last executing test programs: 14.511113876s ago: executing program 1 (id=3161): r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000540)={&(0x7f00000002c0)=@newlink={0x40, 0x10, 0xff05, 0x0, 0x0, {0x0, 0x0, 0x4a00}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @erspan={{0xb}, {0x4}}}, @IFLA_ADDRESS={0xa, 0x1, @link_local}]}, 0x40}, 0x1, 0x0, 0x0, 0x45844}, 0x0) socketpair(0x18, 0x80000, 0x1, &(0x7f0000000000)) 14.225534386s ago: executing program 1 (id=3163): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000500), 0x2841, 0x0) close(r3) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) sendmsg$nl_route_sched(r4, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x20040084) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r6 = socket(0x400000000010, 0x3, 0x0) sendmsg$nl_route_sched(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000900)=@newtfilter={0x894, 0x2c, 0xd3f, 0x10bd2d, 0x25dfdbfd, {0x0, 0x0, 0x0, r2, {0xfffd, 0xfff3}, {}, {0x8, 0xffe0}}, [@filter_kind_options=@f_basic={{0xa}, {0x864, 0x2, [@TCA_BASIC_POLICE={0x860, 0x4, [@TCA_POLICE_PEAKRATE={0x404, 0x3, [0x0, 0x3, 0x3, 0x0, 0x0, 0x0, 0x3, 0x3ff, 0x2, 0x7, 0xfffffff7, 0x7, 0x2a3c14c8, 0x0, 0x140, 0x9cd0, 0x78e, 0x8, 0x9, 0x2, 0x80000000, 0x5, 0x80000000, 0x9, 0x1ff, 0xfff, 0x27, 0x52a67a94, 0xf, 0x1, 0x0, 0xfffffffe, 0x6, 0x0, 0x2, 0x800, 0x8, 0x2, 0xffffffad, 0x8, 0x68, 0x0, 0x10000, 0x7ff, 0x7, 0xffffff64, 0x4, 0x9, 0x7, 0x5, 0x14000000, 0xffff, 0x2, 0x1ff, 0x4, 0xffff5edc, 0x8, 0x4, 0x81, 0x5, 0x94c, 0x1cf, 0x10000000, 0x3, 0x6, 0xfffffffb, 0x1, 0x2, 0x7, 0x1, 0x6, 0x0, 0xa, 0xf43, 0xa, 0x4, 0x5, 0x1, 0xfeb9, 0x3ff, 0x100, 0x2, 0x2, 0x8, 0x0, 0x24000000, 0x4, 0x80000000, 0x6, 0xac5, 0x9, 0xffb, 0x2, 0x67, 0xa, 0x9, 0x5, 0x7fffffff, 0xfffffff8, 0x86, 0x0, 0x0, 0x8ac7, 0x5, 0x78, 0x9, 0xc, 0x6, 0x400, 0x20, 0x5, 0xffffffdf, 0x389, 0x3, 0x1e800000, 0x80000001, 0x4a, 0xff, 0x2, 0x3, 0x1ff, 0x9, 0x4, 0x6, 0x2, 0x7, 0x8001, 0x2, 0x263, 0xb, 0x8, 0x6, 0x6, 0x9, 0x6, 0xa, 0x13d, 0x9, 0x3fed, 0x2, 0x4, 0x2, 0x101, 0x4, 0x7, 0x240, 0x4, 0x5, 0x1, 0xfffffffb, 0x1, 0x800, 0x7fffffff, 0x8fc, 0x2, 0x68a4, 0x600000, 0x6, 0x4, 0x8, 0x4, 0x37, 0xa, 0x9, 0x3, 0x5, 0x8, 0x100, 0x7, 0x101, 0x6, 0x7, 0x7, 0x3, 0x2, 0x3, 0x8, 0x9, 0x0, 0xd6, 0x4ad, 0x7, 0x9, 0x2, 0x0, 0x7e6, 0x54d6, 0x2, 0x3, 0x8, 0x1, 0xf32, 0xffff, 0xb2, 0x0, 0x6, 0x7, 0x8, 0x1, 0x4, 0x7, 0x9, 0x959a, 0x0, 0x7, 0x2, 0x4, 0x7f, 0x2, 0x80000000, 0x10000, 0x10, 0x6, 0x2, 0x4, 0x1000, 0x8, 0x9, 0xfffffffc, 0xe6, 0x2, 0x9, 0x4, 0x1, 0x4, 0x9, 0xff, 0x9, 0x9, 0xb, 0x3, 0x7fff, 0x200, 0x5, 0xca1, 0x7f, 0xe, 0x1, 0x1000, 0xfff, 0x5, 0xc1, 0x0, 0x7, 0x40, 0x7fffffff, 0x1, 0x7, 0x6, 0x8, 0xe9375e5, 0x8cf5, 0x7, 0xdf0d, 0x2, 0xfffffffb]}, @TCA_POLICE_RATE64={0xc, 0x8, 0x9}, @TCA_POLICE_RATE={0x404, 0x2, [0x4, 0x10, 0xd, 0xd36, 0x4, 0x6bc, 0x2, 0x7, 0xf, 0x800, 0x7, 0x7, 0xe7f, 0xffff, 0x7, 0x5, 0x1, 0x0, 0x4, 0x909e, 0x89cd, 0xffffffff, 0x8, 0x9, 0x4, 0x5, 0x2, 0x8, 0x4, 0xf23, 0x3ff, 0x9, 0xa, 0x5, 0x0, 0xff, 0x7f, 0x4, 0x0, 0x3, 0x382, 0x40, 0x80, 0x8, 0x2, 0x5, 0x2, 0x9, 0x7, 0x4, 0x0, 0x7, 0x80000000, 0x80000001, 0x8000, 0x9e, 0xe4, 0x200000, 0x7fffffff, 0x5a, 0x9, 0xfffffff7, 0x4, 0x6, 0x6, 0x459, 0x2, 0xff, 0x14000000, 0x5f72, 0x3, 0x8, 0x7, 0x5, 0x0, 0x6, 0x0, 0x6, 0x1000, 0xffffffff, 0x101, 0x2, 0x5, 0x7, 0x9, 0x1000, 0x9, 0x3, 0xfbb4, 0x4a, 0x0, 0x7, 0x8, 0x9, 0x0, 0x7, 0x101, 0x0, 0x3ff, 0x5, 0x800, 0x7fffffff, 0x2, 0x1, 0x3, 0x4, 0xffff, 0x5, 0x19, 0x6c, 0x9, 0x7fffffff, 0xceb6, 0x5, 0x7, 0x53c0, 0x6, 0x4, 0x9, 0x1, 0x9, 0x2, 0x7, 0x8, 0x3, 0x3ff, 0x1, 0x6, 0xffffff7b, 0x15ef7157, 0x4, 0x5, 0x2, 0x7, 0x7fffffff, 0xdb5, 0x1000, 0x800, 0x8, 0x80000000, 0x100, 0x7, 0x3fd1, 0x40, 0x1000, 0x3, 0xfffffffb, 0x5270e9b, 0x5, 0x7f, 0x9, 0x40, 0x9, 0x3, 0x0, 0x9, 0x8, 0x7, 0x1, 0x7, 0x3, 0x9, 0x0, 0xfe23, 0x6, 0x5, 0x8, 0xffffff7f, 0x3, 0xd, 0x80, 0x4, 0x9, 0x4, 0xff, 0x8001, 0x78, 0x80, 0x72e, 0x5c, 0x1, 0xb0, 0x6, 0x8, 0x9, 0x0, 0x80000001, 0x8, 0x4, 0x4, 0x0, 0x1, 0x1, 0x59ac, 0xebda, 0x7, 0x10000, 0x4, 0x100, 0x0, 0x7, 0x138, 0x1, 0x8, 0xcb18, 0x0, 0xb, 0x5, 0xe489, 0x8, 0x5, 0x6, 0x8d03, 0x1800000, 0x80000000, 0xc4800000, 0x4251, 0x7fff, 0x8001, 0x6, 0x7, 0x5, 0x3, 0x4, 0x371, 0xaa67, 0x2, 0x0, 0x10, 0x8, 0x5a8, 0x400, 0x0, 0x4, 0xf, 0x8, 0x9, 0xc2b3, 0x0, 0x7fffffff, 0xfffffffa, 0x9, 0x3ff, 0x6, 0x7, 0x5, 0x7, 0x4, 0xc, 0x9, 0x1, 0x0, 0x10000, 0x4, 0x4, 0x8]}, @TCA_POLICE_TBF={0x3c, 0x1, {0x4, 0x8, 0x6, 0x4d2, 0x2, {0x8, 0x0, 0xa, 0x8, 0x8, 0x9}, {0x4, 0x0, 0xa380, 0x7ff, 0x5, 0x7d487c2b}, 0x9, 0x4}}, @TCA_POLICE_PEAKRATE64={0xc, 0x9, 0x4}]}]}}]}, 0x894}, 0x1, 0x0, 0x0, 0x10}, 0x8080) bind$xdp(0xffffffffffffffff, &(0x7f0000000080)={0x2d, 0xf, 0x0, 0xc}, 0x10) r7 = socket$kcm(0x11, 0x3, 0x0) sendmsg$kcm(r7, &(0x7f0000000340)={&(0x7f0000000140)=@xdp={0x2c, 0x8, r2, 0x3c}, 0x80, &(0x7f0000000680)=[{&(0x7f0000000380)='\x00', 0x5dc}], 0x1}, 0x4011) 10.04307088s ago: executing program 1 (id=3192): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000540)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000030000000900010073797a300000000040000000030a03000000020000000000030000000900030073797a30000000000900010073797a300000000014000480080002406375fd82080001400000000028000000000a01040000000000000000030000000900010073797a3000000000080002400000000114000000110001"], 0xb0}}, 0x0) (async) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) (async) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_FEATURES_SET(r1, &(0x7f0000002540)={0x0, 0x0, &(0x7f0000002500)={&(0x7f00000000c0)={0x38, r2, 0x1, 0x0, 0x0, {}, [@ETHTOOL_A_FEATURES_WANTED={0xc, 0x3, 0x0, 0x1, [@ETHTOOL_A_BITSET_SIZE={0x8}]}, @ETHTOOL_A_FEATURES_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_bond\x00'}]}]}, 0x38}}, 0x0) (async) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$netlink(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000005d00)={0x114, 0x20, 0x1, 0x0, 0x25dfdbfb, "", [@nested={0x101, 0x117, 0x0, 0x1, [@typed={0xc, 0x16, 0x0, 0x0, @u64=0xfac06}, @typed={0x14, 0x1, 0x0, 0x0, @ipv6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, @generic="50bb2d6f67d29d6fabadb107d0def49c88ea04abde1d5e8d3fb22a1b5046778bdafefc46b0449ade68bf84b36ec72dd71265fc2e882348c26c2126237dd5b37f5ae655b1086cda40e00aec58754734be31d750351dc076eb43d9621dc08c029d1608a46cf26fbe816b89f7cb81bff81a8b9482565856555ee923c65973deb0a99b962bc0fe94a3fcae3697bd7b85b3a682167c43dbf137115a40ebddcad74875ec58e9a3ddb9ad02a078cf0d972df9e99f079767734f69ce475f00ac64337803f5eb4e5842f4d98fe3fa370d47eb640dc5061dc35817c8a66c", @typed={0x4, 0xeb}]}]}, 0x114}], 0x1, 0x0, 0x0, 0x1}, 0x0) 8.451779314s ago: executing program 1 (id=3206): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000380)={0x2, 0x4e22, @multicast1}, 0x10) (async, rerun: 64) r1 = socket(0x10, 0x3, 0x0) (rerun: 64) sendto$inet6(r1, &(0x7f0000000400)="7800000018002507b9409b14ffff00000204be04020506050e020409430009003f000c200a0003000d0085a168d0bf46d32345653600648d0a08000000000a0000005ade4a460c89b6ec0cff3959547f509058ba86c902000000004a32000400160012000a0000000000e000e218d1ddf66ed538f25232508d", 0x79, 0x0, 0x0, 0x0) (async) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(r2, 0x29, 0x1a, &(0x7f00000007c0)=0x40000401, 0x4) (async) bind$inet6(r2, &(0x7f0000000140)={0xa, 0x4e22, 0x0, @empty, 0xffffffff}, 0x1c) (async) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000001d80)=@newtaction={0x898, 0x30, 0xffff, 0x70bd29, 0x0, {}, [{0x884, 0x1, [@m_police={0x880, 0x1, 0x0, 0x0, {{0xb}, {0x854, 0x2, 0x0, 0x1, [[@TCA_POLICE_PEAKRATE64={0xc, 0xb, 0xffffffffffffffff}, @TCA_POLICE_RATE={0x404, 0x2, [0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x4, 0x1, 0x5c4, 0x4000, 0x0, 0x0, 0x8, 0x0, 0x7ff, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0x0, 0x400000, 0x0, 0x0, 0x6, 0x0, 0x8000, 0x5, 0x0, 0x4e16, 0x0, 0x0, 0x0, 0x0, 0x101, 0x0, 0x0, 0x2, 0x8, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000002, 0x0, 0xd9, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, 0x4, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0xfffffffe, 0x0, 0x0, 0x100000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x12, 0x0, 0x6, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x8a, 0x0, 0x2, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb7fe6bd0, 0x6, 0x1ffffffe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x98, 0x0, 0x0, 0x0, 0x0, 0x10000, 0x0, 0x0, 0x1, 0x0, 0x0, 0x2, 0xfffffffc, 0x0, 0xfffffffc, 0x0, 0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x12bc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x10, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x4, 0x800000, 0x0, 0x0, 0x0, 0x0, 0x2, 0x2]}, @TCA_POLICE_PEAKRATE={0x404, 0x3, [0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x402, 0x0, 0xfffffffc, 0x3, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x3a4f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0xfffffffd, 0x0, 0x4, 0x0, 0x0, 0x0, 0x894e, 0x0, 0x5, 0x3, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x4000000, 0x9, 0x8000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa77, 0x0, 0x4000000, 0x9, 0x0, 0x7fd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400400, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x7, 0x0, 0x10, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x3, 0xfffffffe, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffff9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x3, 0xfffffffd, 0x0, 0x0, 0x0, 0x4, 0x80000, 0x0, 0x0, 0x319e, 0x4, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x12, 0x0, 0xfffffbfc, 0x3, 0x4, 0x20000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x404]}, @TCA_POLICE_TBF={0x3c, 0x1, {0x0, 0x0, 0x0, 0xfffffffd, 0x0, {0x3, 0x0, 0xd9f9, 0x0, 0x0, 0x5}, {0x6, 0x0, 0x0, 0x3, 0x0, 0xff}, 0x0, 0xfffffffe}}]]}, {0x4}, {0xc, 0xb}, {0xc, 0xa}}}]}]}, 0x898}}, 0x0) (async) r4 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000280)={'tunl0\x00', &(0x7f00000001c0)={'ip_vti0\x00', 0x0, 0x700, 0x20, 0x2, 0x9, {{0x1b, 0x4, 0x1, 0x25, 0x6c, 0x67, 0x0, 0x8d, 0x2f, 0x0, @multicast1, @dev={0xac, 0x14, 0x14, 0x37}, {[@end, @generic={0x83, 0x8, "c39efe48ea70"}, @noop, @ssrr={0x89, 0x7, 0x4d, [@broadcast]}, @ra={0x94, 0x4, 0x1}, @rr={0x7, 0x1f, 0xfa, [@rand_addr=0x64010101, @multicast2, @initdev={0xac, 0x1e, 0x0, 0x0}, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, @rand_addr=0x64010101, @broadcast]}, @noop, @timestamp={0x44, 0x20, 0xc9, 0x0, 0x2, [0xb, 0x88, 0x1, 0x9, 0xfffffff7, 0x0, 0x9]}]}}}}}) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r4, 0x89f3, &(0x7f00000003c0)={'erspan0\x00', &(0x7f0000000340)={'syztnl0\x00', r5, 0x700, 0x8, 0x4, 0x4, {{0xc, 0x4, 0x3, 0x5, 0x30, 0x64, 0x0, 0x40, 0x2f, 0x0, @local, @local, {[@ra={0x94, 0x4}, @noop, @timestamp_prespec={0x44, 0x14, 0x91, 0x3, 0x3, [{@initdev={0xac, 0x1e, 0x1, 0x0}, 0x5}, {@empty, 0xf1e}]}]}}}}}) (async) r6 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r6, 0x10e, 0xc, &(0x7f0000000040)={0x200000c0, 0xffffffff, 0xfffffff8}, 0x10) (async, rerun: 64) sendmsg$nl_route(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000180)=@ipv4_newroute={0x2c, 0x1a, 0x1, 0x800000, 0x0, {0x2, 0x20, 0x20}, [@RTA_DST={0x8, 0x1, @rand_addr=0x64010101}, @RTA_SRC={0x8, 0x2, @initdev={0xac, 0x1e, 0x0, 0x0}}]}, 0x2c}}, 0x4000) (rerun: 64) 4.907755247s ago: executing program 1 (id=3217): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x5}) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = socket(0xa, 0x801, 0x0) getsockopt(r2, 0x0, 0x40, &(0x7f0000b3ffac)=""/84, &(0x7f00000000c0)=0x54) r3 = syz_genetlink_get_family_id$nbd(&(0x7f0000000000), 0xffffffffffffffff) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) syz_genetlink_get_family_id$nfc(0x0, r1) sendmsg$NBD_CMD_CONNECT(r1, &(0x7f0000001ac0)={0x0, 0x0, &(0x7f0000001a80)={&(0x7f00000001c0)=ANY=[@ANYBLOB='|\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="0100ffffffff0000000001000000100007800c00018008000100", @ANYRES32=r4, @ANYBLOB="0c0005006c010000000000000c000200ff", @ANYRES32=r4], 0x7c}}, 0x20000000) ioctl$TUNSETPERSIST(r0, 0x400454c9, 0x1) r5 = socket$can_j1939(0x1d, 0x2, 0x7) setsockopt$SO_J1939_FILTER(r5, 0x6b, 0x1, &(0x7f0000000200)=[{0x0, 0x1, {0x2, 0xff, 0x1}, {0x0, 0xff, 0x1}, 0x0, 0x2}, {0x1, 0x3, {0x2, 0x0, 0x4}, {0x2}, 0xfe, 0x2}, {0x0, 0x3, {0x0, 0x0, 0x3}, {0x0, 0x1, 0x3}, 0xfd}, {0x1, 0x3, {0x1, 0x1, 0x1}, {0x0, 0xf0, 0x3}, 0x2, 0xff}, {0x2, 0x0, {0x2, 0xf0, 0x4}, {0x1, 0xff, 0x2}, 0x2, 0xfd}, {0x2, 0x3, {0x2, 0x1, 0x4}, {0x2, 0x1, 0x4}, 0xfd}, {0x3, 0x0, {}, {0x2, 0x367dcca9350f20f6}, 0x2, 0xfe}], 0xe0) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f00000001c0), r7) sendmsg$NLBL_UNLABEL_C_STATICREMOVEDEF(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000980)={0x40, r8, 0x1, 0x0, 0x4, {0x3, 0x74, 0x600}, [@NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'ip6gre0\x00'}, @NLBL_UNLABEL_A_IPV4ADDR={0x6, 0x7, @private=0xa010102}, @NLBL_UNLABEL_A_IPV4ADDR={0x8, 0x4, @rand_addr=0x64010101}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @broadcast}]}, 0x40}, 0x1, 0xffffffff00000003}, 0x4000010) ioctl$TUNATTACHFILTER(r0, 0x401054d5, 0x0) 3.455469845s ago: executing program 3 (id=3228): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2241, 0x0) (async) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x300000b, 0x4031, 0xffffffffffffffff, 0x0) (async) r1 = socket$inet(0x2, 0x3, 0x2) (async) r2 = epoll_create1(0x80000) epoll_wait(r2, &(0x7f000000affb)=[{}], 0x1, 0x7fff) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000000040)={0x2000001c}) (async) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x5005}) (async) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r3) (async) socket$kcm(0x10, 0x2, 0x0) (async) r4 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_STAT_SET(r4, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000280)={0x28, 0x1410, 0x1, 0x70bd2c, 0x25dfdbfe, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}, @RDMA_NLDEV_ATTR_STAT_COUNTER_ID={0x8, 0x4f, 0x3}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x1}]}, 0x28}, 0x1, 0x0, 0x0, 0x4000}, 0x4000c014) (async) r5 = socket$netlink(0x10, 0x3, 0x0) (async) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x1, 0x8, &(0x7f0000002fc0)=ANY=[@ANYBLOB="7a0af8ff75257078bfa100000000000007010000f8ffffffb702000005000000bf130000000000008500000006000000b700000000000000950000ff00000000b2595285faa6ead0169191d54f8196217fc560e2fc91f6da4dad4fdc2eb1b5986fc4a3f611a7c8edd3aa5d6ee7ab10b1a297cf52866651ddd73f30f2382f6cda4bfdd45be583823c0f09621f3c1c65ee19ee875daf45006a4c4ea5e15b2f9618d547244a22000000000000db453620ce72d75946c2b638d91dbef661962239c77edf2d34b12cd48a1b20fb7dd8432619f2c50d77bc0ea9b0af58e6fff4942eb613eff289026d5045ef76d7d864409eb2dc9518a09f4886afc26abba34635d0e8b598a51bc742135a6e1d33fe226c944bc76be40d435aa8b5208ff0df2db761014b1b999a12df6bee431a668135b8214afa5827b56a8074bf1e6cf5d84b35a3a3a4c66824fe12dbe20fcf50a194185b9e2d8b815fedb0d982936156be3cdda66fb977aef7c9cb92428ef25d9bf665bd60024c09e9eed544126fabe4cb8d826e1ec03cc492f5cad6227c94fea467aea7fa8b58abc37056433edf43fba5566a3e022034ac81fd48f9b7314ffa730017fbd37fdb23bc26992529402a520ef67e246415a6a8ca9d4aa797a95ca3314ded0d8a24abd57e042888a9141ab4e6c6b939aaefc248791464970c43120211b9bc82a85cd2fc18f535c7986c2d52ba62f74f00000000008000000000000000000000000040000000000000"], &(0x7f0000000100)='GPL\x00'}, 0x48) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000006c0)={r6, 0xe0, &(0x7f00000005c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240), ""/16, 0x0, 0x0, 0x0, 0x0, 0x6, 0x3, &(0x7f00000002c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f00000003c0)=[0x0, 0x0, 0x0], 0x0, 0x3a, &(0x7f0000000400)=[{}, {}, {}], 0x18, 0x10, &(0x7f0000000500), &(0x7f0000000540), 0x8, 0x62, 0x8, 0x8, &(0x7f0000000580)}}, 0x10) bind$packet(r5, &(0x7f0000000700)={0x11, 0x15, r7, 0x1, 0xaf, 0x6, @multicast}, 0x14) (async) setsockopt$sock_attach_bpf(r5, 0x1, 0x32, &(0x7f0000002900)=r6, 0x4) bind$netlink(r5, &(0x7f00000000c0)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) (async) sendmsg$AUDIT_TRIM(r5, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x10, 0x3f6, 0x10, 0x70bd27, 0x25dfdbfb, "", [""]}, 0x10}, 0x1, 0x0, 0x0, 0x8800}, 0x800) (async) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) (async) write$tun(r0, &(0x7f0000000280)={@void, @val={0x3, 0x3, 0x8, 0x3, 0x16, 0xc}, @ipv4=@generic={{0x5, 0x4, 0x1, 0xb, 0x24, 0x65, 0x0, 0x9, 0x84, 0x0, @private=0xa010101, @local}, "c7050804000000000200000001001504"}}, 0x2e) 1.426145404s ago: executing program 3 (id=3230): socket$inet6_udp(0xa, 0x2, 0x0) r0 = socket$pppl2tp(0x18, 0x1, 0x1) ioctl$PPPIOCGCHAN(r0, 0x80047437, &(0x7f0000000040)) r1 = socket$pppl2tp(0x18, 0x1, 0x1) r2 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r1, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @private=0xa010100}, 0x2, 0x0, 0x4}}, 0x2e) unshare(0x20040600) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x2, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000300000000000000feffff10850000000700000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x100, 0x70, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000180)={r3, 0x0, 0x30, 0x0, @val=@uprobe_multi={&(0x7f00000002c0)='./cgroup/cgroup.procs\x00', &(0x7f0000000280)=[0x0], 0x0, 0x0, 0x1}}, 0x40) bpf$LINK_GET_NEXT_ID(0x1f, &(0x7f0000000d00)={0x0, 0x0}, 0x8) r5 = bpf$LINK_GET_FD_BY_ID(0x1e, &(0x7f0000000000)=r4, 0x4) bpf$BPF_LINK_UPDATE(0x1d, &(0x7f0000000040)={r5}, 0x10) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000080), r6) r8 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(r8, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="01002cbd7010fddbdf2505000000080009000200000008000c00a80a0000060001000500000008000b"], 0x3c}}, 0x20000034) r9 = socket$nl_generic(0x10, 0x3, 0x10) r10 = syz_genetlink_get_family_id$ipvs(&(0x7f00000000c0), 0xffffffffffffffff) r11 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r11, &(0x7f0000000440)={0x900, 0x0, &(0x7f0000000400)={&(0x7f00000004c0)=ANY=[@ANYBLOB="020afc000700000028bdc16bafccdf25050007"], 0x38}}, 0x40408c0) sendmsg$IPVS_CMD_DEL_DAEMON(r9, &(0x7f0000000e00)={0x0, 0x0, &(0x7f0000000dc0)={&(0x7f0000000000)=ANY=[@ANYBLOB='T\x00\x00\x00', @ANYRES16=r10, @ANYBLOB="05062bbd7000ffdbdf250a00000040000380060007004e240000080001"], 0x54}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) r13 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r13) r14 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r14, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) r15 = bpf$MAP_CREATE(0x0, &(0x7f0000000500)=ANY=[@ANYRESDEC=0x0, @ANYRES32, @ANYBLOB="2000000000000008000000000000000000000000468c17e3e386cdcfc7043c3869a3e7cc12e4529f74526446b1c32c42e976b7edff6f35fd1c20134321d3d5df1e4e42f80aa9aa30df4bff57dcb9bf5272480912ddeb99fd6ab83cedbf97425a2fd35acf", @ANYRES32=r6, @ANYRESOCT=r12, @ANYBLOB='\x00'/28], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xc, 0x14, &(0x7f00000002c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r15, @ANYBLOB="0000000000000000b7080000fcffffff7b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000001000000180100002020732500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000400000095"], &(0x7f0000000240)='GPL\x00', 0xfffffffc, 0x0, 0x0, 0x0, 0x14, '\x00', 0x0, @fallback=0x27, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$pppl2tp_PPPOL2TP_SO_DEBUG(r1, 0x111, 0x1, 0x0, 0x4) r16 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r16, 0x8933, &(0x7f00000001c0)={'batadv_slave_0\x00'}) 1.413427498s ago: executing program 0 (id=3231): syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) r0 = socket(0x8, 0x800, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000380)}, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(r0, 0x84, 0x14, &(0x7f0000000000)=@assoc_value, &(0x7f0000001080)=0x8) setsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(0xffffffffffffffff, 0x84, 0x83, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6, 0x0, &(0x7f00000000c0)) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000000200), 0xffffffffffffffff) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=ANY=[@ANYBLOB="3000000010000100"/20, @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=0x0, @ANYBLOB="08001b"], 0x30}}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_rx_ring(r5, 0x107, 0x5, &(0x7f0000000040)=@req3={0x1000, 0x3a, 0x1000, 0x3a, 0x4bd1bfda, 0x0, 0x6}, 0x1c) socket(0x40000000015, 0x5, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r4, 0x8933, &(0x7f0000000000)={'team0\x00', 0x0}) sendmsg$nl_route(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x3c, 0x10, 0x7, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x10104, 0xa01}, [@IFLA_IFNAME={0x14, 0x3, 'xfrm0\x00'}, @IFLA_MASTER={0x8, 0xa, r6}]}, 0x3c}}, 0x0) sendmsg$TIPC_CMD_ENABLE_BEARER(r1, &(0x7f0000000440)={0x0, 0xa1ff, &(0x7f0000000400)={&(0x7f0000000280)={0x34, r2, 0x1, 0x0, 0x25dfdbff, {{}, {0x21000000}, {0x18, 0x17, {0x0, 0x0, @l2={'eth', 0x3a, 'team0\x00'}}}}}, 0x34}}, 0x0) 1.279713114s ago: executing program 1 (id=3233): r0 = syz_init_net_socket$x25(0x9, 0x5, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000040)={'dummy0\x00', &(0x7f00000000c0)=@ethtool_cmd={0x2, 0x40, 0x4, 0x7, 0x7f, 0x1, 0x9f, 0xc0, 0x72, 0x6, 0x5, 0x31, 0x10, 0x5, 0xb5, 0x0, [0x2, 0x2]}}) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=ANY=[@ANYBLOB="140000001000009006000000000000000300000a38000000020a01020000000000000000010000020c000440000000000000ed000900010073797a31000000000c0004400000000000000001140000001100010000000000000000000084000a"], 0x60}, 0x1, 0x0, 0x0, 0x8805}, 0x810) socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000400)="d800000019008111e00212ba0d8105040a603f00ff0f040b067c55a1bc000900080006990300000015000500fe8081780d000500030001400200000901ac040000d67f6f94007100a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4b11602b2a10c11ce1b14d6d930dfe1d9d322fe04000000730d7a5025ccca262f3d40fad95667e04adcdf634c1f215ce3bb9ad809d5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92307f00000e970300"/216, 0xd8}], 0x1}, 0x40000) r2 = socket(0x400000000010, 0x3, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0xa8442, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) r5 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000440)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000340)=@newqdisc={0x78, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0x25dfdbfb, {0x0, 0x0, 0x0, r6, {0x0, 0x7ffe}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_sfq={{0x8}, {0x4c, 0x2, {{0x20000002, 0x8, 0xfffffffb, 0x2, 0x2}, 0x5, 0x1, 0x80000000, 0x2, 0x8, 0x17, 0x2, 0x1, 0x0, 0xe, {0x0, 0x7fff, 0x225, 0x3, 0x9, 0x4}}}}]}, 0x78}}, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000280)=@newtfilter={0x94, 0x2c, 0xd27, 0x170bd2b, 0x2, {0x0, 0x0, 0x0, r6, {0x0, 0x10}, {}, {0x8, 0xffe0}}, [@filter_kind_options=@f_flow={{0x9}, {0x64, 0x2, [@TCA_FLOW_MODE={0x8, 0x2, 0x1}, @TCA_FLOW_KEYS={0x8, 0x1, 0x1a29d}, @TCA_FLOW_ACT={0x50, 0x9, 0x0, 0x1, [@m_csum={0x4c, 0x1, 0x0, 0x0, {{0x9}, {0x20, 0x2, 0x0, 0x1, [@TCA_CSUM_PARMS={0x1c, 0x1, {{0x2c3f, 0x3, 0x20000000, 0x2, 0x6}, 0x1e}}]}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x1, 0x1}}}}]}]}}]}, 0x94}, 0x1, 0x0, 0x0, 0x884}, 0x40) socket(0x10, 0x3, 0x0) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r7 = socket$kcm(0x11, 0x3, 0x0) setsockopt$sock_attach_bpf(r7, 0x107, 0xf, &(0x7f0000000600), 0x56) sendmsg$kcm(r7, &(0x7f00000000c0)={&(0x7f00000004c0)=@xdp={0x2c, 0x0, r6, 0x18}, 0x80, &(0x7f00000008c0)=[{&(0x7f00000001c0)="27030200dc0f14000e0005000014c10200000001125ce882cbf400930bf4533f00429c65112a093bbf60b85bcb06", 0x2e}], 0x1}, 0x4005) r8 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000140)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000540)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd27, 0xffffffff, {0x0, 0x0, 0x0, r9, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xfff3}}, [@qdisc_kind_options=@q_qfg={0x8}]}, 0x2c}}, 0x0) r10 = syz_genetlink_get_family_id$nl80211(&(0x7f00000003c0), 0xffffffffffffffff) r11 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r11, 0x8933, &(0x7f0000000540)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_KEY(r11, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB='|\x00\x00\x00', @ANYRES16=r10, @ANYBLOB="010829bd7000000000000b00000008000300", @ANYRES32=r12, @ANYBLOB="60005080110001004abee339084eeef16f162471f40000000800030002ac0f000500020007"], 0x7c}, 0x1, 0x0, 0x0, 0x4}, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000140)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_GET_MPP(r2, &(0x7f0000000500)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000003c0)={&(0x7f0000000300)={0x94, r10, 0x300, 0x70bd28, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r13}, @val={0xc, 0x99, {0x6, 