last executing test programs: 2m56.950820423s ago: executing program 0 (id=461): r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nfc(&(0x7f0000000380), r1) (async) r3 = syz_genetlink_get_family_id$nfc(&(0x7f0000000380), r1) sendmsg$NFC_CMD_LLC_SET_PARAMS(r2, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000400)={0x24, r3, 0x1, 0x70bd26, 0x25dfdbfe, {}, [@NFC_ATTR_LLC_PARAM_RW={0x5, 0x10, 0x1}, @NFC_ATTR_DEVICE_INDEX={0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x10}, 0x8080) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000b80)={0x2, 0x2, &(0x7f0000000080)=@raw=[@call={0x85, 0x0, 0x0, 0xae}, @exit], &(0x7f0000000040)='GPL\x00', 0x8, 0x0, 0x0, 0x0, 0x29, '\x00', 0x0, 0x2a}, 0x94) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000100)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)={0x2c, r4, 0x1, 0x72bd29, 0x0, {{}, {@val={0x8, 0x3, r5}, @void}}, [@NL80211_ATTR_TX_RATES={0x10, 0x5a, 0x0, 0x1, [@NL80211_BAND_5GHZ={0xc, 0x1, 0x0, 0x1, [@NL80211_TXRATE_LEGACY={0x6, 0x1, [0xc, 0x16]}]}]}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40000}, 0x0) (async) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)={0x2c, r4, 0x1, 0x72bd29, 0x0, {{}, {@val={0x8, 0x3, r5}, @void}}, [@NL80211_ATTR_TX_RATES={0x10, 0x5a, 0x0, 0x1, [@NL80211_BAND_5GHZ={0xc, 0x1, 0x0, 0x1, [@NL80211_TXRATE_LEGACY={0x6, 0x1, [0xc, 0x16]}]}]}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40000}, 0x0) 2m56.809591329s ago: executing program 4 (id=463): r0 = socket(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(r1, 0x29, 0x1a, &(0x7f0000001a80)=0x5, 0x4) bind$inet6(r1, &(0x7f0000000140)={0xa, 0x4e22}, 0x1c) r2 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r2, &(0x7f0000000080)={0x2, 0x4e22, @empty}, 0x10) connect$unix(r2, &(0x7f0000000540)=@abs={0x0, 0x0, 0x4e23}, 0x6e) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=@newqdisc={0x44, 0x24, 0x3fe3aa0262d8c583, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}, {0x6}}, [@qdisc_kind_options=@q_fq_pie={{0xb}, {0x14, 0x8002, [@TCA_FQ_PIE_TARGET={0x8, 0x3, 0x2}, @TCA_FQ_PIE_TUPDATE={0x8, 0x4, 0x7}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x2}, 0x2000400c) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x275a, 0x0) mmap(&(0x7f0000002000/0x3000)=nil, 0x3000, 0x0, 0x12, r4, 0x0) r5 = socket$can_bcm(0x1d, 0x2, 0x2) r6 = syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000080)='ns/pid\x00') sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000640)=ANY=[@ANYBLOB="78000000120000022cbd7000ffdbdf2500000000", @ANYRES32=r3, @ANYBLOB="44cb777300bd060b2a7981b58402000180c2000000000014002b800819f9e6a824ccd34729b9596f144f5ba1615fb85d79b20a6ea187683004f3075ee008768fcd2acd1c6111686f77cf12c6a1c3553a16c6eab73a00a51990907b09cbd99925c79582d4496f41c5f0e7a8bd16a055487c92dedda7f6b5eb8fa2237d97d5ba82a00caf0d13dd89ee0c92e44d36900a0810162e1369770bc2330426644b5fd1605c2c7129d51c99e337d2386f047df0dcfa2a50d69a27199c9af57284a5b0d1e2b75c70f3a256c28b72e6c30bbd6d30790afa38ef1d852dd89dc31f9788c9a4f153f57f6faa33e9c52fe5ae5ccd4e3267409837705a1d269a2aacbd3e6cb8c7ccbbdbfa13d01f8cde255b77a5c75677dffbaac602ca60cb6283dd1477061c983a521dae71c184c3c307e179bc9734ca6290daa79a0893a1b5b748ea78db18a50882acbf1e26149d21b9e8e822", @ANYRES32=r4, @ANYBLOB="08000300080000000a00020030ce2a4b336b00001800128008000100707070000c00028008000100", @ANYRES32=r5, @ANYBLOB="0a000100bbbbbbbbbbbb000008001c00", @ANYRES32=r6, @ANYRES32=r6], 0x78}}, 0x0) 2m56.774204746s ago: executing program 0 (id=465): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x1, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x28}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x40000}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000140)=@newtfilter={0x38, 0x2c, 0xd27, 0x70bd28, 0x8000, {0x0, 0x0, 0x0, r3, {0x8, 0x7}, {}, {0xa, 0xfff3}}, [@filter_kind_options=@f_flower={{0xb}, {0x8, 0x2, [@TCA_FLOWER_KEY_ENC_OPTS={0x4}]}}]}, 0x38}, 0x1, 0x0, 0x0, 0x22044028}, 0x0) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="1e0000000000000004000000ff"], 0x50) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f0000001100)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast6-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r5, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r6 = accept4(r5, 0x0, 0x0, 0x800) sendmmsg$alg(r6, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r6, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x51}, {&(0x7f00000004c0)=""/86, 0x56}], 0x2}, 0x0) r7 = syz_genetlink_get_family_id$ethtool(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_COALESCE_SET(r6, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000100)=ANY=[@ANYBLOB="14000000", @ANYRES16=r7, @ANYBLOB="000829bd7000fedbdf25140000000800140008000000"], 0x1c}, 0x1, 0x0, 0x0, 0x10}, 0x40001) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b704000000000000850000005700000095"], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x2c}, 0x94) r8 = bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000940)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x30, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000040)='sched_kthread_work_queue_work\x00', r8}, 0x10) socketpair(0x11, 0xa, 0x0, &(0x7f0000001080)) nanosleep(&(0x7f00000002c0)={0x0, 0x989680}, &(0x7f0000000300)) 2m56.57526095s ago: executing program 4 (id=468): r0 = socket$nl_route(0x10, 0x3, 0x0) pipe(&(0x7f00000045c0)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r2, &(0x7f00000007c0)=[{&(0x7f0000001a00)="ce", 0x1}, {&(0x7f0000001a40)="fa", 0x1}], 0x2, 0x1) r3 = socket$alg(0x26, 0x5, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r4, 0x107, 0xf, &(0x7f0000000040)=0x46c, 0x4) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000900)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=@ipv4_newroute={0x2c, 0x1a, 0x1, 0x0, 0x0, {}, [@RTA_DPORT={0x6, 0x1d, 0xfffe}, @RTA_SPORT={0x6, 0x1c, 0x4e24}]}, 0x2c}}, 0x0) r6 = openat$cgroup(0xffffffffffffffff, &(0x7f0000000540)='syz1\x00', 0x200002, 0x0) openat$cgroup_type(r6, &(0x7f00000007c0), 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000180)={'vlan0\x00', 0x0}) sendto$packet(r4, &(0x7f0000000080)="33031600d1fd140000007ef52f555f2a3b9fe67025c1d97bfbf719143baa4b1f0f858c6632f4", 0x26, 0x40008c1, &(0x7f00000000c0)={0x11, 0x86dd, r7, 0x1, 0x62}, 0x14) ioctl$BTRFS_IOC_BALANCE_PROGRESS(r6, 0x84009422, &(0x7f0000000800)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}}) ioctl$BTRFS_IOC_DEV_INFO(r4, 0xd000941e, &(0x7f0000000c00)={r8, "bff4678338cdeac2bddd8f5f460de415"}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000240)={r8, 0xff, 0x5, 0x4068231b2c8dcab0}) bind$alg(r3, &(0x7f0000000080)={0x26, 'skcipher\x00', 0x0, 0x0, 'cts(cbc(aes))\x00'}, 0x58) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5910fae9d6dcd3292ea54c7b6ef915d564c90c200", 0x18) r9 = accept4(r3, 0x0, 0x0, 0x0) splice(r1, 0x0, r9, 0x0, 0x66, 0xc) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'veth0_vlan\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=@newlink={0x60, 0x10, 0x800, 0x70bd27, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, 0x115, 0x40009}, [@IFLA_LINKINFO={0x30, 0x12, 0x0, 0x1, @ip6erspan={{0xe}, {0x1c, 0x2, 0x0, 0x1, [@IFLA_GRE_IFLAGS={0x6, 0x2, 0x4}, @IFLA_GRE_TTL={0x5, 0x8, 0x8}, @IFLA_GRE_ENCAP_DPORT={0x6, 0x11, 0x4e23}]}}}, @IFLA_LINK={0x8, 0x5, r10}, @IFLA_MTU={0x8, 0x4, 0x8}]}, 0x60}, 0x1, 0x0, 0x0, 0x28081}, 0x8000002) 2m56.321036106s ago: executing program 4 (id=470): setsockopt$inet_mreqsrc(0xffffffffffffffff, 0x0, 0x27, &(0x7f0000000040)={@multicast2, @local, @loopback}, 0xc) (async) setsockopt$inet_msfilter(0xffffffffffffffff, 0x0, 0x29, &(0x7f0000000240)=ANY=[@ANYBLOB], 0x18) (async) syz_emit_ethernet(0x36, &(0x7f0000001800)=ANY=[], 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc2(0x0, r0) sendmsg$TIPC_NL_KEY_SET(0xffffffffffffffff, 0x0, 0x4008014) r1 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$inet_buf(r1, 0x0, 0x10, &(0x7f0000000140)=""/74, &(0x7f00000001c0)=0xfffffffffffffe47) setsockopt$packet_fanout_data(0xffffffffffffffff, 0x107, 0x16, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x30, 0x0, 0x0, 0xfffff010}]}, 0x10) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) (async) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) (async) sendmsg$NFT_BATCH(r2, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000540)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a3c000000090a010400000000000000000a0000040900010073797a310000080008000540000000020900020073797a310000000008000a40fffffffc9c0000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a3100000000700003806c0000800400018064000b802c0001800a0001006c696d69740000001c0002800c00024000000000000000030c0001400000000000010000340001800a0001006c696d6974000000240002800c00024000000000800000000c00014000000068"], 0x100}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) (async) getpeername$packet(0xffffffffffffffff, 0x0, 0x0) (async) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="090000000400000006000000ff"], 0x48) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f00000003c0)={{r3, 0xffffffffffffffff}, &(0x7f0000000340), &(0x7f0000000380)='%pI4 \x00'}, 0x20) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000540)={r4, &(0x7f0000000440), &(0x7f00000004c0)=""/84}, 0x20) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000640)={0x11, 0x4, &(0x7f0000000400)=ANY=[@ANYBLOB="180100001c0000000000000000000000850000006d00000095", @ANYRES32=0x0, @ANYRES16=r0, @ANYRESDEC=r1, @ANYRES64=r0], &(0x7f0000000200)='syzkaller\x00', 0x8, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f00000000c0)='sys_enter\x00', r5}, 0x10) (async) bpf$BPF_PROG_TEST_RUN(0x1c, 0x0, 0x0) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000540)=@base={0x1, 0x4, 0x8, 0xb}, 0x50) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000000085000000b000000018110000", @ANYRES32=r6, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r7}, 0xc) (async) socketpair$unix(0x1, 0x2, 0x0, 0x0) (async) socket$netlink(0x10, 0x3, 0x0) (async) setsockopt$IP_VS_SO_SET_ADD(0xffffffffffffffff, 0x0, 0x482, 0x0, 0x0) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x400448ca, 0x0) (async) syz_80211_join_ibss(&(0x7f0000000040)='wlan0\x00', &(0x7f0000000080)=@default_ibss_ssid, 0x6, 0x0) 2m56.175535418s ago: executing program 0 (id=472): r0 = socket$netlink(0x10, 0x3, 0xc) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000002c0)=@updpolicy={0x13c, 0x19, 0x1, 0x0, 0x3, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in6=@local, 0x2, 0x0, 0x0, 0x0, 0xa, 0x0, 0x80}, {}, {0x0, 0xd, 0x6}, 0x0, 0x200}, [@tmpl={0x84, 0x5, [{{@in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x4d6, 0x3c}, 0x2, @in=@multicast1, 0x3507, 0x4, 0x3, 0x7, 0x8, 0x4, 0x1}, {{@in6=@dev={0xfe, 0x80, '\x00', 0xc}, 0x4d3, 0x2b}, 0x2, @in6=@private0={0xfc, 0x0, '\x00', 0x1}, 0x3501, 0x4, 0x0, 0x73, 0x9, 0x5, 0x7}]}]}, 0x13c}}, 0x0) bind$netlink(r0, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000080), 0xffffffffffffffff) getsockopt$PNPIPE_IFINDEX(0xffffffffffffffff, 0x113, 0x2, &(0x7f00000000c0)=0x0, &(0x7f0000000100)=0x4) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'batadv0\x00', 0x0}) sendmsg$ETHTOOL_MSG_PRIVFLAGS_SET(r0, &(0x7f0000000600)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000180)={0x410, r2, 0x102, 0x70bd2a, 0x25dfdbfe, {}, [@ETHTOOL_A_PRIVFLAGS_HEADER={0x28, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'pimreg1\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}]}, @ETHTOOL_A_PRIVFLAGS_FLAGS={0x158, 0x2, 0x0, 0x1, [@ETHTOOL_A_BITSET_NOMASK={0x4}, @ETHTOOL_A_BITSET_BITS={0xc0, 0x3, 0x0, 0x1, [{0x14, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_NAME={0x8, 0x2, '$\xeb$\x00'}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x6}]}, {0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x4}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x9}]}, {0x24, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_NAME={0x5, 0x2, '\x00'}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x8000}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_NAME={0x5, 0x2, '\x00'}]}, {0x14, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_NAME={0x6, 0x2, '^\x00'}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0xfffffc00}]}, {0x28, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x6}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x101}, @ETHTOOL_A_BITSET_BIT_NAME={0x8, 0x2, '/^@\x00'}, @ETHTOOL_A_BITSET_BIT_NAME={0x5, 0x2, '\x00'}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}]}, {0x8, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_VALUE={0x4}]}, {0x28, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x6}, @ETHTOOL_A_BITSET_BIT_NAME={0x5, 0x2, '\x00'}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_NAME={0x6, 0x2, ']\x00'}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}]}]}, @ETHTOOL_A_BITSET_VALUE={0x89, 0x4, "5d0c90caefe77afd304a126abc55ab55d507bc741f826aff3870c61ab23efd7105371fe73168db5b36ee65fa6ae455e7f2ee9d5b8be54ea2426175097a73cd3d870537cfc582e7212c58d20e4d944fecf5da63f70d71b780b79124bb7ed0fbebd96f067794723d6a7688f36c731faab38f42990c4af3ce6ff022821c70043eaaa79a43dc79"}, @ETHTOOL_A_BITSET_NOMASK={0x4}]}, @ETHTOOL_A_PRIVFLAGS_FLAGS={0x1c8, 0x2, 0x0, 0x1, [@ETHTOOL_A_BITSET_MASK={0x6, 0x5, "f288"}, @ETHTOOL_A_BITSET_MASK={0x90, 0x5, "21cd116f47b111626517b269aa23bffea8f2818a55f92365e5c57b6b1a4bc3987a840301dde5d8eb378d9704acf46ae641bf6c12ad21acbd6371f0451a351d07dbe8513bc50dea758eaf7322233312fa705ddd1b657c1f18b832eb8c59e9ee4b5d35c83c13238a377866dc7ba70f7eb3af033244c97beb4001bd43611d88fc631a46e3b9746b4ae2a3436597"}, @ETHTOOL_A_BITSET_SIZE={0x8, 0x2, 0x10}, @ETHTOOL_A_BITSET_BITS={0x120, 0x3, 0x0, 0x1, [{0x40, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_NAME={0x5, 0x2, '\x00'}, @ETHTOOL_A_BITSET_BIT_NAME={0xc, 0x2, '}&^%L()\x00'}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_NAME={0xd, 0x2, '}-]+\'[\\*\x00'}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x9}, @ETHTOOL_A_BITSET_BIT_NAME={0xc, 0x2, 'ip6gre0\x00'}]}, {0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x372}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0xd08}]}, {0x10, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}]}, {0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_NAME={0x5, 0x2, '\x00'}]}, {0x28, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_NAME={0x6, 0x2, '@\x00'}, @ETHTOOL_A_BITSET_BIT_NAME={0x6, 0x2, '(\x00'}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_NAME={0x9, 0x2, '{]:@\x00'}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}]}, {0x2c, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_NAME={0xc, 0x2, 'ip6gre0\x00'}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0xb8e}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x5}]}, {0x38, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_NAME={0xc, 0x2, 'ip6gre0\x00'}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_NAME={0x5, 0x2, '\x00'}, @ETHTOOL_A_BITSET_BIT_NAME={0x6, 0x2, '!\x00'}, @ETHTOOL_A_BITSET_BIT_NAME={0xc, 0x2, 'syztnl2\x00'}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x5}]}, {0x1c, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0xffff}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x5}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x401}]}]}, @ETHTOOL_A_BITSET_NOMASK={0x4}]}, @ETHTOOL_A_PRIVFLAGS_HEADER={0x8c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'caif0\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'wlan0\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_hsr\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'team0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r3}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vlan1\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r4}]}, @ETHTOOL_A_PRIVFLAGS_HEADER={0x28, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1_to_batadv\x00'}]}]}, 0x410}, 0x1, 0x0, 0x0, 0x80000}, 0x10000) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r5, 0x89f1, &(0x7f0000000040)={'ip6gre0\x00', &(0x7f0000000880)={'syztnl2\x00', 0x0, 0x6, 0x80, 0x5, 0x0, 0xb, @ipv4={'\x00', '\xff\xff', @local}, @loopback={0xfec0ffff00000000, 0xffff8881114a4aa8}, 0x3c20, 0x2f00, 0xfffffffe, 0xb}}) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$batadv(&(0x7f0000000080), r6) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r6, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000300)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r7, @ANYBLOB="f5af24bd7000000000000e00000008000300", @ANYRES32=r6], 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) sendmsg$BATADV_CMD_TP_METER_CANCEL(r0, &(0x7f0000000700)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000006c0)={&(0x7f0000000680)={0x3c, r7, 0x400, 0x70bd29, 0x25dfdbff, {}, [@BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0x3}, @BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0xff}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5, 0x30, 0x1}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x1}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5, 0x2f, 0x1}]}, 0x3c}, 0x1, 0x0, 0x0, 0x20048010}, 0x0) 2m56.094778246s ago: executing program 0 (id=475): r0 = socket$inet6_icmp(0xa, 0x2, 0x3a) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)=ANY=[@ANYBLOB="300000003e000701feffffff00000000017c0000040042800c00018006000000800a00000c000280080013802008686f"], 0x30}, 0x1, 0x0, 0x0, 0xc000}, 0xc000) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) r3 = socket$inet6_mptcp(0xa, 0x1, 0x106) ioctl$int_in(r3, 0x5421, &(0x7f0000000140)=0x2f) mmap(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x8010, 0xffffffffffffffff, 0xfa63c000) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nfc(&(0x7f0000000500), r5) sendmsg$NFC_CMD_SE_IO(r5, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000680)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="010028bd7000fcdbdf251b00000008000100", @ANYRES32=0x0, @ANYBLOB="08001500c0ab4ed999071047000000cc457918f6b4216f064311874a9f02d61cf986407b3f57c32ea577f3eddd9500cb9cc03cd4c39a0701014ee17de3ca73082899d99f55f7c582c838fdddbc8d8c6efb089930082cafb1574d94ca95353e3f4039f3c0f086bee82075a6056f2272bef0310ae73e283a4ac74808c93a402ec5040f61065483bed109e3fad0aea3025d64d0424d95f680c0856f43d176f4ecf2fc862bf797931d0fc477908efa16efe427a0e30a40a51d845acdeaeb1c627920ed5c0dcd97cb89c737fd4fbab6422f1b404167a0d76dc2a8719b79e89b89fe1c9d7580aa9ad8c86ebbc4d8a9c01951e0d5e57d"], 0x24}, 0x1, 0x0, 0x0, 0x8000}, 0x0) sendmsg$NFC_CMD_GET_TARGET(r4, &(0x7f0000000240)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x14, r6, 0x100, 0x70bd25, 0x25dfdbfc, {}, [""]}, 0x14}}, 0x40010) connect$inet6(r3, &(0x7f0000000280)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) setsockopt$sock_linger(r3, 0x1, 0xd, &(0x7f0000000180)={0x20004, 0x7}, 0x8) close(r3) shutdown(r2, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)}, &(0x7f0000000440)=0x10) setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r2, 0x84, 0x72, &(0x7f0000000140)={r7, 0x2, 0x20}, 0xc) sendmsg$IPCTNL_MSG_EXP_NEW(0xffffffffffffffff, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000540)=ANY=[@ANYBLOB="400000000002010400000000000000000a0000b8b90004000180180003801400018008000100ac1e010108000200ac1414aa100008800c0002"], 0x40}}, 0x0) r8 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$devlink(&(0x7f0000000dc0), 0xffffffffffffffff) r9 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r10 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000bc0), r9) sendmsg$NLBL_CIPSOV4_C_ADD(r9, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000000)=ANY=[@ANYBLOB="e0000000", @ANYRES16=r10, @ANYBLOB="01000000000000000000010000000800010000000000140004800500030007000000050000000000000008000200010000000800020001000000a00008801c000782"], 0xe0}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) sendmsg$DEVLINK_CMD_TRAP_GET(r8, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000340)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16=r4, @ANYRES32=r0, @ANYBLOB="5a811ef4117182593fe58e7f2569eb9bc5e028ee301a4adb8c15c693e52e652e5b9831dee983452177afce417809", @ANYRESOCT=r5, @ANYRES64=r2, @ANYRES64=r9], 0x50}, 0x1, 0x0, 0x0, 0x24040011}, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000880)={0xb0, 0x0, 0x1, 0x70bd29, 0x25dfdbfb, {{}, {@val={0x8}, @val={0xc, 0x99, {0x1, 0x5c}}}}, [@mon_options=[@NL80211_ATTR_MNTR_FLAGS={0xc, 0x17, 0x0, 0x1, [@NL80211_MNTR_FLAG_COOK_FRAMES={0x4}, @NL80211_MNTR_FLAG_ACTIVE={0x4}]}], @NL80211_ATTR_4ADDR={0x5}, @NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}, @NL80211_ATTR_IFTYPE={0x8}, @mon_options=[@NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "93c20932b54091474b15a5f4c329bb6426cb27077299b7f5"}, @NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR={0xa}, @NL80211_ATTR_MNTR_FLAGS={0x8, 0x17, 0x0, 0x1, [@NL80211_MNTR_FLAG_COOK_FRAMES={0x4}]}], @mon_options=[@NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR={0xa, 0xe8, @device_b}], @NL80211_ATTR_MESH_ID={0xa}, @NL80211_ATTR_MESH_ID={0xa}, @NL80211_ATTR_IFTYPE={0x8, 0x5, 0x6}, @NL80211_ATTR_IFTYPE={0x8, 0x5, 0xc}]}, 0xb0}, 0x1, 0x0, 0x0, 0x10}, 0x8844) sendto$inet6(r0, &(0x7f00000000c0)="a000398d3bec2068", 0x8, 0x40d0, &(0x7f0000000000)={0xa, 0x4e20, 0xffff, @loopback={0xe0}, 0x5}, 0x1c) r11 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r11, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000380)=@allocspi={0x120, 0x16, 0x1, 0x0, 0x0, {{{@in6=@mcast1, @in6=@mcast1, 0x0, 0x0, 0x4e23, 0x0, 0xa, 0x80, 0xa0}, {@in6=@ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x22}}, 0x4d2, 0x33}, @in6=@empty, {0x0, 0x0, 0x129b, 0xfffffffffffffffc, 0x0, 0xfffffffffffffff1, 0x3}, {0x0, 0x0, 0x0, 0x4}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0x1a0b1}, [@address_filter={0x28, 0x1a, {@in=@local, @in6=@local, 0xa, 0xf7, 0x4}}]}, 0x120}, 0x1, 0x0, 0x0, 0x5010}, 0x4000) ioctl$sock_SIOCGIFVLAN_SET_VLAN_INGRESS_PRIORITY_CMD(r0, 0x8982, &(0x7f0000000080)={0x2, 'ip6_vti0\x00', {0xffffffff}, 0x69}) 2m55.967063061s ago: executing program 4 (id=477): sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="700200001300290a000000000000000007000000", @ANYBLOB="000000000000000010010c8013000c800ca3488008000000000000000800038064001d80050006000000000014000500714abbd2547de97cbbf6efb226f19bf90d0002003a288e5e5b5b5a40000000006000078014000400293a02149f3b75a67093c28fd6f55a2314000400e48f01e49713f0c2d839f940d9f088d8050006000000003bd00002006272696467655f736c6176655f"], 0x270}, 0x1, 0x0, 0x0, 0x20008014}, 0x4) r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_DSTOPTS(r0, 0x29, 0x3b, &(0x7f00000002c0)=ANY=[], 0x8) bind$inet6(r0, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) syz_emit_ethernet(0x66, &(0x7f00000000c0)=ANY=[], 0x0) recvmmsg(r0, &(0x7f0000000100), 0x1, 0x2b, 0x0) setsockopt$inet6_int(r0, 0x29, 0x4, &(0x7f0000000000)=0x1, 0x4) sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f0000000300)={0xa, 0x4e20, 0x0, @mcast1}, 0x1c) 2m55.838374896s ago: executing program 0 (id=478): r0 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000ac0)=@base={0xa, 0x7, 0x2, 0x4}, 0x50) close(0x3) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0600000004000000080000000c"], 0x48) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x14, &(0x7f0000000200)=ANY=[@ANYBLOB="1802000000000000000000000000000018010000786c6c3a00000000070000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000080000850000002d00000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0xc8) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) close(r0) syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000300)='ns/net\x00') r3 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1e, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x80) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000005c0)={r3, 0x0, 0x24, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0xa) pwritev(r3, &(0x7f0000000080)=[{&(0x7f0000000000)="4c8a0c8df1b5236d9b24fa28299b840cf6d0c96626d6fa3eb8", 0x19}, {&(0x7f00000001c0)="163bab0fb53347ed6037dd3e16ef91631e021f9048a92ab861f99fb4ef9566443cf176825f2cd1eac6fe7aefa9ad85f5ffad7793b3f3efb4182c245a75c4dddb40", 0x41}], 0x2, 0x9, 0x4) sendmsg$IPCTNL_MSG_EXP_DELETE(r0, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f00000002c0)={&(0x7f0000000640)={0x12c, 0x2, 0x2, 0x401, 0x0, 0x0, {0x3, 0x0, 0x9}, [@CTA_EXPECT_NAT={0xe4, 0xa, 0x0, 0x1, [@CTA_EXPECT_NAT_TUPLE={0x70, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @mcast1}, {0x14, 0x4, @mcast2}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x84}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x3a}}, @CTA_TUPLE_ZONE={0x6}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x21}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x3}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0xaf}}]}, @CTA_EXPECT_NAT_DIR={0x8}, @CTA_EXPECT_NAT_DIR={0x8, 0x1, 0x1, 0x0, 0x1}, @CTA_EXPECT_NAT_TUPLE={0x2c, 0x2, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x21}}, @CTA_TUPLE_ZONE={0x6}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @initdev={0xac, 0x1e, 0x0, 0x0}}, {0x8, 0x2, @local}}}]}, @CTA_EXPECT_NAT_TUPLE={0xc, 0x2, 0x0, 0x1, [@CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x3}]}, @CTA_EXPECT_NAT_DIR={0x8}, @CTA_EXPECT_NAT_DIR={0x8}, @CTA_EXPECT_NAT_TUPLE={0x18, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @broadcast}, {0x8, 0x2, @empty}}}]}]}, @CTA_EXPECT_TUPLE={0x18, 0x2, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x6}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x1}]}, @CTA_EXPECT_FN={0xa, 0xb, 'Q.931\x00'}, @CTA_EXPECT_ZONE={0x6, 0x7, 0x1, 0x0, 0x2}, @CTA_EXPECT_TIMEOUT={0x8, 0x4, 0x1, 0x0, 0x8}]}, 0x12c}, 0x1, 0x0, 0x0, 0x40000}, 0x40008c2) r4 = socket$kcm(0x10, 0x2, 0x4) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b400000000000000791048000000000071043f000000000095000000"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x48) socket$inet6_sctp(0xa, 0x801, 0x84) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x11, 0x6, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x6}, 0x94) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000280)={0x18, 0x5, &(0x7f0000000040)=ANY=[@ANYBLOB="180100002100000000000000000000008500000075000000a50000002300000095"], &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x8}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f00000001c0)='mmap_lock_acquire_returned\x00', r5}, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r6, &(0x7f0000000100)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r6, 0x0) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000380)={@fallback, 0x10, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r7, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x1, 0x0, 0x3}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x101, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}]}, @NFT_MSG_NEWRULE={0x50, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x28, 0x4, 0x0, 0x1, [{0x24, 0x1, 0x0, 0x1, @bitwise={{0xc}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_BITWISE_LEN={0x8, 0x3, 0x1, 0x0, 0x24}, @NFTA_BITWISE_DREG={0x8, 0x2, 0x1, 0x0, 0x9}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0xc4}}, 0x0) r8 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000780), r0) sendmsg$ETHTOOL_MSG_PAUSE_SET(r0, &(0x7f0000000880)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000840)={&(0x7f00000007c0)={0x64, r8, 0x400, 0x70bd28, 0x25dfdbfb, {}, [@ETHTOOL_A_PAUSE_RX={0x5}, @ETHTOOL_A_PAUSE_AUTONEG={0x5, 0x2, 0x1}, @ETHTOOL_A_PAUSE_TX={0x5, 0x4, 0x1}, @ETHTOOL_A_PAUSE_AUTONEG={0x5, 0x2, 0x1}, @ETHTOOL_A_PAUSE_RX={0x5}, @ETHTOOL_A_PAUSE_AUTONEG={0x5, 0x2, 0x1}, @ETHTOOL_A_PAUSE_HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}]}, @ETHTOOL_A_PAUSE_HEADER={0x14, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_FLAGS={0x8}]}]}, 0x64}, 0x1, 0x0, 0x0, 0x20004880}, 0x80c4) sendmsg$inet(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000140)="5c00000015006b0300224ed86e6c1d0002117ea6e070d6064e22000300000000250002000f00000017d34460bc24eab556a705251e6182949a00003d3b48dfd8cdbf9767b4fa51f62a64c9f4060046d88037e786a6d0a5d700000017", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) 2m55.775666816s ago: executing program 4 (id=479): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000000c0)={'wlan1\x00'}) (async) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000640), r2) ioctl$sock_SIOCGIFINDEX_802154(r2, 0x8933, &(0x7f0000000680)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_NEW_SEC_DEV(r1, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000280)=ANY=[@ANYBLOB='l\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010028bd7000fbdbdf251a00000004002e8008000300", @ANYRES32=r4, @ANYBLOB='4\x00.'], 0x6c}, 0x1, 0x0, 0x0, 0x20040040}, 0x20040) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$tipc(&(0x7f0000001ec0), 0xffffffffffffffff) socket$xdp(0x2c, 0x3, 0x0) (async) socket$inet_icmp_raw(0x2, 0x3, 0x1) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) (async) syz_open_procfs$namespace(0x0, &(0x7f0000000080)='ns/ipc\x00') (async) unshare(0x6a040000) (async) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x40002001, 0x0) r5 = socket$inet6_sctp(0xa, 0x1, 0x84) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff) (async) close(0xffffffffffffffff) (async) socket$nl_route(0x10, 0x3, 0x0) sendmsg$sock(0xffffffffffffffff, &(0x7f0000000500)={0x0, 0x0, 0x0}, 0x20000000) (async) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) read(r6, &(0x7f0000000340)=""/49, 0x31) sendmsg$IPSET_CMD_SAVE(r6, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB="1c000000080601080000000000000004000000040500010006"], 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x10) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, 0x0, 0x8044) (async) bind$inet6(r5, &(0x7f0000000280)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) (async) sendto$inet6(r5, &(0x7f00000002c0)="9e", 0x1, 0x41, &(0x7f0000000200)={0xa, 0x4e23, 0x10003, @loopback, 0x7}, 0x1c) (async) setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r5, 0x84, 0x72, &(0x7f0000000300)={0x0, 0x200002, 0x30}, 0xc) 2m55.266751971s ago: executing program 0 (id=484): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$gtp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$GTP_CMD_NEWPDP(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)={0x1c, r1, 0x1, 0x0, 0x0, {0x2}, [@GTPA_VERSION={0x8}]}, 0x1c}}, 0x0) r2 = socket(0x2b, 0x80801, 0x1) sendmmsg(r2, &(0x7f0000001f40)=[{{&(0x7f0000000180)=@qipcrtr={0x2a, 0x2, 0x8000}, 0x80, 0x0}}], 0x1, 0x20000090) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000080), r0) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000100)={'gre0\x00', &(0x7f00000002c0)={'gre0\x00', 0x0, 0x8, 0x40, 0xfff, 0x7, {{0x36, 0x4, 0x2, 0x2, 0xd8, 0x66, 0x0, 0x6, 0x2f, 0x0, @loopback, @rand_addr=0x64010102, {[@ssrr={0x89, 0x2b, 0xa5, [@multicast1, @initdev={0xac, 0x1e, 0x5, 0x0}, @loopback, @remote, @multicast2, @local, @rand_addr=0x64010101, @local, @local, @broadcast]}, @cipso={0x86, 0x11, 0x3, [{0x5, 0x2}, {0x6, 0x3, '3'}, {0x5, 0x6, "35a605cb"}]}, @timestamp_addr={0x44, 0x54, 0xc8, 0x1, 0x4, [{@broadcast, 0xf}, {@initdev={0xac, 0x1e, 0x0, 0x0}, 0xa}, {@dev={0xac, 0x14, 0x14, 0x10}, 0xffffffff}, {@local, 0x5}, {@rand_addr=0x64010102, 0x1}, {@empty, 0x6}, {@rand_addr=0x64010101, 0x7}, {@private=0xa010101, 0xaaaf}, {@rand_addr=0x64010100, 0x2ca4}, {@initdev={0xac, 0x1e, 0x0, 0x0}, 0x1}]}, @rr={0x7, 0x7, 0x80, [@empty]}, @timestamp_prespec={0x44, 0x2c, 0x29, 0x3, 0xd, [{@rand_addr=0x64010100, 0x401}, {@multicast1, 0x6}, {@empty, 0xc4}, {@broadcast, 0x4}, {@multicast2, 0x3}]}]}}}}}) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r3, 0x8933, &(0x7f0000000140)={'batadv_slave_1\x00', 0x0}) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f00000001c0)={0x0, @remote, @multicast1}, &(0x7f0000000240)=0xc) sendmsg$ETHTOOL_MSG_WOL_GET(r0, &(0x7f0000000480)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)=ANY=[@ANYBLOB='\\\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="000125bd7000fcdbdf250c0001800800030002000000280001801400020076657468305f746f5f687372000000000800010000000000", @ANYRES32=r5, @ANYBLOB="08000100", @ANYRES32=r6, @ANYBLOB="14000180080003000400000008000100", @ANYRES32=r7, @ANYBLOB], 