last executing test programs: 8.266600576s ago: executing program 3 (id=5633): ioctl$XFS_IOC_PATH_TO_HANDLE(0xffffffffffffffff, 0xc0385869, &(0x7f0000000240)={0xffffffffffffffff, &(0x7f0000000000)='#&\x00', 0x80, &(0x7f0000000040)={@align=0xd, {0x2, 0x6, 0x34e, 0x3ff}}, 0x10, &(0x7f0000000080)={@_ha_fsid}, &(0x7f0000000180)=0x7}) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0x20, &(0x7f0000000380)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x8}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [@kfunc={0x85, 0x0, 0x2, 0x0, 0x2}, @generic={0x3, 0x2, 0x3, 0x8, 0x4}, @map_idx_val={0x18, 0x4, 0x6, 0x0, 0xd}, @snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x1f8}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r0}}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f00000001c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, @xdp=0x25, r0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff}, 0x94) ioctl$XFS_IOC_PATH_TO_HANDLE(0xffffffffffffffff, 0xc0385869, &(0x7f0000000240)={0xffffffffffffffff, &(0x7f0000000000)='#&\x00', 0x80, &(0x7f0000000040)={@align=0xd, {0x2, 0x6, 0x34e, 0x3ff}}, 0x10, &(0x7f0000000080)={@_ha_fsid}, &(0x7f0000000180)=0x7}) (async) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0x20, &(0x7f0000000380)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x8}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [@kfunc={0x85, 0x0, 0x2, 0x0, 0x2}, @generic={0x3, 0x2, 0x3, 0x8, 0x4}, @map_idx_val={0x18, 0x4, 0x6, 0x0, 0xd}, @snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x1f8}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r0}}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f00000001c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, @xdp=0x25, r0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff}, 0x94) (async) 8.190753324s ago: executing program 3 (id=5634): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) setsockopt$inet_int(0xffffffffffffffff, 0x0, 0x12, &(0x7f0000000140)=0x9, 0x4) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000400)={&(0x7f00000005c0)=@newqdisc={0x24, 0x24, 0x8, 0xffffffff, 0x0, {0x0, 0x0, 0x0, 0x0, {0x0, 0xfff2}, {}, {0xfff2, 0xc}}}, 0x24}, 0x1, 0x0, 0x0, 0x40000}, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup/syz1\x00', 0x200002, 0x0) r3 = openat$cgroup_type(r2, &(0x7f0000000300), 0x2, 0x0) write$cgroup_type(r3, 0x0, 0x0) r4 = openat$cgroup_procs(r2, &(0x7f00000002c0)='cgroup.threads\x00', 0x2, 0x0) socket$inet6_sctp(0xa, 0x1, 0x84) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) openat$cgroup(r5, &(0x7f00000000c0)='syz0\x00', 0x200002, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01020000000000000000010000000900010073797a300000000058000000160a01000000000000000000010000000900010073797a30000000000900020073797a31000000002c0003800800013fec0000000800024000000004180003801400010070696d3672656731000000000000000048000000160a0101000b00000000000001000000090000000900010073797aed1b59be001c000380180003801400018fabcf4c89690070696d36726567310000000000000000140000001000010000000000000000000000000a0000000000000000"], 0xe8}, 0x1, 0x0, 0x0, 0x40000}, 0x0) write$cgroup_pid(r4, &(0x7f0000000080), 0x12) r7 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) connect$llc(r7, &(0x7f00000001c0)={0x1a, 0x0, 0x0, 0x8, 0x0, 0x0, @dev}, 0x10) r8 = openat$cgroup_ro(r5, &(0x7f0000000040)='cgroup.freeze\x00', 0x275a, 0x0) r9 = bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0x16, 0x3, &(0x7f0000000840)=ANY=[@ANYBLOB="1800000008000000000000000000000095"], &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @flow_dissector, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r9, 0x0, 0xe, 0x0, &(0x7f0000000280)="db759469e36512be2770717f865d", 0x0, 0x8, 0x0, 0x0, 0x21, 0x0, &(0x7f0000000900)="ffffdd014376ea94fe6f22446ab33726e5de05640000000000006929a72cd24065"}, 0x3a) write$cgroup_int(r8, &(0x7f0000000200)=0x1, 0x12) bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) socket$netlink(0x10, 0x3, 0x1) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, 0x0, 0x0) r10 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r10, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000009c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01020000000000000000010000000900010073797a300000000040000000160a01000900000000000000010000000900010073797a30000000000900020073797a3000000000140003800800014000000000080002400000000048000000160a0101000b000000000000010000000900020073797a30000000000900010073797a30000000001c00038018000380140002"], 0xd0}, 0x1, 0x0, 0x0, 0x24040841}, 0x0) write$tun(r8, &(0x7f0000001280)=ANY=[@ANYBLOB="000086dd0000110005000000a60c6b63851e0f9806", @ANYRES32=0x41424344], 0xfce) 3.79446071s ago: executing program 3 (id=5666): r0 = socket$nl_route(0x10, 0x3, 0x0) (async) r1 = socket$inet6(0xa, 0x2, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB='\v\x00\x00\x00\b\x00\x00\x00\f\x00', @ANYRES32=0x1, @ANYBLOB='@\x00'], 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000000c0), &(0x7f0000000140), 0x5, r2}, 0x38) (async) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000140)={r2, &(0x7f00000001c0), &(0x7f0000000180)=""/10, 0x2}, 0x20) (async) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'virt_wifi0\x00', 0x0}) setsockopt$inet6_mreq(r1, 0x29, 0x1b, &(0x7f0000000000)={@remote, r3}, 0x14) (async) r4 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) recvmmsg(r4, &(0x7f0000000fc0)=[{{&(0x7f00000003c0)=@generic, 0x80, &(0x7f0000000080)=[{&(0x7f0000000c80)=""/210, 0xd2}, {&(0x7f0000000540)=""/162, 0xa2}, {&(0x7f0000000600)=""/77, 0x4d}], 0x3, &(0x7f0000000680)=""/224, 0xe0}, 0x6}, {{&(0x7f0000000780)=@isdn, 0x80, &(0x7f0000000800)=[{&(0x7f0000001240)=""/4096, 0x1000}, {&(0x7f0000000240)=""/64, 0x40}], 0x2}}, {{&(0x7f0000000b80)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @initdev}}}, 0x80, &(0x7f0000000840)=[{&(0x7f0000000980)=""/225, 0xe1}, {&(0x7f0000000c00)=""/87, 0x57}, {&(0x7f0000000a80)=""/209, 0xd1}], 0x3, &(0x7f0000000ec0)=""/195, 0xc3}, 0x81}], 0x3, 0x40012061, 0x0) bind$nfc_llcp(r4, &(0x7f0000000280)={0x27, 0x0, 0x1, 0x5, 0x0, 0x6, "23ba4cb148e27a62778ab6e2ad47e2f096dbae5488d838161da26752700a993a9898b753acbbe03034a8e6487bac34f3e95e88aaaafc3788337701a4cd90bb", 0x21}, 0x60) (async) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)=ANY=[@ANYBLOB="240000000000090702000000000000800705", @ANYRES32, @ANYBLOB="0c000180060002000f000000"], 0x24}, 0x1, 0x5502000000000000}, 0x4000) (async) sendmsg$nl_route_sched(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000880)=@delqdisc={0x88, 0x25, 0x201, 0x70bd27, 0x25dfdbfb, {0x0, 0x0, 0x0, r3, {0x2, 0x6}, {0x9, 0xf}, {0xf, 0x9}}, [@TCA_STAB={0x5c, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0xff, 0x2, 0x44f, 0x8, 0x3f01ba347e3cb803, 0x2002, 0x48, 0x2}}, {0x8, 0x2, [0x8, 0x6]}}, {{0x1c, 0x1, {0x2, 0x4, 0x5f4, 0x8000, 0x1, 0x6, 0x2, 0x9}}, {0x16, 0x2, [0x2, 0x1, 0x3, 0x2a1a, 0x2, 0x10, 0x6, 0xf77b, 0x2]}}]}, @TCA_INGRESS_BLOCK={0x8, 0xd, 0x7}]}, 0x88}, 0x1, 0xf0ffffffffffff, 0x0, 0x1c005}, 0x24048004) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) (async) r5 = socket$inet_udp(0x2, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) (async) bind$inet(r5, 0x0, 0x0) (async) socket$nl_xfrm(0x10, 0x3, 0x6) (async) sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x0) (async) bind$inet(0xffffffffffffffff, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x13}}, 0x10) (async) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000380)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r6, {0x0, 0x7}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_qfg={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40004}, 0x0) (async) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000940)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000340)={&(0x7f00000001c0)=@getqdisc={0x3c, 0x26, 0x2, 0x70bd29, 0x25dfdbfb, {0x0, 0x0, 0x0, r6, {0x7, 0x7}, {0xfff1, 0x4}, {0xffff, 0xfff1}}, [{0x4}, {0x4}, {0x4}, {0x4}, {0x4}, {0x4}]}, 0x3c}, 0x1, 0x0, 0x0, 0x40080}, 0x20001000) (async) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, 0x0, 0x0) (async) r7 = socket$inet6_sctp(0xa, 0x801, 0x84) sendmmsg$inet6(r7, &(0x7f00000023c0)=[{{&(0x7f0000000300)={0xa, 0x4e21, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0xa}, 0x1c, &(0x7f0000000000)=[{&(0x7f00000002c0)='G', 0x1}], 0x1}}, {{&(0x7f00000004c0)={0xa, 0x4e21, 0x7, @private1={0xfc, 0x1, '\x00', 0x1}}, 0x1c, &(0x7f0000000500)=[{&(0x7f0000001300)="1f", 0x1}], 0x1}}], 0x2, 0x880) (async) shutdown(r7, 0x1) (async) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r7, 0x84, 0x75, &(0x7f0000000380)={0x0, 0xfff}, 0x8) (async) r8 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r8, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="ec00000021000100feffffff000000000000000000000000000000000000000000000000007c0000000000000000000000000000000000001700a00000000000", @ANYRES32, @ANYRES32=0x0, @ANYBLOB="00000000000000009c00110000000000000000000000000000000000fe8000000000000000000000000000bbac14142100000000000000000000000020010000000000000000000000000000000200000000000000000a0000000000000000000000000000000000fe8000000000000000000000000000bb"], 0xec}}, 0x0) (async) socket(0x2b, 0x80801, 0x1) 2.874096883s ago: executing program 3 (id=5677): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ieee802154(&(0x7f00000002c0), r0) sendmsg$IEEE802154_LLSEC_SETPARAMS(r0, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000004c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="01002cbd7000ff4dc2b2ab70d9dbdf252500", @ANYRES32=0x0, @ANYBLOB], 0x1c}, 0x1, 0x0, 0x0, 0x8080}, 0x20008090) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000440)=@newlink={0x68, 0x10, 0xffffffffffffffff, 0x70bd2b, 0x25dfdbbb, {0x0, 0x0, 0x0, 0x0, 0x50a10, 0x51a23}, [@IFLA_LINKINFO={0x48, 0x12, 0x0, 0x1, @ip6erspan={{0xe}, {0x34, 0x2, 0x0, 0x1, [@IFLA_GRE_OFLAGS={0x6, 0x3, 0x30}, @IFLA_GRE_REMOTE={0x14, 0x7, @private2}, @IFLA_GRE_LOCAL={0x14, 0x6, @private2={0xfc, 0x2, '\x00', 0x1}}]}}}]}, 0x68}, 0x1, 0x20000, 0x0, 0x240440d5}, 0x9080) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000e00), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000e40)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_GET_SCAN(r2, &(0x7f0000000f00)={0x0, 0x0, &(0x7f0000000ec0)={&(0x7f0000000000)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r4, @ANYBLOB="210f00000000fedbdf25200000000800", @ANYRES32=r5], 0x1c}, 0x1, 0x0, 0x0, 0x48010}, 0x200000000000000) 2.563805381s ago: executing program 4 (id=5679): r0 = socket$packet(0x11, 0x3, 0x300) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000004c0)=ANY=[@ANYBLOB="240000001e00010000000000000000000000000601000000000000000800010000000000"], 0x24}}, 0x0) setsockopt$packet_rx_ring(r0, 0x107, 0x5, &(0x7f0000000040)=@req3={0x1000, 0x3a, 0x1000, 0x3a, 0x770, 0x0, 0xbabd}, 0x1c) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000700)=@base={0xe, 0x4, 0x4, 0x2, 0x0, 0x1}, 0x50) socket$inet6_sctp(0xa, 0x5, 0x84) socket$nl_netfilter(0x10, 0x3, 0xc) openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0x42000, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket(0x10, 0x803, 0x0) socket$nl_route(0x10, 0x3, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="1b00000000000000000000000080", @ANYBLOB], 0x50) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x19, 0x4, 0x4, 0x2, 0x0, 0x1, 0xfffffffc}, 0x50) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0x14, &(0x7f00000001c0)=ANY=[@ANYBLOB="18000000000100000000000000000000180100002020782500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000007000000850000000600000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000fcffffff7b8af8ff00000000bca2000000000000a6020000f8ffffffb703000018000000b704000000000000850000003300000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x38, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000003c0)={{r3}, &(0x7f0000000340), &(0x7f0000000380)=r4}, 0x20) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000b80)={r4, 0x2000012, 0xb90, 0x0, &(0x7f0000000c40)="63eced8e46dc3f2ddf33c9e9b986", 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xb}, 0x50) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xd, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000000010100000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bca2000000000000a6020000f8ffffffb703000008000000b7040000000000008500000033000000850000000700000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback=0xa, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc641}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000b80)={r5, 0x2000012, 0xe, 0x0, &(0x7f0000000080)="63eced8e46dc3f2ddf33c9e9b986", 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xb}, 0x50) socket$packet(0x11, 0x3, 0x300) r6 = socket$inet6_sctp(0xa, 0x1, 0x84) shutdown(r6, 0x1) r7 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000040)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], &(0x7f00000002c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x44, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffdf0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r7, 0x5, 0xb68, 0x560b0000, &(0x7f0000000000)="259a53f271a76d2673004c6588a8", 0x0, 0xd01, 0x2a0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) 2.546082079s ago: executing program 2 (id=5680): socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r2, 0x0, 0x6, 0xd) (async, rerun: 64) close(r1) (rerun: 64) write(r0, 0x0, 0x0) (async) mmap(&(0x7f00009fd000/0x600000)=nil, 0x600000, 0x100000d, 0x6031, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x3000007, 0x31, r2, 0x0) (async) r3 = socket$inet6_mptcp(0xa, 0x1, 0x106) getsockopt$inet_mptcp_buf(r3, 0x11c, 0x4, &(0x7f0000001280)=""/247, &(0x7f0000000200)=0xf7) (async) socket$kcm(0x29, 0x0, 0x0) 2.481143642s ago: executing program 3 (id=5681): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240), 0x50) r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) r2 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="1b00000000000000000000000000040000000000", @ANYRES32=0x0, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000000000000000001784c21fbbf504bae7006eb08cce65e873a08d2833920502cf3892ed35c9240d2569500447ebc90f345cc63e8fa9d9f34e0ababa1414657fd218957c89faec550283d29353fd52c39479357b8940abed2e801c0fad72d61f493615f26feaa1177036a3a884c61f2c1b327acbc7bececdcca9766f289e95bddf556efd9fc699c89cd7e63c0d2236e17007d8588232d085e3cf147b5f5149978aa459468e3eda2949ffddef93bdb78dc7fd1ff510aa5c37d2d643f1827a49a0d6d87d10ce8fd97a655cfcd828"], 0x50) r3 = socket(0x10, 0x803, 0x0) r4 = syz_genetlink_get_family_id$devlink(&(0x7f0000000500), r3) r5 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt(r5, 0x84, 0x81, &(0x7f0000000280)="1a00000002000000", 0x8) setsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r5, 0x84, 0x18, &(0x7f0000000300), 0x8) sendmsg$DEVLINK_CMD_TRAP_GET(r3, &(0x7f0000000680)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000640)={&(0x7f00000005c0)={0x4c, r4, 0x100, 0x70bd29, 0x25dfdbff, {}, [{@pci={{0x8}, {0x11}}, {0x1c}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x2884}, 0x85) sendmsg$IPVS_CMD_SET_INFO(r3, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000c80)={0x28, 0x12, 0x1, 0x70bd25, 0x0, "", [@nested={0x10, 0x0, 0x0, 0x0, [@typed={0xc, 0x135, 0x0, 0x0, @u64}]}, @nested={0x8, 0x31, 0x0, 0x1, [@nested={0x4, 0xd5}]}]}, 0x28}], 0x1}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r7, @ANYBLOB="01000000000000001c0012000c000100626f6e64"], 0x3c}}, 0x0) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r8, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000540)={&(0x7f00000003c0)=@newlink={0x3c, 0x10, 0xff05, 0x0, 0xfffffff5, {0x0, 0x0, 0x4a00, 0x0, 0x2844a}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bond={{0x9}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r7}]}, 0x3c}}, 0x0) sendmsg$nl_route_sched(r8, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000e80)=@deltaction={0x114, 0x31, 0x200, 0x70bd2b, 0x25dfdbff, {}, [@TCA_ACT_TAB={0x40, 0x1, [{0x10, 0x19, 0x0, 0x0, @TCA_ACT_KIND={0x9, 0x1, 'vlan\x00'}}, {0xc, 0x1e, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x4}}, {0x14, 0x17, 0x0, 0x0, @TCA_ACT_KIND={0xf, 0x1, 'tunnel_key\x00'}}, {0xc, 0xd, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'nat\x00'}}]}, @TCA_ACT_TAB={0x7c, 0x1, [{0xc, 0xe, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x75f}}, {0xc, 0xe, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'ipt\x00'}}, {0xc, 0xe, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x7fffffff}}, {0xc, 0x1e, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0xfffffe00}}, {0xc, 0x16, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'ipt\x00'}}, {0xc, 0x1c, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x6}}, {0x14, 0x4, 0x0, 0x0, @TCA_ACT_KIND={0xf, 0x1, 'tunnel_key\x00'}}, {0x10, 0x1b, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'sample\x00'}}, {0xc, 0xc, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x1}}]}, @TCA_ACT_TAB={0x24, 0x1, [{0x10, 0x9, 0x0, 0x0, @TCA_ACT_KIND={0x9, 0x1, 'csum\x00'}}, {0x10, 0x10, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'police\x00'}}]}, @TCA_ACT_TAB={0x20, 0x1, [{0x10, 0x8, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'sample\x00'}}, {0xc, 0x2, 0x0, 0x0, @TCA_ACT_INDEX={0x8}}]}]}, 0x114}}, 0x0) r9 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x11, 0x10, &(0x7f00000000c0)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1}, {{0x18, 0x1, 0x1, 0x0, r2}}, {}, [@alu={0x7, 0x0, 0x7, 0x9, 0x0, 0x0, 0xfffffffffffffffc}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x3}, {0x85, 0x0, 0x0, 0xc6}}}, &(0x7f0000000080)='GPL\x00', 0x8, 0x0, 0x0, 0x41100, 0x5, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x1}, 0x94) r10 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r10, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001680)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x40001}, 0x4040850) r11 = socket$alg(0x26, 0x5, 0x0) setsockopt$ALG_SET_KEY(r11, 0x117, 0x1, &(0x7f0000000400)="9da73cb5faaa4da71a3f2854075366d8f243d3fe30ad65dbde5014f748401a8a6ec53b90c37f3f8a85ce04864304a93b708e38fdd85f2d2e0b6002d6d038b6f0935fc456c7b7ef69e85b8855bf212e8390cbb8b55bc60c4c7f1bda63cb5fb0cfb1fb97f52d21dfb7e2b233791a249ecb8f557e7e7f26e7f4fa850e6b8111d9531771512473c170bf591f44b33219bf3b3235cca486e04b73f3db04cc28fcbb5e5350b15dea4eb1a92395ed2cbe01ddf8873d16c1c21d7858443350f04646cb0748b03aae8ab8983cb47e58bd2a582b266050286106692ce50ca4da8c281e880fb95e7f2554c3a496a2c27514272eecd2e2114c134dc4c8e51ffe093202d6", 0xfe) sendmsg$NFT_BATCH(r10, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a48000000030a0fdb00000000000000000a0000050900030073797a30000000000900010073797a310000000014000480080002403cb140bb0800014000000003080005400000000014000000110001"], 0x70}, 0x1, 0x0, 0x0, 0x4000850}, 0x24000840) sendmsg$NFT_BATCH(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000780)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x3}}, [@NFT_MSG_NEWOBJ={0x20, 0x12, 0xa, 0x301, 0x0, 0x0, {0x7, 0x0, 0x1}, @NFT_OBJECT_CT_TIMEOUT=@NFTA_OBJ_HANDLE={0xc, 0x6, 0x1, 0x0, 0x3}}, @NFT_MSG_DELTABLE={0x14, 0x2, 0xa, 0x201, 0x0, 0x0, {0x7, 0x0, 0x5}}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x7}}}, 0x5c}, 0x1, 0x0, 0x0, 0xb0}, 0x20008890) bpf$OBJ_PIN_PROG(0x6, &(0x7f0000000700)=@generic={&(0x7f0000000580)='./file0\x00', r9}, 0x18) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x18, 0x1c, &(0x7f0000000d80)=ANY=[@ANYBLOB="1808000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000005000000bf0900000000000055090100000000009500000000000000b7020000000000007b9a18fe00000000b6090800400000007b9af0ff00000000bf8610000000000007080000f8ffffffbfa400000000000007040000f0ffffffb70200190800000018280000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7050000080000001500000076000000bf980000000000005608f0ff0000000085000000b4000000b7000000000000009500000000000000"], &(0x7f0000000980)='GPL\x00', 0x2, 0x0, 0x0, 0x0, 0x9, '\x00', 0x0, @fallback=0xd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 2.360697069s ago: executing program 2 (id=5682): r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_BEACON(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)={0x48, r0, 0x1, 0x70bd2c, 0x25dfdbfe, {{}, {@void, @void}}}, 0x48}}, 0xb0b6961456b96b1f) (async) r1 = socket(0xa, 0x3, 0x3a) setsockopt$MRT6_ADD_MFC_PROXY(r1, 0x29, 0xcd, &(0x7f00000000c0)={{0xa, 0x2, 0x0, @local}, {0xa, 0x0, 0x0, @private2={0xfc, 0x2, '\x00', 0x1}}}, 0x5c) unshare(0x6e000000) (async) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="5800000002060102000034e40000000004000008050005000a000000050001000600000005000400000000000900020073797a310000000011000300686173683a69702c706f72740000"], 0x58}, 0x1, 0x0, 0x0, 0x81}, 0x0) (async, rerun: 32) r3 = socket$alg(0x26, 0x5, 0x0) (rerun: 32) bind$alg(r3, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(des3_ede)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) (async, rerun: 64) r4 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000700)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1}, 0x48) (rerun: 64) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000f40)={r4, &(0x7f0000000200), 0x0}, 0x20) (async) r5 = accept4(r3, 0x0, 0x0, 0x0) sendmmsg$alg(r5, &(0x7f0000000400)=[{0x0, 0x0, 0x0}], 0x1, 0x0) (async) recvmsg(r5, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x51}], 0x1}, 0x20000253) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) (async) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="19000000040000000400"], 0x48) close(0x3) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="0e000000040000000400000009"], 0x48) (async, rerun: 32) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x6, 0xd, &(0x7f00000001c0)=ANY=[@ANYBLOB="1800000000010000000000000000000018110000", @ANYRES32=r6], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x1, '\x00', 0x0, @xdp=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (rerun: 32) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000b80)={r7, 0x2000012, 0xe, 0x0, &(0x7f0000000c40)="63eced8e46dc3f2ddf33c9e9b986", 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xb}, 0x50) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0xc800) (async) syz_genetlink_get_family_id$wireguard(0x0, 0xffffffffffffffff) (async, rerun: 32) socket$nl_crypto(0x10, 0x3, 0x15) (async, rerun: 32) ioctl$F2FS_IOC_GARBAGE_COLLECT_RANGE(r1, 0x4018f50b, &(0x7f0000000300)={0x0, 0x5920, 0xb3}) (async) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) (async) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, 0x0) (async) sendmsg$IPSET_CMD_ADD(r8, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000003c0)=ANY=[@ANYBLOB="5c000000090601020000000000000000020000000900020073797a31000000000500010007000000340007801800018014000240fe8000000000000000000000000000bb06000440000400000500070006000000060005404e220000b9e5c3cba737bc4e4031bf38ca209bcdda31ae1ccb24061c31dff21c868cc1572599768c7708e4abda73e2fe207bba076b45360b7f97141f0c977481a213ff4b6a88437c4845694fce2538d8b1f518d313f72af1913a432a6479df0af6ae35f6d42f9530d9e799ec3842971fffd0198f592a9c8653012269e78cbc59eb1fee6717027ea3cf92a5f92afb0a22b4baa2009341b8dcf331181468b6b5ae40b5d7f478c8ec250df516879d295d6d86816b96ff02d8cd031362054cc4da9e8b198e4587758cd5a4eb1e841dec1f40ef9cf2466b260c01e024bbda48d96ffce1b68a589d0e9db7f65021e0b2bc0cbe1a98fe266f5d3b"], 0x5c}, 0x1, 0x0, 0x0, 0x10000082}, 0x80) (async, rerun: 64) socket$nl_route(0x10, 0x3, 0x0) (rerun: 64) 2.056036969s ago: executing program 1 (id=5683): bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000400)=ANY=[@ANYBLOB="9feb010018000000000000001800000018000000040000000200000000000003"], 0x0, 0x34}, 0x28) r0 = socket$netlink(0x10, 0x3, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0x25dfdbfe, {0x0, 0x0, 0x0, r4, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x10}}, [@qdisc_kind_options=@q_prio={{0x9}, {0x18, 0x2, {0x9}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x40480c0}, 0x20040084) sendmsg$nl_route_sched(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=@gettfilter={0x24, 0x2e, 0x12d, 0x70bd2c, 0x6, {0x0, 0x0, 0x0, r4, {0xfff3, 0xfffe}, {0xfff3, 0xfff1}, {0xd, 0x5}}}, 0x24}, 0x1, 0x0, 0x0, 0x4}, 0x4041880) r5 = socket(0x200000000000011, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000080)={'team0\x00', 0x0}) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="200014363dab9731ea6038db23000076000d0b25bd7000000000000300000000"], 0x20}, 0x1, 0x0, 0x0, 0x4000885}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=ANY=[@ANYBLOB="3c000000100005ff00000000000000000000004a", @ANYRES32=0x0, @ANYBLOB="8000020080280000140012800b00010062617461647600000400028008000a00", @ANYRES32=r6, @ANYBLOB="08000000000000004df2e5beacb041834d512f5b0476b21e78f5886317aa046b9b60b0e7655a31ac88980d57a03730880200000012e331ff20b688cd59"], 0x3c}}, 0x40000) 1.86551037s ago: executing program 4 (id=5684): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="240000001a000100000000000000000081000000000002000000000008000f"], 0x24}}, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$netlbl_calipso(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NLBL_CALIPSO_C_ADD(r1, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="00022bbd7000fbdbdf2501000000080002000200000008000100030000000800020002000000"], 0x2c}, 0x1, 0x0, 0x0, 0x90}, 0x4000895) 1.721268639s ago: executing program 4 (id=5685): r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) (async) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) r3 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000340)={0x14, 0x3e, 0x229, 0x0, 0x25dfdbfc, {0xa}}, 0x14}}, 0x8804) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f00000001c0)={0x0, 0x10, &(0x7f0000000000)=[@in={0x2, 0x4e21, @rand_addr=0x64010102}]}, &(0x7f00000002c0)=0x10) (async) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r5 = socket$inet6_sctp(0xa, 0x5, 0x84) (async) setsockopt$inet6_MCAST_LEAVE_GROUP(0xffffffffffffffff, 0x29, 0x2d, &(0x7f0000000200)={0x18, {{0xa, 0x4e23, 0x9, @ipv4={'\x00', '\xff\xff', @broadcast}, 0x8}}}, 0x88) shutdown(r5, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r5, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x38, &(0x7f0000000040)=[@in6={0xa, 0x4e20, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, @in6={0xa, 0x4e20, 0x0, @loopback, 0x3}]}, &(0x7f0000000180)=0x10) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(r5, 0x84, 0x6c, &(0x7f0000000400)={r6, 0x39, "b1c18f70612939ec9920b77781b7addc6bc7f2bbfb1cd5017f4a85f67b8abb3c66269c42d7a238cb802ff1c984d8d842d176fef210dee530c1"}, &(0x7f00000000c0)=0x41) (async) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r7) (async) r8 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000005c0)=@newqdisc={0xc4, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xfff2, 0x2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x94, 0x2, {{0x3, 0x8000003, 0x6361, 0x5, 0xffffffff, 0x3}, [@TCA_NETEM_REORDER={0xc, 0x3, {0x0, 0xfffff010}}, @TCA_NETEM_JITTER64={0xc, 0xb, 0x5}, @TCA_NETEM_LATENCY64={0xc}, @TCA_NETEM_DELAY_DIST={0x47, 0x2, "23de315a1776b1edf4740f87fa4a78a6fb6a4ecb171ec7c3c20aefd65e12e3bf18cff2c42b075ade29e5d41831b91baf7797cc53daf627fe56eae354df16cd746dde2b"}, @TCA_NETEM_REORDER={0xc, 0x3, {0x0, 0x7}}]}}}]}, 