_1) entered disabled state [ 295.823351][T11765] bond0: (slave bond_slave_0): Releasing backup interface [ 295.842872][T11765] bond0: (slave bond_slave_1): Releasing backup interface [ 295.859792][T11765] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 295.868429][T11765] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 295.880879][T11765] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 295.890026][T11765] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 295.907006][T11765] bond0: (slave wlan1): Releasing backup interface [ 295.938906][T11765] batman_adv: batadv0: Interface deactivated: macsec1 [ 295.957053][T11765] batman_adv: batadv0: Removing interface: macsec1 [ 295.970363][T11771] tipc: Resetting bearer [ 296.006375][T11759] gretap2: entered promiscuous mode [ 296.039284][T11758] tipc: Resetting bearer [ 296.572961][T11799] netlink: 28 bytes leftover after parsing attributes in process `syz.2.1568'. [ 296.909942][T11807] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1571'. [ 296.926419][T11807] Couldn't find request waiting for DGID: 0000:0000:0000:0000:0000:0000:0000:0000 [ 298.068191][T11758] tipc: Disabling bearer [ 298.112612][T11783] lo speed is unknown, defaulting to 1000 [ 298.126612][T11818] tipc: Enabling of bearer rejected, failed to enable media [ 298.281240][T11821] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1574'. [ 298.439163][T11826] netlink: 'syz.3.1577': attribute type 1 has an invalid length. [ 298.506309][T11826] smc: adding net device bond0 with user defined pnetid SYZ2 [ 298.539308][T11826] bond0: entered promiscuous mode [ 298.553729][T11826] bond0: entered allmulticast mode [ 298.559454][T11826] 8021q: adding VLAN 0 to HW filter on device bond0 [ 298.592934][T11826] ip6gretap1: entered promiscuous mode [ 298.599538][T11826] ip6gretap1: entered allmulticast mode [ 298.606056][T11826] bond0: (slave ip6gretap1): Enslaving as a backup interface with an up link [ 298.641175][ T12] bond0: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 298.762307][ T49] bond0: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 299.116408][T11850] syzkaller1: entered promiscuous mode [ 299.165560][T11850] syzkaller1: entered allmulticast mode [ 299.220921][T11856] netlink: 'syz.4.1584': attribute type 1 has an invalid length. [ 299.229589][T11848] lo speed is unknown, defaulting to 1000 [ 299.297145][T11862] netlink: 20 bytes leftover after parsing attributes in process `syz.2.1585'. [ 299.321634][T11856] workqueue: Failed to create a rescuer kthread for wq "bond5": -EINTR [ 299.442885][T11865] netlink: 566 bytes leftover after parsing attributes in process `syz.4.1586'. [ 299.655679][T11870] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1587'. [ 300.035363][T11874] __nla_validate_parse: 1 callbacks suppressed [ 300.035385][T11874] netlink: 20 bytes leftover after parsing attributes in process `syz.4.1589'. [ 300.092107][T11870] syz.2.1587 (11870) used greatest stack depth: 17864 bytes left [ 300.293692][T11874] vlan0: entered promiscuous mode [ 300.830359][T11899] macvlan1: entered promiscuous mode [ 300.859591][T11899] ipvlan0: entered promiscuous mode [ 300.912441][T11899] ipvlan0: left promiscuous mode [ 300.932093][T11899] macvlan1: left promiscuous mode [ 301.252242][T11916] netlink: 'syz.2.1600': attribute type 23 has an invalid length. [ 301.268885][T11919] ipt_rpfilter: unknown options [ 301.786075][T11944] netlink: 28 bytes leftover after parsing attributes in process `syz.2.1612'. [ 301.838425][T11944] 8021q: adding VLAN 0 to HW filter on device bond0 [ 301.930638][T11949] openvswitch: netlink: Message has 16 unknown bytes. [ 302.015173][T11949] netlink: 'syz.3.1613': attribute type 1 has an invalid length. [ 302.038211][T11949] netlink: 88 bytes leftover after parsing attributes in process `syz.3.1613'. [ 302.075951][T11949] netlink: 'syz.3.1613': attribute type 1 has an invalid length. [ 302.096821][T11953] netlink: 40 bytes leftover after parsing attributes in process `syz.0.1614'. [ 302.352933][T11963] xt_bpf: check failed: parse error [ 302.397559][T11973] netlink: 96 bytes leftover after parsing attributes in process `syz.4.1621'. [ 302.445150][T11978] bridge_slave_0: left allmulticast mode [ 302.488461][T11978] bridge_slave_0: left promiscuous mode [ 302.501916][T11978] bridge0: port 1(bridge_slave_0) entered disabled state [ 302.572971][T11978] bridge_slave_1: left allmulticast mode [ 302.578685][T11978] bridge_slave_1: left promiscuous mode [ 302.624639][T11978] bridge0: port 2(bridge_slave_1) entered disabled state [ 302.696525][T11978] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 302.782233][T11985] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 302.821374][T11985] netlink: 'syz.4.1625': attribute type 4 has an invalid length. [ 302.968268][T11992] x_tables: duplicate entry at hook 3 [ 303.008567][T11992] netlink: 48 bytes leftover after parsing attributes in process `syz.0.1627'. [ 303.225097][T11998] netlink: 212376 bytes leftover after parsing attributes in process `syz.1.1628'. [ 303.411316][T12002] Bluetooth: MGMT ver 1.23 [ 303.533372][T11985] mac80211_hwsim hwsim10 wlan0: left allmulticast mode [ 303.668205][T12020] openvswitch: netlink: IP tunnel attribute has 8 unknown bytes. [ 303.670631][T11985] hsr0: left allmulticast mode [ 303.711960][T11985] hsr_slave_0: left allmulticast mode [ 303.717407][T11985] hsr_slave_1: left allmulticast mode [ 303.766206][ T45] lo speed is unknown, defaulting to 1000 [ 303.780222][T11975] lo speed is unknown, defaulting to 1000 [ 303.793084][ T49] netdevsim netdevsim4 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 303.794246][ T45] syz0: Port: 1 Link DOWN [ 303.822351][ T49] netdevsim netdevsim4 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 303.910854][ T49] netdevsim netdevsim4 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 303.939779][ T49] netdevsim netdevsim4 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 303.980762][T12004] lo speed is unknown, defaulting to 1000 [ 304.527098][T12028] lo speed is unknown, defaulting to 1000 [ 304.725630][T12051] netlink: 'syz.1.1641': attribute type 4 has an invalid length. [ 304.754917][T12051] netlink: 'syz.1.1641': attribute type 4 has an invalid length. [ 305.185524][T12048] lo speed is unknown, defaulting to 1000 [ 305.416749][T12071] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1646'. [ 306.331227][ T30] audit: type=1800 audit(1753270185.281:11): pid=12092 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.1650" name="memory.events" dev="tmpfs" ino=1809 res=0 errno=0 [ 306.675769][T12097] bridge1: entered allmulticast mode [ 306.922141][T12108] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1657'. [ 307.166799][T12113] vlan0: entered promiscuous mode [ 307.204972][T12116] netlink: 'syz.4.1661': attribute type 2 has an invalid length. [ 307.231838][T12116] netlink: 24 bytes leftover after parsing attributes in process `syz.4.1661'. [ 307.293594][T12119] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1661'. [ 307.332427][T12119] batadv0: entered promiscuous mode [ 307.358464][T12119] 8021q: adding VLAN 0 to HW filter on device macvlan1 [ 307.359199][T12123] netlink: 'syz.0.1663': attribute type 1 has an invalid length. [ 307.400342][T12119] batadv0: left promiscuous mode [ 307.583691][T12123] 8021q: adding VLAN 0 to HW filter on device bond0 [ 307.606680][T12131] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1664'. [ 307.625385][T12138] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1665'. [ 307.642479][T12128] 8021q: adding VLAN 0 to HW filter on device bond0 [ 307.650716][T12128] bond0: (slave vxcan3): The slave device specified does not support setting the MAC address [ 307.664276][T12128] bond0: (slave vxcan3): Error -95 calling set_mac_address [ 307.701543][T12129] gretap1: entered promiscuous mode [ 307.721999][T12129] bond0: (slave gretap1): making interface the new active one [ 307.730716][T12129] bond0: (slave gretap1): Enslaving as an active interface with an up link [ 307.747552][T12103] netdevsim netdevsim2 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 307.898416][T12131] 8021q: adding VLAN 0 to HW filter on device bond1 [ 307.948921][T12103] netdevsim netdevsim2 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 308.021071][T12137] lo speed is unknown, defaulting to 1000 [ 308.056456][T12103] netdevsim netdevsim2 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 308.315035][T12103] netdevsim netdevsim2 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 308.528169][T12141] lo speed is unknown, defaulting to 1000 [ 308.671794][T12171] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1671'. [ 308.758595][ T49] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 308.837365][ T6199] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 308.925865][ T6199] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 309.165687][ T49] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 309.515368][T12155] lo speed is unknown, defaulting to 1000 [ 310.130681][T12198] lo speed is unknown, defaulting to 1000 [ 310.696672][T12219] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1684'. [ 310.914269][T12216] lo speed is unknown, defaulting to 1000 [ 311.226560][T12227] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1687'. [ 311.547783][T12233] netlink: 'syz.0.1688': attribute type 13 has an invalid length. [ 311.571786][T12233] netlink: 'syz.0.1688': attribute type 17 has an invalid length. [ 311.692195][T12235] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1688'. [ 311.975662][T12233] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 312.248267][T12239] tipc: Enabled bearer , priority 0 [ 312.361478][T12240] syzkaller0: entered promiscuous mode [ 312.367236][T12240] syzkaller0: entered allmulticast mode [ 312.379827][T12239] tipc: Resetting bearer [ 312.404487][T12234] lo speed is unknown, defaulting to 1000 [ 312.459683][T12236] tipc: Resetting bearer [ 312.516008][T12236] tipc: Disabling bearer [ 313.144132][T12253] netlink: 'syz.2.1694': attribute type 1 has an invalid length. [ 313.228953][T12254] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1694'. [ 313.257861][T12254] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1694'. [ 313.326476][T12256] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1695'. [ 