0x5c}, 0x1, 0x0, 0x0, 0x8000}, 0x4008044) sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000040)=ANY=[@ANYBLOB="4400000010000305000000090000000000000000", @ANYRES32=0x0, @ANYBLOB="00000000000000002400128009000100626f6e6400000000140002800800130001000000080014"], 0x44}}, 0x0) 2m54.798693592s ago: executing program 32 (id=484): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$gtp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$GTP_CMD_NEWPDP(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)={0x1c, r1, 0x1, 0x0, 0x0, {0x2}, [@GTPA_VERSION={0x8}]}, 0x1c}}, 0x0) r2 = socket(0x2b, 0x80801, 0x1) sendmmsg(r2, &(0x7f0000001f40)=[{{&(0x7f0000000180)=@qipcrtr={0x2a, 0x2, 0x8000}, 0x80, 0x0}}], 0x1, 0x20000090) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000080), r0) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000100)={'gre0\x00', &(0x7f00000002c0)={'gre0\x00', 0x0, 0x8, 0x40, 0xfff, 0x7, {{0x36, 0x4, 0x2, 0x2, 0xd8, 0x66, 0x0, 0x6, 0x2f, 0x0, @loopback, @rand_addr=0x64010102, {[@ssrr={0x89, 0x2b, 0xa5, [@multicast1, @initdev={0xac, 0x1e, 0x5, 0x0}, @loopback, @remote, @multicast2, @local, @rand_addr=0x64010101, @local, @local, @broadcast]}, @cipso={0x86, 0x11, 0x3, [{0x5, 0x2}, {0x6, 0x3, '3'}, {0x5, 0x6, "35a605cb"}]}, @timestamp_addr={0x44, 0x54, 0xc8, 0x1, 0x4, [{@broadcast, 0xf}, {@initdev={0xac, 0x1e, 0x0, 0x0}, 0xa}, {@dev={0xac, 0x14, 0x14, 0x10}, 0xffffffff}, {@local, 0x5}, {@rand_addr=0x64010102, 0x1}, {@empty, 0x6}, {@rand_addr=0x64010101, 0x7}, {@private=0xa010101, 0xaaaf}, {@rand_addr=0x64010100, 0x2ca4}, {@initdev={0xac, 0x1e, 0x0, 0x0}, 0x1}]}, @rr={0x7, 0x7, 0x80, [@empty]}, @timestamp_prespec={0x44, 0x2c, 0x29, 0x3, 0xd, [{@rand_addr=0x64010100, 0x401}, {@multicast1, 0x6}, {@empty, 0xc4}, {@broadcast, 0x4}, {@multicast2, 0x3}]}]}}}}}) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r3, 0x8933, &(0x7f0000000140)={'batadv_slave_1\x00', 0x0}) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f00000001c0)={0x0, @remote, @multicast1}, &(0x7f0000000240)=0xc) sendmsg$ETHTOOL_MSG_WOL_GET(r0, &(0x7f0000000480)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)=ANY=[@ANYBLOB='\\\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="000125bd7000fcdbdf250c0001800800030002000000280001801400020076657468305f746f5f687372000000000800010000000000", @ANYRES32=r5, @ANYBLOB="08000100", @ANYRES32=r6, @ANYBLOB="14000180080003000400000008000100", @ANYRES32=r7, @ANYBLOB], 0x5c}, 0x1, 0x0, 0x0, 0x8000}, 0x4008044) sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000040)=ANY=[@ANYBLOB="4400000010000305000000090000000000000000", @ANYRES32=0x0, @ANYBLOB="00000000000000002400128009000100626f6e6400000000140002800800130001000000080014"], 0x44}}, 0x0) 2m54.778710663s ago: executing program 4 (id=490): socket$nl_route(0x10, 0x3, 0x0) r0 = socket$rds(0x15, 0x5, 0x0) getsockopt$PNPIPE_INITSTATE(0xffffffffffffffff, 0x113, 0x4, &(0x7f0000000000), &(0x7f0000000100)=0x4) bind$rds(r0, &(0x7f0000000040)={0x2, 0x4e21, @local}, 0x10) sendmsg$rds(r0, &(0x7f00000002c0)={&(0x7f00000000c0)={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, &(0x7f0000000640)=[{&(0x7f00000009c0)=""/4090, 0xffa}], 0x1}, 0x0) socket$inet6_sctp(0xa, 0x5, 0x84) socket$inet_smc(0x2b, 0x1, 0x0) r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) ioctl$BTRFS_IOC_DEFAULT_SUBVOL(r1, 0x40089413, &(0x7f0000000180)=0x9c) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x11, 0xf, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000800000000bf91000000000000b702000043e7b5538500000085000000b70000000000000095"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000140)='kmem_cache_free\x00', r2}, 0x10) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x0, 0x3, 0xfffffffffffffffd}, 0x0, &(0x7f00000002c0)={0x3ff, 0x0, 0x0, 0x9, 0x0, 0x0, 0x7fffffff}, 0x0, 0x0) close(0x4) 2m54.772783816s ago: executing program 33 (id=490): socket$nl_route(0x10, 0x3, 0x0) r0 = socket$rds(0x15, 0x5, 0x0) getsockopt$PNPIPE_INITSTATE(0xffffffffffffffff, 0x113, 0x4, &(0x7f0000000000), &(0x7f0000000100)=0x4) bind$rds(r0, &(0x7f0000000040)={0x2, 0x4e21, @local}, 0x10) sendmsg$rds(r0, &(0x7f00000002c0)={&(0x7f00000000c0)={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, &(0x7f0000000640)=[{&(0x7f00000009c0)=""/4090, 0xffa}], 0x1}, 0x0) socket$inet6_sctp(0xa, 0x5, 0x84) socket$inet_smc(0x2b, 0x1, 0x0) r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) ioctl$BTRFS_IOC_DEFAULT_SUBVOL(r1, 0x40089413, &(0x7f0000000180)=0x9c) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x11, 0xf, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000800000000bf91000000000000b702000043e7b5538500000085000000b70000000000000095"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000140)='kmem_cache_free\x00', r2}, 0x10) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x0, 0x3, 0xfffffffffffffffd}, 0x0, &(0x7f00000002c0)={0x3ff, 0x0, 0x0, 0x9, 0x0, 0x0, 0x7fffffff}, 0x0, 0x0) close(0x4) 5.654267316s ago: executing program 6 (id=1892): r0 = socket$inet6(0xa, 0x2, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) unshare(0x2c020400) getpeername(r1, 0x0, &(0x7f0000000300)) bind$inet6(r0, &(0x7f0000001080)={0xa, 0x4e20, 0x0, @empty}, 0x1c) recvmsg(r0, &(0x7f0000000440)={0x0, 0x0, 0x0}, 0x0) setsockopt$inet6_int(r0, 0x29, 0x2, &(0x7f0000000000)=0x40000005, 0x4) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r2, 0x8933, &(0x7f0000000080)={'batadv0\x00', 0x0}) ioctl$sock_inet6_SIOCADDRT(r2, 0x890b, &(0x7f00000001c0)={@mcast2={0xff, 0x5}, @ipv4={'\x00', '\xff\xff', @broadcast}, @mcast2, 0x0, 0x0, 0x0, 0x100, 0x0, 0x140192, r3}) setsockopt$inet6_int(r0, 0x29, 0x21, &(0x7f0000000080)=0x7c, 0x4) sendto$inet6(r0, 0x0, 0x0, 0x4000, &(0x7f0000000300)={0xa, 0x4e20, 0x0, @mcast1}, 0x1c) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000000)=ANY=[@ANYBLOB="2000000076000d0b00400000000000b20980390000eaffff07000a"], 0x20}, 0x1, 0x0, 0x0, 0x448d1}, 0x0) 4.700905943s ago: executing program 6 (id=1902): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000a80)={0x11, 0x3, &(0x7f0000000200)=@framed={{0x18, 0x0, 0x0, 0x0, 0xfffffffc}}, &(0x7f0000000100)='GPL\x00', 0x2, 0x0, 0x0, 0x41000, 0x4}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='contention_end\x00', r0}, 0x10) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r2, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/74, 0x328000, 0x1000}, 0x1c) setsockopt$XDP_UMEM_COMPLETION_RING(r2, 0x11b, 0x6, &(0x7f0000000240)=0x1, 0x4) setsockopt$XDP_RX_RING(r2, 0x11b, 0x2, &(0x7f0000001980)=0x100, 0x4) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000580)={'batadv_slave_0\x00', 0x0}) setsockopt$XDP_UMEM_FILL_RING(r2, 0x11b, 0x5, &(0x7f0000000140)=0x1, 0x4) bind$xdp(r2, &(0x7f0000000100)={0x2c, 0x8, r3, 0x0, r2}, 0x10) setsockopt$XDP_TX_RING(r2, 0x11b, 0x3, &(0x7f00000003c0)=0x4, 0x4) 4.415831824s ago: executing program 6 (id=1906): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='cpuset.effective_mems\x00', 0x275a, 0x0) write$cgroup_type(r0, &(0x7f0000000040), 0x9) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x12, r0, 0x0) r1 = socket$inet_smc(0x2b, 0x1, 0x0) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r1, 0x6, 0x23, &(0x7f0000000100)={&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000000000)=0x68) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a300000001f0900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)={{0x14}, [@NFT_MSG_NEWRULE={0x6c, 0x6, 0xa, 0x401, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x40, 0x4, 0x0, 0x1, [{0x3c, 0x1, 0x0, 0x1, @immediate={{0xe}, @val={0x28, 0x2, 0x0, 0x1, [@NFTA_IMMEDIATE_DREG={0x8}, @NFTA_IMMEDIATE_DATA={0x1c, 0x2, 0x0, 0x1, [@NFTA_DATA_VERDICT={0x18, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffd}]}]}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x94}}, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a2c000000050a0900000000000000001d020000000900010073797a30000000000900030073797a32"], 0x54}}, 0x0) 4.415396205s ago: executing program 2 (id=1907): r0 = syz_init_net_socket$llc(0x1a, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, 0x0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x6000, 0x0) close(r2) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$tipc(&(0x7f0000000080), r3) sendmsg$TIPC_CMD_ENABLE_BEARER(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}}, 0x0) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r5 = socket$alg(0x26, 0x5, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000001000010002000000000000000000000a18010000090a010400000000000000000100000008000a40000000000900020073797a32000000000900010073797a3000000000080005400000002cd40009800800014000000006c80002800c00018008000140000000032400018008000140000000070800014000000008080001400000000908000140000000080c000180080001400000000a24000180080001400000000608000140000000ff080001400000000208000140000000013400018008000140764f15e208000140000000000800014000000007ebfd014000000000080001400000000908000140000000001c000180080001400000002808000140000000cb08000140000000031400018008000140000000050800014000000001"], 0x140}}, 0x0) bind$alg(r5, &(0x7f0000000080)={0x26, 'hash\x00', 0x0, 0x0, 'sha224\x00'}, 0x58) sendmsg$TIPC_NL_PEER_REMOVE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000580)={0x14, 0x0, 0x1, 0x70bd2b, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x80}, 0xca4ffd611946ea37) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x305200, 0x0) close(r7) r8 = socket$unix(0x1, 0x1, 0x0) r9 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000009c0)={0x11, 0x11, &(0x7f00000007c0)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, {}, {}, [@generic={0x8, 0x8, 0x2, 0x8, 0x8001}, @alu={0x4, 0xcb051e26ca665391, 0x9, 0x6, 0xb, 0xfffffffffffffff4, 0x8}], {{}, {}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000880)='GPL\x00', 0x4, 0x67, &(0x7f00000008c0)=""/103, 0x40f00, 0x9, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x2, &(0x7f0000000940)=[0xffffffffffffffff, 0x1, 0x1, 0x1, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff], &(0x7f0000000980)=[{0x0, 0x3, 0xd, 0x7}, {0x5, 0x3, 0x9, 0xc}], 0x10, 0x200}, 0x94) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000b00)={{r0, 0xffffffffffffffff}, &(0x7f0000000a80), &(0x7f0000000ac0)='%pi6 \x00'}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f0000000c40)={0x16, 0xe, &(0x7f00000004c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x9}, [@map_idx={0x18, 0x7, 0x5, 0x0, 0x10}, @map_idx_val={0x18, 0x6, 0x6, 0x0, 0x5, 0x0, 0x0, 0x0, 0x3}, @map_val={0x18, 0x0, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x7}, @cb_func={0x18, 0x1, 0x4, 0x0, 0x80}, @map_idx={0x18, 0x9, 0x5, 0x0, 0xf}, @ldst={0x1, 0x0, 0x13e6ae0c8f1eeb4d, 0xa, 0x2, 0xfffffffffffffffe}]}, &(0x7f00000003c0)='GPL\x00', 0x2, 0x4f, &(0x7f00000006c0)=""/79, 0x41100, 0x1, '\x00', 0x0, @fallback=0x37, 0xffffffffffffffff, 0x8, &(0x7f0000000740)={0x3, 0x2}, 0x8, 0x10, &(0x7f0000000780)={0x1, 0x5, 0x7, 0x9}, 0x10, 0x0, r9, 0x9, &(0x7f0000000b40)=[r10], &(0x7f0000000b80)=[{0x2, 0x3, 0x6, 0xd29bf761e34a2eda}, {0x4, 0x3, 0xb, 0xa}, {0x1, 0x4, 0x1, 0xc}, {0x5, 0x3, 0x5, 0x2}, {0x3, 0x2, 0x8, 0x5}, {0x2, 0x5, 0x3}, {0x4, 0x1, 0x1, 0xa}, {0x4, 0x5, 0x6}, {0x4, 0x3, 0xe, 0xb}], 0x10, 0x101}, 0x94) r11 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r11, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000440)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0xffffffff, {0x0, 0x0, 0x0, r12, {0x0, 0xc}, {0xffff, 0xffff}, {0xb}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0xa, 0x7f61, 0x1, 0xc5, 0xe23, 0x1, 0x1, 0x7fff, 0x1}}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x20008001}, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x2000, 0x0) r13 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180), 0x2000, 0x0) ioctl$TUNGETVNETLE(r13, 0x800454dd, &(0x7f0000000300)) sendmsg$nl_route_sched(r11, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000d00)=@delqdisc={0x33c, 0x25, 0x400, 0x30bd26, 0x25dfdbfe, {0x0, 0x0, 0x0, r12, {0xa, 0x2}, {0xc, 0xa}, {0x5, 0xfff3}}, [@TCA_STAB={0x58, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0xb, 0xf7, 0x2, 0x8001, 0x1, 0x80000000, 0x1, 0x7}}, {0x12, 0x2, [0x6, 0x5, 0x5, 0x1, 0x4, 0x1, 0x0]}}, {{0x1c, 0x1, {0x2, 0x3, 0x80, 0x7, 0x1, 0x9, 0x2, 0x1}}, {0x6, 0x2, [0x6]}}]}, @TCA_STAB={0xf8, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x80, 0x2, 0x9, 0x1, 0x0, 0x1c5ea795, 0x401, 0x3}}, {0xa, 0x2, [0x1, 0x0, 0x2]}}, {{0x1c, 0x1, {0x1, 0x2, 0x8, 0x9, 0x2, 0xfffffff9, 0x91, 0x4}}, {0xc, 0x2, [0x1ff, 0x7, 0x4, 0x6]}}, {{0x1c, 0x1, {0xf, 0x0, 0x7ff, 0x3, 0x0, 0x0, 0x6, 0x1}}, {0x6, 0x2, [0x7c]}}, {{0x1c, 0x1, {0x6, 0xff, 0x737, 0x2040, 0x2, 0x4, 0xa8c, 0x7}}, {0x12, 0x2, [0x5, 0x8, 0x0, 0x200, 0x7c2, 0xfff9, 0x3]}}, {{0x1c, 0x1, {0xa6, 0x2, 0x6, 0x100000, 0x2, 0x8, 0x7, 0x7}}, {0x12, 0x2, [0x800, 0x0, 0x7, 0x9dca, 0xfb3a, 0x3ff, 0xfff7]}}, {{0x1c, 0x1, {0x7f, 0x7, 0x5, 0x7, 0x1, 0x401, 0x2}}, {0x4}}]}, @TCA_STAB={0x1b8, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0xe2, 0x9, 0x8, 0x5, 0x1, 0x200, 0x0, 0x5}}, {0xe, 0x2, [0x3793, 0x0, 0xd87, 0xb6a4, 0x5fe]}}, {{0x1c, 0x1, {0xb, 0x9, 0x400, 0x81, 0x1, 0x7c, 0x7, 0x8}}, {0x14, 0x2, [0x4, 0x1, 0x57fe, 0xd, 0x7, 0x29, 0x7, 0xaa]}}, {{0x1c, 0x1, {0x80, 0x4, 0xfffb, 0x7a00, 0x3, 0x3, 0x1, 0x1}}, {0x6, 0x2, [0x80]}}, {{0x1c, 0x1, {0xff, 0x2, 0x8, 0x7, 0x0, 0x2, 0xb, 0xa}}, {0x18, 0x2, [0x0, 0x8000, 0x4, 0x10, 0x4, 0x3, 0x9, 0x9, 0xfabc, 0x3f]}}, {{0x1c, 0x1, {0x80, 0x6c, 0x89c, 0xaf, 0x0, 0xfffffff9, 0x3, 0x1}}, {0x6, 0x2, [0x0]}}, {{0x58, 0x1, {0x9, 0x80, 0xd2f4, 0x3, 0x1, 0x2, 0x7, 0x4}}, {0xc, 0x2, [0xe, 0x480, 0x0, 0x5]}}, {{0x1c, 0x1, {0x6, 0x7, 0x1, 0x7, 0x2, 0x7, 0x6, 0xa}}, {0x18, 0x2, [0xf23, 0xffff, 0x1, 0xff6f, 0x7f, 0xe, 0x43cc, 0xe79b, 0xb4, 0x6]}}, {{0x1c, 0x1, {0xa, 0xe, 0x3, 0x1ff, 0x1, 0x8, 0x400, 0x1}}, {0x6, 0x2, [0x101]}}, {{0x1c, 0x1, {0x2, 0xd0, 0x1, 0x200, 0x1, 0x38, 0xe0a, 0x8}}, {0x14, 0x2, [0xfff, 0x9f, 0x4, 0xde2, 0x6, 0x2, 0xa, 0x7]}}, {{0x1c, 0x1, {0x9, 0x1, 0x1, 0xbc4b, 0x2, 0x7fffffff, 0x40, 0x5}}, {0xe, 0x2, [0xffff, 0x905d, 0x8001, 0xaf6, 0x0]}}]}, @TCA_RATE={0x6, 0x5, {0xfe, 0x6}}, @TCA_INGRESS_BLOCK={0x8, 0xd, 0x8}]}, 0x33c}, 0x1, 0x0, 0x0, 0x2000c061}, 0x4008000) ioctl$SIOCSIFHWADDR(r7, 0x8922, &(0x7f0000002280)={'syzkaller0\x00', @random="2b0100004ec6"}) 4.279917007s ago: executing program 6 (id=1909): sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="700200001300290a000000000000000007000000", @ANYBLOB="000000000000000010010c8013000c800ca3488008000000000000000800038064001d80050006000000000014000500714abbd2547de97cbbf6efb226f19bf90d0002003a288e5e5b5b5a40000000006000078014000400293a02149f3b75a67093c28fd6f55a2314000400e48f01e49713f0c2d839f940d9f088d8050006000000003bd00002006272696467655f736c6176655f"], 0x270}, 0x1, 0x0, 0x0, 0x20008014}, 0x4) r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_DSTOPTS(r0, 0x29, 0x3b, &(0x7f00000002c0)=ANY=[], 0x8) bind$inet6(r0, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) sendmmsg(r1, &(0x7f0000001c00), 0x400000000000159, 0x40840) syz_emit_ethernet(0x66, &(0x7f0000000140)=ANY=[@ANYRES16=0x0, @ANYRESHEX=r0, @ANYRES8=r0, @ANYRESDEC=r1], 0x0) recvmmsg(r0, &(0x7f0000002f80)=[{{0x0, 0x0, &(0x7f00000014c0)=[{&(0x7f0000000180)=""/188, 0xbc}, {&(0x7f0000000240)=""/105, 0x69}, {&(0x7f00000002c0)=""/21, 0x15}, {&(0x7f0000000340)=""/182, 0xb6}, {&(0x7f0000000400)=""/156, 0x9c}, {&(0x7f00000004c0)=""/4096, 0x1000}], 0x6, &(0x7f0000001540)=""/19, 0x13}, 0x3}, {{&(0x7f0000001580)=@isdn, 0x80, &(0x7f00000017c0)=[{&(0x7f0000001600)=""/177, 0xb1}, {&(0x7f00000016c0)=""/216, 0xd8}], 0x2, &(0x7f0000001800)=""/184, 0xb8}, 0xf}, {{0x0, 0x0, &(0x7f0000001bc0)=[{&(0x7f00000018c0)=""/116, 0x74}, {&(0x7f0000001940)=""/20, 0x14}, {&(0x7f0000001980)=""/182, 0xb6}, {&(0x7f0000001a40)=""/248, 0xf8}, {&(0x7f0000001b40)=""/83, 0x53}], 0x5, &(0x7f0000001c40)=""/4096, 0x1000}}, {{&(0x7f0000002c40)=@xdp, 0x80, &(0x7f0000002ec0)=[{&(0x7f0000002cc0)=""/170, 0xaa}, {&(0x7f0000002d80)=""/232, 0xe8}, {&(0x7f0000002e80)=""/48, 0x30}], 0x3, &(0x7f0000002f00)=""/107, 0x6b}, 0x7}], 0x4, 0xb, 0x0) 4.03174171s ago: executing program 2 (id=1911): shutdown(0xffffffffffffffff, 0x0) r0 = socket$kcm(0x21, 0x2, 0x2) r1 = accept(r0, &(0x7f0000000040)=@xdp, &(0x7f00000000c0)=0x80) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000600)={'veth1_virt_wifi\x00'}) sendmsg$kcm(r1, &(0x7f0000000000)={0x0, 0x52, 0x0, 0x0, &(0x7f0000000800)=ANY=[@ANYRES32=r0], 0x28}, 0x44010) shutdown(0xffffffffffffffff, 0x0) (async) socket$kcm(0x21, 0x2, 0x2) (async) accept(r0, &(0x7f0000000040)=@xdp, &(0x7f00000000c0)=0x80) (async) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) (async) socket(0x10, 0x3, 0x0) (async) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000600)={'veth1_virt_wifi\x00'}) (async) sendmsg$kcm(r1, &(0x7f0000000000)={0x0, 0x52, 0x0, 0x0, &(0x7f0000000800)=ANY=[@ANYRES32=r0], 0x28}, 0x44010) (async) 3.940386561s ago: executing program 2 (id=1913): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r0, &(0x7f0000000280)={@val={0x6f01, 0x800}, @val={0x1, 0x0, 0x0, 0x0, 0x14}, @mpls={[], @ipv4=@tcp={{0x6, 0x4, 0x0, 0x0, 0x3f, 0x0, 0x0, 0x0, 0x84, 0x0, @empty=0x3fffffff, @local}, {{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x5, 0xb, 0x0, 0x300, 0x0, 0x18, {[@window={0x9, 0xfffffffffffffec4}, @timestamp={0x5, 0x2}, @generic={0x0, 0x2, "d58838068b91"}]}}}}}}, 0xfd6c) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)) 3.661999157s ago: executing program 2 (id=1915): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000140)=ANY=[@ANYBLOB="4400000010000d042abd70e7ffffffffffffff00", @ANYRES32=0x0, @ANYBLOB="01000000000000002400128009000100626f6e640000000014000280050001000500000005001b0000000000"], 0x44}}, 0x0) 3.237522006s ago: executing program 2 (id=1917): r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000100)={0xa, 0x4e20, 0x0, @empty}, 0x1c) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_UNCONFIRMED(r1, &(0x7f0000000300)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x14, 0x7, 0x1, 0x201, 0x0, 0x0, {0x3, 0x0, 0x9}, ["", "", "", "", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x20000054}, 0x10004041) r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) unshare(0x28000600) unshare(0x20000) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000040)={0x0, 0xffffffffffffffff, 0x0, 0x7, &(0x7f0000000000)='cgroup\x00'}, 0x30) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) tee(r4, r3, 0xffff, 0x1) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r5 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r2, &(0x7f0000000280)=ANY=[@ANYBLOB="0a000000bbaaaaaaaaaa88a808008100110086dd6d002000000c11ff0000000000000000000000000000000000000000000000000000000000000000040000000000f11400000000"], 0x4e) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000380)={0x18, 0x7, &(0x7f0000000040)=ANY=[@ANYBLOB="18000000000000000000000000000000e5000300000000000600000000000000250000001000000006000000faffffff95"], &(0x7f0000000140)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x7}, 0x94) 3.23635994s ago: executing program 6 (id=1918): r0 = accept4$x25(0xffffffffffffffff, &(0x7f0000000040), &(0x7f0000000080)=0x12, 0x80000) r1 = bpf$OBJ_GET_MAP(0x7, &(0x7f00000000c0)=@o_path={&(0x7f0000000000)='./file0\x00', 0x0, 0x8, r0}, 0x18) r2 = socket$unix(0x1, 0x2, 0x0) connect$unix(r2, &(0x7f0000000100)=@file={0x0, './file0\x00'}, 0x6e) setsockopt$inet6_group_source_req(r2, 0x29, 0x2c, &(0x7f0000000180)={0x1, {{0xa, 0x4e20, 0x10000, @mcast2, 0x4}}, {{0xa, 0x4e20, 0x5, @private2, 0x9}}}, 0x108) r3 = socket$netlink(0x10, 0x3, 0xb) sendmsg$NFT_BATCH(r3, &(0x7f0000000540)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x820000}, 0xc, &(0x7f0000000500)={&(0x7f0000000300)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x4}}, [@NFT_MSG_NEWSET={0x1d8, 0x9, 0xa, 0x102, 0x0, 0x0, {0x5, 0x0, 0x8}, [@NFTA_SET_EXPRESSIONS={0x100, 0x12, 0x0, 0x1, [{0x20, 0x1, 0x0, 0x1, @last={{0x9}, @val={0x10, 0x2, 0x0, 0x1, [@NFTA_LAST_MSECS={0xc, 0x2, 0x1, 0x0, 0x2}]}}}, {0x18, 0x1, 0x0, 0x1, @dup_ipv6={{0x8}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_DUP_SREG_ADDR={0x8, 0x1, 0x1, 0x0, 0xa}]}}}, {0x1c, 0x1, 0x0, 0x1, @lookup={{0xb}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_LOOKUP_SET_ID={0x8, 0x4, 0x1, 0x0, 0x3}]}}}, {0x14, 0x1, 0x0, 0x1, @synproxy={{0xd}, @void}}, {0xc, 0x1, 0x0, 0x1, @ct={{0x7}, @void}}, {0x78, 0x1, 0x0, 0x1, @objref={{0xb}, @val={0x68, 0x2, 0x0, 0x1, [@NFTA_OBJREF_IMM_NAME={0x9, 0x2, 'syz2\x00'}, @NFTA_OBJREF_SET_ID={0x8, 0x5, 0x1, 0x0, 0x2}, @NFTA_OBJREF_SET_SREG={0x8, 0x3, 0x1, 0x0, 0x8}, @NFTA_OBJREF_SET_NAME={0x9, 0x4, 'syz2\x00'}, @NFTA_OBJREF_IMM_NAME={0x9, 0x2, 'syz0\x00'}, @NFTA_OBJREF_SET_NAME={0x9, 0x4, 'syz2\x00'}, @NFTA_OBJREF_IMM_TYPE={0x8, 0x1, 0x1, 0x0, 0x4}, @NFTA_OBJREF_SET_SREG={0x8, 0x3, 0x1, 0x0, 0x12}, @NFTA_OBJREF_SET_SREG={0x8, 0x3, 0x1, 0x0, 0x3}, @NFTA_OBJREF_IMM_NAME={0x9, 0x2, 'syz1\x00'}]}}}, {0x10, 0x1, 0x0, 0x1, @meta={{0x9}, @void}}]}, @NFTA_SET_EXPRESSIONS={0x9c, 0x12, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, @ct={{0x7}, @void}}, {0x10, 0x1, 0x0, 0x1, @limit={{0xa}, @void}}, {0x24, 0x1, 0x0, 0x1, @xfrm={{0x9}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_XFRM_DIR={0x5, 0x3, 0x2}, @NFTA_XFRM_KEY={0x8, 0x2, 0x1, 0x0, 0x4}]}}}, {0x10, 0x1, 0x0, 0x1, @bitwise={{0xc}, @void}}, {0xc, 0x1, 0x0, 0x1, @fib={{0x8}, @void}}, {0x2c, 0x1, 0x0, 0x1, @redir={{0xa}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_REDIR_FLAGS={0x8, 0x3, 0x1, 0x0, 0x14}, @NFTA_REDIR_REG_PROTO_MAX={0x8, 0x2, 0x1, 0x0, 0x8}, @NFTA_REDIR_FLAGS={0x8, 0x3, 0x1, 0x0, 0x31}]}}}, {0x10, 0x1, 0x0, 0x1, @dynset={{0xb}, @void}}]}, @NFTA_SET_DATA_LEN={0x8, 0x7, 0x1, 0x0, 0x58d}, @NFTA_SET_DATA_LEN={0x8, 0x7, 0x1, 0x0, 0x30}, @NFTA_SET_GC_INTERVAL={0x8, 0xc, 0x1, 0x0, 0xf2}, @NFTA_SET_EXPR={0x10, 0x11, 0x0, 0x1, @range={{0xa}, @void}}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x200}, 0x1, 0x0, 0x0, 0x8880}, 0x24008081) r4 = accept$packet(0xffffffffffffffff, &(0x7f0000000580)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f00000005c0)=0x14) r6 = accept4(r4, &(0x7f0000000600)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000680)=0x80, 0x80000) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r6, 0x89f8, &(0x7f0000000700)={'syztnl1\x00', &(0x7f00000006c0)={'syztnl0\x00', r5, 0x80, 0x7800, 0x8, 0x9, {{0x7, 0x4, 0x2, 0x5, 0x1c, 0x64, 0x0, 0xca, 0x2f, 0x0, @multicast1, @loopback, {[@ra={0x94, 0x4}, @noop]}}}}}) r9 = accept4$inet(r6, &(0x7f0000000740), &(0x7f0000000780)=0x10, 0x80000) getsockopt$inet_sctp_SCTP_PR_ASSOC_STATUS(r6, 0x84, 0x73, &(0x7f00000007c0)={0x0, 0x4, 0x20, 0xfffffffffffff801, 0x7}, &(0x7f0000000800)=0x18) getsockopt$inet_sctp_SCTP_CONTEXT(r9, 0x84, 0x11, &(0x7f0000000840)={r10, 0xc}, &(0x7f0000000880)=0x8) r11 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000900), r3) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000940)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r6, &(0x7f0000000f00)={&(0x7f00000008c0)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000ec0)={&(0x7f0000000980)={0x510, r11, 0x100, 0x70bd2a, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r12}, @void}}, [@NL80211_ATTR_OFFCHANNEL_TX_OK={0x4}, @NL80211_ATTR_DONT_WAIT_FOR_ACK={0x4}, @NL80211_ATTR_DONT_WAIT_FOR_ACK={0x4}, @NL80211_ATTR_OFFCHANNEL_TX_OK={0x4}, @NL80211_ATTR_CSA_C_OFFSETS_TX={0x8, 0xcd, [0xfff, 0x2]}, @NL80211_ATTR_FRAME={0x4d5, 0x33, @probe_response={{{}, {0x7}, @broadcast, @device_b, @random="e8eb816d1a27", {0x2}}, 0x8, @random=0x101, 0xc6d0, @void, @val={0x1, 0x3, [{0x24}, {0x5}, {0x3}]}, @void, @val={0x4, 0x6, {0x4, 0x8, 0x9, 0x8}}, @void, @void, @void, @val={0x71, 0x7, {0x1, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x8, 0x29}}, [{0xdd, 0xbe, "100b4710ff58701390443e50a45101dd161422f4b7bd07c51945c73266e6954afefe0d4bf6d75111836012d16618180ff929d915a6c4cb62b542be8ee8276d0d0d67b09785cb1b5c0973522547d42d57315ccc91fee7d3332b662fce65c4658f770c30bca42077a5a9ab8cff5d966fbc0173316a5c76320003c3ce9b830bc6676ea611404e284d6ba653edf524a80ed5d098eb097785e44e405068577789dbdfcb1871fd9b1e52fc3c80724813fb09ae7d50f596610e00d30d51e9097371"}, {0xdd, 0x31, "488d824e43f6797059aa080e62cc10b0aebdff0631ffde4dc38348faf203e8e9305c642a9d531b1a0408aff4aeec583929"}, {0xdd, 0x7c, "8dd357d7dc11829d1447cf412f1d57a6645a79fa33ea5689d26013d124c26363a96198bbf323ba4661c6c7d0128dc6fbac84a078058944c00429089886529aab7d8421d084621ba774db63210c5c15b6e4c3715f64d9cdd621a910046848161b891b07011f592895f620ba66fae688bc6961d27c3b0717ec33e74a53"}, {0xdd, 0x49, "b26dc0a4a10d71ff1f01a2994b984a6753c6d93356362fc5e76c32eb1aa8880d1e55877c462114518409accc0e8dfa17f2620752686777bebc6374dde80a9c9a4c80da16920deaa73b"}, {0xdd, 0xed, "e414c43ae5614c9bbda95e646a72d9863c5475d0c763166cdb92ab96c09a2e57cc92bd6e825d38ba552c2bb8cf48b7516fb9483e93db4e220785390dcf696ab30e549a00b980fcec3ae4d2cec88cac2d9a20009ce323683615428721e515a241c83a5ef8d2cd3837464744a3466ab684271f1c75b85de5d05d2b42f7e886d7bcbc797d49dafbfc838838f8909554c1861f7679725421c894c0c5d9faa6df39b91c4b78476f8b9cac4c3f6ffe7997d337cf88ee9d45c42f7a17446d6dfe827ee54861d4408f037e4405b3dfd71837119bc225aef12b1f298e7615c417ec55794052cb3f0ed939b291ef99465c26"}, {0xdd, 0x1f, "29da1ef8ffc59632b89835dc8321f2ebe919c741bac32683c21e0d473eab5b"}, {0xdd, 0x72, "7f21b01762505e8c44e26f31d9482c4e94c3f914cebcc0c888cf3fce70fef0b79b34f367ab790bbe84a241aa288269e0b6e35de5d88aa279cd4d08d918e80403eafb0fba54093e24ed4640dbc6027527a34edfd99cd98fbf4a9584b12653ef853a652ad1ab85fbc98f3e964a53a0b5848347"}, {0xdd, 0x7e, "00d565da36a5d5df11e643a2abd6ae52d4609abb95a5dc2302b53cce1fd7af9bc3c8ab1b62cc06f20bdedeafdcf1d02457a06ffab65f405ea4495c4fea4ac964a880a0892e72278b166c9bfb7fbd13254fc968ce874cf49b32a81e3b64d5ef9189f24fe39a3996657da89be15a97f541b3b049c1dc52476dc6d70f62da62"}, {0xdd, 0xd5, "6dbfaf220f6a6b467434d079ae7b68c791331e2d49e044a7d66c7ed2e7894bb8868e512c4ea21cf4f0b45cb319809115ded51a0cd9eb9a7e8ceacf8d97fab914e0827c4006b587118d067b026437fb6a988c2009ec4487fcfcc83ecf5d5c5512b39c8858b81a610256eaf86bb2f546786b3b560a30b309f2e5adf3bdc3638c00b227815f874d9cc259fec21722612e7f850f72aaa01088ee6580445b2cd39b8db8326984225109be23b6d9b1423fe5b1054fcc00786f47bb463dd781a92a086a9fe413402116c486c366d207482f9ac1d3c29871b5"}]}}, @NL80211_ATTR_DONT_WAIT_FOR_ACK={0x4}]}, 0x510}, 0x1, 0x0, 0x0, 0x4000}, 0x44010) sendmsg$NL80211_CMD_STOP_P2P_DEVICE(r3, &(0x7f0000001000)={&(0x7f0000000f40)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000fc0)={&(0x7f0000000f80)={0x14, 0x0, 0x8, 0x70bd2c, 0x25dfdbff, {{}, {@void, @void}}, ["", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x1000}, 0x8010) r13 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_DEL_KEY(r13, &(0x7f0000001100)={&(0x7f0000001040)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f00000010c0)={&(0x7f0000001080)={0x38, r11, 0xe13, 0x70bd28, 0x25dfdbfe, {{}, {@void, @val={0xc, 0x99, {0x6ec5, 0x63}}}}, [@NL80211_ATTR_KEY_DATA_WEP40={0x9, 0x7, "b1a678a95f"}, @NL80211_ATTR_KEY_CIPHER={0x8, 0x9, 0xfac05}, @NL80211_ATTR_KEY_DEFAULT_MGMT={0x4}]}, 0x38}, 0x1, 0x0, 0x0, 0x80}, 0x20048091) r14 = bpf$OBJ_GET_PROG(0x7, &(0x7f0000001180)=@generic={&(0x7f0000001140)='./file0\x00', 0x0, 0x18}, 0x18) r15 = syz_genetlink_get_family_id$ethtool(&(0x7f00000011c0), r13) ioctl$int_in(r1, 0x5452, &(0x7f0000001200)=0x1) sendmsg$nl_route_sched(r13, &(0x7f0000001300)={&(0x7f0000001240)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000012c0)={&(0x7f0000001280)=@gettclass={0x24, 0x2a, 0x400, 0x70bd26, 0x25dfdbfe, {0x0, 0x0, 0x0, r5, {0x2, 0x5}, {0x1, 0x10}, {0x0, 0xc}}, ["", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20008000}, 0x0) r16 = syz_genetlink_get_family_id$tipc2(&(0x7f0000001380), r13) sendmsg$TIPC_NL_PUBL_GET(r13, &(0x7f0000001740)={&(0x7f0000001340)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000001700)={&(0x7f00000013c0)={0x334, r16, 0x400, 0x70bd26, 0x25dfdbfe, {}, [@TIPC_NLA_NET={0x10, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0x100000000}]}, @TIPC_NLA_MON={0x24, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_REF={0x8, 0x2, 0x4}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x401}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x2}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x8}]}, @TIPC_NLA_SOCK={0x4}, @TIPC_NLA_LINK={0x5c, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}]}, @TIPC_NLA_BEARER={0x144, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e22, 0x1, @empty, 0x1}}, {0x20, 0x2, @in6={0xa, 0x4e23, 0xfffffff9, @loopback, 0x9}}}}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e20, 0xffff, @loopback, 0xac2}}, {0x20, 0x2, @in6={0xa, 0x4e20, 0x9, @private0={0xfc, 0x0, '\x00', 0x1}, 0x7}}}}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x4e20, @rand_addr=0x64010100}}, {0x20, 0x2, @in6={0xa, 0x4e23, 0x6, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x7}}}}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e22, 0x8, @loopback, 0x8}}, {0x14, 0x2, @in={0x2, 0x4e20, @local}}}}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x4e23, @rand_addr=0x64010102}}, {0x20, 0x2, @in6={0xa, 0x4e22, 0x7, @remote, 0x780}}}}]}, @TIPC_NLA_BEARER={0x60, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0x11, 0x1, @l2={'eth', 0x3a, 'macvlan0\x00'}}, @TIPC_NLA_BEARER_PROP={0x1c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x13}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1ff}]}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x4}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x1c00}, @TIPC_NLA_BEARER_PROP={0x1c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7f}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7}]}]}, @TIPC_NLA_BEARER={0xe8, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x35}]}, @TIPC_NLA_BEARER_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x10}]}, @TIPC_NLA_BEARER_PROP={0x44, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x100}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1a}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x20}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x600000}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7}]}, @TIPC_NLA_BEARER_PROP={0x1c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0xc7e}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x912f}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x6}]}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x6}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x4}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @l2={'ib', 0x3a, 'macvlan0\x00'}}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x8}, @TIPC_NLA_BEARER_PROP={0x3c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xfffffffc}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xb}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xb}]}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x3}]}]}, 0x334}, 0x1, 0x0, 0x0, 0x10}, 0x20000040) syz_genetlink_get_family_id$fou(&(0x7f0000001780), r3) sendmsg$ETHTOOL_MSG_LINKMODES_GET(r3, &(0x7f0000001900)={&(0x7f00000017c0)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f00000018c0)={&(0x7f0000001800)={0xb4, r15, 0x200, 0x70bd2a, 0x25dfdbfe, {}, [@HEADER={0x7c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1_to_batadv\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'hsr0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r8}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'nr0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r5}]}, @HEADER={0x24, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r5}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r5}]}]}, 0xb4}, 0x1, 0x0, 0x0, 0x48010}, 0x4008821) socket$inet(0x2, 0x80000, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000001f80)={&(0x7f0000001940)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000001f40)={&(0x7f0000001980)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x7}}, [@NFT_MSG_DELFLOWTABLE={0x114, 0x18, 0xa, 0x101, 0x0, 0x0, {0x7, 0x0, 0x4}, [@NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_FLOWTABLE_FLAGS={0x8, 0x7, 0x1, 0x0, 0x4}, @NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_FLOWTABLE_HOOK={0xc0, 0x3, 0x0, 