0xc4}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) sendmsg$nl_route_sched(r8, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000340)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdc04, {0x0, 0x0, 0x0, r9, {0x0, 0xd}, {0x3, 0xb}, {0x4, 0xffe0}}, [@qdisc_kind_options=@q_fq_codel={{0xd}, {0x14, 0x2, [@TCA_FQ_CODEL_MEMORY_LIMIT={0x8, 0x9, 0x5}, @TCA_FQ_CODEL_FLOWS={0x8, 0x5, 0xa}]}}]}, 0x48}, 0x1, 0x0, 0x0, 0x240040a1}, 0x4890) (async) ioctl$SIOCSIFHWADDR(r7, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r10 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r10, 0x107, 0xf, &(0x7f0000000100)=0x207, 0x4) (async) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000040)={'syzkaller0\x00', 0x0}) sendto$packet(r10, &(0x7f00000002c0)="0503222ed3fc140000004788031c09102c28", 0xfdef, 0x4, &(0x7f0000000140)={0x11, 0x86dd, r11, 0x1, 0x0, 0x6, @multicast}, 0x14) getsockopt$inet_sctp6_SCTP_MAX_BURST(r2, 0x84, 0x83, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000300)=0x8) setsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r2, 0x84, 0xa, &(0x7f00000000c0)={0x0, 0x7, 0x1, 0x3, 0x8000, 0x7, 0x1, 0x8, r12}, 0x20) (async) setsockopt$inet_sctp6_SCTP_ADD_STREAMS(r1, 0x84, 0x79, &(0x7f0000000040)={r12, 0x2, 0x6}, 0x8) ioctl$sock_ifreq(r0, 0x8910, &(0x7f0000000000)={'veth0_vlan\x00', @ifru_ivalue=0x4}) (async) ioctl$sock_netdev_private(r0, 0x89f0, &(0x7f0000000000)) (async) bind$bt_sco(r0, &(0x7f0000000080), 0x8) 1.658827292s ago: executing program 1 (id=5687): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = openat$cgroup_freezer_state(0xffffffffffffffff, &(0x7f0000000000), 0x2, 0x0) preadv(r1, &(0x7f0000003040)=[{&(0x7f0000000180)=""/119, 0x77}, {&(0x7f0000000c40)=""/4096, 0x1000}, {&(0x7f0000001c40)=""/174, 0xae}, {&(0x7f0000001d00)=""/232, 0xe8}, {&(0x7f0000001e00)=""/9, 0x9}, {&(0x7f0000001e40)=""/249, 0xf9}, {&(0x7f0000001f40)=""/108, 0x6c}, {&(0x7f0000001fc0)=""/4096, 0x1000}, {&(0x7f0000002fc0)=""/127, 0x7f}], 0x9, 0x8001, 0x7) r2 = socket$kcm(0x11, 0x200000000000002, 0x300) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0300000004000000040000000a"], 0x50) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0x10, &(0x7f0000000bc0)=ANY=[@ANYBLOB="1808000000000000000000000000000018120000", @ANYRES32=r3, @ANYBLOB="0000000000000000b703000000000000850000002f000000b7000000000000001801000000082c2500000000002120207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000000085000000b000000095"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) setsockopt$sock_attach_bpf(r2, 0x1, 0x32, &(0x7f0000000140)=r4, 0x4) unshare(0x400) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r5, 0x29, 0x40, 0x0, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x2f, 0x9, 0x70bd27, 0x0, {0x4}}, 0x14}, 0x1, 0x0, 0x0, 0x42014}, 0x80000) 1.477809774s ago: executing program 0 (id=5689): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) r1 = socket(0xa, 0x3, 0x3a) getsockopt$MRT6(r1, 0x29, 0xd0, 0x0, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-serpent-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f0000000040)="ad07595c757fe2ba3b743f8279b07e6e9182", 0x12) sendmsg$NFT_BATCH(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000140)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a58000000060a010400000000000000000a0000010900010073797a31000000002c00048028060000000001006f626a72656600001800028008000340000000170900020073797a32000000000900020073797a3200000000140000001100010000000000000000000100000a"], 0x80}, 0x1, 0x0, 0x0, 0x4000850}, 0x24000000) ioctl$SIOCGSTAMP(r2, 0x8906, &(0x7f0000000000)) 1.477113729s ago: executing program 4 (id=5690): socket$packet(0x11, 0x3, 0x300) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000, 0x0, 0xffffffffffffffff, 0xffff}, 0x50) r1 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="9feb01001800000000000000180000001800000004000000020000000100000c02000000000000000000000d0000000000005f"], 0x0, 0x34}, 0x20) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f0000000100)=ANY=[@ANYBLOB="180000000100000000000000801800009500000000000000"], &(0x7f0000000000)='GPL\x00', 0xc, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, r1, 0x8, &(0x7f00000000c0)={0x0, 0x1}, 0x1}, 0x94) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000500)=@bpf_ext={0x1a, 0xf, &(0x7f00000002c0)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x8792}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000180)='GPL\x00', 0x7, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x19, r1, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x1, r2, 0x0, 0x0, 0x0, 0x10, 0x4a6}, 0x94) openat$tun(0xffffffffffffff9c, &(0x7f0000000380), 0x181802, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000000)={0x6, 0xa, &(0x7f0000000400)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, [@jmp={0x6, 0x0, 0xc, 0x0, 0x0, 0x1, 0x25}, @func={0x85, 0x0, 0x1, 0x0, 0x1}, @exit, @cb_func={0x18, 0x0, 0x4, 0x0, 0x2}, @exit, @call={0x85, 0x0, 0x0, 0x4b}]}, 0x0, 0x8, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x7}, 0x94) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$FS_IOC_GET_ENCRYPTION_POLICY_EX(r2, 0xc0096616, 0x0) r4 = socket(0x10, 0x803, 0x0) sendmsg$BATADV_CMD_GET_MESH(r4, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000480)={0x0, 0x92}}, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r5, @ANYRESOCT=r4], 0x3c}, 0x1, 0x0, 0x0, 0xc000}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f00000007c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000180)=@newqdisc={0x64, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {0x0, 0x9}, {0xffff, 0xffff}, {0xfff1, 0xd}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x34, 0x2, {{0x1ff, 0x4, 0x0, 0x0, 0xfffffffd, 0x8}, [@TCA_NETEM_LOSS={0x18, 0x5, 0x0, 0x1, [@NETEM_LOSS_GE={0x14, 0x2, {0xfffffc02, 0x81, 0xfffffffc, 0x4}}]}]}}}]}, 0x64}}, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000300)={&(0x7f0000000440)=ANY=[], 0x0, 0x96}, 0x28) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r7, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000640)={{0x14}, [], {0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}}, 0x28}}, 0x0) r8 = socket$kcm(0x2, 0x3, 0x2) sendmsg$inet(r8, &(0x7f0000001640)={&(0x7f0000000300)={0x2, 0x0, @multicast2=0xe0000001}, 0x10, &(0x7f0000002800)=[{&(0x7f0000000080), 0x97ff}, {&(0x7f0000000740)="fae0835ee82c20abb86f7c287ffb04a52a0b2339a4efc8216bada6fb7f4385ead471969bdf9b82994c10898db8b0fd9a6068b87f4547eff53d6cb7b37534e44d27c79042f58263d71ee0e5b2cb31215ded6df9c76d150aa52a4eecb94fe48e79205c96a0aab13eaa4681860576d2e32f686f8f4ae905e573b200d669e65d56", 0x7f}, {&(0x7f00000015c0)}, {&(0x7f0000000e00)="3f013c9ef434ca4df0854ba1c14f7db8ccda5e87715ffd1ead9c4d9a2306168b07d3c6763a3ceabf6dfae235f3d783ddc8a7bbd796b345df843b5f0a623ab36b3123dfcd05bf4a6e3f35d859ffc0b699be4052995533be91880029387cc3e15b2d9bf3513e617572d965ba8f665eedcbdaad53d04cddeed78a3904956c5dc95f47132090648f98558d14a4850ac4b92e1b41a06dee6198c74c72607a032c3c7ef5abd0ba4a7f9f5dfebd75457b2ec358e951ade237c7498b025ad6524eb4263d6ef72e05901da983aac2b31a5e2631e39301a6dd04c128aabcea9134ec99685df1068506541f1265c77c85300497abfebce6ed768d9922ba3699dc6cc1863c0aa9321170b9e63a74986c1996d0fa1a5886e7023836ddbe64bea33edfe6fc1cb64784da18c2d4930eb481930b9298b57c7939189df401aed6a586f0103fccf70f92a53666d5afd3dd0b12273e5c1f2ddee89ed9a280c10df8e55ed24dcf9d631b693cd38006da4629a6b4a599de94a5b8ba6bccffdaa9d3fe0970623c118ba7e811d534915e4c63fa40df1e5a37ad9e5827ff65b2e4d8480a3f66576a3a52c0c80606098c0cb0b203f20d4f7b614652e4d8eb595d29ad1a4ce2c97aa30328c9987e1f1d8b7954ff54ddb69d5c3d2225bdd84e93b19edc2d33116373b0b5be8eea62d84896d2412edf5d321f75811360f89fe6ca8ac6545ec1c9f86ab285d1b5ba00c269514dab7a076c01cbfecaaff336d116481b16e434262de851a70ff056b1f9319840e27d5f446a3476210f4e70ceb71eeec17619911d56b74d7e761ff9c43dd237772377f888bfad215f3ee19eeeb87564f77241258874dd70bdd976305092426d18a3bc60022cb0acc2d21b3e24", 0x270}], 0x4, &(0x7f0000000600)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @dev={0xac, 0x14, 0x14, 0x10}, @local}}}, @ip_retopts={{0x1c, 0x11, 0x7, {[@noop, @ra={0x94, 0x4}, @timestamp_addr={0x44, 0x4, 0xf7, 0x1, 0x4}]}}}], 0x40}, 0x0) setsockopt$netlink_NETLINK_PKTINFO(r7, 0x10e, 0x3, &(0x7f0000000780)=0x6, 0x4) syz_genetlink_get_family_id$tipc2(&(0x7f0000000000), r6) r9 = socket(0xa, 0x3, 0xff) setsockopt$SO_TIMESTAMPING(r9, 0x1, 0x25, &(0x7f0000000240)=0x2a76, 0x4) r10 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r10, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="020300030e00000027bd70000000000004000900a800000001d78771b90bd8a3b4914783c5432d69ca5b9538a900000003000600000000000200000000000001000000000000000002000100010000000000031600000000030005000000000002"], 0x70}, 0x1, 0x7}, 0x10) sendmsg$inet6(r9, &(0x7f0000000140)={&(0x7f00000000c0)={0xa, 0xa, 0x7, @dev={0xfe, 0x80, '\x00', 0x29}}, 0x1c, &(0x7f0000000480)=[{&(0x7f0000000100)="c6e73300000000", 0x7}, {&(0x7f00000006c0)="9e91d91a9cfc796fff655bb539e2ffb332820636ab4a4f2ba30000", 0x1b}, {&(0x7f00000004c0)="e3cb8bc7195b", 0x6}], 0x3}, 0x20004b88) sendmsg$nl_generic(r6, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000001800)=ANY=[@ANYBLOB="180000002500010324bd7002ffdbdf25010000000400ae"], 0x18}, 0x1, 0x0, 0x0, 0x4004004}, 0x88c0) recvmmsg(r6, &(0x7f0000002b00)=[{{0x0, 0x0, &(0x7f0000000340)=[{&(0x7f0000000500)=""/217, 0xd9}, {&(0x7f0000000f00)=""/222, 0xde}, {&(0x7f0000000180)=""/132, 0x84}, {&(0x7f0000001840)=""/4079, 0xfef}], 0x4}, 0x5}, {{0x0, 0x0, 0x0}, 0xfffffffc}, {{0x0, 0x0, 0x0}, 0x80000001}, {{0x0, 0x0, 0x0}, 0x78}], 0x4, 0x42, 0x0) syz_genetlink_get_family_id$devlink(&(0x7f0000000340), r4) 1.352289935s ago: executing program 0 (id=5691): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_NODELAY(r0, 0x84, 0x3, 0x0, 0x0) (async) r1 = syz_genetlink_get_family_id$nfc(&(0x7f0000000080), 0xffffffffffffffff) r2 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) (async) r3 = socket$l2tp6(0xa, 0x2, 0x73) sendmsg$inet6(r3, &(0x7f0000000140)={&(0x7f0000000100)={0xa, 0x4e60, 0x80000, @dev={0xfe, 0x80, '\x00', 0x3d}, 0xfffffffb}, 0x1c, 0x0, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="180000000000000029"], 0x30}, 0x3400c8d4) (async) r4 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$IOCTL_GET_NCIDEV_IDX(r4, 0x0, &(0x7f0000000000)=0x0) bind$nfc_llcp(r2, &(0x7f0000001040)={0x27, r5, 0xfffffffe, 0x4, 0x0, 0x1, "d92984bd1ca44c226af5160e961711a077609475b78411e88509de050000000000f2170e65e3f50327e422000000000000000000000200000000001900", 0x3f}, 0x60) (async) sendmsg$NFC_CMD_DEV_UP(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000280)={&(0x7f0000000340)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="10002dbd7000fddbdf250200000008000100", @ANYRES32=r5, @ANYBLOB="2e1b6e082b5d01", @ANYRES32=0x0, @ANYBLOB], 0x24}, 0x1, 0x0, 0x0, 0x81}, 0x40010) (async) setsockopt$bt_l2cap_L2CAP_LM(0xffffffffffffffff, 0x6, 0x3, &(0x7f0000000300)=0x3d969a50c256de92, 0x4) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000100000a20000000000a01040000000000000000010080030900010073797a30000000002c000000030a01010000000000000000010000000900010073797a30000000000900030073797a3200000000b4000000060a010400000000000000000100000008000b40000000008c000480340001800b000100657874686472000024000280080001400000000c080003400000000008000440000000220500020089000000540001800c00010062697477697365004400028008000340000000040800014000000014080002400000000c1c000580180001003ac9ef6625009ad0dbd4d3f907d5702d201aa1c20c000480080001006eee7e000900010073797a30"], 0x128}}, 0x0) 1.273658166s ago: executing program 1 (id=5692): r0 = socket(0x8000000010, 0x2, 0x0) write(r0, &(0x7f00000002c0)="fc0000001c000704ab5b2509b868030002ab087a0100000001481093210001c0f0030584050060100000000000039815fa2c53c28648000000b9d95662537a00bc000c00f0ff7f0000b400600033d44000040560916a0033f436313012dafd5a32e273fc83ab82d710f74cec184406f90d435ef8b29d3ef3d92c94170e5bba2e177312e081bea05d3a021e8ca062914a46ccfc510bb73c9455cdc8363ae4f5df77bc4cfd6239ec2a0f0d1bcae5fa0f5f9dcdd51af51af8502943283f4bb102b2b8f5566791cf190201ded815b2ccd243f395ed94e0ad91bd6433802e0784f2013cd1890058a10000c880ac801fe4af000049f0d4796f0000090548de", 0xfc) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = syz_init_net_socket$llc(0x1a, 0x801, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000080), r0) sendmsg$MPTCP_PM_CMD_DEL_ADDR(r0, &(0x7f0000000240)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x800}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x40011}, 0x1) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)=@ipv4_delroute={0x24, 0x20, 0x901, 0x0, 0x25dfdbff, {0x2, 0x18, 0x0, 0x0, 0xff, 0x0, 0x0, 0x8, 0x2000000}, [@RTA_DST={0x8, 0x1, @dev}]}, 0x24}}, 0x0) bind$llc(r2, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x81, 0x42}, 0x10) connect$llc(r2, &(0x7f0000000340)={0x1a, 0x322, 0x0, 0x0, 0x4, 0x90, @random="48bd00"}, 0x10) bind$llc(0xffffffffffffffff, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x81, 0x42}, 0x10) r4 = socket(0x840000000002, 0x3, 0x100) connect$inet(r4, &(0x7f0000000000)={0x2, 0x4e24, @remote}, 0x61) sendmmsg$inet(r4, &(0x7f0000005240), 0x4000095, 0x0) setsockopt$inet_buf(r4, 0x0, 0x29, 0x0, 0x0) close(0xffffffffffffffff) r5 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x6, 0x4, 0x6, 0x8}, 0x50) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xd, &(0x7f0000000480)=ANY=[@ANYBLOB="1800000000000000000000000000000018150000", @ANYRES32=r5, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000005000000b7040000010000008500000015000000850000005000000095"], &(0x7f0000000340)='syzkaller\x00', 0x1, 0x0, 0x0, 0x41100, 0x1, '\x00', 0x0, @fallback=0x2c, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r6, 0x0, 0xe, 0xfeff, &(0x7f0000000100)="e0857f9f582f0300000000000000", 0x0, 0x2f00, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) ioctl$sock_inet_SIOCSARP(r1, 0x8953, &(0x7f0000000180)={{0x2, 0x0, @empty}, {}, 0x0, {0x440, 0x0, @multicast1=0xe000cc02}}) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)=@newlink={0x20, 0x10, 0x200, 0x0, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, 0x8, 0x28}}, 0x20}}, 0x0) 1.170363778s ago: executing program 4 (id=5693): socket$nl_route(0x10, 0x3, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=ANY=[], 0x20}, 0x1, 0x0, 0x0, 0x4048451}, 0x20000800) r1 = accept4$packet(0xffffffffffffffff, &(0x7f0000000080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @multicast}, &(0x7f00000000c0)=0x14, 0x800) setsockopt$packet_fanout_data(r1, 0x107, 0x16, &(0x7f0000000140)={0x5, &(0x7f0000000100)=[{0x200, 0x6, 0x2, 0xc}, {0x200, 0x1, 0x8, 0x8}, {0xfff9, 0x5, 0xf9, 0x3ff}, {0xffff, 0x8, 0x9, 0x8}, {0x0, 0x10, 0x1, 0x200}]}, 0x10) ioctl$BTRFS_IOC_ENCODED_WRITE(r0, 0x40809440, &(0x7f0000000280)={&(0x7f0000000240)=[{&(0x7f0000000180)="6b2ac3750a577cc7f553748415eda290e66626c6c26b56abe87b7724f9280a047bb0756996314706e43496255527c2cab35fa5d6ac48b7982a62f133382e83f0bd9a1a6691818c67643090eed4623ef65c6eb322261758a978f19825ac1a505a3fe608c5c91c02c2ecb9aeb057a8dc363738370aaeba854f4657e3ae3d06717fc2b2ede3b0947114241af10fc5fddeae5c31ab89bb3502d97b8c271aec3d2b79657ab46ed116d0daa78419c7ea0dc92981601843a86b81de92e385", 0xbb}], 0x1, 0x8, 0x0, 0xcf54, 0x8c, 0x100, 0x5}) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_BEACON(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=ANY=[@ANYBLOB='H\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="01002cbd7000fedb7656e27e07ca1d9adf254e000000983b7e03cc6ef92829b562cbfcf7e868404a7db99aa12e9b06b6fce947d041213f898102ece49b03"], 0x48}}, 0xb0b6961456b96b1f) r3 = socket(0xa, 0x3, 0x3a) setsockopt$MRT6_ADD_MFC_PROXY(r3, 0x29, 0xcd, &(0x7f00000000c0)={{0xa, 0x2, 0x0, @local}, {0xa, 0x0, 0x0, @empty}}, 0x5c) unshare(0x6e000000) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="5800000002060102000034e40000000004000008050005000a000000050001000600000005000400000000000900020073797a310000000011000300686173683a69702c706f72740000"], 0x58}, 0x1, 0x0, 0x0, 0x81}, 0x0) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(des3_ede)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r5, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r6 = accept4(r5, 0x0, 0x0, 0x0) sendmmsg$alg(r6, &(0x7f0000000400)=[{0x0, 0x0, 0x0}], 0x1, 0x0) recvmsg(r6, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x51}], 0x1}, 0x20000253) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) r7 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="19000000040000000400"], 0x48) close(0x3) bpf$MAP_CREATE(0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="0e000000040000000400000009"], 0x48) r8 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x6, 0xd, &(0x7f00000001c0)=ANY=[@ANYBLOB="1800000000010000000000000000000018110000", @ANYRES32=r7], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x1, '\x00', 0x0, @xdp=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000b80)={r8, 0x2000012, 0xe, 0x0, &(0x7f0000000c40)="63eced8e46dc3f2ddf33c9e9b986", 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xb}, 0x50) socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0xc800) syz_genetlink_get_family_id$wireguard(0x0, 0xffffffffffffffff) socket$nl_crypto(0x10, 0x3, 0x15) ioctl$F2FS_IOC_GARBAGE_COLLECT_RANGE(r3, 0x4018f50b, &(0x7f0000000300)={0x0, 0x5920, 0xb3}) 1.147184016s ago: executing program 3 (id=5694): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0f00000004000000080000000c"], 0x50) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x16, 0xd, &(0x7f0000000f80)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000003000000850000000800000095"], &(0x7f0000000340)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x18, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r2, 0xc00, 0xe, 0x0, &(0x7f0000000100)="e0b9547ed387dbe9abc89b6f5bec", 0x0, 0x4002000, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) close(r0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0xc004}, 0x0) sendmsg$NFT_BATCH(r4, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSET={0x44, 0x9, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x2}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0xfffffffc}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x106}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x6c}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$NFT_BATCH(r3, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000040)=ANY=[@ANYRESDEC=r2], 0x70}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)=ANY=[], 0x68}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) socket$nl_netfilter(0x10, 0x3, 0xc) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0f00000004000000080000000c"], 0x50) (async) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x16, 0xd, &(0x7f0000000f80)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000003000000850000000800000095"], &(0x7f0000000340)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x18, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r2, 0xc00, 0xe, 0x0, &(0x7f0000000100)="e0b9547ed387dbe9abc89b6f5bec", 0x0, 0x4002000, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) (async) close(r0) (async) socket$nl_netfilter(0x10, 0x3, 0xc) (async) socket$nl_netfilter(0x10, 0x3, 0xc) (async) sendmsg$NFT_BATCH(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0xc004}, 0x0) (async) sendmsg$NFT_BATCH(r4, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSET={0x44, 0x9, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x2}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0xfffffffc}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x106}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x6c}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) (async) sendmsg$NFT_BATCH(r3, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000040)=ANY=[@ANYRESDEC=r2], 0x70}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) (async) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)=ANY=[], 0x68}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) (async) 1.139971218s ago: executing program 2 (id=5695): r0 = socket$nl_audit(0x10, 0x3, 0x9) sendmsg$AUDIT_ADD_RULE(r0, &(0x7f0000000600)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f00000005c0)={&(0x7f0000000180)={0x420, 0x3f3, 0x100, 0x70bd26, 0x25dfdbfb, {0x0, 0x2, 0x20, [0x9, 0x6, 0x2, 0x1ff, 0xfdd, 0x0, 0x3, 0x9, 0xfffffff9, 0x81, 0x6, 0x6, 0x3ff, 0x2, 0x7, 0x9, 0xc, 0x6, 0xffffffff, 0x5, 0x7468, 0x4000000, 0x0, 0x0, 0x0, 0x8001, 0x5, 0xff, 0x6, 0x0, 0x10, 0xf99b, 0x9, 0x6, 0xffff, 0x0, 0x6, 0x27, 0xfffffff2, 0x4, 0x6, 0x47, 0x9, 0x6, 0x5, 0x0, 0x94000000, 0x5, 0x7, 0x7, 0xffffffff, 0xb, 0xff, 0x9, 0x6, 0xf, 0x386b, 0xf9, 0xd75, 0x3, 0xb00000, 0x8, 0x6, 0x3], [0x7, 0x665b, 0x5, 0x4f1, 0xfce, 0x9, 0x4, 0x8, 0x6, 0x8000, 0x0, 0xfffffffe, 0x4, 0x6a, 0x5, 0x80, 0x2, 0x2, 0x3c9, 0xf0000000, 0x7, 0x7, 0x2, 0x9, 0x94a, 0x6, 0x6, 0x8001, 0x9b0, 0x8d, 0xef, 0x10000, 0x8, 0x6b9a, 0x101, 0x6, 0xfffffffe, 0x100, 0x6, 0x9, 0x10, 0x401, 0x5, 0xe, 0x9, 0xff, 0x46, 0x7, 0x1a, 0x882, 0x2, 0xc50, 0x101, 0x7, 0x7d0f, 0x80, 0x2, 0x3, 0x8, 0x9a09, 0xfffffff7], [0x411, 0x7ff, 0x8, 0xff, 0x4, 0x7, 0x3, 0x7, 0x8, 0x3, 0x3, 0x5c, 0x6, 0x6, 0xef2, 0x7fffffff, 0x8, 0x8, 0x3, 0x4, 0x401, 0x4, 0x2, 0x74, 0x0, 0x1, 0x7, 0x6, 0x1, 0xffffffff, 0xaa3f, 0xa1, 0x80, 0x3, 0x5, 0x5, 0x4, 0xffffff00, 0xffffffff, 0x5, 0x6, 0x7, 0x80000001, 0x19b3f10e, 0x7, 0x800, 0x800, 0xffffffff, 0x4, 0x6, 0x4, 0x9, 0x4, 0x9, 0xfffffff7, 0x7f, 0x1, 0x268, 0x9, 0x74ad, 0x5, 0x0, 0x1, 0x4], [0x7, 0xb892, 0x1, 0x8, 0x9, 0xfff, 0x4a49, 0xc, 0x1, 0x73, 0x3, 0x5, 0x1ee9, 0x3, 0x10, 0x4, 0x5, 0x6, 0x5, 0x7fffffff, 0x5, 0x9, 0x7, 0x6, 0xfff, 0x4, 0xb, 0x3, 0x6, 0x10, 0x7, 0x1, 0x80000001, 0x2, 0x7a98, 0x2, 0x0, 0x10, 0x1692, 0x80, 0x4, 0x5, 0x6, 0x78, 0xa50c, 0x10, 0x2746bf1a, 0x7f, 0x3, 0x5, 0x3, 0xc4c, 0x8, 0x6b9, 0x3, 0x0, 0x401, 0x5, 0x1, 0xab7, 0x4, 0xff, 0x3, 0x100]}, ["", "", "", "", ""]}, 0x420}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x7a44, 0x1700) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) sendfile(r2, r1, 0x0, 0x10000) 1.068816339s ago: executing program 0 (id=5696): socketpair$tipc(0x1e, 0x5, 0x0, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000000300), 0xffffffffffffffff) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$pppl2tp(0x18, 0x1, 0x1) r2 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r1, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @dev}, 0x2}}, 0x2e) r3 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_SESSION_DELETE(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000180)={0x40, r3, 0x1, 0x70bd28, 0x40, {0x5}, [@L2TP_ATTR_CONN_ID={0x8, 0x9, 0x2}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0xaa8}, @L2TP_ATTR_PW_TYPE={0x6, 0x1, 0x8}, @L2TP_ATTR_SESSION_ID={0x8, 0xb, 0x2}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x8}]}, 0x40}, 0x1, 0x0, 0x0, 0x4800}, 0x4) r4 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_int(r4, 0x29, 0x4c, &(0x7f0000000040)=0x2, 0x1e) recvmmsg(0xffffffffffffffff, &(0x7f0000001640), 0x0, 0x34000, 0x0) sendmsg$ETHTOOL_MSG_TSINFO_GET(0xffffffffffffffff, 0x0, 0x0) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nbd(&(0x7f0000000040), 0xffffffffffffffff) r7 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000200)={&(0x7f0000000000)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x4, [@enum={0x2, 0x0, 0x0, 0xf}]}, {0x0, [0x0, 0x5f]}}, 0x0, 0x28}, 0x20) r8 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000040)={0x2, 0x4, 0x4, 0x1, 0x80, 0xffffffffffffffff, 0x0, '\x00', 0x0, r7, 0x0, 0x1}, 0x48) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0xd, 0x10, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000100007b8af8ff00000000b7080000000000007b8af0ff00000000bf8100000000000007080000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018210000", @ANYRES32=r8, @ANYBLOB="0000000002000000b70500000800000085000000c200000095"], &(0x7f0000000300)='GPL\x00', 0x2, 0x0, 0x0, 0x0, 0x2b}, 0x94) sendmsg$NBD_CMD_CONNECT(r5, &(0x7f0000001ac0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)={0x3c, r6, 0x1, 0x70bd2b, 0x1000, {}, [@NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x122}, @NBD_ATTR_BACKEND_IDENTIFIER={0xd, 0xa, 'list:set\x00'}, @NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x1}]}, 0x3c}}, 0x400400c) 953.708317ms ago: executing program 2 (id=5697): sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) (async) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000400), 0xffffffffffffffff) r2 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x50) (async) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000100)={0x18, 0xf, &(0x7f0000000400)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x8b, 0x0, 0x0, 0x0, 0x80}, {{0x18, 0x1, 0x1, 0x0, r2}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xfeff}, {0x85, 0x0, 0x0, 0x86}, {0x7, 0x1, 0xb, 0x9, 0x0, 0x20}}, {{0x5, 0x0, 0x5, 0x9, 0x0, 0x1, 0x80000000}}, [], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x3}, {0x85, 0x0, 0x0, 0x84}, {0x7, 0x0, 0xb, 0x0, 0x0, 0x0, 0x500}}}, &(0x7f0000000000)='GPL\x00', 0x3, 0xfed, &(0x7f0000000780)=""/4077, 0x41000, 0x4b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x8000d}, 0x94) sendmsg$TIPC_NL_KEY_SET(r0, &(0x7f0000000100)={0x0, 0x2844, &(0x7f0000000080)={&(0x7f00000001c0)={0x54, r1, 0x1, 0x0, 0x0, {0x3}, [@TIPC_NLA_BEARER={0x40, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xf}}}, {0x14, 0x2, @in={0x2, 0x0, @broadcast}}}}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz2\x00'}]}]}, 0x54}}, 0x0) sendmsg$TIPC_NL_BEARER_SET(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000680)={&(0x7f00000005c0)=ANY=[], 0x34}, 0x1, 0x0, 0x0, 0x800}, 0x20004040) (async) r3 = socket$netlink(0x10, 0x3, 0x0) (async) r4 = socket(0x10, 0x803, 0x0) sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r4, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x1c}}, 0x0) (async) getsockname$packet(r4, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) sendmsg$nl_route(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32=r5, @ANYBLOB="f5ff0f00252155b21c0012000c000100626f6e64000000000c0002000800010001"], 0x3c}}, 0x40000) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x13, 0xe, &(0x7f0000000c00)=ANY=[@ANYRES64=r6], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x31, 0xffffffffffffffff, 0x8, &(0x7f0000000500)={0x1}, 0x8, 0x10, &(0x7f0000000340)={0x0, 0x1}, 0x10}, 0x94) r7 = socket(0x10, 0x803, 0x0) r8 = socket(0x10, 0x803, 0x2) r9 = syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), r8) (async) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) r11 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="1e000000000000000500000006"], 0x48) bpf$MAP_LOOKUP_ELEM(0x2, &(0x7f0000001740)={r11, 0x0, &(0x7f0000001700)=""/53}, 0x20) (async) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000300)={0x3, 0xc, &(0x7f0000000480)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r11, @ANYRESOCT=r7], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x27, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3}, 0x94) r12 = bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f00000003c0)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x6, '\x00', 0x0, @fallback=0x35, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={r12, 0x2000000, 0xe, 0x0, &(0x7f00000004c0)="630b008646dc3f0adf33c9f7b986", 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x2}, 