last executing test programs: 1.65660775s ago: executing program 4 (id=7715): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000180), r1) sendmsg$NLBL_MGMT_C_ADD(r1, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000600)={0x108, r2, 0xe701ac47a3d23ecd, 0x0, 0x0, {}, [@NLBL_MGMT_A_PROTOCOL={0x8}, @NLBL_MGMT_A_DOMAIN={0xce, 0x1, 'C\xec\xf8\xa0w\x15|\xd8\xbcs\xe1\xb93\x14\xcd\xcb\xb6\xb9\xbb\x84\xe5\xbc\xdb\x7f\x9a\xf2\xea\xcc\x91:v@\xe83-\x1d\xaagQl\x7f\tKt\fc\x1f\x17]\xd5\xd0\xf0\xa8\xeb\xd2g\x92\x04\x00\x00\x00od\xe6,\xd3@I\x17\xf3\xbees0\xad\xc6\xbf/*\xb6(o\x91t\x12\x93U6\xf4@n\xdc\xdc\x8a7y\x81FY\xbe\xbbc\xd2\xc3\x01\xa5\xe2V\x8c\xb3im~\xd2V\xdaG\xbdbF\xc8n\x86\xac\x9c\xfb\xda\xe2&\"\xb4:\x13\xe9\tc\x85\xb4\xcb\x17\xbfm\x846\xe7\x7fp\x9eCdb\xad;\xa2\x8fs\xbf6\xe8\xe3Xg3&\xe2 \xd6\n\x9d=~<\x93/\xaf\x89\x06+\x96]\xb5+\xee\xff8^D*\xdb\xb8\xd8t\x80\xd4\x8fK=E0\xe8R\x83'}, @NLBL_MGMT_A_IPV6ADDR={0x14, 0x5, @private2}, @NLBL_MGMT_A_IPV4ADDR={0x8, 0x7, @loopback}]}, 0x108}}, 0x0) (async) sendmsg$NLBL_MGMT_C_REMOVE(r0, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x24, r2, 0x10, 0x70bd2a, 0x25dfdbfd, {}, [@NLBL_MGMT_A_FAMILY={0x6, 0xb, 0x21}, @NLBL_MGMT_A_PROTOCOL={0x8, 0x2, 0x5}]}, 0x24}, 0x1, 0x0, 0x0, 0x80}, 0x40000c0) (async) syz_open_procfs$namespace(0xffffffffffffffff, 0x0) (async) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0x1c, 0x0, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) (async) r5 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0), 0x101200, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000840)={'pimreg1\x00', 0x6bf1c2d5adba8c32}) (async) r6 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r7, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000010000000900010073797a30000000006c000000160a01020000000000000000010000000900010073797a30000000000900020073797a3000000000400003802c00038004000100766c616e31000000000000000000000014000100776c616e3100000000000000000000000800014000000000080002"], 0xfc}}, 0x0) (async) write$tun(r4, &(0x7f0000000740)=ANY=[@ANYBLOB="00000000bbbbbbbbbbbbaaaaaaaaaa3088a81292c68ea095c68697613d4d008100664086dd61b4d55e001406fffc010000000000000000000000000001ff0200000000000000761a15e426be02b0de473f54d25913e49d9fe1f1bbe80fb9be164f3d9d43fde084b6ecc08a4b8ea5f7abce90cd4fd6f5cce0a2ba777bf0764c790d8a046860284e65c1dc8cacf0278ba19fed8d385548ac9bed056aa7307cff86a7aa70d7376eaf9eac912569c05c0efe3d1f5a9f76a9471234753c030f386f0053c92b7fa2d8265c6bdf9d63edd7f962cc25426ca32dc4452af060808adf9685015433b99e25a17b50a93017486cd7dc", @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB="5180000c90780000"], 0x56) (async) bind$netlink(r3, &(0x7f0000000000)={0x10, 0x0, 0x0, 0x80065c9}, 0xc) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) (async) r9 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r10 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000c40), r9) sendmsg$NLBL_UNLABEL_C_STATICADDDEF(r9, &(0x7f0000000d40)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000002c0)={0x34, r10, 0x1, 0x0, 0x0, {0x6, 0x0, 0x900}, [@NLBL_UNLABEL_A_IPV4ADDR={0x8, 0x4, @private}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @multicast1=0xe0000002}, @NLBL_UNLABEL_A_SECCTX={0x4, 0x7, 'unconfined\x00'}]}, 0x34}, 0x2, 0x34005}, 0x0) r11 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000340), r1) sendmsg$IEEE802154_ASSOCIATE_REQ(r9, &(0x7f0000000580)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000540)={&(0x7f00000004c0)={0x44, r11, 0x800, 0x70bd27, 0x25dfdbff, {}, [@IEEE802154_ATTR_COORD_HW_ADDR={0xc, 0x9, {0xaaaaaaaaaaaa0302}}, @IEEE802154_ATTR_CAPABILITY={0x5, 0x11, 0x8}, @IEEE802154_ATTR_COORD_HW_ADDR={0xc, 0x9, {0xaaaaaaaaaaaa0302}}, @IEEE802154_ATTR_COORD_PAN_ID={0x6, 0xa, 0x2}, @IEEE802154_ATTR_COORD_SHORT_ADDR={0x6}]}, 0x44}, 0x1, 0x0, 0x0, 0x80}, 0x8040) (async) sendmsg$NFT_BATCH(r8, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000380)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a05000000000000000000010000000900010073797a30000000002c000000030a01020000000000000000010000000900010073797a30000000000900030073797a310000000084000000060a010400000000000000000100000008000b40000000005c0004802c000180090001007866726d000000001c0002800800024000000004050003000000000008000140000000092c00018008000100636d7000200002800c00038005000100ac000000080001400000000c08000240000000000900010073797a300000000014000000110001"], 0xf8}, 0x1, 0x0, 0x0, 0x40010}, 0x0) 1.358894765s ago: executing program 0 (id=7719): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) (async) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8916, &(0x7f00000002c0)={'ipvlan1\x00', {0x2, 0x4e23, @private=0xac141436}}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=@base={0x16, 0x0, 0x4, 0x1, 0x0, 0x1}, 0x48) (async) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000c40), r5) sendmsg$NLBL_UNLABEL_C_STATICADDDEF(r5, &(0x7f0000000d40)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000002c0)={0x34, r6, 0x1, 0x0, 0x0, {0x6, 0x0, 0x900}, [@NLBL_UNLABEL_A_IPV4ADDR={0x8, 0x4, @private}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @multicast1=0xe0000002}, @NLBL_UNLABEL_A_SECCTX={0x4, 0x7, 'unconfined\x00'}]}, 0x34}, 0x2, 0x34005}, 0x0) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0xe, r4}, 0x38) (async) r7 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r7, 0x6, 0x13, &(0x7f0000000240)=0x1, 0x4) (async) connect$inet(r7, &(0x7f0000000040)={0x2, 0x4e04, @dev={0xac, 0x14, 0x14, 0x59}}, 0x10) (async) shutdown(r7, 0x1) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r7, 0x6, 0x14, &(0x7f00000003c0)=0x2, 0x4) (async) recvmmsg(r7, &(0x7f00000005c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x40000142, 0x0) (async) r8 = socket(0x1a, 0xa, 0x3a) getsockopt$nfc_llcp(r8, 0x3a, 0x1, 0x0, 0x20000000) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000040)={'wlan1\x00', 0x0}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x1e, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x1, 0x2, 0x3, 0x2, 0x1, 0x2d}]}, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x80) (async) sendmsg$NL80211_CMD_UPDATE_OWE_INFO(r8, &(0x7f0000000280)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000240)={&(0x7f00000006c0)={0x200, r3, 0x100, 0x70bd25, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r9}, @val={0xc, 0x99, {0x2, 0x2b}}}}, [@NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_STATUS_CODE={0x6, 0x48, 0x1d}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_IE={0x199, 0x2a, [@ssid={0x0, 0x6, @default_ibss_ssid}, @fast_bss_trans={0x37, 0x17a, {0x1, 0x9, "c144f581a338358d0d213d5e1f34d9cc", "159f3c05ae8824ec784e17dbe92e99d412e2591aa996b2adc438d4db3eacbd82", "3d59a86ec57a82e4e6a4565e00bdea854970879383d3112be7f57c19fef1ace7", [{0x4, 0x1c, "b7af74e75ff59eb90d7d8cfb327ff1d3b35d5c5dfa669464bdddcacd"}, {0x3, 0x15, "d0503339e95a7bb59b3ccb221dd783bd7987193b5e"}, {0x3, 0x26, "3dac05cc6af54c9a02d478ddd366d358586004a2ca1d5eed9bf2d6e289510692c32292a661c9"}, {0x1, 0x7, "74fcd5aae5648e"}, {0x2, 0x26, "fbbca08ef5dde8a34d47401cba5f1b3ffe6cd5c415176d59af9ae5d680a8584509cc005b8c68"}, {0x3, 0x1b, "6ab8850a48a5f1a471ee0bfb9eff92f9062629fecf3691c1f3f069d3601fafb94648098002b34c0c"}, {0x2, 0x27, "7e8416fcdabd52b6b865e9c4a44c87b98752896ad66b43993d839ed1c3f1c5a1d6bab758b27e0d"}, {0x4, 0x24, "7b1fac66643ed38fd1c889161f1a0e581e8b9c5d41b02dc77b5712a6db46165ed87faed8"}, {0x1, 0x1f, "cd38b9d668bef63475dd184bc84e843f27b32adbe312d4ea3f45e4146e2a7b"}]}}, @link_id, @mesh_id={0x72, 0x6}]}, @NL80211_ATTR_STATUS_CODE={0x6, 0x48, 0x4}, @NL80211_ATTR_STATUS_CODE={0x6}]}, 0x200}, 0x1, 0x0, 0x0, 0x4040005}, 0x4000000) (async) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r3, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r10}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x3}]}, 0x24}}, 0x0) (async) sendmsg$NL80211_CMD_START_AP(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000500)={0x18c, r3, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r10}, @void}}, [@beacon=[@NL80211_ATTR_BEACON_HEAD={0x45, 0xe, {{{}, {}, @broadcast, @device_a, @random="8e742f592bf6"}, 0x0, @default, 0x1, @void, @void, @void, @val={0x4, 0x6, {0x7f, 0x1, 0x7}}, @void, @val={0x5, 0x3, {0xeb, 0x3a, 0xb0}}, @void, @void, @void, @void, @val={0x72, 0x6}, @void, @val={0x76, 0x6, {0x8, 0x9, 0x11, 0x979}}}}, @NL80211_ATTR_BEACON_TAIL={0x10e, 0xf, [@perr={0x84, 0x108, {0x1, 0x10, [{{}, @broadcast, 0x7c, @void, 0x7e}, {{}, @device_a, 0x90, @void, 0x25}, {{0x0, 0x1}, @broadcast, 0x5, @value, 0x22}, {{0x0, 0x1}, @device_b, 0x5, @value, 0x30}, {{0x0, 0x1}, @device_a, 0x4, @value=@device_b, 0x1d}, {{}, @device_a, 0x6, @void, 0x3e}, {{}, @broadcast, 0x38000000, @void, 0x1d}, {{0x0, 0x1}, @broadcast, 0x7, @value, 0x3c}, {{}, @device_a, 0x0, @void, 0x26}, {{0x0, 0x1}, @device_b, 0x8ec, @value, 0xb}, {{0x0, 0x1}, @device_a, 0x1, @value, 0x40}, {{0x0, 0x1}, @device_a, 0x400, @value=@device_b, 0x1e}, {{0x0, 0x1}, @device_a, 0x7, @value=@broadcast, 0x33}, {{}, @broadcast, 0xdfb421f, @void, 0x3c}, {{0x0, 0x1}, @device_a, 0x8000, @value=@device_b, 0xa}, {{}, @device_a, 0x7a, @void, 0x32}]}}]}], @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}], @NL80211_ATTR_BEACON_INTERVAL={0x8}, @NL80211_ATTR_DTIM_PERIOD={0x8, 0xd, 0x7}]}, 0x18c}}, 0xc010) 1.299654439s ago: executing program 4 (id=7721): r0 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000740)={0x3, 0x4, 0x4, 0xa, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFNL_MSG_CTHELPER_NEW(r1, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000340)={0x58, 0x0, 0x9, 0x3, 0x0, 0x0, {}, [@NFCTH_PRIV_DATA_LEN={0x8}, @NFCTH_POLICY={0xc, 0x4, 0x0, 0x1, {0x8}}, @NFCTH_NAME={0x9, 0x1, 'syz0\x00'}, @NFCTH_TUPLE={0x24, 0x2, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @multicast2}, {0x8, 0x2, @empty}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}]}, 0x58}}, 0x0) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$MAP_CREATE(0x0, &(0x7f0000000580)=@base={0xa, 0x4, 0x8, 0x2, 0x0, 0x1}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xd, &(0x7f00000003c0)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000700000018110000", @ANYRESHEX=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bca2000000000000a6020000f8ffffffb703000001000000b704000000000000850000003300000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmsg$tipc(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000140)="a2", 0xfffffdef}], 0x1}, 0x0) writev(0xffffffffffffffff, &(0x7f0000000180)=[{&(0x7f0000000000)="8724866f", 0x4}], 0x1) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x8, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="1a04"], 0x0, 0x2, 0x0, 0x0, 0x41100, 0x44, '\x00', 0x0, @fallback=0x18, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close(r4) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) r7 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TDLS_OPER(r7, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000001c0)={0x1c, r6, 0x1, 0x70bd29, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r8}, @void}}}, 0x1c}}, 0x8000) r9 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TUNSETOFFLOAD(r9, 0xc004743e, 0x110e22fff6) r10 = socket(0xa, 0x3, 0x1) getsockopt(r10, 0xff, 0x0, 0x0, &(0x7f0000000040)) ioctl$TUNGETVNETLE(r4, 0x4010744d, &(0x7f0000000180)) ioctl$sock_SIOCBRADDBR(r2, 0x89a0, &(0x7f0000000100)='rose0\x00') r11 = socket$nl_route(0x10, 0x3, 0x0) r12 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0xd, 0x10, &(0x7f0000000580)=@framed={{0x18, 0x5}, [@snprintf={{}, {}, {}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r12}, {0x7, 0x0, 0xb, 0x4}, {0x85, 0x0, 0x0, 0x39}}]}, &(0x7f00000001c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sock_ops, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) sendmsg$nl_route(r11, &(0x7f0000000e00)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000002c0)=@ipmr_delroute={0x1c, 0x19, 0x1, 0x0, 0x0, {0x80, 0x20, 0x0, 0x0, 0x0, 0x11, 0xfe, 0x6}}, 0x1c}, 0x1, 0x0, 0x0, 0x40000d4}, 0x0) r13 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000500)={0x18, 0x3, &(0x7f00000002c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f00000000c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000380)='rxrpc_call\x00', r13}, 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0xa, 0x8, &(0x7f00000001c0)=ANY=[@ANYBLOB="1806000000000000000000000200000018120000", @ANYRES32=r0, @ANYBLOB="0000000000000000b70300000000000085000000665c96a2b7000000000000009500000000000000"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r13, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x3, 0x8, &(0x7f0000000240)=ANY=[@ANYBLOB="1806000000000000000000000000000018120000", @ANYRES32=r0, @ANYBLOB="0000000000000000b703000000000000850000000c000000b7000000000000009500009883"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 1.167437049s ago: executing program 3 (id=7723): r0 = socket$inet_smc(0x2b, 0x1, 0x0) r1 = socket$l2tp6(0xa, 0x2, 0x73) sendmsg$inet6(r1, &(0x7f0000000540)={&(0x7f0000000280)={0xa, 0x4e23, 0xfffffbff, @empty, 0xffff8428}, 0x1c, 0x0, 0x0, &(0x7f0000000700)=[@dstopts={{0x18, 0x29, 0x37, {0x67}}}, @hoplimit={{0x14, 0x29, 0x34, 0x2}}, @hopopts={{0x18, 0x29, 0x36, {0x5e}}}], 0x48}, 0x800) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000300)=@ipv6_getaddrlabel={0x30, 0x4a, 0x1, 0x0, 0x0, {0xa, 0x0, 0x80}, [@IFAL_ADDRESS={0x14, 0x1, @loopback}]}, 0x30}}, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='veno\x00', 0x5) listen(r0, 0x4000) close(r0) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000380)=ANY=[@ANYBLOB="18010000120000000000000000000000850000006d000000180100002020642500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], &(0x7f0000000040)='GPL\x00', 0x7, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xe, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40000000}, 0x94) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000002000)=@ipv6_delrule={0x54, 0x21, 0x1, 0x70bd2d, 0x25dfdbfe, {0xa, 0x20, 0x80, 0x2, 0x8, 0x0, 0x0, 0x3, 0x3}, [@FRA_SRC={0x14, 0x2, @local}, @FRA_DST={0x14, 0x1, @private2={0xfc, 0x2, '\x00', 0x1}}, @FIB_RULE_POLICY=@FRA_GOTO={0x8, 0x4, 0x6c9b}, @FIB_RULE_POLICY=@FRA_SUPPRESS_IFGROUP={0x8, 0xd, 0x5}]}, 0x54}, 0x1, 0x0, 0x0, 0x4}, 0x800) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000300)={&(0x7f0000000280)='contention_end\x00', r3, 0x0, 0x4}, 0x18) r5 = socket$inet_smc(0x2b, 0x1, 0x0) listen(r5, 0x0) accept4(r5, 0x0, 0x0, 0x40000) setsockopt$sock_int(r5, 0x1, 0x7, 0x0, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$fou(&(0x7f0000000000), r0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000080)={'bond0\x00', 0x0}) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r8, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000180)=ANY=[@ANYBLOB="500000001000ffff2bbd7000ffdbdf2500000000", @ANYRES64=r8, @ANYBLOB="00270200502a0c00280012800b00010069703667726500001800028014000700ff02000000000000000000000000000108000a00", @ANYRES32=r7, @ANYRESOCT=r8], 0x50}, 0x1, 0x0, 0x0, 0x8005}, 0x40040) 1.16270413s ago: executing program 0 (id=7724): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) ioctl$TUNSETOWNER(r1, 0x400454d4, 0x0) r2 = syz_init_net_socket$ax25(0x3, 0x3, 0x0) getsockopt$ax25_int(r2, 0x101, 0x9, &(0x7f0000000140), &(0x7f0000000180)=0x4) (async) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) (async) connect$inet(r3, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r3, 0x6, 0x16, &(0x7f0000000000)=[@mss, @timestamp, @window={0x3, 0x7}, @mss={0x2, 0xfff}], 0x4) (async) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000ac0)={&(0x7f0000000000)=ANY=[@ANYBLOB="440000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000002400128009180100626f6e640000110042851251fcf6576b1661edc10000000005001000"/56], 0x44}, 0x1, 0x0, 0x0, 0x4}, 0x0) 1.06948247s ago: executing program 1 (id=7725): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000280)={'wlan0\x00', 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_DEL_STATION(r3, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000680)={&(0x7f0000000500)={0x3c, r1, 0x1, 0x70bd2a, 0x25dfdbff, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_STA_PLINK_ACTION={0x5}, @NL80211_ATTR_STA_EXT_CAPABILITY={0x4}, @NL80211_ATTR_REASON_CODE={0x6, 0x36, 0x8}, @NL80211_ATTR_STA_PLINK_ACTION={0x5}, @NL80211_ATTR_STA_SUPPORTED_RATES={0x4}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4000}, 0x80) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xd, 0x4, &(0x7f0000000040)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x79, 0x11, 0xb0}, [@ldst={0x6}], {0x95, 0x0, 0xc00}}, &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sock_ops, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x1f2, 0x10, &(0x7f0000000000), 0xfffffe51}, 0x48) socket$inet(0x2, 0x1, 0x1) r4 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_int(r4, 0x0, 0x3, 0x0, 0x0) syz_emit_ethernet(0x6a, &(0x7f0000000180)={@local, @empty, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x4, 0x5c, 0x0, 0x0, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x4e22, 0x48, 0x0, @wg=@cookie={0x3, 0x2, "a0fcc73b5ef32a884b2033728e956f3f20d16734af14637c", "85eff9728117c4c62162a8a6a5340ad7eccbe4a1c68802028d6ef0a4df21f4a9"}}}}}}, 0x0) r5 = socket(0x11, 0x3, 0x0) setsockopt$SO_TIMESTAMPING(r5, 0x1, 0x41, &(0x7f00000000c0)=0x4f90, 0x4) sendmmsg(r5, &(0x7f00000023c0)=[{{&(0x7f0000000400)=@qipcrtr={0x2a, 0x1, 0x4001}, 0x80, &(0x7f0000000140)=[{&(0x7f0000000040)="d479183d7d98d181a4b5f3e38100", 0xe}], 0x1}}], 0x1, 0x24044015) recvmmsg(r5, &(0x7f0000005000)=[{{0x0, 0x0, 0x0}, 0xe5}], 0x1, 0x2002, 0x0) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r0, 0x84, 0x73, &(0x7f0000000080)={0x0, 0x5, 0x30, 0x1}, &(0x7f00000000c0)=0x18) getsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r0, 0x84, 0x22, &(0x7f0000000100)={0x4, 0x8207, 0x5, 0x100, r6}, &(0x7f0000000140)=0x10) 1.022887136s ago: executing program 2 (id=7726): syz_emit_ethernet(0x108, &(0x7f0000000140)={@broadcast, @empty, @void, {@ipv4={0x800, @tipc={{0x34, 0x4, 0x2, 0x8, 0xfa, 0x64, 0x0, 0x9, 0x6, 0x0, @rand_addr=0x64010100, @dev={0xac, 0x14, 0x14, 0x1d}, {[@timestamp_prespec={0x44, 0xc, 0xc9, 0x3, 0x6, [{@broadcast, 0xaa}]}, @timestamp_prespec={0x44, 0x1c, 0xd7, 0x3, 0xe, [{@multicast1, 0xcd0}, {@multicast2, 0xffff1e19}, {@private=0xa010102, 0x3}]}, @timestamp={0x44, 0x1c, 0xc4, 0x0, 0x6, [0x4, 0xdcf3, 0x1, 0x6, 0x8, 0x95e]}, @timestamp_addr={0x44, 0x2c, 0x6f, 0x1, 0xb, [{@multicast2, 0xe6}, {@initdev={0xac, 0x1e, 0x0, 0x0}, 0x8}, {@local, 0xfffffbff}, {@dev={0xac, 0x14, 0x14, 0x42}, 0x10000}, {@broadcast, 0xc60}]}, @cipso={0x86, 0x41, 0x2, [{0x6, 0xa, "45bc64d166955fad"}, {0x0, 0x8, "c8330ff833f0"}, {0x1, 0x2}, {0x7, 0xe, "2ca36ddedc8ad027f96780b6"}, {0x5, 0x4, '\t$'}, {0x2, 0xc, "26afb9f7ca9fcb25540d"}, {0x2, 0x7, "fa27472409"}, {0x1, 0x2}]}, @generic={0x83, 0x8, "10383d43b340"}, @end]}}, @payload_named={{{{{0x2a, 0x0, 0x0, 0x0, 0x1, 0xa, 0x0, 0x2, 0xf001, 0x0, 0x1, 0x4, 0x1, 0x2, 0x9, 0x3, 0x1, 0x4e21, 0x4e20}, 0x4, 0x1}, 0x0, 0x1}}, [0x0, 0x0]}}}}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@gettaction={0x50, 0x32, 0x20, 0x70bd25, 0x25dfdbfe, {}, [@action_gd=@TCA_ACT_TAB={0x1c, 0x1, [{0xc, 0x1c, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'bpf\x00'}}, {0xc, 0x1d, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'ife\x00'}}]}, @action_gd=@TCA_ACT_TAB={0x20, 0x1, [{0x10, 0x15, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'mirred\x00'}}, {0xc, 0x17, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x40}}]}]}, 0x50}, 0x1, 0x0, 0x0, 0x40000}, 0x4048801) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)=@newqdisc={0x24, 0x24, 0x1, 0x70bd2a, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {}, {0xffff, 0xffff}, {0x5}}}, 0x24}, 0x1, 0x0, 0x0, 0x40}, 0x0) (async) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="4800000010000d0428bd7000fcdbff2500008000", @ANYRES32=0x0, @ANYBLOB="1000000000000000280012800b0001006272696467650000180002"], 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0300000000000000280012800a00010076786c616e00"], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22cca65c15}, 0x4008840) (async) r0 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r0, &(0x7f00000002c0), 0x40000000000009f, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x13, 0x3, &(0x7f0000000000)=@framed={{0x4e, 0xa, 0xa, 0x0, 0x0, 0x71, 0x10, 0xa1}}, &(0x7f0000000480)='syzkaller\x00'}, 0x80) (async) socket$kcm(0x2, 0xd, 0x2) (async) r1 = syz_init_net_socket$x25(0x9, 0x5, 0x0) (async) r2 = socket$igmp(0x2, 0x3, 0x2) (async) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$MRT_ADD_VIF(r2, 0x0, 0xca, &(0x7f0000000000)={0x0, 0x0, 0xfd, 0x6, @vifc_lcl_ifindex, @remote}, 0x10) ioctl$SIOCX25SSUBSCRIP(r1, 0x89e1, &(0x7f0000003280)={'vxcan1\x00'}) (async) bind$l2tp6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x0, 0x8001, @loopback, 0x5, 0x3}, 0x20) 1.022152821s ago: executing program 3 (id=7727): r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000040)="100000002d000b02d25a806f8c6394f9101a04000a", 0x15}], 0x1}, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000000)="d80000001c0081044e81f782db44b9040a1d08030e000000e8fea4a1180015000600142603600e1208000f1000810401a80016000a0001", 0x37}], 0x1, 0x0, 0x0, 0x7400}, 0x10) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000000200)=ANY=[@ANYBLOB="b700000081000000bfa30000000000000703000009feffff720a00fef8ffffff71a400fe000000007110100000000000e5000200000000004704000001ed030407000000c00000001d440000000000006b0a00fe0000000072030000000a0000e500f9ff000000009500000000000000023bc065b58111c6dfa041b63af4a3912435f1a864a710aad58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a7168c50000000190f32050e436fe275daf51efd601b6bf01c8e8b1b526375ec4dd6fcd82e4fe51bef7af9aa0d7d600c095199fe3ff3128e599b0eaebbdbd732c9cc00eec363e4a8f6456e2cc21557c0afc646cb7798b3e6440c2fbdb00a3e35208b0bb0d2cd829e654400e2438ec649dc74a28610643a98d9ec21ead2ed51b104d4d91af25b845d8a7925c3109b151b8b9f75dd08d123deda88c658d42ecbf28bf7076c15b463bebc72f526d8e8afcb913466aaa7f6df70252e79166d858fcd0e06dd31af9612f2460d0b11008e59a5923906f88b53987ad1714e72ba7a54f0c33d39000d06a59ff616276fd9aa58f2477184b6a89adaf17b0a6041bdef728d236619074d6ebdfd1f5089048ddff6da40f9411fe722631cb467600ade70063e5291569b33d21dae356e1c51f03a801be8189679a16da18ec0ae564162a27afea62d84f3a10746443d6438e959532e0617d419c6bc6ea9f2bca4464f56e24e6d2105bd901204a1deeed4155617572652d950ad31928b0b0c3dc2869f478341d02d0f5ad94b081fcd507acb4b9c65fee9d5a17f48a7382f13d000000225d85ae49cee383dc5049076b989b40000000000000da60d2ae20cfb91d6a49964757cdf538f9ce2bdb1ab062cd54e67011d355d84ce97bb0c6b4a595e487efbb2d71cde2c140952f9a0f0bc6980fe78683ac5c0c31032599ddd71063be9261b2e1aab1675b34a26048ef8c126aeef5f510a8f1aded94a129e4aec6f8d9ab06faffc3a15d96c2ea3e2e04cfe031b2875353193f82ade69d0540059fe6c7fe7cd8697502c7596566d674e425da5e87e59602a9f6590521d31d3804b3e0a1053abdc31282dfb15eb6841bb64a1b304502dda787343ce3c953992e4a982f3c48153baae244e7bf37548c7f1a4cad2422ee965a38f7defbd2160242b104e20dc2d9b0c35608d402ccdd9069bd50b994fda7a9de44028d6112a0c2d21b2dc98816106dec28eaeb883418f562ae00003ea96d10f172c0374d6eed826416050000000bfe9b4a9c5a90ff59d54d1f92ecc4e95dd2d18383117c039862198899b212c55318294270a1ad10c80fef7c24d47afce829ba0f85da6d888f18ea40ab959f6074ab2a40d85d15017ab513cdc6c0e57fb1c1ca571380d7b4ead35a385e0b4a26b702396df7e0c1e02b6e4114f244a9bf93f04bf072f0861f7580e69db384ac7eeedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba34015ea5aacb1188883ad2a3b1832371fe5bc621426d1ed0a4a99702cc1b6912a1e717d29135753208165b9cdbae2ed9dc7358f0ebadde0b727f27feeb744ddcc536cbae315c7d1fe1399562ba6824840bd2951680f6f2f9a6a8346962a350845ffa0d829e4f79adc287906943408e6df3c391e97ba48db0a5adbfd03aac93df8866fb010aec0e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00e10000c95265b2bd83d64a532869d701723fedcbada1ee7baa5b6a686b50f0937f778af083e055f6138a757ebd0ed91124a6b244f9acf41ac5d73a008364e0606a594817031fc2f52c8785fe0721719b3d654026c6ea08b83b5703dad844ceb201ddeb6dc5f6a903792283c42efc54fa84323afc4c10eff462c8843187f1dd48ef3fa293774d582956ff0f40b10ca94f6feeb2893c17888e1cdba94a6ea80c33ead5722c3293a493f1479531dd88261458f40d31fe8df15efaaeea831555877f9538d6ee6ba65893ff1f908ba7554ba583fef3ec7932f5954f31a878e2fae6691d1aee1da02ba516467df3e7d1daac43738012e4fee18a22da19fcdb4c2890cda1f96b952511e3a69d694d625e0b2f808890205f3a6da2819d2f9e77c7c64affa54fec0136cbafa5f6f096753b639a924599c1f69219927ea5301fff0a6063d427f0688430754c02180d61542c2571f983e9673560000000000000000005a7b57f03ca91a01ba2e30ca99e8ebc15ecb4d91675767999d146aef7799738b292fd640dfef6b04d086f737a159d7e0c6e4d81ad64a8bbca48568325b2969e2b15f36b788bce5ccdbaf75c94cb93499f6947a967a7bce14c6de4e7c0660d80010f5c653d22d490cba8c2a4ab595bf4238f18ca428dafc7ac96d404607a0000000051a2104f22e6db5a62b5089c1b45282d38864daa3ae81d6b0968d1d2867b91b7d120617d12d91db2633d6864da40b54783a17aaeb6737c323f9f98e354cc98dcfe23ad01bd1c61563e69ffe1c2c73e16e1461173f359e93d2c5e424c17998809ec8f0232b3955e052a4cecd89008f70314a0bdec86f9b1eb93d491ec86a4555d89fe0120f64c62e8e3ed8bcb45202c3d4bbec8d722824c0ebca8db1ea4a003d2fbdc1f9be78537756ab5bbe4fe9af5d785d0128171c90d9900ce2532b0f9d01c4b45294fbba468df3e1b583cb4e62e754598e47df6bd06431c94bc5d047899fd219f448bf9189c65c9d91eda6b52a373803a9efe44f86909bc90addb7b9aee813df534aac4b3093c91b8068cd84990453f806694d461b76a58d88cf0f520310a1e80dc18cde9ad662eee077515d0a8811922929e085392ab3d1311b8243266d87047f601fa88a0da36b9f302e8262395174328f2482d14008de83070744f143fdec90ba5a82668d5fac114c13955ad6dca5db2231d8ba14c54c47ed04a4b4ace17e357e1d6432399f87a7a14245bbd796a090f3b247b95d37ff40a404bdad74bd20000000000000000000099fef7cd7af3ce64a92f95d89d125b1e641240d7e5e27a3d1f7684448c3e3822d617e205061298b939a191be4b48e169bde2cae3accc5bd40a2968b59c93d35f8e42366fdef9a2abae1cf01ce68abff28861aac8302d268569dd42e194e330c7aaa54ebbcefd23f21ce8153b9926e12e925cb56119df72c7533a48d028ad0c74e2a9478fa3be18a1a2b65079cc1c00000000000000f59dd19e8d525206c0a728cfd42193abe8130bc01a2d69841f3d7799ac04bdc590bb1c89b9c695f163e57343c9bfb59909433c9001c5f8b23e38534a538fc933cac6c2a92d038df638a0f226df9fb857bd414c2cd69985e8053e3dfa41614d7c74d04d8c2471041d17c730fad28395f8d4688898cd58b9d600c851626529bb58aa364b55e73f053450665e7b94ed1012fd7a8139166fd5e59c84f4ab279b1b99c028db4cb9680c8035f967db18de738844da7e260a830c1ffa49f5af3c15423a0e315acb82a3e89218cb314e68fda4d94aa1d815babc13b9fd336d205c5913ef67cf0216e2d81e6127bd9d7fab28800eaab2355992f8ce4cd38add4b272c0bee4076ca4847ffa691cf78fb7ec212bad3bef29f577ea7159b7f3025b3d977ff7c91024cf71126233cb8791c3c"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0xfffffffffffffd00}, 0x48) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={&(0x7f0000000000)=@in6={0xa, 0x0, 0x0, @mcast1}, 0x80, 0x0, 0x0, 0x0, 0x5c8}, 0x0) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907009875f37538e486dd6317ce620300fe"], 0xfe1b) r1 = socket$nl_generic(0x10, 0x3, 0x10) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r3 = openat$cgroup_int(r2, &(0x7f0000000840)='notify_on_release\x00', 0x2, 0x0) write$cgroup_int(r3, &(0x7f0000000040), 0x1) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000040), 0xffffffffffffffff) r5 = bpf$ITER_CREATE(0x21, &(0x7f00000000c0), 0x8) ioctl$SIOCGETSGCNT(r5, 0x89e1, &(0x7f00000001c0)={@empty, @loopback}) sendmsg$MPTCP_PM_CMD_DEL_ADDR(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)={0x20, r4, 0x7, 0x0, 0x0, {}, [@MPTCP_PM_ATTR_ADDR={0xc, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}]}]}, 0x20}}, 0x0) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="563f00001800599c6d0eab070004000523"], 0xfe33) bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x1, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b7050000000400007910a800000000005d0a0000000000009500000000000000"], &(0x7f00000002c0)='GPL\x00', 0x5, 0xfd90, &(0x7f0000000300)=""/188, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x1f3, 0x10, &(0x7f0000000080), 0xfffffffffffffc79}, 0x2a) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000440), r6) sendmsg$NLBL_UNLABEL_C_STATICLISTDEF(r6, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="14000000", @ANYRES16=r7, @ANYBLOB="07ef28bd7000fbdbdf2508"], 0x14}, 0x1, 0x0, 0x0, 0x1}, 0x41094) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000040), r6) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="563f000019"], 0xfe33) 930.807579ms ago: executing program 3 (id=7728): r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f00000000c0)={0x3, 0x1000}, 0x4) r1 = socket$kcm(0x10, 0x3, 0x10) sendmsg$kcm(r1, &(0x7f0000000000)={0x0, 0xffffff0a, &(0x7f0000000080)=[{&(0x7f0000000040)="c018030029000b12d25a80648c2594f90324fc60100c028010000000053582c137153e370248078000f01700d1bd", 0x33fe0}], 0x1}, 0x0) syz_emit_ethernet(0x68, &(0x7f0000005a40)={@multicast, @dev, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "75e700", 0x32, 0x3a, 0x0, @dev, @mcast2, {[], @param_prob={0x4, 0x0, 0x0, 0x0, {0x0, 0x6, "a3579e", 0x0, 0x2c, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @remote, [], "6be2"}}}}}}}, 0x0) setsockopt$packet_rx_ring(r0, 0x107, 0x5, &(0x7f0000000240)=@req3={0x1000, 0x3a, 0x1000, 0x3a, 0x7ff, 0xf84, 0x3}, 0x1c) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) 910.406434ms ago: executing program 4 (id=7729): r0 = socket$inet6(0xa, 0x2, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000200)=@newlink={0x50, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x5b5d}, [@IFLA_AF_SPEC={0x1c, 0x1a, 0x0, 0x1, [@AF_INET6={0x18, 0xa, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @rand_addr=' \x01\x00'}]}]}, @IFLA_ALT_IFNAME={0x14, 0x35, 'wg1\x00'}]}, 0x50}}, 0x0) r2 = socket(0x10, 0x803, 0x0) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), r2) getsockname$packet(r2, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000000c0)=0x14) sendmsg$nl_route(r2, &(0x7f0000000440)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000100)=@newlink={0x48, 0x10, 0x437, 0x0, 0x0, {0x0, 0x0, 0x0, r4, 0x50483}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @gre={{0x8}, {0x1c, 0x2, 0x0, 0x1, [@IFLA_GRE_LOCAL={0x8, 0x6, @remote}, @IFLA_GRE_ENCAP_TYPE={0x6, 