last executing test programs: 3m23.091381813s ago: executing program 0 (id=1828): r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_tx_ring(r0, 0x107, 0x5, &(0x7f00000000c0)=@req3={0x8000, 0x6, 0x8000, 0x6}, 0x1c) mmap(&(0x7f0000000000/0x2000)=nil, 0x30000, 0x2, 0x11, r0, 0x0) r1 = socket$rds(0x15, 0x5, 0x0) bind$rds(r1, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendmsg$rds(r1, &(0x7f0000001600)={&(0x7f0000000000)={0x2, 0x0, @remote}, 0x10, 0x0, 0x0, &(0x7f0000000780)=[@rdma_args={0x48, 0x114, 0x1, {{}, {0x0, 0x2c}, &(0x7f00000006c0)=[{&(0x7f0000000100)=""/44, 0x410200}], 0x1, 0x1000000000000}}], 0x48}, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0x7000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) socket(0x2c, 0x3, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000002c0)={&(0x7f00000003c0)=ANY=[@ANYRES32=r1], &(0x7f0000000380), 0x46, 0x0, 0x1, 0x2}, 0x28) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=ANY=[@ANYBLOB="1c0000001500000100000000000000000a0000000800ff00", @ANYRES32, @ANYBLOB="657342941bc67c6e56ee000057db43ea5f"], 0x1c}}, 0x20000080) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000240)=ANY=[@ANYBLOB="2c0000003ebfa4653981b67a5a95000701feffffff00000000017c0000040042800c00018006000600800a00000800028004001280"], 0x2c}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) sendmsg$NLBL_UNLABEL_C_STATICADD(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={0x0}, 0x8, 0x3000000000002}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000002bc0)=@delchain={0x4c, 0x65, 0x400, 0x70bd2a, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, {0x2}, {0x0, 0xfff3}, {0x0, 0xd}}, [@filter_kind_options=@f_bpf={{0x8}, {0x18, 0x2, [@TCA_BPF_FD={0x8}, @TCA_BPF_POLICE={0x4}, @TCA_BPF_FD={0x8}]}}, @TCA_CHAIN={0x8, 0xb, 0x1d8}]}, 0x4c}, 0x1, 0x0, 0x0, 0x884}, 0x0) r4 = socket(0x10, 0x803, 0x0) sendto(r4, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x4000000, 0x0, 0x0) r5 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000005d00)=ANY=[@ANYBLOB="140100002e00010000000000fcdbdf250401f2800c00180008ac0f00000000001400010000001000000000000000ffffac14141650bb2d6f67d29d6fabadb107d0def49c88ea04abde1d5e8d3fb22a1b5046778bdafefc46b0449ade68bf84b36ec72dd71265fc2e882348c26c2126237dd5b37f5ae655b1086cda40e00aec58754734be31d750351dc076eb43d9621dc08c029d1608a46cf26fbe816b89f7cb81bff81a8b9482565856555ee923c65973deb0a99b962bc0fe94a3fcae3697bd7b85b3a682167c43dbf137115a40ebddcad74875ec58e9a3ddb9ad02a078cf0d972df9e99f079767734f69ce475f00ac64337803f5eb4e5842f4d98fe3fa370d47eb640dc5061dc35817c8a66c29be820400"], 0x114}], 0x1, 0x0, 0x0, 0x1}, 0x0) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0x6, 0xe, &(0x7f00000008c0)=ANY=[@ANYBLOB="b7020000000d0000bfa30000000000000703000000feffff7a0af0fff8ffff1971a4f0ff00000000b7060000080000006f6400000000000045040400010000001704000001000a00b7040000ff0100006a0a00fe0000000085000000be000000b70000000000000095000000000000009e17f199a68b06d83298a8cdc21ce784909b849d5550ad857d0454d8877a6db61d69f2ffcaa10350e11cb97c8adf1bc9a0c4eeceb9971e43405d621ffbc9ce000000d8ca56b50d0c010d631f6dde53a9a53608c10556e5734eb84049761451ce540c772e2d9f8004e26f7fcc059c062234d5595f6fbaa187b81d1106000000000fd60000fd9ac3d09e29a9d542ca9d85a5c9c88474895d679838def0a83a733dc6a39b63a5ed69d32394c53361d7e43c5cbd80450f859ce8122a79c3e40000b59b0fc46d6cec3c0802882add4e3179bd4a44f231b6d753a7be428ba953df4aece69311687f4122073a236c3a32efa04137d4524847d2638da3261c8162bb7c7824be6195a66d2e17e122040e1100000000928612a29fc691e4f1f7bd053abb885f39381f1759410b1059f05684261f332d606834669b49ec99320ca7712d7e79bd5bf5ed818ecc7640917f6a559a47db608fcf9f6c131b84e41c354c66838f72b9e12d36e996f316f0812ca83efb30c7f6c6d57c4a64590401eec22523dd712c680013e87f649a1ede7142ca9d5d8a8c9f9b440fe4331ad5532c74d9a31a5d737537f7a2caa30581253d14dd3e92af7dc836686365ae01bdec561c0402b67801267a8df97d2f85426a5963d4fa3e26cc05972c162f223f000000d999e80de00fcbcc02d0aed7bb8f7ba337d59c14f39dcd4aad4139ef6425a9367f1bd1467fc6b95a4df7669839771ce9d5788029901e5a79d8b9990ace8f74087f25ad50c46088000000008000"/686], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x3a, 0x10, &(0x7f0000000340), 0xd58495bc, 0x0, 0xffffffffffffffff, 0xffffffffffffff5b}, 0x42) unshare(0x8040600) r6 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) r7 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) connect$netrom(r7, &(0x7f0000000300)={{0x6, @rose, 0x1}, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @default]}, 0x48) r8 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$inet6_int(r8, 0x29, 0x48, 0x0, &(0x7f0000000040)) r9 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) listen(r9, 0x80) connect$unix(r6, 0x0, 0x0) 3m22.436525187s ago: executing program 0 (id=1838): r0 = socket$netlink(0x10, 0x3, 0xc) r1 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r1, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r1, 0x10e, 0x4, &(0x7f0000000140)=0x6, 0x4) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f0000000200), 0x4) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000300)=@base={0xe, 0x4, 0x8, 0x800, 0x0, 0xffffffffffffffff, 0x10}, 0x50) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f00000006c0), 0xffffffffffffffff) r5 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f0000001040)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_TID_CONFIG(r5, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000bc0)={&(0x7f0000000200)={0x3c, r4, 0x1, 0x70bd29, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r6}, @void}}, [@NL80211_ATTR_TID_CONFIG={0x20, 0x11d, 0x0, 0x1, [{0x1c, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_TIDS={0x6, 0x5, 0xb2}, @NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE={0x5}, @NL80211_TID_CONFIG_ATTR_AMSDU_CTRL={0x5}]}]}]}, 0x3c}, 0x1, 0x0, 0x0, 0x40800}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3], 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x94) r8 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000280)={r8, 0x2000300, 0xe, 0x0, &(0x7f0000000000)="63eced8e46dc3f0adf3389f7b986", 0x0, 0x0, 0xf0ffff, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) sendmsg$IPCTNL_MSG_CT_NEW(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000008c0)={0x94, 0x0, 0x1, 0x401, 0x0, 0x0, {0xa}, [@CTA_TUPLE_ORIG={0x3c, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @empty}, {0x14, 0x4, @mcast1}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TUPLE_REPLY={0x3c, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @local}, {0x14, 0x4, @dev}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TIMEOUT={0x8}]}, 0x94}}, 0x0) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r9, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="3800000003010101"], 0x38}}, 0x0) r10 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r10, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000600)={0x64, 0x0, 0x1, 0x401, 0x0, 0x1a14, {0x2}, [@CTA_TUPLE_ORIG={0x24, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @multicast1}, {0x8, 0x2, @multicast1}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TUPLE_REPLY={0x24, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @initdev={0xac, 0x1e, 0x0, 0x0}}, {0x8, 0x2, @initdev={0xac, 0x1e, 0x0, 0x0}}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TIMEOUT={0x8, 0x7, 0x1, 0x0, 0xffff639c}]}, 0x64}}, 0x0) sendmsg$IPCTNL_MSG_CT_NEW(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)=ANY=[@ANYBLOB="3800000002011d04000000000000000002000000240001801400018008000100e000000108000200e00000010c000280050001"], 0x38}}, 0x0) 3m22.052040551s ago: executing program 0 (id=1841): socket$netlink(0x10, 0x3, 0x0) r0 = socket(0x10, 0x803, 0x0) (async) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newtaction={0x74, 0x30, 0x1, 0x70bd2c, 0x0, {}, [{0x60, 0x1, [@m_mpls={0x5c, 0x1, 0x0, 0x0, {{0x9}, {0x30, 0x2, 0x0, 0x1, [@TCA_MPLS_PARMS={0x1c, 0x2, {{0xffffffff, 0x10000, 0x0, 0xcb6, 0x2}, 0x1}}, @TCA_MPLS_PROTO={0x6, 0x4, 0x809b}, @TCA_MPLS_TTL={0x5, 0x7, 0x3}]}, {0x4, 0x4}, {0xc}, {0xc, 0x8, {0x0, 0x3}}}}]}]}, 0x74}, 0x1, 0x0, 0x0, 0x10}, 0x0) sendmsg$IPVS_CMD_SET_INFO(r0, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) (async) ioctl$sock_inet_SIOCGARP(r0, 0x8954, &(0x7f0000000300)={{0x2, 0x4e24, @broadcast}, {0x6, @local}, 0x42, {0x2, 0x4e24, @remote}, 'veth0_to_batadv\x00'}) (async) getsockname$packet(r0, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000040)=0x14) sendmsg$nl_route(r1, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000540)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r0, @ANYBLOB="0000e06c23a4000000004a641c001200970b0000000000000000000c000200080001000600", @ANYRES8=r1, @ANYRESHEX], 0x3c}}, 0x0) (async) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=@ipv4_newroute={0x30, 0x18, 0x1, 0xffc, 0x0, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, [@RTA_ENCAP_TYPE={0x6, 0x15, 0x6}, @RTA_ENCAP={0xc, 0x16, 0x0, 0x1, @MPLS_IPTUNNEL_TTL={0x5, 0x2, 0x7f}}]}, 0x30}, 0x1, 0x0, 0x0, 0x10}, 0x44880) (async) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) (async) r6 = socket$nl_generic(0x10, 0x3, 0x10) (async) r7 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0), 0xffffffffffffffff) sendmsg$TIPC_NL_LINK_GET(r6, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="01002cbd7000fddbdf2508000000180004801300010062726f61646361d5e6ca337342e4cf"], 0x2c}, 0x1, 0x0, 0x0, 0x844}, 0x4000000) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x1f, 0x18, &(0x7f0000000080)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020207021000000000020"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r8 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r8, 0x10e, 0xc, &(0x7f0000000440)={0x2, 0xfffffffc, 0x6}, 0x10) (async) r9 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$sock_int(r9, 0x1, 0xf, &(0x7f0000000180)=0x800001, 0x4) bind$inet6(r9, &(0x7f0000000240)={0xa, 0x4e22, 0x7f, @ipv4={'\x00', '\xff\xff', @local}, 0x1}, 0x1c) (async) setsockopt$sock_int(r9, 0x1, 0x2, &(0x7f0000000000)=0xa4, 0x4) (async) listen(r9, 0x2) (async) ioctl$sock_inet_SIOCSIFBRDADDR(r9, 0x891a, &(0x7f0000000400)={'wg0\x00', {0x2, 0x4e24, @initdev={0xac, 0x1e, 0x1, 0x0}}}) (async) sendmsg$nl_generic(r8, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)=ANY=[@ANYBLOB="20004e00001200010a000000000000000080000000"], 0x26}}, 0x0) (async) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x8, 0x4, &(0x7f0000001fd8)=ANY=[@ANYBLOB="1c00000000000000180a02000000000000000000000000009500000000bb0000"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', r5}, 0x94) (async) ioctl$int_in(r0, 0x5421, &(0x7f0000000180)) (async) sendmsg$nl_route(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="4400000010000100"/20, @ANYRES32=0x0, @ANYBLOB="0003f9ffffff000014001400766c616e31009ef1ffffffffffff000008000500", @ANYRES32=r5, @ANYBLOB='\b\x00\n\x00', @ANYRES32=r5, @ANYBLOB], 0x44}}, 0x884) 3m21.988309576s ago: executing program 0 (id=1843): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="05000000070000000700000001"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x1, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b70400000000000085000000c300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) (async) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, @fallback=0x31, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_GET_PROG_INFO(0xa, &(0x7f0000000740)={r1, 0x0, 0x0}, 0x10) (async) r2 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$inet_buf(r2, 0x0, 0x8008000000010, &(0x7f0000005e40)="17000000020001000003d68c5ee17688a2003208020300ecff3f0200000300000a000000009afc5ad9485bbb6a880000d6c8db0000dba67e060180000a0000f10607bdff59100ac45761407a681f009cee4a5acb3da400001fb700674f19b44e09f9315033bf79ac2dff060115003901000000000000ea000000000000000009ffff02dfccebf6ba0008400200000000e90554062a80e605007f71174aa951f3c63e5c83f1ba2112ce68bf17a6e000"/184, 0xb8) setsockopt$inet_tcp_TCP_REPAIR(r2, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) (async) r3 = socket$nl_generic(0x10, 0x3, 0x10) (async, rerun: 32) r4 = syz_genetlink_get_family_id$tipc(&(0x7f0000000040), 0xffffffffffffffff) (rerun: 32) sendmsg$TIPC_CMD_DISABLE_BEARER(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)={0x2c, r4, 0x12b084226d2dad07, 0x0, 0x0, {{}, {}, {0x0, 0x13, @udp='udp:syz0\x00'}}}, 0x2c}}, 0x0) (async, rerun: 64) r5 = accept4$ax25(0xffffffffffffffff, 0x0, &(0x7f0000000180), 0x800) (rerun: 64) r6 = getuid() ioctl$SIOCAX25DELUID(r5, 0x89e2, &(0x7f00000001c0)={0x3, @null, r6}) (async, rerun: 32) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r2, 0x6, 0x14, &(0x7f0000000540)=0x2, 0x4) (async, rerun: 32) connect$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @empty}, 0x10) (async) r7 = socket$inet6(0xa, 0x0, 0x7) sendto$inet6(r7, &(0x7f0000000280)="67846bd2c6cb7793d333cd7bb29e00cb0f0efb6d28a543de2fc2539ff1c185583cf767946c071a2e7bb766f6a201e775f55949685bc47892e6d570949955e9c0d725e522d4a74ed10b40dab24692e8e98917a139b208ae7848ce574674b7ad233432afe03c110ec1763c93247c4417c0a423cc83d56391a8ae0939235de4de5d78b5581418452b7a37891dc69242cf34d9fef321984c36f8df31171359944f8009916b9c07fba4f235f45b01ee9d91746471f3c82f2cd29282b4b2d52943696ceeb416ed7e60d57e52511653819371d0c9b8b20162262430264ad6b617a350690e0172bd98bb2506", 0xe8, 0x4, &(0x7f0000000200)={0xa, 0x4e20, 0x4, @local, 0x3}, 0x1c) 3m21.66053321s ago: executing program 0 (id=1849): r0 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000240)={0x3, 0x4, 0x4, 0xa, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000007c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(cast5)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000001280)="b7f2288a911993f08d3aae", 0xb) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000000900)=[{0x0, 0x0, &(0x7f0000000640)=[{&(0x7f00000000c0)="5bdbd57a0e656889964df9937f561de9b944d1e381fed329742e239cb13cf2af711d03d2f15b3118abd8fd087f117830209a631f9dfbec5cbbbb2216a2d87dfb0d7dd906c594125a10053c8e288ac4445ff0e999d423cc250e31e8650d248e49ba5fb3be8db01db38acf5a4455630ecb10f753530ada6598a1bf4c727f30db4778beff4805370a5cebf05e199368871b2751c242633419d13a6b05a390d21ab1d44be1254385b3d882c646f9762bf3480e05e98c9cc655adb7caa279e66709794e3b93cda0b9a14794e6d020cc68ea70e71a083e1a2b375591203ce218e8d244cf32f5dd7af0ee1ed032d3b59e4d571366", 0xf1}, {&(0x7f0000000000)="ef7791000dc7777cb951ca638ea0e1b5d280548c882aa59a68cd17c0e7f23d6d56a03be6caa272b3505e304463179c4d7768d9c3e5c21f3a9963ffde6682e5ecfe30b771e51c8d", 0x47}], 0x2, 0x0, 0x0, 0x806}], 0x1, 0x0) r3 = socket$nl_crypto(0x10, 0x3, 0x15) sendmsg$netlink(r3, &(0x7f0000000880)={0x0, 0x0, &(0x7f0000000840)=[{&(0x7f0000000180)=ANY=[@ANYBLOB="e000000010000b0500000000000000006f6d8864d22a3f2ffaa46c88bca90000002b0e13e735a3184f1b3d6da2f1acfac0ee50d2b184b27db1f302de337c0004060000000000bf852c89867f6691b01b2d44ecff2d5f28732c2dbd9423debbb86f9dba4a2dba4dbe076c02262600c446a567de243ab0d67683f7bb11c9cab3b3eed8a8bef4ff1631aa78ac86d603c1a66db4424a8ba100022db228bb7b5eb51001b2000000000000a0912086d9f4606d2e4cc898739222c5d3a83cb6c07c21dbb707f3336336ebb7d68100000011000080a64a6f8911"], 0xe0}], 0x1}, 0x0) recvmmsg(r2, &(0x7f0000002380)=[{{0x0, 0x0, &(0x7f0000000600)=[{&(0x7f0000000080)=""/64, 0x40}], 0x1}, 0x7fff}], 0x1, 0x2101, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$cgroup_int(r4, &(0x7f0000000200), 0xffffffc1) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x22051, r4, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x3, 0x25, &(0x7f0000000080)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x6f6}, {{0x18, 0x1, 0x1, 0x0, r4}}, {}, [@cb_func={0x18, 0x1, 0x4, 0x0, 0xfffffffffffffff8}, @ldst={0x1, 0x2, 0x3, 0x9, 0x6, 0xfffffffffffffffc, 0x8}, @map_idx_val={0x18, 0x2, 0x6, 0x0, 0x7, 0x0, 0x0, 0x0, 0xc}, @map_idx_val={0x18, 0x6ccbe9b02c1d7af2, 0x6, 0x0, 0x10, 0x0, 0x0, 0x0, 0x4}, @printk={@lu, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xe}}, @tail_call={{0x18, 0x2, 0x1, 0x0, r0}}, @map_idx_val={0x18, 0xb, 0x6, 0x0, 0x1, 0x0, 0x0, 0x0, 0x5}], {{}, {}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls=0x2f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x3, 0x8, &(0x7f0000000000)=ANY=[@ANYBLOB="180600000000000000000000120000", @ANYRES32=r0, @ANYBLOB="0000000000000000b703000000000000850000000c000000b7000000000000009500000000000000"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) 3m21.40723811s ago: executing program 0 (id=1852): r0 = accept4$unix(0xffffffffffffffff, &(0x7f0000000040)=@abs, &(0x7f00000000c0)=0x6e, 0x40000) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000100)={0x0, ""/256, 0x0, 0x0, 0x0, 0x0, ""/16, ""/16, ""/16, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_SUBVOL_CREATE_V2(0xffffffffffffffff, 0x50009418, &(0x7f0000000380)={{r0}, r1, 0x8, @inherit={0x60, &(0x7f0000000300)={0x1, 0x3, 0x5, 0x40, {0x0, 0x2770, 0x1000, 0x6, 0x2}, [0x0, 0x1000, 0x87]}}, @subvolid=0x8}) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r3, &(0x7f0000000380)={0x0, 0x4076cbba9945d516, &(0x7f0000000340)={0x0, 0x14}}, 0x0) getsockname$packet(r3, &(0x7f0000000400)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="400000001000390400"/20, @ANYRES32=r4, @ANYBLOB="01980000000000002000128008000100677265001400028008000100", @ANYRES32=r4], 0x40}, 0x1, 0x0, 0x0, 0x4014}, 0x4c094) r6 = socket(0x10, 0x3, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000003c0)=0x14) sendmsg$nl_route_sched(r6, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x44, 0x24, 0x5820a61ca228659, 0x0, 0xfffffffe, {0x0, 0x0, 0x0, r7, {0x0, 0x9}, {0xffff, 0xffff}, {0x5, 0x7}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_USC={0x10, 0x3, {0x6, 0x2}}}}]}, 0x79}}, 0x800) sendmsg$nl_route_sched(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000001780)=@newtfilter={0x78, 0x28, 0xd27, 0x70bd2b, 0x25dfdbfd, {0x0, 0x0, 0x0, r7, {0xffff, 0x9}, {}, {0xfff1, 0xb}}, [@filter_kind_options=@f_cgroup={{0xb}, {0x48, 0x2, [@TCA_CGROUP_ACT={0x34, 0x1, [@m_pedit={0x30, 0x7, 0x0, 0x0, {{0xa}, {0x4}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x2, 0x3}}}}]}, @TCA_CGROUP_POLICE={0x10, 0x2, [@TCA_POLICE_PEAKRATE64={0xc, 0x9, 0x10}]}]}}]}, 0x78}, 0x1, 0x0, 0x0, 0x8810}, 0x404c0c0) sendmsg$nl_generic(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000001ac0)={&(0x7f00000041c0)=ANY=[@ANYBLOB="140000002600010026bdf000fcf2ff2506"], 0x14}, 0x1, 0x0, 0x0, 0x4000d}, 0x20048000) 3m6.087009102s ago: executing program 32 (id=1852): r0 = accept4$unix(0xffffffffffffffff, &(0x7f0000000040)=@abs, &(0x7f00000000c0)=0x6e, 0x40000) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000100)={0x0, ""/256, 0x0, 0x0, 0x0, 0x0, ""/16, ""/16, ""/16, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_SUBVOL_CREATE_V2(0xffffffffffffffff, 0x50009418, &(0x7f0000000380)={{r0}, r1, 0x8, @inherit={0x60, &(0x7f0000000300)={0x1, 0x3, 0x5, 0x40, {0x0, 0x2770, 0x1000, 0x6, 0x2}, [0x0, 0x1000, 0x87]}}, @subvolid=0x8}) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r3, &(0x7f0000000380)={0x0, 0x4076cbba9945d516, &(0x7f0000000340)={0x0, 0x14}}, 0x0) getsockname$packet(r3, &(0x7f0000000400)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="400000001000390400"/20, @ANYRES32=r4, @ANYBLOB="01980000000000002000128008000100677265001400028008000100", @ANYRES32=r4], 0x40}, 0x1, 0x0, 0x0, 0x4014}, 0x4c094) r6 = socket(0x10, 0x3, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000003c0)=0x14) sendmsg$nl_route_sched(r6, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x44, 0x24, 0x5820a61ca228659, 0x0, 0xfffffffe, {0x0, 0x0, 0x0, r7, {0x0, 0x9}, {0xffff, 0xffff}, {0x5, 0x7}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_USC={0x10, 0x3, {0x6, 0x2}}}}]}, 0x79}}, 0x800) sendmsg$nl_route_sched(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000001780)=@newtfilter={0x78, 0x28, 0xd27, 0x70bd2b, 0x25dfdbfd, {0x0, 0x0, 0x0, r7, {0xffff, 0x9}, {}, {0xfff1, 0xb}}, [@filter_kind_options=@f_cgroup={{0xb}, {0x48, 0x2, [@TCA_CGROUP_ACT={0x34, 0x1, [@m_pedit={0x30, 0x7, 0x0, 0x0, {{0xa}, {0x4}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x2, 0x3}}}}]}, @TCA_CGROUP_POLICE={0x10, 0x2, [@TCA_POLICE_PEAKRATE64={0xc, 0x9, 0x10}]}]}}]}, 0x78}, 0x1, 0x0, 0x0, 0x8810}, 0x404c0c0) sendmsg$nl_generic(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000001ac0)={&(0x7f00000041c0)=ANY=[@ANYBLOB="140000002600010026bdf000fcf2ff2506"], 0x14}, 0x1, 0x0, 0x0, 0x4000d}, 0x20048000) 2m43.767937604s ago: executing program 5 (id=2264): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) bind$inet6(r0, &(0x7f00004b8fe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendto$inet6(r0, &(0x7f0000847fff)='X', 0x34000, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000380)=@newlink={0x44, 0x10, 0x1, 0x70bd27, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, 0x10424}, [@IFLA_IFNAME={0x14, 0x3, 'veth1_to_bond\x00'}, @IFLA_VFINFO_LIST={0x8, 0x16, 0x0, 0x1, [{0x4, 0x14}]}, @IFLA_LINKMODE={0x5, 0x11, 0x9}]}, 0x44}, 0x1, 0x0, 0x0, 0x801}, 0x60000090) r2 = socket$pppl2tp(0x18, 0x1, 0x1) r3 = socket$inet6_udp(0xa, 0x2, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r4, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10) setsockopt$inet_udp_encap(r4, 0x11, 0x64, &(0x7f0000000000)=0x2, 0x4) syz_emit_ethernet(0xbe, &(0x7f0000000000)={@local, @link_local, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0xb0, 0x0, 0x0, 0x0, 0x11, 0x0, @rand_addr=0x64010101, @dev={0xac, 0x14, 0x14, 0x21}}, {0x0, 0x4e20, 0x9c, 0x0, @wg=@initiation={0x1, 0x0, "7b4b143b7461fd777b1c012bd14efb9f49fcdb8f080c26a04883ad5c8c82b8af", "584cbf2649a50f2dbc43efa8698dfa871c51852e4451b57d037ad3c045942824251d7d17b5191584cdd4fbe40a27424d", "bcfd56f1373669caaa2f19935e6996c7096ffe4f3a4745a8f762b964", {"9a3bfbc1f39cb307b3472eb9cdb042d2", "643fcbb2c5a57df67d544af6e8dafe09"}}}}}}}, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x3}, 0x94) r5 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00', 0x7}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r5, 0x5, 0x0, 0x0, 0x0, 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r6, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@allocspi={0xf8, 0x16, 0x1, 0x0, 0x0, {{{@in=@private=0xa010100, @in6=@ipv4={'\x00', '\xff\xff', @empty}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, 0xa0}, {@in6=@ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x28}}, 0x0, 0x33}, @in6=@empty, {0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xfffffffffffffff1, 0x3}, {0x0, 0x0, 0x2, 0xfffffffffffffffe}, {0x0, 0x0, 0x796}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe55286f1921f74be}, 0x0, 0x1a0b1}}, 0xf8}}, 0x0) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="20010000120013070000000000000000e0000001000000000000000000000000fc00"/64, @ANYRES32=0x0, @ANYRES32=r3, @ANYBLOB="fc020000000000000000200100000000000000000000000000000000000000000000000000000000000000000000000000000000000000072c42572f64a264410b000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fbc18c8582fc7"], 0x120}}, 0x0) connect$pppl2tp(r2, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r3, {0x2, 0x0, @multicast2}, 0x2, 0x0, 0x4}}, 0x2e) r8 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) r9 = socket$inet6_mptcp(0xa, 0x1, 0x106) pipe(&(0x7f0000000c00)={0xffffffffffffffff}) r11 = epoll_create(0x4) epoll_ctl$EPOLL_CTL_ADD(r11, 0x1, r10, &(0x7f0000000040)={0x10000004}) epoll_ctl$EPOLL_CTL_MOD(r11, 0x3, r10, &(0x7f00000004c0)={0xe0000012}) pwrite64(r7, &(0x7f0000000240)="34cae745095fe9930bf8e82827ab20595169f5afccca76983062d6d293c70b18acbf5a82def30384d198986e94c0a30a12538cbe4baced8b9db662954854da4db6c85e7bc3e962306e75b6cf89439464709bc9ab778045f55323eb3f51cd4f3cd920b160e667ba4ade7ac24a8634ea2c3156531be7833a4ec7373aed2ffcdc28831cd1f03702c32b031c89f89c55e3ab2f848c98cff0de7d661be1e07f8736d882fe075a23f81ea8d7", 0xa9, 0x693) setsockopt$inet6_mreq(r9, 0x29, 0x6, 0x0, 0x0) ioctl$SIOCSIFMTU(0xffffffffffffffff, 0x8922, &(0x7f0000000080)={'ip6gre0\x00', 0x7}) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="3c000000bef2594e2e81f968a27bb5a937531e9f7422a359cd08040795105898739139be8e350a02", @ANYRES16=r8, @ANYBLOB="01002cbd7010fddbdf2505000000080009000200000008000c00a80a0000060001000500000008000b00020000000500050000000000"], 0x3c}}, 0x20000034) recvmmsg(r0, &(0x7f00000040c0)=[{{0x0, 0x0, 0x0}, 0x9}], 0x1, 0x1, 0x0) 2m43.569008745s ago: executing program 5 (id=2267): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b0000000000004ee9c428000080000000000000", @ANYRES32, @ANYRES8, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) r1 = accept4$ax25(0xffffffffffffffff, &(0x7f0000000340)={{0x3, @default}, [@remote, @null, @netrom, @default, @bcast, @netrom, @default, @null]}, &(0x7f0000000640)=0x48, 0x0) getsockopt$bt_hci(r1, 0x0, 0x1, &(0x7f0000000680)=""/250, &(0x7f0000000780)=0xfa) (async) getsockopt$bt_hci(r1, 0x0, 0x1, &(0x7f0000000680)=""/250, &(0x7f0000000780)=0xfa) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x1f, 0x14, &(0x7f0000001440)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x3ff}}, @printk={@ld, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0xb0}}]}, &(0x7f0000000200)='GPL\x00', 0x4, 0x0, 0x0, 0x41000, 0x70, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2000}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000500)={r2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) r4 = socket$inet6_mptcp(0xa, 0x1, 0x106) getsockopt$inet6_tcp_int(r4, 0x6, 0x1e, 0xffffffffffffffff, &(0x7f00000002c0)) socket$inet_tcp(0x2, 0x1, 0x0) (async) r5 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IP_VS_SO_SET_ZERO(r5, 0x0, 0x48f, &(0x7f0000000140)={0x11, @initdev={0xac, 0x1e, 0x1, 0x0}, 0x4e20, 0x0, 'lc\x00', 0xa, 0x401, 0x65}, 0x2c) (async) setsockopt$IP_VS_SO_SET_ZERO(r5, 0x0, 0x48f, &(0x7f0000000140)={0x11, @initdev={0xac, 0x1e, 0x1, 0x0}, 0x4e20, 0x0, 'lc\x00', 0xa, 0x401, 0x65}, 0x2c) r6 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r6, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)={0x2, 0xc, 0x81, 0x3, 0x5, 0x0, 0x6c0b, 0x25dfdbfb, [@sadb_address={0x3, 0x7, 0x3c, 0x80, 0x0, @in={0x2, 0x4e20, @multicast2}}]}, 0x28}}, 0x4) r7 = socket$pppl2tp(0x18, 0x1, 0x1) socket$inet6_udp(0xa, 0x2, 0x0) (async) r8 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r7, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r8, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x20}}, 0x2}}, 0x2e) r9 = syz_genetlink_get_family_id$l2tp(&(0x7f00000008c0), 0xffffffffffffffff) socket$nl_generic(0x10, 0x3, 0x10) (async) r10 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(r10, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000005c0)={0x44, r9, 0x1, 0x1070bd2c, 0x4, {0x5}, [@L2TP_ATTR_PW_TYPE={0x6, 0x1, 0x5}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x2}, @L2TP_ATTR_SESSION_ID={0x8}, @L2TP_ATTR_SESSION_ID={0x8, 0xb, 0x2}, @L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0x8}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0xb}]}, 0x44}, 0x1, 0x0, 0x0, 0x20048001}, 0x30) sendmsg$nl_xfrm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=@updpolicy={0x23c, 0x19, 0x1, 0x0, 0x0, {{@in6=@private2, @in6=@empty, 0x0, 0x3, 0x0, 0x0, 0xa, 0x0, 0x20, 0x8}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1d}, {0x0, 0x0, 0x0, 0x2dd}}, [@tmpl={0x184, 0x5, [{{@in=@dev={0xac, 0x14, 0x14, 0x3b}, 0x0, 0x2b}, 0x0, @in=@dev={0xac, 0x14, 0x14, 0xc}, 0x0, 0x0, 0x0, 0xff}, {{@in6=@private2, 0x0, 0x32}, 0x0, @in6=@private1}, {{@in6=@empty, 0x0, 0x3c}, 0x2, @in=@remote, 0x0, 0x1, 0x3}, {{@in6=@mcast2, 0x0, 0x3c}, 0x2, @in6=@rand_addr=' \x01\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, {{@in=@loopback, 0x0, 0x3c}, 0x2, @in=@empty, 0xffffffff}, {{@in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x0, 0x33}, 0x0, @in=@broadcast, 0x0, 0x1}]}]}, 0x23c}}, 0x0) (async) sendmsg$nl_xfrm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=@updpolicy={0x23c, 0x19, 0x1, 0x0, 0x0, {{@in6=@private2, @in6=@empty, 0x0, 0x3, 0x0, 0x0, 0xa, 0x0, 0x20, 0x8}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1d}, {0x0, 0x0, 0x0, 0x2dd}}, [@tmpl={0x184, 0x5, [{{@in=@dev={0xac, 0x14, 0x14, 0x3b}, 0x0, 0x2b}, 0x0, @in=@dev={0xac, 0x14, 0x14, 0xc}, 0x0, 0x0, 0x0, 0xff}, {{@in6=@private2, 0x0, 0x32}, 0x0, @in6=@private1}, {{@in6=@empty, 0x0, 0x3c}, 0x2, @in=@remote, 0x0, 0x1, 0x3}, {{@in6=@mcast2, 0x0, 0x3c}, 0x2, @in6=@rand_addr=' \x01\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, {{@in=@loopback, 0x0, 0x3c}, 0x2, @in=@empty, 0xffffffff}, {{@in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x0, 0x33}, 0x0, @in=@broadcast, 0x0, 0x1}]}]}, 0x23c}}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x11, 0xb, &(0x7f0000000100)=ANY=[@ANYRES16], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xffffffff}, 0x94) 2m43.431814121s ago: executing program 5 (id=2269): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000003c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(cast6-generic)\x00'}, 0x58) (async) r1 = accept4(r0, 0x0, 0x0, 0x0) (async) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000200)="ad00"/16, 0x10) sendmsg$NFT_BATCH(r1, &(0x7f00000006c0)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000700)=ANY=[@ANYBLOB="140000001000010000000000000000000100000a2c000000080a010300000000000000000700000a0900010073797a97650000000c0003400000000000000004140000001100010000000000000000000300000a3f5ab38e68aac931180e46b26154033620c0f9a80cd20c19bd8278003e7fab5dbb85f37b6054ea6718"], 0x54}, 0x1, 0x0, 0x0, 0x91}, 0x4008041) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000080)={'ip6gretap0\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=ANY=[@ANYBLOB="380000005500e502000000000000000007000000", @ANYRES32=r3, @ANYBLOB="200001"], 0x38}}, 0x0) (async, rerun: 32) readv(r1, &(0x7f0000000140)=[{&(0x7f0000000600)=""/152, 0x98}], 0x1) (async, rerun: 32) sendmsg$IPSET_CMD_SAVE(r1, &(0x7f00000004c0)={&(0x7f0000000340), 0xc, &(0x7f0000000480)={&(0x7f0000000440)=ANY=[@ANYBLOB="1c008ee140000000000000003368eae6"], 0x1c}, 0x1, 0x0, 0x0, 0x4000010}, 0x800) (async) sendmsg$NL80211_CMD_CONNECT(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000001c0)=ANY=[@ANYRESDEC=r1], 0x34}, 0x1, 0x0, 0x0, 0x4046814}, 0x20048810) (async, rerun: 32) recvmmsg(r1, &(0x7f0000002440), 0x3ffffffffffff67, 0x0, 0x0) (rerun: 32) socket$packet(0x11, 0xa, 0x300) (async) sendmsg$IPCTNL_MSG_CT_GET(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={0x0}}, 0x0) (async) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x11, 0x5, &(0x7f0000000280)=ANY=[@ANYBLOB="1801000021000000000000004cc311ec8500000075000000a70000000800000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000000)='kfree\x00', r4}, 0x10) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a05000000000000000000010000000900010073797a300000000040000000030a01010000000000000000010000000900030073797a310000000014000480080002400000000008000140000000000900010073797a300000000070000000060a010400000000000000000100000048000480240001800b00010072656a65637400001400028008000140000000000500020000000000200001800700010072740000140002800800014000000009080002400000000008000b40000000000900010073797a300000000014000000110001"], 0xf8}, 0x1, 0x0, 0x0, 0x2040441}, 0x0) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYRES16=r5], 0x48) (async) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000bc0)={&(0x7f0000000040)='sys_exit\x00'}, 0x18) (async) bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000100), 0x34) (async) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x810) (async) r6 = socket$rds(0x15, 0x5, 0x0) (async) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r7, 0x0, 0x404c804) setsockopt$RDS_GET_MR(r6, 0x114, 0x2, &(0x7f0000000280)={{&(0x7f0000000200)}, &(0x7f0000000240), 0x16}, 0x20) (async) socket$nl_netfilter(0x10, 0x3, 0xc) (async) syz_init_net_socket$bt_rfcomm(0x1f, 0x3, 0x3) 2m43.208633545s ago: executing program 5 (id=2272): r0 = socket$inet6(0xa, 0x3, 0x8) sendmmsg$inet6(r0, &(0x7f0000004580)=[{{&(0x7f0000000100)={0xa, 0x0, 0x9, @mcast2}, 0x1c, 0x0, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB='$'], 0x28}}], 0x1, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) getsockopt$bt_BT_RCVMTU(r1, 0x112, 0xd, &(0x7f0000000680)=0xffff, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) r2 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r2, &(0x7f0000000000), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000000180)={'vxcan1\x00', 0x0}) bind$can_raw(r2, &(0x7f0000000200)={0x1d, r3}, 0x10) r4 = socket$inet_tcp(0x2, 0x1, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={0xffffffffffffffff, 0x0, 0x10, 0x38, &(0x7f00000002c0)='\x00\x00\x00\x00\x00\x00\x00\x00', &(0x7f0000000300)=""/8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) bind$inet(r4, &(0x7f00000001c0)={0x2, 0x4e22, @local}, 0x10) connect$inet(r4, &(0x7f0000000080)={0x2, 0x0, @remote}, 0x10) syz_emit_ethernet(0x7f, &(0x7f0000000140)={@local, @remote, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x2, 0x71, 0x0, 0x4000, 0x0, 0x6, 0x0, @remote, @local}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x2, 0x8, 0x10, 0x0, 0x0, 0x2d9, {[@timestamp={0x8, 0xa, 0x0, 0x4ffffffe}]}}, {"f612f71e664e1e708d305ed5744fc115fac6e8dde8714aa5bdc29c74fc3cdeb6ffb87d343aaeef839591f219260160bf00"/61}}}}}}, 0x0) 2m43.129394598s ago: executing program 5 (id=2273): r0 = socket$netlink(0x10, 0x3, 0x10) r1 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r1, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r2 = socket$packet(0x11, 0x2, 0x300) sendmsg$AUDIT_USER(r0, &(0x7f0000000640)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000600)={&(0x7f0000000500)={0xf8, 0x3ed, 0x400, 0x70bd2c, 0x25dfdbfd, "6174adebe6b54c0daee658820d9d1b37ff10c4f126504dadfc9ef9b74df025d9621ccb8cc4227b77b94fc37404c0b0a5820b19acd3a7b8c49b1bbaca3fb8b23a4686f76b5cddd5fc2698013797b728243452877dc5e3b8297288b63aaaee1ed7b7e8712baf043fd701b211cbfccbc9fc8bef45df54ff23c3152e3f393b92c6a5c8d3faaae19a4fd6487000f2cbbd5bb8b649f1c6e4812286bf1b2c81573b312f92c94347ca768ec7734976c5372ae3e36f23424139651b7227373ebe90615297de66301414b7790cee126744126b2500b12ba792f14443f66d5049e31fc1f7767e32c733041f79", ["", "", "", "", ""]}, 0xf8}, 0x1, 0x0, 0x0, 0x40000}, 0x4080) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000300)=ANY=[@ANYBLOB="380090dd2c08410ec370b28a0a5c000018000100000000000000000002000000fc04000900f7ffff050015000200000014001780100008800c000180050002001a0000002a22a2b91f6228f555357d4b466eacdd73c966ce7a439b2834bd66d72b2c86cf58c571ca93b405e135320a3b6ecb0b637cb58fc78d8170526bc6c41a70b159c758021ec8e1ec26d6faf418e1e0cf1b038d18215a4036450602d6617eef10bdef36f8b21f5bc416ce03d858d6a446f8dc9cbf6b25e5cc152d6fa970e486cb852ba79cfeaf82926c86a68d9f2eaab11592bf21b52305bd1defd6c6fd1a155bcddc2bcd08a98c800e53c08ab8862f2d1e0971428d8e65d02b1eb8bda8aeb5a7d7ba6ebe408c5b6300"/281], 0x38}}, 0x2000a080) socket$kcm(0x2, 0xa, 0x2) sendto$packet(r2, 0x0, 0x0, 0x0, 0x0, 0x0) mmap(&(0x7f0000004000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000003400)={0x10, 0x6, &(0x7f0000000740)=@raw=[@call={0x85, 0x0, 0x0, 0xc}, @tail_call], &(0x7f0000000140)='GPL\x00', 0x0, 0x0, 0x0, 0x41100}, 0x94) socket$kcm(0x2, 0x100000000000000a, 0x0) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f0000000000)=0x7a28, 0x4) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x13, 0x0, 0x0) r4 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000d00), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f00000000c0)={'veth1_to_bond\x00'}) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_LINK_GET(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000700)=ANY=[@ANYBLOB='|\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="030700000000000000000800000068000480"], 0x7c}, 0x1, 0x0, 0x0, 0x20000001}, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff) r6 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000440)='blkio.bfq.io_service_bytes_recursive\x00', 0x0, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000180)=ANY=[@ANYBLOB="2c0000001e00431b000000000000000007000000", @ANYRES32, @ANYBLOB="000017000000000008000a00", @ANYRESHEX], 0x2c}}, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r6, 0x6, 0xd, &(0x7f0000000480)='scalable', 0x8) writev(0xffffffffffffffff, &(0x7f0000000380)=[{&(0x7f0000000280)="3986c2d48cf8c83702fb70f5a5a23d944bacc4a2db953e112d8eb30c9201b8152738018f166c52b74cf381b67e42b52177e60cbb6161cd623a34e4af8c089e872072820fffc518e02191ca97f0430f39d4136e3131afea10b8ea1c08160b29a97555e91176ae7370f726717842cf76a06a4092a0b6987feb0aeb79dd84035c6eb2e2", 