last executing test programs: 4.872040164s ago: executing program 0 (id=15582): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240), 0x50) r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x7, 0x1c, &(0x7f00000002c0)=ANY=[@ANYBLOB="1808000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b702000014000000b7091000040000008500000005000000bca900000000000045090200000300006e00000000000000b7020000000000007b9af0ff00000000c509000058020010c3aaf0fff1000000bf8600000000000007080000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018220000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7050000080000004608f0ff76000000bf9820000000000056080000000000008500000007000000b70000000000000095"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 4.830892075s ago: executing program 0 (id=15583): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000680)=ANY=[@ANYBLOB="14000000100001000000000000b890c1a000000a80000000160a01030000000000000000020000000900020073797a30000000000900010073797a30000000005400038008000240000000000800014000000000400003801400010076657468315f746f5f6272696467650014000100776732000000000000000000000000000b00010076657468305f746f5f7465616d00000014000000110001"], 0xa8}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000540)={{0x14}, [@NFT_MSG_NEWRULE={0x58, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x2c, 0x4, 0x0, 0x1, [{0x28, 0x1, 0x0, 0x1, @flow_offload={{0x11}, @val={0x10, 0x2, 0x0, 0x1, [@NFTA_FLOW_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x80}, 0x1, 0x0, 0xf5, 0x2000094}, 0x80) 4.557066518s ago: executing program 0 (id=15588): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000001c0), 0xffffffffffffffff) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(r2, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000280)={0x24, 0x4, 0x8, 0x101, 0x0, 0x0, {0x2, 0x0, 0x3}, [@CTA_TIMEOUT_L3PROTO={0x6, 0x2, 0x1, 0x0, 0x8808}, @CTA_TIMEOUT_L4PROTO={0x5, 0x3, 0x11}]}, 0x24}, 0x1, 0x0, 0x0, 0x801}, 0x20000800) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB='d\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="17090002000000000000010000000500070000000000080009000000000008000a00000000f4060002000000000014001f0000000000000000000000000000000000140020000000000000005a35f2e3ffffac1414bb06001b004e2300"], 0x64}}, 0x0) 4.453665153s ago: executing program 0 (id=15589): unshare(0xe00) (async) unshare(0x4040800) unshare(0x38000000) (async) unshare(0x48000000) (async) unshare(0x100) ioctl$XFS_IOC_PATH_TO_FSHANDLE(0xffffffffffffffff, 0xc0385868, &(0x7f0000000100)={0xffffffffffffffff, &(0x7f0000000000)='\x00', 0x400882, &(0x7f0000000040)={@align=0x273, {0x4, 0x1, 0x800, 0x8}}, 0xc94, &(0x7f0000000080)={@_ha_fsid}, &(0x7f00000000c0)}) sendmsg$IPSET_CMD_LIST(r0, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)={0x68, 0x7, 0x6, 0xc00, 0x0, 0x0, {0x2, 0x0, 0x6}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_FLAGS={0x8, 0x6, 0x1, 0x0, 0x3}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_FLAGS={0x8, 0x6, 0x1, 0x0, 0x5}, @IPSET_ATTR_FLAGS={0x8, 0x6, 0x1, 0x0, 0x8450}, @IPSET_ATTR_FLAGS={0x8, 0x6, 0x1, 0x0, 0x4}, @IPSET_ATTR_FLAGS={0x8, 0x6, 0x1, 0x0, 0xfffffff7}]}, 0x68}, 0x1, 0x0, 0x0, 0x4}, 0x40000) (async) bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f0000001500)={&(0x7f0000000280)="c03d71d1d3940a7269850109d2929924bba86f4287a55522a7ccb2c8a924f75528e43e848fb0207c41b155b7baf75d9c03cec913355c12eca6ab3b4d3c4edab9b0e269bffdabcc74bc972d79085340ab02c5b310ca63ec8cf34d520e0b4a7ec734b66a3245832468a92fad244f252c26caa6b05f355d1c98c1b33753cf64066c0605eb8a325c0fb04cf0ce9396502495e8d11fcda8c475475256d2c04de271711422bb6b1305a35e545216d515028422ffd81a702e75fabeaebf1ec465169f25711b9388199436199f317fa5", &(0x7f0000000380)=""/111, &(0x7f0000000400)="675235068184864d47b82fb587c424580069a64a27fde966a8485017bfb12d423fc2a4376fb468ea9167bddd7d4390d858feb7e3e8a0ec164d879dea6d015226e6149ec40b358b26ba69701e72dc035777952e12846dccfaf0bcc9fb9ff7ecbc194383fdbcdafc1ffe8f916f0b7fc9a3d57778a95f7c0b99e5bba2a8057203660cbd82fed561ba6493fa7610b06dee04bb519f6b181b36976b22b4db3bd711850ef0f2a67e482bf6dd0f6f38982940814c4055d5273619793809866402416e1ca7c8cb02c221511ea98db441f936d6b0e0f7ad7727b89d9deb65f2b00ea218f597fed2ac67326deaaee80d487c84515e29c7dfe49c3485514be748403ec14ad7fef7dc22b6bd0bdf34563fadd0b35022d3844a812dd61fe4cc5289adc8daf0105d54ef5da69632a2091b83676d7ce3593c2358643834222611de8fb3e1385f8b1918524fa3838f2672ad5abfb0ca6840e14345dda847021eb28fad4fedb0cf721afd218bdece4bb97934ccde949ea1b867b89f7133c3a1ba7c3675231a1959b40382562c4e3da86b26e5e08275c6b07438e0518d703fe6bb6d658c10346b165e4643f7f48dbfe8e8601547ac3063bc500a9da11222bff981ad9807ccd49cf70a95819c68c2cde154c77458611eb224d8dba57397777fb97e97b2e1f4ecfbfb8ac0aa5a9a041b06efacf6af707842598228dd82f71410611b0efd0e3a6f472b02bd5f25fb7d5ee8bca51a4c4eac45c635623053ebd202adda72caa66343b98570f07c48c0c97f2cf1a51a34fa1edcfcac7c705a93bcfbe849771e1e078a6d55feca6b985323e7f440ea76f42ed85354f31433ad886843b50ecbcb4cca25ed7dd0921749c6622f9449d6e24434141108d0dcc0474989c835f302ca4b8c8fc1e0e07b0bf00f259cae33213a13f267abf2b2b2bb663ecd3b53f5f3c4cf4e84c7ec9688d7a55dc3fb66a025de83ffec38c28df375567c625abad8a52910e6a31d20d5938d9a5ded1edff8103f07134c9e40cd820e2bfce5cd67c610691d5dd3211930965ea349f831e44c790dc29162dbffb7dc601572b63ab3711260d1eb4889c768731b83003f40073f2a7d35a663afc9774213354c3196d720c62c7f4e8f1b626dfd2d32160d23205767260ca0991a6965679ef47079671d175797ca429d36d294aa4e1cc1c52ae5973185679a8cdbcb7fc6a94f3588a9393f2832b633ef222b52eaf05663467422e9650a791d7e76105054dd99779c8113619c608f0c0e04226625cc1eeedfbc6a3e0f8531b909731b1d03d370294348c2bf11b0edf52bc6370ccb040b09c25c61c5a34d847f19ed07ced9cdb54da4c51a182fd22e71afbbaadc8a1501344bad14330c7108a58544d5878d32ffce218fd95b2f8563222ca5524350d83a7a398d398dacf1ec922383955110e8eb1488deed52b1051df7fd793946fad355a3329e231386590c024f04d9d105142ea5c039c1b5d7324a0a435bba5ef8df7bf71a13eb9f951e8e9d01b3f43e1371c4a996c6a2b80a491bf89c95a42a0fc239f88c7f57c90e06084385f7b9fb712c4531d22745f49540c0d6e2b7dd89dfeba5cd937066df5a75806378b5588d823edc2966f44e94b40c6ebcd603e601cd9d9e62f6c973b97bd15bade90bb09ed67f5fdbe9c805e25d2d8dbb275e72e5889c2794103788ad3506dfc6497fb94b3f788d734c776b2d91f018a96d96bd9ae52394177c390ff1fb74064282b88c869dd25e8afc81a116fe58fd9866652550937d42246bcfc2fa964378cacd1f5805ffb71708b58c832c517b3f7059101a1e29b645af0fee7f123135050a2fc0062dbc5050b7feec77c83d9740b01f6fd96c5f9f721bc49f31d1f4df4597a983293c6c24db60c581d9fb09b27b61be1be38a9cb6babdda7a121cc5cddb7dd49b4c808b2534ef333ff1692ae0f250cc4c5f2c16f42d8471d9667072cbe72386ab2e209d1438d6636b912c0bd9c4107fdb2355bbb554e94d874cb6bbc0ac07d640684ea0c10d17ca14e0ca514614f8e4bb9f5bedf3402505ce5f3768c5c81997f2de388fd8d1af3d4a77b1e0ec39cfe974d2a43c96dcd4e86e60d0380a0e96207ee711777f9a3198909bab518a801546a51eb152bcc03e4767c0b19c3012060c8282282404a6856d2e8fd4ab8339a391042b230a0ac1d9641752277ad6fa585d61dff4ebde03ea742a07afe45fa6b5c6da9d9142bd859b641220843a453cc5f5f5f7669f5f6e93aa9dfb61575701723dfcc77915a79e14eeff0f85edf5449fe5546df47388ca439cc7ccc422e3c4d8f60de24654e0c8678e565278c337e24154a61e6440449aedbe338e3ea3bcd52a7f400a27ff180c53e94e0a264a9977c5c3741936c67f5eebb0ef3f57ffd6b9499d7b6b7710d9b9999721deeed15a8999f09db710883225134c4bc2f478289baad1757cbd2434a5641fa429d1266150b285410255e218bf42c8360315dda6c7e499067fb4af16e191fa0b4a167dac376a20f743f530b297aa064c491ddf29eb39657e670bc44b98b7bdf5dbc4da8a4a82234b4f6b9b977e0e50d044e318927f68ef1afbc51880f58024841b0223eaa1296d52613b64a147821d06281fdc37dea32b1a468be4e183d9636c9891a4cf22ce919501c6312cb054a1722c61012c659eb0007296aab837da311bdafdfa27edf498fd3b9e96a597c754061f8f1003e702b12e137e04b25f5e8def05831de8537fada87c774bdb79d2d5c34a13d8c6fb36e1a7ffb5ed813d3965c30b0524da548de4e9fcf69c45c9ecd8898b08cfc3ab56e54fc9cd05b5b797ecb3bb34c05f4b2255ff9519d25c0a08cfb1d035abea71d08da897bd0a37010cca15ecbed58aae9d2501551f76bc2eaca6dad69c5d91a51b26c05230e971d79d796684b1e2a743832c43b6f6e395fbd60135a6bbb1145934f7f6ef8b01776b667db1a17ded2628a0e6d62c7344b2b18e10bf306d8ca300e7ce8c03b4f725df8ee9ddb7c44fef3eea25ae426a8f8a67f007f2414315dd73b3d2bcb80bd0f206146bf499a737fc85c2008ff45e74aea3ab0539cabe5ca0dcb3cf358f7e5b1c41fcd9748a59d54cc9dcf7a994b3dd73460afc88505cdb1e5a907b7422921ee9f068d1e44937081d66e18a4e9c723eb8c4d90131872ee9e9b34b9bc73050d665ac58432b014e40b10400fd04b40a119fa375ca7bf15ef19589ca625f269532deb0f457dad71bcf23b03444a7df5e3d6822b1fc096cec948ed34b19907865f92f56c5cd84c9a7f6e72a95b9ddd1da630e8424e83c5bfcd97e5114f8a801da2b88fa1b7a2b07cc1c01c6de76f94bd1a4c0ba349c80c77e23b40bc2a6668adb8a2644ab9a5ad6ad19c40e20df118234668fcfe6db33fa96ee3a28a3698db907b6274125e6e3b71bce606097fe222854a34e0057e5b0d7b239b76474ddfc540cde6a2ec730203ceda9fdca4a063070f31fa39e5e0202936691b3f0f5f73d347894614da977941af52cfdedec267d3b53bece3d91dafe454a646ebc16e1fce4472b7593f6f5db2f8255d7de4b48d665c7f66e2d005e63ba115228b3b52e1182b9bc71fe3065cfff0f4745153773dfd67270acb085b8a2eeb0e2cb5991dc445dcddf7aa28774080f91c6e91cb835158615abc21c2e4e588d986aa13e10e582aad6901ba571d8a4701b5b25a0a7148ec2d3373691cacc4b60b2b78ed254870db75509a5cd8449893e9c08d15230c3fc860098b8d2ea8671f7343ebfe034e031426ba53e2c494c5fe5dd3e32be55e720849c9db2fe435a8d9e682f2794578dedae29cc0eb47d09862dc5d862574b4a097098bf8ff93f87608ec891a9e598d709e56819ff31873bbac7e255d09e16a339a8c303fc52549cb8d82fd29fb0c0a8df890b46c5e3a98574a57d46ea31bca6d65b59f5ce21982fbf9a8b22318aad81d855c1e3376a0675e8bd905e1b04ab5fc2c4602d037bfab9b62bdb2ea1d691ac9571f55b6014826a01daf7cd49ace3e078b69b86a454a3b9fc36f87b7a34b77f65665d7b571b605a50a6cd4a6fa13b149a8cbc76339170edca0262b1e5f003073b24f5b1e82ae8a5a36730d667c316fb676cf4be2b57c98eb675d32bdc1d6bc03c618030ee7d9f6f4f18ed1b68549911b10ca67a2a631585a75cbf5c8f47b6fee8fbaf2597cd786e625abb6af6060b51d8bf52ea864351fed005517ae324feb1d5e5fabf043b949a5d0da78d9fcac4aa5a3e4bf7e9e50dba3651b61d7e7308a35d415feb4521393753d3a68f3336afe2d1332c5a461cc9595d26df34aa5e0eb8fae339c4249651b96cad4389ed7c90def1cc756481956d09094f4e444e10fce8933b59c17aacf28ed3ac57d81b8dfc0ee7e830c499f2ef81af4b3e658a5f8ee0c4bfe110199a497fe97e8bcf59c57d8ee52d5ccba85879c31461f9f5fe25d04c9753492d7463f73fecd949a7c61d63e2dead95a1626de38b935449fc2ff99f5b58344c6f60b3ccd19d473cbc4794528147510d434d1dccf8fce8838f59783a1cbb889cc21f9c3bb9f6c3b8e4fd375b45c0bc32e5b66299c3cf15114a3c4b8e19082dc8f8b70a8cda3d6d0e22cd13e8fa38d67db291efc10591924b676dd3abf6edc5e38a2432326d9f138fe8dbd35b2827fade11e9887cc6d6bb03ce248ac39c91faff3b0fc4264f8722fe428bf6a9182893a3c9bd631db147353eed6f85539ac35ae5749609d027d1eca51ee264b43590563e5514ce48ab66027ff789dc36db98f32ff6a8427864262d9229964605653b1eb5b031b2ca081975a1bd5a074755e3a6119335afce6280a4bf14faa9849210f8814ca96e1cae6bc708eb7e57c9f954d409f6b6e5d7e4658a2192a912d91711f4baf1c3046dc90795c3b6f1ff14b8e7a4cd655eae771c9fca32f231948cd4a878fecf548f8905bb58749dd5003f976ab66e1b109f073d2b00eb790d5347f585fcecf450819843501098ea3f39d4245cb8066b30315e101d7fadb3bc07e55d0294400eee3ab7dac95e701f2f92d14423d61f76de62f6de209225f9d52fdc9c5ce3e5857e60c2f655d89de26789a77ffd2352a80451fe7bbfefc2deb8342fadd80f52cf5aa3c4067987092492ea081176ef4283774d069b7e0c92b22e38be080fc44e7512719cd58a06613d87a4ff004975e2d946836b36b55dfe8e39ebe63922590a9328a2b9d7b2cfe80e25f69217ce69b9fbf99cfdef5ac3a023797a66b1e28598a2e8a6668730a4efabf237f39ed7f304d48b0c83564893651c7c6e8ef9e6437075bdd8718b7d98bf301701e12428f2a572334bcf75df05003abb39e31d44ff57d088f32a9a9174fc1a73acaea02ad16c4ca81d53368b8dcde07f92ba1b7669fb5488fc295bf8a00f072cf623a1e59f565faa29f3ad9d81436d578bd8920056bcd5d87826c6f431dd61456348e4ca24db9d900b3bff6363fb6af64f83e0557ad5e497c5578f0d0a5630b2632a1d73bc9a77018d10641a0870e5f7ee122f0b55002b0cf413dd5782dbb73df2d54f020e005d3a39c124f88948ec3331bc2893ec3ea03d6335b26bf44a6e148d86aa9308cea19cf9ca8ac357eecb73d92c236e0cbfceca424763f2d9bb2a00b056fea4117b41e4610a8db4c2cd85f2f89d2fbc8ca4368656159dcbea50bf24c3c3719ff7d7a6258b3af2303dadbada9b94f21ca93f4fe150f93b3de7f17e92843238f14ef50eb660d78f25b307a52d4cc4c094e5c32f5115e65acb4e43bee0934aa2c043ce5902ff19c8252b92409cb9cacc19e46eabef342faf06111f196d962242486e71", &(0x7f0000001400)="b551c6dfabeab48c59cee1b6192c1e294e8c10fc4e3ba4ca73df985ce50515f6d6740fbbbe123797c02db1b3cb88b1b867dac38a28a078c93236062acbdf8d02d333707c7bb0e6198e3133e8947fbefd2f16fc956bb075dbb0ba4be69443f13bdff4a22ed203a2443b5ebae5d7284460004312cd7c80b67beba313b090371bd1dec570858be963beb865c3f2878eb28136949416ff552af1f8e6a49f65eabaf18dcbfaca798aaa0afce6cbaa8a0048de63ecc2194cd2b16cb3625cd6a438ebde4054fede0b6af9f83514bd8af0deb41de80733145ff9dd20eb9bb498ba4e3b", 0x6, r0}, 0x38) (async) r1 = socket$inet_smc(0x2b, 0x1, 0x0) ioctl$XFS_IOC_ATTRLIST_BY_HANDLE(r1, 0x4058587a, &(0x7f0000001740)={{r0, &(0x7f0000001540)='+\x00', 0x440180, &(0x7f0000001580)={@align=0x10001, {0x6, 0x80, 0x3, 0xb}}, 0x8, &(0x7f00000015c0), &(0x7f0000001600)=0x7}, {[0x7, 0x401, 0x3, 0x5]}, 0x9, 0xfc, &(0x7f0000001640)=""/252}) unshare(0x4000400) openat$tun(0xffffffffffffff9c, &(0x7f00000017c0), 0x200000, 0x0) (async) getsockname$packet(r0, &(0x7f0000001800)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000001840)=0x14) r4 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000001880)={0x2, 0x4, 0x8, 0x1, 0x80, r0, 0x9, '\x00', r3, 0xffffffffffffffff, 0x0, 0x1}, 0x50) getsockopt$PNPIPE_IFINDEX(r2, 0x113, 0x2, &(0x7f0000001ac0)=0x0, &(0x7f0000001b00)=0x4) (async) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000001e80)={r2, 0xe0, &(0x7f0000001d80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, &(0x7f0000001bc0)=[0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x2, 0x7, &(0x7f0000001c00)=[0x0, 0x0], &(0x7f0000001c40)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0x69, &(0x7f0000001c80)=[{}], 0x8, 0x10, &(0x7f0000001cc0), &(0x7f0000001d00), 0x8, 0x84, 0x8, 0x8, &(0x7f0000001d40)}}, 0x10) (async) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000001f40)={{r4, 0xffffffffffffffff}, &(0x7f0000001ec0), &(0x7f0000001f00)='%pK \x00'}, 0x20) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000002080)=@bpf_lsm={0x1d, 0xd, &(0x7f0000001900)=@raw=[@snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x100}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r2}}], &(0x7f0000001980)='GPL\x00', 0x8, 0xf6, &(0x7f00000019c0)=""/246, 0x40f00, 0x0, '\x00', r5, 0x1b, r2, 0x8, &(0x7f0000001b40)={0x2, 0x3}, 0x8, 0x10, &(0x7f0000001b80)={0x0, 0x9, 0x77a, 0x4}, 0x10, r7, 0x0, 0x9, &(0x7f0000001f80)=[r8, r0], &(0x7f0000001fc0)=[{0x9, 0x1, 0x10}, {0x1, 0x5, 0x8, 0xc}, {0x0, 0x5, 0xe, 0x7}, {0x3, 0x5, 0xc, 0xc}, {0x0, 0x4, 0x1, 0x6}, {0x5, 0x3, 0xd, 0x7}, {0x1, 0x2, 0x9, 0xb}, {0x0, 0x4, 0xf, 0x2}, {0x0, 0x5, 0xa, 0x1}], 0x10, 0x9}, 0x94) (async) sendfile(r2, r0, &(0x7f0000002140)=0xd848, 0x8) getsockopt$inet6_mreq(r0, 0x29, 0x14, &(0x7f0000002180)={@local}, &(0x7f00000021c0)=0x14) recvmmsg(r0, &(0x7f0000002d80)=[{{&(0x7f0000002200)=@alg, 0x80, &(0x7f0000002500)=[{&(0x7f0000002280)=""/139, 0x8b}, {&(0x7f0000002340)=""/103, 0x67}, {&(0x7f00000023c0)=""/105, 0x69}, {&(0x7f0000002440)=""/109, 0x6d}, {&(0x7f00000024c0)=""/16, 0x10}], 0x5, &(0x7f0000002580)=""/193, 0xc1}, 0x1a}, {{&(0x7f0000002680)=@l2={0x1f, 0x0, @fixed}, 0x80, &(0x7f0000002700)}, 0x3fe}, {{&(0x7f0000002740)=@qipcrtr, 0x80, &(0x7f0000002a00)=[{&(0x7f00000027c0)=""/168, 0xa8}, {&(0x7f0000002880)=""/170, 0xaa}, {&(0x7f0000002940)=""/157, 0x9d}], 0x3, &(0x7f0000002a40)=""/20, 0x14}, 0xf0}, {{0x0, 0x0, &(0x7f0000002c40)=[{&(0x7f0000002a80)=""/157, 0x9d}, {&(0x7f0000002b40)=""/238, 0xee}], 0x2, &(0x7f0000002c80)=""/244, 0xf4}, 0x200}], 0x4, 0x10000, &(0x7f0000002e80)={0x77359400}) (async) unshare(0x2010800) (async) sendmmsg$inet6(r2, &(0x7f0000002f80)=[{{0x0, 0x0, &(0x7f0000002f00)=[{&(0x7f0000002ec0)="a9e875afb22c596672b3cd0d2dd0cd6ec07ffc7b5522bde06963", 0x1a}], 0x1, &(0x7f0000002f40)=[@hoplimit={{0x14, 0x29, 0x34, 0x3ac00}}], 0x18}}], 0x1, 0x4008894) (async) socket$pppl2tp(0x18, 0x1, 0x1) (async) unshare(0x40000000) (async) setsockopt$sock_attach_bpf(r1, 0x1, 0x32, &(0x7f0000002fc0)=r0, 0x4) unshare(0xa020080) unshare(0x10040000) (async) unshare(0x40040100) (async) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f00000030c0)={'sit0\x00', &(0x7f0000003000)={'gretap0\x00', r6, 0x1, 0x8, 0xc, 0x100, {{0x23, 0x4, 0x1, 0x32, 0x8c, 0x64, 0x0, 0x6, 0x4, 0x0, @remote, @rand_addr=0x5, {[@rr={0x7, 0x23, 0x24, [@loopback, @multicast2, @dev={0xac, 0x14, 0x14, 0x1f}, @multicast1, @remote, @remote, @empty, @local]}, @lsrr={0x83, 0x17, 0x88, [@multicast1, @multicast1, @rand_addr=0x64010100, @loopback, @dev={0xac, 0x14, 0x14, 0x15}]}, @rr={0x7, 0x13, 0xb6, [@multicast1, @multicast2, @multicast2, @broadcast]}, @lsrr={0x83, 0xf, 0x26, [@multicast2, @initdev={0xac, 0x1e, 0x0, 0x0}, @rand_addr=0x64010101]}, @timestamp={0x44, 0x18, 0x74, 0x0, 0x9, [0x5, 0x2, 0x2, 0x3, 0x9]}, @noop]}}}}}) 4.267298874s ago: executing program 2 (id=15593): r0 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_INIT(r0, 0x0, 0xc8, &(0x7f0000003d40), 0x4) (async) setsockopt$MRT_ADD_VIF(r0, 0x0, 0xca, &(0x7f0000003d80)={0x0, 0x0, 0x3, 0x7ff, @vifc_lcl_addr=@local, @broadcast}, 0x10) (async) socket$igmp(0x2, 0x3, 0x2) mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x0, 0x32, 0xffffffffffffffff, 0xc921d000) (async) bpf$TOKEN_CREATE(0x24, &(0x7f0000000040)={0x0, r0}, 0x8) (async) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000100)={0x1, 0xffffffffffffffff}, 0x4) ioctl$XFS_IOC_PATH_TO_HANDLE(r0, 0xc0385869, &(0x7f0000000380)={r1, &(0x7f0000000080)='\x00', 0x640100, &(0x7f0000000200)={@_ha_fsid={[0x1, 0xd]}, {0x0, 0x1ff, 0xfffffc01, 0x5}}, 0x40000000, &(0x7f0000000300)={@_ha_fsid}, &(0x7f0000000340)=0x1ff}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x14, &(0x7f00000003c0)=@framed={{0x18, 0x2, 0x0, 0x0, 0xb2b3, 0x0, 0x0, 0x0, 0x200}, [@snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x7fff}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r2}}, @exit, @call={0x85, 0x0, 0x0, 0xb0}, @map_val={0x18, 0x4, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x4324e3ad}]}, &(0x7f0000000000)='GPL\x00', 0x4, 0xaa, &(0x7f0000001240)=""/170, 0x40f00, 0x40}, 0x94) (async) setsockopt$MRT_ADD_VIF(r0, 0x0, 0xca, &(0x7f00000000c0)={0x8, 0x1, 0x3, 0x4, @vifc_lcl_addr=@dev={0xac, 0x14, 0x14, 0xa}, @remote}, 0x10) 4.025848117s ago: executing program 2 (id=15596): mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x0, 0x32, 0xffffffffffffffff, 0x8528c000) r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000980)={0xd, 0x10, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bf8100000000000007080000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018210000", @ANYRES32=r0, @ANYBLOB="0000000002000000b70500000800000085000000c200000095"], &(0x7f0000000380)='GPL\x00', 0xc, 0x1002, &(0x7f00000014c0)=""/4098, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0xc00, 0x0, 0x0, 0x10, 0x5}, 0x94) 3.871604944s ago: executing program 2 (id=15598): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'bridge0\x00', 0x0}) bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x3, 0x23, &(0x7f00000002c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x80000000, 0x0, 0x0, 0x0, 0xdecc}, [@map_idx={0x18, 0x2, 0x5, 0x0, 0x3}, @kfunc={0x85, 0x0, 0x2, 0x0, 0x4}, @snprintf, @map_val={0x18, 0x7, 0x2, 0x0, 0x1, 0x0, 0x0, 0x0, 0x9}, @map_val, @initr0={0x18, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x1}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, 0x1}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x7}}, @func={0x85, 0x0, 0x1, 0x0, 0xffffffffffffffff}]}, &(0x7f0000000400)='GPL\x00', 0x4, 0xfb, &(0x7f0000000440)=""/251, 0x40f00, 0x0, '\x00', r1, @sched_cls=0x2e, 0xffffffffffffffff, 0x8, &(0x7f0000000540)={0x7, 0x2}, 0x8, 0x10, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, &(0x7f0000000580)=[0xffffffffffffffff, 0x1, 0x1, 0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0xffffffffffffffff], 0x0, 0x10, 0x4867}, 0x94) bpf$BPF_PROG_QUERY(0x10, &(0x7f00000007c0)={@ifindex=r1, 0x1e, 0x0, 0xfffffffd, &(0x7f0000000680)=[0x0, 0x0, 0x0, 0x0, 0x0], 0x5, 0x0, &(0x7f00000006c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000700)=[0x0], &(0x7f0000000740)=[0x0, 0x0]}, 0x40) sendmsg$nl_route(r0, &(0x7f0000001300)={0x0, 0x0, &(0x7f0000000180)={0x0, 0x34}, 0x1, 0x0, 0x0, 0x1}, 0x20040010) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=ANY=[@ANYBLOB="200000006800e97800000000000000000a0000000000000008000500", @ANYRES16=r2], 0x20}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000004380)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="240000001800090400000000000000000a000000000000030000000008001e0001"], 0x24}}, 0x0) socket$unix(0x1, 0x1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) bpf$MAP_LOOKUP_ELEM(0x5, 0x0, 0x0) r3 = socket$inet6(0xa, 0x1, 0x8000000003c) sendmsg(r3, 0x0, 0x44004) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) bind$bt_l2cap(r6, &(0x7f0000000000)={0x1f, 0x6, @any, 0x0, 0x1}, 0xe) sendmsg$nl_route(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000100)=@ipv4_newroute={0x24, 0x18, 0x35f32a6dfa748ddd, 0x0, 0x0, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}}, 0x24}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=@newlink={0x28, 0x10, 0x1, 0x1, 0x0, {0x0, 0x0, 0x0, 0x0, 0x420}, [@IFLA_GROUP={0x8}]}, 0x28}, 0x1, 0xc3ffffffffffffff}, 0x0) 3.437731298s ago: executing program 2 (id=15599): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x18, 0xa, &(0x7f0000000080)=@framed={{0x18, 0x8, 0x0, 0x0, 0xffd0}, [@func={0x85, 0x0, 0x1, 0x0, 0x6}, @map_fd={0x18, 0x0, 0x0}, @generic={0x66, 0x8, 0x0, 0xffff}, @initr0={0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000}, @exit]}, &(0x7f0000000000)='GPL\x00', 0x2, 0x0, 0x0, 0x0, 0xc}, 0x94) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$int_out(r0, 0x0, &(0x7f0000000180)) read(r1, &(0x7f0000000000)=""/184, 0xb8) r2 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000000000)={'vcan0\x00', 0x0}) connect$can_bcm(r2, &(0x7f00000000c0)={0x1d, r3}, 0x10) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)=@newlink={0x5c, 0x10, 0x1, 0xffffffff, 0xfffffffe, {0x0, 0x0, 0x0, 0x0, 0x2a060}, [@IFLA_IFNAME={0x14, 0x3, 'syz_tun\x00'}, @IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @vxcan={{0xa}, {0x18, 0x2, 0x0, 0x1, @val={0x14, 0x1, {{0x0, 0x0, 0x0, r3, 0x42, 0x48001}}}}}}]}, 0x5c}, 0x1, 0x0, 0x0, 0x4004}, 0x8000) 3.106005572s ago: executing program 2 (id=15602): bpf$PROG_LOAD(0x5, &(0x7f00000007c0)={0x6, 0xc, &(0x7f00000002c0)=ANY=[@ANYBLOB="180200000400000000000000000000008500000041000000180100002020732500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000740000007200000095"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf3ff, 0x0, 0x0}, 0x94) 2.971533913s ago: executing program 2 (id=15604): bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000000)={&(0x7f0000000200)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x0, 0x0, 0x2}}, &(0x7f0000000100)=""/141, 0x1a, 0x8d, 0x1, 0x7}, 0x28) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r1 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) connect$unix(r1, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000100)=ANY=[@ANYRES8=r0, @ANYRES32, @ANYBLOB="0000000000000000400012800c0001"], 0x68}}, 0x0) r2 = socket$igmp6(0xa, 0x3, 0x2) r3 = socket$kcm(0x2, 0x7, 0x2) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r2, 0x8983, &(0x7f0000000300)={0x0, 'syzkaller1\x00', {0x2}}) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$tipc(&(0x7f0000000080), 0xffffffffffffffff) setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x1, &(0x7f00000001c0)=0x8, 0x4) sendmsg$TIPC_CMD_SET_LINK_PRI(r4, &(0x7f0000000400)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f00000003c0)={&(0x7f0000000340)={0x68, r5, 0x400, 0x70bd2b, 0x25dfdbff, {{}, {}, {0x4c, 0x18, {0x9, @media='udp\x00'}}}, ["", "", "", "", "", ""]}, 0x68}, 0x1, 0x0, 0x0, 0x20040800}, 0x24000841) r6 = socket(0x1d, 0x2, 0x6) setsockopt$pppl2tp_PPPOL2TP_SO_RECVSEQ(r6, 0x6a, 0x4, 0x1, 0x27) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$devlink(&(0x7f0000000600), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_TRAP_GROUP_SET(r7, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000340)={0x4c, r8, 0x1, 0x70bd29, 0x25dfdbff, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0xd}, {0x5, 0x83, 0x1}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4008004}, 0x840) r9 = getpid() r10 = socket$nl_generic(0x10, 0x3, 0x10) r11 = syz_genetlink_get_family_id$devlink(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RELOAD(r10, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)={0x3c, r11, 0x1, 0x70bd27, 0x25dfdbfb, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, @DEVLINK_ATTR_NETNS_PID={0x8, 0x8b, r9}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4040010}, 0x30) sendmsg$DEVLINK_CMD_RELOAD(r4, &(0x7f0000000500)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f00000004c0)={&(0x7f0000000440)={0x5c, r8, 0x800, 0x70bd2a, 0x25dfdbff, {}, [{@pci={{0x8}, {0x11}}, @DEVLINK_ATTR_NETNS_PID={0x8, 0x8b, r9}}, {@pci={{0x8}, {0x11}}, @DEVLINK_ATTR_NETNS_ID={0x8}}]}, 0x5c}, 0x1, 0x0, 0x0, 0x20000000}, 0x40080) write$tun(r0, &(0x7f0000000100)=ANY=[@ANYBLOB="06000000bbbbbbbbbbbbaaaaaaaaaabb88f5"], 0x72) 2.441344494s ago: executing program 1 (id=15610): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'bridge0\x00', 0x0}) bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x3, 0x23, &(0x7f00000002c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x80000000, 0x0, 0x0, 0x0, 0xdecc}, [@map_idx={0x18, 0x2, 0x5, 0x0, 0x3}, @kfunc={0x85, 0x0, 0x2, 0x0, 0x4}, @snprintf, @map_val={0x18, 0x7, 0x2, 0x0, 0x1, 0x0, 0x0, 0x0, 0x9}, @map_val, @initr0={0x18, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x1}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, 0x1}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x7}}, @func={0x85, 0x0, 0x1, 0x0, 0xffffffffffffffff}]}, &(0x7f0000000400)='GPL\x00', 0x4, 0xfb, &(0x7f0000000440)=""/251, 0x40f00, 0x0, '\x00', r1, @sched_cls=0x2e, 0xffffffffffffffff, 0x8, &(0x7f0000000540)={0x7, 0x2}, 0x8, 0x10, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, &(0x7f0000000580)=[0xffffffffffffffff, 0x1, 0x1, 0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0xffffffffffffffff], 0x0, 0x10, 0x4867}, 0x94) bpf$BPF_PROG_QUERY(0x10, &(0x7f00000007c0)={@ifindex=r1, 0x1e, 0x0, 0xfffffffd, &(0x7f0000000680)=[0x0, 0x0, 0x0, 0x0, 0x0], 0x5, 0x0, &(0x7f00000006c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000700)=[0x0], &(0x7f0000000740)=[0x0, 0x0]}, 0x40) sendmsg$nl_route(r0, &(0x7f0000001300)={0x0, 0x0, &(0x7f0000000180)={0x0, 0x34}, 0x1, 0x0, 0x0, 0x1}, 0x20040010) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=ANY=[@ANYBLOB="200000006800e97800000000000000000a0000000000000008000500", @ANYRES16=r2], 0x20}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000004380)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="240000001800090400000000000000000a000000000000030000000008001e0001"], 0x24}}, 0x0) socket$unix(0x1, 0x1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) bpf$MAP_LOOKUP_ELEM(0x5, 0x0, 0x0) r3 = socket$inet6(0xa, 0x1, 0x8000000003c) sendmsg(r3, 0x0, 0x44004) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) bind$bt_l2cap(r6, &(0x7f0000000000)={0x1f, 0x6, @any, 0x0, 0x1}, 0xe) sendmsg$nl_route(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000100)=@ipv4_newroute={0x24, 0x18, 0x35f32a6dfa748ddd, 0x0, 0x0, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}}, 0x24}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=@newlink={0x28, 0x10, 0x1, 0x1, 0x0, {0x0, 0x0, 0x0, 0x0, 0x420}, [@IFLA_GROUP={0x8}]}, 0x28}, 0x1, 0xc3ffffffffffffff}, 0x0) 1.814295179s ago: executing program 1 (id=15613): r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000180)={&(0x7f0000000000)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x7d, 0x7d, 0x4, [@func={0x2, 0x0, 0x0, 0xc, 0x5}, @int={0x9, 0x0, 0x0, 0x1, 0x0, 0x7d, 0x0, 0x1a, 0x5}, @datasec={0x2, 0x4, 0x0, 0xf, 0x1, [{0x3, 0x0, 0x6}, {0x2, 0x0, 0x3}, {0x3, 0x2, 0x4}, {0x1, 0x7, 0x38983ef8}], 'g'}, @ptr={0x10, 0x0, 0x0, 0x2, 0x1}, @array={0x0, 0x0, 0x0, 0x3, 0x0, {0x5, 0x2, 0xa}}]}, {0x0, [0x30, 0x2e]}}, &(0x7f00000000c0)=""/156, 0x9c, 0x9c, 0x1, 0x7be}, 0x28) pwrite64(r0, &(0x7f00000001c0)="63e59edfe2555a99035a55c3b14a5728826952a1c4f13ef44872", 0x1a, 0x0) r1 = socket(0x28, 0x3, 0xe) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$OSF_MSG_ADD(r2, &(0x7f0000001300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f00000012c0)={&(0x7f0000000240)={0x1060, 0x0, 0x5, 0x401, 0x0, 0x0, {0xa, 0x0, 0x7}, [{{0x254, 0x1, {{0x0, 0x7}, 0xb, 0xff, 0x0, 0xfff4, 0x8, 'syz0\x00', "13f10d54befd06b776e4e583fa3ca8b760f7da10ee422eec4ab588766d72a356", "5886ce1c16d05dea13977ec109cb0aaa15738253048199394d7d4fc5b75dbe28", [{0x100, 0x81, {0x1}}, {0x19, 0xb, {0x0, 0x101}}, {0x1ff, 0x9b, {0x1, 0xffff}}, {0x8, 0x3, {0x2}}, {0xd, 0x7ff, {0x2, 0xfff}}, {0xc2de, 0x3, {0x2, 0x180}}, {0x7, 0x1, {0x2, 0xffff7fff}}, {0x0, 0x200, {0x2, 0x7}}, {0x7, 0x5376, {0x1, 0x9}}, {0x9, 0x0, {0x3, 0x8}}, {0xfff7, 0x0, {0x0, 0x1}}, {0x3, 0x4, {0x3, 0x81}}, {0x40, 0x4, {0x3, 0x6}}, {0x7, 0x5, {0x1, 0x3}}, {0x70, 0x8, {0x2, 0x4}}, {0xfffb, 0x8001, {0x2, 0x7f}}, {0x2, 0xffff, {0x2, 0x8001}}, {0x0, 0x3, {0x3, 0xffffffff}}, {0x8, 0x4, {0x3, 0xb4d}}, {0x5, 0x86, {0x3, 0x6}}, {0x6, 0x1000, {0x2, 0xe90b}}, {0x7, 0x8, {0x2, 0x7fff}}, {0x1, 0xffff, {0x2, 0x4}}, {0x9, 0xe1e, {0x2, 0x4}}, {0x9, 0x0, {0x0, 0x800}}, {0x4, 0x1b0, {0x2, 0x3}}, {0xfffa, 0x3, {0x1, 0xeb0}}, {0x316, 0x6, {0x2, 0xffffffff}}, {0x5, 0x7, {0x0, 0x6}}, {0x81, 0x7ff, {0x2, 0x8000}}, {0x200, 0x463d, {0x1, 0xf29}}, {0x1, 0x3, {0x0, 0x101}}, {0x101, 0x4a00, {0x1, 0xa12}}, {0x101, 0x7, {0x1, 0x6}}, {0x8, 0xfff8, {0x1}}, {0xff, 0x400, {0x0, 0x20000000}}, {0xffff, 0x2, {0x2, 0x5}}, {0xffa2, 0xfffe, {0x2, 0xffff}}, {0xff, 0x9, {0x2, 0x80}}, {0x6, 0x4, {0x2, 0x66c}}]}}}, {{0x254, 0x1, {{0x2, 0xfffffffc}, 0x80, 0x3e, 0x5, 0x4, 0x1c, 'syz1\x00', "3f931c559564ad417ef9b927c2bdb9e9eaf02c34e4fdb13bb3d2b5973a45d616", "76edc514553679e155ad0fdf75bc9d60c55d1b8ee6b7b4dc1fd65622328988dc", [{0x200, 0x101, {0x0, 0xef9}}, {0x9, 0xc, {0x1, 0x7}}, {0x6, 0x5, {0x3, 0x7}}, {0x42b2, 0x3, {0x0, 0x3}}, {0xec80, 0x8, {0x1}}, {0xfd84, 0x0, {0x0, 0x7}}, {0x5, 0x400, {0x1, 0xf0e0}}, {0x1, 0xe7, {0x0, 0x7}}, {0x9, 0xa222, {0x3, 0x7}}, {0x2, 0x5, {0x1, 0x7f}}, {0x8000, 0x0, {0x0, 0x2}}, {0xb, 0x8000, {0x0, 0x10001}}, {0xffff, 0xfffc, {0x0, 0x5}}, {0xfff, 0x6, {0x3, 0x209}}, {0x1, 0x800, {0x1, 0x5}}, {0xdc, 0x3, {0x3, 0x1}}, {0x6, 0x5, {0x3, 0x2adb}}, {0x800, 0x40, {0x1, 0xfff}}, {0x2, 0x1, {0x3, 0x9}}, {0x1, 0x241, {0x3, 0x9}}, {0xea, 0xb, {0x2, 0x40}}, {0x6f1, 0x19f, {0x3, 0x400}}, {0x5, 0x8, {0x3, 0x6}}, {0x1, 0x1, {0x2, 0x1}}, {0xab4, 0x200, {0x2, 0x3}}, {0x7, 0x6, {0x3, 0x521c00}}, {0x9, 0x8, {0x2, 0x3}}, {0x1, 0x6, {0x1, 0x2b9f}}, {0x698, 0x6, {0x3, 0x2}}, {0xb4, 0x0, {0x0, 0x6}}, {0xfff8, 0xe82, {0x0, 0x2}}, {0x7, 0x1, {0x1, 0xffffffc0}}, {0x3, 0x200, {0x1, 0xdd071be}}, {0x66, 0x5, {0x0, 0x401}}, {0xb, 0x1, {0x0, 0x6}}, {0x7fff, 0xe3, {0x2, 0xa}}, {0x0, 0x5, {0x3, 0x2}}, {0x8, 0x9, {0x2, 0xc96}}, {0x2d, 0x7, {0x1, 0x2bd}}, {0x7, 0x4, {0x3, 0x4}}]}}}, {{0x254, 0x1, {{0x3, 0x400}, 0x8, 0x7f, 0x8, 0x9, 0x24, 'syz1\x00', "8486ad327bedca24bd281175a104c6ae6743a8cc36eb3b35fa5cb1c3a4f0be2e", "69608bb79d9c7a38578cc2128d10bb9e2825a3dd113d2ec738e78de0a3a6dbe7", [{0x9, 0x4, {0x3}}, {0x1, 