0x50) (async) sendmsg$nl_route(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="3c0000001000010400eeffff11feffffff000000", @ANYRES32=r10, @ANYRES16=r9], 0x3c}, 0x1, 0x0, 0x0, 0x40020c1}, 0x0) r13 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_inet6_SIOCSIFADDR(r13, 0x8916, &(0x7f0000000100)={@ipv4={'\x00', '\xff\xff', @multicast2}, 0x56, r5}) (async) socket$kcm(0x11, 0x3, 0x0) (async) r14 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r14, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7001}) (async) socket(0x400000000010, 0x3, 0x45a) 681.602383ms ago: executing program 0 (id=5698): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x9, &(0x7f0000000000)=0xe9, 0x4) (async) getsockopt$inet6_tcp_int(r0, 0x6, 0x9, 0x0, &(0x7f0000000080)) (async) r1 = socket(0xa, 0x3, 0x3a) setsockopt$MRT6_ADD_MFC_PROXY(r1, 0x29, 0xd2, &(0x7f0000000000)={{0xa, 0x4e24, 0x100, @local, 0x4}, {0xa, 0x4e23, 0x7, @empty, 0xd473}, 0x0, {[0x4, 0x7, 0x3, 0x8001, 0xe10, 0xe, 0x3]}}, 0x5c) (async) setsockopt$MRT6_ADD_MFC_PROXY(r1, 0x29, 0xd3, &(0x7f00000000c0)={{0xa, 0x1, 0x0, @local, 0x4}, {0xa, 0x4e21, 0x0, @empty}, 0xfffd, {[0x0, 0x20000, 0x0, 0x0, 0x0, 0xe3]}}, 0x5c) (async) r2 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r2, 0x107, 0x12, &(0x7f0000000040)={0x0, 0x9007}, 0x4) (async) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$EBT_SO_SET_ENTRIES(r3, 0x0, 0x80, &(0x7f0000000100)=@broute={'broute\x00', 0x3ffff, 0x1, 0x24e, [0x2000000004c0, 0x2000000006ae, 0x2000000006de, 0x2000000004c0, 0x2000000004c0, 0x2000000004c0], 0x0, 0x0, &(0x7f00000004c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{0x0, 0x12, 0x88f7, 'pim6reg\x00', 'veth0_to_hsr\x00', 'caif0\x00', 'veth1_to_bond\x00', @local, [0xff, 0xff, 0x0, 0xff, 0xff], @empty, [0xff, 0x0, 0xff], 0xae, 0x16e, 0x1be, [@time={{'time\x00', 0x0, 0x18}, {{0x1c0, 0x8ad, 0x120d4, 0xafa7, 0x10, 0x9, 0x1}}}], [@common=@NFLOG={'NFLOG\x00', 0x50, {{0x7, 0x3ff, 0x401, 0x0, 0x0, "ece3492bcea7897c18df55fc70ce63b941c2bbeb539cc9c8d9a25ee8c35a9b01fa966e23229ffe27013f6cf619332505836c85219af8fb58ca7f9b0bf7eef6ae"}}}, @common=@RATEEST={'RATEEST\x00', 0x20, {{'syz0\x00', 0x61, 0x4, {0xb02}}}}], @common=@LED={'LED\x00', 0x28, {{'syz0\x00', 0x1, 0x54, {0x3}}}}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x1, 0xffffffffffffffff}]}, 0x2c6) (async) close(0x3) 640.702882ms ago: executing program 1 (id=5699): bpf$MAP_CREATE(0x100000000000000, &(0x7f0000000340)=@base={0x12, 0x80001, 0x8, 0x2, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x2}, 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000040)={0x1f, 0x2, &(0x7f0000000100)=ANY=[@ANYBLOB="20000000a800000095"], &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x13, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x4}, 0x94) bpf$MAP_CREATE(0x100000000000000, &(0x7f0000000340)=@base={0x12, 0x80001, 0x8, 0x2, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x2}, 0x50) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000040)={0x1f, 0x2, &(0x7f0000000100)=ANY=[@ANYBLOB="20000000a800000095"], &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x13, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x4}, 0x94) (async) 617.081678ms ago: executing program 2 (id=5700): r0 = bpf$MAP_CREATE(0x100000000000000, &(0x7f0000000440)=ANY=[@ANYBLOB="0900000004000000080000000200000020200000", @ANYRES32=0x1, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000c4b9c252b3c8ae8761e3007f00000000000000ffffffffff"], 0x50) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000280)={r0, &(0x7f00000000c0), &(0x7f0000000080)=@udp, 0x3}, 0x20) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000002b40), 0xffffffffffffffff) sendmsg$NLBL_MGMT_C_ADD(0xffffffffffffffff, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000002c00)={&(0x7f0000000100)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010025bd7000fedbdf250100d8b8c1a47a9a0900000e0001006e65342f6c32636170000000080002000500000008"], 0x34}, 0x1, 0x2000000, 0x0, 0x20000000}, 0x4000080) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl802154(&(0x7f00000002c0), r1) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000300)={'wpan1\x00', 0x0}) r6 = socket$inet_icmp(0x2, 0x2, 0x1) r7 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0x5, 0x8, 0x2, 0x4}, 0x50) close(0x3) bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x2, 0x4, 0x4, 0x8, 0x1014}, 0x50) r8 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x14, &(0x7f0000000200)=ANY=[@ANYRES32=r2, @ANYRES32=r7, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) setsockopt$EBT_SO_SET_ENTRIES(r6, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00', 0x19, 0x0, 0x90, [0x200000000140, 0x0, 0x0, 0x200000000170, 0x2000000001a0], 0x0, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000006000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000004000ffffffff00000000"]}, 0x108) r9 = syz_genetlink_get_family_id$nl802154(&(0x7f0000002600), 0xffffffffffffffff) r10 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r10, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r12 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r13 = syz_genetlink_get_family_id$nfc(&(0x7f0000001c00), r12) sendmsg$NFC_CMD_START_POLL(r12, &(0x7f0000001e80)={0x0, 0x0, &(0x7f0000001e40)={&(0x7f0000000100)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r13, @ANYBLOB="010027bd7000fbfddf2506000000080003002000000008000100ea"], 0x2c}, 0x1, 0x0, 0x0, 0x91}, 0x10) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000002400)=ANY=[@ANYBLOB="b7000000ff000000bfa300000000000007030000f4ffffff620af0fff8ffffff71a4f0ff000000002d0a0200000000001d400200000000004704000001ed000062030000000000001d440000000000007a0af0ff00ffffffc3030000e10000009f040000000000009500000000000000023bc065b58111c6dfa041b63af4a3912435f1a864a710e4d58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a7168c50000000190f32050e436fe275daf51efd601b6bf01c8e8b1b526375ec4dd6fcd82e4fee5bef7af9aa0d7d66a77ac8daab82167606068067500c095199fe3ff3128e599b0eaebbdbd732c9cc00eec363e4a8f6456e2cc21557c0afc646cb7798b3e6440c2fbdb00c37dfca3e35208b0bb0d2cd829e654400e2438ec649dc74a28610643a98d9ec21ead2ed51b104d4d91af25b845d8a7925c3109b151b8b9f75dd08d123deda88c658d42ecbf28bf7076c15b463bebba2c598b4fc72f526d8e8afcb913466aaa7f6df70252e79166d858fcd0e06dd31af9612f2460d0b11008e59a5923030000000000000014e72ba7a54f0c33d39000d06a59ff616236fd9aa5b4e377184b6a89adaf17b0a6041bdef728d236619074d6ebdfd1f5089048ddff6da40f9411fe722631cb467600ade70063e5291569b33d21dae356e1c51f03a801be8189679a16da18ec0ae564162a27afea62d84f3a10746443d6438e959532e0617d419c6bc6ea9f2bca4464f56e24e6d2105bd901204a1deeed4155617572652d950ad31928b0b0c3dc2869f478341d02d0f5ad94b081fcd507acb4b9c65fee9d5a17f48a7382f13d000000225d85ae49cee383dc5049ef6a989b40000000000000da60d2ae20cfb91d6a49964757cdf538f9ce2bdb1ab062cd54e67011d355d84ce97bb0c6b4a595e487efbb2d71cde2c140952f9a0f0bc6980fe78683ac5c0c31032599ddd71063be9261b2e1aab1675b34a22048ef8c126aeef5f510a8f1aded94a129e4aec6f8d9ab06faffc3a15d96c2ea3e2e04cfe031b2875353193f82ade69d0540059fe6c7fe7cd8697502c7592566d674e425da5e87e59602a9f6590521d31d3804b3e0a1053abdc31282dfb15eb6841bb64a1b304502dda787343ce3c953992e4a982f3c48153baae244e7bf37548c7f1a4cad2422ee965a38f7defbd2160242b104e20dc2d9b0c35608d402ccdd9069bd50b994fda7a9de44028d6112a0c2d21b2dc98816106dec28eaeb883418f562ae00003ea96d10f172c0374d6eed826416050000000bfe9b4a9c5a90ff59d54d1f92ecc4e95dd2d18383117c039862198899b212c55318294270fa3d0ee281eaa11ad47afce829ba0f85da6d888f18ea40ab959f6074ab2a40d85d15017ab513cdc6c0e57fb1c1ca571380d7b4ead35a385e0b4a26b702396df7e0c1e02b6e4114f244a9bf93f04bf072f0861f7580e69db384ac7eeedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba34015ea5aacb1188883ad2a3b1832371fe5bc621426d1ed0a4a99702cc1b6912a1e717d29135753208165b9cdbae2ed9dc7358f0ebadde0b727f27feeb744ddcc536cbae315c7d1fe1399562ba6824840bd2951680f6f2f9a6a8346962a350845ffa0d829e4f79adc287906943408e6df3c3bfd03aac93df8866fb010aec0e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00000000c95265b2bd83d64a532869d701723fedcbada1ee7baa5b6a686b50f0937f778af083e055f6138a757ebd0ed93517a6b244f9acf41ac5d73a008364e0606a594817031fc2f52c8785fe0721719b3d654026c6ea08b83b123145ab5703dad844ceb201ddeb6dc5f6a903792283c42e54fa84323afc4c10eff462c8843187f1dd48ef3fa293774d582956ff0f40b10ca94f6feeb2893c17888e1cdba94a6ea80c33ead5722c3293a493f1479531dd88261458f40d31fe8df15efaaeea831555877f9538d6ee6ba65807ff1f908ba7554ba583fef3ec7932f5954f31a878e2fae6691d1aee1da02ba516467df3e7d1daac43738012e4fee18a22da19fcdb4c2890cda1f96b952511e3a69d694d625e0b2f808890205f3a6da2819d2f9e77c7c64affa54fec0136cbafa5f62e96753b639a924599c1f69219927ea5301fff0a6063d427f0688430754c02180d61542c25000000000000000005a7b57f03ca91c11ba2e30ca99e8ebc15ecb4d91675767999d146aef7799738b292fd640dfef6b04d086f737a159d7e0c6e4d81ad64a8bbca48568325b2969e2b15f36b788bce5ccdbaf75c94cb93499f6947a967a7bce14c6de4e7c0660d80010f5c653d22d49030a8c2a4ab595bf4238f18ca428dafc7ac96d404607a0000000051a2104f22e6cb5a62b5089c1b45282d38864daa3ae81d6b0968d1d2867b91b7d120617d12d91db2633d6864da40b54783a17aaeb6737c323f9f98e354cc98dcfe23ad01bd1c61563e69ffe1c2c73e1661261173f359e93d2c5e424c17998809ec8f0232b3955e052a4cecd89008f70314a0bdd491ec86a4555d89fe0120f64c62e8e3ed8bcb45202c3d4bbec8d722824c0ebca8db1ea4a003d2fbdc1f9be78537756ab5bbe4fe9af5d785d0128171c90d9900ce2532b0f9d01c4b45294fbba468df3e1b393cb4e62e754598e47df6bd06431c94bc5d047899fd219f448bf9189c65c9d91eda6b52a373803a9efe44f86909bc90addb7b9aee813df534aac4b3093c91b8068cd849904568916694d461b76a58d88cf0f520310a1e9fdc18cde98d662eee077515d0a8811922929e085392ab3d1311b8243266d87047f601fa88a0da36b9f302e8262395174328f2482d14008de83070744f143fdec90ba5a82668d5fac114c13955ad6dca5db2231d8ba14c54c47ed04a4b4ace17e357e1d6432399f87a7a14245bbd796a09313b247b95d37ff40a404bdad74bd20000000000000000000099fef7cdb70f617af3ce64a92f95d89d125b1e641240d7e5e27a3d1f7684448c3e3822d617e205061298b939a191be4b48e169bde2cae3accc5bd40a2968b59c93d35f8e42366fdef9a2abae1cf01ce68abff28861aac8302d268569dd42e194e330c7aaa54ebbcefd23f21ce8153b9926e12e925cb56119df72c7533a48d028af0c74e2a9478fa3be18a1a2b65079cc1c7bc46dd12305a1ae9dd19e8d525206c0a728cfd42193abe8130b51d6c9b94c5513df2d85e8c01a2d69841f3d7799ac04bdc590bb1c89b9c695f163e57343c9bfb59909433c9001c5f8b23e38534a538fc933cac6c2a92d038df638a0f226df9fb857bd414c2cd69985e8053e3dfa41614d7c74d04d8c2471041d17c730fad28395f8d4688898cd58b9d600c851626529bb58aa364b55e73f053450665e7b94ad1012fd7a8139166fd5e59c84f4ab279b1b99c028db4cb9680c8035f967db18de738844da7e260a830c1ffa49f5af3c15423a0e315acb82a3e89218cb314e68fda4d94aa1d815babc13b9fd336d205c5913ef670000000000000000ba470bfe62fe2933082149d42e8a00672f0814bf895e3a6dfbc711243f58a817895f5c4eaf7de8411a831ef65508f416ae3fd1db8386f6aae40515273adcff6196bb45476ec0a5279ed223f772aee25947b1f0d275c0e495b050f10a0b5d19b578a2b4096b9df527211bb39a29224c34a517dc344a195697b0c158d3519c04fe7621ebeef0bc369a1431a90c4117bdfe358e0e869e9f3e5443813261c1c3c78ab2584603e4468de7d0dc93691491050666f4ea5f083a1b281ed230569921856befe07538fbf33f43fa4ad583867bee301ae1e2566ae7a7afb7fc54895a2fef928d91a162affb4d373c7628a2871d7d19eaf06ed5f58f799c8ff391d3752b115073702ee257ade173dd2f736ed5939f219ba42f7650b9a262f6ee4af52aba3e669a835555ea1674f89d7f98ee1a1c7f977e0a93fdf91606d01c1a9dacfd4328502948bed0bc9514e4f66846bc1f245aa5abad88d56679092fee01007cade7ee72a49a498d51a26ba5cf0896cd9143d457262976f682bf31833ee99b5301f349dd2815e76a8b9a6cec5e000bd6bdafcb9536379b6cd0351cfe345abb1f"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0x2fe4a74041c1ce1c}, 0x48) sendmsg$NL802154_CMD_GET_SEC_DEVKEY(r10, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000480)={0x1c, r9, 0xf21, 0x70bd28, 0x25dfdbfc, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r11}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4044085}, 0x24008840) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r3, &(0x7f0000000400)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000340)={0x48, r4, 0x20, 0x70bd2a, 0x25dfdbff, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r5}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r11}]}, 0x48}, 0x1, 0x0, 0x0, 0x800}, 0x0) sendmsg$NLBL_MGMT_C_ADD(r1, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB='[\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="08002abd7000ffdbdf25010000000800040001000000080007000000000014000500fc01000000000000000000000000000114000500ff0100000000000000000000000000010900010073797a31000000000800040001000000"], 0x60}}, 0x14040000) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000040), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)={'wpan3\x00'}) r14 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r14, &(0x7f0000000680)={0x28, 0x0, 0x0, @hyper}, 0x10) connect$vsock_stream(r14, &(0x7f0000001300)={0x28, 0x0, 0x2710}, 0x10) 514.233041ms ago: executing program 0 (id=5701): socket$nl_route(0x10, 0x3, 0x0) (async) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$tipc(0x1e, 0x2, 0x0) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f000000b500), 0xffffffffffffffff) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000040)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_TID_CONFIG(r3, &(0x7f000000d040)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)={0x34, r2, 0x8de13c6b70ae92c3, 0x41003, 0x0, {{}, {@val={0x8, 0x3, r4}, @void}}, [@NL80211_ATTR_TID_CONFIG={0x18, 0x11d, 0x0, 0x1, [{0x14, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_TIDS={0x6, 0x5, 0xe}, @NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE={0x5}]}]}]}, 0x34}, 0x1, 0x0, 0x0, 0x800}, 0x0) (async) sendmsg$NL80211_CMD_SET_TID_CONFIG(r3, &(0x7f000000d040)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)={0x34, r2, 0x8de13c6b70ae92c3, 0x41003, 0x0, {{}, {@val={0x8, 0x3, r4}, @void}}, [@NL80211_ATTR_TID_CONFIG={0x18, 0x11d, 0x0, 0x1, [{0x14, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_TIDS={0x6, 0x5, 0xe}, @NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE={0x5}]}]}]}, 0x34}, 0x1, 0x0, 0x0, 0x800}, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) r5 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r5, 0x10f, 0x87, &(0x7f0000000040)={0x41}, 0x10) (async) setsockopt$TIPC_GROUP_JOIN(r5, 0x10f, 0x87, &(0x7f0000000040)={0x41}, 0x10) r6 = socket$tipc(0x1e, 0x2, 0x0) sendmsg$tipc(r6, &(0x7f0000000180)={&(0x7f0000000080)=@nameseq={0x1e, 0x1, 0x0, {0x41}}, 0x10, 0x0}, 0x0) (async) sendmsg$tipc(r6, &(0x7f0000000180)={&(0x7f0000000080)=@nameseq={0x1e, 0x1, 0x0, {0x41}}, 0x10, 0x0}, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000003c0)) (async) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r8, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000001740)=[{&(0x7f0000000280)='>', 0x33fe0}], 0x1}, 0x3) shutdown(r7, 0x2) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000000c0)={'bridge_slave_1\x00'}) (async) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000000c0)={'bridge_slave_1\x00', 0x0}) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000003780)={0x0, 0x0, &(0x7f0000003740)={&(0x7f00000000c0)={{0x14}, [@NFT_MSG_DELRULE={0xc0, 0x8, 0xa, 0x301, 0x0, 0x0, {0x3, 0x0, 0x2}, [@NFTA_RULE_HANDLE={0xc, 0x3, 0x1, 0x0, 0x3}, @NFTA_RULE_POSITION_ID={0x8, 0xa, 0x1, 0x0, 0x2}, @NFTA_RULE_HANDLE={0xc, 0x3, 0x1, 0x0, 0x3}, @NFTA_RULE_ID={0x8, 0x9, 0x1, 0x0, 0x3}, @NFTA_RULE_HANDLE={0xc, 0x3, 0x1, 0x0, 0x3}, @NFTA_RULE_CHAIN_ID={0x8, 0xb, 0x1, 0x0, 0x2}, @NFTA_RULE_COMPAT={0x4c, 0x5, 0x0, 0x1, [@NFTA_RULE_COMPAT_PROTO_BRIDGE={0x8, 0x1, 0x1, 0x0, 0x11}, @NFTA_RULE_COMPAT_PROTO_IPV6={0x8, 0x1, 0x1, 0x0, 0x5c}, @NFTA_RULE_COMPAT_PROTO_IPV4={0x8, 0x1, 0x1, 0x0, 0x5e}, @NFTA_RULE_COMPAT_PROTO_IPV6={0x8, 0x1, 0x1, 0x0, 0x3a}, @NFTA_RULE_COMPAT_PROTO_IPV4={0x8, 0x1, 0x1, 0x0, 0x8}, @NFTA_RULE_COMPAT_PROTO_BRIDGE={0x8, 0x1, 0x1, 0x0, 0x6003}, @NFTA_RULE_COMPAT_PROTO_BRIDGE={0x8, 0x1, 0x1, 0x0, 0x884c}, @NFTA_RULE_COMPAT_PROTO_IPV4={0x8, 0x1, 0x1, 0x0, 0x84}, @NFTA_RULE_COMPAT_FLAGS={0x8, 0x2, 0x1, 0x0, 0x1}]}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_RULE_POSITION={0xc, 0x6, 0x1, 0x0, 0x1}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz0\x00'}]}, @NFT_MSG_DELSETELEM={0x5c, 0xe, 0xa, 0x5, 0x0, 0x0, {0x3, 0x0, 0x7}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz2\x00'}, @NFTA_SET_ELEM_LIST_SET_ID={0x8, 0x4, 0x1, 0x0, 0x2}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x10, 0x3, 0x0, 0x1, [{0x8, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0x4}]}, {0x4}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0xa}}}, 0x144}, 0x1, 0x0, 0x0, 0x80}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000001c0)=ANY=[@ANYBLOB="440000001000090400"/20, @ANYRES32=r9, @ANYBLOB="020000000000000024001280110001006272696467655f736c617665000000000c00058005002b"], 0x44}, 0x1, 0x0, 0x0, 0x20000080}, 0x0) syz_emit_ethernet(0x4e, &(0x7f00000003c0)={@multicast, @remote, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, '\x00@\x00', 0x18, 0x3a, 0xff, @dev={0xfe, 0x80, '\x00', 0x46}, @mcast2, {[], @ndisc_na={0x88, 0x0, 0x0, 0xd2, '\x00', @private0}}}}}}, 0x0) 496.569792ms ago: executing program 1 (id=5702): bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0xd, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="1800000041ffffff00000000080000009111b9000000000095"], &(0x7f00000001c0)='syzkaller\x00', 0x3, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x1d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffff9}, 0x94) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x13, &(0x7f0000000240)=0x100000001, 0x59) connect$inet6(r1, &(0x7f0000000200)={0xa, 0x4e22, 0xb6, @ipv4={'\x00', '\xff\xff', @local}, 0xc4ca}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000080)=0x2, 0x4) sendto$inet6(r1, &(0x7f0000000300)='S', 0xfffffffffffffe94, 0xc000, 0x0, 0x0) setsockopt$sock_int(r1, 0x1, 0x20, &(0x7f0000000000)=0x2100e6d4, 0x4) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0xf, 0x0, 0x0) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), r0) sendmsg$NL80211_CMD_SET_WDS_PEER(r0, &(0x7f0000000280)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f00000001c0)={&(0x7f00000003c0)=ANY=[@ANYBLOB="5c00002b6df3816154fcab2380d900014500", @ANYRES16=r2, @ANYBLOB="000427bd7000fcdbdf25420000000a00060050505050505000000a00060050505050505000000a00060050505050505000000a00060008021100000100000a00060008021100000000000a0006000802110000000000"], 0x5c}, 0x1, 0x0, 0x0, 0x200408c4}, 0x8010) r3 = bpf$PROG_LOAD(0x5, 0x0, 0x0) close(r3) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="700200001300290a000000000000000007000000", @ANYRES32, @ANYBLOB="000000000000000010010c8013000c800ca3488008000000000000000800038064001d"], 0x270}, 0x1, 0x0, 0x0, 0x20008014}, 0x4) r4 = socket(0x10, 0x3, 0x0) r5 = socket(0x10, 0x3, 0x4) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000380)={'bridge_slave_0\x00', 0x0}) sendmsg$nl_route(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="700200001300290a000000000000000007000000", @ANYRES32=r6], 0x270}, 0x1, 0x0, 0x0, 0x20008014}, 0x4) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000000)=@newqdisc={0x24, 0x24, 0xd31, 0x0, 0x4, {0x0, 0x0, 0x0, 0x0, {}, {0xffff, 0xffff}, {0x0, 0xfff1}}}, 0x24}}, 0x0) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000000c0)={0x0}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000340)=ANY=[], 0x48}, 0x1, 0x0, 0x0, 0x806}, 0x24004801) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000000)={'netdevsim0\x00', 0x0}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)=ANY=[@ANYRESHEX=r2, @ANYRES32=r9, @ANYBLOB="1000018004000480080001"], 0x28}}, 0x0) sendmmsg(r7, &(0x7f00000002c0), 0x40000000000009f, 0x0) sendmmsg(r4, &(0x7f0000000000), 0x400000000000235, 0x0) r10 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r11 = syz_genetlink_get_family_id$nbd(&(0x7f0000000200), r10) sendmsg$NBD_CMD_CONNECT(r10, &(0x7f00000027c0)={0x0, 0x0, &(0x7f0000002780)={&(0x7f00000002c0)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r11, @ANYBLOB="010029bd7000fbdbdf25010000000c00020000000000000000001c0007801800018008000100", @ANYBLOB="04"], 0x3c}, 0x1, 0x0, 0x0, 0x4000004}, 0x4000) 307.554725ms ago: executing program 4 (id=5703): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000400)={'syzkaller0\x00', 0x7101}) syz_init_net_socket$llc(0x1a, 0x1, 0x0) socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket(0x400000000010, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)=@getqdisc={0x2c, 0x26, 0x8, 0x70bd2d, 0x25dfdbfd, {0x0, 0x0, 0x0, r2, {0xa, 0xffe0}, {0xf, 0x2}, {0xfffd, 0xffe0}}, [{0x4}, {0x4}]}, 0x2c}, 0x1, 0x0, 0x0, 0x8040}, 0x20) sendmsg$nl_route_sched(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000500)=@newtfilter={0x130, 0x2c, 0x800, 0x70fd2c, 0x25dfdbbd, {0x0, 0x0, 0x0, r2, {0xc, 0xc}, {}, {0x7, 0xfff1}}, [@filter_kind_options=@f_basic={{0xa}, {0x100, 0x2, [@TCA_BASIC_EMATCHES={0xfc, 0x2, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x2}}, @TCA_EMATCH_TREE_LIST={0xf0, 0x2, 0x0, 0x1, [@TCF_EM_CONTAINER={0xec, 0x2, 0x0, 0x0, {{0x3ff, 0x0, 0x6}, "4628e1aa71cafaa270898e4f7787e00f361bd367fb98df500f683a2c053f1a18acaa68414b1418121d73006d54eb13bc006e708a35409811bdf679eec8d9027b5e9e6a6aeeb0ae7a2a73ef3af7190b9a12e56f9fd93a485d897b3267cc1f9324977de3e2f285089256da0b58cc5fca1fd035ae9aebebf2e2bb281f5c2fe5554398cd57d2e5b1f08b97ba1ce2811885083192e1070f945e1cf5b3d88db8deb6c0bee3a8dae132a0d4002576d33a56372a262f1b1173bf3fbab70aa61f9f30b3fb557a36a3a54177933c069e1c1e915e1e9130eac529745cf8c3044abbbfa6"}}]}]}]}}]}, 0x130}, 0x1, 0x0, 0x0, 0x20041090}, 0xc080) socket$nl_route(0x10, 0x3, 0x0) 201.747541ms ago: executing program 2 (id=5704): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_FIOSETOWN(r1, 0x8901, &(0x7f00000003c0)) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000d40), 0xffffffffffffffff) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_REG(r4, &(0x7f0000000f00)={0x0, 0x0, &(0x7f0000000ec0)={&(0x7f0000000500)=ANY=[@ANYBLOB="7c020000", @ANYRES16=r3, @ANYBLOB="f3f428bd7000fedbdf251a000000a000228044000080080005000600000008000400710c000008000300050000000800020003000000080002000180000008000200f3ffffff080002008600000008000500000800002c00008008000600ffff00000800010000000000080002000800000008000400ff01000008000200060000002c0000800800030009000000080005000100000008000200a0ec000008000300ff01000008000600010000000700210061610000050092000700000008009a0001000000a80122803400008008000200070000000800070034000000080006006c0000000800060003000000080001000500000008000600020000005c0000"], 0x27c}, 0x1, 0x0, 0x0, 0x4000880}, 0x20000090) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_GET_KEY(r2, &(0x7f0000000200)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f00000001c0)={&(0x7f0000000100)={0x84, r3, 0x0, 0x70bd26, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r5}, @void}}, [@NL80211_ATTR_KEY={0x24, 0x50, 0x0, 0x1, [@NL80211_KEY_DATA_WEP104={0x11, 0x1, "a839610d34395c04b1e61bee53"}, @NL80211_KEY_TYPE={0x8, 0x7, 0x2}, @NL80211_KEY_DEFAULT={0x4}]}, @NL80211_ATTR_KEY_TYPE={0x8}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_KEY={0x30, 0x50, 0x0, 0x1, [@NL80211_KEY_TYPE={0x8, 0x7, 0x2}, @NL80211_KEY_DEFAULT_TYPES={0x10, 0x8, 0x0, 0x1, [@NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}]}, @NL80211_KEY_DATA_WEP104={0x11, 0x1, "fc12c9355b19b47d5ccd2809ea"}]}]}, 0x84}, 0x1, 0x0, 0x0, 0x24000000}, 0x4008040) r6 = syz_genetlink_get_family_id$nbd(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$NBD_CMD_CONNECT(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000003c0)=ANY=[@ANYBLOB='h\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="010000000000000000000100000008000100400000000c000200700f0000000000000c00060003000000000000000a000a00272d5d29212b0000140007"], 0x6c}}, 0x0) 185.797911ms ago: executing program 0 (id=5705): bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000004c0)={0xffffffffffffffff, 0xe0, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, &(0x7f0000000040)=[0x0, 0x0, 0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, &(0x7f00000001c0)=[0x0], &(0x7f0000000240)=[0x0], 0x0, 0x31, &(0x7f0000000280)=[{}, {}, {}, {}, {}, {}, {}, {}, {}, {}], 0x50, 0x10, &(0x7f0000000300), &(0x7f0000000500), 0x34, 0x36, 0x8, 0x8, &(0x7f0000000380)}}, 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000700)={0xc, 0x3, &(0x7f0000000680)=@framed={{0x18, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0xaa97}}, 0x0, 0x3a6, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x20, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb}, 0x94) r1 = socket$inet6(0xa, 0x2, 0x0) mmap(&(0x7f0000000000/0x95c000)=nil, 0x95c000, 0x2000009, 0x8c4b815a5465c2b1, 0xffffffffffffffff, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$IP6T_SO_GET_REVISION_TARGET(r2, 0x29, 0x45, 0x0, &(0x7f0000000380)) setsockopt$inet6_int(r1, 0x29, 0x35, &(0x7f0000000000)=0x8000, 0x4) bind$inet6(r1, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) setsockopt$inet6_int(r1, 0x29, 0xb, &(0x7f00000000c0)=0x1, 0x4) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="10000000040000000400000003"], 0x50) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x6, 0xd, &(0x7f0000000200)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffb}, [@call={0x85, 0x0, 0x0, 0x5}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r3}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x6}, {}, {0x4}, {0x6, 0x0, 0xa}, {}, {}, {0x85, 0x0, 0x0, 0x33}}]}, &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x46, '\x00', 0x0, @xdp=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100}, 0x94) r5 = socket$kcm(0xa, 0x922000000003, 0x11) setsockopt$sock_attach_bpf(r5, 0x29, 0x24, 0x0, 0x0) syz_init_net_socket$llc(0x1a, 0x1, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r6, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)=ANY=[@ANYBLOB="581800004400010029bd700004000000010000000400488040180180", @ANYRES32], 0x1858}, 0x1, 0x0, 0x0, 0x200408d1}, 0x4008094) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000b80)={r4, 0x2000012, 0xe, 0x0, &(0x7f0000000280)="63ec33c9e9b98600000000000000", 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xb}, 0x50) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$devlink(&(0x7f0000000600), 0xffffffffffffffff) socket$inet_mptcp(0x2, 0x1, 0x106) sendmsg$DEVLINK_CMD_RATE_GET(r7, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000640)=ANY=[@ANYBLOB="35d8f8d7", @ANYRES16=r8, @ANYBLOB="01002cbd7000fbdbdf2513000000"], 0x14}}, 0x40) socket(0x10, 0x80002, 0x0) socket$nl_rdma(0x10, 0x3, 0x14) setsockopt$IP_VS_SO_SET_ADD(0xffffffffffffffff, 0x0, 0x482, &(0x7f0000000040)={0x84, @broadcast, 0x4e2e, 0x3, 'lblc\x00', 0x11, 0x10000004, 0x9}, 0x2c) r9 = socket$kcm(0xa, 0x2, 0x0) r10 = socket$inet_sctp(0x2, 0x1, 0x84) openat$tcp_congestion(0xffffffffffffff9c, &(0x7f00000000c0), 0x1, 0x0) setsockopt$IP_VS_SO_SET_ADDDEST(0xffffffffffffffff, 0x0, 0x487, &(0x7f0000000000)={{0x84, @private=0xa010102, 0x4e21, 0x3, 'wrr\x00', 0x23, 0x81, 0x1}, {@initdev={0xac, 0x1e, 0x1, 0x0}, 0x4e23, 0x10000, 0x1cb, 0x12d61, 0x12d58}}, 0x44) setsockopt$IP_VS_SO_SET_ADDDEST(r10, 0x0, 0x487, &(0x7f0000000000)={{0x84, @rand_addr=0x64010100, 0x4e24, 0x3, 'lc\x00', 0x8, 0x323b, 0x55}, {@remote, 0x4e23, 0x10000, 0x0, 0x12d5c, 0x12d4c}}, 0x44) sendmsg$sock(r9, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e22, 0x0, @dev, 0xfffffeec}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0) 0s ago: executing program 1 (id=5706): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000000)=ANY=[@ANYRESDEC=0x0], 