last executing test programs: 22.471317247s ago: executing program 2 (id=1304): r0 = socket(0x10, 0x803, 0x0) sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x1c}}, 0x0) getsockname$packet(r0, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=ANY=[], 0x3c}}, 0x20040000) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)=@newlink={0x44, 0x10, 0x503, 0x70bd2d, 0x700, {0x0, 0x0, 0x0, 0x0, 0x0, 0x1000}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bond={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BOND_MODE={0x5, 0x1, 0x1}]}}}, @IFLA_MASTER={0x8, 0xa, r1}]}, 0x44}, 0x1, 0x0, 0x0, 0x800}, 0x0) getpeername$packet(r0, &(0x7f0000000180), &(0x7f00000001c0)=0x14) 22.052746402s ago: executing program 2 (id=1312): r0 = socket$inet(0x2, 0x80000, 0x9) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000340), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000002c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r1, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000005fc0)={&(0x7f0000000000)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="01002dbd0600ffdbdb252100000008000300", @ANYRES32=r3, @ANYBLOB="0600eb00000800000400ec000a00060008021100000100000600f70000ff000008009e"], 0x44}, 0x1, 0x0, 0x0, 0x4048020}, 0x20000) 21.782416259s ago: executing program 2 (id=1313): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000680)={0x10, 0x4, &(0x7f0000001280)=ANY=[@ANYRES32, @ANYRESDEC=0x0, @ANYRESDEC=0x0, @ANYRESOCT, @ANYRESDEC, @ANYRES16], &(0x7f00000000c0)='GPL\x00', 0x3, 0x0, 0x0, 0x0, 0x71}, 0x94) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000001240)=ANY=[@ANYRESOCT=r0], 0x48) bpf$BPF_PROG_DETACH(0x8, &(0x7f00000001c0)=ANY=[@ANYRES32=r1, @ANYRES32=r0, @ANYBLOB="07f65ebef60ea4c3ff000000", @ANYRES32, @ANYBLOB, @ANYRES64=0x0], 0x10) (async) r2 = socket$vsock_stream(0x28, 0x1, 0x0) bind$vsock_stream(r2, 0x0, 0x0) listen(r2, 0x0) (async) r3 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r3, &(0x7f0000000640)={0x28, 0x0, 0x2710, @local}, 0x10) (async) close(0x3) (async) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, 0x0, &(0x7f0000000140)) (async) r4 = socket$inet6_sctp(0xa, 0x801, 0x84) getsockopt$inet_opts(0xffffffffffffffff, 0x0, 0x14, &(0x7f0000937fed)=""/3, &(0x7f0000000080)=0x3) (async, rerun: 64) getsockopt$bt_hci(r4, 0x84, 0x1, &(0x7f0000000080)=""/4057, &(0x7f0000001180)=0xfd9) (async, rerun: 64) sendmmsg$inet_sctp(0xffffffffffffffff, 0x0, 0x0, 0x0) (async) recvmmsg(r4, &(0x7f0000002b80)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x5}], 0x1, 0x0, 0x0) (async, rerun: 64) r5 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff) (rerun: 64) r6 = socket$netlink(0x10, 0x3, 0x10) sendmsg$DEVLINK_CMD_PORT_GET(r6, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000001200)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="01000500000000000000350000000e0001006e657464657673696d0000000f0002006e82657464657673696d3000000800030001000000"], 0x3c}}, 0x0) shutdown(r3, 0x0) (async, rerun: 32) mmap(&(0x7f00003e4000/0x3000)=nil, 0x3000, 0xb635773f05ebbee1, 0x8031, 0xffffffffffffffff, 0x0) (async, rerun: 32) socketpair(0x2c, 0xa, 0x7, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) (async) r8 = bpf$MAP_CREATE(0x0, &(0x7f00000013c0)=ANY=[@ANYBLOB="120000e505000000000000000200000000180000ff8844ef4a92a7894fad062b472958d605582c8160f6909f2b488980cb7c7d27c1fb1c3f3d95952e5bb310d55a33635ffdea59c3fccfa85ec01b8b77a84108c70631a2682283817a5e6f10f1924b34bf9b0a8b53aa6991148b0624dd8791a177efae4b4839", @ANYRES32, @ANYBLOB="0000000600160000000000000000001c002000e0b1226d10ed7f6fb0b1fe5573f362d229e738c6eef240361a74bdd30c007f4573871d941b8617e4119f1ba3885520fc3f784b46d14fe7fcf44359a83eee133f6bc163", @ANYRES64=r1, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000180)={{r8}, &(0x7f0000000040), &(0x7f0000000140)=r7}, 0x20) socket$l2tp(0x2, 0x2, 0x73) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFNL_MSG_COMPAT_GET(r9, &(0x7f00000017c0)={0x0, 0x0, &(0x7f0000001780)={0x0}, 0x1, 0x0, 0x0, 0x1}, 0x24040800) getsockopt$netrom_NETROM_IDLE(0xffffffffffffffff, 0x103, 0x7, &(0x7f0000001140)=0x3, &(0x7f00000011c0)=0x4) (async) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000100)={{r8}, 0x0, 0x0}, 0x20) (async) bpf$MAP_DELETE_ELEM(0x3, 0x0, 0x0) close(r1) 21.741692528s ago: executing program 2 (id=1315): r0 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000340)={0x118, 0x2e, 0x1, 0x0, 0x0, "", [@nested={0x4, 0x119}, @nested={0x104, 0x11, 0x0, 0x1, [@nested={0x100, 0xcf, 0x0, 0x1, [@generic="d478b585fcf4962925eb81095dd3d92e983e841d6ef7368187237f5e91a74d57e8aaee05ec6319", @generic="8f3bec68ef62803fe98daf2de4c76a713091d7d093f16995a391c42d5dfc312e9b67f3e831135df00a399b5234733f156436b0ed25721632972efdd7a775655ff99c2abdc650ece6458a5f9db07c36adc6ebcfe60b70e5a54a83041bc8e1c08dc0afd69868eddb1e9634f84ef01b3f9c31b8c76a0e2ac9dba5adc10a3c9a2360cb2fe6e11e9efcaff1b39dd49895a112f947e4923d9b5c428a37b673f33f3ed02d225807d47efe0a590665b49bf5eaa0890c512f2a01eb6713c6b3539790dca05a2632596c591745bbbf4953c0a783a881f8cf755e"]}]}]}, 0x118}], 0x1, 0x0, 0x0, 0x84}, 0x300) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f00000001c0)="d80000001c0081064e81f782db44b9040a1d08040000000000000aa1180002000607002603600e12080b0f0000810401a8001605200001400200000803604e0cfab94dcf5c0461c1d67f6f94007134cf6ee08000a0e408e8d8ef52a98516277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee422fe7c9f8775730d16a4683f5aeb4edbb57a5025ccca9e00360db70100000040fad95667e006dcdf63951f215ce3bb9ad809d5e1cace81ed0bffece0b42a9ecbee5de6ccd40dd6e4edef5d2defd5ccae8d3fb7c27a1059ae31c60e2234d732", 0xd8}], 0x1, 0x0, 0x0, 0x7400}, 0x400c0) 21.427699433s ago: executing program 2 (id=1316): sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0xc0) write$tun(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="00000000000003002000000088"], 0x62) r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f00005f5000)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="020300001b0000000000000000000000040003000000000000000000000000000000000000000000000000000000000005000600000000000a00000000000000fe8000000000000000000000000000bb00000000000000000400040000000000000000000000000000000000000000000000000000000000020001000000000000000000000000ff05000500000000000a00000000000000fe8896380000000000000001000000010000000000000000030007000000000002004e24ac14141f0000000000000000020013"], 0xd8}}, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000001100)=@migrate={0xec, 0x21, 0x1, 0x0, 0x0, {{@in=@multicast1, @in=@dev={0xac, 0x14, 0x14, 0x2e}, 0x0, 0x0, 0x0, 0x0, 0x2, 0x80, 0x80, 0x2e}}, [@migrate={0x9c, 0x11, [{@in=@loopback=0xa010101, @in=@loopback, @in6=@private2={0xfc, 0x2, '\x00', 0x1}, @in6=@loopback, 0x0, 0x3, 0x0, 0x0, 0xa, 0xa}, {@in=@private=0xa010101, @in=@loopback, @in=@dev={0xac, 0x14, 0x14, 0x39}, @in=@dev={0xac, 0x14, 0x14, 0x2c}, 0x3c, 0x0, 0x0, 0x0, 0x8, 0x2}]}]}, 0xec}, 0x1, 0x0, 0x0, 0xc000}, 0x4020800) close(0x4) unshare(0x6a040000) socket$nl_generic(0x10, 0x3, 0x10) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socket$unix(0x1, 0x5, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r2, 0x6, 0xd, &(0x7f0000000000)='bbr', 0x3) sendto$inet(r2, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x2c) r3 = socket$kcm(0x10, 0x2, 0x4) sendmsg$kcm(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000280)="89000000120081ae08060cdc030000007f03e3f7000000006ee2ffca1b1f0000000004c00e72f750375ed08a56331dbf9ed7815e381ad6e747033a0093b837dc6cc01e32efaec8c7a6ec0012100001400d0c0c00bdad446b9bbc7a46e3988285dcdf12f21308f868fece01955fed0009d78f0a947ee2b49e33538afa8af92347514f0b56a20ff27fff", 0x89}], 0x1}, 0x0) 20.702888723s ago: executing program 2 (id=1327): r0 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$IOCTL_GET_NCIDEV_IDX(r0, 0x0, &(0x7f00000000c0)) r1 = socket$inet(0x2, 0x2, 0x1) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r2) r3 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r2, &(0x7f0000000000)={0xa, 0x4e22, 0x0, @local, 0xb}, 0x1c) listen(r3, 0x0) syz_emit_ethernet(0x4e, &(0x7f0000000280)={@local, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x1a}, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "c105f5", 0x18, 0x6, 0x0, @local, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x6, 0x2, 0x0, 0x0, 0x0, {[@fastopen={0x1e, 0x4, 'U7'}]}}}}}}}}, 0x0) connect$inet(r1, &(0x7f0000000180)={0x2, 0x4e24, @remote}, 0x10) sendmmsg$inet(r1, &(0x7f00000028c0)=[{{0x0, 0x0, &(0x7f0000000980)=[{&(0x7f0000000500)="08001497", 0x4}, {&(0x7f0000000400)="c63d763f80", 0x5}], 0x2}}], 0x1, 0x8000) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r4) sendmsg$NFC_CMD_DEV_UP(r4, &(0x7f0000000140)={0x0, 0xfffffffffffffffd, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r5, @ANYRES64=r0, @ANYRES64=r5], 0x1c}, 0x1, 0x0, 0x0, 0x8000040}, 0x0) write$nci(r0, &(0x7f0000000040)=ANY=[@ANYBLOB="e0cc014c"], 0x4) 18.886981043s ago: executing program 1 (id=1347): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000004c0)=[{&(0x7f0000000380)="2e00000010008188e6b62aa73772cc9f1ba1f848110000005e140602000000000e000a001000000002900000121f", 0x2e}], 0x1}, 0x40) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r4, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000640)=@newtfilter={0x44, 0x2c, 0xd27, 0x70bd2c, 0x2, {0x0, 0x0, 0x0, r4, {0xc, 0x3}, {}, {0x9}}, [@filter_kind_options=@f_flower={{0xb}, {0x14, 0x2, [@TCA_FLOWER_KEY_ENC_IPV4_DST={0x8, 0x1d, @initdev={0xac, 0x1e, 0x0, 0x0}}, @TCA_FLOWER_KEY_ENC_IPV4_DST_MASK={0x8}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4}, 0x0) 18.826642512s ago: executing program 1 (id=1349): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = socket(0x10, 0x80003, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000040)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_prio={{0x9}, {0x18, 0x2, {0xf, "000000000000000f000100000e00"}}}]}, 0x48}}, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000380)=@newsa={0x13c, 0x10, 0x713, 0x0, 0x25dfdbff, {{@in=@loopback, @in=@private=0xa010102, 0x1, 0x0, 0x0, 0x0, 0x2}, {@in=@loopback, 0x4d3, 0x32}, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, {0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0xa, 0x4}, [@algo_aead={0x4c, 0x12, {{'gcm(aes)\x00'}, 0x0, 0x60}}]}, 0x13c}}, 0x0) 18.727223074s ago: executing program 1 (id=1352): sendmsg$SOCK_DIAG_BY_FAMILY(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, 0x0}, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_attach_bpf(r1, 0x1, 0x4c, &(0x7f0000000000), 0x4) sendmsg$inet(r0, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff}) sendmsg$IPSET_CMD_RENAME(r2, &(0x7f0000000600)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000540)={0x5c, 0x5, 0x6, 0x201, 0x0, 0x0, {0x5, 0x0, 0x6}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME2={0x9, 0x3, 'syz0\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME2={0x9, 0x3, 'syz2\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}]}, 0x5c}, 0x1, 0x0, 0x0, 0x4000}, 0x4890) recvmsg$unix(r1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000300)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) r4 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) ioctl$ifreq_SIOCGIFINDEX_wireguard(r3, 0x8933, &(0x7f0000000180)={'wg2\x00', 0x0}) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x11, 0xf, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000800000000bf91000000000000b702000043e7b5538500000085000000b70000000000000095"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', r5, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4a, 0x0, 0x0, 0x0}, 0x1a) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000140)='kmem_cache_free\x00', r6}, 0x10) ppoll(&(0x7f0000000500)=[{r4}], 0x1, 0x0, 0x0, 0x0) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x0, 0x3, 0xfffffffffffffffd, 0x9323, 0xfffffffffffffffe, 0x0, 0x2}, 0x0, &(0x7f00000002c0)={0x3ff, 0x0, 0x0, 0x9, 0x0, 0x0, 0x7fffffff, 0x2}, 0x0, 0x0) sendmsg$IEEE802154_ADD_IFACE(0xffffffffffffffff, &(0x7f0000000740)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4081}, 0x4000800) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x11, 0x6, &(0x7f0000001c40)=ANY=[@ANYBLOB="050000000000000061110c00000000008510000002000000850000000500000095000000000000009500a5050000000077d8f3b423cdac8d80000000000000002be16ad10a48b243ccc42606d25dfd73a015e0ca7fc2506a0f7535f7866907dc6751dfb265a0e3ccae669e17fd6587d452d6453559c3421eed73d56615fe6c54c3b3ffe1b4ce25d7c983c044c03bf3a48dfe47ec9dd6c091c30b93bfae76d9ebacd3ed3e26e7a23129d6606fd28a69989d552af9cc9e5ef6bda9df2c3af36effff9af2551ce935b0f327cb3f011a2fd52347125907000000000000003ed38ae89d24e1cebfba2f87925bfacba83109751fe6c05405d027edd68149ee99eef6a6992308a4fc0b7c70bc677d6dd4aed4af7511d7900a820b6347184e9a217b5614cd50cbe43a1ed2526814bc0000e9e086ce48e90defb6670c3df262ad0a97aec7291c25447c106a99893e10db21901eb397b2f5fd71d20fa7a050fbbef9e326ea27e513e96068fd1e8a43e89f9c85c822a961546ed5363c17ff1432d08806bc376e3e49ee52b59d13182e1f24ed200ada12f7a1525320e716660000000000b02b001500a710eb1affb87ba55b2d72078e9f40b4ae7d01000000d11cd22c35d3294000000000000000000000000000000000000000000000000000000000000000000000000c52f4ebd2c893bb97a068bd10738d3c9f7a98eccb26f7e2df3ad37b729ac83b0dcb4f48f3c3356b9997fc455a17690b6f7f9ccbe4b1701941b18a904c0e585a66c3b84b138efc20a546d3d5227e23b03f2a834391ad24fe977076ce7d9b20cf92cb151763d41f5c76e2ff3e93ee296c4082ee73e7e197253a2b66c353312c9d75711ce1623e9c54bdff59d1a69dcb7d84c235b23a4480c2461b405cfd1a38992f295ad3adc94cd07c850d1c77a211bfa02c24e9280333152fb794e4ddea02017a6c139b50101caecaf2abc084075ad10727522934a87a4ddcdb112754ca5bdec0ead14b6c0f19a4b126bbe0c2b8c9ff68236c8600000000000000000000000066e034c81c3cab4e33fc8dc55ce0ada18dcb1a47a87baf63e4edf11c6e82893add3bee3e10fc873d1d922b0877cbcd95b839d3059d5140a1f742f6e75741e39e5cb6a193e06a1043375b0f61b5d4e17c81baa31b924d84f2243471221c158ae8f44bfbfa7c2730302b66a99f66705b71e6205e7cbf36435e1eabb9a63fcd604d5cc27e1317ad94cf438d7187a2fe4e06fa6cbf84ef1efa82cb2c4af6bd1370616cdbe2b98fd89b79824ba089df1f81e6fcef073059f5f1d6a221d791839d7826ed1759c2153532c393fd1bd7be2e7f5abf2f0800000000ea46c07adee10d0f2bc85cf37182256e4fd8f56942726efc07180eaa5421d697665c8bacd39cdb392e6153af80bc1a69e3bfab032e78c9a96eab13be845a0d44ef2a4ab414ac2e4802a3b5d3aa2a4a4fc259206d97d0cc1602d6b45ff414c53fc9f5f68438f0423e168a97923ca0464b40b2f797841fb2bb2e5ad9feff37220ab7c34f4c382c247e7735adb55c209f7c0f8880733dbd3f5a095cc6a2"], &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x6}, 0x70) r8 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000080)='sched_switch\x00', r7}, 0x10) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000140)={r8, 0x0, 0x0}, 0x10) r9 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r10 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r10, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="0100", @ANYRES32, @ANYBLOB="08001b0000000000"], 0x34}, 0x1, 0x0, 0x0, 0x20048054}, 0x0) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8b04, &(0x7f0000000200)={'wlan1\x00'}) bind$inet(0xffffffffffffffff, &(0x7f0000000100)={0x2, 0x4e23, @remote}, 0x10) sendmsg$NLBL_UNLABEL_C_STATICADDDEF(r9, &(0x7f0000000280)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000240)={&(0x7f00000006c0)=ANY=[@ANYBLOB="28000000b13737ede8ee6a41255701b9b039af10ac96c27337adb87140766841ecafd416ba1f14934c2d3cb272b3570c9d49f589ef69df06000000e33b1d453828bbcf8545e8bfded131bd68767e048b319b8a3f72fd7b287004ad", @ANYRES16=0x0, @ANYBLOB="00042bbd7000fedbdf250600000014000600726f73653000"/34], 0x28}, 0x1, 0x0, 0x0, 0x20004000}, 0x1) close(0x4) 17.763689787s ago: executing program 1 (id=1362): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x3, 0x0, 0x0, {0x7}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x40, 0x9, 0xa, 0x401, 0x0, 0x0, {0x7}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz0\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0xd}, @NFTA_SET_EXPRESSIONS={0x4}]}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x0, 0x84}}}, 0x88}}, 0x0) (async) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x3, 0x0, 0x0, {0x7}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x40, 0x9, 0xa, 0x401, 0x0, 0x0, {0x7}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz0\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0xd}, @NFTA_SET_EXPRESSIONS={0x4}]}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x0, 0x84}}}, 0x88}}, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000001480)) (async) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000340)={'bridge_slave_0\x00'}) (async) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000340)={'bridge_slave_0\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=@bridge_dellink={0x2c, 0x13, 0x1, 0x0, 0xffffffff, {0x7, 0x0, 0x0, r4, 0x8400, 0x40000}, [@IFLA_AF_SPEC={0xc, 0x1a, 0x0, 0x1, [@AF_INET={0x8, 0x4, 0x0, 0x1, {0x4, 0x5}}]}]}, 0x2c}, 0x1, 0x0, 0x0, 0x80}, 0x0) ioctl$EXT4_IOC_SETFSUUID(r2, 0x4008662c, &(0x7f0000000100)={0x0, 0x0, "d24898409ae0d149cdf047577a6f476a"}) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000013c0)={0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', r4}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={0x0, r5}, 0x18) mmap(&(0x7f0000200000/0x4000)=nil, 0x4000, 0x4, 0x200000006c832, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x3, 0x200000005c832, 0xffffffffffffffff, 0x0) 17.659237778s ago: executing program 1 (id=1365): r0 = bpf$TOKEN_CREATE(0x24, &(0x7f0000000100), 0x8) r1 = socket$vsock_stream(0x28, 0x1, 0x0) bind$vsock_stream(r1, &(0x7f0000000440), 0x10) listen(r1, 0x5) r2 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r2, &(0x7f0000000100)={0x28, 0x0, 0x0, @local}, 0x10) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000080)={'pimreg0\x00', 0x7c2}) r4 = socket(0x2b, 0x1, 0x0) listen(r4, 0x0) setsockopt$sock_timeval(r4, 0x1, 0x14, &(0x7f0000454ff0)={0x0, 0x2710}, 0x10) accept4$nfc_llcp(r4, 0x0, 0x0, 0x0) ioctl$TUNATTACHFILTER(r3, 0x401054d5, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x4, 0x7}]}) openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0xa8001, 0x0) ioctl$TUNSETQUEUE(r3, 0x400454d9, &(0x7f00000000c0)={'veth0_to_batadv\x00', 0x400}) ioctl$TUNSETQUEUE(r3, 0x400454d9, &(0x7f0000000140)={'veth0_macvtap\x00', 0x200}) r5 = accept4$unix(r1, 0x0, 0x0, 0x0) sendto$packet(r2, &(0x7f0000000600)="5f0efc3e1792a50972d2eb21bdff9ca4ac804c2847689e7fd3f3fe7bf05ddc63ff512d4074687760a5fbd1fc97777a6e55123f04cc8437b15f4b2c6f5027dcea15b6658d", 0xffffff3d, 0x0, 0x0, 0xffffffffffffff10) recvmsg(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)=[{&(0x7f0000000300)=""/74, 0xffffff78}], 0x1}, 0x10012) ioctl$SIOCAX25ADDFWD(0xffffffffffffffff, 0x89ea, &(0x7f0000000200)={@default, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}}) pwrite64(r0, &(0x7f00000002c0)="7a492ed1588467f805b124ac47f34bce34fe6825cfb873116513591824211f2a800bd60a52fb41310a8fcd5a95cf4052aa0843bc5f70bfe33ef6abb983335afd4bc29a6ff7a8c32dc674e3195e913646bda3df89c8e87564b415d514b6c58b630ec8071ad75edaf45ca9eee4d1d98b0eeffc807241b14746c0dd46a3149036f761471dcd202dc02c5d4fda4cd2732240d6a5f493cc02af876dfbb137ca09ea48edf1dfdbc4c5774cc6b1670b01a517eb5e343bbcb8123971a90eb8befd69a806982090166fd6eca4bda9bb00597d677c6c70c24896896c3490b1a09afc83036aba75700169ea9b18236f732d5952221f0cfa35c5f4786c91cd", 0xf9, 0x80000001) r6 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r6, 0x4000000000000, 0x40, &(0x7f0000000a00)=@raw={'raw\x00', 0xc08, 0x3, 0x438, 0x0, 0x5002004a, 0xb, 0x310, 0xea13, 0x3a0, 0x3c8, 0x3c8, 0x3a0, 0x3c8, 0x3, 0x0, {[{{@ip={@multicast2, @private=0xa010101, 0xff, 0xffffffff, 'bridge0\x00', 'veth0_macvtap\x00', {}, {0xff}, 0x5c, 0x3, 0x2}, 0x0, 0x2c8, 0x310, 0x0, {}, [@common=@unspec=@bpf1={{0x230}, @bytecode={0x0, 0x2, 0x0, [{}, {0x16}, {0x4}, {}, {}, {0x0, 0x0, 0x5e}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x6}, {0x0, 0x0, 0x4}, {}, {0x4, 0x8}, {}, {}, {0x1}, {0x0, 0x0, 0x0, 0x7f}, {0x0, 0x4}, {}, {0x0, 0x0, 0x0, 0x9}, {}, {0xfffc}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x4}, {}, {0x0, 0x0, 0x40}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x80}, {}, {}, {}, {}, {}, {0x0, 0x0, 0xfd}]}}, @common=@inet=@socket3={{0x28}}]}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0xffff, 0x0, 0x0, 0x0, 'pptp\x00'}}}, {{@uncond, 0x0, 0x70, 0x90}, @unspec=@TRACE={0x20}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x4}}}}, 0x498) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x18, 0x4, &(0x7f0000000080)=ANY=[], &(0x7f0000000040)='GPL\x00', 0x80000001, 0x0, 0x0, 0x0, 0x6c, '\x00', 0x0, 0x24}, 0x94) 17.658758727s ago: executing program 0 (id=1366): r0 = socket$l2tp(0x2, 0x2, 0x73) bind$inet(r0, &(0x7f00000002c0)={0x2, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x10) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @local}, 0x10) sendmmsg$inet(r0, &(0x7f0000000900)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x52}}], 0x1, 0x400c0c2) unshare(0x4000400) (async) unshare(0x4000400) r1 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r1, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/74, 0x328000, 0x1000}, 0x1c) (async) setsockopt$XDP_UMEM_REG(r1, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/74, 0x328000, 0x1000}, 0x1c) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e23, @broadcast}, 0x10) 17.651183917s ago: executing program 4 (id=1367): r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_opts(r0, 0x29, 0x36, 0x0, 0x8) setsockopt$inet6_int(r0, 0x29, 0x4b, &(0x7f0000000080)=0x1ff, 0x4) sendmmsg$inet6(r0, &(0x7f0000000fc0)=[{{&(0x7f0000000240)={0xa, 0x4e20, 0x1, @remote, 0x9}, 0x1c, 0x0, 0x0, &(0x7f00000011c0)=ANY=[@ANYBLOB="24000000000000002900000032000000ff050000000000000000120000000001", @ANYRES32=0x0, @ANYBLOB="0000000018"], 0x40, 0x7ffffff7}}], 0x1, 0x4881) 17.58992493s ago: executing program 4 (id=1368): r0 = socket$vsock_stream(0x28, 0x1, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="19000000040000000800000008"], 0x50) r2 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r2, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000000)="d8000000100081044e81f782db44b904021d080010000000e8fe55a1180015000600142603600e120500210007000401a8001600a400014020000300036010fab94dcf5c0461c1d67f6f94007134cf6ee08000a0e408e8d8ef52a98516277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775730d16a4683f5aeb4edbb57a5025ccca9e00360db70100000040fad95667e006dcdf63951f215ce3bb9ad809d5e1cace81ed0bffec", 0xbd}], 0x1}, 0x0) r3 = socket(0x10, 0x803, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000300)={'team_slave_1\x00', 0x0}) r6 = socket$l2tp(0x2, 0x2, 0x73) ioctl$sock_SIOCETHTOOL(r6, 0x8946, &(0x7f0000000480)={'veth1_to_bond\x00', &(0x7f0000000400)=@ethtool_coalesce={0xe, 0x8, 0x0, 0x9, 0x3, 0x7, 0x6, 0x18000000, 0x2, 0x9, 0x8, 0x4, 0x6e0, 0x4, 0x7, 0x5, 0x8000, 0x8, 0x743, 0x23, 0x4, 0x5, 0x10000}}) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r5, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xffe0, 0xffff}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x1}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000001100)={&(0x7f0000000640)=@newtfilter={0x48, 0x2c, 0xd2b, 0x70bd29, 0x35dfdbfb, {0x0, 0x0, 0x0, r5, {0xffe0}, {}, {0x7, 0xfff3}}, [@filter_kind_options=@f_matchall={{0xd}, {0x14, 0x2, [@TCA_MATCHALL_FLAGS={0x8, 0x3, 0x1}, @TCA_MATCHALL_CLASSID={0x8, 0x1, {0xe, 0xffe0}}]}}]}, 0x48}}, 0x24040084) socket$nl_netfilter(0x10, 0x3, 0xc) r7 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) r8 = bpf$MAP_CREATE(0x0, &(0x7f00000027c0)=ANY=[@ANYBLOB="040000000400000004000000050001"], 0x48) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000180)={r8, 0x58, &(0x7f0000000680)={0x0, 0x0}}, 0x10) r10 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f00000003c0)={r9, 0x0, 0x10}, 0xc) close(r10) recvmmsg(r7, &(0x7f000000a1c0)=[{{0x0, 0x0, 0x0}, 0x3}], 0x1, 0x8020, 0x0) sendmsg$802154_dgram(r7, &(0x7f000000b8c0)={&(0x7f000000b800)={0x24, @long={0x3, 0xffff, {0xaaaaaaaaaaaa0102}}}, 0x14, &(0x7f000000b880)={0x0}, 0x1, 0x0, 0x0, 0x20000011}, 0x0) r11 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r11, 0x29, 0x40, &(0x7f0000000f40)=@raw={'raw\x00', 0x8, 0x3, 0x478, 0x1c0, 0xffffffff, 0xffffffff, 0x1c0, 0xffffffff, 0x3a8, 0xffffffff, 0xffffffff, 0x3a8, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@remote, @loopback, [0xff, 0x0, 0xff, 0xff], [0xffffffff, 0xff, 0xff], 'team_slave_0\x00', 'netdevsim0\x00', {}, {0xff}, 0x29, 0x3, 0x0, 0x60}, 0x0, 0x1a0, 0x1c0, 0x60030000, {0x0, 0xff000000}, [@common=@inet=@recent0={{0xf8}, {0x9, 0x2, 0x24, 0x0, 'syz0\x00'}}]}, @unspec=@TRACE={0x20}}, {{@uncond, 0x0, 0x1c8, 0x1e8, 0x0, {}, [@common=@inet=@recent0={{0xf8}, {0x0, 0x0, 0x1, 0x1, 'syz0\x00', 0xfe}}, @common=@mh={{0x28}, {"b11c", 0x1}}]}, @unspec=@NOTRACK={0x20}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x4d8) sendmsg$netlink(r3, 0x0, 0x4000841) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="180000000000000000000000000001b518110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r12 = bpf$OBJ_GET_PROG(0x7, &(0x7f0000000380)=@generic={&(0x7f0000000300)='./file0\x00', 0x0, 0x8}, 0x18) r13 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) ioctl$FS_IOC_GETFSLABEL(r13, 0x800452d3, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000200)={{r1}, &(0x7f00000002c0), &(0x7f00000003c0)=r12}, 0x20) connect$vsock_stream(r0, &(0x7f0000000140)={0x28, 0x0, 0x0, @my=0x1}, 0x10) r14 = bpf$PROG_LOAD(0x5, &(0x7f0000000580)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2b, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000340)={&(0x7f0000000400)='virtio_transport_alloc_pkt\x00', r14}, 0x18) 17.503853927s ago: executing program 0 (id=1370): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000240)={0x26, 'hash\x00', 0x0, 0x0, 'sm3\x00'}, 0x58) r1 = accept4(r0, 0x0, 0x0, 0x0) sendmsg$xdp(r1, &(0x7f0000000980)={0x0, 0x0, &(0x7f00000008c0)=[{0x0}, {&(0x7f0000000680), 0xfc3f}, {&(0x7f0000000180)="f689c52faf3dff8a0a010e5ad621dbd20e3fe2baf5686a720dfbbd4a85151aad1bcfdbbbee953e6c9487c995de9130e12540469a9dec0c5e94245cf1851605edd0fc4b78878f71ce04012ab5a87b5e292f53ee4ad2fef90d472031dd73f72b830bb43ce8015b5e7af0466f828f38279c1fa8978085a51cbfb1aebe31401955fd1bd425e4f3e396610d198f12da72063f420099a462cf", 0x96}, {&(0x7f0000000780)}, {&(0x7f00000007c0)="4bbb2000f12c3a5dd8c2711c3ecf2f16e7670c2d164ed42aab88586a75d8d755d4408fd4d1547f922c4eea8b81d0408756bb2bd4e8d4ca6e503d2f0bb1e1f8283b9313ebdbd6494f6afb58427cc9a6b3331c81d8ac3cd679530970ce7bfbc529170a55a1edf67f2750a4e7e6e81164ba4befe5f8d988f80c83a8295ee37d0d88aedd585ce8193df46df33df4547215318c341626284ec36118a02c4b893fdd3206972af2824305ef6522df3151b67286724fa19b25fcc245bd96467fc10b2815ca80c387e44ca0d0f3d87355508d521e0473b76d2e589e462bc801ac74700477d3715e6ac68efdadd234f467", 0xec}], 0x5, 0x0, 0x0, 0x81}, 0x4008060) r2 = socket$tipc(0x1e, 0x2, 0x0) accept4(r2, 0x0, &(0x7f0000000000), 0x80800) 17.481625546s ago: executing program 0 (id=1371): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000000c0)={'dvmrp0\x00'}) unshare(0x64000600) gettid() r1 = socket(0x1a, 0xa, 0xd) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) setsockopt$inet6_MCAST_JOIN_GROUP(0xffffffffffffffff, 0x29, 0x2a, &(0x7f0000fca000)={0x5, {{0xa, 0x0, 0x0, @mcast1}}}, 0x88) unshare(0x10000080) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={0x0}}, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r3) socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r3, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @mcast2}, 0x1c) listen(r1, 0xffbffffc) r4 = socket$inet_mptcp(0x2, 0x1, 0x106) r5 = socket$nl_route(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) r6 = socket(0x11, 0x3, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_team(r7, 0x8933, &(0x7f0000000000)={'team0\x00', 0x0}) r9 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r9, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=ANY=[@ANYRESDEC=r5], 0x28}}, 0x0) bind$packet(r6, &(0x7f00000001c0)={0x11, 0x0, r8, 0x1, 0x2, 0x6, @random="972122308aee"}, 0x14) r10 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r10, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f00000002c0)="2e00000010008188040f80ec59acbc0413010048100000005e140602000000000e000a000f00000002800000121f", 0x2e}], 0x1}, 0x0) connect$inet(r4, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) socket$nl_generic(0x10, 0x3, 0x10) r11 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r6, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000040)=ANY=[@ANYBLOB="28000000349db76a98cb71e0", @ANYRES16=r11, @ANYBLOB="010000000000000000000100000014000180060001000200000008000300ac1414aa"], 0x28}}, 0x40008d1) 17.399348299s ago: executing program 3 (id=1372): r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000001680)={&(0x7f0000000000)=@newtaction={0x6c, 0x30, 0x53b, 0x0, 0x0, {}, [{0x58, 0x1, [@m_simple={0x54, 0x1, 0x0, 0x0, {{0xb}, {0x28, 0x2, 0x0, 0x1, [@TCA_DEF_DATA={0xb, 0x3, 'simple\x00'}, @TCA_DEF_PARMS={0x18, 0x2, {0x9f}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc}}}]}]}, 0x6c}, 0x1, 0x0, 0x0, 0x4060040}, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r1, &(0x7f0000000880)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000280)=ANY=[@ANYBLOB="1c0000005e00010000000000fddbdf2508000000010000000b"], 0x1c}], 0x1}, 0x0) recvmmsg$unix(0xffffffffffffffff, &(0x7f00000048c0)=[{{&(0x7f0000000080), 0x6e, &(0x7f00000001c0)=[{&(0x7f0000000140)=""/76, 0x4c}], 0x1, &(0x7f0000000200)=[@cred={{0x1c}}, @rights={{0x34, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x58}}, {{&(0x7f0000000280)=@abs, 0x6e, &(0x7f00000047c0)=[{&(0x7f0000000300)=""/197, 0xc5}, {&(0x7f0000000400)=""/206, 0xce}, {&(0x7f0000000500)=""/238, 0xee}, {&(0x7f0000000600)=""/34, 0x22}, {&(0x7f0000000640)=""/11, 0xb}, {&(0x7f0000000680)=""/4096, 0x1000}, {&(0x7f00000016c0)=""/4096, 0x1000}, {&(0x7f00000026c0)=""/4096, 0x1000}, {&(0x7f00000036c0)=""/4096, 0x1000}, {&(0x7f00000046c0)=""/230, 0xe6}], 0xa, &(0x7f0000004880)=[@cred={{0x1c}}, @cred={{0x1c}}], 0x40}}], 0x2, 0x0, &(0x7f0000004980)) sendto$inet6(r0, &(0x7f0000000000)='s', 0x10a73, 0x800, 0x0, 0x4b6ae4f95a5de35b) 17.239483516s ago: executing program 3 (id=1373): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000080)=ANY=[@ANYBLOB="6000000010000108fdfffffffddbdf2500000000", @ANYRES32=r0, @ANYBLOB="000000042104020008001b000000000038001a8004002d000a80"], 0x60}, 0x1, 0x0, 0x0, 0x4040080}, 0x0) r2 = socket$inet_sctp(0x2, 0x5, 0x84) r3 = socket$inet_sctp(0x2, 0x5, 0x84) close(r3) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_LOCAL_AUTH_CHUNKS(r4, 0x84, 0x1b, &(0x7f0000000000)={0x0, 0x33, "b89e47139d3f74b6497ae8eb4bfd9cd9fb1540ad73d86f2d0dee78814a027766b0148d51c5f70ef1dd7ac60a0450e7dd481e7c"}, &(0x7f0000000280)=0x3b) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r4, 0x29, 0x20, &(0x7f0000000380)={@remote, 0x9, 0x2, 0x3, 0x3, 0x201, 0x49}, 0x20) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r4, 0x84, 0x6f, &(0x7f0000000300)={r5, 0x2c, &(0x7f0000000040)=[@in6={0xa, 0x4e20, 0xffaf, @mcast1, 0x5234}, @in={0x2, 0x4e22, @loopback}]}, &(0x7f0000000080)=0x10) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r4, 0x84, 