last executing test programs: 1m41.437906382s ago: executing program 4 (id=10877): ioctl$ifreq_SIOCGIFINDEX_batadv_hard(0xffffffffffffffff, 0x8933, &(0x7f00000003c0)={'batadv_slave_1\x00'}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x4040850) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f00000002c0)={'wlan0\x00'}) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), r0) r2 = socket(0x2, 0x80805, 0x0) bpf$BPF_GET_MAP_INFO(0xf, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r2, 0x89f8, &(0x7f0000000500)={'sit0\x00', &(0x7f0000000480)={'sit0\x00', 0x0, 0x7f07, 0x738, 0xf36f, 0xa9, {{0x5, 0x4, 0x2, 0x9, 0x14, 0x65, 0x0, 0x2, 0x29, 0x0, @dev={0xac, 0x14, 0x14, 0x31}, @remote}}}}) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000001380)={0x0, 0x0, &(0x7f0000001340)={&(0x7f0000000000)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r1, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r3, @ANYBLOB="d506330080000000ffffffffffff080211000001"], 0x6f4}}, 0x0) ioctl$SIOCX25GSUBSCRIP(r2, 0x89e0, 0x0) sendmsg$NL80211_CMD_SET_NOACK_MAP(0xffffffffffffffff, 0x0, 0x40) 1m41.302628606s ago: executing program 4 (id=10878): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x2, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000003bc0), 0x28) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, &(0x7f0000000680)=@gcm_128={{0x303}, "000037d7009400", "c0b6c5b29ca2b838d41ac2fc7ddf972d", "e9be1eae", "bb10000000000001"}, 0x28) socket$nl_route(0x10, 0x3, 0x0) epoll_create1(0x0) epoll_create1(0x0) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) shutdown(r0, 0x1) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000680)) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x0, 0x3, 0xfffffffffffffffd, 0x9323, 0xfffffffffffffffe, 0x0, 0x2}, 0x0, &(0x7f00000002c0)={0x3ff, 0x0, 0x0, 0x9, 0x0, 0x7dc48146, 0x7fffffff, 0x5539e0cf}, 0x0, 0x0) 1m40.340488781s ago: executing program 2 (id=10897): r0 = socket$inet6(0xa, 0x3, 0x5) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) connect$inet6(r1, &(0x7f0000000180)={0xa, 0x4001, 0x0, @dev={0xfe, 0x80, '\x00', 0x1c}, 0xd}, 0x1c) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r2, &(0x7f00000009c0)={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x21}}, 0x10) sendmmsg(r2, 0x0, 0x0, 0x4000005) shutdown(r2, 0x1) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) 1m40.284235026s ago: executing program 1 (id=10898): socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="01000000050000000900"], 0x48) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) close(0x3) socket$inet_icmp_raw(0x2, 0x3, 0x1) socket$packet(0x11, 0x3, 0x300) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0e000000040000000800000005"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f00000001c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bc82000000000000a6020000f8ffffffb703000008000000cd03000000000000850000003300000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp=0xedf0e51957efc755, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000080)={{r0}, &(0x7f0000000240), &(0x7f0000000380)=r1}, 0x20) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={r1, 0x18000000000002a0, 0x5ee, 0x0, &(0x7f0000000580)="b9ff03076804268c989e14f088a8", 0x0, 0x500, 0x60000000, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) syz_extract_tcp_res$synack(0x0, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000240)={'bridge_slave_1\x00'}) 1m40.283478798s ago: executing program 0 (id=10899): getpid() sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r0) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={'\x00', '\xff\xff', @empty}, 0xf}, 0x1c) listen(r1, 0x0) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r2, &(0x7f0000000140)={0x2, 0x4e22, @loopback}, 0x10) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000004c0)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="0100000000000000000001000000280001801400040000000000000000000000ffffac1414aa060001000a0080000800060003"], 0x3c}, 0x1, 0x0, 0x0, 0x4000000}, 0x4000000) 1m40.282545666s ago: executing program 4 (id=10900): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x20702, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'syzkaller0\x00', 0xca58c30f81b6079f}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0xa802, 0x0) close(r1) socket(0x10, 0x803, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f00000000c0)={'syzkaller0\x00', @broadcast}) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r4 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x129, 0x0, 0xfffffffd, {0x0, 0x0, 0x0, r3, {0x1, 0xd}, {}, {0x8, 0xfff1}}}, 0x24}, 0x1, 0x0, 0x0, 0x24048840}, 0x40004) recvmmsg(r4, &(0x7f0000001480)=[{{0x0, 0x0, &(0x7f0000000bc0)=[{&(0x7f0000000040)=""/55, 0x37}, {&(0x7f0000000540)=""/189, 0xbd}, {&(0x7f0000001ac0)=""/4096, 0x1000}, {&(0x7f0000000940)=""/74, 0x4a}], 0x4}, 0x5d}], 0x1b00, 0x10022, 0x0) 1m40.131008468s ago: executing program 1 (id=10902): openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = socket(0x400000000010, 0x3, 0x0) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, 0x0, 0x20008850) sendmsg$nl_route_sched(r1, &(0x7f0000000900)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000940)=@newtfilter={0x24, 0x2c, 0xd27, 0x70bd28, 0xfffff000, {0x0, 0x0, 0x0, r3, {0xf000, 0xffff}, {}, {0x7, 0xa}}}, 0x24}, 0x1, 0x0, 0x0, 0x80}, 0x20000800) r4 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) sendmsg$nl_route_sched(r0, 0x0, 0x20000800) r5 = socket(0x400000000010, 0x3, 0x0) r6 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=@gettfilter={0x24, 0x2e, 0x205, 0x70bd2c, 0x25dfdafd, {0x0, 0x0, 0x0, r7, {0xc, 0xc}, {0x0, 0xfff1}}}, 0x24}, 0x1, 0x0, 0x0, 0x20000801}, 0x4041080) 1m40.093897117s ago: executing program 2 (id=10903): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) sendmsg$NL802154_CMD_NEW_SEC_KEY(0xffffffffffffffff, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={&(0x7f00000001c0)=ANY=[@ANYBLOB=',', @ANYBLOB], 0x12c}, 0x1, 0x0, 0x0, 0x24004821}, 0x0) r1 = socket$kcm(0x2, 0xa, 0x2) socket$packet(0x11, 0x2, 0x300) r2 = bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB, @ANYRES32=r2], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0xb, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000007c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={0x0, r3}, 0x18) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r0, &(0x7f0000000280)={@val={0x0, 0x800}, @val={0x1, 0x0, 0x0, 0x0, 0x3d}, @mpls={[], @ipv4=@tcp={{0x6, 0x4, 0x0, 0x0, 0x40, 0x0, 0x0, 0x0, 0x84, 0x0, @empty=0x3fffffff, @local}, {{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x2, 0xb, 0x0, 0x0, 0x0, 0x4, {[@window={0xa, 0x3}, @timestamp={0x5, 0x2}, @generic={0x0, 0x2, "d58838068b91"}]}}}}}}, 0x4e) 1m39.371528087s ago: executing program 0 (id=10905): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) bind$inet6(r0, &(0x7f00000002c0)={0xa, 0x4e23, 0x1, @loopback}, 0x1c) r1 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, 0x0) r2 = socket(0x840000000002, 0x3, 0x100) setsockopt$WPAN_SECURITY(r2, 0x0, 0x32, 0x0, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) listen(r0, 0x5) socket$kcm(0x11, 0x2, 0x0) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) readv(r0, &(0x7f0000000a00)=[{0x0}, {&(0x7f0000001cc0)=""/4096, 0x1000}, {&(0x7f00000008c0)=""/189, 0xbd}, {&(0x7f0000000b40)=""/193, 0xc1}, {&(0x7f00000000c0)=""/8, 0x8}], 0x5) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f0000000580)={0x0, @in={{0x2, 0x0, @empty}}, 0x0, 0x0, 0x3fc, 0x0, 0x32}, 0x9c) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x20, 0x3, &(0x7f0000000340)=ANY=[], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @netfilter=0x2d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sendto$inet6(r3, &(0x7f0000847fff)='X', 0x34000, 0xe0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) 1m38.398636684s ago: executing program 0 (id=10906): r0 = socket$kcm(0x11, 0x3, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r2 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) close(r2) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r3 = socket$unix(0x1, 0x1, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000440)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x0, 0xffffffff, {0x0, 0x0, 0x0, r5, {0x0, 0xb}, {0xffff, 0xffff}, {0xb}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0xa, 0x7f61, 0xfffffffd, 0xc5, 0xe23, 0x1, 0x1, 0x7fff, 0x1}}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x20008001}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=@newqdisc={0x40, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdc01, {0x0, 0x0, 0x0, r7, {0x0, 0xd}, {0xffff, 0xb}, {0xffff, 0xffe0}}, [@qdisc_kind_options=@q_fq_codel={{0xd}, {0xc, 0x2, [@TCA_FQ_CODEL_CE_THRESHOLD={0x8, 0x7, 0xfffffff9}]}}]}, 0x40}, 0x1, 0x0, 0x0, 0x240040e0}, 0x4890) sendmsg$kcm(r0, &(0x7f0000000140)={&(0x7f0000000280)=@xdp={0x2c, 0xa888, r5, 0x3e}, 0x80, &(0x7f0000000200)=[{&(0x7f0000000240)="2719020059002fb96d9ce35eb119b04a88a8", 0x12}], 0x1}, 0x778b1a20232401d6) 1m38.125843872s ago: executing program 1 (id=10907): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$BATADV_CMD_SET_MESH(0xffffffffffffffff, 0x0, 0x80) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000600)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x28, 0x2, {{0x3, 0x3, 0x2, 0x7, 0xffffffff, 0x3}, [@TCA_NETEM_CORRUPT={0xc, 0x4, {0x4, 0x6}}]}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) sendto$packet(r4, &(0x7f00000005c0)="bad330fbc9b55400040000ea0756", 0xe, 0x40, &(0x7f00000001c0)={0x11, 0x8100, r3, 0x1, 0xd8, 0x6, @multicast}, 0x14) 1m38.05002737s ago: executing program 4 (id=10908): r0 = socket$netlink(0x10, 0x3, 0x0) bind$netlink(r0, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r1 = socket(0x400000000010, 0x3, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r3 = socket(0x400000000010, 0x3, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r5, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xc, 0xf}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x8001}, 0x20008850) sendmsg$nl_route_sched(r3, &(0x7f0000000900)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000940)=@newtfilter={0x34, 0x2c, 0xd27, 0x70bd28, 0xfffff000, {0x0, 0x0, 0x0, r5, {0xf000, 0xffff}, {}, {0x7, 0xa}}, [@filter_kind_options=@f_route={{0xa}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x80}, 0x20000800) r6 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000900)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newtfilter={0x3c, 0x2c, 0xd27, 0x70bd28, 0xfffff000, {0x0, 0x0, 0x0, r7, {0xf000, 0xffff}, {}, {0x7, 0xa}}, [@filter_kind_options=@f_route={{0xa}, {0xc, 0x2, [@TCA_ROUTE4_FROM={0x8, 0x3, 0x50}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x80}, 0x20000800) 1m37.498593235s ago: executing program 2 (id=10910): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x40, 0x0) ioctl$BTRFS_IOC_SUBVOL_GETFLAGS(r0, 0x80089419, 0x0) write$cgroup_subtree(0xffffffffffffffff, 0x0, 0x10448) socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, 0x0) socket(0x10, 0x803, 0x2) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040), 0x200002, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) mkdirat$cgroup_root(0xffffffffffffff9c, 0x0, 0x1ff) r2 = openat$cgroup_devices(0xffffffffffffffff, 0x0, 0x2, 0x0) write$cgroup_devices(r2, 0x0, 0xa) r3 = openat$cgroup_devices(r1, &(0x7f0000000000)='devices.allow\x00', 0x2, 0x0) write$cgroup_devices(r3, &(0x7f00000002c0)=ANY=[@ANYBLOB='a'], 0x8) 1m37.402877095s ago: executing program 2 (id=10912): socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="01000000050000000900"], 0x48) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) close(0x3) socket$inet_icmp_raw(0x2, 0x3, 0x1) socket$packet(0x11, 0x3, 0x300) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0e000000040000000800000005"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f00000001c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bc82000000000000a6020000f8ffffffb703000008000000cd03000000000000850000003300000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp=0xedf0e51957efc755, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000080)={{r0}, &(0x7f0000000240), &(0x7f0000000380)=r1}, 0x20) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={r1, 0x18000000000002a0, 0x5ee, 0x0, &(0x7f0000000580)="b9ff03076804268c989e14f088a8", 0x0, 0x500, 0x60000000, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) syz_extract_tcp_res$synack(0x0, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000240)={'bridge_slave_1\x00'}) 1m37.371702516s ago: executing program 0 (id=10913): socket$inet_sctp(0x2, 0x5, 0x84) socket$inet6_sctp(0xa, 0x1, 0x84) socket$inet_mptcp(0x2, 0x1, 0x106) socket(0x10, 0x80002, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) socket$xdp(0x2c, 0x3, 0x0) socket$xdp(0x2c, 0x3, 0x0) socket$netlink(0x10, 0x3, 0x400000000000004) socket(0x10, 0x803, 0x0) r0 = socket$kcm(0xa, 0x922000000003, 0x11) r1 = socket$kcm(0x10, 0x2, 0x4) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='memory.stat\x00', 0x26e1, 0x0) setsockopt$sock_attach_bpf(r0, 0x1, 0x3e, &(0x7f0000000100)=r2, 0x4) sendmsg$kcm(r1, &(0x7f0000000100), 0x0) 1m37.35648506s ago: executing program 4 (id=10914): r0 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, 0x0, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) recvmmsg(r1, &(0x7f0000004380), 0x0, 0xc0000000, &(0x7f0000004580)={0x77359400}) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0xd, 0x5, &(0x7f0000000040)=@framed={{0x66, 0xa, 0x0, 0x0, 0x0, 0x61, 0x11, 0x38}, [@initr0]}, 0x0}, 0x94) r2 = socket$inet6(0xa, 0x1, 0x0) r3 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r3, &(0x7f0000000000)={0x500, 0x0, &(0x7f0000000040)={&(0x7f0000000180)=ANY=[@ANYBLOB="020300090a0000000000000004000000030006000000000002000000ac1414000000000000000000020001000000000000000002fffffffb030005000000000002"], 0x50}}, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f0000000180)={{{@in=@private, @in6=@dev, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@local, 0x0, 0x6c}, 0x0, @in6=@loopback, 0x0, 0x0, 0x0, 0x4}}, 0xe8) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @dev}}, 0x1c) r4 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)={0x2, 0x9, 0x0, 0x0, 0x2}, 0x10}}, 0x0) 1m37.26315527s ago: executing program 1 (id=10916): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r2) sendmsg$TIPC_CMD_ENABLE_BEARER(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x100, 0x0) close(r4) r5 = socket$unix(0x1, 0x1, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000006c0)=@newqdisc={0x84, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r7, {0x0, 0xb}, {0xffff, 0xffff}, {0x0, 0xe}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x54, 0x2, {{0x100, 0x3, 0x6361, 0x5, 0xfffffffd, 0x6}, [@TCA_NETEM_LATENCY64={0xc, 0xa, 0x211}, @TCA_NETEM_SLOT={0x2c, 0xc, {0xfffffffffffffff4, 0x2, 0x49b, 0x0, 0x5, 0x7}}]}}}]}, 0x84}, 0x1, 0x0, 0x0, 0xc04c001}, 0x20000804) ioctl$SIOCSIFHWADDR(r4, 0x8922, &(0x7f0000002280)={'syzkaller0\x00', @random="2b0100004ec6"}) 1m37.187588641s ago: executing program 2 (id=10917): ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(0xffffffffffffffff, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_CONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)={0x30, 0x0, 0x5, 0x0, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r0}, @void}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}]]}, 0x30}}, 0x0) syz_80211_inject_frame(&(0x7f00000002c0)=@device_b, &(0x7f0000000300)=@mgmt_frame=@probe_response={{{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x1, [{0x2, 0x1}]}, @void, @void, @void, @void, @void, @void}, 0x2f) nanosleep(&(0x7f0000000340)={0x0, 0x2faf080}, 0x0) syz_80211_inject_frame(&(0x7f00000003c0)=@device_b, &(0x7f0000000400)=@mgmt_frame=@auth={{{}, {}, @device_b, @device_a, @from_mac, {0x0, 0x1}}, 0x0, 0x2, 0x0, @void}, 0x1e) syz_80211_inject_frame(&(0x7f00000004c0)=@device_b, &(0x7f0000000380)=@mgmt_frame=@assoc_resp={{{}, {}, @device_b, @device_a, @from_mac, {0x0, 0x2}}, 0x1, 0x0, @default, @val, @void}, 0x20) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000600)=ANY=[@ANYBLOB="5000000008021100000108021100000050505050505000000000000000000000000401000006020202020202"], 0x36) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_ASSOCIATE(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000003c0)={0x48, r2, 0x1, 0x70bd2c, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r4}, @void}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x96c}], @NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_PREV_BSSID={0xa, 0x4f, @from_mac=@device_b}]}, 0x48}, 0x1, 0x0, 0x0, 0x4000815}, 0x850) 1m37.187273739s ago: executing program 0 (id=10918): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x1c1b40, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000001c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) sendmsg$IEEE802154_SCAN_REQ(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000000080)={0x2, 0x4e23, @local}, 0x10) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f00000018c0)={0x0, 0x0, &(0x7f0000000180)={0x0, 0x30}}, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000400)='vegas', 0x5) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) socket$inet6(0x10, 0x2, 0x4) close(0x4) 1m37.187022863s ago: executing program 1 (id=10919): r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000003c0), 0x181341, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd26, 0xffffffff, {0x0, 0x0, 0x0, r4, {0x0, 0x6}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_qfg={0x8}]}, 0x2c}}, 0x24040084) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000400)=@newqdisc={0x34, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdfc, {0x0, 0x0, 0x0, r4, {0xffff}, {0xffff, 0xffff}, {0x2, 0xa}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x400dc}, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=@newqdisc={0x50, 0x28, 0x1, 0x70bd2a, 0xfffdfdf8, {0x0, 0x0, 0x0, r7, {0xffff}, {0xffff, 0xffff}, {0x2, 0xb}}, [@qdisc_kind_options=@q_cbs={{0x8}, {0x1c, 0x2, @TCA_CBS_PARMS={0x18, 0x1, {0x97, '\x00', 0xe3f0, 0x6, 0x3, 0x10000}}}}, @TCA_RATE={0x6, 0x5, {0x1, 0x1}}]}, 0x50}, 0x1, 0x0, 0x0, 0x4040000}, 0x240000a0) 1m36.93414534s ago: executing program 1 (id=10920): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) bind$netlink(r1, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f0000000000), 0x4) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r1, 0x10e, 0x4, &(0x7f0000000140)=0x7, 0x4) r2 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000001280)=@newtaction={0x18, 0x31, 0x3d, 0x0, 0x0, {}, [{0x4}]}, 0x18}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000340)=@newtaction={0xcc, 0x30, 0xffff, 0x70bd27, 0x0, {}, [{0xb8, 0x1, [@m_police={0x6c, 0x1, 0x0, 0x0, {{0xb}, {0x40, 0x2, 0x0, 0x1, [[@TCA_POLICE_TBF={0x3c, 0x1, {0x10000, 0x0, 0x0, 0x0, 0x0, {0x0, 0x2, 0x0, 0x0, 0xfffe}, {0x0, 0x0, 0x0, 0x0, 0xfffd}}}]]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x2}}}}, @m_gact={0x48, 0x2, 0x0, 0x0, {{0x9}, {0x1c, 0x2, 0x0, 0x1, [@TCA_GACT_PARMS={0x18, 0x2, {0x0, 0x0, 0x1}}]}, {0x4}, {0xc, 0x3}, {0xc}}}]}]}, 0xcc}}, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002120207b1af8ff00000000bfa100000000000007010000f8ffffffb702000004000000b7030000000000de850000000400000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000140)='kmem_cache_free\x00', r3}, 0x10) sendmmsg$inet(0xffffffffffffffff, 0x0, 0x0, 0x8040) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000700)={0x0, 0x1e5, &(0x7f00000006c0)={&(0x7f0000000440)=@deltaction={0x28, 0x31, 0x101, 0x0, 0x0, {}, [@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, 0x0, 0x0, @TCA_ACT_KIND={0x9, 0x1, 'gact\x00'}}]}]}, 0x28}}, 0x0) 1m36.933616645s ago: executing program 2 (id=10921): bpf$BPF_RAW_TRACEPOINT_OPEN_UNNAMED(0x11, 0x0, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000180)={0x0, 0xffffffffffffffff, 0x0, 0x7, &(0x7f0000000000)='cgroup\x00'}, 0x30) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000100)={0x18, 0x4, &(0x7f0000000400)=ANY=[@ANYBLOB="dc010000100000001800000000000000000000000000000095"], &(0x7f00000003c0)='syzkaller\x00', 0x5, 0x0, 0x0, 0x0, 0x4}, 0x94) r2 = openat$cgroup_procs(r0, &(0x7f0000000480)='cgroup.procs\x00', 0x2, 0x0) sendfile(r1, r2, 0x0, 0x3ffffffffffffa) bpf$BPF_TASK_FD_QUERY(0x14, 0x0, 0x0) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r4 = openat$cgroup_procs(r3, &(0x7f0000000040)='cgroup.threads\x00', 0x2, 0x0) sendfile(r4, r4, 0x0, 0x1) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r6 = openat$cgroup_procs(r5, &(0x7f0000000200)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r6, &(0x7f0000000c40), 0x12) 1m36.631712358s ago: executing program 32 (id=10920): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) bind$netlink(r1, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f0000000000), 0x4) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r1, 0x10e, 0x4, &(0x7f0000000140)=0x7, 0x4) r2 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000001280)=@newtaction={0x18, 0x31, 0x3d, 0x0, 0x0, {}, [{0x4}]}, 0x18}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000340)=@newtaction={0xcc, 0x30, 0xffff, 0x70bd27, 0x0, {}, [{0xb8, 0x1, [@m_police={0x6c, 0x1, 0x0, 0x0, {{0xb}, {0x40, 0x2, 0x0, 0x1, [[@TCA_POLICE_TBF={0x3c, 0x1, {0x10000, 0x0, 0x0, 0x0, 0x0, {0x0, 0x2, 0x0, 0x0, 0xfffe}, {0x0, 0x0, 0x0, 0x0, 0xfffd}}}]]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x2}}}}, @m_gact={0x48, 0x2, 0x0, 0x0, {{0x9}, {0x1c, 0x2, 0x0, 0x1, [@TCA_GACT_PARMS={0x18, 0x2, {0x0, 0x0, 0x1}}]}, {0x4}, {0xc, 0x3}, {0xc}}}]}]}, 0xcc}}, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002120207b1af8ff00000000bfa100000000000007010000f8ffffffb702000004000000b7030000000000de850000000400000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000140)='kmem_cache_free\x00', r3}, 0x10) sendmmsg$inet(0xffffffffffffffff, 0x0, 0x0, 0x8040) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000700)={0x0, 0x1e5, &(0x7f00000006c0)={&(0x7f0000000440)=@deltaction={0x28, 0x31, 0x101, 0x0, 0x0, {}, [@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, 0x0, 0x0, @TCA_ACT_KIND={0x9, 0x1, 'gact\x00'}}]}]}, 0x28}}, 0x0) 1m36.596119341s ago: executing program 0 (id=10923): r0 = socket$kcm(0x11, 0x3, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r2 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) close(r2) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r3 = socket$unix(0x1, 0x1, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000440)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x0, 0xffffffff, {0x0, 0x0, 0x0, r5, {0x0, 0xb}, {0xffff, 0xffff}, {0xb}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0xa, 0x7f61, 0xfffffffd, 0xc5, 0xe23, 0x1, 0x1, 0x7fff, 0x1}}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x20008001}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=@newqdisc={0x40, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdc01, {0x0, 0x0, 0x0, r7, {0x0, 0xd}, {0xffff, 0xb}, {0xffff, 0xffe0}}, [@qdisc_kind_options=@q_fq_codel={{0xd}, {0xc, 0x2, [@TCA_FQ_CODEL_CE_THRESHOLD={0x8, 0x7, 0xfffffff9}]}}]}, 0x40}, 0x1, 0x0, 0x0, 0x240040e0}, 0x4890) sendmsg$kcm(r0, &(0x7f0000000140)={&(0x7f0000000280)=@xdp={0x2c, 0xa888, r5, 0x3e}, 0x80, &(0x7f0000000200)=[{&(0x7f0000000240)="2719020059002fb96d9ce35eb119b04a88a8", 0x12}], 0x1}, 0x778b1a20232401d6) 1m36.549289859s ago: executing program 33 (id=10923): r0 = socket$kcm(0x11, 0x3, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r2 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) close(r2) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r3 = socket$unix(0x1, 0x1, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000440)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x0, 0xffffffff, {0x0, 0x0, 0x0, r5, {0x0, 0xb}, {0xffff, 0xffff}, {0xb}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0xa, 0x7f61, 0xfffffffd, 0xc5, 0xe23, 0x1, 0x1, 0x7fff, 0x1}}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x20008001}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=@newqdisc={0x40, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdc01, {0x0, 0x0, 0x0, r7, {0x0, 0xd}, {0xffff, 0xb}, {0xffff, 0xffe0}}, [@qdisc_kind_options=@q_fq_codel={{0xd}, {0xc, 0x2, [@TCA_FQ_CODEL_CE_THRESHOLD={0x8, 0x7, 0xfffffff9}]}}]}, 0x40}, 0x1, 0x0, 0x0, 0x240040e0}, 0x4890) sendmsg$kcm(r0, &(0x7f0000000140)={&(0x7f0000000280)=@xdp={0x2c, 0xa888, r5, 0x3e}, 0x80, &(0x7f0000000200)=[{&(0x7f0000000240)="2719020059002fb96d9ce35eb119b04a88a8", 0x12}], 0x1}, 0x778b1a20232401d6) 1m36.541943775s ago: executing program 34 (id=10921): bpf$BPF_RAW_TRACEPOINT_OPEN_UNNAMED(0x11, 0x0, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000180)={0x0, 0xffffffffffffffff, 0x0, 0x7, &(0x7f0000000000)='cgroup\x00'}, 0x30) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000100)={0x18, 0x4, &(0x7f0000000400)=ANY=[@ANYBLOB="dc010000100000001800000000000000000000000000000095"], &(0x7f00000003c0)='syzkaller\x00', 0x5, 0x0, 0x0, 0x0, 0x4}, 0x94) r2 = openat$cgroup_procs(r0, &(0x7f0000000480)='cgroup.procs\x00', 0x2, 0x0) sendfile(r1, r2, 0x0, 0x3ffffffffffffa) bpf$BPF_TASK_FD_QUERY(0x14, 0x0, 0x0) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r4 = openat$cgroup_procs(r3, &(0x7f0000000040)='cgroup.threads\x00', 0x2, 0x0) sendfile(r4, r4, 0x0, 0x1) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r6 = openat$cgroup_procs(r5, &(0x7f0000000200)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r6, &(0x7f0000000c40), 0x12) 1m36.097303484s ago: executing program 4 (id=10925): setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000bc0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd29, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x2}}, [@qdisc_kind_options=@q_fq_codel={{0xd}, {0x4}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000400)=@newtfilter={0x34, 