last executing test programs: 12.50353959s ago: executing program 1 (id=3115): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFNL_MSG_CTHELPER_NEW(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000000)=ANY=[@ANYBLOB="580000000009010100000000000000000100000508000540002200000900010073797a31000000002400020014000180080001747dfbc6e1056d4a72e3788dedab1414aa08000200000000000c000280050001"], 0x58}, 0x1, 0x0, 0x0, 0x44894}, 0x4000080) sendmsg$NFULNL_MSG_CONFIG(r0, &(0x7f0000000440)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000400)={&(0x7f0000000300)={0x44, 0x1, 0x4, 0x401, 0x0, 0x0, {0xa, 0x0, 0x6}, [@NFULA_CFG_FLAGS={0x6, 0x6, 0x1, 0x0, 0x7}, @NFULA_CFG_FLAGS={0x6, 0x6, 0x1, 0x0, 0x4}, @NFULA_CFG_NLBUFSIZ={0x8, 0x3, 0x1, 0x0, 0x5}, @NFULA_CFG_TIMEOUT={0x8, 0x4, 0x1, 0x0, 0x8000}, @NFULA_CFG_CMD={0x5, 0x1, 0x3}, @NFULA_CFG_NLBUFSIZ={0x8, 0x3, 0x1, 0x0, 0x6}]}, 0x44}, 0x1, 0x0, 0x0, 0x20008000}, 0x0) unshare(0x400) r1 = socket(0x2a, 0x2, 0x0) ioctl$SIOCSIFMTU(r1, 0x8918, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000000080)={'vxcan1\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f0000000800)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000002c0)=@can_newroute={0x24, 0x18, 0x1, 0x0, 0x25dfdbfd, {0x1d, 0x1, 0x4}, [@CGW_DST_IF={0x8, 0xa, r3}, @CGW_SRC_IF={0x8, 0x9, r3}]}, 0x24}, 0x1, 0x0, 0x0, 0x800}, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000005, 0x8031, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r4, 0x0, 0x40, &(0x7f0000000040)=@raw={'raw\x00', 0x9, 0x3, 0x200, 0x118, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x1a8, 0xffffffff, 0xffffffff, 0x1a8, 0xffffffff, 0x3, 0x0, {[{{@uncond, 0x0, 0x70, 0xd8}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x2, 0x8, 0x81, 0x100, 'pptp\x00', 'syz1\x00', {0x4}}}}, {{@uncond, 0x0, 0x70, 0x90}, @unspec=@NOTRACK={0x20}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x260) socket$nl_netfilter(0x10, 0x3, 0xc) (async) sendmsg$NFNL_MSG_CTHELPER_NEW(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000000)=ANY=[@ANYBLOB="580000000009010100000000000000000100000508000540002200000900010073797a31000000002400020014000180080001747dfbc6e1056d4a72e3788dedab1414aa08000200000000000c000280050001"], 0x58}, 0x1, 0x0, 0x0, 0x44894}, 0x4000080) (async) sendmsg$NFULNL_MSG_CONFIG(r0, &(0x7f0000000440)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000400)={&(0x7f0000000300)={0x44, 0x1, 0x4, 0x401, 0x0, 0x0, {0xa, 0x0, 0x6}, [@NFULA_CFG_FLAGS={0x6, 0x6, 0x1, 0x0, 0x7}, @NFULA_CFG_FLAGS={0x6, 0x6, 0x1, 0x0, 0x4}, @NFULA_CFG_NLBUFSIZ={0x8, 0x3, 0x1, 0x0, 0x5}, @NFULA_CFG_TIMEOUT={0x8, 0x4, 0x1, 0x0, 0x8000}, @NFULA_CFG_CMD={0x5, 0x1, 0x3}, @NFULA_CFG_NLBUFSIZ={0x8, 0x3, 0x1, 0x0, 0x6}]}, 0x44}, 0x1, 0x0, 0x0, 0x20008000}, 0x0) (async) unshare(0x400) (async) socket(0x2a, 0x2, 0x0) (async) ioctl$SIOCSIFMTU(r1, 0x8918, 0x0) (async) socket$nl_route(0x10, 0x3, 0x0) (async) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000000080)={'vxcan1\x00'}) (async) sendmsg$nl_route(r2, &(0x7f0000000800)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000002c0)=@can_newroute={0x24, 0x18, 0x1, 0x0, 0x25dfdbfd, {0x1d, 0x1, 0x4}, [@CGW_DST_IF={0x8, 0xa, r3}, @CGW_SRC_IF={0x8, 0x9, r3}]}, 0x24}, 0x1, 0x0, 0x0, 0x800}, 0x0) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000005, 0x8031, 0xffffffffffffffff, 0x0) (async) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) (async) socket$inet_udp(0x2, 0x2, 0x0) (async) setsockopt$IPT_SO_SET_REPLACE(r4, 0x0, 0x40, &(0x7f0000000040)=@raw={'raw\x00', 0x9, 0x3, 0x200, 0x118, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x1a8, 0xffffffff, 0xffffffff, 0x1a8, 0xffffffff, 0x3, 0x0, {[{{@uncond, 0x0, 0x70, 0xd8}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x2, 0x8, 0x81, 0x100, 'pptp\x00', 'syz1\x00', {0x4}}}}, {{@uncond, 0x0, 0x70, 0x90}, @unspec=@NOTRACK={0x20}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x260) (async) 11.472742764s ago: executing program 1 (id=3133): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$IPCTNL_MSG_TIMEOUT_NEW(r0, &(0x7f0000000200)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x68, 0x0, 0x8, 0x401, 0x0, 0x0, {0x0, 0x0, 0x2}, [@CTA_TIMEOUT_DATA={0x1c, 0x4, 0x0, 0x1, @udp=[@CTA_TIMEOUT_UDP_REPLIED={0x8, 0x2, 0x1, 0x0, 0x2}, @CTA_TIMEOUT_UDP_UNREPLIED={0x8, 0x1, 0x1, 0x0, 0xffffffff}, @CTA_TIMEOUT_UDP_UNREPLIED={0x8, 0x1, 0x1, 0x0, 0x3}]}, @CTA_TIMEOUT_DATA={0x24, 0x4, 0x0, 0x1, @udp=[@CTA_TIMEOUT_UDP_UNREPLIED={0x8, 0x1, 0x1, 0x0, 0x7}, @CTA_TIMEOUT_UDP_REPLIED={0x8, 0x2, 0x1, 0x0, 0x7fff}, @CTA_TIMEOUT_UDP_REPLIED={0x8, 0x2, 0x1, 0x0, 0x2}, @CTA_TIMEOUT_UDP_REPLIED={0x8, 0x2, 0x1, 0x0, 0x5}]}, @CTA_TIMEOUT_L3PROTO={0x6, 0x2, 0x1, 0x0, 0x4}, @CTA_TIMEOUT_DATA={0xc, 0x4, 0x0, 0x1, @icmpv6=[@CTA_TIMEOUT_ICMPV6_TIMEOUT={0x8, 0x1, 0x1, 0x0, 0x40}]}]}, 0x68}}, 0x4000000) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000002100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a5c000000090a010400000000000000000a0000040900010073797a310000000008000540000000040900020073797a310000000008000a40fffffffc200011800e000100636f6e6e6c696d69740000000c00028008000140fffff27414000000110001"], 0x84}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) r1 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCADDRT(r1, 0x890b, &(0x7f0000000000)={0x4000000, {}, {0x2, 0x0, @empty}, {0x2, 0x0, @empty}, 0x2a0, 0x0, 0x0, 0x0, 0x20}) sendmsg$NFT_MSG_GETSETELEM(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000002c0)=ANY=[@ANYBLOB="800000000d0a010800000000000000000a0000010900020073797a31000000000900010073797a310000000054000380500000803e0001"], 0x80}}, 0x8000) 11.233772673s ago: executing program 1 (id=3140): r0 = socket(0x10, 0x7, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) socket$unix(0x1, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x20, 0x4, &(0x7f0000000a80)=ANY=[@ANYBLOB="1800000000000000000000000100010081120800000000009500000000000000e077a80121bf2f1cc8206d77da3e8a1f0beab807ae07b46195f5798748484ff18978a49a507d441d179be3393905ec58d5b80433d809c3fcfdf37dd4061693c6ec921db90c62ab03612fe5ea5503fb6881bb7ad9fca6f0d3b16dd0548db4c8e43234a12c39a3741b8f491716ab05d1751e7f1f617ad0550c990bf380118e63a79ee4c9e5a8c76f769dd438ab50bac51a07ebb59d7a96d7e0658b38f3e9b8bc402ddbe2b9e43ea8e66350d3d152365566fdef8444dfdf21314558ed7afa8388eebacaa15d162e2bf0cfa2a49c149c87964a18c863525256116545f1f706b2a37285a09f36cee92bbb26b0e3d0181bdf86ac"], &(0x7f0000000040)='syzkaller\x00', 0x8, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, @netfilter=0x2d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x400}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={0xffffffffffffffff, 0x2f00020b, 0xd, 0x0, &(0x7f0000000200)="63eced8e46dc3f0adf33c9f7b9", 0x0, 0x7515, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="220000000400000010000000"], 0x48) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x48) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000480)={'macvlan1\x00', 0x0}) getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000880)={{{@in6=@local, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@initdev}, 0x0, @in6=@mcast2}}, &(0x7f00000004c0)=0xe8) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000000bc0)={{{@in=@multicast1, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x4e23, 0x101, 0x4e20, 0x403, 0x2, 0xa0, 0xa0, 0x2f, r4, r5}, {0x8, 0x3, 0x7, 0x4, 0x7, 0x80000001, 0x400, 0x8}, {0xd1, 0xcf, 0xfffffffffffffff9, 0x8001}, 0x5, 0x6e6bb8, 0x2, 0x1, 0x1, 0x1}, {{@in=@multicast2, 0x4d2, 0xff}, 0xa, @in6=@mcast1, 0x3504, 0x2, 0x1, 0x10, 0xaa, 0x6, 0x400004}}, 0xe8) r6 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r6, 0x10f, 0x87, &(0x7f0000000140)=@req={0xe, 0x8, 0x4000000, 0x9}, 0x10) recvmsg$unix(r6, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000180)=""/254, 0xfe}], 0x1}, 0x20) sendmmsg(r6, &(0x7f00000030c0)=[{{0x0, 0xa9cc7003, &(0x7f0000000400)=[{&(0x7f00000000c0)="ee", 0x101d0}], 0x1}}], 0x400000000000181, 0x9200000000000000) read$alg(r6, &(0x7f0000000300)=""/74, 0x4a) r7 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x10f, 0x87, &(0x7f0000000140)=@req3={0x5814, 0x400003, 0x0, 0x81, 0x81ff, 0x2001, 0x4}, 0x1c) sendmmsg(r7, &(0x7f00000030c0)=[{{0x0, 0xa9cc7003, &(0x7f0000000400)=[{&(0x7f00000000c0)="ee", 0x101d0}], 0x1}}], 0x400000000000181, 0x9200000000000000) read$alg(r7, &(0x7f0000000000)=""/106, 0x6a) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) r9 = bpf$PROG_LOAD(0x5, &(0x7f0000000540)={0x4, 0x5, &(0x7f0000000500)=ANY=[@ANYBLOB="180200000000000e00000000000000008500000053000000850000005000000095"], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x20, '\x00', 0x0, @fallback=0x1, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x8000}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000240)={{r3}, &(0x7f0000000040), &(0x7f0000000080)=r9}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000a40)={{r2}, &(0x7f00000009c0), &(0x7f0000000a00)=r8}, 0x20) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f00000000c0)={r3}, 0x4) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000640)={r2, 0xffffffffffffffff}, 0x4) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x7, 0x1c, &(0x7f0000000680)=ANY=[@ANYBLOB="18080000cbb60000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000008000000bf092000000000000d090100000000009500000000000000b7080000000000007b8af8ff00000000b7080000020000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r10, @ANYBLOB="0000000000000000b7050000080000001c00000000000000bf9800000000000056080000000000008500000005000000b70000000200000095"], &(0x7f0000000000)='GPL\x00', 0x5, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000000}, 0x94) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f00000001c0)={0x28, 0x1d, 0xfffffffb, 0xffffffff}, 0x10) write(r0, &(0x7f0000000040)="240000001e005f0214f6fffffffffff8070003000000000000000000080009000d000000", 0x24) 3.059287147s ago: executing program 2 (id=3218): r0 = socket(0x2, 0x80805, 0x0) setsockopt$inet_sctp6_SCTP_MAXSEG(r0, 0x84, 0x82, 0x0, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0xe, 0x4, &(0x7f0000000700)=@framed={{0x18, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x4000008}, [@generic={0x89, 0x1, 0x1, 0xa2}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41103, 0x0, '\x00', 0x0, @fallback=0x28, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd}, 0x94) ioctl$F2FS_IOC_COMMIT_ATOMIC_WRITE(r1, 0xf502, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='blkio.bfq.io_service_bytes\x00', 0x275a, 0x0) ioctl$FIBMAP(r2, 0x1, &(0x7f0000000080)) sendto$packet(r2, &(0x7f0000000340)="ea1ac5d2d1d446c7737ef1d0171ce27c3593bec38097863219230e669f7bb94a1c28ddec34b680632d70f28a8b541a91891777904374d1a49eab5192b46ff7b78f59fc56c7a3066702cd59898f8444f22d1b5b2a574759d24584db04825f672e418a127f78144a0c9413b09fae2716989693a702f1fda888958dfa90dae0f065902725f6ee3243870927a0a7e3d8da3c855288bdb6284ad88d231576d9b07e69abbb4c343aa09accd0b4fe13d29ff75f60e97b54ca66f36749a1e7340bda5a3c838c00faeba3b0896065a445b69a0ca6ecfe93651ae8269ae0e67ae866d2910596dc71033dd7c5bb20b137a2011a017e7ce1e041c66db7ea6bbd05f0948a27fd261d435dab9d732c53e5ebd3af8f8e83e3f3d0d34b149ef5f887315ff8", 0x11d, 0x20048004, &(0x7f00000000c0)={0x11, 0x19, 0x0, 0x1, 0x8, 0x6, @remote}, 0x14) syz_emit_ethernet(0x4b, &(0x7f0000000240)=ANY=[@ANYBLOB="ffffffffffff0180c200000388a8490081002b000004f804c75a179e58f114254acf8f7c9c24cc937a0600851603d282c450768a596fc9acb422186121952409ba6d3825f7b27116e7aaa5da36975f2762f5a9d049f014d0031ead82a55193a2fda2d1028660b7625304f30c10ec54bcfbca7b65407095730fa5b31a37ccce8ea894591e3f97d7f38af7790ca80d37f32b2ea8d074388e11522c5c1b96d95ebfdda3e40b1459372fe705cc26a4e4dd246b2939f45f8cddb98139eca34f02945018fb17f4c7e1996600bc3eac189f84ec2889e8a3c200"/236], &(0x7f0000000200)={0x0, 0x3, [0xba6, 0xfb2, 0xe34, 0x781]}) 2.892566151s ago: executing program 2 (id=3220): r0 = socket$inet_mptcp(0x2, 0x1, 0x106) socket$unix(0x1, 0x1, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$packet(0x11, 0x3, 0x300) socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000100)={0x3, 0x1000}, 0x4) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000003c0)=ANY=[@ANYBLOB="280000001e00431b000000000000000007000000", @ANYRES32=0x0, @ANYBLOB='\x00\n\x00', @ANYRES32=0x0, @ANYBLOB], 0x28}}, 0x2000c058) setsockopt$packet_int(r1, 0x107, 0xa, &(0x7f00000003c0)=0x2, 0x4) setsockopt$packet_rx_ring(r1, 0x107, 0x5, &(0x7f0000000040)=@req3={0x1000, 0x3a, 0x1000, 0x3a, 0x9, 0x0, 0xffffffff}, 0x1c) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000500)={&(0x7f0000000240)=ANY=[@ANYBLOB="9feb010018000000000000000c0000000c00000002000000000000000000000604"], 0x0, 0x26}, 0x20) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000540)={0x6, 0x3, &(0x7f0000000780)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x48}, 0x94) r3 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000780)=ANY=[], &(0x7f00000002c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x6}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r3, 0x5, 0xe, 0x0, &(0x7f0000000380)="fc5cc45c490704289349a8af1d25", 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x0, 0x3, 0x0, 0x0, 0x4}, 0x0, &(0x7f00000002c0)={0x3ff, 0x0, 0x0, 0x0, 0x0, 0x8, 0x7fffffff}, 0x0, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x89f1, &(0x7f00000002c0)={'ip6_vti0\x00', &(0x7f0000000140)=@ethtool_cmd={0x2e, 0x0, 0x0, 0x200, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0xfffff7fc, 0x0, 0x0, 0x0, 0x47, [0xbffffffc, 0x80]}}) 2.780423551s ago: executing program 4 (id=3221): r0 = socket$inet6_udp(0xa, 0x2, 0x0) (async) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000280)={0x64, 0x2, 0x6, 0x801, 0x0, 0x0, {0x3, 0x0, 0xfffd}, [@IPSET_ATTR_DATA={0x14, 0x7, 0x0, 0x1, [@IPSET_ATTR_CADT_FLAGS={0x8, 0x11}, @IPSET_ATTR_BUCKETSIZE={0x5, 0x15, 0x1}]}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_TYPENAME={0x16, 0x3, 'hash:net,port,net\x00'}]}, 0x64}, 0x1, 0x0, 0x0, 0x14}, 0x0) r2 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r2, 0x10e, 0xc, &(0x7f00000001c0)={0x5813}, 0x10) (async) sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)=@ipv6_getaddrlabel={0x24, 0x1e, 0x492dfc465ae32a8d, 0x10000, 0x0, {}, [@IFAL_LABEL={0x8, 0x2, 0x3}]}, 0x24}, 0x1, 0x0, 0x0, 0x40800}, 0x0) (async) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) (async) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r4 = openat$cgroup_pressure(r3, &(0x7f0000000140)='io.pressure\x00', 0x2, 0x0) (async) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="5000000010004b0429bd7000000000007a000000", @ANYRES32=0x0, @ANYBLOB="09a0010006810000240012800b0001006272696467650000144dc9f6c60024000100000005001600000200000a0001"], 0x50}}, 0x20000000) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) setsockopt$TIPC_SRC_DROPPABLE(r6, 0x10f, 0x80, &(0x7f0000001640)=0x4f1d, 0x4) (async) sendmmsg$inet(r6, &(0x7f0000001540)=[{{0x0, 0xfffffffffffffda1, 0x0}}], 0x40001b6, 0xf5) (async) setsockopt$SO_TIMESTAMP(r6, 0x1, 0x1d, &(0x7f00000001c0)=0x4, 0x4) (async) preadv(r4, &(0x7f00000000c0), 0x26, 0x0, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x610, 0x120, 0x0, 0x120, 0x3b0, 0x210, 0x4d0, 0x4d0, 0x4d0, 0x4d0, 0x4d0, 0x6, 0x0, {[{{@ipv6={@mcast1, @private1, [0xffffff00], [], 'nicvf0\x00', 'veth1_to_batadv\x00', {0xff}}, 0x0, 0x118, 0x140, 0x0, {0x0, 0x3a010000}, [@inet=@rpfilter={{0x28}, {0x7}}, @inet]}, @HL={0x28, 'HL\x00', 0x0, {0x0, 0x80}}}, {{@ipv6={@rand_addr=' \x01\x00', @private2={0xfc, 0x2, '\x00', 0x1}, [0xff, 0x0, 0xffffff00, 0xff], [0xffffffff, 0xff, 0xffffffff], 'batadv_slave_0\x00', 'veth1_to_hsr\x00', {}, {0xff}, 0x2e, 0x3, 0x2, 0x38}, 0x0, 0xa8, 0xf0}, @DNPT={0x48, 'DNPT\x00', 0x0, {@ipv6=@empty, @ipv6=@empty, 0x39, 0x16}}}, {{@uncond, 0x0, 0xf8, 0x120}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00', 0x0, {0x0}}}, {{@ipv6={@mcast1, @loopback, [], [], 'batadv_slave_0\x00', 'ipvlan1\x00', {}, {}, 0x2}, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffffffffffff}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@common=@hl={{0x28}, {0x2, 0x81}}, @common=@icmp6={{0x28}, {0xe, "8738", 0x1}}]}, @inet=@TOS={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x6d2) 2.543514812s ago: executing program 4 (id=3222): unshare(0x22020600) r0 = socket$can_j1939(0x1d, 0x2, 0x7) r1 = socket$inet6(0xa, 0x3, 0x7) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000140)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(des3_ede)\x00'}, 0x58) r3 = socket$kcm(0x21, 0x2, 0xa) bpf$ITER_CREATE(0x21, &(0x7f0000000180), 0x8) sendmsg$kcm(r3, &(0x7f0000000080)={&(0x7f0000000000)=@rxrpc=@in6={0x21, 0x1, 0x2, 0x1c, {0xa, 0x0, 0x4, @dev, 0x8000000}}, 0x80, 0x0, 0x0, &(0x7f0000001300)=[{0x18, 0x110, 0x1, '\x00'}, {0x10, 0x110, 0xb}], 0x28}, 0xfc40) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r4 = accept4(r2, 0x0, 0x0, 0x0) syz_genetlink_get_family_id$tipc(&(0x7f0000000240), r4) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000740)=ANY=[@ANYRES32], 0x48) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000500)=@base={0xc, 0x4, 0x4, 0x7, 0x0, r5}, 0x50) ioctl$XFS_IOC_PATH_TO_HANDLE(0xffffffffffffffff, 0xc0385869, &(0x7f0000000340)={r2, &(0x7f00000001c0)='GPL\x00', 0x20000, &(0x7f0000000200)={@_ha_fsid={[0x5, 0x9]}, {0xf, 0x8, 0x1, 0x8000000000000001}}, 0x4, &(0x7f00000002c0)={@_ha_fsid}, &(0x7f0000000300)=0x10}) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYRES16=r6], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x30, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, r7, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000023c0)={0x0, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="1500000000"], 0x0}, 0x90) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000e00), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r8, 0x8933, &(0x7f0000000e40)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_GET_SCAN(r8, &(0x7f0000000f00)={0x0, 0x0, &(0x7f0000000ec0)={&(0x7f0000000580)=ANY=[@ANYBLOB="361ec67dcc4fe62a6c99c7f523a9beb8c3e12799e6b766c0ed277d9772199efde94e527d2b32f340a09c95c9f7e4346b2444918b0b63dcabce0366da1f4c190a35a572be035858357cae6914194b4b4133f276b4c8dd31a0a5ff1ca6935628baad21007a9623451ffc2f4de61c166075a0ac7f69daf85399b388ec3ee2f155c013b03d22d40fae10e715f45e45141a0ec735f9218b90a4a4ac1fcb9d1018dfe2cd39fefe360041d3780e5fbd3f70bdf902d9d27c0beffd2c24c19769e9", @ANYRES16=r9, @ANYBLOB="210f00000000fedbdf252000000008000300", @ANYRES32=r10, @ANYBLOB], 0x1c}, 0x1, 0x0, 0x0, 0x48010}, 0x0) syz_genetlink_get_family_id$tipc(&(0x7f0000000140), r8) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af0ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000001"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r11 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r11, 0x8933, &(0x7f0000000100)={'wlan0\x00', 0x0}) r13 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(r11, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000340)={0x30, r13, 0x21, 0x72bd25, 0x0, {{}, {@val={0x8, 0x3, r12}, @void}}, [@NL80211_ATTR_TX_RATES={0x14, 0x5a, 0x0, 0x1, [@NL80211_BAND_2GHZ={0x10, 0x0, 0x0, 0x1, [@NL80211_TXRATE_HT={0x4}, @NL80211_TXRATE_LEGACY={0x5, 0x1, [0x4]}]}]}]}, 0x30}, 0x1, 0x0, 0x0, 0x24000000}, 0x0) setsockopt$sock_int(r7, 0x1, 0x29, &(0x7f00000004c0)=0x9, 0x4) syz_emit_ethernet(0x6e, &(0x7f0000000100)=ANY=[], 0x0) r14 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(r14, &(0x7f0000001b80)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000001b40)={&(0x7f0000001340)=ANY=[@ANYBLOB="f0070000", @ANYRES16=r9, @ANYBLOB="00012bbd7000fedbdf253900000008000300", @ANYRES32=r10, @ANYRES32=r0], 0x7f0}, 0x1, 0x0, 0x0, 0x4090}, 0x80) 1.897121079s ago: executing program 2 (id=3229): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) ioctl$sock_inet6_SIOCDELRT(r1, 0x890c, &(0x7f00000016c0)={@remote, @mcast2, @empty, 0x4, 0x40, 0x81, 0x100, 0x84a, 0x82000a}) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'syzkaller1\x00', 0x2}) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x5, 0x4, &(0x7f00000005c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, [@ldst={0x1, 0x2, 0x4, 0x0, 0x1}]}, &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x3, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) readv(r0, &(0x7f0000000080)=[{&(0x7f0000001980)=""/4101, 0x1005}], 0x1) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r3, 0x10f, 0x87, &(0x7f0000000140)={0x10000042, 0x0, 0x2}, 0x10) r4 = socket$tipc(0x1e, 0x2, 0x0) bind$tipc(r4, &(0x7f0000000200)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x0, 0xfffffffd}}, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000740)=ANY=[@ANYBLOB="a800006dcdc81d06c34a0796b834df25087c0000080001800400dd808c000380850004807900f700cd8e3cc57397f7468e98ea188c500222fb52fba902c2f289a796dfd9095aad35149c5ba6e18b74fc3d5cec2ab66a725ccb96422b37a1f311db173baf169f86479d54a8cde5cfdca1c079974e6c37219f819ad6ae1e93f9330140781c3b11bfccc102ef915393abeb1f701f8db6e8fa126e3cc7a3960000001cf8636601000000791cee01549f3b73cb9c00c006122c4439f799b714bd786a123cb99dcc5f20d6bae177d3d2c4cbb4c03900772c3a38f68e7cbc251829a4873b9c5dc6e7ea640dfdb490034736239d924b214d6c9ded9dc8b4c4fdaac633134f8dc723d7b226eb0a66e79c8a3e2d62ca26b4c77ff30000000000000000000082e50723ab826ecfb232ea6ad9179502758509eb7f5536a31ab9943de7335099737afc01a1b7989258635f98d397c9324f9e9478d1d0624ec2e9"], 0xa8}}, 0x4c000) r5 = socket$kcm(0x2, 0xa, 0x2) r6 = socket$vsock_stream(0x28, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r6, 0x8946, &(0x7f0000000040)={'geneve0\x00', &(0x7f0000000000)=@ethtool_ts_info}) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x3, 0x6, &(0x7f0000000000)=ANY=[@ANYBLOB="b40800000000000073113300000000008510000002000000b7000000000000009500c200000000009500001200000000"], &(0x7f0000000080)='GPL\x00', 0x4, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sched_cls}, 0x70) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', @link_local}) ioctl$XFS_IOC_START_COMMIT(r4, 0x80585882, &(0x7f0000000240)={0xffffffffffffffff}) sendmsg$nl_route(r7, &(0x7f0000000400)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)=@ipv6_getanyicast={0x14, 0x3e, 0x10, 0x70bd2d, 0x25dfdbff, {}, [""]}, 0x14}, 0x1, 0x0, 0x0, 0x4008090}, 0x1) r8 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) ioctl$TUNSETIFF(r8, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r9 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r9, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r8, &(0x7f0000000100)=ANY=[@ANYBLOB="00200000ffffffffffffbbbbbbbbbbbb08004500003cfffe20000029"], 0x4e) r10 = socket(0xa, 0x3, 0x87) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000fc0)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r11, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001400)=[{&(0x7f0000000080)="3bfdd75fa5717852d59a9367444a2130e72cd4dabc8854532cca0c32a5b9f844a4610c7525650ce3d3b76b15026d93e6dee896115e9364066aa3d14e33ef732b4681335c576902153114bdb9c74b538a71115fb1d1a63d1b04129661b29aab89d0be999a6b7c9bea755adedbf305a79f70b71d3d4c98577b49db4963ce89b0def5e840f459659cb6f86d56b069a5de11d601d348ff88ca6e5e2cfe40176880b33e9e8dbc32ba2e6a99b1b50276dc4f06166000d7069a3cc76f", 