0x4, {0x2, 0x18764d9a}}, {0x1, 0x8, {0x3, 0x308c4}}, {0xf801, 0x1, {0x1, 0x1}}, {0x7, 0x1, {0x3, 0xfff}}, {0x80, 0x80, {0x0, 0xc77a}}, {0x7, 0x4, {0x0, 0x200}}, {0x7, 0xfffa, {0x3, 0x5}}, {0x6, 0x9, {0x0, 0x1}}, {0xd, 0x0, {0x0, 0x400000}}, {0xa906, 0x3, {0x3, 0xfffffffe}}, {0xff, 0x4, {0x1}}, {0x7, 0x1, {0x0, 0x8}}, {0xf, 0x4, {0x1, 0xffffffff}}, {0x13f, 0xfff7, {0x1, 0xb}}, {0x9, 0x2}, {0xa4, 0x3, {0x2, 0x72a}}, {0x5, 0x100, {0x1, 0x8}}, {0x5, 0x401, {0x3, 0x1d4}}, {0xf088, 0x1ff, {0x2, 0x2}}, {0x40, 0x19, {0x0, 0xb7}}, {0x1, 0xfff8, {0x3, 0x3}}, {0x0, 0x401, {0x0, 0x10}}, {0x5, 0x3, {0x2}}, {0x0, 0x3, {0x0, 0x23}}, {0x7, 0x0, {0x0, 0x4}}, {0x9, 0x0, {0x3, 0x21}}, {0x6c04, 0x3ff, {0x2, 0x9c}}, {0x0, 0x3, {0x3, 0x80000000}}, {0x6, 0x1000, {0x2, 0xfffffffc}}, {0xad, 0xcc, {0x2, 0x400}}, {0x9, 0x3, {0x1, 0x2}}, {0x1, 0x130b, {0x3, 0x3}}, {0x9, 0x8b9, {0x2, 0x3}}, {0x0, 0x5, {0x2, 0x10}}, {0x9, 0x6, {0x0, 0x80}}, {0xd, 0x5, {0x2, 0x5}}, {0x0, 0x0, {0x2, 0x8001}}, {0xf83f, 0xef92, {0x0, 0x2}}, {0x6, 0xb, {0x3, 0x6}}]}}}, {{0x254, 0x1, {{0x0, 0x7}, 0x7, 0x4, 0x0, 0x400, 0x1, 'syz0\x00', "0a40e9212d6d4a314bc5080564634431d58684ef8877aca05d8fc5f77d608047", "bb65ad745e467504b137cc37a84a38635f27cee5d1e0e8fd31732798a0bdb0ea", [{0xff04, 0xeed9, {0x1, 0x1}}, {0x6, 0x7, {0x1, 0x4}}, {0xd1, 0x9, {0x2, 0x8}}, {0xfff1, 0x8, {0x3, 0x8000}}, {0x8, 0x8, {0x1, 0x10000}}, {0x7, 0x7, {0x3, 0x8000}}, {0xaf4, 0x5, {0x0, 0x5e9}}, {0x9, 0x4, {0x1, 0xb}}, {0x100, 0x401, {0x2, 0x1}}, {0x200, 0x18e, {0x3}}, {0xfffa, 0x0, {0x3, 0x2}}, {0x0, 0x8, {0x3, 0xffff}}, {0x2, 0x8, {0x1}}, {0x8, 0xa, {0x3, 0x546}}, {0xfffb, 0x7, {0x1, 0x6}}, {0xbda, 0x1ff, {0x0, 0x400}}, {0x1, 0xe, {0x2, 0x9}}, {0x3, 0x0, {0x0, 0x5}}, {0xc5, 0x1, {0x0, 0x5}}, {0x9, 0x8, {0x1, 0x7ff}}, {0xfff8, 0x8001, {0x0, 0x200}}, {0xda, 0x0, {0x2, 0x4}}, {0x7, 0x81, {0x2, 0x3}}, {0x2, 0xa, {0x0, 0x8}}, {0xffff, 0x3, {0x2}}, {0x5, 0xebd1, {0x2, 0xb7}}, {0x9, 0x2, {0x3}}, {0x8000, 0x58, {0x0, 0x2}}, {0x8, 0x0, {0x1, 0x6}}, {0x0, 0xec, {0x0, 0x6}}, {0x4, 0x2, {0x0, 0xf}}, {0x800, 0x0, {0x2, 0x3}}, {0x9, 0x6, {0x2, 0x3}}, {0x9, 0x8a97, {0x2, 0x8}}, {0x80, 0x100, {0x2, 0x8}}, {0x401, 0x3, {0x1, 0x100}}, {0x5, 0x0, {0x3, 0x2}}, {0x2, 0xef7, {0x1, 0x1}}, {0x8, 0x0, {0x2, 0x9}}, {0x3ceb, 0xba, {0x0, 0xffffa326}}]}}}, {{0x254, 0x1, {{}, 0x6, 0xfc, 0x7, 0xd, 0x0, 'syz0\x00', "47a0813872a9649435fac2ea869fa7accfb13a3f3ea9f6a292e7f9badb16080c", "ec7dc7c67838d1e97d21a3e6f27092591876293e99dfbbe1313b026a17031471", [{0x3, 0x2, {0x3, 0x9}}, {0x6, 0x8, {0x3, 0x4}}, {0x162, 0x3, {0x3, 0x4}}, {0x9, 0x3, {0x1, 0x4}}, {0x76, 0x9, {0x1, 0x3}}, {0x40, 0x0, {0x0, 0xd}}, {0x5, 0x6, {0x1, 0x9}}, {0xb, 0x7, {0x2, 0x100}}, {0x1, 0xfff, {0x1, 0x7}}, {0x4, 0x1, {0x0, 0x9}}, {0x101, 0x13f3, {0x1, 0x101}}, {0x8, 0x6, {0x3, 0xc}}, {0x7, 0x6, {0x1, 0x9}}, {0x8, 0x2, {0x3, 0x3}}, {0x5, 0xa, {0x3, 0xe}}, {0x8, 0x6, {0x3, 0x1000000}}, {0x9, 0xf2b7, {0x1, 0xa}}, {0xed, 0x0, {0x2, 0x6}}, {0x10, 0x3ff, {0x1, 0xb256}}, {0x6, 0xb}, {0x1, 0xc, {0x1, 0x7fffffff}}, {0x3dfb, 0xa, {0x3, 0xf}}, {0x7, 0x0, {0x1, 0x4}}, {0xffff, 0x7, {0x3, 0x6}}, {0x8000, 0x7, {0x3, 0x4}}, {0x0, 0x8, {0x2, 0xffffff3d}}, {0x17d, 0x6, {0x2, 0x33}}, {0x0, 0x9f, {0x2, 0xf3cb}}, {0x7, 0x1, {0x2, 0xb}}, {0xfffb, 0xaa6a, {0x0, 0x3ff}}, {0xeb, 0x40, {0x2, 0x9}}, {0x4, 0x200, {0x2, 0x8a7}}, {0x8, 0x7f, {0x3, 0x272}}, {0x8, 0x7fff, {0x2, 0x10}}, {0x2, 0x2, {0x0, 0xfffffffd}}, {0x7715, 0x8, {0x0, 0x8001}}, {0x0, 0xf95e, {0x3, 0x3}}, {0x4, 0x7fff, {0x3, 0x8}}, {0x8001, 0x8, {0x2, 0xebb4}}, {0x8001, 0x2, {0x2, 0xa}}]}}}, {{0x254, 0x1, {{0x1, 0x4}, 0x6, 0x80, 0x5, 0xc, 0x8, 'syz0\x00', "9c9db53e989146275198f61b954bde4c319aa44ac27a2ee880b6a9617b1cd520", "21181cac6f4046a3059f1116549f67c1b7ce7b13d2eaccd9c1b6cc8a299a98af", [{0xe0, 0x2, {0x0, 0x1}}, {0xfff, 0x101, {0x1, 0x7fffffff}}, {0x400, 0x9, {0x0, 0x4}}, {0x4, 0x4, {0x3, 0x2}}, {0x9, 0x81, {0x1}}, {0x4380, 0x32, {0x3, 0x1}}, {0xe, 0x8, {0x1, 0x1000}}, {0x1e2d, 0x6, {0x1, 0x9b70}}, {0x3, 0x8, {0x3, 0xffffffff}}, {0x7, 0x5}, {0x8, 0x23, {0x1, 0x1}}, {0x8, 0x1, {0x2}}, {0x80, 0x1ff, {0x1, 0x6}}, {0x1, 0x4e21, {0x3, 0x1}}, {0x0, 0x2, {0x3, 0x5}}, {0xf1d, 0x9a, {0x0, 0x6}}, {0xce, 0xffff, {0x2, 0x3ff}}, {0x3, 0x4, {0x1}}, {0x0, 0x8, {0x3, 0x9}}, {0x6, 0x2, {0x1, 0x6}}, {0xe04, 0x0, {0x2, 0x3}}, {0x2b83, 0x3, {0x2}}, {0xd397, 0xda0c, {0x2, 0x3000}}, {0xff0f, 0xb, {0x1, 0x1}}, {0x0, 0x3b4c, {0x0, 0x14}}, {0x9, 0xfff9, {0x0, 0x8d7b}}, {0xe, 0x9, {0x0, 0xc705}}, {0x0, 0x1b, {0x3, 0x5}}, {0xb5e, 0x3, {0x1, 0x3}}, {0xc, 0x2, {0x0, 0x3}}, {0x1, 0x4, {0x2, 0x80000001}}, {0x8, 0x5, {0x2, 0x1000}}, {0x40, 0x2, {0x3, 0x38a6}}, {0xd, 0xfffe, {0x0, 0x5}}, {0x3, 0x10, {0x1, 0xf925}}, {0x5, 0x8, {0x0, 0xfffffffe}}, {0x4, 0xb13, {0x3, 0x4}}, {0xfdf9, 0x4, {0x2, 0x7f}}, {0x2, 0xcfe, {0x0, 0x355}}, {0x7, 0x6, {0x2, 0xd}}]}}}, {{0x254, 0x1, {{}, 0xfb, 0x1, 0x6, 0x2, 0x28, 'syz1\x00', "c64d75524587d08c68e063e3f65cf1012bd728c71e41fca0c7b307c01923f083", "745043dffa7b12911898941b6f242d478493ff057780ee02543a55706702d384", [{0x4, 0xff, {0x0, 0xb8}}, {0x1, 0x7f, {0x2, 0x1}}, {0xb6b4, 0x3, {0x3, 0x3}}, {0x2, 0x7ff, {0x3, 0xe42}}, {0x101, 0x0, {0x2, 0xffffac63}}, {0xc, 0x4, {0x1, 0x401}}, {0x4, 0xf, {0x3, 0xd}}, {0xfffe, 0xd42, {0x2, 0xb}}, {0xfff8, 0x8, {0x3, 0x9}}, {0x1, 0x5, {0x0, 0x4}}, {0x100, 0xc, {0x2, 0x8}}, {0x7, 0x9, {0x3, 0x3ff}}, {0x65, 0x7}, {0x5, 0x6, {0x3, 0x1ff}}, {0x5, 0x8001, {0x2, 0xe}}, {0x10, 0x200, {0x0, 0x9e}}, {0x7, 0x5, {0x1, 0x5}}, {0xd, 0x9300, {0x3, 0x5}}, {0x5, 0x1200, {0x3, 0x3}}, {0xd, 0x2, {0x1, 0x8}}, {0x8, 0x10f0, {0x3, 0xfffff5a4}}, {0x8, 0xc, {0x0, 0x7}}, {0x4, 0xfff, {0x0, 0x3}}, {0x1a6, 0xffff, {0x3, 0x6}}, {0x5, 0x1, {0x1, 0x70}}, {0x352, 0x101, {0x0, 0xa}}, {0x8a2, 0x6, {0x3, 0x7}}, {0x9, 0xe8f, {0x0, 0x401}}, {0x2, 0x77, {0x2, 0xf8}}, {0x49c, 0x983, {0x0, 0x1}}, {0x7, 0x9, {0x2, 0xfffffff7}}, {0x9, 0x8, {0x3}}, {0x7, 0x2, {0x1, 0xfa1}}, {0x0, 0x2b, {0x2, 0x6}}, {0x3e, 0x1ff, {0x2, 0x2}}, {0x0, 0x7025, {0x0, 0x1cd0}}, {0x1, 0x0, {0x0, 0xfe000000}}, {0x5, 0x800, {0x1, 0x5}}, {0x2, 0x5, {0x3, 0x4}}, {0x2, 0x1, {0x2, 0x4}}]}}}]}, 0x1060}, 0x1, 0x0, 0x0, 0x8000}, 0x80) setsockopt$SO_VM_SOCKETS_BUFFER_MIN_SIZE(r1, 0x28, 0x1, &(0x7f0000001340)=0x7, 0x8) setsockopt$IP6T_SO_SET_ADD_COUNTERS(r1, 0x29, 0x41, &(0x7f0000001380)={'filter\x00', 0x3, [{}, {}, {}]}, 0x58) ioctl$sock_SIOCDELDLCI(r1, 0x8981, &(0x7f0000001400)={'ip6gre0\x00', 0x40}) r3 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001840)=@bpf_lsm={0x1d, 0x29, &(0x7f0000001440)=@framed={{0x18, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x6}, [@btf_id={0x18, 0x3, 0x3, 0x0, 0x4}, @ringbuf_query, @map_val={0x18, 0x9, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0xfffffffa}, @map_fd={0x18, 0x1}, @call={0x85, 0x0, 0x0, 0x7a}, @btf_id={0x18, 0x9, 0x3, 0x0, 0x1}, @map_fd={0x18, 0xa}, @kfunc={0x85, 0x0, 0x2, 0x0, 0x2}, @snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x8000}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, 0x1}}, @ringbuf_output={{}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x66b}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}]}, &(0x7f00000015c0)='syzkaller\x00', 0xc, 0xe8, &(0x7f0000001600)=""/232, 0x40f00, 0x17, '\x00', 0x0, 0x1b, 0xffffffffffffffff, 0x8, &(0x7f0000001700)={0x9, 0x2}, 0x8, 0x10, &(0x7f0000001740)={0x0, 0xc, 0x5, 0xfac}, 0x10, 0x0, 0x0, 0x7, &(0x7f0000001780)=[0x1], &(0x7f00000017c0)=[{0x2, 0x2, 0xf, 0x3}, {0x0, 0x1, 0xe}, {0x4, 0x3, 0x0, 0xc}, {0x5, 0x3, 0xc, 0x6}, {0x4, 0x1, 0x7, 0x5}, {0x3, 0x1, 0xb, 0x5}, {0x1, 0x3, 0x2, 0xc}], 0x10, 0x7ff}, 0x94) setsockopt$sock_attach_bpf(r1, 0x1, 0x32, &(0x7f0000001900)=r3, 0x4) sendmsg$nl_netfilter(r2, &(0x7f0000001a80)={&(0x7f0000001940)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000001a40)={&(0x7f0000001980)={0xa0, 0x5, 0x3, 0x301, 0x70bd28, 0x25dfdbfd, {0x2, 0x0, 0x7}, [@generic="674b78c6b1b9b324883078e242ea350a3b05e763553b6b170e358db7480294894b3247bf2a0aa85280e4c16f4ab3e6be360cd05767bfa4f45b9c241c647fc930aed04e5da92c7cb2da2383613294d870d3c5773ff9a2908093373414b7b3df3142ad33ce02c259e92273ca6e9e71dd3d29e778ef00e16b3721e2d3124754e9a7658e3f023cbc7526e268"]}, 0xa0}}, 0x20000000) setsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX_OLD(r1, 0x84, 0x6b, &(0x7f0000001ac0)=[@in={0x2, 0x4e22, @loopback}, @in6={0xa, 0x4e21, 0x5, @remote, 0x20}, @in6={0xa, 0x4e22, 0xffff8000, @empty, 0x9}, @in={0x2, 0x4e24, @multicast1}], 0x58) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000001b40), 0x282400, 0x0) ioctl$SIOCSIFHWADDR(r4, 0x8924, &(0x7f0000001b80)={'veth1_to_bridge\x00', @random="e0ba2c94a2e0"}) ioctl$AUTOFS_IOC_ASKUMOUNT(r2, 0x80049370, &(0x7f0000001bc0)) r5 = syz_genetlink_get_family_id$devlink(&(0x7f0000001c40), r1) sendmsg$DEVLINK_CMD_SB_POOL_SET(r1, &(0x7f0000001d40)={&(0x7f0000001c00)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000001d00)={&(0x7f0000001c80)={0x54, r5, 0x10, 0x70bd26, 0x25dfdbfd, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0xb, 0x8}, {0x6, 0x11, 0x2a0}, {0x8, 0x13, 0x7}, {0x5, 0x14, 0x4}}]}, 0x54}, 0x1, 0x0, 0x0, 0x10}, 0x10) ioctl$NILFS_IOCTL_CLEAN_SEGMENTS(0xffffffffffffffff, 0x40786e88, &(0x7f0000001f80)={{&(0x7f0000001d80)=[{0x7fffffffffffffff, 0x7e4, 0x9, {0x1, 0x4ea3}, 0x1ff, 0x6, 0x2}, {0xfffffffffffffffd, 0x6, 0x1, {0x7, 0x4}, 0x6, 0x8, 0x1}, {0x2cad00, 0x10001, 0x8000, {0xd990, 0xfffffffffffffffd}, 0x4f7, 0x2, 0xb}, {0x5, 0x9, 0x10001, {0x81, 0xc}, 0x8, 0x3, 0x3}], 0x4, 0x40, 0x2d1, 0x101}, {&(0x7f0000001e80)=[{0x8, 0x200}, {0x3, 0x8000000000000001}, {0x7}, {0x1, 0x2}], 0x4, 0x10, 0x7, 0xc}, {&(0x7f0000001ec0)=[0xfffffffffffffffa, 0x5e], 0x2, 0x8, 0x5, 0x9}, {&(0x7f0000001f00)=[{0x9, 0x1, 0x6, 0x1, 0x9}], 0x1, 0x28, 0x1a2, 0x1}, {&(0x7f0000001f40)=[0x0, 0xffffffffffff1dd0, 0xffffffffffffff80, 0x8, 0x3, 0x6, 0xf5b2, 0xe000000000000000], 0x8, 0x8, 0x5, 0x7}}) r6 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000002000)={0x1b, 0x0, 0x0, 0x9, 0x0, 0x1, 0x10000, '\x00', 0x0, r0, 0x5, 0x3, 0x5}, 0x50) getsockopt$inet_mreqn(r1, 0x0, 0x20, &(0x7f00000021c0)={@broadcast, @remote, 0x0}, &(0x7f0000002200)=0xc) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f00000022c0)={0x8, 0x0}, 0x8) r9 = bpf$PROG_LOAD(0x5, &(0x7f0000002380)={0x1c, 0x13, &(0x7f0000002080)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x2}, {{0x18, 0x1, 0x1, 0x0, r6}}, {}, [@kfunc={0x85, 0x0, 0x2, 0x0, 0x4}, @map_idx_val={0x18, 0xb, 0x6, 0x0, 0x5, 0x0, 0x0, 0x0, 0x7ff}, @kfunc={0x85, 0x0, 0x2, 0x0, 0x5}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000002140)='syzkaller\x00', 0x200, 0x17, &(0x7f0000002180)=""/23, 0x40f00, 0x1, '\x00', r7, @fallback=0x31, 0xffffffffffffffff, 0x8, &(0x7f0000002240)={0x7, 0x5}, 0x8, 0x10, &(0x7f0000002280)={0x3, 0x8, 0x7, 0x3d}, 0x10, r8, 0xffffffffffffffff, 0x8, 0x0, &(0x7f0000002300)=[{0x0, 0x5, 0xa, 0x7}, {0x4, 0x3, 0x2, 0x8}, {0x1, 0x2, 0x2}, {0x0, 0x3, 0x5}, {0x0, 0x1, 0xf, 0x2}, {0x4, 0x5, 0xd, 0x6}, {0x3, 0x3, 0x4, 0xc}, {0x5, 0x1, 0x0, 0x2}], 0x10, 0x10000}, 0x94) getsockopt$bt_BT_SECURITY(r1, 0x112, 0x4, &(0x7f0000002440), 0x2) ioctl$BTRFS_IOC_QUOTA_CTL(r9, 0xc0109428, &(0x7f0000002480)={0x1, 0x8000}) sendmsg$nl_route(r1, &(0x7f00000025c0)={&(0x7f00000024c0)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000002580)={&(0x7f0000002500)=@ipv6_deladdrlabel={0x44, 0x49, 0xc00, 0x70bd2d, 0x25dfdbfb, {0xa, 0x0, 0x0, 0x0, r7, 0x8}, [@IFAL_ADDRESS={0x14, 0x1, @private1={0xfc, 0x1, '\x00', 0x2}}, @IFAL_ADDRESS={0x14, 0x1, @loopback}]}, 0x44}, 0x1, 0x0, 0x0, 0x20000004}, 0x4000) socket$unix(0x1, 0x5, 0x0) ioctl$SIOCSIFHWADDR(r4, 0x8924, &(0x7f0000002600)={'veth1_to_bond\x00', @remote}) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(r1, 0x84, 0x6c, &(0x7f0000002640)={0x0, 0x1000, "03d8a696ecfd9943f6aad16a51e112306466f3e87fb4d26c2b4049d4d5eb3f50776271816de570a68bc160a14a5e56caa50d46c41daf05d62819824d9a4869f42c8a4c6e0927c78dad58912fba101ee6b6b70777ed355d43b928e6d43227fc00a45acc393a79f965d1884704e64b3ca68fd6a539fa35f7853c8e01142f0d756b70d1246daa1f7e20c9a39cef12592cc94881f24e1f5687485b0432ce52080dbe079a791e282a8bc255824d61c3e09680c92490ed33bdbc7996f3c97c739e755527e3f480514156f2090821ff8517b8954304ee32a4569f5315d4d5204609c473b53c8e7e7e092e95009381f497084bd14a68bd147f4df2d091f222dbe75760f4cde115388dfd15ab0131fd068a988525a26aace89c1b501b64e99b9f5452b37c0ced9ec01a18be89b858186225592eca64d6e1668ed34e7ac3e8b21fe761562a1ec4b2f232db94eaf731f7c17a805f0e2e936fe9da18b8cf08dcd295d3267021b6d1040f9febcdc40f76873e67547816bd4b9ee6e6be642e21cd798ac2704c2cc0120d3901326a86271a90975ad6e785067c3d416bb96816896f31c21be5a2b396bff28b345f350e7770bed11b59bfca6b070befb07edb57cc69a1b6eb368cad2f4aca21484cf41e6481c07bdd3f6440e70c65b9a9c1ee66133a573bbb834c0fc478dc88227ddc3b8c9bc6a51c6692329fabc8b5871463f2d9734c5d3e8a2bebb6d7191ef422b912e64aa176b78d20d956b0f839bbc1a71621d1974affc12341c1c0b516c866d60f4eb80fb6519f0e6f203715316880305c6dba7b11c4be28383a327a67cf72fa34820796acd88fac6afd8601e6b75ef36ffbf379d32ec79062e6d5295be6745cae7ad9472377e557d588aaba84c37258f905594b5c29a6a4f0782ecd0bcb5765f0ef826ec4e9183af23907d62be90709939faa672adfc4ca140f53eb47683247156f1b9fecd33acb586a9d37e0c092a3ee365e45f1f9185a632438404568aae4addf136e880228dc1b84d584c55740d130ad6595f08853aad4110c7a0fd928e1b809b0296a94e84c9491b6c6fcdeaac5383fbf6918ad2a2599cc18caf0df13d7b97426d50f3dd50bf41046c54ddbb09b5006b0c714142ce348bd4b304a7b12b4b11e42d11c62b8576746aff25a6d68b9ebe323d856c01513c4acaeb5943b971630efefaf13190f9072a0f847fab4c2428b27a5e27d043983794c12be8ee3cc09f5a0f9fa036cb3ed33cd92bec677378fc19816799c762a6163c3266ad49c82fb10511ebb70b6577109c75a955bdf19d129d9a2a256253f4358b7ebf908067df100c4976ce1aa3fd2f8a87f3cc660200250f242b17213445b82296facd6cb8e56b365be9cac46712f17aec31e2704cdd8067a599e30f84e549c2d910e85f8c1c6f94b3dfcf0c670d8b1514f4de5c9413f6b283b72444f369be2548342fb5b14b83ca9fe9185716cf490a1d8077b6fbb6aa32315dcc146ca823a3edb670d99cfcf00d1c62ca453796dca542205da0b6978c7eb767d8c9faec71bdf223714d749a34686a9c9f5bd5247b37074643da89f89efa43c4dee9d44fb464ab9163c1c6ed429d6c81b9a0b2413d929454c7a508be22bc63844f9c590f5aef382a9862c4d46dd79a7ccca3c8499829bd858d355ccde69cbcd2f802fde8fac3c41c164cdd94e53306f4e7be5d2aa41deb8d2b067faededf43e6a9ba93ba2b8cdd1da233abccf7c2a3a6628576a19e32ce4f3704823875c0db01bc553ea61a8457bcfea7e6abdc788e91d874933418ea304bcf88d015466a3b267dcb59085e8053d97b5171157ae87c727467e1b8f06808b64028dff03ef9aeef08a9ecbd019c9e21e7025536949b6929edeea22e60610c2a0be4d6b007c6667b6b5f8fe4d7fd6cf32de02ed22827815e01275ec4358d2a51e16bf9c82e305f0c1761fe2ec14cc3b6444508059fd15794c8ac3a9390b8d0f06f2ecb8bfdbd99ddd2fc7ee6dd1255a8fc78d043c016d9755a6b11cf73b5de5dd16efe6382a0152fe8de04f494531506d946a6bfdce587ae0498fbf512fa5843b7626106576f913ed52b4694bf6549d46b57d71ef8ee6ee42d74e966e6f4b8b98515bc97e6792a3d6dc52b9cedd0a96b88ff24334d87ac821d11cc5f42802dad6ae04509497692a4043c78c8bf87a9d0dc3767e0119fd1093121b87882d674103f7d51a614af1383a3b8ada9db9752d612f91e4b268ad379a36fbcde27edce709233dfd59e3a255c3962d3ebf14981f48988014644bba62587c26d0af9fcf23b4fb2041594abdea5a304910cf98dc14a07a2a77d92be2967533e314738decd4b6d3ffba237c13f23b935546e378e6f41ca0c2bcb890a1054231a934b8c2f42a349a3105cc2877eb24f5557937d65e94fab460932cbfd4ca47bbe02803baba958d1633f35ba20aa5687e8e8a059be9bbc058e4fb393b3f14adf877c843743ba0179640609cb6c72ae70767444461f2f512c59fa2a7f80f5f6e1261ec3b69b6626a0e5cd0acffa6a94950b0ac71306ac43fa48852a4c506b8a5251571cd6ab14c4e74be636bf55868ab3d4ebe4056ff42653db4a5968b84576091a6a4bec99d689daa531840bf19c8fcee215d7528f9abd1888efbc5e2cdc0dc0cc96fcd63185517d59ad57a08fe223f0d0dabb8b4dc66d9cc0c78f0e011e530d84cd8174f2340162e792d677419d32113feb32d3c6f0a44dc276804da0eb2d125b53b4df43b87b36a0bc3391ff858bb3a2ff7b48f91260837885388443d58fd9ae199d1097c7dabb951e27732af9541679ecc3ccff51ed9de968cf1701b57302c27c79692aaf0aead10a3d613d81c4474e6e49a68cfca67a49b7d610a4e1cd199235f7fa247d00b01abd7cca84a0dec4f62aa326dba23f6d5795a9e047986f3d80f01dc16b4a63b65b5edc99dd8f30a5a8f60682108f801cbe6adf252e49b3ffad3bc2e8ce19794c107320c292f5a33b34a7581c86056f890ed87f1ba883a9a19b315867803d059d5d822922e0c0d03a4995568470026188d549cef771892345b9595d820f6e05eafe66ec2e1194b20bbb3e9918d7c8570a8122c9615abb4091ce0e1310924792e82da814ca72fd148ff64754fe6138320347e6f0ff38151d5e10bdf9683b346222978e19d452f978947abb131ae1d1df7d5302a0e59c924c8247b125a28a3acf2d998ba09056357ea85720b407d87c7907069c93478191a4eeda99fa78e92046598aa67a6d9f5721226125b36dd3741856c94d896a07392c8cc776565ec0248392ac9d4fca9aae2048163159cc5d274fe2061ef2808b285eb8223d2d5a4c11f8f422b8264b97ccba3a73e181e2081f35c3363ae2b1b889e6d949f86df372bcb6454609a879764d18b4ac52545f03d4275e2287de799e7b233181566c019944f9bd6f1c09248e0c4cf8219d5ecd8625c1d12547dfa46387addc65f71b32ff51a2fc3c052ebb0dda7a22a7a56092bb4f601bc7d9f631a670cde126e31d8673b2a59ba09f8780d16c15ee28cc39373ea8c122fa169c2af2b6070d51fc20054ee344b7103989e272dea37c7d7a84ec933e8881a429d9417b7357ca0c0c0ff7b043b319b33a3e82dd0d4557ee45d2e38b59b3bedec32ace332f30df4bfe464b25be2fad64e0b0a4536b4fa6699b3355a0bdc27d0b6ba451801da0e2c49faa847b680210fc438030124f6fad267bd3ba46f29c42abf8d8db2d64d65c707bebb65f18cf5070a3057762875edcf3fd1f39a5a22a0deafff9f001d57aa9b4ca23bfa9778a82bcff11abf8cf10dc2797e88c812961a8184e31276e320bea33f4861cd6ff61d254560a62aa06c2d283ce03a1485edaa1d4ab10d74eb78c1554000cf0dfc0eccdade10ce70276ab07768d679d98d53b7ae56f970909f4b1cf37865e48953483bf99e634adbfb4c1b24beb14f7dd95edc5d9e9aad4adb360718a809b27342616a629b8e44c4e90035e0150fa612ff256faf0b42976a7ea6b5605d7be1e17ed7c5b4cf8978db7bbb3ab8a5f09282cf52b82a015d65d36affd97678f3dcd907feb6bf8ac0c0a96feb5f80378977300e46f18bd9f9b01c1c73e4a3710e4bcea8d4c26f9266678325e87478223d9cf2a676f88adfa1d1cb08f1426435a4bef6e2944c69b3aba949e222d90db0e9680e6e95990a1af8f9cc45787430954e224ae8a1d84604e89d8f4286c8fdbb5d69e2c1cc2980d4707c2fc80d01ccae1b1765dfea420bb7d149714577c2877a86f10c5072f0f457c5a9b5225b83c6de28f00d28282aa86ee84151556ece36c9643d46e6715b8f7798a98355d8127a9572e1459809229db08a4a8af27d61816fb2356669441ee802ffa9acd1c813a312ee77e13d59e079a88350ad2cdd884223f0eecb6d9107671d9139a33cec915a7aa54581b61ac4bbc3a08492bea2c6b11ec7bd10c18f18f85d1fd878dfec8c204137057c6b3fe1242ec12681f171f1c901a046016ae4c2aea13f49997632dc335d87f0f7d5a04c4796eae707800357db186bffc9d30a650324f9c4aa24f14f220759301e8f90a55d421dfa1ec33f4bdbedd0f39273accc98d4919b74dca74dcfbc77c35a6fb6d434b12ce6a5a4b6dd419ea2b5728780c8f10b56d267c9ef120f29b6808885f89dc0e6718536a72f1dfc4466f002a343aaae8c805e247114120d7e2a32ad3d0396a0f01dc24aef82004f5bcf87663343266d4ebdfe3603b3d3a2823ebf3175351efcf9d06fd016813f7b7a8cc80535f40736721814eff849d001a8087a4213a88ba5cb686c34f05710500cca231fe09378625670ea60c9c5ba6fbad13b00722cf2b487a1e4c17814cda22fe74a04a1dbefed67c52ca527a7d14e44e282c5d82f9891381a1bc555b1ea8224ef09bf4a8dcb4ea5fbbe51075979d0cff44406c789c9f0c3e5a33396837286ac7e893f64801c7e56f23a1691a8e3bde9399e9c67361b5ffe3b14c15d511f700c586969d06840b4d682f7ef96e71a12e55c999807d4ea7c9db5a0b589a2fdc3f891c5ef1e1e03b8b9e03ecaaf1b60b34a67b0d8a47c8aae972a10a1ab3912cd6be70df37966846a116c4d8a58f14faf6a73356651754edd3f982f44adc63a4d28734a0fa4662a75c2a285922b9a471da36b99f12d5f9d751fb469695ec77f9a65e64e60b36f38023d75ebc10c03d2a6c2ed0fbb28023028eca1fadcde2b472a21f037a4449014f4b3304eb5898cb8df90a6c9875d81549770b7725882afe9f53f33aeef57e096b62271be57b1e60c65286a71c0da0e498eee2a8e7cf3cd0a98988c050696e081270f9b5d821f23a3b3beb1fbf57f46a44a407d732b878271e45d303b098029e4bd9e48d58bf33a857cf7fc503f0a1db0d69ebd8a77f3eec2337de5266ca26cd80f76615fc4a6d9c5041c29af5480c37b45d6b3fe020afaf64e833ef9248570145e3f339eed48f909ce452e427daa4d9b3596f811f2403532ee521fe5bde71a675a3411fff934bfd56404a8fccf08412710e747d92cc149968c83946d3d35d80e2af67ed8db7e70d4fec597938b64490f2820ffbfdb440d522d75495442fe4e6f7fe6ebd7fe8fb1cdca68e122adda628c0dc522006436c907326c59abfe7c64b8c7b084a76ba153b192fdba75c298e285621e8fa5aeafc136182f4b89525452719ffed88a5842ae3cc569d38d7732889408c8f45dd696edc5d39b08b59dd06e330c0f6d229bd258d1b5c7dff6133819bb1dd8b90d2b3ddebca96c01bc9accd66b55d25d0f91d16cbe9227c2ebedf66c5d9bf41994f64818607183a66814"}, &(0x7f0000003680)=0x1008) getsockopt$inet_sctp_SCTP_STATUS(r1, 0x84, 0xe, &(0x7f00000036c0)={r10, 0x8, 0x4bc, 0x4, 0x9, 0x3, 0xe, 0xf4, {0x0, @in={{0x2, 0x4e24, @initdev={0xac, 0x1e, 0x1, 0x0}}}, 0x3, 0x2b3a, 0x4, 0x2, 0xd48}}, &(0x7f0000003780)=0xb0) syz_genetlink_get_family_id$nl80211(&(0x7f00000037c0), r3) 1.809383865s ago: executing program 3 (id=15614): r0 = socket$inet6_icmp(0xa, 0x2, 0x3a) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000000c0)={'vxcan0\x00', 0x0}) r2 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCETHTOOL(r2, 0x89ff, &(0x7f0000001440)={'bridge_slave_1\x00', &(0x7f0000000000)=@ethtool_modinfo={0x42, 0x1e6, 0x401}}) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = socket$netlink(0x10, 0x3, 0x4) write(r5, &(0x7f00000000c0)="29000000140005b7ff000000040860eb0101b6ff02159f02c26ed638eeb738256e06a40e07fff0797e", 0x140) r6 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="12000000360000000400000002"], 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000003c0)={{r6, 0xffffffffffffffff}, &(0x7f0000000080), &(0x7f0000000380)=r4}, 0x20) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000300)={r7, 0x0, 0x0}, 0x20) r8 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000140), r8) r10 = syz_genetlink_get_family_id$devlink(&(0x7f0000000640), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_TRAP_SET(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000600)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000780)={&(0x7f0000000680)=ANY=[@ANYBLOB="d4000000", @ANYRES16=r10, @ANYBLOB="10002cbd7000fbdbdf253e000000080001007063690011000200303030303a30303a31302e30000000001c008200736f757263255f6d61635f69735f6d756c746963690011000200303030303a301c008200736f757263655f6d61635f6973006d756c746963617374000500830001000000080001007063690011000200303030303a30303a31302e30000000001c008200736f757263655f6d61635f69735f6d756c7469636173740005008300"/198], 0xd4}, 0x1, 0x0, 0x0, 0x8000}, 0x80) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000540)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x5, '\x00', r1, 0xffffffffffffffff, 0x5, 0x3, 0x2}, 0x50) ioctl$XFS_IOC_ATTRLIST_BY_HANDLE(r7, 0x4058587a, &(0x7f0000000d00)={{r3, &(0x7f0000000bc0)='\x92](,\x00', 0xc0000, &(0x7f0000000c00)={@align=0x80, {0x1, 0xff65, 0x1, 0x800}}, 0x8, &(0x7f0000000c40)={@_ha_fsid}, &(0x7f0000000c80)=0xe}, {[0x1, 0x4, 0x80, 0xb2]}, 0x40, 0x2c, &(0x7f0000000cc0)=""/44}) r12 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x2, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000300000000000000fe020010850000000700000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x100, 0x70, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000005c0)={r12, 0x0, 0x30, 0x0, @void}, 0x40) pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r13, &(0x7f00000000c0)=[{&(0x7f0000000180)="77690addcfbe1fbb66ec", 0xff3b}], 0x1, 0x1) bpf$PROG_LOAD(0x5, &(0x7f0000000e40)={0x19, 0x18, &(0x7f0000000e00)=ANY=[@ANYRES8=r9, @ANYRESHEX=r4], &(0x7f0000000680)='syzkaller\x00', 0x0, 0x66, &(0x7f0000000b40)=""/102, 0x40f00, 0x6, '\x00', r1, @fallback=0x2a, r11, 0x8, &(0x7f0000000d80)={0x3, 0x4}, 0x8, 0x10, 0x0, 0x0, 0xffffffffffffffff, r12, 0x3, &(0x7f0000000dc0)=[r6, r13], &(0x7f0000000f00)=[{0x1, 0x5, 0xb, 0x6}, {0x3, 0x5, 0x3, 0xb}, {0x2, 0x5, 0xf, 0x9}], 0x10, 0xfffffffe}, 0x94) sendmsg$NLBL_CIPSOV4_C_ADD(r8, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000004c0)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="010000000000000000000100000008000100030000002c0004800500030080ff00000500030080ff00000500030080ff0000050003000100000005000300800000000800020003"], 0x50}, 0x1, 0x0, 0x0, 0x40}, 0x0) r14 = socket$inet6_tcp(0xa, 0x1, 0x0) r15 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000340)='./cgroup/syz1\x00', 0x200002, 0x0) openat$cgroup_ro(r15, &(0x7f0000000400)='devices.list\x00', 0x0, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r14, 0x29, 0x40, &(0x7f00000006c0)=@raw={'raw\x00', 0x8, 0x3, 0x408, 0x138, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x338, 0xffffffff, 0xffffffff, 0x338, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [0xffffff00, 0xff000000], [0xffffffff], 'veth0_macvtap\x00', 'dvmrp1\x00', {}, {}, 0x88}, 0x0, 0x110, 0x138, 0x0, {}, [@common=@unspec=@statistic={{0x38}, {0x0, 0x0, 0x3096, 0x7fff, 0x56e5, {0x2}}}, @common=@inet=@udplite={{0x30}, {[0x4e23, 0x4e23], [0x4e24, 0x4e21], 0x1}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@mcast1, @ipv4={'\x00', '\xff\xff', @dev}, [], [0xff, 0x0, 0x0, 0xff000000], 'erspan0\x00', 'gre0\x00', {}, {}, 0x0, 0x0, 0x3}, 0x0, 0x1d0, 0x200, 0x0, {}, [@common=@inet=@recent0={{0xf8}, {0x80000001, 0x3, 0x20, 0x0, 'syz1\x00', 0x4}}, @common=@ah={{0x30}, {[0x4d4, 0x4d4], 0x84, 0x25, 0x3}}]}, @common=@unspec=@CONNMARK={0x30, 'CONNMARK\x00', 0x1, {0x0, 0xffffffff}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x468) r16 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r16, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000400)="d800000019008111e00212ba0d8105040a603f00ff0f040b067c55a1bc000900080006990300000015000500fe8081780d001500030001400200000901ac040000d67f6f94007100a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4b11602b2a10c11ce1b14d6d930dfe1d9d322fe04000000730d7a5025ccca262f3d40fad95667e04adcdf634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92307f00000e970300"/216, 0xd8}], 0x1}, 0x0) r17 = syz_genetlink_get_family_id$nbd(&(0x7f0000000180), r8) sendmsg$NBD_CMD_RECONFIGURE(r8, &(0x7f00000002c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000280)={&(0x7f00000001c0)={0x34, r17, 0x200, 0x80000001, 0x25dfdbfd, {}, [@NBD_ATTR_BACKEND_IDENTIFIER={0x6, 0xa, '\xff\xff'}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x3d6}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x104}]}, 0x34}, 0x1, 0x0, 0x0, 0x20000800}, 0x20000040) 1.775252022s ago: executing program 4 (id=15615): r0 = socket$nl_route(0x10, 0x3, 0x0) (async) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000003a00010325bd7000fcfffb1408"], 0x14}}, 0x0) (async, rerun: 32) bpf$PROG_LOAD(0x5, 0x0, 0x0) (rerun: 32) bpf$MAP_CREATE(0x0, 0x0, 0x0) syz_genetlink_get_family_id$nfc(&(0x7f0000000100), 0xffffffffffffffff) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000000)='hybla', 0x5) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) (async) r3 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}) (async, rerun: 32) socket$packet(0x11, 0x3, 0x300) (rerun: 32) write$tun(r2, &(0x7f00000002c0)={@val={0x0, 0x86dd}, @val={0x0, 0x1, 0x11, 0x4, 0x0, 0xca6}, @mpls={[], @ipv6=@gre_packet={0xe, 0x6, "ec00be", 0x44, 0x2f, 0xff, @local, @mcast2, {[], {{0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x88be, 0x1200, 0x3}, {0x0, 0x0, 0x1, 0x1}, {0x1, 0x0, 0x1}, {0xa888, 0x88be, 0x2, {{0x6, 0x1, 0x9, 0x2, 0x1, 0x0, 0x3, 0x5}, 0x1, {0x88a8}}}, {0x8, 0x22eb, 0x20000, {{0x0, 0x2, 0x9, 0x0, 0x0, 0x2, 0x7, 0x8}, 0x2, {0x2, 0x4, 0x0, 0x5, 0x1, 0x1, 0x1}}}, {0x8, 0x6558, 0x2}}}}}}, 0xfdef) (async) r4 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r4, &(0x7f0000000000)={0x10, 0x0, 0x25dfdbfb, 0x2ffffffff}, 0xc) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x301, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz1\x00'}]}, @NFT_MSG_NEWCHAIN={0x54, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}, @NFTA_CHAIN_HOOK={0x28, 0x4, 0x0, 0x1, [@NFTA_HOOK_PRIORITY={0x8}, @NFTA_HOOK_HOOKNUM={0x8, 0x1, 0x1, 0x0, 0x5}, @NFTA_HOOK_DEV={0x14, 0x3, 'veth1_macvtap\x00'}]}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz1\x00'}]}, @NFT_MSG_DELCHAIN={0x4c, 0x5, 0xa, 0x201, 0x0, 0x0, {0x1, 0x0, 0x2000}, [@NFTA_CHAIN_HANDLE={0xc, 0x2, 0x1, 0x0, 0x1}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_CHAIN_HOOK={0x20, 0x4, 0x0, 0x1, [@NFTA_HOOK_DEV={0x14, 0x3, 'veth1_macvtap\x00'}, @NFTA_HOOK_HOOKNUM={0x8, 0x1, 0x1, 0x0, 0x5}]}]}], {0x14}}, 0xe8}}, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), r1) (async) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000480)=ANY=[], 0x5c}, 0x1, 0x0, 0x0, 0x48001}, 0x0) r6 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r6, 0x10e, 0xc, &(0x7f0000000000)={0x4800}, 0x10) sendmsg$nl_generic(r6, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000001c0)={0x14, 0x16, 0xa01, 0x0, 0x25dfdbfb}, 0x14}}, 0x0) 1.620733198s ago: executing program 0 (id=15616): unshare(0x22020600) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="0b00000007000006000000000000000001000000", @ANYRES32, @ANYBLOB="fcffffff00"/20, @ANYRES32=0x0, @ANYRES64=r0, @ANYBLOB='\x00'/28], 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000a40)={{r1, 0xffffffffffffffff}, &(0x7f00000009c0), &(0x7f0000000a00)}, 0x20) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000080)={r2, &(0x7f0000000080), &(0x7f0000000200)=""/166}, 0x20) r3 = socket(0x2, 0x80805, 0x0) sendmmsg$inet_sctp(r3, &(0x7f0000003380)=[{&(0x7f0000000080)=@in={0x2, 0x4e24, @local}, 0x10, &(0x7f00000004c0)=[{&(0x7f00000003c0)="04", 0x1}], 0x1, &(0x7f0000000140)=ANY=[@ANYBLOB="1800000000000000000000000000400051a00e000100ffff68a2"], 0x18}], 0x1, 0x4000004) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r3, 0x84, 0x6e, 0x0, 0x0) r4 = socket$inet_icmp(0x2, 0x2, 0x1) sendmmsg$inet(r4, &(0x7f0000000340)=[{{&(0x7f0000000200)={0x2, 0x4e22, @local}, 0x10, &(0x7f0000001d40)=[{&(0x7f0000000400)='\b\x00\x00\x00(\x00\x00\x00', 0xffffff0d}, {0x0}], 0x2}}, {{0x0, 0x0, &(0x7f00000003c0), 0x0, 0x0, 0x10}}], 0x2, 0xc000) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r3, 0x89f2, &(0x7f0000000780)={'syztnl2\x00', &(0x7f0000000700)={'syztnl0\x00', 0x0, 0x1, 0x7, 0x0, 0x80000001, {{0xa, 0x4, 0x1, 0x2a, 0x28, 0x64, 0x0, 0x2, 0x29, 0x0, @multicast2, @local, {[@generic={0x94, 0xc, "1b66ffea55c58a86bbfe"}, @lsrr={0x83, 0x7, 0xfb, [@local]}]}}}}}) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000000840)={0x6, 0x0}, 0x8) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000900)={{r2, 0xffffffffffffffff}, &(0x7f0000000880), &(0x7f00000008c0)=r2}, 0x20) r8 = openat$cgroup(0xffffffffffffffff, &(0x7f0000000300)='syz1\x00', 0x200002, 0x0) ioctl$BTRFS_IOC_BALANCE_V2(r3, 0xc4009420, &(0x7f0000001380)={0x9, 0x2, {0x4, @struct={0x2, 0x81}, 0x0, 0x783, 0x2, 0x2, 0xfffffffffffffffc, 0x4, 0x19, @struct={0x5, 0x2}, 0x81, 0xc00, [0xfffffffffffff264, 0x0, 0x9, 0xa, 0x3, 0x5]}, {0x7, @struct={0x8, 0x7fff}, 0x0, 0x6c, 0x8, 0x8, 0x6, 0x100000000, 0x40e, @struct={0x1ff, 0xf}, 0xb207, 0xfffffff9, [0x3ff, 0x9, 0xffffffffffffffc0, 0x4, 0x64, 0x9]}, {0x81, @struct={0x1c00000, 0x6}, 0x0, 0x4, 0x0, 0x3, 0x8, 0x7, 0x10, @struct={0xe76, 0x43c258dd}, 0xffff, 0xeba9, [0x2, 0x2, 0x4, 0x9, 0x5095, 0x8]}, {0x6, 0xfffffffffffffffa, 0xcb}}) ioctl$BTRFS_IOC_DEV_INFO(r8, 0xd000941e, &(0x7f0000001d80)={r9, "7f7f86cab855beb8f6d82e27ef3e0242"}) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000b00)=@bpf_lsm={0x1d, 0x9, &(0x7f0000000440)=@raw=[@cb_func={0x18, 0x5, 0x4, 0x0, 0xffffffffffffffff}, @kfunc={0x85, 0x0, 0x2, 0x0, 0x2}, @cb_func={0x18, 0xb, 0x4, 0x0, 0xfffffffffffffffc}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffffc}, @exit, @cb_func={0x18, 0xf, 0x4, 0x0, 0xfffffffffffffff9}], &(0x7f0000000500)='syzkaller\x00', 0xffffffff, 0xde, &(0x7f0000000600)=""/222, 0x41000, 0x40, '\x00', r5, 0x1b, 0xffffffffffffffff, 0x8, &(0x7f00000007c0)={0x3, 0x4}, 0x8, 0x10, &(0x7f0000000800)={0x3, 0xd, 0xffd, 0xfffffffe}, 0x10, r6, 0x0, 0x6, &(0x7f0000000940)=[r7, r1, r2, r2, r2], &(0x7f0000000a80)=[{0x0, 