0xe, 0x1}, @IFLA_GRE_ENCAP_FLAGS={0x6, 0xf, 0x4bb7}]}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x40000}, 0x4000000) sendmmsg$inet(r0, &(0x7f0000000880)=[{{&(0x7f0000000040)={0x2, 0x4e1c, @multicast1}, 0x10, 0x0, 0x0, &(0x7f0000000000)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {r4, @empty, @multicast1}}}], 0x20}}], 0x1, 0x4880) r5 = socket$netlink(0x10, 0x3, 0x6) sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(r5, &(0x7f0000000300)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000280)={&(0x7f00000001c0)={0x64, r3, 0x800, 0x70bd28, 0x25dfdbfe, {{}, {@void, @void}}, [@NL80211_ATTR_DURATION={0x8, 0x57, 0x80}, @chandef_params=[@NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0x8}, @NL80211_ATTR_CHANNEL_WIDTH={0x8}, @NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x971}, @NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x7}, @NL80211_ATTR_CHANNEL_WIDTH={0x8}, @NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x3}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x1}, @NL80211_ATTR_WIPHY_EDMG_BW_CONFIG={0x5, 0x119, 0xf}, @NL80211_ATTR_WIPHY_EDMG_BW_CONFIG={0x5, 0x119, 0x9}]]}, 0x64}, 0x1, 0x0, 0x0, 0x8000}, 0x84) 822.915456ms ago: executing program 0 (id=7730): r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$sock_attach_bpf(r0, 0x1, 0x46, &(0x7f0000000380), 0x4) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB="1c0000001500010000000000000000000100000008000100", @ANYRES16=r1], 0x1c}}, 0x0) r2 = accept4$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @loopback}}, &(0x7f0000000040)=0x1c, 0x0) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f00000003c0), 0xffffffffffffffff) r4 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f00000002c0)={'erspan0\x00', 0x0}) sendmsg$nl_route(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000000c0)=@newlink={0x40, 0x10, 0xc3b, 0x0, 0x0, {0x0, 0x0, 0x0, r6}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @erspan={{0xb}, {0x10, 0x2, 0x0, 0x1, [@IFLA_GRE_COLLECT_METADATA={0x4}, @IFLA_GRE_ENCAP_DPORT={0x6}]}}}]}, 0x40}}, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r7, 0x8933, &(0x7f0000000540)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_KEY(r7, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000680)={&(0x7f00000001c0)=ANY=[@ANYBLOB="02000000", @ANYRES16=r3, @ANYBLOB="010800000000fedbdf250b00000008000300", @ANYRES32=r8, @ANYBLOB="0a0006000802110000010000200050800500020002000000090001007ee5d52ffd000000080003000aac0f00"], 0x48}}, 0x40000) sendto$l2tp6(r2, &(0x7f00000000c0)="613dd7c84739eb229261cf2fe54f48a143286146581cbde6ca62f4e01e729859a1133cf0537fbb54059ece4f33fe0440a6766187fe2e2bc4e8d3a35ff08c1204fd2ab46282589ef699e00653a265cb2da28f97c7208c26416c1be91e13a1", 0x5e, 0x4000, 0x0, 0x0) r9 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(r9, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000080)=ANY=[@ANYBLOB="3c000000100005ff00000000000000000000004a", @ANYRES32=0x0, @ANYBLOB="000000000000000014001280090001007665ae87591fe863daf60204164b716ce246a000"], 0x3c}}, 0x0) 817.608349ms ago: executing program 2 (id=7731): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340), 0x702, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) bind$netlink(r1, &(0x7f00000000c0)={0x10, 0x0, 0x25dfdbff, 0x80000000}, 0xc) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0x25dfdbfb, {0x0, 0x0, 0x0, r3, {0x0, 0x1}, {0xffff, 0xffff}, {0xffff, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0xfffe}}}]}, 0x38}}, 0x4000) sendmsg$nl_route_sched(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000002980)=@newtfilter={0x60, 0x2c, 0xd27, 0x30bd29, 0x25dfdbff, {0x0, 0x0, 0x0, r3, {0x0, 0xd}, {}, {0x7}}, [@filter_kind_options=@f_flow={{0x9}, {0x30, 0x2, [@TCA_FLOW_EMATCHES={0x2c, 0xb, 0x0, 0x1, [@TCA_EMATCH_TREE_LIST={0x20, 0x2, 0x0, 0x1, [@TCF_EM_U32={0x1c, 0x3, 0x0, 0x0, {{0xb, 0x3, 0x200}, {0x81, 0x5, 0x58, 0x8}}}]}, @TCA_EMATCH_TREE_HDR={0x8}]}]}}]}, 0x60}, 0x1, 0x0, 0x0, 0x24000014}, 0x200e4040) setsockopt$pppl2tp_PPPOL2TP_SO_SENDSEQ(r1, 0x111, 0x3, 0x0, 0x4) 779.098087ms ago: executing program 1 (id=7732): setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f00000002c0)='reno\x00', 0x5) (async) r0 = socket$nl_crypto(0x10, 0x3, 0x15) sendmsg$nl_crypto(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000032c0)=ANY=[@ANYBLOB="e000000015000000000000000000000070636263286663727970742d67656e6572696329000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000096141c54cdef7a05698cee949dad43c2181ef8506f9db6a1cae6fee8a18357713e5d737bc425effec8b2a9c8ea7422319671032e557ec9af1976fd8bcd54c0f1d741e5f72e4b33390de8bcb4e3a55646dc321bae3d3d80e0338da1793f01b23fee4f10ce4ef9fec41b91ed15de755c05b085f3d0540ca84737325586c7778859c63eb9cd5e768887c6ecf5f4143a9833c679a7eea85c2ec27a9eefa6f7943f889eebce18241b3dc39a32000000000000"], 0xe0}}, 0x0) (async) sendmsg$nl_crypto(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="e8000000110001"], 0xe8}}, 0x0) (async) r1 = socket(0xa, 0x3, 0x9) (async) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) (async) r3 = socket$inet(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) (async) r5 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r5, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000240)=@newqdisc={0x2c, 0x24, 0x8, 0x70bd2b, 0x0, {0x0, 0x0, 0x12, r4, {0x0, 0x1}, {0xffff, 0xffff}, {0x1, 0xffff}}, [@TCA_EGRESS_BLOCK={0x8, 0xe, 0x6}]}, 0x2c}}, 0x0) (async) ioctl$TUNSETLINK(r2, 0x400454cd, 0x304) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) (async) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close(r7) (async, rerun: 64) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) (async, rerun: 64) close(r6) (async) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000a40)) (async) ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000000140)={'ip6gretap0\x00', @random}) (async) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f00000012c0)={0x7, [{}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0}], 0x8, "b2ecb1cfa24c6f"}) ioctl$BTRFS_IOC_INO_LOOKUP(r1, 0xd0009412, &(0x7f00000022c0)={r9, 0x400}) (async) getsockopt$nfc_llcp(r1, 0x3a, 0x0, 0x0, 0x2000005d) (async) ioctl$sock_kcm_SIOCKCMCLONE(r1, 0x89e2, &(0x7f0000000040)={r1}) (async) r11 = syz_genetlink_get_family_id$ethtool(&(0x7f00000001c0), r1) (async) r12 = socket$nl_generic(0x10, 0x3, 0x10) r13 = syz_genetlink_get_family_id$devlink(&(0x7f0000000340), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RATE_GET(r12, &(0x7f0000000700)={0x0, 0x0, &(0x7f0000000c00)={&(0x7f00000006c0)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r13, @ANYBLOB="190300000000000000004a0000000e0002"], 0x34}}, 0x0) getsockopt$inet6_mtu(r8, 0x29, 0x17, &(0x7f0000000400), &(0x7f0000000440)=0x4) sendmsg$ETHTOOL_MSG_COALESCE_SET(r10, &(0x7f0000000280)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)=ANY=[@ANYBLOB="14340000", @ANYRES16=r11, @ANYBLOB="00012cbd7000fcdbdf2514000000"], 0x14}, 0x1, 0x0, 0x0, 0x8c0}, 0x0) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x5, &(0x7f0000000540)=ANY=[@ANYRES8], &(0x7f0000000140)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8}, 0x94) 678.763096ms ago: executing program 4 (id=7733): r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r0, 0x107, 0x11, 0x0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) setsockopt$bt_rfcomm_RFCOMM_LM(0xffffffffffffffff, 0x12, 0x3, &(0x7f0000000080)=0x2, 0x4) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r2 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'team_slave_1\x00', @link_local}) write$tun(r1, &(0x7f0000000040)=ANY=[@ANYBLOB="1c00000e"], 0xf) 660.353055ms ago: executing program 1 (id=7734): r0 = socket$netlink(0x10, 0x3, 0x13) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000004c0), 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000080)={'\x00', 0x8411}) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000240)='cpuacct.usage_percpu\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x0, 0x28011, r4, 0x0) ioctl$TUNSETVNETLE(r3, 0x400454dc, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000002c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000001340)={&(0x7f0000000680)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r2, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r5, @ANYBLOB="d506330300021100000100"/20], 0x6f4}}, 0x4881) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)={{0x14}, [@NFT_MSG_NEWRULE={0x50, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x24, 0x4, 0x0, 0x1, [{0x20, 0x1, 0x0, 0x1, @ct={{0x7}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_CT_KEY={0x8, 0x2, 0x1, 0x0, 0xf}, @NFTA_CT_DREG={0x8, 0x1, 0x1, 0x0, 0x2}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x78}}, 0x0) r7 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r7, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) syz_emit_ethernet(0x3e, &(0x7f0000000140)=ANY=[@ANYBLOB="aaaaaaaaaaaa00ffffff080047000030ffff000000069078ac147f0faf42a1aac37a000000000000000011ea", @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB="5c02000090780000"], 0x0) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_GET_SURVEY(r0, &(0x7f0000000d00)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x1c, r2, 0x8, 0x70bd28, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r5}, @void}}, [""]}, 0x1c}, 0x1, 0x0, 0x0, 0x40041}, 0x4005) sendmsg$NL80211_CMD_GET_SURVEY(r0, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000100)={&(0x7f0000000c40)={0x1c, r2, 0x4, 0x70bd29, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r8}, @void}}, ["", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x4) r9 = socket$nl_route(0x10, 0x3, 0x0) r10 = socket$inet6_sctp(0xa, 0x1, 0x84) r11 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r11, 0x10e, 0xc, &(0x7f0000000040)={0x80}, 0x213) sendmsg$nl_route(r11, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="280000001a00010000000000000000000a00000900000000000000000c0009"], 0x28}, 0x1, 0x0, 0x0, 0x20040000}, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r10, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x1c, &(0x7f00000020c0)=[@in6={0xa, 0x0, 0x0, @remote, 0x34}]}, &(0x7f0000002100)=0x10) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000100)={0x10, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x1, 0x2, 0x3, 0x0, 0x1, 0x3a}]}, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x8}, 0x80) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r10, 0x84, 0x66, 0x0, &(0x7f0000000180)) sendmsg$nl_route(r9, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000140)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bridge={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BR_MCAST_LAST_MEMBER_CNT={0x8, 0x14}]}}}]}, 0x3c}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000000200)=ANY=[@ANYBLOB="b700000081000000bfa30000000000000703000009feffff720a00fef8ffffff71a400fe0000000071101000000000001d300200000000004704000001ed030407000000c00000001d440000000000006b0a00fe0000000072030000000a0000e500f9ff000000009500000000000000023bc065b58111c6dfa041b63af4a3912435f1a864a710aad58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a7168c50000000190f32050e436fe275daf51efd601b6bf01c8e8b1b526375ec4dd6fcd82e4fe51bef7af9aa0d7d600c095199fe3ff3128e599b0eaebbdbd732c9cc00eec363e4a8f6456e2cc21557c0afc646cb7798b3e6440c2fbdb00a3e35208b0bb0d2cd829e654400e2438ec649dc74a28610643a98d9ec21ead2ed51b104d4d91af25b845d8a7925c3109b151b8b9f75dd08d123deda88c658d42ecbf28bf7076c15b463bebc72f526d8e8afcb913466aaa7f6df70252e79166d858fcd0e06dd31af9612f2460d0b11008e59a5923906f88b53987ad1714e72ba7a54f0c33d39000d06a59ff616276fd9aa58f2477184b6a89adaf17b0a6041bdef728d236619074d6ebdfd1f5089048ddff6da40f9411fe722631cb467600ade70063e5291569b33d21dae356e1c51f03a801be8189679a16da18ec0ae564162a27afea62d84f3a10746443d6438e959532e0617d419c6bc6ea9f2bca4464f56e24e6d2105bd901204a1deeed4155617572652d950ad31928b0b0c3dc2869f478341d02d0f5ad94b081fcd507acb4b9c65fee9d5a17f48a7382f13d000000225d85ae49cee383dc5049076b989b40000000000000da60d2ae20cfb91d6a49964757cdf538f9ce2bdb1ab062cd54e67011d355d84ce97bb0c6b4a595e487efbb2d71cde2c140952f9a0f0bc6980fe78683ac5c0c31032599ddd71063be9261b2e1aab1675b34a26048ef8c126aeef5f510a8f1aded94a129e4aec6f8d9ab06faffc3a15d96c2ea3e2e04cfe031b2875353193f82ade69d0540059fe6c7fe7cd8697502c7596566d674e425da5e87e59602a9f6590521d31d3804b3e0a1053abdc31282dfb15eb6841bb64a1b304502dda787343ce3c953992e4a982f3c48153baae244e7bf37548c7f1a4cad2422ee965a38f7defbd2160242b104e20dc2d9b0c35608d402ccdd9069bd50b994fda7a9de44028d6112a0c2d21b2dc98816106dec28eaeb883418f562ae00003ea96d10f172c0374d6eed826416050000000bfe9b4a9c5a90ff59d54d1f92ecc4e95dd2d18383117c039862198899b212c55318294270a1ad10c80fef7c24d47afce829ba0f85da6d888f18ea40ab959f6074ab2a40d85d15017ab513cdc6c0e57fb1c1ca571380d7b4ead35a385e0b4a26b702396df7e0c1e02b6e4114f244a9bf93f04bf072f0861f7580e69db384ac7eeedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba34015ea5aacb1188883ad2a3b1832371fe5bc621426d1ed0a4a99702cc1b6912a1e717d29135753208165b9cdbae2ed9dc7358f0ebadde0b727f27feeb744ddcc536cbae315c7d1fe1399562ba6824840bd2951680f6f2f9a6a8346962a350845ffa0d829e4f79adc287906943408e6df3c391e97ba48db0a5adbfd03aac93df8866fb010aec0e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00e10000c95265b2bd83d64a532869d701723fedcbada1ee7baa5b6a686b50f0937f778af083e055f6138a757ebd0ed91124a6b244f9acf41ac5d73a008364e0606a594817031fc2f52c8785fe0721719b3d654026c6ea08b83b5703dad844ceb201ddeb6dc5f6a903792283c42efc54fa84323afc4c10eff462c8843187f1dd48ef3fa293774d582956ff0f40b10ca94f6feeb2893c17888e1cdba94a6ea80c33ead5722c3293a493f1479531dd88261458f40d31fe8df15efaaeea831555877f9538d6ee6ba65893ff1f908ba7554ba583fef3ec7932f5954f31a878e2fae6691d1aee1da02ba516467df3e7d1daac43738012e4fee18a22da19fcdb4c2890cda1f96b952511e3a69d694d625e0b2f808890205f3a6da2819d2f9e77c7c64affa54fec0136cbafa5f6f096753b639a924599c1f69219927ea5301fff0a6063d427f0688430754c02180d61542c2571f983e9673560000000000000000005a7b57f03ca91a01ba2e30ca99e8ebc15ecb4d91675767999d146aef7799738b292fd640dfef6b04d086f737a159d7e0c6e4d81ad64a8bbca48568325b2969e2b15f36b788bce5ccdbaf75c94cb93499f6947a967a7bce14c6de4e7c0660d80010f5c653d22d490cba8c2a4ab595bf4238f18ca428dafc7ac96d404607a0000000051a2104f22e6db5a62b5089c1b45282d38864daa3ae81d6b0968d1d2867b91b7d120617d12d91db2633d6864da40b54783a17aaeb6737c323f9f98e354cc98dcfe23ad01bd1c61563e69ffe1c2c73e16e1461173f359e93d2c5e424c17998809ec8f0232b3955e052a4cecd89008f70314a0bdec86f9b1eb93d491ec86a4555d89fe0120f64c62e8e3ed8bcb45202c3d4bbec8d722824c0ebca8db1ea4a003d2fbdc1f9be78537756ab5bbe4fe9af5d785d0128171c90d9900ce2532b0f9d01c4b45294fbba468df3e1b583cb4e62e754598e47df6bd06431c94bc5d047899fd219f448bf9189c65c9d91eda6b52a373803a9efe44f86909bc90addb7b9aee813df534aac4b3093c91b8068cd84990453f806694d461b76a58d88cf0f520310a1e80dc18cde9ad662eee077515d0a8811922929e085392ab3d1311b8243266d87047f601fa88a0da36b9f302e8262395174328f2482d14008de83070744f143fdec90ba5a82668d5fac114c13955ad6dca5db2231d8ba14c54c47ed04a4b4ace17e357e1d6432399f87a7a14245bbd796a090f3b247b95d37ff40a404bdad74bd20000000000000000000099fef7cd7af3ce64a92f95d89d125b1e641240d7e5e27a3d1f7684448c3e3822d617e205061298b939a191be4b48e169bde2cae3accc5bd40a2968b59c93d35f8e42366fdef9a2abae1cf01ce68abff28861aac8302d268569dd42e194e330c7aaa54ebbcefd23f21ce8153b9926e12e925cb56119df72c7533a48d028ad0c74e2a9478fa3be18a1a2b65079cc1c00000000000000f59dd19e8d525206c0a728cfd42193abe8130bc01a2d69841f3d7799ac04bdc590bb1c89b9c695f163e57343c9bfb59909433c9001c5f8b23e38534a538fc933cac6c2a92d038df638a0f226df9fb857bd414c2cd69985e8053e3dfa41614d7c74d04d8c2471041d17c730fad28395f8d4688898cd58b9d600c851626529bb58aa364b55e73f053450665e7b94ed1012fd7a8139166fd5e59c84f4ab279b1b99c028db4cb9680c8035f967db18de738844da7e260a830c1ffa49f5af3c15423a0e315acb82a3e89218cb314e68fda4d94aa1d815babc13b9fd336d205c5913ef67cf0216e2d81e6127bd9d7fab28800eaab2355992f8ce4cd38add4b272c0bee4076ca4847ffa691cf78fb7ec212bad3bef29f577ea7159b7f3025b3d977ff7c91024cf71126233cb8791c3c"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0xfffffffffffffd00}, 0x48) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) ioctl$FIOCLEX(r12, 0x5451) 611.366036ms ago: executing program 3 (id=7735): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r1, &(0x7f0000000100)={0x18, 0x0, {0x3, @broadcast, 'batadv_slave_0\x00'}}, 0x1e) ioctl$PPPOEIOCSFWD(r1, 0x4008b100, &(0x7f0000004500)={0x18, 0x0, {0x2, @local, 'nicvf0\x00'}}) syz_emit_ethernet(0x4e, &(0x7f0000000700)={@broadcast, @broadcast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x40, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast}, @time_exceeded={0x21, 0x0, 0x0, 0x12, 0x0, 0x2802, {0x9, 0x2, 0x0, 0x0, 0x24, 0x0, 0x0, 0x0, 0x0, 0x0, @multicast2, @rand_addr=0xe0000000, {[@ra={0x94, 0x4}, @cipso={0x86, 0x9, 0x0, [{0x0, 0x3, "d2"}]}]}}}}}}}, 0x0) (async) syz_emit_ethernet(0x4e, &(0x7f0000000700)={@broadcast, @broadcast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x40, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast}, @time_exceeded={0x21, 0x0, 0x0, 0x12, 0x0, 0x2802, {0x9, 0x2, 0x0, 0x0, 0x24, 0x0, 0x0, 0x0, 0x0, 0x0, @multicast2, @rand_addr=0xe0000000, {[@ra={0x94, 0x4}, @cipso={0x86, 0x9, 0x0, [{0x0, 0x3, "d2"}]}]}}}}}}}, 0x0) r2 = socket$nl_audit(0x10, 0x3, 0x9) sendmsg$AUDIT_TTY_SET(r2, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x18, 0x3f9, 0x2, 0x70bd26, 0x25dfdbfe, {0x1}, ["", "", "", "", "", "", "", ""]}, 0x18}}, 0x20) (async) sendmsg$AUDIT_TTY_SET(r2, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x18, 0x3f9, 0x2, 0x70bd26, 0x25dfdbfe, {0x1}, ["", "", "", "", "", "", "", ""]}, 0x18}}, 0x20) r3 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000c80)={'lo\x00'}) (async) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000c80)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000001200)={0x0, 0x35, &(0x7f0000000000)={&(0x7f0000000140)=@newqdisc={0x60, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {0x0, 0x1}, {0x6, 0xffff}, {0x10}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x30, 0x2, {{}, [@TCA_NETEM_RATE={0x14, 0xd, {0x0, 0x10}}, @TCA_NETEM_REORDER={0x0, 0x3, {0x8, 0x5469}}, @TCA_NETEM_JITTER64={0x0, 0xb, 0x3}]}}}]}, 0x60}}, 0x0) (async) sendmsg$nl_route_sched(r0, &(0x7f0000001200)={0x0, 0x35, &(0x7f0000000000)={&(0x7f0000000140)=@newqdisc={0x60, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {0x0, 0x1}, {0x6, 0xffff}, {0x10}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x30, 0x2, {{}, [@TCA_NETEM_RATE={0x14, 0xd, {0x0, 0x10}}, @TCA_NETEM_REORDER={0x0, 0x3, {0x8, 0x5469}}, @TCA_NETEM_JITTER64={0x0, 0xb, 0x3}]}}}]}, 0x60}}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1a00000000001000fe1f00"/20, @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0xe, 0xe, &(0x7f0000001880)=ANY=[@ANYBLOB="b700000081000000bfa300000000000007030000f1feffff720af0fff8ffffff71a4f0ff0000000071108600000000001d400500000000002604000001ed00000f030000000000007c440000000000006b0a00fe000000007203000000000006b5000000000000009500000000000000023bc065b58111c6dfa041b63af4a3912435f18564a710aad58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a7168c50000000190f32050e436fe275daf51efd601b6bf01c8e8b1b526375ec4dd6fcd82e4fe51bef7af9aa0d7d600c095199fe3ff3128e599b0eaebbdbd732c9cc00eec363e4a8f6456e2cc21557c26fc646cb7798b3e6440c2fbdb00a3e35208b0bb0d2cd829e654400e2438ec649dc74a28610643a98d9ec21ead2ed51b104d4d91af25b845d8a7925c3109b151b8b9f75dd08d123deda88c658d42ecbf28bf7076c15b463bebc72f526d8e8afcb913466aaa7f6df70252e79166d858fcd0e06dd31af9612f2460d0b11008e59a5923906f88b53987ad1714e72ba7a54f0c33d39000d06a59ff616236fd9aa58f2477184b6a89adaf17b0a6041bdef728d236619074d6ebdfd1f5089048ddff6da40f9411fe722631cb467600ade70063e5291569b33d21dae356e1c51f03a801be8189679a16da18ec0ae564162a27afea62d84f3a10746443d6438e959532e0617d419c6bc6ea9f2bca4464f56e24e6d2105bd901204a1deeed4155617572652d950ad31928b0b0c3dc2869f478341d02d0f5ad94b081fcd507acb4b9c65fee9d5a17f48a7382f13d000000225d85ae49cee383dc5049076b989b40000000000000da60d2ae20cfb91d6a49964757cdf538f9ce2bdb1ab062cd54e67011d355d84ce97bb0c6b4a595e487efbb2d71cde2c140952f9a0f0bc6980fe78683ac5c0c31032599ddd71063be9261b2e1aab1675b34a22048ef8c126aeef5f510a8f1aded94a129e4aec6f8d9ab06faffc3a15d96c2ea3e2e04cfe031b2875353193f82ade69d0540059fe6c7fe7cd8697502c7596566d674e425da5e87e59602a9f6590521d31d3804b3e0a1053abdc31282dfb15eb6841bb64a1b304502dda787343ce3c953992e4a982f3c48153baae244e7bf37548c7f1a4cad2422ee965a38f7defbd2160242b104e20dc2d9b0c35608d402ccc99069bd50b994fda7a9de44028d6112a0c2d21b2dc98816106dec28eaeb883418f562ae00003ea96d10f172c0374d6eed826416050000000bfe9b4a9c5a90ff59d54d1f92ecc4e95dd2d18383117c039862198899b212c55318294270a1ad10c80fef7c24d47afce829ba0f85da6d888f18ea40ab959f6074ab2a40d85d15017ab513cdc6c0e57fb1c1ca571380d7b4ead35a385e0b4a26b702396df7e0c1e02b6e4114f244a9bf93f04bf072f0861f7580e69db384ac7eeedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba34015ea5aacb1188883ad24b89b6a3b1832371fe5bc621426d1ed0a4a99702cc1b6912a1e717d29135753208165b9cdbae2ed9dc7358f0ebadde0b727f27feeb744ddcc536cbae315c7d1fe1399562ba6824840bd2951680f6f2f9a6a8346962a350845ffa0d829e4f79adc287906943408e6df3c391e97ba48db0a5adbfd03aac93df8866fb010aec0e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00e10000c95265b2bd83d64a532869d701723fedcbada1ee7baa5b6a686b50f0937f778af083e055f6138a757ebd0ed91124a6b244f9acf41ac5d73a008364e0606a594817031fc2f52c87852730a3bd7ac923fe0721719b3d654026c6ea08b83b123145ab5703dad844ceb201ddeb6dc5f6a903792283c42efc54fa84323afc4c10eff462c8843187f1dd48ef3fa293774d582956ff0f40b10ca94f6feeb2893c17888e1cdba94a6ea80c33ead5722c3293a493f1479531dd88261458f40d31fe8df15efaaeea831555877f9538d6ee6ba65893ff1f908ba7554ba583fef3ec7932f5954f31a878e2fae6691d1aee1da02ba516467df3e7d1daac43738012e4fee18a22da19fcdb4c2890cda1f96b952511e3a69d694d625e0b2f808890205f3a6da2819d2f9e77c7c64affa54fec0136cbafa5f6f096753b639a924599c1f69219927ea5301fff0a6063d427f0688430754c02180d61542c2571f983e9673560000000000000000005a7b57f03ca91a01ba2e30ca99e8ebc15ecb4d91675767999d146aef7799738b292fd640dfef6b04d086f737a159d7e0c6e4d81ad64a8bbca4856ff03b2969e2b15f36b788bce5ccdbaf75c94cb93499f6947a967a7bce14c6de4e7c0660d80010f5c653d22d490cba8c2a4ab595bf4238f18ca428dafc7ac96d404607a0000000051a2104f22e6db5a62b5089c1b45282d38864daa3ae81d6b0968d1d2867b91b7d120617d12d91db2633d6864da40b54783a17aaeb6737c323f9f98e354cc98dcfe23ad01bd1c61563e69ffe1c2c73e16e1461173f359e93d2c5e424c17998809ec8f0232b3955e052a4cecd89008f70314a0bdd491ec860cde7c79f7b4d4e24c62e8e3ed8bcb45202c3d4bbec8d722824c0ebca8db1ea4a003d2fbdc1f9be78537756ab5bbe4fe9af5d785d0128171c90d9900ce2532b0f9d01c4b450100000001000000393cb4e62e754598e47df6bd06431c94bc5d047899fd219f448bf9189c65c9d91eda6b52a373803a9efe44f86909bc90addb7b9aee813df534aac4b3093c91b8068cd84990453f006694d461b76a58d88cf0f520310a1e80dc18cde98d662eee077515d0a8811922929e085392ab3d1311b8243266d87047f601fa88a0da36b9f302e8262395174328f2482d14008de83070744f143fdec90ba5a82668d5fac114c13955ad6dca5db2231d8ba14c54c47ed04a4b4ace17e357e1d6432399f87a7a14245bbd796a09313b247b95d37ff40a404bdad74bd20000000000000000000099fef7cd7af3ce64a92f95d89d125b1e641240d7e5e27a3d1f7684448c3e3822d617e205061298b939a191be4b48e169bde2cae3accc5bd40a2968b59c93d35f8e42366fdef9a2abae1cf01ce68abff28861aac8302d268569dd42e194e330c7aaa54ebbcefd23f21ce8153b9926e12e925cb56119df72c7533a48d028ad0c74e2a9478fa3be18a1a2b65079cc1c00400000000000f59dd19e8d525206c0a728cfd42193abe8130bc01a2d69841f3d7799ac04bdc590bb1c89b9c695f163e57343c9bfb59909433c9001c5f8b23e38534a538fc933cac6c2a92d038df638a0f226df9fb857bd414c2cd69985e8053e3dfa41614d7c74d04d8c2471041d17c730fad28395f8d4688898cd58b9d600c851626529bb58aa364b55e73f053450665e7b94ed1012fd7a8139166fd599c028db4cb9680c8035f967db18de738844da7e260a830c1ffa49f5af3c15423a0e315acb82a3e89218cb314e68fda4d94aa1d815babc13b9fd336d205c5913ef67cf0216e2d81e6127bd9d7fab28800eaab2355992f8ce4cd38add4b272c0bee4076ca4847ffa691cf78fb7ec212bad3bef29f577ea7159b7f3025b3d977ff7c91024cf71126233cb80610eb37bd2d40ebdfed687f0b093e68f10b72146a0b749ee2105e2da94a288146abbbaf7c0b24fe0000000000000000f1a4f4de6a8d12dc9e71a20cbd412898586843b534d36e21379a8a06133c1babde9e5bd5b6afc5f684aada43ee560e800f58cb33b8483f6518abde7c86bd5d389c1b3c40fdd4bebe4adf87b1025ff57eb50984cc5bad9ea1c15484ea627c3c1501d612ed65939266e7332966f03e0376076e7c5dfe25f367dda7f69db89829b360dd2f59cbaad10f13e269eca792725bbacb96aa0a5c426ca76f84322661"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0xffa3}, 0x48) 542.958393ms ago: executing program 2 (id=7736): pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = syz_init_net_socket$ax25(0x3, 0x3, 0xf0) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r3, 0x107, 0x12, &(0x7f0000000040)={0x0, 0x6}, 0x4) setsockopt$packet_fanout_data(r3, 0x107, 0x16, &(0x7f0000000100)={0x2, &(0x7f0000000180)=[{0x6c}, {0x6}]}, 0x10) ioctl$SIOCAX25GETINFOOLD(r2, 0x89e9, &(0x7f0000000200)) vmsplice(r0, &(0x7f0000000240)=[{&(0x7f00000000c0)='s', 0x1}], 0x1, 0x2) r4 = syz_init_net_socket$x25(0x9, 0x5, 0x0) ioctl$SIOCX25GSUBSCRIP(r4, 0x89e0, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=@ipv6_getanyicast={0x14, 0x3e, 0x100, 0x70bd2d, 0x25dfdbfe, {}, ["", ""]}, 0x14}}, 0x2000c800) accept$nfc_llcp(r1, 0x0, &(0x7f0000000100)) r6 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) accept4(r6, 0x0, 0x0, 0x0) 535.525026ms ago: executing program 0 (id=7737): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='blkio.bfq.io_merged_recursive\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x0, 0x28011, r0, 0x0) r1 = syz_init_net_socket$x25(0x9, 0x5, 0x0) ioctl$SIOCX25SCALLUSERDATA(r1, 0x89e5, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="1a00000000000000000000000000000066380000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000004000000000005000000000000000000000000000000000000008d86b854e2606e67f04857e6ebecc97cde38b998183648beb6c50c24014ed445e1da1bfd92edef74ece9e94b062bc750054d3280a1d79da2473120619f4a14c2129d8483c5a1b36fb5d53f385aed9637d2db5f1b6bc76aadf370c6592da676a6ebaaf1d472963c0537b241381b771f596406463deb79eea0f4f2e42094a67eaf9d7211d782d42560dae4aae301d5aa9ddca553353a9dca0e592358de43836497166c5d8edbeb66e5c1cf4449ef8a520bb65ca3c45539ee641925ac27b24de5722c9c13bcf0daf2c7901ffeda1758952c287d6a2afcd90ec7db49"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x3, 0x16, &(0x7f0000001000)=ANY=[@ANYBLOB="61158c000000000061138c0000000000bfa00000000000001503000008004e002d3501000000000095004100000000006916000000000000bf67000000000000350605000fff07206706000005000000160302000ee60060bf500000000000000f650000000000006507f9ff0100000007070000cddfffff1e75000000000000bf54000000000000070400000400f9ffbd4301000000000095000000000000001500000000000000950000000000000032ed3c12dc8c27df8ecf264e0f84f9f17d3c30e32f1754558f2278af6d71d79a5e12814cb1d8a5d4601d295c45a6a0b9bdb7dd3997f9c9c4f6f3be4b369289aa6812b8e007e733a9a4f1b0af3dda82ee45a010fb94fe9de57b9d8a814261bdb94a05000000c6c60bf70d742a81762bab8395fa64810b5b40d893ea8fe01c5473d51b546cad3f1d5ab2af27546e7c955ccefa1f6ab689b555202da2e0ec2871b4a7e65836429a527dc47ebe84a423b6c8d345dc8da3085b0ab71ca1b901627b562ed04ae76002d4519af619e3cca4d69e88158f0200000000c8fb730a5c1bf2b2bb71a629361997a75fd552bdc2300000008ac86d8a297dff0445a15f21dce4de9f29eff65aadc841848c9b562a31e56723888fb126a163f16f920ae2fb494059bba8e3b680324a188076ebae3f55c4e9b2ad9bc1172ba7cbebe174aba210d739a018f9bbec63222d20cecac4d03723f1c932c9a6aa57f1ad2e99e0e67ab93716d20000009fbb0f53acbb40b4f8e2738270b31562ed834f2af97787f696649a462e7ee4bcf8b07a10d6735154beb4000000000000000000000000004000bc00f679629709e7e78f4ddc211bc3ebe6bd9d42ca0140a7afaab43176e65ec1118d50d1e827f3472f4445d253880800000000000000690884f800031e03a651bb96589a7e2e509bcc1d161347623cb5e7ac4629c8ab04871bc47287cd31cc43010000207b40407d000000210000000000000000005f37d83f84e98a523d80bd970d703f37ca364a601ae899a56715a0a62a34c6c94cce6994521629ab028acfc1d926a0f6a5489af8dc2f17923f3c40dfd1970a55c22fe3a5ac000000f4000000000000000000000000c1eb2d91fb79ea00000000000000bb0d00000000000000000000e4007be511fe32fbc90e2364a55e9bb66ac64423d2d00fea2594e190deae46e26c596f84eba9000000000000003cc3aa39ee4b1386bab561cda886fa642994cacd473b543ccb5f0d7b63924f17c67b13631d22a11dc3c6939628950000000000000001c7205a6b068fff496d2da7d632bd1f61b007e1ff5f1be1969a1ba791ad46d800000000c7f26a0337302f3b41eae59809fd05d12f6186f117b062df67d3a63f3265dd1410eea68208a3f26b2989b832d8b34a34a4f08b34b30410856e858d27adee7daf32903d3fc78700d429a2d4c8b6d803eb83eecfe4c7ff9e6ab5a52e83d089dad7a8710e0254f1b11cced7bc3c8da0c44d2ebf9f6f3ff3be4d1458077c2253b0c7c7a0a9fdd63bf910dc20e5cb2a88e59febc47f1212a21f631dbaa74f22bad050e9856b48ae3a03a497c37758537650fe6db88aa3c41fdc3d78e046f6160e1741299e8dc29906870e6431ed1eab5d067a183f064b060a8ec12725d42e3a74863d66bee966b1574f8e01b3f34a267ff0afa1e1c758a0079b747067312e9815a21cb3f1f8150d999d788535a4d3114dbc7e2bf2402a75fd7a55733360040855ed5d1c0d634fb9fb38f84d9d87b27f8a5d91217b728f13e3ee20e69e0ffb2780b1a7af137ff7b4ff010404faf0a4da65396174b4563d54b52f06c870edf0c5d744b5272b44c23488b2bdbff947c4dfa108cbb88202ee1192b81f428a5b3c299848649e1a6bff52f657a67463d7dbf85ae9321fc2b517dc4a29b9b5a8ded5de8206c812439ab129ae818837ee1562078fc524b3baf49a0be9bb7d958d5e87c6c09bf71a894bad62934782cc308e936d7637e07c4a2a3bc87b0da23c00d9ef418cf19e7a8c4c328be0ce95798adc2dca871073f6bd61dc18487b6feb89752cd600000000abc86b94f8cbde4d470667bee722a6a2af483ad0d3415ed0f9db059acaba9eaea93f811d434e00000000000000000000d154ba10a8e51489a614e69722bac30000000000000000000000000000c5dfd188ff555285b9743d3aac000583f42d168613151d681a2f71373f20d92c9048407c91fabecfe8b3f2d5454d127edab14ba61ba1cfc4336324c86f3dcb43e9a58208077e90f6ec1c7ac756f61dcc372cdd30b82507489f0bbfbd3c3f21752e81319c0161e154ceb16e00bc7f5a6962dff317f4d014786e432817064874d69a39cb0da31bcc5f81894d8a80756447322207b4007dff12eb95066cc6bc256f0a12282224d718b06ca80b57aa183dd0c3eee45891441f2b89b4c67aa9882281393954972046974f18df232cd7fca610e33f51c2d062020f403d85ff36c26e2f6bd1d82f4d3ceb3472d9a77e0057a3bfe697d9ab7585f4a1b381343d2cf855689232f4fc5135790662dc1419a374be9d7b3e5be2886d23add90d862f1a682ff11c798e338af3e5bb0f9d3952b15bf3e0c618c89d20ca1e18a031397693bf3cfbd8417e5b55e641c898c280356f2da222d5d68919d98158578dcf18efa404e508bcbbb8cfcf70086821ebdf34c9a1dff45af873df904c2bdbef81f246d26f4b40df949e12bdac18533d4e11c608cc31d60cb591c40a7b386fa1c753336d7220a35118d4919b45eff32aab684e62c6691de14e97aa7e9dc8ecf0cd50540246d2b746e41e5b4e2c095039dfe0f71db6265f7580d098be40ef36faee5d1695830d4242a23e541e6ce9fa1998d8961cf4fe3c8e8fbb566f148c8befc229614a4b7f80d237b8abc6fd0407de31d6e5532f360d379f20f054692b47207922fe6c14eba96c9a7ae906abc1ae1ae8c4fae92883cfa1978a04bbff4bbe0000000000000000000000000044585397feaadda3fcc64e7b0c08f7ac5c64cb190f1712a3b10fc34eb758705f1751d8c8b712eb39d2b8ad44f129c2c9aedb15"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0xffffffffffffffd2}, 