0x82}], 0x1) writev(0xffffffffffffffff, &(0x7f0000000400)=[{&(0x7f0000000300)='0', 0x1}], 0x1) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={0xffffffffffffffff, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000300)=""/8, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000001c0)={0xd, 0x1d, &(0x7f00000007c0)=@raw=[@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r6}, {}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @tail_call={{0x18, 0x2, 0x1, 0x0, r6}}, @jmp={0x5, 0x0, 0x9, 0xb, 0x3, 0xffffffffffffffc0, 0x1}, @map_fd={0x18, 0x6, 0x1, 0x0, r6}, @ldst={0x1, 0x1, 0x4, 0x0, 0x0, 0x80}, @generic={0xa0, 0x9, 0x9, 0x8, 0xa}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r6}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x3}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x2}}, @ldst={0x2, 0x0, 0x3, 0xa, 0x2, 0xffffffffffffffff, 0xfffffffffffffff0}], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xf}, 0x94) r8 = syz_init_net_socket$ax25(0x3, 0x2, 0xa4) bind$ax25(r8, 0x0, 0x0) 2m42.836548565s ago: executing program 5 (id=2275): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000001ac0)={&(0x7f00000041c0)=ANY=[@ANYBLOB="140000002600010026bdf000fcf2ff2506"], 0x14}, 0x1, 0x0, 0x0, 0x4000d}, 0x20048000) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000f80), r2) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_STATION(r2, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000400)={0x28, r3, 0xb97534d5fe9704cf, 0x0, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r4}, @void}}, [@NL80211_ATTR_MAC={0xa}]}, 0x28}, 0x1, 0x0, 0x0, 0x80c1}, 0x0) sendmsg$NL80211_CMD_DEL_PMKSA(r0, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x20, r3, 0x400, 0x70bd29, 0x25dfdbfc, {{}, {@void, @void}}, [@NL80211_ATTR_MAC={0xa, 0x6, @from_mac}]}, 0x20}, 0x1, 0x0, 0x0, 0x10000}, 0x80) 2m27.703004739s ago: executing program 33 (id=2275): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000001ac0)={&(0x7f00000041c0)=ANY=[@ANYBLOB="140000002600010026bdf000fcf2ff2506"], 0x14}, 0x1, 0x0, 0x0, 0x4000d}, 0x20048000) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000f80), r2) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_STATION(r2, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000400)={0x28, r3, 0xb97534d5fe9704cf, 0x0, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r4}, @void}}, [@NL80211_ATTR_MAC={0xa}]}, 0x28}, 0x1, 0x0, 0x0, 0x80c1}, 0x0) sendmsg$NL80211_CMD_DEL_PMKSA(r0, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x20, r3, 0x400, 0x70bd29, 0x25dfdbfc, {{}, {@void, @void}}, [@NL80211_ATTR_MAC={0xa, 0x6, @from_mac}]}, 0x20}, 0x1, 0x0, 0x0, 0x10000}, 0x80) 50.361430188s ago: executing program 3 (id=2897): r0 = socket(0x2, 0x400000000002, 0x0) setsockopt(r0, 0x0, 0x20, &(0x7f00000012c0)="15020000", 0x4) r1 = socket$can_raw(0x1d, 0x3, 0x1) r2 = socket$kcm(0x2d, 0x2, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000400)={0x5, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18080000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000700000095"], &(0x7f00000000c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000580)="d8001c00180081064e81f782db44fd56170d12a0b9b545c7", 0x18}], 0x1}, 0x0) ioctl$sock_kcm_SIOCKCMATTACH(r2, 0x89e3, &(0x7f0000000180)={0xffffffffffffffff, r3}) socket$pppl2tp(0x18, 0x1, 0x1) unshare(0x40000000) r4 = socket(0x2, 0x80805, 0x0) r5 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r5, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r5, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x10, &(0x7f00000001c0)=[@in={0x2, 0x4e23, @rand_addr=0x64010100}]}, &(0x7f0000000140)=0x10) getsockopt$inet_sctp_SCTP_GET_ASSOC_STATS(r4, 0x84, 0x70, &(0x7f0000000400)={r6, @in6={{0xa, 0x4e21, 0x9, @local, 0x6}}, [0x8, 0xfff, 0x10001, 0x2, 0x9, 0xcc, 0x4, 0x5, 0x80000000, 0xc, 0x1, 0x100000000, 0x5, 0xd56, 0x7fffffff]}, &(0x7f0000000080)=0x100) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, r7, 0x0) r8 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r8, 0x10e, 0xc, &(0x7f0000000180)={0x6}, 0x10) getsockopt$CAN_RAW_FILTER(r1, 0x65, 0x1, &(0x7f0000000040)=[{}, {}, {}, {}, {}, {}], &(0x7f0000000000)=0x30) 30.640969757s ago: executing program 1 (id=2956): r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000600)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x50) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=@base={0xe, 0x4, 0x8, 0x1}, 0x48) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0x10, &(0x7f0000000280)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000501b702000002000000850000008600000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bca2000000000000a6020000f8ffffffb703000008000000b7040000dd010000070000003300000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000040)={r4, r1, 0x25, 0x0, @void}, 0x10) syz_emit_ethernet(0x3a, &(0x7f0000000600)={@local, @empty, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x2c, 0x2, 0x0, 0x0, 0x11, 0x0, @empty, @empty}, {0x4e25, 0x4e20, 0x18, 0x0, @wg=@data={0x4, 0x7407, 0xfffffffffffffffa}}}}}}, 0x0) 30.283863578s ago: executing program 1 (id=2957): unshare(0x22020400) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="1b00000000000000000000000080000000000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000000000000000000000000000000000000000000000000000055db69e6f29903acfb63592a699ea2b6a9fa78ab30c043195f9373f06ac0ab3ea2a865ae3a23045bcb8f5bd7182fb1fb736ae9eaa9d08dcf5abbf6598b6c1a49a22e1f40612ad1632058590ed99ed8fba0af3a9b394e511b5830060038e27b11d93a34f9feb4cd321472f8997e5d74"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000007c0)={0x11, 0x18, &(0x7f0000000440)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0xffffffff}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x3ff}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x2}}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0xed41d0969ec4053c, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 30.015562962s ago: executing program 1 (id=2958): r0 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000040)=ANY=[@ANYBLOB="1800000002000000000000000000082295"], &(0x7f0000000180)='syzkaller\x00', 0x0, 0x0, 0x0, 0x1e00, 0x21}, 0x94) r1 = socket$kcm(0x29, 0x7, 0x0) r2 = accept$ax25(r0, &(0x7f00000000c0)={{}, [@default, @bcast, @remote, @bcast, @null, @default, @remote, @netrom]}, &(0x7f00000001c0)=0x48) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=@newsa={0x144, 0x10, 0x1, 0xbffffffe, 0x100, {{@in=@empty, @in6=@ipv4={'\x00', '\xff\xff', @remote}, 0x1, 0x394, 0x4e23, 0x5, 0x0, 0x0, 0x0, 0x3a}, {@in6=@mcast2, 0x4d4, 0x6c}, @in=@remote, {0x0, 0x9, 0x6, 0xffff, 0x8251c, 0x2, 0xfffffffffffffff8}, {0x6, 0x0, 0x1f, 0x1ff}, {0x2, 0xfffffffc}, 0x70bd2a, 0x3504, 0xa, 0x1, 0xfd, 0x20}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}, @mark={0xc, 0x15, {0x35075a, 0x3}}]}, 0x144}, 0x1, 0x0, 0x0, 0x8801}, 0x10) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000500)=@newsa={0x138, 0x10, 0x1, 0xfffffffe, 0x100, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x1, 0x714, 0x4e23, 0x5, 0x0, 0x0, 0x0, 0x3a}, {@in6=@mcast2, 0x4d4, 0x6c}, @in=@loopback, {0x0, 0x192, 0x6, 0xfffb, 0x8251c, 0x2, 0xfffffffffffffff8}, {0xffffffffffffffff, 0x0, 0x1f, 0xfffffffffffffffe}, {0x2, 0x3ff, 0x4}, 0x70bd2a, 0x0, 0xa, 0x1, 0x0, 0x20}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}]}, 0x138}, 0x1, 0x0, 0x0, 0x8801}, 0x0) r5 = socket$kcm(0xa, 0x5, 0x0) sendmsg$kcm(r5, &(0x7f00000002c0)={&(0x7f0000000240)=@l2tp={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x20}, 0x3}, 0x80, &(0x7f0000000140)=[{&(0x7f0000000540)="19", 0x1}], 0x1}, 0x0) setsockopt$sock_attach_bpf(r5, 0x29, 0x6, 0x0, 0x0) ioctl$sock_kcm_SIOCKCMUNATTACH(r1, 0x89e1, &(0x7f0000000200)={r2}) r6 = socket$inet6(0xa, 0x3, 0x3) mmap(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x1000001, 0x30, r6, 0x9f27a000) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000400)={r0, 0x0, 0x25, 0x0, @void}, 0x10) r7 = socket$nl_route(0x10, 0x3, 0x0) bind(r2, &(0x7f0000000240)=@pptp={0x18, 0x2, {0x2, @multicast1}}, 0x80) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x14080, 0x10000}, [@IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r0}]}, @IFLA_GROUP={0x8}]}, 0x34}, 0x1, 0x0, 0x0, 0x20000040}, 0x0) 28.970511793s ago: executing program 1 (id=2961): unshare(0x6a040000) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='io.stat\x00', 0x275a, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$rds(0x15, 0x5, 0x0) getsockopt$rose(0xffffffffffffffff, 0x104, 0x7, 0x0, 0x0) bind$rds(r2, &(0x7f0000000040)={0x2, 0x4e21, @local}, 0x10) sendmsg$rds(r2, &(0x7f00000002c0)={&(0x7f00000000c0)={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, &(0x7f0000000640)}, 0x0) socket$inet6_sctp(0xa, 0x5, 0x84) r3 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000bc0)=ANY=[@ANYRES8=r1, @ANYRESDEC=r0, @ANYRES32=r2, @ANYRESHEX, @ANYRES32=r1, @ANYBLOB="f2e418f93ddf40768cf489701e568aed2fe79d62499d2f3402c02976ac33eda868e0e80cb1f2ab5f8d5705d9eb13669fb2bc34a5183bb81b4067067cd0df534ecf999af44690aceafbc5f0b15f6b4c6c34da9211ef128bad849d0083fd5334f14f4b48c6fa155c6c24d7148baef443ecb5df08f54305276825da9260b8b42e2965f58409f13173624e39eab865305b5e8134e7817c38ee95b22a6eb92e3bdc851e349e85546af3e35f31b70237f8b719ea0d6451b1dd1377c2fe50710f13f4f6ab970a3761d1", @ANYRESHEX=r1, @ANYBLOB="3ca16a9e4fc32049237c6c4d0578d9859991287cfd20b1597dfccd3b93b025293e38d8b7ed795573b22b0fbaae1ee2965e7240d3e5388d7d550a010c042347b7dcfa6ae7d9d1a5ae8917e1330b541d59af149d7f0be09491e786649a7bffa51236e9dd504325c2a2481cbcfb1153e1a307bdf93be5e4b041db769a520123e37ed4812fdeda24b3234c2488e30d2ff09dcd3ef7388abf6998701e73f3488ff7fa7ad2e73a1927f4ce023713a6b8d2d4622303e4b7e4559508d330f5a14211e83fb4a03d04bc"], 0x48) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x11, 0xf, &(0x7f00000003c0)=ANY=[], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x37, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000140)='kmem_cache_free\x00', r4}, 0x10) ppoll(&(0x7f0000000500)=[{r3}], 0x1, 0x0, 0x0, 0x0) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x0, 0x3, 0xfffffffffffffffd}, 0x0, &(0x7f00000002c0)={0x3ff, 0x0, 0x0, 0x9, 0x0, 0x0, 0x7fffffff}, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) write$cgroup_int(r0, &(0x7f0000000200), 0xffffffc1) socket$inet6(0xa, 0x2, 0x0) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) r6 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r6, &(0x7f0000001600)={0x0, 0x0, &(0x7f00000015c0)={&(0x7f0000000540)=ANY=[@ANYBLOB="5772335d539ccfe625bd7000fddbdf25434728c51df21fd29c45a89275c4fe9194f7292e02b1e3c253aecdc73b72414fd1cf2cc226ce48ceb008b50ceff3fbc3cc218ef7491fda7a6e737622c2bef22d99e33dff9d05aba05930a1e51be8401c1a1b5465d3ab5a6a8b8c6dffdb0c32d8a4be83caa4493b5fa5bafeb25449e3e08ff1a74cafea92285394a6a90f629be4270b5c6f1699eaad182e3e30629fe2bd8ba76244b02419f88aa81d2436bc4dcaff50d7ddd46771da31add296c5292937eaa4e4976b9c6f31a8957229ee339bc51c96a1fa150aaddc3acb98ed211fbf5740acb2b4d7d1ddad021cb976891e62cb1cf55a2ec0df907b2fbb767278417318abf3bbaaae0b9059f6217c14a07193f56b90926e88ef7fe9a5be1b13b71253efb46ba66327430c0746a12c3c8990a55d785d9343ed4f7bb8603d99008a136d9e8e5daa725eba6f233af381e28b815e93ff9420ab4d8a6450c60e68404076a128c056d95eec3503b5515336646b1d4629de6f8e41a8953b2aa2c64543eef58b1b43650d1198e250ecafab0aae4837d054064a74d0bb11c4824477"], 0x10}}, 0x810) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) write$tun(r5, &(0x7f00000002c0)=ANY=[], 0xfdef) r7 = socket$inet(0x2, 0x2, 0x1) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r8, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="500000001000050400"/20, @ANYRES32=0x0, @ANYBLOB="00885c77636af8959e2c8e30223be972000000000000bd0c0012800b00010065727370616e00002000028004001200060018000d10000005001600020000000500170000000000"], 0x50}, 0x1, 0x0, 0x0, 0x49040}, 0x0) bind$inet(r7, &(0x7f0000000000)={0x2, 0x6e24, @empty}, 0x10) r9 = socket$inet(0x2, 0x2, 0x1) setsockopt$sock_int(r9, 0x1, 0x2, &(0x7f0000000080), 0x4) bind$inet(r9, &(0x7f0000000000)={0x2, 0x6e24, @empty}, 0x10) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x22051, r0, 0x0) openat$cgroup_ro(r0, &(0x7f0000000180)='memory.events\x00', 0x275a, 0x0) 21.920582384s ago: executing program 1 (id=2982): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0xa, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={r0, 0x2000000, 0xe, 0x0, &(0x7f0000000200)="63eced8e46dc3f0adf33c9f786dd", 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000500)={&(0x7f0000000540)=ANY=[@ANYBLOB="9feb0100180000000000000038000000380000000400000002000000000000110400000000000000000000000000000200000000020000000000000602000000020000000000000e0300000000000000000061"], 0x0, 0x54}, 0x28) bpf$BPF_PROG_DETACH(0x1c, &(0x7f0000000580)=ANY=[@ANYRESHEX=r0, @ANYRES32, @ANYRES32, @ANYBLOB='/\x00'/12, @ANYBLOB="df9adbff08523681ee9bde50e468f03218676d660b77230cd6974ec663afc49929b0ecaf9f409ed80b7872f835d0e0d1c0580ac8b50b7ad697749c2d1fc42f795359d151cec5b58edf718386f8a84ba24418ffffff7f538753aaa0daec97038dd7c234d5b5238ea122d8bdebe88f1fbb73e5257febd80e40e5a9ae412148a91bb55608ec3f9d975dff33965913275874c5bbda6ac1c4db62a46de6051a2aa7cf3f1c4435bf16547136c4b3bc589c8676f9690d202bb13bd2e7c35a84e6ffb43b00b2f6a45c68fcd9e6b6b3d981d3b171949270a41f63aa4a", @ANYBLOB="7fb733358c739a898d1fd6e2f7ba27dca68b910dba27da03e24e7ee72c7012709d403835397a2038e23ac52358dffed2e6bf3d35bcac3c3d0be345d7a89bb3c35d1fa08ea4c8c9d6962c2bb275416c7345822c0aab257b33efd65ffac19c74cdeda5048acc52247e26b5b3c85e33b446b390892846ccbaf5820992f100c7303bd150b1e9d7000fd88c8272cc20fe84413dc6ee1eb73e27f075988397cccdb32bf5b55a797679790494b92a9370ef49cde4febd7f67c705681bf17d592059865e03e01ab1334dbd980a9b49c967c0b13723e1f73f22b2a97ae1d14e67beb1099a1886eb4554751c6a467f27000f94e65f42cf64204d31"], 0x20) r1 = socket$tipc(0x1e, 0x2, 0x0) ppoll(&(0x7f0000000500)=[{r1, 0x208}], 0x1, &(0x7f0000000580), 0x0, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_START_AP(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000540)=ANY=[@ANYBLOB="80000000", @ANYRES16, @ANYBLOB="050000000000000000000f00000008000300", @ANYRES32=0x0, @ANYBLOB="0c009900040000005300000057000e0048"], 0x80}}, 0x0) 21.170094973s ago: executing program 1 (id=2985): unshare(0x20000400) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, &(0x7f00000038c0)=ANY=[@ANYBLOB="620af8ff0c200021bfa100000000000007010000f8ffffffb702000003000000bd120000000000008500000006000000b70000000000000095000000000000003faf4f1e7f2aa3d9b18ed81c0c869b51ec6c0af4e0e4a9446c7670568982b4e020f698393aa0f3881f9c24aa56f15199fad0093c59d66b5ece9f36c70d0f13905ea23c22624c9f87f9793f50bb546040677b0c5077da80fb982c1e9400e693146cea484a415b76966118b64f751a0f241b072e90080008002d75593a625704f07a72c234664c0af9360a1f7a5e6b607130c89f18c0c1089d8b853289e01aa27ae8b09e00e79ab20b0b8e1148f49faf2ad0000000000000006fa03c6468972089b302d7bf6023cdcedb5e0125ebbc08dee510cb2364149215108333719acd97cfa107d40224edc5465a932b77e74e802a0d42bc6099ad2300000080006ef6c1ff0900000000000010c63a949e8b7955394ffa82b8e942c89112f4ab87b1bfeda7be586602d985430cea0162ab3fcf4591c926abfb0767192302000000b0eea24492a660583eecb42cbcd3de3a83209da17a0faf60fd6ad9b97aa5fa68480366c9c6fd6fa5043aa3926b81e3b59c95c25a573dc2edcaea2b1a52496dfcaf99431412fd134a996382a1a04d5bb924cfe5f3185418d605ffff9c4d2ec7c32f2095e63c80aff9fa740b5b7632f32030916f89c6dad7603f2ba2a790d62d6faec2fed44da4928b30142ba11de6c5d50b83bae613402216b5054d1e7c13b1355d6f4a8245ffa4997da97e22f4c0eb97fca585ec6bf58351d564beb6d952aab9c70764b0a8a7583c90b3433b809bdb9fbd48bc873495cbff8a326eea31ae4e0f7505ebf6c9d13330ca005ace1a84521f14518c9b476fccbd6c712016219848624b87cec2dbe98223a0eb4fa39f6b5c02e6d6d90756ff57902a8f57000000009700cf0b4b8bc2294133000000000000000000030000000000000000000000000010008bc0d9559711e6e8861c46495ba585a4b2d02edc3e28dd271c896249ed85b980680b00002b435ac15fc0288d9b2a169cdcacc413038dafb7a2c8cb482bac0ac502d9ba96ffffff7f0000100000000000007d5ad897ef3b7cda42013d53046da21b40216e14ba2d6ad5656bfff17addaedab25b30002abbba7fa725f38400be7c1f001b2cd317902f19e385be9e48dccff729433282830689da6b53b263339863297771429d120000003341bf4abacac95900fca0493cf29b33dcc9ffffffffffffffd39fec2271ff01589646efd1cf870cd7bb2366fde41f94290c2a5ff870ce41fd3467decb05cfd9fcb32c8ed1dbd9d10a64c1083d5e71b5565b1768ee58969c41595229df17bcad70fb4021428ce970275d13b78100788f11f76161d46ea3ab60fa4d30dc94ef241875f3b4ce0232fcea69c271d7fa29822aea68a660e717a04becff0f719197724f4fce1093b62d7e8c7123d8ec571be54c72d978cf906df0042e36acd37d7f9e119f2c06f815312e0cfe222a06f56dd022c074eb8a322fb0bf47c0a8d154b405c37feaf3dd95f6ef2ae582786105c7df8be5877050c91301bb997316dbf17866fb84d4173731efe895ff2e1c5560926e90109b598502d3e959efc71f665c4d75cf2458e3546c1c776da64fb5abee0acfd235f2f4632c9062ece84c99a061887a20639b41c8c12ee86c50804042b3fb5aac518a75f9e7d7101d5e186c489b3a06fb99e0aa7f23a054de2f4d92d6bd72ee2c9fdc75aaaf1e3e483b4ad05573af40326993947d9a631bcbf3583784acbda216550d7aec6b79e30cbd128f54c2d3335457acf37331766e472391e358c3b377327ac9ecc34f24c9ae153ec60ad0694dc55bff9f5f45f90400000000000000d6b2c5ea1393fdf24285bff3b89c9cc0ad1857216f1a985f369191ae954febb3df464bfe0f7f3ee9afe7befb89d2777399f5874c553aeb3729cffe86e66964ae09bb6d163118e4cbe024fd4500f8ff0700000000cc9d8046c216c1f895778cb25122a2a9f9b444aeadea2a40da8daccf080842a486721737390cbf3a74cb2003016f1514216bdf57d2a40d40b51ab63e96ec8485b3b8a8c9ae3d14f93100c2e0893862eef552fcde2981f48c482bde8a168c3f5db2fea6f26e4a4304e50c349f4f9ecee27defc93871c5f99b355b72d538ba4958ea8e4aa37094191e10096e7e60fc3541a2c905a1a95e9571bf38ae1981c4238ecaee6f75cd0a6881bd1517a8250ddc8674152f94e3a409e2a3bce109b60000000000000000d6d5210d7503000000a87a27602b81f76386f1535bef1497f92186086e29c6bc5a1fad6ec9a31137abf9a404abde7750898b1bd627e873f8703be8672d70d1ab57075228a9f46ed9bd1f08fb8191bbab2dc51de3a61f0868afc4294859323e6c257a45319f18101288d139bd3da20fed05a8fe64680b0a3fc22dd70400000000946912d6c98cd1a9fbe1e7d58c08acaf30235b918a31d2eca55f74a23641f61f2d5b308cf0d031b0c7f0ced69993e9960ff5f76015e6009556237badf4e7965bbe2777e808fcba821aa8e8c5c39609ff854352cb4900000000000000000000000000c1fee30a3f7a85d1b29e58c77685efc0ceb1c8e5729c66418d169fc03aa188546b3ad2a182068e1e3a0e2505bc7f41019645466a53f1c96e0d4b3bc19faa5449209b083dbd334b47f067bbab40743b2a42010082008df75cf43f8ecc8d3726602111b40e761fd21081920382f14d12ca3c3431ee97471c2ed01faa7eaa69eb7f7f80572fdd11bb1d0d1280fbc22bf73468788df51710d7d31c632fc5ed1762eb0b428ee751c47d8e894f745a868404a0bf35f0121008b722b1eaa6aedfa1bf2e7ccb2d61d5d76331945ecefa26b8471d42645288d7226bbd9ccd628ab84875f2c50ba891cea592b0430a537a395dc73bda367bf12cb7d81691a5fe8c47be395656a297e9df0e71f96756ea5cce7daac4be290159f6bcd75f0dda9de5532e71ae9e48b0ed0254a83100000000f6fbb869604d51a36a54c832e45b2569dc0d90b075225fde44c4e0973171ad47d6b0fdf9743af932cd6db49a47613808bad959710300000000000000832d0a45fa4242e24c7e800003c9e8095e02985f28e678f66422436f949e2ab8f162d7e3f855e378f4a1f40b0c6fb2d4b205a800b6d713acebc5b014e61a543a5a194f9ac18d76b5440e3b1a569e7397f6cafa86966d7ba19e720413267a6ccea9c439671d2c680f2753ca184eeeb843450368acb4383a01d25eb3d1e23e0f2645d1cdfa9fa410632f95a5f622f851c66ee7e30393cd7a4d67ff2a49c4f93c0984b5c2d4523497dad64f95f08493564a1df87111c9bf3194fef97dcecc467ace45feeb685c5870d05f88a0f463db88d377442e1349acaf766218b54a9d624778e1c4e064c98e494198276eb2df7766411bef0ebb5000000000006065d635b0b7a00ee767221d8af9753387e0cd8d718f54a29df6fba3bd4c440e6e2172e3fcc01b8babb757b5c59217b80d0db3ba582814a604e4ef7a803e9ca7c85b35c9b93a9e0885e238b44ae1c2e64cce3b27083b8246829e64056000302bffff15405bd5f2eba20000000000000000000000000000000000009a9823fd8fbc5aa165099c5ed032b48ea12d8e0588dc52702e4084913a06d468d0928bad76d697e1f85ab030e788d38788ee5b5428d4a971cc97db9fd2310801570735ce129e7e77fc2777692664a1488fd8d6dff4dad618fd54f529d4555c6507009ee69dd1bc55258789b24052137e9637f3efbab71720f88cf573fe0e5239c000be2733c49546f6e8a9175ec6f14dbf72cac91643b2fd99c29eca28a3c2e60d5e5b8795fae16a7c3ea57e728eca35eaf0155a39f97580e079175426c088a0208040982a0000000000000000000000000051ceaaf0159fe61f2eade7603d0a7a56fb09cd119ac06adb6597155ae47846892bb414c024d8cbe9240b71ec6dc2124d3a19e2d714b273d95d1d3aa737cb04a33615ff2a730e51067d5d675d7122361c37c61a43b5afd865b60d4cae891b73220f17d25985a7f76834995e53a93a1c7b9eef267df691ca983a0b15bda7f6c5c1ca7aa50261a3089a1ebf0734c9b07e8951ff023263ad5aed8cfb49b49e128c697724c057d22c5df5aef27ce3db11d5ad5527d149d076e1a87e2df27c0cb8a67ad026bf953e88f10447e125c2c0f1aebee1f3390a9e3ddad4e2a6e0f6e4569fdefa19e870e04acf9493b963f98e23cfc665e4f465fa3f801e1957c399e45f61d3459b1c606204368bb931345af2823c487d2fd99db6ea6e008e7ffa06ca861551189d155bd077a79fe2c7e961352e56824f727d21d41eae78bfec4a2d7a7edbc8ef958c5ea599f7c25bf71c2340558aa12fdd24a88aaad5921aee7dae6a2f3009d9cb43ab4898d0f0aa565431b6abe585d75db04d1c9ba0b9de4ae8b0d3132bc6810cc9a693979f55174a72e1df9fdef35bc470f9e6e591982757f45c52c645d891bf63bb21fb66926ebe1a8525611fc3e8bb8795c36dc2a86b5ab46ff33cc74f61751b2dae92676db85c8d0c721b7ea4544bf51c95c86fcac1f434d09d1ee4928aafe23de66fed972e0dddfb33f64e48701b049239e7f552d816441d11c4c2647c014462344359198d97c4b6e9ed31ca18987b64de079b2bed641e8a92f13ca70844c65cb423d01950b0ebf44bd28e09c05d9ae5dd689fb880fb18d042219f5ac60c3a03b085abf3e8e3efc842a8d328733461f04c99607061c65ed14c61322a5ac2d371a95b8ad867857ed13a4fa4ae033a09673866cd77f4bcdaaa05207166b19a8758d8855400d8c6a7242dc207251e8797eca24ea4f487663e60f2f5e1f1424958fd148f846830e88a42d93e1fe9c0b4a4a268921738938aa9f3cb3811ac87c54c8ebc8bcfb4613cc3a997ff1579edbd4ade8020e3ad001b072b1a751b588ac4639f35a58e00a50c0270608c7a7f10132b1c25b9ea81232fbef665f6212f875b2a000000000000000000000000000000000000000000000000000000a0cc2b89ce1525748ce167cbabb881f060599a6a59f645edca1d5c24b2f6b8c997a8f3e1b7679984a566d98d4d31198ee4c5ea7be0d99cf89bba4a6fd0bec12e7792bec3c5038e13b1"], &(0x7f0000000680)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x16, 0xffffffffffffffff, 0x8, &(0x7f0000000000)={0x4}, 0x8, 0x10, &(0x7f0000000000)={0x0, 0x44}, 0x10}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000540)='rcu_utilization\x00', r0}, 0x10) close(0xffffffffffffffff) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000580)={0x5, 0x5, &(0x7f00000003c0)=ANY=[@ANYBLOB="180000004830000000000000fa40000007010000080020007500feff0000820095"], &(0x7f0000000100)='GPL\x00', 0x3, 0xfa, &(0x7f00000007c0)=""/250, 0x0, 0x8}, 0x94) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0xf, 0x4, 0x4, 0x12}, 0x48) r5 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0xe, 0x4, &(0x7f0000000400)=ANY=[], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00}, 0x94) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000780)=ANY=[@ANYRES16=r0, @ANYRES32=r5, @ANYBLOB='\x00\x00', @ANYRESDEC, @ANYRES16=r1, @ANYRES64=r3], 0x10) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000740)={{r4, 0xffffffffffffffff}, &(0x7f00000006c0), &(0x7f0000000700)=r3}, 0x20) sendmsg$inet(r2, &(0x7f0000000980)={0x0, 0x6000, &(0x7f0000000900)=[{&(0x7f0000000640)='U', 0xa00120}], 0x1}, 0x3) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, 0x0, 0x0) r7 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) r8 = socket$inet6(0xa, 0x3, 0x5) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r8, 0x29, 0x20, &(0x7f00000000c0)={@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x800, 0x0, 0x3, 0x9}, 0x20) mmap$xdp(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x2000009, 0x12, 0xffffffffffffffff, 0x0) setsockopt$inet6_int(r8, 0x29, 0x1000000000021, 0x0, 0x0) socket$packet(0x11, 0x3, 0x300) getpid() sendmsg$netlink(r7, &(0x7f00000001c0)={0x0, 0xfffffffffffffdbf, &(0x7f0000003e00)=[{&(0x7f00000009c0)=ANY=[@ANYBLOB="6c0100002f000100000000000000000001712201ad0001000300000000000000140001002001000000000000000000000000000050bb2d6f67d29d6fabadb107d0def49c88ea04abde1d5e8d3fb22a1b5046778bdafefc46b0449ade68bf84b36ec72dd71265fc2e882348c26c2126237dd5b37f5ae655b1086cda40e00aec58754734be31d750351dc076eb43d9621dc08c029d1608a487f26fbe8101000000010000008b9482565856555ee923c65973deb0a99b962bc0fe94a3fcae3697bd7b85b3a682167c43dbf137115a40ebddcad74875ec58e9a3ddb9ad02a078cf0d972df9e99f079767734f69ce475f55ac64337803f5eb4e5842f4d98fe3fa370d47eb640dc5061dc35817c8a66c29be82fd000000d30321b64dcc02f32b6585e485fc09cca4f5d13c863f2128a60030f5637e6c8cab15fe59eb06bfacd578f19be4b7537cadb50fc93be09c58bf0f30e6ccfddb66363f40ee1c5b6a8eaa4d12dee2b039cc3d77400cfd000000"], 0x16c}, {0x0}], 0x2}, 0x6000) bpf$PROG_LOAD(0x5, &(0x7f0000000d80)={0x7, 0x19, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000009000000000000008218179c40d3b561", @ANYRES32=r4, @ANYBLOB="0000000000000000851000000800000018120000", @ANYRES32=r6, @ANYBLOB="0000000000000000b703000000000000850000000c000000b700000000000000852000000300000018110000", @ANYRES32=r6, @ANYBLOB="0000000000000000b70200000000000085000000860000009500000000000000180100002020752500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000ff00000085000000060000009500000000000000"], &(0x7f00000002c0)='GPL\x00', 0x7, 0x73, &(0x7f0000000b40)=""/115, 0x41100, 0x22, '\x00', 0x0, @fallback=0x1b, 0xffffffffffffffff, 0x8, &(0x7f0000000300)={0x5, 0x3}, 0x8, 0x10, &(0x7f0000000500)={0x0, 0x5, 0xf, 0xd3}, 0x10, 0x0, r1, 0x6, &(0x7f0000000cc0)=[r6, r4, r4, r6, 0xffffffffffffffff], &(0x7f0000000d00)=[{0x2, 0x5, 0x2, 0x6}, {0x0, 0x2, 0x10, 0x1}, {0x2, 0x4, 0x7, 0xe}, {0x4, 0x4, 0x9, 0x6}, {0x2, 0x1, 0xd, 0x6}, {0x3, 0x3, 0xd}], 0x10, 0x9}, 0x94) r9 = socket(0x2, 0x80805, 0x0) r10 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r10, 0x0) close(0x3) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r10, 0x84, 0x7a, &(0x7f0000000340)={0x0, @in={{0x2, 0xce23, @broadcast}}}, &(0x7f0000000040)=0x84) sendmmsg$inet_sctp(r9, &(0x7f00000032c0)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="30000000000000008400000001000000000000017c"], 0x30}], 0x1, 0x0) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r9, 0x84, 0x75, &(0x7f0000000180)={0x0, 0x5}, &(0x7f0000000240)=0x8) 19.941226783s ago: executing program 3 (id=2905): bpf$MAP_CREATE(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0500000004000000060000000400000000000000", @ANYRES32, @ANYBLOB="0300000000000000000000000000000000000000836ece424ec9d74dc02bbf641f33a2d99ded7d92e4d573b7d54a5321aa548390ef0cca270e92169068fc09b195a2c5c2e60f50c5ed92ea0e82f4764df77e85490bcc50375d49a562a07d7b91e9ea8d347ff4aa689af29fcdb2d92b3e79c000"/126, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$devlink(&(0x7f00000002c0), r0) socket$nl_generic(0x10, 0x3, 0x10) socket$inet_mptcp(0x2, 0x1, 0x106) socket$nl_route(0x10, 0x3, 0x0) socket$qrtr(0x2a, 0x2, 0x0) syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000300)='ns/net\x00') socket$pppl2tp(0x18, 0x1, 0x1) socket(0x400000000010, 0x3, 0x0) socket$unix(0x1, 0x5, 0x0) socket(0x2, 0x8080b, 0xa) bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000040000008500000072000000850000005000000095"], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket$packet(0x11, 0x2, 0x300) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0b00000007000000010001000600000001000000", @ANYRES32, @ANYBLOB="000000000000000d00000000000000000000000067fefa1bd248c2cc856e6f550895b707d54333a039032e6b1dadf943345615fe57be", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) socket$netlink(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket$inet_sctp(0x2, 0x1, 0x84) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)) socket$nl_route(0x10, 0x3, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close(r2) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r3) sendmsg$TIPC_CMD_ENABLE_BEARER(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}}, 0x0) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) 18.581930548s ago: executing program 3 (id=2995): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000013c0)={0x18, 0x3, &(0x7f0000000080)=@framed, &(0x7f0000000280)='syzkaller\x00', 0xffffff7f, 0x61}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000040)='contention_end\x00', r0}, 0x10) r1 = socket$rds(0x15, 0x5, 0x0) bind$rds(r1, &(0x7f0000000100)={0x2, 0x4e21, @multicast2}, 0x10) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000080), r3) sendmsg$IEEE802154_ASSOCIATE_REQ(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)={0x14, r4, 0x1, 0x70bd2c, 0x25dfdbfd}, 0x14}, 0x1, 0x0, 0x0, 0x4000}, 0xc040) bpf$PROG_LOAD(0x5, &(0x7f0000000c00)={0x6, 0x3, &(0x7f00000003c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}}, &(0x7f0000000bc0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000000)="d8000000180081084e81f782db44b904021d080006067c09e8fe55a10a0015400800142603600e120800160000001001a8001600a400014003", 0x39}], 0x1, 0x0, 0x0, 0x6000}, 0x0) r5 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000240)=[{&(0x7f0000000000)="d800000010008104687da3aa7143a0b8c81d080b25000000e8fe551a250015000600149b0000001208000313eba96240a8002b", 0x33}], 0x1}, 0x4180) write$cgroup_subtree(r5, &(0x7f0000000000)=ANY=[], 0xfe33) r6 = socket$kcm(0x10, 0x2, 0x0) write$cgroup_subtree(r6, &(0x7f0000000000)=ANY=[], 0x33fe0) sendmsg$nl_generic(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)={0x18, 0x42, 0x107, 0xfffffffe, 0x0, {0x1, 0x7c}, [@nested={0x4, 0x142}]}, 0x18}, 0x1, 0x0, 0x0, 0xc000}, 0xc000) 18.111870859s ago: executing program 6 (id=2997): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000006c0), 0xffffffffffffffff) r2 = socket$nl_route(0x10, 0x3, 0x0) (async) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) (async) r4 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) (async) r5 = socket$inet6_sctp(0xa, 0x5, 0x84) (async) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000000)) setsockopt$inet_sctp6_SCTP_INITMSG(r5, 0x84, 0x2, &(0x7f00000000c0)={0xfffc, 0xc4d4}, 0x8) sendto$inet6(r5, &(0x7f0000000480)="b663441e2f", 0x5, 0x24004001, &(0x7f0000000280)={0xa, 0x0, 0xe8, @ipv4={'\x00', '\xff\xff', @loopback}, 0x85}, 0x1c) (async) setsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r5, 0x84, 0xa, 0x0, 0x0) (async) recvmmsg(r4, &(0x7f0000004380)=[{{0x0, 0x0, 0x0}, 0x9}], 0x1, 0x2000, 0x0) (async) sendmsg$NFT_BATCH(r3, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000001000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)={{0x14}, [@NFT_MSG_NEWSET={0x3c, 0x12, 0xa, 0x101, 0x0, 0x0, {0x2}, [@NFTA_SET_NAME={0x9, 0x2, 'syz2\x00'}, @NFTA_SET_KEY_TYPE={0x8}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x8}]}, @NFT_MSG_DELSETELEM={0x20, 0xe, 0xa, 0x5, 0x0, 0x0, {0x7, 0x0, 0x9}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}]}], {0x14}}, 0x84}}, 0x0) r6 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="19000000040000000800000008"], 0x48) r7 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000500000000000000000018110000", @ANYRES32=r6, @ANYBLOB="0000000000000000b7080000000000107b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000925e850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x22, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r8 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000a00)=@bpf_ext={0x1c, 0x7, &(0x7f0000000400)=@raw=[@generic={0x9, 0xa, 0x6, 0x9, 0x400}, @cb_func={0x18, 0x7}, @btf_id={0x18, 0x8, 0x3, 0x0, 0x5}, @exit, @exit], &(0x7f00000004c0)='syzkaller\x00', 0x3, 0x14, &(0x7f0000000680)=""/20, 0x41100, 0x1, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000700)={0x4, 0x5}, 0x8, 0x10, &(0x7f0000000740)={0x2, 0x0, 0xfffffffb, 0x7}, 0x10, 0x14171, r7, 0x4, &(0x7f0000000780)=[r6, r6, r6, r6], &(0x7f00000007c0)=[{0x0, 0x5, 0x6, 0x6}, {0x1, 0x3, 0x7}, {0x3, 0x5, 0xd}, {0x0, 0x4, 0xe, 0xb}], 0x10, 0xc}, 0x94) r9 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0x0, 0x0, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r8, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$inet_sctp6_SCTP_EVENTS(0xffffffffffffffff, 0x84, 0xb, &(0x7f00000003c0)={0x10, 0xff, 0x5, 0xac, 0x81, 0xf8, 0x3, 0x7, 0xc, 0x1, 0x5, 0x3, 0x6, 0xc}, 0xe) (async) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_attach_bpf(r10, 0x1, 0x32, &(0x7f0000000180)=r9, 0x4) (async) sendmsg$inet(r11, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x20000000) r12 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_NET_SET(r12, &(0x7f0000000380)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000340)={&(0x7f0000000080)={0x28, 0x0, 0x200, 0x70bd29, 0x25dfdbfd, {}, [@TIPC_NLA_PUBL={0x14, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_TYPE={0x1, 0x1, 0xac}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x8}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x20008090}, 0x810) (async) sendmsg$nl_route(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000640)=@newlink={0x40, 0x10, 0x437, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x4048b}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @sit={{0x8}, {0x14, 0x2, 0x0, 0x1, [@IFLA_IPTUN_REMOTE={0x8, 0x3, @broadcast}, @IFLA_IPTUN_LOCAL={0x8, 0x2, @loopback}]}}}]}, 0x40}}, 0x0) (async) r13 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r13, 0x8933, &(0x7f0000000280)={'wlan1\x00', 0x0}) (async) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f00000001c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000157b8af8ff00000000bc82000000000000a6020000f8ffffffb703000008000000b70300000000000085"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) r15 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r15, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000540)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x3}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x1, 0x0, 0x2}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1, 0x0, 0xfffe}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz0\x00'}]}, @NFT_MSG_NEWRULE={0x54, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1, 0x0, 0x4}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x2c, 0x4, 0x0, 0x1, [{0x28, 0x1, 0x0, 0x1, @immediate={{0xe}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_IMMEDIATE_DATA={0x8, 0x2, 0x0, 0x1, [@NFTA_DATA_VERDICT={0x4}]}, @NFTA_IMMEDIATE_DREG={0x8, 0x1, 0x1, 0x0, 0x11}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0xc8}}, 0x0) (async) sendmsg$NL80211_CMD_NEW_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000001c0)=ANY=[@ANYBLOB='`\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="0100000000000000000007000000080001006e00000008000300", @ANYRES32=r14, @ANYBLOB="0c0099000000000000000000050053000100000014000400776c616e310000000000000000000000140006"], 0x60}}, 0x0) 17.594420807s ago: executing program 3 (id=2998): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) socket$xdp(0x2c, 0x3, 