last executing test programs: 4.498272472s ago: executing program 0 (id=7264): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000300), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000400)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_AUTHENTICATE(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x3c, r1, 0x1, 0x20000002, 0x25dfdbff, {{}, {@val={0x8, 0x3, r3}, @void}}, [@key_params=[@NL80211_ATTR_MAC={0xa, 0x6, @broadcast}], @NL80211_ATTR_AUTH_TYPE={0x8}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @key_params]}, 0x3c}, 0x1, 0x0, 0x0, 0x20040040}, 0x0) 4.304539048s ago: executing program 0 (id=7267): socket$xdp(0x2c, 0x3, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'xcbc(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000140)="2c385aa3d49100dc6626c892b6bc436a", 0x10) r1 = accept4(r0, 0x0, 0x0, 0x80800) sendmmsg$inet6(r1, &(0x7f0000002300)=[{{0x0, 0x0, &(0x7f0000001fc0)=[{&(0x7f00000001c0)="2bcc8aad42e22e25fbfbe6b468f7cda43cce7c06272bafbfdd37d8e72097bb3fd8e8f7d840727a020e0a5acaa9397617d488e83429fd968d72e1593e28eab9a219452dda9d16bfcd2da085cca1b2c75e", 0x50}, {&(0x7f00000002c0)='E', 0x1}], 0x2}}], 0x1, 0x44051) r2 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(r2, 0x11b, 0x6, &(0x7f0000000080)=0x1000000, 0x4) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r4, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x3, &(0x7f0000000000)=[{0x20, 0x0, 0x0, 0xfffff010}, {0x20, 0x0, 0x0, 0xfffff00c}, {0x6}]}, 0x10) sendmsg$nl_route_sched(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000001000)=@delchain={0x24, 0x65, 0x400, 0x70bd26, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {0xfff1, 0xffe0}, {0x5, 0xb}, {0x0, 0xb}}}, 0x33fe0}, 0x1, 0x0, 0x0, 0x20008000}, 0x4000) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0b00000007000000010001000900000001"], 0x48) sendmsg$NFT_BATCH(r1, &(0x7f0000000f40)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000f00)={&(0x7f0000001040)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_DELOBJ={0x2c, 0x14, 0xa, 0x101, 0x0, 0x0, {0x2, 0x0, 0x5}, [@NFTA_OBJ_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_OBJ_NAME={0x9, 0x2, 'syz1\x00'}]}, @NFT_MSG_NEWTABLE={0xb0, 0x0, 0xa, 0x101, 0x0, 0x0, {0x5, 0x0, 0x6}, [@NFTA_TABLE_HANDLE={0xc, 0x4, 0x1, 0x0, 0x1}, @NFTA_TABLE_FLAGS={0x8, 0x2, 0x1, 0x0, 0x1}, @NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}, @NFTA_TABLE_USERDATA={0x73, 0x6, "cae5c823e1ec5c56ea02726817d8c979972983d180c74493eebf0a8f0b7a29bd47f7861acdf72914b889e88740c4bef4c78d9b2b5b5652b3a0244be150107a94cc13fdd8f0a8f2c9977a1eb5c82e43b605e84c1522263c96e2d22556364b0d54cdcb9756e54bf413816672444a878e"}, @NFTA_TABLE_FLAGS={0x8, 0x2, 0x1, 0x0, 0x3}]}, @NFT_MSG_NEWFLOWTABLE={0x140, 0x16, 0xa, 0x801, 0x0, 0x0, {0x0, 0x0, 0x8}, [@NFTA_FLOWTABLE_HOOK={0x88, 0x3, 0x0, 0x1, [@NFTA_FLOWTABLE_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x6}, @NFTA_FLOWTABLE_HOOK_DEVS={0x2c, 0x3, 0x0, 0x1, [{0x14, 0x1, 'pimreg1\x00'}, {0x14, 0x1, 'veth1_macvtap\x00'}]}, @NFTA_FLOWTABLE_HOOK_DEVS={0x40, 0x3, 0x0, 0x1, [{0x14, 0x1, 'caif0\x00'}, {0x14, 0x1, 'ip6gre0\x00'}, {0x14, 0x1, 'lo\x00'}]}, @NFTA_FLOWTABLE_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x10001}, @NFTA_FLOWTABLE_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x9}]}, @NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_FLOWTABLE_FLAGS={0x8, 0x7, 0x1, 0x0, 0x1}, @NFTA_FLOWTABLE_HANDLE={0xc, 0x5, 0x1, 0x0, 0x3}, @NFTA_FLOWTABLE_HOOK={0x6c, 0x3, 0x0, 0x1, [@NFTA_FLOWTABLE_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x401}, @NFTA_FLOWTABLE_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x8}, @NFTA_FLOWTABLE_HOOK_NUM={0x8}, @NFTA_FLOWTABLE_HOOK_NUM={0x8}, @NFTA_FLOWTABLE_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x5ea18ab1}, @NFTA_FLOWTABLE_HOOK_DEVS={0x40, 0x3, 0x0, 0x1, [{0x14, 0x1, 'hsr0\x00'}, {0x14, 0x1, 'bond_slave_0\x00'}, {0x14, 0x1, 'syzkaller1\x00'}]}]}, @NFTA_FLOWTABLE_HANDLE={0xc, 0x5, 0x1, 0x0, 0x4}, @NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz1\x00'}]}, @NFT_MSG_NEWCHAIN={0x28, 0x3, 0xa, 0x401, 0x0, 0x0, {0x5, 0x0, 0xa}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_FLAGS={0x8, 0xa, 0x1, 0x0, 0x5}]}, @NFT_MSG_DELFLOWTABLE={0xb4, 0x18, 0xa, 0x201, 0x0, 0x0, {0x0, 0x0, 0x1}, [@NFTA_FLOWTABLE_HOOK={0x94, 0x3, 0x0, 0x1, [@NFTA_FLOWTABLE_HOOK_DEVS={0x90, 0x3, 0x0, 0x1, [{0x14, 0x1, 'ipvlan1\x00'}, {0x14, 0x1, 'bridge0\x00'}, {0x14, 0x1, 'veth0_virt_wifi\x00'}, {0x14, 0x1, 'caif0\x00'}, {0x14, 0x1, 'veth1_vlan\x00'}, {0x14, 0x1, 'virt_wifi0\x00'}, {0x14, 0x1, 'veth1_to_team\x00'}]}]}, @NFTA_FLOWTABLE_HANDLE={0xc, 0x5, 0x1, 0x0, 0x3}]}, @NFT_MSG_DELTABLE={0xa8, 0x2, 0xa, 0x3, 0x0, 0x0, {0x0, 0x0, 0x3}, [@NFTA_TABLE_HANDLE={0xc, 0x4, 0x1, 0x0, 0x4}, @NFTA_TABLE_USERDATA={0x78, 0x6, "a5a375bf56d9f8626b7d2830d9d41f4a938ff8450f6ee0cabba26694d09c1dd19cd9ffbd5ee782d34a23d90315217847cd7a1023fe1c74b12b84afe907f5426234a707f4abb1d0230618dec7cb39970f100e21dbdec9db0ec5c668a0f1dc2995f657f057fbd83d4bda3cf9edf7b9bc949a89ccaa"}, @NFTA_TABLE_FLAGS={0x8, 0x2, 0x1, 0x0, 0x2}, @NFTA_TABLE_FLAGS={0x8}]}, @NFT_MSG_DELSETELEM={0x28, 0xe, 0xa, 0x101, 0x0, 0x0, {0x3, 0x0, 0x7}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_SET_ID={0x8, 0x4, 0x1, 0x0, 0x3}]}], {0x14}}, 0x3f0}, 0x1, 0x0, 0x0, 0x801}, 0x4) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000080)={r5, &(0x7f0000000300)="c9e85053188accfc1e8b579db05f6750bd9347bc4ac215db4e9dd5fe6e9524e2e952abc8283a18b2a0346f", &(0x7f0000000200)=""/166}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f0000000540)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b70800000d0000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r6 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) r7 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r7, 0x1, r6, &(0x7f0000000000)={0x20000008}) epoll_ctl$EPOLL_CTL_MOD(r7, 0x3, r7, &(0x7f0000000100)={0x20000001}) epoll_pwait(r7, &(0x7f0000000140)=[{}], 0x1, 0x80000000, 0x0, 0x0) r8 = bpf$PROG_LOAD(0x5, &(0x7f0000000700)={0x16, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @flow_dissector, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={r8, 0x2000002, 0xe, 0x0, &(0x7f0000000200)="63eced8e46dc3f0adf33c9f7b986", 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) socket$netlink(0x10, 0x3, 0x400000000000004) r9 = accept4$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x0, 0x0, @remote}, &(0x7f00000000c0)=0x1c, 0x80000) setsockopt$IP6T_SO_SET_REPLACE(r9, 0x29, 0x40, &(0x7f0000000480)=@raw={'raw\x00', 0x9, 0x3, 0x310, 0x168, 0xffffffff, 0xffffffff, 0x168, 0xffffffff, 0x240, 0xffffffff, 0xffffffff, 0x240, 0xffffffff, 0x3, &(0x7f0000000100), {[{{@ipv6={@mcast2, @empty, [0xffffff00, 0x0, 0xff, 0xff], [0x0, 0xffffff00, 0xffffffff, 0xffffff00], 'vxcan1\x00', 'ip6gre0\x00', {}, {}, 0x2b, 0xa, 0x0, 0x5}, 0x0, 0x100, 0x168, 0x0, {}, [@common=@frag={{0x30}, {[0x8, 0x15], 0xae2, 0x0, 0x3}}, @inet=@rpfilter={{0x28}, {0x3}}]}, @unspec=@CT1={0x68, 'CT\x00', 0x1, {0xe, 0x5, 0x401, 0x7, 'syz1\x00', 'syz0\x00', {0x8}}}}, {{@uncond, 0x0, 0xa8, 0xd8}, @common=@unspec=@CONNMARK={0x30, 'CONNMARK\x00', 0x1, {0x9fb, 0x22, 0x8001, 0x1}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x370) writev(0xffffffffffffffff, &(0x7f0000000000), 0x0) r10 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r10, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x5, 0x0, 0x0, {0x5}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x101, 0x0, 0x0, {0x5}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz0\x00'}]}, @NFT_MSG_NEWRULE={0x48, 0x6, 0xa, 0x401, 0x0, 0x0, {0x5}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x20, 0x4, 0x0, 0x1, [{0x1c, 0x1, 0x0, 0x1, @tunnel={{0xb}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_TUNNEL_KEY={0x8, 0x1, 0x1, 0x0, 0x30}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0xbc}}, 0x0) r11 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x1, 0x0) ioctl$TUNSETOFFLOAD(r11, 0x4004743d, 0x110e22fff6) 3.577406539s ago: executing program 1 (id=7279): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$BTRFS_IOC_RM_DEV_V2(r0, 0x5000943a, &(0x7f00000000c0)={{}, 0x0, 0x8, @unused=[0x8, 0x1, 0x5, 0xff], @subvolid=0x3}) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=ANY=[], 0x4c}, 0x1, 0x0, 0x0, 0x20000000}, 0x20000011) 3.459152082s ago: executing program 1 (id=7280): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_MAX_BURST(r0, 0x84, 0xc, &(0x7f0000000480)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(0xffffffffffffffff, 0x84, 0x6d, &(0x7f0000000040)={r1}, &(0x7f0000000080)=0x8) 3.435186373s ago: executing program 1 (id=7281): socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000009b40)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x94}, 0x24000000) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000200)='ns/pid_for_children\x00') unshare(0x6a040000) socket$inet_tcp(0x2, 0x1, 0x0) openat$tcp_congestion(0xffffffffffffff9c, &(0x7f00000000c0), 0x1, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB], 0x0, 0x34}, 0x28) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f0000000100)=ANY=[@ANYBLOB="180000000100000000000000801800009500000000000000"], &(0x7f0000000000)='GPL\x00', 0xc, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, r0, 0x8, &(0x7f00000000c0)={0x0, 0x1}, 0x1}, 0x94) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000500)=@bpf_ext={0x1a, 0xf, &(0x7f00000002c0)=ANY=[@ANYBLOB="0000000000000000b702000014000000b70300000000000085000000b9000000bf0900000000000055090100000000009500000000000000bf91000000000000b7020000020000008500000084000000b7000000000000009500000000000000"], &(0x7f0000000180)='GPL\x00', 0x7, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x3a, r0, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x1, r1, 0x0, 0x0, 0x0, 0x10, 0x4a6}, 0x94) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@gettaction={0x14, 0x32, 0x114, 0x70bd25, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x40000}, 0x2004c8d8) r2 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$IP6T_SO_SET_ADD_COUNTERS(r2, 0x29, 0x41, &(0x7f0000000400)=ANY=[@ANYBLOB="6d616e676c6500000000000000000000000000000000000000000000000000000200000000000000f9ff00"/63], 0x48) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000240)={@cgroup, 0xffffffffffffffff, 0xc, 0x2004}, 0x20) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)=@newqdisc={0x24, 0x24, 0x1, 0x70bd2a, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {}, {0xffff, 0xffff}, {0x5}}}, 0x24}, 0x1, 0x0, 0x0, 0x20000850}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000100)=@newqdisc={0x24, 0x24, 0x4, 0xc0000000, 0x0, {0x0, 0x0, 0x0, 0x0, {0x3, 0x3}, {0xa, 0xe}, {0x0, 0x9}}}, 0x24}}, 0x20004055) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000200)={'dummy0\x00', 0x0}) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0xf, 0x0, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x10, 0x803, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f0000000380)=[@in={0x2, 0x4e1c, @initdev={0xac, 0x1e, 0xff, 0x0}}]}, &(0x7f0000000180)=0x10) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffffff, 0x84, 0x1d, &(0x7f0000000000)={0x1, [0x0]}, &(0x7f0000000080)=0x8) getsockopt$inet_sctp_SCTP_GET_PEER_ADDRS(0xffffffffffffffff, 0x84, 0x6c, &(0x7f00000001c0)={r5, 0x10, "3f77bd301f72b9a895dd0c7404e114e1"}, &(0x7f00000002c0)=0x18) getsockopt$inet_sctp_SCTP_PR_ASSOC_STATUS(r4, 0x84, 0x73, &(0x7f00000001c0)={r5, 0x7, 0x0, 0xd3b, 0x4}, &(0x7f0000000440)=0x18) sendmsg$nl_route(r4, &(0x7f0000000380)={0x0, 0x4076cbba9945d516, &(0x7f0000000340)={0x0, 0x14}}, 0x0) getsockname$packet(r4, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="44000000100039042abd70000000000000000000", @ANYRES32=r6, @ANYBLOB="011802000b000100677265746170000014000280060011004e20000008000400687dec2c0000000000000000"], 0x44}, 0x1, 0x0, 0x0, 0x410c0}, 0x4000020) 2.58629255s ago: executing program 3 (id=7286): r0 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000040)=ANY=[@ANYBLOB="1800000002000000000000000000082295"], &(0x7f0000000180)='syzkaller\x00', 0x0, 0x0, 0x0, 0x1e00, 0x2c}, 0x94) (async) r1 = socket$inet6(0xa, 0x3, 0x3) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000200)={'veth1_to_hsr\x00', 0x0}) r3 = bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000002c0)={r0, r2, 0x25, 0x0, @val=@netkit={@void, @value=r0}}, 0x1c) (async) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="80400100000001720c002b8008000100", @ANYRES32=r0, @ANYBLOB="08001b"], 0x34}, 0x1, 0x0, 0x0, 0x20004040}, 0x0) (async) bpf$LINK_DETACH(0x22, &(0x7f00000000c0)=r3, 0x4) r5 = socket(0x10, 0x3, 0x0) (async) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b70800000d0000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) (async) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="0b00000005000000000400000900000001"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18000000000000000000000000000000850000006d"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) r7 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4000000000000007910480000000000610400000000000095000000"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x48) close(r7) r8 = socket(0x28, 0x5, 0x0) (async) r9 = socket(0x28, 0x5, 0x0) bind$vsock_stream(r9, &(0x7f0000000040)={0x28, 0x0, 0x0, @local}, 0x10) (async) listen(r9, 0x4) (async) connect$vsock_stream(r8, &(0x7f0000000080)={0x28, 0x0, 0x0, @local}, 0x10) (async) r10 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0f000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000000c0)={{r10}, &(0x7f0000000000), &(0x7f0000000080)=r7}, 0x20) r11 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r11, &(0x7f0000000140)=[{&(0x7f0000000180)="580000001400192340834b80040d8c5610067f0200ff000000000000000058000b4824ca945f64009400ff0325010ebc000000000000008000f0fffeffe809005300fff5dd00000008000300090c10000000008003000000", 0x58}], 0x1) recvmsg$kcm(r8, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x2000) (async) r12 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000d80)={0x18, 0x5, &(0x7f0000000480)=ANY=[@ANYBLOB="1801000021"], 0x0, 0x40, 0x0, 0x0, 0x0, 0xb4a02fe0ce239f93, '\x00', 0x0, 0x2}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xe, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000800000000000000000000018110000", @ANYRES32=r6], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x59, '\x00', 0x0, @fallback=0x2a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, r12, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) r13 = bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) listen(r8, 0x7697) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={r13, 0x2000000, 0xe, 0x0, &(0x7f0000000040)="630b008646dc3f0adf33c9f7b986", 0x0, 0xcf25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x80}, 0x50) (async) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000000)=@newqdisc={0x44, 0x24, 0x3fe3aa0262d8c583, 0x0, 0x0, {0x0, 0x0, 0x0, r14, {0xc, 0x8}, {0x0, 0x1}, {0x6}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x14, 0x2, [@TCA_CAKE_RAW={0x8, 0xc, 0x1}, @TCA_CAKE_MPU={0x8, 0xe, 0x63}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x2}, 0x2000084c) 2.38483472s ago: executing program 3 (id=7288): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000300), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000400)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_AUTHENTICATE(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x30, r1, 0x1, 0x20000002, 0x25dfdbff, {{}, {@val={0x8, 0x3, r3}, @void}}, [@key_params=[@NL80211_ATTR_MAC={0xa, 0x6, @broadcast}], @NL80211_ATTR_AUTH_TYPE={0x8}, @key_params]}, 0x30}, 0x1, 0x0, 0x0, 0x20040040}, 0x0) 2.185556254s ago: executing program 3 (id=7290): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) socket$nl_route(0x10, 0x3, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000140)=ANY=[@ANYBLOB="280000001800090000000000000000001c140000fe000001000000000c00"], 0x28}}, 0x0) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000040)='ns/cgroup\x00') mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeef, 0x8031, 0xffffffffffffffff, 0x215eb000) r1 = bpf$MAP_CREATE(0x0, 0x0, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x59, '\x00', 0x0, @fallback=0xd, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = socket$inet(0x2, 0x80001, 0x0) setsockopt$IPT_SO_SET_ADD_COUNTERS(r2, 0x0, 0x61, &(0x7f0000000640)=ANY=[], 0x48) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$FAT_IOCTL_SET_ATTRIBUTES(r1, 0x40047211, &(0x7f0000000200)=0x4) r4 = socket$inet_tcp(0x2, 0x1, 0x0) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f00000008c0), r3) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000e00)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_CQM(r0, &(0x7f0000000f80)={0x0, 0x0, &(0x7f0000000f40)={&(0x7f00000004c0)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="010029bd7000fedbdf253f00000008000300", @ANYRES32=r6, @ANYRESOCT=r5], 0x3c}, 0x1, 0x0, 0x0, 0x80c0}, 0x4) socket$netlink(0x10, 0x3, 0x12) listen(0xffffffffffffffff, 0x8) r7 = accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x5, 0x3030, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) setsockopt$inet6_mreq(r7, 0x29, 0x1c, &(0x7f00000001c0)={@remote}, 0x14) r8 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r8, 0x0, 0x80, &(0x7f0000000100)=@broute={'broute\x00', 0x20, 0x0, 0x90, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000000040], 0x0, 0x0, &(0x7f0000000040)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0x7fffffffffffffff}]}, 0x108) r9 = syz_genetlink_get_family_id$devlink(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RATE_GET(r0, &(0x7f0000000600)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000580)={&(0x7f0000000380)={0x1f4, r9, 0x8, 0x70bd27, 0x25dfdbfd, {}, [@DEVLINK_ATTR_RATE_NODE_NAME={0xe3, 0xa8, @random="702b25db9262099b50ffa3ccc9fe0a8b2a184981174924973eff5d1183d0901308b3173be0f9d65b3a396123fe59d60bdb8a5fa3b3607c464ca03be2d30a22cf563a2a99f4bd8d880d6213ba20f7a8632f1a1120280f97808186c25f51e2ea7ecef40239c4f1ac33263b7e1ffa759b08b94a1703c669237eeebcef563387028ecf2550e9714668eaf8530e6e429873535d14a2d8c2e4cfefa13851a884f4563a43493a3771eb5c551f0eeedb7b4a7ca71d634aa1ccace6c31d7705877a294b7b1681f9cdd6aae17f9f1bb39679b63bb991f16801a7eeea6d7c1d6a0c5bbcda"}, @DEVLINK_ATTR_PORT_INDEX={0x8}, @DEVLINK_ATTR_PORT_INDEX={0x8}, @DEVLINK_ATTR_RATE_NODE_NAME={0xc9, 0xa8, @random="c2865f26b4053f6e1b611f22993fcf979afe8a32fcff7f5b07feedeafc4e70aa2986ad3dea0e7bc90a936d5befdab266cc837fd7d44dd409e1050899482525082d4284d962d29c4c87bc5517cb89b3ff1fafcd8745ee61cac7de8ec988269edf6c931d94dadad0b974b95ab0811910411b2c7b795e4aaa5a1a3d8e32d4477695cc9c4e388c472545ccf2d71c23811ef619226de0f4965fb9585b899ecf1f86a176598ffaa1c2d6c90d89923a0a6915510580f7640195128d32fd108174db509a5c0fb334f3"}, @DEVLINK_ATTR_RATE_NODE_NAME={0xf, 0xa8, @name2}, @DEVLINK_ATTR_RATE_NODE_NAME={0xe}]}, 0x1fe}, 0x1, 0x0, 0x0, 0x40800}, 0x8040) r10 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFULNL_MSG_CONFIG(r10, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000009c0)=ANY=[@ANYRES16], 0x24}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) sendmsg$NFULNL_MSG_CONFIG(r10, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)={0x24, 0x1, 0x4, 0x5, 0x0, 0x0, {0xa}, [@NFULA_CFG_CMD={0x5, 0x1, 0x2}, @NFULA_CFG_FLAGS={0x6}]}, 0x24}, 0x1, 0x0, 0x0, 0xc010}, 0x22000004) 1.97568415s ago: executing program 4 (id=7293): ioctl$sock_inet6_tcp_SIOCOUTQNSD(0xffffffffffffffff, 0x894b, 0x0) (async, rerun: 64) r0 = socket(0x400000000010, 0x3, 0x0) (rerun: 64) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'batadv_slave_0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000380)=@newtfilter={0x78, 0x2c, 0xf3f, 0x30bd29, 0x25dfdbfd, {0x0, 0x0, 0x0, r1, {0xb, 0xfff3}, {}, {0x7, 0xfff1}}, [@filter_kind_options=@f_route={{0xa}, {0x48, 0x2, [@TCA_ROUTE4_CLASSID={0x8, 0x1, {0x5, 0x4}}, @TCA_ROUTE4_ACT={0x34, 0x6, [@m_csum={0x30, 0x9, 0x0, 0x0, {{0x9}, {0x4}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc}}}]}, @TCA_ROUTE4_FROM={0x8, 0x3, 0x5}]}}]}, 0x78}, 0x1, 0x0, 0x0, 0x240490d0}, 0xd0) (async) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x2000000000000021, 0x2, 0x10000000000002) (async, rerun: 64) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x6, 0x4, 0x8, 0x5}, 0x50) (rerun: 64) bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f0000000540)={&(0x7f00000003c0)="97", &(0x7f0000001140)=""/4096, &(0x7f0000000300), &(0x7f00000001c0), 0x5, r4}, 0x38) setsockopt$bt_rfcomm_RFCOMM_LM(r3, 0x110, 0x3, 0x0, 0x15edfeb2) (async) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000740)=ANY=[@ANYBLOB="500000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000001140012800c0001006d6163766c616e00dbff028008000500", @ANYRES32=r2, @ANYBLOB="080004007f0000000a000100aa"], 0x50}}, 0x0) 1.62760876s ago: executing program 4 (id=7295): r0 = socket$packet(0x11, 0x3, 0x300) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r2 = socket$unix(0x1, 0x1, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000026c0)=@newqdisc={0x24, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2, 0xffff}}}, 0x24}, 0x1, 0x0, 0x0, 0x20000001}, 0x0) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x180, 0x0) close(r5) socket$nl_route(0x10, 0x3, 0x0) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r6 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000300)=@newqdisc={0x30, 0x24, 0x4ee4e6a52ff56541, 0x70bd27, 0x7fffe, {0x0, 0x0, 0x0, r7, {0x0, 0xffe0}, {0xb, 0xb}, {0x0, 0x1}}, [@qdisc_kind_options=@q_hhf={{0x8}, {0x4}}]}, 0x30}, 0x1, 0x0, 0x0, 0x4048800}, 0x400c000) setsockopt$packet_int(r0, 0x107, 0xf, &(0x7f0000000100)=0x207, 0x4) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'syzkaller0\x00', 0x0}) sendto$packet(r0, &(0x7f00000002c0)="05031620d3fc140000004788031c09102c28", 0xfce0, 0x4, &(0x7f0000000140)={0x11, 0x0, r8, 0x1, 0x0, 0x6, @multicast}, 0x14) 1.572106209s ago: executing program 0 (id=7296): r0 = socket$nl_route(0x10, 0x3, 0x0) (async, rerun: 64) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="19000000040000000400000005"], 0x48) (rerun: 64) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async, rerun: 32) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xa, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x9, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (rerun: 32) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000001200)={r2, 0x2000000, 0xe, 0x0, &(0x7f0000000200)="63eced8e46dc3f07df33c9f7b986", 0x0, 0xffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r3 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r3, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) (async) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000500)=ANY=[@ANYBLOB="1d0000001000030400"/20, @ANYRES32=r4, @ANYBLOB="46060900000000001400128009000100626f6e640000000004000280"], 0x34}, 0x1, 0x0, 0x0, 0x690}, 0x20) (async, rerun: 32) r5 = socket$nl_route(0x10, 0x3, 0x0) (rerun: 32) r6 = socket(0x1, 0x803, 0x0) getsockname$packet(r6, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=@newlink={0x44, 0x10, 0x401, 0x70bd26, 0x0, {0x0, 0x0, 0x0, 0x0, 0x29d01}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @macvlan={{0xc}, {0xc, 0x2, 0x0, 0x1, [@IFLA_MACVLAN_MODE={0x8, 0x1, 0x8}]}}}, @IFLA_LINK={0x8, 0x5, r7}]}, 0x44}}, 0x0) 1.364973008s ago: executing program 2 (id=7298): r0 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r0, &(0x7f0000000080)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x200, 0xfffffffd}}, 0x10) (async) r1 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f00000001c0)={0x8000042, 0x3}, 0x10) (async) r2 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r2, 0x10f, 0x87, &(0x7f0000000100)={0x42}, 0x10) r3 = socket$tipc(0x1e, 0x5, 0x0) (async) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_TIMEOUT_DELETE(r4, &(0x7f0000002b00)={0x0, 0x0, &(0x7f0000002ac0)={&(0x7f0000002a80)={0x20, 0x2, 0x8, 0x801, 0x0, 0x0, {0x5, 0x0, 0xa}, [@CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x880}, 0x40080) (async) bind$tipc(r3, &(0x7f0000000180)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x3, 0x4}}, 0x10) (async, rerun: 64) r5 = socket$tipc(0x1e, 0x5, 0x0) (rerun: 64) sendmsg$tipc(r5, &(0x7f0000000380)={&(0x7f0000000140)=@nameseq={0x1e, 0x1, 0x2, {0x42, 0x3, 0x4}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x4000884}, 0x4) 1.195517031s ago: executing program 0 (id=7299): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) r2 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, 0x0, 0x0) close(0x4) getsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000000), 0x10) syz_open_procfs$namespace(0x0, &(0x7f0000000040)='ns/cgroup\x00') mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeef, 0x8031, 0xffffffffffffffff, 0x215eb000) r3 = socket(0x8, 0x2, 0x4) ioctl$sock_SIOCGIFINDEX(r3, 0x61f0, 0x0) sendmmsg$inet6(r3, &(0x7f0000002640)=[{{0x0, 0x0, 0x0}}], 0x1, 0x2389555475d75812) shutdown(0xffffffffffffffff, 0x1) close(0x4) r4 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f00000003c0)={'syzkaller0\x00', 0x0}) r6 = socket(0x400000000010, 0x3, 0x0) sendmsg$nl_route_sched(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000600)=@getchain={0x24, 0x66, 0x903, 0x70bd2e, 0x25dfdc03, {0x0, 0x0, 0x0, r5, {0xffe0, 0xb}, {0xffff, 0xfff1}, {0x6, 0xfff2}}}, 0x24}, 0x1, 0x0, 0x0, 0x48}, 0x8000) sendmmsg$inet(r0, &(0x7f0000000cc0)=[{{&(0x7f0000000200)={0x2, 0x4e24, @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x10, &(0x7f0000000600)=[{&(0x7f0000000240)="e66a2a196bfb5628c373fc641d4e2ef046ff9b3cec19aac150b5c7a99bffbbcaf86c05723b621f12a60da99662a4ffcbd2c7e957c1309002985b9cf9c55595560ca0cc240cc8e53e1639db15f6976e4fe666e74bc4c273b0fbc19c842c0abb8bd9823bb80b1c4b0bdd1ae34644f55bbd354b106d446f76e171c9ff", 0x7b}, {&(0x7f00000002c0)="122156f691f5dfa412c93c94ebee9cc6a86487906cbfbf0139a365e3560f445bf27b47ecd0ec216b641e04336d2dda0727cc19d86d52c0255ea81bc7ae4a73d345c6c7ff7820f66b27b3515fd2488dc7e2947ed6f4ef04d6e50452ab59f1be381793b846e7517023e2c93ca9d8e526665fb8ce1de83f05b3e7ed6ae3c287ecc61747a8f116defd816482a8211563eb41edf032a31aa227326aae31123bd72b20c7476046a1680dd803b7fe23f0c6ab80e0894213ca051b4334a5c1a6345cd90447d2e195f3cb1ac18eed8f31a4d30c2770e5e0c4c01208cc9a2c", 0xda}, {&(0x7f00000003c0)}, {&(0x7f0000000400)}, {&(0x7f0000000440)="43bf20a382dbc7043f1a48dc9521de6a4c1da8d0dd92b8a2c0beff2a645d66e4171c39e71e84019082e6014ba3e201ed3ab970c19e0d0d7e34bae40f3482aa99cf34733375d6e736e2536ab3f048c6c02e02de3ea640c9f0c9a404a956c46a1634e26935529ce3203c5388aa91e48672711ebd2b7d748cbb7652ecc8885f76efc9ca4555b38cf41ffcd163b7f47d6ca703400f64851abecf9cc6582349f5c8eb53e8dc72b3d4b6274d0e20ffa21902b72e04a571ab8e391ea91586e676f51891d33c5fc0f9f0dc6099481d0eca0bccfbe45f466f573455a625ab5acf6c90a58b6a2dffa56e0fd8215de70f19f5adc0ff86b5a42f34dbdc80a0de", 0xfa}, {&(0x7f0000000540)="564f0ade2b0e5ff45d9f87b256cfdaf0fced977fab3a4e442c7ccbe8b5479860194b6fbf580bf0f038c64c5621a329302f2ecd6edd6a78201c5d2c7bac56e0f9eea2ba5ec638a7dd2446594ab17b7d83", 0x50}], 0x6}}, {{&(0x7f0000000680)={0x2, 0x4e24, @loopback}, 0x10, &(0x7f0000000800)=[{&(0x7f00000006c0)="a059a5a801d05cf07ed59882f444", 0xe}, {&(0x7f0000000700)='/O', 0x2}, {&(0x7f0000000740)="5edf98f0f1a24ec90b74ef85c34136a6fe4288b98a0756255ec412e336cf6a512070fe7f0ad1c12f245ec374aa32b28c5b79bce3e5d3d5303d56b11565b22693b683fe9604c9a62cded5fa69ad055e790d2670da5edd77962151428fff8d833e05434f6d9293362821a22d1575da9c4095b2defaa82f25eafc11c42299889ef965b04e020088d3c7c6dab362cd6792d2d3677280daf6b131", 0x98}], 0x3, &(0x7f0000000840)=[@ip_retopts={{0xb4, 0x0, 0x7, {[@ra={0x94, 0x4}, @lsrr={0x83, 0x13, 0x93, [@initdev={0xac, 0x1e, 0x1, 0x0}, @initdev={0xac, 0x1e, 0x0, 0x0}, @local, @multicast1]}, @timestamp_addr={0x44, 0x14, 0x81, 0x1, 0x1, [{@empty, 0x171c}, {@rand_addr=0x64010101, 0x6}]}, @noop, @rr={0x7, 0x27, 0x32, [@multicast2, @broadcast, @private=0xa010100, @private=0xa010100, @local, @multicast1, @broadcast, @broadcast, @initdev={0xac, 0x1e, 0x1, 0x0}]}, @ssrr={0x89, 0x13, 0x47, [@loopback, @empty, @dev={0xac, 0x14, 0x14, 0x27}, @loopback]}, @ssrr={0x89, 0xb, 0x9f, [@private=0xa010100, @private=0xa010101]}, @noop, @rr={0x7, 