0x48) readv(r2, &(0x7f00000005c0)=[{&(0x7f0000000140)=""/250, 0xfa}, {&(0x7f0000000240)=""/250, 0xfa}, {&(0x7f0000000040)=""/171, 0xab}, {&(0x7f0000000340)=""/103, 0x67}, {&(0x7f0000000440)=""/146, 0x92}, {&(0x7f0000000500)=""/189, 0xbd}], 0x6) r3 = socket$inet6_mptcp(0xa, 0x1, 0x106) setsockopt$inet6_mreq(r3, 0x29, 0x8, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='blkio.bfq.io_merged_recursive\x00', 0x275a, 0x0) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x0, 0x28011, r0, 0x0) (async) syz_init_net_socket$x25(0x9, 0x5, 0x0) (async) ioctl$SIOCX25SCALLUSERDATA(r1, 0x89e5, 0x0) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="1a00000000000000000000000000000066380000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000004000000000005000000000000000000000000000000000000008d86b854e2606e67f04857e6ebecc97cde38b998183648beb6c50c24014ed445e1da1bfd92edef74ece9e94b062bc750054d3280a1d79da2473120619f4a14c2129d8483c5a1b36fb5d53f385aed9637d2db5f1b6bc76aadf370c6592da676a6ebaaf1d472963c0537b241381b771f596406463deb79eea0f4f2e42094a67eaf9d7211d782d42560dae4aae301d5aa9ddca553353a9dca0e592358de43836497166c5d8edbeb66e5c1cf4449ef8a520bb65ca3c45539ee641925ac27b24de5722c9c13bcf0daf2c7901ffeda1758952c287d6a2afcd90ec7db49"], 0x48) (async) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x3, 0x16, &(0x7f0000001000)=ANY=[@ANYBLOB="61158c000000000061138c0000000000bfa00000000000001503000008004e002d3501000000000095004100000000006916000000000000bf67000000000000350605000fff07206706000005000000160302000ee60060bf500000000000000f650000000000006507f9ff0100000007070000cddfffff1e75000000000000bf54000000000000070400000400f9ffbd4301000000000095000000000000001500000000000000950000000000000032ed3c12dc8c27df8ecf264e0f84f9f17d3c30e32f1754558f2278af6d71d79a5e12814cb1d8a5d4601d295c45a6a0b9bdb7dd3997f9c9c4f6f3be4b369289aa6812b8e007e733a9a4f1b0af3dda82ee45a010fb94fe9de57b9d8a814261bdb94a05000000c6c60bf70d742a81762bab8395fa64810b5b40d893ea8fe01c5473d51b546cad3f1d5ab2af27546e7c955ccefa1f6ab689b555202da2e0ec2871b4a7e65836429a527dc47ebe84a423b6c8d345dc8da3085b0ab71ca1b901627b562ed04ae76002d4519af619e3cca4d69e88158f0200000000c8fb730a5c1bf2b2bb71a629361997a75fd552bdc2300000008ac86d8a297dff0445a15f21dce4de9f29eff65aadc841848c9b562a31e56723888fb126a163f16f920ae2fb494059bba8e3b680324a188076ebae3f55c4e9b2ad9bc1172ba7cbebe174aba210d739a018f9bbec63222d20cecac4d03723f1c932c9a6aa57f1ad2e99e0e67ab93716d20000009fbb0f53acbb40b4f8e2738270b31562ed834f2af97787f696649a462e7ee4bcf8b07a10d6735154beb4000000000000000000000000004000bc00f679629709e7e78f4ddc211bc3ebe6bd9d42ca0140a7afaab43176e65ec1118d50d1e827f3472f4445d253880800000000000000690884f800031e03a651bb96589a7e2e509bcc1d161347623cb5e7ac4629c8ab04871bc47287cd31cc43010000207b40407d000000210000000000000000005f37d83f84e98a523d80bd970d703f37ca364a601ae899a56715a0a62a34c6c94cce6994521629ab028acfc1d926a0f6a5489af8dc2f17923f3c40dfd1970a55c22fe3a5ac000000f4000000000000000000000000c1eb2d91fb79ea00000000000000bb0d00000000000000000000e4007be511fe32fbc90e2364a55e9bb66ac64423d2d00fea2594e190deae46e26c596f84eba9000000000000003cc3aa39ee4b1386bab561cda886fa642994cacd473b543ccb5f0d7b63924f17c67b13631d22a11dc3c6939628950000000000000001c7205a6b068fff496d2da7d632bd1f61b007e1ff5f1be1969a1ba791ad46d800000000c7f26a0337302f3b41eae59809fd05d12f6186f117b062df67d3a63f3265dd1410eea68208a3f26b2989b832d8b34a34a4f08b34b30410856e858d27adee7daf32903d3fc78700d429a2d4c8b6d803eb83eecfe4c7ff9e6ab5a52e83d089dad7a8710e0254f1b11cced7bc3c8da0c44d2ebf9f6f3ff3be4d1458077c2253b0c7c7a0a9fdd63bf910dc20e5cb2a88e59febc47f1212a21f631dbaa74f22bad050e9856b48ae3a03a497c37758537650fe6db88aa3c41fdc3d78e046f6160e1741299e8dc29906870e6431ed1eab5d067a183f064b060a8ec12725d42e3a74863d66bee966b1574f8e01b3f34a267ff0afa1e1c758a0079b747067312e9815a21cb3f1f8150d999d788535a4d3114dbc7e2bf2402a75fd7a55733360040855ed5d1c0d634fb9fb38f84d9d87b27f8a5d91217b728f13e3ee20e69e0ffb2780b1a7af137ff7b4ff010404faf0a4da65396174b4563d54b52f06c870edf0c5d744b5272b44c23488b2bdbff947c4dfa108cbb88202ee1192b81f428a5b3c299848649e1a6bff52f657a67463d7dbf85ae9321fc2b517dc4a29b9b5a8ded5de8206c812439ab129ae818837ee1562078fc524b3baf49a0be9bb7d958d5e87c6c09bf71a894bad62934782cc308e936d7637e07c4a2a3bc87b0da23c00d9ef418cf19e7a8c4c328be0ce95798adc2dca871073f6bd61dc18487b6feb89752cd600000000abc86b94f8cbde4d470667bee722a6a2af483ad0d3415ed0f9db059acaba9eaea93f811d434e00000000000000000000d154ba10a8e51489a614e69722bac30000000000000000000000000000c5dfd188ff555285b9743d3aac000583f42d168613151d681a2f71373f20d92c9048407c91fabecfe8b3f2d5454d127edab14ba61ba1cfc4336324c86f3dcb43e9a58208077e90f6ec1c7ac756f61dcc372cdd30b82507489f0bbfbd3c3f21752e81319c0161e154ceb16e00bc7f5a6962dff317f4d014786e432817064874d69a39cb0da31bcc5f81894d8a80756447322207b4007dff12eb95066cc6bc256f0a12282224d718b06ca80b57aa183dd0c3eee45891441f2b89b4c67aa9882281393954972046974f18df232cd7fca610e33f51c2d062020f403d85ff36c26e2f6bd1d82f4d3ceb3472d9a77e0057a3bfe697d9ab7585f4a1b381343d2cf855689232f4fc5135790662dc1419a374be9d7b3e5be2886d23add90d862f1a682ff11c798e338af3e5bb0f9d3952b15bf3e0c618c89d20ca1e18a031397693bf3cfbd8417e5b55e641c898c280356f2da222d5d68919d98158578dcf18efa404e508bcbbb8cfcf70086821ebdf34c9a1dff45af873df904c2bdbef81f246d26f4b40df949e12bdac18533d4e11c608cc31d60cb591c40a7b386fa1c753336d7220a35118d4919b45eff32aab684e62c6691de14e97aa7e9dc8ecf0cd50540246d2b746e41e5b4e2c095039dfe0f71db6265f7580d098be40ef36faee5d1695830d4242a23e541e6ce9fa1998d8961cf4fe3c8e8fbb566f148c8befc229614a4b7f80d237b8abc6fd0407de31d6e5532f360d379f20f054692b47207922fe6c14eba96c9a7ae906abc1ae1ae8c4fae92883cfa1978a04bbff4bbe0000000000000000000000000044585397feaadda3fcc64e7b0c08f7ac5c64cb190f1712a3b10fc34eb758705f1751d8c8b712eb39d2b8ad44f129c2c9aedb15"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0xffffffffffffffd2}, 0x48) (async) readv(r2, &(0x7f00000005c0)=[{&(0x7f0000000140)=""/250, 0xfa}, {&(0x7f0000000240)=""/250, 0xfa}, {&(0x7f0000000040)=""/171, 0xab}, {&(0x7f0000000340)=""/103, 0x67}, {&(0x7f0000000440)=""/146, 0x92}, {&(0x7f0000000500)=""/189, 0xbd}], 0x6) (async) socket$inet6_mptcp(0xa, 0x1, 0x106) (async) setsockopt$inet6_mreq(r3, 0x29, 0x8, 0x0, 0x0) (async) 446.025678ms ago: executing program 3 (id=7738): syz_emit_ethernet(0x3e, &(0x7f0000000f00)={@local, @broadcast, @void, {@ipv6={0x86dd, @generic={0x0, 0x6, "9fbbb0", 0x8, 0x0, 0x0, @private1, @local, {[@fragment={0x0, 0x0, 0x76}]}}}}}, 0x0) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000001b80)=ANY=[@ANYBLOB="b702000000000000bfa300000000000007030000fdfdfff67a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040000010000400404000001000000b7050000020000006a0a00fe00000000850000000a000000b70000000000000095000000000000009cc6b3fcd62c7d376238975d43a4505f80fc88943c4f0cf08e467b592f868ee30a0e8c1bf176db2a6b2feb4b6fd3d5707bfd2d84aaa3b1d4e984c46ea7e2a447a36f5662403e1b2be4cc7c2683908a0d411a9872971c7c56f0979bd10b97163c1d6d0e1946c79521b1abda45cbe8d0d26b5069f8a98f7dc8f76b74635fc9f9de9ca3c00cb9bf4e418d07fa22f0610a70f2bdf4000000000000b0c2940dd8e263aa743f7555193161f45346b1004006000000e1ffff8816326d7d25c32aac1c7d5b5be399f6609876b5887437a172fbc02a74067529194e533583412dff048f0000000000000000b2728a0481e9f0da43bb6cfb851cd364ff19ffcafe3e64be033c9d2f002cc93c1c13caec04a347383420336bec88c24a9fb6a6991ddb737d527d6acb15426415b6e8b14fdfa2c6e94bd0339454c13ad3e328a100000000b515a1000000000000000eb2e9c15b6c8f6198282df27badac8507bc7d202e0990e0"], &(0x7f0000000340)='GPL\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000340)={r0, 0xffff0000, 0xf0, 0x0, &(0x7f0000001a40)="2b206d074843b397737ea49da2aa", 0x0, 0xf000, 0x720e, 0x0, 0x0, 0x0, 0x0}, 0x48) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0xe, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000200001000000000000000000610300"/32], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x80) syz_emit_ethernet(0x3e, &(0x7f0000000f00)={@local, @broadcast, @void, {@ipv6={0x86dd, @generic={0x0, 0x6, "9fbbb0", 0x8, 0x0, 0x0, @private1, @local, {[@fragment={0x0, 0x0, 0x76}]}}}}}, 0x0) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000001b80)=ANY=[@ANYBLOB="b702000000000000bfa300000000000007030000fdfdfff67a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040000010000400404000001000000b7050000020000006a0a00fe00000000850000000a000000b70000000000000095000000000000009cc6b3fcd62c7d376238975d43a4505f80fc88943c4f0cf08e467b592f868ee30a0e8c1bf176db2a6b2feb4b6fd3d5707bfd2d84aaa3b1d4e984c46ea7e2a447a36f5662403e1b2be4cc7c2683908a0d411a9872971c7c56f0979bd10b97163c1d6d0e1946c79521b1abda45cbe8d0d26b5069f8a98f7dc8f76b74635fc9f9de9ca3c00cb9bf4e418d07fa22f0610a70f2bdf4000000000000b0c2940dd8e263aa743f7555193161f45346b1004006000000e1ffff8816326d7d25c32aac1c7d5b5be399f6609876b5887437a172fbc02a74067529194e533583412dff048f0000000000000000b2728a0481e9f0da43bb6cfb851cd364ff19ffcafe3e64be033c9d2f002cc93c1c13caec04a347383420336bec88c24a9fb6a6991ddb737d527d6acb15426415b6e8b14fdfa2c6e94bd0339454c13ad3e328a100000000b515a1000000000000000eb2e9c15b6c8f6198282df27badac8507bc7d202e0990e0"], &(0x7f0000000340)='GPL\x00'}, 0x48) (async) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000340)={r0, 0xffff0000, 0xf0, 0x0, &(0x7f0000001a40)="2b206d074843b397737ea49da2aa", 0x0, 0xf000, 0x720e, 0x0, 0x0, 0x0, 0x0}, 0x48) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0xe, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000200001000000000000000000610300"/32], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x80) (async) 441.685231ms ago: executing program 4 (id=7739): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) mmap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x3000004, 0x13, r0, 0xf45f2000) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) ioctl$FS_IOC_RESVSP(r1, 0x4030582a, &(0x7f0000000380)={0x0, 0x1, 0x10, 0x7}) setsockopt$ARPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x60, &(0x7f0000000480)={'filter\x00', 0x104, 0x4, 0x3c0, 0x0, 0xe8, 0x1f0, 0x2d8, 0x2d8, 0x2d8, 0x4, 0x0, {[{{@arp={@remote, @broadcast, 0x0, 0x0, 0x0, 0x0, {@mac=@local}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'dvmrp0\x00', 'macvlan0\x00'}, 0xc0, 0xe8}, @unspec=@NFQUEUE1={0x28}}, {{@arp={@loopback, @multicast2, 0x0, 0x0, 0x0, 0x0, {@mac=@local}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'pim6reg0\x00', 'veth0\x00'}, 0xc0, 0x108}, @unspec=@LED={0x48, 'LED\x00', 0x0, {'syz1\x00'}}}, {{@uncond, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0xe8}}], {{'\x00', 0xc0, 0xe8}, {0x28}}}}, 0x410) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r1, 0x10e, 0x4, &(0x7f0000000300), 0x4) getpeername(r1, &(0x7f0000000200)=@ax25={{}, [@bcast, @null, @bcast, @remote, @netrom, @netrom, @remote, @null]}, &(0x7f0000000100)=0x80) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000600)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000"], 0xa4}}, 0x4) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=ANY=[@ANYBLOB="740000001000210400000000fcdbdf2500000000", @ANYRES32=0x0, @ANYBLOB="adffa8886004000024001280090001007866726d000000001400028008000100010000000800020011000000050021000000000008000a00", @ANYRES32, @ANYBLOB='\n\x00:'], 0x74}}, 0x0) r3 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000100)={'vcan0\x00', 0x0}) ioctl$ifreq_SIOCGIFINDEX_wireguard(r3, 0x8933, &(0x7f00000003c0)={'wg1\x00'}) connect$can_bcm(r3, &(0x7f00000000c0)={0x1d, r4}, 0x10) sendmsg$can_bcm(r3, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000dc0)={0x1, 0xc02, 0x0, {}, {0x77359400}, {}, 0x1, @canfd={{0x0, 0x1}, 0x1d, 0x1, 0x0, 0x0, "62af510b0b7f04ce9bf921f6c5f5c085ede7c77fa0601b1c2f77ffaf5d4095b4c27212333d3ddd460a3fe836ce0f88ab294b8b06d2b55fb8d14a92c421a907a2"}}, 0x80}}, 0x0) sendmsg$can_bcm(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000480)=ANY=[@ANYBLOB="010000008db879e2b2fa56da00000000", @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x2710, @ANYBLOB="0000000001"], 0x38}}, 0x20000000) ioctl$sock_inet_SIOCDELRT(r1, 0x890c, &(0x7f0000000080)={0x0, {0x2, 0x4e20, @rand_addr=0x64010101}, {0x2, 0x4e21, @empty}, {0x2, 0x4e20, @broadcast}, 0x1c1, 0x0, 0x0, 0x0, 0x100, &(0x7f0000000040)='dvmrp0\x00', 0x1, 0x2, 0x6}) ioctl$sock_SIOCETHTOOL(r1, 0x8946, &(0x7f00000002c0)={'bridge_slave_1\x00', &(0x7f0000000180)=@ethtool_rxfh={0x46, 0x100, 0x2, 0xffffffff, 0x3, "be6a9a", 0x5, [0x4, 0x2056e5d3, 0x5, 0x4, 0x2, 0x6, 0x5, 0x8]}}) r5 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000280)=[{&(0x7f0000000540)="d8000000180081054e81f782db4cb904021d080406037c09e8fe55a10a0015400400142603600e122f00160006000600c7000600200005400700027c035c0461c1d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775730d16a4683f5aeb4edbb57a5025ccca9e00360db798262f3d40fad95667e006dcdf63951f215ce3bb9ad809d5e1cace81ed0bffece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703920723f9a941", 0xd8}], 0x1, 0x0, 0x0, 0x4a0f0000}, 0x0) 382.903308ms ago: executing program 2 (id=7740): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="146f23c6d60f4ac1c1870b680000001500010300"], 0x14}}, 0x0) (async) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000300), r1) (async) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) (async, rerun: 64) sendmsg$NFT_BATCH(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000280)={{0x14}, [@NFT_MSG_NEWRULE={0x50, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x24, 0x4, 0x0, 0x1, [{0x20, 0x1, 0x0, 0x1, @ct={{0x7}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_CT_DREG={0x8, 0x1, 0x1, 0x0, 0xc}, @NFTA_CT_KEY={0x8, 0x2, 0x1, 0x0, 0xb}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x78}}, 0x0) (async, rerun: 64) sendmsg$NL802154_CMD_SET_MAX_FRAME_RETRIES(r1, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x40, r2, 0x300, 0x70bd2b, 0x25dfdbfc, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x3}, @NL802154_ATTR_MAX_FRAME_RETRIES={0x5, 0xf, 0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000002}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000003}]}, 0x40}}, 0x24000091) read(r0, &(0x7f0000000080)=""/186, 0xba) r4 = socket$netlink(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r4, 0x10e, 0xc, &(0x7f00000000c0)=0x8004, 0x4) (async) sendmsg$netlink(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)=[{&(0x7f0000000a40)=ANY=[@ANYBLOB="1c000000560001060000000000000000070012c3c1"], 0x1c}], 0x1}, 0x0) (async) syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) 380.666101ms ago: executing program 0 (id=7741): syz_emit_ethernet(0x4e, &(0x7f00000007c0)={@random="2f5b02cb75db", @local, @void, {@ipv6={0x86dd, @udp={0x0, 0x6, "018100", 0x18, 0x11, 0x0, @remote, @local, {[@dstopts={0x2c}], {0x4e20, 0xe22, 0x10, 0x0, @gue={{0x2, 0x0, 0x0, 0x8, 0x100}}}}}}}}, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000000240)=[@in={0x2, 0x4e24, @local}, @in6={0xa, 0x4e21, 0x4, @empty, 0xc}, @in6={0xa, 0x4e24, 0xed, @private1, 0xff}, @in={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x18}}, @in={0x2, 0x4e20, @private=0xa010100}, @in={0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0x22}}, @in6={0xa, 0x4e24, 0x5, @mcast2, 0x1}, @in6={0xa, 0x4e22, 0x40000000, @local, 0xff}, @in6={0xa, 0x4e23, 0xffffff12, @empty, 0x1}], 0xcc) r3 = syz_genetlink_get_family_id$devlink(&(0x7f00000008c0), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RATE_DEL(r1, &(0x7f00000009c0)={0x0, 0x0, &(0x7f0000000980)={&(0x7f0000000900)={0x34, r3, 0x1, 0x70bd2a, 0x25dfdbfe, {}, [@handle=@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}]}, 0x34}, 0x1, 0x0, 0x0, 0x84}, 0x0) r4 = socket(0x40000000015, 0x5, 0x0) bind$inet(r4, &(0x7f0000000340)={0x2, 0x0, @loopback}, 0x10) r5 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) bind$inet6(r5, &(0x7f0000001900)={0xa, 0x0, 0x0, @empty}, 0x1c) sendmsg(r4, &(0x7f0000000200)={&(0x7f0000000040)=@in={0x2, 0x0, @multicast1}, 0x80, 0x0, 0x0, &(0x7f0000019580)=ANY=[@ANYBLOB="1000000000000000040000000000000010000000000000001401000007"], 0x20}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000008c0)=ANY=[@ANYBLOB="6c0000001000010400d201000072f60000020000", @ANYRES32=0x0, @ANYBLOB="0524060000000000300012800b0001006272696467650000200002800c002e00fffff6ffffffffff050007001f0091af76d027000000000008000a00a8"], 0x6c}}, 0x10) 342.614081ms ago: executing program 1 (id=7742): r0 = syz_init_net_socket$x25(0x9, 0x5, 0x0) getpeername(r0, 0x0, 0x0) r1 = socket$vsock_stream(0x28, 0x1, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000003c0)=@newtfilter={0x43c, 0x2c, 0xd27, 0x70bd2d, 0x0, {0x0, 0x0, 0x0, 0x0, {0x5}, {}, {0x8, 0xffe0}}, [@filter_kind_options=@f_basic={{0xa}, {0x40c, 0x2, [@TCA_BASIC_POLICE={0x408, 0x4, [@TCA_POLICE_RATE={0x404, 0x2, [0x3, 0x8, 0x62, 0x2, 0x0, 0xc, 0x2, 0x7fff, 0x0, 0xffffff70, 0x19, 0xffffffa9, 0x2, 0x7, 0x80000001, 0x7, 0x3, 0x36, 0xc, 0x6, 0x6, 0x5d0bef1f, 0x400, 0x1, 0x837, 0xffffffff, 0x9fec, 0x401, 0x68, 0x9, 0xdd64, 0x1, 0x4, 0x8001, 0xfffffffe, 0x2, 0x0, 0x200, 0xfff, 0xfffffff1, 0x7, 0x4, 0xf, 0x7, 0x7469, 0xb, 0x2, 0x200, 0xff32, 0x6, 0xca, 0x4ec1, 0x1, 0x9, 0x80, 0x0, 0x10000, 0x0, 0xb4, 0x7, 0x6, 0x0, 0x0, 0x8156b2a, 0x2, 0xd5c, 0x4, 0xa0, 0x2, 0x7, 0x4, 0x0, 0x81, 0xff, 0x2, 0xe6b, 0x9, 0xa, 0xc8c, 0x1, 0xd2a, 0x6, 0xf4e, 0x9, 0x3a0, 0x3, 0x10000, 0x7ff, 0x44, 0x1, 0x2, 0x800, 0x3, 0x8, 0x0, 0x6, 0x922e, 0x0, 0x8, 0x3, 0xf, 0x4, 0x2, 0x2c000, 0x80, 0x5, 0x7, 0x2, 0x5, 0x0, 0x9, 0x6, 0x0, 0x3365, 0x1, 0x5, 0xffffffff, 0x1000, 0x0, 0x4, 0x0, 0x1, 0x2, 0x81, 0x111, 0x2, 0x5c20, 0x7f, 0x0, 0xe, 0xfffffffb, 0x6, 0x391, 0x0, 0x0, 0x3, 0x9, 0xc95d90e, 0xff, 0x2, 0x7, 0x7fffffff, 0xc7, 0x4, 0x7, 0x0, 0x9, 0xffffffff, 0x9, 0x1, 0x4, 0x3, 0x7, 0xfffffff9, 0x10, 0x2, 0xfff, 0x2, 0x6, 0x8b4, 0x600000, 0x1, 0x6, 0x0, 0x10000, 0x0, 0x3, 0x5, 0x0, 0x1000, 0x6, 0x9, 0x0, 0x1, 0x81, 0x2, 0xffff6c4b, 0x800, 0x7, 0x5, 0x7fff, 0x8, 0xffffffff, 0x9, 0x6, 0x0, 0x40, 0x67e1, 0x80000000, 0x2, 0x603c, 0x4, 0x4, 0x0, 0xfffffff8, 0x7, 0x3, 0x10, 0x400, 0xfffffe00, 0x1, 0x3, 0x0, 0xffff, 0x4, 0x6, 0x8, 0x0, 0x400, 0x1, 0x87, 0x10, 0x2, 0x0, 0xfffffffd, 0x3, 0x7, 0x616, 0x2, 0x2, 0xd1, 0x2, 0xfffffffc, 0x8, 0xe, 0x800, 0x1, 0x4, 0xd87, 0x80000001, 0x48e0, 0x8, 0x9, 0x40, 0x400, 0x5, 0x2, 0x4e1b, 0x1, 0x1000, 0x8, 0x4, 0x3, 0x0, 0x2, 0x9, 0x2, 0x3, 0x10001, 0xffff, 0x4d, 0xd, 0x8, 0x2, 0x2, 0x8]}]}]}}]}, 0x43c}}, 0x4000) r2 = socket(0x2a, 0x2, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000400)={&(0x7f00000005c0)=@newqdisc={0x24}, 0x24}}, 0x0) getsockname$packet(r2, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000001480)=0x14) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000380)=@newqdisc={0x2c, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000800)=@newtfilter={0x44, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0x0, 0xfff3}, {}, {0x2, 0xfff9}}, [@filter_kind_options=@f_flower={{0xb}, {0x14, 0x2, [@TCA_FLOWER_KEY_ENC_OPTS={0x10, 0x54, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPTS_GENEVE={0xc, 0x1, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPT_GENEVE_CLASS={0x6, 0x1, 0x1}]}]}]}}]}, 0x44}}, 0x20040040) r4 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r4, &(0x7f00000002c0), 0x40000000000009f, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$devlink(&(0x7f0000000dc0), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_TRAP_GET(r5, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000540)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="010000000000fbdbdf25270000000e0001006e657464657673696d0000000f0002006e657464657673696d3000001c0053"], 0x50}, 0x1, 0x0, 0x0, 0x24040011}, 0x0) bind$vsock_stream(r1, &(0x7f0000000440), 0x10) listen(r1, 0x0) r7 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r7, &(0x7f0000000040)={0x28, 0x0, 0x0, @local}, 0x10) r8 = socket$igmp6(0xa, 0x3, 0x2) setsockopt(r8, 0xff, 0x3, &(0x7f0000000900)="7c73c6e9", 0x4) r9 = accept$netrom(0xffffffffffffffff, &(0x7f0000000100)={{0x3, @null}, [@default, @default, @rose, @default, @bcast, @default, @remote, @netrom]}, &(0x7f0000000000)=0x48) ioctl$sock_SIOCETHTOOL(r9, 0x8946, &(0x7f00000001c0)={'veth0_to_batadv\x00', &(0x7f0000000180)=@ethtool_eee={0x44, 0xffffffff, 0x32, 0x7, 0x800, 0x6, 0x2, 0x5, [0x101, 0x8]}}) syz_genetlink_get_family_id$smc(&(0x7f0000000200), r5) writev(r7, &(0x7f00000002c0)=[{&(0x7f0000000080)='?', 0x20000081}], 0x2) shutdown(r7, 0x1) 260.934751ms ago: executing program 2 (id=7743): socket$can_bcm(0x1d, 0x2, 0x2) r0 = socket$nl_route(0x10, 0x3, 0x0) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000000)={'vxcan0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000080)=@getchain={0x24, 0x11, 0x1, 0x0, 0x2000001, {0x0, 0x0, 0x0, r1, {0x1}, {0x9, 0x1b}, {0xfff2, 0x6}}}, 0x24}}, 0x40044) 178.829523ms ago: executing program 3 (id=7744): r0 = socket$kcm(0x21, 0x2, 0x2) sendmsg$kcm(r0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)=[{0x10, 0x110, 0xe}, {0x10, 0x110, 0xe}], 0x20}, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000800)=ANY=[@ANYBLOB="940000002b000b00000000000208000005000000040003007c0001"], 0x94}}, 0xc00) r2 = socket$nl_generic(0x10, 0x3, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffc}, 0x94) r3 = socket$netlink(0x10, 0x3, 0xf) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff) r6 = socket(0x2b, 0x1, 0x1) setsockopt$inet6_tcp_TCP_REPAIR(r6, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) connect$inet6(r6, &(0x7f00000001c0)={0xa, 0x4e1f, 0x2, @ipv4={'\x00', '\xff\xff', @local}, 0x1}, 0x1c) setsockopt$inet6_IPV6_DSTOPTS(r6, 0x29, 0x3b, &(0x7f0000000200)=ANY=[], 0x28) sendmsg$DEVLINK_CMD_RATE_GET(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)={0x34, r5, 0x701, 0x0, 0x0, {0x41}, [@handle=@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}]}, 0x34}}, 0x0) sendmsg$DEVLINK_CMD_RATE_DEL(r2, &(0x7f0000000280)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000200)={&(0x7f0000000a80)={0x10a4, r5, 0x2, 0x70bd26, 0x25dfdbfd, {}, [@DEVLINK_ATTR_PORT_INDEX={0x8, 0x3, 0x1}, @DEVLINK_ATTR_PORT_INDEX={0x8, 0x3, 0x2}, @DEVLINK_ATTR_RATE_NODE_NAME={0x1004, 0xa8, @random="739c796bc02d0bf62da7835873f14b196305d20ea34dc75345edb9bc145908a713f8e663bec23fc69d8ec5cfb7f38019d0c14e65059e1deeed1ca4cf10e3143e7ae8bde78da5daf87d2b7561f39e067227d10792116932dce9110736c2fa070f39345a1d1b66e1840362123a07ecf0e888182bb0b411e814c33f68b4a64ce301417208e7d3f8ee4826093be3f101746d8ce33a9a4a7a85294d5000611f208e0bfb9fb7cd33eeaeea19cc5287530a1f29d35536f83fa66609ddd40c3f40f040bb6d834b246c87d6db830a4e3f0e0be6cc5a52b4ee0f0b7fbcb65d1b0de43db02ad42032bb9e6a3cb6499f07da73690e97f1cf3058e0a4f5ab571bbe7feaac384fae8c30df753df5dfe655479b64efed3e75ec5faa04fb00e6dfade087811056cf9d63ccd7e03e0e124ac4a7b4e0b8f3d3088c50dcbdd130dc878929c05f0786cebba46f728c3a828847cf72fe5dc665263db07bfa0b5fc7019336861a4e975b5d6c18d5793e035c7dd1339a8269603549c4ed8306af26fbfe78bd02df598d30c0b26ab48fd50a1a3e1a0f391a332a1e2a280f468af83c780801cc3cee8ee99c8e4d9efb397961a3b4efffa7ee2b42963d200e67fe22aab72525fe95450bc3cbb05f7383c6c25ddad1b9e5955dee5036c9a8ac4d030239d9f76632705271390231db3afca798774e7d4f31b2a38459bce1c2d57880b2bad7745b9486d7fb8d36aba5fcb05d778a5e7afcee92fa7291441e96d82a5c684bd70676172942345250357c483aa49d637acdb01ba0ba3f15ef6f0d607ccda68ad749ef6940b1edf43a8d4545f07b5bf79477bc98bc559c20ee127c10f4adb5d65680647f5235577be6d8c3b71c3c281756f5a8168efa0c9ab1bf633f2779c70656a16b8aefafdc71084842ab5141c9eeed988c3d8cbad2d9a6018200d0ba2df3f9085abedf4afd47689813e6f7d430d335f533762e2f8c945cc46055300da2ab3d8cc5f73569e93251cf727b2c8264042eba8837399c32fcac53c88a2338d7ab729e1021993ba9d251773bb19421fbf081ff00a1156254e6a68f1515d447221ea09bcd5093d2c31365b78079a3ab6f61a5f040ae1bdae11bb70901dcf4ef04dd943b4e082dd2eab34db2a2e2fd97e43e265a11c557384d1a1eaa8730374ab01d20302acb2884f8f03fc390401c1b38e34120e8f644b31bfc8b2c5c759dd02050a2eb937b17a701d56f9d9eadef69ebaab53dd6ab1bb72445ba5bc52261203829fd36a2889e0f0b62694e22301707b7d518a166123fd067cf4510d592870e13facb7422b5feecc158a761a6f1735cf4b07b41d7cdbd3d10636ea6498fe00234f7d4c82cba917cc6e8f2c9dc35ce6f11fe290fc0607a9fc91e7c15bdf681dca96002a7778b17922963bc5ebe7c1af942f2e98cae4a3ccc66c8fc7a87823b8d5d74f982cc3c8fa44bf075f32e114e4ea9c5d3909b753ebe14595086c6e777c5552686caefd5f4279dadcb167c85a2b74cdeae4d21e3661b22217cf65eefe5ffd0be358c8d8117c871504cfae584d7cfc1fe9a6f61dc6faddeb4d1029908c1cfd60f579db56ecd3f4151a830280cd3155b7eca9fd92575893945f30675c90a58b4c2b12c54ffed4f09747a36a300c6ff84b2f6ad514343dd25fad277af9ffdbd928e1e070aa6c32dc4a25c8b56c60ee206a771880cde0a9b0cb06b24729a9e28334a31e0c12a0214b9f73c315d65cb09198aed7cdfbab59e1677a7560803ae967568a0959aaf0f5611d166bec10f374bca96f98ee40445e96cd0643f5f8f3748ec3cfa444b8e943914cf610f607e566b60936a2cf9fb6b1c39a7b4d5485f1ff1f9e7529987d0de27f06529c302f36adcca84e10f0229722623490193a1a0bd7962bf7dbf6fba1f10ed7499b8a7f311e1f051be362da3e36bae18df6110b9ccfaee619968bff4af32c0446b517b3cb430307b00974cd148af5af85ba90c1dfcd7f2efb919a806f8603c87f795e97360ef96db1dc2f1ab383b69281f0266da4a761da4e220797ac73bcd65bd62b7ccba36a1d3af07fd4f59de294fcfb900f4962e32a993040323860b707c4d0ad2620489d2e987078bdce2265a73520153bf86043316c18f057dcac00080c6c9861f0b666c8d0906a7da80762656e23c51481d4b45960a1b44e2f1074213320a30d2eb2bf8687dd21108cba49c8275aa9e41808a63355b96e78b7732042c71910b17cf30f022f612f90170a8466d7be7b983cf133dcc2b599b19bc9c89dfa7bf10bc99006c4c4b2c09ab8786d9eaef203ae3816e55e9d48b72bd472f5c230b0e735e0775c0c2f134ddfeb2c38c11ca3138f3020a57b745f06d40f8e65c260fd82faed449b6a03ddafd0e221b82b97d5685cf7330aecc67aa440874aa8bb52204873eaa0b74b81444fde827a5ef9f67576a789b9045f8716475cb8f9a30d180f8c5d409f2adfd486c2979adbf516383c3d3ddbab94b8416dc07792beb9bd5a9f60219bf0ab62ac412d2485bf0bad2f7766884dd9ef48b9413ad6b07441983e139025f2b24f3b61e16fa4e7dfeb8ad38a4a5cefa1f7629483efd141d849cd8b4d3106a4b9a1551b23b519c298eaaab827995b9ad459890b791c20958817aac2c3df6f1cf99a9365a105ee102286cee1e074e4704853c679096ba9de59c553afa4f9f914fe102c016cd86ded980d711f9546e9250015d135b7905bc26a329b6d4cc24a2d0cc8f38c74719e0661b2f5eb9b178ed283608345fad951c1f108f1b72254a96b064816c03954d287422c26a1732be5339996d0e20d439ac1be7ea5bf0e3941fa9cb0b4690bd35be7ae9938b7b8d15c2abfbe16716f07321daea4649f96c3733cc5194684607883fb49514bad710d14c8fdcae994b3d8c9a8429557834af4323ba7e71a4929263074a3194e83ce22d998e5ecd86ba223a805aed7a06b70b06a958cd08fe30d41adf3a77f7eeda0793966e7eb1d6e0b7b81b5d2a0e70750999a1201ad2a1975f6b42807fd85de97d85143c1430b3529ff24fe9443c9ff84fd93a73fcedb93aa29e8542821fcbe59890201cb3175e56fe59fd10deac48a2046b3dc340235326557b75646c11a49e8e50f4b50d99ba926260d57cf0fbd71dca6d12ee9583536069591da3f8fa7e3cad08cb05064e55f775539457d046cd798b91c5c9f95b5f42fdd2ec70a8f9b48d28d7972900835036fefd2da4d70fa264ab3be90b629c1f4114fe963c5ca3c4a07f3baa647a1efc138b10fce93f4b37be5f4f7c580494c3dd4925b44073c8bdd09f28dfb30077e308085ef2a27b0315e002b6378b3b5b15f3e39ce840ac51fdc98be8c062a4511eda384e46cbd54ca1e5dc2152a125a875e9b300140c18fc06e7de8d763f15a567b544cb73879903b996ebddb1382fca4eca4cee704da1f274439d1ed35ae92636f837b6bb0ade5bd39ef603dbba3104ca99a79b828cba8a2fc238be19825bd1dbe5e85ed3f7df193de1947f1f8e5e44f4cbf04463fee9de1ade6c1271972afc14ea1a063eb9f832f4cedb3e58ad07c664237d542c152fe13f22e71de2c7260cb7d848b9f990995ecd81b2cba764b9394a9850de6448d435c953dd9864201396fcccd7311ea6cc7816e9ea15ec0ee6e7219260b3841eabaa636a7cb38815c512b49717f5409c2acfb9a064bfd1abbe4608a03ec6d9dc35077ea2f5c462336da27205660576d286f64b6a01beb512f60d9826627702dce08f24b1b629b02e50bef4b2764e843e619031b52a0147f5b1b937fa184b15a41b81409cc4846b0f06b6847005cc485ec8a7aa7f494776a162e7570a1217f13301cd36db328d715a6b08e58152c3f8ac9a2bff385bd9de3355fd693a502bde53cf3c02bb67a9bc33be129693bd402da73a88d769b7a7856e85e436b689a049c1d8c3188d5efb5a0bc5661c637c7b640bc27884438d24e123ea7a320c53be1e66a13efc5bd2a681b5fd73ccacf9265a5543ac5394c0ef86f9a366f66525f4d416a14bb4c3f1b61bf25c3bde96e5f50b54657923eefc427d81712455b26a0366e995df5ce177fce9d22e0f7d069e6b6bb0ecd76b29dedfd0c4cf8ce48604fd42d3764a96caa5ab222f30f32023375f614227174e83003381b5c3139c3dd82a8ef8071e61d1de09b4486c94c23f580bed91a831624253fb10a76a1ba9680ded0cf5b0c67135680aa91bf281c28f5859e3c77fa2b212fc842e9703e0f1988266cf11a9a113dec5d219f3d9bdb3ad05c4b2785689d3ee9818e2ecfe0cdde3812e8dce9aafcb75878b016e95bbdd6e6d44aa271cac620e903ab68c0f8fffc4feff071f95f13bbc01a7a73cf4c55f1b6b27b6fe80df2091dbf234e0f9f13fbcf15c2443335e8abfa63287b1f6b751116c64aecc4996198f01496323b9c15f5ceb120b3a36a49c0b0bde09a38e28fc9d6c6493ff4763600ead1f60a20b78a8cde402b440e6b62b48c24200e35bcc59bcb722a30e4b8c3481e091ba0817518581d6bb7d0ded8a82ca37884846c778aab33318c6b8c7c0bfc690afb4738f7434000631e7239826d35807b52e7d4add210f6d83bf93ebfb3072f41d1ca0288ba825075b35c356a354693cadb37e55f79367e706a531a2db573ddf0dc7caac10b7ccf91b69cefa962698730427e8a2827de3afca8d5676442e15bcfe2c6456ecc6f0865e77acf55287949b02952195f4115187f7aca24b952a9696e0dbfc3a5d00b046497a853b839a873b9726f2f39084fcfd1e045ecc0bc742672ca00c962d6edab1b52587906123788b5c552889d625dcd84f1dcdb3bae8292fec01f41ec1344f5c8aca353e44be33b42ed45d16d725a1f43f58f8ec3a4aec37483ca44a52317eb18b394559ff4f2637fc841744f6e86a76e110e28710787e0cb40ab96b1c2a15b799015b9823a236c27981e3830c7bd36c71e2d3fb0450b137d77afe0a2e64260daf5636de81c6d61e174d4c9348aedf84689e5cdba526549cbd627691f1346b9275ffac4f03ac35479455345e6e5010d7e7ac11ff5cd9799483ab92044bea8ad0bcbf3d1ce779972066191fe6197c1e496a25f74fa7658319c9999802868d93b8570856445e73ef69afd3b4b9ed0b0575f9c2d10f0e7132a01d8324ffd073052b8bed9e0d98804fce689b35c8739cdb1f5cdd4233f370b4b341e964b7899a24dbe06fb2bfee76e9d1d629f6ba7edc9f7612884b145ed69a25e80fce4e559416fd18838b5677faf11ebefa335c9b639ee35f5882db728f51709b1f3dd9a452d37c811c4687231b845d165899e167ba96794b9949bef8324f56221b8d5b2bda5fd620b2c989264c13f438bbd6ca64ea1b49b0bda1c21203a768d81f649d18ca859b02758be75d6f5edde5042aef3ca56784582ec66c0fc93ce4fc08e4a8936f5642be0a4538d3b4e12fc301f570265b570e9050aa394d5a6db43c0642aa8e3e837a7e2d7c9aa311a231cc48ef8f96ee749a5e88aa319b9c53fd307980c471b90521dec8bc6735a7e437c80626a67cb423cfb8e163e23cad3c4efbccf1228e63223a9708d395bb870bb748637e59c9db221b8883ba48e9850dcaacd36354ba2f23e9f198c4ceaee612314cdb025fd352913401764f961eba611dbfcb9160ca75155409e7e8e3feeb1aadc5c4a913fe802b23994fcf006f4d4b715e0a765a16b717214480d78e7d2ce67e2b80316480ccce9f2e199f03d412845c31dc0528fce39ba782f517a111393ba3ecf0645a86824067ace5fc9c60db7c12e89f6f4619515d0086b4c6ea0e458cb666df8bf12466dbc8259206498984ecb9"}, @DEVLINK_ATTR_RATE_NODE_NAME={0x6c, 