last executing test programs: 2.341723694s ago: executing program 0 (id=5731): unshare(0x22020400) r0 = socket$inet_mptcp(0x2, 0x1, 0x106) listen(r0, 0xfffffbff) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000440)={0x58, 0x2, 0x6, 0x201, 0x0, 0x0, {0x7, 0x0, 0x2}, [@IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_HASHSIZE={0x8, 0x12, 0x1, 0x0, 0x100000}]}, @IPSET_ATTR_TYPENAME={0x14, 0x3, 'hash:ip,port,ip\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}]}, 0x58}}, 0x8000) poll(&(0x7f0000000040)=[{r0, 0x1146}], 0x1, 0x400) r2 = socket$packet(0x11, 0x3, 0x300) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff) r3 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r3, &(0x7f0000000380)={0x0, 0x4076cbba9945d516, &(0x7f0000000340)={0x0, 0x14}}, 0x0) getsockname$packet(r3, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000003c0)=@newlink={0x50, 0x10, 0x439, 0x70bd23, 0x25dfdbfb, {0x0, 0x0, 0x0, r4, 0xb881}, [@IFLA_LINKINFO={0x30, 0x12, 0x0, 0x1, @ipip6={{0xb}, {0x20, 0x2, 0x0, 0x1, [@IFLA_IPTUN_FLAGS={0x8, 0x8, 0x2e}, @IFLA_IPTUN_REMOTE={0x14, 0x3, @rand_addr=' \x01\x00'}]}}}]}, 0x50}, 0x1, 0x0, 0x0, 0x24008007}, 0x4040844) getsockopt$inet6_opts(r3, 0x29, 0x39, 0x0, &(0x7f00000000c0)) sendto$packet(r2, &(0x7f0000000640)="e8b77052a9", 0x28, 0x40, &(0x7f0000000200)={0x11, 0x86dd, r4, 0x1, 0x0, 0x6, @local}, 0x14) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = socket$inet6(0xa, 0x800000000000002, 0x0) setsockopt$inet6_mtu(r6, 0x29, 0x17, &(0x7f0000000040)=0x5, 0x8) sendmmsg$inet6(r6, &(0x7f0000001340)=[{{&(0x7f00000002c0)={0xa, 0x4e20, 0x8, @dev={0xfe, 0x80, '\x00', 0x29}}, 0x1c, 0x0}}], 0x1, 0xc040) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r8 = socket$nl_route(0x10, 0x3, 0x0) ioctl$TUNSETIFF(r7, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) socket$packet(0x11, 0x3, 0x300) r9 = socket$nl_route(0x10, 0x3, 0x0) r10 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r9, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r11, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000000}, 0x20040084) sendmsg$nl_route_sched(r8, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000001240)=@newqdisc={0x44, 0x28, 0x4ee4e6a52ff56541, 0x4000, 0xfffffdf8, {0x0, 0x0, 0x0, r11, {0x5}, {}, {0xa, 0x3}}, [@qdisc_kind_options=@q_red={{0x8}, {0x18, 0x2, [@TCA_RED_PARMS={0x14, 0x1, {0x0, 0xb41, 0x8, 0x10, 0x5, 0x18, 0x1}}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x40098}, 0x0) r12 = bpf$PROG_LOAD(0x5, &(0x7f0000000fc0)={0x16, 0x5, &(0x7f0000000240)=ANY=[@ANYBLOB="1802000003000000000000000000000085000000a0000000850000005000000095"], &(0x7f0000000400)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @flow_dissector, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r12, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffff7, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) bind$inet6(r5, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) 2.340837642s ago: executing program 0 (id=5733): openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, 0x0}, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) socket$nl_route(0x10, 0x3, 0x0) r0 = socket(0x10, 0x803, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nbd(&(0x7f0000000000), 0xffffffffffffffff) r4 = socket(0x80000000000000a, 0x2, 0x0) setsockopt$inet6_group_source_req(r4, 0x29, 0x2e, 0x0, 0x0) setsockopt$inet6_group_source_req(r4, 0x29, 0x2e, &(0x7f0000000380)={0x4, {{0xa, 0x4e24, 0x80000000, @ipv4={'\x00', '\xff\xff', @multicast1}}}, {{0xa, 0x4, 0x0, @local, 0x40}}}, 0x108) setsockopt$inet6_group_source_req(r4, 0x29, 0x2e, &(0x7f0000000200)={0x1, {{0xa, 0x4e20, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x4e20, 0xa4fffffb, @loopback}}}, 0x108) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000280)=@bpf_lsm={0x10, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="7910480000000000790040000000000095"], &(0x7f0000000100)='GPL\x00', 0xb, 0x0, 0x0, 0x40f00}, 0x16) sendmsg$NFT_BATCH(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(r0, 0xd000943d, &(0x7f00000cfe40)={0x7, [], 0x4f, "3622913af5e4e7"}) sendmsg$NFT_BATCH(r5, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a4c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc080003400000001408000c4000000e45400000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a310000000014000380100000800c00018006000100d103000014000000110001"], 0xb4}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETSETELEM(r6, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000680)=ANY=[@ANYBLOB="480000000d0a010800000000000000000a0000010900020073797a31000000000900010073797a31000000001c000380180000800c00010b3a0001000d00000008000340"], 0x48}, 0x1, 0x0, 0x0, 0x4000805}, 0x8000) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$NBD_CMD_CONNECT(r2, &(0x7f0000001ac0)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000700)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES8=r8, @ANYBLOB="0100ffffffff00f3c00001000000100007800c00018008000100", @ANYRES32=r7, @ANYBLOB="0800010005000000080001cc1a6c79542461a262ec678bcbfaf166038a7bae02ec00e4b32750eb1e75d32f41d487100a0283f6f5fe7c6a83de1e1f0d593aef123de2795c222552713a6542b003b03217e34c13a418e3563c95145cdb13f80b758edf67c10d69a1acdb736cd5601d062577655429022ac26d90852b9b38c473ea1cff3a35f257d39e4f513b94a8e050e828e9f99270281898e0ebe7ee5f8e309ecf599bf987ac666d6bedaca75bd3dee3996eda1888332c58321e6e7454d0588098989b60faa9054b8eccd0f10a5bc093f32e19e97ab47af63b0495f693e039f8658ceccd6e01e01bfbf9a4ebfe907830627dd29f219300d2d051424c8a0c"], 0x34}}, 0x20000000) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000540)=ANY=[@ANYBLOB="bbff2b00004678b9b20d71a6a6c8c98a8971e8d7e33afa4bb5429204e4c88a8434020000000000000000", @ANYRES16=r3, @ANYBLOB="01002dbd7000fbdbdf25020000000800010000000000"], 0x1c}, 0x1, 0x0, 0x0, 0x20000011}, 0x4000810) setsockopt$inet_udp_encap(r0, 0x11, 0x64, 0x0, 0x0) unshare(0x22020400) bpf$OBJ_PIN_PROG(0x11, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) connect$netlink(0xffffffffffffffff, &(0x7f0000000240)=@unspec, 0xc) r9 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RATE_GET(r9, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)=ANY=[@ANYRES16=r1, @ANYRES16=r3, @ANYBLOB="01002cbd700000800000340000000e0001006e657464657673696d0000000f0002006e657464657673696d30000008007300000000000800030005000000"], 0x44}, 0x1, 0x0, 0x0, 0x8090}, 0x20000000) 2.339257565s ago: executing program 2 (id=5735): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1e, 0xc, &(0x7f0000000280)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x16, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000380)='memory.events\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) pwritev(r1, &(0x7f0000000180)=[{&(0x7f0000000000)="8e", 0x1}], 0x1, 0x8001, 0x80) close(r1) socket$nl_netfilter(0x10, 0x3, 0xc) sendfile(r1, r0, 0x0, 0xf03a0005) socket$l2tp(0x2, 0x2, 0x73) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r3 = socket$packet(0x11, 0x3, 0x300) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r4) socket$netlink(0x10, 0x3, 0x0) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) setsockopt$packet_int(r3, 0x107, 0xf, &(0x7f0000000100)=0x207, 0x4) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000040)={'syzkaller0\x00', 0x0}) sendto$packet(r3, &(0x7f00000002c0)="05031600d3fc140000004788031c09102c28", 0xfd1e, 0x4, &(0x7f0000000140)={0x11, 0x0, r5, 0x1, 0x0, 0x6, @multicast}, 0x14) 2.337065643s ago: executing program 4 (id=5737): r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0x42000, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'pim6reg1\x00', 0x2}) (async) ioctl$TUNSETLINK(r0, 0x400454cd, 0x336) (async) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000140)={'pim6reg1\x00', @multicast}) r2 = socket$nl_generic(0x10, 0x3, 0x10) (async) r3 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) socket$unix(0x1, 0x5, 0x0) (async) ioctl$sock_ifreq(r2, 0x8995, 0x0) (async, rerun: 64) r4 = socket$pppl2tp(0x18, 0x1, 0x1) (async, rerun: 64) r5 = socket$inet_udp(0x2, 0x2, 0x0) connect$pppl2tp(r4, &(0x7f0000000980)=@pppol2tpin6={0x18, 0x1, {0x0, r5, 0x1, 0x0, 0x0, 0x0, {0xa, 0xfffe, 0x0, @local}}}, 0x32) (async) r6 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r6, 0x0, 0x0) (async) r7 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000000), r2) sendmsg$L2TP_CMD_TUNNEL_CREATE(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000680)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="170900000000fedbdf250100000008001800ac1414aa060002000100000008000a0001000000050007000000000008000900fffffffe08001900ffffffff"], 0x44}}, 0x4804) close(r0) 2.198555649s ago: executing program 2 (id=5738): bind$netlink(0xffffffffffffffff, &(0x7f00000000c0)={0x10, 0x0, 0x25dfdbfb, 0x2ffffffff}, 0xc) (async) bind$netlink(0xffffffffffffffff, &(0x7f00000000c0)={0x10, 0x0, 0x25dfdbfb, 0x2ffffffff}, 0xc) r0 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x482, &(0x7f0000000040)={0x84, @broadcast, 0x4e21, 0x3, 'rr\x00', 0x1, 0x10000004, 0x8}, 0x2c) socket$kcm(0x29, 0x2, 0x0) (async) r1 = socket$kcm(0x29, 0x2, 0x0) setsockopt$kcm_KCM_RECV_DISABLE(r1, 0x119, 0x1, 0x0, 0x22) socket$kcm(0xa, 0x2, 0x0) r2 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$IP_VS_SO_SET_ADDDEST(r2, 0x0, 0x487, &(0x7f0000000000)={{0x84, @private=0xa010101, 0x4e22, 0x3, 'sed\x00', 0x23, 0x81, 0x5}, {@dev={0xac, 0x14, 0x14, 0x3c}, 0x4e22, 0x2, 0x1cb, 0x12d61, 0x12d58}}, 0x44) (async) setsockopt$IP_VS_SO_SET_ADDDEST(r2, 0x0, 0x487, &(0x7f0000000000)={{0x84, @private=0xa010101, 0x4e22, 0x3, 'sed\x00', 0x23, 0x81, 0x5}, {@dev={0xac, 0x14, 0x14, 0x3c}, 0x4e22, 0x2, 0x1cb, 0x12d61, 0x12d58}}, 0x44) socket$inet(0x2, 0x2, 0x0) (async) socket$inet(0x2, 0x2, 0x0) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000d00), 0xffffffffffffffff) sendmsg$TIPC_NL_BEARER_GET(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000004c0)=ANY=[@ANYBLOB="18000000", @ANYRES16=r3, @ANYBLOB="0100ff030000fbdbdf251f00000004000180"], 0x18}, 0x1, 0x0, 0x0, 0x41001}, 0x8000) setsockopt$netlink_NETLINK_BROADCAST_ERROR(0xffffffffffffffff, 0x10e, 0x4, &(0x7f00000003c0)=0x6, 0xdc) r4 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040), 0x801, 0x0) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="0a00000005000000020000000700000000000000", @ANYRES32=0x1, @ANYBLOB="00000100"/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000000000000000000000000000000000000000000db310f014bdfe36ec48aad7ed9d4c4166e4ed2d23989f9508b65490d6c52c01ccebec8eda85edf1349d6ef187b1b22d166d8cc3dcede1c09b18922f9cd0f337f190a6f86ca704b0b6a5b3693d56e2c524ec7bd5a04bf849d522fe2b2302243fa5198764ab9f30ecc6311360b34ef2cd21d0645144184d3dc9c88efc3667532fdfd"], 0x50) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000600)=ANY=[@ANYBLOB="180000000300000000000000f7ffffff18110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b7080000000000007b8af8ff0c4667a300000000bfa200000000000007020000f8ffdfffb703000008000000b70400000000000085000000030000009500000000000000fbe88fbda7691217b2b7989414cb6639ca71e075a695160917f175be62746f525706aa6a44b8b61f10e7044970c5af21670d90b5cdd7c90b23ccd7937939aaabb1b89f88a95c6d9bed8f6d167b11883698c79b14e759cd6ea3415949042c381f72360eb1f678291ab0fc143100539cabcdc1686b69b730c6ece3f966358f139dd186eba546cc93046bd39d57970c8cbeec899471864a27083bed5fba16724e12f5cb6ab4f6d36ac33392bcd96676ab29a434"], &(0x7f0000000400)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0xd, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$ifreq_SIOCGIFINDEX_team(r2, 0x8933, &(0x7f00000001c0)) (async) ioctl$ifreq_SIOCGIFINDEX_team(r2, 0x8933, &(0x7f00000001c0)) bpf$ENABLE_STATS(0x20, 0x0, 0x0) (async) bpf$ENABLE_STATS(0x20, 0x0, 0x0) bpf$PROG_BIND_MAP(0xa, &(0x7f00000003c0)={r6, r5}, 0xc) write$rfkill(r4, &(0x7f0000000080)={0x0, 0x1, 0x3, 0x3, 0xfd}, 0x8) (async) write$rfkill(r4, &(0x7f0000000080)={0x0, 0x1, 0x3, 0x3, 0xfd}, 0x8) write$rfkill(r4, &(0x7f0000000340)={0x6, 0x2, 0x3, 0x0, 0x1}, 0x8) socket$nl_route(0x10, 0x3, 0x0) setsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f00000002c0)={{{@in6=@dev={0xfe, 0x80, '\x00', 0x80}, @in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x0, 0x0, 0xffff, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xee01}, {0x0, 0xfffffffffffffffd, 0x1, 0x8, 0x0, 0x0, 0x0, 0x3}, {0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, 0x2}, {{@in=@rand_addr=0x64010102, 0x0, 0x33}, 0x2, @in=@loopback, 0x0, 0x0, 0x0, 0xb7, 0x0, 0x7fbfffd}}, 0xe8) setsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, 0x0, 0x0) r7 = socket$alg(0x26, 0x5, 0x0) connect$inet(r2, &(0x7f0000000100)={0x2, 0x4e24, @broadcast}, 0x10) bind$alg(r7, &(0x7f0000000080)={0x26, 'skcipher\x00', 0x0, 0x0, 'cts(cbc(aes))\x00'}, 0x58) socket$inet_tcp(0x2, 0x1, 0x0) (async) r8 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r8, 0x6, 0x22, &(0x7f0000000200)=0xdf, 0x4) (async) setsockopt$inet_tcp_int(r8, 0x6, 0x22, &(0x7f0000000200)=0xdf, 0x4) ioctl$sock_SIOCETHTOOL(r8, 0x8946, &(0x7f0000000040)={'veth1\x00', &(0x7f00000002c0)=@ethtool_gstrings={0x4b, 0x3}}) setsockopt$ALG_SET_KEY(r7, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5910fae9d6dcd3292ea54c7b6ef915d564c90c200", 0x18) (async) setsockopt$ALG_SET_KEY(r7, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5910fae9d6dcd3292ea54c7b6ef915d564c90c200", 0x18) 2.190748648s ago: executing program 0 (id=5739): socket$inet6_sctp(0xa, 0x1, 0x84) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000040)='ns/cgroup\x00') mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeef, 0x8031, 0xffffffffffffffff, 0x215eb000) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_route(0x10, 0x3, 0x0) r0 = socket(0x10, 0x803, 0x0) sendmsg$NL80211_CMD_GET_COALESCE(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000400)={0x0, 0x14}}, 0x0) getsockname$packet(r0, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) r2 = socket$inet6(0xa, 0x800000000000002, 0x0) setsockopt$IP6T_SO_SET_ADD_COUNTERS(r2, 0x29, 0x41, &(0x7f0000000440)=ANY=[@ANYBLOB="6e61740000000000000000000000000000008000000000000000000000c36700020000000000000000000000000000000000000000000000981407ecaa823d0587bdea66b521a78423293eef020e8ca0f5b54f8bc742a95e6b90b276a676a27638dcfebf768038ca6c67aec60a97e605b697b3256cd55f0bebe4ed00"/135], 0x48) (fail_nth: 2) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)=ANY=[@ANYBLOB="3c000000100003040000", @ANYRES32=r1, @ANYRES32=r3], 0x3c}}, 0x0) sendmsg$NFQNL_MSG_VERDICT(r0, &(0x7f0000000800)={&(0x7f00000000c0), 0xc, &(0x7f00000007c0)={&(0x7f0000000640)=ANY=[@ANYBLOB="100100000103050000000000000000000a000005080003400000000778000b800c00170000000101000000010c001700000000000000000720000d8004000380080001007f00000108000100ac1414bb080002000000000024001080080003400000000808000140000080010800014000000006080002400000000f0600124000000000080008400000d35708001a400000000964000b801800068014000400fe880000000000000000000000000001140005800e0001007369702d03000000000000003400188008000140000000030800024000000040080001400000040008000340000000020800024000f8772e84000240000000000c00138006000240026d00000c000f8006000740000200"], 0x110}, 0x1, 0x0, 0x0, 0x8000}, 0x8800) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r5) socket(0x2, 0x80805, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000340)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r7, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x6361, 0x7, 0xffffffff, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) sendmsg$nl_route_sched(r6, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000001100)=@newqdisc={0x40, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdc01, {0x0, 0x0, 0x0, r7, {0x0, 0xd}, {0xffff, 0xb}, {0xffff, 0xffe0}}, [@qdisc_kind_options=@q_fq_codel={{0xd}, {0xc, 0x2, [@TCA_FQ_CODEL_MEMORY_LIMIT={0x8, 0x9, 0x9239}]}}]}, 0x40}, 0x1, 0x0, 0x0, 0x240040e0}, 0x4890) r8 = socket$packet(0x11, 0x3, 0x300) sendto$packet(r8, &(0x7f00000005c0)="bad330fbc9b55400040000ea0756a85d86dd", 0x12, 0x0, &(0x7f00000001c0)={0x11, 0x8100, r7, 0x1, 0x7, 0x6, @multicast}, 0x14) bpf$PROG_LOAD(0x5, &(0x7f0000001e00)={0x3, 0xc, &(0x7f0000000740)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000610000001801000020786c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000110b0008850000007200000095"], &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0xd, '\x00', 0x0, @fallback=0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 2.141397138s ago: executing program 1 (id=5740): r0 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000100)={'vxcan0\x00', 0x0}) connect$can_bcm(r0, &(0x7f00000000c0)={0x1d, r1}, 0x10) sendmsg$can_bcm(r0, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000000)=ANY=[@ANYBLOB="010000004d0800000400000000000000", @ANYRESHEX=r1, @ANYRES64=r1, @ANYRES64=0x77359400, @ANYRES64=0x0, @ANYBLOB="0000000301"], 0x80}, 0x1, 0x0, 0x0, 0x48485}, 0x48001) unshare(0x2020600) r2 = socket$inet6(0xa, 0x5, 0x0) connect$inet6(r2, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0xe, 0x4, &(0x7f0000000700)=ANY=[@ANYBLOB="1800000008090000000000000000000063112d000000000095"], &(0x7f0000000c40)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x7, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb}, 0x94) 1.954032566s ago: executing program 2 (id=5742): sendmsg$TIPC_CMD_ENABLE_BEARER(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000140)={&(0x7f0000000040)={0x34, 0x0, 0x300, 0x70bd2b, 0x25dfdbff, {{}, {}, {0x18, 0x17, {0x11, 0x7, @udp='udp:syz1\x00'}}}, ["", "", "", "", "", ""]}, 0x34}, 0x1, 0x0, 0x0, 0x10}, 0x800) r0 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000001c0)={'syz_tun\x00', 0x0}) setsockopt$packet_int(r0, 0x107, 0xf, &(0x7f0000000080)=0xf3f, 0x4) sendto$packet(r0, &(0x7f00000000c0)="3f0302e9dce0140006001e0089e9aaa911d7c2290f0086dd1327c9167c643c4a1b7880610cc96655b1b141ab059b24d0fbc50df71548a3f6c5609063382a0c1511fdf9435e3ffe46", 0xe90c, 0x0, &(0x7f0000000540)={0xc9, 0x0, r1, 0x1, 0x0, 0x6, @multicast}, 0x14) 1.94786791s ago: executing program 1 (id=5743): r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000100)={0x1b, 0x0, 0x0, 0x80000000, 0x0, 0xffffffffffffffff, 0x2, '\x00', 0x0, 0xffffffffffffffff, 0x2, 0x1, 0x4}, 0x50) r1 = bpf$OBJ_GET_PROG(0x7, &(0x7f0000000040)=@o_path={&(0x7f00000000c0)='./file0\x00', 0x0, 0x18, r0}, 0x18) ioctl$AUTOFS_IOC_EXPIRE_MULTI(r1, 0x40049366, &(0x7f0000000080)) (async, rerun: 32) r2 = socket$inet6_udp(0xa, 0x2, 0x0) (rerun: 32) getsockopt$IP6T_SO_GET_INFO(r2, 0x29, 0x40, &(0x7f0000000280)={'mangle\x00', 0x0, [0x0, 0x2, 0x8, 0x7300, 0x80000001]}, &(0x7f0000000300)=0x54) (async) r3 = socket(0x1e, 0x1, 0x0) bind$802154_dgram(r3, &(0x7f0000000040)={0x24, @long={0x3, 0x0, {0xaaaaaaaaaaaa0302}}}, 0x14) (async, rerun: 32) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000180), 0xffffffffffffffff) (rerun: 32) sendmsg$NL80211_CMD_CRIT_PROTOCOL_STOP(r3, &(0x7f0000000240)={&(0x7f0000000000), 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x1c, r4, 0x0, 0x70bd27, 0x25dfdbff, {{}, {@val={0x8}, @void}}, ["", "", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x40001}, 0xc044) 1.890464766s ago: executing program 4 (id=5744): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$inet_smc(0x2b, 0x1, 0x0) ioctl$XFS_IOC_ATTRLIST_BY_HANDLE(r0, 0x4058587a, &(0x7f0000000300)={{r1, &(0x7f0000000040)='-,#\x00', 0x204202, &(0x7f0000000080)={@_ha_fsid={[0xe1d0, 0x6]}, {0x6, 0xde, 0x5, 0xffffffff}}, 0x0, &(0x7f00000000c0), &(0x7f0000000100)}, {[0x401, 0x10000, 0xd, 0x3]}, 0x5, 0x84, &(0x7f00000001c0)=""/132}) ioctl$sock_inet6_tcp_SIOCOUTQ(r2, 0x5411, &(0x7f0000000380)) r3 = bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) openat$cgroup_procs(r4, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) unshare(0x22020600) r5 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000004c0)=ANY=[@ANYRES32=0x0, @ANYBLOB="b70000"], 0x48) r7 = bpf$MAP_CREATE(0x0, &(0x7f0000000500)=ANY=[@ANYRESOCT=r6, @ANYRES32, @ANYBLOB="0000000000000000000000000000000000000000919315431522456f7392969d805837ac03a8bcfbf170a96590e42e13ceb9f475887444d2dd6f269476fa", @ANYRESDEC=r5, @ANYRESOCT=r3, @ANYRES8], 0x50) r8 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$inet_tcp_buf(r8, 0x6, 0x1c, 0x0, &(0x7f0000000000)=0xfffffffffffffe3f) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300), &(0x7f0000000100), 0x3f, r7}, 0x38) socket$xdp(0x2c, 0x3, 0x0) r9 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r9, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=@updpolicy={0xfc, 0x19, 0x1, 0x70bd2d, 0x25dfdbfe, {{@in6=@loopback, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0xa, 0x20, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0xc, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x8000}, {0x4, 0x7ffffffffffffffd, 0x407ffffffffffe, 0x800000000000002}, 0x3, 0x1, 0x1, 0x0, 0x2, 0x1}, [@tmpl={0x44, 0x5, [{{@in=@empty, 0x0, 0x2b}, 0x0, @in6=@private2, 0x3503, 0x4, 0x3, 0x0, 0x0, 0x0, 0x113b}]}]}, 0xfc}}, 0x0) r10 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r10, &(0x7f0000000000)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="0207000902"], 0x10}}, 0x0) r11 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000001cc0)=ANY=[@ANYBLOB="b702000007000000bfa30000000000000703000000fefffe7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe00000000850000000d000000b7000000000000009500000000000000c9be17044171e1d3d7b1efd036d7af273bce36015779c4cef58fa35d17c668a4b63e069efb29797573b8538e31ec24925095a163b9d4e76be2661f2a395e41f7e31a8021e00b00104e0801d4de36e5fdc6c42a7b3ff13f2360a6e231fd223bc33091dd61258a1fda45991fbdce6793c8a4785ee8b60092659b941bbd694dff0f0000000000003a45404b04bf97c4fea679c032b363956cd8bac9626b5db1b07a0bd7cc85e961506a35a04617dc0200379e731d3a8d8feac94a4ee293001f6ce7d5b40bf2a7f9be8173a9639a79fae885d05afe042c0e7821d406c967379e7521292d24d6c8034f2fc7c855a8945e9bce678ee9a015abc9daac8876623db56346916674ceb55f60b493f2f4d736acb2f206fc538450a676d71c01175b8454eb92567e8f8a707b590d7219288e23ee0800000000000010a49fc8f4ff0300000000000000000000cb947d6017ad27714772ad790af252e648ef8c313c604324f5b306000000000000cf327a8f5dd89315b8c8650a70162bba30ad7804fa4140f1a754ffff000000ab744d306619dfb3a37d897662bee00189f43da46a908a235c84cbad335fd1d2f2ef93a6a70c8b8ece0e243eab05a34ab0a7e7e497065e5e282e284f8d5e8852a265d528075214af000000000070d42182d8f3a347d48289a824e5b7b238e27263a23c0b865f75331d888c72df1da4b290582f00024227f03204add786a87b23ceb17c25810e769fe2d6a7bd8e504843b66b1a8c7b364bd2194ba9c8f60ac0c9b18d8c1b9e1a736825c91b4dff0000c1c5dcffa295c2930000000000235d84b0193a5ea7c77cdb7de8ce1a59ab4158097b4dd13ebfaf4425c6855530b56a3320d85c8fe85f667998b1a7e589f486c107761108e4e230419fd27b6ad9c10b25c6b6ed84badbb970dcf133279dd355e41de944564bdab99c5c712a9fbc8e9691c775bb94f746505e1e748cf1710d52468b4b1625ce21612ed5e807dfb5f19f3267e5366b2c0b2a0be49ae476263c9407ac6c596bf3cf66204984f5aebf93d1caa220ea6969cea852fe9a7d1eee13f1f48722a69ad9fb850bd093a302b9250245900ad5c8e5f20ddf77ee3d5a168964fad1aa7347d36c502d02b1d96d753ef6fc354fc126070060c65c147651fca62c0a06939f40c90ebc3042e753fe91b5770b24f25c558736dd7e1e9fb214cbb04c5c6ee4c970b320ba6fb6ef4615f4092de54c519f4622e1224153463ea80248a45a95a189958f586d606dcaa9aac656cf95a2d35225cfb0e6f47486d5cbb04a590116d4de92e203e107d68728a189b0d537d2442beab2f8ce7b2dd357200dcd139e47267012fc2a2b6bad79be429d1ddaccbe0139f16ca1b9bc1103000000ed1ece54cfdbe04670bee9b42fe3dc42033997e2e700b6edb2b49b5f2f6001ee0a9e5d1bee199ce9124a5cb479040000000000000049ead5b02d5ea1dcf6cdcf332fe94b3c1932d8d391754774a32c9b7e6ca4023bce2c7281d27a2cb62383ab3a3bb535650fbfb96c89936855eb7a485698f0d20c3eedd6123ef8f218d52ea2c346f80acb8b9a71856d2f2d1a7c6f45ee127b6a1d1ac1e243ed02e49e8aafe835919564af915965a050c37ceff855bd2dec3452c7c38f5dbf1ff1ff00020000000000006a1a029ea6540b40b2f797813af2c7d4ed235c2dc5f1dbbfcc52b2f55fd3f9f100c4891d0cb4c10ed01489bf235c45822594842da1b411346297a40bbf221bbf63ad3822575dcc01a3c34b5aa4e3750400000000000000fc0fd9c746cf0ed4b0343d00a154e6a869346256ffbd666a34414ab0f40bec45b1c24f02ac9bc20e69201968537dd4dc61323c8b6d3643183631664eeca616696fb30fe89c8bdb15037c801fca4a9c220fec5d14582a00b62548ddf2599e5ffc5330cefb8903d276eae21b0b4b20100ead8256636c7e754185e815dd21445cc965a0526da38021a3e540949494ef3041cfa5067f556a0af5c19d27ff4f61fa7762d7963c96853709e773f14c47eef784cb145ae9d6d37fc7b5d83e05ac773fcc429eae6826a9d207d4c39df8eed9cc2ae3f68df1c6495a82d02939b448bf8038521057714e6e644d633d2abe9e0b0025d16b7eff573f78364ed70a62a7b1e55311dc0193d47f9ecc8c7ad268dc6e2e75f8cc83315411bd6c6b88e1850ee757ac2f9e4d6ac510003717d5847a19e750db92d33d6bdc434d0b52b2eb4b1790459e35122f46b205120a54bf657da9fd55d43a89e333481de468f5984a69509e9eac5a5b39c004396e8cb3ab037fd62fa43f259f13ebc4b590e9ea07ea37689049c799cd444d45dabe3e3cf086768daa6816c37793d17a284d2828f5eab2d3f0bedd5334b7bb4c983fa9cd4bd86f0ad227901e83ef4871695380d25bea2929fa66382af6ddb89917ab100046151bd08fce74247955247daa1ea75139b9ce3771526503c7db3a4b3ff39301986c1fd9b5c42d39e768946c9a7ee8dd081bfb6ea5fa132ebdbe72d02ce9f2000000006f63ae8311afc4943c963d39e42c54a3f52d121bfb425fe268892f654febdaee43e95b5ae6749275e1ad8b8b279e1ae296e03a8d9386d8e199dc1f00000008000000000000000026c43493c622f041b47d329b248e8ccd92e9b17007ba2578eefcb59f50343722e6cba3be72fd037eb5fa243a395b5c83376a14414b32c2e8a33de8000000003927da2bec76f4e15c8bf3715c5bfe7b3617d0fcf9b5861554b5b76b8ae69c644a48931306a16cff8a38ea95553867e2c5fb1e99b1802e616345871b4611627874cfbe30fa5793c873ae6f75427f3eeda690147b9615b096d967c2d7f5ddf725f0544f8750a5ed04d6ca0f223506fec5d5e65b467c59459f6113cf41c174a63a17fc79d0b777a0c903c0d2e7f79b6f9ce68a3b72315407040f6a09cadc25e87b7c6b4a3079c7989b4cf04b251fb555fa9a2d74392939b4dbaa9e620e22ab975ac3a5a329157762c1f29075fbdd39451a56b97c90e4fde6782a7c78e7fbe8400054dcafcd51e9eef2d2ea10a3f2636ac2239cef5d8505060de55f472aa89cb8e0188f2ee96cb1ae8dee3c03d0a942c6289cbc4499cea402bd0550520f4aae98c436f18a667ae4efeb5e6a4b1b3f53536145a87578eac8bfc1037acd9d9629449714ed1302714c3519fdd8529b5a86ce2fabb7f285fe73730000000000000000000000000000000073b6f8e9255567374cb2cc80be58fca5b1dc50d85342e56beda632edb7f0a4abcabae102fadfbffecc6b1549315dda8e09d18a7fe5e1574e4fad426b6ca211da39a16dffdd661a20b20c390e00004b002cd83b754c3d32819c823027b3cf8f8da6e63d099712be370bb2aa06debff931ea0a2e7aa0390000000000000045b6720d74c470d49e1e97d1668bb75ad994089d723c2eeaad3f857937fa3df615121a1841ed452dd395788e1a82efda18b41c06c948ef44af8500fbe1ee0828a3b047afb80435935b0f99b381dcf101e9a1593bdaab3bc88c70bf56995a4790a339e1b62516356644ed7df6db419d0976a5169e68e8bd4712552c5ec03f2818c17c4a5bf1e5ecd9bb40074a63c66b61f4779226a99dc5ff9c442e93991570797493569e6f9ccd6d73bcbce41022d4731fc61b6bf0188c74a21471332a546ffe8e9dd738aa2ca782ff5a547a1ad7c348c59ff99d1496404eafcd0333df8f2801d39ad0c82735af24b819efc2fd67c6a53835f0af6a51d1b9123f4b9af7fa2ee2ebf4bc2973cf04380b41aa7577e35bcd28446bfcea19aa85440fe0fdce12e53da7b8842b7527a34d1bcb16fcdc84f2c46a78c01c2ff463cdd0d65267b0822e899e893514a02acd8c21583d181208175d08ff75223da84d53656eb7ab46ad442d70c67a6010029329aaf116308d57e77065464eb94ba18e680c2030b4212c135a3c3bbce5e911453b9e35e5b2a0390ebeb084988880a7b07435188680ce166b8858f00876c191fd4df2c32440ddcce4410199080009ad86d35168a442cfb9d399172c436a744649c810ce30505348d6f7bc87f0c202ab626acfaf0c732a3536fd46796b1bb6a2217834db8066789735a67dc95c679d02e0eaf743911bde21ffe0b6ccda73dee5694020544392d0538a8075706b26b2680555bd5dd1b4e2f59275c02372ff99d5f1066d018016c43541c6374be429d483f513c84a7dc1aced670625a93082a9bfaa86b2aa73ada8945b088d9ec0aa549a8ec8e50060fcace5e89ee1ffc1dc0f8a87"], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x3e}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r11, 0x18000000000002a0, 0x2d1, 0xfffffffffffffd85, &(0x7f00000000c0)="b9ff0303000d698cb89e40f086dd6000000e00ff8700630677", 0x0, 0x100, 0x2000000, 0x0, 0x0, &(0x7f0000000440)}, 0x28) setsockopt$IP_VS_SO_SET_STARTDAEMON(r1, 0x0, 0x48b, &(0x7f0000000000)={0x2, '\x00', 0x4}, 0x18) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)=ANY=[@ANYRESHEX=r0], 