313.701210][T12269] netlink: 48 bytes leftover after parsing attributes in process `syz.4.1699'. [ 313.732221][T12269] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1699'. [ 313.751043][T12269] netlink: 16 bytes leftover after parsing attributes in process `syz.4.1699'. [ 313.760218][T12269] netlink: 40 bytes leftover after parsing attributes in process `syz.4.1699'. [ 314.023140][T12279] FAULT_INJECTION: forcing a failure. [ 314.023140][T12279] name failslab, interval 1, probability 0, space 0, times 0 [ 314.044159][T12282] netlink: 'syz.3.1703': attribute type 23 has an invalid length. [ 314.047055][T12279] CPU: 0 UID: 0 PID: 12279 Comm: syz.4.1702 Not tainted 6.16.0-rc6-syzkaller-01646-g56613001dfc9 #0 PREEMPT(full) [ 314.047082][T12279] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 314.047092][T12279] Call Trace: [ 314.047099][T12279] [ 314.047107][T12279] dump_stack_lvl+0x189/0x250 [ 314.047140][T12279] ? __pfx____ratelimit+0x10/0x10 [ 314.047160][T12279] ? __pfx_dump_stack_lvl+0x10/0x10 [ 314.047180][T12279] ? __pfx__printk+0x10/0x10 [ 314.047208][T12279] ? __pfx___might_resched+0x10/0x10 [ 314.047227][T12279] ? fs_reclaim_acquire+0x7d/0x100 [ 314.047250][T12279] should_fail_ex+0x414/0x560 [ 314.047274][T12279] should_failslab+0xa8/0x100 [ 314.047301][T12279] kmem_cache_alloc_node_noprof+0x76/0x3c0 [ 314.047323][T12279] ? __alloc_skb+0x112/0x2d0 [ 314.047346][T12279] __alloc_skb+0x112/0x2d0 [ 314.047369][T12279] netlink_ack+0x146/0xa50 [ 314.047383][T12279] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 314.047420][T12279] netlink_rcv_skb+0x28c/0x470 [ 314.047434][T12279] ? __lock_acquire+0xab9/0xd20 [ 314.047473][T12279] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 314.047492][T12279] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 314.047522][T12279] ? netlink_deliver_tap+0x2e/0x1b0 [ 314.047548][T12279] netlink_unicast+0x82c/0x9e0 [ 314.047582][T12279] ? __pfx_netlink_unicast+0x10/0x10 [ 314.047608][T12279] ? netlink_sendmsg+0x642/0xb30 [ 314.047623][T12279] ? skb_put+0x11b/0x210 [ 314.047646][T12279] netlink_sendmsg+0x805/0xb30 [ 314.047673][T12279] ? __pfx_netlink_sendmsg+0x10/0x10 [ 314.047694][T12279] ? aa_sock_msg_perm+0x94/0x160 [ 314.047714][T12279] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 314.047731][T12279] ? __pfx_netlink_sendmsg+0x10/0x10 [ 314.047756][T12279] __sock_sendmsg+0x21c/0x270 [ 314.047783][T12279] ____sys_sendmsg+0x505/0x830 [ 314.047810][T12279] ? __pfx_____sys_sendmsg+0x10/0x10 [ 314.047840][T12279] ? import_iovec+0x74/0xa0 [ 314.047867][T12279] ___sys_sendmsg+0x21f/0x2a0 [ 314.047890][T12279] ? __pfx____sys_sendmsg+0x10/0x10 [ 314.047949][T12279] ? __fget_files+0x2a/0x420 [ 314.047964][T12279] ? __fget_files+0x3a0/0x420 [ 314.047991][T12279] __x64_sys_sendmsg+0x19b/0x260 [ 314.048014][T12279] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 314.048045][T12279] ? __pfx_ksys_write+0x10/0x10 [ 314.048064][T12279] ? rcu_is_watching+0x15/0xb0 [ 314.048090][T12279] ? do_syscall_64+0xbe/0x3b0 [ 314.048112][T12279] do_syscall_64+0xfa/0x3b0 [ 314.048128][T12279] ? lockdep_hardirqs_on+0x9c/0x150 [ 314.048145][T12279] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 314.048162][T12279] ? clear_bhb_loop+0x60/0xb0 [ 314.048183][T12279] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 314.048199][T12279] RIP: 0033:0x7faac618e9a9 [ 314.048215][T12279] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 314.048229][T12279] RSP: 002b:00007faac6fe5038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 314.048249][T12279] RAX: ffffffffffffffda RBX: 00007faac63b5fa0 RCX: 00007faac618e9a9 [ 314.048261][T12279] RDX: 0000000020000000 RSI: 00002000000002c0 RDI: 000000000000000d [ 314.048272][T12279] RBP: 00007faac6fe5090 R08: 0000000000000000 R09: 0000000000000000 [ 314.048283][T12279] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 314.048293][T12279] R13: 0000000000000000 R14: 00007faac63b5fa0 R15: 00007fff2b1daf08 [ 314.048323][T12279] [ 314.440419][T12289] lo speed is unknown, defaulting to 1000 [ 315.283670][T12320] sit0: entered promiscuous mode [ 315.327731][T12320] netlink: 'syz.0.1713': attribute type 1 has an invalid length. [ 316.070338][T12348] __nla_validate_parse: 3 callbacks suppressed [ 316.070360][T12348] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1723'. [ 316.450703][T12345] lo speed is unknown, defaulting to 1000 [ 316.638136][T12362] mac80211_hwsim hwsim9 wlan1: entered allmulticast mode [ 316.751837][T12362] bond0: (slave ip6gretap1): Removing an active aggregator [ 316.800094][T12368] netlink: 'syz.3.1726': attribute type 10 has an invalid length. [ 316.835246][T12362] bond0: (slave ip6gretap1): Releasing backup interface [ 316.897220][T12362] ip6gretap1: left promiscuous mode [ 316.926794][T12362] ip6gretap1: left allmulticast mode [ 316.938212][T12372] workqueue: Failed to create a rescuer kthread for wq "nfc2_nci_tx_wq": -EINTR [ 316.985699][T12368] mac80211_hwsim hwsim9 wlan1: left allmulticast mode [ 317.336510][ T1301] ieee802154 phy1 wpan1: encryption failed: -22 [ 317.806707][T12406] netlink: 68 bytes leftover after parsing attributes in process `syz.1.1738'. [ 317.816350][T12406] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1738'. [ 317.828447][T12406] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1738'. [ 318.182854][T12424] syz.1.1742 uses old SIOCAX25GETINFO [ 318.384581][T12429] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1746'. [ 318.444939][T12431] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1747'. [ 319.348170][T12456] lo speed is unknown, defaulting to 1000 [ 319.946550][T12466] netlink: 28 bytes leftover after parsing attributes in process `syz.3.1757'. [ 320.879400][T12474] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 321.244307][ T12] netdevsim netdevsim2 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 321.308328][ T6199] netdevsim netdevsim2 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 321.318078][ T6199] netdevsim netdevsim2 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 321.376951][ T6199] netdevsim netdevsim2 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 321.450860][T12498] netlink: 'syz.2.1762': attribute type 23 has an invalid length. [ 322.163269][T12514] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1767'. [ 322.285546][T12513] xt_CT: No such helper "snmp_trap" [ 322.293780][T12516] netlink: 96 bytes leftover after parsing attributes in process `syz.4.1766'. [ 322.403758][T12518] netlink: 212376 bytes leftover after parsing attributes in process `syz.4.1768'. [ 322.652641][T12522] tipc: Enabled bearer , priority 0 [ 322.661433][T12522] syzkaller0: entered promiscuous mode [ 322.667120][T12522] syzkaller0: entered allmulticast mode [ 322.728737][T12522] tipc: Resetting bearer [ 322.761835][T12521] tipc: Resetting bearer [ 322.836427][T12521] tipc: Disabling bearer [ 322.876266][T12529] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1773'. [ 323.231783][T12538] netlink: 'syz.2.1776': attribute type 23 has an invalid length. [ 323.326596][T12541] lo speed is unknown, defaulting to 1000 [ 324.658097][T12570] macsec1: entered promiscuous mode [ 324.664045][T12570] mac80211_hwsim hwsim8 wlan0: entered promiscuous mode [ 324.671506][T12570] macsec1: entered allmulticast mode [ 324.677071][T12570] mac80211_hwsim hwsim8 wlan0: entered allmulticast mode [ 325.008590][T12579] lo speed is unknown, defaulting to 1000 [ 326.149130][T12592] lo speed is unknown, defaulting to 1000 [ 326.644666][T12607] netlink: 'syz.0.1798': attribute type 39 has an invalid length. [ 327.039746][T12417] Set syz1 is full, maxelem 65536 reached [ 327.232352][T12627] netlink: 'syz.1.1803': attribute type 1 has an invalid length. [ 327.400339][T12627] 8021q: adding VLAN 0 to HW filter on device bond7 [ 327.507489][T12633] 8021q: adding VLAN 0 to HW filter on device bond7 [ 327.515714][T12633] bond7: (slave vxcan3): The slave device specified does not support setting the MAC address [ 327.528270][T12633] bond7: (slave vxcan3): Error -95 calling set_mac_address [ 327.557030][ T1145] nci: nci_extract_activation_params_nfc_dep: unsupported activation_rf_tech_and_mode 0x6 [ 328.304610][T12666] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1813'. [ 328.590461][T12682] netlink: 'syz.2.1818': attribute type 10 has an invalid length. [ 328.648771][T12677] lo speed is unknown, defaulting to 1000 [ 329.501848][T12717] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1825'. [ 329.533540][T12717] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1825'. [ 329.774615][T12730] netlink: 'syz.2.1830': attribute type 23 has an invalid length. [ 329.875161][T12735] netlink: 'syz.0.1829': attribute type 1 has an invalid length. [ 329.990588][T12735] bond4: entered promiscuous mode [ 329.997381][T12735] 8021q: adding VLAN 0 to HW filter on device bond4 [ 330.249150][T12681] netlink: 16 bytes leftover after parsing attributes in process `syz.3.1816'. [ 330.312547][T12746] macsec1: entered promiscuous mode [ 330.328808][T12746] mac80211_hwsim hwsim5 wlan0: entered promiscuous mode [ 330.344226][T12746] macsec1: entered allmulticast mode [ 330.349596][T12746] mac80211_hwsim hwsim5 wlan0: entered allmulticast mode [ 330.572983][T12759] geneve0: mtu less than device minimum [ 330.619067][T12760] geneve0: mtu less than device minimum [ 330.890145][T12769] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1836'. [ 330.915097][T12769] 8021q: adding VLAN 0 to HW filter on device ipvlan2 [ 331.061841][T12784] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1841'. [ 331.335788][T12792] netlink: 'syz.1.1845': attribute type 1 has an invalid length. [ 331.608832][T12802] x_tables: duplicate underflow at hook 1 [ 331.670195][T12805] netlink: 'syz.0.1849': attribute type 16 has an invalid length. [ 331.901444][T12809] netlink: 40 bytes leftover after parsing attributes in process `syz.2.1850'. [ 331.948991][T12808] netlink: 48 bytes leftover after parsing attributes in process `syz.3.1851'. [ 332.299298][T12815] lo speed is unknown, defaulting to 1000 [ 332.317478][T12824] netlink: 92 bytes leftover after parsing attributes in process `syz.2.1855'. [ 332.577498][T12829] netlink: 'syz.1.1856': attribute type 13 has an invalid length. [ 