0x52}}}}, [@NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @device_b}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @device_b}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @broadcast}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @device_b}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @broadcast}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @device_b}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}]}, 0x94}}, 0x4000000) socket$nl_xfrm(0x10, 0x3, 0x6) 1.148259241s ago: executing program 4 (id=3234): sendmsg$NL802154_CMD_SET_CHANNEL(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="36d5aac5", @ANYRES16=0x0, @ANYBLOB="020025bd7000fedbdf25090000000800010001000000050008000000000005000700170000000500070012000000"], 0x34}, 0x1, 0x0, 0x0, 0x40c1}, 0x8000) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)={0x14, 0x3b, 0x1, 0x70bd27, 0x25dfdbfd, {0xc}}, 0x14}, 0x1, 0x0, 0x0, 0x48c1}, 0x20040000) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)=ANY=[@ANYRES8=r1], 0xe0}}, 0x0) r2 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_RES_MR_GET(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="200000001a1401"], 0x20}}, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="3800000041000701fefffffffeffffff017c0000040042800c00018006000600800a000014000201000006800cd58ff7462ae7349c1f45530daf91dc8c57e47323ca1b1c4959ceced4a0d618ea90da266d769bc6befe4853b6f059e04f550de75d4ad22fc0261f780127bd6fd092d57b2ccc1030b319444a0005e14005f63e6050b1d19d7ee22510cba341441b2cdb0ceeefe36f96ef"], 0x38}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$wireguard(&(0x7f00000003c0), 0xffffffffffffffff) sendmsg$WG_CMD_SET_DEVICE(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000002c80)={0x8c, r4, 0x1, 0x0, 0x0, {}, [@WGDEVICE_A_LISTEN_PORT={0x6, 0x6, 0x4e23}, @WGDEVICE_A_PRIVATE_KEY={0x24, 0x3, @b}, @WGDEVICE_A_IFNAME={0x14, 0x2, 'wg0\x00'}, @WGDEVICE_A_PEERS={0x38, 0x8, 0x0, 0x1, [{0x98, 0x0, 0x0, 0x1, [@WGPEER_A_FLAGS={0x8, 0x3, 0x1}, @WGPEER_A_PUBLIC_KEY={0x24, 0x1, @neg}, @WGPEER_A_ALLOWEDIPS={0x4}]}]}]}, 0x8c}, 0x1, 0x0, 0x0, 0x4004840}, 0x40000) sendmsg$WG_CMD_GET_DEVICE(r1, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x1c, r4, 0x200, 0x70bd2d, 0x25dfdbfb, {}, [@WGDEVICE_A_LISTEN_PORT={0x6, 0x6, 0x4e21}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20}, 0x10) 1.140896071s ago: executing program 0 (id=3235): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = accept(r0, &(0x7f0000000040)=@nfc, &(0x7f0000000100)=0x80) (async) r2 = syz_open_procfs$namespace(0x0, &(0x7f0000000180)='ns/time\x00') (async, rerun: 64) r3 = ioctl$NS_GET_PARENT(0xffffffffffffffff, 0xb702, 0x0) (rerun: 64) r4 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r4, 0x10f, 0x87, &(0x7f0000000000)={0x42, 0x1}, 0x10) r5 = socket$tipc(0x1e, 0x2, 0x0) bind$tipc(r5, &(0x7f0000000180)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x1, 0x5}}, 0x10) setsockopt$TIPC_GROUP_JOIN(r5, 0x10f, 0x87, &(0x7f0000000240)={0x42, 0x1}, 0x10) (async) bind$tipc(r4, 0x0, 0x0) (async) sendmsg$RDMA_NLDEV_CMD_SET(r1, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x2c, 0x1402, 0x0, 0x70bd2b, 0x25dfdbff, "", [@RDMA_NLDEV_ATTR_DEV_NAME={0x9, 0x2, 'syz0\x00'}, @RDMA_NLDEV_NET_NS_FD={0x8, 0x44, r2}, @RDMA_NLDEV_NET_NS_FD={0x8, 0x44, r3}]}, 0x2c}, 0x1, 0x0, 0x0, 0x24000000}, 0x20000081) (async, rerun: 32) r6 = socket$nl_route(0x10, 0x3, 0x0) (rerun: 32) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000000)=ANY=[@ANYBLOB="4c000000100001042abd7000fddbdf2500000000", @ANYRES32=0x0, @ANYBLOB="2001000097690400180012800b00010067656e657665000008000280040006001400030067656e65766531"], 0x4c}, 0x1, 0x0, 0x0, 0x10}, 0x2000000) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x3, 0x0, 0x0, {0x7}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x44, 0x9, 0xa, 0x401, 0x0, 0x0, {0x7}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz0\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0xd}, @NFTA_SET_USERDATA={0x7, 0xd, 0x1, 0x0, "63efee"}]}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x5, 0x84}}}, 0x8c}, 0x1, 0x0, 0x0, 0x20004010}, 0x20050800) (async, rerun: 64) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r2, 0xc0c89425, &(0x7f0000000280)={"0f77dd918a6ee7b24dd0b9912370d27c", 0x0, 0x0, {0x4, 0x401}, {0x7, 0x8}, 0x7, [0x100000001, 0x4, 0x7, 0x2, 0x7fffffff, 0x6, 0x0, 0x6, 0x8, 0x3, 0x61, 0x7, 0x8, 0xb, 0xc, 0xfffffffffffeffff]}) (rerun: 64) ioctl$BTRFS_IOC_RM_DEV_V2(r0, 0x5000943a, &(0x7f00000004c0)={{r1}, r7, 0x0, @unused=[0x400, 0x3, 0x1ff, 0x5], @subvolid=0x74}) 1.123795917s ago: executing program 3 (id=3236): r0 = bpf$OBJ_GET_PROG(0x7, &(0x7f0000000040)=@o_path={&(0x7f0000000000)='./file0\x00', 0x0, 0x8}, 0x18) ioctl$XFS_IOC_BULKSTAT(r0, 0x8040587f, &(0x7f00000002c0)={{0x5, 0x4, 0x5, 0x4, 0x7ff}, &(0x7f0000000080)=[{}, {}, {}]}) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$devlink(&(0x7f0000000380), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_TRAP_SET(r1, &(0x7f0000000540)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000500)={&(0x7f00000003c0)={0x11c, r2, 0x800, 0x70bd2d, 0x25dfdbfb, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x1c}, {0x5}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x1c}, {0x5, 0x83, 0x1}}, {@pci={{0x8}, {0x11}}, {0x1c}, {0x5}}, {@pci={{0x8}, {0x11}}, {0x1c}, {0x5}}]}, 0x11c}, 0x1, 0x0, 0x0, 0x10}, 0x80a0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r3, 0x6, 0xd, 0xfffffffffffffffd, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000005c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_LEAVE_MESH(r1, &(0x7f0000000680)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000640)={&(0x7f0000000600)={0x1c, 0x0, 0x100, 0x70bd2d, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r4}, @void}}, [""]}, 0x1c}, 0x1, 0x0, 0x0, 0x40810}, 0x814) r5 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$EBT_SO_GET_INFO(r5, 0x0, 0x80, &(0x7f00000006c0)={'nat\x00', 0x0, 0x0, 0x0, [0x7, 0x7, 0x935, 0xaff, 0x8, 0x657]}, &(0x7f0000000740)=0x78) r6 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000780), r6) setsockopt(r1, 0x5, 0x1, &(0x7f00000007c0), 0x0) r7 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000a00)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x7, '\x00', 0x0, 0xffffffffffffffff, 0x2, 0x3, 0x3}, 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000a80)={&(0x7f0000000800)="42f79a463eb049fd3a17dc730b0038cdadcb83c85569f073a335eff53b5c44d331699f9423f83022159f994ef8374aa32a752e42a43415e2ed6d8f6e187bbb12b8b0a026ddc1088f9c14231ed7a229063cb3aae257fc78fb0257f6e8fd4adc81a6232f6d1f1b2dbf041c4ecd5c0dbb3026f2cbe689efd129f2a54cc918b25d66508b05e73aa29253bb185368373018fff6943ec23fdc630f922c0a2ba049f94861e20c595fa9771042dea556e57895a000d27db028da1cc53e74047a5066b14baaa36faa379877c71bf31d1c9d65a21fa5087d479aeddb0435d610d246f8a510f9", &(0x7f0000000900)=""/43, &(0x7f0000000940)="23ef246078d52bc3ba6279393dd4f4cddf2fe0b042268e7656231af9fae4a90bf038f172c5afa30be57b0233d0f2cbfe50d0f1ffe041583323d06f", &(0x7f0000000980)="8202121b2f5caeb9b094758914eccc31f6bfd3156303554f7490036b12ec626881a49132b05b9f23e29e78281df20d52ff2480646b5c81f3e60338d71a4b64d1f6f3644f8047c2878e7e7b54012c41bcac81583d3cb033a2149ee71358d888a36f74b9e763e6a1f84cb3bcfb7a89f61d5d5a61346b00e5b8b74a0535691ca132", 0x4, r7}, 0x38) r8 = socket$inet(0x2, 0x800, 0x1) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000ac0)={'nr0\x00', 0x0}) setsockopt$inet6_int(r3, 0x29, 0x4e, &(0x7f0000000b00), 0x4) bind$netlink(r6, &(0x7f0000000b40)={0x10, 0x0, 0x25dfdbfd, 0x2000000}, 0xc) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r0, 0x89f8, &(0x7f0000000c40)={'tunl0\x00', &(0x7f0000000b80)={'gre0\x00', r9, 0x80, 0x8000, 0xad8, 0x98ac, {{0x24, 0x4, 0x2, 0x6, 0x90, 0x65, 0x0, 0x6, 0x4, 0x0, @empty, @local, {[@ssrr={0x89, 0x13, 0x1a, [@multicast2, @loopback, @multicast1, @multicast2]}, @timestamp={0x44, 0x18, 0x36, 0x0, 0x7, [0x9308, 0x88, 0x3, 0x4, 0x8001]}, @noop, @ra={0x94, 0x4, 0x1}, @rr={0x7, 0x17, 0xa2, [@local, @multicast2, @private=0xa010102, @multicast1, @multicast2]}, @generic={0x7, 0xd, "21856b8d5c97ce30d8025e"}, @ssrr={0x89, 0x7, 0x47, [@broadcast]}, @timestamp_prespec={0x44, 0x14, 0x3f, 0x3, 0x8, [{@empty, 0x6bb6}, {@multicast1, 0x10}]}, @timestamp_addr={0x44, 0xc, 0x5e, 0x1, 0xe, [{@local, 0x8}]}]}}}}}) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, &(0x7f0000000dc0)={r5}) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000d80)={@fallback=r10, 0x0, 0x1, 0x3, &(0x7f0000000c80)=[0x0, 0x0, 0x0], 0x3, 0x0, &(0x7f0000000cc0)=[0x0, 0x0, 0x0], &(0x7f0000000d00)=[0x0], &(0x7f0000000d40)=[0x0, 0x0, 0x0, 0x0, 0x0]}, 0x40) r11 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r12 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000e40), 0xffffffffffffffff) sendmsg$IEEE802154_ASSOCIATE_REQ(r11, &(0x7f0000000f40)={&(0x7f0000000e00)={0x10, 0x0, 0x0, 0x19d7c5eb7020ebde}, 0xc, &(0x7f0000000f00)={&(0x7f0000000e80)={0x5c, r12, 0x10, 0x70bd29, 0x25dfdbfd, {}, [@IEEE802154_ATTR_CAPABILITY={0x5, 0x11, 0xfd}, @IEEE802154_ATTR_COORD_SHORT_ADDR={0x6, 0x8, 0x1aabc}, @IEEE802154_ATTR_COORD_HW_ADDR={0xc, 0x9, {0xaaaaaaaaaaaa0302}}, @IEEE802154_ATTR_COORD_HW_ADDR={0xc, 0x9, {0xaaaaaaaaaaaa0302}}, @IEEE802154_ATTR_COORD_SHORT_ADDR={0x6, 0x8, 0xaaa1}, @IEEE802154_ATTR_COORD_PAN_ID={0x6, 0xa, 0xfffd}, @IEEE802154_ATTR_PAGE={0x5, 0x1d, 0x1a}, @IEEE802154_ATTR_COORD_SHORT_ADDR={0x6, 0x8, 0xaaa1}]}, 0x5c}, 0x1, 0x0, 0x0, 0x4040000}, 0x1) r13 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000fc0), r11) sendmsg$IEEE802154_START_REQ(0xffffffffffffffff, &(0x7f00000010c0)={&(0x7f0000000f80)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000001080)={&(0x7f0000001000)={0x5c, r13, 0x4, 0x70bd2c, 0x25dfdbfb, {}, [@IEEE802154_ATTR_PAGE={0x5, 0x1d, 0xb}, @IEEE802154_ATTR_PAN_COORD={0x5, 0x19, 0x9}, @IEEE802154_ATTR_COORD_REALIGN={0x5, 0x1b, 0xfc}, @IEEE802154_ATTR_SF_ORD={0x5}, @IEEE802154_ATTR_COORD_SHORT_ADDR={0x6, 0x8, 0xaaa0}, @IEEE802154_ATTR_PAN_COORD={0x5, 0x19, 0x5}, @IEEE802154_ATTR_COORD_PAN_ID={0x6, 0xa, 0xffff}, @IEEE802154_ATTR_COORD_SHORT_ADDR={0x6, 0x8, 0xaaa0}, @IEEE802154_ATTR_SF_ORD={0x5, 0x18, 0x7a}]}, 0x5c}, 0x1, 0x0, 0x0, 0x4}, 0x8000) sendmsg$DEVLINK_CMD_SB_PORT_POOL_GET(r10, &(0x7f0000001380)={&(0x7f0000001100)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000001340)={&(0x7f0000001140)={0x1f0, r2, 0x200, 0x70bd28, 0x25dfdbff, {}, [{{@pci={{0x8}, {0x11}}, {0x8, 0x3, 0x1}}, {0x8, 0xb, 0xffff0000}, {0x6, 0x11, 0xcc}}, {{@pci={{0x8}, {0x11}}, {0x8, 0x3, 0x1}}, {0x8, 0xb, 0x5}, {0x6, 0x11, 0x7}}, {{@pci={{0x8}, {0x11}}, {0x8}}, {0x8, 0xb, 0x4}, {0x6, 0x11, 0xb}}, {{@pci={{0x8}, {0x11}}, {0x8, 0x3, 0x1}}, {0x8, 0xb, 0xd}, {0x6, 0x11, 0x1}}, {{@pci={{0x8}, {0x11}}, {0x8}}, {0x8, 0xb, 0xf6}, {0x6, 0x11, 0xff}}, {{@pci={{0x8}, {0x11}}, {0x8, 0x3, 0x1}}, {0x8, 0xb, 0x8001}, {0x6, 0x11, 0x7}}, {{@pci={{0x8}, {0x11}}, {0x8, 0x3, 0x2}}, {0x8, 0xb, 0x4}, {0x6, 0x11, 0x7ff}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8}}, {0x8, 0xb, 0xffff}, {0x6, 0x11, 0x5}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8}}, {0x8, 0xb, 0x8}, {0x6, 0x11, 0x8}}]}, 0x1f0}, 0x1, 0x0, 0x0, 0x40001}, 0x810) sendmsg$nl_route(r10, &(0x7f0000001480)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x40040004}, 0xc, &(0x7f0000001440)={&(0x7f0000001400)=@getneightbl={0x14, 0x42, 0x220, 0x70bd2c, 0x25dfdbfb, {}, [""]}, 0x14}, 0x1, 0x0, 0x0, 0x24000080}, 0x8000) 949.255727ms ago: executing program 4 (id=3237): sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000340)=@migrate={0x138, 0x21, 0x1, 0x70bd2d, 0x0, {{@in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @in=@multicast1, 0x0, 0x0, 0x400, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0xffffffffffffffff}}, [@migrate={0xe8, 0x11, [{@in=@empty, @in=@broadcast, @in6=@mcast1, @in6=@dev={0xfe, 0x80, '\x00', 0x20}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa}, {@in6=@empty, @in6=@remote, @in=@loopback, @in=@dev={0xac, 0x14, 0x14, 0x1a}}, {@in=@empty, @in=@broadcast, @in=@empty, @in6=@loopback, 0x0, 0x0, 0x0, 0x3507, 0x0, 0xa}]}]}, 0x138}, 0x1, 0x0, 0x0, 0x20000881}, 0x0) 931.759184ms ago: executing program 0 (id=3239): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=@newqdisc={0x44, 0x24, 0x2, 0x70bd29, 0x25dfdc00, {0x60, 0x0, 0x0, 0x0, {0xfff1, 0xfff2}, {0x1, 0xc}, {0xfff3, 0x8}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x14, 0x2, [@TCA_CAKE_MEMORY={0x8, 0xa, 0x80008000}, @TCA_CAKE_FWMARK={0x8, 0x12, 0xffff7fff}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x44045}, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r2, 0x5, 0x0, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x3}]}, 0x24}, 0x1, 0x0, 0x0, 0x50}, 0x0) sendmsg$NL80211_CMD_START_AP(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x88, r2, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@beacon=[@NL80211_ATTR_BEACON_HEAD={0x45, 0xe, {{{}, {0x3}, @broadcast, @device_a, @from_mac=@broadcast}, 0x0, @default, 0x8848, @void, @val, @val={0x3, 0x1, 0x5c}, @val={0x4, 0x6, {0x31, 0xfc, 0x0, 0xef}}, @val={0x6, 0x2, 0x10}, @void, @void, @val={0x2a, 0x1, {0x1, 0x0, 0x1}}, @void, @void, @void, @val={0x71, 0x7, {0x1, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0, 0x54}}, @void}}, @NL80211_ATTR_FTM_RESPONDER={0xc, 0x10e, 0x0, 0x1, [@NL80211_FTM_RESP_ATTR_ENABLED={0x4}, @NL80211_FTM_RESP_ATTR_CIVICLOC={0x4}]}], @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x980}], @NL80211_ATTR_BEACON_INTERVAL={0x8}, @NL80211_ATTR_DTIM_PERIOD={0x8, 0xd, 0xfffffffd}]}, 0x88}, 0x1, 0x0, 0x0, 0x10}, 0x0) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(r1, &(0x7f0000000280)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x60, r4, 0x100, 0x70bd28, 0x25dfdbff, {}, [@MPTCP_PM_ATTR_ADDR_REMOTE={0x3c, 0x6, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @loopback}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @mcast2}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x2}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @multicast1}]}, @MPTCP_PM_ATTR_TOKEN={0x8, 0x4, 0xff}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x7}]}, 0x60}, 0x1, 0x0, 0x0, 0x20000040}, 0x40) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0000000000008000280012800a00010076786c616e"], 0x50}}, 0x4000084) 865.758006ms ago: executing program 4 (id=3240): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f00000000c0)={0x0, @in={{0x2, 0x4e23, @empty}}, 0x0, 0x2002, 0x40000002, 0x4, 0xa17433da3c5d6980, 0x2, 0x81}, 0x9c) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f00000004c0)={0x0, @in={{0x2, 0x4e22, @empty}}, 0xfffffff8, 0x40, 0xc, 0xffffffbb, 0x40, 0x1, 0x1}, &(0x7f00000003c0)=0x9c) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r1, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)=@base={0x1b, 0x0, 0x0, 0x8000, 0x80004}, 0x50) ioctl$FS_IOC_GET_ENCRYPTION_POLICY_EX(r2, 0xc0096616, &(0x7f0000000000)={0x3, [0x0, 0x0, 0x0]}) 786.933055ms ago: executing program 4 (id=3241): socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r0, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000400)=""/248, 0xf8}], 0x1}, 0x1f00) close(0x3) (async, rerun: 64) r2 = socket$inet6(0xa, 0x4, 0x6) (rerun: 64) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r3, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x1c, &(0x7f00000000c0)=[@in6={0xa, 0x4e20, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}]}, &(0x7f0000000180)=0x10) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r3, 0x84, 0x25, &(0x7f0000001500)={r4, @in6={{0xa, 0x4e20, 0x23, @loopback, 0x7}}, 0xffbe}, 0x90) sendmsg$tipc(r1, &(0x7f0000000240)={0x0, 0xfffffff5, &(0x7f0000000200)=[{&(0x7f0000000140)="a2", 0xfffffdef}], 0x1}, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r2, 0x81f8943c, &(0x7f0000000540)={0x0, ""/256, 0x0, 0x0, 0x0, 0x0, ""/16, ""/16, ""/16, 0x0}) (async, rerun: 64) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) (async, rerun: 64) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040), 0x200002, 0x0) r7 = openat$cgroup_devices(r6, &(0x7f0000000240)='devices.deny\x00', 0x2, 0x0) write$cgroup_devices(r7, &(0x7f0000000f80)=ANY=[@ANYBLOB='b *:* rwr'], 0x9) (async) ioctl$BTRFS_IOC_RM_DEV_V2(r1, 0x5000943a, &(0x7f00000015c0)={{r0}, r5, 0x12, @inherit={0x50, &(0x7f0000000740)={0x0, 0x1, 0x80000001, 0x0, {0x2c, 0x100000001, 0x882000, 0xeda, 0xfffffffffffffffc}, [0x2]}}, @name="0c116ece150565f7661839a06ccc95d0c98a238284b2528ea8453ae1360d42c4f4675503ca73d16e7daf24da4286c06033037322d34d11cd60819ae822fa4cf4b26220f3590163279a863c370b6ea2a3119e7ab55671a61c3f07082670fa26d79332cf591bbc7c90979b8fb7d9d24ec97476bcf48d45b0fa84108350b896bbbf290a9a1fe1355e15f26b14c6a7ce49c89c72eccf14321ba7495ca307b0536f6bf323fa49cddb2b1a117a4110f6bab3e2f5edec686156804ea863694af3f64a39bb2b2a4de3b68f60b788f5455db682529909213c83322cd70649208570d11b7d74661836621e2758c945991e8919a2cdafa1f287a6054bb7866b716b63985a93c8c270d08a6b011a36270edfb701145c67a896567b46fbd7cb42af2ba60fdb2cf97d15e579f1b5e48cfabb46ebe2e08c0cf247bb1e0fba4c8368185c4edf5640425f38a28298fda9ef2b8a48fac5a7966806a855e800304ae167f9a36c3fd15cbb65a9b8110a5dbccdbbe667dda6315d567c50e8899b7c617ae17160d7f039669ffb7155b877203722140ee106a2a4b94a8eeda61ad1faccee914a1ae32874a046582f8545374c97f242b3b3b34b46ec0a47fc86000c7785cea5ad0fd113fda3577effe6f23fb9a7b5bedf4c3f6ac2ef8543e392e5d4b97bee384254bdaf076a4a950db0d2e36e2addb90485048aa7e9582d7d1dd596b45d70bdd23d8f027f9099ea550ee7b8174cff0744c4ce9ea2fc86175ebe878a91b10164986887290e74e58e59930fe87c90f41713098f42596e9afecaf408f7d989bb500e02c6decfff084fc4c156409b084662eaa397ce879372cd1ab34bd3ffc9702cf4f11113f7b4a7d6d5be5b4df897621a07667001109be6dee82d6a64980601079c1c74206b25c5ab7f1a5b5b0afa109fbcb3e697506c69131d44a2c94580b9bcfd30db5297571b6a8247a77df894522ac9558886cb853ec10e85f6eb548b9ffa6924aed922d91edaa117437d9d0e215d5c86e120dc711a14738d2ba2393db8390f97e3fb2aecf91f63c5c844e9abe603fee9230678a4dc376422e2ed8ab88781c1b4d874f59b0d53764af801b0c6d7b1cdc8f742e4757d8553b7646807c0b0685138ba18d85d28b165417516ea483af6a9f61e097ca87d07cbddc63bc082d9149d84daabbfced5b2342d123050a2ce556f981c69ac7fa1fbd66ac7a2f82173b8ce4e3bf2625055e39ea51f4cee35f07f0babf325705f5c3e2d51055624c4da1246ae754b2e0a18fcc4611f20482400bd4e87fe54ac78170c669d2915a88e6229fb0a933cd892cca2b6a0dda07334ab4304f7f682e9ff5dc4c06b47d8c8d9fc4bcd35955ae287ebe87a1f8f54a82247856247cbdf3679556fc22ab3c0de17ef93bd34761b867c6d8c692b054bd95b52c61a163a87b4747be7c67d96c210d73d311de11297a7bffc0bbca95a2f857dfb3a3575001e6000e30ada77576f867f6b85c09fdbf5e63cf37d6b45f61d10bd7e8fb591a27d085da10c444a162f92d8807c4b66a62574c63d8bb89ec034669d3cdd9aa20e829518fb53cf0ac3c68dc060a092fe9a9cf94669f709be23deeff729b87c9cecdeefe867b4a22530b0feef9a89e892d5019955edb6d13c3982e619dcee1bd6f0cfbac809e3f0cd58f8a904750ebf1466ce54b5c7dbcebddec51deef04dcc93d81bd04a60e6550173dc6ae460a034150bee3791d633831bb840702bf404b13d36a6f6c966d316e583285aaa2ae3a2d7673704fc24d5891d86bdbaeeb7ab46a4cbc687f08f8bd00cf54acb92184ff7f568d1ded0defd2e6efb8f5763010687a667de1ce5800b91b295aebb2478645fe34e23f77fda85221ef4f47ea8dcc80ba2c0b7670150660b97e7305bc8f68e27988ccc69017c04d10c8effdb79dc7f666e6c1ec950fea1ad9b8c4beded1ffe927216031da26b719ec80b748c65722d688a417f1176cbbdae6d272a9fa05f7bf037b5c53c179accf5173c1bf938e64380069c51a9175db9939778f904bf2e7972f581af9d8f7b3d1003fda89b7759e4a7dc7d124df5b09e469560d6e791a6bf9b08863a6b262efe8c744e61125b636c4b273b7b4d94d004848871dd044a3d3bb2278965b00ec52b343605cc4d5a67786ba02c14af1c098b72b3322e4c1d18b3b5dae1a4595392462baead687f77d61c47ee7852d13c949f687646c36854afcf3b1c004a6508cefa2a21063ed102aadaac2ac2859c4cee9cb0d5ded20c6d3b9afc82bd4734d48dba9210e2c08cad8f11a461204041e4e9438167cf9fd719aaf961780514dec65cba4b07cb12c8e82854739291760301ad46e8f53892f4f8ea33cd437f28bb04f43702a48b37e81e2f150c93b5bd22dd23de170b47cef479b531a9262b1018e6a2155753ccde97419cc81c807716c898e34a48d4c98b69fb17ece341787758b7ecb95c69744fcd104a235b88e77523d3dad023bc244c51ace54cff2029d4d13b4aa241be0a57f6e0385911a3f6432db9f2b6f88d2faed0c269278dd26f80c976f8d7485178501c3c6be5468ef6b2efb93ae8479f8a174ce0180b3252dcafe4a77018ba21b7b7ee5d58610d72c3f613ccdbe4e0ae4a61e8fbe64cb21361c781c02177b9369399c1c319823fc8484537c4605ec6875bae53a4fc87060d32ff1020e217b17df62703d91f319fc95622f95ed1ee6ce0b68636404d8737c2b588f5de86cf65ddeab63ad0c0f6d58dfbe6290c6bffcfe9d5e600dfac56ad98601ebf9fe2f5eba60b2247d0f91ca01645f56116884fb1e49eb9cbb6402f3b328495b9340a8113544956f0dc29807625c189ee24749a27849414ef2d8c3b5b104d238dbd9fd0e85fd71e8437ef65529b72d2eb2ef5dd39b9b70f17245aaa4f925393d3a8f702b9f636ca2629a710030ae4bc757a143e6da8275fe2c3fc07edcdc861d81db8c75c95019d73b04c63326dce2a44b4abf4a12bffbc012c980b8996d77405d8f7101ae57a97bb4f7352edde2810e38b4c942bec64dfb7d976cf5c206ca299ca0a8b0c74f0da2629c143767f5f033ba5bf4b8ef8405f7bb3a85b4ea013bc2ac759fb10731e8788e11af9b1fa4752d5e47a36a543b0f624766bbd7893d430bbb7c6fd10b1aa629490f050b7cdd9a203a8e2645dbb45e33bf1c95b94a62a23bbbed0d3577cf667a2f40ab3c2cca98797667af3764ce63d4fdb0ff6c4f54d7d8ee25c763fb3bb7c321f4298ce10ce7001b19cb7dc2f2dcb983969998b7eac8ab98d444d3106974f51b4ed762bc7a91b2cb6f340d783819fc63d158b527b823d74623471a7e2f8f5702ce7578fd542eb35b3eedc8481e1524958fc4b845c429f668e56ecb3ab83f59c3986a9af7fd9052df78fef9d49944a5a247600245c5ef287db6294e5a33d811c22bfbd5d53d25c5bd3b2512b968c3cbb3e34f496532f43ababbe796c45af2fbcd415b6ce1197268806ac39a95ad407826f2dcc0d13c1c912f75c346c39dd71ba3ef8aa85c1d80bf41b158d856b60fe079018f65deacceac2e5c093e154e249bc5b226924ebc924828cac3db30d022da7ef7b427678559f651d36dfd06003210e10d1e583bfdc7789fae22b60159abc5cde76f0312f2f8d0fe3a6885de852749b91560ab0d1730ea141ddf631d0c0630591e328a9af5d624f3637069420da717cf0be8cb013057062e8fd5cf53cf6e822fc684368ddf8d0a9d584d63b5c9f668a39bd4fe7f62f2dce5b6c90a66bbb9a1af7e4d53c0213acad25fa48e5d314ba740135790b0819d46c9c19d03d0d0320451829ad8a25b4aa79149b0fe72c33ffed07a26762647e73f857a05fa56b01b05c55df9e4ca6859cff7f16c61f24f29056f5c11bab3523a4545f8c8721d118954b300d55caf26371d6fea7210175468727c8d48e76bdee089081304f8c22b35dfc65b7700938a8f3ecdc88bdb1d2958b0ec1e92d3cbdca2a83e054db238057289779cd4a7858ef982e50f8f2dd0b772e4c4c2f2ebe0bd13336f2480343a2cc8d6665eceab0dbf42ecc72153572273762571045a6f45237f4c9ca29ae537a5d294d8be78282fe919452be5f3c0fb1b9280765953653364ef981458c6105692738a0f4d349cd9481e8bb13a89d963dba0c4e076e0f9de61d3f63a165d1cc6673daf88a8c87f58d468d37a10dc1b23602744d2c70b982cd11ea5e67f01f91c97f7d57ea5326c3a404e4014e44530b29619eeae2fe8e1e25abb3948e6fb30fb36e4cb4cdf6e5770927ab80b7f3722b5f5335b70aee6aa89d4ebf458850d3b88db201c65cbd6ae2a5019ab44efb9d943b517031121b8582a05e30fa9816321785d917fa3c8ef740fd87dd22df15c11401f211669023520b5064e4b443dd7e5e3e097ebe65438d188af59318f785295825ec88e988ce11d6790077bb79afc9427554de52d252bb1e49f19d1200aafa0e569c6b391f706b425e751a8f35eabf52a96d15077d56c76683c45ddd28cde94957dec3c9f6fe841a40a2222a9909d96e57a0bf9e323018befa486d769ba8faf1a6d8efcbb6163d9afbfda87534fd03fea81e2570b56fd8977b9ebabfe23e2b7b312f09b714393b1df2d2d23f6ddfeabec6c37c96ceb83b9131d259d98fd75487236ee34dea4701ee90de94479a8731802e7f984ee1b779905d48c8d3e09737ffec8ca00968c41fce6018f9f155ada10996ecadc511b0682c073d5db0105f35560915300dbb57392c63a2db3caf6736932d963d4273e6ee456fc23ae25c65dff4a4c5314792f3b94b079385154946124c0b83e9eea0f9d7497e6ded534337609cd80162a03bff8f78e874747d67dcce7a667e33e50669e9c332f7a46b8827c8cbc9d7ba6136ab14d237b6fb4f252c118c15e54429b6e1ae5f0f6e6f9440ce7c00a5b9f8cfe3d8246af6ef1238a049fb754fd0257bb238983c2c905067d5710cb4b7d0258b06ebc30fe5751f004b434395a369cffd8b5d06cf9edb8ee6e80b762879d3128405dd5521af7136fa3e60a3bbfafe666dda713d8f341d1535555c396782a3ccc5be9a3a46a147a630c30029007e69e48a5d8f88c4d244194835a8b8ca6b34d690c4a0ce8ed7bbd2ec1fc46fe9c556cafd03a1ce43540e229230219296e6634e4830de8e8b932f07c2322f1d6ca6a68b8e04fcd65e4ca147d311e7da4d9d7cb4fb0a267b78a8af678669764ee675effc9e2f323f8dffc596549328f1cf6c77e4c40859753a2716abe848068606d448961fa4c4c49fc8cbcff2d54f8436789ecfcdf7c7b72860862ae9440911f254840bca229ef66d5b930213e29a585111bb0a44eb1d7bf7b24720855295c3b622cdd8a3e1ce5247d4435248ce348d9b736733c5fb0f784672c10627f0c279cdc9387145b41d9c506a1de7d1a239524a94eac91d84180c388ddd934a32585ae186a81481349732b5e45c06896eef7b5a308821f8c398ac7b96a584872820677f8ee7cba448ff310061319461c3744b9357a8a3b444058f5f21e856bd1961a1c1157eb22f00aa6eecd35c02e75a692e09f947b0f45224cb367646929d81b2f071394b42c5ab725282b6055f78e59fcc58fca6fcb8f6685fa32fdb0245bbcabc1e66aaba58aaf69fe4fc61f8074d27fa2acb068f29125e0fcb324ee11838e89b90ba618d6fc6cf1136954dd96d20a5a5e9f4b72547cab117dfe2d01169efb015bed045a011aed5e0adee56b2a8ad1a608c8edc2e0e4e"}) 784.890905ms ago: executing program 3 (id=3242): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0xd, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000f5ffff5f12a400000000df9400000000000000000000000080"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x90) r0 = socket(0x11, 0x2, 0x0) setsockopt(r0, 0x103, 0x2, &(0x7f00000000c0)="010000000200060200071a80010161aa", 0x10) syz_genetlink_get_family_id$mptcp(&(0x7f0000000080), r0) close(r0) 770.535388ms ago: executing program 0 (id=3243): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000000)={0x1, 