last executing test programs: 11.988346834s ago: executing program 0 (id=5928): socket$kcm(0xa, 0x3, 0x87) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @broadcast}) (async) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000030400000000fbdbdf2500000000", @ANYRES32=0x0, @ANYBLOB="20000000100000001c001280090001006970697027d6fc6015b652eea28f3b"], 0x3c}}, 0x20000000) (async) write$tun(r0, &(0x7f0000000040)=ANY=[@ANYBLOB="034886dd010000000000140000006000000003088700fe88a43de1a400000000000000007d01ff020000000000000000000000000001"], 0xfdef) (async) setsockopt$sock_int(r1, 0x1, 0xa, &(0x7f0000000080)=0x6, 0x4) 11.64814781s ago: executing program 0 (id=5931): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x32, 0xffffffffffffffff, 0x0) r1 = syz_init_net_socket$x25(0x9, 0x5, 0x0) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) r2 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="9feb01001800000000000000240000002400000002000000000000000000000d0a0000000000000000000003000000000000000000"], &(0x7f0000000f40)=""/4087, 0x3e, 0xff7, 0x1}, 0x20) r3 = socket$l2tp(0x2, 0x2, 0x73) connect$l2tp(r3, &(0x7f0000000000)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x39}}, 0x10) bind$x25(r1, &(0x7f0000000080), 0x12) bind$inet(r3, &(0x7f0000000040)={0x2, 0x4e24, @multicast2}, 0x10) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000140)=ANY=[@ANYRESDEC=r2, @ANYRES8=r0, @ANYRESDEC=r0, @ANYBLOB="ffffdfff0000000000000000000000000000000033000000000000000000000000000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fcffffffffffffff000000000000000000000000000004000000010000000000000000000a000000000000000000000048000100736861323536000000000000000000000000000000000000000000000000000000000045ff3d9b000000000000000000000000000048460000000000000000000000000008001d00000000000800220003"], 0x148}}, 0xc800) 11.518205465s ago: executing program 0 (id=5933): r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000d00)=@nat={'nat\x00', 0x19, 0x1, 0x21e, [0x200000002300, 0x0, 0x0, 0x2000000024be, 0x2000000024ee], 0x20, 0x0, &(0x7f0000002300)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff01000000050000006b0000000016636169663000000000000000e3ff00007665746831000000000000000000000073797a5f74756e0039da0000f8ff0000000076657468310000000000000000001000aaaaaaaaaa3d000000ff00000180c2000003ff00ffffff00ae000000560100008e0100006f776e6572000000000000000000000000000000001800"/198, @ANYRES32, @ANYRES32, @ANYRES32=0xee00, @ANYRES32, @ANYBLOB="02040000000000004e464c4f4700000000000000000000000000000000000000000000000000000050000000000000000100000007000300000000005cae641872319dfae5a988272763a36abcf1f74cfd4bf988531a30a528c1c044813d8205fd8b1fdf1c2ccd79b5fb7f9e096fbd1c7eeee4b6646c0b2fc39d3fe20000000072656469726563740000000000000000000000000000000000000000000000000800000000000000feffffff00000000736e6174000000000000000000000000000000000000000000000000000000001000000000000000ffffffffffff0000fcffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x296) pipe(&(0x7f0000000040)) 11.228300732s ago: executing program 0 (id=5938): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_rdma(0x10, 0x3, 0x14) bind$netlink(r1, &(0x7f0000000000)={0x10, 0x0, 0x25dfdbfe, 0x800}, 0xc) bpf$ENABLE_STATS(0x20, 0x0, 0x0) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r2, 0x84, 0x1f, &(0x7f00000004c0)={0x0, @in6={{0xa, 0x4e23, 0x1000, @empty, 0xe}}, 0x6, 0xa}, 0x90) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b70800000d0000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="0b00000005000000000400000900000001"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000900)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b708000008"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f00000004c0)={r3, &(0x7f0000000340), &(0x7f00000005c0)=""/155}, 0x20) close(0x3) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xe, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000800000000200000000000018110000", @ANYRES32=r3], 0x0, 0x0, 0x0, 0x0, 0x0, 0x59, '\x00', 0x0, @fallback=0xd, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000800)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={r4, 0x2000000, 0xe, 0x0, &(0x7f00000004c0)="630b008646dc3f0adf33c9f7b986", 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x2}, 0x50) sendmsg$nl_route_sched(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000340)=@newtaction={0x64, 0x30, 0x80d, 0x0, 0x0, {}, [{0x50, 0x1, [@m_ct={0x4c, 0x1, 0x0, 0x0, {{0x7}, {0x24, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18}, @TCA_CT_ACTION={0x6, 0x3, 0x14}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x64}}, 0x0) 10.988821705s ago: executing program 0 (id=5940): r0 = socket$nl_route(0x10, 0x3, 0x0) (async) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) getsockopt$inet6_tcp_int(r1, 0x6, 0x17, 0xfffffffffffffffd, &(0x7f0000000340)=0x33) (async) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000240)=@newqdisc={0x1f, 0x24, 0x1}, 0x24}}, 0x0) (async) r3 = socket(0x10, 0x803, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) (async) sendmsg$nl_route_sched(r3, &(0x7f0000000140)={0x0, 0xffffffffffffff34, &(0x7f0000000080)={0x0, 0xb8}}, 0x0) (async) getsockname$packet(r3, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000000)=0x14) sendmsg$nl_route(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="34000000100081eee80000040000000010000000", @ANYRES32=r5, @ANYBLOB="ddfffffdff000000140012000c000100627269646765"], 0x34}}, 0x0) sendmsg$nl_route(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000140)=@ipv4_newaddr={0x20, 0x14, 0x1, 0x0, 0x0, {0x2, 0x0, 0x0, 0xff, r5}, [@IFA_LOCAL={0x8, 0x2, @local}]}, 0x20}}, 0x0) (async) r6 = socket$inet(0x2, 0x3, 0x2) setsockopt$inet_mreqsrc(r6, 0x0, 0x27, &(0x7f0000000040)={@multicast2, @local}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000440)={{r6, 0xffffffffffffffff}, &(0x7f00000003c0), &(0x7f0000000400)}, 0x20) (async) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r8, &(0x7f0000000600)=ANY=[], 0x32600) (async) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r8, 0x0) r9 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000001900)={&(0x7f00000017c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x94, 0x94, 0x7, [@struct={0x5, 0x9, 0x0, 0x4, 0x1, 0x30c56c23, [{0x8, 0x1, 0x8}, {0x0, 0x2, 0x1}, {0x2, 0x4, 0x3}, {0x3c63497c, 0x1, 0x81}, {0xb, 0x5, 0x2}, {0x1, 0x3, 0xfffffff9}, {0xd, 0x1, 0xe}, {0xd, 0x4, 0x8}, {0x9, 0x4, 0x1ff}]}, @var={0x8, 0x0, 0x0, 0xe, 0x2, 0x1}, @typedef={0xa, 0x0, 0x0, 0x8, 0x5}]}, {0x0, [0x5f, 0x5f, 0x0, 0x30, 0x61]}}, &(0x7f0000001880)=""/83, 0xb3, 0x53, 0x1, 0x8e}, 0x28) r10 = syz_open_procfs$namespace(0x0, &(0x7f0000000000)) (async) r11 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='blkio.bfq.dequeue\x00', 0x275a, 0x0) sendfile(r10, r11, 0x0, 0x0) (async) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000001a00)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000001980), &(0x7f00000019c0)='%pi6 \x00'}, 0x20) (async) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000001ac0)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000001a40), &(0x7f0000001a80)='%ps \x00'}, 0x20) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000001b80)={0x6, 0x25, &(0x7f0000000480)=@raw=[@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r7}}, @cb_func={0x18, 0x6, 0x4, 0x0, 0x5}, @exit, @btf_id={0x18, 0x1, 0x3, 0x0, 0x1}, @snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x4a6}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r8}}, @call={0x85, 0x0, 0x0, 0x71}, @snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x3}}, @jmp={0x5, 0x0, 0xa, 0xa, 0x2, 0x1, 0x1}], &(0x7f00000005c0)='syzkaller\x00', 0x8e93, 0x1000, &(0x7f00000007c0)=""/4096, 0x41100, 0x8, '\x00', 0x0, 0x25, r9, 0x8, 0x0, 0x0, 0x10, &(0x7f0000001940)={0x0, 0xc, 0x6, 0x3}, 0x10, 0x0, 0x0, 0x3, &(0x7f0000001b00)=[0xffffffffffffffff, 0xffffffffffffffff, r11, 0xffffffffffffffff, r12, r13], &(0x7f0000001b40)=[{0x2, 0x4, 0xa, 0x5}, {0x3, 0x1, 0xa, 0xa}, {0x3, 0x5, 0xb, 0x3}], 0x10, 0x1f}, 0x94) (async) r14 = socket(0x10, 0x803, 0x4) sendmsg$nl_route(r14, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={0x0, 0x1c}, 0x1, 0x0, 0x0, 0x20088814}, 0x0) (async) getsockname$packet(r14, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) setsockopt$inet_msfilter(r6, 0x0, 0x29, &(0x7f0000000380)={@multicast2, @local, 0x1, 0x2, [@local, @loopback]}, 0x18) sendmsg$nl_route_sched(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=@delchain={0x24, 0x11, 0x1, 0x13, 0x0, {0x0, 0x0, 0x0, r15, {0x0, 0xb}}}, 0x24}}, 0x0) 10.76195576s ago: executing program 0 (id=5945): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket(0x1, 0x2, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0f000000040000000400000012"], 0x50) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000140)={r3, &(0x7f0000000180), &(0x7f00000000c0)=@tcp6=r2}, 0x20) close(r2) setsockopt$sock_attach_bpf(r1, 0x1, 0x4c, &(0x7f0000000000), 0x4) sendmsg$inet(r0, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x4000000) recvmsg$unix(r1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffff64}, 0x40000040) 3.294672944s ago: executing program 4 (id=6001): bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x10, 0xe, &(0x7f0000001880)=ANY=[@ANYBLOB="b700000028d80000bca30000000000003403000040feffff720af0ff0000000071a4f0ff000000001f030000000000002e0a0200000000002604fdffffff000e61144400000000001d430000000000007a0a00fe0000001f61141c0000000000b503f7fff80000009500000000000000033bc065b78111c6dfa041b63af4a3912435f1a864a7aad58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a7168e5181554a090f30002af51efd601b6bf01c8e8b1fee5bef7af9aa0d7d600c095199fe3ff3128e599b0eaebbdbd732c9cc00eec363e4a8f6456e2cc21557c0afc646cb7798b3e6440c2fbdb00a3e35208b0bb0d2cd829e65440000000000000000028610643a98d9ec21ead2ed51b104d4d91af25b845b9f7d08d123deda88c658d42ecbf28bf7076c15b463bebc72f526dd70252e79166d858fcd0e06dd31af9612fa402d0b11008e59a5923906f88b53987ad1714e72ba7a54f0c33d39000d06a59ff616236fd9aa58f0177184b6a89adaf17b0a6041bdef728f5089048ddff6da40f9411fe7226a40409d6e37c4f46756d31cb467600ade70063e5291569b33d21dae356e1c51f03a801be8189679a16da18ec0ae564162a27afea62d84f3a10076443d643649393bf52d2105bd901128c7e0ec82701c8204a1deeed4155617572652d950ad31928b0b036dc2869f478341d02d0f5ad94b081fcd507acb4b9c67382f13d000000225d85ae49cee383dc5049076b98fb6853ab39a21514da60d2ae20cfb91d6a49964757cdf538f9ce2bdbb9893a5de817101ab062cd54e67051d355d84ce97bb0c6b6a595e487a2cc47c0efbb2d71cde2c10f0bc6980fe78683ac5c0c31032599dd273863be9261eee52216d009f4c52048ef8c126aeef5f510a8f1aded94a129e4aec6e8d9ab06faffc3a15d91c2ea3e2e04cfe031b287539d0540059fe6c7fe7cd8697502c7596566de74e425da5e7f009602a9f61d3804b3e0a1053abdc31282dfb15eb6841bb64a1b3045024a982f3c48b936e6f9e0fcda88fe4413537528fd79153baae244e7bf573eac34b781337ad5901a4cad2422ee965a38f7defbd2960242b104e20dc2d9b0c35608d402ccdd9069bd50b994fda7a9de44022a579dfc0229cc0dc98816106dec28eaeb883418f562ae00003ea96d10f172c0374d6eed826416050000000bfe9b4a9c5a90ff59d54d1f92ecc48899b212c55318294270a1ad10c80fef7c24d47afcc829ba0f85da6d888f18ea40ab959f6074ab2a40d85d1501783a7ab51380d7b4ead35a385e0b4a26b602396df7e0c1e02b88c114f244a9bf93f04bf072f0861f5c0b000000000000eedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba3401e6a52acb1188883ad2a3b1832371fe5bc621426d1ed01b389708165b9cdbae2ed9dc7358f0ebadde0b727f27feeb7464dcc536cbae2f5c7d951680f6f2f9a6a8346962a350845ffa0d82884f79adc287906943408e6df3c391e97ba48db0a5adbfd03aac93df8866fb010ae20e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00000000c95265b2bd83d648532869d701723fedcbada1ee7baa19faf67256b56a41fd355b6a686b50f0937f778af083e055f6138a757ebd0ed91124a6b244f9acf41ac5d73a008364e0606a594817031fc2654026c6ea08b83b123145ab5703dad844ceb201efeb6dc5f6a9037d2283c42efc54dd84323afc4c10eff462c8843187f1dd48ef0900000000000000ff0f4000000000f00700003c17888e1cdba94a6ea80c33ead5722c3293a493f1479531dd88261458f40d31fe8df15efaaeea831555877f9538c6ee6ba65893ff1f908ba7554ba583ec7932f5954f31a878e2fae6691d1aee1da02ba516467df3e7d1daac43738612e4fee18a22da19fcdb4c1011e32f808890205f0e6da2819d2f9e77c7c64affa54fec0136cbafa5f62e96753b639a924599c1f69219927ea5301fff0a6063d427180d61542c2571f983e96635600000554f327a3535e7c7542799493c31ac05a7b57f03ca91a01ba2a30ca99e969d6fd09dc28ebc15edb4d91675767999d146aef7799738b292fd64bbca48568325b2969e2b15f36b788bce5ccdbaf75c94cb93499f6947a967a794963442aece449a0d80010f5c653d22d49030a8c2a4ab595bf4238f18ca428dafc7ac96d404607a0000000051a2104f22e6db5a62b5089c1b45282d38864daa3ae81d6b0968d1d2869291b7d12096833d6864da40b54783a17aaeb6737c323f9f98e354cc98dcfe23ad01bd1c61563e69ffe1c2c73e16e637d4219ef7ec61261173f359e93d2c5e424c17998809ec8f0232b3955e052a4cecd89008f70314a0bdd491ecab5d232f89fe0120f64c62e8e3ed8bcb45202c204bbec8d722824c0ebca8db1ea4a05e41f6016ab5bbe4fe7ff5d785d0128171c90d9900ca2532b0f9d01c4b45294fbba468df3e1b393cb4e62e753b4172ba7ac1f2b51c94bc5d047899fd219f448bf9189c65c9d91eda6b52a373803a9efe44f86909bc90addbc4b3093c91b8068c5adfcb0d7fd849904568916694d461b76a58d88cf0f520310a1e9fdc18cde98d662eee077515d0a881192292ffff5392ab3d1311b82432662806add87047f601fa888400000000000000000000000000006acc19808d7cf29bc974b0ea92499a41b9b9a7c2bca311a28ee4952f2d325a56397c78f12205db653a536f0100e0eda300a43a13bd1b9f3322405d1efd78e578dc6b3fb84f3738a4b6caa800000087efa51c5d95ecba4e50e529d1e8c89600e809dc3d0a2f65579e23457949a50f2d0455cf699b3746979f99f6a1527f004f37e84fb478199dc1020f4beb98b8074bf7df8b5e783637daf121f175a81cffff4ac55a4385e9a617aa6c8e10d4202c5afeb06e2f9115558ea12f92d7ae633d44086b3f03b20d546fa66a72e38207c9d20035abc46271a30f1240de52536941242d23896ab74a3c6670fdc49c14f34fc4eadd6db8d80eba439772bf60a1db18c472dafc5569adc282928d2a1ffe29f1a57d3f18f4edaeb5d37918e6fddcd821da67a0785585a4443440dc65600e64a4a274000000000000000000000000000000000000000000000009dd14b38f2f5426d7cf5075047c31f6ce6adddfe3ac649c0643c8bfbeb14ba1fd7a485aa893915cf81e29aaf375e904bbe52691a4120260ffcd030000006d291ebcef893e1b9ccb6797d0646fe0e7274434f28efb43e06e64f0698caca42f4e6018a455736c482a017e2b13dac4a90faa109f0e87cc94e3efb649692456463ca74aa6ad4bf50c1acb3928143be1c1023a375e528285544d0064b98646f3109e9a4942ce42c6e7ec84b664f6c2770803f10b0a1fcbfc309381aeba191950bae71f37f1eb7ceeffb3c0547ac6571603adbfde4c8b5f8d7f4b854441613633b48865b65bdc415e1e0dcf672d68cf4cebf04f4bc1eebf560a26d3b332240d450fdb0a9a69f432e277f3a0386eb2bd1305c821c64757f786b79fef54dbe64c67d73934bc80b2133fb3c04cc7ea48bf97a6243c9f95dcbddecf45f008f1822c7868e1ff5a3cff5d6b6898335792749df7b1f51e91f8c1c3b1b93b33aaa3fab69cef08a9f6f6cf39dea3d878b2ed42545421970cc426e644332bc956d1c6adefdf0ede2c5c94aa632646ae225accdf031f611d01622921f1b922a5ac887cca3136133dce8d9f5f4da7bed2ea5d94362200000000000000000000f296b0c1484e5f781ad26bff696b05ff0a5e2270e07e18b04273bd4075ea38ab463bfa6a38e7c537498ba3e4df8dfc9e8c0a0d213c3ffad44d2a376def42e41e9fc3167a257e040fa7cf32c221aaac6cfdeb33c27500001a0000000000000000000017350000c11ae694b0c69c2c03f6790044a357e785af6e153d5f1ea460af92c7cbbd6295afe740f5e154346d483e0d10522a7a945b93fb705b95b6aae27a8fab1e6984c8bdc12360627137ab6737b68ab08acb29a74dc36b51209cfbc87f61182bbeb2772e9d5a1ffc477179be481ffe46a4ce86be0b1f8eee42a611a3d44ca450b14586ed63dd92005c79e4a8ab8a94f0b74903580ac98708007c80d6c7d0de4614195e40d797c0348dd70f36a220e8b3710fb5358c27e90793bcb9ee6319342c4b239ca8cbc6fc83d32e6eb62ad92e43991f2447be9c2a1ae1119eafb901a43d57e885116d19aa152bfb89f8d0b2516f80120a1cddff771657f3d0288ec3899f1e3ba0151c4037148fb479de703fc52b6573349c28d1b107d859b4961324c17756dde99de1924a1d2b7095d34a55060f47f4407d89acf9f285b20c2e6b3d0491d0d3591b0d94713332b6b79c8297117b0d14eff64e0aca8a4b4aa773d8fba1217e9519952419bb9dd998d0ec870ff00b6d556018602738fbc6cec89d6dd13cf55b96f6fe9a137d2d6a56ad78e52c23ed080000000000002bc261a781fd14126c146a0aac4221839a4b9bbf61e4bba695a41e2109eba8e40c370267cc51ffadbd15cafc97a4d3edfdcb9b5729307c6bdaf7b69325fb05fa8a9869de0600ee477d71bf3e36d1d9019edfa27aae24b632f251df210c86a18fae731ecb8b0d48357378caf2b6789509b1bacfd4fa812dc341875cfa5e798bbf59770000000000000000c8a594ea3c3347962d9113b1fecdfad5a8da641053f02e49456f5d21674521e67a5b18ea451eccf69dd6af928d2d68da9304a296c22fdcea26498d26229110b1aade386b113045033a6188d56e675564d8cb8d5b40114b0f5bf15dd64c9ece60b8588ee8777d0ea8f4713b258427c7d90f9e93348e17723ba9ab8ae790f74cc41ae5795835f3cec40dff485d2802c08611454d9ea784a205bcc07ec26f906f3cf45bb37014ab6f22af6213618e242b283ea9d3f0677ee598072ec06f7170009d92bb7ed9d12c378dfd3e74ec056ee83eef666423d934fc5908c9ff98715218a5964f1e00000000426ac9588e27aefe307f49662990ee823568bbc2f89596ced7c6c52d76b8096f1848410843b93fd404f535be474f456778b5ef85abb8fc2336abd5ea64a6efea8a5aca0015499b88ae780a7bae4df603bd3c72808cf300440b1b638a6640f7de8d0d82f359ca2f779cd48cd8d3603f4f69e47f386988c9b7b5d6dd3d48a1fdca780049d7c87bea42161a4c0d7cf0125b43dc9d8845f3c05a08acda647e7143d0e0aee2949a45e2848890522c2288072467d2afe269f589fb7e034b92d3ca245b16b71998711bfe206c9690b6d0eebb06a29349229eb45ff15c63aa2c82c56d7420738cd1b04eb16e87cb524315d7361ea3635d3799bb7fcc56aa5e1dbe031a7a12554dee6754b72f43a6fddf427f32ec3df274a88097725679769beebf1aa6eb09d5154e4900000000000d0f7160a05911d969879953d3d4702b2676c07bb0fd14020a66718378825d5ed789711b77d40dc31e0b8fc651b45559da463f0000000000000000000000000052d42124e9c26aba885015e69d42ecd710342ac597ebea576ae15fdf611356f622e831741ab15549e0d7a2bd0324e2b3b48a10551607492c19eaf58485feb4cab19c303b30ba2ddea0d792d77724c9fa4ed58b93668fc20484f141ee2b6a0029e88fdc853189b4dafd36ff23b11967090e508f45e3f10857038a52ef275cf9e3e4b5d30b12d138dfa70930c603b5e3f4b7be67be3dba3cbd8d4d143195af0697d779445d67dcfbd922d12a8b49f93eac7a72faacf80346b3b6"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_msg, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0xffffffffffffff97, 0x10, &(0x7f00000000c0), 0xffffffffffffffc2}, 0x48) (async) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000007c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(sm4)\x00'}, 0x58) (async) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000001280)="b7f2288a911993f08d3aaea2bc0000de", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000005500)=[{0x0, 0x0, &(0x7f0000000380)=[{&(0x7f0000000000)="77167ead34cd1eaf2108c04de96e99fa4435f9041368e8dfec6af2ae8080b56c53c12b8431d17955ae1ec78709eee9acf825fdb672651f7eafb44b576930aff4b6a86ced3e4392cfe57a2c11b97e93f38debd6dc69f3a50d5742daa7081df08bd8118dcd6d9d18830c7d79d8", 0x6c}, {&(0x7f00000000c0)="23ade41881a1e7ca07379924e2cb53138ec1e2ac415947eb6c7f56119ff98596d7469564e6d7c49134d1d57bf4cf20e6ba85156f3c5aa55a181146316537eceea0fff85f05333feea12645495ffa", 0x4e}, {&(0x7f0000000140)="66348451d22f5e2e4385e0bf75c5c3d30327039c072cd147f3b25df80100010000000004706aa85896228ef23136cbc160147a23", 0x34}, {&(0x7f0000000180)="fe6abb1be48e556b473cabd427d746ca7d9bbf4f24ec7659b1c254940281f0a248dfc8c103fad1369a53e3402210b77170735064ceae5fcf381d21cc8960440e0a459705262c4c53065f369fe8e63bc7650112b91fdccaceff93fd8cdab5a479b9614318eebc5a609b633b114fe330c840cc077cd6a6f6ca2bca0cc48c06177e0bc3b7fe6320e9f2e5a824d74aa3cccac383bacd0a126a58fa999675ad5c41c171807570ac0501332c2794950f4633a074325e58cd43d58340513dbc10eaaf4ff3c4b8d98621267d8b1abdbf01d7de9a86c2d4373dd907da5a", 0xd9}, {&(0x7f0000000280)="1b1eb47967b88f89e960c59413baaf1384ad9c758abf845c5714a919ca02735c5514fa78f9f084d72227c1d3f6607ce5a2183a169535d0b2bb594ecb92b8df361bca805ac5595a389d39a58a35c0ff662c2c83431c0c2e2ece5ca6a104d1d45c1c15ca4d75cab6b1bb92", 0x6a}], 0x5}], 0x1, 0x4814) (async) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000000, 0x12, r2, 0x0) r3 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) setsockopt$bt_l2cap_L2CAP_LM(r3, 0x6, 0x3, &(0x7f0000000040)=0x20, 0x4) recvmmsg(r1, &(0x7f0000000e00)=[{{0x0, 0x0, &(0x7f0000000840)=[{&(0x7f0000000080)=""/22, 0x16}, {&(0x7f0000000340)=""/21, 0x15}, {&(0x7f0000000400)=""/151, 0x97}, {&(0x7f0000000680)=""/246, 0xf6}], 0x4}, 0x3}], 0x1, 0x2001, 0x0) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0xd, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4000000000000006311a40000000000040300000000000000000000090000004d04ff8634b8d5242040ce"], &(0x7f0000000080)='GPL\x00', 0x8, 0x3e0, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sock_ops, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0x76}, 0x48) 3.090063574s ago: executing program 4 (id=6002): r0 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000000)={0x8004800}, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=ANY=[@ANYBLOB="180000001600010a0002000000836b00000000ac"], 0x78}, 0x1, 0x0, 0x0, 0x8000}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0xe, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="180000000040000000000000000000007110ad000000000095"], &(0x7f0000000100)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x17, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) getsockname$l2tp6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @private1}, &(0x7f00000000c0)=0x20) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x7, 0x6, &(0x7f00000005c0)=ANY=[@ANYBLOB="05000000000000007111ab00000000008510000002000000850000002a00000095000000000000009500a505000000008d8d72a4d2b0e866647a5563580154525990a711faae6b5efa82c515c097c645d4a49869490531e6fc004371de6a0e2aeb39db28a841fee433ca770c6799b28945ba973ff15b71d81a48f65b229efa31eb19c4d6945c8db59bf97ce0d74761c6ededcdebebfcd90759bd2cfe8b4253a9468fe5b0759b99a37a189ddd91f7bf447837"], &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x6}, 0x70) 2.847364183s ago: executing program 2 (id=6006): r0 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000980)=@raw={'raw\x00', 0x8, 0x3, 0x4c0, 0x190, 0xffffffff, 0xffffffff, 0x190, 0xffffffff, 0x3f0, 0xffffffff, 0xffffffff, 0x3f0, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [0x0, 0x0, 0x0, 0xff0000ff], [], 'veth0_macvtap\x00', 'dvmrp1\x00', {}, {}, 0x0, 0x0, 0x2}, 0x0, 0x128, 0x190, 0x0, {}, [@common=@unspec=@addrtype1={{0x28}, {0x46, 0x0, 0x9}}, @common=@inet=@hashlimit1={{0x58}, {'bond_slave_1\x00', {0x29, 0x1ff, 0x6, 0xb0e6, 0x10001, 0x84e, 0xfffffffb, 0x18, 0x8}, {0x1}}}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x18, 0x800, 0x1, 0x6, 'netbios-ns\x00', 'syz0\x00', {0x8}}}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'erspan0\x00', 'gre0\x00', {}, {}, 0x0, 0x4}, 0x0, 0x1f8, 0x260, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@recent0={{0xf8}, {0xffff, 0x40, 0x10, 0x1, 'syz0\x00', 0xa}}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x1, 0x8, 0x2, 0x8, 'pptp\x00', 'syz1\x00', {0x5a}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x520) (async) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="0a000000050000000200000004"], 0x48) (async) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000dc0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) (async) close(0x3) (async) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000380)={'syztnl0\x00', &(0x7f0000000200)={'gre0\x00', 0x0, 0x8, 0x10, 0x8000, 0x0, {{0x4e, 0x4, 0x1, 0x2b, 0x138, 0x66, 0x0, 0x0, 0x29, 0x0, @rand_addr=0x64010100, @broadcast, {[@timestamp={0x44, 0xc, 0x27, 0x0, 0x9, [0x3, 0xe]}, @noop, @timestamp={0x44, 0x20, 0x4e, 0x0, 0x9, [0xc3b, 0xa, 0x3, 0x4, 0x7fffffff, 0xdadb, 0x7801]}, @timestamp_addr={0x44, 0x44, 0xa2, 0x1, 0x9, [{@loopback, 0x25a}, {@multicast1, 0x9f9b}, {@loopback, 0x5}, {@multicast2, 0x2}, {@multicast2, 0x906}, {@local, 0x6}, {@private=0xa010101, 0x7}, {@private=0xa010101, 0xffffffff}]}, @generic={0x0, 0xd, "e2dbefd3be45941133d809"}, @rr={0x7, 0x23, 0x87, [@empty, @multicast2, @initdev={0xac, 0x1e, 0x0, 0x0}, @local, @private=0xa010102, @loopback, @initdev={0xac, 0x1e, 0x0, 0x0}, @private=0xa010102]}, @cipso={0x86, 0x46, 0x3, [{0x5, 0x6, "c0dbcf68"}, {0x0, 0x10, "d8f1fb955dd5d31c4ae5a7124160"}, {0x5, 0x7, "84108628e6"}, {0x1, 0x12, "499ef5745cc693f6e5d5cd9bb0adfd12"}, {0x0, 0xd, "9eb21d8e154b986c80471a"}, {0x4, 0x4, "9fae"}]}, @timestamp_addr={0x44, 0x1c, 0x32, 0x1, 0x5, [{@remote, 0x5}, {@broadcast}, {@multicast2, 0xef45}]}, @ssrr={0x89, 0x1f, 0xb1, [@multicast2, @dev={0xac, 0x14, 0x14, 0x1c}, @private=0xa010101, @local, @multicast2, @rand_addr=0x64010100, @rand_addr=0x64010101]}]}}}}}) (async) ioctl$ifreq_SIOCGIFINDEX_wireguard(r0, 0x8933, &(0x7f00000003c0)={'wg2\x00', 0x0}) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000300)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x40000, 0x25dfdbff, {0x0, 0x0, 0x0, r6, {0xa}, {0xffff, 0x3}}, [@TCA_EGRESS_BLOCK={0x8, 0xe, 0x3}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000400}, 0x0) (async) getpeername$packet(0xffffffffffffffff, &(0x7f0000000400)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000000440)=0x14) (async) ioctl$ifreq_SIOCGIFINDEX_wireguard(r0, 0x8933, &(0x7f0000000480)={'wg2\x00', 0x0}) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000540)={'erspan0\x00', &(0x7f00000004c0)={'syztnl0\x00', 0x0, 0x1d89f8703e82daf1, 0x700, 0xfffffbff, 0x1, {{0xb, 0x4, 0x0, 0x3, 0x2c, 0x67, 0x0, 0x1, 0x2f, 0x0, @multicast2, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@lsrr={0x83, 0xb, 0xf6, [@loopback, @private=0xa010100]}, @timestamp_prespec={0x44, 0xc, 0xc, 0x3, 0x9, [{@dev={0xac, 0x14, 0x14, 0xa}, 0x7}]}]}}}}}) (async) r10 = socket$nl_route(0x10, 0x3, 0x0) (async) r11 = socket$netlink(0x10, 0x3, 0x0) (async) r12 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r12, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={0x0, 0x14}}, 0x0) getsockname$packet(r12, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x7) sendmsg$nl_route(r11, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="480000001000050700000086d7c0d6c878f064eb", @ANYRES32=r13, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) (async) sendmsg$nl_route_sched(r11, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000900)=@newqdisc={0x30, 0x24, 0xf1d, 0x0, 0x25dfdbfb, {0x0, 0x0, 0x0, r13, {0x0, 0x8}, {0xfff1, 0xffff}, {0x6}}, [@qdisc_kind_options=@q_clsact={0xb}]}, 0x30}}, 0x4000800) (async) sendmsg$nl_route_sched(r10, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000980)=@delchain={0x24, 0x64, 0x1, 0x70bd2a, 0x3, {0x0, 0x0, 0x0, r13, {0x0, 0xffe0}, {0xfff3, 0xffff}, {0x0, 0x1b}}}, 0x24}, 0x1, 0x0, 0x0, 0x10}, 0x10) (async) sendmsg$ETHTOOL_MSG_PRIVFLAGS_GET(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000680)={&(0x7f0000000740)=ANY=[@ANYBLOB="d8000000", @ANYRES16=0x0, @ANYBLOB="200029bd7000ffdbdf250d00000050000180080003000300000008000100", @ANYRES32=0x0, @ANYBLOB="140002007663616e30000000000000000000000008000100", @ANYRES32=0x0, @ANYBLOB, @ANYRES32=r3, @ANYBLOB="08000100", @ANYRES32=r4, @ANYBLOB="080003000000000008000300010000001400018008000100", @ANYRES32=r6, @ANYBLOB="0800030004000000200001801400020076657468305f6d61637674617000000008000100", @ANYRES32=r7, @ANYBLOB="0c00018008000100", @ANYRES32=r8, @ANYBLOB="1c000180080003000000000008000100", @ANYRES32=r9, @ANYBLOB="08000100", @ANYRES32=r13, @ANYBLOB="18000180140002006970365f767469300000000000000000", @ANYRESDEC=r11, @ANYRES8=r7], 0xd8}, 0x1, 0x0, 0x0, 0x4800}, 0x9c4) bpf$MAP_CREATE(0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="0f00000004000000080000000b00000000000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000000000000000000100"/28], 0x50) (async) bpf$PROG_LOAD(0x5, &(0x7f0000001c40)={0x0, 0x10, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b702000001000000850000008600000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) (async) r16 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0x10, &(0x7f0000000180)=ANY=[], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) (async) r17 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000a40)={r17, 0x27, 0x0, 0x0, 0x0, 0x0, 0x4000, 0xf2ffffff, 0x0, 0x0, 0x0, 0x0}, 0x50) setsockopt$sock_attach_bpf(r14, 0x1, 0x32, &(0x7f00000000c0)=r16, 0x4) (async) sendmsg$unix(r15, &(0x7f00000006c0)={0x0, 0x0, 0x0}, 0x0) 2.735207489s ago: executing program 1 (id=6007): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000240)=[{&(0x7f00000000c0)="d800000018008103e00312ba0d8105040a600300ff0f04d0067c55a1bc000900b80006990700000015000500fef32702d3001500030001400200000901ac040098007f6f94007100a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4098000001fb791643a5ee4b11602b2a10c11ce1b14d6d930dfe1d9d322fe04000000730d7a5025ccca262f3d40fad95667e04adcdf634c1fff01e3bb9ad809d5e1cace81ed0b66bce0b42a9e1b518077c20708215c2c4b4ecbee5de6ccd40dd6e4edef3d93452a92307f00000e970300000000000000", 0xd8}], 0x1}, 0x48002) sendmsg$nl_generic(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000001ac0)={&(0x7f0000000900)=ANY=[@ANYBLOB="180000002e00010026bdf000fcdbdf250400000004001d"], 0x18}, 0x1, 0x0, 0x0, 0x4000d}, 0x4000010) 2.676257933s ago: executing program 4 (id=6008): r0 = socket$nl_crypto(0x10, 0x3, 0x15) sendmsg$nl_crypto(r0, &(0x7f0000000200)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f00000001c0)={&(0x7f00000000c0)=@getstat={0xe0, 0x15, 0x1, 0x70bd26, 0x25dfdbff, {{'blake2b-256\x00'}, '\x00', '\x00', 0x2400, 0x400}, ["", "", "", "", "", "", ""]}, 0xe0}, 0x1, 0x0, 0x0, 0x4}, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) r2 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x3) ioctl$FS_IOC_GETFSLABEL(r2, 0x400452c8, &(0x7f0000000100)) sendmsg$NFT_BATCH(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01010000000000000000010000000900010073797a300000000040000000160a01000000000000000000010000000900010073797a30000000000900020073797a3000000000140003800800014000000000080002400000000050000000160a0103000b000000000000010000000900020073797a30000000000900010073797a30000000001c000380"], 0xd8}}, 0x0) 2.643200454s ago: executing program 2 (id=6009): r0 = epoll_create1(0x0) sendmsg$RDMA_NLDEV_CMD_SET(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000340)={&(0x7f00000002c0)=ANY=[@ANYBLOB="000126180b00fbdbdf250900020073797a300000000008000100010000000800010002004000080001000200000005005400000000000500540000000000"], 