332.598161][T12828] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1857'. [ 332.610420][T12829] netlink: 'syz.1.1856': attribute type 17 has an invalid length. [ 332.946366][T12829] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 333.364149][T12830] lo speed is unknown, defaulting to 1000 [ 333.460205][T12856] tipc: New replicast peer: 255.255.255.255 [ 333.472166][T12856] tipc: Enabled bearer , priority 10 [ 333.900526][T12872] IPVS: set_ctl: invalid protocol: 29 127.0.0.1:20004 [ 333.904226][T12873] netlink: 'syz.2.1870': attribute type 1 has an invalid length. [ 334.015090][T12876] veth0_to_bridge: entered promiscuous mode [ 334.148249][T12873] bond4: entered promiscuous mode [ 334.167296][T12873] bond4: entered allmulticast mode [ 334.229746][T12875] veth0_to_bridge: left promiscuous mode [ 334.268066][T12890] __nla_validate_parse: 1 callbacks suppressed [ 334.268087][T12890] netlink: 132 bytes leftover after parsing attributes in process `syz.4.1876'. [ 334.325081][T12892] netlink: 132 bytes leftover after parsing attributes in process `syz.4.1876'. [ 334.414575][T12898] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1879'. [ 334.447098][T12889] lo speed is unknown, defaulting to 1000 [ 335.040248][T12885] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 335.139519][T12928] ipt_REJECT: TCP_RESET invalid for non-tcp [ 335.356075][T12934] netlink: 'syz.4.1888': attribute type 12 has an invalid length. [ 335.404529][T12934] IPVS: set_ctl: invalid protocol: 60 172.30.1.5:19999 [ 335.431505][T12934] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1888'. [ 336.602563][T12966] netlink: 'syz.0.1895': attribute type 17 has an invalid length. [ 336.643501][T12967] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1896'. [ 336.754670][T12971] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1897'. [ 336.782919][T12972] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1895'. [ 336.868872][T12967] 8021q: adding VLAN 0 to HW filter on device bond8 [ 336.912266][T12969] macvlan4: entered promiscuous mode [ 336.918595][T12969] macvlan4: entered allmulticast mode [ 336.926312][T12969] bond8: entered promiscuous mode [ 336.932640][T12969] 8021q: adding VLAN 0 to HW filter on device macvlan4 [ 336.959067][T12969] bond8: left promiscuous mode [ 337.126760][T12968] lo speed is unknown, defaulting to 1000 [ 337.668656][T13001] xt_hashlimit: size too large, truncated to 1048576 [ 337.676428][T13001] xt_hashlimit: max too large, truncated to 1048576 [ 338.190083][T13016] netlink: 60 bytes leftover after parsing attributes in process `syz.2.1909'. [ 338.844090][T13027] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 339.179669][T13033] syzkaller1: entered promiscuous mode [ 339.199040][T13033] syzkaller1: entered allmulticast mode [ 339.403947][T13041] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1914'. [ 339.436937][T13043] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1915'. [ 339.480895][T13043] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1915'. [ 339.790695][T13062] lo speed is unknown, defaulting to 1000 [ 339.822010][T13068] netlink: 48 bytes leftover after parsing attributes in process `syz.4.1921'. [ 339.993403][T13077] bpq0: left promiscuous mode [ 340.011200][T13077] bpq0: left allmulticast mode [ 340.336667][T13086] netlink: 40 bytes leftover after parsing attributes in process `syz.3.1927'. [ 340.786139][T13118] netlink: 176 bytes leftover after parsing attributes in process `syz.4.1932'. [ 340.882694][T13118] netlink: 24 bytes leftover after parsing attributes in process `syz.4.1932'. [ 340.945834][T13132] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1933'. [ 340.961573][T13132] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1933'. [ 341.506075][T13141] lo speed is unknown, defaulting to 1000 [ 341.987524][T13176] netdevsim netdevsim1 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 342.175540][T13176] netdevsim netdevsim1 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 342.298104][T13176] netdevsim netdevsim1 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 342.335439][T13190] netlink: 'syz.4.1949': attribute type 1 has an invalid length. [ 342.345972][T13190] netlink: 'syz.4.1949': attribute type 2 has an invalid length. [ 342.480458][T13176] netdevsim netdevsim1 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 342.500699][T13192] RDS: rds_bind could not find a transport for 100:806:aaaa:aaaa:aaaa:0:e000:2, load rds_tcp or rds_rdma? [ 342.661891][ T13] netdevsim netdevsim1 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 342.770426][ T13] netdevsim netdevsim1 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 342.834288][ T13] netdevsim netdevsim1 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 342.845896][ T13] netdevsim netdevsim1 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 342.956813][T13203] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1952'. [ 343.039657][T13165] lo speed is unknown, defaulting to 1000 [ 343.170643][T13211] Cannot find add_set index 2 as target [ 343.661452][T13228] netlink: 'syz.4.1960': attribute type 30 has an invalid length. [ 343.666396][T13231] workqueue: name exceeds WQ_NAME_LEN. Truncating to: žÀ^–>º>ùMv^µâ侦¸ÑKc'A¥»– [ 343.696353][T13110] netdevsim netdevsim4 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 343.700368][T13228] netlink: 'syz.4.1960': attribute type 30 has an invalid length. [ 343.710683][T13110] netdevsim netdevsim4 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 343.767218][T13110] netdevsim netdevsim4 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 343.784369][T13110] netdevsim netdevsim4 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 344.410744][T13266] FAULT_INJECTION: forcing a failure. [ 344.410744][T13266] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 344.425404][T13266] CPU: 0 UID: 0 PID: 13266 Comm: syz.0.1969 Not tainted 6.16.0-rc6-syzkaller-01646-g56613001dfc9 #0 PREEMPT(full) [ 344.425434][T13266] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 344.425446][T13266] Call Trace: [ 344.425453][T13266] [ 344.425461][T13266] dump_stack_lvl+0x189/0x250 [ 344.425489][T13266] ? __pfx____ratelimit+0x10/0x10 [ 344.425510][T13266] ? __pfx_dump_stack_lvl+0x10/0x10 [ 344.425531][T13266] ? __pfx__printk+0x10/0x10 [ 344.425572][T13266] should_fail_ex+0x414/0x560 [ 344.425597][T13266] _copy_to_user+0x31/0xb0 [ 344.425626][T13266] simple_read_from_buffer+0xe1/0x170 [ 344.425660][T13266] proc_fail_nth_read+0x1df/0x250 [ 344.425684][T13266] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 344.425706][T13266] ? rw_verify_area+0x258/0x650 [ 344.425727][T13266] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 344.425746][T13266] vfs_read+0x200/0x980 [ 344.425777][T13266] ? __pfx___mutex_lock+0x10/0x10 [ 344.425798][T13266] ? __pfx_vfs_read+0x10/0x10 [ 344.425823][T13266] ? __fget_files+0x2a/0x420 [ 344.425847][T13266] ? __fget_files+0x3a0/0x420 [ 344.425861][T13266] ? __fget_files+0x2a/0x420 [ 344.425890][T13266] ksys_read+0x145/0x250 [ 344.425917][T13266] ? __pfx_ksys_read+0x10/0x10 [ 344.425947][T13266] ? do_syscall_64+0xbe/0x3b0 [ 344.425971][T13266] do_syscall_64+0xfa/0x3b0 [ 344.425989][T13266] ? lockdep_hardirqs_on+0x9c/0x150 [ 344.426006][T13266] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 344.426025][T13266] ? clear_bhb_loop+0x60/0xb0 [ 344.426049][T13266] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 344.426067][T13266] RIP: 0033:0x7f933bd8d3bc [ 344.426085][T13266] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 344.426101][T13266] RSP: 002b:00007f933cbfa030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 344.426122][T13266] RAX: ffffffffffffffda RBX: 00007f933bfb5fa0 RCX: 00007f933bd8d3bc [ 344.426136][T13266] RDX: 000000000000000f RSI: 00007f933cbfa0a0 RDI: 000000000000000a [ 344.426148][T13266] RBP: 00007f933cbfa090 R08: 0000000000000000 R09: 0000000000000000 [ 344.426158][T13266] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 344.426169][T13266] R13: 0000000000000000 R14: 00007f933bfb5fa0 R15: 00007ffc52a99968 [ 344.426201][T13266] [ 344.857338][T13271] lo speed is unknown, defaulting to 1000 [ 345.048782][T13277] __nla_validate_parse: 10 callbacks suppressed [ 345.048807][T13277] netlink: 24 bytes leftover after parsing attributes in process `syz.4.1973'. [ 345.102762][T13278] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1973'. [ 345.160346][T13278] netlink: 20 bytes leftover after parsing attributes in process `syz.4.1973'. [ 345.508105][T13283] netlink: 20 bytes leftover after parsing attributes in process `syz.4.1974'. [ 345.727193][T13287] vti0: entered promiscuous mode [ 345.732750][T13287] vti0: entered allmulticast mode [ 346.020138][T13293] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1978'. [ 346.426642][T13309] tipc: New replicast peer: 255.255.255.83 [ 346.440009][T13309] tipc: Enabled bearer , priority 10 [ 346.510660][T13314] netlink: 56 bytes leftover after parsing attributes in process `syz.4.1985'. [ 346.848840][T13334] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1991'. [ 346.869061][T13338] netlink: 20 bytes leftover after parsing attributes in process `syz.3.1993'. [ 346.934344][T13343] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1991'. [ 346.966943][T13343] bond0: Device is already in use. [ 347.329441][T13360] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1997'. [ 347.551867][ T5956] tipc: Node number set to 3138145256 [ 347.766960][T13382] tipc: Enabling of bearer rejected, failed to enable media [ 347.818092][T13381] lo speed is unknown, defaulting to 1000 [ 348.162671][T13392] syzkaller1: entered promiscuous mode [ 348.166707][T13394] x_tables: duplicate underflow at hook 1 [ 348.168649][T13392] syzkaller1: entered allmulticast mode [ 348.175960][T13394] IPVS: set_ctl: invalid protocol: 2 172.20.20.187:20002 [ 348.438955][T13398] tipc: Enabling of bearer rejected, failed to enable media [ 348.558034][T13400] A link change request failed with some changes committed already. Interface wlan0 may have been left with an inconsistent configuration, please check. [ 348.588859][T13401] A link change request failed with some changes committed already. Interface wlan0 may have been left with an inconsistent configuration, please check. [ 348.696263][T13407] netlink: 'syz.3.2011': attribute type 21 has an