0x2, &(0x7f0000000480)=ANY=[@ANYBLOB="9110bc000000000095"], &(0x7f00000003c0)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffe}, 0x94) r0 = bpf$MAP_CREATE(0x100000000000000, &(0x7f0000000140)=@base={0xa, 0x16, 0xb3, 0x7f}, 0x48) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0x12, &(0x7f0000000080)=@framed={{0x18, 0x5}, [@func={0x85, 0x0, 0x1, 0x0, 0x6}, @map_fd={0x18, 0x0, 0x1, 0x0, r0}, @generic={0x66}, @initr0, @exit, @printk={@x={0x18, 0x0}, {0x3, 0x3, 0x3, 0xa, 0x0}, {0x7, 0x1, 0xc, 0x1, 0x5}, {0x7, 0x0, 0x0, 0x1, 0x0, 0x0, 0xfffffe00}, {}, {}, {0x85, 0x0, 0x0, 0x2d}}]}, &(0x7f0000000000)='GPL\x00', 0x2}, 0x90) 768.711947ms ago: executing program 2 (id=3244): r0 = socket$nl_crypto(0x10, 0x3, 0x15) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000440)={0xffffffffffffffff, 0xe0, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, &(0x7f0000000140)=[0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x2, 0x1, &(0x7f0000000180)=[0x0, 0x0], &(0x7f00000001c0)=[0x0], 0x0, 0x7b, &(0x7f0000000240)=[{}], 0x8, 0x10, &(0x7f0000000280), &(0x7f00000002c0), 0x8, 0x50, 0x8, 0x8, &(0x7f0000000300)}}, 0x10) ioctl$XFS_IOC_START_COMMIT(0xffffffffffffffff, 0x80585882, &(0x7f0000000480)={0xffffffffffffffff}) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) mmap(&(0x7f0000002000/0x4000)=nil, 0x4000, 0xedc623580215bdcd, 0x12, r3, 0x0) r4 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000580)={0xffffffffffffffff, 0xffff, 0x4}, 0xc) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f00000005c0)={0x1, 0xffffffffffffffff}, 0x4) r6 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000300)={0x6, 0x10, &(0x7f00000003c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r6, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083006b5a751000000000000055090100000000009500000000006100fcff00000000bf91000000000000b7020000000000008500000000000000b7000000000000009500000000000000"], &(0x7f0000000100)='GPL\x00', 0x2, 0xf9, &(0x7f0000000140)=""/249}, 0x94) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4) r8 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000640)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x2, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x4, 0x1}, 0x50) r9 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000006c0)='memory.numa_stat\x00', 0x0, 0x0) r10 = bpf$MAP_CREATE(0x100000000000000, &(0x7f0000000440)=@base={0x12, 0x3a, 0x8, 0x2}, 0x48) syz_emit_ethernet(0x46, &(0x7f0000000080)=ANY=[@ANYBLOB="aaaaaaaaaaaa0180c200000086dd60b8192300100000fe8000000000000000000000000000aafe8000000000000010000000000000aa89010000000000003100c204b0"], 0x0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000400)=@bpf_lsm={0x6, 0x4, &(0x7f0000000000)=@framed={{0x18, 0x0, 0x0, 0x0, 0x7}, [@call={0x85, 0x0, 0x0, 0xb2}]}, &(0x7f0000000100)='GPL\x00'}, 0x94) bpf$BPF_PROG_ATTACH(0x1c, &(0x7f00000010c0)={@map=r10, 0xffffffffffffffff, 0x2c}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000780)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000000700), &(0x7f0000000740)}, 0x20) r12 = openat$cgroup_ro(r0, &(0x7f00000007c0)='blkio.throttle.io_service_bytes_recursive\x00', 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000008c0)={0x18, 0xa, &(0x7f0000000000)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7ff}, [@call, @generic={0xe9, 0x6, 0x4, 0xc274, 0x3d5e}, @kfunc={0x85, 0x0, 0x2, 0x0, 0x1}, @kfunc={0x85, 0x0, 0x2, 0x0, 0x4}, @call={0x85, 0x0, 0x0, 0x87}, @jmp={0x5, 0x1, 0x4, 0xb, 0x4, 0x40, 0x800000000000001e}, @jmp={0x5, 0x1, 0x1, 0x6, 0x3, 0xfffffffffffffff0, 0x10}]}, &(0x7f0000000080)='syzkaller\x00', 0xfffffff7, 0x41, &(0x7f00000000c0)=""/65, 0x41100, 0x8, '\x00', r1, 0x0, r2, 0x8, &(0x7f0000000500)={0x5, 0x4}, 0x8, 0x10, &(0x7f0000000540)={0x4, 0xc, 0x7, 0xb98b}, 0x10, 0x0, 0x0, 0x7, &(0x7f0000000800)=[r3, r4, r5, r7, r8, r9, r10, r0, r11, r12], &(0x7f0000000840)=[{0x5, 0x3, 0x5, 0xc}, {0x1, 0x1, 0xe, 0x8}, {0x2, 0x2, 0x1, 0xa}, {0x0, 0x5, 0x0, 0x3}, {0x1, 0x3, 0xd, 0xb}, {0x1, 0x5, 0xd, 0x9f3a82db6a7e7ab7}, {0x0, 0x2, 0x8, 0xc}], 0x10, 0xce31}, 0x94) setsockopt$netlink_NETLINK_CAP_ACK(r0, 0x10e, 0xa, &(0x7f0000000200)=0x776, 0x4) 625.254157ms ago: executing program 2 (id=3245): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x10, 0x4, &(0x7f0000000240)=@framed={{0x18, 0x2, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0xfffffffe}, [@alu={0x4, 0x0, 0xd, 0xa, 0x0, 0x0, 0x10}]}, &(0x7f0000000200)='syzkaller\x00', 0x7, 0x79, &(0x7f0000000180)=""/121, 0x41000, 0x4}, 0x94) ioctl$XFS_IOC_PATH_TO_HANDLE(r0, 0xc0385869, &(0x7f0000000300)={r0, &(0x7f0000000040)='\x00', 0x400800, &(0x7f0000000080)={@align=0xd, {0x0, 0xf0e, 0x7, 0x6}}, 0x6, &(0x7f0000000280), &(0x7f00000002c0)=0x7}) bpf$OBJ_PIN_MAP(0x6, &(0x7f0000000340)=@o_path={&(0x7f0000000000)='./file0\x00', r1, 0x4000, r0}, 0x18) ioctl$SIOCSIFMTU(r1, 0x8922, &(0x7f0000000380)={'syzkaller1\x00', 0x7}) 625.005853ms ago: executing program 3 (id=3246): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000120a0102000082012efae9422c6100010900010073797a310000000014000000180a010300000000000000000900000828000000020a01080000000000000900010073797a3000000000080002400000000364000000080a01040000000000000000010000030b00010073797a9d83300000000014000580080002400000000108000140000088090900010073797a300000000006ff0b40000000041400058008000240000000020800024000000002080009400000000314000000020a01070000000000000000010000071400010000edffffffffffff0000000a700e7757659a2584925695b190a9285aeda59e823f36d87411fdf1f7dffdb209efe98c7dcf18d5548294bbc04b29b9440f70d346e8bb950adfdea2d6ddf5d66454b41792b581e683a8173981f24f206644e3ce8990053d6527c13f49638702e168bcbe2a8b9ff61f0a4af45b412c54f0c361bca219f9ec6cb198359c2e62474635ec161f244c583f9f5ede926af69a0883579aa0f9ce613be9e6e57ce14e6e1076333847ba60bbb7151a8a17183c313a21cfd54fd8980df5ed55675bdb727d7955e536116f23f11404bd8bc43d5314739f5f123ead64141ade4534d980a2dccbcae5773dfa7c6dccb253880bd1be2d4b4ac796a87f5569f7378e223440ae8e3f9854a986a4dc694c3f8c7509973e4646e6b4d1007de0ae91bdf85baaf749f4ce21cdb896606e3ddc2594ad8f3f6843eb50de6819e62ad05d21fc4ea3eca8bdb138ce15"], 0xfc}}, 0x0) 586.400497ms ago: executing program 0 (id=3247): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) r3 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) getsockopt$IP_VS_SO_GET_DAEMON(r3, 0x0, 0x487, 0x0, &(0x7f0000000040)) r4 = socket$packet(0x11, 0x2, 0x300) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r1, 0xc0c89425, &(0x7f0000000080)={"2fbd5e184742748e62e8629567d838a7", 0x0, 0x0, {0xa13, 0x7}, {0x1, 0x800}, 0x100000001, [0xe, 0x7, 0x4, 0x2, 0x32336cc4, 0x8001, 0x0, 0x1, 0x3, 0x6, 0xc, 0xf, 0x2, 0xa, 0x1, 0x5]}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000440)={0x0, ""/256, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r4, 0xc0c89425, &(0x7f0000000640)={"aca649fb48e1419beec49bfb6b0144bc", r5, r6, {0x5, 0x5}, {0xffffffffffffffff, 0xc}, 0x7, [0x3, 0x5, 0x200, 0xfffffffffffffffe, 0x2, 0xee7, 0x5, 0x9, 0x893, 0x1, 0x9768, 0x3, 0x9, 0x9, 0x10, 0x7]}) bind$packet(r4, &(0x7f0000000d00)={0x11, 0x5, r2, 0x1, 0x6, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}, 0x14) writev(r0, &(0x7f00000003c0)=[{&(0x7f0000000040)="390000001300034700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fdd411efc40800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f0000000400)="390000001300034700bb5be1c3e4feff06000000010000004500000025000000190004000400ad000200000000000006040000000000f93132", 0x39}], 0x1) sendto$packet(r4, 0x0, 0x0, 0x10, 0x0, 0x0) 489.720314ms ago: executing program 4 (id=3248): r0 = socket$netlink(0x10, 0x3, 0x4) ioctl$sock_SIOCSIFVLAN_GET_VLAN_INGRESS_PRIORITY_CMD(r0, 0x8983, &(0x7f0000000040)) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x2, 0x2, &(0x7f0000000000)=ANY=[@ANYBLOB='\x00\b\x00'], &(0x7f0000000080)='syzkaller\x00', 0x9, 0x0, 0x0, 0x0, 0x29, '\x00', 0x0, 0x38}, 0x94) writev(r0, &(0x7f0000000080)=[{&(0x7f0000000200)="a10100001500add427323b470c45b4560a067fffffff81004e22000d00ff0028925aa80020007b00090080000efffeffe809000000ff0000f03ac7100003ffffffffffffffffffffffe7ee00000000000000000200000000", 0x1a1}], 0x1) 433.778931ms ago: executing program 3 (id=3249): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x2000000000000021, 0x2, 0x10000000000002) connect$rxrpc(r1, &(0x7f0000000140)=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x8, @multicast2}}, 0x24) sendmmsg(r1, &(0x7f0000000180)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="18000000000000001001000001"], 0x18, 0xe000}, 0x5}], 0x1, 0x0) recvmmsg(r1, &(0x7f0000000d00), 0xf000, 0x10002, 0x0) setsockopt$inet_sctp6_SCTP_AUTH_DEACTIVATE_KEY(r1, 0x84, 0x23, 0x0, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000100)=@newlink={0x5c, 0x10, 0x401, 0x70bd29, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, 0xb00, 0x46951}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @geneve={{0xb}, {0x18, 0x2, 0x0, 0x1, [@IFLA_GENEVE_REMOTE6={0x14, 0x7, @private1={0xfc, 0x1, '\x00', 0x1}}]}}}, @IFLA_IFNAME={0x14, 0x3, 'geneve1\x00'}]}, 0x5c}}, 0x2000000) 431.816367ms ago: executing program 2 (id=3250): sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000340)=@migrate={0x138, 0x21, 0x1, 0x70bd2d, 0x0, {{@in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @in=@multicast1, 0x0, 0x0, 0x400, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0xffffffffffffffff}}, [@migrate={0xe8, 0x11, [{@in=@empty, @in=@broadcast, @in6=@mcast1, @in6=@dev={0xfe, 0x80, '\x00', 0x20}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa}, {@in6=@empty, @in6=@remote, @in=@loopback, @in=@dev={0xac, 0x14, 0x14, 0x1a}}, {@in=@empty, @in=@broadcast, @in=@empty, @in6=@loopback, 0x0, 0x0, 0x0, 0x3507, 0x0, 0xa}]}]}, 0x138}, 0x1, 0x0, 0x0, 0x20000881}, 0x0) 430.792002ms ago: executing program 0 (id=3251): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x2802, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) bpf$MAP_CREATE(0x0, &(0x7f0000000640)=@base={0x16, 0x0, 0x4, 0xff, 0x4, 0x1}, 0x48) r3 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffffd, {0x0, 0x0, 0x0, r4, {0x0, 0x1}, {0xffff, 0xffff}, {0xffe0, 0x2}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000006c0)=@newtfilter={0x5c, 0x2c, 0xf3f, 0x30bd29, 0x25dfdbfd, {0x0, 0x0, 0x0, r4, {0xb, 0x4}, {}, {0x7, 0x300}}, [@filter_kind_options=@f_basic={{0xa}, {0x2c, 0x2, [@TCA_BASIC_EMATCHES={0x28, 0x2, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x1}}, @TCA_EMATCH_TREE_LIST={0x1c, 0x2, 0x0, 0x1, [@TCF_EM_CMP={0x18, 0x1, 0x0, 0x0, {{0x6, 0x1, 0xff84}, {0x8001, 0x9, 0x78, 0x4, 0x6}}}]}]}]}}]}, 0x5c}, 0x1, 0x0, 0x0, 0x20041090}, 0x0) r5 = socket$kcm(0x11, 0x3, 0x0) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r6) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x275a, 0x0) mmap(&(0x7f0000002000/0x3000)=nil, 0x3000, 0x0, 0x12, r7, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000000)={&(0x7f00000000c0)=ANY=[@ANYBLOB="9feb010020000000000c00a7551e6c59fcdb4b8843d17360"], &(0x7f0000001f80)=""/226, 0x26, 0xe2, 0xa}, 0x28) setsockopt$inet6_buf(r3, 0x29, 0x14, &(0x7f0000000280)="d9614e18f1a088938028f718d6898388c795812b8ef61fb4a464fd5e94d7fc0de0b8087ae65395e043642c222417e41e75fb940cb3397e3d1d14864871709e4e42e0", 0x42) pipe(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) close(r9) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) tee(r8, r10, 0x8f5, 0x0) r11 = socket$nl_crypto(0x10, 0x3, 0x15) sendmsg$netlink(r11, &(0x7f0000000880)={0x0, 0x0, &(0x7f0000000840)=[{&(0x7f0000000000)=ANY=[@ANYBLOB="e00000001000090527bd7000000000000f00230073797a6b616c6c65723100009d0000002b0ea3184f123d6da2f1acfac0"], 0xe0}], 0x1}, 0x40040) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) sendmsg$kcm(r5, &(0x7f00000000c0)={&(0x7f0000000140)=@xdp={0x2c, 0x7, r4, 0x1}, 0x80, &(0x7f0000000200)=[{&(0x7f0000000740)="82", 0x1}], 0x1}, 0x5) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0xa, 0x5, 0x7524, 0x1000, 0x0, 0x1, 0x335}, 0x50) r12 = bpf$PROG_LOAD(0x5, &(0x7f0000000740)={0xc, 0x8, &(0x7f0000000d80)=ANY=[@ANYBLOB="1800000000000000000000000000000018020000", @ANYRES32=r1, @ANYBLOB="0000000000000000b703000000000000850000000d000000b70000000000000095"], &(0x7f0000000180)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x6e, '\x00', 0x0, @fallback=0x1b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000003c0)={r12, 0x3e8, 0xe80, 0x0, &(0x7f0000000000)="c1df07000000d30a298ee68886dd87", 0x0, 0x3ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x50) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000000)=0x40000000) 350.916513ms ago: executing program 4 (id=3252): r0 = socket(0x10, 0x803, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000000c0)=@getchain={0x24, 0x66, 0x0, 0x3, 0x2000, {0x0, 0x0, 0x0, 0x0, {0x0, 0x8}, {0x0, 0xfff2}, {0xffe0}}}, 0x24}}, 0x400c0) getsockname$packet(r0, &(0x7f0000000740)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000700)=0x14) bpf$TOKEN_CREATE(0x24, 0x0, 0x0) getsockopt$WPAN_WANTACK(r1, 0x0, 0x0, &(0x7f0000000100), &(0x7f00000001c0)=0x4) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x2c0800, 0x0) close(r3) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180)) r4 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000001480)={'syzkaller0\x00', 0x7101}) ioctl$SIOCSIFHWADDR(r3, 0x8943, &(0x7f0000002280)={'syzkaller0\x00'}) r5 = epoll_create1(0x80000) epoll_ctl$EPOLL_CTL_ADD(r5, 0x1, r4, &(0x7f0000000140)={0x6}) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000000)={@ifindex, 0xffffffffffffffff, 0x36, 0x4}, 0x20) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000007c0)=ANY=[@ANYBLOB="480000001000010400"/20, @ANYRES32=r2, @ANYBLOB="0000000000000000280012800b000100697036746e6c00001800028014000300ff"], 0x48}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)=ANY=[@ANYBLOB="3c00000010000104fcffffff0000000000000000", @ANYRES32=r2, @ANYBLOB="00250000201000001c0012800b000100697036746e6c00000c00028006000f0044d2fcf6"], 0x3c}, 0x1, 0x0, 0x0, 0x40001}, 0x20004010) socket(0x10, 0x803, 0x0) (async) socket(0x10, 0x803, 0x0) (async) sendmsg$nl_route_sched(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000000c0)=@getchain={0x24, 0x66, 0x0, 0x3, 0x2000, {0x0, 0x0, 0x0, 0x0, {0x0, 0x8}, {0x0, 0xfff2}, {0xffe0}}}, 0x24}}, 0x400c0) (async) getsockname$packet(r0, &(0x7f0000000740)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000700)=0x14) (async) bpf$TOKEN_CREATE(0x24, 0x0, 0x0) (async) getsockopt$WPAN_WANTACK(r1, 0x0, 0x0, &(0x7f0000000100), &(0x7f00000001c0)=0x4) (async) openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x2c0800, 0x0) (async) close(r3) (async) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180)) (async) openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) (async) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000001480)={'syzkaller0\x00', 0x7101}) (async) ioctl$SIOCSIFHWADDR(r3, 0x8943, &(0x7f0000002280)={'syzkaller0\x00'}) (async) epoll_create1(0x80000) (async) epoll_ctl$EPOLL_CTL_ADD(r5, 0x1, r4, &(0x7f0000000140)={0x6}) (async) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000000)={@ifindex, 0xffffffffffffffff, 0x36, 0x4}, 0x20) (async) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000007c0)=ANY=[@ANYBLOB="480000001000010400"/20, @ANYRES32=r2, @ANYBLOB="0000000000000000280012800b000100697036746e6c00001800028014000300ff"], 0x48}}, 0x0) (async) sendmsg$nl_route(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)=ANY=[@ANYBLOB="3c00000010000104fcffffff0000000000000000", @ANYRES32=r2, @ANYBLOB="00250000201000001c0012800b000100697036746e6c00000c00028006000f0044d2fcf6"], 0x3c}, 0x1, 0x0, 0x0, 0x40001}, 0x20004010) (async) 332.601678ms ago: executing program 2 (id=3253): sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000000)=ANY=[@ANYBLOB="2000000076000d00000000000000000003000000000000000800010002"], 0x20}}, 0x0) 117.874912ms ago: executing program 2 (id=3254): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x8, &(0x7f0000000280)={&(0x7f0000000240)=@delchain={0x24, 0x65, 0x400, 0x70bd29, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, {0x509d884560ba1ba6, 0x3}, {}, {0xfff3, 0x10}}}, 0x24}}, 0x10) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@gettaction={0x50, 0x32, 0x200, 0x70bd25, 0x25dfdbfe, {}, [@action_gd=@TCA_ACT_TAB={0x1c, 0x1, [{0xc, 0x1c, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'bpf\x00'}}, {0xc, 0x1d, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'ife\x00'}}]}, @action_gd=@TCA_ACT_TAB={0x20, 0x1, [{0x10, 0xf, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'mirred\x00'}}, {0xc, 0x1c, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x40}}]}]}, 0x50}, 0x1, 0x0, 0x0, 0x40000}, 0x4048840) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000100)=@newqdisc={0x3c, 0x24, 0x200, 0xc0000000, 0x0, {0x0, 0x0, 0x0, 0x0, {0x3, 0x3}, {0xa, 0xe}, {0x0, 0x9}}, [@qdisc_kind_options=@q_fq_pie={{0xb}, {0xc, 0x8002, [@TCA_FQ_PIE_TARGET={0x8, 0x3, 0x4}]}}]}, 0x3c}}, 0x20004015) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB, @ANYRES32=0x0, @ANYBLOB="0300000000000000280012800a00010076786c616e00"], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22cca65c15}, 0x4008840) r0 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r0, &(0x7f00000002c0), 0x40000000000009f, 0xe0) 0s ago: executing program 2 (id=3255): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) mmap(&(0x7f0000002000/0x4000)=nil, 0x4000, 0xedc623580215bdcd, 0x12, r0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) unshare(0x6020400) r2 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) poll(&(0x7f0000000040)=[{r2, 0x400}], 0x1, 0x1) pwritev(r1, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0xb, 0x4, &(0x7f0000000700)=ANY=[@ANYBLOB="18000000ffffffff000000002000000073110b000000000095"], &(0x7f0000000180)='syzkaller\x00', 0x3, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x2e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, 0x94) kernel console output (not intermixed with test programs): 8028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 409.668912][T14339] RAX: ffffffffffffffda RBX: 00007f3e74c25fa0 RCX: 00007f3e7499de59 [ 409.668928][T14339] RDX: 0000000000000006 RSI: 000000000000011b RDI: 0000000000000006 [ 409.668942][T14339] RBP: 00007f3e74a33e6f R08: 0000000000000004 R09: 0000000000000000 [ 409.668956][T14339] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000000 [ 409.668970][T14339] R13: 00007f3e74c26038 R14: 00007f3e74c25fa0 R15: 00007ffebed4b448 [ 409.669006][T14339] [ 409.669037][T14339] Mem-Info: [ 409.960740][T14339] active_anon:13216 inactive_anon:0 isolated_anon:0 [ 409.960740][T14339] active_file:0 inactive_file:43298 isolated_file:0 [ 409.960740][T14339] unevictable:3840 dirty:282 writeback:0 [ 409.960740][T14339] slab_reclaimable:11139 slab_unreclaimable:166641 [ 409.960740][T14339] mapped:32634 shmem:4365 pagetables:1406 [ 409.960740][T14339] sec_pagetables:0 bounce:0 [ 409.960740][T14339] kernel_misc_reclaimable:0 [ 409.960740][T14339] free:1241502 free_pcp:9777 free_cma:0 [ 410.033203][T14339] Node 0 active_anon:53064kB inactive_anon:0kB active_file:0kB inactive_file:173000kB unevictable:13824kB isolated(anon):0kB isolated(file):0kB mapped:130536kB dirty:1124kB writeback:0kB shmem:15924kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:14552kB pagetables:5460kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 410.082631][T14343] netlink: 32 bytes leftover after parsing attributes in process `syz.4.2153'. [ 410.118462][T14339] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:192kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:4kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:64kB pagetables:164kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 410.166194][T14339] Node 0 DMA free:15360kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 410.256429][T14339] lowmem_reserve[]: 0 2489 2489 2489 2489 [ 410.265407][T14339] Node 0 DMA32 free:998724kB boost:0kB min:34160kB low:42700kB high:51240kB reserved_highatomic:0KB free_highatomic:0KB active_anon:48764kB inactive_anon:0kB active_file:0kB inactive_file:173000kB unevictable:13824kB writepending:1124kB zspages:0kB present:3129332kB managed:2548764kB mlocked:12288kB bounce:0kB free_pcp:42556kB local_pcp:24968kB free_cma:0kB [ 410.327774][T14339] lowmem_reserve[]: 0 0 0 0 0 [ 410.334159][T14339] Node 0 Normal free:0kB boost:0kB min:0kB low:0kB high:0kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:268kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 410.382693][T14339] lowmem_reserve[]: 0 0 0 0 0 [ 410.401583][T14339] Node 1 Normal free:3951168kB boost:0kB min:55736kB low:69668kB high:83600kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:192kB unevictable:1536kB writepending:4kB zspages:0kB present:4194300kB managed:4111100kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 410.563499][T14339] lowmem_reserve[]: 0 0 0 0 0 [ 410.586722][T14339] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 410.604629][T14344] llcp: llcp_sock_recvmsg: Recv datagram failed state 4 -512 0 [ 410.619613][T14339] Node 0 DMA32: 765*4kB (UM) 515*8kB (UME) 382*16kB (UM) 343*32kB (UM) 148*64kB (UM) 37*128kB (UE) 4*256kB (UME) 1*512kB (U) 2*1024kB (UM) 2*2048kB (ME) 234*4096kB (UM) = 1004620kB [ 410.660299][T14339] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 410.678867][T14339] Node 1 Normal: 0*4kB 2*8kB (UM) 7*16kB (UM) 6*32kB (UM) 12*64kB (UM) 2*128kB (UM) 3*256kB (UM) 3*512kB (UM) 1*1024kB (M) 1*2048kB (U) 963*4096kB (UM) = 3951168kB [ 410.698246][T14339] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 410.738264][T14339] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 410.765278][T14339] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 410.794187][T14339] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 410.831892][T14339] 47659 total pagecache pages [ 410.842243][T14339] 0 pages in swap cache [ 410.865259][T14339] Free swap = 124996kB [ 410.869502][T14339] Total swap = 124996kB [ 410.879267][T14339] 2097051 pages RAM [ 410.907639][T14339] 0 pages HighMem/MovableOnly [ 410.915622][T14339] 428178 pages reserved [ 410.923774][T14339] 0 pages cma reserved [ 411.222032][T14373] netlink: 'syz.3.2159': attribute type 1 has an invalid length. [ 411.319682][T14380] net_ratelimit: 24 callbacks suppressed [ 411.319701][T14380] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 411.328458][T14376] block nbd1: server does not support multiple connections per device. [ 411.367460][T14376] block nbd1: shutting down sockets [ 411.399728][T14377] lo speed is unknown, defaulting to 1000 [ 411.424908][T14377] lo speed is unknown, defaulting to 1000 [ 411.514893][ C1] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 411.570917][T14384] netlink: 'syz.4.2162': attribute type 15 has an invalid length. [ 411.580779][T14384] netlink: 'syz.4.2162': attribute type 15 has an invalid length. [ 411.722711][T14390] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 411.734186][T14390] netlink: 'syz.2.2165': attribute type 1 has an invalid length. [ 411.791579][T14390] 8021q: adding VLAN 0 to HW filter on device bond11 [ 411.831766][T14392] bond11: (slave veth9): Enslaving as a backup interface with a down link [ 411.881461][T14390] bond11: (slave dummy0): Enslaving as a backup interface with a down link [ 411.901352][T14390] netlink: 'syz.2.2165': attribute type 10 has an invalid length. [ 412.184263][T14410] openvswitch: netlink: Missing key (keys=40, expected=200000) [ 412.530900][T14419] syzkaller1: entered promiscuous mode [ 412.541755][T14419] syzkaller1: entered allmulticast mode [ 412.578697][T14432] __nla_validate_parse: 10 callbacks suppressed [ 412.578716][T14432] netlink: 24 bytes leftover after parsing attributes in process `syz.4.2178'. [ 412.599575][T14419] netlink: 'syz.3.2175': attribute type 7 has an invalid length. [ 412.668069][T14429] nftables ruleset with unbound chain [ 412.706798][T14435] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2179'. [ 412.718445][T14435] netlink: 52 bytes leftover after parsing attributes in process `syz.4.2179'. [ 412.844185][T14440] netlink: 'syz.2.2180': attribute type 1 has an invalid length. [ 412.854622][T14440] netlink: 244 bytes leftover after parsing attributes in process `syz.2.2180'. [ 412.858291][T14439] netlink: 'syz.4.2181': attribute type 13 has an invalid length. [ 412.906265][T14437] netlink: 1244 bytes leftover after parsing attributes in process `syz.2.2180'. [ 412.977128][ T7859] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 413.025378][T14442] gretap0: left promiscuous mode [ 413.091173][T14442] 8021q: adding VLAN 0 to HW filter on device bond0 [ 413.100904][T14442] 8021q: adding VLAN 0 to HW filter on device team0 [ 413.109361][T14442] tipc: Resetting bearer [ 413.126850][T14442] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 413.212642][T14442] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 413.241469][T14442] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 413.260897][T14442] veth1_vlan: left promiscuous mode [ 413.271470][ T7859] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 413.282233][T14442] veth0_vlan: left promiscuous mode [ 413.290165][T14442] veth0_vlan: entered promiscuous mode [ 413.298260][T14442] veth1_vlan: entered promiscuous mode [ 413.308909][T14442] veth1_macvtap: left promiscuous mode [ 413.316560][T14442] veth0_macvtap: left promiscuous mode [ 413.323310][T14442] veth0_macvtap: entered promiscuous mode [ 413.336600][T14442] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 413.347090][T14442] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 413.357317][T14442] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 413.367728][T14442] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 413.386335][T14442] 8021q: adding VLAN 0 to HW filter on device bond1 [ 413.420761][T14442] 8021q: adding VLAN 0 to HW filter on device bond2 [ 413.434431][T14442] gretap0: entered promiscuous mode [ 413.445990][T14442] 8021q: adding VLAN 0 to HW filter on device bond3 [ 413.493559][T14442] veth1_macvtap: entered promiscuous mode [ 413.504459][T14442] 8021q: adding VLAN 0 to HW filter on device bond4 [ 413.548565][T14442] 8021q: adding VLAN 0 to HW filter on device bond5 [ 413.559776][T14442] 8021q: adding VLAN 0 to HW filter on device bond6 [ 413.569356][T14442] 8021q: adding VLAN 0 to HW filter on device bond7 [ 413.590035][ T6023] lo speed is unknown, defaulting to 1000 [ 413.612684][ T6023] syz2: Port: 1 Link ACTIVE [ 413.683742][ T12] netdevsim netdevsim3 netdevsim0: set [0, 1] type 1 family 0 port 8472 - 0 [ 413.694983][ T12] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 413.722028][ T12] netdevsim netdevsim3 netdevsim0: set [1, 1] type 2 family 0 port 53110 - 0 [ 413.742378][ T12] netdevsim netdevsim3 netdevsim1: set [0, 1] type 1 family 0 port 8472 - 0 [ 413.754281][ T12] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 413.765746][ T12] netdevsim netdevsim3 netdevsim1: set [1, 1] type 2 family 0 port 53110 - 0 [ 413.782141][T14456] netlink: 'syz.2.2184': attribute type 8 has an invalid length. [ 413.809448][ T12] netdevsim netdevsim3 netdevsim2: set [0, 1] type 1 family 0 port 8472 - 0 [ 413.837865][ T12] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 413.857623][ T12] netdevsim netdevsim3 netdevsim2: set [1, 1] type 2 family 0 port 53110 - 0 [ 413.883408][ T12] netdevsim netdevsim3 netdevsim3: set [0, 1] type 1 family 0 port 8472 - 0 [ 413.899046][ T12] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 413.918661][ T12] netdevsim netdevsim3 netdevsim3: set [1, 1] type 2 family 0 port 53110 - 0 [ 413.940131][ T6139] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 413.970859][ T7860] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 413.983563][ T6139] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 414.000554][T14460] IPVS: sed: FWM 3 0x00000003 - no destination available [ 414.008464][ T6139] ip6_tunnel: ip6tnl3 xmit: Local address not yet configured! [ 414.008906][ T6139] ip6_tunnel: ip6tnl3 xmit: Local address not yet configured! [ 414.036931][ T5737] ip6_tunnel: ip6tnl3 xmit: Local address not yet configured! [ 414.078843][ T7860] ip6_tunnel: ip6erspan1 xmit: Local address not yet configured! [ 414.126510][ T7860] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 414.291886][T14479] "syz.4.2192" (14479) uses obsolete ecb(arc4) skcipher [ 414.384193][T14475] lo speed is unknown, defaulting to 1000 [ 414.394433][T14475] lo speed is unknown, defaulting to 1000 [ 414.417176][T14485] netlink: 'syz.2.2194': attribute type 1 has an invalid length. [ 414.436609][T14485] netlink: 244 bytes leftover after parsing attributes in process `syz.2.2194'. [ 414.493296][T14485] netlink: 1244 bytes leftover after parsing attributes in process `syz.2.2194'. [ 414.985019][T14495] netlink: 112 bytes leftover after parsing attributes in process `syz.3.2197'. [ 414.996540][T14495] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2197'. [ 415.770507][T14517] bond0: Caught tx_queue_len zero misconfig [ 416.251246][T14531] 8021q: adding VLAN 0 to HW filter on device bond9 [ 416.269349][T14533] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2204'. [ 416.479704][T14538] pim6reg1: entered promiscuous mode [ 416.485375][T14538] pim6reg1: entered allmulticast mode [ 416.619260][T14546] "syz.2.2208" (14546) uses obsolete ecb(arc4) skcipher [ 416.692015][ T12] nci: nci_rf_intf_activated_ntf_packet: unsupported rf_interface 0x7 [ 417.392423][T14540] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 417.402058][T14553] validate_nla: 1 callbacks suppressed [ 417.402078][T14553] netlink: 'syz.4.2209': attribute type 1 has an invalid length. [ 418.126960][T14592] __nla_validate_parse: 2 callbacks suppressed [ 418.126981][T14592] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2217'. [ 418.253563][T14596] "syz.2.2219" (14596) uses obsolete ecb(arc4) skcipher [ 418.313973][T14601] FAULT_INJECTION: forcing a failure. [ 418.313973][T14601] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 418.327851][T14601] CPU: 0 UID: 0 PID: 14601 Comm: syz.2.2219 Not tainted syzkaller #0 PREEMPT(full) [ 418.327881][T14601] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 418.327894][T14601] Call Trace: [ 418.327914][T14601] [ 418.327923][T14601] dump_stack_lvl+0xe8/0x150 [ 418.327962][T14601] should_fail_ex+0x40c/0x560 [ 418.327992][T14601] _copy_from_user+0x2d/0xb0 [ 418.328027][T14601] ___sys_recvmsg+0x173/0x5a0 [ 418.328055][T14601] ? __pfx____sys_recvmsg+0x10/0x10 [ 418.328082][T14601] ? __fget_files+0x2a/0x420 [ 418.328146][T14601] do_recvmmsg+0x31a/0x7f0 [ 418.328177][T14601] ? __pfx_do_recvmmsg+0x10/0x10 [ 418.328213][T14601] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 418.328249][T14601] ? __fget_files+0x3a2/0x420 [ 418.328288][T14601] __x64_sys_recvmmsg+0x198/0x250 [ 418.328314][T14601] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 418.328335][T14601] ? fput+0xa0/0xd0 [ 418.328370][T14601] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 418.328394][T14601] do_syscall_64+0x174/0x580 [ 418.328426][T14601] ? trace_irq_disable+0x3b/0x140 [ 418.328453][T14601] ? clear_bhb_loop+0x40/0x90 [ 418.328480][T14601] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 418.328502][T14601] RIP: 0033:0x7f414d79de59 [ 418.328523][T14601] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 418.328541][T14601] RSP: 002b:00007f414e6bc028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 418.328565][T14601] RAX: ffffffffffffffda RBX: 00007f414da26090 RCX: 00007f414d79de59 [ 418.328580][T14601] RDX: 0000000000000002 RSI: 00002000000001c0 RDI: 0000000000000004 [ 418.328594][T14601] RBP: 00007f414e6bc090 R08: 0000000000000000 R09: 0000000000000000 [ 418.328607][T14601] R10: 0000000000010121 R11: 0000000000000246 R12: 0000000000000001 [ 418.328620][T14601] R13: 00007f414da26128 R14: 00007f414da26090 R15: 00007fff872fb138 [ 418.328654][T14601] [ 418.526673][ C0] ip6_tnl_xmit_ctl: 9 callbacks suppressed [ 418.526693][ C0] ip6_tunnel: ip6tnl3 xmit: Local address not yet configured! [ 418.589278][T14605] netlink: 16170 bytes leftover after parsing attributes in process `syz.4.2222'. [ 418.685024][T14615] netlink: 'syz.3.2223': attribute type 11 has an invalid length. [ 418.710955][T14615] netlink: 'syz.3.2223': attribute type 11 has an invalid length. [ 418.721049][T14615] netlink: 228 bytes leftover after parsing attributes in process `syz.3.2223'. [ 418.863207][T14629] netlink: 'syz.4.2225': attribute type 1 has an invalid length. [ 418.871331][T14629] netlink: 244 bytes leftover after parsing attributes in process `syz.4.2225'. [ 418.897125][T14622] x_tables: duplicate underflow at hook 2 [ 419.024464][T14651] netlink: 1244 bytes leftover after parsing attributes in process `syz.4.2225'. [ 419.160162][T14654] veth8: entered allmulticast mode [ 419.352084][T14658] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2229'. [ 419.363063][T14658] xt_hashlimit: size too large, truncated to 1048576 [ 419.484118][T14666] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2230'. [ 419.585729][T14659] lo speed is unknown, defaulting to 1000 [ 419.598400][ C1] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 419.627164][T14659] lo speed is unknown, defaulting to 1000 [ 419.807773][T14671] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2232'. [ 419.882629][T14671] syzkaller0: entered promiscuous mode [ 419.896313][T14671] syzkaller0: entered allmulticast mode [ 420.005023][ C0] ip6_tunnel: ip6erspan1 xmit: Local address not yet configured! [ 420.015781][T14676] vlan6: entered promiscuous mode [ 420.026481][T14676] veth1_virt_wifi: entered promiscuous mode [ 420.041693][T14676] vlan6: entered allmulticast mode [ 420.060925][T14676] veth1_virt_wifi: entered allmulticast mode [ 420.209795][T14666] team0: Refused to change device type [ 420.262143][T14682] tipc: Enabling of bearer rejected, already enabled [ 420.685175][T14700] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2239'. [ 420.832798][T14700] tipc: Enabling of bearer rejected, failed to enable media [ 421.223147][T14723] netlink: 'syz.1.2242': attribute type 1 has an invalid length. [ 421.233790][T14723] netlink: 244 bytes leftover after parsing attributes in process `syz.1.2242'. [ 421.269334][T14721] netlink: 'syz.3.2243': attribute type 3 has an invalid length. [ 421.449768][T14734] netlink: 'syz.3.2247': attribute type 1 has an invalid length. [ 421.652034][T14743] netlink: 'syz.0.2251': attribute type 1 has an invalid length. [ 421.803408][T14742] lo speed is unknown, defaulting to 1000 [ 421.827703][T14742] lo speed is unknown, defaulting to 1000 [ 422.842186][T14800] veth0_to_hsr: Caught tx_queue_len zero misconfig [ 422.858687][T14800] netlink: 'syz.2.2262': attribute type 4 has an invalid length. [ 423.148367][T14809] __nla_validate_parse: 7 callbacks suppressed [ 423.148386][T14809] netlink: 28 bytes leftover after parsing attributes in process `syz.0.2265'. [ 423.184067][T14809] netlink: 28 bytes leftover after parsing attributes in process `syz.0.2265'. [ 423.239832][T14813] netlink: 380 bytes leftover after parsing attributes in process `syz.4.2266'. [ 423.255960][T14813] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2266'. [ 423.265473][T14813] netlink: 7 bytes leftover after parsing attributes in process `syz.4.2266'. [ 423.274847][T14811] lo speed is unknown, defaulting to 1000 [ 423.295459][T14811] lo speed is unknown, defaulting to 1000 [ 423.360867][T14780] tipc: Enabling of bearer rejected, already enabled [ 423.442970][T14820] xt_TPROXY: Can be used only with -p tcp or -p udp [ 423.457464][T14818] lo speed is unknown, defaulting to 1000 [ 423.540856][T14822] x_tables: ip_tables: DNAT target: used from hooks POSTROUTING, but only usable from PREROUTING/OUTPUT [ 423.631671][T14818] lo speed is unknown, defaulting to 1000 [ 423.667743][T14827] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2270'. [ 424.197800][T14833] syzkaller0: entered promiscuous mode [ 424.204823][T14833] syzkaller0: entered allmulticast mode [ 424.694083][T14864] sctp: [Deprecated]: syz.2.2279 (pid 14864) Use of struct sctp_assoc_value in delayed_ack socket option. [ 424.694083][T14864] Use struct sctp_sack_info instead [ 424.898351][T14863] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2280'. [ 424.933421][T14863] netlink: 3 bytes leftover after parsing attributes in process `syz.3.2280'. [ 425.064280][T14871] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 425.133700][T14873] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2282'. [ 425.149570][T14878] netlink: 14 bytes leftover after parsing attributes in process `syz.1.2271'. [ 425.251295][T14878] bond0 (unregistering): Released all slaves [ 425.354911][ C0] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 425.621525][T14896] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 426.245863][T14927] lo speed is unknown, defaulting to 1000 [ 426.263505][T14927] lo speed is unknown, defaulting to 1000 [ 426.315745][T14934] "syz.2.2301" (14934) uses obsolete ecb(arc4) skcipher [ 427.093970][T14958] tipc: Enabling of bearer rejected, failed to enable media [ 427.800476][T14989] syzkaller1: entered promiscuous mode [ 427.811059][T14989] syzkaller1: entered allmulticast mode [ 427.841666][T15007] lo speed is unknown, defaulting to 1000 [ 427.915333][ C0] ip6_tunnel: ip6tnl3 xmit: Local address not yet configured! [ 427.928496][T15007] lo speed is unknown, defaulting to 1000 [ 428.530637][T15043] bridge9: entered promiscuous mode [ 428.537186][T15043] bridge9: entered allmulticast mode [ 428.548005][T15043] team0: Port device bridge9 added [ 428.555601][ C0] ip6_tunnel: ip6erspan1 xmit: Local address not yet configured! [ 428.586383][T15048] __nla_validate_parse: 11 callbacks suppressed [ 428.586403][T15048] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2328'. [ 428.742191][T15048] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2328'. [ 428.769719][T15039] bridge10: entered promiscuous mode [ 428.777645][T15039] bridge10: entered allmulticast mode [ 428.787316][T15039] team0: Port device bridge10 added [ 428.836693][T15055] netlink: 'syz.3.2329': attribute type 37 has an invalid length. [ 429.291016][T15070] A link change request failed with some changes committed already. Interface macvlan0 may have been left with an inconsistent configuration, please check. [ 429.347847][T15076] "syz.0.2336" (15076) uses obsolete ecb(arc4) skcipher [ 429.563266][ T6141] tipc: Resetting bearer [ 429.949329][T15103] xt_hashlimit: overflow, rate too high: 0 [ 430.137586][T15110] netlink: 'syz.2.2344': attribute type 29 has an invalid length. [ 430.153467][T15110] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2344'. [ 430.219220][T15110] syzkaller0: entered promiscuous mode [ 430.226717][T15112] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2345'. [ 430.235179][T15110] syzkaller0: entered allmulticast mode [ 430.267309][T15110] netlink: 'syz.2.2344': attribute type 29 has an invalid length. [ 430.291266][T15110] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2344'. [ 430.319636][T15110] netlink: 'syz.2.2344': attribute type 29 has an invalid length. [ 430.356439][T15110] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2344'. [ 430.384932][T15110] netlink: 'syz.2.2344': attribute type 29 has an invalid length. [ 430.417150][T15116] lo speed is unknown, defaulting to 1000 [ 430.417432][T15110] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2344'. [ 430.431551][T15116] lo speed is unknown, defaulting to 1000 [ 430.449085][T15110] netlink: 'syz.2.2344': attribute type 29 has an invalid length. [ 430.458145][T15110] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2344'. [ 430.469715][T15110] netlink: 'syz.2.2344': attribute type 29 has an invalid length. [ 430.508541][T15110] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2344'. [ 430.531571][T15110] netlink: 'syz.2.2344': attribute type 29 has an invalid length. [ 430.539809][T15110] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2344'. [ 430.549360][T15110] netlink: 'syz.2.2344': attribute type 29 has an invalid length. [ 430.558281][T15110] netlink: 'syz.2.2344': attribute type 29 has an invalid length. [ 430.612469][T15121] only policy match revision 0 supported [ 430.612497][T15121] unable to load match [ 431.045880][T15123] syzkaller0: entered promiscuous mode [ 431.051604][T15123] syzkaller0: entered allmulticast mode [ 431.596008][T15152] bond12: option min_links: invalid value (18446744073709551612) [ 431.637196][T15152] bond12: option min_links: allowed values 0 - 2147483647 [ 431.703633][T15152] bond12 (unregistering): Released all slaves [ 431.840051][T15160] debugfs: '!' already exists in 'ieee80211' [ 432.115273][T15178] xt_TCPMSS: Only works on TCP SYN packets [ 432.611863][T15207] syzkaller0: entered promiscuous mode [ 432.623525][T15207] syzkaller0: entered allmulticast mode [ 432.632813][T15200] syzkaller0: entered promiscuous mode [ 432.639927][T15200] syzkaller0: entered allmulticast mode [ 432.966225][T15223] xfrm0: Caught tx_queue_len zero misconfig [ 432.984080][T15223] lo: Caught tx_queue_len zero misconfig [ 433.005329][T15223] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 433.293966][T15234] lo speed is unknown, defaulting to 1000 [ 433.321318][T15234] lo speed is unknown, defaulting to 1000 [ 433.995037][T15252] __nla_validate_parse: 35 callbacks suppressed [ 433.995056][T15252] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2377'. [ 434.012539][T15255] lo speed is unknown, defaulting to 1000 [ 434.077114][T15255] lo speed is unknown, defaulting to 1000 [ 434.605208][T15251] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 434.882284][T15274] bond12: entered promiscuous mode [ 435.351144][T15292] "syz.3.2387" (15292) uses obsolete ecb(arc4) skcipher [ 435.650246][T15293] syzkaller1: entered promiscuous mode [ 435.664959][T15293] syzkaller1: entered allmulticast mode [ 435.787395][T15306] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2392'. [ 436.153321][T15326] lo speed is unknown, defaulting to 1000 [ 436.207080][T15326] lo speed is unknown, defaulting to 1000 [ 436.237031][ C1] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 436.359468][T15329] validate_nla: 28 callbacks suppressed [ 436.359487][T15329] netlink: 'syz.3.2398': attribute type 1 has an invalid length. [ 436.461773][T15329] 8021q: adding VLAN 0 to HW filter on device bond8 [ 436.573483][T15333] veth5: entered allmulticast mode [ 436.607478][T15333] bond8: (slave veth5): Enslaving as an active interface with an up link [ 436.619384][T15336] netlink: 'syz.4.2399': attribute type 15 has an invalid length. [ 436.647955][T15329] bond8 (unregistering): (slave veth5): Releasing backup interface [ 436.696499][T15329] bond8 (unregistering): Released all slaves [ 436.833027][T15343] "syz.2.2400" (15343) uses obsolete ecb(arc4) skcipher [ 437.056026][T15354] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2402'. [ 437.108024][T15355] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 437.280985][T15347] lo speed is unknown, defaulting to 1000 [ 437.296604][T15347] lo speed is unknown, defaulting to 1000 [ 437.527790][T15350] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2401'. [ 437.546075][T15365] "syz.4.2408" (15365) uses obsolete ecb(arc4) skcipher [ 438.971955][T15391] lo speed is unknown, defaulting to 1000 [ 438.991325][T15391] lo speed is unknown, defaulting to 1000 [ 439.325371][T15405] netlink: 72 bytes leftover after parsing attributes in process `syz.3.2419'. [ 439.529732][T15407] tipc: Enabled bearer , priority 0 [ 439.550586][T15408] tipc: Enabling of bearer rejected, already enabled [ 439.573855][T15407] tipc: Resetting bearer [ 439.726200][T15406] tipc: Disabling bearer [ 439.850404][T15420] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2424'. [ 439.958593][T15420] bond0 (unregistering): Released all slaves [ 440.093945][ T1318] ieee802154 phy0 wpan0: encryption failed: -22 [ 440.170895][T15423] syzkaller1: entered promiscuous mode [ 440.183026][T15423] syzkaller1: entered allmulticast mode [ 440.511743][T15431] syzkaller1: entered promiscuous mode [ 440.522165][T15431] syzkaller1: entered allmulticast mode [ 440.648541][T15416] lo speed is unknown, defaulting to 1000 [ 440.699159][T15446] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 440.725377][ C0] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 440.997399][T15450] geneve2: entered promiscuous mode [ 441.027626][T15416] lo speed is unknown, defaulting to 1000 [ 441.313864][T15466] netlink: 'syz.3.2436': attribute type 1 has an invalid length. [ 441.406094][T15469] bond0: (slave dummy0): making interface the new active one [ 441.415661][T15469] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 441.621657][T15469] tipc: Resetting bearer [ 441.639906][T15469] bond0: (slave dummy0): Releasing active interface [ 441.684754][T15476] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2438'. [ 441.729321][T15469] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 441.749280][T15478] lo: Caught tx_queue_len zero misconfig [ 441.812695][ T6022] lo speed is unknown, defaulting to 1000 [ 441.821796][ T6022] syz2: Port: 1 Link DOWN [ 441.878868][T15489] netlink: 'syz.3.2440': attribute type 1 has an invalid length. [ 441.937477][T15485] bridge0: entered promiscuous mode [ 441.943044][T15485] bridge0: entered allmulticast mode [ 441.961436][T15492] netlink: 20 bytes leftover after parsing attributes in process `syz.3.2440'. [ 441.987352][T15493] af_packet: tpacket_rcv: packet too big, clamped from 1 to 4294967272. macoff=96 [ 442.039608][T15489] bond8: entered promiscuous mode [ 442.045615][T15489] 8021q: adding VLAN 0 to HW filter on device bond8 [ 442.205379][T15496] "syz.0.2442" (15496) uses obsolete ecb(arc4) skcipher [ 442.352266][T15503] netlink: 40 bytes leftover after parsing attributes in process `syz.2.2444'. [ 442.364354][T15503] netlink: 40 bytes leftover after parsing attributes in process `syz.2.2444'. [ 443.033216][T15536] netlink: 28 bytes leftover after parsing attributes in process `syz.0.2454'. [ 443.251928][T15549] netlink: 48 bytes leftover after parsing attributes in process `syz.4.2459'. [ 443.272557][T15549] netlink: 48 bytes leftover after parsing attributes in process `syz.4.2459'. [ 443.292773][T15553] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2461'. [ 443.369945][T15553] bond9: entered promiscuous mode [ 443.375729][T15553] 8021q: adding VLAN 0 to HW filter on device bond9 [ 444.558372][ C0] ip6_tunnel: ip6erspan1 xmit: Local address not yet configured! [ 444.656003][T15617] __nla_validate_parse: 2 callbacks suppressed [ 444.656023][T15617] netlink: 64 bytes leftover after parsing attributes in process `syz.4.2480'. [ 444.740547][T15611] syzkaller1: entered promiscuous mode [ 444.742705][T15602] netlink: 40 bytes leftover after parsing attributes in process `syz.0.2476'. [ 444.765859][T15611] syzkaller1: entered allmulticast mode [ 444.874173][T15626] lo speed is unknown, defaulting to 1000 [ 444.896751][T15626] lo speed is unknown, defaulting to 1000 [ 445.041155][T15628] IPVS: set_ctl: invalid protocol: 2 0.0.0.0:20004 [ 445.071065][T15628] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2484'. [ 445.135806][T15629] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2484'. [ 445.230608][T15644] openvswitch: netlink: Tunnel attr 228 out of range max 16 [ 445.281278][T15628] bond10: option packets_per_slave: mode dependency failed, not supported in mode balance-tlb(5) [ 445.282848][T15644] netlink: 'syz.0.2488': attribute type 1 has an invalid length. [ 445.308168][T15628] bond10 (unregistering): Released all slaves [ 445.319129][T15644] netlink: 228 bytes leftover after parsing attributes in process `syz.0.2488'. [ 445.476346][T15629] tipc: Resetting bearer [ 445.807902][ T6139] netdevsim netdevsim4 netdevsim0: unset [0, 0] type 1 family 0 port 2816 - 0 [ 445.817966][ T6139] netdevsim netdevsim4 netdevsim0: unset [0, 1] type 1 family 0 port 8472 - 0 [ 445.830470][ T6139] netdevsim netdevsim4 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 445.840079][T15655] netlink: 48 bytes leftover after parsing attributes in process `syz.4.2489'. [ 445.850106][ T6139] netdevsim netdevsim4 netdevsim1: unset [0, 0] type 1 family 0 port 2816 - 0 [ 445.859140][ T6139] netdevsim netdevsim4 netdevsim1: unset [0, 1] type 1 family 0 port 8472 - 0 [ 445.868546][ T6139] netdevsim netdevsim4 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 445.895493][T15655] netlink: 48 bytes leftover after parsing attributes in process `syz.4.2489'. [ 445.899930][ T6139] netdevsim netdevsim4 netdevsim2: unset [0, 0] type 1 family 0 port 2816 - 0 [ 445.917221][ T6139] netdevsim netdevsim4 netdevsim2: unset [0, 1] type 1 family 0 port 8472 - 0 [ 445.927142][ T6139] netdevsim netdevsim4 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 445.937899][ T6139] netdevsim netdevsim4 netdevsim3: unset [0, 0] type 1 family 0 port 2816 - 0 [ 445.947852][ T6139] netdevsim netdevsim4 netdevsim3: unset [0, 1] type 1 family 0 port 8472 - 0 [ 445.957583][ T6139] netdevsim netdevsim4 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 446.474820][ C0] ip6_tunnel: ip6tnl3 xmit: Local address not yet configured! [ 446.547385][T15673] FAULT_INJECTION: forcing a failure. [ 446.547385][T15673] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 446.586865][T15673] CPU: 1 UID: 0 PID: 15673 Comm: syz.2.2496 Not tainted syzkaller #0 PREEMPT(full) [ 446.586896][T15673] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 446.586910][T15673] Call Trace: [ 446.586918][T15673] [ 446.586927][T15673] dump_stack_lvl+0xe8/0x150 [ 446.586965][T15673] should_fail_ex+0x40c/0x560 [ 446.586996][T15673] _copy_from_iter+0x1d3/0x1660 [ 446.587028][T15673] ? kmem_cache_alloc_node_noprof+0x1a1/0x610 [ 