last executing test programs: 4m0.052312945s ago: executing program 1 (id=15359): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x275a, 0x0) ioctl$FS_IOC_SETFLAGS(r1, 0x40086602, &(0x7f0000000140)=0x80) mmap(&(0x7f0000002000/0x3000)=nil, 0x3000, 0x0, 0x12, r1, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000400)=ANY=[@ANYBLOB="5c0000001000030500"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000340012800e00010069703665727370616e0000002000028006000200300000001400060000000000000000000000ffff7f00000108000a00", @ANYBLOB="c986"], 0x5c}, 0x1, 0x0, 0x0, 0x20}, 0x0) 3m59.852585471s ago: executing program 1 (id=15363): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nfc(&(0x7f0000000b00), r0) sendmsg$NFC_CMD_DEV_DOWN(r0, &(0x7f0000000d00)={0x0, 0x0, &(0x7f0000000cc0)={&(0x7f0000000c40)={0x14, r1, 0x1, 0x70bd28, 0x25dfdbfb}, 0x14}, 0x1, 0x0, 0x0, 0x20000000}, 0x8000) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r3 = socket(0x400000000010, 0x3, 0x0) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$netlbl_calipso(&(0x7f0000000140), r5) sendmsg$NLBL_CALIPSO_C_REMOVE(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)={0x14, r6, 0x1, 0x70bd2c, 0x0, {0x3}}, 0x14}}, 0x0) sendmsg$NLBL_CALIPSO_C_LIST(r0, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000280)={&(0x7f0000000200)={0x34, r6, 0x100, 0x70bd29, 0x25dfdbfc, {}, [@NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_MTYPE={0x8}]}, 0x34}}, 0x40800) r7 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x100, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r8, {0xfff1, 0xfff1}, {0xffff, 0xffff}, {0xc, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x5}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x50}, 0x80) sendmsg$nl_route_sched(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=@newtfilter={0x30, 0x2c, 0xd27, 0x70bd28, 0x0, {0x0, 0x0, 0x0, r8, {0x5, 0x7}, {}, {0x7, 0xe}}, [@filter_kind_options=@f_fw={{0x7}, {0x4}}]}, 0x30}, 0x1, 0x0, 0x0, 0x84}, 0x8000) r9 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) sendmsg$RDMA_NLDEV_CMD_RES_CQ_GET(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={0x0}, 0x1, 0x0, 0x0, 0x8}, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r9, 0x8b30, &(0x7f0000000040)={'wlan0\x00'}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000440)=@delqdisc={0x24, 0x25, 0x300, 0x70bd2a, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, {0xa, 0xffe0}, {0x1, 0xd}, {0x4, 0x10}}}, 0x24}}, 0x20004055) ioctl$sock_SIOCGIFINDEX_80211(r9, 0x8b30, &(0x7f00000000c0)={'wlan0\x00'}) r10 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=@newtfilter={0x24, 0x2c, 0xd27, 0x70bd26, 0x6000000, {0x0, 0x0, 0x0, r11, {0xf2ff, 0x2}, {}, {0x7, 0xe}}}, 0x24}, 0x1, 0x0, 0x0, 0x8855}, 0x4000800) r12 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r12, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000540)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000030000000900010073797a300000000040000000030a03000000020000000000030000000900030073797a30000000000900010073797a300000000014000480080002406375fd82080001400000000028000000000a01040000000000000000030000000900010073797a3000000000080002400000000114000000110001"], 0xb0}}, 0x0) 3m59.578252991s ago: executing program 1 (id=15370): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000380)={'bridge_slave_0\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="700200001300290a000000000000000007000000", @ANYRES32=r2, @ANYRES8=r0], 0x270}, 0x1, 0x0, 0x0, 0x20008014}, 0x4) ioctl$XFS_IOC_START_COMMIT(r0, 0x80585882, &(0x7f0000000280)={0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r3, 0x8924, &(0x7f0000000300)={'wlan1\x00'}) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001140)={&(0x7f00000001c0)=@newlink={0x24, 0x10, 0x8, 0x70bd29, 0x25dfdbfd, {0x0, 0x0, 0x0, r2, 0xd802, 0x6230}, [@IFLA_VFINFO_LIST={0x4}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000000}, 0x48880) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), r1) sendmsg$NL80211_CMD_ADD_TX_TS(r1, &(0x7f0000000240)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x30, r4, 0x200, 0x70bd2c, 0x25dfdbfe, {{}, {@void, @void}}, [@NL80211_ATTR_TSID={0x5, 0xd2, 0xc}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_ADMITTED_TIME={0x6, 0xd4, 0x3}]}, 0x30}, 0x1, 0x0, 0x0, 0x400a0}, 0x400c0) 3m59.45999447s ago: executing program 1 (id=15373): r0 = syz_genetlink_get_family_id$ipvs(&(0x7f00000001c0), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IPVS_CMD_NEW_DAEMON(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="0100000000000000030009000000440003800800010002000000140002007663616e300000000000000000000000080003"], 0x58}}, 0x0) 3m59.403429625s ago: executing program 1 (id=15376): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000006c0)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd26, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xfff1}}, [@qdisc_kind_options=@q_prio={{0x9}, {0x18, 0x2, {0x8}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x4000000}, 0x20040084) r4 = socket$kcm(0x11, 0x3, 0x0) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r5) socket$unix(0x1, 0x2, 0x0) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000000140)={'syzkaller0\x00', @multicast}) r6 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000440)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000c00)=@newtfilter={0x4c, 0x2c, 0xd3f, 0x70bd24, 0x25dfdbfd, {0x0, 0x0, 0x0, r7, {0xfff3, 0xffe0}, {}, {0x7, 0x2}}, [@filter_kind_options=@f_bpf={{0x8}, {0x20, 0x2, [@TCA_BPF_OPS={{0x6, 0x4, 0x1}, {0xc, 0x5, [{0x6, 0xd, 0x9, 0x8}]}}, @TCA_BPF_FLAGS={0x8, 0x8, 0x1}]}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x8848}, 0x24000804) sendmsg$kcm(r4, &(0x7f00000000c0)={&(0x7f0000000500)=@xdp={0x2c, 0x7, r7, 0x3e}, 0x80, &(0x7f0000000200)=[{&(0x7f0000000180)='\'', 0x1}], 0x1}, 0x20004014) 3m59.162796494s ago: executing program 1 (id=15381): r0 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000002580)=[{&(0x7f0000000180)=ANY=[@ANYBLOB="1400000026000100000000000000000006"], 0x14}], 0x1}, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}}, 0x20004450) sendmsg$NFT_BATCH(r1, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWRULE={0x5c, 0x6, 0xa, 0x41f, 0x0, 0x0, {0xa, 0x0, 0x3}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_EXPRESSIONS={0x30, 0x4, 0x0, 0x1, [{0x2c, 0x1, 0x0, 0x1, @hash={{0x9}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_HASH_MODULUS={0x8, 0x4, 0x1, 0x0, 0xd}, @NFTA_HASH_DREG={0x8, 0x2, 0x1, 0x0, 0xf}, @NFTA_HASH_TYPE={0x8, 0x7, 0x1, 0x0, 0x1}]}}}]}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x84}, 0x1, 0x0, 0x0, 0x14040001}, 0x40488d0) r2 = socket$l2tp(0x2, 0x2, 0x73) r3 = socket$kcm(0x21, 0x2, 0x2) sendmsg$kcm(r3, &(0x7f0000000140)={&(0x7f0000000440)=@rxrpc=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x0, @loopback}}, 0x80, &(0x7f00000004c0)=[{&(0x7f0000000100)="a6", 0x1}, {0x0}], 0x2, &(0x7f0000000000)=ANY=[@ANYRESDEC=r2], 0x10b8}, 0x106) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r4, &(0x7f0000000100)=ANY=[], 0x32600) bind$llc(r4, &(0x7f00000000c0)={0x1a, 0x111, 0x3, 0x8, 0x5, 0x6, @random="af970ade78fe"}, 0x10) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r4, 0x0) recvmsg$kcm(r3, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x2) ioctl$BTRFS_IOC_SCRUB(r3, 0xc400941b, &(0x7f0000000880)={0x0, 0x2, 0x80, 0x1}) ioctl$FICLONE(r3, 0x40049409, r4) setsockopt$IPT_SO_SET_REPLACE(r2, 0x0, 0x40, &(0x7f0000000440)=@mangle={'mangle\x00', 0x44, 0x6, 0x3c0, 0x0, 0x1c8, 0x98, 0x0, 0x98, 0x328, 0x328, 0x328, 0x328, 0x328, 0x6, 0x0, {[{{@ip={@private=0xa010100, @dev={0xac, 0x14, 0x14, 0x13}, 0xff, 0xffffffff, 'pim6reg1\x00', 'bridge_slave_0\x00', {}, {0xff}, 0x88, 0x3}, 0x0, 0x70, 0x98}, @TTL={0x28, 'TTL\x00', 0x0, {0x1, 0x9}}}, {{@ip={@private=0xa010100, @local, 0x0, 0x0, 'wg2\x00', 'veth0_virt_wifi\x00', {}, {0xff}, 0x6}, 0x0, 0x70, 0x98}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0x70, 0x98}, @unspec=@CHECKSUM={0x28}}, {{@ip={@private=0xa010102, @multicast1, 0x0, 0xffffff00, 'syzkaller0\x00', 'bond0\x00'}, 0x0, 0xa0, 0xc8, 0x0, {}, [@common=@unspec=@realm={{0x30}, {0xd, 0x3, 0x1}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0x70, 0x98}, @ECN={0x28, 'ECN\x00', 0x0, {0x0, 0x2}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x420) sendmsg$AUDIT_SET_FEATURE(r4, &(0x7f0000000400)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x20, 0x3fa, 0x100, 0x70bd26, 0x25dfdbff, {0x1, 0x1}, ["", "", "", "", "", "", "", "", ""]}, 0x20}, 0x1, 0x0, 0x0, 0xc810}, 0x804) 3m44.099547953s ago: executing program 32 (id=15381): r0 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000002580)=[{&(0x7f0000000180)=ANY=[@ANYBLOB="1400000026000100000000000000000006"], 0x14}], 0x1}, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}}, 0x20004450) sendmsg$NFT_BATCH(r1, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWRULE={0x5c, 0x6, 0xa, 0x41f, 0x0, 0x0, {0xa, 0x0, 0x3}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_EXPRESSIONS={0x30, 0x4, 0x0, 0x1, [{0x2c, 0x1, 0x0, 0x1, @hash={{0x9}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_HASH_MODULUS={0x8, 0x4, 0x1, 0x0, 0xd}, @NFTA_HASH_DREG={0x8, 0x2, 0x1, 0x0, 0xf}, @NFTA_HASH_TYPE={0x8, 0x7, 0x1, 0x0, 0x1}]}}}]}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x84}, 0x1, 0x0, 0x0, 0x14040001}, 0x40488d0) r2 = socket$l2tp(0x2, 0x2, 0x73) r3 = socket$kcm(0x21, 0x2, 0x2) sendmsg$kcm(r3, &(0x7f0000000140)={&(0x7f0000000440)=@rxrpc=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x0, @loopback}}, 0x80, &(0x7f00000004c0)=[{&(0x7f0000000100)="a6", 0x1}, {0x0}], 0x2, &(0x7f0000000000)=ANY=[@ANYRESDEC=r2], 0x10b8}, 0x106) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r4, &(0x7f0000000100)=ANY=[], 0x32600) bind$llc(r4, &(0x7f00000000c0)={0x1a, 0x111, 0x3, 0x8, 0x5, 0x6, @random="af970ade78fe"}, 0x10) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r4, 0x0) recvmsg$kcm(r3, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x2) ioctl$BTRFS_IOC_SCRUB(r3, 0xc400941b, &(0x7f0000000880)={0x0, 0x2, 0x80, 0x1}) ioctl$FICLONE(r3, 0x40049409, r4) setsockopt$IPT_SO_SET_REPLACE(r2, 0x0, 0x40, &(0x7f0000000440)=@mangle={'mangle\x00', 0x44, 0x6, 0x3c0, 0x0, 0x1c8, 0x98, 0x0, 0x98, 0x328, 0x328, 0x328, 0x328, 0x328, 0x6, 0x0, {[{{@ip={@private=0xa010100, @dev={0xac, 0x14, 0x14, 0x13}, 0xff, 0xffffffff, 'pim6reg1\x00', 'bridge_slave_0\x00', {}, {0xff}, 0x88, 0x3}, 0x0, 0x70, 0x98}, @TTL={0x28, 'TTL\x00', 0x0, {0x1, 0x9}}}, {{@ip={@private=0xa010100, @local, 0x0, 0x0, 'wg2\x00', 'veth0_virt_wifi\x00', {}, {0xff}, 0x6}, 0x0, 0x70, 0x98}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0x70, 0x98}, @unspec=@CHECKSUM={0x28}}, {{@ip={@private=0xa010102, @multicast1, 0x0, 0xffffff00, 'syzkaller0\x00', 'bond0\x00'}, 0x0, 0xa0, 0xc8, 0x0, {}, [@common=@unspec=@realm={{0x30}, {0xd, 0x3, 0x1}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0x70, 0x98}, @ECN={0x28, 'ECN\x00', 0x0, {0x0, 0x2}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x420) sendmsg$AUDIT_SET_FEATURE(r4, &(0x7f0000000400)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x20, 0x3fa, 0x100, 0x70bd26, 0x25dfdbff, {0x1, 0x1}, ["", "", "", "", "", "", "", "", ""]}, 0x20}, 0x1, 0x0, 0x0, 0xc810}, 0x804) 2m39.744898482s ago: executing program 3 (id=16809): bind$inet6(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'seqiv(rfc4106(gcm(aes)))\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000009c0)="ad56b6c5820fae9d6dcd3292ea54c7be8bbdadbb1632ea5704cae881ef915d374c90c200", 0x24) r2 = accept4(r1, 0x0, 0x0, 0x800) sendmmsg$alg(r2, &(0x7f0000000c00)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000001080)=[@op={0x18, 0x117, 0x3, 0x1}, @assoc={0x18, 0x117, 0x4, 0x8}], 0x30, 0x40040}], 0x1, 0x40) sendmsg$RDMA_NLDEV_CMD_GET(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[], 0x38}}, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000200)={0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0x37}}, 0x10) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=@newqdisc={0x30, 0x24, 0x1, 0x70bd2d, 0x0, {0x60, 0x0, 0x0, r4, {0x0, 0xa}, {0xffff, 0xffff}, {0x0, 0xffe0}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x4}}]}, 0x30}, 0x1, 0x0, 0x0, 0x20080}, 0x44080) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000400)=@newqdisc={0x5c, 0x24, 0xd0f, 0x70bd2c, 0x25dfdbfb, {0x60, 0x0, 0x0, r4, {}, {0xffe0, 0xa}, {0xfff3, 0xe}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x2c, 0x2, [@TCA_CAKE_INGRESS={0x8}, @TCA_CAKE_ATM={0x8, 0x4, 0x1}, @TCA_CAKE_WASH={0x8}, @TCA_CAKE_NAT={0x8, 0xb, 0x1}, @TCA_CAKE_OVERHEAD={0x8, 0x6, 0x14}]}}]}, 0x5c}, 0x1, 0x0, 0x0, 0x55}, 0xc010) sendmsg$inet(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000380)="12", 0x1}], 0x1}, 0x40000) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r5, 0x29, 0x40, &(0x7f0000000000)=@filter={'filter\x00', 0x4, 0x4, 0x3e0, 0xffffffff, 0x1e8, 0xd0, 0xd0, 0xfeffffff, 0xffffffff, 0x310, 0x310, 0x310, 0xffffffff, 0x4, 0x0, {[{{@ipv6={@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @ipv4={'\x00', '\xff\xff', @loopback}, [0x47e128f2bce82ddb, 0xff], [0xff, 0xffffff00, 0xff, 0xffffff00], 'veth0_to_bond\x00', 'veth1_vlan\x00', {0xff}, {}, 0x6, 0x5, 0x1, 0x51}, 0x2f2, 0xa8, 0xd0}, @common=@inet=@SYNPROXY={0x28, 'SYNPROXY\x00', 0x0, {0x1, 0x3, 0x800}}}, {{@uncond, 0x0, 0xf0, 0x118, 0x0, {}, [@common=@hbh={{0x48}, {0x1, 0x4, 0x0, [0x4004, 0x5, 0x0, 0x5, 0x7, 0x7, 0x101, 0x3, 0x7ff, 0x50de, 0x4, 0x5, 0x1000, 0x4, 0xffff], 0xd}}]}, @REJECT={0x28, 'REJECT\x00', 0x0, {0x8}}}, {{@ipv6={@private0={0xfc, 0x0, '\x00', 0x1}, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, [0xff], [0x0, 0xff, 0x0, 0xffffff00], 'veth1_virt_wifi\x00', 'wlan1\x00', {}, {}, 0xae, 0xb, 0x6, 0x6}, 0x0, 0xf8, 0x128, 0x0, {}, [@common=@ipv6header={{0x28}, {0x25, 0x80}}, @common=@hl={{0x28}, {0x1, 0x5}}]}, @common=@inet=@SET2={0x30, 'SET\x00', 0x2, {{0x2001, 0x5, 0x1}, {0x4, 0x0, 0x6}, 0x6, 0x817e}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x440) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={0xffffffffffffffff, 0x0, 0x2100, 0x0, &(0x7f0000000100), 0x0, 0x1008, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x50) sendmsg$NFT_BATCH(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000500)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a74000000060a0904000000000000f3770200000048000480300001800e000100696d6d6564696174650000001c000280100002800c00028008000180fffffffb0800014000000000140001800d00010073796e70726f7879000000000900010073797a30000000000900020073797a320000000014000000110001"], 0x9c}}, 0x0) 2m38.916070952s ago: executing program 3 (id=16828): sendmsg$nl_route_sched_retired(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000580)=@delqdisc={0x3c, 0x25, 0x800, 0x70bd2d, 0x25dfdafe, {0x0, 0x0, 0x0, 0x0, {0xd}, {0x7, 0x9}, {0xd, 0xffe0}}, [@q_dsmark={{0xb}, {0xc, 0x2, [@TCA_DSMARK_INDICES={0x6, 0x1, 0x4}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4008044}, 0x0) (async, rerun: 64) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, &(0x7f0000004bc0)={0x0, 0x0, &(0x7f0000004b80)={&(0x7f0000000500)=ANY=[@ANYBLOB="a0000000", @ANYRES16, @ANYBLOB="050424bd7000fedbdf250100000008000100", @ANYRES32=0x0, @ANYBLOB="840002"], 0xa0}, 0x1, 0x0, 0x0, 0x4040800}, 0x24040084) (async, rerun: 64) r0 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3) getsockopt$bt_rfcomm_RFCOMM_LM(r0, 0x12, 0x3, &(0x7f0000000000), &(0x7f0000000040)=0x4) (async) r1 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000500)=ANY=[@ANYBLOB="180100002f00010000000000fcdbdf2507"], 0x118}], 0x1, 0x0, 0x0, 0x1}, 0x0) 2m36.719034352s ago: executing program 3 (id=16832): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000002c0)=@newqdisc={0x48, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x0, 0xa888, 0x0, 0x5000000}}]}}]}, 0x48}}, 0x0) (async) r0 = socket$netlink(0x10, 0x3, 0x0) (async) r1 = socket$kcm(0x29, 0x5, 0x0) (async) r2 = openat$nci(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r3) (async) ioctl$IOCTL_GET_NCIDEV_IDX(r2, 0x0, &(0x7f00000000c0)=0x0) sendmsg$NFC_CMD_DEV_UP(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r4, @ANYBLOB="010026bd7000fcdbdf250200000008000100", @ANYRES32=r5], 0x1c}}, 0x840) (async) sendmsg$kcm(r1, &(0x7f0000000d80)={&(0x7f0000000000)=@nfc_llcp={0x27, r5, 0xffffffffffffffff, 0x1, 0x7, 0xe7, "5410a32524e748c41d483ee5a61f9d9387f7b2e7efa9ee0853ce09e2af9beb69fc7d3595d3eb20b69803b8270748c55d3304900a9ea004b7002c8e5ed169be", 0x29}, 0x80, &(0x7f0000000240)=[{&(0x7f0000000080)="fda576c572e65adc2f61d17b444aedb7a8511e8c77636db66edf5e06a4b8e02fac4c6e9db3470412f4c96be1424401b8075299eb9e9b9a2aea7dc06de251ac618358656c9f5cccdaa9a923ac9a14576cecac82b4831d238d7cedc24db5a6", 0x5e}, {&(0x7f0000000100)="505af6cccb3277d4902f122819d8ed2cb5e7ea30f565784f505bc9d5ba4c46b0a714be61d35cf05463dbc0679fb60ae0b3d9318395572984c7d873db90371f17131d91bb7647", 0x46}, {&(0x7f0000000180)="fa8b83f6484800325396f406456768e6a7d80ab1d901058cd6531d7d8b073f9517204651e464c262f1a743c925ae7a295d53d1570b72f58100c903747044a3bd132bcb8fa3d2c8f6d9bb9e36a1ea8003fb31bd3bae02890768318b2de8b6a1cf2b0ee5c80db4c733c0f8df78ddb5c4a993cf2ffe7605b983618c68186d474acdcfa9e1", 0x83}], 0x3, &(0x7f0000000800)=[{0xe8, 0x3a, 0x9, "427c2daed7361051f1ff1cee53b97d7078bf2d1f86d3f43dc5d47ee8aca9efb3db77b3aed4d00cbb8fa2db2527a2c835822d48b226dab0bd813a3810af7fbfba20eb8356e964a34a5839cce583e1eb8bbb4ad9bae3797d901ef422fc758e3713450765b172efd7c693d95af288cdb713c3020b4aefc41cb42d4276ae947717872c024d073e21fab69c982d38913578a1117553cf52f23bfd41542fba49675e0bffc7bb2c49efced70b5a7070f0f2cda69040ee43bc0a3add28c8951456c72d2b2b5c323a558e9ef41e22058a8c091a866d22766bad"}, {0xa8, 0x10c, 0x5, "495624aeb4d365c748f0925fcd5eb2b1e79e39e125a1a5ec5d099dad41326a8367ac994d161a13c75f69b5d0887f88f25d01d1dbff18954e681a8b7ea281724d20f1401d2bc4fd98662320b0ad497d2534fec92e5cfff25d841efc58490586a96cee625cf5ff95776304864c2cda1b6101ff21a38ba8834f41e6f264b662434fcedd68ab5c1348e51dedeacecca5993bd2279c74"}, {0xf0, 0x11, 0x8, "4a1a6db9d461529a49bae88060b94b3fc38940a105ef79bc250b2aab01107d89edff4e5b5dbb047667b19dd09e44831d2428c6abb5d29be02321516c6284f437c966a837c7600656da9bf654709714975152b02274a5326ca82493fb648a6d7034e2253746237bf883279e3acc3692a2b50ada9a3a887016c50c0b111540daf6bb05833ea9abd7a7a16ef0d17ae250fe46954ff74f6b160cf3ce65950a9f508c7bb9af98b0d3640680c7d99503412071ad8033e9fef5e55f84f578df01d67456dd4d543274cfe7df607ec69c8c43a216d42f8a93fd34a95f2af99b28ef65d067"}, {0x18, 0xff, 0x37e, "e1b770"}, {0x108, 0x111, 0xd, "6bd37a76954d1749db4b48226ab133fcbfdc8e79a9809d9a0187882c4a073c23b87168cafe7ea92b245bd9dd6070646378e6935f7478bb9934189f7df4f7cf91f39bba1254376dce1067458bb7e9b52bc7550cc1eedc29ab43124fca738fc938cb1f2c8bafd97eb26f7ce453675ec02c299d1ca3e9d5f39a8b16766d348069f2698680f900c109a25666d260e49c1865818531cdc46295c32ded67e1e27f97b9668e38172b72c1ab298ac1a5abe8ec889a952c59a70127d10e1b8038873c0809e80fe00a06f6d65797b3c84a26cde60b3fce342608c5eb8d149a708dccbe88634ace760c9a3cdb23e0134ebc27896350f8"}, {0x38, 0x104, 0xfffffe01, "efccbfa5632abd00a508ab364b2fc86ea9cba2191cf89bc94be077374a3b80efd0"}, {0x98, 0x10a, 0x401, "1da4ae0bc370e54b832cff7dcbcfb0045c2da25657c82e49d7ae43562345912ce76311e5b95fbf41534e275f0a4262c53a2f11cc6b919e3657dc5b96fe0c95ac99855c0f29f2165eef15ef7a84a2e839095f910ac23ca6260aa2383151558f8cdd1ed1510737eda4a521c76cbf74f246f58136097ae976bdfb336d9a5d243343427dd8d40750"}, {0xe0, 0x10c, 0x3ff, "3fe451130805603ccc386ef58a14045f2677d43f7ab19514e19111df07c98e5731dffc4c19c5f02c8b039538eb4111fbbd8f02459bccbda2ea342b8ff71f428a8d1f6df049046012092da149bd3268d8eab6f20edf1710aaf0eaa4fd9095d025414eaaa21770fa46effcc0af5f17abb9468c5d73f81fb643ada96b34a056b11740d6fb28404c8274d17daa9a4a72bd316ee35a38809f2a8b76d160ab77c0346d0e02518cda35d6a065703a558b8530eb620e8c482018dfd77af6988695c2f7a0c27fc89b5be15c6ebe"}], 0x550}, 0x40000) sendmsg$nl_route(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000002c0)=ANY=[@ANYBLOB="480000001000810500"/20, @ANYRES32, @ANYBLOB="0000000000000000280012800a00010063616e"], 0x48}}, 0x0) 2m36.472939852s ago: executing program 3 (id=16839): r0 = bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000100), 0x4) bpf$TOKEN_CREATE(0x24, &(0x7f0000000000)={0x0, r0}, 0x8) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000240)={0xffffffffffffffff, 0x58, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0}}, 0x10) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=@base={0x1b, 0x5, 0xfff, 0x7, 0x0, 0xffffffffffffffff, 0x0, '\x00', r1}, 0x50) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000380)={0x1a, 0xf, &(0x7f0000000080)=@ringbuf={{}, {{0x18, 0x1, 0x1, 0x0, r2}}}, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x3c, '\x00', 0x0, 0x1c}, 0x94) 2m36.416437084s ago: executing program 3 (id=16840): setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0x34, 0x0, 0x0) listen(0xffffffffffffffff, 0xfffffffd) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r0, &(0x7f0000000340)=ANY=[@ANYBLOB="000086dd00000700000000000000600000000f982c00fe8000000000000000000000000000aaff02000000000000000000000000000104"], 0xfce) socket$inet_udp(0x2, 0x2, 0x0) 2m36.176627932s ago: executing program 3 (id=16843): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0xffd5, &(0x7f0000001ac0)={&(0x7f0000000240)={0x14, 0x26, 0x1, 0xf0bd26, 0x25dfdbfc, {0x3}}, 0x14}, 0x1, 0x0, 0x0, 0x20004000}, 0x4040090) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000180)={{0x1, 0xffffffffffffffff}, &(0x7f0000000100), &(0x7f0000000140)}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0xd, 0xa, &(0x7f0000001200)=@framed={{}, [@call={0x79, 0x11, 0xc8}, @tail_call={{0x18, 0x2, 0x1, 0x0, r1}}, @alu={0x7, 0x0, 0x5, 0x11, 0x3, 0x80, 0x8}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f0000000200)=""/4096, 0x0, 0x0, '\x00', 0x0, @sock_ops}, 0x94) 2m21.125450188s ago: executing program 33 (id=16843): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0xffd5, &(0x7f0000001ac0)={&(0x7f0000000240)={0x14, 0x26, 0x1, 0xf0bd26, 0x25dfdbfc, {0x3}}, 0x14}, 0x1, 0x0, 0x0, 0x20004000}, 0x4040090) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000180)={{0x1, 0xffffffffffffffff}, &(0x7f0000000100), &(0x7f0000000140)}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0xd, 0xa, &(0x7f0000001200)=@framed={{}, [@call={0x79, 0x11, 0xc8}, @tail_call={{0x18, 0x2, 0x1, 0x0, r1}}, @alu={0x7, 0x0, 0x5, 0x11, 0x3, 0x80, 0x8}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f0000000200)=""/4096, 0x0, 0x0, '\x00', 0x0, @sock_ops}, 0x94) 1m44.424380506s ago: executing program 6 (id=17810): bind$vsock_stream(0xffffffffffffffff, &(0x7f0000000040), 0x10) listen(0xffffffffffffffff, 0x0) r0 = socket(0x28, 0x5, 0x0) connect$vsock_stream(r0, &(0x7f0000000080), 0x10) r1 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_tx_ring(r1, 0x107, 0x5, &(0x7f00000000c0)=@req3={0x8000, 0x6, 0x8000, 0x6}, 0x1c) mmap(&(0x7f000000f000/0x4000)=nil, 0x4000, 0x2, 0x3032, 0xffffffffffffffff, 0x0) setsockopt$sock_linger(r0, 0x1, 0x3c, &(0x7f0000000180)={0x1, 0x5}, 0x8) sendmmsg(r0, &(0x7f0000000100)=[{{0x0, 0x0, &(0x7f0000000200)=[{}], 0x1}}], 0x1, 0x24008094) socket$nl_xfrm(0x10, 0x3, 0x6) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=ANY=[@ANYBLOB="3c010000190001000000000000000000fc02000000000000000000000000000000000000000000000000000000000000000000030000000002000020080000", @ANYRES32=0x0, @ANYBLOB="00000000000180000000020000000000fdffffffffffffff00000000000000000000000000000000000000000000000000000000000000001d00000000000000000000000000000000000000000000000000000000000000dd02000000000000000000004c850000000000000000000084000500ac14143b000000000000000000000000000000ed2b00000000000000ac14140c000000000000000000000000000000000000ff00000000000000000000000000fc020000000000000000000000000001000000003200000000000000000000000000000000000000000000de02350000000000002011c954"], 0x13c}}, 0x0) sendmsg$nl_xfrm(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000004c0)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x80ff, {{@in=@multicast1=0xe0000002, @in, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x87}, {0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x5, 0xfffffffffffffffb}, {0x0, 0x40000000000000, 0x200000000000000}, 0x2}}, 0xb8}, 0x1, 0x0, 0x0, 0x4000015}, 0x2c000010) 1m44.27697666s ago: executing program 6 (id=17814): r0 = socket(0x10, 0x803, 0x0) sendto(r0, 0x0, 0x0, 0x8804, 0x0, 0x0) syz_genetlink_get_family_id$fou(&(0x7f0000000200), r0) recvmmsg(r0, &(0x7f0000007d80)=[{{0x0, 0x0, &(0x7f0000000980)=[{&(0x7f0000000100)=""/59, 0x3b}, {&(0x7f0000000140)=""/126, 0x7e}, {&(0x7f0000000680)=""/135, 0x87}, {&(0x7f0000000f80)=""/4100, 0x1004}, {&(0x7f0000000480)=""/255, 0xff}, {&(0x7f00000002c0)=""/222, 0xde}, {&(0x7f0000000880)=""/247, 0xf7}, {&(0x7f0000000780)=""/210, 0xd2}, {&(0x7f0000000040)=""/32, 0x20}, {&(0x7f0000000e00)=""/113, 0x71}, {&(0x7f0000000000)=""/32, 0x20}], 0xb}, 0x10000fff}], 0x1, 0x0, 0x0) 1m44.020852255s ago: executing program 6 (id=17819): r0 = socket$inet6(0xa, 0x2, 0x3a) r1 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000040)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x2, '\x00', 0x0, 0xffffffffffffffff, 0x2, 0x2, 0x4}, 0x50) r2 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000400)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x4, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x3}, 0x50) bpf$MAP_DELETE_ELEM(0x3, &(0x7f00000008c0)={r2, &(0x7f0000000880)="4174d4cdb3a0672cfc073e6affe5e4722491c55589deac8924d235d3be17a8a0fc6a3b"}, 0x20) r3 = socket(0x2a, 0x2, 0x0) getsockname$packet(r3, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000001480)=0x14) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000001000)=@newqdisc={0x2c, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {}, {0xffff, 0xffff}, {0x0, 0xfff1}}, [@qdisc_kind_options=@q_qfg={0x8}]}, 0x2c}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000001800)=@newtfilter={0x48, 0x2c, 0x605, 0x70bd2a, 0x0, {0x0, 0x0, 0x0, r4, {0x0, 0xffe0}, {}, {0xffff, 0x2}}, [@filter_kind_options=@f_matchall={{0xd}, {0x14, 0x2, [@TCA_MATCHALL_FLAGS={0x8, 0x3, 0x2}, @TCA_MATCHALL_CLASSID={0x8}]}}]}, 0x48}}, 0x48c0) r5 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000580)={&(0x7f0000000780)=ANY=[@ANYBLOB="9feb01001800000000000000a8000000a8000000040000000200000001000006040000000f000000050000000400000000000008030000000700000000000007f50000000b00000003000084ed0700000500000002000000070000000600000005000000ff0700000100000004000000060000000c0000000000001101000000070000000a0000000000000b020000000f0000000000000b0200000000000000000000030000000002000000040000000000000002000000000000020400000000006100bb630daa4fd6d5ec12c284228b68eaa869720a09b45da5417ffc4a55a57dc86cd09ec7"], &(0x7f00000004c0)=""/184, 0xc4, 0xb8, 0x0, 0x3}, 0x28) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0200000004000000e27f000001"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x11, 0xc, &(0x7f0000000480)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r6, @ANYBLOB="0000000000000000b7080000134c2651638af8ff00000000bfa200000000000007020000fcffffffb703000008000000b704000000000000850000000300000095"], &(0x7f0000000e80)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000006c0)={0x6, 0x1e, &(0x7f0000000100)=@raw=[@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r1}}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r1}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x9}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x2}}, @tail_call={{0x18, 0x2, 0x1, 0x0, r1}}, @map_idx_val={0x18, 0x7, 0x6, 0x0, 0xe, 0x0, 0x0, 0x0, 0x10}, @tail_call={{0x18, 0x2, 0x1, 0x0, r0}}, @exit, @ringbuf_query={{0x18, 0x1, 0x1, 0x0, r1}}], &(0x7f0000000200)='syzkaller\x00', 0x80000000, 0x0, 0x0, 0x40f00, 0x10, '\x00', r4, 0x25, r5, 0x8, &(0x7f00000005c0)={0x5, 0x5}, 0x8, 0x10, &(0x7f0000000600)={0x1, 0xe, 0x654f, 0xff}, 0x10, 0x0, 0x0, 0x4, &(0x7f0000000640)=[r1, r1, r1, r1, r1, r1, r1, r6, r1], &(0x7f0000000680)=[{0x1, 0x3, 0x4, 0x6}, {0x1, 0x1, 0xe, 0x5}, {0x2, 0x3, 0x3, 0xb}, {0x4, 0x5, 0x7, 0x1}], 0x10, 0x3}, 0x94) ioctl$F2FS_IOC_PRECACHE_EXTENTS(r1, 0xf50f, 0x0) ioctl$sock_SIOCGIFVLAN_GET_VLAN_EGRESS_PRIORITY_CMD(r0, 0x8982, &(0x7f00000000c0)) sendmmsg$inet6(r0, &(0x7f00000003c0)=[{{&(0x7f0000000380)={0xa, 0x0, 0x0, @loopback, 0x20000}, 0x1c, &(0x7f0000000000)=[{&(0x7f0000000480)="a0002883781ecc0e", 0x8}], 0x1}}], 0x1, 0x40) 1m43.892907393s ago: executing program 6 (id=17824): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000040)={0x1f, 0xffff, 0x3}, 0x6) write(r1, &(0x7f0000000100)="520003000100b8", 0x7) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000010c0)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x3, 0x0, 0x0, {0x7}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x3c, 0x9, 0xa, 0x401, 0x0, 0x0, {0x7}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x21}]}, @NFT_MSG_NEWSETELEM={0x60, 0xc, 0xa, 0x101, 0x0, 0x0, {0x7}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x34, 0x3, 0x0, 0x1, [{0x30, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_SET_ELEM_EXPRESSIONS={0x24, 0xb, 0x0, 0x1, [{0x20, 0x1, 0x0, 0x1, @limit={{0xa}, @val={0x10, 0x2, 0x0, 0x1, [@NFTA_LIMIT_RATE={0xc, 0x1, 0x1, 0x0, 0x9}]}}}]}]}]}]}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x0, 0x84}}}, 0xe4}, 0x1, 0x0, 0x0, 0x44000}, 0x0) 1m43.781484014s ago: executing program 6 (id=17828): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) socket$xdp(0x2c, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x400000000000004) writev(r1, &(0x7f0000019440)=[{&(0x7f0000000200)="480000001400190d7ebdeb75fd0d8c562c84d8c033ed7a80ffe0090f000060000000a2bc5603ca00000f7f89000000200000004a2471083ec6991778581acb6c0101ff0000000309", 0x48}], 0x1) syz_genetlink_get_family_id$nl80211(&(0x7f0000000300), r1) r2 = accept4(r0, 0x0, 0x0, 0x800) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x1c, 