0x50) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000001c0)=@newlink={0x48, 0x10, 0x44b, 0x0, 0x1, {0x7a, 0x0, 0x0, 0x0, 0x9c12}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x18, 0x2, 0x0, 0x1, [@IFLA_BR_GROUP_ADDR={0xa, 0x14, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}}, @IFLA_BR_GROUP_FWD_MASK={0x6}]}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) r2 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000080)={0x3, 0x4, 0x4, 0xa, 0x0, r0, 0x8, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x2}, 0x50) r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000004c0)='cgroup.stat\x00', 0x0, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$batadv(&(0x7f0000000400), r4) sendmsg$BATADV_CMD_TP_METER(r4, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000440)={0x24, r5, 0x8, 0xef5b, 0x25dfdbfd, {}, [@BATADV_ATTR_HARD_IFINDEX={0x8}, @BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0xc}]}, 0x24}, 0x1, 0x0, 0x0, 0x4001}, 0x20000004) sendmsg$BATADV_CMD_GET_DAT_CACHE(r3, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x34, r5, 0x200, 0x70bd2c, 0x25dfdbfd, {}, [@BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x3}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x3}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x9}]}, 0x34}, 0x1, 0x0, 0x0, 0x20000084}, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x5, 0x16, &(0x7f0000000140)=@raw=[@ringbuf_output={{0x18, 0x1, 0x1, 0x0, 0x1}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x3}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x2}}, @snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x2}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r0}}], &(0x7f0000000200)='syzkaller\x00', 0x2b, 0x92, &(0x7f0000000240)=""/146, 0x41000, 0x3, '\x00', 0x0, @fallback=0x19, r3, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000300)={0x1, 0x8, 0x1, 0xffff462b}, 0x10, 0xffffffffffffffff, 0xffffffffffffffff, 0x4, 0x0, &(0x7f0000000340)=[{0x3, 0x5, 0x0, 0x6}, {0x1, 0x2, 0x3, 0x4}, {0x4, 0x5, 0xf, 0x8}, {0x3, 0x2, 0x6, 0x6}], 0x10, 0x100}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000480)={{r2}, &(0x7f0000000100), &(0x7f0000000440)=r6}, 0x20) r7 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) socket$inet(0x2, 0x4000000000000001, 0x0) r8 = socket$inet(0x2, 0x4000000000000001, 0x0) sendto$inet(r8, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$SO_BINDTODEVICE(r8, 0x1, 0x19, &(0x7f0000000000)='batadv_slave_1\x00', 0x10) r9 = socket$inet(0x2, 0x801, 0x0) bind$inet(r9, &(0x7f0000000000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r9, 0x0, 0xffffffffffffffb5, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x1, 0x1c, &(0x7f0000000d80)=ANY=[@ANYBLOB="1808000000000000000000000400000018110000", @ANYRES32=r7, @ANYBLOB="0000000000000000b7020000140000feb7030000000000008500000005000000bf0900000000000055090100000000009500000000000000b7020000000000007baa00fe00000000b5090800000000007baaf0ff00000000bf8700000000000007070000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018280000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7050000080000004602010076000000bf98000000000000be080000000000008500000007000000b70000000000000095"], &(0x7f0000000040)='syzkaller\x00', 0xb, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) kernel console output (not intermixed with test programs): ) [ 744.217589][T23424] syzkaller0: entered promiscuous mode [ 744.309491][T23424] syzkaller0: entered allmulticast mode [ 744.359309][ T5281] veth0_macvtap: left promiscuous mode [ 744.666393][T23518] pimreg: entered allmulticast mode [ 744.927537][T23537] openvswitch: netlink: IP tunnel dst address not specified [ 744.949054][T23537] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 745.017474][T23544] netlink: 52 bytes leftover after parsing attributes in process `syz.2.4375'. [ 745.120400][T23546] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4376'. [ 745.797519][T23565] netlink: 'syz.4.4379': attribute type 7 has an invalid length. [ 745.814805][T23565] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4379'. [ 746.134972][T23576] netlink: 40 bytes leftover after parsing attributes in process `syz.0.4382'. [ 746.159593][T23579] netlink: 220 bytes leftover after parsing attributes in process `syz.4.4384'. [ 746.200391][T23583] netlink: 220 bytes leftover after parsing attributes in process `syz.4.4384'. [ 746.344917][T23586] netlink: 32 bytes leftover after parsing attributes in process `syz.0.4386'. [ 747.058331][T21932] bond3: (slave ip6gretap2): link status up again after 0 ms [ 747.094476][T21932] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 747.218679][T21932] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 747.264902][ T30] audit: type=1804 audit(1785041030.312:43): pid=23626 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.1.4396" name="/newroot/370/cgroup.controllers" dev="tmpfs" ino=1930 res=1 errno=0 [ 747.314379][ T30] audit: type=1800 audit(1785041030.312:44): pid=23626 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.4396" name="cgroup.controllers" dev="tmpfs" ino=1930 res=0 errno=0 [ 747.339231][T21936] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 747.460969][T21936] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 747.603603][T21932] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 747.612103][ T1317] ieee802154 phy1 wpan1: encryption failed: -22 [ 747.743580][T21933] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 747.878243][T21933] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 748.346950][T23661] netlink: 'syz.1.4406': attribute type 1 has an invalid length. [ 749.306585][T23687] pimreg: left allmulticast mode [ 749.319898][T23687] lo: left allmulticast mode [ 749.445838][T23683] syzkaller0: entered promiscuous mode [ 749.471011][T23683] syzkaller0: entered allmulticast mode [ 753.043030][T23723] tipc: Enabling of bearer rejected, failed to enable media [ 753.080067][T21932] net_ratelimit: 4 callbacks suppressed [ 753.080089][T21932] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 753.228335][T21935] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 753.337588][T23747] netlink: 'syz.2.4424': attribute type 1 has an invalid length. [ 753.347010][T23748] netlink: 'syz.1.4426': attribute type 1 has an invalid length. [ 753.374366][T23748] __nla_validate_parse: 4 callbacks suppressed [ 753.374384][T23748] netlink: 224 bytes leftover after parsing attributes in process `syz.1.4426'. [ 753.414388][T23758] netlink: 'syz.1.4426': attribute type 1 has an invalid length. [ 753.449725][T23758] netlink: 224 bytes leftover after parsing attributes in process `syz.1.4426'. [ 753.570646][T23764] x_tables: ip6_tables: icmp6 match: only valid for protocol 58 [ 753.605849][T21932] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 753.694837][T23747] bond8: entered promiscuous mode [ 753.700628][T23747] 8021q: adding VLAN 0 to HW filter on device bond8 [ 753.820243][T21932] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 753.916855][T23776] netlink: 'syz.2.4429': attribute type 7 has an invalid length. [ 753.938338][T21932] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 754.483851][T23784] syzkaller0: entered promiscuous mode [ 754.511936][T23784] syzkaller0: entered allmulticast mode [ 754.804390][T23835] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4442'. [ 755.135601][T23841] IPVS: set_ctl: invalid protocol: 33 172.20.20.170:20004 [ 758.267015][T23835] workqueue: Failed to create a rescuer kthread for wq "bond5": -EINTR [ 758.268758][T21933] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 758.315001][T23843] veth9: entered allmulticast mode [ 758.534071][T23882] netlink: 28 bytes leftover after parsing attributes in process `syz.1.4447'. [ 758.548814][T23882] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4447'. [ 758.569017][T23862] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 758.585867][T23862] A link change request failed with some changes committed already. Interface virt_wifi0 may have been left with an inconsistent configuration, please check. [ 758.613808][T23885] netlink: 28 bytes leftover after parsing attributes in process `syz.1.4447'. [ 758.627152][T23886] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4447'. [ 758.638427][T21937] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 758.652210][T23868] netlink: 28 bytes leftover after parsing attributes in process `syz.2.4445'. [ 758.681794][T23882] batadv0: entered promiscuous mode [ 758.709269][T23882] 8021q: adding VLAN 0 to HW filter on device macsec1 [ 758.777269][T21936] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 759.168374][T21937] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 759.278476][T21936] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 759.329824][T23921] netlink: 'syz.1.4452': attribute type 1 has an invalid length. [ 759.410916][T23921] bond5: entered promiscuous mode [ 759.416642][T23921] 8021q: adding VLAN 0 to HW filter on device bond5 [ 759.433859][T21934] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 759.444657][T23926] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 759.512757][T23921] vlan4: entered allmulticast mode [ 759.518363][T23921] bond5: entered allmulticast mode [ 759.651877][T23927] bond5: (slave bridge8): making interface the new active one [ 759.688017][T23927] bridge8: entered promiscuous mode [ 759.694442][T23927] bridge8: entered allmulticast mode [ 759.712712][T23927] bond5: (slave bridge8): Enslaving as an active interface with an up link [ 759.828240][T21935] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 759.969082][T21936] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 760.090796][T21934] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 760.403655][T23975] macsec1: entered promiscuous mode [ 760.409314][T23975] dummy0: entered promiscuous mode [ 760.415011][T23975] macsec1: entered allmulticast mode [ 760.421584][T23975] dummy0: entered allmulticast mode [ 760.429833][T23975] dummy0: left allmulticast mode [ 760.473253][T10386] dummy0: left promiscuous mode [ 760.482617][T23972] netlink: 'syz.3.4460': attribute type 1 has an invalid length. [ 760.639834][T23972] 8021q: adding VLAN 0 to HW filter on device bond9 [ 760.767476][T23996] netdevsim netdevsim4 netdevsim0: entered allmulticast mode [ 760.820329][T23999] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4467'. [ 760.829711][T23999] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4467'. [ 760.839277][T23999] netlink: 'syz.2.4467': attribute type 11 has an invalid length. [ 760.856381][T23999] netlink: 'syz.2.4467': attribute type 13 has an invalid length. [ 760.889847][T24002] netlink: 'syz.4.4469': attribute type 1 has an invalid length. [ 761.002827][T24002] 8021q: adding VLAN 0 to HW filter on device bond6 [ 761.043854][T24005] bond6: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 761.167658][T24020] netlink: 128 bytes leftover after parsing attributes in process `syz.4.4473'. [ 761.256012][T24029] netlink: 104 bytes leftover after parsing attributes in process `syz.2.4474'. [ 761.342985][T24033] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4473'. [ 761.717703][T24054] block nbd4: not configured, cannot reconfigure [ 761.829394][T24054] IPVS: Scheduler module ip_vs_ not found [ 762.635013][T24102] nicvf0: Unable to set down delay as MII monitoring is disabled [ 762.714238][T24102] nicvf0 (unregistering): Released all slaves [ 762.776242][ C1] vcan0: j1939_tp_rxtimer: 0xffff88807abadc00: rx timeout, send abort [ 762.785096][ C1] vcan0: j1939_xtp_rx_abort_one: 0xffff88807abadc00: 0x00100: (3) A timeout occurred and this is the connection abort to close the session. [ 762.980520][T24118] syzkaller0: entered promiscuous mode [ 762.990204][T24118] syzkaller0: entered allmulticast mode [ 763.032511][T24120] bond9: option all_slaves_active: invalid value (255) [ 763.043928][T24120] bond9 (unregistering): Released all slaves [ 763.368287][T21935] net_ratelimit: 14 callbacks suppressed [ 763.368309][T21935] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 763.509517][T21935] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 763.648309][T21934] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 763.778272][ T37] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 763.795829][T24145] bridge_slave_0: entered promiscuous mode [ 763.898944][ T37] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 763.960277][T24158] IPVS: ip_vs_edit_dest(): server weight less than zero [ 764.028534][T21933] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 764.117314][T24166] __nla_validate_parse: 2 callbacks suppressed [ 764.117330][T24166] netlink: 128 bytes leftover after parsing attributes in process `syz.3.4507'. [ 764.134360][T24166] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 764.178254][T21934] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 764.308562][T21935] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 764.331297][T24181] netlink: 'syz.1.4511': attribute type 1 has an invalid length. [ 764.407222][T24185] veth9: entered allmulticast mode [ 764.429667][T21935] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 764.541119][T24190] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4513'. [ 764.660612][T24200] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4515'. [ 764.787920][T24206] syz_tun: entered promiscuous mode [ 765.157597][T24221] bridge9: entered promiscuous mode [ 765.164962][T24221] bridge9: entered allmulticast mode [ 765.175066][T24221] team0: Port device bridge9 added [ 765.403980][T24234] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4527'. [ 765.413391][T24234] veth1_vlan: left allmulticast mode [ 765.432601][T24234] bridge0: port 3(macvlan0) entered disabled state [ 765.462050][T24234] netlink: 'syz.2.4527': attribute type 2 has an invalid length. [ 765.524340][T24234] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4527'. [ 765.698957][T24253] netlink: 16 bytes leftover after parsing attributes in process `syz.4.4530'. [ 765.721284][T24253] netlink: 16 bytes leftover after parsing attributes in process `syz.4.4530'. [ 766.331223][T24288] tap0: tun_chr_ioctl cmd 1074025677 [ 766.337314][T24288] tap0: linktype set to 774 [ 766.396717][T24292] netlink: 64 bytes leftover after parsing attributes in process `syz.4.4543'. [ 766.443339][T24296] netlink: 'syz.1.4544': attribute type 1 has an invalid length. [ 766.522014][T24296] 8021q: adding VLAN 0 to HW filter on device bond7 [ 766.571024][T24296] bond7: (slave gretap3): Enslaving as a backup interface with an up link [ 766.808993][T24316] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4547'. [ 766.993705][T24318] netlink: 24 bytes leftover after parsing attributes in process `syz.1.4550'. [ 767.597277][T24331] tipc: Enabled bearer , priority 0 [ 768.076068][T24367] IPVS: Scheduler module ip_vs_sip not found [ 768.409026][T21932] net_ratelimit: 31 callbacks suppressed [ 768.409067][T21932] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 768.485444][T24322] x_tables: ip6_tables: SNAT target: used from hooks OUTPUT, but only usable from INPUT/POSTROUTING [ 768.548406][T14219] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 768.593040][T24396] netlink: 'syz.3.4562': attribute type 2 has an invalid length. [ 768.601721][T24396] netlink: 'syz.3.4562': attribute type 1 has an invalid length. [ 768.610341][T24396] nbd: illegal input index -120127480 [ 768.676117][T14205] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 768.796544][T14207] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 768.918529][T12130] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 769.039313][T14207] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 769.079248][ T30] audit: type=1800 audit(1785041052.132:45): pid=24425 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.4569" name="memory.events" dev="tmpfs" ino=1967 res=0 errno=0 [ 769.150220][ T30] audit: type=1804 audit(1785041052.152:46): pid=24425 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.2.4569" name="/newroot/381/memory.events" dev="tmpfs" ino=1967 res=1 errno=0 [ 769.178585][T14205] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 769.443659][T24440] __nla_validate_parse: 3 callbacks suppressed [ 769.443680][T24440] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4574'. [ 769.463479][T24440] netlink: 24 bytes leftover after parsing attributes in process `syz.1.4574'. [ 769.760185][T24447] bond8 (unregistering): Released all slaves [ 770.130862][T12130] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 770.189179][T24473] x_tables: duplicate entry at hook 1 [ 770.258465][T21932] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 770.304502][T24479] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4582'. [ 770.384554][T24484] SET target dimension over the limit! [ 770.384592][T24485] netlink: 28 bytes leftover after parsing attributes in process `syz.0.4584'. [ 770.459555][T14219] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 770.588056][T24497] x_tables: duplicate entry at hook 1 [ 770.602066][T24495] netlink: 24 bytes leftover after parsing attributes in process `syz.2.4589'. [ 770.638695][T24498] 8021q: adding VLAN 0 to HW filter on device team0 [ 770.657357][T24498] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 770.686316][T24498] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 770.698712][T24498] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 770.709203][T24498] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 770.804253][T14207] bridge0: port 1(bridge_slave_0) entered blocking state [ 770.811503][T14207] bridge0: port 1(bridge_slave_0) entered listening state [ 770.824569][T14207] bridge0: port 2(bridge_slave_1) entered blocking state [ 770.831739][T14207] bridge0: port 2(bridge_slave_1) entered listening state [ 771.068008][T24513] netlink: 'syz.0.4592': attribute type 1 has an invalid length. [ 771.139522][T24518] netlink: 28 bytes leftover after parsing attributes in process `syz.0.4592'. [ 771.173506][T24513] 8021q: adding VLAN 0 to HW filter on device bond6 [ 771.192151][T24518] bond6: entered promiscuous mode [ 771.201908][T24520] netlink: 204 bytes leftover after parsing attributes in process `syz.1.4596'. [ 771.247088][T24513] bond6: (slave dummy0): making interface the new active one [ 771.254861][T24513] dummy0: entered promiscuous mode [ 771.261819][T24506] netlink: 28 bytes leftover after parsing attributes in process `syz.3.4590'. [ 771.271328][T24513] bond6: (slave dummy0): Enslaving as an active interface with an up link [ 771.797553][T24544] IPVS: set_ctl: invalid protocol: 58 127.0.0.1:20000 [ 772.128846][T24532] bridge0: port 3(veth0_virt_wifi) entered disabled state [ 773.186312][T24532] batman_adv: batadv0: Interface deactivated: gretap1 [ 773.370107][T24544] netlink: 'syz.4.4603': attribute type 12 has an invalid length. [ 773.379758][T24544] netlink: 132 bytes leftover after parsing attributes in process `syz.4.4603'. [ 773.427270][T14219] net_ratelimit: 7 callbacks suppressed [ 773.427293][T14219] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 773.484332][T14205] netdevsim netdevsim1 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 773.509976][T14205] netdevsim netdevsim1 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 773.533977][T14205] netdevsim netdevsim1 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 773.556321][T14205] netdevsim netdevsim1 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 773.624227][T14205] netdevsim netdevsim1 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 773.668422][T14205] netdevsim netdevsim1 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 773.685422][T14205] netdevsim netdevsim1 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 773.706387][T14205] netdevsim netdevsim1 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 774.458413][T14205] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 774.632170][T12130] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 774.667906][T24622] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4613'. [ 774.689774][T24623] xt_hashlimit: size too large, truncated to 1048576 [ 774.705720][T24622] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4613'. [ 774.767679][T24622] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4613'. [ 774.806602][T24622] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4613'. [ 774.839073][T24622] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4613'. [ 774.871562][T24622] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4613'. [ 774.911806][T24622] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4613'. [ 774.948434][T24622] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4613'. [ 775.006437][T24622] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4613'. [ 775.080062][T24622] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4613'. [ 775.264621][T21932] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 775.322512][T24645] openvswitch: netlink: EtherType 50a is less than min 600 [ 775.398887][T21932] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 775.701133][T24660] netdevsim netdevsim1 netdevsim2: entered promiscuous mode [ 775.709749][T24660] netdevsim netdevsim1 netdevsim2: entered allmulticast mode [ 775.717962][T24660] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 775.758946][T24664] block nbd4: server does not support multiple connections per device. [ 775.763140][T12130] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 775.780423][T24664] block nbd4: shutting down sockets [ 775.908373][ T6334] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 776.244228][T24682] bridge0: port 2(bridge_slave_1) entered disabled state [ 776.251936][T24682] bridge0: port 1(bridge_slave_0) entered disabled state [ 776.602542][T24705] netlink: 'syz.0.4623': attribute type 1 has an invalid length. [ 776.801451][T24682] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 776.981536][T24682] netdevsim netdevsim4 netdevsim0: left allmulticast mode [ 777.013567][T24682] bridge2: left promiscuous mode [ 777.019439][T24682] bridge2: left allmulticast mode [ 777.172573][T24707] bond7: option primary: mode dependency failed, not supported in mode balance-rr(0) [ 777.226624][T24707] bond7 (unregistering): Released all slaves [ 777.315509][T24713] bridge16: entered promiscuous mode [ 777.388909][T12130] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 777.508279][T21935] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 777.614918][T24752] ipt_ECN: cannot use operation on non-tcp rule [ 777.631789][T24752] xt_socket: unknown flags 0x4 [ 778.430557][T21932] net_ratelimit: 7 callbacks suppressed [ 778.430581][T21932] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 778.520619][T24787] Cannot find del_set index 17 as target [ 778.579333][T12130] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 778.698593][T21932] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 778.770867][T24800] syzkaller0: entered promiscuous mode [ 778.781236][T24800] syzkaller0: entered allmulticast mode [ 778.938571][T21932] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 779.048468][T21932] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 779.169261][T14219] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 779.358318][T21932] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 779.488291][T12130] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 779.959812][T14219] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 780.313485][T24877] netlink: 'syz.0.4658': attribute type 17 has an invalid length. [ 780.327167][T24877] __nla_validate_parse: 14 callbacks suppressed [ 780.327191][T24877] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4658'. [ 780.349483][T12130] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 780.518983][T24884] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4663'. [ 781.205210][T24872] team0: Port device netdevsim1 removed [ 781.648508][T24928] syzkaller0: entered promiscuous mode [ 781.654225][T24928] syzkaller0: entered allmulticast mode [ 781.660646][T24931] FAULT_INJECTION: forcing a failure. [ 781.660646][T24931] name failslab, interval 1, probability 0, space 0, times 1 [ 781.681923][T24931] CPU: 0 UID: 0 PID: 24931 Comm: syz.1.4676 Not tainted syzkaller #0 PREEMPT(full) [ 781.681953][T24931] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 781.681964][T24931] Call Trace: [ 781.682052][T24931] [ 781.682111][T24931] dump_stack_lvl+0xe8/0x150 [ 781.682252][T24931] should_fail_ex+0x40c/0x560 [ 781.682349][T24931] should_failslab+0xa8/0x100 [ 781.682418][T24931] kmem_cache_alloc_node_noprof+0xb3/0x610 [ 781.682450][T24931] ? local_lock_release+0x9c/0x160 [ 781.682532][T24931] ? __alloc_skb+0x1d7/0x7a0 [ 781.682548][T24931] ? __alloc_skb+0x1d7/0x7a0 [ 781.682572][T24931] __alloc_skb+0x1d7/0x7a0 [ 781.682594][T24931] netlink_ack+0x136/0xb30 [ 781.682667][T24931] ? __kmalloc_cache_noprof+0x150/0x660 [ 781.682693][T24931] ? nfnetlink_rcv+0x1021/0x28c0 [ 781.682749][T24931] nfnetlink_rcv+0x260c/0x28c0 [ 781.682805][T24931] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 781.682887][T24931] ? netlink_deliver_tap+0x2e/0x1b0 [ 781.682923][T24931] ? netlink_deliver_tap+0x2e/0x1b0 [ 781.682945][T24931] ? netlink_deliver_tap+0x2e/0x1b0 [ 781.682973][T24931] netlink_unicast+0x7bb/0x940 [ 781.683005][T24931] netlink_sendmsg+0x813/0xb40 [ 781.683039][T24931] ? __pfx_netlink_sendmsg+0x10/0x10 [ 781.683067][T24931] ? aa_sock_msg_perm+0xf1/0x1b0 [ 781.683144][T24931] ? __pfx_netlink_sendmsg+0x10/0x10 [ 781.683167][T24931] sock_sendmsg_nosec+0x13a/0x180 [ 781.683228][T24931] ____sys_sendmsg+0x54e/0x850 [ 781.683258][T24931] ? __pfx_____sys_sendmsg+0x10/0x10 [ 781.683292][T24931] ? import_iovec+0x73/0xa0 [ 781.683328][T24931] ___sys_sendmsg+0x2a5/0x360 [ 781.683349][T24931] ? __lock_acquire+0x683/0x2cf0 [ 781.683409][T24931] ? __pfx____sys_sendmsg+0x10/0x10 [ 781.683481][T24931] ? __fget_files+0x2a/0x420 [ 781.683528][T24931] ? __fget_files+0x3a2/0x420 [ 781.683567][T24931] __x64_sys_sendmsg+0x1b1/0x290 [ 781.683594][T24931] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 781.683638][T24931] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 781.683705][T24931] do_syscall_64+0x174/0x580 [ 781.683787][T24931] ? trace_irq_disable+0x3b/0x140 [ 781.683833][T24931] ? clear_bhb_loop+0x40/0x90 [ 781.683866][T24931] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 781.683887][T24931] RIP: 0033:0x7f587f79de99 [ 781.683927][T24931] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 781.683944][T24931] RSP: 002b:00007f58805ef028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 781.683989][T24931] RAX: ffffffffffffffda RBX: 00007f587fa25fa0 RCX: 00007f587f79de99 [ 781.684004][T24931] RDX: 0000000000000000 RSI: 00002000000000c0 RDI: 0000000000000003 [ 781.684017][T24931] RBP: 00007f58805ef090 R08: 0000000000000000 R09: 0000000000000000 [ 781.684029][T24931] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 781.684041][T24931] R13: 00007f587fa26038 R14: 00007f587fa25fa0 R15: 00007ffcb582de78 [ 781.684075][T24931] [ 782.115016][T24936] netlink: 4768 bytes leftover after parsing attributes in process `syz.0.4678'. [ 