0x17, 0x6e, [@loopback, @empty, @private=0xa010101, @local, @multicast1]}, @ssrr={0x89, 0x1b, 0x20, [@local, @multicast2, @local, @multicast2, @dev={0xac, 0x14, 0x14, 0x20}, @rand_addr=0x64010100]}]}}}, @ip_ttl={{0x14}}], 0xd0}}], 0x2, 0x1) 1.081757241s ago: executing program 4 (id=7300): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000300), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000400)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_AUTHENTICATE(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x30, r1, 0x1, 0x20000002, 0x25dfdbff, {{}, {@val={0x8, 0x3, r3}, @void}}, [@key_params=[@NL80211_ATTR_MAC={0xa, 0x6, @broadcast}], @NL80211_ATTR_AUTH_TYPE={0x8}, @key_params]}, 0x30}, 0x1, 0x0, 0x0, 0x20040040}, 0x0) 1.006436463s ago: executing program 2 (id=7301): r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(0xffffffffffffffff, &(0x7f0000000280)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000240)={&(0x7f0000000080)={0x188, r0, 0x8, 0x70bd27, 0x25dfdbfb, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_TX_RATES={0x60, 0x5a, 0x0, 0x1, [@NL80211_BAND_60GHZ={0x3c, 0x2, 0x0, 0x1, [@NL80211_TXRATE_HE_GI={0x5, 0x6, 0x2}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x4, 0x80, 0x8001, 0x7f4, 0x8, 0xa29e, 0xfd, 0x8ad4]}}, @NL80211_TXRATE_LEGACY={0x19, 0x1, [0x18, 0x2, 0x60, 0x12, 0x2, 0x30, 0x9, 0x2, 0x16, 0xb, 0x18, 0x2, 0x5, 0xd4a9d7769652bebf, 0x1b, 0x60, 0x9, 0x36, 0x3, 0x3, 0x9]}]}, @NL80211_BAND_2GHZ={0x20, 0x0, 0x0, 0x1, [@NL80211_TXRATE_LEGACY={0x1c, 0x1, [0x30, 0x0, 0x3, 0x3, 0xc, 0x5, 0xb, 0x36, 0x24, 0x0, 0x9, 0x18, 0x5, 0x39, 0x0, 0x6, 0xc, 0x48, 0x24, 0x60, 0x60, 0x36, 0x9, 0x3]}]}]}, @NL80211_ATTR_TX_RATES={0x10c, 0x5a, 0x0, 0x1, [@NL80211_BAND_2GHZ={0x38, 0x0, 0x0, 0x1, [@NL80211_TXRATE_HE_LTF={0x5}, @NL80211_TXRATE_HT={0x17, 0x2, [{0x6, 0x4}, {0x7, 0x8}, {0x2, 0x1}, {0x7, 0x7}, {0x6, 0x1}, {0x0, 0x9}, {0x1, 0x1}, {0x6, 0x4}, {0x7, 0x8}, {0x3, 0x5}, {0x1, 0x3}, {0x3, 0x1}, {0x7, 0x1}, {0x3, 0x8}, {0x2, 0x1}, {0x7, 0x3}, {0x6, 0xa}, {0x7, 0x2}, {0x4, 0x2}]}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x3ab1, 0x6, 0x100, 0x9, 0xf5, 0x5, 0x8, 0x94]}}]}, @NL80211_BAND_2GHZ={0x18, 0x0, 0x0, 0x1, [@NL80211_TXRATE_VHT={0x14, 0x3, {[0x3, 0x7, 0x1, 0x9, 0x2, 0x0, 0xc966, 0xfff8]}}]}, @NL80211_BAND_5GHZ={0x50, 0x1, 0x0, 0x1, [@NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x2}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x2}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x6, 0xa, 0x8, 0x7, 0x3, 0xb046, 0x7811, 0x9]}}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x3, 0x6, 0x2, 0xdcd, 0x3, 0x1, 0x5, 0x8]}}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x2, 0x3, 0x14, 0x64, 0x4, 0x4, 0x8, 0x4]}}]}, @NL80211_BAND_2GHZ={0x38, 0x0, 0x0, 0x1, [@NL80211_TXRATE_GI={0x5}, @NL80211_TXRATE_LEGACY={0x9, 0x1, [0x1b, 0x48, 0x36, 0x24, 0x30]}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x2}, @NL80211_TXRATE_HT={0xe, 0x2, [{0x3, 0x5}, {0x0, 0x4}, {0x1, 0xa}, {0x6, 0x5}, {0x3, 0x8}, {0x1, 0xa}, {0x2, 0x5}, {0x4}, {0x1, 0x9}, {0x4}]}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x2}]}, @NL80211_BAND_2GHZ={0x30, 0x0, 0x0, 0x1, [@NL80211_TXRATE_VHT={0x14, 0x3, {[0x10, 0x2, 0x4, 0x7, 0x1, 0xe93, 0xf, 0x401]}}, @NL80211_TXRATE_LEGACY={0xc, 0x1, [0x2, 0x2a, 0x24, 0x12, 0x4, 0x36, 0x1, 0xc]}, @NL80211_TXRATE_LEGACY={0xb, 0x1, [0x5, 0x12, 0x36, 0x4, 0x6c, 0x36, 0x1]}]}]}]}, 0x188}, 0x1, 0x0, 0x0, 0x20000006}, 0x20000004) (async) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000004c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000480)={&(0x7f0000000300)={0x150, 0x18, 0x4, 0x70bd2c, 0x25dfdbfe, {0x1f}, [@nested={0x34, 0x74, 0x0, 0x1, [@nested={0x4, 0x8b}, @typed={0x1f, 0x155, 0x0, 0x0, @binary="36a27c9af468b431cfc6e2a803ee93b2360e242471d72136c54466"}, @typed={0xc, 0xbd, 0x0, 0x0, @u64=0x10}]}, @typed={0xc, 0xba, 0x0, 0x0, @u64=0x9c}, @typed={0x8, 0xe7, 0x0, 0x0, @uid}, @generic="a7585517553b9f921556195e949e1b7007660db408d980b1fe558f48d1902c910ec6eed136be16251141ad5cc6cd5c29733965b94c13d1116640e92726439a85ca7488bf06ac1fbde891d4fdfadc320f1d670bbe4c8fd97d42a77af373a2a8aaa139b857f622f22346fc6e42eac5b7eb261cab8930203ad75ac414b1d0353d7143a5828bad94e66a891754895660fcf73e9014723ad61b3724414b33cba39335e54fa7c000e9bc2288f24b1ba5faedcd197108a63bab6008296216cff73632f392d3094e3a15c70c95df98d401e14bc3c78802fcdca86c33f3d2fe82818ec74a588966bd555f", @typed={0xc, 0x126, 0x0, 0x0, @u64=0xafd}]}, 0x150}, 0x1, 0x0, 0x0, 0x20000010}, 0x24040001) sendmsg$OSF_MSG_ADD(0xffffffffffffffff, &(0x7f0000001840)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000001800)={&(0x7f0000000540)={0x12b4, 0x0, 0x5, 0x5, 0x0, 0x0, {0x4, 0x0, 0x7}, [{{0x254, 0x1, {{0x0, 0x4}, 0x65, 0x93, 0xf, 0xb, 0x15, 'syz0\x00', "871586420d79fc085f4da1360294bcbdf650f58ccef8fa0b818bf207aaa5427a", "5eea74b1b37d4df10f9b9a1676943bbed9125d3ed5e81542f2c53debea34d66c", [{0xedf1, 0x0, {0x0, 0xfffffff9}}, {0xff, 0x3, {0x2, 0x7}}, {0x1, 0x1, {0x3, 0x3}}, {0x8, 0xfffb, {0x1, 0x1}}, {0x1, 0x2, {0x0, 0x3}}, {0x7, 0x3, {0x2, 0xffff}}, {0x73, 0x7, {0x1, 0x1}}, {0x401, 0x8, {0x96e2e695ff62aad2, 0x8}}, {0x8, 0x2, {0x2, 0xfffff000}}, {0x4, 0x3, {0x3, 0x357cfba7}}, {0x5, 0x6, {0x2, 0x239}}, {0x9, 0x0, {0x2, 0x13d}}, {0x8001, 0xd, {0x0, 0x5}}, {0x200, 0x3, {0x0, 0xe0}}, {0x2, 0xada0, {0x3, 0x60000000}}, {0x0, 0x2e6b, {0x2}}, {0xc, 0x6, {0x1}}, {0x7f, 0x6, {0x0, 0x9}}, {0x9, 0x2, {0x0, 0x8}}, {0x6, 0x3, {0x1, 0x3}}, {0x4, 0x8001, {0x1, 0x8}}, {0x1, 0x0, {0x1, 0x6}}, {0x7ff, 0x5, {0x1, 0x7}}, {0xfff, 0x7, {0x0, 0x401}}, {0x2, 0x1ff, {0x2, 0x4}}, {0x4, 0x1, {0x1, 0x6}}, {0x3, 0x7, {0x0, 0x5}}, {0xff, 0xb0, {0x1, 0x5}}, {0x3, 0x4, {0x3, 0x6}}, {0x3, 0xf000, {0x2, 0xc2}}, {0xfa9f, 0xfbff, {0x0, 0x7}}, {0xb, 0x8, {0x2, 0x7}}, {0x6, 0x9, {0x7, 0x4}}, {0x5da, 0xf978, {0x1, 0x9}}, {0x4, 0x3, {0x0, 0xffffffff}}, {0xe, 0x8, {0x2, 0x400}}, {0x8001, 0x3ff, {0x2, 0x1}}, {0x3, 0x6, {0x3, 0x4}}, {0x4, 0x2, {0x0, 0x8000}}, {0x1, 0x0, {0x0, 0x1}}]}}}, {{0x254, 0x1, {{0x2, 0x173c0000}, 0xff, 0xbb, 0x6, 0x0, 0x17, 'syz1\x00', "bcf405fdfd6d9d8cda0b32b1f9dcbe60b92046064a72156d1bb20b76749c19ce", "0309061d15eeb1afb77555c9bb9c09a1651d3b34f248b33feaff732a2ea3a291", [{0x7, 0x4, {0x3, 0x9}}, {0xc, 0x34a, {0x3, 0x795f}}, {0xc40, 0x670, {0x1, 0x80000000}}, {0x0, 0x8000, {0x0, 0x401}}, {0x40, 0x5d9f}, {0xfffc, 0xf047, {0x0, 0x3}}, {0x9, 0x5, {0x0, 0xfffffff8}}, {0x7ff, 0x0, {0x2, 0x5}}, {0x6, 0xfffc, {0x1, 0x401}}, {0x5, 0x8, {0x0, 0x6}}, {0x3, 0x8e3a, {0x3, 0x7fffffff}}, {0x2, 0x8, {0x3, 0x2}}, {0xf5c, 0x9, {0x4188bd2223ad12fb, 0x5}}, {0x5, 0x7f, {0x0, 0x7}}, {0xed20, 0xea, {0x1, 0x9265}}, {0xff, 0x7, {0x3, 0x8}}, {0x1, 0x4, {0x3}}, {0x100, 0x3, {0x2}}, {0x1000, 0x4e51, {0x1, 0x7}}, {0x6, 0x7, {0x3, 0x6592}}, {0x7fff, 0x693, {0x3, 0x7fff}}, {0x0, 0x1, {0x3, 0xa}}, {0x4, 0x3, {0x2, 0xa}}, {0x6, 0x3, {0x3, 0x10}}, {0x0, 0x6cb, {0x3}}, {0x8, 0xe725}, {0x3, 0xda03, {0x2, 0x7}}, {0x7, 0xc, {0x3, 0xaa48}}, {0x6, 0x8, {0x0, 0x9}}, {0x4, 0x4, {0x3, 0xfffff687}}, {0xfffd, 0x9}, {0x4, 0x101, {0x1, 0x9}}, {0x5, 0xd167, {0x0, 0x6}}, {0xfff, 0x5, {0x2, 0x1}}, {0x1, 0x764, {0x0, 0x7}}, {0x6, 0x1, {0x1, 0x5}}, {0x1, 0x6, {0x2, 0xcc}}, {0x401, 0x0, {0x3, 0x7}}, {0x8000, 0x8, {0x0, 0x1}}, {0x3, 0x6, {0x1, 0x9}}]}}}, {{0x254, 0x1, {{0x3, 0x3}, 0x0, 0x6, 0x4, 0x7fff, 0x4, 'syz1\x00', "2780d861734769fde49557eb38bc573867506c40c37698f6750134f31dc0b01b", "db9c6e7d803fc5a1993514d3b4ff19734272af4030c40a79a36d4af6028b4043", [{0x1, 0x1, {0x2, 0x2}}, {0xffff, 0x5, {0x0, 0x7ff00}}, {0x7, 0x0, {0x2, 0x5}}, {0x3, 0x9, {0x0, 0x5}}, {0x101, 0x3, {0x1}}, {0x4, 0x2, {0x1, 0x4}}, {0x9, 0xf5, {0x3, 0x200}}, {0x6, 0x7, {0x0, 0xfffffff9}}, {0x0, 0x9, {0x0, 0x1}}, {0x5, 0xfff, {0x3, 0x8001}}, {0x56, 0x4, {0x1}}, {0x6, 0x7, {0x1, 0x1}}, {0x4, 0xfe00, {0x3, 0x7}}, {0x2, 0x2, {0x1, 0x6}}, {0x6, 0x6, {0x0, 0x8000}}, {0xa75, 0x400, {0x2, 0x2}}, {0x2, 0x50d, {0x2, 0x2}}, {0x80, 0x5fcb, {0x0, 0x81}}, {0x5a59, 0x7a, {0x1, 0x256}}, {0x4, 0x0, {0x1, 0x1}}, {0x1, 0x4, {0x1}}, {0x0, 0x3, {0x3, 0x1}}, {0x8, 0x9, {0x1, 0x200}}, {0x4, 0xff7f, {0x0, 0xfffffff8}}, {0x0, 0x0, {0x3}}, {0xa, 0x6, {0x2, 0xff}}, {0x1, 0x2, {0x1, 0x4}}, {0x4, 0xb53, {0x1, 0xff}}, {0x3, 0x6, {0x0, 0xfe2}}, {0x0, 0x2, {0x2, 0x9}}, {0x7f, 0x0, {0x2, 0x10001}}, {0xd02, 0xe, {0x3, 0xdfb4}}, {0x7, 0x5, {0x1, 0x9}}, {0x7ee, 0x6, {0x0, 0x4f44}}, {0x0, 0xf, {0x1}}, {0x2, 0x7, {0x1, 0x5f49}}, {0x8, 0xfff1, {0x1, 0x10001}}, {0x8001, 0x2, {0x1, 0x733}}, {0x1, 0x6fc4, {0x2}}, {0x8, 0x7, {0x0, 0xf31b}}]}}}, {{0x254, 0x1, {{0x0, 0xffff}, 0x7, 0xf, 0x6, 0x0, 0x14, 'syz0\x00', "ff24013ad6c4c9f3f874f0de0f600c0b37cfaab66048453d426c8432d04b4397", "e6c51c96db60918320824f27835b91f86d4fa4be214bf4dfbfd261258cd3acfa", [{0xd, 0x8, {0x3, 0x80}}, {0x6, 0x4, {0x1, 0x80}}, {0x8001, 0x408, {0x0, 0x800}}, {0x7, 0x2c, {0x3, 0x40}}, {0x400, 0x8d05, {0x3, 0x9e}}, {0x0, 0x5, {0x0, 0x9}}, {0x5, 0x9b, {0x2, 0x6fcc}}, {0xfff8, 0xffae, {0x2, 0x7}}, {0x1, 0x2, {0x3, 0x6}}, {0x9, 0x9, {0x0, 0x3ff}}, {0xc7f, 0x300, {0x0, 0x3}}, {0x40, 0x1, {0x3, 0x7}}, {0x5, 0x10, {0x1, 0x2}}, {0x4, 0x86, {0x3, 0x9}}, {0x558, 0xe, {0x3, 0x3}}, {0x7, 0x4, {0x1, 0x180000}}, {0x0, 0x800, {0x0, 0x3}}, {0x1ff, 0x3, {0x2, 0x5}}, {0x9ecc, 0x3ff, {0x3, 0x2}}, {0x3, 0x300, {0x0, 0x7fff}}, {0xffa0, 0x4, {0x0, 0x9}}, {0x0, 0x7, {0x2, 0x5}}, {0x1cc, 0x4, {0x1, 0x8907}}, {0x5, 0x6, {0x3, 0x2ebfc95d}}, {0xe, 0x5, {0x1}}, {0x1, 0x8, {0x2, 0x9bb}}, {0x214, 0x80, {0x2, 0xefb8}}, {0xad, 0x4, {0x0, 0x40}}, {0x7fff, 0x180, {0x2, 0x6}}, {0x6e, 0x3}, {0x400, 0x8, {0x3}}, {0x3, 0x1, {0x0, 0x3}}, {0xfffd, 0x5, {0x1, 0x7}}, {0x9, 0x4, {0x1, 0x4}}, {0x1000, 0xf3f, {0x1, 0x3ff}}, {0x0, 0xc, {0x1, 0x10000}}, {0x2, 0x6, {0x3, 0x7}}, {0x3, 0x7ff, {0x2, 0x3}}, {0xa, 0xa, {0x1, 0x80000001}}, {0xa26, 0x5, {0x0, 0x1}}]}}}, {{0x254, 0x1, {{0x2, 0x3}, 0x3, 0x5c, 0x3, 0x0, 0xe, 'syz0\x00', "8d2ee70b2213be33e7af85a063b0a9b0af5f3aed26dfa19279b9d4511f2c34cd", "10104f14b72313bfd16caf82245d411beda9897e4bb2eff6183867d6d33fdfc4", [{0x81, 0x1000, {0x2, 0x3}}, {0x3, 0x6, {0x0, 0x81}}, {0x33, 0xa, {0x3, 0x3ff}}, {0xbed, 0x6, {0x1, 0x46}}, {0x4, 0xa00, {0x0, 0xffffffff}}, {0xfff7, 0x8, {0x2, 0xfffffff6}}, {0x1000, 0x101, {0x0, 0x8}}, {0x3, 0x3, {0x2, 0x9}}, {0x5, 0x1, {0x0, 0xfffffff9}}, {0xffff, 0x3, {0x2, 0xb}}, {0x4b2c, 0x2, {0x0, 0xd}}, {0x7, 0x3, {0x2, 0x401}}, {0x3, 0x5, {0x2, 0x8}}, {0x6, 0x0, {0x3}}, {0x80, 0x7ff, {0x1}}, {0x7, 0xff01, {0x2, 0xae}}, {0x6ff, 0xe, {0x2, 0x800}}, {0x401, 0x0, {0x1, 0x1}}, {0x6652, 0x5, {0x0, 0x3}}, {0xd, 0x1, {0x1, 0x1}}, {0x7, 0x7, {0x3, 0xb}}, {0x0, 0x1, {0xdcc0947c616812c5, 0x100}}, {0x3, 0x9, {0x0, 0xffff4705}}, {0xff, 0x3, {0x0, 0x9000}}, {0x422, 0x75b1, {0x3, 0x3}}, {0x6, 0x7, {0x0, 0xf}}, {0xfff7, 0xa5, {0x0, 0x7}}, {0x4, 0x5, {0x0, 0x400}}, {0x400, 0x76, {0x2, 0xc}}, {0xfff, 0x8, {0x1, 0x80000000}}, {0xcdb, 0x9, {0x3, 0x1}}, {0x7f, 0x7f, {0x2, 0x1}}, {0x8, 0x7ae, {0x1, 0x1}}, {0x7, 0x297, {0x0, 0x7}}, {0x2, 0x6, {0x2, 0x6}}, {0xb, 0x5, {0x0, 0x8}}, {0x8, 0x9, {0x3, 0x6}}, {0x4, 0x7d, {0x0, 0xf}}, {0x9, 0x2800, {0x2, 0x6}}, {0x100, 0x6763, {0x2, 0xa98}}]}}}, {{0x254, 0x1, {{0x2}, 0x6, 0x2, 0x9, 0x247b, 0x26, 'syz1\x00', "6f8a8d58854378617599b1349fb1a7971ab57566634f220fd9f1470770a868f7", "988d58299c02a18ccfc8dad57b6c4df8ca5a893a95d954ac3db172d000467df0", [{0x0, 0x5, {0x2, 0x9}}, {0x80, 0xffff, {0x3}}, {0xe8cc, 0x0, {0x2, 0x5}}, {0x8f1, 0x7af6, {0x2, 0xae3}}, {0x4, 0x2, {0x2, 0x8}}, {0x17da, 0x6, {0x0, 0x2}}, {0x401, 0x100, {0x1, 0x5}}, {0x40, 0x5, {0x1, 0x1}}, {0xc64f, 0x0, {0x3, 0x2}}, {0xe, 0x9, {0x1, 0x200}}, {0xff26, 0xd9ff, {0x1, 0x5}}, {0x97cb, 0x80, {0x2, 0xfabe}}, {0x7ff, 0x6, {0x3, 0x2}}, {0xc98b, 0xfffa, {0x1, 0x10}}, {0x6, 0xaa8, {0x1, 0xc5f}}, {0x6, 0x8000, {0x3, 0x8}}, {0x8, 0x4, {0x0, 0x3}}, {0x5, 0x9, {0x0, 0x1}}, {0x3, 0x3, {0x0, 0xfffffff0}}, {0x7, 0x1ff, {0x1, 0x4}}, {0x5df, 0xb, {0x1, 0x3}}, {0xd, 0x2, {0x2, 0x7}}, {0x4, 0x3, {0x3, 0x2}}, {0x5, 0xfc01, {0x2, 0x8001}}, {0x4209, 0x8af4, {0x1, 0x6}}, {0x77, 0x1, {0x1}}, {0x1, 0xdbb, {0x3, 0xd6}}, {0x0, 0x5, {0x0, 0x10001}}, {0xffff, 0x9, {0x0, 0x9}}, {0x7, 0x3, {0x2, 0xce}}, {0xd3fa, 0x1, {0x2, 0x5}}, {0x6, 0x5, {0x3, 0x4}}, {0x8ff9, 0x7, {0x2, 0x200}}, {0x9, 0x800, {0x2, 0x7ff}}, {0x0, 0xfff7, {0x0, 0xd9c115f}}, {0x7, 0x8, {0x2, 0xd}}, {0x77ee, 0x10, {0x2, 0xbfb}}, {0x2, 0x0, {0x2, 0xa}}, {0x7, 0x4, {0x0, 0x2}}, {0x8000, 0x1ff, {0x0, 0x8000}}]}}}, {{0x254, 0x1, {{0x2, 0xeeba}, 0x62, 0xfe, 0x6, 0xb, 0x40, 'syz1\x00', "46d23ab4ca91b326d43b08d5014baa1d4fe2f0a5dfc5149a20c9f113c52828bd", "590a206a78147642756613c41e0c80148fc2b8d853311249b52dadd7c3b8c276", [{0x2, 0x2, {0x0, 0xc7}}, {0x7ff, 0x2, {0x0, 0xec}}, {0xfff8, 0x30, {0x1, 0xa}}, {0x1, 0xfff9, {0x2, 0x9}}, {0x0, 0xff4b, {0x2, 0x9}}, {0x0, 0x1, {0x1, 0xc}}, {0x8, 0x8, {0x1, 0x2}}, {0x0, 0xd, {0x0, 0x7}}, {0x4, 0x6, {0x0, 0x7}}, {0x6, 0x8, {0x1, 0x40}}, {0x1, 0xd8c2, {0x3, 0x72}}, {0x4, 0x10, {0x2, 0x6}}, {0x0, 0xfff, {0x0, 0x8}}, {0x6, 0x8, {0x2, 0xd}}, {0x0, 0x3, {0x3, 0x94e8}}, {0x0, 0x4, {0x3, 0x8}}, {0x6cb7, 0x7f, {0x0, 0x8}}, {0x6, 0x6, {0x0, 0x40}}, {0x9, 0xf906, {0x2, 0x8}}, {0x3ff, 0x9, {0x3, 0x2}}, {0x6, 0xfe, {0x2, 0x7f}}, {0x4, 0x400, {0x1, 0x40}}, {0x97, 0xfff8, {0x1, 0x9}}, {0xa, 0x200, {0x1, 0x462e6a74}}, {0x8, 0x1, {0x1, 0x3}}, {0x2, 0x0, {0x0, 0x8}}, {0x2, 0x8, {0x3, 0x5}}, {0x80, 0x1, {0x0, 0xc}}, {0x9, 0x100, {0x2, 0xe}}, {0xffff, 0x7, {0x1, 0x1000}}, {0x9, 0x5, {0x1, 0x3}}, {0xfffd, 0x2, {0x1, 0x7}}, {0x3e6, 0x1, {0x2, 0x7}}, {0x401, 0x8, {0x3, 0x300000}}, {0x7, 0x7, {0x3, 0x5}}, {0x256, 0xb, {0x0, 0x1ff}}, {0x0, 0x7fff, {0x2, 0x5}}, {0x65, 0x5, {0x1, 0x1}}, {0x3, 0x8, {0x1, 0xf87}}, {0x5, 0x2, {0x0, 0x2}}]}}}, {{0x254, 0x1, {{0x0, 0x8}, 0x0, 0x15, 0xbdd, 0x9, 0x8, 'syz0\x00', "8464d1b435bef7a34afcfa381de438301c4a3afc12d0f786b7738d685fdac60f", "26c6f4b10e8f8cdea25068590bb65b2ea81ce343aa6b1e2d30c93953220605b3", [{0x0, 0x9, {0x2, 0x80000001}}, {0x0, 0x1, {0x3, 0xffffff7f}}, {0x4, 0x5, {0x1, 0xc}}, {0x4, 0x3, {0x3, 0x401}}, {0x2, 0x11c, {0x2, 0x2}}, {0x3, 0x8, {0x3, 0x51611a44}}, {0x6, 0xe30, {0x1, 0x7}}, {0x1000, 0x8, {0x1, 0x650}}, {0xfffa, 0x8, {0x1, 0xd}}, {0x1, 0x2, {0x3, 0xc}}, {0x0, 0x9, {0x1, 0x5}}, {0x7, 0x3, {0x1, 0x77e}}, {0x400, 0x2, {0x2, 0xffffffff}}, {0x0, 0xc426, {0x2, 0x6}}, {0xffff, 0x6, {0x2, 0x9}}, {0x3, 0x4, {0x0, 0x68}}, {0x7f, 0x2, {0x1, 0x5}}, {0x7, 0x7fff, {0x3, 0xc}}, {0x80, 0x0, {0x2, 0x4}}, {0x800, 0x7, {0x3, 0x4b1}}, {0x2c1, 0x7, {0x3, 0x6}}, {0x6, 0x0, {0x1, 0x7}}, {0x8, 0x6, {0x0, 0x4}}, {0x5, 0x2, {0x1, 0x6}}, {0x0, 0x81, {0x0, 0x1}}, {0x6a6, 0x6, {0x1, 0xc}}, {0x4, 0xfff4, {0x3, 0x5a20}}, {0xd, 0x40, {0x3, 0x1}}, {0xc427, 0xa5, {0x3, 0x4}}, {0x5, 0x6, {0x2, 0x7}}, {0xd, 0x5, {0x3}}, {0x6, 0x0, {0x3, 0x10000}}, {0x2, 0x9, {0x0, 0xe31b}}, {0x0, 0x6, {0x2, 0x6}}, {0x8, 0xff, {0x2, 0x8}}, {0x0, 0xc, {0x1, 0x1}}, {0x87d, 0x0, {0x3, 0x4bda}}, {0xfff, 0xe, {0x2, 0x9}}, {0x3, 0x6, {0x76a479beca9495b7, 0x7279}}, {0xd, 0x3, {0x1, 0x8000}}]}}}]}, 0x12b4}}, 0x24000090) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r3 = accept4$phonet_pipe(r2, &(0x7f0000001880), &(0x7f00000018c0)=0x10, 0x180800) accept4$phonet_pipe(r3, &(0x7f0000001900), &(0x7f0000001940)=0x10, 0x80000) r4 = accept$packet(0xffffffffffffffff, 0x0, &(0x7f0000001980)) setsockopt$packet_int(r4, 0x107, 0xf, &(0x7f00000019c0)=0x4, 0x4) (async, rerun: 32) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000001a80)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000001a00), &(0x7f0000001a40)='%pB \x00'}, 0x20) (async, rerun: 32) pipe(&(0x7f0000001ac0)={0xffffffffffffffff, 0xffffffffffffffff}) (async, rerun: 32) r8 = bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000001b80)=0xffffffffffffffff, 0x4) (rerun: 32) r9 = bpf$MAP_CREATE(0x0, &(0x7f0000001b00)=@bloom_filter={0x1e, 0x8, 0x10000, 0x100, 0xd480, r5, 0x86ca, '\x00', 0x0, r6, 0x4, 0x1, 0x3, 0x5, @value=r8}, 0x50) (async, rerun: 64) sendmsg$NL80211_CMD_GET_WOWLAN(r7, &(0x7f0000001c80)={&(0x7f0000001bc0)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000001c40)={&(0x7f0000001c00)={0x14, r0, 0x400, 0x70bd2a, 0x25dfdbfd, {{}, {@void, @void, @void}}, ["", "", "", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x8000}, 0x88c0) (async, rerun: 64) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001cc0)={0xffffffffffffffff}) recvfrom$unix(r10, &(0x7f0000001d00)=""/40, 0x28, 0xd2611a9519bfeeae, 0x0, 0x0) (async) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000001d80)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_DEL_PMK(r6, &(0x7f0000001e40)={&(0x7f0000001d40)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000001e00)={&(0x7f0000001dc0)={0x28, r0, 0x100, 0x70bd25, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r11}, @void}}, [@NL80211_ATTR_MAC={0xa}]}, 0x28}, 0x1, 0x0, 0x0, 0x4000000}, 0x40400) (async) ioctl$XFS_IOC_FD_TO_HANDLE(r10, 0xc038586a, &(0x7f0000001f80)={r4, &(0x7f0000001e80)=',*%++\x00', 0x408000, &(0x7f0000001ec0)={@align=0x1, {0x8, 0x7, 0x80, 0x1}}, 0x44ba7ef8, &(0x7f0000001f00), &(0x7f0000001f40)=0xfffffffb}) ioctl$SIOCX25SFACILITIES(r12, 0x89e3, &(0x7f0000001fc0)={0x39, 0xfffffc00, 0x9, 0x7, 0xfffffffe}) bpf$ITER_CREATE(0x21, &(0x7f0000002000)={r7}, 0x8) (async, rerun: 64) getsockopt$inet6_opts(r6, 0x29, 0x39, &(0x7f0000002040)=""/45, &(0x7f0000002080)=0x2d) (async, rerun: 64) r13 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r13, 0x6, 0x16, &(0x7f00000020c0)=[@mss={0x2, 0x8}, @mss={0x2, 0x4}, @window={0x3, 0x101}, @mss], 0x4) socket$inet6_icmp(0xa, 0x2, 0x3a) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000002100), r12) (async, rerun: 32) r14 = socket$nl_rdma(0x10, 0x3, 0x14) (rerun: 32) epoll_ctl$EPOLL_CTL_ADD(r7, 0x1, r14, &(0x7f0000002140)={0x1}) (async, rerun: 64) pwrite64(r9, &(0x7f0000002180)="9b67d28e3da6e0aab903f194c02c099c6e423a9412c6e9ffa68663bdbd3ea6c96d01a34372e20f0caeed77a9a7044930cbd3b2e362bb0b4f5b4d47da16541365df2bc2e54757fbf95aa45d500daedbae8727a4ef2af9b6995e447f1aa8aaa43759700d93c05e2297f000330ac0321a644ca67194", 0x74, 0x8) (rerun: 64) 924.656766ms ago: executing program 1 (id=7302): r0 = socket(0x21, 0x803, 0x1) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r2 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f00000001c0), 0xffffffffffffffff) sendmsg$NLBL_UNLABEL_C_STATICLISTDEF(r1, &(0x7f0000000640)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000600)={&(0x7f0000000500)={0xc4, r2, 0x1, 0x70bd2b, 0x25dfdbfb, {}, [@NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @local}, @NLBL_UNLABEL_A_ACPTFLG={0x5}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}, @NLBL_UNLABEL_A_ACPTFLG={0x5}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @broadcast}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @private2}, @NLBL_UNLABEL_A_SECCTX={0x29, 0x7, 'system_u:object_r:usbtty_device_t:s0\x00'}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @private1}, @NLBL_UNLABEL_A_SECCTX={0x27, 0x7, 'system_u:object_r:lirc_device_t:s0\x00'}]}, 0xc4}, 0x1, 0x0, 0x0, 0x20040000}, 0x10) (async) sendmsg$nl_route(r0, &(0x7f0000000380)={0x0, 0x4076cbba9945d516, &(0x7f0000000340)={0x0, 0x14}}, 0x0) (async) r3 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) bind$802154_dgram(r3, &(0x7f0000000000)={0x24, @long={0x3, 0x2, {0xaaaaaaaaaaaa0002}}}, 0x14) (async) sendmsg$802154_dgram(r3, &(0x7f0000000200)={&(0x7f0000000080), 0x14, &(0x7f0000000040)={0x0}, 0x1, 0x0, 0x0, 0x20000800}, 0x800) (async) getsockname$packet(r0, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async) unshare(0x22020400) (async) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cpuacct.usage_percpu_sys\x00', 0x275a, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000400)=@base={0x19, 0x4, 0x6, 0x5}, 0x50) (async) read$alg(r5, 0x0, 0x0) (async) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000002c0)=ANY=[@ANYBLOB="4c000000100039042abd70000000000000000000", @ANYRES32=r4, @ANYRESDEC=r1], 0x4c}}, 0x0) (async) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000480)=ANY=[@ANYBLOB="60000000100001040000000023e43ae600000000", @ANYRES32=r4, @ANYBLOB="3520040085ad0000400012800e00010069703665727370616e0000002c00028008001500b7210700050016000100000014000700fc02000000000000000000000000000004001200"], 0x60}, 0x1, 0x0, 0x0, 0x4040014}, 0x0) 916.053983ms ago: executing program 4 (id=7303): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000000040)={'vxcan1\x00', 0x0}) connect$can_bcm(r1, &(0x7f0000000140)={0x1d, r2}, 0x10) sendmsg$can_bcm(r1, &(0x7f0000000a80)={0x0, 0x0, &(0x7f0000000a40)={&(0x7f0000000200)=ANY=[@ANYBLOB="050000003008000000000000", @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0], 0x80}, 0x1, 0x0, 0x0, 0x40084}, 0x0) sendmsg$can_bcm(r1, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000480)=ANY=[@ANYBLOB="05"], 0x48}, 0x1, 0x0, 0x0, 0x1}, 0x4004844) r3 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000180)={'vxcan0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000000c0)=@getchain={0x24, 0x11, 0x839, 0x70bd25, 0x100003, {0x0, 0x0, 0x0, r4, {0xb, 0xfff3}, {0x3, 0xfff9}, {0xffe0}}}, 0x24}}, 0x0) mmap(&(0x7f0000691000/0x4000)=nil, 0x4000, 0x3, 0x28011, 0xffffffffffffffff, 0x0) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) mmap(&(0x7f0000496000/0x2000)=nil, 0x2000, 0x0, 0x12, r5, 0x0) mmap(&(0x7f00004f1000/0x3000)=nil, 0x3000, 0x2000006, 0x12, r5, 0x913e0000) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) mmap(&(0x7f0000691000/0x4000)=nil, 0x4000, 0x0, 0x12, r6, 0x0) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) mmap(&(0x7f00005d5000/0x3000)=nil, 0x3000, 0x0, 0x13, r7, 0x3000) r8 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) r9 = socket$kcm(0x21, 0x2, 0x2) sendmsg$kcm(r9, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001a00)=ANY=[], 0x10b8}, 0xff00) r10 = socket$rxrpc(0x21, 0x2, 0x2) bind$rxrpc(r10, &(0x7f0000000340)=@in4={0x21, 0x3, 0x2, 0x10, {0x2, 0x0, @local}}, 0x24) mmap(&(0x7f00004a3000/0x1000)=nil, 0x1000, 0x0, 0x13, r8, 0x0) r11 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r12 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000001080)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0ff0100000079a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe00000000850000000d000000b70000000000000095000000000000005ecefab8f2e85c6c1ca711fcd020f4c0c8c56147d66527da307bf731fef97861750379585e5a076d839240d29c034055b67dafe6c8dc3d5d78c07fa1f7e655ce34e4d5b3185fec0e07004e60c08dc8b8dbf11e6e94d75938321a3aa502cd2424a66e6d2ef831ab7ea0c34f17e3946ef3bb622003b538dfd8e012e79578e51bc53099e90f4580d760551b5b341a29f31e3106d1ddd6152f7cbdb9cd38bdb2209c67deca8eeb9c15ab3a14817ac61e4dd11183a13477bf7e860e3665f1328d6704902cbe7bc04b82d2789cb132b8667c2147661df28d9961b63e1a9cf6c2a660a1fe3c184b751c51160fb20b1c581e7be6ba0dc001c4110555850915148ba532e6ea09c346dfebd38608b3280080005d9a9500000000000000334d83239dd27080851dcac3c12233f9a1fb9c2aec61ce63a38d2fd50117b89a9ab359b4eea0c6e95767d42b4e54861d0227dbfd2e6d7f715a7f3deadd7130856f756436303767d2e24f29e5dad9796edb697aeea0182babd18cac1bd4f4390af9a9ceafd0002cab154ad029a1090000002780870014f51c3c975d5aec84222fff0d7216fdb0d3a0ec4be3e563112f0b39501aafe234870072858dc06e7c337642d3e5a815232f5e16c1b30c3a6a71bc85018e5ff2c91018afc9ffc2cc788bee1b47683db01a469398685211dfbbae3e2ed0a50e7313bff5d4c391ddece00fc772dd6b4d4de2a41990f05ca3bdfc92c88c5b8dcd36e7487afa447c2edfae4f390a8337841cef386e22cc22ee17476d738952229682e24b92533ac2a9f5a699593f084419cae0b4532bcc97d3ae486aca54183fb01c73f979ca9857399537f5dc2acb72e7ead0509d380578673f8b6e74ce23877a6b24db0000000000000003629fbef2461c96a088a22e8b15c3e233db7ab22e30d46a9d24d37cef099ece729aa218f9f44a3210223fdae7ed04935c3c90d3add8eebc8619d7b90dfae158b94f50adab988dd8e12b1b56073d0d10f7067c881434af5cc9398fff00404d5d99f82e20ee6a8c88e18c2977aab37d9ac4cfc1c7b400000000000007ff57c39495c826b956ba859ac8e3c177b91bd7d5e41ff868f7ca1664fe2f3ced846891180604b6dd2499d16d7d9158ffffffff00000000ef069dc42749da00000097f29d0000002d8c38a967c1bbe09315c29877a331bcc87dc3addb08141bdee5d27874b2f663ddeef0005b3d96c7aabf77bfc95769a9294df517d90bdc01e73835efd98ad5a3e1a90800c66ee2b1ad76dff9f9000071414c99d4894ee7f8249dc1e3428d2129369ee1b85af6eb2eea0d0df414b31592479ecf2392548f11e1036a8debd64cbe359454a3f2239cfe35f81b7a490f167e6d5c1109000000000000000042b8ff8c21ad702ccacad5b39eef213d1ca296d2a27798c8ce2a305c0c7d35cf4b22549a4bd92052188bd1f285f653b621491dc6aaee0200e2ff08644fb94c06006eff1be2f633c1d987591ec3db58a7bb3042ec3f771f7a1338a5c3dd35e926049fe86e09c58e273cd905deb28c13c1ed1c0d9cae846bcbfa8cce7b893e578af7dc7d5e87d44ff828de453f34c2b18660b080efc707e676e1fb4d5825c0ca177a4c7fbb4e62b445c00f576b2b5cc7f819abd0f885cc4806f40300966fcf1e54f5a2d38708194cd6f496e5dee734fe7da3770845cf442d488afdc0e17000000000000000000000000000000000000000000000000000005205000000dc1c56d59f35d367632952a93466ae595c6a8cda690d192a070886df42b27098773b45198b4a34ac977ebd4450e121d01342703f5bf030e935878a6d169c80aa4252d4ea6b8f6216ff202b5b5a182cb5e838b307632d03a7ca6f6d0339f9953c3093c3690d10ecb65dc5b47481edbf1f000000000000004d16d29c28eb5167e9936ed327fb237a56224e49d9ea955a5f0dec1b3ccd35364600000000000000000000000000000000000000000000000000000000000026ded4dd6fe1518cc7802043ecfe69f743f1213bf8179ecd9e5a225d67521dc728eac7d80a5646ac2cbde21d3ebfbf69ff861f4394836ddf128d6d19079e64336e7c676505c78ad67548f4b192be1827fcd95cf107753cb0a6a979d3db0c407081c6281e2d8429a863903ca75f4c7df3ea8fc2018d07af1491ef060cd4403a099f32468f65bd06b4082d43e121861b5cc03f1a1561f0589e0d12969bc982ff5d8e9b986c0c6c747d9a1cc500bb892c3a16ff10feea20bdac0000000000000000ca06f256c8028e0f9b65f037b21f3289f86a6826c69fa35ba5cbc3f2db1516ffc5c6e3fa618b24a6ce16d6c7010bb37b61fa0a2d8974e69115d33394e86e4b838297ba20f96936b7e4766e92dea6c5d1d33d84d96b50fb000000ae07c65b71088dd7d5d1e1bab9000000000000000000000000b5ace293bec859c13e3229432ad71d646218b5229dd88137fc7c59aa242af3bb4efb82055a3b61227ad40f52c9f250057931d828ec78e116ae46c4897e2795b6ff92e9a1f63a6ed8fb4f8f3a6ec4e76f8621e24b0b855c02f2b7add58ffb25f339297729a7a51810134d3dfbf71f6516737be55c06d9cdcfb1e2bb10b50000eb4acff90756dba1ecf9f58afd3c19b5c4558ba9af6b7333c894a1fb29ade9ad75c9c022e8d03fe28bc358684492aa771dbfe80745fe89ad349ffaad76ff9dd643796caffdf67af5dd476c37e7e9a84e2e5da2696e285a59b53f2fb0e16d8262c080c159ce40c14089c82759106f422582b42e3e8484ea5a6ad9aa52106eafe0e0caea1ad4cb23f3c2b8a0f455ba69ea284c268d54b43158a8b1d128d02af263b3dc1cab794c9ac57a2a7332f4d8764c302ccd5aac114482b619fc575aa0dd2777e881e29a854380e2f1e49db5a1517ec40bb3fa44f9959bad67ccaba76408da35c9f1534c8bd48bbd61627a2e0a74b5e6aefb7eee403f02734137ff472558014391c673b6071b6ad0f05eed164ca63e4ea26dce0fb3ce0f6591d80dfb8f386bb79f5589829b6b0679b5d65a81826fc9b38f791c8f1892b51ad65a89bc84646ebf78f5d5d4804d9abb071fd711b5e7cc163b42a6510b8f5ee6747df0b560eabe0499bf1fef7c18bb9f55effa018679845c6598fb78bf1b8d9d9f04a5f6062c2bbb91952755b3f7c948268cb647d0a0bb1286480615941154a01d74e2f2efa77850686ee4541f3e79efa63545a7ae53d5f0c40cc86473f7eb093980bd0d97bb4750128d9c519984c5f731ea259e71b2f12d67ce12e52c283e74594dfc933e625737ed231d61263721d46daf093f770357cd78fe1431aef52b4a0a933f1a5334ad03f3876fc8a8e187f80318427b4c922075cf829e3cc49d71d52137b48e1fb6b05dd1c7b251a7059f0a4b4f3431f67fc65b75c202e43816e34ff41db85bacd77b25242830b788ae1e00000000000000000000000000c8b8b5b137dcb7a7949e12307d1fce56fe5b76d2f3f5a7692379542e3fd9a5a7dc57e1dec0bdce65b5db59a0733c9b9da612adb91948ecbfaff8fc206b8350fe268b98aaa2e288be77aedddcc7fb7d631e69b176e2e6678fe1237cb2"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r12, 0x18000000000002a0, 0xf, 0x0, &(0x7f0000000100)="b9ff03076844268cb89e14f088471b", 0x0, 0x8, 0x60000000, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x50) mmap(&(0x7f00005d5000/0x2000)=nil, 0x2000, 0x3, 0x28011, r11, 0x0) mmap(&(0x7f0000867000/0x2000)=nil, 0x2000, 0x0, 0x11, r11, 0x1000) socket(0x2a, 0x4, 0x9d32) socket(0x2a, 0x2, 0x0) 746.658098ms ago: executing program 2 (id=7304): r0 = accept4$phonet_pipe(0xffffffffffffffff, 0x0, &(0x7f0000000000), 0xc0800) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000040)={'batadv_slave_0\x00', 0x0}) (async) getsockopt$sock_timeval(r0, 0x1, 0x14, &(0x7f0000000080), &(0x7f00000000c0)=0x10) (async) ioctl$EXT4_IOC_GROUP_EXTEND(r0, 0x40086607, &(0x7f0000000100)=0xd) syz_emit_ethernet(0x22, &(0x7f0000000140)={@broadcast, @empty, @val={@void, {0x8100, 0x1}}, {@can={0xc, {{0x4, 0x1, 0x1, 0x1}, 0x5, 0x3, 0x0, 