0x1d, &(0x7f0000000140)={0x1, [0x0]}, &(0x7f0000000240)=0x8) sendmsg$inet_sctp(r3, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f00000001c0)='F', 0x1}, {0x0, 0xe0}], 0x2, &(0x7f00000000c0)=ANY=[@ANYBLOB="200000000000000084000000020000000a00476e24ee040028000000", @ANYRES32=r6], 0x20, 0x2400e044}, 0x0) r7 = socket$inet_udplite(0x2, 0x2, 0x88) r8 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x1e, 0x4, 0x0, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x94) r9 = socket$inet(0x2, 0x3, 0x2) r10 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000340), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r9, 0x8933, &(0x7f00000002c0)={'wlan0\x00'}) r11 = socket$alg(0x26, 0x5, 0x0) bind$alg(r11, &(0x7f0000000080)={0x26, 'skcipher\x00', 0x0, 0x0, 'cts(cbc(aes))\x00'}, 0x58) setsockopt$ALG_SET_KEY(r11, 0x117, 0x1, &(0x7f0000c18000)="ff07b6c5910faee30bef915d564c90c20000000000000000", 0x18) r12 = accept4(r11, 0x0, 0x0, 0x0) r13 = socket$nl_generic(0x10, 0x3, 0x10) r14 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000040), r13) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000080)={0xffffffffffffffff, &(0x7f0000000040)}, 0x20) r15 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f00000006c0)={0x0, 0x0, 0x8}, 0xc) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000800)={0x56320017856b356b, 0x11, &(0x7f0000000500)=ANY=[@ANYBLOB="1800000000000000000000000700000018110000", @ANYRES32=r12, @ANYBLOB="0000000000000000b702000014000000b70300000000000085000000835509010000000000950000000000000018000000ffffff7f0000000001000080bf91000000000000b7020000000000008500000085000000b7000000000000009500000000000000"], &(0x7f00000003c0)='syzkaller\x00', 0x9f, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x9, &(0x7f0000000700)=[r8, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r15], &(0x7f0000000740)=[{0x4, 0x5, 0x7, 0x9}, {0x2, 0x2, 0x0, 0x6}, {0x1, 0x1, 0xb, 0x1}, {0x3, 0x5, 0x6, 0xc}, {0x4, 0x1, 0xc, 0x8}, {0x5, 0x2, 0xe, 0x6}, {0x5, 0x3, 0x10, 0x7}, {0x3, 0x4, 0xd, 0x3}, {0x1, 0x3, 0x0, 0x8}], 0x10, 0x1000}, 0x94) sendmsg$MPTCP_PM_CMD_SET_LIMITS(r13, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="14000011d80fc36daecbd400a419215f7098d09fa1fc010000007e57099d7bd12cfe973edb3d3013ee2855951974a5", @ANYRES16=r14, @ANYBLOB="01002abd7000fcdbdf2505000000"], 0x14}, 0x1, 0x0, 0x0, 0x11}, 0x200080d0) sendmsg$NL80211_CMD_TRIGGER_SCAN(r10, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000005fc0)={&(0x7f00000004c0)=ANY=[@ANYRES64=r1, @ANYRES16=r2, @ANYBLOB="01002dbd0600ffdbdb252100000008000300", @ANYRES32=r11, @ANYRES16=r13], 0x44}, 0x1, 0x0, 0x0, 0x4048861}, 0x20000) getsockopt$inet_udp_int(r7, 0x11, 0x1, &(0x7f0000000100), &(0x7f0000000180)=0x4) syz_init_net_socket$nfc_raw(0x27, 0x3, 0x0) 17.137958964s ago: executing program 3 (id=1374): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nbd(&(0x7f0000002600), 0xffffffffffffffff) sendmsg$NBD_CMD_CONNECT(r1, &(0x7f00000027c0)={0x0, 0x0, &(0x7f0000002780)={&(0x7f0000000300)={0x3c, r2, 0x1, 0x70bd29, 0x25dfdbfb, {}, [@NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x4}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, {0x8}}, {0xc, 0x1, 0x0, 0x1, {0x8}}]}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4000004}, 0x4000) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=@newlink={0xb4, 0x12, 0xff05, 0x40000, 0x4, {0x0, 0x0, 0x4a00, 0x0, 0x5, 0x2000}, [@IFLA_LINKINFO={0x2c, 0x12, 0x0, 0x1, @ipip={{0xffffffffffffff48}, {0x1c, 0x2, 0x0, 0x1, [@IFLA_IPTUN_ENCAP_DPORT={0x6, 0x12, 0x4e22}, @IFLA_IPTUN_REMOTE={0x8, 0x3, @loopback}, @IFLA_IPTUN_TTL={0x5, 0x4, 0xff}]}}}, @IFLA_PROP_LIST={0x68, 0x34, 0x0, 0x1, [{0x14, 0x35, 'wg0\x00'}, {0x14, 0x35, 'ip6gre0\x00'}, {0x14, 0x35, 'vlan1\x00'}, {0x14, 0x35, 'veth0_to_team\x00'}, {0x14, 0x35, 'vlan1\x00'}]}]}, 0xb4}}, 0x0) 17.128758066s ago: executing program 3 (id=1375): socket$inet6(0xa, 0x80002, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="fc0000001900674c0000000000000000e0000001000000000000000000000000e000000200000000000000000000000000000000000000000a00000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000000000000000000000000400000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000000000044000500000000000000000000000000000000000000000033"], 0xfc}}, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000000000)={@local, @broadcast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0xb, 0x0, 0x0, 0x3, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x0, 0xfffe, 0x0, 0x0, 0x2f, 0x0, @broadcast=0xac14140a, @multicast1}}}}}}, 0x0) r1 = socket$kcm(0xa, 0x2, 0x73) sendmsg$inet(r1, &(0x7f0000001180)={&(0x7f0000000000)={0xa, 0x0, @empty}, 0xffac, &(0x7f0000001080)=[{&(0x7f0000000040)="a72d11a15c048c0a7d63aebc5cea1f81510ff6091475aeec600831aa9d3944e60bc2ad06a619c560aa0118b28f68f1eb14549d633b4b23f179fb680716faa43414787559be90843c35ab30acad8a6740140e00721abc2eb362f7bde53b3c992d3e28ccc20ec84fdc569947047f6c09a647ee8c0a747b951e66c068ccf1af93ee9e6f9528ff79e2f989383b05a690a6bec4634b867c9446c1c644b3010e8a3514c6328323b4bbdd602b8f0dace6aea70902c4ddd2a2f2810f1348b0d0df3c1e6a5938fcfdc87e7580c6be0c6a06eca62d6f787dd16add086a21391c4c707d8b61929d1252681b84c245e0efafe2e6e73ad86a3cf59235ab0eacbb414af92ec3cdac420a064a98e8cc18bdf63f8997f96436e0fe6f06fdbf47fff353b01a861babd4a38d126bfe3e29049e6cc883e6efae6e70ef9ed124b1b09887a58c991e223b6420dca5ae238027e91b17b1707dc5c0d5f59f0ca95614f1ea1d263c1ee54dfe31ae35eb3c8e3b931dff7920c57fbba89adf2e392c1ad719b90c7ade0d38ff9792934ef1fb12f51d8e2fad12486d5883d5b1a46696fad128c6805cfb25bc6487e1e407d6b266971b09d0d864a7a550284e24b6cdc9f4ae1081a638175dffef002c76ac5558d23e41edbe68f4b4950a13aa000326dae5a857603dc5a40d6c6618a98c7b6e1eebd325ea2c14601a25658965f40864fd015d9b2fff83ee5ed3212ebd9fa429f0140f633556ac07c0c08e67a1848c9942ecc47dd4ffede9a429e9e0472be7cdbcd117e621ddf745c00a814ffff0224634472577dc0b35a9c153409f1a2bddc193b20b4d244d9cbbd59816c46000c596865f58b4e640ed4a9ab6086cede697fb113560925498da83273e679e0e28b84961eb7b9c9b4fa916590965c76b48e5d453f27a821bd2bf0946ff2413ec30f7893d1f046e18f736c40ceda26dfc4a0a62f71a3606d3f72c0a858dfd7895e2572292e11af913c6b513a141d28e501ae7c49618d104aac9abb78466a636efb88120d0eef0a501558a5aa34784a9823f2802a0bcdf318f9b436b34b42a2a7cf513f80364ad9a699d2e23eb4f3a2bbce818bd20da61882b3dac699d05dc24f29b72471b712423ace6278c43df2be7a09e815517b86d8b3ce16af3d64a575958c5fd52aac53b391f3d2a67c24c6c13ec11428b61b80a6a58cbba1790a98d190a572070f63fc0b809669895ea9865c3066b06102f6f2c7171dc7f76e1931b3e4deb569ef9d07d5f86a848f50942e93c419c3a23489f14803b08182dfd48b8d4375be6b7f805a21209c05e5927693a8834c8d5a5acbd47ed8a30a8a741d1ad77639b56b3b90c0b2023fa334befd28b2e27cbcd94b0ce7437f88ce67a925cea6d6d7e5313de6d328b1124a8b9ef83fe39ca3da97d33c60b7fd4af67d3c8fccb595a27a5bffc71e5a5b2ec966828993b0c0f83cbc55f9a7fb66a4101d5c83b77885072b6e2b2ceebe32f635509698c05089b9ff1cb1959b211e114dadb224ef2d5e7a3c55b3ac00fcdc9018577603c6301e5d4341b3d7eeb2665349d448d28d5d108f576408cbe533a6adbba18ebb2d84bb9af81108506a2f50fb56d595579000747930449fdf4ed01715ec624a0cb73636a35b9136f10b79e3d7ded09008b92e92c64e26e6b6d17f18b70b1d9813de8d2ff151c7a6a0452c660a57c33f13e2d9b88fa5f5c0505722d2e787a425e4a3e9b5efa9668e9199f5fb9fe7d5b8a57719a57df152e7f2c6a1087a2a24084f82455b65353a70559f04d5ed12defb81497ea69c1c7e69c373524770b7473c16a69c7a3648a9dd93377b89cdff61cf62512d1ee67a55ea67993937c1f55a2179bc9c8a337364cfb84d295adda1ad9700fc2f5c11cbfc1b90affb4666c6e7e23a6f7751410a5651819f29f690c6dba2b8a67e0f7f8cc377feb1854c393578994c85391ba21b3961aed477f771645571dc7d6cae72bf79c82a92a4edc3742b1398060a0a5c9e81c016b7f2ae3db529c6ff824cc28678764d8ab49d7dc68e5b0556c9e7ffb6fef442776d86fbd458741830e57f22a1f8513b92abd5b2df93a67cc560134078f0b8ecc3276e40aadef5cd579888b86b4988f396679250701f3869e7493b33692035ecd94aca5189fd0a0893ccc5bb19c0b4caca86cf90ebc2a5558f39cccb33f6773a4e425bf551fb3b6456ee1cc62fa1843a9e5539bb2d02ae6ef82533a9dbcfb562c1ab18c1f639ae7ff02083746f74a15ba2d10e4b955940a5d6f488d326a99f287c48ad463ce40367aeeff519cbad0a2d7fdbfa48bff75955467977764c2be2bd2ffa18396c46920c40c50a4037003666406d177e2cd20aee423d07169d8f611f635ba0b62b61265ff2c5548446a2423dd1038482b6852b2d9d2f90aa05d82c5e2c3d1af0c7aad72d82b3da67471af7b037bb0424a785e73f35b5a10a2ab300a195c20cd119a5390e0cd5d49c70bd80883b933e843d0d2902749dcf3c140c708a0f004b7a2f50bf311305dc01719016fcce5863815ca7951de710fcb71cd177551ff6fcd9f8bf01b93868f24c6129b6d7917125338cf62110083093fc7f862015d48450d992f2bb43e601cab19b2ea7b83962a382fc2a31fdf2358bf8a9a9e506eaa7b6eb5e7444d1ef459b24ffa51362abce902dfd84201a0e4b5a3b62757aad54fb65b83821c6bba663886de092065a565921ea3eb6781bb8ed4f4db3abcfeeb379b7e52fca790bea719918e299ab01bf5e92177d134360bf7a16a59e9d03d3dcfb0a25599237e3d41b3f0026c9402b1fb1894426303413a2cbcf7c72807ca694afa285990d07c3bca26413c9947b3b344aafc04544b8c11416e0312b028da7302e316c3966d41884b15055a49a4a0b3eac8e11f88a5615fb0af582f065d28e5a454447e9d0cfc60356439ebf7e1d0a00f5b9cc6daf2bd7195ba96b4d1a0679ff0fb1c01282c378a880f90f460889b67d76d4d0e8db6c928d113533d1d10b810303c43d8ff622c5bab7f095b96e64bf9daa48a2bdf3d9d40bac00cf1b66df61a4f7c3e21938e876f81b1179dce6a008f28eb682cae690ced0ea0d542da604d8056f2b1813ed36683c4c51aeb2650772cfb1c55d4e60604ff06344cfc271b2175a6c94defb807af240b483e24298ca73bfc743ca2ca2e77e6d5b817b3c1986601537faf59ac84c74d8bd0c068cb8e6bd03ac2dcf5793fb4a00b3c901a33aa3ee86e4f0db317b94bb8678ab26e36d305ebac4b0f7f164947148255b562dd0f87648499d45bccfb7d8c9d5624cadf8160a396e79fbcdc100058ba4606e41c02fb2cc0dc6c36196bd28acfde82a18cda2321d2d83fecd3b85380667cd1d0bc68298c6c8f10421a80c8fa86912b6c3e8ddd9d9668520d5151409e6b77f0d7730b374a68a744151bfbd123cfdf871e8c24e70d2ca3b50e84a48e0b78c1781000cfc848d43584985763a76c0ab9ba882c55e3e4aa8f2174255db38adb8350b48a77be22a869d13d183325f859b883464e5e46de5ea8a92532b9a794daaeff657cd361f7f158f8bebe36e9de1f5b9721d4263dcc9472229bc02d3f552180abfb25ca7aa36cb914d99c09fd5bb99dcab9b4e3c634d18fc7dfe84dc4425ad1e39c3e7410d49b4ea0a8a2958688c7725822f6dfc0827d19dc385e0e35a949941e4dd1aaeaab9ebe402f8c584bca7efc829f2ccfb63fd7bde1c182a67c14f9d3f033ca674e2604e89cd55a15419f956cd61a755c1b13554dae98e77be078aadfc131c9677381f1dbe6ef194eb17603a463e8b844ab46a6046e1f07d96d66de669359bff4c3d80948a4de3abb2f171a09b5d8999c379fb62244114e218c79805df7d899e5661320ee6721d652b95f09e4dfe69bd67099c73294b17ab574e0b966aa3ab44478965b9dca3cb3b9282945f24ccdd07c638ae25a84a728ca24f87ff49d718121a694be46f3616e27b1041b3c6cd24b9cf775bfc28dfbe0a009048f0599f2d5d6586cfd1e7f7fe69872d08b98f60d28e6af0d49d7f06ad71a7b5c41df261aba5de114022c7288bc265cc17909fdeadc3d7b256d7ab3b96e40f857060f16b54a6bb7248ee571f87ace5ee39eab412706cf52fa711468b21ea129c3f44bceb429fcc1a0ac2aa87b9365077dcfcfa9a1b32a0a09699197c20019a66cbd0a897feab3706c23123b888ada643d4560082033e31596b0483578968e3c9593ebd97141c228a42fc7645f92171c120aabca36657683fd7c72fcb87217f124d6fabc52f1d221d8410b47b0ad4bd944bf4085365e9b52a53911ab4ee142c5a1ebbe034c9d98c538c066f2dc0acf372eb2397dcac765055123e0ba19be22b18c886bf0f7490abe9fde91ffa62e059962bd134be8501cb5b715a744b1398e2c4c7e8afe72e189dda0654296afa1c1f99ab7d800fa40f72a758625c833b6fc7b7d42250522b456e1e7de815350c36c9cb2f4d1c9cb99109f89b456c559463f11b8b58247809b17a4ed4912bd0a47a529f1364d6dc593ea7f3eb98962078ac90e5012ee1c7b4b9ed5a8c7a9c0231b4ce425693faab64fa0f3482a04d4be2e06ee5d103694d288810a1a7f4d1e908dd82dd2016a064ece5cd67ef1dd5f4cda728fc6f1ccdd949dd8f775d862621507248ef4c83ae274969d19c7ddb02a4e8a1ab2b7aa539a442b22735ceedeefe60a1059dfaaa0979ce8d5387b5a047841fd9749b88ca91216b02d7926408a01916b7781bb7167528ccdb9a486d173437a5ba3e552c8674dff2cc9b21054e0e4f86b61b8723fca58ceef4413bffae9e9be79c5b9788f5449811ce78be9bc7a86375a670197baaef751beabcba0aa6c7c33f1cd702cb78ec39fa1f17d9da733d6abf2b80f9c51ac8f6f664b24edc53a7c9525c3016bd05c67272375fe816b2b121f2de68b885a0fd8f8b8c6c342237b632f6414a3eb3480f5f42106c5812e9bfd4e8c8dea8d08525d9aa1da7c7c2ee7ff3d31b79b211dd01e304a8ffc83a89a59f3b1e2ef5e969b6d90bea7e161066f25622fad914bff52bacd2807093dda1838b529ee57f718b374ce2841b924a42457867547a6edcb8412d85f11796742bf640b5819a9546357df778c332af5983c4373a95d9c58b52dba445eee92e6911824f0c534e7a5934d9eac9b7f6fec22002fc53a3003a3304217f567b47cd326edc5f48eb1f46bb20d1e10e72239afc9769344590cf48902aba5405b7d4baa31a912ab398a2f2d3f037614bb56a89244ece50f3a1e058d274f1e70f944eb8a305be91e561e5eb843d057a81f4deb84a6335ec81ca964cdae5f318d4e9aaea2c477cc279c00c698bcfe4b8e04c09079d8f3f5438d9d45a00f50d2f9b245c8c68eebf247e25ba8d26f8b95b21ac9ceb50c0aa2e4bdc032024db216b92f9350a90ac79341af14d3fa8ba908096e1b503341aed667bb184c672dac85fc4f335b3871c3b4e55ea219a857d2d2e135358f6b45a20b3e7de8e09b2041eb7c5084a80258fb524a983752659298a251e178b56f96bc67ae0a78ec92f92d92c9cf0edb5dcb11e739d69410ad44c8df00caa030d7d89f2ec38bd7698115c423cf3e6048793aca08ffbcdac766f1553773fa00031c1d75246e4e1eddf8948d02a3de6d67fd7329e45070f29044587f1e0db50d04e673191a63e30f96ee0d8d52738fab36a7fe2c6ab9301d401e7ca5b1f039193a580e40abbdf40c2d7e27809dec80815d37adae9fe7fb9d3a974c9fc03944d7338d000b81170be4c6792ed6b3b827194b3ae11e2acfca48498d1126aacf80f3d574256ef7f75552ff087a819e", 0x1000}, {&(0x7f0000001040)="9d7fcf3efc63f4a6a555ba8b4726d7ccaf8a207100e69cfac4377876021d7131b838059f96bd206d4776368ed2a92432e5af71", 0x33}], 0x8, &(0x7f0000001d00)=ANY=[@ANYBLOB="140000000000000001000000250000000201000000000000480000000000000008fdff000797dbc64107b42c556567f2219787566400007300000000000000000000000008000000ef3820f3439cb150a3651e799ef4dca1e3c32158996e4b2abde5f2ba8b679121ac0b0ad62ade31fb2c47f0bbf781eb8bd1e3064141e90e9eac25b189c0da98b676571bbeefba392c3e15a10e03dee4ae1dfe99793e51ec0c6bb5fa6d7b357d249502f5919ef251e5d0e5bed378265b8bd55fde4689cb509b14fa754813a27e72d175e8d677420e10d65108006e2ab8168b1d633b1bb9a7d4d59ebdc7083d93d35cd469deb0d81d7adee2ef7c2f058c2c262b97ecbfb32fe3e3ffcdf7b5c24d0ab0a7ae9e6be6c115c5663dd864d655a7babdcf8315dc29b6f18539abf1422502d7d53ce861d8a07dbb00c5a94e0186689f988628a0986d8f0419924348a32be8950099b4718e6109b9eed9e5b3e8ff86d22cf39479b26cc3e977df19f757432bf055090461", @ANYRES32=0x0, @ANYBLOB="e1212f0409000000e70bcf35ac837225dd355ad309a5ec6096633ba38e1ef5baf006020e5f45c993cb5680017c6720bea9b7c451516a8cff7f00000000000019f20b784b2336d43c8a0f7347801a596dfb0b078a967980ccec1d115c7a0000000000000000000000fed6260fdf140498f1274bc569d0d87656d0d18d903580f0ec0915e89bd286b2c25165043f6a001d53f84eaabf01cc310ff28c7c76867ce1a2c9c91b1db7295614e2a4f8711ec37ae999180cb5bbb9c5382120076e117539d423a2ec0f468db35960831f5f883472327697495b8e8ba8e2f3defbe93e1fc733b06dfc74890a3f63b154e9681d69cdd9894c914ee45c286462888ff84e401a6d8895ffda88a171b7359f815d7b6f7562fba1bbff4cba08f7a3f582d7c604013317281c5e9a8e88b66a4717b3c318f85aecbe8b5f3485f8d31bf5a57b9dd53b382ec017a33d1fabe09daf76b3b0"], 0x6b}, 0x0) 17.099506252s ago: executing program 3 (id=1376): setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, &(0x7f0000000100)="7d1068", 0x3) r0 = socket$inet6(0xa, 0x3, 0x1) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000140)={{{@in6=@empty, @in=@multicast2, 0x0, 0x20, 0x0, 0x0, 0xa}, {0x1, 0x0, 0x20005, 0x8, 0x5, 0xfffffffffffffffa, 0x0, 0x5}, {0x5, 0xfffffffffffffffc, 0xffffffffffffffff}, 0xc24, 0x0, 0x1, 0x0, 0x0, 0x3}, {{@in=@empty, 0x0, 0x32}, 0x2, @in=@empty, 0x0, 0x4, 0x0, 0x0, 0x0, 0x101}}, 0xe8) connect$inet6(r0, &(0x7f0000000240)={0xa, 0x12, 0x0, @empty}, 0x1c) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a1d010000000000000000020000000900010073797a3000000000080002400000000098000000030a01020000000000000000020000000900010073797a30000000000900030073797a32000000006b00030091abc12404d0c4c731b168d80d1f7f1dbb33f596"], 0xfc}, 0x1, 0x0, 0x0, 0x40010}, 0x4000914) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0xfffffffffffffffe, 0x4031, 0xffffffffffffffff, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000740)={0x11, 0xc, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000000000000850000006d000000180100002020642500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000001000000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x10}, 0x94) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000001e80)=ANY=[@ANYBLOB="0b000000080000000c000000ffffffff01"], 0x48) close(0x3) bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x11, 0xd, &(0x7f0000000240)=ANY=[@ANYBLOB="18000000220000000000000000000000850000006d00000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000021007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008020010b704000000000000850000000100000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000500)={r2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) pipe(&(0x7f0000000300)) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18020000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb703000008000000b703000000000020850000007200000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x4, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$FS_IOC_GETFSLABEL(0xffffffffffffffff, 0x400452c8, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000080)='sched_switch\x00', r4}, 0x18) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x275a, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)={0x2, 0x0, 0x5, 0x2, 0x4, 0x0, 0x70bd2a, 0x25dfdbfd, [@sadb_ident={0x2, 0xa, 0x27, 0x0, 0x15}]}, 0x20}}, 0x10) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r5, &(0x7f0000000200), 0x806000) ioctl$FS_IOC_SETFLAGS(r5, 0x40086602, &(0x7f00000002c0)=0x2000000) getpid() mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x200000c, 0x3032, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) sendmsg$IPCTNL_MSG_CT_DELETE(0xffffffffffffffff, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) ppoll(0x0, 0x0, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, 0xffffffffffffffff, 0x0) 16.777542396s ago: executing program 1 (id=1377): bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0xe, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18090000000000000000000000000000850000006d0000001801000020696c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007000000095"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x6, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = socket$packet(0x11, 0x2, 0x300) syz_emit_ethernet(0x82, &(0x7f0000000340)=ANY=[@ANYBLOB="bbbbbbbbbbbbaaaaaaaaaa3081001f00001142aaa4e5f937e5fa280e9214a3dcaee7c361c8107dc2059813c0bf90a43a40ac181c1c9cfbd81e0ed834ebf0034c952efb10ee04b939500c00001979bf454a26813b96dbf92b77f3eab689acb571f6ba186e0ace88775fabf8012e78a32d5914eaa6cc9158cbbfd12e02488d2fb6173e79615392886bd377fec4df24a1f0ce"], &(0x7f0000000080)={0x1, 0x2, [0xb2e, 0xe6e, 0xbb3, 0xcbb]}) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000003c0)={0x3, 0xc, &(0x7f0000000000)=@framed={{0x18, 0x2, 0x0, 0x0, 0x5}, [@call={0x85, 0x0, 0x0, 0x29}, @printk={@lx, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xfffffffc}, {0x85, 0x0, 0x0, 0x73}}]}, &(0x7f0000000080)='GPL\x00', 0x2, 0x0, 0x0, 0x41100, 0x49, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x4}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r1, 0x0, 0xe, 0x0, &(0x7f0000000100)="e0b9547ed387dbe9abc89b6f5bec", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x50) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000001e80)=ANY=[@ANYBLOB="0b000000080000000c000000ffffffff01"], 0x48) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$IP6T_SO_GET_REVISION_TARGET(r3, 0x29, 0x45, 0x0, &(0x7f00000000c0)) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000080)={{r2, 0xffffffffffffffff}, &(0x7f0000000000), &(0x7f0000000040)}, 0x20) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000200)='kfree\x00', r5, 0x0, 0x10000001}, 0x18) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r6, &(0x7f0000000700)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="010300000000fbdbdf251c0000001800018014000200626f6e6430"], 0x2c}}, 0x40006) r8 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r8, 0x6, 0x16, 0x0, 0x0) r9 = socket$alg(0x26, 0x5, 0x0) r10 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000a40)={0x0, 0xf, &(0x7f00000004c0)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0xf, 0x0, 0x0, 0x0, 0x3}, {}, {}, [], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000640)='GPL\x00', 0xc298, 0x0, 0x0, 0x40f00, 0x64, '\x00', r11, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x81}, 0x94) bind$alg(r9, &(0x7f0000000180)={0x26, 'hash\x00', 0x0, 0x0, 'cryptd(sha3-256-generic)\x00'}, 0x58) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x16, 0xc, &(0x7f0000000140)=ANY=[@ANYRESDEC=r0, @ANYRES64=r0, @ANYBLOB="39e0ec4ec7b93661fe381a56c8b69bd53014ab"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, @flow_dissector=0x11, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r12 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_RES_CM_ID_GET(r12, &(0x7f0000000580)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x40, 0x140b, 0x100, 0x70bd2c, 0x25dfdbfe, "", [@RDMA_NLDEV_ATTR_RES_CM_IDN={0x8}, @RDMA_NLDEV_ATTR_RES_CM_IDN={0x8, 0x3f, 0x4}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x2}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8}]}, 0x40}, 0x1, 0x0, 0x0, 0x8000}, 0x800) r13 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r13, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=ANY=[@ANYBLOB="140000002e00090027bd70000000000004010000"], 0x14}, 0x1, 0x0, 0x0, 0x42804}, 0x0) 16.63148462s ago: executing program 4 (id=1378): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'generic-gcm-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000140)="2c385aa3d49100dc6626c892b6bc436a", 0x10) r1 = accept4(r0, 0x0, 0x0, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="160000000000000004000000ff"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005900000095"], 0x0}, 0x90) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000740)={&(0x7f0000000300)='sched_switch\x00', r3}, 0x10) bpf$MAP_CREATE(0x0, &(0x7f0000000380)=@base={0xa, 0x101, 0x7ffc, 0xcc}, 0x50) sendmsg$DEVLINK_CMD_SB_TC_POOL_BIND_SET(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000007c0)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="100029bd7000fcdbdf25180000000e0001006e657464657673696d0000000f0002006e657464657673696d300000080003000100000008000b000e00000006001600090000000500120001000000060011000080000008000b0001000000080001007063690011000200303030303a30303a31302e3000000000080003000300000008000b000000008006001600060000000500120001000000060011000900000008000b00070000000e0001006e657464657673696d0000000f0002006e657464657673696d300000080003000000000008000b000100000006001600080000000500120001000000060011000500000008000b00080000000e0001006e657464657673696d0000000f0002006e657464657673696d300000080003000300000008000b00ff00000006001600090000000500120001000000060011000200000008000b0001ffffff"], 0x150}, 0x1, 0x0, 0x0, 0x20000000}, 0x4084) r4 = socket$inet6_sctp(0xa, 0x1, 0x84) recvmmsg(r4, &(0x7f0000002180)=[{{0x0, 0x0, &(0x7f0000000780)=[{&(0x7f0000000500)=""/254, 0xfe}, {&(0x7f00000000c0)=""/50, 0x32}], 0x10000000000000e6}, 0x3f}], 0x1, 0x60, 0x0) sendmsg$IPCTNL_MSG_EXP_GET(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)={0x34, 0x1, 0x2, 0x101, 0x0, 0x0, {0x3, 0x0, 0x1}, [@CTA_EXPECT_CLASS={0x8, 0x9, 0x1, 0x0, 0x10000}, @CTA_EXPECT_MASTER={0x18, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x28}}, @CTA_TUPLE_ZONE={0x6}]}]}, 0x34}, 0x1, 0x0, 0x0, 0x24004080}, 0x2000010) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000580)="d8000000140081054e81f782db44b904021d080225000000040000a118000200fcffffff00000e1208000f0100810401a80016ea1f", 0x35}], 0x1, 0x0, 0x0, 0x7400}, 0x0) r5 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000440)=[{&(0x7f0000000580)="d8000000140081054e81f782db44b9040a", 0x11}], 0x1, 0x0, 0x0, 0x7400}, 0x0) write$cgroup_subtree(r5, &(0x7f0000000580)=ANY=[], 0xfe33) syz_emit_ethernet(0x6e, &(0x7f0000000040)=ANY=[@ANYBLOB="0180c2000002aaaaaaaaaaaa08004500006000000000002f9078640101000000000024806558000000000000000010000800000086dd"], 0x0) r6 = socket$kcm(0x10, 0x2, 0x10) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000070000040900010073797a30000000009c000000090a010400000000000000000700000308000a40000000000900020073797a30000000000900010073797a3000000000080005400000000d58001280200001800e000100636f6e6e6c696d69740000000c0002800800014000000008200001800e000100636f6e6e6c696d69740000000c00028008000140000000001400017b090001006cdbf80789f3f947dd000280080003"], 0xe4}, 0x1, 0x0, 0x0, 0x8001}, 0x20050840) sendmsg$kcm(r6, &(0x7f0000000000)={0x0, 0xd18c9b25, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f030041000b05d25a806c8c6394f90324fc60100000000a000200053582c137153e3704020180fc5409000c00", 0x33fe0}], 0x1}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0100000001000000e27f00000100000000000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000000007b7e147000000000000000000"], 0x50) r7 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r7, 0x89f3, &(0x7f0000000580)={'gre0\x00', &(0x7f0000000440)={'gre0\x00', 0x0, 0x7, 0x20, 0x3ff, 0x0, {{0x5, 0x4, 0x0, 0x8, 0x14, 0x65, 0x0, 0xf, 0x2f, 0x0, @dev={0xac, 0x14, 0x14, 0x19}, @dev={0xac, 0x14, 0x14, 0x43}}}}}) bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x11, 0x3, &(0x7f0000000280)=@framed, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x27, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_CREATE_TAIL_CALL(0x9, &(0x7f0000000380), 0xc) r8 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000001c0)={0x11, 0x10, &(0x7f00000000c0)=ANY=[@ANYBLOB="180000008f000000000000000100000018110000", @ANYRES32=r8, @ANYBLOB="0000000000000000b702000054000001b7030000000000008500000083000000bf0900000000000055090100000000009500000000000000c309000001000000bf91000000000000b7020000020000008500000085000000b70000000000000095"], &(0x7f0000000080)='GPL\x00', 0x7, 0x0, 0x0, 0x41100, 0xd}, 0x94) 16.600699311s ago: executing program 0 (id=1379): r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, 0x0, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01040000000000000000010000000900010073797a30000000002c0000001b0a05000001000000000000010000000900010073797a30000000000c0002"], 0x74}, 0x1, 0x0, 0x0, 0x8000}, 0x0) (async) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000380)={{r1, 0xffffffffffffffff}, &(0x7f0000000300), &(0x7f0000000340)=r0}, 0x20) r3 = bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000440), 0x4) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000480)=@bloom_filter={0x1e, 0x3, 0x7, 0x8000, 0xa05, r2, 0xf90, '\x00', 0x0, r3, 0x0, 0x0, 0x3, 0xf}, 0x50) (async) r5 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r5, 0x84, 0x9, &(0x7f00000000c0)={0x0, @in6={{0xa, 0x4e22, 0x9, @local, 0x51fc}}, 0x9da7, 0x6, 0xffff, 0x3, 0x8, 0x80000000, 0x5e}, 0x9c) ioctl$ifreq_SIOCGIFINDEX_wireguard(r1, 0x8933, &(0x7f00000001c0)={'wg1\x00', 0x0}) (async) r7 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) ioctl$int_in(r7, 0x5421, &(0x7f0000000000)=0x504) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x22051, r7, 0x0) (async) ioctl$sock_SIOCGPGRP(r7, 0x8904, &(0x7f00000002c0)) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000240)=@bloom_filter={0x1e, 0x5, 0x1, 0xa, 0x40100, 0x1, 0x80000, '\x00', r6, r7, 0x0, 0x0, 0x5, 0x2}, 0x50) (async) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r4, &(0x7f0000000000)={0xa0000000}) (async) r8 = bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x6, 0x3, &(0x7f0000000480)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x32, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) r9 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000580)={'veth0_to_team\x00', 0x0}) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000004c0)={r8, r10, 0x25, 0x33, @void}, 0x10) (async, rerun: 32) unshare(0x28000600) (async, rerun: 32) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000080)={{r4, 0xffffffffffffffff}, 0x0, &(0x7f0000000040)}, 0x20) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001200)={r11, 0x0, &(0x7f0000001780)=""/4096}, 0x20) 16.482048637s ago: executing program 0 (id=1380): bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={0xffffffffffffffff, 0x2000d00, 0x3, 0x0, &(0x7f0000000140)="a06ad8", 0x0, 0x0, 0x4000000, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x50) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)={0x64, 0x2, 0x6, 0x201, 0x0, 0x0, {}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_TYPENAME={0x15, 0x3, 'hash:ip,port,net\x00'}, @IPSET_ATTR_DATA={0x14, 0x7, 0x0, 0x1, [@IPSET_ATTR_TIMEOUT={0x8, 0x6, 0x0}, @IPSET_ATTR_MAXELEM={0x8, 0x13, 0x1, 0x0, 0xfffffffc}]}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x64}}, 0x20000000) write$cgroup_subtree(r0, &(0x7f0000000100)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r0, 0x0) r2 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$inet_mreqn(r2, 0x0, 0x53, 0x0, &(0x7f0000000040)=0xf) 16.287423837s ago: executing program 4 (id=1381): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt(r0, 0x84, 0x81, &(0x7f00000002c0)="1a00000002000000", 0x8) getsockopt$inet_sctp6_SCTP_LOCAL_AUTH_CHUNKS(r0, 0x84, 0x1b, &(0x7f0000002580), &(0x7f00000025c0)=0x8) recvmsg(0xffffffffffffffff, 0x0, 0x1f60) socketpair$nbd(0x1, 