782.148562][T24936] netlink: 4768 bytes leftover after parsing attributes in process `syz.0.4678'. [ 782.315128][T24941] bridge11: entered promiscuous mode [ 782.330793][T24941] bridge11: entered allmulticast mode [ 782.371441][T24950] sctp: [Deprecated]: syz.4.4681 (pid 24950) Use of struct sctp_assoc_value in delayed_ack socket option. [ 782.371441][T24950] Use struct sctp_sack_info instead [ 782.603865][T24962] netlink: 16 bytes leftover after parsing attributes in process `syz.0.4687'. [ 782.786036][T24967] FAULT_INJECTION: forcing a failure. [ 782.786036][T24967] name failslab, interval 1, probability 0, space 0, times 0 [ 782.803540][T24967] CPU: 1 UID: 0 PID: 24967 Comm: syz.0.4689 Not tainted syzkaller #0 PREEMPT(full) [ 782.803571][T24967] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 782.803584][T24967] Call Trace: [ 782.803592][T24967] [ 782.803601][T24967] dump_stack_lvl+0xe8/0x150 [ 782.803640][T24967] should_fail_ex+0x40c/0x560 [ 782.803673][T24967] should_failslab+0xa8/0x100 [ 782.803707][T24967] __kmalloc_cache_noprof+0xa8/0x660 [ 782.803738][T24967] ? nf_tables_newchain+0x1e10/0x28b0 [ 782.803851][T24967] ? nf_tables_newchain+0x1e10/0x28b0 [ 782.803890][T24967] nf_tables_newchain+0x1e10/0x28b0 [ 782.803940][T24967] ? __pfx_nf_tables_newchain+0x10/0x10 [ 782.804006][T24967] ? nfnl_pernet+0x23/0x240 [ 782.804029][T24967] ? nfnl_pernet+0x23/0x240 [ 782.804062][T24967] ? __nla_parse+0x40/0x60 [ 782.804101][T24967] nfnetlink_rcv+0x1288/0x28c0 [ 782.804163][T24967] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 782.804205][T24967] ? ref_tracker_free+0x689/0x830 [ 782.804295][T24967] ? skb_clone+0x246/0x3a0 [ 782.804324][T24967] ? __netlink_deliver_tap+0x811/0x860 [ 782.804359][T24967] ? netlink_deliver_tap+0x2e/0x1b0 [ 782.804391][T24967] ? netlink_deliver_tap+0x2e/0x1b0 [ 782.804424][T24967] netlink_unicast+0x7bb/0x940 [ 782.804460][T24967] netlink_sendmsg+0x813/0xb40 [ 782.804496][T24967] ? __pfx_netlink_sendmsg+0x10/0x10 [ 782.804527][T24967] ? aa_sock_msg_perm+0xf1/0x1b0 [ 782.804558][T24967] ? __pfx_netlink_sendmsg+0x10/0x10 [ 782.804582][T24967] sock_sendmsg_nosec+0x13a/0x180 [ 782.804617][T24967] ____sys_sendmsg+0x54e/0x850 [ 782.804649][T24967] ? __pfx_____sys_sendmsg+0x10/0x10 [ 782.804684][T24967] ? import_iovec+0x73/0xa0 [ 782.804720][T24967] ___sys_sendmsg+0x2a5/0x360 [ 782.804743][T24967] ? __lock_acquire+0x683/0x2cf0 [ 782.804778][T24967] ? __pfx____sys_sendmsg+0x10/0x10 [ 782.804844][T24967] ? __fget_files+0x2a/0x420 [ 782.804873][T24967] ? __fget_files+0x3a2/0x420 [ 782.804911][T24967] __x64_sys_sendmsg+0x1b1/0x290 [ 782.804939][T24967] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 782.804984][T24967] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 782.805009][T24967] do_syscall_64+0x174/0x580 [ 782.805033][T24967] ? trace_irq_disable+0x3b/0x140 [ 782.805061][T24967] ? clear_bhb_loop+0x40/0x90 [ 782.805087][T24967] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 782.805107][T24967] RIP: 0033:0x7f2acdd9de99 [ 782.805128][T24967] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 782.805146][T24967] RSP: 002b:00007f2acec43028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 782.805169][T24967] RAX: ffffffffffffffda RBX: 00007f2ace025fa0 RCX: 00007f2acdd9de99 [ 782.805183][T24967] RDX: 0000000000000000 RSI: 00002000000000c0 RDI: 0000000000000003 [ 782.805196][T24967] RBP: 00007f2acec43090 R08: 0000000000000000 R09: 0000000000000000 [ 782.805208][T24967] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 782.805220][T24967] R13: 00007f2ace026038 R14: 00007f2ace025fa0 R15: 00007fff7509b868 [ 782.805254][T24967] [ 783.394158][T24978] netlink: 36 bytes leftover after parsing attributes in process `syz.4.4693'. [ 783.425623][T24978] netlink: 16 bytes leftover after parsing attributes in process `syz.4.4693'. [ 783.460741][T24978] netlink: 36 bytes leftover after parsing attributes in process `syz.4.4693'. [ 783.509366][T24976] syzkaller0: entered promiscuous mode [ 783.515564][T24976] syzkaller0: entered allmulticast mode [ 783.528392][T21935] net_ratelimit: 12 callbacks suppressed [ 783.528415][T21935] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 783.648391][T21935] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 783.691280][T24998] netlink: 'syz.2.4697': attribute type 4 has an invalid length. [ 783.709635][T24998] netlink: 'syz.2.4697': attribute type 4 has an invalid length. [ 783.718378][T24999] netlink: 'syz.2.4697': attribute type 4 has an invalid length. [ 786.792104][T21935] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 786.938246][T21932] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 786.960718][T25019] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4701'. [ 786.970435][T25018] netlink: 14 bytes leftover after parsing attributes in process `syz.1.4699'. [ 787.048321][T21935] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 787.104936][T25028] syzkaller0: entered promiscuous mode [ 787.110849][T25028] syzkaller0: entered allmulticast mode [ 787.402236][T25038] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4706'. [ 787.498463][T14210] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 787.587953][T25045] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4707'. [ 787.598551][T25045] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4707'. [ 787.628630][T12130] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 787.659579][T25047] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4707'. [ 787.738273][T21935] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 787.837681][T25053] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4710'. [ 787.926366][T25055] syzkaller0: entered promiscuous mode [ 787.932267][T25055] syzkaller0: entered allmulticast mode [ 791.078779][T14210] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 791.219263][T14207] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 791.236192][T25076] hsr0: entered promiscuous mode [ 791.338655][T14207] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 791.437102][T25086] netlink: 'syz.2.4719': attribute type 1 has an invalid length. [ 791.507620][T25091] netlink: 16 bytes leftover after parsing attributes in process `syz.1.4720'. [ 791.518676][T14205] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 791.538509][T25091] netlink: 16 bytes leftover after parsing attributes in process `syz.1.4720'. [ 791.553272][T25092] netlink: 16 bytes leftover after parsing attributes in process `syz.1.4720'. [ 791.624361][T25075] hsr0: left promiscuous mode [ 791.666359][ T6334] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 791.800832][ T6334] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 791.882825][T25114] x_tables: duplicate underflow at hook 2 [ 791.893141][T25116] netlink: 'syz.3.4721': attribute type 4 has an invalid length. [ 791.952943][ T6334] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 791.980749][T25114] pim6reg1: entered promiscuous mode [ 791.989646][T25114] pim6reg1: entered allmulticast mode [ 792.088410][ T6334] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 792.211369][T14207] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 792.329291][T12130] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 792.607755][T25160] netlink: 'syz.3.4741': attribute type 16 has an invalid length. [ 792.619196][T25160] netlink: 'syz.3.4741': attribute type 17 has an invalid length. [ 792.711995][T25161] __nla_validate_parse: 29 callbacks suppressed [ 792.712019][T25161] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4740'. [ 792.802968][T25161] netdevsim netdevsim4 netdevsim0: entered promiscuous mode [ 792.813300][T25161] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 792.821612][T25161] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4740'. [ 793.016364][T25180] netlink: 'syz.0.4747': attribute type 1 has an invalid length. [ 793.109551][T25186] netlink: 'syz.2.4749': attribute type 1 has an invalid length. [ 793.140254][T25185] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4748'. [ 793.211423][T25186] bond11: entered promiscuous mode [ 793.217274][T25186] 8021q: adding VLAN 0 to HW filter on device bond11 [ 793.255085][T25195] netlink: 76 bytes leftover after parsing attributes in process `syz.3.4751'. [ 793.346550][T25186] 8021q: adding VLAN 0 to HW filter on device bond11 [ 793.354399][T25186] bond11: (slave gre2): The slave device specified does not support setting the MAC address [ 793.365553][T25186] bond11: (slave gre2): Setting fail_over_mac to active for active-backup mode [ 793.381767][T25186] bond11: (slave gre2): making interface the new active one [ 793.390114][T25186] gre2: entered promiscuous mode [ 793.394596][T25203] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4751'. [ 793.407645][T25186] bond11: (slave gre2): Enslaving as an active interface with an up link [ 793.787533][T25209] netlink: 48 bytes leftover after parsing attributes in process `syz.0.4756'. [ 793.836535][T25219] bridge0: port 2(bridge_slave_1) entered disabled state [ 793.844138][T25219] bridge0: port 1(bridge_slave_0) entered disabled state [ 793.882403][T25209] netlink: 52 bytes leftover after parsing attributes in process `syz.0.4756'. [ 793.895291][T25223] netlink: 'syz.4.4759': attribute type 1 has an invalid length. [ 793.958726][T25210] netlink: 76 bytes leftover after parsing attributes in process `syz.0.4756'. [ 794.025437][T25223] workqueue: Failed to create a rescuer kthread for wq "bond7": -EINTR [ 794.037147][T25210] netlink: 52 bytes leftover after parsing attributes in process `syz.0.4756'. [ 794.195770][T25236] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4761'. [ 794.241333][T25238] batman_adv: batadv0: Adding interface: vlan5 [ 794.247738][T25238] batman_adv: batadv0: Not using interface vlan5 (retrying later): interface not active [ 794.724831][ T30] audit: type=1107 audit(1785041077.772:47): pid=25256 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='' [ 795.347266][T25289] tc_dump_action: action bad kind [ 795.577812][T25302] ip6gre2: entered promiscuous mode [ 795.595288][T25302] ip6gre2: entered allmulticast mode [ 796.168345][T12130] net_ratelimit: 27 callbacks suppressed [ 796.168369][T12130] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 796.352265][T14207] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 796.498461][T12130] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 796.648263][T14210] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 796.768315][T14210] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 797.098801][T25352] netlink: 'syz.0.4794': attribute type 10 has an invalid length. [ 797.128267][T12130] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 797.248770][T14205] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 797.303325][T25358] netlink: 'syz.4.4798': attribute type 1 has an invalid length. [ 797.358837][T12130] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 797.408516][T25358] 8021q: adding VLAN 0 to HW filter on device bond7 [ 797.474576][ T6334] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 797.619955][T14205] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 797.837854][T25384] bridge0: port 2(bridge_slave_1) entered blocking state [ 797.845183][T25384] bridge0: port 2(bridge_slave_1) entered forwarding state [ 797.852978][T25384] bridge0: port 1(bridge_slave_0) entered blocking state [ 797.860299][T25384] bridge0: port 1(bridge_slave_0) entered forwarding state [ 797.935645][T25367] __nla_validate_parse: 11 callbacks suppressed [ 797.935669][T25367] netlink: 101 bytes leftover after parsing attributes in process `syz.1.4799'. [ 797.975198][T25384] sch_tbf: burst 0 is lower than device ipvlan0 mtu (1514) ! [ 798.407635][T25411] netlink: 'syz.4.4808': attribute type 6 has an invalid length. [ 798.640235][T25423] netlink: 116 bytes leftover after parsing attributes in process `syz.2.4809'. [ 798.821322][T25418] tipc: Enabling of bearer rejected, failed to enable media [ 798.953492][T14205] dvmrp0: left allmulticast mode [ 798.973170][T14205] bond5: left allmulticast mode [ 799.414309][T25447] netlink: 40 bytes leftover after parsing attributes in process `syz.0.4815'. [ 799.526199][T14205] batman_adv: batadv0: Removing interface: gretap1 [ 799.738627][T14205] bond8 (unregistering): (slave gretap2): Releasing active interface [ 799.842324][T14205] bond1 (unregistering): (slave geneve3): Releasing active interface [ 800.003385][T14205] bond11 (unregistering): (slave bridge5): Releasing backup interface [ 800.012559][T14205] bridge5 (unregistering): left promiscuous mode [ 800.020764][T14205] bridge5 (unregistering): left allmulticast mode [ 800.041134][T14205] team0: Port device bridge6 removed [ 800.076405][T14205] bond0 (unregistering): Released all slaves [ 800.101327][T14205] bond1 (unregistering): Released all slaves [ 800.126505][T14205] bond2 (unregistering): (slave veth3): Releasing active interface [ 800.135290][T14205] batadv1: entered promiscuous mode [ 800.152535][T14205] bond2 (unregistering): (slave batadv1): Releasing active interface [ 800.162097][T14205] bond2 (unregistering): Released all slaves [ 800.183869][T14205] bond3 (unregistering): Released all slaves [ 800.205917][T14205] bond4 (unregistering): Released all slaves [ 800.224433][T25460] netlink: 28 bytes leftover after parsing attributes in process `syz.4.4820'. [ 800.234595][T14205] bond5 (unregistering): Released all slaves [ 800.265448][T14205] bond6 (unregistering): Released all slaves [ 800.280329][T14205] bond7 (unregistering): Released all slaves [ 800.294939][T14205] bond8 (unregistering): Released all slaves [ 800.311482][T14205] bond9 (unregistering): Released all slaves [ 800.328007][T14205] bond10 (unregistering): Released all slaves [ 800.354982][T14205] bond11 (unregistering): Released all slaves [ 800.373956][T14205] bond12 (unregistering): (slave batadv2): Releasing active interface [ 800.383808][T14205] bond12 (unregistering): Released all slaves [ 800.585833][T25469] netlink: 20 bytes leftover after parsing attributes in process `syz.1.4822'. [ 801.071871][T14205] tipc: Left network mode [ 801.091591][T25500] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4826'. [ 801.178934][T14207] net_ratelimit: 13 callbacks suppressed [ 801.178967][T14207] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 801.423483][T25508] Bluetooth: hci4: Opcode 0x0401 failed: -22 [ 801.778573][T21937] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 801.876884][T25533] netlink: 92 bytes leftover after parsing attributes in process `syz.0.4834'. [ 802.299112][T25543] syzkaller1: tun_chr_ioctl cmd 1074025677 [ 802.309206][T25543] syzkaller1: linktype set to 768 [ 802.322967][T25545] macvlan0: entered promiscuous mode [ 802.338332][T21932] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 802.469903][T21937] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 802.580099][T21937] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 802.714111][T25553] xt_hashlimit: size too large, truncated to 1048576 [ 803.243316][T25577] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 803.992615][T25582] netlink: 20 bytes leftover after parsing attributes in process `syz.2.4845'. [ 806.058913][ T6334] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 806.124702][T25584] syzkaller0: entered promiscuous mode [ 806.154915][T25584] syzkaller0: entered allmulticast mode [ 806.227805][T25596] netlink: 20 bytes leftover after parsing attributes in process `syz.2.4848'. [ 806.260140][T25596] x_tables: duplicate underflow at hook 1 [ 806.314911][T25597] netlink: 'syz.0.4849': attribute type 10 has an invalid length. [ 806.338763][T25597] netlink: 16154 bytes leftover after parsing attributes in process `syz.0.4849'. [ 806.358414][T21937] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 806.488293][T21937] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 806.499936][T25606] sctp: [Deprecated]: syz.1.4852 (pid 25606) Use of int in max_burst socket option deprecated. [ 806.499936][T25606] Use struct sctp_assoc_value instead [ 806.532638][T25606] IPv6: NLM_F_CREATE should be specified when creating new route [ 807.186941][T21932] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 807.435742][T25643] netlink: 28 bytes leftover after parsing attributes in process `syz.2.4860'. [ 808.330261][T14205] hsr_slave_0: left promiscuous mode [ 808.550460][T14205] hsr_slave_1: left promiscuous mode [ 808.887164][T25636] netlink: 'syz.1.4861': attribute type 10 has an invalid length. [ 808.895730][T25636] netlink: 16154 bytes leftover after parsing attributes in process `syz.1.4861'. [ 808.911193][T14207] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 809.022907][T25652] tipc: Started in network mode [ 809.035739][T25652] tipc: Node identity 7ed15d2dfe91, cluster identity 4711 [ 809.047045][ T1317] ieee802154 phy1 wpan1: encryption failed: -22 [ 809.070029][T25652] tipc: Enabled bearer , priority 0 [ 809.118229][ T6334] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 809.239462][ T6334] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 809.351079][T25673] openvswitch: netlink: Missing valid actions attribute. [ 809.360425][T25673] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 809.373454][T14207] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 809.508312][T14207] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 809.600298][T14205] IPVS: stop unused estimator thread 0... [ 809.738480][T25690] netlink: 'syz.0.4874': attribute type 10 has an invalid length. [ 809.746748][T25690] netlink: 16154 bytes leftover after parsing attributes in process `syz.0.4874'. [ 810.212258][T24564] tipc: Node number set to 2151701805 [ 810.435109][T25696] netlink: 176 bytes leftover after parsing attributes in process `syz.0.4875'. [ 810.604764][T25729] netlink: 'syz.4.4882': attribute type 11 has an invalid length. [ 810.622090][T25729] netlink: 32 bytes leftover after parsing attributes in process `syz.4.4882'. [ 810.761346][T25739] netlink: 20 bytes leftover after parsing attributes in process `syz.1.4886'. [ 810.930606][T25749] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4888'. [ 811.468540][T21932] net_ratelimit: 14 callbacks suppressed [ 811.468564][T21932] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 811.588245][T21932] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 811.708578][T25765] netlink: 'syz.4.4893': attribute type 21 has an invalid length. [ 811.718423][T21932] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 811.720482][T25765] netlink: 128 bytes leftover after parsing attributes in process `syz.4.4893'. [ 811.736912][T25765] netlink: 'syz.4.4893': attribute type 5 has an invalid length. [ 811.753360][T25765] netlink: 3 bytes leftover after parsing attributes in process `syz.4.4893'. [ 811.758005][T25768] netlink: 48 bytes leftover after parsing attributes in process `syz.2.4894'. [ 811.839552][T17976] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 811.906783][T25778] netlink: 180 bytes leftover after parsing attributes in process `syz.1.4896'. [ 811.958538][T17976] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 812.078573][T21932] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 812.192147][T21932] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 812.199963][T25795] netlink: 'syz.0.4902': attribute type 2 has an invalid length. [ 812.293002][T25795] D†'|o: entered promiscuous mode [ 812.308346][T21932] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 812.450137][T21937] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 812.479127][T25807] sctp: [Deprecated]: syz.1.4906 (pid 25807) Use of struct sctp_assoc_value in delayed_ack socket option. [ 812.479127][T25807] Use struct sctp_sack_info instead [ 812.536502][T25808] netlink: 16 bytes leftover after parsing attributes in process `syz.4.4904'. [ 812.674207][T21937] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 812.696965][T25812] netlink: 'syz.1.4908': attribute type 1 has an invalid length. [ 813.225028][T25835] ip6gretap0: left promiscuous mode [ 813.250976][T25835] 8021q: adding VLAN 0 to HW filter on device team0 [ 813.271200][T25835] batadv0: left promiscuous mode [ 813.287762][T25835] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 813.296147][T25835] veth0: left promiscuous mode [ 813.407289][T25835] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 813.428243][T25835] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 813.456118][T24572] batman_adv: batadv0: Interface activated: vlan5 [ 813.533895][ T6334] bridge0: port 3(veth0_virt_wifi) entered blocking state [ 813.541239][ T6334] bridge0: port 3(veth0_virt_wifi) entered listening state [ 813.937302][T25875] netlink: 'syz.2.4925': attribute type 1 has an invalid length. [ 813.984057][T25875] bond12: entered promiscuous mode [ 813.992298][T25875] 8021q: adding VLAN 0 to HW filter on device bond12 [ 814.035294][T25875] netlink: 'syz.2.4925': attribute type 2 has an invalid length. [ 814.069970][T25875] macvtap0: entered allmulticast mode [ 814.091097][T25875] macvtap1: entered allmulticast mode [ 814.116197][T25875] bond12: (slave bridge12): making interface the new active one [ 814.127238][T25875] bridge12: entered promiscuous mode [ 814.140636][T25875] bond12: (slave bridge12): Enslaving as an active interface with an up link [ 815.051619][T25920] llcp: llcp_sock_recvmsg: Recv datagram failed state 4 -11 0 [ 815.057994][T25922] llcp: llcp_sock_recvmsg: Recv datagram failed state 4 -512 0 [ 815.212520][T25929] xt_HMARK: proto mask must be zero with L3 mode [ 815.411951][T25934] __nla_validate_parse: 7 callbacks suppressed [ 815.411972][T25934] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4940'. [ 815.414473][T25938] netlink: 20 bytes leftover after parsing attributes in process `syz.4.4941'. [ 815.424753][T25934] syzkaller0: left promiscuous mode [ 815.444020][T25934] syzkaller0: left allmulticast mode [ 815.824199][T25961] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4944'. [ 815.844403][T25961] x_tables: ip_tables: ah match: only valid for protocol 51 [ 815.852942][T25961] netlink: 14 bytes leftover after parsing attributes in process `syz.3.4944'. [ 815.963504][T25967] netlink: 64 bytes leftover after parsing attributes in process `syz.2.4949'. [ 815.988366][T25967] syzkaller1: entered promiscuous mode [ 815.994218][T25967] syzkaller1: entered allmulticast mode [ 816.049687][T25974] netlink: 'syz.1.4951': attribute type 2 has an invalid length. [ 816.064024][T25974] netlink: 'syz.1.4951': attribute type 2 has an invalid length. [ 816.374112][T25993] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4957'. [ 816.391016][T25993] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4957'. [ 816.417796][ T6334] netdevsim netdevsim0 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 816.425689][T25986] netlink: 'syz.1.4955': attribute type 3 has an invalid length. [ 816.431226][T25993] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4957'. [ 816.442876][T25986] netlink: 'syz.1.4955': attribute type 1 has an invalid length. [ 816.448337][ T6334] netdevsim netdevsim0 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 816.452051][T25986] netlink: 232 bytes leftover after parsing attributes in process `syz.1.4955'. [ 816.479866][T25993] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4957'. [ 816.490452][ T6334] netdevsim netdevsim0 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 816.514856][ T6334] net_ratelimit: 26 callbacks suppressed [ 816.514878][ T6334] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 816.541378][T21936] netdevsim netdevsim0 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 816.638336][ T6334] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 816.758251][T14207] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 816.777239][T26003] netlink: 'syz.3.4952': attribute type 18 has an invalid length. [ 816.878268][T14207] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 816.988892][T21936] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 817.041168][T26024] tc_dump_action: action bad kind [ 817.131299][T21936] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 817.145019][T26028] netlink: 'syz.3.4952': attribute type 18 has an invalid length. [ 817.258497][T21932] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 817.383023][ T6334] netdevsim netdevsim3 eth0: set [0, 1] type 1 family 0 port 4352 - 0 [ 817.391809][ T6334] netdevsim netdevsim3 eth1: set [0, 1] type 1 family 0 port 4352 - 0 [ 817.401295][ T6334] netdevsim netdevsim3 eth2: set [0, 1] type 1 family 0 port 4352 - 0 [ 817.409512][T26035] workqueue: Failed to create a rescuer kthread for wq "nfc2_nci_rx_wq": -EINTR [ 817.411818][ T6334] netdevsim netdevsim3 eth3: set [0, 1] type 1 family 0 port 4352 - 0 [ 817.445937][ T6334] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 817.579694][T14207] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 817.699746][T14207] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 818.132411][T26060] netlink: 'syz.0.4975': attribute type 1 has an invalid length. [ 818.794203][T26052] faux_driver regulatory: loading /lib/firmware/regulatory.db failed with error -4 [ 818.819714][T26052] faux_driver regulatory: Direct firmware load for regulatory.db failed with error -4 [ 818.829767][T26052] faux_driver regulatory: Falling back to sysfs fallback for: regulatory.db [ 818.894432][T26060] 8021q: adding VLAN 0 to HW filter on device bond8 [ 818.928717][T26063] bond8: (slave veth5): Enslaving as an active interface with a down link [ 818.952465][T26066] 8021q: adding VLAN 0 to HW filter on device batadv1 [ 818.965968][T26066] bond8: (slave batadv1): making interface the new active one [ 818.976950][T26066] batadv1: entered promiscuous mode [ 818.984008][T26066] bond8: (slave batadv1): Enslaving as an active interface with an up link [ 819.094895][T26077] 8021q: adding VLAN 0 to HW filter on device bond13 [ 819.292274][ T30] audit: type=1107 audit(1785041102.342:48): pid=26095 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='ù0BòXuò‹|J‚VésÚêR•®jÅæÆÁl6,sC`è³!/ç¯ý?pbcXW€ù çm4ÿ¾ñe=- Ø®@b&áÚn3W§èÔ [ 819.292274][ T30] ëšNÎM¢kG [ 819.292274][ T30] ±nDIdž0͵jCÜåghý:5Ú縼Ӡ4·Š}9v­tÿ!¦U×R^3Ö@tÞ¸»SÁ–†ÆE`.ˬÁµw²XA;îùÈq€%IKÞÖ* –6u‡¤wu‹Ö!