0x4, 0x3, 0x4}, {0x2, 0x2, 0xf, 0x5}, {0x3, 0x4, 0x1, 0x8}, {0x4, 0x1, 0xa, 0x4}, {0x5, 0x2, 0xc, 0xc}, {0x2, 0x1, 0x0, 0x6}], 0x10, 0xbf4b}, 0x94) getsockopt$inet_sctp_SCTP_GET_PEER_ADDRS(r3, 0x84, 0x6c, &(0x7f0000000000)={0x0, 0x16, "f9960a436d2973f1b94d95c0079486805aff22607720"}, &(0x7f0000000100)=0x1e) connect$inet6(0xffffffffffffffff, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x3}, 0x1c) r10 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r11 = socket$nl_crypto(0x10, 0x3, 0x15) sendmsg$nl_crypto(r11, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000b80)=ANY=[@ANYBLOB="e8000000100001002dbd7000fddbdf257874732874776f6669736829"], 0xe8}, 0x1, 0x0, 0x0, 0x44}, 0x80) r12 = socket$pppl2tp(0x18, 0x1, 0x1) r13 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000ac0), 0xffffffffffffffff) r14 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r12, 0x8933, &(0x7f0000000380)={'bond0\x00', 0x0}) sendmsg$ETHTOOL_MSG_PAUSE_SET(r14, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000cc0)={&(0x7f0000000780)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r13, @ANYBLOB="0100d2f2d16eb32902ce2f0000000c00018008000100", @ANYRES32=r15], 0x20}}, 0x40000) sendmsg$inet(r11, &(0x7f0000000700)={&(0x7f0000000180)={0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0x2e}}, 0x10, &(0x7f00000004c0)=[{&(0x7f00000002c0)="500b570fc980bb95a72f3c5647da5c85ebbf0dceeff6b1665d53d4310e2d4f4894aa1940aed0a0e82ef5805a316a765cc0b4e8e51f95633f6a8b76d1cf911ff937160ad2b7ca6b3c138d47ef3716eb6c3e9c72cf5ccdbe25b4b146ff3b3e31ea238632c3cf0122a160b979d726bf44d8d0fb70", 0x73}, {&(0x7f0000000340)="c8075843864ca0eb2ffe2decab114471786a29e4cfcf15431fc3ac9e66a5dcbc9944158e2574475f428af045d299787bd5b0bc0a4e5011d15ba0ce882ffe4cea36c55208f2c59aeb1385f29b39154b881879f2b8a1ff90b582c36739fb682d7ed05daf79def2ec848e62884a6334965fa3b5f700bb5669fafb0e1c5e9cc70dec9bec4e281177ed729e17e08f6dbc01b96ba98419fa2989f16fa1b7dbef247d7b1bc065ed65d8b5f7ce64d082d3e4953c4a3b017d20334b8874b9b08e610434d6080458d351257d", 0xc7}, {&(0x7f0000000440)="8e702ab02c109aa5fc4b9ae599d1b1c108e05788835149dd597de31bbf9d4c528d34528f1b9c195b8686767afb35d307f89e5cc0e203a1867fd2050ff26534e781cfe2fa4ad8c035138693f826365fbdcebe52459c76a1bace8f97e64dbafdd3f831fe9237721a20e812e3470c1a560aafbc277f0549", 0x76}], 0x3, &(0x7f0000001200)=[@ip_tos_u8={{0x11, 0x0, 0x1, 0x2}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {r15, @rand_addr=0x64010101, @empty}}}, @ip_tos_u8={{0x11, 0x0, 0x1, 0xf}}, @ip_retopts={{0xc8, 0x0, 0x7, {[@noop, @generic={0x88, 0x11, "6108b50b8f75176d503aacd9601603"}, @cipso={0x86, 0x1a, 0x2, [{0x0, 0x7, "17f9c54a56"}, {0x7, 0x2}, {0x6, 0xb, "35be601179860246e3"}]}, @ssrr={0x89, 0x1b, 0x7a, [@rand_addr=0x64010102, @remote, @loopback, @initdev={0xac, 0x1e, 0x0, 0x0}, @dev={0xac, 0x14, 0x14, 0x22}, @empty]}, @timestamp_prespec={0x44, 0x34, 0x3c, 0x3, 0xb, [{@empty}, {@broadcast, 0x6}, {@rand_addr=0x64010102, 0x101000}, {@remote, 0x7}, {@private=0xa010102, 0x7}, {@local, 0x38}]}, @cipso={0x86, 0x8, 0x0, [{0x2, 0x2}]}, @cipso={0x86, 0x31, 0x3, [{0x0, 0x12, "ee2af169a230c96930b1d60000000000"}, {0x1, 0x4, "86f6"}, {0x7, 0x8, "51e28b8741cb"}, {0x1, 0xa, "9af23ce158a3267d"}, {0x1, 0x3, "98"}]}, @ssrr={0x89, 0x3, 0x71}]}}}, @ip_ttl={{0x14, 0x0, 0x2, 0x5}}, @ip_tos_int={{0x14, 0x0, 0x1, 0x8}}], 0x148}, 0x800) ioctl$TUNSETIFF(r10, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) socket$nl_route(0x10, 0x3, 0x0) 1.619118957s ago: executing program 1 (id=15617): r0 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4000000000000007910480000000000610400000000000095000000"], &(0x7f0000000280)='GPL\x00', 0x2, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x94) close(r0) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000100)={0x1, 0xffffffffffffffff}, 0x4) r2 = socket$netlink(0x10, 0x3, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000580)=@newqdisc={0x88, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0x25dfdbfb, {0x0, 0x0, 0x0, r4, {}, {0xffff, 0xffff}, {0x2, 0x1}}, [@qdisc_kind_options=@q_mqprio={{0xb}, {0x58, 0x2, {{0xa, [0x6, 0x0, 0x7, 0x9, 0x0, 0x5, 0x6, 0x1, 0x7, 0xb, 0x6, 0x5, 0x6, 0xa, 0x2, 0xd], 0x0, [0xd, 0x7, 0x4, 0x9, 0x31f5, 0x155, 0x1, 0x0, 0x4, 0x4, 0x1, 0x400, 0x2, 0xe403, 0x5e4b, 0xfff], [0x7, 0x2, 0x5, 0x2, 0xd, 0x5, 0x9, 0xff48, 0x6, 0x2, 0x401, 0x400, 0x4, 0x6, 0x2, 0x1]}}}}]}, 0x88}, 0x1, 0x0, 0x0, 0x85c}, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000004c0)={{0x1, 0xffffffffffffffff}, &(0x7f00000003c0), &(0x7f0000000400)=r0}, 0x20) pipe(&(0x7f0000000480)={0xffffffffffffffff}) r7 = socket$netlink(0x10, 0x3, 0xc) splice(r6, 0x0, r7, 0x0, 0x10d00, 0xf) bpf$PROG_LOAD(0x5, &(0x7f0000000900)={0xd, 0x10, &(0x7f0000000140)=@raw=[@ldst={0x2, 0x1, 0x4, 0x7, 0x2, 0x4, 0x10}, @snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x240000}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r1}}, @btf_id={0x18, 0x0, 0x3, 0x0, 0x1}], &(0x7f00000001c0)='syzkaller\x00', 0x6, 0x0, 0x0, 0x40f00, 0x58, '\x00', r4, @fallback=0x22, 0xffffffffffffffff, 0x8, &(0x7f0000000340)={0xa, 0x4}, 0x8, 0x10, &(0x7f0000000380)={0x1, 0x7, 0x1, 0x9}, 0x10, 0xffffffffffffffff, r0, 0x3, &(0x7f00000006c0)=[r5, 0xffffffffffffffff, r6], &(0x7f0000000740)=[{0x3, 0x3, 0x2, 0xc}, {0x2, 0x1, 0x3, 0x5}, {0x0, 0x5, 0xc, 0x9}], 0x10, 0xb}, 0x94) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000029c0)={0xffffffffffffffff, 0xffffffffffffffff}) r9 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000540)=ANY=[@ANYBLOB="b4050000fdff7f006110580000000000c60000000000000095000000000000009f33ef60916e6e713f1eeb0b725ad99b817fd98cd824498949714ffaac8a6f770600dcca55f21f3ca9e822d182054d54d53cd2b6db714e4beb5447000001000000008f2b9000f22425e4097ed62cbc891061017cfa6fa26fa7088c60897d4a6148a1c1e43f00001bde60beac671e8e8fdecb03588aa623fa71f31bf0f871ab5c2ff88afc60027f4e5b5271ed58e835cf0d0000000098b51fe6b1b8d9dbe87dcff414ed000000000000000000000000000000000000000000000000000000b347abe6352a080f8140e5fd10747b6ecdb3540546bf636e3d6e700e5b0500000000000000eb9e1403e6c8f7a187eaf60f3a17f0f046a307a403c19d9829c90bd2114252581567acae715cbe1b57d5cda432c5b910400623d24195405f2e76ccb7b37b41215c184e731fb1"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x366, 0x10, &(0x7f0000000000), 0x1dd}, 0x48) r10 = bpf$MAP_CREATE(0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="0f000000040000000400000012"], 0x48) bpf$BPF_PROG_DETACH(0x8, &(0x7f00000007c0)=ANY=[@ANYRES32=r10, @ANYRES32=r9, @ANYBLOB='\x00'], 0x10) sendmsg$inet(r8, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000bc0)=[{&(0x7f0000000780)='}', 0x1}], 0x1}, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000000c0)={{r10}, &(0x7f0000000000), &(0x7f00000002c0)=r0}, 0x20) socket$nl_generic(0x10, 0x3, 0x10) r11 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000480)={'wlan0\x00'}) r12 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) r13 = syz_genetlink_get_family_id$team(&(0x7f0000000400), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000001140)) sendmsg$TEAM_CMD_OPTIONS_SET(r11, &(0x7f0000001340)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x100000}, 0x4d, &(0x7f0000001300)={&(0x7f0000001180)={0x14, r13, 0xe7c089af45aad44b, 0x70bd2c, 0x3}, 0x14}, 0x1, 0x0, 0x0, 0x54}, 0x4000000) sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_SET_COALESCE(r11, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000001580)=ANY=[@ANYBLOB="b8000000", @ANYRES16=r12, @ANYBLOB], 0xb8}, 0x1, 0x0, 0x0, 0x20008090}, 0x8000) sendmsg$nl_generic(r11, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=ANY=[@ANYBLOB], 0x18}, 0x1, 0x0, 0x0, 0x8004}, 0x0) socket$igmp6(0xa, 0x3, 0x2) socket$pppl2tp(0x18, 0x1, 0x1) 1.594490456s ago: executing program 3 (id=15618): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'bridge0\x00', 0x0}) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x3, 0x23, &(0x7f00000002c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x80000000, 0x0, 0x0, 0x0, 0xdecc}, [@map_idx={0x18, 0x2, 0x5, 0x0, 0x3}, @kfunc={0x85, 0x0, 0x2, 0x0, 0x4}, @snprintf, @map_val={0x18, 0x7, 0x2, 0x0, 0x1, 0x0, 0x0, 0x0, 0x9}, @map_val, @initr0={0x18, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x1}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, 0x1}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x7}}, @func={0x85, 0x0, 0x1, 0x0, 0xffffffffffffffff}]}, &(0x7f0000000400)='GPL\x00', 0x4, 0xfb, &(0x7f0000000440)=""/251, 0x40f00, 0x0, '\x00', r2, @sched_cls=0x2e, 0xffffffffffffffff, 0x8, &(0x7f0000000540)={0x7, 0x2}, 0x8, 0x10, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, &(0x7f0000000580)=[0xffffffffffffffff, 0x1, 0x1, 0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0xffffffffffffffff], 0x0, 0x10, 0x4867}, 0x94) bpf$BPF_PROG_QUERY(0x10, &(0x7f00000007c0)={@ifindex=r2, 0x1e, 0x0, 0xfffffffd, &(0x7f0000000680)=[0x0, 0x0, 0x0, 0x0, 0x0], 0x5, 0x0, &(0x7f00000006c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000700)=[0x0], &(0x7f0000000740)=[0x0, 0x0], 0x0}, 0x40) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000840)={0xdb46, 0x0}, 0x8) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000800)={@fallback=r1, r3, 0xf, 0x30, 0x0, @void, @void, @void, @value=r5, r4}, 0x20) sendmsg$nl_route(r1, &(0x7f0000001300)={0x0, 0x0, &(0x7f0000000180)={0x0, 0x34}, 0x1, 0x0, 0x0, 0x1}, 0x20040010) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=ANY=[@ANYBLOB="200000006800e97800000000000000000a0000000000000008000500", @ANYRES16], 0x20}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000004380)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="240000001800090400000000000000000a000000000000030000000008001e0001"], 0x24}}, 0x0) socket$unix(0x1, 0x1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) bpf$MAP_LOOKUP_ELEM(0x5, 0x0, 0x0) r6 = socket$inet6(0xa, 0x1, 0x8000000003c) sendmsg(r6, 0x0, 0x44004) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$nl_route(0x10, 0x3, 0x0) r9 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) bind$bt_l2cap(r9, &(0x7f0000000000)={0x1f, 0x6, @any, 0x0, 0x1}, 0xe) sendmsg$nl_route(r8, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000100)=@ipv4_newroute={0x24, 0x18, 0x35f32a6dfa748ddd, 0x0, 0x0, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}}, 0x24}}, 0x0) sendmsg$nl_route(r7, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=@newlink={0x28, 0x10, 0x1, 0x1, 0x0, {0x0, 0x0, 0x0, 0x0, 0x420}, [@IFLA_GROUP={0x8}]}, 0x28}, 0x1, 0xc3ffffffffffffff}, 0x0) 1.507430896s ago: executing program 4 (id=15619): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000007c0)=@base={0x8, 0x4, 0x4, 0x9}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0xa, 0x8, &(0x7f0000000240)=ANY=[@ANYBLOB="1809000000000000000000000000000018120000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7030000070000008500000021000000b70000000000000095"], &(0x7f0000000840)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xd000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 1.270803893s ago: executing program 4 (id=15620): r0 = socket$nl_route(0x10, 0x3, 0x0) (async, rerun: 32) r1 = socket$alg(0x26, 0x5, 0x0) (rerun: 32) bind$alg(r1, &(0x7f00000001c0)={0x26, 'hash\x00', 0x0, 0x0, 'hmac(sha512)\x00'}, 0x58) (async) accept$alg(r1, 0x0, 0x0) (async) socket$nl_route(0x10, 0x3, 0x0) (async, rerun: 64) socket$kcm(0x2c, 0x3, 0x0) (async, rerun: 64) socket$xdp(0x2c, 0x3, 0x0) (async) socket$netlink(0x10, 0x3, 0x400000000000004) (async) socket$nl_route(0x10, 0x3, 0x0) (async) socket$inet_icmp_raw(0x2, 0x3, 0x1) (async, rerun: 32) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) (async, rerun: 32) syz_open_procfs$namespace(0x0, &(0x7f0000000200)='ns/cgroup\x00') (async, rerun: 64) socket$pppl2tp(0x18, 0x1, 0x1) (async, rerun: 64) socket$igmp(0x2, 0x3, 0x2) socket$nl_generic(0x10, 0x3, 0x10) socket$inet6_tcp(0xa, 0x1, 0x0) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3) (async, rerun: 64) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000140)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) (async, rerun: 64) socket(0x10, 0x803, 0x0) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) r2 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000000c0), 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0xe, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x1, 0x2, 0x3, 0x0, 0x1, 0x43}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x94) (async) bpf$MAP_LOOKUP_ELEM(0x5, &(0x7f00000000c0)={r2, &(0x7f0000000000), &(0x7f0000000040)=""/73}, 0x70) (async, rerun: 32) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) (rerun: 32) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r3, 0x84, 0x85, &(0x7f0000000300)={0x0, @in6={{0xa, 0x0, 0x0, @empty}}, 0x0, 0x2000}, 0x90) r4 = socket$phonet(0x23, 0x2, 0x1) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000010c0)=ANY=[@ANYBLOB="3401000010000100"/20, @ANYRES32=r4, @ANYBLOB="000000000000000014011a80400002803c000180080021000000000008001800000000000800030000000000080009000000000008000c0000000000080012000000000008001f00000000006c000a80140007"], 0x134}}, 0x0) 1.270378768s ago: executing program 1 (id=15621): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x0, 0x3, 0x0, 0x0, 0x8, 0x0, 0x0, 0x41000, 0x36, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xa22}, 0x94) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="2200000004"], 0x48) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x48) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f00000000c0)={r1}, 0x4) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000640)={r0, 0xffffffffffffffff}, 0x4) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x7, 0x1c, &(0x7f0000000680)=ANY=[@ANYBLOB="18080000cbb60000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000008000000bf0920000000000035090100000000009500000000000000b7080000000000007b8af8ff00000000b7080000020000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r2, @ANYBLOB="0000000000020000b7050000080000001c00000000000000bf980000000000000d080000000000008500000006000000b70000000200000095"], &(0x7f0000000000)='GPL\x00', 0x5, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80004000}, 0x94) 1.267483368s ago: executing program 0 (id=15622): r0 = socket$nl_generic(0x10, 0x3, 0x10) bind$alg(0xffffffffffffffff, &(0x7f00000000c0)={0x26, 'hash\x00', 0x0, 0x0, 'ghash-generic\x00'}, 0x58) sendmsg$BATADV_CMD_TP_METER(r0, &(0x7f00000004c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x50, 0x0, 0x2, 0x70bd28, 0x25dfdbff, {}, [@BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x6}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @broadcast}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x8000}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x6}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5, 0x30, 0x1}, @BATADV_ATTR_HARD_IFINDEX={0x8}]}, 0x50}, 0x1, 0x0, 0x0, 0x40841}, 0x40001) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0) sendmsg$nl_route(r1, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) syz_open_procfs$namespace(0x0, 0x0) unshare(0x6a040000) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r3) r4 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r3, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x1}, 0x1c) listen(r4, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'batadv_slave_0\x00'}) sendmsg$IPCTNL_MSG_CT_DELETE(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000040)={0x20, 0x2, 0x1, 0x401, 0x0, 0x0, {0x2, 0x0, 0x1}, [@CTA_FILTER={0x4}, @CTA_ZONE={0x6}]}, 0x20}, 0x1, 0x0, 0x0, 0x2080}, 0x4000080) r5 = socket$netlink(0x10, 0x3, 0x0) ioctl$XFS_IOC_GETBMAP(r5, 0xc0205826, 0x0) readv(r5, &(0x7f0000001400), 0x0) writev(r5, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000019c0)={0x6, 0xa, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000008000000000000000004000018110000", @ANYRES32=r2, @ANYBLOB="fd00000000000000b7020000000000008500000086000000047200000b00000018c9f6dd2f4b2ccc3c000000000000009500000000000000"], 0x0, 0x6, 0x0, 0x0, 0x40f00, 0x45, '\x00', 0x0, 0x25, r2, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x8, &(0x7f0000001900), &(0x7f0000001940)=[{0x80001, 0x1, 0x6, 0x6}, {0x0, 0x2, 0xe, 0xa}, {0x5, 0x4, 0x5, 0x8}, {0x0, 0x2, 0x4, 0x3}, {0x4, 0x5, 0xa, 0x8}, {0x3, 0x5, 0xc, 0x6}, {0x3, 0x2, 0x6, 0x6}, {0x0, 0x3, 0x3, 0x2}], 0x10, 0x81}, 0x94) r6 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r6, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) getsockopt$inet_sctp6_SCTP_STATUS(r2, 0x84, 0xe, &(0x7f0000000340)={0x0, 0x200, 0x8, 0x5f72, 0x4, 0xd3, 0x4a9, 0xbb, {0x0, @in={{0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0x3d}}}, 0x8, 0x7fff, 0x2, 0xc2d, 0x100}}, &(0x7f0000000400)=0xb0) r7 = accept(r4, 0x0, 0x0) socket$netlink(0x10, 0x3, 0x1) syz_emit_ethernet(0x1d8, 0x0, &(0x7f0000000180)={0x0, 0xf7fffffd, [0x9fe, 0xe5f, 0x63f, 0x700]}) sendmsg$TEAM_CMD_OPTIONS_SET(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000140)=ANY=[], 0xfffffdef}, 0x1, 0x0, 0x0, 0x800}, 0x10) recvfrom(r6, &(0x7f0000000080)=""/60, 0x3c, 0x180, 0x0, 0xffffffffffffff69) 1.265365272s ago: executing program 3 (id=15623): r0 = socket$kcm(0xa, 0x2, 0x0) r1 = socket(0x2, 0x80805, 0x0) setsockopt(r0, 0x3ff, 0x7, &(0x7f0000000380)="180265b73296dd756539e9c08b95bae0ba1e87b1c73fb6a3e9add98cda613f428f3753e0b3299f650a3553e476909392e2e7d3560d29150c18020110cd8cabc4efcb21e68b73ecb65bad05a3325785a31717309ceb06af66e9816ae7e45e638b208ba2363a41d3c765418f30b5272355296cdf9e86d186d12179d8c2abbcd5736916918af7abf54f0523be488bfe8e2b79cebf3d0073a2b68f04652ce49811c8e9a211b426b878445867926be72b3c8fbc3e4c1fa1870e407de05bffbb28d67eb58f51aa6538b6", 0xc7) r2 = socket$inet_sctp(0x2, 0x5, 0x84) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000080)={0x0, @broadcast, @private}, &(0x7f0000000100)=0xc) socket$inet6_tcp(0xa, 0x1, 0x0) r4 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) shutdown(r4, 0x1) socket$nl_generic(0x10, 0x3, 0x10) r5 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_INIT(r5, 0x0, 0xc8, &(0x7f0000000100), 0x4) setsockopt$MRT_ADD_VIF(r5, 0x0, 0xca, &(0x7f0000003d80)={0x0, 0x0, 0x0, 0x0, @vifc_lcl_addr=@local, @dev}, 0x10) syz_emit_ethernet(0x0, 0x0, 0x0) r6 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r7 = socket$igmp(0x2, 0x3, 0x2) socket$netlink(0x10, 0x3, 0x0) getsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f0000000240)={{{@in6=@initdev, @in=@empty}}, {{@in6=@ipv4={""/10, ""/2, @multicast2}}, 0x0, @in6=@mcast2}}, 0x0) setsockopt$MRT_ADD_VIF(r7, 0x0, 0xca, &(0x7f00000000c0)={0x8, 0x0, 0x0, 0x0, @vifc_lcl_addr=@local, @rand_addr=0x64010102}, 0x10) setsockopt$inet_mreq(r6, 0x0, 0x23, &(0x7f0000000000)={@multicast1=0xe0000300, @local}, 0x8) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000980)={0x18, 0x3f, 0x107, 0x0, 0x25dfdbfd, {0x4, 0x7c}, [@nested={0x4, 0xfc}]}, 0x18}, 0x1, 0x0, 0x0, 0xc000}, 0x4040) socket$inet_smc(0x2b, 0x1, 0x0) syz_emit_ethernet(0x36, &(0x7f0000000140)={@local, @broadcast, @void, {@ipv4={0x800, @icmp={{0x8, 0x4, 0x0, 0x2, 0x28, 0x68, 0x0, 0x80, 0x2, 0x0, @empty, @multicast1=0xe0000300, {[@rr={0x7, 0xb, 0xb2, [@local, @loopback]}]}}, @echo={0x8, 0x0, 0x0, 0x6, 0x1}}}}}, 0x0) setsockopt$MRT_ADD_MFC_PROXY(r7, 0x0, 0xd2, &(0x7f0000000200)={@empty, @multicast2=0xe0000300, 0x0, "028a3f6c58b274e6d8451697efe42811ee1df06e9264f7d866b1970548fc3c7b", 0xb2, 0xffffeff7, 0x40, 0x40000006}, 0x3c) ioctl$sock_inet6_SIOCDELRT(r1, 0x890c, &(0x7f0000000180)={@private2, @local, @dev={0xfe, 0x80, '\x00', 0x33}, 0x1, 0x3ff, 0x7, 0x100, 0x2, 0x2850107, r3}) setsockopt$IP_VS_SO_SET_ADD(r2, 0x0, 0x482, &(0x7f0000000140)={0x84, @rand_addr=0x64010105, 0x4e22, 0x3, 'lblc\x00', 0x30, 0x80001, 0x6f}, 0x2c) setsockopt$IP_VS_SO_SET_ADDDEST(r1, 0x0, 0x487, &(0x7f0000000000)={{0x84, @private=0xa010102, 0x4e21, 0x3, 'lc\x00', 0x5, 0x8, 0x77}, {@remote, 0x4e20, 0x2, 0xcd}}, 0x44) setsockopt$IP_VS_SO_SET_FLUSH(r2, 0x0, 0x485, 0x0, 0x0) 1.156879991s ago: executing program 4 (id=15624): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x3, 0x23, &(0x7f00000002c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x80000000, 0x0, 0x0, 0x0, 0xdecc}, [@map_idx={0x18, 0x2, 0x5, 0x0, 0x3}, @kfunc={0x85, 0x0, 0x2, 0x0, 0x4}, @snprintf, @map_val={0x18, 0x7, 0x2, 0x0, 0x1, 0x0, 0x0, 0x0, 0x9}, @map_val, @initr0={0x18, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x1}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, 0x1}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x7}}, @func={0x85, 0x0, 0x1, 0x0, 0xffffffffffffffff}]}, &(0x7f0000000400)='GPL\x00', 0x4, 0xfb, &(0x7f0000000440)=""/251, 0x40f00, 0x0, '\x00', 0x0, @sched_cls=0x2e, 0xffffffffffffffff, 0x8, &(0x7f0000000540)={0x7, 0x2}, 0x8, 0x10, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, &(0x7f0000000580)=[0xffffffffffffffff, 0x1, 0x1, 0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0xffffffffffffffff], 0x0, 0x10, 0x4867}, 0x94) bpf$BPF_PROG_QUERY(0x10, &(0x7f00000007c0)={@ifindex, 0x1e, 0x0, 0xfffffffd, &(0x7f0000000680)=[0x0, 0x0, 0x0, 0x0, 0x0], 0x5, 0x0, &(0x7f00000006c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000700)=[0x0], &(0x7f0000000740)=[0x0, 0x0]}, 0x40) sendmsg$nl_route(r1, &(0x7f0000001300)={0x0, 0x0, &(0x7f0000000180)={0x0, 0x34}, 0x1, 0x0, 0x0, 0x1}, 0x20040010) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=ANY=[@ANYBLOB="200000006800e97800000000000000000a0000000000000008000500", @ANYRES16=r2], 0x20}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000004380)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="240000001800090400000000000000000a000000000000030000000008001e0001"], 0x24}}, 0x0) socket$unix(0x1, 0x1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) bpf$MAP_LOOKUP_ELEM(0x5, 0x0, 0x0) r3 = socket$inet6(0xa, 0x1, 0x8000000003c) sendmsg(r3, 0x0, 0x44004) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) bind$bt_l2cap(r6, &(0x7f0000000000)={0x1f, 0x6, @any, 0x0, 0x1}, 0xe) sendmsg$nl_route(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000100)=@ipv4_newroute={0x24, 0x18, 0x35f32a6dfa748ddd, 0x0, 0x0, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}}, 0x24}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=@newlink={0x28, 0x10, 0x1, 0x1, 0x0, {0x0, 0x0, 0x0, 0x0, 0x420}, [@IFLA_GROUP={0x8}]}, 0x28}, 0x1, 0xc3ffffffffffffff}, 0x0) 1.156144274s ago: executing program 3 (id=15625): socket$kcm(0x11, 0xa, 0x300) r0 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000440)={0x6, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000002000000000000000000082295"], &(0x7f0000000040)='syzkaller\x00'}, 0x94) (async, rerun: 32) r1 = socket$nl_route(0x10, 0x3, 0x0) (rerun: 32) sendmsg$nl_route(r1, &(0x7f0000000c40)={0x0, 0x0, &(0x7f0000000c00)={&(0x7f0000000bc0)=@ipv4_getnexthop={0x1c, 0x6a, 0x1, 0x70bd2d, 0x25dfdbff, {}, [@NHA_GROUPS={0x4}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8801}, 0x80) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r0, 0x1f4, 0xd28, 0x0, &(0x7f0000000940)="ff412f66b083dcc1010b3efc88ca", 0x0, 0x300, 0x300, 0x0, 0x0, 0x0, 0x0, 0x2, 0xffff80fe, 0x6}, 0x50) 1.031590512s ago: executing program 1 (id=15626): r0 = socket$kcm(0xa, 0x3, 0x87) sendmsg$kcm(r0, &(0x7f0000000580)={&(0x7f0000000380)=@l2tp6={0xa, 0x0, 0x7, @private1, 0x0, 0x1}, 0x80, &(0x7f0000000240)=[{0x0, 0x2b}], 0x1}, 0x4048810) pipe(0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) r3 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r3, &(0x7f0000000080)={0x18, 0x0, {0x1, @empty, 'ip6tnl0\x00'}}, 0x1e) r4 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r4, &(0x7f0000000080)={0x18, 0x0, {0x1, @random="70a5562e8a2e", 'ip_vti0\x00'}}, 0x1e) syz_emit_ethernet(0x36, &(0x7f00000006c0)={@local, @random="b0c942034375", @void, {@ipv4={0x8864, @tcp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x22, 0x0, 0x0, 0x6, 0x0, @dev, @broadcast}, {{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_GET(r5, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000001280)={&(0x7f0000000040)={0x38, 0x1, 0x2, 0x5, 0x0, 0x0, {0x2}, [@CTA_EXPECT_MASTER={0x24, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @multicast1}, {0x8, 0x2, @broadcast}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x3a}}]}]}, 0x38}, 0x1, 0x0, 0x0, 0x4000000}, 0x24004084) bind$alg(r2, &(0x7f0000010400)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast6-avx\x00'}, 0x58) r6 = openat$cgroup(0xffffffffffffffff, &(0x7f0000000400)='syz1\x00', 0x200002, 0x0) bpf$BPF_PROG_QUERY(0x10, &(0x7f00000003c0)={@cgroup=r6, 0x11, 0x1, 0x0, &(0x7f0000000140)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x9, 0x0, &(0x7f0000000180)=[0x0], &(0x7f0000000340)=[0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000380)=[0x0, 0x0]}, 0x40) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r7 = accept4(r2, 0x0, 0x0, 0x80800) sendmmsg$alg(r7, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000001dc0)=[{&(0x7f0000000080)="346767eaf6736bfc5ea7619289a76980c0c4c706", 0xb}, {&(0x7f00000000c0)="ed7f0cdaf7b82b4b5cd4fa5d3802c32da295d54f463e64e6871a846935720af8d82fd5c7926fdad87170d4c506fe6c11898225143c98ffdf85d555f99fa85dc109ef0639458898064fb7cca3dfd51849ad2692af5a2564b9d44002550b8d7fbd54cd62f3f1d8", 0x66}, {&(0x7f0000000940)="7abd79f5c177736e149bdcb7630d836453f9648ed78b95a7e741b65a6361779e02b336ed823643dcdbcb2d0a5285470104401a409ebee7ec4a46350270d8d3623109500b418770abf71ecfbcf437de166da0324d87a56d5d240d34e1df3eaf5c3ac648204e2ff753989c8108c4db22d2021d924ce875727089c28ccd12260bcc2870369ed21e22cafbab3efa87c8ede2cc0c4d0935378b88ccf4f21b0c80b9ad150b5ee10141357b172c72e12653237554e4c4eeb60a97c32d7cfd6a38349a689bb91ac66b01a04dca0ca25cc4d312c0472797974974051db17bf835e3d5d729a6e3554a5dad5c2d854f0fdee0635aaa997c5ae78a164c9dde167c3086a60b41059e90c215150964a205300b74e48dd90b80258220d4ad03343c5de889751e018873edd83845ade7811fc3d881001fb23312efefb57805a1ff32d29c0ad9ee532c3ad080508e5eaec899d7236261f4dea87362982dcd9cf13e30085a038c7aa638a2bb30c62f12dec6fcb040b8d899c05a06e45a4794d7711eadd3a23b395f4f89f681eac7e3ae0bf590c4451802920c2076840a39dc0b6b491f130b40cc1aba80bdeddf97d7a5d128b0c7c69252bf13990aaf8f113e3341bb2ccef4bb07174c8a837e2ccbac708567052ab590f023db21665d631986f73aaafd49f208ece84627ae128d0ab47063c5120d81dc4c5597ee6eea3ee9c39bdb395f46c7092bbf2ea5f6b45dabb8b8e2722d5cba946c2e26c56fd403cd0dee38396a989fe64d56feadd18623ee315e30284979f6e869faf35781129536f94f9deeba644b718850d67ed7f2c508ff262b34af8cf700c3ad2e5581465d000ee32b10bb8baf4854526e9b22682410a03bb08c1ae76c6886f1cea09d3093bc5cd7f9207d5613a130769c7391f466918a71b33c4bb72627823a638fa3361fa8afcff8512a92351dec65c4167081c592a988028a18dc08431ee2885bb20a75850434cade5d91a60441aff9d9e12bfebe0991ccdd3c3493cfddd919691cd067a13d1dfa48f4d23ddc9cbd4c4b57042f823c51f2e5e9f7d0bbf6cfb45374b848c5963d3c57b82e1a0296fa6aa34c4fec7f1f3eb208ac406d1a2da114126ae56b67437ce55e709795ef2fd5c9dfe0353f046e5ab944dbc65c72f80d9d264468cf97f44f0fac207e5ccbbf92a1d7adcc6f439227d5edfd9845aecb33e953d9bf7ddb549d0442b0df129d0c04b3cde6445b730972853141c7ff94d52e5eefc1a489f8bda36fedea0271e2868879418d7569d96a445819e356d814c0e2aaae6381aade962c70e50fe7c1ff15d5669e602486ae065d9892284ef49711ca0d377809af922e9bc6339373df94bec51b2a17e3d1a497e3fbc78e9d497e9e020900bd3c7392967aaf79b1de70cc2f2d6210eb06974a4f48128b0c39eb406ea9ddc2cf623e0b8da79a12f9f4389dd6b04f7140544f1f6b6765ed1f7ec06cc1a9947552dc612ab260f9dfd7a0fc74317a2c979196b018d8c8e3eb89262886130af6303c444ec6fba805b68ececf485b3f344c38d2738408581422baa25aa92156800fc1ebb533de6e603534c5a2716ef9d8e008376a3693370f329f6b747fcb33ca22a1e912696242abefc9e0ad4dead3db3076e493ba57eecbb866e0eadadd7ae0fa5423ac63280733127d2ec76064976082a12889a904c261207106e885ad442be8e4bd249591326d541dd89649ea806630a09c194fcedf28e11b00dc66858c66b85baa9f2d7c9003781da13f79f53b769bf423cefe0349b7fb30d706f30793bc06460baf461a489a3d1d4256d8a532bf4e4495f5e7939032b3ee013857805e0c027cb5d954533546c27ec583021cbb8376a1509b6abc7e3e36146b70da4e4be44967f837ee36d310d8bec702c5435f564e346cc68b17ee8eeeae5f89c5181093a90480970ac145b0cc50d4a4f1a38bfacd5eae6ad47291770c76a1e0d013820c42c6739fadb2799680ca345aa4559513ab58e1ee80c41b8787b52553a65a88f92098457c880a669aec36c2acaa6d7e518dc7c3673e8afdf531abc3dd92934eeb3a411e03de46090511ff84a3f58a6112122d3f302e071663af1c1d6c6c77487027d42995d7f23dcc12e48de263eeffcdf42ec4840972d4aae6cff5b5005ca0e9d91c9e02652a732ec6e3f2d71cc96d311c2acdb9b6a3b3dac38c12d968a2b26a3857f32823835ac4c527ce96f61c9b8923e54d5a70374efcd45fc844210425bb41b314e332e56cf7ef1584379f07b05ccf4fff428737495e1d11a907716f202226b172775332b20087e3e6fc5f766781d3fd549f02722733cf4a1141669b37004ca9c0d91d356c704ead7216114a3f1a9dd8768c7876966420a6f3ba6eae4bc54fefa7a7e929c9d21556856eaee68fd431f20cca85e01e89548e916ccd01ee8d13787df745adea3329f64e344c8c6b2ef371ac559716563ca47c74046f285484b3fc3fa99370b2062c8fca6a563f5378e60c68e4ecc6bef633f3cf68bfddcffa2118da27ac11a5e7271597561a97bc228b02a64807288c93a0cdcb778461f45516da4e624ae81108f89b235bc3e909e20ad57142f603ab3ce0c503341c828353e4ce847bd6013bc71a759f423a5c7bc1b0658112e67b9d6728c71b783e33c4b7a2daff455dcfd1877c5f6881ada32f6f66bba65a0be46466ef891b3d7cbe8269fd89d7a9f338b8e9b194cd145d211eada29d442a959c74a284b91d4c645d2f8882951064c34b866e23e7a8b8fdcd059afabcb532bfd8b7b88074df4a86be7938d9b28a168bcb90ead92933830f58fbbbecc1e35269d724f7a9cad61f47ce98aef467115a0711acd607d9d71859043bffdc94eabf6daef73abc52e371c5df3973112b88f0ee5360aa2df69f79d53e2e5cc1e57f19b1aa06d693eaf32ae96882f764a906858f102d9d932570c101e5730782550b7d69614cc02415078fd20b5930b7346a493534cfbd206da866231b507782a8528dedabab2197102b9f9eda4654dd4f67e73d59aa644a1a9e3841ac64e1e17093b5e910a994138e38d1245f0e67c75ae3cade66a82a8dbd1f125a1847a54e4be447e142358c497ad9ef1983dd5f60b6807610019363b709f1bd5415b9fed881d8979b0caaa480ccef19281eef2b4b6d34096571d83f9b67713fc0ee404d352e518d89b3fe5f34eb6a991e47594865ac9a0087d54772a41be1e86986e835866bf389d19e76cc7cfa9345c7a5ca8bee843cd4e836810c9041c0925754b36b661ef60ed10cdcb439bf626c7bc3cb41d43eddc5c69cdd30cde21f3fb65596766911fe9d9be54dd21a0829e0ea56692703c1fe9eed1c677950ef805dcf25843f3d2018570ff32a02b1f0d56743f215728f5ccfff9f9293d3372e6645375bfdd15784976f0fc9ed4b311692239936027abb30d3de9efa19a13037e9fbbb2d42193c389ddacd89a288f091f23b95dd6c2b74d3c6ba491c0a5002e8bc134c94448ec5e2c966f2ad69bc2bd38130f018cc5cd9d7c735666d932603e94e9cbd578e56e7f2c83fedcad7c8c9b7a4eefe43583ed60cd745c5419cb0f40200c8bb3cf5fce6aad72f9cfb78cc2cc2684546990f6bcb96d0b6d5570c99b425b39113cc3fc447a4b6fbaca0ef0281708c4651d08d8d1df03582d961f7b6de6d4272c5767fb802b890479ceb9386fba301660e4f038bdd7a6c06ae47bc54abf22183e5255546bbed816c4de45723cb3460463c0999966bc51106aa6f9e58f8506aaaa5724fd7580e7680a9a66927be2b5850adba52627b5d09267f3d678171a2d793090c3d84d0c7ad3c3feabb3eb737c7bc07145efa4da782d20e9c47c3f698f81657e555eed4c661b366f43da1602d885bee92e922dd2dca07c09d12b4d6ca0bc2dc55faaecc6d8db0460f02a7b43cba73fccbbe55b1cabca6a596f46585e8c9ff0645e9a789ba54b887fbcde62acef1194c999c56b26621e731305f2fd61d80bc5a0098e7eda32e6cc37ffc8d66a43fdbb003f88b317cad1b6c85df8a69f3b04c34921dc2bb6f7ebe35d8c12ca1490660b91fbfe5649db8181de45e38a2dc8c6bedf7858af6d1033da42414384f3e38e828afb144caf8c169a2cef1e8658bc6b89bf074ffb461d4e2138624d8175bbde56e71b3231635d33c1d87d63609dd6a0fa64430bb747afba40ccd0f818a9b82c1ea72334046cf659b59a7630c2d389597e18c549b1b65fe91c6399ff8b3cbff3b096c58e44ba3c50046fac875cfc773bfb6ec6440a6749cdad0aee943ca68eda4f8ded0b5dea04c2bab5fb132df9e3776a13fe5fb8e4ea5892f471ee4f678245edc73715d7a50759dd4914bd0cfe7e23dae902761397ccd14959bec8b03574d71d5265c71beb4d994d957a5ff76b441fc333e59df7df9bb9ae6444da8410ee1ae8f8dd0f4cf93b443ffd188b62ea211c29dae1ba58f3bcc551495b08afb0b21d204fc625021c687d895b1bec95e02d04bb56874f9e881f36d0991d17358f1d21788287e92f0e9e4ad440a3c034559cd835cee29b6dca77c7028b00ed2da0b44795ea9cf0d36e080a9ecc821bb74ab1e68e740b9ef2dc83bb37fb1cb2e408e7fd2a07a23c0612c6ca801659198491d76a5ad5844b0f3c1246fa6b02186a027182079094fdf9daf9b1c1738305ae6a2fcf6b13563a17d8cdc8c15679d6969a65a3f8aff3a32a21021b326770b147cee8e7b4431614623db04dc921232abfe5742d0d097b3048e03838eb2a850c3550e1a29c6cfd429df4c651fa4dbfe5a3b31283dc8f1930aaa39a06130daa9d3910b0de8f478345aae244c3c3fcdb8b3841fbb5d5b3905ce0cb123fe8674c586a77bc87bd29ce34ff44f324b58913e246d9dde804eadf3a575969c5ff3e91c3a66083d07a9a6eb3a016ea819860636de4c4cba86a31bd38e5394bf995486e9b1ae66763170e333c6de391e25ce000171f9ac944717998483e7ee32de82719930ba06461ac3147ad722350e7f2f263da8f30703e417617c5ae6c7fe41f67de62b640b36be65a9c5c35a9854a8e927babaf56964e669e476aa71e32736337973cba2fe3d3bcbdf9b5598a1a2e7ecc670bee07c2a97e89c16aceae9dc4ad65b8802737117f9bd35d759792add543d9beb1a2b42b313089785b3c92b77107f560dddf873a7c97daded22594fc3d0a94fbfa04cb569e95c65d6aeab24c220cd8a9d879a665d6aee839b3e4adac5b99a72ffc8def4ec9da22f0ea204cde30ca2fd91b4d9af9a11bfa88d719f313083a440925e4848b6cd947a9abbcdb6b2a7eb0ebc65805d0e5735bfc063c920ead42f0510e4bcd0387b2ed334548c6612b3d68cca5f73caf749af8b936d04da5c3b7053e4f2218c1ecf4241a76ac106e3538a6b298202c08b60d241175802633726f2054fc037a884956734b7fba4da4240700be22e6614d14c2622d4a372ad96a7e8fea8b45a21d0ddb6ee9ffd81044aa44c7e5ebadc5622d8f02c4d096e0e5883faf8e228298b9290020c1475091547f58c6ef6d2bd283964496c390240a6b78d781dc0778452b332c9b7df90327a03e947b4643c8fda31ae1bbdacf98aaf00543300369bdfdd372e01a1872a41ce697861ea3554d7f91eb36d7758eeee69ec88e7a157cce601ed620353b337ab4092615d4e1423695531ab46c8d549df19f2f175a3c141853cbb6a913a8ecd14ed1f7048f48cb760844b0b18112228a4bfb16a4514b038fd524b46f7a3310803a13a50258d8d4afa5f93c8752e7ca8d9691f6959c14a75cebc472e7ba6cf6aedc2fd8cacdcb6fe27aedaf5799bfa96", 