0x4, 0x5, 0x5, 0x1018, 0xffffffffffffffff, 0xe}, 0x50) syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), r2) 1m43.692340874s ago: executing program 6 (id=17832): socket$nl_generic(0x10, 0x3, 0x10) (async) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)={0x18, 0x26, 0x1, 0x7fffd, 0x1000, {0x4}, [@nested={0x4, 0x1}]}, 0x18}, 0x1, 0x0, 0x0, 0x400c801}, 0x4008090) r1 = socket$inet6_sctp(0xa, 0x801, 0x84) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000040)={'tunl0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd29, 0x0, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0x0, 0xffe0}}, [@qdisc_kind_options=@q_skbprio={{0xc}, {0xe, 0x2, 0x9}}]}, 0x38}}, 0x4000010) r4 = socket$kcm(0x10, 0x400000002, 0x0) write$cgroup_subtree(r4, &(0x7f0000000080)=ANY=[@ANYBLOB="33fe"], 0xfe33) (async) write$cgroup_subtree(r4, &(0x7f0000000080)=ANY=[@ANYBLOB="33fe"], 0xfe33) sendmmsg$inet6(r1, &(0x7f0000000d00)=[{{&(0x7f0000000000)={0xa, 0x0, 0x0, @private1={0xfc, 0x1, '\x00', 0x1}, 0xfffffffc}, 0x1c, &(0x7f0000000300)=[{&(0x7f0000000400)="b8", 0x1}], 0x1}}], 0x1, 0x0) (async) sendmmsg$inet6(r1, &(0x7f0000000d00)=[{{&(0x7f0000000000)={0xa, 0x0, 0x0, @private1={0xfc, 0x1, '\x00', 0x1}, 0xfffffffc}, 0x1c, &(0x7f0000000300)=[{&(0x7f0000000400)="b8", 0x1}], 0x1}}], 0x1, 0x0) shutdown(r1, 0x1) (async) shutdown(r1, 0x1) ioctl$F2FS_IOC_MOVE_RANGE(r0, 0xc020f509, &(0x7f0000000440)={r1, 0xfffffffffffffffe, 0x48, 0x400}) setsockopt$inet_sctp6_SCTP_ASSOCINFO(r5, 0x84, 0x1, &(0x7f0000000480)={0x0, 0x3, 0x8, 0xb, 0xfffffffc, 0x7fff}, 0x14) setsockopt$inet_sctp6_SCTP_AUTH_DEACTIVATE_KEY(r1, 0x84, 0x23, &(0x7f0000000100)={0x0, 0xbc3d}, 0x8) sendmsg$TIPC_NL_PEER_REMOVE(0xffffffffffffffff, &(0x7f0000000d80)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000d40)={&(0x7f0000000ac0)={0x254, 0x0, 0x420, 0x70bd27, 0x25dfdbfb, {}, [@TIPC_NLA_BEARER={0xb8, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x4}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz2\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x4e24, @local}}, {0x20, 0x2, @in6={0xa, 0x4e24, 0x1, @loopback, 0x2}}}}, @TIPC_NLA_BEARER_PROP={0x54, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x2}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x99}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xdd6f}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7fff}]}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x1}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0xa8}]}, @TIPC_NLA_SOCK={0xfffffffffffffea1, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_CON={0x44, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_NODE={0x8, 0x2, 0x4}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x7}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x3}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x4}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x8}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x89}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x800}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x7}]}]}, @TIPC_NLA_SOCK={0x54, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_REF={0x8, 0x2, 0x344}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x9}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x6}, @TIPC_NLA_SOCK_CON={0x2c, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_NODE={0x8, 0x2, 0x3}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x3}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x4}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0xc}, @TIPC_NLA_CON_NODE={0x8}]}, @TIPC_NLA_SOCK_CON={0xc, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_NODE={0x8, 0x2, 0x80000000}]}]}, @TIPC_NLA_LINK={0x28, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x24, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x11}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xfffffffa}]}]}, @TIPC_NLA_SOCK={0x9c, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_CON={0x2c, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_NODE={0x8, 0x2, 0xe61}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0xa}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x9}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x4}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0xcbe}]}, @TIPC_NLA_SOCK_CON={0x54, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_NODE={0x8, 0x2, 0x6}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x7}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x6c9}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x6c019ace}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x4}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x5}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x4}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0xa}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x4}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0xe000000}]}, @TIPC_NLA_SOCK_CON={0x14, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_NODE={0x8, 0x2, 0x8}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x8}]}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}]}, @TIPC_NLA_NODE={0x10, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_ID={0xb, 0x3, "73d0df62b833fe"}]}, @TIPC_NLA_PUBL={0x14, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x1}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x9a4}]}]}, 0x254}, 0x1, 0x0, 0x0, 0x20040014}, 0x4000000) socket(0xa, 0x5, 0x0) (async) r6 = socket(0xa, 0x5, 0x0) setsockopt$IPT_SO_SET_REPLACE(r6, 0x0, 0x40, &(0x7f0000000540)=@mangle={'mangle\x00', 0x44, 0x6, 0x520, 0x138, 0x0, 0x138, 0x208, 0x0, 0x488, 0x488, 0x488, 0x488, 0x488, 0x6, 0x0, {[{{@ip={@broadcast, @dev={0xac, 0x14, 0x14, 0x3a}, 0xff, 0x0, 'geneve1\x00', 'ip6gre0\x00', {}, {0xff}, 0x1}, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0x138}}, {{@ip={@loopback, @remote, 0xffffff00, 0x0, 'macvtap0\x00', 'veth0_virt_wifi\x00', {}, {}, 0x6, 0x1, 0x40}, 0x0, 0x70, 0xa0}, @TPROXY={0x30, 'TPROXY\x00', 0x0, {0x0, 0x2, @multicast2}}}, {{@ip={@private=0xa010102, @dev={0xac, 0x14, 0x14, 0x24}, 0xffffffff, 0xff, 'veth0_to_bond\x00', 'team_slave_1\x00', {0xff}, {0xff}, 0xff, 0x3, 0x19}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x1, @broadcast, 0x7fff, 0x7, [0x29, 0x26, 0x35, 0xc, 0x15, 0x33, 0x21, 0xf, 0x38, 0x21, 0xa, 0x3, 0x3, 0x1f, 0x14, 0x37], 0x2, 0x8, 0x85}}}, {{@ip={@rand_addr, @local, 0x0, 0x0, 'syzkaller0\x00', 'macvlan0\x00', {0xff}, {}, 0x33, 0x3}, 0x0, 0x170, 0x198, 0x0, {}, [@common=@set={{0x40}, {{0x4, [0x2, 0x4, 0x5, 0x6, 0x3, 0x2], 0x1, 0x1}}}, @common=@unspec=@conntrack2={{0xc0}, {{@ipv4=@empty, [0xffffffff, 0xffffffff, 0xffffff00], @ipv4=@broadcast, [0xffffff00, 0xff000000, 0xffffff00], @ipv4=@broadcast, [0xff, 0xffffff00, 0xff, 0xff], @ipv4=@empty, [0x0, 0xff000000, 0xff000000, 0xff], 0x40, 0xf, 0x89, 0x4e22, 0x4e20, 0x4e22, 0x4e22, 0x40}, 0x0, 0x8c}}]}, @inet=@TOS={0x28, 'TOS\x00', 0x0, {0x3, 0x6}}}, {{@ip={@broadcast, @initdev={0xac, 0x1e, 0x0, 0x0}, 0x0, 0xff000000, 'lo\x00', 'batadv_slave_1\x00', {}, {0xff}}, 0x0, 0xc0, 0xe8, 0x0, {}, [@inet=@rpfilter={{0x28}, {0x8}}, @inet=@rpfilter={{0x28}, {0x2}}]}, @common=@inet=@SET1={0x28, 'SET\x00', 0x1, {{0x4, 0x4, 0x7}, {0x0, 0x6, 0x5}}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x580) writev(r6, &(0x7f0000000380)=[{&(0x7f0000000000)="b0dc170c8dc57a6d502001dc00169d85d0b3b1bd7889771533e1a3b3d7afdd0c7207d14f2560846a070fed9b6ea9b975131705d680070fb28a2ba6e0f33141d6a7187c5dc793ca342e57bc4a488b282093ef49b5f2883a2f71b54a036e534e34c4af7b25d25a71e0cfcff8c90a936290d9bbb0e69854f277fa96c300f5a13be7adfde148b4f6fb4ed00d8d3da566cbebf1ba585f5212a55b415ebc54dd1cc4a96e00a193eed06997291035ae2b520df1b8591a130127394010f7abb279514990aa29c4da26f818546756578b6eacbed89b2c957e2019ae84a894365bc1cf690f7231", 0xe2}, {&(0x7f0000000100)="c2a4323220102c836da44604cbcb82c7027b0d3c3e069ac120cdb5fe32327d2060021347062ec636bbecb60e0a230d9ad93f01d4f2df0571050e8267d4cbe564e08a8de86b3c160a2bf63d7008d1493a324a023a485c504b16f50c5aa269fd508a67352c16c83b4a8cffdfce209f244b9566b342de117121ef841e51747e57c5faca408bacb658f353ec7ed8d5d0adcccf6e865b48367229575dfc951b55c6ee743f71f2e6b63bc82c6913b1fc087564844b76fe8defd505", 0xb8}, {&(0x7f00000001c0)="74fbbfac751ca7c4257fab8140082bba9a47308d211c49a554e9b3aa47796ab0ce466f86cebb68182d78c0e31d4ccbe19029b316fb7a7835fe66b8ad4082fb48c3fbb32ba221814bad8721d2ca3327ff28d70f619874f1e3a62178ad6110b49ede8b52fb82b176751e084f12c0f3524ae859bf09381591c85258d247b497212c7a472189b7f4e22f1c3fce788ed16c781d5747530e4f955eae48e675fc1a0439bdcb94a0b31c46da286a3ef36e04907435f4ae862ed9a17016c7e7a7f7a76fb0bbe62c2de9c602b7d444bb1188be7455d10231f7e03d0ffd222e608d08d0605f85a924f50e5039759649e4a51ce3cd71149af2d5cdfd27ca9d99c7aa6d0a", 0xfe}, {&(0x7f00000002c0)="2d5ad0092fb87acebad738602df93fedbeb1b235b04c187a70821ad58e3cef6a166c02e792fc19744db3be3e", 0x2c}, {&(0x7f0000000300)="6b7f2c08dbc03362aff179b685583379df7171670cf6c849428ca35e140b6eec031b5a063d477cc3a96adcfeee8edc9600ca6afd31020c1bf3dbd0a3ff6f016cf7f99e54", 0x44}], 0x5) 1m28.601228437s ago: executing program 34 (id=17832): socket$nl_generic(0x10, 0x3, 0x10) (async) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)={0x18, 0x26, 0x1, 0x7fffd, 0x1000, {0x4}, [@nested={0x4, 0x1}]}, 0x18}, 0x1, 0x0, 0x0, 0x400c801}, 0x4008090) r1 = socket$inet6_sctp(0xa, 0x801, 0x84) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000040)={'tunl0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd29, 0x0, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0x0, 0xffe0}}, [@qdisc_kind_options=@q_skbprio={{0xc}, {0xe, 0x2, 0x9}}]}, 0x38}}, 0x4000010) r4 = socket$kcm(0x10, 0x400000002, 0x0) write$cgroup_subtree(r4, &(0x7f0000000080)=ANY=[@ANYBLOB="33fe"], 0xfe33) (async) write$cgroup_subtree(r4, &(0x7f0000000080)=ANY=[@ANYBLOB="33fe"], 0xfe33) sendmmsg$inet6(r1, &(0x7f0000000d00)=[{{&(0x7f0000000000)={0xa, 0x0, 0x0, @private1={0xfc, 0x1, '\x00', 0x1}, 0xfffffffc}, 0x1c, &(0x7f0000000300)=[{&(0x7f0000000400)="b8", 0x1}], 0x1}}], 0x1, 0x0) (async) sendmmsg$inet6(r1, &(0x7f0000000d00)=[{{&(0x7f0000000000)={0xa, 0x0, 0x0, @private1={0xfc, 0x1, '\x00', 0x1}, 0xfffffffc}, 0x1c, &(0x7f0000000300)=[{&(0x7f0000000400)="b8", 0x1}], 0x1}}], 0x1, 0x0) shutdown(r1, 0x1) (async) shutdown(r1, 0x1) ioctl$F2FS_IOC_MOVE_RANGE(r0, 0xc020f509, &(0x7f0000000440)={r1, 0xfffffffffffffffe, 0x48, 0x400}) setsockopt$inet_sctp6_SCTP_ASSOCINFO(r5, 0x84, 0x1, &(0x7f0000000480)={0x0, 0x3, 0x8, 0xb, 0xfffffffc, 0x7fff}, 0x14) setsockopt$inet_sctp6_SCTP_AUTH_DEACTIVATE_KEY(r1, 0x84, 0x23, &(0x7f0000000100)={0x0, 0xbc3d}, 0x8) sendmsg$TIPC_NL_PEER_REMOVE(0xffffffffffffffff, &(0x7f0000000d80)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000d40)={&(0x7f0000000ac0)={0x254, 0x0, 0x420, 0x70bd27, 0x25dfdbfb, {}, [@TIPC_NLA_BEARER={0xb8, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x4}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz2\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x4e24, @local}}, {0x20, 0x2, @in6={0xa, 0x4e24, 0x1, @loopback, 0x2}}}}, @TIPC_NLA_BEARER_PROP={0x54, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x2}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x99}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xdd6f}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7fff}]}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x1}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0xa8}]}, @TIPC_NLA_SOCK={0xfffffffffffffea1, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_CON={0x44, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_NODE={0x8, 0x2, 0x4}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x7}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x3}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x4}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x8}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x89}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x800}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x7}]}]}, @TIPC_NLA_SOCK={0x54, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_REF={0x8, 0x2, 0x344}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x9}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x6}, @TIPC_NLA_SOCK_CON={0x2c, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_NODE={0x8, 0x2, 0x3}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x3}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x4}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0xc}, @TIPC_NLA_CON_NODE={0x8}]}, @TIPC_NLA_SOCK_CON={0xc, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_NODE={0x8, 0x2, 0x80000000}]}]}, @TIPC_NLA_LINK={0x28, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x24, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x11}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xfffffffa}]}]}, @TIPC_NLA_SOCK={0x9c, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_CON={0x2c, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_NODE={0x8, 0x2, 0xe61}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0xa}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x9}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x4}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0xcbe}]}, @TIPC_NLA_SOCK_CON={0x54, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_NODE={0x8, 0x2, 0x6}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x7}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x6c9}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x6c019ace}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x4}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x5}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x4}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0xa}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x4}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0xe000000}]}, @TIPC_NLA_SOCK_CON={0x14, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_NODE={0x8, 0x2, 0x8}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x8}]}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}]}, @TIPC_NLA_NODE={0x10, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_ID={0xb, 0x3, "73d0df62b833fe"}]}, @TIPC_NLA_PUBL={0x14, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x1}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x9a4}]}]}, 0x254}, 0x1, 0x0, 0x0, 0x20040014}, 0x4000000) socket(0xa, 0x5, 0x0) (async) r6 = socket(0xa, 0x5, 0x0) setsockopt$IPT_SO_SET_REPLACE(r6, 0x0, 0x40, &(0x7f0000000540)=@mangle={'mangle\x00', 0x44, 0x6, 0x520, 0x138, 0x0, 0x138, 0x208, 0x0, 0x488, 0x488, 0x488, 0x488, 0x488, 0x6, 0x0, {[{{@ip={@broadcast, @dev={0xac, 0x14, 0x14, 0x3a}, 0xff, 0x0, 'geneve1\x00', 'ip6gre0\x00', {}, {0xff}, 0x1}, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0x138}}, {{@ip={@loopback, @remote, 0xffffff00, 0x0, 'macvtap0\x00', 'veth0_virt_wifi\x00', {}, {}, 0x6, 0x1, 0x40}, 0x0, 0x70, 0xa0}, @TPROXY={0x30, 'TPROXY\x00', 0x0, {0x0, 0x2, @multicast2}}}, {{@ip={@private=0xa010102, @dev={0xac, 0x14, 0x14, 0x24}, 0xffffffff, 0xff, 'veth0_to_bond\x00', 'team_slave_1\x00', {0xff}, {0xff}, 0xff, 0x3, 0x19}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x1, @broadcast, 0x7fff, 0x7, [0x29, 0x26, 0x35, 0xc, 0x15, 0x33, 0x21, 0xf, 0x38, 0x21, 0xa, 0x3, 0x3, 0x1f, 0x14, 0x37], 0x2, 0x8, 0x85}}}, {{@ip={@rand_addr, @local, 0x0, 0x0, 'syzkaller0\x00', 'macvlan0\x00', {0xff}, {}, 0x33, 0x3}, 0x0, 0x170, 0x198, 0x0, {}, [@common=@set={{0x40}, {{0x4, [0x2, 0x4, 0x5, 0x6, 0x3, 0x2], 0x1, 0x1}}}, @common=@unspec=@conntrack2={{0xc0}, {{@ipv4=@empty, [0xffffffff, 0xffffffff, 0xffffff00], @ipv4=@broadcast, [0xffffff00, 0xff000000, 0xffffff00], @ipv4=@broadcast, [0xff, 0xffffff00, 0xff, 0xff], @ipv4=@empty, [0x0, 0xff000000, 0xff000000, 0xff], 0x40, 0xf, 0x89, 0x4e22, 0x4e20, 0x4e22, 0x4e22, 0x40}, 0x0, 0x8c}}]}, @inet=@TOS={0x28, 'TOS\x00', 0x0, {0x3, 0x6}}}, {{@ip={@broadcast, @initdev={0xac, 0x1e, 0x0, 0x0}, 0x0, 0xff000000, 'lo\x00', 'batadv_slave_1\x00', {}, {0xff}}, 0x0, 0xc0, 0xe8, 0x0, {}, [@inet=@rpfilter={{0x28}, {0x8}}, @inet=@rpfilter={{0x28}, {0x2}}]}, @common=@inet=@SET1={0x28, 'SET\x00', 0x1, {{0x4, 0x4, 0x7}, {0x0, 0x6, 0x5}}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x580) writev(r6, &(0x7f0000000380)=[{&(0x7f0000000000)="b0dc170c8dc57a6d502001dc00169d85d0b3b1bd7889771533e1a3b3d7afdd0c7207d14f2560846a070fed9b6ea9b975131705d680070fb28a2ba6e0f33141d6a7187c5dc793ca342e57bc4a488b282093ef49b5f2883a2f71b54a036e534e34c4af7b25d25a71e0cfcff8c90a936290d9bbb0e69854f277fa96c300f5a13be7adfde148b4f6fb4ed00d8d3da566cbebf1ba585f5212a55b415ebc54dd1cc4a96e00a193eed06997291035ae2b520df1b8591a130127394010f7abb279514990aa29c4da26f818546756578b6eacbed89b2c957e2019ae84a894365bc1cf690f7231", 0xe2}, {&(0x7f0000000100)="c2a4323220102c836da44604cbcb82c7027b0d3c3e069ac120cdb5fe32327d2060021347062ec636bbecb60e0a230d9ad93f01d4f2df0571050e8267d4cbe564e08a8de86b3c160a2bf63d7008d1493a324a023a485c504b16f50c5aa269fd508a67352c16c83b4a8cffdfce209f244b9566b342de117121ef841e51747e57c5faca408bacb658f353ec7ed8d5d0adcccf6e865b48367229575dfc951b55c6ee743f71f2e6b63bc82c6913b1fc087564844b76fe8defd505", 0xb8}, {&(0x7f00000001c0)="74fbbfac751ca7c4257fab8140082bba9a47308d211c49a554e9b3aa47796ab0ce466f86cebb68182d78c0e31d4ccbe19029b316fb7a7835fe66b8ad4082fb48c3fbb32ba221814bad8721d2ca3327ff28d70f619874f1e3a62178ad6110b49ede8b52fb82b176751e084f12c0f3524ae859bf09381591c85258d247b497212c7a472189b7f4e22f1c3fce788ed16c781d5747530e4f955eae48e675fc1a0439bdcb94a0b31c46da286a3ef36e04907435f4ae862ed9a17016c7e7a7f7a76fb0bbe62c2de9c602b7d444bb1188be7455d10231f7e03d0ffd222e608d08d0605f85a924f50e5039759649e4a51ce3cd71149af2d5cdfd27ca9d99c7aa6d0a", 0xfe}, {&(0x7f00000002c0)="2d5ad0092fb87acebad738602df93fedbeb1b235b04c187a70821ad58e3cef6a166c02e792fc19744db3be3e", 0x2c}, {&(0x7f0000000300)="6b7f2c08dbc03362aff179b685583379df7171670cf6c849428ca35e140b6eec031b5a063d477cc3a96adcfeee8edc9600ca6afd31020c1bf3dbd0a3ff6f016cf7f99e54", 0x44}], 0x5) 5.895525136s ago: executing program 2 (id=19444): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000001800)=ANY=[@ANYBLOB="180000002500010324bd7002ffdbdf25010000000400ae"], 0x18}, 0x1, 0x0, 0x0, 0x4008}, 0x0) recvmmsg(r0, &(0x7f0000000d80)=[{{0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000600)=""/91, 0x5b}, {&(0x7f0000000000)=""/66, 0x42}, {&(0x7f0000000440)=""/62, 0x3e}, {&(0x7f0000000900)=""/108, 0x6c}, {&(0x7f0000001840)=""/4137, 0x1019}, {&(0x7f00000001c0)=""/215, 0xe5}], 0x6}, 0xffffffff}, {{0x0, 0x0, 0x0}, 0x2}, {{0x0, 0x0, 0x0, 0x2000, 0x0, 0xfffffffffffffefe}, 0x5}], 0x29, 0x2030, 0x0) 5.731998849s ago: executing program 2 (id=19448): r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000700)=ANY=[], 0x0, 0x34}, 0x28) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$sock_linger(r1, 0x1, 0xd, &(0x7f0000000040)={0xa}, 0x8) shutdown(r1, 0x0) r2 = socket$l2tp(0x2, 0x2, 0x73) r3 = openat$cgroup_ro(r0, &(0x7f0000000440)='blkio.bfq.io_queued_recursive\x00', 0x275a, 0x0) write$cgroup_subtree(r3, &(0x7f0000000100)=ANY=[], 0x32600) mmap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1000002, 0x110, r3, 0x0) setsockopt$ARPT_SO_SET_REPLACE(r2, 0xa02000000000000, 0x60, &(0x7f0000000000)={'filter\x00', 0xb001, 0x4, 0x3e8, 0x1f8, 0x0, 0x110, 0x300, 0x300, 0x300, 0x7fffffe, 0x0, {[{{@arp={@local, @empty, 0x0, 0x0, 0x8, 0x0, {@empty, {[0xff, 0xff]}}, {@mac=@local, {[0x0, 0x0, 0x0, 0x0, 0xff]}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'pimreg\x00', 'netdevsim0\x00'}, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@remote, @mac=@dev={'\xaa\xaa\xaa\xaa\xaa', 0x3f}, @multicast2, @multicast2, 0x2, 0x1}}}, {{@arp={@rand_addr=0x64010102, @empty, 0x0, 0x0, 0x0, 0x0, {@empty, {[0x0, 0x0, 0x0, 0x0, 0x0, 0xff]}}, {}, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 'veth0_to_team\x00', 'ip6tnl0\x00'}, 0xc0, 0xe8}, @unspec=@CLASSIFY={0x28}}, {{@uncond, 0xc0, 0x108}, @unspec=@IDLETIMER={0x48, 'IDLETIMER\x00', 0x0, {0x6572211f, 'syz0\x00', {0x6}}}}], {{'\x00', 0xc0, 0xe8}, {0x28}}}}, 0x438) getsockname$packet(0xffffffffffffffff, 0x0, &(0x7f0000000200)) 5.504927312s ago: executing program 2 (id=19450): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x5, 0x0, 0x0, {0x5}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x5, 0x0, 0x0, {0x5}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz0\x00'}]}, @NFT_MSG_NEWRULE={0x54, 0x6, 0xa, 0x401, 0x0, 0x0, {0x5}, [@NFTA_RULE_ID={0x8, 0x9, 0x1, 0x0, 0x1}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_COMPAT={0x2c, 0x5, 0x0, 0x1, [@NFTA_RULE_COMPAT_PROTO_IPV4={0x8, 0x1, 0x1, 0x0, 0x88}, @NFTA_RULE_COMPAT_FLAGS={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_RULE_COMPAT_PROTO_BRIDGE={0x8, 0x1, 0x1, 0x0, 0xf7}, @NFTA_RULE_COMPAT_PROTO_BRIDGE={0x8, 0x1, 0x1, 0x0, 0x5}, @NFTA_RULE_COMPAT_FLAGS={0x8}]}]}], {0x14}}, 0xc8}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000540)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000500)={&(0x7f0000000300)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x7}}, [@NFT_MSG_DELCHAIN={0x64, 0x5, 0xa, 0x201, 0x0, 0x0, {0xa, 0x0, 0x5}, [@NFTA_CHAIN_TYPE={0xb, 0x7, 'filter\x00'}, @NFTA_CHAIN_FLAGS={0x8, 0xa, 0x1, 0x0, 0x6}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}, @NFTA_CHAIN_ID={0x8, 0xb, 0x1, 0x0, 0x1}, @NFTA_CHAIN_COUNTERS={0x10, 0x8, 0x0, 0x1, [@NFTA_COUNTER_PACKETS={0xc, 0x2, 0x1, 0x0, 0xd}]}, @NFTA_CHAIN_TYPE={0xb, 0x7, 'filter\x00'}]}, @NFT_MSG_DELFLOWTABLE={0x2c, 0x18, 0xa, 0x201, 0x0, 0x0, {0x0, 0x0, 0x6}, [@NFTA_FLOWTABLE_FLAGS={0x8, 0x7, 0x1, 0x0, 0x2}, @NFTA_FLOWTABLE_FLAGS={0x8, 0x7, 0x1, 0x0, 0x1}, @NFTA_FLOWTABLE_FLAGS={0x8, 0x7, 0x1, 0x0, 0x2}]}, @NFT_MSG_NEWRULE={0x10c, 0x6, 0xa, 0x801, 0x0, 0x0, {0x1, 0x0, 0x2}, [@NFTA_RULE_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_RULE_HANDLE={0xc, 0x3, 0x1, 0x0, 0x2}, @NFTA_RULE_HANDLE={0xc, 0x3, 0x1, 0x0, 0x4}, @NFTA_RULE_HANDLE={0xc, 0x3, 0x1, 0x0, 0x4}, @NFTA_RULE_COMPAT={0x24, 0x5, 0x0, 0x1, [@NFTA_RULE_COMPAT_PROTO_BRIDGE={0x8, 0x1, 0x1, 0x0, 0x88f8}, @NFTA_RULE_COMPAT_PROTO_IPV6={0x8, 0x1, 0x1, 0x0, 0xc}, @NFTA_RULE_COMPAT_PROTO_IPV6={0x8, 0x1, 0x1, 0x0, 0x6c}, @NFTA_RULE_COMPAT_PROTO_BRIDGE={0x8, 0x1, 0x1, 0x0, 0x10}]}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_RULE_USERDATA={0x8b, 0x7, 0x1, 0x0, "c2dedec993c23cc42d67a2748e639c75294325dd1f9375289b17226b5e40bd4b0b5171c598a669a4fa5b0809d6ad122df1a6bf9936a99804de8840754b3855b5bc9b1318cebe4c9a1657895a769a5135648e72ba84bd3f5ed43d172485615d93ed2fe352ed1169112586ea7460d4160fa1ce1724e2fa39291a7dd77573da5b43338b0b64ee41e7"}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x1c4}, 0x1, 0x0, 0x0, 0x2004005}, 0x20040090) sendmsg$NFQNL_MSG_CONFIG(r0, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x24, 0x2, 0x3, 0x201, 0x0, 0x0, {0x1, 0x0, 0x6}, [@NFQA_CFG_CMD={0x8, 0x1, {0x4, 0x0, 0x28}}, @NFQA_CFG_MASK={0x8, 0x4, 0x1, 0x0, 0x10}]}, 0x24}, 0x1, 0x0, 0x0, 0x800}, 0x5) 5.339091216s ago: executing program 2 (id=19452): bind$inet6(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'seqiv(rfc4106(gcm(aes)))\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000009c0)="ad56b6c5820fae9d6dcd3292ea54c7be8bbdadbb1632ea5704cae881ef915d374c90", 0x22) r2 = accept4(r1, 0x0, 0x0, 0x800) sendmmsg$alg(r2, &(0x7f0000000c00), 0x0, 0x40) bind$inet(0xffffffffffffffff, 0x0, 0x0) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = socket$rds(0x15, 0x5, 0x0) bind$rds(r3, 0x0, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, 0x0, 0x44000) bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="140000001000010000000000000000000100000a20000000000a01040000000000000000010080030900010073797a30000000002c000000030a01010000000000000000010000000900010073797a30000000000900030073797a32000000008c000000060a010400000000000000000100000008000b400000000064000480340001800b000100657874686472000024000280080001400000000c0800034000000000080004400000002205000200890000002c0001800b0001007470726f787900001c0002800800014000000002080002400000001108000140000000020900010073797a30000000001400000011000100000000000000000000de000a"], 0x100}}, 0x0) r6 = socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=@newqdisc={0x24, 0x24, 0x1, 0x70bd2d, 0x0, {0x60, 0x0, 0x0, r8, {0x0, 0xa}, {0xffff, 0xffff}, {0x0, 0xffe0}}}, 0x24}, 0x1, 0x0, 0x0, 0x20080}, 0x44080) sendmsg$nl_route_sched(r6, 0x0, 0xc010) sendmsg$inet(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000380)="12", 0x1}], 0x1}, 0x40000) r9 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r9, 0x29, 0x40, &(0x7f0000000000)=@filter={'filter\x00', 0x4, 0x4, 0x3e0, 0xffffffff, 0x1e8, 0xd0, 0xd0, 0xfeffffff, 0xffffffff, 0x310, 0x310, 0x310, 0xffffffff, 0x4, 0x0, {[{{@ipv6={@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @ipv4={'\x00', '\xff\xff', @loopback}, [0x47e128f2bce82ddb, 0xff], [0xff, 0xffffff00, 0xff, 0xffffff00], 'veth0_to_bond\x00', 'veth1_vlan\x00', {0xff}, {}, 0x6, 0x5, 0x1, 0x51}, 0x2f2, 0xa8, 0xd0}, @common=@inet=@SYNPROXY={0x28, 'SYNPROXY\x00', 0x0, {0x1, 0x3, 0x800}}}, {{@uncond, 0x0, 0xf0, 0x118, 0x0, {}, [@common=@hbh={{0x48}, {0x1, 0x4, 0x0, [0x4004, 0x5, 0x0, 0x5, 0x7, 0x7, 0x101, 0x3, 0x7ff, 0x50de, 0x4, 0x5, 0x1000, 0x4, 0xffff], 0xd}}]}, @REJECT={0x28, 'REJECT\x00', 0x0, {0x8}}}, {{@ipv6={@private0={0xfc, 0x0, '\x00', 0x1}, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, [0xff], [0x0, 0xff, 0x0, 0xffffff00], 'veth1_virt_wifi\x00', 'wlan1\x00', {}, {}, 0xae, 0xb, 0x6, 0x6}, 0x0, 0xf8, 0x128, 0x0, {}, [@common=@ipv6header={{0x28}, {0x25, 0x80}}, @common=@hl={{0x28}, {0x1, 0x5}}]}, @common=@inet=@SET2={0x30, 'SET\x00', 0x2, {{0x2001, 0x5, 0x1}, {0x4, 0x0, 0x6}, 0x6, 0x817e}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x440) r10 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r10, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) sendmsg$NFT_BATCH(r10, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000500)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a74000000060a0904000000000000f3770200000048000480300001800e000100696d6d6564696174650000001c000280100002800c00028008000180fffffffb0800014000000000140001800d00010073796e70726f7879000000000900010073797a30000000000900020073797a320000000014000000110001"], 0x9c}}, 0x0) 5.048318645s ago: executing program 2 (id=19454): socket$inet_udp(0x2, 0x2, 0x0) syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x3) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000080)={0x38, 0x2, 0x6, 0x101, 0x0, 0x0, {0xc}, [@IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_HASHSIZE={0x8, 0x12, 0x1, 0x0, 0x60000}]}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_REVISION={0x5}]}, 0x38}}, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0xa8442, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) socket$netlink(0x10, 0x3, 0x14) socket$nl_netfilter(0x10, 0x3, 0xc) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000000080000000000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000000000000000000000000000000000000000000000000000093f105981684bc01229fbab5bd53ba931cf45137709de64e47efbb02d671cdcc6b91bb89263b442482288d67c8966b"], 0x48) socket(0x40000000015, 0x5, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000940)={&(0x7f00000013c0)=ANY=[@ANYBLOB="640000001000030400"/20, @ANYRES32=0x0, @ANYBLOB="e5fda988200000002800128009000100766c616e00000000180002800c0002001c0020001f000000060001000700000008000500", @ANYRES32=r2, @ANYBLOB='\b\x00\n\x00', @ANYRES32], 0x64}, 0x1, 0x0, 0x0, 0x8811}, 0x0) 4.523557236s ago: executing program 2 (id=19456): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000007c0)={0x7, 0x4, &(0x7f0000000080)=@framed={{}, [@alu={0x4, 0x1, 0x3, 0x0, 0x3, 0x30, 0x8}]}, &(0x7f00000005c0)='syzkaller\x00', 0x2}, 0x94) syz_emit_ethernet(0x88, &(0x7f00000000c0)={@local, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}, @void, {@ipv6={0x86dd, @gre_packet={0x1, 0x6, "f6ff01", 0x24, 0x2f, 0x0, @remote, @local, {[], {{0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x88be, 0x6, 0x1, [], "bf3f030b7d27"}, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x88a8, [0xffff, 0xb, 0x3e]}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x86dd, [0x9]}, {0xdd86, 0x88be, 0x3, {{0xc, 0x1, 0x8, 0x1, 0x1, 0x0, 0x4, 0x10}, 0x1, {0x7b43}}}, {0x8, 0x22eb, 0x2, {{0x3, 0x2, 0x2, 0x3, 0x0, 0x0, 0x1, 0x9}, 0x2, {0x5, 0xeb, 0x0, 0xd, 0x1, 0x1, 0x1, 0x1, 0x1}}}}}}}}}, 0x0) 2.65658493s ago: executing program 7 (id=19480): bind$inet6(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'seqiv(rfc4106(gcm(aes)))\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000009c0)="ad56b6c5820fae9d6dcd3292ea54c7be8bbdadbb1632ea5704cae881ef915d374c90", 0x22) r2 = accept4(r1, 0x0, 0x0, 0x800) sendmmsg$alg(r2, &(0x7f0000000c00), 0x0, 0x40) bind$inet(0xffffffffffffffff, 0x0, 0x0) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=@newqdisc={0x24, 0x24, 0x1, 0x70bd2d, 0x0, {0x60, 0x0, 0x0, r5, {0x0, 0xa}, {0xffff, 0xffff}, {0x0, 0xffe0}}}, 0x24}, 0x1, 0x0, 0x0, 0x20080}, 0x44080) sendmsg$nl_route_sched(r3, 0x0, 0xc010) sendmsg$inet(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000380)="12", 0x1}], 0x1}, 0x40000) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r6, 0x29, 0x40, &(0x7f0000000000)=@filter={'filter\x00', 0x4, 0x4, 0x3e0, 0xffffffff, 0x1e8, 0xd0, 0xd0, 0xfeffffff, 0xffffffff, 0x310, 0x310, 0x310, 0xffffffff, 0x4, 0x0, {[{{@ipv6={@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @ipv4={'\x00', '\xff\xff', @loopback}, [0x47e128f2bce82ddb, 0xff], [0xff, 0xffffff00, 0xff, 0xffffff00], 'veth0_to_bond\x00', 'veth1_vlan\x00', {0xff}, {}, 0x6, 0x5, 0x1, 0x51}, 0x2f2, 0xa8, 0xd0}, @common=@inet=@SYNPROXY={0x28, 'SYNPROXY\x00', 0x0, {0x1, 0x3, 0x800}}}, {{@uncond, 0x0, 0xf0, 0x118, 0x0, {}, [@common=@hbh={{0x48}, {0x1, 0x4, 0x0, [0x4004, 0x5, 0x0, 0x5, 0x7, 0x7, 0x101, 0x3, 0x7ff, 0x50de, 0x4, 0x5, 0x1000, 0x4, 0xffff], 0xd}}]}, @REJECT={0x28, 'REJECT\x00', 0x0, {0x8}}}, {{@ipv6={@private0={0xfc, 0x0, '\x00', 