invalid length. [ 348.736367][T13407] IPv6: Can't replace route, no match found [ 348.959945][T13420] SET target dimension over the limit! [ 378.776410][ T1301] ieee802154 phy1 wpan1: encryption failed: -22 [ 406.130558][T13425] __nla_validate_parse: 4 callbacks suppressed [ 406.130578][T13425] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2016'. [ 406.351669][T13432] geneve3: entered promiscuous mode [ 406.366764][T13106] netdevsim netdevsim3 eth0: set [1, 2] type 2 family 0 port 6081 - 0 [ 406.450583][T13453] netlink: 596 bytes leftover after parsing attributes in process `syz.2.2023'. [ 406.484535][T13436] syzkaller0: entered promiscuous mode [ 406.490655][T13436] syzkaller0: entered allmulticast mode [ 406.497917][T13448] netlink: 20 bytes leftover after parsing attributes in process `syz.1.2021'. [ 406.507428][T13106] netdevsim netdevsim3 eth1: set [1, 2] type 2 family 0 port 6081 - 0 [ 406.518881][T13106] netdevsim netdevsim3 eth2: set [1, 2] type 2 family 0 port 6081 - 0 [ 406.527673][T13454] macvtap0: entered allmulticast mode [ 406.534529][T13453] tipc: Enabling of bearer rejected, failed to enable media [ 406.549359][T13459] netlink: 9 bytes leftover after parsing attributes in process `syz.0.2024'. [ 406.559021][T13106] netdevsim netdevsim3 eth3: set [1, 2] type 2 family 0 port 6081 - 0 [ 406.568984][T13460] netlink: 14212 bytes leftover after parsing attributes in process `syz.2.2023'. [ 406.611846][T13462] unsupported nlmsg_type 40 [ 406.617661][T13462] netlink: 'syz.0.2024': attribute type 1 has an invalid length. [ 406.635143][T13462] netlink: 5 bytes leftover after parsing attributes in process `syz.0.2024'. [ 406.803515][T13470] SET target dimension over the limit! [ 408.376135][T13459] gretap0: entered promiscuous mode [ 408.395168][T13462] 0ªî{X¹¦: renamed from gretap0 [ 408.404208][T13462] 0ªî{X¹¦: left promiscuous mode [ 408.409308][T13462] 0ªî{X¹¦: entered allmulticast mode [ 408.418033][T13462] A link change request failed with some changes committed already. Interface 30ªî{X¹¦ may have been left with an inconsistent configuration, please check. [ 408.649879][T13487] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2029'. [ 409.032615][T13513] netlink: 'syz.4.2038': attribute type 1 has an invalid length. [ 409.093833][T13508] netlink: 37 bytes leftover after parsing attributes in process `syz.4.2038'. [ 409.800734][T13521] netlink: 'syz.0.2040': attribute type 1 has an invalid length. [ 409.821956][T13518] netlink: 48 bytes leftover after parsing attributes in process `syz.3.2037'. [ 409.857534][T13527] IPv6: NLM_F_CREATE should be specified when creating new route [ 409.868272][T13527] x_tables: unsorted underflow at hook 4 [ 409.898395][T13523] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2041'. [ 409.952653][T13523] gretap2: entered promiscuous mode [ 410.735697][T13564] SET target dimension over the limit! [ 411.210856][T13583] syzkaller0: entered allmulticast mode [ 411.249940][T13583] netlink: 'syz.3.2059': attribute type 6 has an invalid length. [ 411.298949][T13590] netlink: 'syz.2.2061': attribute type 1 has an invalid length. [ 411.322885][T13590] __nla_validate_parse: 3 callbacks suppressed [ 411.322904][T13590] netlink: 168864 bytes leftover after parsing attributes in process `syz.2.2061'. [ 411.678189][T13604] netlink: 'syz.4.2067': attribute type 3 has an invalid length. [ 411.691251][T13604] netlink: 24 bytes leftover after parsing attributes in process `syz.4.2067'. [ 411.700516][T13604] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2067'. [ 411.714560][T13604] netlink: 'syz.4.2067': attribute type 5 has an invalid length. [ 412.373653][T13622] netlink: 32 bytes leftover after parsing attributes in process `syz.4.2070'. [ 413.919911][T13640] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2076'. [ 414.420317][T13670] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2084'. [ 414.443678][T13670] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2084'. [ 414.473053][T13671] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2083'. [ 414.509589][T13673] netlink: 'syz.1.2085': attribute type 10 has an invalid length. [ 414.527829][T13671] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2083'. [ 414.716018][T13680] lo speed is unknown, defaulting to 1000 [ 415.325124][T13693] bridge0: entered promiscuous mode [ 415.344860][T13693] batadv0: entered promiscuous mode [ 415.366113][T13693] batadv0: left promiscuous mode [ 415.404289][T13693] bridge0: left promiscuous mode [ 415.500613][T13694] bridge0: entered promiscuous mode [ 415.522027][T13694] batadv0: entered promiscuous mode [ 415.528842][T13694] batadv0: left promiscuous mode [ 415.542220][T13694] bridge0: left promiscuous mode [ 415.658808][T13704] tipc: Enabled bearer , priority 0 [ 415.675116][T13703] tipc: Enabling of bearer rejected, already enabled [ 415.703907][T13704] syzkaller0: entered promiscuous mode [ 415.734244][T13704] syzkaller0: entered allmulticast mode [ 415.795764][T13703] syzkaller0: mtu less than device minimum [ 415.825523][T13707] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2093'. [ 415.835273][T13707] netlink: 'syz.1.2093': attribute type 13 has an invalid length. [ 415.835432][T13702] tipc: Resetting bearer [ 415.844012][T13707] netlink: 'syz.1.2093': attribute type 12 has an invalid length. [ 415.912898][T13702] tipc: Disabling bearer [ 415.941586][T13714] netlink: 'syz.1.2093': attribute type 1 has an invalid length. [ 415.965018][T13700] lo speed is unknown, defaulting to 1000 [ 416.174422][T13714] 8021q: adding VLAN 0 to HW filter on device bond9 [ 416.344524][T13712] __nla_validate_parse: 1 callbacks suppressed [ 416.344545][T13712] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2094'. [ 416.431614][T13712] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2094'. [ 416.460607][T13712] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2094'. [ 416.588423][T13724] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2096'. [ 416.611768][T13724] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2096'. [ 416.661808][T13724] netlink: 'syz.4.2096': attribute type 15 has an invalid length. [ 416.669720][T13724] netlink: 'syz.4.2096': attribute type 18 has an invalid length. [ 417.005300][T13734] netlink: 20 bytes leftover after parsing attributes in process `syz.1.2099'. [ 417.277927][T13736] 8021q: adding VLAN 0 to HW filter on device bond0 [ 417.324974][T13736] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 417.373597][T12004] lo speed is unknown, defaulting to 1000 [ 417.379461][T12004] syz0: Port: 1 Link ACTIVE [ 417.441658][ T5916] lo speed is unknown, defaulting to 1000 [ 417.563012][T13743] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2104'. [ 417.576823][T13743] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2104'. [ 417.646188][T13745] Cannot find add_set index 2 as target [ 417.785280][T13751] RDS: rds_bind could not find a transport for ::ffff:100.1.1.2, load rds_tcp or rds_rdma? [ 417.862163][T13743] lo speed is unknown, defaulting to 1000 [ 418.044785][T13756] netlink: 'syz.1.2106': attribute type 21 has an invalid length. [ 418.063568][T13756] netlink: 36 bytes leftover after parsing attributes in process `syz.1.2106'. [ 418.081750][T13758] netlink: 'syz.0.2107': attribute type 1 has an invalid length. [ 418.201966][T13760] netlink: 32 bytes leftover after parsing attributes in process `syz.1.2108'. [ 419.126937][T13781] lo speed is unknown, defaulting to 1000 [ 419.203977][T13800] netlink: 'syz.0.2118': attribute type 10 has an invalid length. [ 419.258651][T13774] netlink: 'syz.3.2111': attribute type 6 has an invalid length. [ 419.303507][T13800] A link change request failed with some changes committed already. Interface geneve0 may have been left with an inconsistent configuration, please check. [ 420.043613][T13811] lo speed is unknown, defaulting to 1000 [ 420.330270][T13825] netlink: 'syz.1.2123': attribute type 5 has an invalid length. [ 420.664386][T13834] FAULT_INJECTION: forcing a failure. [ 420.664386][T13834] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 420.716137][T13834] CPU: 0 UID: 0 PID: 13834 Comm: syz.2.2125 Not tainted 6.16.0-rc6-syzkaller-01646-g56613001dfc9 #0 PREEMPT(full) [ 420.716167][T13834] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 420.716179][T13834] Call Trace: [ 420.716187][T13834] [ 420.716195][T13834] dump_stack_lvl+0x189/0x250 [ 420.716224][T13834] ? __pfx____ratelimit+0x10/0x10 [ 420.716245][T13834] ? __pfx_dump_stack_lvl+0x10/0x10 [ 420.716268][T13834] ? __pfx__printk+0x10/0x10 [ 420.716294][T13834] ? __might_fault+0xb0/0x130 [ 420.716331][T13834] should_fail_ex+0x414/0x560 [ 420.716357][T13834] _copy_from_user+0x2d/0xb0 [ 420.716382][T13834] ___sys_sendmsg+0x158/0x2a0 [ 420.716409][T13834] ? __pfx____sys_sendmsg+0x10/0x10 [ 420.716474][T13834] ? __fget_files+0x2a/0x420 [ 420.716491][T13834] ? __fget_files+0x3a0/0x420 [ 420.716520][T13834] __sys_sendmmsg+0x227/0x430 [ 420.716550][T13834] ? __pfx___sys_sendmmsg+0x10/0x10 [ 420.716569][T13834] ? __mutex_unlock_slowpath+0x1cd/0x700 [ 420.716621][T13834] ? ksys_write+0x22a/0x250 [ 420.716648][T13834] ? __pfx_ksys_write+0x10/0x10 [ 420.716670][T13834] ? rcu_is_watching+0x15/0xb0 [ 420.716698][T13834] __x64_sys_sendmmsg+0xa0/0xc0 [ 420.716724][T13834] do_syscall_64+0xfa/0x3b0 [ 420.716743][T13834] ? lockdep_hardirqs_on+0x9c/0x150 [ 420.716762][T13834] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 420.716780][T13834] ? clear_bhb_loop+0x60/0xb0 [ 420.716803][T13834] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 420.716820][T13834] RIP: 0033:0x7f230458e9a9 [ 420.716837][T13834] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 420.716851][T13834] RSP: 002b:00007f230534a038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 420.716873][T13834] RAX: ffffffffffffffda RBX: 00007f23047b5fa0 RCX: 00007f230458e9a9 [ 420.716886][T13834] RDX: 0000000000000002 RSI: 00002000000011c0 RDI: 0000000000000003 [ 420.716899][T13834] RBP: 00007f230534a090 R08: 0000000000000000 R09: 0000000000000000 [ 420.716910][T13834] R10: 0000000004004000 R11: 0000000000000246 R12: 0000000000000001 [ 420.716923][T13834] R13: 0000000000000000 R14: 00007f23047b5fa0 R15: 00007ffcbc4d6138 [ 420.716956][T13834] [ 420.719984][T13836] netlink: 'syz.1.2126': attribute type 10 has