0xa8, @random="0765c62f2cff2478840189998b596ec2eb18db0821c1f8ad5f9343dae1c30180ea990ad7aeddd0e4e75364d8ef158290edceefc71841af3b68e35b0b72910784e08ff6fe4b5cd3cda2681bb20a9eadad8d5f8e587bfb3fa0d551e06605e65c947924dec718bbd9ee"}, @DEVLINK_ATTR_RATE_NODE_NAME={0xe}]}, 0x10a4}, 0x1, 0x0, 0x0, 0x100}, 0x41010) bind$netlink(r3, &(0x7f0000000a40)={0x10, 0x0, 0x25dfdbfb, 0x2ffffffff}, 0xc) setsockopt$sock_int(r3, 0x1, 0x8, &(0x7f0000000000), 0x4) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r3, 0x10e, 0x4, &(0x7f00000003c0)=0x6, 0xdc) sendmsg$NFT_BATCH(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWSET={0x14, 0x9, 0xa, 0x5, 0x0, 0x0, {0x2, 0x0, 0x2}}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x7}}}, 0x3c}, 0x1, 0x0, 0x0, 0x1}, 0x20000080) sendmsg$nl_generic(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000440)={&(0x7f00000007c0)=ANY=[@ANYBLOB="280300002d00090027bd70000000000004"], 0x328}}, 0x84) 173.407065ms ago: executing program 0 (id=7745): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nbd(&(0x7f0000000040), 0xffffffffffffffff) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) sendmsg$NBD_CMD_CONNECT(r0, &(0x7f0000001ac0)={0x0, 0x0, &(0x7f0000001a80)={&(0x7f0000000a80)={0x48, r1, 0x1, 0xfffffffe, 0x0, {}, [@NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r2}}, {0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r2}}]}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0xfb2e77a8993c191f}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0xffff}]}, 0x48}}, 0x20000000) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x20, 0x3, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000008c0)={r3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x14}, 0x50) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r4, &(0x7f0000000080)=ANY=[], 0x10448) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r4, 0x0) r5 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$inet_MCAST_MSFILTER(r5, 0x0, 0x30, &(0x7f0000000280)={0x9, {{0x2, 0x0, @multicast2}}, 0x1}, 0x90) syz_80211_inject_frame(&(0x7f0000000000), &(0x7f00000002c0)=ANY=[@ANYBLOB="30840400080211000001f7ffffffffff061bcb98a8d45f29ee260f810650640001000106b66c24080c302d1a8000050500000000000000030040000d00000000040100010000dd9f98067723fc5e0685b6714ed7f7cae3bd711de3a7d4ad9d5908bc26522570f99154688459a7d4b0d9e32dfc948e4e6a17669c5e7ad19ed2e22d8fbc8bacb9f1df1e15a816ed10aab0d4b687ebbdad73d5627769d971836ee85b16ea6ff4bc64c81938fcf16d62db824918ae491948699b67ec9beb952e4146a9b4762e84aa58cdfcbfb0b5a4cf0cb955eb879237a5567dd0194f04e1fcc0a2a2a5d2c95ff96894f25c3a1cc2a9bec0dd237b788649989ffbae4a8b6a536187a548508ff2feeabce7a8f47fd98969202a586b6212dde1fa61b5a6099b7e006d15452ee514a0af606d18010a7fe8868d508ab16c85b2ca631de44f614a28f29c6f009ac296287ebeeeabbdb6d529ecd5346593329d3e3ebeb489ec184d1baa0c46a55106f5739f9059eba65ba7637382f85bfd36b95f11078240c1a43800c6b4b619acb0da5ef5eb08bb8f414b2cbdbbca091c4a209f63ba9719eb4fb6a67295b408d0f49c4ed8f5f80be2ac677f187716ce1bfefad913be78763f8bf9188e42019ebef54c138bba999c67d3240ae2d17d1e1a82095a037b1aa9c3bf4a451c5a82cb053088588fdf10cfc94d04b20d80f0ce14cf5ef2ac4cdd12c8c48a5974187569ef229d475fce4ccfda3eca1315ba9b24675ebc161f5efc3e6d924e3e274580b1ee0286c975bef20df3207becbdcb9d78ad36c45b93f2fd32615b5125d05658ab8690a4e6e0830e15e9a30e963e48b3afd0adaaf38128eb0e6fcc075357f546623c6a9c3e790cd7042ffb22044a44d003ac9024f0355abda3c89b53e2d0e4cb9baf858b6cf7c75b4592a525"], 0x203) r6 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_NODELAY(r6, 0x84, 0x3, &(0x7f0000000d80)=0x5, 0x4) 150.985915ms ago: executing program 4 (id=7746): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket(0x10, 0x3, 0x0) r2 = socket(0x10, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x10, 0x803, 0x2) syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), r4) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000003c0)=0x14) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = socket$packet(0x11, 0x2, 0x300) r9 = socket$nl_route(0x10, 0x3, 0x0) r10 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r10, &(0x7f0000000380)={0x0, 0x4076cbba9945d516, &(0x7f0000000340)={0x0, 0x14}}, 0x0) getsockname$packet(r10, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r9, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="4c000000100039042abd70000000000000000000", @ANYRES32=r11, @ANYBLOB="01180200031100002c0012800e00010069703665727370616e0000001800028008001500a8bc0d00040012"], 0x4c}}, 0x0) sendto$packet(r8, 0x0, 0x0, 0x94, &(0x7f0000000140)={0x11, 0x16, r11, 0x1, 0x9, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}}, 0x14) ioctl$sock_SIOCGIFINDEX_80211(r7, 0x8933, &(0x7f0000000000)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(r7, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000bc0)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="010000000000000000000200000008000300", @ANYRES32=r12, @ANYBLOB="0800af28603f250d99b8b20085160000260207f7a56f94007982e63bc10f769dcccbcb19cb413e1aee37e71ee78bc07323f834c66a80230ceb4f04979ec6287429"], 0x2c}}, 0x0) sendmsg$nl_route(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffff11ffffffff000000", @ANYRES32=r5, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000005840)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=@newqdisc={0x48, 0x24, 0x5820a61ca228651, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {}, {0xffff, 0xffff}, {0x0, 0xfff3}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x2, 0x8}}]}}]}, 0x48}}, 0x10000001) r13 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r13, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000026c0)=@getchain={0x3c, 0x66, 0x300, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, {0x0, 0xa}, {0x3}, {0xfff1, 0x9}}, [{0x8, 0xb, 0x1}, {0x8, 0xb, 0xc8d9}, {0x8, 0xb, 0x9}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4810}, 0x0) sendmmsg$alg(r1, &(0x7f0000000140), 0x4924b68, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000100)=@raw={'raw\x00', 0x8, 0x3, 0xa50, 0x0, 0xffffffff, 0xffffffff, 0xd0, 0xffffffff, 0x980, 0xffffffff, 0xffffffff, 0x980, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'dvmrp1\x00', {}, {}, 0x73, 0x0, 0x0, 0x45}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0x888, 0x8b0, 0x0, {}, [@common=@unspec=@u32={{0x7e0}, {[{[{0x7fff, 0x1}, {0x8, 0x3}, {0xfffff7ec, 0x1}, {0xfff, 0xbd3626e1c8b1df09}, {0x5, 0x2}, {0xb34c, 0x3}, {0x2}, {0xe48b, 0x2}, {0x101, 0x2}, {0x5, 0x2}, {0x5}], [{0x400}, {0x6, 0x8001}, {0x401, 0x40}, {0x7fff}, {0xffffc1b1, 0x32de}, {0xfff, 0x8}, {0x2, 0x9}, {0x1, 0xbbca}, {0x83, 0x1}, {0x5, 0x7}, {0x3}], 0x1, 0x7}, {[{0x9, 0x3}, {0x80000006, 0x3}, {0x4, 0x3}, {0x1, 0x2}, {0x9, 0x1}, {0xfffffffa}, {0x0, 0x2}, {0x80000000, 0x3}, {0x80000001}, {0x8001}, {0xff, 0x3}], [{0x7, 0x5}, {0x3, 0x6b6}, {0x4, 0x3fc}, {0x3}, {0x4, 0xfff}, {0x3ff, 0xe5d7}, {0x6, 0x3ff}, {0xa78, 0xffffffff}, {0xa9e1, 0x3}, {0x8, 0x1000}, {0xc7, 0xf385}], 0x6, 0x3}, {[{0x101, 0x2}, {0x9}, {0x3, 0x3}, {0x2, 0x3}, {0x48}, {0x9, 0x2}, {0x1, 0x2}, {0x7, 0x2}, {0x9}, {0x7, 0x1}, {0x0, 0x3}], [{0xfffffffb, 0x5}, {0x80000008, 0xa17}, {0x80, 0x4}, {0x8}, {0x3, 0x7}, {0x5e18, 0x7}, {0x4, 0x101}, {0x7, 0xfff}, {0xd, 0x7f}, {0x1002, 0x2}, {0xfb3, 0xa94}], 0xb, 0x4}, {[{0x8, 0x1}, {0x4, 0x2}, {0x4e, 0xc781c4f1f9c1fa4f}, {0x8, 0x1}, {0x4e5, 0x2}, {0x3, 0x3}, {0x6, 0x1}, {0x7, 0x1}, {0x5, 0x2}, {0xfff}, {0x4}], [{0x9, 0x8001}, {0xffff, 0x4}, {0x7fff, 0xf}, {0x66d, 0x9}, {0x92, 0xb}, {0x3, 0x6}, {0x7, 0xfff}, {0x1, 0xff}, {0x1, 0x1}, {0x0, 0x8}, {0x1, 0xff}], 0xa}, {[{0x5, 0x2}, {0x7a3, 0x2}, {0x1, 0x3}, {0x100}, {0x40}, {0x5, 0x1}, {0x8, 0x3}, {0x9, 0x3}, {0x8, 0x2}, {0x1, 0x1}, {0x7}], [{0x854f, 0x6b}, {0x7, 0x7}, {0x6, 0x80}, {0x3, 0x8000}, {0x9}, {0x3, 0x6}, {0x2, 0xf17}, {0x25, 0x401}, {0x200, 0x84b}, {0x7fff, 0x80}, {0x1, 0x1}], 0x4, 0x8}, {[{0xc3d, 0x147d12363fe5c40a}, {0x64, 0x1}, {0xf, 0x3}, {0x5, 0x1}, {0x7fffffff, 0x2}, {0x5}, {0x2af0, 0x2}, {0x1bd6, 0x2}, {0x1, 0x2}, {0x7, 0x1}, {0x7, 0x2}], [{0x92b, 0x1ff}, {0x1, 0xf458}, {0x5, 0x3}, {0x84, 0x1}, {0xe923, 0x7fff}, {0x4, 0xe}, {0x3, 0x6}, {0xad3f, 0x59f}, {0x4, 0xfffffffc}, {0x6}, {0x5, 0x6f}], 0x9}, {[{0x8}, {0x2f, 0x1}, {0x7, 0x1}, {0x0, 0x2}, {0x3, 0x3}, {0x0, 0x2}, {0x1, 0x3}, {0x8, 0x3}, {0x7, 0x3}, {0x2}, {0x2, 0x2}], [{0x6, 0x80000000}, {0x1, 0x9}, {0x40, 0xff}, {0x4, 0x2}, {0x5, 0x6}, {0x2, 0x5}, {0x0, 0x3}, {0xe, 0x5}, {0x6, 0x1ff}, {0xc, 0x7}, {0x1, 0x4}], 0xb, 0x7}, {[{0x8c, 0x3}, {0xd}, {0x10000, 0x2}, {0x8, 0x2}, {0x3, 0x3}, {0x0, 0x3}, {0x1ff, 0x1}, {0x0, 0x1}, {0xc, 0x1}, {0xf0f}, {0xf629}], [{0x4, 0x5}, {0x35f7, 0x1}, {0x401, 0xf6}, {0x94, 0xd16}, {0x8, 0x5}, {0x35, 0x4929}, {0x8001, 0x5}, {0x1000, 0x9}, {0x9f, 0x65}, {0x9, 0x4}, {0x9, 0xf0a9}], 0x1, 0x4}, {[{0x9, 0x1}, {0x9, 0x2}, {0x7, 0x1}, {0x4, 0x4adbb8db8b6f3087}, {0x3}, {0x3, 0x3}, {0x7ff}, {0x7, 0x1}, {0x10000, 0x3}, {0x0, 0x2}, {0x80000000, 0x1}], [{0xf767, 0x8}, {0x24, 0x5}, {0x9, 0x8}, {0x6, 0xb23}, {0x101, 0x4}, {0xfffffff7, 0xb98}, {0x10001, 0x8f}, {0x9, 0xa83}, {0xd, 0x1}, {0x4, 0xe00}, {0x7, 0x444}], 0x6, 0x4}, {[{0x2, 0x3}, {0x2}, {0x26914786, 0x3}, {0x3}, {0xd7f, 0x1}, {0x7fffffff}, {0xf}, {0x4, 0x2}, {0x8, 0x1}, {0x4, 0x3}, {0xe, 0x1}], [{0xb59, 0x6}, {0x4, 0x70c063f5}, {0x2, 0xfffffffe}, {0x5, 0x6}, {0x10000, 0x872}, {0x6, 0x8}, {0xffff, 0x7}, {0x7, 0x4}, {0x6, 0x401}, {0xfff, 0xa}, {0x81, 0x4}], 0xb, 0x4}, {[{0x200, 0x1}, {0x2, 0x3}, {0xa, 0x1}, {0x3ff, 0x1}, {0x7}, {0x1, 0x2}, {0x6, 0x3}, {0x7}, {0x92, 0x3}, {0x6, 0x1}, {0x7fffffff, 0x2}], [{0x3, 0xbbb9}, {0x4, 0x400}, {0xdec, 0x9}, {0x7, 0x1d}, {0x0, 0x9a}, {0x1, 0x8000}, {0x1, 0xf580}, {0x4, 0x9f}, {0x2, 0x4}, {0x5, 0x7}, {0xfff, 0x1}], 0x5, 0x7}], 0x4, 0x1}}]}, @common=@unspec=@AUDIT={0x28, 'AUDIT\x00', 0x0, {0x2}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0xab0) socket$nl_generic(0x10, 0x3, 0x10) r14 = socket$alg(0x26, 0x5, 0x0) bind$alg(r14, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'generic-gcm-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r14, 0x117, 0x1, &(0x7f0000000140)="2c385aa3d49100dc6626c892b6bc436a", 0x10) accept4(r14, 0x0, 0x0, 0x0) 103.410042ms ago: executing program 1 (id=7747): socket(0x10, 0x3, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) (async) socket$netlink(0x10, 0x3, 0x0) (async) socket$inet6_sctp(0xa, 0x1, 0x84) (async, rerun: 32) socket$packet(0x11, 0x3, 0x300) (async, rerun: 32) socket$nl_route(0x10, 0x3, 0x0) (async, rerun: 32) socket$inet6_udp(0xa, 0x2, 0x0) (async, rerun: 32) socket$nl_generic(0x10, 0x3, 0x10) (async, rerun: 64) socket$nl_netfilter(0x10, 0x3, 0xc) (async, rerun: 64) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_pr_sha256\x00'}, 0x58) (async) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) (async) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ieee802154(&(0x7f00000001c0), r1) sendmsg$IEEE802154_ADD_IFACE(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010000000000000000002100000009001f00706879f529000000050020"], 0x28}}, 0x0) (async) socket$inet6(0xa, 0x2, 0x0) (async) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) (async, rerun: 64) socket$inet_sctp(0x2, 0x5, 0x84) (async, rerun: 64) socket$netlink(0x10, 0x3, 0x0) (async) socket$nl_netfilter(0x10, 0x3, 0xc) (async) socket$nl_route(0x10, 0x3, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) (async) r3 = socket$netlink(0x10, 0x3, 0x14) (async) sendmsg$inet6(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @remote}}, 0x1c, 0x0}, 0x0) (async, rerun: 32) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) (rerun: 32) setsockopt$inet6_tcp_int(r4, 0x6, 0x2000000000000020, &(0x7f0000000040)=0xa, 0x1959cc36) (async, rerun: 64) sendmsg$netlink(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000b40)=[{&(0x7f0000000040)=ANY=[@ANYBLOB="2400000026000100000000000000000008000000", @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00', @ANYRES32], 0x24}], 0x1}, 0x0) (rerun: 64) setsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000000200)={0x0, 0x0, 0x207}, 0x20) (async, rerun: 64) sendto$inet6(0xffffffffffffffff, &(0x7f0000847fff)='X', 0xfee4, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) (async, rerun: 64) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0xd, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="180000009be40000000000000000000061121800000000009500000200000000"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x94) 7.028889ms ago: executing program 1 (id=7748): bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000440)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x7c, 0x7c, 0x2, [@var, @func_proto={0x0, 0x6, 0x0, 0xd, 0x0, [{}, {}, {0x0, 0x4}, {}, {}, {}]}, @fwd, @volatile, @typedef={0x4, 0x0, 0x0, 0x8, 0x3}, @volatile={0x0, 0x0, 0x0, 0x9, 0x6}]}}, 0x0, 0x96}, 0x28) r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000000)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x2, [@struct]}}, &(0x7f0000000040)=""/247, 0x26, 0xf7, 0x1}, 0x20) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000500)={0x6, 0x7, &(0x7f0000000180)=@framed={{}, [@func={0x85, 0x0, 0x1, 0x0, 0x3}, @map_val, @exit]}, &(0x7f0000000280)='GPL\x00', 0x5, 0xe2, &(0x7f00000002c0)=""/226, 0x0, 0x0, '\x00', 0x0, 0x25, r0, 0x8, 0x0, 0x0, 0x10, &(0x7f00000004c0), 0x3}, 0x80) r1 = socket(0x1, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCDEL6RD(r1, 0x89fa, &(0x7f0000000100)={'sit0\x00', &(0x7f0000000040)={@remote, @initdev={0xac, 0x1e, 0x0, 0x0}, 0x16, 0x8}}) 0s ago: executing program 2 (id=7749): r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) ioctl$F2FS_IOC_GARBAGE_COLLECT(r0, 0x4004f506, &(0x7f0000000140)=0x1) (async) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$team(&(0x7f00000044c0), 0xffffffffffffffff) (async) ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f0000000240)={'team0\x00', 0x0}) r4 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_NEIGHBORS(r1, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="fbffff4e", @ANYRES16=r4, @ANYBLOB="080025bd7000fedbdf250900000008003c0008000000"], 0x1c}, 0x1, 0x0, 0x0, 0x400489c}, 0x24002040) (async) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f0000004bc0)={0x0, 0x0, &(0x7f0000004b80)={&(0x7f0000000380)=ANY=[@ANYBLOB='`\x00\x00\x00', @ANYRES16=r2, @ANYRES8=r0, @ANYRES32=r3, @ANYBLOB="4400028040000100240001006d6f6465000000000000000000000000000000000000000000000000000000000500030005000000100004006cef770aaa898bfffddb23aed73c6f6164"], 0x60}, 0x1, 0x0, 0x0, 0x4000401}, 0x44084) kernel console output (not intermixed with test programs): 7.360126][T26383] netlink: 'syz.2.5876': attribute type 1 has an invalid length. [ 567.422904][T26383] netlink: 16 bytes leftover after parsing attributes in process `syz.2.5876'. [ 567.480419][T26394] sctp: [Deprecated]: syz.0.5878 (pid 26394) Use of struct sctp_assoc_value in delayed_ack socket option. [ 567.480419][T26394] Use struct sctp_sack_info instead [ 567.629066][T26407] netlink: 40 bytes leftover after parsing attributes in process `syz.4.5881'. [ 567.750985][T26416] netlink: 24 bytes leftover after parsing attributes in process `syz.4.5885'. [ 568.014505][T23678] Bluetooth: hci4: command 0x0c7b tx timeout [ 568.310922][T26440] netlink: 'syz.1.5891': attribute type 1 has an invalid length. [ 568.624127][T23914] tipc: Subscription rejected, illegal request [ 568.847107][T26473] vlan2: entered promiscuous mode [ 568.852269][T26473] bridge0: entered promiscuous mode [ 568.872122][T26475] openvswitch: netlink: Key type 85 is out of range max 32 [ 569.224498][T26496] RDS: rds_bind could not find a transport for ::ffff:172.20.20.187, load rds_tcp or rds_rdma? [ 569.550676][T26517] sock: sock_timestamping_bind_phc: sock not bind to device [ 569.582885][T26517] netlink: 'syz.0.5918': attribute type 2 has an invalid length. [ 569.612682][T26518] gtp0: entered promiscuous mode [ 569.652373][T26518] gtp0: entered allmulticast mode [ 569.810912][T26532] IPVS: set_ctl: invalid protocol: 2 100.1.1.1:20001 [ 570.087570][T23678] Bluetooth: hci4: command 0x0c7b tx timeout [ 570.299191][T26569] __nla_validate_parse: 7 callbacks suppressed [ 570.299209][T26569] netlink: 28 bytes leftover after parsing attributes in process `syz.0.5933'. [ 570.642568][T26593] erspan0: entered allmulticast mode [ 570.772614][T26599] netlink: 28 bytes leftover after parsing attributes in process `syz.2.5939'. [ 570.793523][T26601] IPVS: dh: SCTP 172.20.20.187:0 - no destination available [ 570.822143][T26599] netlink: 'syz.2.5939': attribute type 7 has an invalid length. [ 570.885588][T26599] netlink: 'syz.2.5939': attribute type 8 has an invalid length. [ 570.911042][T26612] pimreg: entered allmulticast mode [ 570.940767][T26599] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5939'. [ 570.980355][T26612] netlink: 'syz.1.5940': attribute type 10 has an invalid length. [ 571.251659][T26637] openvswitch: netlink: Flow actions attr not present in new flow. [ 571.289626][T26639] netlink: 'syz.2.5950': attribute type 1 has an invalid length. [ 571.391612][T26639] netlink: 28 bytes leftover after parsing attributes in process `syz.2.5950'. [ 571.438014][T26639] 8021q: adding VLAN 0 to HW filter on device bond7 [ 571.542706][T26654] netlink: 24 bytes leftover after parsing attributes in process `syz.0.5952'. [ 571.812968][T26664] netlink: 2 bytes leftover after parsing attributes in process `syz.3.5955'. [ 571.917399][T26670] netlink: 'syz.3.5957': attribute type 29 has an invalid length. [ 572.168492][ T5864] Bluetooth: hci4: command 0x0c7b tx timeout [ 572.383035][T26691] netlink: 'syz.0.5963': attribute type 8 has an invalid length. [ 572.409542][T26693] netlink: 12 bytes leftover after parsing attributes in process `syz.1.5964'. [ 572.764546][T26703] netlink: 4 bytes leftover after parsing attributes in process `syz.4.5968'. [ 572.804946][T26703] netlink: 24 bytes leftover after parsing attributes in process `syz.4.5968'. [ 572.873864][T26705] IPVS: set_ctl: invalid protocol: 43 172.30.0.1:20000 [ 572.944072][T26707] hsr0 speed is unknown, defaulting to 1000 [ 573.044232][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 573.194452][T26715] (unnamed net_device) (uninitialized): option lp_interval: invalid value (0) [ 573.203342][T26715] (unnamed net_device) (uninitialized): option lp_interval: allowed values 1 - 2147483647 [ 573.232796][T26715] netlink: 4 bytes leftover after parsing attributes in process `syz.4.5971'. [ 573.506708][T26729] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 573.522982][T26729] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 573.532809][T26729] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 573.541465][T26729] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 573.562215][T26729] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 573.718049][T26727] hsr0 speed is unknown, defaulting to 1000 [ 573.843881][ T5864] Bluetooth: hci2: command 0x0401 tx timeout [ 573.857355][T26739] sch_tbf: burst 4398 is lower than device lo mtu (65550) ! [ 574.191143][T26739] batman_adv: batadv0: Interface deactivated: dummy0 [ 574.231497][T26739] vlan0: left allmulticast mode [ 574.239312][T26739] vlan0: left promiscuous mode [ 574.244404][T23678] Bluetooth: hci4: command 0x0c7b tx timeout [ 574.381353][ T8311] netdevsim netdevsim4 eth0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 574.410383][ T8311] netdevsim netdevsim4 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 574.433074][ T8311] netdevsim netdevsim4 eth1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 574.452850][ T8311] netdevsim netdevsim4 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 574.512627][T26757] netlink: 'syz.2.5984': attribute type 2 has an invalid length. [ 574.523461][ T8311] netdevsim netdevsim4 eth2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 574.541581][ T8311] netdevsim netdevsim4 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 574.553474][ T8311] netdevsim netdevsim4 eth3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 574.562071][ T8311] netdevsim netdevsim4 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 574.963976][ C1] ip6_tunnel: ip6tnl3 xmit: Local address not yet configured! [ 575.433379][T26727] chnl_net:caif_netlink_parms(): no params data found [ 575.535658][T26784] batman_adv: batadv0: Interface deactivated: virt_wifi0 [ 575.605563][T23678] Bluetooth: hci3: command tx timeout [ 575.868633][T26819] __nla_validate_parse: 7 callbacks suppressed [ 575.868651][T26819] netlink: 256 bytes leftover after parsing attributes in process `syz.2.5995'. [ 575.998182][T26819] netlink: 'syz.2.5995': attribute type 1 has an invalid length. [ 576.124963][T26727] bridge0: port 1(bridge_slave_0) entered blocking state [ 576.136978][T26727] bridge0: port 1(bridge_slave_0) entered disabled state [ 576.144848][T26727] bridge_slave_0: entered allmulticast mode [ 576.152672][T26727] bridge_slave_0: entered promiscuous mode [ 576.167314][T26727] bridge0: port 2(bridge_slave_1) entered blocking state [ 576.175195][T26727] bridge0: port 2(bridge_slave_1) entered disabled state [ 576.182394][T26727] bridge_slave_1: entered allmulticast mode [ 576.192360][T26727] bridge_slave_1: entered promiscuous mode [ 576.230934][T26819] bond8 (unregistering): Released all slaves [ 576.334451][T23678] Bluetooth: hci4: command 0x0c7b tx timeout [ 576.349680][T26727] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 576.398913][T26727] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 576.454976][T26727] team0: Port device team_slave_0 added [ 576.457727][T26784] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 576.464348][T26727] team0: Port device team_slave_1 added [ 576.488312][T26784] Bluetooth: hci0: Error when powering off device on rfkill (-4) [ 576.551086][T26727] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 576.566484][T26727] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 576.593472][T26727] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 576.614823][T26784] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 576.620729][T26784] Bluetooth: hci1: Error when powering off device on rfkill (-4) [ 576.630526][T26727] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 576.646272][T26727] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 576.702910][T26727] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 576.715015][T26784] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 576.720918][T26784] Bluetooth: hci4: Error when powering off device on rfkill (-4) [ 576.821954][T26784] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 576.841280][T26784] Bluetooth: hci2: Error when powering off device on rfkill (-4) [ 576.925343][T26727] hsr_slave_0: entered promiscuous mode [ 576.950303][T26727] hsr_slave_1: entered promiscuous mode [ 576.973446][T26727] debugfs: 'hsr0' already exists in 'hsr' [ 576.994309][T26727] Cannot create hsr debugfs directory [ 577.214897][T26784] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 577.220826][T26784] Bluetooth: hci3: Error when powering off device on rfkill (-4) [ 577.603390][T26882] netlink: 32 bytes leftover after parsing attributes in process `syz.3.6006'. [ 577.652092][T26882] openvswitch: netlink: Flow actions attr not present in new flow. [ 578.163903][ C1] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 578.355497][T26918] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6016'. [ 578.395455][T26918] netlink: 24 bytes leftover after parsing attributes in process `syz.2.6016'. [ 578.485552][T26727] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 578.521497][T26727] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 578.596734][T26727] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 578.631324][T26930] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6021'. [ 578.647218][T26727] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 578.657828][T26930] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6021'. [ 578.686896][T26930] netlink: 'syz.4.6021': attribute type 11 has an invalid length. [ 578.775024][T26941] netlink: 212376 bytes leftover after parsing attributes in process `syz.2.6023'. [ 578.809703][T26946] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6021'. [ 578.987657][T26951] tipc: Enabled bearer , priority 0 [ 579.015390][T26951] syzkaller0: entered promiscuous mode [ 579.020889][T26951] syzkaller0: entered allmulticast mode [ 579.079365][T26727] 8021q: adding VLAN 0 to HW filter on device bond0 [ 579.112032][T26951] tipc: Resetting bearer [ 579.123590][T26948] tipc: Resetting bearer [ 579.177517][T26948] tipc: Disabling bearer [ 579.307480][T26727] 8021q: adding VLAN 0 to HW filter on device team0 [ 579.332628][T26966] Freezing with imperfect legacy cgroup freezer. See cgroup.freeze of cgroup v2 [ 579.338163][ T6424] bridge0: port 1(bridge_slave_0) entered blocking state [ 579.349154][ T6424] bridge0: port 1(bridge_slave_0) entered forwarding state [ 579.359092][T26965] netlink: 24 bytes leftover after parsing attributes in process `syz.3.6026'. [ 579.412550][T26965] netlink: 24 bytes leftover after parsing attributes in process `syz.3.6026'. [ 579.458327][ T6424] bridge0: port 2(bridge_slave_1) entered blocking state [ 579.465526][ T6424] bridge0: port 2(bridge_slave_1) entered forwarding state [ 579.872849][T26989] netlink: 'syz.0.6031': attribute type 6 has an invalid length. [ 579.882606][T26989] netlink: 'syz.0.6031': attribute type 5 has an invalid length. [ 580.149863][T27004] netlink: 'syz.2.6035': attribute type 3 has an invalid length. [ 580.231004][T26727] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 580.362905][T27015] netlink: 'syz.2.6039': attribute type 17 has an invalid length. [ 580.588246][T26727] veth0_vlan: entered promiscuous mode [ 580.668907][T27018] tipc: Enabled bearer , priority 0 [ 580.697923][T26727] veth1_vlan: entered promiscuous mode [ 580.747273][T27036] netlink: 'syz.3.6044': attribute type 30 has an invalid length. [ 580.760333][T27018] syzkaller0: entered promiscuous mode [ 580.772577][T27018] syzkaller0: entered allmulticast mode [ 580.815904][T27026] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 580.895041][T27018] tipc: Resetting bearer [ 580.995059][T27017] tipc: Resetting bearer [ 581.025302][T27048] netlink: 'syz.4.6047': attribute type 1 has an invalid length. [ 581.107905][T27055] __nla_validate_parse: 6 callbacks suppressed [ 581.107922][T27055] netlink: 4 bytes leftover after parsing attributes in process `syz.3.6049'. [ 581.130733][T27017] tipc: Disabling bearer [ 581.217487][T27067] netlink: 60 bytes leftover after parsing attributes in process `syz.4.6050'. [ 581.235029][T27061] netlink: 'syz.3.6049': attribute type 12 has an invalid length. [ 581.238678][T26727] veth0_macvtap: entered promiscuous mode [ 581.313193][T26727] veth1_macvtap: entered promiscuous mode [ 581.363853][ C0] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 581.522027][T26727] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 581.590563][T26727] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 581.649528][T11984] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 581.704401][T11984] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 581.728851][T27090] netlink: 'syz.3.6055': attribute type 24 has an invalid length. [ 581.740397][T27091] netlink: 'syz.2.6056': attribute type 14 has an invalid length. [ 581.774755][T11984] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 581.793830][T11984] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 582.002522][T27106] netlink: 20 bytes leftover after parsing attributes in process `syz.0.6057'. [ 582.139604][T11989] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 582.167537][T11989] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 582.291603][T11989] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 582.313730][T11989] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 582.674761][T27140] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6065'. [ 582.878261][T27153] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6070'. [ 582.990199][T27157] syzkaller1: entered promiscuous mode [ 583.007870][T27157] syzkaller1: entered allmulticast mode [ 583.303921][T27166] syzkaller0: entered promiscuous mode [ 583.312753][T27166] syzkaller0: entered allmulticast mode [ 583.515219][T27143] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 585.231606][T27228] netlink: 260 bytes leftover after parsing attributes in process `syz.1.6086'. [ 586.796803][T27163] Set syz1 is full, maxelem 65536 reached [ 587.255958][ T5864] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 587.273055][ T5864] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 587.282116][ T5864] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 587.297685][ T5864] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 587.306232][ T5864] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 587.942837][T27227] delete_channel: no stack [ 587.962376][T27232] hsr0 speed is unknown, defaulting to 1000 [ 588.131176][T27248] validate_nla: 2 callbacks suppressed [ 588.131193][T27248] netlink: 'syz.0.6092': attribute type 2 has an invalid length. [ 588.203352][T27250] netlink: 'syz.0.6092': attribute type 2 has an invalid length. [ 588.235276][T27254] netlink: 348 bytes leftover after parsing attributes in process `syz.2.6093'. [ 588.382042][T27265] netlink: 12 