0x2c, 0xd27, 0x30bd29, 0x25dfdc00, {0x0, 0x0, 0x0, r3, {0x0, 0x4}, {}, {0x8, 0xffff}}, [@filter_kind_options=@f_flower={{0xb}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x20000010}, 0x20000000) r4 = openat$tun(0xffffffffffffff9c, &(0x7f00000004c0), 0x0, 0x0) close(r4) socket$unix(0x1, 0x2, 0x0) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r5 = socket$kcm(0x11, 0x3, 0x0) setsockopt$sock_attach_bpf(r5, 0x107, 0xf, &(0x7f0000000600), 0x56) sendmsg$kcm(r5, &(0x7f00000000c0)={&(0x7f0000000380)=@xdp={0x2c, 0x0, r3, 0xc}, 0x80, &(0x7f0000000000)=[{&(0x7f0000000180)="27030200590214000600002fb96dbcf706e10500000086ddffff1144ee163cd4b8bf", 0x22}, {&(0x7f0000000c00)="4307ed2e", 0x4}], 0x2}, 0x4) 1m36.085516706s ago: executing program 35 (id=10925): setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000bc0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd29, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x2}}, [@qdisc_kind_options=@q_fq_codel={{0xd}, {0x4}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000400)=@newtfilter={0x34, 0x2c, 0xd27, 0x30bd29, 0x25dfdc00, {0x0, 0x0, 0x0, r3, {0x0, 0x4}, {}, {0x8, 0xffff}}, [@filter_kind_options=@f_flower={{0xb}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x20000010}, 0x20000000) r4 = openat$tun(0xffffffffffffff9c, &(0x7f00000004c0), 0x0, 0x0) close(r4) socket$unix(0x1, 0x2, 0x0) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r5 = socket$kcm(0x11, 0x3, 0x0) setsockopt$sock_attach_bpf(r5, 0x107, 0xf, &(0x7f0000000600), 0x56) sendmsg$kcm(r5, &(0x7f00000000c0)={&(0x7f0000000380)=@xdp={0x2c, 0x0, r3, 0xc}, 0x80, &(0x7f0000000000)=[{&(0x7f0000000180)="27030200590214000600002fb96dbcf706e10500000086ddffff1144ee163cd4b8bf", 0x22}, {&(0x7f0000000c00)="4307ed2e", 0x4}], 0x2}, 0x4) 3.048616212s ago: executing program 7 (id=11758): socket$inet_sctp(0x2, 0x5, 0x84) socket$inet6_sctp(0xa, 0x1, 0x84) socket$inet_mptcp(0x2, 0x1, 0x106) socket(0x10, 0x80002, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) socket$xdp(0x2c, 0x3, 0x0) socket$xdp(0x2c, 0x3, 0x0) socket$netlink(0x10, 0x3, 0x400000000000004) socket$kcm(0xa, 0x922000000003, 0x11) r0 = socket$kcm(0x10, 0x2, 0x4) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='memory.stat\x00', 0x26e1, 0x0) sendmsg$kcm(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="48000000150081fb7059ae08060c04000aff0f11000000040011018701546fabca1b4e7d06a6bd7c493872f750375ed08a562af5745e17b8c119418f0f000000d6e74703c48f93b8", 0x48}], 0x1}, 0x0) 2.900209129s ago: executing program 7 (id=11762): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r2) sendmsg$TIPC_CMD_ENABLE_BEARER(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x100, 0x0) close(r4) r5 = socket$unix(0x1, 0x1, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, 0x0) sendmsg$nl_route_sched(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=@newqdisc={0x70, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x8000000, {0x0, 0x0, 0x0, 0x0, {0x0, 0xe}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0xe, 0x7, 0x6361, 0x1, 0xffffffff, 0x6}}}}, @TCA_STAB={0x24, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0xa, 0x7, 0x7, 0xfffff8d2, 0x1, 0x80, 0x1}}, {0x4}}]}]}, 0x70}, 0x1, 0x0, 0x0, 0x20008001}, 0x24004880) ioctl$SIOCSIFHWADDR(r4, 0x8922, &(0x7f0000002280)={'syzkaller0\x00', @random="2b0100004ec6"}) 2.521021435s ago: executing program 7 (id=11767): r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) socketpair$unix(0x1, 0x1, 0x0, 0x0) r1 = syz_init_net_socket$ax25(0x3, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$IPVS_CMD_DEL_SERVICE(r2, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000180)={&(0x7f0000000080)={0x64, r3, 0x1, 0x70bd26, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x8}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x2}, @IPVS_CMD_ATTR_DAEMON={0x4}, @IPVS_CMD_ATTR_SERVICE={0x2c, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_PE_NAME={0x8}, @IPVS_SVC_ATTR_SCHED_NAME={0x7, 0x6, 'nq\x00'}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x3}, @IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x4e23}, @IPVS_SVC_ATTR_AF={0x6, 0x1, 0x2}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x1}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8}]}, 0x64}, 0x1, 0x0, 0x0, 0x800}, 0x24008084) syz_genetlink_get_family_id$SEG6(0x0, r2) sendmsg$SEG6_CMD_SETHMAC(r2, 0x0, 0x24040085) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000340)={'pim6reg1\x00'}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'veth1_vlan\x00'}) getsockopt$IP_SET_OP_VERSION(r2, 0x1, 0x53, &(0x7f0000000380), &(0x7f00000003c0)=0x8) syz_genetlink_get_family_id$fou(0x0, r2) getpeername$packet(0xffffffffffffffff, &(0x7f0000005900)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @multicast}, 0x0) socket$nl_route(0x10, 0x3, 0x0) syz_genetlink_get_family_id$devlink(&(0x7f0000005e00), r2) ioctl$sock_netrom_SIOCADDRT(0xffffffffffffffff, 0x890b, 0x0) r4 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) ioctl$sock_ifreq(r4, 0x8910, &(0x7f0000000000)={'veth0_vlan\x00', @ifru_ivalue=0x4}) ioctl$sock_netdev_private(r0, 0x8914, &(0x7f0000000000)) 2.174899759s ago: executing program 3 (id=11769): r0 = socket$vsock_stream(0x28, 0x1, 0x0) r1 = socket$inet6_sctp(0xa, 0x0, 0x84) shutdown(r1, 0x0) r2 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_PR_SUPPORTED(r2, 0x84, 0x71, &(0x7f00000003c0)={0x0, 0x68}, &(0x7f0000000400)=0x8) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x1c, &(0x7f00000010c0)=[@in6={0xa, 0x4e23, 0x38371a9, @mcast1, 0xb}]}, &(0x7f0000001040)=0x10) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r1, 0x84, 0x75, &(0x7f0000000040)={r3, 0x7ff}, 0x8) pread64(r0, &(0x7f0000000040)=""/4096, 0x1000, 0x1046) getsockopt(r0, 0x28, 0x46, 0x0, &(0x7f0000000000)) 1.997986089s ago: executing program 7 (id=11771): r0 = socket$inet6(0xa, 0x3, 0x8000000003c) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x42901, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r2 = socket$kcm(0x2, 0xa, 0x2) r3 = socket$inet6(0xa, 0x5, 0x0) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) r5 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCDELRT(r5, 0x8912, &(0x7f00000001c0)={0x2000000, {0x2, 0x4e20, @broadcast}, {0x2, 0x1, @remote}, {0x2, 0x0, @broadcast}}) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r4, 0x84, 0x6f, &(0x7f00000001c0)={0x0, 0x10, &(0x7f0000000000)=[@in={0x2, 0x0, @private=0xa010101}]}, &(0x7f0000000080)=0x10) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r4, 0x84, 0x1d, &(0x7f0000000140)={0x1, [0x0]}, &(0x7f0000000240)=0xffc5) setsockopt$inet_sctp6_SCTP_CONTEXT(r3, 0x84, 0x11, &(0x7f0000000000)={r6, 0x10001}, 0x8) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000340)={'syzkaller1\x00', @link_local}) write$tun(r1, &(0x7f0000000040)=ANY=[@ANYBLOB="034886dd0900300003003003e80060ce902d120c2f0081e949b93897bc3b0000000000007d01ff020000000000000000000000000001120022eb"], 0xfdef) connect$inet6(r0, 0x0, 0x0) sendmsg(r0, 0x0, 0x4) r7 = socket$netlink(0x10, 0x3, 0x13) r8 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$vsock_stream(r8, &(0x7f0000000240)={0x28, 0x0, 0xffffffff, @local}, 0x10) bind$inet6(r8, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty}, 0x1c) ioctl$BTRFS_IOC_SNAP_CREATE(r2, 0x50009401, &(0x7f0000000440)={{r0}, "724da980a7599bac9dcedea2f011d8140c4de94027bb25c11fa75751b1fafa4e1dcee68aa4ace97a5f0872db4e2f9d554ad3b2d2aaf8a876a75bf7feec44aa560601bdeb05e6db7bfe35f4473aa27cb13fd54a02ceac24f9e5a82f8941299a8f868f11a63fe620e08396b579367cd0cea4e9204de8c6826b25b33a87f68c74de323455d5cb8f67d6476073d0a7a6dcfe1805f32e1b808c1296093bac409c8f80aee6a5980bc0803aa2ac04d4ff2353ab6a3db1ad6476725fb5f0b76b7cf3c7d1f3bf73f36d5e6ee3503319d4ad6ed77f99c823260ccdff49cf03ba4ece18ea5195a59d3c6e215bb9e04085f3c6780ca0051295c57469e03fc64d43130e17b3b144a63a742d0eb9ac67a1f22540b43a9fe20c26dedc8813fa35f07c83b76215115d87e7edec9a75476fc53f4e2cfbcd76970ee632c96da880b3b722f058051ab06c3d3859c2e54c28e43f8ae1e581003debe6bd1057a33d4b8b99bc37e0c1c8e80f716d1ce1e9992341cab6dc5d12e9a9fbdad1b51420791eac9c122353435cbedae598c05955b66721ffc74620b5ffdfce98ada2d3ae45e9a049b6aef05226cfd49a73f1b3c4ba4bcb8d3ef4d5763063de0c10c6f40e0d57175a70e965dd3c7d7a1be460f5b4ba7955659c35a75e24455f0f12709734a62eef0b312c6aeb0fef63c12573a2671c1eed72972a154a3e349244001076d4822994a8acb41304a7c3285c89b589332ccda3283ecd92bf24445e21d3f865aee71ba1ac4cd6105ffd19c0a80044d7ed9324e44c12c9f7c6189aa940409851855c753f9c874a64106291c9a5669867839d6d39ed8fa43e0e7ba06c1315ba5f820587818b282c8b4a18738a9467646af24fdb196a3cac49b9d6d535f8b195d706abb9ca981b67d657600777e1647561fe9bd9261f786052f099a6918db742b901cb5ec319feb38bcb0c06e18b83b388af2a441e9490f0516d0465a51e9d419dd8be9ff4fb16801d7006b6f3efb24fac15ee91eeccd3a66635ace1679a68cd27781fe02c90ed93c11c3c567ab4e4de00ff0aee8e63dbd9d247ea27f456ef41f42e7ab227291fd8c6a4caec1b37dc0bd1f60e25d6997cacd766b01100d90aee2cfb92e2be5b94bbc05a901803d1154157d391374ebb80fa44e7de97e2e4cf0c12d73663279f9ae0e2e218ad3f467dafbaac3e3cb6c48f4dc371b167a45e6ada0148c264ba7c019ebbf1bfbf47a78743c9192e6d2973b168e0c5e9fb80b17243ed7ded84cb96edf30f5eca335c1de69e304c4d1a7e09e74862a4cdf8155e142ee30a7e4e904910d0656da106e4cae67a280629b09d4efae3348c08f7ec9e9bda56c5fab5dddacc71b2195514d7123b7e2a37fbff69aad7739307190191c4a4c77026339b2d00ef26eac2f486c6ff5ac122dedf40dff4d60d49c1fb0aef2856b78c45e8aa374511cc2cf816bec26748a305ae7a463f661df44ff608a8f92bfed019de4e25804683e18a14e42a2de53a00a2e775e8475a913c1ae59fef271642ac75fd0180427fe7ebe653d64158085771732ef524d5bfc9b02a2117abf23f57f3833dd6d3e46379a2526a34d9c42d14f40e2d16668cf94a945de0361ee11ba0edf1b034d01a764ac1c8dedfaaa380f5493181a1d2d1dd60e5b927f974749db538238cc28cb705544c59c535969d7bf67bb28077b73c20ed4edfe10e0d19fa8445fc2d8eab3cc67a852d4d00938c540206cda5a0131f1987152a88ef8b0c89a81385d5f0c5988512aecaf40e90e2f63a05c50cff59baa5614217836986147d4214c3ee3ca359dea761d855c7dc9672dbdf66b689063fc7366239305ebbdd5fa9e57bc34e6e4255e73b6455adfb97ab7baae5086f3cf253edea1736f54bc495b26178c2c7a17834ee5358573c19a40cf442ab80ec90e31e58ba32d07bcb9848494ca0eee01d4df4979055f50e32e3cf4b28ea9162ac6d610f5109027c34b3cf1b41f0a110d4c221b50beeedf939f0f65cf7c083e8828b9b718fa9a676c28e728c072167e4c9716cbd43c7d2d538bbf14c6fe462c97951465317bd0a2dd9f50856f8c375e531343dbea9409ea155b4a13d4d5e2b9bb71fed2f5b4b17488044ff98f084ba2a6caa0d0d9774f5bc4ba8f327d860d3f06fcf80ce755298ec23eff6241d0f445a90a3cb76c7b0b88a4e50faf86a1aed9edaf154c2dceee14db47a324d31a5616c67e10b39e87c8f4435ce19ded41c76c3b8191ac97a427d573fc03c73ebd019a39d3de27ad7ac0cbdbc4b1f56d53f5803a7954f42371453622b41fbc38188942b23d5f5eb85b2488f3d33e0eb4efb1b341f836be9e7875d9d075ee1a0650738b6e3f3f0439a66ed2da919eecfbe286589572f545dcff18ddd205032a3d2f5c2042b02738657e27fe8cecae6e40035168bba893b1ce864de7dc87812e5cfacbb35aedccbe9a582f1e4f10609fc6426d9dc712b7fd11b8976bd8271558e2ffe92fbb52d69aff73a2bc1ec013a48c971268cfc490af2c6bf6d6930e85d2b4a642260a77524cc283a872e8a9fe572d69e87fc97b0901955a8bfc6a348d440f598a898dba16cdaf029ee75d9097d381ad746748c81692163716b1a51be762c63a90d3c5b3e2bc8936e500e3a36fa4138f7d0725e429e24925b1692d23a8e331ac47cfb5d853db11b8cdc30f89e1ddb2a38129b6aeb0b5825b511046d9cdcc66612498a76756ba64e3c355935b3d98b856d7674a937e0da5ad05b39f13ecc504780ef06028c1da7b5272da7822d45754e52e152e8495a2db9285e4b8016133284ee1634d9af21cc71dd72116097c33bcf600f67a30fec1cf2a8ff2598c0224bec0536ae9e92e18bbf0982b0ad78cd4c4fb2e61586509ff8589db0ed505e8d426a3056effe68074dba9994a6242235cd10ac2d9cb1eec83c893367612492f6dd364c83b930d46e3959f449157b4585229e203360b7c8d0c72607726ebad8a16dbcd501b21f9a8e0095592eb7c245e54e8c369a7c0cdb0ca11b2c5b74fe305b18517d52601629b965d54be564e3cc32f84e076257ecb247199ffcd991ab2aeb4e808ba5797d7624f4d5b4fa46d2867bb0e2ddd502a3913ee5e9cb9374197126c55c9f1113b18bb2b887678e18851195a18f9f84979c51cf55bc098959e97ef1c7fee37d0528dd35e0e002b79b7e6102622ea02335b844980853cf7b7a6f423728420817f35b94528682e0d5a83f8790e073518f8eddf2f0b17c4de7a300e01ba04212b61117f9d7f6dbd8857fb836438e7781bc10783a85f0b298175d1e3708047acbe2db787dd76ebe7b1759672d8e5a031028f5e4b0a58ac2d0b1cc86d0d4b420311ce98d2177c70151c95e70f4216adfe262fefc2a8c55bf03c25ea0207130b3af9642f130a734dba25be514e3a332b6d979ea10a6430f0e941289acb80d2890f79f3ef8588c37438d71b39a29620625c60032fbe697886541ce4c0548b2de5aef1a3040cf59d2543adacdab13b35fbd2d11705650b044149df960521345af650c9be11cda02eae2983a81f706591bff107ee8f133365a95f10624385a276975772a9aab23ebe7458928b02d49cebd96b97cc02a3c6fad57de1ac7e70bd7d7616358911bfb9aa5d8aaf469d045556af224659e5b7227901e39230695cc69c87c8db595c09906f6cd25aa78f4e273d8658a3385eb6499ca17bda1b01a89797b603abec688c63c659345805f45531d23670646a23a2c19d064b23f19bdfd368b9b35d26166047846ee54a9e781d5ed82dde04c4830ba6c316743047f770ac1d97e3992aabe7fdf9d0357a98dcf31daac48c4575706c820b23fb5fc2c8b3b971fdb27781fcc89e72ce193f89191eb973f15f46c260c4d7074feafaed8fe062b05dc108d289910b58590fa01dd2d840c93b7c863889364f3a2e7bc29e6abe254d9a7a58afb5e16270b0f9038d8aab30b0a464a7acd2bea09d4b2d9fd4122540f2a5ca8cd2e4cdcf4f614e5f69fd87dad6777e5faf5e2ea5056af6103dde8c10c544e702a8d7c91520792d6d4a168982f97689fc36dd959a25ac6489f1aba2b0bb5e07c7d8e1a3eeb1cabed66e137aa6aedccefc89cb97877b8b27ae8813f60f460361d185d9c1123f5a8ea31f850008cae0c57464b9bebf42adf06b1c81f8ad9684dbfbcc4c507292bad7f9c6bad0665c5e9a62f775a6409a26db5232f5ea3e6fadd64aee4787e8f220408136c20aca676013d25754958dfa730a4f298b1031b4aefab365e57b4814c175994c2bca238e2de55fa9ecedd1fc31aa284ad953aac9d8a56065ce1209c372f596fc30f0ee97aa0a8d785e2f59f8d4cdddc3d215d9165fa617bba9d84bc5d0f8da7a855d5b3cd586e18237ffc2109940e4648b31e2d137312c717cfe5d533eee9e3fbe441dd0c64cd581bc1b2ebe8f999fa0dfb8f01a40f923a6e91c540e7e3eef9cd6488e9a26e5d3da7ca89eb42fbc5b44eec0f82cc502581e397531d4f63a7e4b9c795cbe7849bbc74cfc4a1422ecbf1c7c4b9c8083cc1ec06e4a2e2c14f8a7ea6aa92623ef28145a8295fd241e94f30b6f52681c5ffa76db73d96c99ce7ee1468837cc74d012407e811924ef4d54422d16a573841acd49e8c79c19fcefcd98c746d9e85f82a3bf46719c4e6e98f1bd90ccd7e7bb61b70ffb91dae7a231bc33053df6fe6f561e1ae0d2501d3dbec2c85fbffa62ec4a219c7a30fca228021446f6e28b89da75a668887070df9bb0dbd66a6ae81db90dee596b2343481b10496eb73cdbfb1e4dbd79a5b7bc387bcef18cf8ede391b85b1efc9b732e9befa783171a5c0069a48ee896065589a9af3c0e1301b2173b3464a3c8b8984bf800028f2658dcb9a76f9b24b1a64cee8aacdb16784cc7ad4e91a57af28390521cc3419036c595ff45131a8002fc65f87fda80aefa439d2b54842bb6f105fe6157b7d2e4f30686160134eb5c843262fb44f7b17d06f53c978dcfd6b1a81a4f93588f6df063d72d1f7064499f21f3a786dec7fd4ada1abfe4606d3b8e700b96f42f093692b8786123244655c4be75a1d2651e7d83ff38ef7c66ac45a0fc6268bb424d8e40099a5a8a51d3002c88e11fbee71522514dd207244028d5291c5df3c895a1015a1802348e763b9e5d883658f53f89c53884481ae7a5c3c3be2337c7c18fab7155edbde9dc7b4bb2d8874abadd1770bd8556f9203526c94a96a43feea15f8a980678a85f1d5410bb462600a85a5c9140f6f3a19abf8adea0c7963ea49a31b98b69462690d58e04de7b0cbeaecf009c5cd131068e9619860c3e36ec08c9f6ee09704bd08c1bb58b79ff917dbe9d1587743e39d1c77e32c647336acdb7a4d04b322fb8936e8955f6198288e51689b78b6c1d0ce022b9a00420685f804dd5b2f3c0952534c3d6185f954fd8f2a184184d9e299e27dac93f8440dc90224f1e7c339d5eda8770abe146ce862f7d8b9daa9f91c06d104fde0e7c904a15507d39bbc6d2cb1894abff73c2cc847f8dea42272e92ceeae4da1c49d7f2ae592a1130a76146083dc23f0946fbe1de9f0587d4ff3e6e49a59db85cb8c56d4f52b8475cf52994f47c4984ba0f9c6fb31f14b0ce3d10567e70d3906cc651ff14a15943f0757cdaafbe208d85ddd89c1a7d5dfadd05f0ab1852341a229dd923cb067fdd3aaeb82f73fb9d16f83a987e92448c75b26922fc2c71fdf7c7501a2f32b839c9a69d28069a87069b7eedddeb08e9b7ac3251ab51aa7c8040ad1afb610c161937334cf91ba2e292df67ccba842364c588bda03392cad8b260285a34168655d753f"}) setsockopt$sock_int(r8, 0x1, 0xf, &(0x7f0000000200)=0x8, 0x4) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r8, 0x6, 0x23, &(0x7f0000000100)={&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x0, 0x0, &(0x7f0000000000)=""/196, 0xc4, 0x0, &(0x7f0000000340)=""/241, 0xf1}, &(0x7f0000000140)=0x40) r9 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000180), r7) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000001c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_PROBE_CLIENT(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000001440)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r9, @ANYBLOB="010628bd7000fbdbdf255400000008000300", @ANYRES32=r10, @ANYBLOB="db09454072efe6bb7f866a06f10d41d088005a78a3fb032580bb23dbcd74bf1a901bcd5d8891c5caf514c900672194b5dc15b374c080e529f9ca1240afc764f14f545312d3ea5a59cacee4107c0da227d8e77d400180a3fb8e1f62062772e72277ad2d6836dd4d2d4c57c0112dd466f4e7a7e70a56206a864bf874afa5e738a3ab56ee7c90823599196cf52351f7a78874698c64c00856e40a1bb15c14ce4ab5c4d867d2bc23db1753f12d2232dd54d013974c4c11b4be80b60553360842647ee1efa4c11c6264d8ea581378e41ddfbdd0497d11d65ceb1f9767dbab4e847d"], 0x1c}, 0x1, 0x0, 0x0, 0x841}, 0x50) syz_init_net_socket$netrom(0x6, 0x5, 0x0) 1.766352731s ago: executing program 3 (id=11773): socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) r0 = syz_open_procfs$namespace(0x0, &(0x7f0000000080)='ns/ipc\x00') r1 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r1, 0x0, 0x0) socket$key(0xf, 0x3, 0x2) syz_emit_ethernet(0x4e, 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) sendmmsg$inet6(0xffffffffffffffff, 0x0, 0x0, 0x97ffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000005c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_DEL_STATION(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)={0x24, 0x0, 0x121, 0x70bd2c, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_MGMT_SUBTYPE={0x5, 0x29, 0xa}]}, 0x24}, 0x1, 0x0, 0x0, 0x40014}, 0x0) r4 = socket$inet_tcp(0x2, 0x1, 0x0) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, 0x0, 0x0) openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) openat$tcp_mem(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0) writev(0xffffffffffffffff, 0x0, 0x0) socket$inet_udp(0x2, 0x2, 0x0) sendmsg$nl_route(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="200000001400030500008000ffdbdf25020000fd", @ANYRES32, @ANYRES8=r0], 0x20}, 0x1, 0x0, 0x0, 0x8090}, 0x48006) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8916, &(0x7f0000000180)={'lo\x00', {0x2, 0x4e22, @broadcast}}) 1.762247837s ago: executing program 8 (id=11774): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0xe, 0x4, 0x8, 0x2}, 0x48) r1 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) ioctl$sock_SIOCINQ(r1, 0x541b, &(0x7f00000002c0)) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x1c, &(0x7f00000000c0)=[@in6={0xa, 0x0, 0x0, @private2}]}, 0x0) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000200)={r0, &(0x7f0000000080), &(0x7f0000000000)=""/10, 0x2}, 0x20) socket$nl_xfrm(0x10, 0x3, 0x6) r2 = socket(0xa, 0x3, 0x3a) getsockopt$nfc_llcp(r2, 0x3a, 0x1, 0x0, 0x20000000) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x3, 0x0, 0x0, {0x3}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x5c, 0x9, 0xa, 0x401, 0x0, 0x0, {0x3}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x23}, @NFTA_SET_EXPR={0x20, 0x11, 0x0, 0x1, @connlimit={{0xe}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_CONNLIMIT_COUNT={0x8}]}}}]}], {0x14, 0x10}}, 0xa4}}, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000004c0)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x4, {{@in=@multicast2, @in, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x87}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ffffffffffffffd, 0xfffffffffffffffb}, {0x0, 0x0, 0x200000000000000}, 0x800, 0x0, 0x0, 0x0, 0x2}}, 0xb8}}, 0x0) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000000)={0x1, 0x2, &(0x7f00000000c0)=ANY=[@ANYBLOB="61106f000000000095"], &(0x7f0000000200)='GPL\x00'}, 0x94) sendmsg$nl_xfrm(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="b8000000190001000000000000000000e00000020000000000000000000000000000000000000000000000000000000000000000000000000a00000029000000", @ANYRES32=0x0, @ANYRES8=r0, @ANYRES64=r3], 0xb8}}, 0x4004) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) socket$nl_xfrm(0x10, 0x3, 0x6) socket$nl_xfrm(0x10, 0x3, 0x6) r5 = epoll_create1(0x80000) epoll_ctl$EPOLL_CTL_ADD(r5, 0x1, r1, &(0x7f0000000380)={0x10}) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=@updpolicy={0xfc, 0x19, 0x1, 0x0, 0x0, {{@in6=@rand_addr=' \x01\x00', @in=@local, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0xa9, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0xa00, 0x40800000000000, 0x800000000000000}}, [@tmpl={0x44, 0x5, [{{@in=@local, 0x0, 0x3c}, 0x0, @in=@broadcast, 0x0, 0x0, 0x3}]}]}, 0xfc}}, 0x0) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NFC_CMD_GET_TARGET(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x14, 0x0, 0x4}, 0x14}}, 0x0) syz_genetlink_get_family_id$nfc(&(0x7f0000000140), r6) r7 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000300), r6) sendmsg$NL802154_CMD_NEW_INTERFACE(r6, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000600)=ANY=[@ANYRESHEX=r6, @ANYRES16=r7, @ANYRES32=r5, @ANYRES32, @ANYRESDEC=r5], 0x30}}, 0x0) r8 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000100)={0x1f, 0x3, &(0x7f0000000000)=ANY=[@ANYBLOB="1800000000490000000000000000000095"], &(0x7f0000000240)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x11}, 0x94) ioctl$IOCTL_GET_NCIDEV_IDX(0xffffffffffffffff, 0x0, &(0x7f0000000300)=0x0) connect$nfc_raw(0xffffffffffffffff, &(0x7f0000000340)={0x27, r9, 0x0, 0x6}, 0x10) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000001c0)={r8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f00000008c0)="89", 0x0}, 0x50) 1.395557706s ago: executing program 8 (id=11776): sendmsg$NL80211_CMD_REGISTER_BEACONS(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16, @ANYBLOB='\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\b'], 0x28}}, 0x0) r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0xfffffffffffffdbc, &(0x7f0000000080)=[{&(0x7f0000000040)="800100006a00f96b1324", 0x18}], 0x1}, 0x4080) 1.394968411s ago: executing program 6 (id=11777): syz_genetlink_get_family_id$wireguard(&(0x7f0000000040), 0xffffffffffffffff) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000040), 0x52) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000001140)={&(0x7f00000002c0)=@newlink={0x54, 0x10, 0x503, 0x70bd29, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x6230}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @vxcan={{0xa}, {0x18, 0x2, 0x0, 0x1, @val={0x14, 0x1, {{0x0, 0x0, 0x0, 0x0, 0x21400}}}}}}, @IFLA_ADDRESS={0xa, 0x3, @random="3a712f0756b8"}]}, 0x54}}, 0x0) 1.3192959s ago: executing program 8 (id=11778): socket$nl_route(0x10, 0x3, 0x0) bpf$ENABLE_STATS(0x20, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) socket$netlink(0x10, 0x3, 0x0) socket(0x10, 0x803, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket(0x1, 0x803, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket(0x1, 0x803, 0x0) socket$packet(0x11, 0x3, 0x300) socket(0x10, 0x803, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0xd, 0x3, &(0x7f0000000000)=@framed, 0x0, 0x4}, 0x94) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_COALESCE_SET(r1, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000180)=ANY=[@ANYBLOB='\\\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010000000000000000001400000008000a00fc00000018000180140002006e657464657673696d300000000000000800050000fcffff08000700fc000000080011000700000008000e00800000000800", @ANYRES16=r0], 0x5c}, 0x1, 0x0, 0x0, 0x800}, 0x0) 1.318558709s ago: executing program 3 (id=11779): r0 = socket$kcm(0x2, 0x2, 0x73) bind$inet(r0, &(0x7f00000000c0)={0x2, 0x2710, @multicast2}, 0x10) 1.231288803s ago: executing program 8 (id=11780): r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000000)='blkio.throttle.io_service_bytes\x00', 0x0, 0x0) syz_emit_ethernet(0x4e, &(0x7f00000000c0)=ANY=[@ANYBLOB="ffffffffffffaaaaaaaaaaaa86dd6087fb7e00000000fe880000000000000000000000000001fc0200000000000000000000000000000002000000000000040100010100c204"], 0x0) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0xb, &(0x7f00000005c0)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000730000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095000000000000002d55715f11e961d1fde85cda4c8aae3a0c64e30cd8655910b3eb2d1451a6bf4b04dc0af703f4c87963ba1424815f140290fb3f659193ae297fdcd50b6dc8d41d9568a55e58cc6514e272e53a081168e74d7189f0e655f66e08f0e108968d80ea3cac636aa60bea16f5e27d5761f66d99ca89ad8cf4e13a2013988c4222d7cf1ff8682043d3d6f16b20de6f1ea6691dcee8e86fa2109aa7898fe15f2c973463c482db5da9926d158ee55592221796e273ccf22a74e8dd3674739087015098b80e9842e82aa484b0047773b358f02338ba5950707984fb201d101bfd1f78b0ea4f397c22d94b5a34491cf3f671af9dacdf409cc1f8d960358d99d506f9b3f52ce15d0cf72083819b4a3a6dfe62b510150dfe25ef1caf21e26954118b0c2dea8b744bed8de035a056fa2d0f7370b9df062c204e070015c5c544f5c74625ea73c563000000c1fcb5a25271"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x22}, 0x44) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000340)='kfree\x00', r2}, 0x10) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000002100), 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x8, &(0x7f0000000000)=@framed={{}, [@tail_call={{0x18, 0x2, 0x1, 0x0, r3}}]}, &(0x7f0000000640)='syzkaller\x00', 0x7, 0xf9, &(0x7f0000000080)=""/249}, 0x70) bind$ax25(r1, &(0x7f0000000d80)={{0x3, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}}, [@null, @default, @null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}]}, 0x48) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000180)={'tunl0\x00', &(0x7f0000000480)={'syztnl1\x00', 0x0, 0x7800, 0x80, 0x2, 0x5, {{0x32, 0x4, 0x2, 0x8, 0xc8, 0x67, 0x0, 0xfa, 0x4, 0x0, @remote, @rand_addr=0x64010102, {[@lsrr={0x83, 0x23, 0xeb, [@remote, @multicast1, @broadcast, @multicast2, @dev={0xac, 0x14, 0x14, 0x36}, @loopback, @local, @dev={0xac, 0x14, 0x14, 0x10}]}, @lsrr={0x83, 0x1b, 0x9d, [@local, @local, @private=0xa010101, @rand_addr=0x64010101, @broadcast, @loopback]}, @timestamp_addr={0x44, 0x1c, 0xe9, 0x1, 0xd, [{@initdev={0xac, 