0xb9}, {&(0x7f0000000180)="892950e2405ee8629d9384a91c16d1706a3e61f305119f95cac0f1927f4c205b971eb41147cb1f86883d6910e68ac3996551800b3ec64b77f8444b18345a2c8b178eeeba0cde7319a5a46bfe7f5770e019efd9d52069edcced33a758c4e657f3a792dc193a1911b4e82ea800ad7afe03c851a8", 0x73}, {&(0x7f0000000200)="a68cde0d56b170df7710b54f17d9a39c4f98f3547190", 0x16}, {&(0x7f0000000240)="45e04400f2b383517a08c397dd0a76e67ecfc8e74573c24dedd3a48fb62418c1412fdcd15e888cb0f5d02e77bfecefda6b064c0bb2b66a9a522e63873dde02330510255eec7dfa1af708cdab59fb71eca786a359a2c3b0cbad35144ec5b069c53f90e43339845dc7fd140c55b0149ab38eb27c140f374bcc2c95b0b121d1a9302f3a01b888243b3fc0d46f0d", 0x8c}, {&(0x7f0000000300)="87fb74cf4d67adbbd062637f514c1f5eb18d7b442e6457a356c6cb1f71a43dfae773c8489cce5145f92615d4bdb13ef54d6ae90ec7733180fcf5adf3e13fdb05b57b748bd14eda042a97fdd84498304a504a0a159b972e8200c2d0f536a3465ec498ed12b924bd134057df36129d3ebe3dd3ce9f0671e5278143e4afa3d43f444681de1b5f9725fca34fa357fe2154981666fb9dc202fc17a0199eb1c25bdd1005e590e84783ee9894c888998dc25a83c14aeee31d114acfa0bcd235d571cd765f4b9259ba43e6fc30291d8a642146c4771898030b736aeee6b247abb0784b154e104e7dcda401f9b1736fea30a41a4153fe6a9a525bd0a3487571f914f05b590e242341ade289d8f5b842c6be4a93c2755dfd47174def782a2f8f61c068b5a012f02c0801601e860def788121e8808c01fed4c920a3698d0d684920918c95b17f76bbcb4f265c931d8f79560ff8114b70f4dd6791e2ed70cfeb89905791b88be26efe1c5c66b7b50b3d2be0dbc066dfc31618f9507f6f340b85a2f76a6dcac9d6ccc289ace5e5fecd25afe22ffa451f5e365ab33cc985f2e9d7f7fb1be4794740a94215d7db14b0ffcec19e5e3c5ae0d8578ef3b65d2a7a77a11e390a6c3a6b391061c886b961e3c2f42d62047bfe1356a44b840d3d956105f4c0fa95db08c4933f00de77cdc057c28b41fecfc8398c442be1ad065954f6c9dfeb2fd7207e8548a00a1d50bdf522d2abfdafd71723616a34830fbfa8fc81e0c2639cc12f363a4919b7a00ac8189dad3e7e54122a2ef430f623658d5e281c9a19442995bb9b0e3f7d13e3016b6f9523be196bf23bbcc5ec802f43ef8b651d688d9d5a44f35c9847e4c32bce3e9ebed2326adadc76f06a195db32c80b3090d7cd65c9d8518ba4e528c5eb5c7a1c5695b21595fa8a8621734bfda8afddd65e1f37a1990220a00fa9bd2c22b0117ceb08ae6af3c944c2eca924abfddad065d1472d0c3f742a49b1e78c669471873706ad157d831d7482b773f07b0673a6ce1e227a7a4d13744bf459434c0ab1c323a38b1a84cbf1ce9741f2b8fdcc2e073e56171603d035aacd83e71d5132831f4f1e8bf517979f132a33fd03783272e9b8c96dfa4e1d320a58d82acfc8d3d53a5a52daafe4dc8be08f4ad53e11cc21374b6ff4ff5ea2ecc5d3f7c057f74f0098e57d990090475cdaffdef0da917653ed10fb70b94b72e5b4d95cbea0fc1dd2579635ad6ab545ba4d7b6d2f5442bdb78beb6c8ed62942a439117025b4566b48d9f3a17fdf4577e8606a4bc4c26557e58312fd2d1a541ebec3e5ae28eef8b2ab0597083716dd12889335570ee7839530eee879d9b137606cd4dd7103991671b4464bb68529eb19fb7a8845e3491bfbac688a87cf0744f429ea112014402915c4c1f6bae08d689d3cb7d641d7befe8fc74a2242310a9a367a39531b4c86da5b39df524e52f33ff9c40b48cb196ffc9ca855b6e698ade8a83e52b9ddc5031ff09e1907e4f8b0d07e64e1fb8e427f8819a7be907aa216bf8e2a4c7cc87ed53bf9490d4cc788b91f3b9f705e984a7e62c7a495e8421b97c39dc954b35468f17c6682334f4e16308448f457faeffff6d1f818522fa441d3a48168bdb12ffebace436a3915b63076cb6a655718647f87eaaf313b5bbd430421eed3a2215e439600a56eac8c65291eb103326a8034662bd337ab51577d9110ec7151be5cc9c54b2a30891acac5ad006ed537dbeb8f16eecbde7cf4e71373faf3c36b772f6d7ea9346875c8cf1049d49d4f8eb01b946c11e8c8e3ab2015f282167acddcc77fff03e1be9134252af0abfe538b4d25fc4ff874b52b9fb0996b5f32b4141dbd30578ff46e13ef6c63fc1620f62cb11a3dce401993976c272a5f62fde3f2a0e654d19e7a39dcdb622b9526d2a15cc18e6f817c916a00775353dd9c8954e66d0445b59bb0f5e6e3b46447232f52a0e398b057d123ef503afcbd48544db6434d2025bfc8dab72262a4fa5426a03061e7f8966e0086ff8ab5a91ab59f19b830394ee8bc76d6fb4816b8f4cde35b7eb9d3811228d51c54828f9", 0x5b6}], 0x5}, 0x0) recvmsg$unix(r12, &(0x7f0000001140)={0x0, 0x0, &(0x7f0000001040)=[{&(0x7f00000015c0)=""/4096, 0x7ffff000}], 0x1, 0x0, 0x2}, 0x40000300) sendmmsg$unix(r10, &(0x7f000000cc80)=[{{&(0x7f0000001d40)=@abs={0x0, 0x0, 0x4e22}, 0x6e, 0x0}}], 0x1, 0x4040000) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) 1.873767474s ago: executing program 1 (id=3152): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0100000004000000080000000d"], 0x48) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x10, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000020000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b702000002000000850000008600000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x40, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x401}, 0x94) close(0x3) r2 = socket$pppl2tp(0x18, 0x1, 0x1) unshare(0xc000600) getsockopt(r2, 0x111, 0x1, 0x0, &(0x7f0000000080)) bpf$MAP_CREATE(0x0, &(0x7f00000007c0)=@base={0x2, 0x4, 0x2, 0xc, 0x1400}, 0x50) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0x10, &(0x7f0000000180)=ANY=[], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$sock_attach_bpf(r3, 0x1, 0x32, &(0x7f00000000c0)=r5, 0x4) r6 = socket$inet6_sctp(0xa, 0x1, 0x84) sendto$inet6(r6, &(0x7f0000000080)='X', 0x1, 0x0, &(0x7f0000000140)={0xa, 0x0, 0x0, @private0}, 0x1c) shutdown(r6, 0x1) getsockopt$inet_sctp6_SCTP_MAXSEG(r6, 0x84, 0xd, &(0x7f0000000200), &(0x7f0000000240)=0x4) sendmsg$unix(r4, &(0x7f00000006c0)={0x0, 0x0, 0x0}, 0x0) 1.696861944s ago: executing program 3 (id=3232): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0xc, 0x4, &(0x7f0000000040)=@framed={{}, [@ldst={0x1, 0x0, 0x4, 0x2, 0x1, 0x40}], {0x95, 0x0, 0x700}}, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xc}, 0x94) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0xc, 0x4, &(0x7f0000000040)=@framed={{}, [@ldst={0x1, 0x0, 0x4, 0x2, 0x1, 0x40}], {0x95, 0x0, 0x700}}, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xc}, 0x94) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000400)={&(0x7f0000000280)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xe0, 0xe0, 0x4, [@enum64={0x5, 0x5, 0x0, 0x13, 0x0, 0x1, [{0x6, 0x2, 0x6734}, {0x7, 0x5, 0x9}, {0xf, 0x1000, 0x81}, {0x3, 0xfffffff8, 0x95}, {0x2, 0x6, 0x6}]}, @struct={0xb, 0x4, 0x0, 0x4, 0x1, 0xffff1403, [{0x5, 0x5, 0x5}, {0x4, 0x3, 0x5}, {0x8, 0x0, 0x1}, {0x10, 0x0, 0x7}]}, @func_proto={0x0, 0x4, 0x0, 0xd, 0x0, [{0x9, 0x1}, {0x3}, {0xc, 0x3}, {0x1, 0x2}]}, @array={0x0, 0x0, 0x0, 0x3, 0x0, {0x4, 0x4, 0xb}}, @union={0x2, 0x1, 0x0, 0x5, 0x1, 0x2, [{0x9, 0x0, 0x2}]}]}, {0x0, [0x0, 0x7f]}}, &(0x7f0000000380)=""/100, 0xfc, 0x64, 0x0, 0xfffffff7, 0x10000}, 0x28) (async) r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000400)={&(0x7f0000000280)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xe0, 0xe0, 0x4, [@enum64={0x5, 0x5, 0x0, 0x13, 0x0, 0x1, [{0x6, 0x2, 0x6734}, {0x7, 0x5, 0x9}, {0xf, 0x1000, 0x81}, {0x3, 0xfffffff8, 0x95}, {0x2, 0x6, 0x6}]}, @struct={0xb, 0x4, 0x0, 0x4, 0x1, 0xffff1403, [{0x5, 0x5, 0x5}, {0x4, 0x3, 0x5}, {0x8, 0x0, 0x1}, {0x10, 0x0, 0x7}]}, @func_proto={0x0, 0x4, 0x0, 0xd, 0x0, [{0x9, 0x1}, {0x3}, {0xc, 0x3}, {0x1, 0x2}]}, @array={0x0, 0x0, 0x0, 0x3, 0x0, {0x4, 0x4, 0xb}}, @union={0x2, 0x1, 0x0, 0x5, 0x1, 0x2, [{0x9, 0x0, 0x2}]}]}, {0x0, [0x0, 0x7f]}}, &(0x7f0000000380)=""/100, 0xfc, 0x64, 0x0, 0xfffffff7, 0x10000}, 0x28) bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x2, 0x4, 0x4, 0x9}, 0x48) (async) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x2, 0x4, 0x4, 0x9}, 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000008c0)={{r1}, &(0x7f0000000840), &(0x7f0000000880), 0x1000000}, 0x20) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0xa, 0x5, 0x2, 0x7}, 0x50) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x0, 0x10, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000b98cad95850000000100000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b70200000000001f850000008600000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r0, 0x89f8, &(0x7f0000000a80)={'tunl0\x00', &(0x7f0000000980)={'syztnl2\x00', 0x0, 0x7850, 0x8, 0x8, 0x7, {{0x29, 0x4, 0x1, 0x25, 0xa4, 0x64, 0x0, 0x3, 0x2f, 0x0, @rand_addr=0x64010102, @loopback, {[@ssrr={0x89, 0xb, 0x5e, [@rand_addr=0x64010101, @rand_addr=0x64010101]}, @cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @ssrr={0x89, 0x17, 0x2b, [@remote, @multicast2, @initdev={0xac, 0x1e, 0x1, 0x0}, @rand_addr=0x64010101, @initdev={0xac, 0x1e, 0x1, 0x0}]}, @ssrr={0x89, 0x23, 0x84, [@broadcast, @empty, @remote, @dev={0xac, 0x14, 0x14, 0x22}, @rand_addr=0x64010100, @broadcast, @private=0xa010102, @local]}, @ssrr={0x89, 0x7, 0x27, [@multicast1]}, @generic={0x89, 0x12, "9f70e48eec883da2947dda02e19cbb0d"}, @ra={0x94, 0x4, 0x1}, @ssrr={0x89, 0x23, 0xed, [@private=0xa010102, @remote, @rand_addr=0x64010102, @remote, @rand_addr=0x64010102, @empty, @empty, @rand_addr=0x64010101]}]}}}}}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000b80)={0x18, 0x22, &(0x7f0000000680)=@framed={{0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x7}, [@map_idx_val={0x18, 0x7, 0x6, 0x0, 0x10, 0x0, 0x0, 0x0, 0x387aad81}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r2}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0xfffff04c}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x2}}, @func={0x85, 0x0, 0x1, 0x0, 0x4}, @snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x80000000}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r1}}, @tail_call={{0x18, 0x2, 0x1, 0x0, r1}}, @ldst={0x1, 0x2, 0x1, 0x8, 0x8, 0xfffffffffffffff0, 0x4}]}, &(0x7f00000007c0)='syzkaller\x00', 0x2, 0x60, &(0x7f0000000900)=""/96, 0x41100, 0x20, '\x00', r4, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000ac0)={0x0, 0x5}, 0x8, 0x10, &(0x7f0000000b00)={0x4, 0x2, 0x7, 0x1}, 0x10, 0x0, 0x0, 0x0, &(0x7f0000000b40)=[r1]}, 0x94) r5 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000004c0)={0x1b, 0x0, 0x0, 0x4, 0x0, 0x1, 0x2, '\x00', 0x0, 0xffffffffffffffff, 0x1, 0x2, 0x1}, 0x50) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000005c0)={0x6, 0x4, &(0x7f0000000000)=@framed={{0x18, 0x0, 0x0, 0x0, 0x4d, 0x0, 0x0, 0x0, 0xd0}, [@call={0x85, 0x0, 0x0, 0x17}]}, &(0x7f0000000080)='GPL\x00', 0x5000, 0x67, &(0x7f0000000200)=""/103, 0x41100, 0x34, '\x00', 0x0, 0x25, r0, 0x8, &(0x7f0000000440)={0x2, 0x4}, 0x8, 0x10, &(0x7f0000000480)={0x2, 0x5, 0x6, 0x2}, 0x10, 0x0, 0x0, 0x2, &(0x7f0000000540)=[r1, r5], &(0x7f0000000580)=[{0x5, 0x4, 0xc, 0x7}, {0x0, 0x2, 0x10, 0xb}]}, 0x94) 1.521169132s ago: executing program 4 (id=3233): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x7, 0xa, &(0x7f0000000680)=@framed={{0x18, 0x8}, [@func={0x85, 0x0, 0x1, 0x0, 0x6}, @map_fd={0x18, 0x0, 0x0}, @generic={0x2c}, @initr0, @exit]}, &(0x7f0000000000)='GPL\x00'}, 0x90) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000040)={r0, 0xe0, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x8, 0x0, 0x0}}, 0x10) r1 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x50) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x1f, 0x11, &(0x7f0000001080)=ANY=[@ANYBLOB="180000000000000000000000feffffff8500000050000000b7080000000000007baaf8ff00000000b5080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r1, @ANYBLOB="0000000000000000b70500000800000085000000a800000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x10, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000000)={r2}, 0xc) bpf$BPF_PROG_QUERY(0x10, &(0x7f00000001c0)={@map=0x1, 0x20, 0x1, 0x6, &(0x7f0000000040)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x6, 0x0, &(0x7f0000000080)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000140)=[0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000180)=[0x0], 0x0}, 0x40) ioctl$XFS_IOC_START_COMMIT(0xffffffffffffffff, 0x80585882, &(0x7f0000000280)={0xffffffffffffffff}) r5 = bpf$BPF_LINK_CREATE(0x1c, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff, 0x33, 0x0, @void}, 0x10) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000200)={@cgroup=r4, r0, 0x2f, 0x2018, 0x0, @value=r5, @void, @void, @void, r3}, 0x20) r6 = socket$nl_route(0x10, 0x3, 0x0) ioctl$EXT4_IOC_GETSTATE(r6, 0x40046629, &(0x7f0000000000)) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f00000000c0)={'bridge0\x00', 0x0}) sendmsg$nl_route(r6, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000440)=@newlink={0x44, 0x10, 0x401, 0xfffffffc, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, 0x1503}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @ipvlan={{0xb}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r7}, @IFLA_MASTER={0x8, 0xa, r7}]}, 0x44}, 0x1, 0x0, 0x0, 0x24000891}, 0x0) 1.518097975s ago: executing program 3 (id=3234): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="19000000040000000400"], 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0x14, &(0x7f00000001c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x10100, 0x0, 0x0, 0x0, 0xfffffffe}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {}, {}, {0x4}, {0x6, 0x0, 0xa}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x33}}, @printk={@llu, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x5}}]}, &(0x7f0000000180)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback=0xf, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc641}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000b80)={r1, 0x2000012, 0xe, 0x0, &(0x7f0000000080)="63eced8e46dc3f2ddf33c9e9b986", 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xb}, 0x50) 1.517571028s ago: executing program 0 (id=3235): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$packet(0x11, 0x3, 0x300) r2 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r2, 0x107, 0x12, &(0x7f0000000000)={0x0, 0x6}, 0x4) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000000)={0x0, 0xb007}, 0x4) r3 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000140), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_wireguard(r0, 0x8933, &(0x7f0000000080)={'wg2\x00', 0x0}) sendmsg$WG_CMD_SET_DEVICE(r0, &(0x7f0000000d40)={0x0, 0xe0, &(0x7f0000000d00)={&(0x7f0000000600)=ANY=[@ANYBLOB="2c020000", @ANYRES16=r3, @ANYBLOB="010000000000000000000100000024000300a05ca84f6c9c8e3853e2fd7a70ae0fb20fa152600cb00845174f08076f8d7843e40108804400208024000100000000000100000000000000fdffff01000000000000000000000000000000001400040003000000ac1414bb00000000000000000600050000000000000100802400020073e591ec06154031d3954ac0e16752e72640f08b5281a8461d17d26d12f2bbb6060005000021000024000100f44da367a88ee6564f020211456727082f5cebee8b1bf5eb7337341b459b39228c00098028000080060001000a0000001400020020010000000000000000000000000001050003000000000088000080060001000a0000001400020020010000000000000000000000000002050003000000001003800080060001008c0e000008000200ac1414aa05000300000000001c000080060001000200000008000200ac1414bb0500030000000000200004000e00000000000000fe800000000000000000000000000000000000009c0000802400020073961633df6dc9cb418b15afd0bae7b90f1e6cfed8bb423cf9285c474163154908000a00010000002400010000000000000000000000000000000000000000000000000000000000000000004800098028000080060001000a00000014000200fe8000000000000000000000000000bb05000300000000001c000080060001000200000008000200000000000500030000000000080005000100000008000100", @ANYRES32=r4], 0x22c}}, 0x0) 1.413310472s ago: executing program 3 (id=3236): r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x50) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000180), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) getsockname$packet(0xffffffffffffffff, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000240)=0x14) sendmsg$ETHTOOL_MSG_LINKINFO_GET(r1, &(0x7f0000000340)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000300)={&(0x7f0000000280)={0x58, r2, 0x200, 0x70bd29, 0x25dfdbfc, {}, [@HEADER={0x44, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ip6gre0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r3}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'sit0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r4}]}]}, 0x58}, 0x1, 0x0, 0x0, 0x40000}, 0x20000080) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x18, 0x10, &(0x7f0000000000)=@ringbuf={{0x18, 0x8}, {{0x18, 0x1, 0x1, 0x0, r0}, {}, {0x7, 0x0, 0xb, 0x6, 0x0, 0x0, 0xffffff1f}, {0x85, 0x0, 0x0, 0x5}}, {{0x6, 0x0, 0x2}}, [@alu={0x4, 0x1, 0x9, 0x8, 0x6}], {{0x7, 0x1, 0xb, 0x8}, {0x6, 0x0, 0x5, 0x8}, {0x85, 0x0, 0x0, 0x7}}}, &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x42, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 1.382539203s ago: executing program 0 (id=3237): mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040), 0x200002, 0x0) r1 = openat$cgroup_devices(r0, &(0x7f0000000380)='devices.allow\x00', 0x2, 0x0) write$cgroup_devices(r1, &(0x7f0000000280)=ANY=[@ANYBLOB], 0xa) 1.277854324s ago: executing program 3 (id=3238): r0 = socket$nl_route(0x10, 0x3, 0x0) (async) bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0x6, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="180000000001000000000000000000001801000020756c2100000000002020207b"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40000}, 0x94) (async) r1 = socket$nl_route(0x10, 0x3, 0x0) (async) pipe(&(0x7f0000000080)={0xffffffffffffffff}) r3 = syz_genetlink_get_family_id$devlink(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_SB_TC_POOL_BIND_SET(r2, &(0x7f0000000700)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f00000006c0)={&(0x7f0000000480)={0x234, r3, 0x0, 0x70bd25, 0x25dfdbfe, {}, [{{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x1}}, {0x8, 0xb, 0x10001}, {0x6, 0x16, 0x6}, {0x5}, {0x6, 0x11, 0x1}, {0x8, 0xb, 0x9}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8}}, {0x8, 0xb, 0x1}, {0x6, 0x16, 0x1800}, {0x5, 0x12, 0x1}, {0x6, 0x11, 0xc616}, {0x8, 0xb, 0x2}}, {{@pci={{0x8}, {0x11}}, {0x8, 0x3, 0x1}}, {0x8, 0xb, 0x7}, {0x6, 0x16, 0x8}, {0x5}, {0x6, 0x11, 0x800}, {0x8, 0xb, 0x9}}, {{@pci={{0x8}, {0x11}}, {0x8}}, {0x8}, {0x6, 0x16, 0x7f}, {0x5, 0x12, 0x1}, {0x6, 0x11, 0x5}, {0x8, 0xb, 0x80}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x1}}, {0x8, 0xb, 0x9}, {0x6, 0x16, 0x9}, {0x5, 0x12, 0x1}, {0x6, 0x11, 0x6}, {0x8, 0xb, 0x5}}, {{@pci={{0x8}, {0x11}}, {0x8, 0x3, 0x1}}, {0x8, 0xb, 0x8001}, {0x6, 0x16, 0x800}, {0x5}, {0x6, 0x11, 0x7}, {0x8, 0xb, 0x1}}, {{@pci={{0x8}, {0x11}}, {0x8, 0x3, 0x3}}, {0x8}, {0x6, 0x16, 0xe707}, {0x5}, {0x6, 0x11, 0x7f}, {0x8, 0xb, 0x5}}]}, 0x234}, 0x1, 0x0, 0x0, 0x24008000}, 0x4) (async) sendmsg$nl_route(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=ANY=[@ANYBLOB="380000005500e5e025bd70000100000007000000", @ANYRES32, @ANYBLOB="204001"], 0x38}, 0x1, 0x0, 0x0, 0x2000c844}, 0x400a151) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000c80)={'veth0_to_bridge\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000840)=@newqdisc={0x40, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {}, {0xffff, 0xffff}, {0x1, 0x2}}, [@qdisc_kind_options=@q_fq={{0x7}, {0x14, 0x2, [@TCA_FQ_FLOW_MAX_RATE={0x8, 0x12}, @TCA_FQ_BUCKETS_LOG={0x8, 0x8, 0x14}]}}]}, 0x40}, 0x1, 0x0, 0x0, 0x44010}, 0x40000) 1.273255572s ago: executing program 4 (id=3239): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0e000000040000000800000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000006080)={0x6, 0xc, &(0x7f00000001c0)=ANY=[@ANYBLOB, @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bc82000000000000a6020000f8ffffffb703000008000000ac030000000000008500000033000000"], &(0x7f0000000780)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket$inet_tcp(0x2, 0x1, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0xd, 0x4, &(0x7f0000000040)=@framed={{}, [@ldst={0x1, 0x2, 0x4, 0x2, 0x1, 0xb8}]}, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xd, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xffffffff}, 0x94) setsockopt$inet_sctp_SCTP_ASSOCINFO(0xffffffffffffffff, 0x84, 0x1, 0x0, 0x0) r1 = socket$kcm(0x10, 0x2, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x19, 0x4, 0x4, 0x2, 0x0, 0x1}, 0x50) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=ANY=[], 0x1c}}, 0x4000000) r3 = socket$inet(0x2, 0x2, 0x1) sendmsg$inet(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000600)=[{&(0x7f0000000400)='\b\x00', 0x2}, {&(0x7f0000000500)="962b07a3f9c8", 0x6}], 0x2}, 0x42090) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000240)={r2, &(0x7f00000000c0), &(0x7f0000000000)=""/3, 0x2}, 0x20) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000240)={r2, &(0x7f0000000140), &(0x7f0000000000)=""/6, 0x2}, 0x20) openat$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000080), 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x18, 0x5, &(0x7f0000000040)=ANY=[@ANYBLOB="180100002100000000000000000000008500000075000000a50000002300000095"], &(0x7f00000000c0)='GPL\x00'}, 0x94) mmap(&(0x7f0000000000/0xa000)=nil, 0xa000, 0x1000006, 0x4132, 0xffffffffffffffff, 0x0) r4 = socket$vsock_stream(0x28, 0x1, 0x0) mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x0, 0x12, r4, 0x0) pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r5, &(0x7f00000000c0)=[{&(0x7f0000000180)="77690addcfbe1fbb66ec", 0xff3b}], 0x1, 0x1) sendmsg$kcm(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000040)="2e00000011008108090f9becdb4cb92e264831371900000069bd6efb2502eaf60d002700020400bf050005001201", 0x2e}], 0x1}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0e000000040000000800000005"], 0x48) (async) bpf$PROG_LOAD(0x5, &(0x7f0000006080)={0x6, 0xc, &(0x7f00000001c0)=ANY=[@ANYBLOB, @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bc82000000000000a6020000f8ffffffb703000008000000ac030000000000008500000033000000"], &(0x7f0000000780)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) socket$inet_tcp(0x2, 0x1, 0x0) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0xd, 0x4, &(0x7f0000000040)=@framed={{}, [@ldst={0x1, 0x2, 0x4, 0x2, 0x1, 0xb8}]}, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xd, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xffffffff}, 0x94) (async) setsockopt$inet_sctp_SCTP_ASSOCINFO(0xffffffffffffffff, 0x84, 0x1, 0x0, 0x0) (async) socket$kcm(0x10, 0x2, 0x0) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x19, 0x4, 0x4, 0x2, 0x0, 0x1}, 0x50) (async) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=ANY=[], 0x1c}}, 0x4000000) (async) socket$inet(0x2, 0x2, 0x1) (async) sendmsg$inet(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000600)=[{&(0x7f0000000400)='\b\x00', 0x2}, {&(0x7f0000000500)="962b07a3f9c8", 0x6}], 0x2}, 0x42090) (async) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000240)={r2, &(0x7f00000000c0), &(0x7f0000000000)=""/3, 0x2}, 0x20) (async) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000240)={r2, &(0x7f0000000140), &(0x7f0000000000)=""/6, 0x2}, 0x20) (async) openat$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000080), 0x2, 0x0) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x18, 0x5, &(0x7f0000000040)=ANY=[@ANYBLOB="180100002100000000000000000000008500000075000000a50000002300000095"], &(0x7f00000000c0)='GPL\x00'}, 0x94) (async) mmap(&(0x7f0000000000/0xa000)=nil, 0xa000, 0x1000006, 0x4132, 0xffffffffffffffff, 0x0) (async) socket$vsock_stream(0x28, 0x1, 0x0) (async) mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x0, 