bytes leftover after parsing attributes in process `syz.0.6096'. [ 588.470381][T27267] netlink: 4 bytes leftover after parsing attributes in process `syz.3.6095'. [ 588.768757][T27283] netlink: 224 bytes leftover after parsing attributes in process `syz.3.6100'. [ 588.857183][T27287] netlink: 32 bytes leftover after parsing attributes in process `syz.1.6099'. [ 588.968165][T27292] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6102'. [ 589.031926][T27292] bond0: entered promiscuous mode [ 589.074924][T27292] bond0: left promiscuous mode [ 589.081203][T27295] netlink: 24 bytes leftover after parsing attributes in process `syz.1.6103'. [ 589.258866][T27295] netlink: 'syz.1.6103': attribute type 32 has an invalid length. [ 589.274457][T27295] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6103'. [ 589.357729][T27295] (unnamed net_device) (uninitialized): option coupled_control: invalid value (52) [ 589.382589][ T5864] Bluetooth: hci5: command tx timeout [ 589.631269][T27322] nft_compat: unsupported protocol 0 [ 589.648911][T27232] chnl_net:caif_netlink_parms(): no params data found [ 589.830297][T27330] netlink: 'syz.1.6110': attribute type 1 has an invalid length. [ 589.840122][T27332] netlink: 56 bytes leftover after parsing attributes in process `syz.0.6111'. [ 589.874734][T27332] netlink: 12 bytes leftover after parsing attributes in process `syz.0.6111'. [ 590.039884][T27232] bridge0: port 1(bridge_slave_0) entered blocking state [ 590.085785][T27232] bridge0: port 1(bridge_slave_0) entered disabled state [ 590.120663][T27232] bridge_slave_0: entered allmulticast mode [ 590.152077][T27232] bridge_slave_0: entered promiscuous mode [ 590.180438][T27232] bridge0: port 2(bridge_slave_1) entered blocking state [ 590.211987][T27232] bridge0: port 2(bridge_slave_1) entered disabled state [ 590.238373][T27232] bridge_slave_1: entered allmulticast mode [ 590.262817][T27232] bridge_slave_1: entered promiscuous mode [ 590.395243][T27232] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 590.427086][T27232] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 590.589498][T27232] team0: Port device team_slave_0 added [ 590.618029][T27232] team0: Port device team_slave_1 added [ 590.736136][T27232] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 590.743110][T27232] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 590.823660][T27232] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 590.866977][T27232] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 590.874040][T27232] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 590.914056][T27232] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 591.080369][T27232] hsr_slave_0: entered promiscuous mode [ 591.087615][T27232] hsr_slave_1: entered promiscuous mode [ 591.096938][T27232] debugfs: 'hsr0' already exists in 'hsr' [ 591.125468][T27232] Cannot create hsr debugfs directory [ 591.445773][ T5864] Bluetooth: hci5: command tx timeout [ 591.672259][T27394] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 592.114529][T27411] IPVS: Error connecting to the multicast addr [ 592.299383][T27420] macvtap1: entered allmulticast mode [ 592.309138][T27420] bridge0: entered allmulticast mode [ 592.345523][T27420] bridge0: port 2(macvtap1) entered blocking state [ 592.352263][T27420] bridge0: port 2(macvtap1) entered disabled state [ 592.405218][T27420] bridge0: left allmulticast mode [ 592.434601][T27427] netlink: 'syz.0.6131': attribute type 1 has an invalid length. [ 592.442584][T27428] netlink: 'syz.1.6130': attribute type 21 has an invalid length. [ 592.502023][T27426] bridge_slave_0: left allmulticast mode [ 592.535010][T27426] bridge_slave_0: left promiscuous mode [ 592.551018][T27426] bridge0: port 1(bridge_slave_0) entered disabled state [ 592.576493][T27426] bridge_slave_1: left allmulticast mode [ 592.592378][T27426] bridge_slave_1: left promiscuous mode [ 592.613518][T27426] bridge0: port 2(bridge_slave_1) entered disabled state [ 592.641213][T27426] bond0: (slave bond_slave_0): Releasing backup interface [ 592.684249][T27426] bond0: (slave bond_slave_1): Releasing backup interface [ 592.721313][T27426] team0: Port device team_slave_0 removed [ 592.752762][T27426] team0: Port device team_slave_1 removed [ 592.769605][T27426] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 592.778324][T27426] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 592.787477][T27426] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 592.796371][T27426] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 593.181076][T27232] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 593.282167][T27232] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 593.339527][T27232] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 593.444540][T27232] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 593.524315][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 593.525805][ T5864] Bluetooth: hci5: command tx timeout [ 593.726330][T27494] netlink: 'syz.0.6142': attribute type 83 has an invalid length. [ 593.728727][T27496] __nla_validate_parse: 4 callbacks suppressed [ 593.728742][T27496] netlink: 24 bytes leftover after parsing attributes in process `syz.3.6143'. [ 593.754695][T27496] netlink: 24 bytes leftover after parsing attributes in process `syz.3.6143'. [ 593.790797][T27496] netlink: 24 bytes leftover after parsing attributes in process `syz.3.6143'. [ 593.872172][T27496] netlink: 24 bytes leftover after parsing attributes in process `syz.3.6143'. [ 593.956104][T27496] netlink: 24 bytes leftover after parsing attributes in process `syz.3.6143'. [ 593.979210][T27232] 8021q: adding VLAN 0 to HW filter on device bond0 [ 593.988623][T27496] netlink: 24 bytes leftover after parsing attributes in process `syz.3.6143'. [ 593.997089][T27505] netlink: 'syz.0.6145': attribute type 2 has an invalid length. [ 594.030027][T27496] netlink: 24 bytes leftover after parsing attributes in process `syz.3.6143'. [ 594.075532][T27496] netlink: 24 bytes leftover after parsing attributes in process `syz.3.6143'. [ 594.099326][T27232] 8021q: adding VLAN 0 to HW filter on device team0 [ 594.107810][T27496] netlink: 24 bytes leftover after parsing attributes in process `syz.3.6143'. [ 594.177232][T27496] netlink: 24 bytes leftover after parsing attributes in process `syz.3.6143'. [ 594.292196][T11984] bridge0: port 1(bridge_slave_0) entered blocking state [ 594.299377][T11984] bridge0: port 1(bridge_slave_0) entered forwarding state [ 594.374971][T11984] bridge0: port 2(bridge_slave_1) entered blocking state [ 594.382198][T11984] bridge0: port 2(bridge_slave_1) entered forwarding state [ 594.776916][T27537] IPVS: rr: TCP [::]:0 - no destination available [ 595.179172][T27232] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 595.475858][T27575] macsec1: entered promiscuous mode [ 595.481111][T27575] macsec1: entered allmulticast mode [ 595.606002][ T5864] Bluetooth: hci5: command tx timeout [ 595.996096][T27598] syzkaller0: entered allmulticast mode [ 596.401287][T27232] veth0_vlan: entered promiscuous mode [ 596.417683][T27617] nbd: device at index 3 is going down [ 596.428983][T27232] veth1_vlan: entered promiscuous mode [ 596.599606][T27612] bridge0: entered promiscuous mode [ 596.627812][T27612] bridge0: entered allmulticast mode [ 596.710719][T27619] hsr0 speed is unknown, defaulting to 1000 [ 596.834624][T27232] veth0_macvtap: entered promiscuous mode [ 596.892277][T27232] veth1_macvtap: entered promiscuous mode [ 596.990703][T27232] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 597.059601][T27232] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 597.217206][T11989] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 597.249275][T11989] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 597.285968][T11989] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 597.311494][T11989] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 597.684692][ T6424] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 597.702823][ T6424] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 597.937841][T11990] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 597.975868][T11990] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 599.125877][T27740] netlink: 'syz.3.6193': attribute type 1 has an invalid length. [ 599.154652][T27740] netlink: 'syz.3.6193': attribute type 3 has an invalid length. [ 599.192821][T27740] __nla_validate_parse: 35 callbacks suppressed [ 599.192836][T27740] netlink: 224 bytes leftover after parsing attributes in process `syz.3.6193'. [ 599.244630][T27740] NCSI netlink: No device for ifindex 0 [ 599.261127][T27743] netlink: 'syz.3.6193': attribute type 1 has an invalid length. [ 599.313057][T27743] netlink: 'syz.3.6193': attribute type 3 has an invalid length. [ 599.334742][T27743] netlink: 224 bytes leftover after parsing attributes in process `syz.3.6193'. [ 599.363489][T27743] NCSI netlink: No device for ifindex 0 [ 599.580281][T23678] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 599.592831][T23678] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 599.601169][T23678] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 599.610307][T23678] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 599.619050][T23678] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 601.210028][ T6424] bond0 (unregistering): Released all slaves [ 601.326118][ T6424] bond1 (unregistering): Released all slaves [ 601.438567][ T6424] bond2 (unregistering): Released all slaves [ 601.548731][ T6424] bond3 (unregistering): Released all slaves [ 601.657685][ T6424] bond4 (unregistering): Released all slaves [ 601.671280][ T6424] bond5 (unregistering): Released all slaves [ 601.684461][T23678] Bluetooth: hci0: command tx timeout [ 601.689096][ T6424] bond6 (unregistering): Released all slaves [ 601.893479][T27749] hsr0 speed is unknown, defaulting to 1000 [ 601.942845][ T6424] : left promiscuous mode [ 602.067705][ T6424] tipc: Disabling bearer [ 602.095264][ T6424] tipc: Left network mode [ 602.185436][T27767] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6198'. [ 602.625424][T27787] netlink: 76 bytes leftover after parsing attributes in process `syz.2.6204'. [ 602.647360][T27787] nbd: illegal input index -8454144 [ 602.658533][T27787] netlink: 76 bytes leftover after parsing attributes in process `syz.2.6204'. [ 602.668483][T27787] nbd: illegal input index -8454144 [ 602.749037][T27790] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6206'. [ 603.040543][T27802] netlink: 830 bytes leftover after parsing attributes in process `syz.2.6208'. [ 603.087862][T27806] mac80211_hwsim hwsim44 wlan1: entered allmulticast mode [ 603.149563][T27802] netlink: 'syz.2.6208': attribute type 10 has an invalid length. [ 603.196326][T27802] mac80211_hwsim hwsim44 wlan1: left allmulticast mode [ 603.225141][T27802] bond0: (slave wlan1): refused to change device type [ 603.279677][T27802] dummy0: left allmulticast mode [ 603.304517][T27802] bridge0: port 1(dummy0) entered disabled state [ 603.469252][T27802] bond2: (slave gretap1): Releasing active interface [ 603.540665][T27802] bond3: (slave veth9): Releasing active interface [ 603.590280][T27802] bond3: (slave veth9): the permanent HWaddr of slave - b2:a5:94:94:0e:d7 - is still in use by bond - set the HWaddr of slave to a different address to avoid conflicts [ 603.772498][T23678] Bluetooth: hci0: command tx timeout [ 604.018516][T27802] bond3: (slave veth11): Releasing active interface [ 604.468712][T27802] bond6: (slave gretap2): Releasing active interface [ 604.847979][T27816] workqueue: Failed to create a rescuer kthread for wq "bond8": -EINTR [ 604.850546][T27821] workqueue: Failed to create a rescuer kthread for wq "bond1": -EINTR [ 605.271024][T27859] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6217'. [ 605.361963][T27859] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6217'. [ 605.467684][T27866] netlink: 'syz.4.6217': attribute type 83 has an invalid length. [ 605.538395][ C1] vcan0: j1939_tp_rxtimer: 0xffff8880435b1000: rx timeout, send abort [ 605.548176][ C1] vcan0: j1939_tp_rxtimer: 0xffff8880435b1400: rx timeout, send abort [ 605.556787][ C1] vcan0: j1939_xtp_rx_abort_one: 0xffff8880435b1000: 0x00000: (3) A timeout occurred and this is the connection abort to close the session. [ 605.572123][ C1] vcan0: j1939_xtp_rx_abort_one: 0xffff8880435b1400: 0x00000: (3) A timeout occurred and this is the connection abort to close the session. [ 605.844608][T23678] Bluetooth: hci0: command tx timeout [ 606.022099][ T3593] netdevsim netdevsim3 netdevsim0: unset [0, 0] type 1 family 0 port 2816 - 0 [ 606.037554][ T3593] netdevsim netdevsim3 netdevsim0: unset [0, 1] type 1 family 0 port 8472 - 0 [ 606.057866][ T3593] netdevsim netdevsim3 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 606.067595][ T3593] netdevsim netdevsim3 netdevsim1: unset [0, 0] type 1 family 0 port 2816 - 0 [ 606.076773][ T3593] netdevsim netdevsim3 netdevsim1: unset [0, 1] type 1 family 0 port 8472 - 0 [ 606.085867][ T3593] netdevsim netdevsim3 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 606.105256][T27883] netlink: 16 bytes leftover after parsing attributes in process `syz.3.6222'. [ 606.119627][T27883] netlink: 212264 bytes leftover after parsing attributes in process `syz.3.6222'. [ 606.182615][ T6424] hsr_slave_1: left promiscuous mode [ 606.290314][ T6424] veth1_macvtap: left allmulticast mode [ 606.318417][ T6424] veth1_macvtap: left promiscuous mode [ 606.336429][ T6424] veth0_macvtap: left promiscuous mode [ 606.361060][ T6424] veth1_vlan: left promiscuous mode [ 606.411836][T27897] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6224'. [ 606.807684][ T6424] pimreg (unregistering): left allmulticast mode [ 606.848599][ T6424] pim6reg (unregistering): left allmulticast mode [ 607.836570][ T3593] netdevsim netdevsim3 netdevsim2: unset [0, 0] type 1 family 0 port 2816 - 0 [ 607.849290][ T3593] netdevsim netdevsim3 netdevsim2: unset [0, 1] type 1 family 0 port 8472 - 0 [ 607.858338][ T3593] netdevsim netdevsim3 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 607.877146][ T3593] netdevsim netdevsim3 netdevsim3: unset [0, 0] type 1 family 0 port 2816 - 0 [ 607.892530][ T3593] netdevsim netdevsim3 netdevsim3: unset [0, 1] type 1 family 0 port 8472 - 0 [ 607.902384][ T3593] netdevsim netdevsim3 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 607.911812][T27749] chnl_net:caif_netlink_parms(): no params data found [ 607.925715][ T5864] Bluetooth: hci0: command tx timeout [ 608.002918][T27898] (unnamed net_device) (uninitialized): Unable to set up delay as MII monitoring is disabled [ 608.041766][T27897] veth0_macvtap: left promiscuous mode [ 608.298834][T27939] netlink: 'syz.4.6227': attribute type 11 has an invalid length. [ 608.319518][T27939] netlink: 'syz.4.6227': attribute type 1 has an invalid length. [ 608.562622][T27947] vlan2: entered allmulticast mode [ 608.593214][T27947] veth1: entered allmulticast mode [ 608.685261][ T30] audit: type=1800 audit(1757479037.830:8): pid=27963 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.6233" name="memory.events" dev="tmpfs" ino=213 res=0 errno=0 [ 608.820666][T27749] bridge0: port 1(bridge_slave_0) entered blocking state [ 608.848384][T27749] bridge0: port 1(bridge_slave_0) entered disabled state [ 608.863954][T27749] bridge_slave_0: entered allmulticast mode [ 608.880352][T27749] bridge_slave_0: entered promiscuous mode [ 608.911587][T27749] bridge0: port 2(bridge_slave_1) entered blocking state [ 608.920980][T27749] bridge0: port 2(bridge_slave_1) entered disabled state [ 608.932029][T27749] bridge_slave_1: entered allmulticast mode [ 608.940015][T27749] bridge_slave_1: entered promiscuous mode [ 608.999456][T27749] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 609.054472][T27749] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 609.135816][ T6424] IPVS: stop unused estimator thread 0... [ 609.192708][T27749] team0: Port device team_slave_0 added [ 609.228886][T27749] team0: Port device team_slave_1 added [ 609.436022][T28007] netlink: 'syz.1.6242': attribute type 1 has an invalid length. [ 609.461348][T28008] netlink: 'syz.1.6242': attribute type 1 has an invalid length. [ 609.563023][T28012] netlink: 'syz.2.6243': attribute type 6 has an invalid length. [ 609.588852][T27749] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 609.597429][T27749] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 609.625700][T28014] netlink: 'syz.2.6243': attribute type 6 has an invalid length. [ 609.640241][T27749] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 609.679142][T27749] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 609.690070][T27749] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 609.734047][T27749] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 609.753433][T28018] netlink: 76 bytes leftover after parsing attributes in process `syz.3.6245'. [ 609.782626][T28018] nbd: illegal input index -8454144 [ 609.802781][T28020] Bluetooth: MGMT ver 1.23 [ 609.827312][T28015] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 609.862035][T28017] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 609.902363][ T6424] netdevsim netdevsim0 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 609.955766][T28027] netlink: 4 bytes leftover after parsing attributes in process `syz.3.6248'. [ 609.976965][T28027] netlink: 'syz.3.6248': attribute type 12 has an invalid length. [ 610.004559][ T5864] Bluetooth: hci0: command 0x0405 tx timeout [ 610.036312][ T6424] netdevsim netdevsim0 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 610.059049][T28027] netlink: 4 bytes leftover after parsing attributes in process `syz.3.6248'. [ 610.073823][T28027] netlink: 'syz.3.6248': attribute type 12 has an invalid length. [ 610.126186][T27749] hsr_slave_0: entered promiscuous mode [ 610.133532][T27749] hsr_slave_1: entered promiscuous mode [ 610.186597][T27749] debugfs: 'hsr0' already exists in 'hsr' [ 610.203010][T27749] Cannot create hsr debugfs directory [ 611.948979][ T6424] netdevsim netdevsim0 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 612.142916][ T6424] netdevsim netdevsim0 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 612.309904][T28058] netlink: zone id is out of range [ 612.326545][T28058] netlink: zone id is out of range [ 612.341911][T28058] netlink: zone id is out of range [ 612.351893][T28058] netlink: zone id is out of range [ 612.408780][T28058] netlink: zone id is out of range [ 612.430708][T28058] netlink: zone id is out of range [ 612.444839][T28058] netlink: zone id is out of range [ 612.453061][T28058] netlink: zone id is out of range [ 612.511065][T28064] syzkaller0: entered promiscuous mode [ 612.523458][T28064] syzkaller0: entered allmulticast mode [ 613.370930][T28089] netlink: 'syz.3.6266': attribute type 1 has an invalid length. [ 613.379564][T28089] netlink: 172 bytes leftover after parsing attributes in process `syz.3.6266'. [ 614.711903][T28105] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6270'. [ 614.953019][ T6424] dvmrp1 (unregistering): left allmulticast mode [ 615.231327][ T6424] bond0 (unregistering): Released all slaves [ 615.248517][ T6424] bond1 (unregistering): Released all slaves [ 615.265363][ T6424] bond2 (unregistering): Released all slaves [ 615.289326][ T6424] bond3 (unregistering): Released all slaves [ 615.428350][ T6424] bond4 (unregistering): Released all slaves [ 615.565595][ T6424] bond5 (unregistering): Released all slaves [ 615.637879][T28111] net_ratelimit: 17 callbacks suppressed [ 615.637897][T28111] IPVS: rr: UDP 224.0.0.2:0 - no destination available [ 615.654510][T28111] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6272'. [ 615.719340][ T6424] bond6 (unregistering): Released all slaves [ 615.737126][T28097] ªªªªªª: renamed from vlan0 (while UP) [ 615.745570][T28104] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 615.777954][T28105] bridge0: port 2(bridge_slave_1) entered disabled state [ 615.905560][T28105] bridge_slave_1 (unregistering): left allmulticast mode [ 615.922523][T28105] bridge_slave_1 (unregistering): left promiscuous mode [ 615.930667][T28105] bridge0: port 2(bridge_slave_1) entered disabled state [ 616.038517][T28117] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6274'. [ 616.092721][ T6424] tipc: Left network mode [ 616.154815][ T6424] IPVS: stopping backup sync thread 21354 ... [ 616.266028][T28127] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6278'. [ 616.878781][T27749] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 616.896493][T28146] netlink: 204108 bytes leftover after parsing attributes in process `syz.3.6285'. [ 616.962270][T27749] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 617.011063][T27749] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 617.110573][T27749] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 617.240341][T28154] netlink: 'syz.3.6287': attribute type 1 has an invalid length. [ 617.249882][ T6424] hsr_slave_1: left promiscuous mode [ 617.261887][ T6424] batman_adv: batadv0: Removing interface: dummy0 [ 617.281065][ T6424] batman_adv: batadv0: Removing interface: virt_wifi0 [ 618.540850][T28154] workqueue: Failed to create a rescuer kthread for wq "bond8": -EINTR [ 618.662009][T28190] sctp: [Deprecated]: syz.3.6291 (pid 28190) Use of int in max_burst socket option. [ 618.662009][T28190] Use struct sctp_assoc_value instead [ 618.928676][T28201] bond9 (unregistering): Released all slaves [ 618.960589][T28206] netlink: 4 bytes leftover after parsing attributes in process `syz.3.6295'. [ 618.962947][T28208] (unnamed net_device) (uninitialized): option packets_per_slave: invalid value (18446744073709551615) [ 619.003913][T28208] (unnamed net_device) (uninitialized): option packets_per_slave: allowed values 0 - 65535 [ 619.035493][T28209] (unnamed net_device) (uninitialized): option packets_per_slave: invalid value (18446744073709551615) [ 619.086863][T28209] (unnamed net_device) (uninitialized): option packets_per_slave: allowed values 0 - 65535 [ 619.100199][T28213] netlink: 16 bytes leftover after parsing attributes in process `syz.4.6297'. [ 619.122685][T28213] netlink: 224 bytes leftover after parsing attributes in process `syz.4.6297'. [ 619.401829][T28233] netlink: 'syz.1.6299': attribute type 10 has an invalid length. [ 619.472160][T28237] netlink: 24 bytes leftover after parsing attributes in process `syz.1.6299'. [ 619.650996][T28233] veth0_vlan: entered allmulticast mode [ 619.740133][T28233] veth0_vlan: left promiscuous mode [ 619.756923][T28233] veth0_vlan: entered promiscuous mode [ 619.782264][T28233] team0: Device veth0_vlan failed to register rx_handler [ 619.851281][T28250] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6306'. [ 619.868306][T28250] netlink: 20 bytes leftover after parsing attributes in process `syz.3.6306'. [ 619.942230][T27749] 8021q: adding VLAN 0 to HW filter on device bond0 [ 619.973364][ T6424] IPVS: stop unused estimator thread 0... [ 620.029037][T27749] 8021q: adding VLAN 0 to HW filter on device team0 [ 620.087819][T23915] bridge0: port 1(bridge_slave_0) entered blocking state [ 620.094996][T23915] bridge0: port 1(bridge_slave_0) entered forwarding state [ 620.140631][T28266] netlink: 36 bytes leftover after parsing attributes in process `syz.1.6310'. [ 620.148072][T28265] netlink: 24 bytes leftover after parsing attributes in process `syz.3.6308'. [ 620.153706][T28266] netlink: 24 bytes leftover after parsing attributes in process `syz.1.6310'. [ 620.187911][T28257] macvtap1: entered allmulticast mode [ 620.213215][T28257] bridge0: entered allmulticast mode [ 620.251232][T28257] bridge0: port 1(macvtap1) entered blocking state [ 620.261237][T28257] bridge0: port 1(macvtap1) entered disabled state [ 620.275996][T28257] bridge0: left allmulticast mode [ 620.503559][ T3532] bridge0: port 2(bridge_slave_1) entered blocking state [ 620.510769][ T3532] bridge0: port 2(bridge_slave_1) entered forwarding state [ 621.297315][T28308] netlink: 9 bytes leftover after parsing attributes in process `syz.4.6317'. [ 621.320625][T28308] gretap0: entered promiscuous mode [ 621.368141][T28319] 0ªî{X¹¦: renamed from gretap0 [ 621.389991][T28319] 0ªî{X¹¦: left promiscuous mode [ 621.402892][T28319] 0ªî{X¹¦: entered allmulticast mode [ 621.452256][T28319] A link change request failed with some changes committed already. Interface 30ªî{X¹¦ may have been left with an inconsistent configuration, please check. [ 621.486189][T28323] workqueue: name exceeds WQ_NAME_LEN. Truncating to: !寿$ûÌÌULÙvy¸ÚØ¢…D£øUDŒw˜}z [ 621.542186][T27749] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 621.655338][T28332] netlink: zone id is out of range [ 621.673879][T28332] netlink: zone id is out of range [ 621.679012][T28332] netlink: zone id is out of range [ 621.698527][T28332] netlink: zone id is out of range [ 621.703999][T28332] netlink: zone id is out of range [ 621.706589][T28323] netlink: 'syz.2.6320': attribute type 32 has an invalid length. [ 621.709179][T28332] netlink: zone id is out of range [ 621.722163][T28332] netlink: zone id is out of range [ 621.729936][T28332] netlink: zone id is out of range [ 621.735270][T28332] netlink: get zone limit has 8 unknown bytes [ 621.748906][T28337] netlink: 'syz.1.6322': attribute type 1 has an invalid length. [ 621.841836][T28337] 8021q: adding VLAN 0 to HW filter on device bond1 [ 621.876275][T27749] veth0_vlan: entered promiscuous mode [ 621.936484][T28340] 8021q: adding VLAN 0 to HW filter on device bond1 [ 621.955192][T28340] bond1: (slave vti0): The slave device specified does not support setting the MAC address [ 621.966345][T28340] bond1: (slave vti0): Error -95 calling set_mac_address [ 622.057594][T27749] veth1_vlan: entered promiscuous mode [ 622.152894][T27749] veth0_macvtap: entered promiscuous mode [ 622.183559][T28351] netlink: 'syz.2.6326': attribute type 1 has an invalid length. [ 622.191273][T27749] veth1_macvtap: entered promiscuous mode [ 622.219575][T27749] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 622.260171][T27749] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 622.294450][ T6424] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 622.322236][ T6424] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 622.332646][ T6424] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 622.348857][ T6424] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 622.443459][ T8306] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 622.465808][ T8306] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 622.576278][ T3532] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 622.617676][ T3532] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 623.241980][T28397] netlink: 'syz.0.6338': attribute type 1 has an invalid length. [ 623.841378][ T5864] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 623.855010][ T5864] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 623.863303][ T5864] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 623.878721][ T5864] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 623.887061][ T5864] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 624.022031][T28426] sysfs: cannot create duplicate filename '/class/ieee80211/!