0x0, "374a44ed9e2c1040"}}}}, &(0x7f0000000180)={0x0, 0x1, [0xdeb, 0x118, 0xd42, 0xa63]}) (async) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD(0xffffffffffffffff, &(0x7f00000004c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000480)={&(0x7f0000000240)={0x234, r2, 0x400, 0x70bd2d, 0x25dfdbff, {{}, {@void, @void}}, [@NL80211_ATTR_REKEY_DATA={0x3c, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x3}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="9153cdc95dd6f5737a3da327c3af75a02e53717123bce940"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="91e1399b942d0f710962a2f083adbc7f"}]}, @NL80211_ATTR_REKEY_DATA={0x4c, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_KCK={0x14, 0x2, @kck="45faeebbc34af5b72a32f77450e4eed6"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="d0c70d9a6a9212583d8ff84ade0871f2"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "7e5e9d5acb5200d1"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="64793a7d711d78143c0a6b72cc57169f"}]}, @NL80211_ATTR_REKEY_DATA={0x8c, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="639e617b683ae00b9cf02d91a2f2cfbb6dd23e9fabd0dba7c9b85e6b8f3e653f"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0xea70}, @NL80211_REKEY_DATA_KCK={0x14, 0x2, @kck="9247cb0d4340bfdf89ef457d332b6fee"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="3958ce404e4facc8a0aa9d97ebfd1ca4"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="aee09fccad6fd5bb4416c58121dcc1b9c2fb9cb3250762f7"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "ce1fa69db52568ae"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "7b0cef1036e473c0"}]}, @NL80211_ATTR_REKEY_DATA={0x40, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="5af99ed644be8dc22d5951c4cb6079c2"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x10000}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "e92cce9e1b21dc34"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x5}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "93d3e13a6e050dc6"}]}, @NL80211_ATTR_REKEY_DATA={0xcc, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="dba89c9d640630af1f35cfacac3bfab4"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="c8e42316bc2652f246b3a1bb740e35a3"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "99a41d448d786d9e"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "1f88831ec0e9e65c"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "c8bc06feca920ffa"}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="1b775d2ba20ad849f0ec79fa37874fd590aac278aa96577686ad2d022e2b20c7"}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="03605511066100fef3993f2a08f7e1e3759958d831ec8e57"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "26fbd55e566a486c"}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="1659b4e4e480b385d8a8d97875cdc81d7090160a3efcddfcef26cb2eb4520a15"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "92afd8d2c61aff01"}]}]}, 0x234}, 0x1, 0x0, 0x0, 0x4000}, 0x8c0) (async) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r3, &(0x7f00000005c0)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x488c0}, 0xc, &(0x7f0000000580)={&(0x7f0000000540)={0x40, r2, 0x22a, 0x70bd25, 0x25dfdbfe, {{}, {@void, @val={0xc, 0x99, {0x7, 0x42}}}}, [@NL80211_ATTR_MAX_CRIT_PROT_DURATION={0x6, 0xb4, 0xfa3}, @NL80211_ATTR_MAX_CRIT_PROT_DURATION={0x6, 0xb4, 0x106f}, @NL80211_ATTR_MAX_CRIT_PROT_DURATION={0x6, 0xb4, 0x9a0}, @NL80211_ATTR_CRIT_PROT_ID={0x6, 0xb3, 0x1}]}, 0x40}, 0x1, 0x0, 0x0, 0x4040085}, 0x4000) (async) r4 = socket(0x10, 0x5, 0x2) sendmsg$nl_xfrm(r4, &(0x7f00000006c0)={&(0x7f0000000600)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000680)={&(0x7f0000000640)=@getspdinfo={0x14, 0x25, 0x10, 0x70bd29, 0x25dfdbfc, 0xfffffff7, ["", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x4000004}, 0x1) pselect6(0x40, &(0x7f0000000700)={0x9, 0x2, 0x7, 0x8, 0x41ce, 0x0, 0x1, 0x573e}, &(0x7f0000000740)={0x3, 0x4, 0x7, 0x8, 0x100000001, 0x80000000, 0x101, 0x7}, &(0x7f0000000780)={0x8, 0x7, 0x40, 0x2, 0x101, 0x0, 0xe, 0x1}, &(0x7f00000007c0)={0x77359400}, &(0x7f0000000840)={&(0x7f0000000800)={[0x2]}, 0x8}) ioctl$sock_inet6_SIOCADDRT(r4, 0x890b, &(0x7f0000000880)={@private0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @mcast2, 0x3, 0x6, 0x7, 0x400, 0xed8d, 0x100014, r1}) (async) sendmsg$tipc(r4, &(0x7f0000000b00)={&(0x7f0000000900)=@name={0x1e, 0x2, 0x0, {{0x2, 0x3}}}, 0x10, &(0x7f0000000a80)=[{&(0x7f0000000940)="5341843bdc6eaf10c2c9d233016e5b6f855e1c251405c7ebe7a051759f822b0ebbb42b66e642335ca4762c8c3505731dae19828349699f5704bb1e0967f46d7ea5bf874fa1ef8bd0607cc2377d1df221eb0dc5c44990e4d5cae7b3d7f076e61b92b98c08b7f235051a3b2a499ce8e4d25c6d6e14c4f374b6f6213c6912ca13e22ebc72695526da3dd5baee971660a1c84caa87d452f4a86a0678a731d110bca42f13b468df8929bf3a33969357bc2aa94a01bb27e1e8cc682eea28716ce005ca5e292cb120b14a7e1916a10fdf9f7700ad5b548cfad9c73d11814744822dea5914", 0xe1}, {&(0x7f0000000a40)="1de64913891deb88ce3d2e2837fb2042aa110a77eac6b6456a8cc38b518abf95", 0x20}], 0x2, &(0x7f0000000ac0)="0d6e28196f086a1ce7845eaa830ce4ae365c2551daf3db1325ac6050bd89428a75c4e31494b79650070d7f59056edcb92b20a0", 0x33, 0x48}, 0x0) (async) ioctl$sock_SIOCGIFVLAN_SET_VLAN_NAME_TYPE_CMD(r4, 0x8982, &(0x7f0000000b40)={0x6, 'dvmrp1\x00', {0x8}, 0x7}) (async) clock_gettime(0x0, &(0x7f0000008b40)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000008900)=[{{&(0x7f0000000b80)=@ethernet={0x0, @multicast}, 0x80, &(0x7f0000001e00)=[{&(0x7f0000000c00)=""/52, 0x34}, {&(0x7f0000000c40)=""/4096, 0x1000}, {&(0x7f0000001c40)=""/186, 0xba}, {&(0x7f0000001d00)=""/227, 0xe3}], 0x4, &(0x7f0000001e40)=""/53, 0x35}, 0xffff}, {{0x0, 0x0, &(0x7f00000040c0)=[{&(0x7f0000001e80)=""/4096, 0x1000}, {&(0x7f0000002e80)=""/110, 0x6e}, {&(0x7f0000002f00)=""/115, 0x73}, {&(0x7f0000002f80)=""/160, 0xa0}, {&(0x7f0000003040)=""/4096, 0x1000}, {&(0x7f0000004040)=""/111, 0x6f}], 0x6, &(0x7f0000004140)=""/11, 0xb}, 0x9}, {{&(0x7f0000004180)=@vsock, 0x80, &(0x7f0000004500)=[{&(0x7f0000004200)=""/14, 0xe}, {&(0x7f0000004240)=""/149, 0x95}, {&(0x7f0000004300)=""/246, 0xf6}, {&(0x7f0000004400)=""/201, 0xc9}], 0x4, &(0x7f0000004540)=""/174, 0xae}, 0x80}, {{&(0x7f0000004600)=@hci, 0x80, &(0x7f00000056c0)=[{&(0x7f0000004680)=""/48, 0x30}, {&(0x7f00000046c0)=""/4096, 0x1000}], 0x2, &(0x7f0000005700)=""/91, 0x5b}, 0x1}, {{0x0, 0x0, &(0x7f0000005880)=[{&(0x7f0000005780)=""/217, 0xd9}], 0x1, &(0x7f00000058c0)=""/240, 0xf0}, 0x200}, {{&(0x7f00000059c0)=@in6={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @loopback}}, 0x80, &(0x7f0000006b00)=[{&(0x7f0000005a40)=""/4096, 0x1000}, {&(0x7f0000006a40)=""/175, 0xaf}], 0x2}, 0xfffffffd}, {{&(0x7f0000006b40)=@hci, 0x80, &(0x7f0000007140)=[{&(0x7f0000006bc0)=""/32, 0x20}, {&(0x7f0000006c00)=""/208, 0xd0}, {&(0x7f0000006d00)=""/234, 0xea}, {&(0x7f0000006e00)=""/171, 0xab}, {&(0x7f0000006ec0)=""/140, 0x8c}, {&(0x7f0000006f80)=""/24, 0x18}, {&(0x7f0000006fc0)=""/98, 0x62}, {&(0x7f0000007040)=""/214, 0xd6}], 0x8, &(0x7f00000071c0)=""/192, 0xc0}, 0x7}, {{&(0x7f0000007280)=@qipcrtr, 0x80, &(0x7f00000086c0)=[{&(0x7f0000007300)=""/20, 0x14}, {&(0x7f0000007340)=""/110, 0x6e}, {&(0x7f00000073c0)=""/4096, 0x1000}, {&(0x7f00000083c0)=""/217, 0xd9}, {&(0x7f00000084c0)=""/52, 0x34}, {&(0x7f0000008500)=""/206, 0xce}, {&(0x7f0000008600)=""/171, 0xab}], 0x7, &(0x7f0000008740)=""/40, 0x28}, 0x9}, {{0x0, 0x0, &(0x7f0000008880)=[{&(0x7f0000008780)=""/254, 0xfe}], 0x1, &(0x7f00000088c0)=""/42, 0x2a}, 0x2}], 0x9, 0x2000, &(0x7f0000008b80)={r5, r6+60000000}) (async) r7 = syz_genetlink_get_family_id$l2tp(&(0x7f0000008c00), r4) sendmsg$L2TP_CMD_SESSION_DELETE(r4, &(0x7f0000008cc0)={&(0x7f0000008bc0)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000008c80)={&(0x7f0000008c40)={0x34, r7, 0x100, 0x70bd26, 0x25dfdbfd, {}, [@L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0x8}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e20}, @L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x7}, @L2TP_ATTR_SESSION_ID={0x8, 0xb, 0x3}]}, 0x34}, 0x1, 0x0, 0x0, 0x4}, 0x8000) (async) sendmsg$NL80211_CMD_SET_PMKSA(r4, &(0x7f0000008dc0)={&(0x7f0000008d00)={0x10, 0x0, 0x0, 0x80401010}, 0xc, &(0x7f0000008d80)={&(0x7f0000008d40)={0x28, r2, 0x800, 0x70bd2a, 0x25dfdbfb, {{}, {@void, @val={0xc, 0x99, {0x5, 0x20}}}}, [@NL80211_ATTR_SSID={0x8, 0x34, @random='$_{?'}]}, 0x28}, 0x1, 0x0, 0x0, 0x800}, 0x5) (async) sendmsg$IPVS_CMD_NEW_DEST(r4, &(0x7f0000008f40)={&(0x7f0000008e00)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000008f00)={&(0x7f0000008e40)={0xa8, 0x0, 0x200, 0x70bd27, 0x25dfdbfe, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x9d30}, @IPVS_CMD_ATTR_DEST={0x2c, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0xff}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x6, 0xb, 0xa}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x200}, @IPVS_DEST_ATTR_TUN_FLAGS={0x6, 0xf, 0x4}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfff}]}, @IPVS_CMD_ATTR_DAEMON={0x3c, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'sit0\x00'}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @mcast2}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x9}]}, @IPVS_CMD_ATTR_SERVICE={0x1c, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x4e20}, @IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x4e22}, @IPVS_SVC_ATTR_SCHED_NAME={0x7, 0x6, 'nq\x00'}]}]}, 0xa8}, 0x1, 0x0, 0x0, 0x8000}, 0x8004) (async) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r0, 0xd000943e, &(0x7f0000008f80)={0x0, 0x0, "85fd60104f1cbe7b1fc900fe4bb547fc2af6d0a7473666d50f5efc0ee1a38cf4c79345bd92da18fef32814725db00c033c065ce88b68568e404d97f30660f4cbd323f2ea00e9db84a1ae0944d6510f63840c7ea1c6740416d4c325eb6e43c188c487d1013803489f3b7361cc74a5f83257dd46c98e2450460f6e05d4f23aee99e60976f6ef42cb64e9da2c066765b539d743103bbd65505f8bdb2faa38bfc8ad1c00c78b621503317980080f8d3107928f75fdb741e37bb9448249ea2811c4b88958be91171c841b8a836e01422091798e3289120864cb258bb454aa0de92e0b07d2e104c4cdbc50c0345586e6f701646e75369cc125b502c4d77f611565dc23", "8d9eb44e0e9e2a5d016f1b542953138686d02e87b8ea243a08cfb3716699c6051b75c708f586dc116c22e2bc41f80a8c77955291ce86178790b10447e59e7c40de63d950faeb653b88d5862978c3c9c3b66475e4bba68dcc3703c937b413081de4341199987037d39cebce343da073b71e9161f3c382ec4491a1ed806384c5c923d14c3a89b45f061f8b099a9fb1afa92cde7215428a8248b55da334ee800ef65cccbd811518efd248a5ed3dacf61a616518b303d360a48941c5868b00666d2d902dc4265e891094804cfb092255abead947a72a7903c425c9614956d8d589f6e01d08911e19f362b52f9296ec858de13f0c1b8f101c0d999afed5c8b40b497368e573f6f6560e2154739b469168b2d5f1ee13090844f54573aabec3acafea51b4a2fc5fbb66dcaa5b86a8c66af2788d4568cc5ea9ee675aeb1440e4f952bf9b048d49e02e550d157edfeb9c52b8e28812f0e4e4b08046fabd6e07d7ae7524da13d323f10484a78b18ed4bc562abe4b0641b9be7a8f76c45b54078c3fcd0e53049f8aa5fe6eb975fa141aef1bd69e1ad558b28db7bd74b530d807fd46dc3a49aaa15b9f7b7f094c71f066d06b8fbffafbdd1d0d455d83edb408c67760233c71b9a6861523e47c270fee7beb8e2dead37bbb57d0a35cc8ee586bb3a95ef2ccba1d91b130b145430cb8d2f16832e1be5c4b4456e671df9499e9a74f73fb2ed4d194355104c0890251d26cc0567582a0801b54b612d3b78a0f94a653854cfe92644ec0e732f938cb2f787933c3851de38fc59186e22ea70ba87b745b5b3ce3cd37d5212251d1edd43ed41e315a4536f885b5d2a434ba406d46f2ae4bc0fbbe7e46f26c73ff382dadd4869d8c2302bc2fcaaaa415bdbdc28bfb05bcb5eb15f28b1ff252c23906d8409d96797fcbabb075d5dc69c8a78e5fe722710a689938f39aabf102edc22c7e013d32894a9f89737865afe1ffa759e45bccbcbe83e2119c018e4e4cf6a69458cacdac60fc1a41675eae6adfb5c24d52b8b5312eb67213ca7a7d00808f007be94d2ae708f55d9479fd6f87f4c315596979de528306304043c12429072c683800ccc914488b2a435cc4eb331f758e4adad1a67e3ac5706cec657992e7971bfb64c0c2145456f5aa97ad3008b9339ec3258b17c58d1ea140ddad4181a62aa8c3bded36fb64adba1395c1e13896da235392c77deec16accaaf9de3f041d0213aa1b32728e2c62a4d776dbcd65e39d04837782050f3289b6edf1513b04ca6a01742b8d31b360392c8a4d7b6f668f28acc7ed5dff5eea87cf60c7ba262eb0f7cb9cdf314f106fc42db4c71c1bdb0f5138da20edbd0422f6c576ebb119a2e2111fffa45d0d4b817aea0cdfe707cff7fb61360b1d2611b3fd2bd75fca633de575b420f6c8a2d94c0dc248b1e55fc5c31e36bde0ae7e02ef063c39deb39800d3943e9452a5fbcec95361cff03eccf1361471c5cbfe70d1eabfeb4d7fde8e91b9349972b6f1d184ea16439e47bfd124eac84a68c453193dc80db5e87751cad1c9f9f4e4162233eac6e54182ff29f895e88c9c786847c6de4ae898e8f877562699abaaac55f499daaf27d04f5b89e983ca2fd5db242ac718e1b1bfa379eb2a9e5d16864d4ea70a8e42f60ed4d18126dc8bbc88b87fd408b60ebb76104785508098d0fa9aac2c321d8044cd06594d7ff8d2f5a21bfa1623fd6c30bfec330e1e884efe995687f5645a80560971a6b66bcdb89fded27b9f62ba016c80dc87efd96a923102398698b3af917f98ec4d2596dcf69cf404182939ad31d546c5e36dd662b3853aa4cf2de1074d7e9fbfa244638a008afe12e01f52ba52ab750dc18e8d09f7dca8ca9089aae1ddf4f1529c1e395e477b71ec2b6c33004b6c3a1e18c4b061a3fb4433b5ef3a222325a22fe5d6d9cf94ef435e5de484c6e1073585541342ffb250c49d45316c0f69652bf5bdd3aa759c27e6857e0c62d4a02f84ccb4c51cd12ad62b4a9bf64f2b7fd76c5740b9e3e3d1ebe9abc8567c87ace436dc821302ccf734803695a6df6d53c8df1bd238bde76abc249d521a1af3784cefc6d498518d0ae69fcd4e7ca45060110836c800640215537200e88d04a6e44733fac2d1bb3627ca040a6fad52d2f32df6de47e75658833f08ef9775f79e2760d060a6735447c4c229c3456749a9716f9a0de20f38e5b3ec5f6b827c2203fe02f58b70cbe7459b107a926ffd6ad4253ca854e4d95e85055912a3d7b6ab5eef09dc411d0f5c2ec3fbac78a4de357f0e1da4ebf3688a837feaa934d233f229286f5f70e37dd7bd53c37395f459a34e1a52c735c4111489142416809bc60346bf44a29bd43c6563aa359a9d775f815ceaf3bddc7c85fa07a9654eefada524072935cfd3b91b8bbdddc6dfffddfc41337cee7736067ab8fb5983bce88e5c851a55fca1c783285f479305688a81fbf4ca1b589c3b50ce2c1bace0b1b3f8058586121fb48211e29ec128ab90b0b7e31b579cf31c057be9ae46e2b08283de6863519e793e4e539877ff297dd9a51bc98387d2f46739be167c373d76de23e97964b5ea214bcd1c009787e45d32d760f6d6a259f7749c31dc89afe579f2f621d2b76c40b6093044ce33e0b60792994c9b563cce87f62976b3dc52bbb80fc4a1ee8b775454d39849d9db3e08ba8f6852c33b3f97c82f01b546f7e84841d663b5570405f99f6088b4412b0c65bceea71a36b7e14bb0a74eba0d8abcef1c11c609aa5fccb91511d6913cf7adf2eda904dee7c7572ccb65a5ba82db209d11253dd452b3223ab273cb49597a6b4c2e20f229ea5bee7f71e25fab3d9dfb7f798ae686f4c0a4e9a01541007daf46f1c82b4dba3731055d7e77053c05c670ad12575917247ab84bc3df9e288eb6a57b62f7182aadd5b71a7d851077118fd2ab5e1b3bcf26bd0bc4c2cb4bc20f93771dcd441c908dd9c4c6f26803dd8002acdb565e2b64659dbae99df2477ded12b179f97462a374a5aa8a378451279b16c72fbef73a1f44298d9d9ee89cacdafba114e58b453beb97fce6fe62b5a782cf9f1a682611e474c729329d439fdd9c9c92f8b2d44661102b2942a1f4556212c630657860c66db58596eb27f1c44e163c5ea88b94c6944f296dda6df1154f2bb07788ac127b38c100ffc68c3c492392402ee410b719878790dd84f1e837ec5dd28e9f62aebcb83d311b33221dc68c109138210a1702361851bb98a77c91d6fa7548bc40a7d8f2de4e5a3b1d422010c7c394478d1225555857f7a6b2f9e608e18a0029285b7574bfc82ba3cc451838c66922e813d8ad27c3f0c854610e1c19ee1b4057df814c222603ebe48b7489f66c413b587c17161e7fbd2abe05a37e212c33f561fc7d42cb06d64423c875d7f9af8a4034f96402f3a2cc0c8204c896a319023927f30964ce9091722e22bb7ec63f0aa3ec5d4f8708cb272120a729757c573c820cfba90629187c7bdf5bd23913a5f38c380811bd61c3e2441ee14168782a78f806b85036b51fb68dc2be064aef1a69c9321814653e63f098c7e58de1902b7a8870ca846c608b9d9a7cf58aac89176a483b8e19b8e3601e8ccbda60d7d416dd705442d010bc95e50ac0aa7e1dcede987836554576b0ca356b1590c2fcb2fbe850b56cbaf678088a92aa1a8e433f735cd62e5a2a756fd09e37ad961bf045d6c1d89c72fa6f91f868da6879b20e89b9351d08832d3b83532b615a5b90b08fbcecfe4dbfc53e3a893808fe8d93dc0cd7c1bf685914a7f0a0bdf0b1b8d8fce9898235ae50252339a0be90df4d408aa6468010066c1f99e298555864863688fec8ebe60a4a88a3eca67610cf12fea7629f18a68b815e5c8adec306a363bd09d43a6d233b2f3220f18b418fd2f77dfe4373cb9ddd920d8c124d0c9d7c2573adddbea98421582a08ea059d23360b855b7e3cce634b5510e58c9bb4e03c614aecbf5f47cfb0ac54777e690709a4cdaebeee0065860bf909645fe603cf78c1cfcd398f46212448d07e37b1c9fbe741e9e68ef31adc716c86328e18e60f8492526aa111f1ec38dd16e2a290ebd169bb5ca800e70ee2d2a3853077e3a3f171e50b89090f01e15db05c1019c1bd667eac8bb1785351247b5fd52a869280debbf863acbd86e7fae7b3de8967c8cc51bcf6d111c342ac6a4976fd5ce72a7902f1dd595a78c186e7ff97b841cfe67449e3e9002cf53ff4345221509723a9d1241662911fc3a6847a9308d429536112e6df293ba6a95e8aa22c9f3225d3bd97d394ab9e210745ace380e6f6cc1cb3cf3ac037a439dcd85295e170df32c40126bdda6f8101b2babedb6ef46b3a0df907943c1e9a5e82b2db7fd7c259b63b60bd15eaf63616d956f87c3e5c2fce841663c67d7f1cbed7a348883938be1ed2385a81e175337a12098b9ba6f5d8f6ce1ba353051f4eeb820b5a3d7a42960a52c11db7bbca8320ceee576325a2c431c65cfe74abf002da67a187384693370cea5f2cc30741a93ead60a4068126465d3301252af94a4ba3100a5d164512393e59f5f069e7d8e726e8852b48ed33d69f555ff4e18cb3ebe313adde9f7b1cd33ba4eb57de9574999fd9e23e41e4175f8b206ba2cfb1aa3e9df78555fcd3a7a0d4ca0151c49fb81625302b9428f251c26bd6824e6710d52634679765b35f9080e954721c23b0f6c0a302b8be5cd06a24cbd94a11e5d0c906e390cb513a5cbd40f608c10fbaf7e9186e88efe616af09f34b418ce0801d58e4798aa4e4d60e3be8421b90b3effbf11cea6d812779d0634198146f5b808d76d0a1b6d06cd6f0b7db5592730bdfc44ffc0e3ac9db1ad9ceca046359cac2755a7971212464535c2f172427da1c67466bbd4c59adc2bb8117017ecea45b1414f1382831c83d15731768d4761910b9cd4ba4ecb511f695e36bf4ebdf45d75a253480f80df767fdec62644e73095176d6883cf4f2259f2c4fc73cfcfd5251c67b213601e33b06a991c941e61da13a6ec81546fc24ef704db0a231189d96631ecb60c9d977ec95ed9fefaeb9865f9540347a3faef5ee8f554b17d240dfd8bbf00cc123b5e306fd008e20f14875aa7e385861e8ca9a2545f44320d694672ba7dee4339fc1cd138202a5d13fc708d950853bbb79ebbf378875cd0507f4f5dacb7417a02ae9c2b02708eabf9605a94b2d35e00e78835c65abcbcb5bf1d95eaa0737ee6e9e8ec10649a2dd23850565207fb5b8ab6142d829a092bf8bfd9b3a9ba099d6631a84ef9225fbe43f25e3a719263c89486b4a21bd63e40b5c0e26e0297c15c91c2736f81f5f60e8896647aced0d8324b8654fd6556a8da0b0a43aab717dfd66d962a496896dd5cf76d4174c2a156918145fd362974197dfe82674f742dc23a903b8670681f5c55fe9e08b1e9e005af7b287b25e93257"}) ioctl$BTRFS_IOC_TREE_SEARCH(r4, 0xd0009411, &(0x7f0000009f80)={{r8, 0xd53c, 0x641, 0x6, 0x9, 0xffffffffffffffff, 0x8, 0x8, 0x1, 0x7, 0xc, 0x5, 0xfea, 0x4, 0x10}}) (async) sendmsg$tipc(r4, &(0x7f000000b300)={&(0x7f000000af80)=@name={0x1e, 0x2, 0x3, {{0x43}, 0x2}}, 0x10, &(0x7f000000b1c0)=[{&(0x7f000000afc0)="ea71ce8bcc07ec69255b08d0e9d24fbe7cd0fbede97ce092bee7bac8ae34d7816070c065f35d74a4302a9b3a359fa222a9e84549be6a190a9ec093065c51a61f0c32a393fa28dc9a177bf72dd9e3996643ab8b6bcb7d4cc14b7d8c4691415bc425934eefcd0e5a2cb973e3a5a404c81abafacb4af38bc9", 0x77}, {&(0x7f000000b040)="c997f5df07d88fd17e92154c5bfd0e5f8258f78ba95b9c69111d585c4f1fd5b0207aa31155f78dbf0cdc1af1b40d99dfe1272baa84438aebaeaaa69b3d9b2ee874245398334cfc03dd2dbdd0c933718d7bbb850d3d0bc834edc640331c365de9784eb9a00e5d0027a35ffe89ebe3523021b4d9e9e26349f91ab286457f119cdf", 0x80}, {&(0x7f000000b0c0)="7c18c4ea4a1e3296fa0b926523d4932b0c8aa3b00a9c2b9fc9777aff2daec388888d4237042dcb3d68cb3d3f762934cb5dd10383d1ff6b5f53b7095703899c22bed5687c66a5fb09dc0003aa123f7aef453db684a75f75cb4b7f2fa112d682e4ee101b014dd6832aa531f67b551bf2783a9055e7855292e22b49ccbf1d3c772c59a7e4f0f83b800bd5facb60a2dc5a59684e88ce86e006287ac72acde691cedf4b880eb144441c279c060637b5868e10cd5bbe8e6b1c04495c6676aeef70626c29e1adb7a368ac2c0deab1c8f1230560d9099b6b5859dbcbc681b213763cf6e30133273e1f66042e3073b5ea6e08ba558ed5dba4dfcec54436fcae5ec848", 0xfe}], 0x3, &(0x7f000000b200)="6477d70c978d4760c1993edd6207fc8118c60ce5dd72f0056721699c4439b90b60b67850e4af712d0cef064354e287a0bf92e68591aa232f3c5d273dd7b8fe38f91553482f631648b3bc66e3780c4353c0437cee36c02987a5e9fb044fe7c1bc272852332c7db8b4a58aaae3c05434ad8decfc3abf000a38f0dd351dca274fbcf1c6a8eb45f056d079f65a587216ce7b50cd3642faeb25df998bf4a839abff885bba7119db2f0514dea5c5146bb178b2ccba3db00f9a745d5284c3fb18d06c928151dc", 0xc3, 0x45}, 0x20000000) (async) r9 = syz_genetlink_get_family_id$nl80211(&(0x7f000000b380), r3) sendmsg$NL80211_CMD_ADD_TX_TS(r3, &(0x7f000000b440)={&(0x7f000000b340)={0x10, 0x0, 0x0, 0x40001050}, 0xc, &(0x7f000000b400)={&(0x7f000000b3c0)={0x1c, r9, 0x200, 0x70bd25, 0x25dfdbfe, {{}, {@void, @void}}, [@NL80211_ATTR_USER_PRIO={0x5, 0xd3, 0x2}]}, 0x1c}, 0x1, 0x0, 0x0, 0x10}, 0x90) (async) r10 = syz_genetlink_get_family_id$gtp(&(0x7f000000b4c0), r3) sendmsg$GTP_CMD_GETPDP(r3, &(0x7f000000b5c0)={&(0x7f000000b480)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f000000b580)={&(0x7f000000b500)={0x48, r10, 0x20, 0x70bd2a, 0x25dfdbfc, {}, [@GTPA_FAMILY={0x5, 0xd, 0x8}, @GTPA_I_TEI={0x8, 0x8, 0x3}, @GTPA_TID={0xc, 0x3, 0x2}, @GTPA_NET_NS_FD={0x8}, @GTPA_FAMILY={0x5, 0xd, 0x1}, @GTPA_FLOW={0x6, 0x6, 0x2}]}, 0x48}, 0x1, 0x0, 0x0, 0x4008001}, 0x20000004) (async) socket$inet6_tcp(0xa, 0x1, 0x0) (async) setsockopt$packet_int(r0, 0x107, 0xa, &(0x7f000000b600)=0x646, 0x4) 731.86979ms ago: executing program 3 (id=7305): r0 = bpf$OBJ_GET_PROG(0x7, &(0x7f00000000c0)=@o_path={&(0x7f0000000080)='./file0\x00'}, 0x18) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r0, 0x0, 0x0, 0xc, 0x0, &(0x7f00000001c0)=""/12, 0x6, 0x0, 0x800, 0x80, &(0x7f00000005c0)="3aeb50d37b2b9f217b64305fbecef983083ffba4ddb83a95f7b3a0d0c8281e00cf99fda1822a023ea6c14c7de345c35bf66a64e2942a764939a4ff7e00806d551fb21d544eae9f61615a841a92a5ae437949aaf00e7572d7a12e0740c5b124d2e6c1d9fc57eba785f75e45e3a33080b5968748f10630452a268768fb690f854c7f918b8e528f3027b78d46f8bf77f892fb1c5612de05e23cb9740c6992662dc049d0c35e04afb3f55f5c8a3a3eb4f09a280fdbe57e50d290cac89879fcf8bbe3bcef9cb512528f008feae38d7807ecec26373d48088b61832afc734345ee547995cedf37cfdee1841636deb55bdab1f75bf9357de574bf804f4745072e74dc0410d40b0a133a173233d30c2eb6de220197000473b215f5674b22fdd90f338d6735d45b804b9bb728c260b9d5d110af108346b5c18b8e8ae86ee2a31b83ec69cf7880099a4aeeb5d1f64a2175665551e517d16ac609b6d4c4497bd8d271ec3312efdb3ed776eb779c1cd32f0a661b329f4b245578978383e8d1df7f1827bcf39ca022b3a1aafc4190abd2792ac591d21ec74905d595370f009a788e662a094a1b1983c12b0c535f92e8dcc831fadeb67701d12b834898fa495d83bdd2d00cb1894a3b485e176e95633ce1d5a93e6d9ed6d726ea72380af6f3be11b775f2485f66f355ded03167bc5c9538ff5a9ebcdeba4ad9bb36ae3750747c70a7f5634ccad83d73abfaa2901f33324691e68e573a22f28faef2bdc4c104ce0c2ae861ebf58b148bbde1721483cb96f57f3be2901104a7f7037ecbb7482434f6223218975133ec45a5c371215277000be2960e62864d9e79ba28c5d212c1a2462e7e7bb3768cd168a4e6f1a8d74f287adb96a16b703c51ea7f1b8fb0816f50bda4f732851c023948c5d8a299c129aa1e5d635eea18ea06050548cc20457b34aa5079aa33e6f2d0e49d54843499715b1f92200cd84cc365c474d0a07e2a00c1f01d8de31fb19d39dbcd836fef1ef1a8a367610250c14711922d4e8e5c98bbeaa5dc3eb8c3b91e6763b53c016931ae81050976edeadb5a834a67bdd513a376d0a2a292c1cc7c288a0d37c0e6612db0d107abe6a953e7f2e718592a4a7421e9fccbc08edf493bf7128e45c1444cc551efb299a2ef4dd81bc351d3c66cd497adc80939c4293609a6d2872fd35cac3b5f5b12ab7e0dca8fac2d21c28b3730a1a1bf4613110bea669621aa83ce62dd054595ae75e45c9db50d8cd5db57fce70f23722654eac92ed2a611ac6bcab747d843d009937508e2969f48ee0a51662c82300b4d39e050c7ba906a109f4f3681f23cc55620b6cffc19fdc33baba70a58f8e3ec33f1040d3fea3c9ea39beabc181b47d4f1fa83a916bffcc28f546506f2d7efd127bc8e1df6ed626ac434d74ad0ec448e63d0a1cf8be281676d394a741169cb260f6b34803706f4de4475731035a58c5399d49d7078437ef9b6918059e0aa8a338fd97bf25add312d2f777098e0d85ecbd174fefb7d1f121dfd017dcb3b408462a6278beb4eb4cb70a121052d29312de6c764d88108f0547f8ebddd0aad21b8cf02070ecad7a2cd20d81c651b5763d4e8502da169450d5926d09c409224e2d352bf96d6d05229ca994ab74e6c7fb2a618f261367bda327a9d142a3682006c0c39f23cac0d591582e4eeb17b72b9a4833beee44843d61458092438652148429482f4d49b6a4589ea6567219d4fe2a8205ec8c9936f7e7c3c271ebe2b9a3d876b0478e92d09c518f8448867f6ffc81c810d2e8b1a7836e0f4676f0c00f8904b21efdedd7ad5b57db36605c1bd7e0e82c4ebb930770cccfb6bb9521516f23a35677c7026b7bd21157d5ac739006f77d1522d9af0dccbb4a2eec45b7e05cd319cc204a7102dc2b59b8776d23902e6fce9c1896c1d1576c6a93715d85ef718d19f02cf885925a4fe307a62b74fa43e385ef2bf7ae9b162b1c98ae6790366d93d405f9fa8de0ceba43c20e76c91e18d5775d186ec628624a86dec1b6d102322032c7baf51b78b6d84800502cce787e2bd5fc71ee57149769d0543a4a779e9ab145a63c94e00ef33a96d36028df29b42268ed842f8d93139205315c041bf1e845f051b46b2b293c142258de992e976727380577598edf10f9f6461e74fd9ce2381f828cf470fdbe232c64a0406be4381eacc11770f95ac77eeb340ee11accc1677f16ff7ddbe3eb7f709990e543dd12e0d81095976f4cfcd7c1dd80cae2d40f34766a27aea280ed3b8160cb2f832c8d6ba752a26d449e0b8a53603f5b01dae1450c810d1f5a09d4d7cbb877c8b4c6e2cbe5df29ba326c99de77d2a30f337a884e9c3928199f6dc0c3fe3f7b95dea9c46b19c0b3114a7da890ab7591de8ea5d1ccedcd778ad784dd4d974de8d3d723e4d54311342132938935dd9ff93c0aaf23504762fca26f43c20196a261cc00c94400fe843b4f6f06934410393069fce85bf24fae197d9cea98362eaed60778f2b9d36051e0da8e92d6df4bdc2a114c86b77df80ba4ab244fb4b2521494f98ca4b87c8053316b49052b1f68bcf6f3d6bdf8bc47f4e054baa00f200d819a710affcaebe984f37c1702ebc333430b7cd80d80eb579868142a3fd95e675626074a52c080fc973d10604a144b3ac7e7bbff82a5821db6408044f1e9635589c09b66d9cbc9615b4ca016cac6a48e774da91a13ea96125da63c25be3ebb365d7f16af4a61f563cf12c7276c290ae2da7523863b7cde274a0b34241698f25922d2c57ebd159068f654396c3ee147e118ab6ec348a10ec56019b9c39cd36c4d83bb6e264e82a94f635aab3d756ede9a3509f1f27e6d2816e88eb9303db0d7162eaff98805bdd34f680cdf95ff352f04e065b719bb22fcab2b56fc43356b2eef9bf", &(0x7f0000000200)="9d7328d6e0eff2079603250dc610ca6b1e5cbe6e2bab081652abe6ac9d23f9372b3b16643a5ea8b7e9a090e414be582a1b9a472e8a007ce3ecfd035ed6a8091d9adb97d6601215cf7ba1e5d41e2619f7727ad88954b2885d5fe237171b99a062625d3d4216b9b30743ac38d9d1350ad13dda19d2a26a8aec386f02c5755bb3d6", 0x6, 0x0, 0x5}, 0x50) socket$nl_route(0x10, 0x3, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff) bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0xa, 0x4, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000630122000000000095"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0x8, '\x00', 0x0, @fallback=0x7, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) poll(&(0x7f0000000000), 0x20000000000000b5, 0x9) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r1, 0x0) mkdirat$cgroup(0xffffffffffffffff, &(0x7f0000000180)='syz1\x00', 0x1ff) 652.309916ms ago: executing program 2 (id=7306): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="03000000040000000400000009"], 0x48) unshare(0x26020480) mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x800005, 0x32, 0xffffffffffffffff, 0x852ac000) r1 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0xc, &(0x7f0000000180)={0x80000020}, 0x10) sendmsg$nl_route(r1, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000280)=@getlink={0x44, 0x12, 0x18efde40b3708357, 0xfffffffd, 0x0, {}, [@IFLA_MAP={0x24, 0xe, {0xd, 0x4d, 0x6, 0x7, 0x6, 0xfa}}]}, 0x44}}, 0x0) r2 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000000), 0x1, 0x0) pwritev(r2, &(0x7f0000000480)=[{&(0x7f00000001c0)="e7", 0x1}], 0x1, 0x2, 0x80) pwrite64(r2, &(0x7f00000004c0)='a', 0x1, 0x200) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000540)={r0, 0xe0, &(0x7f0000002140)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0}}, 0x10) 583.248241ms ago: executing program 1 (id=7307): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_MAX_BURST(r1, 0x84, 0xc, 0x0, &(0x7f0000000040)) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r0, 0x84, 0x6d, &(0x7f0000000040), &(0x7f0000000080)=0x8) 569.117784ms ago: executing program 4 (id=7308): r0 = socket$netlink(0x10, 0x3, 0x0) (async) r1 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r1, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="01000000020000001c0012000c000100626f6e64000000000c0002000800010005"], 0x3c}}, 0x0) (async) r4 = socket$nl_route(0x10, 0x3, 0x0) (async) r5 = socket(0x10, 0x803, 0x2) syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), r5) (async) getsockname$packet(r5, &(0x7f0000000680)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000003c0)=0x14) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="3c0000001000010400eeffff11ffffffff000000", @ANYRES32=r6, @ANYBLOB="6ce784ced5a7f4cc996951f7"], 0x3c}}, 0x0) recvmmsg(r1, &(0x7f0000007a00)=[{{&(0x7f0000000280)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @remote}}}, 0x80, &(0x7f0000001b40)=[{&(0x7f0000000400)=""/83, 0x53}, {&(0x7f0000000480)=""/219, 0xdb}, {&(0x7f0000000580)=""/57, 0x39}, {&(0x7f00000005c0)=""/116, 0x74}, {&(0x7f00000006c0)=""/103, 0x67}, {&(0x7f0000000740)=""/55, 0x37}, {&(0x7f0000000780)=""/57, 0x39}, {&(0x7f00000007c0)=""/68, 0x44}, {&(0x7f0000000b40)=""/4096, 0x1000}], 0x9, &(0x7f0000001c00)=""/186, 0xba}, 0x9}, {{&(0x7f0000001cc0)=@ethernet={0x0, @random}, 0x80, &(0x7f0000001e00)=[{&(0x7f0000001d40)=""/162, 