0x0) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000ac0), r0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000880)=ANY=[@ANYBLOB="12000000010000000800000008"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xd, &(0x7f0000000f80)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005800000085000000a000000095"], &(0x7f0000000340)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, &(0x7f0000003900)=ANY=[@ANYBLOB="620af8ff0c200021bfa100000000000007010000f8ffffffb702000003000000bd120000000000008500000006000000b70000000000000095000000000000003faf4f1e7f2aa3d9b18ed81c0c869b51ec6c0af4e0e4a9446c7670568982b4e020f698393aa0f3881f9c24aa56f15199fad0093c59d66b5ece9f36c70d0f13905ea23c22624c9f87f9793f50bb546040677b0c5077da80fb982c1e9400e693146cea484a415b76966118b64f751a0f241b07080008002d75593a286cecc93e64c227c95aa0b784625704f07a72c234664c0af9360a1f7a5e6b607130c89f18c0c1089d8b853289e01aa27ae8b09e00e79ab20b0b8e1148f49faf2ad0000000000000006fa03c6468972089b302d7bf6023cdcedb5e0125ebbc08dee510cb2364149215108333719acd97cfa107d40224edc5465a932b77e74e802a0d42bc6099ad2300000080006ef6c1ff0900000000000010c63a949e8b7955394ffa82b8e942c89112f4ab87b1bfeda7be586602d985430cea0162ab3fcf4591c926abfb0767192302000000b0eea24492a660583eecb42cbcd3de3a83209da17a0faf60fd6ad9b97aa5fa68480366c9c6fd6fa5043aa3926b81e3b59c95c25a573dc2edcaea2b1a52496dfcaf99431412fd134a996382a1a04d5bb924cfe5f3185418d605ffff9c4d2ec7c32f2095e63c80aff9fa740b5b7632f32030916f89c6dad7603f2ba2a790d62d6faec2fed44da4928b30142ba11de6c5d50b83bae613402216b5054d1e7c13b1355d6f4a8245ffa4997da9c77af4c0eb97fca585ec6bf5af51d564beb6d952aab9c70764b0a8a7583c90b3433b809bdb9fbd48bc873495cbff8a326eea31ae4e0f7505ebf6c9d13330ca005ace1a84521f14518c9b476fccbd6c712016219848624b87cec2dbe98223a0eb4fa39f6b5c02e6d6d90756ff57902a8f57000000009700cf0b4b8bc2294133000000000000000000030000000000000000000000000010008bc0d9559711e6e8861c46495ba585a4b2d02edc3e28dd271c896249ed85b980680b00002b435ac15fc0288d9b2a169cdcacc413038dafb7a2c8cb482bac0ac502d9ba96ffffff7f0000100000000000007d5ad897ef3b7cda42013d53046da21b40216e14ba2d6ad5656bfff17addaedab25b30002abbba7fa725f38400be7c1f001b2cd317902f19e385be9e48dccff729433282830689da6b53b263339863297771429d120000003341bf4abacac95900fca0493cf29b33dcc9ffffffffffffffd39fec2271ff01589646efd1cf870cd7bb2366fde41f94290c2a5ff870ce41fd3467decb05cfd9fcb32c8ed1dbd9d10a64c1083d5e71b5565b1768ee58969c41595229df17bcad70fb4021428ce970275d13b78100788f11f76161d46ea3abe0fa4d30dc94ef241875f3b4ce0232fcea69c271d7fa29822aea68a660e717a04becff0f719197724f4fce1093b62d7e8c7123d8ec571be54c72d978cf906df0042e36acd37d7f9e119f2c06f815312e0cfe222a06f56dd022c074eb8a322fb0bf47c0a8d154b405c37feaf3dd95f6ef2ae582786105c7df8be5877050c91301bb997316dbf17866fb84d4173731efe895ff2e1c5560926e90109b598502d3e959efc71f665c4d75cf2458e3546c1c776da64fb5abee0acfd235f2f4632c9062ece84c99a061887a20639b41c8c12ee86c50804042b3fb5aac518a75f9e7d7101d5e186c489b3a06fb99e0aa7f23a054de2f4d92d6bd72ee2c9fdc75aaaf1e3e483b4ad05573af40326993947d9a631bcbf3583784acbda216550d7aec6b79e30cbd128f54c2d3335457acf37331766e472391e358c3b377327ac9ecc34f24c9ae153ec60ac0694dc55bff9f5f45f90400000000000000d6b2c5ea1393fdf24285bf16b99c9cc0ad1857216f1a985f369191ae954febb3df464bfe0f7f3ee9afe7befb89d2777399f5874c553aeb3729cffe86e66964ae09bb6d163118e4cbe024fd4500f8ff0700000000cc9d8046c216c1f895778cb25122a2a9f9b444aeadea2a40da8daccf080842a486721737390cbf3a74cb2003016f1514216bdf57d2a40d40b51ab63e96ec8485b3b8a8c9ae3d14f93100c2e0893862eef552fcde2981f48c482bde8a168c3f5db2fea6f26e4a4304e50c349f4f9ecee27defc93871c5f99b355b72d538ba4958ea8e4aa37094191e10096e7e60fc3541a2c905a1a95e9571bf38ae1981c4238ecaee6f75cd0a6881bd1517a8250ddc8674152f94e3a409e2a3bce109b60000000000000000d6d5210d7503000000a87a27602b81f76386f1535bef1497f92186086e29c6bc5a1fad6ec9a31137abf9a404abde7750898b1bd627e873f8703be8672d70d1ab57075228a9f46ed9bd1f08fb8191bbab2dc51de3a61f0868afc4294859323e6c257a45319f18101288d139bd3da20fed05a8fe64680b0a3fc22dd70400000000946912d6c98cd1a9fbe1e7d58c08acaf30235b918a31d2eca55f74a23641f61f2d5b308cf0d031b0c7f0ced69993e9960ff5f76015e6009556237badf4e7965bbe2777e808fcba821aa8e8c5c39609ff854352cb4900000000000000000000000000c1fee30a3f7a85d1b29e58c77685efc0ceb1c8e5729c66418d169fc03aa188546b3ad2a182068e1e3a0e2505bc7f41019645466a53f1c96e0d4b3bc19faa5449209b083dbd334b47f067bbab40743b2a42010082008df75cf43f8ecc8d3726602111b40e761fd21081920382f14d12ca3c3431ee97471c7868dcda7eaa69eb7f7f80572fdd11bb1d0d1280fbc22bf73468788df51710d7d31c632fc5ed1762eb0b428ee751c47d8e894f745a868404a0bf35f0121008b722b1eaa6aedfa1bf2e7ccb2d61d5d76331945ecefa26b8471d42645288d7226bbd9ccd628ab84875f2c50ba891cea592b0430a537a395dc73bda367bf12cb7d81691a5fe8c47be395656a297e9df0e71f96756ea5cce7daac4be290159f6bcd75f0dda9de5532e71ae9e48b0ed0254a83100000000f6fbb869604d51a36a54c832e45b2569dc0d90b075225fde44c4e0973171ad47d6b0fdf9743af932cd6db49a47613808bad959710300000000000000832d0a45fa4242e24c7e800003c9e8095e02985f28e678f66422436f949e2ab8f162d7e3f855e378f4a1f40b0c6fb2d4b205a800b6d713acebc5b014e61a543a5a194f9ac18d76b5440e3b1a569e7397f6cafa86966d7ba19e720413267a6ccea9c439671d2c680f2753ca184eeeb843450368acb4383a01d25eb3d1e23e0f2645d1cdfa9fa410632f95a5f622f851c66ee7e30393cd7a4d67ff2a49c4f93c0984b5c2d4523497e4d64f95f08493564a1df87111c9bf3194fef97dcecc467ace45feeb685c5870d05f88a0f463db88d377442e1349acaf766218b54a9d624778e1c4e064c98e494198276eb2df7766411bef0ebb5000000000006065d635b0b7a00ee767221d8af9753387e0cd8d718f54a29df6eba3bd4c440e6e2172e3fcc01b8babb757b5c59217b80d0db3ba582814a604e4ef7a803e9ca7c85b35c9b93a9e0885e238b44ae1c2e64cce3b27083b8246829e64056000302bffff15405bd5f2eba20000000000000000000000000000000000009a9823fd8fbc5aa16509945ed032b48ea12d8e0588dc52702e4084913a06d468d0928bad76d697e1f85ab030e788d38788ee5b5428d4a971cc97db9fd231088e570735ce129e7e77fc2777692664a1488fd8d6dff4dad618fd54f529d4555c6507009ee69dd1bc55258789b24052137e9637f3efbab71720f88c3c44b3b7486f979e8a3174b531f573fe0e5239c000be2733c49546f6e8a9175ec6f14dbf72cac91643b2fd99c29eca28a3c2e60d5e5b8795fae16a7c3ea57e728eca35eaf0155a39f97580e079175426c088a0208040982a0000000000000000000000000051ceaaf0159fe61f2eade7603d0a7a56fb09cd119ac06adb6597155ae47846892bb423c024d8cbe9240b71ec6dc2124d3a19e2d714b273d95d1d3aa737cb04a33615ff2a730e51067d5d675d7122361c37c61a43b5afd865b60d4cae891b73220f17d25985a7f76834995e53a93a1c7b9eef267df691ca983a0b15bda7f6c5c1ca7aa50261a3089a1ebf0734c9b07e8951ff023263ad5aed8cfb49b49e128c697724c057d22c5df5aef27ce3db11d5ad5527d149d076e1a87e2df27c0cb8a67ad026bf953e88f10447e125c2c0f1aebee1f3390a9e3ddad4e2a6e0f6e4569fdefa19e870e04acf9493b963f98e23cfc665e4f465fa3f801e1957c399e45f61d3459b1c606204368bb931345af2823c487d2fd99db6ea6e008e7ffa06ca861551189d155bd077a79fe2c7e961352e56824f727d21d41eae78bfec4a2d7a7edbc8ef958c5ea599f7c25bf71c2340558aa12fdd24a88aaad5921aee7dae6a2f3009d9cb43ab4898d0f0aa565431b6abe585d75db04d1c9ba0b9de4ae8b0d3132bc6810cc9a693979f55174a72e1df9fdef35bc470f9e6e591982757f45c52c645d891bf63bb21fb66926ebe1a8525611fc3e8bb8795c36dc2a86b5ab46ff33cc74f61751b2dae92676db85c8d0c721b7ea4544bf51c95c86fcac1f434d09d1ee4928aafe23de66fed972e0dddfb33f64e48701b049239e7f552d816441d11c4c2647c014462344359198d97c4b6e9ed31ca18987b64de079b2bed641e8a92f13ca70844c65cb423d01950b0ebf44bd28e09c05d9ae5dd689fb880fb18d042219f5ac60c3a03b085abf3e8e3efc842a8d328733461f04c99607061c65ed14c61322a5ac2d371a95b8ad867ec92d13a4fa4ae033a09673866cd77f4bcdaaa05207166b19a8758d8855400d8c6a7242dc207251e8797eca24ea4f487663e60f2f5e1f1424958fd148f846830e88a42d93e1fe9c0b4a4a268921738938aa9f3cb3811ac87c54c8ebc8bcfb4613cc3a997ff1579edbd4ade8020e3ad001b072b1a751b588ac4639f35a58e00a50c0270608c7a7f10132b1c25b9ea81232fbef665f6212f875b2a0000000000000000000000000000cf7b6c4ba9bec153d6834bfef080df374703a8ff56a63ec1fe5f2e05a79e3cace7283dd68d41e94420c325fe4dae144fde5ec25a87d625cab20753a77b323fa3783c8b675859b9012647885a242adfee2fe812ecbe5191e0a15142f7349e7627cc39d724e2e34e7a24154f26ae3125b36d0504965295d0453902ac7079b11a3a1e655e482331e3dc35b2e7e4e3ea99064fe5b9c8ae0ca3e5fd653f3286a99d81ce4eba765c38d097391ad4babac38ce5b4344e24a361cd54e5"], &(0x7f0000000380)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x2e) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000540)='rcu_utilization\x00', r2}, 0x10) listen(0xffffffffffffffff, 0x0) syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x6, 0x3, &(0x7f0000000480)=ANY=[@ANYBLOB="180000000200000000000000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x32, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = socket$nl_generic(0x10, 0x3, 0x10) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, 0xffffffffffffffff, 0x0, 0x7, &(0x7f0000000000)='cgroup\x00'}, 0x30) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f00000002c0)={'nicvf0\x00'}) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, 0x0) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000004c0)={r3, 0x0, 0x25, 0x0, @void}, 0x10) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000480)=@newlink={0x3c, 0x10, 0x403, 0x70bd2a, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, 0x88afa5b4, 0x40}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @batadv={{0xb}, {0x4}}}, @IFLA_NUM_TX_QUEUES={0x8, 0x1f, 0x3}]}, 0x3c}}, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000700)='sched_switch\x00'}, 0x18) r6 = socket$nl_route(0x10, 0x3, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000080)={'team_slave_0\x00', 0x0}) sendmsg$nl_route(r6, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000240)=@dellink={0x20, 0x11, 0x1, 0x70bd2c, 0x25dfdc00, {0x0, 0x0, 0x0, r7, 0xc0a742c700a80d57, 0x25aa6}}, 0x20}}, 0x2000e844) syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) r8 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r8, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000380)=@updpolicy={0xc4, 0x19, 0x1, 0x0, 0x0, {{@in=@remote, @in6=@empty, 0x8000, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xee01}}, [@policy_type={0xa, 0x10, {0x1}}]}, 0xc4}}, 0x0) sendmsg$nl_xfrm(r8, &(0x7f00000000c0)={0x0, 0xa00, &(0x7f0000000080)={&(0x7f0000000040)=@flushpolicy={0x1c, 0x1d, 0x1, 0x0, 0x0, "", [@policy_type={0xa, 0x10, {0x1}}]}, 0x1c}}, 0x0) 17.578643257s ago: executing program 2 (id=2999): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x1, 0xe, &(0x7f00000002c0)=ANY=[@ANYBLOB="b7020000f7ffffffbfa70000000000002502000020feffff7a0af0fff8ffffff69a4f0ff00000000b70600000018d1fe5d6405000000000075040000000d00000701000000000000b70400001000e5207b0700fe0000000085000000b5000000b70000000a00000095000000000000006458c2c62fc206000000f909a63796c113a80c19aab9d60700ffffffff483be3f0d3253730e78000000062c28b22756bedf3cf393d14c46cc4f79fd2b316da4f0de8163f6242fa7323f1740637c48468766aeb39439fce41f144631ac262dcae08c3d1a1fbe96dd87235b44174f7c013700e69274f8e9c31975e551558055dc2dc29edc33b375fa325dcf3e91e20f63d7030dbe7ff7f51fe89c3d17cf45a1616ad237682057034dfdc81f5a53cd640212c88e8b687a2446049577c75b76b775c1e301caf2465ed4b2ad56b848d046c52bfc3737127120ab17d82a294d174f240a3cdc725cfe6e839a1f80f59486578e45b008d39ab618f660e3c53ed4409aa92ae4fecd913060ca74ed8a303e22de12087a217d8d7be0ae1117cc791313b1318497dd5ebeef0d7e1795a6ff20f699870ebb137cffa79465da52ab2b3430ba0ba59152496a1ea5dd1e4dee46f6d3688603b5f25a588a31da4e481884074e211dd09a8b8039d0834507656ed7d552a990c1354d7638b2c2215dd9f606b01a92fabc6eb6fa033a86f8920e2168a80d7c86da5ad1d27c8d2a180e56046a49b989128ea736894d3eef8dca16ed63520be4654ddb14bfe4268c487c5a75c044e21021c089608c50adbc4e3f4c6a4ca86c7d2df5bc7c76e413d05e8f57b1e22d4af34f9d4d2e6e4d4f57f47aebdd5f98f67834c656b2fe09df4a1b15116fceaa404a6df278c7c629f584ba8d37c1137c2263ae02ad3718a03a886eb"], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x139}, 0x48) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xffde}, {0xffff, 0xffff}, {0x1, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000940)=@newtfilter={0x10c, 0x2c, 0xd27, 0x70bd25, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0xe, 0x7}, {}, {0x7, 0x2}}, [@filter_kind_options=@f_flower={{0xb}, {0xdc, 0x2, [@TCA_FLOWER_KEY_ENC_OPTS_MASK={0x4}, @TCA_FLOWER_KEY_ENC_OPTS={0xc, 0x54, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPTS_VXLAN={0x4}, @TCA_FLOWER_KEY_ENC_OPTS_ERSPAN]}, @TCA_FLOWER_KEY_ICMPV6_TYPE_MASK={0x5}, @TCA_FLOWER_KEY_ENC_OPTS_MASK={0xa4, 0x55, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPTS_VXLAN={0x4}, @TCA_FLOWER_KEY_ENC_OPTS_ERSPAN={0x0, 0x3, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPT_ERSPAN_DIR={0x0, 0x3, 0x8}]}, @TCA_FLOWER_KEY_ENC_OPTS_GENEVE={0x34, 0x1, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPT_GENEVE_DATA={0x5, 0x3, 0x8c}, @TCA_FLOWER_KEY_ENC_OPT_GENEVE_DATA={0x5, 0x3, 0x3}, @TCA_FLOWER_KEY_ENC_OPT_GENEVE_CLASS={0x6, 0x1, 0x4}, @TCA_FLOWER_KEY_ENC_OPT_GENEVE_DATA={0x5, 0x3, 0x10}, @TCA_FLOWER_KEY_ENC_OPT_GENEVE_CLASS={0x6, 0x1, 0x9}, @TCA_FLOWER_KEY_ENC_OPT_GENEVE_DATA={0x5, 0x3, 0xe7}]}, @TCA_FLOWER_KEY_ENC_OPTS_GENEVE={0x2c, 0x1, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPT_GENEVE_TYPE={0x5, 0x2, 0x5}, @TCA_FLOWER_KEY_ENC_OPT_GENEVE_DATA={0x5, 0x3, 0x8}, @TCA_FLOWER_KEY_ENC_OPT_GENEVE_TYPE={0x5, 0x2, 0x1}, @TCA_FLOWER_KEY_ENC_OPT_GENEVE_TYPE={0x5, 0x2, 0x8}, @TCA_FLOWER_KEY_ENC_OPT_GENEVE_CLASS={0x6, 0x1, 0x1}]}, @TCA_FLOWER_KEY_ENC_OPTS_GENEVE={0xc, 0x1, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPT_GENEVE_DATA={0x5, 0x3, 0x4}]}, @TCA_FLOWER_KEY_ENC_OPTS_GENEVE={0x4}]}, @TCA_FLOWER_KEY_ARP_THA={0xa, 0x41, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x37}}, @TCA_FLOWER_KEY_TCP_SRC={0x6}, @TCA_FLOWER_KEY_ENC_IPV4_SRC={0x8, 0x1b, @local}]}}]}, 0x10c}, 0x1, 0x0, 0x0, 0x80}, 0x0) 16.961339023s ago: executing program 6 (id=3001): r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000240)={0x2, &(0x7f0000000400)=[{0x28, 0x1, 0x0, 0xfffff008}, {0x6, 0xc, 0x0, 0x6}]}, 0x10) r1 = socket(0x1d, 0x2, 0x6) setsockopt$ALG_SET_AEAD_AUTHSIZE(r1, 0x6a, 0x2, 0x20000002, 0x5) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-aesni\x00'}, 0x58) sendmmsg(r3, &(0x7f0000000ec0)=[{{&(0x7f00000002c0)=@l2tp={0x2, 0x0, @private=0xa010100, 0x4}, 0x80, &(0x7f0000000340)=[{&(0x7f00000006c0)="cc5c84001214dbd9e5943aa8a315357330c56529d6b619a78687eea13ea02981afbb0fab70e8c3ab037cd82bd48f4947702a177974e7eff5f2ccdec909645f69e3dea5153157374459f6a21ba8609552d9ada54e81b0f19b55b77cf382ad229baa9decce1ea639a300f1fa65b945a0e29d36cb8ed369e916", 0x78}, {&(0x7f00000007c0)="a960e57530b65741465209e7c6235055450b1ed3da8592b928d8e20971659d8e3ca392643af5fa7ae0e3455099a5f7b857afa34cbf9962bdc9db46a15e7dcf9412a2b98b6a", 0x45}, {&(0x7f0000001400)="9af390e2aadb61017e08249a2485ad46a590a90910858e1ceefc66db2ed8f32bf6be0e2f94e7e4db6454393a128402ed26580c7c5ebc85db639da17c927c23dbde640ab030889e8b61f26d270bc73b21c9ac8ba542e6b4ad2cd147059128ba038e4b9ebb20537f437b23b46ec790720e1fb74cef3c677e9978662a84cf2fcf73c73a5e763358496737af6284226bad34fb9083f87d853ab78c816cf32c90bd5c40ff6446214552d29745d34e0c4bfa623d00e5cbb393972371503122a0f44135db5654ace67cddb85a12df91fcf994fc680afe5d34268b23447589ef3f5383d152bf6dd104984297180f896ec8b1ba50952c5ab76e144f5636692d7cf17922c9b447ed6d59553ec6085e07413034875c1ae0947280e1a6f0d5e7f23b32e56ead8590d3269fdcb624cc870968b2f100bf3bc3d2ab105a5f61456d4969181fbd207b6f4d6d9ca0a1920daabec06d0c5e276d18f2571e88373dd41af9080d72aa88b10f8900b48acb61a61007dd4dd0e9240af5382a26f68bd706a83d8df76a4a5d02b39d07f97c4f86dad9e14eb957cc4be52b027a462262589929e3d035188dd9f0561e3ba2de6bafe743d9ae397e9aa423644fba8b2d6425ac1cd78c76e52e04d3a29e74075625fb5e674bab02843991ce804e0d04961f2978f3749c5ad83f355ae5da936fd6e0178d2bd12aacbe0205aa9a15579fd61d738f8d36412e814ba500edaf28ea68b0e96fb1839acf8416d8f5df7fad3b663f68e2ee5784fd01c7021130a490e629b1348acf3479e0392ecabbeeb18ec421c26e76f6f5c480e7decc85a0583a56180f199d26090b10ee5057ec4c1e04be948a5960acda014d646cf91bfdfb9d327f8ab545f8b41e8dbab94f195b189a8642a6b95e0ceb36b640fbdfe21925cc110bd2ef2c3fe24f12f95771b60e2ffbc47e58b2237b5574cadc32aab0f0db3202e4adc44a0651ef97703957857cfb6022578c97802f486bd7f48129f0c120700d0b70e048618a9f1de9f34dbb1f92dadc86f09e6288eb1bdbd1f700cc2df781654dfd57d9da779607080d3bc6dede5818aa8d6c99fa1ffdbb6a1a43040fe1379cf2a8b4b862db428c29e388a6e6b863bc818c2139a0d4238f10baf22f498b6629181f997ac280547e92fe300d0f8dd8b6724df5aa14be73cd630b808a29bfb52707b8db7d0065bd753b3773f8df58c74ea56f4582caa2fa8532b8049fd9ba775afc5b92b767ed0b35d4c086d9af6f7b7ed96f5f9d3734e703fc683fe0ed82b7763c67734067759e27b60036a3b4c53526716c175d75a9fa6ed019d3e1047bcb9c6510665de23cc2802804a0c3a347faba392282df430e5e6141f9eb660f7cb0eaedb832a7880c953bc0188c1f28eb466799e2768886ef81096847f50159278b572b0cca7744d6a572a81ddd2bcea73da3c8a59680bcaaadaf95e1fe91e41a8036835975b072a9587c560e3da854c96c64011755d08fef5228bb2db62a445bc0b9e17dea88854cd6a7c8a288727d5690fc4941978dee5eda2dbdc85915e7a2fdae978adb217b3f6b31cf69b51b9f805f8b447a4868b442933fc0e03860a7084230ff8fdff70665717f9c0bade31f87f5de99643e800feceb0dfdd6d1b67d4056a52f0efa2ed2b1142132c6242d917b46d939aade6a362bf586058385d7fcef1b4e358a093d6781b9e9bf280520ff083a6026bf701237e38927ed21209dbf407a7944ef687b93619b181b9112477fa902f391a7163f93bec2d6369ffba644f4fd5139890fb66bd6017a61d9fd043154eb0ab0de3046cdb8a182a553cece0701a922518cf09cd1ab421ee8ec677a8d453cd8c21bdaa5f8dd804dfe80fffec8c4d778d5e260b65a2f0d3c1b09e9d6bd1f3746aa7fe07374a028a89fc96eb66affbcddfaa01a72058566e33af88e37f43fbba73c0423d54079fad54c136ec5fcd61d5134f833ab44f6cfbc2348871f190ac4c4bc20c97fcb29f4823a8e3bf76f85b10dfd33df0001646a7e0b2ee3e14455f6c8f225b80eed457e772cb2504ded46a24e911428decff4a130be797b6530c33ec1be7b0dd4df6206eca1c4c8dfda776336bcb876d80043195de773fbcf0d3abe53e9a38da0af7a6598815a71ffc937203f5a04e87eb532e579d66d42b06b791b6ebd50e7855f6645d29434bb0280fdf1511b163b12838f39ca864516711501bbe345d46b34ab2f0d8317d45376f73e302a90f5c362b18e1840668a9f27e90f2b715b4b6ae7a6dc387583110a42fd4977635275f7244a1912d0c67cf53d5da8a384839020d71db234fcc4388a735275763f01b2b4967e99f551e489bcc28f693a1e688ac8c39a971f8ae9d973cc7adac4a642a7a84ecca2d0bd24c300b94dff82fa4f95c1ce5fdb9128466443cb8442048e53cd46334d59774de0e2ceefcd4cd2e6c9da7cdc2162346111f7da236d72f33d509d73133951e1a3f84fa7e767cf56fc9bfb3986c5ec501634b92a780f63e0ee61e3d25f51c39b975ea587027a101059e9386f1eaaaab8ebfd5c453e9f86c851f9c78e4e06184f04fa9a54ba0bba5d18108c2973f50cb626eca6e3d5b2907b00d2ad4fff9546482815291bd220fa31c1d1a735562174644fe06131e31ce66064fa6a02d5bda756994f81163b97e854274183bbc4ddeb9bb823944afc3e07caf510732df2835fd11de82cb318b88f4d385adb57ac73ffe7f3d1e387848766e11000c94123f2a7d33a93d3b030ebb1206f26221a1ceef44a708693796ab80add7d9b6907c653c6becc21d49c380b3fea419276a387ad482fc3614fa7cac6ea9d07dffc85c1d3f01f57aa9816f32e3237b05d191c3f3d2ed31c313346176d18dc53307afc3aea306a5b44189b6fce062cd21319f1c0a5cf3bc84aaff275491d5fa26d12173e134bdb776478c27502dd4786cc079b6eb00d05f1c8c27a2e326ef11ad1866529b60e6a9e9ae776f01071e364a4604dfe79fbdfc9828628e50940398cc6b925ea8806ee3bbd22129c5d37551eb5e1ef613b027aebce0a83963888396f3e7c953e5416b522fd3a0660fefaea0fc97ca7d82191e2e8f23ca2aa56e8b9de2e1d3e093b8c3f4d7e700b7193b3d83c5b6bb1e7ff2a1c574c9d15ad79631573e41d46653601c510ec7cd0d6125c8e600ebb41247988c28305ac47eead817fecf4460c2221a399134d1d11363401090691a7bf1f58f27a09311d6591cef3d879570667e9e10eebf7df32ec9417f0132be9f1485b167b58b0bf88e31fb2d3957fa05a4d3f191c1d1caa189fc0c11c04287ceaee39a147aced6e3e9c2fe8f51a9823401ad4bf92b0fd4070aae1fe886b8c160a0d2a1507259e58c5608654f05f444877bf9ec215933d6f0a89a3f6199a23c535d8cf9541f2eb970261b12325884fe64330f67a8b07748522c58e5096a04afc67f08b4b0b3da2c9e010b8f079fabdbd187b3d1f69b9f8110e0ec3a488aa8b8563745f7e9fdc1faeaf542858f417d3a75d416e8f55c46cd962d9ac96ce8b56f7a0e22350d2b9e8a537780edddd519fd43baec4834aa6abb0b8c4007dfbb9dac74bf3802108966bf7d5a2999d16110ad0d2cab1c72c2d0ddce14e5043ee62fe9b722355dd2b7e728a589da59ef46dae95f1b89c22d5487a855bc1ee5f9d1427f643e2fa8748e07e6b51e365ab5e23e32401acc229c09f56868532ca611fa678b13f7f580392aee230878817f9dadc9b071245f75b7f626ab6f3342e8d80c3735e3a37646dfddeddec617fd3c155bb0735dd74eb1b71b957645978638f6bab555681b1e0047f7ccf370051f8fd42b171d16291a79ab5aad78940d12129d4de9f1d0a17f539fe333c7e3af31703dd147044ab4efd666cda9942c14cb25fae13cdb497bf7d71094192765df81234cf3dc9d38cdf373a06f5b723ab987708c8ed1b1b7c14cf55663298e752621be837d9e8f806552e0d605515dc0346354c76536d7681bac9dce48479abf18fc8b45862471ce1d75957a23c6bee5b2eb0022d557b6ad6153124e4594d26cc4a6e70de89086e0365039d215c2d9c7d881766b564b58be42104b4a4cad074eb1600be3a98fd7e19296066ee8a8d141d1b9f070c06c58c4f6e5c73b43022f39a13e701220064ceac7951818b1a88f68b2241efc57d37f224161533c75e279500896058aa03ce9571567172b57dbd40e1e14f8068cec77cde8da6aebf54039de9c7251289192616dca9d90bcc3ca24708dde9309d00d9a61c7be33f5858729ca3726fd8e8fdf911e58d3908797ec7b53cec49a8d51a3a30c3172b4277a8be98346488f10385ab3396ba34390f5f44a6f51606a392c25f4b6c65d3cee98004c5312b9f2a6349facbb7f0491fa0505ddc859e25963fae59e8ff05282c108be2a267690c8d53cd2ab7189b997cca8f0905ebcdc86a29b851546284870b348d54023e16262e78c034885696e931e1b2a7b2c23c59ef21393370a16f068ce46115e6b1c3ba9375bb9cb644ec9032bb2eb57eb4897284164af7a8b0a7019a610985dad9f1ce9f12a9a2399ee63fd6d21ee4adc8cbeb7ffe22b50e14c959042197ae45c8f8db2a5d03d6d9c2d5e826112a0bf6d21854a6d5fc77604e4117d7e9a92804c7db9f3eeca536b61a079654f8afbccc140602db833e537ac3c591b98549b5c70734e98b5a47eb9cc16ab2e0ed4f32ff69558e5dcfa2a3b54b8cf3326d4cdd7e9a0c19e4b703070a996acb40a882c2c512e38b4e3d31fe91", 0xd16}], 0x3}}, {{0x0, 0x0, &(0x7f0000000600)=[{0x0}, {&(0x7f0000000880)="90b9f79fecb3ad0dc00ca95fb148a3ba4355cee5ce27d2c10d8474464a37dea0c1ab2a961404f5aa5493cdadb4b6bf4131e96c0aef0f89065db2aa551c68ce3fa911638fd608ff9e30cce409b6e516e59c272cdbbb88c83dc61199d70f8f", 0x5e}, {&(0x7f0000000a40)}], 0x3}}], 0x2, 0x11) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r4 = accept4(r3, 0x0, 0x0, 0x800) sendmmsg$alg(r4, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r4, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc2(0x0, r4) sendmsg$TIPC_NL_NET_GET(0xffffffffffffffff, 0x0, 0x800) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) ioctl$TUNSETIFF(r7, 0x400454ca, 0x0) socket$kcm(0x2, 0xa, 0x2) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) bpf$BPF_PROG_DETACH(0x1c, &(0x7f0000000000)={@cgroup, 0xffffffffffffffff, 0x2f}, 0x20) sendmsg$NFT_BATCH(r8, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f0000000540)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r5, &(0x7f0000001380)={0x0, 0x0, &(0x7f0000001340)={&(0x7f0000000680)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r6, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r9, @ANYBLOB="d506330080000000ffffffffffff080211000001"], 0x6f4}}, 0x0) r10 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_REG(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000100)=ANY=[@ANYBLOB="60010000", @ANYRES16=r10, @ANYBLOB="01002cbd7000ffdbdf251a00000008009a000000000007002100616100000500920005000000080001001a000000180122802400008008000700090000000800060079000000080004000400000000000000030000000c00008008000100ffffffff3c0000800800020007000000080001006300000008000396478e9a397162fa000a000000080001004d000000080006000900000008000600040000001c0000800800020007000000080005000800000008000500080000004600"], 0x160}, 0x1, 0x0, 0x0, 0x840}, 0x4020) sendmsg$NL80211_CMD_SET_WDS_PEER(r1, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)={0x8c, r10, 0x200, 0x70bd2d, 0x25dfdbfd, {{}, {@void, @void}}, [@NL80211_ATTR_MAC={0xa, 0x6, @random="8c42557fec96"}, @NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_MAC={0xa, 0x6, @from_mac=@device_b}, @NL80211_ATTR_MAC={0xa, 0x6, @random="a393072041ca"}, @NL80211_ATTR_MAC={0xa, 0x6, @random="b50340ea8eac"}, @NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_MAC={0xa, 0x6, @from_mac=@device_b}, @NL80211_ATTR_MAC={0xa, 0x6, @from_mac=@device_b}, @NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_MAC={0xfffffffffffffd09, 0x6, @random="e09b44544e6b"}]}, 0x8c}, 0x1, 0x0, 0x0, 0x4008000}, 0x0) 16.313503635s ago: executing program 3 (id=3002): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r1, 0x10e, 0x1, &(0x7f0000000400)=0x1, 0x4) r2 = socket$inet6(0xa, 0x803, 0x81) setsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f0000000280)={{{@in=@rand_addr=0x64010100, @in=@broadcast, 0x0, 0x4, 0x0, 0x0, 0xa}, {0x0, 0x7, 0x0, 0x6, 0xffffffffffffffff, 0x7, 0x0, 0x40000000000000}, {0x9, 0x5f94c303, 0x53e5, 0x20}, 0xfffffff7, 0x1, 0x1, 0x0, 0x3, 0x2}, {{@in=@loopback, 0x1, 0x32}, 0x2, @in6=@local, 0x1502, 0x4, 0x3, 0x0, 0xc36, 0x101}}, 0xe8) connect$inet6(r2, &(0x7f0000000080)={0xa, 0x4e21, 0x0, @loopback, 0xfffffffd}, 0x1c) socket$nl_xfrm(0x10, 0x3, 0x6) r3 = socket$l2tp6(0xa, 0x2, 0x73) ioctl$BTRFS_IOC_WAIT_SYNC(r3, 0x40089416, &(0x7f0000000080)) bpf$PROG_LOAD(0x5, &(0x7f00002a0fb8)={0xd, 0x4, &(0x7f0000000000)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x8c, 0x76}, [@call={0x27}]}, &(0x7f0000000040)='syzkaller\x00', 0x4, 0x99, &(0x7f0000000180)=""/153, 0x0, 0x0, '\x00', 0x0, @sock_ops, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0xfffffffffffffed8}, 0x23) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[@ANYRES32=0x0], 0x28}, 0x1, 0x0, 0x0, 0x4004095}, 0x40040c0) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x18, 0x3, &(0x7f0000000d00)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000000)='syzkaller\x00'}, 0x90) r5 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000001c0)='task_newtask\x00', r4}, 0x10) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff) unshare(0x2c020400) r6 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r5}, 0x8) close(r6) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x1c1341, 0x0) ioctl$TUNSETIFF(r7, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) r8 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r9 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0), 0xc0241, 0x0) close(r9) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)) ioctl$SIOCSIFHWADDR(r9, 0x8922, &(0x7f0000002280)={'syzkaller0\x00', @random="2b0100004ec6"}) close(r8) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)) ioctl$SIOCSIFHWADDR(r8, 0x8914, &(0x7f0000000140)={'syzkaller0\x00', @random="371692e7f7ef"}) r10 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close(r10) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000340)) 15.882109025s ago: executing program 2 (id=3003): ioctl$F2FS_IOC_GET_PIN_FILE(0xffffffffffffffff, 0x8004f50e, 0x0) socket$kcm(0xa, 0x2, 0x88) socket$tipc(0x1e, 0x5, 0x0) r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) r1 = socket$key(0xf, 0x3, 0x2) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f0000000a00)=ANY=[@ANYBLOB="b8000000190001000000000000000000fe880000000000000000000000000101ac1414aa000063df0000000000000000000000004e2300000a00008000000000887a590733ebcf3122dbc5453950d1ecbf3d61d1323f8fb62b28a04b40c89fd76d8e28af0f1a88c5057c66b0096210829f26da81019e18803e914e5d7b15127701208997d3d922256bb9ebad406101308cd2d95eff1dd00628b3a3bf7545e6f82503a66633fab44526ee6f9b7e86adff60078268d45b5d724f9778d90695bb7f11392679cbbdddaea0c45cb517c9a66c064430400799db4016e968347e76cc0a9a79b44351d9472cd695dc6e9ee975fed5ff3cb6d2c5a366b4ff62fe155587d6d2cdb09fda4d81dd51956eb0b4d016acd3e8bfeb654d6c1e55f051ec6500ea296692a738617209aed6884c04c88d7c52efc798f5fb9d5347340ecd0fa7d61b3725e02985ac0c2483af934897ee686f50030e95245704d06ddbe01fa6e199764c775e9a6f6ea310", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000000000000a900000000000000040000000000000000000000000000000000000000000000ffffffffffffffffffffffffffffffff00000000000000000000000000000000000a0000000000000000000000804000000000000100000000000010000000000001010000000000"], 0xb8}, 0x1, 0x0, 0x0, 0x80}, 0x0) sendmsg$key(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)=ANY=[@ANYBLOB="021600000a0000000200000000000000080012000007a18208"], 0x50}}, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x11, 0x6, &(0x7f0000000cc0)=ANY=[@ANYBLOB="050000000000000061110c00000000008510000002000000850000000500000095000000000000009500a5050000000077d8f3b423cdac8d80000000000000002be16ad10a48b243ccc42606d25dfd73a015e0ca7fc2506a0f7535f7866907dc0200000000000000ae669e17fd6587d452d6453559c3421eed73d56615fe6c54c3b3ffe1b4ce25d7c983c044c03bf3a48dfe47ec9dd6c091c30b93bfae76d9ebacd3ed3e26e7a23129d6606fd28a69989d552af6bda9df2c3af36effff9af2551ce896165127cb3f011a7d06602e2fc40848228567ffb400000000003ed38ae89d24e1cebfba2f87925bfacba83109751fe6c05405d027edd68149ee99eef6a6992308a4fc0b7c70bc677d6dd4aed4af7500d7900a820b6347184e9a217b5614cd50cbe43a1ed2526814bc0000e9e086ce48e90defb6670c3df2624f56da648d28ad0a97aec7291c25447c106a99893e10db21901eb397b2f5fd71400fa7a050fbbef9e326ea27e513e96068fd1e8a43e89f9c85c822a961546ed5363c17ff1432d08806bc376e3e49ee52b59d13182e1f24ed200ada10eb1affb87ba55b2d72078e9f40b4ae7d01000000d11cd22c35d32940000088dde499000000fdffffff00000000000f000000ef0000000000000000000000000c52f4ebd2c893bb97a068bd10734a83584898eccb26f7b789cfc4cd995fa3e11a5c74c85404e2df3ad37b729ac83b0dcb4f48f3c3356b9997fc455a17690b6f7f9ccbe4b1701941b18aba6b16455a66c3b84b138efc20a546d3d5227e23b03f2a834391ade2ff3e93ee296c4082ee73e7c353312c9d75711ce1623e9c54bdff59d2a69dcb7d84c235b23a4480c2461b405cfd1a38992f295ad3adc94cd07c850d1ce6d0b2fea02c24e9280333152fb794e4ddea02017a6c139b50101caecaf2abc0847a1ff2f7fc3c2b99a96fc4275ad107274e2934a87a4ddcdb112754ca5bdec0ead14b6c0f19a43a2f05c7f0be31491eb8c9ff68236c8600040000000000000000000066e034c81c3cab64e4fc8dc55ce0ada18dcbf31c6e82893add3bee3e10fc873d1d922b0877cbcd95b839d3059d5140a1f742f6e75741e39e5cb6a193e06a1043375b0f61b5d4e17c81baa31b924d84f224baf1221c15fa12313ffbfa7c2730309f66705b71e6205e7cbf3643561eabb9a63fcd604d5cc27e1317ad94cf438d71873e540be16b6ca205081173bd03c4754fc4674812daab482fd390a1c903b5d28a1eb247b5837d7603b92495d5c569f6433c3fca5206cb0000003fdbbd3892c52c2e7612e05de32322e980a3d69931e2c9312dd517c96f2ee90362476ed853c4c9b7d4ebf13cbaa795860e92a3d7d004f2c491db38eb769f094d5d48b262cc35c40682138cf13a49aa9f27abec00002f01ba1251aaf2385416ca719300"], &(0x7f0000000000)='syzkaller\x00', 0x5, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x6}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000001c0)='sched_switch\x00', r3}, 0x18) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x11, 0xf, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000800000000bf91000000000000b702000043e7b5538500000085000000b70000000000000095"], &(0x7f0000000180)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x43, '\x00', 0x0, @fallback=0xa, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000}, 0x94) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r5, 0xc1646000) r6 = syz_init_net_socket$x25(0x9, 0x5, 0x0) ioctl$SIOCX25GSUBSCRIP(r6, 0x89e0, 0x0) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r7, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r7, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000010c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSET={0x48, 0x9, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x2}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_EXPRESSIONS={0x14, 0x12, 0x0, 0x1, [{0x10, 0x1, 0x0, 0x1, @xfrm={{0x9}, @void}}]}]}, @NFT_MSG_NEWSETELEM={0x178, 0xc, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x6}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x14c, 0x3, 0x0, 0x1, [{0x2c, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0x28, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0x21, 0x1, "cacbe6455607d36987fa1b821a7c5c9494a73c1a7a9b380bfe849feb83"}]}]}, {0x10c, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_TIMEOUT={0xc, 0x4, 0x1, 0x0, 0x4}, @NFTA_SET_ELEM_EXPIRATION={0xc, 0x5, 0x1, 0x0, 0x1}, @NFTA_SET_ELEM_EXPIRATION={0xc, 0x5, 0x1, 0x0, 0x9}, @NFTA_SET_ELEM_EXPRESSIONS={0x54, 0xb, 0x0, 0x1, [{0x50, 0x1, 0x0, 0x1, @dynset={{0xb}, @val={0x40, 0x2, 0x0, 0x1, [@NFTA_DYNSET_OP={0x8, 0x3, 0x1, 0x0, 0x1}, @NFTA_DYNSET_SET_NAME={0x9, 0x1, 'syz0\x00'}, @NFTA_DYNSET_SREG_KEY={0x8, 0x4, 0x1, 0x0, 0x12}, @NFTA_DYNSET_SREG_KEY={0x8, 0x4, 0x1, 0x0, 0x1}, @NFTA_DYNSET_SET_NAME={0x9, 0x1, 'syz1\x00'}, @NFTA_DYNSET_SET_NAME={0x9, 0x1, 'syz2\x00'}]}}}]}, @NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x3}, @NFTA_SET_ELEM_EXPRESSIONS={0x88, 0xb, 0x0, 0x1, [{0x38, 0x1, 0x0, 0x1, @counter={{0xc}, @val={0x28, 0x2, 0x0, 0x1, [@NFTA_COUNTER_PACKETS={0xc, 0x2, 0x1, 0x0, 0x7}, @NFTA_COUNTER_BYTES={0xc, 0x1, 0x1, 0x0, 0x51}, @NFTA_COUNTER_BYTES={0xc, 0x1, 0x1, 0x0, 0x1}]}}}, {0x10, 0x1, 0x0, 0x1, @reject={{0xb}, @void}}, {0x3c, 0x1, 0x0, 0x1, @tproxy={{0xb}, @val={0x2c, 0x2, 0x0, 0x1, [@NFTA_TPROXY_FAMILY={0x8, 0x1, 0x1, 0x0, 0x2}, @NFTA_TPROXY_REG_ADDR={0x8}, @NFTA_TPROXY_FAMILY={0x8, 0x1, 0x1, 0x0, 0x2}, @NFTA_TPROXY_REG_ADDR={0x8, 0x2, 0x1, 0x0, 0x2}, @NFTA_TPROXY_FAMILY={0x8, 0x1, 0x1, 0x0, 0x2}]}}}]}]}, {0x10, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_EXPIRATION={0xc, 0x5, 0x1, 0x0, 0x3}]}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x1e8}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETSETELEM(r8, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000880)={0x40, 0xd, 0xa, 0x801, 0x0, 0x0, {0xa, 0x0, 0x1}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x14, 0x3, 0x0, 0x1, [{0x10, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0xc, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0x6, 0x1, "1e1c"}]}]}]}]}, 0x40}, 0x1, 0x0, 0x0, 0x4000805}, 0x8000) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000140)='kmem_cache_free\x00', r4, 0x0, 0x8}, 0x18) ppoll(&(0x7f0000000500)=[{r0, 0x3204}], 0x1, 0x0, 0x0, 0x0) r9 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r9, 0x107, 0x7, 0x0, 0x0) pselect6(0x40, &(0x7f0000000240)={0x0, 0x0, 0x3, 0x8000000000, 0x1}, 0x0, &(0x7f00000002c0)={0x3ff, 0x0, 0x0, 0x3, 0x0, 0x0, 0x7fffffff, 0xfffffffffffffffc}, 0x0, 0x0) write$cgroup_pressure(0xffffffffffffffff, &(0x7f00000000c0)={'full', 0x20, 0x6, 0x20, 0x416}, 0x2f) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) r10 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040), 0x200002, 0x0) r11 = openat$cgroup_devices(r10, &(0x7f0000000300)='devices.allow\x00', 0x2, 0x0) write$cgroup_devices(r11, &(0x7f00000000c0)=ANY=[@ANYBLOB='c 1:2'], 0xa) 15.517371255s ago: executing program 6 (id=3005): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0xa, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={r0, 0x2000000, 0xe, 0x0, &(0x7f0000000200)="63eced8e46dc3f0adf33c9f786dd", 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000500)={&(0x7f0000000540)=ANY=[@ANYBLOB="9feb0100180000000000000038000000380000000400000002000000000000110400000000000000000000000000000200000000020000000000000602000000020000000000000e0300000000000000000061"], 0x0, 0x54}, 0x28) bpf$BPF_PROG_DETACH(0x1c, &(0x7f0000000580)=ANY=[@ANYRESHEX=r0, @ANYRES32, @ANYRES32, @ANYBLOB='/\x00'/12, @ANYBLOB="df9adbff08523681ee9bde50e468f03218676d660b77230cd6974ec663afc49929b0ecaf9f409ed80b7872f835d0e0d1c0580ac8b50b7ad697749c2d1fc42f795359d151cec5b58edf718386f8a84ba24418ffffff7f538753aaa0daec97038dd7c234d5b5238ea122d8bdebe88f1fbb73e5257febd80e40e5a9ae412148a91bb55608ec3f9d975dff33965913275874c5bbda6ac1c4db62a46de6051a2aa7cf3f1c4435bf16547136c4b3bc589c8676f9690d202bb13bd2e7c35a84e6ffb43b00b2f6a45c68fcd9e6b6b3d981d3b171949270a41f63aa4a", @ANYBLOB="7fb733358c739a898d1fd6e2f7ba27dca68b910dba27da03e24e7ee72c7012709d403835397a2038e23ac52358dffed2e6bf3d35bcac3c3d0be345d7a89bb3c35d1fa08ea4c8c9d6962c2bb275416c7345822c0aab257b33efd65ffac19c74cdeda5048acc52247e26b5b3c85e33b446b390892846ccbaf5820992f100c7303bd150b1e9d7000fd88c8272cc20fe84413dc6ee1eb73e27f075988397cccdb32bf5b55a797679790494b92a9370ef49cde4febd7f67c705681bf17d592059865e03e01ab1334dbd980a9b49c967c0b13723e1f73f22b2a97ae1d14e67beb1099a1886eb4554751c6a467f27000f94e65f42cf64204d31"], 0x20) r1 = socket$tipc(0x1e, 0x2, 0x0) ppoll(&(0x7f0000000500)=[{r1, 0x208}], 0x1, &(0x7f0000000580), 0x0, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_START_AP(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000540)=ANY=[@ANYBLOB="80000000", @ANYRES16, @ANYBLOB="050000000000000000000f00000008000300", @ANYRES32=0x0, @ANYBLOB="0c009900040000005300000057000e0048"], 0x80}}, 0x0) 15.515042715s ago: executing program 2 (id=3006): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_inet_SIOCGARP(0xffffffffffffffff, 0x8954, &(0x7f0000000040)={{0x2, 0x4e21, @empty}, {0x1, @random="8825f840d166"}, 0x4, {0x2, 0x4e21, @rand_addr=0x64010100}, 'lo\x00'}) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000040), 0x1e) (async) setsockopt$inet6_IPV6_HOPOPTS(r0, 0x29, 0x36, 0x0, 0x0) (async) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000980)=@newtaction={0x8f4, 0x30, 0xb, 0x5, 0x0, {}, [{0x58, 0x1, [@m_ct={0x54, 0x1, 0x0, 0x0, {{0x7}, {0x2c, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0x80000001, 0x0, 0x3, 0xfffffffc, 0x400}}, @TCA_CT_ACTION={0x6, 0x3, 0x19}, @TCA_CT_NAT_IPV4_MIN={0x8, 0x9, @private=0xa010102}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x2}}}}]}, {0x888, 0x1, [@m_police={0x4a4, 0x4, 0x0, 0x0, {{0xb}, {0x468, 0x2, 0x0, 0x1, [[@TCA_POLICE_TBF={0x3c, 0x1, {0x7, 0x20000000, 0x2, 0x7, 0xbd4, {0x6, 0x2, 0x6, 0x3, 0x2, 0x6}, {0x4, 0x0, 0x2, 0x0, 0xab33, 0x7fff}, 0x80000001, 0x8000, 0x8}}, @TCA_POLICE_PEAKRATE64={0xc, 0x9, 0x9}, @TCA_POLICE_PEAKRATE64={0xc, 0x9, 0xcc3a}, @TCA_POLICE_RATE64={0xc, 0x8, 0xc4a3}, @TCA_POLICE_RATE={0x404, 0x2, [0x5, 0x6, 0xfc, 0xfffffbff, 0x6, 0x6bad, 0x9, 0xfffffffa, 0xd, 0x8, 0x3ff, 0x5, 0xe1, 0x41, 0xffffffff, 0x200, 0x6, 0x37, 0x8, 0x10000, 0x8, 0x1, 0xc0fc, 0x9, 0x3, 0x6, 0x6, 0x8, 0x5, 0x2, 0x401, 0x7, 0x9, 0x3, 0xfffff82d, 0xfff, 0x2f67, 0x5a8f, 0xfdd, 0x0, 0xb567, 0x1, 0x7, 0xc8, 0x3, 0x7, 0x100, 0x4, 0x100, 0x87f, 0x7f, 0x1, 0x8, 0x7, 0xbea1, 0x401, 0x7fffffff, 0x7, 0x81, 0xa, 0x3, 0x8, 0x1, 0x1e2a, 0x400, 0x7, 0xd, 0xf, 0x9, 0x1, 0x2, 0x4, 0x3, 0x3, 0x2, 0x0, 0x0, 0x80000001, 0x6, 0x0, 0x0, 0x82, 0x1, 0x101, 0x9f3, 0x1, 0x0, 0x5, 0xc0, 0x5, 0x4, 0x6, 0xcd, 0x8, 0x4, 0x4, 0x3, 0x3ab2d81a, 0x2bb9991c, 0x3, 0x9, 0x0, 0x6, 0x100000, 0x7, 0x9, 0x2, 0x4275, 0xb29187f, 0x3, 0x9, 0x7fffffff, 0xfffffc01, 0x1, 0x2, 0x9933, 0x10001, 0x7, 0x0, 0xfffffffc, 0x9, 0x3, 0x4, 0x80000000, 0x1, 0x6, 0x2, 0x80, 0x6, 0x9, 0x40, 0x731, 0x8, 0xc, 0x2, 0xd86, 0x157, 0x400, 0xff, 0x2, 0x40, 0xfffff800, 0x6, 0x2, 0x200, 0xfffffffa, 0x7, 0x2, 0x2, 0x2c00, 0x5, 0x8000, 0xffff8001, 0x8, 0x0, 0xfff, 0xc, 0x8, 0x8, 0x5, 0x100, 0x883f, 0x0, 0x7b, 0x7f, 0xffff, 0x0, 0x1000, 0x9, 0x0, 0x9, 0x40, 0x800, 0x0, 0x9, 0x0, 0xd, 0x7, 0x1, 0x7, 0x5, 0x8000001, 0x7, 0xfffffff8, 0x1ff, 0x10000, 0xffffffff, 0xe, 0x5, 0x3, 0xfdee, 0xfffffff7, 0x6, 0x5, 