0x1}, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, [0xff], [0x0, 0xff, 0x0, 0xffffff00], 'veth1_virt_wifi\x00', 'wlan1\x00', {}, {}, 0xae, 0xb, 0x6, 0x6}, 0x0, 0xf8, 0x128, 0x0, {}, [@common=@ipv6header={{0x28}, {0x25, 0x80}}, @common=@hl={{0x28}, {0x1, 0x5}}]}, @common=@inet=@SET2={0x30, 'SET\x00', 0x2, {{0x2001, 0x5, 0x1}, {0x4, 0x0, 0x6}, 0x6, 0x817e}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x440) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r7, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) sendmsg$NFT_BATCH(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000500)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a74000000060a0904000000000000f3770200000048000480300001800e000100696d6d6564696174650000001c000280100002800c00028008000180fffffffb0800014000000000140001800d00010073796e70726f7879000000000900010073797a30000000000900020073797a320000000014000000110001"], 0x9c}}, 0x0) (fail_nth: 9) 2.263569549s ago: executing program 5 (id=19485): r0 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0xa) setsockopt$netlink_NETLINK_NO_ENOBUFS(r2, 0x10e, 0x5, &(0x7f0000000000)=0xffffffff, 0x4) sendmsg$NL80211_CMD_LEAVE_MESH(r2, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000040)=ANY=[], 0x33fe0}}, 0x0) r3 = socket$pppl2tp(0x18, 0x1, 0x1) r4 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r4, &(0x7f00000001c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x14}}, 0x10) connect$inet(r4, &(0x7f0000000480)={0x2, 0x0, @multicast1}, 0x10) r5 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r5, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r4, 0x2, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @private1}}}, 0x32) connect$pppl2tp(r3, &(0x7f0000000140)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @empty}, 0x2, 0x2, 0x2}}, 0x26) sendmsg$TCPDIAG_GETSOCK(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000640)={0x4c, 0x12, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {0x0, 0x8}}}, 0x4c}}, 0x0) sendmsg$TCPDIAG_GETSOCK(r2, &(0x7f0000000b40)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000b00)={&(0x7f0000000700)={0x3fc, 0x12, 0x200, 0x70bd2d, 0x25dfdbfc, {0x27, 0xe, 0xad, 0x8, {0x4e22, 0x4e24, [0xfffff621, 0x4b5f4145, 0xfffffffc, 0x4f], [0x9, 0xa4af, 0x8000, 0x6], r1, [0x9, 0x1]}, 0x1800}, [@INET_DIAG_REQ_BYTECODE={0xa8, 0x1, "3fbf9e476f93e6eaaf3f8d5e952c7586d7ba179906f73ef097492fd1134efc6efaabca3e5a132782e2138aa57de8a3a14f12546e6e3e8e46db1731f766df13375a0ed0a610f4bf44467181cc1712c4d91ba1c6ecbd1a69ddf0206c8f6266a29764094ed67d5fc8a2ef13b61f30fdbb10824afda967f038d79b87a7e42e1a9c156c7fe5cd515bb820715ff8aae8ecbf82390441d5d32ec43d6e83f36069246d6a2b3862b0"}, @INET_DIAG_REQ_BYTECODE={0xd8, 0x1, "11061c08100909b6e0a94b1dc7d912928c663834feec2a6a54d3bef49c12cbb478208866738800307140f06001ccf524b0f200e39eda0ce8608f9e46ebaaed51dfee013b54ebcfd0c270e49410cce7523030a0ee21822ba9d50b60c14a9926553d823c28d0529ac1f83250935025091846acb72f1b40cce3577546f8a42daeda6a1ba8008d19a656da96b1373a2272bce0ce3ab664897499f9bd905f98ebd8ae3c20401721ad7b4dbff34dbd13b2ee86ca432c575863f2da9a867605c4d46950633ec0c2fc3594e9fa8d5abed63a5df38b8ebd3d"}, @INET_DIAG_REQ_BYTECODE={0x103, 0x1, "f0ee7061f979d96eaf9f658e18123e96d03943573c3b973c73687daa31b9b9dc53c90ce09ca301cd12461b941eff062a4e174167901d0059692a54c33d9279208dc4320354ce6c7d5dc6b3cacd7974fdaab43e25fded67a3fd122cdcde1bd448bf3e671862407275c874a5f9e82c2aac108d77c0d153380bb4cf4056177b82235075d31650da368c4e106445b9372bc3a60571b61f954dcb4a6bef7cd29980721b4fb332e588ddb49fbacaf3e2fba16ef37195f72f4fd2210ac07c7c0e1457042b5c9ae5da2027c27300118cfa613976faae0b2dc9b7f2d0f3d7bc616d19952e8734a8c2f27ce4606fa2de2f1e0974a17eb4f65b1d9821768dbc30f7e15e27"}, @INET_DIAG_REQ_BYTECODE={0x52, 0x1, "e798097661df7d9efe30403d7f344c792a70404dc2d7c09de8b94f8b8f7d89c8bd07ae4f3741994cf8a576f7bda7fc0009326333b4de809d6cd5838a17ba317b473c3057243bd70e3a3be011c59c"}, @INET_DIAG_REQ_BYTECODE={0x9b, 0x1, "fadb204ab247c65863d5b084f6974f90bc9565e01ff1a877847cd69b56a0dc9a35dfd1324add6aa6c33d6895e25a5414c4d8490cf825ce40174fe5a9dc406ec04dfd8eaf0e0be9b842173d6a98b6d632bdf3f0ac43d971d31d1ca957967ade973e94d6dc438a40b5df1c82480f3ed35c5fac4c4dd0843c983c2882380a50c7b194833c36d06c993844473183063a2ff8c3295622654ce5"}, @INET_DIAG_REQ_BYTECODE={0x3c, 0x1, "289c8f8be3aa13757eba9a22e2a43588b3ca771ad6d74ebbf5d88ddba4b2752fb6d3c0daeb531798bcc0a0d56a0dfbb54bb1586f6f520d5c"}]}, 0x3fc}, 0x1, 0x0, 0x0, 0x800}, 0x20000040) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000100)={0x50, 0x2, 0x6, 0x3, 0x0, 0x0, {}, [@IPSET_ATTR_TYPENAME={0xd, 0x3, 'hash:net\x00'}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_REVISION={0x5, 0x4, 0x1}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}]}, 0x50}, 0x1, 0x0, 0x0, 0x4000}, 0x40) ioctl$EXT4_IOC_GROUP_ADD(r2, 0x40286608, &(0x7f0000000040)={0xb48d, 0x7, 0x8, 0x100, 0x1ff, 0x6e}) sendmsg$nl_route_sched(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000006c0)=@newqdisc={0x3c, 0x24, 0x3fe3aa0262d8c583, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {}, {0xffff, 0xffff}, {0x6}}, [@qdisc_kind_options=@q_fq_pie={{0xb}, {0x4, 0x8002}}, @TCA_EGRESS_BLOCK={0x8, 0xe, 0x2}]}, 0x3c}, 0x1, 0x0, 0x0, 0x2}, 0x2000400c) 2.117239544s ago: executing program 0 (id=19486): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r2 = socket$nl_generic(0x10, 0x3, 0x10) recvmmsg(r2, &(0x7f0000001280)=[{{&(0x7f0000000400)=@alg, 0x80, &(0x7f0000000840)=[{&(0x7f0000000480)=""/27, 0x1b}, {&(0x7f00000004c0)=""/119, 0x77}, {&(0x7f0000000540)=""/58, 0x3a}, {&(0x7f0000000580)=""/121, 0x79}, {&(0x7f0000000600)=""/180, 0xb4}, {&(0x7f00000006c0)=""/130, 0x82}, {&(0x7f0000000780)=""/173, 0xad}], 0x7, &(0x7f00000008c0)=""/196, 0xc4}, 0xc}, {{&(0x7f00000009c0)=@l2tp={0x2, 0x0, @empty}, 0x80, &(0x7f0000000bc0)=[{&(0x7f0000000a40)=""/131, 0x83}, {&(0x7f0000000b00)=""/173, 0xad}], 0x2, &(0x7f0000000c00)}, 0x10000}, {{&(0x7f0000000c40)=@isdn, 0x80, &(0x7f0000001180)=[{&(0x7f0000000cc0)=""/199, 0xc7}, {&(0x7f0000000dc0)=""/150, 0x96}, {&(0x7f0000000e80)=""/94, 0x5e}, {&(0x7f0000000f00)=""/18, 0x12}, {&(0x7f0000000f40)=""/236, 0xec}, {&(0x7f0000001040)=""/201, 0xc9}, {&(0x7f0000001140)=""/7, 0x7}], 0x7, &(0x7f0000001200)=""/82, 0x52}, 0x7fffffff}], 0x3, 0x0, 0x0) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000300), 0xffffffffffffffff) sendmsg$TIPC_NL_UDP_GET_REMOTEIP(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x28, r3, 0xcc071acbf25dbf8f, 0x70bd2b, 0x25dfdbfc, {}, [@TIPC_NLA_BEARER={0x14, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz2\x00'}]}]}, 0x28}}, 0x0) sendmsg$TIPC_NL_UDP_GET_REMOTEIP(r2, &(0x7f0000000240)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2021800}, 0xc, &(0x7f0000000200)={&(0x7f0000001340)={0xec, 0x0, 0x2, 0x70bd2c, 0x25dfdbfb, {}, [@TIPC_NLA_SOCK={0x34, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_REF={0x8, 0x2, 0x1}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_ADDR={0x0, 0x1, 0x6}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x2}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x81}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x7}]}, @TIPC_NLA_MEDIA={0x38, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_PROP={0x0, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x0, 0x4, 0x6}]}, @TIPC_NLA_MEDIA_PROP={0x1c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x4}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xe}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}]}, @TIPC_NLA_SOCK={0x20, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_CON={0x1c, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_NODE={0x8, 0x2, 0x2}, @TIPC_NLA_CON_FLAG={0x8}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x7}]}]}, @TIPC_NLA_NET={0x28, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_NODEID_W1={0xff3b, 0x4, 0x1}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x2}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0xf8ce}, @TIPC_NLA_NET_ID={0x8, 0x1, 0xfffffff8}]}, @TIPC_NLA_MON={0x24, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x2b, 0x1, 0x7}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x6}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x9}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x6}]}]}, 0xec}, 0x1, 0x0, 0x0, 0x48005}, 0x10) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'macvlan0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=ANY=[@ANYBLOB="740000001000030500"/20, @ANYRES32=0x0, @ANYBLOB="00000000952805004c0012800c0001006d6163766c616e003c0002800800010010000000280005800a000400aaaaaaaaaa3b00000a000400aaaaaaaaaabb00000a000400aaaaaaaaaabb0000080003000300000008000500", @ANYRES32=r4], 0x74}}, 0x0) 2.115366876s ago: executing program 5 (id=19488): bpf$TOKEN_CREATE(0x24, &(0x7f00000000c0), 0x8) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0x12, 0xc, 0x8, 0x3, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x3}, 0x50) (async) r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x500, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=ANY=[@ANYBLOB="020300090e000000000000000000000005000600000000000a00000000000000fc00000000000000000000000000000000000000000000000200010000000000130002020000000005000500000000000a0000001e000000ff0100000000000000000000000000010000000000000000"], 0x70}}, 0x0) (async) r1 = socket$nl_sock_diag(0x10, 0x3, 0x4) (async, rerun: 32) r2 = socket$nl_route(0x10, 0x3, 0x0) (rerun: 32) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="500000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="21000000000000002a0012800b00010067656e65766500000c00028008001100ff"], 0x50}}, 0x0) sendmsg$TCPDIAG_GETSOCK(r1, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=ANY=[@ANYBLOB="700000001200230500"/56, @ANYRES32=0x0, @ANYBLOB="00000000000000000000000000efff002100010007031c000a"], 0x70}}, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$gtp(&(0x7f0000000200), 0xffffffffffffffff) sendmsg$GTP_CMD_NEWPDP(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)={0x2c, r4, 0x3c1ef5685f8d0157, 0x0, 0x0, {}, [@GTPA_I_TEI={0x8}, @GTPA_VERSION={0x8, 0x2, 0x1}, @GTPA_LINK={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x8000}, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) listen(r3, 0x0) (async) sendmsg$nl_route(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x503, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @macvlan={{0xc}, {0xc, 0x2, 0x0, 0x1, [@IFLA_MACVLAN_MODE={0x8}]}}}]}, 0x3c}}, 0x0) 1.998532317s ago: executing program 5 (id=19489): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x1c}}, 0x0) getsockname$packet(r1, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32=r2, @ANYBLOB="f5ff0f00252155b21c0012000c000100626f6e6400"], 0x3c}}, 0x40000) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000680)=ANY=[@ANYBLOB="3c000000100003050000ff000007000000000000", @ANYRES32=0x0, @ANYBLOB="0000000006100000140012800b00010062726964676500000400028008000a00", @ANYRES32=r2], 0x3c}, 0x1, 0x0, 0x0, 0x800}, 0x440b0) 1.779848563s ago: executing program 5 (id=19490): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="500000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="21000000000000002a0012800b00010067656e65766500000c00028008001100ff"], 0x50}}, 0x0) (fail_nth: 9) 1.705149801s ago: executing program 7 (id=19491): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000600)=@newqdisc={0x24, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}}, 0x24}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) (async) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000400)=ANY=[@ANYBLOB="3800000055002f03000000000000000007000000", @ANYRES32, @ANYBLOB="200001"], 0x38}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=ANY=[@ANYBLOB="740000001000210400000000fcdbdf2500000000", @ANYRES32=0x0, @ANYBLOB="adffa8886004000024001280090001007866726d000000001400028008000100010000000800020011000000050021000000000008000a00", @ANYRES32, @ANYBLOB='\n\x00:'], 0x74}}, 0x0) (async) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0xd, 0x5, &(0x7f0000000080)=ANY=[@ANYBLOB="560a0000000000006111bc00000000001800000000000000000000000000000095"], &(0x7f0000000000)='GPL\x00'}, 0x90) (async) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x4000000) (async) sendmsg$NFT_BATCH(r2, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000540)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a88000000060a010400000000000000000a0000010900010073797a31000000005c000480580001800b0001007461726765740000480002802c0003009ac420002e2eafb9fdd672bad09dfb78c7699c74e82fa0c70000000000000000000000000000000008000240000000000e00010049444c4554494d45520000000900020073797a32"], 0xb0}, 0x1, 0x0, 0x0, 0x4000850}, 0x20040040) r3 = socket$inet_sctp(0x2, 0x5, 0x84) (async) r4 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r4, 0x84, 0x6f, &(0x7f0000000280)={0x0, 0x1c, &(0x7f0000000000)=[@in6={0xa, 0x0, 0x0, @private0={0xfc, 0x0, '\x00', 0x1}, 0x9}]}, 0x0) getsockopt$inet_sctp6_SCTP_MAX_BURST(r4, 0x84, 0x83, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000300)=0x8) setsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(r3, 0x84, 0x76, &(0x7f00000000c0)={r5, 0x5}, 0x8) (async) setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(0xffffffffffffffff, 0x84, 0x72, &(0x7f0000000040)={r5, 0x1}, 0xc) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x15, 0x3, &(0x7f00000001c0)=ANY=[@ANYBLOB="1daa000000000000711019000000000095"], &(0x7f0000000480)='syzkaller\x00'}, 0x90) 1.061362078s ago: executing program 0 (id=19492): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@ipv6_newrule={0x44, 0x20, 0x2d2c6d60ea1da725, 0x70bd29, 0x25dfdbfd, {0xa, 0x0, 0x0, 0xcd, 0xfe, 0x0, 0x0, 0x1, 0x18002}, [@FIB_RULE_POLICY=@FRA_IIFNAME={0x14, 0x3, 'veth0_to_bond\x00'}, @FIB_RULE_POLICY=@FRA_IIFNAME={0x14, 0x3, 'pimreg1\x00'}]}, 0x44}, 0x1, 0x0, 0x0, 0x20008005}, 0x0) 997.357495ms ago: executing program 7 (id=19494): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'ipvlan0\x00', 0x0}) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12000000060000000400000002"], 0x48) r4 = socket$kcm(0xa, 0x2, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000001c0)={{r3}, &(0x7f0000000080)=0x1000000, &(0x7f0000000180)=r4}, 0x20) ioctl$sock_kcm_SIOCKCMCLONE(r4, 0x89e2, 0x0) connect$inet6(r1, &(0x7f0000000100)={0xa, 0x4e21, 0x4, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010101}, 0x5}, 0x1c) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=ANY=[@ANYBLOB="740000001000030500"/20, @ANYRES32=0x0, @ANYBLOB="00000000952805004c0012800c0001006d6163766c616e003c0002800800010010000000280005800a000400aaaaaaaaaa3b00000a000400aaaaaaaaaabb00000a000400aaaaaaaaaabb0000080003000300000008000500", @ANYRES32=r2], 0x74}}, 0x0) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x101203, 0x0) ioctl$TUNSETIFINDEX(r5, 0x400454da, &(0x7f0000000080)) 879.9567ms ago: executing program 5 (id=19496): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r0, &(0x7f0000000100)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r0, 0x0) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r0, 0x89f3, &(0x7f00000002c0)={'gretap0\x00', &(0x7f0000000200)={'gretap0\x00', 0x0, 0x10, 0x8000, 0x9ab, 0x3, {{0x26, 0x4, 0x0, 0x3e, 0x98, 0x64, 0x0, 0x9b, 0x2f, 0x0, @local, @dev={0xac, 0x14, 0x14, 0x1b}, {[@noop, @timestamp_addr={0x44, 0xc, 0x10, 0x1, 0xa, [{@private=0xa010102, 0x51}]}, @rr={0x7, 0x1f, 0x62, [@local, @multicast2, @initdev={0xac, 0x1e, 0x0, 0x0}, @initdev={0xac, 0x1e, 0x1, 0x0}, @multicast1, @local, @private=0xa010100]}, @end, @cipso={0x86, 0x1e, 0x2, [{0x1, 0x10, "eedab5a8ebf48a5dcc047789204c"}, {0x0, 0x3, "ed"}, {0x7, 0x5, "6355c7"}]}, @cipso={0x86, 0x35, 0xffffffffffffffff, [{0x2, 0x5, "1aaf22"}, {0x5, 0x2}, {0x2, 0x2}, {0x6cc174e373a558ae, 0x11, "3e78008d9801b414e80b1848fc18ed"}, {0x0, 0xd, "d14769047a850db22d313b"}, {0x6, 0x8, "e45b628746ec"}]}, @end]}}}}}) bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4000000000000007910480000000000710425000000000095000000"], &(0x7f0000000000)='syzkaller\x00', 0x2, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x71, '\x00', r1, @sk_msg}, 0x94) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) (async) write$cgroup_subtree(r0, &(0x7f0000000100)=ANY=[], 0x32600) (async) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r0, 0x0) (async) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r0, 0x89f3, &(0x7f00000002c0)={'gretap0\x00', &(0x7f0000000200)={'gretap0\x00', 0x0, 0x10, 0x8000, 0x9ab, 0x3, {{0x26, 0x4, 0x0, 0x3e, 0x98, 0x64, 0x0, 0x9b, 0x2f, 0x0, @local, @dev={0xac, 0x14, 0x14, 0x1b}, {[@noop, @timestamp_addr={0x44, 0xc, 0x10, 0x1, 0xa, [{@private=0xa010102, 0x51}]}, @rr={0x7, 0x1f, 0x62, [@local, @multicast2, @initdev={0xac, 0x1e, 0x0, 0x0}, @initdev={0xac, 0x1e, 0x1, 0x0}, @multicast1, @local, @private=0xa010100]}, @end, @cipso={0x86, 0x1e, 0x2, [{0x1, 0x10, "eedab5a8ebf48a5dcc047789204c"}, {0x0, 0x3, "ed"}, {0x7, 0x5, "6355c7"}]}, @cipso={0x86, 0x35, 0xffffffffffffffff, [{0x2, 0x5, "1aaf22"}, {0x5, 0x2}, {0x2, 0x2}, {0x6cc174e373a558ae, 0x11, "3e78008d9801b414e80b1848fc18ed"}, {0x0, 0xd, "d14769047a850db22d313b"}, {0x6, 0x8, "e45b628746ec"}]}, @end]}}}}}) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4000000000000007910480000000000710425000000000095000000"], &(0x7f0000000000)='syzkaller\x00', 0x2, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x71, '\x00', r1, @sk_msg}, 0x94) (async) 828.868145ms ago: executing program 0 (id=19497): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x6, 0x4, 0x8, 0x8}, 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000001080)={0x6, 0xc, &(0x7f0000000180)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001}, [@ringbuf_output={{0x18, 0x5, 0x1, 0x0, r0}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x45}}]}, &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback=0x1d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000000c0)={r1, 0x0, 0xe, 0x0, &(0x7f00000002c0)="e02742e86c0d85ff9782762f0800", 0x0, 0x40000, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="500000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="21000000000000002a0012800b00010067656e65766500000c00028008001100ff"], 0x50}}, 0x0) 765.01611ms ago: executing program 7 (id=19498): ioctl$XFS_IOC_ATTRLIST_BY_HANDLE(0xffffffffffffffff, 0x4058587a, &(0x7f0000000240)={{0xffffffffffffffff, &(0x7f0000000000)='\x00', 0x141900, &(0x7f0000000080)={@align, {0x2, 0x7, 0xa31, 0xe}}, 0x4, &(0x7f00000000c0)={@_ha_fsid}, &(0x7f00000001c0)=0x3}, {[0x2, 0xc752247, 0x3, 0x10001]}, 0x6, 0x8, &(0x7f0000000200)=""/8}) (async) ioctl$XFS_IOC_ATTRLIST_BY_HANDLE(0xffffffffffffffff, 0x4058587a, &(0x7f0000000240)={{0xffffffffffffffff, &(0x7f0000000000)='\x00', 0x141900, &(0x7f0000000080)={@align, {0x2, 0x7, 0xa31, 0xe}}, 0x4, &(0x7f00000000c0)={@_ha_fsid}, &(0x7f00000001c0)=0x3}, {[0x2, 0xc752247, 0x3, 0x10001]}, 0x6, 0x8, &(0x7f0000000200)=""/8}) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000300), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000340)={'wlan0\x00', 0x0}) socket$nl_generic(0x10, 0x3, 0x10) (async) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$devlink(&(0x7f0000000140), 0xffffffffffffffff) (async) r4 = syz_genetlink_get_family_id$devlink(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RATE_SET(r3, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000002c0)={0x3c, r4, 0x101, 0x70bd27, 0x25dfdbfe, {}, [@DEVLINK_ATTR_PORT_INDEX={0x8, 0x3, 0x1}, @handle=@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x20000000}, 0x4) sendmsg$DEVLINK_CMD_PORT_UNSPLIT(r0, &(0x7f0000000540)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000500)={&(0x7f00000004c0)={0x38, r4, 0x20, 0x70bd2b, 0x25dfdbff, {}, [{{@pci={{0x8}, {0x11}}, {0x8, 0x3, 0x1}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4000}, 0x40) sendmsg$NL80211_CMD_DISCONNECT(r0, &(0x7f0000000400)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x30, r1, 0x20, 0x70bd2c, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r2}, @val={0xc, 0x99, {0x1000, 0x15c}}}}, [@NL80211_ATTR_REASON_CODE={0x6, 0x36, 0x28}]}, 0x30}, 0x1, 0x0, 0x0, 0x4008804}, 0x80) socket$nl_generic(0x10, 0x3, 0x10) (async) r5 = socket$nl_generic(0x10, 0x3, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x15, 0x3, &(0x7f0000000000)=@framed={{0xc3, 0xa, 0xa, 0xfe00, 0x0, 0x71, 0x10, 0x1a}}, &(0x7f0000000480)='syzkaller\x00'}, 0x80) sendmsg$nl_generic(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="140000003a00010327bd7000fcffffff08f3"], 0x14}}, 0x0) syz_genetlink_get_family_id$gtp(&(0x7f0000000100), r5) 701.663879ms ago: executing program 4 (id=19499): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000000)={0x58, 0x2, 0x6, 0x201, 0x0, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_BUCKETSIZE={0x5, 0x15, 0x1}]}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_TYPENAME={0x11, 0x3, 'hash:net,net\x00'}]}, 0x58}, 0x1, 0x0, 0x0, 0xc040}, 0x0) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x3, 0x1, &(0x7f0000000400)=@raw=[@jmp={0x5, 0x0, 0x1, 0x2, 0x4, 0xfffffffffffffff0, 0x1}], &(0x7f0000000080)='GPL\x00', 0x4, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x60, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x8, &(0x7f0000000040), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x94) 637.151026ms ago: executing program 5 (id=19500): r0 = accept$unix(0xffffffffffffffff, &(0x7f0000000000), &(0x7f0000000080)=0x6e) listen(r0, 0x400) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x41, &(0x7f00000000c0), 0x4) r1 = accept4$unix(r0, &(0x7f0000000100), &(0x7f0000000180)=0x6e, 0x800) ioctl$INCFS_IOC_CREATE_FILE(r0, 0xc058671e, &(0x7f0000001580)={{}, {0x100}, 0xc8, 0x0, 0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)="95d8569e192a2149d8b141516150fb3f773e244628c8bc0374c3555b8f7090ca36269bffcdbf273df5403b56f0decf8049e35e6bc90001be1ed5f070bdf6ff64fe9cfa6e24e5be09c7b3abd2325f4fec76e03b399bed04b236542f61a0d0428d5d4d21cf81eef183ebee6720bf6ca889aa8f3b4e7854afcb8cac259a35c53043cc0d95b4a1bd6e6fe76d4838c33a6aa592cf62419990463b414039f8ffb198a98b730f13acd6e412ad3c80daf6a0840494f84b5a8db4b1255d3c44b5ef9e948b85de7388bb4e2cf7ea4254a7bb0aca4a4652be22285f5f56e07b6bac0a22a40910c1364a0a735e119cc19734744667e3d10e2ea10f3c8806ab2a89c8f3bdec12ddefc93bc6744c9249c518c48dd02e5491e1e91720efc0ba492da0a8a0fe52e57642205b649ca10926f4681b84a385ec62ef783358405693a79a86ac25a221a2f25c09929ac9f14baa27600387b3844727b521cc1a9f39836c2474ce5969b18ee72d561de87963e1b6e8e92847b0b04e06ea5072a3ab84ec4ac6a3e7dc4d309eb1fe688d6d8c3b0a9b688bb48f74f5d388d73608566e09fe3c155d7a5510e578618aebad67ca73d5c052dcc6092a9d05004d410b3293671678b6dabc6266415ae447c50d6316db1470f7329d16", 0x1cd, 0x0, &(0x7f0000000440)={0x2, 0x10b9, {0x1, 0xc, 0xac, "bb0fac9765214e27b1137c087127420fcb78704ed0b80d228f8abf2df15ca14ba2791e947612658347f7cb7de5e9d2d3429fa9a22abc1a31b0979bc3c88f05aa0c656e315fb84c70bdf57babd03e4619dbc1f4addd6b33e04e41c28cb7476fd6d767f811ccef169779a27645172a1e697750a405c483e43d7fb61b2aa540ed87cc9f24519b5e549658416b19207d543af63ce91135ad76d51f55a829cd0c737fe5a47dd7a50c437898d87be7", 0x1000, "e91e32cae97a2d861d93c6accd79820f6a318e6f4b59df8bd848ab8fd8f37082465bee1577d0b1e7e790daa4fc5b599dc4879b6c7daa29efb37c974bb7fb53221dc3fa23165204e0d699280bf0ecea1f963e6213e268c196916763466481d5077af26a2a7f9404ae5a12611cb80fd7d369dba012b3b18f0ab00dd327344aa001704d22868ccbd0f7ec5c23ccfb607630446087f3c407de6e7209cf442220a23c18c1f8395d5973b45f077a873fc1fd8f606e783a17d52849183d02f34bd24eee927a4a357894d364238adde086485346cc2da6ff574f304e4bd7fb6cc8f8196f7cb3fc19326e16b423e1668695fcfa09957529b6f7333fd65617d4713b1f6ced67d71b87aea3cb0e27c81b1dc5ddd6eed5415f885e9014b3334235e84ec0d68ba104fb80bbf580408f5ffc2fd6ffa9914e60fb2799e3f526b541f98b32e489afbaac01fe4e33931217fb2d479abde5a395c16f7e0f6119a7c7b2e759aaa1ea52ad03cb9d1d7dd14c4b20db581aec580b10d0607328bbaa6229af2247941a99c381d0a514e873046bd1b937712d3598e10da2e0899d0582abb34fc36526e0a83c3ea776630834fe100c882a840b95e6f2e9d4d1a4d1c37ac2db111af78fb0e93f9f2ce6e889e88d366ba7c8c2203c2fef3934f368caefa739e76b82a85e6b31261a0ecc50a1810b4a7ffc6f963091881f1989196b4a91266224e0d6e232653b412370361e63d49e72b6a45896fef266dbc43f3f13997b93e2a5a06b9262dd08f4584c92038d2313f9f0b3f85112f301c4136ea41fd15754d4d7e7a16748f67dfecb449de538ce916bfbd497a2b500f0fc2ea0517ed6f33fd78aafd4a92e1060cec2c78c58f93de7373b8e5eb4d32cb154843b7316f6fd08a994f6b0b44c8a6f9f67fee5d843daa392f203531fa3edb75e4b1c3d23bf1163b8e86805ee6c8057b6a507c6f7dca1e55845dc5ab35211003e7ba1ba58ccc9cb90776fcf8e05e09d60e453fe5139d572d4d43d2dd3066784521b3f3f9a9a18f33e433fcffc0dc03e9f3c5bbb80349be694950b387e09d49c7586a10290587fef7d534f4091b7d2cea1e111c377c4bd4685699f6815a430f59baf9bab4ef38c1db6b0b997a3694ce0f8550e74b7a86cdfb66c8281f1dab623d521fe4ce952be715fd0eb1fc14a2c637d780f87d78ee70b77b63d6e366443001273f5fb941878a5e783d046d2c121ed57d44a28ff22a202679fa6cd998705ff3610214febe90df01a7a7176ac74a9b753597fbb2e0b773d9809902586b4f51cbd0063257ebb390058d3eb8e86032c9d710b4c1a8b5652237ab415b0a0ac5224ed781486d658f549ad0a2c3504553d63ae42463fd7d59d1516b153c8e97b5eecad3045c6270de3379b83f785c2eda02b0523c154270e9e84c4f77ab0fd31a6a24b421de45885b64699e358715e5fb111db1dfd050ac55790fb067ed44c279dc4b775b3b6943a3f8021978396f8c68d6f94c79684343681c2885e787bb8e0983c192d49773fa750a5c722ef2bdf5d0cdd3ee4ed4fed6b5e08f15b3f824f53d24c7c07927ad268b4492f578c20a09b9f842383a9135f68b7ea5b8bdb6644c428fcb196135ec17ab584a7070a382f7690f95782a324dd0efd06e0ce72c289a0756ecbc1fe9f8d855f4c147faaf86d7d32f3e7029d485e4d4ca5fc2d6b8e4386f429cc125ccaf07f9629ae2a88bedfb10c21e6b4046c7f13402d843b68e108310792e7eab55c36d4de46aa0c61081474ebfe53ab161d0a02b0752a9ed71628afa4ff762160e4133871576c2cfd691d7d895d47530915c1fa6b0f8c753e0cc46f5fef8c7cd855d1d390e7086bd50dd92dc4fda90b7404f06aad14555fc4569d5f4ae08bd306311e4d29bf05c72e7489791e387975e9c9acda8ee43bd35a6d34b4f98263dfe67ea76d5bdc5b409cd1392221742d8dca093f90af3ab3cfbfa2c4d0913a34bf2ff707eb856e9a15237ed091a52152c00bcb072e5a6cf12989fc13e69a651a56cf8d779b7f5dd7cced340cb503f3e6da49d52d7490d60252ede05cb07e4566ddfd3161d6f23428cd743d4f65744bfe163a5bed9281fdc854f72146e4b042310803ef558d035ba7f5b21556b2e95aec67a5e467ad1277503a32e8bc0a90a8feb7d194d943030949162d5e1a554c160ac23cec3a655cec0b82dd9d156fa276d55bdadf6eb7431819b8ab436201d30e32d2bcaf2b6fe9a7985c33be883819712defd19c11d3a148984ce486433e8b50044c272e3fbdd1eeb780782ba6301b6a7b965a414f632127c89445b9cce5c5d59f61e5f143fefd57e2da14e9f8d6e7d9e9e0445f447e10d0d13666b86952402502ca43632e88ae0ecd1391dc5f68cdbe4e9b384a7357d3228fe05569591fc3d84908a6bcf8d5a370b9174e3d87df017ffb79551b3ee2bec02e8e728d7cfb35a2c810f15c9918c14ebf0334b802776125e21275fbd5a2172805d38d2698d6dd07c5d52ce1fd5294e4291ab73bb6cb21b41bea06336ac7f927f6fa329f65effe78aa9bff30e126e80036b4a471e40e7f1828668d2d6bd08e0a169440bc4f2290892ad9c859f3afe4c754819ab4746993bbf8e72ef2840ab693b3f964483373366d1d440cdc9ec249cce76f630c36e73d017265313a66b0143d1ab4ea95a92f8d63bd84ac1b3cba72ad9d06a009292cd5525177b7b6c5d4e505c2b7e7ee16bdd390e45de434c9f192652f968d0317b333cbf809fb62b15847b4d6fb871a557da147333865e525013c0ff6ea4e891d53a227b82f874d2954b1ffb155e9875fa9532f0dc58294aced1c718fee31375e0d366961f807f8481e875c63e382044aa798b3e6eedd7d29300f08528ecfa10d323bf85e9462a47c7db06cb0174ec3f1b9bf088e65c034a7fa9dfb79e4da8e50e3346556a8cc6007d45a10cdaaf2f3d6585a7d2f63c27ac0ecce575f0db586a0ff64c2912ec91de7f70a8bbd0697f0675dc37f229dcc969f978106cee6e12153c41c3424eed8e51fa2cb93e214cd7e6283fd47c4ae516ba0c39d20bff852ff044ba662be98641ad27fd28b664949020afd3a07240d27e226ae7b7e61f6766f27302e017fb6f9f6076a3a2bb2131dd042a304371820373b208246fe344e262d4a70e81cde8d7ab448472904a33ba31b6fe32941889d20cb4c27ab94d9c63ee15d46823c0f5124c713bcbeeea8f6a69a899e323834a55c3680f62d546ff4bfe16d1866e74f1f3951d5fd529ee9a7f729c0d00b840104515b7920ee6983fe54d6a2f339ba81e481ff1665bbcc8aec72578a8585fd7547046679c8231a140163f46b387e3d8fa55e981cd714d32aed344e5d7e072a97be10c6707bdc34a574424dbc8811df6a29d0365d99be780000854610523dc7d0241fba0b08a202488786b28ce19c26ae51dbbc3c2fceb3b400b4a12295d4d13c86f158c9b647270d01fdbd6b9eb832ef5300aceddc412f77c63faae35d9e4b458c9298b85137219b152054b87fa4769d495b9eec35bf61b31fe3d05dd7d3a6a18aa9b66ebbf4c70a4445cd4745367ab93f54e69f322d6e4bc0b4559e31d7679af486edb8a622ee8535fabe4ebc6a2b4230070d8fc8aa034ff60f145f0e5f9a1fb4045e52110d48883831157d63f7c3b488527aaf2b1f9fbe6c86b480f622478004782ded33d74bbabc23d065c1efe7f57d404d85002487fd9606ae9c04ec652b6d2288c82be06762fa8e4181987765bef9628c4420e78c4bf43833077b91a0442b5e7831fb95385cdb8fd62a44b794709d85268f651970ad3a7b5d0be75ecb8970cb9ba80b862dc06a8755a0865765ff05a4d94fd442052da5f1641b2f1edbd0bbe9a0446fe2101558e7936e0092c33a1e72b23a84e41936689482d7b6c76924eeb5fb6189557f59061ee81b033a923e05a57b3541475b1054464fca824d5a88e1227a941bb08f65c130dc85cd33571d94ea8e58f3d1d402a2063c6152f4834c796b288fd5c7df5276245985472b3d2899684da57c15b0842c53a1f9a6a47f60d5539ea25ac0f966fd4ee3fb03333199a5cb8ce9ab217f416057ad6e97fa238c51b4c143b254937bbd7773c602eb3b8464bef7861bcaca0f59244f118c1d786a0f55dcac32896b8ba0cbdb2741361284c52a75deecc72024ce321a5cb0412ddb7503feefb27f2d71112fe6958924ed71e808e873bddeb11bf5b8e4d4a8b0ee230fcc15552b08e87a70f2aded2d0e8805a1f1473902e7e2109b9ff8e5acc862e759d97dbbdc862da0bd1b216473dc75ba00abf22b2f3c0a7f0ea7417df0d47619305e6e327d68555c0e12b2ee82b53dad898e0f56d64a2855a56c1439231979e4af2ca3df90156cea23f6bebb06c991cca817585d4f377bfe3646823159edcdc8d14fd7089a4320f5c9f99be62f215ebeb4bbf2d1cfc90bba1b52ed15d36acd261f9384320c9aa6b43b1fa569d9c33c54945e438aeeb5a48a8bd2d682269c0bef89c3110894635202416fa1b2094fd200bc8a0408ccd248d711544bd14988b616fdf217a8b53881dc489e97db4b9737ab1cc288ff13397dc378bfcbeb81ef505a9371d114532540aba9363a7d4b0d6fe8859c10363db853ddb2a4f9297ecd53b3631a2242cf3a44bda071ca3d9d4038006c8068e3d44d33671b1a2608c23f66e6869c53fdb15dfd74076348c7d455d47cbd09ad42758296fa4e732de10c5e85f99729d27f38e65f813d38da15cce7549756626727c4a94cd57ea5ce75836fee7f82a479e1b3ce90811d1e62856ceb2bd36d4d851850f654753b19c41e348aaa3fe02e500e815e2ecdeaf7d8ba482b886210adec7703e09c49ba7880f85d5c0fb5bfbced1951cd081bafe4581eae64c4a558d6698d1e45e77f56e269475788b0a7545b2c5fc8c6384526f5504f047a215ce28adcc3ca357ae233f50d2fd56f24885fdd053b54a7b53b3beb86cdd6bd73b5198af8ecde1e349acff948c69ac4787f3d624943c0a843f4a88ecb3b5f915219ded8f80f09ef5f12f0bbce7b7fcb1cad036b6f1a6301bf449702b0b02db0b04eef6e0f11dc6278f22deb38f078c379e448d35ed94b5dfc07edfb605af0956327eade62d4661bf7fb20351e87dd2fcfad70d41d44adf14a09f0a00a4151f82aee2a75cfa81ebd4e9e295e9c525ae2055b31dc7f0381a5536287ee0747d3713833cdf0852658a9b4d339ff30fcd3c10f378fb48d7c8c70cbbf40793487c2ef29b7cd171a3d50cdcc3e623116b10c7b2c95f430df04d13f3ab079f1c99869b5476563472cfc28d4805398130a23b9d2a141ef66bce95d71e9b501d95fe7f311c3b9e6a367f4f1f832400d126eac69e2adfc782b938c4f3121760a71ab51166cc53409416a151608805548f46014c316a7500cf581ae478acba7b188961a13b67638708c6a8354e1c5370363ed319f7e0b43bfc08363371d0e2228676884fee8abff8159099b929f3aafabe625df284349c6410d20320fabd9986deb73bbc8162f3b2ed8b7f191e159662317a8cc80b7dfb08b7e7380051b315502712670a82f5ec265df1ef486179fa1d5b4cf14a5596acf5ca06fbd0db82af10c1414fce32758659af6db5126d9454a650eeeb7f7b06eac5b46f9cd0be04eea5cc4b7829d374e9ae27a492ffa25b475c93d10fd2313f52794b355ae5a57a16a4a70cd524e4134b2eedbdec0c9fabaa42d82d1bc4303c78376d4bcb9c2f914e12565301c112d8706d3e2b8b2d137b1775873b903d9c614198f36a132db4f4ea64a9943658fe5728adae9b94be4c16dff9dbfb86c8a373ed6"}, 0x76, "c7be2b091c00238a30c4ef123324ceb7ac62816bb8de1b712e03487667e861ca9cc943d593e33e772184707a5c279f3a1d29216fbdc9533b66f286e4c432a79df31bf35025f169d3c7d67c3106ce1f9a904fe37e0e5f413b629f332113a796c3b96a52831e8c9d360fbfa9098055aebf74d6d804b34b"}, 0x113b}) r2 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) getsockopt$inet6_mtu(r2, 0x29, 0x17, &(0x7f0000001600), &(0x7f0000001640)=0x4) connect$unix(r1, &(0x7f0000001680)=@file={0x1, './file0\x00'}, 0x6e) getsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000001700), 0x10) r3 = socket$inet_sctp(0x2, 0x5, 0x84) getsockopt$inet_sctp_SCTP_I_WANT_MAPPED_V4_ADDR(r3, 0x84, 0xc, &(0x7f0000001740), &(0x7f0000001780)=0x4) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f00000017c0), r4) socket$qrtr(0x2a, 0x2, 0x0) ioctl$FITRIM(r1, 0xc0185879, &(0x7f0000001800)={0xffffffff, 0x2, 0x40000000000000}) syz_genetlink_get_family_id$nl802154(&(0x7f0000001840), r4) r5 = socket$can_raw(0x1d, 0x3, 0x1) recvmsg$can_raw(r5, &(0x7f0000001a80)={&(0x7f0000001880)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, 0x80, &(0x7f0000001a40)=[{&(0x7f0000001900)=""/189, 0xbd}, {&(0x7f00000019c0)=""/110, 0x6e}], 0x2}, 0x10100) ioctl$IOCTL_GET_NCIDEV_IDX(0xffffffffffffffff, 0x0, &(0x7f0000001b00)=0x0) ioctl$IOCTL_GET_NCIDEV_IDX(0xffffffffffffffff, 0x0, &(0x7f0000001b40)=0x0) sendmsg$NFC_CMD_ENABLE_SE(0xffffffffffffffff, &(0x7f0000001c00)={&(0x7f0000001ac0)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000001bc0)={&(0x7f0000001b80)={0x2c, 0x0, 0x400, 0x70bd28, 0x25dfdbfe, {}, [@NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r6}, @NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r7}, @NFC_ATTR_SE_INDEX={0x8, 0x15, 0x1}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000}, 0x4000008) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000001c40)={'pim6reg1\x00', 0x0}) setsockopt$inet6_IPV6_ADDRFORM(r2, 0x29, 0x1, &(0x7f0000001c80), 0x4) read$nci(r3, &(0x7f0000001cc0)=""/86, 0x56) sendmsg$NLBL_MGMT_C_VERSION(r4, &(0x7f0000001e40)={&(0x7f0000001d40)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000001e00)={&(0x7f0000001d80)={0x74, 0x0, 0x400, 0x70bd2c, 0x25dfdbfd, {}, [@NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @broadcast}, @NLBL_MGMT_A_FAMILY={0x6, 0xb, 0x1f}, @NLBL_MGMT_A_IPV6MASK={0x14, 0x6, @private1={0xfc, 0x1, '\x00', 0x1}}, @NLBL_MGMT_A_IPV6MASK={0x14, 0x6, @private0={0xfc, 0x0, '\x00', 0x1}}, @NLBL_MGMT_A_CV4DOI={0x8, 0x4, 0x3}, @NLBL_MGMT_A_CLPDOI={0x8, 0xc, 0x1}, @NLBL_MGMT_A_DOMAIN={0x5, 0x1, '\x00'}, @NLBL_MGMT_A_CLPDOI={0x8, 0xc, 0x3}, @NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @private=0xa010101}]}, 0x74}, 0x1, 0x0, 0x0, 0x8080}, 0x8088) r9 = syz_genetlink_get_family_id$nfc(&(0x7f0000001ec0), r4) sendmsg$NFC_CMD_FW_DOWNLOAD(r4, &(0x7f0000001fc0)={&(0x7f0000001e80)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000001f80)={&(0x7f0000001f00)={0x4c, r9, 0x400, 0x70bd26, 0x25dfdbfc, {}, [@NFC_ATTR_FIRMWARE_NAME={0x11, 0x14, ']#i/.