446.587057][T15673] ? rcu_is_watching+0x15/0xb0 [ 446.587091][T15673] ? trace_kmem_cache_alloc+0x29/0xe0 [ 446.587120][T15673] ? kmem_cache_alloc_node_noprof+0x3b8/0x610 [ 446.587147][T15673] ? __pfx__copy_from_iter+0x10/0x10 [ 446.587175][T15673] ? __alloc_skb+0x276/0x7a0 [ 446.587203][T15673] ? __alloc_skb+0x276/0x7a0 [ 446.587246][T15673] ? netlink_sendmsg+0x650/0xb40 [ 446.587267][T15673] ? skb_put+0x112/0x210 [ 446.587301][T15673] netlink_sendmsg+0x6c0/0xb40 [ 446.587334][T15673] ? __pfx_netlink_sendmsg+0x10/0x10 [ 446.587361][T15673] ? aa_sock_msg_perm+0xf1/0x1b0 [ 446.587389][T15673] ? __pfx_netlink_sendmsg+0x10/0x10 [ 446.587410][T15673] sock_sendmsg_nosec+0x13a/0x180 [ 446.587439][T15673] ____sys_sendmsg+0x54e/0x850 [ 446.587479][T15673] ? __pfx_____sys_sendmsg+0x10/0x10 [ 446.587523][T15673] ? import_iovec+0x73/0xa0 [ 446.587558][T15673] ___sys_sendmsg+0x2a5/0x360 [ 446.587589][T15673] ? __lock_acquire+0x683/0x2cf0 [ 446.587624][T15673] ? __pfx____sys_sendmsg+0x10/0x10 [ 446.587697][T15673] ? __fget_files+0x2a/0x420 [ 446.587724][T15673] ? __fget_files+0x3a2/0x420 [ 446.587765][T15673] __x64_sys_sendmsg+0x1b1/0x290 [ 446.587802][T15673] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 446.587856][T15673] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 446.587881][T15673] do_syscall_64+0x174/0x580 [ 446.587912][T15673] ? trace_irq_disable+0x3b/0x140 [ 446.587940][T15673] ? clear_bhb_loop+0x40/0x90 [ 446.587967][T15673] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 446.587989][T15673] RIP: 0033:0x7f414d79de59 [ 446.588009][T15673] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 446.588028][T15673] RSP: 002b:00007f414e6dd028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 446.588051][T15673] RAX: ffffffffffffffda RBX: 00007f414da25fa0 RCX: 00007f414d79de59 [ 446.588067][T15673] RDX: 0000000020000000 RSI: 0000200000000080 RDI: 0000000000000003 [ 446.588081][T15673] RBP: 00007f414e6dd090 R08: 0000000000000000 R09: 0000000000000000 [ 446.588095][T15673] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 446.588107][T15673] R13: 00007f414da26038 R14: 00007f414da25fa0 R15: 00007fff872fb138 [ 446.588142][T15673] [ 447.043566][T15693] netlink: 48 bytes leftover after parsing attributes in process `syz.0.2500'. [ 447.067849][T15693] netlink: 48 bytes leftover after parsing attributes in process `syz.0.2500'. [ 447.091790][T15695] netlink: 36 bytes leftover after parsing attributes in process `syz.4.2502'. [ 447.437585][T15718] netlink: 'syz.4.2510': attribute type 29 has an invalid length. [ 447.515776][T15723] lo speed is unknown, defaulting to 1000 [ 447.531683][T15723] lo speed is unknown, defaulting to 1000 [ 447.860195][T15737] netlink: 'syz.1.2511': attribute type 1 has an invalid length. [ 447.893150][T15733] block nbd0: reconnected socket [ 448.333802][T15750] syzkaller0: entered promiscuous mode [ 448.339785][T15750] syzkaller0: entered allmulticast mode [ 448.637675][T15771] netlink: 'syz.3.2523': attribute type 1 has an invalid length. [ 449.062800][T15785] lo speed is unknown, defaulting to 1000 [ 449.111681][T15785] lo speed is unknown, defaulting to 1000 [ 449.153972][T15788] syzkaller0: entered promiscuous mode [ 449.161847][T15788] syzkaller0: entered allmulticast mode [ 449.230681][T15792] netdevsim netdevsim3 €Â: renamed from netdevsim0 (while UP) [ 449.743033][ T4937] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 449.754869][ T4937] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 449.765247][ T4937] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 449.778760][ T4937] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 449.787101][ T4937] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 449.808356][T15801] __nla_validate_parse: 12 callbacks suppressed [ 449.808375][T15801] netlink: 7 bytes leftover after parsing attributes in process `syz.3.2532'. [ 449.861573][T15801] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2532'. [ 450.657557][T15842] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2538'. [ 450.720023][T15799] lo speed is unknown, defaulting to 1000 [ 450.753069][T15799] lo speed is unknown, defaulting to 1000 [ 450.786941][T15842] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2538'. [ 450.870828][T15822] vxcan1: entered allmulticast mode [ 451.130257][T15849] netlink: 28 bytes leftover after parsing attributes in process `syz.0.2540'. [ 451.315141][T15851] "syz.4.2541" (15851) uses obsolete ecb(arc4) skcipher [ 451.350663][T15858] bond9 (unregistering): Released all slaves [ 451.397539][T15864] netlink: 104 bytes leftover after parsing attributes in process `syz.3.2542'. [ 451.689476][T15877] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2544'. [ 451.851767][T15799] bridge0: port 1(bridge_slave_0) entered blocking state [ 451.868346][T15799] bridge0: port 1(bridge_slave_0) entered disabled state [ 451.888843][T15799] bridge_slave_0: entered allmulticast mode [ 451.911539][T15799] bridge_slave_0: entered promiscuous mode [ 451.925008][ T5639] Bluetooth: hci5: command tx timeout [ 451.938588][T15799] bridge0: port 2(bridge_slave_1) entered blocking state [ 451.964637][T15799] bridge0: port 2(bridge_slave_1) entered disabled state [ 451.977480][T15799] bridge_slave_1: entered allmulticast mode [ 452.000184][T15799] bridge_slave_1: entered promiscuous mode [ 452.106942][T15799] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 452.148403][T15799] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 452.160802][T15891] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2548'. [ 452.263805][T15799] team0: Port device team_slave_0 added [ 452.282323][T15891] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2548'. [ 452.307210][T15799] team0: Port device team_slave_1 added [ 452.433005][T15799] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 452.434986][T15899] netlink: 28 bytes leftover after parsing attributes in process `syz.3.2549'. [ 452.458053][T15799] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 452.528808][T15799] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 452.553010][T15799] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 452.568538][T15799] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 452.597784][T15799] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 452.703040][T15904] FAULT_INJECTION: forcing a failure. [ 452.703040][T15904] name failslab, interval 1, probability 0, space 0, times 1 [ 452.717727][T15904] CPU: 1 UID: 0 PID: 15904 Comm: syz.0.2551 Not tainted syzkaller #0 PREEMPT(full) [ 452.717751][T15904] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 452.717763][T15904] Call Trace: [ 452.717770][T15904] [ 452.717778][T15904] dump_stack_lvl+0xe8/0x150 [ 452.717813][T15904] should_fail_ex+0x40c/0x560 [ 452.717839][T15904] should_failslab+0xa8/0x100 [ 452.717867][T15904] kmem_cache_alloc_noprof+0xa6/0x5f0 [ 452.717890][T15904] ? skb_clone+0x212/0x3a0 [ 452.717906][T15904] ? skb_clone+0x212/0x3a0 [ 452.717930][T15904] skb_clone+0x212/0x3a0 [ 452.717963][T15904] __netlink_deliver_tap+0x413/0x860 [ 452.717992][T15904] ? netlink_deliver_tap+0x2e/0x1b0 [ 452.718011][T15904] netlink_deliver_tap+0x19c/0x1b0 [ 452.718030][T15904] netlink_sendskb+0x68/0x140 [ 452.718058][T15904] netlink_rcv_skb+0x2a4/0x4a0 [ 452.718088][T15904] ? __pfx_genl_rcv_msg+0x10/0x10 [ 452.718112][T15904] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 452.718180][T15904] ? down_read+0x2be/0x330 [ 452.718206][T15904] genl_rcv+0x28/0x40 [ 452.718231][T15904] netlink_unicast+0x7bb/0x940 [ 452.718270][T15904] netlink_sendmsg+0x813/0xb40 [ 452.718295][T15904] ? __pfx_netlink_sendmsg+0x10/0x10 [ 452.718317][T15904] ? aa_sock_msg_perm+0xf1/0x1b0 [ 452.718341][T15904] ? __pfx_netlink_sendmsg+0x10/0x10 [ 452.718358][T15904] sock_sendmsg_nosec+0x13a/0x180 [ 452.718382][T15904] ____sys_sendmsg+0x54e/0x850 [ 452.718415][T15904] ? __pfx_____sys_sendmsg+0x10/0x10 [ 452.718453][T15904] ? import_iovec+0x73/0xa0 [ 452.718485][T15904] ___sys_sendmsg+0x2a5/0x360 [ 452.718511][T15904] ? __lock_acquire+0x683/0x2cf0 [ 452.718540][T15904] ? __pfx____sys_sendmsg+0x10/0x10 [ 452.718600][T15904] ? __fget_files+0x2a/0x420 [ 452.718622][T15904] ? __fget_files+0x3a2/0x420 [ 452.718656][T15904] __x64_sys_sendmsg+0x1b1/0x290 [ 452.718687][T15904] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 452.718734][T15904] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 452.718755][T15904] do_syscall_64+0x174/0x580 [ 452.718783][T15904] ? trace_irq_disable+0x3b/0x140 [ 452.718806][T15904] ? clear_bhb_loop+0x40/0x90 [ 452.718829][T15904] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 452.718847][T15904] RIP: 0033:0x7f8dded9de59 [ 452.718866][T15904] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 452.718884][T15904] RSP: 002b:00007f8ddfc4a028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 452.718907][T15904] RAX: ffffffffffffffda RBX: 00007f8ddf025fa0 RCX: 00007f8dded9de59 [ 452.718923][T15904] RDX: 0000000020000000 RSI: 0000200000000080 RDI: 0000000000000003 [ 452.718937][T15904] RBP: 00007f8ddfc4a090 R08: 0000000000000000 R09: 0000000000000000 [ 452.718959][T15904] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 452.718971][T15904] R13: 00007f8ddf026038 R14: 00007f8ddf025fa0 R15: 00007ffc66c7a598 [ 452.719008][T15904] [ 452.722950][T15908] Unsupported ieee802154 address type: 0 [ 452.770867][T15799] hsr_slave_0: entered promiscuous mode [ 453.030622][T15799] hsr_slave_1: entered promiscuous mode [ 453.037133][T15799] debugfs: 'hsr0' already exists in 'hsr' [ 453.042984][T15799] Cannot create hsr debugfs directory [ 453.048684][T15905] lo speed is unknown, defaulting to 1000 [ 453.059959][T15905] lo speed is unknown, defaulting to 1000 [ 453.109119][T15911] xt_CT: You must specify a L4 protocol and not use inversions on it [ 453.499331][T15926] "syz.4.2556" (15926) uses obsolete ecb(arc4) skcipher [ 454.007494][ T5639] Bluetooth: hci5: command tx timeout [ 454.025382][T15929] mac80211_hwsim hwsim0 wlan0: entered promiscuous mode [ 454.039328][T15929] netlink: 'syz.0.2557': attribute type 1 has an invalid length. [ 454.170745][T15799] netdevsim netdevsim2 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 454.207787][T15799] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 454.415087][T15799] netdevsim netdevsim2 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 454.425537][T15799] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 454.615928][T15960] "syz.0.2560" (15960) uses obsolete ecb(arc4) skcipher [ 454.693114][T15799] netdevsim netdevsim2 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 454.704128][T15799] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 455.068022][T15799] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 455.080461][T15799] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 455.090771][T15799] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 455.102554][T15799] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 455.111997][T15799] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 455.124436][T15799] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 455.145622][T15799] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 455.162470][T15799] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 455.316071][T15799] 8021q: adding VLAN 0 to HW filter on device bond0 [ 455.343671][T15799] 8021q: adding VLAN 0 to HW filter on device team0 [ 455.362963][T14645] bridge0: port 1(bridge_slave_0) entered blocking state [ 455.370232][T14645] bridge0: port 1(bridge_slave_0) entered forwarding state [ 455.414186][T15978] __nla_validate_parse: 1 callbacks suppressed [ 455.414207][T15978] netlink: 20 bytes leftover after parsing attributes in process `syz.3.2566'. [ 455.433008][T15084] bridge0: port 2(bridge_slave_1) entered blocking state [ 455.440257][T15084] bridge0: port 2(bridge_slave_1) entered forwarding state [ 455.647739][T15987] "syz.0.2568" (15987) uses obsolete ecb(arc4) skcipher [ 455.797149][T15981] netlink: 20 bytes leftover after parsing attributes in process `syz.3.2566'. [ 455.840730][T15981] nbd: nbd64 already in use [ 456.049543][T15992] syzkaller0: entered promiscuous mode [ 456.083034][T15992] syzkaller0: entered allmulticast mode [ 456.085431][ T5639] Bluetooth: hci5: command tx timeout [ 456.188420][T14251] udevd[14251]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 456.441599][T16014] lo speed is unknown, defaulting to 1000 [ 456.462512][T16014] lo speed is unknown, defaulting to 1000 [ 456.606398][T16021] netlink: 64 bytes leftover after parsing attributes in process `syz.0.2574'. [ 456.663910][T15799] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 456.778039][T15799] veth0_vlan: entered promiscuous mode [ 456.802349][T15799] veth1_vlan: entered promiscuous mode [ 456.872229][T15799] veth0_macvtap: entered promiscuous mode [ 456.905426][T15799] veth1_macvtap: entered promiscuous mode [ 456.995522][T15799] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 457.011006][T15799] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 457.068987][T15997] netlink: 1244 bytes leftover after parsing attributes in process `syz.1.2562'. [ 457.089355][T14645] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 457.104035][T14645] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 457.117244][T14645] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 457.126809][T14645] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 457.233858][T16038] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2578'. [ 457.672696][T16044] netlink: 52 bytes leftover after parsing attributes in process `syz.0.2581'. [ 457.832331][T16047] netlink: 48 bytes leftover after parsing attributes in process `syz.4.2580'. [ 457.867043][T16044] workqueue: name exceeds WQ_NAME_LEN. Truncating to: ç–½mÔ%A¯úÆÿAZøZ´”àIƺ¥þ àø§% [ 457.920178][ T6145] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 457.942063][ T6145] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 458.025303][T16052] "syz.3.2583" (16052) uses obsolete ecb(arc4) skcipher [ 458.038759][ T6145] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 458.080860][ T6145] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 458.154927][ T5639] Bluetooth: hci5: command tx timeout [ 458.606056][T16068] lo speed is unknown, defaulting to 1000 [ 458.624856][T16068] lo speed is unknown, defaulting to 1000 [ 458.792160][T16081] netlink: 1244 bytes leftover after parsing attributes in process `syz.4.2588'. [ 458.914245][T16087] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2590'. [ 459.679571][T16109] syzkaller0: entered promiscuous mode [ 459.710336][T16109] syzkaller0: entered allmulticast mode [ 459.961017][T16120] netlink: 172 bytes leftover after parsing attributes in process `syz.2.2598'. [ 459.997102][T16122] netlink: 'syz.1.2592': attribute type 3 has an invalid length. [ 460.118289][T16130] "syz.2.2600" (16130) uses obsolete ecb(arc4) skcipher [ 460.447169][ T4937] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 460.463458][ T4937] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 460.472342][ T4937] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 460.492770][ T4937] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 460.503981][ T4937] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 460.682558][T16145] __nla_validate_parse: 2 callbacks suppressed [ 460.682577][T16145] netlink: 52 bytes leftover after parsing attributes in process `syz.1.2602'. [ 460.702748][ T5639] block nbd1: Receive control failed (result -32) [ 460.703991][ T4937] block nbd1: Receive control failed (result -32) [ 460.710114][ T5632] block nbd1: Receive control failed (result -32) [ 460.768567][T16145] netlink: 7 bytes leftover after parsing attributes in process `syz.1.2602'. [ 460.777865][T16145] netlink: 52 bytes leftover after parsing attributes in process `syz.1.2602'. [ 460.787477][T16145] netlink: 7 bytes leftover after parsing attributes in process `syz.1.2602'. [ 460.797143][T16145] netlink: 52 bytes leftover after parsing attributes in process `syz.1.2602'. [ 461.029467][T16155] netlink: 1244 bytes leftover after parsing attributes in process `syz.3.2606'. [ 461.436460][ T6139] netdevsim netdevsim0 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 2816 - 0 [ 461.448266][ T6139] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 461.492444][T16139] lo speed is unknown, defaulting to 1000 [ 461.501078][T16139] lo speed is unknown, defaulting to 1000 [ 461.553262][ T6139] netdevsim netdevsim0 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 2816 - 0 [ 461.563997][ T6139] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 461.727733][ T6139] netdevsim netdevsim0 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 2816 - 0 [ 461.742237][ T6139] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 462.103409][T16193] xt_hashlimit: Unknown mode mask 3FFFF, kernel too old? [ 462.113430][T16194] xt_hashlimit: Unknown mode mask 3FFFF, kernel too old? [ 462.122114][T16193] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 462.221629][T16198] ip_tunnel: non-ECT from 0.0.0.0 with TOS=0x3 [ 462.272100][T16198] syzkaller0: entered promiscuous mode [ 462.286035][T16198] syzkaller0: entered allmulticast mode [ 462.351808][T16198] tipc: Started in network mode [ 462.357964][T16198] tipc: Node identity 8607cc8bdd1b, cluster identity 4711 [ 462.384026][T16198] tipc: Enabled bearer , priority 0 [ 462.491938][T16198] tipc: Resetting bearer [ 462.561073][ T5632] Bluetooth: hci3: command tx timeout [ 462.574310][T16209] netlink: 104 bytes leftover after parsing attributes in process `syz.3.2619'. [ 462.588199][T16196] tipc: Resetting bearer [ 462.816473][T16196] tipc: Disabling bearer [ 462.831561][T16215] netlink: 'syz.1.2620': attribute type 1 has an invalid length. [ 462.840634][T16215] netlink: 248 bytes leftover after parsing attributes in process `syz.1.2620'. [ 463.042230][T16212] netlink: 1244 bytes leftover after parsing attributes in process `syz.1.2620'. [ 463.158860][T16218] bond9: option packets_per_slave: invalid value (1048582) [ 463.181495][T16218] bond9: option packets_per_slave: allowed values 0 - 65535 [ 463.198613][T16218] bond9 (unregistering): Released all slaves [ 463.526792][T16139] bridge0: port 1(bridge_slave_0) entered blocking state [ 463.542083][T16139] bridge0: port 1(bridge_slave_0) entered disabled state [ 463.567819][T16139] bridge_slave_0: entered allmulticast mode [ 463.591344][T16139] bridge_slave_0: entered promiscuous mode [ 463.615365][T16139] bridge0: port 2(bridge_slave_1) entered blocking state [ 463.623876][T16139] bridge0: port 2(bridge_slave_1) entered disabled state [ 463.632536][T16139] bridge_slave_1: entered allmulticast mode [ 463.640911][T16139] bridge_slave_1: entered promiscuous mode [ 463.703538][T16139] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 463.720789][T16139] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 463.842676][T16139] team0: Port device team_slave_0 added [ 463.859282][T16139] team0: Port device team_slave_1 added [ 463.900463][T16139] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 463.908405][T16139] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 463.938404][T16139] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 464.280644][ T6139] bond5 (unregistering): (slave ip6gre1): Releasing backup interface [ 464.343011][ T6139] team0: Port device xfrm0 removed [ 464.397458][ T6139] 0ªî{X¹¦ (unregistering): left promiscuous mode [ 464.421855][ T6139] bond2 (unregistering): (slave gretap0): Releasing active interface [ 464.579986][ T6139] bond0 (unregistering): Released all slaves [ 464.596053][ T6139] bond1 (unregistering): Released all slaves [ 464.612769][ T6139] bond2 (unregistering): Released all slaves [ 464.632027][ T6139] bond3 (unregistering): (slave macvlan1): Releasing backup interface [ 464.640760][ T5632] Bluetooth: hci3: command tx timeout [ 464.658453][ T6139] bond3 (unregistering): Released all slaves [ 464.674919][ T6139] bond4 (unregistering): Released all slaves [ 464.691401][ T6139] bond5 (unregistering): Released all slaves [ 464.712436][ T6139] bond6 (unregistering): Released all slaves [ 464.745852][ T6139] bond7 (unregistering): Released all slaves [ 464.769631][ T6139] bond8 (unregistering): (slave veth7): Releasing active interface [ 464.787514][ T6139] bond8 (unregistering): Released all slaves [ 464.805272][ T6139] bond9 (unregistering): Released all slaves [ 464.822858][ T5282] 8021q: adding VLAN 0 to HW filter on device eth1 [ 464.832946][T16139] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 464.847215][T16139] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 464.910006][T16139] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 465.013073][T16270] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2629'. [ 465.091778][T16270] netlink: 'syz.2.2629': attribute type 1 has an invalid length. [ 465.131836][T16139] hsr_slave_0: entered promiscuous mode [ 465.152106][T16139] hsr_slave_1: entered promiscuous mode [ 465.170734][T16139] debugfs: 'hsr0' already exists in 'hsr' [ 465.184233][T16139] Cannot create hsr debugfs directory [ 465.214214][T16277] tipc: Enabled bearer , priority 0 [ 465.245992][ T6139] : left promiscuous mode [ 465.412534][T16277] tipc: Disabling bearer [ 465.707212][ T6139] tipc: Disabling bearer [ 465.723759][ T6139] tipc: Left network mode [ 465.799077][ T6139] IPVS: stopping backup sync thread 10357 ... [ 465.808631][T16309] __nla_validate_parse: 5 callbacks suppressed [ 465.808648][T16309] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2637'. [ 465.901715][T16313] netlink: 'syz.3.2638': attribute type 11 has an invalid length. [ 466.211348][T16317] 8021q: adding VLAN 0 to HW filter on device team0 [ 466.221866][T16317] tipc: Resetting bearer [ 466.327143][T16317] 8021q: adding VLAN 0 to HW filter on device bond0 [ 466.338663][ T7860] ip6_tunnel: ip6erspan1 xmit: Local address not yet configured! [ 466.347602][ T7860] ip6_tunnel: ip6tnl3 xmit: Local address not yet configured! [ 466.357703][ T7860] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 466.515340][ T7860] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 466.529620][ T6018] lo speed is unknown, defaulting to 1000 [ 466.538590][ T5282] 8021q: adding VLAN 0 to HW filter on device eth2 [ 466.560042][T16333] netlink: 'syz.3.2642': attribute type 1 has an invalid length. [ 466.568159][ T6018] syz2: Port: 1 Link ACTIVE [ 466.598484][T16333] netlink: 248 bytes leftover after parsing attributes in process `syz.3.2642'. [ 466.600596][T16335] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2644'. [ 466.618701][T16335] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2644'. [ 466.683761][T16333] netlink: 1244 bytes leftover after parsing attributes in process `syz.3.2642'. [ 466.714791][ T5632] Bluetooth: hci3: command tx timeout [ 466.764998][ T187] ip6_tunnel: ip6erspan1 xmit: Local address not yet configured! [ 466.777970][T16343] netlink: 68 bytes leftover after parsing attributes in process `syz.2.2646'. [ 466.885423][ T187] ip6_tunnel: ip6tnl3 xmit: Local address not yet configured! [ 466.947328][T16353] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2647'. [ 467.091026][T16356] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2648'. [ 467.486512][T16356] syzkaller1: entered promiscuous mode [ 467.500456][T16356] syzkaller1: entered allmulticast mode [ 468.140222][T16322] tipc: Resetting bearer [ 468.207530][T16392] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2656'. [ 468.272680][T16395] netlink: 'syz.2.2656': attribute type 2 has an invalid length. [ 468.800020][ T5632] Bluetooth: hci3: command tx timeout [ 468.823183][ T6139] veth0_to_team: left promiscuous mode [ 468.910048][ T6139] hsr_slave_0: left promiscuous mode [ 468.920850][ T6139] hsr_slave_1: left promiscuous mode [ 469.007170][ T6139] veth1_macvtap: left promiscuous mode [ 469.025141][ T6139] veth1_vlan: left promiscuous mode [ 469.034169][ T6139] veth0_vlan: left promiscuous mode [ 469.057179][T16422] netlink: 'syz.3.2660': attribute type 1 has an invalid length. [ 469.083471][T16422] netlink: 248 bytes leftover after parsing attributes in process `syz.3.2660'. [ 470.163058][ C0] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 470.320062][ T6141] smc: removing ib device syz1 [ 470.385967][ T6018] lo speed is unknown, defaulting to 1000 [ 470.419866][ T6018] syz1: Port: 1 Link DOWN [ 470.531580][ T6141] smbdirect: ib_dev[syz1] removed [ 471.015855][ T4937] block nbd2: Receive control failed (result -32) [ 471.017464][ T5639] block nbd2: Receive control failed (result -32) [ 471.023191][ T5632] block nbd2: Receive control failed (result -32) [ 471.106350][T16467] syzkaller0: entered promiscuous mode [ 471.179852][T16467] syzkaller0: entered allmulticast mode [ 471.213860][T16139] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 