0x12, r4, 0x0) (async) pipe(&(0x7f0000000040)) (async) vmsplice(r5, &(0x7f00000000c0)=[{&(0x7f0000000180)="77690addcfbe1fbb66ec", 0xff3b}], 0x1, 0x1) (async) sendmsg$kcm(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000040)="2e00000011008108090f9becdb4cb92e264831371900000069bd6efb2502eaf60d002700020400bf050005001201", 0x2e}], 0x1}, 0x0) (async) 1.238537225s ago: executing program 0 (id=3240): r0 = socket(0x2, 0x80805, 0x0) sendmmsg$inet_sctp(r0, &(0x7f0000000880)=[{&(0x7f0000000440)=@in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, &(0x7f00000004c0)=[{&(0x7f0000000100)="03", 0x1}], 0x1}], 0x1, 0x0) sendmmsg$inet_sctp(r0, &(0x7f00000032c0)=[{0x0, 0x0, &(0x7f0000000240)=[{0x0}, {&(0x7f0000000300)="359cb6", 0x3}], 0x2, &(0x7f0000000000)=ANY=[@ANYBLOB="30000000000000008400000001000000000000000c000400"/44, @ANYRES32=0x0], 0x30}], 0x1, 0x0) 1.152725263s ago: executing program 3 (id=3241): r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000200)=0x474c, 0x4) (async) bind$inet(r0, &(0x7f0000000240)={0x2, 0x0, @local}, 0x6f) (async) connect$inet(r0, &(0x7f0000000480)={0x2, 0x0, @multicast1}, 0x10) sendmmsg(r0, &(0x7f0000007fc0), 0x800001d, 0x300) (async) setsockopt$inet_int(r0, 0x0, 0x14, &(0x7f0000000000)=0x40, 0x4) (async) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, r1, 0x0) recvmmsg(r0, &(0x7f0000004200)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000580)=""/73, 0x49}, 0x10}], 0x1, 0x45833af92e4b39ff, 0x0) (async) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000bc0), r2) r4 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) (async) openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0x22d00, 0x0) close(0x4) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) (async) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000040)='ns/cgroup\x00') (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeef, 0x8031, 0xffffffffffffffff, 0x215eb000) (async) close(0xffffffffffffffff) (async) socket(0x14, 0x2, 0x4) connect$tipc(0xffffffffffffffff, &(0x7f0000000040)=@id={0x1e, 0x3, 0x0, {0x4e24}}, 0x10) syz_genetlink_get_family_id$devlink(0x0, 0xffffffffffffffff) (async) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0x0) (async) shutdown(r4, 0x1) (async) setsockopt$sock_int(r4, 0x1, 0x20, &(0x7f0000000280)=0xfffff908, 0x4) sendmsg$NLBL_CIPSOV4_C_ADD(r2, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000800)=ANY=[@ANYBLOB="84010000", @ANYRES16=r3, @ANYBLOB="0100d8000000000000000100000004000480080002000100000008000100000000000400088058010c8054000b800800090000000000080009000000000008000a000000000008000a000000000008000a000000000008000900000000000800097c86b722735035dc0067f6b13308000a000000000008000a000000000008000900975b9b5e04000b801c000b80080009"], 0x184}}, 0x0) (async) socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x22, 0x800, 0x10000) sendmsg$IPVS_CMD_SET_INFO(r5, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) (async) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) 901.306576ms ago: executing program 0 (id=3242): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a4c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40ffff0100000003400000001408000c4000000e45400000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a310000000014000380100000800c00018006000100d103000014000000110001"], 0xb4}, 0x1, 0x0, 0x0, 0x855}, 0x40) sendmsg$NFT_BATCH(r1, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=ANY=[@ANYBLOB="140000001000010000000000000000000300000a4c0000000e0a010100000000000000000a0000060900020073797a31000000000900010073797a3100000000200003801c0000800c00018006000100d103"], 0x74}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)={0x60, 0x2, 0x6, 0x3, 0x0, 0x0, {0x0, 0x0, 0x6}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x14, 0x7, 0x0, 0x1, [@IPSET_ATTR_MAXELEM={0x8, 0x13, 0x0, 0x0, 0x56074974}, @IPSET_ATTR_HASHSIZE={0x8}]}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_TYPENAME={0x12, 0x3, 'hash:net,port\x00'}]}, 0x60}, 0x1, 0x0, 0x0, 0x4000}, 0x4000) 900.857338ms ago: executing program 1 (id=3243): mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x21031, 0xffffffffffffffff, 0x21d63000) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0xd, 0x20000000ec071, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x9, 0x6, 0x8, 0x8}, 0x48) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x11, r0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ipvs(&(0x7f00000001c0), r1) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000140)={0x26, 'hash\x00', 0x0, 0x0, 'hmac(sm3)\x00'}, 0x58) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r3, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=ANY=[], 0x20}, 0x1, 0x0, 0x0, 0x42804}, 0x0) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, 0x0, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r4, &(0x7f0000000100)={0x2, 0x0, @local}, 0x10) socket$rxrpc(0x21, 0x2, 0xa) setsockopt$sock_int(r4, 0x1, 0x6, &(0x7f0000000000)=0x4, 0x4) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r5, 0x10e, 0x1, &(0x7f0000000400)=0x1, 0x4) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r6, &(0x7f0000000480)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000840)=ANY=[@ANYBLOB="fc00000019000100000000000000000000000000000000000000000000000000fe8000000000000000000000000000bb00000000000000000200000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000000000000700000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000440005002001000000000000000000000000000000000002320000000a000000fc010000000000000000000000000000000000000400000000000000000000fb00000000"], 0xfc}}, 0x0) connect$inet(r4, &(0x7f0000000280)={0x2, 0x0, @broadcast}, 0x10) sendmmsg$inet(r4, &(0x7f0000004d00)=[{{0x0, 0x97, 0x0, 0x0, 0x0, 0x0, 0x30000}}], 0x300, 0xf1c) r7 = accept4(r2, 0x0, 0x0, 0x800) sendmsg$IPCTNL_MSG_CT_NEW(r7, 0x0, 0x8000) accept$inet6(r7, 0x0, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000200)={0x0}, 0x1, 0x0, 0x0, 0x4000001}, 0x20040000) r8 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000140), 0x43cfc1, 0x0) r9 = socket$netlink(0x10, 0x3, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000640)={0x6, 0x6, &(0x7f0000000700)=ANY=[@ANYBLOB="180000000800000000000000eb030000851000000300000005410800500b000085100000fdffffff95000000000000002b641ee231c72a2c35a919e93e5b6e3c7f6e244532dd53b8b5479706175b031eb03e3820b15e374b097dcc6b291e463595025d9a2d86096b5f3e6a75a687d80ffcc4dd96b22a6d31d7b68c92db3f6a7a9ec3998ac4a3eb8d06722e803061a71b6c7a84241e3731d06c33f2cd66ca87fc7d53bfe72cdbf2b5876a8870c7c8774992b08a021d9e5543fbd817a19a589c874c3b769b4f9dc9e69d5314708be601000000000000004e9df5f2edf372150dc4856abca58a2da5ce6507f8c7fecab727dd6017237e9f1752ae255cace631eade33e120f88596b9454592114c4ffa2d6923a32757cf3329e5ab"], &(0x7f00000002c0)='syzkaller\x00', 0x2557, 0xc8, &(0x7f00000004c0)=""/200, 0x41100, 0x2, '\x00', 0x0, 0x25, r6, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000380)={0x0, 0x4, 0x2, 0x7}, 0x10, 0x0, 0x0, 0x2, &(0x7f00000003c0)=[r8, 0xffffffffffffffff, 0xffffffffffffffff, r7, 0xffffffffffffffff], &(0x7f0000000940)=[{0x5, 0x5, 0xf, 0x3}, {0x4, 0x5, 0x7, 0x7}], 0x10, 0x7}, 0x94) bind$netlink(r9, &(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000}, 0xc) setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r9, 0x10e, 0x2, &(0x7f0000000080)=0xf, 0x4) 789.016544ms ago: executing program 2 (id=3244): socket$nl_generic(0x10, 0x3, 0x10) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fed007907001175f37538e486dd6317ce2200102f00fe80000000000000875a65059ff57b00000000000000000000000000ac1414aa"], 0xcfa4) r0 = socket$kcm(0x11, 0x200000000000002, 0x300) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000001c0)={0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41000, 0x40, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)}, 0x94) close(r2) recvmsg$unix(r1, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) setsockopt$sock_attach_bpf(r0, 0x107, 0x12, &(0x7f00000008c0)=r3, 0x4) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000440)={0x6, 0x20000136, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x40, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x4}, 0x94) r4 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000200)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x7}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r4, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x88be, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) 667.147543ms ago: executing program 4 (id=3245): sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x2000c8d1) bpf$PROG_LOAD(0x5, 0x0, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) close(r0) ioctl$SIOCSIFHWADDR(r0, 0x8b34, 0x0) r1 = socket$netlink(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), r0) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_GET_KEY(r0, &(0x7f0000000240)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000200)={&(0x7f0000000140)={0xc0, r2, 0x8, 0x70bd2d, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_KEY_DEFAULT_MGMT={0x4}, @NL80211_ATTR_KEY_TYPE={0x8, 0x37, 0x2}, @NL80211_ATTR_KEY_CIPHER={0x8, 0x9, 0xfac05}, @NL80211_ATTR_KEY={0x60, 0x50, 0x0, 0x1, [@NL80211_KEY_DATA_WEP104={0x11, 0x1, "5778d18491b40e028d7810de47"}, @NL80211_KEY_CIPHER={0x8, 0x3, 0xfac05}, @NL80211_KEY_TYPE={0x8, 0x7, 0x2}, @NL80211_KEY_DATA_WEP40={0x9, 0x1, "a9c608f772"}, @NL80211_KEY_DEFAULT={0x4}, @NL80211_KEY_DATA_WEP104={0x11, 0x1, "a3638c602aa21e2bae7ae318d5"}, @NL80211_KEY_SEQ={0x14, 0x4, "7edc2a5981e704f15e6c6aa54f76f2cd"}]}, @NL80211_ATTR_KEY_DEFAULT={0x4}, @NL80211_ATTR_KEY_SEQ={0xd, 0xa, "d05efefbe0cbc64fcc"}, @NL80211_ATTR_KEY_SEQ={0x8, 0xa, "9d28a117"}, @NL80211_ATTR_KEY_DATA_WEP104={0x11, 0x7, "4c626939b21251cc4465fd0c4d"}]}, 0xc0}, 0x1, 0x0, 0x0, 0x4800}, 0x4) bind$netlink(r1, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) socket$packet(0x11, 0x3, 0x300) ioctl$sock_kcm_SIOCKCMCLONE(r0, 0x89e2, &(0x7f0000000000)={r1}) setsockopt$sock_int(r4, 0x1, 0x2a, &(0x7f00000003c0)=0x8, 0x4) socket$inet6_mptcp(0xa, 0x1, 0x106) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000080)=@newlink={0x3c, 0x10, 0x403, 0xfffffffd, 0x0, {0x0, 0x0, 0x4, 0x0, 0x8bb9}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bridge={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BR_MCAST_ROUTER={0x5}]}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4}, 0x8044) 565.357018ms ago: executing program 0 (id=3246): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="19000000040000000400"], 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0x14, &(0x7f00000001c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x10100, 0x0, 0x0, 0x0, 0xfffffffe}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {}, {}, {0x4}, {0x6, 0x0, 0xa}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x33}}, @printk={@llu, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x5}}]}, &(0x7f0000000180)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback=0xf, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc641}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000b80)={r1, 0x2000012, 0xe, 0x0, &(0x7f0000000080)="63eced8e46dc3f2ddf33c9e9b986", 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xb}, 0x50) 428.645765ms ago: executing program 0 (id=3247): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000680)={0x10, 0x4, &(0x7f0000000380)=ANY=[@ANYBLOB="1802000000c4400000000000e0feff00850000000f00000095"], &(0x7f00000000c0)='GPL\x00'}, 0x90) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000023c0)=@base={0x12, 0x4, 0x8, 0xb}, 0x48) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000540)=ANY=[@ANYRES32=r2, @ANYRES32=r1, @ANYBLOB='\a'], 0x10) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r3, 0x0) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="12000000040000000400000012"], 0x48) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000048c0)={r4, &(0x7f00000047c0), &(0x7f0000004880)=@udp=r3}, 0x20) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000500)={r2, &(0x7f0000000200), &(0x7f00000004c0)=@tcp6=r3, 0x1}, 0x20) r5 = syz_genetlink_get_family_id$devlink(&(0x7f0000000140), 0xffffffffffffffff) r6 = syz_open_procfs$namespace(0x0, &(0x7f00000001c0)='ns/net\x00') sendmsg$DEVLINK_CMD_RELOAD(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)={0x3c, r5, 0x1, 0x70bd27, 0x25dfdbfb, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, @DEVLINK_ATTR_NETNS_FD={0x8, 0x8a, r6}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4040010}, 0x30) 362.434719ms ago: executing program 4 (id=3248): mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x200000c, 0x3032, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r1, 0x8914, &(0x7f0000000000)) ioctl$sock_netrom_SIOCADDRT(r0, 0x890b, &(0x7f0000000280)={0x1, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @rose={'rose', 0x0}, 0xffff, 'syz0\x00', @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, 0xfffffdba, 0x1, [@default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @default, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @default, @default, @null]}) r2 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r2, 0x0, 0x40, &(0x7f00000004c0)=@raw={'raw\x00', 0x8, 0x3, 0x500, 0x340, 0x11, 0x148, 0x0, 0x0, 0x468, 0x2a8, 0x2a8, 0x468, 0x2a8, 0x3, 0x0, {[{{@uncond, 0x0, 0x2f8, 0x340, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'ip_vti0\x00', {0x300, 0x0, 0x3f, 0x6, 0x88000000, 0x3, 0x7}}}, @common=@unspec=@bpf1={{0x230}, @pinned={0x1, 0x0, 0x0, './file0\x00'}}]}, @unspec=@CT0={0x48}}, {{@ip={@multicast2, @empty, 0x0, 0x0, 'vlan0\x00', 'netdevsim0\x00'}, 0x0, 0xf8, 0x128, 0x0, {}, [@common=@osf={{0x50}, {'syz1\x00', 0x0, 0x4, 0x0, 0x2}}, @common=@unspec=@quota={{0x38}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x560) ioctl$sock_netrom_SIOCADDRT(r0, 0x890b, &(0x7f0000000300)={0x1, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @bpq0, 0x9, 'syz0\x00', @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, 0x82e, 0x5, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default, @bcast, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}]}) ioctl$sock_netrom_SIOCADDRT(r0, 0x890b, &(0x7f00000001c0)={0x1, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bpq0, 0x2, 'syz1\x00', @null, 0x40005, 0x1, [@netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @null, @default]}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0xb, &(0x7f0000000100)=ANY=[@ANYRES32], &(0x7f00000005c0)='GPL\x00', 0x4, 0xde, &(0x7f0000003e40)=""/222, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x4a}, 0x94) 204.213829ms ago: executing program 1 (id=3249): r0 = socket$nl_rdma(0x10, 0x3, 0x14) r1 = socket$kcm(0x10, 0x2, 0x0) socket$packet(0x11, 0x3, 0x300) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x40104}, 0x0) sendmsg$IPSET_CMD_CREATE(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f00000001c0)={0x60, 0x2, 0x6, 0x5, 0x0, 0x0, {0x0, 0x0, 0xfffc}, [@IPSET_ATTR_TYPENAME={0x12, 0x3, 'bitmap:ip,mac\x00'}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_DATA={0x14, 0x7, 0x0, 0x1, [@IPSET_ATTR_CIDR={0x5, 0x3, 0x1f}, @IPSET_ATTR_CADT_FLAGS={0x8, 0x8, 0x1, 0x0, 0xe4}]}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}]}, 0x60}, 0x1, 0x0, 0x0, 0x4010}, 0x0) sendmsg$IPSET_CMD_ADD(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000080)=ANY=[@ANYBLOB="400000000906010200000000000a0000000000000900020073797a31000000000500010007000000180007800c00018008000140ffffffff080009"], 0x40}, 0x1, 0x0, 0x0, 0x10000047}, 0x4000084) syz_emit_ethernet(0x3e, &(0x7f0000000000)=ANY=[@ANYBLOB="bbbbbbbbbbbbbbbbbbfdbbbb080045"], 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000100)={0x6, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="180000000200000000000000000808"], &(0x7f0000000240)='syzkaller\x00'}, 0x94) sendmsg$kcm(r1, &(0x7f0000000940)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000000)="d8000000100081046881f782db44b904021d080b01000000e8fe55a11800150006001400030000120800040043000000a8001600a400014020000d00036010fab94dcf5c0461c1d67f6f94007134cf6ee08000a0e408e8d8ef52a9d7c7c0b7a196e6f66112c88ac417898516277ce06bbace80177ccbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775730d0080000000000000b57a5025ccca9e00360db70100000040fad95667e006dcdf63951f215ce3bb14feb9f5588a63644caf1ce1bd6c769ad809d52a9ecbee", 0xd8}], 0x1}, 0x0) sendmsg$RDMA_NLDEV_CMD_SET(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)=ANY=[@ANYBLOB="1c000000021401002cbd7000fddbdf2509201d"], 0x1c}, 0x1, 0x0, 0x0, 0x24000841}, 0x800) 182.914965ms ago: executing program 2 (id=3250): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x800}, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='net_prio.prioidx\x00', 0x275a, 0x0) sendmsg$NL80211_CMD_GET_POWER_SAVE(r1, &(0x7f0000000300)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x10000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x22040004}, 0x4088) write$ppp(r1, &(0x7f00000000c0)="186ef0d51139cf744259baef7917f5b19caa093b7faf67408b1299c18a142aab5706dbc3f158c921412b9a850028b6323f4c800e765900dc0b78ee3745915b6023de5222c4e44c7e373edc25486306281cd05ff7ca9d4c50d88e905fbe16e798c315664b4c64cfb3d9c0a5b2ad2435943356a54e02be4253b1059c4a380b000ef15b1e0ee7b65b0522f15c3eca513f3a4b9f9e328bd9632f1bc4dbb91c453908ab97f5e76f95ef7f0ca463e5fe87f6b17532e70ecd9be4e0f2b570e95d8d0573315963e857c366c7fc6cab61c51815dfb09bd35d72a1d4d1428735df2200057f691f16dc20e4175ae3ba1f4e4030", 0xee) sendmsg$NFT_BATCH(r0, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)={{0x14}, [@NFT_MSG_NEWRULE={0xc4, 0x6, 0xa, 0x409, 0x0, 0x0, {0x2, 0x0, 0x3}, [@NFTA_RULE_EXPRESSIONS={0x98, 0x4, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, @log={{0x8}, @void}}, {0x68, 0x1, 0x0, 0x1, @counter={{0xc}, @val={0x58, 0x2, 0x0, 0x1, [@NFTA_COUNTER_BYTES={0xc, 0x1, 0x1, 0x0, 0x1}, @NFTA_COUNTER_BYTES={0xc, 0x1, 0x1, 0x0, 0xfd33}, @NFTA_COUNTER_PACKETS={0xc, 0x2, 0x1, 0x0, 0x401}, @NFTA_COUNTER_PACKETS={0xc, 0x2, 0x1, 0x0, 0x7344}, @NFTA_COUNTER_BYTES={0xc, 0x1, 0x1, 0x0, 0x32}, @NFTA_COUNTER_PACKETS={0xc, 0x2, 0x1, 0x0, 0x3}, @NFTA_COUNTER_BYTES={0xc, 0x1, 0x1, 0x0, 0x4}]}}}, {0x10, 0x1, 0x0, 0x1, @queue={{0xa}, @void}}, {0x10, 0x1, 0x0, 0x1, @dynset={{0xb}, @void}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0xec}, 0x1, 0x0, 0x0, 0x40010}, 0x4000) close(r0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000000, 0x10, r0, 0x476ba000) 134.928018ms ago: executing program 3 (id=3251): setsockopt$pppl2tp_PPPOL2TP_SO_DEBUG(0xffffffffffffffff, 0x111, 0x1, 0xc605, 0x4) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL80211_CMD_TDLS_CHANNEL_SWITCH(r0, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x4c, r1, 0x194ba81739ece88b, 0x70bd2d, 0x25dfdbfb, {{}, {@void, @val={0xc, 0x99, {0xfffffff9, 0x57}}}}, [@chandef_params=[@NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0x5}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x3}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8}], @NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_OPER_CLASS={0x5, 0xd6, 0xbd}]}, 0x4c}, 0x1, 0x0, 0x0, 0x8805}, 0x20008081) ioctl$XFS_IOC_PATH_TO_HANDLE(r0, 0xc0385869, &(0x7f0000000280)={r0, &(0x7f0000000180)='nl80211\x00', 0x351000, &(0x7f00000001c0)={@align, {0x84, 0x800, 0x7, 0x9}}, 0x0, &(0x7f0000000200)={@_ha_fsid}, &(0x7f0000000240)=0xb}) r3 = syz_genetlink_get_family_id$batadv(&(0x7f0000000300), r0) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f00000003c0)={'ip6tnl0\x00', &(0x7f0000000340)={'ip6gre0\x00', 0x0, 0x29, 0x2, 0xe6, 0x1000, 0x0, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @local, 0x80, 0x0, 0x2, 0x2a7d16f5}}) sendmsg$BATADV_CMD_GET_BLA_CLAIM(r2, &(0x7f00000004c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000480)={&(0x7f0000000400)={0x54, r3, 0x200, 0x70bd29, 0x25dfdbfe, {}, [@BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x7fff}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x1}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x8}, @BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r4}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x8}, @BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}]}, 0x54}, 0x1, 0x0, 0x0, 0x50}, 0x40) ioctl$AUTOFS_IOC_FAIL(r2, 0x9361, 0x6) sendmsg$can_bcm(r2, &(0x7f0000000600)={&(0x7f0000000500)={0x1d, r4}, 0x10, &(0x7f00000005c0)={&(0x7f0000000540)={0x1, 0x200, 0x3, {0x0, 0xea60}, {}, {0x4}, 0x1, @can={{0x0, 0x0, 0x0, 0x1}, 0x8, 0x2, 0x0, 0x0, "597f41c9fc8cdd61"}}, 0x48}, 0x1, 0x0, 0x0, 0x2004c820}, 0x40040) socket$inet6(0xa, 0xa, 0x1) setsockopt$packet_rx_ring(r2, 0x107, 0x5, &(0x7f0000000640)=@req3={0xfff, 0x5, 0x5, 0x4463c552, 0x9, 0x400, 0x9}, 0x1c) sendmsg$nl_generic(r0, &(0x7f0000001a00)={&(0x7f0000000680), 0xc, &(0x7f00000019c0)={&(0x7f00000006c0)={0x12c4, 0x23, 0x800, 0x70bd27, 0x25dfdbfc, {0x9}, [@generic="0cfe975a38789ae1dcfbbe360f135b91bd9df86cc127fdc682bb3032440d32d1dca4de6aeef08fdf702537ddbf084715d19c57421b1d101c3e11e7eaaab40f03fd9c7cb0a51371d93e205fd3a8be2292f9d8698a5152852386861a02a0c1a42452e78f2c872e5864fbec400da17692eb5b90f7ddf17c8b209b5731acfda505820f970cf842928f7da50bbaf7b458be775a06da0abfface0926cd0e4e0e9d28a62933343ea9c38cf2636558413529c1dc8b43d4eeed687b3ce58e78fa4b2138f2b1b561e712381129ba199aceb2795ae0f74e908d44cc95a0a38eb59f2167e83e4898608cfae04f9720d6", @nested={0x10d8, 0xff, 0x0, 