#-*\xe0$()['}, @NFC_ATTR_FIRMWARE_NAME={0x4}, @NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r7}, @NFC_ATTR_FIRMWARE_NAME={0xe, 0x14, 'NLBL_MGMT\x00'}, @NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r6}]}, 0x4c}, 0x1, 0x0, 0x0, 0x5}, 0x8001) r10 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r10, 0x89f1, &(0x7f0000002080)={'syztnl2\x00', &(0x7f0000002000)={'ip6gre0\x00', r8, 0x2f, 0x2d, 0x9, 0x7ff, 0x8, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @private0, 0x8000, 0x80, 0x1, 0x10000}}) getsockopt$WPAN_WANTACK(0xffffffffffffffff, 0x0, 0x0, &(0x7f00000020c0), &(0x7f0000002100)=0x4) 588.356535ms ago: executing program 4 (id=19501): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000100)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x7, &(0x7f00000000c0)="f8ffffff", 0x4) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000640)=@newlink={0x3c, 0x10, 0x437, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x4048b}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ipvlan={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPVLAN_MODE={0x6, 0x1, 0x2}]}}}]}, 0x3c}}, 0x0) 566.543864ms ago: executing program 7 (id=19502): select(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd) r0 = socket$can_raw(0x1d, 0x3, 0x1) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x3, 0x3, &(0x7f0000000140)=@framed={{0x18, 0x2, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x4}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3}, 0x94) r1 = bpf$BPF_BTF_LOAD(0x12, &(0x7f00000002c0)={&(0x7f00000000c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x18, 0x18, 0x8, [@fwd={0x7}, @ptr={0xd, 0x0, 0x0, 0x2, 0x2}]}, {0x0, [0x2e, 0x20, 0x5f, 0x0, 0x61, 0x5f]}}, &(0x7f0000000240)=""/118, 0x38, 0x76, 0x1, 0x5, 0x10000}, 0x28) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=@base={0x3, 0x4, 0x1, 0x9, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, r1}, 0x50) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)=@base={0xd, 0x9, 0x4, 0x1, 0x0, r2}, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000008c0)={{r3, 0xffffffffffffffff}, &(0x7f0000000840), &(0x7f0000000880)=r2}, 0x20) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000180)={r4, &(0x7f0000000d40), 0x0}, 0x20) getsockopt$CAN_RAW_FILTER(r0, 0x65, 0x1, &(0x7f0000000100)=[{}], &(0x7f0000000180)=0x8) clock_gettime(0x0, &(0x7f0000000040)) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) setsockopt$SO_VM_SOCKETS_CONNECT_TIMEOUT_OLD(0xffffffffffffffff, 0x28, 0x6, &(0x7f0000000000)={r5, r6/1000+10000}, 0xc0836d012a549f1f) 343.845992ms ago: executing program 4 (id=19503): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={0x0}, 0x1, 0x0, 0x0, 0x4000811}, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=@newtaction={0x70, 0x30, 0x1, 0x70bd28, 0x0, {}, [{0x5c, 0x1, [@m_simple={0x58, 0x1, 0x0, 0x0, {{0xb}, {0x2c, 0x2, 0x0, 0x1, [@TCA_DEF_PARMS={0x18, 0x2, {0x2, 0xfffffff8, 0x1, 0x9, 0x7}}, @TCA_DEF_DATA={0xd, 0x3, ')+@$(:(\\\x00'}]}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x2, 0x3}}}}]}]}, 0x70}, 0x1, 0x0, 0x0, 0x4}, 0x0) sendmmsg(r0, &(0x7f00000002c0), 0x40000000000009f, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000800), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_REG(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=ANY=[], 0x28}, 0x1, 0x0, 0x0, 0x20000810}, 0x24000000) 321.906994ms ago: executing program 0 (id=19504): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)={{0x14}, [], {0x14}}, 0x28}}, 0x0) 215.482423ms ago: executing program 4 (id=19505): r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x35288}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ipip6={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPTUN_ENCAP_SPORT={0x6, 0x11, 0x4e21}]}}}]}, 0x3c}, 0x1, 0x0, 0x1100}, 0x4000080) 169.246099ms ago: executing program 7 (id=19506): r0 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) r1 = socket(0x15, 0x5, 0x0) setsockopt$inet6_tcp_int(r1, 0x10f, 0x0, 0x0, 0x0) (async) sendmsg$ETHTOOL_MSG_RINGS_GET(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000500)={0x14, r0, 0xb01, 0x70bd2d}, 0x14}}, 0x0) (async) r2 = socket$xdp(0x2c, 0x3, 0x0) (async) r3 = socket$netlink(0x10, 0x3, 0x0) (async) r4 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r4, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) (async) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r5, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c0002000800010006"], 0x3c}}, 0x0) (async) r6 = socket$nl_route(0x10, 0x3, 0x0) (async) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000018c0)={&(0x7f00000000c0)=@newlink={0x40, 0x10, 0x405, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @erspan={{0xb}, {0x10, 0x2, 0x0, 0x1, [@IFLA_GRE_COLLECT_METADATA={0x4}, @IFLA_GRE_ERSPAN_INDEX={0x8}]}}}]}, 0x40}}, 0x0) (async) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=@newlink={0x48, 0x10, 0x403, 0x70bd27, 0x0, {0x0, 0x0, 0x0, 0x0, 0x90446}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @vlan={{0x9}, {0x10, 0x2, 0x0, 0x1, [@IFLA_VLAN_ID={0x6, 0x1, 0x1}, @IFLA_VLAN_EGRESS_QOS={0x4}]}}}, @IFLA_LINK={0x8, 0x5, r8}]}, 0x48}, 0x1, 0x0, 0x0, 0x20000600}, 0x0) (async) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000280)=@newlink={0x58, 0x10, 0xffffff1f, 0x0, 0x1, {0x0, 0x0, 0x0, 0x0, 0x0, 0x4408}, [@IFLA_LINKINFO={0x30, 0x12, 0x0, 0x1, @geneve={{0xb}, {0x20, 0x2, 0x0, 0x1, [@IFLA_GENEVE_REMOTE6={0x14, 0x7, @loopback}, @IFLA_GENEVE_TOS={0x5, 0x4, 0x1}]}}}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x58}, 0x1, 0x0, 0x0, 0x40000}, 0x0) (async) getsockopt$XDP_STATISTICS(r2, 0x11b, 0x7, 0xffffffffffffffff, &(0x7f0000000080)=0x20) r9 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r10 = socket$nl_generic(0x10, 0x3, 0x10) bind$netlink(r10, &(0x7f00000000c0)={0x10, 0x0, 0x25dfdbff, 0x2000000}, 0xc) (async) sendmsg$NLBL_UNLABEL_C_STATICADD(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={0x0}, 0x8, 0x3000000000002}, 0x0) 167.182881ms ago: executing program 0 (id=19507): r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @local}, 0x2, 0x0, 0x0, 0x4004}}, 0x2e) (async) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x275a, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r3, 0x0) (async) ioctl$FS_IOC_FSSETXATTR(r2, 0x401c5820, 0x0) (async) bind$unix(0xffffffffffffffff, &(0x7f0000000100)=@abs={0x1, 0x0, 0x4e20}, 0x1c) (async) socket(0x11, 0xa, 0x0) (async) bind$alg(0xffffffffffffffff, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ctr-aes-aesni\x00'}, 0x58) (async) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) (async) r4 = accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) sendmsg$alg(r4, &(0x7f0000000780)={0x0, 0x0, &(0x7f0000000580)=[{&(0x7f00000002c0)="26fe", 0x2}], 0x1, 0x0, 0x0, 0x40010}, 0x0) (async) recvmsg(r4, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/65, 0x41}], 0x1}, 0x10103) (async) r5 = socket$unix(0x1, 0x2, 0x0) bind$unix(r5, &(0x7f0000000100)=@abs={0x1, 0x0, 0x4e20}, 0x6e) (async) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r6 = socket$rds(0x15, 0x5, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(r6, 0x114, 0x3f, &(0x7f0000000780)={0x3, "4cff3f"}, 0x4) (async) r7 = socket$unix(0x1, 0x2, 0x0) bind$unix(r7, &(0x7f0000000100)=@abs={0x1, 0x0, 0x4e20}, 0x1c) (async) connect$inet6(r1, &(0x7f0000000180)={0xa, 0x4e1d, 0x0, @empty, 0x61}, 0x1c) socket$nl_xfrm(0x10, 0x3, 0x6) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$ethtool(&(0x7f0000000400), 0xffffffffffffffff) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x12, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41100, 0x8, '\x00', 0x0, @fallback=0x8, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x1000000}, 0x94) (async) bpf$BPF_GET_PROG_INFO(0xa, 0x0, 0x0) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) r8 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r8, 0x107, 0x12, &(0x7f0000000000)={0x0, 0x8000}, 0x4) 65.33657ms ago: executing program 4 (id=19508): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nfc(&(0x7f0000000040), r0) sendmsg$NFC_CMD_DEP_LINK_UP(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="01002abd7000fbdbdf250400000006000a006b983800080001"], 0x24}, 0x1, 0x0, 0x0, 0x40080c0}, 0x8000) bind$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0xe22, 0x0, @local}, 0x1c) socket$netlink(0x10, 0x3, 0x4) writev(0xffffffffffffffff, &(0x7f0000000040), 0x0) 4.461568ms ago: executing program 0 (id=19509): socket$nl_generic(0x10, 0x3, 0x10) (async) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x14, r1, 0x1, 0x0, 0x0, {0x5}}, 0x14}}, 0x0) sendmsg$L2TP_CMD_SESSION_DELETE(r0, &(0x7f00000002c0)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x30, r1, 0x1, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_ENCAP_TYPE={0x6}, @L2TP_ATTR_COOKIE={0xc}, @L2TP_ATTR_MTU={0x6, 0x1c, 0xd}]}, 0x30}, 0x1, 0x0, 0x0, 0x40000}, 0x4000) (async) sendmsg$L2TP_CMD_SESSION_DELETE(r0, &(0x7f00000002c0)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x30, r1, 0x1, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_ENCAP_TYPE={0x6}, @L2TP_ATTR_COOKIE={0xc}, @L2TP_ATTR_MTU={0x6, 0x1c, 0xd}]}, 0x30}, 0x1, 0x0, 0x0, 0x40000}, 0x4000) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000540), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_STRSET_GET(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000780)={0x28, r3, 0x1, 0x400000, 0x25dfdbfc, {}, [@ETHTOOL_A_STRSET_HEADER={0x4}, @ETHTOOL_A_STRSET_STRINGSETS={0x10, 0x2, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x1}]}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x8000}, 0x2000c050) (async) sendmsg$ETHTOOL_MSG_STRSET_GET(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000780)={0x28, r3, 0x1, 0x400000, 0x25dfdbfc, {}, [@ETHTOOL_A_STRSET_HEADER={0x4}, @ETHTOOL_A_STRSET_STRINGSETS={0x10, 0x2, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x1}]}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x8000}, 0x2000c050) ioctl$sock_SIOCGIFVLAN_GET_VLAN_REALDEV_NAME_CMD(r0, 0x8982, &(0x7f0000000040)={0x8, 'syzkaller0\x00', {'vcan0\x00'}, 0x13}) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f00000006c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_TID_CONFIG(r4, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000bc0)={&(0x7f0000000040)={0x2c, r5, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r6}, @void}}, [@NL80211_ATTR_TID_CONFIG={0x10, 0x11d, 0x0, 0x1, [{0xc, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_TIDS={0x6, 0x5, 0x59}]}]}]}, 0x2c}}, 0x0) (async) sendmsg$NL80211_CMD_SET_TID_CONFIG(r4, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000bc0)={&(0x7f0000000040)={0x2c, r5, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r6}, @void}}, [@NL80211_ATTR_TID_CONFIG={0x10, 0x11d, 0x0, 0x1, [{0xc, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_TIDS={0x6, 0x5, 0x59}]}]}]}, 0x2c}}, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f00000006c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r7, 0x8933, &(0x7f0000000000)={'wlan0\x00'}) (async) ioctl$sock_SIOCGIFINDEX_80211(r7, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_TID_CONFIG(r7, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000bc0)={&(0x7f0000000040)={0x2c, r8, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r9}, @void}}, [@NL80211_ATTR_TID_CONFIG={0x10, 0x11d, 0x0, 0x1, [{0xc, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_TIDS={0x6, 0x5, 0x59}]}]}]}, 0x2c}}, 0x0) sendmsg$NL80211_CMD_SET_POWER_SAVE(r0, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x64, r5, 0x401, 0x70bd2d, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r9}, @void}}, [@NL80211_ATTR_PS_STATE={0x8}, @NL80211_ATTR_PS_STATE={0x8, 0x5d, 0x1}, @NL80211_ATTR_PS_STATE={0x8}, @NL80211_ATTR_PS_STATE={0x8}, @NL80211_ATTR_PS_STATE={0x8}, @NL80211_ATTR_PS_STATE={0x8}, @NL80211_ATTR_PS_STATE={0x8, 0x5d, 0x1}, @NL80211_ATTR_PS_STATE={0x8, 0x5d, 0x1}, @NL80211_ATTR_PS_STATE={0x8}]}, 0x64}}, 0x4000890) 0s ago: executing program 4 (id=19510): sendmsg$NFNL_MSG_ACCT_GET(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="74000000010701030000000000000000030000040900010073797a3100000000540007800800024000000002080002400000b55a0800014000000001080001400000000108000240000000070800014000000006080001400000000808000240ffffdfda0800014000e000000806"], 0x74}, 0x1, 0x0, 0x0, 0x4000010}, 0x8000) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=ANY=[@ANYBLOB="3c0000004900010000000000000000000a000000000000eb00000000141001"], 0x3c}, 0x1, 0x0, 0x0, 0x800400d}, 0x8001) socket$kcm(0x10, 0x2, 0x10) (async) r0 = socket$kcm(0x10, 0x2, 0x10) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000070000040900010073797a30000000009c000000090a010400000000000000000700000308000a40000000000900020073797a30000000000900010073797a3000000000080005400000000d58001280200001800e000100636f6e6e6c696d69740000000c0002800800014000000008200001800e000100636f6e6e6c696d69740000000c00028008000140000000001400017b090001006cdbf80789f3f947dd000280080003"], 0xe4}, 0x1, 0x0, 0x0, 0x8001}, 0x20050841) socket$kcm(0x29, 0x5, 0x0) (async) socket$kcm(0x29, 0x5, 0x0) r1 = socket$inet6(0xa, 0x3, 0x1) setsockopt$inet6_int(r1, 0x29, 0x5, 0x0, 0x0) r2 = socket(0x23, 0x5, 0x0) ioctl$sock_inet6_tcp_SIOCINQ(r2, 0x541b, &(0x7f0000000000)) syz_genetlink_get_family_id$gtp(&(0x7f0000000100), r2) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0xd18c9b25, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f030041000b05d25a806c8c6394f90324fc60100000000a000200053582c137153e3704020180fc5409000c00", 0x33fe0}], 0x1}, 0x0) (async) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0xd18c9b25, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f030041000b05d25a806c8c6394f90324fc60100000000a000200053582c137153e3704020180fc5409000c00", 0x33fe0}], 0x1}, 0x0) kernel console output (not intermixed with test programs): k_sendmsg+0x10/0x10 [ 845.336172][T19112] ____sys_sendmsg+0x9b9/0xa20 [ 845.336204][T19112] ? __pfx_____sys_sendmsg+0x10/0x10 [ 845.336240][T19112] ? lock_release+0x4b/0x3c0 [ 845.336268][T19112] ? import_iovec+0x73/0xa0 [ 845.336295][T19112] ___sys_sendmsg+0x2a5/0x360 [ 845.336320][T19112] ? rcu_is_watching+0x15/0xb0 [ 845.336338][T19112] ? get_pid_task+0x20/0x1f0 [ 845.336357][T19112] ? __pfx____sys_sendmsg+0x10/0x10 [ 845.336387][T19112] ? rcu_is_watching+0x15/0xb0 [ 845.336421][T19112] ? __fget_files+0x2a/0x420 [ 845.336442][T19112] ? __fget_files+0x3a2/0x420 [ 845.336469][T19112] __x64_sys_sendmsg+0x1b1/0x290 [ 845.336497][T19112] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 845.336534][T19112] ? rcu_is_watching+0x15/0xb0 [ 845.336554][T19112] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 845.336574][T19112] do_syscall_64+0x174/0x580 [ 845.336600][T19112] ? trace_irq_disable+0x3b/0x140 [ 845.336626][T19112] ? clear_bhb_loop+0x40/0x90 [ 845.336646][T19112] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 845.336665][T19112] RIP: 0033:0x7ff1f8f9ce59 [ 845.336682][T19112] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 845.336700][T19112] RSP: 002b:00007ff1f9edf028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 845.336721][T19112] RAX: ffffffffffffffda RBX: 00007ff1f9215fa0 RCX: 00007ff1f8f9ce59 [ 845.336735][T19112] RDX: 000000002400c000 RSI: 00002000000003c0 RDI: 0000000000000003 [ 845.336761][T19112] RBP: 00007ff1f9edf090 R08: 0000000000000000 R09: 0000000000000000 [ 845.336773][T19112] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 845.336785][T19112] R13: 00007ff1f9216038 R14: 00007ff1f9215fa0 R15: 00007ffe0e757048 [ 845.336827][T19112] [ 845.617718][T19120] netlink: 20 bytes leftover after parsing attributes in process `syz.4.18002'. [ 845.781925][T19133] netlink: 44 bytes leftover after parsing attributes in process `syz.5.18009'. [ 845.996440][T19155] FAULT_INJECTION: forcing a failure. [ 845.996440][T19155] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 846.027274][T19155] CPU: 1 UID: 0 PID: 19155 Comm: syz.5.18015 Not tainted syzkaller #0 PREEMPT(full) [ 846.027301][T19155] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 846.027314][T19155] Call Trace: [ 846.027322][T19155] [ 846.027331][T19155] dump_stack_lvl+0xe8/0x150 [ 846.027358][T19155] should_fail_ex+0x40c/0x560 [ 846.027382][T19155] _copy_from_iter+0x1d3/0x1660 [ 846.027408][T19155] ? rcu_is_watching+0x15/0xb0 [ 846.027433][T19155] ? __pfx__copy_from_iter+0x10/0x10 [ 846.027456][T19155] ? kmem_cache_alloc_node_noprof+0x3ca/0x680 [ 846.027489][T19155] ? netlink_sendmsg+0x650/0xb40 [ 846.027508][T19155] ? skb_put+0x112/0x210 [ 846.027538][T19155] netlink_sendmsg+0x6c0/0xb40 [ 846.027563][T19155] ? __pfx_netlink_sendmsg+0x10/0x10 [ 846.027596][T19155] ? aa_sock_msg_perm+0xf1/0x1b0 [ 846.027619][T19155] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 846.027643][T19155] ? __pfx_netlink_sendmsg+0x10/0x10 [ 846.027675][T19155] ____sys_sendmsg+0x9b9/0xa20 [ 846.027711][T19155] ? __pfx_____sys_sendmsg+0x10/0x10 [ 846.027741][T19155] ? lock_release+0x4b/0x3c0 [ 846.027773][T19155] ? import_iovec+0x73/0xa0 [ 846.027801][T19155] ___sys_sendmsg+0x2a5/0x360 [ 846.027829][T19155] ? rcu_is_watching+0x15/0xb0 [ 846.027848][T19155] ? get_pid_task+0x20/0x1f0 [ 846.027869][T19155] ? __pfx____sys_sendmsg+0x10/0x10 [ 846.027901][T19155] ? rcu_is_watching+0x15/0xb0 [ 846.027940][T19155] ? __fget_files+0x2a/0x420 [ 846.027962][T19155] ? __fget_files+0x3a2/0x420 [ 846.027991][T19155] __x64_sys_sendmsg+0x1b1/0x290 [ 846.028022][T19155] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 846.028065][T19155] ? rcu_is_watching+0x15/0xb0 [ 846.028086][T19155] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 846.028107][T19155] do_syscall_64+0x174/0x580 [ 846.028143][T19155] ? trace_irq_disable+0x3b/0x140 [ 846.028171][T19155] ? clear_bhb_loop+0x40/0x90 [ 846.028193][T19155] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 846.028213][T19155] RIP: 0033:0x7ff1f8f9ce59 [ 846.028231][T19155] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 846.028248][T19155] RSP: 002b:00007ff1f9edf028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 846.028270][T19155] RAX: ffffffffffffffda RBX: 00007ff1f9215fa0 RCX: 00007ff1f8f9ce59 [ 846.028285][T19155] RDX: 000000002400c000 RSI: 00002000000003c0 RDI: 0000000000000003 [ 846.028298][T19155] RBP: 00007ff1f9edf090 R08: 0000000000000000 R09: 0000000000000000 [ 846.028310][T19155] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 846.028322][T19155] R13: 00007ff1f9216038 R14: 00007ff1f9215fa0 R15: 00007ffe0e757048 [ 846.028365][T19155] [ 846.400883][T19162] netlink: 8 bytes leftover after parsing attributes in process `syz.2.18018'. [ 846.584453][T19176] netlink: 'syz.2.18025': attribute type 1 has an invalid length. [ 846.616070][T19176] bond34: entered promiscuous mode [ 846.621639][T19176] 8021q: adding VLAN 0 to HW filter on device bond34 [ 846.668905][T19182] netlink: 196 bytes leftover after parsing attributes in process `syz.5.18027'. [ 846.693522][T19182] sctp: [Deprecated]: syz.5.18027 (pid 19182) Use of int in max_burst socket option deprecated. [ 846.693522][T19182] Use struct sctp_assoc_value instead [ 846.803673][T19193] netlink: 212348 bytes leftover after parsing attributes in process `syz.5.18034'. [ 846.819748][T19193] net_ratelimit: 79 callbacks suppressed [ 846.819767][T19193] netlink: ct family unspecified [ 847.128479][T19222] netlink: 'syz.4.18044': attribute type 22 has an invalid length. [ 847.142858][T19222] netlink: 4 bytes leftover after parsing attributes in process `syz.4.18044'. [ 847.154750][T19222] netlink: 'syz.4.18044': attribute type 22 has an invalid length. [ 847.169862][T19222] netlink: 4 bytes leftover after parsing attributes in process `syz.4.18044'. [ 847.173031][T19224] netlink: 8 bytes leftover after parsing attributes in process `syz.5.18045'. [ 847.223127][T19231] netlink: ct family unspecified [ 847.435950][ T4939] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1 [ 847.443376][ T4939] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9 [ 847.452729][ T4939] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9 [ 847.465896][ T4939] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4 [ 847.477082][ T4939] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2 [ 847.519409][T19253] 8021q: VLANs not supported on gre0 [ 847.706330][T19265] netlink: ct family unspecified [ 847.967953][T19247] lo speed is unknown, defaulting to 1000 [ 847.989922][T19247] C speed is unknown, defaulting to 1000 [ 848.010855][T19247] C speed is unknown, defaulting to 1000 [ 848.220223][T19307] bridge32: entered promiscuous mode [ 848.248580][T19307] bridge32: entered allmulticast mode [ 848.269656][T19313] __nla_validate_parse: 13 callbacks suppressed [ 848.269675][T19313] netlink: 212408 bytes leftover after parsing attributes in process `syz.2.18071'. [ 848.810489][T19247] bridge0: port 1(bridge_slave_0) entered blocking state [ 848.817724][T19247] bridge0: port 1(bridge_slave_0) entered disabled state [ 848.825211][T19247] bridge_slave_0: entered allmulticast mode [ 848.832501][T19247] bridge_slave_0: entered promiscuous mode [ 848.841296][T19247] bridge0: port 2(bridge_slave_1) entered blocking state [ 848.848683][T19247] bridge0: port 2(bridge_slave_1) entered disabled state [ 848.855911][T19247] bridge_slave_1: entered allmulticast mode [ 848.863333][T19247] bridge_slave_1: entered promiscuous mode [ 848.889614][T19247] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 848.902201][T19247] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 848.937582][T19247] team0: Port device team_slave_0 added [ 848.945453][T19247] team0: Port device team_slave_1 added [ 848.967847][T19247] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 848.975847][T19247] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 849.013563][T19247] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 849.036454][T19356] bond0: Caught tx_queue_len zero misconfig [ 849.064952][T19247] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 849.075784][T19247] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 849.131752][T19247] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 849.182690][T19363] netlink: 'syz.2.18084': attribute type 1 has an invalid length. [ 849.212495][T19247] hsr_slave_0: entered promiscuous mode [ 849.219398][T19247] hsr_slave_1: entered promiscuous mode [ 849.234031][T19247] debugfs: 'hsr0' already exists in 'hsr' [ 849.244785][T19369] netlink: 'syz.0.18086': attribute type 1 has an invalid length. [ 849.251318][T19247] Cannot create hsr debugfs directory [ 849.267540][T19363] workqueue: Failed to create a rescuer kthread for wq "bond35": -EINTR [ 849.382550][T19369] nbd: socks must be embedded in a SOCK_ITEM attr [ 849.514960][T19384] netlink: 'syz.4.18088': attribute type 4 has an invalid length. [ 849.549181][ T4939] Bluetooth: hci7: command tx timeout [ 849.657365][T19388] netlink: 28 bytes leftover after parsing attributes in process `syz.5.18091'. [ 849.669148][T19247] netdevsim netdevsim7 netdevsim0: renamed from eth0 [ 849.680707][T19247] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 849.699165][T19388] tipc: Enabled bearer , priority 0 [ 849.706742][T19247] netdevsim netdevsim7 netdevsim1: renamed from eth1 [ 849.716264][T19247] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 849.729082][T19247] netdevsim netdevsim7 netdevsim2: renamed from eth2 [ 849.745985][T19247] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 849.761254][T19388] syzkaller0: entered promiscuous mode [ 849.771033][T19388] syzkaller0: entered allmulticast mode [ 849.785960][T19247] netdevsim netdevsim7 netdevsim3: renamed from eth3 [ 849.815169][T19247] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 849.823816][T19402] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 849.853531][T19391] tipc: Resetting bearer [ 849.863747][T19388] netlink: 8 bytes leftover after parsing attributes in process `syz.5.18091'. [ 849.874638][T19391] netlink: 8 bytes leftover after parsing attributes in process `syz.5.18091'. [ 849.921906][T19387] tipc: Resetting bearer [ 849.959596][T19387] tipc: Disabling bearer [ 850.062696][T19420] netlink: 12 bytes leftover after parsing attributes in process `syz.2.18099'. [ 850.070946][T19247] 8021q: adding VLAN 0 to HW filter on device bond0 [ 850.111411][T19247] 8021q: adding VLAN 0 to HW filter on device team0 [ 850.132954][ T57] bridge0: port 1(bridge_slave_0) entered blocking state [ 850.140130][ T57] bridge0: port 1(bridge_slave_0) entered forwarding state [ 850.194865][ T57] bridge0: port 2(bridge_slave_1) entered blocking state [ 850.202097][ T57] bridge0: port 2(bridge_slave_1) entered forwarding state [ 850.353443][T19436] Can not set IPV6_FL_F_REFLECT if flowlabel_consistency sysctl is enable [ 850.505568][T19446] netlink: 'syz.0.18106': attribute type 8 has an invalid length. [ 850.562519][T19449] netlink: 'syz.4.18107': attribute type 11 has an invalid length. [ 850.572933][T19451] netlink: 12 bytes leftover after parsing attributes in process `syz.5.18105'. [ 850.607883][T19451] veth1_macvtap: left promiscuous mode [ 850.615766][T19451] macsec0: entered promiscuous mode [ 850.760982][T19457] veth0_to_team: entered promiscuous mode [ 850.779102][T19457] veth0_to_team: left promiscuous mode [ 850.803500][T19462] netlink: 28 bytes leftover after parsing attributes in process `syz.0.18108'. [ 850.852361][T19457] netlink: 8 bytes leftover after parsing attributes in process `syz.0.18108'. [ 850.941712][T19471] netlink: 