0xa2}], 0x1, &(0x7f0000001e40)=""/129, 0x81}}, {{&(0x7f0000001f00)=@ax25={{0x3, @default}, [@default, @null, @default, @rose, @bcast, @default, @bcast, @null]}, 0x80, &(0x7f0000005300)=[{&(0x7f0000001f80)=""/4096, 0x1000}, {&(0x7f0000002f80)=""/31, 0x1f}, {&(0x7f0000002fc0)=""/4096, 0x1000}, {&(0x7f0000003fc0)=""/175, 0xaf}, {&(0x7f0000004080)=""/84, 0x54}, {&(0x7f0000004100)=""/174, 0xae}, {&(0x7f00000041c0)=""/4096, 0x1000}, {&(0x7f00000051c0)=""/59, 0x3b}, {&(0x7f0000005200)=""/236, 0xec}], 0x9, &(0x7f00000053c0)=""/110, 0x6e}, 0x9}, {{0x0, 0x0, &(0x7f0000006480)=[{&(0x7f0000005440)=""/4096, 0x1000}, {&(0x7f0000006440)=""/11, 0xb}], 0x2, &(0x7f00000064c0)=""/4096, 0x1000}, 0x79}, {{&(0x7f00000074c0)=@rxrpc=@in6={0x21, 0x0, 0x2, 0x1c, {0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @local}}}, 0x80, &(0x7f0000007900)=[{&(0x7f0000007540)=""/39, 0x27}, {&(0x7f0000007580)=""/44, 0x2c}, {&(0x7f00000075c0)=""/97, 0x61}, {&(0x7f0000007640)=""/226, 0xe2}, {&(0x7f0000007740)=""/99, 0x63}, {&(0x7f00000077c0)=""/15, 0xf}, {&(0x7f0000007800)=""/185, 0xb9}, {&(0x7f00000078c0)=""/43, 0x2b}], 0x8, &(0x7f0000007980)=""/72, 0x48}, 0x9}], 0x5, 0x10140, &(0x7f0000007b40)) socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000180)=ANY=[@ANYBLOB="4800000010001fff000000008100000000000000", @ANYRES32=0x0, @ANYBLOB="00000000003f0000200012800b00010067656e657665000010000280060005004e24000004000e0008000a00", @ANYRES32=r2], 0x48}, 0x1, 0x0, 0x0, 0x2000c0c1}, 0x40000) 527.221272ms ago: executing program 3 (id=7309): sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x44}, 0x1, 0x0, 0x0, 0x8000010}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22cca65c15}, 0x4008840) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=ANY=[@ANYBLOB="4400000010003b1500"/20, @ANYRES32=0x0, @ANYBLOB="662700000000000024001280090001007866726d0000000014000280040003"], 0x44}}, 0x0) r0 = socket$can_bcm(0x1d, 0x2, 0x2) recvmsg$can_bcm(r0, &(0x7f0000002900)={&(0x7f00000001c0)=@x25, 0x80, &(0x7f0000002840)=[{&(0x7f0000000380)=""/150, 0x96}, {&(0x7f0000000440)=""/4096, 0x1000}, {&(0x7f0000001440)=""/214, 0xd6}, {&(0x7f0000001540)=""/126, 0x7e}, {&(0x7f00000015c0)=""/147, 0x93}, {&(0x7f0000001680)=""/60, 0x3c}, {&(0x7f00000016c0)=""/4096, 0x1000}, {&(0x7f00000026c0)=""/80, 0x50}, {&(0x7f0000002740)=""/225, 0xe1}], 0x9}, 0x12042) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)=@newqdisc={0x24, 0x24, 0x1, 0x70bd2a, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {}, {0xffff, 0xffff}, {0x5}}}, 0x24}, 0x1, 0x0, 0x0, 0x40}, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r1, &(0x7f00000002c0), 0x40000000000009f, 0x0) 423.123052ms ago: executing program 1 (id=7310): socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) socket$kcm(0xa, 0x2, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) sendmsg$NL80211_CMD_GET_FTM_RESPONDER_STATS(0xffffffffffffffff, 0x0, 0x204c000) close(0x4) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='cgroup.controllers\x00', 0x275a, 0x0) close(r3) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r4, 0x0) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x89f1, &(0x7f00000002c0)={'ip6gre0\x00', 0x0}) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="1200000004000000080000000b"], 0x48) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000140)={r5, &(0x7f0000000240), &(0x7f00000004c0)=@tcp6=r4}, 0x20) setsockopt$inet6_tcp_TCP_ULP(r2, 0x6, 0x1f, &(0x7f00000002c0), 0x4) recvmsg(r4, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000580)=[{&(0x7f0000000280)=""/32, 0x20}], 0x1, &(0x7f00000005c0)=""/148, 0x94}, 0x40) sendmmsg$alg(r3, &(0x7f0000003900)=[{0x0, 0x0, 0x0}], 0x1, 0x850) r6 = syz_genetlink_get_family_id$nbd(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NBD_CMD_CONNECT(r1, &(0x7f0000001ac0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000001600)={0x48, r6, 0x1, 0x70bd2c, 0x1000, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x9}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r0}}, {0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r0}}]}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x128}]}, 0x48}}, 0x4) 419.416124ms ago: executing program 4 (id=7311): openat$nci(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="3c00000010000104000000000000000000a80000", @ANYRES32=0x0, @ANYBLOB="4060000002400000140012800800010067726500080002800400120008001f00ff000000"], 0x3c}, 0x1, 0x0, 0x0, 0x40c0000}, 0x0) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000340), r1) sendmsg$ETHTOOL_MSG_LINKMODES_GET(r1, &(0x7f0000000540)={0x0, 0xffffffffffffff79, &(0x7f0000000000)={&(0x7f00000025c0)={0x14, r3, 0x301, 0x70bd29, 0x25dfdbff, {0x24}}, 0x6a}, 0x1, 0x0, 0x0, 0x8000}, 0x24044848) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0xa, 0x16, &(0x7f0000000340)=ANY=[@ANYBLOB="61124c00000000006113500000000000bf2000000000000007000000080000002d0301000000000095000000000000006926000000000000bf67000000000000150600000fff070067060000200000006a0200000ee60000bf050000000000003d350000000000006507000002000000070700004a0000000f75000000000000bf54000000000000070400000400f9ff2d53010000000000840400000000000005000000000000009500000000000000db13d5d8b741f2cdaabc8383caf56b8c2b84a8d09535a157f9005bd38addaa65b925cd3ded25b8b9e2a095d2c51ef45c5588ec78c7f32946b17cecfe54c53ab530c58b67851b7e0e82452a083b98a6aa766401047d150203b0417edef332233b081df18961d6822d133bf72a4de1cc0800004537fc211576846ac629d1d93265ba474580047a9dc88de358ce795731891a2031de4e09740c64e5306f991ed4785a9773a433e0db9c1a7d4ab9d658ce9cfdb4db3bed62bcb2bc91ddcdfac2e6d4421c49fb6641cbf56914e76702f673b586c767030090a3967093b000e3806f825f1d0da2a304e06543b56d35235d78b7a7fe912971aab876022e96f5143b6234f5a6b701690b07fb664a44e22b72e843e7cf55f394cf75d1cd3ee79a25fb98cc45b3fde43e62e150d4a2fddd9a976774"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x15}, 0x94) r4 = socket(0x1e, 0x4, 0x0) r5 = socket$inet6(0xa, 0x3, 0x2f) setsockopt$inet6_IPV6_XFRM_POLICY(r5, 0x29, 0x23, &(0x7f0000000140)={{{@in6=@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @in6=@empty, 0x4e20, 0x0, 0x4e23, 0x0, 0x2, 0x0, 0x0, 0x33}, {0x400000, 0x80000800, 0x9141, 0x0, 0x0, 0xf42, 0x5}, {0x0, 0x0, 0x0, 0xffffffffffffff81}, 0x1, 0x0, 0x1, 0x0, 0x4, 0x1}, {{@in=@empty, 0x4, 0x33}, 0xa, @in6=@private1, 0x3507, 0x5, 0x0, 0x4, 0x0, 0x10000000, 0xfffffffd}}, 0xe8) connect$inet6(r5, &(0x7f0000000040)={0xa, 0x0, 0x6, @ipv4={'\x00', '\xff\xff', @remote}, 0x200000}, 0x1c) r6 = socket$can_raw(0x1d, 0x3, 0x1) setsockopt$CAN_RAW_RECV_OWN_MSGS(r6, 0x65, 0x8, &(0x7f0000000200), 0x4) r7 = socket(0x2, 0x80805, 0x0) getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r7, 0x84, 0x1f, &(0x7f0000000580)={0x0, @in={{0x2, 0x4e21, @private=0xa010100}}, 0xfff, 0x4}, &(0x7f0000000640)=0x90) sendmsg$NL80211_CMD_UPDATE_CONNECT_PARAMS(r7, 0x0, 0x4000004) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0xb, 0x6, &(0x7f0000000680)=@framed={{0x5, 0x0, 0x0, 0x0, 0x0, 0x71, 0x11, 0x84}, [@func={0x85, 0x0, 0x1, 0x0, 0x2}, @call={0x85, 0x0, 0x0, 0xa0}, @exit], {0x95, 0x0, 0x5a5}}, &(0x7f0000000080)='GPL\x00', 0x5, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x10, '\x00', 0x0, @fallback=0x38, 0xffffffffffffffff, 0x6}, 0x94) getsockopt$inet_mtu(r4, 0x0, 0xa, &(0x7f0000000240), &(0x7f00000002c0)=0x4) r8 = socket$packet(0x11, 0x2, 0x300) socketpair(0x1, 0x3, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) getsockname$packet(r9, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) bind$packet(r8, &(0x7f00000000c0)={0x11, 0x18, r10, 0x1, 0x81}, 0x14) setsockopt$packet_int(r8, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_rx_ring(r8, 0x107, 0x5, &(0x7f0000000040)=@req3={0x1000, 0x3a, 0x1000, 0x3a, 0x0, 0x0, 0xffffffff}, 0x1c) recvmsg$unix(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000280)=[{&(0x7f00000006c0)=""/4096, 0x1000}], 0x1}, 0x22) sendmmsg(r4, &(0x7f00000030c0)=[{{0x0, 0xa9cc7003, &(0x7f0000000400)=[{&(0x7f00000000c0)="ee", 0x101d0}], 0x1}}], 0x400000000000181, 0x9200000000000000) ioctl$F2FS_IOC_MOVE_RANGE(r4, 0xc020f509, &(0x7f0000000300)={r0, 0x400, 0x0, 0x7}) setsockopt$sock_int(r4, 0x1, 0xb, 0x0, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) 176.976526ms ago: executing program 2 (id=7312): r0 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000c80)={'ip6tnl0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@newlink={0x50, 0x10, 0xffffffffffffffff, 0x70bd25, 0x25dfdbbb, {0x0, 0x0, 0x0, 0x0, 0x52a58, 0x51a23}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @ip6erspan={{0xe}, {0x14, 0x2, 0x0, 0x1, [@IFLA_GRE_FLOWINFO={0x8, 0xc, 0x3}, @IFLA_GRE_FLAGS={0x8, 0xd, 0x1}]}}}, @IFLA_MASTER={0x8, 0xa, r1}]}, 0x50}, 0x1, 0x20000, 0x0, 0x240440d5}, 0x9080) 119.085661ms ago: executing program 3 (id=7313): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000300), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000400)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_AUTHENTICATE(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x34, r1, 0x1, 0x20000002, 0x25dfdbff, {{}, {@val={0x8, 0x3, r3}, @void}}, [@key_params=[@NL80211_ATTR_MAC={0xa, 0x6, @broadcast}], @NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @key_params]}, 0x34}, 0x1, 0x0, 0x0, 0x20040040}, 0x0) 118.728237ms ago: executing program 0 (id=7314): bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000000)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x18, 0x18, 0x2, [@restrict={0x40000}, @func_proto]}}, &(0x7f0000000100)=""/4096, 0x32, 0x1000, 0xa}, 0x28) 94.734063ms ago: executing program 0 (id=7315): r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000040)={0x3, 0x8003}, 0x4) setsockopt$packet_rx_ring(r0, 0x107, 0x5, &(0x7f0000000140)=@req3={0x1000, 0x3a, 0x1000, 0x3a, 0x7ff, 0x2, 0x3b}, 0x1c) r1 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000340)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x7, '\x00', 0x0, 0xffffffffffffffff, 0x1, 0x3, 0x4}, 0x50) socket$kcm(0x2, 0x3, 0x2) syz_emit_ethernet(0x42, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @tcp={{0x8, 0x4, 0x0, 0x0, 0x34, 0x0, 0x0, 0x0, 0x5, 0x0, @remote, @private=0xa010100, {[@ssrr={0x89, 0x7, 0xcc, [@remote]}, @lsrr={0x83, 0x3, 0x4a}]}}, {{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x6, 0x5, 0x4, 0xfffd}}}}}}, 0x0) r2 = socket$packet(0x11, 0x3, 0x300) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000400)=@bpf_lsm={0x6, 0x5, &(0x7f0000000040)=ANY=[@ANYBLOB="1800000000000000000000000000000061100000000000006300020000"], &(0x7f0000000100)='GPL\x00', 0x5, 0xcd, &(0x7f0000000140)=""/205, 0x0, 0x5, '\x00', 0x0, 0x1b, r1}, 0x94) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000040)={'hsr0\x00'}) socket$nl_route(0x10, 0x3, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000100)={0x50, 0x2, 0x6, 0x3, 0x0, 0x0, {}, [@IPSET_ATTR_FAMILY={0x5, 0x5, 0xb}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_TYPENAME={0xc, 0x3, 'hash:ip\x00'}, @IPSET_ATTR_TYPENAME={0x16, 0x3, 'hash:net,port,net\x00'}]}, 0xffffffffffffffaa}, 0x1, 0x0, 0x0, 0x8}, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) r5 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_SET(r5, &(0x7f0000002640)={0x0, 0x0, &(0x7f0000002600)={&(0x7f0000000400)={0x18, 0x1402, 0x1, 0x70bd26, 0x25dfdbfb, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x2}]}, 0x18}, 0x1, 0x0, 0x0, 0x81}, 0x4850) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$devlink(&(0x7f0000000000), r6) sendmsg$DEVLINK_CMD_RATE_GET(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)={0x14, r7, 0x701, 0x0, 0x25dfdbfc, {0x41}}, 0x14}}, 0x24000040) sendmsg$IPSET_CMD_ADD(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000780)=ANY=[], 0x74}, 0x1, 0x0, 0x0, 0x10040003}, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x3, 0xc, &(0x7f0000000740)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000610000001801000020786c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000110b0008850000007100000095"], &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0xd, '\x00', 0x0, @sched_cls=0x36, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket$l2tp(0x2, 0x2, 0x73) socket(0x2c, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) pipe(&(0x7f0000000080)) socket$l2tp(0x2, 0x2, 0x73) socket$nl_generic(0x10, 0x3, 0x10) socket(0x1e, 0x4, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) 0s ago: executing program 2 (id=7316): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000200)={'batadv0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=@newlink={0x40, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x21}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @hsr={{0x8}, {0x14, 0x2, 0x0, 0x1, [@IFLA_HSR_SLAVE1={0x8, 0x1, r1}, @IFLA_HSR_SLAVE2={0x8, 0x2, r1}]}}}]}, 0x40}, 0x1, 0x0, 0x0, 0x20040000}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) (async) r3 = socket$inet6_icmp(0xa, 0x2, 0x3a) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f00000001c0)={{{@in=@local, @in=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in=@initdev}}, &(0x7f00000002c0)=0xe8) setsockopt$inet6_IPV6_XFRM_POLICY(r3, 0x29, 0x23, &(0x7f0000000300)={{{@in=@local, @in6=@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x4e23, 0x3, 0x4e23, 0x18, 0xa, 0x20, 0x80, 0x0, 0x0, r4}, {0x5, 0x6, 0xdd, 0x100000000, 0xfd, 0x5b6, 0x4, 0x80000001}, {0x9, 0x401, 0x0, 0x1}, 0xc, 0x6e6bb1, 0x0, 0x1, 0x2, 0x1}, {{@in6=@mcast1, 0x4d6, 0x6c}, 0xa, @in=@remote, 0x3506, 0x3, 0x3, 0xaa, 0x2, 0xd, 0x4}}, 0xe8) (async) getsockopt$inet6_int(r3, 0x29, 0x16, 0x0, &(0x7f0000002080)) (async) setsockopt$inet6_IPV6_ADDRFORM(r3, 0x29, 0x1, &(0x7f0000000000), 0x4) sendmsg$nl_generic(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000002500010324bd7002ffdbdf250100000008002b00", @ANYRES32=0x0, @ANYBLOB="2764497e4fab216202"], 0x1c}, 0x1, 0x0, 0x0, 0x20044008}, 0x0) kernel console output (not intermixed with test programs): utes in process `syz.2.6116'. [ 969.076781][T31027] netlink: 'syz.0.6118': attribute type 1 has an invalid length. [ 969.111074][T31027] netlink: 'syz.0.6118': attribute type 1 has an invalid length. [ 969.311444][T31034] netlink: 132 bytes leftover after parsing attributes in process `syz.0.6120'. [ 969.484328][ C1] ip6_tunnel: D xmit: Local address not yet configured! [ 970.458049][T31066] lo speed is unknown, defaulting to 1000 [ 970.580354][T30376] tipc: Left network mode [ 970.685035][T19043] Bluetooth: hci0: command tx timeout [ 971.393553][T30922] bridge0: port 1(bridge_slave_0) entered blocking state [ 971.418201][T30922] bridge0: port 1(bridge_slave_0) entered disabled state [ 971.428741][T30922] bridge_slave_0: entered allmulticast mode [ 971.455397][T30922] bridge_slave_0: entered promiscuous mode [ 971.574781][T30922] bridge0: port 2(bridge_slave_1) entered blocking state [ 971.610200][T30922] bridge0: port 2(bridge_slave_1) entered disabled state [ 971.646159][T30922] bridge_slave_1: entered allmulticast mode [ 971.690336][T30922] bridge_slave_1: entered promiscuous mode [ 971.808356][T31118] netlink: 'syz.4.6133': attribute type 19 has an invalid length. [ 971.828744][T31118] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6133'. [ 971.877357][T31119] netlink: 120 bytes leftover after parsing attributes in process `syz.0.6134'. [ 971.889730][T31119] netlink: 'syz.0.6134': attribute type 1 has an invalid length. [ 971.898113][T31119] netlink: 64 bytes leftover after parsing attributes in process `syz.0.6134'. [ 972.044435][T30922] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 972.142841][T30922] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 972.209486][T31129] netlink: 52 bytes leftover after parsing attributes in process `syz.0.6135'. [ 972.259176][T31125] geneve3: entered promiscuous mode [ 972.290860][T31125] netlink: 24 bytes leftover after parsing attributes in process `syz.0.6135'. [ 972.328791][T30922] team0: Port device team_slave_0 added [ 972.356130][T13712] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 972.370533][T13712] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 972.406539][T31125] ip6gre1: entered promiscuous mode [ 972.415717][T31125] ip6gre1: entered allmulticast mode [ 972.478490][T30922] team0: Port device team_slave_1 added [ 972.552958][T13712] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 972.578169][T13712] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 972.879715][T30922] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 972.912093][T30922] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 972.981931][T30922] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 973.085694][T30922] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 973.109516][T30922] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 973.183645][T30922] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 973.561298][T31174] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6144'. [ 973.584710][T31174] netlink: 'syz.2.6144': attribute type 8 has an invalid length. [ 973.609955][T31179] Cannot find add_set index 1 as target [ 973.767166][T30922] hsr_slave_0: entered promiscuous mode [ 973.792882][T30922] hsr_slave_1: entered promiscuous mode [ 973.816945][T30922] debugfs: 'hsr0' already exists in 'hsr' [ 973.835275][T30922] Cannot create hsr debugfs directory [ 974.072697][T31189] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6148'. [ 974.095315][T30376] hsr_slave_0: left promiscuous mode [ 974.108186][T30376] hsr_slave_1: left promiscuous mode [ 974.186910][T30376] pim6reg (unregistering): left allmulticast mode [ 974.215150][T31196] netlink: 'syz.0.6149': attribute type 3 has an invalid length. [ 974.538384][T31208] openvswitch: netlink: Missing key (keys=40, expected=2000) [ 974.785472][T30376] team0 (unregistering): Port device team_slave_1 removed [ 974.831661][T30376] team0 (unregistering): Port device team_slave_0 removed [ 975.055971][T13706] smbdirect: ib_dev[syz2] removed [ 975.384455][ T46] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 975.540798][T30934] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 975.715000][T31225] netlink: 100 bytes leftover after parsing attributes in process `syz.0.6158'. [ 976.078755][T30922] netdevsim netdevsim1 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 976.137028][T30922] netdevsim netdevsim1 eth3 (unregistering): unset [1, 0] type 2 family 0 port 58833 - 0 [ 976.172587][T30922] netdevsim netdevsim1 eth3 (unregistering): unset [1, 1] type 2 family 0 port 6081 - 0 [ 976.262142][T30376] IPVS: stop unused estimator thread 0... [ 976.262568][T31245] netlink: 16 bytes leftover after parsing attributes in process `syz.0.6162'. [ 976.475188][T30922] netdevsim netdevsim1 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 976.498901][T30922] netdevsim netdevsim1 eth2 (unregistering): unset [1, 0] type 2 family 0 port 58833 - 0 [ 976.509397][T30922] netdevsim netdevsim1 eth2 (unregistering): unset [1, 1] type 2 family 0 port 6081 - 0 [ 976.657617][T31251] team0: Port device geneve1 removed [ 976.679749][T31251] bond2: (slave batadv1): Releasing active interface [ 976.713509][T31251] bond8: (slave gretap1): Releasing active interface [ 976.731596][T17613] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 977.112171][T30952] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 977.163086][T30922] netdevsim netdevsim1 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 977.200858][T30922] netdevsim netdevsim1 eth1 (unregistering): unset [1, 0] type 2 family 0 port 58833 - 0 [ 977.221335][T30922] netdevsim netdevsim1 eth1 (unregistering): unset [1, 1] type 2 family 0 port 6081 - 0 [ 977.462441][T31275] netlink: 'syz.4.6171': attribute type 8 has an invalid length. [ 977.537080][T30922] netdevsim netdevsim1 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 977.584402][T30922] netdevsim netdevsim1 eth0 (unregistering): unset [1, 0] type 2 family 0 port 58833 - 0 [ 977.622339][T30922] netdevsim netdevsim1 eth0 (unregistering): unset [1, 1] type 2 family 0 port 6081 - 0 [ 977.801708][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 978.320676][T31298] netlink: 68 bytes leftover after parsing attributes in process `syz.3.6177'. [ 978.733996][T31312] netlink: 36 bytes leftover after parsing attributes in process `syz.4.6181'. [ 978.776700][T30922] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 978.809124][T30922] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 978.838484][T30922] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 978.879475][T30922] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 978.916192][T30922] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 978.956020][T30922] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 978.979528][T30922] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 979.018245][T30922] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 979.086361][T31314] batman_adv: batadv0: Adding interface: ipvlan1 [ 979.110861][T31314] batman_adv: batadv0: The MTU of interface ipvlan1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 979.148391][T31314] batman_adv: batadv0: Not using interface ipvlan1 (retrying later): interface not active [ 979.334710][T31336] netlink: 'syz.2.6185': attribute type 1 has an invalid length. [ 979.556453][T30922] 8021q: adding VLAN 0 to HW filter on device bond0 [ 979.625148][T30922] 8021q: adding VLAN 0 to HW filter on device team0 [ 979.671746][ T6117] bridge0: port 1(bridge_slave_0) entered blocking state [ 979.679000][ T6117] bridge0: port 1(bridge_slave_0) entered forwarding state [ 979.743682][ T6117] bridge0: port 2(bridge_slave_1) entered blocking state [ 979.750957][ T6117] bridge0: port 2(bridge_slave_1) entered forwarding state [ 979.958569][T31349] netdevsim netdevsim4 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 979.984372][T31349] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 980.174176][T31349] netdevsim netdevsim4 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 980.184899][T31349] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 980.359565][T31349] netdevsim netdevsim4 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 980.379938][T31349] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 980.584450][T31349] netdevsim netdevsim4 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 980.613159][T31349] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 980.908896][T13706] netdevsim netdevsim4 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 980.928384][T13706] netdevsim netdevsim4 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 980.999990][T13712] netdevsim netdevsim4 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 981.013367][T13712] netdevsim netdevsim4 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 981.065638][T13712] netdevsim netdevsim4 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 981.075984][T31376] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 981.091243][T13712] netdevsim netdevsim4 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 981.174265][T13712] netdevsim netdevsim4 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 981.198072][T13712] netdevsim netdevsim4 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 981.296379][T31382] netlink: 24 bytes leftover after parsing attributes in process `syz.3.6197'. [ 981.318567][T31384] netlink: 'syz.0.6196': attribute type 10 has an invalid length. [ 981.476896][T31388] netdevsim netdevsim2 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 981.543731][T31388] netdevsim netdevsim2 eth3 (unregistering): unset [1, 1] type 2 family 0 port 20000 - 0 [ 981.594446][T31388] netdevsim netdevsim2 eth3 (unregistering): unset [1, 2] type 2 family 0 port 256 - 0 [ 981.767977][T31388] netdevsim netdevsim2 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 981.791807][T31388] netdevsim netdevsim2 eth2 (unregistering): unset [1, 1] type 2 family 0 port 20000 - 0 [ 981.810092][T31408] netlink: 28 bytes leftover after parsing attributes in process `syz.3.6203'. [ 981.853347][T31388] netdevsim netdevsim2 eth2 (unregistering): unset [1, 2] type 2 family 0 port 256 - 0 [ 981.906740][T31409] netlink: 36 bytes leftover after parsing attributes in process `syz.3.6203'. [ 981.930406][T31398] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6202'. [ 981.940771][T30947] IPVS: starting estimator thread 0... [ 981.969790][T31398] IPVS: lblc: FWM 3 0x00000003 - no destination available [ 982.001085][T30922] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 982.036440][T31415] IPVS: using max 30 ests per chain, 72000 per kthread [ 982.071498][T31388] netdevsim netdevsim2 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 982.096972][T31388] netdevsim netdevsim2 eth1 (unregistering): unset [1, 1] type 2 family 0 port 20000 - 0 [ 982.113400][T31388] netdevsim netdevsim2 eth1 (unregistering): unset [1, 2] type 2 family 0 port 256 - 0 [ 982.228954][T31388] netdevsim netdevsim2 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 982.247827][T31388] netdevsim netdevsim2 eth0 (unregistering): unset [1, 1] type 2 family 0 port 20000 - 0 [ 982.260829][T31388] netdevsim netdevsim2 eth0 (unregistering): unset [1, 2] type 2 family 0 port 256 - 0 [ 982.299271][T30922] veth0_vlan: entered promiscuous mode [ 982.315606][T30922] veth1_vlan: entered promiscuous mode [ 982.406638][T13705] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 982.415483][T13705] netdevsim netdevsim2 eth0: set [1, 1] type 2 family 0 port 256 - 0 [ 982.423895][T13705] netdevsim netdevsim2 eth0: set [1, 2] type 2 family 0 port 20000 - 0 [ 982.469065][ T35] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 982.493295][ T35] netdevsim netdevsim2 eth1: set [1, 1] type 2 family 0 port 256 - 0 [ 982.526418][ T35] netdevsim netdevsim2 eth1: set [1, 2] type 2 family 0 port 20000 - 0 [ 982.605555][ T35] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 982.633666][ T35] netdevsim netdevsim2 eth2: set [1, 1] type 2 family 0 port 256 - 0 [ 982.655620][ T35] netdevsim netdevsim2 eth2: set [1, 2] type 2 family 0 port 20000 - 0 [ 982.686798][T30922] veth0_macvtap: entered promiscuous mode [ 982.754535][T30376] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 982.780269][T30376] netdevsim netdevsim2 eth3: set [1, 1] type 2 family 0 port 256 - 0 [ 982.800674][T30376] netdevsim netdevsim2 eth3: set [1, 2] type 2 family 0 port 20000 - 0 [ 982.836546][T30922] veth1_macvtap: entered promiscuous mode [ 982.845830][T31448] netlink: 220 bytes leftover after parsing attributes in process `syz.4.6207'. [ 982.921120][ C1] ip6_tunnel: syztnl0 xmit: Local address not yet configured! [ 982.988748][T30922] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 983.040660][T30922] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 983.110153][T13706] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 983.126738][T31462] netlink: 36 bytes leftover after parsing attributes in process `syz.3.6213'. [ 983.136549][T13706] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 983.158897][T13706] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 983.220239][T13706] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 983.308405][T31465] netlink: 208240 bytes leftover after parsing attributes in process `syz.4.6215'. [ 983.345221][T31469] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6214'. [ 983.476824][T13705] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 983.495473][T13705] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 983.552254][T31473] netlink: 124 bytes leftover after parsing attributes in process `syz.3.6216'. [ 983.571046][T13712] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 983.574648][T31473] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6216'. [ 983.591946][T31473] netlink: 20 bytes leftover after parsing attributes in process `syz.3.6216'. [ 983.604519][T13712] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 984.099837][T31489] netdevsim netdevsim0 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 984.235113][T31500] netlink: 36 bytes leftover after parsing attributes in process `syz.3.6224'. [ 984.341922][T31500] netlink: 'syz.3.6224': attribute type 10 has an invalid length. [ 