0x34}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) 1.677758978s ago: executing program 2 (id=5746): socket$kcm(0x23, 0x2, 0x0) r0 = socket$packet(0x11, 0x2, 0x300) r1 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0) close(r1) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x1, 0x8, &(0x7f0000002fc0)=ANY=[@ANYBLOB="7a0af8ff75257078bfa100000000000007010000f8ffffffb702000005000000bf130000000000008500000006000000b700000000000000950000ff00000000b2595285faa6ead0169191d54f8196217fc560e2fc91f6da4dad4fdc2eb1b5986fc4a3f611a7c8edd3aa5d6ee7ab10b1a297cf52866651ddd73f30f2382f6cda4bfdd45be583823c0f09621f3c1c65ee19ee875daf45006a4c4ea5e15b2f9618d547244a22000000000000db453620ce72d75946c2b638d91dbef661962239c77edf2d34b12cd48a1b20fb7dd8432619f2c50d77bc0ea9b0af58e6fff4942eb613eff289026d5045ef76d7d864409eb2dc9518a09f4886afc26abba34635d0e8b598a51bc742135a6e1d33fe226c944bc76be40d435aa8b5208ff0df2db761014b1b999a12df6bee431a668135b8214afa5827b56a8074bf1e6cf5d84b35a3a3a4c66824fe12dbe20fcf50a194185b9e2d8b815fedb0d982936156be3cdda66fb977aef7c9cb92428ef25d9bf665bd60024c09e9eed544126fabe4cb8d826e1ec03cc492f5cad6227c94fea467aea7fa8b58abc37056433edf43fba5566a3e022034ac81fd48f9b7314ffa730017fbd37fdb23bc26992529402a520ef67e246415a6a8ca9d4aa797a95ca3314ded0d8a24abd57e042888a9141ab4e6c6b939aaefc248791464970c43120211b9bc82a85cd2fc18f535c7986c2d52ba62f74f00000000008000000000000000000000000040000000000000"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x10}, 0x94) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000ac0)=ANY=[@ANYRES32, @ANYRES32, @ANYBLOB="150000000640"], 0x20) setsockopt$sock_attach_bpf(r0, 0x1, 0x32, &(0x7f0000002900)=r2, 0x4) mmap(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0, 0x2010, r2, 0x40c9000) socket(0x2, 0x80805, 0x0) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r3, &(0x7f0000000500)={&(0x7f0000000040)=@hci, 0x80, &(0x7f0000000100)=[{&(0x7f0000000400)=""/248, 0x200105d0}], 0x1}, 0x1f00) sendmsg$tipc(r4, &(0x7f0000000240)={0x0, 0xfffffff5, &(0x7f0000000200)=[{&(0x7f0000000140)="a2", 0xfffffdef}], 0x1}, 0x0) recvmsg(r4, &(0x7f0000000dc0)={0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f0000000980)=""/96, 0x60}, {0x0}], 0x2, &(0x7f0000000d00)=""/190, 0xbe}, 0x30120) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000000500)=[{{0x0, 0x0, 0x0}, 0x7fffffff}], 0x1, 0x102, 0x0) pipe(0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) 1.469962912s ago: executing program 1 (id=5748): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x1, 0x1, 0x40, 0x40, 0x41, 0xffffffffffffffff, 0xfffffffe}, 0x50) (async) syz_emit_ethernet(0x66, &(0x7f0000000780)={@broadcast, @random="6487a2bed3d6", @void, {@ipv4={0x800, @gre={{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x6c, 0x0, @private}}}}}, 0x0) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000840)="ac17a905bf7bb1b165160f8aab38a1e709c998c81bc9cfa511de16f027bc10ad67be7863f941928938b91a5fc0970b5bd2c86f8f2de3d03d82cd279ca4fe0b00000000920a0e68992804a7f2", &(0x7f00000003c0), 0x1003, r1}, 0x38) (async) bpf$MAP_LOOKUP_ELEM(0x15, &(0x7f0000000b80)={r1, &(0x7f00000005c0), &(0x7f0000000b40)=""/31}, 0x20) (async) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'bridge_slave_0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="340000001300050000000000feffffff07000000", @ANYRES32=r2, @ANYBLOB="003000000000000014001a80100004800c0009"], 0x34}, 0x1, 0x0, 0x0, 0x800c000}, 0x0) getpeername$packet(0xffffffffffffffff, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000080)=0x14) (async) r4 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000400)={&(0x7f0000000200)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xf2, 0xf2, 0x7, [@enum64={0x8, 0x2, 0x0, 0x13, 0x0, 0x3, [{0x2, 0x9, 0xe}, {0x4, 0xfff, 0xfc}]}, @datasec={0x6, 0x4, 0x0, 0xf, 0x1, [{0x2, 0x2, 0x1}, {0x1, 0x9, 0xfffffffb}, {0x2, 0x6, 0xf}, {0x4, 0x401, 0x7fff}], 'B'}, @volatile={0xc, 0x0, 0x0, 0x9, 0x2}, @enum64={0x6, 0x6, 0x0, 0x13, 0x1, 0x1, [{0x4, 0x84, 0x7}, {0x6, 0xf, 0x8}, {0xe, 0x10001, 0x5}, {0x10, 0x800}, {0x4, 0xd4f, 0x1}, {0xa, 0xfffffe00, 0x1}]}, @const={0x1, 0x0, 0x0, 0xa, 0x3}, @datasec={0x6, 0x2, 0x0, 0xf, 0x1, [{0x3, 0x4087, 0x2}, {0x1, 0xc, 0x6}], '7'}]}, {0x0, [0x30, 0x5f, 0x30, 0x2e, 0x61]}}, &(0x7f0000000380)=""/113, 0x113, 0x71, 0x1, 0x8, 0x10000}, 0x28) bpf$MAP_CREATE(0x0, &(0x7f0000000440)=@base={0x16, 0x5, 0x8, 0x5, 0x402, r1, 0x6, '\x00', r3, r4, 0x5, 0x5, 0x3}, 0x50) 1.392930299s ago: executing program 1 (id=5749): r0 = socket$inet_mptcp(0x2, 0x1, 0x106) socket$nl_generic(0x10, 0x3, 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x6, 0x4, &(0x7f00000005c0)=ANY=[@ANYBLOB="18000085000000bc000000950000000000000000000000000000000000000000c4b38c790afeb46f3ac4ff3f712ade337b04dcf5fdf1286083f4697e187564e862e32f32f9e68c8751b59b3e2b0e9325a8f22785ff1f353cd819b99b289ed8deaa7a8517776052ec400015023b62eb02e462bbe1d4baf6576b44654d9b737f5e2366c413a79cc2de2c685c36ae80fcdeb692c406c5d8af2e26c03548ef09c68ada119562c9efc1baa30d92e8ef59b18470cf345bdfd19a4bd3115c16084e8c4cad754273041cfeebf143bbdb4a9b0ab40000000000"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r1, 0x0, 0x2000c008) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) bind$inet(r0, 0x0, 0x0) socket$kcm(0x2, 0xa, 0x2) r2 = socket$nl_route(0x10, 0x3, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) sendmmsg$inet(r2, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) r3 = socket$kcm(0x2, 0x200000000000001, 0x0) sendmsg$inet(r3, &(0x7f0000000580)={&(0x7f0000000340)={0x2, 0x4001, @dev}, 0x10, 0x0}, 0x3000c005) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='memory.stat\x00', 0x26e1, 0x0) setsockopt$sock_attach_bpf(r3, 0x1, 0x3e, &(0x7f0000000100)=r4, 0x4) sendmsg$inet(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000480)="b9693e14ae39b9d4956589cd4383940ab3b40d07cb4c156f3ca6fc88de9cb8a4ecac59ed49fd2b216619907a0b6431db4058ea0fc81a8a2c0d90fe4a4d001cb9ee95d2753b07a7825250f7428fd1147c0143bfdaa681777e472c350000a1e49900194dc22df4c565e5e7dbf454da7e3171f9736ec5b31348bd11c559d531fc5ad17bb24275fe9a24f69f4c0d44458071aff8d3c4783a7f1ccd3442264f6416fda9da7fe6f999f956700335e3e6a034413af8c4ba7c00"/194, 0xc2}, {&(0x7f0000000380)="248d7ac09ae9afb8954f66838ae5bb401e1c656014c4c8af25db88b25065cb5a4c7073b230eb916c6ff171fd78611ff70f30b9e77db814a1d43c7fa7a70c0df21e728ed51b836e0ce6f3faf0e4817093867621b5e0c03cf4638bc53de55de11380d10ae2775154c1069ae25d99ff710f4bbf7b5e76282c2df5a2d1f289179a74a84d8aceef5d869e05cc5117f25cd1e4d2461a95237c2fa3ba38e181e3f23a3cde974dfa75aecc3b2ce33369ad52580a6cd143f10ac7e783955969b8bd05a524f919a2fd9d3cbd055b5d2f7f00ca58f6b770492f471dc3b6b3b101d10f157ec9f68dac9b8d18cf8b", 0xe8}, {&(0x7f0000000240)="a3df552cfd633a6742d5c27a9fc4f4", 0xf}], 0x3}, 0x4009800) socket$alg(0x26, 0x5, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000a40)={0x4, 0x4, &(0x7f0000000100)=ANY=[@ANYBLOB="1800000009000000000000000800000096110000000000"], &(0x7f0000000c40)='GPL\x00', 0x1, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd}, 0x94) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r6 = socket(0x400000000010, 0x3, 0x0) r7 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffffd, {0x0, 0x0, 0x0, r8, {0x0, 0x1}, {0xffff, 0xffff}, {0xffe0, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000780)=@newtfilter={0x60, 0x2c, 0xd3f, 0x30bd29, 0x25dfdbfd, {0x0, 0x0, 0x0, r8, {0xb, 0x7}, {}, {0x7, 0x300}}, [@filter_kind_options=@f_basic={{0xa}, {0x30, 0x2, [@TCA_BASIC_EMATCHES={0x2c, 0x2, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x1}}, @TCA_EMATCH_TREE_LIST={0x20, 0x2, 0x0, 0x1, [@TCF_EM_META={0x1c, 0x1, 0x0, 0x0, {{0x7, 0x4, 0x4}, [@TCA_EM_META_LVALUE={0x4, 0x2, [@TCF_META_TYPE_VAR]}, @TCA_EM_META_HDR={0xc, 0x1, {{0x5, 0x6, 0x2}, {0x5, 0x40}}}]}}]}]}]}}]}, 0x60}, 0x1, 0x0, 0x0, 0x10}, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'vxcan0\x00', 0x0}) connect$can_j1939(0xffffffffffffffff, &(0x7f0000000040)={0x1d, r9, 0x2, {0x4, 0xf0, 0x3}}, 0x18) 1.392271863s ago: executing program 3 (id=5750): r0 = accept$phonet_pipe(0xffffffffffffffff, &(0x7f0000000080), &(0x7f0000000140)=0x10) r1 = accept4$phonet_pipe(r0, &(0x7f0000000100), &(0x7f0000000040)=0x2, 0x80800) getsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f00000000c0), 0x10) r2 = socket$l2tp6(0xa, 0x2, 0x73) bind$l2tp6(r2, &(0x7f0000000000)={0xa, 0x0, 0x6, @empty, 0xb, 0x2}, 0x20) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x13, r3, 0x0) r4 = socket$vsock_stream(0x28, 0x1, 0x0) r5 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_INITMSG(r5, 0x84, 0x2, &(0x7f0000000400)={0xfffc, 0x0, 0x3, 0xffff}, 0x8) sendto$inet6(r5, &(0x7f0000000080)='w', 0x1, 0x94, &(0x7f0000000000)={0xa, 0x4, 0x3, @private1, 0x8}, 0x1c) setsockopt$inet6_int(r5, 0x29, 0x33, 0x0, 0x0) r6 = socket$l2tp6(0xa, 0x2, 0x73) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$batadv(&(0x7f0000000400), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r8, 0x8933, &(0x7f0000000440)={'batadv0\x00', 0x0}) sendmsg$BATADV_CMD_SET_MESH(r8, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000300)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="010028bd7040010000000f00000008000300", @ANYRES32=r10, @ANYBLOB="08003200050000000500330024"], 0x2c}}, 0x18) r11 = socket(0x400000000010, 0x3, 0x0) r12 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r12, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r11, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r13, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r11, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000680)=@getchain={0x64, 0x66, 0x100, 0x70bd2d, 0x25dfdbfe, {0x0, 0x0, 0x0, r10, {0xa, 0xb}, {0x1, 0xfff1}, {0xa, 0xb}}, [{0x8, 0xb, 0x2}, {0x8, 0xb, 0x7}, {0x8, 0xb, 0x1}, {0x8, 0xb, 0x73613c75}, {0x8, 0xb, 0x2}, {0x8, 0xb, 0xffffff}, {0x8, 0xb, 0x9}, {0x8, 0xb, 0x8}]}, 0x64}, 0x1, 0x0, 0x0, 0x10}, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r4, 0x8933, &(0x7f0000000340)={'batadv0\x00', 0x0}) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r3, &(0x7f00000005c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000400)={&(0x7f0000000380)={0x5c, r9, 0x800, 0x70bd29, 0x25dfdbff, {}, [@BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x9db3}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x5}, @BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r13}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0xd1}, @BATADV_ATTR_MULTICAST_FANOUT={0x8}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x3}, @BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r14}, @BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}]}, 0x5c}, 0x1, 0x0, 0x0, 0x20000041}, 0x4000) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, 0x0, 0x0) sendmsg$nl_xfrm(r7, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=@updpolicy={0xfc, 0x19, 0x1, 0x70bd2d, 0x3, {{@in=@rand_addr=0x64010102, @in6=@private0, 0xfffd, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0xc, 0x0, 0x200000, 0x0, 0xefffffffffffffff, 0xcb}, {0x0, 0xa01, 0x407ffffffffffe, 0x2}, 0xfae, 0x0, 0x1, 0x0, 0x4, 0x3}, [@tmpl={0x44, 0x5, [{{@in6=@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x4d6, 0x3c}, 0xa, @in=@empty, 0x3507, 0x1, 0x1, 0x0, 0x5}]}]}, 0xfc}}, 0x0) sendmsg$inet6(r6, &(0x7f0000000440)={&(0x7f0000000300)={0xa, 0x4e24, 0xffffffff, @mcast1, 0xfffd}, 0x1c, 0x0}, 0x48814) ioctl$FS_IOC_GETFSLABEL(r1, 0x81009431, &(0x7f0000000200)) getsockopt(r4, 0x28, 0x1, 0x0, 0x0) 1.195005477s ago: executing program 3 (id=5751): bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f00000010c0)=ANY=[@ANYBLOB="9feb01001800000000000000340000003400000006000000040000000000000e0400000000000000000000000000000d000000000000000000000013020000000000003a0000000a03000000000000005f00"], 0x0, 0x52}, 0x28) 1.094968523s ago: executing program 3 (id=5752): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000002240)=@updsa={0x184, 0x1a, 0x1, 0x70bd2d, 0x25dfdbfd, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in6=@mcast1, 0x4e24, 0x7, 0x4e22, 0xe, 0x0, 0x0, 0x10, 0x87}, {@in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x4d2, 0x33}, @in6=@loopback, {0x0, 0x2, 0x7, 0x164, 0x0, 0x9, 0xc2a, 0x4}, {0x0, 0x4, 0x4, 0x9}, {0x9, 0x5, 0xffffffff}, 0x70bd29, 0x34ff, 0xa, 0x1, 0x7f, 0x43}, [@algo_auth_trunc={0x4c, 0x14, {{'blake2b-256-generic\x00'}, 0x0, 0x180}}, @algo_comp={0x48, 0x3, {{'lzs\x00'}}}]}, 0x184}, 0x1, 0x0, 0x0, 0x40004}, 0x40000) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0xb, 0xc, 0x4, 0xc4f, 0x1, 0x1}, 0x48) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000100), &(0x7f0000000100), 0x6c7, r2}, 0x38) r3 = bpf$TOKEN_CREATE(0x24, &(0x7f0000000000)={0x0, r1}, 0x8) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000080)=ANY=[], 0x0, 0xfffffd00, 0x0, 0x1, 0x4b, 0x10000, @value=r3}, 0x28) 846.237182ms ago: executing program 4 (id=5753): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000000), r0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f00000000c0)={'vcan0\x00', 0x0}) bind$can_j1939(r3, &(0x7f0000000340)={0x1d, r4, 0x0, {0x2, 0x0, 0x6}, 0xfe}, 0x18) setsockopt$sock_int(r3, 0x1, 0x6, &(0x7f0000000040)=0x1, 0x4) sendmsg$inet(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000003c0)=[{&(0x7f0000000280)="81b641f1f3843704b6", 0x9}], 0x1}, 0x4048081) setsockopt$SO_J1939_FILTER(r3, 0x6b, 0x1, &(0x7f0000000180)=[{0x1, 0x0, {0x1, 0x1, 0x3}, {0x2, 0x1, 0x7}, 0xff, 0xfd}, {0x2, 0x2, {0x0, 0x0, 0x1}, {0x2, 0xff}, 0xfd, 0x2}, {0x1, 0x1, {0x0, 0x1}, {0x3, 0x1, 0x3}, 0x2, 0xfd}], 0x60) sendmsg$nl_route_sched(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000080)=@newtfilter={0x24, 0x11, 0x1, 0x70bd39, 0x25dfdbfc, {0x0, 0x0, 0x74, r4, {0xb, 0xfff2}, {0xd, 0x9}, {0x2, 0xd}}}, 0x24}, 0x1, 0xf0ffffffffffff, 0x0, 0x4012}, 0x20000050) sendmsg$NLBL_UNLABEL_C_STATICREMOVEDEF(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000540)=ANY=[@ANYBLOB='<\x00m\x00', @ANYRES16=r1, @ANYBLOB="0100feffffff0000000004740906140002000000000000000000000000000000000114000600626f6e643000"/54], 0x3c}, 0x1, 0xffffffff00000003, 0x0, 0x60040}, 0x404c080) 800.709151ms ago: executing program 1 (id=5754): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0xc0041, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$bt_BT_VOICE(r1, 0x112, 0x13, 0x0, 0x0) ioctl$TUNSETVNETHDRSZ(r0, 0x400454d8, &(0x7f0000000140)=0x90) r2 = socket(0x2, 0x80805, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000000c0)=ANY=[@ANYBLOB="380000004900010029bd7000fddbdf250a008000", @ANYRES32=0x0, @ANYBLOB="f9ffffff0800020000000000140001"], 0x38}, 0x1, 0x0, 0x0, 0x4008840}, 0x0) setsockopt$IP_VS_SO_SET_FLUSH(0xffffffffffffffff, 0x0, 0x485, 0x0, 0x0) r4 = socket(0x2, 0x80805, 0x0) r5 = socket$inet_sctp(0x2, 0x5, 0x84) r6 = socket(0x10, 0x3, 0x0) sendmsg$nl_generic(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="1c0000005a00010000000000fbdbdf250a00000008000100", @ANYRES32, @ANYBLOB="19d27a06da8c48e10bd16494e43cf0f4da855d4532"], 0x1c}}, 0x4) setsockopt$IP_VS_SO_SET_ADD(r5, 0x0, 0x482, &(0x7f0000000040)={0x84, @rand_addr=0x64010101, 0x0, 0x3, 'lblcr\x00', 0x1, 0x80005, 0x41}, 0x2c) r7 = socket$kcm(0x10, 0x2, 0x4) sendmsg$inet(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000001880)="5c00000012006bab9e3de3d86e6c1dffff137e0300000000000000b68675f8001d000a00a0e69ee517d34460bc24eab556a7e6241e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f408000300060100000800030011000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) setsockopt$IP_VS_SO_SET_ADDDEST(r4, 0x0, 0x487, &(0x7f0000000000)={{0x84, @multicast2, 0x4e21, 0x3, 'lc\x00', 0x5, 0x8, 0x77}, {@remote, 0x4e20, 0x2, 0xcd}}, 0x44) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={0xffffffffffffffff, 0x0, 0x3, 0x0, &(0x7f0000000040)="f7edad", 0x0, 0x1008, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x50) r8 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$XFS_IOC_START_COMMIT(r5, 0x80585882, &(0x7f0000000180)) r9 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000140), r2) sendmsg$ETHTOOL_MSG_DEBUG_SET(r8, &(0x7f0000001540)={0x0, 0x0, &(0x7f0000001500)={&(0x7f0000000000)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="0100000000000000000008000000180001801400020073797a5f74756e00000000000000000018000280080002001100000004000100080004"], 0x44}, 0x1, 0x0, 0x0, 0x10}, 0x8090) write$tun(r0, &(0x7f00000003c0)=ANY=[@ANYBLOB="48ce00dfeb0325ce8856321dcbe4b82c30e3fe24d32f8a139ac1efe304f893ef0000010093c8c98b531893320a62c8bbd1b251c03d1b3dc3fd10a85df20ccb351a7079ac2140b64c8cf336629227b5862fee98d21007fb445a0e7ef1227daec60a16cc29a2d324632e7b6aa3da43df0a990942a4a2d67f4ab4f48352669513cc17fa373e0b8e42cab07b9fa98904d7d10838a1e7a68d70bf504c73a0b849f06df79983d613aa315929ab8682f7bc53c55588058e3fda6ce6cf294d02202614c8dd9fc8a56f833f0a8a82bd52d424533c7a64dbdbd8ea930cc0a3b4fa58c9087f7b5f4d7af0a846c7152a6758"], 0xfdef) r10 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCETHTOOL(r10, 0x89f1, &(0x7f00000000c0)={'sit0\x00', &(0x7f0000000140)=@ethtool_cmd={0x0, 0xb, 0x1, 0x1000, 0x1, 0x6, 0x2, 0xfe, 0x10, 0x5, 0x4ab, 0x200, 0x4, 0x6, 0x1, 0x20000045, [0x8, 0x10000002]}}) getsockname$packet(0xffffffffffffffff, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x7) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="480000001000050700000086d7c0d6c878f064eb", @ANYRES32=r11, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000900)=@newqdisc={0x30, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r11, {0x0, 0x5}, {0xfff1, 0xffff}, {0x6}}, [@qdisc_kind_options=@q_clsact={0xb}]}, 0x30}}, 0x4000800) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000140)=@delchain={0x44, 0x64, 0xf31, 0xfffffffb, 0x25dfdbfb, {0x0, 0x0, 0x0, r11, {0x1, 0x9}, {0xfff3, 0x7}, {0x0, 0x1b}}, [@filter_kind_options=@f_flow={{0x9}, {0x14, 0x2, [@TCA_FLOW_XOR={0x8, 0x7, 0x17}, @TCA_FLOW_ADDEND={0x8, 0x5, 0xfffffff9}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x10}, 0x0) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r4, 0x89f0, &(0x7f0000000340)={'ip6gre0\x00', &(0x7f00000002c0)={'syztnl1\x00', r11, 0x2f, 0x7, 0x4, 0xff, 0x25, @empty, @private1, 0x80, 0x7800, 0x75, 0x81}}) 723.751632ms ago: executing program 0 (id=5755): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x6, 0x3, &(0x7f0000000bc0)=@framed, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000001c0)={r0, 0x0, 0x10c6, 0x0, &(0x7f0000002d40)="b3070d5b19aa16a7489474168245f80bbfa179c79d3bffb79761ab0d8e009e9b42b881f247de05b072442debf7bc0ed4b393a763a2bf3d12b851fd541f7a7169bf1fbd1640409fb8f29f118ac55c111bb188b49c7bdb0b55d9b03ef63529493d44c4617aa69a7fe28b6438a324f15e3eb21a0f5a233ee9e9071b7d746b5ee5ec93c8f26de857054995b60874a9d27726d9c069ab61a1623c8951aeaabe0e5d7538f7dbd8bd0628798f4622ee0f72d66106093500348e147e9dcee5dae63af07a6fb007e4cf9d6d6359a252aa81ec8a9caefdcb28f79094b5cab4e154a22c44bf971c039f2d566c4aec66cebca90bfe16ada4b03ffc7e90b023eec64cce3c0351597828adc485980b2aaddd930e4e424e2d0314f7fe17c3092ec5f5e54b39844e714661ac9edf447a2e3dc89f110e54528a4e22d8a86585b4601028b2bbbb4f70b7ac3b6c7129d4d0c8ce0b02c3c1f5e4128a6d315002443ac28bdb0c9d7abe3e4286ec1055688ec813b9979121e900aea3693b9c8b427bb69576362dfb258f8df59e0dbefd7034c1e887a06731e1cc25113331eab4b0d022a63107f774b4a631fa71e16e290881c25fe6af9775fd65359e2af043ec9caad726b0ce923e3c6ef9d081f967e8ef34ef0329b1c84b7bf024bda4cfda93debe4ba05de3e1728c8e22cb844c74f8d769929e6295a16bea0c50727fa33b3c10d2e53e66b20761d9fc6ef5f24b311ff8a4239f81fba4a808a08785c8cb22ac1c4a06f7b3ce232806dfb41c5aa694cf55b9872aa2c53175a76a3427dbb5c00c15ed62686a048edba6bff31ef1a84d711eddc76a4db44c880f26a79da84b9f9cfaaf909267b67a9c853ea9eb1fe586db67a98dcf37a15d5295857ee0bb4e8a4b551f2629bfc72592c0854266245b837a91f3eefbc2612ee909fa43209d02af7d3b83ec13e5dbbfe1a34a8b45ce49722a5369c3c1b8bccd5386cf57baae0d5c4a355d5a729ddce5c0be3aaafaffa497dd6b7f363b5e53f3849c7a2013e0db1ca5d2d93b0a809d1c27306883edaf11b73199275301a9d28cb3e9b267e3342fad165a13f3e44d0d53afc95f44474d5761416489612b6054c17a383a03782bf380bf347742f2845be2df988310378dad9bbf1980a4a84a5e4f10b3a28db2e7829e25640b833b0cf6675eba6601502a7ae3177860dac93726ad9adabc6d98ce30a4cb01ce01b6309982898b617f20c55510253405d93e70fbc4c9ded36bacff16e49d9f70d852c41cec96d6e4f6c44167ed6990d04e63f15fd934e6120f9189fd04e8ff4554fe23751dea387ab1ef5b0973d9510c4cbb1fe89f80d7875c16b2ff9a746f8e2b4e9dc5594712c511dea6bf63c4d9fd7114092ffdcfc16dde14359b2fda592214ad728b4e19132970be209ed98dda93c1c3abe8cffef35679b61e9ac56802bbce8509a047415a1badd9c4a359b6971d73d994e5825115fffd6f389144fdec3bb012f9f392fee8310a847192dc6ff4247a6ba44ca75ed0bc40b50767407a7d6420018b2bd1dc9ed66e11fe5c7b768ff7aae6d1ae62516a0ad980f366b6f3ea5d9e407b3e88869749b15fe400509d70256d82b2d5428b2912e648ebe7022d6f3bfc8d0c9423cba893efc65394e63a56269b7a17f69294000b0bd27902730356f238b868803b7ff4da31013ad66e22c5c7afa1b370fd2d10e0175a3bfba66d88e29fb371998424be80737bfb38db011efc5d63f0fa17efcd90a5cd2d310ab8e4ff2631dc2fc2be5404d4026fb916c1cd481dd70ea1755813574a0ec1d01b1411c7a7a69f6ac972487f9b470090c419d1c57d8641d6f4cd10b1d55ce621ed8e14f28f11b579a6408bbff9fc13cf6fb07c22770e65ed772e790844ea608e38ae48302efb09c173d8c653aaf0c6be98d9a2d166c9d318dfbb8f06b9a241ac72d68a82dbf7f3255e2cb0af5227d854a71b7d4c89fe943db9c0c19ac1dd5264bf8515b217f1de94b5da0f3a4a73f587a71bad13e447eb5ca4d76d3645d749f2ba4b46da62a7717e544cfb025b364c5d19ec6330bc6fdf161a153c61720031dfa170f0c77de03b36fa898e8f00dcb04c21db7362200fae366363f82a2d7292e0d67b72f64e227fdd91edd3c455e7341a9a9b8832631891b563a8d064955d0074a216062147414c2c8badd2c547a51734a96c215d82c68f3eeba0f9a4954e479a0534a8fd131a4b9b1d069322907c1b49e5c68b86079841b34867ae69d42f9843a9c9d290d0ea9ab4068a58e9c76588391b12420af3d9e3d8bf672f3f0ac88a8c269a9570576f6a1a5a39d63cdf7e459a620af3fe5b6fdc7576732bae1f8ab81d5294562d5e82f1273ba1f2cc1f336f2ed3b4a9901dbb3e86f3859750ef51db3601247fcd157072bc3843aedb474433c4694942f1c13356d4cfbf56d5834f9c0250044a017137ae689db25feec05600827c11955e492fb67dc2239b75d7ecc3b279901670ef2ca4d2010cf7e8f08107781b2da20d716619117191f8df96cfe9a81ef18ec0ebcc99cc3558830265d0346f9767ddb6c2fbb2495a9b8ee91f82a1bea2324ec011f45f1462aa216c209186229c233006600414628beb9738efbdad2601cac6b2b7e4c803719d6b826c44e9ae057711f067de8b0f0d1ae2a2f78936a44e2dd9e9b19244ad4b07e6cb870b594fa6f86012f699455ee86aebab98c69f332876fd820f11e982b6023325ab335a28cdceb7ce3bc4706856b4aa37b67fc1a7dc1ce4d88b277db25ebad94140b6107310a4f6e597e8895277c749687e89f0a69bf3cb1de8b459b400806fa8fc5ba4441dce50d3ff057467285e4c21cb12bac00791c3ad4f27c46c58d15de6e9cd746acd26a4fbb7da8849aa6f423dbf3974c1c4610804b5e3e46d5d6d945415e22c039481224a30cbe2b3e271b9f50297afd5df882e5b96fe31acd3e92b8fc5d0cec29915946fd0c02bc2775ad54edfb2715c9e0e197e28e0e1a6505fafec1f24d848c18afc2acb48992cab420200e06db88bc50b985932b40b16bddfdf29480fbddf106f8a5caf40d0304e45ab7c19cea65e834ef6742c413563657b8d7c27b30f85fab4fc041b50c532ea646b0755437603f1a05f87b8d67976f3ae9e729c3fb8ddb91f26d7b26f003c1a8efae40acb42360ea5144d550203e38c4e0329e6c42353b08ef1278dc529cf272b2f8e32b578f6d874fbae55f12db0081a2a6b543a418e74b121e1698eadb8f1ef214d38c403768f4df4b96b2a97c18c584b8a81f3fedd0b0653c9380bb7b42db34217a4b2e57c07de829381de337f65415f794c02192ce775e6788b4d7bf3d06f5e027b89824853b086839c75932dcf6f43c5cfe72b8d89401c8ae441f15337483e46bb09cdf6394f4be8f66415cf842f4567d114dc50f3a2c15b54e4fe65b24bc9ffabe9ce60115f309b510f5433da6fb2cc0d9ff04282b355567841a4c04ffcb47d39d5da114fc167b4e8e35437cf55e7d84b3ef27c7a0390c76643e58691d55196fbd2e3070a9308d76af61c4b43005981ef641be82f6eb80ae69a60ec4e78f99cef86f84bc9ad1101397648dfd15b51dac18cdd46c58f433772c6598364b351e1ea15e21eaa5889ad09e6400c72cb3162034838141a86338ca2f47d0f88d6c0ca13729999d0d7233c7d91bfb8359c5b3e7248f6034a57b28299f6465cddb2622a8c07c221beaa2236a04fb9d3c52e5548d0f0f4506ff8ab3d5e24be3d9d11ac02ff44a8efef9145d16ec9af4fc0cb9d5428e70c62785c9a7bb3d818f7403d2547ff80e9bcd922fe58598590d14eddda8fd07aac6776a6ce015c7dd2cc8eafbd927f7ffc8f519b327e3759e7f41ffee8d4a2121d9b9b4ceb32fd820fff7ad156c74604cab787135cc27b715aa26671fe99a5b9b2f47694f0b8183a266a90ef7c724f95c39e3725e2e54c1bfec568dbf42150ff0cf200c6b22d52ffa932443d62a61e3890cee62516fb0dec3c4d310225ee20a3f29b3dd12f3b1d09225a9a6caf3c2e467f47b92ed3888ea6d7095d8c00a78f36c64a28c2feb102a661e7e4642b8ef4eb3fce7846060873c6a64f76081eb765cd9537d2e08c8bc44d07abc3e77b8e0dd366849d63b11667f5e64b96e89b2ef5fe21b4f5425a7ddc257ddd0202e241060e641341faf01b5ae6577e399fb7714a19add131bf9a89a5d5796140ade0561952c3ff17fc2a6a76efaaa13bd1758d79aa0c85cf6d2617c028ac1f3d5e45a4dd6f0957ebe735e1971251942ebf3927db2254bd5a496eb0a77ad70ced2f70aa837319c454a73041c76c6e01da43bb891140d845528c7c5a26f0dc4dc21d592ef72a105cb3677b9a11a63678882b16aee511b40bd177ec7d3ef272ce23839920c104aafc2f46a99a313a54655bf3ed9fa1492fafb57239ba23ef9325825728ef2d878290f83ac338284b863342353eec1bd132055ebb7d79cecd490b02c8e909cc47ec408f5b8d9571055a7976f54a7ed746e7800ad1f0540ae4046e2256b3afa18f98f28b197ed80f9cdeb2795e41558afd12ae6af37c8911a14235319bca43790c3b6b7b53f63ad85fa83f8f96f5b0460da232f7c239888f352d47b2e8d475d1229afb17143e95e06f786cebdab36d8ce9d281b48562e8b9b00991d1530639a8c5df2ddf58a2c836384b25eac8bf41252fdb8f6a22a88cbe9939fdb098d53a090ecf29e1840bb3b40ee5fc4cabf1fb4014c6aca89f9a781d21a5b14adef25cb2afc83c1f2e3a68ee9994d93f211d3eda73f921911ffec1d558a5e555d8663d3464e866d4985785d621b5fb01767978ee3a7a8356ab681537d17eca71a5dc5d25ab9f182a75b68b650b1a7b0e27b70aacbfe32912bf97ab9e9360f4e6263178c4568da1aede597ffae2ee62fa22fd42e667dac1b48acb807e7083c216a5ec3541cacb8af570fbf050b8f0b93d4f532f110f430d4b08dfbb88e00a6c260a240384ac924096a9d9a17e7580c3304e16ca73f3d6903d72921bba5e4c7a6fce1cb97cf0fc137ba4a1bdcf112e423188c55152559610ed7ae1479db0998bd3cb1ed893e82ff38c958d1e7c693a74ce26254ee515939f96089ccbdc602e225b914fce6b4a6cb193de80328b6eb5d4708405cd7f076d23858ddee1e2c5a68209b0cca0b2f3384dc9c161c62d43597f291162787d0caa3af350f37e76b26e77185aa570a3ff962debd2467abc6e4a06f58753c26edab7718f17f2f57ed7d93dfea748780f57bb1270bb59c9e5f3f9bce8d3c5d2c2f3054313e7987c6e8d0771b923122bc969f7d3fc78c2f3cb04a4c6f75592070773cf2a4573e9c9bd9ac3f28226581f76fd4fd369d99e50c0e35a81617089fb496b2c9c1186fde48682e4a319e4feb7590ce561a9bc4aa1b89910c6d9b124a7b68e9f6706f82eb35e12465fdefccc3e5d8dc11264e3b5baa746ef2822c97b65e6361b26b6c51d1d54a9b1ed5da29bf7717f11abb3d59d7c3b54cd1afd0effdbb73dcb2037f6c73ae29400862877bdae935e354c7b275615192eeb904ac8f1f2d08e83a370714e205f66400a17fe4b6b864d358cbffe04a78d5baeba230956e68569ac3fcd854b639b612095e4e7e405713616d69fca80e18f13b1185f1be523ec08794d326e7c2e218ad94e954e10fa37aa5adadc6a6d6e9e238909e7329b016543ec4e7e648efac549cf156bd4b2b7b3a78cfa9ffcfe4fd5d715d11a3a3105df5a27619200843de421d840a893e94e52d70ddb7a6b06f8c675e4dec51726e41e34cd9aeb753cc8123b5b276cc6e76671821994d802e87e6b4ecc84af312bdd4d7d310e89989a0fe976fba8a48bb71655197adceb140de613d1652e9d61d54bea56573c75ace8403cc5c05e637e225327323bd9e0ac1f8bf933625f07ccd7769235a005c0c738e84225c07651220711e991534cd58c2b1f5a5cecdbfc5feed7f5feb119a064a8bc93b6e680e742c0ba33f27059ca62c192983bcb075211db531d7c4cf85ca7a4f833c01ec1bddca9e4072dc854a7db6788bac2f03a86951621c75b0b5827d3f92f9ffd20633a7d2cd55441fe9fcd1658b4f4799caf995a4cd7aa829dd2e24f40", &(0x7f0000000040), 0x11, 0x0, 0x0, 0x1f7, 0x0, &(0x7f0000000240)="23c65d54f4c5b2babf5c69a185dbff810f38fd90ca899adb0f5f20000000000000005ccad8c230f11b3f1d4db7d6d15136901ae9b5630dde5ae4617eab63a73595bac8332292e02cbc98162455420f9435aa727b090260f7c68e06e1e54e2bcfe9e4210d9ba263e2000000f8a49f102874d2fe80fec28e0b84552470f43e45c508dae05d842d28101ce992cfb22754e81de7e2ba70efceb435946b644796b2ed7d909371b5094bfbce2c8861f0597561c7440814ee2ce467eb3193558b1c454e6c4ada2d4c4c0671485a7c6b5c13a498e261835b6f1ecd6f513d85eac1c619f77ea9c8b1c4f73a37c398569e780bb5b5d0856030e64da2575e2b5e072c4061c1631d5ee88067f249a3ec00343ff37914226422d33a143ec733c66ba2619c4fea5ee9ff07374ea98620e5cca892997b11bdd7c7e0ea553e207c38df29a5ae58d0ef611a1460bc5b03a63a728eff9b1ce98885a6497033d54486cc939bb92c5d292a37fe9ac2f5e7d3913612ca91dcf2d137f90aab571907673a4399680acec5cc8b5b87ecc14223c95a65c95dda1f227a9db02cca68a4a157c9da8e5dacdab0cd9d3df0f055b8a2c99f1eced693fa46525e21f651fee85f47c6f3fd6acb1e51e5542c1212508a72c7e79a7cb8eeae7aca7bba4b4d9d74c2b7c5cb111f0d716d57ae21b8abda1658abfd250e9be722c37e886d5fb073c39f", 