12 bytes leftover after parsing attributes in process `syz.4.18112'. [ 851.050896][T19247] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 851.099720][T19483] netlink: 12 bytes leftover after parsing attributes in process `syz.4.18114'. [ 851.241334][T19496] mac80211_hwsim hwsim11 syzkaller0: entered promiscuous mode [ 851.249680][T19496] mac80211_hwsim hwsim11 syzkaller0: entered allmulticast mode [ 851.259402][T19496] tipc: Resetting bearer [ 851.483993][T19515] xt_ecn: cannot match TCP bits for non-tcp packets [ 851.500520][T19247] veth0_vlan: entered promiscuous mode [ 851.534801][T19247] veth1_vlan: entered promiscuous mode [ 851.614718][T19247] veth0_macvtap: entered promiscuous mode [ 851.628473][ T4939] Bluetooth: hci7: command tx timeout [ 851.659443][T19247] veth1_macvtap: entered promiscuous mode [ 851.698988][T19247] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 851.745541][T19247] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 851.759734][T19530] openvswitch: netlink: Invalid VLAN frame [ 851.791421][ T6574] netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 851.814149][ T6574] netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 851.836992][ T6574] netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 851.851457][ T6574] netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 851.882816][T19525] syzkaller0: entered promiscuous mode [ 851.889876][T19525] syzkaller0: entered allmulticast mode [ 851.904182][T19525] 0: reclassify loop, rule prio 0, protocol 800 [ 852.009703][T19539] ipvlan0: Caught tx_queue_len zero misconfig [ 852.068428][ T6580] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 852.097277][ T6580] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 852.114339][T19537] netlink: 'syz.4.18129': attribute type 11 has an invalid length. [ 852.170428][ T6578] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 852.185011][ T6578] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 852.206585][T19544] openvswitch: netlink: Message has 5 unknown bytes. [ 853.190191][T19573] gtp0: entered allmulticast mode [ 853.329188][T19589] netlink: 'syz.5.18139': attribute type 13 has an invalid length. [ 853.341914][T19589] macsec0: left promiscuous mode [ 853.346908][T19589] macsec0: entered allmulticast mode [ 853.405052][T19593] openvswitch: netlink: Key 6 has unexpected len 20 expected 2 [ 853.505300][T19600] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 853.708278][ T4939] Bluetooth: hci7: command tx timeout [ 855.170304][T19553] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 855.350679][T19617] netlink: 'syz.5.18150': attribute type 11 has an invalid length. [ 855.412070][T19617] __nla_validate_parse: 9 callbacks suppressed [ 855.412091][T19617] netlink: 224 bytes leftover after parsing attributes in process `syz.5.18150'. [ 855.446952][T19623] netlink: 12 bytes leftover after parsing attributes in process `syz.7.18153'. [ 855.514760][T19620] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 855.692155][T19637] netlink: 284 bytes leftover after parsing attributes in process `syz.7.18157'. [ 855.793958][ T4939] Bluetooth: hci7: command tx timeout [ 855.934485][T19646] netlink: 4 bytes leftover after parsing attributes in process `syz.4.18160'. [ 856.104267][T19670] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 856.136220][T19671] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 856.235842][T19677] Can not set IPV6_FL_F_REFLECT if flowlabel_consistency sysctl is enable [ 856.258420][T19674] netlink: 16 bytes leftover after parsing attributes in process `syz.2.18170'. [ 856.285867][T19674] : left promiscuous mode [ 856.375653][T19690] netlink: 8 bytes leftover after parsing attributes in process `syz.0.18176'. [ 856.396852][T19693] netlink: 'syz.7.18177': attribute type 1 has an invalid length. [ 856.480190][T19698] netlink: 12 bytes leftover after parsing attributes in process `syz.2.18180'. [ 856.818691][T19732] netlink: 36 bytes leftover after parsing attributes in process `syz.5.18190'. [ 856.842942][T19733] netlink: 'syz.5.18190': attribute type 75 has an invalid length. [ 856.871821][T19732] netlink: 8 bytes leftover after parsing attributes in process `syz.5.18190'. [ 856.892837][T19733] netlink: 8 bytes leftover after parsing attributes in process `syz.5.18190'. [ 856.904184][T19733] workqueue: Failed to create a rescuer kthread for wq "bond6": -EINTR [ 856.927332][T19743] netlink: 'syz.2.18192': attribute type 1 has an invalid length. [ 856.954333][T19743] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 857.119989][T19755] openvswitch: netlink: IP tunnel dst address not specified [ 857.215031][T19753] bond35: entered promiscuous mode [ 857.233741][T19753] 8021q: adding VLAN 0 to HW filter on device bond35 [ 857.270525][T19762] bridge37: entered promiscuous mode [ 857.281655][T19762] bond35: (slave bridge37): Enslaving as an active interface with an up link [ 857.484132][T19782] bond1: entered promiscuous mode [ 857.558479][T19793] openvswitch: netlink: Invalid VLAN frame [ 857.613974][T19792] tipc: Enabled bearer , priority 0 [ 857.621356][T19781] syzkaller0: entered promiscuous mode [ 857.626977][T19781] syzkaller0: entered allmulticast mode [ 857.635532][T19781] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 857.657428][T19781] tipc: Resetting bearer [ 857.696715][T19779] tipc: Resetting bearer [ 857.737065][T19779] tipc: Disabling bearer [ 857.752859][T19799] openvswitch: netlink: Invalid VLAN frame [ 857.825982][T19802] netlink: 'syz.5.18214': attribute type 8 has an invalid length. [ 858.130612][T19833] netlink: 'syz.4.18222': attribute type 4 has an invalid length. [ 858.226989][T19842] tipc: Enabling of bearer rejected, failed to enable media [ 858.281440][T19848] netlink: 'syz.4.18226': attribute type 1 has an invalid length. [ 858.424157][T19848] bond45: entered promiscuous mode [ 858.433019][T19861] xt_SECMARK: mode already set to 1 cannot mix with rules for mode 9 [ 858.447720][T19848] 8021q: adding VLAN 0 to HW filter on device bond45 [ 858.465818][T19852] bond45: (slave bridge33): making interface the new active one [ 858.481446][T19852] bridge33: entered promiscuous mode [ 858.491595][T19852] bond45: (slave bridge33): Enslaving as an active interface with an up link [ 858.529653][T19860] 0ªX¹¦Dö»: left promiscuous mode [ 858.554910][T19860] erspan0: left promiscuous mode [ 858.617450][T19860] 8021q: adding VLAN 0 to HW filter on device team0 [ 858.665569][T19860] 0·: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 858.677879][T19860] 0·: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 858.691159][T19860] 8021q: adding VLAN 0 to HW filter on device c0· [ 858.706875][T19860] virt_wifi0: entered promiscuous mode [ 858.734380][T19860] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 858.745869][T19860] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 858.764075][T19860] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 858.775563][T19860] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 858.787773][T19860] 8021q: adding VLAN 0 to HW filter on device batadv1 [ 858.801502][T19860] 8021q: adding VLAN 0 to HW filter on device bond1 [ 858.811418][T19860] 8021q: adding VLAN 0 to HW filter on device bond2 [ 858.824668][T19860] erspan0: entered promiscuous mode [ 858.837589][T19860] 8021q: adding VLAN 0 to HW filter on device bond3 [ 858.853740][T19860] gretap1: default qdisc (pfifo_fast) fail, fallback to noqueue [ 858.876561][T19860] 8021q: adding VLAN 0 to HW filter on device bond4 [ 858.900085][T19860] 8021q: adding VLAN 0 to HW filter on device bond5 [ 858.921271][T19860] 8021q: adding VLAN 0 to HW filter on device bond6 [ 858.940504][T19860] 8021q: adding VLAN 0 to HW filter on device bond7 [ 858.950653][T19860] 8021q: adding VLAN 0 to HW filter on device bond8 [ 858.959684][T19860] macvtap0: default qdisc (pfifo_fast) fail, fallback to noqueue [ 858.969589][T19860] 8021q: adding VLAN 0 to HW filter on device macvtap0 [ 858.979910][T19860] 8021q: adding VLAN 0 to HW filter on device bond9 [ 858.990302][T19860] 8021q: adding VLAN 0 to HW filter on device bond10 [ 859.000098][T19860] 8021q: adding VLAN 0 to HW filter on device bond11 [ 859.012388][T19860] 8021q: adding VLAN 0 to HW filter on device bond12 [ 859.025206][T19860] 8021q: adding VLAN 0 to HW filter on device bond13 [ 859.037242][T19860] 8021q: adding VLAN 0 to HW filter on device bond14 [ 859.046647][T19860] 0ªX¹¦Dö»: entered promiscuous mode [ 859.057562][T19860] 8021q: adding VLAN 0 to HW filter on device bond15 [ 859.074211][T19860] ip6erspan0: default qdisc (pfifo_fast) fail, fallback to noqueue [ 859.090180][T19860] 8021q: adding VLAN 0 to HW filter on device bond16 [ 859.101627][T19860] 8021q: adding VLAN 0 to HW filter on device bond17 [ 859.111900][T19860] 8021q: adding VLAN 0 to HW filter on device bond18 [ 859.123618][T19860] 8021q: adding VLAN 0 to HW filter on device bond19 [ 859.131567][T19860] macvtap1: default qdisc (pfifo_fast) fail, fallback to noqueue [ 859.140775][T19860] 8021q: adding VLAN 0 to HW filter on device macvtap1 [ 859.149078][T19860] macvtap2: default qdisc (pfifo_fast) fail, fallback to noqueue [ 859.157218][T19860] 8021q: adding VLAN 0 to HW filter on device macvtap2 [ 859.167929][T19860] erspan1: default qdisc (pfifo_fast) fail, fallback to noqueue [ 859.177974][T19860] 8021q: adding VLAN 0 to HW filter on device bond20 [ 859.186185][T19860] 8021q: adding VLAN 0 to HW filter on device bond21 [ 859.202946][T19860] 8021q: adding VLAN 0 to HW filter on device bond0 [ 859.214140][T19860] 8021q: adding VLAN 0 to HW filter on device bond22 [ 859.225857][T19860] 8021q: adding VLAN 0 to HW filter on device bond23 [ 859.238002][T19860] 8021q: adding VLAN 0 to HW filter on device bond24 [ 859.249118][T19860] 8021q: adding VLAN 0 to HW filter on device bond25 [ 859.262177][T19860] veth1: left promiscuous mode [ 859.338203][T11762] bridge11: entered promiscuous mode [ 859.349204][ T6578] netdevsim netdevsim0 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 859.366557][ T6578] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 859.381259][ T6578] netdevsim netdevsim0 netdevsim0: set [1, 1] type 2 family 0 port 256 - 0 [ 859.393657][ T6578] netdevsim netdevsim0 netdevsim0: set [1, 2] type 2 family 0 port 20000 - 0 [ 859.402999][ T6578] netdevsim netdevsim0 netdevsim0: set [1, 3] type 2 family 0 port 27669 - 0 [ 859.429856][ T6578] netdevsim netdevsim0 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 859.470615][ T6578] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 859.493130][ T6578] netdevsim netdevsim0 netdevsim1: set [1, 1] type 2 family 0 port 256 - 0 [ 859.502104][ T6578] netdevsim netdevsim0 netdevsim1: set [1, 2] type 2 family 0 port 20000 - 0 [ 859.511715][ T6578] netdevsim netdevsim0 netdevsim1: set [1, 3] type 2 family 0 port 27669 - 0 [ 859.527907][T19876] debugfs: 'KŠŸu ™crµ±K:‘£ÿˆÌ¥ÝBßÝ£| “¼ÚÞlS·œ-!' already exists in 'ieee80211' [ 859.582338][ T6578] netdevsim netdevsim0 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 859.596508][ T6578] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 859.612199][ T6578] netdevsim netdevsim0 netdevsim2: set [1, 1] type 2 family 0 port 256 - 0 [ 859.621904][ T6578] netdevsim netdevsim0 netdevsim2: set [1, 2] type 2 family 0 port 20000 - 0 [ 859.631232][ T6578] netdevsim netdevsim0 netdevsim2: set [1, 3] type 2 family 0 port 27669 - 0 [ 859.642176][ T6578] netdevsim netdevsim0 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 859.664751][ T6578] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 859.674445][ T6578] netdevsim netdevsim0 netdevsim3: set [1, 1] type 2 family 0 port 256 - 0 [ 859.683546][ T6578] netdevsim netdevsim0 netdevsim3: set [1, 2] type 2 family 0 port 20000 - 0 [ 859.693096][ T6578] netdevsim netdevsim0 netdevsim3: set [1, 3] type 2 family 0 port 27669 - 0 [ 859.721004][T19892] geneve7: entered promiscuous mode [ 859.734044][T23308] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 859.749375][T23308] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 859.766192][T24759] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 859.775651][T23308] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 859.790200][T13957] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 859.809505][T23308] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 859.823060][T13957] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 859.856305][T11762] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 859.868677][T23308] ip6_tunnel: ip6gre3 xmit: Local address not yet configured! [ 859.893091][T23308] ip6_tunnel: ip6gre3 xmit: Local address not yet configured! [ 859.989159][ T6578] bond12: (slave veth13): link status definitely up, 10000 Mbps full duplex [ 859.998038][ T6578] bond12: (slave veth13): making interface the new active one [ 860.007068][ T6578] bond12: active interface up! [ 860.194777][T19917] can: request_module (can-proto-0) failed. [ 860.326686][T19930] xt_ecn: cannot match TCP bits for non-tcp packets [ 860.340228][T19934] xt_SECMARK: mode already set to 1 cannot mix with rules for mode 9 [ 860.419479][T19936] __nla_validate_parse: 17 callbacks suppressed [ 860.419497][T19936] netlink: 4 bytes leftover after parsing attributes in process `syz.2.18258'. [ 860.464680][T19936] openvswitch: netlink: Flow actions attr not present in new flow. [ 860.507749][T19944] netlink: 'syz.7.18259': attribute type 39 has an invalid length. [ 860.583733][T19947] netlink: 8 bytes leftover after parsing attributes in process `syz.0.18261'. [ 860.645679][T19947] bond26: invalid ARP target 0.0.0.0 specified for addition [ 860.653463][T19947] bond26: option arp_ip_target: invalid value (0) [ 860.677527][T19947] bond26 (unregistering): Released all slaves [ 860.691354][T19957] netlink: 'syz.5.18265': attribute type 49 has an invalid length. [ 860.736316][T19958] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 860.765738][T19952] mac80211_hwsim hwsim11 syzkaller0: left promiscuous mode [ 860.849990][T19967] IPVS: set_ctl: invalid protocol: 255 10.1.1.0:20002 [ 860.863358][T19967] ip6t_REJECT: TCP_RESET illegal for non-tcp [ 860.896768][T19961] syzkaller0: create flow: hash 3895855652 index 1 [ 860.968794][T19977] : entered promiscuous mode [ 860.977579][T19979] netlink: 156 bytes leftover after parsing attributes in process `syz.5.18271'. [ 861.064491][T19981] netlink: 4 bytes leftover after parsing attributes in process `syz.2.18273'. [ 861.091310][T19981] openvswitch: netlink: Flow actions attr not present in new flow. [ 861.173545][T19991] netlink: 8 bytes leftover after parsing attributes in process `syz.2.18275'. [ 861.281171][T19998] : entered promiscuous mode [ 861.289298][T19997] netlink: 8 bytes leftover after parsing attributes in process `syz.4.18278'. [ 861.304882][T19997] netlink: 4 bytes leftover after parsing attributes in process `syz.4.18278'. [ 861.359447][ T6580] syzkaller0: tun_net_xmit 76 [ 861.374006][ T6580] syzkaller0: tun_net_xmit 48 [ 861.390058][T15494] syzkaller0: tun_net_xmit 76 [ 861.440543][T20005] netlink: 80 bytes leftover after parsing attributes in process `syz.0.18281'. [ 861.485723][T19997] netlink: 28 bytes leftover after parsing attributes in process `syz.4.18278'. [ 861.507596][T20010] netlink: 24 bytes leftover after parsing attributes in process `syz.2.18283'. [ 861.520413][T19997] netlink: 'syz.4.18278': attribute type 3 has an invalid length. [ 861.524001][T20010] netlink: 'syz.2.18283': attribute type 83 has an invalid length. [ 861.566917][T19960] syzkaller0: delete flow: hash 3895855652 index 1 [ 861.714236][T20020] openvswitch: netlink: Invalid VLAN frame [ 861.869434][T20033] netlink: 'syz.4.18291': attribute type 5 has an invalid length. [ 862.080070][T20049] SET target dimension over the limit! [ 862.176161][T20056] netlink: ct family unspecified [ 862.249010][T20067] IPVS: length: 4096 != 24 [ 862.272462][T20067] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 863.172366][T20142] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 863.223587][T20152] netlink: 'syz.5.18332': attribute type 33 has an invalid length. [ 863.316461][T20152] bond6: option broadcast_neighbor: mode dependency failed, not supported in mode balance-rr(0) [ 863.336852][T20152] bond6 (unregistering): Released all slaves [ 863.432277][T20161] macvtap3: entered promiscuous mode [ 863.463428][T20161] macvtap3: entered allmulticast mode [ 863.471209][T20161] 0ªX¹¦Dö»: entered allmulticast mode [ 863.534546][T20166] macvtap4: entered promiscuous mode [ 863.541884][T20166] macvtap4: entered allmulticast mode [ 863.704712][T20189] geneve6: entered promiscuous mode [ 864.126484][T20219] netlink: 'syz.4.18353': attribute type 8 has an invalid length. [ 864.150037][T20220] openvswitch: netlink: Invalid VLAN frame [ 864.260743][T20222] bond2: entered promiscuous mode [ 864.266238][T20222] 8021q: adding VLAN 0 to HW filter on device bond2 [ 864.317971][T20228] bridge1: entered promiscuous mode [ 864.361201][T20228] bond2: (slave bridge1): Enslaving as an active interface with an up link [ 864.574192][T20250] tipc: Enabling of bearer rejected, failed to enable media [ 864.614759][T20247] tipc: Enabling of bearer rejected, already enabled [ 864.648137][T20247] mac80211_hwsim hwsim11 syzkaller0: entered promiscuous mode [ 864.683871][T20249] bond3: (slave ip6gretap1): making interface the new active one [ 864.711050][T20249] bond3: (slave ip6gretap1): Enslaving as an active interface with an up link [ 864.763253][T20252] sch_tbf: burst 255 is lower than device syzkaller0 mtu (313) ! [ 864.797672][T20262] C: renamed from lo [ 864.806908][T20258] netlink: 'syz.2.18363': attribute type 61 has an invalid length. [ 864.832861][ T1328] aoe: packet could not be sent on ipvlan1. consider increasing tx_queue_len [ 864.859895][T20262] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check. [ 865.259801][ T4939] block nbd7: Receive control failed (result -32) [ 865.373416][T20299] mac80211_hwsim hwsim11 syzkaller0: left promiscuous mode [ 865.405165][T20299] mac80211_hwsim hwsim11 syzkaller0: left allmulticast mode [ 865.458425][T20315] bridge0: port 1(bridge_slave_0) entered disabled state [ 865.499720][T20315] bridge_slave_0 (unregistering): left allmulticast mode [ 865.525613][T20315] bridge_slave_0 (unregistering): left promiscuous mode [ 865.576785][T20315] bridge0: port 1(bridge_slave_0) entered disabled state [ 865.590933][T20319] __nla_validate_parse: 33 callbacks suppressed [ 865.590954][T20319] netlink: 12 bytes leftover after parsing attributes in process `syz.0.18385'. [ 865.709917][T20319] bond27: entered promiscuous mode [ 865.737631][T20319] 8021q: adding VLAN 0 to HW filter on device bond27 [ 865.857748][T20324] bridge26: entered promiscuous mode [ 865.872131][T20324] bond27: (slave bridge26): Enslaving as an active interface with an up link [ 865.906452][T20336] netlink: 'syz.7.18390': attribute type 3 has an invalid length. [ 865.907430][T20339] IPVS: set_ctl: invalid protocol: 137 100.1.1.2:20004 [ 865.936956][T20339] netlink: 52 bytes leftover after parsing attributes in process `syz.7.18390'. [ 866.063810][T20345] set match dimension is over the limit! [ 866.077185][T20349] openvswitch: netlink: EtherType 50a is less than min 600 [ 866.221757][T20360] openvswitch: netlink: EtherType 50a is less than min 600 [ 866.286071][T20364] netlink: 'syz.0.18399': attribute type 1 has an invalid length. [ 866.305380][T20364] netlink: 24 bytes leftover after parsing attributes in process `syz.0.18399'. [ 866.375836][T20369] netlink: 20 bytes leftover after parsing attributes in process `syz.5.18401'. [ 866.417499][T20369] netlink: 20 bytes leftover after parsing attributes in process `syz.5.18401'. [ 866.447314][T20376] netlink: 8 bytes leftover after parsing attributes in process `syz.0.18402'. [ 866.450982][T20369] geneve4: entered promiscuous mode [ 866.532074][T20384] openvswitch: netlink: Message has 24 unknown bytes. [ 866.606362][T20389] bond0: (slave gre0): refused to change device type [ 866.629404][T20388] bond0: (slave gre0): refused to change device type [ 867.123375][T20428] netlink: 20 bytes leftover after parsing attributes in process `syz.4.18417'. [ 867.165322][T20428] netlink: 20 bytes leftover after parsing attributes in process `syz.4.18417'. [ 867.176482][T20433] netlink: 8 bytes leftover after parsing attributes in process `syz.5.18415'. [ 867.253003][T20437] netlink: 28 bytes leftover after parsing attributes in process `syz.5.18415'. [ 867.372795][T20439] syzkaller0: entered promiscuous mode [ 867.387539][T20439] syzkaller0: entered allmulticast mode [ 867.541262][T20452] Unsupported ieee802154 address type: 0 [ 867.654885][T20464] netlink: 'syz.4.18427': attribute type 1 has an invalid length. [ 867.687616][T20464] 8021q: adding VLAN 0 to HW filter on device bond46 [ 868.009412][T20492] netlink: 'syz.4.18438': attribute type 1 has an invalid length. [ 868.044382][T20492] netlink: 'syz.4.18438': attribute type 1 has an invalid length. [ 868.389932][T20486] tipc: Resetting bearer [ 868.957408][T20486] 0ªX¹¦Dö»: left allmulticast mode [ 868.993032][ T57] netdevsim netdevsim0 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 869.026610][ T57] netdevsim netdevsim0 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 869.057396][ T57] netdevsim netdevsim0 netdevsim0: unset [1, 1] type 2 family 0 port 256 - 0 [ 869.089929][ T57] netdevsim netdevsim0 netdevsim0: unset [1, 2] type 2 family 0 port 20000 - 0 [ 869.110779][ T57] netdevsim netdevsim0 netdevsim0: unset [1, 3] type 2 family 0 port 27669 - 0 [ 869.149120][ T6578] netdevsim netdevsim0 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 869.197020][ T6578] netdevsim netdevsim0 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 869.220995][ T6578] netdevsim netdevsim0 netdevsim1: unset [1, 1] type 2 family 0 port 256 - 0 [ 869.257249][ T6578] netdevsim netdevsim0 netdevsim1: unset [1, 2] type 2 family 0 port 20000 - 0 [ 869.307648][ T6578] netdevsim netdevsim0 netdevsim1: unset [1, 3] type 2 family 0 port 27669 - 0 [ 869.329846][ T6580] netdevsim netdevsim0 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 869.370557][ T6580] netdevsim netdevsim0 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 869.391558][ T6580] netdevsim netdevsim0 netdevsim2: unset [1, 1] type 2 family 0 port 256 - 0 [ 869.418910][ T6580] netdevsim netdevsim0 netdevsim2: unset [1, 2] type 2 family 0 port 20000 - 0 [ 869.429978][ T6580] netdevsim netdevsim0 netdevsim2: unset [1, 3] type 2 family 0 port 27669 - 0 [ 869.442458][T20521] syz_tun: entered allmulticast mode [ 869.469643][T20525] syzkaller1: entered promiscuous mode [ 869.501315][ T6580] netdevsim netdevsim0 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 869.539920][ T6580] netdevsim netdevsim0 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 869.563684][ T6580] netdevsim netdevsim0 netdevsim3: unset [1, 1] type 2 family 0 port 256 - 0 [ 869.588209][ T6580] netdevsim netdevsim0 netdevsim3: unset [1, 2] type 2 family 0 port 20000 - 0 [ 869.610418][ T6580] netdevsim netdevsim0 netdevsim3: unset [1, 3] type 2 family 0 port 27669 - 0 [ 869.700865][T20517] syz_tun: left allmulticast mode [ 869.891159][T20566] syzkaller1: entered promiscuous mode [ 869.919034][T20566] syzkaller1: entered allmulticast mode [ 869.970054][T20574] ip_vti0: left promiscuous mode [ 870.024164][T20576] openvswitch: netlink: EtherType 50a is less than min 600 [ 870.052136][T20579] netlink: 'syz.0.18456': attribute type 8 has an invalid length. [ 870.061013][T20574] bond30: left promiscuous mode [ 870.107534][T20574] bond33: left promiscuous mode [ 870.145724][T20574] geneve6: left promiscuous mode [ 870.185196][T20574] bond34: left promiscuous mode [ 870.201861][T20574] bond35: left promiscuous mode [ 870.206942][T20574] bridge37: left promiscuous mode [ 870.217247][T20574] geneve7: left promiscuous mode [ 870.342921][T20582] team0: Port device team_slave_0 removed [ 870.405838][T20582] team0: Port device team_slave_1 removed [ 870.431476][T20582] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 870.449258][T20582] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 870.464763][T20582] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 870.482199][T20582] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 870.493172][T20582] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 870.521028][T20587] netlink: 'syz.0.18459': attribute type 3 has an invalid length. [ 870.555631][T20583] team0: Port device vlan0 added [ 870.612090][T20590] veth1: left allmulticast mode [ 870.616594][T20602] netlink: 'syz.7.18465': attribute type 1 has an invalid length. [ 870.628002][T20590] ipvlan0: left allmulticast mode [ 870.637484][T20590] batadv_slave_1: left allmulticast mode [ 870.655822][T20602] __nla_validate_parse: 10 callbacks suppressed [ 870.655840][T20602] netlink: 12 bytes leftover after parsing attributes in process `syz.7.18465'. [ 870.678307][T20590] macvtap3: left promiscuous mode [ 870.720746][T20590] macvtap3: left allmulticast mode [ 870.739164][T20590] macvtap4: left promiscuous mode [ 870.747483][T20590] macvtap4: left allmulticast mode [ 870.760039][T20590] bond27: left promiscuous mode [ 870.777130][T20590] bridge26: left promiscuous mode [ 870.903926][T20611] netlink: 8 bytes leftover after parsing attributes in process `syz.4.18468'. [ 870.948649][T20611] netlink: 4 bytes leftover after parsing attributes in process `syz.4.18468'. [ 870.975478][T20612] netlink: 12 bytes leftover after parsing attributes in process `syz.0.18467'. [ 870.976246][T20611] netlink: 'syz.4.18468': attribute type 14 has an invalid length. [ 870.989210][T20614] netlink: 4 bytes leftover after parsing attributes in process `syz.5.18469'. [ 871.014946][T20614] netlink: 4 bytes leftover after parsing attributes in process `syz.5.18469'. [ 871.028370][T20614] netlink: 4 bytes leftover after parsing attributes in process `syz.5.18469'. [ 871.037543][T20614] netlink: 4 bytes leftover after parsing attributes in process `syz.5.18469'. [ 871.046175][T20611] netlink: 'syz.4.18468': attribute type 13 has an invalid length. [ 871.058432][T20614] ip6t_rpfilter: unknown options [ 871.167485][T20618] netlink: 'syz.7.18470': attribute type 8 has an invalid length. [ 871.214352][T20623] netlink: 12 bytes leftover after parsing attributes in process `syz.4.18473'. [ 871.367275][T20630] netlink: 44 bytes leftover after parsing attributes in process `syz.4.18475'. [ 871.385611][T20631] netlink: 'syz.7.18476': attribute type 10 has an invalid length. [ 871.415994][T20634] geneve7: entered promiscuous mode [ 871.421681][T20630] netlink: 'syz.4.18475': attribute type 6 has an invalid length. [ 871.435808][T20634] netlink: 'syz.0.18477': attribute type 1 has an invalid length. [ 871.455520][T20636] openvswitch: netlink: IPv4 tun info is not correct [ 871.464890][T20630] netlink: 'syz.4.18475': attribute type 5 has an invalid length. [ 871.508046][T20639] set match dimension is over the limit! [ 871.581363][T20636] openvswitch: netlink: Missing key (keys=40, expected=2000) [ 872.116807][T20669] syzkaller1: entered promiscuous mode [ 872.130198][T20669] syzkaller1: entered allmulticast mode [ 873.063169][T20722] xt_SECMARK: mode already set to 1 cannot mix with rules for mode 9 [ 873.345954][T20735] syzkaller1: entered promiscuous mode [ 873.352222][T20735] syzkaller1: entered allmulticast mode [ 873.620195][T20748] IPVS: sync thread started: state = BACKUP, mcast_ifn = vcan0, syncid = 0, id = 0 [ 873.690046][T20753] team1 (uninitialized): Failed to send options change via netlink (err -105) [ 873.737302][T20753] team1: entered promiscuous mode [ 873.744274][T20753] team1: entered allmulticast mode [ 873.825870][T20764] FAULT_INJECTION: forcing a failure. [ 873.825870][T20764] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 873.850242][T20764] CPU: 1 UID: 0 PID: 20764 Comm: syz.0.18527 Not tainted syzkaller #0 PREEMPT(full) [ 873.850288][T20764] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 873.850302][T20764] Call Trace: [ 873.850310][T20764] [ 873.850319][T20764] dump_stack_lvl+0xe8/0x150 [ 873.850347][T20764] should_fail_ex+0x40c/0x560 [ 873.850373][T20764] _copy_from_user+0x2d/0xb0 [ 873.850403][T20764] ___sys_sendmsg+0x1c6/0x360 [ 873.850433][T20764] ? rcu_is_watching+0x15/0xb0 [ 873.850454][T20764] ? get_pid_task+0x20/0x1f0 [ 873.850475][T20764] ? __pfx____sys_sendmsg+0x10/0x10 [ 873.850509][T20764] ? rcu_is_watching+0x15/0xb0 [ 873.850549][T20764] ? __fget_files+0x2a/0x420 [ 873.850571][T20764] ? __fget_files+0x3a2/0x420 [ 873.850602][T20764] __x64_sys_sendmsg+0x1b1/0x290 [ 873.850642][T20764] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 873.850683][T20764] ? rcu_is_watching+0x15/0xb0 [ 873.850706][T20764] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 873.850728][T20764] do_syscall_64+0x174/0x580 [ 873.850756][T20764] ? trace_irq_disable+0x3b/0x140 [ 873.850784][T20764] ? clear_bhb_loop+0x40/0x90 [ 873.850809][T20764] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 873.850830][T20764] RIP: 0033:0x7f374859ce59 [ 873.850848][T20764] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 873.850867][T20764] RSP: 002b:00007f3749424028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 873.850889][T20764] RAX: ffffffffffffffda RBX: 00007f3748815fa0 RCX: 00007f374859ce59 [ 873.850905][T20764] RDX: 0000000000008000 RSI: 0000200000004c00 RDI: 0000000000000004 [ 873.850918][T20764] RBP: 00007f3749424090 R08: 0000000000000000 R09: 0000000000000000 [ 873.850932][T20764] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 873.850944][T20764] R13: 00007f3748816038 R14: 00007f3748815fa0 R15: 00007ffd10aa9398 [ 873.850971][T20764] [ 