0x1e, 0x0, 0x0}, 0x7f}, {@multicast1, 0x7}, {@dev={0xac, 0x14, 0x14, 0x40}, 0x5}]}, @ra={0x94, 0x4}, @noop, @ssrr={0x89, 0xf, 0xf7, [@multicast2, @broadcast, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}, @cipso={0x86, 0x41, 0x3, [{0x6, 0x7, "cb8c972ae9"}, {0x5, 0x9, "48bb8e1ee8acfb"}, {0x0, 0x9, "d00f6c9faa6abb"}, {0x1, 0xc, "e8a59ae576bff9564c28"}, {0x1, 0x5, "cf94e7"}, {0x1, 0x6, "731869ee"}, {0x0, 0xb, "6eea2ef9347c22a1e9"}]}]}}}}}) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000840)={0xffffffffffffffff, 0xe0, &(0x7f00000006c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, &(0x7f0000000200)=[0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x7, 0x1, &(0x7f0000000280)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000580)=[0x0], 0x0, 0x34, &(0x7f00000005c0)=[{}, {}, {}, {}, {}], 0x28, 0x10, &(0x7f0000000600), &(0x7f0000000640), 0x8, 0xe7, 0x8, 0x8, &(0x7f0000000680)}}, 0x10) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000b80)={0x11, 0x13, &(0x7f0000000880)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [@call={0x85, 0x0, 0x0, 0xbf}, @alu={0x4, 0x0, 0xd, 0x2, 0x4, 0x2, 0xffffffffffffffff}, @map_idx_val={0x18, 0x9, 0x6, 0x0, 0xf, 0x0, 0x0, 0x0, 0x4}], {{}, {}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000940)='GPL\x00', 0x0, 0xd6, &(0x7f0000000980)=""/214, 0x40f00, 0x20, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000a80)={0x4, 0x9, 0x5}, 0x10, 0x0, 0x0, 0x5, &(0x7f0000000ac0)=[r0, r0, r0], &(0x7f0000000b00)=[{0x0, 0x1, 0xa, 0x5}, {0x5, 0x3, 0x2, 0x9}, {0x2, 0x1, 0xb, 0x5}, {0x3, 0x3, 0x0, 0xc}, {0x3, 0x3, 0xe, 0x84750d185be55a3}], 0x10, 0xfff}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000cc0)={0x16, 0xc, &(0x7f00000000c0)=@raw=[@printk={@i, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x4}}, @ringbuf_query={{0x18, 0x1, 0x1, 0x0, r1}}], &(0x7f0000000140)='syzkaller\x00', 0x2, 0xd0, &(0x7f0000000380)=""/208, 0x0, 0xf, '\x00', r4, @fallback, 0xffffffffffffffff, 0x8, &(0x7f00000001c0)={0x0, 0x1}, 0x8, 0x10, 0x0, 0x0, r5, r6, 0x3, &(0x7f0000000c40)=[r0], &(0x7f0000000c80)=[{0x2, 0x5, 0xa, 0x2}, {0x3, 0x4, 0x7, 0xb}, {0x1, 0x1, 0x1, 0xc}], 0x10, 0x8}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x15, 0x10, &(0x7f0000000040)=ANY=[@ANYBLOB="1800000000000000000000000800000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000014000000b70300000000000085000000a0000000bf090000000000005509010000030000950000000000000085100000f5ffffffbf91000000000000b7020000000000008500000084000000b70000000000000095"], &(0x7f0000000240)='syzkaller\x00', 0x9, 0x0, 0x0, 0x0, 0x2d, '\x00', 0x0, @sk_reuseport, 0x0, 0x8300, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) 1.200602212s ago: executing program 3 (id=11781): setsockopt$inet6_IPV6_HOPOPTS(0xffffffffffffffff, 0x29, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="8712000000000000c91020010000000000000000000000000001c2040000000605020005017774823f8fd8324b7eb0edb41eed03e1ea09d016eddeea087b0d357591f5f3dbf3e05b01007f57f2b1a01bb55fc9c4577df622a42245d37ede3caec2"], 0xa0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="68000000100001002fbd7000fddbdf2500000000", @ANYRES32, @ANYBLOB="0201000000000000140003006e657464657673696d3000000000000034001680300001802c"], 0x68}}, 0x24040800) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x19, 0x4, 0x4, 0x2, 0x0, 0x1}, 0x48) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f00000000c0)={r0, &(0x7f0000000300)='M', &(0x7f0000000000)=""/10, 0x2}, 0x20) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000100)={r0, &(0x7f00000001c0)='M', 0x0}, 0x20) syz_emit_ethernet(0x6e, &(0x7f0000000040)=ANY=[@ANYBLOB="0180c2000002aaaaaaaaaaaa08004500006000000000002f9078640101000000000024806558000000000000000010000800000086dd"], 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)=@newtaction={0x7c, 0x30, 0x871a15abc695fb3d, 0x0, 0x0, {}, [{0x68, 0x1, [@m_tunnel_key={0x64, 0x1, 0x0, 0x0, {{0xf}, {0x34, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_PARMS={0x1c, 0x2, {{0x3, 0x5, 0x0, 0x5cc7, 0x8}, 0x1}}, @TCA_TUNNEL_KEY_ENC_IPV6_SRC={0x14, 0xb, @loopback={0x400000004000300}}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x7c}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) r1 = socket$kcm(0x10, 0x2, 0x10) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r3 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000000280)={'syzkaller1\x00', @link_local}) r4 = socket$inet(0x2, 0x1, 0x100) listen(r4, 0x9) listen(r4, 0x0) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000140)={0x0}, &(0x7f0000000180)=0xc) ioctl$sock_FIOSETOWN(r1, 0x8901, &(0x7f0000000340)=r5) socket$nl_netfilter(0x10, 0x3, 0xc) syz_80211_inject_frame(&(0x7f0000000000), 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000040)={0x5, 0x0, 0x0, &(0x7f0000000240)='GPL\x00', 0x80040005, 0x0, 0x0, 0x41100, 0x18}, 0x94) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wlan0\x00'}) r6 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl(r6, 0x8b1a, &(0x7f0000000040)) sendmsg$DEVLINK_CMD_TRAP_POLICER_SET(0xffffffffffffffff, 0x0, 0x40) r7 = socket$nl_generic(0x10, 0x3, 0x10) getsockopt$inet_sctp6_SCTP_STATUS(0xffffffffffffffff, 0x84, 0xe, 0x0, 0x0) setsockopt$inet_sctp_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, 0x0) syz_genetlink_get_family_id$tipc(0x0, 0xffffffffffffffff) sendmsg$TIPC_CMD_SET_LINK_WINDOW(r7, 0x0, 0x0) getsockopt$SO_COOKIE(0xffffffffffffffff, 0x1, 0x10, &(0x7f0000000100), &(0x7f0000000240)=0x8) 1.146677651s ago: executing program 6 (id=11783): clock_gettime(0x0, &(0x7f00000001c0)={0x0, 0x0}) setsockopt$sock_timeval(0xffffffffffffffff, 0x1, 0x14, &(0x7f0000000240)={r0, r1/1000+10000}, 0x10) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) r3 = socket(0x10, 0x3, 0x0) sendmsg$nl_generic(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="b40000001900010000000000000000001d0109004d0011809ed61b77d9f16a96c594a1835eb265ba7f20e413597129961ed189d63c3391c4854d66a1452ed6b21900c796c4fb58a76f04811e8a7bda7af3bdb21fcab2d6ca22909ed50d079f0b710000004d0012803b6f2811032d68bea0612044f47c2842b277eb4bc53070416c6050e46d2e0d055c97c9e7f9bf0bafe4af56eba9024644942e3645a3e6db0d1191744909497df00d71a338c0c6a42d17"], 0xb4}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=@newqdisc={0xbc, 0x24, 0x0, 0x0, 0x0, {0x0, 0x0, 0x12, 0x0, {0x0, 0xffe0}, {0x0, 0xfff1}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x8c, 0x2, [@TCA_TAPRIO_ATTR_PRIOMAP={0x56, 0x1, {0x2, [0x2, 0x0, 0xf, 0xff, 0x0, 0x3, 0xb, 0x3, 0x0, 0x0, 0x0, 0x0, 0xfd, 0xf4, 0x2], 0x1, [0x1, 0x0, 0x0, 0x0, 0x0, 0x3, 0xd52, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffc]}}, @TCA_TAPRIO_ATTR_SCHED_ENTRY_LIST={0x30, 0xc, 0x0, 0x1, [{0x2c, 0x1, 0x0, 0x1, [@TCA_TAPRIO_SCHED_ENTRY_GATE_MASK={0x8}, @TCA_TAPRIO_SCHED_ENTRY_CMD={0x5}, @TCA_TAPRIO_SCHED_ENTRY_CMD={0x5}, @TCA_TAPRIO_SCHED_ENTRY_GATE_MASK={0x8, 0x3, 0x9}, @TCA_TAPRIO_SCHED_ENTRY_INTERVAL={0x8, 0x4, 0x9}]}]}]}}]}, 0xbc}, 0x1, 0x0, 0x0, 0x4040000}, 0x0) r4 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000340)={'bridge0\x00', 0x0}) r6 = socket(0x10, 0x80002, 0x0) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="440000001300290a000000000000000007000000", @ANYRES32=r5, @ANYBLOB="00000000000000001c001a800800028004000500080000003e"], 0x44}}, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r7 = socket(0x400000000010, 0x3, 0x0) r8 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r10 = syz_init_net_socket$ax25(0x3, 0x2, 0x0) bind$ax25(r10, &(0x7f0000000080)={{0x3, @default, 0x4}, [@null, @null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}]}, 0x48) writev(r10, &(0x7f0000000300)=[{&(0x7f0000000880)="94b2", 0x2}], 0x1) sendmsg$nl_route_sched(r7, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000380)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r9, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xf}}, [@qdisc_kind_options=@q_fq={{0x7}, {0xc, 0x2, [@TCA_FQ_QUANTUM={0x8, 0x3, 0x7331c94b}]}}]}, 0x38}}, 0x0) r11 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r12 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r12, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) r14 = socket$nl_generic(0x10, 0x3, 0x10) r15 = syz_genetlink_get_family_id$batadv(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_HARDIF(r14, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000180)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r15, @ANYBLOB="11072abd7000ffdbdf2505"], 0x1c}, 0x1, 0x0, 0x0, 0x28008000}, 0x40000) r16 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_DEL(r16, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=ANY=[@ANYBLOB="840000000a0601010000000000000000010000000900020073797a310000000005000100070000000800094000000008540008"], 0x84}}, 0x0) sendmsg$nl_route(r12, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="280000001c00010429bd7000ffdbdf2507000000", @ANYRES32=r13, @ANYBLOB="e0ff8b0a0a0002"], 0x28}, 0x1, 0x0, 0x0, 0x1}, 0x24040040) sendmsg$nl_route(r12, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="300000001d"], 0x30}, 0x1, 0x0, 0x0, 0x1}, 0xc31fe084736598c) setsockopt$IP_VS_SO_SET_ADD(r11, 0x0, 0x482, &(0x7f0000000000)={0x3c, @private=0xa010102, 0x4e22, 0x0, 'none\x00', 0x3b, 0x81, 0x4e}, 0x2c) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0xd, &(0x7f0000000280)=@req3={0x8, 0x401, 0x3, 0x0, 0xd, 0x1, 0x4}, 0x1c) 1.091452489s ago: executing program 8 (id=11784): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='blkio.throttle.io_serviced_recursive\x00', 0x26e1, 0x0) close(r0) syz_emit_ethernet(0x52, &(0x7f0000000280)={@local, @remote, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "8a37f2", 0x1c, 0x2c, 0x0, @remote, @local, {[], {{0x600, 0x3, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}, {"5e4cd36bb96bd2b9"}}}}}}}, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r0, 0x8b26, &(0x7f0000000080)={'wlan1\x00', @random="0911008d0c00"}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd26, 0xffffffff, {0x0, 0x0, 0x0, r6, {0x0, 0xfff3}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_USC={0x10, 0x3, {0x6, 0x400, 0x33}}}}]}, 0x44}}, 0x20040084) sendmsg$nl_route_sched(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000b00)=@newqdisc={0x44, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffdfdfc, {0x0, 0x0, 0x0, r6, {}, {0xffff, 0xffff}, {0x2, 0xfff2}}, [@qdisc_kind_options=@q_gred={{0x9}, {0x14, 0x2, [@TCA_GRED_DPS={0x10, 0x3, {0x0, 0xc, 0x1, 0x3}}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x400dc}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000003c0)=@newnexthop={0xa8, 0x68, 0x2, 0x70bd29, 0x25dfdbfb, {0x0, 0x0, 0x2, 0x0, 0x8}, [@NHA_ENCAP={0x18, 0x8, 0x0, 0x1, @LWTUNNEL_IP6_SRC={0x14, 0x3, @ipv4={'\x00', '\xff\xff', @multicast2}}}, @NHA_BLACKHOLE={0x4}, @NHA_OIF={0x8, 0x5, r6}, @NHA_GROUP={0x4c, 0x2, [{0x0, 0x7f}, {0x0, 0x3}, {0x2, 0xd}, {0x0, 0x5}, {0x2, 0x81}, {0x2, 0x7}, {0x80000001, 0x3}, {0x0, 0x4c}, {0x2, 0x2}]}, @NHA_ID={0x8, 0x1, 0x2}, @NHA_BLACKHOLE={0x4}, @NHA_FDB={0x4}, @NHA_FDB={0x4}, @NHA_GROUP={0xc, 0x2, [{0x0, 0x8}]}]}, 0xa8}}, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(r7, 0x107, 0xd, &(0x7f0000000040)=@req={0x3, 0x0, 0x0, 0x6}, 0x10) setsockopt$packet_tx_ring(r7, 0x107, 0xd, &(0x7f0000000180)=@req={0x0, 0xff}, 0x10) ioctl$FS_IOC_GETFSUUID(r1, 0x80111500, &(0x7f0000000340)) r8 = socket$kcm(0x29, 0x2, 0x0) sendmsg$AUDIT_USER_AVC(r0, &(0x7f0000000300)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000140)={&(0x7f00000001c0)={0xa0, 0x453, 0x400, 0x70bd2d, 0x25dfdbfc, "cfcb8cad50231aa333cdd3a92e884ca603f4df8bd7412b62a4193497abfcddc342a1eaa537c8e05ba5eab72d0b385876753ab80727eacba028f1167bcf6ce785ebc3a47370b5aa3a2e9953aa5d8a065fb8f37db3e6e2c16b18c0eade4fccb970ad0bc90d8343e3b8fe863e2cc5894a02e3496b61c735bc1a209dcca00b6dfdfbbeaa23ec02cea4f94342f5d1d7", ["", "", "", "", "", ""]}, 0xa0}, 0x1, 0x0, 0x0, 0x20004020}, 0x40001) r9 = socket$inet_mptcp(0x2, 0x1, 0x106) sendto$inet(r9, 0x0, 0x0, 0x200040d1, &(0x7f0000000100)={0x2, 0x4e21, @local}, 0x10) bind$inet(r9, 0x0, 0x0) ioctl$sock_kcm_SIOCKCMUNATTACH(r8, 0x89e1, &(0x7f0000005140)) 926.663782ms ago: executing program 7 (id=11786): r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f0000000140)='^', 0x34000, 0x0, &(0x7f0000004ff0)={0x2, 0x0, @rand_addr=0xfffffffffffffffe}, 0x10) listen(r0, 0xfff) r1 = accept4(r0, 0x0, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_MAX_BURST(r1, 0x84, 0x14, &(0x7f00000001c0)=@int=0x5470, 0x4) 926.215108ms ago: executing program 6 (id=11787): socket$inet_sctp(0x2, 0x5, 0x84) socket$inet6_sctp(0xa, 0x1, 0x84) socket$inet_mptcp(0x2, 0x1, 0x106) socket(0x10, 0x80002, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) socket$xdp(0x2c, 0x3, 0x0) socket$xdp(0x2c, 0x3, 0x0) socket$netlink(0x10, 0x3, 0x400000000000004) r0 = socket$kcm(0xa, 0x922000000003, 0x11) r1 = socket$kcm(0x10, 0x2, 0x4) setsockopt$sock_attach_bpf(r0, 0x1, 0x3e, &(0x7f0000000100), 0x4) sendmsg$kcm(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="48000000150081fb7059ae08060c04000aff0f11000000040011018701546fabca1b4e7d06a6bd7c493872f750375ed08a562af5745e17b8c119418f0f000000d6e74703c48f93b8", 0x48}], 0x1}, 0x0) 925.659979ms ago: executing program 5 (id=11788): bpf$PROG_LOAD(0x85, &(0x7f00000054c0)={0x4, 0x16, &(0x7f0000000540)=ANY=[@ANYBLOB="611230000000000061135e0000000000bf2000000000000015000600071b48013d030100000000009500000000000000bc26000000000000bf67000000000000070300000fff07006702000003000000360600000ee600f0bf050000000000000f650000000000006507f4ff02000000070700004c0040001f75000000000000bf54000000000000070500000300f9ffad430100000000009500000000000000050000000000000095000000000000004d9bd591d568253e9988431ec068e3a83683d58719d72183f2cb7f43dd55788be820b236dcb695dbfd737cbf5fe7030586162c17600674290ca9d8d6413b8199e34f67ceaaa78710f9f8aba4765c91382f497585ca39c595b21afa6bce62b5ab0d44e9c32ad6f0349d92962a58d39494a19a9183362382792ac85578d3de07b7e155cf4ee5e3dd51212d2831bd8e2655b2fbd88791e4c66c832a774919b28b8a62711f0f156e636804e1d3f44a5ff3d63a3a51f0c7ec0c8c25e072194ddd83aa155a537e15c0d91f502deef03f83e826718705c9aef9613ac4a325a428d147c1749196e94226671fd9573ab0d079d44b13b56f793e98ab571c58e98e022f18a3be3f318e0690fff93f44f22473dc8004fc758218349bd3f0516a72a7ea913bfa7603063ed3118b2d680cbc"], &(0x7f0000000100)='GPL\x00'}, 0x48) 814.423905ms ago: executing program 6 (id=11789): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0), 0xffffffffffffffff) sendmsg$TIPC_NL_LINK_SET(r0, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="0106000000000000000009000000240004801300010062726e6b0000130007800800050000000000"], 0x38}}, 0x0) 795.040161ms ago: executing program 5 (id=11790): socket$nl_route(0x10, 0x3, 0x0) bpf$ENABLE_STATS(0x20, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) socket$netlink(0x10, 0x3, 0x0) socket(0x10, 0x803, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket(0x1, 0x803, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket(0x1, 0x803, 0x0) socket$packet(0x11, 0x3, 0x300) socket(0x10, 0x803, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0xd, 0x3, &(0x7f0000000000)=@framed, 0x0, 0x4}, 0x94) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_COALESCE_SET(r1, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000180)=ANY=[@ANYBLOB='\\\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010000000000000000001400000008000a00fc00000018000180140002006e657464657673696d300000000000000800050000fcffff08000700fc000000080011000700000008000e00800000000800", @ANYRES16=r0], 0x5c}, 0x1, 0x0, 0x0, 0x800}, 0x0) 683.692612ms ago: executing program 8 (id=11791): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001800), 0xffffffffffffffff) r2 = socket$nl_rdma(0x10, 0x3, 0x14) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000001500)=ANY=[@ANYRESHEX=r4, @ANYRES8=r3, @ANYRESDEC=r1, @ANYRES32=r3, @ANYBLOB="0900050003000000b76b8d633c5409e7f27b39ecb2e9d966a8913dcb4032fbcb3359ca9a2852755f2a6e0b666e0bf4c8f564f2b8945cf81dec5ac06fd2b7134ee75237333583"], 0x24}}, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000012c0)=ANY=[@ANYBLOB="18000000240001"], 0x18}, 0x1, 0x0, 0x0, 0x1}, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), r5) recvmmsg(r5, &(0x7f0000004ec0)=[{{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000002c0)=""/4077, 0xfed}], 0x1}, 0x9}], 0x1, 0x2000, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0x8, &(0x7f0000000000)=ANY=[@ANYBLOB="1808000000000000000000000000000018120000", @ANYRES32, @ANYBLOB="00e2ff0000000000b70300000000fbff840000002f000000b7090000000000009500000000000000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmsg$kcm(0xffffffffffffffff, &(0x7f00000013c0)={0x0, 0x0, &(0x7f0000001780)=[{&(0x7f0000001380)="f717cf43be47a6ff20", 0x9}, {&(0x7f0000001400)="0888f5fde58dfcf261", 0x9}, {&(0x7f0000001440)="d65bceab3ca71e58d2005c54d8daa8f8f08372d7e13efcedd5fb06be7fba462950b5fd7341b596795a4b67522d5f044fe9d6cc0d850dec6cfaf40e3bd245a6ad9eef33ef686ce3819aa50f13aa79a8a3e4564e01c2000d48cd2651ad3078e3cc4592a7aa9988c44b0d50fdf9ce1a529f10cc8c5c2f844463a25c82dddd986c4a86450aa066b047bff41fdfcde69075cfe99e35b86c163bd8e743e4", 0x9b}, {&(0x7f0000001840)="521158bd4e2cb337ebc429e5149e75101bfa96677278662cbaa30a1cb356eafa6679f4fb1f0398802c2acbd9fd289a3d34ffa2fbab92e85e9b81a0d4ba43a1aa5b3d7331a5170053123bc034f3f79079f33e2717fcd313199cc1f2808afe91585757c443f47e0000000000000000000000000000c4699be89ea8bf9fb9c05a068f53d65adc0c98a54886b087d06c40d87121b4f6b9592b392259647bdd45dec1207ff0e04a4fffc1e8450c2c4dd43342f1a21fa6c326231af630f3b84a5e86bb9ac532b0bb70e85cbce20a8ef572709145310715a779d8fefa4874ec8b1e610fe8144c7b2ccd2cc9097e70720ad36746cb2dae92a39654cafafabb9a934460c9407f68114c749b7769ca73bf", 0x10c}, {&(0x7f0000001580)="99486326057b9fbd2958b47fff032224657795b21d3d01bca4f6a5a99727cee9bf2d02a71f4bbe565087662286008e08e88feb7d1d8df2ce1e3c2497cef40a773cc217484ec70d22f08306c1a33d03ba97cb38774974c6fcf28f36f16ba71983eeaf1ee45f2a3e63f67a4b6616f3b0ee8f12110633a2334ecc35aee5b5c9ef283d69cf5fb0bb3f359ece072c7cb17ea6987e9a95a8d31d51adc8042a627864892e55b4e9a10a3cf90e029c50d4d1e8e1d50a3db23a28b57a7e27e8e40a386c68b854738236f6c1ec9ff1808fb12fd263d0d85cd56e88923c427d", 0xda}, {&(0x7f0000001680)="e46d5cc187a1bbcecac855261d8e47e1c5b64235ff9360b6ccee1a1a4fa93d23451edd2858d662d9cdc9fca600a32ba6f6f02b57f58faf2152bcf8ca871ed3114cdb1b0d504a53c81454d1ff62fea626c6c2391480f5faa56dd1c1fd50a818b4900817fee574797a10ee07eaba137f657a31b296959518a5a2a0e7cae8738a337b1f41b785a1347e07f480431ce0ecefdee9ce1a68096a4bb2579e67456321332378bedbfc0c06146e7579f47ad39d19a4315b0bbe04756fc465b8de41b35e7a7d747fb4e04bc0e6550496347a0d96d10d12ed4d796305e69ad9574cae1269dd", 0xe0}], 0x6}, 0x801) r6 = socket$kcm(0x10, 0x2, 0x0) write$cgroup_subtree(r6, &(0x7f0000000000)=ANY=[@ANYBLOB="563f00001900599c6d0e000091d028ef8020ab0700040005"], 0xfe33) sendmsg$netlink(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)=[{0x0, 0x114}], 0x1}, 0x80) r7 = socket(0x28, 0x5, 0x0) r8 = socket(0x28, 0x5, 0x0) bind$vsock_stream(r8, &(0x7f0000000040)={0x28, 0x0, 0x0, @local}, 0x10) listen(r8, 0x4) connect$vsock_stream(r7, &(0x7f0000000080)={0x28, 0x0, 0x0, @local}, 0x10) sendmmsg(r7, &(0x7f0000000100)=[{{0x0, 0x2d, &(0x7f00000000c0)=[{&(0x7f0000000000)="1b", 0x40000}], 0x1}}], 0x51, 0x0) r9 = accept4$unix(r8, 0x0, 0x0, 0x800) recvfrom$unix(r9, &(0x7f0000000140)=""/248, 0xf8, 0x40, 0x0, 0x0) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)=ANY=[@ANYBLOB="740000fe", @ANYRES16=r1, @ANYBLOB="050000000000000000000f00000008000300", @ANYRES32=r3, @ANYBLOB="28000e0080000000ffffffffffff0802110000000802110000000000000000000000000064000100080026006c09000008000c006400000008000d00000000000a0034000202020202020000080035000000000004000501"], 0x74}}, 0x0) r10 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r10, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10) setsockopt$inet_int(r10, 0x0, 0x8, &(0x7f00000000c0)=0x7, 0x4) r11 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000200)=ANY=[@ANYBLOB="1800000002000000000000000008082295"], &(0x7f00000000c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100}, 0x94) syz_emit_ethernet(0x2a, &(0x7f0000000000)=ANY=[@ANYBLOB="aaaaaaaaaa622d06000000aa08004500101c523c7ce611907800000000e000000100004e2000089078"], 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r11, 0x5, 0x1, 0x0, &(0x7f0000001300)="ff", 0x0, 0x149d, 0x503, 0x0, 0x0, 0x0, 0x0, 0x2, 0xffff80fe}, 0x50) 683.157667ms ago: executing program 5 (id=11792): r0 = gettid() r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000240)=ANY=[@ANYBLOB="1c00000046000701fcffffff02000000017c000008000100", @ANYRES32=r0], 0x1c}, 0x1, 0x0, 0x0, 0x488c4}, 0xc000) (fail_nth: 4) 629.132281ms ago: executing program 6 (id=11793): pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) close(r0) write$cgroup_subtree(r1, &(0x7f0000000040), 0xfffffc3f) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x20000800}, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000ff0000000000000a58000000060a0b040000000000000000020000002c0004802800018007000100637400001c000280050003001b000000080002400000001108000440000000040900010073797a30000000000900020073797a32"], 0x80}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=@newlink={0x44, 0x10, 0x403, 0x0, 0x0, {0x0, 0x0, 0x74}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @bond={{0x9}, {0x14, 0x2, 0x0, 0x1, [@IFLA_BOND_LP_INTERVAL={0x8, 0x13, 0x3}, @IFLA_BOND_PACKETS_PER_SLAVE={0x8}]}}}]}, 0x44}}, 0x0) 287.414235ms ago: executing program 5 (id=11794): socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0100000005000000090000008b"], 0x48) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) close(0x3) socket$inet_icmp_raw(0x2, 0x3, 0x1) socket$packet(0x11, 0x3, 0x300) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0e000000040000000800000005"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f00000001c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bc82000000000000a6020000f8ffffffb703000008000000cd03000000000000850000003300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp=0xedf0e51957efc755, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000080)={{r0}, &(0x7f0000000240), &(0x7f0000000380)=r1}, 0x20) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={r1, 0x18000000000002a0, 0x5ee, 0x0, &(0x7f0000000580)="b9ff03076804268c989e14f088a8", 0x0, 0x500, 0x60000000, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) syz_extract_tcp_res$synack(0x0, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000240)={'bridge_slave_1\x00'}) 239.114527ms ago: executing program 3 (id=11795): r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x15, 0x20, &(0x7f0000000040)=ANY=[@ANYBLOB="1800000000000000000000000800000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000014000000b70300000000000085000000a0000000bf090000000000005509010000030000950000000000000085100000f5ffffffbf91000000000000b7020000000000008500000084000000b70000000000000095"], &(0x7f0000000240)='syzkaller\x00', 0x9, 0x0, 0x0, 0x0, 0x2d, '\x00', 0x0, @sk_reuseport, 0x0, 0x8300, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) 186.982797ms ago: executing program 6 (id=11796): r0 = socket$inet6(0xa, 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r2 = socket(0x400000000010, 0x3, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r5 = socket(0x400000000010, 0x3, 0x0) r6 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000740)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x70bd29, 0xffffffff, {0x0, 0x0, 0x0, r7, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xc, 0xf}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x7, 0x0, 0x10001, 0xffff, 0x5, 0x5, 0xfec8, 0x5, 0x7f}}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x8001}, 0x20008850) sendmsg$nl_route_sched(r2, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000027c0)=@newtfilter={0x8b0, 0x2c, 0xd27, 0x30bd29, 0x25dfdc00, {0x0, 0x0, 0x0, r4, {0x5, 0x4}, {}, {0x8}}, [@filter_kind_options=@f_matchall={{0xd}, {0x87c, 0x2, [@TCA_MATCHALL_ACT={0x878, 0x2, [@m_police={0x874, 0x1, 0x0, 0x0, {{0xb}, {0x848, 0x2, 0x0, 0x1, [[@TCA_POLICE_RATE={0x404, 0x2, [0x1ff, 0x3, 0x10000, 0x81, 0x7f, 0xfffffffd, 0x4, 0x2, 0x4, 0x5, 0x2234, 0x83, 0x81b, 0x800, 0x8, 0x0, 0x3, 0x7ed53619, 0x1, 0x2, 0x9644, 0x800004, 0x58b, 0x85a, 0x3fc, 0x46, 0x2, 0x1, 0x0, 0x80000000, 0x10001, 0x790, 0x5, 0x1, 0xfffffff9, 0x1a77, 0x9, 0x3, 0x400, 0x63c, 0x4, 0xffffffff, 0x1, 0x3, 0x1, 0x5b1f, 0x7b0, 0x7, 0x100, 0x6, 0xd, 0xff, 0x3, 0x10000, 0x6, 0x6b7, 0x1ff, 0x80, 0x4, 0x7, 0x3, 0xa14, 0x3, 0x5, 0x80000000, 0x81, 0x7, 0x8, 0x5, 0x10001, 0xf7, 0x3, 0xfffffff9, 0x9, 0x4, 0x8, 0xfff, 0x3, 0xfffffffd, 0x9, 0x7, 0x8, 0x100, 0xc0000000, 0x6, 0x6, 0x6, 0x408, 0x80000001, 0x8, 0x1d24, 0x2, 0x7, 0xfffffffe, 0x7f, 0x6, 0x9, 0xff, 0x24, 0x5, 0xb, 0x6, 0x10007a, 0x8, 0x0, 0x7, 0x470, 0x7f, 0x6, 0x0, 0x1, 0x0, 0x4, 0x9, 0x61, 0x200, 0x6, 0x2, 0x2, 0x6, 0x10001, 0x8, 0x7, 0xf, 0xda56, 0x7ffffffe, 0x80, 0x2f0cb955, 0x7, 0xfed, 0xf, 0x6ae, 0x9, 0x1, 0x9, 0x8001, 0x0, 0xec000, 0x0, 0x1, 0x2, 0xfffffffb, 0x7, 0x8, 0x4, 0x1, 0xffffcf1b, 0x282, 0x5517bc7b, 0x3, 0x4, 0xb6b, 0x5, 0xf7800000, 0xac, 0x9, 0x3, 0x10, 0x9, 0x8, 0x80000001, 0x0, 0x74, 0x2, 0x7fffffff, 0x0, 0xa, 0x6, 0xffffffff, 0x8, 0x2, 0x7, 0x7f, 0x5, 0x3, 0x10000a, 0x1, 0x0, 0x9, 0x300, 0x6, 0x3, 0x6, 0xffffffff, 0xffb, 0xff, 0x5, 0x8, 0x3, 0x2, 0x5, 0xfca, 0x399d, 0x6, 0x8ab6, 0x18000, 0x2, 0xfffffff9, 0x2, 0x2, 0x7fffffff, 0x5, 0x200, 0xac, 0xf, 0xd05, 0x9a2ce73, 0x4, 0x6, 0xe074, 0x6b10, 0x5, 0x1, 0x6, 0xb, 0xa26, 0xaf6, 0x0, 0xec, 0x8, 0xde16, 0xc418, 0xffffffff, 0xffffffff, 0x9, 0x400, 0x80001, 0x5, 0x354d, 0x5, 0x2, 0x1, 0x7, 0x0, 0x67f5, 0x7, 0x0, 0x80, 0x5, 0x8, 0xfffffffb, 0x9, 0xe7b, 0x0, 0x7, 0x42bf, 0x10000, 0x9, 0xc, 0x6, 0x4b75, 0x80000001, 0x1000, 0x5915, 0x10001, 0x1]}], [@TCA_POLICE_PEAKRATE={0x404, 0x3, [0x107e, 0x4, 0xec2, 0x6, 0x8, 0x400, 0x5, 0x1, 0x7, 0x470, 0x487, 0x100, 0xa99, 0xfffffeff, 0x100005, 0x37f, 0x8, 0x6, 0x3, 0x3, 0x800, 0xd2f5, 0x40, 0x3, 0x4, 0x5, 0x7, 0x12, 