0x3, 0x8, 0xf, 0x2, 0xfffffff8, 0x5, 0x0, 0xde2, 0x3586edca, 0x8, 0x6, 0xfff, 0x8, 0x1ff, 0x8000, 0xfc4, 0xa3f, 0x1, 0x2, 0x0, 0x6, 0x9, 0x0, 0x40, 0x4, 0x400, 0x80000000, 0x6, 0x3, 0x13, 0x3, 0x6, 0x10001, 0x1, 0x7, 0xfffffffd, 0x8ed, 0x6, 0x7, 0x7, 0xffffffff, 0x80000001, 0x9, 0x335, 0x4, 0x0, 0x2, 0x4, 0x100, 0x310, 0x1c7d, 0x2, 0xa8c0000, 0x3, 0x0, 0x0, 0x8, 0x6, 0x10000, 0x504b9d43, 0x80, 0xc]}]]}, {0x13, 0x6, "d805c6af2f54b80a9bc7be7e96b869"}, {0xc}, {0xc, 0x8, {0x3}}}}, @m_connmark={0x14c, 0x1f, 0x0, 0x0, {{0xd}, {0x20, 0x2, 0x0, 0x1, [@TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x100, 0x5, 0x1, 0x5, 0x200000}, 0x1}}]}, {0x100, 0x6, "2f11e0fbbaa4d38691932406225b426bd62c03135d8bf2361516eab8722c94002766679cf24549053fc175eaf57b8116d4a069177c6c0b647a0e7b88c5e30839afae73f64a37f9dea222325c1e1e39e67fc9145e839dcb227ac13d1b7dd03b0de0c7e70df4a5515483013796038e2f0b3a472245323dac1764cb91ae3b88b0bf1ad4425a03044135e8b46d18674f2357b20dd9a4a9b23ca03b8f0045f968d15737caa1cf2c0e545a1a29251baefc459ea4093436689a5862a08493908a30ae24d1d96532232a88c7029881c1cc7631801d753721855b7ee06729c949aa542552e7cdf3d0bc50a5610580dbbb67f96622cb35a06625f6ace3ddb86368"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x2}}}}, @m_ife={0xe0, 0x9, 0x0, 0x0, {{0x8}, {0x20, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c, 0x1, {{0xffffffff, 0x578, 0x3, 0x5, 0x6}}}]}, {0x9a, 0x6, "517aef3f8f90fd55a276827d6be4c0d4cd29b2181210df1615dbf861469f36efdbcc32b98820c316414da283e99cde9abcf2e3b8dff3c5357d8ed1bbfbb0607c8352200910250f88121630fef5d00600fdb4b092b31e7c802149a2f1d6e5e58378caed7b1a6380b9c75e830f8efecfec83d93511597f8b02bb37fbbce71d267270f8bec56773ffaca3562d31fc2d24b0d1a47cf72f4d"}, {0xc, 0x7, {0x0, 0x1}}, {0xc}}}, @m_nat={0x38, 0x16, 0x0, 0x0, {{0x8}, {0x4}, {0xd, 0x6, "f172a269c15ecc5f44"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x3, 0x2}}}}, @m_skbedit={0x17c, 0x22c2, 0x0, 0x0, {{0xc}, {0x74, 0x2, 0x0, 0x1, [@TCA_SKBEDIT_PARMS={0x18, 0x2, {0x10, 0x70, 0xd775f71bb22267a5, 0xc061, 0x6}}, @TCA_SKBEDIT_PRIORITY={0x8, 0x3, {0x7, 0xffe0}}, @TCA_SKBEDIT_PRIORITY={0x8, 0x3, {0xc, 0x1}}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0x9, 0x8, 0x20000000, 0x400, 0xc8}}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0xffff42fe, 0x147, 0x0, 0x4, 0xb8d}}, @TCA_SKBEDIT_MARK={0x8, 0x5, 0xfffffffb}, @TCA_SKBEDIT_MARK={0x8, 0x5, 0x5}, @TCA_SKBEDIT_MARK={0x8, 0x5, 0x10000}]}, {0xe0, 0x6, "2f866e60ee0618b2c3029c9ba3ef6051c55e6bc5631eb1424c11224a10e8f64fb51b2ac8fea932df19e2e381e5eb6a4240b087b04d818913bc455a9844b2e2bda588e2fd9ac4c7c93cf45b222b487d8ba57554952b5536140f804f0ac684f97a6f994087dcdd70d1a1667bab1bf8f22779abcf268671747ee79fa4f01e2afa942606065d4e864c4b89d7fececf55dd6779627fdc132b337b7e6a1b64e5dea781ea1d1e78171090378e007d82f8b9534695a9396f8f2695cef0b926a26b18b3c297c0f2ee5ff5112eaec23d3d8bd245aa76119f732716c78896623222"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x1, 0x1}}}}]}]}, 0x8f4}, 0x1, 0x0, 0x0, 0x8890}, 0x40) (async) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000006c0)=ANY=[@ANYBLOB="a0010000100001000000000000000000fc01000000000000000000000000000000000000000000ecdf000000", @ANYRES16=r1, @ANYRES32=0x0, @ANYRES32=r2], 0x1a0}}, 0x0) (async) socket$nl_route(0x10, 0x3, 0x0) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) (async) r4 = socket$inet6_mptcp(0xa, 0x1, 0x106) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000200)={r4, 0x200000000000004, 0x7, 0x10}) (async) setsockopt$inet_sctp6_SCTP_INITMSG(r3, 0x84, 0x2, &(0x7f00000000c0)={0xfffc, 0x0, 0x30, 0x1ff}, 0x8) sendto$inet6(r3, &(0x7f00000004c0)="d7", 0x1, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x6, @private1, 0x8}, 0x1c) getsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r3, 0x84, 0x8, &(0x7f0000000100), &(0x7f0000000180)=0x4) (async) r5 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r5, 0x10e, 0xc, 0x0, 0x0) (async) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) setsockopt$netlink_NETLINK_TX_RING(r5, 0x10e, 0x7, &(0x7f00000001c0)={0xa2cd, 0x101, 0x4, 0x8a}, 0x10) (async) sendmsg$NFT_BATCH(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000100000a20000000000a01010003000000000000030000090900010073797a300000000030000000160a010800000000000000000300000a0900020073797a3100000000040003800900010073797a3000000000140000001100010000000000000000000100000a7e85396b8ec54dac366a70964606c063afaeb4ff309509057fdb0c11d481175a2ca73aae788b5005238cde866da20bc7816a0afa1a0c3a298644bfec62c5bde2e58250d003332b2a644faec8f3d02eb05c073d"], 0x78}, 0x1, 0x0, 0x0, 0x882}, 0x20000000) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) r7 = socket$kcm(0x10, 0x2, 0x0) (async, rerun: 32) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000040)="100000002d000b02d25a806f8c6394f9101a04000a", 0x15}], 0x1}, 0x0) (async, rerun: 32) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000000)="d80000001c0081044e81f782db44b9040a1d08030e000000e8fea4a1180015000600142603600e1208000f1000810401a80016000a0001", 0x37}], 0x1, 0x0, 0x0, 0x7400}, 0x10) (async, rerun: 64) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={&(0x7f0000000000)=@in6={0xa, 0x0, 0x0, @mcast1}, 0x80, 0x0, 0x0, 0x0, 0x5c8}, 0x0) (async, rerun: 64) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907009875f37538e486dd6317ce620300fe"], 0xfe1b) (async, rerun: 64) r8 = socket$kcm(0x10, 0x2, 0x0) (rerun: 64) write$cgroup_subtree(r8, &(0x7f0000000000)=ANY=[@ANYBLOB="563f00001800599c6d0eab070004000523"], 0xfe33) (async) write$cgroup_subtree(r7, &(0x7f0000000000)=ANY=[@ANYBLOB="563f000019"], 0xfe33) (async) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x2, 0x2000000000032, 0xffffffffffffffff, 0x0) 15.189069954s ago: executing program 6 (id=3008): socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000080)='ns/ipc\x00') unshare(0x6a040000) connect$inet6(0xffffffffffffffff, &(0x7f00000000c0)={0xa, 0x4e22, 0x2, @loopback, 0x6}, 0x1c) sendmsg$TIPC_NL_KEY_SET(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001200)=ANY=[], 0x54}}, 0x0) bpf$MAP_CREATE(0x280, &(0x7f0000000280)=@base={0x5, 0x5, 0x19fd, 0x84, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x2}, 0x50) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000300), 0xa0380, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) close(r1) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000500)) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000a80)={'syzkaller0\x00', @broadcast}) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x1c1842, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close(r4) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180)) ioctl$SIOCSIFHWADDR(r4, 0x8943, &(0x7f0000002280)={'syzkaller0\x00'}) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) write$tun(r0, &(0x7f0000000040)=ANY=[@ANYBLOB="1c0089060001080006040002530d9f22825effdfffffaaaaaaaaaa2aac1414bb"], 0x20) 14.760083962s ago: executing program 2 (id=3009): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000380)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r7, {0x0, 0xb}, {0xffff, 0xffff}, {0x0, 0xfff3}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x100, 0x7, 0x6361, 0x5, 0xffffffed, 0x6}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x20000001}, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000400)=@newqdisc={0x3c, 0x24, 0x4ee4e6a52ff56541, 0x70b923, 0x7fffd, {0x0, 0x0, 0x0, r7, {0x0, 0x7}, {0xb, 0xb}, {0xa, 0xa}}, [@qdisc_kind_options=@q_cake={{0x9}, {0xc, 0x2, [@TCA_CAKE_TARGET={0x8, 0x8, 0x2}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x2405c0e1}, 0x4008000) r8 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r10 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r10, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty}, 0x1c) setsockopt$sock_int(r10, 0x1, 0xf, &(0x7f00000002c0)=0x7, 0x4) r11 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$sock_int(r11, 0x1, 0xf, &(0x7f0000000180)=0x800001, 0x4) bind$inet6(r11, &(0x7f0000000140)={0xa, 0x4e22, 0x0, @empty}, 0x1c) close(r11) r12 = socket$packet(0x11, 0x2, 0x300) sendto$packet(r12, 0x0, 0x0, 0x40, &(0x7f00000001c0)={0x11, 0x88a8, r9, 0x1, 0xd8, 0x6, @random="98c8ca7122df"}, 0x14) r13 = syz_genetlink_get_family_id$tipc(&(0x7f0000000280), r2) sendmsg$TIPC_CMD_ENABLE_BEARER(r2, &(0x7f0000000340)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x1000040}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x34, r13, 0x400, 0x70bd06, 0x25dfdbfc, {{}, {}, {0x18, 0x17, {0x0, 0x5, @udp='udp:syz1\x00'}}}, ["", "", "", "", ""]}, 0x34}, 0x1, 0x0, 0x0, 0x2000004}, 0x4001) r14 = socket$packet(0x11, 0x3, 0x300) sendto$packet(r14, &(0x7f00000005c0)="bad330fbc9b55400040000ea0756", 0xe, 0x40, &(0x7f00000001c0)={0x11, 0x88a8, r4, 0x1, 0xd8, 0x6, @multicast}, 0x14) r15 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r15, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000008c0)=@newsa={0x17c, 0x10, 0x1, 0x0, 0x25dfdbfc, {{@in=@empty, @in6=@dev={0xfe, 0x80, '\x00', 0x16}, 0x0, 0x0, 0x81e, 0x4, 0x0, 0x20, 0x80, 0x21}, {@in=@multicast1, 0x0, 0x33}, @in=@loopback, {0x401, 0x0, 0x8, 0x0, 0xffffffff, 0x3, 0x0, 0x8000000}, {0xfffffffffffffffd, 0x0, 0xfffffffffffffffd, 0x80000001}, {0x0, 0x1, 0xfffffffc}, 0x0, 0x0, 0xa, 0x4, 0x1, 0x40}, [@algo_auth={0x89, 0x1, {{'rmd160\x00'}, 0x208, "d5deb33e8d02d5b4c6cdd277a6d0adde7a89a2677f61d0a96eb8706a52b9fbdc312b5aeab8894c493c358ef76ec179b21865e1b6f29b2da7d564f2bcd96ec67ffc"}}]}, 0x17c}, 0x1, 0x0, 0x0, 0x24040021}, 0x0) 8.218017276s ago: executing program 3 (id=3011): socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000080)='ns/ipc\x00') r0 = bpf$MAP_CREATE(0x0, &(0x7f0000010880)=@base={0x5, 0x4, 0x8, 0xc}, 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000010400)={0x11, 0xd, &(0x7f0000000280)=@framed={{}, [@call={0x85, 0x0, 0x0, 0xf}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x3}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xc, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000080)={r1, r0}, 0xc) unshare(0x6a040000) connect$inet6(0xffffffffffffffff, &(0x7f00000000c0)={0xa, 0x4e22, 0x2, @loopback, 0x6}, 0x1c) sendmsg$TIPC_NL_KEY_SET(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001200)=ANY=[], 0x54}}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000280)=@base={0x5, 0x5, 0x19fd, 0x84, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x2}, 0x50) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000300), 0xa0380, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) close(r3) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000500)) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000000a80)={'syzkaller0\x00', @broadcast}) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x1c1842, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close(r6) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180)) ioctl$SIOCSIFHWADDR(r6, 0x8943, &(0x7f0000002280)={'syzkaller0\x00'}) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000800)=ANY=[@ANYBLOB="500100001a00130700000000fddbdf252001000000000000000000000000000120010000000000000000000000000001000000004e2100020000014c6c000000", @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="fc010000000000000000000000000000000000fe32000000ffffffff000000000000000000000000000000000010000000000000000000000000000000000000080000000000000001000000ffffffff0000000000000000000000800000000043050000000000000400000000000000ffffffffffffff7f000000000000000001000000000000000000000000000000000000002cbd70000035000002"], 0x150}, 0x1, 0x0, 0x0, 0x880}, 0x2000) 8.082190694s ago: executing program 4 (id=3012): mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x0, 0x20000000ec071, 0xffffffffffffffff, 0x4000) mmap(&(0x7f0000f96000/0x4000)=nil, 0x4000, 0x0, 0x4000932, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) r0 = socket$inet6_udplite(0xa, 0x2, 0x88) r1 = socket(0x1d, 0x2, 0x6) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000000000)={'vxcan0\x00', 0x0}) bind$can_j1939(r1, &(0x7f0000000380)={0x1d, r2, 0x1, {0x0, 0x0, 0x3}, 0xff}, 0x18) sendmsg$NL80211_CMD_SET_MULTICAST_TO_UNICAST(r1, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={0x0}, 0x1, 0x0, 0x0, 0x20004010}, 0xc0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f0000000000)={0x5, 0x1, 0x2, 0x0, 0x0, [{{r1}, 0x5}, {{}, 0xa472}]}) 7.943601547s ago: executing program 4 (id=3013): bind$x25(0xffffffffffffffff, 0x0, 0x0) syz_emit_ethernet(0x2e, &(0x7f0000000240)={@multicast, @local, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x20, 0x0, 0xe000, 0x0, 0x11, 0x0, @empty, @empty}, {0x4, 0x4e25, 0xc, 0x0, @gue={{0x1, 0x1, 0x2, 0xc, 0x100, @void}}}}}}}, 0x0) syz_emit_ethernet(0x32, &(0x7f0000000440)={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @multicast, @void, {@ipv4={0x800, @udp={{0x6, 0x4, 0x0, 0x0, 0x24, 0x0, 0x4002, 0x0, 0x11, 0x0, @empty, @empty, {[@ra={0x94, 0x4}]}}, {0x4e24, 0x0, 0xc, 0x0, @opaque="a256dd25"}}}}}, 0x0) 7.848270678s ago: executing program 4 (id=3014): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$IPVS_CMD_GET_DEST(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000010c0)={0x28, r3, 0x50dc85624ea6cf59, 0x70bd27, 0x1, {}, [@IPVS_CMD_ATTR_SERVICE={0x14, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_AF={0x6, 0x1, 0xa}, @IPVS_SVC_ATTR_FWMARK={0xffffffffffffff81, 0x5, 0x3}, @IPVS_SVC_ATTR_NETMASK={0x0, 0x9, 0x24}, @IPVS_SVC_ATTR_FWMARK={0x0, 0x5, 0x4}, @IPVS_SVC_ATTR_PORT={0x0, 0x4, 0x4e21}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x400c081}, 0x0) sendmsg$IPVS_CMD_GET_INFO(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x3c, r3, 0x4, 0x70bd25, 0x25dfdbfe, {}, [@IPVS_CMD_ATTR_DEST={0x28, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x4}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv4=@private=0xa010101}, @IPVS_DEST_ATTR_TUN_PORT={0x6, 0xe, 0x4e23}]}]}, 0x3c}, 0x1, 0x0, 0x0, 0x1}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xa, 0x1fffffffffffffcd, &(0x7f0000000440)=ANY=[@ANYBLOB="180000000000000000000000000000008500000022000000180100002020702500000000002020207b0af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007200000095"], 0x0, 0x2000000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xa, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18000000000000000000000000000000850000006d"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xa, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x16, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={r4, 0x2000000, 0xe, 0x0, &(0x7f0000000200)="63eced8e46dc3f0adf33c9f7b986", 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r5 = socket$inet_udp(0x2, 0x2, 0x0) r6 = socket$inet6(0xa, 0x1, 0xff) sendmsg$inet6(r6, &(0x7f0000000340)={&(0x7f0000000080)={0xa, 0x4e20, 0x8, @private2, 0x657}, 0x1c, &(0x7f0000000280)=[{&(0x7f0000000180)="f667e1238035bb43babcefb195a095339bc2895eacef5adf076c833b59e8acd02d219f9a802171937d7a3894e3b96be3894eabe755bb612675b91079729cf3b9f667a6178da8c650e11bb191a61854240d6993dd49b2e76bedbda7843397784af6b9eb56b38dcd8d2f965df119fdf51ed1bc3d04d570b2a20a7b552de46a99d71c0f7b00e616510677ccec6d7e636cc6f0bbec417e0df3b205cc7418d4fc3090a0a67cd1969442a9450af73cfc79ef0f68f7c383bc8ba02c5c294169916038529629ab9dd5a5849dbed97442432c8e0ec425", 0xd2}, {&(0x7f0000000380)="abb868896bc87a06ccbf8898684a1ae7e58b617c07ec2018715eec441f852809cfc323bf080d5c7bd01fcd6f25c1edf67f563a86d1e523de3557f21f2e7a3a5ab83cd0f3af4feda0a5cdd6e8240293e09a70250741ff5d8737e316e6d44753a9b43a05795d6e1846a9eb0a04ff6d50df9087f79c8b41a921b5f71df2d5c18112210e08017dfab451c35e6dfbc8ec3ff5f0281c05fbb9bcf24d3ced1d6be285dcdaf297108ca13d820c5b7beadb91b0c46793685fb8e21cf9b9075d48c423b310e207bf6bfb24b35425d2bfc66af13c5417483dfe38c90b8bdedac73976530dbb24fd105e0d977800000000000000607d1a8015f67608725da67353568dbd8696238749cd76a0fe2aa9f503b6759962758876a8d1", 0x114}], 0x2, &(0x7f00000002c0)=[@hoplimit_2292={{0x14, 0x29, 0x8, 0x8}}, @dontfrag={{0x14, 0x29, 0x3e, 0x7}}, @rthdrdstopts={{0x20, 0x29, 0x37, {0x2f, 0x0, '\x00', [@ra={0x5, 0x2, 0x6}]}}}, @hoplimit={{0x14, 0x29, 0x34, 0x15f9}}], 0x68}, 0x40080) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=ANY=[@ANYBLOB="400000001000010429bd700d0000000080000000", @ANYRES32=0x0, @ANYBLOB="2b030000000000002000128008000100677470001400028008000100", @ANYRES32=r1, @ANYBLOB="08000200", @ANYRES32=r5], 0x40}}, 0x0) 1.220834266s ago: executing program 4 (id=3015): r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000100), 0x40000, 0x0) ioctl$PPPIOCNEWUNIT(r0, 0xc004743e, &(0x7f0000000000)=0x3) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0e00000004000000080000000b"], 0x48) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000020001801000020646c2100000000002020007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00', r2}, 0x10) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKMODES_GET(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000a40)={0x18, r4, 0x301, 0x0, 0x25dfdbfc, {0x24}, [@HEADER={0x4}]}, 0x18}}, 0x20000000) ioctl$PPPIOCGIDLE32(r0, 0x8008743f, &(0x7f0000000140)) 920.926161ms ago: executing program 2 (id=3016): r0 = socket$inet6(0xa, 0x2, 0x0) syz_emit_ethernet(0x146, &(0x7f0000000280)=ANY=[@ANYBLOB="0180c2000003aaaaaaaaaaaa86dd60081f2001103afffe800000000000000000000000000020ff02000000000000000000000000000186009078ff0018000000000000000000000aa78ce54006598080a8030037004023493b87aafaffffffffffffff23732472eefa45ad96489269748e254c1e4a8a8b3f0ab0c430d3be27df3e34066d42ca0a5c15b37adac15084dbaf736b41e5af18020001000000000000000000000000030100000000000018137c5eedeead5d05b87f9a168ce9fa5053c7dba3f0bfbdedf001ccf4f4c7e1c0ffffffdbd75df7cd7eeab451ca0a9ee0f0146904f6d1d7f3ba386b75cb6cb259f3cf09c554b9ca2ceafb4e1735936011a5fb6caedf2de4d3d66ef12adef12a2e51ee8dbcc44a35c94addd32e245f8bb0ef39b811d2b15fbbd165ede9c4b62806d93140e62eec2ca5a8c75f5cc4f8ed50c13bb26c028a5ccc66dee94640b3c51a3f018a058414e2c512503140fd141ed8cf006fc93e49772d80e96a0c516a0ff3409ba15dce8b96833898e91ba55e8be9a1aca4ebb4310bc851c259217b35e83f8745580e2ecabe0eed6b7fc97663"], 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)) r1 = socket(0x2, 0x80805, 0x0) getsockopt$bt_hci(r1, 0x84, 0x11, &(0x7f0000000000)=""/4102, &(0x7f0000001040)=0x1006) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000000)={@remote}, 0x14) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x42901, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r3 = socket(0x2a, 0x2, 0x0) getsockname$packet(r3, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000001480)=0x14) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000400)=@newqdisc={0x24, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {}, {0xffff, 0xffff}, {0x0, 0xfff1}}}, 0x24}}, 0x44884) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000000c0)={0x0}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000008c0)=@newtfilter={0x20c, 0x2c, 0xd27, 0x70bd2d, 0x25dfdffd, {0x0, 0x0, 0x0, r4, {0x6}, {}, {0x8, 0x3}}, [@filter_kind_options=@f_basic={{0xa}, {0x1dc, 0x2, [@TCA_BASIC_CLASSID={0x8, 0x1, {0x2, 0xc}}, @TCA_BASIC_EMATCHES={0xffffffffffffff63, 0x2, 0x0, 0x1, [@TCA_EMATCH_TREE_LIST={0x54, 0x2, 0x0, 0x1, [@TCF_EM_U32={0x1c, 0x3, 0x0, 0x0, {{0x5, 0x3, 0x7}, {0x7, 0x10001, 0x7, 0xfffffff7}}}, @TCF_EM_IPT={0x34, 0x3, 0x0, 0x0, {{0x359f, 0x9, 0x3ff}, [@TCA_EM_IPT_HOOK={0x8, 0x1, 0x3}, @TCA_EM_IPT_MATCH_DATA={0x15, 0x5, "d128be47491207a500026fa0e16dde76bb"}, @TCA_EM_IPT_MATCH_REVISION={0x5, 0x3, 0xb}]}}]}, @TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x2}}, @TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x1}}, @TCA_EMATCH_TREE_LIST={0xa8, 0x2, 0x0, 0x1, [@TCF_EM_CONTAINER={0x94, 0x3, 0x0, 0x0, {{0x2, 0x0, 0x3}, "e445ef8ddba2d24479a52789b4cb566a0ce5a32ddb92e89c66cf45c59a8b2422e80ecab561f72357741710446bf02abca4a6f51e129d3ff769246a03ea53ccae7aa51b758eb1eea382eabc55faa8101a1dfc84cf99e9555ed54f918ebb67d441ee3dfb1741c2e32f5d6d52d5a1ec45b4a4c5f7cebce0465ae68ee70f3dad8331dd8e39e52be1f9"}}, @TCF_EM_IPSET={0x10, 0x3, 0x0, 0x0, {{0x8, 0x8, 0x2c}, {0x2, 0x2, 0x3}}}]}]}, @TCA_BASIC_EMATCHES={0x4}, @TCA_BASIC_EMATCHES={0xbc, 0x2, 0x0, 0x1, [@TCA_EMATCH_TREE_LIST={0xb0, 0x2, 0x0, 0x1, [@TCF_EM_CANID={0x14, 0x3, 0x0, 0x0, {{0x8000, 0x7, 0x8}, {{0x1, 0x0, 0x1}, {0x3, 0x0, 0x1}}}}, @TCF_EM_CONTAINER={0xc, 0x2, 0x0, 0x0, {{0x3, 0x0, 0x7}}}, @TCF_EM_U32={0x1c, 0x2, 0x0, 0x0, {{0x401, 0x3, 0x8001}, {0x4, 0x4, 0x8, 0x81}}}, @TCF_EM_CMP={0x18, 0x1, 0x0, 0x0, {{0x1577, 0x1, 0xfffc}, {0x4e3b238, 0x7, 0xf566, 0x4, 0x5, 0x1, 0x1}}}, @TCF_EM_CANID={0x14, 0x3, 0x0, 0x0, {{0x4, 0x7, 0x1}, {{0x2, 0x1, 0x0, 0x1}, {0x1, 0x0, 0x1}}}}, @TCF_EM_IPSET={0x10, 0x3, 0x0, 0x0, {{0x6, 0x8, 0x7fff}, {0x4, 0x5, 0x1}}}, @TCF_EM_CMP={0x18, 0x2, 0x0, 0x0, {{0x4, 0x1, 0x3}, {0xe1d, 0xd, 0x0, 0x1, 0x9, 0x1}}}, @TCF_EM_NBYTE={0x1c, 0x3, 0x0, 0x0, {{0x6, 0x2, 0xa}, {0x5, 0x9, 0x1, "abc00e12181f79fbda"}}}]}, @TCA_EMATCH_TREE_LIST={0x0, 0x2, 0x0, 0x1, [@TCF_EM_IPSET={0x0, 0x3, 0x0, 0x0, {{0x3, 0x8, 0x2}, {0x0, 0x3, 0x7}}}, @TCF_EM_CONTAINER={0x0, 0x1, 0x0, 0x0, {{0x10, 0x0, 0x80}, "a61a1f3d87aeb64a0dd9190ec60ed012f4ef76113500d8465c4d36e32b5b7dd845364284d78913a1f6665f8d51577b4384934a513df1b7453e3d622861addb3dc983db3bac5bb941646f0602fbc396e9523960d4e8dd85cf99e0a338d0999a8fa0962b93c5"}}]}]}]}}]}, 0x20c}}, 0x2000c800) r5 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r5, &(0x7f00000002c0), 0x40000000000009f, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendto$packet(0xffffffffffffffff, &(0x7f0000001080)="35972bae246c293787ad79c7b7aa754966633513c12f924e4f766fecb0c6266e4297f08cbe487ed3747d70f27b00bf835e67e5612e24031c9bdd5ed4fdf5ad59f6", 0x41, 0x0, &(0x7f00000011c0)={0x11, 0x3, 0x0, 0x1, 0x2}, 0x14) r6 = syz_genetlink_get_family_id$mptcp(&(0x7f0000001240), r1) r7 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r7, &(0x7f0000000240)={0x2, 0x4e20, @multicast1}, 0x10) connect$inet(r7, &(0x7f00000003c0)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x23}}, 0x10) r8 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1, 0x3, &(0x7f0000001a00)=ANY=[@ANYBLOB="18000000030000000000000026d0000095002b000000000093adff012255f674412d02000000880b5f04596a5e99fce658be2f200c699223886d8be4b50000005ab527ee3697f98125f30e6326996a3cfee33025a30b45bdcf2c69d105e5e55a1d273683623f1a5dc6e3c7e20eb7a98ecf3bd2cf898e924abe26ac296f660e69ba982fd76e00dcff7f0000ca6b78ad833488cfe4109eaf009eddcf21f5c63cde2f00150200000001000000520a0000151d010000000100bf00000000cc587424363da52001a3cdf2000000db74596fd72c002a60c1bc7dc8c38b7d2e13c50424b9dd1145d03ff45f70685c6bd9ff41c69b7de406e89dcbb7677e65a88a8407a9e7f9c0e91028b0856eb1ed9474480737a55ebb0bd701f7fb21135c6172eba7eb8a341f07e5a2d1e88b3cfc22df01e4bac9d97328fa2a82b5e8741e02056d93a433f50479387467824262852c7939db5672d07cdbe8e14abf56497e5d56dbe37551b870b2851c3f0a1a9ebfcba105a6ccdd01b0f04edb256c0200000073f6db43661bd7f0e2536ffbfe5ca31b4083145531458b7d1e341c6b351ebc5223f54d6bec93f4ef088e5d1be2515226988d664709ff03f1aa3dc7f1580ace9bf2afd28d0700000000000000d6eb372713255012e028cb2654d493a0b43bf21375709f348f5eda2967199cc936859a538100070000000000dc10e13ef227f627a40000ad1fa253d33fa74f172d3407ae4e1e347c0c6ef9dd2b6bb700000000000000000c586272c3f4d79bc36315745cb149f3cb385e6add14652003c7cdd3324f07d134d3a6c718bbd1aafe1140cff0be4c6f8df084c5e9734ae30aa9af030025f01ab03a9b1074407136bc506031f0916a39d3057d55183612b39e73ae8e6dc30356886a831836469e2051d937eb85f3f2d5ae2c1dca476b97419a3b76ed62409d004d7fbe362145d19605d760df4c5124ca325d374b371867a79b35c6617fc3327191fbf514573f0e30d1d60be2168fffc2f3dccd599a2cb77f124e22f87673675805494db821f39b50d938d5fd8c6b2a3a324c257bc9110971b749ccd74089ed6b86f81ca3ba47d8f71d290ed1b1a11f7a67125170c88c3b6a50692cc0064fc6bbd312536ac15016c85c6332226401b110da9c786eeca22debc99335587b54c13c3107008fa069af8223b38ced735c2d906551004d8dc10d88738488da01ffa4add56474573c964a270000f2f16625c0c10200000000c7a5ca60fdad159f2e44171f39638410020000004825d081f2d987f05c534187738655d7dc958f2046fa0c1619a6554b82d9c162eb61ca74f1ffdaccf0ea5f06e0fca8b27ff3983ab74fd3d560700a1fab44e77e312b3b129e000302d613916c9bcf9f0000fac73a5b6bfb27f88dba816020be760f7b45e001efada8000000000000fdaf4660402f7b3b79a433e08074ea2462974a00040000eb01352638f56dae0249d15ba8767259658878b7492cfbacde9b57cf4de00788adce638190f3570e0b4c80ef682df22201270955afb6008846557ee3bc09fda6dbb6550d597300eb82a184c96ffde5a30e5433e866665b98ca2002c804c22ff2634b7bfbf5c0d586cda5b45fd00dede1e88a4d41dee7cc76d7a23d06acb1d2d4c58faea84158bb440df2a694f4cdcaa4f65c22efffffffffffdd00000000d503d79986958115ae07b70f991430b7fb475d77b869ee02000000000000000000001ffff0ef89b2a68d2b05c995445d8a7700bcdfbec74fb2dd163e863315e84498dfb52bb93f6c9084659ce777ddac563c8596c2b1d8180289a61faa95a82bf1cfb7f2fd7252e9322abe282c33445d443a67467893b9bf0d1c8130ae6b226900000635376413c29f7c6f7b7e29b9a0c64e68328661f0c06e21f7d7dc22174ea4447a6f60edef3a4168d40200fbc71104512efe8e5d7d934aa289b4bd2b870000000000000000000007000000002000000000009b777883a02f0593dfc4cb4114b9f9cf4ad155110cc6ace2b322ac31bfa27847c799c8009a1ea5b98e525e6383ad7fd9795170e7b11e247603c2ff49a11459c7f606d729d3979676bffb3049166bb84a0f061991bd57c2566c10c282352aba05b6164ef876915a3f2491e4793e590dcc71de10da96366c1e992c0068c940dd4422c9882d3aa0f8a797b8fea6efcfb5276b7679f15559edaa977504cc0b2f777acb907ebf5fc14add71d0bca37405ded69b77ab4a3d7487fd04000000de17e1e13b93669b79556abb722d9c085b189b5fd1f30e8dc813f608830b110001732135e8e7262f290000923bfb6b41ff3792cee2fc37eee739c3e36a4bc80112968ec0d8902eced1fe552018014a463abbbf7ccd6a92a5734e3ebfca9b6e88e031f31de2183652e77c164c646a1cfd3710aa4205d8d4d4f974133ccb1e49feb42664eccd809c0ba8917eda87489e8946d5c8156197bcb66fd5606c63e3389ee9e8552381646365066ef9a36a449c96485c22ad1aa423b7b89efbc6cd54000bb0ea5f4f1e8773144fb6ac9a44d43593d77e66aa7ed7f3d4e7b211590c738888d02b2dbb0b2ba73ec72e1d8d7360a128499dd19e1e7b9b0671f4f58515b45ecb9964f3c4ddb8234391d514f8d996d8d6dd7f8fadfee2d7a0035638ce27c2936cb04b30a0eb0cde0000000000000040000000ec3c12ecee8fc3a40000000000000000e215b00ce2570b930723cbadb4033d1b8aaa2cfb3fb89e4a6e89737fd6232218a9e0c099d1eb59d60b3cca089785642f327139bc4394fb6d547a9b3c22599e780c1da7433fb47615d372e3fffe9703e37d5c87d513165278650738efcc04d27b766cf7f60066edd292f6c8a2174f391ed164bb1816819ceb3e378e776d422bc946cd9501accebeac3a5b31d8abc68ae537cd44a04e6bc21c35a7beab2610c51e593676bf635a20f597f4631b91454d182f826071f5210bd6d93173589929b23801e63c2266fde13b5a04b8d48be057c752bc415a756ea9b4d34156c4f73dd5e5924ef101a5fcdaf37c7ba2c4a9de9b000000000000000000000000000000a73b862e4b63c245616b522345587d0ee65a6902bdd0abd941e8aba37510b222ae544f395edd1b92ad53fc68f08ea00edc5e10d768836169dd296d56b306e8b75778c37571792a6c3d8b02ef378ebd59422cdd008bef6f80a80a68641ea5ed4f1126bb676098c10bf663eb3fb8c839364d28fd046dc64b35f9c3397ce6f4ad357b0000000000090000000088c7a8e2638f650a6f04a6f33a090f59414d6ebcbc687e66d600000000bd0a58ea6d36fc2cf9b9a71c137a2a22adb1006f371d4faf47285fd66fe0389afb96854bb360edcdf11b4ff6dd578bba93e949d240cde9b5836cb46032484dc19c93db7b6e5afa10547c78e76a3111557346e52566df196fd630561bb908fff4d2e19562aabd43742a26a43799f8636fa04ceb40c9e4ca1cfbbc7b949cd245a3ee118fd0d4f639444539af8766028d4ac4d4c548e290199e0dacbb4f6796b39bf32934d941ba2f88e3ebd0cf8e24f99eca86e4ca9b2cd2b54044a7fc4631572a6378a32df288785f146275c1f548e2a0c1016744e05f9de5044373d7650125027547eefe7b2d8c8871bb65395fae99d8456883705bfdfb00001854b2e5efa8aaf25827d659f592b1575281ec125de7fb91cd81d91dcb19f5cdf1e1e2b4a8a1389753a09110538689e38e07fb2dc72bd4fd11d7bc16aac5d85c6101bb722895248e463a5fb45ce0e564e90cb19d5993b471687ae4165e29cf2f58082115f5f8569896eedfd798733223e6d6584997510c374912ab798bd4af4654c01bb2c411bc36468ddd62b4eba5cfc8953526e0e5b1359797956152d0098ce47c62c3fe5a23219389622b7f65bf03527d25c3941b9cf1ffeedf6d99082bb57ea871c12213cc40900f83033bc18c529171fae324c315bc6ce358831d0230412212acfd5fc8d5cb0d028cf568e8bb40e27befe2ff01f7c6674a4d86d900633ea36641e0a781ea0ea7f2d928b8b22e2f97dd13348927375baea6863bef4acf4299096ada5cdd2a0eaafaa760a79d102d1e0c0000000000000000007926653b8d79ce16a432f124786a0bc3c5b7d196822492ae1ccf91aeac16406ad6f9cd3d96d57fceba8360ae49f73351814c9c2972f11064aaf3739d9100f9c0e4d0cb17d50c82e305ba7d62cf1cc6da26e34982a8c74dd8122cf5b5e7c34fd2712a0cef05e4d8ec7dd363219676bd9b19943185b132eb35a695e208dfa5cecdb1d6425c8879063c0f11bd64291a4209ee6dc1d9e9010013f6148c603e6a335e298efd6ab5cccc47a2c568c6afec54f8251bd840752addf200371361c9eedf05ed98585cf6d99e9e56055064bda2d373369761238c278147cd0eb7799f6b9c9fcaa3fd282154994f5b25420c86db9b6401e885de1c615a719a1c83e8fbbb181282dbaf3313a4e4a4877e9f37607e2cd6da0cf6371ec06a75f5a4206b2418ad8897ae149085d63f01f22eca44033234b3930b4d5da756669a1d59d69e7de54abf439988ed7ec33c2d0a901bb0985a24878984d8a4340fa9a356d100926fb5f2ef9976366a61b8cc2bcb1c072b0e9c564852388e1edff10d75b3832792e471cc15b40380f94d834243080158603fbc9134d6983c540525447478984611c0d9666941bfc0a30db47a8828b6e5c51aee2094599b4ce52795750e1764f1657ca8c5633c71287239dddf5c651496f7bbd148c937f083d2e4e0197dbc6ff0649c749707b17399b1d7efad23abb8b40b38704737e15662ae4913a4a001cd3b71c7af75b5ffad9780650c800a40ca80ddc41987919142fd28dbf22db5f4c435415a03455e1d55d1783ccef97d7e4655cf839d06f06e137bbe462a03b3100231914b19739dd57b4f12d026ad0c7fd3"], &(0x7f00002bf000)='GPL\x00', 0x4, 0x436, &(0x7f0000000040)=""/183, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0xfffffffffffffc95}, 0x48) r9 = socket$kcm(0x29, 0x2, 0x0) ioctl$sock_kcm_SIOCKCMATTACH(r9, 0x89e0, &(0x7f0000000180)={r7, r8}) ioctl$sock_kcm_SIOCKCMCLONE(r9, 0x89e2, &(0x7f0000001380)={0xffffffffffffffff}) sendmsg$nl_route_sched(r10, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000980)=@newtclass={0x24, 0x28, 0x4, 0x70bd28, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, {0xb, 0xa}, {0x5, 0xa}, {0xe, 0xffe0}}}, 0xfdef}, 0x1, 0x0, 0x0, 0x40d1}, 0x40d8) sendmsg$MPTCP_PM_CMD_GET_ADDR(r1, &(0x7f0000001300)={&(0x7f0000001200)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f00000012c0)={&(0x7f0000001280)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="000126bd7000fddbdf2503000100008000000000000000"], 0x2c}, 0x1, 0x0, 0x0, 0x200000c1}, 0x10) r11 = syz_init_net_socket$ax25(0x3, 0x5, 0x31) ioctl$SIOCAX25NOUID(r11, 0x89e3, 0x0) socket$kcm(0x2, 0xa, 0x2) 597.541418ms ago: executing program 4 (id=3017): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0xa, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={r0, 0x2000000, 0xe, 0x0, &(0x7f0000000200)="63eced8e46dc3f0adf33c9f786dd", 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000500)={&(0x7f0000000540)=ANY=[@ANYBLOB="9feb0100180000000000000038000000380000000400000002000000000000110400000000000000000000000000000200000000020000000000000602000000020000000000000e0300000000000000000061"], 0x0, 0x54}, 0x28) bpf$BPF_PROG_DETACH(0x1c, &(0x7f0000000580)=ANY=[@ANYRESHEX=r0, @ANYRES32, @ANYRES32, @ANYBLOB='/\x00'/12, @ANYBLOB="df9adbff08523681ee9bde50e468f03218676d660b77230cd6974ec663afc49929b0ecaf9f409ed80b7872f835d0e0d1c0580ac8b50b7ad697749c2d1fc42f795359d151cec5b58edf718386f8a84ba24418ffffff7f538753aaa0daec97038dd7c234d5b5238ea122d8bdebe88f1fbb73e5257febd80e40e5a9ae412148a91bb55608ec3f9d975dff33965913275874c5bbda6ac1c4db62a46de6051a2aa7cf3f1c4435bf16547136c4b3bc589c8676f9690d202bb13bd2e7c35a84e6ffb43b00b2f6a45c68fcd9e6b6b3d981d3b171949270a41f63aa4a", @ANYBLOB="7fb733358c739a898d1fd6e2f7ba27dca68b910dba27da03e24e7ee72c7012709d403835397a2038e23ac52358dffed2e6bf3d35bcac3c3d0be345d7a89bb3c35d1fa08ea4c8c9d6962c2bb275416c7345822c0aab257b33efd65ffac19c74cdeda5048acc52247e26b5b3c85e33b446b390892846ccbaf5820992f100c7303bd150b1e9d7000fd88c8272cc20fe84413dc6ee1eb73e27f075988397cccdb32bf5b55a797679790494b92a9370ef49cde4febd7f67c705681bf17d592059865e03e01ab1334dbd980a9b49c967c0b13723e1f73f22b2a97ae1d14e67beb1099a1886eb4554751c6a467f27000f94e65f42cf64204d31"], 0x20) r1 = socket$tipc(0x1e, 0x2, 0x0) ppoll(&(0x7f0000000500)=[{r1, 0x208}], 0x1, &(0x7f0000000580), 0x0, 0x0) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_START_AP(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000540)=ANY=[@ANYBLOB="80000000", @ANYRES16=r2, @ANYBLOB="050000000000000000000f00000008000300", @ANYRES32=0x0, @ANYBLOB="0c009900040000005300000057000e0048"], 0x80}}, 0x0) 438.803643ms ago: executing program 4 (id=3018): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = epoll_create1(0x0) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r2, 0x84, 0x76, &(0x7f0000000040)={0x0, 0x9}, 0x7) sendmmsg$inet6(r2, &(0x7f0000000440)=[{{&(0x7f0000000080)={0xa, 0x4e23, 0x0, @loopback, 0x280020}, 0x1c, &(0x7f00000004c0)=[{&(0x7f0000000100)}], 0x1}}], 0x1, 0x20008050) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x11, 0xf, &(0x7f0000000580)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000800000000bf91000000000000b702000043e7b5538500000085000000b70000000000000095"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x24, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000140)='kmem_cache_free\x00', r6}, 0x10) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x11, 0x6, &(0x7f0000000cc0)=ANY=[@ANYBLOB="050000000000000061110c00000000008510000002000000850000000500000095000000000000009500a5050000000077d8f3b423cdac8d80000000000000002be16ad10a48b243ccc42606d25dfd73a015e0ca7fc2506a0f7535f7866907dc0200000000000000ae669e17fd6587d452d6453559c3421eed73d56615fe6c54c3b3ffe1b4ce25d7c983c044c03bf3a48dfe47ec9dd6c091c30b93bfae76d9ebacd3ed3e26e7a23129d6606fd28a69989d552af6bda9df2c3af36effff9af2551ce896165127cb3f011a7d06602e2fc40848228567ffb400000000003ed38ae89d24e1cebfba2f87925bfacba83109751fe6c05405d027edd68149ee99eef6a6992308a4fc0b7c70bc677d6dd4aed4af7500d7900a820b6347184e9a217b5614cd50cbe43a1ed2526814bc0000e9e086ce48e90defb6670c3df2624f56da648d28ad0a97aec7291c25447c106a99893e10db21901eb397b2f5fd71400fa7a050fbbef9e326ea27e513e96068fd1e8a43e89f9c85c822a961546ed5363c17ff1432d08806bc376e3e49ee52b59d13182e1f24ed200ada10eb1affb87ba55b2d72078e9f40b4ae7d01000000d11cd22c35d32940000088dde499000000fdffffff00000000000f000000ef0000000000000000000000000c52f4ebd2c893bb97a068bd10734a83584898eccb26f7b789cfc4cd995fa3e11a5c74c85404e2df3ad37b729ac83b0dcb4f48f3c3356b9997fc455a17690b6f7f9ccbe4b1701941b18aba6b16455a66c3b84b138efc20a546d3d5227e23b03f2a834391ade2ff3e93ee296c4082ee73e7c353312c9d75711ce1623e9c54bdff59d2a69dcb7d84c235b23a4480c2461b405cfd1a38992f295ad3adc94cd07c850d1ce6d0b2fea02c24e9280333152fb794e4ddea02017a6c139b50101caecaf2abc0847a1ff2f7fc3c2b99a96fc4275ad107274e2934a87a4ddcdb112754ca5bdec0ead14b6c0f19a43a2f05c7f0be31491eb8c9ff68236c8600040000000000000000000066e034c81c3cab64e4fc8dc55ce0ada18dcbf31c6e82893add3bee3e10fc873d1d922b0877cbcd95b839d3059d5140a1f742f6e75741e39e5cb6a193e06a1043375b0f61b5d4e17c81baa31b924d84f224baf1221c15fa12313ffbfa7c2730309f66705b71e6205e7cbf3643561eabb9a63fcd604d5cc27e1317ad94cf438d71873e540be16b6ca205081173bd03c4754fc4674812daab482fd390a1c903b5d28a1eb247b5837d7603b92495d5c569f6433c3fca5206cb0000003fdbbd3892c52c2e7612e05de32322e980a3d69931e2c9312dd517c96f2ee90362476ed853c4c9b7d4ebf13cbaa795860e92a3d7d004f2c491db38eb769f094d5d48b262cc35c40682138cf13a49aa9f27abec00002f01ba1251aaf2385416ca719300"], &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x6}, 0x70) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000080)='sched_switch\x00', r7}, 0x10) ppoll(&(0x7f0000000500)=[{r5}], 0x1, 0x0, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[], 0x48}, 0x1, 0x0, 0x0, 0x20040884}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f0000000280)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r8, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000800)=ANY=[@ANYBLOB="340000001100010027bd7000fde9d6c781e606598e835c5afaca298ddbdf2500000031", @ANYRES32=0x0, @ANYBLOB="20100000000004001400030076657468315f766c616e000000000000"], 0x34}, 0x1, 0x0, 0x0, 0x801}, 0x4000000) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff) r9 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r9, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000002c0)=@updpolicy={0x17c, 0x19, 0x1, 0x0, 0x3, {{@in=@private=0xa410100, @in6=@local, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x80}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001}, {}, 0x0, 0x200}, [@tmpl={0xc4, 0x5, [{{@in=@multicast1, 0x4d5, 0x3c}, 0x2, @in=@multicast1, 0x3507, 0x4, 0x3, 0x7, 0x8, 0x4, 0x2}, {{@in6=@dev={0xfe, 0x80, '\x00', 0xc}, 0x4d3, 0x6c}, 0x2, @in=@remote, 0x3501, 0x2, 0x0, 0x73, 0x8000, 0x4, 0x7}, {{@in=@multicast2, 0x80000001, 0x3c}, 0xa, @in=@remote, 0x0, 0x1, 0x1, 0x9, 0x8, 0xe7, 0x7}]}]}, 0x17c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) preadv(0xffffffffffffffff, &(0x7f0000000100), 0xa, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r4, &(0x7f0000000100)={0x20000014}) r10 = socket$netlink(0x10, 0x3, 0x6) writev(r10, 0x0, 0x0) r11 = bpf$MAP_CREATE(0x0, &(0x7f0000010880)=@base={0x5, 0x4, 0x8, 0xc}, 0x50) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f00000008c0)={'veth1_to_bridge\x00'}) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000010c0)={r6, 0xe0, &(0x7f0000000bc0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, &(0x7f0000000900)=[0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x1, 0x4, &(0x7f0000000940)=[0x0], &(0x7f0000000980)=[0x0, 0x0, 0x0, 0x0], 0x0, 0xf9, &(0x7f0000000a00)=[{}], 0x8, 0x10, &(0x7f0000000a40), &(0x7f0000000a80), 0x8, 0x7d, 0x8, 0x8, &(0x7f0000000ac0)}}, 0x10) sendmsg$ETHTOOL_MSG_CHANNELS_GET(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000001200)={&(0x7f0000001540)=ANY=[@ANYBLOB="4afe3ca43cd6f026e6c21245df2b5092ba6f953fdd4ac5df5e321d7a31848f3e031f3c7ee8e923b3bf6ce1dede7346bc9d0edbe6c476d0618bafe900006abe9f33fb4255036b71dff5f53ec36e76410c188441ee0679d693e4116d8f2e10f9633b3a5bba0a0db2a740e68e122a7c5228b092a6373b0e1c276ce889cabc35a758c477cf6bccd97bbf8b4bdab33e3be5c872d174e72ed5fa9cafe37bdd523a3abe41de631a86afddc663a0be68c86884c1ab47db3205355ec2612d6c3b93529385a3bf9e646b3ae00da990c8890dae50f024b89dbd50a8728daa10be45faad94eb59d945eab5abc5a8646da2087dc5ce7cf70ab7fafc80987efc086d83ad19a5b035fa3b73aa843af0a27a80d468619c66ba1c66c3331b4c7ae01e05d2779c6921036afcf1ab477fa707e37949320d19f1f3f2ac85e1e3d86b291c2b89f1c81da5639d485d5b9cdb8e24e906c437c966afcadc3812ba21ee1b64cf93462bea23b886f68ecff2fdb320bb", @ANYRESHEX=r10, @ANYBLOB="00002cbd7000fddb8008000100"/22, @ANYRES32=r11, @ANYBLOB="08000300010000000800030000000000000002006e696376663000000000000010000000e8ff0100bd0c98902b775af66adb24307369344d4e4e694f1af86465c5c964cf16cddd652d6fc26a7dcb25de5888a471953c8742a9505f008df2225d94494cc23ae5643e52b14a0aba8c78be510128f929f085a72057000000000000", @ANYRES32=0x0, @ANYRESDEC=r7, @ANYRES32=r3, @ANYBLOB="1400020069705f767469173004000049c1adcb00eb3100030002000000540001806543090e66762538372edad686080009", @ANYRESOCT=r12, @ANYBLOB="140002006261746164763000000000000000000008000100", @ANYBLOB="12b2c1594111ae994459f05abbebcb664637545c3069bc502f98ee0cb717b89fb90faca0fb6a05759053897b4748df63aa934ae7227be4089323cc82265c5e6bbd86226fc3ab534fc9d0dc9e55c08923ddb71c84ebc8360886da0fd64a1a153e44dea837746453843be78fd8f6fb5c47595a8b53e6a4efdb267c5652cb3178486db227e5ede0e31d766fd23e5e93f6718f504e6f9f2b2cbd79f4df13845a00f92966d14f291705c7b7f1458a4f890f52c06f7abf6514315a060043aa7ef7f275086e2be2150f", @ANYBLOB="1400020076657468315f746f5f7465616d00800800030003000000140001800800030003000000080003000200"/60], 0xf0}, 0x1, 0x0, 0x0, 0x4400c000}, 0x4000894) bpf$PROG_LOAD(0x5, &(0x7f0000010400)={0x11, 0x13, &(0x7f0000000640)=ANY=[@ANYBLOB="1800000006000000000000000700000018110000", @ANYRES32=r5, @ANYBLOB="3f00000000000000b702000014000000b7030000000000008500000083000000bf0900000000000080000000000000029500000000000000185b000000000000000000000000000018360000010000000000000000000000bf91000000000000b7020000010000008500000084000000b7000000000000009500000000000000"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x3d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, 0x94) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000001100)=ANY=[@ANYBLOB="5000000010000100"/20, @ANYRES32=0x0, @ANYBLOB="5d5b0000000000001ccb525a793858340980e6c6001a8018000a8014000700200100000000000000000000000000001400350077673100"/67], 0x50}}, 0x0) 368.273343ms ago: executing program 6 (id=3019): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="0a00000004000000dd0000000a"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000001"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls}, 0x94) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000003c0)={0x6, 0x5, &(0x7f0000000100)=ANY=[@ANYBLOB="180000000000000000000000000000001850000000000020000000000000000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0xfffffff0, 0x0, 0x0, 0x0, &(0x7f0000000080)}, 0x9a) unshare(0x20000400) unshare(0x8000000) unshare(0x68040200) 180.364893ms ago: executing program 2 (id=3020): r0 = socket$vsock_stream(0x28, 0x1, 0x0) bind$vsock_stream(r0, &(0x7f0000000440), 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) listen(r0, 0x5) getgid() r1 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r1, &(0x7f0000000100)={0x28, 0x0, 0x0, @local}, 0x10) r2 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) close(0x3) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x11, 0xf, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000800000000bf91000000000000b702000043e7b5538500000085000000b70000000000000095"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000140)='kmem_cache_free\x00', r3}, 0x10) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x11, 0x6, &(0x7f0000000cc0)=ANY=[@ANYBLOB="050000000000000061110c00000000008510000002000000850000000500000095000000000000009500a5050000000077d8f3b423cdac8d80000000000000002be16ad10a48b243ccc42606d25dfd73a015e0ca7fc2506a0f7535f7866907dc0200000000000000ae669e17fd6587d452d6453559c3421eed73d56615fe6c54c3b3ffe1b4ce25d7c983c044c03bf3a48dfe47ec9dd6c091c30b93bfae76d9ebacd3ed3e26e7a23129d6606fd28a69989d552af6bda9df2c3af36effff9af2551ce896165127cb3f011a7d06602e2fc40848228567ffb400000000003ed38ae89d24e1cebfba2f87925bfacba83109751fe6c05405d027edd68149ee99eef6a6992308a4fc0b7c70bc677d6dd4aed4af7500d7900a820b6347184e9a217b5614cd50cbe43a1ed2526814bc0000e9e086ce48e90defb6670c3df2624f56da648d28ad0a97aec7291c25447c106a99893e10db21901eb397b2f5fd71400fa7a050fbbef9e326ea27e513e96068fd1e8a43e89f9c85c822a961546ed5363c17ff1432d08806bc376e3e49ee52b59d13182e1f24ed200ada10eb1affb87ba55b2d72078e9f40b4ae7d01000000d11cd22c35d32940000088dde499000000fdffffff00000000000f000000ef0000000000000000000000000c52f4ebd2c893bb97a068bd10734a83584898eccb26f7b789cfc4cd995fa3e11a5c74c85404e2df3ad37b729ac83b0dcb4f48f3c3356b9997fc455a17690b6f7f9ccbe4b1701941b18aba6b16455a66c3b84b138efc20a546d3d5227e23b03f2a834391ade2ff3e93ee296c4082ee73e7c353312c9d75711ce1623e9c54bdff59d2a69dcb7d84c235b23a4480c2461b405cfd1a38992f295ad3adc94cd07c850d1ce6d0b2fea02c24e9280333152fb794e4ddea02017a6c139b50101caecaf2abc0847a1ff2f7fc3c2b99a96fc4275ad107274e2934a87a4ddcdb112754ca5bdec0ead14b6c0f19a43a2f05c7f0be31491eb8c9ff68236c8600040000000000000000000066e034c81c3cab64e4fc8dc55ce0ada18dcbf31c6e82893add3bee3e10fc873d1d922b0877cbcd95b839d3059d5140a1f742f6e75741e39e5cb6a193e06a1043375b0f61b5d4e17c81baa31b924d84f224baf1221c15fa12313ffbfa7c2730309f66705b71e6205e7cbf3643561eabb9a63fcd604d5cc27e1317ad94cf438d71873e540be16b6ca205081173bd03c4754fc4674812daab482fd390a1c903b5d28a1eb247b5837d7603b92495d5c569f6433c3fca5206cb0000003fdbbd3892c52c2e7612e05de32322e980a3d69931e2c9312dd517c96f2ee90362476ed853c4c9b7d4ebf13cbaa795860e92a3d7d004f2c491db38eb769f094d5d48b262cc35c40682138cf13a49aa9f27abec00002f01ba1251aaf2385416ca719300"], &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x6}, 0x70) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000080)='sched_switch\x00', r4}, 0x10) ppoll(&(0x7f0000000500), 0x0, 0x0, 0x0, 0x0) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x2, 0x3, 0xfffffffffffffffd}, 0x0, &(0x7f0000000240)={0x3ff, 0x0, 0x0, 0x9, 0x0, 0x0, 0x7fffffff}, 0x0, 0x0) 0s ago: executing program 6 (id=3021): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-serpent-avx\x00'}, 0x58) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmsg$AUDIT_GET_FEATURE(r1, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x3fb, 0x8, 0x70bd29, 0x25dfdbfc, "", ["", "", "", "", ""]}, 0x10}, 0x1, 0x0, 0x0, 0x4000}, 0x4000040) syz_init_net_socket$nfc_llcp(0x27, 0x1, 0x1) openat$6lowpan_control(0xffffffffffffff9c, &(0x7f00000004c0), 0x2, 0x0) r2 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x11, 0xf, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000800000000bf91000000000000b702000043e7b5538500000085000000b70000000000000095"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) epoll_create1(0x80000) sendmsg$IPCTNL_MSG_CT_DELETE(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000340)=ANY=[@ANYBLOB="500000000201010200000000000000000a0000073c0002800c0002800500010021000000070001"], 0x50}, 0x1, 0x0, 0x0, 0x80c0}, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000140)='kmem_cache_free\x00', r3}, 0x10) ppoll(&(0x7f0000000500)=[{r2}], 0x1, 0x0, 0x0, 0x0) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x0, 0x3, 0xfffffffffffffffd}, 0x0, &(0x7f00000002c0)={0xfff, 0x101, 0x10000000000000, 0x9, 0x0, 0x0, 0x7fffffff}, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) close(0x4) socket$nl_generic(0x10, 0x3, 0x10) bind$inet6(0xffffffffffffffff, 0x0, 0x0) kernel console output (not intermixed with test programs): d=13995 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.2127" name="cgroup.controllers" dev="tmpfs" ino=2197 res=0 errno=0 [ 357.897559][T14040] netlink: 'syz.1.2143': attribute type 2 has an invalid length. [ 357.906407][T14039] netlink: 'syz.1.2143': attribute type 2 has an invalid length. [ 358.126791][T14048] __nla_validate_parse: 3 callbacks suppressed [ 358.126813][T14048] netlink: 48 bytes leftover after parsing attributes in process `syz.2.2146'. [ 358.307004][T14063] netlink: 'syz.5.2151': attribute type 1 has an invalid length. [ 358.317538][T14063] netlink: 'syz.5.2151': attribute type 2 has an invalid length. [ 358.389608][T14068] netlink: 2 bytes leftover after parsing attributes in process `syz.5.2151'. [ 358.459069][T14070] x_tables: ip_tables: rpfilter match: used from hooks FORWARD, but only valid from PREROUTING [ 358.706803][T14086] netlink: 96 bytes leftover after parsing attributes in process `syz.3.2159'. [ 359.379520][T14109] sctp: [Deprecated]: syz.1.2165 (pid 14109) Use of struct sctp_assoc_value in delayed_ack socket option. [ 359.379520][T14109] Use struct sctp_sack_info instead [ 359.611969][T14115] netlink: 'syz.5.2167': attribute type 1 has an invalid length. [ 359.619888][T14115] netlink: 224 bytes leftover after parsing attributes in process `syz.5.2167'. [ 359.859695][T14124] ªªªªª speed is unknown, defaulting to 1000 [ 359.941512][T14127] netlink: 36 bytes leftover after parsing attributes in process `syz.4.2170'. [ 359.946002][T14130] netlink: 36 bytes leftover after parsing attributes in process `syz.3.2171'. [ 359.995518][T14134] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2168'. [ 360.360209][ C1] ip6_tunnel: ip6gre3 xmit: Local address not yet configured! [ 360.458063][T14148] netlink: 48 bytes leftover after parsing attributes in process `syz.1.2174'. [ 360.480473][T14151] IPVS: set_ctl: invalid protocol: 51 172.20.20.187:0 [ 360.924863][T14167] veth0_to_bond: entered allmulticast mode [ 361.102332][T14173] netlink: 44 bytes leftover after parsing attributes in process `syz.3.2182'. [ 361.113763][T14173] netlink: 44 bytes leftover after parsing attributes in process `syz.3.2182'. [ 361.695215][T14186] ªªªªª speed is unknown, defaulting to 1000 [ 362.349542][T14233] sctp: [Deprecated]: syz.1.2199 (pid 14233) Use of int in max_burst socket option. [ 362.349542][T14233] Use struct sctp_assoc_value instead [ 362.680244][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 363.699275][T14255] netlink: 'syz.3.2206': attribute type 2 has an invalid length. [ 363.816774][T14261] __nla_validate_parse: 5 callbacks suppressed [ 363.816795][T14261] netlink: 28 bytes leftover after parsing attributes in process `syz.3.2206'. [ 365.441752][T14271] dvmrp12: entered allmulticast mode [ 365.524914][T14271] dvmrp12: left allmulticast mode [ 365.714964][T14290] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2213'. [ 365.788224][T14297] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2216'. [ 365.803690][T14297] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2216'. [ 365.825980][T14293] netlink: 36 bytes leftover after parsing attributes in process `syz.1.2215'. [ 366.008057][T14297] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2216'. [ 366.078950][T14308] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2220'. [ 366.131741][T14308] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2220'. [ 366.173666][ T50] netdevsim netdevsim5 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 366.184186][ T50] netdevsim netdevsim5 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 366.201568][T14308] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2220'. [ 366.214788][ T50] netdevsim netdevsim5 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 366.230974][T14317] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2222'. [ 366.232452][ T50] netdevsim netdevsim5 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 366.327845][T14321] netlink: 'syz.3.2223': attribute type 3 has an invalid length. [ 366.694081][T14343] ªªªªª speed is unknown, defaulting to 1000 [ 366.928037][ T13] netdevsim netdevsim2 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 367.038320][ T13] netdevsim netdevsim2 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 367.049540][ T13] netdevsim netdevsim2 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 367.058430][ T13] netdevsim netdevsim2 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 367.473689][T14379] syzkaller1: entered promiscuous mode [ 367.488855][T14379] syzkaller1: entered allmulticast mode [ 367.677924][T14391] tipc: Enabled bearer , priority 0 [ 367.685137][T14392] syzkaller0: entered promiscuous mode [ 367.690987][T14392] syzkaller0: entered allmulticast mode [ 367.716002][T14391] tipc: Resetting bearer [ 367.731630][T14390] tipc: Resetting bearer [ 367.756389][T14390] tipc: Disabling bearer [ 367.928293][T14406] netlink: 'syz.1.2249': attribute type 8 has an invalid length. [ 368.226941][T14419] ªªªªª speed is unknown, defaulting to 1000 [ 368.440472][ C1] ip6_tunnel: ip6gre3 xmit: Local address not yet configured! [ 368.605199][T14443] : entered promiscuous mode [ 368.667501][T14447] A link change request failed with some changes committed already. Interface veth1_to_bond may have been left with an inconsistent configuration, please check. [ 369.113432][T14476] __nla_validate_parse: 19 callbacks suppressed [ 369.113457][T14476] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2271'. [ 369.169501][T14476] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2271'. [ 369.179819][T14476] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2271'. [ 369.196468][T14479] netlink: 36 bytes leftover after parsing attributes in process `syz.2.2270'. [ 369.272718][T14484] netlink: 100 bytes leftover after parsing attributes in process `syz.5.2273'. [ 369.285462][T14484] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2273'. [ 369.644385][T14498] netlink: 24 bytes leftover after parsing attributes in process `syz.4.2277'. [ 369.732471][T14507] netlink: 48 bytes leftover after parsing attributes in process `syz.1.2278'. [ 369.785961][T14509] netlink: 'syz.4.2280': attribute type 1 has an invalid length. [ 369.796204][T14511] netlink: 'syz.4.2280': attribute type 1 has an invalid length. [ 369.831067][T14509] bond6: entered promiscuous mode [ 369.837016][T14509] 8021q: adding VLAN 0 to HW filter on device bond6 [ 369.871966][T14511] bond7: entered promiscuous mode [ 369.877553][T14511] 8021q: adding VLAN 0 to HW filter on device bond7 [ 369.890163][ T5832] Bluetooth: hci5: command 0x0405 tx timeout [ 369.970084][T14513] ªªªªª speed is unknown, defaulting to 1000 [ 370.064858][T14527] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2284'. [ 370.075151][T14517] syzkaller0: entered promiscuous mode [ 370.081036][T14517] syzkaller0: entered allmulticast mode [ 370.082117][T14527] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2284'. [ 371.880703][T14545] netlink: 'syz.2.2288': attribute type 13 has an invalid length. [ 371.907380][T14545] netlink: 'syz.2.2288': attribute type 17 has an invalid length. [ 372.376145][T14545] 8021q: adding VLAN 0 to HW filter on device bond0 [ 372.386032][T14545] 8021q: adding VLAN 0 to HW filter on device team0 [ 372.397466][T14545] A link change request failed with some changes committed already. Interface 60ªX¹¦À may have been left with an inconsistent configuration, please check. [ 372.414949][T14553] tipc: Enabling of bearer rejected, failed to enable media [ 372.430974][T14571] IPVS: set_ctl: invalid protocol: 44 224.0.0.1:20002 [ 372.537900][T14551] ªªªªª speed is unknown, defaulting to 1000 [ 372.922615][ T3489] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 372.937713][ T3489] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 373.114057][T14589] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 374.265955][T14640] netlink: 'syz.3.2311': attribute type 2 has an invalid length. [ 374.323834][T14640] __nla_validate_parse: 4 callbacks suppressed [ 374.323854][T14640] netlink: 28 bytes leftover after parsing attributes in process `syz.3.2311'. [ 374.647157][T14649] netlink: 'syz.2.2312': attribute type 1 has an invalid length. [ 374.655018][T14649] netlink: 168 bytes leftover after parsing attributes in process `syz.2.2312'. [ 375.200143][T14657] netlink: 48 bytes leftover after parsing attributes in process `syz.4.2315'. [ 375.298598][T14659] netlink: 'syz.2.2317': attribute type 3 has an invalid length. [ 375.527550][T14673] netlink: 64 bytes leftover after parsing attributes in process `syz.1.2322'. [ 375.541205][T14673] netlink: 'syz.1.2322': attribute type 4 has an invalid length. [ 375.606602][T14675] netlink: 'syz.1.2323': attribute type 21 has an invalid length. [ 375.614925][T14675] netlink: 128 bytes leftover after parsing attributes in process `syz.1.2323'. [ 375.624420][T14675] netlink: 3 bytes leftover after parsing attributes in process `syz.1.2323'. [ 375.684397][T14677] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2324'. [ 375.699113][T14677] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2324'. [ 375.711001][T14677] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2324'. [ 375.797265][T14684] netlink: 'syz.3.2327': attribute type 2 has an invalid length. [ 375.834155][T14683] netlink: 'syz.1.2326': attribute type 21 has an invalid length. [ 375.888035][T14686] netdevsim netdevsim3: loading /lib/firmware/. failed with error -22 [ 375.898464][T14686] netdevsim netdevsim3: Direct firmware load for . failed with error -22 [ 375.907275][T14686] netdevsim netdevsim3: Falling back to sysfs fallback for: . [ 375.958547][T14691] vlan3: entered promiscuous mode [ 375.964159][T14691] geneve1: entered promiscuous mode [ 375.972149][T14691] vlan3: entered allmulticast mode [ 375.977738][T14691] geneve1: entered allmulticast mode [ 376.119004][T14699] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2333'. [ 376.122059][T14694] ªªªªª speed is unknown, defaulting to 1000 [ 376.136185][T14699] netlink: 'syz.4.2333': attribute type 12 has an invalid length. [ 376.229071][T14703] sit3: entered promiscuous mode [ 376.572649][T14721] openvswitch: netlink: Unknown nsh attribute 0 [ 376.579143][T14721] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 376.737582][T14729] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 376.748423][T14729] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 376.758269][T14729] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 376.768026][T14729] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 376.796772][T14729] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 376.821021][T14729] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 376.844857][T14727] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 376.961271][T14738] ªªªªª speed is unknown, defaulting to 1000 [ 376.971595][T14743] tc_dump_action: action bad kind [ 377.021140][T14741] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 377.572569][T14755] ªªªªª speed is unknown, defaulting to 1000 [ 377.664431][T14760] ªªªªª speed is unknown, defaulting to 1000 [ 378.434973][T14773] ªªªªª speed is unknown, defaulting to 1000 [ 378.688446][ T1299] ieee802154 phy0 wpan0: encryption failed: -22 [ 378.694912][ T1299] ieee802154 phy1 wpan1: encryption failed: -22 [ 379.707614][T14821] __nla_validate_parse: 15 callbacks suppressed [ 379.707638][T14821] netlink: 36 bytes leftover after parsing attributes in process `syz.3.2370'. [ 380.159553][T14833] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2373'. [ 380.189170][T14833] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2373'. [ 380.211875][T14833] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2373'. [ 380.212471][T14832] netlink: 60 bytes leftover after parsing attributes in process `syz.1.2374'. [ 380.549567][T14851] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 380.579948][T14851] netlink: 48 bytes leftover after parsing attributes in process `syz.2.2380'. [ 380.948578][T14868] netlink: 36 bytes leftover after parsing attributes in process `syz.1.2385'. [ 381.294592][T14876] netlink: 'syz.4.2387': attribute type 83 has an invalid length. [ 381.307118][T14875] netlink: 'syz.4.2387': attribute type 83 has an invalid length. [ 381.318801][T14878] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2388'. [ 381.346894][T14878] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2388'. [ 381.357877][T14878] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2388'. [ 381.545681][T14886] netlink: 'syz.3.2391': attribute type 1 has an invalid length. [ 381.645580][T14886] bond5: entered promiscuous mode [ 381.659608][T14886] 8021q: adding VLAN 0 to HW filter on device bond5 [ 381.691460][T14895] bond5: entered allmulticast mode [ 381.734397][T14886] bond5: (slave bridge4): making interface the new active one [ 381.744615][T14886] bridge4: entered promiscuous mode [ 381.756680][T14886] bridge4: entered allmulticast mode [ 381.764722][T14886] bond5: (slave bridge4): Enslaving as an active interface with an up link [ 381.853628][T14907] ªªªªª speed is unknown, defaulting to 1000 [ 381.920635][T14910] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci5/hci5:200/input6 [ 381.972407][T14914] netlink: 'syz.3.2400': attribute type 21 has an invalid length. [ 382.198117][T14925] netlink: 'syz.3.2404': attribute type 6 has an invalid length. [ 382.209259][T14925] netlink: 'syz.3.2404': attribute type 6 has an invalid length. [ 382.432579][T14938] macsec2: entered promiscuous mode [ 382.438037][T14938] macsec2: entered allmulticast mode [ 382.963783][T14973] Freezing with imperfect legacy cgroup freezer. See cgroup.freeze of cgroup v2 [ 383.121669][T14959] veth1_to_hsr: left allmulticast mode [ 383.130148][T14959] veth1_to_hsr: left promiscuous mode [ 383.194408][T14957] ªªªªª speed is unknown, defaulting to 1000 [ 383.801347][ C1] ip6_tunnel: ip6gre3 xmit: Local address not yet configured! [ 383.868957][T15013] IPVS: set_ctl: invalid protocol: 0 172.20.20.26:20000 [ 383.910241][T15013] bond6: entered promiscuous mode [ 383.916235][T15013] 8021q: adding VLAN 0 to HW filter on device bond6 [ 384.067382][T15013] bond6 (unregistering): Released all slaves [ 384.276875][T15022] ªªªªª speed is unknown, defaulting to 1000 [ 384.356071][T15025] can: request_module (can-proto-0) failed. [ 384.479759][T15032] bridge_slave_1: left allmulticast mode [ 384.485718][T15032] bridge_slave_1: left promiscuous mode [ 384.493772][T15032] bridge0: port 2(bridge_slave_1) entered disabled state [ 384.505477][T15032] bridge_slave_0: left allmulticast mode [ 384.511401][T15032] bridge_slave_0: left promiscuous mode [ 384.517603][T15032] bridge0: port 1(bridge_slave_0) entered disabled state [ 384.801094][T15039] __nla_validate_parse: 88 callbacks suppressed [ 384.801116][T15039] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2434'. [ 384.962105][T15050] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2437'. [ 384.991205][ T9] ip6_tunnel: ip6gre3 xmit: Local address not yet configured! [ 385.090477][ T9] ip6_tunnel: ip6gre3 xmit: Local address not yet configured! [ 385.431501][ T5832] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 385.436710][T15072] net_ratelimit: 7 callbacks suppressed [ 385.436729][T15072] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 385.451566][T15068] ªªªªª speed is unknown, defaulting to 1000 [ 385.462186][ T5832] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 385.462217][T15072] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 385.478220][ T5832] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 385.478644][T15072] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 385.495928][ T5832] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 385.496369][T15072] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 385.512816][ T5832] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 385.514153][T15072] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 385.529312][T15072] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 385.573639][T15072] netlink: 48 bytes leftover after parsing attributes in process `syz.2.2443'. [ 385.602612][ T1151] ip6_tunnel: ip6gre3 xmit: Local address not yet configured! [ 385.612122][T15071] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 385.621858][ T1151] ip6_tunnel: ip6gre3 xmit: Local address not yet configured! [ 385.629558][T15069] ªªªªª speed is unknown, defaulting to 1000 [ 385.700394][ T980] ip6_tunnel: ip6gre3 xmit: Local address not yet configured! [ 386.021825][T15092] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2447'. [ 386.055512][T15069] chnl_net:caif_netlink_parms(): no params data found [ 386.306714][T15108] openvswitch: netlink: Message has 4 unknown bytes. [ 386.326597][T15108] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 386.347622][T15069] bridge0: port 1(bridge_slave_0) entered blocking state [ 386.355224][T15069] bridge0: port 1(bridge_slave_0) entered disabled state [ 386.364214][T15069] bridge_slave_0: entered allmulticast mode [ 386.371490][T15069] bridge_slave_0: entered promiscuous mode [ 386.380045][T15069] bridge0: port 2(bridge_slave_1) entered blocking state [ 386.387243][T15069] bridge0: port 2(bridge_slave_1) entered disabled state [ 386.394800][T15069] bridge_slave_1: entered allmulticast mode [ 386.403399][T15069] bridge_slave_1: entered promiscuous mode [ 386.438948][T15107] netlink: 60 bytes leftover after parsing attributes in process `syz.3.2452'. [ 386.458232][T15116] netlink: 48 bytes leftover after parsing attributes in process `syz.1.2454'. [ 386.515129][T15115] netlink: 60 bytes leftover after parsing attributes in process `syz.3.2452'. [ 386.587576][T15069] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 386.605118][T15069] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 386.789294][T15069] team0: Port device team_slave_0 added [ 386.807644][T15069] team0: Port device team_slave_1 added [ 386.955689][T15069] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 386.975830][T15069] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 387.033128][T15069] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 387.057629][T15069] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 387.074870][T15069] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 387.134831][T15069] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 387.367044][T15144] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2459'. [ 387.373978][T15069] hsr_slave_0: entered promiscuous mode [ 387.393893][T15069] hsr_slave_1: entered promiscuous mode [ 387.401681][T15069] debugfs: 'hsr0' already exists in 'hsr' [ 387.410227][T15069] Cannot create hsr debugfs directory [ 387.562528][ T52] Bluetooth: hci6: command tx timeout [ 387.747387][T15156] FAULT_INJECTION: forcing a failure. [ 387.747387][T15156] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 387.760942][T15156] CPU: 0 UID: 0 PID: 15156 Comm: syz.4.2461 Not tainted syzkaller #0 PREEMPT(full) [ 387.760970][T15156] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 387.760982][T15156] Call Trace: [ 387.760990][T15156] [ 387.760999][T15156] dump_stack_lvl+0x189/0x250 [ 387.761034][T15156] ? __pfx____ratelimit+0x10/0x10 [ 387.761063][T15156] ? __pfx_dump_stack_lvl+0x10/0x10 [ 387.761089][T15156] ? __pfx__printk+0x10/0x10 [ 387.761109][T15156] ? __might_fault+0xb0/0x130 [ 387.761146][T15156] should_fail_ex+0x414/0x560 [ 387.761179][T15156] _copy_from_user+0x2d/0xb0 [ 387.761203][T15156] do_sock_getsockopt+0x17d/0x450 [ 387.761229][T15156] ? __pfx_do_sock_getsockopt+0x10/0x10 [ 387.761250][T15156] ? do_syscall_64+0xa0/0xfa0 [ 387.761268][T15156] ? __fget_files+0x2a/0x420 [ 387.761286][T15156] ? __fget_files+0x3a0/0x420 [ 387.761302][T15156] ? __fget_files+0x2a/0x420 [ 387.761329][T15156] __x64_sys_getsockopt+0x1a5/0x250 [ 387.761349][T15156] ? do_syscall_64+0xa0/0xfa0 [ 387.761370][T15156] ? do_syscall_64+0xa0/0xfa0 [ 387.761394][T15156] do_syscall_64+0xfa/0xfa0 [ 387.761413][T15156] ? lockdep_hardirqs_on+0x9c/0x150 [ 387.761432][T15156] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 387.761463][T15156] ? clear_bhb_loop+0x60/0xb0 [ 387.761486][T15156] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 387.761505][T15156] RIP: 0033:0x7f2b5e98f6c9 [ 387.761524][T15156] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 387.761543][T15156] RSP: 002b:00007f2b5f88a038 EFLAGS: 00000246 ORIG_RAX: 0000000000000037 [ 387.761566][T15156] RAX: ffffffffffffffda RBX: 00007f2b5ebe6090 RCX: 00007f2b5e98f6c9 [ 387.761580][T15156] RDX: 0000000000000005 RSI: 000000000000010c RDI: 000000000000000e [ 387.761592][T15156] RBP: 00007f2b5f88a090 R08: 00002000000001c0 R09: 0000000000000000 [ 387.761605][T15156] R10: 0000200000000180 R11: 0000000000000246 R12: 0000000000000001 [ 387.761617][T15156] R13: 00007f2b5ebe6128 R14: 00007f2b5ebe6090 R15: 00007ffeeff72858 [ 387.761648][T15156] [ 388.247679][T15069] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 388.274648][T15069] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 388.304094][T15069] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 388.332722][T15069] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 388.537691][T15069] 8021q: adding VLAN 0 to HW filter on device bond0 [ 388.574922][T15069] 8021q: adding VLAN 0 to HW filter on device team0 [ 388.580955][T15188] netlink: 'syz.2.2470': attribute type 1 has an invalid length. [ 388.592262][ T50] bridge0: port 1(bridge_slave_0) entered blocking state [ 388.599484][ T50] bridge0: port 1(bridge_slave_0) entered forwarding state [ 388.626888][T15188] 8021q: adding VLAN 0 to HW filter on device bond3 [ 388.651637][T15191] bond3: (slave syz_tun): making interface the new active one [ 388.660573][T15191] bond3: (slave syz_tun): Enslaving as an active interface with an up link [ 388.677864][ T1151] bridge0: port 2(bridge_slave_1) entered blocking state [ 388.685157][ T1151] bridge0: port 2(bridge_slave_1) entered forwarding state [ 388.705869][T15192] netlink: 48 bytes leftover after parsing attributes in process `syz.3.2469'. [ 388.771606][T15194] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2471'. [ 389.017411][T15069] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 389.457124][T15218] syzkaller0: tun_net_xmit 76 [ 389.480648][T15218] tipc: Enabled bearer , priority 0 [ 389.495841][T15218] syzkaller0: tun_chr_ioctl cmd 1074025692 [ 389.512622][T15218] tipc: Resetting bearer [ 389.518638][T15218] syzkaller0: tun_net_xmit 76 [ 389.531588][T15217] tipc: Resetting bearer [ 389.645267][ T52] Bluetooth: hci6: command tx timeout [ 389.650269][ C1] ip6_tunnel: ip6gre3 xmit: Local address not yet configured! [ 389.883538][T15235] sock: sock_set_timeout: `syz.3.2481' (pid 15235) tries to set negative timeout [ 391.355834][T15217] tipc: Disabling bearer [ 391.539753][T15069] veth0_vlan: entered promiscuous mode [ 391.587241][T15069] veth1_vlan: entered promiscuous mode [ 391.720645][ T52] Bluetooth: hci6: command tx timeout [ 391.736033][T15069] veth0_macvtap: entered promiscuous mode [ 391.801797][T15069] veth1_macvtap: entered promiscuous mode [ 391.869504][T15069] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 391.894662][T15261] __nla_validate_parse: 5 callbacks suppressed [ 391.894685][T15261] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2488'. [ 391.915119][T15267] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 391.934513][T15069] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 391.943318][T15267] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 391.953535][T15267] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 391.969571][ T50] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 391.970712][T15267] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 392.003554][T15267] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 392.024295][ T1304] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 392.040626][ T1304] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 392.051502][T15267] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 392.069121][ T1304] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 392.116174][T15267] netlink: 48 bytes leftover after parsing attributes in process `syz.2.2489'. [ 392.168997][T15262] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 392.442081][ T1151] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 392.460505][ T1151] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 392.463560][T15278] ªªªªª speed is unknown, defaulting to 1000 [ 392.584017][T15281] ªªªªª speed is unknown, defaulting to 1000 [ 392.592171][ T1304] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 392.609838][ T1304] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 393.802646][ T52] Bluetooth: hci6: command tx timeout [ 394.608442][T15303] syzkaller0: entered promiscuous mode [ 394.614200][T15303] syzkaller0: entered allmulticast mode [ 394.786672][T15316] ªªªªª speed is unknown, defaulting to 1000 [ 394.789246][T15328] netlink: 48 bytes leftover after parsing attributes in process `syz.4.2503'. [ 394.844289][T15330] netlink: 8 bytes leftover after parsing attributes in process `syz.6.2432'. [ 394.857526][T15330] netlink: 4 bytes leftover after parsing attributes in process `syz.6.2432'. [ 394.887897][T15330] netlink: 4 bytes leftover after parsing attributes in process `syz.6.2432'. [ 394.945363][ T3489] netdevsim netdevsim6 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 394.954584][ T3489] netdevsim netdevsim6 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 394.964350][ T61] netdevsim netdevsim6 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 395.016475][ T61] netdevsim netdevsim6 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 396.023344][T15348] xt_CHECKSUM: CHECKSUM should be avoided. If really needed, restrict with "-p udp" and only use in OUTPUT [ 396.053244][T15348] x_tables: ip_tables: rpfilter match: used from hooks FORWARD, but only valid from PREROUTING [ 396.087288][T15348] Bluetooth: MGMT ver 1.23 [ 397.210252][T15355] syzkaller0: entered promiscuous mode [ 397.216575][T15353] netlink: zone id is out of range [ 397.223217][T15355] syzkaller0: entered allmulticast mode [ 397.229044][T15353] netlink: zone id is out of range [ 397.552968][T15359] netdevsim netdevsim3 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 397.644371][T15371] ªªªªª speed is unknown, defaulting to 1000 [ 397.695687][T15359] netdevsim netdevsim3 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 397.702297][T15378] netlink: 4 bytes leftover after parsing attributes in process `syz.6.2516'. [ 397.715164][T15378] netlink: 'syz.6.2516': attribute type 1 has an invalid length. [ 397.724514][T15378] netlink: 132 bytes leftover after parsing attributes in process `syz.6.2516'. [ 397.847868][T15359] netdevsim netdevsim3 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 397.880959][ C1] ip6_tunnel: ip6gre3 xmit: Local address not yet configured! [ 397.904392][T15383] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2518'. [ 397.930303][T15383] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2518'. [ 397.948989][T15359] netdevsim netdevsim3 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 397.991762][T15383] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2518'. [ 398.133783][T15390] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2521'. [ 398.151658][T15388] netlink: 24 bytes leftover after parsing attributes in process `syz.6.2520'. [ 398.426008][ T3489] netdevsim netdevsim3 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 398.499856][ T50] netdevsim netdevsim3 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 398.644621][ T3489] netdevsim netdevsim3 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 398.684616][ T3489] netdevsim netdevsim3 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 398.702606][T15416] netlink: 47 bytes leftover after parsing attributes in process `syz.1.2529'. [ 398.750173][T15419] netlink: 48 bytes leftover after parsing attributes in process `syz.4.2531'. [ 398.927003][T15424] ªªªªª speed is unknown, defaulting to 1000 [ 399.128742][T15438] netlink: 32 bytes leftover after parsing attributes in process `syz.3.2537'. [ 399.292067][T15437] syzkaller0: entered promiscuous mode [ 399.297628][T15437] syzkaller0: entered allmulticast mode [ 400.149136][T15465] RDS: rds_bind could not find a transport for ::ffff:172.20.20.170, load rds_tcp or rds_rdma? [ 400.186820][T15447] ªªªªª speed is unknown, defaulting to 1000 [ 400.518985][T15477] netlink: 'syz.1.2544': attribute type 1 has an invalid length. [ 400.580460][T15476] bridge0: port 3(veth0_to_bridge) entered blocking state [ 400.608187][T15476] bridge0: port 3(veth0_to_bridge) entered disabled state [ 400.640408][T15476] veth0_to_bridge: entered allmulticast mode [ 400.651683][T15476] veth0_to_bridge: entered promiscuous mode [ 400.681106][T15476] bridge0: adding interface veth0_to_bridge with same address as a received packet (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 400.717434][T15476] bridge0: port 3(veth0_to_bridge) entered blocking state [ 400.724823][T15476] bridge0: port 3(veth0_to_bridge) entered forwarding state [ 401.064973][T15496] netlink: zone id is out of range [ 401.070712][T15496] netlink: zone id is out of range [ 401.419725][T15503] syzkaller1: entered promiscuous mode [ 401.419837][T15507] sctp: [Deprecated]: syz.3.2557 (pid 15507) Use of int in maxseg socket option. [ 401.419837][T15507] Use struct sctp_assoc_value instead [ 401.425750][T15503] syzkaller1: entered allmulticast mode [ 401.645561][T15514] IPVS: set_ctl: invalid protocol: 59 224.0.0.1:20000 [ 402.250924][T15546] netlink: 'syz.1.2568': attribute type 13 has an invalid length. [ 402.258805][T15546] netlink: 'syz.1.2568': attribute type 17 has an invalid length. [ 402.803415][T15547] ªªªªª speed is unknown, defaulting to 1000 [ 402.905794][T15556] syzkaller0: entered promiscuous mode [ 402.911469][T15556] syzkaller0: entered allmulticast mode [ 403.001749][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:42:07:7f:89:ef:05, vlan:0) [ 403.014792][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:42:07:7f:89:ef:05, vlan:0) [ 403.028558][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:42:07:7f:89:ef:05, vlan:0) [ 403.042259][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:42:07:7f:89:ef:05, vlan:0) [ 403.056040][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:42:07:7f:89:ef:05, vlan:0) [ 403.069757][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:42:07:7f:89:ef:05, vlan:0) [ 403.083418][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:42:07:7f:89:ef:05, vlan:0) [ 403.097237][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:42:07:7f:89:ef:05, vlan:0) [ 403.110992][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:42:07:7f:89:ef:05, vlan:0) [ 403.124849][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:42:07:7f:89:ef:05, vlan:0) [ 403.882815][T15593] __nla_validate_parse: 7 callbacks suppressed [ 403.882837][T15593] netlink: 64 bytes leftover after parsing attributes in process `syz.3.2579'. [ 407.031077][T15589] workqueue: Failed to create a rescuer kthread for wq "bond5": -EINTR [ 407.312455][T15601] sch_tbf: burst 0 is lower than device veth1_virt_wifi mtu (1514) ! [ 407.601955][T15605] netlink: 'syz.4.2581': attribute type 29 has an invalid length. [ 407.722367][T15598] netlink: 'syz.4.2581': attribute type 29 has an invalid length. [ 407.758583][T15616] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci6/hci6:200/input7 [ 408.010356][ C1] net_ratelimit: 7456 callbacks suppressed [ 408.010377][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 408.029586][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:42:07:7f:89:ef:05, vlan:0) [ 408.042846][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 408.055570][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 408.068312][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 408.081655][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:42:07:7f:89:ef:05, vlan:0) [ 408.094902][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 408.107582][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 408.120294][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 408.136313][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:42:07:7f:89:ef:05, vlan:0) [ 408.566396][T15638] netlink: 'syz.2.2592': attribute type 13 has an invalid length. [ 408.594139][T15638] netlink: 'syz.2.2592': attribute type 17 has an invalid length. [ 409.970622][T15665] ªªªªª speed is unknown, defaulting to 1000 [ 410.537823][T15687] batman_adv: batadv0: Adding interface: macsec3 [ 410.579425][T15687] batman_adv: batadv0: The MTU of interface macsec3 is too small (1468) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 410.795039][T15687] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 410.930339][T15687] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 410.986887][T15687] batman_adv: batadv0: Interface activated: macsec3 [ 411.464147][T15698] netlink: 'syz.1.2607': attribute type 21 has an invalid length. [ 411.548681][T15698] netlink: 'syz.1.2607': attribute type 1 has an invalid length. [ 411.580909][T15698] netlink: 144 bytes leftover after parsing attributes in process `syz.1.2607'. [ 412.318218][T15709] netlink: 32 bytes leftover after parsing attributes in process `syz.1.2609'. [ 412.961599][T15712] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci6/hci6:200/input8 [ 413.020321][ C1] net_ratelimit: 6467 callbacks suppressed [ 413.020346][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:42:07:7f:89:ef:05, vlan:0) [ 413.039346][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 413.052059][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 413.064644][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 413.077883][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:42:07:7f:89:ef:05, vlan:0) [ 413.091100][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 413.103744][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 413.116400][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 413.129553][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:42:07:7f:89:ef:05, vlan:0) [ 413.142870][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 413.246504][ C1] ip6_tunnel: ip6gre3 xmit: Local address not yet configured! [ 414.205757][T15746] workqueue: name exceeds WQ_NAME_LEN. Truncating to: .¿šØ ÕáÊÎí ÿìà´*žËî]æÌÔáÿÿÿÿÁ [ 415.203031][T15770] netlink: 64 bytes leftover after parsing attributes in process `syz.1.2623'. [ 415.247667][T15772] æÿîÿ: entered promiscuous mode [ 416.438386][T15798] netlink: 12 bytes leftover after parsing attributes in process `syz.6.2629'. [ 416.522261][T15799] netlink: 40 bytes leftover after parsing attributes in process `syz.6.2629'. [ 416.737765][T15807] netlink: 56 bytes leftover after parsing attributes in process `syz.3.2630'. [ 418.030823][ C1] net_ratelimit: 6926 callbacks suppressed [ 418.030847][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:42:07:7f:89:ef:05, vlan:0) [ 418.049302][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:42:07:7f:89:ef:05, vlan:0) [ 418.062408][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 418.074930][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 418.088048][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 418.101170][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:42:07:7f:89:ef:05, vlan:0) [ 418.113761][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:42:07:7f:89:ef:05, vlan:0) [ 418.126795][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 418.139360][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 418.151842][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 418.433915][T15852] ieee802154 phy0 wpan0: encryption failed: -22 [ 418.455670][T15852] ieee802154 phy0 wpan0: encryption failed: -22 [ 419.291022][T15870] netlink: 48 bytes leftover after parsing attributes in process `syz.1.2643'. [ 419.456751][T15875] netlink: 'syz.3.2645': attribute type 6 has an invalid length. [ 420.356149][T15894] netlink: 'syz.1.2651': attribute type 1 has an invalid length. [ 420.407563][T15895] RDS: rds_bind could not find a transport for ::ffff:172.20.20.170, load rds_tcp or rds_rdma? [ 420.495878][T15901] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2651'. [ 420.556219][T15904] netlink: 'syz.2.2647': attribute type 3 has an invalid length. [ 420.575341][T15887] ªªªªª speed is unknown, defaulting to 1000 [ 420.830276][T15883] IPVS: set_ctl: invalid protocol: 135 172.30.1.3:20000 [ 420.942052][T15894] bond5: entered promiscuous mode [ 420.991490][T15894] 8021q: adding VLAN 0 to HW filter on device bond5 [ 421.020161][T15901] bond5: entered allmulticast mode [ 421.287662][T15912] bond5: (slave bridge6): making interface the new active one [ 421.340603][T15912] bridge6: entered promiscuous mode [ 421.346059][T15912] bridge6: entered allmulticast mode [ 421.387166][T15912] bond5: (slave bridge6): Enslaving as an active interface with an up link [ 422.127002][T15931] netlink: 36 bytes leftover after parsing attributes in process `syz.1.2658'. [ 422.535828][T15924] ªªªªª speed is unknown, defaulting to 1000 [ 422.617802][T15927] ªªªªª speed is unknown, defaulting to 1000 [ 423.040855][ C1] net_ratelimit: 6180 callbacks suppressed [ 423.040880][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 423.059258][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 423.072227][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 423.085265][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 423.097785][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 423.110873][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 423.124032][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:42:07:7f:89:ef:05, vlan:0) [ 423.136663][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:42:07:7f:89:ef:05, vlan:0) [ 423.149724][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 423.163631][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 423.521186][T15949] netlink: 8 bytes leftover after parsing attributes in process `syz.6.2662'. [ 423.594774][T15949] netlink: 24 bytes leftover after parsing attributes in process `syz.6.2662'. [ 423.637519][T15949] netlink: 24 bytes leftover after parsing attributes in process `syz.6.2662'. [ 424.218093][T15957] netlink: 10 bytes leftover after parsing attributes in process `syz.3.2663'. [ 424.260339][T15960] macsec1: entered promiscuous mode [ 424.275960][T15960] macsec1: entered allmulticast mode [ 424.597808][T15965] netlink: 'syz.1.2666': attribute type 12 has an invalid length. [ 424.872145][T15974] netlink: 260 bytes leftover after parsing attributes in process `syz.3.2670'. [ 424.930783][T15976] netlink: 36 bytes leftover after parsing attributes in process `syz.1.2671'. [ 425.198006][T15974] syzkaller1: tun_chr_ioctl cmd 1074025677 [ 425.210199][T15974] syzkaller1: Refused to change device type [ 425.264623][ T5941] IPVS: starting estimator thread 0... [ 425.328150][T15980] IPVS: Scheduler module ip_vs_sip not found [ 425.450460][T15982] IPVS: using max 25 ests per chain, 60000 per kthread [ 425.590058][T15980] IPVS: length: 141 != 8 [ 425.793480][T15985] netlink: 48 bytes leftover after parsing attributes in process `syz.2.2674'. [ 426.320002][ C1] sched: DL replenish lagged too much [ 426.356781][T16004] netlink: 8 bytes leftover after parsing attributes in process `syz.6.2680'. [ 426.441239][T16004] netlink: 8 bytes leftover after parsing attributes in process `syz.6.2680'. [ 426.466108][T16006] netlink: 'syz.1.2673': attribute type 1 has an invalid length. [ 426.884963][T16010] netlink: 'syz.2.2682': attribute type 13 has an invalid length. [ 426.922487][T16010] netlink: 'syz.2.2682': attribute type 17 has an invalid length. [ 427.057019][T16012] bridge_slave_0: vlans aren't supported yet for dev_uc|mc_add() [ 427.346049][T16016] batman_adv: batadv0: Adding interface: vlan4 [ 427.384429][T16016] batman_adv: batadv0: The MTU of interface vlan4 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 427.463185][T16016] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 427.514506][T16016] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 427.565238][T16016] batman_adv: batadv0: Not using interface vlan4 (retrying later): interface not active [ 427.580257][T16025] __nla_validate_parse: 5 callbacks suppressed [ 427.580278][T16025] netlink: 48 bytes leftover after parsing attributes in process `syz.4.2686'. [ 428.050228][ C1] net_ratelimit: 7286 callbacks suppressed [ 428.050253][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 428.069175][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:42:07:7f:89:ef:05, vlan:0) [ 428.081752][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:42:07:7f:89:ef:05, vlan:0) [ 428.094843][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 428.107478][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 428.114147][T16031] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2688'. [ 428.120421][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 428.140956][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 428.153505][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 428.166589][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 428.179592][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:42:07:7f:89:ef:05, vlan:0) [ 428.271359][T16028] IPVS: Scheduler module ip_vs_sip not found [ 428.340386][T16031] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2688'. [ 428.410540][T16031] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2688'. [ 428.587856][T16028] IPVS: length: 141 != 8 [ 428.891123][T16043] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2691'. [ 428.974905][T16043] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2691'. [ 429.006754][T16043] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2691'. [ 429.042194][T16046] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2693'. [ 429.085414][T16043] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2691'. [ 429.130996][T16043] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2691'. [ 429.985105][T16075] netlink: 'syz.6.2694': attribute type 1 has an invalid length. [ 430.162997][T16079] x_tables: ip_tables: osf.0 match: invalid size 48 (kernel) != (user) 4096 [ 430.546127][T16081] netlink: 'syz.1.2703': attribute type 1 has an invalid length. [ 430.766533][T16081] 8021q: adding VLAN 0 to HW filter on device bond6 [ 430.897178][T16086] can: request_module (can-proto-3) failed. [ 431.274483][T16110] netlink: 'syz.6.2710': attribute type 5 has an invalid length. [ 431.647166][T16124] No such timeout policy "syz1" [ 431.765561][T16110] ip6erspan0: entered promiscuous mode [ 432.676317][T16142] netlink: 'syz.6.2718': attribute type 62 has an invalid length. [ 432.875482][T16147] bridge7: entered allmulticast mode [ 433.060484][ C1] net_ratelimit: 7260 callbacks suppressed [ 433.060508][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 433.078854][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 433.091554][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 433.105039][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 433.118064][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:42:07:7f:89:ef:05, vlan:0) [ 433.130632][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:42:07:7f:89:ef:05, vlan:0) [ 433.143770][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 433.156335][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 433.169305][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 433.181785][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 433.537099][T16167] __nla_validate_parse: 13 callbacks suppressed [ 433.537121][T16167] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2724'. [ 433.570399][T16169] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2725'. [ 433.749089][T16167] 8021q: adding VLAN 0 to HW filter on device bond4 [ 433.798201][T16173] bond4: (slave lo): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 433.872721][T16185] netlink: 40 bytes leftover after parsing attributes in process `syz.1.2728'. [ 433.897328][T16184] netlink: 48 bytes leftover after parsing attributes in process `syz.6.2727'. [ 433.914825][T16173] 8021q: adding VLAN 0 to HW filter on device bond4 [ 433.955874][T16173] bond4: (slave lo): Enslaving as an active interface with an up link [ 433.992495][T16188] netlink: 36 bytes leftover after parsing attributes in process `syz.4.2729'. [ 434.406009][T16175] bond4 (unregistering): (slave lo): Releasing backup interface [ 434.415988][T16175] bond4 (unregistering): (slave lo): last VLAN challenged slave left bond - VLAN blocking is removed [ 434.438991][T16175] bond4 (unregistering): Released all slaves [ 435.010560][T16197] pim6reg1: entered promiscuous mode [ 435.075514][T16197] pim6reg1: entered allmulticast mode [ 435.106744][T16208] netlink: 'syz.2.2733': attribute type 7 has an invalid length. [ 435.917205][T16224] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2739'. [ 436.401819][T16236] netlink: 48 bytes leftover after parsing attributes in process `syz.2.2742'. [ 436.792451][T16245] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2746'. [ 436.802538][T16247] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2745'. [ 436.859132][T16251] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2748'. [ 437.060610][T16247] bridge_slave_1: left allmulticast mode [ 437.172598][T16247] bridge_slave_1: left promiscuous mode [ 437.178468][T16247] bridge0: port 2(bridge_slave_1) entered disabled state [ 437.299066][T16247] bridge_slave_0: left allmulticast mode [ 437.335666][T16247] bridge_slave_0: left promiscuous mode [ 437.350709][T16247] bridge0: port 1(bridge_slave_0) entered disabled state [ 438.070633][ C1] net_ratelimit: 7504 callbacks suppressed [ 438.070656][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 438.078401][T16246] ªªªªª speed is unknown, defaulting to 1000 [ 438.078872][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 438.109080][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 438.122223][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 438.135308][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:42:07:7f:89:ef:05, vlan:0) [ 438.147891][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:42:07:7f:89:ef:05, vlan:0) [ 438.161034][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 438.173518][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 438.186523][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 438.199007][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 439.861028][T16316] __nla_validate_parse: 3 callbacks suppressed [ 439.861051][T16316] netlink: 4 bytes leftover after parsing attributes in process `syz.6.2765'. [ 440.140437][ T1299] ieee802154 phy0 wpan0: encryption failed: -22 [ 440.146937][ T1299] ieee802154 phy1 wpan1: encryption failed: -22 [ 440.236277][T16326] netlink: 8 bytes leftover after parsing attributes in process `syz.6.2767'. [ 440.295796][T16326] netlink: 4 bytes leftover after parsing attributes in process `syz.6.2767'. [ 440.335621][T16326] netlink: 4 bytes leftover after parsing attributes in process `syz.6.2767'. [ 440.498259][T16331] syzkaller0: entered promiscuous mode [ 440.520330][T16331] syzkaller0: entered allmulticast mode [ 441.452948][T16354] netlink: 8 bytes leftover after parsing attributes in process `syz.6.2775'. [ 442.156118][T16365] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2779'. [ 442.191072][T16365] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2779'. [ 442.210738][T16365] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2779'. [ 442.523030][T16369] ªªªªª speed is unknown, defaulting to 1000 [ 443.080344][ C1] net_ratelimit: 6375 callbacks suppressed [ 443.080366][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 443.098878][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 443.112248][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 443.125486][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:42:07:7f:89:ef:05, vlan:0) [ 443.138337][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:42:07:7f:89:ef:05, vlan:0) [ 443.151664][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 443.164384][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 443.177552][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 443.190449][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 443.203182][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 443.466644][T16393] netlink: 40 bytes leftover after parsing attributes in process `syz.6.2783'. [ 443.593414][T16393] tc_dump_action: action bad kind [ 444.178816][T16408] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 444.190351][T16408] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 444.199613][T16408] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 444.209631][T16408] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 444.218276][T16408] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 444.572517][ T5834] syz_tun (unregistering): left allmulticast mode [ 444.602756][ C1] ip6_tunnel: ip6gre3 xmit: Local address not yet configured! [ 444.725140][ T5834] bond3: (slave syz_tun): Releasing active interface [ 445.029079][ T50] netdevsim netdevsim2 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 445.140545][T16406] ªªªªª speed is unknown, defaulting to 1000 [ 445.345959][ T50] netdevsim netdevsim2 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 445.525900][ T50] netdevsim netdevsim2 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 445.745570][ T50] netdevsim netdevsim2 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 446.280891][ T52] Bluetooth: hci2: command tx timeout [ 446.705455][T16437] ªªªªª speed is unknown, defaulting to 1000 [ 447.036288][T16443] ªªªªª speed is unknown, defaulting to 1000 [ 447.764115][T16456] ªªªªª speed is unknown, defaulting to 1000 [ 448.090335][ C1] net_ratelimit: 6854 callbacks suppressed [ 448.090358][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:42:07:7f:89:ef:05, vlan:0) [ 448.108807][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:42:07:7f:89:ef:05, vlan:0) [ 448.121408][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:42:07:7f:89:ef:05, vlan:0) [ 448.134527][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 448.147644][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 448.160652][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 448.173199][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 448.185852][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 448.198910][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 448.212030][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:42:07:7f:89:ef:05, vlan:0) [ 448.237173][T16406] chnl_net:caif_netlink_parms(): no params data found [ 448.295971][T16469] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2803'. [ 448.518995][ T52] Bluetooth: hci2: command tx timeout [ 449.227504][T16477] netlink: 32 bytes leftover after parsing attributes in process `syz.4.2805'. [ 450.225481][ T50] bond0 (unregistering): (slave 30): Releasing backup interface [ 450.246294][ T50] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 450.263442][ T50] bond0 (unregistering): Released all slaves [ 450.497631][ T50] bond1 (unregistering): Released all slaves [ 450.519482][ T50] bond2 (unregistering): Released all slaves [ 450.601676][ T52] Bluetooth: hci2: command tx timeout [ 450.773145][ T50] bond3 (unregistering): Released all slaves [ 452.690674][ T52] Bluetooth: hci2: command tx timeout [ 453.100198][ C1] net_ratelimit: 8260 callbacks suppressed [ 453.100223][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 453.119025][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 453.131725][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 453.144440][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 453.157603][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 453.170302][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 453.182998][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 453.197293][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 453.210550][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:42:07:7f:89:ef:05, vlan:0) [ 453.224410][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:42:07:7f:89:ef:05, vlan:0) [ 453.791131][T16500] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2809'. [ 453.999555][T16506] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2810'. [ 454.174226][ T50] tipc: Left network mode [ 458.110457][ C1] net_ratelimit: 9199 callbacks suppressed [ 458.110474][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:42:07:7f:89:ef:05, vlan:0) [ 458.128689][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:42:07:7f:89:ef:05, vlan:0) [ 458.141373][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 458.153663][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 458.165964][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 458.178161][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 458.190644][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 458.203310][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 458.215658][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 458.227981][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 458.295786][T16522] tipc: Enabled bearer , priority 0 [ 458.342204][T16523] syzkaller0: entered promiscuous mode [ 458.360682][T16523] syzkaller0: entered allmulticast mode [ 458.421159][T16406] bridge0: port 1(bridge_slave_0) entered blocking state [ 458.428453][T16406] bridge0: port 1(bridge_slave_0) entered disabled state [ 458.479501][T16406] bridge_slave_0: entered allmulticast mode [ 458.514414][T16406] bridge_slave_0: entered promiscuous mode [ 458.635421][T16547] sctp: [Deprecated]: syz.4.2820 (pid 16547) Use of int in max_burst socket option. [ 458.635421][T16547] Use struct sctp_assoc_value instead [ 458.682354][T16547] netlink: 24 bytes leftover after parsing attributes in process `syz.4.2820'. [ 458.696188][T16547] netlink: 11 bytes leftover after parsing attributes in process `syz.4.2820'. [ 458.728441][T16406] bridge0: port 2(bridge_slave_1) entered blocking state [ 458.737150][T16406] bridge0: port 2(bridge_slave_1) entered disabled state [ 458.747163][T16406] bridge_slave_1: entered allmulticast mode [ 458.764295][T16406] bridge_slave_1: entered promiscuous mode [ 458.791771][T16523] tipc: Resetting bearer [ 459.360477][ T5941] tipc: Node number set to 2629284613 [ 460.067264][T16523] tipc: Disabling bearer [ 460.135101][T16549] mac80211_hwsim hwsim2 wlan0: left allmulticast mode [ 460.568418][T16574] netlink: 36 bytes leftover after parsing attributes in process `syz.1.2827'. [ 460.815563][T16576] Bluetooth: hci0: Opcode 0x0c1a failed: -22 [ 461.199766][T16406] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 461.410917][T16583] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2829'. [ 461.454867][T16406] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 461.488747][T16583] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2829'. [ 461.652009][T16583] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2829'. [ 461.730737][T16588] netlink: 'syz.1.2831': attribute type 10 has an invalid length. [ 461.853208][T16406] team0: Port device team_slave_0 added [ 461.942688][T16588] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2831'. [ 461.997471][T16406] team0: Port device team_slave_1 added [ 462.592969][T16406] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 462.651832][T16406] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 462.744126][T16406] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 462.782607][T16603] tipc: Enabled bearer , priority 0 [ 462.841128][ T52] Bluetooth: hci0: command tx timeout [ 463.084060][T16605] syzkaller0: entered promiscuous mode [ 463.120655][ C1] net_ratelimit: 7189 callbacks suppressed [ 463.120678][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 463.130028][T16605] syzkaller0: entered allmulticast mode [ 463.139435][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:42:07:7f:89:ef:05, vlan:0) [ 463.157694][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:42:07:7f:89:ef:05, vlan:0) [ 463.170283][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:42:07:7f:89:ef:05, vlan:0) [ 463.179333][T16406] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 463.183229][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 463.201879][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 463.214609][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 463.227151][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 463.236089][T16406] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 463.239654][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 463.278000][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 463.348771][T16406] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 463.540156][T16606] tipc: Resetting bearer [ 463.549348][T16607] netlink: 'syz.3.2834': attribute type 15 has an invalid length. [ 463.639648][T16602] tipc: Resetting bearer [ 466.187938][T16602] tipc: Disabling bearer [ 466.277796][ T50] hsr_slave_0: left promiscuous mode [ 466.306308][ T50] hsr_slave_1: left promiscuous mode [ 466.312971][ T50] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 466.324008][ T50] batman_adv: batadv0: Removing interface: macsec1 [ 467.233329][ T50] team0 (unregistering): Port device team_slave_1 removed [ 467.359503][ T50] team0 (unregistering): Port device team_slave_0 removed [ 468.130280][ C1] net_ratelimit: 9607 callbacks suppressed [ 468.130304][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 468.148431][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 468.160733][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 468.173127][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 468.185511][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 468.197687][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 468.209886][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 468.222786][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 468.235470][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:42:07:7f:89:ef:05, vlan:0) [ 468.248250][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:42:07:7f:89:ef:05, vlan:0) [ 468.750595][T16635] netlink: 60 bytes leftover after parsing attributes in process `syz.4.2841'. [ 468.772930][T16406] hsr_slave_0: entered promiscuous mode [ 468.787630][T16636] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2842'. [ 468.798693][T16406] hsr_slave_1: entered promiscuous mode [ 468.817708][T16406] debugfs: 'hsr0' already exists in 'hsr' [ 468.838121][T16406] Cannot create hsr debugfs directory [ 468.956284][T16636] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2842'. [ 469.665587][ T50] IPVS: stop unused estimator thread 0... [ 469.839625][T16649] ªªªªª speed is unknown, defaulting to 1000 [ 470.175525][T16656] ªªªªª speed is unknown, defaulting to 1000 [ 470.198735][T16665] netlink: 36 bytes leftover after parsing attributes in process `syz.4.2849'. [ 470.557859][T16654] syzkaller0: entered promiscuous mode [ 470.590140][T16654] syzkaller0: entered allmulticast mode [ 470.767981][T16678] netlink: 'syz.3.2852': attribute type 16 has an invalid length. [ 470.810216][T16678] netlink: 'syz.3.2852': attribute type 17 has an invalid length. [ 470.991306][T16682] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2853'. [ 471.033542][T16682] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2853'. [ 471.537615][T16678] batman_adv: batadv0: Interface deactivated: macsec3 [ 471.688837][T16682] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2853'. [ 471.871507][ T3489] netdevsim netdevsim3 eth0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 472.552336][T16708] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2860'. [ 473.141188][ C1] net_ratelimit: 7799 callbacks suppressed [ 473.141209][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:42:07:7f:89:ef:05, vlan:0) [ 473.159454][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:42:07:7f:89:ef:05, vlan:0) [ 473.172265][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 473.184769][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 473.197119][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 473.209305][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 473.221619][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 473.234223][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 473.246584][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 473.258913][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 475.797986][ T3489] netdevsim netdevsim3 eth1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 475.863069][T16708] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2860'. [ 475.884536][ T3489] netdevsim netdevsim3 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 475.910952][ T3489] netdevsim netdevsim3 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 476.515571][T16406] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 476.549889][T16406] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 476.596346][T16719] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2864'. [ 476.654179][T16406] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 476.699783][T16406] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 476.940770][T16731] netlink: 8 bytes leftover after parsing attributes in process `syz.6.2865'. [ 476.976627][T16731] netlink: 8 bytes leftover after parsing attributes in process `syz.6.2865'. [ 477.318157][T16735] syzkaller1: entered promiscuous mode [ 477.330790][T16735] syzkaller1: entered allmulticast mode [ 477.339479][T16737] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2869'. [ 477.381761][T16737] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2869'. [ 477.635396][T16406] 8021q: adding VLAN 0 to HW filter on device bond0 [ 477.713891][T16406] 8021q: adding VLAN 0 to HW filter on device team0 [ 477.770713][ T61] bridge0: port 1(bridge_slave_0) entered blocking state [ 477.777987][ T61] bridge0: port 1(bridge_slave_0) entered forwarding state [ 477.856938][T16749] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2872'. [ 477.869153][ T61] bridge0: port 2(bridge_slave_1) entered blocking state [ 477.876402][ T61] bridge0: port 2(bridge_slave_1) entered forwarding state [ 477.985049][T16749] netlink: 'syz.1.2872': attribute type 3 has an invalid length. [ 478.018195][T16749] netlink: 'syz.1.2872': attribute type 2 has an invalid length. [ 478.043847][T16749] netlink: 'syz.1.2872': attribute type 2 has an invalid length. [ 478.150207][ C1] net_ratelimit: 8193 callbacks suppressed [ 478.150228][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 478.170658][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 478.183406][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 478.196472][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 478.209565][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:42:07:7f:89:ef:05, vlan:0) [ 478.223152][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:42:07:7f:89:ef:05, vlan:0) [ 478.235794][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:42:07:7f:89:ef:05, vlan:0) [ 478.248904][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 478.262300][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 478.274927][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 479.032685][T16775] netlink: 24 bytes leftover after parsing attributes in process `syz.4.2880'. [ 479.089353][T16776] netlink: 36 bytes leftover after parsing attributes in process `syz.6.2881'. [ 479.119261][T16777] netlink: 24 bytes