an invalid length. [ 420.863014][T13839] netlink: 'syz.1.2126': attribute type 10 has an invalid length. [ 421.062374][T13839] !: entered promiscuous mode [ 421.094982][T13839] bond0: (slave 0!): Enslaving as an active interface with an up link [ 421.362281][T13849] xt_AUDIT: Audit type out of range (valid range: 0..2) [ 421.756199][T13863] netlink: 'syz.4.2135': attribute type 1 has an invalid length. [ 421.787802][T13860] __nla_validate_parse: 4 callbacks suppressed [ 421.787823][T13860] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2136'. [ 421.864416][T13867] IPVS: lblc: UDP 224.0.0.2:0 - no destination available [ 421.865916][T13871] FAULT_INJECTION: forcing a failure. [ 421.865916][T13871] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 421.897402][T13871] CPU: 1 UID: 0 PID: 13871 Comm: syz.3.2137 Not tainted 6.16.0-rc6-syzkaller-01646-g56613001dfc9 #0 PREEMPT(full) [ 421.897433][T13871] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 421.897444][T13871] Call Trace: [ 421.897452][T13871] [ 421.897461][T13871] dump_stack_lvl+0x189/0x250 [ 421.897490][T13871] ? __pfx____ratelimit+0x10/0x10 [ 421.897511][T13871] ? __pfx_dump_stack_lvl+0x10/0x10 [ 421.897533][T13871] ? __pfx__printk+0x10/0x10 [ 421.897576][T13871] should_fail_ex+0x414/0x560 [ 421.897603][T13871] _copy_from_user+0x2d/0xb0 [ 421.897630][T13871] __copy_msghdr+0x3c5/0x5b0 [ 421.897658][T13871] ___sys_sendmsg+0x1a5/0x2a0 [ 421.897684][T13871] ? __pfx____sys_sendmsg+0x10/0x10 [ 421.897750][T13871] ? __fget_files+0x2a/0x420 [ 421.897766][T13871] ? __fget_files+0x3a0/0x420 [ 421.897797][T13871] __sys_sendmmsg+0x227/0x430 [ 421.897839][T13871] ? __pfx___sys_sendmmsg+0x10/0x10 [ 421.897858][T13871] ? __mutex_unlock_slowpath+0x1cd/0x700 [ 421.897911][T13871] ? ksys_write+0x22a/0x250 [ 421.897940][T13871] ? __pfx_ksys_write+0x10/0x10 [ 421.897962][T13871] ? rcu_is_watching+0x15/0xb0 [ 421.897993][T13871] __x64_sys_sendmmsg+0xa0/0xc0 [ 421.898018][T13871] do_syscall_64+0xfa/0x3b0 [ 421.898037][T13871] ? lockdep_hardirqs_on+0x9c/0x150 [ 421.898056][T13871] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 421.898074][T13871] ? clear_bhb_loop+0x60/0xb0 [ 421.898098][T13871] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 421.898117][T13871] RIP: 0033:0x7f146298e9a9 [ 421.898135][T13871] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 421.898151][T13871] RSP: 002b:00007f146383d038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 421.898174][T13871] RAX: ffffffffffffffda RBX: 00007f1462bb5fa0 RCX: 00007f146298e9a9 [ 421.898189][T13871] RDX: 0000000000000002 RSI: 00002000000011c0 RDI: 0000000000000003 [ 421.898201][T13871] RBP: 00007f146383d090 R08: 0000000000000000 R09: 0000000000000000 [ 421.898213][T13871] R10: 0000000004004000 R11: 0000000000000246 R12: 0000000000000001 [ 421.898225][T13871] R13: 0000000000000000 R14: 00007f1462bb5fa0 R15: 00007ffe5e232088 [ 421.898258][T13871] [ 421.936937][T13863] 8021q: adding VLAN 0 to HW filter on device bond6 [ 422.206106][T13868] 8021q: adding VLAN 0 to HW filter on device batadv1 [ 422.218669][T13868] bond6: (slave batadv1): making interface the new active one [ 422.240561][T13880] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2138'. [ 422.254871][T13868] bond6: (slave batadv1): Enslaving as an active interface with an up link [ 422.265373][T13880] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2138'. [ 422.285652][T13880] netlink: 'syz.2.2138': attribute type 18 has an invalid length. [ 422.602870][T13896] netlink: 40 bytes leftover after parsing attributes in process `syz.4.2140'. [ 423.348393][T13917] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2146'. [ 423.450218][T13919] netlink: 24 bytes leftover after parsing attributes in process `syz.4.2146'. [ 423.617640][T13927] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2151'. [ 423.701257][T13934] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2154'. [ 423.883712][T13937] lo speed is unknown, defaulting to 1000 [ 424.266538][T13957] nbd: must specify at least one socket [ 424.548476][T13967] netlink: 'syz.2.2164': attribute type 1 has an invalid length. [ 424.593760][T13967] netlink: 36 bytes leftover after parsing attributes in process `syz.2.2164'. [ 425.202154][T13994] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2170'. [ 425.245131][T13960] lo speed is unknown, defaulting to 1000 [ 425.499441][T14004] mac80211_hwsim hwsim3 wlan1: entered allmulticast mode [ 425.589670][T14004] IPVS: ip_vs_add_dest(): lower threshold is higher than upper threshold [ 425.718452][T14008] openvswitch: netlink: Flow key attr not present in new flow. [ 425.723284][T14004] bond0: (slave 0!): Releasing backup interface [ 425.740704][T14004] !: left promiscuous mode [ 425.916695][T14011] netlink: 'syz.1.2172': attribute type 10 has an invalid length. [ 426.070110][T14011] mac80211_hwsim hwsim3 wlan1: left allmulticast mode [ 426.086080][T14011] bond0: (slave wlan1): refused to change device type [ 426.170697][T13992] lo speed is unknown, defaulting to 1000 [ 426.955229][T14043] lo speed is unknown, defaulting to 1000 [ 428.647620][T14068] __nla_validate_parse: 2 callbacks suppressed [ 428.647640][T14068] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2187'. [ 428.913371][T14083] netlink: 156 bytes leftover after parsing attributes in process `syz.0.2191'. [ 428.979478][T14083] netlink: 'syz.0.2191': attribute type 2 has an invalid length. [ 428.987585][T14087] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 429.015267][T14083] netlink: 51 bytes leftover after parsing attributes in process `syz.0.2191'. [ 429.127146][T14090] vlan2: entered promiscuous mode [ 429.137502][T14090] !: entered promiscuous mode [ 429.359514][T14099] lo speed is unknown, defaulting to 1000 [ 429.720819][T14112] openvswitch: netlink: VXLAN extension message has 4 unknown bytes. [ 429.948008][T14121] netlink: 56 bytes leftover after parsing attributes in process `syz.3.2204'. [ 430.096870][T14104] lo speed is unknown, defaulting to 1000 [ 430.578087][T14139] netlink: 'syz.3.2210': attribute type 6 has an invalid length. [ 430.592271][T14139] netlink: 199836 bytes leftover after parsing attributes in process `syz.3.2210'. [ 430.690524][T14148] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2213'. [ 430.994673][T14157] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2215'. [ 431.075823][T14157] tipc: New replicast peer: fe80:0000:0000:0000:0000:0000:0000:0000 [ 431.158718][T14157] tipc: Enabled bearer , priority 10 [ 431.469177][T14163] lo speed is unknown, defaulting to 1000 [ 432.340196][T14182] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2223'. [ 432.498022][T14186] netlink: 'syz.2.2224': attribute type 13 has an invalid length. [ 432.512602][T14186] netlink: 'syz.2.2224': attribute type 17 has an invalid length. [ 432.610480][T14186] erspan0: left allmulticast mode [ 432.652207][T14191] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2224'. [ 432.698689][T14186] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 432.834417][T14188] lo speed is unknown, defaulting to 1000 [ 433.068633][T14202] Cannot find add_set index 2 as target [ 434.203286][T14230] wireguard0: entered promiscuous mode [ 434.208838][T14230] wireguard0: entered allmulticast mode [ 434.237789][T14237] openvswitch: netlink: IP tunnel attribute has 20 unknown bytes. [ 434.468420][T14245] netlink: 60 bytes leftover after parsing attributes in process `syz.0.2241'. [ 434.517888][T14245] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2241'. [ 434.769827][T14255] netlink: 28 bytes leftover after parsing attributes in process `syz.3.2244'. [ 434.924852][T14253] veth5: entered promiscuous mode [ 435.069180][T14263] IPVS: lblc: UDP 224.0.0.2:0 - no destination available [ 435.292311][T14258] lo speed is unknown, defaulting to 1000 [ 435.304426][T14279] netlink: 'syz.4.2251': attribute type 4 has an invalid length. [ 435.361342][ T5956] lo speed is unknown, defaulting to 1000 [ 435.381186][ T5956] syz0: Port: 1 Link DOWN [ 435.401899][T14279] netlink: 'syz.4.2251': attribute type 4 has an invalid length. [ 435.443823][ T5956] lo speed is unknown, defaulting to 1000 [ 435.449688][ T5956] lo speed is unknown, defaulting to 1000 [ 435.481019][ T5956] syz0: Port: 1 Link ACTIVE [ 435.514616][T14279] bond6: (slave batadv1): Releasing active interface [ 435.899544][T14304] bridge0: entered allmulticast mode [ 435.935998][T14304] pim6reg: entered allmulticast mode [ 436.271355][T14315] netlink: 32 bytes leftover after parsing attributes in process `syz.2.2260'. [ 436.506098][T14320] netlink: 24 bytes leftover after parsing attributes in process `syz.4.2261'. [ 436.543285][T14320] ipt_ECN: cannot use operation on non-tcp rule [ 437.509257][T14362] No such timeout policy "syz1" [ 437.699057][T14378] netlink: 40 bytes leftover after parsing attributes in process `syz.4.2278'. [ 437.984440][T14386] netlink: 'syz.2.2281': attribute type 1 has an invalid length. [ 438.263907][T14401] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2286'. [ 438.280626][T14391] bond5: (slave ip6gretap1): Enslaving as a backup interface with an up link [ 438.306135][T13106] bond5: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 438.307416][T14393] 8021q: adding VLAN 0 to HW filter on device bond5 [ 438.431859][T13106] bond5: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 438.511932][T14413] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2290'. [ 438.587451][T14420] bpq0: entered promiscuous mode [ 438.595872][T14420] bpq0: entered allmulticast mode [ 438.631862][T14420] netlink: 'syz.0.2290': attribute type 1 has an invalid length. [ 438.906142][T14420] bond7: entered promiscuous mode [ 438.929730][T14420] 8021q: adding VLAN 0 to HW filter on device bond7 [ 439.067455][T14422] bond7: (slave bridge2): making interface the new active one [ 439.130815][T14422] bridge2: entered promiscuous mode [ 439.248128][T14422] bond7: (slave bridge2): Enslaving as an active interface with an up link [ 439.369859][T14431] lo speed is unknown, defaulting to 1000 [ 439.383131][T14449] netlink: 132 bytes leftover after parsing attributes in process `syz.3.2298'. [ 439.546417][T14453] netlink: 248 bytes leftover after parsing attributes in process `syz.0.2300'. [ 439.767802][T14457] netlink: 76 bytes leftover after parsing