寿$ûÌÌULÙvy¸ÚØ¢…D£øUDŒw˜}zë' [ 624.061887][T28426] CPU: 1 UID: 0 PID: 28426 Comm: syz.1.6346 Not tainted syzkaller #0 PREEMPT(full) [ 624.061919][T28426] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 624.061930][T28426] Call Trace: [ 624.061937][T28426] [ 624.061945][T28426] dump_stack_lvl+0x189/0x250 [ 624.061974][T28426] ? __pfx_dump_stack_lvl+0x10/0x10 [ 624.061994][T28426] ? __pfx__printk+0x10/0x10 [ 624.062022][T28426] ? kernfs_path_from_node+0x2f/0x290 [ 624.062040][T28426] ? kernfs_path_from_node+0x250/0x290 [ 624.062057][T28426] ? kernfs_path_from_node+0x2f/0x290 [ 624.062080][T28426] sysfs_warn_dup+0x8e/0xa0 [ 624.062099][T28426] sysfs_do_create_link_sd+0xc0/0x110 [ 624.062120][T28426] device_add_class_symlinks+0x1cf/0x240 [ 624.062144][T28426] device_add+0x475/0xb50 [ 624.062167][T28426] wiphy_register+0x1ba6/0x28d0 [ 624.062210][T28426] ? __pfx_wiphy_register+0x10/0x10 [ 624.062231][T28426] ? minstrel_ht_alloc+0x6dd/0x7e0 [ 624.062260][T28426] ? ieee80211_init_rate_ctrl_alg+0x56d/0x5f0 [ 624.062284][T28426] ieee80211_register_hw+0x3484/0x4100 [ 624.062321][T28426] ? ieee80211_register_hw+0x1471/0x4100 [ 624.062352][T28426] ? __pfx_ieee80211_register_hw+0x10/0x10 [ 624.062376][T28426] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 624.062406][T28426] ? __hrtimer_setup+0x187/0x210 [ 624.062422][T28426] ? __pfx_mac80211_hwsim_beacon+0x10/0x10 [ 624.062449][T28426] mac80211_hwsim_new_radio+0x2f0e/0x5340 [ 624.062504][T28426] ? __pfx_mac80211_hwsim_new_radio+0x10/0x10 [ 624.062523][T28426] ? trace_kmalloc+0x1f/0xd0 [ 624.062541][T28426] ? __kmalloc_node_track_caller_noprof+0x28e/0x4e0 [ 624.062562][T28426] ? kstrndup+0xbf/0x160 [ 624.062591][T28426] hwsim_new_radio_nl+0xea4/0x1b10 [ 624.062616][T28426] ? __pfx___nla_validate_parse+0x10/0x10 [ 624.062652][T28426] ? __pfx_hwsim_new_radio_nl+0x10/0x10 [ 624.062686][T28426] ? __nla_parse+0x40/0x60 [ 624.062713][T28426] ? genl_family_rcv_msg_attrs_parse+0x1c9/0x2a0 [ 624.062742][T28426] genl_family_rcv_msg_doit+0x212/0x300 [ 624.062770][T28426] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 624.062804][T28426] ? bpf_lsm_capable+0x9/0x20 [ 624.062824][T28426] ? security_capable+0x7e/0x2e0 [ 624.062856][T28426] genl_rcv_msg+0x60e/0x790 [ 624.062883][T28426] ? __pfx_genl_rcv_msg+0x10/0x10 [ 624.062910][T28426] ? __pfx_hwsim_new_radio_nl+0x10/0x10 [ 624.062950][T28426] netlink_rcv_skb+0x208/0x470 [ 624.062971][T28426] ? __lock_acquire+0xab9/0xd20 [ 624.062993][T28426] ? __pfx_genl_rcv_msg+0x10/0x10 [ 624.063014][T28426] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 624.063058][T28426] ? down_read+0x1ad/0x2e0 [ 624.063080][T28426] genl_rcv+0x28/0x40 [ 624.063096][T28426] netlink_unicast+0x82f/0x9e0 [ 624.063129][T28426] ? __pfx_netlink_unicast+0x10/0x10 [ 624.063153][T28426] ? netlink_sendmsg+0x642/0xb30 [ 624.063168][T28426] ? skb_put+0x11b/0x210 [ 624.063189][T28426] netlink_sendmsg+0x805/0xb30 [ 624.063217][T28426] ? __pfx_netlink_sendmsg+0x10/0x10 [ 624.063238][T28426] ? aa_sock_msg_perm+0xf1/0x1d0 [ 624.063257][T28426] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 624.063274][T28426] ? __pfx_netlink_sendmsg+0x10/0x10 [ 624.063292][T28426] __sock_sendmsg+0x219/0x270 [ 624.063318][T28426] ____sys_sendmsg+0x505/0x830 [ 624.063344][T28426] ? __pfx_____sys_sendmsg+0x10/0x10 [ 624.063374][T28426] ? import_iovec+0x74/0xa0 [ 624.063398][T28426] ___sys_sendmsg+0x21f/0x2a0 [ 624.063420][T28426] ? __pfx____sys_sendmsg+0x10/0x10 [ 624.063481][T28426] ? __fget_files+0x2a/0x420 [ 624.063496][T28426] ? __fget_files+0x3a0/0x420 [ 624.063523][T28426] __x64_sys_sendmsg+0x19b/0x260 [ 624.063546][T28426] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 624.063577][T28426] ? rcu_is_watching+0x15/0xb0 [ 624.063599][T28426] ? do_syscall_64+0xbe/0x3b0 [ 624.063619][T28426] do_syscall_64+0xfa/0x3b0 [ 624.063632][T28426] ? lockdep_hardirqs_on+0x9c/0x150 [ 624.063653][T28426] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 624.063670][T28426] ? clear_bhb_loop+0x60/0xb0 [ 624.063691][T28426] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 624.063707][T28426] RIP: 0033:0x7f0d3478eba9 [ 624.063723][T28426] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 624.063737][T28426] RSP: 002b:00007f0d355ba038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 624.063756][T28426] RAX: ffffffffffffffda RBX: 00007f0d349d6090 RCX: 00007f0d3478eba9 [ 624.063769][T28426] RDX: 0000000000000000 RSI: 0000200000000040 RDI: 0000000000000005 [ 624.063780][T28426] RBP: 00007f0d34811e19 R08: 0000000000000000 R09: 0000000000000000 [ 624.063790][T28426] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 624.063800][T28426] R13: 00007f0d349d6128 R14: 00007f0d349d6090 R15: 00007ffc2d9ffc08 [ 624.063830][T28426] [ 624.570385][T28421] hsr0 speed is unknown, defaulting to 1000 [ 624.603107][T28429] __nla_validate_parse: 10 callbacks suppressed [ 624.603123][T28429] netlink: 65047 bytes leftover after parsing attributes in process `syz.0.6347'. [ 624.828198][T28434] netlink: 'syz.0.6349': attribute type 3 has an invalid length. [ 624.862984][T28434] netlink: 199836 bytes leftover after parsing attributes in process `syz.0.6349'. [ 624.926206][T28434] netlink: 'syz.0.6349': attribute type 3 has an invalid length. [ 624.972744][T28434] netlink: 199836 bytes leftover after parsing attributes in process `syz.0.6349'. [ 625.014632][T28434] netlink: 'syz.0.6349': attribute type 3 has an invalid length. [ 625.051287][T28434] netlink: 199836 bytes leftover after parsing attributes in process `syz.0.6349'. [ 625.134410][T28434] netlink: 'syz.0.6349': attribute type 3 has an invalid length. [ 625.157407][T28434] netlink: 199836 bytes leftover after parsing attributes in process `syz.0.6349'. [ 625.234620][T28434] netlink: 'syz.0.6349': attribute type 3 has an invalid length. [ 625.242372][T28434] netlink: 199836 bytes leftover after parsing attributes in process `syz.0.6349'. [ 625.329585][T28434] netlink: 'syz.0.6349': attribute type 3 has an invalid length. [ 625.374243][T28434] netlink: 199836 bytes leftover after parsing attributes in process `syz.0.6349'. [ 625.419258][T28434] netlink: 'syz.0.6349': attribute type 3 has an invalid length. [ 625.437577][T28453] netlink: 20 bytes leftover after parsing attributes in process `syz.4.6352'. [ 625.464192][T28434] netlink: 199836 bytes leftover after parsing attributes in process `syz.0.6349'. [ 625.580150][T28434] netlink: 'syz.0.6349': attribute type 3 has an invalid length. [ 625.589275][T28434] netlink: 199836 bytes leftover after parsing attributes in process `syz.0.6349'. [ 625.619397][T28434] netlink: 'syz.0.6349': attribute type 3 has an invalid length. [ 625.923867][T23678] Bluetooth: hci1: command tx timeout [ 626.120455][ T3532] team0: Port device geneve0 removed [ 626.537907][ T3532] bond0 (unregistering): Released all slaves [ 626.555004][ T3532] bond1 (unregistering): Released all slaves [ 626.574521][ T3532] bond2 (unregistering): Released all slaves [ 626.596075][ T3532] bond3 (unregistering): Released all slaves [ 626.615009][ T3532] bond4 (unregistering): Released all slaves [ 626.629404][ T3532] bond5 (unregistering): Released all slaves [ 626.757942][ T3532] bond6 (unregistering): Released all slaves [ 626.774433][ T3532] bond7 (unregistering): Released all slaves [ 626.824414][T28421] chnl_net:caif_netlink_parms(): no params data found [ 627.099066][T28486] sysfs: cannot create duplicate filename '/class/ieee80211/!寿$ûÌÌULÙvy¸ÚØ¢…D£øUDŒw˜}zë' [ 627.141691][T28486] CPU: 1 UID: 0 PID: 28486 Comm: syz.4.6361 Not tainted syzkaller #0 PREEMPT(full) [ 627.141717][T28486] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 627.141728][T28486] Call Trace: [ 627.141737][T28486] [ 627.141745][T28486] dump_stack_lvl+0x189/0x250 [ 627.141775][T28486] ? __pfx_dump_stack_lvl+0x10/0x10 [ 627.141797][T28486] ? __pfx__printk+0x10/0x10 [ 627.141826][T28486] ? kernfs_path_from_node+0x2f/0x290 [ 627.141845][T28486] ? kernfs_path_from_node+0x250/0x290 [ 627.141862][T28486] ? kernfs_path_from_node+0x2f/0x290 [ 627.141885][T28486] sysfs_warn_dup+0x8e/0xa0 [ 627.141904][T28486] sysfs_do_create_link_sd+0xc0/0x110 [ 627.141927][T28486] device_add_class_symlinks+0x1cf/0x240 [ 627.141951][T28486] device_add+0x475/0xb50 [ 627.141975][T28486] wiphy_register+0x1ba6/0x28d0 [ 627.142019][T28486] ? __pfx_wiphy_register+0x10/0x10 [ 627.142042][T28486] ? minstrel_ht_alloc+0x6dd/0x7e0 [ 627.142072][T28486] ? ieee80211_init_rate_ctrl_alg+0x56d/0x5f0 [ 627.142097][T28486] ieee80211_register_hw+0x3484/0x4100 [ 627.142134][T28486] ? ieee80211_register_hw+0x1471/0x4100 [ 627.142165][T28486] ? __pfx_ieee80211_register_hw+0x10/0x10 [ 627.142190][T28486] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 627.142222][T28486] ? __hrtimer_setup+0x187/0x210 [ 627.142239][T28486] ? __pfx_mac80211_hwsim_beacon+0x10/0x10 [ 627.142267][T28486] mac80211_hwsim_new_radio+0x2f0e/0x5340 [ 627.142331][T28486] ? __pfx_mac80211_hwsim_new_radio+0x10/0x10 [ 627.142353][T28486] ? trace_kmalloc+0x1f/0xd0 [ 627.142372][T28486] ? __kmalloc_node_track_caller_noprof+0x28e/0x4e0 [ 627.142394][T28486] ? kstrndup+0xbf/0x160 [ 627.142423][T28486] hwsim_new_radio_nl+0xea4/0x1b10 [ 627.142449][T28486] ? __pfx___nla_validate_parse+0x10/0x10 [ 627.142488][T28486] ? __pfx_hwsim_new_radio_nl+0x10/0x10 [ 627.142526][T28486] ? __nla_parse+0x40/0x60 [ 627.142555][T28486] ? genl_family_rcv_msg_attrs_parse+0x1c9/0x2a0 [ 627.142585][T28486] genl_family_rcv_msg_doit+0x212/0x300 [ 627.142612][T28486] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 627.142647][T28486] ? bpf_lsm_capable+0x9/0x20 [ 627.142668][T28486] ? security_capable+0x7e/0x2e0 [ 627.142699][T28486] genl_rcv_msg+0x60e/0x790 [ 627.142727][T28486] ? __pfx_genl_rcv_msg+0x10/0x10 [ 627.142747][T28486] ? __pfx_hwsim_new_radio_nl+0x10/0x10 [ 627.142785][T28486] netlink_rcv_skb+0x208/0x470 [ 627.142807][T28486] ? __lock_acquire+0xab9/0xd20 [ 627.142830][T28486] ? __pfx_genl_rcv_msg+0x10/0x10 [ 627.142852][T28486] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 627.142898][T28486] ? down_read+0x1ad/0x2e0 [ 627.142919][T28486] genl_rcv+0x28/0x40 [ 627.142937][T28486] netlink_unicast+0x82f/0x9e0 [ 627.142971][T28486] ? __pfx_netlink_unicast+0x10/0x10 [ 627.142996][T28486] ? netlink_sendmsg+0x642/0xb30 [ 627.143010][T28486] ? skb_put+0x11b/0x210 [ 627.143033][T28486] netlink_sendmsg+0x805/0xb30 [ 627.143061][T28486] ? __pfx_netlink_sendmsg+0x10/0x10 [ 627.143082][T28486] ? aa_sock_msg_perm+0xf1/0x1d0 [ 627.143102][T28486] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 627.143120][T28486] ? __pfx_netlink_sendmsg+0x10/0x10 [ 627.143138][T28486] __sock_sendmsg+0x219/0x270 [ 627.143166][T28486] ____sys_sendmsg+0x505/0x830 [ 627.143192][T28486] ? __pfx_____sys_sendmsg+0x10/0x10 [ 627.143223][T28486] ? import_iovec+0x74/0xa0 [ 627.143247][T28486] ___sys_sendmsg+0x21f/0x2a0 [ 627.143269][T28486] ? __pfx____sys_sendmsg+0x10/0x10 [ 627.143337][T28486] ? __fget_files+0x2a/0x420 [ 627.143353][T28486] ? __fget_files+0x3a0/0x420 [ 627.143381][T28486] __x64_sys_sendmsg+0x19b/0x260 [ 627.143405][T28486] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 627.143438][T28486] ? rcu_is_watching+0x15/0xb0 [ 627.143462][T28486] ? do_syscall_64+0xbe/0x3b0 [ 627.143485][T28486] do_syscall_64+0xfa/0x3b0 [ 627.143500][T28486] ? lockdep_hardirqs_on+0x9c/0x150 [ 627.143523][T28486] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 627.143541][T28486] ? clear_bhb_loop+0x60/0xb0 [ 627.143563][T28486] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 627.143579][T28486] RIP: 0033:0x7fb47e58eba9 [ 627.143600][T28486] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 627.143614][T28486] RSP: 002b:00007fb47f4ad038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 627.143633][T28486] RAX: ffffffffffffffda RBX: 00007fb47e7d6090 RCX: 00007fb47e58eba9 [ 627.143646][T28486] RDX: 0000000000000000 RSI: 0000200000000040 RDI: 0000000000000007 [ 627.143657][T28486] RBP: 00007fb47e611e19 R08: 0000000000000000 R09: 0000000000000000 [ 627.143667][T28486] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 627.143678][T28486] R13: 00007fb47e7d6128 R14: 00007fb47e7d6090 R15: 00007ffe2fe60e18 [ 627.143713][T28486] [ 627.602632][T28500] netlink: 'syz.2.6363': attribute type 1 has an invalid length. [ 627.737168][T28499] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 627.744430][T28499] IPv6: NLM_F_CREATE should be set when creating new route [ 627.850717][T28421] bridge0: port 1(bridge_slave_0) entered blocking state [ 627.892388][T28421] bridge0: port 1(bridge_slave_0) entered disabled state [ 627.902123][T28421] bridge_slave_0: entered allmulticast mode [ 627.912525][T28421] bridge_slave_0: entered promiscuous mode [ 627.920732][T28421] bridge0: port 2(bridge_slave_1) entered blocking state [ 627.928072][T28421] bridge0: port 2(bridge_slave_1) entered disabled state [ 627.936133][T28421] bridge_slave_1: entered allmulticast mode [ 627.944058][T28421] bridge_slave_1: entered promiscuous mode [ 627.990591][T28516] !: renamed from dummy0 (while UP) [ 628.006323][T23678] Bluetooth: hci1: command tx timeout [ 628.070864][T28421] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 628.083545][T28421] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 628.174875][T28520] macvtap1: entered promiscuous mode [ 628.195036][T28520] vlan0: entered promiscuous mode [ 628.218279][T28520] team0: Device macvtap1 failed to register rx_handler [ 628.238696][T28520] vlan0: left promiscuous mode [ 628.290605][T28421] team0: Port device team_slave_0 added [ 628.316000][T28421] team0: Port device team_slave_1 added [ 628.463497][T28541] netdevsim netdevsim0 netdevsim0: entered promiscuous mode [ 628.481024][T28421] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 628.498400][T28421] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 628.536089][T28421] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 628.551283][ T3532] tipc: Disabling bearer [ 628.561969][ T3532] tipc: Disabling bearer [ 628.586808][ T3532] tipc: Left network mode [ 628.600042][T28421] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 628.640047][T28421] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 628.679726][T28421] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 629.037272][T28421] hsr_slave_0: entered promiscuous mode [ 629.068371][T28421] hsr_slave_1: entered promiscuous mode [ 629.084810][T28421] debugfs: 'hsr0' already exists in 'hsr' [ 629.093567][T28421] Cannot create hsr debugfs directory [ 629.101967][T28577] net_ratelimit: 1 callbacks suppressed [ 629.101982][T28577] openvswitch: netlink: Multiple metadata blocks provided [ 629.119952][T28575] openvswitch: netlink: ufid size 3068 bytes exceeds the range (1, 16) [ 629.787582][ T3532] hsr_slave_1: left promiscuous mode [ 629.880400][T28614] __nla_validate_parse: 9 callbacks suppressed [ 629.880419][T28614] netlink: 256 bytes leftover after parsing attributes in process `syz.1.6399'. [ 629.900612][T28615] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 630.098102][T23678] Bluetooth: hci1: command tx timeout [ 630.531625][T28617] validate_nla: 1 callbacks suppressed [ 630.531643][T28617] netlink: 'syz.4.6401': attribute type 11 has an invalid length. [ 630.545831][T28617] netlink: 64 bytes leftover after parsing attributes in process `syz.4.6401'. [ 630.557727][T28610] (unnamed net_device) (uninitialized): option arp_all_targets: invalid value (18446744073709551613) [ 630.840757][T28626] netlink: 36 bytes leftover after parsing attributes in process `syz.2.6404'. [ 630.885721][T28637] netlink: 209852 bytes leftover after parsing attributes in process `syz.1.6407'. [ 630.914602][T28637] openvswitch: netlink: ufid size 3068 bytes exceeds the range (1, 16) [ 630.988541][T28626] veth17: entered promiscuous mode [ 631.349108][T28660] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 631.395692][T28660] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6415'. [ 631.415930][T28660] netlink: 'syz.4.6415': attribute type 3 has an invalid length. [ 631.451233][ T3532] IPVS: stop unused estimator thread 0... [ 631.452638][T28663] netlink: 24 bytes leftover after parsing attributes in process `syz.1.6416'. [ 631.679177][T28421] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 631.700971][T28421] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 631.750927][T28421] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 631.765328][T28678] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6421'. [ 631.782632][T28421] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 631.822175][T28678] netlink: 'syz.4.6421': attribute type 1 has an invalid length. [ 631.841404][T28678] netlink: 'syz.4.6421': attribute type 2 has an invalid length. [ 632.038448][T28421] 8021q: adding VLAN 0 to HW filter on device bond0 [ 632.106558][T28700] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6426'. [ 632.133152][T28700] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6426'. [ 632.143882][T28421] 8021q: adding VLAN 0 to HW filter on device team0 [ 632.169193][T23923] bridge0: port 1(bridge_slave_0) entered blocking state [ 632.176393][T23923] bridge0: port 1(bridge_slave_0) entered forwarding state [ 632.185028][T23678] Bluetooth: hci1: command tx timeout [ 632.220734][T11990] bridge0: port 2(bridge_slave_1) entered blocking state [ 632.227933][T11990] bridge0: port 2(bridge_slave_1) entered forwarding state [ 632.231105][T28706] netlink: 'syz.1.6427': attribute type 1 has an invalid length. [ 632.251479][T28706] netlink: 224 bytes leftover after parsing attributes in process `syz.1.6427'. [ 632.513060][T28709] bond1 (unregistering): Released all slaves [ 632.789116][T28421] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 632.886041][T28421] veth0_vlan: entered promiscuous mode [ 632.909795][T28421] veth1_vlan: entered promiscuous mode [ 633.227352][T28421] veth0_macvtap: entered promiscuous mode [ 633.318249][T28421] veth1_macvtap: entered promiscuous mode [ 633.431150][T28421] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 633.512953][T28421] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 633.566307][T28775] netlink: 'syz.4.6448': attribute type 3 has an invalid length. [ 633.595684][ T3532] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 633.607355][ T3532] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 633.625372][ T3532] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 633.735304][T23915] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 633.892596][T11990] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 633.923018][T11990] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 633.960696][T28791] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 633.972367][T28790] netlink: 'syz.2.6455': attribute type 10 has an invalid length. [ 634.014273][T28790] team0: Port device geneve0 added [ 634.037446][T23915] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 634.078122][T23915] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 634.941551][T28846] __nla_validate_parse: 14 callbacks suppressed [ 634.941569][T28846] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6472'. [ 635.090945][T28855] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6476'. [ 635.239244][T28862] tipc: Started in network mode [ 635.244783][T28862] tipc: Node identity 0e232453cd32, cluster identity 4711 [ 635.252053][T28862] tipc: Enabled bearer , priority 0 [ 635.262386][T28862] syzkaller0: entered promiscuous mode [ 635.288347][T28862] syzkaller0: entered allmulticast mode [ 635.296976][T28864] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6479'. [ 635.351698][T28862] tipc: Resetting bearer [ 635.398032][T28860] tipc: Resetting bearer [ 635.464157][T28860] tipc: Disabling bearer [ 635.805581][T28883] netlink: 'syz.4.6484': attribute type 178 has an invalid length. [ 635.856379][T28890] netlink: 12 bytes leftover after parsing attributes in process `syz.4.6484'. [ 635.889527][T28883] openvswitch: netlink: Tunnel attr 0 has unexpected len 16 expected 8 [ 636.157959][T28905] netlink: 'syz.3.6493': attribute type 1 has an invalid length. [ 636.175298][T28905] netlink: 228 bytes leftover after parsing attributes in process `syz.3.6493'. [ 636.193715][T28905] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6493'. [ 636.552421][T28913] hsr0 speed is unknown, defaulting to 1000 [ 636.552440][T28917] mac80211_hwsim hwsim64 ÿ: renamed from wlan1 (while UP) [ 636.901359][T28928] netlink: 'syz.0.6501': attribute type 3 has an invalid length. [ 636.949891][T28932] netlink: 104 bytes leftover after parsing attributes in process `syz.0.6501'. [ 636.951536][T28928] netlink: 766 bytes leftover after parsing attributes in process `syz.0.6501'. [ 637.015538][ T5864] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 637.040224][ T5864] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 637.050041][ T5864] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 637.059388][ T5864] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 637.075895][ T5864] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 637.148723][ T3532] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 637.303911][T28915] netlink: 'syz.4.6495': attribute type 13 has an invalid length. [ 637.311775][T28915] netlink: 'syz.4.6495': attribute type 17 has an invalid length. [ 637.348670][T28944] netlink: 300 bytes leftover after parsing attributes in process `syz.1.6506'. [ 637.388658][ T3532] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 637.407191][T28933] hsr0 speed is unknown, defaulting to 1000 [ 637.447181][T28915] 0ªî{X¹¦: left allmulticast mode [ 637.513050][T28915] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 637.568350][ T3532] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 637.736508][ T3532] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 638.582555][ T3532] team0: Port device geneve0 removed [ 638.840117][T28973] netlink: 72 bytes leftover after parsing attributes in process `syz.3.6513'. [ 638.902087][T28974] IPVS: set_ctl: invalid protocol: 2926 172.20.20.187:20000 [ 639.019957][ T3532] bond0 (unregistering): left promiscuous mode [ 639.026889][ T3532] bond0 (unregistering): Released all slaves [ 639.136783][ T5864] Bluetooth: hci2: command tx timeout [ 639.144924][ T3532] bond1 (unregistering): Released all slaves [ 639.260630][ T3532] bond2 (unregistering): Released all slaves [ 639.368956][ T3532] bond3 (unregistering): Released all slaves [ 639.382698][ T3532] bond4 (unregistering): Released all slaves [ 639.396754][ T3532] bond5 (unregistering): Released all slaves [ 639.409365][ T3532] bond6 (unregistering): Released all slaves [ 639.533722][ T3532] bond7 (unregistering): Released all slaves [ 639.548269][ T3532] bond8 (unregistering): Released all slaves [ 640.072691][T28933] chnl_net:caif_netlink_parms(): no params data found [ 640.292834][T28933] bridge0: port 1(bridge_slave_0) entered blocking state [ 640.296153][T29005] netlink: 10 bytes leftover after parsing attributes in process `syz.4.6520'. [ 640.301002][T28933] bridge0: port 1(bridge_slave_0) entered disabled state [ 640.318224][T28933] bridge_slave_0: entered allmulticast mode [ 640.326320][T28933] bridge_slave_0: entered promiscuous mode [ 640.336817][T29007] netlink: 32 bytes leftover after parsing attributes in process `syz.1.6521'. [ 640.352768][T29007] netlink: 32 bytes leftover after parsing attributes in process `syz.1.6521'. [ 640.362241][T28933] bridge0: port 2(bridge_slave_1) entered blocking state [ 640.370208][T28933] bridge0: port 2(bridge_slave_1) entered disabled state [ 640.379088][T28933] bridge_slave_1: entered allmulticast mode [ 640.387748][T28933] bridge_slave_1: entered promiscuous mode [ 640.498316][T28933] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 640.526987][T28933] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 640.670874][T28933] team0: Port device team_slave_0 added [ 640.723448][T28933] team0: Port device team_slave_1 added [ 640.829975][T28933] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 640.854724][T28933] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 640.891080][T28933] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 640.897260][T29040] netlink: 36 bytes leftover after parsing attributes in process `syz.4.6528'. [ 640.916830][T28933] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 640.933679][T28933] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 640.973341][T28933] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 641.032910][T29034] netlink: 44 bytes leftover after parsing attributes in process `syz.4.6528'. [ 641.196478][T28933] hsr_slave_0: entered promiscuous mode [ 641.207759][ T5864] Bluetooth: hci2: command tx timeout [ 641.241382][T28933] hsr_slave_1: entered promiscuous mode [ 641.265116][T28933] debugfs: 'hsr0' already exists in 'hsr' [ 641.270994][T28933] Cannot create hsr debugfs directory [ 641.276626][T29044] tc_dump_action: action bad kind [ 641.356216][ T3532] : left promiscuous mode [ 641.468049][T29062] netlink: 4388 bytes leftover after parsing attributes in process `syz.1.6535'. [ 641.512168][ T3532] tipc: Left network mode [ 641.557568][T29067] A link change request failed with some changes committed already. Interface wg2 may have been left with an inconsistent configuration, please check. [ 641.620222][ T6007] IPVS: starting estimator thread 0... [ 641.716813][T29070] IPVS: using max 38 ests per chain, 91200 per kthread [ 641.758968][T29081] netlink: 'syz.4.6540': attribute type 3 has an invalid length. [ 642.139607][T29096] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6543'. [ 643.284076][ T5864] Bluetooth: hci2: command tx timeout [ 645.179496][T29120] netlink: 44 bytes leftover after parsing attributes in process `syz.3.6551'. [ 645.215278][T29118] bridge0: port 1(syz_tun) entered blocking state [ 645.242177][T29118] bridge0: port 1(syz_tun) entered disabled state [ 645.273889][T29118] syz_tun: entered allmulticast mode [ 645.275639][T29121] netlink: 'syz.1.6550': attribute type 10 has an invalid length. [ 645.323298][T29118] syz_tun: entered promiscuous mode [ 645.381370][ T5864] Bluetooth: hci2: command tx timeout [ 645.383244][T29118] bridge0: port 1(syz_tun) entered blocking state [ 645.394139][T29118] bridge0: port 1(syz_tun) entered forwarding state [ 645.493455][T29121] bridge0: port 1(syz_tun) entered disabled state [ 645.507713][T29121] bridge0: port 1(syz_tun) entered blocking state [ 645.514337][T29121] bridge0: port 1(syz_tun) entered forwarding state [ 645.535490][T29121] bond0: (slave bridge0): Enslaving as an active interface with an up link [ 645.580579][ T3532] bond_slave_1: left promiscuous mode [ 645.614229][ T3532] hsr_slave_0: left promiscuous mode [ 645.639908][ T3532] hsr_slave_1: left promiscuous mode [ 645.678885][ T3532] veth1_macvtap: left promiscuous mode [ 645.777974][T29145] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci2/hci2:200/input8 [ 646.343800][ T3593] smc: removing ib device syz2 [ 646.714389][T29147] netlink: 'syz.0.6556': attribute type 1 has an invalid length. [ 646.907672][T29159] netlink: 12 bytes leftover after parsing attributes in process `syz.1.6560'. [ 646.954298][T29159] bridge0: received packet on syz_tun with own address as source address (addr:aa:aa:aa:aa:aa:aa, vlan:0) [ 647.552561][T29176] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6567'. [ 647.587432][T29179] netlink: 80 bytes leftover after parsing attributes in process `syz.0.6566'. [ 647.766424][ T30] audit: type=1800 audit(1757479076.910:9): pid=29187 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.6570" name=4996AE17DFFC2E43C8174B54B620636894AAACF28FF62616363C70A440AEC4014CAF28C0ADC04308 dev="tmpfs" ino=621 res=0 errno=0 [ 647.849770][T29193] netlink: 'syz.4.6571': attribute type 1 has an invalid length. [ 647.926213][T28933] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 648.041503][T29195] bond1 (unregistering): Released all slaves [ 650.814340][T28933] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 650.830681][T29197] bond1: (slave ipvlan3): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 650.843452][T29197] bond1: (slave ipvlan3): The slave device specified does not support setting the MAC address [ 650.854390][T29197] bond1: (slave ipvlan3): Setting fail_over_mac to active for active-backup mode [ 650.926673][T28933] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 650.966968][T28933] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 651.019021][T29208] 8021q: adding VLAN 0 to HW filter on device ipvlan4 [ 651.036003][T29208] bond0: (slave ipvlan4): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 651.243680][T29213] can: request_module (can-proto-4) failed. [ 651.319382][T29233] netlink: 56 bytes leftover after parsing attributes in process `syz.1.6581'. [ 651.331918][T29233] netlink: 16 bytes leftover after parsing attributes in process `syz.1.6581'. [ 651.402757][T28933] 8021q: adding VLAN 0 to HW filter on device bond0 [ 651.443308][T29241] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6583'. [ 651.481061][T29241] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6583'. [ 651.502530][ T3532] IPVS: stop unused estimator thread 0... [ 651.511433][T28933] 8021q: adding VLAN 0 to HW filter on device team0 [ 651.545428][T23923] bridge0: port 1(bridge_slave_0) entered blocking state [ 651.552575][T23923] bridge0: port 1(bridge_slave_0) entered forwarding state [ 651.561858][T23923] bridge0: port 2(bridge_slave_1) entered blocking state [ 651.569102][T23923] bridge0: port 2(bridge_slave_1) entered forwarding state [ 651.680248][T29250] syzkaller1: entered promiscuous mode [ 651.688412][T29250] syzkaller1: entered allmulticast mode [ 651.729066][T29253] netlink: 'syz.4.6586': attribute type 1 has an invalid length. [ 651.745043][T29250] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6584'. [ 651.757994][T28933] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 652.261276][T29281] netlink: 'syz.1.6590': attribute type 2 has an invalid length. [ 652.279290][T29281] netlink: 'syz.1.6590': attribute type 1 has an invalid length. [ 652.485006][T29287] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6593'. [ 653.064926][T29294] netlink: 12 bytes leftover after parsing attributes in process `syz.1.6595'. [ 653.126759][T29298] netlink: 212376 bytes leftover after parsing attributes in process `syz.0.6596'. [ 653.143211][T28933] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 653.248191][T29304] netlink: 'syz.1.6598': attribute type 1 has an invalid length. [ 653.294440][T29308] netlink: 32 bytes leftover after parsing attributes in process `syz.0.6599'. [ 653.342552][T29304] 8021q: adding VLAN 0 to HW filter on device bond2 [ 653.402130][T28933] veth0_vlan: entered promiscuous mode [ 653.437327][T28933] veth1_vlan: entered promiscuous mode [ 653.470388][T29318] rdma_op ffff88807c1a99f0 conn xmit_rdma 0000000000000000 [ 653.525482][T28933] veth0_macvtap: entered promiscuous mode [ 653.546153][T28933] veth1_macvtap: entered promiscuous mode [ 653.598422][T28933] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 653.647606][T28933] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 653.697706][T23923] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 653.730405][T23923] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 653.798045][T23923] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 653.819277][T23923] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 653.967937][T29337] wg1: entered promiscuous mode [ 653.972831][T29337] wg1: entered allmulticast mode [ 654.011955][T29340] netlink: 'syz.3.6606': attribute type 1 has an invalid length. [ 654.030324][ T3593] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 654.060876][ T3593] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 654.189850][ T6424] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 654.204607][ T6424] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 654.311642][T29347] netlink: 'syz.1.6608': attribute type 1 has an invalid length. [ 654.389497][T29357] netlink: 28 bytes leftover after parsing attributes in process `syz.1.6608'. [ 654.762280][T29383] netlink: 20 bytes leftover after parsing attributes in process `syz.3.6619'. [ 654.820480][T29385] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6620'. [ 655.283133][T29402] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 655.411446][T29407] tipc: Enabled bearer , priority 0 [ 655.427239][T29407] syzkaller0: entered promiscuous mode [ 655.440720][T29407] syzkaller0: entered allmulticast mode [ 655.518971][T29407] veth1: mtu less than device minimum [ 