0x1, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000000780)=ANY=[@ANYBLOB="b700000081020100bfa30000000000000703000020feffff720af0fff8ffffff71a4f0ff000000002d030000000000001d400500000000004704000001ed000072030200000000001d440000000000006b0a20fe000000007303000000000000b5000000000000009500000000000000023bc065b58111c6dfa041b63af4a3912435f1a864a710aad58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a7168c50000000190f32050e436fe275daf51efd601b6bf01c8e8b1b526375ec4dd6fcd82e4fee5bef7af9aa0d7d600c095199fe3ff3128e599b0eaebbdbd732c9cc00eec363e4a8f6456e2cc21557c0afc646cb7798b3e6440c2fbdb00a3e35208b0bb0d2cd829e654400e2438ec649dc74a28610643a98d9ec21ead2ed51b104d4d91af25b845d8a7925c3109b151b8b9f75dd08d123deda88c658d42ecbf28bf7076c15b463bebc72f526d8e8afcb913466aaa7f6df70252e79166d858fcd0e06dd31af9612f2460d0b11008e59a5923906f88b53987ad1714e72ba7a54f0c33d39000d06a59ff616236fd9aa58f2477184b6a89adaf17b0a6041bdef728d236619074d6ebdfd1f5089048ddff6da40f9411fe722631cb467600ade70063e5291569b33d21dae356e1c51f03a801be8189679a16da18ec0ae564162a27afea62d84f3a10746443d6438e959532e0617d419c6bc6ea9f2bca4464f56e24e6d2105bd901204a1deeed4155617572652d950ad31928b0b0c3dc2869f478341d02d0f5ad94b081fcd507acb4b9c65fee9d5a17f48a7382f13d000000225d85ae49cee383dc5049076b989b40000000000000da60d2ae20cfb91d6a49964757cdf538f1ce2bdb1ab062cd54e67011d355d84ce97bb0c6b4a595e487efbb2d71cde2c140952f9a0f0bc6980fe78683ac5c0c31032599ddd71063be9261b2e1aab1675b34a22048ef8c126aeef5f510a8f1aded94a129e4aec6f8d9ab06faffc3a15d96c2ea3e2e04cfe031b2875353193f82ade69d0540059fe6c7fe7cd8697502c7596566d674e425da5e87e59602a9f6590521d31d3804b3e0a1053abdc31282dfb15eb6841bb64a1b304502dda787343ce3c953992e4a982f3c48153baae244e7bf37548c7f1a4cad2422ee965a38f7defbd2160242b104e20dc2d9b0c35608d402ccdd9069bd50b994fda7a9de44028d6112a0c2d21b2dc98816106dec28eaeb883418f562ae00003ea96d10f172c0374d6eed826416050000000bfe9b4a9c5a90ff59d54d1f92ecc4e95dd2d18383117c039862198899b212c55318294270a1ad10c80fef7c24d47afce829ba0f85da6d888f18ea40ab959f6074ab2a40d85d15017ab513cdc6c0e57fb1c107571380d7b4ead35a385e0b4a26b702396df7e0c1e02b6e4114f244a9bf93f04bf072f0861f7580e69db384ac7eeedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba34015ea5aacb1188883ad2a3b1832371fe5bc621426d1ed0a4a99702cc1b6912a1e717d29135753208165b9cdbae2ed9dc7358f0ebadde0b727f27feeb744ddcc536cbae315c7d1fe1399562ba6824840bd2951680f6f2f9a6a8346962a350845ffa0d829e4f79adc287906943408e6df3c391e97ba48db0a5adbfd03aac93df8866fb010aec0e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00000000c95265b2bd83d64a532869d701723fedcbada1ee7baa5b6a686b50f0937f778af083e055f6138a757ebd0ed91124a6b244f9acf41ac5d73a008364e0606a594817031fc2f52c8785fe0721719b3d654026c6ea08b83b123145ab5703dad844ceb201ddeb6dc5f6a903792283c42efc54fa84323afc4c10eff462c8843187f1dd48ef3fa293774d582956ff0f40b10ca94f6feeb2893c17888e1cdba94a6ea80c33ead5722c3293a493f1479531dd88261458f40d31fe8df15efaaeea831555877f9538d6ee6ba65893ff1f908ba7554ba583fef3ec7932f5954f31a878e2fae6691d1aee1da02ba516467df3e7d1daac43738012e4fee18a22da19fcdb4c2890cda1f96b952511e3a69d694d625e0b2f808890205f3a6da2819d2f9e77c7c64affa54fec0136cbafa5f6f096753b639a924599c1f69219927ea5301fff0a6063d427f0688430754c02180d61542c2571f983e9673560000000000000000005a7b57f03ca91a01ba2e30ca99e8ebc15ecb4d91675767999d146aef7799738b292fd640dfef6b04d086f737a159d7e0c6e4d81ad64a8bbca48568325b2969e2b15f36b788bce5ccdbaf75c94cb93499f6947a967a7bce14c6de4e7c0660d80010f5c653d22d49030a8c2a4ab595bf4238f18ca428dafc7ac96d404607a0000000051a2104f22e6db5a62b5089c1b45282d1abf3cb17b40ac9b10968f38864daa3ae81d6b0968d1d2867b91b7d120617d12d91db2633d6864da40b54783a17aaeb6737c323f9f98e354cc98dcfe23ad01bd1c61563e69ffe1c2c73e1661261173f359e93d2c5e424c17998809ec8f0232b3955e052a4cecd89008f70314a0bdd491ec86a4555d89fe0120f64c62e8e3ed8bcb45202c3d4bbec8d722824c0ebca8db1ea4a003d2fbdc1f9be78537756ab5bbe4fe9af5d785d0128171c90d9900ce2532b0f9d01c4b45294fbba468df3e1b393cb4e62e754598e47df6bd06431c94bc5d047899fd219f448bf9189c65c9d91eda6b52a373803a9efe44f86909bc90addb7b9aee813df534aac4b3093c91b8068cd84990453f006694d461b76a58d88cf0f520310a1e9fdc18cde98d662eee077515d0a8811922929e085392ab3d1311b8243266d87047f601fa88a0da36b9f302e8262395174328f2482d14008de83070744f143fdec90ba5a82668d5fac114c13955ad6dca5db2231d8ba14c54c47ed04a4b4ace17e357e1d6432399f87a7a14245bbd796a09313b247b95d37ff40a404bdad74bd20000000000000000000099fef7cd7af3ce64a92f95d89d125b1e641240d7e5e27a3d1f7684448c3e3822d617e205061298b939a191be4b48e169bde2cae3accc5bd40a2968b59c93d35f8e42366fdef9a2abae1cf01ce68abff28861aac8302d268569dd42e194e330c7aaa54ebbcefd23f21ce8153b9926e12e925cb56119df72c7533a48d028ad0c74e2a9478fa3be18a1a2b65079cc1c7bc46dd12305a1ae9dd19e8d525206c0a728cfd42193abe8130bc01a2d61f3b39c64307f9c82b2807c9ff4a269841f3d7799ac04bdc590bb1c89b9c695f163e57343c9bfb59909433c9001c5f8b23e38534a538fc933cac6c2a92d038df638a0f226df9fb857bd414c2cd69985e8053e3dfa41614d7c74d04d8c2471041d17c730fad28395f8d4688898cd58b9d600c851626529bb58aa364b55e73f053450665e7b94ad1012fd7a8139166fd5e59c84f4ab279b1b99c028db4cb9680c8035f967db18de738844da7e260a830c1ffa49f5af3c15423a0e315acb82a3e89218cb314e68fda4d94aa1d815babc13b9fd336d205c5913ef67a41b9e320146ee9f566a28"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0xfffffffffffffd00}, 0x48) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0x3, 0x3, &(0x7f0000000040)=@framed={{0x66, 0xa, 0x0, 0x0, 0x0, 0x61, 0x11, 0x70}}, &(0x7f0000000080)='GPL\x00', 0x2}, 0x94) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x1, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8923, 0x0) preadv(r1, &(0x7f0000000240)=[{&(0x7f0000002980)=""/4096, 0x1000}, {&(0x7f0000001180)=""/160, 0xa0}], 0x2, 0xfff, 0x10001) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000680)=ANY=[@ANYBLOB="14000000100001000000000000b890c1a000000a80000000160a01030000000000000000020000000900020073797a30000000000900010073797a30000000005400038008000240000000000800014000000000400003801400010076657468315f746f5f6272696467650014000100776732000000000000000000000000000b00010076657468305f746f5f7465616d00000014000000110001"], 0xa8}}, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000a80)={{0x14}, [@NFT_MSG_NEWRULE={0x6c, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x40, 0x4, 0x0, 0x1, [{0x28, 0x1, 0x0, 0x1, @flow_offload={{0x11}, @val={0x10, 0x2, 0x0, 0x1, [@NFTA_FLOW_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}}}, {0x14, 0x1, 0x0, 0x1, @synproxy={{0xd}, @void}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}, @NFT_MSG_DELTABLE={0x20, 0x2, 0xa, 0x801, 0x0, 0x0, {0x3, 0x0, 0x9}, [@NFTA_TABLE_HANDLE={0xc, 0x4, 0x1, 0x0, 0x2}]}, @NFT_MSG_DELTABLE={0x14, 0x2, 0xa, 0x401, 0x0, 0x0, {0x2, 0x0, 0xa}}], {0x14}}, 0xc8}, 0x1, 0x0, 0x0, 0x2000094}, 0x4000800) r3 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) bind$inet(r3, &(0x7f0000000080)={0x2, 0x4e23, @local}, 0x10) setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x1a, &(0x7f0000000000)={0x1, &(0x7f0000000280)=[{0x6, 0xfa, 0x0, 0xe4}]}, 0x10) sendto$inet(r3, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r3, 0x6, 0xd, &(0x7f0000000100)='bbr', 0x3) write(r3, &(0x7f0000002480)="58432883c72df18c10d9aa59d287b6f3596b95c6222d2ce9b4c087c0cc0c9a1fc4636a38111c27c8c16ad5db1c03a1fe0a1fd6fb8c8d1e012e21a4022ebd4342129f98cac076fb2a8a9e3be062ffdb58a359bdcd2beb151caa1160aae646d6533e3307d322cf3fa2c610f168a510a24a6bce749674e644b8fab9fe009ce6febb4febf9190a9388c333500d7ff60a66b740916246861403c78851935281d6818925e1c6d44dc8763c99920b29107f0ef2ce0002078c48ea69bedafe371822ad50c3585ce0c00e2866a77eb382a4a94c8140eade00e7cce81a18b01e2824860a08682d5f098ff2025c279a91ded1c2e68d0f765dcc0feeb118f7b2c4d0ac243f214ba6102d1f7e5855d204d3f5f533b590af39177b29e264935d637660ffda56415f003705bac18326fd036ca5866b3774d53bc948ec177f94ad43fa7654e56fd5df799454c24aa5bbcbade05473b27357093cdff40a8f1df11e951fe9c1d4cbd2afcaec315a61538511429be3ac1d5c96c49dae7fc3383d5696f81865daf7cc4fed6628e40b4b9bed2a56a1058b6bfb2213749014375e577b9ec4ead515d6ffcf06ecf73490e8e54ea3c5519765aad9f6ca082198f88d63910ecaf1442789de4fec5af0e5eabcc8cdcc4a2cd6d348c53a7fc4fc84b7a57fad068114c0c2135f9e5b7b5cc693fb7ee2d4a9eeeefcd5bbe1e04d2e79b0b565669cb708fed60dbd04cc4e5970bd688080a20d70426025404797b769225215dfa01e116625e3358c670bad99250553ff83abf0a9a9cabe2f6316b039faf317717c84358f1dfddfb4d50d1133b5d1a458dc57a536675d288a3461a5ff621ac55fa9ed7127baa0893fcb9b32c0a621fb1c2ecbc9eef27077c8253e44900e5f864a0845990268ef473c21fa2ed5bf9ceb00ffc06cd435687bf5d66fc462b4722a4dc90fce58d0c3ceae0dc1ac3e518a3388e21adaa54cd4f12fa328c3ba221fa604905f046f37de3bfe1829d1db4367373029a100339754c9d4491e60f065cb2e75c387cb4bc8bdd204142679dd07173f68b3fd14010aca29cba02fbec1e3da97c3063367fc70c47d5fe1c3a6217c4226f1fff9a7e0197ee5008b04cf56e6b9a7d23f5ba14589640d76049ff3972a317a7b861fd2930bce30b6cd51e9ad81f2ee6d1733ca19cd2fd4c6979076b9c9edf5749817151361dfe46dc44b6add43a483bc508e1c75e28c9c4ad5da72d21fe1731a32aec0661ded551aef04b2adea89868e7991422aeeccc7b92725754a4bcfe2ad480cb23e88d327bb125cc377c2d71b80ae42bbe3291ad850d450041925fe17e51877ef23cc823626b74aa1a048e0a725a77739c36620a0c3de6d15f51484732b16d2fbe71c553bd2c2b6d8519f7ba58ec622ba660d8e2119c2b04645fcb1661c9f1928d1d634b9f41788b68d15656fbb0777e8ea16e1caf9d18d27f352cbbfe566cc85ff611a9e742ae9e43e1a09a5b800caeaeb07a25d34ece6f5b440a281749f89877719d12948f6c89c774ecfb02882083392561f2ece1248aeb0407d70d141c121b815a3ebb6a6e4beef697e535c10502014ea6e9de83a13a4db9aac25045f5dff5fd508cce4e18d44952534c014394315e54a527abd259d9ed8b33d8809396a3aecf5acfc2ad0d85f6f3e63415f317d9ccf3c6888fcc9239079496630f7d85379234051a40cb27a4f6634ea5dc1d2899fa9c355c202c1e90a47c243fcd5f171652c34dee8c50223fe24559b", 0x4d5) setsockopt$sock_int(r3, 0x1, 0x8, &(0x7f0000000600)=0xdfa, 0x4) sendto$inet(r3, &(0x7f0000000580)="17", 0x59a, 0x10008095, 0x0, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(r2, 0xc020f509, &(0x7f0000000140)={r0, 0x100000000, 0xffffffff, 0x4}) connect$pptp(r4, &(0x7f0000000180)={0x18, 0x2, {0x0, @rand_addr=0x64010101}}, 0x1e) 16.123624037s ago: executing program 3 (id=1382): r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_GATEWAYS(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000280)={&(0x7f00000001c0)={0x1c, r0, 0x200, 0x70bd29, 0x25dfdbff, {}, [@BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x6}]}, 0x1c}, 0x1, 0x0, 0x0, 0x44}, 0x10) (async) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f0000000380)={0x0, 0x4076cbba9945d516, &(0x7f0000000340)={0x0, 0x14}}, 0x0) getsockname$packet(r1, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) (async) socket$packet(0x11, 0x3, 0x300) (async) socket$inet(0x2, 0x4000000000000001, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r4 = socket$inet6_udp(0xa, 0x2, 0x0) r5 = socket$nl_rdma(0x10, 0x3, 0x14) r6 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$TIPC_CMD_ENABLE_BEARER(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}, 0x1, 0x0, 0x0, 0x44081}, 0x0) (async) sendmsg$TIPC_CMD_SHOW_STATS(r1, &(0x7f0000000540)={&(0x7f0000000480)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000500)={&(0x7f00000004c0)={0x1c, r6, 0x100, 0x70bd28, 0x25dfdbfb, {}, [""]}, 0x1c}, 0x1, 0x0, 0x0, 0x80}, 0x20000000) (async) sendmsg$RDMA_NLDEV_CMD_RES_MR_GET(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000340)=ANY=[@ANYBLOB="2000000004140100000000000000000008000300000000000800", @ANYRES64=r4], 0x20}, 0x1, 0x0, 0x0, 0x4000015}, 0x814) (async, rerun: 32) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) (async, rerun: 32) sendmsg$NFT_BATCH(r3, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000340)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSET={0x3c, 0x9, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x2}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0xfffffffc}]}, @NFT_MSG_NEWSETELEM={0x4c, 0xc, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x6}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x20, 0x3, 0x0, 0x1, [{0x10, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0xc, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0x6, 0x1, "d103"}]}]}, {0xc, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x2}]}]}]}, @NFT_MSG_DELSETELEM={0x2c, 0xe, 0xa, 0x201, 0x0, 0x0, {0xa}, [@NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}]}], {0xdc, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0xdc}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) (async) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)=ANY=[@ANYRES32=r1, @ANYRES32=r2, @ANYBLOB="01180200031100002c0012800e00010069703665727370616e0000001800028008001500a8bc0d00040012"], 0x4c}}, 0x0) (async) r7 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$SO_RDS_TRANSPORT(0xffffffffffffffff, 0x114, 0x8, &(0x7f0000000040)=0xffffffffffffffff, 0x4) (async) sendmsg$nl_route(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000440)={&(0x7f00000002c0)=@newlink={0x54, 0x10, 0x401, 0x70bd28, 0x3, {0x0, 0x0, 0x0, r2, 0x0, 0x1c05}, [@IFLA_LINKINFO={0x34, 0x12, 0x0, 0x1, @ip6erspan={{0xe}, {0x20, 0x2, 0x0, 0x1, [@IFLA_GRE_COLLECT_METADATA={0x4}, @IFLA_GRE_ENCAP_LIMIT={0x5, 0xb, 0x2}, @IFLA_GRE_TTL={0x5, 0x8, 0x2}, @IFLA_GRE_LINK={0x8, 0x1, r2}]}}}]}, 0x54}, 0x1, 0x0, 0x0, 0x10}, 0x12) 16.122984284s ago: executing program 0 (id=1383): mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000780), r1) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r4 = socket(0x11, 0x4, 0x0) r5 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000600)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000700)=@newqdisc={0x38, 0x24, 0x4, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r6, {0xfff1, 0x1}, {0xffff, 0xffff}, {0xfff3, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x1, 0x8}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000008c0)=@deltaction={0xf8, 0x31, 0x300, 0x70bd25, 0x25dfdbfe, {}, [@TCA_ACT_TAB={0x54, 0x1, [{0xc, 0x1d, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x3}}, {0xc, 0x1b, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x401}}, {0xc, 0xd, 0x0, 0x0, @TCA_ACT_INDEX={0x18, 0x3, 0xb}}, {0x14, 0x7, 0x0, 0x0, @TCA_ACT_KIND={0xd, 0x1, 'connmark\x00'}}, {0xc, 0xb, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x401}}, {0xc, 0xd, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0xe}}]}, @TCA_ACT_TAB={0x10, 0x1, [{0xc, 0x6, 0x0, 0x0, @TCA_ACT_INDEX={0x8}}]}, @TCA_ACT_TAB={0x30, 0x1, [{0x10, 0x5, 0x0, 0x0, @TCA_ACT_KIND={0xc, 0x1, 'skbedit\x00'}}, {0x10, 0x17, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'mirred\x00'}}, {0xc, 0x4, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x80}}]}, @TCA_ACT_TAB={0x4}, @TCA_ACT_TAB={0x4c, 0x1, [{0xc, 0x1a, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x81}}, {0xc, 0x20, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x7}}, {0xc, 0x19, 0x0, 0x0, @TCA_ACT_INDEX={0x8}}, {0xc, 0x1e, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'nat\x00'}}, {0xc, 0x5, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'nat\x00'}}, {0xc, 0x9, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x2}}]}]}, 0xf8}, 0x1, 0x0, 0x0, 0x20048084}, 0x800) sendmsg$NLBL_MGMT_C_ADD(r1, &(0x7f0000000d80)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000640)=ANY=[@ANYRES16=r5, @ANYRES16=r2, @ANYBLOB="0100000040000000000001000000080007000a0101024e00010003dfe4dd9e6efa9e72e4065e1dd0ab4c3f17568492fa019225f4f55724dbd9d7264880ef7cef4da08a74e947a31ce6750f9a05e44bd95d7a6eda083bb40ea3d63e0c0000ddd4a0c6f5e4000008000c000000000008000800ffffffff0800020007000000"], 0x84}}, 0x0) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000ac0)={0x18, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="180100002100000000000000000000008500000075000000a50000002300000095"], &(0x7f0000000180)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x80}, 0x94) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x3000003, 0x204031, 0xffffffffffffffff, 0xffffd000) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f00000001c0)='ifs_status\x00', r7, 0x0, 0x1}, 0x18) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r8, &(0x7f0000000100)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000005, 0x12, r8, 0x0) sendmsg$NL80211_CMD_LEAVE_IBSS(0xffffffffffffffff, &(0x7f0000000540)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000500)={&(0x7f00000004c0)=ANY=[@ANYBLOB=' \x00 \x00', @ANYRES16=0x0, @ANYBLOB="100029bd7000fbdbdf252c0000000c0099000300000037000000"], 0x20}}, 0x4008000) bpf$BPF_LINK_UPDATE(0x1d, &(0x7f0000000080)={r8, r7, 0x4, r7}, 0x10) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x4c02}) r9 = socket(0x2, 0x80805, 0x0) sendmmsg$inet(r9, &(0x7f00000003c0)=[{{&(0x7f0000000000)={0x2, 0x0, @rand_addr=0x64010100}, 0x10, &(0x7f00000000c0)=[{&(0x7f0000000180)="e1", 0x1}], 0x1}}, {{&(0x7f0000000080)={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, &(0x7f0000000140)=[{&(0x7f0000000100)="a7", 0x1}], 0x1}}], 0x2, 0x0) getsockopt$inet_sctp_SCTP_GET_ASSOC_NUMBER(r9, 0x84, 0x1c, &(0x7f0000000380), &(0x7f0000000440)=0x4) ioctl$AUTOFS_IOC_EXPIRE(r0, 0x810c9365, &(0x7f00000001c0)={{0x2, 0x2}, 0x100, './file0\x00'}) readv(r0, &(0x7f0000000040)=[{&(0x7f0000001a80)=""/4112, 0x1010}, {0x0}], 0x2) r10 = socket$kcm(0x2, 0xa, 0x2) ioctl$TUNSETVNETHDRSZ(r0, 0x400454d8, &(0x7f0000000100)=0x730) socket$igmp6(0xa, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r10, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', @link_local}) 15.358913399s ago: executing program 4 (id=1384): r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup/syz0\x00', 0x200002, 0x0) openat$cgroup_type(r0, &(0x7f00000000c0), 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x1e, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x1, 0x2, 0x6b324fb906924663, 0x2, 0x1}]}, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x94) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x1e, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x1, 0x2, 0x6b324fb906924663, 0x2, 0x1}]}, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x94) openat$cgroup_procs(r0, &(0x7f0000000100)='tasks\x00', 0x2, 0x0) 15.330155382s ago: executing program 4 (id=1385): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000540), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_MAX_CSMA_BACKOFFS(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000580)={0x2c, r1, 0x1, 0x70bd2a, 0x25dfdbfe, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x3}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}]}, 0x2c}, 0x1, 0x0, 0x0, 0x8000}, 0x40814) r2 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_NEW_SEC_KEY(r0, &(0x7f0000000200)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f00000001c0)={&(0x7f0000000080)={0x11c, r2, 0x4, 0x70bd26, 0x25dfdbfe, {}, [@NL802154_ATTR_SEC_KEY={0xd4, 0x30, 0x0, 0x1, [@NL802154_KEY_ATTR_BYTES={0x14, 0x4, "e50443f378201fbf99acaeae0ed0c06c"}, @NL802154_KEY_ATTR_USAGE_FRAMES={0x5, 0x2, 0x2}, @NL802154_KEY_ATTR_USAGE_FRAMES={0x5, 0x2, 0x3}, @NL802154_KEY_ATTR_ID={0x68, 0x1, 0x0, 0x1, [@NL802154_KEY_ID_ATTR_SOURCE_SHORT={0x8, 0x4, 0x7}, @NL802154_KEY_ID_ATTR_IMPLICIT={0x14, 0x3, 0x0, 0x1, [@NL802154_DEV_ADDR_ATTR_MODE={0x8}, @NL802154_DEV_ADDR_ATTR_SHORT={0x6, 0x3, 0xaaa1}]}, @NL802154_KEY_ID_ATTR_SOURCE_EXTENDED={0xc, 0x5, 0x100000001}, @NL802154_KEY_ID_ATTR_IMPLICIT={0x3c, 0x3, 0x0, 0x1, [@NL802154_DEV_ADDR_ATTR_PAN_ID={0x6, 0x1, 0x3}, @NL802154_DEV_ADDR_ATTR_EXTENDED={0xc, 0x4, {0xaaaaaaaaaaaa0002}}, @NL802154_DEV_ADDR_ATTR_MODE={0x8, 0x2, 0x2}, @NL802154_DEV_ADDR_ATTR_PAN_ID={0x6, 0x1, 0xffff}, @NL802154_DEV_ADDR_ATTR_SHORT={0x6, 0x3, 0xaaa0}, @NL802154_DEV_ADDR_ATTR_EXTENDED={0xc, 0x4, {0xaaaaaaaaaaaa0202}}]}]}, @NL802154_KEY_ATTR_USAGE_FRAMES={0x5, 0x2, 0x2}, @NL802154_KEY_ATTR_ID={0x4}, @NL802154_KEY_ATTR_ID={0x30, 0x1, 0x0, 0x1, [@NL802154_KEY_ID_ATTR_SOURCE_SHORT={0x8, 0x4, 0x6}, @NL802154_KEY_ID_ATTR_IMPLICIT={0x4}, @NL802154_KEY_ID_ATTR_SOURCE_EXTENDED={0xc, 0x5, 0x8}, @NL802154_KEY_ID_ATTR_IMPLICIT={0x14, 0x3, 0x0, 0x1, [@NL802154_DEV_ADDR_ATTR_SHORT={0x6}, @NL802154_DEV_ADDR_ATTR_PAN_ID={0x6, 0x1, 0x2}]}]}, @NL802154_KEY_ATTR_USAGE_FRAMES={0x5, 0x2, 0xb}]}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_SEC_KEY={0x2c, 0x30, 0x0, 0x1, [@NL802154_KEY_ATTR_BYTES={0x14, 0x4, "ae5acb24d0c0c8dd7ccf38a9d378ef02"}, @NL802154_KEY_ATTR_BYTES={0x14, 0x4, "ec7f4642535e5d5d5e1a878c2f252df1"}]}]}, 0x11c}, 0x1, 0x0, 0x0, 0x4000009}, 0x1) 5.517451459s ago: executing program 32 (id=1327): r0 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$IOCTL_GET_NCIDEV_IDX(r0, 0x0, &(0x7f00000000c0)) r1 = socket$inet(0x2, 0x2, 0x1) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r2) r3 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r2, &(0x7f0000000000)={0xa, 0x4e22, 0x0, @local, 0xb}, 0x1c) listen(r3, 0x0) syz_emit_ethernet(0x4e, &(0x7f0000000280)={@local, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x1a}, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "c105f5", 0x18, 0x6, 0x0, @local, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x6, 0x2, 0x0, 0x0, 0x0, {[@fastopen={0x1e, 0x4, 'U7'}]}}}}}}}}, 0x0) connect$inet(r1, &(0x7f0000000180)={0x2, 0x4e24, @remote}, 0x10) sendmmsg$inet(r1, &(0x7f00000028c0)=[{{0x0, 0x0, &(0x7f0000000980)=[{&(0x7f0000000500)="08001497", 0x4}, {&(0x7f0000000400)="c63d763f80", 0x5}], 0x2}}], 0x1, 0x8000) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r4) sendmsg$NFC_CMD_DEV_UP(r4, &(0x7f0000000140)={0x0, 0xfffffffffffffffd, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r5, @ANYRES64=r0, @ANYRES64=r5], 0x1c}, 0x1, 0x0, 0x0, 0x8000040}, 0x0) write$nci(r0, &(0x7f0000000040)=ANY=[@ANYBLOB="e0cc014c"], 0x4) 1.506005026s ago: executing program 33 (id=1377): bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0xe, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18090000000000000000000000000000850000006d0000001801000020696c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007000000095"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x6, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = socket$packet(0x11, 0x2, 0x300) syz_emit_ethernet(0x82, &(0x7f0000000340)=ANY=[@ANYBLOB="bbbbbbbbbbbbaaaaaaaaaa3081001f00001142aaa4e5f937e5fa280e9214a3dcaee7c361c8107dc2059813c0bf90a43a40ac181c1c9cfbd81e0ed834ebf0034c952efb10ee04b939500c00001979bf454a26813b96dbf92b77f3eab689acb571f6ba186e0ace88775fabf8012e78a32d5914eaa6cc9158cbbfd12e02488d2fb6173e79615392886bd377fec4df24a1f0ce"], &(0x7f0000000080)={0x1, 0x2, [0xb2e, 0xe6e, 0xbb3, 0xcbb]}) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000003c0)={0x3, 0xc, &(0x7f0000000000)=@framed={{0x18, 0x2, 0x0, 0x0, 0x5}, [@call={0x85, 0x0, 0x0, 0x29}, @printk={@lx, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xfffffffc}, {0x85, 0x0, 0x0, 0x73}}]}, &(0x7f0000000080)='GPL\x00', 0x2, 0x0, 0x0, 0x41100, 0x49, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x4}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r1, 0x0, 0xe, 0x0, &(0x7f0000000100)="e0b9547ed387dbe9abc89b6f5bec", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x50) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000001e80)=ANY=[@ANYBLOB="0b000000080000000c000000ffffffff01"], 0x48) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$IP6T_SO_GET_REVISION_TARGET(r3, 0x29, 0x45, 0x0, &(0x7f00000000c0)) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000080)={{r2, 0xffffffffffffffff}, &(0x7f0000000000), &(0x7f0000000040)}, 0x20) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000200)='kfree\x00', r5, 0x0, 0x10000001}, 0x18) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r6, &(0x7f0000000700)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="010300000000fbdbdf251c0000001800018014000200626f6e6430"], 0x2c}}, 0x40006) r8 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r8, 0x6, 0x16, 0x0, 0x0) r9 = socket$alg(0x26, 0x5, 0x0) r10 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000a40)={0x0, 0xf, &(0x7f00000004c0)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0xf, 0x0, 0x0, 0x0, 0x3}, {}, {}, [], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000640)='GPL\x00', 0xc298, 0x0, 0x0, 0x40f00, 0x64, '\x00', r11, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x81}, 0x94) bind$alg(r9, &(0x7f0000000180)={0x26, 'hash\x00', 0x0, 0x0, 'cryptd(sha3-256-generic)\x00'}, 0x58) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x16, 0xc, &(0x7f0000000140)=ANY=[@ANYRESDEC=r0, @ANYRES64=r0, @ANYBLOB="39e0ec4ec7b93661fe381a56c8b69bd53014ab"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, @flow_dissector=0x11, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r12 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_RES_CM_ID_GET(r12, &(0x7f0000000580)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x40, 0x140b, 0x100, 0x70bd2c, 0x25dfdbfe, "", [@RDMA_NLDEV_ATTR_RES_CM_IDN={0x8}, @RDMA_NLDEV_ATTR_RES_CM_IDN={0x8, 0x3f, 0x4}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x2}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8}]}, 0x40}, 0x1, 0x0, 0x0, 0x8000}, 0x800) r13 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r13, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=ANY=[@ANYBLOB="140000002e00090027bd70000000000004010000"], 0x14}, 0x1, 0x0, 0x0, 0x42804}, 0x0) 1.003554934s ago: executing program 34 (id=1383): mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000780), r1) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r4 = socket(0x11, 0x4, 0x0) r5 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000600)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000700)=@newqdisc={0x38, 0x24, 0x4, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r6, {0xfff1, 0x1}, {0xffff, 0xffff}, {0xfff3, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x1, 0x8}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000008c0)=@deltaction={0xf8, 0x31, 0x300, 0x70bd25, 0x25dfdbfe, {}, [@TCA_ACT_TAB={0x54, 0x1, [{0xc, 0x1d, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x3}}, {0xc, 0x1b, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x401}}, {0xc, 0xd, 0x0, 0x0, @TCA_ACT_INDEX={0x18, 0x3, 0xb}}, {0x14, 0x7, 0x0, 0x0, @TCA_ACT_KIND={0xd, 0x1, 'connmark\x00'}}, {0xc, 0xb, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x401}}, {0xc, 0xd, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0xe}}]}, @TCA_ACT_TAB={0x10, 0x1, [{0xc, 0x6, 0x0, 0x0, @TCA_ACT_INDEX={0x8}}]}, @TCA_ACT_TAB={0x30, 0x1, [{0x10, 0x5, 0x0, 0x0, @TCA_ACT_KIND={0xc, 0x1, 'skbedit\x00'}}, {0x10, 0x17, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'mirred\x00'}}, {0xc, 0x4, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x80}}]}, @TCA_ACT_TAB={0x4}, @TCA_ACT_TAB={0x4c, 0x1, [{0xc, 0x1a, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x81}}, {0xc, 0x20, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x7}}, {0xc, 0x19, 0x0, 0x0, @TCA_ACT_INDEX={0x8}}, {0xc, 0x1e, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'nat\x00'}}, {0xc, 0x5, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'nat\x00'}}, {0xc, 0x9, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x2}}]}]}, 0xf8}, 0x1, 0x0, 0x0, 0x20048084}, 0x800) sendmsg$NLBL_MGMT_C_ADD(r1, &(0x7f0000000d80)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000640)=ANY=[@ANYRES16=r5, @ANYRES16=r2, @ANYBLOB="0100000040000000000001000000080007000a0101024e00010003dfe4dd9e6efa9e72e4065e1dd0ab4c3f17568492fa019225f4f55724dbd9d7264880ef7cef4da08a74e947a31ce6750f9a05e44bd95d7a6eda083bb40ea3d63e0c0000ddd4a0c6f5e4000008000c000000000008000800ffffffff0800020007000000"], 0x84}}, 0x0) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000ac0)={0x18, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="180100002100000000000000000000008500000075000000a50000002300000095"], &(0x7f0000000180)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x80}, 0x94) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x3000003, 0x204031, 0xffffffffffffffff, 0xffffd000) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f00000001c0)='ifs_status\x00', r7, 0x0, 0x1}, 0x18) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r8, &(0x7f0000000100)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000005, 0x12, r8, 0x0) sendmsg$NL80211_CMD_LEAVE_IBSS(0xffffffffffffffff, &(0x7f0000000540)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000500)={&(0x7f00000004c0)=ANY=[@ANYBLOB=' \x00 \x00', @ANYRES16=0x0, @ANYBLOB="100029bd7000fbdbdf252c0000000c0099000300000037000000"], 0x20}}, 0x4008000) bpf$BPF_LINK_UPDATE(0x1d, &(0x7f0000000080)={r8, r7, 0x4, r7}, 0x10) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x4c02}) r9 = socket(0x2, 0x80805, 0x0) sendmmsg$inet(r9, &(0x7f00000003c0)=[{{&(0x7f0000000000)={0x2, 0x0, @rand_addr=0x64010100}, 0x10, &(0x7f00000000c0)=[{&(0x7f0000000180)="e1", 0x1}], 0x1}}, {{&(0x7f0000000080)={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, &(0x7f0000000140)=[{&(0x7f0000000100)="a7", 0x1}], 0x1}}], 0x2, 0x0) getsockopt$inet_sctp_SCTP_GET_ASSOC_NUMBER(r9, 0x84, 0x1c, &(0x7f0000000380), &(0x7f0000000440)=0x4) ioctl$AUTOFS_IOC_EXPIRE(r0, 0x810c9365, &(0x7f00000001c0)={{0x2, 0x2}, 0x100, './file0\x00'}) readv(r0, &(0x7f0000000040)=[{&(0x7f0000001a80)=""/4112, 0x1010}, {0x0}], 0x2) r10 = socket$kcm(0x2, 0xa, 0x2) ioctl$TUNSETVNETHDRSZ(r0, 0x400454d8, &(0x7f0000000100)=0x730) socket$igmp6(0xa, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r10, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', @link_local}) 968.211463ms ago: executing program 35 (id=1382): r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_GATEWAYS(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000280)={&(0x7f00000001c0)={0x1c, r0, 0x200, 0x70bd29, 0x25dfdbff, {}, [@BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x6}]}, 0x1c}, 0x1, 0x0, 0x0, 0x44}, 0x10) (async) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f0000000380)={0x0, 0x4076cbba9945d516, &(0x7f0000000340)={0x0, 0x14}}, 0x0) getsockname$packet(r1, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) (async) socket$packet(0x11, 0x3, 0x300) (async) socket$inet(0x2, 0x4000000000000001, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r4 = socket$inet6_udp(0xa, 0x2, 0x0) r5 = socket$nl_rdma(0x10, 0x3, 0x14) r6 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$TIPC_CMD_ENABLE_BEARER(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}, 0x1, 0x0, 0x0, 0x44081}, 0x0) (async) sendmsg$TIPC_CMD_SHOW_STATS(r1, &(0x7f0000000540)={&(0x7f0000000480)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000500)={&(0x7f00000004c0)={0x1c, r6, 0x100, 0x70bd28, 0x25dfdbfb, {}, [""]}, 0x1c}, 0x1, 0x0, 0x0, 0x80}, 0x20000000) (async) sendmsg$RDMA_NLDEV_CMD_RES_MR_GET(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000340)=ANY=[@ANYBLOB="2000000004140100000000000000000008000300000000000800", @ANYRES64=r4], 0x20}, 0x1, 0x0, 0x0, 0x4000015}, 0x814) (async, rerun: 32) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) (async, rerun: 32) sendmsg$NFT_BATCH(r3, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000340)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSET={0x3c, 0x9, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x2}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0xfffffffc}]}, @NFT_MSG_NEWSETELEM={0x4c, 0xc, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x6}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x20, 0x3, 0x0, 0x1, [{0x10, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0xc, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0x6, 0x1, "d103"}]}]}, {0xc, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x2}]}]}]}, @NFT_MSG_DELSETELEM={0x2c, 0xe, 0xa, 0x201, 0x0, 0x0, {0xa}, [@NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}]}], {0xdc, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0xdc}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) (async) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)=ANY=[@ANYRES32=r1, @ANYRES32=r2, @ANYBLOB="01180200031100002c0012800e00010069703665727370616e0000001800028008001500a8bc0d00040012"], 0x4c}}, 0x0) (async) r7 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$SO_RDS_TRANSPORT(0xffffffffffffffff, 0x114, 0x8, &(0x7f0000000040)=0xffffffffffffffff, 0x4) (async) sendmsg$nl_route(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000440)={&(0x7f00000002c0)=@newlink={0x54, 0x10, 0x401, 0x70bd28, 0x3, {0x0, 0x0, 0x0, r2, 0x0, 0x1c05}, [@IFLA_LINKINFO={0x34, 0x12, 0x0, 0x1, @ip6erspan={{0xe}, {0x20, 0x2, 0x0, 0x1, [@IFLA_GRE_COLLECT_METADATA={0x4}, @IFLA_GRE_ENCAP_LIMIT={0x5, 0xb, 0x2}, @IFLA_GRE_TTL={0x5, 0x8, 0x2}, @IFLA_GRE_LINK={0x8, 0x1, r2}]}}}]}, 0x54}, 0x1, 0x0, 0x0, 0x10}, 0x12) 0s ago: executing program 36 (id=1385): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000540), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_MAX_CSMA_BACKOFFS(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000580)={0x2c, r1, 0x1, 0x70bd2a, 0x25dfdbfe, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x3}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}]}, 0x2c}, 0x1, 0x0, 0x0, 0x8000}, 0x40814) r2 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_NEW_SEC_KEY(r0, &(0x7f0000000200)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f00000001c0)={&(0x7f0000000080)={0x11c, r2, 0x4, 0x70bd26, 0x25dfdbfe, {}, [@NL802154_ATTR_SEC_KEY={0xd4, 0x30, 0x0, 0x1, [@NL802154_KEY_ATTR_BYTES={0x14, 0x4, "e50443f378201fbf99acaeae0ed0c06c"}, @NL802154_KEY_ATTR_USAGE_FRAMES={0x5, 0x2, 0x2}, @NL802154_KEY_ATTR_USAGE_FRAMES={0x5, 0x2, 0x3}, @NL802154_KEY_ATTR_ID={0x68, 0x1, 0x0, 0x1, [@NL802154_KEY_ID_ATTR_SOURCE_SHORT={0x8, 0x4, 0x7}, @NL802154_KEY_ID_ATTR_IMPLICIT={0x14, 0x3, 0x0, 0x1, [@NL802154_DEV_ADDR_ATTR_MODE={0x8}, @NL802154_DEV_ADDR_ATTR_SHORT={0x6, 0x3, 0xaaa1}]}, @NL802154_KEY_ID_ATTR_SOURCE_EXTENDED={0xc, 