attributes in process `syz.0.2300'. [ 439.769339][T14430] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 439.867668][T14465] netlink: 'syz.4.2306': attribute type 1 has an invalid length. [ 439.982744][T14465] bond7: entered promiscuous mode [ 439.997150][T14465] 8021q: adding VLAN 0 to HW filter on device bond7 [ 440.080024][T14469] bond7: (slave bridge5): making interface the new active one [ 440.197574][T14469] bridge5: entered promiscuous mode [ 440.214526][T14469] bond7: (slave bridge5): Enslaving as an active interface with an up link [ 440.694954][T14499] netlink: 36 bytes leftover after parsing attributes in process `syz.0.2317'. [ 440.876151][T14492] netdevsim netdevsim4 netdevsim0: left allmulticast mode [ 440.907740][T14492] bridge1: left allmulticast mode [ 440.934831][T14492] macsec1: left allmulticast mode [ 440.948263][T14509] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2316'. [ 440.961892][T14492] bridge2: left promiscuous mode [ 440.967671][T14492] macvlan0: left promiscuous mode [ 440.977020][T14492] macvlan0: left allmulticast mode [ 440.983053][T14492] veth3: left promiscuous mode [ 440.988277][T14492] vlan0: left promiscuous mode [ 441.018938][T14510] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2316'. [ 441.040077][T14492] gretap2: left promiscuous mode [ 441.077949][T14492] bond7: left promiscuous mode [ 441.089061][T14492] bridge5: left promiscuous mode [ 441.108885][T12004] lo speed is unknown, defaulting to 1000 [ 441.118316][T12004] syz0: Port: 1 Link DOWN [ 441.351841][T14509] bridge0 (unregistering): left allmulticast mode [ 441.463284][T13109] netdevsim netdevsim4 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 441.492476][T13109] netdevsim netdevsim4 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 441.520075][ T5851] lo speed is unknown, defaulting to 1000 [ 441.568656][T13109] netdevsim netdevsim4 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 441.598499][T13109] netdevsim netdevsim4 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 441.795673][T14525] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2324'. [ 441.894548][T14529] netlink: 28 bytes leftover after parsing attributes in process `syz.0.2324'. [ 441.944533][T14524] veth9: entered promiscuous mode [ 442.001450][T14533] bridge3: port 1(veth0_to_bond) entered blocking state [ 442.008823][T14533] bridge3: port 1(veth0_to_bond) entered disabled state [ 442.019874][T14533] veth0_to_bond: entered allmulticast mode [ 442.028418][T14533] veth0_to_bond: entered promiscuous mode [ 442.069148][T14525] vlan2: entered allmulticast mode [ 442.075875][T14525] veth1: entered allmulticast mode [ 442.322660][T14539] netlink: 36 bytes leftover after parsing attributes in process `syz.2.2328'. [ 442.622410][T14553] veth1_to_team: entered allmulticast mode [ 442.740445][T14547] lo speed is unknown, defaulting to 1000 [ 442.953354][T14571] netlink: 216 bytes leftover after parsing attributes in process `syz.1.2337'. [ 442.981789][T14571] netlink: 24 bytes leftover after parsing attributes in process `syz.1.2337'. [ 443.517840][T14588] erspan0: entered promiscuous mode [ 443.527853][T14588] batman_adv: batadv0: Adding interface: macvlan5 [ 443.535708][T14588] batman_adv: batadv0: The MTU of interface macvlan5 is too small (1450) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 443.568297][T14588] batman_adv: batadv0: Interface activated: macvlan5 [ 444.130203][T14609] netlink: 'syz.2.2349': attribute type 1 has an invalid length. [ 444.601930][T14622] lo speed is unknown, defaulting to 1000 [ 444.884655][T14627] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 445.900271][T14654] __nla_validate_parse: 6 callbacks suppressed [ 445.900293][T14654] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2364'. [ 446.818377][T14671] netlink: 'syz.0.2370': attribute type 58 has an invalid length. [ 446.866627][T14671] netlink: 20 bytes leftover after parsing attributes in process `syz.0.2370'. [ 447.046069][T14673] netlink: 48 bytes leftover after parsing attributes in process `syz.1.2371'. [ 447.374378][T14678] lo speed is unknown, defaulting to 1000 [ 447.612749][T14685] syzkaller0: entered promiscuous mode [ 447.628683][T14685] syzkaller0: entered allmulticast mode [ 447.655089][ C1] vcan0: j1939_tp_rxtimer: 0xffff88805b3c5800: rx timeout, send abort [ 447.665392][ C1] vcan0: j1939_xtp_rx_abort_one: 0xffff88805b3c5800: 0x00000: (3) A timeout occurred and this is the connection abort to close the session. [ 447.675035][T14696] ip_vti0: entered promiscuous mode [ 447.715013][T14696] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2379'. [ 448.023197][T14713] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2382'. [ 451.460386][T14752] lo speed is unknown, defaulting to 1000 [ 451.485984][T14767] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2394'. [ 452.067232][T14774] lo speed is unknown, defaulting to 1000 [ 452.699159][T14804] netlink: 15188 bytes leftover after parsing attributes in process `syz.1.2407'. [ 453.999932][T14830] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2418'. [ 454.140083][T14835] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2418'. [ 454.214315][T14843] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2422'. [ 454.233295][T14843] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2422'. [ 454.539326][T14857] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2428'. [ 454.642851][T14863] A link change request failed with some changes committed already. Interface ip6_vti0 may have been left with an inconsistent configuration, please check. [ 454.741931][T14869] lo speed is unknown, defaulting to 1000 [ 455.574927][T14877] lo speed is unknown, defaulting to 1000 [ 455.615194][T14891] netlink: 17 bytes leftover after parsing attributes in process `syz.0.2433'. [ 455.835447][T14897] netlink: 40 bytes leftover after parsing attributes in process `syz.4.2434'. [ 455.928569][T14899] netlink: 'syz.0.2436': attribute type 4 has an invalid length. [ 456.085818][T14897] lo speed is unknown, defaulting to 1000 [ 456.569560][T14900] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 456.601527][T14915] netlink: 36 bytes leftover after parsing attributes in process `syz.3.2439'. [ 456.621913][T14915] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2439'. [ 456.623910][T14919] xt_CT: No such helper "syz0" [ 456.673770][T14915] netlink: 36 bytes leftover after parsing attributes in process `syz.3.2439'. [ 456.751635][T14915] netlink: 36 bytes leftover after parsing attributes in process `syz.3.2439'. [ 456.873024][T14929] netlink: 134788 bytes leftover after parsing attributes in process `syz.0.2442'. [ 457.780462][T14947] lo speed is unknown, defaulting to 1000 [ 457.914944][T14962] netlink: 'syz.4.2453': attribute type 9 has an invalid length. [ 457.945202][T14962] netlink: 'syz.4.2453': attribute type 6 has an invalid length. [ 458.508122][T14984] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2458'. [ 458.555608][T14984] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2458'. [ 459.577153][T15024] netlink: 'syz.0.2466': attribute type 10 has an invalid length. [ 459.725065][T15031] netlink: 20 bytes leftover after parsing attributes in process `syz.0.2466'. [ 460.052769][T15036] netlink: 212376 bytes leftover after parsing attributes in process `syz.1.2467'. [ 461.013406][T13109] nci: nci_add_new_protocol: the target found does not have the desired protocol [ 461.034459][T15081] workqueue: Failed to create a rescuer kthread for wq "nfc3_nci_cmd_wq": -EINTR [ 461.034969][T15072] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 461.090576][T15086] netlink: 'syz.0.2480': attribute type 1 has an invalid length. [ 461.125568][T15086] netlink: 'syz.0.2480': attribute type 3 has an invalid length. [ 461.156273][T15086] netlink: 224 bytes leftover after parsing attributes in process `syz.0.2480'. [ 461.423383][T15097] lo speed is unknown, defaulting to 1000 [ 461.799585][T15114] netlink: 32 bytes leftover after parsing attributes in process `syz.2.2489'. [ 461.825148][T15114] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2489'. [ 462.132830][T15128] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2491'. [ 462.638356][T15135] 0ªî{X¹¦: left allmulticast mode [ 462.658992][T15135] sit0: left promiscuous mode [ 462.685477][T15136] netlink: 'syz.0.2492': attribute type 2 has an invalid length. [ 462.692507][T15135] veth0_to_bond: left allmulticast mode [ 462.719083][T15135] veth0_to_bond: left promiscuous mode [ 462.776709][T15135] bridge3: port 1(veth0_to_bond) entered disabled state [ 462.835421][T15135] vlan0: left promiscuous mode [ 462.851371][T15135] gretap1: left promiscuous mode [ 462.861596][T15135] bond0: (slave gretap1): Releasing active interface [ 462.873785][T15135] bond4: left promiscuous mode [ 462.880793][T15135] bond7: left promiscuous mode [ 462.893015][T15142] netlink: 24 bytes leftover after parsing attributes in process `syz.1.2495'. [ 462.908678][T15146] FAULT_INJECTION: forcing a failure. [ 462.908678][T15146] name failslab, interval 1, probability 0, space 0, times 0 [ 462.919323][T15135] bridge2: left promiscuous mode [ 462.922413][T15146] CPU: 0 UID: 0 PID: 15146 Comm: syz.2.2496 Not tainted 6.16.0-rc6-syzkaller-01646-g56613001dfc9 #0 PREEMPT(full) [ 462.922437][T15146] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 462.922448][T15146] Call Trace: [ 462.922455][T15146] [ 462.922463][T15146] dump_stack_lvl+0x189/0x250 [ 462.922489][T15146] ? __pfx____ratelimit+0x10/0x10 [ 462.922508][T15146] ? __pfx_dump_stack_lvl+0x10/0x10 [ 462.922528][T15146] ? __pfx__printk+0x10/0x10 [ 462.922554][T15146] ? __lock_acquire+0xab9/0xd20 [ 462.922582][T15146] should_fail_ex+0x414/0x560 [ 462.922606][T15146] should_failslab+0xa8/0x100 [ 462.922632][T15146] kmem_cache_alloc_noprof+0x73/0x3c0 [ 462.922654][T15146] ? skb_clone+0x212/0x3a0 [ 462.922680][T15146] skb_clone+0x212/0x3a0 [ 462.922705][T15146] __netlink_deliver_tap+0x404/0x850 [ 462.922737][T15146] ? netlink_deliver_tap+0x2e/0x1b0 [ 462.922756][T15146] netlink_deliver_tap+0x19c/0x1b0 [ 462.922775][T15146] netlink_unicast+0x7fa/0x9e0 [ 462.922816][T15146] ? __pfx_netlink_unicast+0x10/0x10 [ 462.922843][T15146] ? netlink_sendmsg+0x642/0xb30 [ 462.922858][T15146] ? skb_put+0x11b/0x210 [ 462.922880][T15146] netlink_sendmsg+0x805/0xb30 [ 462.922908][T15146] ? __pfx_netlink_sendmsg+0x10/0x10 [ 462.922929][T15146] ? aa_sock_msg_perm+0x94/0x160 [ 462.922949][T15146] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 462.922966][T15146] ? __pfx_netlink_sendmsg+0x10/0x10 [ 462.922985][T15146] __sock_sendmsg+0x21c/0x270 [ 462.923012][T15146] ____sys_sendmsg+0x505/0x830 [ 462.923039][T15146] ? __pfx_____sys_sendmsg+0x10/0x10 [ 462.923070][T15146] ? import_iovec+0x74/0xa0 [ 462.923097][T15146] ___sys_sendmsg+0x21f/0x2a0 [ 462.923120][T15146] ? __pfx____sys_sendmsg+0x10/0x10 [ 462.923180][T15146] ? __fget_files+0x2a/0x420 [ 462.923195][T15146] ? __fget_files+0x3a0/0x420 [ 462.923223][T15146] __x64_sys_sendmsg+0x19b/0x260 [ 462.923247][T15146] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 462.923278][T15146] ? __pfx_ksys_write+0x10/0x10 [ 462.923297][T15146] ? rcu_is_watching+0x15/0xb0 [ 462.923323][T15146] ? do_syscall_64+0xbe/0x3b0 [ 462.923346][T15146] do_syscall_64+0xfa/0x3b0 [ 462.923362][T15146] ? lockdep_hardirqs_on+0x9c/0x150 [ 462.923379][T15146] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 462.923395][T15146] ? clear_bhb_loop+0x60/0xb0 [ 462.923430][T15146] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 462.923446][T15146] RIP: 0033:0x7f230458e9a9 [ 462.923463][T15146] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 462.923478][T15146] RSP: 002b:00007f2305329038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 462.923498][T15146] RAX: ffffffffffffffda RBX: 00007f23047b6080 RCX: 00007f230458e9a9 [ 462.923510][T15146] RDX: 0000000000000000 RSI: 0000200000000200 RDI: 0000000000000005 [ 462.923521][T15146] RBP: 00007f2305329090 R08: 0000000000000000 R09: 0000000000000000 [ 462.923531][T15146] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 462.923542][T15146] R13: 0000000000000000 R14: 00007f23047b6080 R15: 00007ffcbc4d6138 [ 462.923572][T15146] [ 463.236721][T15135] bond7: (slave bridge2): Releasing backup interface [ 464.117002][T15183] netdevsim0: mtu less than device minimum [ 465.270435][T15214] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2515'. [ 465.305227][T15214] netlink: 24 bytes leftover after parsing attributes in process `syz.1.2515'. [ 465.323985][T15217] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2515'. [ 465.340720][T15217] netlink: 24 bytes leftover after parsing attributes in process `syz.1.2515'. [ 465.374067][T15216] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2516'. [ 465.816933][T15237] lo speed is unknown, defaulting to 1000 [ 465.846569][T15241] netlink: 'syz.2.2524': attribute type 1 has an invalid length. [ 466.170276][T15247] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2526'. [ 466.232528][T15240] bond6 (unregistering): Released all slaves [ 467.975002][T15301] __nla_validate_parse: 2 callbacks suppressed [ 467.975022][T15301] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2539'. [ 469.102872][T15346] netlink: 'syz.2.2550': attribute type 1 has an invalid length. [ 469.238129][T15329] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 469.520439][T15357] netlink: 'syz.2.2553': attribute type 4 has an invalid length. [ 469.564265][T15357] netlink: 'syz.2.2553': attribute type 4 has an invalid length. [ 470.000430][T15369] lo speed is unknown, defaulting to 1000 [ 470.786293][T15383] netlink: 240 bytes leftover after parsing attributes in process `syz.2.2563'. [ 470.898633][T15383] netlink: 277 bytes leftover after parsing attributes in process `syz.2.2563'. [ 471.036973][T15388] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2565'. [ 471.085862][T15388] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2565'. [ 471.103312][T15388] netlink: 'syz.4.2565': attribute type 3 has an invalid length. [ 471.398492][T15407] lo speed is unknown, defaulting to 1000 [ 472.968281][T13109] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 472.993281][T13109] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 473.317248][T15459] netlink: 48 bytes leftover after parsing attributes in process `syz.1.2584'. [ 473.347845][T15459] netlink: 56 bytes leftover after parsing attributes in process `syz.1.2584'. [ 473.598276][T15470] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2589'. [ 474.203172][T15483] syzkaller0: entered allmulticast mode [ 474.928131][T15523] SET target dimension over the limit! [ 476.516224][T15514] bond0: (slave rose0): Enslaving as an active interface with an up link [ 476.562821][T15507] lo speed is unknown, defaulting to 1000 [ 476.752595][T15538] netlink: 28 bytes leftover after parsing attributes in process `syz.3.2607'. [ 476.791374][T15538] netlink: 28 bytes leftover after parsing attributes in process `syz.3.2607'. [ 477.120360][T15550] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2613'. [ 477.743813][T15570] tipc: Enabling of bearer rejected, already enabled [ 477.783849][T15570] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2619'. [ 477.945050][T15578] netlink: 'syz.4.2619': attribute type 6 has an invalid length. [ 477.999238][T15578] netlink: 176 bytes leftover after parsing attributes in process `syz.4.2619'. [ 477.999881][T15574] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2619'. [ 478.410739][T15593] syzkaller0: entered promiscuous mode [ 478.432573][T15593] syzkaller0: entered allmulticast mode [ 478.497442][T15596] netlink: 44 bytes leftover after parsing attributes in process `syz.3.2627'. [ 478.527174][T15596] netlink: 43 bytes leftover after parsing attributes in process `syz.3.2627'. [ 478.612604][T15596] netlink: 'syz.3.2627': attribute type 6 has an invalid length. [ 478.659644][T15596] netlink: 'syz.3.2627': attribute type 5 has an invalid length. [ 478.709817][T15596] netlink: 43 bytes leftover after parsing attributes in process `syz.3.2627'. [ 478.923602][T15596] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2627'. [ 479.777723][T15609] netlink: 16402 bytes leftover after parsing attributes in process `syz.0.2629'. [ 479.813317][T15607] netlink: 16402 bytes leftover after parsing attributes in process `syz.0.2629'. [ 479.854712][T15608] lo speed is unknown, defaulting to 1000 [ 480.156713][T15602] delete_channel: no stack [ 480.617541][T15639] netlink: 36 bytes leftover after parsing attributes in process `syz.1.2642'. [ 480.740329][T15653] netlink: 36 bytes leftover after parsing attributes in process `syz.0.2643'. [ 480.965152][T15665] IPVS: sync thread started: state = BACKUP, mcast_ifn = lo, syncid = 3, id = 0 [ 481.432116][T15675] bridge3: entered allmulticast mode [ 481.869070][T15703] bond0: (slave rose0): Error: Device is in use and cannot be enslaved [ 482.247987][T15712] lo speed is unknown, defaulting to 1000 [ 482.640802][T15721] syzkaller1: entered promiscuous mode [ 482.647434][T15721] syzkaller1: entered allmulticast mode [ 482.675080][T15719] tipc: Enabled bearer , priority 0 [ 482.691802][T15722] syzkaller0: entered promiscuous mode [ 482.697505][T15722] syzkaller0: entered allmulticast mode [ 482.865835][T15719] tipc: Resetting bearer [ 482.892267][T15718] tipc: Resetting bearer [ 482.909090][T15726] netlink: 'syz.2.2664': attribute type 1 has an invalid length. [ 482.967808][T15718] tipc: Disabling bearer [ 483.310721][T15738] macsec0: entered promiscuous mode [ 483.316486][T15738] BUG: sleeping function called from invalid context at kernel/locking/mutex.c:579 [ 483.325856][T15738] in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 15738, name: syz.4.2668 [ 483.331672][T15745] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2671'. [ 483.335067][T15738] preempt_count: 201, expected: 0 [ 483.348992][T15738] RCU nest depth: 0, expected: 0 [ 483.354001][T15738] 3 locks held by syz.4.2668/15738: [ 483.359220][T15738] #0: ffffffff8fa269b8 (&ops->srcu#2){.+.+}-{0:0}, at: rtnl_link_ops_get+0x23/0x250 [ 483.368818][T15738] #1: ffffffff8f51ed08 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0x8db/0x1c70 [ 483.377963][T15738] #2: ffff88806d986368 (&macsec_netdev_addr_lock_key/1){+...}-{3:3}, at: dev_uc_add+0x67/0x120 [ 483.388524][T15738] Preemption disabled at: [ 483.388537][T15738] [] dev_uc_add+0x56/0x120 [ 483.398933][T15738] CPU: 0 UID: 0 PID: 15738 Comm: syz.4.2668 Not tainted 6.16.0-rc6-syzkaller-01646-g56613001dfc9 #0 PREEMPT(full) [ 483.398960][T15738] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 483.398971][T15738] Call Trace: [ 483.398979][T15738] [ 483.398987][T15738] dump_stack_lvl+0x189/0x250 [ 483.399017][T15738] ? __pfx_dump_stack_lvl+0x10/0x10 [ 483.399040][T15738] ? __pfx__printk+0x10/0x10 [ 483.399069][T15738] ? print_lock_name+0xde/0x100 [ 483.399093][T15738] ? dev_uc_add+0x56/0x120 [ 483.399121][T15738] __might_resched+0x495/0x610 [ 483.399142][T15738] ? stack_depot_save_flags+0x40/0x900 [ 483.399167][T15738] ? dev_uc_add+0x56/0x120 [ 483.399189][T15738] ? __pfx___might_resched+0x10/0x10 [ 483.399213][T15738] ? kasan_save_track+0x4f/0x80 [ 483.399256][T15738] __mutex_lock+0x106/0xe80 [ 483.399292][T15738] ? dev_set_promiscuity+0x10e/0x260 [ 483.399317][T15738] ? __pfx___mutex_lock+0x10/0x10 [ 483.399335][T15738] ? netdev_info+0x10a/0x160 [ 483.399371][T15738] ? __pfx_netdev_info+0x10/0x10 [ 483.399413][T15738] dev_set_promiscuity+0x10e/0x260 [ 483.399438][T15738] ? __pfx_macsec_dev_change_rx_flags+0x10/0x10 [ 483.399461][T15738] __dev_set_promiscuity+0x534/0x740 [ 483.399484][T15738] ? __hw_addr_add_ex+0x3c5/0x770 [ 483.399510][T15738] __dev_set_rx_mode+0x17c/0x260 [ 483.399536][T15738] dev_uc_add+0xc8/0x120 [ 483.399563][T15738] macsec_dev_open+0xd9/0x530 [ 483.399589][T15738] ? ib_device_get_by_netdev+0x46b/0x4d0 [ 483.399617][T15738] ? __pfx_macsec_dev_open+0x10/0x10 [ 483.399642][T15738] ? ib_device_get_by_netdev+0x84/0x4d0 [ 483.399667][T15738] ? hsr_netdev_notify+0x29e/0xcf0 [ 483.399690][T15738] ? __pfx_ib_device_get_by_netdev+0x10/0x10 [ 483.399725][T15738] ? udp_tunnel_nic_netdevice_event+0x1a7/0x19f0 [ 483.399762][T15738] ? ip6_route_dev_notify+0x9a/0x5b0 [ 483.399785][T15738] ? notifier_call_chain+0x3bf/0x3e0 [ 483.399817][T15738] __dev_open+0x470/0x880 [ 483.399852][T15738] ? __pfx___dev_open+0x10/0x10 [ 483.399880][T15738] ? __pfx_macsec_dev_change_rx_flags+0x10/0x10 [ 483.399914][T15738] __dev_change_flags+0x1ea/0x6d0 [ 483.399933][T15738] ? __asan_memset+0x22/0x50 [ 483.399955][T15738] ? dev_addr_mod+0x2ce/0x3d0 [ 