0x1, [@NFTA_FLOWTABLE_HOOK_DEVS={0x90, 0x3, 0x0, 0x1, [{0x14, 0x1, 'syzkaller1\x00'}, {0x14, 0x1, 'netpci0\x00'}, {0x14, 0x1, 'batadv_slave_0\x00'}, {0x14, 0x1, 'bond_slave_1\x00'}, {0x14, 0x1, 'veth0\x00'}, {0x14, 0x1, 'virt_wifi0\x00'}, {0x14, 0x1, 'erspan0\x00'}]}, @NFTA_FLOWTABLE_HOOK_DEVS={0x2c, 0x3, 0x0, 0x1, [{0x14, 0x1, 'macvlan1\x00'}, {0x14, 0x1, 'wlan1\x00'}]}]}, @NFTA_FLOWTABLE_FLAGS={0x8, 0x7, 0x1, 0x0, 0x1}, @NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz1\x00'}]}, @NFT_MSG_NEWTABLE={0x25c, 0x0, 0xa, 0x5, 0x0, 0x0, {0x0, 0x0, 0x8}, [@NFTA_TABLE_HANDLE={0xc, 0x4, 0x1, 0x0, 0x3}, @NFTA_TABLE_FLAGS={0x8, 0x2, 0x1, 0x0, 0x2}, @NFTA_TABLE_HANDLE={0xc, 0x4, 0x1, 0x0, 0x4}, @NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}, @NFTA_TABLE_FLAGS={0x8, 0x2, 0x1, 0x0, 0x1}, @NFTA_TABLE_HANDLE={0xc, 0x4, 0x1, 0x0, 0x5}, @NFTA_TABLE_USERDATA={0x103, 0x6, "10b1fac3f47ca752a71073abcbdac90d805af802802148eaf8b1ba5ccf66b62c67097c165a745c5864d036907e393275d315037a4f92e3b5f10b3a252c8b8ee5774d64741adc4affd259cef5a7c7da97bb88c9992b2345d2ba86d7582a1cc1fb917230a8c177f38aa3a2d2e17d867c8ef070c15f41779f59f9bf39d3de68656fc66fa67dcbe6eabbba27aa4646a6a0d4d46973d9cce49eb8eccb682b56f1b58e7be0af6abc817000d8266cec3b173c075659108307b025e5668487e51ba464aa36e04264af4b8ab0a30b2d0ecf04bcb03d4811db4e9c002060fb1837ffdf572e96b9497f5ac5995c3b6528dbbe3284a9f12981e73b3d2f51c0d198dbc14713"}, @NFTA_TABLE_FLAGS={0x8, 0x2, 0x1, 0x0, 0x1}, @NFTA_TABLE_USERDATA={0xfc, 0x6, "09118ad48145499fb281e912a6326df6290c9451f8849ffcc8cd9da30b84c8e8b10fef2b168b3a08afd185ac5e79cb20eb8e83614d3c91e9a122f2224eb3fc3de2ceabcf7a89963deba8586bd61bc06072b7047fa93bdd5247d48fb054a88e904fc7726f8c2b40604fd6f046f8ce65abde59e6d1561cf22567ae8a9826968b4382aef1f1e645cebf6dce39873c7a38380faa54cab125f933709e824c22dd75ec45e50c226c1cf6bcc36c539f1280bf1dc81fcec8b09a52cf7578cfb98b628d867457ab8f6361742b8addc4e92097ad214d87c4e908af7faba4e584923673ba662b0fae92b5296db442c327c8817f50523628e0533185475d"}]}, @NFT_MSG_DELCHAIN={0x184, 0x5, 0xa, 0x3, 0x0, 0x0, {0xa, 0x0, 0x7}, [@NFTA_CHAIN_POLICY={0x8, 0x5, 0x1, 0x0, 0xfffffffffffffffb}, @NFTA_CHAIN_USERDATA={0xef, 0xc, "10e3d7631702d829136dc2a86ba88a73d3e999a81573bcc4f23ba7e9dfb7644f08dbf5cd201852a721497112e3658234c21f6abeec9e0cefdc92a04c21db3d4e5f542346a02841ba6aba85a0f126d60302305e160ad5f69accddcce4e884a43086676e802a4338c0e2d4356439d1e330a2d4b723b47c0390e7230bce3044a0193cc4e04e1711f3c1d84380eef6f8b4b947f7ac68e3d8075f758ece995fa6995f954ed1268e0fb08e897f103f4ff34b8fae4cad22f1d153f51bd477764e1d2e5235240a90c06c828bc16190cda6676c760d11db84ec023646da7a6a14252a45daaeb062e0bd86a7ab46abe8"}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_CHAIN_COUNTERS={0x58, 0x8, 0x0, 0x1, [@NFTA_COUNTER_BYTES={0xc, 0x1, 0x1, 0x0, 0x10}, @NFTA_COUNTER_PACKETS={0xc, 0x2, 0x1, 0x0, 0x2}, @NFTA_COUNTER_PACKETS={0xc, 0x2, 0x1, 0x0, 0x5}, @NFTA_COUNTER_PACKETS={0xc}, @NFTA_COUNTER_BYTES={0xc, 0x1, 0x1, 0x0, 0x1}, @NFTA_COUNTER_BYTES={0xc}, @NFTA_COUNTER_PACKETS={0xc, 0x2, 0x1, 0x0, 0x4}]}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz0\x00'}, @NFTA_CHAIN_POLICY={0x8, 0x5, 0x1, 0x0, 0xffffffffffffffff}]}, @NFT_MSG_NEWSET={0x5c, 0x9, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0xa}, [@NFTA_SET_KEY_TYPE={0x8}, @NFTA_SET_KEY_TYPE={0x8, 0x4, 0x1, 0x0, 0x2}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x140}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x25}, @NFTA_SET_NAME={0x9, 0x2, 'syz2\x00'}, @NFTA_SET_NAME={0x9, 0x2, 'syz2\x00'}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x8}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x34}]}, @NFT_MSG_DELRULE={0x28, 0x8, 0xa, 0x101, 0x0, 0x0, {}, [@NFTA_RULE_POSITION_ID={0x8, 0xa, 0x1, 0x0, 0x3}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}]}, @NFT_MSG_NEWTABLE={0x1c, 0x0, 0xa, 0x5, 0x0, 0x0, {}, [@NFTA_TABLE_FLAGS={0x8}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x5bc}, 0x1, 0x0, 0x0, 0x80}, 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000002280)={0x4, 0xc, &(0x7f0000001fc0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x9}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r1}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0xd39}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x2}}]}, &(0x7f0000002040)='syzkaller\x00', 0x7, 0x21, &(0x7f0000002080)=""/33, 0x41000, 0x2, '\x00', r8, @fallback=0x12, 0xffffffffffffffff, 0x8, &(0x7f00000020c0)={0x4, 0x5}, 0x8, 0x10, &(0x7f0000002100)={0x0, 0xa, 0x4, 0x8001}, 0x10, 0x0, r14, 0x2, &(0x7f0000002200)=[0xffffffffffffffff, r1, r1], &(0x7f0000002240)=[{0x0, 0x3, 0x6, 0x4}, {0x1, 0x5, 0xe, 0x8}], 0x10, 0x2}, 0x94) 2.559756106s ago: executing program 6 (id=1922): bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x20, 0x3, 0x10004, 0x5}, 0x50) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_int(r1, 0x1, 0x10, &(0x7f0000000100)=0xffff, 0x4) writev(r0, &(0x7f0000000cc0)=[{&(0x7f0000000780)="1e", 0x1}], 0x1) recvmmsg(r1, &(0x7f0000000480)=[{{0x0, 0x0, 0x0}, 0x3}, {{0x0, 0xffffffffffffff21, 0x0, 0x0, &(0x7f00000005c0)=""/108, 0x6c}, 0x7fff}], 0x3fffffffffffcbe, 0x0, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) splice(r2, &(0x7f0000000000)=0x7, r2, &(0x7f0000000040)=0x9, 0x0, 0x4) pipe(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = socket$packet(0x11, 0x3, 0x300) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r6, &(0x7f00000009c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=@newtaction={0x48, 0x1e, 0x109, 0x100, 0x40000, {}, [{0x34, 0x1, [@m_mirred={0x30, 0x8, 0x0, 0x0, {{0xb, 0x9}, {0x4}, {0x4}, {0xc, 0x7, {0x1}}, {0xc}}}]}]}, 0x48}, 0x1, 0x2b1e}, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x89a0, &(0x7f0000000040)={'syzkaller0\x00'}) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="1b0000000000000000000000000004000000856c014c6012c2a7b7caee98783e3c7d3267dde5aff0fccbb0f487e4ff3e959a07", @ANYRES32=0x0, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB='\x00'/28], 0x50) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000000)={'syzkaller0\x00', 0x0}) setsockopt$packet_add_memb(0xffffffffffffffff, 0x107, 0x1, &(0x7f00000000c0)={r7, 0x2, 0x6}, 0xfffffffffffffdd9) r8 = bpf$MAP_CREATE(0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="0e0000000400000004"], 0x48) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000140)={r8, &(0x7f00000007c0), &(0x7f00000000c0)=""/79}, 0x20) r9 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r9, 0x89a1, &(0x7f0000000040)={'syzkaller0\x00'}) r10 = socket$inet(0x10, 0x3, 0x0) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000b00)={r3, 0x20, &(0x7f0000000900)={&(0x7f0000000800)=""/221, 0xdd, 0x0, &(0x7f0000000a40)=""/171, 0xab}}, 0x10) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000bc0)={{r4}, &(0x7f0000000b40), &(0x7f0000000b80)='%+9llu \x00'}, 0x20) bpf$PROG_LOAD(0x5, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r12 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r12, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000000c0)=@newqdisc={0x4c, 0x24, 0xf0b, 0x70bd2b, 0x0, {0x0, 0x0, 0x12, r11, {}, {0xffff, 0xffff}, {0x2}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x1c, 0x2, [@TCA_CAKE_SPLIT_GSO={0x8}, @TCA_CAKE_MEMORY={0x8, 0xa, 0x32}, @TCA_CAKE_FWMARK={0x8, 0x12, 0x5c}]}}]}, 0x4c}}, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x48241, 0x0) sendmsg$nl_generic(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB="18000000240001030000000000000000010000000400ae"], 0x18}, 0x1, 0x0, 0x0, 0x8001}, 0x4000) r13 = accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) sendmsg$RDMA_NLDEV_CMD_RES_PD_GET(r13, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)={0x20, 0x140e, 0xc3ef2dc4aaddb62c, 0x70bd2a, 0x25dfdbfe, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0x8}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8}]}, 0x20}, 0x1, 0x0, 0x0, 0x4001}, 0x10) 2.558545854s ago: executing program 2 (id=1923): sendmsg$NL802154_CMD_NEW_SEC_DEVKEY(0xffffffffffffffff, &(0x7f0000000980)={0x0, 0x0, &(0x7f0000000940)={&(0x7f0000000000)={0x38, 0x0, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}, @NL802154_ATTR_SEC_DEVKEY={0x18, 0x2f, 0x0, 0x1, [@NL802154_DEVKEY_ATTR_FRAME_COUNTER={0x8}, @NL802154_DEVKEY_ATTR_EXTENDED_ADDR={0xc}]}]}, 0x38}}, 0x0) r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="2c000000190001000000000000000000021800000000fd000000ed0008000100ac1414003400080004"], 0x2c}}, 0x0) sendto$inet6(r0, &(0x7f0000000000)='s', 0x10a73, 0x800, 0x0, 0x4b6ae4f95a5de35b) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000000)={'lo\x00'}) (async) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000000)={'lo\x00'}) sendmsg$IPSET_CMD_RENAME(r2, &(0x7f00000003c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000280)={&(0x7f0000000340)={0x68, 0x5, 0x6, 0x201, 0x0, 0x0, {0x0, 0x0, 0x1}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_SETNAME2={0x9, 0x3, 'syz2\x00'}, @IPSET_ATTR_SETNAME2={0x9, 0x3, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME2={0x9, 0x3, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x68}, 0x1, 0x0, 0x0, 0x26000000}, 0x20000000) sendmsg$nl_route(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000004c0)=ANY=[], 0x30}, 0x1, 0x0, 0x0, 0x1804}, 0x4) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000006c0)={0x18, 0xb, &(0x7f0000000640)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020000000000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], &(0x7f00000004c0)='GPL\x00', 0x0, 0x0, 0x0, 0x1f00, 0x0, '\x00', 0x0, 0x2}, 0x94) (async) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000006c0)={0x18, 0xb, &(0x7f0000000640)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020000000000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], &(0x7f00000004c0)='GPL\x00', 0x0, 0x0, 0x0, 0x1f00, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000300)='rcu_utilization\x00', r4}, 0x10) socket$netlink(0x10, 0x3, 0x4) (async) r5 = socket$netlink(0x10, 0x3, 0x4) openat$tun(0xffffffffffffff9c, 0x0, 0x4ca80, 0x0) (async) openat$tun(0xffffffffffffff9c, 0x0, 0x4ca80, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000844}, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) r6 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r6, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) (async) bind$bt_hci(r6, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r6, &(0x7f0000000340)="0a000300010000", 0x7) (async) write(r6, &(0x7f0000000340)="0a000300010000", 0x7) recvmmsg(r6, &(0x7f0000000a40)=[{{0x0, 0x0, 0x0}, 0x5}], 0x40001af, 0x12122, 0x0) bpf$MAP_CREATE_RINGBUF(0x0, 0x0, 0x48) (async) bpf$MAP_CREATE_RINGBUF(0x0, 0x0, 0x48) shutdown(0xffffffffffffffff, 0x2) shutdown(0xffffffffffffffff, 0x2) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0x0) bind$netlink(r5, &(0x7f0000514ff4)={0x10, 0x0, 0x25dfdbfd, 0x2ffffffff}, 0xc) connect$inet6(r1, &(0x7f0000000200)={0xa, 0x0, 0x2, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f00000000c0), 0x4) setsockopt$inet6_tcp_TLS_TX(r1, 0x11a, 0x1, &(0x7f0000000140)=@ccm_128={{0x303}, "8053e7eeb87c6375", "0dee47b49df8d449e11633a06f4679fc", "c0ce6b9a", "684976da3acd6bac"}, 0x28) (async) setsockopt$inet6_tcp_TLS_TX(r1, 0x11a, 0x1, &(0x7f0000000140)=@ccm_128={{0x303}, "8053e7eeb87c6375", "0dee47b49df8d449e11633a06f4679fc", "c0ce6b9a", "684976da3acd6bac"}, 0x28) sendmsg$inet(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000009c0)=[{&(0x7f0000000240)='n', 0x1}], 0x1}, 0x0) (async) sendmsg$inet(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000009c0)=[{&(0x7f0000000240)='n', 0x1}], 0x1}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x1e, 0x4, &(0x7f0000000000)=@framed={{}, [@call={0x85, 0x0, 0x0, 0x8a}]}, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x24}, 0x94) syz_genetlink_get_family_id$nl80211(&(0x7f00000006c0), 0xffffffffffffffff) 2.488901351s ago: executing program 1 (id=1924): sendmsg$NL80211_CMD_SET_CQM(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000380)={0x64, 0x0, 0x0, 0x0, 0x2000000, {{}, {@void, @val={0xc}}}, [@NL80211_ATTR_CQM={0x44, 0x5e, 0x0, 0x1, [@NL80211_ATTR_CQM_TXE_RATE={0x8}, @NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT={0x8}, @NL80211_ATTR_CQM_TXE_PKTS={0x8, 0x6, 0x5}, @NL80211_ATTR_CQM_RSSI_THOLD={0x10, 0x1, [0x0, 0x0, 0x0]}, @NL80211_ATTR_CQM_RSSI_HYST={0x0, 0x2, 0x5}, @NL80211_ATTR_CQM_RSSI_THOLD={0xfffffffffffffcd2, 0x1, [0x1]}, @NL80211_ATTR_CQM_TXE_INTVL={0x8}]}]}, 0x64}, 0x1, 0x0, 0x0, 0x48014}, 0x0) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) r2 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff) accept4(r0, &(0x7f0000000100)=@un=@abs, &(0x7f0000000180)=0x80, 0x1800) sendmsg$DEVLINK_CMD_PORT_GET(r1, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f00000005c0)={0x64, r2, 0x1, 0x0, 0x0, {0x49}, [{{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x73}}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x10000002}}}]}, 0x64}}, 0x0) sendmsg$DEVLINK_CMD_PORT_SET(r0, &(0x7f0000000080)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000040)={&(0x7f0000000580)={0x1ac, r2, 0x2, 0x70bd28, 0x25dfdbfe, {}, [{{@pci={{0x8}, {0x11}}, {0x8, 0x3, 0x3}}, {0x6, 0x4, 0x3}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x2}}, {0x6}}, {{@pci={{0x8}, {0x11}}, {0x8}}, {0x6}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x2}}, {0x6, 0x4, 0x2}}, {{@pci={{0x8}, {0x11}}, {0x8, 0x3, 0x2}}, {0x6, 0x4, 0x2}}, {{@pci={{0x8}, {0x11}}, {0x8}}, {0x6, 0x4, 0x3}}, {{@pci={{0x8}, {0x11}}, {0x8}}, {0x6, 0x4, 0x1}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x2}}, {0x6, 0x4, 0x3}}, {{@pci={{0x8}, {0x11}}, {0x8, 0x3, 0x3}}, {0x6, 0x4, 0x3}}]}, 0x1ac}, 0x1, 0x0, 0x0, 0x20040010}, 0x0) sendmsg$netlink(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000001ac0)=[{&(0x7f00000000c0)=ANY=[@ANYBLOB="140100001f0005040000000065e3609e475fd0b44f8936c608000000b5ee1dc02f"], 0x114}], 0x1}, 0x0) r3 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000200)={0x1b, 0x0, 0x0, 0x9, 0x0, 0xffffffffffffffff, 0x86, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x0, 0x5}, 0x50) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000400)={'batadv_slave_0\x00', 0x0}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000880)={0x18, 0x13, &(0x7f0000000280)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x4}, {{0x18, 0x1, 0x1, 0x0, r3}}, {}, [@ringbuf_query], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000340)='GPL\x00', 0xd, 0x4c, &(0x7f0000000740)=""/76, 0x41000, 0x28, '\x00', r4, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f00000004c0)={0x4, 0xc, 0x2, 0xc}, 0x10, 0x0, 0x0, 0x8, &(0x7f00000007c0), &(0x7f0000000800)=[{0x0, 0x5, 0xd, 0x6}, {0x1, 0x2, 0x9, 0x1}, {0x3, 0x2, 0x4, 0x9}, {0x4, 0x4, 0x8}, {0x4, 0x5, 0x0, 0xb}, {0x4, 0x5, 0x10}, {0x2, 0x2, 0x6, 0x5}, {0x1, 0x3, 0xa, 0xc}], 0x10, 0x7}, 0x94) 2.247791176s ago: executing program 1 (id=1926): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r2) sendmsg$TIPC_CMD_ENABLE_BEARER(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r4, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r5 = socket$inet6(0xa, 0x3, 0x87) setsockopt$inet6_IPV6_XFRM_POLICY(r5, 0x29, 0x23, &(0x7f0000000280)={{{@in6=@remote, @in6=@mcast1, 0xfffd, 0x0, 0x4e20, 0x0, 0x2}, {0x0, 0x4, 0x1, 0x0, 0x0, 0x9}, {0x1ff, 0xffffffffe, 0x4053e5, 0x20}, 0x2, 0x1, 0x1, 0x0, 0x3, 0x1}, {{@in=@empty, 0x1, 0x32}, 0x2, @in6=@private0, 0x3502, 0x1, 0x0, 0x0, 0x6, 0xfffffffd}}, 0xe8) connect$inet6(r5, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @dev}, 0x9df}, 0x1c) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r6, 0x6, 0x13, &(0x7f0000000180)=0x100000001, 0x4) connect$inet6(r6, &(0x7f0000000080)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @dev}}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r6, 0x6, 0x1f, &(0x7f0000000040), 0x4) r7 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r7, &(0x7f0000000140)=[{&(0x7f00000001c0)="580000001400192340834b80040d8c560a067f0202ff000000000000000058000b4824ca945f64009400ff0325010ebc000000000000008000f0fffeffe809005300fff5dd00000010000100060c10000000010000000000", 0x58}], 0x1) r8 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x100, 0x0) getsockopt$inet_sctp6_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0x83, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f00000010c0)=0x8) getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(0xffffffffffffffff, 0x84, 0x1f, &(0x7f00000001c0)={r9, @in={{0x2, 0x4e20, @empty}}, 0xf801, 0x3}, &(0x7f0000000080)=0x90) getsockopt$inet_sctp6_SCTP_GET_ASSOC_STATS(r5, 0x84, 0x70, &(0x7f0000000440)={r9, @in={{0x2, 0x4e20, @private=0xa010100}}, [0x9, 0x7, 0xa4, 0x0, 0xfff, 0x482f9b38, 0x81, 0xfffffffffffffffc, 0x7, 0x962, 0x4, 0xf, 0x6, 0x5405, 0x800]}, &(0x7f0000000240)=0x100) close(r8) r10 = socket$unix(0x1, 0x1, 0x0) r11 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r11, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000026c0)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r12, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2, 0xffff}}, [@qdisc_kind_options=@q_cbs={{0x8}, {0x1c, 0x2, @TCA_CBS_PARMS={0x18, 0x1, {0x0, '\x00', 0x1, 0x7, 0x100, 0x8}}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x20000001}, 0x0) sendmsg$nl_route_sched(r11, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000006c0)=@newqdisc={0x6c, 0x24, 0x4ee4e6a52ff56541, 0x70b923, 0x80000, {0x0, 0x0, 0x0, r12, {}, {0x2, 0xb}, {0x9, 0xb}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x40, 0x2, [@TCA_TBF_BURST={0x8, 0x6, 0xc}, @TCA_TBF_PRATE64={0xc, 0x5, 0x32e15927d6c9748}, @TCA_TBF_PARMS={0x28, 0x1, {{0x6, 0x0, 0x8, 0x5, 0x1, 0x7}, {0x8, 0x1, 0xffff, 0xc, 0xf, 0x1}, 0x8, 0xd, 0xb1b}}]}}]}, 0x6c}, 0x1, 0x0, 0x0, 0x2000c061}, 0x4008000) ioctl$SIOCSIFHWADDR(r8, 0x8922, &(0x7f0000002280)={'syzkaller0\x00', @random="2b0100004ec6"}) 2.069772343s ago: executing program 5 (id=1928): sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="700200001300290a000000000000000007000000", @ANYBLOB="000000000000000010010c8013000c800ca3488008000000000000000800038064001d80050006000000000014000500714abbd2547de97cbbf6efb226f19bf90d0002003a288e5e5b5b5a40000000006000078014000400293a02149f3b75a67093c28fd6f55a2314000400e48f01e49713f0c2d839f940d9f088d8050006000000003bd00002006272696467655f736c6176655f"], 0x270}, 0x1, 0x0, 0x0, 0x20008014}, 0x4) r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_DSTOPTS(r0, 0x29, 0x3b, &(0x7f00000002c0)=ANY=[], 0x8) bind$inet6(r0, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) sendmmsg(r1, &(0x7f0000001c00), 0x400000000000159, 0x40840) syz_emit_ethernet(0x66, &(0x7f0000000140)=ANY=[@ANYRES16=0x0, @ANYRESHEX=r0, @ANYRES8=r0, @ANYRESDEC=r1], 0x0) recvmmsg(r0, &(0x7f0000002f80)=[{{0x0, 0x0, &(0x7f00000014c0)=[{&(0x7f0000000180)=""/188, 0xbc}, {&(0x7f0000000240)=""/105, 0x69}, {&(0x7f00000002c0)=""/21, 0x15}, {&(0x7f0000000340)=""/182, 0xb6}, {&(0x7f0000000400)=""/156, 0x9c}, {&(0x7f00000004c0)=""/4096, 0x1000}], 0x6, &(0x7f0000001540)=""/19, 0x13}, 0x3}, {{&(0x7f0000001580)=@isdn, 0x80, &(0x7f00000017c0)=[{&(0x7f0000001600)=""/177, 0xb1}, {&(0x7f00000016c0)=""/216, 0xd8}], 0x2, &(0x7f0000001800)=""/184, 0xb8}, 0xf}, {{0x0, 0x0, &(0x7f0000001bc0)=[{&(0x7f00000018c0)=""/116, 0x74}, {&(0x7f0000001940)=""/20, 0x14}, {&(0x7f0000001980)=""/182, 0xb6}, {&(0x7f0000001a40)=""/248, 0xf8}, {&(0x7f0000001b40)=""/83, 0x53}], 0x5, &(0x7f0000001c40)=""/4096, 0x1000}}, {{&(0x7f0000002c40)=@xdp, 0x80, &(0x7f0000002ec0)=[{&(0x7f0000002cc0)=""/170, 0xaa}, {&(0x7f0000002d80)=""/232, 0xe8}, {&(0x7f0000002e80)=""/48, 0x30}], 0x3, &(0x7f0000002f00)=""/107, 0x6b}, 0x7}], 0x4, 0xb, 0x0) setsockopt$inet6_int(r0, 0x29, 0x4, &(0x7f0000000000)=0x1, 0x4) 1.3859902s ago: executing program 3 (id=1931): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000a80)={0x11, 0x3, &(0x7f0000000200)=@framed={{0x18, 0x0, 0x0, 0x0, 0xfffffffc}}, &(0x7f0000000100)='GPL\x00', 0x2, 0x0, 0x0, 0x41000, 0x4}, 0x94) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r1, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/74, 0x328000, 0x1000}, 0x1c) setsockopt$XDP_UMEM_COMPLETION_RING(r1, 0x11b, 0x6, &(0x7f0000000240)=0x1, 0x4) setsockopt$XDP_RX_RING(r1, 0x11b, 0x2, &(0x7f0000001980)=0x100, 0x4) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000580)={'batadv_slave_0\x00', 0x0}) setsockopt$XDP_UMEM_FILL_RING(r1, 0x11b, 0x5, &(0x7f0000000140)=0x1, 0x4) bind$xdp(r1, &(0x7f0000000100)={0x2c, 0x8, r2, 0x0, r1}, 0x10) setsockopt$XDP_TX_RING(r1, 0x11b, 0x3, &(0x7f00000003c0)=0x4, 0x4) 1.235444113s ago: executing program 1 (id=1932): r0 = socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) (async) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000300), r2) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000340)={'wlan1\x00'}) sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)={0x20, r1, 0x9c3fa077fa966179, 0xfffffffd, 0x0, {{0x7e}, {@void, @val={0xc, 0x99, {0x916d, 0x15}}}}}, 0x20}}, 0x4000054) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000340)={'bridge_slave_0\x00', 0x0}) (async) r6 = socket(0x10, 0x80002, 0x0) sendmsg$nl_route(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000880)=@bridge_setlink={0x24, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r5}, [@IFLA_AF_SPEC={0x4}]}, 0x24}}, 0x0) (async) setsockopt$packet_drop_memb(r3, 0x107, 0x2, &(0x7f00000000c0)={r5, 0x1, 0x6, @remote}, 0x10) (async) sendmsg$NL80211_CMD_RELOAD_REGDB(r0, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000340)={0x14, r1, 0x1, 0x70bd2d, 0x25dfdbfe, {}, ["", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x20000000}, 0x20008004) 1.108221419s ago: executing program 3 (id=1933): socket$nl_route(0x10, 0x3, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b704000000000000850000005700000095"], 0x0}, 0x90) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000000000)={0x3, &(0x7f0000000040)=[{0x20, 0x0, 0x0, 0xfffff010}, {0x30, 0x0, 0x0, 0x8000}, {0x6}]}, 0x10) sendmsg$nl_route_sched(r0, &(0x7f0000004b80)={0x0, 0x0, &(0x7f0000004b40)={&(0x7f0000005a80)=@delchain={0x24, 0x65, 0x100, 0x70bd29, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {0xc, 0xfff1}, {0xfff3, 0x10}, {0x60f97c3f683a9f2a, 0x4}}}, 0x24}, 0x1, 0x0, 0x0, 0x40000c0}, 0xc054) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0xa, 0x5, 0x2, 0x7}, 0x50) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) recvfrom(0xffffffffffffffff, 0x0, 0x0, 0x2141, 0x0, 0x0) r3 = socket$inet6(0xa, 0x3, 0x3c) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB, @ANYRESOCT=0x0, @ANYRESHEX=r3, @ANYRESHEX], 0x7c}, 0x1, 0x0, 0x0, 0x20004800}, 0x0) sendmsg$NFT_BATCH(r4, &(0x7f0000009b40)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000850}, 0x40) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc(&(0x7f0000000200), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r7, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000780)=ANY=[@ANYRESOCT, @ANYRES32=r5, @ANYRES16=r6], 0x70}}, 0x48805) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000280)='pids.current\x00', 0x0, 0x0) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f000000b500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_TID_CONFIG(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)={0x1c, r8, 0x8de13c6b70ae92c3, 0x41003, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r9}, @void}}}, 0x1c}, 0x1, 0x0, 0x0, 0x800}, 0x4050) connect$inet6(r3, &(0x7f0000000000)={0xa, 0x4000, 0x0, @remote, 0x5}, 0x1c) writev(r3, &(0x7f00000000c0)=[{&(0x7f0000000100)=',', 0xffdf}], 0x1) r10 = socket$nl_route(0x10, 0x3, 0x0) r11 = socket(0x400000000010, 0x3, 0x0) sendmsg$nl_route(r10, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)=ANY=[@ANYBLOB="38000000c19f71a9bcf8bb110000000000000000", @ANYRES32=0x0, @ANYBLOB="2b030000400000001800128008000100677470000c00028008000100", @ANYRES32=r11, @ANYBLOB], 0x38}}, 0x0) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000780)={0x0, 0x0, &(0x7f0000000640), &(0x7f0000000740), 0x75, r2}, 0x38) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000818110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000003"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 1.107570668s ago: executing program 5 (id=1934): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x11, 0x6, &(0x7f00000005c0)=ANY=[@ANYBLOB="050000000000000061110c00000000008510000002000000850000000500000095000000000000009500a5050000000077d8f3b423cdac8d80000000000000002be16ad10a48b243ccc42606d25dfd73a015e0ca7fc2506a0f7535f7866907dc6751dfb265a0e3ccae669e17fd6587d452d6453559c3421eed73d56615fe6c54c3b3ffe1b4ce25d7c983c044c03bf3a48dfe47ec9dd6c091c30b93bfae76d9ebacd3ed3e26e7a23129d6606fd28a69989d552af6bda9df2c3af36effff9af2551ce896165127cb3f011a7d06602e2fd52347125907000000000000003ed38ae89d24e1cebfba2f87925bfacba83109751fe6c05405d027edd68149ee99eef6a6992308a4fc0b7c70bc677d6dd4aed4af7500d7900a820b6347184e9a217b5614cd50cbe43a1ed2526814bc0000e9e086ce48e90defb6670c3df262ad0a97aec7291c25447c106a99893e10db21901eb397b2f5fd71d20fa7a050fbbef9e326ea27e513e96068fd1e8a43e89f9c85c822a961546ed5363c17ff1432d08806bc376e3e49ee52b59d13182e1f24ed200ada12f7a1001500a710eb1affb87ba55b2d72078e9f40b4ae7d01000000d11cd22c35d32940000088dde499000000fdffffff000000000000000000000000000000000000000000000c52f4ebd2c893bb97a068bd10734a83584898eccb26f7b789cfc4cd995fa3e11a5c74c85404e2df3ad37b729ac83b0dcb4f48f3c3356b9997fc455a17690b6f7f9ccbe4b1701941b18a904c0e585a66c3b84b138efc20a546d3d5227e23b03f2a834391ad24fe7d9b20cf92cb151763d41f5c76e2ff3e93ee296c4082ee73e7e197253a2b66c353312c9d75711ce1623e9c54bdff59d2a69dcb7d84c235b23a4480c2461b405cfd1a38992f295ad3adc94cd07c850d1ce6d0b2fea02c24e9280333152fb794e4ddea02017a6c139b50101caecaf2abc0842b99a96fc4275ad107274e2934a87a4ddcdb112754ca5bdec0ead14b6c0f19a43a2f04c7f0be31491eb8c9ff68236c8600000000000000000000000066e034c81c3cab4e33fc8dc55ce0ada18dcbf31c6e82893add3bee3e10fc873d1d922b0877cbcd95b839d3059d5140a1f742f6e75741e39e5cb6a193e06a1043375b0f61b5d4e17c81baa31b924d84f2243471221c15fa12313ffbfa7c2730302b66a99f66705b71e6205e7cbf3643561eabb9a63fcd604d5cc27e1317ad94cf438d71873e540be16b6ca20508011132153c528f7bca92980a3223c5b9cdddedb0a14adddf9a6e70a26b5c0ee0879c349814bee9d96d8bd23db4e801d49201ae84090455682794098afa42b34196b1d849020eeeb1ef48d003d71524683d7cdfa841bca708414fb8ff49742420d1ab7fa678aa4806d5247616e8bc0b02887f8efe9310ccf9bec1c9b7f6671c9d59ac6b09b4436cafdd1887c8e884c930d21ace088ccc99a94d4b33da2fc1b1310bb607a9ad65844655de1ac9fd36d12e07a821fb950368a970c58fb4f3f403fdaf68902874"], &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x6}, 0x70) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(camellia)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r2 = accept4(r1, 0x0, 0x0, 0x800) sendmmsg$alg(r2, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=@allocspi={0x104, 0x16, 0x1, 0x0, 0x0, {{{@in=@rand_addr=0x64010101, @in=@rand_addr=0x64010101, 0x4e20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {@in6=@local, 0x0, 0x6c}, @in=@broadcast, {0x5, 0x1, 0x10}, {0x0, 0x4}, {0x0, 0x1}, 0x0, 0x0, 0xa}, 0x5, 0x5}, [@sec_ctx={0xc, 0x8, {0x8, 0x8, 0x1, 0xe}}]}, 0x104}, 0x1, 0x0, 0x0, 0x1}, 0x4000080) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="180000000000000000000000000000008500000022000000180100002020702500000000002020207b0af8ff00000000bfa10000000000000701"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x54, '\x00', 0x0, @fallback=0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0500000004000000080000000a"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000001"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000023c0)={0x11, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18020000006687000000000000000000850000007b00000095"], 0x0}, 0x94) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000400)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000bc0)={&(0x7f0000000940)='percpu_alloc_percpu\x00', r5}, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x3, 0x3, &(0x7f0000000000)=@framed={{0x7a, 0xa, 0x0, 0xff00, 0x0, 0x71, 0x10, 0x43}}, &(0x7f0000000480)='syzkaller\x00'}, 0x80) recvmsg(r2, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) 811.589801ms ago: executing program 5 (id=1935): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f00000006c0)={0x88, 0x2, 0x6, 0x801, 0x0, 0x0, {0x1}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_DATA={0x2c, 0x7, 0x0, 0x1, [@IPSET_ATTR_MARK={0x8, 0xa, 0x1, 0x0, 0xff}, @IPSET_ATTR_SIZE={0x8, 0x17, 0x1, 0x0, 0x1}, @IPSET_ATTR_CIDR={0x5}, @IPSET_ATTR_HASHSIZE={0x8, 0x12, 0x1, 0x0, 0x80000000}, @IPSET_ATTR_CADT_FLAGS={0x8, 0x8, 0x1, 0x0, 0x6c}]}, @IPSET_ATTR_TYPENAME={0x16, 0x3, 'hash:net,port,net\x00'}, @IPSET_ATTR_DATA={0x14, 0x7, 0x0, 0x1, [@IPSET_ATTR_BUCKETSIZE={0x5, 0x15, 0x7}, @IPSET_ATTR_CADT_FLAGS={0x8, 0x11, 0x1, 0x0, 0xc}]}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}]}, 0x88}, 0x1, 0x0, 0x0, 0x10}, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) (async) r2 = socket$netlink(0x10, 0x3, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x800, 0x0) (async) r4 = socket$nl_generic(0x10, 0x3, 0x10) (async) r5 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$TIPC_NL_MEDIA_GET(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000200)=ANY=[@ANYBLOB="9393b1f0", @ANYRES16=r5, @ANYBLOB="01002bbd700100000000030000005800018044000400200001000a00000000000000fe800000000000000000000000000010f8000000200002000a00000000000005ff020000000000000000000000000001000000000d0001007564703a73797a3000000000"], 0x6c}}, 0x0) (async) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r6) (async) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r7) sendmsg$TIPC_CMD_ENABLE_BEARER(r7, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r8, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}}, 0x0) (async) ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) (async) r9 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x100, 0x0) close(r9) (async) r10 = socket$unix(0x1, 0x1, 0x0) r11 = socket$nl_route(0x10, 0x3, 0x0) (async) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f00000003c0)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r11, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r12, {0x0, 0xb}, {0xffff, 0xffff}, {0x0, 0xe}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x28, 0x2, {{0x100, 0x7, 0x6361, 0x2, 0xfffffffd, 0x6}, [@TCA_NETEM_REORDER={0xc, 0x3, {0x1, 0x4}}]}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x4000}, 0x0) (async) ioctl$SIOCSIFHWADDR(r9, 0x8922, &(0x7f0000002280)={'syzkaller0\x00', @random="2b0100004ec6"}) r13 = socket(0x10, 0x803, 0x0) sendmsg$BATADV_CMD_GET_MESH(r13, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000480)={0x0, 0x32}}, 0x0) (async) getsockname$packet(r13, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000300)=0x14) getsockname$packet(r13, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a) ioctl$sock_inet6_SIOCSIFDSTADDR(0xffffffffffffffff, 0x8918, &(0x7f0000000400)={@mcast1, 0x62, r15}) (async) sendmsg$nl_route(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000000)=ANY=[@ANYBLOB="3800000010000507000000000004000000000000", @ANYRES32=r14, @ANYBLOB="00000016010000001800120008000100736974000c00020008000300", @ANYRES16=r14], 0x38}, 0x1, 0x0, 0x0, 0x8c1}, 0x20000004) (async) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000340)=ANY=[@ANYBLOB="58000000100039042cbd7000eaffffff000003e4", @ANYRES32=r15, @ANYBLOB="03000000cb1507003800128008000100736974002c00028008000100", @ANYRES32, @ANYBLOB="08000300ac"], 0x58}, 0x1, 0x0, 0x0, 0x20008004}, 0x4000040) 811.134026ms ago: executing program 1 (id=1936): bpf$PROG_LOAD(0x5, &(0x7f00000009c0)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff}, 0x94) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000180)=ANY=[@ANYBLOB="9feb010018000000000000002400000024000000090000000400000003000006040000000400000007000000020000000400000004000000fcffffff002e71a061"], 0x0, 0x45, 0x0, 0x1, 0x80000001}, 0x28) r0 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r0, &(0x7f00000000c0)=[{&(0x7f0000000200)="580000001400192340834b80040d8c560a0677bc45ff810500000000000058000b480400945f64009400050028925a01000000000000008000f0fffeffe809000000fff5dd0000001000010002081000418e00000004fcff", 0x58}], 0x1) sendmsg$FOU_CMD_DEL(r0, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x3c, 0x0, 