471.230152][T16139] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 471.238454][T16139] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 471.267259][T16139] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 471.282059][T16139] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 471.314165][T16139] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 472.151750][T16139] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 472.170008][T16139] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 472.396662][T16139] 8021q: adding VLAN 0 to HW filter on device bond0 [ 472.429175][T16139] 8021q: adding VLAN 0 to HW filter on device team0 [ 472.446290][T15085] bridge0: port 1(bridge_slave_0) entered blocking state [ 472.453497][T15085] bridge0: port 1(bridge_slave_0) entered forwarding state [ 472.477869][T15085] bridge0: port 2(bridge_slave_1) entered blocking state [ 472.485092][T15085] bridge0: port 2(bridge_slave_1) entered forwarding state [ 473.270964][T16139] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 473.308266][ T6139] IPVS: stop unused estimator thread 0... [ 473.381472][T16139] veth0_vlan: entered promiscuous mode [ 473.417504][T16139] veth1_vlan: entered promiscuous mode [ 473.478625][T16139] veth0_macvtap: entered promiscuous mode [ 473.501095][T16139] veth1_macvtap: entered promiscuous mode [ 473.536592][T16139] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 473.553068][T16139] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 473.570825][T14645] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 473.582720][T14645] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 473.594291][T14645] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 473.622242][T14645] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 473.740016][T15085] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 473.764717][T15085] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 473.812848][T15085] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 473.822308][T15085] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 475.914749][ C0] ip6_tunnel: ip6erspan1 xmit: Local address not yet configured! [ 481.676648][ C0] ip6_tunnel: ip6tnl3 xmit: Local address not yet configured! [ 486.158509][ C0] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 501.517628][ T1318] ieee802154 phy0 wpan0: encryption failed: -22 [ 519.278960][T16614] IPVS: sync thread started: state = BACKUP, mcast_ifn = geneve0, syncid = 1, id = 0 [ 519.479385][ T5632] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 519.493400][ T5632] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 519.506801][ T5632] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 519.517732][ T5632] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 519.526700][ T5632] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 519.579704][T16628] __nla_validate_parse: 4 callbacks suppressed [ 519.579725][T16628] netlink: 16166 bytes leftover after parsing attributes in process `syz.2.2672'. [ 519.643922][T16627] lo speed is unknown, defaulting to 1000 [ 519.678123][T16619] tipc: Enabled bearer , priority 0 [ 519.887096][T16619] syzkaller0: entered promiscuous mode [ 519.893248][T16619] syzkaller0: entered allmulticast mode [ 519.927557][T16617] lo speed is unknown, defaulting to 1000 [ 520.002837][T16636] tipc: Resetting bearer [ 520.122536][T16645] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2676'. [ 520.470044][T16622] lo speed is unknown, defaulting to 1000 [ 520.617966][T16616] tipc: Resetting bearer [ 520.645245][T16616] tipc: Disabling bearer [ 520.983487][T16668] syzkaller0: entered promiscuous mode [ 520.998078][T16668] syzkaller0: entered allmulticast mode [ 521.330966][T16703] netlink: 'syz.2.2688': attribute type 1 has an invalid length. [ 521.530709][T16622] bridge0: port 1(bridge_slave_0) entered blocking state [ 521.538565][T16622] bridge0: port 1(bridge_slave_0) entered disabled state [ 521.546976][T16622] bridge_slave_0: entered allmulticast mode [ 521.555331][T16622] bridge_slave_0: entered promiscuous mode [ 521.564397][T16622] bridge0: port 2(bridge_slave_1) entered blocking state [ 521.572632][T16622] bridge0: port 2(bridge_slave_1) entered disabled state [ 521.580982][T16622] bridge_slave_1: entered allmulticast mode [ 521.589408][T16716] netlink: 28 bytes leftover after parsing attributes in process `syz.3.2690'. [ 521.599030][ T5632] Bluetooth: hci4: command tx timeout [ 521.609467][T16622] bridge_slave_1: entered promiscuous mode [ 521.693385][T16622] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 521.709048][T16622] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 521.718887][T16709] lo speed is unknown, defaulting to 1000 [ 521.776177][T16711] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2692'. [ 521.790259][T16622] team0: Port device team_slave_0 added [ 521.827801][T16622] team0: Port device team_slave_1 added [ 521.952390][T16622] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 521.960660][T16622] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 521.987091][T16622] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 522.001695][T16622] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 522.009180][T16622] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 522.036539][T16622] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 522.050101][T16725] netlink: 48 bytes leftover after parsing attributes in process `syz.1.2695'. [ 522.124043][T16721] syzkaller0: entered promiscuous mode [ 522.138935][T16721] syzkaller0: entered allmulticast mode [ 522.264869][T16725] netlink: 48 bytes leftover after parsing attributes in process `syz.1.2695'. [ 523.679702][ T5632] Bluetooth: hci4: command tx timeout [ 524.539703][T16741] syzkaller0: entered promiscuous mode [ 524.545723][T16741] syzkaller0: entered allmulticast mode [ 524.576007][T16622] hsr_slave_0: entered promiscuous mode [ 524.601355][T16622] hsr_slave_1: entered promiscuous mode [ 524.620044][T16622] debugfs: 'hsr0' already exists in 'hsr' [ 524.634643][T16622] Cannot create hsr debugfs directory [ 524.718032][T16738] lo speed is unknown, defaulting to 1000 [ 524.718306][T16757] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2702'. [ 524.757521][T16757] tipc: Started in network mode [ 524.762610][T16757] tipc: Node identity fe800000000000000000000000000014, cluster identity 4711 [ 524.778659][T16757] tipc: Enabled bearer , priority 26 [ 524.910510][T16766] netlink: 1244 bytes leftover after parsing attributes in process `syz.2.2703'. [ 525.077668][T16771] batadv_slave_1: entered promiscuous mode [ 525.156719][T16771] batadv_slave_1: left promiscuous mode [ 525.306297][T16779] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2708'. [ 525.423476][T16788] netlink: 48 bytes leftover after parsing attributes in process `syz.3.2710'. [ 525.447021][T16788] netlink: 48 bytes leftover after parsing attributes in process `syz.3.2710'. [ 525.531167][T16790] §: renamed from sit0 (while UP) [ 525.566363][T16779] netlink: 27 bytes leftover after parsing attributes in process `syz.0.2708'. [ 525.755070][ T5632] Bluetooth: hci4: command tx timeout [ 525.798137][ T6018] tipc: Node number set to 4269801492 [ 525.809228][T16795] lo speed is unknown, defaulting to 1000 [ 525.931519][T16622] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 525.943321][T16622] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 525.963603][T16622] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 525.975305][T16622] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 525.983479][T16622] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 526.009166][T16622] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 526.025841][T16622] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 526.041132][T16622] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 526.220606][T16785] netlink: 'syz.1.2707': attribute type 1 has an invalid length. [ 526.261324][T16808] netlink: 'syz.0.2715': attribute type 10 has an invalid length. [ 526.416652][T16815] lo speed is unknown, defaulting to 1000 [ 526.527601][T16831] netlink: 48 bytes leftover after parsing attributes in process `syz.0.2720'. [ 526.556919][T16831] netlink: 48 bytes leftover after parsing attributes in process `syz.0.2720'. [ 526.752735][T16834] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2721'. [ 526.762132][T16834] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2721'. [ 526.822007][T16622] 8021q: adding VLAN 0 to HW filter on device bond0 [ 526.848275][T14653] netdevsim netdevsim0 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 526.862142][T14653] netdevsim netdevsim0 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 526.893054][T14653] netdevsim netdevsim0 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 526.937926][T14653] netdevsim netdevsim0 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 526.976937][T16622] 8021q: adding VLAN 0 to HW filter on device team0 [ 527.024163][ T6141] bridge0: port 1(bridge_slave_0) entered blocking state [ 527.031455][ T6141] bridge0: port 1(bridge_slave_0) entered forwarding state [ 527.072433][ T6141] bridge0: port 2(bridge_slave_1) entered blocking state [ 527.079676][ T6141] bridge0: port 2(bridge_slave_1) entered forwarding state [ 527.114769][ C0] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 527.397500][T16851] netlink: 'syz.0.2725': attribute type 2 has an invalid length. [ 527.439794][T16847] 8021q: adding VLAN 0 to HW filter on device bond1 [ 527.585145][T16855] lo speed is unknown, defaulting to 1000 [ 527.820361][T16863] bond2: option ad_actor_sys_prio: mode dependency failed, not supported in mode balance-rr(0) [ 527.836214][ T5632] Bluetooth: hci4: command tx timeout [ 527.846850][T16863] bond2 (unregistering): Released all slaves [ 528.217808][T16886] netlink: 'syz.2.2735': attribute type 1 has an invalid length. [ 528.321572][T16886] bond1: entered promiscuous mode [ 528.328073][T16886] 8021q: adding VLAN 0 to HW filter on device bond1 [ 528.421110][T16622] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 528.531888][T16894] netlink: 'syz.2.2735': attribute type 5 has an invalid length. [ 528.621038][T16894] macvtap1: entered allmulticast mode [ 528.689759][T16899] IPv6: NLM_F_CREATE should be specified when creating new route [ 528.699396][T16900] IPv6: NLM_F_CREATE should be specified when creating new route [ 529.098848][T16622] veth0_vlan: entered promiscuous mode [ 529.123086][T16622] veth1_vlan: entered promiscuous mode [ 529.256826][T16622] veth0_macvtap: entered promiscuous mode [ 529.285609][T16622] veth1_macvtap: entered promiscuous mode [ 529.333035][T16622] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 529.406401][T16622] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 529.510366][ T6139] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 529.531090][ T6139] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 529.558235][ T6139] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 529.630013][ T6139] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 529.761490][ T6139] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 529.790265][ T6139] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 529.837252][ T6141] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 529.850382][ T6141] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 530.202843][T16946] __nla_validate_parse: 12 callbacks suppressed [ 530.202863][T16946] netlink: 52 bytes leftover after parsing attributes in process `syz.3.2746'. [ 530.231616][T16936] xt_CT: You must specify a L4 protocol and not use inversions on it [ 530.244394][T16943] bond0: option arp_validate: invalid value (55553) [ 530.262786][ T6139] bond0: (slave bond_slave_0): interface is now down [ 530.273768][ T6139] bond0: (slave bond_slave_1): interface is now down [ 530.298654][ T6139] bond0: now running without any active interface! [ 530.339778][T16912] lo speed is unknown, defaulting to 1000 [ 530.661760][T16961] netlink: 256 bytes leftover after parsing attributes in process `syz.3.2752'. [ 530.732073][T16961] netlink: 1244 bytes leftover after parsing attributes in process `syz.3.2752'. [ 530.908338][T16975] ref_tracker: memory allocation failure, unreliable refcount tracker. [ 530.961399][T16977] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2757'. [ 530.971509][T16977] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2757'. [ 531.026877][T16981] netlink: 24 bytes leftover after parsing attributes in process `syz.4.2758'. [ 531.050971][T16973] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2755'. [ 531.098078][T16984] veth1_to_bond: entered allmulticast mode [ 531.109201][T16984] veth1_to_bond: entered promiscuous mode [ 531.127511][T16984] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2759'. [ 531.156182][T16984] veth1_to_bond (unregistering): left allmulticast mode [ 531.163346][T16984] veth1_to_bond (unregistering): left promiscuous mode [ 531.176905][T16984] bond0: (slave bond_slave_1): Releasing backup interface [ 531.211242][T16986] netlink: 'syz.4.2760': attribute type 2 has an invalid length. [ 531.492399][T17003] syzkaller0: entered promiscuous mode [ 531.498315][T17003] syzkaller0: entered allmulticast mode [ 531.931864][T17023] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2769'. [ 531.974940][T17023] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2769'. [ 532.382504][ T5639] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 532.399498][ T5639] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 532.409958][ T5639] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 532.437917][ T5639] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 532.451609][ T5639] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 532.494793][ T187] IPVS: starting estimator thread 0... [ 532.500753][T17031] bridge0: port 1(bridge_slave_0) entered disabled state [ 532.614659][T17035] IPVS: using max 25 ests per chain, 60000 per kthread [ 532.630654][T17031] bridge_slave_0 (unregistering): left allmulticast mode [ 532.640948][T17031] bridge_slave_0 (unregistering): left promiscuous mode [ 532.662929][T17031] bridge0: port 1(bridge_slave_0) entered disabled state [ 532.887317][ T5625] syz_tun (unregistering): left allmulticast mode [ 532.983320][T17050] syz_tun: entered allmulticast mode [ 532.999953][T17050] netlink: 'syz.2.2777': attribute type 9 has an invalid length. [ 533.009199][T17050] netlink: 'syz.2.2777': attribute type 6 has an invalid length. [ 533.081774][T17049] syz_tun: left allmulticast mode [ 533.128582][T17056] netlink: 'syz.4.2778': attribute type 1 has an invalid length. [ 533.146740][T17056] netlink: 'syz.4.2778': attribute type 2 has an invalid length. [ 533.205587][T17033] lo speed is unknown, defaulting to 1000 [ 533.790062][T17090] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 533.834143][T17090] netlink: 'syz.2.2787': attribute type 1 has an invalid length. [ 533.922841][T17033] bridge0: port 1(bridge_slave_0) entered blocking state [ 533.936045][T17033] bridge0: port 1(bridge_slave_0) entered disabled state [ 533.955824][T17033] bridge_slave_0: entered allmulticast mode [ 533.963340][T17033] bridge_slave_0: entered promiscuous mode [ 533.982739][T17033] bridge0: port 2(bridge_slave_1) entered blocking state [ 533.996006][T17033] bridge0: port 2(bridge_slave_1) entered disabled state [ 534.008119][T17033] bridge_slave_1: entered allmulticast mode [ 534.026939][T17033] bridge_slave_1: entered promiscuous mode [ 534.098746][T17033] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 534.123282][T17033] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 534.203152][T17033] team0: Port device team_slave_0 added [ 534.212350][T17033] team0: Port device team_slave_1 added [ 534.261518][T17033] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 534.274814][T17033] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 534.303327][T17033] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 534.318682][T17033] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 534.327249][T17033] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 534.418272][T17033] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 534.459017][T17106] syzkaller0: entered promiscuous mode [ 534.465071][T17106] syzkaller0: entered allmulticast mode [ 534.565345][T17033] hsr_slave_0: entered promiscuous mode [ 534.585776][T17033] hsr_slave_1: entered promiscuous mode [ 534.607084][T17033] debugfs: 'hsr0' already exists in 'hsr' [ 534.618245][T17033] Cannot create hsr debugfs directory [ 534.872939][T17118] netlink: 'syz.2.2794': attribute type 1 has an invalid length. [ 535.019536][T17126] netlink: 'syz.4.2796': attribute type 12 has an invalid length. [ 535.030473][T17126] netlink: 'syz.4.2796': attribute type 29 has an invalid length. [ 535.039995][T17126] netlink: 'syz.4.2796': attribute type 1 has an invalid length. [ 535.138390][T17128] syzkaller0: entered promiscuous mode [ 535.148807][T17131] netlink: 'syz.2.2794': attribute type 3 has an invalid length. [ 535.157725][T17128] syzkaller0: entered allmulticast mode [ 535.263238][T17033] netdevsim netdevsim3 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 2816 - 0 [ 535.276630][T17033] netdevsim netdevsim3 netdevsim3 (unregistering): unset [0, 1] type 1 family 0 port 8472 - 0 [ 535.290765][T17033] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 535.303288][T17033] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 1] type 2 family 0 port 53110 - 0 [ 536.037824][T17163] "syz.2.2804" (17163) uses obsolete ecb(arc4) skcipher [ 536.289288][T17168] __nla_validate_parse: 18 callbacks suppressed [ 536.289308][T17168] netlink: 1244 bytes leftover after parsing attributes in process `syz.1.2803'. [ 537.810525][T17145] syzkaller0: entered promiscuous mode [ 537.816153][T17145] syzkaller0: entered allmulticast mode [ 537.950348][T17033] netdevsim netdevsim3 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 2816 - 0 [ 537.961486][T17033] netdevsim netdevsim3 netdevsim2 (unregistering): unset [0, 1] type 1 family 0 port 8472 - 0 [ 537.973722][T17033] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 537.986114][T17033] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 1] type 2 family 0 port 53110 - 0 [ 538.117135][T17033] netdevsim netdevsim3 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 2816 - 0 [ 538.138157][T17033] netdevsim netdevsim3 netdevsim1 (unregistering): unset [0, 1] type 1 family 0 port 8472 - 0 [ 538.164771][T17033] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 538.178291][T17033] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 1] type 2 family 0 port 53110 - 0 [ 538.213600][T17186] validate_nla: 2 callbacks suppressed [ 538.213621][T17186] netlink: 'syz.0.2808': attribute type 1 has an invalid length. [ 538.238368][T17190] x_tables: duplicate underflow at hook 1 [ 538.249988][T17186] netlink: 236 bytes leftover after parsing attributes in process `syz.0.2808'. [ 538.277400][T17186] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2808'. [ 538.353650][T17033] netdevsim netdevsim3 €Â (unregistering): unset [0, 0] type 1 family 0 port 2816 - 0 [ 538.368908][T17033] netdevsim netdevsim3 €Â (unregistering): unset [0, 1] type 1 family 0 port 8472 - 0 [ 538.379958][T17033] netdevsim netdevsim3 €Â (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 538.390548][T17033] netdevsim netdevsim3 €Â (unregistering): unset [1, 1] type 2 family 0 port 53110 - 0 [ 538.433132][T17184] pimreg9: entered allmulticast mode [ 538.687764][T17033] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 538.701996][T17033] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 538.710850][T17033] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 538.722799][T17033] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 538.732659][T17033] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 538.744386][T17033] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 538.753542][T17033] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 538.766771][T17033] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 538.911432][T17033] 8021q: adding VLAN 0 to HW filter on device bond0 [ 538.939549][T17033] 8021q: adding VLAN 0 to HW filter on device team0 [ 538.980871][T14645] bridge0: port 1(bridge_slave_0) entered blocking state [ 538.988097][T14645] bridge0: port 1(bridge_slave_0) entered forwarding state [ 539.013464][T14645] bridge0: port 2(bridge_slave_1) entered blocking state [ 539.020751][T14645] bridge0: port 2(bridge_slave_1) entered forwarding state [ 539.200082][T17033] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 539.765657][T17237] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2818'. [ 539.791960][T17238] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2819'. [ 539.802525][T17227] lo speed is unknown, defaulting to 1000 [ 540.016309][T17245] syzkaller0: entered promiscuous mode [ 540.036012][T17245] syzkaller0: entered allmulticast mode [ 540.072227][T17033] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 540.182383][T17247] tipc: Resetting bearer [ 540.202001][T17247] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 540.224070][T17253] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2820'. [ 540.254409][T17245] netlink: 'syz.4.2820': attribute type 21 has an invalid length. [ 540.268343][T17245] IPv6: NLM_F_CREATE should be specified when creating new route [ 540.330220][T17254] team0: Refused to change device type [ 540.510929][T17033] veth0_vlan: entered promiscuous mode [ 540.534267][T17033] veth1_vlan: entered promiscuous mode [ 540.591398][T17260] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2823'. [ 540.605516][T17033] veth0_macvtap: entered promiscuous mode [ 540.618170][T17260] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2823'. [ 540.623694][T17033] veth1_macvtap: entered promiscuous mode [ 540.681664][T17260] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2823'. [ 540.694344][T17033] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 540.704583][T17260] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2823'. [ 540.716934][ T6139] netdevsim netdevsim4 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 540.742035][T17033] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 540.752714][ T6139] netdevsim netdevsim4 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 540.763654][ T6139] netdevsim netdevsim4 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 540.803727][ T6139] netdevsim netdevsim4 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 540.850946][ T6139] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 540.903699][ T6139] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 541.116645][ T6139] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 541.267690][ T6139] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 541.332680][T14645] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 541.348033][T14645] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 541.441999][T14645] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 541.469384][T14645] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 541.499669][T17276] __nla_validate_parse: 1 callbacks suppressed [ 541.499687][T17276] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2829'. [ 541.536181][T17276] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2829'. [ 541.559793][T17276] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2829'. [ 541.580659][T17276] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2829'. [ 541.755603][T17281] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2771'. [ 541.839127][T17281] team0: Port device team_slave_0 removed [ 541.868086][T17287] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2831'. [ 542.229272][T17301] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2835'. [ 542.256594][T17301] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2835'. [ 542.285919][T17301] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2835'. [ 542.305189][T17301] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2835'. [ 542.475001][ C0] ip6_tunnel: ip6erspan1 xmit: Local address not yet configured! [ 542.990852][T17302] netlink: 'syz.1.2833': attribute type 4 has an invalid length. [ 543.021714][T17320] ip6tnl1: entered allmulticast mode [ 543.067094][T17322] syzkaller0: entered promiscuous mode [ 543.084870][T17322] syzkaller0: entered allmulticast mode [ 543.358962][T17332] ip6t_REJECT: ECHOREPLY is not supported [ 543.453637][T17339] IPVS: set_ctl: invalid protocol: 47 172.20.20.187:20000 [ 543.585603][T17333] netlink: 'syz.2.2849': attribute type 10 has an invalid length. [ 543.629490][T17340] IPVS: set_ctl: invalid protocol: 47 172.20.20.187:20000 [ 543.647044][T17336] 8021q: adding VLAN 0 to HW filter on device macvlan3 [ 