984.377863][T31489] netdevsim netdevsim0 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 984.378921][ T50] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 984.406346][ T50] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 984.409557][T31509] xt_addrtype: both incoming and outgoing interface limitation cannot be selected [ 984.432174][ T50] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 984.450970][ T50] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 984.462561][ T50] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 984.535094][T31489] netdevsim netdevsim0 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 984.694463][T31506] : entered promiscuous mode [ 984.745361][T31489] netdevsim netdevsim0 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 984.814251][T31518] netlink: 'syz.1.6227': attribute type 1 has an invalid length. [ 984.832132][T31518] netlink: 248 bytes leftover after parsing attributes in process `syz.1.6227'. [ 984.893422][T31518] netlink: 65051 bytes leftover after parsing attributes in process `syz.1.6227'. [ 985.144652][T13706] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 985.192935][T31530] netlink: 68 bytes leftover after parsing attributes in process `syz.3.6230'. [ 985.253120][T30376] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 985.304288][T13706] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 985.423472][T30376] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 985.664542][T31550] netlink: 64 bytes leftover after parsing attributes in process `syz.0.6235'. [ 985.853970][T31550] batman_adv: batadv0: Interface activated: dummy0 [ 985.868177][T31550] batadv0: mtu less than device minimum [ 985.890825][T31550] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 985.902904][T31550] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 985.914933][T31550] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 985.926971][T31550] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 985.938964][T31550] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 985.951008][T31550] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 985.962974][T31550] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 986.008248][T31550] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 986.044055][T31550] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 986.055102][T31550] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 986.072902][T31550] veth1_vlan: left promiscuous mode [ 986.079896][T31550] veth0_vlan: left promiscuous mode [ 986.086166][T31550] veth0_vlan: entered promiscuous mode [ 986.095733][T31550] veth1_vlan: entered promiscuous mode [ 986.104178][T31550] veth1_macvtap: left promiscuous mode [ 986.112902][T31550] veth1_macvtap: entered promiscuous mode [ 986.122936][ C1] ip6_tunnel: D xmit: Local address not yet configured! [ 986.127033][T31550] 8021q: adding VLAN 0 to HW filter on device bond1 [ 986.139665][T31550] 8021q: adding VLAN 0 to HW filter on device bond2 [ 986.187503][T31550] 8021q: adding VLAN 0 to HW filter on device bond3 [ 986.209665][T31550] 8021q: adding VLAN 0 to HW filter on device bond4 [ 986.291810][T31550] 8021q: adding VLAN 0 to HW filter on device  [ 986.303550][T31550] 8021q: adding VLAN 0 to HW filter on device bond5 [ 986.325852][T31550] 8021q: adding VLAN 0 to HW filter on device bond6 [ 986.334716][T31550] 8021q: adding VLAN 0 to HW filter on device bond7 [ 986.348392][T31550] 8021q: adding VLAN 0 to HW filter on device bond8 [ 986.360275][T31550] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 986.387532][T31550] geneve3: left promiscuous mode [ 986.394171][T31550] ip6gre1: left promiscuous mode [ 986.405846][T31550] batman_adv: batadv0: Interface activated: ipvlan1 [ 986.421995][T31550] net_ratelimit: 12 callbacks suppressed [ 986.422031][T31550] batadv0: mtu less than device minimum [ 986.437209][T31550] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 986.450855][T31550] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 986.462749][T31550] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 986.474624][T31550] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 986.485886][T31550] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 986.497275][T31550] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 986.508454][T31550] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 986.510717][ T6117] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 986.520195][T31550] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 986.534063][T19043] Bluetooth: hci3: command tx timeout [ 986.566813][T31550] 8021q: adding VLAN 0 to HW filter on device eth0 [ 986.578571][T31550] 8021q: adding VLAN 0 to HW filter on device eth1 [ 986.588496][T31550] 8021q: adding VLAN 0 to HW filter on device eth2 [ 986.629571][T31550] 8021q: adding VLAN 0 to HW filter on device eth3 [ 986.826043][T30375] netdevsim netdevsim0 eth0: set [0, 0] type 1 family 0 port 4352 - 0 [ 986.834786][T30375] netdevsim netdevsim0 eth1: set [0, 0] type 1 family 0 port 4352 - 0 [ 986.887032][T30375] netdevsim netdevsim0 eth2: set [0, 0] type 1 family 0 port 4352 - 0 [ 986.904842][T30375] netdevsim netdevsim0 eth3: set [0, 0] type 1 family 0 port 4352 - 0 [ 987.096132][T31571] netlink: 'syz.4.6242': attribute type 4 has an invalid length. [ 987.133581][T31574] netlink: 56 bytes leftover after parsing attributes in process `syz.0.6243'. [ 987.143476][ T6438] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 987.208344][T31576] netlink: 'syz.4.6242': attribute type 4 has an invalid length. [ 987.581605][ T6438] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 988.601410][T19043] Bluetooth: hci3: command tx timeout [ 988.638946][T31504] bridge0: port 1(bridge_slave_0) entered blocking state [ 988.695617][T31504] bridge0: port 1(bridge_slave_0) entered disabled state [ 988.733540][T31504] bridge_slave_0: entered allmulticast mode [ 988.768047][T31504] bridge_slave_0: entered promiscuous mode [ 988.837916][ T35] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 988.867850][T31504] bridge0: port 2(bridge_slave_1) entered blocking state [ 988.889800][T31504] bridge0: port 2(bridge_slave_1) entered disabled state [ 988.916418][T31504] bridge_slave_1: entered allmulticast mode [ 988.952656][T31504] bridge_slave_1: entered promiscuous mode [ 989.112557][T31504] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 989.160075][T31504] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 989.331434][T31504] team0: Port device team_slave_0 added [ 989.406848][T31504] team0: Port device team_slave_1 added [ 989.977629][T31504] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 989.997571][T30952] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 990.000478][T31504] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 990.100572][T31504] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 990.163501][T31504] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 990.185465][T31504] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 990.248392][T31504] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 990.583027][T31504] hsr_slave_0: entered promiscuous mode [ 990.589596][T31504] hsr_slave_1: entered promiscuous mode [ 990.596950][T31504] debugfs: 'hsr0' already exists in 'hsr' [ 990.606894][T31504] Cannot create hsr debugfs directory [ 990.681377][T30951] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 990.681604][T19043] Bluetooth: hci3: command tx timeout [ 990.790736][T30375] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 990.799008][T30375] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 990.984749][T31504] netdevsim netdevsim2 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 991.015325][T31504] netdevsim netdevsim2 eth3 (unregistering): unset [1, 1] type 2 family 0 port 256 - 0 [ 991.025797][T31504] netdevsim netdevsim2 eth3 (unregistering): unset [1, 2] type 2 family 0 port 20000 - 0 [ 991.099651][T31504] netdevsim netdevsim2 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 991.109803][T31504] netdevsim netdevsim2 eth2 (unregistering): unset [1, 1] type 2 family 0 port 256 - 0 [ 991.120244][T31504] netdevsim netdevsim2 eth2 (unregistering): unset [1, 2] type 2 family 0 port 20000 - 0 [ 991.194881][T31504] netdevsim netdevsim2 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 991.208309][T31504] netdevsim netdevsim2 eth1 (unregistering): unset [1, 1] type 2 family 0 port 256 - 0 [ 991.219056][T31504] netdevsim netdevsim2 eth1 (unregistering): unset [1, 2] type 2 family 0 port 20000 - 0 [ 991.363210][T31504] netdevsim netdevsim2 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 991.375488][T31504] netdevsim netdevsim2 eth0 (unregistering): unset [1, 1] type 2 family 0 port 256 - 0 [ 991.386912][T31504] netdevsim netdevsim2 eth0 (unregistering): unset [1, 2] type 2 family 0 port 20000 - 0 [ 991.608798][T31504] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 991.622574][T31504] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 991.630925][T31504] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 991.642091][T31504] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 991.650652][T31504] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 991.663032][ T6117] net_ratelimit: 29 callbacks suppressed [ 991.663053][ T6117] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 991.683306][ T6117] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 991.706559][T31504] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 991.715883][T31504] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 991.726627][T31504] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 991.801194][T30932] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 991.807536][T31504] 8021q: adding VLAN 0 to HW filter on device bond0 [ 991.831888][T31504] 8021q: adding VLAN 0 to HW filter on device team0 [ 991.845954][T13706] bridge0: port 1(bridge_slave_0) entered blocking state [ 991.853092][T13706] bridge0: port 1(bridge_slave_0) entered forwarding state [ 991.873691][T30375] bridge0: port 2(bridge_slave_1) entered blocking state [ 991.880903][T30375] bridge0: port 2(bridge_slave_1) entered forwarding state [ 992.211447][T13706] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 992.226991][T13706] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 992.248747][T31504] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 992.299264][T31504] veth0_vlan: entered promiscuous mode [ 992.318432][T31504] veth1_vlan: entered promiscuous mode [ 992.346640][T31504] veth0_macvtap: entered promiscuous mode [ 992.356315][T31504] veth1_macvtap: entered promiscuous mode [ 992.380139][T31504] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 992.395789][T31504] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 992.414257][T30375] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 992.424454][T30375] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 992.435646][T30375] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 992.446191][T30375] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 992.563540][T13713] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 992.577940][T13713] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 992.607116][T13706] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 992.619516][T13706] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 992.753827][T13712] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 992.769027][T13712] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 992.769607][T19043] Bluetooth: hci3: command tx timeout [ 993.290705][T13712] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 993.305042][T13712] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 993.830847][T13712] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 993.845841][T13712] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 995.001414][ C1] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 996.922256][ T35] net_ratelimit: 10 callbacks suppressed [ 996.922274][ T35] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 996.942328][ T35] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 997.470898][T13712] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 997.486155][T13712] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 998.010814][T13712] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 998.025296][T13712] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 998.550992][T13712] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 998.565925][T13712] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 999.090711][T13706] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 999.105663][T13706] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1002.171353][T13713] net_ratelimit: 10 callbacks suppressed [ 1002.171377][T13713] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1002.191809][T13713] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1002.710919][ T6117] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1002.725516][ T6117] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1003.253116][T13713] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1003.268384][T13713] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1003.790899][T13706] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1003.805409][T13706] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1004.042184][ C1] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 1004.331013][ T35] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1004.345501][ T35] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1006.603100][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 1007.410724][T13705] net_ratelimit: 10 callbacks suppressed [ 1007.410747][T13705] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1007.431076][T13705] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1007.950819][ T6117] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1007.965423][ T6117] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1008.490778][T13713] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1008.505226][T13713] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1009.020703][T13705] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1009.036004][T13705] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1009.563032][T13705] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1009.577514][T13705] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1012.651128][T13713] net_ratelimit: 10 callbacks suppressed [ 1012.651153][T13713] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1012.671293][T13713] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1013.191684][T13713] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1013.206816][T13713] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1013.699356][T13712] tipc: Resetting bearer [ 1013.741231][ T35] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1013.755767][ T35] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1014.016889][T13712] batman_adv: batadv0: Removing interface: vlan4 [ 1014.046845][T13712] bond6 (unregistering): (slave gretap1): Releasing active interface [ 1014.093042][T13712] bond7 (unregistering): (slave geneve2): Releasing active interface [ 1014.156011][T13712] bond0 (unregistering): (slave bridge2): Releasing backup interface [ 1014.164403][T13712] bridge2 (unregistering): left promiscuous mode [ 1014.171511][T13712] bridge2 (unregistering): left allmulticast mode [ 1014.184058][T13712] bond3 (unregistering): (slave bridge3): Releasing backup interface [ 1014.193974][T13712] bridge3 (unregistering): left promiscuous mode [ 1014.200487][T13712] bridge3 (unregistering): left allmulticast mode [ 1014.253855][T13712] tipc: Disabling bearer [ 1014.293045][ T35] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1014.307413][ T35] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1014.352945][T13712] .` (unregistering): Released all slaves [ 1014.364332][T13712] bond1 (unregistering): Released all slaves [ 1014.382775][T13712] bond2 (unregistering): Released all slaves [ 1014.411428][T13712] bond0 (unregistering): Released all slaves [ 1014.431754][T13712] bond3 (unregistering): Released all slaves [ 1014.446543][T13712] bond4 (unregistering): Released all slaves [ 1014.475027][T13712] bond5 (unregistering): Released all slaves [ 1014.492227][T13712] bond6 (unregistering): Released all slaves [ 1014.513759][T13712] bond7 (unregistering): Released all slaves [ 1014.701113][T13712] : left promiscuous mode [ 1014.832427][ T6117] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1014.832453][T13712] tipc: Left network mode [ 1014.853017][ T6117] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1014.888052][T13712] IPVS: stopping backup sync thread 19269 ... [ 1016.066528][T13712] hsr_slave_0: left promiscuous mode [ 1016.072556][T13712] hsr_slave_1: left promiscuous mode [ 1016.078374][T13712] batman_adv: batadv0: Interface deactivated: ipvlan2 [ 1016.085429][T13712] batman_adv: batadv0: Removing interface: ipvlan2 [ 1016.097959][T13712] veth1_macvtap: left promiscuous mode [ 1016.103562][T13712] veth0_macvtap: left promiscuous mode [ 1016.109197][T13712] veth1_vlan: left promiscuous mode [ 1016.115167][T13712] veth0_vlan: left promiscuous mode [ 1017.002279][T13712] IPVS: stop unused estimator thread 0... [ 1017.940743][T30375] net_ratelimit: 10 callbacks suppressed [ 1017.940766][T30375] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1017.963371][T30375] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1018.481157][T13712] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1018.496012][T13712] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1018.763770][ C1] ip6_tunnel: D xmit: Local address not yet configured! [ 1019.020807][T30376] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1019.035812][T30376] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1019.563236][T30375] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1019.578162][T30375] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1020.100815][T13713] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1020.115265][T13713] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1020.681795][ C1] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 1023.180712][T13712] net_ratelimit: 10 callbacks suppressed [ 1023.180736][T13712] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1023.200914][T13712] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1023.724143][T13705] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1023.738742][T13705] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1024.260762][T13712] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1024.275445][T13712] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1024.800612][T13705] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1024.815210][T13705] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1025.330922][T13712] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1025.345396][T13712] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1028.410812][T30376] net_ratelimit: 10 callbacks suppressed [ 1028.410829][T30376] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1028.430981][T30376] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1028.950821][T13712] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1028.965344][T13712] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1029.490670][T13705] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1029.505140][T13705] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1030.021982][ T35] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1030.036766][ T35] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1030.561391][T13712] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1030.576195][T13712] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1031.947190][T31710] __nla_validate_parse: 4 callbacks suppressed [ 1031.947210][T31710] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6257'. [ 1032.178548][T31720] netlink: 220 bytes leftover after parsing attributes in process `syz.3.6258'. [ 1032.208940][T31720] netlink: 'syz.3.6258': attribute type 2 has an invalid length. [ 1032.239305][T31702] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1032.498379][T31702] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1032.738374][T31702] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1033.104347][T31744] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6265'. [ 1033.126331][T31702] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1033.199454][ T50] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 1033.229698][ T50] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 1033.252490][ T50] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 1033.286399][ T50] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 1033.298437][ T50] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 1033.651731][T31757] xt_TPROXY: Can be used only with -p tcp or -p udp [ 1033.681165][T13706] net_ratelimit: 10 callbacks suppressed [ 1033.681188][T13706] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1033.701728][T13706] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1033.803010][T31760] netlink: 28 bytes leftover after parsing attributes in process `syz.1.6266'. [ 1033.828541][T13705] netdevsim netdevsim0 eth3 (unregistering): unset [0, 0] type 1 family 0 port 4352 - 0 [ 1033.839775][T13705] netdevsim netdevsim0 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1033.953190][T13712] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1034.068629][T13705] netdevsim netdevsim0 eth2 (unregistering): unset [0, 0] type 1 family 0 port 4352 - 0 [ 1034.079250][T13705] netdevsim netdevsim0 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1034.125826][ T35] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1034.215017][T13713] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1034.241228][ T35] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1034.255692][ T35] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1034.326365][T13705] netdevsim netdevsim0 eth1 (unregistering): unset [0, 0] type 1 family 0 port 4352 - 0 [ 1034.346704][T13705] netdevsim netdevsim0 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1034.396246][T13706] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1034.407270][T31772] netlink: 'syz.4.6269': attribute type 1 has an invalid length. [ 1034.447586][T31772] 8021q: adding VLAN 0 to HW filter on device bond2 [ 1034.502949][T13705] netdevsim netdevsim0 eth0 (unregistering): unset [0, 0] type 1 family 0 port 4352 - 0 [ 1034.521045][T13705] netdevsim netdevsim0 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1034.815562][T30930] IPVS: starting estimator thread 0... [ 1034.824603][T13706] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1034.839378][T13706] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1034.951330][T31786] IPVS: using max 30 ests per chain, 72000 per kthread [ 1035.011944][T31784] syzkaller0: entered promiscuous mode [ 1035.017664][T31784] syzkaller0: entered allmulticast mode [ 1035.323242][ T50] Bluetooth: hci4: command tx timeout [ 1035.365937][T13705] tipc: Resetting bearer [ 1035.382414][ T6117] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1035.396999][ T6117] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1035.497000][T31803] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1035.947737][ T6438] hid-generic 0005:0C45:1011.0002: item fetching failed at offset 0/1 [ 1035.993308][T13713] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1036.007822][T13713] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1036.027555][ T6438] hid-generic 0005:0C45:1011.0002: probe with driver hid-generic failed with error -22 [ 1036.218398][T13705] bond5 (unregistering): (slave vti0): Releasing backup interface [ 1036.256304][T31817] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6283'. [ 1036.533704][T13705] tipc: Disabling bearer [ 1036.564131][T13705] bond3 (unregistering): (slave bridge4): Releasing backup interface [ 1036.743899][T13705] bond1 (unregistering): Released all slaves [ 1036.769850][T13705] bond2 (unregistering): Released all slaves [ 1036.798983][T13705] bond3 (unregistering): Released all slaves [ 1036.828106][T13705] bond4 (unregistering): Released all slaves [ 1036.880120][T13705]  (unregistering): Released all slaves [ 1036.902818][T13705] bond5 (unregistering): Released all slaves [ 1036.938052][T13705] bond6 (unregistering): Released all slaves [ 1036.970276][T13705] bond7 (unregistering): Released all slaves [ 1037.017888][T13705] bond8 (unregistering): Released all slaves [ 1037.399011][T13705] tipc: Disabling bearer [ 1037.404384][ T50] Bluetooth: hci4: command tx timeout [ 1037.446270][T13705] tipc: Left network mode [ 1038.672860][T31868] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6294'. [ 1038.940164][T31862] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1039.028979][ T5293] 8021q: adding VLAN 0 to HW filter on device eth1 [ 1039.053467][T31875] syzkaller0: entered promiscuous mode [ 1039.059292][T31875] syzkaller0: entered allmulticast mode [ 1039.175721][ T35] net_ratelimit: 10 callbacks suppressed [ 1039.175741][ T35] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1039.196194][ T35] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1039.364744][T31747] bridge0: port 1(bridge_slave_0) entered blocking state [ 1039.374260][T31887] netlink: 104 bytes leftover after parsing attributes in process `syz.4.6297'. [ 1039.385083][T31747] bridge0: port 1(bridge_slave_0) entered disabled state [ 1039.406699][T31747] bridge_slave_0: entered allmulticast mode [ 1039.425516][T31747] bridge_slave_0: entered promiscuous mode [ 1039.446394][T31747] bridge0: port 2(bridge_slave_1) entered blocking state [ 1039.461143][T31747] bridge0: port 2(bridge_slave_1) entered disabled state [ 1039.473658][T31747] bridge_slave_1: entered allmulticast mode [ 1039.481587][ T50] Bluetooth: hci4: command tx timeout [ 1039.498561][T31747] bridge_slave_1: entered promiscuous mode [ 1039.654197][T31899] netlink: 'syz.1.6302': attribute type 1 has an invalid length. [ 1039.691130][T31900] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6300'. [ 1039.737811][T30375] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1039.752758][T30375] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1039.831377][T31899] 8021q: adding VLAN 0 to HW filter on device bond1 [ 1040.173657][T31902] bond1: (slave veth3): Enslaving as an active interface with a down link [ 1040.218795][T31904] 8021q: adding VLAN 0 to HW filter on device batadv1 [ 1040.237745][T31904] bond1: (slave batadv1): making interface the new active one [ 1040.251090][T31904] batadv1: entered promiscuous mode [ 1040.257043][T31904] bond1: (slave batadv1): Enslaving as an active interface with an up link [ 1040.299055][T13706] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1040.314420][T13706] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1040.347756][T31747] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1040.454218][T31747] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1040.607360][T31923] netlink: 'syz.1.6304': attribute type 1 has an invalid length. [ 1040.711577][T31747] team0: Port device team_slave_0 added [ 1040.772277][T31747] team0: Port device team_slave_1 added [ 1040.871993][T13706] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1040.886532][T13706] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1041.121204][T31747] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1041.146128][T31747] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1041.214607][T31747] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1041.263924][T31933] netdevsim netdevsim4 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1041.278368][T31933] netdevsim netdevsim4 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1041.360803][T31948] netlink: 4 bytes leftover after parsing attributes in process `syz.3.6310'. [ 1041.395449][T31948] xt_TCPMSS: Only works on TCP SYN packets [ 