0x5, 0x100000001}, @NL802154_KEY_ID_ATTR_IMPLICIT={0x3c, 0x3, 0x0, 0x1, [@NL802154_DEV_ADDR_ATTR_PAN_ID={0x6, 0x1, 0x3}, @NL802154_DEV_ADDR_ATTR_EXTENDED={0xc, 0x4, {0xaaaaaaaaaaaa0002}}, @NL802154_DEV_ADDR_ATTR_MODE={0x8, 0x2, 0x2}, @NL802154_DEV_ADDR_ATTR_PAN_ID={0x6, 0x1, 0xffff}, @NL802154_DEV_ADDR_ATTR_SHORT={0x6, 0x3, 0xaaa0}, @NL802154_DEV_ADDR_ATTR_EXTENDED={0xc, 0x4, {0xaaaaaaaaaaaa0202}}]}]}, @NL802154_KEY_ATTR_USAGE_FRAMES={0x5, 0x2, 0x2}, @NL802154_KEY_ATTR_ID={0x4}, @NL802154_KEY_ATTR_ID={0x30, 0x1, 0x0, 0x1, [@NL802154_KEY_ID_ATTR_SOURCE_SHORT={0x8, 0x4, 0x6}, @NL802154_KEY_ID_ATTR_IMPLICIT={0x4}, @NL802154_KEY_ID_ATTR_SOURCE_EXTENDED={0xc, 0x5, 0x8}, @NL802154_KEY_ID_ATTR_IMPLICIT={0x14, 0x3, 0x0, 0x1, [@NL802154_DEV_ADDR_ATTR_SHORT={0x6}, @NL802154_DEV_ADDR_ATTR_PAN_ID={0x6, 0x1, 0x2}]}]}, @NL802154_KEY_ATTR_USAGE_FRAMES={0x5, 0x2, 0xb}]}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_SEC_KEY={0x2c, 0x30, 0x0, 0x1, [@NL802154_KEY_ATTR_BYTES={0x14, 0x4, "ae5acb24d0c0c8dd7ccf38a9d378ef02"}, @NL802154_KEY_ATTR_BYTES={0x14, 0x4, "ec7f4642535e5d5d5e1a878c2f252df1"}]}]}, 0x11c}, 0x1, 0x0, 0x0, 0x4000009}, 0x1) kernel console output (not intermixed with test programs): 72.736741][ T5833] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 72.745824][ T5833] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 72.753634][ T5833] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 73.357929][ T5839] chnl_net:caif_netlink_parms(): no params data found [ 73.442448][ T5835] chnl_net:caif_netlink_parms(): no params data found [ 73.455778][ T5823] chnl_net:caif_netlink_parms(): no params data found [ 73.577816][ T5822] chnl_net:caif_netlink_parms(): no params data found [ 73.652086][ T5839] bridge0: port 1(bridge_slave_0) entered blocking state [ 73.660072][ T5839] bridge0: port 1(bridge_slave_0) entered disabled state [ 73.667448][ T5839] bridge_slave_0: entered allmulticast mode [ 73.674696][ T5839] bridge_slave_0: entered promiscuous mode [ 73.693301][ T5839] bridge0: port 2(bridge_slave_1) entered blocking state [ 73.700881][ T5839] bridge0: port 2(bridge_slave_1) entered disabled state [ 73.710503][ T5839] bridge_slave_1: entered allmulticast mode [ 73.718837][ T5839] bridge_slave_1: entered promiscuous mode [ 73.732568][ T5829] chnl_net:caif_netlink_parms(): no params data found [ 73.861558][ T5839] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 73.881792][ T5835] bridge0: port 1(bridge_slave_0) entered blocking state [ 73.889043][ T5835] bridge0: port 1(bridge_slave_0) entered disabled state [ 73.896649][ T5835] bridge_slave_0: entered allmulticast mode [ 73.903564][ T5835] bridge_slave_0: entered promiscuous mode [ 73.910860][ T5823] bridge0: port 1(bridge_slave_0) entered blocking state [ 73.918555][ T5823] bridge0: port 1(bridge_slave_0) entered disabled state [ 73.926023][ T5823] bridge_slave_0: entered allmulticast mode [ 73.932966][ T5823] bridge_slave_0: entered promiscuous mode [ 73.947706][ T5839] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 73.962243][ T5835] bridge0: port 2(bridge_slave_1) entered blocking state [ 73.969727][ T5835] bridge0: port 2(bridge_slave_1) entered disabled state [ 73.976965][ T5835] bridge_slave_1: entered allmulticast mode [ 73.983931][ T5835] bridge_slave_1: entered promiscuous mode [ 73.990905][ T5823] bridge0: port 2(bridge_slave_1) entered blocking state [ 73.998197][ T5823] bridge0: port 2(bridge_slave_1) entered disabled state [ 74.005550][ T5823] bridge_slave_1: entered allmulticast mode [ 74.012580][ T5823] bridge_slave_1: entered promiscuous mode [ 74.123479][ T5835] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 74.143691][ T5822] bridge0: port 1(bridge_slave_0) entered blocking state [ 74.151053][ T5822] bridge0: port 1(bridge_slave_0) entered disabled state [ 74.158835][ T5822] bridge_slave_0: entered allmulticast mode [ 74.166063][ T5822] bridge_slave_0: entered promiscuous mode [ 74.175661][ T5839] team0: Port device team_slave_0 added [ 74.199108][ T5835] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 74.211973][ T5823] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 74.222066][ T5822] bridge0: port 2(bridge_slave_1) entered blocking state [ 74.229374][ T5822] bridge0: port 2(bridge_slave_1) entered disabled state [ 74.236947][ T5822] bridge_slave_1: entered allmulticast mode [ 74.243834][ T5822] bridge_slave_1: entered promiscuous mode [ 74.254997][ T5839] team0: Port device team_slave_1 added [ 74.270561][ T5829] bridge0: port 1(bridge_slave_0) entered blocking state [ 74.277790][ T5829] bridge0: port 1(bridge_slave_0) entered disabled state [ 74.285173][ T5829] bridge_slave_0: entered allmulticast mode [ 74.292099][ T5829] bridge_slave_0: entered promiscuous mode [ 74.316011][ T5823] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 74.348327][ T5829] bridge0: port 2(bridge_slave_1) entered blocking state [ 74.355543][ T5829] bridge0: port 2(bridge_slave_1) entered disabled state [ 74.362673][ T5829] bridge_slave_1: entered allmulticast mode [ 74.370447][ T5829] bridge_slave_1: entered promiscuous mode [ 74.410134][ T5839] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 74.417233][ T5839] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 74.444177][ T5839] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 74.468967][ T5835] team0: Port device team_slave_0 added [ 74.488764][ T5822] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 74.498753][ T5839] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 74.505840][ T5839] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 74.532269][ T5839] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 74.558237][ T5835] team0: Port device team_slave_1 added [ 74.565748][ T5823] team0: Port device team_slave_0 added [ 74.573824][ T5822] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 74.610092][ T5829] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 74.632622][ T5823] team0: Port device team_slave_1 added [ 74.653327][ T5822] team0: Port device team_slave_0 added [ 74.662451][ T5829] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 74.703641][ T5822] team0: Port device team_slave_1 added [ 74.733609][ T5835] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 74.735287][ T5145] Bluetooth: hci0: command tx timeout [ 74.740966][ T5833] Bluetooth: hci1: command tx timeout [ 74.746408][ T5145] Bluetooth: hci2: command tx timeout [ 74.752549][ T5835] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 74.783708][ T5835] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 74.814647][ T5145] Bluetooth: hci4: command tx timeout [ 74.824325][ T5145] Bluetooth: hci3: command tx timeout [ 74.845528][ T5835] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 74.852490][ T5835] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 74.878767][ T5835] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 74.890360][ T5823] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 74.897654][ T5823] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 74.923710][ T5823] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 74.940439][ T5839] hsr_slave_0: entered promiscuous mode [ 74.947114][ T5839] hsr_slave_1: entered promiscuous mode [ 74.954050][ T5822] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 74.961265][ T5822] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 74.987256][ T5822] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 75.000487][ T5829] team0: Port device team_slave_0 added [ 75.013384][ T5823] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 75.020408][ T5823] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 75.046596][ T5823] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 75.066574][ T5822] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 75.073527][ T5822] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 75.100000][ T5822] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 75.112493][ T5829] team0: Port device team_slave_1 added [ 75.174031][ T5835] hsr_slave_0: entered promiscuous mode [ 75.180383][ T5835] hsr_slave_1: entered promiscuous mode [ 75.186912][ T5835] debugfs: 'hsr0' already exists in 'hsr' [ 75.192699][ T5835] Cannot create hsr debugfs directory [ 75.249035][ T5829] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 75.256481][ T5829] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 75.283151][ T5829] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 75.334787][ T5829] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 75.341788][ T5829] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 75.367708][ T5829] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 75.394474][ T5823] hsr_slave_0: entered promiscuous mode [ 75.400804][ T5823] hsr_slave_1: entered promiscuous mode [ 75.407281][ T5823] debugfs: 'hsr0' already exists in 'hsr' [ 75.413013][ T5823] Cannot create hsr debugfs directory [ 75.457460][ T5822] hsr_slave_0: entered promiscuous mode [ 75.463667][ T5822] hsr_slave_1: entered promiscuous mode [ 75.469975][ T5822] debugfs: 'hsr0' already exists in 'hsr' [ 75.476240][ T5822] Cannot create hsr debugfs directory [ 75.671949][ T5829] hsr_slave_0: entered promiscuous mode [ 75.678327][ T5829] hsr_slave_1: entered promiscuous mode [ 75.685172][ T5829] debugfs: 'hsr0' already exists in 'hsr' [ 75.690908][ T5829] Cannot create hsr debugfs directory [ 75.925552][ T5839] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 75.961795][ T5839] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 75.988170][ T5839] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 76.020984][ T5839] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 76.111435][ T5835] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 76.122495][ T5835] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 76.139587][ T5835] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 76.168537][ T5835] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 76.239466][ T5823] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 76.250506][ T5823] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 76.260532][ T5823] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 76.271654][ T5823] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 76.388634][ T5822] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 76.401005][ T5822] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 76.411655][ T5822] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 76.421677][ T5822] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 76.474064][ T5839] 8021q: adding VLAN 0 to HW filter on device bond0 [ 76.520025][ T5829] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 76.541544][ T5839] 8021q: adding VLAN 0 to HW filter on device team0 [ 76.555749][ T5829] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 76.565929][ T5829] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 76.583411][ T2998] bridge0: port 1(bridge_slave_0) entered blocking state [ 76.590713][ T2998] bridge0: port 1(bridge_slave_0) entered forwarding state [ 76.606851][ T5829] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 76.640498][ T2998] bridge0: port 2(bridge_slave_1) entered blocking state [ 76.647636][ T2998] bridge0: port 2(bridge_slave_1) entered forwarding state [ 76.751165][ T5835] 8021q: adding VLAN 0 to HW filter on device bond0 [ 76.786763][ T5823] 8021q: adding VLAN 0 to HW filter on device bond0 [ 76.814605][ T5145] Bluetooth: hci1: command tx timeout [ 76.814902][ T5833] Bluetooth: hci2: command tx timeout [ 76.820041][ T5145] Bluetooth: hci0: command tx timeout [ 76.843955][ T5823] 8021q: adding VLAN 0 to HW filter on device team0 [ 76.856568][ T5835] 8021q: adding VLAN 0 to HW filter on device team0 [ 76.894835][ T5145] Bluetooth: hci3: command tx timeout [ 76.894876][ T5833] Bluetooth: hci4: command tx timeout [ 76.908550][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 76.915743][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 76.928530][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 76.935711][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 76.959788][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 76.966975][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 76.981524][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 76.988694][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 77.017515][ T5822] 8021q: adding VLAN 0 to HW filter on device bond0 [ 77.093916][ T5829] 8021q: adding VLAN 0 to HW filter on device bond0 [ 77.147094][ T5822] 8021q: adding VLAN 0 to HW filter on device team0 [ 77.172039][ T5835] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 77.182980][ T5835] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 77.229437][ T5839] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 77.278061][ T60] bridge0: port 1(bridge_slave_0) entered blocking state [ 77.285249][ T60] bridge0: port 1(bridge_slave_0) entered forwarding state [ 77.306758][ T60] bridge0: port 2(bridge_slave_1) entered blocking state [ 77.313942][ T60] bridge0: port 2(bridge_slave_1) entered forwarding state [ 77.369263][ T5829] 8021q: adding VLAN 0 to HW filter on device team0 [ 77.426877][ T60] bridge0: port 1(bridge_slave_0) entered blocking state [ 77.434018][ T60] bridge0: port 1(bridge_slave_0) entered forwarding state [ 77.512827][ T60] bridge0: port 2(bridge_slave_1) entered blocking state [ 77.520021][ T60] bridge0: port 2(bridge_slave_1) entered forwarding state [ 77.626004][ T5839] veth0_vlan: entered promiscuous mode [ 77.643181][ T5823] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 77.666763][ T5835] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 77.680039][ T5839] veth1_vlan: entered promiscuous mode [ 77.706224][ T5829] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 77.722155][ T5829] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 77.853143][ T5839] veth0_macvtap: entered promiscuous mode [ 77.887247][ T5835] veth0_vlan: entered promiscuous mode [ 77.897706][ T5839] veth1_macvtap: entered promiscuous mode [ 77.916179][ T5823] veth0_vlan: entered promiscuous mode [ 77.962684][ T5823] veth1_vlan: entered promiscuous mode [ 77.977280][ T5822] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 77.990177][ T5839] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 78.000741][ T5835] veth1_vlan: entered promiscuous mode [ 78.026300][ T5839] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 78.083447][ T60] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 78.093490][ T60] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 78.111937][ T5835] veth0_macvtap: entered promiscuous mode [ 78.121484][ T60] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 78.141261][ T60] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 78.161961][ T5835] veth1_macvtap: entered promiscuous mode [ 78.171267][ T5829] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 78.201715][ T5823] veth0_macvtap: entered promiscuous mode [ 78.261670][ T5823] veth1_macvtap: entered promiscuous mode [ 78.312397][ T5835] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 78.352606][ T5822] veth0_vlan: entered promiscuous mode [ 78.372897][ T5835] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 78.403688][ T2998] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 78.409892][ T5822] veth1_vlan: entered promiscuous mode [ 78.428882][ T3542] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 78.434269][ T2998] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 78.445632][ T3542] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 78.457400][ T3542] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 78.489188][ T3542] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 78.530518][ T5823] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 78.578493][ T5823] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 78.590293][ T3542] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 78.605041][ T3542] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 78.620091][ T5822] veth0_macvtap: entered promiscuous mode [ 78.662321][ T3542] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 78.673777][ T5822] veth1_macvtap: entered promiscuous mode [ 78.693712][ T3542] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 78.710958][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 78.727946][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 78.728314][ T3542] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 78.756954][ T5839] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 78.783992][ T3542] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 78.810957][ T5822] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 78.863235][ T5822] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 78.894731][ T5833] Bluetooth: hci0: command tx timeout [ 78.905776][ T5833] Bluetooth: hci2: command tx timeout [ 78.907306][ T5145] Bluetooth: hci1: command tx timeout [ 78.915042][ T1047] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 78.946738][ T1047] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 78.948704][ T36] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 78.972232][ T5829] veth0_vlan: entered promiscuous mode [ 78.981114][ T5145] Bluetooth: hci3: command tx timeout [ 78.985619][ T5833] Bluetooth: hci4: command tx timeout [ 79.000092][ T36] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 79.009625][ T36] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 79.026721][ T5942] syz.3.4 uses obsolete (PF_INET,SOCK_PACKET) [ 79.054794][ T1047] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 79.065771][ T1047] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 79.074407][ T36] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 79.142363][ T5829] veth1_vlan: entered promiscuous mode [ 79.172170][ T5944] netlink: 'syz.3.6': attribute type 10 has an invalid length. [ 79.223317][ T5944] 8021q: adding VLAN 0 to HW filter on device team0 [ 79.236987][ T5944] bond0: (slave team0): Enslaving as an active interface with an up link [ 79.266455][ T2998] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 79.282180][ T2998] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 79.355078][ T5829] veth0_macvtap: entered promiscuous mode [ 79.427031][ T36] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 79.436016][ T36] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 79.456497][ T5829] veth1_macvtap: entered promiscuous mode [ 79.480334][ T5953] netlink: 'syz.0.7': attribute type 30 has an invalid length. [ 79.542466][ T5953] workqueue: Failed to create a rescuer kthread for wq "bond1": -EINTR [ 79.551379][ T5829] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 79.589379][ T1047] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 79.590739][ T5829] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 79.613794][ T1047] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 79.642656][ T36] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 79.665744][ T36] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 79.750152][ T36] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 79.762230][ T36] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 79.786485][ T5969] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 79.899269][ T5968] mac80211_hwsim hwsim3 wlan1: entered allmulticast mode [ 79.923070][ T5970] warning: `syz.3.10' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 79.945948][ T5968] netlink: 'syz.3.10': attribute type 10 has an invalid length. [ 79.970623][ T5981] netlink: 'syz.1.12': attribute type 1 has an invalid length. [ 79.982533][ T5983] netlink: 4 bytes leftover after parsing attributes in process `syz.1.12'. [ 79.995124][ T5982] netlink: 8 bytes leftover after parsing attributes in process `syz.1.12'. [ 80.008246][ T5968] mac80211_hwsim hwsim3 wlan1: left allmulticast mode [ 80.098166][ T3542] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 80.136350][ T3542] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 80.187508][ T5991] netlink: 4 bytes leftover after parsing attributes in process `syz.0.14'. [ 80.285445][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 80.302534][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 80.603581][ T6009] netlink: 28 bytes leftover after parsing attributes in process `syz.2.19'. [ 80.747787][ T6011] netlink: 12 bytes leftover after parsing attributes in process `syz.4.5'. [ 80.842062][ T6016] netlink: 'syz.1.20': attribute type 1 has an invalid length. [ 80.856016][ T6015] netlink: 12 bytes leftover after parsing attributes in process `syz.4.5'. [ 80.916423][ T6022] netlink: 8 bytes leftover after parsing attributes in process `syz.1.20'. [ 80.980408][ T5145] Bluetooth: hci2: command tx timeout [ 80.980421][ T5832] Bluetooth: hci0: command tx timeout [ 80.980467][ T5833] Bluetooth: hci1: command tx timeout [ 81.029632][ T6015] netlink: 280 bytes leftover after parsing attributes in process `syz.4.5'. [ 81.055434][ T5833] Bluetooth: hci4: command tx timeout [ 81.056072][ T5145] Bluetooth: hci3: command tx timeout [ 81.757001][ T6051] nbd0: detected capacity change from 0 to 127 [ 81.771400][ T6056] netlink: 12 bytes leftover after parsing attributes in process `syz.3.25'. [ 82.133079][ T6068] FAULT_INJECTION: forcing a failure. [ 82.133079][ T6068] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 82.168968][ T6068] CPU: 0 UID: 0 PID: 6068 Comm: syz.2.28 Not tainted syzkaller #0 PREEMPT(full) [ 82.168995][ T6068] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 82.169012][ T6068] Call Trace: [ 82.169019][ T6068] [ 82.169027][ T6068] dump_stack_lvl+0x189/0x250 [ 82.169061][ T6068] ? __pfx____ratelimit+0x10/0x10 [ 82.169085][ T6068] ? __pfx_dump_stack_lvl+0x10/0x10 [ 82.169107][ T6068] ? __pfx__printk+0x10/0x10 [ 82.169138][ T6068] should_fail_ex+0x414/0x560 [ 82.169167][ T6068] _copy_to_user+0x31/0xb0 [ 82.169191][ T6068] simple_read_from_buffer+0xe1/0x170 [ 82.169220][ T6068] proc_fail_nth_read+0x1b3/0x220 [ 82.169245][ T6068] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 82.169269][ T6068] ? rw_verify_area+0x2a6/0x4d0 [ 82.169290][ T6068] ? __lock_acquire+0xab9/0xd20 [ 82.169306][ T6068] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 82.169328][ T6068] vfs_read+0x200/0xa30 [ 82.169349][ T6068] ? fdget_pos+0x247/0x320 [ 82.169370][ T6068] ? __pfx___mutex_lock+0x10/0x10 [ 82.169389][ T6068] ? __pfx_vfs_read+0x10/0x10 [ 82.169412][ T6068] ? __fget_files+0x2a/0x420 [ 82.169432][ T6068] ? __fget_files+0x3a0/0x420 [ 82.169448][ T6068] ? __fget_files+0x2a/0x420 [ 82.169473][ T6068] ksys_read+0x145/0x250 [ 82.169498][ T6068] ? __pfx_ksys_read+0x10/0x10 [ 82.169524][ T6068] ? do_syscall_64+0xbe/0xfa0 [ 82.169545][ T6068] do_syscall_64+0xfa/0xfa0 [ 82.169561][ T6068] ? lockdep_hardirqs_on+0x9c/0x150 [ 82.169577][ T6068] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 82.169594][ T6068] ? clear_bhb_loop+0x60/0xb0 [ 82.169614][ T6068] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 82.169631][ T6068] RIP: 0033:0x7fe3e638e0dc [ 82.169654][ T6068] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 82.169667][ T6068] RSP: 002b:00007fe3e7184030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 82.169687][ T6068] RAX: ffffffffffffffda RBX: 00007fe3e65e5fa0 RCX: 00007fe3e638e0dc [ 82.169699][ T6068] RDX: 000000000000000f RSI: 00007fe3e71840a0 RDI: 0000000000000004 [ 82.169709][ T6068] RBP: 00007fe3e7184090 R08: 0000000000000000 R09: 0000000000000000 [ 82.169719][ T6068] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000001 [ 82.169729][ T6068] R13: 00007fe3e65e6038 R14: 00007fe3e65e5fa0 R15: 00007fffd5625db8 [ 82.169760][ T6068] [ 82.521758][ T5145] block nbd0: Receive control failed (result -104) [ 82.665162][ T6074] Can't find ip_set type hash:n [ 83.187433][ T6104] Zero length message leads to an empty skb [ 83.200842][ T6106] netlink: 8 bytes leftover after parsing attributes in process `syz.4.36'. [ 83.270896][ T6108] tipc: Started in network mode [ 83.276903][ T6108] tipc: Node identity e0000001, cluster identity 4711 [ 83.283826][ T6108] tipc: Enabling of bearer rejected, failed to enable media [ 83.348875][ T6106] bond1: option broadcast_neighbor: invalid value (5) [ 83.368953][ T6106] bond1 (unregistering): Released all slaves [ 83.466865][ T6111] 8021q: VLANs not supported on vcan0 [ 83.797593][ T6108] syzkaller1: entered promiscuous mode [ 83.814438][ T6108] syzkaller1: entered allmulticast mode [ 85.136331][ T56] block nbd0: Connection timed out, retrying (0/1 alive) [ 85.148672][ T56] block nbd0: Connection timed out, retrying (0/1 alive) [ 85.157527][ T56] block nbd0: Connection timed out, retrying (0/1 alive) [ 85.165085][ T11] block nbd0: Dead connection, failed to find a fallback [ 85.173411][ T11] block nbd0: shutting down sockets [ 85.179323][ T56] block nbd0: Connection timed out, retrying (0/1 alive) [ 85.187371][ T11] I/O error, dev nbd0, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 85.197159][ T11] Buffer I/O error on dev nbd0, logical block 1, async page read [ 85.205637][ T11] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 85.215509][ T11] Buffer I/O error on dev nbd0, logical block 0, async page read [ 85.223490][ T11] I/O error, dev nbd0, sector 6 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 85.234319][ T11] Buffer I/O error on dev nbd0, logical block 3, async page read [ 85.241367][ T6214] __nla_validate_parse: 10 callbacks suppressed [ 85.241384][ T6214] netlink: 36 bytes leftover after parsing attributes in process `syz.4.59'. [ 85.242941][ T11] I/O error, dev nbd0, sector 4 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 85.268005][ T11] Buffer I/O error on dev nbd0, logical block 2, async page read [ 85.276652][ T5841] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 85.289796][ T5841] Buffer I/O error on dev nbd0, logical block 0, async page read [ 85.307041][ T5841] I/O error, dev nbd0, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 85.309931][ T6222] netlink: 8 bytes leftover after parsing attributes in process `syz.3.60'. [ 85.333147][ T5841] Buffer I/O error on dev nbd0, logical block 1, async page read [ 85.342957][ T5841] I/O error, dev nbd0, sector 4 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 85.354542][ T5841] Buffer I/O error on dev nbd0, logical block 2, async page read [ 85.362567][ T5841] I/O error, dev nbd0, sector 6 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 85.372770][ T5841] Buffer I/O error on dev nbd0, logical block 3, async page read [ 85.381134][ T5841] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 85.390398][ T5841] Buffer I/O error on dev nbd0, logical block 0, async page read [ 85.398436][ T5841] I/O error, dev nbd0, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 85.419180][ T5841] Buffer I/O error on dev nbd0, logical block 1, async page read [ 85.449604][ T5841] ldm_validate_partition_table(): Disk read failed. [ 85.483494][ T5841] Dev nbd0: unable to read RDB block 0 [ 85.506215][ T5841] nbd0: unable to read partition table [ 85.590897][ T5841] ldm_validate_partition_table(): Disk read failed. [ 85.638530][ T5841] Dev nbd0: unable to read RDB block 0 [ 85.682620][ T5841] nbd0: unable to read partition table [ 86.059644][ T6251] netlink: 272 bytes leftover after parsing attributes in process `syz.2.65'. [ 86.293627][ T6264] netlink: 'syz.1.70': attribute type 2 has an invalid length. [ 86.370031][ T6269] Illegal XDP return value 4294967262 on prog (id 30) dev N/A, expect packet loss! [ 86.613122][ T6281] netlink: 'syz.3.73': attribute type 13 has an invalid length. [ 86.632570][ T6281] netlink: 'syz.3.73': attribute type 17 has an invalid length. [ 86.741708][ T10] cfg80211: failed to load regulatory.db [ 86.891637][ T6300] netlink: 12 bytes leftover after parsing attributes in process `syz.4.78'. [ 87.009458][ T6281] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 87.106581][ T6311] netlink: 148 bytes leftover after parsing attributes in process `syz.1.81'. [ 87.534693][ T6332] netlink: 132 bytes leftover after parsing attributes in process `syz.4.88'. [ 87.581318][ T6335] netlink: 4 bytes leftover after parsing attributes in process `syz.3.89'. [ 87.601473][ T6335] netlink: 16 bytes leftover after parsing attributes in process `syz.3.89'. [ 87.789226][ T6345] netlink: 240 bytes leftover after parsing attributes in process `syz.1.90'. [ 87.806329][ T6347] netlink: 4 bytes leftover after parsing attributes in process `syz.3.93'. [ 87.833696][ T6338] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 88.301911][ T6356] bond1: option primary: mode dependency failed, not supported in mode balance-rr(0) [ 88.407381][ T6356] bond1 (unregistering): Released all slaves [ 88.678903][ T6386] tipc: Started in network mode [ 88.683833][ T6386] tipc: Node identity ac14140f, cluster identity 4711 [ 88.722804][ T6386] tipc: New replicast peer: 255.255.255.255 [ 88.766677][ T6386] tipc: Enabled bearer , priority 10 [ 88.800374][ T6391] netlink: 'syz.3.100': attribute type 11 has an invalid length. [ 88.808493][ T6397] SET target dimension over the limit! [ 88.820848][ T6391] netlink: 'syz.3.100': attribute type 11 has an invalid length. [ 89.001976][ T6386] bridge1: entered promiscuous mode [ 89.017017][ T6386] bridge1: entered allmulticast mode [ 89.139599][ T6408] netlink: 'syz.2.107': attribute type 15 has an invalid length. [ 89.183840][ T6412] netlink: 'syz.0.108': attribute type 21 has an invalid length. [ 89.192082][ T6412] IPv6: NLM_F_CREATE should be specified when creating new route [ 89.210707][ T6416] sctp: [Deprecated]: syz.3.109 (pid 6416) Use of int in max_burst socket option. [ 89.210707][ T6416] Use struct sctp_assoc_value instead [ 89.226492][ T6412] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 89.233957][ T6412] IPv6: NLM_F_CREATE should be set when creating new route [ 89.241315][ T6412] IPv6: NLM_F_CREATE should be set when creating new route [ 89.244073][ T6410] 8021q: adding VLAN 0 to HW filter on device bond1 [ 89.248775][ T6412] IPv6: NLM_F_CREATE should be set when creating new route [ 89.277395][ T6412] mac80211_hwsim hwsim4 wlan0: entered promiscuous mode [ 89.285416][ T6412] A link change request failed with some changes committed already. Interface wlan0 may have been left with an inconsistent configuration, please check. [ 89.888694][ T10] tipc: Node number set to 2886997007 [ 91.249899][ T6515] netlink: 'syz.0.132': attribute type 1 has an invalid length. [ 91.647979][ T6531] __nla_validate_parse: 6 callbacks suppressed [ 91.647997][ T6531] netlink: 28 bytes leftover after parsing attributes in process `syz.4.133'. [ 91.684351][ T6531] netlink: 8 bytes leftover after parsing attributes in process `syz.4.133'. [ 91.693290][ T6531] netlink: 4 bytes leftover after parsing attributes in process `syz.4.133'. [ 91.702407][ T6531] netlink: 8 bytes leftover after parsing attributes in process `syz.4.133'. [ 91.711895][ T6531] netlink: 8 bytes leftover after parsing attributes in process `syz.4.133'. [ 91.721523][ T6531] netlink: 4 bytes leftover after parsing attributes in process `syz.4.133'. [ 91.730868][ T6531] netlink: 164 bytes