0x2, 0x0, 0x7ffc}, 0x50) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000240)=ANY=[@ANYBLOB="380000001800010000000000000000000200000000000006000000000c00090008000000", @ANYRES32, @ANYBLOB="08000400", @ANYRES32, @ANYBLOB="080005"], 0x38}}, 0x0) 588.256168ms ago: executing program 4 (id=5756): ioctl$BTRFS_IOC_SUBVOL_SYNC_WAIT(0xffffffffffffffff, 0x40109441, &(0x7f0000000080)={0x1000, 0x3, 0x1}) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0x16, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="660a00000000000069114e0000000000850000001a0000009500000000000000"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x8}, 0x80) 587.629734ms ago: executing program 3 (id=5757): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000040)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) r1 = socket$nl_rdma(0x10, 0x3, 0x14) r2 = socket$inet(0x2, 0x3, 0x9) sendmsg$inet(r2, &(0x7f00000000c0)={&(0x7f0000000040)={0x2, 0x1, @multicast1}, 0x10, 0x0, 0x0, &(0x7f0000000300)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @local, @rand_addr=0x64010100}}}, @ip_retopts={{0x1c, 0x0, 0x7, {[@timestamp_prespec={0x44, 0xc, 0x5, 0x3, 0x8, [{@multicast1, 0x9}]}]}}}], 0x40}, 0x24000800) sendmsg$RDMA_NLDEV_CMD_SET(r1, &(0x7f0000001000)={0x0, 0x0, &(0x7f0000000fc0)={&(0x7f0000000000)=ANY=[@ANYBLOB="200000000214010028bd7000fedbdf2505005400fce70000080001"], 0x20}, 0x1, 0x0, 0x0, 0x4000050}, 0x80d0) ioctl$sock_inet_SIOCGIFNETMASK(0xffffffffffffffff, 0x891b, &(0x7f0000000100)={'bond_slave_0\x00', {0x2, 0x0, @local}}) r3 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x10000, 0x0) getsockopt$PNPIPE_IFINDEX(0xffffffffffffffff, 0x113, 0x2, &(0x7f00000001c0)=0x0, &(0x7f0000000200)=0x4) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(r2, 0x84, 0x7c, &(0x7f0000000b40)={0x0, 0xfff7, 0x5}, &(0x7f0000000b80)=0x8) ioctl$TUNSETIFINDEX(r4, 0x400454da, &(0x7f0000000440)=r5) r6 = bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000240)=0xffffffffffffffff, 0x4) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000880)={0x18, 0x22, &(0x7f0000000480)=@raw=[@map_fd={0x18, 0x3, 0x1, 0x0, r3}, @generic={0xff, 0x1, 0x5, 0x3}, @cb_func={0x18, 0x9, 0x4, 0x0, 0xfffffffffffffffd}, @ringbuf_output={{}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x8}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x2}}, @map_val={0x18, 0x4, 0x2, 0x0, r3, 0x0, 0x0, 0x0, 0x9}, @tail_call, @snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0xffff9891}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r0}}], &(0x7f00000005c0)='syzkaller\x00', 0x10000, 0x91, &(0x7f0000000600)=""/145, 0x41000, 0x54, '\x00', r5, 0x0, 0xffffffffffffffff, 0x8, &(0x7f00000006c0)={0x0, 0x2}, 0x8, 0x10, &(0x7f0000000700)={0x2, 0x6, 0x80, 0x6481}, 0x10, 0x0, 0x0, 0x6, &(0x7f0000000740)=[r0, r3, r3, r0, r3, r0, r3, r3], &(0x7f0000000800)=[{0x4, 0x4, 0x9, 0x4}, {0x3, 0x3, 0x1, 0x2}, {0x3, 0x1, 0x3, 0xa}, {0x4, 0x1, 0x4, 0xc}, {0x2, 0x4, 0x2, 0x9}, {0x3, 0x4, 0x80000000, 0x4}], 0x10, 0x45}, 0x94) pipe(&(0x7f0000000000)={0xffffffffffffffff}) close(r8) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x1, 0x3, &(0x7f0000000140)=ANY=[], &(0x7f00000000c0)='syzkaller\x00', 0x5, 0x72, &(0x7f00000002c0)=""/209, 0x0, 0x21, '\x00', 0x0, 0x0, r8, 0x8, 0x0, 0x0, 0x10, 0x0, 0x1c}, 0x94) r9 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) connect$netrom(r9, &(0x7f0000000380)={{0x6, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, 0xa}, [@rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @null, @bcast, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}]}, 0x48) sendmsg$NL80211_CMD_GET_MPP(r9, &(0x7f0000000d00)={&(0x7f0000000bc0)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c40)={0x74, 0x0, 0x10, 0x70bd25, 0x25dfdbff, {{}, {@void, @val={0xc, 0x99, {0x4, 0x1a}}}}, [@NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @device_b}, @NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa}, @NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}]}, 0x74}, 0x1, 0x0, 0x0, 0x811}, 0x240080d0) sendmsg$NL80211_CMD_EXTERNAL_AUTH(r8, &(0x7f0000000a80)={&(0x7f0000000780)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000a40)={&(0x7f0000000980)={0x90, 0x0, 0x8, 0x70bd29, 0x25dfdbfc, {{}, {@void, @void}}, [@NL80211_ATTR_BSSID={0xa, 0xf5, @random="a55765382def"}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_PMKID={0x14, 0x55, "69f4d0930f5893e6875ec950d17beb1c"}, @NL80211_ATTR_BSSID={0xa}, @NL80211_ATTR_SSID={0xc, 0x34, @random="25596b0400000004"}, @NL80211_ATTR_BSSID={0xa, 0xf5, @from_mac}, @NL80211_ATTR_STATUS_CODE={0x6, 0x48, 0x5d}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ibss_ssid}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ibss_ssid}, @NL80211_ATTR_BSSID={0xa, 0xf5, @random="b22cfe0479f3"}]}, 0x90}, 0x1, 0x0, 0x0, 0x41}, 0x14) r10 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) r11 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x2, &(0x7f0000000040)=@raw=[@cb_func={0x18, 0x7}], &(0x7f00000000c0)='GPL\x00', 0x3, 0x26, &(0x7f0000000100)=""/38, 0x40f00, 0x40, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000140)={0x3, 0xb, 0x2, 0x5}, 0x10, 0x0, 0x0, 0x3, &(0x7f0000000180)=[0xffffffffffffffff, 0x1, 0x1, 0x1, 0x1, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff], &(0x7f00000001c0)=[{0x5, 0x4, 0x1, 0x5}, {0x4, 0x5, 0x6, 0x1}, {0x3, 0x4, 0x7, 0x6}], 0x10, 0x3}, 0x94) bpf$BPF_PROG_QUERY(0x10, &(0x7f00000003c0)={@cgroup, 0xf, 0x1, 0x200, &(0x7f00000002c0)=[0x0, 0x0, 0x0], 0x3, 0x0, &(0x7f0000000300)=[0x0, 0x0, 0x0], &(0x7f0000000340)=[0x0], &(0x7f0000000380)=[0x0, 0x0], 0x0}, 0x40) r13 = openat$cgroup(r10, &(0x7f0000000480)='syz0\x00', 0x200002, 0x0) r14 = bpf$OBJ_GET_PROG(0x7, &(0x7f0000000500)=@generic={&(0x7f00000004c0)='./file0\x00', 0x0, 0x4}, 0x18) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000400)={@cgroup=r13, r11, 0x32, 0x14, 0x0, @void, @value=r14, @void, @void, r12}, 0x20) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={0xffffffffffffffff, 0x0, 0x3c, 0x0, &(0x7f0000000440)="c1a36abcde20d308098e080086dd", 0x0, 0x4012, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x1}, 0x3f) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000940)={@map=r0, r7, 0x28, 0x10, r8, @void, @value, @void, @void, r12}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x3, 0x1c, &(0x7f0000000d40)=ANY=[@ANYBLOB="1806000004000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000000000000b7080000000000007d9af8ff00000000b5080000010000007baaf0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7050000080000001500000076000000bf91000000000000b5020000000000002800000085000000b7000000000000009500000000000000276af2bdf9be8aa14a1b4702ef9c2dd5d63d4dd3c30a134a90ab7b0acce58cb13aa5fc1476bd6e8f1fa589e309c3dfc86f0e0504fb3d7fdb8076a086e7f22a439b0f858b83846bebfe8a84a41546ccc08f25ee5b5c7d93b7bf06f758d31a515390201d590d84710118bbf1050a660bcc2ed0fc5c6e13e51c636bee2044b792daf1ecdfce8111db5d07c4b08e33e91352f4f1a9ffd8195e3f8002919accf2fc10b07ad6635cd5e1b1470ed42d10"], &(0x7f0000000180)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x37, r6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200004}, 0x94) 586.401549ms ago: executing program 0 (id=5758): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) (async) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0x439, 0x70bd2c, 0xffffffea, {0x0, 0x0, 0xe403, 0x0, 0x40083}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @sit={{0x8}, {0x14, 0x2, 0x0, 0x1, [@IFLA_IPTUN_6RD_PREFIXLEN={0x6, 0xd, 0x9}, @IFLA_IPTUN_REMOTE={0x8, 0x3, @multicast1}]}}}]}, 0x40}, 0x1, 0x0, 0x0, 0x8000}, 0x4040) (async) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x5, 0x0, 0x0, {0x1, 0x0, 0xffff}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz0\x00'}]}, @NFT_MSG_NEWRULE={0x50, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1, 0x0, 0x8}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x28, 0x4, 0x0, 0x1, [{0x24, 0x1, 0x0, 0x1, @tproxy={{0xb}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_TPROXY_FAMILY={0x8, 0x1, 0x1, 0x0, 0x1}, @NFTA_TPROXY_REG_PORT={0x8, 0x3, 0x1, 0x0, 0xa}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0xc4}, 0x1, 0x0, 0x0, 0x8d0}, 0x4008800) 494.850488ms ago: executing program 2 (id=5759): bpf$MAP_CREATE(0x1900000000000000, &(0x7f0000000380)=ANY=[@ANYBLOB="1f000000000000000000004bc0d5af00000008"], 0x50) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, &(0x7f0000000000)={0x1, 0x3}, 0x8) 486.88005ms ago: executing program 1 (id=5760): bpf$PROG_LOAD_XDP(0x5, &(0x7f00000001c0)={0xd, 0x8, &(0x7f00000006c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018d8c84fdb6d25ced1aa1d0cb6f2b94ba6d785a5", @ANYRES32, @ANYBLOB="0000000000000000b703000000000000850000000c000000b7000000000000009500000000000000"], 0x0, 0x2}, 0x94) sendmsg$kcm(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000008c0)=[{&(0x7f0000000000)="1400000010003507d25a806f8c6394f903", 0x11}], 0x1}, 0x0) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb79100a6c52d922ba2a05dd4242"], 0xfdef) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x3, 0x0, 0x0, 0x40f00, 0x10, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffe}, 0x94) r0 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r0, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) r1 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x1a, &(0x7f0000000000)={0x3, &(0x7f0000000040)=[{0x20, 0x0, 0x0, 0xfffff010}, {0x30, 0x0, 0x0, 0x8000}, {0x6}]}, 0x10) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000080)={'syzkaller1\x00', 0x2}) r6 = socket$igmp6(0xa, 0x3, 0x2) r7 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r7, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @random="2b0436d23321"}) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r6, 0x8983, &(0x7f0000000300)={0x0, 'syzkaller1\x00', {0x2}}) write$tun(r5, &(0x7f0000000400)=ANY=[@ANYBLOB="0030f6aaaaaaaaaabb0188c200000e88a800008100000208004500001c006800000011907864010100e0000001000017dcd433f7858f4e3cab9d68cc04a7b3af4ebd4c1837045993557981ead2119ce88a1e8ddd91c35600000000000000"], 0x36) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000a00), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000480)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_WIPHY(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r8, @ANYBLOB="000425bd7000fcdbdf040200010008003f0036000000080061"], 0x24}, 0x1, 0x0, 0x0, 0x4008001}, 0x20000000) sendmsg$NL80211_CMD_SET_COALESCE(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000b00)={&(0x7f0000000040)={0x1c, r8, 0x1, 0x70bd2a, 0x0, {{0x2}, {@val={0x8, 0x3, r9}, @void}}}, 0x1c}}, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000001a80)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_GET_WOWLAN(r1, &(0x7f0000001b40)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000001b00)={&(0x7f0000001ac0)=ANY=[@ANYBLOB="2b246588", @ANYRES16=r8, @ANYBLOB="00022abd70000400000049000000080001001500000008000300", @ANYRES32=r10, @ANYBLOB="0c0099002e0000005a0000"], 0x30}, 0x1, 0x0, 0x0, 0x40001}, 0x6000) getsockopt$sock_buf(r3, 0x1, 0x1a, &(0x7f0000000100)=""/2, &(0x7f0000000140)=0x2) r11 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r11, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000780)=ANY=[@ANYBLOB="240000001800ffff00000000000000000a140000fe04fd090000000006001500060000009b17c330a9f330b823a2807aa4275a7ae2f4ef6f2233a37d9796992ca78a76267f7f94af4b6475a2de6932a1cd40fa6e021e9bcfcc47aebb8830e78c75db152f6ae2820e7e3d45b42c18e6eaa9387a423afb451edd16ced705dc1b478b69e2db525762dddf4ac364a2ef3f15c3628e18767a5a929cb8b470c142d6811b37ed7fc35cc8195b9b84488890ab97495059b6941a564b5fdb07a43b66d0ad24f36e79f1777b359d87a8cbdb45a80ae6c0ea6804adbfc8c28301606a26486e3705ab21b89c98ee829e8f354f4c3bcefc45412d9429b5ea827508b72403"], 0x24}}, 0x0) r12 = socket$inet6(0xa, 0x3, 0xff) sendmmsg$inet6(r12, &(0x7f0000000580)=[{{&(0x7f0000000040)={0xa, 0x0, 0x0, @private1}, 0x1c, 0x0}}, {{0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000180)="06d14dad91515bc88e7941335c6609d36aa2d6a821cd25a5bfdc4b5ba81d41ea69e78a7d167734e25327a369f32067b93d52896c5fca22e1551d0790fe70c16e9e7d102df54bee5ed77a29daecee01baf049291eb2e1e503f4d80c19e8098470cd7f28b09915e0082aa9b9454c3a8f49cacfa0df4e013d34deb61bf2a12815338fa0da", 0x83}, {&(0x7f0000000300)="8d2b639d693f5717bf7540f701c7478aaa4b7f4a16e45ce8b452016098a2591e1952324f3fa26e8fce5e9754bc52e36bf9e9a80db262aa0a2eb97dc7a755cf0e5b96b0fbf15131c254d04f00168043e86c6cad729a33063d95de15f368dc83baeb7f6905ba5b05e576a3317f72478133ae794a7d5f44d71a2f2899cc3b1fa7c1fa1bf3c815233b301bb4c779432912bea7f9a37b11e4a83cd177e32bfa", 0x9d}], 0x2, &(0x7f0000001bc0)=ANY=[@ANYBLOB="d00000000000000029000000040000007316000000000000010100c910fe8000000000000000000000000000420001000502fffc060f14182af466ee04130db53636f309e10102000001060000000000000738000000000c05020004000000000000000600000000000000000400000000000001000000000000000900000000000000e000000000000000f0429e30dabfb97196d6fae4c4c24355d5af472c42d6624deaac1ff0018520063c43623f4ede5e47a8ac471a77c7205ceea42dda02ec847eb815bab6c4699cf40a55c4cc004000000000000000290000003600000032040000000000000401b401000502ff000502000805027fffc20400000400c204000000090401000103000000000000772c7a3f8289dcf0b9758abb123704bed3ebdfe4b6887ea3a02d22e460f73f2ad60ddacb"], 0x110}}], 0x2, 0x0) r13 = socket$inet(0x2, 0x80000, 0x7) setsockopt$inet_mreqn(r13, 0x0, 0x27, &(0x7f0000000740)={@multicast2, @loopback}, 0xc) 470.331535ms ago: executing program 0 (id=5761): sendmmsg$inet(0xffffffffffffffff, &(0x7f0000000540)=[{{0x0, 0x0, &(0x7f0000000680)=[{&(0x7f00000000c0)='\b', 0x1}], 0x1}}], 0x1, 0x6044004) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r2 = socket(0x400000000010, 0x3, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=ANY=[@ANYBLOB="1900000004000000040000000200000000000000", @ANYRES32=0x1, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00e3ffffb0ccffffff00000000000000000000000000000000000000dca4ef2f96ca534d0092aaafce2003a7d77c93acdb3babcddf952639d9e77ea036d1651a29772e7f"], 0x50) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000240)={r4, &(0x7f00000000c0)="ad", &(0x7f0000000000)=""/3, 0x2}, 0x20) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nl802154(&(0x7f00000003c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(r5, 0x8933, &(0x7f0000000000)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_NEW_SEC_DEVKEY(r5, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000240)={0x50, r6, 0x1, 0xfffffffd, 0xfffffffd, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r7}, @NL802154_ATTR_SEC_DEVKEY={0x34, 0x2f, 0x0, 0x1, [@NL802154_DEVKEY_ATTR_EXTENDED_ADDR={0xc}, @NL802154_DEVKEY_ATTR_FRAME_COUNTER={0x8}, @NL802154_DEVKEY_ATTR_ID={0x1c, 0x3, 0x0, 0x1, [@NL802154_KEY_ID_ATTR_INDEX={0x5, 0x2, 0x2}, @NL802154_KEY_ID_ATTR_SOURCE_SHORT={0x8, 0x4, 0x2}, @NL802154_KEY_ID_ATTR_MODE={0x8, 0x1, 0x2}]}]}]}, 0x50}}, 0x0) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000240)={r4, &(0x7f0000000140), &(0x7f0000000000)=""/6, 0x2}, 0x20) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000400)={r4, &(0x7f0000000380), &(0x7f0000000500)=""/166}, 0x20) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000bc0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd29, 0xffffffff, {0x0, 0x0, 0x0, r8, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x8}}, [@qdisc_kind_options=@q_fq_codel={{0xd}, {0x4}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000380)=@newtfilter={0x84, 0x2c, 0xd27, 0x30bd29, 0x25dfdc00, {0x0, 0x0, 0x0, r8, {0xfff5, 0x8}, {}, {0x8, 0xc}}, [@filter_kind_options=@f_matchall={{0xd}, {0x50, 0x2, [@TCA_MATCHALL_ACT={0x4c, 0x2, [@m_gact={0x48, 0x1, 0x0, 0x0, {{0x9}, {0x1c, 0x2, 0x0, 0x1, [@TCA_GACT_PARMS={0x18, 0x2, {0x6, 0x80, 0xffffffffffffffff, 0xfffffffc, 0x8}}]}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x3, 0x3}}}}]}]}}]}, 0x84}, 0x1, 0x0, 0x0, 0x20000010}, 0x20000000) r9 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000003c0)={0x10, 0x4, &(0x7f0000000380)=ANY=[@ANYBLOB="1802000000c400000000000000000000850000003e00000095"], &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x8}, 0x94) r10 = bpf$MAP_CREATE(0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="1200000004000000080000000b"], 0x48) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000300)=ANY=[@ANYRES32=r10, @ANYRES32=r9, @ANYBLOB='\a'], 0x10) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000140)={r10, &(0x7f0000000240), &(0x7f00000004c0)=@tcp6=r0}, 0x20) setsockopt$netlink_NETLINK_RX_RING(r2, 0x10e, 0x6, &(0x7f0000000180)={0xe5a7, 0x5, 0x0, 0x8}, 0x10) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0xe, 0x4, &(0x7f0000000400)=ANY=[@ANYBLOB="18020000801000000000000004000000850000002f00000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x8}, 0x94) r11 = socket$inet(0x2, 0x2, 0x73) setsockopt$inet_opts(r11, 0x0, 0x4, 0x0, 0x0) r12 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="01000000120000007f00000001"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000540)={0x3, 0x5, &(0x7f0000000200)=ANY=[@ANYBLOB="180000047ab7d29319fb0e1ef408a7f352c005000000000100000000000018094900", @ANYRES32=r12, @ANYBLOB="00000000000000009500000000000000"], &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sendto$inet(r11, 0x0, 0x0, 0x8045, &(0x7f0000000080)={0x2, 0x0, @empty}, 0x10) sendmmsg$inet6(r0, &(0x7f0000002000)=[{{0x0, 0x0, &(0x7f0000000180), 0x1}}, {{0x0, 0x0, &(0x7f0000000640)=[{&(0x7f00000009c0)='.', 0xc400}], 0x7}}], 0x44, 0x0) 466.831042ms ago: executing program 4 (id=5762): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x1e, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="1800000000000000000000000000000071123c000000000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x94) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0xa8442, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) r3 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000380)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r4, {0x0, 0x7ffe}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000800)=@newtfilter={0x94, 0x2c, 0xd27, 0x170bd2b, 0x2, {0x0, 0x0, 0x0, r4, {0x0, 0x10}, {}, {0x8, 0xffe0}}, [@filter_kind_options=@f_flow={{0x9}, {0x64, 0x2, [@TCA_FLOW_MODE={0x8, 0x2, 0x1}, @TCA_FLOW_KEYS={0x8, 0x1, 0x1a29c}, @TCA_FLOW_ACT={0x50, 0x9, 0x0, 0x1, [@m_csum={0x4c, 0x1, 0x0, 0x0, {{0x9}, {0x20, 0x2, 0x0, 0x1, [@TCA_CSUM_PARMS={0x1c, 0x1, {{0x8, 0x0, 0x5, 0xb2, 0xa8}, 0x39}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x1, 0x1}}}}]}]}}]}, 0x94}, 0x1, 0x0, 0x0, 0x884}, 0x2) syz_emit_ethernet(0x36, &(0x7f0000000140)={@broadcast, @random="1704b45adbde", @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @timestamp_reply={0xe, 0x0, 0x0, 0x4, 0x2, 0x6, 0x2, 0xdd31}}}}}, 0x0) r5 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000200)={'geneve0\x00', 0x0}) sendmsg$nl_route(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="4400000010000100"/20, @ANYRES32=r6, @ANYBLOB="00000000000000001c0012800b00010067656e65766500000c00028008000200ac1414bb080004"], 0x44}, 0x1, 0x2}, 0x40000) close(r2) socket(0x10, 0x3, 0x0) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r7 = socket$kcm(0x11, 0x3, 0x0) setsockopt$sock_attach_bpf(r7, 0x107, 0xf, &(0x7f0000000600), 0x56) sendmsg$kcm(r7, &(0x7f0000000280)={&(0x7f0000000540)=@xdp={0x2c, 0x0, r4, 0x42}, 0x80, &(0x7f00000000c0)=[{&(0x7f00000002c0)="27030200dc0f14000e00fe3c002400004000ff1100000066c1532cc10200000003125ce882cbf490d90812533f00", 0x2e}], 0x1}, 0x4005) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000004c0)={r0, 0xe0, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0}}, 0x10) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x3, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b405000000a1539d371050000000000073019b00000000009500000000000000"], &(0x7f0000003ff6)='GPL\x00', 0x5, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0x85}, 0x52) 410.670501ms ago: executing program 2 (id=5763): bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000200)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x5}, 0x50) r0 = socket$inet6_sctp(0xa, 0x1, 0x84) sendmmsg$inet6(r0, &(0x7f0000000280)=[{{&(0x7f0000000340)={0xa, 0x4e23, 0xfffffff9, @dev={0xfe, 0x80, '\x00', 0x36}, 0x9}, 0x1c, &(0x7f00000004c0)=[{&(0x7f00000005c0)="05", 0x1}], 0x1}}, {{&(0x7f0000000040)={0xa, 0x4e23, 0x8, @local, 0x3}, 0x1c, &(0x7f0000000200)=[{&(0x7f0000000100)="2849de7792c3", 0x6}], 0x1}}], 0x2, 0x24000045) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f00000000c0)={0x0, 0x72c2}, 0x8) bpf$TOKEN_CREATE(0x24, &(0x7f0000000000)={0x0, r0}, 0x8) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x1c, &(0x7f0000000280)=[@in6={0xa, 0x4e21, 0x7ff, @private2, 0xeb2}]}, &(0x7f0000000180)=0x10) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00'}) getsockopt$bt_hci(r2, 0x84, 0x1, &(0x7f0000000080)=""/4057, &(0x7f0000000000)=0xfd9) bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x1e, 0xa, &(0x7f00000009c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x9}, [@func={0x85, 0x0, 0x1, 0x0, 0x7}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffff8}, @tail_call]}, &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x38, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff}, 0x94) 397.356741ms ago: executing program 3 (id=5764): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$kcm(0x2, 0x3, 0x2) sendmsg$inet(r1, &(0x7f0000003a80)={&(0x7f00000004c0)={0x2, 0x0, @multicast1}, 0x10, 0x0, 0x0, &(0x7f0000000000)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @dev={0xac, 0x14, 0x14, 0x15}, @private=0xa010100}}}], 0x20}, 0x4008804) sendmsg$kcm(r1, &(0x7f0000000480)={&(0x7f00000002c0)=@l2tp={0x2, 0x0, @remote, 0xfffffffe}, 0x80, &(0x7f0000000180)=[{&(0x7f0000000840)="3282db78e0ea55", 0x7}], 0x1}, 0x8400) bind$inet6(0xffffffffffffffff, 0x0, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000540)={0x6, 0xb, &(0x7f0000000a80)=ANY=[@ANYRES32=r0], &(0x7f0000000000)='GPL\x00', 0x2, 0x0, 0x0, 0x0, 0x6a, '\x00', 0x0, @fallback=0x36, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x94) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r4, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp_SCTP_ADD_STREAMS(0xffffffffffffffff, 0x84, 0x79, &(0x7f0000000000)={r5, 0x6, 0x2}, 0x8) getsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(0xffffffffffffffff, 0x84, 0x22, &(0x7f0000000100)={0x800d, 0x8003, 0x529, 0x9, r5}, &(0x7f0000000140)=0x10) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f00000004c0)={'syz_tun\x00', 0x0}) r7 = bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000000c0)={r2, r6, 0x25, 0x0, @void}, 0x10) r8 = socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet6(0xa, 0x802, 0x0) setsockopt$inet6_tcp_int(r8, 0x6, 0x7, 0x0, 0x0) socket$inet6(0xa, 0x80002, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x10) syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) syz_emit_ethernet(0x1289, &(0x7f00000048c0)=ANY=[], 0x0) r9 = syz_init_net_socket$ax25(0x3, 0x2, 0xc4) r10 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) bind$xdp(0xffffffffffffffff, &(0x7f0000000600)={0x2c, 0x3, 0x0, 0x2e}, 0x10) getsockopt$sock_cred(r10, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0}, &(0x7f0000000080)=0xc) ppoll(&(0x7f0000000280)=[{r9, 0x200}, {r9, 0xc110}, {r4}, {r3, 0x1000}, {r7}], 0x5, &(0x7f0000000340)={0x0, 0x3938700}, &(0x7f00000003c0)={[0x3ff]}, 0x8) sendmsg$netlink(r10, 0x0, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000840)=ANY=[@ANYRES32=0x0, @ANYRES8=0x0, @ANYBLOB="ac14141d000000000000000000000000000004d56c000000fe8000000000000000000000000000bb0300000000000000ffffffff00000000030000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000000000000000000000000000000000000000000000000be1c000000"], 0xfc}}, 0x20000011) ioctl$SIOCAX25GETUID(r9, 0x89e0, &(0x7f0000000480)={0x3, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, r11}) sendmsg$inet(r1, &(0x7f0000000500)={&(0x7f0000000140)={0x2, 0x3, @local}, 0x10, &(0x7f0000004d00)=[{&(0x7f0000000100)="db", 0x1}, {&(0x7f0000003ac0)="759e3473a13006caae149f787a74fc42ae6a80700fd5aebe4105f65e5780fbf4c3ca1489c7cd6c84d7e05bf20e5a3f36a4de20196dadf7ea99ae3171b9f60374302acbace45d700ac04fdf9808cc059e4c8d1202c91475ec72b3f2cacbc89c01318e9f1f09d9047a7c579e1f34e7655da0d6ac2284a09f351f1557a6a7c98fb83ab8edaa5fd342c10e348fb9878db4091102bb911458bbb036bcdab0dedf6fdd45efca8435571bfa83243ed9c6c8f9050f2f50278de5c9303155f17c813f1fa557b83313ab998c736f1899b893f18fb91014b51367c13e0cc1bdf820f5fb2e88489aa6e9c3d24b1d3139eef65a00625c80b8131ad90e600a2edc1dd644ff60af59c44c320c14847112ea318fb4e2835363b0138153123da414dea2c304b32f9a916c8c56fc122ebcf20e019295eecb9879ae21b890715390d0d64606ef172bf5babf64808a8807470de0fe4e634386f6210c48f2cf3c658be61f0b0d6f0b36212d5ff2c0e0762d1319f52f05975f5af37faf8d9d65c37781a29dc38f170b280ec152da3333c72bd32414bbd2f89886ebdbd9fe6d2368d6a21ff57fc1d23293d0dcd6253df9a81f7bbdab33ca269aa779c4f6dc77cef0d58b9d742daf813b7802d302a2b8a3f87dca570b943887e9022d0be00b6a1a96ace3329f43b8b0c6fc7bcb1397bd363b309e79f07ab3c8399b10798114b86f0263f0f16dbc71878b261f63bde1ca8779ac2d03cec61a89ea248be95cc0c642b1a933cff1ce3738d69b5d1b63408afc628377d471216939296865e6145f2503636e91a168598366fe180b4882b8f3235d35399162fe9325bccec18ae0783d7fea324912a93ff0e22807fc955580e923d507149f869885826b4ee58caecf01958f356f191054878693531ebd9439556ad1484f61fe8fd2ea5741cdece16c48e12bb1c582568675c8fb0db616a685e3ca937297f2fe8d878ed8d1df5deed9ee516f94922eb076fe93c39cd9076415e650d36b52e23c936296e69918d97f242659422d9ddfafb23b0217a13de5f88b6a3d5c58bb18c159cb4565d00d7d87a4ab16f1ec665b53a159933816e0004306490f8afde614304783398091354fb3e46eaf50a9de83f44b475aa8907c441d6f6b60cf24184b68aa6128c88fab71d176a84c3a6e4435cd92166467b1b0ff8dfe22f84e80a0cb905fb383c95b98c45c9c910283676316ae384392866b2885d7128552045c45344339f4d3657c6aaca8d7d3fc607a1bf242499d39b106df511904cc14c34c287d1aa2e976512bccccde4cc9c7be611925a7047fea154dfc8c5062f6d0e873bea681a5e9b84ff22fc35e99541f301f59b6fe0bfc92c4f9fe3f50afba657f82ae875eb60d5dedb61c8895027ba9c8540eefa6cbab6ebff45b6bb3b258ee851652b19b82aad488027c16e465aed313ff77b097832bfdd935ace3a3c49d53366ca9128e1ec8f33bb1dbd7ddbad53ae5169a5b42dfc9bfb1836438f16c88672d1b01e9172dd2315dd59b5d4f8889020db256b88f205b2724435bbf088eace37cd9e834b0805b50ff782b3213456d255b3f710e8801e73faae8be55a526230aaeb16a32dcc9c22eb7125584459e5436fb372b37027b72ca6ec297ceec33d3357fd84e8d14ab82c6a116ecf3b03e07308355ed91d69e08e88e5d744f85d26f26fcf8f37b243b2a3bb8d6d7dc058ee2e103328568e5728712bf4b88844448bd2a2644bfdf4f838d68e0aa86ac0f5244499bee9bbedbe53ca0b10b74b1c2ea6c4cf117b50c7f78b603af8ce13cd7fc93839f4a99a938104ba6e13f19239bc7304245aaf2763e1e1203ceb8939abc91160de8c89b59888cb18b9014b940ecc30ba8a637f9d7eea576b058ca5ce45c18c5cb94cafab19c532fe9d29abb93e8bac6e55ac8ca18115a66c0f732c1e263b4a59ecfe3343bd509149467df796e395d54f8224254a2550c3b68d1e037723a14d674b48d345f7d24236a", 0x57d}], 0x2}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=ANY=[@ANYBLOB="440000002500010324bd7006fddbdf25150000002e004e0001947babe4b3e2789dc163318cdb8464be13f74a5ed14b082a25a2adffffffff27002dc8800fc60000c465adb258bfbdfc353591458d0c685a5ed06c752f45f911248ca12ad1d201597af2a5be637499b2a3c57f889994bc46603e300b73c001e8cb3cc6f9bfb4c504ff4e00662c9ff776088e52"], 0x44}, 0x1, 0x0, 0x0, 0x4}, 0x24008002) 83.8158ms ago: executing program 3 (id=5765): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$igmp(0x2, 0x3, 0x2) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x5dd93000) r2 = epoll_create1(0x0) epoll_wait(r2, &(0x7f0000002a80)=[{}], 0x1, 0xfffeffff) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000000540)={0x9d32f4b280c65371}) sendmsg$netlink(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000100)={0x18, 0x56, 0x601, 0x2, 0x0, "", [@typed={0x7, 0x0, 0x0, 0x0, @str='\x00\x00\x00'}]}, 0x18}], 0x1}, 