0x1000}, {&(0x7f0000001940)="1141727cdcdafa5be8e5aba6bb92a48c1818812f62bba03c93f231c6c133908479ca8a2652c1e03b3a396c8733d16c504f00e1234633604af73ac7cf6f0d5ebd301d4628eb3b220fa249bf16aae568ddeb07ece86275c18e7e11650c7731d561f0b0b77244b8b972194b316a96e367fad6afbb02a90df6d6f563d9fb01551f22a6134c0561978a0d274bf22a2219667a6bdef57f50408dcb6a10f0750c876e103bb01dee60d9d33f8d101c77806da13abf7b132b5ca8e3a6aaed2c79d8a7daa6b9e348bd6aac4c21ee3a27b427f588cb5468d6c98ae797630aee8414d13a3424df91b7ebd693b12c274310e9495e8b110a781526cad3dd137dee3c09998ad7", 0xff}, {&(0x7f0000001a40)="bcc072ce5f2908c8adf087fc4776d59d0cd1f0a6d2440b747919ab96efe0fd6cfd7350eeda6f7fd5999b88c717e30fe5f40c29134c400e7b51c489970892435450a25befb8f5b22cf1c27449509e2d3bff748f000c6e36c51d6388577b0fc5eaafa04384469e446db0628e7c7c79ae6e0f714f9bdb926346983bd8a53beaf4ce92e42c359f87d801784e05169c14ae1409", 0x91}, {&(0x7f0000001b00)="d1ee569384f46bc9d1f4f2899f6c03a2f3bf9421f081a8868a5857ef14597d3b0a815a4bbd16012f6df66ec0b2af0b39e011a74b7457bba7105207a4199c9464cb008e659315a390e210b3f5c0a3af8bd4fa675ea2bcc011cc95822da5db552cc45c73ef1859c963507c86ae3a57ac068e47a4b87c091d87a948df211d7321f61a6a421aebd69446aeb1", 0x8a}, {&(0x7f0000001bc0)="44cf42f2ff0f00e5ad514274f2e7813dc92f6adbe55a7bbcb46dbcb14b96953e1f0a4ec909c9ad6f4d2787f7364961e09fb8dc4f895bf754e16bd9f52de494280000000000feffffffffffffff00", 0x4e}, {&(0x7f0000001c40)="5be3c0da91753472961f00f54338956133", 0x11}, {&(0x7f0000001c80)="cccfcdcc0c44f58aebd6f2d8178c7f97c2a0d1e75c", 0x15}, {&(0x7f0000000240)="31f43df55ae599743816a92edad3a6bdfbdf7201e2c43072d0fa2e68b27de87a080f62591237ae23cd8cb653f9682944a629c25bbc0210d574804776acdac9b76654a97b341e71f24b8190b52f090b4eefa87410e33c563e0a57d3ae442e220846a01c06b5296b526d906798c76a9e10f899d996ff8fac3934d13155b0f82d632b27de88206d1808a569ce12cc1c12021991b3d82b66a5fc07c0c377bc5171b0d0bd76d0db20dca9e5f5979ba00003f1f953f7f93db9f9d869f8bee44789e2c126fae07c1c2933d1751c3eae", 0xcc}], 0xa, &(0x7f0000000380), 0x0, 0x8e90be991888d948}], 0x1, 0x1000c841) recvmsg(r7, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000640)=""/88, 0x58}], 0x1}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000004f40)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a6c000000060a0b040000000000000000020000004000048018000180080001006f7366000c000280080001400000000424000180090001006d6574610000000014000280080002400000000208000340000000150900010073797a30000000000900020073797a32"], 0x94}}, 0x0) 980.120408ms ago: executing program 1 (id=15627): r0 = socket$netlink(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RATE_NEW(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000300)={0x34, r1, 0x1, 0x0, 0x25dfdbfb, {0x25}, [@handle=@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}]}, 0x34}, 0x1, 0x0, 0x0, 0x41}, 0x0) r2 = socket$netlink(0x10, 0x3, 0x10) r3 = socket$igmp6(0xa, 0x3, 0x2) getsockopt$inet6_int(r3, 0x29, 0x35, 0x0, &(0x7f0000000540)) bind$netlink(r2, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) 916.139989ms ago: executing program 3 (id=15628): bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000080)={0xffffffffffffffff, 0x1, 0x8}, 0xc) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000000080000000000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000404000000000000000000000300"/28], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x3, 0xd, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000850000002200000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b70800000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000980046c1394c"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="06000000040000000800000008"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=@framed={{}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r1}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x8, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000640)={0x11, 0x21, &(0x7f0000000f80)=@raw=[@printk={@lli, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xa175}}, @initr0={0x18, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x4}, @map_idx={0x18, 0x9, 0x5, 0x0, 0x8}, @snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x6a2}}, @map_fd={0x18, 0x5, 0x1, 0x0, 0x1}, @tail_call={{0x18, 0x2, 0x1, 0x0, 0x1}}, @call={0x85, 0x0, 0x0, 0xd}], &(0x7f0000000480)='syzkaller\x00', 0x7, 0x31, &(0x7f00000004c0)=""/49, 0x0, 0x20, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000500)={0x5, 0x5}, 0x8, 0x10, &(0x7f0000000c40)={0xfff, 0x5, 0x7fff, 0x100}, 0x10, 0x0, 0x0, 0x6, &(0x7f0000000580)=[0x1, 0xffffffffffffffff, 0xffffffffffffffff], &(0x7f00000005c0)=[{0x4, 0x3, 0x10, 0x9}, {0x2, 0x2, 0x8, 0x7}, {0x4, 0x4, 0xa, 0x929cb24d8abf2991}, {0x3, 0x5, 0x3, 0x2}, {0x4, 0x1, 0xe, 0x1}, {0x4, 0x2, 0x0, 0x4}], 0x10, 0x8000}, 0x94) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000700)={0x2, 0x4, 0x8, 0x1, 0x80, 0x1, 0xfffffff7, '\x00', 0x0, 0xffffffffffffffff, 0x2, 0x0, 0x5}, 0x50) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000780)={0x0, 0x401}, 0xc) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f00000007c0)={0x1, 0xffffffffffffffff}, 0x4) bpf$ITER_CREATE(0x21, &(0x7f0000000800), 0x8) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000840)={0x2, 0x4, 0x8, 0x1, 0x80, 0x1, 0x40, '\x00', 0x0, 0xffffffffffffffff, 0x1, 0x2, 0x4}, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000940)={{}, &(0x7f00000008c0), &(0x7f0000000900)}, 0x20) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="160000000000000004000000ff"], 0x48) bpf$MAP_CREATE(0x0, &(0x7f0000000bc0)=@base={0x5, 0x5, 0x8, 0xfff}, 0x50) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000083850000000400000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r5}, 0xc) r6 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000080)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b704000000000000850000005700000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x60}, 0x94) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000ec0)=@bpf_ext={0x1c, 0x2, &(0x7f0000000400)=@raw=[@cb_func={0x18, 0x1, 0x4, 0x0, 0xb}], &(0x7f0000000d40)='GPL\x00', 0x1, 0x0, 0x0, 0x41000, 0x8, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000d80)={0x0, 0x9}, 0x8, 0x10, &(0x7f0000000dc0)={0x0, 0xb, 0x5755, 0xfffffffe}, 0x10, 0x1d0b5, r6, 0x5, &(0x7f0000000e00)=[r1, r2, r0, r0], &(0x7f0000000e40)=[{0x2, 0x4, 0x1, 0x6}, {0x4, 0x3, 0xfffffffd, 0x3}, {0x2, 0x1, 0x10, 0x1}, {0x2, 0x5, 0x5, 0x4}, {0x1, 0x5, 0x6, 0x6}], 0x10, 0x1}, 0x94) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000008000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008"], 0x0}, 0x94) ioctl$XFS_IOC_ATTRLIST_BY_HANDLE(0xffffffffffffffff, 0x4058587a, &(0x7f0000000b40)={{0xffffffffffffffff, &(0x7f0000000980)='\xb7%!\x00', 0x204000, &(0x7f00000009c0)={@align=0x7ff, {0xcc4c, 0x8, 0xfffffffe, 0x7}}, 0x7, &(0x7f0000000a00)={@_ha_fsid}, &(0x7f0000000a40)=0x3}, {[0x600, 0x4, 0x0, 0x5]}, 0x1ff, 0x81, &(0x7f0000000a80)=""/129}) bpf$MAP_CREATE(0x0, &(0x7f0000000500)=@base={0xa, 0x4, 0xfff, 0x7, 0x0, 0x1}, 0x50) r7 = socket(0x10, 0x3, 0x0) r8 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0xe, 0x4, 0x8, 0x7}, 0x50) close(0x3) bpf$MAP_CREATE(0x0, &(0x7f0000000880)=ANY=[@ANYBLOB="19000000040000000400000002"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000d00)={0x11, 0x15, &(0x7f0000000200)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000047b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000100850000000100000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000010000850000008200000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r9 = bpf$PROG_LOAD(0x5, &(0x7f0000000580)={0x11, 0xd, &(0x7f0000000240)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r8, @ANYBLOB="0000000000000000b7080000385efeb47b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000004000085000000010000008500000050"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x7, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f00000000c0)={r9}, 0xc) setsockopt$netlink_NETLINK_TX_RING(r7, 0x10e, 0xc, &(0x7f0000000000)={0x4800}, 0x10) 731.415115ms ago: executing program 3 (id=15629): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000003c0)=ANY=[@ANYBLOB="180000002e00010026bdf000fcdbdf1b04000000040010"], 0x18}, 0x1, 0x0, 0x0, 0x4000d}, 0x850) r1 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r1, &(0x7f00000000c0)={0x10, 0x0, 0x25dfdbfd, 0x2ffdfffff}, 0x6b) (async) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f0000000000), 0x4) (async) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r1, 0x10e, 0x4, &(0x7f0000000100)=0x1800, 0x4) (async) r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0x169821, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) (async) write$tun(r2, &(0x7f0000000240)=ANY=[@ANYBLOB="034886dd49032800030020000000600000000004730081e949b93897bc3b0000070000007d01ff020000000000000000000000000001"], 0xfdef) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'wg2\x00', 0x2020}) (async) r3 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r3, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000340)={&(0x7f0000000200)={0x2, 0x3, 0x0, 0x3, 0x18, 0x0, 0x70bd2c, 0x25dfdbfb, [@sadb_address={0x3, 0x7, 0x33, 0x20, 0x0, @in6={0xa, 0x4e20, 0x2, @private0, 0x7fffffff}}, @sadb_x_policy={0x8, 0x12, 0x4, 0x1, 0x0, 0x6e6bc0, 0x9, {0x6, 0xff, 0x5, 0x4, 0x0, 0x6, 0x0, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, @in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}}, @sadb_sa={0x2, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2}, @sadb_x_policy={0x8, 0x12, 0x2, 0x1, 0x0, 0x6e6bb1, 0x9, {0x6, 0x6c, 0x1, 0x8, 0x0, 0x6, 0x0, @in6=@ipv4={'\x00', '\xff\xff', @loopback}, @in=@multicast1}}, @sadb_x_nat_t_type={0x2000000b, 0x14, 0x9}]}, 0xc0}, 0x1, 0x7}, 0x40040) close(0x3) close(0xffffffffffffffff) 80.97282ms ago: executing program 4 (id=15630): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000007c0)=@base={0x8, 0x4, 0x4, 0x9}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0xa, 0x8, &(0x7f0000000240)=ANY=[@ANYBLOB="1809000000000000000000000000000018120000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7030000070000008500000021000000b70000000000000095"], &(0x7f0000000840)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 0s ago: executing program 4 (id=15631): bind$inet6(0xffffffffffffffff, &(0x7f00000000c0)={0xa, 0x4e21, 0xb, @empty}, 0x1c) connect$inet6(0xffffffffffffffff, 0x0, 0x0) r0 = socket$netlink(0x10, 0x3, 0x10) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[], 0x18}}, 0x20004000) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@gettaction={0x38, 0x32, 0x20, 0x70bd25, 0x25dfdbfe, {}, [@action_gd=@TCA_ACT_TAB={0x4}, @action_gd=@TCA_ACT_TAB={0x20, 0x1, [{0x10, 0xd, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'mirred\x00'}}, {0xc, 0x17, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x40}}]}]}, 0x38}, 0x1, 0x0, 0x0, 0x40000}, 0x4048840) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="4800000010000d0428bd7000fcdbff2500008000", @ANYRES32=0x0, @ANYBLOB="1000000000000000280012800b0001006272696467650000180002"], 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0300000000000000280012800a00010076786c616e00"], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22cca65c15}, 0x4008840) r1 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r1, &(0x7f00000002c0), 0x40000000000009f, 0x0) ioctl$ifreq_SIOCGIFINDEX_wireguard(0xffffffffffffffff, 0x8933, 0x0) r2 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000003c0)={0xffffffffffffffff}) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000f80), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_STATION(r4, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000001040)={&(0x7f0000000100)={0x34, r5, 0xb97534d5fe9704cf, 0x0, 0x0, {{}, {@val={0x8, 0x3, r6}, @void}}, [@NL80211_ATTR_STA_SUPPORTED_RATES={0x4}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_STA_LISTEN_INTERVAL={0x6}]}, 0x34}, 0x1, 0x0, 0x0, 0xc0}, 0x0) syz_emit_ethernet(0x76, &(0x7f00000000c0)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaaaa86dd6000030000403a00fc000000000000000000000000000000ff0200000007000000000000000000000000604aa19800003c"], 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=@newtaction={0x6c, 0x30, 0x1, 0x70bd28, 0x0, {}, [{0x58, 0x1, [@m_skbmod={0x54, 0x1, 0x0, 0x0, {{0xb}, {0x28, 0x2, 0x0, 0x1, [@TCA_SKBMOD_PARMS={0x24, 0x2, {{0xffffffff, 0x10001, 0xffffffffffffffff, 0x3c, 0x3}, 0x400000000a}}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x6c}, 0x1, 0x0, 0x0, 0x4}, 0x0) syz_emit_ethernet(0x6e, &(0x7f0000000040)=ANY=[@ANYBLOB="0180c2000002aaaaaaaaaaaa08004500006000000000002f9078640101000000000024806558000000000000000010000800000086dd"], 0x0) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000007e40)=[{0x0, 0x0, &(0x7f0000003740)=[{&(0x7f00000000c0)="4789d3aefc1a4d03345aed327be33c", 0xf}], 0x1, 0x0, 0x0, 0x20000000}], 0x1, 0x20040894) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000002c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_GET_STATION(r0, &(0x7f0000000680)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000640)={&(0x7f0000000500)={0x108, r5, 0x200, 0x70bd2b, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r7}, @void}}, [@NL80211_ATTR_STA_LISTEN_INTERVAL={0x6, 0x12, 0xbd26}, @NL80211_ATTR_MESH_PEER_AID={0x6, 0xed, 0x30c}, @NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES={0xc0, 0xbe, "c627716d0fc3b6b961f0e229d39af02822cb6e5a7c4d1575fd3d800ad57240bf629aa8ef9b14622ad6921e0c9d58fa8e133ba67fe6d28244a5adeed13da52bae81bd31ba9763ffbb99237aa76f95da2d4e040e21adbd60c732cf9e30a2a407b4bd111404a5f79ddea54baa5c0c1eeac9af7726308bf849c868e19c40a2cf313f45d492b474ed9cd46adf47a9416f60c778273db35e6c671c8fe4f2095a5c2704b28051b8319b904dcae05dfb739ba6a5cc1583a359ba6f8798999000"}, @NL80211_ATTR_MGMT_SUBTYPE={0x5, 0x29, 0xa}, @NL80211_ATTR_PEER_AID={0x6, 0xb5, 0x2d}, @NL80211_ATTR_MAC={0xa}]}, 0x108}, 0x1, 0x0, 0x0, 0x1}, 0x1) r8 = socket$kcm(0x10, 0x2, 0x10) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000070000040900010073797a30000000009c000000090a010400000000000000000700000308000a40000000000900020073797a30000000000900010073797a3000000000080005400000000d58001280200001800e000100636f6e6e6c696d69740000000c0002800800014000000008200001800e000100636f6e6e6c696d69740000000c00028008000140000000001400017b090001006cdbf80789f3f947dd000280080003"], 0xe4}, 0x1, 0x0, 0x0, 0x8001}, 0x20010840) sendmsg$kcm(r8, &(0x7f0000000000)={0x0, 0xd18c9b25, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f030041000b05d25a806c8c6394f90324fc60100000000a000200053582c137153e3704020180fc5409000c00", 0x33fe0}], 0x1}, 0x0) sendmsg$DEVLINK_CMD_RATE_NEW(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000300)={0x34, r2, 0x1, 0x0, 0x25dfdbfb, {0x25}, [@handle=@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}]}, 0x34}, 0x1, 0x0, 0x0, 0x41}, 0x0) syz_emit_ethernet(0x133, &(0x7f0000000740)={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}, @random="9f3402e1e7de", @val={@void, {0x8100, 0x0, 0x1, 0x3}}, {@mpls_mc={0x8848, {[{0x8, 0x0, 0x1}], @ipv6=@tipc_packet={0x5, 0x6, "b9c58b", 0xf5, 0x6, 0xff, @dev={0xfe, 0x80, '\x00', 0x32}, @remote, {[@dstopts={0x8, 0x2, '\x00', [@hao={0xc9, 0x10, @remote}]}, @dstopts={0xc, 0x6, '\x00', [@calipso={0x7, 0x30, {0x0, 0xa, 0x4, 0x3, [0x3800000, 0x1, 0xffffffffffff4a5c, 0x6, 0x9]}}]}, @srh={0x5e, 0xe, 0x4, 0x7, 0x3, 0x0, 0xfaae, [@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @ipv4={'\x00', '\xff\xff', @empty}, @dev={0xfe, 0x80, '\x00', 0x1d}, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @local, @rand_addr=' \x01\x00', @local]}], @payload_conn={{{0x1d, 0x0, 0x0, 0x1, 0x1, 0x6, 0x2, 0x2, 0x0, 0x0, 0x2, 0x3, 0x2, 0x0, 0x800, 0x9, 0x2, 0x4e21, 0x4e22}}, [0x0, 0x0, 0x0, 0x0, 0x0]}}}}}}}, &(0x7f0000000880)={0x0, 0x3, [0xd1f, 0x5b6, 0x90d, 0x63b]}) r9 = bpf$PROG_LOAD(0x5, &(0x7f00000027c0)={0x4, 0x5, &(0x7f0000000040)=@framed={{0x18, 0x2, 0x0, 0x0, 0x3}, [@call={0x85, 0x0, 0x0, 0x2e}, @call={0x85, 0x0, 0x0, 0xa0}]}, &(0x7f00000000c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0xc, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000140)={r9, 0x702, 0xe, 0x0, &(0x7f0000000380)="e46033ddaf373b1ce2be0696a3da", 0x0, 0xa001, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) socket$nl_generic(0x10, 0x3, 0x10) kernel console output (not intermixed with test programs): speed/duplex [ 1174.069251][ T12] bond5: (slave bridge4): failed to get link speed/duplex [ 1174.137947][T25791] netlink: 16 bytes leftover after parsing attributes in process `syz.1.14637'. [ 1174.256895][T25639] bridge0: port 1(bridge_slave_0) entered blocking state [ 1174.292362][T25639] bridge0: port 1(bridge_slave_0) entered disabled state [ 1174.316519][T25639] bridge_slave_0: entered allmulticast mode [ 1174.332422][T25802] netlink: 'syz.1.14640': attribute type 4 has an invalid length. [ 1174.346245][T25639] bridge_slave_0: entered promiscuous mode [ 1174.366475][T25804] netlink: 'syz.3.14641': attribute type 1 has an invalid length. [ 1174.375373][ T12] bond5: (slave bridge4): failed to get link speed/duplex [ 1174.393120][T25804] netlink: 'syz.3.14641': attribute type 1 has an invalid length. [ 1174.402182][T25639] bridge0: port 2(bridge_slave_1) entered blocking state [ 1174.410567][T25804] netlink: 'syz.3.14641': attribute type 1 has an invalid length. [ 1174.419433][T25639] bridge0: port 2(bridge_slave_1) entered disabled state [ 1174.427361][T25639] bridge_slave_1: entered allmulticast mode [ 1174.434546][T25804] netlink: 'syz.3.14641': attribute type 1 has an invalid length. [ 1174.445882][T25639] bridge_slave_1: entered promiscuous mode [ 1174.452687][T25804] netlink: 'syz.3.14641': attribute type 1 has an invalid length. [ 1174.468664][T25804] netlink: 'syz.3.14641': attribute type 1 has an invalid length. [ 1174.503303][T25639] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1174.518727][T25639] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1174.580297][T25639] team0: Port device team_slave_0 added [ 1174.601011][T25639] team0: Port device team_slave_1 added [ 1174.645711][T25639] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1174.653771][T25639] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1174.683852][T25639] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1174.706633][T25639] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1174.757268][T25639] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1174.791379][T25639] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1174.838630][T25639] hsr_slave_0: entered promiscuous mode [ 1174.845078][T25639] hsr_slave_1: entered promiscuous mode [ 1174.851336][T25639] debugfs: 'hsr0' already exists in 'hsr' [ 1174.857098][T25639] Cannot create hsr debugfs directory [ 1175.009127][ T5624] Bluetooth: hci4: command tx timeout [ 1175.058872][ T6241] bond5: (slave bridge4): failed to get link speed/duplex [ 1175.115326][T25822] xt_CT: No such helper "snmp_trap" [ 1175.334180][T25837] netlink: 277 bytes leftover after parsing attributes in process `syz.4.14654'. [ 1175.550976][T25639] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 1175.579231][T25639] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1175.605940][T25639] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 1175.634617][T25639] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1175.636712][T25852] netlink: 44 bytes leftover after parsing attributes in process `syz.1.14660'. [ 1175.662483][T25639] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 1175.680897][T25854] netlink: 44 bytes leftover after parsing attributes in process `syz.1.14660'. [ 1175.690767][T25639] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1175.698635][T25639] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 1175.707483][T25639] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1175.964649][T25639] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1176.009804][T25639] 8021q: adding VLAN 0 to HW filter on device team0 [ 1176.035142][ T35] bridge0: port 1(bridge_slave_0) entered blocking state [ 1176.042342][ T35] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1176.078098][ T35] bridge0: port 2(bridge_slave_1) entered blocking state [ 1176.085340][ T35] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1176.321880][T25898] netlink: 112 bytes leftover after parsing attributes in process `syz.0.14668'. [ 1176.333172][T25898] xt_TCPMSS: Only works on TCP SYN packets [ 1176.436265][T25902] netlink: 20 bytes leftover after parsing attributes in process `syz.1.14669'. [ 1176.471822][T25904] netlink: 4 bytes leftover after parsing attributes in process `syz.0.14670'. [ 1176.545153][T25909] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1176.584035][T25909] 8021q: adding VLAN 0 to HW filter on device team0 [ 1176.624664][T25909] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1176.752072][T25909] 0·: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 1176.763832][T25909] 0·: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 1176.782653][T25909] veth1_vlan: left promiscuous mode [ 1176.790805][T25909] veth0_vlan: left promiscuous mode [ 1176.799005][T25909] veth0_vlan: entered promiscuous mode [ 1176.811156][T25909] veth1_vlan: entered promiscuous mode [ 1176.856140][T25909] 8021q: adding VLAN 0 to HW filter on device bond1 [ 1176.928166][T25909] 8021q: adding VLAN 0 to HW filter on device bond2 [ 1176.936904][T25909] 8021q: adding VLAN 0 to HW filter on device bond3 [ 1176.950270][T25909] 8021q: adding VLAN 0 to HW filter on device bond4 [ 1176.962314][T25909] 8021q: adding VLAN 0 to HW filter on device bond5 [ 1176.971473][T25909] net_ratelimit: 9 callbacks suppressed [ 1176.971487][T25909] A link change request failed with some changes committed already. Interface vxlan0 may have been left with an inconsistent configuration, please check. [ 1177.028380][ T35] netdevsim netdevsim1 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 1177.036742][ T35] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1177.055242][ T35] netdevsim netdevsim1 eth0: set [1, 1] type 2 family 0 port 20004 - 0 [ 1177.064075][ T35] netdevsim netdevsim1 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1177.083310][ T35] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1177.101229][ T35] netdevsim netdevsim1 eth1: set [1, 1] type 2 family 0 port 20004 - 0 [ 1177.127851][ T35] netdevsim netdevsim1 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1177.137068][ T35] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1177.159459][ T35] netdevsim netdevsim1 eth2: set [1, 1] type 2 family 0 port 20004 - 0 [ 1177.168364][ T5624] Bluetooth: hci4: command tx timeout [ 1177.174068][ T35] bond5: (slave bridge4): failed to get link speed/duplex [ 1177.181250][ T35] netdevsim netdevsim1 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1177.189438][ T35] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1177.197620][ T35] netdevsim netdevsim1 eth3: set [1, 1] type 2 family 0 port 20004 - 0 [ 1177.214386][ T6241] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 1177.223524][ T6241] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 1177.234533][T25639] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1177.236525][T25932] netlink: 12 bytes leftover after parsing attributes in process `syz.0.14676'. [ 1177.251362][ T5356] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 1177.346879][T25936] lo speed is unknown, defaulting to 1000 [ 1177.355288][T25639] veth0_vlan: entered promiscuous mode [ 1177.379464][T25639] veth1_vlan: entered promiscuous mode [ 1177.470532][T25639] veth0_macvtap: entered promiscuous mode [ 1177.482204][ T6228] bond5: (slave bridge4): failed to get link speed/duplex [ 1177.490808][ T5356] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 1177.502688][T25639] veth1_macvtap: entered promiscuous mode [ 1177.527866][T25639] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1177.551787][T25639] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1177.593031][ T6241] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1177.605336][ T6241] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1177.624750][ T6241] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1177.644713][ T6241] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1177.729425][ T6228] bond5: (slave bridge4): failed to get link speed/duplex [ 1177.826941][ T6941] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1177.835845][ T5730] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 1177.852964][ T6941] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1177.952670][T25936] lo speed is unknown, defaulting to 1000 [ 1177.964913][ T6241] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1177.972622][ T35] bond5: (slave bridge4): failed to get link speed/duplex [ 1177.988442][ T6241] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1178.002069][T25955] netlink: 4 bytes leftover after parsing attributes in process `syz.3.14683'. [ 1178.108404][ T6941] bond5: (slave bridge4): failed to get link speed/duplex [ 1178.241345][ T6941] bond5: (slave bridge4): failed to get link speed/duplex [ 1178.388590][ T35] bond5: (slave bridge4): failed to get link speed/duplex [ 1178.549035][ T6241] bond5: (slave bridge4): failed to get link speed/duplex [ 1178.565976][T25982] sch_tbf: peakrate 2 is lower than or equals to rate 8 ! [ 1178.686461][T25990] lo speed is unknown, defaulting to 1000 [ 1178.747102][ T6228] bond5: (slave bridge4): failed to get link speed/duplex [ 1179.074875][T26001] netlink: 4 bytes leftover after parsing attributes in process `syz.4.14698'. [ 1179.116680][T26001] mac80211_hwsim hwsim165 syzkaller0: entered promiscuous mode [ 1179.137297][T26001] mac80211_hwsim hwsim165 syzkaller0: entered allmulticast mode [ 1179.238589][ T5624] Bluetooth: hci4: command tx timeout [ 1179.861484][T25990] lo speed is unknown, defaulting to 1000 [ 1179.925386][T26021] netlink: 8 bytes leftover after parsing attributes in process `syz.3.14703'. [ 1180.338451][T26029] validate_nla: 59 callbacks suppressed [ 1180.338496][T26029] netlink: 'syz.1.14705': attribute type 21 has an invalid length. [ 1180.403734][T26029] netlink: 156 bytes leftover after parsing attributes in process `syz.1.14705'. [ 1180.428148][T26035] RDS: rds_bind could not find a transport for ::ffff:172.20.20.170, load rds_tcp or rds_rdma? [ 1180.541093][T26027] syzkaller0: entered promiscuous mode [ 1180.555559][T26027] syzkaller0: entered allmulticast mode [ 1180.639727][T26025] netlink: 8 bytes leftover after parsing attributes in process `syz.3.14704'. [ 1180.958009][T26057] netlink: 8 bytes leftover after parsing attributes in process `syz.2.14711'. [ 1181.075268][T26059] tipc: New replicast peer: 255.255.255.255 [ 1181.100458][T26059] tipc: Enabled bearer , priority 10 [ 1181.140667][T26065] bridge0: port 2(bridge_slave_1) entered disabled state [ 1181.148038][T26065] bridge0: port 1(bridge_slave_0) entered disabled state [ 1181.233658][T26071] netlink: 24 bytes leftover after parsing attributes in process `syz.4.14713'. [ 1181.260698][T26065] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1181.275049][T26065] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1181.367551][ T13] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1181.383445][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 1181.385753][ T13] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1181.445477][ T13] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1181.468462][ T13] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1181.511624][T26081] netlink: 8 bytes leftover after parsing attributes in process `syz.4.14717'. [ 1181.558104][T26087] netlink: 8 bytes leftover after parsing attributes in process `syz.4.14717'. [ 1181.650894][T26089] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1181.661874][T26089] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1181.693728][T26089] veth1_vlan: left promiscuous mode [ 1181.703546][T26089] veth0_vlan: left promiscuous mode [ 1181.709500][T26089] veth0_vlan: entered promiscuous mode [ 1181.720195][T26089] veth1_vlan: entered promiscuous mode [ 1181.739166][T26089] 8021q: adding VLAN 0 to HW filter on device bond1 [ 1181.762284][T26089] 8021q: adding VLAN 0 to HW filter on device bond2 [ 1181.772818][T26089] 8021q: adding VLAN 0 to HW filter on device bond3 [ 1181.781088][T26089] batman_adv: batadv0: Interface activated: gretap1 [ 1181.832260][T26103] netlink: 'syz.2.14725': attribute type 1 has an invalid length. [ 1181.853550][T26089] 8021q: adding VLAN 0 to HW filter on device ipvlan2 [ 1181.865918][T26089] 8021q: adding VLAN 0 to HW filter on device batadv1 [ 1181.881208][T26089] 8021q: adding VLAN 0 to HW filter on device batadv2 [ 1181.894647][T26089] 8021q: adding VLAN 0 to HW filter on device eth0 [ 1181.904680][T26089] 8021q: adding VLAN 0 to HW filter on device eth1 [ 1181.913756][T26089] 8021q: adding VLAN 0 to HW filter on device eth2 [ 1181.922079][T26089] 8021q: adding VLAN 0 to HW filter on device eth3 [ 1181.929915][T26089] 8021q: adding VLAN 0 to HW filter on device bond4 [ 1181.940996][T26089] 8021q: adding VLAN 0 to HW filter on device bond5 [ 