leftover after parsing attributes in process `syz.4.133'. [ 91.740150][ T6531] netlink: 16488 bytes leftover after parsing attributes in process `syz.4.133'. [ 91.758186][ T6540] SET target dimension over the limit! [ 91.871041][ T6545] tipc: Enabling of bearer rejected, failed to enable media [ 91.902659][ T6546] netlink: 12 bytes leftover after parsing attributes in process `syz.3.138'. [ 92.029444][ T6548] netlink: 'syz.1.139': attribute type 13 has an invalid length. [ 92.531537][ T6570] netlink: 8 bytes leftover after parsing attributes in process `syz.4.143'. [ 93.492441][ T6617] syzkaller0: entered promiscuous mode [ 93.506117][ T6617] syzkaller0: entered allmulticast mode [ 94.099707][ T6634] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 94.106312][ T6631] netlink: 'syz.4.158': attribute type 1 has an invalid length. [ 94.120783][ T6635] bridge_slave_0: left allmulticast mode [ 94.134605][ T6635] bridge_slave_0: left promiscuous mode [ 94.154699][ T6635] bridge0: port 1(bridge_slave_0) entered disabled state [ 94.191414][ T6635] bridge_slave_1: left allmulticast mode [ 94.203229][ T6635] bridge_slave_1: left promiscuous mode [ 94.211973][ T6635] bridge0: port 2(bridge_slave_1) entered disabled state [ 94.231078][ T6635] bond0: (slave bond_slave_0): Releasing backup interface [ 94.232879][ T6646] netlink: 'syz.2.159': attribute type 10 has an invalid length. [ 94.252888][ T6635] bond0: (slave bond_slave_1): Releasing backup interface [ 94.280147][ T6635] team0: Port device team_slave_0 removed [ 94.296107][ T6635] team0: Port device team_slave_1 removed [ 94.303865][ T6635] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 94.312486][ T6635] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 94.321763][ T6635] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 94.329939][ T6635] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 94.339170][ T6635] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 94.468672][ T6637] bond3: (slave vxcan3): The slave device specified does not support setting the MAC address [ 94.480661][ T6637] bond3: (slave vxcan3): Error -95 calling set_mac_address [ 94.527870][ T6644] bond3: (slave gretap1): making interface the new active one [ 94.553130][ T6644] bond3: (slave gretap1): Enslaving as an active interface with an up link [ 94.584902][ T6646] 8021q: adding VLAN 0 to HW filter on device bond0 [ 94.598610][ T6646] bond0: (slave wlan1): Enslaving as an active interface with an up link [ 94.624139][ T6649] macvlan2: entered promiscuous mode [ 94.630972][ T6649] macvlan2: entered allmulticast mode [ 94.646015][ T6649] bond3: entered promiscuous mode [ 94.653645][ T6649] gretap1: entered promiscuous mode [ 94.660779][ T6649] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 94.670618][ T6649] bond3: (slave macvlan2): the slave hw address is in use by the bond; giving it the hw address of gretap1 [ 94.683552][ T6649] bond3: left promiscuous mode [ 94.688397][ T6649] gretap1: left promiscuous mode [ 94.729467][ T6658] wg1 speed is unknown, defaulting to 1000 [ 94.800037][ T6658] wg1 speed is unknown, defaulting to 1000 [ 94.888799][ T6658] wg1 speed is unknown, defaulting to 1000 [ 94.896341][ T6650] syz.2.159 (6650) used greatest stack depth: 17832 bytes left [ 94.920695][ T6658] iwpm_register_pid: Unable to send a nlmsg (client = 2) [ 94.972011][ T6658] infiniband syz0: RDMA CMA: cma_listen_on_dev, error -98 [ 95.047033][ T6658] wg1 speed is unknown, defaulting to 1000 [ 95.065462][ T6658] wg1 speed is unknown, defaulting to 1000 [ 95.073290][ T6658] wg1 speed is unknown, defaulting to 1000 [ 95.082823][ T6658] wg1 speed is unknown, defaulting to 1000 [ 95.093609][ T6658] wg1 speed is unknown, defaulting to 1000 [ 95.117686][ T6682] syz_tun: entered promiscuous mode [ 95.159575][ T6682] netlink: 'syz.2.169': attribute type 30 has an invalid length. [ 95.291288][ T6687] wg1 speed is unknown, defaulting to 1000 [ 95.743157][ T6703] wg1 speed is unknown, defaulting to 1000 [ 95.761018][ T6713] netlink: 'syz.0.178': attribute type 10 has an invalid length. [ 95.797113][ T6713] team0: Port device dummy0 added [ 95.916891][ T6713] bond1: option resend_igmp: invalid value (2878) [ 95.933600][ T6713] bond1: option resend_igmp: allowed values 0 - 255 [ 95.949321][ T6713] bond1 (unregistering): Released all slaves [ 96.119383][ T6722] wg1 speed is unknown, defaulting to 1000 [ 96.642076][ T6740] netlink: 'syz.1.182': attribute type 12 has an invalid length. [ 96.654496][ T6740] __nla_validate_parse: 10 callbacks suppressed [ 96.654512][ T6740] netlink: 120 bytes leftover after parsing attributes in process `syz.1.182'. [ 96.830837][ T6758] netlink: 4 bytes leftover after parsing attributes in process `syz.1.185'. [ 96.886953][ T6744] wg1 speed is unknown, defaulting to 1000 [ 96.984923][ T6760] tipc: Enabled bearer , priority 0 [ 97.027662][ T6754] syzkaller0: entered promiscuous mode [ 97.034681][ T6754] syzkaller0: entered allmulticast mode [ 97.139828][ T6754] tipc: Resetting bearer [ 97.204573][ T6753] tipc: Resetting bearer [ 97.239017][ T6753] tipc: Disabling bearer [ 97.389632][ T6768] tipc: Started in network mode [ 97.394652][ T6768] tipc: Node identity de54b920c172, cluster identity 4711 [ 97.408820][ T6768] tipc: Enabled bearer , priority 0 [ 97.433941][ T6769] syzkaller0: entered promiscuous mode [ 97.455505][ T6769] syzkaller0: entered allmulticast mode [ 97.535841][ T6773] tipc: Enabling of bearer rejected, already enabled [ 97.561170][ T6781] netlink: 'syz.1.190': attribute type 3 has an invalid length. [ 97.628532][ T6778] netlink: 'syz.2.189': attribute type 12 has an invalid length. [ 97.668219][ T6768] tipc: Resetting bearer [ 97.699122][ T6768] tipc: Disabling bearer [ 97.929564][ T6790] wg1 speed is unknown, defaulting to 1000 [ 98.301544][ T6810] IPVS: set_ctl: invalid protocol: 0 0.0.0.0:0 [ 98.353879][ T6805] wg1 speed is unknown, defaulting to 1000 [ 98.557680][ T6820] netlink: 104 bytes leftover after parsing attributes in process `syz.0.199'. [ 98.838287][ T6830] netlink: 12 bytes leftover after parsing attributes in process `syz.4.204'. [ 99.470258][ T6862] netlink: 8 bytes leftover after parsing attributes in process `syz.0.212'. [ 99.568281][ T6867] xt_CHECKSUM: CHECKSUM should be avoided. If really needed, restrict with "-p udp" and only use in OUTPUT [ 99.813972][ T6878] wg1 speed is unknown, defaulting to 1000 [ 100.169421][ T6898] netlink: 'syz.1.220': attribute type 13 has an invalid length. [ 100.216964][ T6898] netlink: 'syz.1.220': attribute type 17 has an invalid length. [ 100.413682][ T6896] wg1 speed is unknown, defaulting to 1000 [ 100.535578][ T6890] netlink: 45 bytes leftover after parsing attributes in process `syz.4.217'. [ 100.683090][ T6898] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 100.703762][ T6922] openvswitch: netlink: Missing valid actions attribute. [ 100.712020][ T6922] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 100.751634][ T6900] bond1: option lacp_active: mode dependency failed, not supported in mode balance-rr(0) [ 100.769855][ T6900] bond1 (unregistering): Released all slaves [ 100.977876][ T6901] wg1 speed is unknown, defaulting to 1000 [ 101.377176][ T6946] netlink: 68 bytes leftover after parsing attributes in process `syz.3.232'. [ 101.413999][ T6938] erspan0: entered promiscuous mode [ 101.432278][ T6938] vlan2: entered promiscuous mode [ 101.443908][ T6950] ip6t_REJECT: TCP_RESET illegal for non-tcp [ 101.450889][ T6938] vlan2: entered allmulticast mode [ 101.467856][ T6938] erspan0: entered allmulticast mode [ 101.917392][ T6972] raw_sendmsg: syz.2.242 forgot to set AF_INET. Fix it! [ 102.045609][ T6975] bond1: option ad_select: invalid value (232) [ 102.053226][ T6975] bond1 (unregistering): Released all slaves [ 102.182939][ T6977] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 102.252308][ T6989] netlink: 256 bytes leftover after parsing attributes in process `syz.2.246'. [ 102.283651][ T6981] netlink: 40 bytes leftover after parsing attributes in process `syz.2.246'. [ 102.344022][ T6977] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 102.496199][ T6977] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 102.724574][ T7015] netlink: 3 bytes leftover after parsing attributes in process `syz.2.253'. [ 102.748395][ T6977] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 102.824125][ T7015] 0ªX¹¦À: renamed from caif0 [ 102.839375][ T7015] 0ªX¹¦À: entered allmulticast mode [ 102.854966][ T7015] A link change request failed with some changes committed already. Interface 60ªX¹¦À may have been left with an inconsistent configuration, please check. [ 103.051639][ T49] netdevsim netdevsim4 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 103.130634][ T49] netdevsim netdevsim4 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 103.140248][ T7036] wg1 speed is unknown, defaulting to 1000 [ 103.195399][ T49] netdevsim netdevsim4 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 103.249726][ T49] netdevsim netdevsim4 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 103.270353][ T7042] netlink: 124 bytes leftover after parsing attributes in process `syz.3.261'. [ 103.300065][ T7042] netlink: 'syz.3.261': attribute type 8 has an invalid length. [ 103.379398][ T7042] bond1: entered promiscuous mode [ 103.385803][ T7042] bond1: entered allmulticast mode [ 103.391373][ T7042] 8021q: adding VLAN 0 to HW filter on device bond1 [ 103.411320][ T7051] netlink: 236 bytes leftover after parsing attributes in process `syz.4.263'. [ 103.425768][ T7051] netlink: 7 bytes leftover after parsing attributes in process `syz.4.263'. [ 103.517584][ T7051] netlink: 7 bytes leftover after parsing attributes in process `syz.4.263'. [ 104.052089][ T7064] hsr0: entered promiscuous mode [ 104.060626][ T7064] macsec1: entered promiscuous mode [ 104.080099][ T7082] netlink: 'syz.1.272': attribute type 10 has an invalid length. [ 104.080889][ T7064] macsec1: entered allmulticast mode [ 104.103158][ T7064] hsr0: entered allmulticast mode [ 104.110006][ T7064] hsr_slave_0: entered allmulticast mode [ 104.117412][ T7064] hsr_slave_1: entered allmulticast mode [ 104.261669][ T7064] hsr0: left allmulticast mode [ 104.268028][ T7064] hsr_slave_0: left allmulticast mode [ 104.273538][ T7064] hsr_slave_1: left allmulticast mode [ 104.303851][ T7082] bridge0: port 3(macsec0) entered blocking state [ 104.341837][ T7082] bridge0: port 3(macsec0) entered disabled state [ 104.372341][ T7082] macsec0: entered allmulticast mode [ 104.395196][ T7082] veth1_macvtap: entered allmulticast mode [ 104.414542][ T7082] macsec0: entered promiscuous mode [ 104.424076][ T7082] bridge0: port 3(macsec0) entered blocking state [ 104.430839][ T7082] bridge0: port 3(macsec0) entered forwarding state [ 104.464706][ T7095] netlink: 16 bytes leftover after parsing attributes in process `syz.4.274'. [ 104.663418][ T7109] : renamed from bond_slave_0 (while UP) [ 104.703182][ T7110] netlink: 'syz.0.278': attribute type 27 has an invalid length. [ 104.821319][ T7110] wg1 speed is unknown, defaulting to 1000 [ 104.842769][ T7114] sctp: [Deprecated]: syz.2.279 (pid 7114) Use of int in maxseg socket option. [ 104.842769][ T7114] Use struct sctp_assoc_value instead [ 104.935860][ T7111] wg1 speed is unknown, defaulting to 1000 [ 105.169809][ T7122] wg1 speed is unknown, defaulting to 1000 [ 105.245438][ T7126] tipc: Started in network mode [ 105.251418][ T7126] tipc: Node identity cad7c52eccef, cluster identity 4711 [ 105.261607][ T7126] tipc: Enabled bearer , priority 0 [ 105.334051][ T7124] syzkaller0: entered promiscuous mode [ 105.343494][ T7124] syzkaller0: entered allmulticast mode [ 105.485927][ T7131] tipc: Resetting bearer [ 105.492080][ T7133] tipc: Invalid UDP bearer configuration [ 105.492112][ T7133] tipc: Enabling of bearer rejected, failed to enable media [ 105.522401][ T7123] tipc: Resetting bearer [ 105.547791][ T7123] tipc: Disabling bearer [ 105.571705][ T7140] sch_tbf: burst 0 is lower than device veth1_virt_wifi mtu (1514) ! [ 105.701535][ T7147] wg1 speed is unknown, defaulting to 1000 [ 105.720089][ T7149] netlink: 4 bytes leftover after parsing attributes in process `syz.3.289'. [ 105.738020][ T7149] netlink: 4 bytes leftover after parsing attributes in process `syz.3.289'. [ 107.147813][ T7221] : entered promiscuous mode [ 107.207452][ T7223] xt_cgroup: xt_cgroup: no path or classid specified [ 107.376976][ T7236] __nla_validate_parse: 6 callbacks suppressed [ 107.376992][ T7236] netlink: 4 bytes leftover after parsing attributes in process `syz.3.312'. [ 107.579613][ T7249] netlink: 12 bytes leftover after parsing attributes in process `syz.4.316'. [ 107.687709][ T7261] openvswitch: netlink: Key type 262 is out of range max 32 [ 108.207028][ T7292] netlink: 8 bytes leftover after parsing attributes in process `syz.0.328'. [ 108.218055][ T7292] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 108.463313][ T7306] xt_hashlimit: max too large, truncated to 1048576 [ 108.480661][ T7306] xt_CT: You must specify a L4 protocol and not use inversions on it [ 108.493676][ T7306] bond0: option xmit_hash_policy: invalid value (9) [ 108.543465][ T7311] netlink: 'syz.0.334': attribute type 22 has an invalid length. [ 108.608789][ T7317] netlink: 12 bytes leftover after parsing attributes in process `syz.0.334'. [ 108.771558][ T7327] netlink: 48 bytes leftover after parsing attributes in process `syz.4.338'. [ 108.796745][ T7323] bond0: (slave team0): Releasing backup interface [ 108.838162][ T7329] x_tables: duplicate underflow at hook 1 [ 108.849858][ T7327] mapping of prio or/and queue is allowed only from OUTPUT/FORWARD/POSTROUTING chains [ 108.873838][ T7323] bridge_slave_0: left allmulticast mode [ 108.879807][ T7323] bridge_slave_0: left promiscuous mode [ 108.885689][ T7323] bridge0: port 1(bridge_slave_0) entered disabled state [ 108.900784][ T7323] bridge_slave_1: left allmulticast mode [ 108.906651][ T7323] bridge_slave_1: left promiscuous mode [ 108.922669][ T7323] bridge0: port 2(bridge_slave_1) entered disabled state [ 108.948943][ T7323] bond0: (slave bond_slave_0): Releasing backup interface [ 108.972853][ T7323] bond0: (slave bond_slave_1): Releasing backup interface [ 109.005713][ T7323] team0: Port device team_slave_0 removed [ 109.033664][ T7323] team0: Port device team_slave_1 removed [ 109.046177][ T7323] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 109.053661][ T7323] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 109.076238][ T7323] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 109.083747][ T7323] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 109.093374][ T7323] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 109.192131][ T7345] veth1: entered promiscuous mode [ 109.211191][ T7345] vlan2: entered promiscuous mode [ 109.263309][ T7353] netlink: 20 bytes leftover after parsing attributes in process `syz.2.346'. [ 109.294076][ T7347] vlan2: entered promiscuous mode [ 109.346979][ T7355] wg1 speed is unknown, defaulting to 1000 [ 109.537368][ T7364] netlink: 'syz.2.350': attribute type 10 has an invalid length. [ 109.571844][ T7364] netlink: 40 bytes leftover after parsing attributes in process `syz.2.350'. [ 109.581443][ T7371] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 109.582169][ T7371] batadv_slave_1: entered promiscuous mode [ 109.601924][ T7371] A link change request failed with some changes committed already. Interface batadv_slave_1 may have been left with an inconsistent configuration, please check. [ 109.621795][ T7373] netlink: 8 bytes leftover after parsing attributes in process `syz.3.351'. [ 109.656599][ T7378] netlink: 24 bytes leftover after parsing attributes in process `syz.1.355'. [ 109.672570][ T7364] dummy0: entered promiscuous mode [ 109.680027][ T7364] bridge0: port 1(dummy0) entered blocking state [ 109.702976][ T7364] bridge0: port 1(dummy0) entered disabled state [ 109.721858][ T7364] dummy0: entered allmulticast mode [ 109.773252][ T7364] bridge0: port 1(dummy0) entered blocking state [ 109.779985][ T7364] bridge0: port 1(dummy0) entered forwarding state [ 109.868986][ T7393] netlink: 'syz.4.357': attribute type 1 has an invalid length. [ 110.029663][ T7404] netlink: 'syz.0.353': attribute type 3 has an invalid length. [ 110.032692][ T7403] netlink: 'syz.1.360': attribute type 10 has an invalid length. [ 110.052552][ T7403] netlink: 2 bytes leftover after parsing attributes in process `syz.1.360'. [ 110.067998][ T7403] bond0: entered promiscuous mode [ 110.084348][ T7403] bond_slave_0: entered promiscuous mode [ 110.104842][ T7403] bond_slave_1: entered promiscuous mode [ 110.111491][ T7403] bridge0: port 4(bond0) entered blocking state [ 110.120520][ T7403] bridge0: port 4(bond0) entered disabled state [ 110.127598][ T7403] bond0: entered allmulticast mode [ 110.143029][ T7403] bond_slave_0: entered allmulticast mode [ 110.149478][ T7403] bond_slave_1: entered allmulticast mode [ 110.159338][ T7403] bridge0: port 4(bond0) entered blocking state [ 110.165744][ T7403] bridge0: port 4(bond0) entered forwarding state [ 110.252418][ T7409] wg1 speed is unknown, defaulting to 1000 [ 110.296903][ T7415] syzkaller1: entered promiscuous mode [ 110.302501][ T7415] syzkaller1: entered allmulticast mode [ 110.432441][ T7426] Bluetooth: hci0: Opcode 0x0c1a failed: -22 [ 110.444758][ T24] IPVS: starting estimator thread 0... [ 110.554412][ T7428] IPVS: using max 31 ests per chain, 74400 per kthread [ 110.760768][ T7435] wg1 speed is unknown, defaulting to 1000 [ 110.970870][ T7446] bond5: entered promiscuous mode [ 110.976769][ T7446] 8021q: adding VLAN 0 to HW filter on device bond5 [ 110.985504][ T7445] netlink: 'syz.4.367': attribute type 1 has an invalid length. [ 111.024427][ T7445] bond6: entered promiscuous mode [ 111.029491][ T7445] bond6: entered allmulticast mode [ 111.294913][ T5833] Bluetooth: hci4: command 0x0405 tx timeout [ 111.360344][ T7460] wg1 speed is unknown, defaulting to 1000 [ 111.488777][ T7468] netlink: 'syz.1.373': attribute type 10 has an invalid length. [ 111.538449][ T7468] mac80211_hwsim hwsim9 wlan1: entered promiscuous mode [ 111.571941][ T7468] mac80211_hwsim hwsim9 wlan1: entered allmulticast mode [ 111.581804][ T7468] bond0: (slave wlan1): Enslaving as an active interface with an up link [ 112.487646][ T7530] wg1 speed is unknown, defaulting to 1000 [ 112.495300][ T5145] Bluetooth: hci0: command tx timeout [ 112.533415][ T7540] dvmrp0: entered allmulticast mode [ 112.799543][ T7549] bridge2: the hash_elasticity option has been deprecated and is always 16 [ 112.812114][ T7549] bridge2: entered allmulticast mode [ 112.893925][ T7553] ipvlan0: entered promiscuous mode [ 112.901032][ T7553] 8021q: adding VLAN 0 to HW filter on device ipvlan0 [ 113.287641][ T7569] xt_connbytes: Forcing CT accounting to be enabled [ 113.299291][ T7568] bridge0: entered promiscuous mode [ 113.305881][ T7568] vlan2: entered promiscuous mode [ 113.341382][ T7571] sch_fq: defrate 2 ignored. [ 113.398436][ T7575] ip6t_REJECT: ECHOREPLY is not supported [ 113.466026][ T7579] openvswitch: netlink: ct_state flags 010000e0 unsupported [ 113.539081][ T7579] netlink: 'syz.2.407': attribute type 13 has an invalid length. [ 113.552877][ T7579] netlink: 'syz.2.407': attribute type 17 has an invalid length. [ 113.570372][ T7582] __nla_validate_parse: 10 callbacks suppressed [ 113.570388][ T7582] netlink: 76 bytes leftover after parsing attributes in process `syz.1.408'. [ 113.651163][ T7579] syz_tun: left promiscuous mode [ 113.702899][ T7579] 0ªX¹¦À: left allmulticast mode [ 113.709946][ T7579] A link change request failed with some changes committed already. Interface 60ªX¹¦À may have been left with an inconsistent configuration, please check. [ 113.920778][ T7602] tipc: Enabled bearer , priority 0 [ 113.949675][ T7602] syzkaller0: entered promiscuous mode [ 113.957778][ T7602] syzkaller0: entered allmulticast mode [ 114.017782][ T7605] wg1 speed is unknown, defaulting to 1000 [ 114.034862][ T7602] tipc: Resetting bearer [ 114.056227][ T7601] tipc: Resetting bearer [ 114.081928][ T7601] tipc: Disabling bearer [ 114.150145][ T7611] netlink: 32 bytes leftover after parsing attributes in process `syz.4.415'. [ 114.536855][ T7624] netlink: 156 bytes leftover after parsing attributes in process `syz.2.414'. [ 114.588046][ T7626] sctp: [Deprecated]: syz.3.418 (pid 7626) Use of int in max_burst socket option deprecated. [ 114.588046][ T7626] Use struct sctp_assoc_value instead [ 114.659397][ T7615] bridge0: port 2(bridge_slave_1) entered disabled state [ 114.667185][ T7615] bridge0: port 1(bridge_slave_0) entered disabled state [ 114.683997][ T7626] IPVS: set_ctl: invalid protocol: 50 172.20.20.187:20001 [ 114.695508][ T7633] netlink: 8 bytes leftover after parsing attributes in process `syz.0.420'. [ 114.780665][ T7615] team0: Failed to send port change of device team_slave_0 via netlink (err -105) [ 114.797852][ T7615] team0: Failed to send port change of device team_slave_1 via netlink (err -105) [ 114.812812][ T7615] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 114.828781][ T7615] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 114.892471][ T7615] hsr0: left promiscuous mode [ 115.179142][ T7617] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 115.224831][ T7631] tipc: Enabled bearer , priority 0 [ 115.253466][ T7635] dvmrp1: tun_chr_ioctl cmd 1074025673 [ 115.259580][ T7636] dvmrp1: tun_chr_ioctl cmd 1074025677 [ 115.265549][ T7636] dvmrp1: linktype set to 769 [ 115.270770][ T7636] dvmrp1: tun_chr_ioctl cmd 1074025677 [ 115.277029][ T7636] dvmrp1: linktype set to 769 [ 115.282582][ T3542] netdevsim netdevsim4 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 115.308213][ T3542] netdevsim netdevsim4 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 115.422119][ T7635] dvmrp1: tun_chr_ioctl cmd 1074025673 [ 115.435276][ T7636] dvmrp1: tun_chr_ioctl cmd 1074025677 [ 115.440997][ T7636] dvmrp1: linktype set to 769 [ 115.451775][ T7631] tipc: Disabling bearer [ 115.467957][ T3542] netdevsim netdevsim4 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 115.493066][ T7635] dvmrp1: tun_chr_ioctl cmd 1074025673 [ 115.504388][ T7648] wg1 speed is unknown, defaulting to 1000 [ 115.514548][ T7635] dvmrp1: tun_chr_ioctl cmd 1074025673 [ 115.520273][ T7635] dvmrp1: tun_chr_ioctl cmd 1074025673 [ 115.606023][ T7617] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 115.621878][ T7636] dvmrp1: tun_chr_ioctl cmd 1074025677 [ 115.629567][ T7636] dvmrp1: linktype set to 769 [ 115.637621][ T3542] netdevsim netdevsim4 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 115.675976][ T7644] wg1 speed is unknown, defaulting to 1000 [ 115.788574][ T7617] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 115.821458][ T7660] netlink: 32 bytes leftover after parsing attributes in process `syz.1.424'. [ 116.086126][ T7617] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 116.360625][ T7670] netlink: 'syz.1.426': attribute type 1 has an invalid length. [ 116.374327][ T7670] netlink: 'syz.1.426': attribute type 4 has an invalid length. [ 116.390302][ T7670] netlink: 15586 bytes leftover after parsing attributes in process `syz.1.426'. [ 116.451836][ T1047] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 116.464936][ T1047] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 116.522794][ T49] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 116.580851][ T49] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 116.708743][ T7682] netlink: 8 bytes leftover after parsing attributes in process `syz.1.430'. [ 116.721868][ T7682] netlink: 12 bytes leftover after parsing attributes in process `syz.1.430'. [ 116.745835][ T7686] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 116.757499][ T7682] netlink: 28 bytes leftover after parsing attributes in process `syz.1.430'. [ 116.826724][ T7687] netlink: 20 bytes leftover after parsing attributes in process `syz.3.431'. [ 116.979991][ T7686] wg1 speed is unknown, defaulting to 1000 [ 117.057714][ T7693] wg1 speed is unknown, defaulting to 1000 [ 117.189548][ T7702] netlink: 'syz.3.436': attribute type 6 has an invalid length. [ 117.342980][ T7701] 8021q: adding VLAN 0 to HW filter on device bond1 [ 117.357711][ T7701] bridge0: port 5(bond1) entered blocking state [ 117.365756][ T7701] bridge0: port 5(bond1) entered disabled state [ 117.382260][ T7701] bond1: entered allmulticast mode [ 117.390450][ T7701] bond1: entered promiscuous mode [ 117.414907][ T7701] bridge0: port 5(bond1) entered blocking state [ 117.421620][ T7701] bridge0: port 5(bond1) entered forwarding state [ 117.456240][ T3542] bridge0: port 5(bond1) entered disabled state [ 117.784757][ T5833] Bluetooth: hci4: command 0x0405 tx timeout [ 118.434101][ T7761] openvswitch: netlink: Flow actions attr not present in new flow. [ 118.588399][ T7773] ip_tunnel: non-ECT from 0.0.0.0 with TOS=0x3 [ 118.595422][ T7774] ip_tunnel: non-ECT from 0.0.0.0 with TOS=0x3 [ 119.064918][ T7791] __nla_validate_parse: 2 callbacks suppressed [ 119.064934][ T7791] netlink: 156 bytes leftover after parsing attributes in process `syz.0.457'. [ 119.318522][ T7803] syzkaller0: refused to change device tx_queue_len [ 119.651766][ T7823] netlink: 8 bytes leftover after parsing attributes in process `syz.4.465'. [ 119.709928][ T7824] netlink: 40 bytes leftover after parsing attributes in process `syz.4.465'. [ 119.731200][ T7823] netlink: 36 bytes leftover after parsing attributes in process `syz.4.465'. [ 119.777722][ T7826] netlink: 36 bytes leftover after parsing attributes in process `syz.1.467'. [ 120.032365][ T7821] netlink: 28 bytes leftover after parsing attributes in process `syz.2.466'. [ 120.033342][ T7845] netlink: 8 bytes leftover after parsing attributes in process `syz.4.471'. [ 120.207697][ T7845] netlink: 'syz.4.471': attribute type 2 has an invalid length. [ 120.303198][ T7858] netlink: 4 bytes leftover after parsing attributes in process `syz.0.474'. [ 120.319398][ T7858] smc: net device bond0 applied user defined pnetid SYZ0 [ 120.341512][ T7858] smc: net device bond0 erased user defined pnetid SYZ0 [ 120.361708][ T7865] Bluetooth: MGMT ver 1.23 [ 120.712254][ T7895] netlink: 60 bytes leftover after parsing attributes in process `syz.2.483'. [ 120.725745][ T7895] netlink: 96 bytes leftover after parsing attributes in process `syz.2.483'. [ 120.735793][ T7895] xt_hashlimit: size too large, truncated to 1048576 [ 120.756241][ T7895] xt_hashlimit: invalid rate [ 121.417281][ T7906] tipc: Cannot configure node identity twice [ 121.466373][ T7910] netlink: 'syz.4.490': attribute type 13 has an invalid length. [ 121.602832][ T7912] 8021q: adding VLAN 0 to HW filter on device ipvlan2 [ 121.759847][ T7927] syzkaller1: entered promiscuous mode [ 121.765723][ T7927] syzkaller1: entered allmulticast mode [ 121.904935][ T7937] netlink: 'syz.1.501': attribute type 14 has an invalid length. [ 121.959263][ T36] netdevsim netdevsim1 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 121.968798][ T7937] netlink: 'syz.1.501': attribute type 14 has an invalid length. [ 121.977355][ T36] netdevsim netdevsim1 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 121.993947][ T36] netdevsim netdevsim1 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 122.022022][ T36] netdevsim netdevsim1 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 122.291139][ T5912] hid-generic 0005:0002:5508.0001: hidraw0: BLUETOOTH HID vc2.38 Device [syz0] on aa:aa:aa:aa:aa:aa [ 122.362462][ T7966] IPVS: set_ctl: invalid protocol: 0 224.0.0.2:20253 [ 122.413047][ T7966] Bluetooth: hci0: Opcode 0x0c1a failed: -22 [ 122.470409][ T7972] bond0: option active_slave: mode dependency failed, not supported in mode balance-rr(0) [ 122.674062][ T7982] netlink: 'syz.0.515': attribute type 10 has an invalid length. [ 122.701687][ T7982] netlink: 'syz.0.515': attribute type 10 has an invalid length. [ 122.718855][ T7982] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 122.758262][ T7982] team0: Port device dummy0 removed [ 122.802744][ T7982] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 122.974727][ T7992] bridge_slave_1: left allmulticast mode [ 122.983865][ T7992] bridge_slave_1: left promiscuous mode [ 122.990811][ T7992] bridge0: port 2(bridge_slave_1) entered disabled state [ 123.002145][ T7992] A link change request failed with some changes committed already. Interface bridge_slave_1 may have been left with an inconsistent configuration, please check. [ 123.020284][ T7994] batadv_slave_1: entered promiscuous mode [ 123.027104][ T7994] batadv_slave_1: entered allmulticast mode [ 123.131515][ T7994] wg1 speed is unknown, defaulting to 1000 [ 123.817940][ T8032] bond0 (unregistering): Released all slaves [ 123.961755][ T8036] syzkaller0: entered promiscuous mode [ 123.969224][ T8036] syzkaller0: entered allmulticast mode [ 124.161846][ T8059] netlink: 'syz.4.537': attribute type 7 has an invalid length. [ 124.175054][ T8058] netlink: 'syz.1.538': attribute type 1 has an invalid length. [ 124.193107][ T8058] __nla_validate_parse: 10 callbacks suppressed [ 124.193126][ T8058] netlink: 224 bytes leftover after parsing attributes in process `syz.1.538'. [ 124.266010][ T8062] netlink: 8 bytes leftover after parsing attributes in process `syz.3.539'. [ 124.275619][ T8062] netlink: 40 bytes leftover after parsing attributes in process `syz.3.539'. [ 124.416887][ T5145] Bluetooth: hci0: command tx timeout [ 125.337829][ T8064] lo speed is unknown, defaulting to 1000 [ 125.351522][ T8058] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 125.367896][ T8068] netlink: 'syz.1.538': attribute type 5 has an invalid length. [ 125.391911][ T8064] lo speed is unknown, defaulting to 1000 [ 125.406371][ T8060] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 125.412472][ T8060] Bluetooth: hci1: Error when powering off device on rfkill (-4) [ 125.440807][ T8064] lo speed is unknown, defaulting to 1000 [ 125.502896][ T8060] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 125.521252][ T8064] infiniband syz1: RDMA CMA: cma_listen_on_dev, error -98 [ 125.535597][ T8060] Bluetooth: hci2: Error when powering off device on rfkill (-4) [ 125.567409][ T8064] lo speed is unknown, defaulting to 1000 [ 125.579490][ T8060] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 125.587439][ T8064] lo speed is unknown, defaulting to 1000 [ 125.594411][ T8060] Bluetooth: hci3: Error when powering off device on rfkill (-4) [ 125.600103][ T8064] lo speed is unknown, defaulting to 1000 [ 125.624995][ T8060] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 125.643207][ T8060] Bluetooth: hci4: Error when powering off device on rfkill (-4) [ 125.661277][ T8064] lo speed is unknown, defaulting to 1000 [ 125.669069][ T8064] lo speed is unknown, defaulting to 1000 [ 125.954693][ T8096] netlink: 60 bytes leftover after parsing attributes in process `syz.1.548'. [ 125.986336][ T8102] mac80211_hwsim hwsim7 wlan1: entered allmulticast mode [ 126.019297][ T8102] dummy0: left allmulticast mode [ 126.029227][ T8102] dummy0: left promiscuous mode [ 126.044656][ T8102] bridge0: port 1(dummy0) entered disabled state [ 126.126713][ T8117] netlink: 'syz.2.552': attribute type 10 has an invalid length. [ 126.178016][ T8102] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 126.210402][ T8117] mac80211_hwsim hwsim7 wlan1: left allmulticast mode [ 126.219845][ T8110] wg1 speed is unknown, defaulting to 1000 [ 126.270565][ T8110] lo speed is unknown, defaulting to 1000 [ 126.311954][ T8124] netlink: 24 bytes leftover after parsing attributes in process `syz.1.555'. [ 126.384839][ T8124] netlink: 4 bytes leftover after parsing attributes in process `syz.1.555'. [ 126.411815][ T8129] bridge0: port 3(macvtap1) entered blocking state [ 126.420670][ T8129] bridge0: port 3(macvtap1) entered disabled state [ 126.435055][ T8129] macvtap1: entered allmulticast mode [ 126.448698][ T8129] bridge0: entered allmulticast mode [ 126.472081][ T8129] macvtap1: left allmulticast mode [ 126.486241][ T8129] bridge0: left allmulticast mode [ 126.738044][ T8144] netlink: 8 bytes leftover after parsing attributes in process `syz.1.563'. [ 126.827761][ T8151] netlink: 'syz.2.564': attribute type 29 has an invalid length. [ 127.237386][ T30] audit: type=1107 audit(1763215870.370:2): pid=8182 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='ÜC{ì#.