0x44}, 0x1, 0x0, 0x0, 0x400c084}, 0x1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)) (async) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r1, &(0x7f0000000080)={0x10000000}) epoll_create1(0x0) (async) r3 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r2, &(0x7f0000000100)={0x20000014}) unshare(0x28000600) (async) unshare(0x28000600) r4 = socket$alg(0x26, 0x5, 0x0) bind$alg(r4, &(0x7f0000000040)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(serpent)\x00'}, 0x58) (async) bind$alg(r4, &(0x7f0000000040)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(serpent)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, 0x0, 0x0) sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD(0xffffffffffffffff, &(0x7f0000000ac0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000a80)={&(0x7f0000000780)={0x178, 0x0, 0x200, 0x70bd2d, 0x25dfdbfc, {{}, {@void, @val={0xc, 0x99, {0x101, 0x75}}}}, [@NL80211_ATTR_REKEY_DATA={0x4}, @NL80211_ATTR_REKEY_DATA={0x34, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "7b6200ee64e4af9a"}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="30ea15d0d251c9f268b4d1eccfaf21d9a5964ef0a7fb2aaeba02fe9a134aaa15"}]}, @NL80211_ATTR_REKEY_DATA={0x5c, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x85d}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "65cd6919bf9b1f7c"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0xff}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "4ecba330d83ca221"}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="a030ff2bfa00de9ac4934578af359bb6a12e1435afc5572685ceede9938db449"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "ba5ef875e85bc845"}]}, @NL80211_ATTR_REKEY_DATA={0x74, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_KCK={0x14, 0x2, @kck="54feca3a627ece01ecdc81739cce5d1f"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "6aad432412efae69"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="31f33dc00a499e41b77f5bc2fc4fda62"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "6febf26272042529"}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="19cc60d0aa693b2bd4066b9d4b2b8fe43b26b0b794b7bb050c38219ecf0ed349"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "7d7afecc3519644d"}]}, @NL80211_ATTR_REKEY_DATA={0x50, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x2408}, @NL80211_REKEY_DATA_KCK={0x14, 0x2, @kck="d3c9aeb207f6f9054348e3b038394676"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0xfffffffe}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="42fb04baed88680b533eabeeb88b377b"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="ee96a9ee1e67b7a284476503155662be"}]}]}, 0x178}, 0x1, 0x0, 0x0, 0x8c0}, 0x80000c0) accept4$alg(r4, 0x0, 0x0, 0x0) (async) r5 = accept4$alg(r4, 0x0, 0x0, 0x0) sendmmsg$alg(r5, &(0x7f00000021c0)=[{0x0, 0x0, &(0x7f0000001000)=[{&(0x7f0000000100)="a92e81d0991808e33c2330164cf023df", 0xfffffc81}], 0x1, &(0x7f0000001040)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18, 0x880}], 0x1, 0x80001) read$alg(r5, &(0x7f0000001080)=""/4130, 0x1022) bpf$PROG_LOAD(0x5, &(0x7f0000000480)={0x9, 0x3, &(0x7f0000000900)=ANY=[@ANYBLOB="b70000000000000007000000000000009500000000000000bdc5072e4c75223f007e6ca306000000000000009c91420b66f0980e90dc0a9900d145243692fe648adf4cbc1dc631c378820861eccfa60822e798d6526600eea6c33dd5b2a7762091bffe56a9440bf23deb4dc8947d2bafec88ae3708013fdc5b2a1dbc7d50fcb6d9a01d03491c35fee5ff00002e40db34dea1063eaf2e3d6959435775943a5a7090b1c08454a248811ed0850a0e16793732f7c9af95af00100000955133044fd041b55379c29cc8ca9e1e5223ceb6f2e4980e5be2d3f36ae968af01953b6e4b3aa3fe0c375b2e17019ccdf4b9b5caccc4722cf3e6cfa6567c5a8e01bf465f0a27e54911827c4fa432ca89bf5ac89effedbe12b66ce9643697ac0e12a966dcea592613f479d71eb2597dd9000000000000000000000000001d5bdafcd419016b45507fedc616a94a06268d9b21e956eabc"], &(0x7f0000003ff6)='syzkaller\x00', 0x1, 0xce, &(0x7f00000001c0)=""/206, 0x0, 0x0, '\x00', 0x0, @cgroup_sock=0x22}, 0x94) (async) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000480)={0x9, 0x3, &(0x7f0000000900)=ANY=[@ANYBLOB="b70000000000000007000000000000009500000000000000bdc5072e4c75223f007e6ca306000000000000009c91420b66f0980e90dc0a9900d145243692fe648adf4cbc1dc631c378820861eccfa60822e798d6526600eea6c33dd5b2a7762091bffe56a9440bf23deb4dc8947d2bafec88ae3708013fdc5b2a1dbc7d50fcb6d9a01d03491c35fee5ff00002e40db34dea1063eaf2e3d6959435775943a5a7090b1c08454a248811ed0850a0e16793732f7c9af95af00100000955133044fd041b55379c29cc8ca9e1e5223ceb6f2e4980e5be2d3f36ae968af01953b6e4b3aa3fe0c375b2e17019ccdf4b9b5caccc4722cf3e6cfa6567c5a8e01bf465f0a27e54911827c4fa432ca89bf5ac89effedbe12b66ce9643697ac0e12a966dcea592613f479d71eb2597dd9000000000000000000000000001d5bdafcd419016b45507fedc616a94a06268d9b21e956eabc"], &(0x7f0000003ff6)='syzkaller\x00', 0x1, 0xce, &(0x7f00000001c0)=""/206, 0x0, 0x0, '\x00', 0x0, @cgroup_sock=0x22}, 0x94) r7 = socket$inet6(0xa, 0x2, 0x0) r8 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000005c0)=ANY=[@ANYBLOB="b80000001300020000000000fbdbdf25fc0000000000000000000000000000002001000000000000000000000000000100000004000000000a0060803b0000001b49f85509108a26ba867441e3ad5cf33fb99c867a86efa56e51879c0ca5647c533cf5df25637eda32dcfd82df8c3619e94725fae24875d49392f45ae2a04f27593caeef39de1078f21683ff886a9a3189aa38333aeb5f39ce67fe53f2ca1b224c90e9fb63c79b5a80f5384897499a883131f71435b9268b0c9d88cc7dbad9f71844ce3c517297b8c1df1785b12d2267a0f06d7282ae35f1e5a19bbdcee18f8f24b57bac61ff5ce1b92004cfe91761efe9b03cd9b400374dc2dc5272c69ebabb1771851b6b0337bb9e2aa9d5e4f9c828bd617bdb97eb1ce6017161ba30fd560ca8c4d5860dd503b328439982d45286118c2738cc", @ANYRES32=0x0, @ANYRES32=0xee01, @ANYBLOB="00000000000000000400000000000000000000000000000000000000000000000400000000000000fdffffffffffffff00000000000000000000000000000000feffffffffffffff00000000000000000000000000000000000000000000000009000000000000000001020000000000"], 0xb8}, 0x1, 0x0, 0x0, 0x90}, 0x50) (async) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000005c0)=ANY=[@ANYBLOB="b80000001300020000000000fbdbdf25fc0000000000000000000000000000002001000000000000000000000000000100000004000000000a0060803b0000001b49f85509108a26ba867441e3ad5cf33fb99c867a86efa56e51879c0ca5647c533cf5df25637eda32dcfd82df8c3619e94725fae24875d49392f45ae2a04f27593caeef39de1078f21683ff886a9a3189aa38333aeb5f39ce67fe53f2ca1b224c90e9fb63c79b5a80f5384897499a883131f71435b9268b0c9d88cc7dbad9f71844ce3c517297b8c1df1785b12d2267a0f06d7282ae35f1e5a19bbdcee18f8f24b57bac61ff5ce1b92004cfe91761efe9b03cd9b400374dc2dc5272c69ebabb1771851b6b0337bb9e2aa9d5e4f9c828bd617bdb97eb1ce6017161ba30fd560ca8c4d5860dd503b328439982d45286118c2738cc", @ANYRES32=0x0, @ANYRES32=0xee01, @ANYBLOB="00000000000000000400000000000000000000000000000000000000000000000400000000000000fdffffffffffffff00000000000000000000000000000000feffffffffffffff00000000000000000000000000000000000000000000000009000000000000000001020000000000"], 0xb8}, 0x1, 0x0, 0x0, 0x90}, 0x50) r9 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r9, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9"], 0xb8}}, 0x0) (async) sendmsg$nl_xfrm(r9, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9"], 0xb8}}, 0x0) sendmsg$nl_xfrm(r8, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9990000000000000000fc0000000000000001"], 0xb8}}, 0x0) (async) sendmsg$nl_xfrm(r8, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9990000000000000000fc0000000000000001"], 0xb8}}, 0x0) r10 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r10, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000280)=ANY=[@ANYBLOB="b80000001300e9990000000000000000fc000000000000000100000000000000ac1e000100000000000000000000000000000000000000000a0060"], 0xb8}}, 0x20040014) r11 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r11, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0xcb23c9c9931e99e9, 0x0, 0x0, {{@in6=@private0, @in=@empty, 0x0, 0x0, 0x0, 0x0, 0xa, 0x40, 0x0, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0xaa3, 0xfffffffffffffff8, 0x40000000, 0x0, 0x8, 0x3}, {0x0, 0x8}, 0xfffffffc, 0x0, 0x0, 0x0, 0x0, 0x3}}, 0xb8}}, 0x0) r12 = socket(0x2d, 0x2, 0x0) socket$kcm(0x29, 0x2, 0x0) (async) socket$kcm(0x29, 0x2, 0x0) sendmsg$RDMA_NLDEV_CMD_DELLINK(r12, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f00000000c0)={0x0}, 0x1, 0x0, 0x0, 0xc0}, 0x0) setsockopt$sock_attach_bpf(r7, 0x1, 0x34, &(0x7f0000009000)=r6, 0x4) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r0, &(0x7f0000000000)={0xa0000001}) 2.336807009s ago: executing program 3 (id=6010): bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={0xffffffffffffffff, 0x2000000, 0xd, 0x0, &(0x7f0000000200)="63eced8e46dc3f0adf33c9f7b9", 0x0, 0x3800, 0x0, 0x1f, 0x0, 0x0, 0x0}, 0x50) pipe(&(0x7f0000000040)={0xffffffffffffffff}) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) getsockopt$inet6_tcp_int(r1, 0x6, 0x24, &(0x7f0000000c00), &(0x7f0000002000)=0x2) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000240)={r0}, 0x4) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="220000000400000010000000"], 0x48) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f00000000c0)={r2}, 0x4) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0xe, 0x3, &(0x7f0000000000)=@framed={{0x62, 0xa, 0x0, 0xffc4, 0x0, 0x71, 0x10, 0xa3}}, &(0x7f0000000480)='GPL\x00'}, 0x90) 2.211745849s ago: executing program 1 (id=6011): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x1c}}, 0x0) getsockname$packet(r1, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000006c0)={0x3, 0x4, 0x4, 0x7ffffffe, 0x0, 0x1}, 0x48) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32=r2, @ANYBLOB="f5ff0f00252155b21c0012000c000100626f6e64000000000c0002000800010001"], 0x3c}}, 0x40000) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)={{0x14}, [@NFT_MSG_NEWRULE={0x6c, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x40, 0x4, 0x0, 0x1, [{0x3c, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0x2c, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_LEN={0x8, 0x4, 0x1, 0x0, 0x4}, @NFTA_EXTHDR_SREG={0x8, 0x7, 0x1, 0x0, 0x9}, @NFTA_EXTHDR_OP={0x8, 0x6, 0x1, 0x0, 0x1}, @NFTA_EXTHDR_TYPE={0x5}, @NFTA_EXTHDR_OFFSET={0x8, 0x3, 0x1, 0x0, 0x4}]}}}]}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0x94}}, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(r7, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)=ANY=[@ANYBLOB='@\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="010026bd70000400000005000000080009000200000008000c00a50a000008000b00000000000600010007dc"], 0x40}}, 0x20) sendmsg$L2TP_CMD_TUNNEL_GET(r5, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)={0x50, r6, 0x100, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IP_SADDR={0x8, 0x18, @private=0xa010100}, @L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x3}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x1}, @L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0x6}, @L2TP_ATTR_COOKIE={0xc, 0xf, 0x3}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0x1}, @L2TP_ATTR_PW_TYPE={0x6, 0x1, 0x8}]}, 0x50}, 0x1, 0x0, 0x0, 0x800}, 0x20008004) r8 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_inet6_SIOCSIFADDR(r8, 0x8916, &(0x7f0000000380)={@dev={0xfe, 0x80, '\x00', 0x1f}, 0x76, r2}) ioctl$sock_inet6_SIOCSIFADDR(r4, 0x8916, &(0x7f0000000100)={@ipv4={'\x00', '\xff\xff', @multicast2}, 0x56, r2}) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000b80)=ANY=[@ANYBLOB="3c00000010000305000000000007000000000000", @ANYRES32=0x0, @ANYBLOB="0000000006100000140012800b00010062726964676500000400028008000a00", @ANYRES32=r2], 0x3c}, 0x1, 0x0, 0x0, 0x800}, 0x440b0) socket$netlink(0x10, 0x3, 0x0) (async) socket(0x10, 0x803, 0x0) (async) sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x1c}}, 0x0) (async) getsockname$packet(r1, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) (async) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000006c0)={0x3, 0x4, 0x4, 0x7ffffffe, 0x0, 0x1}, 0x48) (async) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32=r2, @ANYBLOB="f5ff0f00252155b21c0012000c000100626f6e64000000000c0002000800010001"], 0x3c}}, 0x40000) (async) socket$nl_netfilter(0x10, 0x3, 0xc) (async) sendmsg$NFT_BATCH(r3, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) (async) sendmsg$NFT_BATCH(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)={{0x14}, [@NFT_MSG_NEWRULE={0x6c, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x40, 0x4, 0x0, 0x1, [{0x3c, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0x2c, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_LEN={0x8, 0x4, 0x1, 0x0, 0x4}, @NFTA_EXTHDR_SREG={0x8, 0x7, 0x1, 0x0, 0x9}, @NFTA_EXTHDR_OP={0x8, 0x6, 0x1, 0x0, 0x1}, @NFTA_EXTHDR_TYPE={0x5}, @NFTA_EXTHDR_OFFSET={0x8, 0x3, 0x1, 0x0, 0x4}]}}}]}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0x94}}, 0x0) (async) socket$inet6_tcp(0xa, 0x1, 0x0) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$L2TP_CMD_SESSION_DELETE(r7, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)=ANY=[@ANYBLOB='@\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="010026bd70000400000005000000080009000200000008000c00a50a000008000b00000000000600010007dc"], 0x40}}, 0x20) (async) sendmsg$L2TP_CMD_TUNNEL_GET(r5, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)={0x50, r6, 0x100, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_IP_SADDR={0x8, 0x18, @private=0xa010100}, @L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x3}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x1}, @L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0x6}, @L2TP_ATTR_COOKIE={0xc, 0xf, 0x3}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0x1}, @L2TP_ATTR_PW_TYPE={0x6, 0x1, 0x8}]}, 0x50}, 0x1, 0x0, 0x0, 0x800}, 0x20008004) (async) socket$inet6_udplite(0xa, 0x2, 0x88) (async) ioctl$sock_inet6_SIOCSIFADDR(r8, 0x8916, &(0x7f0000000380)={@dev={0xfe, 0x80, '\x00', 0x1f}, 0x76, r2}) (async) ioctl$sock_inet6_SIOCSIFADDR(r4, 0x8916, &(0x7f0000000100)={@ipv4={'\x00', '\xff\xff', @multicast2}, 0x56, r2}) (async) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000b80)=ANY=[@ANYBLOB="3c00000010000305000000000007000000000000", @ANYRES32=0x0, @ANYBLOB="0000000006100000140012800b00010062726964676500000400028008000a00", @ANYRES32=r2], 0x3c}, 0x1, 0x0, 0x0, 0x800}, 0x440b0) (async) 2.050863335s ago: executing program 2 (id=6012): clock_gettime(0x4, &(0x7f0000000000)) syz_emit_ethernet(0xae, &(0x7f0000000000)={@local, @empty, @void, {@ipv4={0x800, @icmp={{0x26, 0x4, 0x0, 0x36, 0xa0, 0x65, 0x0, 0x4, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x2e}, {[@timestamp_addr={0x44, 0x54, 0x45, 0x1, 0x0, [{@dev={0xac, 0x14, 0x14, 0x2e}, 0x2}, {@initdev={0xac, 0x1e, 0x0, 0x0}, 0x7}, {@local, 0x6}, {@broadcast, 0x7fffffff}, {@empty, 0x2}, {@multicast1, 0x6}, {@broadcast, 0x6}, {@empty, 0x3}, {@private=0xa010101, 0xe44}, {@empty, 0x8}]}, @cipso={0x86, 0x24, 0x3, [{0x0, 0x9, "fee36c06548191"}, {0x7, 0x4, "f4fe"}, {0x1, 0x9, "7bb82e6f3c74b5"}, {0x5, 0x8, "464415067c93"}]}, @ssrr={0x89, 0xb, 0x57, [@broadcast, @loopback]}]}}, @info_request={0xf, 0x0, 0x0, 0x2, 0xd369}}}}}, 0x0) 2.004954446s ago: executing program 4 (id=6013): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r0, &(0x7f0000000280)={@val={0x6f01, 0x800}, @val={0x1, 0x0, 0x0, 0x0, 0x20}, @mpls={[], @ipv4=@tcp={{0x6, 0x4, 0x0, 0x0, 0x3f, 0x0, 0x0, 0x0, 0x84, 0x0, @empty=0x3fffffff, @local}, {{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x5, 0xb, 0x0, 0xfe, 0x0, 0x13, {[@window={0x9, 0xfffffffffffffec4}, @timestamp={0x5, 0x2, 0xfffd, 0x88000}, @generic={0x0, 0x2, "d58838068b91"}]}}}}}}, 0x4e) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x8) sendmsg$nl_xfrm(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000004c0)=ANY=[@ANYBLOB="3c01000019000100000000000000000000000000000000000000000000000000ac1414bb0000000000000000000000000000fffd000000000a00000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000000000000fdffc591ffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffffffffffff000000000000000000000000000000000000000000000000000000000000000000000000b86b6e00000000000000000084000500ac0714aa000000000000000000000000000000002b00000000000000ffffffff00000000000000000000000000000000000000000000000000000000000000007f000001000000000000000000000000000000006c00000000000000ac1414aa0000000000000000000a0000004000"/244], 0x13c}, 0x1, 0x0, 0x0, 0x9}, 0x4040000) r3 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_buf(r3, 0x0, 0x8008000000010, &(0x7f0000005e40)="17000000020001000003d68c5ee17688a2003208020300ecff3f0200000300000a000000009afc5ad9485bbb6a880000d6c8db0000dba67e060180000a0000f10607bdff59100ac45761407a681f009cee4a5acb3da400001fb700674f19b44e09f9315033bf79ac2dff060115003901000000000000ea000000000000000009ffff02dfccebf6ba0008400200000000e90554062a80e605007f71174aa951f3c63e5c83f1ba2112ce68bf17a6e000"/184, 0xb8) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000001c0)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="1800000000000000e5460e17b401000000000000000085000000470000009500000000000000"], &(0x7f0000000140)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xe}, 0x91) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) (async) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) (async) socket$kcm(0x2, 0xa, 0x2) (async) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) (async) write$tun(r0, &(0x7f0000000280)={@val={0x6f01, 0x800}, @val={0x1, 0x0, 0x0, 0x0, 0x20}, @mpls={[], @ipv4=@tcp={{0x6, 0x4, 0x0, 0x0, 0x3f, 0x0, 0x0, 0x0, 0x84, 0x0, @empty=0x3fffffff, @local}, {{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x5, 0xb, 0x0, 0xfe, 0x0, 0x13, {[@window={0x9, 0xfffffffffffffec4}, @timestamp={0x5, 0x2, 0xfffd, 0x88000}, @generic={0x0, 0x2, "d58838068b91"}]}}}}}}, 0x4e) (async) socket$nl_xfrm(0x10, 0x3, 0x6) (async) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x8) (async) sendmsg$nl_xfrm(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000004c0)=ANY=[@ANYBLOB="3c01000019000100000000000000000000000000000000000000000000000000ac1414bb0000000000000000000000000000fffd000000000a00000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000000000000fdffc591ffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffffffffffff000000000000000000000000000000000000000000000000000000000000000000000000b86b6e00000000000000000084000500ac0714aa000000000000000000000000000000002b00000000000000ffffffff00000000000000000000000000000000000000000000000000000000000000007f000001000000000000000000000000000000006c00000000000000ac1414aa0000000000000000000a0000004000"/244], 0x13c}, 0x1, 0x0, 0x0, 0x9}, 0x4040000) (async) socket$inet_udp(0x2, 0x2, 0x0) (async) setsockopt$inet_buf(r3, 0x0, 0x8008000000010, &(0x7f0000005e40)="17000000020001000003d68c5ee17688a2003208020300ecff3f0200000300000a000000009afc5ad9485bbb6a880000d6c8db0000dba67e060180000a0000f10607bdff59100ac45761407a681f009cee4a5acb3da400001fb700674f19b44e09f9315033bf79ac2dff060115003901000000000000ea000000000000000009ffff02dfccebf6ba0008400200000000e90554062a80e605007f71174aa951f3c63e5c83f1ba2112ce68bf17a6e000"/184, 0xb8) (async) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000001c0)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="1800000000000000e5460e17b401000000000000000085000000470000009500000000000000"], &(0x7f0000000140)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xe}, 0x91) (async) 1.998672558s ago: executing program 3 (id=6014): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETTABLE(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000e80)={&(0x7f0000000080)=ANY=[], 0x14}, 0x1, 0x0, 0x0, 0x48040040}, 0x44044) 1.855490839s ago: executing program 2 (id=6015): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$IEEE802154_LLSEC_SETPARAMS(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x24, r1, 0x400, 0x70bd27, 0x25dfdbff, {}, [@IEEE802154_ATTR_SHORT_ADDR={0x6, 0x4, 0xaaa1}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x4000000}, 0x800) r2 = syz_genetlink_get_family_id$net_dm(&(0x7f0000000180), r0) sendmsg$NET_DM_CMD_START(r0, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x14, r2, 0x2, 0x70bd2d, 0x25dfdbfd, {}, ["", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x40005}, 0x4048810) r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000280)='blkio.bfq.io_service_time_recursive\x00', 0x0, 0x0) r4 = syz_genetlink_get_family_id$batadv(&(0x7f0000000300), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_BLA_CLAIM(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x34, r4, 0x100, 0x70bd2a, 0x25dfdbfd, {}, [@BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5, 0x29, 0x1}]}, 0x34}, 0x1, 0x0, 0x0, 0x8890}, 0x800) r5 = syz_genetlink_get_family_id$nfc(&(0x7f0000000440), r0) ioctl$IOCTL_GET_NCIDEV_IDX(r3, 0x0, &(0x7f0000000480)=0x0) sendmsg$NFC_CMD_VENDOR(r0, &(0x7f00000015c0)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000001580)={&(0x7f00000004c0)={0x1084, r5, 0x100, 0x70bd2c, 0x25dfdbfb, {}, [@NFC_ATTR_VENDOR_DATA={0x1004, 0x1f, "962537c281e1db8e9321406554c44d52ae58332b78d3f46769fa656980c6abe8b69a0d789c2e0894a2e7cbe41d64ba45b882257fb98c1be7fb467690164812a12b628eea35de2ff1095ec7f3f3b88cded28a68bc1daeef63c4b3368c878b168dd4c797b1e72ba9f4420d8af77f13f72a8744603d84d2ca02fcfbe50e80f3efcf673870ea4e39302066545180e47966da401b344635f6699fdb04fac8865f1d5e1f632ed42cf8342560c0a7ffef18c8d2bbc81e416d9f9c08b1245d009ac8977308bbdab2d3fe33cf51549aad86eb03ddb25571ce5c6e53957c449571255b1829d364495c3342cc3ef0383f8531cb0842da103dbfe6d40af8ca910ab6a34d4494d0dd745e2f1467929fe038db984350c698ee1d426754970c42a9c65d59bf71f654f077767b5e16a1685847ff799354a3397690dd6f4756c1bee99c423f0de1ec590526aaced7cf10da57b133ed98e2cac65b5e33d1cb156cb093f7bc98533f8820c04ed5822b3358ed34d70eb2c41cb2a5f1d27e04981ed3b02560f96230bb44c3292453acb4bd2d2d84c74cca80f24f2c1ecef97097542e505c728f494a9f6ada4ff37dd970bbe89fda38d96ae3ba913be542205276fde322257912fcdfb15c08fbb7018c5cdaeca60cef6195218a1e0720f2451c6a7c3b34779c263e14f16c3afb4edfac7d843b457871fc565c9bc89936b36750fba3147bdc4f34c97fce4d75b42f118edcea781099555f93b351bbde3eb43cc5afdd99c381b19970ac4f21c5796f4568d73e20e2fd96d2c304fc9c90023c78938c39c01e162e29d5aa13b582741b5368e4220826576a655ffc34cdc01fe1f91be08472aef9425f435af578f0fd1ddf15ac5aa98ef0f84b81e6a5eee054ecc6a877929c52539e57d55eacd24cb3696eac0d2cc1bb7b097e5d1d7674c7e9a8dde0c79bb873a414dd94dc211db1ba0803d8a0895e8d174f6647d62872f4430b112cc9d47f9cd666bf6481708e58d3962a4cfb6a3ff1ad1cf825f30938a168393cd4565fd7e78c1a705585f1f156770b417f4c8ae39085f8809fa5ee32876e4283d6151c5f404041f85b73bbba2cc80be060852004d522dc3e4d92518a1594f69db02ae59b9d6e99ef282b275977b8f1873bf87f2eed5e2f3885748a01763747cbb4bb6dba64786fbc2edc2dd001d95f70ba60ca2af85d9c5ff5ddeceec6bf34012873dced9a310e0eb3a49105aa347d110d83732352e6d5daa293208d670e408533adb89c52544e520bf2dcfade57ca6724bf18fbf5995218eb2902e548dc91d9b602ceebab57be498b3f0acf79ee9377b5afd7760f25d7017677a7e7790fedd9cfed0c39f184d4e7b9875e493343188e3c5f21c1b473e519838033167f2a519ac26acf1b6552a77f29e138cd61c5bce5f092848c5baed8e5f047d41d0f24707bd8d47bda3f021442cb3f10c9817bec1bf491febc397919abdb1505f79f6fe85d565d6943294e34d81efeee5a86cd9683fa8b178ba88ccf2f11b2492f796afd0df2b733b3a68a856d4d76e1c4fdc516f44938f7b233d674c518c9a4c607b441b06b5e744607479265dfc32a62a2f5d1c2de12ecec86ef91a1c1055f6f435e7142c1eb1c36a504804687f2b4e607d653a85c72cd9b9ae9271156088f6dfd1bcf5ef35e7f371224c327c2ffde845a6330fabdd80af54215bd1e46bf0ccaee5be7af573922866f51841a5c6bef98e596ef03862a969b2aead055ce5e753e9d1f09c105cffc741453cbba77305280c9e999fea7ee2c8a976ed0059da056ffb60aa29cad8c4af730708c6cc2126586d71828491b613209f28e695c18f4b2040c8d8c19e4c8119a93a0387e2d4ba45dca35993458c19c5af146475acc28368fc3bf096ada5963fe18c3fd24b402a3a0a684ab7d5a7c9bc4399e0b24133ca868333f49ed0a669838f374cecf39d383d18e1294a1358c634a69e386dff8304e3ff6999282edc3ad895a20dfb9cde95ed62735e6ac3b40190a94d43c05ba11f42b1d4ea10764ca2d311309a555ed83d890465c8b8abebe887794ae83b805aeeda4448e65586d9ac5a526502371c2d7c5b7ff6c6cf532ca5c746c452c27ae7cf957a6261c23b03ec7e9ef783cdc47ab58549667872e801ecaf10e676bb7e479159b5d5bc24f0076d9d7e255b85c44a770d0ed4a81584c84025a1c087202e36afade95c5f2f836289b248dc67622e4763de647251bc879068ac60e78b9bcfe606124871cd05b9f27dc01ac98c6713c05f598557fa5fafc5ee6bfadf0a9ee6c891fb3c517008451d657dac64ee0d66423052ae41f5a3d7e0822d1b10d20a9e53eca2340766feafe9ed08c989ebca5dde68bd50c8d1c8c0e044f56162a4ff06b1718d8402543d8646ff3bf9519418a7c9bd6f1f13443eb405c7c600888cfbe1f9249df44870cf7e933048fbe2714637c2f11909a1651436b59874b94b8f2e5762246091571af2de14f000179ed8bb41a6363012ef9cf79957eda61d3168992e4d718556f66c67b8dff55dc15d28f2db6c2fd70fe8e557f280b6b1ceca074fe1c51725f2bd5f9d8916e0a72aca123ce6ed302df7485c97822cdc3c50e5e1c448159b5da0551e72098757a9e19da3331ed51e12b0d211b784acbb173707d9d63129204aba2f81c52864756172f395c6b00d10ff7cbee601ce584df496830abf9cb172812b771393f0590a3b572ea8b4df58a9c9558d9abc7ab9af9c1d3e0f889cd14764e9516f7f6e671036719144f04f20fb7bf5deca39d54ff332d5ea03e54c6250409313a214d51d89470d5d6580991a363d8f2d92942844c7d6e7345060c94cb6f07292d983e0719e3e16b7471bfced5f96e3efc1dea6efa5a95d6b6f246c60e8e814fd0013343c2b0ed6a786c7716bd675eb2fbf085391576ea8b998b95dca36742fe64e7c21aedb0926c0f1136d5e10971cb98cb2ca3eee377b7d9c8d14b682ba80590a879b7e9b7b33d4b3a64f0daae4b428d80673f62668806849217aa02ec3f87d0701bee23a394c929dae20b8262f2f5245068d789a2731fa13c40d6faafa5bdbde6974481a86d10de528f7008fd7037d339b2459056b22e2ca789ae57ae23b229354bef889ca55a9952348ec2adcbcd3a10f454cc31b157c302bb8d12c27dd75d70f474abdafa7b3f77a378cb4fe8298b77a05673aa467df6803e485cc6a44f61c427e154d9160c30eae4f31fa07c9546b9a743566ff90cbb64ddd6e7ad3a9481d4825a61baefaf17406fe29c007fb593bb4190c023b8763a368c09609dace6bff2dab93ea535119ffc07c4ed33015850a8521ca139454a5ff588591cea1fe27ac5ac7ca4f05d64438de334ae6959a2d4093ef8914a8acac7de1e3b08301eb209080d67943f7c5b96b248d9a873ebcddc5098275a408f343d27f6347de18ec8effde1d7e2fc4e144370aa13d8da242a863608650846b6cb2d23d4e826e303c11ef3d127c02f708c615d94db9083bc44cea17f16a1fc0c23f8fc64c7936e50c4ea8d973caae360eab42f028c9c098d6b377a567853f5422a273842baa0dd075962ca7d31f9291c31094475c8e4f21f7dfb2970c2da16acf704b9b8f8696d35938c3ca01947bd890d5bbf57ed8ea70b26371f28828d8f1890ed6c0694e6a531bad7e00c1a2530f88fce43c82f6d388f850f01772637ac197b18ac90d334f55d2ef18faf6bff82a5b9bc1fc35e528a291b006534a7d639c613578953f1c32fb929a4084c00a87fb503363ef4dca367e219a28e4123de7fca15e62b8eec41ea724fb49f6a86d7ecad9f4674fdd83defac26931ca0d0ba5ab327dd14bb133e81e0b4d2ffedf11cbc8401059113ae97722590428633348e4935f51e780797c7cf0a8cb5e98fa2b935c535fdda07e62986647414526521de1d030227f405fd3c41c64b51cfbfd721c006217db6a94bb81015da9314100d88ab5849d893f3cc7707a548b34618f85e8070454939487aa6353b70a481916c4af8154d0f164c69af0b7e69962c93d45c880b580791e5d2e4cfcebd31783680c46caeee0f0d8b25f51188f04937e2cb004db84a66fc9faf74b18aa3e898d305dbf88f611e99f6ab0b8c1fabef83c09561c6e9de54c66bf0f243e54ce4e5990d2461f6ef3ac24855794f4da10c7d4780c914916a12edf07c1f4342c2f706bb0bc01d370c94cfcd1ac35cd227ec409845c017bef7b5c0496a7c9824b5be10f87f3ba7864bdf24cd1bdeb5242e9950eec8740aa4cca76752b00ab29ce7dc4e10eae3496a035df40e85c7b74e5371f629471d2c324672d208ded8606c4d815934c81ed78c3345529fcf2ebbd234ce653cd03cf838b9a66d6e834f334c73ea325db9f46ba36842ad00dce9f6f925fe3bbd3c50abe3c97c12a3e9733d77b6e3eca5e7ca9eb332914a4c85b0eb293188afa930aae19db73284d56f18148f831ab9f9bce1ac45bd031ef5081daa4417e088b21ac36506ea207586845217b356ca18054d257a56d74b5a5b529523fdbd2df0ffbe3d1cf0c53202f2b68d08d45da383a47e2ce390a916a2c125727d723451a672ba8e66d7f32b582d20a5ec77d28d20e76f7f862b168009b20c9a35c1c8be0b11a0fef1aabd8ad4007083c1cfc7bddb73cd473e1f8af83653949a7c02518646d4e8d690e8b0775bcc4b7474dee26f12c6e4a1d154105b2ee54760b8153e4c6e4a5084a2d991c458003641544c15bb019aca1972ee5732ae0436535ac0025d79d516efbaa0a14349932a624d6a0d78635c9c5a53ad0abe8110df2a3a88c885a2c4c6a7d0c030e83a960496c5c6bd4698bd32dc022a764b26514c77bd5d42c932b2573d52f18ef64c999b3e591ae89872f5fc13d8b216016ddf3690d08049825eed61d630d35e68302d3f2164e02f356371c42aec0bffd2bd28e7c816f91e94864fa4cce52df6a6b55235d6fc205acd24ac4db31dc7f58d220339adc49766564db6493568647fdcecf9a4508082a5ae57183601f4e0e480d2297abfd063db44045b3de1d8a93278e8b373d7dd3ffa57425195060d9c7d7f457590a7469cca22085786fc60c80ad0a59961df846ed44f45ee86f70aeeb9b69274dfeb6583e565a9c90ed5bd3f95bf855e0fe8f0419c506e64b86059bdfe9651cf5be2b1a0dc04a2ab7ac98d9a20dcc760e84096870921b96ae29d33040583870ac5c068fa94228269fa2b15bcd0e3b9a9a180c431477526eba6c2e0bb333bf7288292387e192456af45a7f6a22e29a5565273078664362745b700896264a9b4b5de2b4a9568dedf941ba5c8a43e84a72d40fc579913d88d43315011a230159bbe70df1a1401e37f3f6fb3b908e76b14a65550601b627f5b9bdbc38c3fb0da373e8fc84d3daf96ad165652f2ba13e77288b782942e075fe88387207282bfd4390d25f0491190a1cafcdffbdd01c8d5ad651a7c1f1929ea0977d60d2777481383b23397a04c2cdf61e5ec77a2c7788eb702f7a1ba2c41c0d876114df44737cc1219f88ceb41c8e325573a48490a3559639d44d0c09310efca864d4b1d9df64ec10ec0a155d5d4786c0aef8577c5c95e84bd4b1a0d7db596bd4d826d196def7ee8effcfb40c68ec14a3ddb616382fe7dcf218bcffc46f77c81f20999550061b03985818cfbcf0b07faeeec88c1ba4b9f3fb94ba3f107dc019c12701dd03eef64d6f4a4fe599a63458ae5808341a0987dae37fdc9fa03ad73d87c524865d00a544a4a3726d1aa9ec06cbd710b97eaa7e007775ff3a97c7313087241425ef28cd00f5950cd7cb3c28dae8c506c4d692875276fe32111a4"}, @NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r6}, @NFC_ATTR_VENDOR_ID={0x8, 0x1d, 0x8000}, @NFC_ATTR_VENDOR_DATA={0x5c, 0x1f, "87484bb731c2c8059670461c1558eaf627c01f7f85f0d6cbe5990a34ba5d48e4c6897acff3448a6c8bb518465183ae13286e9be723ed440f29251966f302f973317c5bd264a9b19ef3e25e5fcb2240acaf2c74ddf7d8ec3d"}]}, 0x1084}, 0x1, 0x0, 0x0, 0x40000}, 0x4) bind$x25(r3, &(0x7f0000001600), 0x12) sendmsg$NL80211_CMD_LEAVE_MESH(r3, &(0x7f0000001700)={&(0x7f0000001640)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000016c0)={&(0x7f0000001680)={0x14, 0x0, 0x400, 0x70bd2c, 