1181.951074][T26089] 8021q: adding VLAN 0 to HW filter on device bond6 [ 1181.961305][T26089] 8021q: adding VLAN 0 to HW filter on device bond7 [ 1181.978922][T26089] 8021q: adding VLAN 0 to HW filter on device bond8 [ 1181.987363][T26089] 8021q: adding VLAN 0 to HW filter on device bond9 [ 1182.003346][T26089] net_ratelimit: 18 callbacks suppressed [ 1182.003363][T26089] A link change request failed with some changes committed already. Interface vxlan1 may have been left with an inconsistent configuration, please check. [ 1182.051391][ T6228] netdevsim netdevsim3 eth0: set [0, 0] type 1 family 0 port 4352 - 0 [ 1182.059622][ T6228] netdevsim netdevsim3 eth0: set [0, 1] type 1 family 0 port 8472 - 0 [ 1182.067817][ T6228] netdevsim netdevsim3 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1182.076000][ T6228] netdevsim netdevsim3 eth0: set [1, 1] type 2 family 0 port 20000 - 0 [ 1182.084268][ T6228] netdevsim netdevsim3 eth0: set [1, 2] type 2 family 0 port 20004 - 0 [ 1182.092543][ T6228] netdevsim netdevsim3 eth1: set [0, 0] type 1 family 0 port 4352 - 0 [ 1182.100713][ T6228] netdevsim netdevsim3 eth1: set [0, 1] type 1 family 0 port 8472 - 0 [ 1182.116309][ T6228] netdevsim netdevsim3 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1182.126711][ T6228] netdevsim netdevsim3 eth1: set [1, 1] type 2 family 0 port 20000 - 0 [ 1182.140494][ T6228] netdevsim netdevsim3 eth1: set [1, 2] type 2 family 0 port 20004 - 0 [ 1182.185174][ T6228] netdevsim netdevsim3 eth2: set [0, 0] type 1 family 0 port 4352 - 0 [ 1182.206048][ T6228] netdevsim netdevsim3 eth2: set [0, 1] type 1 family 0 port 8472 - 0 [ 1182.228854][ T6228] netdevsim netdevsim3 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1182.251582][ T6228] netdevsim netdevsim3 eth2: set [1, 1] type 2 family 0 port 20000 - 0 [ 1182.259965][ T6228] netdevsim netdevsim3 eth2: set [1, 2] type 2 family 0 port 20004 - 0 [ 1182.268259][ T6228] netdevsim netdevsim3 eth3: set [0, 0] type 1 family 0 port 4352 - 0 [ 1182.276452][ T6228] netdevsim netdevsim3 eth3: set [0, 1] type 1 family 0 port 8472 - 0 [ 1182.284633][ T6228] netdevsim netdevsim3 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1182.292811][ T6228] netdevsim netdevsim3 eth3: set [1, 1] type 2 family 0 port 20000 - 0 [ 1182.301102][ T6228] netdevsim netdevsim3 eth3: set [1, 2] type 2 family 0 port 20004 - 0 [ 1182.349781][T26114] netlink: 32 bytes leftover after parsing attributes in process `syz.3.14728'. [ 1182.391281][T26114] netlink: 16186 bytes leftover after parsing attributes in process `syz.3.14728'. [ 1182.561250][ T5730] tipc: Node number set to 2442808147 [ 1182.602797][T26127] netlink: 'syz.0.14733': attribute type 1 has an invalid length. [ 1182.620828][T26115] syzkaller1: entered promiscuous mode [ 1182.634287][T26115] syzkaller1: entered allmulticast mode [ 1182.651964][ T13] bond9: (slave veth9): link status definitely up, 10000 Mbps full duplex [ 1182.662843][ T13] bond9: (slave veth9): making interface the new active one [ 1182.672370][ T13] bond9: active interface up! [ 1182.729462][ T12] bond5: (slave veth5): link status definitely up, 10000 Mbps full duplex [ 1182.769504][ T12] bond5: (slave veth5): making interface the new active one [ 1182.782910][ T12] bond5: active interface up! [ 1182.809229][ T6228] bond5: (slave bridge4): failed to get link speed/duplex [ 1182.922936][ T13] bond5: (slave bridge4): failed to get link speed/duplex [ 1183.050300][ T13] bond5: (slave bridge4): failed to get link speed/duplex [ 1183.087166][T26154] Cannot find set identified by id 0 to match [ 1183.169005][ T6228] bond5: (slave bridge4): failed to get link speed/duplex [ 1183.195791][T26156] mac80211_hwsim hwsim165 syzkaller0: left promiscuous mode [ 1183.214961][T26156] mac80211_hwsim hwsim165 syzkaller0: left allmulticast mode [ 1183.240850][T26160] netlink: 'syz.2.14745': attribute type 1 has an invalid length. [ 1183.252443][T26162] syzkaller1: entered promiscuous mode [ 1183.259206][T26162] syzkaller1: entered allmulticast mode [ 1183.288879][ T12] bond5: (slave bridge4): failed to get link speed/duplex [ 1183.392388][T26160] lo speed is unknown, defaulting to 1000 [ 1183.409640][ T13] bond5: (slave bridge4): failed to get link speed/duplex [ 1183.549072][ T6228] bond5: (slave bridge4): failed to get link speed/duplex [ 1183.689080][ T6228] bond5: (slave bridge4): failed to get link speed/duplex [ 1183.819202][ T35] bond5: (slave bridge4): failed to get link speed/duplex [ 1184.083482][T26202] netlink: 'syz.4.14755': attribute type 15 has an invalid length. [ 1184.093609][T26194] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1184.122460][T26194] 8021q: adding VLAN 0 to HW filter on device team0 [ 1184.185795][T26194] hsr0: A HSR master's MTU cannot be greater than the smallest MTU of its slaves minus the HSR Tag length (6 octets). [ 1184.231923][T16915] lo speed is unknown, defaulting to 1000 [ 1184.245360][T16915] syz1: Port: 1 Link ACTIVE [ 1184.291266][T26160] lo speed is unknown, defaulting to 1000 [ 1184.300138][T16921] lo speed is unknown, defaulting to 1000 [ 1185.114912][T26245] __nla_validate_parse: 8 callbacks suppressed [ 1185.114946][T26245] netlink: 16 bytes leftover after parsing attributes in process `syz.3.14771'. [ 1185.190284][T26245] netlink: 4 bytes leftover after parsing attributes in process `syz.3.14771'. [ 1185.264403][T26245] netlink: 212348 bytes leftover after parsing attributes in process `syz.3.14771'. [ 1185.314816][T26241] syzkaller1: entered promiscuous mode [ 1185.341501][T26241] syzkaller1: entered allmulticast mode [ 1185.455438][T26260] netlink: 4 bytes leftover after parsing attributes in process `syz.4.14776'. [ 1185.555512][T26265] netlink: 'syz.3.14775': attribute type 13 has an invalid length. [ 1185.612573][T26265] gretap0: refused to change device tx_queue_len [ 1185.846246][T26287] netlink: 4 bytes leftover after parsing attributes in process `syz.4.14784'. [ 1186.059820][T26291] syzkaller0: entered promiscuous mode [ 1186.065569][T26291] syzkaller0: entered allmulticast mode [ 1186.076095][T26303] syzkaller1: entered promiscuous mode [ 1186.087581][T26303] syzkaller1: entered allmulticast mode [ 1186.298011][T26322] netlink: 3 bytes leftover after parsing attributes in process `syz.1.14794'. [ 1186.400613][T26330] netlink: 'syz.1.14797': attribute type 2 has an invalid length. [ 1186.420029][T26330] netlink: 7 bytes leftover after parsing attributes in process `syz.1.14797'. [ 1186.495000][T26335] workqueue: Failed to create a rescuer kthread for wq "nfc2_nci_rx_wq": -EINTR [ 1186.571787][T26341] bridge6: entered promiscuous mode [ 1186.609894][T26341] bridge6: entered allmulticast mode [ 1187.024882][T26368] netlink: 44 bytes leftover after parsing attributes in process `syz.4.14807'. [ 1187.083675][ T6939] net_ratelimit: 25 callbacks suppressed [ 1187.083694][ T6939] bond5: (slave bridge4): failed to get link speed/duplex [ 1187.126682][T26377] netlink: del zone limit has 8 unknown bytes [ 1187.135678][T26374] A link change request failed with some changes committed already. Interface macvlan0 may have been left with an inconsistent configuration, please check. [ 1187.186068][T26377] lo speed is unknown, defaulting to 1000 [ 1187.219233][ T6241] bond5: (slave bridge4): failed to get link speed/duplex [ 1187.325931][T26385] netlink: 48 bytes leftover after parsing attributes in process `syz.4.14812'. [ 1187.339036][ T6228] bond5: (slave bridge4): failed to get link speed/duplex [ 1187.458619][ T6226] bond5: (slave bridge4): failed to get link speed/duplex [ 1187.578884][ T6228] bond5: (slave bridge4): failed to get link speed/duplex [ 1187.699015][ T6228] bond5: (slave bridge4): failed to get link speed/duplex [ 1187.820064][ T6228] bond5: (slave bridge4): failed to get link speed/duplex [ 1187.935339][T26377] lo speed is unknown, defaulting to 1000 [ 1187.948967][ T6228] bond5: (slave bridge4): failed to get link speed/duplex [ 1188.526462][T26418] sctp: [Deprecated]: syz.2.14819 (pid 26418) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1188.526462][T26418] Use struct sctp_sack_info instead [ 1189.350986][T26438] IPVS: sync thread started: state = BACKUP, mcast_ifn = lo, syncid = 1, id = 0 [ 1189.478530][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 1189.619863][T26447] netlink: 16 bytes leftover after parsing attributes in process `syz.1.14828'. [ 1189.854254][T26450] batman_adv: batadv0: Adding interface: dummy0 [ 1189.862343][T26450] batman_adv: batadv0: The MTU of interface dummy0 is too small (1280) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1312 would solve the problem. [ 1189.896304][T26450] batman_adv: batadv0: Interface activated: dummy0 [ 1190.183855][T26470] syzkaller1: entered promiscuous mode [ 1190.198755][T26470] syzkaller1: entered allmulticast mode [ 1190.545967][T26486] netlink: 28 bytes leftover after parsing attributes in process `syz.4.14841'. [ 1190.577462][T26486] netlink: 'syz.4.14841': attribute type 7 has an invalid length. [ 1190.595492][T26486] netlink: 'syz.4.14841': attribute type 8 has an invalid length. [ 1190.622777][T26486] netlink: 4 bytes leftover after parsing attributes in process `syz.4.14841'. [ 1191.537116][T26515] lo speed is unknown, defaulting to 1000 [ 1191.738337][T26525] netlink: 'syz.3.14850': attribute type 13 has an invalid length. [ 1192.157976][T26551] netlink: 24 bytes leftover after parsing attributes in process `syz.2.14861'. [ 1192.232931][T26525] syzkaller0: entered promiscuous mode [ 1192.239673][T26525] syzkaller0: entered allmulticast mode [ 1192.249153][T26539] net_ratelimit: 32 callbacks suppressed [ 1192.249173][T26539] A link change request failed with some changes committed already. Interface veth1_vlan may have been left with an inconsistent configuration, please check. [ 1192.326450][T26544] netlink: 'syz.1.14859': attribute type 12 has an invalid length. [ 1192.340546][T26544] netlink: 132 bytes leftover after parsing attributes in process `syz.1.14859'. [ 1192.359425][T26530] lo speed is unknown, defaulting to 1000 [ 1192.369215][ T6241] bond5: (slave bridge4): failed to get link speed/duplex [ 1192.499274][ T6226] bond5: (slave bridge4): failed to get link speed/duplex [ 1192.616329][T26566] netlink: 'syz.1.14865': attribute type 11 has an invalid length. [ 1192.628602][ T6226] bond5: (slave bridge4): failed to get link speed/duplex [ 1192.758892][ T6939] bond5: (slave bridge4): failed to get link speed/duplex [ 1192.920557][ T6939] bond5: (slave bridge4): failed to get link speed/duplex [ 1192.971756][T26574] team0: Port device syz_tun removed [ 1192.984446][T26579] netlink: 'syz.2.14868': attribute type 1 has an invalid length. [ 1193.025565][T26574] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 1193.058796][T26582] netlink: 44 bytes leftover after parsing attributes in process `syz.2.14868'. [ 1193.068642][ T6939] bond5: (slave bridge4): failed to get link speed/duplex [ 1193.071167][T26515] lo speed is unknown, defaulting to 1000 [ 1193.107795][T26579] bond1: entered promiscuous mode [ 1193.112905][T26579] bond1: entered allmulticast mode [ 1193.118333][T26579] 8021q: adding VLAN 0 to HW filter on device bond1 [ 1193.178571][ T6939] bond5: (slave bridge4): failed to get link speed/duplex [ 1193.191023][T26587] xt_hashlimit: size too large, truncated to 1048576 [ 1193.285728][T26530] lo speed is unknown, defaulting to 1000 [ 1193.301669][T26582] netlink: 112 bytes leftover after parsing attributes in process `syz.2.14868'. [ 1193.338381][ T6226] bond5: (slave bridge4): failed to get link speed/duplex [ 1193.398357][T26582] netlink: 112 bytes leftover after parsing attributes in process `syz.2.14868'. [ 1193.645081][T26605] hsr0: A HSR master's MTU cannot be greater than the smallest MTU of its slaves minus the HSR Tag length (6 octets). [ 1194.505692][T26618] netlink: 'syz.0.14878': attribute type 2 has an invalid length. [ 1194.561365][T26623] netlink: 12 bytes leftover after parsing attributes in process `syz.1.14880'. [ 1194.577556][T26623] vlan2: entered promiscuous mode [ 1194.586004][T26623] geneve1: entered promiscuous mode [ 1194.592119][T26623] vlan2: entered allmulticast mode [ 1194.597327][T26623] geneve1: entered allmulticast mode [ 1194.717654][T26635] netlink: 8 bytes leftover after parsing attributes in process `syz.1.14884'. [ 1196.500567][T26596] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1196.614172][T26644] netlink: 4 bytes leftover after parsing attributes in process `syz.0.14886'. [ 1196.704585][T26652] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for gretap2 [ 1196.740358][T26652] batman_adv: batadv0: Adding interface: gretap2 [ 1196.749461][T26652] batman_adv: batadv0: The MTU of interface gretap2 is too small (1462) to handle the transport of batman-adv packets. If you experience problems getting traffic through try increasing the MTU to 1532. [ 1196.782010][T26659] netlink: 'syz.1.14890': attribute type 89 has an invalid length. [ 1196.791220][T26652] batman_adv: batadv0: Interface activated: gretap2 [ 1197.077407][T26674] netlink: 5132 bytes leftover after parsing attributes in process `syz.3.14897'. [ 1197.102457][T26671] netlink: 356 bytes leftover after parsing attributes in process `syz.2.14896'. [ 1197.118622][T26675] netlink: 'syz.1.14895': attribute type 1 has an invalid length. [ 1197.134780][T26676] netlink: 356 bytes leftover after parsing attributes in process `syz.2.14896'. [ 1197.154258][T26678] netlink: 24 bytes leftover after parsing attributes in process `syz.4.14898'. [ 1197.185919][T26675] bond13: entered promiscuous mode [ 1197.192208][T26675] 8021q: adding VLAN 0 to HW filter on device bond13 [ 1197.256216][T26680] bond13: (slave bridge7): making interface the new active one [ 1197.298979][T26680] bridge7: entered promiscuous mode [ 1197.305167][T26687] netlink: 332 bytes leftover after parsing attributes in process `syz.2.14899'. [ 1197.332838][T26680] bond13: (slave bridge7): Enslaving as an active interface with an up link [ 1197.363175][T26687] netlink: 'syz.2.14899': attribute type 9 has an invalid length. [ 1197.401672][T26678] ip6gre2: entered promiscuous mode [ 1197.413818][T26690] net_ratelimit: 32 callbacks suppressed [ 1197.413837][T26690] openvswitch: netlink: nsh attribute has 16 unknown bytes. [ 1197.432694][T26678] ip6gre2: entered allmulticast mode [ 1197.457563][T26675] bond13: (slave ipvlan2): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 1197.487337][T26687] netlink: 'syz.2.14899': attribute type 1 has an invalid length. [ 1197.516661][T26690] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1197.531942][T26675] bond13: (slave ipvlan2): The slave device specified does not support setting the MAC address [ 1197.560725][T14709] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 1197.567973][T14709] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 1197.575200][T14709] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 1197.591278][T14709] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 1197.599171][T14709] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 1197.629360][ T13] bond5: (slave bridge4): failed to get link speed/duplex [ 1197.803433][ T6228] bond5: (slave bridge4): failed to get link speed/duplex [ 1197.939185][ T6939] bond5: (slave bridge4): failed to get link speed/duplex [ 1197.961676][T26726] netlink: 212368 bytes leftover after parsing attributes in process `syz.2.14909'. [ 1198.066173][ T13] bond5: (slave bridge4): failed to get link speed/duplex [ 1198.196811][T26734] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1198.213581][T15342] syz_tun (unregistering): left allmulticast mode [ 1198.279857][ T13] bond5: (slave bridge4): failed to get link speed/duplex [ 1198.333657][ T6228] netdevsim netdevsim3 eth3 (unregistering): unset [0, 0] type 1 family 0 port 4352 - 0 [ 1198.360924][ T6228] netdevsim netdevsim3 eth3 (unregistering): unset [0, 1] type 1 family 0 port 8472 - 0 [ 1198.374486][ T6228] netdevsim netdevsim3 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1198.384455][ T6228] netdevsim netdevsim3 eth3 (unregistering): unset [1, 1] type 2 family 0 port 20000 - 0 [ 1198.395023][ T6228] netdevsim netdevsim3 eth3 (unregistering): unset [1, 2] type 2 family 0 port 20004 - 0 [ 1198.413801][T26695] lo speed is unknown, defaulting to 1000 [ 1198.419835][ T6941] bond5: (slave bridge4): failed to get link speed/duplex [ 1198.477843][ T6228] netdevsim netdevsim3 eth2 (unregistering): unset [0, 0] type 1 family 0 port 4352 - 0 [ 1198.498356][ T6228] netdevsim netdevsim3 eth2 (unregistering): unset [0, 1] type 1 family 0 port 8472 - 0 [ 1198.510346][ T6228] netdevsim netdevsim3 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1198.520099][ T6228] netdevsim netdevsim3 eth2 (unregistering): unset [1, 1] type 2 family 0 port 20000 - 0 [ 1198.533195][ T6228] netdevsim netdevsim3 eth2 (unregistering): unset [1, 2] type 2 family 0 port 20004 - 0 [ 1198.617991][ T6241] bond5: (slave bridge4): failed to get link speed/duplex [ 1198.676221][T26695] lo speed is unknown, defaulting to 1000 [ 1198.947541][ T6228] netdevsim netdevsim3 eth1 (unregistering): unset [0, 0] type 1 family 0 port 4352 - 0 [ 1198.957357][ T6228] netdevsim netdevsim3 eth1 (unregistering): unset [0, 1] type 1 family 0 port 8472 - 0 [ 1198.967111][ T6228] netdevsim netdevsim3 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1198.976861][ T6228] netdevsim netdevsim3 eth1 (unregistering): unset [1, 1] type 2 family 0 port 20000 - 0 [ 1198.986691][ T6228] netdevsim netdevsim3 eth1 (unregistering): unset [1, 2] type 2 family 0 port 20004 - 0 [ 1199.196869][T26759] ipvlan2: entered promiscuous mode [ 1199.211112][T26771] netlink: 'syz.1.14919': attribute type 4 has an invalid length. [ 1199.223513][ T6228] netdevsim netdevsim3 eth0 (unregistering): unset [0, 0] type 1 family 0 port 4352 - 0 [ 1199.233664][ T6228] netdevsim netdevsim3 eth0 (unregistering): unset [0, 1] type 1 family 0 port 8472 - 0 [ 1199.243425][ T6228] netdevsim netdevsim3 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1199.281715][ T6228] netdevsim netdevsim3 eth0 (unregistering): unset [1, 1] type 2 family 0 port 20000 - 0 [ 1199.292296][ T6228] netdevsim netdevsim3 eth0 (unregistering): unset [1, 2] type 2 family 0 port 20004 - 0 [ 1199.377343][T26695] bridge0: port 1(bridge_slave_0) entered blocking state [ 1199.391027][T26695] bridge0: port 1(bridge_slave_0) entered disabled state [ 1199.400537][T26695] bridge_slave_0: entered allmulticast mode [ 1199.407801][T26695] bridge_slave_0: entered promiscuous mode [ 1199.424628][T26695] bridge0: port 2(bridge_slave_1) entered blocking state [ 1199.439857][T26695] bridge0: port 2(bridge_slave_1) entered disabled state [ 1199.467700][T26695] bridge_slave_1: entered allmulticast mode [ 1199.491543][T26695] bridge_slave_1: entered promiscuous mode [ 1199.575444][T26695] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1199.607965][T26695] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1199.629446][T26785] netlink: 24 bytes leftover after parsing attributes in process `syz.2.14923'. [ 1199.650313][T14709] Bluetooth: hci3: command tx timeout [ 1199.737940][T26695] team0: Port device team_slave_0 added [ 1199.770831][ T6228] pimreg: left allmulticast mode [ 1199.803274][ T6228] batman_adv: batadv0: Interface deactivated: gretap1 [ 1199.834312][T26797] xt_CONNSECMARK: only valid in 'mangle' or 'security' table, not 'raw' [ 1199.853531][T26797] netlink: 4 bytes leftover after parsing attributes in process `syz.1.14926'. [ 1200.063357][ T6228] batman_adv: batadv0: Removing interface: gretap1 [ 1200.139891][ T6228] bond0 (unregistering): Released all slaves [ 1200.156293][ T6228] bond1 (unregistering): Released all slaves [ 1200.170621][ T6228] bond2 (unregistering): Released all slaves [ 1200.182574][ T6228] bond3 (unregistering): Released all slaves [ 1200.194173][ T6228] bond4 (unregistering): Released all slaves [ 1200.207373][ T6228] bond5 (unregistering): (slave veth5): Releasing active interface [ 1200.230207][ T6228] bond5 (unregistering): Released all slaves [ 1200.242321][ T6228] bond6 (unregistering): Released all slaves [ 1200.254264][ T6228] bond7 (unregistering): Released all slaves [ 1200.267122][ T6228] bond8 (unregistering): Released all slaves [ 1200.278723][ T6228] bond9 (unregistering): (slave veth9): Releasing active interface [ 1200.293445][ T6228] bond9 (unregistering): Released all slaves [ 1200.305328][T26695] team0: Port device team_slave_1 added [ 1200.311392][T26794] netlink: 4 bytes leftover after parsing attributes in process `syz.4.14925'. [ 1200.339707][T26695] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1200.346691][T26695] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1200.460802][T26695] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1200.487132][T26816] IPv6: NLM_F_CREATE should be specified when creating new route [ 1200.499913][ T6941] bond5: (slave bridge4): failed to get link speed/duplex [ 1200.508070][T26695] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1200.515049][T26695] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1200.548416][T26695] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1200.554913][T26816] IPVS: set_ctl: invalid protocol: 58 172.30.1.2:20002 [ 1200.619648][T26695] hsr_slave_0: entered promiscuous mode [ 1200.636545][T26695] hsr_slave_1: entered promiscuous mode [ 1200.670873][T26695] debugfs: 'hsr0' already exists in 'hsr' [ 1200.682192][T26695] Cannot create hsr debugfs directory [ 1200.745480][ T6228] tipc: Disabling bearer [ 1200.755917][ T6228] tipc: Disabling bearer [ 1200.793261][ T6228] tipc: Left network mode [ 1201.341732][ T5284] 8021q: adding VLAN 0 to HW filter on device eth1 [ 1201.633278][T26695] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 1201.729288][T14709] Bluetooth: hci3: command tx timeout [ 1201.744483][T26695] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1201.811329][T26695] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 1201.876539][T26695] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1201.915312][T26695] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 1201.937887][T26877] netlink: 72 bytes leftover after parsing attributes in process `syz.4.14942'. [ 1201.987992][T26695] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1202.022426][ T6228] batman_adv: batadv0: Interface deactivated: dummy0 [ 1202.048120][ T6228] batman_adv: batadv0: Removing interface: dummy0 [ 1202.110469][ T6228] veth1_vlan: left promiscuous mode [ 1202.127925][ T6228] veth0_vlan: left promiscuous mode [ 1202.192425][T26894] netlink: 'syz.0.14946': attribute type 1 has an invalid length. [ 1202.322136][T26902] netlink: 28 bytes leftover after parsing attributes in process `syz.0.14946'. [ 1202.540625][T26695] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 1202.551445][T26695] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1202.560696][ T6241] net_ratelimit: 4 callbacks suppressed [ 1202.560712][ T6241] bond5: (slave bridge4): failed to get link speed/duplex [ 1202.613897][T26898] bond6: (slave geneve3): making interface the new active one [ 1202.622207][T26898] bond6: (slave geneve3): Enslaving as an active interface with an up link [ 1202.642143][ T6941] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 20000 - 0 [ 1202.644524][T26880] lo speed is unknown, defaulting to 1000 [ 1202.671354][ T6941] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 20000 - 0 [ 1202.700544][ T6941] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 20000 - 0 [ 1202.731482][ T6941] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 20000 - 0 [ 1202.849194][ T35] bond5: (slave bridge4): failed to get link speed/duplex [ 1202.929087][T26695] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1202.960068][T26927] netlink: 4 bytes leftover after parsing attributes in process `syz.0.14949'. [ 1203.034686][T26917] lo speed is unknown, defaulting to 1000 [ 1203.039808][T26695] 8021q: adding VLAN 0 to HW filter on device team0 [ 1203.052022][ T6241] bridge0: port 1(bridge_slave_0) entered blocking state [ 1203.059308][ T6241] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1203.088616][ T13] bond5: (slave bridge4): failed to get link speed/duplex [ 1203.166818][T26695] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 1203.177214][T26695] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 1203.249138][ T6241] bridge0: port 2(bridge_slave_1) entered blocking state [ 1203.256301][ T6241] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1203.292364][T26880] lo speed is unknown, defaulting to 1000 [ 1203.307298][ T6226] bond5: (slave bridge4): failed to get link speed/duplex [ 1203.359446][T26932] netlink: 'syz.0.14950': attribute type 11 has an invalid length. [ 1203.386978][T26929] Bluetooth: MGMT ver 1.23 [ 1203.420251][ T6241] bond5: (slave bridge4): failed to get link speed/duplex [ 1203.481687][T26932] netlink: 4 bytes leftover after parsing attributes in process `syz.0.14950'. [ 1203.539561][T26922] netlink: 8 bytes leftover after parsing attributes in process `syz.1.14948'. [ 1203.570600][T26922] netlink: 32 bytes leftover after parsing attributes in process `syz.1.14948'. [ 1203.674752][T26932] syz_tun (unregistering): left allmulticast mode [ 1203.692402][T26926] lo speed is unknown, defaulting to 1000 [ 1203.812437][T14709] Bluetooth: hci3: command tx timeout [ 1203.978927][ T6941] bond5: (slave bridge4): failed to get link speed/duplex [ 1204.091606][T26917] lo speed is unknown, defaulting to 1000 [ 1204.101020][ T13] bond5: (slave bridge4): failed to get link speed/duplex [ 1204.229297][ T6941] bond5: (slave bridge4): failed to get link speed/duplex [ 1204.262461][ T6228] IPVS: stop unused estimator thread 0... [ 1204.502292][ T6941] bond5: (slave bridge4): failed to get link speed/duplex [ 1204.585493][T26695] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1204.796076][T26926] lo speed is unknown, defaulting to 1000 [ 1204.823777][T26695] veth0_vlan: entered promiscuous mode [ 1204.864864][T26695] veth1_vlan: entered promiscuous mode [ 1204.877932][T26968] netdevsim netdevsim0 eth3 (unregistering): unset [1, 0] type 2 family 0 port 20000 - 0 [ 1204.980707][T26968] netdevsim netdevsim0 eth2 (unregistering): unset [1, 0] type 2 family 0 port 20000 - 0 [ 1205.019903][T26695] veth0_macvtap: entered promiscuous mode [ 1205.041470][T26695] veth1_macvtap: entered promiscuous mode [ 1205.079502][T26695] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1205.109945][T26695] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1205.161446][ T12] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1205.170364][ T12] bond5: (slave bridge4): failed to get link speed/duplex [ 1205.197035][T26968] netdevsim netdevsim0 eth1 (unregistering): unset [1, 0] type 2 family 0 port 20000 - 0 [ 1205.215399][ T6226] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1205.293623][ T6226] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1205.317013][ T6226] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1205.370160][T26976] netlink: 60 bytes leftover after parsing attributes in process `syz.4.14960'. [ 1205.408471][T26968] netdevsim netdevsim0 eth0 (unregistering): unset [1, 0] type 2 family 0 port 20000 - 0 [ 1205.569787][ T6226] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1205.579616][ T6226] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1205.652828][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1205.660974][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1205.755385][ T6939] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 20000 - 0 [ 1205.777843][ T6939] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 20000 - 0 [ 1205.796834][T26978] netlink: 12 bytes leftover after parsing attributes in process `syz.3.14900'. [ 1205.808084][ T6939] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 20000 - 0 [ 1205.884245][T14709] Bluetooth: hci3: command tx timeout [ 1205.904464][ T6241] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 20000 - 0 [ 1206.004694][T26980] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1206.031767][T26980] 8021q: adding VLAN 0 to HW filter on device team0 [ 1206.075848][T26980] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1206.243996][T26980] virt_wifi0: default qdisc (pfifo_fast) fail, fallback to noqueue [ 1206.265334][T26980] veth1_vlan: left promiscuous mode [ 1206.276111][T26995] netlink: 36 bytes leftover after parsing attributes in process `syz.0.14967'. [ 1206.291513][T26980] veth0_vlan: left promiscuous mode [ 1206.309698][T26980] veth0_vlan: entered promiscuous mode [ 1206.350104][T26995] netlink: 4 bytes leftover after parsing attributes in process `syz.0.14967'. [ 1206.351062][T26980] veth1_vlan: entered promiscuous mode [ 1206.420679][T26980] veth1_macvtap: left promiscuous mode [ 1206.440848][T26980] veth0_macvtap: left promiscuous mode [ 1206.449685][T26980] veth0_macvtap: entered promiscuous mode [ 1206.725143][T27002] lo speed is unknown, defaulting to 1000 [ 1206.769092][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 1206.980305][T27019] netlink: 16 bytes leftover after parsing attributes in process `syz.1.14973'. [ 1207.003782][T27019] netlink: 'syz.1.14973': attribute type 5 has an invalid length. [ 1207.431328][T27041] x_tables: ip_tables: DNAT target: used from hooks POSTROUTING, but only usable from PREROUTING/OUTPUT [ 1207.449382][T27043] netlink: 12 bytes leftover after parsing attributes in process `syz.0.14981'. [ 1207.500266][T27002] lo speed is unknown, defaulting to 1000 [ 1207.642730][ T13] net_ratelimit: 11 callbacks suppressed [ 1207.642753][ T13] bond5: (slave bridge4): failed to get link speed/duplex [ 1207.854719][T27063] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1207.868747][ T6241] bond5: (slave bridge4): failed to get link speed/duplex [ 1207.954037][T27063] mac80211_hwsim hwsim165 syzkaller0: entered promiscuous mode [ 1207.984984][T27063] mac80211_hwsim hwsim165 syzkaller0: entered allmulticast mode [ 1208.019126][ T13] bond5: (slave bridge4): failed to get link speed/duplex [ 1208.182466][T27072] netlink: 12 bytes leftover after parsing attributes in process `syz.1.14993'. [ 1208.194906][T27073] netlink: 8 bytes leftover after parsing attributes in process `syz.4.14994'. [ 1208.204258][ T6224] bond5: (slave bridge4): failed to get link speed/duplex [ 1208.308381][ T6226] bond5: (slave bridge4): failed to get link speed/duplex [ 1208.442350][ T6939] bond5: (slave bridge4): failed to get link speed/duplex [ 1208.590452][ T6939] bond5: (slave bridge4): failed to get link speed/duplex [ 1208.731201][T27094] netlink: 12 bytes leftover after parsing attributes in process `syz.3.14999'. [ 1208.767768][T27096] netlink: 152 bytes leftover after parsing attributes in process `syz.1.15000'. [ 1208.830778][T27094] veth3: entered allmulticast mode [ 1208.914711][T27111] netlink: 'syz.1.15003': attribute type 13 has an invalid length. [ 1208.923139][T27111] netlink: 'syz.1.15003': attribute type 17 has an invalid length. [ 1208.973741][T27106] netlink: 12 bytes leftover after parsing attributes in process `syz.4.15001'. [ 