655.697368][T29422] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6631'. [ 655.710920][T29421] netlink: 32 bytes leftover after parsing attributes in process `syz.2.6632'. [ 655.743964][T29406] tipc: Resetting bearer [ 655.795618][T29406] tipc: Disabling bearer [ 655.857981][T29426] bond2: entered promiscuous mode [ 655.863040][T29426] bond2: entered allmulticast mode [ 655.869687][T29426] 8021q: adding VLAN 0 to HW filter on device bond2 [ 656.059043][T29436] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6638'. [ 656.107537][T29440] netlink: 'syz.3.6640': attribute type 1 has an invalid length. [ 656.250937][T29447] netlink: 'syz.3.6643': attribute type 29 has an invalid length. [ 656.260287][T29446] netlink: 'syz.2.6642': attribute type 12 has an invalid length. [ 656.318939][T29447] netlink: 'syz.3.6643': attribute type 29 has an invalid length. [ 656.454412][T29461] syz_tun: entered allmulticast mode [ 656.565016][T29460] syz_tun: left allmulticast mode [ 656.717362][T29476] netlink: 'syz.4.6653': attribute type 1 has an invalid length. [ 656.764372][T29478] netlink: 'syz.0.6654': attribute type 10 has an invalid length. [ 656.814191][T29478] 8021q: adding VLAN 0 to HW filter on device team0 [ 656.839949][T29478] bond0: (slave team0): Enslaving as an active interface with an up link [ 656.890832][T29486] netlink: 'syz.4.6657': attribute type 10 has an invalid length. [ 656.900422][T29482] IPVS: set_ctl: invalid protocol: 0 127.0.0.1:20001 [ 656.941474][T29486] team0: Port device dummy0 added [ 657.090263][T29496] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 657.230837][T29504] tipc: Started in network mode [ 657.252518][T29504] tipc: Node identity 321743fd54db, cluster identity 4711 [ 657.277919][T29504] tipc: Enabled bearer , priority 0 [ 657.313868][T29512] syzkaller0: entered promiscuous mode [ 657.357571][T29512] syzkaller0: entered allmulticast mode [ 657.372034][T29510] hsr0: A HSR master's MTU cannot be greater than the smallest MTU of its slaves minus the HSR Tag length (6 octets). [ 657.466623][T29504] tipc: Resetting bearer [ 657.489886][T29502] tipc: Resetting bearer [ 657.576682][T29502] tipc: Disabling bearer [ 657.597074][T29524] veth0: entered promiscuous mode [ 657.637191][T29519] veth0: left promiscuous mode [ 657.760159][T29537] __nla_validate_parse: 6 callbacks suppressed [ 657.760177][T29537] netlink: 4 bytes leftover after parsing attributes in process `syz.3.6674'. [ 657.816877][T29544] netlink: 212376 bytes leftover after parsing attributes in process `syz.2.6675'. [ 658.053405][T29551] netlink: 212376 bytes leftover after parsing attributes in process `syz.1.6676'. [ 658.174803][T29556] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6679'. [ 658.236170][T29563] bridge0: received packet on syz_tun with own address as source address (addr:aa:aa:aa:aa:aa:aa, vlan:0) [ 658.269095][T29563] netlink: 212376 bytes leftover after parsing attributes in process `syz.1.6682'. [ 658.349272][T29567] netlink: 'syz.4.6684': attribute type 11 has an invalid length. [ 658.370003][T29567] netlink: 224 bytes leftover after parsing attributes in process `syz.4.6684'. [ 658.385609][T29567] netlink: 'syz.4.6684': attribute type 11 has an invalid length. [ 658.404248][T29567] netlink: 224 bytes leftover after parsing attributes in process `syz.4.6684'. [ 658.431430][T29572] netlink: 60 bytes leftover after parsing attributes in process `syz.1.6686'. [ 659.112574][T29578] netlink: 24 bytes leftover after parsing attributes in process `syz.4.6688'. [ 659.136188][T29578] netlink: 24 bytes leftover after parsing attributes in process `syz.4.6688'. [ 659.527305][T29599] tc_dump_action: action bad kind [ 659.727148][T29600] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 659.804754][T29604] validate_nla: 4 callbacks suppressed [ 659.804771][T29604] netlink: 'syz.3.6695': attribute type 29 has an invalid length. [ 659.948175][T29600] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 660.000619][T29607] netlink: 'syz.3.6695': attribute type 29 has an invalid length. [ 660.033892][T29620] netdevsim netdevsim4 netdevsim0: entered promiscuous mode [ 660.161344][T29600] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 660.196027][T29628] sctp: [Deprecated]: syz.4.6702 (pid 29628) Use of int in max_burst socket option deprecated. [ 660.196027][T29628] Use struct sctp_assoc_value instead [ 660.216925][T29630] netlink: 'syz.2.6701': attribute type 7 has an invalid length. [ 660.303280][T29600] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 661.000268][ T3532] netdevsim netdevsim3 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 661.013774][ T3532] netdevsim netdevsim3 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 661.078108][T11990] netdevsim netdevsim3 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 661.171983][T11989] netdevsim netdevsim3 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 661.359576][T29657] netlink: 'syz.3.6710': attribute type 1 has an invalid length. [ 661.370734][T29655] netlink: 'syz.1.6709': attribute type 1 has an invalid length. [ 661.394214][T29657] netlink: 'syz.3.6710': attribute type 2 has an invalid length. [ 662.419954][T29728] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 662.667459][T29741] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 663.229753][T29777] openvswitch: netlink: Missing key (keys=40, expected=200000) [ 663.371410][T29790] __nla_validate_parse: 26 callbacks suppressed [ 663.371427][T29790] netlink: 24 bytes leftover after parsing attributes in process `syz.2.6752'. [ 663.551716][T29802] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6755'. [ 663.664922][T29808] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6757'. [ 663.810160][T29819] netlink: 28 bytes leftover after parsing attributes in process `syz.4.6760'. [ 663.822295][T29819] netlink: 24 bytes leftover after parsing attributes in process `syz.4.6760'. [ 663.980055][T29828] netlink: 24 bytes leftover after parsing attributes in process `syz.4.6763'. [ 664.196232][T29837] netlink: 232 bytes leftover after parsing attributes in process `syz.2.6766'. [ 664.283238][T29836] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 664.451218][T29855] netlink: 224 bytes leftover after parsing attributes in process `syz.1.6774'. [ 664.765217][T29874] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6781'. [ 664.886240][T29885] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6785'. [ 664.947479][T29883] team0: Port device team_slave_1 removed [ 665.411186][T29915] netlink: 'syz.2.6794': attribute type 4 has an invalid length. [ 665.468120][T29915] netlink: 'syz.2.6794': attribute type 4 has an invalid length. [ 665.765858][T29941] openvswitch: netlink: Key type 147 is out of range max 32 [ 665.809583][T29941] tipc: Enabled bearer , priority 0 [ 665.949709][T29941] syzkaller0: entered promiscuous mode [ 665.955714][T29941] syzkaller0: entered allmulticast mode [ 666.009679][T29941] tipc: Resetting bearer [ 666.513962][T29938] tipc: Resetting bearer [ 666.804293][ T5873] tipc: Node number set to 3272680531 [ 668.388067][T29938] tipc: Disabling bearer [ 668.627072][T29994] __nla_validate_parse: 7 callbacks suppressed [ 668.627091][T29994] netlink: 4 bytes leftover after parsing attributes in process `syz.3.6816'. [ 668.832457][T30007] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci2/hci2:200/input9 [ 668.859396][T30017] netlink: 32 bytes leftover after parsing attributes in process `syz.0.6822'. [ 668.893091][T30019] netlink: 32 bytes leftover after parsing attributes in process `syz.0.6822'. [ 668.941908][T30007] tipc: Started in network mode [ 668.946958][T30007] tipc: Node identity 8285f473ffca, cluster identity 4711 [ 668.955075][T30007] tipc: Enabled bearer , priority 0 [ 668.974541][T30007] syzkaller0: entered promiscuous mode [ 668.980012][T30007] syzkaller0: entered allmulticast mode [ 669.040774][T30007] tipc: Resetting bearer [ 669.055847][T30018] netlink: 'syz.1.6824': attribute type 4 has an invalid length. [ 669.095252][T30006] tipc: Resetting bearer [ 669.153375][T30027] netlink: 24 bytes leftover after parsing attributes in process `syz.0.6826'. [ 669.197239][T30006] tipc: Disabling bearer [ 669.303401][T30032] pimreg: entered allmulticast mode [ 669.506890][T30040] syzkaller1: entered promiscuous mode [ 669.512393][T30040] syzkaller1: entered allmulticast mode [ 669.558375][T30048] netlink: 'syz.2.6834': attribute type 11 has an invalid length. [ 669.685242][T30040] netlink: 28 bytes leftover after parsing attributes in process `syz.3.6831'. [ 669.778464][T30040] vlan3: entered allmulticast mode [ 669.790375][T30040] veth1: entered allmulticast mode [ 670.081008][T30075] netlink: 16 bytes leftover after parsing attributes in process `syz.4.6841'. [ 670.109131][T30075] netlink: 12 bytes leftover after parsing attributes in process `syz.4.6841'. [ 670.124343][T30078] netlink: 48 bytes leftover after parsing attributes in process `syz.0.6840'. [ 670.391314][T30091] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6848'. [ 670.568582][T30107] netlink: 20 bytes leftover after parsing attributes in process `syz.4.6850'. [ 670.705229][T30109] dvmrp0: entered allmulticast mode [ 670.711055][T30113] bridge_slave_1: left allmulticast mode [ 670.724856][T30113] bridge_slave_1: left promiscuous mode [ 670.730958][T30113] bridge0: port 2(bridge_slave_1) entered disabled state [ 670.747309][T30113] bridge_slave_0: left allmulticast mode [ 670.765303][T30113] bridge_slave_0: left promiscuous mode [ 670.771099][T30113] bridge0: port 1(bridge_slave_0) entered disabled state [ 670.946585][T30125] tipc: Enabled bearer , priority 0 [ 671.056299][T30138] netlink: 'syz.0.6861': attribute type 10 has an invalid length. [ 671.087573][T30129] syzkaller0: entered promiscuous mode [ 671.108224][T30129] syzkaller0: entered allmulticast mode [ 671.141460][T30138] veth0_vlan: entered allmulticast mode [ 671.167304][T30138] veth0_vlan: left promiscuous mode [ 671.175215][T30138] veth0_vlan: entered promiscuous mode [ 671.186557][T30138] team0: Device veth0_vlan failed to register rx_handler [ 671.229285][T30117] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 671.299793][T30117] tipc: Resetting bearer [ 671.379683][T30110] tipc: Resetting bearer [ 671.408421][T30110] tipc: Disabling bearer [ 671.429116][T30160] syz_tun: entered allmulticast mode [ 671.459289][T30162] dvmrp8: entered allmulticast mode [ 671.579634][T30169] syz_tun: left allmulticast mode [ 671.589263][T30169] dvmrp8: left allmulticast mode [ 671.657702][T30182] openvswitch: netlink: Unexpected mask (mask=200040, allowed=10048) [ 671.771004][T30192] sctp: [Deprecated]: syz.3.6874 (pid 30192) Use of int in max_burst socket option deprecated. [ 671.771004][T30192] Use struct sctp_assoc_value instead [ 672.571340][T30217] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 672.652129][T30218] veth5: entered allmulticast mode [ 672.664014][T30208] hsr0 speed is unknown, defaulting to 1000 [ 672.959179][T30246] ICMPv6: Received fragmented ndisc packet. Carefully consider disabling suppress_frag_ndisc. [ 673.340560][T30267] syzkaller1: entered allmulticast mode [ 673.472077][T30277] netlink: 'syz.0.6900': attribute type 6 has an invalid length. [ 673.491846][T30273] syzkaller0: entered promiscuous mode [ 673.500889][T30273] syzkaller0: entered allmulticast mode [ 673.580564][T30273] tipc: Started in network mode [ 673.603129][T30273] tipc: Node identity bab54591e974, cluster identity 4711 [ 673.627493][T30273] tipc: Enabled bearer , priority 0 [ 673.652765][T30273] sch_tbf: burst 7 is lower than device syzkaller0 mtu (1514) ! [ 673.731214][T30292] __nla_validate_parse: 4 callbacks suppressed [ 673.731230][T30292] netlink: 18 bytes leftover after parsing attributes in process `syz.0.6903'. [ 673.766965][T30273] tipc: Resetting bearer [ 673.794978][T30272] tipc: Resetting bearer [ 673.857234][T30272] tipc: Disabling bearer [ 674.096570][T30318] netlink: 4 bytes leftover after parsing attributes in process `syz.3.6911'. [ 674.156121][T30318] veth0_macvtap: left promiscuous mode [ 674.466567][T30339] veth1_macvtap: left promiscuous mode [ 674.495329][T30342] netlink: 'syz.3.6919': attribute type 10 has an invalid length. [ 674.525219][T30339] netlink: 40 bytes leftover after parsing attributes in process `syz.4.6920'. [ 674.542441][T30345] netlink: 40 bytes leftover after parsing attributes in process `syz.0.6921'. [ 674.555993][T30349] netlink: 60 bytes leftover after parsing attributes in process `syz.3.6919'. [ 674.563530][T30339] netlink: 40 bytes leftover after parsing attributes in process `syz.4.6920'. [ 674.588625][T30348] netlink: 212376 bytes leftover after parsing attributes in process `syz.2.6922'. [ 674.627448][T30350] netlink: 212376 bytes leftover after parsing attributes in process `syz.2.6922'. [ 674.650188][T30355] netlink: 40 bytes leftover after parsing attributes in process `syz.3.6919'. [ 674.718777][T30342] bond0: (slave wlan1): Enslaving as an active interface with an up link [ 674.739225][T30348] ksmbd: Daemon and kernel module version mismatch. ksmbd: 124, kernel module: 1. User-space ksmbd should terminate. [ 674.874397][T30367] netlink: 64985 bytes leftover after parsing attributes in process `syz.3.6926'. [ 674.959589][T30370] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 675.213088][T30380] ip6gretap0: entered promiscuous mode [ 675.629071][T30401] sctp: [Deprecated]: syz.2.6939 (pid 30401) Use of int in max_burst socket option. [ 675.629071][T30401] Use struct sctp_assoc_value instead [ 675.761286][T30412] netlink: 'syz.3.6942': attribute type 10 has an invalid length. [ 675.808580][T30412] team0: Port device dummy0 added [ 676.231888][T30443] openvswitch: netlink: Tunnel attr 0 has unexpected len 16 expected 8 [ 676.568659][T30469] lo: entered promiscuous mode [ 676.579184][T30469] netlink: 'syz.4.6961': attribute type 2 has an invalid length. [ 676.608109][T30469] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 676.982277][T30503] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 676.989554][T30503] IPv6: NLM_F_CREATE should be set when creating new route [ 677.190494][T30510] veth0_to_bridge: entered promiscuous mode [ 677.199894][T30510] veth0_to_bridge: entered allmulticast mode [ 677.200046][T30512] netlink: 'syz.3.6972': attribute type 1 has an invalid length. [ 677.995333][T30560] netlink: 'syz.2.6988': attribute type 1 has an invalid length. [ 678.628795][T30598] syzkaller0: entered promiscuous mode [ 678.649641][T30598] syzkaller0: entered allmulticast mode [ 679.559059][T30655] __nla_validate_parse: 13 callbacks suppressed [ 679.559078][T30655] netlink: 8 bytes leftover after parsing attributes in process `syz.2.7011'. [ 679.596172][T30655] netlink: 12 bytes leftover after parsing attributes in process `syz.2.7011'. [ 679.619835][T30660] netlink: 28 bytes leftover after parsing attributes in process `syz.0.7010'. [ 679.626358][T30655] netlink: 8 bytes leftover after parsing attributes in process `syz.2.7011'. [ 679.638141][T30655] netlink: 12 bytes leftover after parsing attributes in process `syz.2.7011'. [ 679.646855][T11984] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 679.667877][T11984] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 679.685463][T11984] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 679.700511][T11984] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 679.801459][T30674] netlink: 8 bytes leftover after parsing attributes in process `syz.0.7017'. [ 679.830327][T30674] netlink: 'syz.0.7017': attribute type 1 has an invalid length. [ 679.838727][T30674] netlink: 'syz.0.7017': attribute type 2 has an invalid length. [ 679.942695][T30679] skbuff: bad partial csum: csum=65489/0 headroom=64 headlen=65491 [ 680.163847][T26729] Bluetooth: hci2: command 0x0405 tx timeout [ 680.339287][T30706] netlink: 60 bytes leftover after parsing attributes in process `syz.4.7029'. [ 680.455221][T30657] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 680.861745][T30740] netlink: 'syz.3.7035': attribute type 7 has an invalid length. [ 680.882481][T30743] netlink: 212408 bytes leftover after parsing attributes in process `syz.1.7036'. [ 680.892895][T30740] : entered promiscuous mode [ 680.901713][T30740] netlink: 8 bytes leftover after parsing attributes in process `syz.3.7035'. [ 680.907207][T30743] netlink: zone id is out of range [ 680.923804][T30743] netlink: get zone limit has 8 unknown bytes [ 680.979553][T30747] netlink: 4 bytes leftover after parsing attributes in process `syz.2.7037'. [ 680.997919][T30747] netlink: 'syz.2.7037': attribute type 3 has an invalid length. [ 681.265892][T30769] openvswitch: netlink: IP tunnel dst address not specified [ 681.343238][T30773] bridge_slave_1: left allmulticast mode [ 681.352391][T30773] bridge_slave_1: left promiscuous mode [ 681.396052][T30773] bridge0: port 2(bridge_slave_1) entered disabled state [ 681.421222][T30773] bridge_slave_0: left allmulticast mode [ 681.427599][T30773] bridge_slave_0: left promiscuous mode [ 681.433507][T30773] bridge0: port 1(bridge_slave_0) entered disabled state [ 681.539439][T30771] veth0_to_bridge: entered promiscuous mode [ 681.546386][T30771] veth0_to_bridge: left promiscuous mode [ 681.562891][T30785] geneve2: entered promiscuous mode [ 681.578546][T30785] geneve2: entered allmulticast mode [ 681.612825][ T3532] netdevsim netdevsim2 netdevsim0: set [1, 1] type 2 family 0 port 19999 - 0 [ 681.633256][ T3532] netdevsim netdevsim2 netdevsim1: set [1, 1] type 2 family 0 port 19999 - 0 [ 681.740939][T30788] netdevsim netdevsim2 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 681.754580][T30788] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 681.798235][ T3532] netdevsim netdevsim2 netdevsim2: set [1, 1] type 2 family 0 port 19999 - 0 [ 681.841997][T30805] netlink: 'syz.0.7056': attribute type 12 has an invalid length. [ 682.146463][T30822] team0: Device gtp0 is of different type [ 682.180539][ T6007] IPVS: starting estimator thread 0... [ 682.273909][T30828] IPVS: using max 29 ests per chain, 69600 per kthread [ 682.490265][ T5864] Bluetooth: hci0: Opcode 0x0c03 failed: -110 [ 682.766601][T30870] Bluetooth: MGMT ver 1.23 [ 683.119340][T30889] netlink: 'syz.0.7077': attribute type 1 has an invalid length. [ 683.258061][T30901] bond1: (slave bridge0): making interface the new active one [ 683.266319][T30901] bond1: (slave bridge0): Enslaving as an active interface with an up link [ 683.432135][T30788] netdevsim netdevsim2 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 683.462805][T30788] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 683.492423][T30788] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 1] type 2 family 0 port 19999 - 0 [ 683.692014][T30788] netdevsim netdevsim2 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 683.720761][T30788] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 683.734981][T30788] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 1] type 2 family 0 port 19999 - 0 [ 683.959270][T30788] netdevsim netdevsim2 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 683.988545][T30788] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 684.027903][T30788] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 1] type 2 family 0 port 19999 - 0 [ 684.227283][T23923] netdevsim netdevsim2 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 684.247952][T23923] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 19999 - 0 [ 684.267238][T23923] netdevsim netdevsim2 eth0: set [1, 1] type 2 family 0 port 6081 - 0 [ 684.276378][T30967] openvswitch: netlink: IP tunnel attribute has 8 unknown bytes. [ 684.382862][T11989] netdevsim netdevsim2 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 684.396684][T11989] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 19999 - 0 [ 684.407418][T11989] netdevsim netdevsim2 eth1: set [1, 1] type 2 family 0 port 6081 - 0 [ 684.468371][T11984] netdevsim netdevsim2 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 684.494109][T11984] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 19999 - 0 [ 684.502472][T11984] netdevsim netdevsim2 eth2: set [1, 1] type 2 family 0 port 6081 - 0 [ 684.605176][T11990] netdevsim netdevsim2 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 684.630831][T11990] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 19999 - 0 [ 684.659275][T11990] netdevsim netdevsim2 eth3: set [1, 1] type 2 family 0 port 6081 - 0 [ 684.788712][T30995] netlink: 'syz.2.7108': attribute type 12 has an invalid length. [ 684.801216][T30995] (unnamed net_device) (uninitialized): option primary_reselect: invalid value (255) [ 684.804760][ T5864] Bluetooth: hci2: Opcode 0x0401 failed: -110 [ 684.814723][T23678] Bluetooth: hci2: command 0x0405 tx timeout [ 684.924351][T31004] __nla_validate_parse: 15 callbacks suppressed [ 684.924367][T31004] netlink: 224 bytes leftover after parsing attributes in process `syz.1.7110'. [ 684.976824][T31008] netlink: 212376 bytes leftover after parsing attributes in process `syz.4.7111'. [ 684.979924][T31004] tls_set_device_offload_rx: netdev not found [ 685.113078][T31015] netlink: 24 bytes leftover after parsing attributes in process `syz.0.7115'. [ 685.185978][T31022] netlink: 16 bytes leftover after parsing attributes in process `syz.1.7117'. [ 685.436467][T31038] netlink: 191164 bytes leftover after parsing attributes in process `syz.0.7122'. [ 685.498251][T31043] netlink: 16 bytes leftover after parsing attributes in process `syz.4.7121'. [ 685.638738][T31051] nft_compat: unsupported protocol 0 [ 685.817133][T31060] openvswitch: netlink: Actions may not be safe on all matching packets [ 685.861460][T31061] netlink: 12 bytes leftover after parsing attributes in process `syz.1.7130'. [ 685.874265][T31060] syz_tun: entered allmulticast mode [ 685.887536][T31060] dvmrp8: entered allmulticast mode [ 685.898115][T31060] syzkaller1: entered promiscuous mode [ 685.911771][T31060] syzkaller1: entered allmulticast mode [ 686.001246][T31059] syz_tun: left allmulticast mode [ 686.002001][T31074] nbd: must specify an index to disconnect [ 686.317998][T31093] netlink: 'syz.4.7141': attribute type 10 has an invalid length. [ 686.348894][T31093] netlink: 48 bytes leftover after parsing attributes in process `syz.4.7141'. [ 686.387165][T31098] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for gretap1 [ 686.420272][T31098] gretap1: default qdisc (pfifo_fast) fail, fallback to noqueue [ 686.428851][T31098] gretap1: entered promiscuous mode [ 686.434710][T31098] gretap1: entered allmulticast mode [ 686.529029][T31108] A link change request failed with some changes committed already. Interface bond0 may have been left with an inconsistent configuration, please check. [ 686.760808][T31126] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 686.770315][T31124] netlink: 60 bytes leftover after parsing attributes in process `syz.0.7150'. [ 686.800721][T31130] netlink: 216 bytes leftover after parsing attributes in process `syz.2.7152'. [ 686.955824][T31139] netlink: 'syz.0.7156': attribute type 6 has an invalid length. [ 686.981137][T31137] xfrm1: entered promiscuous mode [ 687.037316][T31139] netlink: 'syz.0.7156': attribute type 6 has an invalid length. [ 687.096682][T31139] netlink: 'syz.0.7156': attribute type 6 has an invalid length. [ 687.229038][T31161] netlink: 'syz.2.7162': attribute type 1 has an invalid length. [ 687.464187][T31169] netlink: 'syz.3.7165': attribute type 12 has an invalid length. [ 687.645471][T31174] block nbd2: server does not support multiple connections per device. [ 687.681110][T31174] block nbd2: shutting down sockets [ 687.790363][T31186] (unnamed net_device) (uninitialized): option use_carrier: invalid value (4) [ 687.992610][T31205] wg1: entered promiscuous mode [ 688.111773][T31215] gretap1: entered promiscuous mode [ 688.120207][T31215] gretap1: entered allmulticast mode [ 688.137406][T31215] : renamed from veth0_vlan [ 688.405396][ T5864] Bluetooth: hci2: command 0x0405 tx timeout [ 688.429424][T31235] xt_policy: neither incoming nor outgoing policy selected [ 689.456788][T31287] netlink: 'syz.2.7199': attribute type 13 has an invalid length. [ 689.584540][T31287] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 689.708212][T31296] netlink: 'syz.0.7202': attribute type 4 has an invalid length. [ 689.836438][T31307] netlink: 'syz.2.7206': attribute type 3 has an invalid length. [ 690.290768][T31337] netlink: 'syz.1.7217': attribute type 4 has an invalid length. [ 690.301715][T31338] netlink: 'syz.1.7217': attribute type 4 has an invalid length. [ 690.481325][T31346] __nla_validate_parse: 27 callbacks suppressed [ 690.481343][T31346] netlink: 4 bytes leftover after parsing attributes in process `syz.1.7222'. [ 690.502332][T31346] syz_tun: left allmulticast mode [ 690.508729][T31346] syz_tun: left promiscuous mode [ 690.516561][T31346] bridge0: port 1(syz_tun) entered disabled state [ 690.573429][T31356] netlink: 8 bytes leftover after parsing attributes in process `syz.1.7222'. [ 690.640130][T31346] bond0: (slave bridge0): Releasing backup interface [ 690.711094][T31361] erspan0: entered allmulticast mode [ 690.771304][T31373] netlink: 168864 bytes leftover after parsing attributes in process `syz.0.7226'. [ 690.922353][T31382] netlink: 20 bytes leftover after parsing attributes in process `syz.1.7229'. [ 691.076795][T31386] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci2/hci2:200/input10 [ 691.111507][T31392] netlink: 36 bytes leftover after parsing attributes in process `syz.1.7233'. [ 691.518083][T31418] RDS: rds_bind could not find a transport for fe80::, load rds_tcp or rds_rdma? [ 691.709015][T31422] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 691.859478][T31439] netlink: 48 bytes leftover after parsing attributes in process `syz.3.7246'. [ 691.860194][T31437] syzkaller1: entered promiscuous mode [ 691.878839][T31437] syzkaller1: entered allmulticast mode [ 691.979505][T31440] validate_nla: 2 callbacks suppressed [ 691.979523][T31440] netlink: 'syz.3.7246': attribute type 1 has an invalid length. [ 692.194166][T31452] netlink: 8 bytes leftover after parsing attributes in process `syz.1.7249'. [ 692.272811][T31469] netlink: 212376 bytes leftover after parsing attributes in process `syz.0.7253'. [ 692.332512][T31473] netlink: 12 bytes leftover after parsing attributes in process `syz.2.7256'. [ 692.415204][T31480] netlink: 'syz.4.7255': attribute type 19 has an invalid length. [ 692.600365][T31491] netlink: 132 bytes leftover after parsing attributes in process `syz.1.7259'. [ 692.638536][T31493] netlink: 'syz.2.7260': attribute type 3 has an invalid length. [ 692.654654][T31493] openvswitch: netlink: ERSPAN option length err (len 256, max 255). [ 692.808662][T31503] openvswitch: netlink: Unexpected mask (mask=1040, allowed=10048) [ 693.027009][T31515] gre0: entered promiscuous mode [ 693.371839][T31530] tipc: Enabling of bearer rejected, failed to enable media [ 693.387460][T31530] tipc: Enabled bearer , priority 0 [ 693.441238][T31530] syzkaller0: entered promiscuous mode [ 693.459246][T31530] syzkaller0: entered allmulticast mode [ 693.479232][T31534] netlink: 'syz.4.7277': attribute type 7 has an invalid length. [ 693.516496][T31530] tipc: Resetting bearer [ 693.599213][T31529] tipc: Resetting bearer [ 693.664405][T31529] tipc: Disabling bearer [ 693.841947][T31556] openvswitch: netlink: IPv6 tunnel dst address is zero [ 693.997750][T31567] netlink: 'syz.4.7289': attribute type 39 has an invalid length. [ 693.999015][T31566] netlink: 'syz.4.7289': attribute type 39 has an invalid length. [ 694.404981][ T5956] IPVS: starting estimator thread 0... [ 694.409662][T31594] netlink: 'syz.4.7298': attribute type 7 has an invalid length. [ 694.428197][T31596] netlink: 'syz.0.7297': attribute type 1 has an invalid length. [ 694.479525][T31598] syzkaller1: entered promiscuous mode [ 694.492320][T31598] syzkaller1: entered allmulticast mode [ 694.513746][T31593] IPVS: using max 32 ests per chain, 76800 per kthread [ 694.975808][T31620] hsr0 speed is unknown, defaulting to 1000 [ 695.111799][T31638] netlink: 'syz.2.7313': attribute type 6 has an invalid length. [ 695.121720][T31638] netlink: 'syz.2.7313': attribute type 6 has an invalid length. [ 695.506092][T31662] __nla_validate_parse: 15 callbacks suppressed [ 695.506109][T31662] netlink: 12 bytes leftover after parsing attributes in process `syz.2.7319'. [ 695.635787][T31666] netlink: 8 bytes leftover after parsing attributes in process `syz.0.7320'. [ 695.654688][T31666] netlink: 4 bytes leftover after parsing attributes in process `syz.0.7320'. [ 695.714460][ T3532] netdevsim netdevsim0 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 695.730309][T31666] netlink: 8 bytes leftover after parsing attributes in process `syz.0.7320'. [ 695.750235][ T3532] netdevsim netdevsim0 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 695.814267][ T3532] netdevsim netdevsim0 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 695.823101][T31666] netlink: 4 bytes leftover after parsing attributes in process `syz.0.7320'. [ 695.846586][ T3532] netdevsim netdevsim0 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 695.896416][T31687] netlink: 4 bytes leftover after parsing attributes in process `syz.2.7325'. [ 696.135870][T31701] netlink: 4 bytes leftover after parsing attributes in process `syz.3.7326'. [ 696.145743][ T3532] nci: nci_rx_work: unknown MT 0x1 [ 696.172610][T31704] netlink: 28 bytes leftover after parsing attributes in process `syz.2.7329'. [ 696.740018][T31740] syzkaller0: entered promiscuous mode [ 696.745644][T31740] syzkaller0: entered allmulticast mode [ 697.289773][T31765] netlink: 32 bytes leftover after parsing attributes in process `syz.1.7347'. [ 697.380168][T31769] netlink: 32 bytes leftover after parsing attributes in process `syz.1.7347'. [ 697.819636][T31805] : renamed from bridge_slave_0 (while UP) [ 697.875762][T31808] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 698.666248][T31829] bridge0: port 1(bridge_slave_0) entered disabled state [ 698.882676][T31829] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 698.898915][T31829] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 699.138077][T31865] (unnamed net_device) (uninitialized): option lacp_active: mode dependency failed, not supported in mode balance-rr(0) [ 699.203903][T11984] netdevsim netdevsim4 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 699.250831][T11984] netdevsim netdevsim4 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 699.293087][T11984] netdevsim netdevsim4 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 699.352936][T11984] netdevsim netdevsim4 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 699.384212][T31880] IPVS: set_ctl: invalid protocol: 43 172.30.0.1:20000 [ 699.491735][T31891] hsr0 speed is unknown, defaulting to 1000 [ 699.563428][T31890] hsr0 speed is unknown, defaulting to 1000 [ 700.262154][T31929] openvswitch: netlink: Flow key attribute not present in set flow. [ 700.355233][T31936] nbd: must specify a device to reconfigure [ 700.605466][T31945] __nla_validate_parse: 5 callbacks suppressed [ 700.605483][T31945] netlink: 8 bytes leftover after parsing attributes in process `syz.4.7398'. [ 700.681424][T31953] validate_nla: 96 callbacks suppressed [ 700.681442][T31953] netlink: 'syz.1.7402': attribute type 29 has an invalid length. [ 700.725312][T31953] netlink: 8 bytes leftover after parsing attributes in process `syz.1.7402'. [ 700.733158][T31960] IPv6: NLM_F_CREATE should be specified when creating new route [ 700.746093][T31953] netlink: 'syz.1.7402': attribute type 29 has an invalid length. [ 700.764753][T31953] netlink: 8 bytes leftover after parsing attributes in process `syz.1.7402'. [ 700.792149][T31953] netlink: 'syz.1.7402': attribute type 24 has an invalid length. [ 700.880885][T31965] netlink: 212408 bytes leftover after parsing attributes in process `syz.1.7402'. [ 701.111125][T31983] netlink: 16 bytes leftover after parsing attributes in process `syz.0.7412'. [ 701.377710][T32002] netlink: 4 bytes leftover after parsing attributes in process `syz.1.7414'. [ 701.388275][T32003] netlink: 36 bytes leftover after parsing attributes in process `syz.2.7415'. [ 701.419297][T32002] netlink: 12 bytes leftover after parsing attributes in process `syz.1.7414'. [ 701.468884][T32010] netlink: 4 bytes leftover after parsing attributes in process `syz.2.7415'. [ 701.565039][T32016] netlink: 48 bytes leftover after parsing attributes in process `syz.4.7417'. [ 701.760816][T32028] netlink: 'syz.1.7422': attribute type 1 has an invalid length. [ 701.992045][T32028] 8021q: adding VLAN 0 to HW filter on device bond5 [ 702.043547][T32040] 8021q: adding VLAN 0 to HW filter on device bond5 [ 702.060437][T32040] bond5: (slave vxcan3): The slave device specified does not support setting the MAC address [ 702.073485][T32040] bond5: (slave vxcan3): Error -95 calling set_mac_address [ 702.121012][T32043] veth5: entered promiscuous mode [ 702.138059][T32043] bond5: (slave veth5): Enslaving as an active interface with a down link [ 702.474011][T32075] pimreg3: entered allmulticast mode [ 702.619624][T32086] netlink: 'syz.0.7436': attribute type 10 has an invalid length. [ 702.698036][T32087] tipc: Enabled bearer , priority 0 [ 702.743994][T32087] syzkaller0: entered promiscuous mode [ 702.749491][T32087] syzkaller0: entered allmulticast mode [ 702.807531][T32095] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 702.995733][T32095] tipc: Resetting bearer [ 703.002877][T32085] tipc: Resetting bearer [ 703.080781][T32085] tipc: Disabling bearer [ 703.247586][T32121] netlink: 'syz.1.7451': attribute type 23 has an invalid length. [ 703.313283][T32125] tipc: Enabling of bearer rejected, failed to enable media [ 703.604272][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 703.617097][T32148] netlink: 'syz.2.7458': attribute type 2 has an invalid length. [ 703.626530][T32148] nbd: must specify at least one socket [ 703.650539][T32149] netlink: 'syz.0.7459': attribute type 3 has an invalid length. [ 703.869272][T32161] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 703.946748][T32166] openvswitch: netlink: Unexpected mask (mask=c0, allowed=10048) [ 704.789124][T32210] netdevsim netdevsim4: Direct firmware load for ..