0x2, 0x8, 0x101, 0xffffffff, 0x2, 0x10000, 0xa6, 0x3, 0x10000, 0x1000, 0x4, 0x0, 0x3, 0x0, 0xd, 0x6, 0x98, 0x8, 0x6, 0x9, 0x1000, 0xb3000, 0xf, 0x3, 0x9, 0xb4, 0x94d, 0x9, 0x8, 0xc, 0x100, 0xec0, 0xffff, 0x4, 0x2, 0x3ff, 0x3e, 0xb828, 0x0, 0x0, 0x365, 0x8, 0x8, 0xf, 0x1, 0xfffffffe, 0xfffffff6, 0x93, 0x7fff, 0x92, 0x0, 0x7, 0xfffffffc, 0x7ff, 0x9, 0x8, 0x0, 0x2, 0x8, 0xffffff37, 0x3, 0x9, 0xc, 0xff, 0x3, 0x3, 0x400, 0x100000, 0x7f, 0x2, 0x8, 0x4, 0x7, 0x4, 0x7, 0xfffffffa, 0x101, 0xadd9, 0x1, 0x0, 0x7, 0x7fffffff, 0x40, 0x4, 0x0, 0x5, 0x4, 0x1, 0x8, 0x9, 0x6, 0x6, 0x2, 0xb, 0x3, 0x7f, 0xffff, 0x9, 0x1685, 0xa252, 0x2, 0x200, 0x3, 0x1, 0x400, 0xfffffffc, 0xfffffffc, 0x1000, 0x7ff, 0x5, 0x1f6, 0x751, 0x7, 0x40000000, 0x1, 0xffffdbb7, 0x50, 0xf, 0xf, 0xe, 0x3, 0x0, 0x81, 0xfff80000, 0x7a9, 0x1, 0x6, 0x3, 0x7ef8, 0x7, 0x5, 0x2, 0x0, 0x4e8, 0x80, 0x3, 0x8, 0x5, 0x2, 0x5, 0x7fff, 0x7, 0x8, 0x6a4941c5, 0x2ea567b4, 0x8, 0x80000000, 0x6, 0x40, 0x2, 0xfff, 0x8, 0x7, 0x1, 0x1, 0x0, 0x0, 0xd3bed341, 0x691f, 0x0, 0x2, 0x9, 0x6, 0x0, 0x1ff, 0x400003, 0x3, 0x6, 0x5fc8462f, 0x0, 0x100, 0xffff, 0xfffffffc, 0x5, 0x0, 0xb9a6, 0x522, 0x2, 0x2, 0x900, 0x8, 0xbb99, 0xb8000000, 0x8, 0xffffff01, 0xc0a1, 0x8, 0x8, 0x7, 0x59, 0x9, 0x2, 0x101, 0x5f502dc7, 0x7, 0x26, 0x4, 0x6, 0x80000001, 0x3, 0xffffff97, 0x2, 0x40, 0x1, 0x40, 0x8, 0x3, 0x710, 0x8, 0x1, 0xfffff339, 0x3, 0x8001, 0x1, 0x8001, 0x8, 0x8, 0xfffffffa, 0x8, 0x9, 0x3, 0xe, 0x10000, 0x9, 0xa, 0x6, 0xfffffff8]}, @TCA_POLICE_TBF={0x3c, 0x1, {0xfffffe00, 0x20000000, 0x5, 0x1, 0xdbec, {0x8, 0x0, 0xb55, 0x5, 0x7, 0x5}, {0x6, 0x2, 0xd, 0x5, 0x1, 0x5d17}, 0x2, 0x0, 0x6}}]]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x3}}}}]}]}}]}, 0x8b0}, 0x1, 0x0, 0x0, 0x10}, 0x40) r8 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r8) socket(0x2, 0x5, 0x0) ioctl$SIOCSIFHWADDR(r8, 0x8914, &(0x7f00000000c0)={'syzkaller0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) r9 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmmsg$inet(r0, &(0x7f00000017c0)=[{{&(0x7f0000000040)={0x2, 0x4e21, @local}, 0x10, 0x0, 0x0, &(0x7f00000006c0)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {r10, @dev={0xac, 0x14, 0x14, 0x41}, @empty}}}], 0x20}}], 0x27, 0x0) 186.726951ms ago: executing program 5 (id=11797): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=@newlink={0x44, 0x10, 0x403, 0x70bd2a, 0x0, {0x0, 0x0, 0x74}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x14, 0x2, 0x0, 0x1, [@IFLA_BR_VLAN_STATS_ENABLED={0x5, 0x29, 0x1}, @IFLA_BR_VLAN_DEFAULT_PVID={0x6, 0x27, 0x4}]}}}]}, 0x44}}, 0x0) ioctl$EXT4_IOC_CHECKPOINT(r1, 0x4004662b, &(0x7f0000000040)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, &(0x7f00000001c0)="a7d6b3b535654de425936abf0aadbed4a2269a6aec965eb38da82dc67f18e24bbf2db4757f0f4bc6b9daad00579a6cbe6055add4ed023566e742a6d05cef2a2f1543a5e834849ae2b4d3af3afcb11b2ef5e399e2356209f766ec398a2135a369918d6fa8e4d35a45fbff1b10f23bdbc78855f1deb39eef87a8685de7443cdea608eb05f8c953ef68e244888c0844", 0x8e) r3 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_RES_CM_ID_GET(r3, &(0x7f0000013c00)={0x0, 0x0, &(0x7f0000013bc0)={&(0x7f0000000000)=ANY=[@ANYBLOB="280000001b140100000000000d000000080004"], 0x28}, 0x1, 0x0, 0x0, 0x4855}, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000002c0)={'erspan0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f00000000c0)=@newlink={0x48, 0x10, 0xc3b, 0x0, 0x0, {0x0, 0x0, 0x0, r4, 0x19000, 0x2060}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @erspan={{0xb}, {0x4, 0x2, 0x0, 0x1, [@IFLA_GRE_ENCAP_DPORT={0x6, 0x11, 0x4e22}, @IFLA_GRE_ENCAP_SPORT={0x6}, @IFLA_GRE_COLLECT_METADATA={0x4}]}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x8054}, 0x1) 152.662979ms ago: executing program 5 (id=11798): r0 = socket$vsock_stream(0x28, 0x1, 0x0) (fail_nth: 5) getsockopt(r0, 0x28, 0x46, 0x0, &(0x7f0000000000)) 122.732263ms ago: executing program 3 (id=11799): socket$inet_sctp(0x2, 0x5, 0x84) socket$inet6_sctp(0xa, 0x1, 0x84) socket$inet_mptcp(0x2, 0x1, 0x106) socket(0x10, 0x80002, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) socket$xdp(0x2c, 0x3, 0x0) socket$xdp(0x2c, 0x3, 0x0) socket$netlink(0x10, 0x3, 0x400000000000004) r0 = socket$kcm(0xa, 0x922000000003, 0x11) r1 = socket$kcm(0x10, 0x2, 0x4) setsockopt$sock_attach_bpf(r0, 0x1, 0x3e, &(0x7f0000000100), 0x4) sendmsg$kcm(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="48000000150081fb7059ae08060c04000aff0f11000000040011018701546fabca1b4e7d06a6bd7c493872f750375ed08a562af5745e17b8c119418f0f000000d6e74703c48f93b8", 0x48}], 0x1}, 0x0) 0s ago: executing program 7 (id=11800): bpf$BPF_BTF_LOAD(0x12, &(0x7f00000004c0)={&(0x7f0000000600)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x18, 0x18, 0x2, [@array={0x0, 0x0, 0x0, 0xa, 0x0, {0x0, 0x1000000}}]}}, &(0x7f00000006c0)=""/184, 0x32, 0xb8, 0x1}, 0x20) (fail_nth: 5) kernel console output (not intermixed with test programs): er0: entered promiscuous mode [ 525.807130][T27693] syzkaller0: entered allmulticast mode [ 525.814619][T27695] tipc: Enabling of bearer rejected, already enabled [ 525.877077][T27693] tipc: Enabled bearer , priority 0 [ 525.887230][T27695] tipc: Resetting bearer [ 525.896236][T27692] tipc: Resetting bearer [ 525.924964][T27692] tipc: Disabling bearer [ 526.216000][T27710] syzkaller0: entered promiscuous mode [ 526.221817][T27710] syzkaller0: entered allmulticast mode [ 526.233573][T27712] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 526.264917][T27706] syzkaller0: entered promiscuous mode [ 526.270455][T27706] syzkaller0: entered allmulticast mode [ 526.467035][T27714] netlink: 'syz.4.9968': attribute type 1 has an invalid length. [ 526.508128][T27714] 8021q: adding VLAN 0 to HW filter on device bond3 [ 526.538903][T27714] 8021q: adding VLAN 0 to HW filter on device bond3 [ 526.546848][T27714] bond3: (slave vxcan5): The slave device specified does not support setting the MAC address [ 526.559067][T27714] bond3: (slave vxcan5): Error -95 calling set_mac_address [ 526.609988][T27720] veth15: entered promiscuous mode [ 526.621257][T27720] bond3: (slave veth15): Enslaving as an active interface with a down link [ 526.636669][T27718] mac80211_hwsim hwsim5 syzkaller0: entered promiscuous mode [ 526.645429][T27718] mac80211_hwsim hwsim5 syzkaller0: entered allmulticast mode [ 526.647968][T27714] netlink: 28 bytes leftover after parsing attributes in process `syz.4.9968'. [ 526.665459][T27714] 8021q: adding VLAN 0 to HW filter on device bond3 [ 526.711374][T27725] syzkaller0: entered promiscuous mode [ 526.717998][T27725] syzkaller0: entered allmulticast mode [ 526.773040][T27727] netlink: 20 bytes leftover after parsing attributes in process `syz.2.9973'. [ 526.789368][T27727] rdma_rxe: rxe_newlink: failed to add ip6_vti0 [ 526.870810][T27729] syzkaller0: entered promiscuous mode [ 526.877131][T27729] syzkaller0: entered allmulticast mode [ 526.897351][T27731] netlink: 'syz.2.9975': attribute type 1 has an invalid length. [ 528.627716][T27744] mac80211_hwsim hwsim5 syzkaller0: left promiscuous mode [ 528.635839][T27744] mac80211_hwsim hwsim5 syzkaller0: left allmulticast mode [ 528.931462][T27774] netlink: 4 bytes leftover after parsing attributes in process `syz.1.9983'. [ 530.337090][T27774] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 530.370815][T27774] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 530.434017][T27780] mac80211_hwsim hwsim5 syzkaller0: entered promiscuous mode [ 530.463467][T27780] mac80211_hwsim hwsim5 syzkaller0: entered allmulticast mode [ 530.579866][T27790] mac80211_hwsim hwsim5 syzkaller0: left promiscuous mode [ 530.587604][T27790] mac80211_hwsim hwsim5 syzkaller0: left allmulticast mode [ 530.763518][T27793] netlink: 4 bytes leftover after parsing attributes in process `syz.4.9992'. [ 530.763642][T27797] mac80211_hwsim hwsim5 syzkaller0: entered promiscuous mode [ 530.804423][T27797] mac80211_hwsim hwsim5 syzkaller0: entered allmulticast mode [ 530.898223][T27802] tipc: Enabled bearer , priority 0 [ 530.909953][T27802] syzkaller0: entered promiscuous mode [ 530.921269][T27802] syzkaller0: entered allmulticast mode [ 530.948312][T27802] sch_tbf: burst 4 is lower than device syzkaller0 mtu (1514) ! [ 530.991369][T27802] tipc: Resetting bearer [ 531.010409][T27801] tipc: Resetting bearer [ 531.018988][T27808] netlink: 'syz.4.9998': attribute type 1 has an invalid length. [ 531.037447][T27801] tipc: Disabling bearer [ 531.076426][T27808] 8021q: adding VLAN 0 to HW filter on device bond4 [ 531.123633][T27810] 8021q: adding VLAN 0 to HW filter on device bond4 [ 531.145396][T27810] bond4: (slave vxcan5): The slave device specified does not support setting the MAC address [ 531.159841][T27810] bond4: (slave vxcan5): Error -95 calling set_mac_address [ 531.197666][T27808] gretap3: entered promiscuous mode [ 531.209813][T27808] bond4: (slave gretap3): making interface the new active one [ 531.219091][T27808] bond4: (slave gretap3): Enslaving as an active interface with an up link [ 531.241599][T27815] macvlan3: entered promiscuous mode [ 531.247179][T27815] macvlan3: entered allmulticast mode [ 531.253375][T27815] bond4: entered promiscuous mode [ 531.260034][T27815] 8021q: adding VLAN 0 to HW filter on device macvlan3 [ 531.270660][T27815] bond4: (slave macvlan3): the slave hw address is in use by the bond; giving it the hw address of gretap3 [ 531.288346][T27815] bond4: left promiscuous mode [ 531.328649][T27817] syzkaller0: entered promiscuous mode [ 531.334604][T27817] syzkaller0: entered allmulticast mode [ 531.372375][T27814] netlink: 76 bytes leftover after parsing attributes in process `syz.1.10001'. [ 531.745424][T27829] tipc: Enabled bearer , priority 0 [ 531.773097][T27829] syzkaller0: entered promiscuous mode [ 531.790357][T27829] syzkaller0: entered allmulticast mode [ 531.809210][T27834] netlink: 24 bytes leftover after parsing attributes in process `syz.0.10008'. [ 531.822205][T27834] netlink: 24 bytes leftover after parsing attributes in process `syz.0.10008'. [ 531.869263][T27834] syzkaller0: entered promiscuous mode [ 531.875025][T27834] syzkaller0: entered allmulticast mode [ 531.919186][T27829] tipc: Resetting bearer [ 531.926451][T27836] syzkaller0: entered promiscuous mode [ 531.931985][T27836] syzkaller0: entered allmulticast mode [ 531.948607][T27827] tipc: Resetting bearer [ 531.986060][T27827] tipc: Disabling bearer [ 532.051163][T27846] netlink: 4 bytes leftover after parsing attributes in process `syz.2.10014'. [ 532.346294][T27846] netlink: 4 bytes leftover after parsing attributes in process `syz.2.10014'. [ 532.468951][T27851] syzkaller0: entered promiscuous mode [ 532.474590][T27851] syzkaller0: entered allmulticast mode [ 535.592085][T27870] syzkaller0: entered promiscuous mode [ 535.597778][T27870] syzkaller0: entered allmulticast mode [ 537.203955][T27899] tipc: Enabled bearer , priority 0 [ 537.228501][T27898] mac80211_hwsim hwsim6 syzkaller0: left promiscuous mode [ 537.236690][T27898] mac80211_hwsim hwsim6 syzkaller0: left allmulticast mode [ 537.256180][T27899] tipc: Resetting bearer [ 537.392690][T27909] mac80211_hwsim hwsim6 syzkaller0: entered promiscuous mode [ 537.401663][T27909] mac80211_hwsim hwsim6 syzkaller0: entered allmulticast mode [ 537.410106][T27907] tipc: Enabling of bearer rejected, already enabled [ 537.565256][T27915] netlink: 76 bytes leftover after parsing attributes in process `syz.4.10028'. [ 537.587704][T27915] syzkaller0: entered promiscuous mode [ 537.598218][T27915] syzkaller0: entered allmulticast mode [ 537.610669][T27918] tipc: Enabling of bearer rejected, already enabled [ 537.620795][T27914] mac80211_hwsim hwsim5 syzkaller0: Caught tx_queue_len zero misconfig [ 537.783130][T27928] netlink: 12 bytes leftover after parsing attributes in process `syz.4.10033'. [ 537.884485][T27933] tipc: Enabled bearer , priority 0 [ 537.892931][T27933] syzkaller0: entered promiscuous mode [ 537.899491][T27933] syzkaller0: entered allmulticast mode [ 537.910384][T27933] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 538.074064][T27945] tipc: Resetting bearer [ 538.139117][T27930] tipc: Resetting bearer [ 538.159360][T27930] tipc: Disabling bearer [ 538.308668][T27954] syzkaller0: entered promiscuous mode [ 538.318325][T27954] syzkaller0: entered allmulticast mode [ 538.366085][T27958] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 538.428400][T27958] syzkaller0: entered promiscuous mode [ 538.434013][T27958] syzkaller0: entered allmulticast mode [ 538.625905][T27974] netlink: 4 bytes leftover after parsing attributes in process `syz.2.10047'. [ 538.744007][T27980] tipc: Enabling of bearer rejected, already enabled [ 538.762775][T27976] 0: reclassify loop, rule prio 0, protocol 800 [ 539.395933][T28014] 0: reclassify loop, rule prio 0, protocol 800 [ 539.644198][T28027] netlink: 76 bytes leftover after parsing attributes in process `syz.1.10068'. [ 539.998953][T28042] netlink: 4 bytes leftover after parsing attributes in process `syz.1.10075'. [ 540.086186][T28046] netlink: 'syz.2.10076': attribute type 1 has an invalid length. [ 540.099093][T28048] xt_connbytes: Forcing CT accounting to be enabled [ 540.177237][T28045] netlink: 4 bytes leftover after parsing attributes in process `syz.0.10077'. [ 540.249112][T28055] netlink: 12 bytes leftover after parsing attributes in process `syz.1.10080'. [ 540.268905][T28055] tipc: Enabling of bearer rejected, failed to enable media [ 540.382804][T28060] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 540.449192][T28062] mac80211_hwsim hwsim5 syzkaller0: left promiscuous mode [ 540.470513][T28062] mac80211_hwsim hwsim5 syzkaller0: left allmulticast mode [ 540.511102][T28065] tipc: Enabled bearer , priority 0 [ 540.535790][T28065] syzkaller0: entered promiscuous mode [ 540.541341][T28065] syzkaller0: entered allmulticast mode [ 540.556168][T28065] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 540.587566][T28065] tipc: Resetting bearer [ 540.597351][T28064] tipc: Resetting bearer [ 540.614855][T28064] tipc: Disabling bearer [ 540.995993][T28088] syzkaller0: entered promiscuous mode [ 541.011795][T28088] syzkaller0: entered allmulticast mode [ 541.202519][T28098] netlink: 8 bytes leftover after parsing attributes in process `syz.3.10098'. [ 541.219971][T28097] tipc: Enabled bearer , priority 0 [ 541.228624][T28097] syzkaller0: entered promiscuous mode [ 541.234164][T28097] syzkaller0: entered allmulticast mode [ 541.276330][T28097] tipc: Resetting bearer [ 541.294180][T28096] tipc: Resetting bearer [ 541.324196][T28096] tipc: Disabling bearer [ 541.373597][T28102] netlink: 28 bytes leftover after parsing attributes in process `syz.2.10101'. [ 541.613252][T28114] tipc: Enabled bearer , priority 0 [ 541.648119][T28114] syzkaller0: entered promiscuous mode [ 541.669378][T28114] syzkaller0: entered allmulticast mode [ 541.754671][T28114] tipc: Resetting bearer [ 541.776586][T28117] tipc: Enabled bearer , priority 0 [ 541.785228][T28117] syzkaller0: entered promiscuous mode [ 541.790765][T28117] syzkaller0: entered allmulticast mode [ 541.807760][T28112] tipc: Resetting bearer [ 541.876034][T28112] tipc: Disabling bearer [ 541.889026][T28121] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 541.921162][T28117] tipc: Resetting bearer [ 541.930979][T28125] tipc: Enabling of bearer rejected, already enabled [ 541.945289][T28117] tipc: Resetting bearer [ 541.974205][T28117] tipc: Disabling bearer [ 542.009907][T28125] mac80211_hwsim hwsim5 syzkaller0: entered promiscuous mode [ 542.018814][T28125] mac80211_hwsim hwsim5 syzkaller0: entered allmulticast mode [ 542.136442][T28127] v: renamed from vlan0 [ 542.173669][T28125] sch_tbf: burst 127 is lower than device syzkaller0 mtu (313) ! [ 542.308987][T28131] syzkaller0: entered promiscuous mode [ 542.315239][T28131] syzkaller0: entered allmulticast mode [ 542.388709][T28143] netlink: 76 bytes leftover after parsing attributes in process `syz.0.10113'. [ 542.424638][T28143] syzkaller0: entered promiscuous mode [ 542.430332][T28143] syzkaller0: entered allmulticast mode [ 544.242759][T28173] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 544.292515][T28180] ip6t_REJECT: ECHOREPLY is not supported [ 544.317533][T28181] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 544.351269][T28173] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 544.402761][T28173] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 544.536009][T28195] __nla_validate_parse: 2 callbacks suppressed [ 544.536031][T28195] netlink: 28 bytes leftover after parsing attributes in process `syz.4.10128'. [ 544.702738][T28202] netlink: 12 bytes leftover after parsing attributes in process `syz.2.10132'. [ 544.788934][T28204] netlink: 12 bytes leftover after parsing attributes in process `syz.2.10133'. [ 545.103762][T28214] mac80211_hwsim hwsim5 syzkaller0: left promiscuous mode [ 545.114717][T28214] mac80211_hwsim hwsim5 syzkaller0: left allmulticast mode [ 545.245188][T28221] netlink: 28 bytes leftover after parsing attributes in process `syz.3.10141'. [ 545.380180][T28230] netlink: 20 bytes leftover after parsing attributes in process `syz.4.10144'. [ 545.408737][T28230] netlink: 20 bytes leftover after parsing attributes in process `syz.4.10144'. [ 545.526604][T28239] syzkaller0: entered promiscuous mode [ 545.532667][T28239] syzkaller0: entered allmulticast mode [ 545.640371][T28247] netlink: 8 bytes leftover after parsing attributes in process `syz.4.10150'. [ 546.087331][T28271] xt_CT: You must specify a L4 protocol and not use inversions on it [ 546.243459][T28266] siw: device registration error -23 [ 546.263456][T28282] tipc: Enabling of bearer rejected, already enabled [ 546.290785][T28266] Unsupported ieee802154 address type: 0 [ 546.343311][T28286] syzkaller0: entered promiscuous mode [ 546.364842][T28286] syzkaller0: entered allmulticast mode [ 546.460725][T28294] xt_connbytes: Forcing CT accounting to be enabled [ 546.541630][T28300] openvswitch: netlink: IP tunnel dst address not specified [ 546.575510][T28299] tipc: Enabling of bearer rejected, already enabled [ 546.790256][T28308] bond8: entered promiscuous mode [ 546.804748][T28308] 8021q: adding VLAN 0 to HW filter on device bond8 [ 546.913736][T28302] infiniband !yz!: set active [ 546.919314][T28302] infiniband !yz!: added team_slave_0 [ 547.003522][T28302] RDS/IB: !yz!: added [ 547.022194][T28302] smc: adding ib device !yz! with port count 1 [ 547.040315][T28302] smc: ib device !yz! port 1 has no pnetid [ 547.566006][T28338] syzkaller0: entered promiscuous mode [ 547.571586][T28338] syzkaller0: entered allmulticast mode [ 547.821509][T28348] syzkaller0: entered promiscuous mode [ 547.827774][T28348] syzkaller0: entered allmulticast mode [ 550.046328][T28395] netlink: 36 bytes leftover after parsing attributes in process `syz.2.10214'. [ 550.060117][T28395] netlink: 212368 bytes leftover after parsing attributes in process `syz.2.10214'. [ 550.071364][T28395] netlink: 8 bytes leftover after parsing attributes in process `syz.2.10214'. [ 550.096402][T28395] : entered promiscuous mode [ 550.212338][T28402] netlink: 28 bytes leftover after parsing attributes in process `syz.3.10218'. [ 550.415047][ T30] audit: type=1800 audit(1765286527.936:3): pid=28411 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.10221" name="memory.events" dev="tmpfs" ino=10558 res=0 errno=0 [ 550.477304][ T30] audit: type=1804 audit(1765286527.936:4): pid=28411 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.3.10221" name="/newroot/2095/memory.events" dev="tmpfs" ino=10558 res=1 errno=0 [ 550.490244][T28415] netlink: 6 bytes leftover after parsing attributes in process `syz.0.10224'. [ 550.555520][T28415] A link change request failed with some changes committed already. Interface vxcan1 may have been left with an inconsistent configuration, please check. [ 550.585233][T28421] netlink: 24 bytes leftover after parsing attributes in process `syz.4.10226'. [ 550.718202][T28425] netlink: 4 bytes leftover after parsing attributes in process `syz.3.10228'. [ 550.810068][T28429] netlink: 76 bytes leftover after parsing attributes in process `syz.0.10231'. [ 550.835718][T28429] syzkaller0: entered promiscuous mode [ 550.849025][T28429] syzkaller0: entered allmulticast mode [ 550.911211][T28433] netlink: 4 bytes leftover after parsing attributes in process `syz.3.10233'. [ 550.942773][T28433] netlink: 4 bytes leftover after parsing attributes in process `syz.3.10233'. [ 551.345163][T28457] xt_policy: neither incoming nor outgoing policy selected [ 551.521044][T28467] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 551.551218][T28467] syzkaller0: entered promiscuous mode [ 551.557343][T28467] syzkaller0: entered allmulticast mode [ 551.651755][T28473] syzkaller0: entered promiscuous mode [ 551.665973][T28473] syzkaller0: entered allmulticast mode [ 552.229683][T28510] mac80211_hwsim hwsim5 syzkaller0: entered promiscuous mode [ 552.238072][T28510] mac80211_hwsim hwsim5 syzkaller0: entered allmulticast mode [ 552.869102][T28545] syzkaller0: entered promiscuous mode [ 552.875493][T28545] syzkaller0: entered allmulticast mode [ 554.218709][T28631] netlink: 'syz.1.10322': attribute type 3 has an invalid length. [ 555.059642][T28683] __nla_validate_parse: 15 callbacks suppressed [ 555.059664][T28683] netlink: 20 bytes leftover after parsing attributes in process `syz.3.10346'. [ 555.166462][T28687] syzkaller0: entered promiscuous mode [ 555.185113][T28687] syzkaller0: entered allmulticast mode [ 555.194120][T28689] netlink: 28 bytes leftover after parsing attributes in process `syz.0.10349'. [ 555.446353][ T5848] Bluetooth: hci1: command 0x0406 tx timeout [ 555.681469][T28716] netlink: 36 bytes leftover after parsing attributes in process `syz.4.10361'. [ 556.031151][T28740] lo: Caught tx_queue_len zero misconfig [ 556.038235][T28740] netem: change failed [ 556.187635][T28751] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 556.206110][T28751] syzkaller0: entered promiscuous mode [ 556.216829][T28751] syzkaller0: entered allmulticast mode [ 556.308657][T28757] netlink: 165 bytes leftover after parsing attributes in process `syz.3.10380'. [ 556.441695][T28762] netlink: 7 bytes leftover after parsing attributes in process `syz.3.10383'. [ 556.465021][T28762] erspan0: entered promiscuous mode [ 556.758398][T28778] netlink: 12 bytes leftover after parsing attributes in process `syz.2.10389'. [ 556.779188][T28780] tipc: New replicast peer: 172.30.1.2 [ 556.987741][T28790] syzkaller1: entered promiscuous mode [ 556.993296][T28790] syzkaller1: entered allmulticast mode [ 557.454865][T28815] netlink: 'syz.4.10404': attribute type 42 has an invalid length. [ 557.464150][T28815] netlink: 28 bytes leftover after parsing attributes in process `syz.4.10404'. [ 557.625889][T28822] lo speed is unknown, defaulting to 1000 [ 557.705313][T28832] team0: No ports can be present during mode change [ 558.073701][T28849] netlink: 'syz.1.10418': attribute type 4 has an invalid length. [ 558.226380][T28828] netlink: 'syz.3.10407': attribute type 4 has an invalid length. [ 558.244545][T28822] wlan0 speed is unknown, defaulting to 1000 [ 558.251970][T28822] lo speed is unknown, defaulting to 1000 [ 558.606222][T28861] tipc: Enabled bearer , priority 0 [ 558.613892][T28861] syzkaller0: entered promiscuous mode [ 558.619640][T28861] syzkaller0: entered allmulticast mode [ 558.639057][T28860] tipc: Resetting bearer [ 558.660549][T28860] tipc: Disabling bearer [ 559.378381][T28883] netlink: 71 bytes leftover after parsing attributes in process `syz.0.10433'. [ 559.498403][T28891] netlink: 'syz.4.10437': attribute type 10 has an invalid length. [ 559.516834][T28891] veth0_virt_wifi: entered allmulticast mode [ 559.545785][T28891] team0: Port device veth0_virt_wifi added [ 560.106581][T28915] netlink: 76 bytes leftover after parsing attributes in process `syz.4.10447'. [ 560.499621][T28933] IPVS: sh: FWM 3 0x00000003 - no destination available [ 560.559301][T28936] tipc: Enabled bearer , priority 0 [ 560.581503][T28936] syzkaller0: entered promiscuous mode [ 560.587522][T28936] syzkaller0: entered allmulticast mode [ 560.610161][T28936] tipc: Resetting bearer [ 560.616925][T28940] veth0: entered promiscuous mode [ 560.624498][T28934] tipc: Resetting bearer [ 560.663661][T28934] tipc: Disabling bearer [ 560.687369][T28938] veth0: left promiscuous mode [ 560.919585][T28958] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 561.382770][T28980] netlink: 28 bytes leftover after parsing attributes in process `syz.2.10478'. [ 561.396157][T28978] netlink: 76 bytes leftover after parsing attributes in process `syz.0.10477'. [ 561.712972][T28997] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 562.109760][T29019] netlink: 76 bytes leftover after parsing attributes in process `syz.3.10494'. [ 562.185480][T29022] netlink: 4 bytes leftover after parsing attributes in process `syz.2.10496'. [ 562.222683][T29022] netlink: 4 bytes leftover after parsing attributes in process `syz.2.10496'. [ 562.632154][T29049] tls_set_device_offload_rx: netdev not found [ 563.559608][T29103] netlink: 4 bytes leftover after parsing attributes in process `syz.0.10521'. [ 563.644067][T29103] team0 (unregistering): Port device bridge3 removed [ 563.985670][T29130] netlink: 12 bytes leftover after parsing attributes in process `syz.3.10533'. [ 564.006711][T29130] netlink: 12 bytes leftover after parsing attributes in process `syz.3.10533'. [ 564.296492][T29147] syzkaller0: entered promiscuous mode [ 564.318690][T29147] syzkaller0: entered allmulticast mode [ 564.418407][T29157] netlink: 'syz.0.10549': attribute type 1 has an invalid length. [ 564.478722][T29157] 8021q: adding VLAN 0 to HW filter on device bond9 [ 564.562258][T29161] bond9: (slave geneve3): making interface the new active one [ 564.615030][T29161] bond9: (slave geneve3): Enslaving as