0x100, 0x70bd25, 0x25dfdbfb, {}, [@FOU_ATTR_LOCAL_V6={0x14, 0x7, @mcast2}, @FOU_ATTR_REMCSUM_NOPARTIAL={0x4}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0x33}, @FOU_ATTR_LOCAL_V4={0x8, 0x6, @multicast1}]}, 0x3c}}, 0x4000880) (async) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0xa, 0x4, 0x8, 0x8}, 0x48) bpf$TOKEN_CREATE(0x24, &(0x7f0000000180)={0x0, r1}, 0x8) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1a, 0xd, &(0x7f00000002c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bf125185a200000000000007020000f8ffffffb703000008000000b7040000000000008500000001000000850000000f00"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x18, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000600)={&(0x7f00000005c0)='sys_enter\x00', r2}, 0x10) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000080)={{r1}, &(0x7f0000000000), &(0x7f0000000040)}, 0x20) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002c80)={0x3, 0x4, &(0x7f0000000000)=@framed={{0x18, 0x2, 0x0, 0x0, 0x1}, [@call={0x85, 0x0, 0x0, 0x87}]}, &(0x7f0000000080)='GPL\x00'}, 0x94) 805.0531ms ago: executing program 3 (id=1937): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) r1 = getpid() ioctl$sock_FIOSETOWN(r0, 0x8901, &(0x7f0000000140)=r1) ioctl$sock_FIOSETOWN(r0, 0x8901, &(0x7f0000000000)=r1) connect$bt_l2cap(r0, &(0x7f0000000040)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}, 0xe) r2 = syz_init_net_socket$bt_bnep(0x1f, 0x3, 0x4) bpf$ENABLE_STATS(0x20, 0x0, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x16, 0xe, &(0x7f0000000c00)=ANY=[@ANYBLOB="b702000000000080bfa30000000000000703000000feffff7a0af0fff8ffff1971a4f0ff00000000b7060000080000001e6400000000000045040400010000001704000001000a00b7040000000100006a0af2fe00000000850000001a000000b70000000000000095000000000000008e17f199a68b061b93d83298a8cdda1ce784909b849d5550ad855dab54d8877a6db61d69f2ffcaa10350e11cb97ce8df1bc9a0c4eeceb9971e43405d621ffbc9b0d8ca56b50f0c010d631f6dbc8486bc5d5bf2ca8285056892db03cf1c62d57c08a90b189d190c341035de53a9a53608c10556e5734eb84049761451ce540c772e069f80cb201b2de17dfdb4b60939d5d6aed4062049b87e03e2cd18a77dda613e0c64497fcc059c062234d5595f6fbaa187b81d1106000000000f0000fd9ac3d09e29a9d542ca9d85a5c9c88474895d679838def0a83a733dc6a39b63a5ed69d32394c53361d7480884bd8000000000000000b91c61bd99dc89f12907af7dccd106cb937b450f859ce8292a79c3e40000b59b0fc46d6cec3c080a882add4e1179bd4a44f231a2d73148be4248cdc138408ba953df4aece69311687f4122073a236c3a32efa04137d46f0247d2638da3261c8162bb7c7824be6195a66d2e17e122040e11001131ce319045e5b3334e68475ac3f46aa2837f9004600daded9b19b35eebe52613c346e255421b23a278fd00004270b1cd5fc9aa2286ccca37db965d9dd366598f5ec993cb0cf127e2a46cfbdf63eea190d86a4d1b75ae98480100bd5828954a7d093a54f7e75b3753508ca3c41685d1e407315e59d626c23b3f89a926e9382966853774e7dd1f1a2177cdf2802237c177d543e8da47a01f05e113e53518270239b69c117e2637c31085f4d8a596b6edab26afaf6605b231199f38a6fc7eb83714387450ea18eafbace8eec18a4b2c442e7b88a7611c1283bec84e1715fb9f4fcaf52c08058fc4f21c0ad71adabdd850aed3eeec6eaab347bdf474e17b9aa345d1e6e3bb83f90230bdf53e7d0e5c3f914d905422b83f30936674ba8f0bffaf2305c0972df71fe5f4e01506471e897bced7798509e64df360d95f9a4099f86438ac2bbcbdbd1d9db21a1d5c065567fd70aae68096827fa5c2d9bd20292344c7dcf6241447cfbb05b5d0fdb4e08afbac5397b64aa369922ed7ed8918f97294b6854210d2b93aaf92159dbaa2f186d4a420c68d6baf1c31de4f0bf478bfd51bb1e96ea849a80ae5a89be7e38474c7aade344d68324f9e12a6b9770e6bd12ae69efffaee58040753701af84c2924c1b5aea1650f42c9ae9820a33095f062fb88313d035ea405515a61a4be64f9fa0985c5be592090cc48291004609fdac2ab6100000000000000a84570c7c00d647daf8af334050b61e9b2d3f0adad1d1ff47be19b8da2799e9ecef8efabe73f92dbd0760f8bbd9c590bd1371e2b5d9a2ea2190f5e4f5cd641cdfe5d89f84a368ef7e6ff1eacdc0ec9e97b8f9c9e314661ea0aa8a104008d188b66b3a4aedeed9df4238a08fc2fb1007233cc2c87fcaa0cccd8ec03444471c1dd660c87acc17bff740d199a7c0c52c63c0408b5158e0000000c275eedb02f141113cf2c55b2c08c2c68cc99d2bb5840fba332e1c82862ec9b90106248f81d32a47ac94ddee815dba8aeb5d3121cf247a81aef7805b020e9eec44cbe3055be69fe066824ba2292b9cdce41635fc00df96fb10a3a8cc60c4a76c65ebbb0640e0a29de94edf5cbefac1c5fa96e7080af804b22cabce10ea52f1018527f4aa39cdafa3eff63de2a7f50d042667820f6f86f276afb2b8134301e031351ee13013137e9d5cec0c84d7e3f82c6fd12eb98f9ea654bcb9ce59a2015183c6e65bb0537e611b830d74c30fb8207fca0990acdbb51e4e234026e00000000b3ebae3eb52c140953a350fcf0124b1a30b1afc29ea56f8413686d912eb8118d73ef9c6d3843ebcb555301c0205dd3bd9b1d742e334319c8979c322e92"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @flow_dissector, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000340)}, 0x42) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000008c0)={r3, 0x0, 0xe, 0x0, &(0x7f0000000080)="3a173357f297c605804ab3828443", 0x0, 0x3800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) r4 = accept(r2, &(0x7f0000000180)=@alg, &(0x7f0000000200)=0x80) ioctl$sock_bt_bnep_BNEPCONNADD(r4, 0x400442c8, &(0x7f0000000080)={r0, 0xfffffffa, 0x3}) 657.385792ms ago: executing program 1 (id=1938): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=ANY=[@ANYBLOB="64000000020605aad200000000000000000000000900020073797a32000000000500040000000000250001000600cf001400078008000640000000000800130000000000050005000a00000016000300686173683a6e65746f5d6742e3bd9b196624ad50a594609a29930fe36c06d67b47e45f9dcf34dffc50d8fdfde98c99931717f43607c79a44d264b2aa979058b05f5f8012067ed1624570e28e9ad357d4cf2ef3389fec41ee8e62dd5b"], 0x64}, 0x1, 0x0, 0x0, 0x4000000}, 0x2000) sendmsg$IPSET_CMD_GET_BYINDEX(r0, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, 0xf, 0x6, 0x5, 0x0, 0x0, {0x0, 0x0, 0xa}, [@IPSET_ATTR_INDEX={0x6}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8}, 0x4004) 583.767081ms ago: executing program 3 (id=1939): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x11, 0x6, &(0x7f00000005c0)=ANY=[@ANYBLOB="050000000000000061110c00000000008510000002000000850000000500000095000000000000009500a5050000000077d8f3b423cdac8d80000000000000002be16ad10a48b243ccc42606d25dfd73a015e0ca7fc2506a0f7535f7866907dc6751dfb265a0e3ccae669e17fd6587d452d6453559c3421eed73d56615fe6c54c3b3ffe1b4ce25d7c983c044c03bf3a48dfe47ec9dd6c091c30b93bfae76d9ebacd3ed3e26e7a23129d6606fd28a69989d552af6bda9df2c3af36effff9af2551ce896165127cb3f011a7d06602e2fd52347125907000000000000003ed38ae89d24e1cebfba2f87925bfacba83109751fe6c05405d027edd68149ee99eef6a6992308a4fc0b7c70bc677d6dd4aed4af7500d7900a820b6347184e9a217b5614cd50cbe43a1ed2526814bc0000e9e086ce48e90defb6670c3df262ad0a97aec7291c25447c106a99893e10db21901eb397b2f5fd71d20fa7a050fbbef9e326ea27e513e96068fd1e8a43e89f9c85c822a961546ed5363c17ff1432d08806bc376e3e49ee52b59d13182e1f24ed200ada12f7a1001500a710eb1affb87ba55b2d72078e9f40b4ae7d01000000d11cd22c35d32940000088dde499000000fdffffff000000000000000000000000000000000000000000000c52f4ebd2c893bb97a068bd10734a83584898eccb26f7b789cfc4cd995fa3e11a5c74c85404e2df3ad37b729ac83b0dcb4f48f3c3356b9997fc455a17690b6f7f9ccbe4b1701941b18a904c0e585a66c3b84b138efc20a546d3d5227e23b03f2a834391ad24fe7d9b20cf92cb151763d41f5c76e2ff3e93ee296c4082ee73e7e197253a2b66c353312c9d75711ce1623e9c54bdff59d2a69dcb7d84c235b23a4480c2461b405cfd1a38992f295ad3adc94cd07c850d1ce6d0b2fea02c24e9280333152fb794e4ddea02017a6c139b50101caecaf2abc0842b99a96fc4275ad107274e2934a87a4ddcdb112754ca5bdec0ead14b6c0f19a43a2f04c7f0be31491eb8c9ff68236c8600000000000000000000000066e034c81c3cab4e33fc8dc55ce0ada18dcbf31c6e82893add3bee3e10fc873d1d922b0877cbcd95b839d3059d5140a1f742f6e75741e39e5cb6a193e06a1043375b0f61b5d4e17c81baa31b924d84f2243471221c15fa12313ffbfa7c2730302b66a99f66705b71e6205e7cbf3643561eabb9a63fcd604d5cc27e1317ad94cf438d71873e540be16b6ca20508011132153c528f7bca92980a3223c5b9cdddedb0a14adddf9a6e70a26b5c0ee0879c349814bee9d96d8bd23db4e801d49201ae84090455682794098afa42b34196b1d849020eeeb1ef48d003d71524683d7cdfa841bca708414fb8ff49742420d1ab7fa678aa4806d5247616e8bc0b02887f8efe9310ccf9bec1c9b7f6671c9d59ac6b09b4436cafdd1887c8e884c930d21ace088ccc99a94d4b33da2fc1b1310bb607a9ad65844655de1ac9fd36d12e07a821fb950368a970c58fb4f3f403fdaf68902874"], &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x6}, 0x70) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(camellia)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r2 = accept4(r1, 0x0, 0x0, 0x800) sendmmsg$alg(r2, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r2, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2, 0x0, 0x0, 0xf000000}, 0x0) 579.257227ms ago: executing program 5 (id=1940): r0 = socket(0x10, 0x3, 0x0) sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000080)={0x34, 0x0, 0x1, 0x70bd2b, 0x0, {}, [@ETHTOOL_A_COALESCE_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'netdevsim0\x00'}]}, @ETHTOOL_A_COALESCE_USE_CQE_MODE_RX={0x5, 0x19, 0x1}]}, 0x34}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="5000000020000103feffffff0000000002000000000000000400010008000a000008000005001e"], 0x50}}, 0x4000850) sendmmsg$alg(r0, &(0x7f0000000140), 0x4924b68, 0x0) r1 = socket(0x2, 0x80805, 0x0) sendmmsg$inet(r1, &(0x7f00000003c0)=[{{&(0x7f0000000000)={0x2, 0x0, @rand_addr=0x64010100}, 0x10, &(0x7f0000000680)=[{&(0x7f00000006c0)="1bd56c5ebae20163", 0x8}], 0x1}}], 0x1, 0x0) r2 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r2, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r1, 0x84, 0x72, &(0x7f0000000040)={r3, 0x8788, 0x20}, 0xc) 478.075302ms ago: executing program 1 (id=1941): r0 = socket$nl_route(0x10, 0x3, 0x0) unshare(0x22020400) pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) recvfrom$rose(r1, 0x0, 0x0, 0x9637f83aea13cb50, 0x0, 0x0) r2 = socket(0x840000000002, 0x3, 0x100) connect$inet(r2, &(0x7f0000000000)={0x2, 0x4e20, @remote}, 0x10) sendmmsg$inet(r2, &(0x7f0000005240), 0x4000095, 0x0) syz_genetlink_get_family_id$devlink(&(0x7f0000000280), r2) recvmsg$can_bcm(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000280)=[{&(0x7f0000000140)=""/24, 0x18}, {&(0x7f0000000180)=""/253, 0xfd}], 0x2, &(0x7f00000002c0)=""/51, 0x33}, 0x2) r3 = bpf$ITER_CREATE(0x21, &(0x7f0000000340), 0x8) bpf$ITER_CREATE(0x21, &(0x7f0000000380)={r3}, 0x8) getsockopt$SO_TIMESTAMP(r0, 0x1, 0x1d, &(0x7f0000000080), &(0x7f0000000100)=0x4) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=ANY=[@ANYRES64=r0, @ANYRES32, @ANYRES32=r0], 0x3c}, 0x1, 0x0, 0x0, 0x1}, 0xc0d0) 379.776436ms ago: executing program 3 (id=1942): r0 = syz_genetlink_get_family_id$ipvs(&(0x7f00000001c0), 0xffffffffffffffff) socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000140)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_JOIN_IBSS(r1, &(0x7f0000000300)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000180)={&(0x7f0000000200)={0x50, 0x0, 0x400, 0x70bd26, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r2}, @val={0xc, 0x99, {0x8, 0x19}}}}, [@NL80211_ATTR_MCAST_RATE={0x8, 0x6b, 0x4}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_FREQ_FIXED={0x4}, @NL80211_ATTR_BSS_BASIC_RATES={0xf, 0x24, [{0x3}, {0xc, 0x1}, {0x5}, {0x24}, {0x2}, {0x6c}, {0xc, 0x1}, {0x2}, {0x60}, {0x16, 0x1}, {0x36}]}]}, 0x50}, 0x1, 0x0, 0x0, 0x44800}, 0x800) sendmsg$IPVS_CMD_NEW_DAEMON(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000000)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="01000000000000000000090000003c000380140002007663616e30000000000000000000000014000600ff0500000000000000000000000000010800010001000000080003"], 0x50}}, 0x0) sendmsg$NL80211_CMD_SET_CQM(r1, &(0x7f0000000740)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000700)={&(0x7f0000000680)={0x50, 0x0, 0x8, 0x70bd25, 0x25dfdbfe, {{}, {@void, @val={0xc, 0x99, {0x6, 0x31}}}}, [@NL80211_ATTR_CQM={0xc, 0x5e, 0x0, 0x1, [@NL80211_ATTR_CQM_RSSI_HYST={0x8, 0x2, 0x2}]}, @NL80211_ATTR_CQM={0x24, 0x5e, 0x0, 0x1, [@NL80211_ATTR_CQM_RSSI_LEVEL={0x8, 0x9, 0x5d45e49d}, @NL80211_ATTR_CQM_RSSI_LEVEL={0x8, 0x9, 0x1}, @NL80211_ATTR_CQM_RSSI_HYST={0x8, 0x2, 0xc}, @NL80211_ATTR_CQM_RSSI_LEVEL={0x8, 0x9, 0xfffffff7}]}]}, 0x50}, 0x1, 0x0, 0x0, 0x2000c000}, 0x4004) (async) sendmsg$NL80211_CMD_SET_CQM(r1, &(0x7f0000000740)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000700)={&(0x7f0000000680)={0x50, 0x0, 0x8, 0x70bd25, 0x25dfdbfe, {{}, {@void, @val={0xc, 0x99, {0x6, 0x31}}}}, [@NL80211_ATTR_CQM={0xc, 0x5e, 0x0, 0x1, [@NL80211_ATTR_CQM_RSSI_HYST={0x8, 0x2, 0x2}]}, @NL80211_ATTR_CQM={0x24, 0x5e, 0x0, 0x1, [@NL80211_ATTR_CQM_RSSI_LEVEL={0x8, 0x9, 0x5d45e49d}, @NL80211_ATTR_CQM_RSSI_LEVEL={0x8, 0x9, 0x1}, @NL80211_ATTR_CQM_RSSI_HYST={0x8, 0x2, 0xc}, @NL80211_ATTR_CQM_RSSI_LEVEL={0x8, 0x9, 0xfffffff7}]}]}, 0x50}, 0x1, 0x0, 0x0, 0x2000c000}, 0x4004) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f00000000c0)={'batadv_slave_0\x00'}) splice(r1, &(0x7f0000000780)=0x4, r1, &(0x7f00000007c0), 0x200, 0x18) socket$nl_netfilter(0x10, 0x3, 0xc) (async) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000300), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000340)={'wlan0\x00'}) (async) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000340)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000080)={0x2c, r5, 0x1, 0x210000, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r6}, @void}}, [@NL80211_ATTR_TX_RATES={0x10, 0x5a, 0x0, 0x1, [@NL80211_BAND_5GHZ={0xc, 0x4, 0x0, 0x1, [@NL80211_TXRATE_LEGACY={0x5, 0x1, [0x4]}]}]}]}, 0x2c}, 0x1, 0x0, 0x0, 0x200440c1}, 0x4004) sendmsg$NL80211_CMD_CONNECT(r1, &(0x7f0000000580)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000540)={&(0x7f0000000380)=ANY=[@ANYBLOB="8c41f55d", @ANYRES16=r5, @ANYBLOB="000428bd7000ffdbdf252e00000008000300", @ANYRES32=r2, @ANYBLOB="0c009900000000000b00000006009800000400000400d0000400010110009d0000000000ff000200060010000a00340001010101010100003801518018000080110001005dd8bcb19d6fdf3b3ef9057aa70000001800008013000400436df7bb1fc29c7732d31a71a0bc06003c00008011000100dcf6294421838cce91c2d15cb6000000050009000100000009000100fc5e0effce000000080007000200000005000200010000007000008004000500050009000100000005000200000000002400088004000100040002000400020004000100040001000400010004000200040001002000088004000100040001000400010004000100040002000400010004000100090001001ab5ceade500000008000880040001003c0000802400088004000200040001000400010004000200040002000400010004000100040002000500020005000000090001003cd74c2fc2000000100000800800030004000000040006000c000080080003000a581f00"], 0x18c}, 0x1, 0x0, 0x0, 0x4}, 0x10) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=ANY=[@ANYBLOB="58000000100001002abd70000000000000000000", @ANYRES32=0x0, @ANYBLOB="802100000000000014000300776c616e300000000000000000000000080004000e0400001c0016801800018014000b00070000ce"], 0x58}}, 0x0) (async) sendmsg$nl_route(r7, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=ANY=[@ANYBLOB="58000000100001002abd70000000000000000000", @ANYRES32=0x0, @ANYBLOB="802100000000000014000300776c616e300000000000000000000000080004000e0400001c0016801800018014000b00070000ce"], 0x58}}, 0x0) 378.399225ms ago: executing program 5 (id=1943): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000a80)={0x11, 0x3, &(0x7f0000000200)=@framed={{0x18, 0x0, 0x0, 0x0, 0xfffffffc}}, &(0x7f0000000100)='GPL\x00', 0x2, 0x0, 0x0, 0x41000, 0x4}, 0x94) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r1, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/74, 0x328000, 0x1000}, 0x1c) setsockopt$XDP_UMEM_COMPLETION_RING(r1, 0x11b, 0x6, &(0x7f0000000240)=0x1, 0x4) setsockopt$XDP_RX_RING(r1, 0x11b, 0x2, &(0x7f0000001980)=0x100, 0x4) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000580)={'batadv_slave_0\x00', 0x0}) setsockopt$XDP_UMEM_FILL_RING(r1, 0x11b, 0x5, &(0x7f0000000140)=0x1, 0x4) bind$xdp(r1, &(0x7f0000000100)={0x2c, 0x8, r2, 0x0, r1}, 0x10) setsockopt$XDP_TX_RING(r1, 0x11b, 0x3, &(0x7f00000003c0)=0x4, 0x4) 40.60212ms ago: executing program 5 (id=1944): sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="700200001300290a000000000000000007000000", @ANYBLOB="000000000000000010010c8013000c800ca3488008000000000000000800038064001d80050006000000000014000500714abbd2547de97cbbf6efb226f19bf90d0002003a288e5e5b5b5a40000000006000078014000400293a02149f3b75a67093c28fd6f55a2314000400e48f01e49713f0c2d839f940d9f088d8050006000000003bd00002006272696467655f736c6176655f"], 0x270}, 0x1, 0x0, 0x0, 0x20008014}, 0x4) r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_DSTOPTS(r0, 0x29, 0x3b, &(0x7f00000002c0)=ANY=[], 0x8) bind$inet6(r0, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) sendmmsg(r1, &(0x7f0000001c00), 0x400000000000159, 0x40840) syz_emit_ethernet(0x66, &(0x7f0000000140)=ANY=[@ANYRES16=0x0, @ANYRESHEX=r0, @ANYRES8=r0, @ANYRESDEC=r1], 0x0) recvmmsg(r0, &(0x7f0000002f80)=[{{0x0, 0x0, &(0x7f00000014c0)=[{&(0x7f0000000180)=""/188, 0xbc}, {&(0x7f0000000240)=""/105, 0x69}, {&(0x7f00000002c0)=""/21, 0x15}, {&(0x7f0000000340)=""/182, 0xb6}, {&(0x7f0000000400)=""/156, 0x9c}, {&(0x7f00000004c0)=""/4096, 0x1000}], 0x6, &(0x7f0000001540)=""/19, 0x13}, 0x3}, {{&(0x7f0000001580)=@isdn, 0x80, &(0x7f00000017c0)=[{&(0x7f0000001600)=""/177, 0xb1}, {&(0x7f00000016c0)=""/216, 0xd8}], 0x2, &(0x7f0000001800)=""/184, 0xb8}, 0xf}, {{0x0, 0x0, &(0x7f0000001bc0)=[{&(0x7f00000018c0)=""/116, 0x74}, {&(0x7f0000001940)=""/20, 0x14}, {&(0x7f0000001980)=""/182, 0xb6}, {&(0x7f0000001a40)=""/248, 0xf8}, {&(0x7f0000001b40)=""/83, 0x53}], 0x5, &(0x7f0000001c40)=""/4096, 0x1000}}, {{&(0x7f0000002c40)=@xdp, 0x80, &(0x7f0000002ec0)=[{&(0x7f0000002cc0)=""/170, 0xaa}, {&(0x7f0000002d80)=""/232, 0xe8}, {&(0x7f0000002e80)=""/48, 0x30}], 0x3, &(0x7f0000002f00)=""/107, 0x6b}, 0x7}], 0x4, 0xb, 0x0) setsockopt$inet6_int(r0, 0x29, 0x4, &(0x7f0000000000)=0x1, 0x4) 0s ago: executing program 3 (id=1945): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f00000022c0)=ANY=[@ANYBLOB="b702000001010000bfa300000000000007030000fdfdfff67a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040000010000400404000001f7ff04b7050000040000006a0a00fe00000000850000000a000000b70000000000000095000000000000009cc6b3fcd62c061c6238975d43a4505f80e39c9f3c530cf08e467b592f868ee3b0a435df0a0e8c1bf176db2a6b2feb4b77d339707bfd2d84aaa3b1d4e984c46ea7e2b347a36f5662403e1b2be4284322a4908a0d411a9872971c7c56f0979bd10b97163c066d0e196bf02f46c7953ab1abdaf90a70f2bdf4000200000000b0c2c125080963f63223b7b80197aa3161f45346b100000000000000000089070000009876b588743794298b79dc192dff048fc207c81f28bdd3e26a1a8a0481e9f0da43bb6ca66e2f55a9ff19ffcafe3e64be06000000000000005064caec04a367c23d9fb6a6991ddb737d527d6acb15426406991c3b404984dfa2c6e94bd0339454c13a0100000082c15dc760a313e3b3ca5d3393404029e98fa883c71949a34d84030323e3d54fc5b29d27643453ad9211e3550ee5520211d9370175133f260c6882a146880b9387f1beb5418618bc83a3becf9bb57da7ba8b913c685fc6700848dc6665d73248c1f74e08ad04ce905faf32706e0000249a028044ede964362cfb2f30a246c3b2f60000fc4deb91da1368b0960b8d69bd99c64893d44f962524429dc058528e7e541c903869d96989b9a986620cb2c95c83f2a082c52764f49e51188f9418b01bcd8ae164acdac95318ec8b2c6feacdcf4b528e5e58219bc54f6ad5679e7f430e6960ed048c46e1dccca05bfa1d67c83795eae2d31968c055d325a9c794ef88b30c2de4a274878b73c05ffa88b7073be648b12bb1fee58958d6a6f31bfe568215dfbde59dad00008a73b40f09cf018cd496b36050d7fd45e3620c28f76749262e33e16429a6da35ceb1a989de81c3f8b8bc348ef2ac3781b847611fcb0a26acafdd6d9a1b17dcb9f7c493d8f8cd344a1d470ca0d6f16ab0293774b5509fb0e7113936d59d5a60dbd84a938476adeebab9ff44f531bb0200000000000000cc1fbc455a64fd449284f71761092a0302000000000000008a05d36fd9b814b4292745418c92d944763a4bf5e138d810e29a31f08f7dea7762d2d8f7e1d24cabe17ad4135d8872935ceac6eb4f046f2acc1b0efb4438abddcabb4e4e72705edfa2cddb01f44c850e4ea450aab72b589bec83bbb688e659fb426cb43d0ee993516fd4e867232cde69b6ffad447dcd92e0ef8234ff850ec3948dd1fa7afb77d951fe4abf618121b7894c106beb49a71c62df5544ef221973432ccc7e62b151eb898a01010a7ec5acd0a5dcb2de443880c8a682515d1da9a3048744acb44384d1591df789883c0560495cb0cb32283529926d25e5c7f481112ab8a82247e927fb6f256830dab3671f00500d36a17790bab7d0e89e6c15314f2b963bfc867953476b0505c7d728326d666f39e82cfcf7e7a85df288d75df24c5e4d529c349923f9a4fb882310391dd58b4cbd8def239a227724d39c3e6c40e20e07e68a22888a5c3941b7a765b92bcb37f302487bcbd93ccf3a104021ff34ddf7ffcca1a04eae963e25516a114573779b24a341dfb2e80f1f345c6d96493ffc2a18478b5bf3aab2ea59c51cf0678e1a57d0ea042d911548ff612002ddb2d54d42fbdde42b56887003d27468225b2594a05044baf314113e8894680600000000000000db6b56557a5adad95cb9a69d4de50642b4b9d6d3ba7eb534c88d443ac8b3685135dfc4da06e7f8695be614c557caed7eb0120516e1351fed7d8ffa31c8f4be364185469cfc5f25c90d71bce745dd2d58a30e0844f12c4cbbdd7a08465e665c2620d78673dfb6d9263ed7def8924cfcd48a8a3534f1a3eac9ee9f18a18106ba3d7c7a62330f5c0e98cb7982dd7bad02c8dba9c13894185bfc4bd2520b6e2043fcb3fc5eb55ecf9e6e363ea2ac40a14a6faa21b0f5a0fdb6487c51ef12c27b30255bc4f8813be88beeb5aa6f6a4151cfb90644e50630ed474df7d1635afcb1ea3f6c47b5acbba2ce5099a9387c7acb9bbd1da497611ceda25049e48ddacccbb58dddaf9a3510d65383829a51e0f416661fa80ca1eaaa6cf0824305ba4ec80400c50ffe83ccb0e6fef321190c58aca8c7c8c6d26ff5cbc2cadebda8e1219e04f8dacffd33db1a0a2e74c9eb978d80a12d0b5327bfd053000000000000000000be0d02a14708504412fa93d335992b2983c5addc191b4a21c7b340d0536b01958e15315eb5f3f9f4992c18f666359f40295fa73284c4b607669bae75bd68c3e2b770c324a0ab26b6065d7ea6a7bd80052db57506ec7cc861bf3998d07484c66630ca8173fea3f06ed1dfc70a8b90418e2dc76137e0f68cb1c8a908aef9f0f85647dba54e05028c33d94d463fb20d2e7547184b8d3611e45dff02144387f342ef9b9bf650e9d049bf65258a7bc094a6965e24611c077e1ca0891362a9d68f3ec7610c0449acf18459500f024f9b75885cd79ba32776e4a511c8a4ad922b00000000000000a9241220dfbf7d02ef507ec6fc7f5d37d835f7bed71283c431b9d8cbd9003972bf1dc6a71bedad8e19efc3edd2a7a7e555d5f3176af69920471e6e5bcb8966c813c132d65e2b99d3015e06b372e1aefaae14ee3fbc6349af362c19b59c214de66912d1a9a98d92dc197a51c29443de62caca334c46d110e50896fe50d0477771d387f40c8ef05750ca651e6e69a237dcf78666d6ab2bda1f853525494e4efdd93be38bb5fc671f8794002d7a951fd336aaf4ed1166cb459df70218c571ba1c40b028234505e5477e268326af8812c2fbb8785a223fce0a0601c2a3b58bea8c6216eadabcabe86ab46e4cd3d58ef7ce8d3c4b0bc5952e81dfc0a490d8568db6f9c51fe703c6864fae0053d2f91f49e977cdc1962dbc28c29471a72199862bc8fc6e211d136ecc87185f2437c4fce146d8579cab4fba94b2b613c9b8148d05e0690a4c4ab35aabc45801d2b82081e62b23a01b58b1ffb624f63ad2246796796160cd3682374364edac52f1becb7c6eff50823b75fb2ef516ec4ec1cb20a2535b504502d744f2099674e58f2c117c980cf0d041c8ea5c4f166bab4aa5ed200ef4dcff96f7c9c1ab8c22db0f439b23b04bcd41ffc3a0e01976ca1cf43e12d7d72f3faa4979faabd62e2dc54a980eae4d5e8c6498de331c3aba1144ef1190ea6cda641d9416c4560cab2d819eac7b04c70f141754c3ffd79da363fe8859afee531710caf1b2bf5a51142f4755cbb700c28083525a9093790096cb93417f1216000000000000000000000000000040ceb244e4cae2b65a76d41793aabccd3d0c50486eae0000000000007c012779c14ca94759266200229b58c12279817869e831cade7b09ddffffff9d93e2ad25eed43c0b9ee4fd209b5b919a42f676b9d7236fc8dd5040899d0676291407ce9ac8101dd3512f5b3ac8cf8179d1749de324000030d0f942ec4604c28d5c287d1435956784003a53eb5fe535ead8857acf0166dbd9f30a9b9c8a9b9faf1356faf269cded935b07863e4fdad8aab52686c81babd1c08f6700a2fadd413443022ea5c774ffefdd426abed08d437a4db48611fc82a18ab9f54758a1aad86d95cd186ceb55fafa3930090467b8b7bb8ae7e1c8b4b4106a381cb67fdb86def4de2076dc538bb97502b4b4350e633dc0a53d2f64ec521f6fa1cd02843a5e16074d86c9a01bc5cfae0245f1fab843c633446f5f3a43226109b7dafe7815773bd6969f04cbe15236b90000000000000000000000000000000000000000000000000000ff0779b9c005da21073c6d9680d4e547cb727addb2efe11b8b3a706569f1522b57d71bb0beccab7c8fe9e1330b2f501b2ac3cf4eba7ceda6ff8a0c8b18c5e9e2f505e833217557abb257d61af8e8c473a7585436730db75da167481ab8921fe051b250f8d8ef9c8481bb28a137d15040b0181c28dfad7c17b30c452a64c43a1167b948247c33abc765a6ba695c3cea5e32a4d1ae2dcbec2ff4268e03aad15efc6004e6b3d7f0edf8b5d4ae7846a6d43c16c90b7c5dc13ac2ff0439ab693498964cad2bb533bcd240778b7e49145c48efde42b44c01517f1a7c7707b4c4fc0900e7086ec40354504590696282286db9030f0320e2fcba8723939005347b3f744ff1973431000000000000000000000000000000000000003495d69aaf9a1d83e83511a3bf44fe753b8ad83bc34ea4d46b397e000ff267c50122aa5aaf8474ec2e57d960d963900bef84a4b3c7dd01ae4d6b5522aa8a35ae7996e298bcfea4d3677a67b52041ec21ae8003aa1c9969178b1b00e4d12ac9741fd788fb6260ec043c013907523c77f8acc20b9e2fd224ca8f0000b2b10991881e0a12f4e1c4f54b9ca7c9a0c8298d60b8b6eaa023418992d6d62b0e9faca4a3b3a805e859137cd933ef5eb8db16f159f32505725da51414562d064b551246dacd586f42d04d3fed3c087bb52ae4bc09f3846c785d1b278e661ed01fbc2415288bc9c808c4aef648d431b3029da0dec8886c3ee9cad996843d00a3b5eb54e270dd2e96c8f2fdb4c27c2d1bd467f2a14867dec67730d8a68329839d9feff688dfbe25c73f936338e7b057980da58a6303d95f17712d01005a1066ae457ae32925ce658b559c1182a74e267da57fe25b19153f1cdebaddf3f7a3479c09f2303d000000000000000000000000000000b17fedd6b6501a47d0e5b510f4a4fab5a62d5fa7e8ead851b01dbfdfe5823c2600"/3432], &(0x7f0000000340)='GPL\x00'}, 0x48) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r1, &(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000000000041}, 0xc) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000b40)={&(0x7f0000000a00)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x24, 0x24, 0x2, [@func_proto={0x0, 0x3, 0x0, 0xd, 0x0, [{}, {}, {}]}]}}, &(0x7f0000000a80)=""/172, 0x3e, 0xac, 0x9}, 0x28) r2 = socket$inet6(0xa, 0x3, 0x1) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f0000000440)={{{@in6=@private1={0xfc, 0x1, '\x00', 0x1}, @in=@rand_addr=0x640100ff, 0x0, 0x0, 0x4e22, 0x0, 0xa}, {0xfffffffffffffffe, 0x400403, 0x0, 0x0, 0x0, 0x2, 0x0, 0x9}, {0x800, 0xd, 0x0, 0x7}, 0xfffffff9, 0x0, 0x1, 0x0, 0x0, 0x1}, {{@in6=@private1, 0x4d2, 0x2b}, 0x2, @in=@dev={0xac, 0x14, 0x14, 0x1d}, 0x3500, 0x1, 0x2, 0x0, 0x1, 0x9}}, 0xe8) sendmmsg(r2, &(0x7f0000000480), 0x21, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000780)={r0, 0x18000000000002a0, 0xe, 0x0, &(0x7f0000000080)="5aee41dea43e63a3f7fb7f110000", 0x0, 0xf004, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) kernel console output (not intermixed with test programs): _0) entered blocking state [ 137.289612][ T7486] bridge0: port 1(bridge_slave_0) entered forwarding state [ 137.357318][ T7486] bridge0: port 2(bridge_slave_1) entered blocking state [ 137.364556][ T7486] bridge0: port 2(bridge_slave_1) entered forwarding state [ 137.400430][ T7486] bridge0: port 1(bridge_slave_0) entered blocking state [ 137.407647][ T7486] bridge0: port 1(bridge_slave_0) entered forwarding state [ 137.477716][ T36] bridge0: port 2(bridge_slave_1) entered blocking state [ 137.484959][ T36] bridge0: port 2(bridge_slave_1) entered forwarding state [ 137.706842][ T8141] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 137.754071][ T8146] netlink: 'syz.3.558': attribute type 282 has an invalid length. [ 137.777583][ T8141] netlink: 60 bytes leftover after parsing attributes in process `syz.2.557'. [ 137.973889][ T8153] netlink: 8 bytes leftover after parsing attributes in process `syz.3.559'. [ 138.003755][ T8153] FAULT_INJECTION: forcing a failure. [ 138.003755][ T8153] name failslab, interval 1, probability 0, space 0, times 0 [ 138.067531][ T8153] CPU: 1 UID: 0 PID: 8153 Comm: syz.3.559 Not tainted syzkaller #0 PREEMPT(full) [ 138.067562][ T8153] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 138.067572][ T8153] Call Trace: [ 138.067579][ T8153] [ 138.067587][ T8153] dump_stack_lvl+0x189/0x250 [ 138.067612][ T8153] ? __pfx____ratelimit+0x10/0x10 [ 138.067629][ T8153] ? __pfx_dump_stack_lvl+0x10/0x10 [ 138.067647][ T8153] ? __pfx__printk+0x10/0x10 [ 138.067672][ T8153] ? __pfx___might_resched+0x10/0x10 [ 138.067693][ T8153] should_fail_ex+0x414/0x560 [ 138.067720][ T8153] should_failslab+0xa8/0x100 [ 138.067745][ T8153] __kmalloc_node_track_caller_noprof+0xcc/0x4e0 [ 138.067765][ T8153] ? ovs_nla_get_match+0x3b5/0x18c0 [ 138.067782][ T8153] ? __parse_vlan_from_nlattrs+0x1dc/0x12e0 [ 138.067808][ T8153] kmemdup_noprof+0x2b/0x70 [ 138.067839][ T8153] ovs_nla_get_match+0x3b5/0x18c0 [ 138.067856][ T8153] ? ___sys_sendmsg+0x21f/0x2a0 [ 138.067873][ T8153] ? __x64_sys_sendmsg+0x19b/0x260 [ 138.067903][ T8153] ? __pfx_ovs_nla_get_match+0x10/0x10 [ 138.067959][ T8153] ? __asan_memset+0x22/0x50 [ 138.067980][ T8153] ovs_flow_cmd_new+0x324/0xd80 [ 138.068007][ T8153] ? __pfx_ovs_flow_cmd_new+0x10/0x10 [ 138.068086][ T8153] ? __nla_parse+0x40/0x60 [ 138.068112][ T8153] ? genl_family_rcv_msg_attrs_parse+0x1c9/0x2a0 [ 138.068141][ T8153] genl_family_rcv_msg_doit+0x215/0x300 [ 138.068169][ T8153] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 138.068203][ T8153] ? bpf_lsm_capable+0x9/0x20 [ 138.068232][ T8153] ? security_capable+0x7e/0x2e0 [ 138.068261][ T8153] genl_rcv_msg+0x60e/0x790 [ 138.068288][ T8153] ? __pfx_genl_rcv_msg+0x10/0x10 [ 138.068307][ T8153] ? __pfx_ovs_flow_cmd_new+0x10/0x10 [ 138.068326][ T8153] ? __asan_memcpy+0x40/0x70 [ 138.068343][ T8153] ? __pfx_ref_tracker_free+0x10/0x10 [ 138.068373][ T8153] netlink_rcv_skb+0x208/0x470 [ 138.068388][ T8153] ? __lock_acquire+0xab9/0xd20 [ 138.068411][ T8153] ? __pfx_genl_rcv_msg+0x10/0x10 [ 138.068433][ T8153] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 138.068469][ T8153] ? down_read+0x1ad/0x2e0 [ 138.068490][ T8153] genl_rcv+0x28/0x40 [ 138.068507][ T8153] netlink_unicast+0x82c/0x9e0 [ 138.068537][ T8153] ? __pfx_netlink_unicast+0x10/0x10 [ 138.068560][ T8153] ? netlink_sendmsg+0x642/0xb30 [ 138.068574][ T8153] ? skb_put+0x11b/0x210 [ 138.068596][ T8153] netlink_sendmsg+0x805/0xb30 [ 138.068624][ T8153] ? __pfx_netlink_sendmsg+0x10/0x10 [ 138.068644][ T8153] ? aa_sock_msg_perm+0xf1/0x1d0 [ 138.068669][ T8153] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 138.068686][ T8153] ? __pfx_netlink_sendmsg+0x10/0x10 [ 138.068703][ T8153] __sock_sendmsg+0x21c/0x270 [ 138.068735][ T8153] ____sys_sendmsg+0x505/0x830 [ 138.068771][ T8153] ? __pfx_____sys_sendmsg+0x10/0x10 [ 138.068805][ T8153] ? import_iovec+0x74/0xa0 [ 138.068829][ T8153] ___sys_sendmsg+0x21f/0x2a0 [ 138.068851][ T8153] ? __pfx____sys_sendmsg+0x10/0x10 [ 138.068910][ T8153] ? __fget_files+0x2a/0x420 [ 138.068925][ T8153] ? __fget_files+0x3a0/0x420 [ 138.068952][ T8153] __x64_sys_sendmsg+0x19b/0x260 [ 138.068973][ T8153] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 138.069002][ T8153] ? __pfx_ksys_write+0x10/0x10 [ 138.069021][ T8153] ? rcu_is_watching+0x15/0xb0 [ 138.069043][ T8153] ? do_syscall_64+0xbe/0x3b0 [ 138.069064][ T8153] do_syscall_64+0xfa/0x3b0 [ 138.069080][ T8153] ? lockdep_hardirqs_on+0x9c/0x150 [ 138.069097][ T8153] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 138.069113][ T8153] ? clear_bhb_loop+0x60/0xb0 [ 138.069134][ T8153] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 138.069150][ T8153] RIP: 0033:0x7f710df8ebe9 [ 138.069166][ T8153] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 138.069179][ T8153] RSP: 002b:00007f710eddc038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 138.069198][ T8153] RAX: ffffffffffffffda RBX: 00007f710e1c5fa0 RCX: 00007f710df8ebe9 [ 138.069210][ T8153] RDX: 000000000000c010 RSI: 0000200000000040 RDI: 0000000000000003 [ 138.069227][ T8153] RBP: 00007f710eddc090 R08: 0000000000000000 R09: 0000000000000000 [ 138.069237][ T8153] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 138.069247][ T8153] R13: 00007f710e1c6038 R14: 00007f710e1c5fa0 R15: 00007fff00d42a58 [ 138.069278][ T8153] [ 138.874647][ T7779] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 139.214061][ T7782] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 139.235979][ T8171] dvmrp8: left allmulticast mode [ 139.678494][ T8171] syz.2.561 (8171) used greatest stack depth: 17864 bytes left [ 139.824934][ T8195] netlink: 4 bytes leftover after parsing attributes in process `syz.2.565'. [ 139.865130][ T8195] netlink: 'syz.2.565': attribute type 18 has an invalid length. [ 139.871229][ T7779] veth0_vlan: entered promiscuous mode [ 139.900396][ T7779] veth1_vlan: entered promiscuous mode [ 139.943202][ T8195] netlink: 8 bytes leftover after parsing attributes in process `syz.2.565'. [ 139.965609][ T8198] netlink: 'syz.3.566': attribute type 10 has an invalid length. [ 139.972499][ T8195] netlink: 4 bytes leftover after parsing attributes in process `syz.2.565'. [ 140.011949][ T8198] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 140.032671][ T8198] bond0: (slave batadv0): Enslaving as an active interface with an up link [ 140.044736][ T8195] netlink: 8 bytes leftover after parsing attributes in process `syz.2.565'. [ 140.060513][ T8195] netlink: 4 bytes leftover after parsing attributes in process `syz.2.565'. [ 140.205453][ T7782] veth0_vlan: entered promiscuous mode [ 140.244142][ T7779] veth0_macvtap: entered promiscuous mode [ 140.273677][ T7782] veth1_vlan: entered promiscuous mode [ 140.321935][ T7779] veth1_macvtap: entered promiscuous mode [ 140.384909][ T7779] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 140.491686][ T7779] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 140.508856][ T7782] veth0_macvtap: entered promiscuous mode [ 140.548864][ T8203] netlink: 96 bytes leftover after parsing attributes in process `syz.3.568'. [ 140.597395][ T7782] veth1_macvtap: entered promiscuous mode [ 140.616471][ T8213] netlink: 8 bytes leftover after parsing attributes in process `syz.2.570'. [ 140.634685][ T8213] openvswitch: netlink: nsh attribute has 65520 unknown bytes. [ 140.641100][ T1123] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 140.646541][ T8213] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 140.749129][ T1123] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 140.774696][ T1123] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 140.783457][ T1123] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 140.903929][ T8219] netlink: 40 bytes leftover after parsing attributes in process `syz.2.571'. [ 140.970876][ T7782] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 141.052546][ T7782] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 141.238378][ T36] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 141.259084][ T36] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 141.326728][ T36] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 141.356168][ T36] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 141.383785][ T36] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 141.414468][ T36] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 141.661919][ T7486] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 141.677250][ T7486] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 141.713249][ T8236] openvswitch: netlink: nsh attribute has 65520 unknown bytes. [ 141.739904][ T8236] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 141.794596][ T7486] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 141.804147][ T7486] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 142.137515][ T1099] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 142.167437][ T1099] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 142.241947][ T8251] 0ªX¹¦À: renamed from caif0 [ 142.280092][ T8251] 0ªX¹¦À: entered allmulticast mode [ 142.286188][ T8251] A link change request failed with some changes committed already. Interface 60ªX¹¦À may have been left with an inconsistent configuration, please check. [ 142.297784][ T8256] netlink: 'syz.6.585': attribute type 2 has an invalid length. [ 142.416660][ T8256] k›*·]‘: entered promiscuous mode [ 142.457453][ T8264] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 142.562047][ T8268] tipc: Started in network mode [ 142.577705][ T8268] tipc: Node identity 6efa565a1518, cluster identity 4711 [ 142.586153][ T8268] tipc: Enabled bearer , priority 0 [ 142.596938][ T8267] syzkaller0: entered promiscuous mode [ 142.613505][ T8267] syzkaller0: entered allmulticast mode [ 142.658531][ T8267] tipc: Resetting bearer [ 142.762484][ T8267] tipc: Disabling bearer [ 142.979710][ T8277] __nla_validate_parse: 7 callbacks suppressed [ 142.979728][ T8277] netlink: 24 bytes leftover after parsing attributes in process `syz.5.589'. [ 143.028697][ T8277] netlink: 92 bytes leftover after parsing attributes in process `syz.5.589'. [ 143.055487][ T8277] netlink: 24 bytes leftover after parsing attributes in process `syz.5.589'. [ 143.075297][ T8277] netlink: 24 bytes leftover after parsing attributes in process `syz.5.589'. [ 143.116479][ T8280] netlink: 24 bytes leftover after parsing attributes in process `syz.5.589'. [ 143.319410][ T8289] netlink: 8 bytes leftover after parsing attributes in process `syz.1.592'. [ 143.394801][ T8289] openvswitch: netlink: nsh attribute has 65520 unknown bytes. [ 143.408080][ T8289] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 143.956685][ T8305] Bluetooth: MGMT ver 1.23 [ 145.419530][ T8304] batman_adv: batadv0: Adding interface: ip6gretap1 [ 145.426342][ T8304] batman_adv: batadv0: The MTU of interface ip6gretap1 is too small (1434) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 145.452980][ T8304] batman_adv: batadv0: Interface activated: ip6gretap1 [ 145.477804][ T8305] workqueue: Failed to create a rescuer kthread for wq "wg-crypt-wireguard%d": -EINTR [ 145.645167][ T8312] Bluetooth: MGMT ver 1.23 [ 146.024071][ T8332] netlink: 8 bytes leftover after parsing attributes in process `syz.5.605'. [ 146.078058][ T8332] openvswitch: netlink: nsh attribute has 65520 unknown bytes. [ 146.114606][ T8332] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 146.400309][ T8354] ieee802154 phy0 wpan0: encryption failed: -22 [ 146.410830][ T8350] ieee802154 phy0 wpan0: encryption failed: -22 [ 146.525231][ T8360] netlink: 1360 bytes leftover after parsing attributes in process `syz.3.609'. [ 146.594490][ T8360] netlink: 8 bytes leftover after parsing attributes in process `syz.3.609'. [ 147.102501][ T8380] netlink: 'syz.3.615': attribute type 1 has an invalid length. [ 147.133664][ T8380] netlink: 168 bytes leftover after parsing attributes in process `syz.3.615'. [ 147.183571][ T8380] NCSI netlink: No device for ifindex 0 [ 147.243834][ T8382] netlink: 'syz.5.614': attribute type 29 has an invalid length. [ 147.437157][ T8386] batman_adv: batadv0: Adding interface: dummy0 [ 147.443626][ T8386] batman_adv: batadv0: Interface activated: dummy0 [ 147.470988][ T8383] netlink: 'syz.5.614': attribute type 29 has an invalid length. [ 147.556821][ T8390] batman_adv: batadv0: Adding interface: ip6gretap1 [ 147.579372][ T8390] batman_adv: batadv0: The MTU of interface ip6gretap1 is too small (1434) to handle the transport of batman-adv packets. If you experience problems getting traffic through try increasing the MTU to 1500. [ 147.618193][ T8390] batman_adv: batadv0: Interface activated: ip6gretap1 [ 147.666661][ T8382] batadv0: mtu less than device minimum [ 147.713888][ T8382] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (0) [ 147.725873][ T8382] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (0) [ 147.737562][ T8382] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (0) [ 147.749171][ T8382] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (0) [ 147.760782][ T8382] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (0) [ 147.850919][ T8407] netlink: 'syz.3.618': attribute type 4 has an invalid length. [ 147.891392][ T8401] netlink: 'syz.3.618': attribute type 4 has an invalid length. [ 148.030207][ T8401] ieee802154 phy0 wpan0: encryption failed: -22 [ 148.389889][ T8394] mpoa:mpoad_close: () going down [ 149.101234][ T8456] netlink: 5636 bytes leftover after parsing attributes in process `syz.1.631'. [ 149.708359][ T8475] tipc: Cannot configure node identity twice [ 149.741107][ T8475] netlink: 12 bytes leftover after parsing attributes in process `syz.3.638'. [ 149.811484][ T8481] netlink: 8 bytes leftover after parsing attributes in process `syz.2.639'. [ 149.844685][ T8481] net_ratelimit: 14 callbacks suppressed [ 149.844702][ T8481] openvswitch: netlink: nsh attribute has 65520 unknown bytes. [ 149.874503][ T8481] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 150.431271][ T8520] netlink: 228 bytes leftover after parsing attributes in process `syz.5.648'. [ 151.014100][ T5962] IPVS: starting estimator thread 0... [ 151.047453][ T8551] netlink: 16 bytes leftover after parsing attributes in process `syz.1.657'. [ 151.134423][ T8550] IPVS: using max 33 ests per chain, 79200 per kthread [ 151.230115][ T8562] netlink: 12 bytes leftover after parsing attributes in process `syz.2.658'. [ 151.299869][ T8561] tipc: Enabled bearer , priority 0 [ 151.312329][ T8561] syzkaller0: entered promiscuous mode [ 151.326450][ T8561] syzkaller0: entered allmulticast mode [ 151.344066][ T8569] netlink: 12 bytes leftover after parsing attributes in process `syz.6.660'. [ 151.447621][ T8572] netlink: 12 bytes leftover after parsing attributes in process `syz.5.662'. [ 151.582252][ T8581] netlink: 24 bytes leftover after parsing attributes in process `syz.1.663'. [ 151.595805][ T8561] tipc: Resetting bearer [ 151.622012][ T8564] vlan2: entered allmulticast mode [ 151.628549][ T8564] bridge0: entered allmulticast mode [ 151.679987][ T8560] tipc: Resetting bearer [ 151.709329][ T8560] tipc: Disabling bearer [ 151.915516][ T8591] netlink: 28 bytes leftover after parsing attributes in process `syz.3.665'. [ 151.932948][ T8591] ip6tnl0: left promiscuous mode [ 151.950228][ T8591] syz_tun: left promiscuous mode [ 151.999254][ T8591] gretap1: left promiscuous mode [ 152.451515][ T8613] netlink: 'syz.1.674': attribute type 1 has an invalid length. [ 152.471268][ T8613] netlink: 'syz.1.674': attribute type 1 has an invalid length. [ 152.639071][ T8616] nbd: socks must be embedded in a SOCK_ITEM attr [ 152.703240][ T8632] batadv_slave_1: entered promiscuous mode [ 153.164191][ T5873] udevd[5873]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 153.266585][ T8630] batadv_slave_1: left promiscuous mode [ 153.283648][ T8655] netlink: 'syz.6.678': attribute type 1 has an invalid length. [ 153.296146][ T5873] udevd[5873]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 153.503856][ T8663] tc_dump_action: action bad kind [ 154.315178][ T8666] Bluetooth: hci0: Opcode 0x0401 failed: -4 [ 154.332121][ T8695] __nla_validate_parse: 152 callbacks suppressed [ 154.332139][ T8695] netlink: 14 bytes leftover after parsing attributes in process `syz.1.688'. [ 154.801071][ T8718] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 154.808670][ T8718] IPv6: NLM_F_CREATE should be set when creating new route [ 154.825734][ T36] netdevsim netdevsim6 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 154.851293][ T36] netdevsim netdevsim6 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 154.961667][ T8714] syzkaller0: create flow: hash 1288646792 index 1 [ 155.003412][ T8724] netlink: 8 bytes leftover after parsing attributes in process `syz.6.694'. [ 155.044433][ T8724] netlink: 4 bytes leftover after parsing attributes in process `syz.6.694'. [ 155.120107][ T36] netdevsim netdevsim6 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 155.152532][ T36] netdevsim netdevsim6 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 155.226506][ T36] syzkaller0: tun_net_xmit 76 [ 155.239172][ T8730] netlink: 8 bytes leftover after parsing attributes in process `syz.2.695'. [ 155.255684][ T8730] netlink: 8 bytes leftover after parsing attributes in process `syz.2.695'. [ 155.259155][ T6017] syzkaller0: tun_net_xmit 76 [ 155.269408][ T6017] syzkaller0: tun_net_xmit 48 [ 155.295342][ T8730] netlink: 8 bytes leftover after parsing attributes in process `syz.2.695'. [ 155.313098][ T8724] netlink: 8 bytes leftover after parsing attributes in process `syz.6.694'. [ 155.420195][ T8711] syzkaller0: delete flow: hash 1288646792 index 1 [ 155.685652][ T5182] Bluetooth: hci0: command 0x0401 tx timeout [ 156.994213][ T8755] netlink: 64 bytes leftover after parsing attributes in process `syz.5.700'. [ 157.189841][ T8771] tipc: Enabled bearer , priority 0 [ 157.213869][ T8777] netlink: 316 bytes leftover after parsing attributes in process `syz.1.705'. [ 157.217826][ T8771] syzkaller0: entered promiscuous mode [ 157.239636][ T8771] syzkaller0: entered allmulticast mode [ 157.259217][ T8771] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 157.330064][ T8785] tipc: Resetting bearer [ 157.399177][ T8771] tipc: Resetting bearer [ 157.433583][ T8771] tipc: Disabling bearer [ 157.450996][ T8788] bridge0: port 1(veth0_to_team) entered blocking state [ 157.460144][ T8788] bridge0: port 1(veth0_to_team) entered disabled state [ 157.468174][ T8788] veth0_to_team: entered allmulticast mode [ 157.479913][ T8788] veth0_to_team: entered promiscuous mode [ 157.599687][ T8795] netlink: 44 bytes leftover after parsing attributes in process `syz.6.710'. [ 157.718498][ T8795] team0: Port device team_slave_0 removed [ 157.737749][ T8797] batman_adv: batadv0: Adding interface: dummy0 [ 157.759027][ T8797] batman_adv: batadv0: The MTU of interface dummy0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 157.815749][ T8797] batman_adv: batadv0: Interface activated: dummy0 [ 158.343827][ T1099] netdevsim netdevsim5 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 158.368188][ T1099] netdevsim netdevsim5 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 158.390900][ T1099] netdevsim netdevsim5 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 158.400434][ T8830] netlink: 'syz.1.718': attribute type 10 has an invalid length. [ 158.500259][ T1099] netdevsim netdevsim5 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 158.518894][ T8830] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 158.530877][ T8830] Ã: (slave batadv0): Enslaving as an active interface with an up link [ 158.581049][ T8830] netlink: zone id is out of range [ 158.602653][ T8830] netlink: zone id is out of range [ 158.647235][ T8830] netlink: zone id is out of range [ 158.652778][ T8830] netlink: zone id is out of range [ 158.663705][ T8842] openvswitch: netlink: ufid size 18 bytes exceeds the range (1, 16) [ 158.675302][ T8830] netlink: zone id is out of range [ 158.680650][ T8842] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 158.690896][ T8830] netlink: zone id is out of range [ 158.706158][ T8842] netlink: 'syz.5.721': attribute type 12 has an invalid length. [ 158.767814][ T8830] netlink: set zone limit has 4 unknown bytes [ 159.037384][ T8848] netlink: 'syz.1.723': attribute type 2 has an invalid length. [ 159.218661][ T8852] tipc: Enabled bearer , priority 0 [ 159.230459][ T8852] syzkaller0: entered promiscuous mode [ 159.254949][ T8852] syzkaller0: entered allmulticast mode [ 159.326541][ T8862] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 159.359001][ T8857] __nla_validate_parse: 6 callbacks suppressed [ 159.359017][ T8857] netlink: 8 bytes leftover after parsing attributes in process `syz.5.727'. [ 159.477247][ T8849] tipc: Resetting bearer [ 159.510808][ T8849] tipc: Disabling bearer [ 159.566892][ T8868] tipc: Enabled bearer , priority 0 [ 159.627160][ T8868] tipc: Disabling bearer [ 160.064830][ T8880] netlink: 16 bytes leftover after parsing attributes in process `syz.1.733'. [ 160.362442][ T8889] team0: entered promiscuous mode [ 160.367630][ T8889] team_slave_0: entered promiscuous mode [ 160.373892][ T8889] team_slave_1: entered promiscuous mode [ 160.422067][ T8889] netlink: 4 bytes leftover after parsing attributes in process `syz.5.734'. [ 160.463160][ T8897] netlink: 56 bytes leftover after parsing attributes in process `syz.1.735'. [ 160.482077][ T8899] netlink: 'syz.2.736': attribute type 12 has an invalid length. [ 160.683767][ T8889] team0 (unregistering): left promiscuous mode [ 160.692761][ T8889] team_slave_0: left promiscuous mode [ 160.701065][ T8889] team_slave_1: left promiscuous mode [ 160.722819][ T8889] team0 (unregistering): Port device team_slave_0 removed [ 160.770728][ T8889] team0 (unregistering): Port device team_slave_1 removed [ 161.064492][ T8927] netlink: 28 bytes leftover after parsing attributes in process `syz.3.741'. [ 161.500978][ T8948] netlink: 8 bytes leftover after parsing attributes in process `syz.3.749'. [ 162.399694][ T8989] 8021q: VLANs not supported on ip6tnl0 [ 162.693245][ T9005] netlink: 8 bytes leftover after parsing attributes in process `syz.3.763'. [ 162.732865][ T9007] netlink: 'syz.2.765': attribute type 1 has an invalid length. [ 162.754475][ T9007] netlink: 'syz.2.765': attribute type 1 has an invalid length. [ 162.824081][ T9014] netlink: 'syz.2.765': attribute type 1 has an invalid length. [ 163.009350][ T9014] 8021q: adding VLAN 0 to HW filter on device bond2 [ 163.032872][ T9011] netlink: 20 bytes leftover after parsing attributes in process `syz.5.766'. [ 163.034226][ T9017] mac80211_hwsim hwsim3 wlan0: left promiscuous mode [ 163.056806][ T9011] netlink: 12 bytes leftover after parsing attributes in process `syz.5.766'. [ 163.074394][ T9011] netlink: 8 bytes leftover after parsing attributes in process `syz.5.766'. [ 163.092734][ T9017] bond2: (slave wlan0): Enslaving as an active interface with a down link [ 163.110687][ T9026] tipc: Enabled bearer , priority 0 [ 163.119601][ T9020] syzkaller0: entered promiscuous mode [ 163.128800][ T9020] syzkaller0: entered allmulticast mode [ 163.207124][ T9020] tipc: Resetting bearer [ 163.280113][ T9016] tipc: Resetting bearer [ 163.313882][ T9016] tipc: Disabling bearer [ 163.638558][ T9041] : entered promiscuous mode [ 163.694239][ T9047] netlink: 'syz.1.775': attribute type 1 has an invalid length. [ 163.853112][ T9050] rdma_op ffff8880794db1f0 conn xmit_rdma 0000000000000000 [ 163.915586][ T9050] ipvlan2: entered allmulticast mode [ 163.921196][ T9050] netdevsim netdevsim2 netdevsim0: entered allmulticast mode [ 164.216062][ T9076] netlink: 'syz.5.782': attribute type 1 has an invalid length. [ 164.774689][ T9092] tipc: Enabling of bearer rejected, failed to enable media [ 165.062322][ T9107] __nla_validate_parse: 5 callbacks suppressed [ 165.062339][ T9107] netlink: 12 bytes leftover after parsing attributes in process `syz.2.788'. [ 165.289675][ T9111] netlink: 8 bytes leftover after parsing attributes in process `syz.3.789'. [ 165.339689][ T9111] net_ratelimit: 4 callbacks suppressed [ 165.339706][ T9111] openvswitch: netlink: nsh attribute has 65520 unknown bytes. [ 165.398102][ T9111] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 165.677987][ T9118] bridge2: entered promiscuous mode [ 165.680947][ T9121] netlink: 8 bytes leftover after parsing attributes in process `syz.3.791'. [ 165.683231][ T9118] bridge2: entered allmulticast mode [ 165.736299][ T9118] team0: Port device bridge2 added [ 165.943449][ T9130] netlink: 8 bytes leftover after parsing attributes in process `syz.3.793'. [ 166.040373][ T9134] Bluetooth: MGMT ver 1.23 [ 166.872265][ T9168] netlink: 88 bytes leftover after parsing attributes in process `syz.6.799'. [ 166.944771][ T9168] netlink: 16 bytes leftover after parsing attributes in process `syz.6.799'. [ 167.209430][ T9179] netlink: 8 bytes leftover after parsing attributes in process `syz.3.801'. [ 167.295192][ T9179] openvswitch: netlink: nsh attribute has 65520 unknown bytes. [ 167.313546][ T9179] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 167.503751][ T9188] Bluetooth: MGMT ver 1.23 [ 167.554669][ T9188] geneve2: entered promiscuous mode [ 167.583405][ T9188] netlink: 4 bytes leftover after parsing attributes in process `syz.5.804'. [ 168.533854][ T9224] veth0_to_bridge: entered promiscuous mode [ 168.615889][ T9224] veth0_to_bridge: left promiscuous mode [ 168.650854][ T9235] netlink: 16 bytes leftover after parsing attributes in process `syz.5.814'. [ 168.847192][ T9240] netlink: 8 bytes leftover after parsing attributes in process `syz.2.815'. [ 168.884848][ T9240] openvswitch: netlink: nsh attribute has 65520 unknown bytes. [ 168.892465][ T9240] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 169.298557][ T9257] openvswitch: netlink: Invalid MD length 4685 for MD type 0 [ 169.324515][ T9257] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 170.476644][ T9298] ip6tnl0: left allmulticast mode [ 170.798697][ T9298] bridge2: left promiscuous mode [ 170.809580][ T9298] bridge2: left allmulticast mode [ 170.985655][ T9315] __nla_validate_parse: 6 callbacks suppressed [ 170.985679][ T9315] netlink: 96 bytes leftover after parsing attributes in process `syz.2.833'. [ 171.074673][ T1099] netdevsim netdevsim3 eth0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 171.086924][ T1099] netdevsim netdevsim3 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 171.168493][ T1099] netdevsim netdevsim3 eth1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 171.189536][ T1099] netdevsim netdevsim3 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 171.226586][ T9330] netlink: 12 bytes leftover after parsing attributes in process `syz.6.836'. [ 171.274601][ T1099] netdevsim netdevsim3 eth2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 171.306018][ T1099] netdevsim netdevsim3 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 171.479453][ T1099] netdevsim netdevsim3 eth3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 171.496627][ T1099] netdevsim netdevsim3 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 171.568176][ T9339] netlink: 24 bytes leftover after parsing attributes in process `syz.5.840'. [ 171.720823][ T9351] netlink: 8 bytes leftover after parsing attributes in process `syz.2.841'. [ 171.791208][ T9357] netlink: 8 bytes leftover after parsing attributes in process `syz.2.841'. [ 171.910359][ T9351] gretap0: entered promiscuous mode [ 171.954857][ T9348] netlink: 12 bytes leftover after parsing attributes in process `syz.2.841'. [ 171.979067][ T9365] netlink: 20 bytes leftover after parsing attributes in process `syz.3.844'. [ 172.336862][ T9388] netlink: 8 bytes leftover after parsing attributes in process `syz.1.849'. [ 172.431479][ T9396] netlink: 3 bytes leftover after parsing attributes in process `syz.5.850'. [ 172.619553][ T9396] batadv1: entered promiscuous mode [ 172.646514][ T9396] batadv1: entered allmulticast mode [ 173.358952][ T9457] netlink: 8 bytes leftover after parsing attributes in process `syz.5.862'. [ 174.029181][ T9485] tipc: Failed to remove unknown binding: 66,1,1/0:1011799448/1011799450 [ 174.119297][ T9485] tipc: Failed to remove unknown binding: 66,1,1/0:1011799448/1011799450 [ 174.204367][ T9485] tipc: Failed to remove unknown binding: 66,1,1/0:1011799448/1011799450 [ 174.680037][ T9510] netdevsim netdevsim2 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 174.708213][ T9510] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 174.740768][ T9510] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 1] type 2 family 0 port 20000 - 0 [ 174.810401][ T9518] (unnamed net_device) (uninitialized): invalid ARP target 0.0.0.0 specified for addition [ 174.834547][ T9518] (unnamed net_device) (uninitialized): option arp_ip_target: invalid value (0) [ 174.856889][ T9521] v: renamed from ip6_vti0 (while UP) [ 175.107769][ T9510] netdevsim netdevsim2 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 175.127185][ T9510] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 175.165677][ T9510] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 1] type 2 family 0 port 20000 - 0 [ 175.521710][ T9573] netlink: 'syz.1.884': attribute type 64 has an invalid length. [ 175.568603][ T9510] netdevsim netdevsim2 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 175.626124][ T9510] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 175.644737][ T9510] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 1] type 2 family 0 port 20000 - 0 [ 175.968180][ T9510] netdevsim netdevsim2 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 175.998577][ T9510] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 176.032193][ T9510] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 1] type 2 family 0 port 20000 - 0 [ 176.161790][ T9605] openvswitch: netlink: Key type 16144 is out of range max 32 [ 176.365636][ T1123] netdevsim netdevsim2 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 176.385506][ T1123] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 20000 - 0 [ 176.414529][ T1123] netdevsim netdevsim2 eth0: set [1, 1] type 2 family 0 port 6081 - 0 [ 176.459495][ T9612] ip6tnl2: entered promiscuous mode [ 176.474051][ T9612] ip6tnl2: entered allmulticast mode [ 176.504150][ T9612] team0: Device ip6tnl2 is of different type [ 176.618526][ T1123] netdevsim netdevsim2 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 176.629189][ T1123] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 20000 - 0 [ 176.637800][ T1123] netdevsim netdevsim2 eth1: set [1, 1] type 2 family 0 port 6081 - 0 [ 176.646502][ T9624] 8021q: VLANs not supported on caif0 [ 176.653374][ T9622] syzkaller1: entered promiscuous mode [ 176.661669][ T9622] syzkaller1: entered allmulticast mode [ 176.697777][ T1165] netdevsim netdevsim2 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 176.713555][ T1165] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 20000 - 0 [ 176.731158][ T1165] netdevsim netdevsim2 eth2: set [1, 1] type 2 family 0 port 6081 - 0 [ 176.808998][ T12] netdevsim netdevsim2 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 176.826556][ T12] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 20000 - 0 [ 176.847074][ T12] netdevsim netdevsim2 eth3: set [1, 1] type 2 family 0 port 6081 - 0 [ 176.939732][ T9636] __nla_validate_parse: 4 callbacks suppressed [ 176.939748][ T9636] netlink: 32 bytes leftover after parsing attributes in process `syz.5.898'. [ 177.020081][ T9636] netlink: 'syz.5.898': attribute type 32 has an invalid length. [ 177.052923][ T9636] bond0: option coupled_control: mode dependency failed, not supported in mode balance-rr(0) [ 177.212864][ T9655] syzkaller0: create flow: hash 1288646792 index 1 [ 177.248004][ T9661] netlink: 8 bytes leftover after parsing attributes in process `syz.5.905'. [ 177.314768][ T1165] nci: nci_rf_intf_activated_ntf_packet: unsupported activation_rf_tech_and_mode 0x7 [ 177.333686][ T9661] netlink: 452 bytes leftover after parsing attributes in process `syz.5.905'. [ 177.686798][ T9647] syzkaller0: delete flow: hash 1288646792 index 1 [ 179.402111][ T9678] batman_adv: batadv0: Adding interface: dummy0 [ 179.408574][ T9678] batman_adv: batadv0: The MTU of interface dummy0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 179.436011][ T9678] batman_adv: batadv0: Interface activated: dummy0 [ 179.730616][ T9694] netlink: 388 bytes leftover after parsing attributes in process `syz.3.913'. [ 179.848217][ T9705] netlink: 8 bytes leftover after parsing attributes in process `syz.1.917'. [ 179.876201][ T9707] netlink: 8 bytes leftover after parsing attributes in process `syz.5.918'. [ 180.096467][ T9719] netlink: 'syz.5.920': attribute type 1 has an invalid length. [ 180.266173][ T9726] sch_tbf: burst 3298 is lower than device lo mtu (11337746) ! [ 180.569184][ T9740] IPv6: addrconf: prefix option has invalid lifetime [ 180.994051][ T9761] netlink: 12 bytes leftover after parsing attributes in process `syz.3.933'. [ 181.102551][ T9764] netlink: 'syz.5.932': attribute type 1 has an invalid length. [ 181.134485][ T9764] netlink: 228 bytes leftover after parsing attributes in process `syz.5.932'. [ 181.638113][ T9781] netlink: 8 bytes leftover after parsing attributes in process `syz.5.937'. [ 182.286204][ T9805] 8021q: adding VLAN 0 to HW filter on device bond3 [ 182.400661][ T9805] Ã: (slave batadv0): Releasing backup interface [ 182.431081][ T9805] Ã: (slave bond_slave_0): Releasing backup interface [ 182.464980][ T9805] Ã: (slave bond_slave_1): Releasing backup interface [ 182.480705][ T9805] veth0_to_team: left allmulticast mode [ 182.488688][ T9805] veth0_to_team: left promiscuous mode [ 182.497412][ T9805] bridge0: port 1(veth0_to_team) entered disabled state [ 182.534923][ T9805] team0: Port device team_slave_0 removed [ 182.574187][ T9805] team0: Port device team_slave_1 removed [ 182.583088][ T9805] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 182.591359][ T9805] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 182.603640][ T9805] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 182.611328][ T9805] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 182.662414][ T9805] batman_adv: batadv0: Interface deactivated: ip6gretap1 [ 182.690124][ T9805] batman_adv: batadv0: Removing interface: ip6gretap1 [ 183.116019][ T9853] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 183.230865][ T9858] IPv6: NLM_F_CREATE should be specified when creating new route [ 185.126378][ T5182] Bluetooth: hci0: command 0x0401 tx timeout [ 185.474936][ T9872] netlink: 'syz.1.962': attribute type 1 has an invalid length. [ 185.550732][ T9875] netlink: 8 bytes leftover after parsing attributes in process `syz.1.962'. [ 185.652371][ T9879] netlink: 'syz.3.963': attribute type 13 has an invalid length. [ 185.684831][ T9879] netlink: 'syz.3.963': attribute type 17 has an invalid length. [ 185.705693][ T9872] bond4: entered promiscuous mode [ 185.711162][ T9872] 8021q: adding VLAN 0 to HW filter on device bond4 [ 185.740355][ T9881] netlink: 'syz.5.965': attribute type 10 has an invalid length. [ 185.761656][ T9881] netlink: 40 bytes leftover after parsing attributes in process `syz.5.965'. [ 185.850355][ T9879] 8021q: adding VLAN 0 to HW filter on device bond0 [ 185.865231][ T9879] 8021q: adding VLAN 0 to HW filter on device team0 [ 185.880129][ T9879] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 185.902001][ T9881] A link change request failed with some changes committed already. Interface geneve0 may have been left with an inconsistent configuration, please check. [ 185.951119][ T9889] netlink: 788 bytes leftover after parsing attributes in process `syz.2.966'. [ 186.094110][ T9896] netlink: 24 bytes leftover after parsing attributes in process `syz.1.968'. [ 186.118826][ T9901] FAULT_INJECTION: forcing a failure. [ 186.118826][ T9901] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 186.147780][ T9901] CPU: 1 UID: 0 PID: 9901 Comm: syz.3.970 Not tainted syzkaller #0 PREEMPT(full) [ 186.147821][ T9901] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 186.147842][ T9901] Call Trace: [ 186.147856][ T9901] [ 186.147870][ T9901] dump_stack_lvl+0x189/0x250 [ 186.147912][ T9901] ? __pfx____ratelimit+0x10/0x10 [ 186.147928][ T9901] ? __pfx_dump_stack_lvl+0x10/0x10 [ 186.147945][ T9901] ? __pfx__printk+0x10/0x10 [ 186.147972][ T9901] should_fail_ex+0x414/0x560 [ 186.147993][ T9901] _copy_to_user+0x31/0xb0 [ 186.148011][ T9901] simple_read_from_buffer+0xe1/0x170 [ 186.148034][ T9901] proc_fail_nth_read+0x1b3/0x220 [ 186.148053][ T9901] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 186.148069][ T9901] ? rw_verify_area+0x2a6/0x4d0 [ 186.148084][ T9901] ? __lock_acquire+0xab9/0xd20 [ 186.148100][ T9901] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 186.148116][ T9901] vfs_read+0x1fd/0xa30 [ 186.148131][ T9901] ? fdget_pos+0x247/0x320 [ 186.148146][ T9901] ? __pfx___mutex_lock+0x10/0x10 [ 186.148160][ T9901] ? __pfx_vfs_read+0x10/0x10 [ 186.148177][ T9901] ? __fget_files+0x2a/0x420 [ 186.148192][ T9901] ? __fget_files+0x3a0/0x420 [ 186.148202][ T9901] ? __fget_files+0x2a/0x420 [ 186.148220][ T9901] ksys_read+0x145/0x250 [ 186.148238][ T9901] ? __pfx_ksys_read+0x10/0x10 [ 186.148251][ T9901] ? rcu_is_watching+0x15/0xb0 [ 186.148268][ T9901] ? do_syscall_64+0xbe/0x3b0 [ 186.148285][ T9901] do_syscall_64+0xfa/0x3b0 [ 186.148297][ T9901] ? lockdep_hardirqs_on+0x9c/0x150 [ 186.148310][ T9901] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 186.148322][ T9901] ? clear_bhb_loop+0x60/0xb0 [ 186.148338][ T9901] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 186.148365][ T9901] RIP: 0033:0x7f710df8d5fc [ 186.148378][ T9901] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 186.148391][ T9901] RSP: 002b:00007f710eddc030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 186.148405][ T9901] RAX: ffffffffffffffda RBX: 00007f710e1c5fa0 RCX: 00007f710df8d5fc [ 186.148415][ T9901] RDX: 000000000000000f RSI: 00007f710eddc0a0 RDI: 0000000000000004 [ 186.148423][ T9901] RBP: 00007f710eddc090 R08: 0000000000000000 R09: 0000000000000000 [ 186.148431][ T9901] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 186.148438][ T9901] R13: 00007f710e1c6038 R14: 00007f710e1c5fa0 R15: 00007fff00d42a58 [ 186.148460][ T9901] [ 186.634254][ T9910] netlink: 20 bytes leftover after parsing attributes in process `syz.3.974'. [ 186.690697][ T9919] netlink: 32 bytes leftover after parsing attributes in process `syz.2.975'. [ 186.832208][ T9925] netlink: 256 bytes leftover after parsing attributes in process `syz.6.976'. [ 186.848624][ T9925] netlink: 48 bytes leftover after parsing attributes in process `syz.6.976'. [ 186.920957][ T9923] netlink: 256 bytes leftover after parsing attributes in process `syz.6.976'. [ 186.943035][ T9923] netlink: 