àÔ!h ö [ 127.237386][ T30] ' [ 127.393341][ T8190] netlink: 8 bytes leftover after parsing attributes in process `syz.2.575'. [ 127.418271][ T8192] openvswitch: netlink: ct_state flags 010000e0 unsupported [ 127.613083][ T8188] netlink: 28 bytes leftover after parsing attributes in process `syz.4.573'. [ 128.008368][ T8221] netlink: 'syz.0.583': attribute type 3 has an invalid length. [ 128.147006][ T8223] netlink: 20 bytes leftover after parsing attributes in process `syz.3.586'. [ 128.330384][ T8223] nbd: socks must be embedded in a SOCK_ITEM attr [ 129.612741][ T8269] __nla_validate_parse: 3 callbacks suppressed [ 129.612757][ T8269] netlink: 52 bytes leftover after parsing attributes in process `syz.3.601'. [ 129.843508][ T8274] bond7: entered promiscuous mode [ 129.857563][ T8274] 8021q: adding VLAN 0 to HW filter on device bond7 [ 130.095569][ T8296] tipc: Enabled bearer , priority 0 [ 130.105752][ T8296] syzkaller0: entered promiscuous mode [ 130.111251][ T8296] syzkaller0: entered allmulticast mode [ 130.137829][ T8285] netlink: 12 bytes leftover after parsing attributes in process `syz.3.605'. [ 130.156489][ T8285] netlink: 8 bytes leftover after parsing attributes in process `syz.3.605'. [ 130.196770][ T8295] tipc: Resetting bearer [ 130.249020][ T8295] tipc: Disabling bearer [ 130.508751][ T8319] xt_hashlimit: max too large, truncated to 1048576 [ 130.628889][ T2998] netdevsim netdevsim2 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 130.649103][ T8329] netlink: 'syz.0.617': attribute type 1 has an invalid length. [ 130.657594][ T2998] netdevsim netdevsim2 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 130.670519][ T2998] netdevsim netdevsim2 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 130.710449][ T8333] netlink: 8 bytes leftover after parsing attributes in process `syz.0.617'. [ 130.747774][ T8329] bond1: option mode: invalid value (7) [ 130.755557][ T8329] bond1 (unregistering): Released all slaves [ 130.780689][ T8331] netlink: 52 bytes leftover after parsing attributes in process `syz.3.619'. [ 130.790127][ T2998] netdevsim netdevsim2 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 130.875360][ T8341] vti0: entered promiscuous mode [ 130.985522][ T8353] siw: device registration error -23 [ 131.093802][ T8358] bond1: entered allmulticast mode [ 131.103546][ T8358] 8021q: adding VLAN 0 to HW filter on device bond1 [ 131.112940][ T8358] team0: Port device bond1 added [ 131.113196][ T8362] netlink: 24 bytes leftover after parsing attributes in process `syz.0.625'. [ 131.294398][ T8375] netlink: 'syz.1.631': attribute type 2 has an invalid length. [ 131.410801][ T8381] wg1 speed is unknown, defaulting to 1000 [ 131.423304][ T8381] lo speed is unknown, defaulting to 1000 [ 131.496205][ T8387] tipc: Enabled bearer , priority 0 [ 131.505054][ T8387] syzkaller0: entered promiscuous mode [ 131.510597][ T8387] syzkaller0: entered allmulticast mode [ 131.533090][ T8387] tipc: Resetting bearer [ 131.558209][ T8385] tipc: Resetting bearer [ 131.597438][ T8385] tipc: Disabling bearer [ 131.858124][ T8397] wg1 speed is unknown, defaulting to 1000 [ 131.993324][ T8397] lo speed is unknown, defaulting to 1000 [ 132.133093][ T8409] wg1 speed is unknown, defaulting to 1000 [ 132.158111][ T8409] lo speed is unknown, defaulting to 1000 [ 132.299267][ T8413] wg1 speed is unknown, defaulting to 1000 [ 132.313294][ T8413] lo speed is unknown, defaulting to 1000 [ 132.457979][ T8421] netlink: 4 bytes leftover after parsing attributes in process `syz.2.640'. [ 132.479622][ T8424] wg1 speed is unknown, defaulting to 1000 [ 132.495770][ T8424] lo speed is unknown, defaulting to 1000 [ 132.604496][ T8437] netlink: 'syz.3.645': attribute type 1 has an invalid length. [ 132.719608][ T8444] netlink: 28 bytes leftover after parsing attributes in process `syz.3.645'. [ 132.822892][ T1301] ieee802154 phy0 wpan0: encryption failed: -22 [ 132.909014][ T8439] wg1 speed is unknown, defaulting to 1000 [ 132.950426][ T8439] lo speed is unknown, defaulting to 1000 [ 133.474879][ T8456] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 133.519293][ T8462] team_slave_0: entered promiscuous mode [ 133.525380][ T8462] team_slave_1: entered promiscuous mode [ 133.548938][ T8462] team0: Device macsec2 is already an upper device of the team interface [ 133.580612][ T8462] team_slave_0: left promiscuous mode [ 133.586159][ T8462] team_slave_1: left promiscuous mode [ 133.609283][ T8474] sctp: [Deprecated]: syz.2.657 (pid 8474) Use of int in maxseg socket option. [ 133.609283][ T8474] Use struct sctp_assoc_value instead [ 133.662485][ T8463] team_slave_0: entered promiscuous mode [ 133.668266][ T8463] team_slave_1: entered promiscuous mode [ 133.692273][ T8463] team0: Device macsec2 is already an upper device of the team interface [ 133.708304][ T8463] team_slave_0: left promiscuous mode [ 133.713770][ T8463] team_slave_1: left promiscuous mode [ 133.801937][ T8456] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 133.917959][ T8456] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 133.980897][ T8483] netlink: 4 bytes leftover after parsing attributes in process `syz.3.659'. [ 134.027863][ T8479] netlink: 12 bytes leftover after parsing attributes in process `syz.3.659'. [ 134.103171][ T8456] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 134.178193][ T8495] x_tables: duplicate underflow at hook 1 [ 134.238008][ T8500] netlink: 'syz.2.667': attribute type 1 has an invalid length. [ 134.397966][ T2998] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 134.420851][ T8507] wg1 speed is unknown, defaulting to 1000 [ 134.466693][ T8507] lo speed is unknown, defaulting to 1000 [ 134.515030][ T3542] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 134.530191][ T8518] FAULT_INJECTION: forcing a failure. [ 134.530191][ T8518] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 134.565798][ T8518] CPU: 0 UID: 0 PID: 8518 Comm: syz.1.670 Not tainted syzkaller #0 PREEMPT(full) [ 134.565823][ T8518] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 134.565833][ T8518] Call Trace: [ 134.565840][ T8518] [ 134.565848][ T8518] dump_stack_lvl+0x189/0x250 [ 134.565876][ T8518] ? __pfx____ratelimit+0x10/0x10 [ 134.565900][ T8518] ? __pfx_dump_stack_lvl+0x10/0x10 [ 134.565922][ T8518] ? __pfx__printk+0x10/0x10 [ 134.565939][ T8518] ? __might_fault+0xb0/0x130 [ 134.565972][ T8518] should_fail_ex+0x414/0x560 [ 134.566001][ T8518] _copy_from_user+0x2d/0xb0 [ 134.566023][ T8518] ___sys_sendmsg+0x158/0x2a0 [ 134.566045][ T8518] ? __pfx____sys_sendmsg+0x10/0x10 [ 134.566099][ T8518] ? __fget_files+0x2a/0x420 [ 134.566115][ T8518] ? __fget_files+0x3a0/0x420 [ 134.566141][ T8518] __sys_sendmmsg+0x227/0x430 [ 134.566165][ T8518] ? __pfx___sys_sendmmsg+0x10/0x10 [ 134.566193][ T8518] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 134.566229][ T8518] ? ksys_write+0x22a/0x250 [ 134.566253][ T8518] ? __pfx_ksys_write+0x10/0x10 [ 134.566280][ T8518] __x64_sys_sendmmsg+0xa0/0xc0 [ 134.566302][ T8518] do_syscall_64+0xfa/0xfa0 [ 134.566317][ T8518] ? lockdep_hardirqs_on+0x9c/0x150 [ 134.566333][ T8518] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 134.566350][ T8518] ? clear_bhb_loop+0x60/0xb0 [ 134.566377][ T8518] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 134.566394][ T8518] RIP: 0033:0x7f024338f6c9 [ 134.566409][ T8518] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 134.566423][ T8518] RSP: 002b:00007f0244308038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 134.566441][ T8518] RAX: ffffffffffffffda RBX: 00007f02435e5fa0 RCX: 00007f024338f6c9 [ 134.566454][ T8518] RDX: 0000000000000001 RSI: 0000200000000fc0 RDI: 0000000000000003 [ 134.566464][ T8518] RBP: 00007f0244308090 R08: 0000000000000000 R09: 0000000000000000 [ 134.566475][ T8518] R10: 0000000000004881 R11: 0000000000000246 R12: 0000000000000001 [ 134.566485][ T8518] R13: 00007f02435e6038 R14: 00007f02435e5fa0 R15: 00007fff50a400d8 [ 134.566515][ T8518] [ 134.568934][ T3542] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 134.625133][ T8520] __nla_validate_parse: 6 callbacks suppressed [ 134.625149][ T8520] netlink: 208 bytes leftover after parsing attributes in process `syz.3.671'. [ 134.753590][ T36] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 135.070902][ T8531] wg1 speed is unknown, defaulting to 1000 [ 135.094459][ T8531] lo speed is unknown, defaulting to 1000 [ 135.352029][ T8555] netlink: 24 bytes leftover after parsing attributes in process `syz.2.680'. [ 135.362170][ T7627] IPVS: starting estimator thread 0... [ 135.382926][ T8543] netlink: 64 bytes leftover after parsing attributes in process `syz.0.677'. [ 135.393184][ T8555] Bluetooth: hci0: Opcode 0x0c1a failed: -22 [ 135.406547][ T8543] netlink: 12 bytes leftover after parsing attributes in process `syz.0.677'. [ 135.456930][ T8557] IPVS: using max 33 ests per chain, 79200 per kthread [ 135.546016][ T8565] tipc: Started in network mode [ 135.552326][ T8565] tipc: Node identity c6b2b643f6a5, cluster identity 4711 [ 135.560182][ T8565] tipc: Enabled bearer , priority 0 [ 135.616659][ T8569] syzkaller0: entered promiscuous mode [ 135.638969][ T8569] syzkaller0: entered allmulticast mode [ 135.689325][ T8565] tipc: Resetting bearer [ 135.719614][ T8563] tipc: Resetting bearer [ 135.778224][ T8563] tipc: Disabling bearer [ 136.025294][ T8587] netlink: 'syz.3.690': attribute type 1 has an invalid length. [ 136.151036][ T8596] netlink: 'syz.0.691': attribute type 12 has an invalid length. [ 136.232879][ T8599] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 136.321110][ T8605] x_tables: ip6_tables: TCPMSS target: only valid for protocol 6 [ 136.429033][ T8609] netlink: 207952 bytes leftover after parsing attributes in process `syz.4.697'. [ 136.487213][ T8614] netlink: 36 bytes leftover after parsing attributes in process `syz.2.699'. [ 136.488632][ T8609] geneve2: entered promiscuous mode [ 136.513170][ T2998] netdevsim netdevsim4 eth0: set [1, 0] type 2 family 0 port 20000 - 0 [ 136.528318][ T2998] netdevsim netdevsim4 eth1: set [1, 0] type 2 family 0 port 20000 - 0 [ 136.546024][ T2998] netdevsim netdevsim4 eth2: set [1, 0] type 2 family 0 port 20000 - 0 [ 136.558104][ T2998] netdevsim netdevsim4 eth3: set [1, 0] type 2 family 0 port 20000 - 0 [ 136.602553][ T8621] netlink: 'syz.3.701': attribute type 1 has an invalid length. [ 136.752742][ T8621] 8021q: adding VLAN 0 to HW filter on device bond0 [ 136.877866][ T8649] openvswitch: netlink: ct_state flags 010000e0 unsupported [ 137.049161][ T8659] wg1 speed is unknown, defaulting to 1000 [ 137.068770][ T8659] lo speed is unknown, defaulting to 1000 [ 137.087486][ T8661] netlink: 'syz.4.712': attribute type 27 has an invalid length. [ 137.126241][ T8661] bond5: left promiscuous mode [ 137.145081][ T8661] bond6: left promiscuous mode [ 137.164490][ T8661] bond6: left allmulticast mode [ 137.240900][ T8661] bond7: left promiscuous mode [ 137.247894][ T8661] geneve2: left promiscuous mode [ 137.314359][ T8666] 8021q: adding VLAN 0 to HW filter on device bond0 [ 137.322762][ T8666] 8021q: adding VLAN 0 to HW filter on device team0 [ 137.337749][ T8666] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 137.353839][ T2998] netdevsim netdevsim4 eth0: unset [1, 0] type 2 family 0 port 20000 - 0 [ 137.362542][ T2998] netdevsim netdevsim4 eth1: unset [1, 0] type 2 family 0 port 20000 - 0 [ 137.371337][ T2998] netdevsim netdevsim4 eth2: unset [1, 0] type 2 family 0 port 20000 - 0 [ 137.374809][ T5145] Bluetooth: hci0: command tx timeout [ 137.395578][ T5824] lo speed is unknown, defaulting to 1000 [ 137.404358][ T5824] syz1: Port: 1 Link ACTIVE [ 137.424464][ T2998] netdevsim netdevsim4 eth3: unset [1, 0] type 2 family 0 port 20000 - 0 [ 137.609149][ T8688] openvswitch: netlink: ct_state flags 010000e0 unsupported [ 137.776468][ T8699] netlink: 'syz.3.721': attribute type 1 has an invalid length. [ 137.784142][ T8699] netlink: 'syz.3.721': attribute type 7 has an invalid length. [ 137.801210][ T8699] netlink: 'syz.3.721': attribute type 8 has an invalid length. [ 137.811949][ T8699] netlink: 208 bytes leftover after parsing attributes in process `syz.3.721'. [ 138.138514][ T8719] netlink: 8 bytes leftover after parsing attributes in process `syz.3.727'. [ 138.160275][ T8719] netlink: 24 bytes leftover after parsing attributes in process `syz.3.727'. [ 138.272344][ T8725] netlink: 'syz.4.726': attribute type 1 has an invalid length. [ 138.313442][ T8725] netlink: 224 bytes leftover after parsing attributes in process `syz.4.726'. [ 138.893904][ T8741] syzkaller0: entered promiscuous mode [ 138.905490][ T8741] syzkaller0: entered allmulticast mode [ 138.924641][ T8748] openvswitch: netlink: ct_state flags 010000e0 unsupported [ 139.102099][ T8754] netlink: 'syz.1.734': attribute type 4 has an invalid length. [ 139.421558][ T8769] pimreg: entered allmulticast mode [ 139.430606][ T8769] xt_CONNSECMARK: invalid mode: 0 [ 139.469984][ T8769] pimreg: left allmulticast mode [ 139.523462][ T8783] netlink: 'syz.0.740': attribute type 22 has an invalid length. [ 139.555558][ T36] netdevsim netdevsim0 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 139.563909][ T36] netdevsim netdevsim0 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 139.595899][ T3542] netdevsim netdevsim0 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 139.634285][ T8786] __nla_validate_parse: 2 callbacks suppressed [ 139.634301][ T8786] netlink: 284 bytes leftover after parsing attributes in process `syz.2.745'. [ 139.634315][ T3542] netdevsim netdevsim0 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 139.773417][ T8796] openvswitch: netlink: Message has 8 unknown bytes. [ 139.940931][ T8806] netlink: 8 bytes leftover after parsing attributes in process `syz.4.744'. [ 140.009448][ T8808] A link change request failed with some changes committed already. Interface bond0 may have been left with an inconsistent configuration, please check. [ 140.139234][ T8813] netlink: 12 bytes leftover after parsing attributes in process `syz.3.750'. [ 140.191718][ T8813] 8021q: adding VLAN 0 to HW filter on device bond2 [ 140.261123][ T8816] wg1 speed is unknown, defaulting to 1000 [ 140.299658][ T8816] lo speed is unknown, defaulting to 1000 [ 140.492963][ T8821] wg1 speed is unknown, defaulting to 1000 [ 140.522982][ T8821] lo speed is unknown, defaulting to 1000 [ 140.578696][ T8813] netlink: 8 bytes leftover after parsing attributes in process `syz.3.750'. [ 140.820986][ T8840] ip6t_REJECT: ECHOREPLY is not supported [ 141.457227][ T8890] Cannot find set identified by id 3 to match [ 141.464002][ T8884] team0: Port device bridge35 added [ 141.522126][ T8884] bridge0: port 3(team0) entered blocking state [ 141.534802][ T8884] bridge0: port 3(team0) entered disabled state [ 141.542332][ T8884] team0: entered allmulticast mode [ 141.566209][ T8884] team_slave_0: entered allmulticast mode [ 141.572023][ T8884] team_slave_1: entered allmulticast mode [ 141.579164][ T8884] bridge35: entered allmulticast mode [ 141.611950][ T8884] team0: entered promiscuous mode [ 141.627093][ T8884] team_slave_0: entered promiscuous mode [ 141.633054][ T8884] team_slave_1: entered promiscuous mode [ 141.639144][ T8884] bridge35: entered promiscuous mode [ 141.736783][ T8910] netlink: 12 bytes leftover after parsing attributes in process `syz.1.779'. [ 141.801585][ T8913] veth0_to_bridge: entered promiscuous mode [ 141.824853][ T8910] netlink: 12 bytes leftover after parsing attributes in process `syz.1.779'. [ 141.847510][ T8917] tipc: Enabling of bearer rejected, failed to enable media [ 141.872098][ T8910] netlink: 12 bytes leftover after parsing attributes in process `syz.1.779'. [ 141.878135][ T8912] veth0_to_bridge: left promiscuous mode [ 141.906379][ T8919] wg1 speed is unknown, defaulting to 1000 [ 141.926638][ T8919] lo speed is unknown, defaulting to 1000 [ 142.099154][ T8936] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 142.230181][ T8941] syzkaller1: tun_chr_ioctl cmd 1074025677 [ 142.239786][ T8941] syzkaller1: Refused to change device type [ 142.276982][ T8936] wg1 speed is unknown, defaulting to 1000 [ 142.300527][ T8936] lo speed is unknown, defaulting to 1000 [ 142.664592][ T8964] validate_nla: 3 callbacks suppressed [ 142.664608][ T8964] netlink: 'syz.3.795': attribute type 10 has an invalid length. [ 142.764824][ T8981] wg1 speed is unknown, defaulting to 1000 [ 142.772479][ T8981] lo speed is unknown, defaulting to 1000 [ 142.954886][ T8986] erspan0: entered promiscuous mode [ 143.034114][ T8989] team_slave_1: Caught tx_queue_len zero misconfig [ 144.025341][ T9029] netlink: 28 bytes leftover after parsing attributes in process `syz.2.808'. [ 144.069376][ T9029] netlink: 28 bytes leftover after parsing attributes in process `syz.2.808'. [ 144.079011][ T9029] netlink: 'syz.2.808': attribute type 4 has an invalid length. [ 144.089166][ T9030] netlink: 224 bytes leftover after parsing attributes in process `syz.2.808'. [ 144.619701][ T9046] wg1 speed is unknown, defaulting to 1000 [ 144.641984][ T9046] lo speed is unknown, defaulting to 1000 [ 144.789728][ T9066] tipc: Invalid UDP bearer configuration [ 144.789778][ T9066] tipc: Enabling of bearer rejected, failed to enable media [ 144.826508][ T9070] __nla_validate_parse: 3 callbacks suppressed [ 144.826526][ T9070] netlink: 4 bytes leftover after parsing attributes in process `syz.3.821'. [ 144.901785][ T9073] netlink: 'syz.4.822': attribute type 1 has an invalid length. [ 144.947420][ T9066] netlink: 'syz.2.819': attribute type 322 has an invalid length. [ 145.030361][ T9073] netlink: 4 bytes leftover after parsing attributes in process `syz.4.822'. [ 145.063815][ T9076] bond8: (slave veth3): Enslaving as an active interface with a down link [ 145.074910][ T9083] syz_tun: entered allmulticast mode [ 145.097127][ T9073] bond8 (unregistering): (slave veth3): Releasing active interface [ 145.112675][ T9073] bond8 (unregistering): Released all slaves [ 145.268044][ T9102] openvswitch: netlink: ct_state flags 010000e0 unsupported [ 145.276340][ T9101] syzkaller1: entered promiscuous mode [ 145.292106][ T9101] syzkaller1: entered allmulticast mode [ 145.517137][ T9116] netlink: 'syz.3.835': attribute type 2 has an invalid length. [ 145.536839][ T9116] netlink: 156 bytes leftover after parsing attributes in process `syz.3.835'. [ 145.736716][ T9132] netlink: 52 bytes leftover after parsing attributes in process `syz.4.843'. [ 145.740492][ T9128] 8021q: adding VLAN 0 to HW filter on device bond3 [ 145.756482][ T9133] netlink: 'syz.1.842': attribute type 4 has an invalid length. [ 145.757973][ T9128] netlink: 8 bytes leftover after parsing attributes in process `syz.3.841'. [ 145.822216][ T9127] wg1 speed is unknown, defaulting to 1000 [ 145.832178][ T9127] lo speed is unknown, defaulting to 1000 [ 145.974134][ T9146] team0: Port device bridge0 added [ 146.091844][ T9155] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 146.103541][ T9155] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 146.137307][ T9155] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 146.151365][ T9155] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 146.161199][ T9155] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 146.183694][ T9155] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 146.303424][ T9155] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 146.319909][ T9155] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 146.329450][ T9155] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 146.514626][ T9178] netlink: 176 bytes leftover after parsing attributes in process `syz.2.852'. [ 146.676640][ T9188] netlink: 8 bytes leftover after parsing attributes in process `syz.0.853'. [ 146.725410][ T9191] netlink: 'syz.4.855': attribute type 6 has an invalid length. [ 146.734738][ T9191] IPv6: NLM_F_CREATE should be specified when creating new route [ 146.822340][ T9196] x_tables: arp_tables: .0 target: invalid size 8 (kernel) != (user) 0 [ 148.122419][ T9204] netlink: 24 bytes leftover after parsing attributes in process `syz.1.858'. [ 148.283001][ T9220] netlink: 140 bytes leftover after parsing attributes in process `syz.1.858'. [ 148.311527][ T9218] netlink: 12 bytes leftover after parsing attributes in process `syz.0.865'. [ 148.453530][ T9218] 8021q: adding VLAN 0 to HW filter on device bond2 [ 148.532693][ T9226] wg1 speed is unknown, defaulting to 1000 [ 148.571208][ T9226] lo speed is unknown, defaulting to 1000 [ 149.019072][ T9274] lo: Caught tx_queue_len zero misconfig [ 149.439249][ T9295] netlink: 'syz.2.880': attribute type 10 has an invalid length. [ 149.498001][ T9299] wg1 speed is unknown, defaulting to 1000 [ 149.620302][ T9299] lo speed is unknown, defaulting to 1000 [ 150.164002][ T9329] wg1 speed is unknown, defaulting to 1000 [ 150.181945][ T9329] lo speed is unknown, defaulting to 1000 [ 150.262815][ T9330] wg1 speed is unknown, defaulting to 1000 [ 150.302634][ T9333] team0: Port device bridge0 removed [ 150.323152][ T9333] net_ratelimit: 56 callbacks suppressed [ 150.323171][ T9333] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 150.360225][ T9330] lo speed is unknown, defaulting to 1000 [ 150.379581][ T9340] netlink: 'syz.2.890': attribute type 5 has an invalid length. [ 150.544843][ T9340] wg1 speed is unknown, defaulting to 1000 [ 150.568979][ T9340] lo speed is unknown, defaulting to 1000 [ 150.836639][ T9348] wg1 speed is unknown, defaulting to 1000 [ 150.857912][ T9348] lo speed is unknown, defaulting to 1000 [ 150.906580][ T9359] vti0: entered promiscuous mode [ 151.112704][ T9369] __nla_validate_parse: 4 callbacks suppressed [ 151.112721][ T9369] netlink: 20 bytes leftover after parsing attributes in process `syz.1.898'. [ 151.358972][ T9387] netlink: 64 bytes leftover after parsing attributes in process `syz.1.902'. [ 151.370525][ T9387] team0: No ports can be present during mode change [ 151.865296][ T9425] wg1 speed is unknown, defaulting to 1000 [ 151.875244][ T9425] lo speed is unknown, defaulting to 1000 [ 152.430776][ T9440] wg1 speed is unknown, defaulting to 1000 [ 152.438762][ T9440] lo speed is unknown, defaulting to 1000 [ 152.634526][ T9445] netlink: 8 bytes leftover after parsing attributes in process `syz.3.921'. [ 152.648047][ T9445] netlink: 4 bytes leftover after parsing attributes in process `syz.3.921'. [ 152.657761][ T9445] netlink: 'syz.3.921': attribute type 18 has an invalid length. [ 152.666594][ T9445] netlink: 8 bytes leftover after parsing attributes in process `syz.3.921'. [ 152.873126][ T9457] team0: left allmulticast mode [ 152.878504][ T9457] team_slave_0: left allmulticast mode [ 152.884803][ T9457] team_slave_1: left allmulticast mode [ 152.890516][ T9457] bridge35: left allmulticast mode [ 152.914878][ T9457] team0: left promiscuous mode [ 152.927466][ T9457] team_slave_0: left promiscuous mode [ 152.943545][ T9457] team_slave_1: left promiscuous mode [ 152.955664][ T9460] netlink: 4 bytes leftover after parsing attributes in process `syz.4.923'. [ 152.965582][ T9457] bridge35: left promiscuous mode [ 152.976570][ T9457] bridge0: port 3(team0) entered disabled state [ 152.995773][ T9457] bridge_slave_0: left allmulticast mode [ 153.012796][ T9457] bridge_slave_0: left promiscuous mode [ 153.019362][ T9457] bridge0: port 1(bridge_slave_0) entered disabled state [ 153.029759][ T9457] bridge_slave_1: left allmulticast mode [ 153.035831][ T9457] bridge_slave_1: left promiscuous mode [ 153.044714][ T9457] bridge0: port 2(bridge_slave_1) entered disabled state [ 153.068545][ T9457] bond0: (slave 30): Releasing backup interface [ 153.077412][ T9457] bond0: (slave bond_slave_1): Releasing backup interface [ 153.087434][ T9457] team0: Port device team_slave_0 removed [ 153.097092][ T9457] team0: Port device team_slave_1 removed [ 153.103220][ T9457] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 153.112149][ T9457] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 153.120747][ T9457] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 153.252249][ T9462] wg1 speed is unknown, defaulting to 1000 [ 153.266536][ T9473] netlink: 'syz.1.930': attribute type 83 has an invalid length. [ 153.273748][ T9462] lo speed is unknown, defaulting to 1000 [ 153.403957][ T9486] x_tables: ip_tables: rpfilter match: used from hooks FORWARD, but only valid from PREROUTING [ 153.555986][ T9493] netlink: 8 bytes leftover after parsing attributes in process `syz.3.936'. [ 153.571195][ T9493] bond3: option mode: unable to set because the bond device is up [ 153.704953][ T9497] mac80211_hwsim hwsim9 syzkaller0: entered promiscuous mode [ 153.729836][ T9497] mac80211_hwsim hwsim9 syzkaller0: entered allmulticast mode [ 153.807939][ T9501] wg1 speed is unknown, defaulting to 1000 [ 153.835818][ T9501] lo speed is unknown, defaulting to 1000 [ 153.863464][ T9505] FAULT_INJECTION: forcing a failure. [ 153.863464][ T9505] name failslab, interval 1, probability 0, space 0, times 1 [ 153.879119][ T9505] CPU: 1 UID: 0 PID: 9505 Comm: syz.1.940 Not tainted syzkaller #0 PREEMPT(full) [ 153.879142][ T9505] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 153.879152][ T9505] Call Trace: [ 153.879160][ T9505] [ 153.879167][ T9505] dump_stack_lvl+0x189/0x250 [ 153.879195][ T9505] ? __pfx____ratelimit+0x10/0x10 [ 153.879219][ T9505] ? __pfx_dump_stack_lvl+0x10/0x10 [ 153.879241][ T9505] ? __pfx__printk+0x10/0x10 [ 153.879264][ T9505] ? __pfx___might_resched+0x10/0x10 [ 153.879282][ T9505] ? fs_reclaim_acquire+0x7d/0x100 [ 153.879303][ T9505] should_fail_ex+0x414/0x560 [ 153.879333][ T9505] should_failslab+0xa8/0x100 [ 153.879352][ T9505] __kmalloc_noprof+0xcb/0x7f0 [ 153.879374][ T9505] ? sock_kmalloc+0xd6/0x160 [ 153.879406][ T9505] sock_kmalloc+0xd6/0x160 [ 153.879428][ T9505] ____sys_sendmsg+0x1b5/0x830 [ 153.879453][ T9505] ? __pfx_____sys_sendmsg+0x10/0x10 [ 153.879481][ T9505] ? import_iovec+0x74/0xa0 [ 153.879506][ T9505] ___sys_sendmsg+0x21f/0x2a0 [ 153.879528][ T9505] ? __pfx____sys_sendmsg+0x10/0x10 [ 153.879582][ T9505] ? __fget_files+0x2a/0x420 [ 153.879598][ T9505] ? __fget_files+0x3a0/0x420 [ 153.879624][ T9505] __sys_sendmmsg+0x227/0x430 [ 153.879646][ T9505] ? __pfx___sys_sendmmsg+0x10/0x10 [ 153.879674][ T9505] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 153.879710][ T9505] ? ksys_write+0x22a/0x250 [ 153.879736][ T9505] ? __pfx_ksys_write+0x10/0x10 [ 153.879763][ T9505] __x64_sys_sendmmsg+0xa0/0xc0 [ 153.879785][ T9505] do_syscall_64+0xfa/0xfa0 [ 153.879800][ T9505] ? lockdep_hardirqs_on+0x9c/0x150 [ 153.879816][ T9505] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 153.879833][ T9505] ? clear_bhb_loop+0x60/0xb0 [ 153.879854][ T9505] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 153.879869][ T9505] RIP: 0033:0x7f024338f6c9 [ 153.879886][ T9505] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 153.879899][ T9505] RSP: 002b:00007f0244308038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 153.879918][ T9505] RAX: ffffffffffffffda RBX: 00007f02435e5fa0 RCX: 00007f024338f6c9 [ 153.879930][ T9505] RDX: 0000000000000001 RSI: 0000200000000fc0 RDI: 0000000000000003 [ 153.879941][ T9505] RBP: 00007f0244308090 R08: 0000000000000000 R09: 0000000000000000 [ 153.879951][ T9505] R10: 0000000000004880 R11: 0000000000000246 R12: 0000000000000001 [ 153.879962][ T9505] R13: 00007f02435e6038 R14: 00007f02435e5fa0 R15: 00007fff50a400d8 [ 153.879992][ T9505] [ 153.921047][ T9508] netlink: 212368 bytes leftover after parsing attributes in process `syz.0.941'. [ 154.233091][ T9517] netlink: 8 bytes leftover after parsing attributes in process `syz.0.943'. [ 154.335413][ T9512] wg1 speed is unknown, defaulting to 1000 [ 154.342947][ T9512] lo speed is unknown, defaulting to 1000 [ 154.365273][ T9522] netlink: 'syz.4.946': attribute type 1 has an invalid length. [ 154.373037][ T9522] netlink: 'syz.4.946': attribute type 3 has an invalid length. [ 154.394784][ T9522] netlink: 224 bytes leftover after parsing attributes in process `syz.4.946'. [ 154.719811][ T9547] FAULT_INJECTION: forcing a failure. [ 154.719811][ T9547] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 154.753022][ T9547] CPU: 1 UID: 0 PID: 9547 Comm: syz.4.952 Not tainted syzkaller #0 PREEMPT(full) [ 154.753049][ T9547] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 154.753059][ T9547] Call Trace: [ 154.753066][ T9547] [ 154.753075][ T9547] dump_stack_lvl+0x189/0x250 [ 154.753102][ T9547] ? __pfx____ratelimit+0x10/0x10 [ 154.753133][ T9547] ? __pfx_dump_stack_lvl+0x10/0x10 [ 154.753155][ T9547] ? __pfx__printk+0x10/0x10 [ 154.753173][ T9547] ? __might_fault+0xb0/0x130 [ 154.753207][ T9547] should_fail_ex+0x414/0x560 [ 154.753236][ T9547] _copy_from_user+0x2d/0xb0 [ 154.753259][ T9547] ____sys_sendmsg+0x2fe/0x830 [ 154.753284][ T9547] ? __pfx_____sys_sendmsg+0x10/0x10 [ 154.753313][ T9547] ? import_iovec+0x74/0xa0 [ 154.753337][ T9547] ___sys_sendmsg+0x21f/0x2a0 [ 154.753359][ T9547] ? __pfx____sys_sendmsg+0x10/0x10 [ 154.753413][ T9547] ? __fget_files+0x2a/0x420 [ 154.753429][ T9547] ? __fget_files+0x3a0/0x420 [ 154.753456][ T9547] __sys_sendmmsg+0x227/0x430 [ 154.753481][ T9547] ? __pfx___sys_sendmmsg+0x10/0x10 [ 154.753509][ T9547] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 154.753546][ T9547] ? ksys_write+0x22a/0x250 [ 154.753571][ T9547] ? __pfx_ksys_write+0x10/0x10 [ 154.753598][ T9547] __x64_sys_sendmmsg+0xa0/0xc0 [ 154.753619][ T9547] do_syscall_64+0xfa/0xfa0 [ 154.753635][ T9547] ? lockdep_hardirqs_on+0x9c/0x150 [ 154.753651][ T9547] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 154.753668][ T9547] ? clear_bhb_loop+0x60/0xb0 [ 154.753689][ T9547] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 154.753706][ T9547] RIP: 0033:0x7fdfaa78f6c9 [ 154.753722][ T9547] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 154.753735][ T9547] RSP: 002b:00007fdfab5f4038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 154.753754][ T9547] RAX: ffffffffffffffda RBX: 00007fdfaa9e5fa0 RCX: 00007fdfaa78f6c9 [ 154.753767][ T9547] RDX: 0000000000000001 RSI: 0000200000000fc0 RDI: 0000000000000003 [ 154.753777][ T9547] RBP: 00007fdfab5f4090 R08: 0000000000000000 R09: 0000000000000000 [ 154.753788][ T9547] R10: 0000000000004880 R11: 0000000000000246 R12: 0000000000000001 [ 154.753798][ T9547] R13: 00007fdfaa9e6038 R14: 00007fdfaa9e5fa0 R15: 00007ffceb089da8 [ 154.753829][ T9547] [ 155.123576][ T9554] team0: Device gtp0 is of different type [ 155.189738][ T9556] tipc: Enabled bearer , priority 0 [ 155.244686][ T9554] syzkaller0: entered promiscuous mode [ 155.264400][ T9554] syzkaller0: entered allmulticast mode [ 155.290869][ T9554] tipc: Resetting bearer [ 155.299754][ T9553] tipc: Resetting bearer [ 155.325890][ T9553] tipc: Disabling bearer [ 155.487150][ T9571] wg1 speed is unknown, defaulting to 1000 [ 155.507038][ T9571] lo speed is unknown, defaulting to 1000 [ 155.688416][ T9581] 8021q: VLANs not supported on sit0 [ 155.794540][ T9585] netlink: 'syz.0.963': attribute type 322 has an invalid length. [ 155.945529][ T9589] FAULT_INJECTION: forcing a failure. [ 155.945529][ T9589] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 155.986464][ T9589] CPU: 0 UID: 0 PID: 9589 Comm: syz.2.965 Not tainted syzkaller #0 PREEMPT(full) [ 155.986487][ T9589] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 155.986496][ T9589] Call Trace: [ 155.986502][ T9589] [ 155.986509][ T9589] dump_stack_lvl+0x189/0x250 [ 155.986534][ T9589] ? __pfx____ratelimit+0x10/0x10 [ 155.986559][ T9589] ? __pfx_dump_stack_lvl+0x10/0x10 [ 155.986579][ T9589] ? __pfx__printk+0x10/0x10 [ 155.986606][ T9589] should_fail_ex+0x414/0x560 [ 155.986634][ T9589] _copy_to_user+0x31/0xb0 [ 155.986657][ T9589] simple_read_from_buffer+0xe1/0x170 [ 155.986685][ T9589] proc_fail_nth_read+0x1b3/0x220 [ 155.986710][ T9589] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 155.986734][ T9589] ? rw_verify_area+0x2a6/0x4d0 [ 155.986755][ T9589] ? __lock_acquire+0xab9/0xd20 [ 155.986770][ T9589] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 155.986792][ T9589] vfs_read+0x200/0xa30 [ 155.986813][ T9589] ? fdget_pos+0x247/0x320 [ 155.986834][ T9589] ? __pfx___mutex_lock+0x10/0x10 [ 155.986852][ T9589] ? __pfx_vfs_read+0x10/0x10 [ 155.986873][ T9589] ? __fget_files+0x2a/0x420 [ 155.986892][ T9589] ? __fget_files+0x3a0/0x420 [ 155.986905][ T9589] ? __fget_files+0x2a/0x420 [ 155.986928][ T9589] ksys_read+0x145/0x250 [ 155.986949][ T9589] ? __pfx_ksys_read+0x10/0x10 [ 155.986972][ T9589] ? do_syscall_64+0xbe/0xfa0 [ 155.987001][ T9589] do_syscall_64+0xfa/0xfa0 [ 155.987015][ T9589] ? lockdep_hardirqs_on+0x9c/0x150 [ 155.987030][ T9589] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 155.987045][ T9589] ? clear_bhb_loop+0x60/0xb0 [ 155.987064][ T9589] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 155.987078][ T9589] RIP: 0033:0x7fe3e638e0dc [ 155.987093][ T9589] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 155.987105][ T9589] RSP: 002b:00007fe3e7184030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 155.987123][ T9589] RAX: ffffffffffffffda RBX: 00007fe3e65e5fa0 RCX: 00007fe3e638e0dc [ 155.987134][ T9589] RDX: 000000000000000f RSI: 00007fe3e71840a0 RDI: 0000000000000004 [ 155.987143][ T9589] RBP: 00007fe3e7184090 R08: 0000000000000000 R09: 0000000000000000 [ 155.987153][ T9589] R10: 0000000000004880 R11: 0000000000000246 R12: 0000000000000001 [ 155.987162][ T9589] R13: 00007fe3e65e6038 R14: 00007fe3e65e5fa0 R15: 00007fffd5625db8 [ 155.987191][ T9589] [ 156.517621][ T9602] __nla_validate_parse: 3 callbacks suppressed [ 156.517638][ T9602] netlink: 28 bytes leftover after parsing attributes in process `syz.2.968'. [ 156.554428][ T9602] netlink: 12 bytes leftover after parsing attributes in process `syz.2.968'. [ 156.569965][ T9597] wg1 speed is unknown, defaulting to 1000 [ 156.589274][ T9597] lo speed is unknown, defaulting to 1000 [ 156.651446][ T983] IPVS: starting estimator thread 0... [ 156.658435][ T9606] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 156.747316][ T9606] batman_adv: batadv0: Adding interface: vlan2 [ 156.753508][ T9606] batman_adv: batadv0: The MTU of interface vlan2 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 156.780150][ T9612] IPVS: using max 28 ests per chain, 67200 per kthread [ 156.819344][ T9606] batman_adv: batadv0: Not using interface vlan2 (retrying later): interface not active [ 156.904233][ T9626] netlink: 4 bytes leftover after parsing attributes in process `syz.0.973'. [ 157.132644][ T9626] bridge_slave_0: left allmulticast mode [ 157.146982][ T9641] siw: device registration error -23 [ 157.147738][ T9626] bridge_slave_0: left promiscuous mode [ 157.179142][ T9626] bridge0: port 1(bridge_slave_0) entered disabled state [ 157.469032][ T9652] netlink: 'syz.3.982': attribute type 8 has an invalid length. [ 157.576834][ T9654] wg1 speed is unknown, defaulting to 1000 [ 157.593703][ T9654] lo speed is unknown, defaulting to 1000 [ 157.889510][ T9676] netlink: 'syz.2.989': attribute type 3 has an invalid length. [ 157.938695][ T9681] netlink: 8 bytes leftover after parsing attributes in process `syz.4.990'. [ 157.968028][ T9681] netlink: 8 bytes leftover after parsing attributes in process `syz.4.990'. [ 157.977815][ T9681] netlink: 124 bytes leftover after parsing attributes in process `syz.4.990'. [ 158.292220][ T9701] wg1 speed is unknown, defaulting to 1000 [ 158.308806][ T9701] lo speed is unknown, defaulting to 1000 [ 158.867655][ T9740] tipc: Failed to remove unknown binding: 66,1,1/0:933339761/933339763 [ 158.901879][ T9740] tipc: Failed to remove unknown binding: 66,1,1/0:933339761/933339763 [ 158.931106][ T9740] tipc: Failed to remove unknown binding: 66,1,1/0:933339761/933339763 [ 159.092457][ T9755] tipc: Enabled bearer , priority 0 [ 159.100094][ T9755] syzkaller0: entered promiscuous mode [ 159.105829][ T9755] syzkaller0: entered allmulticast mode [ 159.139873][ T9760] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1016'. [ 159.162821][ T9755] netlink: 'syz.0.1014': attribute type 21 has an invalid length. [ 159.171425][ T9755] netlink: 'syz.0.1014': attribute type 6 has an invalid length. [ 159.179441][ T9755] netlink: 64 bytes leftover after parsing attributes in process `syz.0.1014'. [ 159.220901][ T9755] tipc: Resetting bearer [ 159.254628][ T9754] tipc: Resetting bearer [ 159.273954][ T30] audit: type=1800 audit(1763215902.400:3): pid=9763 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.1018" name="blkio.bfq.time_recursive" dev="tmpfs" ino=1029 res=0 errno=0 [ 159.342661][ T9754] tipc: Disabling bearer [ 159.893572][ T9794] wg1 speed is unknown, defaulting to 1000 [ 159.910022][ T9794] lo speed is unknown, defaulting to 1000 [ 159.959233][ T9800] x_tables: ip6_tables: mh match: only valid for protocol 135 [ 160.920506][ T9849] bridge0: trying to set multicast startup query interval below minimum, setting to 100 (1000ms) [ 160.949242][ T9841] netlink: 'syz.2.1040': attribute type 1 has an invalid length. [ 160.972394][ T9841] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1040'. [ 161.013055][ T9849] syzkaller1: tun_chr_ioctl cmd 1074025677 [ 161.052699][ T9849] syzkaller1: linktype set to 778 [ 161.174644][ T9856] wg1 speed is unknown, defaulting to 1000 [ 161.195681][ T9856] lo speed is unknown, defaulting to 1000 [ 161.286343][ T9860] syzkaller0: entered promiscuous mode [ 161.304858][ T9860] syzkaller0: entered allmulticast mode [ 161.358967][ T9869] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1044'. [ 161.501948][ T9868] wg1 speed is unknown, defaulting to 1000 [ 161.524441][ T9868] lo speed is unknown, defaulting to 1000 [ 162.507651][ T9928] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1059'. [ 162.523285][ T9898] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 162.781390][ T5912] wg1 speed is unknown, defaulting to 1000 [ 162.789585][ T60] netdevsim netdevsim0 eth0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 162.812914][ T5912] syz0: Port: 1 Link DOWN [ 162.827453][ T60] netdevsim netdevsim0 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 162.852321][ T60] netdevsim netdevsim0 eth1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 162.882817][ T60] netdevsim netdevsim0 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 162.914270][ T60] netdevsim netdevsim0 eth2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 162.922796][ T60] netdevsim netdevsim0 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 162.956284][ T60] netdevsim netdevsim0 eth3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 162.982973][ T60] netdevsim netdevsim0 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 163.528574][ T9968] netlink: 'syz.4.1064': attribute type 6 has an invalid length. [ 163.685205][ T9996] netlink: 14 bytes leftover after parsing attributes in process `syz.0.1072'. [ 163.699844][ T9996] netlink: 'syz.0.1072': attribute type 10 has an invalid length. [ 163.709977][ T9996] bond0: (slave wlan1): Opening slave failed [ 163.846097][T10003] netlink: 48 bytes leftover after parsing attributes in process `syz.4.1074'. [ 163.890444][T10005] wg1 speed is unknown, defaulting to 1000 [ 163.905977][T10005] lo speed is unknown, defaulting to 1000 [ 164.075885][T10016] wg1 speed is unknown, defaulting to 1000 [ 164.083441][T10016] lo speed is unknown, defaulting to 1000 [ 164.155841][T10020] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1077'. [ 164.183859][T10019] mac80211_hwsim hwsim2 wlan0: entered promiscuous mode [ 164.213846][T10020] bond4: option broadcast_neighbor: mode dependency failed, not supported in mode balance-rr(0) [ 164.225818][T10020] bond4 (unregistering): Released all slaves [ 164.310922][T10024] wg1 speed is unknown, defaulting to 1000 [ 164.318903][T10024] lo speed is unknown, defaulting to 1000 [ 164.831114][T10052] netlink: 72 bytes leftover after parsing attributes in process `syz.0.1084'. [ 164.847356][T10053] netlink: 24 bytes leftover after parsing attributes in process `syz.4.1086'. [ 164.956997][T10059] tipc: Enabled bearer , priority 0 [ 164.972675][T10059] syzkaller0: entered promiscuous mode [ 164.996904][T10059] syzkaller0: entered allmulticast mode [ 165.113433][T10065] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1089'. [ 165.116562][T10059] tipc: Resetting bearer [ 165.185729][T10058] tipc: Resetting bearer [ 165.235641][T10073] netlink: 16 bytes leftover after parsing attributes in process `syz.3.1091'. [ 165.235790][T10058] tipc: Disabling bearer [ 165.284068][T10073] tipc: Enabled bearer , priority 0 [ 165.327899][T10072] tipc: Disabling bearer [ 165.453603][T10086] wg1 speed is unknown, defaulting to 1000 [ 165.476972][T10086] lo speed is unknown, defaulting to 1000 [ 165.497831][T10092] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1094'. [ 165.580767][T10099] netlink: 276 bytes leftover after parsing attributes in process `syz.2.1099'. [ 165.589465][T10094] can: request_module (can-proto-4) failed. [ 165.649797][T10094] 8021q: adding VLAN 0 to HW filter on device team0 [ 165.661205][T10094] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 165.758280][T10101] wg1 speed is unknown, defaulting to 1000 [ 165.786621][T10101] lo speed is unknown, defaulting to 1000 [ 165.932841][T10115] Bluetooth: hci0: Opcode 0x0c1a failed: -22 [ 166.127360][T10123] IPVS: set_ctl: invalid protocol: 58 10.1.1.2:20000 [ 166.518198][T10136] tipc: Enabled bearer , priority 0 [ 167.064394][T10149] wg1 speed is unknown, defaulting to 1000 [ 167.101581][T10149] lo speed is unknown, defaulting to 1000 [ 167.156826][T10172] veth0: entered promiscuous mode [ 167.550873][T10194] netlink: 'syz.0.1129': attribute type 1 has an invalid length. [ 167.668448][T10194] 8021q: adding VLAN 0 to HW filter on device bond3 [ 167.710334][T10202] __nla_validate_parse: 6 callbacks suppressed [ 167.710350][T10202] netlink: 3 bytes leftover after parsing attributes in process `syz.0.1129'. [ 167.905377][T10199] 8021q: adding VLAN 0 to HW filter on device bond3 [ 167.912448][T10199] bond3: (slave vxcan3): The slave device specified does not support setting the MAC address [ 167.935177][T10199] bond3: (slave vxcan3): Error -95 calling set_mac_address [ 167.942542][ T5145] Bluetooth: hci0: command tx timeout [ 167.968696][ T5887] tipc: Node number set to 104383790 [ 168.174138][T10220] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1135'. [ 168.232046][T10220] bond1: option broadcast_neighbor: mode dependency failed, not supported in mode balance-rr(0) [ 168.256467][T10220] bond1 (unregistering): Released all slaves [ 168.284070][T10225] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1137'. [ 168.293617][T10225] bond0: Unable to set up delay as MII monitoring is disabled [ 168.368518][T10227] 8021q: adding VLAN 0 to HW filter on device bond1 [ 168.388759][T10227] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 168.417278][T10227] bond1: (slave macvlan2): Enslaving as a backup interface with a down link [ 168.437029][T10227] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 168.474030][T10233] netlink: 64 bytes leftover after parsing attributes in process `syz.3.1140'. [ 168.490856][T10229] A link change request failed with some changes committed already. Interface veth0_to_bond may have been left with an inconsistent configuration, please check. [ 168.653027][T10247] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1145'. [ 168.665196][T10248] openvswitch: netlink: nsh attribute has 65532 unknown bytes. [ 168.683125][T10248] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 168.730101][T10250] trusted_key: syz.0.1146 sent an empty control message without MSG_MORE. [ 168.746634][T10250] openvswitch: netlink: Key type 31 is not supported [ 168.768949][T10255] netlink: 40 bytes leftover after parsing attributes in process `syz.1.1148'. [ 168.863683][T10255] Bluetooth: MGMT ver 1.23 [ 168.992966][T10267] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1151'. [ 169.004560][T10267] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1151'. [ 169.039755][T10270] wg1 speed is unknown, defaulting to 1000 [ 169.060129][T10270] lo speed is unknown, defaulting to 1000 [ 169.458672][T10286] netlink: 48 bytes leftover after parsing attributes in process `syz.2.1157'. [ 169.633373][ T30] audit: type=1804 audit(1763215912.760:4): pid=10296 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.3.1159" name="/newroot/248/x000000000000000400000000000000000000004" dev="tmpfs" ino=1286 res=1 errno=0 [ 169.667835][ T30] audit: type=1800 audit(1763215912.800:5): pid=10296 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.1159" name="x000000000000000400000000000000000000004" dev="tmpfs" ino=1286 res=0 errno=0 [ 169.716856][T10300] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1161'. [ 169.726048][T10300] netlink: 'syz.1.1161': attribute type 12 has an invalid length. [ 169.739698][T10300] netlink: 'syz.1.1161': attribute type 12 has an invalid length. [ 169.850722][T10310] RDS: rds_bind could not find a transport for fe80::aa, load rds_tcp or rds_rdma? [ 169.985046][T10324] netlink: 'syz.3.1166': attribute type 1 has an invalid length. [ 170.238404][T10343] wg1 speed is unknown, defaulting to 1000 [ 170.246854][T10343] lo speed is unknown, defaulting to 1000 [ 170.448052][T10358] xt_hashlimit: max too large, truncated to 1048576 [ 170.783649][T10365] batman_adv: batadv0: Removing interface: vlan2 [ 170.837830][T10369] netlink: 'syz.3.1184': attribute type 3 has an invalid length. [ 171.426354][T10390] wg1: entered promiscuous mode [ 171.431496][T10390] wg1: entered allmulticast mode [ 171.538310][T10410] netlink: 'syz.4.1195': attribute type 3 has an invalid length. [ 171.704643][T10421] tipc: Can't bind to reserved service type 1 [ 171.726103][T10421] netlink: 'syz.1.1198': attribute type 5 has an invalid length. [ 171.768145][T10421] vlan2: entered allmulticast mode [ 171.847374][T10424] vlan2: entered allmulticast mode [ 172.241967][T10435] xt_NFQUEUE: number of queues (65532) out of range (got 118598) [ 172.264503][T10435] ip6gretap2: entered promiscuous mode [ 172.317921][T10451] netlink: 'syz.4.1206': attribute type 4 has an invalid length. [ 172.417966][ T5879] lo speed is unknown, defaulting to 1000 [ 172.434321][ T5879] syz1: Port: 1 Link DOWN [ 172.453891][T10461] netlink: 'syz.1.1209': attribute type 10 has an invalid length. [ 172.487468][T10461] team0: Port device syz_tun added [ 172.580187][T10468] syzkaller0: entered promiscuous mode [ 172.601086][T10468] syzkaller0: entered allmulticast mode [ 172.716832][T10482] __nla_validate_parse: 13 callbacks suppressed [ 172.716849][T10482] netlink: 212368 bytes leftover after parsing attributes in process `syz.1.1213'. [ 172.883750][T10486] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1216'. [ 172.905884][T10486] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1216'. [ 172.952216][T10486] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1216'. [ 172.961381][T10486] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1216'. [ 173.005258][T10486] netlink: 'syz.2.1216': attribute type 1 has an invalid length. [ 173.333879][T10509] wg1 speed is unknown, defaulting to 1000 [ 173.400989][T10509] lo speed is unknown, defaulting to 1000 [ 173.470132][ T30] audit: type=1800 audit(1763215916.530:6): pid=10517 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.1223" name="memory.events" dev="tmpfs" ino=1366 res=0 errno=0 [ 174.227698][T10555] netlink: 20 bytes leftover after parsing attributes in process `syz.3.1234'. [ 174.380840][T10568] x_tables: unsorted underflow at hook 3 [ 174.641480][T10577] bond0: option active_slave: mode dependency failed, not supported in mode balance-rr(0) [ 174.772540][T10588] vxcan2: entered allmulticast mode [ 174.802647][T10590] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1248'. [ 174.834361][T10592] xfrm1: entered allmulticast mode [ 175.024945][T10596] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 175.260795][T10596] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 175.310564][T10607] tipc: New replicast peer: 255.255.255.32 [ 175.318430][T10607] tipc: Enabled bearer , priority 10 [ 175.463676][T10617] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1253'. [ 175.470839][T10596] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 175.509876][T10608] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1252'. [ 175.544379][T10608] tipc: Disabling bearer [ 175.591633][T10607] syzkaller0: entered promiscuous mode [ 175.614343][T10607] syzkaller0: entered allmulticast mode [ 175.763676][T10596] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 176.063946][ T49] netdevsim netdevsim3 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 176.112548][ T49] netdevsim netdevsim3 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 176.224804][ T60] netdevsim netdevsim3 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 176.248483][ T60] netdevsim netdevsim3 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 176.315355][ T30] audit: type=1804 audit(1763215919.440:7): pid=10652 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.2.1262" name="/newroot/243/cgroup.controllers" dev="tmpfs" ino=1258 res=1 errno=0 [ 176.373579][ T30] audit: type=1800 audit(1763215919.470:8): pid=10652 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.1262" name="cgroup.controllers" dev="tmpfs" ino=1258 res=0 errno=0 [ 176.540645][T10666] syzkaller0: entered promiscuous mode [ 176.553465][T10666] syzkaller0: entered allmulticast mode [ 176.665967][T10669] bond2: option tlb_dynamic_lb: mode dependency failed, not supported in mode active-backup(1) [ 176.704788][T10669] bond2 (unregistering): Released all slaves [ 176.821427][T10665] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1267'. [ 177.094644][T10692] veth0_to_batadv: Caught tx_queue_len zero misconfig [ 177.312103][T10703] tunl0: Caught tx_queue_len zero misconfig [ 177.408999][T10699] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 177.734771][T10733] xt_TCPMSS: Only works on TCP SYN packets [ 177.768591][T10733] sctp: [Deprecated]: syz.3.1284 (pid 10733) Use of int in max_burst socket option deprecated. [ 177.768591][T10733] Use struct sctp_assoc_value instead [ 177.790009][T10735] __nla_validate_parse: 3 callbacks suppressed [ 177.790026][T10735] netlink: 256 bytes leftover after parsing attributes in process `syz.0.1285'. [ 178.073488][T10746] wg1 speed is unknown, defaulting to 1000 [ 178.081553][T10746] lo speed is unknown, defaulting to 1000 [ 178.100461][T10747] netlink: 64 bytes leftover after parsing attributes in process `syz.1.1288'. [ 178.442384][T10761] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1291'. [ 178.453021][T10761] sctp: [Deprecated]: syz.0.1291 (pid 10761) Use of struct sctp_assoc_value in delayed_ack socket option. [ 178.453021][T10761] Use struct sctp_sack_info instead [ 178.677397][T10774] syzkaller1: entered promiscuous mode [ 178.682997][T10774] syzkaller1: entered allmulticast mode [ 178.771085][T10775] netlink: 'syz.2.1289': attribute type 6 has an invalid length. [ 179.004364][T10782] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1299'. [ 179.282028][T10790] wg1 speed is unknown, defaulting to 1000 [ 179.327197][T10790] lo speed is unknown, defaulting to 1000 [ 179.465837][T10813] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1306'. [ 179.493675][T10805] bond1 (unregistering): Released all slaves [ 179.885141][T10824] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1310'. [ 179.901943][T10834] wg1 speed is unknown, defaulting to 1000 [ 179.917661][T10834] lo speed is unknown, defaulting to 1000 [ 180.045123][T10848] dvmrp1: tun_chr_ioctl cmd 1074812118 [ 180.051394][T10848] tap0: tun_chr_ioctl cmd 1074025681 [ 180.713094][T10857] wg1 speed is unknown, defaulting to 1000 [ 180.743554][T10857] lo speed is unknown, defaulting to 1000 [ 181.215213][T10894] vlan0: entered promiscuous mode [ 181.235428][T10894] dummy0: entered promiscuous mode [ 181.277824][T10897] netlink: 'syz.1.1330': attribute type 13 has an invalid length. [ 181.374510][T10907] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1333'. [ 181.383648][T10907] netlink: 348 bytes leftover after parsing attributes in process `syz.4.1333'. [ 181.392971][T10907] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1333'. [ 181.402465][T10907] netlink: 348 bytes leftover after parsing attributes in process `syz.4.1333'. [ 181.457957][T10897] bridge0: port 4(bond0) entered disabled state [ 181.464576][T10897] bridge0: port 3(macsec0) entered disabled state [ 181.471175][T10897] bridge0: port 2(bridge_slave_1) entered disabled state [ 181.478937][T10897] bridge0: port 1(bridge_slave_0) entered disabled state [ 181.576386][T10897] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 181.593643][T10897] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 181.713685][T10897] veth1_macvtap: left allmulticast mode [ 181.791056][ T2998] netdevsim netdevsim1 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 181.827598][ T2998] netdevsim netdevsim1 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 181.866500][T10902] wg1 speed is unknown, defaulting to 1000 [ 181.879660][ T2998] netdevsim netdevsim1 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 181.910369][ T2998] netdevsim netdevsim1 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 181.929720][T10902] lo speed is unknown, defaulting to 1000 [ 181.957345][ T2998] netdevsim netdevsim1 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 181.974338][ T2998] netdevsim netdevsim1 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 181.993649][ T2998] netdevsim netdevsim1 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 182.013216][ T2998] netdevsim netdevsim1 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 182.412179][T10934] tipc: Enabled bearer , priority 0 [ 182.426193][T10934] syzkaller0: entered promiscuous mode [ 182.441990][T10934] syzkaller0: entered allmulticast mode [ 182.513087][T10939] wg1: entered promiscuous mode [ 182.518290][T10939] wg1: entered allmulticast mode [ 182.530999][T10934] tipc: Resetting bearer [ 182.554418][T10931] tipc: Resetting bearer [ 182.642933][T10931] tipc: Disabling bearer [ 182.690467][ T7627] wg1 speed is unknown, defaulting to 1000 [ 182.696677][ T7627] syz0: Port: 1 Link ACTIVE [ 182.758309][T10945] x_tables: ip6_tables: tcp match: only valid for protocol 6 [ 182.836965][T10952] netlink: 'syz.1.1347': attribute type 10 has an invalid length. [ 182.852073][T10952] team0: Port device dummy0 added [ 182.929722][T10956] __nla_validate_parse: 2 callbacks suppressed [ 182.929739][T10956] netlink: 2 bytes leftover after parsing attributes in process `syz.4.1350'. [ 183.002017][T10956] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1350'. [ 183.152040][T10969] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1352'. [ 183.361285][T10975] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1356'. [ 183.372004][T10975] sctp: [Deprecated]: syz.3.1356 (pid 10975) Use of struct sctp_assoc_value in delayed_ack socket option. [ 183.372004][T10975] Use struct sctp_sack_info instead [ 183.592734][T10980] sctp: [Deprecated]: syz.0.1357 (pid 10980) Use of int in maxseg socket option. [ 183.592734][T10980] Use struct sctp_assoc_value instead [ 184.249875][T11023] x_tables: ip6_tables: mh match: only valid for protocol 135 [ 184.298243][T11022] wg1 speed is unknown, defaulting to 1000 [ 184.306900][T11022] lo speed is unknown, defaulting to 1000 [ 184.368370][T11028] netlink: 7 bytes leftover after parsing attributes in process `syz.3.1372'. [ 184.377546][T11028] netlink: 28 bytes leftover after parsing attributes in process `syz.3.1372'. [ 184.378295][T11025] netlink: 'syz.0.1371': attribute type 10 has an invalid length. [ 184.386616][T11028] netlink: 28 bytes leftover after parsing attributes in process `syz.3.1372'. [ 184.424627][T11025] 8021q: adding VLAN 0 to HW filter on device team0 [ 184.437882][T11025] bond0: (slave team0): Enslaving as an active interface with an up link [ 184.470116][T11032] A link change request failed with some changes committed already. Interface gre0 may have been left with an inconsistent configuration, please check. [ 184.546373][T11034] nbd: must specify a size in bytes for the device [ 184.553521][T11034] netlink: 40 bytes leftover after parsing attributes in process `syz.3.1374'. [ 185.119186][T11049] netlink: 100 bytes leftover after parsing attributes in process `syz.4.1378'. [ 185.138227][T11049] netlink: 211792 bytes leftover after parsing attributes in process `syz.4.1378'. [ 332.495661][ T31] INFO: task kworker/0:4:5887 blocked for more than 143 seconds. [ 332.503430][ T31] Not tainted syzkaller #0 [ 332.508388][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 332.517103][ T31] task:kworker/0:4 state:D stack:23624 pid:5887 tgid:5887 ppid:2 task_flags:0x4208060 flags:0x00080000 [ 332.529136][ T31] Workqueue: events rfkill_sync_work [ 332.534470][ T31] Call Trace: [ 332.537741][ T31] [ 332.540658][ T31] __schedule+0x1798/0x4cc0 SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 332.545186][ T31] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 332.550568][ T31] ? __pfx___schedule+0x10/0x10 [ 332.555585][ T31] ? schedule+0x91/0x360 [ 332.559850][ T31] schedule+0x165/0x360 [ 332.564043][ T31] schedule_preempt_disabled+0x13/0x30 [ 332.569608][ T31] __mutex_lock+0x7e6/0x1350 [ 332.574388][ T31] ? __mutex_lock+0x5bb/0x1350 [ 332.579173][ T31] ? nfc_rfkill_set_block+0x50/0x2e0 [ 332.584655][ T31] ? __pfx___mutex_lock+0x10/0x10 [ 332.589704][ T31] ? lockdep_hardirqs_on+0x9c/0x150 [ 332.595291][ T31] ? _raw_spin_unlock_irqrestore+0xad/0x110 [ 332.601199][ T31] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 332.607580][ T31] ? __pfx_nfc_rfkill_set_block+0x10/0x10 [ 332.613322][ T31] nfc_rfkill_set_block+0x50/0x2e0 [ 332.624270][ T31] ? __pfx_nfc_rfkill_set_block+0x10/0x10 [ 332.630036][ T31] rfkill_set_block+0x1d2/0x440 [ 332.678690][ T31] rfkill_sync_work+0x114/0x200 [ 332.683586][ T31] ? process_scheduled_works+0x9ef/0x17b0 [ 332.689351][ T31] process_scheduled_works+0xae1/0x17b0 [ 332.694923][ T31] ? __pfx_process_scheduled_works+0x10/0x10 [ 332.700899][ T31] worker_thread+0x8a0/0xda0 [ 332.705574][ T31] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 332.711913][ T31] ? __kthread_parkme+0x7b/0x200 [ 332.716869][ T31] kthread+0x711/0x8a0 [ 332.720928][ T31] ? __pfx_worker_thread+0x10/0x10 [ 332.726128][ T31] ? __pfx_kthread+0x10/0x10 [ 332.730706][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 332.735943][ T31] ? lockdep_hardirqs_on+0x9c/0x150 [ 332.741132][ T31] ? __pfx_kthread+0x10/0x10 [ 332.745722][ T31] ret_from_fork+0x4bc/0x870 [ 332.750296][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 332.755420][ T31] ? __switch_to_asm+0x39/0x70 [ 332.760182][ T31] ? __switch_to_asm+0x33/0x70 [ 332.764958][ T31] ? __pfx_kthread+0x10/0x10 [ 332.769539][ T31] ret_from_fork_asm+0x1a/0x30 [ 332.774339][ T31] [ 332.777392][ T31] INFO: task kworker/0:11:9923 blocked for more than 143 seconds. [ 332.785209][ T31] Not tainted syzkaller #0 [ 332.790127][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 332.798802][ T31] task:kworker/0:11 state:D stack:25832 pid:9923 tgid:9923 ppid:2 task_flags:0x4208060 flags:0x00080000 [ 332.810812][ T31] Workqueue: events rfkill_global_led_trigger_worker [ 332.817544][ T31] Call Trace: [ 332.820814][ T31] [ 332.823732][ T31] __schedule+0x1798/0x4cc0 [ 332.828310][ T31] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 332.833682][ T31] ? __pfx___schedule+0x10/0x10 [ 332.838558][ T31] ? schedule+0x91/0x360 [ 332.842790][ T31] schedule+0x165/0x360 [ 332.846955][ T31] schedule_preempt_disabled+0x13/0x30 [ 332.852400][ T31] __mutex_lock+0x7e6/0x1350 [ 332.857016][ T31] ? __mutex_lock+0x5bb/0x1350 [ 332.861771][ T31] ? rfkill_global_led_trigger_worker+0x27/0xd0 [ 332.868029][ T31] ? __pfx___mutex_lock+0x10/0x10 [ 332.873040][ T31] ? process_scheduled_works+0x9ef/0x17b0 [ 332.878785][ T31] ? process_scheduled_works+0x9ef/0x17b0 [ 332.884506][ T31] rfkill_global_led_trigger_worker+0x27/0xd0 [ 332.890556][ T31] ? process_scheduled_works+0x9ef/0x17b0 [ 332.896311][ T31] process_scheduled_works+0xae1/0x17b0 [ 332.901872][ T31] ? __pfx_process_scheduled_works+0x10/0x10 [ 332.907898][ T31] worker_thread+0x8a0/0xda0 [ 332.912506][ T31] kthread+0x711/0x8a0 [ 332.916595][ T31] ? __pfx_worker_thread+0x10/0x10 [ 332.921692][ T31] ? __pfx_kthread+0x10/0x10 [ 332.926287][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 332.931474][ T31] ? lockdep_hardirqs_on+0x9c/0x150 [ 332.936687][ T31] ? __pfx_kthread+0x10/0x10 [ 332.941265][ T31] ret_from_fork+0x4bc/0x870 [ 332.945874][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 332.950970][ T31] ? __switch_to_asm+0x39/0x70 [ 332.955819][ T31] ? __switch_to_asm+0x33/0x70 [ 332.960564][ T31] ? __pfx_kthread+0x10/0x10 [ 332.965368][ T31] ret_from_fork_asm+0x1a/0x30 [ 332.970170][ T31] [ 332.973209][ T31] INFO: task syz.2.1327:10888 blocked for more than 143 seconds. [ 332.981205][ T31] Not tainted syzkaller #0 [ 332.986188][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 332.994888][ T31] task:syz.2.1327 state:D stack:26568 pid:10888 tgid:10888 ppid:5823 task_flags:0x400040 flags:0x00080002 [ 333.006806][ T31] Call Trace: [ 333.010072][ T31] [ 333.013268][ T31] __schedule+0x1798/0x4cc0 [ 333.017891][ T31] ? validate_chain+0x897/0x2140 [ 333.022857][ T31] ? __lock_acquire+0xab9/0xd20 [ 333.027720][ T31] ? __pfx___schedule+0x10/0x10 [ 333.032584][ T31] ? schedule+0x91/0x360 [ 333.036856][ T31] schedule+0x165/0x360 [ 333.041002][ T31] schedule_timeout+0x9a/0x270 [ 333.045778][ T31] ? __pfx_schedule_timeout+0x10/0x10 [ 333.051146][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 333.056501][ T31] ? lockdep_hardirqs_on+0x9c/0x150 [ 333.061702][ T31] ? wait_for_completion+0x267/0x5d0 [ 333.067008][ T31] wait_for_completion+0x2bf/0x5d0 [ 333.072120][ T31] ? __pfx_wait_for_completion+0x10/0x10 [ 333.077806][ T31] ? __flush_work+0xd2/0xbc0 [ 333.082420][ T31] ? __flush_work+0xd2/0xbc0 [ 333.087037][ T31] __flush_work+0x9b9/0xbc0 [ 333.091546][ T31] ? __flush_work+0xd2/0xbc0 [ 333.096155][ T31] ? __pfx___flush_work+0x10/0x10 [ 333.101167][ T31] ? __pfx_wq_barrier_func+0x10/0x10 [ 333.106490][ T31] ? __pfx___cancel_work+0x10/0x10 [ 333.111853][ T31] ? nfc_genl_device_removed+0x23c/0x330 [ 333.117494][ T31] __cancel_work_sync+0xbe/0x110 [ 333.122435][ T31] rfkill_unregister+0x92/0x220 [ 333.127442][ T31] nfc_unregister_device+0x96/0x2a0 [ 333.132676][ T31] ? __pfx_virtual_ncidev_close+0x10/0x10 [ 333.138910][ T31] virtual_ncidev_close+0x56/0x90 [ 333.143968][ T31] __fput+0x44c/0xa70 [ 333.148000][ T31] task_work_run+0x1d4/0x260 [ 333.152604][ T31] ? __pfx_task_work_run+0x10/0x10 [ 333.157746][ T31] ? exit_to_user_mode_loop+0x40/0x130 [ 333.163199][ T31] exit_to_user_mode_loop+0xe9/0x130 [ 333.168493][ T31] do_syscall_64+0x2bd/0xfa0 [ 333.173069][ T31] ? lockdep_hardirqs_on+0x9c/0x150 [ 333.178279][ T31] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 333.184445][ T31] ? clear_bhb_loop+0x60/0xb0 [ 333.189544][ T31] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 333.195469][ T31] RIP: 0033:0x7fe3e638f6c9 [ 333.199926][ T31] RSP: 002b:00007fffd5625f18 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 333.208360][ T31] RAX: 0000000000000000 RBX: 000000000002c336 RCX: 00007fe3e638f6c9 [ 333.216428][ T31] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 333.224813][ T31] RBP: 00007fe3e65e7da0 R08: 0000000000000001 R09: 0000000fd562620f [ 333.232774][ T31] R10: 0000001b2fb20000 R11: 0000000000000246 R12: 00007fe3e65e5fac [ 333.240762][ T31] R13: 00007fe3e65e5fa0 R14: ffffffffffffffff R15: 00007fffd5626030 [ 333.248761][ T31] [ 333.251778][ T31] INFO: task syz.1.1377:11045 blocked for more than 144 seconds. [ 333.262186][ T31] Not tainted syzkaller #0 [ 333.267154][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 333.275845][ T31] task:syz.1.1377 state:D stack:23792 pid:11045 tgid:11041 ppid:5822 task_flags:0x400140 flags:0x00080003 [ 333.287777][ T31] Call Trace: [ 333.291039][ T31] [ 333.293957][ T31] __schedule+0x1798/0x4cc0 [ 333.298507][ T31] ? __lock_acquire+0xab9/0xd20 [ 333.303346][ T31] ? __lock_acquire+0xab9/0xd20 [ 333.308235][ T31] ? __pfx___schedule+0x10/0x10 [ 333.313089][ T31] ? schedule+0x91/0x360 [ 333.317344][ T31] schedule+0x165/0x360 [ 333.321488][ T31] schedule_preempt_disabled+0x13/0x30 [ 333.326945][ T31] __mutex_lock+0x7e6/0x1350 [ 333.331517][ T31] ? rcu_is_watching+0x15/0xb0 [ 333.336285][ T31] ? __mutex_lock+0x5bb/0x1350 [ 333.341034][ T31] ? rfkill_register+0x37/0x8e0 [ 333.345888][ T31] ? __pfx___mutex_lock+0x10/0x10 [ 333.350892][ T31] ? netdev_run_todo+0xe1d/0xea0 [ 333.355840][ T31] ? lockdep_hardirqs_on+0x9c/0x150 [ 333.361024][ T31] ? __pfx_netdev_run_todo+0x10/0x10 [ 333.366331][ T31] ? __pfx_mod_delayed_work_on+0x10/0x10 [ 333.371963][ T31] rfkill_register+0x37/0x8e0 [ 333.379565][ T31] wiphy_register+0x246a/0x2d20 [ 333.384478][ T31] ? __pfx_wiphy_register+0x10/0x10 [ 333.389697][ T31] ? __pfx_netdev_run_todo+0x10/0x10 [ 333.395013][ T31] ? minstrel_ht_alloc+0x6e0/0x7e0 [ 333.400126][ T31] ? ieee80211_init_rate_ctrl_alg+0x56d/0x5f0 [ 333.406210][ T31] ieee80211_register_hw+0x3473/0x40d0 [ 333.411672][ T31] ? ieee80211_register_hw+0x14b1/0x40d0 [ 333.417329][ T31] ? __pfx_ieee80211_register_hw+0x10/0x10 [ 333.423122][ T31] ? _raw_spin_unlock_irqrestore+0x85/0x110 [ 333.429031][ T31] ? _raw_spin_unlock_irqrestore+0xad/0x110 [ 333.434942][ T31] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 333.441271][ T31] ? __hrtimer_setup+0x187/0x210 [ 333.446208][ T31] ? __pfx_mac80211_hwsim_beacon+0x10/0x10 [ 333.452004][ T31] mac80211_hwsim_new_radio+0x2f9a/0x5260 [ 333.457798][ T31] ? __pfx_mac80211_hwsim_new_radio+0x10/0x10 [ 333.463869][ T31] ? __asan_memset+0x22/0x50 [ 333.468492][ T31] ? __nla_validate_parse+0x2400/0x2d40 [ 333.474052][ T31] ? __x64_sys_sendmsg+0x19b/0x260 [ 333.479221][ T31] ? do_syscall_64+0xfa/0xfa0 [ 333.483913][ T31] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 333.489998][ T31] hwsim_new_radio_nl+0xf5b/0x1bd0 [ 333.495127][ T31] ? __pfx___nla_validate_parse+0x10/0x10 [ 333.500841][ T31] ? __pfx_hwsim_new_radio_nl+0x10/0x10 [ 333.506477][ T31] ? rcu_is_watching+0x15/0xb0 [ 333.511241][ T31] ? __nla_parse+0x40/0x60 [ 333.515730][ T31] ? genl_family_rcv_msg_attrs_parse+0x1c9/0x2a0 [ 333.522055][ T31] genl_family_rcv_msg_doit+0x215/0x300 [ 333.527632][ T31] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 333.533701][ T31] ? bpf_lsm_capable+0x9/0x20 [ 333.538521][ T31] ? security_capable+0x7e/0x2e0 [ 333.543484][ T31] genl_rcv_msg+0x60e/0x790 [ 333.548101][ T31] ? __pfx_genl_rcv_msg+0x10/0x10 [ 333.553224][ T31] ? __pfx_hwsim_new_radio_nl+0x10/0x10 [ 333.558979][ T31] netlink_rcv_skb+0x208/0x470 [ 333.563755][ T31] ? __lock_acquire+0xab9/0xd20 [ 333.568633][ T31] ? __pfx_genl_rcv_msg+0x10/0x10 [ 333.573653][ T31] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 333.579002][ T31] ? down_read+0x1ad/0x2e0 [ 333.583423][ T31] genl_rcv+0x28/0x40 [ 333.587495][ T31] netlink_unicast+0x82f/0x9e0 [ 333.592276][ T31] ? __pfx_netlink_unicast+0x10/0x10 [ 333.597623][ T31] ? netlink_sendmsg+0x642/0xb30 [ 333.602553][ T31] ? skb_put+0x11b/0x210 [ 333.606811][ T31] netlink_sendmsg+0x805/0xb30 [ 333.611566][ T31] ? __pfx_netlink_sendmsg+0x10/0x10 [ 333.616905][ T31] ? aa_sock_msg_perm+0xf1/0x1d0 [ 333.622101][ T31] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 333.627415][ T31] ? __pfx_netlink_sendmsg+0x10/0x10 [ 333.632700][ T31] __sock_sendmsg+0x21c/0x270 [ 333.637403][ T31] ____sys_sendmsg+0x505/0x830 [ 333.642250][ T31] ? __pfx_____sys_sendmsg+0x10/0x10 [ 333.647574][ T31] ? import_iovec+0x74/0xa0 [ 333.652069][ T31] ___sys_sendmsg+0x21f/0x2a0 [ 333.656755][ T31] ? __pfx____sys_sendmsg+0x10/0x10 [ 333.661962][ T31] ? __fget_files+0x2a/0x420 [ 333.666554][ T31] ? __fget_files+0x3a0/0x420 [ 333.671218][ T31] __x64_sys_sendmsg+0x19b/0x260 [ 333.676158][ T31] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 333.681725][ T31] ? do_syscall_64+0xbe/0xfa0 [ 333.686445][ T31] do_syscall_64+0xfa/0xfa0 [ 333.690958][ T31] ? lockdep_hardirqs_on+0x9c/0x150 [ 333.696240][ T31] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 333.702310][ T31] ? clear_bhb_loop+0x60/0xb0 [ 333.707005][ T31] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 333.712884][ T31] RIP: 0033:0x7f024338f6c9 [ 333.717326][ T31] RSP: 002b:00007f02442e7038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 333.725746][ T31] RAX: ffffffffffffffda RBX: 00007f02435e6090 RCX: 00007f024338f6c9 [ 333.733709][ T31] RDX: 0000000000000000 RSI: 0000200000000100 RDI: 000000000000000e [ 333.741691][ T31] RBP: 00007f0243411f91 R08: 0000000000000000 R09: 0000000000000000 [ 333.749682][ T31] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 333.757663][ T31] R13: 00007f02435e6128 R14: 00007f02435e6090 R15: 00007fff50a400d8 [ 333.765657][ T31] [ 333.768672][ T31] INFO: task syz.3.1382:11060 blocked for more than 144 seconds. [ 333.776399][ T31] Not tainted syzkaller #0 [ 333.781311][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 333.789977][ T31] task:syz.3.1382 state:D stack:28328 pid:11060 tgid:11059 ppid:5839 task_flags:0x400040 flags:0x00080002 [ 333.801902][ T31] Call Trace: [ 333.805213][ T31] [ 333.808154][ T31] __schedule+0x1798/0x4cc0 [ 333.812682][ T31] ? __lock_acquire+0xab9/0xd20 [ 333.817568][ T31] ? __lock_acquire+0xab9/0xd20 [ 333.822414][ T31] ? __pfx___schedule+0x10/0x10 [ 333.827286][ T31] ? schedule+0x91/0x360 [ 333.831530][ T31] schedule+0x165/0x360 [ 333.835691][ T31] schedule_preempt_disabled+0x13/0x30 [ 333.841136][ T31] __mutex_lock+0x7e6/0x1350 [ 333.845731][ T31] ? __mutex_lock+0x5bb/0x1350 [ 333.850479][ T31] ? genl_rcv_msg+0x10d/0x790 [ 333.855214][ T31] ? __pfx___mutex_lock+0x10/0x10 [ 333.860228][ T31] ? __pfx___dev_queue_xmit+0x10/0x10 [ 333.865773][ T31] ? radix_tree_lookup+0x240/0x290 [ 333.870874][ T31] genl_rcv_msg+0x10d/0x790 [ 333.875394][ T31] ? __pfx_genl_rcv_msg+0x10/0x10 [ 333.880432][ T31] ? ref_tracker_free+0x63a/0x7d0 [ 333.885464][ T31] ? __asan_memcpy+0x40/0x70 [ 333.890038][ T31] ? __pfx_ref_tracker_free+0x10/0x10 [ 333.895415][ T31] netlink_rcv_skb+0x208/0x470 [ 333.900161][ T31] ? __lock_acquire+0xab9/0xd20 [ 333.905059][ T31] ? __pfx_genl_rcv_msg+0x10/0x10 [ 333.910071][ T31] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 333.915378][ T31] ? down_read+0x1ad/0x2e0 [ 333.919784][ T31] genl_rcv+0x28/0x40 [ 333.923745][ T31] netlink_unicast+0x82f/0x9e0 [ 333.928533][ T31] ? __pfx_netlink_unicast+0x10/0x10 [ 333.933806][ T31] ? netlink_sendmsg+0x642/0xb30 [ 333.938786][ T31] ? skb_put+0x11b/0x210 [ 333.943048][ T31] netlink_sendmsg+0x805/0xb30 [ 333.947834][ T31] ? __pfx_netlink_sendmsg+0x10/0x10 [ 333.953105][ T31] ? aa_sock_msg_perm+0xf1/0x1d0 [ 333.958061][ T31] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 333.963352][ T31] ? __pfx_netlink_sendmsg+0x10/0x10 [ 333.968648][ T31] __sock_sendmsg+0x21c/0x270 [ 333.973321][ T31] __sys_sendto+0x3bd/0x520 [ 333.977829][ T31] ? __pfx___sys_sendto+0x10/0x10 [ 333.982835][ T31] ? count_memcg_event_mm+0x21/0x260 [ 333.988135][ T31] ? exc_page_fault+0x82/0x100 [ 333.992898][ T31] ? do_user_addr_fault+0xc85/0x1380 [ 333.998202][ T31] __x64_sys_sendto+0xde/0x100 [ 334.002956][ T31] do_syscall_64+0xfa/0xfa0 [ 334.007549][ T31] ? lockdep_hardirqs_on+0x9c/0x150 [ 334.012732][ T31] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 334.018893][ T31] ? clear_bhb_loop+0x60/0xb0 [ 334.023568][ T31] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 334.029466][ T31] RIP: 0033:0x7fa82e79155c [ 334.033865][ T31] RSP: 002b:00007fa82f59fec0 EFLAGS: 00000293 ORIG_RAX: 000000000000002c [ 334.042286][ T31] RAX: ffffffffffffffda RBX: 00007fa82f59ffc0 RCX: 00007fa82e79155c [ 334.050281][ T31] RDX: 0000000000000020 RSI: 00007fa82f5a0010 RDI: 0000000000000003 [ 334.058288][ T31] RBP: 0000000000000000 R08: 00007fa82f59ff14 R09: 000000000000000c [ 334.066277][ T31] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000003 [ 334.074295][ T31] R13: 00007fa82f59ff68 R14: 00007fa82f5a0010 R15: 0000000000000000 [ 334.082276][ T31] [ 334.085315][ T31] INFO: task syz.0.1383:11062 blocked for more than 144 seconds. [ 334.093033][ T31] Not tainted syzkaller #0 [ 334.098099][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 334.106779][ T31] task:syz.0.1383 state:D stack:27368 pid:11062 tgid:11061 ppid:5835 task_flags:0x400140 flags:0x00080002 [ 334.118731][ T31] Call Trace: [ 334.122016][ T31] [ 334.124983][ T31] __schedule+0x1798/0x4cc0 [ 334.129489][ T31] ? __lock_acquire+0xab9/0xd20 [ 334.134361][ T31] ? __lock_acquire+0xab9/0xd20 [ 334.139213][ T31] ? __pfx___schedule+0x10/0x10 [ 334.144058][ T31] ? schedule+0x91/0x360 [ 334.148316][ T31] schedule+0x165/0x360 [ 334.152463][ T31] schedule_preempt_disabled+0x13/0x30 [ 334.158053][ T31] __mutex_lock+0x7e6/0x1350 [ 334.162644][ T31] ? __mutex_lock+0x5bb/0x1350 [ 334.167424][ T31] ? genl_rcv_msg+0x10d/0x790 [ 334.172104][ T31] ? __pfx___mutex_lock+0x10/0x10 [ 334.177167][ T31] ? stack_trace_save+0x9c/0xe0 [ 334.182066][ T31] ? radix_tree_lookup+0x240/0x290 [ 334.187193][ T31] genl_rcv_msg+0x10d/0x790 [ 334.191776][ T31] ? __lock_acquire+0xab9/0xd20 [ 334.197020][ T31] ? __pfx_genl_rcv_msg+0x10/0x10 [ 334.202043][ T31] netlink_rcv_skb+0x208/0x470 [ 334.206837][ T31] ? __lock_acquire+0xab9/0xd20 [ 334.211703][ T31] ? __pfx_genl_rcv_msg+0x10/0x10 [ 334.216753][ T31] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 334.222045][ T31] ? down_read+0x1ad/0x2e0 [ 334.226481][ T31] genl_rcv+0x28/0x40 [ 334.230455][ T31] netlink_unicast+0x82f/0x9e0 [ 334.235325][ T31] ? __pfx_netlink_unicast+0x10/0x10 [ 334.240597][ T31] ? netlink_sendmsg+0x642/0xb30 [ 334.245542][ T31] ? skb_put+0x11b/0x210 [ 334.249793][ T31] netlink_sendmsg+0x805/0xb30 [ 334.254578][ T31] ? __pfx_netlink_sendmsg+0x10/0x10 [ 334.259877][ T31] ? aa_sock_msg_perm+0xf1/0x1d0 [ 334.264853][ T31] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 334.270138][ T31] ? __pfx_netlink_sendmsg+0x10/0x10 [ 334.275467][ T31] __sock_sendmsg+0x21c/0x270 [ 334.280137][ T31] __sys_sendto+0x3bd/0x520 [ 334.284656][ T31] ? __pfx___sys_sendto+0x10/0x10 [ 334.289664][ T31] ? count_memcg_event_mm+0x21/0x260 [ 334.294990][ T31] ? exc_page_fault+0x82/0x100 [ 334.299737][ T31] ? do_user_addr_fault+0xc85/0x1380 [ 334.305031][ T31] __x64_sys_sendto+0xde/0x100 [ 334.309779][ T31] do_syscall_64+0xfa/0xfa0 [ 334.314301][ T31] ? lockdep_hardirqs_on+0x9c/0x150 [ 334.319493][ T31] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 334.325568][ T31] ? clear_bhb_loop+0x60/0xb0 [ 334.330227][ T31] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 334.336165][ T31] RIP: 0033:0x7ff99b79155c [ 334.340578][ T31] RSP: 002b:00007ff99c605ec0 EFLAGS: 00000293 ORIG_RAX: 000000000000002c [ 334.349008][ T31] RAX: ffffffffffffffda RBX: 00007ff99c605fc0 RCX: 00007ff99b79155c [ 334.356990][ T31] RDX: 0000000000000024 RSI: 00007ff99c606010 RDI: 0000000000000005 [ 334.364971][ T31] RBP: 0000000000000000 R08: 00007ff99c605f14 R09: 000000000000000c [ 334.372938][ T31] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000005 [ 334.380939][ T31] R13: 00007ff99c605f68 R14: 00007ff99c606010 R15: 0000000000000000 [ 334.389055][ T31] [ 334.392090][ T31] INFO: task syz.4.1385:11075 blocked for more than 145 seconds. [ 334.399899][ T31] Not tainted syzkaller #0 [ 334.404839][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 334.413491][ T31] task:syz.4.1385 state:D stack:28264 pid:11075 tgid:11074 ppid:5829 task_flags:0x400140 flags:0x00080002 [ 334.426160][ T31] Call Trace: [ 334.429562][ T31] [ 334.432510][ T31] __schedule+0x1798/0x4cc0 [ 334.437210][ T31] ? __lock_acquire+0xab9/0xd20 [ 334.442090][ T31] ? __lock_acquire+0xab9/0xd20 [ 334.446974][ T31] ? __pfx___schedule+0x10/0x10 [ 334.451837][ T31] ? schedule+0x91/0x360 [ 334.456197][ T31] schedule+0x165/0x360 [ 334.460346][ T31] schedule_preempt_disabled+0x13/0x30 [ 334.465811][ T31] __mutex_lock+0x7e6/0x1350 [ 334.470479][ T31] ? __mutex_lock+0x5bb/0x1350 [ 334.475295][ T31] ? genl_rcv_msg+0x10d/0x790 [ 334.480067][ T31] ? __pfx___mutex_lock+0x10/0x10 [ 334.485227][ T31] ? __pfx___dev_queue_xmit+0x10/0x10 [ 334.490600][ T31] ? radix_tree_lookup+0x240/0x290 [ 334.495736][ T31] genl_rcv_msg+0x10d/0x790 [ 334.500243][ T31] ? __pfx_genl_rcv_msg+0x10/0x10 [ 334.505292][ T31] ? ref_tracker_free+0x63a/0x7d0 [ 334.510405][ T31] ? __asan_memcpy+0x40/0x70 [ 334.515025][ T31] ? __pfx_ref_tracker_free+0x10/0x10 [ 334.520478][ T31] netlink_rcv_skb+0x208/0x470 [ 334.525256][ T31] ? __lock_acquire+0xab9/0xd20 [ 334.530186][ T31] ? __pfx_genl_rcv_msg+0x10/0x10 [ 334.535331][ T31] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 334.540723][ T31] ? down_read+0x1ad/0x2e0 [ 334.545168][ T31] genl_rcv+0x28/0x40 [ 334.549135][ T31] netlink_unicast+0x82f/0x9e0 [ 334.553904][ T31] ? __pfx_netlink_unicast+0x10/0x10 [ 334.559251][ T31] ? netlink_sendmsg+0x642/0xb30 [ 334.564222][ T31] ? skb_put+0x11b/0x210 [ 334.568467][ T31] netlink_sendmsg+0x805/0xb30 [ 334.573222][ T31] ? __pfx_netlink_sendmsg+0x10/0x10 [ 334.578554][ T31] ? aa_sock_msg_perm+0xf1/0x1d0 [ 334.583501][ T31] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 334.588808][ T31] ? __pfx_netlink_sendmsg+0x10/0x10 [ 334.594080][ T31] __sock_sendmsg+0x21c/0x270 [ 334.598769][ T31] __sys_sendto+0x3bd/0x520 [ 334.603254][ T31] ? __pfx___sys_sendto+0x10/0x10 [ 334.608291][ T31] ? count_memcg_event_mm+0x21/0x260 [ 334.613574][ T31] ? exc_page_fault+0x82/0x100 [ 334.618346][ T31] ? do_user_addr_fault+0xc85/0x1380 [ 334.623618][ T31] __x64_sys_sendto+0xde/0x100 [ 334.628386][ T31] do_syscall_64+0xfa/0xfa0 [ 334.632869][ T31] ? lockdep_hardirqs_on+0x9c/0x150 [ 334.638088][ T31] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 334.644144][ T31] ? clear_bhb_loop+0x60/0xb0 [ 334.648828][ T31] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 334.654730][ T31] RIP: 0033:0x7fdfaa79155c [ 334.659127][ T31] RSP: 002b:00007fdfab5f2ec0 EFLAGS: 00000293 ORIG_RAX: 000000000000002c [ 334.667549][ T31] RAX: ffffffffffffffda RBX: 00007fdfab5f2fc0 RCX: 00007fdfaa79155c [ 334.675619][ T31] RDX: 0000000000000024 RSI: 00007fdfab5f3010 RDI: 0000000000000003 [ 334.683596][ T31] RBP: 0000000000000000 R08: 00007fdfab5f2f14 R09: 000000000000000c [ 334.691612][ T31] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000003 [ 334.699612][ T31] R13: 00007fdfab5f2f68 R14: 00007fdfab5f3010 R15: 0000000000000000 [ 334.707623][ T31] [ 334.710649][ T31] INFO: task syz.4.1385:11076 blocked for more than 145 seconds. [ 334.718413][ T31] Not tainted syzkaller #0 [ 334.723340][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 334.732017][ T31] task:syz.4.1385 state:D stack:28328 pid:11076 tgid:11074 ppid:5829 task_flags:0x400040 flags:0x00080002 [ 334.743939][ T31] Call Trace: [ 334.747228][ T31] [ 334.750173][ T31] __schedule+0x1798/0x4cc0 [ 334.754698][ T31] ? __lock_acquire+0xab9/0xd20 [ 334.759553][ T31] ? __lock_acquire+0xab9/0xd20 [ 334.764452][ T31] ? __pfx___schedule+0x10/0x10 [ 334.769340][ T31] ? schedule+0x91/0x360 [ 334.773584][ T31] schedule+0x165/0x360 [ 334.777780][ T31] schedule_preempt_disabled+0x13/0x30 [ 334.783257][ T31] __mutex_lock+0x7e6/0x1350 [ 334.787861][ T31] ? __mutex_lock+0x5bb/0x1350 [ 334.792655][ T31] ? genl_rcv_msg+0x10d/0x790 [ 334.797353][ T31] ? __pfx___mutex_lock+0x10/0x10 [ 334.802374][ T31] ? __pfx___dev_queue_xmit+0x10/0x10 [ 334.807868][ T31] ? radix_tree_lookup+0x240/0x290 [ 334.812984][ T31] genl_rcv_msg+0x10d/0x790 [ 334.817667][ T31] ? __pfx_genl_rcv_msg+0x10/0x10 [ 334.822691][ T31] ? ref_tracker_free+0x63a/0x7d0 [ 334.827968][ T31] ? __asan_memcpy+0x40/0x70 [ 334.832553][ T31] ? __pfx_ref_tracker_free+0x10/0x10 [ 334.837935][ T31] netlink_rcv_skb+0x208/0x470 [ 334.842682][ T31] ? __lock_acquire+0xab9/0xd20 [ 334.847535][ T31] ? __pfx_genl_rcv_msg+0x10/0x10 [ 334.852553][ T31] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 334.857863][ T31] ? down_read+0x1ad/0x2e0 [ 334.862275][ T31] genl_rcv+0x28/0x40 [ 334.866378][ T31] netlink_unicast+0x82f/0x9e0 [ 334.871136][ T31] ? __pfx_netlink_unicast+0x10/0x10 [ 334.876440][ T31] ? netlink_sendmsg+0x642/0xb30 [ 334.881361][ T31] ? skb_put+0x11b/0x210 [ 334.885695][ T31] netlink_sendmsg+0x805/0xb30 [ 334.890448][ T31] ? __pfx_netlink_sendmsg+0x10/0x10 [ 334.895781][ T31] ? aa_sock_msg_perm+0xf1/0x1d0 [ 334.900756][ T31] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 334.906060][ T31] ? __pfx_netlink_sendmsg+0x10/0x10 [ 334.911332][ T31] __sock_sendmsg+0x21c/0x270 [ 334.916024][ T31] __sys_sendto+0x3bd/0x520 [ 334.920548][ T31] ? __pfx___sys_sendto+0x10/0x10 [ 334.925581][ T31] ? __lock_acquire+0xab9/0xd20 [ 334.930504][ T31] ? fd_install+0x97/0x540 [ 334.934948][ T31] ? fd_install+0x30d/0x540 [ 334.939436][ T31] __x64_sys_sendto+0xde/0x100 [ 334.944204][ T31] do_syscall_64+0xfa/0xfa0 [ 334.948702][ T31] ? lockdep_hardirqs_on+0x9c/0x150 [ 334.953878][ T31] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 334.959954][ T31] ? clear_bhb_loop+0x60/0xb0 [ 334.964649][ T31] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 334.970547][ T31] RIP: 0033:0x7fdfaa79155c [ 334.974996][ T31] RSP: 002b:00007fdfab5d1ec0 EFLAGS: 00000293 ORIG_RAX: 000000000000002c [ 334.983415][ T31] RAX: ffffffffffffffda RBX: 00007fdfab5d1fc0 RCX: 00007fdfaa79155c [ 334.991399][ T31] RDX: 0000000000000024 RSI: 00007fdfab5d2010 RDI: 0000000000000005 [ 334.999389][ T31] RBP: 0000000000000000 R08: 00007fdfab5d1f14 R09: 000000000000000c [ 335.007381][ T31] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000005 [ 335.015375][ T31] R13: 00007fdfab5d1f68 R14: 00007fdfab5d2010 R15: 0000000000000000 [ 335.023415][ T31] [ 335.026533][ T31] [ 335.026533][ T31] Showing all locks held in the system: [ 335.034382][ T31] 1 lock held by khungtaskd/31: [ 335.039314][ T31] #0: ffffffff8df3d6a0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 [ 335.049203][ T31] 2 locks held by getty/5588: [ 335.053863][ T31] #0: ffff88814d2b70a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 [ 335.063625][ T31] #1: ffffc9000332b2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x43e/0x1400 [ 335.073741][ T31] 4 locks held by kworker/0:4/5887: [ 335.079037][ T31] #0: ffff88801a055948 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x17b0 [ 335.090174][ T31] #1: ffffc90004497ba0 ((work_completion)(&rfkill->sync_work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x17b0 [ 335.102528][ T31] #2: ffffffff8f5aca68 (rfkill_global_mutex){+.+.}-{4:4}, at: rfkill_sync_work+0x2e/0x200 [ 335.112549][ T31] #3: ffff8880227e0100 (&dev->mutex){....}-{4:4}, at: nfc_rfkill_set_block+0x50/0x2e0 [ 335.122440][ T31] 3 locks held by kworker/0:11/9923: [ 335.127740][ T31] #0: ffff88801a055948 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x17b0 [ 335.138736][ T31] #1: ffffc90003a97ba0 ((work_completion)(&rfkill_global_led_trigger_work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x17b0 [ 335.152291][ T31] #2: ffffffff8f5aca68 (rfkill_global_mutex){+.+.}-{4:4}, at: rfkill_global_led_trigger_worker+0x27/0xd0 [ 335.163674][ T31] 1 lock held by syz.2.1327/10888: [ 335.168810][ T31] #0: ffff8880227e0100 (&dev->mutex){....}-{4:4}, at: nfc_unregister_device+0x63/0x2a0 [ 335.178584][ T31] 3 locks held by syz.1.1377/11045: [ 335.183760][ T31] #0: ffffffff8f3320b0 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 [ 335.191979][ T31] #1: ffffffff8f331ec8 (genl_mutex){+.+.}-{4:4}, at: genl_rcv_msg+0x10d/0x790 [ 335.201009][ T31] #2: ffffffff8f5aca68 (rfkill_global_mutex){+.+.}-{4:4}, at: rfkill_register+0x37/0x8e0 [ 335.211076][ T31] 2 locks held by syz.3.1382/11060: [ 335.216493][ T31] #0: ffffffff8f3320b0 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 [ 335.224705][ T31] #1: ffffffff8f331ec8 (genl_mutex){+.+.}-{4:4}, at: genl_rcv_msg+0x10d/0x790 [ 335.233657][ T31] 2 locks held by syz.0.1383/11062: [ 335.238869][ T31] #0: ffffffff8f3320b0 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 [ 335.247081][ T31] #1: ffffffff8f331ec8 (genl_mutex){+.+.}-{4:4}, at: genl_rcv_msg+0x10d/0x790 [ 335.256180][ T31] 2 locks held by syz.4.1385/11075: [ 335.261376][ T31] #0: ffffffff8f3320b0 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 [ 335.269584][ T31] #1: ffffffff8f331ec8 (genl_mutex){+.+.}-{4:4}, at: genl_rcv_msg+0x10d/0x790 [ 335.278612][ T31] 2 locks held by syz.4.1385/11076: [ 335.283787][ T31] #0: ffffffff8f3320b0 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 [ 335.291984][ T31] #1: ffffffff8f331ec8 (genl_mutex){+.+.}-{4:4}, at: genl_rcv_msg+0x10d/0x790 [ 335.300991][ T31] 2 locks held by syz-executor/11079: [ 335.306393][ T31] #0: ffff88807acff918 (&data->open_mutex){+.+.}-{4:4}, at: vhci_create_device+0x34/0x650 [ 335.316404][ T31] #1: ffffffff8f5aca68 (rfkill_global_mutex){+.+.}-{4:4}, at: rfkill_register+0x37/0x8e0 [ 335.326323][ T31] 2 locks held by syz-executor/11081: [ 335.331722][ T31] #0: ffff888071d00118 (&data->open_mutex){+.+.}-{4:4}, at: vhci_create_device+0x34/0x650 [ 335.341907][ T31] #1: ffffffff8f5aca68 (rfkill_global_mutex){+.+.}-{4:4}, at: rfkill_register+0x37/0x8e0 [ 335.351856][ T31] 2 locks held by syz-executor/11084: [ 335.357232][ T31] #0: ffff88807db17918 (&data->open_mutex){+.+.}-{4:4}, at: vhci_create_device+0x34/0x650 [ 335.367249][ T31] #1: ffffffff8f5aca68 (rfkill_global_mutex){+.+.}-{4:4}, at: rfkill_register+0x37/0x8e0 [ 335.377305][ T31] 2 locks held by syz-executor/11085: [ 335.382656][ T31] #0: ffff8880268f2118 (&data->open_mutex){+.+.}-{4:4}, at: vhci_create_device+0x34/0x650 [ 335.392760][ T31] #1: ffffffff8f5aca68 (rfkill_global_mutex){+.+.}-{4:4}, at: rfkill_register+0x37/0x8e0 [ 335.402703][ T31] 2 locks held by syz-executor/11087: [ 335.408098][ T31] #0: ffff88807ca32118 (&data->open_mutex){+.+.}-{4:4}, at: vhci_create_device+0x34/0x650 [ 335.418154][ T31] #1: ffffffff8f5aca68 (rfkill_global_mutex){+.+.}-{4:4}, at: rfkill_register+0x37/0x8e0 [ 335.428089][ T31] 2 locks held by syz-executor/11089: [ 335.433621][ T31] #0: ffff8880279f0118 (&data->open_mutex){+.+.}-{4:4}, at: vhci_create_device+0x34/0x650 [ 335.443667][ T31] #1: ffffffff8f5aca68 (rfkill_global_mutex){+.+.}-{4:4}, at: rfkill_register+0x37/0x8e0 [ 335.453734][ T31] 2 locks held by syz-executor/11091: [ 335.461021][ T31] #0: ffff888054f93918 (&data->open_mutex){+.+.}-{4:4}, at: vhci_create_device+0x34/0x650 [ 335.471615][ T31] #1: ffffffff8f5aca68 (rfkill_global_mutex){+.+.}-{4:4}, at: rfkill_register+0x37/0x8e0 [ 335.481651][ T31] 2 locks held by syz-executor/11094: [ 335.487057][ T31] #0: ffff888021b5c918 (&data->open_mutex){+.+.}-{4:4}, at: vhci_create_device+0x34/0x650 [ 335.497105][ T31] #1: ffffffff8f5aca68 (rfkill_global_mutex){+.+.}-{4:4}, at: rfkill_register+0x37/0x8e0 [ 335.507057][ T31] 2 locks held by syz-executor/11095: [ 335.512436][ T31] #0: ffff888021b5b118 (&data->open_mutex){+.+.}-{4:4}, at: vhci_create_device+0x34/0x650 [ 335.522485][ T31] #1: ffffffff8f5aca68 (rfkill_global_mutex){+.+.}-{4:4}, at: rfkill_register+0x37/0x8e0 [ 335.532491][ T31] 2 locks held by syz-executor/11097: [ 335.537912][ T31] #0: ffff888070758118 (&data->open_mutex){+.+.}-{4:4}, at: vhci_create_device+0x34/0x650 [ 335.548005][ T31] #1: ffffffff8f5aca68 (rfkill_global_mutex){+.+.}-{4:4}, at: rfkill_register+0x37/0x8e0 [ 335.558308][ T31] 2 locks held by syz-executor/11099: [ 335.563659][ T31] #0: ffff88807d1cd118 (&data->open_mutex){+.+.}-{4:4}, at: vhci_create_device+0x34/0x650 [ 335.573692][ T31] #1: ffffffff8f5aca68 (rfkill_global_mutex){+.+.}-{4:4}, at: rfkill_register+0x37/0x8e0 [ 335.583640][ T31] 2 locks held by syz-executor/11101: [ 335.589029][ T31] #0: ffff88807d033118 (&data->open_mutex){+.+.}-{4:4}, at: vhci_create_device+0x34/0x650 [ 335.599135][ T31] #1: ffffffff8f5aca68 (rfkill_global_mutex){+.+.}-{4:4}, at: rfkill_register+0x37/0x8e0 [ 335.609082][ T31] 2 locks held by syz-executor/11104: [ 335.614510][ T31] #0: ffff88802ed27118 (&data->open_mutex){+.+.}-{4:4}, at: vhci_create_device+0x34/0x650 [ 335.624580][ T31] #1: ffffffff8f5aca68 (rfkill_global_mutex){+.+.}-{4:4}, at: rfkill_register+0x37/0x8e0 [ 335.635025][ T31] 2 locks held by syz-executor/11105: [ 335.640418][ T31] #0: ffff88802079d118 (&data->open_mutex){+.+.}-{4:4}, at: vhci_create_device+0x34/0x650 [ 335.650467][ T31] #1: ffffffff8f5aca68 (rfkill_global_mutex){+.+.}-{4:4}, at: rfkill_register+0x37/0x8e0 [ 335.660465][ T31] 2 locks held by syz-executor/11107: [ 335.665849][ T31] #0: ffff88807c935918 (&data->open_mutex){+.+.}-{4:4}, at: vhci_create_device+0x34/0x650 [ 335.675882][ T31] #1: ffffffff8f5aca68 (rfkill_global_mutex){+.+.}-{4:4}, at: rfkill_register+0x37/0x8e0 [ 335.686020][ T31] [ 335.688352][ T31] ============================================= [ 335.688352][ T31] [ 335.696879][ T31] NMI backtrace for cpu 1 [ 335.696900][ T31] CPU: 1 UID: 0 PID: 31 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) [ 335.696919][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 335.696929][ T31] Call Trace: [ 335.696936][ T31] [ 335.696944][ T31] dump_stack_lvl+0x189/0x250 [ 335.696974][ T31] ? __pfx_dump_stack_lvl+0x10/0x10 [ 335.697001][ T31] ? __pfx__printk+0x10/0x10 [ 335.697031][ T31] nmi_cpu_backtrace+0x39e/0x3d0 [ 335.697056][ T31] ? __pfx_nmi_cpu_backtrace+0x10/0x10 [ 335.697079][ T31] ? __pfx__printk+0x10/0x10 [ 335.697101][ T31] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 335.697121][ T31] nmi_trigger_cpumask_backtrace+0x17a/0x300 [ 335.697152][ T31] watchdog+0xf60/0xfa0 [ 335.697175][ T31] ? watchdog+0x1e2/0xfa0 [ 335.697198][ T31] kthread+0x711/0x8a0 [ 335.697222][ T31] ? __pfx_watchdog+0x10/0x10 [ 335.697238][ T31] ? __pfx_kthread+0x10/0x10 [ 335.697261][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 335.697285][ T31] ? lockdep_hardirqs_on+0x9c/0x150 [ 335.697300][ T31] ? __pfx_kthread+0x10/0x10 [ 335.697328][ T31] ret_from_fork+0x4bc/0x870 [ 335.697348][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 335.697373][ T31] ? __switch_to_asm+0x39/0x70 [ 335.697387][ T31] ? __switch_to_asm+0x33/0x70 [ 335.697400][ T31] ? __pfx_kthread+0x10/0x10 [ 335.697422][ T31] ret_from_fork_asm+0x1a/0x30 [ 335.697454][ T31] [ 335.697460][ T31] Sending NMI from CPU 1 to CPUs 0: [ 335.842332][ C0] NMI backtrace for cpu 0 [ 335.842362][ C0] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted syzkaller #0 PREEMPT(full) [ 335.842378][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 335.842387][ C0] RIP: 0010:pv_native_safe_halt+0x13/0x20 [ 335.842406][ C0] Code: cc cc cc cc cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d f3 20 21 00 f3 0f 1e fa fb f4 c8 e6 02 00 cc cc cc cc cc cc cc cc 90 90 90 90 90 90 90 90 90 [ 335.842419][ C0] RSP: 0018:ffffffff8dc07d80 EFLAGS: 000002c6 [ 335.842433][ C0] RAX: 8dab207388661800 RBX: ffffffff81967b47 RCX: 8dab207388661800 [ 335.842444][ C0] RDX: 0000000000000001 RSI: ffffffff8d7102db RDI: ffffffff8bbf0760 [ 335.842454][ C0] RBP: ffffffff8dc07ea8 R08: ffff8880b8832fdb R09: 1ffff110171065fb [ 335.842465][ C0] R10: dffffc0000000000 R11: ffffed10171065fc R12: ffffffff8f7cfd70 [ 335.842476][ C0] R13: 0000000000000000 R14: 0000000000000000 R15: 1ffffffff1b92a40 [ 335.842486][ C0] FS: 0000000000000000(0000) GS:ffff888126138000(0000) knlGS:0000000000000000 [ 335.842497][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 335.842507][ C0] CR2: 000055d0129d0000 CR3: 000000000dd38000 CR4: 00000000003526f0 [ 335.842520][ C0] Call Trace: [ 335.842528][ C0] [ 335.842533][ C0] default_idle+0x13/0x20 [ 335.842550][ C0] default_idle_call+0x73/0xb0 [ 335.842573][ C0] do_idle+0x1e7/0x510 [ 335.842589][ C0] ? lockdep_hardirqs_on+0x9c/0x150 [ 335.842606][ C0] ? __pfx_do_idle+0x10/0x10 [ 335.842624][ C0] ? do_idle+0x4e7/0x510 [ 335.842641][ C0] cpu_startup_entry+0x44/0x60 [ 335.842655][ C0] rest_init+0x2de/0x300 [ 335.842673][ C0] start_kernel+0x3ae/0x410 [ 335.842693][ C0] x86_64_start_reservations+0x24/0x30 [ 335.842709][ C0] x86_64_start_kernel+0x143/0x1c0 [ 335.842724][ C0] common_startup_64+0x13e/0x147 [ 335.842750][ C0]