0x0) r3 = socket$inet(0x2, 0x2, 0x1) connect$inet(r3, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10) r4 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r4, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r4, 0x10e, 0x4, &(0x7f0000000140)=0x6, 0x4) setsockopt$sock_int(r4, 0x1, 0x8, &(0x7f0000000200), 0x4) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000680)=ANY=[@ANYBLOB="940000000001010400000007000000000a0000003c0001802c00018014000300fe8000000000000000000000000000aa14000400ff0100000000000000000000000000010c000280050001000000000070d8bbecdc67663c0002802c00060014000300fe8000000000000000000000000000aa14000400fec000000000000000000000000000aa0c00028005000100000000000800074000008ac850850a2da5001dc9257024caddb8fd820aad72409f549c758304881d9489169c60a1ae370b11a8939d7545a8d0192afa7a7c92d9a89b3f82a1298de9e0f1475198b03dcf5e5c3bd133c82b365703e36fb16537b410028154e02674ed28ac2c1c80f8400c75eacae44281e694ad92137a04bf14bd4b17af48ece7154e3c4791795249e7c0c6bced60e493172ed2461b493f4418002b9921a839e6160d978cadd0a6beacd797e60ec4dfc066128afd5bb2d9cb12aefacb968b30a2e5fc4b8f24c71fda"], 0x94}}, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_DELETE(r5, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000640)={0x14, 0x2, 0x1, 0x5, 0x0, 0x0, {0x2, 0x0, 0x8}}, 0x14}, 0x1, 0x0, 0x0, 0x20044804}, 0x40040) sendmsg$IPCTNL_MSG_CT_GET_DYING(r6, &(0x7f0000001900)={0x0, 0x0, &(0x7f0000001980)={&(0x7f0000001940)={0x14, 0x6, 0x1, 0x301, 0x0, 0x0, {0x3, 0x0, 0x5}}, 0x14}, 0x1, 0x0, 0x0, 0x24044831}, 0x4404c810) syz_emit_ethernet(0x6e, 0x0, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r7, 0x0, 0x0) sendmsg$nl_route_sched(r7, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000200)=@newqdisc={0x40, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdc01, {0x0, 0x0, 0x0, r8, {0x0, 0xd}, {0xffff, 0xb}, {0xffff, 0xffe0}}, [@qdisc_kind_options=@q_pie={{0x8}, {0x14, 0x2, [@TCA_PIE_TUPDATE={0x8, 0x3, 0x8358}, @TCA_PIE_BYTEMODE={0x8, 0x7, 0x1}]}}]}, 0x40}, 0x1, 0x0, 0x0, 0x240040e0}, 0x4890) sendmmsg$inet(r3, &(0x7f0000000540)=[{{0x0, 0x0, &(0x7f0000000380)=[{0x0}, {&(0x7f00000000c0)="08001497733f5d3e", 0x2a}], 0x2}}], 0x1, 0x2004000) 0s ago: executing program 4 (id=5766): r0 = socket(0x80000000000000a, 0x2, 0x3ff) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f00000008c0)=@raw={'raw\x00', 0x8, 0x3, 0x560, 0x170, 0xffffffff, 0xffffffff, 0x170, 0xffffffff, 0x490, 0xffffffff, 0xffffffff, 0x490, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'dvmrp1\x00'}, 0x0, 0x148, 0x170, 0x0, {}, [@common=@unspec=@helper={{0x48}}, @common=@inet=@hashlimit1={{0x58}, {'bond_slave_1\x00', {0x41, 0x7, 0x6, 0xb0e2, 0x10001, 0x84e, 0xfffffffb, 0x18, 0x8}, {0x1}}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0x2b8, 0x320, 0x0, {}, [@common=@unspec=@conntrack1={{0xb8}, {{@ipv4=@loopback, [0x0, 0x0, 0xffffff00, 0xffffff00], @ipv4=@multicast1, [0xffffff00, 0xffffff00, 0xffffffff, 0xffffff00], @ipv4=@private=0xa010100, [0xff, 0xff000000, 0xffffff00, 0xffffff00], @ipv4=@local, [0xff000000, 0xff, 0xff], 0xffffffff, 0x3, 0x3b, 0x4e21, 0x4e23, 0x4e21, 0x4e21, 0x122, 0x300}, 0x1, 0x8f}}, @common=@inet=@hashlimit3={{0x158}, {'team_slave_1\x00', {0x3, 0x0, 0x41, 0x4, 0x2, 0x1000, 0x6, 0x40000003}}}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x7a, 0x1, 0x40, 'snmp_trap\x00', 'syz1\x00', {0x400}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x5c0) kernel console output (not intermixed with test programs): t: lec0:No lecd attached [ 420.990452][T20892] netlink: 20 bytes leftover after parsing attributes in process `syz.2.3839'. [ 421.063792][T20895] xt_hashlimit: size too large, truncated to 1048576 [ 421.112656][T20897] netlink: 44 bytes leftover after parsing attributes in process `syz.1.3841'. [ 421.124380][T20900] –: renamed from vxcan1 (while UP) [ 421.441268][T20913] syzkaller0: entered promiscuous mode [ 421.446937][T20913] syzkaller0: entered allmulticast mode [ 421.533043][T20919] netlink: 'syz.1.3847': attribute type 1 has an invalid length. [ 421.541154][T20919] netlink: 476 bytes leftover after parsing attributes in process `syz.1.3847'. [ 421.552259][T20919] netlink: 1041 bytes leftover after parsing attributes in process `syz.1.3847'. [ 421.564292][T20919] macvtap0: entered promiscuous mode [ 421.656998][T20926] lo: entered allmulticast mode [ 421.665490][T20926] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 421.709811][T20921] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3848'. [ 422.108647][T20949] netlink: 'syz.1.3857': attribute type 1 has an invalid length. [ 422.160940][T20954] IPVS: set_ctl: invalid protocol: 2 255.255.255.255:20002 [ 422.169608][T20949] bond4: entered promiscuous mode [ 422.175755][T20949] 8021q: adding VLAN 0 to HW filter on device bond4 [ 422.215221][T20950] vlan2: entered allmulticast mode [ 422.237167][T20950] bond4: entered allmulticast mode [ 422.244004][T20958] netlink: 20 bytes leftover after parsing attributes in process `syz.3.3859'. [ 422.289174][T20949] bond4: (slave bridge3): making interface the new active one [ 422.300386][T20949] bridge3: entered promiscuous mode [ 422.319827][T20949] bridge3: entered allmulticast mode [ 422.327069][T20949] bond4: (slave bridge3): Enslaving as an active interface with an up link [ 422.499639][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 422.523177][T20970] netlink: 36 bytes leftover after parsing attributes in process `syz.0.3864'. [ 422.537898][T20970] sctp: [Deprecated]: syz.0.3864 (pid 20970) Use of int in maxseg socket option. [ 422.537898][T20970] Use struct sctp_assoc_value instead [ 422.904966][T20991] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3868'. [ 422.945741][T20991] netlink: 100 bytes leftover after parsing attributes in process `syz.0.3868'. [ 423.817607][T21029] x_tables: ip_tables: rpfilter match: used from hooks OUTPUT, but only valid from PREROUTING [ 423.828294][T21030] x_tables: ip_tables: rpfilter match: used from hooks OUTPUT, but only valid from PREROUTING [ 424.901863][ T29] audit: type=1107 audit(1776250902.148:8): pid=21064 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='' [ 425.066108][T21085] lec:lec_vcc_attach: copy from user failed for 28 bytes [ 425.420190][ T47] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 425.451638][ T47] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 425.489951][ T47] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 425.535866][ T47] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 425.610963][T21085] __nla_validate_parse: 8 callbacks suppressed [ 425.610983][T21085] netlink: 236 bytes leftover after parsing attributes in process `syz.0.3893'. [ 425.641648][T21105] xt_ecn: cannot match TCP bits for non-tcp packets [ 425.651820][T21104] tun0: tun_chr_ioctl cmd 35111 [ 425.664173][T21104] tun0: tun_chr_ioctl cmd 1074812117 [ 425.918866][T21112] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3903'. [ 425.948552][T21112] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3903'. [ 425.959402][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 425.967605][ C0] lec:lec_tx_timeout: lec0 [ 425.967725][T21112] netlink: 'syz.1.3903': attribute type 18 has an invalid length. [ 425.972371][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 425.997190][T21110] pim6reg: entered allmulticast mode [ 426.004610][T21113] tipc: Enabled bearer , priority 5 [ 426.016376][T21116] pim6reg: left allmulticast mode [ 426.292969][T21129] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3906'. [ 426.317834][T21129] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 426.920494][T21155] netlink: 'syz.4.3912': attribute type 10 has an invalid length. [ 426.939654][T21155] team_slave_0: left promiscuous mode [ 426.945600][T21155] team_slave_1: left promiscuous mode [ 427.017245][T21165] geneve3: entered promiscuous mode [ 427.020429][T21167] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 427.121619][ T796] tipc: Node number set to 1664786322 [ 427.365605][T21191] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 427.374232][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 427.416066][T21195] netlink: 'syz.0.3926': attribute type 1 has an invalid length. [ 427.424877][T21195] netlink: 'syz.0.3926': attribute type 4 has an invalid length. [ 427.434458][T21195] netlink: 9462 bytes leftover after parsing attributes in process `syz.0.3926'. [ 427.446298][T21192] netlink: 'syz.1.3924': attribute type 2 has an invalid length. [ 427.455147][T21195] netlink: 'syz.0.3926': attribute type 1 has an invalid length. [ 427.456458][T21193] netlink: 'syz.1.3924': attribute type 2 has an invalid length. [ 427.480418][T21195] netlink: 'syz.0.3926': attribute type 4 has an invalid length. [ 427.487973][T21192] !: entered promiscuous mode [ 427.494557][T21195] netlink: 9462 bytes leftover after parsing attributes in process `syz.0.3926'. [ 427.568780][T21200] netlink: 20 bytes leftover after parsing attributes in process `syz.0.3926'. [ 427.594461][T21203] netlink: 296 bytes leftover after parsing attributes in process `syz.1.3928'. [ 427.633354][T21205] netlink: 7064 bytes leftover after parsing attributes in process `syz.4.3929'. [ 427.646302][T21205] openvswitch: netlink: Missing key (keys=40, expected=2000) [ 427.715127][T21207] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3930'. [ 427.725581][T21209] netlink: 'syz.4.3931': attribute type 12 has an invalid length. [ 427.828890][T21211] netlink: 'syz.1.3930': attribute type 5 has an invalid length. [ 428.297055][T21235] sctp: [Deprecated]: syz.0.3940 (pid 21235) Use of struct sctp_assoc_value in delayed_ack socket option. [ 428.297055][T21235] Use struct sctp_sack_info instead [ 428.441412][T21241] erspan0: entered promiscuous mode [ 428.457593][T21242] netlink: 'syz.2.3943': attribute type 1 has an invalid length. [ 430.326138][T21356] SET target dimension over the limit! [ 430.427090][ T29] audit: type=1800 audit(1776250907.678:9): pid=21358 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.3974" name="memory.events" dev="tmpfs" ino=882 res=0 errno=0 [ 430.971036][T21391] __nla_validate_parse: 22 callbacks suppressed [ 430.971057][T21391] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3983'. [ 430.989394][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 430.997421][ C0] lec:lec_tx_timeout: lec0 [ 430.999669][T21391] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3983'. [ 431.002822][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 431.039807][T21391] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3983'. [ 431.059542][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 431.072038][T21391] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3983'. [ 431.181997][T21406] netlink: 144 bytes leftover after parsing attributes in process `syz.1.3988'. [ 431.508339][T21428] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3994'. [ 431.523854][T21428] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3994'. [ 431.667648][T21438] netlink: 32 bytes leftover after parsing attributes in process `syz.3.3995'. [ 431.736285][T21438] vlan0: entered promiscuous mode [ 431.756904][T21442] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3996'. [ 431.773051][T21442] batadv_slave_0: entered promiscuous mode [ 431.781372][T21442] macsec2: entered promiscuous mode [ 431.783939][ T5826] Bluetooth: hci1: link tx timeout [ 431.786770][T21442] macsec2: entered allmulticast mode [ 431.799641][ T5826] Bluetooth: hci1: killing stalled connection 11:aa:aa:aa:aa:aa [ 431.810743][T21442] batadv_slave_0: entered allmulticast mode [ 431.817369][T21441] "syz.4.3997" (21441) uses obsolete ecb(arc4) skcipher [ 431.824773][T21442] batadv_slave_0: left allmulticast mode [ 431.832227][T21442] batadv_slave_0: left promiscuous mode [ 431.860168][T12235] Bluetooth: hci5: command 0x0406 tx timeout [ 432.047076][T21452] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4001'. [ 432.136253][T21463] netdevsim netdevsim1 netdevsim0: entered promiscuous mode [ 432.212943][T21463] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 432.230997][T21463] netdevsim netdevsim1 netdevsim0: refused to change device tx_queue_len [ 432.241322][T21459] tipc: Started in network mode [ 432.263524][T21459] tipc: Node identity fe80000000000000000000000000001, cluster identity 4711 [ 432.284375][T21459] tipc: Enabling of bearer rejected, failed to enable media [ 432.301334][T21463] validate_nla: 8 callbacks suppressed [ 432.301351][T21463] netlink: 'syz.1.4003': attribute type 2 has an invalid length. [ 432.380408][T21463] netlink: 'syz.1.4003': attribute type 1 has an invalid length. [ 432.597307][T21477] 8021q: adding VLAN 0 to HW filter on device bond4 [ 433.880508][ T5145] Bluetooth: hci1: command 0x0406 tx timeout [ 433.967885][T21514] xt_hashlimit: size too large, truncated to 1048576 [ 434.120455][T21510] tap0: tun_chr_ioctl cmd 2148553947 [ 434.422705][T21532] netlink: 'syz.3.4020': attribute type 1 has an invalid length. [ 435.321761][T21578] openvswitch: netlink: IP tunnel dst address not specified [ 435.457706][T21585] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 435.500336][T21595] openvswitch: netlink: Unexpected mask (mask=20440, allowed=10048) [ 435.881479][T21629] tipc: Enabling of bearer rejected, failed to enable media [ 436.019457][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 436.027613][ C0] lec:lec_tx_timeout: lec0 [ 436.032512][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 436.222737][T21639] __nla_validate_parse: 12 callbacks suppressed [ 436.222757][T21639] netlink: 28 bytes leftover after parsing attributes in process `syz.1.4050'. [ 436.249165][T21639] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4050'. [ 436.373514][T21639] netlink: 28 bytes leftover after parsing attributes in process `syz.1.4050'. [ 436.466181][T21648] sctp: [Deprecated]: syz.0.4052 (pid 21648) Use of int in max_burst socket option. [ 436.466181][T21648] Use struct sctp_assoc_value instead [ 436.864392][T21661] bond5: option ad_actor_sys_prio: mode dependency failed, not supported in mode balance-rr(0) [ 436.877524][T21661] bond5 (unregistering): Released all slaves [ 436.923338][T21665] netlink: 404 bytes leftover after parsing attributes in process `syz.3.4058'. [ 436.933211][T21665] netlink: 28 bytes leftover after parsing attributes in process `syz.3.4058'. [ 436.942704][T21665] netlink: 28 bytes leftover after parsing attributes in process `syz.3.4058'. [ 436.953963][T21665] netlink: 20 bytes leftover after parsing attributes in process `syz.3.4058'. [ 436.963888][T21670] 8021q: VLANs not supported on ipvlan0 [ 437.095249][T21676] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4061'. [ 437.234330][T21689] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4066'. [ 437.285542][T21694] macvlan0: left allmulticast mode [ 437.309101][T21694] netlink: 'syz.0.4067': attribute type 2 has an invalid length. [ 437.377270][T21699] netlink: 32 bytes leftover after parsing attributes in process `syz.3.4068'. [ 437.837381][T21737] bond3: option fail_over_mac: invalid value (127) [ 437.855628][T21737] bond3 (unregistering): Released all slaves [ 437.902880][T21744] mac80211_hwsim hwsim53 syzkaller0: left promiscuous mode [ 437.910290][T21744] mac80211_hwsim hwsim53 syzkaller0: left allmulticast mode [ 438.260220][T21762] netlink: 'syz.1.4084': attribute type 7 has an invalid length. [ 438.353131][T21758] A link change request failed with some changes committed already. Interface bond0 may have been left with an inconsistent configuration, please check. [ 438.369145][T21762] netlink: 'syz.1.4084': attribute type 8 has an invalid length. [ 438.386971][T21762] ip6gretap0: entered promiscuous mode [ 438.394998][T21762] syz_tun: entered promiscuous mode [ 438.402259][T21762] ip6gretap0: left promiscuous mode [ 438.410142][T21762] syz_tun: left promiscuous mode [ 438.443815][ T9441] bond0: (slave bridge1): link status definitely down, disabling slave [ 438.467656][ T9441] bridge1: left promiscuous mode [ 438.491822][ T9441] bridge1: left allmulticast mode [ 438.503428][ T9441] bond0: now running without any active interface! [ 438.627305][ T796] IPVS: starting estimator thread 0... [ 438.742091][T21775] IPVS: using max 43 ests per chain, 103200 per kthread [ 439.131728][ T29] audit: type=1800 audit(1776250916.378:10): pid=21786 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.4090" name="memory.events" dev="tmpfs" ino=1019 res=0 errno=0 [ 439.195300][T21803] sctp: [Deprecated]: syz.2.4094 (pid 21803) Use of int in maxseg socket option. [ 439.195300][T21803] Use struct sctp_assoc_value instead [ 439.217770][T21804] ip6t_srh: unknown srh invflags BA61 [ 439.377062][T21800] pim6reg1: entered allmulticast mode [ 439.458794][T21812] block nbd4: not configured, cannot reconfigure [ 439.880586][T21826] can: request_module (can-proto-5) failed. [ 440.068268][T21846] macvtap0: entered promiscuous mode [ 440.152188][T21845] macvtap0: left promiscuous mode [ 440.235127][T21853] netlink: 'syz.3.4107': attribute type 1 has an invalid length. [ 440.469819][T21865] FAULT_INJECTION: forcing a failure. [ 440.469819][T21865] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 440.498353][T21865] CPU: 0 UID: 0 PID: 21865 Comm: syz.4.4111 Not tainted syzkaller #0 PREEMPT(full) [ 440.498380][T21865] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 440.498395][T21865] Call Trace: [ 440.498403][T21865] [ 440.498411][T21865] dump_stack_lvl+0xe8/0x150 [ 440.498442][T21865] should_fail_ex+0x412/0x560 [ 440.498474][T21865] _copy_from_user+0x2d/0xb0 [ 440.498496][T21865] __sys_bpf+0x229/0x950 [ 440.498517][T21865] ? __pfx___sys_bpf+0x10/0x10 [ 440.498550][T21865] ? ksys_write+0x242/0x270 [ 440.498574][T21865] ? __pfx_ksys_write+0x10/0x10 [ 440.498601][T21865] __x64_sys_bpf+0x7c/0x90 [ 440.498626][T21865] do_syscall_64+0x14d/0xf80 [ 440.498647][T21865] ? trace_irq_disable+0x3b/0x150 [ 440.498663][T21865] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 440.498682][T21865] ? clear_bhb_loop+0x40/0x90 [ 440.498703][T21865] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 440.498724][T21865] RIP: 0033:0x7fc0b719c819 [ 440.498741][T21865] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 440.498756][T21865] RSP: 002b:00007fc0b8092028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 440.498775][T21865] RAX: ffffffffffffffda RBX: 00007fc0b7415fa0 RCX: 00007fc0b719c819 [ 440.498788][T21865] RDX: 0000000000000094 RSI: 0000200000000580 RDI: 0000000000000005 [ 440.498798][T21865] RBP: 00007fc0b8092090 R08: 0000000000000000 R09: 0000000000000000 [ 440.498810][T21865] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 440.498821][T21865] R13: 00007fc0b7416038 R14: 00007fc0b7415fa0 R15: 00007ffdfe0b0238 [ 440.498851][T21865] [ 440.741035][T21868] netlink: 'syz.2.4112': attribute type 1 has an invalid length. [ 440.766669][T21870] IPv6: NLM_F_CREATE should be specified when creating new route [ 440.775276][T21870] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 440.782676][T21870] IPv6: NLM_F_CREATE should be set when creating new route [ 440.789995][T21870] IPv6: NLM_F_CREATE should be set when creating new route [ 440.797220][T21870] IPv6: NLM_F_CREATE should be set when creating new route [ 441.039487][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 441.047661][ C0] lec:lec_tx_timeout: lec0 [ 441.053250][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 441.263630][T21886] bond3: entered promiscuous mode [ 441.268874][T21886] bond3: entered allmulticast mode [ 441.274897][T21886] 8021q: adding VLAN 0 to HW filter on device bond3 [ 441.375843][T21906] __nla_validate_parse: 12 callbacks suppressed [ 441.375914][T21906] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4124'. [ 441.405636][T21906] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4124'. [ 441.420389][ T9440] netdevsim netdevsim0 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 441.465117][ T9440] netdevsim netdevsim0 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 441.498379][ T9440] netdevsim netdevsim0 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 441.529458][ T9440] netdevsim netdevsim0 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 441.850510][T21929] netlink: 24 bytes leftover after parsing attributes in process `syz.4.4130'. [ 441.930976][T21931] netlink: 24 bytes leftover after parsing attributes in process `syz.4.4130'. [ 442.108714][T21936] netlink: 28 bytes leftover after parsing attributes in process `syz.4.4133'. [ 442.160903][T21942] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 442.169233][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 442.201615][T21942] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4134'. [ 442.239155][T21942] macvtap1: entered promiscuous mode [ 442.250352][T21942] €Â: entered promiscuous mode [ 442.260065][T21942] macvtap1: entered allmulticast mode [ 442.266343][T21942] €Â: entered allmulticast mode [ 442.267737][T21946] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4134'. [ 442.343356][T21946] €Â: left allmulticast mode [ 442.348099][T21946] €Â: left promiscuous mode [ 442.460992][T21953] netlink: 'syz.2.4136': attribute type 5 has an invalid length. [ 442.543456][T21960] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4138'. [ 442.606627][T21962] openvswitch: netlink: Unexpected mask (mask=100000000, allowed=10048) [ 442.876620][T21981] netlink: 28 bytes leftover after parsing attributes in process `syz.0.4142'. [ 443.566909][T22012] xfrm1: entered allmulticast mode [ 443.788413][T22018] netlink: 28 bytes leftover after parsing attributes in process `syz.3.4154'. [ 443.906514][T22023] netlink: 'syz.2.4156': attribute type 1 has an invalid length. [ 444.073729][T22030] Bluetooth: MGMT ver 1.23 [ 444.113319][ T7386] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 445.102307][T22084] IPVS: ip_vs_add_dest(): server weight less than zero [ 445.151074][ T7386] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 445.517061][ T9440] dvmrp6: left allmulticast mode [ 445.719232][T22129] batman_adv: batadv0: adding TT local entry aa:aa:aa:aa:aa:2a to non-existent VLAN 773 [ 445.755341][ T9440] gretap0 (unregistering): left promiscuous mode [ 445.780435][ T9440] bond4 (unregistering): (slave gretap1): Releasing active interface [ 445.794544][ T9440] batman_adv: batadv0: Removing interface: gretap2 [ 446.059458][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 446.067744][ C0] lec:lec_tx_timeout: lec0 [ 446.072671][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 446.145746][ T9440] bond1 (unregistering): Released all slaves [ 446.164923][ T9440] bond2 (unregistering): Released all slaves [ 446.186146][ T9440] team0: Port device bond3 removed [ 446.193356][ T9440] bond3 (unregistering): Released all slaves [ 446.217767][ T9440] bond4 (unregistering): Released all slaves [ 446.245684][ T9440] bond5 (unregistering): Released all slaves [ 446.266826][ T9440] bond6 (unregistering): Released all slaves [ 446.294039][ T9440] bond7 (unregistering): (slave macvlan2): Releasing backup interface [ 446.304019][ T9440] bond7 (unregistering): Released all slaves [ 446.327781][ T9440] bond8 (unregistering): Released all slaves [ 446.608370][ T9440] tipc: Left network mode [ 446.635708][T22140] __nla_validate_parse: 20 callbacks suppressed [ 446.635725][T22140] netlink: 24 bytes leftover after parsing attributes in process `syz.4.4187'. [ 446.897027][T22155] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4192'. [ 447.297545][T22181] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4199'. [ 447.344223][T22183] tipc: Enabling of bearer rejected, failed to enable media [ 447.591957][T22198] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4204'. [ 447.609055][T22196] ipt_REJECT: ECHOREPLY no longer supported. [ 447.616385][T22197] netlink: 60 bytes leftover after parsing attributes in process `syz.2.4203'. [ 447.628022][ T5826] Bluetooth: hci1: command 0x0406 tx timeout [ 447.688356][T22197] netlink: 60 bytes leftover after parsing attributes in process `syz.2.4203'. [ 447.699527][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 447.952638][T22217] netlink: 56 bytes leftover after parsing attributes in process `syz.2.4208'. [ 448.057302][ T9440] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 448.740223][ T9440] team0 (unregistering): Port device team_slave_1 removed [ 448.749327][T22234] netlink: 24 bytes leftover after parsing attributes in process `syz.0.4211'. [ 449.210264][T22264] netlink: 'syz.3.4213': attribute type 8 has an invalid length. [ 449.241228][T22269] netlink: 28 bytes leftover after parsing attributes in process `syz.3.4213'. [ 449.330526][T22273] netlink: 20 bytes leftover after parsing attributes in process `syz.0.4214'. [ 449.653757][ T9440] IPVS: stop unused estimator thread 0... [ 450.131745][T22309] : entered promiscuous mode [ 450.777721][T22343] netlink: 'syz.1.4230': attribute type 9 has an invalid length. [ 450.833901][T22343] netlink: 'syz.1.4230': attribute type 6 has an invalid length. [ 450.945792][T22343] 8021q: VLANs not supported on wg1 [ 451.177691][T22369] block nbd0: not configured, cannot reconfigure [ 451.859392][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5790 ms [ 451.867644][ C0] lec:lec_tx_timeout: lec0 [ 451.872396][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 451.997219][T22350] __nla_validate_parse: 6 callbacks suppressed [ 451.997240][T22350] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4232'. [ 452.471981][T22434] netlink: 'syz.1.4246': attribute type 4 has an invalid length. [ 452.861616][T22450] netlink: 20 bytes leftover after parsing attributes in process `syz.4.4250'. [ 452.994581][T22460] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4252'. [ 453.826351][T22506] netlink: 220 bytes leftover after parsing attributes in process `syz.3.4261'. [ 453.840437][T22506] netlink: 'syz.3.4261': attribute type 2 has an invalid length. [ 454.057301][T22517] veth0: entered promiscuous mode [ 454.145608][T22515] veth0: left promiscuous mode [ 454.169881][T22521] netlink: 'syz.2.4263': attribute type 12 has an invalid length. [ 454.177758][T22521] netlink: 132 bytes leftover after parsing attributes in process `syz.2.4263'. [ 454.904790][T22565] netlink: 36 bytes leftover after parsing attributes in process `syz.2.4274'. [ 454.953021][T22565] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4274'. [ 455.086277][T22572] netlink: 32 bytes leftover after parsing attributes in process `syz.4.4277'. [ 455.264528][T22578] netlink: 36 bytes leftover after parsing attributes in process `syz.3.4279'. [ 455.652065][T22610] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4286'. [ 455.674428][ T9441] netdevsim netdevsim4 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 455.696651][ T9441] netdevsim netdevsim4 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 455.716089][ T9441] netdevsim netdevsim4 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 455.737081][ T9441] netdevsim netdevsim4 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 456.265310][T22642] openvswitch: netlink: IP tunnel attribute has 4 unknown bytes. [ 456.700799][T22664] tipc: Started in network mode [ 456.705724][T22664] tipc: Node identity 080211000001, cluster identity 4711 [ 456.717312][T22664] tipc: Enabled bearer , priority 0 [ 456.767849][T22673] mac80211_hwsim hwsim53 syzkaller0: entered promiscuous mode [ 456.776232][T22673] mac80211_hwsim hwsim53 syzkaller0: entered allmulticast mode [ 456.786801][T22673] tipc: Resetting bearer [ 456.899436][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5030 ms [ 456.907476][ C0] lec:lec_tx_timeout: lec0 [ 456.912215][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 457.033031][T22692] netlink: 