48 bytes leftover after parsing attributes in process `syz.6.976'. [ 187.128233][ T9923] lo speed is unknown, defaulting to 1000 [ 187.128535][ T9925] rdma_rxe: rxe_newlink: failed to add lo [ 187.216365][ T9923] lo speed is unknown, defaulting to 1000 [ 187.315670][ T9923] lo speed is unknown, defaulting to 1000 [ 187.910960][ T9923] infiniband syz0: set active [ 187.916233][ T5962] lo speed is unknown, defaulting to 1000 [ 187.922395][ T9923] infiniband syz0: added lo [ 187.937498][ T9923] syz0: rxe_create_cq: returned err = -12 [ 187.955851][ T9923] infiniband syz0: Couldn't create ib_mad CQ [ 187.981398][ T9923] infiniband syz0: Couldn't open port 1 [ 188.038478][ T9963] netlink: 'syz.1.985': attribute type 1 has an invalid length. [ 188.097959][ T9971] bond5: entered promiscuous mode [ 188.108309][ T9923] RDS/IB: syz0: added [ 188.113348][ T9923] smc: adding ib device syz0 with port count 1 [ 188.119455][ T9971] bond5: entered allmulticast mode [ 188.120393][ T9923] smc: ib device syz0 port 1 has pnetid [ 188.136955][ T9971] 8021q: adding VLAN 0 to HW filter on device bond5 [ 188.147268][ T5962] lo speed is unknown, defaulting to 1000 [ 188.164830][ T9923] lo speed is unknown, defaulting to 1000 [ 188.290737][ T9977] netlink: 'syz.1.988': attribute type 2 has an invalid length. [ 188.675625][ T9990] netlink: 'syz.5.992': attribute type 5 has an invalid length. [ 188.842845][ T9923] lo speed is unknown, defaulting to 1000 [ 189.063166][ T9996] tipc: Enabled bearer , priority 0 [ 189.113333][ T9996] syzkaller0: entered promiscuous mode [ 189.132921][ T9996] syzkaller0: entered allmulticast mode [ 189.245530][ T9996] tipc: Resetting bearer [ 189.272540][ T9995] tipc: Resetting bearer [ 189.332531][ T9995] tipc: Disabling bearer [ 189.600231][ T9923] lo speed is unknown, defaulting to 1000 [ 189.756383][T10011] ip6tnl2: entered promiscuous mode [ 189.979953][T10020] tipc: Enabled bearer , priority 0 [ 190.003186][T10020] syzkaller0: entered promiscuous mode [ 190.028468][T10020] syzkaller0: entered allmulticast mode [ 190.095401][T10020] tipc: Resetting bearer [ 190.113982][T10018] tipc: Resetting bearer [ 190.157866][T10018] tipc: Disabling bearer [ 190.307032][ T9923] lo speed is unknown, defaulting to 1000 [ 190.418893][T10039] netlink: 'syz.5.1008': attribute type 1 has an invalid length. [ 190.482703][T10039] tipc: Started in network mode [ 190.498345][T10039] tipc: Node identity 6ec2b19b2f26, cluster identity 4711 [ 190.506184][T10039] tipc: Enabled bearer , priority 0 [ 190.520172][T10043] netlink: 'syz.2.1009': attribute type 10 has an invalid length. [ 190.536378][T10043] bond0: (slave wlan1): Enslaving as an active interface with an up link [ 190.557576][T10039] syzkaller0: entered promiscuous mode [ 190.563088][T10039] syzkaller0: entered allmulticast mode [ 190.630942][T10039] tipc: Resetting bearer [ 190.659995][T10039] netlink: 'syz.5.1008': attribute type 1 has an invalid length. [ 190.704554][T10038] tipc: Resetting bearer [ 190.815104][T10038] tipc: Disabling bearer [ 190.905596][T10055] __nla_validate_parse: 8 callbacks suppressed [ 190.905612][T10055] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1011'. [ 190.960546][T10055] bridge_slave_1: left allmulticast mode [ 190.966668][T10055] bridge_slave_1: left promiscuous mode [ 190.982630][T10055] bridge0: port 2(bridge_slave_1) entered disabled state [ 191.091321][T10055] bridge_slave_0: left allmulticast mode [ 191.154640][T10055] bridge_slave_0: left promiscuous mode [ 191.185115][T10055] bridge0: port 1(bridge_slave_0) entered disabled state [ 191.267868][T10063] netlink: 148 bytes leftover after parsing attributes in process `syz.3.1014'. [ 191.305601][ T9923] lo speed is unknown, defaulting to 1000 [ 191.474072][T10067] tipc: Enabled bearer , priority 0 [ 191.483048][T10067] syzkaller0: entered promiscuous mode [ 191.499607][T10067] syzkaller0: entered allmulticast mode [ 191.587624][T10073] (unnamed net_device) (uninitialized): (slave bond_slave_1): Device is not our slave [ 191.614874][T10073] (unnamed net_device) (uninitialized): option active_slave: invalid value (bond_slave_1) [ 191.646804][T10067] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 191.818586][T10069] tipc: Resetting bearer [ 191.879209][T10082] netlink: 32 bytes leftover after parsing attributes in process `syz.5.1019'. [ 191.901774][T10082] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1019'. [ 191.920220][T10082] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1019'. [ 191.950685][T10082] netlink: 'syz.5.1019': attribute type 14 has an invalid length. [ 191.961702][T10069] tipc: Resetting bearer [ 191.962119][T10082] netlink: 'syz.5.1019': attribute type 13 has an invalid length. [ 191.995791][T10069] tipc: Disabling bearer [ 192.093819][ T9923] lo speed is unknown, defaulting to 1000 [ 192.148665][T10086] gretap0: left promiscuous mode [ 192.221447][ T1123] nci: nci_rf_discover_ntf_packet: unsupported rf_tech_and_mode 0x9 [ 193.380939][T10086] bond1: left promiscuous mode [ 193.413012][T10086] bond4: left promiscuous mode [ 193.429027][T10086] bond5: left promiscuous mode [ 193.433948][T10086] bond5: left allmulticast mode [ 193.440916][T10086] ip6tnl2: left promiscuous mode [ 193.462211][T10098] syzkaller0: entered promiscuous mode [ 193.468145][T10098] syzkaller0: entered allmulticast mode [ 193.479120][T10079] lo speed is unknown, defaulting to 1000 [ 193.486003][ T56] netdevsim netdevsim1 eth0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 193.516375][ T56] netdevsim netdevsim1 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 193.560750][ T56] netdevsim netdevsim1 eth1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 193.589596][ T56] netdevsim netdevsim1 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 193.611116][ T56] netdevsim netdevsim1 eth2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 193.622407][ T56] netdevsim netdevsim1 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 193.763456][T10133] openvswitch: netlink: ct_state flags 0000ee01 unsupported [ 193.796042][ T56] netdevsim netdevsim1 eth3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 193.812075][ T56] netdevsim netdevsim1 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 193.903009][T10138] tipc: Can't bind to reserved service type 1 [ 194.003549][T10142] netlink: 68 bytes leftover after parsing attributes in process `syz.1.1033'. [ 194.074117][T10144] netlink: 1284 bytes leftover after parsing attributes in process `syz.3.1035'. [ 194.173756][T10146] netlink: 96 bytes leftover after parsing attributes in process `syz.3.1036'. [ 194.197965][T10110] lo speed is unknown, defaulting to 1000 [ 194.199977][T10146] netlink: 'syz.3.1036': attribute type 10 has an invalid length. [ 194.240428][T10146] 8021q: adding VLAN 0 to HW filter on device team0 [ 194.255344][T10146] bond0: (slave team0): Enslaving as an active interface with an up link [ 194.331612][ T1302] ieee802154 phy0 wpan0: encryption failed: -22 [ 194.874217][T10165] netdevsim netdevsim2 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 194.901571][T10165] netdevsim netdevsim2 eth3 (unregistering): unset [1, 0] type 2 family 0 port 20000 - 0 [ 194.932624][T10165] netdevsim netdevsim2 eth3 (unregistering): unset [1, 1] type 2 family 0 port 6081 - 0 [ 194.982003][T10176] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1045'. [ 195.273889][T10165] netdevsim netdevsim2 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 195.286118][T10165] netdevsim netdevsim2 eth2 (unregistering): unset [1, 0] type 2 family 0 port 20000 - 0 [ 195.296370][T10165] netdevsim netdevsim2 eth2 (unregistering): unset [1, 1] type 2 family 0 port 6081 - 0 [ 195.402559][T10182] lo speed is unknown, defaulting to 1000 [ 195.425033][T10165] netdevsim netdevsim2 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 195.446838][T10165] netdevsim netdevsim2 eth1 (unregistering): unset [1, 0] type 2 family 0 port 20000 - 0 [ 195.467137][T10165] netdevsim netdevsim2 eth1 (unregistering): unset [1, 1] type 2 family 0 port 6081 - 0 [ 195.559432][T10199] netlink: 20 bytes leftover after parsing attributes in process `syz.5.1047'. [ 195.595088][T10198] openvswitch: netlink: ct_state flags 0000ee01 unsupported [ 195.625955][T10165] netdevsim netdevsim2 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 195.638097][T10165] netdevsim netdevsim2 eth0 (unregistering): unset [1, 0] type 2 family 0 port 20000 - 0 [ 195.648670][T10165] netdevsim netdevsim2 eth0 (unregistering): unset [1, 1] type 2 family 0 port 6081 - 0 [ 195.999809][ T1165] netdevsim netdevsim2 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 196.023886][ T1165] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 20000 - 0 [ 196.041894][ T1165] netdevsim netdevsim2 eth0: set [1, 1] type 2 family 0 port 6081 - 0 [ 196.088410][T10213] __nla_validate_parse: 1 callbacks suppressed [ 196.088425][T10213] netlink: 32 bytes leftover after parsing attributes in process `syz.5.1049'. [ 196.118296][T10213] netlink: 32 bytes leftover after parsing attributes in process `syz.5.1049'. [ 196.150852][ T1165] netdevsim netdevsim2 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 196.181076][ T1165] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 20000 - 0 [ 196.195693][ T1165] netdevsim netdevsim2 eth1: set [1, 1] type 2 family 0 port 6081 - 0 [ 196.293592][T10210] syzkaller1: entered promiscuous mode [ 196.304484][T10210] syzkaller1: entered allmulticast mode [ 196.323657][ T1165] netdevsim netdevsim2 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 196.340464][ T1165] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 20000 - 0 [ 196.351306][ T1165] netdevsim netdevsim2 eth2: set [1, 1] type 2 family 0 port 6081 - 0 [ 196.407708][ T5863] Bluetooth: hci3: command 0x0406 tx timeout [ 196.413928][ T5863] Bluetooth: hci2: command 0x0406 tx timeout [ 196.420604][ T5863] Bluetooth: hci1: command 0x0406 tx timeout [ 196.454676][ T49] netdevsim netdevsim2 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 196.463861][ T49] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 20000 - 0 [ 196.473286][ T49] netdevsim netdevsim2 eth3: set [1, 1] type 2 family 0 port 6081 - 0 [ 196.680547][ T5527] 8021q: adding VLAN 0 to HW filter on device bond1 [ 196.841389][T10240] netlink: 'syz.2.1053': attribute type 5 has an invalid length. [ 196.844478][T10244] netlink: 'syz.6.1055': attribute type 6 has an invalid length. [ 197.178419][T10260] netlink: 'syz.3.1057': attribute type 10 has an invalid length. [ 197.204761][T10251] tipc: Enabled bearer , priority 0 [ 197.342085][T10251] syzkaller0: entered promiscuous mode [ 197.370213][T10251] syzkaller0: entered allmulticast mode [ 197.395287][T10251] tipc: Resetting bearer [ 197.514786][T10250] tipc: Resetting bearer [ 197.641779][T10277] netlink: 'syz.5.1061': attribute type 7 has an invalid length. [ 197.753777][T10281] netlink: 12 bytes leftover after parsing attributes in process `syz.6.1060'. [ 197.819016][T10275] netlink: 8 bytes leftover after parsing attributes in process `syz.6.1060'. [ 197.830708][T10275] netlink: 24 bytes leftover after parsing attributes in process `syz.6.1060'. [ 198.269355][ T5927] tipc: Node number set to 3443946776 [ 199.245879][T10250] tipc: Disabling bearer [ 199.267200][T10277] : entered promiscuous mode [ 199.564503][T10299] netlink: 'syz.1.1066': attribute type 29 has an invalid length. [ 199.631053][T10307] netlink: 76 bytes leftover after parsing attributes in process `syz.2.1067'. [ 199.747911][T10310] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1068'. [ 199.808880][ T30] audit: type=1800 audit(1756620297.499:4): pid=10314 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.1067" name="memory.events" dev="tmpfs" ino=1145 res=0 errno=0 [ 200.492947][T10341] lo speed is unknown, defaulting to 1000 [ 201.396098][T10373] netlink: 'syz.6.1083': attribute type 1 has an invalid length. [ 201.431352][T10373] netlink: 224 bytes leftover after parsing attributes in process `syz.6.1083'. [ 201.733698][T10380] netlink: 24 bytes leftover after parsing attributes in process `syz.6.1085'. [ 201.920327][T10380] bond1: entered promiscuous mode [ 201.942250][T10380] 8021q: adding VLAN 0 to HW filter on device bond1 [ 202.249885][T10404] netlink: 'syz.5.1088': attribute type 12 has an invalid length. [ 202.266666][T10404] netlink: 9472 bytes leftover after parsing attributes in process `syz.5.1088'. [ 202.307025][T10380] bond1 (unregistering): Released all slaves [ 202.343406][T10403] (unnamed net_device) (uninitialized): Unable to set down delay as MII monitoring is disabled [ 202.533634][T10406] tipc: Enabled bearer , priority 0 [ 202.590181][T10406] syz_tun: entered promiscuous mode [ 202.654828][T10406] tipc: Resetting bearer [ 202.803757][T10405] tipc: Disabling bearer [ 203.077421][T10429] bond0: (slave ipvlan2): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 203.118783][T10429] bond0: (slave ipvlan2): The slave device specified does not support setting the MAC address [ 203.150098][T10429] bond0: (slave ipvlan2): Error -95 calling set_mac_address [ 204.914859][T10501] netlink: 9 bytes leftover after parsing attributes in process `syz.3.1117'. [ 204.961005][T10501] ..0·: renamed from hsr0 [ 205.006301][T10501] ..0·: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 205.064537][T10501] ..0·: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 205.086816][T10501] ..0·: entered allmulticast mode [ 205.151911][T10501] hsr_slave_0: entered allmulticast mode [ 205.182215][T10501] hsr_slave_1: entered allmulticast mode [ 205.219945][T10501] A link change request failed with some changes committed already. Interface ..0· may have been left with an inconsistent configuration, please check. [ 205.268080][T10510] tipc: Enabling of bearer rejected, failed to enable media [ 205.299219][T10516] dummy0: entered promiscuous mode [ 205.319677][T10516] vlan2: entered promiscuous mode [ 205.900722][T10538] netlink: 'syz.1.1126': attribute type 23 has an invalid length. [ 205.948394][T10542] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1128'. [ 205.982707][T10545] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1128'. [ 206.085212][T10549] tipc: Enabled bearer , priority 0 [ 206.416368][T10567] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1134'. [ 206.471055][T10570] netlink: 'syz.1.1135': attribute type 1 has an invalid length. [ 206.511423][T10574] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1135'. [ 206.530487][T10574] A link change request failed with some changes committed already. Interface geneve0 may have been left with an inconsistent configuration, please check. [ 206.547893][T10574] A link change request failed with some changes committed already. Interface geneve0 may have been left with an inconsistent configuration, please check. [ 206.566910][T10570] bond0: (slave rose0): Error: Device can not be enslaved while up [ 206.579937][T10570] bond0: (slave rose0): Error: Device can not be enslaved while up [ 206.589164][T10574] A link change request failed with some changes committed already. Interface geneve0 may have been left with an inconsistent configuration, please check. [ 206.592302][T10576] netlink: 'syz.5.1137': attribute type 1 has an invalid length. [ 206.612702][T10574] A link change request failed with some changes committed already. Interface geneve0 may have been left with an inconsistent configuration, please check. [ 206.629201][T10570] bond0: (slave rose0): Error: Device can not be enslaved while up [ 206.657551][T10574] A link change request failed with some changes committed already. Interface geneve0 may have been left with an inconsistent configuration, please check. [ 206.675492][T10574] A link change request failed with some changes committed already. Interface geneve0 may have been left with an inconsistent configuration, please check. [ 206.692231][T10570] bond0: (slave rose0): Error: Device can not be enslaved while up [ 206.717240][T10578] bond1: (slave bridge1): making interface the new active one [ 206.728171][T10578] bond1: (slave bridge1): Enslaving as an active interface with an up link [ 206.739450][T10534] tipc: Resetting bearer [ 206.768868][T10534] tipc: Disabling bearer [ 206.783747][T10574] A link change request failed with some changes committed already. Interface geneve0 may have been left with an inconsistent configuration, please check. [ 206.847368][T10574] A link change request failed with some changes committed already. Interface geneve0 may have been left with an inconsistent configuration, please check. [ 206.866430][T10582] netlink: 248 bytes leftover after parsing attributes in process `syz.5.1138'. [ 206.897867][T10570] bond0: (slave rose0): Error: Device can not be enslaved while up [ 206.934788][T10570] bond0: (slave rose0): Error: Device can not be enslaved while up [ 206.978253][T10570] bond0: (slave rose0): Error: Device can not be enslaved while up [ 207.020246][T10574] A link change request failed with some changes committed already. Interface geneve0 may have been left with an inconsistent configuration, please check. [ 207.042834][T10570] bond0: (slave rose0): Error: Device can not be enslaved while up [ 207.065657][T10570] bond0: (slave rose0): Error: Device can not be enslaved while up [ 207.096025][T10570] bond0: (slave rose0): Error: Device can not be enslaved while up [ 207.112703][T10570] bond0: (slave rose0): Error: Device can not be enslaved while up [ 207.123435][T10570] bond0: (slave rose0): Error: Device can not be enslaved while up [ 207.132628][T10570] bond0: (slave rose0): Error: Device can not be enslaved while up [ 207.143760][T10570] bond0: (slave rose0): Error: Device can not be enslaved while up [ 207.152616][T10570] bond0: (slave rose0): Error: Device can not be enslaved while up [ 207.165921][T10570] bond0: (slave rose0): Error: Device can not be enslaved while up [ 207.189997][T10570] bond0: (slave rose0): Error: Device can not be enslaved while up [ 207.198792][T10570] bond0: (slave rose0): Error: Device can not be enslaved while up [ 207.225327][T10570] bond0: (slave rose0): Error: Device can not be enslaved while up [ 207.273989][T10570] bond0: (slave rose0): Error: Device can not be enslaved while up [ 207.280433][T10600] netlink: 'syz.5.1144': attribute type 16 has an invalid length. [ 207.285494][T10570] bond0: (slave rose0): Error: Device can not be enslaved while up [ 207.299863][T10600] netlink: 'syz.5.1144': attribute type 3 has an invalid length. [ 207.309843][T10600] netlink: 64066 bytes leftover after parsing attributes in process `syz.5.1144'. [ 207.320262][T10570] bond0: (slave rose0): Error: Device can not be enslaved while up [ 207.398480][T10601] can: request_module (can-proto-0) failed. [ 207.537529][T10610] netlink: 516 bytes leftover after parsing attributes in process `syz.1.1146'. [ 207.739616][T10622] tipc: Enabling of bearer rejected, failed to enable media [ 207.801140][T10622] tipc: Enabling of bearer rejected, failed to enable media [ 208.441538][T10668] xt_time: invalid argument - start or stop time greater than 23:59:59 [ 208.542106][T10671] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 208.549411][T10671] IPv6: NLM_F_CREATE should be set when creating new route [ 208.556772][T10671] IPv6: NLM_F_CREATE should be set when creating new route [ 208.563995][T10671] IPv6: NLM_F_CREATE should be set when creating new route [ 208.668479][T10671] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 208.706289][T10676] netlink: 400 bytes leftover after parsing attributes in process `syz.1.1160'. [ 208.720383][T10671] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 208.821952][T10685] netlink: 400 bytes leftover after parsing attributes in process `syz.1.1160'. [ 208.951048][T10685] netlink: 'syz.1.1160': attribute type 8 has an invalid length. [ 209.065406][T10696] netlink: 76 bytes leftover after parsing attributes in process `syz.3.1164'. [ 209.103914][T10696] netlink: 464 bytes leftover after parsing attributes in process `syz.3.1164'. [ 209.224884][T10704] netlink: 'syz.2.1168': attribute type 3 has an invalid length. [ 209.244087][T10705] netlink: 'syz.2.1168': attribute type 3 has an invalid length. [ 209.269535][T10704] netlink: 'syz.2.1168': attribute type 3 has an invalid length. [ 209.296881][T10704] netlink: 'syz.2.1168': attribute type 3 has an invalid length. [ 209.393511][T10711] netlink: 14 bytes leftover after parsing attributes in process `syz.5.1170'. [ 209.440464][T10714] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1171'. [ 209.487179][T10711] hsr_slave_0: left promiscuous mode [ 209.565559][T10711] hsr_slave_1: left promiscuous mode [ 209.876295][T10722] syzkaller1: entered promiscuous mode [ 209.882039][T10722] syzkaller1: entered allmulticast mode [ 210.707119][T10772] hsr0: A HSR master's MTU cannot be greater than the smallest MTU of its slaves minus the HSR Tag length (6 octets). [ 210.720828][T10777] lo speed is unknown, defaulting to 1000 [ 210.736698][T10781] net_ratelimit: 50 callbacks suppressed [ 210.736715][T10781] openvswitch: netlink: nsh attribute has 65520 unknown bytes. [ 210.750746][T10781] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 210.993498][T10783] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci4/hci4:200/input5 [ 211.565575][T10798] validate_nla: 47 callbacks suppressed [ 211.565593][T10798] netlink: 'syz.5.1193': attribute type 1 has an invalid length. [ 211.596265][T10798] netlink: 'syz.5.1193': attribute type 2 has an invalid length. [ 213.026354][T10821] __nla_validate_parse: 4 callbacks suppressed [ 213.026374][T10821] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1196'. [ 213.060261][T10821] netlink: 44 bytes leftover after parsing attributes in process `syz.2.1196'. [ 215.065261][T10844] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1201'. [ 215.102840][T10844] netlink: 52 bytes leftover after parsing attributes in process `syz.5.1201'. [ 215.352886][T10854] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1204'. [ 215.383674][T10854] bond_slave_0: entered promiscuous mode [ 215.389811][T10854] bond_slave_1: entered promiscuous mode [ 215.434177][T10854] macvlan3: entered promiscuous mode [ 215.444120][T10854] bond0: entered promiscuous mode [ 215.455556][T10854] 8021q: adding VLAN 0 to HW filter on device macvlan3 [ 215.482103][T10860] netlink: 212376 bytes leftover after parsing attributes in process `syz.3.1206'. [ 215.681069][ T5914] IPVS: starting estimator thread 0... [ 215.774509][T10870] IPVS: using max 32 ests per chain, 76800 per kthread [ 215.810245][T10869] bridge0: port 2(bridge_slave_1) entered disabled state [ 215.818069][T10869] bridge0: port 1(bridge_slave_0) entered disabled state [ 215.828499][T10872] netlink: 'syz.3.1209': attribute type 83 has an invalid length. [ 215.862474][T10869] batman_adv: batadv0: Interface deactivated: dummy0 [ 215.881512][T10877] netlink: 4 bytes leftover after parsing attributes in process `syz.6.1208'. [ 215.947129][T10869] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 215.966552][T10869] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 216.086897][ T983] lo speed is unknown, defaulting to 1000 [ 216.092676][ T983] syz0: Port: 1 Link DOWN [ 216.110093][ T5914] lo speed is unknown, defaulting to 1000 [ 216.161860][T10877] hsr_slave_0: left promiscuous mode [ 216.171507][T10877] hsr_slave_1: left promiscuous mode [ 216.213125][ T56] netdevsim netdevsim6 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 216.228156][ T56] netdevsim netdevsim6 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 216.243598][ T56] netdevsim netdevsim6 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 216.253237][ T56] netdevsim netdevsim6 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 216.288270][T10868] lo speed is unknown, defaulting to 1000 [ 216.301246][ T56] netdevsim netdevsim6 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 216.414998][ T56] netdevsim netdevsim6 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 216.435297][ T56] netdevsim netdevsim6 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 216.444196][ T56] netdevsim netdevsim6 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 216.973786][T10907] netlink: 248 bytes leftover after parsing attributes in process `syz.2.1217'. [ 217.132496][T10910] lo speed is unknown, defaulting to 1000 [ 217.802992][T10926] tipc: Enabled bearer , priority 0 [ 217.854031][T10926] syzkaller0: entered promiscuous mode [ 217.876637][T10926] syzkaller0: entered allmulticast mode [ 217.911061][T10926] tipc: Resetting bearer [ 217.939940][T10926] tipc: Enabling of bearer rejected, already enabled [ 218.343293][T10946] netlink: 32 bytes leftover after parsing attributes in process `syz.3.1225'. [ 218.677609][T10962] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1229'. [ 218.702710][T10962] openvswitch: netlink: nsh attribute has 65520 unknown bytes. [ 218.730552][T10962] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 218.894689][ T5914] tipc: Node number set to 1105506715 [ 218.997881][T10977] vlan0: entered promiscuous mode [ 219.503383][T10993] lo speed is unknown, defaulting to 1000 [ 219.648588][T10988] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1235'. [ 220.034711][T11019] netdevsim netdevsim5 netdevsim0: entered promiscuous mode [ 220.096340][T11028] netlink: 8 bytes leftover after parsing attributes in process `syz.6.1243'. [ 220.110490][T11019] macvlan4: entered allmulticast mode [ 220.117513][T11019] netdevsim netdevsim5 netdevsim0: entered allmulticast mode [ 220.125983][T11028] openvswitch: netlink: nsh attribute has 65520 unknown bytes. [ 220.137433][T11028] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 220.148077][T11019] netdevsim netdevsim5 netdevsim0: left allmulticast mode [ 220.160380][T11019] netdevsim netdevsim5 netdevsim0: left promiscuous mode [ 220.425751][T11031] tipc: Enabled bearer , priority 0 [ 220.451346][T11031] syzkaller0: entered promiscuous mode [ 220.461548][T11031] syzkaller0: entered allmulticast mode [ 220.540628][T11031] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 220.550153][T10988] lo speed is unknown, defaulting to 1000 [ 220.657435][T11034] tipc: Resetting bearer [ 220.728030][T11031] tipc: Resetting bearer [ 220.768267][T11031] tipc: Disabling bearer [ 221.273646][T11058] netlink: 'syz.5.1251': attribute type 83 has an invalid length. [ 221.312974][T11062] netlink: 112 bytes leftover after parsing attributes in process `syz.2.1252'. [ 221.513766][T11066] netlink: 8 bytes leftover after parsing attributes in process `syz.6.1254'. [ 221.554693][T11066] openvswitch: netlink: nsh attribute has 65520 unknown bytes. [ 221.581747][T11066] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 221.671873][T11068] tipc: Enabled bearer , priority 0 [ 221.876150][T11068] syzkaller0: entered promiscuous mode [ 221.881668][T11068] syzkaller0: entered allmulticast mode [ 221.887996][T11079] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 221.907585][T11075] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 222.059057][T11068] tipc: Resetting bearer [ 222.135248][T11072] tipc: Resetting bearer [ 222.271279][T11072] tipc: Disabling bearer [ 222.330752][T11086] tipc: Enabled bearer , priority 0 [ 222.349202][T11088] syzkaller0: entered promiscuous mode [ 222.368476][T11088] syzkaller0: entered allmulticast mode [ 222.437464][T11084] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 222.495141][T11084] tipc: Resetting bearer [ 222.514833][T11097] netlink: 'syz.2.1263': attribute type 2 has an invalid length. [ 222.586677][T11090] tipc: Resetting bearer [ 222.624094][T11090] tipc: Disabling bearer [ 222.730757][T11109] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1267'. [ 222.740241][T11111] netlink: 'syz.2.1266': attribute type 21 has an invalid length. [ 222.754009][T11109] openvswitch: netlink: nsh attribute has 65520 unknown bytes. [ 222.763612][T11111] netlink: 'syz.2.1266': attribute type 6 has an invalid length. [ 222.804075][T11109] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 222.816288][T11110] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1266'. [ 222.850473][T11111] netlink: 64 bytes leftover after parsing attributes in process `syz.2.1266'. [ 222.882928][T11110] netlink: 277 bytes leftover after parsing attributes in process `syz.2.1266'. [ 222.932184][T11117] netlink: 'syz.5.1269': attribute type 13 has an invalid length. [ 222.956521][T11117] netlink: 'syz.5.1269': attribute type 17 has an invalid length. [ 223.151891][T11117] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 223.453252][T11149] bridge: RTM_NEWNEIGH with invalid ether address [ 223.492174][T11153] netlink: 'syz.3.1276': attribute type 2 has an invalid length. [ 223.522936][T11154] __nla_validate_parse: 4 callbacks suppressed [ 223.522953][T11154] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1277'. [ 223.856218][T11169] netlink: 209852 bytes leftover after parsing attributes in process `syz.6.1282'. [ 223.880322][T11169] openvswitch: netlink: ufid size 3068 bytes exceeds the range (1, 16) [ 223.915414][T11169] openvswitch: netlink: Flow get message rejected, Key attribute missing. [ 223.992484][T11174] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1284'. [ 224.146473][T11183] 8021q: VLANs not supported on vxcan1 [ 224.656904][T11191] netlink: 12 bytes leftover after parsing attributes in process `syz.6.1291'. [ 225.069325][T11204] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1295'. [ 225.206744][T11213] tipc: Enabled bearer , priority 0 [ 225.224965][T11213] syzkaller0: entered promiscuous mode [ 225.230485][T11213] syzkaller0: entered allmulticast mode [ 225.254240][T11213] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 225.308635][T11213] netlink: 36 bytes leftover after parsing attributes in process `syz.3.1297'. [ 225.373482][T11213] tipc: Resetting bearer [ 225.469146][T11213] tipc: Resetting bearer [ 225.476888][T11231] netlink: 'syz.6.1304': attribute type 1 has an invalid length. [ 225.500203][T11213] tipc: Disabling bearer [ 226.615651][T11254] veth3: entered promiscuous mode [ 228.222550][T11294] netlink: 'syz.1.1317': attribute type 3 has an invalid length. [ 228.231985][T11294] netlink: 'syz.1.1317': attribute type 3 has an invalid length. [ 228.251940][T11294] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1317'. [ 228.929173][T11249] delete_channel: no stack [ 229.115172][T11268] batman_adv: batadv0: Interface deactivated: dummy0 [ 229.143314][T11268] 0ªX¹¦À: left allmulticast mode [ 229.320667][T11268] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 229.347086][T11268] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 229.501386][T11268] vlan0: left promiscuous mode [ 229.682010][T11291] syzkaller0: entered promiscuous mode [ 229.706727][T11291] syzkaller0: entered allmulticast mode [ 229.719787][ T7486] netdevsim netdevsim2 eth0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 229.732055][ T7486] netdevsim netdevsim2 eth0: unset [1, 0] type 2 family 0 port 20000 - 0 [ 229.743348][ T7486] netdevsim netdevsim2 eth0: unset [1, 1] type 2 family 0 port 6081 - 0 [ 229.815187][T11314] sctp: [Deprecated]: syz.5.1320 (pid 11314) Use of struct sctp_assoc_value in delayed_ack socket option. [ 229.815187][T11314] Use struct sctp_sack_info instead [ 229.828874][ T7486] netdevsim netdevsim2 eth1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 229.841180][ T7486] netdevsim netdevsim2 eth1: unset [1, 0] type 2 family 0 port 20000 - 0 [ 229.863733][ T7486] netdevsim netdevsim2 eth1: unset [1, 1] type 2 family 0 port 6081 - 0 [ 229.939492][ T7486] netdevsim netdevsim2 eth2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 229.960015][ T7486] netdevsim netdevsim2 eth2: unset [1, 0] type 2 family 0 port 20000 - 0 [ 229.986403][ T7486] netdevsim netdevsim2 eth2: unset [1, 1] type 2 family 0 port 6081 - 0 [ 229.997792][T11320] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1322'. [ 230.009931][ T1165] netdevsim netdevsim2 eth3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 