0x1, [@generic="0181a3686bd2635c4d07442d572849e830156487a0b0da33e617acf9eb0c2017a98367daec2da43b297b594994a0d45d0e85c7e6634f2f6fbc7948250b75be205d189a5cd996de9e7d5306b8231c8b80811c26661ab3dff1b533dbb4e7885e750063ac61cba2d5f9491fff401fec9130f47a40d6deab1253058a27d0763cf290b64bcec85380a43d6c331d8188f137dbbc58ae5a93fb794f026a988f3a7752c8a1791760c196e74d23ca1162da7df0505879aca533ac488f8ef7a8e7f22fc01b0b219855d0cf12f890eee9a110afcf6e7361d9362441c3138323673b3a678959c8a9f005e5e498bece02243f21f4c1b3227989481bbd3770a1c9b5e332fe939ac833a71f4856535eb1000305caa5e35e9f997dced2850b259dfda552f7d8ca16561c9baf351e059abe949333d0815a3ec967128df19b93061d1ae87493b6001560297d5d2354c987e3b4e6821a0ee1677c806ee1e3364d4731796da38334fdc36cecf37acd24ea1964a040da4b42c0d710e13fa81f01b1e855dadc9c398cadb82ebafdfb0711f01f85d667ccafe12be32095bcf4ff313fad848104b9d8ca0d54ecd996c0427ea62d5e0667350beb1d663a7bb838c0953ea66fb6c3eacc65cf43d67b0032c0354c0a34b2498f761eb7ee73701c8496dd71888b7c497a99eea14bf993fc3068d13f68190632fe4733aa1ce9464efcbfdc98f17c465d2a1a2cb4bc812b9f565669ccd49847f2e81770a85726bb960d778a8b7d1f8e8c46dab9924cd9db7e0b46cdd12c5d90ae5ab4deea022880d6b54903d17ef49e8be1c45dc627d46a0aa14390bdfaee5c6280d51fb0e165f74953637f3c502b55f360ea3947e2e81fe8dab446939a4e76a6c5cccc1d2dd9d173942ba857d030119a2ce76c596a5b78bc2bd6c33dda63af24713d0de9bb3ef5a0614b3681ac99cefc73416d0288fcbaf1958bddd0bd008a3a28d6644a8f711240b17321705c6039ba4fbd6a611dc9e7dc83da958f88c56ff7e3d65d95c4be1652dfded28952945b83c0cc69ae6d3a413870043b1bddbba8fed16cd0c95da3a8ee902ce12042d3b1956d7699fb4b9600a61092a72abcbb8ea838a80b7c0d352ed0d2029ff95acc412ee418d88bb378bf1167dd8a831c6b08309df6a92706adb211a34d09e15550c4cbe8c23d38b3ab1985bb99e2c19f8118deadd68610e8a05db3255f7a015ec4a33f947e69b979140d1792a9b7deed502f5bbe05ce97e77c66edbb60bf6b3098f3c99d9d96e3744a7480a8b231421565c3446aad42ab22d16e05adc769c95af54b24b7273d2349e5bb52c3b515be65617f50168123d47e096a9cd5ccd82402366e2ebd5cd327b77b648d0dd55d3ad5fca11406917e4272ff098ffc858b7de463a20b306f8416c47ebb1259f0cef20e29fc2732a1f74ccf03f63637a244e89f5fc061d69c7925b5363968310ed20f7e483be6a159930036c74e3867a5d04d9a727f78759d784e5388366190074fa92d0d15d0a403d0c7ff239543a7444e130e99b482c98b97f4219aa9e37a748d72fa5b83c3131b6c5a21f9f915459832d33ee6de43f8d98b42921340b4098f2b4f9aa5b68c570526c0e034ab1a8f1d3534fd7cdd763578981a71c2fa72348831ecc9c0464e7d7c88980cf4202ac9ab84b037b4f1a509c7736a7f8ddc0f483e8464b8b658cbf9d6d81f88412f0fb643f165eaba54df3b50c905bd9df145501c5f737378dd33fa897a010088eef8b8b62c2e6be696cdfb73ebe89deabc3465c0c266e1938713493e583f55b91f1c5d90727a8bdd256f699fa380488af58cc1157202e92a99e8383ae60896c876ebdc527f2e70b8038aa40cbbb1c91da3d113fc345913096a624ed2333c0c69db153f6290a13e8890d59c0db23e01415c0548e25f2cceb69786ee9955f598ca883a0f5c94d045acf0f039ad17b8f021a009a8edc2ee8fcc8e16eb03569878c0e412b7a988861bdbd49ba52f91da399f4512f719a0529f05ac7a6cdfa09ec824d49dbf3e69863c8e8c2f10bbb43b43267adcc4ac6d243150929e7c8fd85b0add40016fc33fe3285bf5ec4a629051339558c2b96d22dfb6191613e409e8b081248bada51088900b66417bd1916dee4b750897abe9f941932f2b017a3e1e0eba0cef69fccf891c5c2db73e3b8661a125100ce3d2734ed7db0b2d3cf18c742289b326ca58993a7439575956450b619e83fa5584c03a8d542b11cc091c224e2db1d2ada0579e7a19bcb6159ad2d2e9f7bbc77c35060d559fca3ab0c376945a8141f77793a78ccbff8b8f186d2268bf0a2cd232b948e26b13188093924accad4d7f3e5a07af783b5d600e4404b46451a921ae21751a0653b59430ab799e75f690fecee3ed57452caeeb5488760504d3c23872074e124db064e1bf519f4b7d15d5343d3cc074f680ab0a10938b7708d16a6f4b914a919b13d989dfe84cf271237186dfafe7dfeea11f5c938f4c8b7d2459737c96bf36d6fc515151b4bff759297ae26c9fd2432f9931f585d434c8eea89e9b961b38a8813442d2b4f9b11514a5eae35420c227c3d8389230ea698cbb9232c07bf877e7b80caded168b54e0bf0c622672f20e3bed68f93bc1dfc77d080aec176d07136019055cac43c95ed82a123eb1dae3dac57888e07cf0aa1a631a14a20b378338a91a8fb42a247850a8097055d3a3bd0f0cc811dbcb1c0b379e057e766b230f6d04e3d24f66ca7193d6e8a05e13fdc361d8aaa7923e2506488751b3f7d25ad32bd0b771fb6582db76105bf96b8cc1ac17aba71df610d2b08b4c633505f7d547e4ae37e40f7798277f8ecea0492b545d48f419212eb45d7a8d7c834c5c11ccf2a7007f404125090dfc2b2c1bec7d481a56fda05d38dfdd81c57aab946da15d48637fb053cb81882351c4a14ab37bdb988bfce8645c9ec8a14314a565d97f3b16d93049a38e52a944cf73746c14564b289e876f4817142f915ce54dae58d72f0a9df7352ffc2866c25a069b16c5f807d704e2ea366189648105e43acc374fbdbeb54d144f64ecaa2c9ba6d83d9e563201dcd1e38ec80c837abe5b0aa7f45028277e499a1c3ced97262859ed322f4918c3670c7ffc8e057b654365c0df5c258f32c96e2d4a72ccefe87ddde1d2f5ef4aee7bb89bb6fd8b7df0fedecf65253ebf7af4f916ba3676a364fb58f9b1b44352ddf75de994451ebc9ddbe3e077c2f84dc9774e47cfb65f60d7190372144a2af4b949ed2d2e2c95ad7f1300ffee545e85972da3ae043ef8317dcc428f81c9abdd1ebd5aff5b5ddb14139b59950cbafe0d2629260fc1ed3c861593b53717ecb82f23f6c8d1690022e1f5d04d97cedf91ec0b5f7484c09969c8ee89b50ec890c476024ecd91662581fd9a8b48ae3ab15b14407f85172c0816821696198a24af8c6f80e679254ce295d714b956390bfd194eaae894de917bdf97d85a7e686cce674236636bb29357fdcc5fa33064d94a9c502b238012dba9d1cfda3e6d78fe90370969f742f70dc66277094b97f184de2c738397954750e12103cd98074f2439c8fbce87bd0bf2865382da0300d6701cd753c0e1da2f38fb108f4f73c3843e8bbfbbaea122f6d90edb66a95e6ab66ae7a5fe2089005f2893ae70248f6efa6b7a150a9c42d4c1a41410a9bcc92f7794799ef2c2ccf53e0ed3f60293a269fadf380e5b561a43483e764bb6149116019328b8aad7237509128e092fde21fc68844b27ab4209ffd1bca077ea8d6834497c69ee0cda81fe205ce7ada54e5e2d9361b68df49f3c67ea73cad1b7c52a3c7f64a4eba348b02f1db49e8bd9a6872ec24e614942ed3258ddf5a5ab70f3bda82cc043fd71e02e989aafbcbec026653f4629d25273550e0db674640e53d4be783ab04e4ef5bfb60b915bfa718f13b024d48fda112d50557b24105c659bc229a2af437461f0791822d947e01e79aa34f03305b9349abacd60d7be3d7676d2b534a3e0641af2851dce6c68a6fdc3e386403dab59319479d825b75cb3119e6e035ed41fa93990ff96598ff81bb875a414c3e02bd8cb7be91fb589842c8f93de7783e1bdd785d8d3a56213fe9ed722d017042b4bbe1c71f4c451a435a83c8943de20eabce3d1bfd8e6b80310b5d2f4b6d0f7b61327470cca34805a7e37fbc141a8f4394d5fc3b41ec54b29d7b051e64a7a62536b1cd40e991082991dd68080a9f41efca2df4e54a161b618775e6e99f9a9cc70bd84baffbfadbffec030b9584c6f1379f885e692f3da2539bf8ae624eaee499dea3dbdcfdb38dc5873f0d1854969e92fd2a929bc16e5330da0eff43df540910e7eaab79854e5cab53144ac7d1ddb98c97ea20a60be3bdf3b818f0c50b4402d3334176d84e9c715dc33cb1d060f7b78c41cd7cdb42c0f2075987db7df377653830de8a40717bda14b154b9e9378a5eb33fd032c8c5dc44fee8495bcde07a2fbc16c7d933479f59c3b21d90481803acd6e12f1bc3cfbf4237938e3196118b2d98b65d2ee6d01ada85d18215e8fbee6478c2fb11a09d8bf738f2e743a8f63aaa2d4715cbb1ace610e89a023666577617bf67c23c7ab320f19952727065ea1a65ca248ca8a915ea03373b9ef48fc012ef349daab919481becd1be56ed608b77902752f867a85ce5bc599049041ac4f276dad41d5e006800b5690f7ffca780c772c37911beb16ee6ec228b34b60e8fb9e6c52527b1c97c7ec807971ef05d3e35c21c29bd0165f6ecbf153a08fe3e10f2c7bde81820c2c3bf55970d6a55b31b63450089f2d051d09a83431d1fe187908d92696f86fd91e1f3996e82c33c448c768d8f0ec329de759bd9c0d2bfb0b8f933b45db26876f1952486205e21e9de708c07879c84385361520ac7f2d498288647787f9359e62ed045a3ca078d09602a482c77365fb2d04288e48f7bbbd081806e68c5facf7348ebf30740c277845367d7c8cc7b49895bc7083b34f3e64b0493dc29119851a89637816a443288ce4ffccf9e5067021b85bc901194c53e12f17b0acb350d4f33a984b1a859d4955768b27b27ad8ca16e3791602a473667880746c2b74ce16df708d78a5873a8622e55a91c80e29d70c7bdc4586eb40aa2b485243f7d61a488263093a9405b1de86b4cdcf59ca651b3e52e865174ecd61a72ba49aa06322b1c9e91c023cb5d420c53b0eba9ae8a441af082d03eaefc82dd8b1e12360325793f6925b2238f91d9d384cbfd0c16f7af2940b59e0672596d00025ad628085945095f7b246369545fde528b9ffb7fb95e1daa67aaba5a652eb16630fa78fb5c47691878ac8787ccd8d789c0fbb02a8f8dd402bae845b6c96e62cf9c6714aea9eb970d590b193fdeb3257c5c9fc174ef6ec73878b112073bc64871ba2e6148615b88a2a901a3c9047c08d7192c2538125ac8f0e08f95aa326c0b0bbeeeca3a8f6fc92c115893098cc9a6cd7211ac9cebd99a171ce2eac184129cf1fe6898411e9d568a0fc9b13a2d1ae803300cc456c06a0c2083165ff2d0a411f3304f53c070c3afc45d2f4bba746cc2c20371cc7d8f43d9de0d88bc465682081ad36ac26ed3b205e47cf19836361b833ac953e4522ce27a9560127148c99ad801a5cec4ba0f0fdffc1464e39d7fc3b2b31dce1b38925c156b2015a7a676643165f3193264ef305baf8c6b3418ed286b05f2a788080a2f61478e1486585a7c99807304b00ddcf7f4c597df6e6604eb584140287e9c4b2e23fa7ebb05d132b35b4e02940831083954e618ce54ec0ec8cfb8abf24ad87eb10e58f531e63344c05c8a677794eb32d1de01d", @nested={0x4, 0x64}, @generic="8f914e32993c7fd6304bb615e4ace353d72205eae5d2ef41cd0dcfebe06e8a810a8dc46afeb45ff6b2dd98e4ad7f9540fada5a534bea9c7760b7ab5ab67015d2221e765bd5992f0ebe4ca08c639096efd4ae2a597d12feeb8b05db3f", @generic="c4479c3a8d5605c40e8c0085ef8c145f6a508ab390952dc56a20624ee9b6b6b1bb2f4fe8265d9d0739a366d0cc7c44d53aeeab72b43d104f882c7f2519cb7cca90a30de7fcb0a30abcab3891838aaad7", @typed={0xc, 0xa4, 0x0, 0x0, @u64=0x200}, @generic, @nested={0x4, 0x13b}, @generic="48daf1ed2145a210105d6edfe13b18f15e3bc80c"]}, @nested={0xe9, 0x92, 0x0, 0x1, [@generic="7057cc9a31c1c5a1d861792247906e488ea229a5054df898cc5883551724cd6522ffc59628b22ef514b22c32a2cfc75fae160a588f54c8e8b0b5006683420c351edfa68ffc1f8323705a372ea542d008e354aeef105c271ba698fd5e661264e433ff8c6d65ca7a956ebb55314e2f91467d5905955428bbaaec64c310a4262de899d5a0f9d6728fc0015135f91a002c58bc188fc337068a54", @typed={0xc, 0x5, 0x0, 0x0, @u64=0x8}, @generic="13d8cf83fd79a278700adab6d140b8b7ebeeebdd01801404c2ef58cdd0c9ad78ffbcef8a97afa6dc30a4fa73442391ab78d024d1f473bc17b8", @typed={0x8, 0x40, 0x0, 0x0, @fd=r2}]}]}, 0x12c4}}, 0x4000000) sendmsg$NL80211_CMD_RELOAD_REGDB(r0, &(0x7f0000001b00)={&(0x7f0000001a40)={0x10, 0x0, 0x0, 0x80020000}, 0xc, &(0x7f0000001ac0)={&(0x7f0000001a80)={0x14, r1, 0x5, 0x70bd29, 0x25dfdbfc, {}, ["", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x50}, 0x200048d0) sendmsg$NL80211_CMD_UPDATE_FT_IES(r2, &(0x7f0000001d00)={&(0x7f0000001b40)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000001cc0)={&(0x7f0000001b80)={0x138, r1, 0x100, 0x70bd25, 0x25dfdbfe, {{}, {@void, @void}}, [@NL80211_ATTR_IE={0x121, 0x2a, [@peer_mgmt={0x75, 0x6, {0x0, 0x95f, @val=0x9, @void, @void}}, @prep={0x83, 0x25, {{0x0, 0x1}, 0x3, 0x5, @broadcast, 0x67, @value, 0x9, 0x81, @device_a, 0x1}}, @prep={0x83, 0x1f, {{}, 0x0, 0x3, @device_a, 0x59d, @void, 0x2, 0x5, @device_b, 0x2}}, @measure_req={0x26, 0xa7, {0x4, 0x5, 0x48, "c3dedd2854528201aba105bc429503831d60c05c50d35663721900ead2bbd5ee01914e2e1473e6361e200577480c5b84f7b0d585cf2d98f355d7749ca1a4c18b150cf17bca0bb29000c1c762b3472e66d766298d895bc6b3dc6365be728c2ae3d6850a074d8600ad3bbbba499f0ae640963356919ee5d2d0f927861f73adc183dddd770d0a1cbddb5af7148861b365ceac7b1b4ef4c93d2d5c64dbdb8d378fc1a532cb59"}}, @gcr_ga={0xbd, 0x6}, @link_id={0x65, 0x12, {@from_mac=@device_b, @broadcast, @broadcast}}, @mesh_id={0x72, 0x6}]}]}, 0x138}, 0x1, 0x0, 0x0, 0x5}, 0x4000) ioctl$BTRFS_IOC_ENCODED_WRITE(r0, 0x40809440, &(0x7f0000001e80)={&(0x7f0000001e40)=[{&(0x7f0000001d40)="8991131ff06eda29bcd5281cb41b1ec81336bcaebe0895d4c8241b6c622dbeaf53a6899f057c194039d66f191d85f7c8558956f97924767568b9be1ac34c16ae2a9200c74bafa2cbfcc5e711414ad7f431c06cda6b756285df7f2dd3ab27de37c62c3e96c5a751b0a81a6ff66d76e5ee6dfdb85892d237198ab58233c0e282a91e6e22f2feac9911b525c32581ac7f18133c4125767294120600d69af2b2bca31d86ebb93a6e0f13d30389089d48ab2cc83a3a30f8f2d99d6fb3c4eb6f0776df153711f2a8e00b6a68a872f1bee1e229deb8f2ac6b84a087226d85d7d5442f", 0xdf}], 0x1, 0x100000000, 0x0, 0x8, 0x6, 0x761c, 0x7, 0x1}) sendmsg$TIPC_CMD_SHOW_LINK_STATS(r2, &(0x7f0000001fc0)={&(0x7f0000001f00)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000001f80)={&(0x7f0000001f40)={0x30, 0x0, 0x0, 0x70bd27, 0x25dfdbfd, {{}, {}, {0x14, 0x14, 'broadcast-link\x00'}}, ["", "", "", "", "", ""]}, 0x30}}, 0xc80) accept$packet(r2, &(0x7f0000002000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000002040)=0x14) socket$can_raw(0x1d, 0x3, 0x1) r6 = syz_genetlink_get_family_id$ethtool(&(0x7f00000020c0), r0) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r0, &(0x7f0000002180)={&(0x7f0000002080)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000002140)={&(0x7f0000002100)={0x3c, r6, 0x400, 0x70bd26, 0x25dfdbfc, {}, [@ETHTOOL_A_LINKMODES_HEADER={0x28, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ip_vti0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r5}]}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4000}, 0x101) openat$ppp(0xffffffffffffff9c, &(0x7f00000021c0), 0x1, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(r2, 0x89e2, &(0x7f0000002200)={r2}) sendmsg$RDMA_NLDEV_CMD_RES_MR_GET(r7, &(0x7f0000002300)={&(0x7f0000002240)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f00000022c0)={&(0x7f0000002280)={0x20, 0x140d, 0x100, 0x70bd28, 0x25dfdbfc, "", [@RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x4}, @RDMA_NLDEV_ATTR_RES_MRN={0x8, 0x3e, 0x5}]}, 0x20}, 0x1, 0x0, 0x0, 0x8000}, 0x4840) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r2, 0x6, 0x14, &(0x7f0000002340)=0x2, 0x4) ioctl$sock_SIOCSIFVLAN_GET_VLAN_INGRESS_PRIORITY_CMD(0xffffffffffffffff, 0x8983, &(0x7f0000002380)) r8 = syz_genetlink_get_family_id$ethtool(&(0x7f0000002400), r7) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r2, 0x89f3, &(0x7f00000024c0)={'ip6tnl0\x00', &(0x7f0000002440)={'syztnl0\x00', r4, 0x29, 0xc0, 0xbb, 0xffffffff, 0x0, @empty, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x7, 0x80, 0x4, 0xa}}) sendmsg$ETHTOOL_MSG_COALESCE_GET(r0, &(0x7f0000002640)={&(0x7f00000023c0)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000002600)={&(0x7f0000002500)={0xf0, r8, 0x400, 0x70bd28, 0x25dfdbfd, {}, [@HEADER={0x60, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vxcan1\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r5}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r4}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'macsec0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'wg1\x00'}]}, @HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}]}, @HEADER={0x30, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r5}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r9}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'wg2\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}]}, @HEADER={0x1c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r5}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r4}]}, @HEADER={0x24, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r4}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}]}]}, 0xf0}, 0x1, 0x0, 0x0, 0x40}, 0x4050) sendmsg$NBD_CMD_RECONFIGURE(0xffffffffffffffff, &(0x7f0000002740)={&(0x7f0000002680)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000002700)={&(0x7f00000026c0)={0x20, 0x0, 0x2, 0x70bd2a, 0x25dfdbff, {}, [@NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x84}]}, 0x20}, 0x1, 0x0, 0x0, 0x48014}, 0x20004800) 0s ago: executing program 2 (id=3252): r0 = socket(0x2, 0x80805, 0x0) sendmmsg$inet_sctp(r0, &(0x7f0000000880)=[{&(0x7f0000000440)=@in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, &(0x7f00000004c0)=[{&(0x7f0000000100)="03", 0x1}], 0x1}], 0x1, 0x0) sendmmsg$inet_sctp(r0, &(0x7f00000032c0)=[{0x0, 0x0, &(0x7f0000000240)=[{0x0}, {&(0x7f0000000300)="359cb6", 0x3}], 0x2, &(0x7f0000000000)=ANY=[@ANYBLOB="30000000000000008400000001000000000000000c000400"/44, @ANYRES32=0x0], 0x30}], 0x1, 0x0) kernel console output (not intermixed with test programs): 0][ T995] netdevsim netdevsim4 eth3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 339.956280][ T995] netdevsim netdevsim4 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 340.045662][T14013] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 340.104591][T14047] A link change request failed with some changes committed already. Interface bond_slave_1 may have been left with an inconsistent configuration, please check. [ 340.162226][T14013] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 340.307726][T12004] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 340.353357][T12004] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 340.378915][T12004] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 340.409427][T12004] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 340.483168][ T995] ip6_tunnel: ip6tnl7 xmit: Local address not yet configured! [ 340.503402][ T995] ip6_tunnel: ip6tnl7 xmit: Local address not yet configured! [ 340.511402][ T7907] ip6_tunnel: ip6tnl7 xmit: Local address not yet configured! [ 340.538471][T14076] netlink: 56 bytes leftover after parsing attributes in process `syz.0.2032'. [ 340.558190][T14078] netlink: 48 bytes leftover after parsing attributes in process `syz.1.2036'. [ 340.660824][T14080] bond7: entered promiscuous mode [ 340.681231][T14080] 8021q: adding VLAN 0 to HW filter on device bond7 [ 340.840019][T14094] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2040'. [ 340.850034][T14094] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2040'. [ 340.861282][T14094] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2040'. [ 340.864337][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 340.871853][T14094] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2040'. [ 340.878228][ C1] lec:lec_tx_timeout: lec0 [ 340.880167][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 340.897799][ T7907] ip6_tunnel: ip6tnl7 xmit: Local address not yet configured! [ 340.911387][T14094] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2040'. [ 340.920985][T14094] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2040'. [ 340.930629][T14094] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2040'. [ 340.941080][T14094] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2040'. [ 340.951049][T14094] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2040'. [ 340.961367][ T7907] ip6_tunnel: ip6tnl7 xmit: Local address not yet configured! [ 340.994713][T14094] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2040'. [ 341.070442][T14059] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 341.255808][T14114] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 341.339975][T14118] unsupported nlmsg_type 40 [ 341.610840][T14132] lo speed is unknown, defaulting to 1000 [ 341.637045][T14132] wg1 speed is unknown, defaulting to 1000 [ 341.791679][T14144] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 341.825895][T14139] lo speed is unknown, defaulting to 1000 [ 343.561351][T14139] wg1 speed is unknown, defaulting to 1000 [ 343.872621][T14169] netlink: 'syz.2.2058': attribute type 1 has an invalid length. [ 343.880997][ T5841] Bluetooth: hci3: link tx timeout [ 343.893085][ T5841] Bluetooth: hci3: killing stalled connection 11:aa:aa:aa:aa:aa [ 344.208038][T14183] sctp: [Deprecated]: syz.1.2063 (pid 14183) Use of int in max_burst socket option. [ 344.208038][T14183] Use struct sctp_assoc_value instead [ 344.289878][T14183] lo speed is unknown, defaulting to 1000 [ 344.301992][T14183] wg1 speed is unknown, defaulting to 1000 [ 344.401132][T14189] lo speed is unknown, defaulting to 1000 [ 344.423859][T14189] wg1 speed is unknown, defaulting to 1000 [ 344.475256][ C0] ip6_tunnel: ip6tnl7 xmit: Local address not yet configured! [ 345.249365][ T126] netdevsim netdevsim2 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 345.268653][ T126] netdevsim netdevsim2 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 345.309308][ T126] netdevsim netdevsim2 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 345.339148][ T126] netdevsim netdevsim2 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 345.558158][T14244] lo speed is unknown, defaulting to 1000 [ 345.575912][T14244] wg1 speed is unknown, defaulting to 1000 [ 345.904243][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 345.912314][ C1] lec:lec_tx_timeout: lec0 [ 345.917224][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 345.923764][ T5841] Bluetooth: hci3: command 0x0405 tx timeout [ 346.275119][T14288] tipc: Enabled bearer , priority 14 [ 346.284798][T14293] __nla_validate_parse: 111 callbacks suppressed [ 346.284817][T14293] netlink: 3 bytes leftover after parsing attributes in process `syz.1.2082'. [ 346.344594][T14293] 0X: renamed from caif0 [ 346.359848][T14293] tipc: Disabling bearer [ 346.381145][T14293] 0X: entered allmulticast mode [ 346.393388][T14293] A link change request failed with some changes committed already. Interface 60X may have been left with an inconsistent configuration, please check. [ 346.745821][T14315] bond8: entered allmulticast mode [ 346.934672][T14326] netlink: 28 bytes leftover after parsing attributes in process `syz.0.2091'. [ 346.943714][T14326] netlink: 28 bytes leftover after parsing attributes in process `syz.0.2091'. [ 347.065298][T14337] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2092'. [ 347.819876][T14361] lo speed is unknown, defaulting to 1000 [ 347.827852][T14371] netlink: 36 bytes leftover after parsing attributes in process `syz.4.2097'. [ 347.880292][T14370] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2099'. [ 347.894220][T14361] wg1 speed is unknown, defaulting to 1000 [ 347.925915][T14370] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2099'. [ 347.944841][T14370] netlink: 'syz.1.2099': attribute type 13 has an invalid length. [ 348.349252][T14393] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 348.488816][T14402] macvlan0: entered promiscuous mode [ 348.519142][T14402] bond0: entered promiscuous mode [ 348.526038][T14402] bond_slave_0: entered promiscuous mode [ 348.538209][T14402] bond_slave_1: entered promiscuous mode [ 348.576461][T14402] 8021q: adding VLAN 0 to HW filter on device macvlan0 [ 348.608427][T14415] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2106'. [ 348.612252][T14402] team0: Port device macvlan0 added [ 348.692996][T14407] team_slave_1: Caught tx_queue_len zero misconfig [ 348.717271][T14425] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 348.973630][T14438] xt_recent: hitcount (33554435) is larger than allowed maximum (65535) [ 349.201444][T14441] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2115'. [ 349.237123][T14441] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2115'. [ 350.023630][T14482] syzkaller0: entered promiscuous mode [ 350.070085][T14482] syzkaller0: entered allmulticast mode [ 350.098669][T14488] ip6tnl0: Caught tx_queue_len zero misconfig [ 350.780961][T14515] netlink: 'syz.4.2128': attribute type 7 has an invalid length. [ 350.924187][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 350.932266][ C1] lec:lec_tx_timeout: lec0 [ 350.937980][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 352.236015][ T11] block nbd0: Possible stuck request ffff8880269c0000: control (read@0,1024B). Runtime 120 seconds [ 352.246888][ T11] block nbd0: Possible stuck request ffff8880269c0200: control (read@1024,1024B). Runtime 120 seconds [ 352.258185][ T11] block nbd0: Possible stuck request ffff8880269c0400: control (read@2048,1024B). Runtime 120 seconds [ 352.269344][ T11] block nbd0: Possible stuck request ffff8880269c0600: control (read@3072,1024B). Runtime 120 seconds [ 352.389790][T14508] workqueue: Failed to create a rescuer kthread for wq "wg-crypt-wireguard%d": -EINTR [ 352.522976][T14529] __nla_validate_parse: 6 callbacks suppressed [ 352.522997][T14529] netlink: 256 bytes leftover after parsing attributes in process `syz.2.2133'. [ 352.738923][T14539] netlink: 104 bytes leftover after parsing attributes in process `syz.4.2136'. [ 352.762499][T14543] netlink: 'syz.1.2139': attribute type 32 has an invalid length. [ 352.771296][T14543] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2139'. [ 352.780467][T14543] bond0: option coupled_control: mode dependency failed, not supported in mode balance-rr(0) [ 353.090291][T14559] netlink: 'syz.0.2145': attribute type 1 has an invalid length. [ 353.127673][T14559] netlink: 28 bytes leftover after parsing attributes in process `syz.0.2145'. [ 353.138082][T14559] 8021q: adding VLAN 0 to HW filter on device bond9 [ 353.343454][T14574] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2149'. [ 353.353052][T14574] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2149'. [ 353.362815][T14574] netlink: 'syz.2.2149': attribute type 5 has an invalid length. [ 353.383201][T14573] netlink: 256 bytes leftover after parsing attributes in process `syz.0.2148'. [ 353.597423][T14586] netlink: 'syz.2.2153': attribute type 4 has an invalid length. [ 353.914039][T14602] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2158'. [ 354.000637][T14610] netlink: 256 bytes leftover after parsing attributes in process `syz.4.2161'. [ 354.040273][T14612] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2162'. [ 354.051963][T14612] netlink: 'syz.3.2162': attribute type 12 has an invalid length. [ 354.063941][T14612] netlink: 'syz.3.2162': attribute type 12 has