874.136726][T20773] openvswitch: netlink: Invalid VLAN frame [ 874.499599][T20802] nbd: must specify an index to disconnect [ 874.914649][T20838] set match dimension is over the limit! [ 874.962112][T20844] bond0: entered allmulticast mode [ 875.041968][T20853] netdevsim netdevsim7: Firmware load for './file0/file0/..' refused, path contains '..' component [ 875.661832][T20889] validate_nla: 74 callbacks suppressed [ 875.661850][T20889] netlink: 'syz.0.18565': attribute type 1 has an invalid length. [ 875.722530][T20889] 8021q: adding VLAN 0 to HW filter on device bond28 [ 875.865723][T20901] openvswitch: netlink: nsh attr 0 has unexpected len 1 expected 0 [ 875.934990][T20904] netlink: 'syz.2.18572': attribute type 1 has an invalid length. [ 875.964132][T20904] __nla_validate_parse: 28 callbacks suppressed [ 875.964148][T20904] netlink: 8 bytes leftover after parsing attributes in process `syz.2.18572'. [ 876.127876][T20916] tipc: Started in network mode [ 876.151383][T20916] tipc: Node identity ac14142f, cluster identity 4711 [ 876.182718][T20916] tipc: Enabling of bearer rejected, failed to enable media [ 876.200119][T20922] macsec0: entered allmulticast mode [ 876.266402][T20929] FAULT_INJECTION: forcing a failure. [ 876.266402][T20929] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 876.288789][T20929] CPU: 0 UID: 0 PID: 20929 Comm: syz.7.18581 Not tainted syzkaller #0 PREEMPT(full) [ 876.288815][T20929] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 876.288826][T20929] Call Trace: [ 876.288834][T20929] [ 876.288842][T20929] dump_stack_lvl+0xe8/0x150 [ 876.288866][T20929] should_fail_ex+0x40c/0x560 [ 876.288896][T20929] _copy_from_iter+0x1d3/0x1660 [ 876.288921][T20929] ? rcu_is_watching+0x15/0xb0 [ 876.288944][T20929] ? __pfx__copy_from_iter+0x10/0x10 [ 876.288964][T20929] ? kmem_cache_alloc_node_noprof+0x3ca/0x680 [ 876.288994][T20929] ? netlink_sendmsg+0x650/0xb40 [ 876.289012][T20929] ? skb_put+0x112/0x210 [ 876.289038][T20929] netlink_sendmsg+0x6c0/0xb40 [ 876.289061][T20929] ? __pfx_netlink_sendmsg+0x10/0x10 [ 876.289091][T20929] ? aa_sock_msg_perm+0xf1/0x1b0 [ 876.289111][T20929] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 876.289134][T20929] ? __pfx_netlink_sendmsg+0x10/0x10 [ 876.289163][T20929] ____sys_sendmsg+0x9b9/0xa20 [ 876.289195][T20929] ? __pfx_____sys_sendmsg+0x10/0x10 [ 876.289223][T20929] ? lock_release+0x4b/0x3c0 [ 876.289252][T20929] ? import_iovec+0x73/0xa0 [ 876.289279][T20929] ___sys_sendmsg+0x2a5/0x360 [ 876.289304][T20929] ? rcu_is_watching+0x15/0xb0 [ 876.289322][T20929] ? get_pid_task+0x20/0x1f0 [ 876.289341][T20929] ? __pfx____sys_sendmsg+0x10/0x10 [ 876.289370][T20929] ? rcu_is_watching+0x15/0xb0 [ 876.289410][T20929] ? __fget_files+0x2a/0x420 [ 876.289431][T20929] ? __fget_files+0x3a2/0x420 [ 876.289458][T20929] __x64_sys_sendmsg+0x1b1/0x290 [ 876.289486][T20929] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 876.289522][T20929] ? rcu_is_watching+0x15/0xb0 [ 876.289542][T20929] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 876.289562][T20929] do_syscall_64+0x174/0x580 [ 876.289586][T20929] ? trace_irq_disable+0x3b/0x140 [ 876.289611][T20929] ? clear_bhb_loop+0x40/0x90 [ 876.289633][T20929] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 876.289652][T20929] RIP: 0033:0x7fe8df79ce59 [ 876.289668][T20929] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 876.289685][T20929] RSP: 002b:00007fe8e06e7028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 876.289705][T20929] RAX: ffffffffffffffda RBX: 00007fe8dfa15fa0 RCX: 00007fe8df79ce59 [ 876.289719][T20929] RDX: 0000000000008000 RSI: 0000200000004c00 RDI: 0000000000000004 [ 876.289732][T20929] RBP: 00007fe8e06e7090 R08: 0000000000000000 R09: 0000000000000000 [ 876.289744][T20929] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 876.289756][T20929] R13: 00007fe8dfa16038 R14: 00007fe8dfa15fa0 R15: 00007ffdf0ebd8f8 [ 876.289780][T20929] [ 876.446961][T20922] veth1_macvtap: entered allmulticast mode [ 876.622107][T20922] macsec0: left promiscuous mode [ 876.636135][T20922] macsec0: left allmulticast mode [ 876.646284][T20922] veth1_macvtap: left allmulticast mode [ 876.685485][T20937] netlink: 40 bytes leftover after parsing attributes in process `syz.5.18576'. [ 876.733372][T20946] openvswitch: netlink: Key type 8708 is out of range max 32 [ 876.747270][T20948] netlink: 212348 bytes leftover after parsing attributes in process `syz.7.18585'. [ 876.775904][T20948] netlink: ct family unspecified [ 876.783247][T20950] netlink: 'syz.4.18586': attribute type 83 has an invalid length. [ 876.853306][T20954] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check. [ 876.886540][T20958] netlink: 'syz.7.18590': attribute type 8 has an invalid length. [ 876.966092][T20961] netlink: 20 bytes leftover after parsing attributes in process `syz.4.18591'. [ 876.989349][T20964] netlink: 4 bytes leftover after parsing attributes in process `syz.7.18592'. [ 877.179515][T20983] netlink: 12 bytes leftover after parsing attributes in process `syz.5.18597'. [ 877.297340][T20992] netlink: 80 bytes leftover after parsing attributes in process `syz.7.18599'. [ 877.435724][T21000] netlink: 'syz.5.18602': attribute type 8 has an invalid length. [ 877.544454][T21006] sctp: [Deprecated]: syz.2.18604 (pid 21006) Use of struct sctp_assoc_value in delayed_ack socket option. [ 877.544454][T21006] Use struct sctp_sack_info instead [ 877.725218][T21014] syzkaller0: entered promiscuous mode [ 877.744267][T21014] syzkaller0: entered allmulticast mode [ 877.793679][T21014] bridge12: entered promiscuous mode [ 877.816827][T21014] bridge12: entered allmulticast mode [ 878.165594][T21054] netlink: 52 bytes leftover after parsing attributes in process `syz.2.18619'. [ 878.183285][T21055] ipt_rpfilter: unknown options [ 878.320106][T21067] netlink: 28 bytes leftover after parsing attributes in process `syz.5.18622'. [ 878.329811][T21066] xt_cgroup: path and classid specified [ 878.346143][T21068] netlink: 12 bytes leftover after parsing attributes in process `syz.2.18624'. [ 878.360397][T21069] IPVS: sync thread started: state = BACKUP, mcast_ifn = vcan0, syncid = 0, id = 0 [ 879.939984][T21174] bond4 (unregistering): Released all slaves [ 879.956827][T21192] C: entered allmulticast mode [ 879.974542][T21192] C: left allmulticast mode [ 880.043425][T21196] netlink: 'syz.5.18668': attribute type 1 has an invalid length. [ 880.086967][T21196] xt_TCPMSS: Only works on TCP SYN packets [ 880.286894][T21221] xt_CT: You must specify a L4 protocol and not use inversions on it [ 880.421730][T21228] set match dimension is over the limit! [ 880.532475][T21232] netlink: 'syz.0.18683': attribute type 1 has an invalid length. [ 880.555934][T21232] netlink: 'syz.0.18683': attribute type 2 has an invalid length. [ 880.771719][T21251] openvswitch: netlink: Invalid VLAN frame [ 880.823217][T21255] erspan0: entered allmulticast mode [ 881.156234][T21283] netlink: 'syz.7.18703': attribute type 5 has an invalid length. [ 881.273564][T21287] __nla_validate_parse: 14 callbacks suppressed [ 881.273585][T21287] netlink: 48 bytes leftover after parsing attributes in process `syz.7.18705'. [ 881.305159][T21288] netlink: 156 bytes leftover after parsing attributes in process `syz.0.18704'. [ 881.463015][T21298] netlink: 20 bytes leftover after parsing attributes in process `syz.0.18709'. [ 881.472955][T21298] netlink: 16 bytes leftover after parsing attributes in process `syz.0.18709'. [ 881.491767][T21299] 8021q: VLANs not supported on ip_vti0 [ 881.565951][T21305] netlink: 'syz.5.18712': attribute type 3 has an invalid length. [ 881.691185][T21321] netlink: 40 bytes leftover after parsing attributes in process `syz.2.18717'. [ 881.842884][T21332] netlink: 156 bytes leftover after parsing attributes in process `syz.2.18719'. [ 881.922723][T21335] sch_tbf: burst 7 is lower than device syzkaller0 mtu (1514) ! [ 881.931787][T21338] openvswitch: netlink: Key type 30 is not supported [ 881.962706][T21335] syzkaller0: entered promiscuous mode [ 881.985601][T21335] syzkaller0: entered allmulticast mode [ 882.051999][T21348] netlink: 8 bytes leftover after parsing attributes in process `syz.2.18724'. [ 882.082184][T21348] netlink: 'syz.2.18724': attribute type 3 has an invalid length. [ 882.263858][T21362] set match dimension is over the limit! [ 882.399728][T21372] erspan0: left allmulticast mode [ 882.467648][T21367] x_tables: duplicate underflow at hook 1 [ 882.478819][T21376] netlink: 156 bytes leftover after parsing attributes in process `syz.5.18732'. [ 882.597826][T21382] syzkaller0: entered promiscuous mode [ 882.604097][T21382] syzkaller0: entered allmulticast mode [ 882.624034][T21382] netlink: 'syz.7.18734': attribute type 2 has an invalid length. [ 882.792565][T21395] netlink: 12 bytes leftover after parsing attributes in process `syz.7.18741'. [ 882.807255][T21399] sctp: [Deprecated]: syz.2.18740 (pid 21399) Use of int in max_burst socket option deprecated. [ 882.807255][T21399] Use struct sctp_assoc_value instead [ 882.936362][T21403] netlink: 12 bytes leftover after parsing attributes in process `syz.7.18743'. [ 883.790963][T21471] syzkaller1: entered promiscuous mode [ 883.806401][T21471] syzkaller1: entered allmulticast mode [ 884.421673][T21521] netlink: 'syz.7.18779': attribute type 1 has an invalid length. [ 884.447049][T21521] netlink: 'syz.7.18779': attribute type 1 has an invalid length. [ 884.455573][T21521] netlink: 'syz.7.18779': attribute type 8 has an invalid length. [ 884.643156][ T4939] block nbd8: Receive control failed (result -32) [ 884.717682][T21537] netlink: 'syz.4.18785': attribute type 49 has an invalid length. [ 884.779749][T21540] netlink: 'syz.7.18786': attribute type 11 has an invalid length. [ 884.806370][T21540] netlink: 'syz.7.18786': attribute type 5 has an invalid length. [ 884.927775][T21556] x_tables: unsorted underflow at hook 2 [ 884.999757][T21559] FAULT_INJECTION: forcing a failure. [ 884.999757][T21559] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 885.021768][T21559] CPU: 0 UID: 0 PID: 21559 Comm: syz.7.18792 Not tainted syzkaller #0 PREEMPT(full) [ 885.021797][T21559] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 885.021810][T21559] Call Trace: [ 885.021818][T21559] [ 885.021828][T21559] dump_stack_lvl+0xe8/0x150 [ 885.021856][T21559] should_fail_ex+0x40c/0x560 [ 885.021882][T21559] _copy_from_user+0x2d/0xb0 [ 885.021912][T21559] ___sys_sendmsg+0x1c6/0x360 [ 885.021942][T21559] ? rcu_is_watching+0x15/0xb0 [ 885.021964][T21559] ? get_pid_task+0x20/0x1f0 [ 885.021985][T21559] ? __pfx____sys_sendmsg+0x10/0x10 [ 885.022019][T21559] ? rcu_is_watching+0x15/0xb0 [ 885.022059][T21559] ? __fget_files+0x2a/0x420 [ 885.022083][T21559] ? __fget_files+0x3a2/0x420 [ 885.022120][T21559] __x64_sys_sendmsg+0x1b1/0x290 [ 885.022153][T21559] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 885.022193][T21559] ? rcu_is_watching+0x15/0xb0 [ 885.022216][T21559] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 885.022238][T21559] do_syscall_64+0x174/0x580 [ 885.022266][T21559] ? trace_irq_disable+0x3b/0x140 [ 885.022294][T21559] ? clear_bhb_loop+0x40/0x90 [ 885.022319][T21559] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 885.022339][T21559] RIP: 0033:0x7fe8df79ce59 [ 885.022359][T21559] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 885.022377][T21559] RSP: 002b:00007fe8e06e7028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 885.022399][T21559] RAX: ffffffffffffffda RBX: 00007fe8dfa15fa0 RCX: 00007fe8df79ce59 [ 885.022416][T21559] RDX: 0000000000040810 RSI: 0000200000000140 RDI: 0000000000000003 [ 885.022430][T21559] RBP: 00007fe8e06e7090 R08: 0000000000000000 R09: 0000000000000000 [ 885.022444][T21559] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 885.022462][T21559] R13: 00007fe8dfa16038 R14: 00007fe8dfa15fa0 R15: 00007ffdf0ebd8f8 [ 885.022491][T21559] [ 885.327525][T21568] syzkaller1: entered promiscuous mode [ 885.355836][T21568] syzkaller1: entered allmulticast mode [ 885.687171][T21594] netlink: 'syz.0.18804': attribute type 2 has an invalid length. [ 885.858826][T21615] IPVS: Unknown mcast interface: vcan0 [ 886.163091][T21640] validate_nla: 4 callbacks suppressed [ 886.163109][T21640] netlink: 'syz.2.18815': attribute type 3 has an invalid length. [ 886.179699][T21638] dvmrp0: entered allmulticast mode [ 886.186726][T21642] xt_addrtype: ipv6 PROHIBIT (THROW, NAT ..) matching not supported [ 886.196488][T21641] netlink: 'syz.2.18815': attribute type 3 has an invalid length. [ 886.354574][T21653] tipc: Enabling of bearer rejected, already enabled [ 886.597487][T21665] __nla_validate_parse: 24 callbacks suppressed [ 886.597509][T21665] netlink: 28 bytes leftover after parsing attributes in process `syz.2.18819'. [ 886.625378][T21665] IPVS: Unknown mcast interface: vcan0 [ 886.757916][T21672] netlink: 16 bytes leftover after parsing attributes in process `syz.5.18823'. [ 886.776822][T21672] : left promiscuous mode [ 886.813724][T21675] netlink: 'syz.4.18824': attribute type 83 has an invalid length. [ 886.830348][T21676] netlink: 4552 bytes leftover after parsing attributes in process `syz.0.18825'. [ 886.847615][T21676] netlink: 4552 bytes leftover after parsing attributes in process `syz.0.18825'. [ 886.867265][T21678] netlink: 'syz.2.18826': attribute type 29 has an invalid length. [ 887.004182][T21685] netlink: 12 bytes leftover after parsing attributes in process `syz.5.18828'. [ 887.015722][T21691] netlink: 'syz.0.18830': attribute type 2 has an invalid length. [ 887.036541][T21690] netlink: 108 bytes leftover after parsing attributes in process `syz.2.18829'. [ 887.129557][T21698] netlink: 28 bytes leftover after parsing attributes in process `syz.0.18832'. [ 887.160618][T21698] IPVS: Unknown mcast interface: vcan0 [ 887.201814][T21704] netlink: 'syz.7.18834': attribute type 30 has an invalid length. [ 887.216327][T21703] xt_SECMARK: mode already set to 1 cannot mix with rules for mode 9 [ 887.324303][T21712] set match dimension is over the limit! [ 887.393217][T21699] Bluetooth: hci5: command 0x0405 tx timeout [ 887.427880][T21717] netlink: 'syz.2.18838': attribute type 8 has an invalid length. [ 887.575000][T21725] netlink: 'syz.5.18843': attribute type 1 has an invalid length. [ 887.652740][T21731] openvswitch: netlink: Message has 8 unknown bytes. [ 887.669865][T21731] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 887.842805][T21739] netlink: 24 bytes leftover after parsing attributes in process `syz.7.18846'. [ 887.894955][T21748] xt_SECMARK: mode already set to 1 cannot mix with rules for mode 9 [ 887.978892][T21754] netlink: 212344 bytes leftover after parsing attributes in process `syz.5.18850'. [ 888.027175][T21758] netlink: 12 bytes leftover after parsing attributes in process `syz.0.18852'. [ 888.130919][T21750] bridge0: port 2(bridge_slave_1) entered disabled state [ 888.235251][T21750] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 888.246515][T21750] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 888.327226][T21755] geneve2: entered promiscuous mode [ 888.332583][T21755] geneve2: entered allmulticast mode [ 888.343330][T21772] xfrm0 speed is unknown, defaulting to 1000 [ 888.348862][ T2024] Bluetooth: hci0: Opcode 0x0c03 failed: -110 [ 888.357500][ T6574] netdevsim netdevsim7 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 888.383935][ T6574] netdevsim netdevsim7 netdevsim0: set [1, 1] type 2 family 0 port 19999 - 0 [ 888.394766][ T6574] netdevsim netdevsim7 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 888.407194][ T6574] netdevsim netdevsim7 netdevsim1: set [1, 1] type 2 family 0 port 19999 - 0 [ 888.432950][ T6574] netdevsim netdevsim7 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 888.476211][ T6574] netdevsim netdevsim7 netdevsim2: set [1, 1] type 2 family 0 port 19999 - 0 [ 888.509506][T21772] xfrm0 speed is unknown, defaulting to 1000 [ 888.515624][ T6588] netdevsim netdevsim7 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 888.532768][ T6588] netdevsim netdevsim7 netdevsim3: set [1, 1] type 2 family 0 port 19999 - 0 [ 888.550209][T21772] xfrm0 speed is unknown, defaulting to 1000 [ 888.629854][T21782] mac80211_hwsim hwsim67 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 888.746267][T21789] x_tables: ip_tables: DNAT target: used from hooks POSTROUTING, but only usable from PREROUTING/OUTPUT [ 888.985383][T21772] infiniband syz1: set down [ 888.985452][T13957] xfrm0 speed is unknown, defaulting to 1000 [ 888.996360][T21772] infiniband syz1: added xfrm0 [ 889.029394][T21772] smbdirect: ib_dev[syz1]: added: IB_CA max_fast_reg_page_list_len=512 device_cap_flags=0x1c001223c76 kernel_cap_flags=0x14 page_size_cap=0xfffff000 [ 889.058484][T21772] smbdirect: ib_dev[syz1]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=32 max_cqe=32767 max_qp_wr=1048576 max_send_sge=32 max_recv_sge=32 [ 889.103924][T21772] smbdirect: ib_dev[syz1]PORT[1]: iwarp=0 ib=0 roce=1 v1=0 v2=1 core_cap_flags=0x803005 [ 889.155926][T21772] RDS/IB: syz1: added [ 889.165012][T21772] smc: adding ib device syz1 with port count 1 [ 889.179781][T21772] smc: ib device syz1 port 1 has no pnetid [ 889.185970][T13957] xfrm0 speed is unknown, defaulting to 1000 [ 889.194871][T21772] xfrm0 speed is unknown, defaulting to 1000 [ 889.258584][T21821] bond47: option xmit_hash_policy: invalid value (64) [ 889.274983][T21821] bond47 (unregistering): Released all slaves [ 889.359454][T21772] xfrm0 speed is unknown, defaulting to 1000 [ 889.531655][T21772] xfrm0 speed is unknown, defaulting to 1000 [ 889.664334][T21772] xfrm0 speed is unknown, defaulting to 1000 [ 889.840496][T21772] xfrm0 speed is unknown, defaulting to 1000 [ 889.992175][T21772] xfrm0 speed is unknown, defaulting to 1000 [ 890.145999][T21772] xfrm0 speed is unknown, defaulting to 1000 [ 890.317013][T21772] xfrm0 speed is unknown, defaulting to 1000 [ 890.485342][T21842] netlink: 'syz.2.18877': attribute type 1 has an invalid length. [ 890.504978][T21842] bond37: option mode: invalid value (9) [ 890.511868][T21842] bond37 (unregistering): Released all slaves [ 890.580559][T21842] : renamed from veth0_vlan [ 891.734367][T21789] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 891.782741][T21854] __nla_validate_parse: 16 callbacks suppressed [ 891.782761][T21854] netlink: 12 bytes leftover after parsing attributes in process `syz.0.18879'. [ 891.901616][T21858] FAULT_INJECTION: forcing a failure. [ 891.901616][T21858] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 891.921668][T21858] CPU: 1 UID: 0 PID: 21858 Comm: syz.0.18883 Not tainted syzkaller #0 PREEMPT(full) [ 891.921695][T21858] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 891.921718][T21858] Call Trace: [ 891.921726][T21858] [ 891.921735][T21858] dump_stack_lvl+0xe8/0x150 [ 891.921762][T21858] should_fail_ex+0x40c/0x560 [ 891.921787][T21858] _copy_from_user+0x2d/0xb0 [ 891.921815][T21858] kstrtouint_from_user+0xd6/0x180 [ 891.921836][T21858] ? __might_fault+0xaf/0x130 [ 891.921862][T21858] ? __pfx_kstrtouint_from_user+0x10/0x10 [ 891.921887][T21858] ? __mutex_trylock_common+0x15f/0x270 [ 891.921912][T21858] ? vfs_write+0x22b/0xba0 [ 891.921948][T21858] ? rcu_is_watching+0x15/0xb0 [ 891.921969][T21858] proc_fail_nth_write+0x8e/0x210 [ 891.921994][T21858] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 891.922021][T21858] ? preempt_count_add+0x91/0x190 [ 891.922049][T21858] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 891.922073][T21858] vfs_write+0x296/0xba0 [ 891.922103][T21858] ? __pfx_vfs_write+0x10/0x10 [ 891.922132][T21858] ? __fget_files+0x3a2/0x420 [ 891.922153][T21858] ? __fget_files+0x2a/0x420 [ 891.922179][T21858] ksys_write+0x150/0x270 [ 891.922207][T21858] ? __pfx_ksys_write+0x10/0x10 [ 891.922235][T21858] ? rcu_is_watching+0x15/0xb0 [ 891.922256][T21858] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 891.922276][T21858] do_syscall_64+0x174/0x580 [ 891.922301][T21858] ? trace_irq_disable+0x3b/0x140 [ 891.922327][T21858] ? clear_bhb_loop+0x40/0x90 [ 891.922349][T21858] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 891.922367][T21858] RIP: 0033:0x7f374855d68e [ 891.922385][T21858] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 891.922401][T21858] RSP: 002b:00007f3749423fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 891.922422][T21858] RAX: ffffffffffffffda RBX: 00007f37494246c0 RCX: 00007f374855d68e [ 891.922436][T21858] RDX: 0000000000000001 RSI: 00007f37494240a0 RDI: 0000000000000004 [ 891.922449][T21858] RBP: 00007f3749424090 R08: 0000000000000000 R09: 0000000000000000 [ 891.922461][T21858] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 891.922472][T21858] R13: 00007f3748816038 R14: 00007f3748815fa0 R15: 00007ffd10aa9398 [ 891.922496][T21858] [ 892.099726][T21868] netlink: 4 bytes leftover after parsing attributes in process `syz.5.18884'. [ 892.181611][T21869] mac80211_hwsim hwsim11 syzkaller0: entered promiscuous mode [ 892.207985][T21869] mac80211_hwsim hwsim11 syzkaller0: entered allmulticast mode [ 892.364182][T21883] netlink: 36 bytes leftover after parsing attributes in process `syz.5.18887'. [ 892.672824][T21893] syzkaller0: entered promiscuous mode [ 892.688394][T21893] syzkaller0: entered allmulticast mode [ 892.755199][T21911] netlink: 12 bytes leftover after parsing attributes in process `syz.4.18894'. [ 893.113259][T21933] netlink: 16 bytes leftover after parsing attributes in process `syz.7.18902'. [ 893.142357][T21933] netlink: 7060 bytes leftover after parsing attributes in process `syz.7.18902'. [ 893.154727][T21934] ipt_REJECT: TCP_RESET invalid for non-tcp [ 893.229657][T21934] gre6: entered promiscuous mode [ 893.254190][T21934] gre6: entered allmulticast mode [ 893.296065][T21943] bond0: left promiscuous mode [ 893.312849][T21943] ip6gre1: left promiscuous mode [ 893.344183][T21949] netlink: 'syz.0.18907': attribute type 1 has an invalid length. [ 893.380234][T21949] bond29: entered promiscuous mode [ 893.385727][T21949] 8021q: adding VLAN 0 to HW filter on device bond29 [ 893.429596][T21949] bond29: (slave bridge28): making interface the new active one [ 893.438445][T21949] bridge28: entered promiscuous mode [ 893.444795][T21949] bond29: (slave bridge28): Enslaving as an active interface with an up link [ 893.537696][T21967] netlink: 'syz.0.18912': attribute type 1 has an invalid length. [ 893.540356][T21970] netlink: 36 bytes leftover after parsing attributes in process `syz.5.18913'. [ 893.598641][T21973] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 893.617738][T21976] netlink: 'syz.5.18915': attribute type 26 has an invalid length. [ 893.761707][T21988] syzkaller0: entered promiscuous mode [ 893.767325][T21988] syzkaller0: entered allmulticast mode [ 894.154761][T22005] IPVS: set_ctl: invalid protocol: 136 172.20.20.187:20001 [ 894.317868][T22014] netlink: 4 bytes leftover after parsing attributes in process `syz.7.18926'. [ 894.328355][T22014] netlink: 4 bytes leftover after parsing attributes in process `syz.7.18926'. [ 894.360281][T22014] netlink: 'syz.7.18926': attribute type 3 has an invalid length. [ 894.532295][T22035] : entered promiscuous mode [ 894.581489][T22040] netlink: 232 bytes leftover after parsing attributes in process `syz.4.18937'. [ 894.996538][T22069] bond7: entered promiscuous mode [ 895.006495][T22073] x_tables: unsorted underflow at hook 1 [ 895.020364][T22069] macvlan2: entered promiscuous mode [ 895.025785][T22069] macvlan2: entered allmulticast mode [ 895.032614][T22069] bond7: (slave macvlan2): Opening slave failed [ 895.198662][T22092] smc: net device team0 applied user defined pnetid SYZ2 [ 895.206119][T22092] smc: net device team0 erased user defined pnetid SYZ2 [ 895.243694][T22093] tipc: Enabled bearer , priority 0 [ 895.266675][T22093] syzkaller0: entered promiscuous mode [ 895.276665][T22093] syzkaller0: entered allmulticast mode [ 895.291814][T22093] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 895.397807][T22103] tipc: Resetting bearer [ 895.472958][T22090] tipc: Resetting bearer [ 895.519053][T22090] tipc: Disabling bearer [ 895.787133][T22136] geneve8: entered promiscuous mode [ 895.974241][T22153] bridge0: entered allmulticast mode [ 895.987254][T22154] ksmbd: Daemon and kernel module version mismatch. ksmbd: 0, kernel module: 1. User-space ksmbd should terminate. [ 896.031104][T22154] xt_TPROXY: Can be used only with -p tcp or -p udp [ 896.046223][T22158] FAULT_INJECTION: forcing a failure. [ 896.046223][T22158] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 896.066506][T22158] CPU: 1 UID: 0 PID: 22158 Comm: syz.2.18971 Not tainted syzkaller #0 PREEMPT(full) [ 896.066532][T22158] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 896.066544][T22158] Call Trace: [ 896.066552][T22158] [ 896.066560][T22158] dump_stack_lvl+0xe8/0x150 [ 896.066586][T22158] should_fail_ex+0x40c/0x560 [ 896.066610][T22158] _copy_from_user+0x2d/0xb0 [ 896.066638][T22158] ___sys_sendmsg+0x1c6/0x360 [ 896.066667][T22158] ? rcu_is_watching+0x15/0xb0 [ 896.066687][T22158] ? get_pid_task+0x20/0x1f0 [ 896.066708][T22158] ? __pfx____sys_sendmsg+0x10/0x10 [ 896.066740][T22158] ? rcu_is_watching+0x15/0xb0 [ 896.066777][T22158] ? __fget_files+0x2a/0x420 [ 896.066799][T22158] ? __fget_files+0x3a2/0x420 [ 896.066827][T22158] __x64_sys_sendmsg+0x1b1/0x290 [ 896.066858][T22158] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 896.066895][T22158] ? rcu_is_watching+0x15/0xb0 [ 896.066916][T22158] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 896.066937][T22158] do_syscall_64+0x174/0x580 [ 896.066962][T22158] ? trace_irq_disable+0x3b/0x140 [ 896.066987][T22158] ? clear_bhb_loop+0x40/0x90 [ 896.067008][T22158] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 896.067026][T22158] RIP: 0033:0x7f24a379ce59 [ 896.067043][T22158] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 896.067060][T22158] RSP: 002b:00007f24a4617028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 896.067079][T22158] RAX: ffffffffffffffda RBX: 00007f24a3a15fa0 RCX: 00007f24a379ce59 [ 896.067093][T22158] RDX: 0000000000000000 RSI: 0000200000000200 RDI: 0000000000000003 [ 896.067104][T22158] RBP: 00007f24a4617090 R08: 0000000000000000 R09: 0000000000000000 [ 896.067117][T22158] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 896.067128][T22158] R13: 00007f24a3a16038 R14: 00007f24a3a15fa0 R15: 00007ffe32ad8538 [ 896.067154][T22158] [ 896.357912][T22163] tipc: Enabled bearer , priority 0 [ 896.394953][T22163] syzkaller0: entered promiscuous mode [ 896.400861][T22163] syzkaller0: entered allmulticast mode [ 896.411519][T22163] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 896.438781][T22163] tipc: Resetting bearer [ 896.446286][T22162] tipc: Resetting bearer [ 896.457098][T22162] tipc: Disabling bearer [ 896.696603][T22189] FAULT_INJECTION: forcing a failure. [ 896.696603][T22189] name failslab, interval 1, probability 0, space 0, times 0 [ 896.726078][T22189] CPU: 1 UID: 0 PID: 22189 Comm: syz.5.18983 Not tainted syzkaller #0 PREEMPT(full) [ 896.726107][T22189] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 896.726120][T22189] Call Trace: [ 896.726128][T22189] [ 896.726137][T22189] dump_stack_lvl+0xe8/0x150 [ 896.726164][T22189] should_fail_ex+0x40c/0x560 [ 896.726190][T22189] should_failslab+0xa8/0x100 [ 896.726230][T22189] kmem_cache_alloc_node_noprof+0x8f/0x680 [ 896.726257][T22189] ? rcu_is_watching+0x15/0xb0 [ 896.726278][T22189] ? __alloc_skb+0x1d7/0x7a0 [ 896.726302][T22189] ? trace_irq_enable+0x3b/0x140 [ 896.726332][T22189] __alloc_skb+0x1d7/0x7a0 [ 896.726361][T22189] netlink_sendmsg+0x5d4/0xb40 [ 896.726386][T22189] ? __pfx_netlink_sendmsg+0x10/0x10 [ 896.726420][T22189] ? aa_sock_msg_perm+0xf1/0x1b0 [ 896.726442][T22189] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 896.726467][T22189] ? __pfx_netlink_sendmsg+0x10/0x10 [ 896.726499][T22189] ____sys_sendmsg+0x9b9/0xa20 [ 896.726535][T22189] ? __pfx_____sys_sendmsg+0x10/0x10 [ 896.726566][T22189] ? lock_release+0x4b/0x3c0 [ 896.726597][T22189] ? import_iovec+0x73/0xa0 [ 896.726625][T22189] ___sys_sendmsg+0x2a5/0x360 [ 896.726654][T22189] ? rcu_is_watching+0x15/0xb0 [ 896.726674][T22189] ? get_pid_task+0x20/0x1f0 [ 896.726695][T22189] ? __pfx____sys_sendmsg+0x10/0x10 [ 896.726726][T22189] ? rcu_is_watching+0x15/0xb0 [ 896.726765][T22189] ? __fget_files+0x2a/0x420 [ 896.726788][T22189] ? __fget_files+0x3a2/0x420 [ 896.726817][T22189] __x64_sys_sendmsg+0x1b1/0x290 [ 896.726849][T22189] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 896.726888][T22189] ? rcu_is_watching+0x15/0xb0 [ 896.726910][T22189] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 896.726931][T22189] do_syscall_64+0x174/0x580 [ 896.726957][T22189] ? trace_irq_disable+0x3b/0x140 [ 896.726984][T22189] ? clear_bhb_loop+0x40/0x90 [ 896.727007][T22189] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 896.727026][T22189] RIP: 0033:0x7ff1f8f9ce59 [ 896.727045][T22189] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 896.727063][T22189] RSP: 002b:00007ff1f9edf028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 896.727085][T22189] RAX: ffffffffffffffda RBX: 00007ff1f9215fa0 RCX: 00007ff1f8f9ce59 [ 896.727101][T22189] RDX: 0000000000000000 RSI: 0000200000000200 RDI: 0000000000000003 [ 896.727115][T22189] RBP: 00007ff1f9edf090 R08: 0000000000000000 R09: 0000000000000000 [ 896.727129][T22189] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 896.727141][T22189] R13: 00007ff1f9216038 R14: 00007ff1f9215fa0 R15: 00007ffe0e757048 [ 896.727168][T22189] [ 897.018574][T22182] block nbd9: server does not support multiple connections per device. [ 897.027483][T22182] block nbd9: shutting down sockets [ 897.261626][T22207] xt_SECMARK: mode already set to 1 cannot mix with rules for mode 9 [ 