0x25dfdbfe, {{}, {@void, @void}}, ["", "", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x40040}, 0x4040000) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$ethtool(&(0x7f0000001780), r3) sendmsg$ETHTOOL_MSG_WOL_GET(r7, &(0x7f0000001840)={&(0x7f0000001740)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000001800)={&(0x7f00000017c0)={0x3c, r8, 0x8, 0x70bd29, 0x25dfdbfc, {}, [@HEADER={0x28, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'nr0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8}]}]}, 0x3c}, 0x1, 0x0, 0x0, 0x8000}, 0x8004) syz_genetlink_get_family_id$mptcp(&(0x7f0000001880), r3) ioctl$SIOCSIFHWADDR(r3, 0x8924, &(0x7f00000018c0)={'hsr0\x00', @broadcast}) getsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f0000001900)={0x0, @in={{0x2, 0x4e23, @empty}}, 0x0, 0x3, 0x2, 0x80000001, 0x0, 0x3, 0x40}, &(0x7f00000019c0)=0x9c) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffffff, 0x84, 0x6c, &(0x7f0000001a00)={r9}, &(0x7f0000001a40)=0x8) ioctl$BTRFS_IOC_SNAP_DESTROY(r3, 0x5000940f, &(0x7f0000001a80)={{r7}, "e28993b26513f8651740e848d6024d28a34eaf43cad5163550631e02a7fb2dfb30614902e38660db4706313a10fe88edc855071e983671898487ad2425028803d29099cd64dce51adc9249cc273c7f14243d300bb89aa4e51a108334942c236810c687dec711d47cb712780ed898751df2c984e9140e17123d5cd1517891481850ced4d58bc1021ee735c32c0937766520930bfa4f25d0d12e5b0f3e4803fac47eab4ea9c70ff4f5b1a82faec8ce8a6f311b685086980f66a3235a01a2c5acc22414d3451301e552d15ad53462b1f7253aa7bd7a15b27bb3ce2db0051e3dfd0272f7b09145bb875c6541b16dfc8c3fd6b56e70a0c5d9b8a3b1c3eaef26745556fb443dbf007daeb940133946f28b44d790962719dcc47e8fa29d1a896b8010c59d0c7d5053540747ddb1a293dd37a15ec566aa5d29e6a97eff90f1c534c0aa25ab06013dff5e3c95477ff5a9b782996ea57d19ab28b7830832e779e6435c3acf6acda4c096096a84c17c1f01b2585fbcb70ffc9a65260792472117224d7b29a45466c4faeedf20932976daf3d20404e508a1c09db2345c5109c1d02e9bc40be61a788917f0a8ef7307f9c7c63a42309f3bb994ab302b1709abedf2dd4affae74de95c0ffc645282cc44e48b73d9314c77db2a5104f9a0038bd761cc1f3960fc22b9e859c2ed087eccce6b694805dcbd2863625b5518110e7a74d7f06297879d0d27a3ef169daf92eea8bf714b3c5aa251a1732253e5e4c0f1b43f98f6bb41c3af618c97b35c4706b93f990e3a9751a1b38523b3cb2ad1c13dae994df8689e8d35f8ce1eaedd2dcd53579d93d0a68f5d64e6515ba79db132f42c734ae448a987bf8392f7fbe201d9b491b2f50e89184dd1d1a106f95ad3ebbe8e07ec7fddf53901d0011df20c5014e98795c2721d569f2f95c845c316068a51bd79a00f65b08d775a16e2479984f39e3528ef86b1ad830234a8342b1958d09848b2e5bf25eaa4165c2975bbd05a7ce1b23fbcb75bf1ca13e637fd40ddd586588969fc14886ac6496518731d151b9e76d81a226f96afb30553698d5c2ffa2b647dc24fe977b224a7ed5e0edc54677c290d7fb47d4b4e7abec3acac48a78409d51458d9ada6087cf3aed5c452623b01e6af0785c4163d956e1b392de2db1773f9944feaf21a6788c13e8e381f8390a82558c57916cc65f9e41d02ca7c3a6768e991f6800b160bef11a8b251537279453427c0d273a8862291220530b433cb0bf3964a49ad0f95622e99b6a64c49cf41c6c8b745cfe9f3e19f7c85e3bc6ca4301df893f91e8cbfb14f8fb9983bb6ef5b024118052828fc9ad548e4c96dcfda081205c39d154a5e943fdc80a1a4b1c1a4f85a48de0b3521a6250625dfc81c497eff0334549479f647107025d6db42e7181dc628a72c64d6bb50656ef3a652da2c2a93eb03eea045116a8df4d897db173aab00fa25f40c81b5d0312801118dd4f23af82b445478329c641ac3a910ab2a405eb9afcca2dee280581e0fdace0275c6e9486b26cf2502505f46750c1afb49d44254fd87f0ded78fec3389e35030821b1cfd4938109e69732187fc19582bdd4611a91341cc55c85d8084cb063748437af973c0b79dc56c25941db9b88d0b3a843b9c9484d10ea148e7425d81d11e1b0cf06016afbe5e6729da5d8b24b0da39f787ab9c749f9dda1497a0eb5135ece9d387859c0c4dd1b0bc1e7840d0bb7f998ea9c50ac2262d983075d0e37a0c78ad7022f046b8ac007e3386362417ec283132f684d5b671eb0915dcd8b5f8fcd1dd38d58766380cdce25e057747b69d2b466861537371b58c33474602c22ff1f0bbbf735de6a94bdeb0981209b6e3d16c0ab6b46ab4e2a0564246729c080476f62182d9c8b5b4450da53bf560911cffd990ecaef37acabd7ee817b3b8d3c12c0526be520494e70fb3038f7d3a326647b7acab188ca1c6735f092836ce3444b0ec25b26a6a72b0e7c4d2bc0c66592d78724a3a1a00f994ddcb5ada40cd4bac83948f24187b77969f38877277758a6d0571b63055c5e92d7c24585b46dd28076f284323998e2b978aab7cfbcd59f23ed3af321e0b48681fb4d3f441de23a90514868b9d24e41ea7d1bb8fb6da2c772fc3cbca7438da4606929fe20da00c19e08480685f2b9a7de43321ac58a59670f1afdc3cdf79ed9c9e510977c7a6fa30b5866733686e24e088cc04206323c6b466d1c395a419bc2be1ee7d84d5ae37e98f001adaf9c9e8cf495c969d52c69862e3475e0e3f49026fe2292bc8f5916464377fca05cb7089f7597af2804295a8917b9c433fc1bf4c2a88f39168e3c0a53b43f41cb9d7a343d0f63eb5eb7d330a7744efeb2c847c0a27259fda552ada0c41172fee3933827527c8b9d01bba10b5d95697dd78c1891603686576c863a60168da9d878cd32daefe09bbe59779d342e680234c6e54ccacdff7fd53090d8088603977271a2b91dc0ff5d520f9985f97dc36005f0ab729b978efb682f4770927ae584dded8bad45f89f46509c9cc6b3b30dababe87f00ab80f1d721d4643f980f7a6ee99afb46515f9da6011c5963fe7dafc352ff5dd3d68f706b6644496341740b0df8f33c8a45064d7f25ca10b1bd25fc5a7414dd17e9faf413465bc6a3b8c915fc51496e3c6bf3a7cbf0b79ce6cd91af152b632671ee40bacd5ae49d65567c8936c57f2b32f95f57667a4297afd77890cbffed36e425826714c710c6e093b0eee3b017e064d21ce7c2335164a9b6b2930f0c0cad826fd4fe537a1e7df62f476f56bbe8bdac61dfd031b68f635ade867a0924a32a55fdf657158c50dde480787a76c58fed8bf3f6db7bcd01f0563d9b5d8abc161242c8b60ddb13ffb3a659b345fda8f832332a15008184df57bec8394b3ca041f2e80cd7d0618cd5500998332aff30dd2117e265f89b8ff09039dfbcfcb4610b7bafccd25aebe645393b9e8ecef72b0cd1ac14c10c8b2462b1ec2bb47048c99f37c92fa670777e46a411725b2d4461f90796bec83d262d0be51f0ac7e313bf1f400c1535d9b8636c310b8ad9ea158862ea08bff7cc7b106016d9d09ceaa56f20c0c7f5b87e3e3ec89d7a2d6f699278ae8ad5711918317d9d3c3067c1e564c3940c708bd03e797ec3aa7aeff92990af68c4b622e56bad7c7f48d87f4601338ab803b26f0a6e094844cb6ead93c6bcd4c21d5e930d5a437443230d8bf4c679298ed6ad2d664fd92120ae911a4f0e5b6e4f4e3a954441aaddcea0be03ef1dc2d53410c393619b58ed0b19b7d456e224b46d74ccd7ec738ebb0473843800355ec6152aebe4e2e5cecb1fc899c0e2546f2603c4986fcb2facfa7fcb33b862eed3e8d67e6d43a2bd74bb6bd2436710384e35554d7cc2ceedc0141a0c57c47f07d92ce0f9b316b09f5efa914b7e2e8435cdaebb65926cb3dbdad4bcd03089399c3c15e635c198306232bf59c4584ddca9e298abaa06ce4238a3094f795a9f29cadda655c674cf652c5e8c4440f5f97dbe37ad31d17764329c2f311ba9780c9e0f55f3d5d9b3f7ddb3c59219e49e54087cc6b3b6eafd12c671e94cdff3a2e73e5ec5a90aa642e1fb2122533b24b7be7ad7779009f2a9ca1428832a85c96443ae5e1a681cd2be0e9398bcc95bc4d0067346d8ab93e172a2649352e75165f73e4f5f07c7dec371c32f02ffdf98e8f3fdb276fbeeb3a11ee1c05eb2cfbb7606341d6d108639468d4e7da742abae2624e6fe5f97cc1a09a98244244154122a9b7cb24cd88f283e5a54933079966424a48bee7f37b64df8dc190f4b2f4f8bcb2a3a2b3896d9296b3164c69fc2200ef86ebe5731c748e6934a83a5bb87947146ef0cbe247382d075daad3ebab6e9ae60ecb6cd6e2bd7aeec843c0c8c5a6a72644abcdd907e57ee3ee7ad3deaff9b63273451f6b498b7ddde99aac358c326a9f2b53b3faeece6747ddfb59005afb1ea59211150d0d77433df175cf92d9fbf906b8c79a4de9b0c9c7a7e7a088ea746d500b95e6d3e0e822dd3f4a37941143b1233441607a7d190af45507c116ddb97b2bf128b040b34c9e53d567e1d72774302a574e8c32ca089c560ce84319a7fd27e4d91564279db60d474dcd1902785104c6d291403c135ccdcdd9c0a1e9d114d6ecafff15fd6014503f51646c721eb7d09e95da4c14d454de039ddbefedd164f17248b0c8e9b5f9a9dc1dbfd93739a42eb41b1d0ad2b199dc754d7ed401a77f267b4adff440c5ac9d04c38a89affced1f505256cbda69a0bd0610235db6b86ebb5f093cef1aa3e39bd80ab9b8818bebc6b93b06eed32c97fed9f76c90df6181dea014092e5224797917a4c22ee330ffe2b45f94adb2e772c3aa7ae7d8958bae4ff85640937db8bcddd14deb01637bfc3f04d0c586ec232e35be0cad1573fd42d20b1884d93cd5a877bac5717edfababa8a55a751e9cab53e70271e52a03fc5b268b963efc03bbca97c6f2be3acb4c4049ce39040b45de2f73393826f6a4cf1e0d51c749c5adc6cc8ad4e80009e708463b266084e51679ee00975b84549c7018366fde6101bbc3cf8eefe1b9d1cb1add2c61e59a8799f2199e02a1058a5d51e48681028b03045f733a770d71c11826e891c0231604c1d9b82072aa1cbd8149532f69a9114ebf55de803ad7a11800bba11b7df2abf07888368a5efe4713a4b38ccb5da52079fb57ab01238221b84948b8963da0dfeb758a4170d6b278adca41dbd5e17fbc7b806052519bfe3bb09e3c32c494a41419ab5337a0cc4c11c9a16d322ea249f030c067a0fc1f48b8e2a1a667d1fd6ecc7fb7fb3ce055a62e71d9daba414ab67f721c03ee81e8884187f40fe561df43207cd5c475924fae9337154fb9a045541fd7ec2df0fcb2737fcb17e88031319337b442c6d1c0dfecb916e7a073723c5f10d5a8530831d5ff3d5b7c00a0329dbe5aa3cbc450159bc824c389b842b2057749c2255fff60dbdfca0802ae66bb691242b716511d411447bf5b923cfdc541bf491374d639f771d7068edc4919f1c533f526130423e22e06b78ef975ad23642ecb85a6722212980ec77e4d48d230e66aa0033b9534205e9256235fb87f33e11d9520a112275644514c18aaa7613c38383b96e5312d5861bf4bf2790cf781cdc1833ecd9eff0fab75f4a3458d33fb59a938d36d68568af38be99844337507f6068d1ea42174549517c501b2c9cd6ea0ef6432598ed7890cd050d713925fedb82fd6ae35929256d02aaff6b3017ebe811adb0c0b0a63bf095f98e3c85aba8b49b67c6499eb3e8c86515b98b2934928cca16dad70fc4a0ab3cb294147d7273bd8ccaa5e6f865c27084a02f01fca0200eb09729f9044d3289902d66ec710abb872a2e7f08de2ebf23924519663d8682425c6a46f8d52d6c142f63b92fee47f89c03635b0e9e29303d3d7e88299c6a20f18feb66587c00034c39d8924d031cf6333617db452bedfab2dc0536e5a485a4f67071256fa694299f0511edd520dd6cad54986eaecb3c1583002d74cbe2a28658479b20bc704194dfde299a966c25881908a23342b18798a0d153422e10cc9b2a8c5e1f298f5a24b070dc59f538e9faeee5d6af4a2abd063774890ef134656e481dc4981f17d336ea2f1e45163e5301108715bab73bc067307c2324a8a202cb7ea1636245fd6db9432b4d335637ce493ef3c1379a15f8e3282f5531d513d49067f09498012e5189bd5ab81284fc97a57650ae16ecd814185ac18cdee575751ed5bba672ab75fa3bbdee23b3936e74a947336ac4cc29584bcb0705"}) sendmsg$NFC_CMD_ENABLE_SE(r0, &(0x7f0000002b40)={&(0x7f0000002a80)={0x10, 0x0, 0x0, 0x8417b0ae046cd88a}, 0xc, &(0x7f0000002b00)={&(0x7f0000002ac0)={0x2c, r5, 0x10, 0x70bd29, 0x25dfdbfd, {}, [@NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r6}, @NFC_ATTR_SE_INDEX={0x8, 0x15, 0xc0}, @NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r6}]}, 0x2c}, 0x1, 0x0, 0x0, 0x48008}, 0x4008050) sendmsg$NFC_CMD_DEP_LINK_DOWN(r0, &(0x7f0000002c80)={&(0x7f0000002b80)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000002c40)={&(0x7f0000002bc0)={0x44, r5, 0x200, 0x70bd2b, 0x25dfdbfe, {}, [@NFC_ATTR_TARGET_INDEX={0x8}, @NFC_ATTR_TARGET_INDEX={0x8, 0x4, 0x4}, @NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r6}, @NFC_ATTR_TARGET_INDEX={0x8}, @NFC_ATTR_TARGET_INDEX={0x8, 0x4, 0x1}, @NFC_ATTR_TARGET_INDEX={0x8}]}, 0x44}, 0x1, 0x0, 0x0, 0x8000}, 0x0) sendto$packet(r3, &(0x7f0000002cc0)="8df08bb3c4ced63b", 0x8, 0x20000080, &(0x7f0000002d00)={0x11, 0x1, 0x0, 0x1, 0x10}, 0x14) r10 = syz_init_net_socket$x25(0x9, 0x5, 0x0) r11 = socket$inet_sctp(0x2, 0x5, 0x84) getsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r11, 0x84, 0x9, &(0x7f0000002d40)={r9, @in6={{0xa, 0x4e22, 0x0, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x706}}, 0x2, 0x1ff, 0x4, 0xe812, 0xb2, 0xa, 0xe}, &(0x7f0000002e00)=0x9c) r12 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NFC_CMD_LLC_GET_PARAMS(r12, &(0x7f0000002f40)={&(0x7f0000002e40)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000002f00)={&(0x7f0000002e80)={0x44, r5, 0x100, 0x70bd28, 0x25dfdbfb, {}, [@NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r6}, @NFC_ATTR_FIRMWARE_NAME={0x9, 0x14, 'hsr0\x00'}, @NFC_ATTR_FIRMWARE_NAME={0x7, 0x14, '{$['}, @NFC_ATTR_FIRMWARE_NAME={0x4}, @NFC_ATTR_FIRMWARE_NAME={0x8, 0x14, 'm-.&'}, @NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r6}]}, 0x44}}, 0x4000000) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(r10, 0x8982, &(0x7f0000002f80)) 1.855143118s ago: executing program 3 (id=6016): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)={{0x14}, [@NFT_MSG_NEWRULE={0x90, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2, 0x0, 0xfffe}, [@NFTA_RULE_EXPRESSIONS={0x64, 0x4, 0x0, 0x1, [{0x40, 0x1, 0x0, 0x1, @connlimit={{0xe}, @val={0x2c, 0x2, 0x0, 0x1, [@NFTA_CONNLIMIT_COUNT={0x8}, @NFTA_CONNLIMIT_COUNT={0x8}, @NFTA_CONNLIMIT_FLAGS={0x8}, @NFTA_CONNLIMIT_FLAGS={0x8}, @NFTA_CONNLIMIT_FLAGS={0x8, 0x2, 0x1, 0x0, 0xffffffff}]}}}, {0x20, 0x1, 0x0, 0x1, @ct={{0x7}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_CT_KEY={0x8, 0x2, 0x1, 0x0, 0x4}, @NFTA_CT_SREG={0x8, 0x4, 0x1, 0x0, 0xf}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x5}}}, 0xb8}, 0x1, 0x0, 0x0, 0x24040840}, 0x0) 1.754446104s ago: executing program 1 (id=6017): r0 = socket$kcm(0x10, 0x2, 0x10) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000070000040900010073797a30000000009c000000090a010400000000000000000700000308000a40000000000900020073797a30000000000900010073797a3000000000080005400000000d58001280200001800e000100636f6e6e6c696d69740000000c0002800800014000000008200001800e000100636f6e6e6c696d69740000000c000280080001400000000014000180090001006cdbf80789f3f947dd000280080003"], 0xe4}, 0x1, 0x0, 0x0, 0x40004}, 0x20050840) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_RINGS_SET(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000100)={0x34, r3, 0x1, 0x0, 0x0, {}, [@ETHTOOL_A_RINGS_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'wlan1\x00'}]}, @ETHTOOL_A_RINGS_RX_MINI={0x8, 0x7, 0x1}]}, 0x34}}, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000380)={'ip6gre0\x00', &(0x7f0000000300)={'syztnl0\x00', 0x0, 0x6, 0x0, 0xfe, 0x0, 0x1, @empty, @empty, 0x20, 0x40, 0x82, 0x2}}) sendmsg$ETHTOOL_MSG_LINKINFO_SET(r1, &(0x7f0000000480)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x70, r3, 0x1, 0x70bd29, 0x25dfdbff, {}, [@ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x6}, @ETHTOOL_A_LINKINFO_TP_MDIX_CTRL={0x5, 0x5, 0xb4}, @ETHTOOL_A_LINKINFO_TP_MDIX_CTRL={0x5, 0x5, 0x4}, @ETHTOOL_A_LINKINFO_TP_MDIX_CTRL={0x5, 0x5, 0x5}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x4}, @ETHTOOL_A_LINKINFO_PORT={0x5}, @ETHTOOL_A_LINKINFO_HEADER={0x14, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r4}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}]}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0xf}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x9}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x5}]}, 0x70}}, 0x40) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0xd18c9b25, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f030041000b05d25a806c8c6394f90324fc60100000000a000200053582c137153e3704020180fc5409000c00", 0x33fe0}], 0x1}, 0x0) r5 = socket$inet_tcp(0x2, 0x1, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002a80)={0x2c, 0x2c, 0x107, 0x0, 0x25dfdbff, {0x1, 0x7c}, [@nested={0x8, 0x1, 0x0, 0x1, [@typed={0x4, 0x6}]}, @nested={0x10, 0x2, 0x0, 0x1, [@nested={0xc, 0x1, 0x0, 0x1, [@nested={0x8, 0x8e, 0x0, 0x1, [@nested={0x4, 0xe9}]}]}]}]}, 0x2c}, 0x1, 0x0, 0x0, 0x8000}, 0xc010) ioctl$sock_kcm_SIOCKCMUNATTACH(0xffffffffffffffff, 0x89e1, &(0x7f0000000100)={r5}) setsockopt$inet_tcp_TCP_CONGESTION(r5, 0x6, 0xd, &(0x7f0000000040)='highspeed', 0x9) socket$nl_netfilter(0x10, 0x3, 0xc) r7 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f00000029c0)={'ip6gre0\x00', 0x0}) r9 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000080)=@newlink={0x3c, 0x10, 0xffffffffffffffff, 0x70bd27, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, 0xec37}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @ipvlan={{0xb}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r8}]}, 0x3c}, 0x1, 0x0, 0x0, 0x1}, 0xc000802) 1.724039921s ago: executing program 2 (id=6018): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0xb, 0x7, 0x10001, 0x9, 0x1}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b70800000d0000007b8af8ff00000000bfa200000000000007"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000023c0)={0x0, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="1802000000000000076d00000000000085000000ca0000009500000000000000"], 0x0}, 0x90) r1 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0xc, &(0x7f0000000000)={0x4000004}, 0x10) write(r1, &(0x7f0000000080)="240000001a007f0214f9f4070009040802000000000000050002000008000f40fe00000e", 0x24) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000480)={&(0x7f0000000980)=ANY=[@ANYBLOB="9feb010018000000000000002400000024000000090000000000000000000083"], 0x0, 0x45, 0x0, 0x0, 0xa}, 0x20) r2 = accept4$phonet_pipe(r1, &(0x7f0000000040), &(0x7f0000000200)=0x10, 0x80800) ioctl$FS_IOC_GETFSUUID(r2, 0x80111500, &(0x7f0000000240)) r3 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000040), r4) r6 = socket$alg(0x26, 0x5, 0x0) bind$alg(r6, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(des3_ede)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r6, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r7 = accept4(r6, 0x0, 0x0, 0x0) sendmmsg$alg(r7, &(0x7f0000000400)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r7, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f00000000c0)=""/73, 0x49}], 0x1}, 0x0) r8 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r8, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r9 = socket(0x400000000010, 0x3, 0x0) r10 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r9, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r11, {0x0, 0xffff}, {0xffff, 0xffff}, {0x0, 0xf}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_FSC={0x10, 0x2, {0xa30e, 0x1, 0xfffffffa}}}}]}, 0x44}}, 0x0) sendmsg$nl_route_sched(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000000c0)=@newtfilter={0x3c, 0x2c, 0xd3f, 0x70bd24, 0x25dfdbfc, {0x0, 0x0, 0x0, r11, {0xfff3, 0xffe0}, {}, {0x5, 0x8}}, [@filter_kind_options=@f_basic={{0xa}, {0xc, 0x2, [@TCA_BASIC_CLASSID={0x8, 0x1, {0x0, 0xffff}}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x8848}, 0x4000010) r12 = socket(0x10, 0x3, 0x0) sendmmsg(r12, &(0x7f0000000000), 0x4000000000001f2, 0xfff0) sendmsg$NLBL_CIPSOV4_C_ADD(r4, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000b40)={0x48, r5, 0x1, 0x3, 0x25dfdbfd, {}, [@NLBL_CIPSOV4_A_MTYPE={0x8, 0x2, 0x2}, @NLBL_CIPSOV4_A_TAGLST={0x24, 0x4, 0x0, 0x1, [{0x5, 0x3, 0x2}, {0x5}, {0x5, 0x3, 0x2}, {0x5, 0x3, 0x7}]}, @NLBL_CIPSOV4_A_DOI={0x8, 0x1, 0xffffffffffffffff}]}, 0x48}, 0x1, 0x0, 0x0, 0x8000}, 0x0) sendmsg$netlink(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000005d00)={0x114, 0x3b, 0x1, 0x0, 0x25dfdbfb, "", [@nested={0x102, 0x117, 0x0, 0x1, [@typed={0xc, 0x16, 0x0, 0x0, @u64=0xfac06}, @typed={0x14, 0x1, 0x0, 0x0, @ipv6=@ipv4={'\x00', '\xff\xff', @empty}}, @generic="50bb2d6f67d29d6fabadb107d0def49c88ea04abde1d5e8d3fb22a1b5046778bdafefc46b0449ade68bf84b36ec72dd71265fc2e882348c26c2126237dd5b37f5ae655b1086cda40e00aec58754734be31d750351dc076eb43d9621dc08c029d1608a46cf26fbe816b89f7cb81bff81a8b9482565856555ee923c65973deb0a99b962bc0fe94a3fcae3697bd7b85b3a682167c43dbf137115a40ebddcad74875ec58e9a3ddb9ad02a078cf0d972df9e99f079767734f69ce475f00ac64337803f5eb4e5842f4d98fe3fa370d47eb640dc5061dc35817c8a66c29", @typed={0x4, 0xeb}]}]}, 0x114}], 0x1, 0x0, 0x0, 0x1}, 0x0) 1.62763672s ago: executing program 3 (id=6019): socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r0, 0x8923, &(0x7f0000000080)={'virt_wifi0\x00', @broadcast}) pwrite64(r0, &(0x7f00000000c0)="adcfe13fa0960239979c942267544b39ef4073f613e445a810d0458848543b5e12bc3170798ef7becd72ec1064188e89cc4a579a8ba9a3d9170931a8ed8a346ac691b822bdaef3bc3c6aecb5a793df4e", 0x50, 0x9) 1.304640736s ago: executing program 4 (id=6020): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0xd, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x1, 0x0, 0x3, 0x2, 0x1, 0x74}]}, 0x0, 0x4}, 0x94) (async) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="3400000010000305000000000007000000000000", @ANYRES32=0x0, @ANYBLOB="0000000006100000140012800b000100627269646765000004fa0180"], 0x34}, 0x1, 0x0, 0x0, 0x800}, 0x440b0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) (async) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0xd, 0x5, &(0x7f0000000700)=ANY=[@ANYBLOB="260a00000000000061117c00000000001800000000000000000000000000000095"], &(0x7f0000000000)='GPL\x00'}, 0x90) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000002c0)={'macvlan0\x00', 0x0}) (async) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000010c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="440000001000010400"/20, @ANYRES32=r1, @ANYBLOB="00001700000000001c0037"], 0x44}, 0x1, 0x0, 0x0, 0x50}, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8b18, &(0x7f0000000000)={'wlan0\x00'}) 1.239547593s ago: executing program 3 (id=6021): r0 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) r1 = socket$rxrpc(0x21, 0x2, 0xa) setsockopt$RXRPC_UPGRADEABLE_SERVICE(r1, 0x110, 0x5, 0x0, 0x0) sendmsg$netlink(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000540)={0x318, 0x2e, 0x1, 0x3, 0x25dfdbfc, "", [@nested={0x305, 0x10f3, 0x0, 0x1, [@nested={0xc, 0xe5, 0x0, 0x1, [@typed={0x8, 0xda, 0x0, 0x0, @pid}]}, @nested={0x15d, 0x7f, 0x0, 0x1, [@generic="cc39cb9db042474549524889905886009171313736215baae9fdfd00355318c9977e4535d6b232b37dc0067392db2608b279505c77b74983531f58fce686effe61b609487abb81bc75d4e67ca3e055d72cb435ab6f1639ffd15c57dfcf7a0a6386e7afb30e5a0ce79b72d75913", @generic="f80bec69229f826d13775d03b15cc5d9882718098ed0675d1935b77f14e53e774732635edbf74182997ee5", @generic="8a1413e08e03a3389678ab2957a52405dabfa582c12516d13e7b20e21bec94abd3cc16f391bb36c846adb1a2dde9e7c38240b38b72f3f4f667a4f434dde0b0aeb0a2f56f7fd8eba140f139432ea7537f6f3f749d8dfca2af8f34aebbe449c0fda2131ad1c773103d88ebb282185baceaa3003f43f6993418a06f3f7a0a4a7342638a92486ebfdd5f632e95a74f510d67c3ea24374ce3676f13e058fe6d39426ccf2a0bf4c7e7ebab5b43d4756cbc7775fed402e1e066532afc62323a1bacacdf62"]}, @generic="50bb2d6f67d29d6fabadb107d0def49c88ea04abde1d5e8d3fb22a1b5046778bdafefc46b0449ade68bf84b36ec72dd71265fc2e882348c26c2126237dd5b37f5ae655b1086cda40e00aec58754734be31d750351dc076eb43d9621dc08c029d1608a46cf26fbe816b89f7cb81bff81a8b9482565856555ee923c65973deb0a99b962bc0fe94a3fcae3697bd7b85b3a682167c43dbf137115a40ebddcad74875ec58e9a3ddb9ad02a078cf0d972df9e99f079767734f69ce475f00ac64337803f5eb4e5842f4d98fe3fa370d47eb640dc5061dc35817", @generic="053b3a0b0a3176fa81d5dd205df77d46f70df08bc18894624e7bffe90164484395675b08b5cb590c676c2142be91e216739d0690e72a5925af7fb13fb2a4be76902e2211229172bd7c360f6d603e8eff61b35dd6ff34fe58dc5d3ba23ebb70b0d2f8d302084ad3e98ec61864d2cb9d0647451ab80d4f325eadc8d7ad364274f68cf6f7874b0d0c1b6442967dae092f893ad27643e311bc94a206618e9e36515064a0fab336692db34956ed512f98d73cf478601a5677008289970a674d1b41"]}]}, 0x318}], 0x1, 0x0, 0x0, 0x1}, 0x0) 1.238730001s ago: executing program 1 (id=6022): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x20, 0x3, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @netfilter=0x2d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000008c0)={r0, 0x0, 0x14, 0x0, &(0x7f00000006c0)="f6f4e9a1d78ad62ceef1884366a578bb3fb7dbfc", 0x0, 0x0, 0x0, 0x3, 0x0, &(0x7f0000000700)='Ir;', 0x0}, 0x50) (async) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'bridge0\x00', 0x0}) (async) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=ANY=[@ANYBLOB="780000001000830404000000fedbdf2500007400", @ANYRES32=r1, @ANYBLOB="0008000007500500580012800b0001006272696467650000480002800500190002000000050017"], 0x78}, 0x1, 0x0, 0x0, 0x800}, 0x0) (async) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, &(0x7f0000000640)={'batadv0\x00', 0x0}) (async) r4 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000a40)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff5653f, 0x70bd2d, 0x25dfdbfc, {0x0, 0x0, 0x0, r5, {0x0, 0x9}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x81}, 0x0) (async) sendmsg$nl_route_sched(r4, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newtfilter={0x44, 0x2c, 0xf07, 0x70bd2a, 0x25dfdbfc, {0x0, 0x0, 0x0, r5, {0xc}, {0x0, 0x9}, {0xffff, 0x9}}, [@filter_kind_options=@f_flower={{0xb}, {0x14, 0x2, [@TCA_FLOWER_KEY_ETH_TYPE={0x6, 0x8, 0x8848}, @TCA_FLOWER_KEY_MPLS_LABEL={0x8, 0x46, 0x7fffffff}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x8881}, 0x0) (async, rerun: 32) r6 = socket$nl_route(0x10, 0x3, 0x0) (rerun: 32) r7 = socket(0x1, 0x803, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000640)=ANY=[@ANYBLOB="500000001000210400000000fedbdf2500000000", @ANYRES32=0x0, @ANYBLOB="adffa888e16000002800128009000100766c616e00000000180002800c0002000e0000000a000000060001000001000008000500", @ANYRES32=r8], 0x50}}, 0x2) (async) getpeername$packet(0xffffffffffffffff, &(0x7f0000000680)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000740)=0x14) (async, rerun: 32) r10 = socket$netlink(0x10, 0x3, 0x0) (rerun: 32) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000200)={'geneve0\x00', 0x0}) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="9400000010000100"/20, @ANYRES32=r11, @ANYBLOB="0006000000000000240012800b00010067656e657665000014000280060005004e24000008000b"], 0x94}, 0x1, 0x2, 0x0, 0x804}, 0x0) (async) r12 = socket(0x400000000010, 0x3, 0x0) (async) r13 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r13, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r12, &(0x7f0000000bc0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000d00)=@deltfilter={0x0, 0x2d, 0xd5155227a596f8ac, 0x70bd2a, 0x25dfdbfb, {0x0, 0x0, 0x0, r9, {0x10, 0xfff3}, {0xffe0}, {0x8, 0xfff3}}, [@TCA_RATE={0x0, 0x5, {0xb}}, @TCA_RATE={0x0, 0x5, {0x1, 0x7}}, @filter_kind_options=@f_u32={{}, {0x0, 0x2, [@TCA_U32_FLAGS={0x0, 0xb, 0x8}, @TCA_U32_DIVISOR={0x0, 0x4, 0x5d}]}}, @filter_kind_options=@f_bpf={{}, {0x0, 0x2, [@TCA_BPF_NAME={0x0, 0x7, './file0\x00'}, @TCA_BPF_ACT={0x0, 0x1, [@m_nat={0x0, 0x0, 0x0, 0x0, {{}, {0x0, 0x2, 0x0, 0x1, [@TCA_NAT_PARMS={0x0, 0x1, {{0x3, 0x2799, 0x3, 0x1, 0x8}, @remote, @multicast2, 0xff000000}}, @TCA_NAT_PARMS={0x0, 0x1, {{0x7ff, 0x6, 0x4, 0x2, 0x1}, @initdev={0xac, 0x1e, 0x1, 0x0}, @empty, 0xffffffff}}]}, {0x0, 0x6, "7dca4a7fec316c7c66108738f1bc56a2f43340afb9d6dd5e00fed4203d2354db3abc378068452fad01e6391861479e0eeab67ccaa3c3da164511830dd2a91dd6ddfb98c4d3f1ba60ed0e07c74a89cc1a9035512811096b3e1b62c231c5c11f71e2af627adba5c2de795f80315ce5b1943f515d5b8b1d320c56764ce4ea2e01966bd850544bea43adeac4ed489cc7cd9f4390d67f559ecbe2360ab6af6f34f09bcffc329c0fec77c321eda2831ba19424dbf838fe"}, {0x0, 0x7, {0x1, 0x1}}, {0x0, 0x8, {0x2}}}}, @m_sample={0x0, 0x16, 0x0, 0x0, {{}, {0x0, 0x2, 0x0, 0x1, [@TCA_SAMPLE_TRUNC_SIZE={0x0, 0x4, 0xd99}, @TCA_SAMPLE_TRUNC_SIZE={0x0, 0x4, 0xfffff27f}, @TCA_SAMPLE_RATE={0x0, 0x3, 0x8}, @TCA_SAMPLE_TRUNC_SIZE={0x0, 0x4, 0xd7}, @TCA_SAMPLE_PARMS={0x0, 0x2, {0x9, 0x2, 0x7, 0x1ff, 0x9}}]}, {0x0, 0x6, "ceb7420bd626eb5b23b211450e335f26094d6a12022a324a83597a152f5da5ed92204379c5a81cc6ea81cd9ce8dd650617c07031fdb82427472b8aee46d821b73971dc2f03c82ee7424ebc7460faf940ecd5133b176fdaa5c2aa69a86045a582f2ff9cd74f580d3d2d2795911ff7ebf0c5800b"}, {0x0, 0x7, {0x0, 0x1}}, {0x0, 0x8, {0x1, 0x3}}}}, @m_skbedit={0x0, 0x6, 0x0, 0x0, {{}, {0x0, 0x2, 0x0, 0x1, [@TCA_SKBEDIT_PRIORITY={0x0, 0x3, {0xe, 0x4}}, @TCA_SKBEDIT_MARK={0x0, 0x5, 0x400000}, @TCA_SKBEDIT_PRIORITY={0x0, 0x3, {0xfff1, 0xffe0}}, @TCA_SKBEDIT_QUEUE_MAPPING={0x0, 0x4, 0x200}, @TCA_SKBEDIT_PTYPE={0x0, 0x7, 0x5}, @TCA_SKBEDIT_MARK={0x0, 0x5, 0x8}, @TCA_SKBEDIT_QUEUE_MAPPING={0x0, 0x4, 0x3}, @TCA_SKBEDIT_MARK={0x0, 0x5, 0x1}]}, {0x0, 0x6, "973b93b3491c71a7353fdf8b503a90b86c2fe185a2107371875e73ea0990de81c7b497f730119ecf8ef7e9484a16105e8c8eaabd1123b7dca02faa312482d671b9be59"}, {0x0, 0x7, {0x1, 0x1}}, {0x0, 0x8, {0x1, 0xdef807445d10003}}}}, @m_vlan={0x0, 0x8, 0x0, 0x0, {{}, {0x0, 0x2, 0x0, 0x1, [@TCA_VLAN_PUSH_VLAN_PROTOCOL={0x0, 0x4, 0x9a8}]}, {0x0, 0x6, "fa4c35efdf1beb117b2516a81d787128c79fa8c9f5326c3c400107c928a3b38bdd9b5b8081ca9650acaa0dd4e1838239fd322f97171a46050ec5b8a4f1ebb5d04daeccab8489adea196db9c20c215fab7873ce4414e6551b373836c08ed3d137173a090ca109118f9a7d3355da811b436838cc6783cbc963f519e153f9babe290e8c42dd31948bc12a7bae62b24eb496bc26cb54209256a541406cbbf845e9cedfc3052a197158cb648bcdee536072e478168152c02201c0"}, {}, {0x0, 0x8, {0x1, 0x2}}}}, @m_ctinfo={0x0, 0x13, 0x0, 0x0, {{}, {0x0, 0x2, 0x0, 0x1, [@TCA_CTINFO_PARMS_CPMARK_MASK={0x0, 0x7, 0xd}, @TCA_CTINFO_PARMS_CPMARK_MASK={0x0, 0x7, 0x6}, @TCA_CTINFO_ZONE={0x0, 0x4, 0x400}, @TCA_CTINFO_PARMS_DSCP_MASK={0x0, 0x5, 0x6}, @TCA_CTINFO_ZONE={0x0, 0x4, 0x4}, @TCA_CTINFO_ZONE={0x0, 0x4, 0xfff8}, @TCA_CTINFO_PARMS_CPMARK_MASK={0x0, 0x7, 0xffffff00}, @TCA_CTINFO_ZONE={0x0, 0x4, 0xe90}]}, {0x0, 0x6, "49eb505e27fca79cd8f75cc0c9f80d6290f349f9f3fe75435eca7b749db0997828c8f6cd9c910fa23f91df44a7c1868534b13a370d12655feef15d76693f13d399a50727d8261b65b8abf16eb6cb44bee1c51c1da808717304bd7d6a68a46e3131f67b8f1dad51ca7cbaa0fa92a865bf53146c3a353568496da7842fddc5ba31133ac41e17e8c2c63250ff21e370a000b2464b11d90578923142fcbe287b0fcc19b5afc6a480b02c530f09cb064255b73dbc9741bc24861e0f465c55ef"}, {}, {0x0, 0x8, {0x0, 0x3}}}}]}, @TCA_BPF_OPS={{}, {0x0, 0x5, [{0x100, 0xbc, 0x6c, 0xffffffff}]}}, @TCA_BPF_CLASSID={0x0, 0x3, {0xc, 0x7}}, @TCA_BPF_FLAGS_GEN]}}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4}, 0x0) (async) sendmsg$nl_route_sched(r12, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000016c0)=@newtfilter={0x3c, 0x2c, 0xd27, 0x30bd29, 0x25dfdc00, {0x0, 0x0, 0x0, r14, {0x0, 0x7}, {}, {0x8, 0xf}}, [@filter_kind_options=@f_route={{0xa}, {0xc, 0x2, [@TCA_ROUTE4_FROM={0x8, 0x3, 0x10000b9}]}}]}, 0x3c}}, 0x20000000) (async) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000800)={'ip6tnl0\x00', &(0x7f0000000480)={'ip6gre0\x00', 0x0, 0x4, 0xf, 0x3, 0x2, 0x28, @private1={0xfc, 0x1, '\x00', 0xa1}, @remote, 0x7800, 0x8, 0x8, 0x1}}) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000880)={'syztnl2\x00', &(0x7f0000000840)={'erspan0\x00', 0x0, 0x80, 0x6cc4236b4af6bf9f, 0xfffffffd, 0x5, {{0x8, 0x4, 0x0, 0xb, 0x20, 0x64, 0x0, 0xd, 0x2f, 0x0, @multicast2, @empty, {[@generic={0x83, 0x8, "3b73f3e889fb"}, @ra={0x94, 0x4}]}}}}}) (async, rerun: 64) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x14, &(0x7f0000000940)={@private2, 0x0}, &(0x7f0000000980)=0x14) (async, rerun: 64) r18 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r18, 0x8933, &(0x7f0000000380)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r18, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r19, {0x0, 0x7}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9}, {0xc, 