an invalid length. [ 354.119211][T14612] bond7: option arp_all_targets: invalid value (129) [ 354.128050][T14612] bond7 (unregistering): Released all slaves [ 354.167235][T14616] tipc: Enabled bearer , priority 0 [ 354.177394][T14615] tipc: Disabling bearer [ 354.539725][T14646] .70: renamed from hsr0 [ 354.552857][T14646] .70: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 354.574308][T14646] .70: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 354.600520][T14646] .70: entered allmulticast mode [ 354.627103][T14646] hsr_slave_0: entered allmulticast mode [ 354.648731][T14646] hsr_slave_1: entered allmulticast mode [ 354.656823][T14646] A link change request failed with some changes committed already. Interface .70 may have been left with an inconsistent configuration, please check. [ 354.691984][T14657] syzkaller0: entered promiscuous mode [ 354.705910][T14657] syzkaller0: entered allmulticast mode [ 355.372226][T14648] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 355.650369][T14702] netlink: 'syz.3.2190': attribute type 1 has an invalid length. [ 355.824681][T14711] tipc: Enabled bearer , priority 0 [ 355.840348][T14711] syzkaller0: entered promiscuous mode [ 355.852898][T14711] syzkaller0: entered allmulticast mode [ 355.898698][T14716] lo: entered allmulticast mode [ 355.990204][T14711] tipc: Resetting bearer [ 356.065087][T14710] tipc: Resetting bearer [ 356.144867][T14710] tipc: Disabling bearer [ 356.160952][T14732] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 356.186690][T14720] lo speed is unknown, defaulting to 1000 [ 356.195624][T14720] wg1 speed is unknown, defaulting to 1000 [ 356.201710][T14734] tipc: Enabled bearer , priority 0 [ 356.315366][T14739] A link change request failed with some changes committed already. Interface ipvlan0 may have been left with an inconsistent configuration, please check. [ 356.331917][T14739] netlink: 'syz.0.2198': attribute type 6 has an invalid length. [ 356.340206][T14739] IPv6: NLM_F_CREATE should be specified when creating new route [ 356.352691][T14739] netlink: 'syz.0.2198': attribute type 2 has an invalid length. [ 356.369177][T14739] l24): entered promiscuous mode [ 356.567453][T14747] mac80211_hwsim hwsim10 syzkaller0: left promiscuous mode [ 356.575727][T14747] mac80211_hwsim hwsim10 syzkaller0: left allmulticast mode [ 356.714152][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5780 ms [ 356.722192][ C1] lec:lec_tx_timeout: lec0 [ 356.727262][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 357.149852][T14790] netlink: 'syz.1.2214': attribute type 1 has an invalid length. [ 357.400422][T14799] netlink: 'syz.2.2216': attribute type 4 has an invalid length. [ 357.408305][T14799] netlink: 'syz.2.2216': attribute type 1 has an invalid length. [ 357.509759][T14823] netlink: 'syz.0.2220': attribute type 1 has an invalid length. [ 357.600821][T14823] 8021q: adding VLAN 0 to HW filter on device bond10 [ 357.719237][T14828] netlink: 'syz.1.2224': attribute type 1 has an invalid length. [ 357.730259][T14831] __nla_validate_parse: 14 callbacks suppressed [ 357.730297][T14831] netlink: 24 bytes leftover after parsing attributes in process `syz.1.2224'. [ 358.039423][T14852] xt_CT: You must specify a L4 protocol and not use inversions on it [ 358.048584][T14851] xt_CT: You must specify a L4 protocol and not use inversions on it [ 358.183128][T14856] netlink: 'syz.3.2229': attribute type 1 has an invalid length. [ 358.232799][T14856] 8021q: adding VLAN 0 to HW filter on device bond7 [ 358.247869][T14855] tipc: Enabling of bearer rejected, already enabled [ 358.383736][T14852] bond7: (slave veth7): Enslaving as an active interface with a down link [ 358.641600][T14883] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2238'. [ 358.667515][T14880] lo speed is unknown, defaulting to 1000 [ 358.685500][T14883] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2238'. [ 358.746450][T14880] wg1 speed is unknown, defaulting to 1000 [ 358.753781][T14894] netlink: 40 bytes leftover after parsing attributes in process `syz.4.2240'. [ 358.771546][T14894] netlink: 260 bytes leftover after parsing attributes in process `syz.4.2240'. [ 358.808007][T14896] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 359.006868][T14909] tunl0: Caught tx_queue_len zero misconfig [ 359.235616][T14919] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2246'. [ 359.370379][T14918] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2247'. [ 359.386897][T14929] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2248'. [ 359.569040][T14918] 8021q: adding VLAN 0 to HW filter on device bond11 [ 359.614814][T14922] syzkaller1: tun_chr_ioctl cmd 1074025677 [ 359.620846][T14922] syzkaller1: linktype set to 825 [ 359.693875][T14918] macsec1: entered allmulticast mode [ 359.699567][T14918] bond11: entered allmulticast mode [ 359.706651][T14918] bond11: left allmulticast mode [ 359.848466][T14952] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2255'. [ 359.876293][T14952] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2255'. [ 360.016335][T14952] workqueue: name exceeds WQ_NAME_LEN. Truncating to: . ΁ *] [ 360.415036][T14971] netlink: 'syz.4.2261': attribute type 1 has an invalid length. [ 360.456347][T14971] vlan4: entered promiscuous mode [ 360.461535][T14971] gretap0: entered promiscuous mode [ 360.525165][T14988] netlink: 'syz.0.2265': attribute type 1 has an invalid length. [ 360.597469][T14988] bond12: entered promiscuous mode [ 360.603124][T14988] 8021q: adding VLAN 0 to HW filter on device bond12 [ 360.651603][T14988] 8021q: adding VLAN 0 to HW filter on device bond12 [ 360.661007][T14988] bond12: (slave ip6gre2): The slave device specified does not support setting the MAC address [ 360.672086][T14988] bond12: (slave ip6gre2): Setting fail_over_mac to active for active-backup mode [ 360.688275][T14988] bond12: (slave ip6gre2): making interface the new active one [ 360.696117][T14988] ip6gre2: entered promiscuous mode [ 360.703325][T14988] bond12: (slave ip6gre2): Enslaving as an active interface with an up link [ 360.874483][T15013] IPVS: set_ctl: invalid protocol: 0 255.255.255.255:20004 [ 361.189860][T15028] mac80211_hwsim hwsim11 syzkaller0: left promiscuous mode [ 361.203298][T15028] mac80211_hwsim hwsim11 syzkaller0: left allmulticast mode [ 361.358725][T15039] netlink: 'syz.2.2277': attribute type 10 has an invalid length. [ 361.370610][T15034] IPv6: sit1: Disabled Multicast RS [ 361.379548][T15034] sit1: entered allmulticast mode [ 361.388497][T15041] netlink: 'syz.0.2276': attribute type 30 has an invalid length. [ 361.440981][T15038] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 361.754169][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5030 ms [ 361.762245][ C1] lec:lec_tx_timeout: lec0 [ 361.766902][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 361.860044][T15064] set match dimension is over the limit! [ 362.101162][T15084] lo speed is unknown, defaulting to 1000 [ 362.161860][T15084] wg1 speed is unknown, defaulting to 1000 [ 362.662738][T15118] netlink: 'syz.0.2300': attribute type 6 has an invalid length. [ 362.779718][T15122] netlink: 'syz.4.2302': attribute type 9 has an invalid length. [ 362.858720][T15129] x_tables: ip6_tables: mh match: only valid for protocol 135 [ 362.862672][T15122] netlink: 'syz.4.2302': attribute type 9 has an invalid length. [ 362.879829][T15129] netlink: 'syz.3.2305': attribute type 9 has an invalid length. [ 362.932995][T15122] netlink: 'syz.4.2302': attribute type 9 has an invalid length. [ 362.942378][T15129] __nla_validate_parse: 28 callbacks suppressed [ 362.942395][T15129] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2305'. [ 362.991180][T15122] netlink: 'syz.4.2302': attribute type 9 has an invalid length. [ 363.024820][T15137] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2307'. [ 363.047164][T15137] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2307'. [ 363.061331][T15137] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2307'. [ 363.073862][T15137] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2307'. [ 363.084033][T15137] erspan0: entered promiscuous mode [ 363.091878][T15137] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2307'. [ 363.102805][T15137] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2307'. [ 363.119475][T15137] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2307'. [ 363.135533][T15137] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2307'. [ 363.146870][T15137] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2307'. [ 363.166497][T15137] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 363.192527][T15122] netlink: 'syz.4.2302': attribute type 9 has an invalid length. [ 363.235293][T15122] netlink: 'syz.4.2302': attribute type 9 has an invalid length. [ 363.244790][ T5929] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 363.784535][ T5929] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 363.792655][ T995] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 364.002358][T15184] ؤFN&: renamed from lo (while UP) [ 364.346025][T15206] batman_adv: batadv0: Adding interface: dummy0 [ 364.352585][T15206] batman_adv: batadv0: The MTU of interface dummy0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 364.379288][T15206] batman_adv: batadv0: Not using interface dummy0 (retrying later): interface not active [ 364.738749][T15233] xt_recent: Unsupported userspace flags (000000b1) [ 364.759220][T15236] FAULT_INJECTION: forcing a failure. [ 364.759220][T15236] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 364.814553][T15236] CPU: 1 UID: 0 PID: 15236 Comm: syz.3.2338 Not tainted syzkaller #0 PREEMPT(full) [ 364.814582][T15236] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 364.814594][T15236] Call Trace: [ 364.814601][T15236] [ 364.814615][T12010] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 364.814609][T15236] dump_stack_lvl+0xe8/0x150 [ 364.814643][T15236] should_fail_ex+0x412/0x560 [ 364.814788][T15236] _copy_from_user+0x2d/0xb0 [ 364.814867][T15236] __sys_connect+0x156/0x450 [ 364.814949][T15236] ? __pfx___sys_connect+0x10/0x10 [ 364.815054][T15236] ? __pfx_ksys_write+0x10/0x10 [ 364.815154][T15236] __x64_sys_connect+0x7a/0x90 [ 364.815227][T15236] do_syscall_64+0x14d/0xf80 [ 364.815285][T15236] ? trace_irq_disable+0x3b/0x150 [ 364.815328][T15236] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 364.815390][T15236] ? clear_bhb_loop+0x40/0x90 [ 364.815452][T15236] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 364.815504][T15236] RIP: 0033:0x7f6c1279c819 [ 364.815562][T15236] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 364.815605][T15236] RSP: 002b:00007f6c135e8028 EFLAGS: 00000246 ORIG_RAX: 000000000000002a [ 364.815666][T15236] RAX: ffffffffffffffda RBX: 00007f6c12a15fa0 RCX: 00007f6c1279c819 [ 364.815702][T15236] RDX: 000000000000001c RSI: 00002000000000c0 RDI: 0000000000000003 [ 364.815735][T15236] RBP: 00007f6c135e8090 R08: 0000000000000000 R09: 0000000000000000 [ 364.815768][T15236] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 364.815798][T15236] R13: 00007f6c12a16038 R14: 00007f6c12a15fa0 R15: 00007ffd8928dfd8 [ 364.815876][T15236] [ 364.987675][T12010] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 365.034841][ T5929] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 365.229205][T15244] pim6reg1: entered promiscuous mode [ 365.240445][T15244] pim6reg1: entered allmulticast mode [ 365.444498][T15253] lo speed is unknown, defaulting to 1000 [ 365.456009][T15253] wg1 speed is unknown, defaulting to 1000 [ 365.799709][T15285] FAULT_INJECTION: forcing a failure. [ 365.799709][T15285] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 365.831081][T15285] CPU: 1 UID: 0 PID: 15285 Comm: syz.2.2351 Not tainted syzkaller #0 PREEMPT(full) [ 365.831109][T15285] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 365.831127][T15285] Call Trace: [ 365.831136][T15285] [ 365.831144][T15285] dump_stack_lvl+0xe8/0x150 [ 365.831179][T15285] should_fail_ex+0x412/0x560 [ 365.831219][T15285] _copy_to_user+0x31/0xb0 [ 365.831248][T15285] simple_read_from_buffer+0xe1/0x170 [ 365.831285][T15285] proc_fail_nth_read+0x1bb/0x230 [ 365.831320][T15285] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 365.831357][T15285] ? rw_verify_area+0x2a6/0x4d0 [ 365.831380][T15285] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 365.831414][T15285] vfs_read+0x20c/0xa70 [ 365.831435][T15285] ? fdget_pos+0x246/0x320 [ 365.831461][T15285] ? __pfx___mutex_lock+0x10/0x10 [ 365.831485][T15285] ? __pfx_vfs_read+0x10/0x10 [ 365.831511][T15285] ? __fget_files+0x2a/0x420 [ 365.831535][T15285] ? __fget_files+0x3a0/0x420 [ 365.831553][T15285] ? __fget_files+0x2a/0x420 [ 365.831583][T15285] ksys_read+0x150/0x270 [ 365.831609][T15285] ? __pfx_ksys_read+0x10/0x10 [ 365.831647][T15285] do_syscall_64+0x14d/0xf80 [ 365.831667][T15285] ? trace_irq_disable+0x3b/0x150 [ 365.831686][T15285] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 365.831708][T15285] ? clear_bhb_loop+0x40/0x90 [ 365.831741][T15285] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 365.831769][T15285] RIP: 0033:0x7f1016d5d04e [ 365.831788][T15285] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 365.831807][T15285] RSP: 002b:00007f1017b88fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 365.831829][T15285] RAX: ffffffffffffffda RBX: 00007f1017b896c0 RCX: 00007f1016d5d04e [ 365.831845][T15285] RDX: 000000000000000f RSI: 00007f1017b890a0 RDI: 0000000000000004 [ 365.831858][T15285] RBP: 00007f1017b89090 R08: 0000000000000000 R09: 0000000000000000 [ 365.831871][T15285] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 365.831883][T15285] R13: 00007f1017016038 R14: 00007f1017015fa0 R15: 00007fff4020e1f8 [ 365.831918][T15285] [ 366.407383][T15300] rdma_op ffff88807b15d9f0 conn xmit_rdma 0000000000000000 [ 366.564367][T15312] IPv6: NLM_F_REPLACE set, but no existing node found! [ 366.656934][T15312] openvswitch: netlink: Flow actions attr not present in new flow. [ 366.774168][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 366.782267][ C1] lec:lec_tx_timeout: lec0 [ 366.786931][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 366.890191][T15327] ip6_tunnel: non-ECT from fe80:0000:0000:0000:0000:0000:0000:002d with DS=0x85 [ 367.014600][T15337] validate_nla: 24 callbacks suppressed [ 367.014622][T15337] netlink: 'syz.0.2368': attribute type 39 has an invalid length. [ 367.420832][T15349] netlink: 'syz.1.2371': attribute type 8 has an invalid length. [ 367.594507][ T11] block nbd1: Possible stuck request ffff8880269f0000: control (read@0,1024B). Runtime 120 seconds [ 367.608103][ T11] block nbd1: Possible stuck request ffff8880269f0200: control (read@1024,1024B). Runtime 120 seconds [ 367.620725][ T11] block nbd1: Possible stuck request ffff8880269f0400: control (read@2048,1024B). Runtime 120 seconds [ 367.632219][ T11] block nbd1: Possible stuck request ffff8880269f0600: control (read@3072,1024B). Runtime 120 seconds [ 367.647652][T15363] netlink: 'syz.4.2374': attribute type 39 has an invalid length. [ 368.123681][T15390] __nla_validate_parse: 17 callbacks suppressed [ 368.123698][T15390] netlink: 64 bytes leftover after parsing attributes in process `syz.1.2386'. [ 368.168831][T15393] netlink: 20 bytes leftover after parsing attributes in process `syz.3.2387'. [ 368.194688][T15393] netlink: 40 bytes leftover after parsing attributes in process `syz.3.2387'. [ 368.258741][T15393] 8021q: adding VLAN 0 to HW filter on device bond8 [ 368.289497][T15396] tap0: tun_chr_ioctl cmd 1074025677 [ 368.295095][T15396] tap0: linktype set to 778 [ 368.462577][T15402] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2390'. [ 368.696473][T15421] "syz.3.2395" (15421) uses obsolete ecb(arc4) skcipher [ 368.855239][T15423] veth11: entered allmulticast mode [ 368.916248][T15435] netlink: 'syz.2.2399': attribute type 13 has an invalid length. [ 368.955181][T15435] netlink: 'syz.2.2399': attribute type 17 has an invalid length. [ 369.571146][T15429] bridge0: port 3(bond0) entered blocking state [ 369.584491][T15429] bridge0: port 3(bond0) entered disabled state [ 369.602719][T15429] bond0: entered allmulticast mode [ 369.612062][T15429] : entered allmulticast mode [ 369.619482][T15429] bond_slave_1: entered allmulticast mode [ 369.625988][T15429] batadv0: entered allmulticast mode [ 369.633824][T15429] bond0: entered promiscuous mode [ 369.639636][T15429] : entered promiscuous mode [ 369.645291][T15429] bond_slave_1: entered promiscuous mode [ 369.651208][T15429] batadv0: entered promiscuous mode [ 369.657709][T15429] bridge0: port 3(bond0) entered blocking state [ 369.664350][T15429] bridge0: port 3(bond0) entered listening state [ 369.707034][T15435] erspan0: left promiscuous mode [ 369.719898][T15465] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2406'. [ 369.815994][T15435] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 369.840136][T15438] bond0: Caught tx_queue_len zero misconfig [ 369.845994][T12010] batman_adv: batadv0: No IGMP Querier present - multicast optimizations disabled [ 369.846092][T12010] batman_adv: batadv0: No MLD Querier present - multicast optimizations disabled [ 369.875205][T15438] netlink: 20 bytes leftover after parsing attributes in process `syz.1.2400'. [ 370.120563][T15483] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2409'. [ 370.820518][T15491] x_tables: ip_tables: osf match: only valid for protocol 6 [ 370.870879][ T78] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 370.938259][T15488] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 371.170032][T15514] lo: Caught tx_queue_len zero misconfig [ 371.280824][T15514] pim6reg: entered allmulticast mode [ 371.290276][T15515] pim6reg: left allmulticast mode [ 371.383963][T15527] netlink: 20 bytes leftover after parsing attributes in process `syz.3.2423'. [ 371.435652][T15529] netlink: 20 bytes leftover after parsing attributes in process `syz.3.2423'. [ 371.506644][T15527] bridge0: port 4(syz_tun) entered blocking state [ 371.513209][T15527] bridge0: port 4(syz_tun) entered disabled state [ 371.523464][T15527] syz_tun: entered allmulticast mode [ 371.531402][T15527] syz_tun: entered promiscuous mode [ 371.552027][T15527] bridge0: port 4(syz_tun) entered blocking state [ 371.558652][T15527] bridge0: port 4(syz_tun) entered listening state [ 371.715587][T15544] unsupported nla_type 87 [ 371.804169][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5020 ms [ 371.812258][ C1] lec:lec_tx_timeout: lec0 [ 371.816915][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 372.133394][T15567] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 372.146804][T15566] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 372.195981][T15570] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2432'. [ 372.740630][T15592] --map-set only usable from mangle table [ 373.019189][T15608] 8021q: adding VLAN 0 to HW filter on device bond12 [ 373.097262][T15609] openvswitch: netlink: Unknown nsh attribute 0 [ 373.251143][T15616] __nla_validate_parse: 5 callbacks suppressed [ 373.251161][T15616] netlink: 268 bytes leftover after parsing attributes in process `syz.4.2448'. [ 373.282196][T15616] netlink: 136 bytes leftover after parsing attributes in process `syz.4.2448'. [ 373.306334][T15616] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2448'. [ 373.340990][T15603] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2444'. [ 373.374241][T15603] netlink: 20 bytes leftover after parsing attributes in process `syz.0.2444'. [ 373.823637][T15634] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2454'. [ 373.850629][T15635] netlink: 24 bytes leftover after parsing attributes in process `syz.4.2455'. [ 374.564614][T15654] netlink: 'syz.1.2462': attribute type 1 has an invalid length. [ 374.725860][T15665] bond13: (slave vxcan3): The slave device specified does not support setting the MAC address [ 374.739547][T15665] bond13: (slave vxcan3): Error -95 calling set_mac_address [ 374.838101][T15668] bond13: (slave gretap3): making interface the new active one [ 374.876437][T15668] bond13: (slave gretap3): Enslaving as an active interface with an up link [ 374.966784][T15654] macvlan2: entered promiscuous mode [ 374.984448][T15654] macvlan2: entered allmulticast mode [ 375.006471][T15654] bond13: entered promiscuous mode [ 375.012482][T15654] gretap3: entered promiscuous mode [ 375.038299][T15654] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 375.051820][T15654] bond13: (slave macvlan2): the slave hw address is in use by the bond; giving it the hw address of gretap3 [ 375.073940][T15654] bond13: left promiscuous mode [ 375.081505][T15654] gretap3: left promiscuous mode [ 375.274535][ C0] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 375.283515][T15690] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2472'. [ 375.347499][T15693] netlink: 'syz.1.2475': attribute type 11 has an invalid length. [ 375.380573][T15693] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2475'. [ 375.550208][T15700] tipc: Enabling of bearer rejected, already enabled [ 375.566371][T15700] mac80211_hwsim hwsim10 syzkaller0: entered promiscuous mode [ 375.584920][T15700] mac80211_hwsim hwsim10 syzkaller0: entered allmulticast mode [ 375.720187][T15700] netlink: 'syz.4.2477': attribute type 1 has an invalid length. [ 375.728461][T15700] netlink: 'syz.4.2477': attribute type 2 has an invalid length. [ 375.737244][T15700] netlink: 'syz.4.2477': attribute type 2 has an invalid length. [ 375.795254][T15700] netlink: 'syz.4.2477': attribute type 2 has an invalid length. [ 375.820284][T15700] netlink: 'syz.4.2477': attribute type 1 has an invalid length. [ 375.829659][T15700] netlink: 'syz.4.2477': attribute type 2 has an invalid length. [ 376.609185][T15730] netlink: 'syz.1.2484': attribute type 15 has an invalid length. [ 376.760147][T15736] lo speed is unknown, defaulting to 1000 [ 376.821053][T15736] wg1 speed is unknown, defaulting to 1000 [ 376.834132][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 376.842228][ C1] lec:lec_tx_timeout: lec0 [ 376.847251][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 377.086580][T15762] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2491'. [ 377.103332][T15744] lo speed is unknown, defaulting to 1000 [ 377.321912][T15744] wg1 speed is unknown, defaulting to 1000 [ 378.407207][T15807] IPVS: set_ctl: invalid protocol: 0 255.255.255.255:20001 [ 378.465875][T15832] __nla_validate_parse: 1 callbacks suppressed [ 378.465892][T15832] netlink: 76 bytes leftover after parsing attributes in process `syz.2.2508'. [ 378.736645][T15847] geneve1: Caught tx_queue_len zero misconfig [ 378.760229][T15847] syz_tun: left allmulticast mode [ 378.772439][T15847] syz_tun: left promiscuous mode [ 378.799105][T15847] bridge0: port 3(syz_tun) entered disabled state [ 378.883389][T15847] bridge_slave_0: left allmulticast mode [ 378.891360][T15847] bridge_slave_0: left promiscuous mode [ 378.907028][T15847] bridge0: port 1(bridge_slave_0) entered disabled state [ 378.943777][T15871] Freezing with imperfect legacy cgroup freezer. See cgroup.freeze of cgroup v2 [ 378.958068][T15847] bridge_slave_1: left allmulticast mode [ 378.963852][T15847] bridge_slave_1: left promiscuous mode [ 378.967116][T15871] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2517'. [ 378.985369][T15847] bridge0: port 2(bridge_slave_1) entered disabled state [ 378.997631][T15847] bond0: (slave bond_slave_0): Releasing backup interface [ 379.010289][T15847] bond_slave_0: left promiscuous mode [ 379.033737][T15847] bond0: (slave bond_slave_1): Releasing backup interface [ 379.062755][T15847] bond_slave_1: left promiscuous mode [ 379.078743][T15847] team0: Port device team_slave_1 removed [ 379.091437][T15847] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 379.378023][T15892] lo speed is unknown, defaulting to 1000 [ 379.388260][T15892] wg1 speed is unknown, defaulting to 1000 [ 379.473256][T15903] tunl0: Caught tx_queue_len zero misconfig [ 379.710182][T15911] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2527'. [ 379.725052][T15911] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2527'. [ 380.081569][T15940] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2536'. [ 380.109641][T15936] netlink: 36 bytes leftover after parsing attributes in process `syz.4.2534'. [ 380.335476][T15955] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2542'. [ 380.361331][T15963] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2543'. [ 380.718217][T15977] IPVS: set_ctl: invalid protocol: 58 255.255.255.255:20003 [ 380.873302][T15989] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2551'. [ 380.906854][T15996] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2554'. [ 380.976144][T15999] macvlan3: entered allmulticast mode [ 380.981576][T15999] hsr0: entered allmulticast mode [ 380.993598][T15999] hsr_slave_0: entered allmulticast mode [ 380.999610][T15999] hsr_slave_1: entered allmulticast mode [ 381.305600][T16022] lo speed is unknown, defaulting to 1000 [ 381.373292][T16022] wg1 speed is unknown, defaulting to 1000 [ 381.831244][T16059] sctp: [Deprecated]: syz.0.2567 (pid 16059) Use of struct sctp_assoc_value in delayed_ack socket option. [ 381.831244][T16059] Use struct sctp_sack_info instead [ 381.854159][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 381.862195][ C1] lec:lec_tx_timeout: lec0 [ 381.866773][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 382.033085][T16063] netlink: 'syz.2.2568': attribute type 29 has an invalid length. [ 382.178272][T16075] ip6t_srh: unknown srh invflags BA61 [ 382.325087][ T11] block nbd0: Possible stuck request ffff8880269c0000: control (read@0,1024B). Runtime 150 seconds [ 382.335932][ T11] block nbd0: Possible stuck request ffff8880269c0200: control (read@1024,1024B). Runtime 150 seconds [ 382.347290][ T11] block nbd0: Possible stuck request ffff8880269c0400: control (read@2048,1024B). Runtime 150 seconds [ 382.358582][ T11] block nbd0: Possible stuck request ffff8880269c0600: control (read@3072,1024B). Runtime 150 seconds [ 382.542285][T16097] netlink: 'syz.2.2577': attribute type 1 has an invalid length. [ 382.597334][T16097] 8021q: adding VLAN 0 to HW filter on device bond9 [ 382.616177][T16102] netlink: 'syz.2.2577': attribute type 8 has an invalid length. [ 382.666548][T16102] bond9: (slave geneve2): making interface the new active one [ 382.683776][T16102] bond9: (slave geneve2): Enslaving as an active interface with an up link [ 382.696615][ T78] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 20004 - 0 [ 382.738604][ T78] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 20004 - 0 [ 382.785911][ T78] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 20004 - 0 [ 382.802863][T16109] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 382.820715][ T78] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 20004 - 0 [ 383.313587][T16137] bridge13: the hash_elasticity option has been deprecated and is always 16 [ 383.351905][T16137] bridge13: entered allmulticast mode [ 383.594860][ C0] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 383.686430][T16151] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 20004 - 0 [ 383.963685][T16151] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 20004 - 0 [ 384.093918][T16182] bond7: (slave 26ؤFN&): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 384.122685][T16182] bond7: (slave 26ؤFN&): Enslaving as an active interface with an up link [ 384.174079][T16182] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 384.248951][T16151] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 20004 - 0 [ 384.456494][T16151] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 20004 - 0 [ 384.492299][T16179] lo speed is unknown, defaulting to 1000 [ 384.500219][T16179] wg1 speed is unknown, defaulting to 1000 [ 384.811234][ T995] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 20004 - 0 [ 384.870126][ T995] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 20004 - 0 [ 384.879920][ C1] bridge0: port 3(bond0) entered learning state [ 384.951751][T16224] __nla_validate_parse: 10 callbacks suppressed [ 384.951769][T16224] netlink: 20 bytes leftover after parsing attributes in process `syz.3.2607'. [ 385.034654][ T995] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 20004 - 0 [ 385.058616][T16221] macvtap1: entered promiscuous mode [ 385.075611][T16221] syz_tun: entered promiscuous mode [ 385.100599][T16221] syz_tun: left promiscuous mode [ 385.199061][ T126] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 20004 - 0 [ 385.405713][T16245] netlink: 24 bytes leftover after parsing attributes in process `syz.4.2612'. [ 385.469605][T16251] netlink: 'syz.0.2613': attribute type 1 has an invalid length. [ 385.481188][T16238] netlink: 'syz.3.2610': attribute type 10 has an invalid length. [ 385.490905][T16245] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2612'. [ 385.501464][T16251] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2613'. [ 385.512183][T16238] veth0_vlan: left promiscuous mode [ 385.525906][T16238] veth0_vlan: entered promiscuous mode [ 385.548808][T16238] team0: Device veth0_vlan failed to register rx_handler [ 385.880826][T16271] netlink: 6032 bytes leftover after parsing attributes in process `syz.0.2621'. [ 385.916273][T16275] netlink: 36 bytes leftover after parsing attributes in process `syz.3.2623'. [ 385.930369][T16275] netlink: 'syz.3.2623': attribute type 21 has an invalid length. [ 386.059230][T16282] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2621'. [ 386.107422][T16282] xt_hashlimit: max too large, truncated to 1048576 [ 386.114952][T16282] xt_hashlimit: overflow, try lower: 2/0 [ 386.164508][T16280] lo speed is unknown, defaulting to 1000 [ 386.179646][T16280] wg1 speed is unknown, defaulting to 1000 [ 386.794257][ C0] bridge0: port 4(syz_tun) entered learning state [ 386.884306][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5020 ms [ 386.892363][ C1] lec:lec_tx_timeout: lec0 [ 386.897154][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 386.924381][T16324] netlink: 104 bytes leftover after parsing attributes in process `syz.0.2634'. [ 387.208671][T12004] netdevsim netdevsim2 eth0: unset [1, 0] type 2 family 0 port 20004 - 0 [ 387.232222][T12004] netdevsim netdevsim2 eth1: unset [1, 0] type 2 family 0 port 20004 - 0 [ 387.336366][T12004] netdevsim netdevsim2 eth2: unset [1, 0] type 2 family 0 port 20004 - 0 [ 387.369768][T12004] netdevsim netdevsim2 eth3: unset [1, 0] type 2 family 0 port 20004 - 0 [ 387.404222][T16334] lo speed is unknown, defaulting to 1000 [ 387.423373][T16334] wg1 speed is unknown, defaulting to 1000 [ 387.549849][T16350] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2639'. [ 387.710772][T16360] netlink: 'syz.4.2642': attribute type 1 has an invalid length. [ 387.888351][T16374] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2646'. [ 387.909316][T16374] netlink: 'syz.0.2646': attribute type 5 has an invalid length. [ 387.930691][T16362] bridge0: port 4(syz_tun) entered disabled state [ 388.028686][T16362] syz_tun (unregistering): left allmulticast mode [ 388.057623][T16362] syz_tun (unregistering): left promiscuous mode [ 388.067143][T16362] bridge0: port 4(syz_tun) entered disabled state [ 388.555382][ T5841] Bluetooth: hci3: command 0x0405 tx timeout [ 388.598275][T16400] vlan3: entered promiscuous mode [ 388.620068][T16400] veth1: entered promiscuous mode [ 388.970182][T16417] openvswitch: netlink: Invalid VLAN frame [ 389.006247][T16419] bridge0: port 3(bond0) entered disabled state [ 389.057916][T16421] IPVS: length: 132 != 8 [ 389.070264][T16419] netlink: 'syz.3.2661': attribute type 16 has an invalid length. [ 389.090725][T16421] pimreg: entered allmulticast mode [ 389.100663][T16419] netlink: 'syz.3.2661': attribute type 17 has an invalid length. [ 389.671797][T16452] netlink: 'syz.4.2671': attribute type 1 has an invalid length. [ 389.681625][T16451] delete_channel: no stack [ 389.687926][T16451] delete_channel: no stack [ 390.087497][T16472] netlink: 'syz.3.2676': attribute type 13 has an invalid length. [ 390.503839][T16484] __nla_validate_parse: 11 callbacks suppressed [ 390.503860][T16484] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2679'. [ 390.637645][ T51] Bluetooth: hci3: command 0x0405 tx timeout [ 390.792532][T16490] lo speed is unknown, defaulting to 1000 [ 390.822140][T16490] wg1 speed is unknown, defaulting to 1000 [ 391.024552][T16493] lo speed is unknown, defaulting to 1000 [ 391.077723][T16493] wg1 speed is unknown, defaulting to 1000 [ 391.081498][T16496] lo speed is unknown, defaulting to 1000 [ 391.168485][T16496] wg1 speed is unknown, defaulting to 1000 [ 391.726588][T16488] A link change request failed with some changes committed already. Interface wlan0 may have been left with an inconsistent configuration, please check. [ 391.762775][T16529] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2689'. [ 391.904299][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 391.912470][ C1] lec:lec_tx_timeout: lec0 [ 391.918795][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 392.427788][T16562] netlink: 65051 bytes leftover after parsing attributes in process `syz.4.2699'. [ 392.674249][T16558] lo speed is unknown, defaulting to 1000 [ 392.683221][T16558] wg1 speed is unknown, defaulting to 1000 [ 392.698449][T16579] x_tables: duplicate underflow at hook 1 [ 393.108846][T16590] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2708'. [ 393.196687][T16602] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2713'. [ 393.239144][T16602] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2713'. [ 393.601228][T16622] xt_TCPMSS: Only works on TCP SYN packets [ 393.611168][T16621] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2717'. [ 393.637129][T16624] openvswitch: netlink: Unexpected mask (mask=200440, allowed=10048) [ 393.679924][T16626] x_tables: ip_tables: TPROXY target: used from hooks FORWARD, but only usable from PREROUTING [ 393.941083][T16643] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2726'. [ 394.224403][T16651] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2730'. [ 394.277564][T16655] syzkaller0: entered promiscuous mode [ 394.283165][T16655] syzkaller0: entered allmulticast mode [ 394.549516][T16671] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2735'. [ 394.658956][T16671] netlink: 'syz.4.2735': attribute type 1 has an invalid length. [ 394.679343][T16671] netlink: 'syz.4.2735': attribute type 2 has an invalid length. [ 394.884461][T16681] 8021q: adding VLAN 0 to HW filter on device bond10 [ 395.180591][T16706] veth14: entered allmulticast mode [ 395.280763][T16719] nbd: must specify an index to disconnect [ 395.625067][T16739] syzkaller1: entered promiscuous mode [ 395.630694][T16739] syzkaller1: entered allmulticast mode [ 395.812044][T16756] tipc: Enabling of bearer rejected, failed to enable media [ 395.880264][T16759] __nla_validate_parse: 4 callbacks suppressed [ 395.880284][T16759] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2762'. [ 395.939128][T16764] netlink: 20 bytes leftover after parsing attributes in process `syz.0.2762'. [ 396.124713][T16772] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2764'. [ 396.250161][T16773] bond14: up delay (1024) is not a multiple of miimon (100), value rounded to 1000 ms [ 396.260023][T16773] bond14: down delay (7) is not a multiple of miimon (100), value rounded to 0 ms [ 396.372047][T16786] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2764'. [ 396.387845][T16772] : entered promiscuous mode [ 396.414067][T16786] openvswitch: : Dropping previously announced user features [ 396.691692][T16793] netlink: 'syz.3.2767': attribute type 1 has an invalid length. [ 396.838805][T16798] bond9: (slave geneve3): making interface the new active one [ 396.876761][T16798] bond9: (slave geneve3): Enslaving as an active interface with an up link [ 396.926146][ T126] netdevsim netdevsim3 eth0: set [1, 0] type 2 family 0 port 20004 - 0 [ 396.934563][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 396.934593][ C1] lec:lec_tx_timeout: lec0 [ 396.942999][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 396.958800][T16808] netlink: 'syz.0.2770': attribute type 8 has an invalid length. [ 396.967345][ T126] netdevsim netdevsim3 eth1: set [1, 0] type 2 family 0 port 20004 - 0 [ 396.995450][ T126] netdevsim netdevsim3 eth2: set [1, 0] type 2 family 0 port 20004 - 0 [ 397.023705][T16805] batman_adv: batadv0: Adding interface: ipvlan2 [ 397.083726][T16805] batman_adv: batadv0: The MTU of interface ipvlan2 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 397.110506][T16805] batman_adv: batadv0: Not using interface ipvlan2 (retrying later): interface not active [ 397.147189][ T126] netdevsim netdevsim3 eth3: set [1, 0] type 2 family 0 port 20004 - 0 [ 397.193076][T16821] dvmrp6: entered allmulticast mode [ 397.278611][T16821] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2773'. [ 397.320532][T16829] netlink: 32 bytes leftover after parsing attributes in process `syz.4.2774'. [ 397.377870][T16820] delete_channel: no stack [ 397.606330][T16835] xt_addrtype: ipv6 does not support BROADCAST matching [ 397.673086][T16848] IPVS: set_ctl: invalid protocol: 136 0.0.0.0:19998 [ 397.682590][ T11] block nbd1: Possible stuck request ffff8880269f0000: control (read@0,1024B). Runtime 150 seconds [ 397.696129][ T11] block nbd1: Possible stuck request ffff8880269f0200: control (read@1024,1024B). Runtime 150 seconds [ 397.707443][ T11] block nbd1: Possible stuck request ffff8880269f0400: control (read@2048,1024B). Runtime 150 seconds [ 397.720631][ T11] block nbd1: Possible stuck request ffff8880269f0600: control (read@3072,1024B). Runtime 150 seconds [ 397.948518][T16862] sctp: [Deprecated]: syz.2.2780 (pid 16862) Use of struct sctp_assoc_value in delayed_ack socket option. [ 397.948518][T16862] Use struct sctp_sack_info instead [ 398.000056][T16862] netlink: 'syz.2.2780': attribute type 10 has an invalid length. [ 398.189674][T16868] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2782'. [ 400.470491][T16834] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 400.761780][T16914] IPVS: set_ctl: invalid protocol: 94 172.30.0.4:20002 [ 400.793301][T16905] lo speed is unknown, defaulting to 1000 [ 400.823361][T16904] lo speed is unknown, defaulting to 1000 [ 400.855533][T16905] wg1 speed is unknown, defaulting to 1000 [ 400.876487][T16907] lo speed is unknown, defaulting to 1000 [ 400.884882][T16904] wg1 speed is unknown, defaulting to 1000 [ 400.932821][T16907] wg1 speed is unknown, defaulting to 1000 [ 401.478061][T16949] netlink: 'syz.2.2797': attribute type 1 has an invalid length. [ 401.486223][T16949] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2797'. [ 401.513069][T16947] netlink: 'syz.2.2797': attribute type 1 has an invalid length. [ 401.721345][T16958] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2801'. [ 401.813576][T16956] lo speed is unknown, defaulting to 1000 [ 401.822491][T16960] tipc: Enabling of bearer rejected, already enabled [ 401.865220][T16956] wg1 speed is unknown, defaulting to 1000 [ 402.771853][T16981] xt_cgroup: invalid path, errno=-2 [ 402.794151][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5860 ms [ 402.802345][ C1] lec:lec_tx_timeout: lec0 [ 402.807817][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 402.826034][T16981] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2808'. [ 402.948167][T16989] netlink: 'syz.4.2811': attribute type 28 has an invalid length. [ 403.027416][T16981] ip6erspan0: entered allmulticast mode [ 403.040021][T16972] lo speed is unknown, defaulting to 1000 [ 403.061888][T16997] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2812'. [ 403.073566][T16972] wg1 speed is unknown, defaulting to 1000 [ 403.282989][ T51] block nbd2: Receive control failed (result -32) [ 403.342953][T16997] veth15: entered allmulticast mode [ 403.361033][T16997] bond11: (slave veth15): Enslaving as an active interface with an up link [ 403.406372][T17000] bond11 (unregistering): (slave veth15): Releasing backup interface [ 403.457614][T17000] bond11 (unregistering): Released all slaves [ 403.551611][T17017] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2814'. [ 403.832142][T17026] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2817'. [ 404.218073][T17046] netlink: 60 bytes leftover after parsing attributes in process `syz.2.2822'. [ 404.405017][T17052] netlink: 44 bytes leftover after parsing attributes in process `syz.2.2823'. [ 405.947923][T17065] bridge0: left allmulticast mode [ 406.046346][T17091] netlink: 60 bytes leftover after parsing attributes in process `syz.3.2833'. [ 406.068061][T17065] 0X: left allmulticast mode [ 406.082310][T17065] .70: left allmulticast mode [ 406.087841][T17065] hsr_slave_0: left allmulticast mode [ 406.093456][T17065] hsr_slave_1: left allmulticast mode [ 406.105374][T17065] bond5: left promiscuous mode [ 406.125037][T17065] bond6: left promiscuous mode [ 406.129872][T17065] bridge5: left promiscuous mode [ 406.155403][T17065] macvtap1: left allmulticast mode [ 406.173688][T17065] vlan3: left promiscuous mode [ 406.191051][T17065] geneve1: left promiscuous mode [ 406.204344][T17065] vlan3: left allmulticast mode [ 406.215510][T17065] geneve1: left allmulticast mode [ 406.238585][T17065] ip6tnl1: left allmulticast mode [ 406.306433][T17104] x_tables: arp_tables: NFQUEUE target: not valid for this family [ 406.315699][T17065] geneve3: left promiscuous mode [ 406.322727][T17104] netlink: 32 bytes leftover after parsing attributes in process `syz.0.2836'. [ 406.342891][T17065] gretap2: left promiscuous mode [ 406.436817][T17065] bond0: left promiscuous mode [ 406.445501][T17065] macvlan0: left promiscuous mode [ 406.476388][T17065] sit1: left allmulticast mode [ 406.508675][T17111] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2838'. [ 406.565403][T17065] bridge13: left allmulticast mode [ 406.636402][T12004] netdevsim netdevsim1 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 406.658839][T12004] netdevsim netdevsim1 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 406.753400][T17119] netlink: 'syz.3.2839': attribute type 15 has an invalid length. [ 406.768603][T17119] netlink: 666 bytes leftover after parsing attributes in process `syz.3.2839'. [ 406.834533][T12004] netdevsim netdevsim1 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 406.848590][T17112] sch_tbf: burst 512 is lower than device syzkaller0 mtu (1500) ! [ 406.879931][T17112] Cannot find del_set index 4 as target [ 406.896983][T12004] netdevsim netdevsim1 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 406.962969][T17132] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2843'. [ 407.015139][T17132] netlink: 7 bytes leftover after parsing attributes in process `syz.0.2843'. [ 407.089050][T17140] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2846'. [ 407.167537][T17140] netlink: 'syz.3.2846': attribute type 5 has an invalid length. [ 407.376126][T17157] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2852'. [ 407.390568][T17157] netlink: 'syz.3.2852': attribute type 26 has an invalid length. [ 407.399390][T17157] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2852'. [ 407.409486][T17157] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2852'. [ 407.419056][T17157] netlink: 'syz.3.2852': attribute type 26 has an invalid length. [ 407.427198][T17157] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2852'. [ 407.640123][T17173] FAULT_INJECTION: forcing a failure. [ 407.640123][T17173] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 407.654167][T17173] CPU: 0 UID: 0 PID: 17173 Comm: syz.4.2858 Not tainted syzkaller #0 PREEMPT(full) [ 407.654201][T17173] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 407.654214][T17173] Call Trace: [ 407.654222][T17173] [ 407.654231][T17173] dump_stack_lvl+0xe8/0x150 [ 407.654267][T17173] should_fail_ex+0x412/0x560 [ 407.654307][T17173] _copy_from_user+0x2d/0xb0 [ 407.654334][T17173] __sys_connect+0x156/0x450 [ 407.654366][T17173] ? __pfx___sys_connect+0x10/0x10 [ 407.654408][T17173] ? __pfx_ksys_write+0x10/0x10 [ 407.654442][T17173] __x64_sys_connect+0x7a/0x90 [ 407.654472][T17173] do_syscall_64+0x14d/0xf80 [ 407.654492][T17173] ? trace_irq_disable+0x3b/0x150 [ 407.654511][T17173] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 407.654533][T17173] ? clear_bhb_loop+0x40/0x90 [ 407.654559][T17173] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 407.654580][T17173] RIP: 0033:0x7f211639c819 [ 407.654599][T17173] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 407.654617][T17173] RSP: 002b:00007f21172cc028 EFLAGS: 00000246 ORIG_RAX: 000000000000002a [ 407.654639][T17173] RAX: ffffffffffffffda RBX: 00007f2116615fa0 RCX: 00007f211639c819 [ 407.654655][T17173] RDX: 000000000000001e RSI: 0000200000000080 RDI: 0000000000000005 [ 407.654668][T17173] RBP: 00007f21172cc090 R08: 0000000000000000 R09: 0000000000000000 [ 407.654680][T17173] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 407.654693][T17173] R13: 00007f2116616038 R14: 00007f2116615fa0 R15: 00007fffc229f578 [ 407.654727][T17173] [ 407.826661][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5020 ms [ 407.834771][ C1] lec:lec_tx_timeout: lec0 [ 407.843348][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 407.915408][T17181] netlink: 19 bytes leftover after parsing attributes in process `syz.4.2859'. [ 407.953942][T17174] netlink: 'syz.3.2857': attribute type 4 has an invalid length. [ 408.007933][T17171] veth0_to_hsr: Caught tx_queue_len zero misconfig [ 408.070955][ T7925] lo speed is unknown, defaulting to 1000 [ 408.078570][ T7925] syz2: Port: 1 