483.399980][T15738] ? __pfx___dev_change_flags+0x10/0x10 [ 483.400016][T15738] rtnl_newlink_create+0x555/0xb00 [ 483.400056][T15738] ? __pfx_rtnl_newlink_create+0x10/0x10 [ 483.400076][T15738] ? rtnl_newlink+0x8db/0x1c70 [ 483.400098][T15738] ? __pfx___mutex_lock+0x10/0x10 [ 483.400132][T15738] ? ns_capable+0x8a/0xf0 [ 483.400159][T15738] rtnl_newlink+0x16d6/0x1c70 [ 483.400199][T15738] ? __pfx_rtnl_newlink+0x10/0x10 [ 483.400224][T15738] ? rcu_is_watching+0x15/0xb0 [ 483.400248][T15738] ? __switch_to+0xd74/0x1600 [ 483.400287][T15738] ? __lock_acquire+0xab9/0xd20 [ 483.400323][T15738] ? __lock_acquire+0xab9/0xd20 [ 483.400369][T15738] ? is_bpf_text_address+0x26/0x2b0 [ 483.400413][T15738] ? __lock_acquire+0xab9/0xd20 [ 483.400486][T15738] ? __pfx_rtnl_newlink+0x10/0x10 [ 483.400513][T15738] rtnetlink_rcv_msg+0x7cf/0xb70 [ 483.400539][T15738] ? __lock_acquire+0xab9/0xd20 [ 483.400565][T15738] ? rtnetlink_rcv_msg+0x1ab/0xb70 [ 483.400584][T15738] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 483.400626][T15738] netlink_rcv_skb+0x208/0x470 [ 483.400644][T15738] ? __lock_acquire+0xab9/0xd20 [ 483.400663][T15738] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 483.400685][T15738] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 483.400745][T15738] ? netlink_deliver_tap+0x2e/0x1b0 [ 483.400776][T15738] netlink_unicast+0x82c/0x9e0 [ 483.400821][T15738] ? __pfx_netlink_unicast+0x10/0x10 [ 483.400859][T15738] ? netlink_sendmsg+0x642/0xb30 [ 483.400874][T15738] ? skb_put+0x11b/0x210 [ 483.400913][T15738] netlink_sendmsg+0x805/0xb30 [ 483.400943][T15738] ? __pfx_netlink_sendmsg+0x10/0x10 [ 483.400966][T15738] ? aa_sock_msg_perm+0x94/0x160 [ 483.400988][T15738] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 483.401007][T15738] ? __pfx_netlink_sendmsg+0x10/0x10 [ 483.401026][T15738] __sock_sendmsg+0x21c/0x270 [ 483.401055][T15738] ____sys_sendmsg+0x505/0x830 [ 483.401082][T15738] ? __pfx_____sys_sendmsg+0x10/0x10 [ 483.401113][T15738] ? import_iovec+0x74/0xa0 [ 483.401142][T15738] ___sys_sendmsg+0x21f/0x2a0 [ 483.401168][T15738] ? __pfx____sys_sendmsg+0x10/0x10 [ 483.401237][T15738] ? __fget_files+0x2a/0x420 [ 483.401254][T15738] ? __fget_files+0x3a0/0x420 [ 483.401284][T15738] __x64_sys_sendmsg+0x19b/0x260 [ 483.401311][T15738] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 483.401348][T15738] ? rcu_is_watching+0x15/0xb0 [ 483.401376][T15738] ? do_syscall_64+0xbe/0x3b0 [ 483.401402][T15738] do_syscall_64+0xfa/0x3b0 [ 483.401420][T15738] ? lockdep_hardirqs_on+0x9c/0x150 [ 483.401438][T15738] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 483.401455][T15738] ? clear_bhb_loop+0x60/0xb0 [ 483.401479][T15738] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 483.401498][T15738] RIP: 0033:0x7faac618e9a9 [ 483.401516][T15738] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 483.401532][T15738] RSP: 002b:00007faac6fe5038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 483.401553][T15738] RAX: ffffffffffffffda RBX: 00007faac63b5fa0 RCX: 00007faac618e9a9 [ 483.401567][T15738] RDX: 0000000000000010 RSI: 0000200000000000 RDI: 0000000000000005 [ 483.401579][T15738] RBP: 00007faac6210d69 R08: 0000000000000000 R09: 0000000000000000 [ 483.401592][T15738] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 483.401603][T15738] R13: 0000000000000000 R14: 00007faac63b5fa0 R15: 00007fff2b1daf08 [ 483.401638][T15738] [ 483.415177][T15746] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2671'. [ 483.423887][T15738] [ 483.423898][T15738] ============================= [ 483.423910][T15738] [ BUG: Invalid wait context ] [ 483.423921][T15738] 6.16.0-rc6-syzkaller-01646-g56613001dfc9 #0 Tainted: G W [ 483.423934][T15738] ----------------------------- [ 483.423940][T15738] syz.4.2668/15738 is trying to lock: [ 483.423951][T15738] ffff88805ba78d20 (&dev_instance_lock_key#20){+.+.}-{4:4}, at: dev_set_promiscuity+0x10e/0x260 [ 483.424009][T15738] other info that might help us debug this: [ 483.424017][T15738] context-{5:5} [ 483.424026][T15738] 3 locks held by syz.4.2668/15738: [ 483.424038][T15738] #0: ffffffff8fa269b8 (&ops->srcu#2){.+.+}-{0:0}, at: rtnl_link_ops_get+0x23/0x250 [ 483.424093][T15738] #1: ffffffff8f51ed08 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0x8db/0x1c70 [ 484.022691][T15738] #2: ffff88806d986368 (&macsec_netdev_addr_lock_key/1){+...}-{3:3}, at: dev_uc_add+0x67/0x120 [ 484.033238][T15738] stack backtrace: [ 484.036958][T15738] CPU: 0 UID: 0 PID: 15738 Comm: syz.4.2668 Tainted: G W 6.16.0-rc6-syzkaller-01646-g56613001dfc9 #0 PREEMPT(full) [ 484.036981][T15738] Tainted: [W]=WARN [ 484.036985][T15738] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 484.036994][T15738] Call Trace: [ 484.037003][T15738] [ 484.037011][T15738] dump_stack_lvl+0x189/0x250 [ 484.037030][T15738] ? __pfx_dump_stack_lvl+0x10/0x10 [ 484.037047][T15738] ? __pfx__printk+0x10/0x10 [ 484.037067][T15738] ? print_lock_name+0xde/0x100 [ 484.037086][T15738] __lock_acquire+0xbcb/0xd20 [ 484.037104][T15738] ? dev_set_promiscuity+0x10e/0x260 [ 484.037118][T15738] lock_acquire+0x120/0x360 [ 484.037131][T15738] ? dev_set_promiscuity+0x10e/0x260 [ 484.037150][T15738] __mutex_lock+0x182/0xe80 [ 484.037165][T15738] ? dev_set_promiscuity+0x10e/0x260 [ 484.037183][T15738] ? dev_set_promiscuity+0x10e/0x260 [ 484.037198][T15738] ? __pfx___mutex_lock+0x10/0x10 [ 484.037211][T15738] ? netdev_info+0x10a/0x160 [ 484.037233][T15738] ? __pfx_netdev_info+0x10/0x10 [ 484.037256][T15738] dev_set_promiscuity+0x10e/0x260 [ 484.037272][T15738] ? __pfx_macsec_dev_change_rx_flags+0x10/0x10 [ 484.037291][T15738] __dev_set_promiscuity+0x534/0x740 [ 484.037307][T15738] ? __hw_addr_add_ex+0x3c5/0x770 [ 484.037324][T15738] __dev_set_rx_mode+0x17c/0x260 [ 484.037340][T15738] dev_uc_add+0xc8/0x120 [ 484.037357][T15738] macsec_dev_open+0xd9/0x530 [ 484.037374][T15738] ? ib_device_get_by_netdev+0x46b/0x4d0 [ 484.037394][T15738] ? __pfx_macsec_dev_open+0x10/0x10 [ 484.037411][T15738] ? ib_device_get_by_netdev+0x84/0x4d0 [ 484.037429][T15738] ? hsr_netdev_notify+0x29e/0xcf0 [ 484.037446][T15738] ? __pfx_ib_device_get_by_netdev+0x10/0x10 [ 484.037466][T15738] ? udp_tunnel_nic_netdevice_event+0x1a7/0x19f0 [ 484.037491][T15738] ? ip6_route_dev_notify+0x9a/0x5b0 [ 484.037506][T15738] ? notifier_call_chain+0x3bf/0x3e0 [ 484.037525][T15738] __dev_open+0x470/0x880 [ 484.037547][T15738] ? __pfx___dev_open+0x10/0x10 [ 484.037567][T15738] ? __pfx_macsec_dev_change_rx_flags+0x10/0x10 [ 484.037588][T15738] __dev_change_flags+0x1ea/0x6d0 [ 484.037603][T15738] ? __asan_memset+0x22/0x50 [ 484.037619][T15738] ? dev_addr_mod+0x2ce/0x3d0 [ 484.037635][T15738] ? __pfx___dev_change_flags+0x10/0x10 [ 484.037654][T15738] rtnl_newlink_create+0x555/0xb00 [ 484.037674][T15738] ? __pfx_rtnl_newlink_create+0x10/0x10 [ 484.037688][T15738] ? rtnl_newlink+0x8db/0x1c70 [ 484.037702][T15738] ? __pfx___mutex_lock+0x10/0x10 [ 484.037725][T15738] ? ns_capable+0x8a/0xf0 [ 484.037743][T15738] rtnl_newlink+0x16d6/0x1c70 [ 484.037761][T15738] ? __pfx_rtnl_newlink+0x10/0x10 [ 484.037776][T15738] ? rcu_is_watching+0x15/0xb0 [ 484.037792][T15738] ? __switch_to+0xd74/0x1600 [ 484.037815][T15738] ? __lock_acquire+0xab9/0xd20 [ 484.037832][T15738] ? __lock_acquire+0xab9/0xd20 [ 484.037852][T15738] ? is_bpf_text_address+0x26/0x2b0 [ 484.037873][T15738] ? __lock_acquire+0xab9/0xd20 [ 484.037895][T15738] ? __pfx_rtnl_newlink+0x10/0x10 [ 484.037908][T15738] rtnetlink_rcv_msg+0x7cf/0xb70 [ 484.037921][T15738] ? __lock_acquire+0xab9/0xd20 [ 484.037935][T15738] ? rtnetlink_rcv_msg+0x1ab/0xb70 [ 484.037947][T15738] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 484.037966][T15738] netlink_rcv_skb+0x208/0x470 [ 484.037979][T15738] ? __lock_acquire+0xab9/0xd20 [ 484.037992][T15738] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 484.038006][T15738] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 484.038023][T15738] ? netlink_deliver_tap+0x2e/0x1b0 [ 484.038039][T15738] netlink_unicast+0x82c/0x9e0 [ 484.038061][T15738] ? __pfx_netlink_unicast+0x10/0x10 [ 484.038081][T15738] ? netlink_sendmsg+0x642/0xb30 [ 484.038094][T15738] ? skb_put+0x11b/0x210 [ 484.038109][T15738] netlink_sendmsg+0x805/0xb30 [ 484.038126][T15738] ? __pfx_netlink_sendmsg+0x10/0x10 [ 484.038141][T15738] ? aa_sock_msg_perm+0x94/0x160 [ 484.038156][T15738] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 484.038170][T15738] ? __pfx_netlink_sendmsg+0x10/0x10 [ 484.038184][T15738] __sock_sendmsg+0x21c/0x270 [ 484.038205][T15738] ____sys_sendmsg+0x505/0x830 [ 484.038223][T15738] ? __pfx_____sys_sendmsg+0x10/0x10 [ 484.038242][T15738] ? import_iovec+0x74/0xa0 [ 484.038262][T15738] ___sys_sendmsg+0x21f/0x2a0 [ 484.038278][T15738] ? __pfx____sys_sendmsg+0x10/0x10 [ 484.038306][T15738] ? __fget_files+0x2a/0x420 [ 484.038318][T15738] ? __fget_files+0x3a0/0x420 [ 484.038334][T15738] __x64_sys_sendmsg+0x19b/0x260 [ 484.038350][T15738] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 484.038370][T15738] ? rcu_is_watching+0x15/0xb0 [ 484.038388][T15738] ? do_syscall_64+0xbe/0x3b0 [ 484.038404][T15738] do_syscall_64+0xfa/0x3b0 [ 484.038418][T15738] ? lockdep_hardirqs_on+0x9c/0x150 [ 484.038431][T15738] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 484.038445][T15738] ? clear_bhb_loop+0x60/0xb0 [ 484.038460][T15738] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 484.038475][T15738] RIP: 0033:0x7faac618e9a9 [ 484.038489][T15738] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 484.038502][T15738] RSP: 002b:00007faac6fe5038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 484.038517][T15738] RAX: ffffffffffffffda RBX: 00007faac63b5fa0 RCX: 00007faac618e9a9 [ 484.038528][T15738] RDX: 0000000000000010 RSI: 0000200000000000 RDI: 0000000000000005 [ 484.038537][T15738] RBP: 00007faac6210d69 R08: 0000000000000000 R09: 0000000000000000 [ 484.038546][T15738] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 484.038554][T15738] R13: 0000000000000000 R14: 00007faac63b5fa0 R15: 00007fff2b1daf08 [ 484.038571][T15738] [ 484.577174][T15738] netdevsim netdevsim4 netdevsim0: entered promiscuous mode [ 484.586482][T15747] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2671'. [ 484.597611][T15738] macsec2: entered allmulticast mode [ 484.603159][T15738] macsec0: entered allmulticast mode [ 484.608706][T15738] netdevsim netdevsim4 netdevsim0: entered allmulticast mode