1209.149272][T27120] netlink: 4 bytes leftover after parsing attributes in process `syz.1.15003'. [ 1209.170466][T27105] batman_adv: batadv0: Interface deactivated: gretap2 [ 1209.219245][T27111] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1209.227710][T27111] 8021q: adding VLAN 0 to HW filter on device team0 [ 1209.239362][T27111] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1209.367514][T27111] veth1_vlan: left promiscuous mode [ 1209.374896][T27111] veth0_vlan: left promiscuous mode [ 1209.382668][T27111] veth0_vlan: entered promiscuous mode [ 1209.393306][T27111] veth1_vlan: entered promiscuous mode [ 1209.421321][T27111] 8021q: adding VLAN 0 to HW filter on device bond1 [ 1209.472441][T27111] 8021q: adding VLAN 0 to HW filter on device bond2 [ 1209.481839][T27111] 8021q: adding VLAN 0 to HW filter on device bond3 [ 1209.495999][T27111] 8021q: adding VLAN 0 to HW filter on device bond4 [ 1209.506299][T27111] 8021q: adding VLAN 0 to HW filter on device bond5 [ 1209.518560][T27111] A link change request failed with some changes committed already. Interface vxlan0 may have been left with an inconsistent configuration, please check. [ 1209.604922][ T6226] bond5: (slave bridge4): failed to get link speed/duplex [ 1209.782194][ T35] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 1209.814595][T27130] sit0: entered promiscuous mode [ 1209.854985][T27130] netlink: 'syz.3.15008': attribute type 1 has an invalid length. [ 1209.869344][T27139] workqueue: Failed to create a rescuer kthread for wq "nfc3_nci_tx_wq": -EINTR [ 1209.913815][T27155] netlink: 236 bytes leftover after parsing attributes in process `syz.0.15011'. [ 1209.977112][T27130] netlink: 1 bytes leftover after parsing attributes in process `syz.3.15008'. [ 1210.064593][T27162] netlink: 'syz.2.15015': attribute type 8 has an invalid length. [ 1210.106834][T27159] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 1210.114693][T27159] IPv6: NLM_F_CREATE should be set when creating new route [ 1210.122520][T27159] IPv6: NLM_F_CREATE should be set when creating new route [ 1210.130301][T27159] IPv6: NLM_F_CREATE should be set when creating new route [ 1210.451803][T27188] veth1_to_bond: entered promiscuous mode [ 1210.566128][T27195] syzkaller0: entered promiscuous mode [ 1210.591515][T27195] syzkaller0: entered allmulticast mode [ 1210.627593][T27195] tipc: Enabled bearer , priority 0 [ 1210.771855][T27187] tipc: Resetting bearer [ 1210.792227][T27187] tipc: Disabling bearer [ 1210.855669][T27187] veth1_to_bond: left promiscuous mode [ 1210.993301][T27227] tun0: tun_chr_ioctl cmd 1074025673 [ 1211.008804][T27230] tun0: tun_chr_ioctl cmd 1074025673 [ 1211.083077][T27242] IPVS: sync thread started: state = BACKUP, mcast_ifn = veth0_to_hsr, syncid = 1, id = 0 [ 1211.204650][T27248] syzkaller1: entered promiscuous mode [ 1211.210922][T27248] syzkaller1: entered allmulticast mode [ 1211.523506][T27260] lo speed is unknown, defaulting to 1000 [ 1212.067898][T27260] lo speed is unknown, defaulting to 1000 [ 1212.367969][T27294] FAULT_INJECTION: forcing a failure. [ 1212.367969][T27294] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1212.388886][T27294] CPU: 1 UID: 0 PID: 27294 Comm: syz.0.15060 Not tainted syzkaller #0 PREEMPT(full) [ 1212.388915][T27294] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1212.388929][T27294] Call Trace: [ 1212.388938][T27294] [ 1212.388947][T27294] dump_stack_lvl+0xe8/0x150 [ 1212.388975][T27294] should_fail_ex+0x40c/0x560 [ 1212.389000][T27294] _copy_from_user+0x2d/0xb0 [ 1212.389029][T27294] ___sys_sendmsg+0x1c6/0x360 [ 1212.389059][T27294] ? rcu_is_watching+0x15/0xb0 [ 1212.389079][T27294] ? get_pid_task+0x20/0x1f0 [ 1212.389100][T27294] ? __pfx____sys_sendmsg+0x10/0x10 [ 1212.389133][T27294] ? rcu_is_watching+0x15/0xb0 [ 1212.389170][T27294] ? __fget_files+0x2a/0x420 [ 1212.389194][T27294] ? __fget_files+0x3a2/0x420 [ 1212.389223][T27294] __x64_sys_sendmsg+0x1b1/0x290 [ 1212.389268][T27294] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1212.389306][T27294] ? rcu_is_watching+0x15/0xb0 [ 1212.389343][T27294] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1212.389361][T27294] do_syscall_64+0x174/0x580 [ 1212.389385][T27294] ? trace_irq_disable+0x3b/0x140 [ 1212.389409][T27294] ? clear_bhb_loop+0x40/0x90 [ 1212.389429][T27294] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1212.389446][T27294] RIP: 0033:0x7f4c7d39ce59 [ 1212.389462][T27294] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1212.389477][T27294] RSP: 002b:00007f4c7e2df028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1212.389497][T27294] RAX: ffffffffffffffda RBX: 00007f4c7d615fa0 RCX: 00007f4c7d39ce59 [ 1212.389509][T27294] RDX: 0000000000000010 RSI: 0000200000000980 RDI: 0000000000000003 [ 1212.389520][T27294] RBP: 00007f4c7e2df090 R08: 0000000000000000 R09: 0000000000000000 [ 1212.389531][T27294] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1212.389542][T27294] R13: 00007f4c7d616038 R14: 00007f4c7d615fa0 R15: 00007ffe5df93078 [ 1212.389563][T27294] [ 1212.697209][T27297] FAULT_INJECTION: forcing a failure. [ 1212.697209][T27297] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1212.723250][T27300] tipc: Enabled bearer , priority 0 [ 1212.731316][T27300] +: renamed from syzkaller0 [ 1212.736301][T27297] CPU: 1 UID: 0 PID: 27297 Comm: syz.2.15061 Not tainted syzkaller #0 PREEMPT(full) [ 1212.736327][T27297] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1212.736340][T27297] Call Trace: [ 1212.736348][T27297] [ 1212.736356][T27297] dump_stack_lvl+0xe8/0x150 [ 1212.736382][T27297] should_fail_ex+0x40c/0x560 [ 1212.736406][T27297] _copy_to_user+0x31/0xb0 [ 1212.736434][T27297] simple_read_from_buffer+0xe1/0x170 [ 1212.736460][T27297] proc_fail_nth_read+0x1bb/0x230 [ 1212.736487][T27297] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1212.736516][T27297] ? rw_verify_area+0x24a/0x4c0 [ 1212.736543][T27297] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1212.736569][T27297] vfs_read+0x213/0xa80 [ 1212.736597][T27297] ? __pfx___mutex_lock+0x10/0x10 [ 1212.736623][T27297] ? __pfx_vfs_read+0x10/0x10 [ 1212.736652][T27297] ? __fget_files+0x3a2/0x420 [ 1212.736672][T27297] ? __fget_files+0x2a/0x420 [ 1212.736698][T27297] ksys_read+0x150/0x270 [ 1212.736724][T27297] ? __pfx_ksys_read+0x10/0x10 [ 1212.736751][T27297] ? rcu_is_watching+0x15/0xb0 [ 1212.736773][T27297] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1212.736794][T27297] do_syscall_64+0x174/0x580 [ 1212.736819][T27297] ? trace_irq_disable+0x3b/0x140 [ 1212.736857][T27297] ? clear_bhb_loop+0x40/0x90 [ 1212.736880][T27297] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1212.736900][T27297] RIP: 0033:0x7fc61055d68e [ 1212.736918][T27297] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1212.736935][T27297] RSP: 002b:00007fc60e7f5fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1212.736957][T27297] RAX: ffffffffffffffda RBX: 00007fc60e7f66c0 RCX: 00007fc61055d68e [ 1212.736973][T27297] RDX: 000000000000000f RSI: 00007fc60e7f60a0 RDI: 0000000000000004 [ 1212.736986][T27297] RBP: 00007fc60e7f6090 R08: 0000000000000000 R09: 0000000000000000 [ 1212.736998][T27297] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1212.737011][T27297] R13: 00007fc610816038 R14: 00007fc610815fa0 R15: 00007ffd5bcee618 [ 1212.737036][T27297] [ 1212.750061][T27300] tipc: Disabling bearer [ 1213.040456][ T6241] net_ratelimit: 20 callbacks suppressed [ 1213.040477][ T6241] bond5: (slave bridge4): failed to get link speed/duplex [ 1213.057096][T27307] __nla_validate_parse: 5 callbacks suppressed [ 1213.057116][T27307] netlink: 36 bytes leftover after parsing attributes in process `syz.2.15064'. [ 1213.234678][T27315] syzkaller1: entered promiscuous mode [ 1213.240218][T27315] syzkaller1: entered allmulticast mode [ 1213.279578][ T13] bond5: (slave bridge4): failed to get link speed/duplex [ 1213.400085][ T13] bond5: (slave bridge4): failed to get link speed/duplex [ 1213.518891][ T13] bond5: (slave bridge4): failed to get link speed/duplex [ 1213.628579][ T13] bond5: (slave bridge4): failed to get link speed/duplex [ 1213.752029][ T6241] bond5: (slave bridge4): failed to get link speed/duplex [ 1213.879598][ C0] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 1213.890068][ T13] bond5: (slave bridge4): failed to get link speed/duplex [ 1214.020858][ T6241] bond5: (slave bridge4): failed to get link speed/duplex [ 1214.040175][T27354] FAULT_INJECTION: forcing a failure. [ 1214.040175][T27354] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1214.053283][T27354] CPU: 1 UID: 0 PID: 27354 Comm: syz.1.15085 Not tainted syzkaller #0 PREEMPT(full) [ 1214.053309][T27354] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1214.053322][T27354] Call Trace: [ 1214.053331][T27354] [ 1214.053339][T27354] dump_stack_lvl+0xe8/0x150 [ 1214.053367][T27354] should_fail_ex+0x40c/0x560 [ 1214.053391][T27354] _copy_from_iter+0x1d3/0x1660 [ 1214.053418][T27354] ? rcu_is_watching+0x15/0xb0 [ 1214.053443][T27354] ? __pfx__copy_from_iter+0x10/0x10 [ 1214.053465][T27354] ? kmem_cache_alloc_node_noprof+0x3ca/0x680 [ 1214.053497][T27354] ? netlink_sendmsg+0x650/0xb40 [ 1214.053527][T27354] ? skb_put+0x112/0x210 [ 1214.053554][T27354] netlink_sendmsg+0x6c0/0xb40 [ 1214.053589][T27354] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1214.053621][T27354] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1214.053642][T27354] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1214.053667][T27354] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1214.053698][T27354] ____sys_sendmsg+0x9b9/0xa20 [ 1214.053732][T27354] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1214.053762][T27354] ? lock_release+0x4b/0x3c0 [ 1214.053793][T27354] ? import_iovec+0x73/0xa0 [ 1214.053820][T27354] ___sys_sendmsg+0x2a5/0x360 [ 1214.053849][T27354] ? rcu_is_watching+0x15/0xb0 [ 1214.053867][T27354] ? get_pid_task+0x20/0x1f0 [ 1214.053887][T27354] ? __pfx____sys_sendmsg+0x10/0x10 [ 1214.053920][T27354] ? rcu_is_watching+0x15/0xb0 [ 1214.053955][T27354] ? __fget_files+0x2a/0x420 [ 1214.053977][T27354] ? __fget_files+0x3a2/0x420 [ 1214.054004][T27354] __x64_sys_sendmsg+0x1b1/0x290 [ 1214.054033][T27354] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1214.054070][T27354] ? rcu_is_watching+0x15/0xb0 [ 1214.054092][T27354] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1214.054113][T27354] do_syscall_64+0x174/0x580 [ 1214.054140][T27354] ? trace_irq_disable+0x3b/0x140 [ 1214.054167][T27354] ? clear_bhb_loop+0x40/0x90 [ 1214.054190][T27354] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1214.054209][T27354] RIP: 0033:0x7ffb6a99ce59 [ 1214.054228][T27354] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1214.054245][T27354] RSP: 002b:00007ffb6b8b8028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1214.054274][T27354] RAX: ffffffffffffffda RBX: 00007ffb6ac15fa0 RCX: 00007ffb6a99ce59 [ 1214.054289][T27354] RDX: 0000000000000010 RSI: 0000200000000980 RDI: 0000000000000003 [ 1214.054302][T27354] RBP: 00007ffb6b8b8090 R08: 0000000000000000 R09: 0000000000000000 [ 1214.054315][T27354] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1214.054328][T27354] R13: 00007ffb6ac16038 R14: 00007ffb6ac15fa0 R15: 00007fff2b0626b8 [ 1214.054353][T27354] [ 1214.060601][T27356] tipc: Enabling of bearer rejected, already enabled [ 1214.372993][ T6939] bond5: (slave bridge4): failed to get link speed/duplex [ 1214.442523][T27356] tipc: Resetting bearer [ 1214.509496][ T6241] bond5: (slave bridge4): failed to get link speed/duplex [ 1214.665952][ T35] dummy0: left allmulticast mode [ 1214.679254][ T35] dvmrp0: left allmulticast mode [ 1214.765864][T27366] netlink: 192 bytes leftover after parsing attributes in process `syz.1.15092'. [ 1214.831920][ T35] bond4 (unregistering): (slave vti0): Releasing backup interface [ 1214.843523][ T35] vti0 (unregistering): left promiscuous mode [ 1214.876612][ T35] bond6 (unregistering): (slave geneve6): Releasing active interface [ 1214.904117][ T35] bond1 (unregistering): (slave geneve2): Releasing active interface [ 1214.951898][T27376] nbd: must specify a size in bytes for the device [ 1214.960445][ T35] bond2 (unregistering): (slave bridge2): Releasing backup interface [ 1214.982387][ T35] bond0 (unregistering): (slave bridge6): Releasing backup interface [ 1214.992632][ T35] bridge6 (unregistering): left promiscuous mode [ 1215.018120][ T35] bond7 (unregistering): (slave .`): Releasing backup interface [ 1215.028984][ T35] .` (unregistering): Released all slaves [ 1215.039973][ T35] bond1 (unregistering): Released all slaves [ 1215.068896][ T35] bond2 (unregistering): (slave veth5): Releasing backup interface [ 1215.077750][ T35] bond2 (unregistering): Released all slaves [ 1215.094073][ T35] bond3 (unregistering): Released all slaves [ 1215.110449][ T35] bond4 (unregistering): Released all slaves [ 1215.123007][ T35] team0: Port device bond5 removed [ 1215.130112][ T35] bond5 (unregistering): Released all slaves [ 1215.144756][ T35] bond6 (unregistering): Released all slaves [ 1215.163723][ T35] bond7 (unregistering): Released all slaves [ 1215.181701][ T35] bond0 (unregistering): Released all slaves [ 1215.199284][ T35] bond8 (unregistering): Released all slaves [ 1215.250851][T27374] bridge0: entered allmulticast mode [ 1215.337119][ T35] tipc: Disabling bearer [ 1215.350759][ T35] tipc: Left network mode [ 1215.366050][T27371] lo speed is unknown, defaulting to 1000 [ 1215.505188][T27385] netlink: 84 bytes leftover after parsing attributes in process `syz.3.15096'. [ 1215.517387][T27385] netlink: 84 bytes leftover after parsing attributes in process `syz.3.15096'. [ 1215.607278][T27378] lo speed is unknown, defaulting to 1000 [ 1215.661883][ T35] batman_adv: batadv0: Removing interface: macvtap0 [ 1215.892275][T27371] lo speed is unknown, defaulting to 1000 [ 1216.162607][T27378] lo speed is unknown, defaulting to 1000 [ 1217.386923][ T35] hsr_slave_0: left promiscuous mode [ 1217.448927][ T35] hsr_slave_1: left promiscuous mode [ 1217.802952][ T6939] smc: removing ib device syz0 [ 1217.833528][T27421] netlink: 24 bytes leftover after parsing attributes in process `syz.3.15105'. [ 1218.147441][T27429] x_tables: duplicate underflow at hook 2 [ 1218.157578][ T6939] smbdirect: ib_dev[syz0] removed [ 1218.234088][T27439] netlink: 28 bytes leftover after parsing attributes in process `syz.0.15113'. [ 1218.250737][T27439] netlink: 32 bytes leftover after parsing attributes in process `syz.0.15113'. [ 1218.260959][T27439] netlink: 28 bytes leftover after parsing attributes in process `syz.0.15113'. [ 1218.273637][T27439] netlink: 32 bytes leftover after parsing attributes in process `syz.0.15113'. [ 1218.308738][ T6241] net_ratelimit: 11 callbacks suppressed [ 1218.308756][ T6241] bond5: (slave bridge4): failed to get link speed/duplex [ 1218.344495][T27445] xt_hashlimit: size too large, truncated to 1048576 [ 1218.455165][T27450] netlink: 4 bytes leftover after parsing attributes in process `syz.3.15116'. [ 1218.481609][T27450] xt_TCPMSS: Only works on TCP SYN packets [ 1218.493943][ T12] bond5: (slave bridge4): failed to get link speed/duplex [ 1218.620544][ T12] bond5: (slave bridge4): failed to get link speed/duplex [ 1218.761098][ T12] bond5: (slave bridge4): failed to get link speed/duplex [ 1218.878782][ T13] bond5: (slave bridge4): failed to get link speed/duplex [ 1218.981111][T27453] bridge_slave_1: left allmulticast mode [ 1219.004077][T27453] bridge_slave_1: left promiscuous mode [ 1219.019482][T27453] bridge0: port 2(bridge_slave_1) entered disabled state [ 1219.110973][T27453] bridge_slave_0: left allmulticast mode [ 1219.116751][T27453] bridge_slave_0: left promiscuous mode [ 1219.125832][T27453] bridge0: port 1(bridge_slave_0) entered disabled state [ 1219.357363][ T12] bond5: (slave bridge4): failed to get link speed/duplex [ 1219.543149][T27490] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1219.552774][T27490] 8021q: adding VLAN 0 to HW filter on device team0 [ 1219.572313][T27490] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1219.667080][T27490] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1219.681753][T27490] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1219.701323][T27490] hsr0: A HSR master's MTU cannot be greater than the smallest MTU of its slaves minus the HSR Tag length (6 octets). [ 1219.716825][ T6224] bridge0: port 1(bridge_slave_0) entered blocking state [ 1219.723974][ T6224] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1219.738750][ T6224] bridge0: port 2(bridge_slave_1) entered blocking state [ 1219.745939][ T6224] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1219.865653][ T6226] bond5: (slave bridge4): failed to get link speed/duplex [ 1220.007138][ T6226] bond5: (slave bridge4): failed to get link speed/duplex [ 1220.129389][ T6241] bond5: (slave bridge4): failed to get link speed/duplex [ 1220.139492][T27496] FAULT_INJECTION: forcing a failure. [ 1220.139492][T27496] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1220.184351][T27496] CPU: 0 UID: 0 PID: 27496 Comm: syz.2.15129 Not tainted syzkaller #0 PREEMPT(full) [ 1220.184380][T27496] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1220.184392][T27496] Call Trace: [ 1220.184401][T27496] [ 1220.184409][T27496] dump_stack_lvl+0xe8/0x150 [ 1220.184437][T27496] should_fail_ex+0x40c/0x560 [ 1220.184462][T27496] _copy_from_user+0x2d/0xb0 [ 1220.184490][T27496] __sys_bpf+0x229/0x950 [ 1220.184519][T27496] ? __pfx___sys_bpf+0x10/0x10 [ 1220.184555][T27496] ? ksys_write+0x242/0x270 [ 1220.184583][T27496] ? __pfx_ksys_write+0x10/0x10 [ 1220.184613][T27496] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1220.184635][T27496] __x64_sys_bpf+0x7c/0x90 [ 1220.184660][T27496] do_syscall_64+0x174/0x580 [ 1220.184686][T27496] ? trace_irq_disable+0x3b/0x140 [ 1220.184713][T27496] ? clear_bhb_loop+0x40/0x90 [ 1220.184736][T27496] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1220.184756][T27496] RIP: 0033:0x7fc61059ce59 [ 1220.184775][T27496] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1220.184793][T27496] RSP: 002b:00007fc60e7f6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1220.184814][T27496] RAX: ffffffffffffffda RBX: 00007fc610815fa0 RCX: 00007fc61059ce59 [ 1220.184830][T27496] RDX: 0000000000000048 RSI: 0000200000000500 RDI: 000000000000000a [ 1220.184843][T27496] RBP: 00007fc60e7f6090 R08: 0000000000000000 R09: 0000000000000000 [ 1220.184857][T27496] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1220.184869][T27496] R13: 00007fc610816038 R14: 00007fc610815fa0 R15: 00007ffd5bcee618 [ 1220.184894][T27496] [ 1220.375391][ T6241] bond5: (slave bridge4): failed to get link speed/duplex [ 1220.661402][ T35] IPVS: stop unused estimator thread 0... [ 1220.772689][T27522] netlink: 72 bytes leftover after parsing attributes in process `syz.1.15138'. [ 1220.782688][T27522] netlink: 12 bytes leftover after parsing attributes in process `syz.1.15138'. [ 1220.801125][T27522] netlink: 4 bytes leftover after parsing attributes in process `syz.1.15138'. [ 1220.810830][T27518] netlink: 8 bytes leftover after parsing attributes in process `syz.0.15137'. [ 1220.983769][T27539] xt_hashlimit: size too large, truncated to 1048576 [ 1220.993258][T27539] xt_hashlimit: invalid interval [ 1221.460692][ T5624] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 1221.469351][ T5624] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 1221.477317][ T5624] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 1221.504720][ T5624] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 1221.516768][ T5624] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 1222.119277][ C0] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 1222.397566][T27604] lo speed is unknown, defaulting to 1000 [ 1222.503960][T27617] netlink: 56 bytes leftover after parsing attributes in process `syz.2.15162'. [ 1222.719184][T27562] lo speed is unknown, defaulting to 1000 [ 1222.725503][T27604] lo speed is unknown, defaulting to 1000 [ 1223.007389][T27639] bond0 (unregistering): Released all slaves [ 1223.028172][T27562] lo speed is unknown, defaulting to 1000 [ 1223.317617][T27649] netlink: 'syz.1.15169': attribute type 21 has an invalid length. [ 1223.359964][ T6224] net_ratelimit: 20 callbacks suppressed [ 1223.359983][ T6224] bond5: (slave bridge4): failed to get link speed/duplex [ 1223.383701][T27649] IPv6: NLM_F_CREATE should be specified when creating new route [ 1223.559516][ T5624] Bluetooth: hci0: command tx timeout [ 1223.673114][T27646] lo speed is unknown, defaulting to 1000 [ 1223.729201][ T35] bond5: (slave bridge4): failed to get link speed/duplex [ 1223.812557][T27662] __nla_validate_parse: 3 callbacks suppressed [ 1223.812576][T27662] netlink: 16170 bytes leftover after parsing attributes in process `syz.3.15173'. [ 1223.962223][T27638] IPVS: set_ctl: invalid protocol: 0 0.0.0.0:0 [ 1223.962965][T27646] lo speed is unknown, defaulting to 1000 [ 1223.979722][T27666] IPVS: set_ctl: invalid protocol: 0 0.0.0.0:0 [ 1223.993085][ T35] bond5: (slave bridge4): failed to get link speed/duplex [ 1224.296162][T27562] bridge0: port 1(bridge_slave_0) entered blocking state [ 1224.308718][T27562] bridge0: port 1(bridge_slave_0) entered disabled state [ 1224.319094][T27562] bridge_slave_0: entered allmulticast mode [ 1224.330933][T27562] bridge_slave_0: entered promiscuous mode [ 1224.339463][T27562] bridge0: port 2(bridge_slave_1) entered blocking state [ 1224.346643][T27562] bridge0: port 2(bridge_slave_1) entered disabled state [ 1224.368164][T27562] bridge_slave_1: entered allmulticast mode [ 1224.375996][T27562] bridge_slave_1: entered promiscuous mode [ 1224.472715][T27562] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1224.501546][T27562] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1224.565008][T27682] syzkaller0: entered promiscuous mode [ 1224.570897][T27682] syzkaller0: entered allmulticast mode [ 1224.582447][T27562] team0: Port device team_slave_0 added [ 1224.592200][T27562] team0: Port device team_slave_1 added [ 1224.721881][T27690] netlink: 56 bytes leftover after parsing attributes in process `syz.2.15176'. [ 1224.746116][T27690] netlink: 56 bytes leftover after parsing attributes in process `syz.2.15176'. [ 1224.756334][T27690] netlink: 'syz.2.15176': attribute type 1 has an invalid length. [ 1224.920274][ T35] wlan1: Trigger new scan to find an IBSS to join [ 1225.294624][T27687] lo speed is unknown, defaulting to 1000 [ 1225.388969][ T6939] bond5: (slave bridge4): failed to get link speed/duplex [ 1225.490316][T27687] lo speed is unknown, defaulting to 1000 [ 1225.508854][ T6224] bond5: (slave bridge4): failed to get link speed/duplex [ 1225.529366][T27562] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1225.536365][T27562] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1225.562268][T27562] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1225.574418][T27562] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1225.581401][T27562] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1225.638144][T27562] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1225.642604][ T5624] Bluetooth: hci0: command tx timeout [ 1225.712042][T27700] netlink: 56 bytes leftover after parsing attributes in process `syz.3.15182'. [ 1225.738629][T27562] hsr_slave_0: entered promiscuous mode [ 1225.745110][T27562] hsr_slave_1: entered promiscuous mode [ 1225.779384][T27562] debugfs: 'hsr0' already exists in 'hsr' [ 1225.785165][T27562] Cannot create hsr debugfs directory [ 1225.844996][ T6939] tipc: Subscription rejected, illegal request [ 1225.863286][T27702] syzkaller0: entered promiscuous mode [ 1225.870370][T27702] syzkaller0: entered allmulticast mode [ 1226.004135][ T6224] bond5: (slave bridge4): failed to get link speed/duplex [ 1226.016741][T27562] netdevsim netdevsim0 eth3 (unregistering): unset [1, 0] type 2 family 0 port 20000 - 0 [ 1226.066361][T27562] netdevsim netdevsim0 eth2 (unregistering): unset [1, 0] type 2 family 0 port 20000 - 0 [ 1226.119470][ T35] bond5: (slave bridge4): failed to get link speed/duplex [ 1226.175513][T27562] netdevsim netdevsim0 eth1 (unregistering): unset [1, 0] type 2 family 0 port 20000 - 0 [ 1226.235726][T27562] netdevsim netdevsim0 eth0 (unregistering): unset [1, 0] type 2 family 0 port 20000 - 0 [ 1226.320510][ T35] bond5: (slave bridge4): failed to get link speed/duplex [ 1226.366519][T27725] netlink: 8 bytes leftover after parsing attributes in process `syz.1.15190'. [ 1226.377686][T27724] netlink: 8 bytes leftover after parsing attributes in process `syz.2.15189'. [ 1226.390381][T27725] netlink: 'syz.1.15190': attribute type 13 has an invalid length. [ 1226.415191][T27725] netlink: 'syz.1.15190': attribute type 17 has an invalid length. [ 1226.446070][T27721] syzkaller0: entered promiscuous mode [ 1226.451599][T27721] syzkaller0: entered allmulticast mode [ 1226.458650][T27726] netlink: 8 bytes leftover after parsing attributes in process `syz.2.15189'. [ 1226.467530][T27724] netlink: 20 bytes leftover after parsing attributes in process `syz.2.15189'. [ 1226.529855][T27725] A link change request failed with some changes committed already. Interface vxlan0 may have been left with an inconsistent configuration, please check. [ 1226.559685][ T35] bond5: (slave bridge4): failed to get link speed/duplex [ 1226.775049][T27562] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 1226.799420][T27562] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1226.809936][T27562] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 1226.830381][T27562] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1226.844927][T27562] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 1226.860485][T27562] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1226.874438][T27562] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 1226.893269][T27562] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1227.264411][T27754] macvtap0: entered allmulticast mode [ 1227.275518][T27754] dummy0: entered allmulticast mode [ 1227.284426][T27754] dummy0: entered promiscuous mode [ 1227.294100][T27754] dummy0: left allmulticast mode [ 1227.312486][T16915] dummy0: left promiscuous mode [ 1227.376424][T27562] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1227.387449][T27772] x_tables: duplicate underflow at hook 1 [ 1227.406683][T27562] 8021q: adding VLAN 0 to HW filter on device team0 [ 1227.431462][ T35] bridge0: port 1(bridge_slave_0) entered blocking state [ 1227.438612][ T35] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1227.447608][ T35] bridge0: port 2(bridge_slave_1) entered blocking state [ 1227.454743][ T35] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1227.481815][T27771] syzkaller0: entered promiscuous mode [ 1227.488150][T27771] syzkaller0: entered allmulticast mode [ 1227.517210][T27562] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 1227.533876][T27562] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 1227.719321][ T5624] Bluetooth: hci0: command tx timeout [ 1227.927043][T27778] lo speed is unknown, defaulting to 1000 [ 1227.940201][T27787] syzkaller0: entered promiscuous mode [ 1227.962460][T27787] syzkaller0: entered allmulticast mode [ 1227.993535][T27787] tipc: Started in network mode [ 1228.005932][T27787] tipc: Node identity ae0897e3c896, cluster identity 4711 [ 1228.022196][T27787] tipc: Enabled bearer , priority 0 [ 1228.053824][T27786] tipc: Resetting bearer [ 1228.067158][T27786] tipc: Disabling bearer [ 1228.115055][T27778] lo speed is unknown, defaulting to 1000 [ 1228.264198][T27798] syzkaller1: entered promiscuous mode [ 1228.292072][T27798] syzkaller1: entered allmulticast mode [ 1228.460708][ T35] net_ratelimit: 8 callbacks suppressed [ 1228.460743][ T35] bond5: (slave bridge4): failed to get link speed/duplex [ 1228.549106][T27815] tunl0: entered promiscuous mode [ 1228.658465][ T13] bond5: (slave bridge4): failed to get link speed/duplex [ 1228.838677][ T6241] wlan1: Trigger new scan to find an IBSS to join [ 1228.881169][T27562] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1228.905526][T27826] tipc: Enabled bearer , priority 0 [ 1228.946973][T27830] syzkaller0: entered promiscuous mode [ 1228.965927][T27830] syzkaller0: entered allmulticast mode [ 1228.999484][ T6241] bond5: (slave bridge4): failed to get link speed/duplex [ 1229.030955][T27826] tipc: Resetting bearer [ 1229.037059][T27837] netlink: 104 bytes leftover after parsing attributes in process `syz.4.15222'. [ 1229.095386][T27824] tipc: Resetting bearer [ 1229.128926][T27824] tipc: Disabling bearer [ 1229.184802][T27844] netlink: 'syz.2.15224': attribute type 21 has an invalid length. [ 1229.193345][T27845] netlink: 'syz.2.15224': attribute type 21 has an invalid length. [ 1229.289520][T27562] veth0_vlan: entered promiscuous mode [ 1229.302339][T27562] veth1_vlan: entered promiscuous mode [ 1229.315965][T27849] syzkaller1: entered promiscuous mode [ 1229.321705][T27849] syzkaller1: entered allmulticast mode [ 1229.363340][T27562] veth0_macvtap: entered promiscuous mode [ 1229.374128][T27562] veth1_macvtap: entered promiscuous mode [ 1229.390519][T27562] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1229.410482][T27562] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1229.422997][ T6228] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1229.431918][ T6228] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1229.440819][ T6228] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1229.452475][ T6228] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1229.470271][ T6228] bond5: (slave bridge4): failed to get link speed/duplex [ 1229.534553][ T6941] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1229.542513][ T6941] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1229.624452][ T6241] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1229.632323][ T6241] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1229.659704][T27864] lo speed is unknown, defaulting to 1000 [ 1229.692903][T27866] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1229.702168][ T6941] bond5: (slave bridge4): failed to get link speed/duplex [ 1229.774780][T27864] lo speed is unknown, defaulting to 1000 [ 1229.798859][ T5624] Bluetooth: hci0: command tx timeout [ 1229.819196][ T6224] bond5: (slave bridge4): failed to get link speed/duplex [ 1229.940091][ T6941] bond5: (slave bridge4): failed to get link speed/duplex [ 1230.024251][T27873] netlink: 4 bytes leftover after parsing attributes in process `syz.1.15229'. [ 1230.036596][T27880] syz_tun: entered allmulticast mode [ 1230.104909][ T5356] IPVS: starting estimator thread 0... [ 1230.130750][ T6228] bond5: (slave bridge4): failed to get link speed/duplex [ 1230.198856][T27883] IPVS: using max 38 ests per chain, 91200 per kthread [ 1230.259394][ T6941] bond5: (slave bridge4): failed to get link speed/duplex [ 1230.398429][ T6224] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1231.330406][T14709] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 1231.339704][T14709] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 1231.346966][T14709] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 