897.339913][T22213] __nla_validate_parse: 10 callbacks suppressed [ 897.339933][T22213] netlink: 4 bytes leftover after parsing attributes in process `syz.7.18991'. [ 897.553938][T22222] syzkaller0: entered promiscuous mode [ 897.581711][T22222] syzkaller0: entered allmulticast mode [ 897.607275][T22227] FAULT_INJECTION: forcing a failure. [ 897.607275][T22227] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 897.644172][T22227] CPU: 1 UID: 0 PID: 22227 Comm: syz.5.18996 Not tainted syzkaller #0 PREEMPT(full) [ 897.644202][T22227] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 897.644216][T22227] Call Trace: [ 897.644225][T22227] [ 897.644234][T22227] dump_stack_lvl+0xe8/0x150 [ 897.644262][T22227] should_fail_ex+0x40c/0x560 [ 897.644290][T22227] _copy_from_iter+0x1d3/0x1660 [ 897.644319][T22227] ? rcu_is_watching+0x15/0xb0 [ 897.644345][T22227] ? __pfx__copy_from_iter+0x10/0x10 [ 897.644368][T22227] ? kmem_cache_alloc_node_noprof+0x3ca/0x680 [ 897.644405][T22227] ? netlink_sendmsg+0x650/0xb40 [ 897.644425][T22227] ? skb_put+0x112/0x210 [ 897.644456][T22227] netlink_sendmsg+0x6c0/0xb40 [ 897.644481][T22227] ? __pfx_netlink_sendmsg+0x10/0x10 [ 897.644516][T22227] ? aa_sock_msg_perm+0xf1/0x1b0 [ 897.644538][T22227] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 897.644563][T22227] ? __pfx_netlink_sendmsg+0x10/0x10 [ 897.644604][T22227] ____sys_sendmsg+0x9b9/0xa20 [ 897.644640][T22227] ? __pfx_____sys_sendmsg+0x10/0x10 [ 897.644673][T22227] ? lock_release+0x4b/0x3c0 [ 897.644705][T22227] ? import_iovec+0x73/0xa0 [ 897.644735][T22227] ___sys_sendmsg+0x2a5/0x360 [ 897.644764][T22227] ? rcu_is_watching+0x15/0xb0 [ 897.644783][T22227] ? get_pid_task+0x20/0x1f0 [ 897.644806][T22227] ? __pfx____sys_sendmsg+0x10/0x10 [ 897.644840][T22227] ? rcu_is_watching+0x15/0xb0 [ 897.644882][T22227] ? __fget_files+0x2a/0x420 [ 897.644905][T22227] ? __fget_files+0x3a2/0x420 [ 897.644936][T22227] __x64_sys_sendmsg+0x1b1/0x290 [ 897.644968][T22227] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 897.645008][T22227] ? rcu_is_watching+0x15/0xb0 [ 897.645030][T22227] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 897.645052][T22227] do_syscall_64+0x174/0x580 [ 897.645078][T22227] ? trace_irq_disable+0x3b/0x140 [ 897.645107][T22227] ? clear_bhb_loop+0x40/0x90 [ 897.645131][T22227] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 897.645151][T22227] RIP: 0033:0x7ff1f8f9ce59 [ 897.645170][T22227] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 897.645190][T22227] RSP: 002b:00007ff1f9edf028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 897.645212][T22227] RAX: ffffffffffffffda RBX: 00007ff1f9215fa0 RCX: 00007ff1f8f9ce59 [ 897.645228][T22227] RDX: 0000000000000000 RSI: 0000200000000200 RDI: 0000000000000003 [ 897.645242][T22227] RBP: 00007ff1f9edf090 R08: 0000000000000000 R09: 0000000000000000 [ 897.645255][T22227] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 897.645269][T22227] R13: 00007ff1f9216038 R14: 00007ff1f9215fa0 R15: 00007ffe0e757048 [ 897.645295][T22227] [ 897.940261][T22231] netlink: 8 bytes leftover after parsing attributes in process `syz.7.18998'. [ 898.027862][T22233] netlink: 'syz.4.19000': attribute type 11 has an invalid length. [ 898.047992][T22233] netlink: 228 bytes leftover after parsing attributes in process `syz.4.19000'. [ 898.289226][T22249] netlink: 20 bytes leftover after parsing attributes in process `syz.0.19004'. [ 898.336686][T22243] netlink: 2 bytes leftover after parsing attributes in process `syz.0.19004'. [ 898.400044][T22243] netlink: 24 bytes leftover after parsing attributes in process `syz.0.19004'. [ 898.527509][T22264] syzkaller0: entered promiscuous mode [ 898.546289][T22264] syzkaller0: entered allmulticast mode [ 898.582070][T22268] syzkaller1: entered promiscuous mode [ 898.642644][T22268] syzkaller1: entered allmulticast mode [ 898.664590][T22283] netlink: 'syz.0.19014': attribute type 1 has an invalid length. [ 898.707716][T22283] 8021q: adding VLAN 0 to HW filter on device bond30 [ 898.762235][T22289] bridge40: the hash_elasticity option has been deprecated and is always 16 [ 898.952743][T22302] netlink: 4 bytes leftover after parsing attributes in process `syz.0.19022'. [ 899.147751][T22322] syzkaller0: entered promiscuous mode [ 899.155114][T22322] syzkaller0: entered allmulticast mode [ 899.163038][T22317] tipc: Enabled bearer , priority 0 [ 899.182619][T22306] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 899.244292][T22306] tipc: Resetting bearer [ 899.290566][T22305] tipc: Resetting bearer [ 899.323682][T22305] tipc: Disabling bearer [ 899.427632][T22336] netlink: 'syz.0.19030': attribute type 1 has an invalid length. [ 899.482289][T22336] netlink: 28 bytes leftover after parsing attributes in process `syz.0.19030'. [ 899.579307][T22342] bond47: Unable to set up delay as MII monitoring is disabled [ 899.600228][T22342] bond47 (unregistering): Released all slaves [ 899.857957][T22352] netlink: 4 bytes leftover after parsing attributes in process `syz.7.19033'. [ 899.870768][T22357] netlink: 8 bytes leftover after parsing attributes in process `syz.5.19035'. [ 900.177236][T22379] tipc: Enabled bearer , priority 0 [ 900.216072][T22379] syzkaller0: entered promiscuous mode [ 900.230303][T22379] syzkaller0: entered allmulticast mode [ 900.245776][T22379] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 900.292753][T22379] tipc: Resetting bearer [ 900.353558][T22375] tipc: Resetting bearer [ 900.400732][T22375] tipc: Disabling bearer [ 900.492887][T22391] syzkaller0: entered promiscuous mode [ 900.513472][T22391] syzkaller0: entered allmulticast mode [ 900.825869][T22421] netlink: 'syz.4.19056': attribute type 1 has an invalid length. [ 900.853439][T22425] tunl0: entered promiscuous mode [ 900.859957][T22425] netlink: 'syz.2.19055': attribute type 3 has an invalid length. [ 901.064609][T22441] set match dimension is over the limit! [ 901.204756][T22445] bond37 (unregistering): Released all slaves [ 901.257942][T22450] openvswitch: netlink: Message has 5 unknown bytes. [ 901.424298][T22468] netlink: 'syz.2.19070': attribute type 21 has an invalid length. [ 901.641915][T22496] syzkaller1: entered promiscuous mode [ 901.647715][T22496] syzkaller1: entered allmulticast mode [ 904.187368][T22460] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 904.313158][T22514] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 904.461155][T22529] __nla_validate_parse: 31 callbacks suppressed [ 904.461176][T22529] netlink: 8 bytes leftover after parsing attributes in process `syz.4.19091'. [ 904.644955][T22543] netlink: 'syz.5.19094': attribute type 1 has an invalid length. [ 904.695680][T22543] workqueue: Failed to create a rescuer kthread for wq "bond8": -EINTR [ 904.705800][T22553] netlink: 212348 bytes leftover after parsing attributes in process `syz.0.19097'. [ 904.724216][T22553] openvswitch: netlink: Message has 5 unknown bytes. [ 904.884182][T22570] syzkaller0: entered promiscuous mode [ 904.891318][T22570] syzkaller0: entered allmulticast mode [ 904.897352][T22571] netlink: 12 bytes leftover after parsing attributes in process `syz.7.19099'. [ 904.920167][T22570] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 904.940979][T22571] bond4: entered promiscuous mode [ 904.946128][T22571] bond4: entered allmulticast mode [ 905.420476][T22584] netlink: 'syz.2.19102': attribute type 5 has an invalid length. [ 905.460138][T22586] netlink: 12 bytes leftover after parsing attributes in process `syz.2.19103'. [ 907.698434][T22559] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 907.852534][T22599] netlink: 4 bytes leftover after parsing attributes in process `syz.7.19108'. [ 908.159423][T22625] netlink: 12 bytes leftover after parsing attributes in process `syz.0.19115'. [ 908.299720][T22632] netlink: 'syz.2.19117': attribute type 1 has an invalid length. [ 908.338822][T22632] 8021q: adding VLAN 0 to HW filter on device bond37 [ 908.355161][T22640] netlink: 212348 bytes leftover after parsing attributes in process `syz.0.19120'. [ 908.366319][T22632] bond37: (slave veth0_to_bond): Enslaving as an active interface with a down link [ 908.378611][T22640] openvswitch: netlink: Message has 5 unknown bytes. [ 908.416890][T22642] netlink: 28 bytes leftover after parsing attributes in process `syz.5.19122'. [ 908.576584][T22660] netlink: 666 bytes leftover after parsing attributes in process `syz.2.19127'. [ 908.614309][T22657] netlink: 'syz.4.19126': attribute type 6 has an invalid length. [ 908.646558][T22661] netlink: 'syz.4.19126': attribute type 6 has an invalid length. [ 908.685543][T22664] netlink: 16 bytes leftover after parsing attributes in process `syz.7.19128'. [ 908.697225][T22664] : left promiscuous mode [ 908.701187][T22666] IPVS: set_ctl: invalid protocol: 58 0.0.0.0:20000 [ 908.798032][T22676] netlink: 'syz.7.19131': attribute type 1 has an invalid length. [ 911.326412][T22643] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 911.339528][T22662] netlink: 'syz.2.19127': attribute type 1 has an invalid length. [ 911.356203][T22662] __nla_validate_parse: 1 callbacks suppressed [ 911.356220][T22662] netlink: 224 bytes leftover after parsing attributes in process `syz.2.19127'. [ 911.546572][T22698] netlink: 8 bytes leftover after parsing attributes in process `syz.0.19138'. [ 911.744785][T22711] netlink: 27 bytes leftover after parsing attributes in process `syz.0.19142'. [ 911.756744][T22713] openvswitch: netlink: IPv4 tun info is not correct [ 911.824202][T22719] syzkaller0: entered promiscuous mode [ 911.845943][T22719] syzkaller0: entered allmulticast mode [ 911.874485][T22719] netlink: 72 bytes leftover after parsing attributes in process `syz.0.19142'. [ 911.907194][T22721] netlink: 'syz.5.19145': attribute type 2 has an invalid length. [ 912.047473][T22727] netlink: 8 bytes leftover after parsing attributes in process `syz.4.19147'. [ 912.156051][T22732] set match dimension is over the limit! [ 912.281295][T22738] netlink: 8 bytes leftover after parsing attributes in process `syz.4.19152'. [ 912.345419][T22740] vlan9: entered promiscuous mode [ 912.368229][T22740] gretap0: entered promiscuous mode [ 912.380535][T22734] netlink: 152 bytes leftover after parsing attributes in process `syz.5.19149'. [ 912.422857][T22746] netlink: 12 bytes leftover after parsing attributes in process `syz.0.19153'. [ 912.543549][T22752] atomic_op ffff88804bc42998 conn xmit_atomic 0000000000000000 [ 912.561695][T22755] netlink: 12 bytes leftover after parsing attributes in process `syz.2.19156'. [ 912.574526][T22751] 8021q: VLANs not supported on bond0 [ 912.581041][T22758] netlink: 4 bytes leftover after parsing attributes in process `syz.0.19158'. [ 912.721468][T22755] bond38: (slave bridge41): Enslaving as an active interface with an up link [ 913.033530][T22786] netlink: 'syz.5.19168': attribute type 3 has an invalid length. [ 913.197018][T22794] tipc: Enabled bearer , priority 0 [ 913.204648][T22794] syzkaller0: entered promiscuous mode [ 913.210695][T22794] syzkaller0: entered allmulticast mode [ 913.218381][T22794] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 913.230231][T22794] tipc: Resetting bearer [ 913.237654][T22793] tipc: Resetting bearer [ 913.245069][T22793] tipc: Disabling bearer [ 913.321904][T22796] set match dimension is over the limit! [ 913.376936][T22799] netlink: 'syz.4.19175': attribute type 12 has an invalid length. [ 913.385835][T22799] netlink: 'syz.4.19175': attribute type 12 has an invalid length. [ 913.523573][T22809] netlink: 'syz.4.19179': attribute type 9 has an invalid length. [ 913.586713][T22813] batadv_slave_1: entered promiscuous mode [ 913.610233][T22812] batadv_slave_1: left promiscuous mode [ 913.707091][T22827] ÿ: renamed from batadv_slave_0 [ 914.199307][T22870] netlink: 'syz.4.19200': attribute type 1 has an invalid length. [ 914.551427][T22893] syzkaller1: entered promiscuous mode [ 914.557010][T22893] syzkaller1: entered allmulticast mode [ 914.575737][T22895] xt_ecn: cannot match TCP bits for non-tcp packets [ 914.615054][T22898] x_tables: ip_tables: DNAT target: used from hooks POSTROUTING, but only usable from PREROUTING/OUTPUT [ 914.755358][T22903] tipc: Enabled bearer , priority 0 [ 914.783186][T22903] syzkaller0: entered promiscuous mode [ 914.806402][T22903] syzkaller0: entered allmulticast mode [ 914.814753][T22903] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 914.846863][T22903] tipc: Resetting bearer [ 914.874892][T22902] tipc: Resetting bearer [ 914.900257][T22902] tipc: Disabling bearer [ 915.003810][T22908] syzkaller0: entered promiscuous mode [ 915.027179][T22908] syzkaller0: entered allmulticast mode [ 915.095011][T22922] rdma_rxe: rxe_newlink: failed to add xfrm0 [ 915.239975][T22930] x_tables: ip_tables: DNAT target: used from hooks POSTROUTING, but only usable from PREROUTING/OUTPUT [ 915.505454][T22943] xt_SECMARK: mode already set to 1 cannot mix with rules for mode 9 [ 915.522714][T22944] tipc: Enabled bearer , priority 0 [ 915.534555][T22940] syzkaller0: entered promiscuous mode [ 915.541733][T22940] syzkaller0: entered allmulticast mode [ 915.552649][T22942] syzkaller0: entered promiscuous mode [ 915.558791][T22942] syzkaller0: entered allmulticast mode [ 915.565653][T22940] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 915.585774][T22940] tipc: Resetting bearer [ 915.614974][T22938] tipc: Resetting bearer [ 915.644856][T22938] tipc: Disabling bearer [ 915.827446][T22962] netlink: 'syz.4.19231': attribute type 2 has an invalid length. [ 915.843644][T22962] netlink: 'syz.4.19231': attribute type 8 has an invalid length. [ 916.291272][T22986] C speed is unknown, defaulting to 1000 [ 916.294262][T22998] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 916.323349][T22986] C speed is unknown, defaulting to 1000 [ 916.345204][T22986] C speed is unknown, defaulting to 1000 [ 916.365710][T23001] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 916.402059][T22998] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 916.461292][T23007] x_tables: ip_tables: DNAT target: used from hooks POSTROUTING, but only usable from PREROUTING/OUTPUT [ 916.537004][T23011] netlink: 'syz.5.19249': attribute type 8 has an invalid length. [ 916.606931][T23015] __nla_validate_parse: 33 callbacks suppressed [ 916.606950][T23015] netlink: 104 bytes leftover after parsing attributes in process `syz.7.19250'. [ 916.653990][T22986] xfrm0 speed is unknown, defaulting to 1000 [ 916.904036][T23030] set match dimension is over the limit! [ 917.139685][T23042] netlink: 48 bytes leftover after parsing attributes in process `syz.5.19260'. [ 917.205366][T23047] netlink: 28 bytes leftover after parsing attributes in process `syz.0.19262'. [ 917.323282][T23054] bridge6: trying to set multicast query interval below minimum, setting to 100 (1000ms) [ 917.460106][T23068] netlink: 666 bytes leftover after parsing attributes in process `syz.7.19268'. [ 917.700949][T23080] tipc: Enabled bearer , priority 0 [ 917.721153][T23080] syzkaller0: entered promiscuous mode [ 917.740563][T23080] syzkaller0: entered allmulticast mode [ 917.759002][T23088] netlink: 48 bytes leftover after parsing attributes in process `syz.5.19274'. [ 917.790152][T23080] tipc: Resetting bearer [ 917.834431][T23078] tipc: Resetting bearer [ 917.863729][T23078] tipc: Disabling bearer [ 918.233633][T23124] netlink: 48 bytes leftover after parsing attributes in process `syz.4.19285'. [ 918.427859][T23130] C speed is unknown, defaulting to 1000 [ 918.442482][T23137] netlink: 8 bytes leftover after parsing attributes in process `syz.7.19288'. [ 918.473863][T23130] C speed is unknown, defaulting to 1000 [ 918.486338][T23130] C speed is unknown, defaulting to 1000 [ 918.494689][T23137] netlink: 12 bytes leftover after parsing attributes in process `syz.7.19288'. [ 918.715684][T23130] xfrm0 speed is unknown, defaulting to 1000 [ 918.900184][T23161] ip6gre0: Caught tx_queue_len zero misconfig [ 919.854698][T23226] netlink: 12 bytes leftover after parsing attributes in process `syz.2.19317'. [ 920.205927][T23245] netlink: 20 bytes leftover after parsing attributes in process `syz.4.19325'. [ 920.386866][T23251] 8021q: VLANs not supported on ipvlan0 [ 920.551125][ T5624] Bluetooth: hci8: unexpected cc 0x0c03 length: 249 > 1 [ 920.562374][ T5624] Bluetooth: hci8: unexpected cc 0x1003 length: 249 > 9 [ 920.571788][T23259] xt_l2tp: v2 doesn't support IP mode [ 920.577293][ T5624] Bluetooth: hci8: unexpected cc 0x1001 length: 249 > 9 [ 920.585201][T23261] xt_l2tp: v2 doesn't support IP mode [ 920.599222][ T5624] Bluetooth: hci8: unexpected cc 0x0c23 length: 249 > 4 [ 920.610691][ T5624] Bluetooth: hci8: unexpected cc 0x0c38 length: 249 > 2 [ 920.735699][T23265] 8021q: VLANs not supported on sit0 [ 920.767081][T23265] netlink: 'syz.2.19331': attribute type 1 has an invalid length. [ 920.923363][T15514] IPVS: starting estimator thread 0... [ 921.048121][T23287] IPVS: using max 39 ests per chain, 93600 per kthread [ 921.241980][ T6586] netdevsim netdevsim5 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 921.271423][ T6586] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 921.292173][ T6586] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 1] type 2 family 0 port 20000 - 0 [ 921.373283][ T6586] netdevsim netdevsim5 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 921.404772][ T6586] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 921.423733][ T6586] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 1] type 2 family 0 port 20000 - 0 [ 921.446244][T23316] netlink: 'syz.2.19342': attribute type 1 has an invalid length. [ 921.530762][T23316] 8021q: adding VLAN 0 to HW filter on device bond39 [ 921.557869][ T6586] netdevsim netdevsim5 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 921.573277][ T6586] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 921.585665][ T6586] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 1] type 2 family 0 port 20000 - 0 [ 921.646052][T23323] __nla_validate_parse: 5 callbacks suppressed [ 921.646074][T23323] netlink: 4 bytes leftover after parsing attributes in process `syz.4.19344'. [ 921.663640][T23258] C speed is unknown, defaulting to 1000 [ 921.677878][T23326] tipc: Resetting bearer [ 921.756472][ T6586] netdevsim netdevsim5 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 921.787063][ T6586] netdevsim netdevsim5 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 921.800860][ T6586] netdevsim netdevsim5 netdevsim0 (unregistering): unset [1, 1] type 2 family 0 port 20000 - 0 [ 921.815736][T23258] C speed is unknown, defaulting to 1000 [ 921.851847][T23326] tipc: Resetting bearer [ 921.886554][T23258] C speed is unknown, defaulting to 1000 [ 921.984632][ T6588] netdevsim netdevsim5 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 921.994770][T23326] Bluetooth: hci6: Opcode 0x0c1a failed: -4 [ 922.022185][ T6588] netdevsim netdevsim5 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 922.030913][T23326] Bluetooth: hci6: Error when powering off device on rfkill (-4) [ 922.079113][T23341] syzkaller0: entered promiscuous mode [ 922.096515][T23341] syzkaller0: entered allmulticast mode [ 922.124880][ T6580] netdevsim netdevsim5 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 922.217111][T23326] Bluetooth: hci7: Opcode 0x0c1a failed: -4 [ 922.224299][ T6574] netdevsim netdevsim5 eth4: set [0, 0] type 1 family 0 port 8472 - 0 [ 922.237337][T23326] Bluetooth: hci7: Error when powering off device on rfkill (-4) [ 922.301062][ T6586] dvmrp0: left allmulticast mode [ 922.406864][ T6586] bond0 (unregistering): (slave ip6gre1): Releasing backup interface [ 922.455988][ T6586] bond1 (unregistering): (slave geneve2): Releasing active interface [ 922.506090][ T6586] bond5 (unregistering): (slave bridge9): Releasing backup interface [ 922.524253][ T6586] bridge9 (unregistering): left promiscuous mode [ 922.555617][ T6586] bond0 (unregistering): Released all slaves [ 922.568005][ T6586] bond1 (unregistering): Released all slaves [ 922.584347][ T6586] bond2 (unregistering): Released all slaves [ 922.600858][ T6586] bond3 (unregistering): Released all slaves [ 922.616999][ T6586] bond4 (unregistering): Released all slaves [ 922.635286][ T6586] bond5 (unregistering): Released all slaves [ 922.650140][ T6586] bond6 (unregistering): Released all slaves [ 922.662310][ T6586] bond7 (unregistering): Released all slaves [ 922.668430][ T2024] Bluetooth: hci8: command tx timeout [ 922.679287][T23258] xfrm0 speed is unknown, defaulting to 1000 [ 922.704919][T23326] Bluetooth: hci8: Opcode 0x0c1a failed: -4 [ 922.714169][T23326] Bluetooth: hci8: Error when powering off device on rfkill (-4) [ 922.799959][ T6586] tipc: Left network mode [ 922.876970][ T6586] IPVS: stopping backup sync thread 21069 ... [ 923.013762][T23374] netlink: 8 bytes leftover after parsing attributes in process `syz.0.19351'. [ 923.033481][T23371] syzkaller0: entered promiscuous mode [ 923.043997][T23374] netlink: 4 bytes leftover after parsing attributes in process `syz.0.19351'. [ 923.055220][T23371] syzkaller0: entered allmulticast mode [ 923.297806][T23394] xt_connbytes: Forcing CT accounting to be enabled [ 923.341765][T23394] x_tables: ip_tables: DNAT target: used from hooks POSTROUTING, but only usable from PREROUTING/OUTPUT [ 923.454426][T23402] netlink: 48 bytes leftover after parsing attributes in process `syz.4.19354'. [ 923.548850][T23407] netlink: 16 bytes leftover after parsing attributes in process `syz.7.19359'. [ 923.593694][T23407] netlink: 32 bytes leftover after parsing attributes in process `syz.7.19359'. [ 923.634431][T23407] gretap1: entered promiscuous mode [ 923.673135][T23407] gretap1: entered allmulticast mode [ 923.866844][ T5283] 8021q: adding VLAN 0 to HW filter on device eth1 [ 924.116312][T23442] FAULT_INJECTION: forcing a failure. [ 924.116312][T23442] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 924.132481][T23442] CPU: 1 UID: 0 PID: 23442 Comm: syz.7.19374 Not tainted syzkaller #0 PREEMPT(full) [ 924.132509][T23442] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 924.132522][T23442] Call Trace: [ 924.132530][T23442] [ 924.132538][T23442] dump_stack_lvl+0xe8/0x150 [ 924.132567][T23442] should_fail_ex+0x40c/0x560 [ 924.132594][T23442] _copy_from_user+0x2d/0xb0 [ 924.132623][T23442] ___sys_sendmsg+0x1c6/0x360 [ 924.132654][T23442] ? rcu_is_watching+0x15/0xb0 [ 924.132675][T23442] ? get_pid_task+0x20/0x1f0 [ 924.132697][T23442] ? __pfx____sys_sendmsg+0x10/0x10 [ 924.132731][T23442] ? rcu_is_watching+0x15/0xb0 [ 924.132771][T23442] ? __fget_files+0x2a/0x420 [ 924.132794][T23442] ? __fget_files+0x3a2/0x420 [ 924.132825][T23442] __x64_sys_sendmsg+0x1b1/0x290 [ 924.132857][T23442] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 924.132897][T23442] ? rcu_is_watching+0x15/0xb0 [ 924.132920][T23442] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 924.132941][T23442] do_syscall_64+0x174/0x580 [ 924.132981][T23442] ? trace_irq_disable+0x3b/0x140 [ 924.133008][T23442] ? clear_bhb_loop+0x40/0x90 [ 924.133032][T23442] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 924.133052][T23442] RIP: 0033:0x7fe8df79ce59 [ 924.133070][T23442] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 924.133087][T23442] RSP: 002b:00007fe8e06e7028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 924.133110][T23442] RAX: ffffffffffffffda RBX: 00007fe8dfa15fa0 RCX: 00007fe8df79ce59 [ 924.133125][T23442] RDX: 0000000000000000 RSI: 0000200000000080 RDI: 0000000000000003 [ 924.133150][T23442] RBP: 00007fe8e06e7090 R08: 0000000000000000 R09: 0000000000000000 [ 924.133162][T23442] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 924.133173][T23442] R13: 00007fe8dfa16038 R14: 00007fe8dfa15fa0 R15: 00007ffdf0ebd8f8 [ 924.133198][T23442] [ 924.720931][T23470] netlink: 16 bytes leftover after parsing attributes in process `syz.4.19380'. [ 924.751288][T23470] netlink: 6 bytes leftover after parsing attributes in process `syz.4.19380'. [ 924.761127][T23470] netlink: 64 bytes leftover after parsing attributes in process `syz.4.19380'. [ 924.823624][T23472] tipc: Enabled bearer , priority 0 [ 924.891767][T23472] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 924.969259][T23487] set match dimension is over the limit! [ 925.051832][ T6586] hsr_slave_0: left promiscuous mode [ 925.087896][ T6586] hsr_slave_1: left promiscuous mode [ 925.115988][ T6586] veth0_macvtap: left promiscuous mode [ 925.130697][ T6586] veth1_vlan: left promiscuous mode [ 925.375906][ T6586] team0 (unregistering): Port device vlan0 removed [ 925.523676][T23472] tipc: Resetting bearer [ 925.535720][T23258] bridge0: port 1(bridge_slave_0) entered blocking state [ 925.543674][T23258] bridge0: port 1(bridge_slave_0) entered disabled state [ 925.571239][T23258] bridge_slave_0: entered allmulticast mode [ 925.578620][T23258] bridge_slave_0: entered promiscuous mode [ 925.586403][T23505] 8021q: adding VLAN 0 to HW filter on device bond0 [ 925.595331][T23505] eql: remember to turn off Van-Jacobson compression on your slave devices [ 925.606085][T23505] A link change request failed with some changes committed already. Interface wlan1 may have been left with an inconsistent configuration, please check. [ 925.625981][ T5283] 8021q: adding VLAN 0 to HW filter on device eth2 [ 925.642721][T23471] tipc: Disabling bearer [ 925.668621][T23258] bridge0: port 2(bridge_slave_1) entered blocking state [ 925.687305][T23258] bridge0: port 2(bridge_slave_1) entered disabled state [ 925.726154][T23258] bridge_slave_1: entered allmulticast mode [ 925.745080][T23258] bridge_slave_1: entered promiscuous mode [ 925.797915][T23516] netlink: 24 bytes leftover after parsing attributes in process `syz.7.19391'. [ 925.824529][T23258] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 925.839635][T23258] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 925.914434][T23258] team0: Port device team_slave_0 added [ 925.969388][T23258] team0: Port device team_slave_1 added [ 926.077065][T23258] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 926.120797][T23258] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 926.167499][T23258] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 926.227427][T23258] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 926.244760][T23258] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 926.291369][T23258] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 926.367742][T23258] hsr_slave_0: entered promiscuous mode [ 926.374372][T23258] hsr_slave_1: entered promiscuous mode [ 926.550724][T23567] wg2: Caught tx_queue_len zero misconfig [ 926.617473][T23258] netdevsim netdevsim5 eth4 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 926.709983][T23258] netdevsim netdevsim5 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 926.725066][T23581] __nla_validate_parse: 1 callbacks suppressed [ 926.725084][T23581] netlink: 8 bytes leftover after parsing attributes in process `syz.2.19406'. [ 926.825379][T23258] netdevsim netdevsim5 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 926.859279][T23585] netlink: 4 bytes leftover after parsing attributes in process `syz.7.19408'. [ 926.885532][T23585] netlink: 14 bytes leftover after parsing attributes in process `syz.7.19408'. [ 926.944736][T23594] sock: sock_timestamping_bind_phc: sock not bind to device [ 926.979169][T23591] netlink: 20 bytes leftover after parsing attributes in process `syz.4.19409'. [ 926.989088][T23591] tipc: Invalid UDP bearer configuration [ 926.989125][T23591] tipc: Enabling of bearer rejected, failed to enable media [ 927.039002][ T57] syzkaller0: tun_net_xmit 76 [ 927.043962][ T57] syzkaller0: tun_net_xmit 48 [ 927.069622][ T29] syzkaller0: tun_net_xmit 76 [ 927.084682][T23581] netlink: 'syz.2.19406': attribute type 1 has an invalid length. [ 927.097961][T23258] netdevsim netdevsim5 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 927.124524][T23581] netlink: 96 bytes leftover after parsing attributes in process `syz.2.19406'. [ 927.137422][T23581] netlink: 1 bytes leftover after parsing attributes in process `syz.2.19406'. [ 927.173169][T23598] netlink: 'syz.0.19411': attribute type 39 has an invalid length. [ 927.191028][T23600] netlink: 12 bytes leftover after parsing attributes in process `syz.4.19412'. [ 927.213853][T23581] netlink: 658 bytes leftover after parsing attributes in process `syz.2.19406'. [ 927.227181][T23578] syzkaller0: delete flow: hash 3895855652 index 1 [ 927.414545][T23611] netlink: 'syz.7.19415': attribute type 4 has an invalid length. [ 927.449695][T23611] netlink: 152 bytes leftover after parsing attributes in process `syz.7.19415'. [ 927.502956][T23258] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 927.541878][T23258] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 927.568458][T23611] .