'syz.4.4306': attribute type 5 has an invalid length. [ 457.061859][T22692] __nla_validate_parse: 8 callbacks suppressed [ 457.061878][T22692] netlink: 3657 bytes leftover after parsing attributes in process `syz.4.4306'. [ 457.464977][ T5145] Bluetooth: hci2: command 0x0406 tx timeout [ 457.511429][T22719] netlink: 5112 bytes leftover after parsing attributes in process `syz.4.4316'. [ 457.547298][T22720] netlink: 'syz.4.4316': attribute type 1 has an invalid length. [ 457.550972][T22726] netlink: 16 bytes leftover after parsing attributes in process `syz.1.4317'. [ 457.570305][T22720] netlink: 'syz.4.4316': attribute type 2 has an invalid length. [ 457.614649][T22719] netlink: 5112 bytes leftover after parsing attributes in process `syz.4.4316'. [ 457.628106][T22719] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4316'. [ 457.631552][T22720] netlink: 'syz.4.4316': attribute type 2 has an invalid length. [ 457.639019][T22726] ipvlan1: entered promiscuous mode [ 457.653003][T22726] ipvlan1: left promiscuous mode [ 457.713774][T22735] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4320'. [ 457.739526][T22735] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4320'. [ 457.759775][T22735] netlink: 324 bytes leftover after parsing attributes in process `syz.4.4320'. [ 457.813448][T22735] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4320'. [ 457.835753][T22735] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4320'. [ 457.846927][ T796] tipc: Node number set to 134418688 [ 458.006430][T22759] bond5: entered promiscuous mode [ 458.012902][T22759] 8021q: adding VLAN 0 to HW filter on device bond5 [ 458.051346][T22759] 8021q: adding VLAN 0 to HW filter on device bond5 [ 458.058797][T22759] bond5: (slave vcan0): The slave device specified does not support setting the MAC address [ 458.071909][T22759] bond5: (slave vcan0): Error -95 calling set_mac_address [ 458.173645][T22757] team_slave_0: entered promiscuous mode [ 458.180221][T22757] team_slave_1: entered promiscuous mode [ 458.198282][T22757] 8021q: adding VLAN 0 to HW filter on device team0 [ 458.215406][T22757] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 458.623635][T22794] bridge_slave_0: default FDB implementation only supports local addresses [ 459.084817][T22825] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 459.126325][T22825] netlink: 'syz.3.4342': attribute type 1 has an invalid length. [ 459.141785][T22825] netlink: 'syz.3.4342': attribute type 1 has an invalid length. [ 459.162985][T22825] netlink: 'syz.3.4342': attribute type 8 has an invalid length. [ 459.187936][T22825] netlink: 'syz.3.4342': attribute type 10 has an invalid length. [ 459.267993][T22825] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 459.463548][T22861] batadv_slave_0: entered promiscuous mode [ 459.470221][T22861] batadv_slave_0: left promiscuous mode [ 460.528725][T22909] syzkaller1: entered promiscuous mode [ 460.536212][T22909] syzkaller1: entered allmulticast mode [ 460.606270][T22916] xt_HMARK: proto mask must be zero with L3 mode [ 460.719229][T22922] openvswitch: netlink: Duplicate key (type 21). [ 461.050380][T22941] can: request_module (can-proto-0) failed. [ 461.056898][T22941] netlink: 'syz.2.4373': attribute type 1 has an invalid length. [ 461.179227][T22944] IPVS: length: 75 != 24 [ 461.302919][T22961] x_tables: ip6_tables: rpfilter match: used from hooks OUTPUT, but only valid from PREROUTING [ 461.480207][T22971] IPv6: sit1: Disabled Multicast RS [ 461.487741][T22971] sit1: entered allmulticast mode [ 461.631448][T22975] sctp: [Deprecated]: syz.0.4384 (pid 22975) Use of struct sctp_assoc_value in delayed_ack socket option. [ 461.631448][T22975] Use struct sctp_sack_info instead [ 461.635302][T22976] erspan0: entered promiscuous mode [ 461.676452][T22976] macsec1: entered allmulticast mode [ 461.679306][T22975] sctp: [Deprecated]: syz.0.4384 (pid 22975) Use of struct sctp_assoc_value in delayed_ack socket option. [ 461.679306][T22975] Use struct sctp_sack_info instead [ 461.687306][T22976] erspan0: entered allmulticast mode [ 461.710356][T22976] erspan0: left allmulticast mode [ 461.716453][T22976] erspan0: left promiscuous mode [ 461.808552][T22985] bond2: option lacp_rate: mode dependency failed, not supported in mode active-backup(1) [ 461.831255][T22985] bond2 (unregistering): Released all slaves [ 461.883778][T22982] syzkaller1: entered promiscuous mode [ 461.890634][T22982] syzkaller1: entered allmulticast mode [ 461.924838][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 461.933056][ C0] lec:lec_tx_timeout: lec0 [ 461.938022][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 462.057057][T23000] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 462.111798][T23000] team0: Port device macvlan2 added [ 462.157220][T23009] netlink: 'syz.0.4393': attribute type 10 has an invalid length. [ 462.190094][T23011] x_tables: duplicate underflow at hook 3 [ 462.322190][T23018] netlink: 'syz.2.4397': attribute type 1 has an invalid length. [ 462.340211][T23019] __nla_validate_parse: 14 callbacks suppressed [ 462.340230][T23019] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4396'. [ 462.482366][T23026] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4401'. [ 462.628781][T23041] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4405'. [ 462.637798][T23044] netlink: 144 bytes leftover after parsing attributes in process `syz.3.4406'. [ 462.638039][T23043] netlink: 144 bytes leftover after parsing attributes in process `syz.3.4406'. [ 462.657353][T23041] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4405'. [ 462.892914][T23057] SET target dimension over the limit! [ 463.200370][T23075] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 463.366780][T23093] netlink: 'syz.1.4423': attribute type 29 has an invalid length. [ 463.375852][T23094] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4424'. [ 463.376568][T23093] netlink: 'syz.1.4423': attribute type 29 has an invalid length. [ 463.404546][T23093] netlink: 'syz.1.4423': attribute type 29 has an invalid length. [ 463.425364][T23093] netlink: 'syz.1.4423': attribute type 29 has an invalid length. [ 463.453229][T23093] netlink: 'syz.1.4423': attribute type 9 has an invalid length. [ 463.476554][T23093] netlink: 212340 bytes leftover after parsing attributes in process `syz.1.4423'. [ 463.710466][T23113] syzkaller0: entered promiscuous mode [ 463.716110][T23113] syzkaller0: entered allmulticast mode [ 463.732824][T23113] tc action pedit 'at' offset -255 out of bounds [ 463.864778][T23120] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4430'. [ 463.984152][T23126] netlink: 'syz.4.4432': attribute type 1 has an invalid length. [ 464.010811][T23126] netlink: 244 bytes leftover after parsing attributes in process `syz.4.4432'. [ 464.051298][T23131] ip6erspan0: entered allmulticast mode [ 464.377740][T23146] syz_tun: entered allmulticast mode [ 464.385697][T23144] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 464.576848][T23155] veth1: entered promiscuous mode [ 464.583716][T23155] veth1: entered allmulticast mode [ 464.984200][T23178] netlink: 'syz.2.4448': attribute type 10 has an invalid length. [ 465.006106][T23178] bond0: (slave wlan1): Enslaving as an active interface with an up link [ 465.017685][T23179] xfrm0: entered promiscuous mode [ 465.024058][T23179] xfrm0: entered allmulticast mode [ 465.170721][T23186] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 465.589538][T23196] syzkaller0: entered promiscuous mode [ 465.595575][T23196] syzkaller0: entered allmulticast mode [ 465.703735][T23204] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 465.831543][T23213] netlink: 'syz.0.4459': attribute type 49 has an invalid length. [ 466.341226][T23243] syzkaller1: entered promiscuous mode [ 466.346745][T23243] syzkaller1: entered allmulticast mode [ 466.569739][T23264] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 466.864769][T23274] bridge4: the hash_elasticity option has been deprecated and is always 16 [ 466.889833][T23274] bridge4: entered allmulticast mode [ 466.949430][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 466.957528][ C0] lec:lec_tx_timeout: lec0 [ 466.962593][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 467.406767][T23295] __nla_validate_parse: 9 callbacks suppressed [ 467.406787][T23295] netlink: 16 bytes leftover after parsing attributes in process `syz.0.4484'. [ 467.505091][T23304] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4488'. [ 467.514554][T23304] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4488'. [ 468.420994][T23334] xt_CT: You must specify a L4 protocol and not use inversions on it [ 468.681836][T23356] netlink: 6032 bytes leftover after parsing attributes in process `syz.3.4501'. [ 468.823509][T23360] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4502'. [ 468.843971][T23360] netlink: 580 bytes leftover after parsing attributes in process `syz.3.4502'. [ 469.152494][T23369] validate_nla: 1 callbacks suppressed [ 469.152513][T23369] netlink: 'syz.0.4506': attribute type 10 has an invalid length. [ 469.307200][T23369] dummy0: left allmulticast mode [ 469.351637][T23385] veth0: entered promiscuous mode [ 469.357632][T23383] netlink: 20 bytes leftover after parsing attributes in process `syz.2.4510'. [ 469.411854][T23386] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4511'. [ 469.512808][T23394] netlink: 20 bytes leftover after parsing attributes in process `syz.4.4511'. [ 469.721098][T23398] pim6reg: entered allmulticast mode [ 469.811610][T23368] veth0: left promiscuous mode [ 470.144115][T23422] netlink: 24 bytes leftover after parsing attributes in process `syz.0.4519'. [ 470.776791][T23455] netlink: 'syz.4.4530': attribute type 1 has an invalid length. [ 470.798752][T23453] netlink: 'syz.2.4528': attribute type 1 has an invalid length. [ 470.883471][T23455] 8021q: adding VLAN 0 to HW filter on device bond6 [ 470.970918][T23465] bond6: (slave syz_tun): Enslaving as a backup interface with an up link [ 471.476088][T23498] netlink: 'syz.0.4540': attribute type 3 has an invalid length. [ 471.499073][T23498] netlink: 'syz.0.4540': attribute type 3 has an invalid length. [ 471.969420][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 471.977585][ C0] lec:lec_tx_timeout: lec0 [ 471.982704][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 472.824322][ T5145] Bluetooth: hci4: command 0x0406 tx timeout [ 472.855163][T23590] syzkaller1: entered promiscuous mode [ 472.862423][T23592] __nla_validate_parse: 13 callbacks suppressed [ 472.862444][T23592] netlink: 212368 bytes leftover after parsing attributes in process `syz.3.4560'. [ 472.887339][T23590] syzkaller1: entered allmulticast mode [ 473.207487][T23617] netlink: 24 bytes leftover after parsing attributes in process `syz.3.4565'. [ 473.454820][T23632] IPVS: length: 528 != 632 [ 473.648897][T23641] netlink: 'syz.2.4572': attribute type 1 has an invalid length. [ 473.729292][T23641] netlink: 'syz.2.4572': attribute type 1 has an invalid length. [ 474.037077][T23673] netlink: 'syz.4.4580': attribute type 1 has an invalid length. [ 474.070958][T23665] netlink: 24 bytes leftover after parsing attributes in process `syz.3.4578'. [ 474.078659][T23653] syzkaller0: entered promiscuous mode [ 474.089511][T23653] syzkaller0: entered allmulticast mode [ 474.331478][T23684] netlink: zone id is out of range [ 474.336767][T23684] netlink: zone id is out of range [ 474.366562][T23673] 8021q: adding VLAN 0 to HW filter on device bond7 [ 474.387871][T23684] netlink: zone id is out of range [ 474.393366][T23684] netlink: zone id is out of range [ 474.398973][T23684] netlink: zone id is out of range [ 474.404505][T23684] netlink: zone id is out of range [ 474.416914][T23684] netlink: zone id is out of range [ 474.427601][T23684] netlink: zone id is out of range [ 474.433172][T23684] netlink: zone id is out of range [ 474.438527][T23684] netlink: zone id is out of range [ 474.458085][T23677] veth9: entered promiscuous mode [ 476.400456][T23686] workqueue: Failed to create a rescuer kthread for wq "bond5": -EINTR [ 476.435314][T23700] bridge0: port 1(bridge_slave_0) entered disabled state [ 476.689965][T23719] netlink: 'syz.2.4590': attribute type 2 has an invalid length. [ 476.729081][T23719] !¼Þ: entered promiscuous mode [ 476.793038][T23719] netlink: 'syz.2.4590': attribute type 2 has an invalid length. [ 476.824218][T23719] !¼Þ: left promiscuous mode [ 476.989438][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 476.997606][ C0] lec:lec_tx_timeout: lec0 [ 477.002318][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 477.111162][T23731] netlink: 16 bytes leftover after parsing attributes in process `syz.2.4590'. [ 477.204967][T23741] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4594'. [ 477.214103][T23741] netlink: 'syz.4.4594': attribute type 29 has an invalid length. [ 477.222155][T23741] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4594'. [ 477.423962][T23744] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4595'. [ 477.451985][T23744] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4595'. [ 477.583226][T23737] tipc: Enabling of bearer rejected, already enabled [ 477.603013][T23749] lo: Caught tx_queue_len zero misconfig [ 477.851668][T23761] xt_time: invalid argument - start or stop time greater than 23:59:59 [ 477.861145][T23754] netlink: 28 bytes leftover after parsing attributes in process `syz.2.4599'. [ 478.118221][T23768] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4598'. [ 478.165832][T23772] netlink: 71 bytes leftover after parsing attributes in process `syz.1.4605'. [ 478.964936][T23792] netlink: 48 bytes leftover after parsing attributes in process `syz.3.4609'. [ 478.998886][T23782] ip6gre1: entered promiscuous mode [ 479.013531][T23782] ip6gre1: entered allmulticast mode [ 479.374855][T23818] raw_sendmsg: syz.0.4616 forgot to set AF_INET. Fix it! [ 479.598952][T23825] netlink: 28 bytes leftover after parsing attributes in process `syz.2.4619'. [ 479.678935][T23830] netlink: 'syz.2.4620': attribute type 153 has an invalid length. [ 479.687390][T23830] netlink: 24 bytes leftover after parsing attributes in process `syz.2.4620'. [ 480.001622][T23838] netlink: 32 bytes leftover after parsing attributes in process `syz.3.4622'. [ 480.012026][T23838] netlink: 'syz.3.4622': attribute type 1 has an invalid length. [ 480.085493][T23839] netlink: 28 bytes leftover after parsing attributes in process `syz.1.4623'. [ 480.335896][T23863] netlink: 48 bytes leftover after parsing attributes in process `syz.0.4629'. [ 480.623473][T23880] netlink: 'syz.2.4633': attribute type 4 has an invalid length. [ 480.945649][T23901] netlink: 24 bytes leftover after parsing attributes in process `syz.4.4641'. [ 481.018853][T23906] gretap1: entered promiscuous mode [ 481.027088][T23906] batman_adv: batadv0: Adding interface: gretap1 [ 481.034408][T23906] batman_adv: batadv0: The MTU of interface gretap1 is too small (1462) to handle the transport of batman-adv packets. If you experience problems getting traffic through try increasing the MTU to 1532. [ 481.055500][T23901] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4641'. [ 481.066862][T23906] batman_adv: batadv0: Not using interface gretap1 (retrying later): interface not active [ 481.192902][T23920] tunl0: Caught tx_queue_len zero misconfig [ 481.282594][T23924] netlink: 'syz.1.4648': attribute type 1 has an invalid length. [ 481.299200][T23924] vxcan1: left promiscuous mode [ 481.306093][T23924] macvtap0: left promiscuous mode [ 481.312183][T23924] netdevsim netdevsim1 netdevsim0: left promiscuous mode [ 481.321722][T23924] bond4: left promiscuous mode [ 481.326720][T23924] bridge3: left promiscuous mode [ 481.332812][T23924] macvtap1: left promiscuous mode [ 481.338807][T23924] ip6gre1: left promiscuous mode [ 481.344436][T23924] gretap1: left promiscuous mode [ 481.619598][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 481.726649][T23946] x_tables: arp_tables: CLASSIFY target: used from hooks INPUT, but only usable from FORWARD/OUTPUT [ 481.760178][T23946] 8021q: VLANs not supported on ipvlan0 [ 481.782052][T23946] sctp: [Deprecated]: syz.1.4655 (pid 23946) Use of int in max_burst socket option deprecated. [ 481.782052][T23946] Use struct sctp_assoc_value instead [ 482.009455][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 482.017713][ C0] lec:lec_tx_timeout: lec0 [ 482.020609][T23961] bond8: peer notification delay (9) is not a multiple of miimon (100), value rounded to 0 ms [ 482.022697][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 482.105698][T23969] bridge0: left allmulticast mode [ 482.111888][T23961] syzkaller1: entered promiscuous mode [ 482.118131][T23961] syzkaller1: entered allmulticast mode [ 482.321693][T23975] lo speed is unknown, defaulting to 1000 [ 482.327670][T23975] lo speed is unknown, defaulting to 1000 [ 482.334724][T23975] lo speed is unknown, defaulting to 1000 [ 482.377138][T23975] infiniband syz2: RDMA CMA: cma_listen_on_dev, error -98 [ 482.464758][T23990] syzkaller0: entered promiscuous mode [ 482.479639][T23990] syzkaller0: entered allmulticast mode [ 482.553852][T23975] lo speed is unknown, defaulting to 1000 [ 482.571580][T23975] lo speed is unknown, defaulting to 1000 [ 482.578456][T23975] lo speed is unknown, defaulting to 1000 [ 482.601234][T23975] lo speed is unknown, defaulting to 1000 [ 482.608738][T23975] lo speed is unknown, defaulting to 1000 [ 482.622792][T23975] lo speed is unknown, defaulting to 1000 [ 482.630604][T23975] lo speed is unknown, defaulting to 1000 [ 483.163012][T24019] __nla_validate_parse: 17 callbacks suppressed [ 483.163059][T24019] netlink: 28 bytes leftover after parsing attributes in process `syz.0.4676'. [ 483.871742][T24041] netlink: 'syz.4.4679': attribute type 4 has an invalid length. [ 483.973864][T24042] netlink: 1036 bytes leftover after parsing attributes in process `syz.1.4678'. [ 485.110118][T24077] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4689'. [ 485.206271][T24083] netlink: 'syz.0.4691': attribute type 1 has an invalid length. [ 485.388825][T24083] netlink: 28 bytes leftover after parsing attributes in process `syz.0.4691'. [ 485.410648][T24093] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4693'. [ 485.440617][T24083] 8021q: adding VLAN 0 to HW filter on device bond5 [ 485.559765][T24083] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4691'. [ 485.596134][T24083] batadv1: entered promiscuous mode [ 485.616728][T24083] batadv1: entered allmulticast mode [ 485.678621][T24083] 8021q: adding VLAN 0 to HW filter on device batadv1 [ 485.693608][T24097] netlink: 28 bytes leftover after parsing attributes in process `syz.2.4695'. [ 485.811256][T24103] netlink: 28 bytes leftover after parsing attributes in process `syz.3.4696'. [ 485.816389][T24105] netlink: 20 bytes leftover after parsing attributes in process `syz.4.4697'. [ 485.821489][T24103] netlink: 28 bytes leftover after parsing attributes in process `syz.3.4696'. [ 485.849515][T24105] nbd: socks must be embedded in a SOCK_ITEM attr [ 485.919725][T24103] netlink: 'syz.3.4696': attribute type 4 has an invalid length. [ 485.969282][T24106] nbd: nbd64 already in use [ 486.969138][T24152] Bluetooth: MGMT ver 1.23 [ 487.039372][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 487.047479][ C0] lec:lec_tx_timeout: lec0 [ 487.052183][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 487.153259][T24159] syzkaller1: entered promiscuous mode [ 487.168849][T24159] syzkaller1: entered allmulticast mode [ 487.246258][ T29] audit: type=1107 audit(1776250964.498:11): pid=24163 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='' [ 487.584647][T24181] netlink: 'syz.4.4718': attribute type 33 has an invalid length. [ 487.606728][T24185] veth0_to_hsr: Caught tx_queue_len zero misconfig [ 487.731853][T24188] netlink: 'syz.0.4720': attribute type 10 has an invalid length. [ 487.784873][T24188] veth0: entered promiscuous mode [ 487.790868][T24188] bond0: entered promiscuous mode [ 487.806617][T24188] geneve0: left allmulticast mode [ 487.990047][T24187] bond0: left promiscuous mode [ 487.995253][T24187] veth0: left promiscuous mode [ 488.045524][T24205] netlink: 'syz.3.4724': attribute type 20 has an invalid length. [ 488.070406][T24190] 8021q: adding VLAN 0 to HW filter on device macvlan3 [ 488.132494][ T9438] netdevsim netdevsim3 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 488.220826][T24218] FAULT_INJECTION: forcing a failure. [ 488.220826][T24218] name failslab, interval 1, probability 0, space 0, times 0 [ 488.253948][T24218] CPU: 1 UID: 0 PID: 24218 Comm: syz.3.4726 Not tainted syzkaller #0 PREEMPT(full) [ 488.253977][T24218] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 488.253988][T24218] Call Trace: [ 488.253995][T24218] [ 488.254003][T24218] dump_stack_lvl+0xe8/0x150 [ 488.254033][T24218] should_fail_ex+0x412/0x560 [ 488.254061][T24218] should_failslab+0xa8/0x100 [ 488.254083][T24218] ? skb_clone+0x212/0x3a0 [ 488.254098][T24218] kmem_cache_alloc_noprof+0x87/0x650 [ 488.254117][T24218] ? __netlink_lookup+0xc6/0x8b0 [ 488.254145][T24218] skb_clone+0x212/0x3a0 [ 488.254166][T24218] __netlink_deliver_tap+0x404/0x850 [ 488.254201][T24218] ? netlink_deliver_tap+0x2e/0x1b0 [ 488.254221][T24218] netlink_deliver_tap+0x19c/0x1b0 [ 488.254243][T24218] netlink_unicast+0x730/0x8e0 [ 488.254270][T24218] netlink_sendmsg+0x813/0xb40 [ 488.254300][T24218] ? __pfx_netlink_sendmsg+0x10/0x10 [ 488.254325][T24218] ? aa_sock_msg_perm+0xf1/0x1b0 [ 488.254352][T24218] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 488.254376][T24218] ____sys_sendmsg+0x972/0x9f0 [ 488.254407][T24218] ? __pfx_____sys_sendmsg+0x10/0x10 [ 488.254437][T24218] ? import_iovec+0x73/0xa0 [ 488.254457][T24218] ___sys_sendmsg+0x2a5/0x360 [ 488.254487][T24218] ? __pfx____sys_sendmsg+0x10/0x10 [ 488.254541][T24218] ? __fget_files+0x2a/0x420 [ 488.254555][T24218] ? __fget_files+0x3a0/0x420 [ 488.254577][T24218] __x64_sys_sendmsg+0x1bd/0x2a0 [ 488.254605][T24218] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 488.254638][T24218] ? __pfx_ksys_write+0x10/0x10 [ 488.254669][T24218] do_syscall_64+0x14d/0xf80 [ 488.254690][T24218] ? trace_irq_disable+0x3b/0x150 [ 488.254704][T24218] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 488.254722][T24218] ? clear_bhb_loop+0x40/0x90 [ 488.254743][T24218] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 488.254759][T24218] RIP: 0033:0x7f960619c819 [ 488.254776][T24218] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 488.254792][T24218] RSP: 002b:00007f96043f6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 488.254812][T24218] RAX: ffffffffffffffda RBX: 00007f9606415fa0 RCX: 00007f960619c819 [ 488.254826][T24218] RDX: 0000000020004804 RSI: 0000200000000000 RDI: 0000000000000008 [ 488.254837][T24218] RBP: 00007f96043f6090 R08: 0000000000000000 R09: 0000000000000000 [ 488.254847][T24218] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 488.254856][T24218] R13: 00007f9606416038 R14: 00007f9606415fa0 R15: 00007ffebd1b5868 [ 488.254884][T24218] [ 488.256688][ T9438] netdevsim netdevsim3 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 488.659777][ T9438] netdevsim netdevsim3 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 488.668537][ T9438] netdevsim netdevsim3 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 488.770359][T24230] netlink: 'syz.3.4729': attribute type 4 has an invalid length. [ 488.853548][T24230] __nla_validate_parse: 10 callbacks suppressed [ 488.853567][T24230] netlink: 20 bytes leftover after parsing attributes in process `syz.3.4729'. [ 489.236083][T24246] netlink: 32 bytes leftover after parsing attributes in process `syz.0.4735'. [ 489.331637][T24254] netlink: 'syz.4.4737': attribute type 1 has an invalid length. [ 489.388674][T24254] netlink: 200 bytes leftover after parsing attributes in process `syz.4.4737'. [ 489.470847][T24259] netlink: 'syz.0.4738': attribute type 11 has an invalid length. [ 489.503881][T24259] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4738'. [ 489.537088][T24265] FAULT_INJECTION: forcing a failure. [ 489.537088][T24265] name failslab, interval 1, probability 0, space 0, times 0 [ 489.613335][T24265] CPU: 1 UID: 0 PID: 24265 Comm: syz.1.4740 Not tainted syzkaller #0 PREEMPT(full) [ 489.613361][T24265] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 489.613371][T24265] Call Trace: [ 489.613378][T24265] [ 489.613385][T24265] dump_stack_lvl+0xe8/0x150 [ 489.613415][T24265] should_fail_ex+0x412/0x560 [ 489.613445][T24265] should_failslab+0xa8/0x100 [ 489.613468][T24265] kmem_cache_alloc_node_noprof+0x8f/0x690 [ 489.613488][T24265] ? __alloc_skb+0x186/0x7d0 [ 489.613509][T24265] ? __alloc_skb+0x1d0/0x7d0 [ 489.613529][T24265] ? __local_bh_enable_ip+0xd0/0x130 [ 489.613554][T24265] __alloc_skb+0x1d0/0x7d0 [ 489.613576][T24265] ? netlink_ack_tlv_len+0x6c/0x210 [ 489.613602][T24265] netlink_ack+0x146/0xa50 [ 489.613623][T24265] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 489.613644][T24265] ? ref_tracker_free+0x693/0x840 [ 489.613664][T24265] ? __pfx_ref_tracker_free+0x10/0x10 [ 489.613691][T24265] netlink_rcv_skb+0x2b6/0x4b0 [ 489.613715][T24265] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 489.613739][T24265] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 489.613774][T24265] ? netlink_deliver_tap+0x2e/0x1b0 [ 489.613796][T24265] ? netlink_deliver_tap+0x2e/0x1b0 [ 489.613824][T24265] netlink_unicast+0x75c/0x8e0 [ 489.613853][T24265] netlink_sendmsg+0x813/0xb40 [ 489.613883][T24265] ? __pfx_netlink_sendmsg+0x10/0x10 [ 489.613908][T24265] ? aa_sock_msg_perm+0xf1/0x1b0 [ 489.613926][T24265] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 489.613950][T24265] ____sys_sendmsg+0x972/0x9f0 [ 489.613981][T24265] ? __pfx_____sys_sendmsg+0x10/0x10 [ 489.614014][T24265] ? import_iovec+0x73/0xa0 [ 489.614035][T24265] ___sys_sendmsg+0x2a5/0x360 [ 489.614064][T24265] ? __pfx____sys_sendmsg+0x10/0x10 [ 489.614119][T24265] ? __fget_files+0x2a/0x420 [ 489.614134][T24265] ? __fget_files+0x3a0/0x420 [ 489.614160][T24265] __x64_sys_sendmsg+0x1bd/0x2a0 [ 489.614188][T24265] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 489.614222][T24265] ? __pfx_ksys_write+0x10/0x10 [ 489.614257][T24265] do_syscall_64+0x14d/0xf80 [ 489.614278][T24265] ? trace_irq_disable+0x3b/0x150 [ 489.614293][T24265] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 489.614311][T24265] ? clear_bhb_loop+0x40/0x90 [ 489.614336][T24265] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 489.614354][T24265] RIP: 0033:0x7f5acdb9c819 [ 489.614372][T24265] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 489.614387][T24265] RSP: 002b:00007f5acea17028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 489.614406][T24265] RAX: ffffffffffffffda RBX: 00007f5acde16090 RCX: 00007f5acdb9c819 [ 489.614418][T24265] RDX: 0000000020004804 RSI: 0000200000000000 RDI: 0000000000000008 [ 489.614430][T24265] RBP: 00007f5acea17090 R08: 0000000000000000 R09: 0000000000000000 [ 489.614441][T24265] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 489.614452][T24265] R13: 00007f5acde16128 R14: 00007f5acde16090 R15: 00007ffef0d53d48 [ 489.614479][T24265] [ 489.951361][T24271] ip6erspan0: entered allmulticast mode [ 490.177702][T24283] netlink: 24 bytes leftover after parsing attributes in process `syz.1.4747'. [ 490.188731][T24294] bond0: (slave veth0_macvtap): Error: Device is in use and cannot be enslaved [ 490.213671][T24283] netlink: 11 bytes leftover after parsing attributes in process `syz.1.4747'. [ 490.306868][T24283] netlink: 184 bytes leftover after parsing attributes in process `syz.1.4747'. [ 490.424261][T24309] xt_CT: You must specify a L4 protocol and not use inversions