1231.365356][T14709] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 1231.373749][T14709] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 1231.486022][T27940] syzkaller1: entered promiscuous mode [ 1231.500859][T27940] syzkaller1: entered allmulticast mode [ 1231.669962][T27961] netlink: 'syz.2.15254': attribute type 1 has an invalid length. [ 1231.848137][T27961] 8021q: adding VLAN 0 to HW filter on device bond2 [ 1231.896179][T27961] netlink: 44 bytes leftover after parsing attributes in process `syz.2.15254'. [ 1231.913332][T27961] 8021q: adding VLAN 0 to HW filter on device batadv1 [ 1231.921900][T27961] bond2: (slave batadv1): making interface the new active one [ 1231.930100][T27961] bond2: (slave batadv1): Enslaving as an active interface with an up link [ 1232.006977][T27966] vlan2: entered promiscuous mode [ 1232.021137][T27966] bond2: entered promiscuous mode [ 1232.026220][T27966] batadv1: entered promiscuous mode [ 1232.043398][T27966] vlan2: entered allmulticast mode [ 1232.051106][T27966] bond2: entered allmulticast mode [ 1232.056250][T27966] batadv1: entered allmulticast mode [ 1232.206930][T16515] syz_tun (unregistering): left allmulticast mode [ 1232.305250][T27974] lo speed is unknown, defaulting to 1000 [ 1232.582853][ T6940] netdevsim netdevsim1 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1232.610833][ T6940] netdevsim netdevsim1 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1232.652957][ T6940] netdevsim netdevsim1 eth3 (unregistering): unset [1, 1] type 2 family 0 port 20004 - 0 [ 1232.687720][ T6939] tipc: Subscription rejected, illegal request [ 1232.827192][T27936] lo speed is unknown, defaulting to 1000 [ 1232.836733][T27974] lo speed is unknown, defaulting to 1000 [ 1233.125082][ T6940] netdevsim netdevsim1 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1233.156186][ T6940] netdevsim netdevsim1 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1233.210388][ T6940] netdevsim netdevsim1 eth2 (unregistering): unset [1, 1] type 2 family 0 port 20004 - 0 [ 1233.243364][T28013] netlink: 'syz.4.15263': attribute type 1 has an invalid length. [ 1233.251954][T28013] netlink: 244 bytes leftover after parsing attributes in process `syz.4.15263'. [ 1233.289433][T27936] lo speed is unknown, defaulting to 1000 [ 1233.305845][T28018] netlink: 60 bytes leftover after parsing attributes in process `syz.3.15264'. [ 1233.329036][T28013] syzkaller1: entered promiscuous mode [ 1233.334540][T28013] syzkaller1: entered allmulticast mode [ 1233.399181][T14709] Bluetooth: hci1: command tx timeout [ 1233.456059][ T6940] netdevsim netdevsim1 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1233.466121][ T6940] netdevsim netdevsim1 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1233.475895][ T6940] netdevsim netdevsim1 eth1 (unregistering): unset [1, 1] type 2 family 0 port 20004 - 0 [ 1233.525658][ T6224] net_ratelimit: 17 callbacks suppressed [ 1233.534424][ T6224] bond5: (slave bridge4): failed to get link speed/duplex [ 1233.643203][ C1] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 1233.748749][ T6241] bond5: (slave bridge4): failed to get link speed/duplex [ 1233.825774][ T6940] netdevsim netdevsim1 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1233.874876][ T6940] netdevsim netdevsim1 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1233.934724][ T6940] netdevsim netdevsim1 eth0 (unregistering): unset [1, 1] type 2 family 0 port 20004 - 0 [ 1234.190725][ T6939] bond5: (slave bridge4): failed to get link speed/duplex [ 1234.371186][T27936] bridge0: port 1(bridge_slave_0) entered blocking state [ 1234.391167][T27936] bridge0: port 1(bridge_slave_0) entered disabled state [ 1234.413339][T27936] bridge_slave_0: entered allmulticast mode [ 1234.435924][T27936] bridge_slave_0: entered promiscuous mode [ 1234.486157][T27936] bridge0: port 2(bridge_slave_1) entered blocking state [ 1234.509435][T27936] bridge0: port 2(bridge_slave_1) entered disabled state [ 1234.535364][T27936] bridge_slave_1: entered allmulticast mode [ 1234.556358][T27936] bridge_slave_1: entered promiscuous mode [ 1234.617889][T27936] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1234.638999][ T6228] bond5: (slave bridge4): failed to get link speed/duplex [ 1234.660857][T27936] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1234.687919][ T6940] dvmrp0: left allmulticast mode [ 1235.087776][ T6940] bond5 (unregistering): (slave ip6gretap1): Releasing active interface [ 1235.375980][ T6940] batman_adv: batadv0: Removing interface: gretap2 [ 1235.478541][T14709] Bluetooth: hci1: command tx timeout [ 1235.547408][ T6940] team0: Port device bridge0 removed [ 1235.616239][ T6940] bond13 (unregistering): (slave bridge7): Releasing backup interface [ 1235.626075][ T6940] bridge7 (unregistering): left promiscuous mode [ 1235.648007][ T6940] bond0 (unregistering): Released all slaves [ 1235.660493][ T6940] bond1 (unregistering): Released all slaves [ 1235.673789][ T6940] bond2 (unregistering): Released all slaves [ 1235.690141][ T6940] bond3 (unregistering): Released all slaves [ 1235.704858][ T6940] bond4 (unregistering): Released all slaves [ 1235.718049][ T6940] bond5 (unregistering): Released all slaves [ 1235.736407][ T6940] bond6 (unregistering): Released all slaves [ 1235.754927][ T6940] bond7 (unregistering): Released all slaves [ 1235.771021][ T6940] bond9 (unregistering): Released all slaves [ 1235.786707][ T6940] bond8 (unregistering): Released all slaves [ 1235.808383][ T6940] bond10 (unregistering): (slave bond11): Releasing backup interface [ 1235.817495][ T6940] bond10 (unregistering): Released all slaves [ 1235.832628][ T6940] bond11 (unregistering): Released all slaves [ 1235.852938][ T6940] bond12 (unregistering): Released all slaves [ 1235.866129][ T6940] bond13 (unregistering): Released all slaves [ 1235.902328][T28066] netlink: 8 bytes leftover after parsing attributes in process `syz.3.15274'. [ 1235.915621][T27936] team0: Port device team_slave_0 added [ 1235.935319][T27936] team0: Port device team_slave_1 added [ 1236.041705][T27936] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1236.054140][T28077] ip6t_REJECT: ECHOREPLY is not supported [ 1236.073382][T27936] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1236.137453][T27936] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1236.174728][ T6940] hmac(sha224: left promiscuous mode [ 1236.188538][T27936] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1236.197501][T27936] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1236.223650][T27936] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1236.239795][T28082] netlink: 8 bytes leftover after parsing attributes in process `syz.4.15278'. [ 1236.253079][T28086] netlink: 'syz.3.15279': attribute type 2 has an invalid length. [ 1236.288320][ T6224] bond5: (slave bridge4): failed to get link speed/duplex [ 1236.419493][T27936] hsr_slave_0: entered promiscuous mode [ 1236.426004][T27936] hsr_slave_1: entered promiscuous mode [ 1236.432220][T27936] debugfs: 'hsr0' already exists in 'hsr' [ 1236.437974][T27936] Cannot create hsr debugfs directory [ 1236.466599][ T6940] tipc: Disabling bearer [ 1236.502004][ T6940] tipc: Left network mode [ 1236.532455][T28093] hsr0: A HSR master's MTU cannot be greater than the smallest MTU of its slaves minus the HSR Tag length (6 octets). [ 1236.598817][ T6241] bond5: (slave bridge4): failed to get link speed/duplex [ 1236.617335][T28108] netlink: 16 bytes leftover after parsing attributes in process `syz.3.15287'. [ 1236.939334][T27848] bond5: (slave bridge4): failed to get link speed/duplex [ 1236.973439][T28125] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1237.385835][T28137] tipc: Resetting bearer [ 1237.393658][T28137] mac80211_hwsim hwsim165 syzkaller0: left promiscuous mode [ 1237.401283][T28137] mac80211_hwsim hwsim165 syzkaller0: left allmulticast mode [ 1237.410174][T28137] ip6gre2: left promiscuous mode [ 1237.415152][T28137] ip6gre2: left allmulticast mode [ 1237.424054][ T5284] 8021q: adding VLAN 0 to HW filter on device eth1 [ 1237.463823][T28144] syzkaller1: entered promiscuous mode [ 1237.471259][T28144] syzkaller1: entered allmulticast mode [ 1237.558472][T14709] Bluetooth: hci1: command tx timeout [ 1237.740149][T28166] netlink: 56 bytes leftover after parsing attributes in process `syz.2.15297'. [ 1237.850706][T28179] netlink: 'syz.4.15302': attribute type 1 has an invalid length. [ 1237.864087][T28174] lo speed is unknown, defaulting to 1000 [ 1237.881224][T28180] netlink: 'syz.2.15301': attribute type 266 has an invalid length. [ 1237.890719][T28179] netlink: 2088 bytes leftover after parsing attributes in process `syz.4.15302'. [ 1237.909299][T28180] netlink: 144 bytes leftover after parsing attributes in process `syz.2.15301'. [ 1237.983046][ T6224] bond5: (slave bridge4): failed to get link speed/duplex [ 1238.180932][T27848] bond5: (slave bridge4): failed to get link speed/duplex [ 1238.194400][T28174] lo speed is unknown, defaulting to 1000 [ 1238.495406][T28200] netlink: 192 bytes leftover after parsing attributes in process `syz.2.15306'. [ 1238.506333][T28200] netlink: 8 bytes leftover after parsing attributes in process `syz.2.15306'. [ 1238.558898][T27848] net_ratelimit: 1 callbacks suppressed [ 1238.558916][T27848] bond5: (slave bridge4): failed to get link speed/duplex [ 1238.593167][T28197] tipc: Enabled bearer , priority 10 [ 1238.672621][T28202] lo speed is unknown, defaulting to 1000 [ 1238.706779][ T6940] hsr_slave_0: left promiscuous mode [ 1238.740971][ T6940] hsr_slave_1: left promiscuous mode [ 1238.802732][ T6940] veth1_vlan: left promiscuous mode [ 1238.818365][ T6940] veth0_vlan: left promiscuous mode [ 1238.977203][ T6940] team0 (unregistering): Port device batadv1 removed [ 1239.224757][T28214] syzkaller1: entered promiscuous mode [ 1239.239230][T28202] lo speed is unknown, defaulting to 1000 [ 1239.247122][T28214] syzkaller1: entered allmulticast mode [ 1239.329114][T27936] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 1239.338771][T27936] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1239.347133][T27936] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 1239.394269][T27936] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1239.402094][T27936] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 1239.416666][T27936] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1239.424474][T27936] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 1239.440668][T27936] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1239.633658][T27936] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1239.645105][T14709] Bluetooth: hci1: command tx timeout [ 1239.676988][T27936] 8021q: adding VLAN 0 to HW filter on device team0 [ 1239.689574][ T6224] bridge0: port 1(bridge_slave_0) entered blocking state [ 1239.696721][ T6224] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1239.720995][ T6224] bridge0: port 2(bridge_slave_1) entered blocking state [ 1239.728134][ T6224] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1239.758865][T27936] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 1239.771719][T27936] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 1239.793240][ T6941] bond5: (slave bridge4): failed to get link speed/duplex [ 1239.984488][ T6941] bond5: (slave bridge4): failed to get link speed/duplex [ 1240.103119][T28254] syz_tun: entered allmulticast mode [ 1240.149934][ T9460] IPVS: starting estimator thread 0... [ 1240.171316][T28259] netlink: 'syz.2.15313': attribute type 3 has an invalid length. [ 1240.200992][ T6224] bond5: (slave bridge4): failed to get link speed/duplex [ 1240.348946][T27848] bond5: (slave bridge4): failed to get link speed/duplex [ 1240.367264][T28270] netlink: 8 bytes leftover after parsing attributes in process `syz.3.15314'. [ 1240.377380][T28258] IPVS: using max 41 ests per chain, 98400 per kthread [ 1240.479292][ T6224] bond5: (slave bridge4): failed to get link speed/duplex [ 1240.599595][ T6228] bond5: (slave bridge4): failed to get link speed/duplex [ 1240.740129][T27848] bond5: (slave bridge4): failed to get link speed/duplex [ 1240.878422][ T6224] bond5: (slave bridge4): failed to get link speed/duplex [ 1240.998735][ T6228] bond5: (slave bridge4): failed to get link speed/duplex [ 1241.015324][T28292] netlink: 'syz.2.15317': attribute type 1 has an invalid length. [ 1241.044296][T27936] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1241.236917][ T6940] IPVS: stop unused estimator thread 0... [ 1241.267324][T27936] veth0_vlan: entered promiscuous mode [ 1241.320880][T27936] veth1_vlan: entered promiscuous mode [ 1241.443908][T27936] veth0_macvtap: entered promiscuous mode [ 1241.506549][T27936] veth1_macvtap: entered promiscuous mode [ 1241.604455][T27936] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1241.673128][T27936] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1241.727564][ T6241] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1241.853371][ T6241] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1241.879412][ T6241] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1241.916177][ T6241] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1242.337363][ T6241] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1242.370914][T28343] netlink: 24 bytes leftover after parsing attributes in process `syz.2.15328'. [ 1242.392923][ T6241] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1242.620064][ T35] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1242.646276][ T35] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1242.730938][T28363] Cannot find del_set index 4 as target [ 1242.987874][T28383] netlink: 12 bytes leftover after parsing attributes in process `syz.1.15338'. [ 1243.147584][ T5624] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 1243.156370][ T5624] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 1243.164516][ T5624] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 1243.174992][ T5624] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 1243.184030][ T5624] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 1243.544044][T28414] geneve0: entered promiscuous mode [ 1243.576654][T28414] geneve0: left promiscuous mode [ 1243.664268][ T6941] net_ratelimit: 15 callbacks suppressed [ 1243.664290][ T6941] bond5: (slave bridge4): failed to get link speed/duplex [ 1243.801580][ T6940] bond5: (slave bridge4): failed to get link speed/duplex [ 1243.841513][T28429] tunl0: left promiscuous mode [ 1243.896817][T28434] netlink: 24 bytes leftover after parsing attributes in process `syz.3.15352'. [ 1243.936782][T28429] bridge0: port 2(bridge_slave_1) entered disabled state [ 1243.944920][T28429] bridge0: port 1(bridge_slave_0) entered disabled state [ 1243.960735][T28437] netlink: 56 bytes leftover after parsing attributes in process `syz.3.15352'. [ 1244.054714][T28429] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1244.067058][T28429] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1244.098018][T28429] bond1: left promiscuous mode [ 1244.104590][T28429] bond1: left allmulticast mode [ 1244.112517][T28429] ipvlan2: left promiscuous mode [ 1244.134652][T28429] vlan2: left promiscuous mode [ 1244.139678][T28429] bond2: left promiscuous mode [ 1244.144587][T28429] batadv1: left promiscuous mode [ 1244.150970][T28429] vlan2: left allmulticast mode [ 1244.155934][T28429] bond2: left allmulticast mode [ 1244.162006][T28429] batadv1: left allmulticast mode [ 1244.318837][T28435] bridge0: port 2(bridge_slave_1) entered disabled state [ 1244.326387][T28435] bridge0: port 1(bridge_slave_0) entered disabled state [ 1244.598617][T28453] netlink: 8 bytes leftover after parsing attributes in process `syz.0.15355'. [ 1244.622158][T28435] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1244.667331][T28435] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1244.959199][ T6939] netdevsim netdevsim1 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1244.980796][ T6939] netdevsim netdevsim1 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1245.010258][ T6939] netdevsim netdevsim1 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1245.040047][ T6939] netdevsim netdevsim1 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1245.084188][T28392] lo speed is unknown, defaulting to 1000 [ 1245.096540][T28463] netlink: 'syz.1.15357': attribute type 62 has an invalid length. [ 1245.107358][ T35] bond5: (slave bridge4): failed to get link speed/duplex [ 1245.239613][ T5624] Bluetooth: hci2: command tx timeout [ 1245.245332][ T6228] bond5: (slave bridge4): failed to get link speed/duplex [ 1245.279920][T28469] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1245.331433][T28392] lo speed is unknown, defaulting to 1000 [ 1245.368365][ T6939] bond5: (slave bridge4): failed to get link speed/duplex [ 1245.494664][T28477] netlink: 'syz.0.15361': attribute type 3 has an invalid length. [ 1245.672124][T28488] FAULT_INJECTION: forcing a failure. [ 1245.672124][T28488] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1245.688936][T28488] CPU: 0 UID: 0 PID: 28488 Comm: syz.2.15364 Not tainted syzkaller #0 PREEMPT(full) [ 1245.688969][T28488] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1245.688982][T28488] Call Trace: [ 1245.688990][T28488] [ 1245.688998][T28488] dump_stack_lvl+0xe8/0x150 [ 1245.689027][T28488] should_fail_ex+0x40c/0x560 [ 1245.689052][T28488] _copy_from_iter+0x1d3/0x1660 [ 1245.689080][T28488] ? rcu_is_watching+0x15/0xb0 [ 1245.689104][T28488] ? __pfx__copy_from_iter+0x10/0x10 [ 1245.689127][T28488] ? kmem_cache_alloc_node_noprof+0x3ca/0x680 [ 1245.689159][T28488] ? netlink_sendmsg+0x650/0xb40 [ 1245.689190][T28488] ? skb_put+0x112/0x210 [ 1245.689219][T28488] netlink_sendmsg+0x6c0/0xb40 [ 1245.689255][T28488] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1245.689288][T28488] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1245.689309][T28488] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1245.689335][T28488] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1245.689366][T28488] ____sys_sendmsg+0x9b9/0xa20 [ 1245.689402][T28488] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1245.689434][T28488] ? lock_release+0x4b/0x3c0 [ 1245.689465][T28488] ? import_iovec+0x73/0xa0 [ 1245.689493][T28488] ___sys_sendmsg+0x2a5/0x360 [ 1245.689523][T28488] ? rcu_is_watching+0x15/0xb0 [ 1245.689543][T28488] ? get_pid_task+0x20/0x1f0 [ 1245.689564][T28488] ? __pfx____sys_sendmsg+0x10/0x10 [ 1245.689598][T28488] ? rcu_is_watching+0x15/0xb0 [ 1245.689635][T28488] ? __fget_files+0x2a/0x420 [ 1245.689658][T28488] ? __fget_files+0x3a2/0x420 [ 1245.689687][T28488] __x64_sys_sendmsg+0x1b1/0x290 [ 1245.689718][T28488] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1245.689765][T28488] ? rcu_is_watching+0x15/0xb0 [ 1245.689787][T28488] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1245.689809][T28488] do_syscall_64+0x174/0x580 [ 1245.689837][T28488] ? trace_irq_disable+0x3b/0x140 [ 1245.689866][T28488] ? clear_bhb_loop+0x40/0x90 [ 1245.689890][T28488] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1245.689911][T28488] RIP: 0033:0x7fc61059ce59 [ 1245.689930][T28488] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1245.689948][T28488] RSP: 002b:00007fc60e7d5028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1245.689971][T28488] RAX: ffffffffffffffda RBX: 00007fc610816090 RCX: 00007fc61059ce59 [ 1245.689987][T28488] RDX: 000000000001c090 RSI: 00002000000001c0 RDI: 0000000000000005 [ 1245.690001][T28488] RBP: 00007fc60e7d5090 R08: 0000000000000000 R09: 0000000000000000 [ 1245.690014][T28488] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1245.690026][T28488] R13: 00007fc610816128 R14: 00007fc610816090 R15: 00007ffd5bcee618 [ 1245.690051][T28488] [ 1246.001596][T28491] netlink: 4 bytes leftover after parsing attributes in process `syz.2.15365'. [ 1246.246314][T28392] bridge0: port 1(bridge_slave_0) entered blocking state [ 1246.253530][T28392] bridge0: port 1(bridge_slave_0) entered disabled state [ 1246.260739][T28392] bridge_slave_0: entered allmulticast mode [ 1246.267697][T28392] bridge_slave_0: entered promiscuous mode [ 1246.284173][T28392] bridge0: port 2(bridge_slave_1) entered blocking state [ 1246.291370][T28392] bridge0: port 2(bridge_slave_1) entered disabled state [ 1246.298680][T28392] bridge_slave_1: entered allmulticast mode [ 1246.305809][T28392] bridge_slave_1: entered promiscuous mode [ 1246.331223][T28392] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1246.353243][T28392] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1246.388389][T28392] team0: Port device team_slave_0 added [ 1246.398858][T28392] team0: Port device team_slave_1 added [ 1246.430294][T28392] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1246.437539][T28392] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1246.463582][T28392] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1246.475589][T28392] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1246.482556][T28392] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1246.563322][T28392] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1246.654715][T28392] hsr_slave_0: entered promiscuous mode [ 1246.661400][T28392] hsr_slave_1: entered promiscuous mode [ 1246.688696][T28392] debugfs: 'hsr0' already exists in 'hsr' [ 1246.694648][T28392] Cannot create hsr debugfs directory [ 1246.950409][ T6941] bond5: (slave bridge4): failed to get link speed/duplex [ 1247.157849][ T6939] bond5: (slave bridge4): failed to get link speed/duplex [ 1247.268485][ T6939] bond5: (slave bridge4): failed to get link speed/duplex [ 1247.318306][ T5624] Bluetooth: hci2: command tx timeout [ 1247.337116][T28542] netlink: 'syz.3.15376': attribute type 3 has an invalid length. [ 1247.408332][ T35] bond5: (slave bridge4): failed to get link speed/duplex [ 1247.454564][T28548] netlink: 64 bytes leftover after parsing attributes in process `syz.1.15378'. [ 1247.759677][T28566] netlink: 'syz.3.15385': attribute type 32 has an invalid length. [ 1248.357079][T28392] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 1248.373685][T28392] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1248.383853][T28392] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 1248.394870][T28392] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1248.402660][T28392] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 1248.411822][T28392] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1248.419843][T28392] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 1248.429849][T28392] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1248.505604][T28392] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1248.522770][T28392] 8021q: adding VLAN 0 to HW filter on device team0 [ 1248.534526][ T6939] bridge0: port 1(bridge_slave_0) entered blocking state [ 1248.541724][ T6939] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1248.594639][ T6941] bridge0: port 2(bridge_slave_1) entered blocking state [ 1248.601777][ T6941] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1248.738582][T27848] net_ratelimit: 7 callbacks suppressed [ 1248.738603][T27848] bond5: (slave bridge4): failed to get link speed/duplex [ 1248.858274][ T6228] bond5: (slave bridge4): failed to get link speed/duplex [ 1248.978389][ T6939] bond5: (slave bridge4): failed to get link speed/duplex [ 1249.109635][ T6941] bond5: (slave bridge4): failed to get link speed/duplex [ 1249.119844][T28634] netlink: 'syz.1.15397': attribute type 1 has an invalid length. [ 1249.130603][T28635] netlink: 'syz.1.15397': attribute type 1 has an invalid length. [ 1249.253349][ T6939] bond5: (slave bridge4): failed to get link speed/duplex [ 1249.379278][ T35] bond5: (slave bridge4): failed to get link speed/duplex [ 1249.398589][ T5624] Bluetooth: hci2: command tx timeout [ 1249.462949][T28392] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1249.498810][ T6941] bond5: (slave bridge4): failed to get link speed/duplex [ 1249.564424][T28648] lo speed is unknown, defaulting to 1000 [ 1249.618644][ T6941] bond5: (slave bridge4): failed to get link speed/duplex [ 1249.749414][T27848] bond5: (slave bridge4): failed to get link speed/duplex [ 1249.861515][T28662] netlink: 32 bytes leftover after parsing attributes in process `syz.1.15403'. [ 1249.891373][ T6941] bond5: (slave bridge4): failed to get link speed/duplex [ 1250.273778][T28648] lo speed is unknown, defaulting to 1000 [ 1250.317490][T28392] veth0_vlan: entered promiscuous mode [ 1250.332400][T28669] syzkaller1: entered promiscuous mode [ 1250.341052][T28669] syzkaller1: entered allmulticast mode [ 1250.375361][T28392] veth1_vlan: entered promiscuous mode [ 1250.436826][T28673] netlink: 28 bytes leftover after parsing attributes in process `syz.0.15406'. [ 1250.474134][T28392] veth0_macvtap: entered promiscuous mode [ 1250.485254][T28392] veth1_macvtap: entered promiscuous mode [ 1250.507098][T28392] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1250.536925][T28392] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1250.551948][ T6241] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1250.579611][ T6241] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1250.599914][ T6241] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1250.634835][ T6241] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1250.747476][T27848] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1250.773756][T27848] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1250.845762][ T6939] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1250.865874][ T6939] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1250.992342][T28688] netlink: 132 bytes leftover after parsing attributes in process `syz.0.15413'. [ 1251.030291][T28688] netlink: 'syz.0.15413': attribute type 58 has an invalid length. [ 1251.059050][T28688] netlink: 20 bytes leftover after parsing attributes in process `syz.0.15413'. [ 1251.346005][T28698] syz_tun: entered allmulticast mode [ 1251.379310][T28698] dvmrp8: entered allmulticast mode [ 1251.414993][T28696] syz_tun: left allmulticast mode [ 1251.478494][ T5624] Bluetooth: hci2: command tx timeout [ 1251.527655][T28709] syz_tun: entered allmulticast mode [ 1251.536645][T28708] syz_tun: left allmulticast mode [ 1251.546713][ T5721] IPVS: starting estimator thread 0... [ 1251.689099][T28714] netlink: 'syz.3.15419': attribute type 3 has an invalid length. [ 1251.721836][T28710] IPVS: using max 43 ests per chain, 103200 per kthread [ 1252.116149][T28732] geneve2: entered promiscuous mode [ 1252.152242][ T35] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1252.168666][ T35] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1252.192559][ T35] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1252.224891][ T35] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1252.264313][T28747] netlink: 'syz.1.15432': attribute type 15 has an invalid length. [ 1252.283452][T28745] syz_tun: entered allmulticast mode [ 1252.303924][T16916] IPVS: starting estimator thread 0... [ 1252.428692][T28755] IPVS: using max 40 ests per chain, 96000 per kthread [ 1252.520842][T28764] netlink: 24 bytes leftover after parsing attributes in process `syz.1.15437'. [ 1252.542804][T28763] netlink: 24 bytes leftover after parsing attributes in process `syz.1.15437'. [ 1252.590816][T28767] netlink: 12 bytes leftover after parsing attributes in process `syz.4.15438'. [ 1252.854986][T28785] netlink: 56 bytes leftover after parsing attributes in process `syz.1.15443'. [ 1253.144898][T28796] syz_tun: entered allmulticast mode [ 1253.182581][ T5721] IPVS: starting estimator thread 0... [ 1253.238200][T28805] xt_hashlimit: size too large, truncated to 1048576 [ 1253.258970][T28805] xt_hashlimit: max too large, truncated to 1048576 [ 1253.291817][T28802] IPVS: using max 41 ests per chain, 98400 per kthread [ 1253.496736][T28813] lo speed is unknown, defaulting to 1000 [ 1253.848447][ T6940] net_ratelimit: 26 callbacks suppressed [ 1253.848485][ T6940] bond5: (slave bridge4): failed to get link speed/duplex [ 1253.911406][T28813] lo speed is unknown, defaulting to 1000 [ 1254.018516][ T6940] bond5: (slave bridge4): failed to get link speed/duplex [ 1254.039517][T28820] netlink: 36764 bytes leftover after parsing attributes in process `syz.2.15453'. [ 1254.075557][T28820] netlink: 12 bytes leftover after parsing attributes in process `syz.2.15453'. [ 1254.169969][ T6940] bond5: (slave bridge4): failed to get link speed/duplex [ 1254.299947][T28830] syzkaller1: entered promiscuous mode [ 1254.317226][T28830] syzkaller1: entered allmulticast mode [ 1254.349304][ T6940] bond5: (slave bridge4): failed to get link speed/duplex [ 1254.390835][T28831] sit0: left promiscuous mode [ 1254.533095][T28831] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1254.546272][T28831] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1254.555154][T28842] netlink: 12 bytes leftover after parsing attributes in process `syz.4.15458'. [ 1254.652328][T28831] syzkaller1: left promiscuous mode [ 1254.657616][T28831] syzkaller1: left allmulticast mode [ 1254.666965][T28830] sch_tbf: burst 0 is lower than device ip6gre0 mtu (1280) ! [ 1254.675154][T28834] netlink: 4 bytes leftover after parsing attributes in process `syz.4.15458'. [ 1254.704262][ T35] netdevsim netdevsim3 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1254.713379][ T35] netdevsim netdevsim3 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1254.752368][ T35] netdevsim netdevsim3 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1254.776442][ T35] bond5: (slave bridge4): failed to get link speed/duplex [ 1254.793624][ T6228] netdevsim netdevsim3 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1254.887984][T28850] netlink: 12 bytes leftover after parsing attributes in process `syz.4.15461'. [ 1254.899302][T27848] bond5: (slave bridge4): failed to get link speed/duplex [ 1255.019358][ T35] bond5: (slave bridge4): failed to get link speed/duplex [ 1255.150473][ T6939] bond5: (slave bridge4): failed to get link speed/duplex [ 1255.278354][T27848] bond5: (slave bridge4): failed to get link speed/duplex [ 1255.411383][ T6939] bond5: (slave bridge4): failed to get link speed/duplex [ 1255.556787][T28873] netlink: 14 bytes leftover after parsing attributes in process `syz.4.15469'. [ 1255.587398][T28873] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1255.673283][T28873] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1255.701370][T28873] bond0 (unregistering): Released all slaves [ 1255.935270][T28887] geneve2: left promiscuous mode [ 1255.966894][ T6939] netdevsim netdevsim2 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1255.993829][ T6939] netdevsim netdevsim2 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1256.021840][ T6939] netdevsim netdevsim2 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1256.058494][ T6939] netdevsim netdevsim2 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1256.091684][T28889] syz_tun: entered allmulticast mode [ 1256.175599][T28889] lo speed is unknown, defaulting to 1000 [ 1256.194186][T28900] pimreg: entered allmulticast mode [ 1256.633101][T28889] lo speed is unknown, defaulting to 1000 [ 1256.746390][T28928] netlink: 'syz.2.15485': attribute type 3 has an invalid length. [ 1256.878137][T28912] netlink: 'syz.3.15483': attribute type 1 has an invalid length. [ 1256.983500][T28912] syzkaller1: entered promiscuous mode [ 1257.015106][T28912] syzkaller1: entered allmulticast mode [ 1257.069485][T28888] syz_tun: left allmulticast mode [ 1257.100351][T28940] tc_dump_action: action bad kind [ 1257.304005][T28949] netlink: 'syz.1.15490': attribute type 8 has an invalid length. [ 1257.667086][T28954] bridge0: port 2(bridge_slave_1) entered disabled state [ 1257.675181][T28954] bridge0: port 1(bridge_slave_0) entered disabled state [ 1257.687534][T28960] __nla_validate_parse: 4 callbacks suppressed [ 1257.687564][T28960] netlink: 4 bytes leftover after parsing attributes in process `syz.2.15492'. [ 1257.819391][T28954] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1257.819391][T28963] netlink: 'syz.2.15492': attribute type 1 has an invalid length. [ 1257.834445][T28954] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1257.834877][T28963] netlink: 'syz.2.15492': attribute type 3 has an invalid length. [ 1257.850065][T28963] netlink: 224 bytes leftover after parsing attributes in process `syz.2.15492'. [ 1257.912913][T28960] syz_tun (unregistering): left allmulticast mode [ 1257.946131][T27848] netdevsim netdevsim0 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1257.957769][T27848] netdevsim netdevsim0 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1257.982351][T27848] netdevsim netdevsim0 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1258.014928][T27848] netdevsim netdevsim0 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1258.054776][T28972] netlink: 64 bytes leftover after parsing attributes in process `syz.0.15496'. [ 1258.121326][T28974] netlink: 'syz.2.15499': attribute type 1 has an invalid length. [ 1258.145359][T28972] netlink: 'syz.0.15496': attribute type 1 has an invalid length. [ 1258.193727][T28974] 8021q: adding VLAN 0 to HW filter on device bond3 [ 1258.321417][T28987] netlink: 'syz.3.15502': attribute type 3 has an invalid length. [ 1258.494272][T28976] 8021q: adding VLAN 0 to HW filter on device bond2 [ 1258.504782][T28976] bond1: (slave bond2): making interface the new active one [ 1258.513575][T28976] bond1: (slave bond2): Enslaving as an active interface with an up link [ 1258.543062][T29001] netlink: 40 bytes leftover after parsing attributes in process `syz.2.15505'. [ 1258.557952][T29001] netlink: 40 bytes leftover after parsing attributes in process `syz.2.15505'. [ 1258.582226][T29006] netlink: 4 bytes leftover after parsing attributes in process `syz.1.15506'. [ 1258.664747][T29008] syzkaller1: entered promiscuous mode [ 1258.685086][T29008] syzkaller1: entered allmulticast mode [ 1258.880067][T27848] net_ratelimit: 21 callbacks suppressed [ 1258.880097][T27848] bond5: (slave bridge4): failed to get link speed/duplex [ 1258.947926][T29027] hsr0: entered promiscuous mode [ 1259.021639][ T6241] bond5: (slave bridge4): failed to get link speed/duplex [ 1259.211875][T29050] netlink: 12 bytes leftover after parsing attributes in process `syz.1.15519'. [ 1259.237289][T29045] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1259.266746][T29045] 8021q: adding VLAN 0 to HW filter on device team0 [ 1259.278813][T29045] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1259.325080][T29045] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1259.335626][T29045] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1259.350720][T29045] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 1259.363272][T29045] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 1259.380420][T29045] veth1_vlan: left promiscuous mode [ 1259.386723][T29045] veth0_vlan: left promiscuous mode [ 1259.393190][T29045] veth0_vlan: entered promiscuous mode [ 1259.405920][T29045] veth1_vlan: entered promiscuous mode [ 1259.417267][T29045] veth1_macvtap: left promiscuous mode [ 1259.423979][T29045] veth0_macvtap: left promiscuous mode [ 1259.430972][T29045] veth0_macvtap: entered promiscuous mode [ 1259.443563][T29045] veth1_macvtap: entered promiscuous mode [ 1259.459050][T29045] 8021q: adding VLAN 0 to HW filter on device eth0 [ 1259.467631][T29045] 8021q: adding VLAN 0 to HW filter on device eth1 [ 1259.484226][T29045] 8021q: adding VLAN 0 to HW filter on device eth2 [ 1259.493288][T29045] 8021q: adding VLAN 0 to HW filter on device eth3 [ 1259.503541][T29045] 8021q: adding VLAN 0 to HW filter on device bond1 [ 1259.513408][T29045] 8021q: adding VLAN 0 to HW filter on device bond2 [ 1259.522880][T29045] 8021q: adding VLAN 0 to HW filter on device batadv1 [ 1259.554757][ T35] bridge0: port 1(bridge_slave_0) entered blocking state [ 1259.561923][ T35] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1259.676937][ T35] bridge0: port 2(bridge_slave_1) entered blocking state [ 1259.684130][ T35] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1259.923164][T29080] netlink: 12 bytes leftover after parsing attributes in process `syz.2.15523'. [ 1259.951665][ T6939] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1259.965102][ T6939] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1259.981495][ T6939] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1260.012112][ T6939] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1260.065316][ T6241] bond5: (slave bridge4): failed to get link speed/duplex [ 1260.199820][T27848] bond5: (slave bridge4): failed to get link speed/duplex [ 1260.337493][T29099] lo speed is unknown, defaulting to 1000 [ 1260.361113][T29071] bond5: (slave bridge4): failed to get link speed/duplex [ 1260.558965][T27848] bond5: (slave bridge4): failed to get link speed/duplex [ 1260.655248][T29122] lo speed is unknown, defaulting to 1000 [ 1260.661684][T29099] lo speed is unknown, defaulting to 1000 [ 1260.683565][T29071] bond5: (slave bridge4): failed to get link speed/duplex [ 1260.809400][T29071] bond5: (slave bridge4): failed to get link speed/duplex [ 1260.870675][T29134] netlink: 20 bytes leftover after parsing attributes in process `syz.1.15537'. [ 1260.998927][T29071] bond5: (slave bridge4): failed to get link speed/duplex [ 1261.023972][T29122] lo speed is unknown, defaulting to 1000 [ 1261.112759][T29139] netlink: zone id is out of range [ 1261.359932][T29146] syz_tun: entered allmulticast mode [ 1261.415239][T29148] netlink: 20 bytes leftover after parsing attributes in process `syz.1.15541'. [ 1261.721861][T29160] batadv_slave_1: entered promiscuous mode [ 1261.820803][T29159] batadv_slave_1: left promiscuous mode [ 1261.870770][T29071] tipc: Subscription rejected, illegal request [ 1262.036638][T29166] Bluetooth: MGMT ver 1.23 [ 1262.063650][T29166] sctp: [Deprecated]: syz.3.15546 (pid 29166) Use of int in max_burst socket option. [ 1262.063650][T29166] Use struct sctp_assoc_value instead [ 1262.133902][T29164] bond3: option fail_over_mac: invalid value (127) [ 1262.168731][T29164] bond3 (unregistering): Released all slaves [ 1262.490781][T29178] lo speed is unknown, defaulting to 1000 [ 1262.813245][T29178] lo speed is unknown, defaulting to 1000 [ 1262.860622][T29191] __nla_validate_parse: 2 callbacks suppressed [ 1262.860666][T29191] netlink: 24 bytes leftover after parsing attributes in process `syz.0.15553'. [ 1262.937365][T29195] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1262.954303][T29195] 8021q: adding VLAN 0 to HW filter on device team0 [ 1262.982829][T29195] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1263.195631][T29195] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1263.220568][T29195] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1263.234750][T29195] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 1263.262782][T29195] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 1263.299637][T29195] veth1_vlan: left promiscuous mode [ 1263.316067][T29195] veth0_vlan: left promiscuous mode [ 1263.324428][T29195] veth0_vlan: entered promiscuous mode [ 1263.335808][T29195] veth1_vlan: entered promiscuous mode [ 1263.352790][T29195] veth1_macvtap: left promiscuous mode [ 1263.362606][T29195] veth0_macvtap: left promiscuous mode [ 1263.369769][T29195] veth0_macvtap: entered promiscuous mode [ 1263.376486][T29195] veth1_macvtap: entered promiscuous mode [ 1263.387971][T29195] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1263.397126][T29195] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1263.406896][T29195] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1263.415888][T29195] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1263.442401][ T6939] bridge0: port 1(bridge_slave_0) entered blocking state [ 1263.449515][ T6939] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1263.458284][ T6939] bridge0: port 2(bridge_slave_1) entered blocking state [ 1263.465406][ T6939] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1263.511572][T29201] pimreg: tun_chr_ioctl cmd 1074025677 [ 1263.517514][T29201] pimreg: linktype set to 6 [ 1263.523221][T29071] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1263.532200][T29071] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1263.555882][T29071] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1263.565113][T29071] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1263.691036][T29211] tc action pedit 'at' offset 5 out of bounds [ 1263.984102][ T6939] net_ratelimit: 12 callbacks suppressed [ 1263.984122][ T6939] bond5: (slave bridge4): failed to get link speed/duplex [ 1264.148652][T29071] bond5: (slave bridge4): failed to get link speed/duplex [ 1264.375968][T29226] netlink: 128 bytes leftover after parsing attributes in process `syz.2.15564'. [ 1264.841945][ T6224] bond5: (slave bridge4): failed to get link speed/duplex [ 1264.978408][ T6224] bond5: (slave bridge4): failed to get link speed/duplex [ 1265.100669][ T6241] bond5: (slave bridge4): failed to get link speed/duplex [ 1265.248736][ T6224] bond5: (slave bridge4): failed to get link speed/duplex [ 1265.277154][T29247] netlink: 12 bytes leftover after parsing attributes in process `syz.3.15568'. [ 1265.528962][ T35] bond5: (slave bridge4): failed to get link speed/duplex [ 1265.641249][T29071] bond5: (slave bridge4): failed to get link speed/duplex [ 1265.675918][T29264] sctp: [Deprecated]: syz.4.15574 (pid 29264) Use of int in max_burst socket option. [ 1265.675918][T29264] Use struct sctp_assoc_value instead [ 1265.727305][T29270] netlink: 16 bytes leftover after parsing attributes in process `syz.0.15577'. [ 1265.743769][T29273] netlink: 20 bytes leftover after parsing attributes in process `syz.1.15576'. [ 1265.759033][T29071] bond5: (slave bridge4): failed to get link speed/duplex [ 1265.898429][T29071] bond5: (slave bridge4): failed to get link speed/duplex [ 1266.111223][T29285] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1266.131584][T29285] 8021q: adding VLAN 0 to HW filter on device team0 [ 1266.152749][T29285] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1266.256153][T29303] netlink: 24 bytes leftover after parsing attributes in process `syz.1.15586'. [ 1266.375197][T29285] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1266.405535][T29285] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1266.443853][T29285] hsr0: A HSR master's MTU cannot be greater than the smallest MTU of its slaves minus the HSR Tag length (6 octets). [ 1266.483360][T29309] nbd: couldn't find device at index 2 [ 1266.568042][T29287] lo speed is unknown, defaulting to 1000 [ 1266.660330][T29324] lo: entered allmulticast mode [ 1266.686693][T29327] netlink: 1 bytes leftover after parsing attributes in process `syz.3.15594'. [ 1266.724275][T29325] dvmrp8: entered allmulticast mode [ 1266.744441][T29322] lo: left allmulticast mode [ 1266.755442][T29322] dvmrp8: left allmulticast mode [ 1266.803536][T29313] lo speed is unknown, defaulting to 1000 [ 1266.803554][T29287] lo speed is unknown, defaulting to 1000 [ 1266.825834][T29328] syzkaller0: create flow: hash 1712759678 index 1 [ 1266.840666][ T5730] syzkaller0: tun_net_xmit 76 [ 1267.138366][ T5721] syzkaller0: tun_net_xmit 76 [ 1267.156527][T29342] bridge0: port 2(bridge_slave_1) entered disabled state [ 1267.163853][T29342] bridge0: port 1(bridge_slave_0) entered disabled state [ 1267.243924][T29342] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1267.256854][T29342] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1267.281704][T29342] hsr0: left promiscuous mode [ 1267.393376][T29313] lo speed is unknown, defaulting to 1000 [ 1267.422048][T16915] syzkaller0: tun_net_xmit 76 [ 1267.438678][ T5721] syzkaller0: tun_net_xmit 76 [ 1267.529145][T16915] syzkaller0: tun_net_xmit 76 [ 1267.552741][T29343] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1267.567468][T29343] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1267.602677][ T6224] netdevsim netdevsim2 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1267.636097][T29320] syzkaller0: delete flow: hash 1712759678 index 1 [ 1267.767642][ T6224] netdevsim netdevsim2 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1267.784181][T29356] netlink: 20 bytes leftover after parsing attributes in process `syz.3.15601'. [ 1267.817584][ T6224] netdevsim netdevsim2 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1267.837309][ T6224] netdevsim netdevsim2 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1268.074020][T29368] netlink: 'syz.1.15605': attribute type 2 has an invalid length. [ 1268.818790][T29385] bridge0: port 2(bridge_slave_1) entered disabled state [ 1268.826223][T29385] bridge0: port 1(bridge_slave_0) entered disabled state [ 1268.902005][T29385] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1268.918671][T29385] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1269.018461][T29387] netlink: 20 bytes leftover after parsing attributes in process `syz.3.15612'. [ 1269.072912][ T6241] netdevsim netdevsim1 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1269.116758][ T6241] netdevsim netdevsim1 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1269.155767][ T6241] netdevsim netdevsim1 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1269.193320][ T6241] netdevsim netdevsim1 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1269.290824][T27848] net_ratelimit: 32 callbacks suppressed [ 1269.290844][T27848] bond5: (slave bridge4): failed to get link speed/duplex [ 1269.375947][T29403] netlink: 8 bytes leftover after parsing attributes in process `syz.0.15616'. [ 1269.440554][T27848] bond5: (slave bridge4): failed to get link speed/duplex [ 1269.568809][ T6241] bond5: (slave bridge4): failed to get link speed/duplex [ 1269.698340][ T6241] bond5: (slave bridge4): failed to get link speed/duplex [ 1269.803786][T29428] lo speed is unknown, defaulting to 1000 [ 1269.818238][ T6941] bond5: (slave bridge4): failed to get link speed/duplex [ 1270.360715][T29439] bridge0: port 2(bridge_slave_1) entered disabled state [ 1270.369003][T29439] bridge0: port 1(bridge_slave_0) entered disabled state [ 1270.660504][T29439] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1270.677860][T29439] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1270.794994][T29428] lo speed is unknown, defaulting to 1000 [ 1270.877895][ T6941] netdevsim netdevsim4 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1270.898701][ T6941] netdevsim netdevsim4 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1270.954125][T29459] netlink: 8 bytes leftover after parsing attributes in process `syz.4.15631'. [ 1270.973005][ T6939] bond5: (slave bridge4): failed to get link speed/duplex [ 1270.988490][ T6941] netdevsim netdevsim4 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1270.997544][T29459] netlink: 20 bytes leftover after parsing attributes in process `syz.4.15631'. [ 1271.060106][T29459] netlink: 16 bytes leftover after parsing attributes in process `syz.4.15631'. [ 1271.075729][T29460] netlink: 212368 bytes leftover after parsing attributes in process `syz.4.15631'. [ 1271.108039][ T6941] netdevsim netdevsim4 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1271.133537][ T6941] netdevsim netdevsim4 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1271.170460][ T6941] netdevsim netdevsim4 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 1271.180170][ T6941] netdevsim netdevsim4 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1271.190024][ T6941] netdevsim netdevsim4 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1271.227803][T29459] netdevsim netdevsim4 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1271.252924][ T6941] ================================================================== [ 1271.261049][ T6941] BUG: KASAN: slab-use-after-free in __mutex_lock+0x154/0x1550 [ 1271.268640][ T6941] Read of size 8 at addr ffff888029e342a8 by task kworker/u8:8/6941 [ 1271.276646][ T6941] [ 1271.278994][ T6941] CPU: 1 UID: 0 PID: 6941 Comm: kworker/u8:8 Not tainted syzkaller #0 PREEMPT(full) [ 1271.279015][ T6941] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1271.279027][ T6941] Workqueue: udp_tunnel_nic udp_tunnel_nic_device_sync_work [ 1271.279133][ T6941] Call Trace: [ 1271.279140][ T6941] [ 1271.279147][ T6941] dump_stack_lvl+0xe8/0x150 [ 1271.279168][ T6941] print_address_description+0x55/0x1e0 [ 1271.279185][ T6941] ? __mutex_lock+0x154/0x1550 [ 1271.279207][ T6941] print_report+0x58/0x70 [ 1271.279222][ T6941] kasan_report+0x117/0x150 [ 1271.279247][ T6941] ? rcu_is_watching+0x15/0xb0 [ 1271.279265][ T6941] ? __mutex_lock+0x154/0x1550 [ 1271.279291][ T6941] __mutex_lock+0x154/0x1550 [ 1271.279315][ T6941] ? __mutex_lock+0x5d4/0x1550 [ 1271.279338][ T6941] ? udp_tunnel_nic_device_sync_work+0x39/0xa20 [ 1271.279363][ T6941] ? __pfx___mutex_lock+0x10/0x10 [ 1271.279386][ T6941] ? do_raw_spin_lock+0x12b/0x2f0 [ 1271.279408][ T6941] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 1271.279434][ T6941] ? pwq_dec_nr_in_flight+0xb93/0xf20 [ 1271.279457][ T6941] ? process_scheduled_works+0xa20/0x14e0 [ 1271.279476][ T6941] ? rcu_is_watching+0x15/0xb0 [ 1271.279493][ T6941] ? process_scheduled_works+0xa20/0x14e0 [ 1271.279514][ T6941] udp_tunnel_nic_device_sync_work+0x39/0xa20 [ 1271.279540][ T6941] ? rcu_is_watching+0x15/0xb0 [ 1271.279558][ T6941] ? process_scheduled_works+0xa20/0x14e0 [ 1271.279579][ T6941] process_scheduled_works+0xa8e/0x14e0 [ 1271.279613][ T6941] ? __pfx_process_scheduled_works+0x10/0x10 [ 1271.279632][ T6941] ? do_raw_spin_lock+0x26c/0x2f0 [ 1271.279655][ T6941] ? assign_work+0x3cf/0x5d0 [ 1271.279677][ T6941] worker_thread+0xa47/0xfb0 [ 1271.279712][ T6941] kthread+0x388/0x470 [ 1271.279727][ T6941] ? __pfx_worker_thread+0x10/0x10 [ 1271.279748][ T6941] ? __pfx_kthread+0x10/0x10 [ 1271.279764][ T6941] ret_from_fork+0x514/0xb70 [ 1271.279782][ T6941] ? __pfx_ret_from_fork+0x10/0x10 [ 1271.279798][ T6941] ? __switch_to+0xc89/0x1420 [ 1271.279823][ T6941] ? __pfx_kthread+0x10/0x10 [ 1271.279838][ T6941] ret_from_fork_asm+0x1a/0x30 [ 1271.279869][ T6941] [ 1271.279876][ T6941] [ 1271.483758][ T6941] Allocated by task 28392: [ 1271.488196][ T6941] kasan_save_track+0x3e/0x80 [ 1271.492942][ T6941] __kasan_kmalloc+0x93/0xb0 [ 1271.497550][ T6941] __kmalloc_noprof+0x358/0x750 [ 1271.502417][ T6941] udp_tunnel_nic_netdevice_event+0x4e9/0x1850 [ 1271.508591][ T6941] notifier_call_chain+0x1a5/0x3d0 [ 1271.513734][ T6941] register_netdevice+0x18a4/0x1eb0 [ 1271.518943][ T6941] nsim_create+0xbd7/0x1140 [ 1271.523560][ T6941] __nsim_dev_port_add+0x7f8/0xcd0 [ 1271.528721][ T6941] nsim_dev_port_add_all+0x37/0xf0 [ 1271.533851][ T6941] nsim_drv_probe+0x8ce/0xbf0 [ 1271.538545][ T6941] really_probe+0x254/0xae0 [ 1271.543140][ T6941] __driver_probe_device+0x1e8/0x360 [ 1271.548442][ T6941] driver_probe_device+0x4f/0x240 [ 1271.553483][ T6941] __device_attach_driver+0x270/0x410 [ 1271.558871][ T6941] bus_for_each_drv+0x258/0x2f0 [ 1271.563796][ T6941] __device_attach+0x2c4/0x450 [ 1271.568576][ T6941] device_initial_probe+0xa1/0xd0 [ 1271.573631][ T6941] bus_probe_device+0x12a/0x220 [ 1271.578500][ T6941] device_add+0x7d7/0xb80 [ 1271.582844][ T6941] new_device_store+0x37b/0x710 [ 1271.587783][ T6941] kernfs_fop_write_iter+0x3a4/0x540 [ 1271.593081][ T6941] vfs_write+0x612/0xba0 [ 1271.597348][ T6941] ksys_write+0x150/0x270 [ 1271.601691][ T6941] do_syscall_64+0x174/0x580 [ 1271.606302][ T6941] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1271.612207][ T6941] [ 1271.614542][ T6941] Freed by task 29459: [ 1271.618622][ T6941] kasan_save_track+0x3e/0x80 [ 1271.623315][ T6941] kasan_save_free_info+0x40/0x50 [ 1271.628364][ T6941] __kasan_slab_free+0x5c/0x80 [ 1271.633153][ T6941] kfree+0x1c5/0x640 [ 1271.637068][ T6941] udp_tunnel_nic_netdevice_event+0x1236/0x1850 [ 1271.643325][ T6941] notifier_call_chain+0x1a5/0x3d0 [ 1271.648461][ T6941] unregister_netdevice_many_notify+0x17de/0x2150 [ 1271.654890][ T6941] unregister_netdevice_queue+0x2f5/0x340 [ 1271.660621][ T6941] nsim_destroy+0x26d/0x800 [ 1271.665137][ T6941] __nsim_dev_port_del+0x14e/0x200 [ 1271.670264][ T6941] nsim_dev_reload_destroy+0x288/0x490 [ 1271.675759][ T6941] nsim_dev_reload_down+0x8a/0xc0 [ 1271.680830][ T6941] devlink_reload+0x1c5/0x890 [ 1271.685638][ T6941] devlink_nl_reload_doit+0xa9c/0xc80 [ 1271.691027][ T6941] genl_family_rcv_msg_doit+0x233/0x340 [ 1271.696582][ T6941] genl_rcv_msg+0x614/0x7a0 [ 1271.701090][ T6941] netlink_rcv_skb+0x226/0x4a0 [ 1271.705863][ T6941] genl_rcv+0x28/0x40 [ 1271.709853][ T6941] netlink_unicast+0x7bb/0x940 [ 1271.714627][ T6941] netlink_sendmsg+0x813/0xb40 [ 1271.719403][ T6941] ____sys_sendmsg+0x9b9/0xa20 [ 1271.724191][ T6941] ___sys_sendmsg+0x2a5/0x360 [ 1271.728888][ T6941] __x64_sys_sendmsg+0x1b1/0x290 [ 1271.733841][ T6941] do_syscall_64+0x174/0x580 [ 1271.738445][ T6941] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1271.744373][ T6941] [ 1271.746703][ T6941] Last potentially related work creation: [ 1271.752420][ T6941] kasan_save_stack+0x3e/0x60 [ 1271.757110][ T6941] kasan_record_aux_stack+0xbd/0xd0 [ 1271.762324][ T6941] insert_work+0x3d/0x330 [ 1271.766665][ T6941] __queue_work+0xb7c/0xff0 [ 1271.771184][ T6941] queue_work_on+0x106/0x1d0 [ 1271.775791][ T6941] __udp_tunnel_nic_add_port+0xba9/0xd90 [ 1271.781437][ T6941] udp_tunnel_notify_add_rx_port+0x2bd/0x3c0 [ 1271.787427][ T6941] __vxlan_sock_add+0xdb7/0x1370 [ 1271.792453][ T6941] vxlan_open+0x11d/0x220 [ 1271.796888][ T6941] __dev_open+0x46f/0x850 [ 1271.801226][ T6941] __dev_change_flags+0x329/0x820 [ 1271.806257][ T6941] rtnl_newlink_create+0x53e/0xb00 [ 1271.811386][ T6941] rtnl_newlink+0x167f/0x1bd0 [ 1271.816074][ T6941] rtnetlink_rcv_msg+0x802/0xc00 [ 1271.821024][ T6941] netlink_rcv_skb+0x226/0x4a0 [ 1271.825805][ T6941] netlink_unicast+0x7bb/0x940 [ 1271.830591][ T6941] netlink_sendmsg+0x813/0xb40 [ 1271.835375][ T6941] ____sys_sendmsg+0x9b9/0xa20 [ 1271.840158][ T6941] ___sys_sendmsg+0x2a5/0x360 [ 1271.844851][ T6941] __sys_sendmmsg+0x273/0x4d0 [ 1271.849550][ T6941] __x64_sys_sendmmsg+0xa0/0xc0 [ 1271.854422][ T6941] do_syscall_64+0x174/0x580 [ 1271.859028][ T6941] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1271.864933][ T6941] [ 1271.867263][ T6941] Second to last potentially related work creation: [ 1271.873859][ T6941] kasan_save_stack+0x3e/0x60 [ 1271.878553][ T6941] kasan_record_aux_stack+0xbd/0xd0 [ 1271.883770][ T6941] insert_work+0x3d/0x330 [ 1271.888115][ T6941] __queue_work+0xb7c/0xff0 [ 1271.892639][ T6941] queue_work_on+0x106/0x1d0 [ 1271.897248][ T6941] __udp_tunnel_nic_del_port+0xc6/0x110 [ 1271.902816][ T6941] udp_tunnel_notify_del_rx_port+0x2bd/0x3c0 [ 1271.908814][ T6941] geneve_sock_release+0x425/0x490 [ 1271.913945][ T6941] geneve_stop+0x176/0x1b0 [ 1271.918378][ T6941] __dev_close_many+0x366/0x6e0 [ 1271.923241][ T6941] __dev_change_flags+0x3f5/0x820 [ 1271.928280][ T6941] netif_change_flags+0x7c/0x1b0 [ 1271.933249][ T6941] do_setlink+0xdd6/0x4670 [ 1271.937686][ T6941] rtnl_newlink+0x148e/0x1bd0 [ 1271.942383][ T6941] rtnetlink_rcv_msg+0x802/0xc00 [ 1271.947341][ T6941] netlink_rcv_skb+0x226/0x4a0 [ 1271.952122][ T6941] netlink_unicast+0x7bb/0x940 [ 1271.956905][ T6941] netlink_sendmsg+0x813/0xb40 [ 1271.961695][ T6941] ____sys_sendmsg+0x9b9/0xa20 [ 1271.966506][ T6941] ___sys_sendmsg+0x2a5/0x360 [ 1271.971205][ T6941] __x64_sys_sendmsg+0x1b1/0x290 [ 1271.976166][ T6941] do_syscall_64+0x174/0x580 [ 1271.980779][ T6941] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1271.986685][ T6941] [ 1271.989022][ T6941] The buggy address belongs to the object at ffff888029e34200 [ 1271.989022][ T6941] which belongs to the cache kmalloc-256 of size 256 [ 1272.003095][ T6941] The buggy address is located 168 bytes inside of [ 1272.003095][ T6941] freed 256-byte region [ffff888029e34200, ffff888029e34300) [ 1272.016911][ T6941] [ 1272.019254][ T6941] The buggy address belongs to the physical page: [ 1272.025697][ T6941] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x29e34 [ 1272.034484][ T6941] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 1272.042994][ T6941] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 1272.050552][ T6941] page_type: f5(slab) [ 1272.054549][ T6941] raw: 00fff00000000040 ffff88813fe1bb40 dead000000000100 dead000000000122 [ 1272.063142][ T6941] raw: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000 [ 1272.071738][ T6941] head: 00fff00000000040 ffff88813fe1bb40 dead000000000100 dead000000000122 [ 1272.080427][ T6941] head: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000 [ 1272.089109][ T6941] head: 00fff00000000001 ffffffffffffff81 00000000ffffffff 00000000ffffffff [ 1272.097791][ T6941] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 1272.106470][ T6941] page dumped because: kasan: bad access detected [ 1272.112912][ T6941] page_owner tracks the page as allocated [ 1272.118640][ T6941] page last allocated via order 1, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5636, tgid 5636 (syz-executor), ts 70483791575, free_ts 70470110693 [ 1272.140020][ T6941] post_alloc_hook+0x22d/0x280 [ 1272.144808][ T6941] get_page_from_freelist+0x24ae/0x2530 [ 1272.150369][ T6941] __alloc_frozen_pages_noprof+0x18d/0x380 [ 1272.156196][ T6941] allocate_slab+0x74/0x5d0 [ 1272.160713][ T6941] refill_objects+0x328/0x3c0 [ 1272.165406][ T6941] __pcs_replace_empty_main+0x2e0/0x6b0 [ 1272.170961][ T6941] __kmalloc_noprof+0x464/0x750 [ 1272.175827][ T6941] fib_create_info+0x16fe/0x3170 [ 1272.180850][ T6941] fib_table_insert+0xcb/0x1b10 [ 1272.185722][ T6941] fib_magic+0x43b/0x530 [ 1272.190018][ T6941] fib_add_ifaddr+0x139/0x5d0 [ 1272.194705][ T6941] fib_inetaddr_event+0x12e/0x190 [ 1272.199741][ T6941] notifier_call_chain+0x1a5/0x3d0 [ 1272.204890][ T6941] blocking_notifier_call_chain+0x6a/0x90 [ 1272.210628][ T6941] __inet_insert_ifa+0x9ef/0xbc0 [ 1272.215639][ T6941] inet_rtm_newaddr+0x102d/0x19e0 [ 1272.220676][ T6941] page last free pid 57 tgid 57 stack trace: [ 1272.226659][ T6941] __free_frozen_pages+0xc0d/0xd20 [ 1272.231797][ T6941] __slab_free+0x274/0x2c0 [ 1272.236248][ T6941] qlist_free_all+0x99/0x100 [ 1272.240864][ T6941] kasan_quarantine_reduce+0x148/0x160 [ 1272.246343][ T6941] __kasan_slab_alloc+0x22/0x80 [ 1272.251241][ T6941] kmem_cache_alloc_node_noprof+0x380/0x680 [ 1272.257153][ T6941] __alloc_skb+0x1d7/0x7a0 [ 1272.261578][ T6941] rtmsg_ifinfo_build_skb+0x7f/0x260 [ 1272.266901][ T6941] rtmsg_ifinfo+0x8c/0x1a0 [ 1272.271324][ T6941] netif_state_change+0x297/0x3a0 [ 1272.276368][ T6941] __linkwatch_run_queue+0x52a/0x800 [ 1272.281660][ T6941] linkwatch_event+0x4c/0x60 [ 1272.286254][ T6941] process_scheduled_works+0xa8e/0x14e0 [ 1272.291816][ T6941] worker_thread+0xa47/0xfb0 [ 1272.296434][ T6941] kthread+0x388/0x470 [ 1272.300508][ T6941] ret_from_fork+0x514/0xb70 [ 1272.305104][ T6941] [ 1272.307429][ T6941] Memory state around the buggy address: [ 1272.313063][ T6941] ffff888029e34180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 1272.321127][ T6941] ffff888029e34200: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1272.329191][ T6941] >ffff888029e34280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1272.337280][ T6941] ^ [ 1272.342665][ T6941] ffff888029e34300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 1272.350735][ T6941] ffff888029e34380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 1272.358811][ T6941] ================================================================== [ 1272.440755][ T6941] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 1272.448025][ T6941] CPU: 0 UID: 0 PID: 6941 Comm: kworker/u8:8 Not tainted syzkaller #0 PREEMPT(full) [ 1272.457511][ T6941] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1272.467588][ T6941] Workqueue: udp_tunnel_nic udp_tunnel_nic_device_sync_work [ 1272.474909][ T6941] Call Trace: [ 1272.478210][ T6941] [ 1272.481147][ T6941] vpanic+0x56c/0xa60 [ 1272.485127][ T6941] ? __pfx_vpanic+0x10/0x10 [ 1272.489635][ T6941] ? rcu_is_watching+0x15/0xb0 [ 1272.494403][ T6941] panic+0xc5/0xd0 [ 1272.498146][ T6941] ? __pfx_panic+0x10/0x10 [ 1272.502587][ T6941] ? preempt_schedule_thunk+0x16/0x40 [ 1272.507965][ T6941] ? __mutex_lock+0x154/0x1550 [ 1272.512731][ T6941] ? preempt_schedule_thunk+0x16/0x40 [ 1272.518116][ T6941] ? __mutex_lock+0x154/0x1550 [ 1272.522887][ T6941] check_panic_on_warn+0x89/0xb0 [ 1272.527840][ T6941] ? __mutex_lock+0x154/0x1550 [ 1272.532617][ T6941] end_report+0x73/0x170 [ 1272.536883][ T6941] ? __mutex_lock+0x154/0x1550 [ 1272.541655][ T6941] kasan_report+0x128/0x150 [ 1272.546157][ T6941] ? rcu_is_watching+0x15/0xb0 [ 1272.550915][ T6941] ? __mutex_lock+0x154/0x1550 [ 1272.555684][ T6941] __mutex_lock+0x154/0x1550 [ 1272.560278][ T6941] ? __mutex_lock+0x5d4/0x1550 [ 1272.565036][ T6941] ? udp_tunnel_nic_device_sync_work+0x39/0xa20 [ 1272.571272][ T6941] ? __pfx___mutex_lock+0x10/0x10 [ 1272.576318][ T6941] ? do_raw_spin_lock+0x12b/0x2f0 [ 1272.581349][ T6941] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 1272.586714][ T6941] ? pwq_dec_nr_in_flight+0xb93/0xf20 [ 1272.592082][ T6941] ? process_scheduled_works+0xa20/0x14e0 [ 1272.597794][ T6941] ? rcu_is_watching+0x15/0xb0 [ 1272.602553][ T6941] ? process_scheduled_works+0xa20/0x14e0 [ 1272.608268][ T6941] udp_tunnel_nic_device_sync_work+0x39/0xa20 [ 1272.614339][ T6941] ? rcu_is_watching+0x15/0xb0 [ 1272.619096][ T6941] ? process_scheduled_works+0xa20/0x14e0 [ 1272.624810][ T6941] process_scheduled_works+0xa8e/0x14e0 [ 1272.630359][ T6941] ? __pfx_process_scheduled_works+0x10/0x10 [ 1272.636335][ T6941] ? do_raw_spin_lock+0x26c/0x2f0 [ 1272.641357][ T6941] ? assign_work+0x3cf/0x5d0 [ 1272.645969][ T6941] worker_thread+0xa47/0xfb0 [ 1272.650594][ T6941] kthread+0x388/0x470 [ 1272.654675][ T6941] ? __pfx_worker_thread+0x10/0x10 [ 1272.659799][ T6941] ? __pfx_kthread+0x10/0x10 [ 1272.664382][ T6941] ret_from_fork+0x514/0xb70 [ 1272.668965][ T6941] ? __pfx_ret_from_fork+0x10/0x10 [ 1272.674071][ T6941] ? __switch_to+0xc89/0x1420 [ 1272.678749][ T6941] ? __pfx_kthread+0x10/0x10 [ 1272.683334][ T6941] ret_from_fork_asm+0x1a/0x30 [ 1272.688103][ T6941] [ 1272.691785][ T6941] Kernel Offset: disabled [ 1272.696108][ T6941] Rebooting in 86400 seconds..