leftover after parsing attributes in process `syz.4.2880'. [ 479.420775][T16777] ip6gre1: entered promiscuous mode [ 479.433311][T16784] netlink: 'syz.1.2883': attribute type 3 has an invalid length. [ 479.550397][T16406] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 479.571734][T16408] Bluetooth: hci2: command 0x0405 tx timeout [ 479.868710][T16406] veth0_vlan: entered promiscuous mode [ 479.965440][T16406] veth1_vlan: entered promiscuous mode [ 480.031795][T16797] 0ªX¹¦À: renamed from caif0 [ 480.068366][T16797] 0ªX¹¦À: entered allmulticast mode [ 480.186520][T16406] veth0_macvtap: entered promiscuous mode [ 480.247130][T16406] veth1_macvtap: entered promiscuous mode [ 480.373401][T16406] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 480.437393][T16406] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 480.595949][ T61] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 480.631986][T16811] netlink: 'syz.3.2888': attribute type 3 has an invalid length. [ 480.640197][T16811] netlink: 'syz.3.2888': attribute type 1 has an invalid length. [ 480.652676][ T61] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 480.699217][ T61] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 480.713406][T16815] FAULT_INJECTION: forcing a failure. [ 480.713406][T16815] name failslab, interval 1, probability 0, space 0, times 0 [ 480.746153][ T61] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 480.760013][T16815] CPU: 0 UID: 0 PID: 16815 Comm: syz.1.2889 Not tainted syzkaller #0 PREEMPT(full) [ 480.760044][T16815] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 480.760056][T16815] Call Trace: [ 480.760064][T16815] [ 480.760072][T16815] dump_stack_lvl+0x189/0x250 [ 480.760108][T16815] ? __pfx____ratelimit+0x10/0x10 [ 480.760136][T16815] ? __pfx_dump_stack_lvl+0x10/0x10 [ 480.760161][T16815] ? __pfx__printk+0x10/0x10 [ 480.760185][T16815] ? __pfx___might_resched+0x10/0x10 [ 480.760205][T16815] ? fs_reclaim_acquire+0x7d/0x100 [ 480.760230][T16815] should_fail_ex+0x414/0x560 [ 480.760264][T16815] should_failslab+0xa8/0x100 [ 480.760285][T16815] __kvmalloc_node_noprof+0x158/0x910 [ 480.760310][T16815] ? __nf_register_net_hook+0x232/0x930 [ 480.760331][T16815] ? nf_hook_entries_grow+0x281/0x720 [ 480.760360][T16815] nf_hook_entries_grow+0x281/0x720 [ 480.760399][T16815] __nf_register_net_hook+0x2c9/0x930 [ 480.760433][T16815] nf_register_net_hook+0xb2/0x190 [ 480.760458][T16815] nf_register_net_hooks+0x44/0x1b0 [ 480.760493][T16815] nf_ct_netns_do_get+0x212/0x5a0 [ 480.760520][T16815] ? __pfx_nf_ct_netns_do_get+0x10/0x10 [ 480.760545][T16815] ? synproxy_pernet+0x45/0x270 [ 480.760569][T16815] ? synproxy_pernet+0x45/0x270 [ 480.760592][T16815] ? synproxy_pernet+0x45/0x270 [ 480.760624][T16815] nft_synproxy_do_init+0x1d1/0x4c0 [ 480.760658][T16815] nf_tables_newrule+0x1794/0x28a0 [ 480.760703][T16815] ? __pfx_nf_tables_newrule+0x10/0x10 [ 480.760730][T16815] ? nfnl_pernet+0x23/0x240 [ 480.760771][T16815] ? __nla_parse+0x40/0x60 [ 480.760799][T16815] nfnetlink_rcv+0x11d9/0x2590 [ 480.760873][T16815] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 480.760967][T16815] ? netlink_deliver_tap+0x2e/0x1b0 [ 480.761012][T16815] netlink_unicast+0x82f/0x9e0 [ 480.761053][T16815] ? __pfx_netlink_unicast+0x10/0x10 [ 480.761085][T16815] ? netlink_sendmsg+0x642/0xb30 [ 480.761104][T16815] ? skb_put+0x11b/0x210 [ 480.761129][T16815] netlink_sendmsg+0x805/0xb30 [ 480.761162][T16815] ? __pfx_netlink_sendmsg+0x10/0x10 [ 480.761187][T16815] ? aa_sock_msg_perm+0xf1/0x1d0 [ 480.761219][T16815] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 480.761239][T16815] ? __pfx_netlink_sendmsg+0x10/0x10 [ 480.761262][T16815] __sock_sendmsg+0x21c/0x270 [ 480.761293][T16815] ____sys_sendmsg+0x505/0x830 [ 480.761334][T16815] ? __pfx_____sys_sendmsg+0x10/0x10 [ 480.761369][T16815] ? import_iovec+0x74/0xa0 [ 480.761399][T16815] ___sys_sendmsg+0x21f/0x2a0 [ 480.761425][T16815] ? __pfx____sys_sendmsg+0x10/0x10 [ 480.761502][T16815] ? __fget_files+0x2a/0x420 [ 480.761521][T16815] ? __fget_files+0x3a0/0x420 [ 480.761554][T16815] __x64_sys_sendmsg+0x19b/0x260 [ 480.761581][T16815] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 480.761617][T16815] ? __pfx_ksys_write+0x10/0x10 [ 480.761649][T16815] ? do_syscall_64+0xbe/0xfa0 [ 480.761673][T16815] do_syscall_64+0xfa/0xfa0 [ 480.761690][T16815] ? lockdep_hardirqs_on+0x9c/0x150 [ 480.761710][T16815] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 480.761728][T16815] ? clear_bhb_loop+0x60/0xb0 [ 480.761753][T16815] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 480.761771][T16815] RIP: 0033:0x7fbbde38f6c9 [ 480.761791][T16815] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 480.761807][T16815] RSP: 002b:00007fbbdf2cb038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 480.761831][T16815] RAX: ffffffffffffffda RBX: 00007fbbde5e5fa0 RCX: 00007fbbde38f6c9 [ 480.761846][T16815] RDX: 0000000024000840 RSI: 0000200000009b40 RDI: 0000000000000003 [ 480.761859][T16815] RBP: 00007fbbdf2cb090 R08: 0000000000000000 R09: 0000000000000000 [ 480.761871][T16815] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 480.761883][T16815] R13: 00007fbbde5e6038 R14: 00007fbbde5e5fa0 R15: 00007fff0c9754c8 [ 480.761920][T16815] [ 481.177156][T16818] __nla_validate_parse: 5 callbacks suppressed [ 481.177177][T16818] netlink: 20 bytes leftover after parsing attributes in process `syz.4.2891'. [ 481.242715][T16821] netlink: 20 bytes leftover after parsing attributes in process `syz.4.2891'. [ 481.597833][T16832] netlink: 36 bytes leftover after parsing attributes in process `syz.3.2894'. [ 481.870786][ T61] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 481.878949][ T61] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 482.236041][ T61] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 482.252267][ T61] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 482.349640][T16840] ªªªªª speed is unknown, defaulting to 1000 [ 483.160252][ C1] net_ratelimit: 6929 callbacks suppressed [ 483.160276][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 483.173068][T16855] syz.4.2900: vmalloc error: size 16781312, failed to allocated page array size 32776, mode:0xdc2(GFP_KERNEL|__GFP_HIGHMEM|__GFP_ZERO), nodemask=(null) [ 483.178865][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 483.207954][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 483.220962][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:42:07:7f:89:ef:05, vlan:0) [ 483.234714][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:42:07:7f:89:ef:05, vlan:0) [ 483.236121][T16855] ,cpuset= [ 483.247291][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:42:07:7f:89:ef:05, vlan:0) [ 483.248181][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 483.276131][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 483.288684][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 483.301233][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 483.362484][T16855] /,mems_allowed=0-1 [ 483.366577][T16855] CPU: 0 UID: 0 PID: 16855 Comm: syz.4.2900 Not tainted syzkaller #0 PREEMPT(full) [ 483.366602][T16855] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 483.366613][T16855] Call Trace: [ 483.366620][T16855] [ 483.366628][T16855] dump_stack_lvl+0x189/0x250 [ 483.366660][T16855] ? __pfx_rcu_read_unlock_special+0x10/0x10 [ 483.366690][T16855] ? __pfx_dump_stack_lvl+0x10/0x10 [ 483.366715][T16855] ? __pfx__printk+0x10/0x10 [ 483.366736][T16855] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 483.366762][T16855] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 483.366797][T16855] warn_alloc+0x214/0x310 [ 483.366834][T16855] ? __pfx_warn_alloc+0x10/0x10 [ 483.366881][T16855] ? __get_vm_area_node+0x28f/0x300 [ 483.366910][T16855] ? xskq_create+0xbf/0x170 [ 483.366943][T16855] __vmalloc_node_range_noprof+0x690/0x12d0 [ 483.367008][T16855] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 483.367041][T16855] ? __kasan_kmalloc+0x93/0xb0 [ 483.367079][T16855] vmalloc_user_noprof+0xad/0xf0 [ 483.367106][T16855] ? xskq_create+0xbf/0x170 [ 483.367135][T16855] xskq_create+0xbf/0x170 [ 483.367166][T16855] xsk_init_queue+0xb0/0x110 [ 483.367197][T16855] xsk_setsockopt+0x57b/0x8d0 [ 483.367228][T16855] ? __pfx_xsk_setsockopt+0x10/0x10 [ 483.367258][T16855] ? __pfx_aa_sk_perm+0x10/0x10 [ 483.367288][T16855] ? aa_sock_opt_perm+0xff/0x1b0 [ 483.367320][T16855] ? bpf_lsm_socket_setsockopt+0x9/0x20 [ 483.367340][T16855] ? __pfx_xsk_setsockopt+0x10/0x10 [ 483.367368][T16855] do_sock_setsockopt+0x17c/0x1b0 [ 483.367405][T16855] __x64_sys_setsockopt+0x13f/0x1b0 [ 483.367434][T16855] do_syscall_64+0xfa/0xfa0 [ 483.367452][T16855] ? lockdep_hardirqs_on+0x9c/0x150 [ 483.367471][T16855] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 483.367490][T16855] ? clear_bhb_loop+0x60/0xb0 [ 483.367514][T16855] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 483.367533][T16855] RIP: 0033:0x7f2b5e98f6c9 [ 483.367552][T16855] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 483.367568][T16855] RSP: 002b:00007f2b5f88a038 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 483.367588][T16855] RAX: ffffffffffffffda RBX: 00007f2b5ebe6090 RCX: 00007f2b5e98f6c9 [ 483.367602][T16855] RDX: 0000000000000003 RSI: 000000000000011b RDI: 0000000000000003 [ 483.367614][T16855] RBP: 00007f2b5ea11f91 R08: 0000000000000004 R09: 0000000000000000 [ 483.367626][T16855] R10: 0000200000001780 R11: 0000000000000246 R12: 0000000000000000 [ 483.367638][T16855] R13: 00007f2b5ebe6128 R14: 00007f2b5ebe6090 R15: 00007ffeeff72858 [ 483.367674][T16855] [ 483.367682][T16855] Mem-Info: [ 483.811322][T16868] netlink: 'syz.2.2782': attribute type 1 has an invalid length. [ 483.871208][T16868] netlink: 168 bytes leftover after parsing attributes in process `syz.2.2782'. [ 483.953760][T16865] FAULT_INJECTION: forcing a failure. [ 483.953760][T16865] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 484.174576][T16865] CPU: 0 UID: 0 PID: 16865 Comm: syz.1.2903 Not tainted syzkaller #0 PREEMPT(full) [ 484.174607][T16865] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 484.174618][T16865] Call Trace: [ 484.174626][T16865] [ 484.174635][T16865] dump_stack_lvl+0x189/0x250 [ 484.174668][T16865] ? __pfx____ratelimit+0x10/0x10 [ 484.174709][T16865] ? __pfx_dump_stack_lvl+0x10/0x10 [ 484.174735][T16865] ? __pfx__printk+0x10/0x10 [ 484.174755][T16865] ? __might_fault+0xb0/0x130 [ 484.174795][T16865] should_fail_ex+0x414/0x560 [ 484.174831][T16865] _copy_from_user+0x2d/0xb0 [ 484.174856][T16865] __sys_bpf+0x1e3/0x860 [ 484.174879][T16865] ? __pfx___sys_bpf+0x10/0x10 [ 484.174918][T16865] ? ksys_write+0x22a/0x250 [ 484.174950][T16865] ? __pfx_ksys_write+0x10/0x10 [ 484.174984][T16865] __x64_sys_bpf+0x7c/0x90 [ 484.175014][T16865] do_syscall_64+0xfa/0xfa0 [ 484.175031][T16865] ? lockdep_hardirqs_on+0x9c/0x150 [ 484.175051][T16865] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 484.175070][T16865] ? clear_bhb_loop+0x60/0xb0 [ 484.175094][T16865] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 484.175112][T16865] RIP: 0033:0x7fbbde38f6c9 [ 484.175131][T16865] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 484.175148][T16865] RSP: 002b:00007fbbdf289038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 484.175170][T16865] RAX: ffffffffffffffda RBX: 00007fbbde5e6180 RCX: 00007fbbde38f6c9 [ 484.175184][T16865] RDX: 0000000000000050 RSI: 0000200000000280 RDI: 0000000000000000 [ 484.175197][T16865] RBP: 00007fbbdf289090 R08: 0000000000000000 R09: 0000000000000000 [ 484.175209][T16865] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 484.175220][T16865] R13: 00007fbbde5e6218 R14: 00007fbbde5e6180 R15: 00007fff0c9754c8 [ 484.175256][T16865] [ 484.911193][T16408] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1 [ 484.985339][T16408] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9 [ 485.014660][T16855] active_anon:5300 inactive_anon:0 isolated_anon:0 [ 485.014660][T16855] active_file:3904 inactive_file:40048 isolated_file:0 [ 485.014660][T16855] unevictable:768 dirty:247 writeback:0 [ 485.014660][T16855] slab_reclaimable:11541 slab_unreclaimable:159845 [ 485.014660][T16855] mapped:39866 shmem:1355 pagetables:1039 [ 485.014660][T16855] sec_pagetables:0 bounce:0 [ 485.014660][T16855] kernel_misc_reclaimable:0 [ 485.014660][T16855] free:1231598 free_pcp:20909 free_cma:0 [ 485.072164][T16408] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9 [ 485.165018][T16408] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4 [ 485.194176][T16408] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2 [ 485.258509][T16879] netlink: 36 bytes leftover after parsing attributes in process `syz.2.2906'. [ 485.292428][T16855] Node 0 active_anon:21400kB inactive_anon:0kB active_file:15616kB inactive_file:159996kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:159464kB dirty:988kB writeback:0kB shmem:3884kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:13532kB pagetables:4024kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 485.560104][T16855] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:196kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:48kB pagetables:132kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 485.607208][T16871] ªªªªª speed is unknown, defaulting to 1000 [ 485.676797][T16855] Node 0 DMA free:15360kB boost:0kB min:204kB low:252kB high:300kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 485.747337][T16855] lowmem_reserve[]: 0 2504 2505 2505 2505 [ 485.766798][T16855] Node 0 DMA32 free:1016268kB boost:0kB min:34308kB low:42884kB high:51460kB reserved_highatomic:0KB free_highatomic:0KB active_anon:21400kB inactive_anon:0kB active_file:15616kB inactive_file:159996kB unevictable:1536kB writepending:1088kB zspages:0kB present:3129332kB managed:2565112kB mlocked:0kB bounce:0kB free_pcp:74964kB local_pcp:44472kB free_cma:0kB [ 485.834810][T16875] ªªªªª speed is unknown, defaulting to 1000 [ 485.915713][T16855] lowmem_reserve[]: 0 0 0 0 0 [ 485.940551][T16855] Node 0 Normal free:0kB boost:0kB min:0kB low:0kB high:0kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:108kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 486.072123][T16855] lowmem_reserve[]: 0 0 0 0 0 [ 486.109616][T16855] Node 1 Normal free:3904088kB boost:0kB min:55592kB low:69488kB high:83384kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:196kB unevictable:1536kB writepending:4kB zspages:0kB present:4194300kB managed:4111100kB mlocked:0kB bounce:0kB free_pcp:11040kB local_pcp:7808kB free_cma:0kB [ 486.223804][T16867] syzkaller0: entered promiscuous mode [ 486.293222][T16867] syzkaller0: entered allmulticast mode [ 486.307431][T16855] lowmem_reserve[]: 0 0 0 0 0 [ 486.341677][T16855] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 486.429131][T16855] Node 0 DMA32: 848*4kB (UME) 158*8kB (UME) 188*16kB (UME) 187*32kB (UME) 86*64kB (UME) 54*128kB (UM) 24*256kB (ME) 12*512kB (M) 10*1024kB (UM) 6*2048kB (UM) 232*4096kB (UM) = 1011152kB [ 486.559171][T16894] Cannot find add_set index 0 as target [ 486.565447][T16855] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 486.647767][T16855] Node 1 Normal: 212*4kB (UME) 53*8kB (UME) 42*16kB (UME) 206*32kB (UME) 42*64kB (UME) 13*128kB (UME) 4*256kB (UME) 4*512kB (UME) 1*1024kB (M) 2*2048kB (UE) 948*4096kB (M) = 3904088kB [ 486.740633][T16855] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 486.826128][T16855] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 486.877095][T16855] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 486.952984][T16855] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 487.015702][T16855] 45478 total pagecache pages [ 487.049190][T16855] 0 pages in swap cache [ 487.073586][T16855] Free swap = 124996kB [ 487.098467][T16855] Total swap = 124996kB [ 487.130235][T16855] 2097051 pages RAM [ 487.156890][T16855] 0 pages HighMem/MovableOnly [ 487.184807][T16855] 424131 pages reserved [ 487.220881][T16855] 0 pages cma reserved [ 487.330755][T16408] Bluetooth: hci7: command tx timeout [ 487.429253][T16902] netlink: 'syz.1.2911': attribute type 4 has an invalid length. [ 487.462907][T16905] netlink: 'syz.2.2912': attribute type 83 has an invalid length. [ 487.482582][T16902] veth1_to_hsr: entered allmulticast mode [ 487.875813][T16917] x_tables: ip6_tables: CLASSIFY target: used from hooks PREROUTING, but only usable from FORWARD/OUTPUT/POSTROUTING [ 488.170160][ C1] net_ratelimit: 7132 callbacks suppressed [ 488.170182][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 488.189042][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:42:07:7f:89:ef:05, vlan:0) [ 488.202719][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:42:07:7f:89:ef:05, vlan:0) [ 488.215593][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:42:07:7f:89:ef:05, vlan:0) [ 488.228788][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 488.241379][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 488.253919][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 488.266510][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 488.279117][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 488.292183][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 488.515708][T16936] nbd: must specify at least one socket [ 488.537032][T16936] netlink: 20 bytes leftover after parsing attributes in process `syz.1.2918'. [ 488.722746][T16941] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2920'. [ 489.405500][T16408] Bluetooth: hci7: command tx timeout [ 491.484057][T16408] Bluetooth: hci7: command tx timeout [ 492.416899][T16941] bridge_slave_1: left allmulticast mode [ 492.425179][T16941] bridge_slave_1: left promiscuous mode [ 492.431346][T16941] bridge0: port 2(bridge_slave_1) entered disabled state [ 492.484370][T16941] bridge_slave_0: left allmulticast mode [ 492.491184][T16941] bridge_slave_0: left promiscuous mode [ 492.498863][T16941] bridge0: port 1(bridge_slave_0) entered disabled state [ 493.060511][T16923] ªªªªª speed is unknown, defaulting to 1000 [ 493.180231][ C1] net_ratelimit: 8593 callbacks suppressed [ 493.180250][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 493.199185][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 493.212267][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:42:07:7f:89:ef:05, vlan:0) [ 493.225848][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:42:07:7f:89:ef:05, vlan:0) [ 493.238452][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:42:07:7f:89:ef:05, vlan:0) [ 493.251524][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 493.264046][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 493.267649][T16951] netlink: 68 bytes leftover after parsing attributes in process `syz.2.2922'. [ 493.276538][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 493.297888][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 493.310459][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 493.369911][T16949] netlink: 'syz.2.2922': attribute type 4 has an invalid length. [ 493.574342][T16408] Bluetooth: hci7: command tx timeout [ 493.755739][T16955] ªªªªª speed is unknown, defaulting to 1000 [ 493.794856][T16962] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2925'. [ 493.810337][T16875] chnl_net:caif_netlink_parms(): no params data found [ 494.126982][T16962] 8021q: adding VLAN 0 to HW filter on device bond1 [ 494.327141][T16967] bond8: option ad_actor_sys_prio: mode dependency failed, not supported in mode broadcast(3) [ 494.482806][T16967] bond8 (unregistering): Released all slaves [ 494.581067][T16970] netlink: 280 bytes leftover after parsing attributes in process `syz.2.2928'. [ 494.851345][T16973] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2929'. [ 495.053705][T16973] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2929'. [ 495.107514][ T1151] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 495.400892][T16983] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2931'. [ 495.441259][T16983] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2931'. [ 495.470124][ T1151] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 495.504110][ T1151] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 495.544998][T16875] bridge0: port 1(bridge_slave_0) entered blocking state [ 495.585327][T16875] bridge0: port 1(bridge_slave_0) entered disabled state [ 495.621720][T16875] bridge_slave_0: entered allmulticast mode [ 495.666924][T16875] bridge_slave_0: entered promiscuous mode [ 495.713238][ T1151] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 495.751435][T16875] bridge0: port 2(bridge_slave_1) entered blocking state [ 495.758750][T16875] bridge0: port 2(bridge_slave_1) entered disabled state [ 495.806707][T16875] bridge_slave_1: entered allmulticast mode [ 495.843919][T16875] bridge_slave_1: entered promiscuous mode [ 496.305009][T16875] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 496.392261][T16875] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 496.862609][T17017] netlink: 4 bytes leftover after parsing attributes in process `syz.6.2940'. [ 497.004829][T17021] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2941'. [ 497.075278][T17022] netlink: 'syz.4.2941': attribute type 13 has an invalid length. [ 498.190038][ C1] net_ratelimit: 7778 callbacks suppressed [ 498.190059][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 498.208403][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 498.221397][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:42:07:7f:89:ef:05, vlan:0) [ 498.234787][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:42:07:7f:89:ef:05, vlan:0) [ 498.247073][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:42:07:7f:89:ef:05, vlan:0) [ 498.259593][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 498.271831][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 498.284075][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 498.296505][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 498.308798][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 498.353613][T16875] team0: Port device team_slave_0 added [ 498.390721][T17017] netlink: 4 bytes leftover after parsing attributes in process `syz.6.2940'. [ 498.634543][T16875] team0: Port device team_slave_1 added [ 498.650056][T17029] netlink: 65039 bytes leftover after parsing attributes in process `syz.2.2942'. [ 499.030760][T17039] netlink: 'syz.2.2945': attribute type 1 has an invalid length. [ 499.140686][T16875] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 499.147681][T16875] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 499.295103][T16875] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 499.334740][T17046] netlink: 32 bytes leftover after parsing attributes in process `syz.4.2947'. [ 499.470342][T16875] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 499.509614][T16875] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 499.629880][T16875] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 500.121879][T16875] hsr_slave_0: entered promiscuous mode [ 500.161607][T16875] hsr_slave_1: entered promiscuous mode [ 500.191173][T16875] debugfs: 'hsr0' already exists in 'hsr' [ 500.223824][T16875] Cannot create hsr debugfs directory [ 500.672823][T17057] ªªªªª speed is unknown, defaulting to 1000 [ 501.517352][T17076] ªªªªª speed is unknown, defaulting to 1000 [ 501.565559][ T1299] ieee802154 phy0 wpan0: encryption failed: -22 [ 501.572383][ T1299] ieee802154 phy1 wpan1: encryption failed: -22 [ 502.477760][T16875] netdevsim netdevsim3 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 502.734876][T16875] netdevsim netdevsim3 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 502.939780][T17095] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2959'. [ 503.003800][ T52] Bluetooth: hci7: command 0x0405 tx timeout [ 503.059095][T16875] netdevsim netdevsim3 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 503.200224][ C1] net_ratelimit: 7576 callbacks suppressed [ 503.200247][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 503.218641][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:42:07:7f:89:ef:05, vlan:0) [ 503.231642][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:42:07:7f:89:ef:05, vlan:0) [ 503.243969][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:42:07:7f:89:ef:05, vlan:0) [ 503.259169][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 503.271436][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 503.283978][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 503.296463][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 503.308984][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 503.321647][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 503.736271][T17108] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2963'. [ 503.888298][T17110] FAULT_INJECTION: forcing a failure. [ 503.888298][T17110] name failslab, interval 1, probability 0, space 0, times 0 [ 503.916363][T17110] CPU: 0 UID: 0 PID: 17110 Comm: syz.2.2964 Not tainted syzkaller #0 PREEMPT(full) [ 503.916393][T17110] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 503.916406][T17110] Call Trace: [ 503.916414][T17110] [ 503.916423][T17110] dump_stack_lvl+0x189/0x250 [ 503.916456][T17110] ? __pfx____ratelimit+0x10/0x10 [ 503.916495][T17110] ? __pfx_dump_stack_lvl+0x10/0x10 [ 503.916520][T17110] ? __pfx__printk+0x10/0x10 [ 503.916550][T17110] ? __pfx___might_resched+0x10/0x10 [ 503.916570][T17110] ? fs_reclaim_acquire+0x7d/0x100 [ 503.916595][T17110] should_fail_ex+0x414/0x560 [ 503.916632][T17110] should_failslab+0xa8/0x100 [ 503.916654][T17110] __kvmalloc_node_noprof+0x158/0x910 [ 503.916684][T17110] ? __nf_hook_entries_try_shrink+0x31b/0x6f0 [ 503.916717][T17110] __nf_hook_entries_try_shrink+0x31b/0x6f0 [ 503.916756][T17110] __nf_unregister_net_hook+0x4f6/0x700 [ 503.916792][T17110] nf_unregister_net_hooks+0xcb/0x140 [ 503.916819][T17110] nf_ct_netns_put+0x36d/0x520 [ 503.916840][T17110] ? __pfx_nft_masq_ipv6_destroy+0x10/0x10 [ 503.916867][T17110] nf_tables_abort+0x7a51/0x8640 [ 503.916916][T17110] ? nf_tables_newrule+0x23c1/0x28a0 [ 503.916950][T17110] ? __pfx_nf_tables_abort+0x10/0x10 [ 503.917017][T17110] nfnetlink_rcv+0x1d18/0x2590 [ 503.917094][T17110] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 503.917145][T17110] ? ref_tracker_free+0x63a/0x7d0 [ 503.917204][T17110] ? __netlink_deliver_tap+0x807/0x850 [ 503.917225][T17110] ? netlink_deliver_tap+0x2e/0x1b0 [ 503.917270][T17110] netlink_unicast+0x82f/0x9e0 [ 503.917311][T17110] ? __pfx_netlink_unicast+0x10/0x10 [ 503.917349][T17110] ? netlink_sendmsg+0x642/0xb30 [ 503.917368][T17110] ? skb_put+0x11b/0x210 [ 503.917393][T17110] netlink_sendmsg+0x805/0xb30 [ 503.917428][T17110] ? __pfx_netlink_sendmsg+0x10/0x10 [ 503.917454][T17110] ? aa_sock_msg_perm+0xf1/0x1d0 [ 503.917494][T17110] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 503.917513][T17110] ? __pfx_netlink_sendmsg+0x10/0x10 [ 503.917536][T17110] __sock_sendmsg+0x21c/0x270 [ 503.917569][T17110] ____sys_sendmsg+0x505/0x830 [ 503.917600][T17110] ? __pfx_____sys_sendmsg+0x10/0x10 [ 503.917635][T17110] ? import_iovec+0x74/0xa0 [ 503.917666][T17110] ___sys_sendmsg+0x21f/0x2a0 [ 503.917691][T17110] ? __pfx____sys_sendmsg+0x10/0x10 [ 503.917763][T17110] ? __fget_files+0x2a/0x420 [ 503.917781][T17110] ? __fget_files+0x3a0/0x420 [ 503.917813][T17110] __x64_sys_sendmsg+0x19b/0x260 [ 503.917839][T17110] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 503.917874][T17110] ? __pfx_ksys_write+0x10/0x10 [ 503.917907][T17110] ? do_syscall_64+0xbe/0xfa0 [ 503.917930][T17110] do_syscall_64+0xfa/0xfa0 [ 503.917945][T17110] ? lockdep_hardirqs_on+0x9c/0x150 [ 503.917963][T17110] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 503.917981][T17110] ? clear_bhb_loop+0x60/0xb0 [ 503.918005][T17110] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 503.918023][T17110] RIP: 0033:0x7f2b3e38f6c9 [ 503.918043][T17110] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 503.918058][T17110] RSP: 002b:00007f2b3f195038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 503.918081][T17110] RAX: ffffffffffffffda RBX: 00007f2b3e5e5fa0 RCX: 00007f2b3e38f6c9 [ 503.918095][T17110] RDX: 0000000024000840 RSI: 0000200000009b40 RDI: 0000000000000003 [ 503.918107][T17110] RBP: 00007f2b3f195090 R08: 0000000000000000 R09: 0000000000000000 [ 503.918119][T17110] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 503.918131][T17110] R13: 00007f2b3e5e6038 R14: 00007f2b3e5e5fa0 R15: 00007ffe22148538 [ 503.918169][T17110] [ 504.382298][T17112] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2965'. [ 504.394113][T16875] netdevsim netdevsim3 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 504.467555][T17112] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2965'. [ 504.557011][T17116] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2966'. [ 504.575701][T17115] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2966'. [ 504.991240][T17102] ªªªªª speed is unknown, defaulting to 1000 [ 505.064643][T17127] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2968'. [ 505.678069][T17138] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2968'. [ 505.753863][T17140] netlink: 48 bytes leftover after parsing attributes in process `syz.1.2961'. [ 506.103721][T17120] ªªªªª speed is unknown, defaulting to 1000 [ 506.166957][T17127] `: left allmulticast mode [ 506.229848][T17127] geneve0: left allmulticast mode [ 506.286520][T17127] bridge4: left allmulticast mode [ 506.328267][T17127] `: left promiscuous mode [ 506.346537][T17127] geneve0: left promiscuous mode [ 506.382959][T17127] bridge4: left promiscuous mode [ 506.402297][T17127] bridge0: port 1(`) entered disabled state [ 507.312255][T16875] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 507.436830][T16875] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 507.567643][T16875] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 507.718539][T16875] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 508.209976][ C1] net_ratelimit: 7620 callbacks suppressed [ 508.210000][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 508.228305][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 508.240625][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 508.253320][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 508.266127][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:42:07:7f:89:ef:05, vlan:0) [ 508.280555][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:42:07:7f:89:ef:05, vlan:0) [ 508.292922][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:42:07:7f:89:ef:05, vlan:0) [ 508.305553][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 508.317806][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 508.330153][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 508.887785][T17176] FAULT_INJECTION: forcing a failure. [ 508.887785][T17176] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 508.904365][T17176] CPU: 0 UID: 0 PID: 17176 Comm: syz.6.2977 Not tainted syzkaller #0 PREEMPT(full) [ 508.904396][T17176] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 508.904407][T17176] Call Trace: [ 508.904415][T17176] [ 508.904424][T17176] dump_stack_lvl+0x189/0x250 [ 508.904457][T17176] ? __pfx____ratelimit+0x10/0x10 [ 508.904486][T17176] ? __pfx_dump_stack_lvl+0x10/0x10 [ 508.904512][T17176] ? __pfx__printk+0x10/0x10 [ 508.904550][T17176] should_fail_ex+0x414/0x560 [ 508.904587][T17176] _copy_from_user+0x2d/0xb0 [ 508.904613][T17176] copy_from_sockptr+0x5e/0xa0 [ 508.904636][T17176] do_ipv6_setsockopt+0x1741/0x2eb0 [ 508.904669][T17176] ? __pfx_do_ipv6_setsockopt+0x10/0x10 [ 508.904694][T17176] ? __pfx_aa_label_sk_perm+0x10/0x10 [ 508.904737][T17176] ? vfs_write+0x956/0xb30 [ 508.904770][T17176] ? __pfx___might_resched+0x10/0x10 [ 508.904800][T17176] ? __lock_acquire+0xab9/0xd20 [ 508.904829][T17176] ? aa_sk_perm+0x81e/0x950 [ 508.904862][T17176] ? __pfx_aa_sk_perm+0x10/0x10 [ 508.904890][T17176] ? aa_sock_opt_perm+0xff/0x1b0 [ 508.904923][T17176] ipv6_setsockopt+0x59/0x170 [ 508.904941][T17176] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 508.904974][T17176] do_sock_setsockopt+0x17c/0x1b0 [ 508.905002][T17176] __x64_sys_setsockopt+0x13f/0x1b0 [ 508.905030][T17176] do_syscall_64+0xfa/0xfa0 [ 508.905048][T17176] ? lockdep_hardirqs_on+0x9c/0x150 [ 508.905067][T17176] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 508.905086][T17176] ? clear_bhb_loop+0x60/0xb0 [ 508.905122][T17176] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 508.905141][T17176] RIP: 0033:0x7f078d98f6c9 [ 508.905167][T17176] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 508.905184][T17176] RSP: 002b:00007f078e8df038 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 508.905206][T17176] RAX: ffffffffffffffda RBX: 00007f078dbe5fa0 RCX: 00007f078d98f6c9 [ 508.905220][T17176] RDX: 000000000000001c RSI: 0000000000000029 RDI: 0000000000000003 [ 508.905232][T17176] RBP: 00007f078e8df090 R08: 0000000000000014 R09: 0000000000000000 [ 508.905244][T17176] R10: 0000200000000040 R11: 0000000000000246 R12: 0000000000000001 [ 508.905256][T17176] R13: 00007f078dbe6038 R14: 00007f078dbe5fa0 R15: 00007fff91d0bea8 [ 508.905292][T17176] [ 509.289522][T16875] 8021q: adding VLAN 0 to HW filter on device bond0 [ 509.313124][T16875] 8021q: adding VLAN 0 to HW filter on device team0 [ 509.361085][T16875] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 509.371512][T16875] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 509.416354][ T1151] bridge0: port 1(bridge_slave_0) entered blocking state [ 509.423613][ T1151] bridge0: port 1(bridge_slave_0) entered forwarding state [ 509.471770][ T1151] bridge0: port 2(bridge_slave_1) entered blocking state [ 509.479072][ T1151] bridge0: port 2(bridge_slave_1) entered forwarding state [ 509.994505][T16875] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 510.069523][T16875] veth0_vlan: entered promiscuous mode [ 510.087929][T16875] veth1_vlan: entered promiscuous mode [ 510.318333][T16875] veth0_macvtap: entered promiscuous mode [ 510.388784][T16875] veth1_macvtap: entered promiscuous mode [ 510.526851][T16875] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 510.683747][T16875] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 510.740563][ T61] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 510.749542][ T61] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 510.865614][ T61] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 510.933521][ T61] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 511.446376][ T3489] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 511.494652][ T3489] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 511.937669][T17204] 8021q: adding VLAN 0 to HW filter on device bond2 [ 512.032381][T17208] netdevsim netdevsim6 netdevsim0: refused to change device tx_queue_len [ 512.116110][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 512.133622][T17215] netlink: 'syz.1.2985': attribute type 1 has an invalid length. [ 512.171442][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 512.194151][T17215] netlink: 168 bytes leftover after parsing attributes in process `syz.1.2985'. [ 512.360962][T17218] netlink: 28 bytes leftover after parsing attributes in process `syz.6.2988'. [ 512.419178][T17218] netlink: 28 bytes leftover after parsing attributes in process `syz.6.2988'. [ 512.468042][T17218] netlink: 'syz.6.2988': attribute type 4 has an invalid length. [ 512.572319][T17218] netlink: 48 bytes leftover after parsing attributes in process `syz.6.2988'. [ 512.731353][T17221] tipc: Started in network mode [ 512.774281][T17221] tipc: Node identity 36c6b3977899, cluster identity 4711 [ 512.819658][T17221] tipc: Enabled bearer , priority 0 [ 512.854802][T17225] syzkaller0: entered promiscuous mode [ 512.901540][T17225] syzkaller0: entered allmulticast mode [ 512.985590][T17220] tipc: Resetting bearer [ 513.216829][T17229] netlink: 68 bytes leftover after parsing attributes in process `syz.4.2991'. [ 513.220812][ C1] net_ratelimit: 7378 callbacks suppressed [ 513.220830][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:42:07:7f:89:ef:05, vlan:0) [ 513.245562][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:42:07:7f:89:ef:05, vlan:0) [ 