€ failed with error -2 [ 704.802844][T32210] netdevsim netdevsim4: Falling back to sysfs fallback for: ..€ [ 704.942923][T32217] sctp: [Deprecated]: syz.1.7476 (pid 32217) Use of int in max_burst socket option. [ 704.942923][T32217] Use struct sctp_assoc_value instead [ 704.980920][T32218] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci2/hci2:200/input11 [ 705.251250][T32234] netlink: 'syz.2.7481': attribute type 11 has an invalid length. [ 705.410634][T32239] hsr_slave_1 (unregistering): left promiscuous mode [ 705.880886][T32272] sctp: [Deprecated]: syz.0.7494 (pid 32272) Use of int in maxseg socket option. [ 705.880886][T32272] Use struct sctp_assoc_value instead [ 705.947629][T32274] tap0: tun_chr_ioctl cmd 2148553947 [ 706.003681][T32272] netlink: 'syz.0.7494': attribute type 5 has an invalid length. [ 706.027891][T32282] veth0: entered promiscuous mode [ 706.049525][T32282] veth0: left promiscuous mode [ 706.424813][T32304] __nla_validate_parse: 16 callbacks suppressed [ 706.424831][T32304] netlink: 152 bytes leftover after parsing attributes in process `syz.2.7503'. [ 707.194433][T32332] netlink: 348 bytes leftover after parsing attributes in process `syz.2.7511'. [ 707.351658][T32340] sctp: [Deprecated]: syz.1.7514 (pid 32340) Use of struct sctp_assoc_value in delayed_ack socket option. [ 707.351658][T32340] Use struct sctp_sack_info instead [ 707.495108][T32351] sch_tbf: burst 8 is lower than device ip6tnl0 mtu (1452) ! [ 707.545144][T32362] netlink: 8 bytes leftover after parsing attributes in process `syz.0.7517'. [ 707.545709][T11990] nci: nci_rx_work: unknown MT 0x1 [ 707.606416][T32353] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 707.850614][T32386] netlink: 'syz.0.7525': attribute type 12 has an invalid length. [ 707.895661][T32388] netlink: 'syz.0.7525': attribute type 12 has an invalid length. [ 708.061995][T32382] batman_adv: batadv0: Adding interface: ipvlan2 [ 708.085599][T32382] batman_adv: batadv0: The MTU of interface ipvlan2 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 708.183750][T32382] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 708.291979][T32382] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 708.312347][T32382] batman_adv: batadv0: Not using interface ipvlan2 (retrying later): interface not active [ 708.345971][T32401] syzkaller1: entered promiscuous mode [ 708.352898][T32401] syzkaller1: entered allmulticast mode [ 708.922294][T32431] netlink: 8 bytes leftover after parsing attributes in process `syz.3.7536'. [ 709.336736][T32464] netlink: 20 bytes leftover after parsing attributes in process `syz.1.7540'. [ 710.780036][T32454] netlink: 12 bytes leftover after parsing attributes in process `syz.1.7540'. [ 710.911908][T32473] netlink: 64 bytes leftover after parsing attributes in process `syz.0.7548'. [ 710.927488][T32474] netlink: 'syz.4.7546': attribute type 1 has an invalid length. [ 710.935951][T32474] netlink: 'syz.4.7546': attribute type 1 has an invalid length. [ 711.259212][T32494] hsr0 speed is unknown, defaulting to 1000 [ 711.343498][T32501] netlink: 8 bytes leftover after parsing attributes in process `syz.3.7557'. [ 711.395233][T32504] netlink: 8 bytes leftover after parsing attributes in process `syz.3.7557'. [ 711.409224][T32501] (unnamed net_device) (uninitialized): option xmit_hash_policy: invalid value (64) [ 711.450101][T32504] (unnamed net_device) (uninitialized): option xmit_hash_policy: invalid value (64) [ 711.820317][T32526] netlink: 16 bytes leftover after parsing attributes in process `syz.1.7565'. [ 711.832382][T32527] netlink: 16 bytes leftover after parsing attributes in process `syz.1.7565'. [ 711.833093][T32536] openvswitch: netlink: Missing key (keys=40, expected=200000) [ 711.980878][T32539] netlink: 152 bytes leftover after parsing attributes in process `syz.0.7568'. [ 712.002557][T32539] 8021q: VLANs not supported on ip6tnl0 [ 712.597972][T32580] netlink: 1216 bytes leftover after parsing attributes in process `syz.1.7584'. [ 712.657841][T32585] veth0: entered promiscuous mode [ 712.687330][T32583] syzkaller0: entered promiscuous mode [ 712.692816][T32583] syzkaller0: entered allmulticast mode [ 712.700140][T32590] netlink: 84 bytes leftover after parsing attributes in process `syz.3.7587'. [ 712.729372][T32585] netlink: 48 bytes leftover after parsing attributes in process `syz.2.7589'. [ 712.844963][T32600] netlink: 148 bytes leftover after parsing attributes in process `syz.3.7592'. [ 712.862988][T32600] openvswitch: netlink: VXLAN extension 173 out of range max 1 [ 712.943066][T32585] veth0: left promiscuous mode [ 713.040459][T32609] netlink: 52 bytes leftover after parsing attributes in process `syz.0.7594'. [ 713.070386][T32611] veth0: entered promiscuous mode [ 713.080531][T32611] netlink: 4 bytes leftover after parsing attributes in process `syz.4.7597'. [ 713.167203][T32611] veth0 (unregistering): left promiscuous mode [ 713.299623][T32624] netlink: 8 bytes leftover after parsing attributes in process `syz.2.7602'. [ 713.367873][T23678] Bluetooth: hci5: command 0x0406 tx timeout [ 713.520214][T32639] netlink: 'syz.3.7607': attribute type 21 has an invalid length. [ 713.926868][T32665] tipc: Enabled bearer , priority 0 [ 714.093527][T32665] syzkaller0: entered promiscuous mode [ 714.110573][T32665] syzkaller0: entered allmulticast mode [ 714.124542][T32665] tipc: Resetting bearer [ 714.140979][T32664] tipc: Resetting bearer [ 714.338661][T32688] RDS: rds_bind could not find a transport for fe80::, load rds_tcp or rds_rdma? [ 715.918570][T32664] tipc: Disabling bearer [ 716.120178][T32701] bond0: entered promiscuous mode [ 716.133339][T32701] bond0: left promiscuous mode [ 716.579122][T32740] tipc: Enabled bearer , priority 0 [ 716.602512][T32740] syzkaller0: entered promiscuous mode [ 716.610084][T32740] syzkaller0: entered allmulticast mode [ 716.647929][T32740] bridge0: port 1(bridge_slave_0) entered disabled state [ 716.662999][T32740] bridge0: port 2(bridge_slave_1) entered disabled state [ 716.675464][T32748] netlink: 'syz.2.7641': attribute type 16 has an invalid length. [ 716.705458][T32748] netlink: 'syz.2.7641': attribute type 17 has an invalid length. [ 716.761508][T32740] tipc: Resetting bearer [ 716.769660][T32740] tipc: Resetting bearer [ 716.912346][T32748] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 716.985462][T32762] __nla_validate_parse: 14 callbacks suppressed [ 716.985488][T32762] netlink: 24 bytes leftover after parsing attributes in process `syz.1.7647'. [ 717.185806][T32750] tipc: Resetting bearer [ 717.287123][ T5864] block nbd2: Receive control failed (result -32) [ 717.312908][ T316] openvswitch: netlink: Key 0 has unexpected len 4 expected 0 [ 717.434276][T32737] tipc: Resetting bearer [ 717.491509][T32737] tipc: Disabling bearer [ 717.600635][ T316] hsr0 speed is unknown, defaulting to 1000 [ 717.902956][ T340] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 717.948234][ T346] pim6reg1: entered promiscuous mode [ 717.973753][ T346] pim6reg1: entered allmulticast mode [ 718.707854][ T378] netlink: 4 bytes leftover after parsing attributes in process `syz.1.7669'. [ 719.030690][ T397] netlink: 'syz.3.7673': attribute type 1 has an invalid length. [ 719.417492][ T421] netlink: 16 bytes leftover after parsing attributes in process `syz.3.7678'. [ 719.426693][ T421] netlink: 16 bytes leftover after parsing attributes in process `syz.3.7678'. [ 719.560773][ T421] netlink: 12 bytes leftover after parsing attributes in process `syz.3.7678'. [ 719.570925][ T421] netlink: 12 bytes leftover after parsing attributes in process `syz.3.7678'. [ 719.785204][ T434] netlink: 4 bytes leftover after parsing attributes in process `syz.3.7680'. [ 720.048172][ T453] netlink: 96 bytes leftover after parsing attributes in process `syz.0.7685'. [ 720.189005][ T459] netlink: 4 bytes leftover after parsing attributes in process `syz.3.7688'. [ 720.348437][ T461] netlink: 4 bytes leftover after parsing attributes in process `syz.0.7690'. [ 720.670930][ T486] Unsupported ieee802154 address type: 0 [ 720.773289][ T492] tipc: Enabled bearer , priority 0 [ 720.792698][ T492] syzkaller0: entered promiscuous mode [ 720.802260][ T492] syzkaller0: entered allmulticast mode [ 720.826107][ T495] openvswitch: netlink: Duplicate or invalid key (type 0). [ 720.830315][ T492] tipc: Resetting bearer [ 720.841295][ T494] openvswitch: netlink: Duplicate or invalid key (type 0). [ 720.848577][ T495] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 720.862242][ T491] tipc: Resetting bearer [ 720.868708][ T494] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 720.979975][ T491] tipc: Disabling bearer [ 721.387759][ T508] hsr0 speed is unknown, defaulting to 1000 [ 721.571521][ T510] syzkaller0: entered promiscuous mode [ 721.579363][ T510] syzkaller0: entered allmulticast mode [ 722.738646][ T539] __nla_validate_parse: 1 callbacks suppressed [ 722.738664][ T539] netlink: 20 bytes leftover after parsing attributes in process `syz.1.7711'. [ 724.735213][ T566] netlink: 72 bytes leftover after parsing attributes in process `syz.1.7718'. [ 724.747347][ T568] netlink: 12 bytes leftover after parsing attributes in process `syz.0.7719'. [ 724.759059][ T566] netlink: 72 bytes leftover after parsing attributes in process `syz.1.7718'. [ 724.789512][ T566] netlink: 'syz.1.7718': attribute type 4 has an invalid length. [ 724.818400][ T566] netlink: 17 bytes leftover after parsing attributes in process `syz.1.7718'. [ 724.875895][ T577] netlink: 'syz.4.7721': attribute type 1 has an invalid length. [ 724.895415][ T577] netlink: 'syz.4.7721': attribute type 2 has an invalid length. [ 724.976539][ T582] netlink: 48 bytes leftover after parsing attributes in process `syz.3.7723'. [ 725.025726][ T584] netlink: 32 bytes leftover after parsing attributes in process `syz.0.7724'. [ 725.078879][ T590] netlink: 'syz.2.7726': attribute type 21 has an invalid length. [ 725.104199][ T590] netlink: 4 bytes leftover after parsing attributes in process `syz.2.7726'. [ 725.124252][ T590] netlink: 'syz.2.7726': attribute type 21 has an invalid length. [ 725.150187][ T590] netlink: 4 bytes leftover after parsing attributes in process `syz.2.7726'. [ 725.225693][ T599] wg1: entered promiscuous mode [ 725.239230][ T599] wg1: entered allmulticast mode [ 725.269332][ T601] netlink: 'syz.3.7728': attribute type 2 has an invalid length. [ 725.280293][ T601] netlink: 199836 bytes leftover after parsing attributes in process `syz.3.7728'. [ 725.323660][ T601] nbd: must specify a device to reconfigure [ 725.712925][ T629] netlink: 'syz.4.7739': attribute type 58 has an invalid length. [ 725.789378][ T639] netlink: 'syz.4.7739': attribute type 21 has an invalid length. [ 725.850093][ T639] netlink: 'syz.4.7739': attribute type 5 has an invalid length. [ 725.867321][ T644] netlink: 'syz.1.7742': attribute type 83 has an invalid length. [ 726.105895][ T650] [ 726.108249][ T650] ====================================================== [ 726.115257][ T650] WARNING: possible circular locking dependency detected [ 726.122265][ T650] syzkaller #0 Not tainted [ 726.126657][ T650] ------------------------------------------------------ [ 726.133653][ T650] syz.0.7745/650 is trying to acquire lock: [ 726.139521][ T650] ffff888025241988 (&q->elevator_lock){+.+.}-{4:4}, at: elevator_change+0x19b/0x450 [ 726.148904][ T650] [ 726.148904][ T650] but task is already holding lock: [ 726.156243][ T650] ffff888025241448 (&q->q_usage_counter(io)#53){++++}-{0:0}, at: elevator_change+0x180/0x450 [ 726.166416][ T650] [ 726.166416][ T650] which lock already depends on the new lock. [ 726.166416][ T650] [ 726.176808][ T650] [ 726.176808][ T650] the existing dependency chain (in reverse order) is: [ 726.185796][ T650] [ 726.185796][ T650] -> #6 (&q->q_usage_counter(io)#53){++++}-{0:0}: [ 726.194382][ T650] lock_acquire+0x120/0x360 [ 726.199390][ T650] blk_alloc_queue+0x538/0x620 [ 726.204657][ T650] __blk_mq_alloc_disk+0x15c/0x340 [ 726.210267][ T650] nbd_dev_add+0x46c/0xae0 [ 726.215191][ T650] nbd_init+0x168/0x1f0 [ 726.219848][ T650] do_one_initcall+0x233/0x820 [ 726.225115][ T650] do_initcall_level+0x104/0x190 [ 726.230559][ T650] do_initcalls+0x59/0xa0 [ 726.235389][ T650] kernel_init_freeable+0x334/0x4b0 [ 726.241090][ T650] kernel_init+0x1d/0x1d0 [ 726.245918][ T650] ret_from_fork+0x3fc/0x770 [ 726.251007][ T650] ret_from_fork_asm+0x1a/0x30 [ 726.256279][ T650] [ 726.256279][ T650] -> #5 (fs_reclaim){+.+.}-{0:0}: [ 726.263472][ T650] lock_acquire+0x120/0x360 [ 726.268483][ T650] fs_reclaim_acquire+0x72/0x100 [ 726.273926][ T650] kmem_cache_alloc_node_noprof+0x47/0x3c0 [ 726.280235][ T650] __alloc_skb+0x112/0x2d0 [ 726.285149][ T650] tcp_stream_alloc_skb+0x3d/0x340 [ 726.290764][ T650] tcp_sendmsg_locked+0xf38/0x5620 [ 726.296376][ T650] tcp_sendmsg+0x2f/0x50 [ 726.301120][ T650] __sock_sendmsg+0x19c/0x270 [ 726.306301][ T650] sock_write_iter+0x258/0x330 [ 726.311570][ T650] vfs_write+0x5c6/0xb30 [ 726.316320][ T650] ksys_write+0x145/0x250 [ 726.321155][ T650] do_syscall_64+0xfa/0x3b0 [ 726.326163][ T650] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 726.332561][ T650] [ 726.332561][ T650] -> #4 (sk_lock-AF_INET){+.+.}-{0:0}: [ 726.340190][ T650] lock_acquire+0x120/0x360 [ 726.345197][ T650] lock_sock_nested+0x48/0x100 [ 726.350460][ T650] inet_shutdown+0x6a/0x390 [ 726.355465][ T650] nbd_mark_nsock_dead+0x2e9/0x560 [ 726.361074][ T650] sock_shutdown+0x15e/0x260 [ 726.366164][ T650] nbd_config_put+0x342/0x790 [ 726.371356][ T650] nbd_genl_connect+0x167c/0x18f0 [ 726.376882][ T650] genl_family_rcv_msg_doit+0x212/0x300 [ 726.382931][ T650] genl_rcv_msg+0x60e/0x790 [ 726.387936][ T650] netlink_rcv_skb+0x208/0x470 [ 726.393203][ T650] genl_rcv+0x28/0x40 [ 726.397683][ T650] netlink_unicast+0x82f/0x9e0 [ 726.402946][ T650] netlink_sendmsg+0x805/0xb30 [ 726.408206][ T650] __sock_sendmsg+0x219/0x270 [ 726.413389][ T650] ____sys_sendmsg+0x505/0x830 [ 726.418654][ T650] ___sys_sendmsg+0x21f/0x2a0 [ 726.423830][ T650] __x64_sys_sendmsg+0x19b/0x260 [ 726.429266][ T650] do_syscall_64+0xfa/0x3b0 [ 726.434271][ T650] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 726.440672][ T650] [ 726.440672][ T650] -> #3 (&nsock->tx_lock){+.+.}-{4:4}: [ 726.448306][ T650] lock_acquire+0x120/0x360 [ 726.453319][ T650] __mutex_lock+0x187/0x1350 [ 726.458412][ T650] nbd_queue_rq+0x257/0xf10 [ 726.463430][ T650] blk_mq_dispatch_rq_list+0x4c0/0x1900 [ 726.469488][ T650] __blk_mq_sched_dispatch_requests+0xda4/0x1570 [ 726.476326][ T650] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 726.482812][ T650] blk_mq_run_hw_queue+0x348/0x4f0 [ 726.488430][ T650] blk_mq_dispatch_list+0xd0c/0xe00 [ 726.494134][ T650] blk_mq_flush_plug_list+0x469/0x550 [ 726.500018][ T650] __blk_flush_plug+0x3d3/0x4b0 [ 726.505376][ T650] __submit_bio+0x2d3/0x5a0 [ 726.510376][ T650] submit_bio_noacct_nocheck+0x4ab/0xb50 [ 726.516513][ T650] block_read_full_folio+0x599/0x830 [ 726.522301][ T650] filemap_read_folio+0x114/0x380 [ 726.527824][ T650] do_read_cache_folio+0x350/0x590 [ 726.533437][ T650] read_part_sector+0xb6/0x2b0 [ 726.538703][ T650] adfspart_check_ICS+0xa4/0xa50 [ 726.544145][ T650] bdev_disk_changed+0x75f/0x14b0 [ 726.549675][ T650] blkdev_get_whole+0x380/0x510 [ 726.555029][ T650] bdev_open+0x31e/0xd30 [ 726.559777][ T650] blkdev_open+0x3a8/0x510 [ 726.564699][ T650] do_dentry_open+0x953/0x13f0 [ 726.569966][ T650] vfs_open+0x3b/0x340 [ 726.574535][ T650] path_openat+0x2ee5/0x3830 [ 726.579627][ T650] do_filp_open+0x1fa/0x410 [ 726.584630][ T650] do_sys_openat2+0x121/0x1c0 [ 726.589808][ T650] __x64_sys_openat+0x138/0x170 [ 726.595164][ T650] do_syscall_64+0xfa/0x3b0 [ 726.600170][ T650] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 726.606561][ T650] [ 726.606561][ T650] -> #2 (&cmd->lock){+.+.}-{4:4}: [ 726.613754][ T650] lock_acquire+0x120/0x360 [ 726.618774][ T650] __mutex_lock+0x187/0x1350 [ 726.623862][ T650] nbd_queue_rq+0xc8/0xf10 [ 726.628785][ T650] blk_mq_dispatch_rq_list+0x4c0/0x1900 [ 726.634835][ T650] __blk_mq_sched_dispatch_requests+0xda4/0x1570 [ 726.641668][ T650] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 726.648155][ T650] blk_mq_run_hw_queue+0x348/0x4f0 [ 726.653767][ T650] blk_mq_dispatch_list+0xd0c/0xe00 [ 726.659466][ T650] blk_mq_flush_plug_list+0x469/0x550 [ 726.665349][ T650] __blk_flush_plug+0x3d3/0x4b0 [ 726.670707][ T650] __submit_bio+0x2d3/0x5a0 [ 726.675712][ T650] submit_bio_noacct_nocheck+0x4ab/0xb50 [ 726.681851][ T650] block_read_full_folio+0x599/0x830 [ 726.687638][ T650] filemap_read_folio+0x114/0x380 [ 726.693165][ T650] do_read_cache_folio+0x350/0x590 [ 726.698774][ T650] read_part_sector+0xb6/0x2b0 [ 726.704040][ T650] adfspart_check_ICS+0xa4/0xa50 [ 726.709482][ T650] bdev_disk_changed+0x75f/0x14b0 [ 726.715007][ T650] blkdev_get_whole+0x380/0x510 [ 726.720366][ T650] bdev_open+0x31e/0xd30 [ 726.725113][ T650] blkdev_open+0x3a8/0x510 [ 726.730029][ T650] do_dentry_open+0x953/0x13f0 [ 726.735290][ T650] vfs_open+0x3b/0x340 [ 726.739859][ T650] path_openat+0x2ee5/0x3830 [ 726.744949][ T650] do_filp_open+0x1fa/0x410 [ 726.749951][ T650] do_sys_openat2+0x121/0x1c0 [ 726.755128][ T650] __x64_sys_openat+0x138/0x170 [ 726.760482][ T650] do_syscall_64+0xfa/0x3b0 [ 726.765485][ T650] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 726.771878][ T650] [ 726.771878][ T650] -> #1 (set->srcu){.+.+}-{0:0}: [ 726.778985][ T650] lock_sync+0xba/0x160 [ 726.783653][ T650] __synchronize_srcu+0x96/0x3a0 [ 726.789101][ T650] elevator_switch+0x12b/0x640 [ 726.794372][ T650] elevator_change+0x2d4/0x450 [ 726.799638][ T650] elevator_set_default+0x186/0x260 [ 726.805338][ T650] blk_register_queue+0x34e/0x3f0 [ 726.810863][ T650] __add_disk+0x677/0xd50 [ 726.815690][ T650] add_disk_fwnode+0xfc/0x480 [ 726.820868][ T650] nbd_dev_add+0x717/0xae0 [ 726.825789][ T650] nbd_init+0x168/0x1f0 [ 726.830446][ T650] do_one_initcall+0x233/0x820 [ 726.835710][ T650] do_initcall_level+0x104/0x190 [ 726.841152][ T650] do_initcalls+0x59/0xa0 [ 726.845984][ T650] kernel_init_freeable+0x334/0x4b0 [ 726.851685][ T650] kernel_init+0x1d/0x1d0 [ 726.856514][ T650] ret_from_fork+0x3fc/0x770 [ 726.861604][ T650] ret_from_fork_asm+0x1a/0x30 [ 726.866870][ T650] [ 726.866870][ T650] -> #0 (&q->elevator_lock){+.+.}-{4:4}: [ 726.874676][ T650] validate_chain+0xb9b/0x2140 [ 726.879947][ T650] __lock_acquire+0xab9/0xd20 [ 726.885136][ T650] lock_acquire+0x120/0x360 [ 726.890157][ T650] __mutex_lock+0x187/0x1350 [ 726.895255][ T650] elevator_change+0x19b/0x450 [ 726.900527][ T650] elevator_set_none+0x42/0xb0 [ 726.905799][ T650] blk_mq_update_nr_hw_queues+0x598/0x1aa0 [ 726.912112][ T650] nbd_start_device+0x17f/0xb10 [ 726.917474][ T650] nbd_genl_connect+0x135b/0x18f0 [ 726.923010][ T650] genl_family_rcv_msg_doit+0x212/0x300 [ 726.929063][ T650] genl_rcv_msg+0x60e/0x790 [ 726.934073][ T650] netlink_rcv_skb+0x208/0x470 [ 726.939352][ T650] genl_rcv+0x28/0x40 [ 726.943838][ T650] netlink_unicast+0x82f/0x9e0 [ 726.949110][ T650] netlink_sendmsg+0x805/0xb30 [ 726.954374][ T650] __sock_sendmsg+0x219/0x270 [ 726.959557][ T650] ____sys_sendmsg+0x505/0x830 [ 726.964823][ T650] ___sys_sendmsg+0x21f/0x2a0 [ 726.970006][ T650] __x64_sys_sendmsg+0x19b/0x260 [ 726.975453][ T650] do_syscall_64+0xfa/0x3b0 [ 726.980460][ T650] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 726.986856][ T650] [ 726.986856][ T650] other info that might help us debug this: [ 726.986856][ T650] [ 726.997062][ T650] Chain exists of: [ 726.997062][ T650] &q->elevator_lock --> fs_reclaim --> &q->q_usage_counter(io)#53 [ 726.997062][ T650] [ 727.010784][ T650] Possible unsafe locking scenario: [ 727.010784][ T650] [ 727.018217][ T650] CPU0 CPU1 [ 727.023567][ T650] ---- ---- [ 727.028910][ T650] lock(&q->q_usage_counter(io)#53); [ 727.034270][ T650] lock(fs_reclaim); [ 727.040756][ T650] lock(&q->q_usage_counter(io)#53); [ 727.048634][ T650] lock(&q->elevator_lock); [ 727.053207][ T650] [ 727.053207][ T650] *** DEADLOCK *** [ 727.053207][ T650] [ 727.061328][ T650] 6 locks held by syz.0.7745/650: [ 727.066332][ T650] #0: ffffffff8f59e930 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 [ 727.074510][ T650] #1: ffffffff8f59e748 (genl_mutex){+.+.}-{4:4}, at: genl_rcv_msg+0x10d/0x790 [ 727.083466][ T650] #2: ffff88802524f988 (&set->update_nr_hwq_lock){++++}-{4:4}, at: blk_mq_update_nr_hw_queues+0xa7/0x1aa0 [ 727.094854][ T650] #3: ffff88802524f8d8 (&set->tag_list_lock){+.+.}-{4:4}, at: blk_mq_update_nr_hw_queues+0xba/0x1aa0 [ 727.105796][ T650] #4: ffff888025241448 (&q->q_usage_counter(io)#53){++++}-{0:0}, at: elevator_change+0x180/0x450 [ 727.116403][ T650] #5: ffff888025241480 (&q->q_usage_counter(queue)#37){+.+.}-{0:0}, at: elevator_change+0x180/0x450 [ 727.127276][ T650] [ 727.127276][ T650] stack backtrace: [ 727.133157][ T650] CPU: 1 UID: 0 PID: 650 Comm: syz.0.7745 Not tainted syzkaller #0 PREEMPT(full) [ 727.133177][ T650] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 727.133186][ T650] Call Trace: [ 727.133195][ T650] [ 727.133203][ T650] dump_stack_lvl+0x189/0x250 [ 727.133225][ T650] ? __pfx_dump_stack_lvl+0x10/0x10 [ 727.133241][ T650] ? __pfx__printk+0x10/0x10 [ 727.133260][ T650] ? print_lock_name+0xde/0x100 [ 727.133279][ T650] print_circular_bug+0x2ee/0x310 [ 727.133296][ T650] check_noncircular+0x134/0x160 [ 727.133312][ T650] validate_chain+0xb9b/0x2140 [ 727.133334][ T650] __lock_acquire+0xab9/0xd20 [ 727.133355][ T650] ? elevator_change+0x19b/0x450 [ 727.133373][ T650] lock_acquire+0x120/0x360 [ 727.133390][ T650] ? elevator_change+0x19b/0x450 [ 727.133412][ T650] __mutex_lock+0x187/0x1350 [ 727.133426][ T650] ? elevator_change+0x19b/0x450 [ 727.133444][ T650] ? xa_find_after+0xae/0x430 [ 727.133461][ T650] ? xa_find_after+0x402/0x430 [ 727.133475][ T650] ? elevator_change+0x19b/0x450 [ 727.133491][ T650] ? xa_find_after+0xae/0x430 [ 727.133506][ T650] ? __pfx___mutex_lock+0x10/0x10 [ 727.133521][ T650] ? __pfx_blk_mq_cancel_work_sync+0x10/0x10 [ 727.133538][ T650] elevator_change+0x19b/0x450 [ 727.133556][ T650] ? elevator_set_none+0x37/0xb0 [ 727.133578][ T650] elevator_set_none+0x42/0xb0 [ 727.133597][ T650] blk_mq_update_nr_hw_queues+0x598/0x1aa0 [ 727.133618][ T650] ? __pfx_blk_mq_update_nr_hw_queues+0x10/0x10 [ 727.133639][ T650] ? sysfs_add_file_mode_ns+0x259/0x300 [ 727.133662][ T650] nbd_start_device+0x17f/0xb10 [ 727.133683][ T650] ? device_create_file+0xf4/0x1c0 [ 727.133698][ T650] nbd_genl_connect+0x135b/0x18f0 [ 727.133720][ T650] ? __pfx_nbd_genl_connect+0x10/0x10 [ 727.133742][ T650] ? __nla_parse+0x40/0x60 [ 727.133762][ T650] ? genl_family_rcv_msg_attrs_parse+0x1c9/0x2a0 [ 727.133782][ T650] genl_family_rcv_msg_doit+0x212/0x300 [ 727.133801][ T650] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 727.133822][ T650] ? stack_trace_save+0x9c/0xe0 [ 727.133839][ T650] genl_rcv_msg+0x60e/0x790 [ 727.133862][ T650] ? __pfx_genl_rcv_msg+0x10/0x10 [ 727.133877][ T650] ? __pfx_nbd_genl_connect+0x10/0x10 [ 727.133899][ T650] netlink_rcv_skb+0x208/0x470 [ 727.133917][ T650] ? __lock_acquire+0xab9/0xd20 [ 727.133935][ T650] ? __pfx_genl_rcv_msg+0x10/0x10 [ 727.133950][ T650] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 727.133976][ T650] ? down_read+0x1ad/0x2e0 [ 727.133990][ T650] genl_rcv+0x28/0x40 [ 727.134004][ T650] netlink_unicast+0x82f/0x9e0 [ 727.134029][ T650] ? __pfx_netlink_unicast+0x10/0x10 [ 727.134046][ T650] ? netlink_sendmsg+0x642/0xb30 [ 727.134058][ T650] ? skb_put+0x11b/0x210 [ 727.134073][ T650] netlink_sendmsg+0x805/0xb30 [ 727.134089][ T650] ? __pfx_netlink_sendmsg+0x10/0x10 [ 727.134108][ T650] ? aa_sock_msg_perm+0xf1/0x1d0 [ 727.134123][ T650] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 727.134138][ T650] ? __pfx_netlink_sendmsg+0x10/0x10 [ 727.134151][ T650] __sock_sendmsg+0x219/0x270 [ 727.134169][ T650] ____sys_sendmsg+0x505/0x830 [ 727.134185][ T650] ? __pfx_____sys_sendmsg+0x10/0x10 [ 727.134203][ T650] ? import_iovec+0x74/0xa0 [ 727.134219][ T650] ___sys_sendmsg+0x21f/0x2a0 [ 727.134235][ T650] ? __pfx____sys_sendmsg+0x10/0x10 [ 727.134261][ T650] ? __fget_files+0x2a/0x420 [ 727.134273][ T650] ? __fget_files+0x3a0/0x420 [ 727.134289][ T650] __x64_sys_sendmsg+0x19b/0x260 [ 727.134304][ T650] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 727.134322][ T650] ? rcu_is_watching+0x15/0xb0 [ 727.134338][ T650] ? do_syscall_64+0xbe/0x3b0 [ 727.134353][ T650] do_syscall_64+0xfa/0x3b0 [ 727.134366][ T650] ? lockdep_hardirqs_on+0x9c/0x150 [ 727.134384][ T650] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 727.134398][ T650] ? clear_bhb_loop+0x60/0xb0 [ 727.134413][ T650] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 727.134427][ T650] RIP: 0033:0x7fca3eb8eba9 [ 727.134441][ T650] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 727.134454][ T650] RSP: 002b:00007fca3fa23038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 727.134470][ T650] RAX: ffffffffffffffda RBX: 00007fca3edd5fa0 RCX: 00007fca3eb8eba9 [ 727.134481][ T650] RDX: 0000000020000000 RSI: 0000200000001ac0 RDI: 0000000000000004 [ 727.134490][ T650] RBP: 00007fca3ec11e19 R08: 0000000000000000 R09: 0000000000000000 [ 727.134500][ T650] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 727.134509][ T650] R13: 00007fca3edd6038 R14: 00007fca3edd5fa0 R15: 00007ffe68aeb878 [ 727.134525][ T650] [ 727.610628][ T5864] block nbd4: Receive control failed (result -32) [ 727.610632][T23678] block nbd4: Receive control failed (result -32) [ 727.644014][ T650] nbd4: detected capacity change from 0 to 127 [ 727.651557][ T647] ieee80211 phy78: Selected rate control algorithm 'minstrel_ht'