an active interface with an up link [ 564.666375][T29171] netlink: 8 bytes leftover after parsing attributes in process `syz.3.10553'. [ 564.719039][ T6345] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 564.737239][ T6345] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 564.747221][ T6345] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 564.756537][ T6345] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 565.216348][ T62] nci: nci_rsp_packet: unsupported rsp opcode 0xf05 [ 565.308399][T29210] __nla_validate_parse: 1 callbacks suppressed [ 565.308422][T29210] netlink: 14544 bytes leftover after parsing attributes in process `syz.4.10566'. [ 565.617366][T29220] netlink: 'syz.2.10571': attribute type 4 has an invalid length. [ 565.628713][T29220] netlink: 'syz.2.10571': attribute type 4 has an invalid length. [ 565.881264][T29231] syzkaller0: entered promiscuous mode [ 565.887057][T29231] syzkaller0: entered allmulticast mode [ 566.156429][T29243] netlink: 64 bytes leftover after parsing attributes in process `syz.0.10581'. [ 568.013949][T29275] netlink: 'syz.3.10588': attribute type 30 has an invalid length. [ 568.248884][ T7068] nci: nci_add_new_protocol: the target found does not have the desired protocol [ 568.493871][ T1303] ieee802154 phy0 wpan0: encryption failed: -22 [ 569.476891][T29332] syzkaller0: entered promiscuous mode [ 569.482447][T29332] syzkaller0: entered allmulticast mode [ 569.674248][T29343] netlink: 4 bytes leftover after parsing attributes in process `syz.1.10615'. [ 569.813863][T29350] netlink: 28 bytes leftover after parsing attributes in process `syz.2.10619'. [ 570.281389][T29380] netlink: 28 bytes leftover after parsing attributes in process `syz.3.10630'. [ 570.374827][T29384] tipc: Enabled bearer , priority 0 [ 570.384089][T29386] nbd: nbd3 already in use [ 570.389950][T29386] block nbd3: NBD_DISCONNECT [ 570.395963][T29386] block nbd3: Send disconnect failed -32 [ 570.488014][T29384] syzkaller0: entered promiscuous mode [ 570.505218][T29384] syzkaller0: entered allmulticast mode [ 570.511637][T29384] tipc: Resetting bearer [ 570.549814][T29383] tipc: Resetting bearer [ 570.597101][T29393] netlink: 27 bytes leftover after parsing attributes in process `syz.3.10635'. [ 572.170701][T29383] tipc: Disabling bearer [ 572.429390][T29417] netlink: 40 bytes leftover after parsing attributes in process `syz.0.10642'. [ 572.442560][T29419] netlink: 16 bytes leftover after parsing attributes in process `syz.1.10644'. [ 572.472334][T29424] netlink: 28 bytes leftover after parsing attributes in process `syz.3.10643'. [ 573.269417][T29457] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 573.278571][T29457] syzkaller0: entered promiscuous mode [ 573.284100][T29457] syzkaller0: entered allmulticast mode [ 573.828826][T29476] syzkaller0: entered promiscuous mode [ 573.834739][T29476] syzkaller0: entered allmulticast mode [ 574.012404][T29484] netlink: 8 bytes leftover after parsing attributes in process `syz.4.10664'. [ 575.749943][ T6072] nci: nci_ntf_packet: unsupported ntf opcode 0xf2e [ 575.897573][T29506] lo speed is unknown, defaulting to 1000 [ 575.948158][T29521] netlink: 'syz.1.10676': attribute type 1 has an invalid length. [ 576.388393][T29534] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 576.399312][T29534] syzkaller0: entered promiscuous mode [ 576.408654][T29534] syzkaller0: entered allmulticast mode [ 576.452484][T29537] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 576.534128][T29506] wlan0 speed is unknown, defaulting to 1000 [ 576.552669][T29540] IPVS: sync thread started: state = BACKUP, mcast_ifn = lo, syncid = 2, id = 0 [ 576.604633][T29506] lo speed is unknown, defaulting to 1000 [ 577.320074][T29559] netlink: 8 bytes leftover after parsing attributes in process `syz.3.10688'. [ 577.853546][T29573] netlink: 4 bytes leftover after parsing attributes in process `syz.2.10693'. [ 577.908322][T29573] netlink: 12 bytes leftover after parsing attributes in process `syz.2.10693'. [ 578.109379][T29579] netlink: 4 bytes leftover after parsing attributes in process `syz.1.10694'. [ 578.157374][T29581] netlink: 20 bytes leftover after parsing attributes in process `syz.0.10697'. [ 578.346642][T29588] netlink: 'syz.0.10698': attribute type 30 has an invalid length. [ 578.367019][T29588] netlink: 4 bytes leftover after parsing attributes in process `syz.0.10698'. [ 578.405958][T29588] netlink: 'syz.0.10698': attribute type 30 has an invalid length. [ 578.413947][T29588] netlink: 4 bytes leftover after parsing attributes in process `syz.0.10698'. [ 578.727877][T29602] netlink: 12 bytes leftover after parsing attributes in process `syz.0.10704'. [ 579.357215][T29624] syzkaller0: entered promiscuous mode [ 579.375058][T29624] syzkaller0: entered allmulticast mode [ 579.400644][T29627] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 579.451872][T29630] sch_tbf: burst 127 is lower than device syzkaller0 mtu (313) ! [ 579.579031][T29637] netlink: 8 bytes leftover after parsing attributes in process `syz.1.10717'. [ 579.998636][T29651] netlink: 8 bytes leftover after parsing attributes in process `syz.3.10722'. [ 580.410235][T29665] tipc: Enabled bearer , priority 0 [ 580.441197][T29665] tipc: Resetting bearer [ 580.467228][T29664] tipc: Disabling bearer [ 580.520414][T29668] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 580.534095][T29671] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 580.697988][T29673] syzkaller0: entered promiscuous mode [ 580.714816][T29673] syzkaller0: entered allmulticast mode [ 580.855855][T29678] netlink: 'syz.2.10732': attribute type 32 has an invalid length. [ 580.946894][T29678] bond1: option coupled_control: invalid value (52) [ 580.983708][T29678] bond1 (unregistering): Released all slaves [ 581.098681][T29699] syzkaller1: entered promiscuous mode [ 581.104242][T29699] syzkaller1: entered allmulticast mode [ 581.290308][T29696] syzkaller0: entered promiscuous mode [ 581.305567][T29696] syzkaller0: entered allmulticast mode [ 582.261858][T29736] lec:lec_atm_close: lec0: Shut down! [ 583.924762][T29781] netlink: 'syz.4.10755': attribute type 12 has an invalid length. [ 585.417043][T29836] tipc: Enabling of bearer rejected, already enabled [ 586.341169][T29888] dummy0: left allmulticast mode [ 586.376207][T29888] bridge0: port 1(dummy0) entered disabled state [ 586.396632][T29888] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 586.436123][T29888] team0: No ports can be present during mode change [ 586.458977][T29898] tipc: Enabling of bearer rejected, failed to enable media [ 586.595030][T29910] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 586.602316][T29910] IPv6: NLM_F_CREATE should be set when creating new route [ 586.763436][T29920] netlink: 'syz.2.10802': attribute type 1 has an invalid length. [ 586.817875][T29920] 8021q: adding VLAN 0 to HW filter on device bond9 [ 586.852854][T29924] bond9: (slave veth11): Enslaving as an active interface with a down link [ 586.885363][T29920] bond9: (slave veth0_to_bond): Enslaving as an active interface with a down link [ 586.951724][T29920] bond9: (slave veth13): Enslaving as an active interface with a down link [ 587.155941][T29935] lo speed is unknown, defaulting to 1000 [ 587.332515][T29948] mac80211_hwsim hwsim6 syzkaller0: left promiscuous mode [ 587.340320][T29948] mac80211_hwsim hwsim6 syzkaller0: left allmulticast mode [ 587.395518][T29935] wlan0 speed is unknown, defaulting to 1000 [ 587.403685][T29935] lo speed is unknown, defaulting to 1000 [ 588.735978][T30000] lo speed is unknown, defaulting to 1000 [ 589.276792][T30000] wlan0 speed is unknown, defaulting to 1000 [ 589.277569][T30011] lo speed is unknown, defaulting to 1000 [ 589.285955][T30000] lo speed is unknown, defaulting to 1000 [ 589.402200][T30028] IPVS: sh: SCTP 127.0.0.1:0 - no destination available [ 589.839789][T30011] wlan0 speed is unknown, defaulting to 1000 [ 589.876471][T30011] lo speed is unknown, defaulting to 1000 [ 589.883433][T30042] __nla_validate_parse: 2 callbacks suppressed [ 589.883453][T30042] netlink: 20 bytes leftover after parsing attributes in process `syz.3.10836'. [ 589.947750][T30044] netlink: 24 bytes leftover after parsing attributes in process `syz.0.10837'. [ 590.208584][T30050] bond0: (slave macvlan0): Opening slave failed [ 590.569651][T30056] mac80211_hwsim hwsim6 syzkaller0: entered promiscuous mode [ 590.578647][T30056] mac80211_hwsim hwsim6 syzkaller0: entered allmulticast mode [ 590.650633][T30058] tipc: Enabling of bearer rejected, already enabled [ 590.680438][T30053] syzkaller0: entered promiscuous mode [ 590.695380][T30053] syzkaller0: entered allmulticast mode [ 590.778613][T30060] tipc: Enabling of bearer rejected, already enabled [ 591.509945][T30070] syzkaller1: entered promiscuous mode [ 591.524804][T30070] syzkaller1: entered allmulticast mode [ 591.906130][T30083] netlink: 24 bytes leftover after parsing attributes in process `syz.1.10852'. [ 592.100816][T30087] tipc: Enabling of bearer rejected, already enabled [ 592.280736][T30090] netlink: 24 bytes leftover after parsing attributes in process `syz.3.10854'. [ 592.321107][T30092] netlink: 4 bytes leftover after parsing attributes in process `syz.1.10855'. [ 592.498297][T30103] netlink: 12 bytes leftover after parsing attributes in process `syz.4.10857'. [ 592.637182][T30097] syzkaller1: entered promiscuous mode [ 592.658997][T30097] syzkaller1: entered allmulticast mode [ 592.997535][T30117] tipc: Enabling of bearer rejected, failed to enable media [ 593.008690][T30118] netlink: 4 bytes leftover after parsing attributes in process `syz.1.10863'. [ 593.020521][T30118] veth0_to_bridge: left allmulticast mode [ 593.041568][T30118] veth0_to_bridge: left promiscuous mode [ 593.068018][T30118] bridge0: port 1(veth0_to_bridge) entered disabled state [ 593.680138][T30142] netlink: 8 bytes leftover after parsing attributes in process `syz.2.10870'. [ 594.122784][T30158] netlink: 'syz.2.10876': attribute type 4 has an invalid length. [ 594.736107][T30186] syzkaller0: entered promiscuous mode [ 594.741795][T30186] syzkaller0: entered allmulticast mode [ 595.019853][T30201] tipc: Enabling of bearer rejected, failed to enable media [ 595.446700][T30222] syzkaller0: entered promiscuous mode [ 595.465699][T30222] syzkaller0: entered allmulticast mode [ 595.846680][ T9563] IPVS: ip_vs_send_async error -101 [ 596.043281][T30246] netlink: 'syz.3.10904': attribute type 13 has an invalid length. [ 597.997953][T30265] syzkaller0: entered promiscuous mode [ 598.008806][T30265] syzkaller0: entered allmulticast mode [ 599.474000][ T5851] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 599.485279][ T5851] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 599.496107][ T5851] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 599.505073][ T5851] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 599.512947][ T5851] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 599.592238][T30325] lo speed is unknown, defaulting to 1000 [ 599.815657][ T5848] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 599.825701][ T5848] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 599.833925][ T5848] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 599.842141][ T5848] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 599.852276][ T5848] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 599.921225][T30331] tipc: Enabling of bearer rejected, already enabled [ 600.070779][ T5848] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 600.081452][T30327] lo speed is unknown, defaulting to 1000 [ 600.089885][T30325] wlan0 speed is unknown, defaulting to 1000 [ 600.097304][ T5848] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 600.105982][ T5848] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 600.113976][ T5848] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 600.122000][ T5848] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 600.124830][T30325] lo speed is unknown, defaulting to 1000 [ 600.455034][ T5848] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 600.465285][ T5848] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 600.473637][ T5848] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 600.481920][ T5848] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 600.491783][ T5848] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 600.568072][T30343] sch_tbf: burst 127 is lower than device syzkaller0 mtu (313) ! [ 600.684100][T30327] wlan0 speed is unknown, defaulting to 1000 [ 600.686308][T30332] lo speed is unknown, defaulting to 1000 [ 600.706997][T30327] lo speed is unknown, defaulting to 1000 [ 601.030241][T30339] lo speed is unknown, defaulting to 1000 [ 601.043218][T30332] wlan0 speed is unknown, defaulting to 1000 [ 601.072509][T30332] lo speed is unknown, defaulting to 1000 [ 601.438114][T30325] chnl_net:caif_netlink_parms(): no params data found [ 601.456503][T30339] wlan0 speed is unknown, defaulting to 1000 [ 601.487579][T30339] lo speed is unknown, defaulting to 1000 [ 601.604741][ T5848] Bluetooth: hci0: command tx timeout [ 601.699773][T30325] bridge0: port 1(bridge_slave_0) entered blocking state [ 601.716915][T30325] bridge0: port 1(bridge_slave_0) entered disabled state [ 601.731474][T30325] bridge_slave_0: entered allmulticast mode [ 601.767212][T30325] bridge_slave_0: entered promiscuous mode [ 601.809051][T30325] bridge0: port 2(bridge_slave_1) entered blocking state [ 601.817135][T30325] bridge0: port 2(bridge_slave_1) entered disabled state [ 601.835152][T30325] bridge_slave_1: entered allmulticast mode [ 601.843263][T30325] bridge_slave_1: entered promiscuous mode [ 601.924696][ T5848] Bluetooth: hci1: command tx timeout [ 602.003819][T30325] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 602.051992][T30325] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 602.070594][T30363] netlink: 12 bytes leftover after parsing attributes in process `syz.3.10937'. [ 602.125584][ T5848] block nbd3: Receive control failed (result -1) [ 602.164945][ T5848] Bluetooth: hci2: command tx timeout [ 602.189317][T30325] team0: Port device team_slave_0 added [ 602.259826][T30325] team0: Port device team_slave_1 added [ 602.498488][T30325] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 602.524355][T30325] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 602.566177][T30325] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 602.578146][ T5848] Bluetooth: hci4: command tx timeout [ 602.605790][T30325] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 602.613133][T30325] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 602.640213][T30325] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 602.665658][T30327] chnl_net:caif_netlink_parms(): no params data found [ 602.931938][T30325] hsr_slave_0: entered promiscuous mode [ 602.940977][T30325] hsr_slave_1: entered promiscuous mode [ 602.947835][T30325] debugfs: 'hsr0' already exists in 'hsr' [ 602.953710][T30325] Cannot create hsr debugfs directory [ 603.015488][T30375] sch_tbf: burst 127 is lower than device syzkaller0 mtu (313) ! [ 603.023680][T30332] chnl_net:caif_netlink_parms(): no params data found [ 603.077441][T30327] bridge0: port 1(bridge_slave_0) entered blocking state [ 603.085209][T30327] bridge0: port 1(bridge_slave_0) entered disabled state [ 603.092968][T30327] bridge_slave_0: entered allmulticast mode [ 603.101427][T30327] bridge_slave_0: entered promiscuous mode [ 603.148773][T30327] bridge0: port 2(bridge_slave_1) entered blocking state [ 603.158251][T30327] bridge0: port 2(bridge_slave_1) entered disabled state [ 603.165983][T30327] bridge_slave_1: entered allmulticast mode [ 603.173911][T30327] bridge_slave_1: entered promiscuous mode [ 603.303157][T30327] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 603.331252][T30327] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 603.516042][T30327] team0: Port device team_slave_0 added [ 603.522052][T30332] bridge0: port 1(bridge_slave_0) entered blocking state [ 603.530439][T30332] bridge0: port 1(bridge_slave_0) entered disabled state [ 603.538776][T30332] bridge_slave_0: entered allmulticast mode [ 603.548439][T30332] bridge_slave_0: entered promiscuous mode [ 603.574103][T30327] team0: Port device team_slave_1 added [ 603.587394][T30332] bridge0: port 2(bridge_slave_1) entered blocking state [ 603.595789][T30332] bridge0: port 2(bridge_slave_1) entered disabled state [ 603.603165][T30332] bridge_slave_1: entered allmulticast mode [ 603.611533][T30332] bridge_slave_1: entered promiscuous mode [ 603.684950][ T5848] Bluetooth: hci0: command tx timeout [ 603.720114][T30332] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 603.741373][T30339] chnl_net:caif_netlink_parms(): no params data found [ 603.754154][T30327] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 603.761905][T30327] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 603.789620][T30327] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 603.806106][T30332] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 603.830109][T30327] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 603.837331][T30327] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 603.863736][T30327] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 603.985785][T30332] team0: Port device team_slave_0 added [ 604.004701][ T5848] Bluetooth: hci1: command tx timeout [ 604.022056][T30332] team0: Port device team_slave_1 added [ 604.185889][T30327] hsr_slave_0: entered promiscuous mode [ 604.192840][T30327] hsr_slave_1: entered promiscuous mode [ 604.199931][T30327] debugfs: 'hsr0' already exists in 'hsr' [ 604.206100][T30327] Cannot create hsr debugfs directory [ 604.215320][T30339] bridge0: port 1(bridge_slave_0) entered blocking state [ 604.222685][T30339] bridge0: port 1(bridge_slave_0) entered disabled state [ 604.244688][ T5848] Bluetooth: hci2: command tx timeout [ 604.245501][T30339] bridge_slave_0: entered allmulticast mode [ 604.263799][T30339] bridge_slave_0: entered promiscuous mode [ 604.287003][T30332] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 604.301494][T30332] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 604.332272][T30332] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 604.373214][T30339] bridge0: port 2(bridge_slave_1) entered blocking state [ 604.380779][T30339] bridge0: port 2(bridge_slave_1) entered disabled state [ 604.388306][T30339] bridge_slave_1: entered allmulticast mode [ 604.395973][T30339] bridge_slave_1: entered promiscuous mode [ 604.438290][T30397] netdevsim netdevsim3 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 604.447759][T30397] netdevsim netdevsim3 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 604.456721][T30397] netdevsim netdevsim3 netdevsim0: unset [1, 1] type 2 family 0 port 20000 - 0 [ 604.496805][T30397] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 604.515247][T30332] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 604.522248][T30332] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 604.548491][T30332] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 604.560346][T30325] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 604.636795][T30325] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 604.645527][ T5848] Bluetooth: hci4: command tx timeout [ 604.688113][T30325] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 604.712099][T30339] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 604.724191][T30325] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 604.777118][T30339] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 604.847825][T30332] hsr_slave_0: entered promiscuous mode [ 604.854454][T30332] hsr_slave_1: entered promiscuous mode [ 604.860870][T30332] debugfs: 'hsr0' already exists in 'hsr' [ 604.866758][T30332] Cannot create hsr debugfs directory [ 604.897713][T30339] team0: Port device team_slave_0 added [ 604.926983][T30339] team0: Port device team_slave_1 added [ 605.095709][T30339] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 605.102717][T30339] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 605.130497][T30339] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 605.151599][T30339] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 605.160069][T30339] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 605.187083][T30339] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 605.310592][T30339] hsr_slave_0: entered promiscuous mode [ 605.317976][T30339] hsr_slave_1: entered promiscuous mode [ 605.324709][T30339] debugfs: 'hsr0' already exists in 'hsr' [ 605.330523][T30339] Cannot create hsr debugfs directory [ 605.438787][T30327] netdevsim netdevsim8 netdevsim0: renamed from eth0 [ 605.472787][T30327] netdevsim netdevsim8 netdevsim1: renamed from eth1 [ 605.509080][T30327] netdevsim netdevsim8 netdevsim2: renamed from eth2 [ 605.532885][T30327] netdevsim netdevsim8 netdevsim3: renamed from eth3 [ 605.668001][T30332] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 605.683114][T30332] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 605.705643][T30332] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 605.737373][T30332] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 605.765625][ T5848] Bluetooth: hci0: command tx timeout [ 605.809798][T30325] 8021q: adding VLAN 0 to HW filter on device bond0 [ 605.846248][T30339] netdevsim netdevsim7 netdevsim0: renamed from eth0 [ 605.858459][T30339] netdevsim netdevsim7 netdevsim1: renamed from eth1 [ 605.869530][T30339] netdevsim netdevsim7 netdevsim2: renamed from eth2 [ 605.888844][T30339] netdevsim netdevsim7 netdevsim3: renamed from eth3 [ 605.958374][T30325] 8021q: adding VLAN 0 to HW filter on device team0 [ 605.998487][ T6072] bridge0: port 1(bridge_slave_0) entered blocking state [ 606.005733][ T6072] bridge0: port 1(bridge_slave_0) entered forwarding state [ 606.039821][ T6072] bridge0: port 2(bridge_slave_1) entered blocking state [ 606.047054][ T6072] bridge0: port 2(bridge_slave_1) entered forwarding state [ 606.068937][T30436] pimreg: entered allmulticast mode [ 606.085690][ T5848] Bluetooth: hci1: command tx timeout [ 606.220942][T30327] 8021q: adding VLAN 0 to HW filter on device bond0 [ 606.241830][T30332] 8021q: adding VLAN 0 to HW filter on device bond0 [ 606.282480][T30327] 8021q: adding VLAN 0 to HW filter on device team0 [ 606.301815][ T3511] bridge0: port 1(bridge_slave_0) entered blocking state [ 606.309073][ T3511] bridge0: port 1(bridge_slave_0) entered forwarding state [ 606.325215][ T5848] Bluetooth: hci2: command tx timeout [ 606.353748][T30332] 8021q: adding VLAN 0 to HW filter on device team0 [ 606.379716][ T3511] bridge0: port 2(bridge_slave_1) entered blocking state [ 606.386987][ T3511] bridge0: port 2(bridge_slave_1) entered forwarding state [ 606.398502][ T3511] bridge0: port 1(bridge_slave_0) entered blocking state [ 606.405760][ T3511] bridge0: port 1(bridge_slave_0) entered forwarding state [ 606.451803][ T3511] bridge0: port 2(bridge_slave_1) entered blocking state [ 606.459151][ T3511] bridge0: port 2(bridge_slave_1) entered forwarding state [ 606.497489][T30339] 8021q: adding VLAN 0 to HW filter on device bond0 [ 606.553236][T30339] 8021q: adding VLAN 0 to HW filter on device team0 [ 606.584181][ T1097] bridge0: port 1(bridge_slave_0) entered blocking state [ 606.591371][ T1097] bridge0: port 1(bridge_slave_0) entered forwarding state [ 606.619269][ T1097] bridge0: port 2(bridge_slave_1) entered blocking state [ 606.626479][ T1097] bridge0: port 2(bridge_slave_1) entered forwarding state [ 606.694214][T30325] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 606.725399][ T5848] Bluetooth: hci4: command tx timeout [ 607.188884][T30332] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 607.269950][T30327] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 607.499191][T30339] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 607.590822][T30325] veth0_vlan: entered promiscuous mode [ 607.660164][T30325] veth1_vlan: entered promiscuous mode [ 607.703119][T30477] mac80211_hwsim hwsim6 syzkaller0: left promiscuous mode [ 607.724630][T30477] mac80211_hwsim hwsim6 syzkaller0: left allmulticast mode [ 607.835573][T30325] veth0_macvtap: entered promiscuous mode [ 607.855219][ T5848] Bluetooth: hci0: command tx timeout [ 607.889293][T30325] veth1_macvtap: entered promiscuous mode [ 607.940745][T30486] sch_tbf: burst 127 is lower than device syzkaller0 mtu (313) ! [ 607.976545][T30486] mac80211_hwsim hwsim6 syzkaller0: entered promiscuous mode [ 607.987123][T30486] mac80211_hwsim hwsim6 syzkaller0: entered allmulticast mode [ 608.028973][T30325] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 608.088292][T30325] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 608.106809][T30327] veth0_vlan: entered promiscuous mode [ 608.139823][ T6072] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 608.153078][ T6072] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 608.166480][ T5848] Bluetooth: hci1: command tx timeout [ 608.174100][T30327] veth1_vlan: entered promiscuous mode [ 608.193804][ T6072] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 608.203192][ T6072] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 608.225201][T30332] veth0_vlan: entered promiscuous mode [ 608.273019][T30339] veth0_vlan: entered promiscuous mode [ 608.312071][T30332] veth1_vlan: entered promiscuous mode [ 608.335579][T30339] veth1_vlan: entered promiscuous mode [ 608.406003][ T5848] Bluetooth: hci2: command tx timeout [ 608.437449][T30327] veth0_macvtap: entered promiscuous mode [ 608.438941][ T6072] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 608.451814][T30327] veth1_macvtap: entered promiscuous mode [ 608.490166][ T6072] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 608.537611][T30327] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 