1041.467733][T31747] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1041.487894][T31747] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1041.522620][T13713] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 1041.537130][T13713] batman_adv: batadv0: Local translation table size (72) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1041.559109][T31747] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1041.572498][ T50] Bluetooth: hci4: command tx timeout [ 1041.632885][T31948] bridge_slave_1: left allmulticast mode [ 1041.645423][T31948] bridge_slave_1: left promiscuous mode [ 1041.651684][T31948] bridge0: port 2(bridge_slave_1) entered disabled state [ 1041.667330][T31948] bridge_slave_0: left allmulticast mode [ 1041.673513][T31948] bridge_slave_0: left promiscuous mode [ 1041.679536][T31948] bridge0: port 1(bridge_slave_0) entered disabled state [ 1041.778908][T13705] hsr_slave_0: left promiscuous mode [ 1041.798241][T13705] hsr_slave_1: left promiscuous mode [ 1041.816411][T13705] batman_adv: batadv0: Interface deactivated: dummy0 [ 1041.848753][T13705] batman_adv: batadv0: Removing interface: dummy0 [ 1041.871428][T13705] batman_adv: batadv0: Interface deactivated: ipvlan1 [ 1041.891508][T13705] batman_adv: batadv0: Removing interface: ipvlan1 [ 1041.916784][T13705] veth1_macvtap: left promiscuous mode [ 1041.923027][T13705] veth1_vlan: left promiscuous mode [ 1041.928902][T13705] veth0_vlan: left promiscuous mode [ 1042.392605][T31933] netdevsim netdevsim4 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1042.402556][T31933] netdevsim netdevsim4 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1042.420010][ T5293] 8021q: adding VLAN 0 to HW filter on device eth2 [ 1042.527764][T31958] bond1: (slave bond_slave_1): Device is not our slave [ 1042.553421][T31958] bond1: option active_slave: invalid value (bond_slave_1) [ 1042.569213][T31958] bond1 (unregistering): Released all slaves [ 1042.678591][T31964] netlink: 4 bytes leftover after parsing attributes in process `syz.3.6312'. [ 1042.710110][T31747] hsr_slave_0: entered promiscuous mode [ 1042.722276][T31747] hsr_slave_1: entered promiscuous mode [ 1042.823209][T31933] netdevsim netdevsim4 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1042.841293][T31933] netdevsim netdevsim4 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1042.984073][T31933] netdevsim netdevsim4 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1042.999941][T31933] netdevsim netdevsim4 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1043.453288][T30375] netdevsim netdevsim4 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 1043.478127][T30375] netdevsim netdevsim4 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1043.525198][T13705] IPVS: stop unused estimator thread 0... [ 1043.583084][T30375] netdevsim netdevsim4 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1043.612388][T30375] netdevsim netdevsim4 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1043.630857][T30375] netdevsim netdevsim4 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1043.649377][T30375] netdevsim netdevsim4 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1043.836059][T30375] netdevsim netdevsim4 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1043.859921][T30375] netdevsim netdevsim4 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1043.926508][T31999] netlink: 44 bytes leftover after parsing attributes in process `syz.1.6321'. [ 1043.951339][T31999] netlink: 35 bytes leftover after parsing attributes in process `syz.1.6321'. [ 1044.003773][T31999] netlink: 'syz.1.6321': attribute type 5 has an invalid length. [ 1044.034691][T31999] netlink: 'syz.1.6321': attribute type 6 has an invalid length. [ 1044.073225][T31999] netlink: 35 bytes leftover after parsing attributes in process `syz.1.6321'. [ 1044.111172][T32001] netlink: 44 bytes leftover after parsing attributes in process `syz.1.6321'. [ 1044.152201][T32001] netlink: 35 bytes leftover after parsing attributes in process `syz.1.6321'. [ 1044.186444][T32001] netlink: 'syz.1.6321': attribute type 5 has an invalid length. [ 1044.214107][T32001] netlink: 'syz.1.6321': attribute type 6 has an invalid length. [ 1044.255267][T32001] netlink: 35 bytes leftover after parsing attributes in process `syz.1.6321'. [ 1044.369674][T32015] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6325'. [ 1044.656430][T32026] netlink: 132 bytes leftover after parsing attributes in process `syz.2.6329'. [ 1044.853174][T32033] netlink: 16 bytes leftover after parsing attributes in process `syz.1.6331'. [ 1044.919054][T32033] netlink: 'syz.1.6331': attribute type 1 has an invalid length. [ 1044.987812][T32033] sctp: [Deprecated]: syz.1.6331 (pid 32033) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1044.987812][T32033] Use struct sctp_sack_info instead [ 1045.148340][T32044] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6334'. [ 1045.226962][T32049] Bluetooth: MGMT ver 1.23 [ 1045.314985][T31747] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 1045.358174][T31747] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1045.388666][T31747] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 1045.444926][T31747] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1045.469198][T31747] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 1045.509769][T31747] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1045.529614][T31747] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 1045.572919][T31747] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1045.958818][T31747] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1046.089003][T31747] 8021q: adding VLAN 0 to HW filter on device team0 [ 1046.128714][T13705] bridge0: port 1(bridge_slave_0) entered blocking state [ 1046.135985][T13705] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1046.215102][T13712] bridge0: port 2(bridge_slave_1) entered blocking state [ 1046.222380][T13712] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1046.581759][ T50] block nbd0: Receive control failed (result -32) [ 1046.895918][T32109] openvswitch: netlink: Unexpected mask (mask=240040, allowed=10048) [ 1047.753944][T32137] xt_CT: No such helper "syz0" [ 1047.989337][T31747] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1048.223933][T32162] nbd: nbd1 already in use [ 1048.243665][T32162] block nbd1: NBD_DISCONNECT [ 1048.259096][T32162] block nbd1: Send disconnect failed -32 [ 1048.262931][T31747] veth0_vlan: entered promiscuous mode [ 1048.272046][T32162] block nbd1: shutting down sockets [ 1048.316748][T31747] veth1_vlan: entered promiscuous mode [ 1048.649210][T32183] veth0_to_hsr: mtu less than device minimum [ 1048.716633][ T6117] bond1: (slave veth3): link status definitely up, 10000 Mbps full duplex [ 1048.983578][T31747] veth0_macvtap: entered promiscuous mode [ 1049.013907][T31747] veth1_macvtap: entered promiscuous mode [ 1049.184328][T31747] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1049.204849][ T29] audit: type=1800 audit(1780758747.653:14): pid=32204 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.6368" name="memory.events" dev="tmpfs" ino=296 res=0 errno=0 [ 1049.231079][T31747] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1049.269679][T32204] netlink: 'syz.3.6368': attribute type 15 has an invalid length. [ 1049.304477][T13712] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1049.319374][T13712] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1049.377101][T30376] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1049.442235][T30376] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1049.527008][T32216] __nla_validate_parse: 5 callbacks suppressed [ 1049.527032][T32216] netlink: 56 bytes leftover after parsing attributes in process `syz.4.6371'. [ 1049.622287][T32216] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6371'. [ 1049.770497][ T6117] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1049.792000][ T6117] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1049.968451][T13706] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1050.005658][T13706] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1050.151959][T32239] A link change request failed with some changes committed already. Interface veth0_to_batadv may have been left with an inconsistent configuration, please check. [ 1050.399920][T30930] IPVS: starting estimator thread 0... [ 1050.520561][T32248] IPVS: using max 33 ests per chain, 79200 per kthread [ 1050.601905][T32258] netlink: 'syz.3.6379': attribute type 178 has an invalid length. [ 1050.653859][T32257] netlink: 'syz.3.6379': attribute type 178 has an invalid length. [ 1051.108835][T32277] netlink: 'syz.3.6384': attribute type 4 has an invalid length. [ 1051.561529][T13706] batadv1: left promiscuous mode [ 1051.700600][T32295] netlink: 16 bytes leftover after parsing attributes in process `syz.3.6389'. [ 1051.894694][T32299] veth1_to_batadv: entered promiscuous mode [ 1052.342030][T32308] can: request_module (can-proto-5) failed. [ 1053.254882][T32339] netlink: 28 bytes leftover after parsing attributes in process `syz.1.6399'. [ 1053.609309][T32359] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6403'. [ 1053.640879][T32359] netlink: 24 bytes leftover after parsing attributes in process `syz.1.6403'. [ 1053.737934][T32359] pim6reg: entered allmulticast mode [ 1054.109032][T32368] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6404'. [ 1054.181212][T32371] dvmrp0: entered allmulticast mode [ 1054.224470][T32368] veth0_macvtap: left promiscuous mode [ 1054.586849][T32378] –: renamed from dummy0 (while UP) [ 1054.591416][T32377] Bluetooth: MGMT ver 1.23 [ 1054.643265][T32377] netlink: 40 bytes leftover after parsing attributes in process `syz.4.6406'. [ 1054.706114][T32380] netlink: 12 bytes leftover after parsing attributes in process `syz.4.6406'. [ 1054.732255][T32380] netlink: 68 bytes leftover after parsing attributes in process `syz.4.6406'. [ 1054.761494][T32380] netlink: 12 bytes leftover after parsing attributes in process `syz.4.6406'. [ 1054.824452][T32380] netlink: 68 bytes leftover after parsing attributes in process `syz.4.6406'. [ 1055.237522][T32399] netlink: 132 bytes leftover after parsing attributes in process `syz.1.6411'. [ 1055.269853][T32398] sctp: [Deprecated]: syz.3.6412 (pid 32398) Use of int in max_burst socket option. [ 1055.269853][T32398] Use struct sctp_assoc_value instead [ 1055.626806][T32417] netlink: 248 bytes leftover after parsing attributes in process `syz.0.6417'. [ 1055.819024][T32423] netlink: 248 bytes leftover after parsing attributes in process `syz.0.6417'. [ 1056.135449][T32436] netlink: 56 bytes leftover after parsing attributes in process `syz.0.6421'. [ 1056.295598][T32440] netlink: 132 bytes leftover after parsing attributes in process `syz.3.6423'. [ 1056.648560][T32450] syzkaller1: entered promiscuous mode [ 1056.675825][T32450] syzkaller1: entered allmulticast mode [ 1056.697685][T32459] openvswitch: netlink: Unknown VXLAN extension attribute 0 [ 1056.912134][T32465] xt_nfacct: accounting object `syz0' does not exist [ 1057.251159][T32490] netlink: 'syz.3.6435': attribute type 15 has an invalid length. [ 1057.271130][T32491] netlink: 'syz.3.6435': attribute type 15 has an invalid length. [ 1057.288211][T32490] netlink: 'syz.3.6435': attribute type 25 has an invalid length. [ 1057.311564][T32491] netlink: 'syz.3.6435': attribute type 25 has an invalid length. [ 1057.316392][T32493] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 1058.583686][T32530] netlink: 'syz.0.6441': attribute type 3 has an invalid length. [ 1059.831369][T32464] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1060.103894][T32546] __nla_validate_parse: 9 callbacks suppressed [ 1060.103919][T32546] netlink: 16 bytes leftover after parsing attributes in process `syz.3.6445'. [ 1060.174936][T32546] netlink: 20 bytes leftover after parsing attributes in process `syz.3.6445'. [ 1060.189399][T32550] syzkaller0: entered promiscuous mode [ 1060.201566][T32550] syzkaller0: entered allmulticast mode [ 1060.496815][T32575] netlink: 'syz.1.6454': attribute type 4 has an invalid length. [ 1060.552575][T32578] syzkaller0: entered promiscuous mode [ 1060.566713][T32578] syzkaller0: entered allmulticast mode [ 1060.606506][T32578] tipc: Enabled bearer , priority 0 [ 1060.636654][T32576] tipc: Resetting bearer [ 1060.679745][T32576] tipc: Disabling bearer [ 1060.712372][T32581] netlink: 16186 bytes leftover after parsing attributes in process `syz.3.6458'. [ 1061.104447][T32600] netlink: 44 bytes leftover after parsing attributes in process `syz.3.6463'. [ 1061.147729][T32600] netlink: 'syz.3.6463': attribute type 4 has an invalid length. [ 1061.197292][T32604] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6466'. [ 1061.304443][T32604] bond1: option ad_actor_sys_prio: invalid value (0) [ 1061.311734][T32604] bond1: option ad_actor_sys_prio: allowed values 1 - 65535 [ 1061.328854][T32604] bond1 (unregistering): Released all slaves [ 1061.399849][T32618] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6470'. [ 1061.500244][T32616] syzkaller0: entered promiscuous mode [ 1061.507005][T32616] syzkaller0: entered allmulticast mode [ 1061.554889][T32624] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6471'. [ 1061.629115][T32624] netlink: 60 bytes leftover after parsing attributes in process `syz.2.6471'. [ 1061.784741][T32634] netlink: 14 bytes leftover after parsing attributes in process `syz.0.6476'. [ 1061.812479][T21982] Bluetooth: hci5: command 0x0406 tx timeout [ 1061.822151][T21982] Bluetooth: hci2: command 0x0406 tx timeout [ 1061.923871][T32643] netlink: 132 bytes leftover after parsing attributes in process `syz.1.6478'. [ 1062.037413][T32647] netlink: 'syz.1.6480': attribute type 2 has an invalid length. [ 1062.612646][T32667] netlink: 'syz.2.6486': attribute type 10 has an invalid length. [ 1062.667325][T32663] netlink: 'syz.2.6486': attribute type 10 has an invalid length. [ 1062.726611][T32667] team0: Port device dummy0 added [ 1062.820061][T32663] team0: Port device dummy0 removed [ 1062.853744][T32663] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 1062.868007][T32685] syzkaller0: entered promiscuous mode [ 1062.882689][T32685] syzkaller0: entered allmulticast mode [ 1062.967992][T32679] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1063.485655][T32697] netlink: 'syz.1.6492': attribute type 25 has an invalid length. [ 1064.858503][T32741] syzkaller0: entered promiscuous mode [ 1064.875897][T32741] syzkaller0: entered allmulticast mode [ 1065.769799][ T314] __nla_validate_parse: 15 callbacks suppressed [ 1065.769823][ T314] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6512'. [ 1065.915877][ T316] syzkaller0: entered promiscuous mode [ 1065.946667][ T316] syzkaller0: entered allmulticast mode [ 1065.956817][ T319] tipc: Failed to remove unknown binding: 66,0,0/0:18678162/18678164 [ 1065.982434][ T317] tipc: Started in network mode [ 1065.985079][ T319] tipc: Failed to remove unknown binding: 66,0,0/0:18678162/18678163 [ 1066.002333][ T317] tipc: Node identity a28a91555a22, cluster identity 4711 [ 1066.009352][ T320] tipc: Failed to remove unknown binding: 66,0,0/0:18678162/18678164 [ 1066.030224][ T320] tipc: Failed to remove unknown binding: 66,0,0/0:18678162/18678163 [ 1066.042310][ T317] tipc: Enabled bearer , priority 0 [ 1066.085273][ T315] tipc: Resetting bearer [ 1066.223285][ T315] tipc: Disabling bearer [ 1066.716257][ T335] syzkaller0: entered promiscuous mode [ 1066.727150][ T335] syzkaller0: entered allmulticast mode [ 1066.799569][ T339] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6521'. [ 1066.922949][T32762] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1067.312635][T32762] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1067.388829][ T364] bridge1: entered promiscuous mode [ 1067.403524][ T364] bridge1: entered allmulticast mode [ 1067.586146][ T378] x_tables: arp_tables: CLASSIFY target: used from hooks INPUT, but only usable from FORWARD/OUTPUT [ 1067.607515][ T379] netlink: 3 bytes leftover after parsing attributes in process `syz.2.6530'. [ 1067.632433][ T379] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6530'. [ 1067.651363][ T379] netlink: 3 bytes leftover after parsing attributes in process `syz.2.6530'. [ 1067.671647][ T379] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6530'. [ 1067.683854][T32762] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1067.694520][ T379] netlink: 3 bytes leftover after parsing attributes in process `syz.2.6530'. [ 1067.929714][T32762] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1068.208097][ T393] syzkaller0: entered promiscuous mode [ 1068.224610][ T393] syzkaller0: entered allmulticast mode [ 1068.836573][T13705] netdevsim netdevsim3 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1068.883626][ T411] netlink: 16 bytes leftover after parsing attributes in process `syz.4.6537'. [ 1069.039349][T30375] netdevsim netdevsim3 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1069.100036][ T6117] netdevsim netdevsim3 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1069.170235][ T422] IPVS: sync thread started: state = MASTER, mcast_ifn = veth1_to_hsr, syncid = 4, id = 0 [ 1069.221269][T30376] netdevsim netdevsim3 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1069.354112][ T424] netlink: 212340 bytes leftover after parsing attributes in process `syz.4.6541'. [ 1069.390929][ T424] openvswitch: netlink: Port 167772160 exceeds max allowable 65535 [ 1069.688628][ T431] netlink: 124 bytes leftover after parsing attributes in process `syz.4.6543'. [ 1069.962011][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 1070.103484][ T455] netlink: 'syz.2.6551': attribute type 4 has an invalid length. [ 1070.153739][ T458] netlink: 'syz.2.6551': attribute type 4 has an invalid length. [ 1070.257872][ T460] IPVS: set_ctl: invalid protocol: 0 224.0.0.2:20001 [ 1070.787932][ T462] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1071.101424][ T462] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1071.305899][ T492] __nla_validate_parse: 1 callbacks suppressed [ 1071.305920][ T492] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6558'. [ 1071.496908][ T462] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1071.594902][ T498] veth0: entered promiscuous mode [ 1071.612746][ T504] bond0: entered promiscuous mode [ 1071.628157][ T504] bond_slave_0: entered promiscuous mode [ 1071.647941][ T504] bond_slave_1: entered promiscuous mode [ 1071.679527][ T497] bond0: left promiscuous mode [ 1071.695241][ T497] bond_slave_0: left promiscuous mode [ 1071.715013][ T497] bond_slave_1: left promiscuous mode [ 1071.793224][ T497] veth0: left promiscuous mode [ 1071.988397][ T462] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1072.162095][ T524] netlink: 16 bytes leftover after parsing attributes in process `syz.2.6562'. [ 1072.183030][ T524] netlink: 16 bytes leftover after parsing attributes in process `syz.2.6562'. [ 1072.263708][ T544] batman_adv: batadv0: Adding interface: dummy0 [ 1072.271089][ T544] batman_adv: batadv0: The MTU of interface dummy0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1072.305105][ T544] batman_adv: batadv0: Interface activated: dummy0 [ 1072.368454][ T544] batadv0: mtu less than device minimum [ 1072.384792][ T544] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 1072.396311][ T544] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 1072.408269][ T544] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 1072.420354][ T544] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 1072.434439][ T544] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 1072.446406][ T544] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 1072.458468][ T544] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 1072.470537][ T544] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 1072.659902][ T35] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1072.729221][ T561] netlink: 'syz.2.6570': attribute type 61 has an invalid length. [ 1072.768432][ T35] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1072.843738][ T35] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1072.915895][ T35] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1072.983540][ T569] netlink: 'syz.1.6573': attribute type 10 has an invalid length. [ 1073.002937][ T569] batman_adv: batadv0: Interface deactivated: dummy0 [ 1073.038360][ T572] netlink: 'syz.1.6573': attribute type 10 has an invalid length. [ 1073.050069][ T569] batman_adv: batadv0: Removing interface: dummy0 [ 1073.159548][ T569] team0: Port device dummy0 added [ 1073.241789][ T572] team0: Port device dummy0 removed [ 1073.299433][ T572] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 1073.523285][ T594] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6578'. [ 1074.411680][ T628] netlink: 'syz.0.6589': attribute type 1 has an invalid length. [ 1074.436981][ T628] bond1: entered promiscuous mode [ 1074.444131][ T628] 8021q: adding VLAN 0 to HW filter on device bond1 [ 1074.501694][ T628] bond1: (slave veth3): making interface the new active one [ 1074.509094][ T628] veth3: entered promiscuous mode [ 1074.517474][ T628] bond1: (slave veth3): Enslaving as an active interface with an up link [ 1074.714709][ T635] syzkaller1: entered promiscuous mode [ 1074.729973][ T635] syzkaller1: entered allmulticast mode [ 1075.451771][ T663] tun0: tun_chr_ioctl cmd 1074025672 [ 1075.468435][ T663] tun0: ignored: set checksum disabled [ 1075.515386][ T668] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6599'. [ 1075.774983][ T674] netlink: 24 bytes leftover after parsing attributes in process `syz.0.6602'. [ 1076.198185][ T689] bridge1: left promiscuous mode [ 1076.387012][ T698] syzkaller0: entered promiscuous mode [ 1076.396387][ T698] syzkaller0: entered allmulticast mode [ 1076.549595][ T708] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6609'. [ 1080.584047][ T711] netlink: 192 bytes leftover after parsing attributes in process `syz.3.6610'. [ 1080.608432][ T711] netlink: 192 bytes leftover after parsing attributes in process `syz.3.6610'. [ 1080.786658][ T734] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6616'. [ 1080.797752][ T734] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6616'. [ 1080.956434][ T732] bond2: down delay (5) is not a multiple of miimon (2), value rounded to 4 ms [ 1080.985969][ T732] bond2: entered promiscuous mode [ 1081.039189][ T738] net_ratelimit: 366 callbacks suppressed [ 1081.039212][ T738] netlink: zone id is out of range [ 1081.082301][ T738] netlink: zone id is out of range [ 1081.115903][ T738] netlink: zone id is out of range [ 1081.118519][ T740] pim6reg1: entered promiscuous mode [ 1081.136595][ T738] netlink: zone id is out of range [ 1081.150942][ T740] pim6reg1: entered allmulticast mode [ 1081.165053][ T738] netlink: zone id is out of range [ 1081.174922][ T746] FAULT_INJECTION: forcing a failure. [ 1081.174922][ T746] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1081.180144][ T738] netlink: zone id is out of range [ 1081.200731][ T746] CPU: 1 UID: 0 PID: 746 Comm: syz.0.6620 Not tainted syzkaller #0 PREEMPT(full) [ 1081.200763][ T746] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1081.200776][ T746] Call Trace: [ 1081.200786][ T746] [ 1081.200797][ T746] dump_stack_lvl+0xe8/0x150 [ 1081.200832][ T746] should_fail_ex+0x412/0x560 [ 1081.200864][ T746] _copy_from_user+0x2d/0xb0 [ 1081.200892][ T746] ___sys_recvmsg+0x175/0x590 [ 1081.200928][ T746] ? __pfx____sys_recvmsg+0x10/0x10 [ 1081.200960][ T746] ? __fget_files+0x2a/0x420 [ 1081.201006][ T746] ? __fget_files+0x3a0/0x420 [ 1081.201042][ T746] do_recvmmsg+0x334/0x800 [ 1081.201078][ T746] ? __pfx_do_recvmmsg+0x10/0x10 [ 1081.201123][ T746] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 1081.201173][ T746] __x64_sys_recvmmsg+0x198/0x250 [ 1081.201202][ T746] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 1081.201239][ T746] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1081.201265][ T746] do_syscall_64+0x174/0x580 [ 1081.201287][ T746] ? trace_irq_disable+0x3b/0x140 [ 1081.201321][ T746] ? clear_bhb_loop+0x40/0x90 [ 1081.201347][ T746] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1081.201368][ T746] RIP: 0033:0x7ff2bb99ce59 [ 1081.201389][ T746] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1081.201408][ T746] RSP: 002b:00007ff2bc895028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 1081.201431][ T746] RAX: ffffffffffffffda RBX: 00007ff2bbc15fa0 RCX: 00007ff2bb99ce59 [ 1081.201455][ T746] RDX: 0000000000000003 RSI: 0000200000000580 RDI: 0000000000000003 [ 1081.201470][ T746] RBP: 00007ff2bc895090 R08: 0000000000000000 R09: 0000000000000000 [ 1081.201483][ T746] R10: 0000000040000002 R11: 0000000000000246 R12: 0000000000000001 [ 1081.201497][ T746] R13: 00007ff2bbc16038 R14: 00007ff2bbc15fa0 R15: 00007ffe28a5bb98 [ 1081.201532][ T746] [ 1081.438843][ T738] netlink: zone id is out of range [ 1081.444321][ T738] netlink: zone id is out of range [ 1081.449534][ T738] netlink: zone id is out of range [ 1081.517494][ T738] netlink: zone id is out of range [ 1081.675036][ T767] syzkaller0: entered promiscuous mode [ 1081.691236][ T767] syzkaller0: entered allmulticast mode [ 1081.951529][ T777] block nbd2: reconnected socket [ 1081.962180][ T777] block nbd2: Unsupported socket: should be TCP or UNIX. [ 1082.018372][ T781] netlink: 14 bytes leftover after parsing attributes in process `syz.0.6629'. [ 1082.651272][ T50] block nbd2: Receive control failed (result -104) [ 1083.305908][T13713] bond1 (unregistering): Released all slaves [ 1083.337872][T13713] bond2 (unregistering): Released all slaves [ 1083.354377][T13713] bond3 (unregistering): Released all slaves [ 1083.369146][T13713] bond4 (unregistering): Released all slaves [ 1083.394811][T13713] bond5 (unregistering): Released all slaves [ 1083.413318][T13713] bond6 (unregistering): Released all slaves [ 1083.435173][T13713] bond7 (unregistering): Released all slaves [ 1083.451661][T13713] bond8 (unregistering): Released all slaves [ 1083.616180][ T804] bond3: entered promiscuous mode [ 1083.638150][ T804] 8021q: adding VLAN 0 to HW filter on device bond3 [ 1083.717731][ T824] netlink: 212408 bytes leftover after parsing attributes in process `syz.4.6641'. [ 1083.772137][ T822] syz_tun: entered promiscuous mode [ 1083.832019][ T827] syzkaller0: entered promiscuous mode [ 1083.841765][ T827] syzkaller0: entered allmulticast mode [ 1083.944418][ T822] 8021q: adding VLAN 0 to HW filter on device macvlan5 [ 1084.012342][T30930] team_slave_0: entered promiscuous mode [ 1084.020237][T30930] team_slave_1: entered promiscuous mode [ 1084.114479][ T836] 8021q: adding VLAN 0 to HW filter on device macvlan6 [ 1084.228907][T13713] hmac(sha224: left promiscuous mode [ 1084.324055][T13713] tipc: Disabling bearer [ 1084.330573][T13713] tipc: Left network mode [ 1085.074845][ T872] netlink: 'syz.4.6652': attribute type 16 has an invalid length. [ 1085.174925][ T881] netlink: 12 bytes leftover after parsing attributes in process `syz.0.6655'. [ 1085.228692][ T875] netlink: 36 bytes leftover after parsing attributes in process `syz.1.6653'. [ 1085.541935][ T902] netlink: 20 bytes leftover after parsing attributes in process `syz.0.6655'. [ 1085.581524][ T881] 8021q: adding VLAN 0 to HW filter on device bond2 [ 1085.708877][ T887] bond2: (slave veth5): Enslaving as an active interface with an up link [ 1085.719886][ T906] netlink: 132 bytes leftover after parsing attributes in process `syz.4.6659'. [ 1085.888536][ T895] netlink: 200 bytes leftover after parsing attributes in process `syz.0.6655'. [ 1086.005752][ T902] bond2: (slave bridge1): Enslaving as an active interface with an up link [ 1086.282533][ T1935] block nbd2: Connection timed out, retrying (0/1 alive) [ 1086.291782][ T1935] block nbd2: Connection timed out, retrying (0/1 alive) [ 1086.298934][ T1935] block nbd2: Connection timed out, retrying (0/1 alive) [ 1086.306204][ T1935] block nbd2: Connection timed out, retrying (0/1 alive) [ 1086.314436][ T1935] block nbd2: Connection timed out, retrying (0/1 alive) [ 1086.322941][ T1935] block nbd2: Connection timed out, retrying (0/1 alive) [ 1086.330664][ T11] block nbd2: Dead connection, failed to find a fallback [ 1086.338308][ T11] block nbd2: shutting down sockets [ 1086.352517][ T1935] block nbd2: Connection timed out, retrying (0/1 alive) [ 1086.359754][ T11] blk_print_req_error: 138 callbacks suppressed [ 1086.359772][ T11] I/O error, dev nbd2, sector 4 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 1086.375911][ T1935] block nbd2: Connection timed out, retrying (0/1 alive) [ 1086.383970][ T11] buffer_io_error: 138 callbacks suppressed [ 1086.383992][ T11] Buffer I/O error on dev nbd2, logical block 4, async page read [ 1086.398744][ T11] I/O error, dev nbd2, sector 3 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 1086.407918][ T11] Buffer I/O error on dev nbd2, logical block 3, async page read [ 1086.416702][ T11] I/O error, dev nbd2, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 1086.425971][ T11] Buffer I/O error on dev nbd2, logical block 2, async page read [ 1086.433925][ T11] I/O error, dev nbd2, sector 1 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 1086.436329][ T945] netlink: 48 bytes leftover after parsing attributes in process `syz.0.6663'. [ 1086.443539][ T11] Buffer I/O error on dev nbd2, logical block 1, async page read [ 1086.460152][ T11] I/O error, dev nbd2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 1086.469337][ T11] Buffer I/O error on dev nbd2, logical block 0, async page read [ 1086.477309][ T11] I/O error, dev nbd2, sector 7 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 1086.486443][ T11] Buffer I/O error on dev nbd2, logical block 7, async page read [ 1086.494372][ T11] I/O error, dev nbd2, sector 6 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 1086.503521][ T11] Buffer I/O error on dev nbd2, logical block 6, async page read [ 1086.511635][ T11] I/O error, dev nbd2, sector 5 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 1086.521653][ T11] Buffer I/O error on dev nbd2, logical block 5, async page read [ 1086.532950][ T724] I/O error, dev nbd2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 1086.545011][ T724] Buffer I/O error on dev nbd2, logical block 0, async page read [ 1086.558678][ T724] I/O error, dev nbd2, sector 1 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 1086.567956][ T724] Buffer I/O error on dev nbd2, logical block 1, async page read [ 1086.583149][ T724] ldm_validate_partition_table(): Disk read failed. [ 1086.594031][ T724] Dev nbd2: unable to read RDB block 0 [ 1086.606790][ T724] nbd2: unable to read partition table [ 1086.625998][ T724] ldm_validate_partition_table(): Disk read failed. [ 1086.637142][ T724] Dev nbd2: unable to read RDB block 0 [ 1086.651714][ T724] nbd2: unable to read partition table [ 1086.843215][ T944] netlink: 76 bytes leftover after parsing attributes in process `syz.2.6664'. [ 1087.229839][ T977] netlink: 32 bytes leftover after parsing attributes in process `syz.1.6668'. [ 1087.285114][ T977] netlink: 16 bytes leftover after parsing attributes in process `syz.1.6668'. [ 1087.400681][T19043] Bluetooth: hci0: command 0x0406 tx timeout [ 1087.656774][ T990] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6673'. [ 1087.850567][ T990] hsr_slave_1 (unregistering): left promiscuous mode [ 1088.263978][ T1005] netlink: 'syz.0.6675': attribute type 1 has an invalid length. [ 1088.314077][ T1005] netlink: 224 bytes leftover after parsing attributes in process `syz.0.6675'. [ 1088.570894][ T1009] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6676'. [ 1088.856449][T13713] veth1_macvtap: left promiscuous mode [ 1088.878478][T13713] veth1_vlan: left promiscuous mode [ 1088.891191][T13713] veth0_vlan: left promiscuous mode [ 1088.918574][ T1025] xt_TPROXY: Can be used only with -p tcp or -p udp [ 1088.985213][ T1025] xt_CT: No such helper "netbios-ns" [ 1089.128533][T13713] pim6reg99999999 (unregistering): left allmulticast mode [ 1090.030891][ T1058] netlink: 12 bytes leftover after parsing attributes in process `syz.4.6687'. [ 1090.113098][ T1059] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6686'. [ 1090.185193][ T1059] netlink: 12 bytes leftover after parsing attributes in process `syz.0.6686'. [ 1090.404834][ T1059] block nbd1: Unsupported socket: should be TCP or UNIX. [ 1090.443135][ C1] ip6_tunnel: D xmit: Local address not yet configured! [ 1090.473566][T13713] IPVS: stop unused estimator thread 0... [ 1090.654863][ T1094] nft_compat: unsupported protocol 32 [ 1090.703661][ T1094] netlink: 'syz.4.6693': attribute type 1 has an invalid length. [ 1090.727136][ T1098] syzkaller0: entered promiscuous mode [ 1090.739223][ T1094] netlink: 48 bytes leftover after parsing attributes in process `syz.4.6693'. [ 1090.745574][ T1098] syzkaller0: entered allmulticast mode [ 1090.772467][ T1099] netlink: 12 bytes leftover after parsing attributes in process `syz.0.6695'. [ 1090.996750][ T1108] tap0: tun_chr_ioctl cmd 1074025677 [ 1091.018603][ T1108] tap0: linktype set to 6 [ 1091.482813][ T1124] nbd: nbd64 already in use [ 1091.848489][ T1139] IPVS: set_ctl: invalid protocol: 43 172.20.20.187:20001 [ 1091.858004][ T917] udevd[917]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 1092.215721][ T1153] netlink: 'syz.1.6711': attribute type 1 has an invalid length. [ 1092.647866][ T1175] __nla_validate_parse: 7 callbacks suppressed [ 1092.647889][ T1175] netlink: 132 bytes leftover after parsing attributes in process `syz.3.6718'. [ 1092.669077][ T1178] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6720'. [ 1092.678098][ T1153] bond2: (slave gretap2): making interface the new active one [ 1092.686682][ T1153] bond2: (slave gretap2): Enslaving as an active interface with an up link [ 1092.696733][ T1164] veth1_to_bridge: entered promiscuous mode [ 1092.717469][ T1164] veth1_to_bridge: entered allmulticast mode [ 1092.794997][ T1181] netlink: 'syz.4.6719': attribute type 1 has an invalid length. [ 1092.826796][ T1181] netlink: 936 bytes leftover after parsing attributes in process `syz.4.6719'. [ 1093.272083][ T1215] netlink: 12 bytes leftover after parsing attributes in process `syz.2.6728'. [ 1093.401130][ T1223] netlink: 132 bytes leftover after parsing attributes in process `syz.4.6731'. [ 1093.449806][ T1221] syzkaller0: entered promiscuous mode [ 1093.478847][ T1221] syzkaller0: entered allmulticast mode [ 1093.547751][ T1226] vxcan2: entered promiscuous mode [ 1093.693878][ T1236] netlink: 24 bytes leftover after parsing attributes in process `syz.2.6735'. [ 1093.754418][ T1236] netlink: 12 bytes leftover after parsing attributes in process `syz.2.6735'. [ 1093.810720][ T1236] netlink: 24 bytes leftover after parsing attributes in process `syz.2.6735'. [ 1093.853504][ T1236] netlink: 12 bytes leftover after parsing attributes in process `syz.2.6735'. [ 1093.870090][ T1236] netlink: 24 bytes leftover after parsing attributes in process `syz.2.6735'. [ 1094.165403][ T1254] net_ratelimit: 391 callbacks suppressed [ 1094.165424][ T1254] openvswitch: netlink: Unexpected mask (mask=200240, allowed=10048) [ 1094.397698][ T1269] bond1 (unregistering): Released all slaves [ 1094.644379][ T1285] netlink: 'syz.3.6749': attribute type 6 has an invalid length. [ 1094.652958][ T1285] netlink: 'syz.3.6749': attribute type 7 has an invalid length. [ 1094.670868][ T1285] netlink: 'syz.3.6749': attribute type 8 has an invalid length. [ 1094.678965][ T1285] netlink: 'syz.3.6749': attribute type 15 has an invalid length. [ 1094.711266][ T1285] pim6reg1: entered promiscuous mode [ 1094.729507][ T1285] pim6reg1: entered allmulticast mode [ 1094.814221][ T1295] netlink: 'syz.3.6749': attribute type 6 has an invalid length. [ 1094.824804][ T1295] netlink: 'syz.3.6749': attribute type 7 has an invalid length. [ 1094.833821][ T1295] netlink: 'syz.3.6749': attribute type 8 has an invalid length. [ 1095.782095][ T1350] IPVS: set_ctl: invalid protocol: 44 172.20.20.170:20000 [ 1095.795732][ T1350] IPVS: set_ctl: invalid protocol: 43 172.20.20.16:20004 [ 1095.857147][ T1354] validate_nla: 1 callbacks suppressed [ 1095.857167][ T1354] netlink: 'syz.3.6770': attribute type 2 has an invalid length. [ 1096.039494][ T1362] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1096.045476][ T1364] lo speed is unknown, defaulting to 1000 [ 1096.063924][ T1364] lo speed is unknown, defaulting to 1000 [ 1096.084572][ T1364] lo speed is unknown, defaulting to 1000 [ 1096.094351][ T1364] smbdirect: ib_dev[syz2]: added: RNIC max_fast_reg_page_list_len=256 device_cap_flags=0x200000 kernel_cap_flags=0x10 page_size_cap=0x1000 [ 1096.109051][ T1364] smbdirect: ib_dev[syz2]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=1 max_cqe=3276800 max_qp_wr=32768 max_send_sge=6 max_recv_sge=6 [ 1096.131826][ T1364] smbdirect: ib_dev[syz2]PORT[1]: iwarp=1 ib=0 roce=0 v1=0 v2=0 core_cap_flags=0x400008 [ 1096.184183][ T1364] infiniband syz2: RDMA CMA: cma_listen_on_dev, error -98 [ 1096.304080][ T1364] lo speed is unknown, defaulting to 1000 [ 1096.318643][ T1364] lo speed is unknown, defaulting to 1000 [ 1096.342832][ T1364] lo speed is unknown, defaulting to 1000 [ 1096.373620][ T1364] lo speed is unknown, defaulting to 1000 [ 1096.388440][ T1364] lo speed is unknown, defaulting to 1000 [ 1096.430156][ T1364] lo speed is unknown, defaulting to 1000 [ 1096.466455][ T1364] lo speed is unknown, defaulting to 1000 [ 1096.932759][ T1408] workqueue: Failed to create a rescuer kthread for wq "nfc2_nci_rx_wq": -EINTR [ 1097.198216][ T1423] IPVS: set_ctl: invalid protocol: 94 100.1.1.0:20001 [ 1097.760193][ T1453] __nla_validate_parse: 148 callbacks suppressed [ 1097.760216][ T1453] netlink: 132 bytes leftover after parsing attributes in process `syz.4.6805'. [ 1098.355792][ T1488] 5Ò: entered promiscuous mode [ 1098.416626][ T1486] macvtap0: entered promiscuous mode [ 1098.429445][ T1486] bridge0: entered promiscuous mode [ 1098.742884][ T1506] netlink: 132 bytes leftover after parsing attributes in process `syz.4.6819'. [ 1099.142236][ T1526] netlink: 'syz.0.6825': attribute type 10 has an invalid length. [ 1107.880702][T19043] Bluetooth: hci3: command 0x0406 tx timeout [ 1119.177988][ T1579] batman_adv: batadv0: adding TT local entry aa:aa:aa:aa:aa:2a to non-existent VLAN 1303 [ 1119.186925][ T1581] netlink: 24 bytes leftover after parsing attributes in process `syz.4.6830'. [ 1119.201107][ T1575] netlink: 'syz.1.6827': attribute type 10 has an invalid length. [ 1119.210090][ T1579] batman_adv: batadv0: Adding interface: dummy0 [ 1119.216548][ T1579] batman_adv: batadv0: The MTU of interface dummy0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1119.243191][ T1579] batman_adv: batadv0: Interface activated: dummy0 [ 1119.281213][ T1575] syz_tun: entered promiscuous mode [ 1119.285626][ T1587] netlink: 48 bytes leftover after parsing attributes in process `syz.2.6831'. [ 1119.315633][ T1575] bond0: (slave syz_tun): Enslaving as an active interface with an up link [ 1119.374531][ T1584] batadv0: mtu less than device minimum [ 1119.381893][ T1584] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 1119.393878][ T1584] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 1119.405761][ T1584] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 1119.417072][ T1584] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 1119.429005][ T1584] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 1119.440271][ T1584] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 1119.451884][ T1584] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 1119.463169][ T1584] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 1119.562549][ T1589] tipc: Started in network mode [ 1119.586843][ T1589] tipc: Node identity 6a1e340c30c1, cluster identity 4711 [ 1119.624121][ T1589] tipc: Enabled bearer , priority 0 [ 1119.658515][ T1576] tipc: Resetting bearer [ 1119.693703][ T1592] syzkaller0: entered promiscuous mode [ 1119.732930][ T1592] syzkaller0: entered allmulticast mode [ 1119.756428][ T1603] netlink: 132 bytes leftover after parsing attributes in process `syz.0.6834'. [ 1119.767112][ T1570] tipc: Resetting bearer [ 1119.767898][ T1604] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6833'. [ 1119.827076][ T1570] tipc: Disabling bearer [ 1119.867913][ T1604] netlink: 256 bytes leftover after parsing attributes in process `syz.1.6833'. [ 1119.933529][ T1613] netlink: 212368 bytes leftover after parsing attributes in process `syz.0.6837'. [ 1119.997254][ T1616] netlink: 'syz.0.6837': attribute type 8 has an invalid length. [ 1120.039755][ T1613] can: request_module (can-proto-0) failed. [ 1120.095181][ T1621] syzkaller0: entered promiscuous mode [ 1120.108929][ T1621] syzkaller0: entered allmulticast mode [ 1120.147780][ T1624] tap0: tun_chr_ioctl cmd 1074025673 [ 1120.154615][ T1622] netlink: 96 bytes leftover after parsing attributes in process `syz.3.6839'. [ 1120.164107][ T1625] tap0: tun_chr_ioctl cmd 1074025681 [ 1120.182783][ T1624] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6840'. [ 1120.299092][ T1631] netlink: 132 bytes leftover after parsing attributes in process `syz.0.6842'. [ 1120.878420][ T1644] netlink: 132 bytes leftover after parsing attributes in process `syz.4.6847'. [ 1121.504472][ T1663] netlink: 'syz.3.6856': attribute type 30 has an invalid length. [ 1121.828166][ T1682] 8021q: adding VLAN 0 to HW filter on device bond2 [ 1121.872023][ T1682] 8021q: adding VLAN 0 to HW filter on device bond2 [ 1121.879527][ T1682] bond2: (slave ipip0): The slave device specified does not support setting the MAC address [ 1121.891849][ T1682] bond2: (slave ipip0): Error -95 calling set_mac_address [ 1122.691661][ T1694] lo speed is unknown, defaulting to 1000 [ 1123.647455][ T1745] Bluetooth: hci0: Opcode 0x0401 failed: -4 [ 1123.668627][ T1743] Bluetooth: hci0: Opcode 0x0401 failed: -4 [ 1124.327608][ T1782] 8021q: VLANs not supported on vcan0 [ 1124.431466][ T1784] netlink: 'syz.0.6893': attribute type 1 has an invalid length. [ 1124.455226][ T1786] netlink: 'syz.3.6894': attribute type 13 has an invalid length. [ 1124.491791][ T1784] bond3: entered promiscuous mode [ 1124.500111][ T1784] 8021q: adding VLAN 0 to HW filter on device bond3 [ 1124.516858][T30948] IPVS: starting estimator thread 0... [ 1124.610611][ T1796] IPVS: using max 32 ests per chain, 76800 per kthread [ 1124.778934][ T1784] 8021q: adding VLAN 0 to HW filter on device bond3 [ 1124.793994][ T1784] bond3: (slave ipip0): The slave device specified does not support setting the MAC address [ 1124.810243][ T1784] bond3: (slave ipip0): Setting fail_over_mac to active for active-backup mode [ 1124.842260][ T1784] bond3: (slave ipip0): making interface the new active one [ 1124.861921][ T1784] ipip0: entered promiscuous mode [ 1124.869128][ T1784] bond3: (slave ipip0): Enslaving as an active interface with an up link [ 1124.989192][ T1813] __nla_validate_parse: 10 callbacks suppressed [ 1124.989216][ T1813] netlink: 132 bytes leftover after parsing attributes in process `syz.1.6899'. [ 1125.085884][ T1815] netlink: 4 bytes leftover after parsing attributes in process `syz.3.6900'. [ 1125.153482][ T1817] netlink: 'syz.1.6901': attribute type 10 has an invalid length. [ 1125.259038][ T1817] 8021q: adding VLAN 0 to HW filter on device team0 [ 1125.288896][ T1817] bond0: (slave team0): Enslaving as an active interface with an up link [ 1125.547190][ T1830] netlink: 16 bytes leftover after parsing attributes in process `syz.1.6905'. [ 1125.561000][ T50] Bluetooth: hci0: command 0x0406 tx timeout [ 1125.611079][ T1843] IPVS: sync thread started: state = MASTER, mcast_ifn = macsec0, syncid = 134217731, id = 0 [ 1125.985305][ T1858] FAULT_INJECTION: forcing a failure. [ 1125.985305][ T1858] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1126.022176][ T1858] CPU: 1 UID: 0 PID: 1858 Comm: syz.1.6910 Not tainted syzkaller #0 PREEMPT(full) [ 1126.022207][ T1858] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1126.022221][ T1858] Call Trace: [ 1126.022230][ T1858] [ 1126.022240][ T1858] dump_stack_lvl+0xe8/0x150 [ 1126.022273][ T1858] should_fail_ex+0x412/0x560 [ 1126.022303][ T1858] _copy_from_user+0x2d/0xb0 [ 1126.022331][ T1858] csum_and_copy_from_iter_full+0x1e7/0x1f00 [ 1126.022366][ T1858] ? __alloc_frozen_pages_noprof+0x1de/0x380 [ 1126.022394][ T1858] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 1126.022431][ T1858] ? __pfx_csum_and_copy_from_iter_full+0x10/0x10 [ 1126.022475][ T1858] ip_generic_getfrag+0x149/0x2d0 [ 1126.022618][ T1858] ? __pfx_ip_generic_getfrag+0x10/0x10 [ 1126.022651][ T1858] ? skb_page_frag_refill+0x119/0x460 [ 1126.022691][ T1858] __ip_append_data+0x2328/0x3e40 [ 1126.022736][ T1858] ? __pfx_raw_getfrag+0x10/0x10 [ 1126.022839][ T1858] ? __pfx___ip_append_data+0x10/0x10 [ 1126.022873][ T1858] ? ipv4_mtu+0x53b/0x650 [ 1126.022920][ T1858] ? ipv4_mtu+0x23/0x650 [ 1126.022957][ T1858] ? __pfx_ipv4_mtu+0x10/0x10 [ 1126.022988][ T1858] ? ip_setup_cork+0x57e/0xa50 [ 1126.023022][ T1858] ip_append_data+0x10d/0x190 [ 1126.023059][ T1858] ? __pfx_raw_getfrag+0x10/0x10 [ 1126.023094][ T1858] raw_sendmsg+0x14be/0x1a50 [ 1126.023146][ T1858] ? __pfx_raw_sendmsg+0x10/0x10 [ 1126.023194][ T1858] ? aa_sk_perm+0x6d5/0x900 [ 1126.023236][ T1858] ? __pfx_aa_sk_perm+0x10/0x10 [ 1126.023262][ T1858] ? tomoyo_socket_sendmsg_permission+0x215/0x300 [ 1126.023327][ T1858] ? sock_rps_record_flow+0x19/0x350 [ 1126.023363][ T1858] ? inet_sendmsg+0x2f4/0x370 [ 1126.023392][ T1858] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1126.023426][ T1858] ____sys_sendmsg+0x80a/0x9f0 [ 1126.023460][ T1858] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1126.023497][ T1858] ? import_iovec+0x73/0xa0 [ 1126.023528][ T1858] ___sys_sendmsg+0x2a5/0x360 [ 1126.023551][ T1858] ? __lock_acquire+0x6b5/0x2cf0 [ 1126.023585][ T1858] ? __pfx____sys_sendmsg+0x10/0x10 [ 1126.023650][ T1858] ? __fget_files+0x2a/0x420 [ 1126.023676][ T1858] ? __fget_files+0x3a0/0x420 [ 1126.023713][ T1858] __x64_sys_sendmsg+0x1bd/0x2a0 [ 1126.023742][ T1858] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1126.023779][ T1858] ? __pfx_ksys_write+0x10/0x10 [ 1126.023821][ T1858] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1126.023845][ T1858] do_syscall_64+0x174/0x580 [ 1126.023872][ T1858] ? clear_bhb_loop+0x40/0x90 [ 1126.023899][ T1858] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1126.023920][ T1858] RIP: 0033:0x7f17fbb9ce59 [ 1126.023942][ T1858] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1126.023968][ T1858] RSP: 002b:00007f17fcaf2028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1126.023991][ T1858] RAX: ffffffffffffffda RBX: 00007f17fbe15fa0 RCX: 00007f17fbb9ce59 [ 1126.024007][ T1858] RDX: 0000000000000000 RSI: 0000200000001000 RDI: 0000000000000004 [ 1126.024019][ T1858] RBP: 00007f17fcaf2090 R08: 0000000000000000 R09: 0000000000000000 [ 1126.024032][ T1858] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1126.024044][ T1858] R13: 00007f17fbe16038 R14: 00007f17fbe15fa0 R15: 00007ffc272be248 [ 1126.024079][ T1858] [ 1126.521287][ T1861] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6912'. [ 1126.602048][ T1870] netlink: 152 bytes leftover after parsing attributes in process `syz.2.6913'. [ 1126.615667][ T1867] netlink: 232 bytes leftover after parsing attributes in process `syz.3.6914'. [ 1126.661032][ T1867] netlink: 4 bytes leftover after parsing attributes in process `syz.3.6914'. [ 1126.701538][ T1863] netlink: 12 bytes leftover after parsing attributes in process `syz.2.6913'. [ 1126.795141][ T1863] 8021q: adding VLAN 0 to HW filter on device bond4 [ 1126.807954][ T1870] bond4: (slave hsr0): The slave device specified does not support setting the MAC address [ 1126.839402][ T1870] hsr0: A HSR master's MTU cannot be greater than the smallest MTU of its slaves minus the HSR Tag length (6 octets). [ 1126.855300][ T1870] bond4: (slave hsr0): Error -22 calling dev_set_mtu [ 1126.903649][ T1869] 8021q: adding VLAN 0 to HW filter on device ipvlan2 [ 1127.255181][ T1899] netlink: 12 bytes leftover after parsing attributes in process `syz.2.6921'. [ 1127.598233][ T6110] netdevsim netdevsim2 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 1127.616419][ T6110] netdevsim netdevsim2 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1127.641993][ T50] Bluetooth: hci0: command 0x0406 tx timeout [ 1127.646573][ T6110] netdevsim netdevsim2 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1127.693791][ T6110] netdevsim netdevsim2 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1127.725257][ T1906] netlink: 16 bytes leftover after parsing attributes in process `syz.2.6922'. [ 1128.207036][ T1897] lo speed is unknown, defaulting to 1000 [ 1128.266347][ T1943] netlink: 'syz.3.6933': attribute type 6 has an invalid length. [ 1128.677582][ T1963] netlink: 'syz.4.6938': attribute type 1 has an invalid length. [ 1128.901152][ T1963] 8021q: adding VLAN 0 to HW filter on device bond3 [ 1128.969373][ T1968] bond3: (slave geneve2): making interface the new active one [ 1128.979412][ T1968] bond3: (slave geneve2): Enslaving as an active interface with an up link [ 1129.903183][ T2007] IPVS: set_ctl: invalid protocol: 364 172.30.0.3:20004 [ 1130.112149][ T2028] __nla_validate_parse: 13 callbacks suppressed [ 1130.112173][ T2028] netlink: 132 bytes leftover after parsing attributes in process `syz.4.6949'. [ 1130.376315][ T2037] netlink: 132 bytes leftover after parsing attributes in process `syz.4.6952'. [ 1134.430733][ T2041] workqueue: Failed to create a rescuer kthread for wq "bond3": -EINTR [ 1134.657252][ T2058] pim6reg1: entered promiscuous mode [ 1134.665392][ T2064] netlink: 44 bytes leftover after parsing attributes in process `syz.0.6956'. [ 1134.680275][ T2058] pim6reg1: entered allmulticast mode [ 1135.164309][ T2032] lo speed is unknown, defaulting to 1000 [ 1135.393082][ T2095] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6966'. [ 1135.434078][ T2099] netlink: 280 bytes leftover after parsing attributes in process `syz.0.6965'. [ 1135.479957][ T2099] netlink: 40 bytes leftover after parsing attributes in process `syz.0.6965'. [ 1135.947392][ T2118] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6972'. [ 1136.091407][ T2118] bond3: entered allmulticast mode [ 1136.162295][ T2120] ip6gretap0: entered allmulticast mode [ 1136.173034][ T2120] bond3: (slave ip6gretap0): Enslaving as an active interface with an up link [ 1136.213030][ T2129] xt_l2tp: missing protocol rule (udp|l2tpip) [ 1136.296710][ T2131] netlink: 28 bytes leftover after parsing attributes in process `syz.4.6976'. [ 1136.434802][T30952] lo speed is unknown, defaulting to 1000 [ 1136.611061][ T2102] lo speed is unknown, defaulting to 1000 [ 1136.715335][ T29] audit: type=1804 audit(1780758835.173:15): pid=2140 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.3.6978" name="/newroot/187/memory.events" dev="tmpfs" ino=970 res=1 errno=0 [ 1136.738342][ T29] audit: type=1800 audit(1780758835.173:16): pid=2140 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.6978" name="memory.events" dev="tmpfs" ino=970 res=0 errno=0 [ 1136.753748][ T2145] netlink: 32 bytes leftover after parsing attributes in process `syz.4.6979'. [ 1137.184580][ T2152] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6981'. [ 1137.358427][ T2157] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6983'. [ 1137.448673][ T2159] netlink: 132 bytes leftover after parsing attributes in process `syz.1.6984'. [ 1137.759230][ T2162] Bluetooth: MGMT ver 1.23 [ 1137.990007][ T2179] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6987'. [ 1138.323560][ T2193] netlink: 'syz.2.6993': attribute type 61 has an invalid length. [ 1139.800592][T19043] Bluetooth: hci2: command 0x0406 tx timeout [ 1139.803279][ T50] Bluetooth: hci2: Opcode 0x0401 failed: -110 [ 1156.326738][ T2207] __nla_validate_parse: 2 callbacks suppressed [ 1156.326761][ T2207] netlink: 132 bytes leftover after parsing attributes in process `syz.1.6995'. [ 1156.348321][ T2210] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6998'. [ 1156.769299][ T2230] netlink: 44 bytes leftover after parsing attributes in process `syz.2.7003'. [ 1156.798786][ T2238] bond4: option lacp_active: mode dependency failed, not supported in mode balance-alb(6) [ 1156.821910][ T2238] bond4 (unregistering): Released all slaves [ 1156.856856][ T2241] netlink: 'syz.4.7006': attribute type 1 has an invalid length. [ 1156.891336][ T2241] bond4: entered promiscuous mode [ 1156.896948][ T2241] 8021q: adding VLAN 0 to HW filter on device bond4 [ 1156.996071][ T2241] bond4: (slave bridge5): making interface the new active one [ 1157.035230][ T2241] bridge5: entered promiscuous mode [ 1157.048322][ T2241] bond4: (slave bridge5): Enslaving as an active interface with an up link [ 1157.219184][ T2253] netlink: 8 bytes leftover after parsing attributes in process `syz.2.7009'. [ 1157.233104][ T2255] netlink: 132 bytes leftover after parsing attributes in process `syz.4.7010'. [ 1157.462954][ T2261] net_ratelimit: 11 callbacks suppressed [ 1157.462978][ T2261] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 1158.075305][ T2284] netdevsim netdevsim4 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1158.101199][ T2284] netdevsim netdevsim4 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1158.346457][ T2289] bond4: option primary: mode dependency failed, not supported in mode balance-rr(0) [ 1158.352324][ T2294] netlink: 36 bytes leftover after parsing attributes in process `syz.2.7021'. [ 1158.368732][ T2289] bond4 (unregistering): Released all slaves [ 1158.408820][ T2284] netdevsim netdevsim4 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1158.425204][ T2295] netlink: 68 bytes leftover after parsing attributes in process `syz.2.7021'. [ 1158.442830][ T2284] netdevsim netdevsim4 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1158.612685][ T2267] lo speed is unknown, defaulting to 1000 [ 1158.629195][ T2284] netdevsim netdevsim4 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1158.670854][ T2284] netdevsim netdevsim4 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1158.936757][ T2284] netdevsim netdevsim4 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1158.946843][ T2284] netdevsim netdevsim4 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1159.059505][ T2279] lo speed is unknown, defaulting to 1000 [ 1159.314669][ T747] netdevsim netdevsim4 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 1159.327398][ T747] netdevsim netdevsim4 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1159.513121][ T2315] netlink: 'syz.0.7028': attribute type 1 has an invalid length. [ 1159.536370][ T747] netdevsim netdevsim4 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1159.545622][ T747] netdevsim netdevsim4 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1159.614155][ T2315] 8021q: adding VLAN 0 to HW filter on device bond4 [ 1159.627353][ T747] netdevsim netdevsim4 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1159.638544][ T747] netdevsim netdevsim4 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1159.686520][T13705] netdevsim netdevsim4 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1159.711403][T13705] netdevsim netdevsim4 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1160.016244][ T2328] openvswitch: netlink: Tunnel attr 3 has unexpected len 4 expected 1 [ 1160.031014][ T2328] openvswitch: netlink: Missing key (keys=40, expected=80) [ 1160.291947][ T2336] syzkaller0: entered promiscuous mode [ 1160.298713][ T2336] syzkaller0: entered allmulticast mode [ 1160.466675][ T2348] No such timeout policy "syz0" [ 1160.616065][ T2352] bridge0: port 1(bridge_slave_0) entered disabled state [ 1160.641932][ T2352] bridge0: port 2(bridge_slave_1) entered disabled state [ 1160.743123][ T2355] bridge0: port 1(bridge_slave_0) entered blocking state [ 1160.750548][ T2355] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1160.763270][ T2355] bridge0: port 2(bridge_slave_1) entered blocking state [ 1160.770532][ T2355] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1160.864211][ T2355] bond1: left promiscuous mode [ 1160.869301][ T2355] veth3: left promiscuous mode [ 1160.888831][ T2355] bond3: left promiscuous mode [ 1160.895178][ T2355] ipip0: left promiscuous mode [ 1160.925651][ T2358] netlink: 108 bytes leftover after parsing attributes in process `syz.1.7041'. [ 1161.053232][ T2361] netlink: 20 bytes leftover after parsing attributes in process `syz.0.7042'. [ 1161.377152][ T2371] netlink: 'syz.2.7043': attribute type 21 has an invalid length. [ 1161.403533][ T2373] netlink: 12 bytes leftover after parsing attributes in process `syz.1.7044'. [ 1161.412982][ T2371] netlink: 'syz.2.7043': attribute type 21 has an invalid length. [ 1161.421548][ T2373] netlink: 12 bytes leftover after parsing attributes in process `syz.1.7044'. [ 1161.475499][ T2371] netlink: 8 bytes leftover after parsing attributes in process `syz.2.7043'. [ 1161.508272][ T2371] netlink: 12 bytes leftover after parsing attributes in process `syz.2.7043'. [ 1161.540974][ T2371] netlink: 8 bytes leftover after parsing attributes in process `syz.2.7043'. [ 1161.560207][ T2371] netlink: 12 bytes leftover after parsing attributes in process `syz.2.7043'. [ 1161.632292][ T2387] netlink: 8 bytes leftover after parsing attributes in process `syz.3.7048'. [ 1161.694087][ T2391] netlink: 132 bytes leftover after parsing attributes in process `syz.2.7049'. [ 1162.270116][ T2411] netlink: 244 bytes leftover after parsing attributes in process `syz.1.7056'. [ 1162.669223][ T2430] IPVS: Scheduler module ip_vs_6 [ 1162.669223][ T2430]  not found [ 1162.900299][ T2444] netlink: 132 bytes leftover after parsing attributes in process `syz.1.7062'. [ 1163.073928][ T2449] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 1163.081260][ T2449] IPv6: NLM_F_CREATE should be set when creating new route [ 1163.177378][ T29] audit: type=1107 audit(1780758861.633:17): pid=2454 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa [ 1163.544773][ T2490] syzkaller0: entered promiscuous mode [ 1163.710605][ T2490] syzkaller0: entered allmulticast mode [ 1163.840433][ T2477] lo speed is unknown, defaulting to 1000 [ 1164.695177][ T2544] syzkaller0: entered promiscuous mode [ 1164.711266][ T2544] syzkaller0: entered allmulticast mode [ 1165.322518][ T2557] xt_socket: unknown flags 0x8 [ 1165.956377][ T2584] netlink: 'syz.0.7096': attribute type 1 has an invalid length. [ 1166.426339][ T2620] syzkaller0: entered promiscuous mode [ 1166.446217][ T2620] syzkaller0: entered allmulticast mode [ 1166.648322][ T2629] ip6gretap0: entered promiscuous mode [ 1166.858822][ T2645] FAULT_INJECTION: forcing a failure. [ 1166.858822][ T2645] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1166.883672][ T2645] CPU: 0 UID: 0 PID: 2645 Comm: syz.2.7108 Not tainted syzkaller #0 PREEMPT(full) [ 1166.883675][ T2634] __nla_validate_parse: 15 callbacks suppressed [ 1166.883703][ T2645] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1166.883717][ T2645] Call Trace: [ 1166.883726][ T2645] [ 1166.883725][ T2634] netlink: 12 bytes leftover after parsing attributes in process `syz.0.7105'. [ 1166.883737][ T2645] dump_stack_lvl+0xe8/0x150 [ 1166.883772][ T2645] should_fail_ex+0x412/0x560 [ 1166.883802][ T2645] _copy_from_user+0x2d/0xb0 [ 1166.883827][ T2645] ___sys_sendmsg+0x1c6/0x360 [ 1166.883853][ T2645] ? __lock_acquire+0x6b5/0x2cf0 [ 1166.883881][ T2645] ? __pfx____sys_sendmsg+0x10/0x10 [ 1166.883939][ T2645] ? __fget_files+0x2a/0x420 [ 1166.883964][ T2645] ? __fget_files+0x3a0/0x420 [ 1166.883997][ T2645] __x64_sys_sendmsg+0x1bd/0x2a0 [ 1166.884022][ T2645] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1166.884054][ T2645] ? __pfx_ksys_write+0x10/0x10 [ 1166.884090][ T2645] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1166.884113][ T2645] do_syscall_64+0x174/0x580 [ 1166.884137][ T2645] ? trace_irq_disable+0x3b/0x140 [ 1166.884166][ T2645] ? clear_bhb_loop+0x40/0x90 [ 1166.884195][ T2645] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1166.884214][ T2645] RIP: 0033:0x7ff06999ce59 [ 1166.884233][ T2645] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1166.884250][ T2645] RSP: 002b:00007ff06a91d028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1166.884272][ T2645] RAX: ffffffffffffffda RBX: 00007ff069c15fa0 RCX: 00007ff06999ce59 [ 1166.884286][ T2645] RDX: 0000000000000000 RSI: 0000200000000480 RDI: 0000000000000005 [ 1166.884299][ T2645] RBP: 00007ff06a91d090 R08: 0000000000000000 R09: 0000000000000000 [ 1166.884311][ T2645] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1166.884322][ T2645] R13: 00007ff069c16038 R14: 00007ff069c15fa0 R15: 00007ffd29a2ef08 [ 1166.884353][ T2645] [ 1167.101753][ T2635] netlink: 11562 bytes leftover after parsing attributes in process `syz.0.7105'. [ 1167.138129][ T2653] syzkaller0: entered promiscuous mode [ 1167.147675][ T2653] syzkaller0: entered allmulticast mode [ 1167.572161][ T2683] netlink: 'syz.0.7112': attribute type 2 has an invalid length. [ 1167.609398][ T2683] netlink: 'syz.0.7112': attribute type 2 has an invalid length. [ 1167.644635][ T2685] netlink: 4 bytes leftover after parsing attributes in process `syz.4.7114'. [ 1167.693037][ T2683] macsec1: entered promiscuous mode [ 1167.914655][ T2698] netlink: 56 bytes leftover after parsing attributes in process `syz.4.7116'. [ 1168.185353][ T2711] syzkaller0: entered promiscuous mode [ 1168.197331][ T2711] syzkaller0: entered allmulticast mode [ 1168.427950][ T2715] netlink: 8 bytes leftover after parsing attributes in process `syz.2.7118'. [ 1168.701154][ T2729] xt_hashlimit: overflow, try lower: 6/0 [ 1169.046106][ T2748] netlink: 'syz.2.7128': attribute type 1 has an invalid length. [ 1169.062976][ T2748] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1169.149334][ T2752] syzkaller0: entered promiscuous mode [ 1169.169964][ T2752] syzkaller0: entered allmulticast mode [ 1169.186804][ T2759] pimreg: entered allmulticast mode [ 1169.226737][ T2748] netlink: 4 bytes leftover after parsing attributes in process `syz.2.7128'. [ 1169.299218][ T2748] hsr_slave_1 (unregistering): left promiscuous mode [ 1169.471011][ T2769] netlink: 8 bytes leftover after parsing attributes in process `syz.1.7132'. [ 1169.500133][ T2769] netlink: 4 bytes leftover after parsing attributes in process `syz.1.7132'. [ 1169.520639][ T2769] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1169.610779][ T2769] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1169.807797][ T2760] lo speed is unknown, defaulting to 1000 [ 1170.546103][ T2803] netlink: 4 bytes leftover after parsing attributes in process `syz.0.7137'. [ 1170.606437][ T2804] netlink: 4 bytes leftover after parsing attributes in process `syz.0.7137'. [ 1170.635960][ T2758] lo speed is unknown, defaulting to 1000 [ 1171.212052][ T2820] netlink: zone id is out of range [ 1171.225124][ T2820] netlink: zone id is out of range [ 1171.237215][ T2820] netlink: zone id is out of range [ 1171.252075][ T2820] netlink: zone id is out of range [ 1171.272593][ T2820] netlink: zone id is out of range [ 1171.295377][ T2820] netlink: zone id is out of range [ 1171.303938][ T2820] netlink: zone id is out of range [ 1171.314370][ T2820] netlink: zone id is out of range [ 1171.319568][ T2820] netlink: zone id is out of range [ 1172.031555][ T2861] __nla_validate_parse: 2 callbacks suppressed [ 1172.031577][ T2861] netlink: 12 bytes leftover after parsing attributes in process `syz.2.7150'. [ 1172.074532][ T2862] netlink: 132 bytes leftover after parsing attributes in process `syz.4.7148'. [ 1172.190623][ T2866] netlink: 4 bytes leftover after parsing attributes in process `syz.1.7151'. [ 1172.448064][ T2881] netlink: 20 bytes leftover after parsing attributes in process `syz.1.7155'. [ 1172.475836][ T2878] netlink: 12 bytes leftover after parsing attributes in process `syz.0.7153'. [ 1172.528507][ T2888] netlink: 28 bytes leftover after parsing attributes in process `syz.0.7153'. [ 1172.701277][ T2878] 8021q: adding VLAN 0 to HW filter on device bond5 [ 1172.744345][ T2901] netlink: 12 bytes leftover after parsing attributes in process `syz.2.7158'. [ 1173.010254][ T2912] netlink: 4 bytes leftover after parsing attributes in process `syz.3.7165'. [ 1173.093373][ T2915] xt_SECMARK: mode already set to 1 cannot mix with rules for mode 4 [ 1173.376964][ T2934] netlink: 24 bytes leftover after parsing attributes in process `syz.0.7171'. [ 1173.474210][ T2934] xt_CT: You must specify a L4 protocol and not use inversions on it [ 1173.491191][ T2936] xt_CT: You must specify a L4 protocol and not use inversions on it [ 1173.500751][ T2938] netlink: 8 bytes leftover after parsing attributes in process `syz.3.7169'. [ 1173.841632][ T2908] lo speed is unknown, defaulting to 1000 [ 1174.764452][ T2978] dvmrp5: entered allmulticast mode [ 1175.313272][ T2995] syzkaller1: tun_chr_ioctl cmd 1074025677 [ 1175.333566][ T2995] syzkaller1: Refused to change device type [ 1175.660844][ T3016] xt_CT: You must specify a L4 protocol and not use inversions on it [ 1177.007251][ T3052] netlink: 'syz.1.7200': attribute type 4 has an invalid length. [ 1177.048368][ T3052] net_ratelimit: 168 callbacks suppressed [ 1177.048390][ T3052] batman_adv: batadv0: adding TT local entry aa:aa:aa:aa:aa:2a to non-existent VLAN 1303 [ 1177.267956][ T3031] syzkaller0: entered promiscuous mode [ 1177.284131][ T3031] syzkaller0: entered allmulticast mode [ 1178.093135][ T3097] __nla_validate_parse: 4 callbacks suppressed [ 1178.093157][ T3097] netlink: 24 bytes leftover after parsing attributes in process `syz.2.7214'. [ 1178.211637][ T3096] bond5: option tlb_dynamic_lb: invalid value (5) [ 1178.244571][ T3096] bond5 (unregistering): Released all slaves [ 1178.394855][ T3080] lo speed is unknown, defaulting to 1000 [ 1178.890794][ T3131] netlink: 232 bytes leftover after parsing attributes in process `syz.4.7224'. [ 1178.935360][ T3131] netlink: 4 bytes leftover after parsing attributes in process `syz.4.7224'. [ 1179.473850][ T3150] tipc: Enabled bearer , priority 0 [ 1179.527180][ T3152] batman_adv: batadv0: Interface deactivated: dummy0 [ 1179.531630][ T3147] netlink: 24 bytes leftover after parsing attributes in process `syz.3.7228'. [ 1179.573782][ T3152] batman_adv: batadv0: Removing interface: dummy0 [ 1179.601795][ T3150] netlink: 12 bytes leftover after parsing attributes in process `syz.3.7228'. [ 1179.734291][ T3146] tipc: Disabling bearer [ 1179.774674][ T3169] netlink: 14 bytes leftover after parsing attributes in process `syz.4.7232'. [ 1179.870918][ T3169] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1179.941277][ T3169] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1179.988933][ T3169] bond0 (unregistering): Released all slaves [ 1180.414591][ T3196] netlink: 8 bytes leftover after parsing attributes in process `syz.4.7236'. [ 1182.226055][ T3245] syzkaller0: entered promiscuous mode [ 1182.233888][ T3245] syzkaller0: entered allmulticast mode [ 1182.949636][ T3248] netlink: 36 bytes leftover after parsing attributes in process `syz.3.7246'. [ 1182.964307][ T3248] netlink: 24 bytes leftover after parsing attributes in process `syz.3.7246'. [ 1183.045229][ T3182] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1183.102783][ T3251] xt_hl: Unknown Hop Limit match mode: 206 [ 1183.155919][ T3252] xt_hl: Unknown Hop Limit match mode: 206 [ 1183.474814][ T3266] netlink: 12 bytes leftover after parsing attributes in process `syz.4.7253'. [ 1183.648767][ T3272] netlink: 'syz.0.7254': attribute type 1 has an invalid length. [ 1183.911724][ T3269] gretap1: entered promiscuous mode [ 1183.919948][ T3285] netlink: 72 bytes leftover after parsing attributes in process `syz.4.7259'. [ 1183.946788][ T3285] netlink: 12 bytes leftover after parsing attributes in process `syz.4.7259'. [ 1183.967055][ T3285] netlink: 4 bytes leftover after parsing attributes in process `syz.4.7259'. [ 1184.133178][ T3296] netlink: 12 bytes leftover after parsing attributes in process `syz.2.7262'. [ 1184.249141][ T3296] 8021q: adding VLAN 0 to HW filter on device bond5 [ 1184.442567][ T3309] netlink: 132 bytes leftover after parsing attributes in process `syz.4.7266'. [ 1184.648841][ T3323] netlink: 8 bytes leftover after parsing attributes in process `syz.2.7270'. [ 1184.677234][ T3323] netlink: 312 bytes leftover after parsing attributes in process `syz.2.7270'. [ 1184.705180][ T3326] netlink: 65039 bytes leftover after parsing attributes in process `syz.2.7270'. [ 1184.719972][ T3323] netlink: 8 bytes leftover after parsing attributes in process `syz.2.7270'. [ 1184.929265][ T3335] tap0: tun_chr_ioctl cmd 1074025677 [ 1184.935547][ T3335] tap0: linktype set to 768 [ 1184.952909][ T3335] netlink: 'syz.1.7276': attribute type 3 has an invalid length. [ 1185.872199][ T3361] blkio.reset_stats is deprecated [ 1186.165881][ T3367] A link change request failed with some changes committed already. Interface bond_slave_0 may have been left with an inconsistent configuration, please check. [ 1186.278614][ T3372] A: option downdelay: invalid value (18446744073709547007) [ 1186.300733][ T3372] A: option downdelay: allowed values 0 - 2147483647 [ 1186.311527][ T3372] A (unregistering): Released all slaves [ 1186.352832][ T3349] lo speed is unknown, defaulting to 1000 [ 1187.179776][ T3400] syzkaller0: entered promiscuous mode [ 1187.185879][ T3400] syzkaller0: entered allmulticast mode [ 1188.109502][ T3466] netlink: 'syz.4.7308': attribute type 1 has an invalid length. [ 1188.278292][ T3475] xfrm1: entered promiscuous mode [ 1188.314300][ T3475] xfrm1: entered allmulticast mode [ 1188.630286][ T3485] [ 1188.632704][ T3485] ====================================================== [ 1188.639768][ T3485] WARNING: possible circular locking dependency detected [ 1188.646880][ T3485] syzkaller #0 Not tainted [ 1188.651321][ T3485] ------------------------------------------------------ [ 1188.658482][ T3485] syz.1.7310/3485 is trying to acquire lock: [ 1188.664458][ T3485] ffff88802725b418 (&q->elevator_lock){+.+.}-{4:4}, at: elevator_change+0x1b3/0x450 [ 1188.673968][ T3485] [ 1188.673968][ T3485] but task is already holding lock: [ 1188.681336][ T3485] ffff88802725aef0 (&q->q_usage_counter(io)#56){++++}-{0:0}, at: elevator_change+0x198/0x450 [ 1188.691600][ T3485] [ 1188.691600][ T3485] which lock already depends on the new lock. [ 1188.691600][ T3485] [ 1188.702045][ T3485] [ 1188.702045][ T3485] the existing dependency chain (in reverse order) is: [ 1188.711055][ T3485] [ 1188.711055][ T3485] -> #6 (&q->q_usage_counter(io)#56){++++}-{0:0}: [ 1188.719728][ T3485] blk_alloc_queue+0x546/0x680 [ 1188.725171][ T3485] __blk_mq_alloc_disk+0x197/0x390 [ 1188.730967][ T3485] nbd_dev_add+0x499/0xb50 [ 1188.736001][ T3485] nbd_init+0x168/0x1f0 [ 1188.740767][ T3485] do_one_initcall+0x250/0x870 [ 1188.746062][ T3485] do_initcall_level+0x104/0x190 [ 1188.751559][ T3485] do_initcalls+0x59/0xa0 [ 1188.756414][ T3485] kernel_init_freeable+0x2a6/0x3e0 [ 1188.762137][ T3485] kernel_init+0x1d/0x1d0 [ 1188.767001][ T3485] ret_from_fork+0x514/0xb70 [ 1188.772136][ T3485] ret_from_fork_asm+0x1a/0x30 [ 1188.777430][ T3485] [ 1188.777430][ T3485] -> #5 (fs_reclaim){+.+.}-{0:0}: [ 1188.784651][ T3485] fs_reclaim_acquire+0x71/0x100 [ 1188.790127][ T3485] kmem_cache_alloc_node_noprof+0x4a/0x690 [ 1188.796463][ T3485] __alloc_skb+0x1d0/0x7d0 [ 1188.801401][ T3485] __ip6_append_data+0x2d3c/0x3f60 [ 1188.807107][ T3485] ip6_append_data+0x10f/0x280 [ 1188.812400][ T3485] rawv6_sendmsg+0x12d3/0x18e0 [ 1188.817790][ T3485] ____sys_sendmsg+0x80a/0x9f0 [ 1188.823081][ T3485] ___sys_sendmsg+0x2a5/0x360 [ 1188.828294][ T3485] __x64_sys_sendmsg+0x1bd/0x2a0 [ 1188.833761][ T3485] do_syscall_64+0x174/0x580 [ 1188.838879][ T3485] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1188.845300][ T3485] [ 1188.845300][ T3485] -> #4 (sk_lock-AF_INET6){+.+.}-{0:0}: [ 1188.853049][ T3485] lock_sock_nested+0x41/0x100 [ 1188.858348][ T3485] inet_shutdown+0x6a/0x390 [ 1188.863380][ T3485] nbd_mark_nsock_dead+0x2e9/0x560 [ 1188.869070][ T3485] recv_work+0x1c2e/0x1d40 [ 1188.874010][ T3485] process_scheduled_works+0xb5d/0x1860 [ 1188.880099][ T3485] worker_thread+0xa53/0xfc0 [ 1188.885216][ T3485] kthread+0x389/0x470 [ 1188.889818][ T3485] ret_from_fork+0x514/0xb70 [ 1188.894937][ T3485] ret_from_fork_asm+0x1a/0x30 [ 1188.901150][ T3485] [ 1188.901150][ T3485] -> #3 (&nsock->tx_lock){+.+.}-{4:4}: [ 1188.908854][ T3485] __mutex_lock+0x1a3/0x1550 [ 1188.913992][ T3485] nbd_queue_rq+0x37b/0x1100 [ 1188.919125][ T3485] blk_mq_dispatch_rq_list+0xa70/0x1910 [ 1188.925234][ T3485] __blk_mq_sched_dispatch_requests+0xdcc/0x1600 [ 1188.932177][ T3485] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 1188.938716][ T3485] blk_mq_run_hw_queue+0x348/0x4f0 [ 1188.944363][ T3485] blk_mq_dispatch_list+0xd16/0xe10 [ 1188.950103][ T3485] blk_mq_flush_plug_list+0x48d/0x570 [ 1188.956008][ T3485] __blk_flush_plug+0x3ed/0x4d0 [ 1188.961394][ T3485] __submit_bio+0x28d/0x580 [ 1188.966432][ T3485] submit_bio_noacct_nocheck+0x2f4/0xa40 [ 1188.972587][ T3485] block_read_full_folio+0x599/0x830 [ 1188.978418][ T3485] filemap_read_folio+0x137/0x3b0 [ 1188.983973][ T3485] do_read_cache_folio+0x358/0x590 [ 1188.989616][ T3485] read_part_sector+0xb6/0x2b0 [ 1188.994950][ T3485] adfspart_check_ICS+0xb1/0x960 [ 1189.000423][ T3485] bdev_disk_changed+0x817/0x1770 [ 1189.005976][ T3485] blkdev_get_whole+0x380/0x510 [ 1189.011401][ T3485] bdev_open+0x31e/0xd30 [ 1189.016170][ T3485] blkdev_open+0x470/0x610 [ 1189.021117][ T3485] do_dentry_open+0x822/0x13a0 [ 1189.026412][ T3485] vfs_open+0x3b/0x340 [ 1189.031004][ T3485] path_openat+0x2e08/0x3860 [ 1189.036126][ T3485] do_file_open+0x23e/0x4a0 [ 1189.041157][ T3485] do_sys_openat2+0x113/0x200 [ 1189.046361][ T3485] __x64_sys_openat+0x138/0x170 [ 1189.051746][ T3485] do_syscall_64+0x174/0x580 [ 1189.056862][ T3485] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1189.063288][ T3485] [ 1189.063288][ T3485] -> #2 (&cmd->lock){+.+.}-{4:4}: [ 1189.070522][ T3485] __mutex_lock+0x1a3/0x1550 [ 1189.075648][ T3485] nbd_queue_rq+0xc6/0x1100 [ 1189.080683][ T3485] blk_mq_dispatch_rq_list+0xa70/0x1910 [ 1189.086777][ T3485] __blk_mq_sched_dispatch_requests+0xdcc/0x1600 [ 1189.093640][ T3485] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 1189.100150][ T3485] blk_mq_run_hw_queue+0x348/0x4f0 [ 1189.105785][ T3485] blk_mq_dispatch_list+0xd16/0xe10 [ 1189.111532][ T3485] blk_mq_flush_plug_list+0x48d/0x570 [ 1189.117435][ T3485] __blk_flush_plug+0x3ed/0x4d0 [ 1189.122815][ T3485] __submit_bio+0x28d/0x580 [ 1189.127846][ T3485] submit_bio_noacct_nocheck+0x2f4/0xa40 [ 1189.134004][ T3485] block_read_full_folio+0x599/0x830 [ 1189.139818][ T3485] filemap_read_folio+0x137/0x3b0 [ 1189.145382][ T3485] do_read_cache_folio+0x358/0x590 [ 1189.151026][ T3485] read_part_sector+0xb6/0x2b0 [ 1189.156318][ T3485] adfspart_check_ICS+0xb1/0x960 [ 1189.161782][ T3485] bdev_disk_changed+0x817/0x1770 [ 1189.167339][ T3485] blkdev_get_whole+0x380/0x510 [ 1189.172717][ T3485] bdev_open+0x31e/0xd30 [ 1189.177491][ T3485] blkdev_open+0x470/0x610 [ 1189.182440][ T3485] do_dentry_open+0x822/0x13a0 [ 1189.187734][ T3485] vfs_open+0x3b/0x340 [ 1189.192327][ T3485] path_openat+0x2e08/0x3860 [ 1189.197454][ T3485] do_file_open+0x23e/0x4a0 [ 1189.202487][ T3485] do_sys_openat2+0x113/0x200 [ 1189.207688][ T3485] __x64_sys_openat+0x138/0x170 [ 1189.213065][ T3485] do_syscall_64+0x174/0x580 [ 1189.218180][ T3485] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1189.224596][ T3485] [ 1189.224596][ T3485] -> #1 (set->srcu){.+.+}-{0:0}: [ 1189.231730][ T3485] __synchronize_srcu+0xca/0x300 [ 1189.237191][ T3485] elevator_switch+0x1e8/0x7a0 [ 1189.242480][ T3485] elevator_change+0x2cc/0x450 [ 1189.247765][ T3485] elevator_set_default+0x36c/0x430 [ 1189.253498][ T3485] blk_register_queue+0x3e9/0x4e0 [ 1189.259049][ T3485] __add_disk+0x677/0xd50 [ 1189.263906][ T3485] add_disk_fwnode+0xfb/0x480 [ 1189.269114][ T3485] nbd_dev_add+0x72c/0xb50 [ 1189.274059][ T3485] nbd_init+0x168/0x1f0 [ 1189.278743][ T3485] do_one_initcall+0x250/0x870 [ 1189.284043][ T3485] do_initcall_level+0x104/0x190 [ 1189.289505][ T3485] do_initcalls+0x59/0xa0 [ 1189.294360][ T3485] kernel_init_freeable+0x2a6/0x3e0 [ 1189.300081][ T3485] kernel_init+0x1d/0x1d0 [ 1189.304937][ T3485] ret_from_fork+0x514/0xb70 [ 1189.310053][ T3485] ret_from_fork_asm+0x1a/0x30 [ 1189.315339][ T3485] [ 1189.315339][ T3485] -> #0 (&q->elevator_lock){+.+.}-{4:4}: [ 1189.323166][ T3485] __lock_acquire+0x15a5/0x2cf0 [ 1189.328545][ T3485] lock_acquire+0x106/0x350 [ 1189.333572][ T3485] __mutex_lock+0x1a3/0x1550 [ 1189.338689][ T3485] elevator_change+0x1b3/0x450 [ 1189.343982][ T3485] elevator_set_none+0xb5/0x140 [ 1189.349358][ T3485] blk_mq_update_nr_hw_queues+0x5e7/0x1a60 [ 1189.355714][ T3485] nbd_start_device+0x17f/0xb10 [ 1189.361095][ T3485] nbd_genl_connect+0x165b/0x1cf0 [ 1189.366648][ T3485] genl_family_rcv_msg_doit+0x22a/0x330 [ 1189.372725][ T3485] genl_rcv_msg+0x61c/0x7a0 [ 1189.377759][ T3485] netlink_rcv_skb+0x232/0x4b0 [ 1189.383050][ T3485] genl_rcv+0x28/0x40 [ 1189.387566][ T3485] netlink_unicast+0x75c/0x8e0 [ 1189.392850][ T3485] netlink_sendmsg+0x813/0xb40 [ 1189.398139][ T3485] ____sys_sendmsg+0x972/0x9f0 [ 1189.403451][ T3485] ___sys_sendmsg+0x2a5/0x360 [ 1189.408675][ T3485] __x64_sys_sendmsg+0x1bd/0x2a0 [ 1189.414156][ T3485] do_syscall_64+0x174/0x580 [ 1189.419283][ T3485] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1189.425708][ T3485] [ 1189.425708][ T3485] other info that might help us debug this: [ 1189.425708][ T3485] [ 1189.436025][ T3485] Chain exists of: [ 1189.436025][ T3485] &q->elevator_lock --> fs_reclaim --> &q->q_usage_counter(io)#56 [ 1189.436025][ T3485] [ 1189.449806][ T3485] Possible unsafe locking scenario: [ 1189.449806][ T3485] [ 1189.457320][ T3485] CPU0 CPU1 [ 1189.462759][ T3485] ---- ---- [ 1189.468167][ T3485] lock(&q->q_usage_counter(io)#56); [ 1189.473581][ T3485] lock(fs_reclaim); [ 1189.480092][ T3485] lock(&q->q_usage_counter(io)#56); [ 1189.487993][ T3485] lock(&q->elevator_lock); [ 1189.492590][ T3485] [ 1189.492590][ T3485] *** DEADLOCK *** [ 1189.492590][ T3485] [ 1189.500777][ T3485] 6 locks held by syz.1.7310/3485: [ 1189.505882][ T3485] #0: ffffffff8fe3a248 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 [ 1189.514135][ T3485] #1: ffffffff8fe3a080 (genl_mutex){+.+.}-{4:4}, at: genl_rcv_msg+0x10b/0x7a0 [ 1189.523394][ T3485] #2: ffff8880272611c0 (&set->update_nr_hwq_lock){++++}-{4:4}, at: blk_mq_update_nr_hw_queues+0xad/0x1a60 [ 1189.534823][ T3485] #3: ffff8880272610d0 (&set->tag_list_lock){+.+.}-{4:4}, at: blk_mq_update_nr_hw_queues+0xc0/0x1a60 [ 1189.545799][ T3485] #4: ffff88802725aef0 (&q->q_usage_counter(io)#56){++++}-{0:0}, at: elevator_change+0x198/0x450 [ 1189.556455][ T3485] #5: ffff88802725af28 (&q->q_usage_counter(queue)#40){+.+.}-{0:0}, at: elevator_change+0x198/0x450 [ 1189.567438][ T3485] [ 1189.567438][ T3485] stack backtrace: [ 1189.573345][ T3485] CPU: 1 UID: 0 PID: 3485 Comm: syz.1.7310 Not tainted syzkaller #0 PREEMPT(full) [ 1189.573369][ T3485] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1189.573380][ T3485] Call Trace: [ 1189.573389][ T3485] [ 1189.573399][ T3485] dump_stack_lvl+0xe8/0x150 [ 1189.573420][ T3485] print_circular_bug+0x2e1/0x300 [ 1189.573445][ T3485] check_noncircular+0x12e/0x150 [ 1189.573469][ T3485] __lock_acquire+0x15a5/0x2cf0 [ 1189.573497][ T3485] ? elevator_change+0x1b3/0x450 [ 1189.573515][ T3485] lock_acquire+0x106/0x350 [ 1189.573531][ T3485] ? elevator_change+0x1b3/0x450 [ 1189.573556][ T3485] __mutex_lock+0x1a3/0x1550 [ 1189.573575][ T3485] ? elevator_change+0x1b3/0x450 [ 1189.573595][ T3485] ? rcu_is_watching+0x15/0xb0 [ 1189.573617][ T3485] ? work_grab_pending+0x3d1/0x990 [ 1189.573636][ T3485] ? elevator_change+0x1b3/0x450 [ 1189.573655][ T3485] ? __pfx___mutex_lock+0x10/0x10 [ 1189.573673][ T3485] ? enable_work+0x17f/0x230 [ 1189.573692][ T3485] ? lockdep_hardirqs_on+0x7a/0x110 [ 1189.573713][ T3485] ? __cancel_work_sync+0xf7/0x110 [ 1189.573733][ T3485] ? blk_mq_cancel_work_sync+0xa5/0xe0 [ 1189.573762][ T3485] elevator_change+0x1b3/0x450 [ 1189.573784][ T3485] elevator_set_none+0xb5/0x140 [ 1189.573803][ T3485] ? __pfx_elevator_set_none+0x10/0x10 [ 1189.573824][ T3485] ? xa_load+0x1db/0x210 [ 1189.573846][ T3485] blk_mq_update_nr_hw_queues+0x5e7/0x1a60 [ 1189.573876][ T3485] ? kernfs_add_one+0x477/0x5c0 [ 1189.573901][ T3485] ? __pfx_blk_mq_update_nr_hw_queues+0x10/0x10 [ 1189.573929][ T3485] ? sysfs_add_file_mode_ns+0x259/0x300 [ 1189.573950][ T3485] nbd_start_device+0x17f/0xb10 [ 1189.573978][ T3485] ? device_create_file+0xf4/0x1b0 [ 1189.574076][ T3485] nbd_genl_connect+0x165b/0x1cf0 [ 1189.574100][ T3485] ? __pfx___nla_validate_parse+0x10/0x10 [ 1189.574125][ T3485] ? __pfx_nbd_genl_connect+0x10/0x10 [ 1189.574150][ T3485] ? rcu_is_watching+0x15/0xb0 [ 1189.574169][ T3485] ? trace_kmalloc+0x2a/0xf0 [ 1189.574195][ T3485] ? __nla_parse+0x40/0x60 [ 1189.574215][ T3485] ? genl_family_rcv_msg_attrs_parse+0x20b/0x2f0 [ 1189.574241][ T3485] ? genl_family_rcv_msg_attrs_parse+0x265/0x2f0 [ 1189.574269][ T3485] genl_family_rcv_msg_doit+0x22a/0x330 [ 1189.574296][ T3485] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 1189.574325][ T3485] ? __lock_acquire+0x6b5/0x2cf0 [ 1189.574346][ T3485] genl_rcv_msg+0x61c/0x7a0 [ 1189.574375][ T3485] ? __pfx_genl_rcv_msg+0x10/0x10 [ 1189.574398][ T3485] ? __pfx_nbd_genl_connect+0x10/0x10 [ 1189.574426][ T3485] netlink_rcv_skb+0x232/0x4b0 [ 1189.574445][ T3485] ? __pfx_genl_rcv_msg+0x10/0x10 [ 1189.574469][ T3485] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 1189.574493][ T3485] ? down_read+0x270/0x2e0 [ 1189.574532][ T3485] ? genl_rcv+0xd/0x40 [ 1189.574554][ T3485] genl_rcv+0x28/0x40 [ 1189.574576][ T3485] netlink_unicast+0x75c/0x8e0 [ 1189.574597][ T3485] netlink_sendmsg+0x813/0xb40 [ 1189.574620][ T3485] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1189.574641][ T3485] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1189.574668][ T3485] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1189.574693][ T3485] ____sys_sendmsg+0x972/0x9f0 [ 1189.574713][ T3485] ? __might_fault+0xaf/0x130 [ 1189.574738][ T3485] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1189.574765][ T3485] ? import_iovec+0x73/0xa0 [ 1189.574787][ T3485] ___sys_sendmsg+0x2a5/0x360 [ 1189.574805][ T3485] ? __lock_acquire+0x6b5/0x2cf0 [ 1189.574823][ T3485] ? __pfx____sys_sendmsg+0x10/0x10 [ 1189.574845][ T3485] ? futex_wake+0x4ac/0x580 [ 1189.574889][ T3485] ? __fget_files+0x2a/0x420 [ 1189.574908][ T3485] ? __fget_files+0x3a0/0x420 [ 1189.574932][ T3485] __x64_sys_sendmsg+0x1bd/0x2a0 [ 1189.574952][ T3485] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1189.574975][ T3485] ? rcu_is_watching+0x15/0xb0 [ 1189.574997][ T3485] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1189.575015][ T3485] do_syscall_64+0x174/0x580 [ 1189.575033][ T3485] ? trace_irq_disable+0x3b/0x140 [ 1189.575058][ T3485] ? clear_bhb_loop+0x40/0x90 [ 1189.575076][ T3485] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1189.575093][ T3485] RIP: 0033:0x7f17fbb9ce59 [ 1189.575110][ T3485] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1189.575126][ T3485] RSP: 002b:00007f17fcad1028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1189.575144][ T3485] RAX: ffffffffffffffda RBX: 00007f17fbe16090 RCX: 00007f17fbb9ce59 [ 1189.575157][ T3485] RDX: 0000000000000004 RSI: 0000200000001ac0 RDI: 0000000000000006 [ 1189.575168][ T3485] RBP: 00007f17fbc32d6f R08: 0000000000000000 R09: 0000000000000000 [ 1189.575179][ T3485] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1189.575189][ T3485] R13: 00007f17fbe16128 R14: 00007f17fbe16090 R15: 00007ffc272be248 [ 1189.575209][ T3485] [ 1190.101125][T19043] block nbd7: Receive control failed (result -32) [ 1190.107729][ T50] block nbd7: Receive control failed (result -32)