0x2, [@TCA_CAKE_AUTORATE={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x40004}, 0x0) (async) sendmsg$ETHTOOL_MSG_LINKMODES_GET(0xffffffffffffffff, &(0x7f0000000cc0)={&(0x7f0000000000), 0xc, &(0x7f0000000c80)={&(0x7f00000009c0)=ANY=[@ANYBLOB="b0020000", @ANYRES16=0x0, @ANYBLOB="00022abd7000fbdbdf250400000028000180080003000300000008000100", @ANYRES32=0x0, @ANYBLOB="1400020070696d3672656731000000000000000084000180080003000200000008000100", @ANYRES32=0x0, @ANYBLOB="14000200726f7365300000000000000000000000140002006272696467655f736c6176655f31000008000100", @ANYRES32=0x0, @ANYBLOB="08000100", @ANYRES32=0x0, @ANYBLOB="1400020067656e6576653100000000000000000008000100", @ANYRES32=0x0, @ANYBLOB="1400020073797a6b616c6c65723100000000000008000100", @ANYRES32=0x0, @ANYBLOB="6000018008000300010000000800030003314dfe54000100", @ANYRES32=0x0, @ANYBLOB="1400020076657468305f746f5f62617461647600140002006d6163766c616e30000000000000000008000100", @ANYRES32=0x0, @ANYBLOB="140002006772657461703000000000000000000044000180080003000100000008000100", @ANYRES32=r1, @ANYBLOB="08000300020000001400020076657468305f746f5f6272696467650014000200766972745f776966693000000000000044000180140002007866726d30000000000000000000000008000100", @ANYRES32=r3, @ANYBLOB="08000100", @ANYRES32=r5, @ANYBLOB="08000300030000001400020070696d367265673100000000000000002800018008000100", @ANYRES32=r8, @ANYBLOB="140002006772657461703000000000000000000008000300030000002c00018008000100", @ANYRES32=r9, @ANYBLOB="0800030001000000080003000200000008000100", @ANYRES32=r11, @ANYBLOB="08000300010000007400018008000100", @ANYRES32=r14, @ANYBLOB="140002007665746830000000000000000000000008000100", @ANYRES32=r15, @ANYBLOB="14000200766c616e3100000000000000000000001400020076657468315f746f5f6261746164760014000200626f6e645f736c6176655f300000000008000100", @ANYRES32=r16, @ANYBLOB="08000100", @ANYRES32=r17, @ANYBLOB="400001801400020076657468315f746f5f68737200000000080003000300000008000100", @ANYRES32=r19, @ANYBLOB="080003000300000008000300010000000800030000000000"], 0x2b0}, 0x1, 0x0, 0x0, 0x4000004}, 0x4000000) 1.069721104s ago: executing program 2 (id=6023): r0 = socket$kcm(0x11, 0x3, 0x0) r1 = socket$unix(0x1, 0x5, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r3) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r5, &(0x7f0000000040)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) write$bt_hci(r5, &(0x7f0000000500)=ANY=[@ANYBLOB="4c00010002"], 0x8) r6 = socket$caif_seqpacket(0x25, 0x5, 0x3) r7 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x6, 0x4, 0x8, 0xa}, 0x48) r8 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x3, 0xc, &(0x7f0000000000)=@framed={{}, [@ringbuf_output={{0x18, 0x5, 0x1, 0x0, r7}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x1d}}]}, &(0x7f0000000200)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000780)={r8, 0x18000000000002a0, 0xe, 0x0, &(0x7f0000000040)="5a6e41dea43e63a3f70cff11c72b", 0x0, 0x2e00, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) setsockopt$sock_attach_bpf(r6, 0x1, 0x32, &(0x7f0000000140)=r8, 0x4) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000600)=@newqdisc={0x24, 0x24, 0x200, 0x70bd26, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}}, 0x24}, 0x1, 0x0, 0x0, 0x40088c1}, 0x20000090) sendmsg$nl_route_sched(r4, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000006c0)=@newqdisc={0x34, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdc01, {0x0, 0x0, 0x0, r9, {0x0, 0xd}, {0xffff, 0xb}, {0xfff3, 0xffe0}}, [@qdisc_kind_options=@q_pfifo_fast={0xf}]}, 0x34}, 0x1, 0x0, 0x0, 0x240040e0}, 0x4890) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) setsockopt$sock_attach_bpf(r0, 0x107, 0xf, &(0x7f0000000600), 0x56) sendmsg$kcm(r0, &(0x7f00000000c0)={&(0x7f0000000580)=@xdp={0x2c, 0x0, r10, 0x3e}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000180)="27030200590214000600002fb96dbcf706e10500000086ddffff1144ee162fd4b8bf4a31accb", 0xfdef}], 0x1}, 0x0) 904.281513ms ago: executing program 3 (id=6024): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x3) getsockopt$bt_BT_DEFER_SETUP(r0, 0x12, 0x2, 0x0, &(0x7f0000000200)) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000240)={{0x14}, [@NFT_MSG_DELSET={0x20, 0xb, 0xa, 0x801, 0x0, 0x0, {0xa, 0x0, 0x6}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x48}, 0x1, 0x0, 0x0, 0x8001}, 0x4c0d0) writev(0xffffffffffffffff, &(0x7f0000000380)=[{&(0x7f0000000280)="3986c2d48cf8c83702fb70f5a5a23d944bacc4a2db953e112d8eb30c9201b8152738018f166c52b74cf381b67e42b52177e60cbb6161cd623a34e4af8c089e872072820fffc518e02191ca97f0430f39d4136e3131afea10b8ea1c08160b29a97555e91176ae7370f726717842cf76a06a4092a0b6987feb0aeb79dd84035c6eb2e2", 0x82}], 0x1) writev(0xffffffffffffffff, &(0x7f0000000400)=[{&(0x7f0000000300)='0', 0x1}], 0x1) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={0xffffffffffffffff, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000300)=""/8, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000001c0)={0xd, 0x4, &(0x7f0000000040)=@framed={{}, [@ldst={0x1, 0x0, 0x3, 0x9, 0x1, 0x4}]}, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xf}, 0xb6) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$TIPC_NL_BEARER_ENABLE(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000003c0)=ANY=[@ANYBLOB='`\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="01000000000000000000030000004c0001800d0001007564703a73797a310000000038000400200001"], 0x60}}, 0x0) 872.95217ms ago: executing program 1 (id=6025): r0 = socket(0x2a, 0x2, 0x0) sendmsg$TIPC_NL_LINK_GET(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000280)={0x0, 0x24}}, 0x0) getsockname$packet(r0, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000001480)=0x14) r2 = socket$packet(0x11, 0x2, 0x300) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x4, 0x16, 0x0, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x5}, 0x94) socket$nl_netfilter(0x10, 0x3, 0xc) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={0x0, 0x18}, 0x1, 0x0, 0x0, 0x4008}, 0x0) sendmsg$TIPC_NL_KEY_SET(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000080), 0xc, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[], 0x4c}}, 0x40) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={0x0, 0x64}, 0x1, 0x0, 0x0, 0x890}, 0x0) sendmsg$NL80211_CMD_SET_REG(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x60000100}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x4000}, 0x0) r4 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r4, &(0x7f00000002c0)={0xa, 0x4e22, 0x0, @local, 0xb}, 0x1c) listen(r4, 0x2) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x5b5ace103c07041}, 0x0) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f0000000940)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r5, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5", 0x4) r6 = accept4(r5, 0x0, 0x0, 0x800) sendmmsg$alg(r6, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r6, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) syz_emit_ethernet(0x4e, &(0x7f0000000600)={@local, @broadcast, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "00fcff", 0x18, 0x6, 0x1, @local, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x6, 0xc2, 0x0, 0x0, 0x0, {[@fastopen={0x1e, 0x2}]}}}}}}}}, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000080)={'wlan0\x00', 0x0}) socket(0x21, 0x2, 0x1000) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000740)={0x6, 0xf, &(0x7f0000000140)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x9}, {}, {}, [], {{}, {}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f00000001c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x40, '\x00', r7, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x5}, 0x94) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r8, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000840)={&(0x7f0000000c40)=ANY=[@ANYBLOB="580000001000010009000000000000000000ffff", @ANYRES32=0x0, @ANYBLOB="00000000da44000024001a8020000a8014000700fe8000000000000000020040000000000500080002000000140003007866726d30"], 0x58}}, 0x240488c4) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=@newqdisc={0x2c, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000100)=@newtfilter={0x4c, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {0xfffa, 0xe}, {}, {0x1c, 0xfff9}}, [@filter_kind_options=@f_flower={{0xb}, {0x1c, 0x2, [@TCA_FLOWER_KEY_ETH_TYPE={0x6, 0x8, 0x800}, @TCA_FLOWER_KEY_IP_PROTO={0x5, 0x9, 0x84}, @TCA_FLOWER_KEY_SCTP_SRC={0x6}]}}]}, 0x4c}}, 0x24004000) socket$netlink(0x10, 0x3, 0x0) 597.373463ms ago: executing program 1 (id=6026): bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0xd, 0x4, &(0x7f0000000400)=ANY=[@ANYBLOB="b4000000000000006111dc000000000006000000000000009500000000000000"], &(0x7f0000000080)='GPL\x00', 0xf, 0x3e0, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sock_ops, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0x76}, 0x48) (async) r0 = syz_genetlink_get_family_id$ethtool(&(0x7f00000000c0), 0xffffffffffffffff) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000100)=ANY=[@ANYBLOB="80010000100001000000000000000000ac574400000000000000007f000001000000000000000000000000000000000000000002000000000a00ff8000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="ff020000000000000000000000000001000000006c000000e000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a"], 0x180}}, 0x0) r2 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'veth1_macvtap\x00', 0x0}) r4 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000300)=@newlink={0x3c, 0x10, 0x503, 0x70bd2a, 0x4, {0x0, 0x0, 0x0, 0x0, 0x38018, 0x201a0}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macsec={{0xb}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r3}]}, 0x3c}}, 0x800) (async) r5 = socket$nl_route(0x10, 0x3, 0x0) (async) r6 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) setsockopt$SO_ATTACH_FILTER(r6, 0x1, 0x1a, &(0x7f0000000080)={0x1, &(0x7f0000000040)=[{0x6}]}, 0x10) (async) bind$bt_hci(r6, &(0x7f0000000140)={0x1f, 0xffff, 0x2}, 0x6) r7 = socket(0x1, 0x803, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000640)=ANY=[@ANYBLOB="500000001000210400000000fedbdf2500000000", @ANYRES32=0x0, @ANYBLOB="adffa888e16000002800128009000100766c616e00000000180002800c0002000e0000000a000000060001000001000008000500", @ANYRES32=r8], 0x50}}, 0x2) (async) r9 = socket$nl_generic(0x10, 0x3, 0x10) r10 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000140)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f00000018c0)={{r10, 0xffffffffffffffff}, &(0x7f0000000100), &(0x7f00000006c0)='%pB \x00'}, 0x20) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000440)={r11, 0xffffffffffffffff}, 0x4) ioctl$sock_SIOCSIFVLAN_DEL_VLAN_CMD(r6, 0x8983, &(0x7f0000000340)={0x1, 'veth1_to_bond\x00', {}, 0xaee}) (async, rerun: 64) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x3, 0x10, &(0x7f0000000040)=ANY=[@ANYBLOB="18000000000000000000000008000000b7080000000000007b8af8ff000000009f080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230800", @ANYRES32=r12, @ANYBLOB="0000000000000000b70500000800000085000000a500000095"], &(0x7f0000000480)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x41, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10}, 0x94) (async, rerun: 64) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r9, 0x8933, &(0x7f0000000140)={'batadv0\x00', 0x0}) (async) r14 = syz_genetlink_get_family_id$batadv(&(0x7f0000000200), 0xffffffffffffffff) unshare(0x6020400) (async) r15 = socket$vsock_stream(0x28, 0x1, 0x0) shutdown(r15, 0x300) (async) sendmsg$BATADV_CMD_SET_MESH(r9, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000000)={0x24, r14, 0x11, 0x0, 0xffffffff, {}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r13}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5, 0x37, 0x1}]}, 0x24}}, 0x0) (async, rerun: 64) r16 = syz_genetlink_get_family_id$tipc(&(0x7f0000000580), r9) (rerun: 64) sendmsg$TIPC_CMD_GET_MAX_PORTS(r9, &(0x7f0000000700)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000600)={&(0x7f00000005c0)={0x1c, r16, 0x100, 0x70bd27, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x40884}, 0x20000080) (async) sendmsg$ETHTOOL_MSG_EEE_SET(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000100)={0x1a0, r0, 0x300, 0x70bd2b, 0x25dfdbff, {}, [@ETHTOOL_A_EEE_TX_LPI_ENABLED={0x5, 0x6, 0x1}, @ETHTOOL_A_EEE_MODES_OURS={0x8, 0x2, 0x0, 0x1, [@ETHTOOL_A_BITSET_NOMASK={0x4}]}, @ETHTOOL_A_EEE_HEADER={0x28, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'gretap0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r3}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}]}, @ETHTOOL_A_EEE_TX_LPI_TIMER={0x8, 0x7, 0x9}, @ETHTOOL_A_EEE_TX_LPI_TIMER={0x8, 0x7, 0xc}, @ETHTOOL_A_EEE_MODES_OURS={0x110, 0x2, 0x0, 0x1, [@ETHTOOL_A_BITSET_NOMASK={0x4}, @ETHTOOL_A_BITSET_MASK={0x86, 0x5, "fb9f52838a0f81247fe800d6bce21959968c99d19dd41e1a6cfbe0e53b34412ecdbba2c32c0e8e32ab6a4ce58793baa31f6a3f14a8a21e329cb7e6fc9a18eb6d8dafd8f0be20d3d45d68e973ba6a4c251e0b34fc75f7bd66b9e9bc19172027f6066713deaba0f6a4a9bf190e6bd2b490349fd741bb09e15ca05328a1e96f0719dbda"}, @ETHTOOL_A_BITSET_VALUE={0x79, 0x4, "fd5e72d41eb6449c5087d0520f282255567832bd31f346b7ddd89f3716e063b1111c121173835a1a7fc2e55fc987712cd569fac6511aacbaa98fcd874f93f21a47a79e4732d222675635fadee57615688e74f079474c23fe70dcdb56a238040314ffebedd4a0246a5702dc31173e9c6b32e0cb6815"}, @ETHTOOL_A_BITSET_NOMASK={0x4}]}, @ETHTOOL_A_EEE_HEADER={0x24, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r13}]}, @ETHTOOL_A_EEE_ENABLED={0x5, 0x5, 0x1}, @ETHTOOL_A_EEE_TX_LPI_TIMER={0x8, 0x7, 0x7}]}, 0x1a0}, 0x1, 0x0, 0x0, 0x20000000}, 0x20000000) 0s ago: executing program 4 (id=6027): r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000300)={&(0x7f0000000780)=ANY=[@ANYBLOB="9feb010018000000000000000c0000000c000000020000000000000000000004000000000000b97b7c7842581c22d4e51558eb7b20deb47b55a5e4661721bd2f544e5c516264e1d98b9fe678c39f6ce38059eed248d3870c7951e8edb87068c7653dcfdf0ec28aaee91e9691ba4d152a00d8eb2910d58b22924f8d9c73333fac94aef7b1d43375435f79403f36003a2fb2ba0d1c4769742584b11ceab255"], 0x0, 0x26, 0x0, 0x1}, 0x28) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000340)={r0, 0x20, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0}}, 0x10) bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000400)=r1, 0x4) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0xa, 0x8, &(0x7f00000000c0)=@framed={{}, [@ldst={0x1, 0x3, 0x3, 0x0, 0x1, 0x40, 0xfffffffffffffffc}, @btf_id={0x18, 0x4, 0x3, 0x0, 0x4}, @map_idx_val={0x18, 0x5, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x8}]}, &(0x7f0000000100)='syzkaller\x00', 0x9, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r1}, 0x94) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002c80)={0x3, 0x4, &(0x7f0000000140)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x87}]}, &(0x7f0000000080)='GPL\x00'}, 0x90) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r3, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) (async) connect$inet6(r3, &(0x7f0000000100)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x1}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r3, 0x6, 0x1f, &(0x7f00000002c0), 0x4) (async) close(0x3) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$devlink(&(0x7f0000000440), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_GET(r4, &(0x7f0000000680)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000640)={&(0x7f0000000540)={0xcc, r5, 0x400, 0x70bd26, 0x25dfdbfc, {}, [@pci={{0x8}, {0x11}}, @nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, @nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, @nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, @pci={{0x8}, {0x11}}, @nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}]}, 0xcc}, 0x1, 0x0, 0x0, 0x8010}, 0x20000000) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000480)=@bpf_tracing={0x1a, 0x3, &(0x7f0000000000)=@framed, &(0x7f00000001c0)='syzkaller\x00', 0x3, 0x40, &(0x7f0000000200)=""/64, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x24b40, r2}, 0x94) r6 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000240)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x6d, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x4, 0x4}, 0x50) (async) r7 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r7, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10) r8 = socket$igmp(0x2, 0x3, 0x2) setsockopt$inet_int(r8, 0x0, 0x13, &(0x7f0000000080)=0x4, 0x16) r9 = socket$qrtr(0x2a, 0x2, 0x0) bind$qrtr(r9, &(0x7f0000000000)={0x2a, 0x1, 0x2}, 0xc) (async) syz_emit_ethernet(0x90, &(0x7f00000006c0)={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}, @random="f6916cfd7d96", @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x82, 0x0, 0x0, 0x0, 0x11, 0x0, @rand_addr=0x64010101, @empty}, {0x0, 0x4e21, 0x6e, 0x0, @opaque="b2d63ee5b2d4c6538a7b6aa67e90e815bc17370f0f79c61de5db05aa44431d8e9146854554122874451d70db7deaf2ce72563394af6d9826b288b705aefe299972b876f993fb6a31c5f7b243df8ea8b17ca245b508378b91c11b04ef9974f83fe592582953da"}}}}}, 0x0) r10 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000300), 0x4) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000380)={{r6}, &(0x7f00000002c0), &(0x7f0000000340)=r10}, 0x20) kernel console output (not intermixed with test programs): 6'. [ 619.971053][T21257] netlink: 140 bytes leftover after parsing attributes in process `syz.0.4016'. [ 619.997599][T21257] netlink: 41 bytes leftover after parsing attributes in process `syz.0.4016'. [ 620.793211][T21301] netdevsim netdevsim1 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 620.807689][T21306] sctp: [Deprecated]: syz.4.4032 (pid 21306) Use of int in maxseg socket option. [ 620.807689][T21306] Use struct sctp_assoc_value instead [ 620.816197][T21301] netdevsim netdevsim1 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 620.886499][T21301] netdevsim netdevsim1 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 620.897031][T21301] netdevsim netdevsim1 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 620.973958][T21301] netdevsim netdevsim1 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 620.984983][T21301] netdevsim netdevsim1 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 621.021030][T21280] Bluetooth: hci0: Opcode 0x080f failed: -4 [ 621.090475][T21301] netdevsim netdevsim1 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 621.112709][T21301] netdevsim netdevsim1 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 621.178325][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5590 ms [ 621.186530][ C1] lec:lec_tx_timeout: lec0 [ 621.245317][ T49] netdevsim netdevsim1 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 621.272912][ T49] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 621.317119][T21338] macvlan0: entered promiscuous mode [ 621.325039][ T69] netdevsim netdevsim1 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 621.368486][ T69] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 621.409842][ T69] netdevsim netdevsim1 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 621.424971][ T69] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 621.467516][ T69] netdevsim netdevsim1 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 621.489645][ T69] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 621.646170][T21349] Cannot find del_set index 4 as target [ 621.833919][T21365] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 622.109605][T21382] openvswitch: netlink: IP tunnel attribute has 4 unknown bytes. [ 622.127823][T21382] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 622.158933][ T25] block nbd2: Connection timed out, retrying (0/2 alive) [ 622.167680][ T25] block nbd2: Connection timed out, retrying (0/2 alive) [ 622.179650][ T25] block nbd2: Connection timed out, retrying (0/2 alive) [ 622.183682][ T5208] block nbd3: Connection timed out, retrying (0/2 alive) [ 622.186788][ T25] block nbd2: Connection timed out, retrying (0/2 alive) [ 622.203401][ T5208] block nbd3: Connection timed out, retrying (0/2 alive) [ 622.203674][ T25] block nbd2: Dead connection, failed to find a fallback [ 622.210981][ T5208] block nbd3: Connection timed out, retrying (0/2 alive) [ 622.211028][ T5208] block nbd3: Connection timed out, retrying (0/2 alive) [ 622.211107][ T5208] block nbd3: Dead connection, failed to find a fallback [ 622.302607][T17350] Bluetooth: hci0: command 0x080f tx timeout [ 622.454866][T21398] openvswitch: netlink: Unexpected mask (mask=240, allowed=10048) [ 622.569548][T21404] hsr_slave_0: left promiscuous mode [ 622.577562][T21404] hsr_slave_1: left promiscuous mode [ 622.838801][T21417] syzkaller1: entered promiscuous mode [ 622.856427][T21417] syzkaller1: entered allmulticast mode [ 622.901990][T21400] tipc: Enabling of bearer rejected, failed to enable media [ 623.126151][T21431] wlan1 speed is unknown, defaulting to 1000 [ 623.509574][T21450] ip6t_srh: unknown srh invflags 4000 [ 623.664487][T21454] netlink: 'syz.1.4079': attribute type 1 has an invalid length. [ 623.801516][T21431] wg1 speed is unknown, defaulting to 1000 [ 623.890369][T21471] syzkaller1: entered promiscuous mode [ 623.895900][T21471] syzkaller1: entered allmulticast mode [ 623.922515][T21468] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 623.957765][T21468] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 624.137930][T21479] team0: No ports can be present during mode change [ 624.148499][T21481] wlan1 speed is unknown, defaulting to 1000 [ 624.705830][ T1302] lec:lec_start_xmit: lec0:No lecd attached [ 625.136316][ C1] IPv4: Oversized IP packet from 127.0.0.1 [ 625.167588][T21526] ip6gre1: entered allmulticast mode [ 625.256081][T21536] openvswitch: netlink: IP tunnel TTL not specified. [ 625.348851][T21538] block nbd4: not configured, cannot reconfigure [ 625.362963][T21540] netlink: 'syz.1.4106': attribute type 1 has an invalid length. [ 625.454139][T21540] 8021q: adding VLAN 0 to HW filter on device bond1 [ 625.509759][T21550] netlink: 'syz.0.4107': attribute type 2 has an invalid length. [ 625.549392][T21547] bond1: (slave veth3): Enslaving as an active interface with a down link [ 625.560190][T21555] xt_hashlimit: invalid rate [ 625.593217][T21556] netlink: 'syz.4.4111': attribute type 10 has an invalid length. [ 625.606495][T21557] geneve2: entered promiscuous mode [ 625.612977][T21557] geneve2: entered allmulticast mode [ 625.628760][ T49] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 625.655790][T21558] macvlan2: entered promiscuous mode [ 625.698402][T21558] macvlan2: entered allmulticast mode [ 625.704840][T21558] bond1: entered promiscuous mode [ 625.743708][T21558] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 625.744633][T21563] __nla_validate_parse: 11 callbacks suppressed [ 625.744649][T21563] netlink: 104 bytes leftover after parsing attributes in process `syz.2.4114'. [ 625.776342][T21558] bond1: (slave macvlan2): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 625.794184][T21565] netlink: 'syz.3.4113': attribute type 10 has an invalid length. [ 625.802416][T21558] bond1: left promiscuous mode [ 625.832647][ T69] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 625.863411][T21565] bridge_slave_1: left allmulticast mode [ 625.871598][T21565] bridge_slave_1: left promiscuous mode [ 625.877642][T21565] bridge0: port 2(bridge_slave_1) entered disabled state [ 625.910008][ T69] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 625.934598][T21565] netlink: 28 bytes leftover after parsing attributes in process `syz.3.4113'. [ 625.988411][T21569] syzkaller1: entered promiscuous mode [ 626.004045][T21569] syzkaller1: entered allmulticast mode [ 626.018871][T21565] netlink: 'syz.3.4113': attribute type 7 has an invalid length. [ 626.060964][T21565] netlink: 'syz.3.4113': attribute type 8 has an invalid length. [ 626.071616][T21573] x_tables: ip_tables: TPROXY target: used from hooks FORWARD, but only usable from PREROUTING [ 626.108078][T21565] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4113'. [ 626.202766][ T69] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 626.227209][T21578] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4117'. [ 628.072740][T21589] netlink: 24 bytes leftover after parsing attributes in process `syz.0.4119'. [ 628.619558][T21635] netlink: 176 bytes leftover after parsing attributes in process `syz.1.4126'. [ 628.640046][T21635] netlink: 32 bytes leftover after parsing attributes in process `syz.1.4126'. [ 628.653817][T21635] netlink: 'syz.1.4126': attribute type 29 has an invalid length. [ 628.831363][T21598] syzkaller1: entered promiscuous mode [ 628.837006][T21598] syzkaller1: entered allmulticast mode [ 628.876935][ T69] netdevsim netdevsim4 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 628.889358][ T69] netdevsim netdevsim4 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 628.944019][ T69] netdevsim netdevsim4 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 628.971601][ T69] netdevsim netdevsim4 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 629.605302][T21650] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 629.653761][T21683] syzkaller1: entered promiscuous mode [ 629.666321][T21683] syzkaller1: entered allmulticast mode [ 630.158662][T21718] netlink: 7064 bytes leftover after parsing attributes in process `syz.2.4155'. [ 630.173826][T21718] openvswitch: netlink: Missing key (keys=40, expected=10000000) [ 630.218255][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5510 ms [ 630.226463][ C1] lec:lec_tx_timeout: lec0 [ 630.352150][T21732] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4158'. [ 630.394617][T21732] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4158'. [ 630.404689][T21736] netlink: zone id is out of range [ 630.410891][T21736] netlink: zone id is out of range [ 630.416227][T21736] netlink: zone id is out of range [ 630.422851][T21736] netlink: zone id is out of range [ 630.444517][T21736] netlink: zone id is out of range [ 630.470530][T21736] netlink: zone id is out of range [ 630.493244][T21736] netlink: zone id is out of range [ 630.514738][T21736] netlink: zone id is out of range [ 630.528295][T21736] netlink: zone id is out of range [ 630.610188][T21744] netlink: 'syz.0.4162': attribute type 8 has an invalid length. [ 630.808913][T21750] __nla_validate_parse: 2 callbacks suppressed [ 630.808935][T21750] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4165'. [ 630.889840][T21750] bridge_slave_0 (unregistering): left allmulticast mode [ 630.948510][T21750] bridge_slave_0 (unregistering): left promiscuous mode [ 630.955626][T21750] bridge0: port 1(bridge_slave_0) entered disabled state [ 631.115737][T21778] netlink: 48 bytes leftover after parsing attributes in process `syz.2.4171'. [ 631.317404][T21787] sctp: [Deprecated]: syz.0.4173 (pid 21787) Use of int in maxseg socket option. [ 631.317404][T21787] Use struct sctp_assoc_value instead [ 631.736348][T21813] xt_hashlimit: size too large, truncated to 1048576 [ 631.849770][T21825] macvtap0: entered promiscuous mode [ 631.856500][T21825] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4184'. [ 632.289115][T21825] veth0_macvtap: left promiscuous mode [ 632.566647][T21843] netlink: 44 bytes leftover after parsing attributes in process `syz.2.4190'. [ 632.754086][T21858] netlink: 'syz.0.4193': attribute type 12 has an invalid length. [ 632.764222][T21856] netlink: 44 bytes leftover after parsing attributes in process `syz.1.4196'. [ 632.776967][T21860] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4197'. [ 632.797170][T21861] netlink: 'syz.4.4195': attribute type 2 has an invalid length. [ 632.853572][T21865] netlink: 'syz.4.4195': attribute type 2 has an invalid length. [ 632.905780][T21861] !: entered promiscuous mode [ 632.936112][T21870] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4195'. [ 632.968600][T21865] !: left promiscuous mode [ 632.990813][T21873] netlink: 20 bytes leftover after parsing attributes in process `syz.0.4200'. [ 633.113301][T21873] netlink: 184 bytes leftover after parsing attributes in process `syz.0.4200'. [ 633.191444][T21884] netlink: 'syz.2.4205': attribute type 12 has an invalid length. [ 633.606973][T21918] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4213'. [ 633.690882][T21909] IPVS: ip_vs_edit_dest(): lower threshold is higher than upper threshold [ 636.492771][T21908] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 636.771453][T21955] net_ratelimit: 46 callbacks suppressed [ 636.771475][T21955] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 636.948921][T21965] syzkaller1: entered promiscuous mode [ 636.954648][T21965] syzkaller1: entered allmulticast mode [ 637.020916][T17350] Bluetooth: hci1: command 0x0406 tx timeout [ 637.501673][ T5208] block nbd3: shutting down sockets [ 637.501807][ T25] block nbd2: shutting down sockets [ 637.510539][ T25] I/O error, dev nbd2, sector 6 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 637.512863][ T5208] I/O error, dev nbd3, sector 6 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 637.523018][ T25] Buffer I/O error on dev nbd2, logical block 3, async page read [ 637.532881][ T5208] Buffer I/O error on dev nbd3, logical block 3, async page read [ 637.541385][ T25] I/O error, dev nbd2, sector 4 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 637.548621][ T5208] I/O error, dev nbd3, sector 4 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 637.559516][ T25] Buffer I/O error on dev nbd2, logical block 2, async page read [ 637.567953][ T5208] Buffer I/O error on dev nbd3, logical block 2, async page read [ 637.576046][ T25] I/O error, dev nbd2, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 