608.549681][T30332] veth0_macvtap: entered promiscuous mode [ 608.561556][T30339] veth0_macvtap: entered promiscuous mode [ 608.571428][ T6068] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 608.576201][T30332] veth1_macvtap: entered promiscuous mode [ 608.587029][ T6068] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 608.605349][T30339] veth1_macvtap: entered promiscuous mode [ 608.615241][T30327] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 608.685172][ T6068] netdevsim netdevsim8 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 608.701903][T30339] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 608.710384][ T6068] netdevsim netdevsim8 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 608.722733][T30332] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 608.751011][ T6068] netdevsim netdevsim8 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 608.782026][ T6068] netdevsim netdevsim8 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 608.799269][T30332] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 608.807582][ T5848] Bluetooth: hci4: command tx timeout [ 608.981016][T30339] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 609.032080][ T74] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 609.061539][ T74] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 609.081952][ T74] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 609.091814][ T74] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 609.120819][ T74] netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 609.179616][ T74] netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 609.227047][ T74] netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 609.238632][ T74] netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 609.298355][ T74] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 609.322778][ T74] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 609.387253][T30503] syzkaller0: entered promiscuous mode [ 609.392879][T30503] syzkaller0: entered allmulticast mode [ 609.497809][ T74] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 609.515667][ T74] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 609.538152][T30509] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 609.596980][ T6068] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 609.613832][ T6068] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 609.728624][ T74] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 609.749344][ T74] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 609.767220][T30511] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 609.807241][ T7068] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 609.817031][ T7068] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 609.858739][T30508] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 609.902215][ T74] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 609.919381][ T74] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 610.102086][T30518] netlink: 28 bytes leftover after parsing attributes in process `syz.6.10959'. [ 610.621010][T30526] syzkaller0: entered promiscuous mode [ 610.626728][T30526] syzkaller0: entered allmulticast mode [ 612.635441][T30535] syzkaller0: entered promiscuous mode [ 612.640980][T30535] syzkaller0: entered allmulticast mode [ 612.695366][T30572] netlink: 'syz.3.10968': attribute type 13 has an invalid length. [ 614.020066][T30588] netlink: 'syz.7.10973': attribute type 1 has an invalid length. [ 615.228065][T30580] mac80211_hwsim hwsim6 syzkaller0: Caught tx_queue_len zero misconfig [ 615.265357][T30584] tipc: Enabling of bearer rejected, already enabled [ 615.465952][T30601] tipc: Started in network mode [ 615.481251][T30601] tipc: Node identity e6014761ba4d, cluster identity 4711 [ 615.496887][T30601] tipc: Enabled bearer , priority 0 [ 615.657004][T30602] syzkaller0: entered promiscuous mode [ 615.662729][T30602] syzkaller0: entered allmulticast mode [ 615.673745][T30602] tipc: Resetting bearer [ 615.709261][T30600] tipc: Resetting bearer [ 617.423554][T30600] tipc: Disabling bearer [ 617.437845][T30612] tipc: Enabling of bearer rejected, already enabled [ 617.449241][ T5821] tipc: Node number set to 1548502881 [ 617.687640][T30498] Bluetooth: hci4: command tx timeout [ 617.878086][T30627] lo speed is unknown, defaulting to 1000 [ 618.205197][T30643] netlink: 8 bytes leftover after parsing attributes in process `syz.8.10991'. [ 618.498175][T30627] wlan0 speed is unknown, defaulting to 1000 [ 618.527824][T30627] lo speed is unknown, defaulting to 1000 [ 618.767096][T30665] tipc: Started in network mode [ 618.772050][T30665] tipc: Node identity 5e6657068f7c, cluster identity 4711 [ 618.810425][T30665] tipc: Enabled bearer , priority 0 [ 618.929600][T30655] syzkaller0: entered promiscuous mode [ 618.935318][T30655] syzkaller0: entered allmulticast mode [ 618.941834][T30655] tipc: Resetting bearer [ 618.962249][T30654] tipc: Resetting bearer [ 620.864059][T30654] tipc: Disabling bearer [ 620.873312][T30671] tipc: Started in network mode [ 620.878653][T30671] tipc: Node identity ba3ce5c0c0f8, cluster identity 4711 [ 620.886666][T30671] tipc: Enabled bearer , priority 0 [ 620.893932][T30675] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 620.917357][T30681] tipc: Resetting bearer [ 620.993519][T30688] netlink: 4 bytes leftover after parsing attributes in process `syz.8.11006'. [ 621.041452][T30670] tipc: Disabling bearer [ 621.074588][ T5899] tipc: Node number set to 3508164358 [ 621.527775][T30708] netlink: 40 bytes leftover after parsing attributes in process `syz.5.11011'. [ 621.595610][T30710] netlink: 'syz.8.11012': attribute type 83 has an invalid length. [ 621.717112][T30714] bond0: (slave rose0): Error: Device can not be enslaved while up [ 622.417633][T30734] syzkaller0: entered promiscuous mode [ 622.423179][T30734] syzkaller0: entered allmulticast mode [ 623.663670][T30778] syzkaller0: entered promiscuous mode [ 623.673125][T30778] syzkaller0: entered allmulticast mode [ 623.833091][T30790] netlink: 56 bytes leftover after parsing attributes in process `syz.8.11045'. [ 623.846504][T30790] netlink: 56 bytes leftover after parsing attributes in process `syz.8.11045'. [ 624.782529][T30844] netlink: 'syz.6.11061': attribute type 3 has an invalid length. [ 625.491956][T30871] netlink: 'syz.6.11073': attribute type 12 has an invalid length. [ 625.520318][T30871] netlink: 'syz.6.11073': attribute type 29 has an invalid length. [ 625.549364][T30871] netlink: 148 bytes leftover after parsing attributes in process `syz.6.11073'. [ 625.564629][T30871] netlink: 'syz.6.11073': attribute type 2 has an invalid length. [ 625.572537][T30871] netlink: 'syz.6.11073': attribute type 3 has an invalid length. [ 625.604782][T30871] netlink: 15 bytes leftover after parsing attributes in process `syz.6.11073'. [ 625.793025][T30881] syzkaller0: entered promiscuous mode [ 625.799610][T30881] syzkaller0: entered allmulticast mode [ 626.026792][T30892] netlink: 8 bytes leftover after parsing attributes in process `syz.3.11080'. [ 626.233015][ T1097] nci: nci_rsp_packet: unknown rsp opcode 0x805 [ 627.149891][T30930] bridge0: port 1(bridge_slave_0) entered disabled state [ 627.162997][T30930] bridge0: port 2(bridge_slave_1) entered disabled state [ 627.175087][T30934] vxcan1: tx drop: invalid sa for name 0x0000000000000001 [ 627.385074][T30932] syzkaller0: entered promiscuous mode [ 627.390838][T30932] syzkaller0: entered allmulticast mode [ 628.498768][T30982] netlink: 12 bytes leftover after parsing attributes in process `syz.5.11115'. [ 628.558318][T30943] netdevsim netdevsim5 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 628.567552][T30982] netlink: 12 bytes leftover after parsing attributes in process `syz.5.11115'. [ 628.587646][T30943] netdevsim netdevsim5 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 628.632969][T30943] netdevsim netdevsim5 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 628.665225][T30943] netdevsim netdevsim5 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 629.963873][ T1303] ieee802154 phy0 wpan0: encryption failed: -22 [ 630.296825][T31046] netlink: 'syz.3.11138': attribute type 5 has an invalid length. [ 630.741071][T30854] Set syz1 is full, maxelem 65536 reached [ 630.774572][T31060] netlink: 28 bytes leftover after parsing attributes in process `syz.5.11146'. [ 631.361553][T31085] syzkaller0: entered promiscuous mode [ 631.368421][T31085] syzkaller0: entered allmulticast mode [ 631.601199][T31093] syzkaller0: entered promiscuous mode [ 631.608795][T31093] syzkaller0: entered allmulticast mode [ 631.619238][T31093] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 631.766023][T31100] netlink: 28 bytes leftover after parsing attributes in process `syz.3.11164'. [ 631.913999][T31102] llcp: llcp_sock_recvmsg: Recv datagram failed state 3 -6 0 [ 632.521258][T31138] netlink: 28 bytes leftover after parsing attributes in process `syz.5.11176'. [ 633.229114][T31149] openvswitch: netlink: VXLAN extension 30 out of range max 1 [ 634.808296][T31216] syzkaller1: entered promiscuous mode [ 634.820719][T31216] syzkaller1: entered allmulticast mode [ 635.088923][T31225] tipc: New replicast peer: 255.255.255.255 [ 635.105513][T31225] tipc: Enabled bearer , priority 10 [ 635.112037][T31222] lo speed is unknown, defaulting to 1000 [ 635.258616][ T5942] IPVS: starting estimator thread 0... [ 635.368970][T31235] IPVS: using max 28 ests per chain, 67200 per kthread [ 635.531145][T31222] wlan0 speed is unknown, defaulting to 1000 [ 635.551968][T31222] lo speed is unknown, defaulting to 1000 [ 635.984797][T31261] netlink: 156 bytes leftover after parsing attributes in process `syz.3.11226'. [ 636.435837][T31268] netlink: 'syz.5.11229': attribute type 5 has an invalid length. [ 636.586058][T31276] netlink: 44 bytes leftover after parsing attributes in process `syz.5.11232'. [ 636.763139][T31283] TCP: request_sock_subflow_v6: Possible SYN flooding on port [::]:20002. Sending cookies. [ 638.483566][T31324] netlink: 4 bytes leftover after parsing attributes in process `syz.7.11247'. [ 638.737255][ C0] vcan0: j1939_tp_rxtimer: 0xffff888062d17800: rx timeout, send abort [ 639.232235][ C0] vcan0: j1939_tp_rxtimer: 0xffff888062d16000: rx timeout, send abort [ 639.246983][ C0] vcan0: j1939_tp_rxtimer: 0xffff888062d17800: abort rx timeout. Force session deactivation [ 639.745936][ C0] vcan0: j1939_tp_rxtimer: 0xffff888062d16000: abort rx timeout. Force session deactivation [ 642.198980][T31313] Set syz1 is full, maxelem 65536 reached [ 642.260375][T31333] netlink: 28 bytes leftover after parsing attributes in process `syz.7.11250'. [ 642.414037][T31341] netlink: 4 bytes leftover after parsing attributes in process `syz.8.11254'. [ 642.494072][T31346] netlink: 'syz.3.11256': attribute type 1 has an invalid length. [ 642.513035][T31346] netlink: 3 bytes leftover after parsing attributes in process `syz.3.11256'. [ 642.609351][T31348] netlink: 8 bytes leftover after parsing attributes in process `syz.7.11257'. [ 642.680867][T31355] netlink: 'syz.6.11259': attribute type 1 has an invalid length. [ 642.767388][T31355] 8021q: adding VLAN 0 to HW filter on device bond1 [ 642.825409][T31364] veth3: entered promiscuous mode [ 642.854665][T31364] bond1: (slave veth3): Enslaving as an active interface with an up link [ 643.171999][T31381] netlink: 12 bytes leftover after parsing attributes in process `syz.5.11270'. [ 643.297930][T31385] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 643.305261][T31385] IPv6: NLM_F_CREATE should be set when creating new route [ 643.331689][T31389] tipc: Enabling of bearer rejected, failed to enable media [ 643.355565][T31389] syzkaller0: entered promiscuous mode [ 643.364880][T31389] syzkaller0: entered allmulticast mode [ 643.773333][T31412] netlink: 28 bytes leftover after parsing attributes in process `syz.7.11282'. [ 644.044855][T31418] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci4/hci4:200/input5 [ 644.185309][T31424] tipc: Enabled bearer , priority 0 [ 644.244859][T31424] syzkaller0: entered promiscuous mode [ 644.250552][T31424] syzkaller0: entered allmulticast mode [ 644.258819][T31424] tipc: Resetting bearer [ 644.295522][T31423] tipc: Resetting bearer [ 646.638393][T31423] tipc: Disabling bearer [ 646.674947][T31443] tipc: Enabling of bearer rejected, failed to enable media [ 646.876315][T31474] syzkaller0: entered promiscuous mode [ 646.881950][T31474] syzkaller0: entered allmulticast mode [ 649.202930][T31509] tipc: Started in network mode [ 649.217271][T31509] tipc: Node identity 6e2521d398c, cluster identity 4711 [ 649.229674][T31509] tipc: Enabled bearer , priority 0 [ 649.304746][T31509] syzkaller0: entered promiscuous mode [ 649.310562][T31509] syzkaller0: entered allmulticast mode [ 649.325710][T31509] tipc: Resetting bearer [ 649.440278][T31508] tipc: Resetting bearer [ 651.282039][T31508] tipc: Disabling bearer [ 651.297945][T31515] tipc: Enabling of bearer rejected, failed to enable media [ 651.312679][T31522] syzkaller0: entered promiscuous mode [ 651.318564][T31522] syzkaller0: entered allmulticast mode [ 653.145721][ T5950] tipc: Node number set to 4142211539 [ 653.201468][T31544] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 653.635504][T31566] netlink: 200 bytes leftover after parsing attributes in process `syz.3.11329'. [ 653.675463][T31563] tipc: Enabled bearer , priority 0 [ 653.749916][T31563] syzkaller0: entered promiscuous mode [ 653.755953][T31563] syzkaller0: entered allmulticast mode [ 653.762892][T31563] tipc: Resetting bearer [ 655.498896][T31561] tipc: Resetting bearer [ 655.601046][T31586] netlink: 12 bytes leftover after parsing attributes in process `syz.5.11333'. [ 657.275363][T31561] tipc: Disabling bearer [ 659.017604][ T5906] tipc: Node number set to 2059724224 [ 659.042348][T31588] tipc: Enabling of bearer rejected, failed to enable media [ 659.076978][T31591] syzkaller0: entered promiscuous mode [ 659.084594][T31591] syzkaller0: entered allmulticast mode [ 659.118216][T31604] netlink: 12 bytes leftover after parsing attributes in process `syz.6.11334'. [ 659.223236][T31615] netlink: 12 bytes leftover after parsing attributes in process `syz.5.11336'. [ 659.286392][T31604] netlink: 12 bytes leftover after parsing attributes in process `syz.6.11334'. [ 659.300209][T30660] netdevsim netdevsim6 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 659.380720][T31619] netlink: 'syz.8.11338': attribute type 12 has an invalid length. [ 659.389494][T31619] netlink: 'syz.8.11338': attribute type 29 has an invalid length. [ 659.398887][T31619] netlink: 148 bytes leftover after parsing attributes in process `syz.8.11338'. [ 659.409066][T31619] netlink: 'syz.8.11338': attribute type 1 has an invalid length. [ 659.418420][T31619] netlink: 'syz.8.11338': attribute type 2 has an invalid length. [ 659.427126][T31619] netlink: 31 bytes leftover after parsing attributes in process `syz.8.11338'. [ 659.436726][T30660] netdevsim netdevsim6 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 659.449359][T30660] netdevsim netdevsim6 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 659.480176][T31623] bridge3: port 1(veth0_to_bond) entered blocking state [ 659.535277][T31623] bridge3: port 1(veth0_to_bond) entered disabled state [ 659.554024][T31623] veth0_to_bond: entered allmulticast mode [ 659.583407][T31623] veth0_to_bond: entered promiscuous mode [ 659.597409][T30660] netdevsim netdevsim6 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 659.696107][T31634] sctp: [Deprecated]: syz.3.11344 (pid 31634) Use of int in maxseg socket option. [ 659.696107][T31634] Use struct sctp_assoc_value instead [ 659.751730][T31634] bridge_slave_0: left allmulticast mode [ 659.773487][T31639] netlink: 12 bytes leftover after parsing attributes in process `syz.8.11347'. [ 659.786899][T31634] bridge_slave_0: left promiscuous mode [ 659.792859][T31634] bridge0: port 1(bridge_slave_0) entered disabled state [ 659.826051][T31634] bond0: (slave bridge_slave_1): Releasing backup interface [ 659.843749][T30498] Bluetooth: hci4: link tx timeout [ 659.852013][T30498] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 659.888200][T31634] bond0: (slave bond_slave_0): Releasing backup interface [ 659.936071][T31634] bond0: (slave bond_slave_1): Releasing backup interface [ 659.979850][T31634] team0: Port device C removed [ 660.013446][T31634] team0: Port device team_slave_1 removed [ 660.033810][T31634] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 660.266703][T31660] tipc: Enabling of bearer rejected, failed to enable media [ 660.348924][T31669] syzkaller0: entered promiscuous mode [ 660.361873][T31669] syzkaller0: entered allmulticast mode [ 661.268913][ T5848] Bluetooth: hci4: link tx timeout [ 661.274098][ T5848] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 661.929285][ T5848] Bluetooth: hci4: command 0x0406 tx timeout [ 662.773124][T31717] syzkaller0: entered promiscuous mode [ 662.799270][T31717] syzkaller0: entered allmulticast mode [ 662.864909][T31717] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 663.306929][T31745] tipc: Resetting bearer [ 663.536838][T31763] netlink: 4 bytes leftover after parsing attributes in process `syz.7.11380'. [ 663.959493][T31779] syzkaller0: entered promiscuous mode [ 663.968597][T31779] syzkaller0: entered allmulticast mode [ 664.090795][T31784] netlink: 8 bytes leftover after parsing attributes in process `syz.6.11391'. [ 664.260872][T31792] sctp: Trying to GSO but underlying device doesn't support it. [ 664.682320][T31820] mac80211_hwsim hwsim21 syzkaller0: entered promiscuous mode [ 664.720014][T31820] mac80211_hwsim hwsim21 syzkaller0: entered allmulticast mode [ 664.965674][T31835] syzkaller0: entered promiscuous mode [ 664.971423][T31835] syzkaller0: entered allmulticast mode [ 665.534139][T31854] syzkaller0: entered promiscuous mode [ 665.544594][T31854] syzkaller0: entered allmulticast mode [ 665.667695][T31856] syzkaller0: entered promiscuous mode [ 665.673589][T31856] syzkaller0: entered allmulticast mode [ 665.755231][T31860] RDS: rds_bind could not find a transport for ::ffff:172.30.0.9, load rds_tcp or rds_rdma? [ 665.795042][T31862] netlink: 64 bytes leftover after parsing attributes in process `syz.6.11425'. [ 665.817374][T31862] block nbd0: Unsupported socket: should be TCP or UNIX. [ 666.178314][T31880] syzkaller0: entered promiscuous mode [ 666.191125][T31880] syzkaller0: entered allmulticast mode [ 666.204944][T31880] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 666.359823][T31886] netlink: 4 bytes leftover after parsing attributes in process `syz.7.11438'. [ 666.700436][T31910] tipc: Enabling of bearer rejected, failed to enable media [ 666.714017][T31910] syzkaller0: entered promiscuous mode [ 666.736070][T31910] syzkaller0: entered allmulticast mode [ 666.789627][T31912] netlink: 40 bytes leftover after parsing attributes in process `syz.3.11447'. [ 666.800037][T31912] netlink: 28 bytes leftover after parsing attributes in process `syz.3.11447'. [ 667.147651][T31923] netlink: 4 bytes leftover after parsing attributes in process `syz.7.11453'. [ 667.452970][T31953] netlink: 40 bytes leftover after parsing attributes in process `syz.8.11462'. [ 667.464146][T31948] netlink: 28 bytes leftover after parsing attributes in process `syz.8.11462'. [ 667.692477][T31963] tipc: Enabling of bearer rejected, failed to enable media [ 668.339398][T32006] netlink: 4 bytes leftover after parsing attributes in process `syz.5.11486'. [ 668.369354][T32005] tipc: Enabling of bearer rejected, failed to enable media [ 668.387937][T32005] syzkaller0: entered promiscuous mode [ 668.394565][T32005] syzkaller0: entered allmulticast mode [ 669.257689][T32051] syzkaller0: entered promiscuous mode [ 669.263314][T32051] syzkaller0: entered allmulticast mode [ 669.357950][T32053] gre0: entered promiscuous mode [ 669.363162][T32053] gre0: entered allmulticast mode [ 669.814605][T32072] netlink: 'syz.7.11515': attribute type 12 has an invalid length. [ 669.822601][T32072] netlink: 'syz.7.11515': attribute type 29 has an invalid length. [ 669.850887][T32072] netlink: 148 bytes leftover after parsing attributes in process `syz.7.11515'. [ 669.863309][T32072] netlink: 'syz.7.11515': attribute type 1 has an invalid length. [ 669.877543][T32072] netlink: 'syz.7.11515': attribute type 2 has an invalid length. [ 669.886222][T32072] netlink: 31 bytes leftover after parsing attributes in process `syz.7.11515'. [ 670.078555][T32084] netlink: 'syz.7.11521': attribute type 10 has an invalid length. [ 670.160440][T32084] bond0: (slave netdevsim0): Enslaving as an active interface with an up link [ 670.301946][T32096] IPv4: Oversized IP packet from 127.202.26.0 [ 670.677105][ T3462] nci: nci_rf_discover_ntf_packet: unsupported rf_tech_and_mode 0x18 [ 671.329224][T32135] netlink: 'syz.5.11543': attribute type 4 has an invalid length. [ 671.368484][T32135] netlink: 'syz.5.11543': attribute type 4 has an invalid length. [ 671.450453][T32137] syz_tun: entered allmulticast mode [ 671.457746][T32136] syz_tun: left allmulticast mode [ 671.602747][T32142] netlink: 'syz.6.11548': attribute type 9 has an invalid length. [ 671.616500][T32142] netlink: 'syz.6.11548': attribute type 11 has an invalid length. [ 671.635830][T32142] netlink: 'syz.6.11548': attribute type 12 has an invalid length. [ 671.643839][T32142] netlink: 210020 bytes leftover after parsing attributes in process `syz.6.11548'. [ 671.669442][T32142] netlink: 4 bytes leftover after parsing attributes in process `syz.6.11548'. [ 671.755442][T32149] netlink: 16 bytes leftover after parsing attributes in process `syz.7.11550'. [ 672.379767][T32185] netlink: 8 bytes leftover after parsing attributes in process `syz.3.11562'. [ 672.403357][T32185] netlink: 8 bytes leftover after parsing attributes in process `syz.3.11562'. [ 672.711852][T32197] sch_tbf: burst 274 is lower than device lo mtu (65550) ! [ 672.973951][T32211] netlink: 27 bytes leftover after parsing attributes in process `syz.8.11573'. [ 672.982150][T32213] netlink: 64 bytes leftover after parsing attributes in process `syz.6.11574'. [ 673.008217][T32214] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 673.683149][T32246] batman_adv: batadv0: Adding interface: dummy0 [ 673.690131][T32246] batman_adv: batadv0: The MTU of interface dummy0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 673.754138][T32246] batman_adv: batadv0: Interface activated: dummy0 [ 673.777637][ T5942] IPVS: starting estimator thread 0... [ 673.827721][T32253] batadv0: mtu less than device minimum [ 673.835087][T32253] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 673.847405][T32253] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 673.859351][T32253] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 673.871313][T32253] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 673.883303][T32253] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 673.895270][T32253] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 673.895532][T32255] IPVS: using max 27 ests per chain, 64800 per kthread [ 673.907405][T32253] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 673.924827][T32253] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 674.270016][T32270] netlink: 4 bytes leftover after parsing attributes in process `syz.8.11595'. [ 674.305926][T32271] mac80211_hwsim hwsim6 syzkaller0: left promiscuous mode [ 674.341485][T32271] mac80211_hwsim hwsim6 syzkaller0: left allmulticast mode [ 674.431077][T32281] syz_tun: entered allmulticast mode [ 674.446386][T32279] syz_tun: left allmulticast mode [ 674.454200][T32275] netlink: 4 bytes leftover after parsing attributes in process `syz.7.11598'. [ 674.524990][T32287] block nbd5: not configured, cannot reconfigure [ 674.833854][T32304] netlink: 4 bytes leftover after parsing attributes in process `syz.8.11608'. [ 675.587369][T32329] netem: change failed [ 675.631671][T32331] lo: Caught tx_queue_len zero misconfig [ 675.645315][T32331] sch_tbf: burst 19872 is lower than device lo mtu (11337746) ! [ 675.936228][T32344] lo speed is unknown, defaulting to 1000 [ 676.603726][T32344] wlan0 speed is unknown, defaulting to 1000 [ 676.630688][T32344] lo speed is unknown, defaulting to 1000 [ 676.766795][T32353] __nla_validate_parse: 2 callbacks suppressed [ 676.766815][T32353] netlink: 12 bytes leftover after parsing attributes in process `syz.3.11629'. [ 676.810242][T32356] netlink: 'syz.7.11628': attribute type 1 has an invalid length. [ 676.818331][T32356] netlink: 3 bytes leftover after parsing attributes in process `syz.7.11628'. [ 676.948572][T32359] mac80211_hwsim hwsim6 syzkaller0: entered promiscuous mode [ 676.956666][T32359] mac80211_hwsim hwsim6 syzkaller0: entered allmulticast mode [ 677.096591][T32361] netlink: 4 bytes leftover after parsing attributes in process `syz.6.11630'. [ 677.907083][T32389] netlink: 'syz.3.11640': attribute type 3 has an invalid length. [ 678.081621][T32397] tipc: Enabled bearer , priority 0 [ 678.124115][T32397] netem: change failed [ 678.215731][T32400] netlink: 'syz.3.11645': attribute type 26 has an invalid length. [ 678.230882][T32400] netlink: 4 bytes leftover after parsing attributes in process `syz.3.11645'. [ 678.276089][T32400] netlink: 'syz.3.11645': attribute type 26 has an invalid length. [ 678.304811][T32400] netlink: 4 bytes leftover after parsing attributes in process `syz.3.11645'. [ 678.362778][T32403] netlink: 4 bytes leftover after parsing attributes in process `syz.5.11646'. [ 678.440862][T32412] netlink: 12 bytes leftover after parsing attributes in process `syz.6.11650'. [ 678.822132][T32431] netlink: 4 bytes leftover after parsing attributes in process `syz.6.11655'. [ 678.981765][T32423] syzkaller0: entered promiscuous