on it [ 490.770961][T24333] FAULT_INJECTION: forcing a failure. [ 490.770961][T24333] name failslab, interval 1, probability 0, space 0, times 0 [ 490.844491][T24333] CPU: 0 UID: 0 PID: 24333 Comm: syz.4.4757 Not tainted syzkaller #0 PREEMPT(full) [ 490.844521][T24333] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 490.844531][T24333] Call Trace: [ 490.844538][T24333] [ 490.844546][T24333] dump_stack_lvl+0xe8/0x150 [ 490.844576][T24333] should_fail_ex+0x412/0x560 [ 490.844606][T24333] should_failslab+0xa8/0x100 [ 490.844631][T24333] __kmalloc_cache_noprof+0x88/0x660 [ 490.844654][T24333] ? tcf_proto_create+0x65/0x330 [ 490.844678][T24333] tcf_proto_create+0x65/0x330 [ 490.844700][T24333] tc_new_tfilter+0x12ff/0x1780 [ 490.844741][T24333] ? __pfx_tc_new_tfilter+0x10/0x10 [ 490.844791][T24333] ? __pfx_tc_new_tfilter+0x10/0x10 [ 490.844808][T24333] rtnetlink_rcv_msg+0x7d5/0xbe0 [ 490.844835][T24333] ? rtnetlink_rcv_msg+0x1b9/0xbe0 [ 490.844856][T24333] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 490.844877][T24333] ? ref_tracker_free+0x693/0x840 [ 490.844899][T24333] ? __pfx_ref_tracker_free+0x10/0x10 [ 490.844926][T24333] netlink_rcv_skb+0x232/0x4b0 [ 490.844952][T24333] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 490.844975][T24333] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 490.845012][T24333] ? netlink_deliver_tap+0x2e/0x1b0 [ 490.845035][T24333] ? netlink_deliver_tap+0x2e/0x1b0 [ 490.845065][T24333] netlink_unicast+0x75c/0x8e0 [ 490.845098][T24333] netlink_sendmsg+0x813/0xb40 [ 490.845131][T24333] ? __pfx_netlink_sendmsg+0x10/0x10 [ 490.845159][T24333] ? aa_sock_msg_perm+0xf1/0x1b0 [ 490.845179][T24333] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 490.845203][T24333] ____sys_sendmsg+0x972/0x9f0 [ 490.845237][T24333] ? __pfx_____sys_sendmsg+0x10/0x10 [ 490.845270][T24333] ? import_iovec+0x73/0xa0 [ 490.845294][T24333] ___sys_sendmsg+0x2a5/0x360 [ 490.845325][T24333] ? __pfx____sys_sendmsg+0x10/0x10 [ 490.845385][T24333] ? __fget_files+0x2a/0x420 [ 490.845401][T24333] ? __fget_files+0x3a0/0x420 [ 490.845427][T24333] __x64_sys_sendmsg+0x1bd/0x2a0 [ 490.845455][T24333] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 490.845497][T24333] ? __pfx_ksys_write+0x10/0x10 [ 490.845529][T24333] do_syscall_64+0x14d/0xf80 [ 490.845549][T24333] ? trace_irq_disable+0x3b/0x150 [ 490.845565][T24333] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 490.845583][T24333] ? clear_bhb_loop+0x40/0x90 [ 490.845605][T24333] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 490.845623][T24333] RIP: 0033:0x7fc0b719c819 [ 490.845640][T24333] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 490.845655][T24333] RSP: 002b:00007fc0b8092028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 490.845675][T24333] RAX: ffffffffffffffda RBX: 00007fc0b7415fa0 RCX: 00007fc0b719c819 [ 490.845687][T24333] RDX: 0000000020004804 RSI: 0000200000000000 RDI: 0000000000000008 [ 490.845699][T24333] RBP: 00007fc0b8092090 R08: 0000000000000000 R09: 0000000000000000 [ 490.845710][T24333] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 490.845720][T24333] R13: 00007fc0b7416038 R14: 00007fc0b7415fa0 R15: 00007ffdfe0b0238 [ 490.845750][T24333] [ 491.449885][ T797] IPVS: starting estimator thread 0... [ 491.467851][T24349] geneve3: entered promiscuous mode [ 491.474136][T24351] netlink: 87 bytes leftover after parsing attributes in process `syz.3.4760'. [ 491.539555][T24354] IPVS: using max 38 ests per chain, 91200 per kthread [ 491.597784][T24351] tipc: Resetting bearer [ 491.761447][T24369] x_tables: ip6_tables: policy.0 match: invalid size 312 (kernel) != (user) 8 [ 491.855038][T24371] lo speed is unknown, defaulting to 1000 [ 491.976495][T24373] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 491.994374][T24368] lo speed is unknown, defaulting to 1000 [ 492.003532][T24373] netlink: 'syz.2.4764': attribute type 1 has an invalid length. [ 492.012151][T24373] netlink: 96 bytes leftover after parsing attributes in process `syz.2.4764'. [ 492.030979][T24373] netlink: 'syz.2.4764': attribute type 1 has an invalid length. [ 492.043656][T24381] netlink: 20 bytes leftover after parsing attributes in process `syz.1.4762'. [ 492.055546][T24373] netlink: 'syz.2.4764': attribute type 8 has an invalid length. [ 492.059409][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 492.069583][T24378] netlink: 'syz.2.4764': attribute type 10 has an invalid length. [ 492.071529][ C0] lec:lec_tx_timeout: lec0 [ 492.084063][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 492.382547][T24373] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 492.655112][T24399] FAULT_INJECTION: forcing a failure. [ 492.655112][T24399] name failslab, interval 1, probability 0, space 0, times 0 [ 492.668914][T24399] CPU: 0 UID: 0 PID: 24399 Comm: syz.4.4768 Not tainted syzkaller #0 PREEMPT(full) [ 492.668939][T24399] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 492.668950][T24399] Call Trace: [ 492.668957][T24399] [ 492.668964][T24399] dump_stack_lvl+0xe8/0x150 [ 492.669014][T24399] should_fail_ex+0x412/0x560 [ 492.669044][T24399] should_failslab+0xa8/0x100 [ 492.669071][T24399] __kmalloc_cache_noprof+0x88/0x660 [ 492.669093][T24399] ? cls_bpf_change+0x269/0xd90 [ 492.669123][T24399] cls_bpf_change+0x269/0xd90 [ 492.669147][T24399] ? __pfx___mutex_lock+0x10/0x10 [ 492.669180][T24399] ? __pfx_cls_bpf_change+0x10/0x10 [ 492.669226][T24399] tc_new_tfilter+0xff8/0x1780 [ 492.669270][T24399] ? __pfx_tc_new_tfilter+0x10/0x10 [ 492.669322][T24399] ? __pfx_tc_new_tfilter+0x10/0x10 [ 492.669338][T24399] rtnetlink_rcv_msg+0x7d5/0xbe0 [ 492.669363][T24399] ? rtnetlink_rcv_msg+0x1b9/0xbe0 [ 492.669384][T24399] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 492.669403][T24399] ? ref_tracker_free+0x693/0x840 [ 492.669424][T24399] ? __pfx_ref_tracker_free+0x10/0x10 [ 492.669452][T24399] netlink_rcv_skb+0x232/0x4b0 [ 492.669477][T24399] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 492.669501][T24399] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 492.669537][T24399] ? netlink_deliver_tap+0x2e/0x1b0 [ 492.669561][T24399] ? netlink_deliver_tap+0x2e/0x1b0 [ 492.669590][T24399] netlink_unicast+0x75c/0x8e0 [ 492.669622][T24399] netlink_sendmsg+0x813/0xb40 [ 492.669656][T24399] ? __pfx_netlink_sendmsg+0x10/0x10 [ 492.669683][T24399] ? aa_sock_msg_perm+0xf1/0x1b0 [ 492.669702][T24399] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 492.669726][T24399] ____sys_sendmsg+0x972/0x9f0 [ 492.669761][T24399] ? __pfx_____sys_sendmsg+0x10/0x10 [ 492.669796][T24399] ? import_iovec+0x73/0xa0 [ 492.669819][T24399] ___sys_sendmsg+0x2a5/0x360 [ 492.669857][T24399] ? __pfx____sys_sendmsg+0x10/0x10 [ 492.669915][T24399] ? __fget_files+0x2a/0x420 [ 492.669930][T24399] ? __fget_files+0x3a0/0x420 [ 492.669953][T24399] __x64_sys_sendmsg+0x1bd/0x2a0 [ 492.669980][T24399] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 492.670020][T24399] ? __pfx_ksys_write+0x10/0x10 [ 492.670053][T24399] do_syscall_64+0x14d/0xf80 [ 492.670074][T24399] ? trace_irq_disable+0x3b/0x150 [ 492.670089][T24399] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 492.670107][T24399] ? clear_bhb_loop+0x40/0x90 [ 492.670129][T24399] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 492.670147][T24399] RIP: 0033:0x7fc0b719c819 [ 492.670164][T24399] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 492.670179][T24399] RSP: 002b:00007fc0b8092028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 492.670204][T24399] RAX: ffffffffffffffda RBX: 00007fc0b7415fa0 RCX: 00007fc0b719c819 [ 492.670217][T24399] RDX: 0000000020004804 RSI: 0000200000000000 RDI: 0000000000000008 [ 492.670228][T24399] RBP: 00007fc0b8092090 R08: 0000000000000000 R09: 0000000000000000 [ 492.670239][T24399] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 492.670250][T24399] R13: 00007fc0b7416038 R14: 00007fc0b7415fa0 R15: 00007ffdfe0b0238 [ 492.670279][T24399] [ 494.022336][T24457] net_ratelimit: 338 callbacks suppressed [ 494.022357][T24457] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 494.409186][ T9438] netdevsim netdevsim0 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 494.421242][ T9438] netdevsim netdevsim0 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 494.506341][T24479] openvswitch: netlink: Unexpected mask (mask=201040, allowed=10048) [ 494.526187][T24479] __nla_validate_parse: 8 callbacks suppressed [ 494.526205][T24479] netlink: 48 bytes leftover after parsing attributes in process `syz.0.4791'. [ 494.543835][ T9438] netdevsim netdevsim0 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 494.563200][T24481] netlink: 72 bytes leftover after parsing attributes in process `syz.2.4792'. [ 494.571200][ T9438] netdevsim netdevsim0 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 494.643913][T24482] infiniband syz0: RDMA CMA: cma_listen_on_dev, error -98 [ 495.314833][T24513] netlink: 48 bytes leftover after parsing attributes in process `syz.4.4803'. [ 495.606385][T24517] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4804'. [ 495.997697][T24534] netlink: 56 bytes leftover after parsing attributes in process `syz.0.4810'. [ 496.015863][T24536] netlink: 'syz.4.4811': attribute type 1 has an invalid length. [ 496.058581][T24536] 8021q: adding VLAN 0 to HW filter on device bond9 [ 496.101076][T24536] vlan3: entered promiscuous mode [ 496.119430][T24536] bond9: entered promiscuous mode [ 496.150051][T24536] vlan3: entered allmulticast mode [ 496.167112][T24536] bond9: entered allmulticast mode [ 496.247254][T24544] bond9: (slave bridge6): making interface the new active one [ 496.268608][T24544] bridge6: entered promiscuous mode [ 496.293149][T24544] bridge6: entered allmulticast mode [ 496.307734][T24544] bond9: (slave bridge6): Enslaving as an active interface with an up link [ 496.484669][T24555] openvswitch: netlink: IP tunnel dst address not specified [ 497.223772][T24567] netlink: 252 bytes leftover after parsing attributes in process `syz.2.4820'. [ 497.365517][T24570] mac80211_hwsim hwsim56 syzkaller0: entered promiscuous mode [ 497.384751][T24570] mac80211_hwsim hwsim56 syzkaller0: entered allmulticast mode [ 497.507277][T24572] netlink: 65173 bytes leftover after parsing attributes in process `syz.2.4822'. [ 497.542039][T24572] netlink: 'syz.2.4822': attribute type 1 has an invalid length. [ 497.859376][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5770 ms [ 497.867525][ C0] lec:lec_tx_timeout: lec0 [ 497.873494][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 498.226253][T24596] netlink: 16 bytes leftover after parsing attributes in process `syz.1.4831'. [ 498.966535][T24538] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 499.486348][T24628] netlink: 'syz.1.4846': attribute type 1 has an invalid length. [ 499.805770][T24644] lo speed is unknown, defaulting to 1000 [ 499.824249][T24649] netlink: 'syz.3.4851': attribute type 4 has an invalid length. [ 499.909162][ T7386] lo speed is unknown, defaulting to 1000 [ 499.966363][ T7386] syz2: Port: 1 Link DOWN [ 501.436691][T24705] netlink: 28 bytes leftover after parsing attributes in process `syz.2.4878'. [ 501.461536][T24709] tap0: tun_chr_ioctl cmd 2148553947 [ 501.487689][T24709] tap0: tun_chr_ioctl cmd 35111 [ 501.489474][T24705] netlink: 36 bytes leftover after parsing attributes in process `syz.2.4878'. [ 501.534880][T24705] vlan0: entered promiscuous mode [ 501.737008][T24691] bridge_slave_0: left allmulticast mode [ 501.769784][T24691] bridge_slave_0: left promiscuous mode [ 501.786698][T24691] bridge0: port 1(bridge_slave_0) entered disabled state [ 501.798919][T24691] bridge_slave_1: left allmulticast mode [ 501.812264][T24691] bridge_slave_1: left promiscuous mode [ 501.818697][T24691] bridge0: port 2(bridge_slave_1) entered disabled state [ 501.836221][T24691] team0: Port device team_slave_0 removed [ 501.844685][T24691] team0: Port device team_slave_1 removed [ 501.851820][T24691] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 501.860537][T24691] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 501.879643][T24722] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 501.932014][T24720] team0: No ports can be present during mode change [ 502.253103][T24755] netlink: 24 bytes leftover after parsing attributes in process `syz.2.4898'. [ 502.649708][T24784] ip6erspan0: entered allmulticast mode [ 502.899422][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5020 ms [ 502.907457][ C0] lec:lec_tx_timeout: lec0 [ 502.913002][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 503.103015][T24808] veth1_to_bond: left allmulticast mode [ 503.108966][T24808] A link change request failed with some changes committed already. Interface veth1_to_bond may have been left with an inconsistent configuration, please check. [ 504.166950][T24865] netlink: 24 bytes leftover after parsing attributes in process `syz.2.4946'. [ 507.320780][T25054] netlink: 220 bytes leftover after parsing attributes in process `syz.3.5034'. [ 507.384772][T25057] netlink: 'syz.0.5036': attribute type 3 has an invalid length. [ 507.413115][T25057] netlink: 'syz.0.5036': attribute type 1 has an invalid length. [ 507.456589][T25057] netlink: 232 bytes leftover after parsing attributes in process `syz.0.5036'. [ 507.513133][T25066] netlink: 4 bytes leftover after parsing attributes in process `syz.4.5037'. [ 507.576682][T25066] syz_tun (unregistering): left allmulticast mode [ 507.729989][T25066] bond6: (slave syz_tun): Removing an active aggregator [ 507.751503][T25066] bond6: (slave syz_tun): Releasing backup interface [ 507.919414][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 507.927632][ C0] lec:lec_tx_timeout: lec0 [ 507.933449][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 508.168991][T25104] Unknown options in mask 6 [ 508.318822][T25112] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5051'. [ 508.368959][T25115] netlink: 24 bytes leftover after parsing attributes in process `syz.0.5050'. [ 508.391326][T25117] xt_ipcomp: unknown flags 1D [ 508.608950][T25131] team_slave_1: Caught tx_queue_len zero misconfig [ 508.668225][ T5826] Bluetooth: hci3: command 0x0406 tx timeout [ 508.717078][T25136] mac80211_hwsim hwsim58 syzkaller0: entered promiscuous mode [ 508.726032][T25136] mac80211_hwsim hwsim58 syzkaller0: entered allmulticast mode [ 508.990857][T25142] team0: Failed to send options change via netlink (err -105) [ 508.999207][T25142] team0: Failed to send port change of device team_slave_0 via netlink (err -105) [ 509.005650][T25146] xt_l2tp: missing protocol rule (udp|l2tpip) [ 509.010139][T25142] team0: Port device team_slave_0 removed [ 509.017565][T25146] netlink: 20 bytes leftover after parsing attributes in process `syz.3.5064'. [ 509.032277][T25146] netlink: 12 bytes leftover after parsing attributes in process `syz.3.5064'. [ 509.231215][T25149] lo speed is unknown, defaulting to 1000 [ 509.350616][T25159] delete_channel: no stack [ 509.720958][T25173] bridge_slave_0: invalid flags given to default FDB implementation [ 510.055546][T25186] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 510.219464][T25194] netlink: 4 bytes leftover after parsing attributes in process `syz.3.5079'. [ 510.248554][T25196] netlink: 384 bytes leftover after parsing attributes in process `syz.3.5079'. [ 510.269246][T25198] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5080'. [ 511.492578][T25278] netlink: 'syz.2.5104': attribute type 1 has an invalid length. [ 512.154688][T25318] netlink: 'syz.3.5118': attribute type 1 has an invalid length. [ 512.820511][T25352] __nla_validate_parse: 8 callbacks suppressed [ 512.820527][T25352] netlink: 48 bytes leftover after parsing attributes in process `syz.3.5129'. [ 512.949400][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 512.957576][ C0] lec:lec_tx_timeout: lec0 [ 512.962661][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 513.012347][T25365] netlink: 'syz.0.5127': attribute type 1 has an invalid length. [ 513.117370][T25365] bond6: entered promiscuous mode [ 513.126991][T25372] netlink: 12 bytes leftover after parsing attributes in process `syz.1.5134'. [ 513.140794][T25365] bond6: entered allmulticast mode [ 513.146366][T25365] 8021q: adding VLAN 0 to HW filter on device bond6 [ 513.185701][T25375] netlink: 24 bytes leftover after parsing attributes in process `syz.3.5136'. [ 513.213089][T25370] macvlan2: entered promiscuous mode [ 513.218911][T25370] macvlan2: entered allmulticast mode [ 513.240776][T25370] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 513.460745][T25384] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5140'. [ 513.559788][T25384] bond8: Invalid ad_actor_system MAC address. [ 513.566886][T25384] bond8: option ad_actor_system: invalid value (7) [ 513.659285][T25384] bond8 (unregistering): Released all slaves [ 513.754604][T25391] syzkaller1: entered promiscuous mode [ 513.780452][T25391] syzkaller1: entered allmulticast mode [ 514.098898][T25410] xt_l2tp: v2 sid > 0xffff: 4294967293 [ 514.737758][T25441] lo speed is unknown, defaulting to 1000 [ 515.482091][T25471] veth9: entered promiscuous mode [ 515.488733][T25471] veth9: entered allmulticast mode [ 516.003167][T25513] sctp: [Deprecated]: syz.1.5180 (pid 25513) Use of struct sctp_assoc_value in delayed_ack socket option. [ 516.003167][T25513] Use struct sctp_sack_info instead [ 516.175420][T25525] netlink: 'syz.1.5184': attribute type 1 has an invalid length. [ 516.213950][T25525] netlink: 'syz.1.5184': attribute type 1 has an invalid length. [ 516.247598][T25525] netlink: 9172 bytes leftover after parsing attributes in process `syz.1.5184'. [ 516.294890][T25533] netlink: 4 bytes leftover after parsing attributes in process `syz.4.5185'. [ 516.493615][T25540] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5188'. [ 516.518326][T25543] netlink: 36 bytes leftover after parsing attributes in process `syz.4.5189'. [ 516.519499][T25540] A link change request failed with some changes committed already. Interface team0 may have been left with an inconsistent configuration, please check. [ 516.846614][T25561] netlink: 'syz.4.5195': attribute type 1 has an invalid length. [ 516.885596][T25562] netlink: 28 bytes leftover after parsing attributes in process `syz.2.5196'. [ 516.916772][T25561] bond11: entered promiscuous mode [ 516.948742][T25561] 8021q: adding VLAN 0 to HW filter on device bond11 [ 517.155767][T25584] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5199'. [ 517.969479][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 517.977581][ C0] lec:lec_tx_timeout: lec0 [ 517.982267][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 518.087626][T25624] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5211'. [ 518.484503][T25630] netlink: 'syz.1.5213': attribute type 61 has an invalid length. [ 518.509957][T25630] netlink: 16 bytes leftover after parsing attributes in process `syz.1.5213'. [ 518.764817][T25638] bond12: Removing last ns target with arp_interval on [ 518.867319][T25646] netlink: 'syz.4.5219': attribute type 2 has an invalid length. [ 518.915577][T25646] : entered promiscuous mode [ 519.130410][T25666] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5225'. [ 519.144023][T25667] netlink: 'syz.3.5224': attribute type 4 has an invalid length. [ 519.159578][T25667] netlink: 17 bytes leftover after parsing attributes in process `syz.3.5224'. [ 519.184302][T25672] netlink: 277 bytes leftover after parsing attributes in process `syz.2.5225'. [ 519.254265][T25666] netlink: 64 bytes leftover after parsing attributes in process `syz.2.5225'. [ 519.265431][T25667] xt_TPROXY: Can be used only with -p tcp or -p udp [ 519.311068][T25667] netlink: 212368 bytes leftover after parsing attributes in process `syz.3.5224'. [ 519.329835][T25666] bond8: (slave vcan0): refused to change device type [ 519.349817][T25680] netlink: 'syz.1.5228': attribute type 2 has an invalid length. [ 519.394728][T25680] netlink: 'syz.1.5228': attribute type 11 has an invalid length. [ 519.415533][T25680] netlink: 132 bytes leftover after parsing attributes in process `syz.1.5228'. [ 519.504397][T25687] FAULT_INJECTION: forcing a failure. [ 519.504397][T25687] name failslab, interval 1, probability 0, space 0, times 0 [ 519.557300][T25693] mac80211_hwsim hwsim56 syzkaller0: left promiscuous mode [ 519.578772][T25693] mac80211_hwsim hwsim56 syzkaller0: left allmulticast mode [ 519.579356][T25687] CPU: 1 UID: 0 PID: 25687 Comm: syz.3.5231 Not tainted syzkaller #0 PREEMPT(full) [ 519.579379][T25687] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 519.579389][T25687] Call Trace: [ 519.579396][T25687] [ 519.579404][T25687] dump_stack_lvl+0xe8/0x150 [ 519.579435][T25687] should_fail_ex+0x412/0x560 [ 519.579466][T25687] should_failslab+0xa8/0x100 [ 519.579488][T25687] ? skb_clone+0x212/0x3a0 [ 519.579504][T25687] kmem_cache_alloc_noprof+0x87/0x650 [ 519.579524][T25687] ? __netlink_lookup+0xc6/0x8b0 [ 519.579555][T25687] skb_clone+0x212/0x3a0 [ 519.579575][T25687] __netlink_deliver_tap+0x404/0x850 [ 519.579608][T25687] ? netlink_deliver_tap+0x2e/0x1b0 [ 519.579632][T25687] netlink_deliver_tap+0x19c/0x1b0 [ 519.579657][T25687] netlink_unicast+0x730/0x8e0 [ 519.579688][T25687] netlink_sendmsg+0x813/0xb40 [ 519.579720][T25687] ? __pfx_netlink_sendmsg+0x10/0x10 [ 519.579746][T25687] ? aa_sock_msg_perm+0xf1/0x1b0 [ 519.579765][T25687] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 519.579789][T25687] ____sys_sendmsg+0x972/0x9f0 [ 519.579822][T25687] ? __pfx_____sys_sendmsg+0x10/0x10 [ 519.579855][T25687] ? import_iovec+0x73/0xa0 [ 519.579879][T25687] ___sys_sendmsg+0x2a5/0x360 [ 519.579909][T25687] ? __pfx____sys_sendmsg+0x10/0x10 [ 519.579965][T25687] ? __fget_files+0x2a/0x420 [ 519.579980][T25687] ? __fget_files+0x3a0/0x420 [ 519.580006][T25687] __x64_sys_sendmsg+0x1bd/0x2a0 [ 519.580033][T25687] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 519.580066][T25687] ? __pfx_ksys_write+0x10/0x10 [ 519.580097][T25687] do_syscall_64+0x14d/0xf80 [ 519.580123][T25687] ? trace_irq_disable+0x3b/0x150 [ 519.580138][T25687] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 519.580155][T25687] ? clear_bhb_loop+0x40/0x90 [ 519.580176][T25687] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 519.580193][T25687] RIP: 0033:0x7f960619c819 [ 519.580210][T25687] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 519.580225][T25687] RSP: 002b:00007f96043f6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 519.580244][T25687] RAX: ffffffffffffffda RBX: 00007f9606415fa0 RCX: 00007f960619c819 [ 519.580255][T25687] RDX: 0000000024040090 RSI: 0000200000000080 RDI: 0000000000000003 [ 519.580267][T25687] RBP: 00007f96043f6090 R08: 0000000000000000 R09: 0000000000000000 [ 519.580277][T25687] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 519.580287][T25687] R13: 00007f9606416038 R14: 00007f9606415fa0 R15: 00007ffebd1b5868 [ 519.580315][T25687] [ 520.264653][T25722] netlink: 60 bytes leftover after parsing attributes in process `syz.2.5241'. [ 520.274082][T25722] netlink: 35 bytes leftover after parsing attributes in process `syz.2.5241'. [ 520.498557][T25724] lo speed is unknown, defaulting to 1000 [ 520.986188][T25753] syz.1.5254 (25753) used obsolete PPPIOCDETACH ioctl [ 521.091827][T25757] netlink: 'syz.4.5256': attribute type 1 has an invalid length. [ 521.416765][T25789] sctp: [Deprecated]: syz.4.5264 (pid 25789) Use of int in maxseg socket option. [ 521.416765][T25789] Use struct sctp_assoc_value instead [ 521.466141][T25784] lo speed is unknown, defaulting to 1000 [ 521.554175][T25794] netlink: 'syz.1.5268': attribute type 4 has an invalid length. [ 522.042360][T25833] "syz.3.5279" (25833) uses obsolete ecb(arc4) skcipher [ 522.365662][T25864] FAULT_INJECTION: forcing a failure. [ 522.365662][T25864] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 522.443086][T25864] CPU: 1 UID: 0 PID: 25864 Comm: syz.3.5285 Not tainted syzkaller #0 PREEMPT(full) [ 522.443114][T25864] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 522.443125][T25864] Call Trace: [ 522.443132][T25864] [ 522.443141][T25864] dump_stack_lvl+0xe8/0x150 [ 522.443170][T25864] should_fail_ex+0x412/0x560 [ 522.443201][T25864] _copy_from_iter+0x1d3/0x1670 [ 522.443220][T25864] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 522.443248][T25864] ? __pfx_policy_nodemask+0x10/0x10 [ 522.443273][T25864] ? __pfx__copy_from_iter+0x10/0x10 [ 522.443298][T25864] ? set_page_refcounted+0xa0/0x1e0 [ 522.443320][T25864] ? page_copy_sane+0x4e/0x270 [ 522.443340][T25864] copy_page_from_iter+0xdd/0x170 [ 522.443362][T25864] tun_get_user+0x1db3/0x3ed0 [ 522.443384][T25864] ? tun_get_user+0x6ff/0x3ed0 [ 522.443420][T25864] ? aa_file_perm+0x50e/0x15e0 [ 522.443439][T25864] ? __pfx_tun_get_user+0x10/0x10 [ 522.443457][T25864] ? aa_file_perm+0x192/0x15e0 [ 522.443493][T25864] ? ref_tracker_alloc+0x35c/0x4c0 [ 522.443513][T25864] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 522.443537][T25864] ? tun_get+0x1c/0x2f0 [ 522.443562][T25864] ? tun_get+0x1c/0x2f0 [ 522.443580][T25864] ? tun_get+0x1c/0x2f0 [ 522.443604][T25864] tun_chr_write_iter+0x113/0x200 [ 522.443628][T25864] vfs_write+0x61d/0xb90 [ 522.443656][T25864] ? __pfx_vfs_write+0x10/0x10 [ 522.443685][T25864] ? __fget_files+0x2a/0x420 [ 522.443710][T25864] ksys_write+0x150/0x270 [ 522.443732][T25864] ? __pfx_ksys_write+0x10/0x10 [ 522.443762][T25864] do_syscall_64+0x14d/0xf80 [ 522.443782][T25864] ? trace_irq_disable+0x3b/0x150 [ 522.443797][T25864] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 522.443816][T25864] ? clear_bhb_loop+0x40/0x90 [ 522.443836][T25864] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 522.443854][T25864] RIP: 0033:0x7f960615d04e [ 522.443871][T25864] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 522.443886][T25864] RSP: 002b:00007f96043f5fb8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 522.443915][T25864] RAX: ffffffffffffffda RBX: 00007f96043f66c0 RCX: 00007f960615d04e [ 522.443928][T25864] RDX: 0000000000000036 RSI: 0000200000000140 RDI: 00000000000000c8 [ 522.443940][T25864] RBP: 00007f96043f6090 R08: 0000000000000000 R09: 0000000000000000 [ 522.443951][T25864] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 522.443961][T25864] R13: 00007f9606416038 R14: 00007f9606415fa0 R15: 00007ffebd1b5868 [ 522.443990][T25864] [ 522.757242][T25868] lo speed is unknown, defaulting to 1000 [ 522.989403][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 522.998113][ C0] lec:lec_tx_timeout: lec0 [ 523.003085][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 523.095725][T25890] __nla_validate_parse: 7 callbacks suppressed [ 523.095746][T25890] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5295'. [ 523.288899][T25903] netlink: 'syz.1.5298': attribute type 2 has an invalid length. [ 523.291225][T25899] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5295'. [ 523.316631][T25889] bridge0: port 2(bridge_slave_1) entered disabled state [ 523.431323][T25889] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 523.516758][T25889] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 523.885604][T25903] l2: entered promiscuous mode [ 523.891530][T22842] netdevsim netdevsim2 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 523.912247][T22842] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 523.937872][T22842] netdevsim netdevsim2 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 523.948301][T22842] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 524.098251][T22842] netdevsim netdevsim2 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 524.118376][T22842] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 524.131383][T22842] netdevsim netdevsim2 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 