543.683503][T17333] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 543.719014][T17333] team0: Port device netdevsim1 added [ 543.728410][T17333] netdevsim netdevsim2 netdevsim1: entered promiscuous mode [ 543.746549][ T7862] team_slave_0: entered promiscuous mode [ 543.754137][ T7862] team_slave_1: entered promiscuous mode [ 543.852346][T17357] IPv6: NLM_F_CREATE should be specified when creating new route [ 543.894041][T17355] lo speed is unknown, defaulting to 1000 [ 544.044091][T17364] FAULT_INJECTION: forcing a failure. [ 544.044091][T17364] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 544.057843][ T6145] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 544.069384][T17364] CPU: 1 UID: 0 PID: 17364 Comm: syz.4.2856 Not tainted syzkaller #0 PREEMPT(full) [ 544.069413][T17364] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 544.069428][T17364] Call Trace: [ 544.069436][T17364] [ 544.069445][T17364] dump_stack_lvl+0xe8/0x150 [ 544.069485][T17364] should_fail_ex+0x40c/0x560 [ 544.069517][T17364] _copy_to_user+0x31/0xb0 [ 544.069552][T17364] simple_read_from_buffer+0xe1/0x170 [ 544.069588][T17364] proc_fail_nth_read+0x1bb/0x230 [ 544.069623][T17364] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 544.069656][T17364] ? rw_verify_area+0x24a/0x4c0 [ 544.069689][T17364] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 544.069717][T17364] vfs_read+0x213/0xa80 [ 544.069754][T17364] ? __pfx___mutex_lock+0x10/0x10 [ 544.069786][T17364] ? __pfx_vfs_read+0x10/0x10 [ 544.069793][ T6145] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 544.069820][T17364] ? __fget_files+0x2a/0x420 [ 544.069930][T17364] ? __fget_files+0x3a2/0x420 [ 544.070025][T17364] ? __fget_files+0x2a/0x420 [ 544.070135][T17364] ksys_read+0x150/0x270 [ 544.070224][T17364] ? __pfx_ksys_read+0x10/0x10 [ 544.070336][T17364] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 544.070387][T17364] do_syscall_64+0x174/0x580 [ 544.070472][T17364] ? clear_bhb_loop+0x40/0x90 [ 544.070545][T17364] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 544.070608][T17364] RIP: 0033:0x7fb91e35e68e [ 544.070661][T17364] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 544.070713][T17364] RSP: 002b:00007fb91f1b5fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 544.070770][T17364] RAX: ffffffffffffffda RBX: 00007fb91f1b66c0 RCX: 00007fb91e35e68e [ 544.070811][T17364] RDX: 000000000000000f RSI: 00007fb91f1b60a0 RDI: 0000000000000005 [ 544.070854][T17364] RBP: 00007fb91f1b6090 R08: 0000000000000000 R09: 0000000000000000 [ 544.070881][T17364] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 544.070920][T17364] R13: 00007fb91e626038 R14: 00007fb91e625fa0 R15: 00007ffc8d89b4f8 [ 544.071006][T17364] [ 544.352012][T17366] bridge_slave_1: left allmulticast mode [ 544.377814][T17366] bridge_slave_1: left promiscuous mode [ 544.393850][T17366] bridge0: port 2(bridge_slave_1) entered disabled state [ 544.467423][T17372] FAULT_INJECTION: forcing a failure. [ 544.467423][T17372] name failslab, interval 1, probability 0, space 0, times 0 [ 544.482707][T17372] CPU: 1 UID: 0 PID: 17372 Comm: syz.2.2858 Not tainted syzkaller #0 PREEMPT(full) [ 544.482736][T17372] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 544.482750][T17372] Call Trace: [ 544.482758][T17372] [ 544.482768][T17372] dump_stack_lvl+0xe8/0x150 [ 544.482816][T17372] should_fail_ex+0x40c/0x560 [ 544.482848][T17372] should_failslab+0xa8/0x100 [ 544.482882][T17372] kmem_cache_alloc_noprof+0xa6/0x5f0 [ 544.482911][T17372] ? skb_clone+0x212/0x3a0 [ 544.482931][T17372] ? skb_clone+0x212/0x3a0 [ 544.482960][T17372] skb_clone+0x212/0x3a0 [ 544.482980][T17372] ? dev_queue_xmit_nit+0x25c/0xac0 [ 544.483016][T17372] dev_queue_xmit_nit+0x28d/0xac0 [ 544.483047][T17372] ? dev_queue_xmit_nit+0x2d/0xac0 [ 544.483089][T17372] dev_hard_start_xmit+0x1c1/0x830 [ 544.483131][T17372] __dev_queue_xmit+0x1435/0x37f0 [ 544.483154][T17372] ? do_syscall_64+0x174/0x580 [ 544.483185][T17372] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 544.483222][T17372] ? __dev_queue_xmit+0x29b/0x37f0 [ 544.483256][T17372] ? __pfx___dev_queue_xmit+0x10/0x10 [ 544.483294][T17372] ? __copy_skb_header+0xa3/0x4a0 [ 544.483341][T17372] ? __skb_clone+0x449/0x6c0 [ 544.483382][T17372] ? skb_clone+0x246/0x3a0 [ 544.483407][T17372] __netlink_deliver_tap+0x5b4/0x860 [ 544.483443][T17372] ? netlink_deliver_tap+0x2e/0x1b0 [ 544.483468][T17372] netlink_deliver_tap+0x19c/0x1b0 [ 544.483492][T17372] netlink_unicast+0x77f/0x940 [ 544.483537][T17372] netlink_sendmsg+0x813/0xb40 [ 544.483571][T17372] ? __pfx_netlink_sendmsg+0x10/0x10 [ 544.483599][T17372] ? aa_sock_msg_perm+0xf1/0x1b0 [ 544.483629][T17372] ? __pfx_netlink_sendmsg+0x10/0x10 [ 544.483651][T17372] sock_sendmsg_nosec+0x13a/0x180 [ 544.483681][T17372] ____sys_sendmsg+0x54e/0x850 [ 544.483722][T17372] ? __pfx_____sys_sendmsg+0x10/0x10 [ 544.483768][T17372] ? import_iovec+0x73/0xa0 [ 544.483811][T17372] ___sys_sendmsg+0x2a5/0x360 [ 544.483843][T17372] ? __lock_acquire+0x683/0x2cf0 [ 544.483885][T17372] ? __pfx____sys_sendmsg+0x10/0x10 [ 544.483965][T17372] ? __fget_files+0x2a/0x420 [ 544.483993][T17372] ? __fget_files+0x3a2/0x420 [ 544.484035][T17372] __x64_sys_sendmsg+0x1b1/0x290 [ 544.484072][T17372] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 544.484128][T17372] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 544.484152][T17372] do_syscall_64+0x174/0x580 [ 544.484181][T17372] ? trace_irq_disable+0x3b/0x140 [ 544.484209][T17372] ? clear_bhb_loop+0x40/0x90 [ 544.484237][T17372] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 544.484259][T17372] RIP: 0033:0x7f605ab9de59 [ 544.484280][T17372] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 544.484298][T17372] RSP: 002b:00007f605b98a028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 544.484321][T17372] RAX: ffffffffffffffda RBX: 00007f605ae26180 RCX: 00007f605ab9de59 [ 544.484338][T17372] RDX: 0000000000000000 RSI: 0000200000000440 RDI: 0000000000000003 [ 544.484351][T17372] RBP: 00007f605b98a090 R08: 0000000000000000 R09: 0000000000000000 [ 544.484365][T17372] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 544.484377][T17372] R13: 00007f605ae26218 R14: 00007f605ae26180 R15: 00007ffcc6ef4138 [ 544.484414][T17372] [ 544.820517][T17366] bond0: (slave bond_slave_0): Releasing backup interface [ 544.874212][T17366] team_slave_0: left promiscuous mode [ 544.923751][T17366] team0: Port device team_slave_0 removed [ 544.951773][T17366] team_slave_1: left promiscuous mode [ 544.976838][T17366] team0: Port device team_slave_1 removed [ 544.983982][T17366] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 544.992059][T17366] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 545.003099][T17381] openvswitch: netlink: Message has 8 unknown bytes. [ 545.020358][T17366] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 545.033497][T17366] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 545.051551][T17366] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 545.067789][ T6145] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 545.080380][ T6145] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 545.158052][T17369] team0: Device xfrm0 is of different type [ 545.194917][T17372] tipc: Enabled bearer , priority 0 [ 545.209629][ T6139] tipc: Resetting bearer [ 545.559944][T17402] batadv_slave_1: mtu less than device minimum [ 545.652391][T17401] netlink: 'syz.3.2866': attribute type 3 has an invalid length. [ 545.681366][T17401] netlink: 'syz.3.2866': attribute type 16 has an invalid length. [ 545.979248][ T24] IPVS: starting estimator thread 0... [ 546.007443][T17426] sch_tbf: burst 7 is lower than device syzkaller0 mtu (1500) ! [ 546.037998][T17426] syzkaller0: entered promiscuous mode [ 546.052441][T17426] syzkaller0: entered allmulticast mode [ 546.085451][T17430] IPVS: using max 24 ests per chain, 57600 per kthread [ 546.132149][T17433] bridge_slave_0: left allmulticast mode [ 546.159055][T17433] bridge_slave_0: left promiscuous mode [ 546.166664][T17433] bridge0: port 1(bridge_slave_0) entered disabled state [ 546.190284][T17433] bridge_slave_1: left allmulticast mode [ 546.263139][T17433] bridge_slave_1: left promiscuous mode [ 546.272971][T17433] bridge0: port 2(bridge_slave_1) entered disabled state [ 546.290035][T17433] bond0: (slave bond_slave_0): Releasing backup interface [ 546.301665][T17433] bond0: (slave bond_slave_1): Releasing backup interface [ 546.328326][T17433] team0: Port device team_slave_0 removed [ 546.343398][T17433] team0: Port device team_slave_1 removed [ 546.350374][T17433] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 546.362209][T17433] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 546.374267][T17433] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 546.383596][T17433] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 546.445848][T17433] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 546.516646][T17434] team0: Port device xfrm0 added [ 546.521831][ T5737] tipc: Node number set to 1528614027 [ 546.543445][T17435] tipc: Enabled bearer , priority 0 [ 546.793028][T17442] sctp: [Deprecated]: syz.0.2876 (pid 17442) Use of int in max_burst socket option deprecated. [ 546.793028][T17442] Use struct sctp_assoc_value instead [ 547.346400][T17462] __nla_validate_parse: 11 callbacks suppressed [ 547.346421][T17462] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2880'. [ 547.522281][T17444] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2877'. [ 549.061819][T17500] tipc: Resetting bearer [ 549.661125][T17511] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2892'. [ 549.749742][T17500] team0: Port device xfrm0 removed [ 549.784100][T17500] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 549.893530][T17507] bond3 (unregistering): Released all slaves [ 549.941344][T17511] tipc: Resetting bearer [ 550.055695][T17511] erspan0: entered promiscuous mode [ 550.070904][T17518] netlink: 20 bytes leftover after parsing attributes in process `syz.0.2893'. [ 550.096824][T17511] bond1: entered allmulticast mode [ 550.115542][T17511] macvtap1: left allmulticast mode [ 550.131544][T17511] bond1: left allmulticast mode [ 550.143809][T17511] 8021q: adding VLAN 0 to HW filter on device macvtap1 [ 550.175190][T17511] 8021q: adding VLAN 0 to HW filter on device bond2 [ 550.193273][ T6141] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 550.262683][T17422] Set syz1 is full, maxelem 65536 reached [ 550.524731][ T4937] block nbd3: Receive control failed (result -32) [ 550.532391][ T5639] block nbd3: Receive control failed (result -32) [ 550.542860][ T5632] block nbd3: Receive control failed (result -32) [ 550.769386][T17537] syzkaller0: entered promiscuous mode [ 550.775169][T17537] syzkaller0: entered allmulticast mode [ 550.844016][T17550] netlink: 60 bytes leftover after parsing attributes in process `syz.1.2899'. [ 550.998913][T17557] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2906'. [ 551.053377][T17559] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2902'. [ 552.714807][ C0] ip6_tunnel: ip6tnl3 xmit: Local address not yet configured! [ 553.251053][T17557] 8021q: adding VLAN 0 to HW filter on device bond0 [ 553.317123][T17583] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2909'. [ 553.375032][T17585] vxcan1: tx drop: invalid sa for name 0x0000000000000002 [ 553.545266][T17592] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2913'. [ 553.556367][T17592] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2913'. [ 553.621730][T17596] netlink: 'syz.3.2915': attribute type 1 has an invalid length. [ 553.651706][T17596] veth3: entered allmulticast mode [ 553.721518][T17599] macvlan2: entered promiscuous mode [ 553.732733][T17599] macvlan2: entered allmulticast mode [ 553.809734][T17598] lo speed is unknown, defaulting to 1000 [ 554.075107][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 554.107070][T17613] bridge1: entered promiscuous mode [ 554.125507][T17613] bridge1: entered allmulticast mode [ 554.150016][T17613] team0: Port device bridge1 added [ 554.284609][T17618] syzkaller0: entered promiscuous mode [ 554.291778][T17618] syzkaller0: entered allmulticast mode [ 554.341179][T17613] bridge0: port 3(team0) entered blocking state [ 554.356440][T17613] bridge0: port 3(team0) entered disabled state [ 554.363006][T17613] team0: entered allmulticast mode [ 554.368510][T17613] team_slave_0: entered allmulticast mode [ 554.376968][T17613] team_slave_1: entered allmulticast mode [ 554.388273][T17613] team0: entered promiscuous mode [ 554.393451][T17613] team_slave_0: entered promiscuous mode [ 554.400059][T17613] team_slave_1: entered promiscuous mode [ 554.409068][T17613] bridge0: port 3(team0) entered blocking state [ 554.415525][T17613] bridge0: port 3(team0) entered forwarding state [ 554.432200][T17620] dvmrp3: entered allmulticast mode [ 554.467944][T17598] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 554.507327][T17617] lo speed is unknown, defaulting to 1000 [ 554.775230][T17628] xt_bpf: check failed: parse error [ 554.786109][T17628] x_tables: duplicate underflow at hook 1 [ 555.030864][T17641] netlink: 'syz.0.2927': attribute type 2 has an invalid length. [ 555.215696][T17648] xt_hashlimit: size too large, truncated to 1048576 [ 557.120924][T17641] : entered promiscuous mode [ 557.253199][T17661] syzkaller0: entered promiscuous mode [ 557.265635][T17661] syzkaller0: entered allmulticast mode [ 557.288111][T17661] tipc: Enabled bearer , priority 0 [ 557.520028][T17660] tipc: Resetting bearer [ 557.600727][T17660] tipc: Disabling bearer [ 557.770812][T17665] netlink: 32 bytes leftover after parsing attributes in process `syz.4.2933'. [ 557.808882][T17677] netlink: 48 bytes leftover after parsing attributes in process `syz.2.2939'. [ 557.970548][T17687] ip6_tunnel: non-ECT from fc00:0000:0000:0000:0000:0000:0000:0000 with DS=0x6 [ 558.304765][T17702] syzkaller1: tun_chr_ioctl cmd 1074025677 [ 558.321382][T17702] syzkaller1: linktype set to 769 [ 558.590632][T17708] netlink: 'syz.4.2947': attribute type 3 has an invalid length. [ 558.726190][T17714] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2950'. [ 558.929363][T17727] netlink: 'syz.1.2951': attribute type 1 has an invalid length. [ 558.957317][T17727] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2951'. [ 559.393606][T17735] syzkaller0: entered promiscuous mode [ 559.399624][T17735] syzkaller0: entered allmulticast mode [ 559.432454][T17735] netlink: 'syz.2.2954': attribute type 10 has an invalid length. [ 559.454157][T17735] bond0: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 559.465089][ T6141] bond0: (slave veth0_to_bond): interface is now down [ 559.496283][ T6139] bond0: (slave veth0_to_bond): interface is now down [ 559.511270][ T6139] bond0: now running without any active interface! [ 559.691260][T17739] syzkaller0: entered promiscuous mode [ 559.697948][T17739] syzkaller0: entered allmulticast mode [ 561.674736][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 561.709652][T17714] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 561.889086][T17750] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2958'. [ 561.898750][T17750] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2958'. [ 561.907908][T17752] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2960'. [ 562.884049][T17783] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2966'. [ 562.961524][ T1318] ieee802154 phy0 wpan0: encryption failed: -22 [ 563.008660][T17783] veth3: entered allmulticast mode [ 563.019879][T17783] bond3: (slave veth3): Enslaving as an active interface with an up link [ 563.065189][T17783] bond3 (unregistering): (slave veth3): Releasing backup interface [ 563.082204][T17783] bond3 (unregistering): Released all slaves [ 563.322780][T17788] 8021q: adding VLAN 0 to HW filter on device bond3 [ 563.339737][T17788] bond3 (unregistering): Released all slaves [ 564.998068][T17758] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 565.192151][T17795] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2969'. [ 565.258832][T17800] netlink: 'syz.4.2971': attribute type 83 has an invalid length. [ 565.327809][T17804] bridge_slave_0: left allmulticast mode [ 565.345986][T17804] bridge_slave_0: left promiscuous mode [ 565.361316][T17804] bridge0: port 1(bridge_slave_0) entered disabled state [ 565.400163][T17804] bridge_slave_1: left allmulticast mode [ 565.424791][T17804] bridge_slave_1: left promiscuous mode [ 565.443219][T17804] bridge0: port 2(bridge_slave_1) entered disabled state [ 565.473992][T17804] bond0: (slave bond_slave_0): Releasing backup interface [ 565.491072][T17804] bond0: (slave bond_slave_1): Releasing backup interface [ 565.511842][T17804] team0: Port device team_slave_1 removed [ 565.520652][T17804] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 565.529023][T17804] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 565.538746][T17804] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 565.547010][T17804] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 565.561306][T17804] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 565.619047][T17808] team0: Port device xfrm0 added [ 565.631548][T17822] tipc: Started in network mode [ 565.644818][T17822] tipc: Node identity 6a685afae30f, cluster identity 4711 [ 565.655225][T17822] tipc: Enabled bearer , priority 0 [ 565.792600][T17821] netlink: 92 bytes leftover after parsing attributes in process `syz.2.2975'. [ 565.872511][T17834] tipc: Enabled bearer , priority 0 [ 565.887698][T17834] syzkaller0: entered promiscuous mode [ 565.904802][T17834] syzkaller0: entered allmulticast mode [ 565.933735][T17835] xt_CHECKSUM: CHECKSUM should be avoided. If really needed, restrict with "-p udp" and only use in OUTPUT [ 565.969082][T17834] tipc: Resetting bearer [ 566.002068][T17833] tipc: Resetting bearer [ 566.043688][T17833] tipc: Disabling bearer [ 566.412850][ T5632] block nbd4: Receive control failed (result -32) [ 566.595024][T17866] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2986'. [ 566.963330][T17884] team0: left allmulticast mode [ 566.982360][T17884] team_slave_0: left allmulticast mode [ 566.997586][T17884] team_slave_1: left allmulticast mode [ 567.014035][T17884] team0: left promiscuous mode [ 567.028394][T17884] team_slave_0: left promiscuous mode [ 567.045994][T17884] team_slave_1: left promiscuous mode [ 567.055365][T17884] bridge0: port 3(team0) entered disabled state [ 567.127927][T17884] bridge_slave_0: left allmulticast mode [ 567.145285][T17884] bridge_slave_0: left promiscuous mode [ 567.164929][T17884] bridge0: port 1(bridge_slave_0) entered disabled state [ 567.202023][T17884] bridge_slave_1: left allmulticast mode [ 567.212845][T17884] bridge_slave_1: left promiscuous mode [ 567.226585][T17884] bridge0: port 2(bridge_slave_1) entered disabled state [ 567.257179][T17884] bond0: (slave bond_slave_0): Releasing backup interface [ 567.288888][T17884] bond0: (slave bond_slave_1): Releasing backup interface [ 567.352443][T17884] team0: Port device team_slave_0 removed [ 567.409486][T17884] team0: Port device team_slave_1 removed [ 567.426591][T17884] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 567.441515][T17884] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 567.461928][T17884] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 567.471059][T17884] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 567.481988][T17884] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 567.556576][T17886] team0: Device xfrm0 is of different type [ 567.582270][ T7860] tipc: Node number set to 2305252090 [ 567.727147][T17894] lo speed is unknown, defaulting to 1000 [ 569.240032][T17922] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2996'. [ 569.576396][T17879] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 569.586160][T17872] tipc: Started in network mode [ 569.591664][T17872] tipc: Node identity aaaaaaaaaa1a, cluster identity 4711 [ 569.599170][T17872] tipc: Enabled bearer , priority 0 [ 569.761715][T17936] netlink: 48 bytes leftover after parsing attributes in process `syz.3.2998'. [ 569.783994][T17936] netlink: 48 bytes leftover after parsing attributes in process `syz.3.2998'. [ 569.807953][T17932] netlink: 60 bytes leftover after parsing attributes in process `syz.4.2999'. [ 569.993587][T17942] syzkaller0: entered promiscuous mode [ 570.003840][T17942] syzkaller0: entered allmulticast mode [ 570.028044][T17938] netlink: 'syz.2.3001': attribute type 5 has an invalid length. [ 570.076892][T17952] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3004'. [ 570.087859][T17953] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3004'. [ 570.207504][T17956] "syz.4.3005" (17956) uses obsolete ecb(arc4) skcipher [ 571.270676][T17974] netlink: 156 bytes leftover after parsing attributes in process `syz.4.3009'. [ 572.828749][ T7862] tipc: Node number set to 11578026 [ 573.015845][T17998] sock: sock_set_timeout: `syz.0.3015' (pid 17998) tries to set negative timeout [ 573.046369][T18003] netlink: 'syz.3.3016': attribute type 8 has an invalid length. [ 573.148503][T18005] tipc: Resetting bearer [ 573.191614][T18005] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 573.248676][T17990] team0: Device xfrm0 is of different type [ 573.331032][T18016] netlink: 7 bytes leftover after parsing attributes in process `syz.2.3017'. [ 573.421497][T18019] netlink: 48 bytes leftover after parsing attributes in process `syz.0.3019'. [ 573.820324][T18035] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3026'. [ 574.239842][T18057] SET target dimension over the limit! [ 574.260860][T18057] SET target dimension over the limit! [ 574.361408][T18064] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3034'. [ 574.413209][T18064] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3034'. [ 574.619065][T18074] netlink: 'syz.1.3027': attribute type 1 has an invalid length. [ 575.038498][T18090] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 575.284908][ T5632] Bluetooth: hci5: command 0x0406 tx timeout [ 575.479487][T18108] netlink: 16 bytes leftover after parsing attributes in process `syz.0.3041'. [ 575.757955][T18122] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3045'. [ 577.039798][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 578.043196][T18120] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 578.065500][T18122] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3045'. [ 578.241728][T18148] xt_hl: Unknown TTL match mode: 237 [ 578.285602][T18148] bond0: Error: Cannot enslave bond to itself. [ 578.347126][T18151] netlink: 68 bytes leftover after parsing attributes in process `syz.0.3050'. [ 578.743149][T18166] sctp: [Deprecated]: syz.4.3053 (pid 18166) Use of struct sctp_assoc_value in delayed_ack socket option. [ 578.743149][T18166] Use struct sctp_sack_info instead [ 578.851978][T18171] netlink: 'syz.3.3052': attribute type 10 has an invalid length. [ 578.864177][T18170] 8021q: adding VLAN 0 to HW filter on device bond3 [ 578.929978][T18170] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3054'. [ 578.981606][T18176] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3054'. [ 579.231333][T18182] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci1/hci1:200/input5 [ 579.301788][T18182] netlink: 'syz.0.3059': attribute type 12 has an invalid length. [ 579.474854][T18194] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3061'. [ 579.601685][T18194] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3061'. [ 579.816630][T18203] netlink: 'syz.0.3063': attribute type 8 has an invalid length. [ 579.828171][T18203] netlink: 14 bytes leftover after parsing attributes in process `syz.0.3063'. [ 579.884287][T18208] netlink: 'syz.2.3065': attribute type 83 has an invalid length. [ 580.209166][T18221] bond0: entered promiscuous mode [ 580.214851][T18221] veth0_to_bond: entered promiscuous mode [ 580.226335][T18221] bond0: left promiscuous mode [ 580.231205][T18221] veth0_to_bond: left promiscuous mode [ 580.249190][T18218] lo speed is unknown, defaulting to 1000 [ 580.270941][T18225] bond0: entered promiscuous mode [ 580.276402][T18225] veth0_to_bond: entered promiscuous mode [ 580.283831][T18225] bond0: left promiscuous mode [ 580.290166][T18225] veth0_to_bond: left promiscuous mode [ 580.786809][T18240] netlink: 'syz.0.3074': attribute type 2 has an invalid length. [ 580.888889][T18243] netlink: 168 bytes leftover after parsing attributes in process `syz.4.3076'. [ 580.898415][T18243] netlink: 196 bytes leftover after parsing attributes in process `syz.4.3076'. [ 580.928619][T15085] tipc: Subscription rejected, illegal request [ 580.997374][T18246] openvswitch: netlink: Tunnel attr 68 out of range max 16 [ 582.247716][T18295] netlink: 'syz.3.3090': attribute type 1 has an invalid length. [ 582.335024][T18295] 8021q: adding VLAN 0 to HW filter on device