230.033684][T11322] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1322'. [ 230.044082][ T1165] netdevsim netdevsim2 eth3: unset [1, 0] type 2 family 0 port 20000 - 0 [ 230.083046][ T1165] netdevsim netdevsim2 eth3: unset [1, 1] type 2 family 0 port 6081 - 0 [ 230.119958][T11328] (unnamed net_device) (uninitialized): Removing last arp target with arp_interval on [ 230.182811][T11328] bond3: entered promiscuous mode [ 230.201681][T11329] netlink: 'syz.6.1324': attribute type 29 has an invalid length. [ 230.223030][T11332] netlink: 'syz.6.1324': attribute type 29 has an invalid length. [ 230.247243][T11336] netlink: 'syz.3.1325': attribute type 13 has an invalid length. [ 230.325297][T11336] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1325'. [ 230.677281][T11362] netlink: 20 bytes leftover after parsing attributes in process `syz.6.1333'. [ 230.802477][T11360] syz_tun: entered allmulticast mode [ 230.842207][T11364] dvmrp8: entered allmulticast mode [ 230.869678][T11369] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1334'. [ 230.897986][T11369] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1334'. [ 231.114988][T11362] IPVS: Unknown mcast interface: bridGe_slave0 [ 231.141921][T11360] netlink: 'syz.5.1332': attribute type 23 has an invalid length. [ 231.311970][T11389] netlink: 'syz.2.1338': attribute type 5 has an invalid length. [ 231.341874][T11393] netlink: 160 bytes leftover after parsing attributes in process `syz.2.1338'. [ 231.394910][T11358] lo speed is unknown, defaulting to 1000 [ 231.415420][T11356] syz_tun: left allmulticast mode [ 231.450693][T11356] dvmrp8: left allmulticast mode [ 231.712965][T11413] netlink: 72 bytes leftover after parsing attributes in process `syz.1.1340'. [ 232.197413][T11429] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1345'. [ 232.224599][T11429] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1345'. [ 232.338788][T11368] lo speed is unknown, defaulting to 1000 [ 233.289443][T11474] bridge0: failed insert local address into bridge forwarding table [ 233.828583][T11495] lo speed is unknown, defaulting to 1000 [ 234.921337][T11529] netlink: 'syz.3.1365': attribute type 1 has an invalid length. [ 235.196722][T11535] netlink: 'syz.2.1366': attribute type 10 has an invalid length. [ 235.358124][T11535] 8021q: adding VLAN 0 to HW filter on device team0 [ 235.388377][T11535] bond0: (slave team0): Enslaving as an active interface with an up link [ 236.027081][ T5934] hid-generic 0005:16BF:5505.0001: unknown main item tag 0x0 [ 236.045883][ T5934] hid-generic 0005:16BF:5505.0001: unknown main item tag 0x0 [ 236.053762][ T5934] hid-generic 0005:16BF:5505.0001: reserved main item tag 0xe [ 236.080129][ T5934] hid-generic 0005:16BF:5505.0001: hidraw0: BLUETOOTH HID vc3.b8 Device [syz0] on aa:aa:aa:aa:aa:aa [ 236.137677][T11552] mac80211_hwsim hwsim7 wlan1: entered allmulticast mode [ 236.258559][T11554] netlink: 'syz.1.1370': attribute type 10 has an invalid length. [ 236.284771][T11554] mac80211_hwsim hwsim7 wlan1: left allmulticast mode [ 236.312421][T11554] Ã: (slave wlan1): Enslaving as an active interface with an up link [ 236.370643][T11553] fido_id[11553]: Failed to open report descriptor at '/sys/devices/virtual/bluetooth/hci4/hci4:200/report_descriptor': No such file or directory [ 236.529685][T11562] syzkaller1: entered promiscuous mode [ 236.535288][T11562] syzkaller1: entered allmulticast mode [ 236.647451][T11562] Ã: (slave wlan1): Releasing backup interface [ 236.754092][T11567] __nla_validate_parse: 5 callbacks suppressed [ 236.754111][T11567] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1376'. [ 236.841737][T11570] lo speed is unknown, defaulting to 1000 [ 237.022484][T11594] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1381'. [ 237.128112][T11595] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1381'. [ 237.291115][T11603] 8021q: VLANs not supported on gre0 [ 237.315737][T11596] lo speed is unknown, defaulting to 1000 [ 237.498592][T11609] netlink: 36 bytes leftover after parsing attributes in process `syz.5.1384'. [ 237.814777][T11621] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1388'. [ 237.841755][T11622] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1387'. [ 237.854662][T11621] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1388'. [ 237.920236][T11621] netlink: 48 bytes leftover after parsing attributes in process `syz.5.1388'. [ 238.017014][T11624] netlink: 'syz.5.1389': attribute type 1 has an invalid length. [ 238.079134][T11624] 8021q: adding VLAN 0 to HW filter on device bond2 [ 238.373492][T11626] 8021q: adding VLAN 0 to HW filter on device bond2 [ 238.401015][T11626] bond2: (slave vxcan3): The slave device specified does not support setting the MAC address [ 238.440281][T11626] bond2: (slave vxcan3): Error -95 calling set_mac_address [ 238.440689][T11635] netlink: 'syz.6.1391': attribute type 1 has an invalid length. [ 238.457428][T11635] netlink: 228 bytes leftover after parsing attributes in process `syz.6.1391'. [ 238.468317][T11635] NCSI netlink: No device for ifindex 0 [ 238.773310][T11637] syzkaller0: entered promiscuous mode [ 238.782353][T11637] syzkaller0: entered allmulticast mode [ 238.957417][T11653] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1398'. [ 238.966776][ T56] wlan0: Trigger new scan to find an IBSS to join [ 239.092009][T11664] netlink: 'syz.1.1401': attribute type 11 has an invalid length. [ 239.327284][T11671] tipc: Enabled bearer , priority 0 [ 239.765221][ T5869] Bluetooth: hci4: command 0x0405 tx timeout [ 241.128076][T11671] tipc: Disabling bearer [ 241.198315][T11703] lo speed is unknown, defaulting to 1000 [ 241.262974][ T6017] hid-generic 0005:16BF:5505.0002: unknown main item tag 0x0 [ 241.322578][ T6017] hid-generic 0005:16BF:5505.0002: hidraw0: BLUETOOTH HID vc3.b8 Device [syz0] on aa:aa:aa:aa:aa:aa [ 241.420700][T11727] RDS: rds_bind could not find a transport for 2001::2, load rds_tcp or rds_rdma? [ 241.473748][T11721] fido_id[11721]: Failed to open report descriptor at '/sys/devices/virtual/bluetooth/hci4/hci4:200/report_descriptor': No such file or directory [ 241.813835][T11741] netlink: 'syz.6.1419': attribute type 13 has an invalid length. [ 241.862492][T11741] netlink: 'syz.6.1419': attribute type 17 has an invalid length. [ 241.925714][ T1123] wlan0: Trigger new scan to find an IBSS to join [ 242.030726][T11747] __nla_validate_parse: 3 callbacks suppressed [ 242.030743][T11747] netlink: 184 bytes leftover after parsing attributes in process `syz.1.1420'. [ 242.114066][T11741] 8021q: adding VLAN 0 to HW filter on device bond0 [ 242.140046][T11741] 8021q: adding VLAN 0 to HW filter on device team0 [ 242.189932][T11741] batman_adv: batadv0: Interface activated: dummy0 [ 242.199315][T11741] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 242.216150][ T5943] lo speed is unknown, defaulting to 1000 [ 242.251074][ T5943] syz0: Port: 1 Link ACTIVE [ 242.256663][T11307] lo speed is unknown, defaulting to 1000 [ 242.380153][T11759] tipc: Enabled bearer , priority 0 [ 242.406366][T11759] syzkaller0: entered promiscuous mode [ 242.422091][T11759] syzkaller0: entered allmulticast mode [ 242.462524][T11764] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1426'. [ 242.473846][T11759] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 242.540306][T11759] tipc: Resetting bearer [ 242.621279][T11756] tipc: Resetting bearer [ 242.663205][T11756] tipc: Disabling bearer [ 242.693393][T11768] netdevsim netdevsim6 netdevsim0: entered allmulticast mode [ 242.723729][T11768] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 242.761236][T11774] netlink: 'syz.1.1431': attribute type 1 has an invalid length. [ 242.787504][T11774] bond3: (slave vcan1): The slave device specified does not support setting the MAC address [ 242.842058][T11774] bond3: (slave vcan1): Error -95 calling set_mac_address [ 242.905628][T11779] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1432'. [ 243.101301][T11779] geneve2: entered promiscuous mode [ 243.107344][T11779] geneve2: entered allmulticast mode [ 243.115870][ T12] netdevsim netdevsim3 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 243.124085][ T12] netdevsim netdevsim3 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 243.143067][T11773] lo speed is unknown, defaulting to 1000 [ 243.175487][ T12] netdevsim netdevsim3 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 243.199559][ T12] netdevsim netdevsim3 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 243.334069][T11796] tipc: Enabled bearer , priority 0 [ 243.360188][T11795] syzkaller0: entered promiscuous mode [ 243.398856][T11795] syzkaller0: entered allmulticast mode [ 243.562636][T11795] tipc: Resetting bearer [ 243.563017][T11813] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1439'. [ 243.585070][T11813] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1439'. [ 243.617860][T11795] tipc: Disabling bearer [ 243.875264][T11828] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1444'. [ 243.923352][T11775] netlink: 428 bytes leftover after parsing attributes in process `syz.2.1430'. [ 244.056702][T11775] netlink: 32 bytes leftover after parsing attributes in process `syz.2.1430'. [ 244.107572][T11834] netlink: 260 bytes leftover after parsing attributes in process `syz.1.1446'. [ 244.131188][T11834] netlink: 260 bytes leftover after parsing attributes in process `syz.1.1446'. [ 244.544678][T11301] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 244.859463][T11865] lo speed is unknown, defaulting to 1000 [ 244.965178][ T7486] wlan0: Trigger new scan to find an IBSS to join [ 245.036639][T11888] netlink: 'syz.6.1456': attribute type 10 has an invalid length. [ 245.116024][T11887] syzkaller0: entered promiscuous mode [ 245.131753][T11887] syzkaller0: entered allmulticast mode [ 245.258226][T11888] netdevsim netdevsim6 netdevsim0: left allmulticast mode [ 245.317891][T11888] bond0: (slave netdevsim0): Enslaving as an active interface with an up link [ 245.368119][T11897] tipc: Enabled bearer , priority 0 [ 245.525441][T11301] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 245.903897][T11911] netlink: 'syz.6.1464': attribute type 1 has an invalid length. [ 245.946848][ T7486] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 246.484503][ T6017] tipc: Node number set to 562559624 [ 247.229791][T11904] workqueue: Failed to create a rescuer kthread for wq "wg-crypt-wireguard%d": -EINTR [ 247.261161][T11892] tipc: Disabling bearer [ 247.331671][T11918] __nla_validate_parse: 7 callbacks suppressed [ 247.331688][T11918] netlink: 96 bytes leftover after parsing attributes in process `syz.5.1465'. [ 247.372490][T11919] netlink: 96 bytes leftover after parsing attributes in process `syz.5.1465'. [ 247.672185][T11932] tipc: Enabled bearer , priority 0 [ 247.715628][T11930] syzkaller0: entered promiscuous mode [ 247.741628][T11930] syzkaller0: entered allmulticast mode [ 247.800088][T11937] netlink: 8 bytes leftover after parsing attributes in process `syz.6.1471'. [ 247.858005][T11925] tipc: Resetting bearer [ 248.015675][T11925] tipc: Disabling bearer [ 248.112923][T11951] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1474'. [ 248.291692][T11961] netlink: 'syz.2.1478': attribute type 2 has an invalid length. [ 248.371902][T11967] netlink: 92 bytes leftover after parsing attributes in process `syz.2.1478'. [ 248.546135][T11975] netlink: 28 bytes leftover after parsing attributes in process `syz.6.1480'. [ 248.586351][T11977] tipc: Enabled bearer , priority 0 [ 248.600512][T11982] netlink: 'syz.1.1482': attribute type 10 has an invalid length. [ 248.620471][T11977] syzkaller0: entered promiscuous mode [ 248.644047][T11977] syzkaller0: entered allmulticast mode [ 248.667210][T11985] netlink: 'syz.1.1482': attribute type 10 has an invalid length. [ 248.731461][T11978] tipc: Enabling of bearer rejected, failed to enable media [ 248.752281][T11984] netlink: 228 bytes leftover after parsing attributes in process `syz.5.1481'. [ 248.784935][T11977] tipc: Resetting bearer [ 248.801630][T11974] tipc: Resetting bearer [ 248.919882][T11974] tipc: Disabling bearer [ 249.943529][T12024] lo speed is unknown, defaulting to 1000 [ 250.258621][T12036] netlink: 16 bytes leftover after parsing attributes in process `syz.5.1495'. [ 250.301164][T12036] netlink: 64 bytes leftover after parsing attributes in process `syz.5.1495'. [ 250.315438][T12036] tipc: Invalid UDP bearer configuration [ 250.315496][T12036] tipc: Enabling of bearer rejected, failed to enable media [ 250.517230][T12050] netlink: 8 bytes leftover after parsing attributes in process `syz.6.1499'. [ 251.442710][T12091] lo speed is unknown, defaulting to 1000 [ 251.922954][T12102] lo speed is unknown, defaulting to 1000 [ 251.944253][T12102] lo speed is unknown, defaulting to 1000 [ 251.968235][T12102] lo speed is unknown, defaulting to 1000 [ 251.980960][T12102] iwpm_register_pid: Unable to send a nlmsg (client = 2) [ 252.000542][T12102] infiniband syz1: RDMA CMA: cma_listen_on_dev, error -98 [ 252.049580][T12102] lo speed is unknown, defaulting to 1000 [ 252.058332][T12102] lo speed is unknown, defaulting to 1000 [ 252.068563][T12102] lo speed is unknown, defaulting to 1000 [ 252.079069][T12102] lo speed is unknown, defaulting to 1000 [ 252.087292][T12102] lo speed is unknown, defaulting to 1000 [ 252.094158][T12102] lo speed is unknown, defaulting to 1000 [ 252.101329][T12102] lo speed is unknown, defaulting to 1000 [ 252.351253][T12108] team0: entered promiscuous mode [ 252.360553][T12108] team_slave_1: entered promiscuous mode [ 252.401690][T12108] __nla_validate_parse: 3 callbacks suppressed [ 252.401709][T12108] netlink: 4 bytes leftover after parsing attributes in process `syz.6.1515'. [ 252.444407][T12111] gtp0: entered promiscuous mode [ 252.496328][T12113] netlink: 'syz.5.1516': attribute type 2 has an invalid length. [ 252.630522][T12108] team0 (unregistering): left promiscuous mode [ 252.638046][T12108] team_slave_1: left promiscuous mode [ 252.645784][T12108] team0 (unregistering): Port device team_slave_1 removed [ 252.672037][T12122] tap0: tun_chr_ioctl cmd 1074025677 [ 252.681070][T12122] tap0: linktype set to 774 [ 252.734145][T12121] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1518'. [ 252.876012][T12129] !: renamed from dummy0 (while UP) [ 252.973210][T12132] tipc: Enabled bearer , priority 0 [ 252.995706][T12132] syzkaller0: entered promiscuous mode [ 253.023934][T12132] syzkaller0: entered allmulticast mode [ 253.083687][T12132] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 253.115574][T12132] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1520'. [ 253.152987][T12132] tipc: Resetting bearer [ 253.251089][T12132] tipc: Resetting bearer [ 253.338835][T12132] tipc: Disabling bearer [ 253.495317][T12154] netlink: 'syz.1.1528': attribute type 2 has an invalid length. [ 253.742531][T12169] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1530'. [ 253.826207][T12175] netlink: 104 bytes leftover after parsing attributes in process `syz.2.1532'. [ 253.902568][T12180] netlink: 'syz.3.1533': attribute type 1 has an invalid length. [ 253.960058][T12180] netlink: 'syz.3.1533': attribute type 10 has an invalid length. [ 253.985020][T12180] team0: Device bond0 is already an upper device of the team interface [ 254.341651][T12171] bond0: (slave netdevsim0): Releasing backup interface [ 254.647910][T12209] dvmrp8: entered allmulticast mode [ 254.753830][T12208] tipc: Enabling of bearer rejected, failed to enable media [ 254.785912][T12209] dvmrp8: left allmulticast mode [ 254.928329][T12210] tipc: Enabling of bearer rejected, failed to enable media [ 254.991484][T12222] tipc: Enabled bearer , priority 0 [ 255.036908][T12226] netlink: 256 bytes leftover after parsing attributes in process `syz.5.1542'. [ 255.082833][T12219] syzkaller0: entered promiscuous mode [ 255.107751][T12219] syzkaller0: entered allmulticast mode [ 255.186301][T12239] openvswitch: netlink: IPv4 tun info is not correct [ 255.243117][T12221] tipc: Resetting bearer [ 255.472738][T12247] netlink: 'syz.3.1545': attribute type 1 has an invalid length. [ 255.500922][T12247] netlink: 232 bytes leftover after parsing attributes in process `syz.3.1545'. [ 255.593903][T12247] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1545'. [ 255.621253][T12242] lo speed is unknown, defaulting to 1000 [ 255.691664][T12217] tipc: Resetting bearer [ 255.773630][T12217] tipc: Disabling bearer [ 255.785839][ T1302] ieee802154 phy0 wpan0: encryption failed: -22 [ 256.305238][T12242] lo speed is unknown, defaulting to 1000 [ 256.706261][T12290] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1554'. [ 258.047206][T12347] netlink: 'syz.5.1570': attribute type 2 has an invalid length. [ 258.059691][T12350] netlink: 20 bytes leftover after parsing attributes in process `syz.3.1571'. [ 258.151857][T12356] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1569'. [ 258.196162][T12346] lo speed is unknown, defaulting to 1000 [ 258.372525][T12364] netlink: 'syz.2.1569': attribute type 1 has an invalid length. [ 258.440636][T12364] netlink: 224 bytes leftover after parsing attributes in process `syz.2.1569'. [ 258.782322][T12377] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1578'. [ 258.851526][T12367] lo speed is unknown, defaulting to 1000 [ 258.852489][T12346] lo speed is unknown, defaulting to 1000 [ 259.443038][T12403] netlink: 'syz.6.1583': attribute type 2 has an invalid length. [ 259.543679][T12367] lo speed is unknown, defaulting to 1000 [ 260.072019][T12415] lo speed is unknown, defaulting to 1000 [ 260.116395][T12426] tipc: Enabled bearer , priority 0 [ 260.376224][T12434] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1586'. [ 260.391199][T12433] netlink: 'syz.6.1591': attribute type 16 has an invalid length. [ 260.420677][T12433] netlink: 'syz.6.1591': attribute type 3 has an invalid length. [ 260.470827][T12433] netlink: 34162 bytes leftover after parsing attributes in process `syz.6.1591'. [ 260.490236][T12420] syzkaller0: entered promiscuous mode [ 260.523692][T12440] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1590'. [ 260.544210][T12420] syzkaller0: entered allmulticast mode [ 260.580269][T12426] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 260.650098][T12437] netlink: 'syz.2.1590': attribute type 5 has an invalid length. [ 260.902848][T12440] bond0: (slave team0): Releasing backup interface [ 260.918599][T12440] team0 (unregistering): Port device team_slave_0 removed [ 260.928265][T12440] team0 (unregistering): Port device team_slave_1 removed [ 260.938105][T12440] team0 (unregistering): Port device geneve0 removed [ 260.961421][T12423] tipc: Resetting bearer [ 260.981002][T12423] tipc: Disabling bearer [ 261.178032][T12449] netlink: 'syz.6.1595': attribute type 2 has an invalid length. [ 261.986507][T12467] lo speed is unknown, defaulting to 1000 [ 263.366166][T12484] batman_adv: batadv0: Interface deactivated: 0! [ 263.389577][T12484] vlan0: left promiscuous mode [ 263.406858][ T6017] lo speed is unknown, defaulting to 1000 [ 263.412623][ T6017] syz0: Port: 1 Link DOWN [ 263.449394][T12504] team0: Device sit1 is of different type [ 263.495869][T12499] syzkaller1: entered promiscuous mode [ 263.502574][T12499] syzkaller1: entered allmulticast mode [ 263.530615][T11307] lo speed is unknown, defaulting to 1000 [ 263.627658][T12509] tipc: Enabled bearer , priority 0 [ 263.646884][T12509] syzkaller0: entered promiscuous mode [ 263.666283][T12509] syzkaller0: entered allmulticast mode [ 263.752457][T12517] netlink: 'syz.3.1607': attribute type 2 has an invalid length. [ 263.761651][T12518] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 263.807946][T12509] netlink: 8 bytes leftover after parsing attributes in process `syz.6.1606'. [ 263.926740][T12509] tipc: Resetting bearer [ 264.003060][T12509] tipc: Disabling bearer [ 264.437619][T12540] netlink: 830 bytes leftover after parsing attributes in process `syz.6.1613'. [ 264.524764][T12552] netlink: 'syz.2.1614': attribute type 1 has an invalid length. [ 264.867308][T12562] tipc: Enabled bearer , priority 0 [ 264.928129][T12562] syzkaller0: entered promiscuous mode [ 264.965472][T12562] syzkaller0: entered allmulticast mode [ 265.004528][T12562] netlink: 60 bytes leftover after parsing attributes in process `syz.6.1617'. [ 265.029770][T12562] netlink: 201392 bytes leftover after parsing attributes in process `syz.6.1617'. [ 265.029770][T12563] netlink: 201392 bytes leftover after parsing attributes in process `syz.6.1617'. [ 265.029795][T12562] openvswitch: netlink: ufid size 3068 bytes exceeds the range (1, 16) [ 265.057968][T12563] openvswitch: netlink: ufid size 3068 bytes exceeds the range (1, 16) [ 265.057992][T12563] openvswitch: netlink: Message has 8454 unknown bytes. [ 265.067551][T12563] tipc: Resetting bearer [ 265.105688][T12568] netlink: 28 bytes leftover after parsing attributes in process `syz.2.1618'. [ 265.172912][T12562] openvswitch: netlink: Message has 8454 unknown bytes. [ 265.200814][T12568] bridge0: port 1(macvlan3) entered blocking state [ 265.251127][T12568] bridge0: port 1(macvlan3) entered disabled state [ 265.278654][T12568] macvlan3: entered allmulticast mode [ 265.284189][T12568] bridge0: entered allmulticast mode [ 265.295567][T12579] netlink: 'syz.3.1619': attribute type 2 has an invalid length. [ 265.321238][T12568] macvlan3: left allmulticast mode [ 265.334624][T12568] bridge0: left allmulticast mode [ 265.388366][T12558] tipc: Resetting bearer [ 265.607083][T12558] tipc: Disabling bearer [ 265.668854][T12595] tipc: Enabled bearer , priority 0 [ 265.693996][T12590] syzkaller0: entered promiscuous mode [ 265.710233][T12590] syzkaller0: entered allmulticast mode [ 265.760510][T12590] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 265.810922][T12593] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1623'. [ 265.822336][T12603] openvswitch: netlink: IP tunnel attribute has 16 unknown bytes. [ 265.824889][T12601] netlink: 80 bytes leftover after parsing attributes in process `syz.3.1625'. [ 265.842281][T12601] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1625'. [ 265.861553][T12601] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1625'. [ 265.922000][T12590] tipc: Resetting bearer [ 266.120094][T12590] tipc: Disabling bearer [ 266.706627][T12642] 8021q: adding VLAN 0 to HW filter on device batadv1 [ 266.736205][T12642] team0: Failed to send port change of device batadv1 via netlink (err -105) [ 266.815106][T12642] team0: Failed to send options change via netlink (err -105) [ 266.888249][T12642] team0: Port device batadv1 added [ 266.970894][T12664] netlink: 'syz.2.1639': attribute type 58 has an invalid length. [ 267.308899][T12678] tipc: Enabled bearer , priority 0 [ 267.317617][T12678] syzkaller0: entered promiscuous mode [ 267.329826][T12678] syzkaller0: entered allmulticast mode [ 267.439481][T12678] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 267.530344][T12679] tipc: Resetting bearer [ 267.614247][T12678] tipc: Resetting bearer [ 267.656669][T12678] tipc: Disabling bearer [ 268.775766][T12747] tipc: Enabling of bearer rejected, already enabled [ 268.809297][T12747] sch_tbf: burst 127 is lower than device syzkaller0 mtu (313) ! [ 268.906459][T12747] __nla_validate_parse: 6 callbacks suppressed [ 268.906479][T12747] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1661'. [ 268.973058][T12754] netlink: 40 bytes leftover after parsing attributes in process `syz.6.1662'. [ 269.255855][T12766] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1665'. [ 269.286431][T12774] netlink: 4 bytes leftover after parsing attributes in process `syz.6.1667'. [ 269.306772][T12774] netlink: 8 bytes leftover after parsing attributes in process `syz.6.1667'. [ 269.924913][ T51] Bluetooth: hci4: command 0x0405 tx timeout [ 269.992464][T12805] netlink: 52 bytes leftover after parsing attributes in process `syz.2.1674'. [ 270.027916][T12810] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1676'. [ 270.045853][T12807] tipc: Enabled bearer , priority 0 [ 270.059932][T12807] syzkaller0: entered promiscuous mode [ 270.065687][T12807] syzkaller0: entered allmulticast mode [ 270.103488][T12805] syzkaller1: entered promiscuous mode [ 270.122906][T12805] syzkaller1: entered allmulticast mode [ 270.198787][T12813] netlink: 20 bytes leftover after parsing attributes in process `syz.5.1677'. [ 270.209007][T12807] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 270.265680][T12807] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1675'. [ 270.312063][T12807] tipc: Resetting bearer [ 270.401668][T12820] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1680'. [ 270.531878][T12807] tipc: Resetting bearer [ 270.552860][T12807] tipc: Disabling bearer [ 270.966761][T12844] (unnamed net_device) (uninitialized): Removing last ns target with arp_interval on [ 271.028655][T12846] lo speed is unknown, defaulting to 1000 [ 271.210949][T12863] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 271.486576][T12874] pim6reg1: entered promiscuous mode [ 271.514521][T12874] pim6reg1: entered allmulticast mode [ 271.731041][T12883] 8021q: adding VLAN 0 to HW filter on device bond2 [ 271.748344][T12883] bond0: (slave bond2): Enslaving as an active interface with an up link [ 272.711329][T12908] lo speed is unknown, defaulting to 1000 [ 272.883487][T12917] netlink: 'syz.1.1705': attribute type 1 has an invalid length. [ 272.932985][T12919] bridge0: port 3(veth0_to_team) entered blocking state [ 272.952559][T12919] bridge0: port 3(veth0_to_team) entered disabled state [ 272.971323][T12919] veth0_to_team: entered allmulticast mode [ 272.991812][T12919] veth0_to_team: entered promiscuous mode [ 273.014387][T12917] netlink: 'syz.1.1705': attribute type 1 has an invalid length. [ 273.297905][T12929] lo speed is unknown, defaulting to 1000 [ 273.323869][T12929] lo speed is unknown, defaulting to 1000 [ 273.345054][T12934] netlink: 'syz.1.1710': attribute type 10 has an invalid length. [ 273.407863][T12929] lo speed is unknown, defaulting to 1000 [ 273.413929][T12934] Ã: entered promiscuous mode [ 273.434117][T12934] Ã: entered allmulticast mode [ 273.450665][T12929] infiniband syz2: RDMA CMA: cma_listen_on_dev, error -98 [ 273.459998][T12934] 8021q: adding VLAN 0 to HW filter on device à [ 273.500910][T12934] A link change request failed with some changes committed already. Interface à may have been left with an inconsistent configuration, please check. [ 273.573321][T12929] lo speed is unknown, defaulting to 1000 [ 273.669040][T12937] syzkaller0: entered promiscuous mode [ 273.678880][T12937] syzkaller0: entered allmulticast mode [ 273.691731][T12929] lo speed is unknown, defaulting to 1000 [ 273.920765][T12929] lo speed is unknown, defaulting to 1000 [ 276.347371][T12948] tipc: Enabled bearer , priority 0 [ 276.356271][T12929] lo speed is unknown, defaulting to 1000 [ 276.365228][T12929] lo speed is unknown, defaulting to 1000 [ 276.366331][T12956] tipc: Resetting bearer [ 276.432787][T12939] tipc: Disabling bearer [ 276.453697][T12929] lo speed is unknown, defaulting to 1000 [ 276.462150][T12929] lo speed is unknown, defaulting to 1000 [ 276.480448][T12929] lo speed is unknown, defaulting to 1000 [ 276.504224][T12961] lo speed is unknown, defaulting to 1000 [ 276.799214][T12970] __nla_validate_parse: 9 callbacks suppressed [ 276.799230][T12970] netlink: 28 bytes leftover after parsing attributes in process `syz.6.1719'. [ 276.870579][T12970] netlink: 28 bytes leftover after parsing attributes in process `syz.6.1719'. [ 277.174049][T12988] netlink: 8 bytes leftover after parsing attributes in process `syz.6.1721'. [ 277.283761][T12991] syzkaller0: entered promiscuous mode [ 277.304470][T12991] syzkaller0: entered allmulticast mode [ 277.675907][T12999] block nbd1: server does not support multiple connections per device. [ 277.697489][T12999] block nbd1: shutting down sockets [ 278.045438][T13006] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1726'. [ 278.428944][T13024] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1730'. [ 278.886648][T13037] tipc: Enabled bearer , priority 0 [ 278.928395][T13037] tipc: Resetting bearer [ 279.082006][T13037] tipc: Disabling bearer [ 279.381515][T13063] netlink: 8 bytes leftover after parsing attributes in process `syz.6.1738'. [ 279.476693][T13063] netlink: 8 bytes leftover after parsing attributes in process `syz.6.1738'. [ 279.533004][T13063] netlink: 8 bytes leftover after parsing attributes in process `syz.6.1738'. [ 279.586248][T13063] netlink: 8 bytes leftover after parsing attributes in process `syz.6.1738'. [ 279.622068][T13063] netlink: 8 bytes leftover after parsing attributes in process `syz.6.1738'. [ 279.722476][T13063] 8021q: adding VLAN 0 to HW filter on device bond0 [ 279.766214][T13063] batman_adv: batadv0: Interface activated: 0! [ 279.788513][T13063] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 279.805930][T11301] lo speed is unknown, defaulting to 1000 [ 279.811918][T11301] syz0: Port: 1 Link ACTIVE [ 279.976326][ T5901] lo speed is unknown, defaulting to 1000 [ 280.055260][T13079] macsec1: entered promiscuous mode [ 280.060514][T13079] batadv0: entered promiscuous mode [ 280.143051][T13079] batadv0: left promiscuous mode [ 280.233368][T13090] workqueue: Failed to create a rescuer kthread for wq "bond7": -EINTR [ 280.317921][T13096] IPv6: NLM_F_REPLACE set, but no existing node found! [ 280.523145][T13106] netlink: 'syz.6.1746': attribute type 13 has an invalid length. [ 280.967481][T13125] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for gretap2 [ 281.028527][T13125] gretap2: entered promiscuous mode [ 281.049527][T13125] gretap2: entered allmulticast mode [ 281.235120][T13136] bond5: entered promiscuous mode [ 281.245260][T13136] 8021q: adding VLAN 0 to HW filter on device bond5 [ 281.640157][T13136] bond5 (unregistering): Released all slaves [ 281.651688][T13154] FAULT_INJECTION: forcing a failure. [ 281.651688][T13154] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 281.666045][T13154] CPU: 1 UID: 0 PID: 13154 Comm: syz.6.1759 Not tainted syzkaller #0 PREEMPT(full) [ 281.666075][T13154] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 281.666099][T13154] Call Trace: [ 281.666107][T13154] [ 281.666115][T13154] dump_stack_lvl+0x189/0x250 [ 281.666141][T13154] ? __pfx____ratelimit+0x10/0x10 [ 281.666160][T13154] ? __pfx_dump_stack_lvl+0x10/0x10 [ 281.666180][T13154] ? __pfx__printk+0x10/0x10 [ 281.666204][T13154] ? fs_reclaim_acquire+0x7d/0x100 [ 281.666239][T13154] should_fail_ex+0x414/0x560 [ 281.666267][T13154] prepare_alloc_pages+0x213/0x610 [ 281.666294][T13154] __alloc_frozen_pages_noprof+0x123/0x370 [ 281.666316][T13154] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 281.666345][T13154] ? policy_nodemask+0x27c/0x720 [ 281.666376][T13154] alloc_pages_mpol+0x232/0x4a0 [ 281.666405][T13154] vma_alloc_folio_noprof+0xe4/0x200 [ 281.666431][T13154] ? __pfx_vma_alloc_folio_noprof+0x10/0x10 [ 281.666469][T13154] folio_prealloc+0x30/0x180 [ 281.666493][T13154] do_wp_page+0x1231/0x5800 [ 281.666536][T13154] ? __pfx_do_wp_page+0x10/0x10 [ 281.666554][T13154] ? do_raw_spin_lock+0x121/0x290 [ 281.666578][T13154] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 281.666610][T13154] __handle_mm_fault+0x1033/0x5440 [ 281.666650][T13154] ? __pfx___handle_mm_fault+0x10/0x10 [ 281.666687][T13154] ? follow_page_pte+0xd03/0x13e0 [ 281.666721][T13154] handle_mm_fault+0x40a/0x8e0 [ 281.666755][T13154] __get_user_pages+0x1699/0x2ce0 [ 281.666773][T13154] ? __lock_acquire+0xab9/0xd20 [ 281.666842][T13154] __gup_longterm_locked+0xde9/0x1660 [ 281.666877][T13154] ? sanity_check_pinned_pages+0x123a/0x1300 [ 281.666907][T13154] gup_fast_fallback+0x1e6a/0x2010 [ 281.666966][T13154] ? __pfx_gup_fast_fallback+0x10/0x10 [ 281.666984][T13154] ? stack_trace_save+0x9c/0xe0 [ 281.667004][T13154] ? __pfx_stack_trace_save+0x10/0x10 [ 281.667036][T13154] ? pin_user_pages_fast+0x4d/0xb0 [ 281.667059][T13154] iov_iter_extract_pages+0x35a/0x5e0 [ 281.667090][T13154] extract_iter_to_sg+0xe46/0x24e0 [ 281.667125][T13154] ? __pfx_extract_iter_to_sg+0x10/0x10 [ 281.667169][T13154] ? __asan_memset+0x22/0x50 [ 281.667190][T13154] af_alg_get_rsgl+0x436/0x810 [ 281.667230][T13154] skcipher_recvmsg+0x3c0/0x11c0 [ 281.667256][T13154] ? aa_sk_perm+0x81e/0x950 [ 281.667292][T13154] ? __pfx_skcipher_recvmsg+0x10/0x10 [ 281.667316][T13154] ? bpf_lsm_socket_recvmsg+0x9/0x20 [ 281.667333][T13154] ? security_socket_recvmsg+0x7e/0x2e0 [ 281.667352][T13154] ? __pfx_skcipher_recvmsg+0x10/0x10 [ 281.667374][T13154] sock_recvmsg+0x22c/0x270 [ 281.667402][T13154] ____sys_recvmsg+0x1c9/0x460 [ 281.667430][T13154] ? __pfx_____sys_recvmsg+0x10/0x10 [ 281.667464][T13154] ? import_iovec+0x74/0xa0 [ 281.667485][T13154] ___sys_recvmsg+0x1b5/0x510 [ 281.667511][T13154] ? __pfx____sys_recvmsg+0x10/0x10 [ 281.667565][T13154] ? __fget_files+0x3a0/0x420 [ 281.667593][T13154] __x64_sys_recvmsg+0x198/0x260 [ 281.667616][T13154] ? __pfx___x64_sys_recvmsg+0x10/0x10 [ 281.667648][T13154] ? __pfx_ksys_write+0x10/0x10 [ 281.667666][T13154] ? rcu_is_watching+0x15/0xb0 [ 281.667690][T13154] ? do_syscall_64+0xbe/0x3b0 [ 281.667713][T13154] do_syscall_64+0xfa/0x3b0 [ 281.667729][T13154] ? lockdep_hardirqs_on+0x9c/0x150 [ 281.667747][T13154] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 281.667764][T13154] ? clear_bhb_loop+0x60/0xb0 [ 281.667784][T13154] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 281.667800][T13154] RIP: 0033:0x7f73cf98ebe9 [ 281.667816][T13154] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 281.667836][T13154] RSP: 002b:00007f73d0840038 EFLAGS: 00000246 ORIG_RAX: 000000000000002f [ 281.667856][T13154] RAX: ffffffffffffffda RBX: 00007f73cfbc5fa0 RCX: 00007f73cf98ebe9 [ 281.667869][T13154] RDX: 0000000000000000 RSI: 00002000000005c0 RDI: 0000000000000006 [ 281.667880][T13154] RBP: 00007f73d0840090 R08: 0000000000000000 R09: 0000000000000000 [ 281.667891][T13154] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 281.667901][T13154] R13: 00007f73cfbc6038 R14: 00007f73cfbc5fa0 R15: 00007ffeb513a878 [ 281.667933][T13154] [ 282.694004][T13168] macvlan3: entered promiscuous mode [ 282.736096][T13168] vlan0: entered promiscuous mode [ 283.026250][T13184] FAULT_INJECTION: forcing a failure. [ 283.026250][T13184] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 283.057462][T13186] lo speed is unknown, defaulting to 1000 [ 283.063313][T13184] CPU: 0 UID: 0 PID: 13184 Comm: syz.5.1770 Not tainted syzkaller #0 PREEMPT(full) [ 283.063337][T13184] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 283.063347][T13184] Call Trace: [ 283.063355][T13184] [ 283.063362][T13184] dump_stack_lvl+0x189/0x250 [ 283.063387][T13184] ? __pfx____ratelimit+0x10/0x10 [ 283.063404][T13184] ? __pfx_dump_stack_lvl+0x10/0x10 [ 283.063424][T13184] ? __pfx__printk+0x10/0x10 [ 283.063447][T13184] ? fs_reclaim_acquire+0x7d/0x100 [ 283.063481][T13184] should_fail_ex+0x414/0x560 [ 283.063509][T13184] prepare_alloc_pages+0x213/0x610 [ 283.063535][T13184] __alloc_frozen_pages_noprof+0x123/0x370 [ 283.063557][T13184] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 283.063586][T13184] ? policy_nodemask+0x27c/0x720 [ 283.063614][T13184] alloc_pages_mpol+0x232/0x4a0 [ 283.063641][T13184] vma_alloc_folio_noprof+0xe4/0x200 [ 283.063667][T13184] ? __pfx_vma_alloc_folio_noprof+0x10/0x10 [ 283.063700][T13184] folio_prealloc+0x30/0x180 [ 283.063722][T13184] do_wp_page+0x1231/0x5800 [ 283.063775][T13184] ? __pfx_do_wp_page+0x10/0x10 [ 283.063790][T13184] ? do_raw_spin_lock+0x121/0x290 [ 283.063813][T13184] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 283.063844][T13184] __handle_mm_fault+0x1033/0x5440 [ 283.063884][T13184] ? __pfx___handle_mm_fault+0x10/0x10 [ 283.063922][T13184] ? follow_page_pte+0xd03/0x13e0 [ 283.063955][T13184] handle_mm_fault+0x40a/0x8e0 [ 283.063988][T13184] __get_user_pages+0x1699/0x2ce0 [ 283.064006][T13184] ? __lock_acquire+0xab9/0xd20 [ 283.064067][T13184] __gup_longterm_locked+0xde9/0x1660 [ 283.064102][T13184] ? sanity_check_pinned_pages+0x123a/0x1300 [ 283.064133][T13184] gup_fast_fallback+0x1e6a/0x2010 [ 283.064191][T13184] ? __pfx_gup_fast_fallback+0x10/0x10 [ 283.064208][T13184] ? stack_trace_save+0x9c/0xe0 [ 283.064227][T13184] ? __pfx_stack_trace_save+0x10/0x10 [ 283.064258][T13184] ? pin_user_pages_fast+0x4d/0xb0 [ 283.064285][T13184] iov_iter_extract_pages+0x35a/0x5e0 [ 283.064313][T13184] extract_iter_to_sg+0xe46/0x24e0 [ 283.064346][T13184] ? __pfx_extract_iter_to_sg+0x10/0x10 [ 283.064391][T13184] ? __asan_memset+0x22/0x50 [ 283.064412][T13184] af_alg_get_rsgl+0x436/0x810 [ 283.064455][T13184] skcipher_recvmsg+0x3c0/0x11c0 [ 283.064481][T13184] ? aa_sk_perm+0x81e/0x950 [ 283.064517][T13184] ? __pfx_skcipher_recvmsg+0x10/0x10 [ 283.064543][T13184] ? bpf_lsm_socket_recvmsg+0x9/0x20 [ 283.064559][T13184] ? security_socket_recvmsg+0x7e/0x2e0 [ 283.064578][T13184] ? __pfx_skcipher_recvmsg+0x10/0x10 [ 283.064599][T13184] sock_recvmsg+0x22c/0x270 [ 283.064627][T13184] ____sys_recvmsg+0x1c9/0x460 [ 283.064657][T13184] ? __pfx_____sys_recvmsg+0x10/0x10 [ 283.064694][T13184] ? import_iovec+0x74/0xa0 [ 283.064725][T13184] ___sys_recvmsg+0x1b5/0x510 [ 283.064755][T13184] ? __pfx____sys_recvmsg+0x10/0x10 [ 283.064804][T13184] ? __fget_files+0x3a0/0x420 [ 283.064833][T13184] __x64_sys_recvmsg+0x198/0x260 [ 283.064856][T13184] ? __pfx___x64_sys_recvmsg+0x10/0x10 [ 283.064887][T13184] ? __pfx_ksys_write+0x10/0x10 [ 283.064906][T13184] ? rcu_is_watching+0x15/0xb0 [ 283.064930][T13184] ? do_syscall_64+0xbe/0x3b0 [ 283.064953][T13184] do_syscall_64+0xfa/0x3b0 [ 283.064969][T13184] ? lockdep_hardirqs_on+0x9c/0x150 [ 283.064985][T13184] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 283.065001][T13184] ? clear_bhb_loop+0x60/0xb0 [ 283.065022][T13184] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 283.065039][T13184] RIP: 0033:0x7feefcf8ebe9 [ 283.065055][T13184] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 283.065070][T13184] RSP: 002b:00007feefdd9a038 EFLAGS: 00000246 ORIG_RAX: 000000000000002f [ 283.065089][T13184] RAX: ffffffffffffffda RBX: 00007feefd1c5fa0 RCX: 00007feefcf8ebe9 [ 283.065101][T13184] RDX: 0000000000000000 RSI: 00002000000005c0 RDI: 0000000000000006 [ 283.065112][T13184] RBP: 00007feefdd9a090 R08: 0000000000000000 R09: 0000000000000000 [ 283.065123][T13184] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 283.065134][T13184] R13: 00007feefd1c6038 R14: 00007feefd1c5fa0 R15: 00007ffe216028f8 [ 283.065165][T13184] [ 283.734204][T13198] syzkaller1: entered promiscuous mode [ 283.759099][T13198] syzkaller1: entered allmulticast mode [ 284.035280][T13212] netlink: 'syz.1.1774': attribute type 13 has an invalid length. [ 284.043186][T13212] netlink: 'syz.1.1774': attribute type 17 has an invalid length. [ 284.293331][T13212] Ã: left promiscuous mode [ 284.302844][T13212] Ã: left allmulticast mode [ 284.322240][T13212] 8021q: adding VLAN 0 to HW filter on device team0 [ 284.334123][T13212] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 284.353746][T13186] lo speed is unknown, defaulting to 1000 [ 284.463822][T13216] lo speed is unknown, defaulting to 1000 [ 284.490749][T13231] __nla_validate_parse: 20 callbacks suppressed [ 284.490864][T13231] netlink: 24 bytes leftover after parsing attributes in process `syz.6.1779'. [ 284.548892][T13231] netlink: 67 bytes leftover after parsing attributes in process `syz.6.1779'. [ 284.888605][T13240] netlink: 8 bytes leftover after parsing attributes in process `syz.6.1782'. [ 284.919695][T13243] netlink: 128 bytes leftover after parsing attributes in process `syz.3.1783'. [ 284.934713][T13240] netlink: 8 bytes leftover after parsing attributes in process `syz.6.1782'. [ 284.953927][T13216] lo speed is unknown, defaulting to 1000 [ 285.236974][T13250] batman_adv: batadv0: Removing interface: dummy0 [ 285.326272][T13258] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1784'. [ 285.346071][T13250] bond0: (slave bond_slave_0): Releasing backup interface [ 285.402249][T13250] bond0: (slave bond_slave_1): Releasing backup interface [ 285.433752][T13250] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 285.496252][T13250] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 285.506802][T13264] netlink: 16 bytes leftover after parsing attributes in process `syz.3.1787'. [ 285.527303][T13250] bond2: (slave wlan0): Releasing active interface [ 285.550726][T13250] bond0: (slave wlan1): Releasing backup interface [ 285.560503][T13250] bond1: (slave geneve2): Releasing active interface [ 286.256159][T13284] raw_sendmsg: syz.5.1794 forgot to set AF_INET. Fix it! [ 286.495000][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 286.518429][T13293] lo speed is unknown, defaulting to 1000 [ 286.759192][T13302] netlink: 256 bytes leftover after parsing attributes in process `syz.2.1800'. [ 286.788085][T13304] bond0: option active_slave: mode dependency failed, not supported in mode balance-rr(0) [ 286.796230][T13302] netlink: 48 bytes leftover after parsing attributes in process `syz.2.1800'. [ 286.861002][T13302] gretap0: left promiscuous mode [ 286.907484][T13302] 8021q: adding VLAN 0 to HW filter on device bond0 [ 286.923770][T13302] A link change request failed with some changes committed already. Interface 60ªX¹¦À may have been left with an inconsistent configuration, please check. [ 287.116840][T13293] lo speed is unknown, defaulting to 1000 [ 287.152405][ T5901] IPVS: starting estimator thread 0... [ 287.256517][T13312] IPVS: using max 28 ests per chain, 67200 per kthread [ 287.417902][T13317] netlink: 40 bytes leftover after parsing attributes in process `syz.6.1806'. [ 287.576497][T13327] tipc: Enabled bearer , priority 0 [ 287.607697][T13327] syzkaller0: entered promiscuous mode [ 287.621984][T13327] syzkaller0: entered allmulticast mode [ 287.659616][T13327] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 287.800313][T13327] tipc: Resetting bearer [ 287.998045][T13327] tipc: Disabling bearer [ 288.037442][T13341] macvtap1: entered promiscuous mode [ 288.042776][T13341] mac80211_hwsim hwsim5 wlan1: entered promiscuous mode [ 288.087966][T13341] mac80211_hwsim hwsim5 wlan1: left promiscuous mode [ 288.326266][T13348] lo speed is unknown, defaulting to 1000 [ 288.391841][T13355] openvswitch: netlink: Message has 4 unknown bytes. [ 288.406785][T13355] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 288.577564][T13361] tipc: Invalid UDP bearer configuration [ 288.577619][T13361] tipc: Enabling of bearer rejected, failed to enable media [ 288.940248][T13345] lo speed is unknown, defaulting to 1000 [ 288.958227][T13348] lo speed is unknown, defaulting to 1000 [ 289.037489][T13377] tipc: Enabled bearer , priority 0 [ 289.046260][T13377] syzkaller0: entered promiscuous mode [ 289.051750][T13377] syzkaller0: entered allmulticast mode [ 289.073199][T13377] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 289.510710][T13345] lo speed is unknown, defaulting to 1000 [ 289.810503][T13410] __nla_validate_parse: 4 callbacks suppressed [ 289.810522][T13410] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1831'. [ 289.837248][T13377] tipc: Resetting bearer [ 289.970038][T13377] tipc: Disabling bearer [ 290.112286][T13424] netlink: 'syz.6.1835': attribute type 1 has an invalid length. [ 290.128352][T13424] netlink: 224 bytes leftover after parsing attributes in process `syz.6.1835'. [ 290.440279][T13431] netlink: 8 bytes leftover after parsing attributes in process `syz.6.1837'. [ 290.611556][T13432] netlink: 16 bytes leftover after parsing attributes in process `syz.6.1837'. [ 290.669033][T13436] netlink: 212376 bytes leftover after parsing attributes in process `syz.3.1839'. [ 290.918762][T13441] netlink: 'syz.3.1840': attribute type 10 has an invalid length. [ 290.960183][T13440] mac80211_hwsim hwsim9 wlan1: entered allmulticast mode [ 290.969267][T13444] netlink: 48 bytes leftover after parsing attributes in process `syz.5.1842'. [ 291.075166][T13449] sctp: [Deprecated]: syz.3.1843 (pid 13449) Use of struct sctp_assoc_value in delayed_ack socket option. [ 291.075166][T13449] Use struct sctp_sack_info instead [ 291.086296][T13447] bridge0: entered promiscuous mode [ 291.120538][T13445] vcan0: tx drop: invalid sa for name 0x0000000000000002 [ 291.180829][T13456] netlink: 8 bytes leftover after parsing attributes in process `syz.6.1844'. [ 291.197167][T13456] netlink: 36 bytes leftover after parsing attributes in process `syz.6.1844'. [ 291.310973][T13467] netlink: 'syz.3.1847': attribute type 10 has an invalid length. [ 291.485147][T13477] tipc: Enabling of bearer rejected, already enabled [ 291.521040][T13477] tipc: Resetting bearer [ 291.549088][T13477] syzkaller0: left promiscuous mode [ 291.626798][T13480] pim6reg: entered allmulticast mode [ 291.794264][T13480] pim6reg: left allmulticast mode [ 291.832113][T13489] netlink: 'syz.5.1853': attribute type 2 has an invalid length. [ 291.987175][T13489] k›*·]‘: entered promiscuous mode [ 292.059845][T13493] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 292.132844][ T49] bridge0: port 3(veth0_to_team) entered blocking state [ 292.139962][ T49] bridge0: port 3(veth0_to_team) entered forwarding state [ 292.186322][ T5934] lo speed is unknown, defaulting to 1000 [ 292.271442][T13495] bridge0: port 3(veth0_to_team) entered disabled state [ 292.440765][T13512] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1854'. [ 293.298758][T13556] netlink: 68 bytes leftover after parsing attributes in process `syz.5.1869'. [ 293.365496][T13558] (unnamed net_device) (uninitialized): option miimon: invalid value (18446744073709551607) [ 293.385708][T13558] (unnamed net_device) (uninitialized): option miimon: allowed values 0 - 2147483647 [ 293.518310][T13566] netlink: 'syz.5.1874': attribute type 4 has an invalid length. [ 293.532686][T13564] netlink: 'syz.3.1873': attribute type 10 has an invalid length. [ 293.543006][T13564] batman_adv: batadv0: Adding interface: virt_wifi0 [ 293.556621][T13564] batman_adv: batadv0: The MTU of interface virt_wifi0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 293.602595][T13564] batman_adv: batadv0: Interface activated: virt_wifi0 [ 293.948450][T13580] tipc: Enabled bearer , priority 0 [ 293.966764][T13580] syzkaller0: entered promiscuous mode [ 293.975261][T13580] syzkaller0: entered allmulticast mode [ 294.028256][T13585] gtp0: entered promiscuous mode [ 294.066205][T13580] tipc: Resetting bearer [ 294.095874][T13579] tipc: Resetting bearer [ 294.164247][T13579] tipc: Disabling bearer [ 294.205850][T13601] xt_limit: Overflow, try lower: 271964/0 [ 294.220609][T13604] xt_limit: Overflow, try lower: 271964/0 [ 294.538927][T13622] lo speed is unknown, defaulting to 1000 [ 294.810365][T13636] batadv_slave_1: entered promiscuous mode [ 294.823075][T13635] batadv_slave_1: left promiscuous mode [ 294.837509][T13637] netlink: 'syz.6.1892': attribute type 10 has an invalid length. [ 294.886104][T13639] netlink: 'syz.1.1894': attribute type 21 has an invalid length. [ 294.894131][T13639] __nla_validate_parse: 2 callbacks suppressed [ 294.894146][T13639] netlink: 132 bytes leftover after parsing attributes in process `syz.1.1894'. [ 294.927692][T13622] lo speed is unknown, defaulting to 1000 [ 295.511549][T13658] netlink: 20 bytes leftover after parsing attributes in process `syz.3.1901'. [ 295.523765][T13658] netlink: 20 bytes leftover after parsing attributes in process `syz.3.1901'. [ 295.539288][T13658] netlink: 20 bytes leftover after parsing attributes in process `syz.3.1901'. [ 295.551067][T13658] netlink: 20 bytes leftover after parsing attributes in process `syz.3.1901'. [ 296.076008][T13682] tipc: Enabled bearer , priority 0 [ 296.099595][T13682] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1907'. [ 296.131785][T13682] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1907'. [ 296.150516][T13682] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1907'. [ 296.196170][T13687] tipc: Resetting bearer [ 296.209284][T13679] tipc: Disabling bearer [ 296.358164][T13697] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1912'. [ 296.367676][T13697] (unnamed net_device) (uninitialized): Invalid ad_actor_system MAC address. [ 296.421641][T13697] (unnamed net_device) (uninitialized): option ad_actor_system: invalid value (7) [ 296.454711][T13697] netlink: 28 bytes leftover after parsing attributes in process `syz.3.1912'. [ 296.492054][T13697] !: renamed from dummy0 (while UP) [ 296.902722][T13707] 8021q: adding VLAN 0 to HW filter on device bond4 [ 297.315083][T13710] 8021q: adding VLAN 0 to HW filter on device bond4 [ 297.352791][T13710] bond0: (slave bond4): Enslaving as an active interface with an up link [ 297.825605][T13730] tc_dump_action: action bad kind [ 297.957001][T13744] netlink: 'syz.6.1922': attribute type 9 has an invalid length. [ 298.015054][T13744] netlink: 'syz.6.1922': attribute type 6 has an invalid length. [ 298.147648][T13750] tipc: Enabled bearer , priority 0 [ 298.176480][T13750] syzkaller0: entered promiscuous mode [ 298.181982][T13750] syzkaller0: entered allmulticast mode [ 298.335590][T13753] bond0: Caught tx_queue_len zero misconfig [ 298.861366][T13750] sch_tbf: burst 12 is lower than device syzkaller0 mtu (1514) ! [ 298.876736][T13760] tipc: Resetting bearer [ 298.909255][T13749] tipc: Resetting bearer [ 298.947630][T13749] tipc: Disabling bearer [ 299.594620][T13781] tipc: Enabling of bearer rejected, already enabled [ 299.640684][T13784] syzkaller0: entered promiscuous mode [ 299.776613][T13791] netlink: 'syz.1.1938': attribute type 1 has an invalid length. [ 299.994188][T13801] IPVS: Error connecting to the multicast addr [ 300.107152][T13801] mac80211_hwsim hwsim8 wlan0: entered promiscuous mode [ 300.136627][T13801] A link change request failed with some changes committed already. Interface wlan0 may have been left with an inconsistent configuration, please check. [ 300.189032][T13805] A link change request failed with some changes committed already. Interface wlan0 may have been left with an inconsistent configuration, please check. [ 300.438673][T13811] ================================================================== [ 300.446788][T13811] BUG: KASAN: slab-use-after-free in xfrm_state_find+0x2cf2/0x5400 [ 300.454692][T13811] Read of size 1 at addr ffff8880548d4bb0 by task syz.3.1945/13811 [ 300.462602][T13811] [ 300.464935][T13811] CPU: 1 UID: 0 PID: 13811 Comm: syz.3.1945 Not tainted syzkaller #0 PREEMPT(full) [ 300.464959][T13811] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 300.464970][T13811] Call Trace: [ 300.464978][T13811] [ 300.464986][T13811] dump_stack_lvl+0x189/0x250 [ 300.465019][T13811] ? __kasan_check_byte+0x12/0x40 [ 300.465046][T13811] ? __pfx_dump_stack_lvl+0x10/0x10 [ 300.465065][T13811] ? lock_release+0x4b/0x3e0 [ 300.465093][T13811] ? __virt_addr_valid+0x4a5/0x5c0 [ 300.465117][T13811] print_report+0xca/0x240 [ 300.465133][T13811] ? xfrm_state_find+0x2cf2/0x5400 [ 300.465151][T13811] kasan_report+0x118/0x150 [ 300.465173][T13811] ? xfrm_state_find+0x2cf2/0x5400 [ 300.465196][T13811] xfrm_state_find+0x2cf2/0x5400 [ 300.465219][T13811] ? __pfx___find_rr_leaf+0x10/0x10 [ 300.465242][T13811] ? xfrm_state_find+0x1da/0x5400 [ 300.465263][T13811] ? __pfx_xfrm_state_find+0x10/0x10 [ 300.465279][T13811] ? __rt6_find_exception_rcu+0x127/0x4c0 [ 300.465300][T13811] ? __pfx___rt6_find_exception_rcu+0x10/0x10 [ 300.465321][T13811] xfrm_resolve_and_create_bundle+0x768/0x2f80 [ 300.465350][T13811] ? ip6_pol_route+0x162/0x1180 [ 300.465374][T13811] ? __pfx_ip6_pol_route+0x10/0x10 [ 300.465395][T13811] ? __pfx_xfrm_resolve_and_create_bundle+0x10/0x10 [ 300.465417][T13811] ? __lock_acquire+0xab9/0xd20 [ 300.465449][T13811] ? xfrm_sk_policy_lookup+0x9d/0x750 [ 300.465476][T13811] ? xfrm_sk_policy_lookup+0x9d/0x750 [ 300.465500][T13811] ? xfrm_expand_policies+0x41f/0x6a0 [ 300.465524][T13811] xfrm_lookup_with_ifid+0x2a7/0x1a70 [ 300.465547][T13811] ? __pfx_ip6_dst_lookup_tail+0x10/0x10 [ 300.465571][T13811] ? __pfx_xfrm_lookup_with_ifid+0x10/0x10 [ 300.465593][T13811] ? txopt_get+0x335/0x3f0 [ 300.465609][T13811] ? aa_label_sk_perm+0x4cd/0x630 [ 300.465633][T13811] ? __pfx_txopt_get+0x10/0x10 [ 300.465652][T13811] xfrm_lookup_route+0x3c/0x1c0 [ 300.465673][T13811] rawv6_sendmsg+0xdab/0x1820 [ 300.465696][T13811] ? __pfx_rawv6_sendmsg+0x10/0x10 [ 300.465716][T13811] ? finish_task_switch+0x266/0x950 [ 300.465743][T13811] ? __pfx_aa_sk_perm+0x10/0x10 [ 300.465766][T13811] ? sock_rps_record_flow+0x19/0x410 [ 300.465789][T13811] ? inet_sendmsg+0x2f4/0x370 [ 300.465809][T13811] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 300.465830][T13811] __sock_sendmsg+0x19c/0x270 [ 300.465853][T13811] ____sys_sendmsg+0x52d/0x830 [ 300.465874][T13811] ? __pfx_____sys_sendmsg+0x10/0x10 [ 300.465898][T13811] ? import_iovec+0x74/0xa0 [ 300.465918][T13811] ___sys_sendmsg+0x21f/0x2a0 [ 300.465938][T13811] ? __pfx____sys_sendmsg+0x10/0x10 [ 300.465974][T13811] ? __fget_files+0x2a/0x420 [ 300.465989][T13811] ? __fget_files+0x3a0/0x420 [ 300.466017][T13811] __sys_sendmmsg+0x227/0x430 [ 300.466039][T13811] ? __pfx___sys_sendmmsg+0x10/0x10 [ 300.466057][T13811] ? do_futex+0x333/0x420 [ 300.466095][T13811] ? rcu_is_watching+0x15/0xb0 [ 300.466116][T13811] __x64_sys_sendmmsg+0xa0/0xc0 [ 300.466135][T13811] do_syscall_64+0xfa/0x3b0 [ 300.466153][T13811] ? lockdep_hardirqs_on+0x9c/0x150 [ 300.466169][T13811] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 300.466186][T13811] ? clear_bhb_loop+0x60/0xb0 [ 300.466205][T13811] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 300.466223][T13811] RIP: 0033:0x7f710df8ebe9 [ 300.466239][T13811] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 300.466254][T13811] RSP: 002b:00007f710eddc038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 300.466274][T13811] RAX: ffffffffffffffda RBX: 00007f710e1c5fa0 RCX: 00007f710df8ebe9 [ 300.466287][T13811] RDX: 0000000000000021 RSI: 0000200000000480 RDI: 0000000000000005 [ 300.466300][T13811] RBP: 00007f710e011e19 R08: 0000000000000000 R09: 0000000000000000 [ 300.466312][T13811] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 300.466323][T13811] R13: 00007f710e1c6038 R14: 00007f710e1c5fa0 R15: 00007fff00d42a58 [ 300.466345][T13811] [ 300.466352][T13811] [ 300.846839][T13811] Allocated by task 9364: [ 300.851155][T13811] kasan_save_track+0x3e/0x80 [ 300.855825][T13811] __kasan_slab_alloc+0x6c/0x80 [ 300.860663][T13811] kmem_cache_alloc_noprof+0x1c1/0x3c0 [ 300.866107][T13811] xfrm_state_alloc+0x24/0x2f0 [ 300.870878][T13811] __find_acq_core+0x8a7/0x1c00 [ 300.875713][T13811] xfrm_find_acq+0x78/0xa0 [ 300.880112][T13811] xfrm_alloc_userspi+0x6b3/0xc90 [ 300.885124][T13811] xfrm_user_rcv_msg+0x7a0/0xab0 [ 300.890047][T13811] netlink_rcv_skb+0x208/0x470 [ 300.894791][T13811] xfrm_netlink_rcv+0x79/0x90 [ 300.899452][T13811] netlink_unicast+0x82c/0x9e0 [ 300.904231][T13811] netlink_sendmsg+0x805/0xb30 [ 300.908976][T13811] __sock_sendmsg+0x21c/0x270 [ 300.913652][T13811] ____sys_sendmsg+0x505/0x830 [ 300.918400][T13811] ___sys_sendmsg+0x21f/0x2a0 [ 300.923061][T13811] __x64_sys_sendmsg+0x19b/0x260 [ 300.927980][T13811] do_syscall_64+0xfa/0x3b0 [ 300.932465][T13811] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 300.938343][T13811] [ 300.940653][T13811] Freed by task 5927: [ 300.944610][T13811] kasan_save_track+0x3e/0x80 [ 300.949278][T13811] kasan_save_free_info+0x46/0x50 [ 300.954283][T13811] __kasan_slab_free+0x5b/0x80 [ 300.959036][T13811] kmem_cache_free+0x18f/0x400 [ 300.963785][T13811] xfrm_state_gc_task+0x52d/0x6b0 [ 300.968809][T13811] process_scheduled_works+0xae1/0x17b0 [ 300.974359][T13811] worker_thread+0x8a0/0xda0 [ 300.978950][T13811] kthread+0x70e/0x8a0 [ 300.983013][T13811] ret_from_fork+0x3f9/0x770 [ 300.987590][T13811] ret_from_fork_asm+0x1a/0x30 [ 300.992341][T13811] [ 300.994653][T13811] The buggy address belongs to the object at ffff8880548d4880 [ 300.994653][T13811] which belongs to the cache xfrm_state of size 928 [ 301.008613][T13811] The buggy address is located 816 bytes inside of [ 301.008613][T13811] freed 928-byte region [ffff8880548d4880, ffff8880548d4c20) [ 301.022399][T13811] [ 301.024717][T13811] The buggy address belongs to the physical page: [ 301.031131][T13811] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff8880548d4880 pfn:0x548d4 [ 301.041185][T13811] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 301.049667][T13811] anon flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 301.057636][T13811] page_type: f5(slab) [ 301.061609][T13811] raw: 00fff00000000040 ffff888143ac2a00 0000000000000000 0000000000000001 [ 301.070174][T13811] raw: ffff8880548d4880 00000000000f0000 00000000f5000000 0000000000000000 [ 301.078740][T13811] head: 00fff00000000040 ffff888143ac2a00 0000000000000000 0000000000000001 [ 301.087392][T13811] head: ffff8880548d4880 00000000000f0000 00000000f5000000 0000000000000000 [ 301.096045][T13811] head: 00fff00000000002 ffffea0001523501 00000000ffffffff 00000000ffffffff [ 301.104696][T13811] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 301.113342][T13811] page dumped because: kasan: bad access detected [ 301.119746][T13811] page_owner tracks the page as allocated [ 301.125440][T13811] page last allocated via order 2, migratetype Unmovable, gfp_mask 0x52820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 6020, tgid 6019 (syz.3.4), ts 81096197135, free_ts 80957626199 [ 301.144264][T13811] post_alloc_hook+0x240/0x2a0 [ 301.149025][T13811] get_page_from_freelist+0x21e4/0x22c0 [ 301.154554][T13811] __alloc_frozen_pages_noprof+0x181/0x370 [ 301.160341][T13811] alloc_pages_mpol+0x232/0x4a0 [ 301.165178][T13811] allocate_slab+0x8a/0x370 [ 301.169671][T13811] ___slab_alloc+0xbeb/0x1410 [ 301.174371][T13811] kmem_cache_alloc_noprof+0x283/0x3c0 [ 301.179825][T13811] xfrm_state_alloc+0x24/0x2f0 [ 301.184574][T13811] __find_acq_core+0x8a7/0x1c00 [ 301.189409][T13811] xfrm_find_acq+0x78/0xa0 [ 301.193806][T13811] pfkey_getspi+0x65d/0xee0 [ 301.198291][T13811] pfkey_sendmsg+0xbfe/0x1090 [ 301.202948][T13811] __sock_sendmsg+0x21c/0x270 [ 301.207615][T13811] ____sys_sendmsg+0x52d/0x830 [ 301.212398][T13811] ___sys_sendmsg+0x21f/0x2a0 [ 301.217054][T13811] __sys_sendmmsg+0x227/0x430 [ 301.221715][T13811] page last free pid 6007 tgid 6007 stack trace: [ 301.228028][T13811] __free_frozen_pages+0xbc4/0xd30 [ 301.233126][T13811] __folio_put+0x21b/0x2c0 [ 301.237523][T13811] update_and_free_hugetlb_folio+0x169/0x280 [ 301.243487][T13811] free_huge_folio+0xd72/0x1100 [ 301.248316][T13811] folios_put_refs+0x410/0x640 [ 301.253062][T13811] remove_inode_hugepages+0xee3/0x1100 [ 301.258514][T13811] hugetlbfs_evict_inode+0xbf/0x230 [ 301.263696][T13811] evict+0x501/0x9c0 [ 301.267577][T13811] __dentry_kill+0x209/0x660 [ 301.272147][T13811] dput+0x19f/0x2b0 [ 301.275934][T13811] __fput+0x68e/0xa70 [ 301.279981][T13811] task_work_run+0x1d4/0x260 [ 301.284562][T13811] do_exit+0x6b5/0x2300 [ 301.288710][T13811] do_group_exit+0x21c/0x2d0 [ 301.293282][T13811] __x64_sys_exit_group+0x3f/0x40 [ 301.298290][T13811] x64_sys_call+0x21f7/0x2200 [ 301.302955][T13811] [ 301.305258][T13811] Memory state around the buggy address: [ 301.310865][T13811] ffff8880548d4a80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 301.318923][T13811] ffff8880548d4b00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 301.326965][T13811] >ffff8880548d4b80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 301.335005][T13811] ^ [ 301.340613][T13811] ffff8880548d4c00: fb fb fb fb fc fc fc fc fc fc fc fc fc fc fc fc [ 301.348658][T13811] ffff8880548d4c80: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb [ 301.356702][T13811] ================================================================== [ 301.402169][T13811] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 301.409405][T13811] CPU: 0 UID: 0 PID: 13811 Comm: syz.3.1945 Not tainted syzkaller #0 PREEMPT(full) [ 301.418784][T13811] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 301.428845][T13811] Call Trace: [ 301.432128][T13811] [ 301.435061][T13811] dump_stack_lvl+0x99/0x250 [ 301.439657][T13811] ? __asan_memcpy+0x40/0x70 [ 301.444257][T13811] ? __pfx_dump_stack_lvl+0x10/0x10 [ 301.449464][T13811] ? __pfx__printk+0x10/0x10 [ 301.454073][T13811] vpanic+0x281/0x750 [ 301.458060][T13811] ? preempt_schedule+0xae/0xc0 [ 301.462921][T13811] ? __pfx_vpanic+0x10/0x10 [ 301.467426][T13811] ? preempt_schedule_common+0x83/0xd0 [ 301.472895][T13811] ? preempt_schedule+0xae/0xc0 [ 301.477752][T13811] ? __pfx_preempt_schedule+0x10/0x10 [ 301.483134][T13811] panic+0xb9/0xc0 [ 301.486858][T13811] ? __pfx_panic+0x10/0x10 [ 301.491276][T13811] ? _raw_spin_unlock_irqrestore+0xfd/0x110 [ 301.497180][T13811] ? xfrm_state_find+0x2cf2/0x5400 [ 301.502296][T13811] check_panic_on_warn+0x89/0xb0 [ 301.507240][T13811] ? xfrm_state_find+0x2cf2/0x5400 [ 301.512339][T13811] end_report+0x78/0x160 [ 301.516568][T13811] kasan_report+0x129/0x150 [ 301.521059][T13811] ? xfrm_state_find+0x2cf2/0x5400 [ 301.526158][T13811] xfrm_state_find+0x2cf2/0x5400 [ 301.531081][T13811] ? __pfx___find_rr_leaf+0x10/0x10 [ 301.536268][T13811] ? xfrm_state_find+0x1da/0x5400 [ 301.541280][T13811] ? __pfx_xfrm_state_find+0x10/0x10 [ 301.546550][T13811] ? __rt6_find_exception_rcu+0x127/0x4c0 [ 301.552255][T13811] ? __pfx___rt6_find_exception_rcu+0x10/0x10 [ 301.558309][T13811] xfrm_resolve_and_create_bundle+0x768/0x2f80 [ 301.564464][T13811] ? ip6_pol_route+0x162/0x1180 [ 301.569304][T13811] ? __pfx_ip6_pol_route+0x10/0x10 [ 301.574399][T13811] ? __pfx_xfrm_resolve_and_create_bundle+0x10/0x10 [ 301.580971][T13811] ? __lock_acquire+0xab9/0xd20 [ 301.585820][T13811] ? xfrm_sk_policy_lookup+0x9d/0x750 [ 301.591272][T13811] ? xfrm_sk_policy_lookup+0x9d/0x750 [ 301.596638][T13811] ? xfrm_expand_policies+0x41f/0x6a0 [ 301.601998][T13811] xfrm_lookup_with_ifid+0x2a7/0x1a70 [ 301.607356][T13811] ? __pfx_ip6_dst_lookup_tail+0x10/0x10 [ 301.612995][T13811] ? __pfx_xfrm_lookup_with_ifid+0x10/0x10 [ 301.618807][T13811] ? txopt_get+0x335/0x3f0 [ 301.623223][T13811] ? aa_label_sk_perm+0x4cd/0x630 [ 301.628240][T13811] ? __pfx_txopt_get+0x10/0x10 [ 301.633001][T13811] xfrm_lookup_route+0x3c/0x1c0 [ 301.637843][T13811] rawv6_sendmsg+0xdab/0x1820 [ 301.642511][T13811] ? __pfx_rawv6_sendmsg+0x10/0x10 [ 301.647607][T13811] ? finish_task_switch+0x266/0x950 [ 301.652810][T13811] ? __pfx_aa_sk_perm+0x10/0x10 [ 301.657679][T13811] ? sock_rps_record_flow+0x19/0x410 [ 301.662966][T13811] ? inet_sendmsg+0x2f4/0x370 [ 301.667642][T13811] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 301.672934][T13811] __sock_sendmsg+0x19c/0x270 [ 301.677621][T13811] ____sys_sendmsg+0x52d/0x830 [ 301.682391][T13811] ? __pfx_____sys_sendmsg+0x10/0x10 [ 301.687684][T13811] ? import_iovec+0x74/0xa0 [ 301.692185][T13811] ___sys_sendmsg+0x21f/0x2a0 [ 301.696860][T13811] ? __pfx____sys_sendmsg+0x10/0x10 [ 301.702068][T13811] ? __fget_files+0x2a/0x420 [ 301.706645][T13811] ? __fget_files+0x3a0/0x420 [ 301.711314][T13811] __sys_sendmmsg+0x227/0x430 [ 301.715981][T13811] ? __pfx___sys_sendmmsg+0x10/0x10 [ 301.721189][T13811] ? do_futex+0x333/0x420 [ 301.725515][T13811] ? rcu_is_watching+0x15/0xb0 [ 301.730263][T13811] __x64_sys_sendmmsg+0xa0/0xc0 [ 301.735127][T13811] do_syscall_64+0xfa/0x3b0 [ 301.739621][T13811] ? lockdep_hardirqs_on+0x9c/0x150 [ 301.744801][T13811] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 301.750848][T13811] ? clear_bhb_loop+0x60/0xb0 [ 301.755512][T13811] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 301.761392][T13811] RIP: 0033:0x7f710df8ebe9 [ 301.765812][T13811] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 301.785415][T13811] RSP: 002b:00007f710eddc038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 301.793831][T13811] RAX: ffffffffffffffda RBX: 00007f710e1c5fa0 RCX: 00007f710df8ebe9 [ 301.801794][T13811] RDX: 0000000000000021 RSI: 0000200000000480 RDI: 0000000000000005 [ 301.809755][T13811] RBP: 00007f710e011e19 R08: 0000000000000000 R09: 0000000000000000 [ 301.817733][T13811] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 301.825691][T13811] R13: 00007f710e1c6038 R14: 00007f710e1c5fa0 R15: 00007fff00d42a58 [ 301.833657][T13811] [ 301.836834][T13811] Kernel Offset: disabled [ 301.841137][T13811] Rebooting in 86400 seconds..