`: renamed from bond0 [ 927.601738][T23620] vlan0: entered promiscuous mode [ 927.606905][T23625] netlink: 8 bytes leftover after parsing attributes in process `syz.2.19418'. [ 927.623251][T23620] bridge0: entered promiscuous mode [ 927.654718][T23258] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 927.691530][T23258] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 927.723777][T23258] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 927.790737][T23258] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 927.842157][T23258] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 927.871506][T23258] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 927.880998][T23632] FAULT_INJECTION: forcing a failure. [ 927.880998][T23632] name failslab, interval 1, probability 0, space 0, times 0 [ 927.905494][T23632] CPU: 0 UID: 0 PID: 23632 Comm: syz.4.19419 Not tainted syzkaller #0 PREEMPT(full) [ 927.905518][T23632] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 927.905530][T23632] Call Trace: [ 927.905537][T23632] [ 927.905545][T23632] dump_stack_lvl+0xe8/0x150 [ 927.905569][T23632] should_fail_ex+0x40c/0x560 [ 927.905595][T23632] should_failslab+0xa8/0x100 [ 927.905622][T23632] ? skb_clone+0x212/0x3a0 [ 927.905638][T23632] kmem_cache_alloc_noprof+0x87/0x650 [ 927.905661][T23632] ? apparmor_capable+0x126/0x170 [ 927.905688][T23632] skb_clone+0x212/0x3a0 [ 927.905703][T23632] ? nfnetlink_rcv+0x4b0/0x28c0 [ 927.905728][T23632] nfnetlink_rcv+0x4de/0x28c0 [ 927.905751][T23632] ? is_bpf_text_address+0x292/0x2b0 [ 927.905783][T23632] ? kernel_text_address+0xa5/0xe0 [ 927.905803][T23632] ? __kernel_text_address+0xd/0x30 [ 927.905822][T23632] ? unwind_get_return_address+0x4d/0x90 [ 927.905844][T23632] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 927.905870][T23632] ? arch_stack_walk+0xfb/0x150 [ 927.905900][T23632] ? stack_trace_save+0xa9/0x100 [ 927.905924][T23632] ? __pfx_stack_trace_save+0x10/0x10 [ 927.905959][T23632] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 927.905991][T23632] ? netlink_sendmsg+0x5d4/0xb40 [ 927.906007][T23632] ? ____sys_sendmsg+0x9b9/0xa20 [ 927.906034][T23632] ? ___sys_sendmsg+0x2a5/0x360 [ 927.906059][T23632] ? __x64_sys_sendmsg+0x1b1/0x290 [ 927.906109][T23632] ? __netlink_lookup+0xc6/0x8b0 [ 927.906127][T23632] ? rcu_is_watching+0x15/0xb0 [ 927.906150][T23632] ? rcu_is_watching+0x15/0xb0 [ 927.906170][T23632] ? lock_release+0x4b/0x3c0 [ 927.906205][T23632] ? net_generic+0x1e/0x240 [ 927.906228][T23632] ? rcu_is_watching+0x15/0xb0 [ 927.906249][T23632] ? netlink_deliver_tap+0x2e/0x1b0 [ 927.906288][T23632] ? rcu_is_watching+0x15/0xb0 [ 927.906306][T23632] ? netlink_deliver_tap+0x2e/0x1b0 [ 927.906334][T23632] ? rcu_is_watching+0x15/0xb0 [ 927.906352][T23632] ? netlink_deliver_tap+0x2e/0x1b0 [ 927.906380][T23632] ? lock_release+0x4b/0x3c0 [ 927.906409][T23632] ? netlink_deliver_tap+0x2e/0x1b0 [ 927.906440][T23632] netlink_unicast+0x7bb/0x940 [ 927.906471][T23632] netlink_sendmsg+0x813/0xb40 [ 927.906495][T23632] ? __pfx_netlink_sendmsg+0x10/0x10 [ 927.906526][T23632] ? aa_sock_msg_perm+0xf1/0x1b0 [ 927.906546][T23632] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 927.906569][T23632] ? __pfx_netlink_sendmsg+0x10/0x10 [ 927.906617][T23632] ____sys_sendmsg+0x9b9/0xa20 [ 927.906651][T23632] ? __pfx_____sys_sendmsg+0x10/0x10 [ 927.906682][T23632] ? lock_release+0x4b/0x3c0 [ 927.906713][T23632] ? import_iovec+0x73/0xa0 [ 927.906741][T23632] ___sys_sendmsg+0x2a5/0x360 [ 927.906779][T23632] ? rcu_is_watching+0x15/0xb0 [ 927.906797][T23632] ? get_pid_task+0x20/0x1f0 [ 927.906816][T23632] ? __pfx____sys_sendmsg+0x10/0x10 [ 927.906846][T23632] ? rcu_is_watching+0x15/0xb0 [ 927.906881][T23632] ? __fget_files+0x2a/0x420 [ 927.906901][T23632] ? __fget_files+0x3a2/0x420 [ 927.906927][T23632] __x64_sys_sendmsg+0x1b1/0x290 [ 927.906964][T23632] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 927.907001][T23632] ? rcu_is_watching+0x15/0xb0 [ 927.907022][T23632] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 927.907042][T23632] do_syscall_64+0x174/0x580 [ 927.907066][T23632] ? trace_irq_disable+0x3b/0x140 [ 927.907091][T23632] ? clear_bhb_loop+0x40/0x90 [ 927.907114][T23632] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 927.907132][T23632] RIP: 0033:0x7fbbfa59ce59 [ 927.907150][T23632] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 927.907166][T23632] RSP: 002b:00007fbbfb4b3028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 927.907186][T23632] RAX: ffffffffffffffda RBX: 00007fbbfa816090 RCX: 00007fbbfa59ce59 [ 927.907201][T23632] RDX: 0000000000000000 RSI: 0000200000000040 RDI: 000000000000000b [ 927.907214][T23632] RBP: 00007fbbfb4b3090 R08: 0000000000000000 R09: 0000000000000000 [ 927.907243][T23632] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 927.907255][T23632] R13: 00007fbbfa816128 R14: 00007fbbfa816090 R15: 00007ffff30f3eb8 [ 927.907282][T23632] [ 928.396688][T23258] 8021q: adding VLAN 0 to HW filter on device bond0 [ 928.411219][T23258] 8021q: adding VLAN 0 to HW filter on device team0 [ 928.444498][ T6575] bridge0: port 1(bridge_slave_0) entered blocking state [ 928.451725][ T6575] bridge0: port 1(bridge_slave_0) entered forwarding state [ 928.463135][ T6575] bridge0: port 2(bridge_slave_1) entered blocking state [ 928.470274][ T6575] bridge0: port 2(bridge_slave_1) entered forwarding state [ 928.492356][T23258] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 928.502919][T23258] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 928.959719][T23686] netlink: 'syz.7.19428': attribute type 1 has an invalid length. [ 929.278749][T23714] FAULT_INJECTION: forcing a failure. [ 929.278749][T23714] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 929.304824][T23714] CPU: 0 UID: 0 PID: 23714 Comm: syz.2.19434 Not tainted syzkaller #0 PREEMPT(full) [ 929.304850][T23714] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 929.304862][T23714] Call Trace: [ 929.304869][T23714] [ 929.304877][T23714] dump_stack_lvl+0xe8/0x150 [ 929.304903][T23714] should_fail_ex+0x40c/0x560 [ 929.304926][T23714] _copy_from_user+0x2d/0xb0 [ 929.304953][T23714] ___sys_sendmsg+0x1c6/0x360 [ 929.304980][T23714] ? rcu_is_watching+0x15/0xb0 [ 929.304999][T23714] ? get_pid_task+0x20/0x1f0 [ 929.305019][T23714] ? __pfx____sys_sendmsg+0x10/0x10 [ 929.305050][T23714] ? rcu_is_watching+0x15/0xb0 [ 929.305087][T23714] ? __fget_files+0x2a/0x420 [ 929.305108][T23714] ? __fget_files+0x3a2/0x420 [ 929.305135][T23714] __x64_sys_sendmsg+0x1b1/0x290 [ 929.305165][T23714] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 929.305201][T23714] ? rcu_is_watching+0x15/0xb0 [ 929.305222][T23714] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 929.305250][T23714] do_syscall_64+0x174/0x580 [ 929.305275][T23714] ? trace_irq_disable+0x3b/0x140 [ 929.305302][T23714] ? clear_bhb_loop+0x40/0x90 [ 929.305325][T23714] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 929.305343][T23714] RIP: 0033:0x7f24a379ce59 [ 929.305360][T23714] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 929.305377][T23714] RSP: 002b:00007f24a4617028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 929.305398][T23714] RAX: ffffffffffffffda RBX: 00007f24a3a15fa0 RCX: 00007f24a379ce59 [ 929.305412][T23714] RDX: 0000000020000080 RSI: 0000200000000100 RDI: 0000000000000003 [ 929.305425][T23714] RBP: 00007f24a4617090 R08: 0000000000000000 R09: 0000000000000000 [ 929.305437][T23714] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 929.305447][T23714] R13: 00007f24a3a16038 R14: 00007f24a3a15fa0 R15: 00007ffe32ad8538 [ 929.305471][T23714] [ 929.561805][T23723] netlink: 'syz.2.19437': attribute type 5 has an invalid length. [ 929.695650][T23258] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 930.086440][T23753] sit0: mtu less than device minimum [ 930.443917][T23258] veth0_vlan: entered promiscuous mode [ 930.489719][T23258] veth1_vlan: entered promiscuous mode [ 930.556256][T23258] veth0_macvtap: entered promiscuous mode [ 930.585302][T23258] veth1_macvtap: entered promiscuous mode [ 930.645720][T23258] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 930.691439][T23258] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 930.717407][ T6577] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 930.743162][ T6577] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 930.782034][ T6577] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 930.811437][ T6577] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 930.831955][T23799] FAULT_INJECTION: forcing a failure. [ 930.831955][T23799] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 930.885337][T23799] CPU: 1 UID: 0 PID: 23799 Comm: syz.7.19453 Not tainted syzkaller #0 PREEMPT(full) [ 930.885364][T23799] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 930.885378][T23799] Call Trace: [ 930.885386][T23799] [ 930.885394][T23799] dump_stack_lvl+0xe8/0x150 [ 930.885421][T23799] should_fail_ex+0x40c/0x560 [ 930.885447][T23799] _copy_from_iter+0x1d3/0x1660 [ 930.885474][T23799] ? rcu_is_watching+0x15/0xb0 [ 930.885500][T23799] ? __pfx__copy_from_iter+0x10/0x10 [ 930.885521][T23799] ? kmem_cache_alloc_node_noprof+0x3ca/0x680 [ 930.885554][T23799] ? netlink_sendmsg+0x650/0xb40 [ 930.885583][T23799] ? skb_put+0x112/0x210 [ 930.885611][T23799] netlink_sendmsg+0x6c0/0xb40 [ 930.885636][T23799] ? __pfx_netlink_sendmsg+0x10/0x10 [ 930.885670][T23799] ? aa_sock_msg_perm+0xf1/0x1b0 [ 930.885690][T23799] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 930.885715][T23799] ? __pfx_netlink_sendmsg+0x10/0x10 [ 930.885747][T23799] ____sys_sendmsg+0x9b9/0xa20 [ 930.885782][T23799] ? __pfx_____sys_sendmsg+0x10/0x10 [ 930.885813][T23799] ? lock_release+0x4b/0x3c0 [ 930.885845][T23799] ? import_iovec+0x73/0xa0 [ 930.885874][T23799] ___sys_sendmsg+0x2a5/0x360 [ 930.885902][T23799] ? rcu_is_watching+0x15/0xb0 [ 930.885921][T23799] ? get_pid_task+0x20/0x1f0 [ 930.885942][T23799] ? __pfx____sys_sendmsg+0x10/0x10 [ 930.885975][T23799] ? rcu_is_watching+0x15/0xb0 [ 930.886013][T23799] ? __fget_files+0x2a/0x420 [ 930.886036][T23799] ? __fget_files+0x3a2/0x420 [ 930.886064][T23799] __x64_sys_sendmsg+0x1b1/0x290 [ 930.886095][T23799] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 930.886134][T23799] ? rcu_is_watching+0x15/0xb0 [ 930.886156][T23799] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 930.886177][T23799] do_syscall_64+0x174/0x580 [ 930.886204][T23799] ? trace_irq_disable+0x3b/0x140 [ 930.886232][T23799] ? clear_bhb_loop+0x40/0x90 [ 930.886255][T23799] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 930.886275][T23799] RIP: 0033:0x7fe8df79ce59 [ 930.886294][T23799] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 930.886312][T23799] RSP: 002b:00007fe8e06a5028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 930.886333][T23799] RAX: ffffffffffffffda RBX: 00007fe8dfa16180 RCX: 00007fe8df79ce59 [ 930.886348][T23799] RDX: 0000000000000000 RSI: 0000200000000040 RDI: 000000000000000b [ 930.886362][T23799] RBP: 00007fe8e06a5090 R08: 0000000000000000 R09: 0000000000000000 [ 930.886375][T23799] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 930.886388][T23799] R13: 00007fe8dfa16218 R14: 00007fe8dfa16180 R15: 00007ffdf0ebd8f8 [ 930.886414][T23799] [ 931.302981][ T6586] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 931.362844][ T6586] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 931.386055][ T57] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 931.415880][ T57] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 931.505665][T23813] tipc: Enabling of bearer rejected, already enabled [ 932.032196][ T5624] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 932.047529][ T5624] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 932.058614][ T5624] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 932.071316][ T5624] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 932.093158][ T5624] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 932.164617][T23856] netlink: 'syz.0.19466': attribute type 3 has an invalid length. [ 932.174580][T23856] __nla_validate_parse: 3 callbacks suppressed [ 932.174597][T23856] netlink: 4 bytes leftover after parsing attributes in process `syz.0.19466'. [ 932.191739][T23856] netlink: 14 bytes leftover after parsing attributes in process `syz.0.19466'. [ 932.626621][T23874] netlink: 212348 bytes leftover after parsing attributes in process `syz.5.19472'. [ 932.644119][T23867] syzkaller0: entered promiscuous mode [ 932.659731][T23867] syzkaller0: entered allmulticast mode [ 932.717783][T23883] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 933.106094][T23846] C speed is unknown, defaulting to 1000 [ 933.114115][T23910] netlink: 4 bytes leftover after parsing attributes in process `syz.4.19479'. [ 933.140948][T23846] C speed is unknown, defaulting to 1000 [ 933.150596][T23910] netlink: 14 bytes leftover after parsing attributes in process `syz.4.19479'. [ 933.167828][T23846] C speed is unknown, defaulting to 1000 [ 933.384977][T23924] netlink: 'syz.5.19482': attribute type 1 has an invalid length. [ 933.417404][T23846] xfrm0 speed is unknown, defaulting to 1000 [ 933.510716][T23928] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for gretap4 [ 933.563101][T23928] gretap4: default qdisc (pfifo_fast) fail, fallback to noqueue [ 933.578716][T23928] gretap4: entered promiscuous mode [ 933.597580][T23928] gretap4: entered allmulticast mode [ 933.935633][T23967] netlink: 12 bytes leftover after parsing attributes in process `syz.5.19489'. [ 934.125750][T23976] netlink: 'syz.7.19491': attribute type 58 has an invalid length. [ 934.137052][T23979] netlink: 4 bytes leftover after parsing attributes in process `syz.5.19490'. [ 934.155916][T23976] netlink: 20 bytes leftover after parsing attributes in process `syz.7.19491'. [ 934.165344][T23979] netlink: 14 bytes leftover after parsing attributes in process `syz.5.19490'. [ 934.184673][T23979] FAULT_INJECTION: forcing a failure. [ 934.184673][T23979] name failslab, interval 1, probability 0, space 0, times 0 [ 934.197683][ T2024] Bluetooth: hci5: command tx timeout [ 934.203996][T23979] CPU: 0 UID: 0 PID: 23979 Comm: syz.5.19490 Not tainted syzkaller #0 PREEMPT(full) [ 934.204021][T23979] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 934.204034][T23979] Call Trace: [ 934.204042][T23979] [ 934.204050][T23979] dump_stack_lvl+0xe8/0x150 [ 934.204089][T23979] should_fail_ex+0x40c/0x560 [ 934.204112][T23979] should_failslab+0xa8/0x100 [ 934.204140][T23979] ? security_inode_alloc+0x39/0x310 [ 934.204160][T23979] kmem_cache_alloc_noprof+0x87/0x650 [ 934.204184][T23979] ? __pfx_make_kgid+0x10/0x10 [ 934.204211][T23979] security_inode_alloc+0x39/0x310 [ 934.204232][T23979] inode_init_always_gfp+0x97e/0xd30 [ 934.204254][T23979] ? __pfx_debugfs_alloc_inode+0x10/0x10 [ 934.204279][T23979] alloc_inode+0x82/0x1b0 [ 934.204298][T23979] new_inode+0x1f/0x170 [ 934.204321][T23979] __debugfs_create_file+0xb8/0x400 [ 934.204346][T23979] debugfs_create_file_full+0x3f/0x60 [ 934.204370][T23979] ref_tracker_dir_debugfs+0x197/0x360 [ 934.204393][T23979] ? __pfx_ref_tracker_dir_debugfs+0x10/0x10 [ 934.204430][T23979] ? __kvmalloc_node_noprof+0x53d/0x890 [ 934.204458][T23979] ? alloc_netdev_mqs+0xa9/0x1270 [ 934.204480][T23979] ? __raw_spin_lock_init+0x45/0x100 [ 934.204507][T23979] alloc_netdev_mqs+0x275/0x1270 [ 934.204524][T23979] ? __pfx_snprintf+0x10/0x10 [ 934.204544][T23979] ? __pfx_geneve_setup+0x10/0x10 [ 934.204573][T23979] rtnl_create_link+0x321/0xd70 [ 934.204598][T23979] rtnl_newlink_create+0x25f/0xb00 [ 934.204631][T23979] ? __mutex_lock+0x5d4/0x1550 [ 934.204658][T23979] ? __pfx_rtnl_newlink_create+0x10/0x10 [ 934.204688][T23979] ? __pfx___mutex_lock+0x10/0x10 [ 934.204718][T23979] ? ns_capable+0x89/0xe0 [ 934.204744][T23979] rtnl_newlink+0x167f/0x1bd0 [ 934.204785][T23979] ? __pfx_rtnl_newlink+0x10/0x10 [ 934.204808][T23979] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 934.204847][T23979] ? rcu_is_watching+0x15/0xb0 [ 934.204868][T23979] ? trace_irq_enable+0x3b/0x140 [ 934.204896][T23979] ? nlmon_xmit+0xb0/0x100 [ 934.204918][T23979] ? kmem_cache_free+0x182/0x650 [ 934.204951][T23979] ? dev_hard_start_xmit+0x7c7/0x830 [ 934.204980][T23979] ? __dev_queue_xmit+0x29b/0x37f0 [ 934.205026][T23979] ? __dev_queue_xmit+0x29b/0x37f0 [ 934.205046][T23979] ? rcu_is_watching+0x15/0xb0 [ 934.205066][T23979] ? __dev_queue_xmit+0x29b/0x37f0 [ 934.205084][T23979] ? trace_irq_enable+0x3b/0x140 [ 934.205110][T23979] ? __dev_queue_xmit+0x29b/0x37f0 [ 934.205129][T23979] ? __dev_queue_xmit+0x29b/0x37f0 [ 934.205146][T23979] ? __local_bh_enable_ip+0xd0/0x130 [ 934.205171][T23979] ? __dev_queue_xmit+0x29b/0x37f0 [ 934.205198][T23979] ? __pfx_rtnl_newlink+0x10/0x10 [ 934.205223][T23979] ? lock_release+0x4b/0x3c0 [ 934.205251][T23979] ? bpf_lsm_capable+0x9/0x20 [ 934.205269][T23979] ? security_capable+0x7e/0x2c0 [ 934.205303][T23979] ? __pfx_rtnl_newlink+0x10/0x10 [ 934.205329][T23979] rtnetlink_rcv_msg+0x802/0xc00 [ 934.205358][T23979] ? rtnetlink_rcv_msg+0x1c9/0xc00 [ 934.205385][T23979] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 934.205410][T23979] ? ref_tracker_free+0x689/0x830 [ 934.205435][T23979] ? __pfx_ref_tracker_free+0x10/0x10 [ 934.205465][T23979] netlink_rcv_skb+0x226/0x4a0 [ 934.205496][T23979] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 934.205524][T23979] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 934.205564][T23979] ? netlink_deliver_tap+0x2e/0x1b0 [ 934.205597][T23979] netlink_unicast+0x7bb/0x940 [ 934.205631][T23979] netlink_sendmsg+0x813/0xb40 [ 934.205655][T23979] ? __pfx_netlink_sendmsg+0x10/0x10 [ 934.205687][T23979] ? aa_sock_msg_perm+0xf1/0x1b0 [ 934.205708][T23979] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 934.205733][T23979] ? __pfx_netlink_sendmsg+0x10/0x10 [ 934.205772][T23979] ____sys_sendmsg+0x9b9/0xa20 [ 934.205807][T23979] ? __pfx_____sys_sendmsg+0x10/0x10 [ 934.205838][T23979] ? lock_release+0x4b/0x3c0 [ 934.205868][T23979] ? import_iovec+0x73/0xa0 [ 934.205908][T23979] ___sys_sendmsg+0x2a5/0x360 [ 934.205933][T23979] ? rcu_is_watching+0x15/0xb0 [ 934.205952][T23979] ? get_pid_task+0x20/0x1f0 [ 934.205971][T23979] ? __pfx____sys_sendmsg+0x10/0x10 [ 934.206000][T23979] ? rcu_is_watching+0x15/0xb0 [ 934.206035][T23979] ? __fget_files+0x2a/0x420 [ 934.206055][T23979] ? __fget_files+0x3a2/0x420 [ 934.206081][T23979] __x64_sys_sendmsg+0x1b1/0x290 [ 934.206110][T23979] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 934.206147][T23979] ? rcu_is_watching+0x15/0xb0 [ 934.206166][T23979] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 934.206186][T23979] do_syscall_64+0x174/0x580 [ 934.206209][T23979] ? trace_irq_disable+0x3b/0x140 [ 934.206234][T23979] ? clear_bhb_loop+0x40/0x90 [ 934.206256][T23979] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 934.206273][T23979] RIP: 0033:0x7fd294f9ce59 [ 934.206290][T23979] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 934.206303][T23979] RSP: 002b:00007fd295e86028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 934.206320][T23979] RAX: ffffffffffffffda RBX: 00007fd295215fa0 RCX: 00007fd294f9ce59 [ 934.206331][T23979] RDX: 0000000000000000 RSI: 0000200000000080 RDI: 0000000000000003 [ 934.206341][T23979] RBP: 00007fd295e86090 R08: 0000000000000000 R09: 0000000000000000 [ 934.206350][T23979] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 934.206359][T23979] R13: 00007fd295216038 R14: 00007fd295215fa0 R15: 00007ffc164d7ef8 [ 934.206378][T23979] [ 934.206425][T23979] debugfs: out of free dentries, can not create file 'netdev@ffff888032e306f0' [ 934.863837][T23846] bridge0: port 1(bridge_slave_0) entered blocking state [ 934.871880][T23846] bridge0: port 1(bridge_slave_0) entered disabled state [ 934.882192][T23846] bridge_slave_0: entered allmulticast mode [ 934.901195][T23846] bridge_slave_0: entered promiscuous mode [ 934.921144][T23846] bridge0: port 2(bridge_slave_1) entered blocking state [ 934.949883][T23846] bridge0: port 2(bridge_slave_1) entered disabled state [ 934.972811][T23846] bridge_slave_1: entered allmulticast mode [ 935.007196][T23846] bridge_slave_1: entered promiscuous mode [ 935.016702][T23996] IPv6: NLM_F_CREATE should be specified when creating new route [ 935.092154][T23846] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 935.107268][T24006] netlink: 4 bytes leftover after parsing attributes in process `syz.0.19497'. [ 935.127907][T23846] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 935.261530][T23846] team0: Port device team_slave_0 added [ 935.297148][T23846] team0: Port device team_slave_1 added [ 935.375573][T23846] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 935.409318][T23846] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 935.492217][T23846] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 935.517709][T23846] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 935.525666][T23846] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 935.591660][T23846] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 935.698185][T24038] netlink: 'syz.7.19506': attribute type 1 has an invalid length. [ 935.733298][T23846] hsr_slave_0: entered promiscuous mode [ 935.750164][T23846] hsr_slave_1: entered promiscuous mode [ 935.766340][T23846] debugfs: 'hsr0' already exists in 'hsr' [ 935.779504][T23846] Cannot create hsr debugfs directory [ 935.795259][T24048] netlink: 'syz.4.19508': attribute type 10 has an invalid length. [ 935.825225][T24038] 8021q: adding VLAN 0 to HW filter on device bond0 [ 935.869773][ T31] INFO: task syz.3.16843:15517 blocked for more than 143 seconds. [ 935.884341][ T31] Not tainted syzkaller #0 [ 935.900833][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 935.933149][ T31] task:syz.3.16843 state:D stack:27576 pid:15517 tgid:15515 ppid:5619 task_flags:0x400040 flags:0x00080002 [ 935.969121][ T31] Call Trace: [ 935.972507][ T31] [ 935.975523][ T31] __schedule+0x17d9/0x56c0 [ 935.980541][ T31] ? trace_irq_enable+0x3b/0x140 [ 935.985603][ T31] ? __kmalloc_node_track_caller_noprof+0x4d7/0x7b0 [ 935.992586][ T31] ? netlink_rcv_skb+0x226/0x4a0 [ 935.997618][ T31] ? genl_rcv+0x28/0x40 [ 936.003598][ T31] ? __pfx___schedule+0x10/0x10 [ 936.008748][ T31] ? rcu_is_watching+0x15/0xb0 [ 936.013643][ T31] ? rcu_is_watching+0x15/0xb0 [ 936.023644][ T31] ? lock_release+0x4b/0x3c0 [ 936.034917][ T31] ? rcu_is_watching+0x15/0xb0 [ 936.045308][ T31] schedule+0x164/0x360 [ 936.054021][ T31] schedule_preempt_disabled+0x13/0x30 [ 936.067266][ T31] __mutex_lock+0x7bf/0x1550 [ 936.072331][ T31] ? __mutex_lock+0x5d4/0x1550 [ 936.077243][ T31] ? nfsd_nl_threads_get_doit+0x1c0/0x790 [ 936.099278][ T31] ? __pfx___mutex_lock+0x10/0x10 [ 936.105871][ T31] ? __nlmsg_put+0xef/0x1b0 [ 936.111327][ T31] ? genlmsg_put+0x137/0x2e0 [ 936.116025][ T31] nfsd_nl_threads_get_doit+0x1c0/0x790 [ 936.130709][ T31] ? is_bpf_text_address+0x26/0x2b0 [ 936.136024][ T31] ? rcu_is_watching+0x15/0xb0 [ 936.141321][ T31] ? rcu_is_watching+0x15/0xb0 [ 936.146188][ T31] ? __pfx_nfsd_nl_threads_get_doit+0x10/0x10 [ 936.153261][ T31] ? __nla_parse+0x40/0x60 [ 936.157761][ T31] ? genl_family_rcv_msg_attrs_parse+0x20b/0x2f0 [ 936.164620][ T31] ? genl_family_rcv_msg_attrs_parse+0x265/0x2f0 [ 936.171355][ T31] genl_family_rcv_msg_doit+0x233/0x340 [ 936.177057][ T31] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 936.184263][ T31] ? lapic_next_event+0x11/0x20 [ 936.190704][ T31] ? clockevents_program_event+0x491/0x630 [ 936.196615][ T31] genl_rcv_msg+0x614/0x7a0 [ 936.201752][ T31] ? __pfx_genl_rcv_msg+0x10/0x10 [ 936.206872][ T31] ? rcu_is_watching+0x15/0xb0 [ 936.212507][ T31] ? __pfx_nfsd_nl_threads_get_doit+0x10/0x10 [ 936.218987][ T31] ? __netlink_lookup+0xc6/0x8b0 [ 936.224055][ T31] ? rcu_is_watching+0x15/0xb0 [ 936.229159][ T31] netlink_rcv_skb+0x226/0x4a0 [ 936.234282][ T31] ? __pfx_genl_rcv_msg+0x10/0x10 [ 936.241458][ T31] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 936.246939][ T31] ? down_read+0x2be/0x330 [ 936.254296][ T31] genl_rcv+0x28/0x40 [ 936.258839][ T31] netlink_unicast+0x7bb/0x940 [ 936.264689][ T31] netlink_sendmsg+0x813/0xb40 [ 936.277277][ T2024] Bluetooth: hci5: command tx timeout [ 936.289507][ T31] ? __pfx_netlink_sendmsg+0x10/0x10 [ 936.296747][ T31] ? futex_unqueue+0x22/0x240 [ 936.302681][ T31] ? aa_sock_msg_perm+0xf1/0x1b0 [ 936.307786][ T31] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 936.313496][ T31] ? __pfx_netlink_sendmsg+0x10/0x10 [ 936.319337][ T31] ____sys_sendmsg+0x9b9/0xa20 [ 936.324200][ T31] ? __pfx_____sys_sendmsg+0x10/0x10 [ 936.330278][ T31] ? lock_release+0x4b/0x3c0 [ 936.334965][ T31] ? import_iovec+0x73/0xa0 [ 936.339946][ T31] ___sys_sendmsg+0x2a5/0x360 [ 936.344695][ T31] ? __pfx____sys_sendmsg+0x10/0x10 [ 936.350476][ T31] ? futex_wait+0x2a2/0x390 [ 936.355175][ T31] ? __fget_files+0x2a/0x420 [ 936.360915][ T31] ? __fget_files+0x3a2/0x420 [ 936.365667][ T31] __x64_sys_sendmsg+0x1b1/0x290 [ 936.371027][ T31] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 936.376573][ T31] ? rcu_is_watching+0x15/0xb0 [ 936.381722][ T31] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 936.387838][ T31] do_syscall_64+0x174/0x580 [ 936.393424][ T31] ? trace_irq_disable+0x3b/0x140 [ 936.398807][ T31] ? clear_bhb_loop+0x40/0x90 [ 936.403533][ T31] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 936.409732][ T31] RIP: 0033:0x7f052b79ce59 [ 936.414184][ T31] RSP: 002b:00007f052c592028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 936.423538][ T31] RAX: ffffffffffffffda RBX: 00007f052ba15fa0 RCX: 00007f052b79ce59 [ 936.433221][ T31] RDX: 0000000004040090 RSI: 0000200000000000 RDI: 0000000000000003 [ 936.441907][ T31] RBP: 00007f052b832e6f R08: 0000000000000000 R09: 0000000000000000 [ 936.450201][ T31] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 936.464118][ T31] R13: 00007f052ba16038 R14: 00007f052ba15fa0 R15: 00007ffc4b1bf5d8 [ 936.472566][ T31] [ 936.495516][ T31] INFO: lockdep is turned off. [ 936.546363][ T31] NMI backtrace for cpu 0 [ 936.546381][ T31] CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) [ 936.546402][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 936.546414][ T31] Call Trace: [ 936.546421][ T31] [ 936.546428][ T31] dump_stack_lvl+0xe8/0x150 [ 936.546453][ T31] nmi_cpu_backtrace+0x274/0x2d0 [ 936.546475][ T31] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 936.546516][ T31] nmi_trigger_cpumask_backtrace+0x17a/0x300 [ 936.546540][ T31] sys_info+0x135/0x170 [ 936.546557][ T31] watchdog+0xfd7/0x1030 [ 936.546587][ T31] ? watchdog+0x1c7/0x1030 [ 936.546634][ T31] kthread+0x388/0x470 [ 936.546653][ T31] ? __pfx_watchdog+0x10/0x10 [ 936.546677][ T31] ? __pfx_kthread+0x10/0x10 [ 936.546696][ T31] ret_from_fork+0x514/0xb70 [ 936.546718][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 936.546737][ T31] ? __switch_to+0xc89/0x1420 [ 936.546766][ T31] ? __pfx_kthread+0x10/0x10 [ 936.546785][ T31] ret_from_fork_asm+0x1a/0x30 [ 936.546819][ T31] [ 936.546827][ T31] Sending NMI from CPU 0 to CPUs 1: [ 936.659657][ C1] NMI backtrace for cpu 1 [ 936.659673][ C1] CPU: 1 UID: 0 PID: 24069 Comm: dhcpcd-run-hook Not tainted syzkaller #0 PREEMPT(full) [ 936.659694][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 936.659705][ C1] RIP: 0010:__sanitizer_cov_trace_const_cmp4+0x0/0x90 [ 936.659734][ C1] Code: 11 10 48 89 74 11 18 48 89 44 11 20 e9 59 fa e4 09 cc 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1e fa 48 8b 04 24 65 48 8b 15 98 55 74 11 65 8b 0d b9 55 74 [ 936.659749][ C1] RSP: 0018:ffffc90007dffd60 EFLAGS: 00000246 [ 936.659765][ C1] RAX: 0000000000000000 RBX: ffff888076856a48 RCX: ffff88801d3e0000 [ 936.659778][ C1] RDX: 0000000000000000 RSI: 0000000000000002 RDI: 0000000000000000 [ 936.659788][ C1] RBP: 0000000000000002 R08: 0000000000000003 R09: 0000000000000004 [ 936.659798][ C1] R10: dffffc0000000000 R11: fffff52000fbff9c R12: dffffc0000000000 [ 936.659812][ C1] R13: 1ffff1100ed0ad68 R14: ffff888076856b00 R15: ffff888076856b40 [ 936.659825][ C1] FS: 00007f1d3a42bc80(0000) GS:ffff88812537b000(0000) knlGS:0000000000000000 [ 936.659840][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 936.659863][ C1] CR2: 00007ffda35a0ff8 CR3: 0000000049e50000 CR4: 00000000003526f0 [ 936.659878][ C1] Call Trace: [ 936.659895][ C1] [ 936.659900][ C1] fast_dput+0x389/0x670 [ 936.659919][ C1] dput+0x30/0x60 [ 936.659934][ C1] __fput+0x675/0xa50 [ 936.659954][ C1] fput_close_sync+0x11f/0x240 [ 936.659971][ C1] ? __pfx_fput_close_sync+0x10/0x10 [ 936.659996][ C1] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 936.660013][ C1] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 936.660028][ C1] __x64_sys_close+0x7e/0x110 [ 936.660046][ C1] do_syscall_64+0x174/0x580 [ 936.660067][ C1] ? clear_bhb_loop+0x40/0x90 [ 936.660086][ C1] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 936.660100][ C1] RIP: 0033:0x7f1d3a5e9a67 [ 936.660113][ C1] Code: 44 00 00 48 83 ec 10 48 63 ff 45 31 c9 45 31 c0 6a 01 31 c9 e8 ca 19 f9 ff 48 83 c4 18 c3 0f 1f 44 00 00 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 8b 15 61 b3 0d 00 f7 d8 64 89 02 b8 [ 936.660125][ C1] RSP: 002b:00007ffda35a1de8 EFLAGS: 00000202 ORIG_RAX: 0000000000000003 [ 936.660140][ C1] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f1d3a5e9a67 [ 936.660150][ C1] RDX: 000000000000d371 RSI: 0000563e1817fc90 RDI: 0000000000000003 [ 936.660160][ C1] RBP: 0000563e18175511 R08: 0000000000005330 R09: 0000000000000000 [ 936.660170][ C1] R10: 0000563e18175509 R11: 0000000000000202 R12: 00007ffda35a1f38 [ 936.660180][ C1] R13: 0000563e18175508 R14: 0000000000000001 R15: 0000563e18177e37 [ 936.660217][ C1] [ 936.952136][ T31] Kernel panic - not syncing: hung_task: blocked tasks [ 936.959031][ T31] CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) [ 936.968159][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 936.978247][ T31] Call Trace: [ 936.981540][ T31] [ 936.984490][ T31] vpanic+0x56c/0xa60 [ 936.988507][ T31] ? __pfx_vpanic+0x10/0x10 [ 936.993029][ T31] ? rcu_is_watching+0x15/0xb0 [ 936.997819][ T31] ? trace_irq_enable+0x3b/0x140 [ 937.002801][ T31] panic+0xc5/0xd0 [ 937.006554][ T31] ? __pfx_panic+0x10/0x10 [ 937.011008][ T31] watchdog+0x1030/0x1030 [ 937.015383][ T31] ? watchdog+0x1c7/0x1030 [ 937.019840][ T31] kthread+0x388/0x470 [ 937.023944][ T31] ? __pfx_watchdog+0x10/0x10 [ 937.028685][ T31] ? __pfx_kthread+0x10/0x10 [ 937.033321][ T31] ret_from_fork+0x514/0xb70 [ 937.037937][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 937.043073][ T31] ? __switch_to+0xc89/0x1420 [ 937.047796][ T31] ? __pfx_kthread+0x10/0x10 [ 937.052519][ T31] ret_from_fork_asm+0x1a/0x30 [ 937.057329][ T31] [ 937.060980][ T31] Kernel Offset: disabled [ 937.065309][ T31] Rebooting in 86400 seconds..