bond1 [ 582.377164][T18300] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3092'. [ 582.391686][T18304] bond1: (slave gretap1): making interface the new active one [ 582.422508][T18304] bond1: (slave gretap1): Enslaving as an active interface with an up link [ 582.486949][T18311] netlink: 'syz.2.3093': attribute type 210 has an invalid length. [ 582.649831][T18318] bond2: (slave syz_tun): Enslaving as an active interface with an up link [ 582.660727][T18324] block nbd5: Unsupported socket: should be TCP or UNIX. [ 582.972707][T18342] syzkaller0: entered promiscuous mode [ 582.991354][T18342] syzkaller0: entered allmulticast mode [ 583.441717][ T5634] block nbd0: Receive control failed (result -110) [ 583.932007][T18478] __nla_validate_parse: 5 callbacks suppressed [ 583.932028][T18478] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3108'. [ 584.242380][T18509] openvswitch: netlink: Actions may not be safe on all matching packets [ 584.533000][T18539] netlink: 80 bytes leftover after parsing attributes in process `syz.2.3110'. [ 584.558934][T18539] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3110'. [ 584.717527][T18539] ipvlan2: entered allmulticast mode [ 584.744071][T18539] netdevsim netdevsim2 netdevsim3: entered allmulticast mode [ 584.799547][T18539] 8021q: adding VLAN 0 to HW filter on device ipvlan2 [ 585.092075][T18540] mac80211_hwsim hwsim31 wlan1: entered promiscuous mode [ 585.112094][T18540] vlan2: entered promiscuous mode [ 585.318209][T18584] netlink: 'syz.4.3113': attribute type 1 has an invalid length. [ 585.515193][ T5634] Bluetooth: hci3: command 0x0406 tx timeout [ 585.662319][T18584] bond1: entered promiscuous mode [ 585.679526][T18588] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3115'. [ 585.697041][T18584] 8021q: adding VLAN 0 to HW filter on device bond1 [ 585.815553][T18592] vlan2: entered allmulticast mode [ 585.842047][T18592] bridge3: entered allmulticast mode [ 585.891765][T18588] bridge3: port 1(erspan0) entered blocking state [ 585.917319][T18588] bridge3: port 1(erspan0) entered disabled state [ 585.964901][T18588] erspan0: entered allmulticast mode [ 585.983597][T18588] erspan0: left allmulticast mode [ 586.075468][T18595] vlan2: entered promiscuous mode [ 586.083501][T18595] bridge0: entered promiscuous mode [ 586.535374][T15085] nci: nci_add_new_protocol: the target found does not have the desired protocol [ 586.663680][T18622] "syz.2.3124" (18622) uses obsolete ecb(arc4) skcipher [ 586.850481][T18617] syzkaller0: entered promiscuous mode [ 586.856725][T18617] syzkaller0: entered allmulticast mode [ 587.385037][T18590] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 587.691554][T18653] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3129'. [ 587.717496][T18653] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3129'. [ 590.524069][T18658] syzkaller0: entered promiscuous mode [ 590.530043][T18658] syzkaller0: entered allmulticast mode [ 590.555437][T18675] IPVS: set_ctl: invalid protocol: 98 10.1.1.1:20004 [ 592.903579][T18674] workqueue: Failed to create a rescuer kthread for wq "bond4": -EINTR [ 592.932981][T18671] lo speed is unknown, defaulting to 1000 [ 593.029413][T18700] "syz.2.3139" (18700) uses obsolete ecb(arc4) skcipher [ 593.106114][T18701] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3138'. [ 593.183967][T18705] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 593.580998][T18716] syzkaller0: entered promiscuous mode [ 593.586841][T18716] syzkaller0: entered allmulticast mode [ 594.109968][T18743] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3150'. [ 595.889242][T18733] netlink: 96 bytes leftover after parsing attributes in process `syz.0.3147'. [ 595.968328][T18743] lo speed is unknown, defaulting to 1000 [ 595.978538][T18759] SET target dimension over the limit! [ 596.304371][T18776] "syz.3.3158" (18776) uses obsolete ecb(arc4) skcipher [ 596.428247][T18778] lo speed is unknown, defaulting to 1000 [ 596.560338][T18785] bond4: option min_links: invalid value (18446744073709551612) [ 596.568671][T18785] bond4: option min_links: allowed values 0 - 2147483647 [ 596.580757][T18785] bond4 (unregistering): Released all slaves [ 596.760008][T18793] x_tables: ip_tables: DNAT target: used from hooks POSTROUTING, but only usable from PREROUTING/OUTPUT [ 596.781109][T18785] debugfs: '!' already exists in 'ieee80211' [ 597.338800][T18806] tap0: tun_chr_ioctl cmd 2148553947 [ 597.486763][T18813] syzkaller0: entered promiscuous mode [ 597.507059][T18813] syzkaller0: entered allmulticast mode [ 597.678336][T18823] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 597.699634][T18832] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 597.931085][T18847] x_tables: duplicate underflow at hook 1 [ 598.252428][T18867] netlink: 20 bytes leftover after parsing attributes in process `syz.0.3181'. [ 598.271128][T18822] syzkaller0: entered promiscuous mode [ 598.279438][T18822] syzkaller0: entered allmulticast mode [ 598.317235][T18871] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3182'. [ 600.517196][T18879] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3182'. [ 600.540560][T18879] netlink: 'syz.3.3182': attribute type 1 has an invalid length. [ 600.903078][T18897] netlink: 132 bytes leftover after parsing attributes in process `syz.2.3188'. [ 601.370603][T18922] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3193'. [ 601.518973][T18915] netlink: 'syz.0.3194': attribute type 1 has an invalid length. [ 601.740948][T18932] netlink: 207236 bytes leftover after parsing attributes in process `syz.0.3197'. [ 601.840862][T18935] netlink: 6032 bytes leftover after parsing attributes in process `syz.0.3198'. [ 601.946929][T18937] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3199'. [ 602.246592][T14641] netdevsim netdevsim0 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 602.264865][T14641] netdevsim netdevsim0 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 602.280155][T14641] netdevsim netdevsim0 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 602.307080][T14641] netdevsim netdevsim0 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 602.323435][T14641] netdevsim netdevsim0 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 602.340627][T14641] netdevsim netdevsim0 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 602.365367][T14641] netdevsim netdevsim0 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 602.382780][T14641] netdevsim netdevsim0 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 602.483017][T18957] syzkaller0: entered promiscuous mode [ 602.501908][T18957] syzkaller0: entered allmulticast mode [ 602.629729][T18970] "syz.0.3207" (18970) uses obsolete ecb(arc4) skcipher [ 603.000440][T18969] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3205'. [ 603.115983][T18983] netlink: 'syz.2.3208': attribute type 13 has an invalid length. [ 605.075067][T18983] tipc: Resetting bearer [ 605.179608][T18985] syzkaller0: default qdisc (pfifo_fast) fail, fallback to noqueue [ 605.202786][T18985] syzkaller0: entered promiscuous mode [ 605.212242][T18985] syzkaller0: entered allmulticast mode [ 605.298706][T19001] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3210'. [ 605.420618][T19007] netlink: 28 bytes leftover after parsing attributes in process `syz.3.3210'. [ 605.593882][T19014] tipc: Resetting bearer [ 605.632801][T19014] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 605.649641][T19018] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3214'. [ 605.861145][T19014] team0: Device xfrm0 is of different type [ 605.889671][T19021] tipc: Enabling of bearer rejected, already enabled [ 606.241977][T19029] veth1_to_hsr: Caught tx_queue_len zero misconfig [ 606.471719][T19034] wlan0 speed is unknown, defaulting to 1000 [ 606.485294][T19034] wlan0 speed is unknown, defaulting to 1000 [ 606.503908][T19034] wlan0 speed is unknown, defaulting to 1000 [ 606.512843][T19035] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3220'. [ 606.533407][T19034] smbdirect: ib_dev[syz0]: added: RNIC max_fast_reg_page_list_len=256 device_cap_flags=0x200000 kernel_cap_flags=0x10 page_size_cap=0x1000 [ 606.568748][T19034] smbdirect: ib_dev[syz0]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=1 max_cqe=3276800 max_qp_wr=32768 max_send_sge=6 max_recv_sge=6 [ 606.602208][T19034] smbdirect: ib_dev[syz0]PORT[1]: iwarp=1 ib=0 roce=0 v1=0 v2=0 core_cap_flags=0x400008 [ 606.622403][T19041] openvswitch: netlink: VXLAN extension message has 4 unknown bytes. [ 606.665762][T19034] infiniband syz0: RDMA CMA: cma_listen_on_dev, error -98 [ 606.840885][T19034] wlan0 speed is unknown, defaulting to 1000 [ 606.889941][T19034] wlan0 speed is unknown, defaulting to 1000 [ 606.904829][T19034] wlan0 speed is unknown, defaulting to 1000 [ 606.942272][T19034] wlan0 speed is unknown, defaulting to 1000 [ 606.969921][T19034] wlan0 speed is unknown, defaulting to 1000 [ 606.988742][T19034] wlan0 speed is unknown, defaulting to 1000 [ 606.999174][T19034] wlan0 speed is unknown, defaulting to 1000 [ 607.009377][T19034] wlan0 speed is unknown, defaulting to 1000 [ 607.081136][T19052] netlink: 64 bytes leftover after parsing attributes in process `syz.1.3217'. [ 607.146794][T19060] syzkaller0: entered promiscuous mode [ 607.152343][T19060] syzkaller0: entered allmulticast mode [ 607.160560][T19052] nbd5: detected capacity change from 0 to 3 [ 607.191643][T19024] buffer_io_error: 18 callbacks suppressed [ 607.191663][T19024] Buffer I/O error on dev nbd5, logical block 1, async page read [ 607.510395][T19045] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 607.518065][T19045] Bluetooth: hci5: Error when powering off device on rfkill (-4) [ 607.661004][ T5639] block nbd5: Receive control failed (result -104) [ 607.761921][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 609.417678][T19058] tun0: tun_chr_ioctl cmd 1074812117 [ 609.446239][T19045] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 609.463739][T19045] Bluetooth: hci3: Error when powering off device on rfkill (-4) [ 609.527586][T19045] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 609.541672][T19045] Bluetooth: hci4: Error when powering off device on rfkill (-4) [ 609.562874][T19071] netlink: 128 bytes leftover after parsing attributes in process `syz.4.3229'. [ 609.577248][T19071] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3229'. [ 609.663695][T19075] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 609.686807][ T6023] wlan0 speed is unknown, defaulting to 1000 [ 609.706524][ T6023] syz0: Port: 1 Link DOWN [ 609.712744][T19077] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3230'. [ 609.748908][T19075] team0: Port device xfrm0 added [ 609.775985][T19080] tipc: Enabling of bearer rejected, already enabled [ 609.792926][T19045] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 609.799436][T19045] Bluetooth: hci1: Error when powering off device on rfkill (-4) [ 609.949685][T19087] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3234'. [ 609.969352][T19087] openvswitch: netlink: Flow actions attr not present in new flow. [ 610.187873][T19101] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3239'. [ 610.444207][T19122] __nla_validate_parse: 1 callbacks suppressed [ 610.444227][T19122] netlink: 20 bytes leftover after parsing attributes in process `syz.3.3246'. [ 610.509903][T19125] netlink: 'syz.0.3247': attribute type 4 has an invalid length. [ 610.532932][T19125] netlink: 'syz.0.3247': attribute type 4 has an invalid length. [ 611.064088][T19136] geneve1: entered promiscuous mode [ 611.207954][T19151] [ 611.210351][T19151] ====================================================== [ 611.217400][T19151] WARNING: possible circular locking dependency detected [ 611.224459][T19151] syzkaller #0 Not tainted [ 611.228915][T19151] ------------------------------------------------------ [ 611.236482][T19151] syz.2.3255/19151 is trying to acquire lock: [ 611.242570][T19151] ffffffff8ec848a0 (fs_reclaim){+.+.}-{0:0}, at: prepare_alloc_pages+0x15b/0x650 [ 611.251768][T19151] [ 611.251768][T19151] but task is already holding lock: [ 611.259164][T19151] ffff88807dc15cf8 (&mm->mmap_lock){++++}-{4:4}, at: lock_mm_and_find_vma+0x36/0x340 [ 611.268742][T19151] [ 611.268742][T19151] which lock already depends on the new lock. [ 611.268742][T19151] [ 611.279172][T19151] [ 611.279172][T19151] the existing dependency chain (in reverse order) is: [ 611.288288][T19151] [ 611.288288][T19151] -> #7 (&mm->mmap_lock){++++}-{4:4}: [ 611.295878][T19151] __might_fault+0xcb/0x130 [ 611.300922][T19151] _copy_from_iter+0x100/0x1660 [ 611.306316][T19151] tcp_sendmsg_locked+0x2620/0x55c0 [ 611.312067][T19151] tcp_sendmsg+0x2f/0x50 [ 611.316845][T19151] sock_sendmsg_nosec+0x10e/0x180 [ 611.322433][T19151] sock_write_iter+0x2de/0x3e0 [ 611.327734][T19151] vfs_write+0x612/0xba0 [ 611.332522][T19151] ksys_write+0x150/0x270 [ 611.337394][T19151] do_syscall_64+0x174/0x580 [ 611.342530][T19151] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 611.348956][T19151] [ 611.348956][T19151] -> #6 (sk_lock-AF_INET){+.+.}-{0:0}: [ 611.356625][T19151] lock_sock_nested+0x41/0x100 [ 611.361925][T19151] inet_shutdown+0x6a/0x390 [ 611.366975][T19151] nbd_mark_nsock_dead+0x2cb/0x550 [ 611.372642][T19151] recv_work+0x1cee/0x1e10 [ 611.377597][T19151] process_scheduled_works+0xa8e/0x14e0 [ 611.383681][T19151] worker_thread+0xa47/0xfb0 [ 611.388809][T19151] kthread+0x388/0x470 [ 611.393424][T19151] ret_from_fork+0x514/0xb70 [ 611.398560][T19151] ret_from_fork_asm+0x1a/0x30 [ 611.403862][T19151] [ 611.403862][T19151] -> #5 (&nsock->tx_lock){+.+.}-{4:4}: [ 611.411533][T19151] __mutex_lock+0x19d/0x1550 [ 611.416680][T19151] nbd_queue_rq+0x373/0x1150 [ 611.421869][T19151] blk_mq_dispatch_rq_list+0x499/0x1990 [ 611.427958][T19151] __blk_mq_sched_dispatch_requests+0xd36/0x1580 [ 611.434839][T19151] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 611.441367][T19151] blk_mq_run_work_fn+0x16c/0x300 [ 611.446927][T19151] process_scheduled_works+0xa8e/0x14e0 [ 611.453009][T19151] worker_thread+0xa47/0xfb0 [ 611.458138][T19151] kthread+0x388/0x470 [ 611.462746][T19151] ret_from_fork+0x514/0xb70 [ 611.467969][T19151] ret_from_fork_asm+0x1a/0x30 [ 611.473276][T19151] [ 611.473276][T19151] -> #4 (&cmd->lock){+.+.}-{4:4}: [ 611.480512][T19151] __mutex_lock+0x19d/0x1550 [ 611.485648][T19151] nbd_queue_rq+0xc1/0x1150 [ 611.490697][T19151] blk_mq_dispatch_rq_list+0x499/0x1990 [ 611.496788][T19151] __blk_mq_sched_dispatch_requests+0xd36/0x1580 [ 611.503665][T19151] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 611.510191][T19151] blk_mq_run_work_fn+0x16c/0x300 [ 611.515926][T19151] process_scheduled_works+0xa8e/0x14e0 [ 611.522011][T19151] worker_thread+0xa47/0xfb0 [ 611.527597][T19151] kthread+0x388/0x470 [ 611.532208][T19151] ret_from_fork+0x514/0xb70 [ 611.537344][T19151] ret_from_fork_asm+0x1a/0x30 [ 611.542642][T19151] [ 611.542642][T19151] -> #3 (set->srcu){.+.+}-{0:0}: [ 611.549785][T19151] __synchronize_srcu+0xc9/0x2f0 [ 611.555275][T19151] elevator_switch+0x1e8/0x7b0 [ 611.560586][T19151] elevator_change+0x2fa/0x480 [ 611.565898][T19151] elevator_set_default+0x375/0x440 [ 611.571649][T19151] blk_register_queue+0x3f3/0x4e0 [ 611.577221][T19151] __add_disk+0x6cb/0xe30 [ 611.582102][T19151] add_disk_fwnode+0xfb/0x4b0 [ 611.587315][T19151] nbd_dev_add+0x733/0xb60 [ 611.592282][T19151] nbd_init+0x15f/0x1e0 [ 611.596980][T19151] do_one_initcall+0x250/0x870 [ 611.602292][T19151] do_initcall_level+0x10a/0x1a0 [ 611.607774][T19151] do_initcalls+0x59/0xa0 [ 611.612650][T19151] kernel_init_freeable+0x29d/0x3e0 [ 611.618399][T19151] kernel_init+0x1d/0x1d0 [ 611.623270][T19151] ret_from_fork+0x514/0xb70 [ 611.628418][T19151] ret_from_fork_asm+0x1a/0x30 [ 611.633908][T19151] [ 611.633908][T19151] -> #2 (&q->elevator_lock){+.+.}-{4:4}: [ 611.641758][T19151] __mutex_lock+0x19d/0x1550 [ 611.646922][T19151] elevator_change+0x1af/0x480 [ 611.652245][T19151] elevator_set_none+0xb5/0x140 [ 611.657654][T19151] blk_mq_update_nr_hw_queues+0x5ef/0x19f0 [ 611.664019][T19151] nbd_start_device+0x189/0xb30 [ 611.669435][T19151] nbd_genl_connect+0x1597/0x1c10 [ 611.675020][T19151] genl_family_rcv_msg_doit+0x233/0x340 [ 611.681114][T19151] genl_rcv_msg+0x614/0x7a0 [ 611.686163][T19151] netlink_rcv_skb+0x226/0x4a0 [ 611.691489][T19151] genl_rcv+0x28/0x40 [ 611.696031][T19151] netlink_unicast+0x7bb/0x940 [ 611.701346][T19151] netlink_sendmsg+0x813/0xb40 [ 611.706678][T19151] sock_sendmsg_nosec+0x13a/0x180 [ 611.712346][T19151] ____sys_sendmsg+0x54e/0x850 [ 611.717670][T19151] ___sys_sendmsg+0x2a5/0x360 [ 611.722903][T19151] __x64_sys_sendmsg+0x1b1/0x290 [ 611.728394][T19151] do_syscall_64+0x174/0x580 [ 611.733537][T19151] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 611.739972][T19151] [ 611.739972][T19151] -> #1 (&q->q_usage_counter(io)#50){++++}-{0:0}: [ 611.748605][T19151] blk_alloc_queue+0x544/0x690 [ 611.753916][T19151] __blk_mq_alloc_disk+0x194/0x390 [ 611.759571][T19151] nbd_dev_add+0x494/0xb60 [ 611.764542][T19151] nbd_init+0x15f/0x1e0 [ 611.769268][T19151] do_one_initcall+0x250/0x870 [ 611.774597][T19151] do_initcall_level+0x10a/0x1a0 [ 611.780101][T19151] do_initcalls+0x59/0xa0 [ 611.785073][T19151] kernel_init_freeable+0x29d/0x3e0 [ 611.790827][T19151] kernel_init+0x1d/0x1d0 [ 611.795711][T19151] ret_from_fork+0x514/0xb70 [ 611.800879][T19151] ret_from_fork_asm+0x1a/0x30 [ 611.806192][T19151] [ 611.806192][T19151] -> #0 (fs_reclaim){+.+.}-{0:0}: [ 611.813446][T19151] __lock_acquire+0x1520/0x2cf0 [ 611.819116][T19151] lock_acquire+0x106/0x350 [ 611.824173][T19151] fs_reclaim_acquire+0x71/0x100 [ 611.829661][T19151] prepare_alloc_pages+0x15b/0x650 [ 611.835322][T19151] __alloc_frozen_pages_noprof+0x12f/0x380 [ 611.841730][T19151] alloc_pages_mpol+0x212/0x380 [ 611.847137][T19151] folio_alloc_mpol_noprof+0x39/0x160 [ 611.853070][T19151] shmem_alloc_and_add_folio+0x43e/0xf60 [ 611.859253][T19151] shmem_get_folio_gfp+0x5da/0x16d0 [ 611.865012][T19151] shmem_fault+0x179/0x390 [ 611.869986][T19151] __do_fault+0x138/0x2a0 [ 611.874867][T19151] do_pte_missing+0x2215/0x34b0 [ 611.880274][T19151] handle_mm_fault+0x1b36/0x3080 [ 611.885767][T19151] do_user_addr_fault+0x744/0x1340 [ 611.891436][T19151] exc_page_fault+0x6a/0xc0 [ 611.896493][T19151] asm_exc_page_fault+0x26/0x30 [ 611.901892][T19151] fault_in_readable+0x8e/0x130 [ 611.907291][T19151] fault_in_iov_iter_readable+0x135/0x310 [ 611.913565][T19151] generic_perform_write+0x7a0/0x8f0 [ 611.919397][T19151] shmem_file_write_iter+0xf8/0x120 [ 611.925164][T19151] do_iter_readv_writev+0x612/0x8c0 [ 611.930903][T19151] vfs_writev+0x343/0x990 [ 611.935778][T19151] __x64_sys_pwritev+0x19c/0x2b0 [ 611.941263][T19151] do_syscall_64+0x174/0x580 [ 611.946416][T19151] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 611.952862][T19151] [ 611.952862][T19151] other info that might help us debug this: [ 611.952862][T19151] [ 611.963119][T19151] Chain exists of: [ 611.963119][T19151] fs_reclaim --> sk_lock-AF_INET --> &mm->mmap_lock [ 611.963119][T19151] [ 611.975676][T19151] Possible unsafe locking scenario: [ 611.975676][T19151] [ 611.983156][T19151] CPU0 CPU1 [ 611.988547][T19151] ---- ---- [ 611.993926][T19151] rlock(&mm->mmap_lock); [ 611.998368][T19151] lock(sk_lock-AF_INET); [ 612.005336][T19151] lock(&mm->mmap_lock); [ 612.012218][T19151] lock(fs_reclaim); [ 612.016243][T19151] [ 612.016243][T19151] *** DEADLOCK *** [ 612.016243][T19151] [ 612.024416][T19151] 3 locks held by syz.2.3255/19151: [ 612.029646][T19151] #0: ffff888052b36450 (sb_writers#5){.+.+}-{0:0}, at: vfs_writev+0x2af/0x990 [ 612.038664][T19151] #1: ffff88807b786308 (&sb->s_type->i_mutex_key#15){+.+.}-{4:4}, at: shmem_file_write_iter+0x7f/0x120 [ 612.049842][T19151] #2: ffff88807dc15cf8 (&mm->mmap_lock){++++}-{4:4}, at: lock_mm_and_find_vma+0x36/0x340 [ 612.059885][T19151] [ 612.059885][T19151] stack backtrace: [ 612.065795][T19151] CPU: 0 UID: 0 PID: 19151 Comm: syz.2.3255 Not tainted syzkaller #0 PREEMPT(full) [ 612.065827][T19151] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 612.065842][T19151] Call Trace: [ 612.065853][T19151] [ 612.065864][T19151] dump_stack_lvl+0xe8/0x150 [ 612.065894][T19151] print_circular_bug+0x2e1/0x300 [ 612.065914][T19151] check_noncircular+0x12e/0x150 [ 612.065945][T19151] __lock_acquire+0x1520/0x2cf0 [ 612.065971][T19151] ? lock_acquire+0x106/0x350 [ 612.065997][T19151] ? unwind_next_frame+0x8f/0x2550 [ 612.066018][T19151] ? prepare_alloc_pages+0x15b/0x650 [ 612.066040][T19151] lock_acquire+0x106/0x350 [ 612.066063][T19151] ? prepare_alloc_pages+0x15b/0x650 [ 612.066089][T19151] ? is_bpf_text_address+0x26/0x2b0 [ 612.066116][T19151] fs_reclaim_acquire+0x71/0x100 [ 612.066138][T19151] ? prepare_alloc_pages+0x15b/0x650 [ 612.066160][T19151] prepare_alloc_pages+0x15b/0x650 [ 612.066186][T19151] __alloc_frozen_pages_noprof+0x12f/0x380 [ 612.066212][T19151] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 612.066238][T19151] ? __pfx_policy_nodemask+0x10/0x10 [ 612.066275][T19151] alloc_pages_mpol+0x212/0x380 [ 612.066306][T19151] folio_alloc_mpol_noprof+0x39/0x160 [ 612.066333][T19151] shmem_alloc_and_add_folio+0x43e/0xf60 [ 612.066352][T19151] ? filemap_get_entry+0xcd/0x3f0 [ 612.066374][T19151] ? __pfx_filemap_get_entry+0x10/0x10 [ 612.066390][T19151] ? __pfx_shmem_alloc_and_add_folio+0x10/0x10 [ 612.066410][T19151] ? shmem_allowable_huge_orders+0x318/0x6c0 [ 612.066442][T19151] shmem_get_folio_gfp+0x5da/0x16d0 [ 612.066476][T19151] shmem_fault+0x179/0x390 [ 612.066498][T19151] __do_fault+0x138/0x2a0 [ 612.066519][T19151] ? do_pte_missing+0x140c/0x34b0 [ 612.066541][T19151] do_pte_missing+0x2215/0x34b0 [ 612.066567][T19151] ? handle_mm_fault+0xec/0x3080 [ 612.066587][T19151] handle_mm_fault+0x1b36/0x3080 [ 612.066610][T19151] ? handle_mm_fault+0xec/0x3080 [ 612.066632][T19151] ? __pfx_handle_mm_fault+0x10/0x10 [ 612.066657][T19151] ? lock_mm_and_find_vma+0xa7/0x340 [ 612.066680][T19151] do_user_addr_fault+0x744/0x1340 [ 612.066712][T19151] exc_page_fault+0x6a/0xc0 [ 612.066738][T19151] asm_exc_page_fault+0x26/0x30 [ 612.066756][T19151] RIP: 0010:fault_in_readable+0x8e/0x130 [ 612.066775][T19151] Code: a9 00 00 00 0f 01 cb 0f ae e8 4d 85 f6 40 0f 95 c5 4c 89 ff 4c 89 f6 e8 10 d9 ae ff 4d 39 f7 0f 97 c0 40 84 c5 74 43 4d 89 f5 <41> 8a 45 00 88 44 24 07 49 81 e5 00 f0 ff ff 4d 8d a5 00 10 00 00 [ 612.066792][T19151] RSP: 0018:ffffc90004bb7928 EFLAGS: 00050202 [ 612.066808][T19151] RAX: ffffffff82179b01 RBX: 0000000000000200 RCX: ffff88807fabbe00 [ 612.066821][T19151] RDX: 0000000000000002 RSI: 0000200000002000 RDI: 0000200000002200 [ 612.066833][T19151] RBP: ffffc90004bb7a01 R08: ffff88807fabbe00 R09: 0000000000000002 [ 612.066846][T19151] R10: 0000000000000001 R11: 0000000000000002 R12: 00007ffffffff000 [ 612.066857][T19151] R13: 0000200000002000 R14: 0000200000002000 R15: 0000200000002200 [ 612.066873][T19151] ? __pfx_fault_in_readable+0x1/0x10 [ 612.066893][T19151] ? fault_in_readable+0x80/0x130 [ 612.066910][T19151] fault_in_iov_iter_readable+0x135/0x310 [ 612.066936][T19151] generic_perform_write+0x7a0/0x8f0 [ 612.066962][T19151] ? __pfx_generic_perform_write+0x10/0x10 [ 612.066983][T19151] ? __mark_inode_dirty+0x4e7/0x13b0 [ 612.067002][T19151] ? mnt_put_write_access_file+0xc0/0x100 [ 612.067020][T19151] ? file_update_time_flags+0x400/0x4a0 [ 612.067048][T19151] shmem_file_write_iter+0xf8/0x120 [ 612.067068][T19151] do_iter_readv_writev+0x612/0x8c0 [ 612.067087][T19151] ? __pfx_do_iter_readv_writev+0x10/0x10 [ 612.067111][T19151] vfs_writev+0x343/0x990 [ 612.067135][T19151] ? __pfx_vfs_writev+0x10/0x10 [ 612.067162][T19151] ? __fget_files+0x2a/0x420 [ 612.067186][T19151] ? __fget_files+0x3a2/0x420 [ 612.067208][T19151] ? __fget_files+0x2a/0x420 [ 612.067234][T19151] __x64_sys_pwritev+0x19c/0x2b0 [ 612.067252][T19151] ? __pfx___se_sys_futex+0x10/0x10 [ 612.067286][T19151] ? __pfx___x64_sys_pwritev+0x10/0x10 [ 612.067308][T19151] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 612.067326][T19151] do_syscall_64+0x174/0x580 [ 612.067352][T19151] ? trace_irq_disable+0x3b/0x140 [ 612.067373][T19151] ? clear_bhb_loop+0x40/0x90 [ 612.067393][T19151] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 612.067411][T19151] RIP: 0033:0x7f605ab9de59 [ 612.067427][T19151] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 612.067442][T19151] RSP: 002b:00007f605b9ab028 EFLAGS: 00000246 ORIG_RAX: 0000000000000128 [ 612.067459][T19151] RAX: ffffffffffffffda RBX: 00007f605ae26090 RCX: 00007f605ab9de59 [ 612.067471][T19151] RDX: 0000000000000003 RSI: 00002000000004c0 RDI: 0000000000000004 [ 612.067483][T19151] RBP: 00007f605ac33e6f R08: 0000000000000000 R09: 0000000000000000 [ 612.067494][T19151] R10: 0000000008040000 R11: 0000000000000246 R12: 0000000000000000 [ 612.067505][T19151] R13: 00007f605ae26128 R14: 00007f605ae26090 R15: 00007ffcc6ef4138 [ 612.067525][T19151]