513.258199][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:42:07:7f:89:ef:05, vlan:0) [ 513.271315][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 513.271792][T17220] tipc: Disabling bearer [ 513.283868][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 513.302101][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 513.314742][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:42:07:7f:89:ef:05, vlan:0) [ 513.327243][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 513.340115][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 513.353247][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 513.423652][T17228] tc_dump_action: action bad kind [ 513.558224][T17234] netlink: 'syz.6.2993': attribute type 14 has an invalid length. [ 513.891951][ T52] Bluetooth: hci5: command 0x0405 tx timeout [ 514.267000][T17244] tipc: Failed to remove unknown binding: 66,1,1/149636428:4232833392/4232833394 [ 514.300825][T17244] tipc: Failed to remove unknown binding: 66,1,1/149636428:4232833392/4232833394 [ 514.357573][T17244] tipc: Failed to remove unknown binding: 66,1,1/149636428:4232833392/4232833394 [ 514.496596][ T52] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 514.507583][ T52] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 514.529715][ T52] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 514.540111][ T52] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 514.548114][ T52] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 514.590035][T17240] netlink: 'syz.3.2995': attribute type 1 has an invalid length. [ 514.613730][T17241] netlink: 'syz.3.2995': attribute type 1 has an invalid length. [ 514.987138][T17251] ªªªªª speed is unknown, defaulting to 1000 [ 515.169377][T17257] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2999'. [ 515.241725][T17257] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2999'. [ 515.291055][T17257] netlink: 156 bytes leftover after parsing attributes in process `syz.2.2999'. [ 515.581069][T17268] netlink: 20 bytes leftover after parsing attributes in process `syz.6.3001'. [ 515.866963][T17261] team0: Port device team_slave_0 removed [ 516.602704][ T52] Bluetooth: hci3: command tx timeout [ 517.155947][T17277] syzkaller0: entered allmulticast mode [ 517.967879][T17319] netlink: 48 bytes leftover after parsing attributes in process `syz.4.3010'. [ 518.230165][ C1] net_ratelimit: 6777 callbacks suppressed [ 518.230190][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:42:07:7f:89:ef:05, vlan:0) [ 518.249187][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 518.262526][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 518.275184][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 518.287790][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:42:07:7f:89:ef:05, vlan:0) [ 518.300451][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 518.313067][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 518.326095][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 518.338669][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 518.351795][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 518.680065][ T52] Bluetooth: hci3: command tx timeout [ 520.773626][ T52] Bluetooth: hci3: command tx timeout [ 522.840169][ T52] Bluetooth: hci3: command tx timeout [ 523.241559][ C1] net_ratelimit: 8959 callbacks suppressed [ 523.241583][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:42:07:7f:89:ef:05, vlan:0) [ 523.260233][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:42:07:7f:89:ef:05, vlan:0) [ 523.272847][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 523.285089][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 523.297383][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 523.310317][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:42:07:7f:89:ef:05, vlan:0) [ 523.322646][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 523.335462][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 523.348149][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 523.360472][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 524.634315][T17349] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3014'. [ 526.787560][T17302] syzkaller0: default qdisc (pfifo_fast) fail, fallback to noqueue [ 526.819759][T17302] syzkaller0: entered promiscuous mode [ 526.825724][T17302] syzkaller0: entered allmulticast mode [ 526.930431][T17316] syzkaller0: entered promiscuous mode [ 526.936679][T17316] syzkaller0: entered allmulticast mode [ 528.250040][ C1] net_ratelimit: 9734 callbacks suppressed [ 528.250062][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:42:07:7f:89:ef:05, vlan:0) [ 528.268643][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 528.280889][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 528.293893][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 528.306205][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 528.318476][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 528.330816][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 528.343362][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 528.356080][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 528.368752][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 531.019640][T17344] syzkaller0: entered promiscuous mode [ 531.026286][T17344] syzkaller0: entered allmulticast mode [ 531.398398][T17338] ªªªªª speed is unknown, defaulting to 1000 [ 532.154883][T17372] netlink: 20 bytes leftover after parsing attributes in process `syz.4.3018'. [ 532.267274][T17374] netlink: 48 bytes leftover after parsing attributes in process `syz.4.3018'. [ 532.588170][ T1335] bond1 (unregistering): (slave ip6erspan0): Releasing active interface [ 532.763222][ T1335] bond2 (unregistering): (slave ip6gretap1): Releasing active interface [ 532.784239][ T1335] bond2 (unregistering): (slave ip6gretap1): the permanent HWaddr of slave - 2e:da:bd:bb:94:95 - is still in use by bond - set the HWaddr of slave to a different address to avoid conflicts [ 532.854114][ T1335] bond2 (unregistering): (slave erspan0): making interface the new active one [ 532.926321][ T31] INFO: task syz.5.2275:14492 blocked for more than 143 seconds. [ 532.953709][ T31] Not tainted syzkaller #0 SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 532.984783][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 533.011842][ T31] task:syz.5.2275 state:D stack:26984 pid:14492 tgid:14489 ppid:13661 task_flags:0x400140 flags:0x00080002 [ 533.077545][ T31] Call Trace: [ 533.102604][ T31] [ 533.111634][ T31] __schedule+0x1798/0x4cc0 [ 533.130703][ T31] ? __lock_acquire+0xab9/0xd20 [ 533.225149][ T31] ? __pfx___schedule+0x10/0x10 [ 533.260308][ C1] net_ratelimit: 7958 callbacks suppressed [ 533.260333][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:42:07:7f:89:ef:05, vlan:0) [ 533.270087][ T31] ? schedule+0x91/0x360 [ 533.278651][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 533.295659][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 533.308611][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 533.321415][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 533.334139][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 533.346775][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 533.359489][ C1] bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 533.372551][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 533.386068][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 533.390245][ T31] schedule+0x165/0x360 [ 533.454768][ T31] schedule_preempt_disabled+0x13/0x30 [ 533.469996][ T31] __mutex_lock+0x7e6/0x1350 [ 533.474680][ T31] ? __mutex_lock+0x5bb/0x1350 [ 533.479681][ T31] ? nfsd_nl_listener_set_doit+0x137/0x1690 [ 533.510309][ T31] ? __pfx___mutex_lock+0x10/0x10 [ 533.515409][ T31] ? __asan_memset+0x22/0x50 [ 533.532631][ T31] ? __x64_sys_sendmsg+0x19b/0x260 [ 533.537914][ T31] ? do_syscall_64+0xfa/0xfa0 [ 533.554015][ T31] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 533.570074][ T31] nfsd_nl_listener_set_doit+0x137/0x1690 [ 533.575967][ T31] ? __pfx___nla_validate_parse+0x10/0x10 [ 533.588354][ T31] ? __pfx_nfsd_nl_listener_set_doit+0x10/0x10 [ 533.594944][ T31] ? rcu_is_watching+0x15/0xb0 [ 533.599765][ T31] ? __nla_parse+0x40/0x60 [ 533.604392][ T31] ? genl_family_rcv_msg_attrs_parse+0x1c9/0x2a0 [ 533.610968][ T31] genl_family_rcv_msg_doit+0x215/0x300 [ 533.616686][ T31] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 533.623396][ T31] ? bpf_lsm_capable+0x9/0x20 [ 533.628124][ T31] ? security_capable+0x7e/0x2e0 [ 533.633740][ T31] genl_rcv_msg+0x60e/0x790 [ 533.638559][ T31] ? __pfx_genl_rcv_msg+0x10/0x10 [ 533.647968][ T31] ? __pfx_nfsd_nl_listener_set_doit+0x10/0x10 [ 533.654312][ T31] ? __asan_memcpy+0x40/0x70 [ 533.658948][ T31] ? __pfx_ref_tracker_free+0x10/0x10 [ 533.671050][ T31] netlink_rcv_skb+0x208/0x470 [ 533.675890][ T31] ? __lock_acquire+0xab9/0xd20 [ 533.681071][ T31] ? __pfx_genl_rcv_msg+0x10/0x10 [ 533.686160][ T31] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 533.691740][ T31] ? down_read+0x1ad/0x2e0 [ 533.697070][ T31] genl_rcv+0x28/0x40 [ 533.701396][ T31] netlink_unicast+0x82f/0x9e0 [ 533.706310][ T31] ? __pfx_netlink_unicast+0x10/0x10 [ 533.711755][ T31] ? netlink_sendmsg+0x642/0xb30 [ 533.716725][ T31] ? skb_put+0x11b/0x210 [ 533.723101][ T31] netlink_sendmsg+0x805/0xb30 [ 533.727927][ T31] ? __pfx_netlink_sendmsg+0x10/0x10 [ 533.733615][ T31] ? aa_sock_msg_perm+0xf1/0x1d0 [ 533.738603][ T31] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 533.744681][ T31] ? __pfx_netlink_sendmsg+0x10/0x10 [ 533.752682][ T31] __sock_sendmsg+0x21c/0x270 [ 533.757427][ T31] ____sys_sendmsg+0x505/0x830 [ 533.762276][ T31] ? __pfx_____sys_sendmsg+0x10/0x10 [ 533.770287][ T31] ? import_iovec+0x74/0xa0 [ 533.774854][ T31] ___sys_sendmsg+0x21f/0x2a0 [ 533.779587][ T31] ? __pfx____sys_sendmsg+0x10/0x10 [ 533.795965][ T31] ? __fget_files+0x2a/0x420 [ 533.804253][ T31] ? __fget_files+0x3a0/0x420 [ 533.809029][ T31] __x64_sys_sendmsg+0x19b/0x260 [ 533.814104][ T31] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 533.819625][ T31] ? do_syscall_64+0xbe/0xfa0 [ 533.824617][ T31] do_syscall_64+0xfa/0xfa0 [ 533.829246][ T31] ? lockdep_hardirqs_on+0x9c/0x150 [ 533.834563][ T31] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 533.841112][ T31] ? clear_bhb_loop+0x60/0xb0 [ 533.845860][ T31] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 533.852335][ T31] RIP: 0033:0x7f748c98f6c9 [ 533.856786][ T31] RSP: 002b:00007f748d751038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 533.870503][ T31] RAX: ffffffffffffffda RBX: 00007f748cbe5fa0 RCX: 00007f748c98f6c9 [ 533.879672][ T31] RDX: 0000000020048000 RSI: 0000200000000000 RDI: 0000000000000003 [ 533.890082][ T31] RBP: 00007f748ca11f91 R08: 0000000000000000 R09: 0000000000000000 [ 533.898627][ T31] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 533.913277][ T31] R13: 00007f748cbe6038 R14: 00007f748cbe5fa0 R15: 00007ffeff907d08 [ 533.921397][ T31] [ 533.931690][ T31] [ 533.931690][ T31] Showing all locks held in the system: [ 533.939466][ T31] 1 lock held by khungtaskd/31: [ 534.043699][ T31] #0: ffffffff8df3d660 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 [ 534.080073][ T31] 3 locks held by kworker/u8:3/50: [ 534.085332][ T31] #0: ffff88801a069948 ((wq_completion)events_unbound#2){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x17b0 [ 534.140211][ T31] #1: ffffc90000bb7ba0 ((linkwatch_work).work){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x17b0 [ 534.170066][ T31] #2: ffffffff8f2cc008 (rtnl_mutex){+.+.}-{4:4}, at: linkwatch_event+0xe/0x60 [ 534.181647][ T31] 5 locks held by kworker/u8:7/1335: [ 534.186970][ T31] #0: ffff88801aedf148 ((wq_completion)netns){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x17b0 [ 534.220372][ T31] #1: ffffc900041afba0 (net_cleanup_work){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x17b0 [ 534.260198][ T31] #2: ffffffff8f2bf070 (pernet_ops_rwsem){++++}-{4:4}, at: cleanup_net+0xf7/0x820 [ 534.269716][ T31] #3: ffffffff8f2cc008 (rtnl_mutex){+.+.}-{4:4}, at: ops_undo_list+0x2a4/0x990 [ 534.301147][ T31] #4: ffffffff8df430f8 (rcu_state.exp_mutex){+.+.}-{4:4}, at: synchronize_rcu_expedited+0x3b9/0x730 [ 534.330058][ T31] 2 locks held by getty/5586: [ 534.334800][ T31] #0: ffff888033a900a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 [ 534.370033][ T31] #1: ffffc900036bb2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x43e/0x1400 [ 534.390087][ T31] 3 locks held by kworker/0:11/7145: [ 534.395430][ T31] #0: ffff88801a055948 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x17b0 [ 534.430004][ T31] #1: ffffc9000473fba0 (free_ipc_work){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x17b0 [ 534.450015][ T31] #2: ffffffff8df430f8 (rcu_state.exp_mutex){+.+.}-{4:4}, at: synchronize_rcu_expedited+0x3b9/0x730 [ 534.480076][ T31] 5 locks held by kworker/1:8/7147: [ 534.510011][ T31] 2 locks held by kworker/1:9/7148: [ 534.515448][ T31] 2 locks held by syz.0.1852/13027: [ 534.550039][ T31] #0: ffffffff8f331f70 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 [ 534.558409][ T31] #1: ffffffff8e226ee8 (nfsd_mutex){+.+.}-{4:4}, at: nfsd_nl_listener_set_doit+0x137/0x1690 [ 534.613569][ T31] 2 locks held by syz.5.2275/14492: [ 534.618822][ T31] #0: ffffffff8f331f70 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 [ 534.640306][ T31] #1: ffffffff8e226ee8 (nfsd_mutex){+.+.}-{4:4}, at: nfsd_nl_listener_set_doit+0x137/0x1690 [ 534.650637][ T31] 1 lock held by khidpd_16bf5505/15722: [ 534.656206][ T31] #0: ffff8880512a40b8 (&hdev->lock){+.+.}-{4:4}, at: l2cap_unregister_user+0x6a/0x1b0 [ 534.666332][ T31] 1 lock held by syz-executor/17251: [ 534.672363][ T31] #0: ffffffff8f2cc008 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0x8e9/0x1c80 [ 534.682630][ T31] 2 locks held by syz.3.3011/17338: [ 534.690479][ T31] #0: ffffffff8f2bf070 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x337/0x4e0 [ 534.707118][ T31] #1: ffffffff8f2cc008 (rtnl_mutex){+.+.}-{4:4}, at: ops_undo_list+0x2a4/0x990 [ 534.716721][ T31] 1 lock held by syz.4.3018/17372: [ 534.721998][ T31] #0: ffffffff8f2cc008 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_dellink+0x346/0x700 [ 534.731284][ T31] 1 lock held by syz.4.3018/17374: [ 534.736508][ T31] #0: ffffffff8f2cc008 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0x8e9/0x1c80 [ 534.745891][ T31] 6 locks held by syz.6.3021/17381: [ 534.751398][ T31] #0: ffff8880512a4dc8 (&hdev->req_lock){+.+.}-{4:4}, at: hci_unregister_dev+0x212/0x510 [ 534.763572][ T31] #1: ffff8880512a40b8 (&hdev->lock){+.+.}-{4:4}, at: hci_dev_close_sync+0x66a/0x1330 [ 534.773391][ T31] #2: ffffffff8f435fe8 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_conn_hash_flush+0xa1/0x230 [ 534.783788][ T31] #3: ffff888027ac3b38 (&conn->lock#2){+.+.}-{4:4}, at: l2cap_conn_del+0x70/0x680 [ 534.795967][ T31] #4: ffffffff8f45f6d0 (hidp_session_sem){++++}-{4:4}, at: hidp_session_remove+0x2c/0x260 [ 534.806755][ T31] #5: ffffffff8ed59c08 (input_mutex){+.+.}-{4:4}, at: __input_unregister_device+0x328/0x640 [ 534.832378][ T31] [ 534.834774][ T31] ============================================= [ 534.834774][ T31] [ 534.849102][ T31] NMI backtrace for cpu 0 [ 534.849128][ T31] CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) [ 534.849152][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 534.849163][ T31] Call Trace: [ 534.849171][ T31] [ 534.849182][ T31] dump_stack_lvl+0x189/0x250 [ 534.849217][ T31] ? __pfx_dump_stack_lvl+0x10/0x10 [ 534.849243][ T31] ? __pfx__printk+0x10/0x10 [ 534.849279][ T31] nmi_cpu_backtrace+0x39e/0x3d0 [ 534.849308][ T31] ? __pfx_nmi_cpu_backtrace+0x10/0x10 [ 534.849336][ T31] ? __pfx__printk+0x10/0x10 [ 534.849362][ T31] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 534.849394][ T31] nmi_trigger_cpumask_backtrace+0x17a/0x300 [ 534.849423][ T31] watchdog+0xf60/0xfa0 [ 534.849449][ T31] ? watchdog+0x1e2/0xfa0 [ 534.849476][ T31] kthread+0x711/0x8a0 [ 534.849506][ T31] ? __pfx_watchdog+0x10/0x10 [ 534.849524][ T31] ? __pfx_kthread+0x10/0x10 [ 534.849551][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 534.849579][ T31] ? lockdep_hardirqs_on+0x9c/0x150 [ 534.849605][ T31] ? __pfx_kthread+0x10/0x10 [ 534.849632][ T31] ret_from_fork+0x4bc/0x870 [ 534.849656][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 534.849685][ T31] ? __switch_to_asm+0x39/0x70 [ 534.849701][ T31] ? __switch_to_asm+0x33/0x70 [ 534.849715][ T31] ? __pfx_kthread+0x10/0x10 [ 534.849741][ T31] ret_from_fork_asm+0x1a/0x30 [ 534.849778][ T31] [ 534.849786][ T31] Sending NMI from CPU 0 to CPUs 1: [ 535.001201][ C1] NMI backtrace for cpu 1 [ 535.001221][ C1] CPU: 1 UID: 0 PID: 7147 Comm: kworker/1:8 Not tainted syzkaller #0 PREEMPT(full) [ 535.001240][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 535.001249][ C1] Workqueue: events_power_efficient neigh_periodic_work [ 535.001279][ C1] RIP: 0010:lock_release+0x44/0x3e0 [ 535.001298][ C1] Code: 8b 05 d0 1c d1 10 48 89 44 24 28 0f 1f 44 00 00 65 8b 05 d3 1c d1 10 83 f8 08 0f 83 9a 02 00 00 89 c0 48 0f a3 05 fc 93 df 0d <73> 16 e8 d5 ec 08 00 84 c0 75 0d f6 05 88 9f c9 0d 01 0f 84 ad 02 [ 535.001311][ C1] RSP: 0018:ffffc90000a077f0 EFLAGS: 00000297 [ 535.001324][ C1] RAX: 0000000000000001 RBX: ffffffff908f8c01 RCX: 671edebb2e09de00 [ 535.001335][ C1] RDX: ffffc90000a07901 RSI: ffffffff81738d25 RDI: ffffffff8df3d660 [ 535.001347][ C1] RBP: dffffc0000000000 R08: ffffc90000a08ed0 R09: 0000000000000000 [ 535.001357][ C1] R10: ffffc90000a07978 R11: fffff52000140f31 R12: ffffc90000a08ee0 [ 535.001368][ C1] R13: ffffffff81738d25 R14: ffffffff8df3d660 R15: ffffffff81738d25 [ 535.001379][ C1] FS: 0000000000000000(0000) GS:ffff888126238000(0000) knlGS:0000000000000000 [ 535.001391][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 535.001402][ C1] CR2: 00007f078e8bed58 CR3: 000000000dd38000 CR4: 00000000003526f0 [ 535.001417][ C1] Call Trace: [ 535.001424][ C1] [ 535.001432][ C1] ? deref_stack_reg+0x19f/0x230 [ 535.001453][ C1] ? unwind_next_frame+0xa5/0x2390 [ 535.001469][ C1] unwind_next_frame+0x19a9/0x2390 [ 535.001489][ C1] ? unwind_next_frame+0xa5/0x2390 [ 535.001506][ C1] ? net_rx_action+0x672/0xe50 [ 535.001523][ C1] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 535.001542][ C1] arch_stack_walk+0x11c/0x150 [ 535.001562][ C1] ? handle_softirqs+0x286/0x870 [ 535.001581][ C1] stack_trace_save+0x9c/0xe0 [ 535.001599][ C1] ? __pfx_stack_trace_save+0x10/0x10 [ 535.001615][ C1] ? __bpf_ringbuf_reserve+0x803/0xae0 [ 535.001641][ C1] ? __lock_acquire+0xab9/0xd20 [ 535.001655][ C1] kasan_save_track+0x3e/0x80 [ 535.001675][ C1] ? kasan_save_track+0x3e/0x80 [ 535.001693][ C1] ? __kasan_save_free_info+0x46/0x50 [ 535.001709][ C1] ? __kasan_slab_free+0x5c/0x80 [ 535.001727][ C1] ? kmem_cache_free+0x19b/0x690 [ 535.001746][ C1] ? skb_release_head_state+0x270/0x360 [ 535.001761][ C1] ? sk_skb_reason_drop+0xe9/0x170 [ 535.001775][ C1] ? ip6_mc_input+0x8de/0xb70 [ 535.001790][ C1] ? ip_sabotage_in+0x1e1/0x270 [ 535.001809][ C1] ? nf_hook_slow+0xc5/0x220 [ 535.001825][ C1] ? NF_HOOK+0x206/0x3a0 [ 535.001837][ C1] ? __netif_receive_skb+0xd3/0x380 [ 535.001856][ C1] ? netif_receive_skb+0x1cb/0x790 [ 535.001874][ C1] ? NF_HOOK+0xa0/0x390 [ 535.001893][ C1] ? br_handle_frame_finish+0x15c6/0x1c90 [ 535.001912][ C1] ? br_nf_hook_thresh+0x3c6/0x4a0 [ 535.001938][ C1] ? br_nf_pre_routing_finish_ipv6+0x999/0xd60 [ 535.001952][ C1] ? br_nf_pre_routing_ipv6+0x37e/0x6b0 [ 535.001965][ C1] ? br_handle_frame+0x96e/0x14f0 [ 535.001983][ C1] ? __netif_receive_skb_core+0x96f/0x3060 [ 535.002003][ C1] ? __netif_receive_skb+0x72/0x380 [ 535.002021][ C1] ? process_backlog+0x622/0x1530 [ 535.002033][ C1] ? __napi_poll+0xae/0x320 [ 535.002051][ C1] ? net_rx_action+0x672/0xe50 [ 535.002081][ C1] ? skb_release_head_state+0x270/0x360 [ 535.002097][ C1] __kasan_save_free_info+0x46/0x50 [ 535.002114][ C1] __kasan_slab_free+0x5c/0x80 [ 535.002134][ C1] kmem_cache_free+0x19b/0x690 [ 535.002154][ C1] ? __skb_ext_put+0x218/0x2e0 [ 535.002179][ C1] skb_release_head_state+0x270/0x360 [ 535.002197][ C1] sk_skb_reason_drop+0xe9/0x170 [ 535.002213][ C1] ip6_mc_input+0x8de/0xb70 [ 535.002231][ C1] ? __pfx_ip6_mc_input+0x10/0x10 [ 535.002249][ C1] ? ip6_rcv_finish+0x29e/0x2e0 [ 535.002264][ C1] ? __pfx_ip6_rcv_finish+0x10/0x10 [ 535.002278][ C1] ip_sabotage_in+0x1e1/0x270 [ 535.002297][ C1] ? __pfx_ip_sabotage_in+0x10/0x10 [ 535.002318][ C1] nf_hook_slow+0xc5/0x220 [ 535.002337][ C1] NF_HOOK+0x206/0x3a0 [ 535.002350][ C1] ? skb_orphan+0xaf/0xd0 [ 535.002365][ C1] ? __pfx_ip6_rcv_finish+0x10/0x10 [ 535.002379][ C1] ? NF_HOOK+0x9a/0x3a0 [ 535.002393][ C1] ? __pfx_NF_HOOK+0x10/0x10 [ 535.002408][ C1] ? __pfx_ip6_rcv_finish+0x10/0x10 [ 535.002429][ C1] __netif_receive_skb+0xd3/0x380 [ 535.002451][ C1] ? netif_receive_skb+0x115/0x790 [ 535.002469][ C1] netif_receive_skb+0x1cb/0x790 [ 535.002489][ C1] ? __pfx_netif_receive_skb+0x10/0x10 [ 535.002511][ C1] ? br_netif_receive_skb+0x126/0x190 [ 535.002533][ C1] NF_HOOK+0xa0/0x390 [ 535.002551][ C1] ? __pfx_br_netif_receive_skb+0x10/0x10 [ 535.002571][ C1] ? NF_HOOK+0x102/0x390 [ 535.002590][ C1] ? __pfx_NF_HOOK+0x10/0x10 [ 535.002611][ C1] ? __pfx_br_netif_receive_skb+0x10/0x10 [ 535.002634][ C1] ? br_pass_frame_up+0x275/0x420 [ 535.002655][ C1] br_handle_frame_finish+0x15c6/0x1c90 [ 535.002681][ C1] ? __pfx_br_handle_frame_finish+0x10/0x10 [ 535.002707][ C1] ? ip6t_do_table+0x1db/0x1560 [ 535.002725][ C1] ? nf_hook_slow+0x176/0x220 [ 535.002743][ C1] ? __pfx_br_handle_frame_finish+0x10/0x10 [ 535.002763][ C1] br_nf_hook_thresh+0x3c6/0x4a0 [ 535.002788][ C1] ? __pfx_br_nf_hook_thresh+0x10/0x10 [ 535.002809][ C1] ? __pfx_br_handle_frame_finish+0x10/0x10 [ 535.002828][ C1] ? nf_nat_ipv6_in+0x1fc/0x2b0 [ 535.002848][ C1] br_nf_pre_routing_finish_ipv6+0x999/0xd60 [ 535.002863][ C1] ? __pfx_br_handle_frame_finish+0x10/0x10 [ 535.002887][ C1] ? br_nf_pre_routing_ipv6+0x42f/0x6b0 [ 535.002902][ C1] br_nf_pre_routing_ipv6+0x37e/0x6b0 [ 535.002917][ C1] ? __pfx_br_nf_pre_routing_ipv6+0x10/0x10 [ 535.002942][ C1] ? __pfx_br_nf_pre_routing_finish_ipv6+0x10/0x10 [ 535.002956][ C1] ? br_nf_pre_routing+0x720/0x1470 [ 535.002980][ C1] ? __pfx_br_nf_pre_routing+0x10/0x10 [ 535.002999][ C1] br_handle_frame+0x96e/0x14f0 [ 535.003024][ C1] ? __pfx_br_handle_frame+0x10/0x10 [ 535.003046][ C1] ? __pfx_br_handle_frame_finish+0x10/0x10 [ 535.003071][ C1] ? __pfx_br_handle_frame+0x10/0x10 [ 535.003090][ C1] __netif_receive_skb_core+0x96f/0x3060 [ 535.003115][ C1] ? ip6_mc_input+0x8de/0xb70 [ 535.003134][ C1] ? __pfx_ip6_mc_input+0x10/0x10 [ 535.003151][ C1] ? __pfx___netif_receive_skb_core+0x10/0x10 [ 535.003171][ C1] ? ip6_rcv_finish+0x29e/0x2e0 [ 535.003187][ C1] ? NF_HOOK+0x30c/0x3a0 [ 535.003199][ C1] ? skb_orphan+0xaf/0xd0 [ 535.003215][ C1] ? __lock_acquire+0xab9/0xd20 [ 535.003233][ C1] ? process_backlog+0x2d9/0x1530 [ 535.003247][ C1] ? process_backlog+0x2d9/0x1530 [ 535.003263][ C1] __netif_receive_skb+0x72/0x380 [ 535.003284][ C1] ? process_backlog+0x2d9/0x1530 [ 535.003298][ C1] process_backlog+0x622/0x1530 [ 535.003320][ C1] ? __pfx_process_backlog+0x10/0x10 [ 535.003339][ C1] __napi_poll+0xae/0x320 [ 535.003357][ C1] ? skb_defer_free_flush+0x229/0x250 [ 535.003379][ C1] net_rx_action+0x672/0xe50 [ 535.003391][ C1] ? lockdep_hardirqs_on+0x9c/0x150 [ 535.003413][ C1] ? __pfx_net_rx_action+0x10/0x10 [ 535.003444][ C1] handle_softirqs+0x286/0x870 [ 535.003462][ C1] ? do_softirq+0xec/0x180 [ 535.003479][ C1] ? __pfx_handle_softirqs+0x10/0x10 [ 535.003497][ C1] ? rcu_is_watching+0x15/0xb0 [ 535.003513][ C1] ? neigh_periodic_work+0xc28/0xe50 [ 535.003527][ C1] do_softirq+0xec/0x180 [ 535.003541][ C1] [ 535.003546][ C1] [ 535.003552][ C1] ? __pfx_do_softirq+0x10/0x10 [ 535.003571][ C1] ? lockdep_softirqs_on+0x13b/0x1c0 [ 535.003587][ C1] __local_bh_enable_ip+0x17d/0x1c0 [ 535.003602][ C1] ? __pfx___local_bh_enable_ip+0x10/0x10 [ 535.003618][ C1] ? do_raw_spin_unlock+0x122/0x240 [ 535.003638][ C1] ? neigh_periodic_work+0xc28/0xe50 [ 535.003652][ C1] neigh_periodic_work+0xc28/0xe50 [ 535.003669][ C1] ? process_scheduled_works+0x9ef/0x17b0 [ 535.003686][ C1] process_scheduled_works+0xae1/0x17b0 [ 535.003716][ C1] ? __pfx_process_scheduled_works+0x10/0x10 [ 535.003741][ C1] worker_thread+0x8a0/0xda0 [ 535.003769][ C1] kthread+0x711/0x8a0 [ 535.003789][ C1] ? __pfx_worker_thread+0x10/0x10 [ 535.003804][ C1] ? __pfx_kthread+0x10/0x10 [ 535.003823][ C1] ? _raw_spin_unlock_irq+0x23/0x50 [ 535.003843][ C1] ? lockdep_hardirqs_on+0x9c/0x150 [ 535.003856][ C1] ? __pfx_kthread+0x10/0x10 [ 535.003874][ C1] ret_from_fork+0x4bc/0x870 [ 535.003891][ C1] ? __pfx_ret_from_fork+0x10/0x10 [ 535.003909][ C1] ? __switch_to_asm+0x39/0x70 [ 535.003930][ C1] ? __switch_to_asm+0x33/0x70 [ 535.003942][ C1] ? __pfx_kthread+0x10/0x10 [ 535.003960][ C1] ret_from_fork_asm+0x1a/0x30 [ 535.003983][ C1] [ 536.352314][T15722] ================================================================== [ 536.360447][T15722] BUG: KASAN: slab-use-after-free in __mutex_lock+0x801/0x1350 [ 536.368032][T15722] Read of size 8 at addr ffff8880512a40a0 by task khidpd_16bf5505/15722 [ 536.376377][T15722] [ 536.378725][T15722] CPU: 0 UID: 0 PID: 15722 Comm: khidpd_16bf5505 Not tainted syzkaller #0 PREEMPT(full) [ 536.378750][T15722] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 536.378762][T15722] Call Trace: [ 536.378770][T15722] [ 536.378779][T15722] dump_stack_lvl+0x189/0x250 [ 536.378809][T15722] ? __kasan_check_byte+0x12/0x40 [ 536.378830][T15722] ? __pfx_dump_stack_lvl+0x10/0x10 [ 536.378855][T15722] ? lock_release+0x4b/0x3e0 [ 536.378879][T15722] ? __virt_addr_valid+0x4a5/0x5c0 [ 536.378906][T15722] print_report+0xca/0x240 [ 536.378930][T15722] ? __mutex_lock+0x801/0x1350 [ 536.378947][T15722] kasan_report+0x118/0x150 [ 536.378967][T15722] ? __mutex_lock+0x801/0x1350 [ 536.378989][T15722] __mutex_lock+0x801/0x1350 [ 536.379010][T15722] ? __mutex_lock+0x5bb/0x1350 [ 536.379032][T15722] ? l2cap_unregister_user+0x6a/0x1b0 [ 536.379058][T15722] ? __pfx___mutex_lock+0x10/0x10 [ 536.379077][T15722] ? _raw_spin_unlock_irqrestore+0xad/0x110 [ 536.379113][T15722] l2cap_unregister_user+0x6a/0x1b0 [ 536.379140][T15722] hidp_session_thread+0x3c9/0x410 [ 536.379168][T15722] ? __pfx_hidp_session_thread+0x10/0x10 [ 536.379200][T15722] ? _raw_spin_unlock_irqrestore+0xad/0x110 [ 536.379227][T15722] ? __pfx_hidp_session_wake_function+0x10/0x10 [ 536.379256][T15722] ? __pfx_hidp_session_wake_function+0x10/0x10 [ 536.379282][T15722] ? __kthread_parkme+0x7b/0x200 [ 536.379304][T15722] ? __kthread_parkme+0x1a1/0x200 [ 536.379329][T15722] kthread+0x711/0x8a0 [ 536.379354][T15722] ? __pfx_hidp_session_thread+0x10/0x10 [ 536.379379][T15722] ? __pfx_kthread+0x10/0x10 [ 536.379403][T15722] ? _raw_spin_unlock_irq+0x23/0x50 [ 536.379430][T15722] ? lockdep_hardirqs_on+0x9c/0x150 [ 536.379445][T15722] ? __pfx_kthread+0x10/0x10 [ 536.379469][T15722] ret_from_fork+0x4bc/0x870 [ 536.379490][T15722] ? __pfx_ret_from_fork+0x10/0x10 [ 536.379512][T15722] ? __switch_to_asm+0x39/0x70 [ 536.379528][T15722] ? __switch_to_asm+0x33/0x70 [ 536.379543][T15722] ? __pfx_kthread+0x10/0x10 [ 536.379568][T15722] ret_from_fork_asm+0x1a/0x30 [ 536.379594][T15722] [ 536.379600][T15722] [ 536.583003][T15722] Allocated by task 15069: [ 536.587444][T15722] kasan_save_track+0x3e/0x80 [ 536.592166][T15722] __kasan_kmalloc+0x93/0xb0 [ 536.596785][T15722] __kmalloc_noprof+0x411/0x7f0 [ 536.601645][T15722] hci_alloc_dev_priv+0x28/0x2060 [ 536.606875][T15722] vhci_create_device+0x120/0x650 [ 536.611931][T15722] vhci_write+0x3ce/0x4a0 [ 536.616281][T15722] vfs_write+0x5c9/0xb30 [ 536.620544][T15722] ksys_write+0x145/0x250 [ 536.624898][T15722] do_syscall_64+0xfa/0xfa0 [ 536.629414][T15722] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 536.635322][T15722] [ 536.637648][T15722] Freed by task 17381: [ 536.641713][T15722] kasan_save_track+0x3e/0x80 [ 536.646414][T15722] __kasan_save_free_info+0x46/0x50 [ 536.651637][T15722] __kasan_slab_free+0x5c/0x80 [ 536.656420][T15722] kfree+0x19a/0x6d0 [ 536.660325][T15722] bt_host_release+0x82/0x90 [ 536.665002][T15722] device_release+0x9c/0x1c0 [ 536.669616][T15722] kobject_put+0x22b/0x480 [ 536.674087][T15722] vhci_release+0x15a/0x1a0 [ 536.678635][T15722] __fput+0x44c/0xa70 [ 536.682634][T15722] task_work_run+0x1d4/0x260 [ 536.687256][T15722] do_exit+0x6b5/0x2300 [ 536.691435][T15722] do_group_exit+0x21c/0x2d0 [ 536.696052][T15722] get_signal+0x1285/0x1340 [ 536.700565][T15722] arch_do_signal_or_restart+0xa0/0x790 [ 536.706145][T15722] exit_to_user_mode_loop+0x72/0x130 [ 536.711469][T15722] do_syscall_64+0x2bd/0xfa0 [ 536.716091][T15722] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 536.722081][T15722] [ 536.724450][T15722] Last potentially related work creation: [ 536.730173][T15722] kasan_save_stack+0x3e/0x60 [ 536.734973][T15722] kasan_record_aux_stack+0xbd/0xd0 [ 536.740182][T15722] insert_work+0x3d/0x330 [ 536.744530][T15722] __queue_work+0xbaf/0xfb0 [ 536.749052][T15722] queue_work_on+0x181/0x270 [ 536.753745][T15722] process_scheduled_works+0xae1/0x17b0 [ 536.759305][T15722] worker_thread+0x8a0/0xda0 [ 536.763902][T15722] kthread+0x711/0x8a0 [ 536.768009][T15722] ret_from_fork+0x4bc/0x870 [ 536.772791][T15722] ret_from_fork_asm+0x1a/0x30 [ 536.777657][T15722] [ 536.779984][T15722] Second to last potentially related work creation: [ 536.786585][T15722] kasan_save_stack+0x3e/0x60 [ 536.791393][T15722] kasan_record_aux_stack+0xbd/0xd0 [ 536.796607][T15722] insert_work+0x3d/0x330 [ 536.800945][T15722] __queue_work+0xcd2/0xfb0 [ 536.805472][T15722] call_timer_fn+0x17e/0x5f0 [ 536.810081][T15722] __run_timer_base+0x646/0x860 [ 536.814958][T15722] run_timer_softirq+0xb7/0x180 [ 536.819817][T15722] handle_softirqs+0x286/0x870 [ 536.824595][T15722] __irq_exit_rcu+0xca/0x1f0 [ 536.829204][T15722] irq_exit_rcu+0x9/0x30 [ 536.833464][T15722] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 536.839142][T15722] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 536.845162][T15722] [ 536.847521][T15722] The buggy address belongs to the object at ffff8880512a4000 [ 536.847521][T15722] which belongs to the cache kmalloc-8k of size 8192 [ 536.861604][T15722] The buggy address is located 160 bytes inside of [ 536.861604][T15722] freed 8192-byte region [ffff8880512a4000, ffff8880512a6000) [ 536.875524][T15722] [ 536.877859][T15722] The buggy address belongs to the physical page: [ 536.884273][T15722] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x512a0 [ 536.893052][T15722] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 536.901572][T15722] anon flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 536.909568][T15722] page_type: f5(slab) [ 536.913566][T15722] raw: 00fff00000000040 ffff88801a027280 ffffea0001b10200 0000000000000005 [ 536.922186][T15722] raw: 0000000000000000 0000000000020002 00000000f5000000 0000000000000000 [ 536.930794][T15722] head: 00fff00000000040 ffff88801a027280 ffffea0001b10200 0000000000000005 [ 536.939485][T15722] head: 0000000000000000 0000000000020002 00000000f5000000 0000000000000000 [ 536.948173][T15722] head: 00fff00000000003 ffffea000144a801 00000000ffffffff 00000000ffffffff [ 536.956863][T15722] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 536.965543][T15722] page dumped because: kasan: bad access detected [ 536.971980][T15722] page_owner tracks the page as allocated [ 536.977775][T15722] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 13848, tgid 13840 (syz.1.2085), ts 353663037942, free_ts 353647521269 [ 536.999423][T15722] post_alloc_hook+0x240/0x2a0 [ 537.004220][T15722] get_page_from_freelist+0x2365/0x2440 [ 537.009792][T15722] __alloc_frozen_pages_noprof+0x181/0x370 [ 537.015614][T15722] alloc_pages_mpol+0x232/0x4a0 [ 537.020476][T15722] allocate_slab+0x96/0x350 [ 537.024997][T15722] ___slab_alloc+0xe94/0x18a0 [ 537.029695][T15722] __slab_alloc+0x65/0x100 [ 537.034129][T15722] __kmalloc_cache_noprof+0x411/0x6f0 [ 537.039521][T15722] mr_table_alloc+0x65/0x250 [ 537.044124][T15722] ip6mr_net_init+0x21a/0x390 [ 537.048819][T15722] ops_init+0x35c/0x5c0 [ 537.052996][T15722] setup_net+0xfe/0x320 [ 537.057356][T15722] copy_net_ns+0x34e/0x4e0 [ 537.061787][T15722] create_new_namespaces+0x3f3/0x720 [ 537.067086][T15722] unshare_nsproxy_namespaces+0x11c/0x170 [ 537.072823][T15722] ksys_unshare+0x4c8/0x8c0 [ 537.077343][T15722] page last free pid 5840 tgid 5840 stack trace: [ 537.083674][T15722] __free_frozen_pages+0xbc4/0xd30 [ 537.088810][T15722] __put_partials+0x146/0x170 [ 537.093503][T15722] put_cpu_partial+0x1f2/0x2e0 [ 537.098281][T15722] __slab_free+0x2b9/0x390 [ 537.102708][T15722] qlist_free_all+0x97/0x140 [ 537.107319][T15722] kasan_quarantine_reduce+0x148/0x160 [ 537.112804][T15722] __kasan_slab_alloc+0x22/0x80 [ 537.117680][T15722] kmem_cache_alloc_noprof+0x367/0x6e0 [ 537.123146][T15722] getname_flags+0xb8/0x540 [ 537.127668][T15722] __x64_sys_unlink+0x3a/0x50 [ 537.132375][T15722] do_syscall_64+0xfa/0xfa0 [ 537.136891][T15722] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 537.142792][T15722] [ 537.145131][T15722] Memory state around the buggy address: [ 537.150783][T15722] ffff8880512a3f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 537.158858][T15722] ffff8880512a4000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 537.166936][T15722] >ffff8880512a4080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 537.175179][T15722] ^ [ 537.180385][T15722] ffff8880512a4100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 537.188460][T15722] ffff8880512a4180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 537.196539][T15722] ================================================================== [ 537.207286][T15722] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 537.214601][T15722] CPU: 0 UID: 0 PID: 15722 Comm: khidpd_16bf5505 Not tainted syzkaller #0 PREEMPT(full) [ 537.224527][T15722] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 537.234621][T15722] Call Trace: [ 537.237931][T15722] [ 537.240888][T15722] dump_stack_lvl+0x99/0x250 [ 537.245517][T15722] ? __asan_memcpy+0x40/0x70 [ 537.250132][T15722] ? __pfx_dump_stack_lvl+0x10/0x10 [ 537.255354][T15722] ? __pfx__printk+0x10/0x10 [ 537.259977][T15722] vpanic+0x237/0x6d0 [ 537.263988][T15722] ? __pfx_vpanic+0x10/0x10 [ 537.268521][T15722] panic+0xb9/0xc0 [ 537.272268][T15722] ? __pfx_panic+0x10/0x10 [ 537.276711][T15722] ? _raw_spin_unlock_irqrestore+0xa8/0x110 [ 537.282641][T15722] ? _raw_spin_unlock_irqrestore+0xad/0x110 [ 537.288568][T15722] ? __mutex_lock+0x801/0x1350 [ 537.293359][T15722] check_panic_on_warn+0x89/0xb0 [ 537.298331][T15722] ? __mutex_lock+0x801/0x1350 [ 537.303117][T15722] end_report+0x78/0x160 [ 537.307466][T15722] kasan_report+0x129/0x150 [ 537.311992][T15722] ? __mutex_lock+0x801/0x1350 [ 537.316868][T15722] __mutex_lock+0x801/0x1350 [ 537.321489][T15722] ? __mutex_lock+0x5bb/0x1350 [ 537.326277][T15722] ? l2cap_unregister_user+0x6a/0x1b0 [ 537.331681][T15722] ? __pfx___mutex_lock+0x10/0x10 [ 537.336729][T15722] ? _raw_spin_unlock_irqrestore+0xad/0x110 [ 537.342656][T15722] l2cap_unregister_user+0x6a/0x1b0 [ 537.347886][T15722] hidp_session_thread+0x3c9/0x410 [ 537.353045][T15722] ? __pfx_hidp_session_thread+0x10/0x10 [ 537.358796][T15722] ? _raw_spin_unlock_irqrestore+0xad/0x110 [ 537.364721][T15722] ? __pfx_hidp_session_wake_function+0x10/0x10 [ 537.371082][T15722] ? __pfx_hidp_session_wake_function+0x10/0x10 [ 537.377351][T15722] ? __kthread_parkme+0x7b/0x200 [ 537.382403][T15722] ? __kthread_parkme+0x1a1/0x200 [ 537.387454][T15722] kthread+0x711/0x8a0 [ 537.391556][T15722] ? __pfx_hidp_session_thread+0x10/0x10 [ 537.397216][T15722] ? __pfx_kthread+0x10/0x10 [ 537.401835][T15722] ? _raw_spin_unlock_irq+0x23/0x50 [ 537.407060][T15722] ? lockdep_hardirqs_on+0x9c/0x150 [ 537.412279][T15722] ? __pfx_kthread+0x10/0x10 [ 537.416911][T15722] ret_from_fork+0x4bc/0x870 [ 537.421532][T15722] ? __pfx_ret_from_fork+0x10/0x10 [ 537.426669][T15722] ? __switch_to_asm+0x39/0x70 [ 537.431455][T15722] ? __switch_to_asm+0x33/0x70 [ 537.436242][T15722] ? __pfx_kthread+0x10/0x10 [ 537.440871][T15722] ret_from_fork_asm+0x1a/0x30 [ 537.445665][T15722] [ 537.448856][T15722] Kernel Offset: disabled [ 537.453175][T15722] Rebooting in 86400 seconds..