Link DOWN [ 408.183112][T17188] .71: renamed from .70 [ 408.241207][T17188] .71: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 408.263428][T17188] .71: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 408.284620][T17193] netlink: 'syz.3.2864': attribute type 1 has an invalid length. [ 408.288260][T17188] .71: entered allmulticast mode [ 408.292726][T17193] netlink: 'syz.3.2864': attribute type 3 has an invalid length. [ 408.306518][T17188] hsr_slave_0: entered allmulticast mode [ 408.324254][T17188] hsr_slave_1: entered allmulticast mode [ 408.340703][T17188] A link change request failed with some changes committed already. Interface .71 may have been left with an inconsistent configuration, please check. [ 408.940530][ T5841] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 408.956507][ T5841] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 408.972504][ T5841] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 408.981011][ T5841] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 408.988846][ T5841] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 409.126785][T17218] lo speed is unknown, defaulting to 1000 [ 409.137833][T17218] wg1 speed is unknown, defaulting to 1000 [ 409.228679][T17234] netlink: 'syz.4.2877': attribute type 5 has an invalid length. [ 409.352738][ T5832] syz_tun (unregistering): left allmulticast mode [ 409.599794][T17218] chnl_net:caif_netlink_parms(): no params data found [ 409.717394][T17218] bridge0: port 1(bridge_slave_0) entered blocking state [ 409.724905][T17218] bridge0: port 1(bridge_slave_0) entered disabled state [ 409.732136][T17218] bridge_slave_0: entered allmulticast mode [ 409.740896][T17218] bridge_slave_0: entered promiscuous mode [ 409.750681][T17218] bridge0: port 2(bridge_slave_1) entered blocking state [ 409.758214][T17218] bridge0: port 2(bridge_slave_1) entered disabled state [ 409.765590][T17218] bridge_slave_1: entered allmulticast mode [ 409.773122][T17218] bridge_slave_1: entered promiscuous mode [ 409.804999][T17218] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 409.817275][T17218] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 409.851822][T17218] team0: Port device team_slave_0 added [ 409.860040][T17218] team0: Port device team_slave_1 added [ 409.888044][T17218] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 409.895495][T17218] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 409.921904][T17218] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 409.934906][T17218] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 409.941893][T17218] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 409.968192][T17218] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 410.015143][T17218] hsr_slave_0: entered promiscuous mode [ 410.021640][T17218] hsr_slave_1: entered promiscuous mode [ 410.028263][T17218] debugfs: 'hsr0' already exists in 'hsr' [ 410.034037][T17218] Cannot create hsr debugfs directory [ 410.470475][T17272] FAULT_INJECTION: forcing a failure. [ 410.470475][T17272] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 410.486860][T17272] CPU: 1 UID: 0 PID: 17272 Comm: syz.0.2887 Not tainted syzkaller #0 PREEMPT(full) [ 410.486878][T17272] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 410.486887][T17272] Call Trace: [ 410.486893][T17272] [ 410.486898][T17272] dump_stack_lvl+0xe8/0x150 [ 410.486920][T17272] should_fail_ex+0x412/0x560 [ 410.486945][T17272] _copy_from_user+0x2d/0xb0 [ 410.486961][T17272] kstrtouint_from_user+0xd6/0x180 [ 410.486981][T17272] ? __pfx_kstrtouint_from_user+0x10/0x10 [ 410.487005][T17272] proc_fail_nth_write+0x8e/0x210 [ 410.487025][T17272] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 410.487048][T17272] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 410.487069][T17272] vfs_write+0x29a/0xb90 [ 410.487090][T17272] ? __pfx_vfs_write+0x10/0x10 [ 410.487106][T17272] ? __fget_files+0x2a/0x420 [ 410.487121][T17272] ? __fget_files+0x3a0/0x420 [ 410.487132][T17272] ? __fget_files+0x2a/0x420 [ 410.487149][T17272] ksys_write+0x150/0x270 [ 410.487165][T17272] ? __pfx_ksys_write+0x10/0x10 [ 410.487188][T17272] do_syscall_64+0x14d/0xf80 [ 410.487201][T17272] ? trace_irq_disable+0x3b/0x150 [ 410.487213][T17272] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 410.487225][T17272] ? clear_bhb_loop+0x40/0x90 [ 410.487241][T17272] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 410.487254][T17272] RIP: 0033:0x7ff0d335d04e [ 410.487266][T17272] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 410.487278][T17272] RSP: 002b:00007ff0d424bfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 410.487292][T17272] RAX: ffffffffffffffda RBX: 00007ff0d424c6c0 RCX: 00007ff0d335d04e [ 410.487301][T17272] RDX: 0000000000000001 RSI: 00007ff0d424c0a0 RDI: 0000000000000006 [ 410.487309][T17272] RBP: 00007ff0d424c090 R08: 0000000000000000 R09: 0000000000000000 [ 410.487317][T17272] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 410.487325][T17272] R13: 00007ff0d3616038 R14: 00007ff0d3615fa0 R15: 00007ffffd27eaa8 [ 410.487345][T17272] [ 411.034915][ T51] Bluetooth: hci5: command tx timeout [ 412.227049][T17234] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 412.240216][T17218] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 412.247186][T17287] netlink: 'syz.0.2893': attribute type 1 has an invalid length. [ 412.279198][T17218] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 412.328800][T17218] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 412.380354][T17218] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 412.396721][ T11] block nbd0: Possible stuck request ffff8880269c0000: control (read@0,1024B). Runtime 180 seconds [ 412.407637][ T11] block nbd0: Possible stuck request ffff8880269c0200: control (read@1024,1024B). Runtime 180 seconds [ 412.419064][ T11] block nbd0: Possible stuck request ffff8880269c0400: control (read@2048,1024B). Runtime 180 seconds [ 412.430299][ T11] block nbd0: Possible stuck request ffff8880269c0600: control (read@3072,1024B). Runtime 180 seconds [ 412.477356][T17298] __nla_validate_parse: 8 callbacks suppressed [ 412.477373][T17298] netlink: 36 bytes leftover after parsing attributes in process `syz.4.2897'. [ 412.536127][T17307] x_tables: ip_tables: icmp match: only valid for protocol 1 [ 412.644961][T17311] netlink: 'syz.0.2898': attribute type 10 has an invalid length. [ 412.670206][T17311] netlink: 228 bytes leftover after parsing attributes in process `syz.0.2898'. [ 412.746646][T17218] 8021q: adding VLAN 0 to HW filter on device bond0 [ 412.765815][T17313] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2899'. [ 412.814920][T17313] netlink: 'syz.1.2899': attribute type 61 has an invalid length. [ 412.822874][T17313] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2899'. [ 412.834462][T17218] 8021q: adding VLAN 0 to HW filter on device team0 [ 412.864187][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5020 ms [ 412.872297][ C1] lec:lec_tx_timeout: lec0 [ 412.877805][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 412.892289][ T1104] bridge0: port 1(bridge_slave_0) entered blocking state [ 412.899483][ T1104] bridge0: port 1(bridge_slave_0) entered forwarding state [ 412.957832][ T1110] bridge0: port 2(bridge_slave_1) entered blocking state [ 412.965056][ T1110] bridge0: port 2(bridge_slave_1) entered forwarding state [ 413.119140][ T51] Bluetooth: hci5: command tx timeout [ 413.265787][T17332] syzkaller0: entered promiscuous mode [ 413.281501][T17332] syzkaller0: entered allmulticast mode [ 413.328539][T17332] tipc: Enabled bearer , priority 0 [ 413.395439][T17329] tipc: Resetting bearer [ 413.450838][T17329] tipc: Disabling bearer [ 413.498357][T17341] netlink: 'syz.3.2907': attribute type 4 has an invalid length. [ 413.518791][T17337] bond10: option primary_reselect: invalid value (128) [ 413.527968][T17337] bond10 (unregistering): Released all slaves [ 413.587177][T17218] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 413.642309][T17344] netlink: 9 bytes leftover after parsing attributes in process `syz.1.2908'. [ 413.686209][T17344] .70: renamed from .71 (while UP) [ 413.764990][T17344] A link change request failed with some changes committed already. Interface .70 may have been left with an inconsistent configuration, please check. [ 413.855091][T17218] veth0_vlan: entered promiscuous mode [ 413.885587][T17218] veth1_vlan: entered promiscuous mode [ 414.193539][T17218] veth0_macvtap: entered promiscuous mode [ 414.232384][T17218] veth1_macvtap: entered promiscuous mode [ 414.304823][T17218] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 414.360635][T17218] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 414.408933][ T1104] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 414.419900][ T1104] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 414.470198][ T1104] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 414.503483][ T1104] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 414.517549][T17374] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2919'. [ 414.702313][T17378] syzkaller0: entered promiscuous mode [ 414.704983][ T1104] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 414.708318][T17378] syzkaller0: entered allmulticast mode [ 414.762011][ T1104] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 414.891615][ T995] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 414.904197][ T995] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 414.948661][T17369] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2918'. [ 414.969632][T17369] netlink: 32 bytes leftover after parsing attributes in process `syz.1.2918'. [ 414.979876][T17369] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2918'. [ 415.027945][T17369] netlink: 32 bytes leftover after parsing attributes in process `syz.1.2918'. [ 415.120012][T17396] xt_cgroup: invalid path, errno=-2 [ 415.150074][T17392] bond10: entered promiscuous mode [ 415.155359][T17392] bond10: entered allmulticast mode [ 415.161237][T17392] 8021q: adding VLAN 0 to HW filter on device bond10 [ 415.194773][ T51] Bluetooth: hci5: command tx timeout [ 415.386994][T17405] tipc: Enabled bearer , priority 0 [ 415.404903][T17405] syzkaller0: entered promiscuous mode [ 415.410432][T17405] syzkaller0: entered allmulticast mode [ 416.047390][T17436] netlink: 'syz.2.2930': attribute type 8 has an invalid length. [ 416.785616][T17425] .70: mtu greater than device maximum [ 416.791307][T17425] team0: Device .70 failed to change mtu [ 416.926989][T17436] bond0: entered promiscuous mode [ 416.949686][T17436] bond_slave_0: entered promiscuous mode [ 416.963330][T17436] bond_slave_1: entered promiscuous mode [ 416.982105][T17436] gretap0: entered promiscuous mode [ 417.007943][T17436] bond0: left promiscuous mode [ 417.012857][T17436] bond_slave_0: left promiscuous mode [ 417.018958][T17436] bond_slave_1: left promiscuous mode [ 417.027017][T17436] gretap0: left promiscuous mode [ 417.047856][T17405] tipc: Resetting bearer [ 417.065540][T17405] tipc: Disabling bearer [ 417.276940][ T5841] Bluetooth: hci5: command tx timeout [ 417.363182][ T51] Bluetooth: hci0: Opcode 0x0c1a failed: -110 [ 417.626976][ T5841] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 417.636142][ T5841] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 417.643939][ T5841] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 417.656043][ T5841] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 417.663705][ T5841] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 417.731597][T17459] lo speed is unknown, defaulting to 1000 [ 417.746383][T17459] wg1 speed is unknown, defaulting to 1000 [ 417.884461][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 417.892504][ C1] lec:lec_tx_timeout: lec0 [ 417.897110][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 417.915362][T17459] chnl_net:caif_netlink_parms(): no params data found [ 417.989851][T17459] bridge0: port 1(bridge_slave_0) entered blocking state [ 417.998107][T17459] bridge0: port 1(bridge_slave_0) entered disabled state [ 418.005896][T17459] bridge_slave_0: entered allmulticast mode [ 418.013214][T17459] bridge_slave_0: entered promiscuous mode [ 418.021182][T17459] bridge0: port 2(bridge_slave_1) entered blocking state [ 418.028695][T17459] bridge0: port 2(bridge_slave_1) entered disabled state [ 418.036426][T17459] bridge_slave_1: entered allmulticast mode [ 418.043644][T17459] bridge_slave_1: entered promiscuous mode [ 418.074757][T17459] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 418.087632][T17459] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 418.119306][T17459] team0: Port device team_slave_0 added [ 418.127314][T17459] team0: Port device team_slave_1 added [ 418.153944][T17459] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 418.161278][T17459] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 418.187375][T17459] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 418.200471][T17459] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 418.207785][T17459] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 418.239970][T17459] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 418.285444][T17459] hsr_slave_0: entered promiscuous mode [ 418.292079][T17459] hsr_slave_1: entered promiscuous mode [ 418.298573][T17459] debugfs: 'hsr0' already exists in 'hsr' [ 418.304531][T17459] Cannot create hsr debugfs directory [ 418.705886][T17459] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 418.716489][T17459] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 418.729958][T17459] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 418.740580][T17459] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 418.774049][T17459] bridge0: port 2(bridge_slave_1) entered blocking state [ 418.781358][T17459] bridge0: port 2(bridge_slave_1) entered forwarding state [ 418.788913][T17459] bridge0: port 1(bridge_slave_0) entered blocking state [ 418.796137][T17459] bridge0: port 1(bridge_slave_0) entered forwarding state [ 418.852516][T17459] 8021q: adding VLAN 0 to HW filter on device bond0 [ 418.871482][ T126] bridge0: port 1(bridge_slave_0) entered disabled state [ 418.880107][ T126] bridge0: port 2(bridge_slave_1) entered disabled state [ 418.893198][T17459] 8021q: adding VLAN 0 to HW filter on device team0 [ 418.905885][ T126] bridge0: port 1(bridge_slave_0) entered blocking state [ 418.912983][ T126] bridge0: port 1(bridge_slave_0) entered forwarding state [ 418.928122][T12010] bridge0: port 2(bridge_slave_1) entered blocking state [ 418.935381][T12010] bridge0: port 2(bridge_slave_1) entered forwarding state [ 419.118481][T17459] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 419.327794][T17459] veth0_vlan: entered promiscuous mode [ 419.342993][T17459] veth1_vlan: entered promiscuous mode [ 419.374341][T17459] veth0_macvtap: entered promiscuous mode [ 419.383491][T17459] veth1_macvtap: entered promiscuous mode [ 419.402137][T17459] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 419.417923][T17459] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 419.433792][T12010] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 419.445708][T12010] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 419.455499][T12010] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 419.465174][T12010] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 419.533952][T12010] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 419.542786][T12010] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 419.582399][ T995] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 419.591035][ T995] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 419.754389][ T51] Bluetooth: hci2: command tx timeout [ 421.834462][ T51] Bluetooth: hci2: command tx timeout [ 422.573677][ T5194] udevd[5194]: worker [7295] /devices/virtual/block/nbd0 timeout; kill it [ 422.582446][ T5194] udevd[5194]: seq 16330 '/devices/virtual/block/nbd0' killed [ 422.904209][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 422.912246][ C1] lec:lec_tx_timeout: lec0 [ 422.916853][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 423.914842][ T51] Bluetooth: hci2: command tx timeout [ 425.994227][ T51] Bluetooth: hci2: command tx timeout [ 427.756326][ T11] block nbd1: Possible stuck request ffff8880269f0000: control (read@0,1024B). Runtime 180 seconds [ 427.768219][ T11] block nbd1: Possible stuck request ffff8880269f0200: control (read@1024,1024B). Runtime 180 seconds [ 427.779839][ T11] block nbd1: Possible stuck request ffff8880269f0400: control (read@2048,1024B). Runtime 180 seconds [ 427.791129][ T11] block nbd1: Possible stuck request ffff8880269f0600: control (read@3072,1024B). Runtime 180 seconds [ 427.924357][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 427.932498][ C1] lec:lec_tx_timeout: lec0 [ 427.937240][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 428.598089][ T5194] udevd[5194]: worker [8139] /devices/virtual/block/nbd1 timeout; kill it [ 428.606833][ T5194] udevd[5194]: seq 17093 '/devices/virtual/block/nbd1' killed [ 433.754170][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5820 ms [ 433.762315][ C1] lec:lec_tx_timeout: lec0 [ 433.767994][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 438.774181][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 438.782248][ C1] lec:lec_tx_timeout: lec0 [ 438.787062][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 442.474879][ T11] block nbd0: Possible stuck request ffff8880269c0000: control (read@0,1024B). Runtime 210 seconds [ 442.485692][ T11] block nbd0: Possible stuck request ffff8880269c0200: control (read@1024,1024B). Runtime 210 seconds [ 442.496966][ T11] block nbd0: Possible stuck request ffff8880269c0400: control (read@2048,1024B). Runtime 210 seconds [ 442.508052][ T11] block nbd0: Possible stuck request ffff8880269c0600: control (read@3072,1024B). Runtime 210 seconds [ 443.794207][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 443.802282][ C1] lec:lec_tx_timeout: lec0 [ 443.807064][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 448.814142][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 448.822203][ C1] lec:lec_tx_timeout: lec0 [ 448.826873][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 453.834389][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 453.842438][ C1] lec:lec_tx_timeout: lec0 [ 453.847181][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 457.844292][ T11] block nbd1: Possible stuck request ffff8880269f0000: control (read@0,1024B). Runtime 210 seconds [ 457.855135][ T11] block nbd1: Possible stuck request ffff8880269f0200: control (read@1024,1024B). Runtime 210 seconds [ 457.866258][ T11] block nbd1: Possible stuck request ffff8880269f0400: control (read@2048,1024B). Runtime 210 seconds [ 457.877550][ T11] block nbd1: Possible stuck request ffff8880269f0600: control (read@3072,1024B). Runtime 210 seconds [ 458.854210][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 458.862249][ C1] lec:lec_tx_timeout: lec0 [ 458.866922][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 463.874281][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 463.882325][ C1] lec:lec_tx_timeout: lec0 [ 463.887037][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 468.894184][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 468.902223][ C1] lec:lec_tx_timeout: lec0 [ 468.906822][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 472.555332][ T11] block nbd0: Possible stuck request ffff8880269c0000: control (read@0,1024B). Runtime 240 seconds [ 472.566375][ T11] block nbd0: Possible stuck request ffff8880269c0200: control (read@1024,1024B). Runtime 240 seconds [ 472.577503][ T11] block nbd0: Possible stuck request ffff8880269c0400: control (read@2048,1024B). Runtime 240 seconds [ 472.589264][ T11] block nbd0: Possible stuck request ffff8880269c0600: control (read@3072,1024B). Runtime 240 seconds [ 473.916016][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 473.924044][ C1] lec:lec_tx_timeout: lec0 [ 473.928728][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 479.754124][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5820 ms [ 479.762194][ C1] lec:lec_tx_timeout: lec0 [ 479.766974][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 484.774156][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 484.782198][ C1] lec:lec_tx_timeout: lec0 [ 484.786844][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 487.916994][ T11] block nbd1: Possible stuck request ffff8880269f0000: control (read@0,1024B). Runtime 240 seconds [ 487.928021][ T11] block nbd1: Possible stuck request ffff8880269f0200: control (read@1024,1024B). Runtime 240 seconds [ 487.939927][ T11] block nbd1: Possible stuck request ffff8880269f0400: control (read@2048,1024B). Runtime 240 seconds [ 487.951176][ T11] block nbd1: Possible stuck request ffff8880269f0600: control (read@3072,1024B). Runtime 240 seconds [ 489.794153][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 489.802195][ C1] lec:lec_tx_timeout: lec0 [ 489.807283][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 494.814155][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 494.822194][ C1] lec:lec_tx_timeout: lec0 [ 494.826864][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 495.535123][T17496] __nla_validate_parse: 6 callbacks suppressed [ 495.535142][T17496] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2944'. [ 495.569715][T17496] openvswitch: netlink: Flow key attr not present in new flow. [ 495.705421][T17513] netlink: 'syz.2.2950': attribute type 1 has an invalid length. [ 495.713214][T17514] openvswitch: netlink: Unknown VXLAN extension attribute 0 [ 495.713456][T17513] netlink: 240 bytes leftover after parsing attributes in process `syz.2.2950'. [ 496.457676][T17533] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2955'. [ 496.958487][T17544] IPVS: set_ctl: invalid protocol: 1 224.0.0.2:20003 [ 496.974486][T17541] netlink: 'syz.4.2956': attribute type 32 has an invalid length. [ 497.062212][T17548] netlink: 'syz.2.2958': attribute type 1 has an invalid length. [ 497.081259][T17548] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 497.459522][T17563] FAULT_INJECTION: forcing a failure. [ 497.459522][T17563] name failslab, interval 1, probability 0, space 0, times 0 [ 497.495782][T17563] CPU: 1 UID: 0 PID: 17563 Comm: syz.4.2963 Not tainted syzkaller #0 PREEMPT(full) [ 497.495813][T17563] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 497.495826][T17563] Call Trace: [ 497.495834][T17563] [ 497.495844][T17563] dump_stack_lvl+0xe8/0x150 [ 497.495910][T17563] should_fail_ex+0x412/0x560 [ 497.495949][T17563] should_failslab+0xa8/0x100 [ 497.495981][T17563] __kmalloc_noprof+0xe8/0x760 [ 497.496007][T17563] ? kernfs_fop_write_iter+0x158/0x540 [ 497.496039][T17563] kernfs_fop_write_iter+0x158/0x540 [ 497.496073][T17563] vfs_write+0x61d/0xb90 [ 