637.583603][ T5208] I/O error, dev nbd3, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 637.593139][ T25] Buffer I/O error on dev nbd2, logical block 1, async page read [ 637.603312][ T5208] Buffer I/O error on dev nbd3, logical block 1, async page read [ 637.610968][ T25] I/O error, dev nbd2, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 637.618656][ T5208] I/O error, dev nbd3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 637.628278][ T25] Buffer I/O error on dev nbd2, logical block 0, async page read [ 637.637876][ T5208] Buffer I/O error on dev nbd3, logical block 0, async page read [ 637.649785][T19750] I/O error, dev nbd2, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 637.664337][T19508] I/O error, dev nbd3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 637.679317][T19508] Buffer I/O error on dev nbd3, logical block 0, async page read [ 637.689705][T19508] Buffer I/O error on dev nbd3, logical block 1, async page read [ 637.700684][T19508] ldm_validate_partition_table(): Disk read failed. [ 637.711634][T19750] ldm_validate_partition_table(): Disk read failed. [ 637.729224][T19508] Dev nbd3: unable to read RDB block 0 [ 637.731170][T19750] Dev nbd2: unable to read RDB block 0 [ 637.741048][T19508] nbd3: unable to read partition table [ 637.741359][T19750] nbd2: unable to read partition table [ 637.769869][T19750] ldm_validate_partition_table(): Disk read failed. [ 637.770161][T19508] ldm_validate_partition_table(): Disk read failed. [ 637.777203][T19750] Dev nbd2: unable to read RDB block 0 [ 637.793678][T19750] nbd2: unable to read partition table [ 637.819527][T19508] Dev nbd3: unable to read RDB block 0 [ 637.825940][T19508] nbd3: unable to read partition table [ 637.829824][T21994] netlink: 'syz.0.4237': attribute type 1 has an invalid length. [ 637.908899][T21994] workqueue: Failed to create a rescuer kthread for wq "bond5": -EINTR [ 637.971958][T22005] __nla_validate_parse: 7 callbacks suppressed [ 637.971984][T22005] netlink: 248 bytes leftover after parsing attributes in process `syz.2.4238'. [ 638.075748][T22012] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4239'. [ 638.146840][T22015] syzkaller1: entered promiscuous mode [ 638.158389][T22015] syzkaller1: entered allmulticast mode [ 638.205744][T22024] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4244'. [ 638.219848][T22024] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4244'. [ 638.327803][T22027] netlink: 104 bytes leftover after parsing attributes in process `syz.0.4245'. [ 638.338690][T22028] netlink: 104 bytes leftover after parsing attributes in process `syz.0.4245'. [ 638.871676][T22062] netlink: 16 bytes leftover after parsing attributes in process `syz.0.4253'. [ 638.986273][T22062] debugfs: 'Ku crK:̥B| lS-!' already exists in 'ieee80211' [ 639.146133][T22075] netlink: 24 bytes leftover after parsing attributes in process `syz.3.4256'. [ 639.206381][T22075] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4256'. [ 639.531236][T22093] syzkaller1: entered promiscuous mode [ 639.547032][T22093] syzkaller1: entered allmulticast mode [ 639.622883][T22097] syzkaller0: entered allmulticast mode [ 639.641165][T22097] syzkaller0 (unregistering): left allmulticast mode [ 639.727404][T21624] IPVS: starting estimator thread 0... [ 639.751036][T22100] netlink: 20 bytes leftover after parsing attributes in process `syz.3.4262'. [ 639.828242][T22104] IPVS: using max 27 ests per chain, 64800 per kthread [ 643.634541][T22113] tipc: Started in network mode [ 643.639641][T22113] tipc: Node identity 3, cluster identity 4711 [ 643.645940][T22113] tipc: Node number set to 3 [ 643.709952][T22132] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 643.863692][T22142] netlink: 'syz.2.4274': attribute type 39 has an invalid length. [ 643.915971][T22156] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4274'. [ 644.201827][T22174] netlink: 'syz.4.4281': attribute type 4 has an invalid length. [ 644.363809][T22183] netlink: 'syz.4.4284': attribute type 21 has an invalid length. [ 644.417177][T22183] IPv6: NLM_F_CREATE should be specified when creating new route [ 644.547702][T22196] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4287'. [ 644.753355][T22209] netem: change failed [ 644.812255][T22205] x_tables: duplicate underflow at hook 2 [ 644.937842][T22225] netlink: 'syz.2.4297': attribute type 1 has an invalid length. [ 644.961130][T22218] netlink: 44 bytes leftover after parsing attributes in process `syz.1.4295'. [ 645.068920][T22230] netlink: 'syz.0.4298': attribute type 1 has an invalid length. [ 645.224559][T22240] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4301'. [ 645.319439][T22247] netlink: 96 bytes leftover after parsing attributes in process `syz.4.4304'. [ 645.358674][T22247] vlan2: entered allmulticast mode [ 645.367514][T22247] erspan0: entered allmulticast mode [ 645.462761][T22253] netlink: 32 bytes leftover after parsing attributes in process `syz.3.4305'. [ 646.180762][T22297] syzkaller1: entered promiscuous mode [ 646.186408][T22297] syzkaller1: entered allmulticast mode [ 646.271463][T22304] netlink: 'syz.0.4318': attribute type 1 has an invalid length. [ 646.376322][T22304] bond6: entered promiscuous mode [ 646.387514][T22304] 8021q: adding VLAN 0 to HW filter on device bond6 [ 646.455745][T22304] bond6: (slave bridge8): making interface the new active one [ 646.479406][T22304] bridge8: entered promiscuous mode [ 646.495203][T22304] bridge8: left promiscuous mode [ 646.808410][T22327] netlink: 256 bytes leftover after parsing attributes in process `syz.1.4325'. [ 646.817612][T22327] netlink: 'syz.1.4325': attribute type 9 has an invalid length. [ 646.983073][T22348] netlink: 'syz.3.4331': attribute type 5 has an invalid length. [ 647.008232][T22348] netlink: 140 bytes leftover after parsing attributes in process `syz.3.4331'. [ 647.036593][T22351] syzkaller1: entered promiscuous mode [ 647.061638][T22351] syzkaller1: entered allmulticast mode [ 647.188032][T22366] netlink: 64 bytes leftover after parsing attributes in process `syz.1.4337'. [ 647.258329][ T51] Bluetooth: hci2: command 0x0406 tx timeout [ 647.288314][T22369] syzkaller1: entered promiscuous mode [ 647.307682][T22369] syzkaller1: entered allmulticast mode [ 647.459602][T22382] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4342'. [ 647.528548][T22386] netlink: 'syz.3.4343': attribute type 13 has an invalid length. [ 647.536613][T22386] netlink: 'syz.3.4343': attribute type 58 has an invalid length. [ 648.599305][T22431] llcp: llcp_sock_recvmsg: Recv datagram failed state 3 -6 0 [ 648.600491][T22431] syzkaller0: entered promiscuous mode [ 648.651144][T22431] syzkaller0: entered allmulticast mode [ 648.724275][T22446] xt_policy: neither incoming nor outgoing policy selected [ 649.348616][T16918] Bluetooth: hci0: command 0x080f tx timeout [ 649.354774][ T51] Bluetooth: hci0: Opcode 0x0c1a failed: -110 [ 649.550567][T22487] __nla_validate_parse: 10 callbacks suppressed [ 649.550598][T22487] netlink: 20 bytes leftover after parsing attributes in process `syz.4.4367'. [ 649.816427][T22502] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4371'. [ 649.831117][T22512] netlink: 136 bytes leftover after parsing attributes in process `syz.0.4373'. [ 650.045331][T22521] validate_nla: 3 callbacks suppressed [ 650.045353][T22521] netlink: 'syz.1.4374': attribute type 1 has an invalid length. [ 650.118248][T22519] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4374'. [ 650.191856][T22521] bond3: entered promiscuous mode [ 650.197470][T22521] 8021q: adding VLAN 0 to HW filter on device bond3 [ 650.222089][T22519] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4374'. [ 650.609895][T22488] netlink: 28 bytes leftover after parsing attributes in process `syz.3.4369'. [ 650.638531][T22488] netlink: 28 bytes leftover after parsing attributes in process `syz.3.4369'. [ 650.672946][T22559] netlink: 108 bytes leftover after parsing attributes in process `syz.2.4384'. [ 650.689167][T22559] netlink: 'syz.2.4384': attribute type 1 has an invalid length. [ 650.712290][T22559] netlink: 224 bytes leftover after parsing attributes in process `syz.2.4384'. [ 650.887635][T22573] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4387'. [ 651.042705][T22573] macvtap1: entered promiscuous mode [ 651.059322][T22573] vlan0: entered promiscuous mode [ 651.070146][T22573] macvtap1: entered allmulticast mode [ 651.075583][T22573] vlan0: entered allmulticast mode [ 651.148185][T22573] veth0_vlan: entered allmulticast mode [ 651.250428][T22597] netlink: 'syz.2.4392': attribute type 21 has an invalid length. [ 651.575566][T22613] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 653.885180][T22653] workqueue: Failed to create a rescuer kthread for wq "bond4": -EINTR [ 653.977775][T22660] nbd: couldn't find a device at index 0 [ 654.299090][T22678] netlink: 'syz.3.4411': attribute type 39 has an invalid length. [ 654.315337][T22676] bond0: (slave rose0): Error: Device is in use and cannot be enslaved [ 654.493651][T22685] bond7 (unregistering): Released all slaves [ 654.697768][T22703] tipc: Enabling of bearer rejected, media not registered [ 654.986743][T22720] gre2: entered promiscuous mode [ 655.024499][T22720] gre2: entered allmulticast mode [ 655.064481][T22728] netlink: 'syz.0.4426': attribute type 21 has an invalid length. [ 655.086265][T22728] __nla_validate_parse: 13 callbacks suppressed [ 655.086286][T22728] netlink: 152 bytes leftover after parsing attributes in process `syz.0.4426'. [ 655.339011][T22746] netlink: 104 bytes leftover after parsing attributes in process `syz.2.4431'. [ 655.468072][T22754] netlink: 'syz.1.4434': attribute type 5 has an invalid length. [ 655.483224][T22754] delete_channel: no stack [ 655.719204][T22769] netlink: 256 bytes leftover after parsing attributes in process `syz.3.4439'. [ 655.848715][T22766] syzkaller0: entered promiscuous mode [ 655.858565][T22766] syzkaller0: entered allmulticast mode [ 655.926344][T22766] bond9: option arp_validate: mode dependency failed, not supported in mode balance-alb(6) [ 655.940000][T22766] bond9 (unregistering): Released all slaves [ 655.973505][T22784] tipc: Enabling of bearer rejected, failed to enable media [ 656.047288][T22790] netlink: 'syz.4.4444': attribute type 1 has an invalid length. [ 656.225551][T22802] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4446'. [ 656.257529][T22800] netlink: 'syz.3.4447': attribute type 30 has an invalid length. [ 656.305833][T22803] netlink: 116 bytes leftover after parsing attributes in process `syz.4.4444'. [ 657.822644][T22790] workqueue: Failed to create a rescuer kthread for wq "bond4": -EINTR [ 657.870386][T22801] netlink: 32 bytes leftover after parsing attributes in process `syz.4.4444'. [ 657.948810][T22800] workqueue: Failed to create a rescuer kthread for wq "bond7": -EINTR [ 658.112837][T22815] syzkaller0: entered promiscuous mode [ 658.126822][T22815] syzkaller0: entered allmulticast mode [ 658.197820][T22824] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4454'. [ 658.207552][T22823] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 658.238772][T22824] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4454'. [ 658.258751][T22823] A link change request failed with some changes committed already. Interface geneve0 may have been left with an inconsistent configuration, please check. [ 658.687767][T22848] netlink: 24 bytes leftover after parsing attributes in process `syz.2.4463'. [ 658.698085][T22848] openvswitch: netlink: Flow key attr not present in new flow. [ 658.915307][T22874] netlink: 'syz.1.4469': attribute type 10 has an invalid length. [ 658.929696][T22874] netlink: 40 bytes leftover after parsing attributes in process `syz.1.4469'. [ 658.945602][T22874] dummy0: entered promiscuous mode [ 658.955691][T22874] bridge0: port 3(dummy0) entered blocking state [ 658.965350][T22874] bridge0: port 3(dummy0) entered disabled state [ 658.978557][T22874] dummy0: entered allmulticast mode [ 658.999926][T22879] netlink: 'syz.4.4471': attribute type 10 has an invalid length. [ 659.008418][T22874] bridge0: port 3(dummy0) entered blocking state [ 659.014923][T22874] bridge0: port 3(dummy0) entered forwarding state [ 659.037839][T22879] bridge_slave_1: entered allmulticast mode [ 659.054117][T22879] bond0: (slave bridge_slave_1): Enslaving as an active interface with an up link [ 659.503577][T22903] netlink: 'syz.0.4477': attribute type 1 has an invalid length. [ 659.706573][T22911] bridge0: port 1(team0) entered blocking state [ 659.726747][T22911] bridge0: port 1(team0) entered disabled state [ 659.734905][T22911] team0: entered allmulticast mode [ 659.740536][T22911] team_slave_0: entered allmulticast mode [ 659.752863][T22911] team_slave_1: entered allmulticast mode [ 659.775442][T22911] team0: entered promiscuous mode [ 659.798306][T22911] team_slave_0: entered promiscuous mode [ 659.807464][T22911] team_slave_1: entered promiscuous mode [ 660.261537][T22945] IPVS: set_ctl: invalid protocol: 60 172.20.20.17:20004 [ 660.682418][T22976] __nla_validate_parse: 3 callbacks suppressed [ 660.682441][T22976] netlink: 640 bytes leftover after parsing attributes in process `syz.2.4500'. [ 660.698539][T22976] openvswitch: netlink: VXLAN extension message has 4 unknown bytes. [ 660.799868][T22979] IPVS: set_ctl: invalid protocol: 0 172.20.20.51:20001 [ 660.826957][T22979] IPVS: set_ctl: invalid protocol: 2021 172.20.20.59:20001 [ 660.932459][T22984] 8021q: adding VLAN 0 to HW filter on device batadv1 [ 660.964922][T22984] netlink: 'syz.0.4504': attribute type 9 has an invalid length. [ 660.985061][T22986] netlink: 64 bytes leftover after parsing attributes in process `syz.3.4506'. [ 661.026412][T22992] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4509'. [ 661.085813][T22994] Cannot find map_set index 65533 as target [ 661.106101][T22997] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4509'. [ 661.106371][T22996] netlink: 44 bytes leftover after parsing attributes in process `syz.3.4511'. [ 661.140776][T22997] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4509'. [ 661.185973][T23000] netlink: 212344 bytes leftover after parsing attributes in process `syz.0.4510'. [ 661.195637][ T51] block nbd4: Receive control failed (result -32) [ 661.207394][T23000] netlink: 208 bytes leftover after parsing attributes in process `syz.0.4510'. [ 661.469029][T23014] netlink: 'syz.2.4517': attribute type 10 has an invalid length. [ 661.480455][T23016] netlink: 40 bytes leftover after parsing attributes in process `syz.4.4516'. [ 661.490232][T23014] bridge0: port 2(bridge_slave_1) entered disabled state [ 661.497972][T23014] bridge0: port 1(bridge_slave_0) entered disabled state [ 661.548687][T23014] bridge0: port 2(bridge_slave_1) entered blocking state [ 661.556128][T23014] bridge0: port 2(bridge_slave_1) entered forwarding state [ 661.563786][T23014] bridge0: port 1(bridge_slave_0) entered blocking state [ 661.571028][T23014] bridge0: port 1(bridge_slave_0) entered forwarding state [ 661.614482][T23014] bond0: (slave bridge0): Enslaving as an active interface with an up link [ 661.801329][T23033] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4523'. [ 661.820536][T23035] 8021q: adding VLAN 0 to HW filter on device team0 [ 661.827995][T23035] team0: Cannot enslave team device to itself [ 661.933863][T23033] bond4: entered promiscuous mode [ 661.942129][T23033] 8021q: adding VLAN 0 to HW filter on device bond4 [ 662.295916][T23067] xfrm1: entered promiscuous mode [ 662.314168][T23067] xfrm1: entered allmulticast mode [ 662.787739][T23098] netlink: 'syz.3.4543': attribute type 83 has an invalid length. [ 663.033919][T23115] netlink: 'syz.3.4546': attribute type 1 has an invalid length. [ 663.190932][T23125] x_tables: unsorted entry at hook 1 [ 663.431192][T23133] netlink: 'syz.3.4555': attribute type 1 has an invalid length. [ 663.563983][T23138] syzkaller0: entered promiscuous mode [ 663.570500][T23138] syzkaller0: entered allmulticast mode [ 663.584584][T23152] IPVS: sync thread started: state = MASTER, mcast_ifn = veth1_to_team, syncid = 4, id = 0 [ 663.625189][T23133] bond7: (slave vxcan3): The slave device specified does not support setting the MAC address [ 663.637593][T23133] bond7: (slave vxcan3): Error -95 calling set_mac_address [ 664.008483][T23133] macvlan6: entered promiscuous mode [ 664.021358][T23133] macvlan6: entered allmulticast mode [ 664.269734][T23164] gretap1: entered promiscuous mode [ 664.277417][T23164] gretap1: entered allmulticast mode [ 664.699726][T23199] netlink: 'syz.0.4573': attribute type 15 has an invalid length. [ 665.166427][T23227] netlink: 'syz.2.4583': attribute type 10 has an invalid length. [ 665.615762][T23257] tipc: Enabling of bearer rejected, failed to enable media [ 665.706624][T23265] __nla_validate_parse: 23 callbacks suppressed [ 665.706647][T23265] netlink: 68 bytes leftover after parsing attributes in process `syz.0.4591'. [ 666.109551][T23285] syzkaller0: entered allmulticast mode [ 666.599071][T23320] netlink: 248 bytes leftover after parsing attributes in process `syz.0.4606'. [ 666.844399][T23338] netlink: 24 bytes leftover after parsing attributes in process `syz.0.4610'. [ 666.853851][T23333] netlink: 24 bytes leftover after parsing attributes in process `syz.0.4610'. [ 666.909591][T23344] netlink: 'syz.1.4612': attribute type 1 has an invalid length. [ 666.917616][T23334] netlink: 28 bytes leftover after parsing attributes in process `syz.4.4609'. [ 666.941836][T23345] netlink: 'syz.1.4612': attribute type 1 has an invalid length. [ 667.024638][T23344] bond4: entered promiscuous mode [ 667.030526][T23344] 8021q: adding VLAN 0 to HW filter on device bond4 [ 667.039063][T23334] workqueue: Failed to create a rescuer kthread for wq "bond5": -EINTR [ 667.183181][T23363] netlink: 56 bytes leftover after parsing attributes in process `syz.2.4617'. [ 667.505057][T23384] vlan4: entered allmulticast mode [ 667.525747][T23384] bond0: entered allmulticast mode [ 667.541617][T23384] bond_slave_0: entered allmulticast mode [ 667.547573][T23384] bond_slave_1: entered allmulticast mode [ 667.571883][T23384] bridge0: entered allmulticast mode [ 667.575015][T23392] netlink: 32 bytes leftover after parsing attributes in process `syz.4.4626'. [ 667.606857][T23391] netlink: 64 bytes leftover after parsing attributes in process `syz.1.4621'. [ 667.624679][T23393] netlink: 32 bytes leftover after parsing attributes in process `syz.4.4626'. [ 668.100640][T23432] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4635'. [ 668.464811][T23461] syzkaller0: entered promiscuous mode [ 668.472965][T23461] syzkaller0: entered allmulticast mode [ 669.305448][T23521] IPv6: sit2: Disabled Multicast RS [ 669.741058][T23554] xt_NFQUEUE: number of total queues is 0 [ 669.939741][T23561] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 670.035753][T23561] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 670.831090][T23599] bond5: Unable to set peer notification delay as MII monitoring is disabled [ 670.859388][T23619] __nla_validate_parse: 7 callbacks suppressed [ 670.859411][T23619] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4688'. [ 670.918649][T23599] bond5 (unregistering): Released all slaves [ 670.971329][T23603] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4685'. [ 670.983154][T23624] tipc: Enabling of bearer rejected, failed to enable media [ 671.124455][T23628] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4692'. [ 671.149553][T23630] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4694'. [ 671.232331][T11346] netdevsim netdevsim4 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 671.258542][T11346] netdevsim netdevsim4 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 671.408311][T11346] netdevsim netdevsim4 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 671.476702][T11346] netdevsim netdevsim4 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 671.621903][T23668] netlink: 256 bytes leftover after parsing attributes in process `syz.3.4700'. [ 671.665730][T23651] syzkaller0: entered promiscuous mode [ 671.672989][T23651] syzkaller0: entered allmulticast mode [ 671.681048][T23666] netem: incorrect gi model size [ 671.697397][T23666] netem: change failed [ 671.757299][T23674] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4702'. [ 671.874711][T23682] netlink: 560 bytes leftover after parsing attributes in process `syz.4.4704'. [ 672.121530][T23695] netlink: 60 bytes leftover after parsing attributes in process `syz.4.4706'. [ 674.249948][T23728] netlink: 'syz.3.4716': attribute type 3 has an invalid length. [ 674.278577][T23728] netlink: 'syz.3.4716': attribute type 3 has an invalid length. [ 674.428596][T23738] netdevsim netdevsim2 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 674.439293][T23738] netdevsim netdevsim2 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 674.450524][T23738] netdevsim netdevsim2 eth3 (unregistering): unset [1, 1] type 2 family 0 port 20004 - 0 [ 674.502369][T23742] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4720'. [ 674.519009][T23753] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4720'. [ 674.591079][T23738] netdevsim netdevsim2 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 674.621555][T23738] netdevsim netdevsim2 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 674.669675][T23738] netdevsim netdevsim2 eth2 (unregistering): unset [1, 1] type 2 family 0 port 20004 - 0 [ 674.722507][T23762] debugfs: 'Ku crK:̥B| lS-!' already exists in 'ieee80211' [ 674.748031][T23738] netdevsim netdevsim2 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 674.763119][T23738] netdevsim netdevsim2 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 674.777719][T23738] netdevsim netdevsim2 eth1 (unregistering): unset [1, 1] type 2 family 0 port 20004 - 0 [ 674.856928][T23738] netdevsim netdevsim2 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 674.872457][T23738] netdevsim netdevsim2 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 674.879872][T23770] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 674.886670][T23738] netdevsim netdevsim2 eth0 (unregistering): unset [1, 1] type 2 family 0 port 20004 - 0 [ 675.008530][T11354] netdevsim netdevsim2 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 675.019073][T11354] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 20004 - 0 [ 675.027385][T11354] netdevsim netdevsim2 eth0: set [1, 1] type 2 family 0 port 6081 - 0 [ 675.058340][T11354] netdevsim netdevsim2 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 675.066599][T11354] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 20004 - 0 [ 675.089765][T11354] netdevsim netdevsim2 eth1: set [1, 1] type 2 family 0 port 6081 - 0 [ 675.151513][T11354] netdevsim netdevsim2 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 675.160259][T11354] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 20004 - 0 [ 675.169608][T11354] netdevsim netdevsim2 eth2: set [1, 1] type 2 family 0 port 6081 - 0 [ 675.218744][T11354] netdevsim netdevsim2 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 675.232130][T11354] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 20004 - 0 [ 675.250754][T11354] netdevsim netdevsim2 eth3: set [1, 1] type 2 family 0 port 6081 - 0 [ 675.314581][T23786] netlink: 'syz.4.4734': attribute type 1 has an invalid length. [ 675.329648][T23788] netlink: 'syz.3.4735': attribute type 1 has an invalid length. [ 675.346038][T23790] syzkaller0: entered promiscuous mode [ 675.347739][T23786] netlink: 'syz.4.4734': attribute type 1 has an invalid length. [ 675.352696][T23790] syzkaller0: entered allmulticast mode [ 675.394573][T23786] netlink: 'syz.4.4734': attribute type 8 has an invalid length. [ 675.418988][T23788] 8021q: adding VLAN 0 to HW filter on device bond8 [ 675.429518][T23794] bond8: entered allmulticast mode [ 675.505173][T23788] bond8: (slave ip6gretap1): making interface the new active one [ 675.515335][T23788] ip6gretap1: entered allmulticast mode [ 675.522955][T23788] bond8: (slave ip6gretap1): Enslaving as an active interface with an up link [ 675.651502][T23803] syzkaller1: entered promiscuous mode [ 675.660620][T23803] syzkaller1: entered allmulticast mode [ 675.661450][T23807] netlink: 'syz.3.4740': attribute type 1 has an invalid length. [ 675.966730][T23830] __nla_validate_parse: 6 callbacks suppressed [ 675.966752][T23830] netlink: 294 bytes leftover after parsing attributes in process `syz.4.4747'. [ 675.994798][T23830] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 676.040587][T23830] pim6reg: entered allmulticast mode [ 676.225992][T23847] openvswitch: netlink: nsh attr 0 has unexpected len 1 expected 0 [ 676.237562][T23848] tipc: Failed to obtain node identity [ 676.245894][T23848] tipc: Enabling of bearer rejected, failed to enable media [ 676.303932][T23851] IPVS: set_ctl: invalid protocol: 66 0.0.0.0:20001 [ 676.304304][T23848] tipc: Failed to obtain node identity [ 676.352905][T23848] tipc: Enabling of bearer rejected, failed to enable media [ 676.442056][T23859] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4753'. [ 676.502019][T23863] netlink: 'syz.3.4754': attribute type 17 has an invalid length. [ 676.547859][T23863] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4754'. [ 676.586234][T23863] netlink: 28 bytes leftover after parsing attributes in process `syz.3.4754'. [ 676.742791][T23883] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4759'. [ 677.649382][T23927] x_tables: ip_tables: TPROXY target: used from hooks FORWARD, but only usable from PREROUTING [ 677.752084][T23931] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4773'. [ 677.834215][T23931] 8021q: adding VLAN 0 to HW filter on device bond7 [ 677.945871][T23934] bond5: entered promiscuous mode [ 677.973073][T23934] bond5: entered allmulticast mode [ 677.988852][T23934] 8021q: adding VLAN 0 to HW filter on device bond5 [ 678.016587][T23938] sctp: [Deprecated]: syz.0.4775 (pid 23938) Use of struct sctp_assoc_value in delayed_ack socket option. [ 678.016587][T23938] Use struct sctp_sack_info instead [ 678.383266][T23954] bond1: option mode: unable to set because the bond device has slaves [ 678.407097][T23954] netlink: 28 bytes leftover after parsing attributes in process `syz.0.4777'. [ 678.438956][T23955] netlink: 'syz.0.4777': attribute type 1 has an invalid length. [ 678.450960][T23954] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4777'. [ 678.468707][T23955] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4777'. [ 678.507022][T23958] netlink: 24 bytes leftover after parsing attributes in process `syz.3.4779'. [ 678.766578][T23972] gre0: entered promiscuous mode [ 678.774731][T23972] gre0: entered allmulticast mode [ 678.930940][T23980] netlink: 'syz.4.4785': attribute type 1 has an invalid length. [ 679.330137][T24010] netlink: 'syz.3.4795': attribute type 1 has an invalid length. [ 679.433405][T24010] 8021q: adding VLAN 0 to HW filter on device bond10 [ 679.771603][T24032] netlink: 'syz.2.4799': attribute type 10 has an invalid length. [ 680.540361][ T9943] lec:lec_start_xmit: lec0:No lecd attached [ 682.300930][T24009] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 682.490948][T24045] netlink: 'syz.0.4801': attribute type 1 has an invalid length. [ 682.508767][T24045] __nla_validate_parse: 6 callbacks suppressed [ 682.508788][T24045] netlink: 96 bytes leftover after parsing attributes in process `syz.0.4801'. [ 682.553153][T24045] netlink: 1 bytes leftover after parsing attributes in process `syz.0.4801'. [ 682.564542][T24051] veth7: entered promiscuous mode [ 682.579437][T24051] veth7: entered allmulticast mode [ 682.582976][T24058] netlink: 100 bytes leftover after parsing attributes in process `syz.4.4807'. [ 682.595482][T24057] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4803'. [ 682.625094][T24045] A link change request failed with some changes committed already. Interface team0 may have been left with an inconsistent configuration, please check. [ 682.761922][T24069] netlink: 76 bytes leftover after parsing attributes in process `syz.2.4810'. [ 682.999032][T24088] syzkaller1: entered promiscuous mode [ 683.004751][T24088] syzkaller1: entered allmulticast mode [ 683.262674][T24101] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4823'. [ 683.326273][T24105] xt_addrtype: ipv6 PROHIBIT (THROW, NAT ..) matching not supported [ 683.352169][T24101] syzkaller1: entered promiscuous mode [ 683.357773][T24101] syzkaller1: entered allmulticast mode [ 683.368033][T24109] SET target dimension over the limit! [ 683.627985][T24128] netlink: 'syz.4.4832': attribute type 16 has an invalid length. [ 683.648243][T24128] netlink: 'syz.4.4832': attribute type 17 has an invalid length. [ 683.744490][T24128] bond0: left promiscuous mode [ 683.750991][T24128] bond0: left allmulticast mode [ 683.755967][T24128] bridge_slave_1: left allmulticast mode [ 683.764727][T24128] 8021q: adding VLAN 0 to HW filter on device bond0 [ 683.803717][T24128] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 683.823679][T24130] workqueue: Failed to create a rescuer kthread for wq "bond8": -EINTR [ 683.828902][T24139] netlink: 204 bytes leftover after parsing attributes in process `syz.2.4836'. [ 683.851664][T24128] netlink: 'syz.4.4832': attribute type 16 has an invalid length. [ 683.876291][T24128] netlink: 'syz.4.4832': attribute type 17 has an invalid length. [ 683.915139][T24128] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 683.974450][T24128] netlink: 