>§'+M“èõ>· Eñ‚þ@~Swìç €, «ÕŒÛb‰¤±t/Ûº€À¬—Šáfc÷Dý·A—Ã’*ÏÌu´“ÆœZàòÁØe"/ÙÿÛ:«øpÐBV–ï[@¸C¤žÌÐø½ú=›lÝP¤«›¡\m®gØ' [ 821.317914][T26174] ip6tnl8: entered allmulticast mode [ 821.510857][T21936] ip6_tunnel: ip6tnl8 xmit: Local address not yet configured! [ 821.525593][T21936] ip6_tunnel: ip6tnl8 xmit: Local address not yet configured! [ 821.527511][T26182] __nla_validate_parse: 16 callbacks suppressed [ 821.527528][T26182] netlink: 2 bytes leftover after parsing attributes in process `syz.2.5006'. [ 821.548493][T24564] ip6_tunnel: ip6tnl8 xmit: Local address not yet configured! [ 821.556967][T21936] net_ratelimit: 23 callbacks suppressed [ 821.556988][T21936] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 821.698286][T21936] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 821.839781][T21936] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 821.851860][T10386] ip6_tunnel: ip6tnl8 xmit: Local address not yet configured! [ 821.888419][T10386] ip6_tunnel: ip6tnl8 xmit: Local address not yet configured! [ 821.890871][T26193] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5009'. [ 821.927175][T26194] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5009'. [ 821.978383][T21936] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 822.103947][T26197] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5010'. [ 822.113701][T26197] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5010'. [ 822.122902][T14207] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 822.246221][T14207] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 822.266051][T26206] netlink: 24 bytes leftover after parsing attributes in process `syz.1.5013'. [ 822.370548][T14205] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 822.488344][ T6334] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 822.574666][T26216] netlink: 'syz.2.5016': attribute type 1 has an invalid length. [ 822.720852][T26219] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5017'. [ 822.733663][T26216] 8021q: adding VLAN 0 to HW filter on device bond14 [ 822.778228][T21932] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 822.898777][T14207] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 823.230455][T26260] netlink: 12 bytes leftover after parsing attributes in process `syz.3.5019'. [ 823.590210][T26277] netlink: 24 bytes leftover after parsing attributes in process `syz.1.5030'. [ 823.792214][T26297] Bluetooth: hci0: Opcode 0x0401 failed: -22 [ 823.837665][T26260] netlink: 20 bytes leftover after parsing attributes in process `syz.3.5019'. [ 824.178476][T26316] syzkaller0: entered promiscuous mode [ 824.185272][T26316] syzkaller0: entered allmulticast mode [ 824.222009][T26316] tipc: Enabled bearer , priority 0 [ 824.890345][T26315] tipc: Resetting bearer [ 825.050841][T26315] tipc: Disabling bearer [ 825.323371][T26347] syzkaller0: entered promiscuous mode [ 825.329554][T26347] syzkaller0: entered allmulticast mode [ 825.438956][ C0] ip6_tunnel: ip6tnl8 xmit: Local address not yet configured! [ 826.317301][T26369] tipc: Cannot configure node identity twice [ 826.360245][T26389] 8021q: VLANs not supported on bond0 [ 826.543161][T26386] ip6erspan1: entered allmulticast mode [ 826.628965][ T6334] net_ratelimit: 24 callbacks suppressed [ 826.628989][ T6334] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 826.789354][T14205] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 827.147825][T26406] A link change request failed with some changes committed already. Interface virt_wifi0 may have been left with an inconsistent configuration, please check. [ 827.278721][T26412] Cannot find del_set index 17 as target [ 827.355858][T26418] __nla_validate_parse: 12 callbacks suppressed [ 827.355880][T26418] netlink: 16178 bytes leftover after parsing attributes in process `syz.0.5066'. [ 827.395034][T26420] netlink: 24 bytes leftover after parsing attributes in process `syz.2.5067'. [ 827.408646][T21937] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 827.471145][T26420] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5067'. [ 827.487931][T26423] netlink: 'syz.4.5069': attribute type 11 has an invalid length. [ 827.568315][T14207] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 827.658457][T26433] netlink: 16 bytes leftover after parsing attributes in process `syz.4.5072'. [ 827.684734][T26433] netlink: 28 bytes leftover after parsing attributes in process `syz.4.5072'. [ 827.699854][T14207] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 827.758833][T26438] team_slave_1: entered promiscuous mode [ 827.845569][T26443] IPVS: set_ctl: invalid protocol: 60 224.0.0.2:20001 [ 827.899043][T14207] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 827.976811][T26444] netlink: 'syz.3.5064': attribute type 2 has an invalid length. [ 827.996500][T26444] netlink: 'syz.3.5064': attribute type 8 has an invalid length. [ 828.006493][T26444] netlink: 132 bytes leftover after parsing attributes in process `syz.3.5064'. [ 828.020040][T14207] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 828.140993][T21937] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 828.258242][T14207] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 828.298285][T26463] netlink: 16178 bytes leftover after parsing attributes in process `syz.2.5080'. [ 828.606405][T26478] netlink: 'syz.2.5084': attribute type 3 has an invalid length. [ 828.742236][T26487] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5086'. [ 828.881562][ C1] bridge0: port 3(veth0_virt_wifi) entered learning state [ 829.057822][T26494] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5087'. [ 829.145055][T26509] netlink: 12 bytes leftover after parsing attributes in process `syz.1.5090'. [ 829.157690][T26509] workqueue: Failed to create a rescuer kthread for wq "bond8": -EINTR [ 829.586542][T26526] lo: entered allmulticast mode [ 829.605620][T26526] tunl0: entered allmulticast mode [ 829.614970][T26526] gre0: entered allmulticast mode [ 829.621202][T26526] gretap0: entered allmulticast mode [ 829.631345][T26526] erspan0: entered allmulticast mode [ 829.638892][T26526] ip_vti0: entered allmulticast mode [ 829.645075][T26526] ip6_vti0: entered allmulticast mode [ 829.659617][T26526] sit0: entered allmulticast mode [ 829.671125][T26526] ip6tnl0: entered allmulticast mode [ 829.680241][T26526] ip6gre0: entered allmulticast mode [ 829.688904][T26526] ip6gretap0: entered allmulticast mode [ 829.695515][T26526] bridge0: entered allmulticast mode [ 829.702972][T26526] vcan0: entered allmulticast mode [ 829.709519][T26526] team0: entered allmulticast mode [ 829.714962][T26526] bridge3: entered allmulticast mode [ 829.722182][T26526] bridge4: entered allmulticast mode [ 829.730399][T26526] v: entered allmulticast mode [ 829.736132][T26526] nlmon0: entered allmulticast mode [ 829.743416][T26526] batadv0: entered allmulticast mode [ 829.749729][T26526] veth0: entered allmulticast mode [ 829.756359][T26526] veth1: entered allmulticast mode [ 829.763411][T26526] wg0: entered allmulticast mode [ 829.769787][T26526] wg1: entered allmulticast mode [ 829.775518][T26526] wg2: entered allmulticast mode [ 829.783154][T26526] veth0_to_bridge: entered allmulticast mode [ 829.801145][T26526] bridge_slave_0: entered allmulticast mode [ 829.819954][T26526] veth1_to_bridge: entered allmulticast mode [ 829.840989][T26526] bridge_slave_1: entered allmulticast mode [ 829.858650][T26526] veth0_to_bond: entered allmulticast mode [ 829.876111][T26526] bond_slave_0: entered allmulticast mode [ 829.892813][T26526] veth0_to_team: entered allmulticast mode [ 829.909268][T26526] team_slave_0: entered allmulticast mode [ 829.920436][T26526] veth1_to_team: entered allmulticast mode [ 829.927125][T26526] team_slave_1: left promiscuous mode [ 829.933058][T26526] team_slave_1: entered allmulticast mode [ 829.950377][T26526] veth0_to_batadv: entered allmulticast mode [ 829.966190][T26526] batadv_slave_0: entered allmulticast mode [ 829.976067][T26526] veth1_to_batadv: entered allmulticast mode [ 829.985620][T26526] batadv_slave_1: entered allmulticast mode [ 829.993746][T26526] xfrm0: entered allmulticast mode [ 830.003920][T26526] veth0_to_hsr: entered allmulticast mode [ 830.012967][T26526] hsr_slave_0: entered allmulticast mode [ 830.029257][T26526] veth1_to_hsr: entered allmulticast mode [ 830.046209][T26526] hsr_slave_1: entered allmulticast mode [ 830.060755][T26526] hsr0: entered allmulticast mode [ 830.079267][T26526] veth1_virt_wifi: entered allmulticast mode [ 830.100850][T26526] virt_wifi0: entered allmulticast mode [ 830.119683][T21932] batadv1: left promiscuous mode [ 830.507833][ T30] audit: type=1800 audit(1785041113.552:49): pid=26556 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.5098" name="r" dev="tmpfs" ino=2635 res=0 errno=0 [ 830.621830][T26562] syzkaller0: entered promiscuous mode [ 830.639243][T26562] syzkaller0: entered allmulticast mode [ 830.911385][T26590] netlink: 'syz.2.5105': attribute type 1 has an invalid length. [ 830.938284][T26590] netlink: 'syz.2.5105': attribute type 2 has an invalid length. [ 830.976527][T26589] netlink: 'syz.2.5105': attribute type 1 has an invalid length. [ 830.998745][T26589] netlink: 'syz.2.5105': attribute type 2 has an invalid length. [ 831.359118][T26612] syzkaller1: entered promiscuous mode [ 831.386936][T26612] syzkaller1: entered allmulticast mode [ 831.541886][T26618] netlink: 'syz.2.5111': attribute type 1 has an invalid length. [ 831.550084][T26618] netlink: 'syz.2.5111': attribute type 3 has an invalid length. [ 831.649188][T21936] net_ratelimit: 20 callbacks suppressed [ 831.649210][T21936] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 831.789625][T21932] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 831.883768][T26643] Unsupported ieee802154 address type: 0 [ 831.908480][T21937] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 832.044050][T21936] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 832.751900][T26665] bond10 (unregistering): Released all slaves [ 832.893872][T26681] __nla_validate_parse: 16 callbacks suppressed [ 832.893894][T26681] netlink: 28 bytes leftover after parsing attributes in process `syz.1.5123'. [ 832.936476][T26681] netlink: 20 bytes leftover after parsing attributes in process `syz.1.5123'. [ 833.005689][T26686] openvswitch: netlink: Actions may not be safe on all matching packets [ 833.009747][T26690] netlink: 20 bytes leftover after parsing attributes in process `syz.1.5123'. [ 833.100838][T21937] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 833.223635][T21937] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 833.257585][T26701] netlink: zone id is out of range [ 833.271424][T26701] netlink: zone id is out of range [ 833.282286][T26701] netlink: zone id is out of range [ 833.305781][T26705] netlink: 16178 bytes leftover after parsing attributes in process `syz.0.5128'. [ 833.358345][ C0] ip6_tunnel: ip6tnl8 xmit: Local address not yet configured! [ 833.612392][T26711] netlink: 'syz.1.5129': attribute type 4 has an invalid length. [ 833.699337][T26689] infiniband syz0: set active [ 833.705831][T26689] infiniband syz0: added ipvlan1 [ 833.744930][T26689] smbdirect: ib_dev[syz0]: added: IB_CA max_fast_reg_page_list_len=512 device_cap_flags=0x1c001223c76 kernel_cap_flags=0x14 page_size_cap=0xfffff000 [ 833.768193][T26689] smbdirect: ib_dev[syz0]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=32 max_cqe=32767 max_qp_wr=1048576 max_send_sge=32 max_recv_sge=32 [ 833.819759][T26689] smbdirect: ib_dev[syz0]PORT[1]: iwarp=0 ib=0 roce=1 v1=0 v2=1 core_cap_flags=0x803005 [ 833.976627][T26689] RDS/IB: syz0: added [ 833.986745][T26689] smc: adding ib device syz0 with port count 1 [ 834.002630][T26689] smc: ib device syz0 port 1 has no pnetid [ 834.351609][T26732] netlink: 4 bytes leftover after parsing attributes in process `syz.4.5135'. [ 834.404062][T26727] netlink: 4 bytes leftover after parsing attributes in process `syz.4.5135'. [ 835.170659][T26759] netlink: 16178 bytes leftover after parsing attributes in process `syz.1.5141'. [ 835.190946][T26762] xt_hashlimit: size too large, truncated to 1048576 [ 835.261368][T26763] netlink: 4 bytes leftover after parsing attributes in process `syz.4.5143'. [ 835.303648][T26765] netlink: 12 bytes leftover after parsing attributes in process `syz.1.5144'. [ 835.419828][T26765] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5144'. [ 835.501863][T26765] veth13: entered allmulticast mode [ 835.530024][T26765] bond8: (slave veth13): Enslaving as an active interface with an up link [ 836.178869][T26795] syzkaller0: entered promiscuous mode [ 836.218285][T26795] syzkaller0: entered allmulticast mode [ 836.514452][T26812] netlink: 'syz.0.5154': attribute type 10 has an invalid length. [ 836.756440][T26820] dvmrp0: entered allmulticast mode [ 836.774566][T26822] netlink: 'syz.1.5160': attribute type 1 has an invalid length. [ 836.788328][T21932] net_ratelimit: 410 callbacks suppressed [ 836.788350][T21932] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 836.928217][T21932] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 837.048268][T21932] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 837.158283][T21936] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 837.193599][T26841] bridge: RTM_NEWNEIGH with unconfigured vlan 1 on bridge0 [ 837.638285][T14205] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 837.677690][T26852] netlink: 'syz.1.5166': attribute type 10 has an invalid length. [ 837.768922][T21937] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 837.948352][T21937] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 838.069730][T14205] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 838.180336][T26866] syzkaller1: entered promiscuous mode [ 838.198505][T26866] syzkaller1: entered allmulticast mode [ 838.237713][T26873] netlink: 'syz.2.5172': attribute type 9 has an invalid length. [ 838.359284][T14205] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 838.554691][T26886] bond6: (slave dummy0): Releasing active interface [ 838.562122][T26886] dummy0: left promiscuous mode [ 838.572969][T26886] batman_adv: batadv0: Adding interface: dummy0 [ 838.579439][T26886] batman_adv: batadv0: Not using interface dummy0 (retrying later): interface not active [ 838.618267][T14219] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 838.741739][T26894] netlink: 'syz.1.5177': attribute type 10 has an invalid length. [ 838.751489][T26894] __nla_validate_parse: 9 callbacks suppressed [ 838.751510][T26894] netlink: 16154 bytes leftover after parsing attributes in process `syz.1.5177'. [ 838.881087][T26904] netlink: 'syz.1.5180': attribute type 46 has an invalid length. [ 838.892472][T26904] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5180'. [ 838.935149][T26908] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5179'. [ 838.962827][T26909] tc_dump_action: action bad kind [ 839.354459][T26925] netlink: 16 bytes leftover after parsing attributes in process `syz.1.5185'. [ 839.366081][T26925] netlink: 'syz.1.5185': attribute type 1 has an invalid length. [ 839.379148][T26925] netlink: 'syz.1.5185': attribute type 2 has an invalid length. [ 839.387070][T26925] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5185'. [ 840.281841][T26959] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5197'. [ 840.320218][T26959] 8021q: adding VLAN 0 to HW filter on device bond0 [ 840.362071][T14207] bond0: (slave geneve4): link status definitely down, disabling slave [ 840.400468][T14207] geneve4: left promiscuous mode [ 840.420343][T14207] geneve4: left allmulticast mode [ 840.426009][T14207] bond0: now running without any active interface! [ 840.430299][T26958] netlink: 20 bytes leftover after parsing attributes in process `syz.1.5197'. [ 841.152710][T26987] netlink: 36 bytes leftover after parsing attributes in process `syz.4.5203'. [ 841.357628][T27003] netlink: 'syz.1.5209': attribute type 23 has an invalid length. [ 841.374620][T27000] netlink: 'syz.4.5210': attribute type 2 has an invalid length. [ 841.384756][T27000] netlink: 'syz.4.5210': attribute type 1 has an invalid length. [ 841.403789][T27007] netlink: 'syz.2.5212': attribute type 1 has an invalid length. [ 841.411973][T27000] netlink: 152 bytes leftover after parsing attributes in process `syz.4.5210'. [ 841.422943][T27007] netlink: 5984 bytes leftover after parsing attributes in process `syz.2.5212'. [ 841.664773][T27018] ip6t_srh: unknown srh match flags 4000 [ 841.746330][T27020] bridge_slave_1 (unregistering): left allmulticast mode [ 841.766113][T27020] bridge_slave_1 (unregistering): left promiscuous mode [ 841.788962][T27020] bridge0: port 2(bridge_slave_1) entered disabled state [ 841.851102][T21937] net_ratelimit: 23 callbacks suppressed [ 841.851127][T21937] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 841.865945][T27025] tipc: Enabled bearer , priority 0 [ 841.904687][T27024] tipc: Disabling bearer [ 842.147931][T27032] syzkaller1: entered promiscuous mode [ 842.156210][T27032] syzkaller1: entered allmulticast mode [ 842.198608][T14207] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 842.319548][T21937] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 842.440509][T21936] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 842.526555][T27063] xt_CT: You must specify a L4 protocol and not use inversions on it [ 842.608863][T21936] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 842.738310][T21936] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 842.878406][T21937] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 843.008677][T14219] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 843.468463][T14219] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 843.588784][T21937] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 843.652972][T27096] netlink: 'syz.4.5237': attribute type 11 has an invalid length. [ 843.810165][T27105] __nla_validate_parse: 1 callbacks suppressed [ 843.810165][T27104] netlink: 36 bytes leftover after parsing attributes in process `syz.0.5239'. [ 843.810184][T27105] netlink: 36 bytes leftover after parsing attributes in process `syz.0.5239'. [ 843.941189][T27115] netlink: 12 bytes leftover after parsing attributes in process `syz.4.5241'. [ 844.238937][ C1] bridge0: port 3(veth0_virt_wifi) entered forwarding state [ 844.246374][ C1] bridge0: topology change detected, propagating [ 844.413445][T27122] netlink: 60 bytes leftover after parsing attributes in process `syz.4.5241'. [ 844.649196][T27132] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5246'. [ 844.846660][T27136] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5247'. [ 844.925262][T27136] bridge0: port 3(veth0_virt_wifi) entered disabled state [ 845.216431][T27143] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5247'. [ 845.237713][T27136] veth0_virt_wifi (unregistering): left promiscuous mode [ 845.245798][T27136] bridge0: port 3(veth0_virt_wifi) entered disabled state [ 845.819583][T27175] netlink: 16 bytes leftover after parsing attributes in process `syz.1.5258'. [ 845.850977][T27177] netlink: 12 bytes leftover after parsing attributes in process `syz.4.5259'. [ 845.895495][T27182] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5258'. [ 845.933469][T27177] x_tables: duplicate underflow at hook 3 [ 846.044653][ T7419] block nbd4: Receive control failed (result -107) [ 846.349585][T27192] 8021q: adding VLAN 0 to HW filter on device bond9 [ 846.455187][T27164] dvmrp0: entered allmulticast mode [ 846.787908][T27224] netlink: 'syz.4.5266': attribute type 1 has an invalid length. [ 846.974741][T27224] 8021q: adding VLAN 0 to HW filter on device bond8 [ 847.025253][T27227] bond8: (slave gretap1): making interface the new active one [ 847.036659][T27227] bond8: (slave gretap1): Enslaving as an active interface with an up link [ 847.073954][T21936] net_ratelimit: 15 callbacks suppressed [ 847.073977][T21936] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 847.249532][T21939] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 847.371016][T27241] ipvlan2: entered promiscuous mode [ 847.377470][T27241] bridge0: port 2(ipvlan2) entered blocking state [ 847.384991][T27241] bridge0: port 2(ipvlan2) entered disabled state [ 847.394254][T27241] ipvlan2: entered allmulticast mode [ 847.401584][T27241] bridge0: entered allmulticast mode [ 847.413798][T27241] ipvlan2: left allmulticast mode [ 847.419420][T27241] bridge0: left allmulticast mode [ 847.449452][T21936] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 847.628345][T17976] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 847.738366][T17976] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 847.848246][T17976] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 847.859858][T27264] xt_hashlimit: size too large, truncated to 1048576 [ 847.903918][T27266] xt_hashlimit: size too large, truncated to 1048576 [ 847.911885][T27266] x_tables: ip6_tables: TCPMSS target: only valid for protocol 6 [ 847.959879][T17976] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 848.068302][T17976] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 848.181369][T21936] bond3: (slave ip6gretap2): failed to get link speed/duplex [ 848.254394][T27284] tipc: Enabled bearer , priority 0 [ 848.335609][T27284] syzkaller0: entered promiscuous mode [ 848.341597][T27284] syzkaller0: entered allmulticast mode [ 848.719084][ C0] ip6_tunnel: ip6tnl8 xmit: Local address not yet configured! [ 848.896623][T27295] tipc: Resetting bearer [ 848.964201][T21932] netdevsim netdevsim0 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 848.973780][T21932] netdevsim netdevsim0 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 848.983332][T27283] tipc: Resetting bearer [ 849.121081][T27320] __nla_validate_parse: 7 callbacks suppressed [ 849.121105][T27320] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5289'. [ 849.139993][T27320] netlink: 28 bytes leftover after parsing attributes in process `syz.4.5289'. [ 852.131801][T27283] tipc: Disabling bearer [ 852.141545][T21932] netdevsim netdevsim0 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 852.150945][T21932] netdevsim netdevsim0 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 852.160499][T21932] netdevsim netdevsim0 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 852.169882][T21932] netdevsim netdevsim0 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 852.376715][T27329] netlink: 'syz.4.5293': attribute type 39 has an invalid length. [ 855.235448][T21932] netdevsim netdevsim0 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 855.247721][T21932] netdevsim netdevsim0 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 855.480426][T27344] netlink: 'syz.0.5297': attribute type 2 has an invalid length. [ 855.864991][T10386] batman_adv: batadv0: Interface deactivated: vlan5 [ 855.890591][T27371] bridge_slave_1: default FDB implementation only supports local addresses [ 855.902009][T27369] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5305'. [ 855.931045][T27373] netlink: 'syz.0.5306': attribute type 1 has an invalid length. [ 855.939263][T27373] netlink: 96 bytes leftover after parsing attributes in process `syz.0.5306'. [ 856.076298][T27382] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5307'. [ 856.379874][T27392] ipvlan0: renamed from lo (while UP) [ 856.411622][T27392] ipvlan0: left allmulticast mode [ 856.421319][T27392] netlink: 12 bytes leftover after parsing attributes in process `syz.1.5311'. [ 856.614875][T27405] netlink: 76 bytes leftover after parsing attributes in process `syz.0.5316'. [ 856.641636][T27405] netlink: 6 bytes leftover after parsing attributes in process `syz.0.5316'. [ 856.652304][T27405] netlink: 6 bytes leftover after parsing attributes in process `syz.0.5316'. [ 856.876220][T27421] x_tables: duplicate underflow at hook 1 [ 856.927676][T27423] netlink: 'syz.0.5322': attribute type 1 has an invalid length. [ 856.951575][T27426] x_tables: duplicate underflow at hook 1 [ 857.193776][T27423] bond10: entered promiscuous mode [ 857.242203][ T50] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 857.245878][T27423] 8021q: adding VLAN 0 to HW filter on device bond10 [ 857.276060][ T50] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 857.285857][ T50] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 857.296651][ T50] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 857.306837][ T50] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 857.326228][T27428] bond10: (slave ipvlan2): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 857.339407][T27428] bond10: (slave ipvlan2): The slave device specified does not support setting the MAC address [ 857.350019][T27428] bond10: (slave ipvlan2): Setting fail_over_mac to active for active-backup mode [ 857.367691][ T7419] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 857.377714][ T7419] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 857.387854][ T7419] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 857.399740][T27441] netlink: 16 bytes leftover after parsing attributes in process `syz.2.5323'. [ 857.413175][ T7419] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 857.423970][ T7419] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 857.576370][T27441] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci2/hci2:200/input7 [ 857.696413][T27429] syzkaller0: entered promiscuous mode [ 857.708691][T27429] syzkaller0: entered allmulticast mode [ 857.738949][T27437] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 857.927449][T27454] netlink: 48 bytes leftover after parsing attributes in process `syz.4.5326'. [ 858.711687][T27485] syzkaller0: entered promiscuous mode [ 858.726858][T27485] syzkaller0: entered allmulticast mode [ 859.520991][ T7419] Bluetooth: hci2: command tx timeout [ 859.521759][ T5281] veth0_vlan: left promiscuous mode [ 859.581941][T10388] veth0_vlan: entered promiscuous mode [ 859.944068][T27529] SET target dimension over the limit! [ 860.556945][T27552] syzkaller0: entered promiscuous mode [ 860.574992][T27552] syzkaller0: entered allmulticast mode [ 860.746463][T27533] netlink: 24 bytes leftover after parsing attributes in process `syz.3.5335'. [ 860.983716][T27573] openvswitch: netlink: Message has 12 unknown bytes. [ 861.038967][T27573] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 861.062303][T27431] bridge0: port 1(bridge_slave_0) entered blocking state [ 861.081686][T27431] bridge0: port 1(bridge_slave_0) entered disabled state [ 861.085411][T27533] netlink: 'syz.3.5335': attribute type 18 has an invalid length. [ 861.095621][T27431] bridge_slave_0: entered allmulticast mode [ 861.097238][T27576] xt_CT: No such helper "pptp" [ 861.105020][T27431] bridge_slave_0: entered promiscuous mode [ 861.112235][T27533] netlink: 4 bytes leftover after parsing attributes in process `syz.3.5335'. [ 861.155726][T27431] bridge0: port 2(bridge_slave_1) entered blocking state [ 861.164075][T27431] bridge0: port 2(bridge_slave_1) entered disabled state [ 861.175104][T27431] bridge_slave_1: entered allmulticast mode [ 861.186206][T27431] bridge_slave_1: entered promiscuous mode [ 861.350196][T27533] netlink: 'syz.3.5335': attribute type 18 has an invalid length. [ 861.358637][T27533] netlink: 4 bytes leftover after parsing attributes in process `syz.3.5335'. [ 861.380860][T27431] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 861.416558][T27431] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 861.598228][ T7419] Bluetooth: hci2: command tx timeout [ 861.620707][T27431] team0: Port device team_slave_0 added [ 861.719157][T27431] team0: Port device team_slave_1 added [ 862.106526][T27605] netlink: 12 bytes leftover after parsing attributes in process `syz.3.5352'. [ 863.680132][ T7419] Bluetooth: hci2: command tx timeout [ 865.273278][T27614] ªªªªª»: renamed from vxcan1 [ 865.291448][T27431] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 865.326637][T27431] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 865.398348][T27431] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 865.420796][T27431] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 865.436510][T27431] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 