524.166816][T22842] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 524.311753][T25935] netlink: 12 bytes leftover after parsing attributes in process `syz.4.5308'. [ 524.321996][T25931] netlink: 36 bytes leftover after parsing attributes in process `syz.3.5306'. [ 524.323648][T25930] netlink: 132 bytes leftover after parsing attributes in process `syz.3.5306'. [ 524.340644][T25935] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5308'. [ 524.350018][T25931] netlink: 36 bytes leftover after parsing attributes in process `syz.3.5306'. [ 524.384424][T25936] netlink: 36 bytes leftover after parsing attributes in process `syz.2.5307'. [ 524.677792][T25950] netlink: 'syz.3.5312': attribute type 1 has an invalid length. [ 524.768792][T25950] 8021q: adding VLAN 0 to HW filter on device bond2 [ 524.926953][T25970] netlink: 272 bytes leftover after parsing attributes in process `syz.2.5316'. [ 525.102010][T25987] netlink: 'syz.2.5322': attribute type 1 has an invalid length. [ 525.181027][T25987] 8021q: adding VLAN 0 to HW filter on device bond9 [ 525.193582][T25987] netlink: 28 bytes leftover after parsing attributes in process `syz.2.5322'. [ 526.372843][T26055] hsr_slave_0: left promiscuous mode [ 526.385450][T26055] hsr_slave_1: left promiscuous mode [ 526.398012][T26055] hsr0 (unregistering): left allmulticast mode [ 526.404940][T26055] hsr0 (unregistering): left promiscuous mode [ 526.411556][T26055] bridge0: port 3(hsr0) entered disabled state [ 526.670357][T26066] syzkaller1: entered promiscuous mode [ 526.676041][T26066] syzkaller1: entered allmulticast mode [ 527.137263][T26083] xt_hashlimit: size too large, truncated to 1048576 [ 527.214370][T26091] netlink: 'syz.0.5351': attribute type 1 has an invalid length. [ 528.009391][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 528.017590][ C0] lec:lec_tx_timeout: lec0 [ 528.023415][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 528.255560][T26156] netlink: 'syz.4.5363': attribute type 13 has an invalid length. [ 528.282645][T26156] netlink: 'syz.4.5363': attribute type 17 has an invalid length. [ 528.352699][T26150] bridge0: port 2(bridge_slave_1) entered disabled state [ 528.360335][T26150] bridge0: port 1(bridge_slave_0) entered disabled state [ 528.397203][T26150] team_slave_1: left promiscuous mode [ 528.567079][T26150] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 528.636453][T26150] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 528.821602][T26156] 8021q: adding VLAN 0 to HW filter on device team0 [ 528.833257][T26156] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 528.850977][T26156] netlink: 'syz.4.5363': attribute type 13 has an invalid length. [ 528.858993][ T5888] syz0: Port: 1 Link DOWN [ 528.863946][T26156] netlink: 'syz.4.5363': attribute type 17 has an invalid length. [ 528.872357][T26186] IPVS: sync thread started: state = BACKUP, mcast_ifn = hsr0, syncid = 786440, id = 0 [ 528.883593][T22827] netdevsim netdevsim4 eth0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 528.893490][T22827] netdevsim netdevsim4 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 528.902336][T22827] netdevsim netdevsim4 eth1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 528.911450][T22827] netdevsim netdevsim4 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 528.932002][T26156] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 528.951773][T22827] netdevsim netdevsim4 eth2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 528.960700][T26156] netlink: 'syz.4.5363': attribute type 13 has an invalid length. [ 528.968865][T22827] netdevsim netdevsim4 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 528.977874][T26156] netlink: 'syz.4.5363': attribute type 17 has an invalid length. [ 528.988053][T22827] netdevsim netdevsim4 eth3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 528.999222][T22827] netdevsim netdevsim4 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 529.016557][T26156] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 529.180966][T26195] __nla_validate_parse: 41 callbacks suppressed [ 529.180989][T26195] netlink: 24 bytes leftover after parsing attributes in process `syz.3.5375'. [ 529.256164][T26195] netlink: 32 bytes leftover after parsing attributes in process `syz.3.5375'. [ 529.404615][T26215] syzkaller1: entered promiscuous mode [ 529.414104][T26215] syzkaller1: entered allmulticast mode [ 529.528911][T26225] netlink: 64 bytes leftover after parsing attributes in process `syz.1.5387'. [ 529.538501][T26225] netlink: 64 bytes leftover after parsing attributes in process `syz.1.5387'. [ 529.716830][T26230] netlink: 108 bytes leftover after parsing attributes in process `syz.1.5388'. [ 529.751452][T26232] netlink: 32 bytes leftover after parsing attributes in process `syz.2.5389'. [ 529.968781][T26243] netlink: 76 bytes leftover after parsing attributes in process `syz.4.5390'. [ 529.981807][T26243] netlink: 76 bytes leftover after parsing attributes in process `syz.4.5390'. [ 530.623497][T26280] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5407'. [ 530.676750][T26297] netlink: 24 bytes leftover after parsing attributes in process `syz.2.5410'. [ 530.772594][T26304] netlink: 'syz.2.5410': attribute type 3 has an invalid length. [ 530.824584][T26304] netlink: 'syz.2.5410': attribute type 2 has an invalid length. [ 530.846942][T26304] netlink: 'syz.2.5410': attribute type 2 has an invalid length. [ 531.994756][T26349] netlink: 'syz.1.5428': attribute type 3 has an invalid length. [ 532.053589][T26348] batadv_slave_0: entered promiscuous mode [ 532.072727][T26348] batadv_slave_0: entered allmulticast mode [ 532.090527][T26347] lo speed is unknown, defaulting to 1000 [ 532.110197][T26358] netlink: 'syz.0.5429': attribute type 8 has an invalid length. [ 532.126702][T26351] lo speed is unknown, defaulting to 1000 [ 532.150343][T26358] bond0: entered promiscuous mode [ 532.166826][T26358] gretap0: entered promiscuous mode [ 532.173776][T26358] bond0: left promiscuous mode [ 532.188953][T26358] gretap0: left promiscuous mode [ 533.039390][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 533.047837][ C0] lec:lec_tx_timeout: lec0 [ 533.053100][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 533.428067][T26432] IPVS: Unknown mcast interface: vcan0 [ 533.787554][ T29] audit: type=1107 audit(1776251011.038:12): pid=26454 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa [ 533.965594][T26463] FAULT_INJECTION: forcing a failure. [ 533.965594][T26463] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 534.109567][T26463] CPU: 1 UID: 0 PID: 26463 Comm: syz.4.5470 Not tainted syzkaller #0 PREEMPT(full) [ 534.109593][T26463] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 534.109605][T26463] Call Trace: [ 534.109613][T26463] [ 534.109620][T26463] dump_stack_lvl+0xe8/0x150 [ 534.109651][T26463] should_fail_ex+0x412/0x560 [ 534.109682][T26463] _copy_to_user+0x31/0xb0 [ 534.109707][T26463] simple_read_from_buffer+0xe1/0x170 [ 534.109737][T26463] proc_fail_nth_read+0x1bb/0x230 [ 534.109766][T26463] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 534.109794][T26463] ? rw_verify_area+0x2a6/0x4d0 [ 534.109814][T26463] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 534.109841][T26463] vfs_read+0x20c/0xa70 [ 534.109859][T26463] ? fdget_pos+0x246/0x320 [ 534.109880][T26463] ? __pfx___mutex_lock+0x10/0x10 [ 534.109903][T26463] ? __pfx_vfs_read+0x10/0x10 [ 534.109923][T26463] ? __fget_files+0x2a/0x420 [ 534.109944][T26463] ? __fget_files+0x3a0/0x420 [ 534.109970][T26463] ? __fget_files+0x2a/0x420 [ 534.109996][T26463] ksys_read+0x150/0x270 [ 534.110018][T26463] ? __pfx_ksys_read+0x10/0x10 [ 534.110050][T26463] do_syscall_64+0x14d/0xf80 [ 534.110070][T26463] ? trace_irq_disable+0x3b/0x150 [ 534.110084][T26463] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 534.110101][T26463] ? clear_bhb_loop+0x40/0x90 [ 534.110123][T26463] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 534.110141][T26463] RIP: 0033:0x7fc0b715d04e [ 534.110158][T26463] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 534.110173][T26463] RSP: 002b:00007fc0b8091fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 534.110192][T26463] RAX: ffffffffffffffda RBX: 00007fc0b80926c0 RCX: 00007fc0b715d04e [ 534.110205][T26463] RDX: 000000000000000f RSI: 00007fc0b80920a0 RDI: 0000000000000005 [ 534.110216][T26463] RBP: 00007fc0b8092090 R08: 0000000000000000 R09: 0000000000000000 [ 534.110227][T26463] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 534.110238][T26463] R13: 00007fc0b7416038 R14: 00007fc0b7415fa0 R15: 00007ffdfe0b0238 [ 534.110268][T26463] [ 534.342549][T26466] netlink: 'syz.0.5471': attribute type 2 has an invalid length. [ 534.350476][T26466] netlink: 'syz.0.5471': attribute type 1 has an invalid length. [ 534.358465][T26466] __nla_validate_parse: 11 callbacks suppressed [ 534.358486][T26466] netlink: 152 bytes leftover after parsing attributes in process `syz.0.5471'. [ 534.430449][T26442] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5462'. [ 534.456163][T26470] netlink: 'syz.1.5472': attribute type 2 has an invalid length. [ 534.868184][T26493] No such timeout policy "syz1" [ 534.873641][T26489] No such timeout policy "syz1" [ 534.960894][T26498] delete_channel: no stack [ 535.050305][T26502] syzkaller1: entered promiscuous mode [ 535.064309][T26502] syzkaller1: entered allmulticast mode [ 535.210603][T26515] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 535.759126][T26537] netlink: 36 bytes leftover after parsing attributes in process `syz.1.5494'. [ 535.834257][T26545] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci1/hci1:200/input7 [ 536.044016][T26553] netlink: 'syz.4.5498': attribute type 25 has an invalid length. [ 536.052110][T26553] netlink: 'syz.4.5498': attribute type 1 has an invalid length. [ 536.119132][T26560] netlink: 12 bytes leftover after parsing attributes in process `syz.1.5500'. [ 536.181469][ T5826] block nbd2: Receive control failed (result -1) [ 536.255129][T26562] netlink: 156 bytes leftover after parsing attributes in process `syz.0.5502'. [ 536.545000][T26574] netlink: 64 bytes leftover after parsing attributes in process `syz.4.5504'. [ 536.651134][T26577] netlink: 'syz.2.5506': attribute type 61 has an invalid length. [ 536.852707][T26577] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 537.062717][T26591] lo speed is unknown, defaulting to 1000 [ 537.171372][T26603] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 537.199217][T26602] lo speed is unknown, defaulting to 1000 [ 537.477384][T26615] netlink: 'syz.4.5515': attribute type 1 has an invalid length. [ 537.544129][T26615] bond13: (slave vxcan3): The slave device specified does not support setting the MAC address [ 537.562428][T26615] bond13: (slave vxcan3): Error -95 calling set_mac_address [ 537.581447][T26623] netlink: 60 bytes leftover after parsing attributes in process `syz.4.5515'. [ 537.608718][T26623] netlink: 35 bytes leftover after parsing attributes in process `syz.4.5515'. [ 537.983497][T26629] bridge0: left promiscuous mode [ 537.991816][T26642] netlink: 'syz.2.5522': attribute type 83 has an invalid length. [ 538.024284][T26629] 8021q: adding VLAN 0 to HW filter on device bond0 [ 538.059366][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 538.067511][ C0] lec:lec_tx_timeout: lec0 [ 538.072146][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 538.085846][T26629] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 538.646980][T26665] bond14: entered promiscuous mode [ 538.652311][T26665] bond14: entered allmulticast mode [ 538.658543][T26665] 8021q: adding VLAN 0 to HW filter on device bond14 [ 538.717466][T26681] netlink: 24 bytes leftover after parsing attributes in process `syz.2.5534'. [ 538.906526][T26689] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5537'. [ 539.289196][T26720] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 539.381517][T26727] geneve1: Caught tx_queue_len zero misconfig [ 539.416520][T26727] netlink: 'syz.1.5551': attribute type 1 has an invalid length. [ 539.444724][T26727] netlink: 'syz.1.5551': attribute type 1 has an invalid length. [ 539.486837][T26727] __nla_validate_parse: 2 callbacks suppressed [ 539.486858][T26727] netlink: 84 bytes leftover after parsing attributes in process `syz.1.5551'. [ 539.550369][T26726] delete_channel: no stack [ 539.592082][T26734] lo speed is unknown, defaulting to 1000 [ 539.612636][T26739] netlink: 40 bytes leftover after parsing attributes in process `syz.4.5554'. [ 539.635033][T26715] netlink: 28 bytes leftover after parsing attributes in process `syz.0.5547'. [ 539.986883][T26755] FAULT_INJECTION: forcing a failure. [ 539.986883][T26755] name failslab, interval 1, probability 0, space 0, times 0 [ 540.000222][T26755] CPU: 0 UID: 0 PID: 26755 Comm: syz.2.5561 Not tainted syzkaller #0 PREEMPT(full) [ 540.000248][T26755] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 540.000258][T26755] Call Trace: [ 540.000265][T26755] [ 540.000272][T26755] dump_stack_lvl+0xe8/0x150 [ 540.000303][T26755] should_fail_ex+0x412/0x560 [ 540.000334][T26755] should_failslab+0xa8/0x100 [ 540.000358][T26755] kmem_cache_alloc_node_noprof+0x8f/0x690 [ 540.000379][T26755] ? __alloc_skb+0x186/0x7d0 [ 540.000401][T26755] ? __alloc_skb+0x1d0/0x7d0 [ 540.000421][T26755] ? __local_bh_enable_ip+0xd0/0x130 [ 540.000448][T26755] __alloc_skb+0x1d0/0x7d0 [ 540.000475][T26755] netlink_sendmsg+0x5d4/0xb40 [ 540.000508][T26755] ? __pfx_netlink_sendmsg+0x10/0x10 [ 540.000535][T26755] ? aa_sock_msg_perm+0xf1/0x1b0 [ 540.000554][T26755] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 540.000578][T26755] ____sys_sendmsg+0x972/0x9f0 [ 540.000617][T26755] ? __pfx_____sys_sendmsg+0x10/0x10 [ 540.000645][T26755] ? import_iovec+0x73/0xa0 [ 540.000666][T26755] ___sys_sendmsg+0x2a5/0x360 [ 540.000694][T26755] ? __pfx____sys_sendmsg+0x10/0x10 [ 540.000749][T26755] ? __fget_files+0x2a/0x420 [ 540.000765][T26755] ? __fget_files+0x3a0/0x420 [ 540.000790][T26755] __x64_sys_sendmsg+0x1bd/0x2a0 [ 540.000814][T26755] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 540.000845][T26755] ? __pfx_ksys_write+0x10/0x10 [ 540.000872][T26755] do_syscall_64+0x14d/0xf80 [ 540.000891][T26755] ? trace_irq_disable+0x3b/0x150 [ 540.000904][T26755] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 540.000920][T26755] ? clear_bhb_loop+0x40/0x90 [ 540.000940][T26755] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 540.000956][T26755] RIP: 0033:0x7f48dd39c819 [ 540.000971][T26755] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 540.000984][T26755] RSP: 002b:00007f48de342028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 540.001002][T26755] RAX: ffffffffffffffda RBX: 00007f48dd615fa0 RCX: 00007f48dd39c819 [ 540.001014][T26755] RDX: 0000000024044010 RSI: 0000200000000040 RDI: 0000000000000003 [ 540.001025][T26755] RBP: 00007f48de342090 R08: 0000000000000000 R09: 0000000000000000 [ 540.001035][T26755] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 540.001043][T26755] R13: 00007f48dd616038 R14: 00007f48dd615fa0 R15: 00007fff0fc66128 [ 540.001071][T26755] [ 540.504138][T26772] netlink: 24 bytes leftover after parsing attributes in process `syz.2.5566'. [ 540.538387][T26774] Cannot find add_set index 3 as target [ 540.687850][T26778] netlink: 'syz.3.5569': attribute type 5 has an invalid length. [ 541.030410][T26794] FAULT_INJECTION: forcing a failure. [ 541.030410][T26794] name failslab, interval 1, probability 0, space 0, times 0 [ 541.054857][T26794] CPU: 1 UID: 0 PID: 26794 Comm: syz.4.5575 Not tainted syzkaller #0 PREEMPT(full) [ 541.054884][T26794] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 541.054895][T26794] Call Trace: [ 541.054902][T26794] [ 541.054910][T26794] dump_stack_lvl+0xe8/0x150 [ 541.054942][T26794] should_fail_ex+0x412/0x560 [ 541.054973][T26794] should_failslab+0xa8/0x100 [ 541.054998][T26794] __kmalloc_noprof+0xe8/0x760 [ 541.055020][T26794] ? bpf_test_init+0x9f/0x150 [ 541.055041][T26794] ? kstrtouint+0x6e/0xe0 [ 541.055069][T26794] bpf_test_init+0x9f/0x150 [ 541.055096][T26794] bpf_prog_test_run_xdp+0x529/0x1160 [ 541.055134][T26794] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 541.055163][T26794] ? __fget_files+0x2a/0x420 [ 541.055185][T26794] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 541.055210][T26794] bpf_prog_test_run+0x2c7/0x340 [ 541.055233][T26794] __sys_bpf+0x643/0x950 [ 541.055252][T26794] ? __pfx___sys_bpf+0x10/0x10 [ 541.055284][T26794] ? ksys_write+0x242/0x270 [ 541.055306][T26794] ? __pfx_ksys_write+0x10/0x10 [ 541.055333][T26794] __x64_sys_bpf+0x7c/0x90 [ 541.055359][T26794] do_syscall_64+0x14d/0xf80 [ 541.055378][T26794] ? trace_irq_disable+0x3b/0x150 [ 541.055395][T26794] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 541.055413][T26794] ? clear_bhb_loop+0x40/0x90 [ 541.055434][T26794] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 541.055452][T26794] RIP: 0033:0x7fc0b719c819 [ 541.055470][T26794] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 541.055485][T26794] RSP: 002b:00007fc0b8092028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 541.055503][T26794] RAX: ffffffffffffffda RBX: 00007fc0b7415fa0 RCX: 00007fc0b719c819 [ 541.055516][T26794] RDX: 0000000000000050 RSI: 0000200000000200 RDI: 000000000000000a [ 541.055527][T26794] RBP: 00007fc0b8092090 R08: 0000000000000000 R09: 0000000000000000 [ 541.055538][T26794] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 541.055548][T26794] R13: 00007fc0b7416038 R14: 00007fc0b7415fa0 R15: 00007ffdfe0b0238 [ 541.055585][T26794] [ 541.105400][T26783] netlink: 28 bytes leftover after parsing attributes in process `syz.2.5570'. [ 541.350717][T26804] netlink: 180 bytes leftover after parsing attributes in process `syz.4.5577'. [ 541.360266][T26804] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5577'. [ 543.052511][T26790] netlink: 28 bytes leftover after parsing attributes in process `syz.3.5573'. [ 543.062065][T26790] netlink: 28 bytes leftover after parsing attributes in process `syz.3.5573'. [ 543.199943][T26814] FAULT_INJECTION: forcing a failure. [ 543.199943][T26814] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 543.253949][T26814] CPU: 1 UID: 0 PID: 26814 Comm: syz.3.5579 Not tainted syzkaller #0 PREEMPT(full) [ 543.253976][T26814] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 543.253987][T26814] Call Trace: [ 543.253994][T26814] [ 543.254002][T26814] dump_stack_lvl+0xe8/0x150 [ 543.254032][T26814] should_fail_ex+0x412/0x560 [ 543.254063][T26814] _copy_from_user+0x2d/0xb0 [ 543.254086][T26814] bpf_test_init+0xd8/0x150 [ 543.254113][T26814] bpf_prog_test_run_skb+0x389/0x21f0 [ 543.254153][T26814] ? __fget_files+0x2a/0x420 [ 543.254170][T26814] ? __fget_files+0x3a0/0x420 [ 543.254185][T26814] ? __fget_files+0x2a/0x420 [ 543.254205][T26814] ? __pfx_bpf_prog_test_run_skb+0x10/0x10 [ 543.254230][T26814] bpf_prog_test_run+0x2c7/0x340 [ 543.254253][T26814] __sys_bpf+0x643/0x950 [ 543.254272][T26814] ? __pfx___sys_bpf+0x10/0x10 [ 543.254305][T26814] ? ksys_write+0x242/0x270 [ 543.254327][T26814] ? __pfx_ksys_write+0x10/0x10 [ 543.254354][T26814] __x64_sys_bpf+0x7c/0x90 [ 543.254378][T26814] do_syscall_64+0x14d/0xf80 [ 543.254399][T26814] ? trace_irq_disable+0x3b/0x150 [ 543.254415][T26814] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 543.254433][T26814] ? clear_bhb_loop+0x40/0x90 [ 543.254455][T26814] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 543.254472][T26814] RIP: 0033:0x7f960619c819 [ 543.254489][T26814] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 543.254504][T26814] RSP: 002b:00007f96043f6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 543.254523][T26814] RAX: ffffffffffffffda RBX: 00007f9606415fa0 RCX: 00007f960619c819 [ 543.254537][T26814] RDX: 0000000000000050 RSI: 00002000000004c0 RDI: 000000000000000a [ 543.254548][T26814] RBP: 00007f96043f6090 R08: 0000000000000000 R09: 0000000000000000 [ 543.254559][T26814] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 543.254570][T26814] R13: 00007f9606416038 R14: 00007f9606415fa0 R15: 00007ffebd1b5868 [ 543.254599][T26814] [ 543.482076][T26818] FAULT_INJECTION: forcing a failure. [ 543.482076][T26818] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 543.521576][T26818] CPU: 0 UID: 0 PID: 26818 Comm: syz.0.5582 Not tainted syzkaller #0 PREEMPT(full) [ 543.521600][T26818] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 543.521610][T26818] Call Trace: [ 543.521616][T26818] [ 543.521624][T26818] dump_stack_lvl+0xe8/0x150 [ 543.521654][T26818] should_fail_ex+0x412/0x560 [ 543.521685][T26818] _copy_from_user+0x2d/0xb0 [ 543.521707][T26818] ___sys_sendmsg+0x1c6/0x360 [ 543.521740][T26818] ? __pfx____sys_sendmsg+0x10/0x10 [ 543.521766][T26818] ? kstrtouint+0x6e/0xe0 [ 543.521811][T26818] ? __fget_files+0x2a/0x420 [ 543.521828][T26818] ? __fget_files+0x3a0/0x420 [ 543.521855][T26818] __sys_sendmmsg+0x27c/0x4e0 [ 543.521877][T26818] ? __pfx___sys_sendmmsg+0x10/0x10 [ 543.521892][T26818] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 543.521937][T26818] ? ksys_write+0x242/0x270 [ 543.521960][T26818] ? __pfx_ksys_write+0x10/0x10 [ 543.521986][T26818] __x64_sys_sendmmsg+0xa0/0xc0 [ 543.522005][T26818] do_syscall_64+0x14d/0xf80 [ 543.522026][T26818] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 543.522044][T26818] ? clear_bhb_loop+0x40/0x90 [ 543.522066][T26818] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 543.522084][T26818] RIP: 0033:0x7f9869f9c819 [ 543.522099][T26818] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 543.522114][T26818] RSP: 002b:00007f986ad8f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 543.522132][T26818] RAX: ffffffffffffffda RBX: 00007f986a215fa0 RCX: 00007f9869f9c819 [ 543.522144][T26818] RDX: 0000000000000001 RSI: 0000200000000540 RDI: 0000000000000003 [ 543.522153][T26818] RBP: 00007f986ad8f090 R08: 0000000000000000 R09: 0000000000000000 [ 543.522163][T26818] R10: 0000000002004000 R11: 0000000000000246 R12: 0000000000000001 [ 543.522173][T26818] R13: 00007f986a216038 R14: 00007f986a215fa0 R15: 00007ffc0b9435c8 [ 543.522201][T26818] [ 543.859338][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5790 ms [ 543.867508][ C0] lec:lec_tx_timeout: lec0 [ 544.083032][T26840] sit0: Caught tx_queue_len zero misconfig [ 544.246002][T26854] lo speed is unknown, defaulting to 1000 [ 544.304810][T26858] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5597'. [ 544.968339][T26905] netlink: 24 bytes leftover after parsing attributes in process `syz.2.5615'. [ 545.159999][T26923] syzkaller0: entered promiscuous mode [ 545.166790][T26923] syzkaller0: entered allmulticast mode [ 545.249044][T26926] netlink: 'syz.2.5619': attribute type 39 has an invalid length. [ 545.260207][T26926] netlink: 676 bytes leftover after parsing attributes in process `syz.2.5619'. [ 545.446116][T26934] lo speed is unknown, defaulting to 1000 [ 547.487970][T26873] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 547.539576][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 547.745774][T26953] bond7 (unregistering): Released all slaves [ 547.816006][T26946] netlink: 'syz.3.5624': attribute type 29 has an invalid length. [ 547.844129][T26946] netlink: 'syz.3.5624': attribute type 29 has an invalid length. [ 547.905224][T26955] lo speed is unknown, defaulting to 1000 [ 548.043498][T26977] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for gretap1 [ 548.073421][T26983] netlink: 32 bytes leftover after parsing attributes in process `syz.4.5633'. [ 548.117317][T26983] netlink: 36 bytes leftover after parsing attributes in process `syz.4.5633'. [ 548.468950][T27010] FAULT_INJECTION: forcing a failure. [ 548.468950][T27010] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 548.502282][T27010] CPU: 0 UID: 0 PID: 27010 Comm: syz.0.5641 Not tainted syzkaller #0 PREEMPT(full) [ 548.502307][T27010] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 548.502317][T27010] Call Trace: [ 548.502324][T27010] [ 548.502332][T27010] dump_stack_lvl+0xe8/0x150 [ 548.502362][T27010] should_fail_ex+0x412/0x560 [ 548.502393][T27010] _copy_from_user+0x2d/0xb0 [ 548.502415][T27010] __sys_sendto+0x2b0/0x710 [ 548.502442][T27010] ? __pfx___sys_sendto+0x10/0x10 [ 548.502463][T27010] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 548.502497][T27010] ? __fget_files+0x3a0/0x420 [ 548.502524][T27010] ? ksys_write+0x242/0x270 [ 548.502543][T27010] ? __pfx_ksys_write+0x10/0x10 [ 548.502561][T27010] __x64_sys_sendto+0xde/0x100 [ 548.502582][T27010] do_syscall_64+0x14d/0xf80 [ 548.502598][T27010] ? trace_irq_disable+0x3b/0x150 [ 548.502610][T27010] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 548.502624][T27010] ? clear_bhb_loop+0x40/0x90 [ 548.502640][T27010] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 548.502654][T27010] RIP: 0033:0x7f9869f9c819 [ 548.502667][T27010] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 548.502678][T27010] RSP: 002b:00007f986ad8f028 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 548.502694][T27010] RAX: ffffffffffffffda RBX: 00007f986a215fa0 RCX: 00007f9869f9c819 [ 548.502703][T27010] RDX: 000000000000e90c RSI: 00002000000000c0 RDI: 0000000000000003 [ 548.502713][T27010] RBP: 00007f986ad8f090 R08: 0000200000000540 R09: 0000000000000014 [ 548.502721][T27010] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 548.502730][T27010] R13: 00007f986a216038 R14: 00007f986a215fa0 R15: 00007ffc0b9435c8 [ 548.502751][T27010] [ 548.808161][T27014] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5644'. [ 548.967449][T27034] netlink: 48 bytes leftover after parsing attributes in process `syz.4.5647'. [ 549.061645][T27028] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5648'. [ 549.070675][T27028] netlink: 'syz.3.5648': attribute type 26 has an invalid length. [ 549.071649][T27014] bond10: entered promiscuous mode [ 549.081124][T27028] netlink: 4 bytes leftover after parsing attributes in process `syz.3.5648'. [ 549.128096][T27014] bond10: entered allmulticast mode [ 549.147506][T27014] 8021q: adding VLAN 0 to HW filter on device bond10 [ 549.167491][T27020] netem: change failed [ 549.179272][T27045] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5649'. [ 549.201474][T27028] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5648'. [ 549.212345][T27045] netlink: 'syz.1.5649': attribute type 1 has an invalid length. [ 549.230173][T27045] netlink: 'syz.1.5649': attribute type 2 has an invalid length. [ 549.239659][T27028] netlink: 'syz.3.5648': attribute type 26 has an invalid length. [ 549.524171][T27057] mac80211_hwsim hwsim58 syzkaller0: left promiscuous mode [ 549.896337][T27090] sctp: [Deprecated]: syz.3.5664 (pid 27090) Use of int in maxseg socket option. [ 549.896337][T27090] Use struct sctp_assoc_value instead [ 550.099867][ T5145] Bluetooth: hci1: command 0x0406 tx timeout [ 550.234593][T27108] __nla_validate_parse: 4 callbacks suppressed [ 550.234611][T27108] netlink: 40 bytes leftover after parsing attributes in process `syz.4.5669'. [ 550.924269][T27149] netlink: 36 bytes leftover after parsing attributes in process `syz.2.5681'. [ 550.937476][T27138] netlink: 36 bytes leftover after parsing attributes in process `syz.2.5681'. [ 550.975434][T27138] netlink: 36 bytes leftover after parsing attributes in process `syz.2.5681'. [ 550.998432][T27138] netlink: 36 bytes leftover after parsing attributes in process `syz.2.5681'. [ 551.076957][T27138] netlink: 36 bytes leftover after parsing attributes in process `syz.2.5681'. [ 551.112728][T27138] netlink: 36 bytes leftover after parsing attributes in process `syz.2.5681'. [ 551.129901][T27138] netlink: 36 bytes leftover after parsing attributes in process `syz.2.5681'. [ 551.169552][T27138] netlink: 36 bytes leftover after parsing attributes in process `syz.2.5681'. [ 551.189843][T27138] netlink: 36 bytes leftover after parsing attributes in process `syz.2.5681'. [ 551.402497][T27171] FAULT_INJECTION: forcing a failure. [ 551.402497][T27171] name failslab, interval 1, probability 0, space 0, times 0 [ 551.434671][T27171] CPU: 1 UID: 0 PID: 27171 Comm: syz.3.5692 Not tainted syzkaller #0 PREEMPT(full) [ 551.434697][T27171] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 551.434707][T27171] Call Trace: [ 551.434714][T27171] [ 551.434722][T27171] dump_stack_lvl+0xe8/0x150 [ 551.434752][T27171] should_fail_ex+0x412/0x560 [ 551.434782][T27171] should_failslab+0xa8/0x100 [ 551.434805][T27171] kmem_cache_alloc_node_noprof+0x8f/0x690 [ 551.434836][T27171] ? __alloc_skb+0x186/0x7d0 [ 551.434858][T27171] ? __alloc_skb+0x1d0/0x7d0 [ 551.434877][T27171] ? __local_bh_enable_ip+0xd0/0x130 [ 551.434901][T27171] __alloc_skb+0x1d0/0x7d0 [ 551.434928][T27171] alloc_skb_with_frags+0xca/0x890 [ 551.434963][T27171] sock_alloc_send_pskb+0x878/0x990 [ 551.434988][T27171] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 551.435014][T27171] ? __pfx_sock_alloc_send_pskb+0x10/0x10 [ 551.435036][T27171] ? dev_get_by_index+0x22/0x2e0 [ 551.435054][T27171] ? dev_get_by_index+0x22/0x2e0 [ 551.435076][T27171] packet_sendmsg+0x33eb/0x50f0 [ 551.435100][T27171] ? __pfx_aa_label_sk_perm+0x10/0x10 [ 551.435126][T27171] ? __lock_acquire+0x6b5/0x2cf0 [ 551.435156][T27171] ? __lock_acquire+0x6b5/0x2cf0 [ 551.435194][T27171] ? aa_sk_perm+0x6d5/0x900 [ 551.435216][T27171] ? __pfx_packet_sendmsg+0x10/0x10 [ 551.435241][T27171] ? tomoyo_socket_sendmsg_permission+0x1e0/0x300 [ 551.435264][T27171] ? aa_sock_msg_perm+0xf1/0x1b0 [ 551.435281][T27171] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 551.435299][T27171] ? __pfx_packet_sendmsg+0x10/0x10 [ 551.435318][T27171] __sys_sendto+0x672/0x710 [ 551.435344][T27171] ? __pfx___sys_sendto+0x10/0x10 [ 551.435366][T27171] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 551.435399][T27171] ? __fget_files+0x3a0/0x420 [ 551.435424][T27171] ? ksys_write+0x242/0x270 [ 551.435447][T27171] ? __pfx_ksys_write+0x10/0x10 [ 551.435471][T27171] __x64_sys_sendto+0xde/0x100 [ 551.435497][T27171] do_syscall_64+0x14d/0xf80 [ 551.435516][T27171] ? trace_irq_disable+0x3b/0x150 [ 551.435531][T27171] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 551.435548][T27171] ? clear_bhb_loop+0x40/0x90 [ 551.435569][T27171] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 551.435587][T27171] RIP: 0033:0x7f960619c819 [ 551.435604][T27171] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 551.435619][T27171] RSP: 002b:00007f96043f6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 551.435638][T27171] RAX: ffffffffffffffda RBX: 00007f9606415fa0 RCX: 00007f960619c819 [ 551.435652][T27171] RDX: 000000000000e90c RSI: 00002000000000c0 RDI: 0000000000000003 [ 551.435663][T27171] RBP: 00007f96043f6090 R08: 0000200000000540 R09: 0000000000000014 [ 551.435674][T27171] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 551.435684][T27171] R13: 00007f9606416038 R14: 00007f9606415fa0 R15: 00007ffebd1b5868 [ 551.435712][T27171] [ 551.746096][T27173] RDS: rds_bind could not find a transport for ::ffff:172.20.20.170, load rds_tcp or rds_rdma? [ 551.780282][T27175] netlink: 'syz.2.5693': attribute type 13 has an invalid length. [ 552.106324][T27196] netlink: 'syz.3.5700': attribute type 11 has an invalid length. [ 552.475907][T27214] tipc: Started in network mode [ 552.481336][T27214] tipc: Node identity 080211000001, cluster identity 4711 [ 552.488927][T27214] tipc: Enabled bearer , priority 0 [ 552.497194][T27214] mac80211_hwsim hwsim56 syzkaller0: entered promiscuous mode [ 552.505080][T27214] mac80211_hwsim hwsim56 syzkaller0: entered allmulticast mode [ 552.533868][T27215] pim6reg: entered allmulticast mode [ 552.554761][T27214] tipc: Resetting bearer [ 552.561497][T27215] dummy0: left allmulticast mode [ 552.665625][T27204] delete_channel: no stack [ 552.688325][T27229] "syz.2.5710" (27229) uses obsolete ecb(arc4) skcipher [ 552.689074][T27215] pim6reg: left allmulticast mode [ 552.760239][T27230] lo speed is unknown, defaulting to 1000 [ 553.020667][T27240] netlink: 'syz.1.5713': attribute type 1 has an invalid length. [ 553.030258][T27241] netlink: 'syz.2.5712': attribute type 3 has an invalid length. [ 553.135927][T27241] tipc: Enabling of bearer rejected, already enabled [ 553.257058][T27243] 8021q: adding VLAN 0 to HW filter on device bond3 [ 553.423843][T27269] macsec2: entered promiscuous mode [ 553.432203][T27269] bridge0: entered promiscuous mode [ 553.554111][ T7377] tipc: Node number set to 134418688 [ 553.647376][T27281] bridge_slave_0: left allmulticast mode [ 553.666253][T27281] bridge_slave_0: left promiscuous mode [ 553.687021][T27281] bridge0: port 1(bridge_slave_0) entered disabled state [ 553.735210][T27281] bridge_slave_1: left allmulticast mode [ 553.749143][T27281] bridge_slave_1: left promiscuous mode [ 553.775170][T27281] bridge0: port 2(bridge_slave_1) entered disabled state [ 553.821667][T27281] bond0: (slave bond_slave_0): Releasing backup interface [ 553.870052][T27281] bond0: (slave bond_slave_1): Releasing backup interface [ 553.871809][T27266] FAULT_INJECTION: forcing a failure. [ 553.871809][T27266] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 553.905237][T27281] team0: Port device team_slave_0 removed [ 553.913585][T27266] CPU: 1 UID: 0 PID: 27266 Comm: syz.3.5720 Not tainted syzkaller #0 PREEMPT(full) [ 553.913612][T27266] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 553.913622][T27266] Call Trace: [ 553.913631][T27266] [ 553.913638][T27266] dump_stack_lvl+0xe8/0x150 [ 553.913669][T27266] should_fail_ex+0x412/0x560 [ 553.913701][T27266] _copy_from_user+0x2d/0xb0 [ 553.913724][T27266] do_ipv6_setsockopt+0x25c/0x3150 [ 553.913759][T27266] ? __pfx_do_ipv6_setsockopt+0x10/0x10 [ 553.913783][T27266] ? get_pid_task+0x20/0x1f0 [ 553.913802][T27266] ? get_pid_task+0x20/0x1f0 [ 553.913817][T27266] ? get_pid_task+0x20/0x1f0 [ 553.913846][T27266] ? __lock_acquire+0x6b5/0x2cf0 [ 553.913883][T27266] ? aa_sk_perm+0x6d5/0x900 [ 553.913925][T27266] ? __pfx_aa_sk_perm+0x10/0x10 [ 553.913952][T27266] ? __fget_files+0x2a/0x420 [ 553.913968][T27266] ? aa_sock_opt_perm+0xff/0x1a0 [ 553.913988][T27266] ipv6_setsockopt+0x59/0x170 [ 553.914012][T27266] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 553.914037][T27266] do_sock_setsockopt+0x17c/0x1b0 [ 553.914066][T27266] __x64_sys_setsockopt+0x13d/0x1b0 [ 553.914096][T27266] do_syscall_64+0x14d/0xf80 [ 553.914116][T27266] ? trace_irq_disable+0x3b/0x150 [ 553.914133][T27266] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 553.914152][T27266] ? clear_bhb_loop+0x40/0x90 [ 553.914174][T27266] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 553.914192][T27266] RIP: 0033:0x7f960619c819 [ 553.914210][T27266] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 553.914225][T27266] RSP: 002b:00007f96043f6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 553.914245][T27266] RAX: ffffffffffffffda RBX: 00007f9606415fa0 RCX: 00007f960619c819 [ 553.914258][T27266] RDX: 0000000000000041 RSI: 0000000000000029 RDI: 0000000000000007 [ 553.914270][T27266] RBP: 00007f96043f6090 R08: 0000000000000048 R09: 0000000000000000 [ 553.914281][T27266] R10: 0000200000000440 R11: 0000000000000246 R12: 0000000000000001 [ 553.914293][T27266] R13: 00007f9606416038 R14: 00007f9606415fa0 R15: 00007ffebd1b5868 [ 553.914322][T27266] [ 554.140490][T27281] team0: Port device team_slave_1 removed [ 554.147144][T27281] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 554.178592][T27281] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 554.483346][T27307] netlink: 'syz.3.5729': attribute type 1 has an invalid length. [ 554.569048][T27307] 8021q: adding VLAN 0 to HW filter on device bond4 [ 554.627940][T27316] bond4: (slave dummy0): making interface the new active one [ 554.648646][T27316] bond4: (slave dummy0): Enslaving as an active interface with an up link [ 554.685733][T27311] netlink: 'syz.0.5731': attribute type 1 has an invalid length. [ 554.735840][T27307] bond4 (unregistering): (slave dummy0): Releasing active interface [ 554.765510][T27307] bond4 (unregistering): Released all slaves [ 558.455711][T16478] lec:lec_start_xmit: lec0:No lecd attached [ 563.859442][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5400 ms [ 563.867752][ C0] lec:lec_tx_timeout: lec0 [ 563.872398][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 568.035187][ T9455] dvmrp0: left allmulticast mode [ 568.040726][ T9455] dvmrp6: left allmulticast mode [ 568.164069][ T9455] batman_adv: batadv0: Removing interface: vlan5 [ 568.197453][ T9455] bond5 (unregistering): (slave geneve4): Releasing active interface [ 568.209591][ T9455] bond4 (unregistering): (slave geneve3): Releasing active interface [ 568.353165][ T9455] team0: Port device bridge3 removed [ 568.716278][ T9455] bond0 (unregistering): Released all slaves [ 568.726390][ T9455] bond1 (unregistering): Released all slaves [ 568.738939][ T9455] bond2 (unregistering): Released all slaves [ 568.753702][ T9455] bond3 (unregistering): Released all slaves [ 568.775037][ T9455] bond4 (unregistering): Released all slaves [ 568.787456][ T9455] bond5 (unregistering): Released all slaves [ 568.800211][ T9455] bond6 (unregistering): Released all slaves [ 568.815856][ T9455] bond7 (unregistering): Released all slaves [ 568.900258][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5030 ms [ 568.908285][ C0] lec:lec_tx_timeout: lec0 [ 568.942436][ T9455] tipc: Left network mode [ 569.393475][ T9455] hsr_slave_0: left promiscuous mode [ 569.399595][ T9455] hsr_slave_1: left promiscuous mode [ 569.947889][ T9455] IPVS: stop unused estimator thread 0... [ 593.209916][T27336] __nla_validate_parse: 67 callbacks suppressed [ 593.209936][T27336] netlink: 12 bytes leftover after parsing attributes in process `syz.3.5736'. [ 593.230553][T27334] A link change request failed with some changes committed already. Interface veth1_vlan may have been left with an inconsistent configuration, please check. [ 593.236724][T27336] netlink: 12 bytes leftover after parsing attributes in process `syz.3.5736'. [ 593.341715][T27339] pim6reg1: entered promiscuous mode [ 593.347435][T27339] pim6reg1: entered allmulticast mode [ 593.911965][T27345] FAULT_INJECTION: forcing a failure. [ 593.911965][T27345] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 593.927930][T27345] CPU: 1 UID: 0 PID: 27345 Comm: syz.0.5739 Not tainted syzkaller #0 PREEMPT(full) [ 593.927957][T27345] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 593.927969][T27345] Call Trace: [ 593.927986][T27345] [ 593.927994][T27345] dump_stack_lvl+0xe8/0x150 [ 593.928024][T27345] should_fail_ex+0x412/0x560 [ 593.928056][T27345] _copy_from_user+0x2d/0xb0 [ 593.928079][T27345] xt_copy_counters+0x199/0x4c0 [ 593.928102][T27345] ? __pfx_xt_copy_counters+0x10/0x10 [ 593.928122][T27345] ? apparmor_capable+0x126/0x170 [ 593.928145][T27345] ? bpf_lsm_capable+0x9/0x20 [ 593.928170][T27345] ? security_capable+0x7e/0x2c0 [ 593.928202][T27345] do_ip6t_set_ctl+0x1a6/0xe10 [ 593.928226][T27345] ? rcu_is_watching+0x15/0xb0 [ 593.928252][T27345] ? trace_contention_end+0x3d/0x150 [ 593.928271][T27345] ? __pfx_do_ip6t_set_ctl+0x10/0x10 [ 593.928299][T27345] ? nf_setsockopt+0x221/0x290 [ 593.928323][T27345] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 593.928349][T27345] ? __pfx___mutex_lock+0x10/0x10 [ 593.928371][T27345] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 593.928399][T27345] ? __pfx_aa_sk_perm+0x10/0x10 [ 593.928428][T27345] nf_setsockopt+0x26f/0x290 [ 593.928448][T27345] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 593.928473][T27345] do_sock_setsockopt+0x17c/0x1b0 [ 593.928502][T27345] __x64_sys_setsockopt+0x13d/0x1b0 [ 593.928528][T27345] do_syscall_64+0x14d/0xf80 [ 593.928545][T27345] ? trace_irq_disable+0x3b/0x150 [ 593.928559][T27345] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 593.928577][T27345] ? clear_bhb_loop+0x40/0x90 [ 593.928599][T27345] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 593.928615][T27345] RIP: 0033:0x7f9869f9c819 [ 593.928633][T27345] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 593.928649][T27345] RSP: 002b:00007f986ad8f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 593.928669][T27345] RAX: ffffffffffffffda RBX: 00007f986a215fa0 RCX: 00007f9869f9c819 [ 593.928683][T27345] RDX: 0000000000000041 RSI: 0000000000000029 RDI: 0000000000000008 [ 593.928694][T27345] RBP: 00007f986ad8f090 R08: 0000000000000048 R09: 0000000000000000 [ 593.928705][T27345] R10: 0000200000000440 R11: 0000000000000246 R12: 0000000000000001 [ 593.928715][T27345] R13: 00007f986a216038 R14: 00007f986a215fa0 R15: 00007ffc0b9435c8 [ 593.928741][T27345] [ 593.929224][T27345] netlink: 28 bytes leftover after parsing attributes in process `syz.0.5739'. [ 594.703444][T27414] netlink: 4 bytes leftover after parsing attributes in process `syz.4.5753'. [ 594.851400][T27417] IPv6: sit2: Disabled Multicast RS [ 595.344478][T27450] A link change request failed with some changes committed already. Interface geneve0 may have been left with an inconsistent configuration, please check. [ 595.503082][T27461] [ 595.505482][T27461] ====================================================== [ 595.512493][T27461] WARNING: possible circular locking dependency detected [ 595.519585][T27461] syzkaller #0 Not tainted [ 595.524007][T27461] ------------------------------------------------------ [ 595.531050][T27461] syz.3.5765/27461 is trying to acquire lock: [ 595.537212][T27461] ffffffff8e883760 (fs_reclaim){+.+.}-{0:0}, at: prepare_alloc_pages+0x152/0x650 [ 595.546451][T27461] [ 595.546451][T27461] but task is already holding lock: [ 595.553804][T27461] ffff888067175900 (&mm->mmap_lock){++++}-{4:4}, at: lock_mm_and_find_vma+0x36/0x340 [ 595.563288][T27461] [ 595.563288][T27461] which lock already depends on the new lock. [ 595.563288][T27461] [ 595.573679][T27461] [ 595.573679][T27461] the existing dependency chain (in reverse order) is: [ 595.582681][T27461] [ 595.582681][T27461] -> #7 (&mm->mmap_lock){++++}-{4:4}: [ 595.590239][T27461] __might_fault+0xcb/0x130 [ 595.595357][T27461] _copy_from_user+0x28/0xb0 [ 595.600636][T27461] csum_and_copy_from_iter_full+0x1e7/0x1f00 [ 595.607169][T27461] ip_generic_getfrag+0x149/0x2d0 [ 595.612796][T27461] __ip6_append_data+0x39e4/0x3f70 [ 595.618436][T27461] ip6_append_data+0x10f/0x280 [ 595.623801][T27461] rawv6_sendmsg+0x12d3/0x18e0 [ 595.629093][T27461] ____sys_sendmsg+0x80a/0x9f0 [ 595.634376][T27461] ___sys_sendmsg+0x2a5/0x360 [ 595.639585][T27461] __x64_sys_sendmsg+0x1bd/0x2a0 [ 595.645065][T27461] do_syscall_64+0x14d/0xf80 [ 595.650422][T27461] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 595.656827][T27461] [ 595.656827][T27461] -> #6 (sk_lock-AF_INET6){+.+.}-{0:0}: [ 595.664651][T27461] lock_sock_nested+0x41/0x100 [ 595.669940][T27461] inet_shutdown+0x6a/0x390 [ 595.674960][T27461] nbd_mark_nsock_dead+0x2e9/0x560 [ 595.680588][T27461] recv_work+0x1c7f/0x1d90 [ 595.685525][T27461] process_scheduled_works+0xb6e/0x18c0 [ 595.691762][T27461] worker_thread+0xa53/0xfc0 [ 595.696881][T27461] kthread+0x388/0x470 [ 595.701804][T27461] ret_from_fork+0x51e/0xb90 [ 595.707190][T27461] ret_from_fork_asm+0x1a/0x30 [ 595.712687][T27461] [ 595.712687][T27461] -> #5 (&nsock->tx_lock){+.+.}-{4:4}: [ 595.720471][T27461] __mutex_lock+0x19f/0x1300 [ 595.725782][T27461] nbd_queue_rq+0x37b/0x1100 [ 595.732069][T27461] blk_mq_dispatch_rq_list+0xa70/0x1910 [ 595.738239][T27461] __blk_mq_sched_dispatch_requests+0xdcc/0x1600 [ 595.745195][T27461] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 595.752148][T27461] blk_mq_run_hw_queue+0x348/0x4f0 [ 595.757981][T27461] blk_mq_dispatch_list+0xd16/0xe10 [ 595.763804][T27461] blk_mq_flush_plug_list+0x48d/0x570 [ 595.769793][T27461] __blk_flush_plug+0x3ed/0x4d0 [ 595.775170][T27461] __submit_bio+0x28d/0x580 [ 595.780277][T27461] submit_bio_noacct_nocheck+0x2f4/0xa70 [ 595.786454][T27461] block_read_full_folio+0x599/0x830 [ 595.792267][T27461] filemap_read_folio+0x137/0x3b0 [ 595.797929][T27461] do_read_cache_folio+0x358/0x590 [ 595.803581][T27461] read_part_sector+0xb6/0x2b0 [ 595.808982][T27461] adfspart_check_ICS+0xa5/0xa40 [ 595.814615][T27461] bdev_disk_changed+0x7ba/0x1550 [ 595.820168][T27461] blkdev_get_whole+0x380/0x510 [ 595.825544][T27461] bdev_open+0x31e/0xd30 [ 595.830311][T27461] blkdev_open+0x470/0x610 [ 595.835254][T27461] do_dentry_open+0x785/0x14e0 [ 595.840537][T27461] vfs_open+0x3b/0x340 [ 595.845145][T27461] path_openat+0x2e08/0x3860 [ 595.850249][T27461] do_file_open+0x23e/0x4a0 [ 595.855355][T27461] do_sys_openat2+0x113/0x200 [ 595.860550][T27461] __x64_sys_openat+0x138/0x170 [ 595.865941][T27461] do_syscall_64+0x14d/0xf80 [ 595.871045][T27461] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 595.877454][T27461] [ 595.877454][T27461] -> #4 (&cmd->lock){+.+.}-{4:4}: [ 595.884833][T27461] __mutex_lock+0x19f/0x1300 [ 595.889952][T27461] nbd_queue_rq+0xc6/0x1100 [ 595.894992][T27461] blk_mq_dispatch_rq_list+0xa70/0x1910 [ 595.901071][T27461] __blk_mq_sched_dispatch_requests+0xdcc/0x1600 [ 595.908025][T27461] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 595.914644][T27461] blk_mq_run_hw_queue+0x348/0x4f0 [ 595.920303][T27461] blk_mq_dispatch_list+0xd16/0xe10 [ 595.926040][T27461] blk_mq_flush_plug_list+0x48d/0x570 [ 595.931932][T27461] __blk_flush_plug+0x3ed/0x4d0 [ 595.937387][T27461] __submit_bio+0x28d/0x580 [ 595.942407][T27461] submit_bio_noacct_nocheck+0x2f4/0xa70 [ 595.948564][T27461] block_read_full_folio+0x599/0x830 [ 595.954469][T27461] filemap_read_folio+0x137/0x3b0 [ 595.960039][T27461] do_read_cache_folio+0x358/0x590 [ 595.965722][T27461] read_part_sector+0xb6/0x2b0 [ 595.971023][T27461] adfspart_check_ICS+0xa5/0xa40 [ 595.976497][T27461] bdev_disk_changed+0x7ba/0x1550 [ 595.982148][T27461] blkdev_get_whole+0x380/0x510 [ 595.987971][T27461] bdev_open+0x31e/0xd30 [ 595.993253][T27461] blkdev_open+0x470/0x610 [ 595.998276][T27461] do_dentry_open+0x785/0x14e0 [ 596.003562][T27461] vfs_open+0x3b/0x340 [ 596.008241][T27461] path_openat+0x2e08/0x3860 [ 596.013443][T27461] do_file_open+0x23e/0x4a0 [ 596.018908][T27461] do_sys_openat2+0x113/0x200 [ 596.024279][T27461] __x64_sys_openat+0x138/0x170 [ 596.029917][T27461] do_syscall_64+0x14d/0xf80 [ 596.035126][T27461] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 596.041803][T27461] [ 596.041803][T27461] -> #3 (set->srcu){.+.+}-{0:0}: [ 596.049115][T27461] __synchronize_srcu+0xca/0x300 [ 596.054854][T27461] elevator_switch+0x1e8/0x7a0 [ 596.060241][T27461] elevator_change+0x2cc/0x450 [ 596.065794][T27461] elevator_set_default+0x36c/0x430 [ 596.071506][T27461] blk_register_queue+0x366/0x430 [ 596.077061][T27461] __add_disk+0x677/0xd50 [ 596.081914][T27461] add_disk_fwnode+0xfb/0x480 [ 596.087115][T27461] nbd_dev_add+0x72c/0xb50 [ 596.092322][T27461] nbd_init+0x168/0x1f0 [ 596.097023][T27461] do_one_initcall+0x250/0x8d0 [ 596.102407][T27461] do_initcall_level+0x104/0x190 [ 596.107903][T27461] do_initcalls+0x59/0xa0 [ 596.112869][T27461] kernel_init_freeable+0x2a6/0x3e0 [ 596.118609][T27461] kernel_init+0x1d/0x1d0 [ 596.123461][T27461] ret_from_fork+0x51e/0xb90 [ 596.128615][T27461] ret_from_fork_asm+0x1a/0x30 [ 596.133917][T27461] [ 596.133917][T27461] -> #2 (&q->elevator_lock){+.+.}-{4:4}: [ 596.141744][T27461] __mutex_lock+0x19f/0x1300 [ 596.146966][T27461] elevator_change+0x1b3/0x450 [ 596.152349][T27461] elevator_set_none+0xb5/0x140 [ 596.157735][T27461] blk_mq_update_nr_hw_queues+0x5e7/0x1a60 [ 596.164151][T27461] nbd_start_device+0x17f/0xb10 [ 596.169528][T27461] nbd_genl_connect+0x165b/0x1cf0 [ 596.175107][T27461] genl_family_rcv_msg_doit+0x22a/0x330 [ 596.181186][T27461] genl_rcv_msg+0x61c/0x7a0 [ 596.186235][T27461] netlink_rcv_skb+0x232/0x4b0 [ 596.191612][T27461] genl_rcv+0x28/0x40 [ 596.196112][T27461] netlink_unicast+0x75c/0x8e0 [ 596.201746][T27461] netlink_sendmsg+0x813/0xb40 [ 596.207232][T27461] ____sys_sendmsg+0x972/0x9f0 [ 596.212533][T27461] ___sys_sendmsg+0x2a5/0x360 [ 596.217737][T27461] __x64_sys_sendmsg+0x1bd/0x2a0 [ 596.223365][T27461] do_syscall_64+0x14d/0xf80 [ 596.228467][T27461] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 596.235061][T27461] [ 596.235061][T27461] -> #1 (&q->q_usage_counter(io)#50){++++}-{0:0}: [ 596.243746][T27461] blk_alloc_queue+0x546/0x680 [ 596.249118][T27461] __blk_mq_alloc_disk+0x197/0x390 [ 596.254790][T27461] nbd_dev_add+0x499/0xb50 [ 596.259777][T27461] nbd_init+0x168/0x1f0 [ 596.264468][T27461] do_one_initcall+0x250/0x8d0 [ 596.269750][T27461] do_initcall_level+0x104/0x190 [ 596.275208][T27461] do_initcalls+0x59/0xa0 [ 596.280051][T27461] kernel_init_freeable+0x2a6/0x3e0 [ 596.285787][T27461] kernel_init+0x1d/0x1d0 [ 596.290675][T27461] ret_from_fork+0x51e/0xb90 [ 596.295806][T27461] ret_from_fork_asm+0x1a/0x30 [ 596.301085][T27461] [ 596.301085][T27461] -> #0 (fs_reclaim){+.+.}-{0:0}: [ 596.308373][T27461] __lock_acquire+0x15a5/0x2cf0 [ 596.313738][T27461] lock_acquire+0xf0/0x2e0 [ 596.318669][T27461] fs_reclaim_acquire+0x71/0x100 [ 596.324221][T27461] prepare_alloc_pages+0x152/0x650 [ 596.330023][T27461] __alloc_frozen_pages_noprof+0x12f/0x380 [ 596.336531][T27461] alloc_pages_mpol+0x232/0x4a0 [ 596.342022][T27461] folio_alloc_mpol_noprof+0x39/0x70 [ 596.347844][T27461] shmem_alloc_and_add_folio+0x445/0xf80 [ 596.354092][T27461] shmem_get_folio_gfp+0x5a9/0x1670 [ 596.359863][T27461] shmem_fault+0x179/0x390 [ 596.364802][T27461] __do_fault+0x138/0x390 [ 596.369645][T27461] do_pte_missing+0x5c4/0x3490 [ 596.374918][T27461] handle_mm_fault+0x1bec/0x3310 [ 596.380555][T27461] do_user_addr_fault+0x75b/0x1340 [ 596.386271][T27461] exc_page_fault+0x6a/0xc0 [ 596.391381][T27461] asm_exc_page_fault+0x26/0x30 [ 596.396742][T27461] ep_try_send_events+0x79f/0xf10 [ 596.402276][T27461] do_epoll_wait+0x5cf/0xf60 [ 596.407382][T27461] __x64_sys_epoll_wait+0x1d7/0x230 [ 596.413098][T27461] do_syscall_64+0x14d/0xf80 [ 596.418214][T27461] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 596.424657][T27461] [ 596.424657][T27461] other info that might help us debug this: [ 596.424657][T27461] [ 596.434893][T27461] Chain exists of: [ 596.434893][T27461] fs_reclaim --> sk_lock-AF_INET6 --> &mm->mmap_lock [ 596.434893][T27461] [ 596.447671][T27461] Possible unsafe locking scenario: [ 596.447671][T27461] [ 596.455212][T27461] CPU0 CPU1 [ 596.461144][T27461] ---- ---- [ 596.466643][T27461] rlock(&mm->mmap_lock); [ 596.471158][T27461] lock(sk_lock-AF_INET6); [ 596.478272][T27461] lock(&mm->mmap_lock); [ 596.485202][T27461] lock(fs_reclaim); [ 596.489171][T27461] [ 596.489171][T27461] *** DEADLOCK *** [ 596.489171][T27461] [ 596.497299][T27461] 2 locks held by syz.3.5765/27461: [ 596.502537][T27461] #0: ffff888030cd3468 (&ep->mtx){+.+.}-{4:4}, at: ep_try_send_events+0x19d/0xf10 [ 596.511952][T27461] #1: ffff888067175900 (&mm->mmap_lock){++++}-{4:4}, at: lock_mm_and_find_vma+0x36/0x340 [ 596.522153][T27461] [ 596.522153][T27461] stack backtrace: [ 596.528228][T27461] CPU: 1 UID: 0 PID: 27461 Comm: syz.3.5765 Not tainted syzkaller #0 PREEMPT(full) [ 596.528247][T27461] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 596.528258][T27461] Call Trace: [ 596.528265][T27461] [ 596.528274][T27461] dump_stack_lvl+0xe8/0x150 [ 596.528298][T27461] print_circular_bug+0x2e1/0x300 [ 596.528323][T27461] check_noncircular+0x12e/0x150 [ 596.528348][T27461] __lock_acquire+0x15a5/0x2cf0 [ 596.528372][T27461] ? irqentry_exit+0x59e/0x620 [ 596.528390][T27461] ? lockdep_hardirqs_on+0x7a/0x110 [ 596.528407][T27461] ? mas_ascend+0x304/0x890 [ 596.528429][T27461] lock_acquire+0xf0/0x2e0 [ 596.528447][T27461] ? prepare_alloc_pages+0x152/0x650 [ 596.528470][T27461] fs_reclaim_acquire+0x71/0x100 [ 596.528489][T27461] ? prepare_alloc_pages+0x152/0x650 [ 596.528508][T27461] prepare_alloc_pages+0x152/0x650 [ 596.528528][T27461] __alloc_frozen_pages_noprof+0x12f/0x380 [ 596.528551][T27461] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 596.528572][T27461] ? __pfx_policy_nodemask+0x10/0x10 [ 596.528600][T27461] ? mas_next_node+0x3a5/0xd60 [ 596.528622][T27461] alloc_pages_mpol+0x232/0x4a0 [ 596.528643][T27461] folio_alloc_mpol_noprof+0x39/0x70 [ 596.528664][T27461] shmem_alloc_and_add_folio+0x445/0xf80 [ 596.528682][T27461] ? filemap_get_entry+0xca/0x320 [ 596.528699][T27461] ? filemap_get_entry+0xca/0x320 [ 596.528715][T27461] ? filemap_get_entry+0x2ac/0x320 [ 596.528731][T27461] ? __pfx_filemap_get_entry+0x10/0x10 [ 596.528748][T27461] ? __pfx_shmem_alloc_and_add_folio+0x10/0x10 [ 596.528765][T27461] ? shmem_allowable_huge_orders+0x5ec/0x690 [ 596.528791][T27461] shmem_get_folio_gfp+0x5a9/0x1670 [ 596.528824][T27461] shmem_fault+0x179/0x390 [ 596.528843][T27461] __do_fault+0x138/0x390 [ 596.528860][T27461] do_pte_missing+0x5c4/0x3490 [ 596.528881][T27461] ? handle_mm_fault+0xee/0x3310 [ 596.528896][T27461] handle_mm_fault+0x1bec/0x3310 [ 596.528915][T27461] ? handle_mm_fault+0xee/0x3310 [ 596.528931][T27461] ? __pfx_handle_mm_fault+0x10/0x10 [ 596.528951][T27461] ? lock_mm_and_find_vma+0xa7/0x340 [ 596.528970][T27461] do_user_addr_fault+0x75b/0x1340 [ 596.528995][T27461] exc_page_fault+0x6a/0xc0 [ 596.529013][T27461] asm_exc_page_fault+0x26/0x30 [ 596.529028][T27461] RIP: 0010:ep_try_send_events+0x79f/0xf10 [ 596.529046][T27461] Code: b6 04 28 84 c0 0f 85 d4 03 00 00 49 8b 07 48 ba 00 f0 ff ff ff 7f 00 00 48 8b 74 24 68 48 89 f1 48 39 d1 48 0f 47 ca 0f 01 cb <44> 89 31 48 89 41 04 0f 01 ca 48 83 c6 0c 44 8b 74 24 14 0f 84 13 [ 596.529060][T27461] RSP: 0018:ffffc90003497ac0 EFLAGS: 00050283 [ 596.529074][T27461] RAX: 0000000000000000 RBX: ffff888028421498 RCX: 0000200000002a80 [ 596.529087][T27461] RDX: 00007ffffffff000 RSI: 0000200000002a80 RDI: ffff8880284214f3 [ 596.529098][T27461] RBP: ffffc90003497bf0 R08: ffff8880668d4167 R09: 1ffff1100cd1a82c [ 596.529110][T27461] R10: dffffc0000000000 R11: ffffed100cd1a82d R12: 1ffff1100508429d [ 596.529122][T27461] R13: dffffc0000000000 R14: 0000000000000300 R15: ffff8880284214ec [ 596.529144][T27461] ? __pfx_ep_try_send_events+0x10/0x10 [ 596.529161][T27461] ? _raw_spin_unlock_irq+0x23/0x50 [ 596.529178][T27461] do_epoll_wait+0x5cf/0xf60 [ 596.529195][T27461] ? __pfx_futex_wait+0x10/0x10 [ 596.529223][T27461] ? do_epoll_wait+0x7e1/0xf60 [ 596.529241][T27461] ? __pfx_do_epoll_wait+0x10/0x10 [ 596.529257][T27461] ? __pfx_ep_autoremove_wake_function+0x10/0x10 [ 596.529277][T27461] ? __pfx_do_futex+0x10/0x10 [ 596.529298][T27461] ? alloc_file_pseudo+0x1ae/0x240 [ 596.529324][T27461] __x64_sys_epoll_wait+0x1d7/0x230 [ 596.529340][T27461] ? __pfx___x64_sys_epoll_wait+0x10/0x10 [ 596.529355][T27461] ? rcu_is_watching+0x15/0xb0 [ 596.529380][T27461] do_syscall_64+0x14d/0xf80 [ 596.529398][T27461] ? trace_irq_disable+0x3b/0x150 [ 596.529412][T27461] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 596.529427][T27461] ? clear_bhb_loop+0x40/0x90 [ 596.529444][T27461] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 596.529459][T27461] RIP: 0033:0x7f960619c819 [ 596.529474][T27461] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 596.529487][T27461] RSP: 002b:00007f96043f6028 EFLAGS: 00000246 ORIG_RAX: 00000000000000e8 [ 596.529502][T27461] RAX: ffffffffffffffda RBX: 00007f9606415fa0 RCX: 00007f960619c819 [ 596.529514][T27461] RDX: 0000000000000001 RSI: 0000200000002a80 RDI: 0000000000000005 [ 596.529524][T27461] RBP: 00007f9606232c91 R08: 0000000000000000 R09: 0000000000000000 [ 596.529534][T27461] R10: 00000000fffeffff R11: 0000000000000246 R12: 0000000000000000 [ 596.529544][T27461] R13: 00007f9606416038 R14: 00007f9606415fa0 R15: 00007ffebd1b5868 [ 596.529562][T27461] [ 597.034273][T27461] netlink: 68 bytes leftover after parsing attributes in process `syz.3.5765'.