'syz.4.4832': attribute type 16 has an invalid length. [ 683.996520][T24128] netlink: 'syz.4.4832': attribute type 17 has an invalid length. [ 684.027482][T24128] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 684.055900][T24128] netlink: 'syz.4.4832': attribute type 16 has an invalid length. [ 684.081955][T24128] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 684.105366][T24154] syzkaller0: entered promiscuous mode [ 684.111705][T24154] syzkaller0: entered allmulticast mode [ 684.155894][T24128] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 684.240537][T24128] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 684.266922][T24169] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4844'. [ 684.326146][T24128] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 684.366504][T24128] validate_nla: 7 callbacks suppressed [ 684.366525][T24128] netlink: 'syz.4.4832': attribute type 16 has an invalid length. [ 684.383281][T24128] netlink: 'syz.4.4832': attribute type 17 has an invalid length. [ 684.441120][T24128] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 684.641964][T24190] syzkaller1: entered promiscuous mode [ 684.663122][T24190] syzkaller1: entered allmulticast mode [ 685.000241][T24211] nbd: couldn't find a device at index 0 [ 685.390162][T24239] syzkaller1: entered promiscuous mode [ 685.395870][T24239] syzkaller1: entered allmulticast mode [ 685.474305][T24245] openvswitch: netlink: Tunnel attr 78 out of range max 16 [ 685.557869][T24245] bond9: entered promiscuous mode [ 685.565513][T24245] bond9: entered allmulticast mode [ 685.575734][T24245] 8021q: adding VLAN 0 to HW filter on device bond9 [ 685.584299][T24237] syzkaller0: entered promiscuous mode [ 685.598878][T24237] syzkaller0: entered allmulticast mode [ 686.029488][T24267] netlink: 'syz.4.4875': attribute type 1 has an invalid length. [ 686.218261][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5680 ms [ 686.226404][ C1] lec:lec_tx_timeout: lec0 [ 686.233204][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 686.462315][T24285] syzkaller1: entered promiscuous mode [ 686.487073][T24285] syzkaller1: entered allmulticast mode [ 686.505697][T24288] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4879'. [ 687.062328][T24311] netlink: 20 bytes leftover after parsing attributes in process `syz.0.4885'. [ 687.555896][T24344] x_tables: unsorted underflow at hook 3 [ 687.753648][T24358] netlink: 'syz.3.4900': attribute type 10 has an invalid length. [ 687.942024][T24374] net_ratelimit: 1 callbacks suppressed [ 687.942046][T24374] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 687.960053][T24374] netlink: 'syz.1.4905': attribute type 1 has an invalid length. [ 688.014520][T24374] bond5: entered promiscuous mode [ 688.023078][T24374] 8021q: adding VLAN 0 to HW filter on device bond5 [ 688.123509][T24385] __nla_validate_parse: 1 callbacks suppressed [ 688.123531][T24385] netlink: 52 bytes leftover after parsing attributes in process `syz.2.4907'. [ 688.158521][T24385] netlink: 52 bytes leftover after parsing attributes in process `syz.2.4907'. [ 688.177310][T24390] bond5: (slave bridge3): making interface the new active one [ 688.185274][T24385] netlink: 52 bytes leftover after parsing attributes in process `syz.2.4907'. [ 688.190918][T24390] bridge3: entered promiscuous mode [ 688.225573][T24393] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4907'. [ 688.241231][T24390] bond5: (slave bridge3): Enslaving as an active interface with an up link [ 688.252076][T24393] netlink: 20 bytes leftover after parsing attributes in process `syz.2.4907'. [ 688.292901][T24395] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4911'. [ 688.435686][T24406] netlink: 'syz.0.4915': attribute type 1 has an invalid length. [ 688.444335][T24407] netlink: 'syz.0.4915': attribute type 1 has an invalid length. [ 688.532567][T24414] sctp: [Deprecated]: syz.3.4914 (pid 24414) Use of int in max_burst socket option. [ 688.532567][T24414] Use struct sctp_assoc_value instead [ 688.549675][T24407] syzkaller1: entered promiscuous mode [ 688.555213][T24407] syzkaller1: entered allmulticast mode [ 688.580357][T24403] sctp: [Deprecated]: syz.3.4914 (pid 24403) Use of int in max_burst socket option. [ 688.580357][T24403] Use struct sctp_assoc_value instead [ 688.604930][T24413] bond8: (slave bridge10): Enslaving as a backup interface with an up link [ 688.692500][T24420] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4918'. [ 688.702042][T24420] openvswitch: netlink: Flow actions attr not present in new flow. [ 688.905447][ T51] Bluetooth: hci4: link tx timeout [ 688.914088][ T51] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 689.192705][ T798] wg1 speed is unknown, defaulting to 1000 [ 689.213020][T24452] syz_tun: entered allmulticast mode [ 689.239793][T24451] syz_tun: left allmulticast mode [ 689.410051][T24467] netlink: 20 bytes leftover after parsing attributes in process `syz.3.4933'. [ 689.650549][T24443] udevd[24443]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 689.672768][T24443] udevd[24443]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 689.762266][T24481] netlink: 64 bytes leftover after parsing attributes in process `syz.3.4936'. [ 689.919776][T24493] netlink: 212368 bytes leftover after parsing attributes in process `syz.0.4940'. [ 690.443360][T24527] veth0_to_team: entered allmulticast mode [ 690.591705][T24534] A link change request failed with some changes committed already. Interface bond0 may have been left with an inconsistent configuration, please check. [ 690.655933][T24537] ip6t_REJECT: ECHOREPLY is not supported [ 690.678012][T24543] netlink: 'syz.1.4954': attribute type 1 has an invalid length. [ 690.716488][T24543] bond6: entered promiscuous mode [ 690.722570][T24543] 8021q: adding VLAN 0 to HW filter on device bond6 [ 690.942213][ T51] Bluetooth: hci4: command 0x0406 tx timeout [ 690.999499][T24568] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 691.191465][T24586] syzkaller1: entered promiscuous mode [ 691.197033][T24586] syzkaller1: entered allmulticast mode [ 691.220051][T24587] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 691.248591][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 691.256691][ C1] lec:lec_tx_timeout: lec0 [ 691.897926][T24620] bridge_slave_0: left allmulticast mode [ 691.923412][T24620] bridge_slave_0: left promiscuous mode [ 691.936732][T24620] bridge0: port 1(bridge_slave_0) entered disabled state [ 691.967221][T24620] team0: Port device team_slave_0 removed [ 691.985508][T24620] team0: Port device team_slave_1 removed [ 692.010519][T24620] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 692.053484][T24620] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 692.109700][T24620] bond4: (slave veth5): Releasing active interface [ 692.159188][T24620] bond6: (slave gretap2): Releasing active interface [ 692.257078][T24620] bond8: (slave ip6gretap1): Releasing active interface [ 692.290961][T24620] ip6gretap1: left allmulticast mode [ 692.339985][T24651] netlink: 'syz.2.4984': attribute type 1 has an invalid length. [ 692.455010][T24642] syzkaller0: entered promiscuous mode [ 692.482509][T24642] syzkaller0: entered allmulticast mode [ 692.496336][T24644] syzkaller1: entered promiscuous mode [ 692.507533][T24644] syzkaller1: entered allmulticast mode [ 692.862571][ T798] IPVS: starting estimator thread 0... [ 692.978288][T24680] IPVS: using max 27 ests per chain, 64800 per kthread [ 693.077090][T24693] netlink: 'syz.1.4992': attribute type 10 has an invalid length. [ 693.110721][T24694] netlink: 'syz.0.4995': attribute type 21 has an invalid length. [ 693.119043][T24694] IPv6: NLM_F_CREATE should be specified when creating new route [ 693.216911][T24698] syzkaller0: entered promiscuous mode [ 693.228690][T24698] syzkaller0: entered allmulticast mode [ 693.299440][T24700] syzkaller1: entered promiscuous mode [ 693.305287][T24700] syzkaller1: entered allmulticast mode [ 693.546741][T24711] __nla_validate_parse: 14 callbacks suppressed [ 693.546762][T24711] netlink: 4 bytes leftover after parsing attributes in process `syz.3.5004'. [ 693.635667][T24715] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5003'. [ 693.986415][T24725] batadv_slave_0: entered promiscuous mode [ 694.112655][T24728] openvswitch: netlink: Flow set message rejected, Key attribute missing. [ 694.273078][T24733] syzkaller1: entered promiscuous mode [ 694.279810][T24733] syzkaller1: entered allmulticast mode [ 694.453191][T24740] netlink: 12 bytes leftover after parsing attributes in process `syz.0.5015'. [ 694.522238][T24742] netlink: 'syz.4.5016': attribute type 4 has an invalid length. [ 694.701471][T24751] netdevsim netdevsim0 netdevsim0: entered promiscuous mode [ 694.727193][T24748] netlink: 4 bytes leftover after parsing attributes in process `syz.4.5019'. [ 694.737008][T24718] batadv_slave_0: left promiscuous mode [ 694.756098][T24755] netlink: 260 bytes leftover after parsing attributes in process `syz.2.5021'. [ 694.779358][T24748] netlink: 148 bytes leftover after parsing attributes in process `syz.4.5019'. [ 694.813217][T24748] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5019'. [ 694.895946][T24748] netlink: 24 bytes leftover after parsing attributes in process `syz.4.5019'. [ 694.918617][T24765] netlink: 'syz.3.5025': attribute type 18 has an invalid length. [ 694.941850][T24767] syzkaller1: entered promiscuous mode [ 694.968670][T24767] syzkaller1: entered allmulticast mode [ 695.053088][T24769] netlink: 20 bytes leftover after parsing attributes in process `syz.2.5027'. [ 695.088767][T24772] netlink: 'syz.1.5028': attribute type 1 has an invalid length. [ 695.096755][T24772] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5028'. [ 695.106278][T24772] netlink: 'syz.1.5028': attribute type 1 has an invalid length. [ 695.165222][T24776] netlink: 'syz.4.5030': attribute type 1 has an invalid length. [ 695.190818][T24780] netlink: 'syz.2.5032': attribute type 1 has an invalid length. [ 695.269516][T24776] 8021q: adding VLAN 0 to HW filter on device bond6 [ 695.360822][T24783] bond6: (slave geneve3): making interface the new active one [ 695.373089][T24783] bond6: (slave geneve3): Enslaving as an active interface with an up link [ 695.439062][T24796] FAULT_INJECTION: forcing a failure. [ 695.439062][T24796] name failslab, interval 1, probability 0, space 0, times 0 [ 695.439784][T11349] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 695.455439][T24796] CPU: 0 UID: 0 PID: 24796 Comm: syz.3.5037 Not tainted syzkaller #0 PREEMPT(full) [ 695.455466][T24796] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 695.455475][T24796] Call Trace: [ 695.455482][T24796] [ 695.455489][T24796] dump_stack_lvl+0xe8/0x150 [ 695.455519][T24796] should_fail_ex+0x412/0x560 [ 695.455550][T24796] should_failslab+0xa8/0x100 [ 695.455571][T24796] ? skb_clone+0x212/0x3a0 [ 695.455593][T24796] kmem_cache_alloc_noprof+0x87/0x650 [ 695.455620][T24796] ? apparmor_capable+0x126/0x170 [ 695.455648][T24796] skb_clone+0x212/0x3a0 [ 695.455668][T24796] ? nfnetlink_rcv+0x4b0/0x27b0 [ 695.455695][T24796] nfnetlink_rcv+0x4e2/0x27b0 [ 695.455716][T24796] ? is_bpf_text_address+0x26/0x2b0 [ 695.455740][T24796] ? is_bpf_text_address+0x292/0x2b0 [ 695.455757][T24796] ? is_bpf_text_address+0x26/0x2b0 [ 695.455781][T24796] ? __kernel_text_address+0xd/0x30 [ 695.455799][T24796] ? unwind_get_return_address+0x4d/0x90 [ 695.455823][T24796] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 695.455841][T24796] ? arch_stack_walk+0xfb/0x150 [ 695.455873][T24796] ? __lock_acquire+0x6b5/0x2cf0 [ 695.455895][T24796] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 695.455929][T24796] ? __lock_acquire+0x6b5/0x2cf0 [ 695.455957][T24796] ? __lock_acquire+0x6b5/0x2cf0 [ 695.455984][T24796] ? __netlink_lookup+0xc6/0x8b0 [ 695.456008][T24796] ? __netlink_lookup+0x7e4/0x8b0 [ 695.456034][T24796] ? netlink_deliver_tap+0x2e/0x1b0 [ 695.456068][T24796] netlink_unicast+0x80f/0x9b0 [ 695.456101][T24796] ? __pfx_netlink_unicast+0x10/0x10 [ 695.456126][T24796] ? netlink_sendmsg+0x650/0xb40 [ 695.456142][T24796] ? skb_put+0x11b/0x210 [ 695.456164][T24796] netlink_sendmsg+0x813/0xb40 [ 695.456191][T24796] ? __pfx_netlink_sendmsg+0x10/0x10 [ 695.456212][T24796] ? aa_sock_msg_perm+0xf1/0x1b0 [ 695.456238][T24796] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 695.456262][T24796] ____sys_sendmsg+0x972/0x9f0 [ 695.456291][T24796] ? __pfx_____sys_sendmsg+0x10/0x10 [ 695.456321][T24796] ? import_iovec+0x73/0xa0 [ 695.456345][T24796] ___sys_sendmsg+0x2a5/0x360 [ 695.456371][T24796] ? __pfx____sys_sendmsg+0x10/0x10 [ 695.456427][T24796] ? __fget_files+0x2a/0x420 [ 695.456442][T24796] ? __fget_files+0x3a0/0x420 [ 695.456468][T24796] __x64_sys_sendmsg+0x1bd/0x2a0 [ 695.456492][T24796] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 695.456543][T24796] ? __pfx_ksys_write+0x10/0x10 [ 695.456575][T24796] do_syscall_64+0x14d/0xf80 [ 695.456596][T24796] ? trace_irq_disable+0x3b/0x150 [ 695.456617][T24796] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 695.456635][T24796] ? clear_bhb_loop+0x40/0x90 [ 695.456656][T24796] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 695.456673][T24796] RIP: 0033:0x7f94e639c819 [ 695.456690][T24796] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 695.456704][T24796] RSP: 002b:00007f94e7344028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 695.456723][T24796] RAX: ffffffffffffffda RBX: 00007f94e6615fa0 RCX: 00007f94e639c819 [ 695.456736][T24796] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000003 [ 695.456747][T24796] RBP: 00007f94e7344090 R08: 0000000000000000 R09: 0000000000000000 [ 695.456757][T24796] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 695.456767][T24796] R13: 00007f94e6616038 R14: 00007f94e6615fa0 R15: 00007ffdbce22948 [ 695.456796][T24796] [ 695.816850][T11349] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 695.836009][T24793] syzkaller0: entered promiscuous mode [ 695.862656][T24793] syzkaller0: entered allmulticast mode [ 695.894331][T11349] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 695.939319][T11349] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 696.045680][T24820] bond7: invalid ARP target 0.0.0.0 specified for addition [ 696.054180][T24820] bond7: option arp_ip_target: invalid value (0) [ 696.063694][T24820] bond7 (unregistering): Released all slaves [ 696.248011][T24838] xt_TCPMSS: Only works on TCP SYN packets [ 696.251166][T24839] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for gretap3 [ 696.295633][T24835] can: request_module (can-proto-0) failed. [ 696.361916][T24843] netlink: 'syz.3.5051': attribute type 11 has an invalid length. [ 696.396762][T24842] netlink: 'syz.3.5051': attribute type 11 has an invalid length. [ 696.413124][T24842] netlink: 'syz.3.5051': attribute type 11 has an invalid length. [ 696.413124][T24843] netlink: 'syz.3.5051': attribute type 11 has an invalid length. [ 696.756649][T24869] netlink: 'syz.1.5061': attribute type 1 has an invalid length. [ 697.105633][T24894] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 697.206882][T24901] geneve4: entered promiscuous mode [ 697.212987][T24901] geneve4: entered allmulticast mode [ 697.340396][T24910] netlink: 'syz.0.5072': attribute type 10 has an invalid length. [ 697.396268][T24912] xt_hashlimit: size too large, truncated to 1048576 [ 697.410851][T24910] team0 (unregistering): left allmulticast mode [ 697.417173][T24910] team_slave_0: left allmulticast mode [ 697.459321][T24910] team_slave_1: left allmulticast mode [ 697.473952][T24910] team0 (unregistering): left promiscuous mode [ 697.491057][T24910] team_slave_0: left promiscuous mode [ 697.511577][T24910] team_slave_1: left promiscuous mode [ 697.517721][T24910] bridge0: port 1(team0) entered disabled state [ 697.650067][T24910] team0 (unregistering): Port device team_slave_0 removed [ 697.692750][T24910] team0 (unregistering): Port device team_slave_1 removed [ 697.727304][T24910] veth1_to_bridge: left allmulticast mode [ 697.734037][T24910] veth1_to_bridge: left promiscuous mode [ 697.751943][T24910] team0 (unregistering): Port device macvlan2 removed [ 697.769972][T24910] team0 (unregistering): Port device bridge5 removed [ 697.787385][T24923] ip6gre1: entered allmulticast mode [ 697.941052][T24937] Unsupported ieee802154 address type: 0 [ 697.976620][T24939] netlink: 'syz.4.5083': attribute type 15 has an invalid length. [ 698.122630][T24953] netlink: 'syz.3.5085': attribute type 1 has an invalid length. [ 698.144712][T24953] netlink: 'syz.3.5085': attribute type 2 has an invalid length. [ 698.169247][T24953] netlink: 'syz.3.5085': attribute type 1 has an invalid length. [ 698.637590][T24996] syzkaller0: entered promiscuous mode [ 698.653236][T24996] syzkaller0: entered allmulticast mode [ 698.927266][T25012] __nla_validate_parse: 77 callbacks suppressed [ 698.927289][T25012] netlink: 212344 bytes leftover after parsing attributes in process `syz.4.5107'. [ 698.968227][T25012] syzkaller0: entered promiscuous mode [ 698.973786][T25012] syzkaller0: entered allmulticast mode [ 699.244556][T25027] netlink: 20 bytes leftover after parsing attributes in process `syz.3.5113'. [ 699.312984][T25030] netlink: 52 bytes leftover after parsing attributes in process `syz.0.5114'. [ 699.441669][T25041] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5115'. [ 699.567503][T25050] netlink: 4 bytes leftover after parsing attributes in process `syz.4.5119'. [ 699.722591][T25055] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5122'. [ 699.752921][T25055] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5122'. [ 699.786667][T25061] netlink: 56 bytes leftover after parsing attributes in process `syz.0.5124'. [ 699.906462][T25063] siw: device registration error -23 [ 700.000115][T25071] netlink: 190972 bytes leftover after parsing attributes in process `syz.2.5129'. [ 700.056911][T25075] netlink: 32 bytes leftover after parsing attributes in process `syz.0.5130'. [ 700.207516][T25076] syzkaller0: entered promiscuous mode [ 700.227646][T25076] syzkaller0: entered allmulticast mode [ 700.321512][T25092] pimreg3: entered allmulticast mode [ 702.470607][T25108] validate_nla: 4 callbacks suppressed [ 702.470628][T25108] netlink: 'syz.4.5139': attribute type 2 has an invalid length. [ 702.531028][T25115] netlink: 'syz.3.5141': attribute type 83 has an invalid length. [ 702.849942][T25135] ip6t_rpfilter: unknown options [ 703.360392][T25161] workqueue: Failed to create a rescuer kthread for wq "bond9": -EINTR [ 703.675127][T25183] netlink: 'syz.0.5160': attribute type 2 has an invalid length. [ 703.740108][T25187] netlink: 'syz.4.5161': attribute type 1 has an invalid length. [ 703.752642][T25183] 9: entered promiscuous mode [ 703.851326][T25187] 8021q: adding VLAN 0 to HW filter on device bond7 [ 703.916323][T25191] bond7: (slave gretap2): making interface the new active one [ 703.962939][T25191] bond7: (slave gretap2): Enslaving as an active interface with an up link [ 704.107921][T25206] __nla_validate_parse: 3 callbacks suppressed [ 704.107940][T25206] netlink: 108 bytes leftover after parsing attributes in process `syz.3.5164'. [ 704.128866][T25205] netlink: 12 bytes leftover after parsing attributes in process `syz.1.5165'. [ 704.161972][T25198] syzkaller0: entered promiscuous mode [ 704.182397][T25198] syzkaller0: entered allmulticast mode [ 704.208991][T25201] syzkaller1: entered promiscuous mode [ 704.214879][T25201] syzkaller1: entered allmulticast mode [ 704.260689][T25211] netlink: 212348 bytes leftover after parsing attributes in process `syz.4.5168'. [ 706.521458][T25249] netlink: 81 bytes leftover after parsing attributes in process `syz.3.5180'. [ 706.531536][T25251] netlink: 'syz.2.5181': attribute type 9 has an invalid length. [ 706.541488][T25241] netlink: 12 bytes leftover after parsing attributes in process `syz.0.5178'. [ 706.573140][T25248] netlink: 'syz.3.5180': attribute type 1 has an invalid length. [ 706.581241][T25248] netlink: 'syz.3.5180': attribute type 11 has an invalid length. [ 706.590705][T25248] netlink: 224 bytes leftover after parsing attributes in process `syz.3.5180'. [ 706.713965][T25245] netlink: 'syz.1.5177': attribute type 4 has an invalid length. [ 706.929685][T25274] netlink: 33 bytes leftover after parsing attributes in process `syz.3.5186'. [ 707.006745][T25277] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5187'. [ 707.090350][T25280] syzkaller1: entered promiscuous mode [ 707.099162][T25280] syzkaller1: entered allmulticast mode [ 707.229102][T25288] syzkaller0: entered promiscuous mode [ 707.234651][T25288] syzkaller0: entered allmulticast mode [ 707.271443][T25238] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 707.334210][T25294] netlink: 'syz.2.5192': attribute type 75 has an invalid length. [ 707.712612][T25317] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5200'. [ 707.836549][T25329] syzkaller1: entered promiscuous mode [ 707.843478][T25329] syzkaller1: entered allmulticast mode [ 708.142406][ T6187] bond0: (slave bridge_slave_1): interface is now down [ 708.154957][T25350] netlink: 'syz.4.5209': attribute type 10 has an invalid length. [ 708.169289][ T135] bond0: (slave bridge_slave_1): interface is now down [ 708.176852][T25350] syz_tun: entered promiscuous mode [ 708.191536][ T135] bond0: (slave bridge_slave_1): interface is now down [ 708.201900][T25350] bond0: (slave syz_tun): Enslaving as an active interface with an up link [ 708.218697][T25352] syzkaller0: entered allmulticast mode [ 708.219663][ T13] bond0: (slave bridge_slave_1): interface is now down [ 708.240259][T25356] netlink: 108 bytes leftover after parsing attributes in process `syz.2.5208'. [ 708.256866][ T13] bond0: (slave syz_tun): interface is now down [ 708.278644][ T135] bond0: (slave bridge_slave_1): interface is now down [ 708.286421][ T135] bond0: (slave syz_tun): interface is now down [ 708.318621][ T135] bond0: (slave bridge_slave_1): interface is now down [ 708.351325][ T135] bond0: (slave syz_tun): interface is now down [ 708.384551][ T135] bond0: now running without any active interface! [ 708.563965][T25377] netlink: 'syz.3.5218': attribute type 29 has an invalid length. [ 708.574882][T25377] netlink: 'syz.3.5218': attribute type 29 has an invalid length. [ 708.633390][T25381] sctp: [Deprecated]: syz.4.5217 (pid 25381) Use of struct sctp_assoc_value in delayed_ack socket option. [ 708.633390][T25381] Use struct sctp_sack_info instead [ 709.491423][T25432] openvswitch: netlink: nsh attribute has 2 unknown bytes. [ 709.709027][T25444] netlink: 'syz.3.5233': attribute type 1 has an invalid length. [ 709.862553][T25450] syzkaller0: entered promiscuous mode [ 709.878720][T25450] syzkaller0: entered allmulticast mode [ 710.180679][T25455] syzkaller1: entered promiscuous mode [ 710.196515][T25455] syzkaller1: entered allmulticast mode [ 710.992807][T25490] Cannot find del_set index 4 as target [ 711.032657][T25492] __nla_validate_parse: 2 callbacks suppressed [ 711.032678][T25492] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5249'. [ 711.258807][T25505] syzkaller1: entered promiscuous mode [ 711.289246][T25505] syzkaller1: entered allmulticast mode [ 711.501764][T16918] Bluetooth: hci4: command 0x0406 tx timeout [ 711.675519][T25527] netlink: 52 bytes leftover after parsing attributes in process `syz.0.5258'. [ 711.771355][T25534] netlink: 72 bytes leftover after parsing attributes in process `syz.3.5261'. [ 711.821647][T25534] netlink: 28 bytes leftover after parsing attributes in process `syz.3.5261'. [ 712.127211][T25550] netlink: 16 bytes leftover after parsing attributes in process `syz.3.5264'. [ 712.158380][T25550] netlink: 13 bytes leftover after parsing attributes in process `syz.3.5264'. [ 712.257879][T25550] veth9: entered promiscuous mode [ 712.479063][T25569] syzkaller1: entered promiscuous mode [ 712.490095][T25569] syzkaller1: entered allmulticast mode [ 712.546800][T25572] netlink: 24 bytes leftover after parsing attributes in process `syz.3.5269'. [ 712.872870][T25593] netlink: 96 bytes leftover after parsing attributes in process `syz.1.5275'. [ 713.013516][T25607] netlink: 232 bytes leftover after parsing attributes in process `syz.2.5281'. [ 713.051838][T25605] netlink: 'syz.3.5279': attribute type 3 has an invalid length. [ 713.082703][T25597] netlink: 4 bytes leftover after parsing attributes in process `syz.3.5279'. [ 713.200084][T25612] netlink: 'syz.1.5282': attribute type 4 has an invalid length. [ 713.290762][T25618] syzkaller1: entered promiscuous mode [ 713.296643][T25618] syzkaller1: entered allmulticast mode [ 713.577147][T25636] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 713.863082][T25642] netlink: 'syz.2.5291': attribute type 3 has an invalid length. [ 714.208016][T25668] syzkaller1: entered promiscuous mode [ 714.228842][T25668] syzkaller1: entered allmulticast mode [ 714.529901][T25681] netlink: 'syz.1.5305': attribute type 1 has an invalid length. [ 714.764497][T25699] syzkaller0: entered promiscuous mode [ 714.773785][T25699] syzkaller0: entered allmulticast mode [ 715.043682][T25661] llcp: nfc_llcp_send_ui_frame: Could not allocate PDU (error=-512) [ 715.054121][T25661] llcp: nfc_llcp_send_ui_frame: Could not allocate PDU (error=-512) [ 715.145447][T25717] netlink: 'syz.4.5315': attribute type 1 has an invalid length. [ 715.183742][T25717] workqueue: Failed to create a rescuer kthread for wq "bond8": -EINTR [ 715.521283][T25733] gretap1: entered promiscuous mode [ 715.539269][T25733] gretap1: entered allmulticast mode [ 716.166760][T25769] syzkaller1: entered promiscuous mode [ 716.183861][T25769] syzkaller1: entered allmulticast mode [ 716.285829][T25774] vlan4: entered allmulticast mode [ 716.294302][T25774] bond0: entered allmulticast mode [ 716.313171][T25780] __nla_validate_parse: 27 callbacks suppressed [ 716.313193][T25780] netlink: 14 bytes leftover after parsing attributes in process `syz.1.5336'. [ 717.214789][T25831] syzkaller1: entered promiscuous mode [ 717.221392][T25831] syzkaller1: entered allmulticast mode [ 717.361003][T25845] 8021q: VLANs not supported on pim6reg [ 717.453293][T25851] ip6t_REJECT: TCP_RESET illegal for non-tcp [ 717.792316][T25873] IPVS: Unknown mcast interface: nicvf0 [ 717.805098][T25874] netlink: 'syz.3.5364': attribute type 4 has an invalid length. [ 717.821160][T25874] netlink: 'syz.3.5364': attribute type 4 has an invalid length. [ 717.912052][T25882] netlink: 32 bytes leftover after parsing attributes in process `syz.4.5366'. [ 718.199908][T25897] netlink: 12 bytes leftover after parsing attributes in process `syz.1.5369'. [ 718.254232][T25897] netlink: 12 bytes leftover after parsing attributes in process `syz.1.5369'. [ 718.276005][T25897] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5369'. [ 719.139675][T25947] bond1: option mode: unable to set because the bond device has slaves [ 719.479279][T25974] netlink: 'syz.2.5390': attribute type 16 has an invalid length. [ 719.529832][T25974] netlink: 20 bytes leftover after parsing attributes in process `syz.2.5390'. [ 719.710876][T25981] syzkaller0: entered promiscuous mode [ 719.719635][T25981] syzkaller0: entered allmulticast mode [ 719.947435][T25998] netlink: 28 bytes leftover after parsing attributes in process `syz.0.5397'. [ 720.069878][T26004] xt_hashlimit: invalid rate [ 720.074914][T26007] netlink: 596 bytes leftover after parsing attributes in process `syz.3.5400'. [ 720.216461][T26015] nbd: couldn't find a device at index 0 [ 720.473120][T26033] netlink: 'syz.2.5410': attribute type 1 has an invalid length. [ 720.523150][T26038] netlink: 80 bytes leftover after parsing attributes in process `syz.1.5412'. [ 720.580091][T26039] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 720.621767][T26039] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 720.644950][T26039] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 720.780990][ T51] Bluetooth: hci4: command 0x0406 tx timeout [ 720.810044][T26055] netlink: 212 bytes leftover after parsing attributes in process `syz.1.5416'. [ 721.315891][T26091] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not filter [ 721.346730][T26092] nbd: couldn't find a device at index 0 [ 721.520208][T26097] netlink: 4 bytes leftover after parsing attributes in process `syz.3.5431'. [ 721.668775][T26112] netlink: 24 bytes leftover after parsing attributes in process `syz.2.5436'. [ 721.781267][T26118] netlink: 148 bytes leftover after parsing attributes in process `syz.3.5439'. [ 721.820200][T26112] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5436'. [ 721.995205][T26135] netlink: 176 bytes leftover after parsing attributes in process `syz.4.5440'. [ 722.019091][T26135] netlink: 32 bytes leftover after parsing attributes in process `syz.4.5440'. [ 722.159368][T26139] syzkaller0: entered promiscuous mode [ 722.162367][T26143] IPVS: length: 24 != 312 [ 722.258584][T26146] bridge4: trying to set multicast query interval below minimum, setting to 100 (1000ms) [ 722.349057][T26150] netlink: 224 bytes leftover after parsing attributes in process `syz.1.5449'. [ 722.560498][T26159] netlink: 'syz.3.5451': attribute type 1 has an invalid length. [ 722.568960][T26161] netlink: 'syz.1.5453': attribute type 1 has an invalid length. [ 722.587082][T26159] netlink: 'syz.3.5451': attribute type 2 has an invalid length. [ 722.972595][T26175] nbd5: detected capacity change from 0 to 127 [ 723.005985][T26184] netlink: 212368 bytes leftover after parsing attributes in process `syz.1.5457'. [ 723.686106][ T51] block nbd5: Receive control failed (result -104) [ 724.286351][T26216] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5459'. [ 724.304270][T26216] netlink: 12 bytes leftover after parsing attributes in process `syz.4.5459'. [ 725.125174][T26215] workqueue: Failed to create a rescuer kthread for wq "bond8": -EINTR [ 725.892966][T26263] nbd: couldn't find a device at index 0 [ 726.073124][T26273] netlink: 'syz.4.5473': attribute type 1 has an invalid length. [ 726.175332][T26273] bond8: entered promiscuous mode [ 726.188047][T26273] 8021q: adding VLAN 0 to HW filter on device bond8 [ 726.843136][T26312] bond9 (unregistering): Released all slaves [ 726.904717][T26327] __nla_validate_parse: 4 callbacks suppressed [ 726.904738][T26327] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5487'. [ 726.978989][T26327] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5487'. [ 726.992510][T26327] netlink: 'syz.2.5487': attribute type 3 has an invalid length. [ 727.191839][T26346] netlink: 212368 bytes leftover after parsing attributes in process `syz.1.5493'. [ 727.232235][T26347] netlink: 'syz.2.5490': attribute type 1 has an invalid length. [ 727.270812][T26350] netlink: 12 bytes leftover after parsing attributes in process `syz.4.5494'. [ 727.363604][T26347] 8021q: adding VLAN 0 to HW filter on device bond10 [ 727.472130][T26351] bond10: (slave geneve5): making interface the new active one [ 727.482828][T26351] bond10: (slave geneve5): Enslaving as an active interface with an up link [ 727.552589][T26359] netlink: 36 bytes leftover after parsing attributes in process `syz.4.5496'. [ 727.610994][T26366] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5497'. [ 728.111226][T26386] syzkaller0: entered promiscuous mode [ 728.116929][T26386] syzkaller0: entered allmulticast mode [ 728.131050][T26389] netlink: 'syz.2.5506': attribute type 4 has an invalid length. [ 728.142001][T26388] netlink: 48 bytes leftover after parsing attributes in process `syz.3.5504'. [ 728.359262][T26405] netlink: 36 bytes leftover after parsing attributes in process `syz.2.5509'. [ 728.552498][T26412] netlink: 64 bytes leftover after parsing attributes in process `syz.2.5513'. [ 728.660024][T26417] netlink: 'syz.2.5514': attribute type 2 has an invalid length. [ 730.366247][T26414] netlink: 'syz.1.5512': attribute type 22 has an invalid length. [ 730.375862][T26420] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5515'. [ 730.400403][T26414] netlink: 'syz.1.5512': attribute type 22 has an invalid length. [ 730.801903][T26444] syzkaller1: entered promiscuous mode [ 730.835675][T26444] syzkaller1: entered allmulticast mode [ 731.209365][T26458] netlink: 'syz.3.5528': attribute type 1 has an invalid length. [ 731.306615][T26458] 8021q: adding VLAN 0 to HW filter on device bond11 [ 731.445884][T26461] bond11: (slave veth11): Enslaving as an active interface with a down link [ 731.472973][T26458] bond11: (slave veth0_to_bond): Enslaving as an active interface with a down link [ 731.530448][T26463] bond11: (slave veth13): Enslaving as an active interface with a down link [ 731.542292][T26463] netlink: 'syz.3.5528': attribute type 1 has an invalid length. [ 731.551743][T26463] netlink: 'syz.3.5528': attribute type 2 has an invalid length. [ 731.567932][T26472] FAULT_INJECTION: forcing a failure. [ 731.567932][T26472] name failslab, interval 1, probability 0, space 0, times 0 [ 731.653359][T26472] CPU: 0 UID: 0 PID: 26472 Comm: syz.4.5531 Not tainted syzkaller #0 PREEMPT(full) [ 731.653389][T26472] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 731.653400][T26472] Call Trace: [ 731.653408][T26472] [ 731.653415][T26472] dump_stack_lvl+0xe8/0x150 [ 731.653448][T26472] should_fail_ex+0x412/0x560 [ 731.653484][T26472] should_failslab+0xa8/0x100 [ 731.653512][T26472] kmem_cache_alloc_node_noprof+0x8f/0x690 [ 731.653535][T26472] ? __alloc_skb+0x186/0x7d0 [ 731.653556][T26472] ? __alloc_skb+0x1d0/0x7d0 [ 731.653574][T26472] ? __local_bh_enable_ip+0xd0/0x130 [ 731.653614][T26472] __alloc_skb+0x1d0/0x7d0 [ 731.653639][T26472] netlink_sendmsg+0x5d4/0xb40 [ 731.653671][T26472] ? __pfx_netlink_sendmsg+0x10/0x10 [ 731.653695][T26472] ? aa_sock_msg_perm+0xf1/0x1b0 [ 731.653723][T26472] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 731.653747][T26472] ____sys_sendmsg+0x972/0x9f0 [ 731.653781][T26472] ? __pfx_____sys_sendmsg+0x10/0x10 [ 731.653816][T26472] ? import_iovec+0x73/0xa0 [ 731.653843][T26472] ___sys_sendmsg+0x2a5/0x360 [ 731.653874][T26472] ? __pfx____sys_sendmsg+0x10/0x10 [ 731.653939][T26472] ? __fget_files+0x2a/0x420 [ 731.653957][T26472] ? __fget_files+0x3a0/0x420 [ 731.653987][T26472] __x64_sys_sendmsg+0x1bd/0x2a0 [ 731.654015][T26472] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 731.654050][T26472] ? __pfx_ksys_write+0x10/0x10 [ 731.654086][T26472] do_syscall_64+0x14d/0xf80 [ 731.654110][T26472] ? trace_irq_disable+0x3b/0x150 [ 731.654128][T26472] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 731.654147][T26472] ? clear_bhb_loop+0x40/0x90 [ 731.654183][T26472] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 731.654202][T26472] RIP: 0033:0x7f72c6d9c819 [ 731.654222][T26472] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 731.654238][T26472] RSP: 002b:00007f72c7be1028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 731.654261][T26472] RAX: ffffffffffffffda RBX: 00007f72c7016180 RCX: 00007f72c6d9c819 [ 731.654275][T26472] RDX: 0000000000004000 RSI: 00002000000003c0 RDI: 0000000000000004 [ 731.654287][T26472] RBP: 00007f72c7be1090 R08: 0000000000000000 R09: 0000000000000000 [ 731.654299][T26472] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 731.654310][T26472] R13: 00007f72c7016218 R14: 00007f72c7016180 R15: 00007ffdd4e46cd8 [ 731.654343][T26472] [ 732.212998][T26494] syzkaller1: entered promiscuous mode [ 732.227603][T26494] syzkaller1: entered allmulticast mode [ 732.451089][T26504] __nla_validate_parse: 3 callbacks suppressed [ 732.451113][T26504] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5541'. [ 732.473703][T26504] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5541'. [ 732.483371][T26504] netlink: 20 bytes leftover after parsing attributes in process `syz.4.5541'. [ 732.495111][T26504] netlink: 212368 bytes leftover after parsing attributes in process `syz.4.5541'. [ 732.534590][T26504] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5541'. [ 732.564310][T26514] netlink: 'syz.2.5544': attribute type 3 has an invalid length. [ 732.577279][T26517] netlink: 24 bytes leftover after parsing attributes in process `syz.0.5542'. [ 732.586898][T26517] IPv6: NLM_F_CREATE should be specified when creating new route [ 732.598898][T26516] netlink: 'syz.2.5544': attribute type 3 has an invalid length. [ 732.611298][T26519] syz_tun: entered allmulticast mode [ 732.621114][T26520] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 732.645611][T26517] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 732.652933][T26517] IPv6: NLM_F_CREATE should be set when creating new route [ 732.660251][T26517] IPv6: NLM_F_CREATE should be set when creating new route [ 732.713282][T26518] syz_tun: left allmulticast mode [ 732.716029][T26526] openvswitch: netlink: IP tunnel dst address not specified [ 732.786715][T26531] xt_recent: hitcount (4294901760) is larger than allowed maximum (65535) [ 732.806322][T26532] netlink: 'syz.1.5549': attribute type 3 has an invalid length. [ 732.814462][T26532] netlink: 224 bytes leftover after parsing attributes in process `syz.1.5549'. [ 732.846567][T26534] netlink: 64 bytes leftover after parsing attributes in process `syz.3.5546'. [ 732.867696][T26534] netlink: 16 bytes leftover after parsing attributes in process `syz.3.5546'. [ 732.883339][T26534] netlink: 16 bytes leftover after parsing attributes in process `syz.3.5546'. [ 733.104327][T26551] syzkaller1: entered promiscuous mode [ 733.113559][T26551] syzkaller1: entered allmulticast mode [ 733.345970][T26564] openvswitch: netlink: Key type 3841 is out of range max 32 [ 733.527098][T26575] netlink: 'syz.1.5564': attribute type 9 has an invalid length. [ 733.562098][T26575] netlink: 'syz.1.5564': attribute type 11 has an invalid length. [ 733.570947][T26575] netlink: 'syz.1.5564': attribute type 12 has an invalid length. [ 733.644490][T26588] netlink: 'syz.3.5566': attribute type 1 has an invalid length. [ 733.653821][T26580] syzkaller1: entered promiscuous mode [ 733.660894][T26580] syzkaller1: entered allmulticast mode [ 734.415910][T26638] syzkaller1: entered promiscuous mode [ 734.431120][T26638] syzkaller1: entered allmulticast mode [ 734.650123][T26644] team0 (unregistering): Port device team_slave_0 removed [ 734.684329][T26644] team0 (unregistering): Port device team_slave_1 removed [ 734.728727][ T29] audit: type=1800 audit(1775198769.594:4): pid=26650 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.5586" name="memory.events" dev="tmpfs" ino=2343 res=0 errno=0 [ 734.751279][ T29] audit: type=1804 audit(1775198769.604:5): pid=26650 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.2.5586" name="/newroot/456/memory.events" dev="tmpfs" ino=2343 res=1 errno=0 [ 734.950083][T26658] syzkaller0: entered promiscuous mode [ 734.955726][T26658] syzkaller0: entered allmulticast mode [ 735.115135][T26667] 8021q: VLANs not supported on wlan0 [ 735.174271][T26672] syzkaller0: entered promiscuous mode [ 735.181370][T26672] syzkaller0: entered allmulticast mode [ 735.194304][T26672] xt_ipcomp: unknown flags 1D [ 735.326746][T26679] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 737.754231][T26713] __nla_validate_parse: 11 callbacks suppressed [ 737.754253][T26713] netlink: 108 bytes leftover after parsing attributes in process `syz.0.5606'. [ 737.772892][T26713] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5606'. [ 737.874172][T26722] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5607'. [ 737.951085][T26724] wlan1 speed is unknown, defaulting to 1000 [ 738.000522][T26733] openvswitch: netlink: nsh attribute has 4 unknown bytes. [ 738.053374][T26733] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 738.247947][T26749] netlink: 36 bytes leftover after parsing attributes in process `syz.0.5616'. [ 738.314318][T26752] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5616'. [ 738.421619][T26760] netlink: 76 bytes leftover after parsing attributes in process `syz.2.5618'. [ 738.524438][T26760] syzkaller0: entered promiscuous mode [ 738.531493][T26760] syzkaller0: entered allmulticast mode [ 738.548334][T26724] wg1 speed is unknown, defaulting to 1000 [ 738.816041][T26782] netlink: 'syz.1.5624': attribute type 11 has an invalid length. [ 738.824775][T26782] netlink: 224 bytes leftover after parsing attributes in process `syz.1.5624'. [ 739.187300][T26789] netlink: 12 bytes leftover after parsing attributes in process `syz.0.5626'. [ 740.551810][T26785] sysfs: cannot create duplicate filename '/class/ieee80211/Ku crK:̥B| lS-!' [ 740.576197][T26785] CPU: 0 UID: 0 PID: 26785 Comm: syz.0.5626 Not tainted syzkaller #0 PREEMPT(full) [ 740.576227][T26785] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 740.576240][T26785] Call Trace: [ 740.576248][T26785] [ 740.576257][T26785] dump_stack_lvl+0xe8/0x150 [ 740.576292][T26785] sysfs_warn_dup+0x8e/0xa0 [ 740.576316][T26785] sysfs_do_create_link_sd+0xc0/0x110 [ 740.576344][T26785] device_add_class_symlinks+0x1cf/0x240 [ 740.576369][T26785] device_add+0x475/0xb70 [ 740.576393][T26785] wiphy_register+0x1d73/0x2d50 [ 740.576425][T26785] ? __pfx_wiphy_register+0x10/0x10 [ 740.576440][T26785] ? __pfx_netdev_run_todo+0x10/0x10 [ 740.576461][T26785] ? minstrel_ht_alloc+0x6e0/0x7e0 [ 740.576491][T26785] ? ieee80211_init_rate_ctrl_alg+0x55d/0x5d0 [ 740.576517][T26785] ieee80211_register_hw+0x3562/0x4200 [ 740.576552][T26785] ? ieee80211_register_hw+0x14d1/0x4200 [ 740.576584][T26785] ? __pfx_ieee80211_register_hw+0x10/0x10 [ 740.576622][T26785] ? __hrtimer_setup+0x181/0x200 [ 740.576644][T26785] ? __pfx_mac80211_hwsim_beacon+0x10/0x10 [ 740.576672][T26785] mac80211_hwsim_new_radio+0x2f97/0x5330 [ 740.576722][T26785] ? __pfx_mac80211_hwsim_new_radio+0x10/0x10 [ 740.576741][T26785] ? kstrndup+0xbf/0x160 [ 740.576770][T26785] hwsim_new_radio_nl+0xf35/0x1bd0 [ 740.576813][T26785] ? __pfx_hwsim_new_radio_nl+0x10/0x10 [ 740.576842][T26785] ? rcu_is_watching+0x15/0xb0 [ 740.576864][T26785] ? trace_kmalloc+0x2a/0x110 [ 740.576887][T26785] ? __nla_parse+0x40/0x60 [ 740.576908][T26785] ? genl_family_rcv_msg_attrs_parse+0x1c9/0x2a0 [ 740.576937][T26785] genl_family_rcv_msg_doit+0x22a/0x330 [ 740.576963][T26785] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 740.576995][T26785] ? bpf_lsm_capable+0x9/0x20 [ 740.577015][T26785] ? security_capable+0x7e/0x2c0 [ 740.577044][T26785] genl_rcv_msg+0x61c/0x7a0 [ 740.577078][T26785] ? __pfx_genl_rcv_msg+0x10/0x10 [ 740.577096][T26785] ? __pfx_hwsim_new_radio_nl+0x10/0x10 [ 740.577117][T26785] ? __lock_acquire+0x6b5/0x2cf0 [ 740.577148][T26785] netlink_rcv_skb+0x232/0x4b0 [ 740.577164][T26785] ? __pfx_genl_rcv_msg+0x10/0x10 [ 740.577185][T26785] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 740.577218][T26785] ? down_read+0x272/0x2e0 [ 740.577238][T26785] ? genl_rcv+0xd/0x40 [ 740.577258][T26785] genl_rcv+0x28/0x40 [ 740.577276][T26785] netlink_unicast+0x80f/0x9b0 [ 740.577309][T26785] ? __pfx_netlink_unicast+0x10/0x10 [ 740.577330][T26785] ? __kvmalloc_node_noprof+0x393/0x8a0 [ 740.577350][T26785] ? netlink_sendmsg+0x650/0xb40 [ 740.577364][T26785] ? skb_put+0x11b/0x210 [ 740.577386][T26785] netlink_sendmsg+0x813/0xb40 [ 740.577411][T26785] ? __pfx_netlink_sendmsg+0x10/0x10 [ 740.577430][T26785] ? aa_sock_msg_perm+0xf1/0x1b0 [ 740.577455][T26785] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 740.577475][T26785] ____sys_sendmsg+0x972/0x9f0 [ 740.577493][T26785] ? futex_unqueue+0x211/0x240 [ 740.577518][T26785] ? __pfx_____sys_sendmsg+0x10/0x10 [ 740.577547][T26785] ? import_iovec+0x73/0xa0 [ 740.577569][T26785] ___sys_sendmsg+0x2a5/0x360 [ 740.577594][T26785] ? __pfx____sys_sendmsg+0x10/0x10 [ 740.577619][T26785] ? futex_wait+0x29a/0x380 [ 740.577667][T26785] ? __fget_files+0x2a/0x420 [ 740.577680][T26785] ? __fget_files+0x3a0/0x420 [ 740.577704][T26785] __x64_sys_sendmsg+0x1bd/0x2a0 [ 740.577726][T26785] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 740.577754][T26785] ? rcu_is_watching+0x15/0xb0 [ 740.577788][T26785] do_syscall_64+0x14d/0xf80 [ 740.577806][T26785] ? trace_irq_disable+0x3b/0x150 [ 740.577819][T26785] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 740.577835][T26785] ? clear_bhb_loop+0x40/0x90 [ 740.577854][T26785] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 740.577869][T26785] RIP: 0033:0x7f58c899c819 [ 740.577885][T26785] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 740.577898][T26785] RSP: 002b:00007f58c9845028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 740.577916][T26785] RAX: ffffffffffffffda RBX: 00007f58c8c15fa0 RCX: 00007f58c899c819 [ 740.577927][T26785] RDX: 0000000000000010 RSI: 0000200000000100 RDI: 0000000000000003 [ 740.577937][T26785] RBP: 00007f58c8a32c91 R08: 0000000000000000 R09: 0000000000000000 [ 740.577946][T26785] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 740.577955][T26785] R13: 00007f58c8c16038 R14: 00007f58c8c15fa0 R15: 00007fff0da69fa8 [ 740.577982][T26785] [ 741.151291][T26794] bond12: option min_links: invalid value (18446744073709551614) [ 741.181972][T26794] bond12: option min_links: allowed values 0 - 2147483647 [ 741.223796][T26794] bond12 (unregistering): Released all slaves [ 741.260869][T26800] can: request_module (can-proto-0) failed. [ 741.340576][T26808] netlink: 52 bytes leftover after parsing attributes in process `syz.0.5631'. [ 741.350421][T26808] netlink: 12 bytes leftover after parsing attributes in process `syz.0.5631'. [ 741.600552][T26820] openvswitch: netlink: IP tunnel TTL not specified. [ 741.951566][T26847] netlink: 'syz.3.5643': attribute type 10 has an invalid length. [ 742.053934][T26851] x_tables: duplicate underflow at hook 1 [ 742.294547][T26864] macvlan0: entered promiscuous mode [ 742.403695][T26874] netdevsim netdevsim0: Direct firmware load for ..  failed with error -2 [ 742.414520][T26874] netdevsim netdevsim0: Falling back to sysfs fallback for: ..  [ 742.475496][T26878] openvswitch: netlink: Unexpected mask (mask=40040, allowed=10048) [ 742.884998][T26900] __nla_validate_parse: 3 callbacks suppressed [ 742.885020][T26900] netlink: 7 bytes leftover after parsing attributes in process `syz.1.5663'. [ 742.964549][T26900] netlink: 'syz.1.5663': attribute type 4 has an invalid length. [ 742.989923][T26903] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 743.219909][T26898] bridge0: port 3(dummy0) entered disabled state [ 743.226530][T26898] bridge0: port 2(bridge_slave_1) entered disabled state [ 743.234269][T26898] bridge0: port 1(bridge_slave_0) entered disabled state [ 743.729291][T26923] netlink: 76 bytes leftover after parsing attributes in process `syz.2.5669'. [ 743.732515][T26898] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 744.222326][ T135] netdevsim netdevsim1 eth0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 744.248589][ T135] netdevsim netdevsim1 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 744.264430][ T135] netdevsim netdevsim1 eth1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 744.277076][ T135] netdevsim netdevsim1 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 744.310064][ T135] netdevsim netdevsim1 eth2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 744.340597][ T135] netdevsim netdevsim1 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 744.360891][ T135] netdevsim netdevsim1 eth3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 744.381994][ T135] netdevsim netdevsim1 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 744.885204][T26959] netdevsim netdevsim3 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 744.916561][T26959] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 744.970438][T26964] netlink: 'syz.0.5682': attribute type 5 has an invalid length. [ 744.989361][T26964] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5682'. [ 744.990919][T26970] IPv6: NLM_F_CREATE should be specified when creating new route [ 745.000989][ T9943] lec:lec_start_xmit: lec0:No lecd attached [ 745.112167][T26959] netdevsim netdevsim3 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 745.143034][T26959] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 745.290719][T26959] netdevsim netdevsim3 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 745.305154][T26959] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 745.379469][T26977] netlink: 4 bytes leftover after parsing attributes in process `syz.4.5684'. [ 745.429780][T26974] syzkaller1: entered promiscuous mode [ 745.435401][T26974] syzkaller1: entered allmulticast mode [ 745.532850][T26959] netdevsim netdevsim3 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 745.559976][T26959] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 745.735525][T26987] netlink: 'syz.2.5688': attribute type 1 has an invalid length. [ 745.819037][T26987] 8021q: adding VLAN 0 to HW filter on device bond11 [ 745.902728][T26991] bond11: (slave veth0_to_bond): making interface the new active one [ 745.902948][T26996] netlink: 212368 bytes leftover after parsing attributes in process `syz.4.5690'. [ 745.927931][T26991] bond11: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 745.947775][T26987] bond11: entered promiscuous mode [ 745.967980][T26987] veth0_to_bond: entered promiscuous mode [ 745.979267][T26987] bond11: entered allmulticast mode [ 745.984655][T26987] veth0_to_bond: entered allmulticast mode [ 746.314311][T27011] netlink: 224 bytes leftover after parsing attributes in process `syz.2.5693'. [ 746.359272][T27013] netlink: 'syz.1.5694': attribute type 4 has an invalid length. [ 746.370146][T27013] netlink: 'syz.1.5694': attribute type 1 has an invalid length. [ 746.378015][T27013] netlink: 228 bytes leftover after parsing attributes in process `syz.1.5694'. [ 746.556714][T27029] syzkaller1: entered promiscuous mode [ 746.585322][T27029] syzkaller1: entered allmulticast mode [ 746.718277][T27043] netlink: 36 bytes leftover after parsing attributes in process `syz.1.5702'. [ 746.787118][T27046] xt_CT: You must specify a L4 protocol and not use inversions on it [ 747.036656][T27059] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5707'. [ 747.102428][T27066] openvswitch: netlink: IP tunnel attribute has 4 unknown bytes. [ 747.130358][T27066] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 747.188787][T27069] netlink: 28 bytes leftover after parsing attributes in process `syz.3.5711'. [ 747.227800][T27071] netlink: 'syz.4.5710': attribute type 21 has an invalid length. [ 747.249203][T27073] openvswitch: netlink: Key 32 has unexpected len 4 expected 2 [ 747.254889][T27071] netlink: 'syz.4.5710': attribute type 5 has an invalid length. [ 747.290110][T27071] netlink: 'syz.4.5710': attribute type 1 has an invalid length. [ 747.414352][T27083] openvswitch: netlink: Unexpected mask (mask=240, allowed=10048) [ 747.582753][ T1302] aoe: packet could not be sent on bond0. consider increasing tx_queue_len [ 747.803587][T27105] netlink: 'syz.4.5722': attribute type 4 has an invalid length. [ 747.832392][T27107] x_tables: duplicate underflow at hook 1 [ 747.849515][T27107] x_tables: duplicate underflow at hook 1 [ 747.867367][T27105] netlink: 'syz.4.5722': attribute type 4 has an invalid length. [ 747.879898][T27107] x_tables: duplicate underflow at hook 3 [ 747.887510][T27107] ipvlan0: mtu less than device minimum [ 748.005501][T27117] xt_addrtype: input interface limitation not valid in POSTROUTING and OUTPUT [ 748.133149][T27121] netlink: zone id is out of range [ 748.162693][T27121] netlink: zone id is out of range [ 748.181767][T27121] netlink: zone id is out of range [ 748.194838][T27121] netlink: zone id is out of range [ 748.369818][T27132] netlink: 'syz.2.5727': attribute type 1 has an invalid length. [ 748.378469][T27132] __nla_validate_parse: 5 callbacks suppressed [ 748.378489][T27132] netlink: 224 bytes leftover after parsing attributes in process `syz.2.5727'. [ 748.406980][T27138] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 748.421598][T27139] tipc: Started in network mode [ 748.426524][T27139] tipc: Node identity ac141441, cluster identity 5 [ 748.453390][T27139] tipc: Enabled bearer , priority 10 [ 748.466546][T27140] tipc: Enabling of bearer rejected, already enabled [ 748.849333][T27163] netlink: 132 bytes leftover after parsing attributes in process `syz.0.5735'. [ 748.893836][T27166] netlink: 4 bytes leftover after parsing attributes in process `syz.3.5736'. [ 749.280616][T27186] syzkaller0: entered promiscuous mode [ 749.288303][T27199] xt_hashlimit: size too large, truncated to 1048576 [ 749.296805][T27186] syzkaller0: entered allmulticast mode [ 749.429817][T27209] netlink: 212368 bytes leftover after parsing attributes in process `syz.2.5745'. [ 750.223548][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5210 ms [ 750.231622][ C1] lec:lec_tx_timeout: lec0 [ 750.236259][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 751.396421][T21608] tipc: Node number set to 2886997057 [ 751.410928][T27219] 8021q: VLANs not supported on wg1 [ 751.564473][T27236] netlink: 'syz.4.5756': attribute type 1 has an invalid length. [ 751.614100][T27236] netlink: 4 bytes leftover after parsing attributes in process `syz.4.5756'. [ 751.682564][T27243] netlink: 24 bytes leftover after parsing attributes in process `syz.0.5758'. [ 751.827228][T27255] netlink: 'syz.2.5763': attribute type 2 has an invalid length. [ 751.872131][T27268] x_tables: duplicate underflow at hook 4 [ 751.923476][T27268] netlink: 104 bytes leftover after parsing attributes in process `syz.1.5766'. [ 752.135589][T27279] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5769'. [ 752.276367][T27286] netlink: 28 bytes leftover after parsing attributes in process `syz.1.5771'. [ 752.286688][T27286] netlink: 'syz.1.5771': attribute type 7 has an invalid length. [ 752.295438][T27286] netlink: 'syz.1.5771': attribute type 8 has an invalid length. [ 752.326414][T27286] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5771'. [ 752.362600][T27286] netlink: 'syz.1.5771': attribute type 9 has an invalid length. [ 752.436754][T27294] bond9 (unregistering): Released all slaves [ 752.702209][T27309] netlink: 'syz.4.5780': attribute type 9 has an invalid length. [ 752.764345][T27314] netlink: 'syz.0.5783': attribute type 1 has an invalid length. [ 752.815593][T27312] vlan2: entered promiscuous mode [ 752.825409][T27312] gretap0: entered promiscuous mode [ 753.031705][T27327] syzkaller0: entered promiscuous mode [ 753.047547][T27327] syzkaller0: entered allmulticast mode [ 753.061530][T27327] netlink: 'syz.4.5786': attribute type 2 has an invalid length. [ 753.340695][T21385] block nbd5: Possible stuck request ffff888027160000: control (read@0,1024B). Runtime 30 seconds [ 753.352860][T21385] block nbd5: Possible stuck request ffff888027160200: control (read@1024,1024B). Runtime 30 seconds [ 753.367497][T21385] block nbd5: Possible stuck request ffff888027160400: control (read@2048,1024B). Runtime 30 seconds [ 753.378766][T21385] block nbd5: Possible stuck request ffff888027160600: control (read@3072,1024B). Runtime 30 seconds [ 753.420813][T16918] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 753.431220][T16918] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 753.440561][T16918] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 753.450861][T16918] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 753.458878][T16918] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 753.526443][T27337] wlan1 speed is unknown, defaulting to 1000 [ 753.538042][T27340] netlink: 'syz.2.5793': attribute type 4 has an invalid length. [ 753.619510][T27340] __nla_validate_parse: 4 callbacks suppressed [ 753.619531][T27340] netlink: 224 bytes leftover after parsing attributes in process `syz.2.5793'. [ 753.620671][T27346] netlink: 14 bytes leftover after parsing attributes in process `syz.2.5793'. [ 753.781936][T27346] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 753.798351][T27346] bond_slave_0: left allmulticast mode [ 753.817276][T27346] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 753.839306][T27354] netlink: 'syz.4.5795': attribute type 1 has an invalid length. [ 753.847516][T27354] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5795'. [ 753.866668][T27346] bond_slave_1: left allmulticast mode [ 753.892494][T27346] bond0 (unregistering): (slave bridge0): Releasing backup interface [ 753.943637][T27346] bridge0: left allmulticast mode [ 753.949141][T27346] bridge0: port 2(bridge_slave_1) entered disabled state [ 753.956677][T27346] bridge0: port 1(bridge_slave_0) entered disabled state [ 754.003832][T27346] bond0 (unregistering): Released all slaves [ 754.093241][T27337] wg1 speed is unknown, defaulting to 1000 [ 754.204822][T27357] gretap2: entered promiscuous mode [ 754.211914][T27357] batman_adv: batadv0: Adding interface: gretap2 [ 754.219605][T27361] netlink: 12 bytes leftover after parsing attributes in process `syz.1.5796'. [ 754.232194][T27357] batman_adv: batadv0: The MTU of interface gretap2 is too small (1462) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 754.259150][T27357] batman_adv: batadv0: Not using interface gretap2 (retrying later): interface not active [ 754.348025][T27361] workqueue: Failed to create a rescuer kthread for wq "bond8": -EINTR [ 754.589517][T27387] netlink: 28 bytes leftover after parsing attributes in process `syz.0.5801'. [ 754.655725][T27337] chnl_net:caif_netlink_parms(): no params data found [ 754.799718][T27398] sctp: [Deprecated]: syz.0.5803 (pid 27398) Use of int in max_burst socket option. [ 754.799718][T27398] Use struct sctp_assoc_value instead [ 754.836920][T27396] 8021q: adding VLAN 0 to HW filter on device ipvlan2 [ 754.879326][T27337] bridge0: port 1(bridge_slave_0) entered blocking state [ 754.886725][T27337] bridge0: port 1(bridge_slave_0) entered disabled state [ 754.912384][T27337] bridge_slave_0: entered allmulticast mode [ 754.921706][T27337] bridge_slave_0: entered promiscuous mode [ 754.931844][T27403] netlink: 'syz.2.5804': attribute type 12 has an invalid length. [ 754.956791][T27337] bridge0: port 2(bridge_slave_1) entered blocking state [ 754.967007][T27337] bridge0: port 2(bridge_slave_1) entered disabled state [ 754.985402][T27337] bridge_slave_1: entered allmulticast mode [ 754.991356][T27409] netlink: 36 bytes leftover after parsing attributes in process `syz.1.5807'. [ 755.007389][T27412] netlink: 28 bytes leftover after parsing attributes in process `syz.0.5808'. [ 755.012591][T27337] bridge_slave_1: entered promiscuous mode [ 755.196368][T27337] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 755.219461][T27419] netlink: 'syz.2.5809': attribute type 12 has an invalid length. [ 755.248402][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 755.256708][ C1] lec:lec_tx_timeout: lec0 [ 755.266356][T27337] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 755.329066][T27430] veth0: entered promiscuous mode [ 755.362101][T27435] syzkaller0: entered promiscuous mode [ 755.384688][T27435] syzkaller0: entered allmulticast mode [ 755.394513][T27428] veth0: left promiscuous mode [ 755.414912][T27337] team0: Port device team_slave_0 added [ 755.459354][T27439] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5817'. [ 755.469122][T27337] team0: Port device team_slave_1 added [ 755.499666][ T51] Bluetooth: hci3: command tx timeout [ 755.525934][T27337] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 755.534377][T27337] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 755.561780][T27337] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 755.594106][T27448] xt_l2tp: v2 tid > 0xffff: 1114244 [ 755.671348][T27337] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 755.687905][T27337] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 755.721451][T27337] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 755.745682][T27455] nbd: must specify a device to reconfigure [ 755.903744][T27337] hsr_slave_0: entered promiscuous mode [ 755.920915][T27337] hsr_slave_1: entered promiscuous mode [ 756.084601][T27457] wlan1 speed is unknown, defaulting to 1000 [ 756.094308][T27463] netlink: 156 bytes leftover after parsing attributes in process `syz.0.5824'. [ 756.156207][T27469] net_ratelimit: 56 callbacks suppressed [ 756.156238][T27469] A link change request failed with some changes committed already. Interface syz_tun may have been left with an inconsistent configuration, please check. [ 756.686002][T27457] wg1 speed is unknown, defaulting to 1000 [ 756.976514][T27508] nbd: must specify a device to reconfigure [ 757.062822][T27337] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 757.123607][T27337] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 757.177065][T27337] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 757.232827][T27337] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 757.285483][T27515] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5836'. [ 757.529414][T27528] validate_nla: 1 callbacks suppressed [ 757.529435][T27528] netlink: 'syz.0.5839': attribute type 1 has an invalid length. [ 757.554332][T27337] 8021q: adding VLAN 0 to HW filter on device bond0 [ 757.588897][ T51] Bluetooth: hci3: command tx timeout [ 757.615320][T27528] 8021q: adding VLAN 0 to HW filter on device bond9 [ 757.680564][T27337] 8021q: adding VLAN 0 to HW filter on device team0 [ 757.715475][ T6211] bridge0: port 1(bridge_slave_0) entered blocking state [ 757.722830][ T6211] bridge0: port 1(bridge_slave_0) entered forwarding state [ 757.808270][T27546] nbd: must specify a device to reconfigure [ 757.815789][ T6211] bridge0: port 2(bridge_slave_1) entered blocking state [ 757.823240][ T6211] bridge0: port 2(bridge_slave_1) entered forwarding state [ 758.020261][T27554] pimreg: left allmulticast mode [ 758.374343][T27571] netlink: 'syz.4.5850': attribute type 1 has an invalid length. [ 758.550258][T27337] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 758.639928][T27585] nbd: couldn't find a device at index 0 [ 758.725575][T27337] veth0_vlan: entered promiscuous mode [ 758.785036][T27337] veth1_vlan: entered promiscuous mode [ 758.842110][T27595] __nla_validate_parse: 4 callbacks suppressed [ 758.842129][T27595] netlink: 4 bytes leftover after parsing attributes in process `syz.4.5856'. [ 758.924263][T27337] veth0_macvtap: entered promiscuous mode [ 758.960628][T27337] veth1_macvtap: entered promiscuous mode [ 759.025030][T27337] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 759.053998][T27337] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 759.058755][T27599] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5858'. [ 759.159178][T27599] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 759.236958][ T6211] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 759.266708][T27611] netlink: 24 bytes leftover after parsing attributes in process `syz.0.5860'. [ 759.268503][ T6211] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 759.380816][ T6211] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 759.405458][ T6211] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 759.660199][ T51] Bluetooth: hci3: command tx timeout [ 759.820947][ T135] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 759.843551][ T135] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 759.913155][ T6211] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 759.925037][ T6211] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 759.993340][T27637] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5868'. [ 760.195779][T27648] bridge_slave_0: left allmulticast mode [ 760.248324][T27648] bridge_slave_0: left promiscuous mode [ 760.265151][T27648] bridge0: port 1(bridge_slave_0) entered disabled state [ 760.292615][T27648] bridge_slave_1: left allmulticast mode [ 760.304462][T27648] bridge_slave_1: left promiscuous mode [ 760.314820][T27648] bridge0: port 2(bridge_slave_1) entered disabled state [ 760.330156][T27648] bond0: (slave bond_slave_0): Releasing backup interface [ 760.346567][T27648] bond0: (slave bond_slave_1): Releasing backup interface [ 760.369694][T27648] team0: Port device team_slave_0 removed [ 760.383621][T27648] team0: Port device team_slave_1 removed [ 760.391084][T27648] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 760.399273][T27648] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 760.407977][T27648] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 760.415839][T27648] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 760.426060][T27648] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 760.444917][T27650] team0: Mode changed to "random" [ 760.610187][T27668] syzkaller0: entered promiscuous mode [ 760.615740][T27668] syzkaller0: entered allmulticast mode [ 760.800052][T27683] netlink: 'syz.3.5878': attribute type 1 has an invalid length. [ 760.927891][T27690] netlink: 204 bytes leftover after parsing attributes in process `syz.1.5881'. [ 760.939371][T27692] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5879'. [ 760.980426][T27692] netlink: 'syz.0.5879': attribute type 8 has an invalid length. [ 761.160798][T27707] netlink: 4 bytes leftover after parsing attributes in process `syz.3.5883'. [ 761.738946][ T51] Bluetooth: hci3: command tx timeout [ 763.878218][T27690] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 763.887695][T27702] netlink: 108 bytes leftover after parsing attributes in process `syz.1.5881'. [ 763.897394][T27702] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5881'. [ 764.091929][T27728] netlink: 'syz.1.5889': attribute type 9 has an invalid length. [ 764.101200][T27728] netlink: 'syz.1.5889': attribute type 11 has an invalid length. [ 764.110231][T27728] netlink: 'syz.1.5889': attribute type 12 has an invalid length. [ 764.136712][T27728] netlink: 210020 bytes leftover after parsing attributes in process `syz.1.5889'. [ 764.151752][T27735] netlink: 7064 bytes leftover after parsing attributes in process `syz.3.5890'. [ 764.161226][T27735] openvswitch: netlink: Missing key (keys=40, expected=10000000) [ 764.193876][T27728] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5889'. [ 764.194029][T27737] netlink: 212348 bytes leftover after parsing attributes in process `syz.0.5892'. [ 764.248634][T27737] netlink: Conntrack attr type has unexpected length (type=2, length=0, expected=2) [ 764.393498][T27757] netlink: 204 bytes leftover after parsing attributes in process `syz.4.5899'. [ 764.407068][T27756] netlink: 204 bytes leftover after parsing attributes in process `syz.4.5899'. [ 764.471392][T27764] nbd: must specify a device to reconfigure [ 764.633749][T27767] netlink: 12 bytes leftover after parsing attributes in process `syz.3.5901'. [ 764.808714][T27788] netlink: 'syz.0.5908': attribute type 4 has an invalid length. [ 764.884511][T27792] wlan1 speed is unknown, defaulting to 1000 [ 764.974855][T27799] netlink: 'syz.0.5912': attribute type 1 has an invalid length. [ 764.994175][T27799] netlink: 224 bytes leftover after parsing attributes in process `syz.0.5912'. [ 765.172977][T27808] nbd: must specify a device to reconfigure [ 765.776333][T27792] wg1 speed is unknown, defaulting to 1000 [ 766.143699][T27861] PF_CAN: dropped non conform CAN XL skbuff: dev type 280, len 40 [ 766.412712][T27874] syzkaller1: entered promiscuous mode [ 766.430878][T27874] syzkaller1: entered allmulticast mode [ 767.426561][T27931] Cannot find add_set index 2 as target [ 767.534561][T27941] openvswitch: netlink: Unexpected mask (mask=240040, allowed=10048) [ 768.012906][T27959] netlink: 'syz.4.5948': attribute type 2 has an invalid length. [ 768.176728][T16918] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 768.191040][T16918] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 768.199518][T16918] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 768.207609][T16918] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 768.218535][T16918] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 768.385715][T27971] netlink: 'syz.2.5951': attribute type 3 has an invalid length. [ 768.417542][T27962] wlan1 speed is unknown, defaulting to 1000 [ 769.493171][T21608] wg1 speed is unknown, defaulting to 1000 [ 769.506982][T27962] wg1 speed is unknown, defaulting to 1000 [ 769.539137][T21608] syz2: Port: 1 Link DOWN [ 769.889403][T28037] __nla_validate_parse: 6 callbacks suppressed [ 769.889425][T28037] netlink: 212348 bytes leftover after parsing attributes in process `syz.3.5961'. [ 770.264149][ T135] netdevsim netdevsim0 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 770.299013][ T51] Bluetooth: hci5: command tx timeout [ 770.306301][ T135] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 770.319699][ T135] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 1] type 2 family 0 port 256 - 0 [ 770.376571][T28059] A link change request failed with some changes committed already. Interface syz_tun may have been left with an inconsistent configuration, please check. [ 770.536305][ T135] netdevsim netdevsim0 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 770.564167][ T135] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 770.574953][ T135] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 1] type 2 family 0 port 256 - 0 [ 770.681653][T28064] veth0_macvtap: entered allmulticast mode [ 770.775624][ T135] netdevsim netdevsim0 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 770.800970][ T135] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 770.823824][ T135] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 1] type 2 family 0 port 256 - 0 [ 770.864581][T27962] chnl_net:caif_netlink_parms(): no params data found [ 770.904847][T28077] IPv6: sit1: Disabled Multicast RS [ 770.927200][T28077] sit1: entered allmulticast mode [ 771.007828][ T135] netdevsim netdevsim0 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 771.038247][ T135] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 771.056644][ T135] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 1] type 2 family 0 port 256 - 0 [ 771.366580][T27962] bridge0: port 1(bridge_slave_0) entered blocking state [ 771.376337][T27962] bridge0: port 1(bridge_slave_0) entered disabled state [ 771.384570][T27962] bridge_slave_0: entered allmulticast mode [ 771.393619][T27962] bridge_slave_0: entered promiscuous mode [ 771.472438][T27962] bridge0: port 2(bridge_slave_1) entered blocking state [ 771.502722][T27962] bridge0: port 2(bridge_slave_1) entered disabled state [ 771.542572][T27962] bridge_slave_1: entered allmulticast mode [ 771.560690][T27962] bridge_slave_1: entered promiscuous mode [ 771.907185][T27962] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 771.935303][ T135] bridge_slave_1: left allmulticast mode [ 771.949126][ T135] bridge_slave_1: left promiscuous mode [ 771.975421][ T135] bridge0: port 2(bridge_slave_1) entered disabled state [ 772.381451][ T51] Bluetooth: hci5: command tx timeout [ 772.647789][T28175] netlink: 16 bytes leftover after parsing attributes in process `syz.3.5987'. [ 773.084365][ T135] bond2 (unregistering): (slave bridge3): Releasing active interface [ 773.092884][ T135] bridge3 (unregistering): left promiscuous mode [ 773.100073][ T135] bridge3 (unregistering): left allmulticast mode [ 773.162554][ T135] bond4 (unregistering): (slave bridge4): Releasing backup interface [ 773.170959][ T135] bridge4 (unregistering): left promiscuous mode [ 773.412442][ T135] bond8 (unregistering): (slave bridge10): Releasing backup interface [ 773.533735][ T135] bond1 (unregistering): (slave vlan0): Releasing backup interface [ 773.542674][ T135] tipc: Resetting bearer [ 773.550712][ T135] tipc: Resetting bearer [ 773.556161][ T135] bond1 (unregistering): Released all slaves [ 773.574696][ T135] bond2 (unregistering): Released all slaves [ 773.593729][ T135] bond0 (unregistering): Released all slaves [ 773.615454][ T135] bond3 (unregistering): (slave veth5): Releasing active interface [ 773.627817][ T135] bond3 (unregistering): Released all slaves [ 773.649136][ T135] bond4 (unregistering): Released all slaves [ 773.665797][ T135] bond5 (unregistering): Released all slaves [ 773.682908][ T135] bond6 (unregistering): Released all slaves [ 773.702429][ T135] bond7 (unregistering): Released all slaves [ 773.716609][ T135] bond8 (unregistering): Released all slaves [ 773.733899][ T135] bond9 (unregistering): Released all slaves [ 773.750391][T27962] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 773.928563][ T135] 9: left promiscuous mode [ 774.194373][T27962] team0: Port device team_slave_0 added [ 774.224355][ T135] tipc: Disabling bearer [ 774.274953][T28201] netlink: 4 bytes leftover after parsing attributes in process `syz.3.5990'. [ 774.290778][ T135] tipc: Left network mode [ 774.450801][T27962] team0: Port device team_slave_1 added [ 774.458804][ T51] Bluetooth: hci5: command tx timeout [ 774.600978][T27962] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 774.613132][T27962] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 774.644898][T27962] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 774.670635][T27962] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 774.677737][T27962] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 774.720765][T28219] netlink: 36 bytes leftover after parsing attributes in process `syz.1.5994'. [ 774.784968][T27962] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 774.996146][T28229] netlink: 28 bytes leftover after parsing attributes in process `syz.1.5998'. [ 775.252536][T27962] hsr_slave_0: entered promiscuous mode [ 775.276197][T27962] hsr_slave_1: entered promiscuous mode [ 775.313569][T27962] debugfs: 'hsr0' already exists in 'hsr' [ 775.322604][T27962] Cannot create hsr debugfs directory [ 775.490264][T28261] FAULT_INJECTION: forcing a failure. [ 775.490264][T28261] name failslab, interval 1, probability 0, space 0, times 0 [ 775.506958][T28262] xt_addrtype: ipv6 BLACKHOLE matching not supported [ 775.540060][T28261] CPU: 0 UID: 0 PID: 28261 Comm: syz.3.6004 Not tainted syzkaller #0 PREEMPT(full) [ 775.540095][T28261] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 775.540107][T28261] Call Trace: [ 775.540116][T28261] [ 775.540124][T28261] dump_stack_lvl+0xe8/0x150 [ 775.540159][T28261] should_fail_ex+0x412/0x560 [ 775.540196][T28261] should_failslab+0xa8/0x100 [ 775.540224][T28261] __kmalloc_noprof+0xe8/0x760 [ 775.540247][T28261] ? rcu_is_watching+0x15/0xb0 [ 775.540273][T28261] ? genl_family_rcv_msg_attrs_parse+0xa3/0x2a0 [ 775.540309][T28261] genl_family_rcv_msg_attrs_parse+0xa3/0x2a0 [ 775.540344][T28261] genl_family_rcv_msg_doit+0xd9/0x330 [ 775.540379][T28261] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 775.540410][T28261] ? __pfx_genl_get_cmd+0x10/0x10 [ 775.540433][T28261] ? __pfx_nbd_genl_reconfigure+0x10/0x10 [ 775.540465][T28261] ? __lock_acquire+0x6b5/0x2cf0 [ 775.540498][T28261] genl_rcv_msg+0x61c/0x7a0 [ 775.540531][T28261] ? __pfx_genl_rcv_msg+0x10/0x10 [ 775.540555][T28261] ? __pfx_nbd_genl_reconfigure+0x10/0x10 [ 775.540579][T28261] ? __lock_acquire+0x6b5/0x2cf0 [ 775.540618][T28261] netlink_rcv_skb+0x232/0x4b0 [ 775.540638][T28261] ? __pfx_genl_rcv_msg+0x10/0x10 [ 775.540664][T28261] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 775.540703][T28261] ? down_read+0x272/0x2e0 [ 775.540727][T28261] ? genl_rcv+0xd/0x40 [ 775.540751][T28261] genl_rcv+0x28/0x40 [ 775.540774][T28261] netlink_unicast+0x80f/0x9b0 [ 775.540810][T28261] ? __pfx_netlink_unicast+0x10/0x10 [ 775.540841][T28261] ? netlink_sendmsg+0x650/0xb40 [ 775.540859][T28261] ? skb_put+0x11b/0x210 [ 775.540887][T28261] netlink_sendmsg+0x813/0xb40 [ 775.540918][T28261] ? __pfx_netlink_sendmsg+0x10/0x10 [ 775.540943][T28261] ? aa_sock_msg_perm+0xf1/0x1b0 [ 775.540976][T28261] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 775.541014][T28261] ____sys_sendmsg+0x972/0x9f0 [ 775.541050][T28261] ? __pfx_____sys_sendmsg+0x10/0x10 [ 775.541087][T28261] ? import_iovec+0x73/0xa0 [ 775.541114][T28261] ___sys_sendmsg+0x2a5/0x360 [ 775.541145][T28261] ? __pfx____sys_sendmsg+0x10/0x10 [ 775.541209][T28261] ? __fget_files+0x2a/0x420 [ 775.541229][T28261] ? __fget_files+0x3a0/0x420 [ 775.541261][T28261] __x64_sys_sendmsg+0x1bd/0x2a0 [ 775.541291][T28261] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 775.541330][T28261] ? __pfx_ksys_write+0x10/0x10 [ 775.541367][T28261] do_syscall_64+0x14d/0xf80 [ 775.541393][T28261] ? trace_irq_disable+0x3b/0x150 [ 775.541411][T28261] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 775.541432][T28261] ? clear_bhb_loop+0x40/0x90 [ 775.541459][T28261] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 775.541481][T28261] RIP: 0033:0x7fa3a739c819 [ 775.541501][T28261] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 775.541518][T28261] RSP: 002b:00007fa3a81b8028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 775.541541][T28261] RAX: ffffffffffffffda RBX: 00007fa3a7615fa0 RCX: 00007fa3a739c819 [ 775.541556][T28261] RDX: 0000000000004000 RSI: 00002000000003c0 RDI: 0000000000000004 [ 775.541570][T28261] RBP: 00007fa3a81b8090 R08: 0000000000000000 R09: 0000000000000000 [ 775.541583][T28261] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 775.541595][T28261] R13: 00007fa3a7616038 R14: 00007fa3a7615fa0 R15: 00007ffe5cb1db58 [ 775.541632][T28261] [ 776.080826][T28277] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6008'. [ 776.181332][T28284] netlink: 'syz.1.6011': attribute type 1 has an invalid length. [ 776.278956][T28286] netlink: 12 bytes leftover after parsing attributes in process `syz.1.6011'. [ 776.361716][T28284] bond8: entered promiscuous mode [ 776.367268][T28284] 8021q: adding VLAN 0 to HW filter on device bond8 [ 776.420532][T28284] bond8: (slave bridge5): making interface the new active one [ 776.429469][T28284] bridge5: entered promiscuous mode [ 776.436817][T28284] bond8: (slave bridge5): Enslaving as an active interface with an up link [ 776.538326][ T51] Bluetooth: hci5: command tx timeout [ 776.676385][T28310] netlink: 212304 bytes leftover after parsing attributes in process `syz.1.6017'. [ 776.690958][T28310] openvswitch: netlink: Message has 6 unknown bytes. [ 776.874787][T28312] : renamed from virt_wifi0 [ 776.886987][T28308] netlink: 224 bytes leftover after parsing attributes in process `syz.2.6018'. [ 776.920376][T28316] ip6gre0: Master is either lo or non-ether device [ 777.036399][T28325] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6020'. [ 777.142159][T28332] netlink: 408 bytes leftover after parsing attributes in process `syz.3.6021'. [ 777.161852][T28334] netlink: 52 bytes leftover after parsing attributes in process `syz.1.6022'. [ 777.332287][ T135] hsr_slave_0: left promiscuous mode [ 777.374457][ T135] hsr_slave_1: left promiscuous mode [ 777.393613][ T135] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 777.420431][ T135] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 777.464176][ T135] veth1_macvtap: left promiscuous mode [ 777.477865][ T135] veth1_vlan: left promiscuous mode [ 777.492048][ T135] veth0_vlan: left promiscuous mode [ 777.810623][T28364] netlink: 144 bytes leftover after parsing attributes in process `syz.1.6026'. [ 777.916037][T11354] smc: removing ib device syz1 [ 778.217516][T28348] netlink: 20 bytes leftover after parsing attributes in process `syz.3.6024'. [ 778.231852][T28348] tipc: Invalid UDP bearer configuration [ 778.231914][T28348] tipc: Enabling of bearer rejected, failed to enable media [ 778.306398][T21627] ================================================================== [ 778.314541][T21627] BUG: KASAN: slab-use-after-free in __ethtool_get_link_ksettings+0x5e/0x170 [ 778.323353][T21627] Read of size 8 at addr ffff88806e0162f0 by task kworker/0:15/21627 [ 778.331546][T21627] [ 778.333909][T21627] CPU: 0 UID: 0 PID: 21627 Comm: kworker/0:15 Not tainted syzkaller #0 PREEMPT(full) [ 778.333934][T21627] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 778.333945][T21627] Workqueue: events smc_ib_port_event_work [ 778.333975][T21627] Call Trace: [ 778.333984][T21627] [ 778.333992][T21627] dump_stack_lvl+0xe8/0x150 [ 778.334015][T21627] print_report+0xba/0x230 [ 778.334032][T21627] ? __ethtool_get_link_ksettings+0x5e/0x170 [ 778.334050][T21627] kasan_report+0x117/0x150 [ 778.334069][T21627] ? __ethtool_get_link_ksettings+0x5e/0x170 [ 778.334089][T21627] __ethtool_get_link_ksettings+0x5e/0x170 [ 778.334107][T21627] ib_get_eth_speed+0x180/0x7f0 [ 778.334129][T21627] ? rxe_query_port+0x7e/0x3d0 [ 778.334157][T21627] ? __pfx_ib_get_eth_speed+0x10/0x10 [ 778.334182][T21627] ? do_raw_spin_unlock+0xf5/0x210 [ 778.334201][T21627] rxe_query_port+0x93/0x3d0 [ 778.334221][T21627] ib_query_port+0x170/0x830 [ 778.334238][T21627] smc_ib_port_event_work+0x15a/0x940 [ 778.334265][T21627] ? process_scheduled_works+0xa8d/0x18c0 [ 778.334282][T21627] ? process_scheduled_works+0xa8d/0x18c0 [ 778.334300][T21627] process_scheduled_works+0xb6e/0x18c0 [ 778.334329][T21627] ? __pfx_process_scheduled_works+0x10/0x10 [ 778.334350][T21627] ? assign_work+0x3d5/0x5e0 [ 778.334368][T21627] worker_thread+0xa53/0xfc0 [ 778.334397][T21627] kthread+0x388/0x470 [ 778.334411][T21627] ? __pfx_worker_thread+0x10/0x10 [ 778.334429][T21627] ? __pfx_kthread+0x10/0x10 [ 778.334443][T21627] ret_from_fork+0x51e/0xb90 [ 778.334463][T21627] ? __pfx_ret_from_fork+0x10/0x10 [ 778.334480][T21627] ? __switch_to+0xc7d/0x1450 [ 778.334497][T21627] ? __pfx_kthread+0x10/0x10 [ 778.334511][T21627] ret_from_fork_asm+0x1a/0x30 [ 778.334537][T21627] [ 778.334542][T21627] [ 778.508517][T21627] Allocated by task 17345: [ 778.512942][T21627] kasan_save_track+0x3e/0x80 [ 778.517650][T21627] __kasan_kmalloc+0x93/0xb0 [ 778.522560][T21627] __kvmalloc_node_noprof+0x528/0x8a0 [ 778.528026][T21627] alloc_netdev_mqs+0xa6/0x11b0 [ 778.532994][T21627] rtnl_create_link+0x31f/0xd70 [ 778.537853][T21627] rtnl_newlink_create+0x277/0xb70 [ 778.543089][T21627] rtnl_newlink+0x1666/0x1be0 [ 778.547777][T21627] rtnetlink_rcv_msg+0x7d5/0xbe0 [ 778.552817][T21627] netlink_rcv_skb+0x232/0x4b0 [ 778.557699][T21627] netlink_unicast+0x80f/0x9b0 [ 778.562475][T21627] netlink_sendmsg+0x813/0xb40 [ 778.567246][T21627] __sys_sendto+0x672/0x710 [ 778.571781][T21627] __x64_sys_sendto+0xde/0x100 [ 778.576550][T21627] do_syscall_64+0x14d/0xf80 [ 778.581517][T21627] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 778.587510][T21627] [ 778.589872][T21627] Freed by task 135: [ 778.593776][T21627] kasan_save_track+0x3e/0x80 [ 778.598458][T21627] kasan_save_free_info+0x46/0x50 [ 778.604106][T21627] __kasan_slab_free+0x5c/0x80 [ 778.608873][T21627] kfree+0x1c1/0x630 [ 778.612779][T21627] device_release+0xc4/0x1f0 [ 778.617382][T21627] kobject_put+0x228/0x560 [ 778.621807][T21627] netdev_run_todo+0xc75/0xde0 [ 778.626590][T21627] default_device_exit_batch+0x986/0xa00 [ 778.632341][T21627] ops_undo_list+0x52b/0x940 [ 778.637141][T21627] cleanup_net+0x56b/0x800 [ 778.641570][T21627] process_scheduled_works+0xb6e/0x18c0 [ 778.647308][T21627] worker_thread+0xa53/0xfc0 [ 778.651924][T21627] kthread+0x388/0x470 [ 778.655998][T21627] ret_from_fork+0x51e/0xb90 [ 778.660594][T21627] ret_from_fork_asm+0x1a/0x30 [ 778.665371][T21627] [ 778.667744][T21627] The buggy address belongs to the object at ffff88806e016000 [ 778.667744][T21627] which belongs to the cache kmalloc-cg-4k of size 4096 [ 778.682066][T21627] The buggy address is located 752 bytes inside of [ 778.682066][T21627] freed 4096-byte region [ffff88806e016000, ffff88806e017000) [ 778.696141][T21627] [ 778.698494][T21627] The buggy address belongs to the physical page: [ 778.705101][T21627] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x6e010 [ 778.714045][T21627] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 778.722765][T21627] memcg:ffff888078590581 [ 778.727063][T21627] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 778.734713][T21627] page_type: f5(slab) [ 778.738783][T21627] raw: 00fff00000000040 ffff88813fe02500 dead000000000100 dead000000000122 [ 778.747372][T21627] raw: 0000000000000000 0000000800040004 00000000f5000000 ffff888078590581 [ 778.756054][T21627] head: 00fff00000000040 ffff88813fe02500 dead000000000100 dead000000000122 [ 778.764737][T21627] head: 0000000000000000 0000000800040004 00000000f5000000 ffff888078590581 [ 778.773431][T21627] head: 00fff00000000003 ffffea0001b80401 00000000ffffffff 00000000ffffffff [ 778.782152][T21627] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 778.790831][T21627] page dumped because: kasan: bad access detected [ 778.797262][T21627] page_owner tracks the page as allocated [ 778.802984][T21627] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5175, tgid 5175 (syslogd), ts 30100172599, free_ts 27561504759 [ 778.824006][T21627] post_alloc_hook+0x231/0x280 [ 778.828790][T21627] get_page_from_freelist+0x24dc/0x2580 [ 778.834346][T21627] __alloc_frozen_pages_noprof+0x18d/0x380 [ 778.840258][T21627] allocate_slab+0x77/0x660 [ 778.844795][T21627] refill_objects+0x331/0x3c0 [ 778.849493][T21627] __pcs_replace_empty_main+0x2e6/0x730 [ 778.855086][T21627] __kvmalloc_node_noprof+0x657/0x8a0 [ 778.860598][T21627] seq_read_iter+0x202/0xe10 [ 778.865462][T21627] proc_reg_read_iter+0x1b7/0x280 [ 778.870513][T21627] vfs_read+0x582/0xa70 [ 778.874675][T21627] ksys_read+0x150/0x270 [ 778.878926][T21627] do_syscall_64+0x14d/0xf80 [ 778.883538][T21627] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 778.889453][T21627] page last free pid 1 tgid 1 stack trace: [ 778.895277][T21627] __free_frozen_pages+0xc2b/0xdb0 [ 778.900405][T21627] free_contig_range+0xbb/0x170 [ 778.905278][T21627] destroy_args+0x4e5/0x570 [ 778.909795][T21627] debug_vm_pgtable+0x3f8/0x410 [ 778.914669][T21627] do_one_initcall+0x250/0x8d0 [ 778.919530][T21627] do_initcall_level+0x104/0x190 [ 778.924579][T21627] do_initcalls+0x59/0xa0 [ 778.929058][T21627] kernel_init_freeable+0x2a6/0x3e0 [ 778.934290][T21627] kernel_init+0x1d/0x1d0 [ 778.938717][T21627] ret_from_fork+0x51e/0xb90 [ 778.943319][T21627] ret_from_fork_asm+0x1a/0x30 [ 778.948098][T21627] [ 778.950431][T21627] Memory state around the buggy address: [ 778.956066][T21627] ffff88806e016180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 778.964130][T21627] ffff88806e016200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 778.972199][T21627] >ffff88806e016280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 778.980261][T21627] ^ [ 778.987989][T21627] ffff88806e016300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 778.996083][T21627] ffff88806e016380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 779.004159][T21627] ================================================================== [ 779.234712][T21627] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 779.242002][T21627] CPU: 0 UID: 0 PID: 21627 Comm: kworker/0:15 Not tainted syzkaller #0 PREEMPT(full) [ 779.251573][T21627] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 779.261702][T21627] Workqueue: events smc_ib_port_event_work [ 779.267651][T21627] Call Trace: [ 779.271058][T21627] [ 779.274116][T21627] vpanic+0x56c/0xa60 [ 779.278137][T21627] ? __pfx_vpanic+0x10/0x10 [ 779.282666][T21627] ? __pfx___schedule+0x10/0x10 [ 779.287606][T21627] panic+0xc5/0xd0 [ 779.291448][T21627] ? __pfx_panic+0x10/0x10 [ 779.295900][T21627] ? preempt_schedule_common+0x82/0xd0 [ 779.301566][T21627] ? __ethtool_get_link_ksettings+0x5e/0x170 [ 779.307583][T21627] check_panic_on_warn+0x89/0xb0 [ 779.312557][T21627] ? __ethtool_get_link_ksettings+0x5e/0x170 [ 779.318578][T21627] end_report+0x73/0x180 [ 779.322968][T21627] ? __ethtool_get_link_ksettings+0x5e/0x170 [ 779.329177][T21627] kasan_report+0x128/0x150 [ 779.333822][T21627] ? __ethtool_get_link_ksettings+0x5e/0x170 [ 779.339951][T21627] __ethtool_get_link_ksettings+0x5e/0x170 [ 779.346153][T21627] ib_get_eth_speed+0x180/0x7f0 [ 779.351420][T21627] ? rxe_query_port+0x7e/0x3d0 [ 779.356490][T21627] ? __pfx_ib_get_eth_speed+0x10/0x10 [ 779.361909][T21627] ? do_raw_spin_unlock+0xf5/0x210 [ 779.367093][T21627] rxe_query_port+0x93/0x3d0 [ 779.371735][T21627] ib_query_port+0x170/0x830 [ 779.376562][T21627] smc_ib_port_event_work+0x15a/0x940 [ 779.381988][T21627] ? process_scheduled_works+0xa8d/0x18c0 [ 779.387761][T21627] ? process_scheduled_works+0xa8d/0x18c0 [ 779.393517][T21627] process_scheduled_works+0xb6e/0x18c0 [ 779.399221][T21627] ? __pfx_process_scheduled_works+0x10/0x10 [ 779.405422][T21627] ? assign_work+0x3d5/0x5e0 [ 779.410059][T21627] worker_thread+0xa53/0xfc0 [ 779.414700][T21627] kthread+0x388/0x470 [ 779.418801][T21627] ? __pfx_worker_thread+0x10/0x10 [ 779.423955][T21627] ? __pfx_kthread+0x10/0x10 [ 779.428598][T21627] ret_from_fork+0x51e/0xb90 [ 779.433237][T21627] ? __pfx_ret_from_fork+0x10/0x10 [ 779.438396][T21627] ? __switch_to+0xc7d/0x1450 [ 779.443125][T21627] ? __pfx_kthread+0x10/0x10 [ 779.447744][T21627] ret_from_fork_asm+0x1a/0x30 [ 779.452539][T21627] [ 779.455818][T21627] Kernel Offset: disabled [ 779.460200][T21627] Rebooting in 86400 seconds..