mode [ 678.995816][T32436] netlink: 'syz.3.11656': attribute type 1 has an invalid length. [ 679.003809][T32423] syzkaller0: entered allmulticast mode [ 679.069360][T32438] netlink: 28 bytes leftover after parsing attributes in process `syz.3.11656'. [ 679.232175][T32436] bond5: entered promiscuous mode [ 679.251396][T32436] 8021q: adding VLAN 0 to HW filter on device bond5 [ 679.410171][T32438] bond5: entered allmulticast mode [ 679.453294][T32445] bond5: (slave bridge10): making interface the new active one [ 679.468606][T32445] bridge10: entered promiscuous mode [ 679.480120][T32445] bridge10: entered allmulticast mode [ 679.501682][T32445] bond5: (slave bridge10): Enslaving as an active interface with an up link [ 679.537341][T32447] tipc: Enabled bearer , priority 0 [ 679.607884][T32439] tipc: Disabling bearer [ 679.629699][T32455] x_tables: unsorted underflow at hook 3 [ 679.672770][T32457] netem: change failed [ 679.727549][T32460] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 679.736874][T32460] syzkaller0: entered promiscuous mode [ 679.742395][T32460] syzkaller0: entered allmulticast mode [ 680.000105][T32466] netdevsim netdevsim3 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 680.016755][T32466] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 680.044815][T32466] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 1] type 2 family 0 port 20000 - 0 [ 680.188510][T32466] netdevsim netdevsim3 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 680.199327][T32466] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 680.210292][T32466] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 1] type 2 family 0 port 20000 - 0 [ 680.248913][T32472] lo speed is unknown, defaulting to 1000 [ 680.378401][T32466] netdevsim netdevsim3 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 680.390604][T32466] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 680.401134][T32466] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 1] type 2 family 0 port 20000 - 0 [ 680.497575][T32484] netlink: 24 bytes leftover after parsing attributes in process `syz.7.11670'. [ 680.644052][ T3462] netdevsim netdevsim3 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 680.704919][ T3462] netdevsim netdevsim3 eth0: set [1, 0] type 2 family 0 port 20000 - 0 [ 680.713403][ T3462] netdevsim netdevsim3 eth0: set [1, 1] type 2 family 0 port 6081 - 0 [ 680.786072][T30567] netdevsim netdevsim3 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 680.800414][T30567] netdevsim netdevsim3 eth1: set [1, 0] type 2 family 0 port 20000 - 0 [ 680.821925][T30567] netdevsim netdevsim3 eth1: set [1, 1] type 2 family 0 port 6081 - 0 [ 680.880204][ T7068] netdevsim netdevsim3 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 680.904666][ T7068] netdevsim netdevsim3 eth2: set [1, 0] type 2 family 0 port 20000 - 0 [ 680.933284][ T7068] netdevsim netdevsim3 eth2: set [1, 1] type 2 family 0 port 6081 - 0 [ 680.945432][T32493] tipc: Enabled bearer , priority 0 [ 680.956303][T32493] tipc: Resetting bearer [ 681.073715][T32492] tipc: Disabling bearer [ 681.111532][T32472] wlan0 speed is unknown, defaulting to 1000 [ 681.137687][T30567] netdevsim netdevsim3 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 681.147053][T30567] netdevsim netdevsim3 eth3: set [1, 0] type 2 family 0 port 20000 - 0 [ 681.157961][T30567] netdevsim netdevsim3 eth3: set [1, 1] type 2 family 0 port 6081 - 0 [ 681.168599][T32472] lo speed is unknown, defaulting to 1000 [ 681.325173][T32503] syzkaller0: entered promiscuous mode [ 681.330725][T32503] syzkaller0: entered allmulticast mode [ 681.393769][T32510] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 683.217816][T32510] syzkaller0: entered promiscuous mode [ 683.223375][T32510] syzkaller0: entered allmulticast mode [ 683.232866][T32511] syzkaller0: entered promiscuous mode [ 683.238637][T32511] syzkaller0: entered allmulticast mode [ 683.503378][T32528] tipc: Enabled bearer , priority 0 [ 683.668444][T32528] syzkaller0: entered promiscuous mode [ 683.674079][T32528] syzkaller0: entered allmulticast mode [ 683.680625][T32528] tipc: Resetting bearer [ 683.738976][T32526] tipc: Resetting bearer [ 685.468698][T32526] tipc: Disabling bearer [ 685.734382][T32548] __nla_validate_parse: 2 callbacks suppressed [ 685.734403][T32548] netlink: 32 bytes leftover after parsing attributes in process `syz.7.11690'. [ 685.816084][T32548] netlink: 28 bytes leftover after parsing attributes in process `syz.7.11690'. [ 685.939985][T32553] syzkaller0: entered promiscuous mode [ 685.948486][T32553] syzkaller0: entered allmulticast mode [ 686.277904][T32570] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 686.305706][T32570] syzkaller0: entered promiscuous mode [ 686.351654][T32570] syzkaller0: entered allmulticast mode [ 686.697336][T32585] syzkaller0: entered promiscuous mode [ 686.702969][T32585] syzkaller0: entered allmulticast mode [ 687.132628][T32607] FAULT_INJECTION: forcing a failure. [ 687.132628][T32607] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 687.146593][T32607] CPU: 1 UID: 0 PID: 32607 Comm: syz.8.11704 Not tainted syzkaller #0 PREEMPT(full) [ 687.146622][T32607] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 687.146636][T32607] Call Trace: [ 687.146644][T32607] [ 687.146653][T32607] dump_stack_lvl+0x189/0x250 [ 687.146682][T32607] ? __pfx____ratelimit+0x10/0x10 [ 687.146709][T32607] ? __pfx_dump_stack_lvl+0x10/0x10 [ 687.146731][T32607] ? __pfx__printk+0x10/0x10 [ 687.146758][T32607] ? __might_fault+0xb0/0x130 [ 687.146796][T32607] should_fail_ex+0x414/0x560 [ 687.146833][T32607] _copy_from_user+0x2d/0xb0 [ 687.146863][T32607] ___sys_sendmsg+0x158/0x2a0 [ 687.146897][T32607] ? __pfx____sys_sendmsg+0x10/0x10 [ 687.146936][T32607] ? rcu_read_lock_any_held+0xb3/0x120 [ 687.146990][T32607] ? __fget_files+0x2a/0x420 [ 687.147008][T32607] ? __fget_files+0x3a0/0x420 [ 687.147037][T32607] __x64_sys_sendmsg+0x19b/0x260 [ 687.147071][T32607] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 687.147112][T32607] ? __pfx_ksys_write+0x10/0x10 [ 687.147144][T32607] ? do_syscall_64+0xbe/0xf80 [ 687.147175][T32607] do_syscall_64+0xfa/0xf80 [ 687.147202][T32607] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 687.147223][T32607] ? clear_bhb_loop+0x60/0xb0 [ 687.147247][T32607] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 687.147282][T32607] RIP: 0033:0x7f70a618f749 [ 687.147300][T32607] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 687.147318][T32607] RSP: 002b:00007f70a70bc038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 687.147339][T32607] RAX: ffffffffffffffda RBX: 00007f70a63e5fa0 RCX: 00007f70a618f749 [ 687.147353][T32607] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000003 [ 687.147366][T32607] RBP: 00007f70a70bc090 R08: 0000000000000000 R09: 0000000000000000 [ 687.147378][T32607] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 687.147389][T32607] R13: 00007f70a63e6038 R14: 00007f70a63e5fa0 R15: 00007ffd1f1874f8 [ 687.147422][T32607] [ 687.569281][T32621] sch_tbf: burst 127 is lower than device syzkaller0 mtu (313) ! [ 687.856350][T32639] netlink: 4 bytes leftover after parsing attributes in process `syz.7.11713'. [ 688.061681][T32645] netlink: 4 bytes leftover after parsing attributes in process `syz.8.11716'. [ 688.101026][T32654] netlink: 4 bytes leftover after parsing attributes in process `syz.7.11719'. [ 688.118341][T32654] netlink: 76 bytes leftover after parsing attributes in process `syz.7.11719'. [ 688.171997][T32658] netlink: 28 bytes leftover after parsing attributes in process `syz.6.11720'. [ 688.233875][T32661] netlink: 8 bytes leftover after parsing attributes in process `syz.8.11721'. [ 688.249353][T32663] FAULT_INJECTION: forcing a failure. [ 688.249353][T32663] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 688.263116][T32663] CPU: 0 UID: 0 PID: 32663 Comm: syz.7.11722 Not tainted syzkaller #0 PREEMPT(full) [ 688.263137][T32663] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 688.263147][T32663] Call Trace: [ 688.263155][T32663] [ 688.263164][T32663] dump_stack_lvl+0x189/0x250 [ 688.263185][T32663] ? __pfx____ratelimit+0x10/0x10 [ 688.263206][T32663] ? __pfx_dump_stack_lvl+0x10/0x10 [ 688.263221][T32663] ? __pfx__printk+0x10/0x10 [ 688.263242][T32663] ? __might_fault+0xb0/0x130 [ 688.263270][T32663] should_fail_ex+0x414/0x560 [ 688.263292][T32663] _copy_from_user+0x2d/0xb0 [ 688.263315][T32663] ___sys_sendmsg+0x158/0x2a0 [ 688.263343][T32663] ? __pfx____sys_sendmsg+0x10/0x10 [ 688.263382][T32663] ? rcu_read_lock_any_held+0xb3/0x120 [ 688.263441][T32663] ? __fget_files+0x2a/0x420 [ 688.263456][T32663] ? __fget_files+0x3a0/0x420 [ 688.263479][T32663] __x64_sys_sendmsg+0x19b/0x260 [ 688.263504][T32663] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 688.263535][T32663] ? __pfx_ksys_write+0x10/0x10 [ 688.263557][T32663] ? do_syscall_64+0xbe/0xf80 [ 688.263583][T32663] do_syscall_64+0xfa/0xf80 [ 688.263611][T32663] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 688.263631][T32663] ? clear_bhb_loop+0x60/0xb0 [ 688.263656][T32663] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 688.263676][T32663] RIP: 0033:0x7f5809f8f749 [ 688.263694][T32663] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 688.263707][T32663] RSP: 002b:00007f58081ee038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 688.263730][T32663] RAX: ffffffffffffffda RBX: 00007f580a1e5fa0 RCX: 00007f5809f8f749 [ 688.263741][T32663] RDX: 0000000000000000 RSI: 00002000000012c0 RDI: 0000000000000004 [ 688.263750][T32663] RBP: 00007f58081ee090 R08: 0000000000000000 R09: 0000000000000000 [ 688.263759][T32663] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 688.263768][T32663] R13: 00007f580a1e6038 R14: 00007f580a1e5fa0 R15: 00007fff35846ef8 [ 688.263793][T32663] [ 688.621114][T32671] tipc: Enabling of bearer rejected, failed to enable media [ 689.065664][T32687] netdevsim netdevsim5 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 689.081971][T32687] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 689.236516][T32706] FAULT_INJECTION: forcing a failure. [ 689.236516][T32706] name failslab, interval 1, probability 0, space 0, times 1 [ 689.250626][T32706] CPU: 0 UID: 0 PID: 32706 Comm: syz.7.11732 Not tainted syzkaller #0 PREEMPT(full) [ 689.250656][T32706] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 689.250669][T32706] Call Trace: [ 689.250678][T32706] [ 689.250686][T32706] dump_stack_lvl+0x189/0x250 [ 689.250714][T32706] ? __pfx____ratelimit+0x10/0x10 [ 689.250738][T32706] ? __pfx_dump_stack_lvl+0x10/0x10 [ 689.250760][T32706] ? __pfx__printk+0x10/0x10 [ 689.250793][T32706] ? __pfx___might_resched+0x10/0x10 [ 689.250826][T32706] should_fail_ex+0x414/0x560 [ 689.250855][T32706] should_failslab+0xa8/0x100 [ 689.250887][T32706] __kmalloc_noprof+0xcb/0x800 [ 689.250911][T32706] ? tomoyo_realpath_from_path+0xe3/0x5d0 [ 689.250941][T32706] tomoyo_realpath_from_path+0xe3/0x5d0 [ 689.250965][T32706] ? tomoyo_domain+0xd8/0x130 [ 689.250994][T32706] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 689.251024][T32706] tomoyo_path_number_perm+0x1e8/0x5a0 [ 689.251057][T32706] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 689.251106][T32706] ? __mutex_unlock_slowpath+0x1a1/0x730 [ 689.251156][T32706] ? __fget_files+0x2a/0x420 [ 689.251178][T32706] ? __fget_files+0x3a0/0x420 [ 689.251195][T32706] ? __fget_files+0x2a/0x420 [ 689.251216][T32706] security_file_ioctl+0xcb/0x2d0 [ 689.251246][T32706] __se_sys_ioctl+0x47/0x170 [ 689.251275][T32706] do_syscall_64+0xfa/0xf80 [ 689.251302][T32706] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 689.251323][T32706] ? clear_bhb_loop+0x60/0xb0 [ 689.251348][T32706] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 689.251368][T32706] RIP: 0033:0x7f5809f8f749 [ 689.251387][T32706] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 689.251402][T32706] RSP: 002b:00007f58081ee038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 689.251422][T32706] RAX: ffffffffffffffda RBX: 00007f580a1e5fa0 RCX: 00007f5809f8f749 [ 689.251437][T32706] RDX: 0000200000000000 RSI: 0000000000008914 RDI: 0000000000000004 [ 689.251450][T32706] RBP: 00007f58081ee090 R08: 0000000000000000 R09: 0000000000000000 [ 689.251462][T32706] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 689.251473][T32706] R13: 00007f580a1e6038 R14: 00007f580a1e5fa0 R15: 00007fff35846ef8 [ 689.251508][T32706] [ 689.251673][T32706] ERROR: Out of memory at tomoyo_realpath_from_path. [ 689.354919][T32709] netlink: 28 bytes leftover after parsing attributes in process `syz.8.11733'. [ 689.376751][T32687] netdevsim netdevsim5 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 689.518829][T32687] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 689.642405][T32717] FAULT_INJECTION: forcing a failure. [ 689.642405][T32717] name failslab, interval 1, probability 0, space 0, times 0 [ 689.657678][T32717] CPU: 1 UID: 0 PID: 32717 Comm: syz.3.11736 Not tainted syzkaller #0 PREEMPT(full) [ 689.657706][T32717] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 689.657717][T32717] Call Trace: [ 689.657725][T32717] [ 689.657732][T32717] dump_stack_lvl+0x189/0x250 [ 689.657758][T32717] ? __pfx____ratelimit+0x10/0x10 [ 689.657781][T32717] ? __pfx_dump_stack_lvl+0x10/0x10 [ 689.657800][T32717] ? __pfx__printk+0x10/0x10 [ 689.657830][T32717] ? __pfx___might_resched+0x10/0x10 [ 689.657848][T32717] ? fs_reclaim_acquire+0x7d/0x100 [ 689.657878][T32717] should_fail_ex+0x414/0x560 [ 689.657903][T32717] should_failslab+0xa8/0x100 [ 689.657929][T32717] __kmalloc_cache_node_noprof+0x74/0x6f0 [ 689.657952][T32717] ? __get_vm_area_node+0x13f/0x300 [ 689.657978][T32717] __get_vm_area_node+0x13f/0x300 [ 689.658002][T32717] __vmalloc_node_range_noprof+0x30c/0x12d0 [ 689.658029][T32717] ? bpf_prog_alloc_no_stats+0x4a/0x4d0 [ 689.658051][T32717] ? __lock_acquire+0x6b6/0x2cf0 [ 689.658095][T32717] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 689.658122][T32717] ? __lock_acquire+0x6b6/0x2cf0 [ 689.658150][T32717] ? bpf_prog_alloc_no_stats+0x4a/0x4d0 [ 689.658174][T32717] __vmalloc_noprof+0xb1/0xf0 [ 689.658199][T32717] ? bpf_prog_alloc_no_stats+0x4a/0x4d0 [ 689.658228][T32717] bpf_prog_alloc_no_stats+0x4a/0x4d0 [ 689.658260][T32717] bpf_prog_alloc+0x3c/0x1a0 [ 689.658287][T32717] bpf_prog_load+0x735/0x1a10 [ 689.658339][T32717] ? __pfx_bpf_prog_load+0x10/0x10 [ 689.658390][T32717] ? bpf_lsm_bpf+0x9/0x20 [ 689.658409][T32717] ? security_bpf+0x7e/0x300 [ 689.658441][T32717] __sys_bpf+0x507/0x860 [ 689.658469][T32717] ? __pfx___sys_bpf+0x10/0x10 [ 689.658510][T32717] ? ksys_write+0x22a/0x250 [ 689.658538][T32717] ? __pfx_ksys_write+0x10/0x10 [ 689.658571][T32717] __x64_sys_bpf+0x7c/0x90 [ 689.658595][T32717] do_syscall_64+0xfa/0xf80 [ 689.658623][T32717] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 689.658643][T32717] ? clear_bhb_loop+0x60/0xb0 [ 689.658669][T32717] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 689.658689][T32717] RIP: 0033:0x7f9baa38f749 [ 689.658708][T32717] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 689.658726][T32717] RSP: 002b:00007f9bab20b038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 689.658748][T32717] RAX: ffffffffffffffda RBX: 00007f9baa5e5fa0 RCX: 00007f9baa38f749 [ 689.658763][T32717] RDX: 0000000000000048 RSI: 00002000000054c0 RDI: 0000000000000005 [ 689.658776][T32717] RBP: 00007f9bab20b090 R08: 0000000000000000 R09: 0000000000000000 [ 689.658789][T32717] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 689.658801][T32717] R13: 00007f9baa5e6038 R14: 00007f9baa5e5fa0 R15: 00007ffdbf3deb68 [ 689.658836][T32717] [ 689.658952][T32717] syz.3.11736: vmalloc error: size 4096, vm_struct allocation failed, mode:0x500dc0(GFP_USER|__GFP_ZERO|__GFP_ACCOUNT), nodemask=(null) [ 689.678434][T32711] bridge0: port 2(bridge_slave_1) entered disabled state [ 689.687190][T32717] ,cpuset= [ 689.692317][T32711] bridge0: port 1(bridge_slave_0) entered disabled state [ 689.695835][T32717] /,mems_allowed=0-1 [ 689.979654][T32717] CPU: 0 UID: 0 PID: 32717 Comm: syz.3.11736 Not tainted syzkaller #0 PREEMPT(full) [ 689.979683][T32717] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 689.979696][T32717] Call Trace: [ 689.979705][T32717] [ 689.979714][T32717] dump_stack_lvl+0x189/0x250 [ 689.979741][T32717] ? __pfx_rcu_read_unlock_special+0x10/0x10 [ 689.979773][T32717] ? __pfx_dump_stack_lvl+0x10/0x10 [ 689.979794][T32717] ? __pfx__printk+0x10/0x10 [ 689.979819][T32717] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 689.979847][T32717] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 689.979882][T32717] warn_alloc+0x214/0x310 [ 689.979913][T32717] ? __pfx_warn_alloc+0x10/0x10 [ 689.979946][T32717] ? __get_vm_area_node+0x2b5/0x300 [ 689.979975][T32717] __vmalloc_node_range_noprof+0x331/0x12d0 [ 689.979999][T32717] ? __lock_acquire+0x6b6/0x2cf0 [ 689.980041][T32717] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 689.980063][T32717] ? __lock_acquire+0x6b6/0x2cf0 [ 689.980089][T32717] ? bpf_prog_alloc_no_stats+0x4a/0x4d0 [ 689.980110][T32717] __vmalloc_noprof+0xb1/0xf0 [ 689.980132][T32717] ? bpf_prog_alloc_no_stats+0x4a/0x4d0 [ 689.980156][T32717] bpf_prog_alloc_no_stats+0x4a/0x4d0 [ 689.980184][T32717] bpf_prog_alloc+0x3c/0x1a0 [ 689.980209][T32717] bpf_prog_load+0x735/0x1a10 [ 689.980243][T32717] ? __pfx_bpf_prog_load+0x10/0x10 [ 689.980287][T32717] ? bpf_lsm_bpf+0x9/0x20 [ 689.980302][T32717] ? security_bpf+0x7e/0x300 [ 689.980330][T32717] __sys_bpf+0x507/0x860 [ 689.980354][T32717] ? __pfx___sys_bpf+0x10/0x10 [ 689.980391][T32717] ? ksys_write+0x22a/0x250 [ 689.980416][T32717] ? __pfx_ksys_write+0x10/0x10 [ 689.980444][T32717] __x64_sys_bpf+0x7c/0x90 [ 689.980464][T32717] do_syscall_64+0xfa/0xf80 [ 689.980489][T32717] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 689.980506][T32717] ? clear_bhb_loop+0x60/0xb0 [ 689.980529][T32717] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 689.980546][T32717] RIP: 0033:0x7f9baa38f749 [ 689.980563][T32717] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 689.980585][T32717] RSP: 002b:00007f9bab20b038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 689.980606][T32717] RAX: ffffffffffffffda RBX: 00007f9baa5e5fa0 RCX: 00007f9baa38f749 [ 689.980624][T32717] RDX: 0000000000000048 RSI: 00002000000054c0 RDI: 0000000000000005 [ 689.980635][T32717] RBP: 00007f9bab20b090 R08: 0000000000000000 R09: 0000000000000000 [ 689.980647][T32717] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 689.980658][T32717] R13: 00007f9baa5e6038 R14: 00007f9baa5e5fa0 R15: 00007ffdbf3deb68 [ 689.980688][T32717] [ 689.980836][T32717] Mem-Info: [ 690.040788][T32711] batman_adv: batadv0: Interface deactivated: dummy0 [ 690.046710][T32717] active_anon:7420 inactive_anon:0 isolated_anon:0 [ 690.046710][T32717] active_file:3529 inactive_file:40126 isolated_file:0 [ 690.046710][T32717] unevictable:768 dirty:242 writeback:0 [ 690.046710][T32717] slab_reclaimable:12906 slab_unreclaimable:141631 [ 690.046710][T32717] mapped:29218 shmem:1360 pagetables:986 [ 690.046710][T32717] sec_pagetables:0 bounce:0 [ 690.046710][T32717] kernel_misc_reclaimable:0 [ 690.046710][T32717] free:1273030 free_pcp:14496 free_cma:0 [ 690.305721][T32717] Node 0 active_anon:29680kB inactive_anon:0kB active_file:14116kB inactive_file:160300kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:116872kB dirty:968kB writeback:0kB shmem:3904kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:14940kB pagetables:3828kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 690.343628][T32717] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:48kB pagetables:116kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 690.374869][T32717] Node 0 DMA free:15360kB boost:0kB min:204kB low:252kB high:300kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 690.406462][T32717] lowmem_reserve[]: 0 2504 2504 2504 2504 [ 690.412338][T32717] Node 0 DMA32 free:1187484kB boost:0kB min:34308kB low:42884kB high:51460kB reserved_highatomic:0KB free_highatomic:0KB active_anon:29504kB inactive_anon:0kB active_file:14116kB inactive_file:160308kB unevictable:1536kB writepending:972kB zspages:0kB present:3129332kB managed:2564516kB mlocked:0kB bounce:0kB free_pcp:40740kB local_pcp:21088kB free_cma:0kB [ 690.447317][T32717] lowmem_reserve[]: 0 0 0 0 0 [ 690.452133][T32717] Node 0 Normal free:0kB boost:0kB min:0kB low:0kB high:0kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:108kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 690.485869][T32717] lowmem_reserve[]: 0 0 0 0 0 [ 690.490776][T32717] Node 1 Normal free:3889328kB boost:0kB min:55592kB low:69488kB high:83384kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:1536kB writepending:0kB zspages:0kB present:4194300kB managed:4111100kB mlocked:0kB bounce:0kB free_pcp:16928kB local_pcp:8704kB free_cma:0kB [ 690.527054][T32717] lowmem_reserve[]: 0 0 0 0 0 [ 690.530059][T32711] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 690.531879][T32717] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 690.553005][T32711] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 690.560739][T32717] Node 0 DMA32: 555*4kB (UME) 266*8kB (UME) 238*16kB (UME) 412*32kB (UME) 167*64kB (UME) 36*128kB (UME) 7*256kB (UM) 3*512kB (UM) 3*1024kB (ME) 5*2048kB (UME) 277*4096kB (UM) = 1187868kB [ 690.581120][T32717] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 690.593241][T32717] Node 1 Normal: 194*4kB (UE) 59*8kB (UME) 43*16kB (UME) 123*32kB (UME) 35*64kB (UME) 6*128kB (UME) 6*256kB (UME) 4*512kB (UM) 2*1024kB (ME) 2*2048kB (UE) 945*4096kB (M) = 3889328kB [ 690.612605][T32717] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 690.622351][T32717] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 690.632012][T32717] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 690.642796][T32717] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 690.652566][T32717] 45014 total pagecache pages [ 690.657560][T32717] 0 pages in swap cache [ 690.661769][T32717] Free swap = 124996kB [ 690.667212][T32717] Total swap = 124996kB [ 690.671478][T32717] 2097051 pages RAM [ 690.675407][T32717] 0 pages HighMem/MovableOnly [ 690.680164][T32717] 424280 pages reserved [ 690.684583][T32717] 0 pages cma reserved [ 690.728818][T32711] veth3: left promiscuous mode [ 690.742205][T32721] FAULT_INJECTION: forcing a failure. [ 690.742205][T32721] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 690.759552][T32721] CPU: 0 UID: 0 PID: 32721 Comm: syz.3.11738 Not tainted syzkaller #0 PREEMPT(full) [ 690.759582][T32721] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 690.759594][T32721] Call Trace: [ 690.759602][T32721] [ 690.759612][T32721] dump_stack_lvl+0x189/0x250 [ 690.759640][T32721] ? __pfx____ratelimit+0x10/0x10 [ 690.759666][T32721] ? __pfx_dump_stack_lvl+0x10/0x10 [ 690.759688][T32721] ? __pfx__printk+0x10/0x10 [ 690.759730][T32721] should_fail_ex+0x414/0x560 [ 690.759760][T32721] _copy_to_user+0x31/0xb0 [ 690.759792][T32721] simple_read_from_buffer+0xe1/0x170 [ 690.759829][T32721] proc_fail_nth_read+0x1b3/0x220 [ 690.759859][T32721] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 690.759890][T32721] ? rw_verify_area+0x2a6/0x4d0 [ 690.759914][T32721] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 690.759942][T32721] vfs_read+0x200/0xa30 [ 690.759964][T32721] ? fdget_pos+0x247/0x320 [ 690.759987][T32721] ? __pfx___mutex_lock+0x10/0x10 [ 690.760015][T32721] ? __pfx_vfs_read+0x10/0x10 [ 690.760042][T32721] ? __fget_files+0x2a/0x420 [ 690.760065][T32721] ? __fget_files+0x3a0/0x420 [ 690.760081][T32721] ? __fget_files+0x2a/0x420 [ 690.760110][T32721] ksys_read+0x145/0x250 [ 690.760137][T32721] ? __pfx_ksys_read+0x10/0x10 [ 690.760167][T32721] ? do_syscall_64+0xbe/0xf80 [ 690.760198][T32721] do_syscall_64+0xfa/0xf80 [ 690.760226][T32721] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 690.760246][T32721] ? clear_bhb_loop+0x60/0xb0 [ 690.760272][T32721] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 690.760291][T32721] RIP: 0033:0x7f9baa38e15c [ 690.760311][T32721] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 690.760328][T32721] RSP: 002b:00007f9bab20b030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 690.760350][T32721] RAX: ffffffffffffffda RBX: 00007f9baa5e5fa0 RCX: 00007f9baa38e15c [ 690.760365][T32721] RDX: 000000000000000f RSI: 00007f9bab20b0a0 RDI: 0000000000000004 [ 690.760378][T32721] RBP: 00007f9bab20b090 R08: 0000000000000000 R09: 0000000000000000 [ 690.760390][T32721] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 690.760402][T32721] R13: 00007f9baa5e6038 R14: 00007f9baa5e5fa0 R15: 00007ffdbf3deb68 [ 690.760438][T32721] [ 690.762357][T32711] mac80211_hwsim hwsim21 syzkaller0: left promiscuous mode [ 690.999419][T32711] mac80211_hwsim hwsim21 syzkaller0: left allmulticast mode [ 691.002145][T32728] xt_addrtype: ipv6 PROHIBIT (THROW, NAT ..) matching not supported [ 691.108770][T32687] netdevsim netdevsim5 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 691.125015][T32687] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 691.132075][T32732] FAULT_INJECTION: forcing a failure. [ 691.132075][T32732] name failslab, interval 1, probability 0, space 0, times 0 [ 691.153655][T32732] CPU: 0 UID: 0 PID: 32732 Comm: syz.7.11743 Not tainted syzkaller #0 PREEMPT(full) [ 691.153683][T32732] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 691.153696][T32732] Call Trace: [ 691.153704][T32732] [ 691.153712][T32732] dump_stack_lvl+0x189/0x250 [ 691.153740][T32732] ? __pfx____ratelimit+0x10/0x10 [ 691.153764][T32732] ? __pfx_dump_stack_lvl+0x10/0x10 [ 691.153786][T32732] ? __pfx__printk+0x10/0x10 [ 691.153818][T32732] ? __pfx___might_resched+0x10/0x10 [ 691.153837][T32732] ? fs_reclaim_acquire+0x7d/0x100 [ 691.153868][T32732] should_fail_ex+0x414/0x560 [ 691.153894][T32732] should_failslab+0xa8/0x100 [ 