865.492794][T27431] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 865.762074][ T7419] Bluetooth: hci2: command tx timeout [ 865.786575][T27431] hsr_slave_0: entered promiscuous mode [ 865.814861][T27431] hsr_slave_1: entered promiscuous mode [ 866.338323][T27656] IPVS: sync thread started: state = BACKUP, mcast_ifn = veth1_to_hsr, syncid = 1, id = 0 [ 866.672955][T27667] netlink: 4 bytes leftover after parsing attributes in process `syz.3.5366'. [ 866.948279][T27674] netlink: 20 bytes leftover after parsing attributes in process `syz.4.5370'. [ 866.969392][T27675] bridge5: entered promiscuous mode [ 866.975020][T27675] bridge5: entered allmulticast mode [ 866.983711][T27675] team0: Port device bridge5 added [ 867.033172][T27431] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 867.053174][T27431] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 867.070079][T27431] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 867.085152][T27431] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 867.094931][T27431] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 867.117782][T27431] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 867.128011][T27431] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 867.144559][T27431] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 867.163246][T27685] bridge13: the hash_elasticity option has been deprecated and is always 16 [ 867.172173][T27685] bridge13: entered allmulticast mode [ 867.182237][T27681] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 867.216823][T27688] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5372'. [ 867.257259][T27688] netlink: 28 bytes leftover after parsing attributes in process `syz.4.5372'. [ 867.466500][T27431] 8021q: adding VLAN 0 to HW filter on device bond0 [ 867.504346][T27431] 8021q: adding VLAN 0 to HW filter on device team0 [ 867.526974][T17972] bridge0: port 1(bridge_slave_0) entered blocking state [ 867.534324][T17972] bridge0: port 1(bridge_slave_0) entered forwarding state [ 867.608110][T17972] bridge0: port 2(bridge_slave_1) entered blocking state [ 867.615437][T17972] bridge0: port 2(bridge_slave_1) entered forwarding state [ 867.750558][T27716] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5380'. [ 867.813497][T27716] netlink: 'syz.2.5380': attribute type 10 has an invalid length. [ 868.104727][T27729] macvlan0: left promiscuous mode [ 868.135489][T27729] netdevsim netdevsim4 netdevsim0: left promiscuous mode [ 868.156276][T27734] sctp: [Deprecated]: syz.4.5383 (pid 27734) Use of int in max_burst socket option deprecated. [ 868.156276][T27734] Use struct sctp_assoc_value instead [ 868.244812][T27729] ip6erspan1: left allmulticast mode [ 868.329325][T27729] bridge5: left promiscuous mode [ 868.340366][T27729] bridge5: left allmulticast mode [ 868.365200][T27745] bridge0: port 2(bridge_slave_1) entered disabled state [ 868.544176][T27758] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5388'. [ 868.581474][T27758] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5388'. [ 868.699667][T27431] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 868.767454][T27764] netlink: 'syz.4.5389': attribute type 1 has an invalid length. [ 868.818725][T27764] 8021q: adding VLAN 0 to HW filter on device bond9 [ 868.867183][T27431] veth0_vlan: entered promiscuous mode [ 868.920283][T27431] veth1_vlan: entered promiscuous mode [ 869.051529][T27431] veth0_macvtap: entered promiscuous mode [ 869.106425][T27431] veth1_macvtap: entered promiscuous mode [ 869.122067][T27774] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5392'. [ 869.134773][T27774] netlink: 'syz.0.5392': attribute type 11 has an invalid length. [ 869.182941][T17972] netdevsim netdevsim0 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 869.205691][T17972] netdevsim netdevsim0 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 869.232968][T17972] netdevsim netdevsim0 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 869.259941][T17972] netdevsim netdevsim0 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 869.311209][T27431] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 869.353713][T27431] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 869.404370][T27795] netlink: 'syz.0.5394': attribute type 10 has an invalid length. [ 869.430373][T27795] netlink: 16154 bytes leftover after parsing attributes in process `syz.0.5394'. [ 869.464553][T14217] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 869.491981][T14217] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 869.505185][T14217] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 869.542869][T14217] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 869.716381][T27812] netlink: 132 bytes leftover after parsing attributes in process `syz.0.5397'. [ 870.028836][T17974] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 870.064749][T17974] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 870.117275][T14206] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 870.133126][T14206] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 870.152726][T27825] TCP: TCP_TX_DELAY enabled [ 870.277113][T27834] netlink: 'syz.4.5405': attribute type 10 has an invalid length. [ 870.428504][T27843] batadv1: entered promiscuous mode [ 870.438208][T27843] batadv1: entered allmulticast mode [ 870.449503][T27843] 8021q: adding VLAN 0 to HW filter on device batadv1 [ 870.485258][ T1317] ieee802154 phy1 wpan1: encryption failed: -22 [ 871.345760][T27891] netlink: 'syz.0.5417': attribute type 1 has an invalid length. [ 871.507627][T27897] xt_hashlimit: size too large, truncated to 1048576 [ 872.302009][T27890] batman_adv: batadv0: Removing interface: dummy0 [ 872.329673][T27891] workqueue: Failed to create a rescuer kthread for wq "bond12": -EINTR [ 872.334383][T27893] workqueue: Failed to create a rescuer kthread for wq "bond12": -EINTR [ 872.360594][T27901] tipc: Enabling of bearer rejected, failed to enable media [ 872.402117][T27905] netlink: 'syz.2.5419': attribute type 58 has an invalid length. [ 872.422423][T27905] __nla_validate_parse: 3 callbacks suppressed [ 872.422446][T27905] netlink: 20 bytes leftover after parsing attributes in process `syz.2.5419'. [ 872.517616][T27908] FAULT_INJECTION: forcing a failure. [ 872.517616][T27908] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 872.546381][T27908] CPU: 0 UID: 0 PID: 27908 Comm: syz.4.5420 Not tainted syzkaller #0 PREEMPT(full) [ 872.546410][T27908] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 872.546421][T27908] Call Trace: [ 872.546430][T27908] [ 872.546439][T27908] dump_stack_lvl+0xe8/0x150 [ 872.546478][T27908] should_fail_ex+0x40c/0x560 [ 872.546505][T27908] _copy_from_iter+0x1d3/0x1660 [ 872.546529][T27908] ? trace_kmem_cache_alloc+0x29/0xe0 [ 872.546554][T27908] ? kmem_cache_alloc_noprof+0x308/0x5f0 [ 872.546573][T27908] ? kmem_cache_alloc_noprof+0x150/0x5f0 [ 872.546590][T27908] ? __build_skb+0x62/0x440 [ 872.546608][T27908] ? __build_skb+0x62/0x440 [ 872.546631][T27908] ? __pfx__copy_from_iter+0x10/0x10 [ 872.546657][T27908] ? __build_skb+0x2a2/0x440 [ 872.546676][T27908] ? netlink_sendmsg+0x650/0xb40 [ 872.546701][T27908] ? skb_put+0x112/0x210 [ 872.546720][T27908] netlink_sendmsg+0x6c0/0xb40 [ 872.546738][T27908] ? seqcount_lockdep_reader_access+0xd4/0x100 [ 872.546800][T27908] ? __pfx_netlink_sendmsg+0x10/0x10 [ 872.546823][T27908] ? aa_sock_msg_perm+0xf1/0x1b0 [ 872.546847][T27908] ? __pfx_netlink_sendmsg+0x10/0x10 [ 872.546864][T27908] sock_sendmsg_nosec+0x13a/0x180 [ 872.546892][T27908] sock_write_iter+0x2de/0x3e0 [ 872.546918][T27908] ? __pfx_sock_write_iter+0x10/0x10 [ 872.546957][T27908] vfs_write+0x612/0xba0 [ 872.546981][T27908] ? __pfx_vfs_write+0x10/0x10 [ 872.547004][T27908] ? __fget_files+0x2a/0x420 [ 872.547035][T27908] ksys_write+0x150/0x270 [ 872.547054][T27908] ? __pfx_ksys_write+0x10/0x10 [ 872.547076][T27908] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 872.547095][T27908] do_syscall_64+0x174/0x580 [ 872.547121][T27908] ? clear_bhb_loop+0x40/0x90 [ 872.547143][T27908] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 872.547159][T27908] RIP: 0033:0x7f9dcb19de99 [ 872.547175][T27908] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 872.547189][T27908] RSP: 002b:00007f9dc93f6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 872.547207][T27908] RAX: ffffffffffffffda RBX: 00007f9dcb425fa0 RCX: 00007f9dcb19de99 [ 872.547219][T27908] RDX: 000000000000fe33 RSI: 0000200000000000 RDI: 0000000000000003 [ 872.547229][T27908] RBP: 00007f9dc93f6090 R08: 0000000000000000 R09: 0000000000000000 [ 872.547239][T27908] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 872.547248][T27908] R13: 00007f9dcb426038 R14: 00007f9dcb425fa0 R15: 00007ffddd31f3f8 [ 872.547274][T27908] [ 873.127740][T27924] netlink: 16 bytes leftover after parsing attributes in process `syz.0.5428'. [ 873.227795][T27938] sctp: [Deprecated]: syz.4.5430 (pid 27938) Use of int in max_burst socket option. [ 873.227795][T27938] Use struct sctp_assoc_value instead [ 873.627959][T27960] netlink: 12 bytes leftover after parsing attributes in process `syz.4.5433'. [ 873.833139][T27969] FAULT_INJECTION: forcing a failure. [ 873.833139][T27969] name failslab, interval 1, probability 0, space 0, times 0 [ 873.896008][T27969] CPU: 0 UID: 0 PID: 27969 Comm: syz.2.5434 Not tainted syzkaller #0 PREEMPT(full) [ 873.896040][T27969] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 873.896053][T27969] Call Trace: [ 873.896061][T27969] [ 873.896070][T27969] dump_stack_lvl+0xe8/0x150 [ 873.896108][T27969] should_fail_ex+0x40c/0x560 [ 873.896155][T27969] should_failslab+0xa8/0x100 [ 873.896187][T27969] kmem_cache_alloc_noprof+0xa6/0x5f0 [ 873.896214][T27969] ? skb_clone+0x212/0x3a0 [ 873.896238][T27969] ? skb_clone+0x212/0x3a0 [ 873.896268][T27969] skb_clone+0x212/0x3a0 [ 873.896297][T27969] __netlink_deliver_tap+0x413/0x860 [ 873.896335][T27969] ? netlink_deliver_tap+0x2e/0x1b0 [ 873.896363][T27969] netlink_deliver_tap+0x19c/0x1b0 [ 873.896389][T27969] netlink_unicast+0x77f/0x940 [ 873.896424][T27969] netlink_sendmsg+0x813/0xb40 [ 873.896458][T27969] ? __pfx_netlink_sendmsg+0x10/0x10 [ 873.896487][T27969] ? aa_sock_msg_perm+0xf1/0x1b0 [ 873.896516][T27969] ? __pfx_netlink_sendmsg+0x10/0x10 [ 873.896540][T27969] sock_sendmsg_nosec+0x13a/0x180 [ 873.896577][T27969] sock_write_iter+0x2de/0x3e0 [ 873.896608][T27969] ? __pfx_sock_write_iter+0x10/0x10 [ 873.896642][T27969] ? bpf_lsm_file_permission+0x9/0x20 [ 873.896705][T27969] ? security_file_permission+0x75/0x260 [ 873.896813][T27969] vfs_write+0x612/0xba0 [ 873.896844][T27969] ? __pfx_vfs_write+0x10/0x10 [ 873.896877][T27969] ? __fget_files+0x2a/0x420 [ 873.896917][T27969] ksys_write+0x150/0x270 [ 873.896942][T27969] ? __pfx_ksys_write+0x10/0x10 [ 873.896972][T27969] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 873.896996][T27969] do_syscall_64+0x174/0x580 [ 873.897020][T27969] ? trace_irq_disable+0x3b/0x140 [ 873.897046][T27969] ? clear_bhb_loop+0x40/0x90 [ 873.897078][T27969] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 873.897098][T27969] RIP: 0033:0x7ff522d9de99 [ 873.897127][T27969] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 873.897144][T27969] RSP: 002b:00007ff523c7f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 873.897167][T27969] RAX: ffffffffffffffda RBX: 00007ff523025fa0 RCX: 00007ff522d9de99 [ 873.897183][T27969] RDX: 000000000000fe33 RSI: 0000200000000000 RDI: 0000000000000003 [ 873.897196][T27969] RBP: 00007ff523c7f090 R08: 0000000000000000 R09: 0000000000000000 [ 873.897209][T27969] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 873.897221][T27969] R13: 00007ff523026038 R14: 00007ff523025fa0 R15: 00007ffdf9051868 [ 873.897256][T27969] [ 873.903482][T27952] udevd[27952]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 874.116762][ T50] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 874.130500][T27950] udevd[27950]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 874.191129][ T50] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 874.202705][ T50] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 874.213342][ T50] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 874.223992][ T50] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 874.597073][T27969] netlink: 'syz.2.5434': attribute type 10 has an invalid length. [ 874.605244][T27969] netlink: 16154 bytes leftover after parsing attributes in process `syz.2.5434'. [ 874.731227][T27990] netlink: 'syz.4.5437': attribute type 1 has an invalid length. [ 874.818777][T27990] bond10: option mode: invalid value (7) [ 874.842522][T27990] bond10 (unregistering): Released all slaves [ 874.875127][T27995] macvlan1: entered promiscuous mode [ 874.891436][T27995] macvlan1: entered allmulticast mode [ 874.906762][T27995] veth1_vlan: entered allmulticast mode [ 875.072769][T28012] netlink: 20 bytes leftover after parsing attributes in process `syz.2.5441'. [ 875.245287][T28019] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5442'. [ 875.271873][T28019] netlink: 'syz.2.5442': attribute type 2 has an invalid length. [ 875.293275][T28019] netlink: 60 bytes leftover after parsing attributes in process `syz.2.5442'. [ 875.467699][T28027] tipc: Enabling of bearer rejected, failed to enable media [ 875.534519][T17974] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 875.546384][T17974] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 875.598741][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 876.320944][ T7419] Bluetooth: hci0: command tx timeout [ 876.698699][T28082] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5456'. [ 876.975537][T28088] netlink: 'syz.1.5457': attribute type 1 has an invalid length. [ 876.990814][T28088] netlink: 224 bytes leftover after parsing attributes in process `syz.1.5457'. [ 877.068964][T28091] netlink: 12 bytes leftover after parsing attributes in process `syz.1.5457'. [ 877.256959][T27971] bridge0: port 1(bridge_slave_0) entered blocking state [ 877.271828][T27971] bridge0: port 1(bridge_slave_0) entered disabled state [ 877.288366][T27971] bridge_slave_0: entered allmulticast mode [ 877.306048][T27971] bridge_slave_0: entered promiscuous mode [ 877.345112][T27971] bridge0: port 2(bridge_slave_1) entered blocking state [ 877.368368][T27971] bridge0: port 2(bridge_slave_1) entered disabled state [ 877.376300][T27971] bridge_slave_1: entered allmulticast mode [ 877.387455][T27971] bridge_slave_1: entered promiscuous mode [ 877.454146][T28099] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5460'. [ 877.568962][T27971] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 877.585114][T27971] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 877.832789][T27971] team0: Port device team_slave_0 added [ 877.894984][T27971] team0: Port device team_slave_1 added [ 877.971693][T27971] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 877.978857][T27971] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 878.006909][T27971] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 878.023565][T27971] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 878.031158][T27971] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 878.065234][T27971] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 878.158717][ C0] ip6_tunnel: ip6tnl8 xmit: Local address not yet configured! [ 878.228611][T28126] xt_hashlimit: max too large, truncated to 1048576 [ 878.245753][T28126] xt_hashlimit: overflow, try lower: 137438953472/8 [ 878.399840][ T7419] Bluetooth: hci0: command tx timeout [ 878.443818][T27971] hsr_slave_0: entered promiscuous mode [ 878.451793][T27971] hsr_slave_1: entered promiscuous mode [ 878.459051][T27971] debugfs: 'hsr0' already exists in 'hsr' [ 878.465011][T27971] Cannot create hsr debugfs directory [ 878.493111][T28136] netlink: 28 bytes leftover after parsing attributes in process `syz.2.5472'. [ 878.934479][T27971] netdevsim netdevsim0 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 879.139117][T27971] netdevsim netdevsim0 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 879.183452][T28158] gtp0: entered promiscuous mode [ 879.188659][T28158] gtp0: entered allmulticast mode [ 879.196350][T28158] team0: Device gtp0 is of different type [ 879.262202][T27971] netdevsim netdevsim0 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 879.308930][T28160] syzkaller0: entered promiscuous mode [ 879.314588][T28160] syzkaller0: entered allmulticast mode [ 879.444457][T27971] netdevsim netdevsim0 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 879.464706][T28162] netlink: 4 bytes leftover after parsing attributes in process `syz.3.5479'. [ 879.513787][T28166] netlink: 'syz.4.5481': attribute type 1 has an invalid length. [ 879.673940][T28166] 8021q: adding VLAN 0 to HW filter on device bond10 [ 879.697663][T28174] netlink: 'syz.4.5481': attribute type 10 has an invalid length. [ 879.710605][T28174] netlink: 40 bytes leftover after parsing attributes in process `syz.4.5481'. [ 879.727025][T28169] bond10: (slave veth11): Enslaving as an active interface with a down link [ 879.761054][T28170] bond10: (slave dummy0): making interface the new active one [ 879.781876][T28170] dummy0: entered promiscuous mode [ 879.788870][T28170] bond10: (slave dummy0): Enslaving as an active interface with an up link [ 879.798593][T28171] syzkaller0: entered promiscuous mode [ 879.815415][T28171] syzkaller0: entered allmulticast mode [ 879.840924][T28174] bond10: (slave dummy0): Releasing active interface [ 880.319299][T28192] netlink: 'syz.2.5487': attribute type 1 has an invalid length. [ 880.391665][T28192] bond15: entered promiscuous mode [ 880.397465][T28192] 8021q: adding VLAN 0 to HW filter on device bond15 [ 880.480961][ T7419] Bluetooth: hci0: command tx timeout [ 880.557833][T28192] 8021q: adding VLAN 0 to HW filter on device bond15 [ 880.576450][T28192] bond15: (slave vti0): The slave device specified does not support setting the MAC address [ 880.590773][T28208] workqueue: Failed to create a rescuer kthread for wq "nfc2_nci_cmd_wq": -EINTR [ 880.591537][T28209] workqueue: Failed to create a rescuer kthread for wq "nfc2_nci_cmd_wq": -EINTR [ 880.603977][T28192] bond15: (slave vti0): Setting fail_over_mac to active for active-backup mode [ 880.650209][T28192] bond15: (slave vti0): making interface the new active one [ 880.657989][T28192] vti0: entered promiscuous mode [ 880.686566][T28192] bond15: (slave vti0): Enslaving as an active interface with an up link [ 880.712048][T28214] netlink: 84 bytes leftover after parsing attributes in process `syz.4.5492'. [ 880.864021][T27971] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 880.889925][T27971] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 880.898355][T27971] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 880.911640][T27971] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 880.924392][T28224] bond0: (slave bond_slave_1): Releasing backup interface [ 880.967836][T27971] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 881.004572][T27971] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 881.037039][T27971] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 881.054502][T27971] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 881.264146][T28237] syzkaller0: entered promiscuous mode [ 881.312419][T28237] syzkaller0: entered allmulticast mode [ 881.480422][T28246] openvswitch: netlink: IPv4 tunnel dst address is zero [ 881.492368][T27971] 8021q: adding VLAN 0 to HW filter on device bond0 [ 881.555573][T27971] 8021q: adding VLAN 0 to HW filter on device team0 [ 881.597319][T17974] bridge0: port 1(bridge_slave_0) entered blocking state [ 881.604585][T17974] bridge0: port 1(bridge_slave_0) entered forwarding state [ 881.656844][T17974] bridge0: port 2(bridge_slave_1) entered blocking state [ 881.664225][T17974] bridge0: port 2(bridge_slave_1) entered forwarding state [ 881.802487][T28255] netlink: 40 bytes leftover after parsing attributes in process `syz.4.5498'. [ 881.844138][T28255] netlink: 40 bytes leftover after parsing attributes in process `syz.4.5498'. [ 881.887920][T28255] xt_CT: You must specify a L4 protocol and not use inversions on it [ 881.891966][T28257] netlink: 68 bytes leftover after parsing attributes in process `syz.2.5499'. [ 882.257744][T28271] blkio.reset_stats is deprecated [ 882.558287][ T7419] Bluetooth: hci0: command tx timeout [ 882.971663][T28302] syzkaller0: entered promiscuous mode [ 882.997912][T28302] syzkaller0: entered allmulticast mode [ 883.022728][T27971] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 883.213410][T27971] veth0_vlan: entered promiscuous mode [ 883.236242][T27971] veth1_vlan: entered promiscuous mode [ 883.331201][T28306] netlink: 'syz.4.5508': attribute type 13 has an invalid length. [ 883.614169][T27971] veth0_macvtap: entered promiscuous mode [ 883.643979][T28310] tipc: Enabled bearer , priority 0 [ 883.655142][T28311] syzkaller0: default qdisc (pfifo_fast) fail, fallback to noqueue [ 883.706444][T28311] syzkaller0: entered promiscuous mode [ 883.712357][T28311] syzkaller0: entered allmulticast mode [ 883.726507][T28318] tipc: Resetting bearer [ 883.743640][T27971] veth1_macvtap: entered promiscuous mode [ 883.775665][T28305] tipc: Resetting bearer [ 883.808770][T28305] tipc: Disabling bearer [ 883.975157][T28334] x_tables: duplicate underflow at hook 2 [ 884.027787][T27971] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 884.028424][T28334] xt_NFQUEUE: number of total queues is 0 [ 884.062628][T27971] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 884.251530][T17974] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 884.261778][T17974] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 884.276058][T17974] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 884.305952][T17974] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 884.335491][T28345] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5518'. [ 884.547838][T17974] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 884.579297][T17974] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 884.662231][T17972] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 884.681199][T17972] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 884.725849][T28363] syzkaller0: entered promiscuous mode [ 884.741594][T28363] syzkaller0: entered allmulticast mode [ 885.192006][ T50] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 885.215415][ T50] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 885.224700][ T50] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 885.238780][ T50] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 885.251647][ T50] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 886.352955][T28402] netlink: 5 bytes leftover after parsing attributes in process `syz.4.5528'. [ 886.942741][T28408] Bluetooth: MGMT ver 1.23 [ 886.953538][T28410] syzkaller0: entered promiscuous mode [ 886.978310][T28410] syzkaller0: entered allmulticast mode [ 887.011199][T28422] netlink: 28 bytes leftover after parsing attributes in process `syz.0.5532'. [ 887.026847][T28422] netlink: 28 bytes leftover after parsing attributes in process `syz.0.5532'. [ 887.041265][T28422] netlink: 52 bytes leftover after parsing attributes in process `syz.0.5532'. [ 887.155717][T28430] netlink: 12 bytes leftover after parsing attributes in process `syz.0.5535'. [ 887.359431][ T7419] Bluetooth: hci3: command tx timeout [ 887.389843][T28441] xt_hashlimit: size too large, truncated to 1048576 [ 887.914242][T28440] netlink: 4 bytes leftover after parsing attributes in process `syz.4.5537'. [ 887.930805][T28374] bridge0: port 1(bridge_slave_0) entered blocking state [ 887.939200][T28374] bridge0: port 1(bridge_slave_0) entered disabled state [ 887.951914][T28374] bridge_slave_0: entered allmulticast mode [ 887.960808][T28374] bridge_slave_0: entered promiscuous mode [ 887.972247][T28374] bridge0: port 2(bridge_slave_1) entered blocking state [ 887.983519][T28374] bridge0: port 2(bridge_slave_1) entered disabled state [ 887.995565][T28374] bridge_slave_1: entered allmulticast mode [ 888.006519][T28374] bridge_slave_1: entered promiscuous mode [ 888.082821][T28374] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 888.099593][T28374] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 888.146966][T28374] team0: Port device team_slave_0 added [ 888.157272][T28374] team0: Port device team_slave_1 added [ 888.210469][T28374] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 888.227915][T28374] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 888.292298][T28374] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 888.309071][T28374] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 888.317119][T28374] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 888.347011][T28374] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 888.465916][T28374] hsr_slave_0: entered promiscuous mode [ 888.472821][T28374] hsr_slave_1: entered promiscuous mode [ 888.482107][T28374] debugfs: 'hsr0' already exists in 'hsr' [ 888.488621][T28374] Cannot create hsr debugfs directory [ 888.526555][T28483] netlink: 200 bytes leftover after parsing attributes in process `syz.0.5545'. [ 888.530924][T28475] netlink: 12 bytes leftover after parsing attributes in process `syz.4.5542'. [ 888.547828][T28483] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5545'. [ 889.440523][ T50] Bluetooth: hci3: command tx timeout [ 889.637452][T28374] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 889.900058][T28374] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 890.021343][T28374] bond0: (slave netdevsim1): Releasing backup interface [ 890.047127][T28374] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 890.087200][T28531] netlink: 'syz.1.5556': attribute type 21 has an invalid length. [ 890.095553][T28531] netlink: 128 bytes leftover after parsing attributes in process `syz.1.5556'. [ 890.117891][T28531] netlink: 'syz.1.5556': attribute type 5 has an invalid length. [ 890.126213][T28531] netlink: 3 bytes leftover after parsing attributes in process `syz.1.5556'. [ 890.192989][T28374] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 890.513563][T28374] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 890.537263][T28374] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 890.557702][T28374] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 890.603986][T28374] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 890.612908][T28374] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 890.632254][T28374] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 890.640596][T28374] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 890.654389][T28374] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 890.823005][T28374] 8021q: adding VLAN 0 to HW filter on device bond0 [ 890.863822][T28374] 8021q: adding VLAN 0 to HW filter on device team0 [ 890.913988][T17972] bridge0: port 1(bridge_slave_0) entered blocking state [ 890.921288][T17972] bridge0: port 1(bridge_slave_0) entered forwarding state [ 890.943569][T14206] bridge0: port 2(bridge_slave_1) entered blocking state [ 890.950881][T14206] bridge0: port 2(bridge_slave_1) entered forwarding state [ 891.076191][T28573] netlink: 28 bytes leftover after parsing attributes in process `syz.1.5564'. [ 891.110342][T28574] netlink: 28 bytes leftover after parsing attributes in process `syz.1.5564'. [ 891.222633][T28579] ieee802154 phy1 wpan1: encryption failed: -22 [ 891.518719][ T50] Bluetooth: hci3: command tx timeout [ 891.665400][T28601] netlink: 72 bytes leftover after parsing attributes in process `syz.1.5568'. [ 891.688640][T28601] netlink: 12 bytes leftover after parsing attributes in process `syz.1.5568'. [ 891.706866][T28601] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5568'. [ 891.761158][T28374] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 891.848508][T28609] IPVS: persistence engine module ip_vs_pe_ not found [ 891.872711][T28609] netlink: 60 bytes leftover after parsing attributes in process `syz.0.5572'. [ 891.906069][T28609] netlink: 68 bytes leftover after parsing attributes in process `syz.0.5572'. [ 891.915587][T28609] netlink: 68 bytes leftover after parsing attributes in process `syz.0.5572'. [ 891.964682][T28374] veth0_vlan: entered promiscuous mode [ 891.997393][T28374] veth1_vlan: entered promiscuous mode [ 892.071475][T28615] netlink: 'syz.0.5574': attribute type 13 has an invalid length. [ 892.085895][T28374] veth0_macvtap: entered promiscuous mode [ 892.206167][T28374] veth1_macvtap: entered promiscuous mode [ 892.291813][T28374] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 892.335050][T28374] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 892.409892][T21934] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 892.428786][T21934] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 892.443482][T21934] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 892.473229][T17974] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 892.614429][T21934] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 892.630962][T21934] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 892.685255][T17972] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 892.695398][T17972] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 892.795717][T28632] vxlan0: entered promiscuous mode [ 892.803473][T17972] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 892.815203][T17972] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 892.827070][T17972] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 892.836938][T17972] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 893.024407][T28623] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 893.059823][T28643] syzkaller0: entered promiscuous mode [ 893.065426][T28643] syzkaller0: entered allmulticast mode [ 893.205964][T28643] team0: Device ipvlan2 failed to register rx_handler [ 893.598727][ T50] Bluetooth: hci3: command tx timeout [ 893.826406][T28680] vlan3: entered allmulticast mode [ 894.245839][T28698] 8021q: adding VLAN 0 to HW filter on device batadv1 [ 894.280221][T28698] team0: Port device batadv1 added [ 894.649695][ T7419] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 894.664007][ T7419] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 894.676993][ T7419] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 894.685595][ T7419] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 894.697270][ T7419] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 895.399383][T28738] __nla_validate_parse: 7 callbacks suppressed [ 895.399405][T28738] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5605'. [ 895.489467][T28691] dvmrp0: entered allmulticast mode [ 895.919322][T28750] netlink: 12 bytes leftover after parsing attributes in process `syz.0.5608'. [ 895.929721][T28752] netlink: 12 bytes leftover after parsing attributes in process `syz.0.5608'. [ 895.939308][T28750] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5608'. [ 895.949031][T28752] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5608'. [ 896.470100][T28767] gre0: Caught tx_queue_len zero misconfig [ 896.713710][T28771] netlink: 12 bytes leftover after parsing attributes in process `syz.3.5613'. [ 896.838820][ T7419] Bluetooth: hci5: command tx timeout [ 898.878814][ T7419] Bluetooth: hci5: command tx timeout [ 899.850244][T28763] syzkaller0: entered promiscuous mode [ 899.855792][T28763] syzkaller0: entered allmulticast mode [ 899.875827][T28771] workqueue: Failed to create a rescuer kthread for wq "bond10": -EINTR [ 899.879692][T28772] tipc: Resetting bearer [ 899.894147][T28772] veth1_vlan: left promiscuous mode [ 899.901358][T28772] macvlan1: left allmulticast mode [ 900.428510][T28713] bridge0: port 1(bridge_slave_0) entered blocking state [ 900.435957][T28713] bridge0: port 1(bridge_slave_0) entered disabled state [ 900.444822][T28713] bridge_slave_0: entered allmulticast mode [ 900.454922][T28713] bridge_slave_0: entered promiscuous mode [ 900.474870][T28713] bridge0: port 2(bridge_slave_1) entered blocking state [ 900.482437][T28713] bridge0: port 2(bridge_slave_1) entered disabled state [ 900.491186][T28713] bridge_slave_1: entered allmulticast mode [ 900.500415][T28713] bridge_slave_1: entered promiscuous mode [ 900.657950][T28713] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 900.681280][T28713] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 900.703086][T28807] syzkaller0: entered promiscuous mode [ 900.709360][T28807] syzkaller0: entered allmulticast mode [ 900.907757][T28713] team0: Port device team_slave_0 added [ 900.927130][T28713] team0: Port device team_slave_1 added [ 900.961753][ T7419] Bluetooth: hci5: command tx timeout [ 900.970913][T28713] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 900.978220][T28713] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 901.020335][T28713] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 901.035687][T28713] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 901.062369][T28713] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 901.092347][T28713] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 901.222285][T28713] hsr_slave_0: entered promiscuous mode [ 901.230323][T28713] hsr_slave_1: entered promiscuous mode [ 901.240078][T28713] debugfs: 'hsr0' already exists in 'hsr' [ 901.247931][T28713] Cannot create hsr debugfs directory [ 901.743168][T28845] netlink: 44 bytes leftover after parsing attributes in process `syz.1.5629'. [ 901.778296][T28845] netlink: 12 bytes leftover after parsing attributes in process `syz.1.5629'. [ 901.805106][T28845] netlink: 16 bytes leftover after parsing attributes in process `syz.1.5629'. [ 901.824809][T28847] openvswitch: netlink: Key type 14342 is out of range max 32 [ 901.899746][T28847] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5630'. [ 902.012937][T28851] bridge0: port 2(bridge_slave_1) entered disabled state [ 902.020600][T28851] bridge0: port 1(bridge_slave_0) entered disabled state [ 902.119077][T28851] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 902.135027][T28851] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 902.258316][T28851] vxlan0: left promiscuous mode [ 902.364229][T28870] netlink: 40 bytes leftover after parsing attributes in process `syz.3.5634'. [ 902.396488][T12135] netdevsim netdevsim2 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 902.410010][T12135] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 902.424209][T12135] netdevsim netdevsim2 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 902.437050][T12135] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 902.447041][T12135] netdevsim netdevsim2 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 902.456285][T12135] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 902.666656][T28886] openvswitch: netlink: Message has 8 unknown bytes. [ 902.681192][T12135] netdevsim netdevsim2 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 902.704326][T12135] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 902.720569][T28884] netlink: 36 bytes leftover after parsing attributes in process `syz.2.5638'. [ 902.872433][T28890] netlink: 16178 bytes leftover after parsing attributes in process `syz.0.5641'. [ 902.917360][T28893] netlink: 32 bytes leftover after parsing attributes in process `syz.2.5642'. [ 903.056066][ T7419] Bluetooth: hci5: command tx timeout [ 903.073403][T28899] netlink: 'syz.0.5644': attribute type 1 has an invalid length. [ 903.114939][T28899] ip6gre1: entered promiscuous mode [ 903.144660][T28899] ip6gre1: entered allmulticast mode [ 903.162176][T14206] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 903.180122][T14206] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 903.188371][ T5761] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 903.478532][T28713] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 903.576617][T28713] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 903.585319][T28920] tipc: Enabling of bearer rejected, failed to enable media [ 903.609395][T28920] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5650'. [ 903.617710][T28713] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 903.640803][ T5761] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 903.646683][T28713] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 903.698476][ T5761] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 903.698956][T28713] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 903.727730][T28713] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 903.736978][T28713] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 903.774230][T28713] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 903.855996][T28931] netlink: 'syz.2.5653': attribute type 10 has an invalid length. [ 903.865705][T28931] netlink: 16154 bytes leftover after parsing attributes in process `syz.2.5653'. [ 904.088527][T28942] netlink: 'syz.1.5655': attribute type 2 has an invalid length. [ 904.097893][T28713] 8021q: adding VLAN 0 to HW filter on device bond0 [ 904.186837][T28942] : entered promiscuous mode [ 904.214244][T28713] 8021q: adding VLAN 0 to HW filter on device team0 [ 904.243760][T14217] bridge0: port 1(bridge_slave_0) entered blocking state [ 904.251086][T14217] bridge0: port 1(bridge_slave_0) entered forwarding state [ 904.287841][T14217] bridge0: port 2(bridge_slave_1) entered blocking state [ 904.295150][T14217] bridge0: port 2(bridge_slave_1) entered forwarding state [ 905.429593][T28713] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 905.993163][T28984] bond1: option arp_all_targets: invalid value (3) [ 906.040397][T28984] bond1 (unregistering): Released all slaves [ 906.299018][T28975] netlink: 'syz.2.5660': attribute type 1 has an invalid length. [ 906.365485][T28975] bond1: entered promiscuous mode [ 906.373188][T28975] 8021q: adding VLAN 0 to HW filter on device bond1 [ 906.429387][T28975] bond1: (slave bridge1): making interface the new active one [ 906.437501][T28975] bridge1: entered promiscuous mode [ 906.444328][T28975] bond1: (slave bridge1): Enslaving as an active interface with an up link [ 906.494693][T28999] syzkaller0: entered promiscuous mode [ 906.509844][T28999] syzkaller0: entered allmulticast mode [ 906.534913][T29001] 8021q: VLANs not supported on ip_vti0 [ 906.614619][T28713] veth0_vlan: entered promiscuous mode [ 906.630400][T28713] veth1_vlan: entered promiscuous mode [ 906.692419][T28713] veth0_macvtap: entered promiscuous mode [ 906.786738][T28713] veth1_macvtap: entered promiscuous mode [ 906.859830][T28713] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 906.882345][T28713] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 906.939853][T14217] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 906.959630][T12135] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 906.980238][T12135] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 907.005463][T29024] netlink: 'syz.0.5671': attribute type 51 has an invalid length. [ 907.013712][T12135] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 907.061079][T29024] ip6gre2: entered promiscuous mode [ 907.083100][T29024] ip6gre2: entered allmulticast mode [ 907.138020][T29024] __nla_validate_parse: 4 callbacks suppressed [ 907.145387][T29024] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5671'. [ 907.183122][T29031] 8021q: VLANs not supported on tunl0 [ 907.278452][ C0] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 907.391407][T29035] netlink: 40 bytes leftover after parsing attributes in process `syz.0.5674'. [ 907.391961][T12135] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 907.415887][T29035] netlink: 12 bytes leftover after parsing attributes in process `syz.0.5674'. [ 907.436744][T12135] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 907.473260][T14217] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 907.499570][T14217] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 907.667156][T29041] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5676'. [ 907.694617][T29045] ip6erspan1: entered allmulticast mode [ 907.766082][T29054] xt_hl: Unknown TTL match mode: 237 [ 907.786111][T29054] netlink: 28 bytes leftover after parsing attributes in process `syz.0.5678'. [ 907.804743][T29054] netlink: 28 bytes leftover after parsing attributes in process `syz.0.5678'. [ 907.818657][T29054] netlink: 'syz.0.5678': attribute type 1 has an invalid length. [ 907.826680][T29054] netlink: 224 bytes leftover after parsing attributes in process `syz.0.5678'. [ 907.986653][T29070] netlink: 12 bytes leftover after parsing attributes in process `syz.3.5681'. [ 908.421022][T29075] bond10 (unregistering): Released all slaves [ 908.501277][T29078] 8021q: adding VLAN 0 to HW filter on device batadv2 [ 908.523562][T29078] team0: Port device batadv2 added [ 908.951329][T29100] netlink: 28 bytes leftover after parsing attributes in process `syz.4.5690'. [ 909.172126][T29109] netlink: 'syz.1.5692': attribute type 12 has an invalid length. [ 909.227594][T29109] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5692'. [ 909.450822][T29122] tipc: Started in network mode [ 909.460181][T29122] tipc: Node identity ac14140f, cluster identity 4711 [ 909.477767][T29122] tipc: New replicast peer: 255.255.255.255 [ 909.500508][T29122] tipc: Enabled bearer , priority 5 [ 909.507877][T29121] netlink: 'syz.2.5697': attribute type 1 has an invalid length. [ 909.536988][T29118] nbd: must specify at least one socket [ 909.613657][T29121] bond2: entered promiscuous mode [ 909.642385][T29121] 8021q: adding VLAN 0 to HW filter on device bond2 [ 909.693845][T29125] bond2: entered allmulticast mode [ 910.220872][ T7419] block nbd5: Receive control failed (result -1) [ 910.351743][T29157] IPVS: set_ctl: invalid protocol: 0 0.0.0.0:0 [ 910.420035][T29154] [ 910.422449][T29154] ====================================================== [ 910.429514][T29154] WARNING: possible circular locking dependency detected [ 910.436659][T29154] syzkaller #0 Not tainted [ 910.441108][T29154] ------------------------------------------------------ [ 910.448194][T29154] syz.2.5704/29154 is trying to acquire lock: [ 910.454362][T29154] ffff88807c14de18 (set->srcu){.+.+}-{0:0}, at: __synchronize_srcu+0xb5/0x2f0 [ 910.463337][T29154] [ 910.463337][T29154] but task is already holding lock: [ 910.470737][T29154] ffff88802570ebf8 (&q->elevator_lock){+.+.}-{4:4}, at: elevator_change+0x1af/0x480 [ 910.480456][T29154] [ 910.480456][T29154] which lock already depends on the new lock. [ 910.480456][T29154] [ 910.490974][T29154] [ 910.490974][T29154] the existing dependency chain (in reverse order) is: [ 910.500202][T29154] [ 910.500202][T29154] -> #6 (&q->elevator_lock){+.+.}-{4:4}: [ 910.508112][T29154] __mutex_lock+0x19d/0x1550 [ 910.513384][T29154] elevator_change+0x1af/0x480 [ 910.518772][T29154] elevator_set_none+0xb5/0x140 [ 910.524153][T29154] blk_mq_update_nr_hw_queues+0x5ef/0x19f0 [ 910.530530][T29154] nbd_start_device+0x189/0xb30 [ 910.536118][T29154] nbd_genl_connect+0x1597/0x1c10 [ 910.541673][T29154] genl_family_rcv_msg_doit+0x233/0x340 [ 910.548015][T29154] genl_rcv_msg+0x614/0x7a0 [ 910.553161][T29154] netlink_rcv_skb+0x226/0x4a0 [ 910.558457][T29154] genl_rcv+0x28/0x40 [ 910.562966][T29154] netlink_unicast+0x7bb/0x940 [ 910.568267][T29154] netlink_sendmsg+0x813/0xb40 [ 910.573562][T29154] sock_sendmsg_nosec+0x13a/0x180 [ 910.579132][T29154] ____sys_sendmsg+0x54e/0x850 [ 910.584524][T29154] ___sys_sendmsg+0x2a5/0x360 [ 910.589810][T29154] __x64_sys_sendmsg+0x1b1/0x290 [ 910.595357][T29154] do_syscall_64+0x174/0x580 [ 910.600472][T29154] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 910.606888][T29154] [ 910.606888][T29154] -> #5 (&q->q_usage_counter(io)#50){++++}-{0:0}: [ 910.615648][T29154] blk_alloc_queue+0x544/0x690 [ 910.620947][T29154] __blk_mq_alloc_disk+0x194/0x390 [ 910.626581][T29154] nbd_dev_add+0x494/0xb60 [ 910.631523][T29154] nbd_init+0x15f/0x1e0 [ 910.636384][T29154] do_one_initcall+0x250/0x870 [ 910.641683][T29154] do_initcall_level+0x10a/0x1a0 [ 910.647191][T29154] do_initcalls+0x59/0xa0 [ 910.652053][T29154] kernel_init_freeable+0x29d/0x3e0 [ 910.657815][T29154] kernel_init+0x1d/0x1d0 [ 910.662738][T29154] ret_from_fork+0x514/0xb70 [ 910.667968][T29154] ret_from_fork_asm+0x1a/0x30 [ 910.673254][T29154] [ 910.673254][T29154] -> #4 (fs_reclaim){+.+.}-{0:0}: [ 910.680511][T29154] fs_reclaim_acquire+0x71/0x100 [ 910.686002][T29154] kmem_cache_alloc_node_noprof+0x6a/0x610 [ 910.692338][T29154] __alloc_skb+0x276/0x7a0 [ 910.697461][T29154] __ip6_append_data+0x2ec4/0x40c0 [ 910.703208][T29154] ip6_append_data+0x108/0x270 [ 910.708591][T29154] rawv6_sendmsg+0x1298/0x18c0 [ 910.713934][T29154] sock_sendmsg_nosec+0x10e/0x180 [ 910.719493][T29154] ____sys_sendmsg+0x54e/0x850 [ 910.724784][T29154] ___sys_sendmsg+0x2a5/0x360 [ 910.729988][T29154] __x64_sys_sendmsg+0x1b1/0x290 [ 910.735475][T29154] do_syscall_64+0x174/0x580 [ 910.740711][T29154] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 910.747143][T29154] [ 910.747143][T29154] -> #3 (sk_lock-AF_INET6){+.+.}-{0:0}: [ 910.754887][T29154] lock_sock_nested+0x41/0x100 [ 910.760219][T29154] inet_shutdown+0x6a/0x390 [ 910.765313][T29154] nbd_mark_nsock_dead+0x2cb/0x550 [ 910.771039][T29154] recv_work+0x1cee/0x1e10 [ 910.775990][T29154] process_scheduled_works+0xa8e/0x14e0 [ 910.782095][T29154] worker_thread+0xa47/0xfb0 [ 910.787309][T29154] kthread+0x388/0x470 [ 910.791906][T29154] ret_from_fork+0x514/0xb70 [ 910.797139][T29154] ret_from_fork_asm+0x1a/0x30 [ 910.802446][T29154] [ 910.802446][T29154] -> #2 (&nsock->tx_lock){+.+.}-{4:4}: [ 910.810369][T29154] __mutex_lock+0x19d/0x1550 [ 910.815502][T29154] nbd_queue_rq+0x373/0x1150 [ 910.820627][T29154] blk_mq_dispatch_rq_list+0x499/0x1990 [ 910.826763][T29154] __blk_mq_sched_dispatch_requests+0xd36/0x1580 [ 910.833677][T29154] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 910.840275][T29154] blk_mq_run_work_fn+0x16c/0x300 [ 910.845827][T29154] process_scheduled_works+0xa8e/0x14e0 [ 910.851899][T29154] worker_thread+0xa47/0xfb0 [ 910.857017][T29154] kthread+0x388/0x470 [ 910.861621][T29154] ret_from_fork+0x514/0xb70 [ 910.866745][T29154] ret_from_fork_asm+0x1a/0x30 [ 910.872038][T29154] [ 910.872038][T29154] -> #1 (&cmd->lock){+.+.}-{4:4}: [ 910.879274][T29154] __mutex_lock+0x19d/0x1550 [ 910.884391][T29154] nbd_queue_rq+0xc1/0x1150 [ 910.889505][T29154] blk_mq_dispatch_rq_list+0x499/0x1990 [ 910.895584][T29154] __blk_mq_sched_dispatch_requests+0xd36/0x1580 [ 910.902445][T29154] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 910.908957][T29154] blk_mq_run_work_fn+0x16c/0x300 [ 910.914504][T29154] process_scheduled_works+0xa8e/0x14e0 [ 910.920573][T29154] worker_thread+0xa47/0xfb0 [ 910.925784][T29154] kthread+0x388/0x470 [ 910.930643][T29154] ret_from_fork+0x514/0xb70 [ 910.935773][T29154] ret_from_fork_asm+0x1a/0x30 [ 910.941159][T29154] [ 910.941159][T29154] -> #0 (set->srcu){.+.+}-{0:0}: [ 910.948297][T29154] __lock_acquire+0x1520/0x2cf0 [ 910.953678][T29154] lock_sync+0x9d/0x120 [ 910.958369][T29154] __synchronize_srcu+0xc9/0x2f0 [ 910.964009][T29154] elevator_switch+0x1e8/0x7b0 [ 910.969463][T29154] elevator_change+0x2fa/0x480 [ 910.974757][T29154] elevator_set_default+0x375/0x440 [ 910.980487][T29154] blk_register_queue+0x3f3/0x4e0 [ 910.986096][T29154] __add_disk+0x6cb/0xe30 [ 910.990951][T29154] add_disk_fwnode+0x100/0x3a0 [ 910.996236][T29154] nbd_dev_add+0x733/0xb60 [ 911.001177][T29154] nbd_genl_connect+0x992/0x1c10 [ 911.006635][T29154] genl_family_rcv_msg_doit+0x233/0x340 [ 911.012798][T29154] genl_rcv_msg+0x614/0x7a0 [ 911.017829][T29154] netlink_rcv_skb+0x226/0x4a0 [ 911.023214][T29154] genl_rcv+0x28/0x40 [ 911.027726][T29154] netlink_unicast+0x7bb/0x940 [ 911.033010][T29154] netlink_sendmsg+0x813/0xb40 [ 911.038301][T29154] sock_sendmsg_nosec+0x13a/0x180 [ 911.043866][T29154] ____sys_sendmsg+0x54e/0x850 [ 911.049159][T29154] ___sys_sendmsg+0x2a5/0x360 [ 911.054366][T29154] __x64_sys_sendmsg+0x1b1/0x290 [ 911.059826][T29154] do_syscall_64+0x174/0x580 [ 911.064942][T29154] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 911.071372][T29154] [ 911.071372][T29154] other info that might help us debug this: [ 911.071372][T29154] [ 911.081706][T29154] Chain exists of: [ 911.081706][T29154] set->srcu --> &q->q_usage_counter(io)#50 --> &q->elevator_lock [ 911.081706][T29154] [ 911.095502][T29154] Possible unsafe locking scenario: [ 911.095502][T29154] [ 911.103021][T29154] CPU0 CPU1 [ 911.108458][T29154] ---- ---- [ 911.113838][T29154] lock(&q->elevator_lock); [ 911.118439][T29154] lock(&q->q_usage_counter(io)#50); [ 911.126350][T29154] lock(&q->elevator_lock); [ 911.133512][T29154] sync(set->srcu); [ 911.137495][T29154] [ 911.137495][T29154] *** DEADLOCK *** [ 911.137495][T29154] [ 911.145658][T29154] 6 locks held by syz.2.5704/29154: [ 911.151037][T29154] #0: ffffffff9009dee8 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 [ 911.159373][T29154] #1: ffffffff9009dd20 (genl_mutex){+.+.}-{4:4}, at: genl_rcv_msg+0x10b/0x7a0 [ 911.168440][T29154] #2: ffff8880512721c0 (&set->update_nr_hwq_lock){++++}-{4:4}, at: add_disk_fwnode+0xea/0x3a0 [ 911.178806][T29154] #3: ffff88802570ec80 (&q->sysfs_lock){+.+.}-{4:4}, at: blk_register_queue+0x10d/0x4e0 [ 911.188659][T29154] #4: ffff88802570e708 (&q->q_usage_counter(queue)#52){+.+.}-{0:0}, at: elevator_change+0x194/0x480 [ 911.199552][T29154] #5: ffff88802570ebf8 (&q->elevator_lock){+.+.}-{4:4}, at: elevator_change+0x1af/0x480 [ 911.209751][T29154] [ 911.209751][T29154] stack backtrace: [ 911.215658][T29154] CPU: 0 UID: 0 PID: 29154 Comm: syz.2.5704 Not tainted syzkaller #0 PREEMPT(full) [ 911.215679][T29154] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 911.215690][T29154] Call Trace: [ 911.215697][T29154] [ 911.215703][T29154] dump_stack_lvl+0xe8/0x150 [ 911.215730][T29154] print_circular_bug+0x2e1/0x300 [ 911.215749][T29154] check_noncircular+0x12e/0x150 [ 911.215767][T29154] __lock_acquire+0x1520/0x2cf0 [ 911.215790][T29154] ? check_noncircular+0xda/0x150 [ 911.215808][T29154] ? lockdep_unlock+0x5d/0xd0 [ 911.215827][T29154] ? __lock_acquire+0x13e8/0x2cf0 [ 911.215850][T29154] ? __lock_acquire+0x13e8/0x2cf0 [ 911.215872][T29154] ? __synchronize_srcu+0xb5/0x2f0 [ 911.215892][T29154] lock_sync+0x9d/0x120 [ 911.215913][T29154] ? __synchronize_srcu+0xb5/0x2f0 [ 911.215936][T29154] __synchronize_srcu+0xc9/0x2f0 [ 911.215958][T29154] ? __pfx___synchronize_srcu+0x10/0x10 [ 911.215979][T29154] ? do_raw_spin_lock+0x12b/0x2f0 [ 911.216000][T29154] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 911.216062][T29154] ? ktime_get_mono_fast_ns+0x2d2/0x2f0 [ 911.216084][T29154] ? synchronize_srcu+0x20a/0x260 [ 911.216106][T29154] elevator_switch+0x1e8/0x7b0 [ 911.216127][T29154] ? blk_mq_cancel_work_sync+0xa5/0xe0 [ 911.216145][T29154] elevator_change+0x2fa/0x480 [ 911.216167][T29154] ? do_raw_spin_unlock+0xf5/0x210 [ 911.216186][T29154] elevator_set_default+0x375/0x440 [ 911.216209][T29154] ? __pfx_elevator_set_default+0x10/0x10 [ 911.216234][T29154] ? disk_register_independent_access_ranges+0x2d8/0x380 [ 911.216277][T29154] ? blk_crypto_sysfs_register+0x11c/0x170 [ 911.216341][T29154] blk_register_queue+0x3f3/0x4e0 [ 911.216359][T29154] __add_disk+0x6cb/0xe30 [ 911.216379][T29154] add_disk_fwnode+0x100/0x3a0 [ 911.216398][T29154] nbd_dev_add+0x733/0xb60 [ 911.216416][T29154] ? __pfx_nbd_dev_add+0x10/0x10 [ 911.216438][T29154] ? bpf_lsm_capable+0x9/0x20 [ 911.216460][T29154] ? security_capable+0x7e/0x2c0 [ 911.216477][T29154] ? radix_tree_lookup+0x25c/0x290 [ 911.216603][T29154] nbd_genl_connect+0x992/0x1c10 [ 911.216621][T29154] ? __pfx_nbd_genl_connect+0x10/0x10 [ 911.216644][T29154] ? rcu_is_watching+0x15/0xb0 [ 911.216659][T29154] ? trace_kmalloc+0x2a/0xf0 [ 911.216679][T29154] ? __kmalloc_noprof+0x396/0x720 [ 911.216701][T29154] ? __nla_parse+0x40/0x60 [ 911.216724][T29154] ? genl_family_rcv_msg_attrs_parse+0x20b/0x2f0 [ 911.216749][T29154] ? genl_family_rcv_msg_attrs_parse+0x265/0x2f0 [ 911.216775][T29154] genl_family_rcv_msg_doit+0x233/0x340 [ 911.216801][T29154] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 911.216828][T29154] ? __lock_acquire+0x683/0x2cf0 [ 911.216853][T29154] genl_rcv_msg+0x614/0x7a0 [ 911.216878][T29154] ? __pfx_genl_rcv_msg+0x10/0x10 [ 911.216900][T29154] ? __pfx_nbd_genl_connect+0x10/0x10 [ 911.216919][T29154] netlink_rcv_skb+0x226/0x4a0 [ 911.216938][T29154] ? __pfx_genl_rcv_msg+0x10/0x10 [ 911.216960][T29154] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 911.216983][T29154] ? down_read+0x2be/0x330 [ 911.217005][T29154] genl_rcv+0x28/0x40 [ 911.217026][T29154] netlink_unicast+0x7bb/0x940 [ 911.217046][T29154] netlink_sendmsg+0x813/0xb40 [ 911.217068][T29154] ? __pfx_netlink_sendmsg+0x10/0x10 [ 911.217088][T29154] ? aa_sock_msg_perm+0xf1/0x1b0 [ 911.217106][T29154] ? __pfx_netlink_sendmsg+0x10/0x10 [ 911.217124][T29154] sock_sendmsg_nosec+0x13a/0x180 [ 911.217149][T29154] ____sys_sendmsg+0x54e/0x850 [ 911.217169][T29154] ? __pfx_____sys_sendmsg+0x10/0x10 [ 911.217190][T29154] ? import_iovec+0x73/0xa0 [ 911.217215][T29154] ___sys_sendmsg+0x2a5/0x360 [ 911.217232][T29154] ? __lock_acquire+0x683/0x2cf0 [ 911.217255][T29154] ? __pfx____sys_sendmsg+0x10/0x10 [ 911.217274][T29154] ? futex_wake+0x51b/0x5f0 [ 911.217311][T29154] ? __fget_files+0x2a/0x420 [ 911.217332][T29154] ? __fget_files+0x3a2/0x420 [ 911.217357][T29154] __x64_sys_sendmsg+0x1b1/0x290 [ 911.217375][T29154] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 911.217399][T29154] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 911.217417][T29154] do_syscall_64+0x174/0x580 [ 911.217436][T29154] ? clear_bhb_loop+0x40/0x90 [ 911.217454][T29154] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 911.217470][T29154] RIP: 0033:0x7fad19f9de99 [ 911.217486][T29154] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 911.217500][T29154] RSP: 002b:00007fad1adc9028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 911.217518][T29154] RAX: ffffffffffffffda RBX: 00007fad1a225fa0 RCX: 00007fad19f9de99 [ 911.217530][T29154] RDX: 0000000000000000 RSI: 0000200000000240 RDI: 0000000000000004 [ 911.217541][T29154] RBP: 00007fad1a033eaf R08: 0000000000000000 R09: 0000000000000000 [ 911.217552][T29154] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 911.217562][T29154] R13: 00007fad1a226038 R14: 00007fad1a225fa0 R15: 00007ffd82c98828 [ 911.217580][T29154] [ 911.734114][T24566] tipc: Node number set to 2886997007 [ 915.278332][ C0] ip6_tunnel: ip6gre1 xmit: Local address not yet configured!