691.153923][T32732] __kmalloc_cache_node_noprof+0x74/0x6f0 [ 691.153925][ T4523] netdevsim netdevsim6 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 691.153950][T32732] ? __get_vm_area_node+0x13f/0x300 [ 691.153979][T32732] __get_vm_area_node+0x13f/0x300 [ 691.154005][T32732] __vmalloc_node_range_noprof+0x30c/0x12d0 [ 691.154031][T32732] ? bpf_prog_alloc_no_stats+0x4a/0x4d0 [ 691.154060][T32732] ? __lock_acquire+0x6b6/0x2cf0 [ 691.154112][T32732] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 691.154138][T32732] ? __lock_acquire+0x6b6/0x2cf0 [ 691.154170][T32732] ? bpf_prog_alloc_no_stats+0x4a/0x4d0 [ 691.154195][T32732] __vmalloc_noprof+0xb1/0xf0 [ 691.154226][T32732] ? bpf_prog_alloc_no_stats+0x4a/0x4d0 [ 691.154257][T32732] bpf_prog_alloc_no_stats+0x4a/0x4d0 [ 691.154291][T32732] bpf_prog_alloc+0x3c/0x1a0 [ 691.154320][T32732] bpf_prog_load+0x735/0x1a10 [ 691.154363][T32732] ? __pfx_bpf_prog_load+0x10/0x10 [ 691.154414][T32732] ? bpf_lsm_bpf+0x9/0x20 [ 691.154434][T32732] ? security_bpf+0x7e/0x300 [ 691.154477][T32732] __sys_bpf+0x507/0x860 [ 691.154505][T32732] ? __pfx___sys_bpf+0x10/0x10 [ 691.154549][T32732] ? ksys_write+0x22a/0x250 [ 691.154579][T32732] ? __pfx_ksys_write+0x10/0x10 [ 691.154613][T32732] __x64_sys_bpf+0x7c/0x90 [ 691.154637][T32732] do_syscall_64+0xfa/0xf80 [ 691.154668][T32732] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 691.154688][T32732] ? clear_bhb_loop+0x60/0xb0 [ 691.154715][T32732] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 691.154736][T32732] RIP: 0033:0x7f5809f8f749 [ 691.154755][T32732] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 691.154774][T32732] RSP: 002b:00007f58081ee038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 691.154798][T32732] RAX: ffffffffffffffda RBX: 00007f580a1e5fa0 RCX: 00007f5809f8f749 [ 691.154813][T32732] RDX: 0000000000000090 RSI: 00002000000002c0 RDI: 0000000000000005 [ 691.154828][T32732] RBP: 00007f58081ee090 R08: 0000000000000000 R09: 0000000000000000 [ 691.154841][T32732] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 691.154854][T32732] R13: 00007f580a1e6038 R14: 00007f580a1e5fa0 R15: 00007fff35846ef8 [ 691.154891][T32732] [ 691.415900][T32740] FAULT_INJECTION: forcing a failure. [ 691.415900][T32740] name failslab, interval 1, probability 0, space 0, times 0 [ 691.425415][ T4523] netdevsim netdevsim6 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 691.433442][T32740] CPU: 0 UID: 0 PID: 32740 Comm: syz.8.11746 Not tainted syzkaller #0 PREEMPT(full) [ 691.433472][T32740] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 691.433488][T32740] Call Trace: [ 691.433496][T32740] [ 691.433506][T32740] dump_stack_lvl+0x189/0x250 [ 691.433536][T32740] ? __pfx____ratelimit+0x10/0x10 [ 691.433564][T32740] ? __pfx_dump_stack_lvl+0x10/0x10 [ 691.433589][T32740] ? __pfx__printk+0x10/0x10 [ 691.433622][T32740] ? __pfx___might_resched+0x10/0x10 [ 691.433647][T32740] ? fs_reclaim_acquire+0x7d/0x100 [ 691.433682][T32740] should_fail_ex+0x414/0x560 [ 691.433713][T32740] should_failslab+0xa8/0x100 [ 691.433747][T32740] kmem_cache_alloc_node_noprof+0x77/0x710 [ 691.433777][T32740] ? __alloc_skb+0x255/0x430 [ 691.433813][T32740] ? napi_skb_cache_get+0x4a5/0x780 [ 691.433843][T32740] ? napi_skb_cache_get+0x151/0x780 [ 691.433877][T32740] __alloc_skb+0x255/0x430 [ 691.433912][T32740] ? __pfx___alloc_skb+0x10/0x10 [ 691.433946][T32740] ? netlink_autobind+0xdb/0x300 [ 691.433966][T32740] ? netlink_autobind+0x2c2/0x300 [ 691.433994][T32740] netlink_sendmsg+0x5c6/0xb30 [ 691.434027][T32740] ? __pfx_netlink_sendmsg+0x10/0x10 [ 691.434054][T32740] ? aa_sock_msg_perm+0xf1/0x1b0 [ 691.434079][T32740] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 691.434109][T32740] ? __pfx_netlink_sendmsg+0x10/0x10 [ 691.434132][T32740] __sock_sendmsg+0x21c/0x270 [ 691.434164][T32740] ____sys_sendmsg+0x505/0x820 [ 691.434207][T32740] ? __pfx_____sys_sendmsg+0x10/0x10 [ 691.434252][T32740] ? import_iovec+0x74/0xa0 [ 691.434305][T32740] ___sys_sendmsg+0x21f/0x2a0 [ 691.434342][T32740] ? __pfx____sys_sendmsg+0x10/0x10 [ 691.434384][T32740] ? rcu_read_lock_any_held+0xb3/0x120 [ 691.434452][T32740] ? __fget_files+0x2a/0x420 [ 691.434472][T32740] ? __fget_files+0x3a0/0x420 [ 691.434503][T32740] __x64_sys_sendmsg+0x19b/0x260 [ 691.434541][T32740] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 691.434589][T32740] ? __pfx_ksys_write+0x10/0x10 [ 691.434622][T32740] ? do_syscall_64+0xbe/0xf80 [ 691.434657][T32740] do_syscall_64+0xfa/0xf80 [ 691.434689][T32740] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 691.434711][T32740] ? clear_bhb_loop+0x60/0xb0 [ 691.434738][T32740] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 691.434761][T32740] RIP: 0033:0x7f70a618f749 [ 691.434781][T32740] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 691.434800][T32740] RSP: 002b:00007f70a70bc038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 691.434826][T32740] RAX: ffffffffffffffda RBX: 00007f70a63e5fa0 RCX: 00007f70a618f749 [ 691.434843][T32740] RDX: 000000000000c000 RSI: 0000200000000080 RDI: 0000000000000003 [ 691.434857][T32740] RBP: 00007f70a70bc090 R08: 0000000000000000 R09: 0000000000000000 [ 691.434872][T32740] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 691.434884][T32740] R13: 00007f70a63e6038 R14: 00007f70a63e5fa0 R15: 00007ffd1f1874f8 [ 691.434922][T32740] [ 691.771343][ T4523] netdevsim netdevsim6 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 691.780368][ T4523] netdevsim netdevsim6 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 691.794654][ T7068] netdevsim netdevsim6 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 691.803741][ T7068] netdevsim netdevsim6 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 691.813497][ T7068] netdevsim netdevsim6 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 691.823403][ T7068] netdevsim netdevsim6 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 691.832594][T32734] tipc: Enabling of bearer rejected, already enabled [ 691.912617][T32687] netdevsim netdevsim5 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 691.944383][T32687] netdevsim netdevsim5 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 692.001373][T32756] mac80211_hwsim hwsim21 syzkaller0: entered promiscuous mode [ 692.026854][T32756] mac80211_hwsim hwsim21 syzkaller0: entered allmulticast mode [ 692.227870][ T36] netdevsim netdevsim5 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 692.240908][ T36] netdevsim netdevsim5 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 692.308322][T31671] netdevsim netdevsim5 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 692.326983][T31671] netdevsim netdevsim5 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 692.359311][T31671] netdevsim netdevsim5 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 692.368623][T31671] netdevsim netdevsim5 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 692.409592][T31671] netdevsim netdevsim5 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 692.425951][T31671] netdevsim netdevsim5 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 692.579335][ T1097] netdevsim netdevsim8 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 692.596130][ T1097] netdevsim netdevsim8 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 692.615522][ T316] ip6tnl0: Caught tx_queue_len zero misconfig [ 692.647030][ T1097] netdevsim netdevsim8 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 692.667770][ T1097] netdevsim netdevsim8 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 692.688034][ T316] net_ratelimit: 11 callbacks suppressed [ 692.688053][ T316] openvswitch: netlink: VXLAN extension 30 out of range max 1 [ 692.736137][ T323] tipc: Enabled bearer , priority 0 [ 692.756135][ T323] syzkaller0: entered promiscuous mode [ 692.762784][ T323] syzkaller0: entered allmulticast mode [ 692.828734][ T323] tipc: Resetting bearer [ 692.864838][ T322] tipc: Resetting bearer [ 692.925030][ T322] tipc: Disabling bearer [ 693.095639][ T336] nbd4: detected capacity change from 0 to 127 [ 693.110621][ T341] block nbd4: Send control failed (result -32) [ 693.110642][T30498] block nbd4: Receive control failed (result -32) [ 693.126444][ T341] block nbd4: Request send failed, requeueing [ 693.154309][ T11] block nbd4: Dead connection, failed to find a fallback [ 693.164078][ T11] block nbd4: shutting down sockets [ 693.173665][ T341] blk_print_req_error: 138 callbacks suppressed [ 693.173685][ T341] I/O error, dev nbd4, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 693.190957][ T11] I/O error, dev nbd4, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 693.202263][ T11] buffer_io_error: 138 callbacks suppressed [ 693.202281][ T11] Buffer I/O error on dev nbd4, logical block 0, async page read [ 693.216576][ T341] Buffer I/O error on dev nbd4, logical block 1, async page read [ 693.225258][ T341] I/O error, dev nbd4, sector 4 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 693.237047][ T341] Buffer I/O error on dev nbd4, logical block 2, async page read [ 693.245202][ T341] I/O error, dev nbd4, sector 6 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 693.255460][ T341] Buffer I/O error on dev nbd4, logical block 3, async page read [ 693.263424][ T341] I/O error, dev nbd4, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 693.272797][ T341] Buffer I/O error on dev nbd4, logical block 0, async page read [ 693.280961][ T341] I/O error, dev nbd4, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 693.292871][ T341] Buffer I/O error on dev nbd4, logical block 1, async page read [ 693.301046][ T341] I/O error, dev nbd4, sector 4 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 693.310500][ T341] Buffer I/O error on dev nbd4, logical block 2, async page read [ 693.319162][ T341] I/O error, dev nbd4, sector 6 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 693.328984][ T341] Buffer I/O error on dev nbd4, logical block 3, async page read [ 693.349089][ T341] I/O error, dev nbd4, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 693.368522][ T341] Buffer I/O error on dev nbd4, logical block 0, async page read [ 693.386125][ T341] I/O error, dev nbd4, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 693.402314][ T341] Buffer I/O error on dev nbd4, logical block 1, async page read [ 693.447777][ T341] ldm_validate_partition_table(): Disk read failed. [ 693.459826][ T351] netlink: 16 bytes leftover after parsing attributes in process `syz.6.11768'. [ 693.478713][ T341] Dev nbd4: unable to read RDB block 0 [ 693.502428][ T351] bond0: entered promiscuous mode [ 693.516582][ T341] nbd4: unable to read partition table [ 693.531606][ T341] ldm_validate_partition_table(): Disk read failed. [ 693.556180][ T351] bond_slave_0: entered promiscuous mode [ 693.562147][ T351] bond_slave_1: entered promiscuous mode [ 693.572542][ T341] Dev nbd4: unable to read RDB block 0 [ 693.589026][ T341] nbd4: unable to read partition table [ 693.596071][ T351] ip6gretap0: entered promiscuous mode [ 693.609062][ T351] hsr1: entered promiscuous mode [ 693.650139][ T362] sctp: [Deprecated]: syz.5.11770 (pid 362) Use of int in max_burst socket option deprecated. [ 693.650139][ T362] Use struct sctp_assoc_value instead [ 693.666541][ T362] FAULT_INJECTION: forcing a failure. [ 693.666541][ T362] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 693.698403][ T362] CPU: 0 UID: 0 PID: 362 Comm: syz.5.11770 Not tainted syzkaller #0 PREEMPT(full) [ 693.698433][ T362] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 693.698445][ T362] Call Trace: [ 693.698454][ T362] [ 693.698463][ T362] dump_stack_lvl+0x189/0x250 [ 693.698491][ T362] ? __pfx____ratelimit+0x10/0x10 [ 693.698519][ T362] ? __pfx_dump_stack_lvl+0x10/0x10 [ 693.698541][ T362] ? __pfx__printk+0x10/0x10 [ 693.698584][ T362] should_fail_ex+0x414/0x560 [ 693.698613][ T362] _copy_to_user+0x31/0xb0 [ 693.698646][ T362] simple_read_from_buffer+0xe1/0x170 [ 693.698683][ T362] proc_fail_nth_read+0x1b3/0x220 [ 693.698714][ T362] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 693.698746][ T362] ? rw_verify_area+0x2a6/0x4d0 [ 693.698770][ T362] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 693.698800][ T362] vfs_read+0x200/0xa30 [ 693.698824][ T362] ? fdget_pos+0x247/0x320 [ 693.698848][ T362] ? __pfx___mutex_lock+0x10/0x10 [ 693.698876][ T362] ? __pfx_vfs_read+0x10/0x10 [ 693.698904][ T362] ? __fget_files+0x2a/0x420 [ 693.698928][ T362] ? __fget_files+0x3a0/0x420 [ 693.698945][ T362] ? __fget_files+0x2a/0x420 [ 693.699002][ T362] ksys_read+0x145/0x250 [ 693.699031][ T362] ? __pfx_ksys_read+0x10/0x10 [ 693.699061][ T362] ? do_syscall_64+0xbe/0xf80 [ 693.699092][ T362] do_syscall_64+0xfa/0xf80 [ 693.699121][ T362] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 693.699141][ T362] ? clear_bhb_loop+0x60/0xb0 [ 693.699167][ T362] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 693.699187][ T362] RIP: 0033:0x7f2e0c98e15c [ 693.699206][ T362] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 693.699223][ T362] RSP: 002b:00007f2e0d767030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 693.699247][ T362] RAX: ffffffffffffffda RBX: 00007f2e0cbe6090 RCX: 00007f2e0c98e15c [ 693.699261][ T362] RDX: 000000000000000f RSI: 00007f2e0d7670a0 RDI: 0000000000000005 [ 693.699274][ T362] RBP: 00007f2e0d767090 R08: 0000000000000000 R09: 0000000000000000 [ 693.699286][ T362] R10: 00002000000001c0 R11: 0000000000000246 R12: 0000000000000001 [ 693.699300][ T362] R13: 00007f2e0cbe6128 R14: 00007f2e0cbe6090 R15: 00007ffcfacdade8 [ 693.699335][ T362] [ 694.019185][ T366] netlink: 4 bytes leftover after parsing attributes in process `syz.3.11773'. [ 694.234137][ T382] netlink: 8 bytes leftover after parsing attributes in process `syz.5.11775'. [ 694.482205][ T389] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 694.511497][ T394] netlink: 8 bytes leftover after parsing attributes in process `syz.6.11783'. [ 694.521132][ T394] IPVS: set_ctl: invalid protocol: 60 10.1.1.2:20002 [ 694.642824][ T407] sctp: [Deprecated]: syz.7.11786 (pid 407) Use of int in max_burst socket option deprecated. [ 694.642824][ T407] Use struct sctp_assoc_value instead [ 694.753668][ T412] netlink: 12 bytes leftover after parsing attributes in process `syz.6.11789'. [ 694.872151][ T416] FAULT_INJECTION: forcing a failure. [ 694.872151][ T416] name failslab, interval 1, probability 0, space 0, times 0 [ 694.893057][ T416] CPU: 1 UID: 0 PID: 416 Comm: syz.5.11792 Not tainted syzkaller #0 PREEMPT(full) [ 694.893087][ T416] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 694.893100][ T416] Call Trace: [ 694.893108][ T416] [ 694.893117][ T416] dump_stack_lvl+0x189/0x250 [ 694.893146][ T416] ? __pfx____ratelimit+0x10/0x10 [ 694.893172][ T416] ? __pfx_dump_stack_lvl+0x10/0x10 [ 694.893195][ T416] ? __pfx__printk+0x10/0x10 [ 694.893219][ T416] ? kmalloc_reserve+0xbd/0x290 [ 694.893252][ T416] ? __lock_acquire+0x6b6/0x2cf0 [ 694.893282][ T416] should_fail_ex+0x414/0x560 [ 694.893312][ T416] should_failslab+0xa8/0x100 [ 694.893344][ T416] kmem_cache_alloc_noprof+0x74/0x6f0 [ 694.893369][ T416] ? skb_clone+0x212/0x3a0 [ 694.893394][ T416] skb_clone+0x212/0x3a0 [ 694.893417][ T416] __netlink_deliver_tap+0x404/0x850 [ 694.893449][ T416] ? netlink_deliver_tap+0x2e/0x1b0 [ 694.893470][ T416] netlink_deliver_tap+0x19c/0x1b0 [ 694.893491][ T416] netlink_unicast+0x7fa/0x9e0 [ 694.893530][ T416] ? __pfx_netlink_unicast+0x10/0x10 [ 694.893562][ T416] ? netlink_sendmsg+0x642/0xb30 [ 694.893581][ T416] ? skb_put+0x11b/0x210 [ 694.893615][ T416] netlink_sendmsg+0x805/0xb30 [ 694.893646][ T416] ? __pfx_netlink_sendmsg+0x10/0x10 [ 694.893671][ T416] ? aa_sock_msg_perm+0xf1/0x1b0 [ 694.893693][ T416] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 694.893721][ T416] ? __pfx_netlink_sendmsg+0x10/0x10 [ 694.893743][ T416] __sock_sendmsg+0x21c/0x270 [ 694.893770][ T416] ____sys_sendmsg+0x505/0x820 [ 694.893813][ T416] ? __pfx_____sys_sendmsg+0x10/0x10 [ 694.893854][ T416] ? import_iovec+0x74/0xa0 [ 694.893895][ T416] ___sys_sendmsg+0x21f/0x2a0 [ 694.893929][ T416] ? __pfx____sys_sendmsg+0x10/0x10 [ 694.893967][ T416] ? rcu_read_lock_any_held+0xb3/0x120 [ 694.894020][ T416] ? __fget_files+0x2a/0x420 [ 694.894037][ T416] ? __fget_files+0x3a0/0x420 [ 694.894065][ T416] __x64_sys_sendmsg+0x19b/0x260 [ 694.894099][ T416] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 694.894139][ T416] ? __pfx_ksys_write+0x10/0x10 [ 694.894167][ T416] ? do_syscall_64+0xbe/0xf80 [ 694.894197][ T416] do_syscall_64+0xfa/0xf80 [ 694.894222][ T416] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 694.894242][ T416] ? clear_bhb_loop+0x60/0xb0 [ 694.894266][ T416] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 694.894285][ T416] RIP: 0033:0x7f2e0c98f749 [ 694.894304][ T416] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 694.894321][ T416] RSP: 002b:00007f2e0d788038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 694.894344][ T416] RAX: ffffffffffffffda RBX: 00007f2e0cbe5fa0 RCX: 00007f2e0c98f749 [ 694.894359][ T416] RDX: 000000000000c000 RSI: 0000200000000080 RDI: 0000000000000003 [ 694.894372][ T416] RBP: 00007f2e0d788090 R08: 0000000000000000 R09: 0000000000000000 [ 694.894384][ T416] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 694.894396][ T416] R13: 00007f2e0cbe6038 R14: 00007f2e0cbe5fa0 R15: 00007ffcfacdade8 [ 694.894432][ T416] [ 695.259261][ T424] netlink: 16186 bytes leftover after parsing attributes in process `syz.8.11791'. [ 695.393179][ T433] FAULT_INJECTION: forcing a failure. [ 695.393179][ T433] name failslab, interval 1, probability 0, space 0, times 0 [ 695.438388][ T433] CPU: 1 UID: 0 PID: 433 Comm: syz.5.11798 Not tainted syzkaller #0 PREEMPT(full) [ 695.438419][ T433] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 695.438432][ T433] Call Trace: [ 695.438440][ T433] [ 695.438449][ T433] dump_stack_lvl+0x189/0x250 [ 695.438478][ T433] ? __pfx____ratelimit+0x10/0x10 [ 695.438503][ T433] ? __pfx_dump_stack_lvl+0x10/0x10 [ 695.438527][ T433] ? __pfx__printk+0x10/0x10 [ 695.438561][ T433] ? __pfx___might_resched+0x10/0x10 [ 695.438583][ T433] ? fs_reclaim_acquire+0x7d/0x100 [ 695.438617][ T433] should_fail_ex+0x414/0x560 [ 695.438646][ T433] should_failslab+0xa8/0x100 [ 695.438678][ T433] kmem_cache_alloc_lru_noprof+0x79/0x6d0 [ 695.438704][ T433] ? __d_alloc+0x37/0x6f0 [ 695.438731][ T433] __d_alloc+0x37/0x6f0 [ 695.438758][ T433] d_alloc_pseudo+0x21/0xc0 [ 695.438781][ T433] alloc_file_pseudo+0xcc/0x210 [ 695.438826][ T433] ? __pfx_alloc_file_pseudo+0x10/0x10 [ 695.438854][ T433] ? alloc_fd+0x64c/0x6c0 [ 695.438888][ T433] sock_alloc_file+0xb8/0x2e0 [ 695.438908][ T433] ? __sys_socket+0x12e/0x320 [ 695.438934][ T433] __sys_socket+0x13e/0x320 [ 695.438965][ T433] __x64_sys_socket+0x7a/0x90 [ 695.438991][ T433] do_syscall_64+0xfa/0xf80 [ 695.439018][ T433] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 695.439035][ T433] ? clear_bhb_loop+0x60/0xb0 [ 695.439055][ T433] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 695.439071][ T433] RIP: 0033:0x7f2e0c98f749 [ 695.439092][ T433] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 695.439106][ T433] RSP: 002b:00007f2e0d788038 EFLAGS: 00000246 ORIG_RAX: 0000000000000029 [ 695.439124][ T433] RAX: ffffffffffffffda RBX: 00007f2e0cbe5fa0 RCX: 00007f2e0c98f749 [ 695.439136][ T433] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000028 [ 695.439146][ T433] RBP: 00007f2e0d788090 R08: 0000000000000000 R09: 0000000000000000 [ 695.439156][ T433] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 695.439166][ T433] R13: 00007f2e0cbe6038 R14: 00007f2e0cbe5fa0 R15: 00007ffcfacdade8 [ 695.439193][ T433] [ 695.439346][ T433] VFS_BUG_ON_INODE(inode_state_read_once(inode) & I_CLEAR) encountered for inode ffff888055eb2900 [ 695.439346][ T433] fs sockfs mode 140777 opflags 0x8 flags 0x0 state 0x300 count 0 [ 695.542885][ T440] FAULT_INJECTION: forcing a failure. [ 695.542885][ T440] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 695.543538][ T433] ------------[ cut here ]------------ [ 695.559381][ T432] mac80211_hwsim hwsim21 syzkaller0: left promiscuous mode [ 695.561823][ T433] kernel BUG at fs/inode.c:1971! [ 695.562007][ T433] Oops: invalid opcode: 0000 [#1] SMP KASAN PTI [ 695.713436][ T433] CPU: 1 UID: 0 PID: 433 Comm: syz.5.11798 Not tainted syzkaller #0 PREEMPT(full) [ 695.722736][ T433] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 695.732806][ T433] RIP: 0010:iput+0xfc9/0x1030 [ 695.737498][ T433] Code: 8b 7c 24 18 48 c7 c6 a0 df 79 8b e8 e1 58 e8 fe 90 0f 0b e8 e9 6b 81 ff 48 8b 7c 24 18 48 c7 c6 40 df 79 8b e8 c8 58 e8 fe 90 <0f> 0b 44 89 e9 80 e1 07 80 c1 03 38 c1 0f 8c cd fb ff ff 4c 89 ef [ 695.757115][ T433] RSP: 0018:ffffc9001c97fde8 EFLAGS: 00010282 [ 695.763200][ T433] RAX: 000000000000009f RBX: dffffc0000000000 RCX: c2b7c90ed7be8300 [ 695.771181][ T433] RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000 [ 695.779166][ T433] RBP: 1ffffffff1ed61ce R08: ffffc9001c97faa7 R09: 1ffff9200392ff54 [ 695.787144][ T433] R10: dffffc0000000000 R11: fffff5200392ff55 R12: 1ffff1100abd6560 [ 695.795139][ T433] R13: ffff888055eb2b00 R14: 0000000000000200 R15: 1ffffffff1f01152 [ 695.803113][ T433] FS: 00007f2e0d7886c0(0000) GS:ffff8881261b1000(0000) knlGS:0000000000000000 [ 695.812097][ T433] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 695.818686][ T433] CR2: 000000110c2e6610 CR3: 000000002bbb8000 CR4: 00000000003526f0 [ 695.826682][ T433] Call Trace: [ 695.829974][ T433] [ 695.832918][ T433] ? do_raw_spin_unlock+0x122/0x240 [ 695.838134][ T433] __sys_socket+0x2bf/0x320 [ 695.842653][ T433] __x64_sys_socket+0x7a/0x90 [ 695.847340][ T433] do_syscall_64+0xfa/0xf80 [ 695.851853][ T433] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 695.857924][ T433] ? clear_bhb_loop+0x60/0xb0 [ 695.862612][ T433] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 695.868518][ T433] RIP: 0033:0x7f2e0c98f749 [ 695.872942][ T433] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 695.892569][ T433] RSP: 002b:00007f2e0d788038 EFLAGS: 00000246 ORIG_RAX: 0000000000000029 [ 695.901011][ T433] RAX: ffffffffffffffda RBX: 00007f2e0cbe5fa0 RCX: 00007f2e0c98f749 [ 695.908994][ T433] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000028 [ 695.916978][ T433] RBP: 00007f2e0d788090 R08: 0000000000000000 R09: 0000000000000000 [ 695.924958][ T433] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 695.932936][ T433] R13: 00007f2e0cbe6038 R14: 00007f2e0cbe5fa0 R15: 00007ffcfacdade8 [ 695.940925][ T433] [ 695.943969][ T433] Modules linked in: [ 695.951819][ T433] ---[ end trace 0000000000000000 ]--- [ 695.964372][ T433] RIP: 0010:iput+0xfc9/0x1030 [ 695.971281][ T433] Code: 8b 7c 24 18 48 c7 c6 a0 df 79 8b e8 e1 58 e8 fe 90 0f 0b e8 e9 6b 81 ff 48 8b 7c 24 18 48 c7 c6 40 df 79 8b e8 c8 58 e8 fe 90 <0f> 0b 44 89 e9 80 e1 07 80 c1 03 38 c1 0f 8c cd fb ff ff 4c 89 ef [ 695.974535][ T440] CPU: 1 UID: 0 PID: 440 Comm: syz.7.11800 Tainted: G D syzkaller #0 PREEMPT(full) [ 695.974570][ T440] Tainted: [D]=DIE [ 695.974578][ T440] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 695.974593][ T440] Call Trace: [ 695.974600][ T440] [ 695.974610][ T440] dump_stack_lvl+0x189/0x250 [ 695.974639][ T440] ? __pfx____ratelimit+0x10/0x10 [ 695.974666][ T440] ? __pfx_dump_stack_lvl+0x10/0x10 [ 695.974690][ T440] ? __pfx__printk+0x10/0x10 [ 695.974719][ T440] ? __might_fault+0xb0/0x130 [ 695.974751][ T440] should_fail_ex+0x414/0x560 [ 695.974780][ T440] _copy_from_user+0x2d/0xb0 [ 695.974810][ T440] btf_new_fd+0x33f/0xc90 [ 695.974840][ T440] ? apparmor_capable+0x137/0x1a0 [ 695.974872][ T440] ? __pfx_btf_new_fd+0x10/0x10 [ 695.974902][ T440] ? bpf_token_put+0x143/0x160 [ 695.974935][ T440] ? bpf_btf_load+0x126/0x190 [ 695.974963][ T440] __sys_bpf+0x3ed/0x860 [ 695.974990][ T440] ? __pfx___sys_bpf+0x10/0x10 [ 695.975024][ T440] ? ksys_write+0x22a/0x250 [ 695.975061][ T440] ? __pfx_ksys_write+0x10/0x10 [ 695.975090][ T440] __x64_sys_bpf+0x7c/0x90 [ 695.975114][ T440] do_syscall_64+0xfa/0xf80 [ 695.975141][ T440] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 695.975164][ T440] ? clear_bhb_loop+0x60/0xb0 [ 695.975188][ T440] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 695.975208][ T440] RIP: 0033:0x7f5809f8f749 [ 695.975228][ T440] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 695.975248][ T440] RSP: 002b:00007f58081ee038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 695.975273][ T440] RAX: ffffffffffffffda RBX: 00007f580a1e5fa0 RCX: 00007f5809f8f749 [ 695.975289][ T440] RDX: 0000000000000020 RSI: 00002000000004c0 RDI: 0000000000000012 [ 695.975303][ T440] RBP: 00007f58081ee090 R08: 0000000000000000 R09: 0000000000000000 [ 695.975319][ T440] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 695.975331][ T440] R13: 00007f580a1e6038 R14: 00007f580a1e5fa0 R15: 00007fff35846ef8 [ 695.975357][ T440] [ 695.975589][ T432] mac80211_hwsim hwsim21 syzkaller0: left allmulticast mode [ 695.998864][ T433] RSP: 0018:ffffc9001c97fde8 EFLAGS: 00010282 [ 696.217550][ T433] RAX: 000000000000009f RBX: dffffc0000000000 RCX: c2b7c90ed7be8300 [ 696.226572][ T433] RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000 [ 696.235197][ T433] RBP: 1ffffffff1ed61ce R08: ffffc9001c97faa7 R09: 1ffff9200392ff54 [ 696.243214][ T433] R10: dffffc0000000000 R11: fffff5200392ff55 R12: 1ffff1100abd6560 [ 696.251557][ T433] R13: ffff888055eb2b00 R14: 0000000000000200 R15: 1ffffffff1f01152 [ 696.259631][ T433] FS: 00007f2e0d7886c0(0000) GS:ffff8881260b1000(0000) knlGS:0000000000000000 [ 696.269051][ T433] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 696.275786][ T433] CR2: 0000001b34418ff8 CR3: 000000002bbb8000 CR4: 00000000003526f0 [ 696.283824][ T433] Kernel panic - not syncing: Fatal exception [ 696.290372][ T433] Kernel Offset: disabled [ 696.294720][ T433] Rebooting in 86400 seconds..