497.496118][T17563] ? __pfx_vfs_write+0x10/0x10 [ 497.496151][T17563] ? __fget_files+0x2a/0x420 [ 497.496179][T17563] ksys_write+0x150/0x270 [ 497.496204][T17563] ? __pfx_ksys_write+0x10/0x10 [ 497.496239][T17563] do_syscall_64+0x14d/0xf80 [ 497.496258][T17563] ? trace_irq_disable+0x3b/0x150 [ 497.496276][T17563] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 497.496296][T17563] ? clear_bhb_loop+0x40/0x90 [ 497.496320][T17563] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 497.496340][T17563] RIP: 0033:0x7fc09b79c819 [ 497.496357][T17563] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 497.496374][T17563] RSP: 002b:00007fc09c5a2028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 497.496395][T17563] RAX: ffffffffffffffda RBX: 00007fc09ba15fa0 RCX: 00007fc09b79c819 [ 497.496409][T17563] RDX: 000000000000000a RSI: 0000200000000280 RDI: 0000000000000004 [ 497.496421][T17563] RBP: 00007fc09c5a2090 R08: 0000000000000000 R09: 0000000000000000 [ 497.496433][T17563] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 497.496445][T17563] R13: 00007fc09ba16038 R14: 00007fc09ba15fa0 R15: 00007fffb03f3bc8 [ 497.496477][T17563] [ 497.575462][T17567] netlink: 'syz.2.2962': attribute type 1 has an invalid length. [ 497.707759][T17568] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 497.736937][T17564] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2962'. [ 497.746404][T17564] veth0: entered promiscuous mode [ 497.766720][T17566] netlink: 'syz.1.2964': attribute type 4 has an invalid length. [ 497.776261][T17564] veth0: entered allmulticast mode [ 497.803703][ T5836] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 497.817725][ T5836] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 497.829261][ T5836] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 497.842667][ T5836] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 497.860908][T17564] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2962'. [ 497.871692][ T5836] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 497.938240][T17569] lo speed is unknown, defaulting to 1000 [ 497.946014][T17569] wg1 speed is unknown, defaulting to 1000 [ 498.178419][T17584] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2966'. [ 498.444709][T17569] chnl_net:caif_netlink_parms(): no params data found [ 498.709317][T17607] FAULT_INJECTION: forcing a failure. [ 498.709317][T17607] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 498.723576][T17607] CPU: 1 UID: 0 PID: 17607 Comm: syz.3.2974 Not tainted syzkaller #0 PREEMPT(full) [ 498.723603][T17607] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 498.723616][T17607] Call Trace: [ 498.723625][T17607] [ 498.723634][T17607] dump_stack_lvl+0xe8/0x150 [ 498.723671][T17607] should_fail_ex+0x412/0x560 [ 498.723729][T17607] _copy_from_iter+0x1d3/0x1670 [ 498.723764][T17607] ? __pfx__copy_from_iter+0x10/0x10 [ 498.723785][T17607] ? trace_kmalloc+0x2a/0x110 [ 498.723811][T17607] ? __kmalloc_noprof+0x37d/0x760 [ 498.723833][T17607] ? kernfs_fop_write_iter+0x158/0x540 [ 498.723854][T17607] ? __kmalloc_noprof+0x1b8/0x760 [ 498.723877][T17607] kernfs_fop_write_iter+0x19b/0x540 [ 498.723904][T17607] vfs_write+0x61d/0xb90 [ 498.723933][T17607] ? __pfx_vfs_write+0x10/0x10 [ 498.723966][T17607] ? __fget_files+0x2a/0x420 [ 498.724005][T17607] ksys_write+0x150/0x270 [ 498.724031][T17607] ? __pfx_ksys_write+0x10/0x10 [ 498.724071][T17607] do_syscall_64+0x14d/0xf80 [ 498.724092][T17607] ? trace_irq_disable+0x3b/0x150 [ 498.724121][T17607] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 498.724140][T17607] ? clear_bhb_loop+0x40/0x90 [ 498.724164][T17607] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 498.724183][T17607] RIP: 0033:0x7f6c1279c819 [ 498.724200][T17607] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 498.724216][T17607] RSP: 002b:00007f6c135e8028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 498.724236][T17607] RAX: ffffffffffffffda RBX: 00007f6c12a15fa0 RCX: 00007f6c1279c819 [ 498.724250][T17607] RDX: 000000000000000a RSI: 0000200000000280 RDI: 0000000000000004 [ 498.724261][T17607] RBP: 00007f6c135e8090 R08: 0000000000000000 R09: 0000000000000000 [ 498.724272][T17607] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 498.724282][T17607] R13: 00007f6c12a16038 R14: 00007f6c12a15fa0 R15: 00007ffd8928dfd8 [ 498.724313][T17607] [ 498.977369][T17611] x_tables: ip6_tables: mh match: only valid for protocol 135 [ 499.002586][T17569] bridge0: port 1(bridge_slave_0) entered blocking state [ 499.009987][T17569] bridge0: port 1(bridge_slave_0) entered disabled state [ 499.016014][T17611] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2975'. [ 499.018286][T17569] bridge_slave_0: entered allmulticast mode [ 499.033857][T17569] bridge_slave_0: entered promiscuous mode [ 499.045700][ T5841] Bluetooth: hci2: command 0x0405 tx timeout [ 499.057761][T17569] bridge0: port 2(bridge_slave_1) entered blocking state [ 499.065049][T17569] bridge0: port 2(bridge_slave_1) entered disabled state [ 499.072476][T17569] bridge_slave_1: entered allmulticast mode [ 499.080617][T17569] bridge_slave_1: entered promiscuous mode [ 499.156616][T17614] netlink: 52 bytes leftover after parsing attributes in process `syz.4.2976'. [ 499.199400][T17569] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 499.213102][T17619] netlink: 44 bytes leftover after parsing attributes in process `syz.4.2976'. [ 499.225200][T17614] bridge0: port 2(bridge_slave_1) entered disabled state [ 499.232551][T17614] bridge0: port 1(bridge_slave_0) entered disabled state [ 499.365506][T17569] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 499.456952][T17569] team0: Port device team_slave_0 added [ 499.510754][T17569] team0: Port device team_slave_1 added [ 499.676069][T17569] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 499.694254][T17569] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 499.757663][T17569] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 499.823777][T17569] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 499.834183][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 499.842222][ C1] lec:lec_tx_timeout: lec0 [ 499.844304][T17569] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 499.847697][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 499.916770][ T51] Bluetooth: hci3: command tx timeout [ 499.930469][T17569] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 500.133663][T17657] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2987'. [ 500.148642][T17569] hsr_slave_0: entered promiscuous mode [ 500.156016][T17569] hsr_slave_1: entered promiscuous mode [ 500.162270][T17569] debugfs: 'hsr0' already exists in 'hsr' [ 500.169127][T17569] Cannot create hsr debugfs directory [ 500.203465][T17658] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 500.221467][ T7428] lo speed is unknown, defaulting to 1000 [ 500.234370][ T7428] syz2: Port: 1 Link ACTIVE [ 500.298816][T17666] netlink: 'syz.4.2989': attribute type 2 has an invalid length. [ 500.337147][T17652] lo speed is unknown, defaulting to 1000 [ 500.350275][T17668] IPVS: set_ctl: invalid protocol: 137 172.30.0.4:49344 [ 500.360230][T17652] wg1 speed is unknown, defaulting to 1000 [ 500.688050][T17675] xt_TPROXY: Can be used only with -p tcp or -p udp [ 501.292529][T17699] __nla_validate_parse: 1 callbacks suppressed [ 501.292565][T17699] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2999'. [ 501.296759][T17569] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 501.346421][T17702] netlink: 'syz.3.3000': attribute type 1 has an invalid length. [ 501.366281][T17569] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 501.394519][T17702] netlink: 240 bytes leftover after parsing attributes in process `syz.3.3000'. [ 501.419000][T17569] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 501.456943][T17569] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 501.563988][T17714] netlink: 'syz.2.3001': attribute type 13 has an invalid length. [ 501.573901][T17714] netlink: 'syz.2.3001': attribute type 17 has an invalid length. [ 501.603562][T17709] bridge0: port 2(bridge_slave_1) entered disabled state [ 501.611326][T17709] bridge0: port 1(bridge_slave_0) entered disabled state [ 502.024656][ T51] Bluetooth: hci3: command tx timeout [ 502.248484][T17709] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 502.267334][T17709] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 502.579453][T17713] veth0: Caught tx_queue_len zero misconfig [ 502.641814][ T11] block nbd0: Possible stuck request ffff8880269c0000: control (read@0,1024B). Runtime 270 seconds [ 502.663854][ T11] block nbd0: Possible stuck request ffff8880269c0200: control (read@1024,1024B). Runtime 270 seconds [ 502.675200][ T11] block nbd0: Possible stuck request ffff8880269c0400: control (read@2048,1024B). Runtime 270 seconds [ 502.686609][ T11] block nbd0: Possible stuck request ffff8880269c0600: control (read@3072,1024B). Runtime 270 seconds [ 502.720702][T17714] 8021q: adding VLAN 0 to HW filter on device bond0 [ 502.729440][T17714] 8021q: adding VLAN 0 to HW filter on device team0 [ 502.742596][T17714] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 502.808824][T17718] team0 (unregistering): Port device team_slave_0 removed [ 502.887279][T17718] team0 (unregistering): Port device team_slave_1 removed [ 502.994261][ T995] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 503.003409][ T995] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 503.014833][ T995] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 503.023850][ T995] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 503.109310][T17738] netlink: 'syz.3.3004': attribute type 1 has an invalid length. [ 503.224857][T17569] 8021q: adding VLAN 0 to HW filter on device bond0 [ 503.306209][T17569] 8021q: adding VLAN 0 to HW filter on device team0 [ 503.332689][T12010] bridge0: port 1(bridge_slave_0) entered blocking state [ 503.339926][T12010] bridge0: port 1(bridge_slave_0) entered forwarding state [ 503.360897][T17745] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3006'. [ 503.385421][T12010] bridge0: port 2(bridge_slave_1) entered blocking state [ 503.392618][T12010] bridge0: port 2(bridge_slave_1) entered forwarding state [ 503.876893][T17764] netlink: 44 bytes leftover after parsing attributes in process `syz.3.3012'. [ 503.957567][T17768] netlink: 'syz.4.3013': attribute type 10 has an invalid length. [ 504.071374][T17768] bond0: (slave wlan1): Enslaving as an active interface with an up link [ 504.081280][ T51] Bluetooth: hci3: command tx timeout [ 504.130068][T17569] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 504.275750][T17569] veth0_vlan: entered promiscuous mode [ 504.312651][T17569] veth1_vlan: entered promiscuous mode [ 504.322757][T17772] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3015'. [ 504.366189][T17569] veth0_macvtap: entered promiscuous mode [ 504.487076][T17569] veth1_macvtap: entered promiscuous mode [ 504.550064][T17569] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 504.571578][T17569] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 504.648875][T12010] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 504.675030][T12010] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 504.683823][T12010] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 504.703968][T12010] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 504.884309][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 504.892361][ C1] lec:lec_tx_timeout: lec0 [ 504.897068][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 505.065366][T12010] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 505.092746][T12010] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 505.230400][ T49] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 505.238407][ T49] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 506.113102][T17725] Set syz1 is full, maxelem 65536 reached [ 506.115000][T17818] netlink: 'syz.1.3026': attribute type 1 has an invalid length. [ 506.144419][T17818] netlink: 224 bytes leftover after parsing attributes in process `syz.1.3026'. [ 506.164173][ T51] Bluetooth: hci3: command tx timeout [ 506.311813][ T5841] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 506.325833][ T5841] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 506.337968][ T5841] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 506.364299][ T5841] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 506.382080][ T5841] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 506.482931][T17831] lo speed is unknown, defaulting to 1000 [ 506.516432][T17831] wg1 speed is unknown, defaulting to 1000 [ 506.522174][T17828] lo speed is unknown, defaulting to 1000 [ 506.580971][T17828] wg1 speed is unknown, defaulting to 1000 [ 506.814012][T12010] netdevsim netdevsim3 eth3 (unregistering): unset [1, 0] type 2 family 0 port 20004 - 0 [ 506.929800][T12010] netdevsim netdevsim3 eth2 (unregistering): unset [1, 0] type 2 family 0 port 20004 - 0 [ 507.072461][T12010] netdevsim netdevsim3 eth1 (unregistering): unset [1, 0] type 2 family 0 port 20004 - 0 [ 507.279236][T12010] netdevsim netdevsim3 eth0 (unregistering): unset [1, 0] type 2 family 0 port 20004 - 0 [ 507.616172][T17828] chnl_net:caif_netlink_parms(): no params data found [ 507.756529][T17894] netlink: 'syz.0.3049': attribute type 28 has an invalid length. [ 507.817454][T17894] netlink: 'syz.0.3049': attribute type 3 has an invalid length. [ 507.875505][T17894] netlink: 132 bytes leftover after parsing attributes in process `syz.0.3049'. [ 507.884920][T12010] bond0: left allmulticast mode [ 507.890391][T12010] : left allmulticast mode [ 507.900771][T12010] bond_slave_1: left allmulticast mode [ 507.915211][T12010] batadv0: left allmulticast mode [ 507.924535][T12010] bond0: left promiscuous mode [ 507.944684][T12010] : left promiscuous mode [ 507.954475][T12010] bond_slave_1: left promiscuous mode [ 507.965444][T12010] batadv0: left promiscuous mode [ 507.980366][T12010] bridge0: port 3(bond0) entered disabled state [ 508.127558][T12010] bridge_slave_1: left allmulticast mode [ 508.133264][T12010] bridge_slave_1: left promiscuous mode [ 508.164978][T12010] bridge0: port 2(bridge_slave_1) entered disabled state [ 508.183194][T12010] bridge_slave_0: left allmulticast mode [ 508.191641][T12010] bridge_slave_0: left promiscuous mode [ 508.204939][T12010] bridge0: port 1(bridge_slave_0) entered disabled state [ 508.474980][ T51] Bluetooth: hci1: command tx timeout [ 508.780216][T12010] dvmrp1: left allmulticast mode [ 508.786100][T12010] dvmrp6: left allmulticast mode [ 508.951603][T12010] bond1 (unregistering): (slave gre1): Releasing backup interface [ 508.993144][T12010] bond9 (unregistering): (slave geneve3): Releasing active interface [ 509.389365][T12010] bond0 (unregistering): (slave c5): Releasing backup interface [ 509.399058][T12010] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 509.409214][T12010] bond0 (unregistering): (slave batadv0): Releasing backup interface [ 509.421376][T12010] bond0 (unregistering): Released all slaves [ 509.432715][T12010] bond1 (unregistering): Released all slaves [ 509.450039][T12010] bond2 (unregistering): Released all slaves [ 509.464500][T12010] bond3 (unregistering): Released all slaves [ 509.485766][T12010] bond4 (unregistering): Released all slaves [ 509.506344][T12010] bond5 (unregistering): (slave batadv2): Releasing active interface [ 509.517166][T12010] batadv2: left promiscuous mode [ 509.522529][T12010] batadv2: left allmulticast mode [ 509.533085][T12010] bond5 (unregistering): Released all slaves [ 509.548151][T12010] bond6 (unregistering): Released all slaves [ 509.562977][T12010] bond7 (unregistering): (slave veth7): Releasing active interface [ 509.573411][T12010] bond7 (unregistering): Released all slaves [ 509.588417][T12010] bond8 (unregistering): Released all slaves [ 509.613133][T12010] bond9 (unregistering): Released all slaves [ 509.627928][T12010] bond10 (unregistering): Released all slaves [ 509.719538][T17907] bond1: option ad_actor_sys_prio: mode dependency failed, not supported in mode balance-rr(0) [ 509.737816][T17907] bond1 (unregistering): Released all slaves [ 509.904146][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 509.912297][ C1] lec:lec_tx_timeout: lec0 [ 509.917221][T12010] tipc: Disabling bearer [ 509.926920][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 509.965332][T12010] tipc: Disabling bearer [ 509.977680][T12010] tipc: Left network mode [ 510.044674][T17828] bridge0: port 1(bridge_slave_0) entered blocking state [ 510.057441][T17828] bridge0: port 1(bridge_slave_0) entered disabled state [ 510.065322][T17828] bridge_slave_0: entered allmulticast mode [ 510.073236][T17828] bridge_slave_0: entered promiscuous mode [ 510.099167][T17828] bridge0: port 2(bridge_slave_1) entered blocking state [ 510.117945][T17828] bridge0: port 2(bridge_slave_1) entered disabled state [ 510.136375][T17828] bridge_slave_1: entered allmulticast mode [ 510.145097][T17828] bridge_slave_1: entered promiscuous mode [ 510.159364][T17943] netlink: 20 bytes leftover after parsing attributes in process `syz.1.3053'. [ 510.208429][T17940] netlink: 332 bytes leftover after parsing attributes in process `syz.1.3053'. [ 510.235917][T12010] IPVS: stopping master sync thread 13527 ... [ 510.275935][T17950] netlink: 'syz.0.3055': attribute type 13 has an invalid length. [ 510.283905][T17950] netlink: 'syz.0.3055': attribute type 17 has an invalid length. [ 510.347580][T17946] bridge0: port 2(bridge_slave_1) entered disabled state [ 510.355300][T17946] bridge0: port 1(bridge_slave_0) entered disabled state [ 510.547730][T17946] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 510.559714][ T51] Bluetooth: hci1: command tx timeout [ 510.570577][T17946] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 510.762061][T17947] gtp0: entered promiscuous mode [ 510.768631][T17947] gtp0: entered allmulticast mode [ 510.788140][T17943] netlink: 20 bytes leftover after parsing attributes in process `syz.1.3053'. [ 510.845185][T17942] bond1: option active_slave: mode dependency failed, not supported in mode balance-xor(2) [ 510.867124][T17942] bond1 (unregistering): Released all slaves [ 511.020511][T17950] 8021q: adding VLAN 0 to HW filter on device bond0 [ 511.032541][T17950] 8021q: adding VLAN 0 to HW filter on device team0 [ 511.043905][T17950] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 511.067461][ T995] netdevsim netdevsim0 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 511.086979][ T995] netdevsim netdevsim0 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 511.109263][T17828] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 511.164136][ T995] netdevsim netdevsim0 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 511.184252][ T995] netdevsim netdevsim0 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 511.209105][T17828] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 511.287254][T17971] netlink: 712 bytes leftover after parsing attributes in process `syz.2.3058'. [ 511.310903][T17971] netlink: 5504 bytes leftover after parsing attributes in process `syz.2.3058'. [ 511.343378][T17971] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3058'. [ 511.367667][T17828] team0: Port device team_slave_0 added [ 511.415333][T17828] team0: Port device team_slave_1 added [ 511.609516][T17828] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 511.654452][T17828] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 511.716532][T17828] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 511.771580][T17828] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 511.804566][T17828] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 511.901482][T17828] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 511.999577][T18008] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3069'. [ 512.124823][T18008] team1: entered promiscuous mode [ 512.129924][T18008] team1: entered allmulticast mode [ 512.138208][T18008] 8021q: adding VLAN 0 to HW filter on device team1 [ 512.242189][T17828] hsr_slave_0: entered promiscuous mode [ 512.256320][T17828] hsr_slave_1: entered promiscuous mode [ 512.267277][T17828] debugfs: 'hsr0' already exists in 'hsr' [ 512.273053][T17828] Cannot create hsr debugfs directory [ 512.446197][T18017] lo speed is unknown, defaulting to 1000 [ 512.493551][T18017] wg1 speed is unknown, defaulting to 1000 [ 512.506328][T18023] lo speed is unknown, defaulting to 1000 [ 512.569753][T18023] wg1 speed is unknown, defaulting to 1000 [ 512.634371][ T51] Bluetooth: hci1: command tx timeout [ 513.325278][T18052] 8021q: VLANs not supported on syzkaller1 [ 513.718895][T12010] hsr_slave_0: left promiscuous mode [ 513.736013][T12010] hsr_slave_1: left promiscuous mode [ 513.754938][T12010] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 513.775432][T12010] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 513.808757][T12010] veth1_to_hsr: left allmulticast mode [ 513.817618][T12010] veth1_to_hsr: left promiscuous mode [ 513.969346][T12010] pim6reg99999991 (unregistering): left allmulticast mode [ 514.112042][T18083] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 514.339999][T12010] team0 (unregistering): Port device team_slave_1 removed [ 514.364849][T12010] team0 (unregistering): Port device team_slave_0 removed [ 514.585902][ T5901] lo speed is unknown, defaulting to 1000 [ 514.604638][ T5901] syz2: Port: 1 Link DOWN [ 514.714939][ T51] Bluetooth: hci1: command tx timeout [ 514.773625][T17828] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 514.804272][T17828] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 514.840769][T17828] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 514.855451][T18091] tap0: tun_chr_ioctl cmd 1074025676 [ 514.871356][T18091] tap0: owner set to 0 [ 514.885018][T17828] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 514.944120][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5020 ms [ 514.952210][ C1] lec:lec_tx_timeout: lec0 [ 514.957503][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 514.965112][T18100] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3082'. [ 515.240783][T18116] netlink: 'syz.4.3086': attribute type 6 has an invalid length. [ 515.261926][T17828] 8021q: adding VLAN 0 to HW filter on device bond0 [ 515.357031][T17828] 8021q: adding VLAN 0 to HW filter on device team0 [ 515.409104][ T126] bridge0: port 1(bridge_slave_0) entered blocking state [ 515.416446][ T126] bridge0: port 1(bridge_slave_0) entered forwarding state [ 515.425553][T12010] IPVS: stop unused estimator thread 0... [ 515.450769][ T1110] bridge0: port 2(bridge_slave_1) entered blocking state [ 515.458089][ T1110] bridge0: port 2(bridge_slave_1) entered forwarding state [ 515.469581][T18119] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3085'. [ 515.584513][T18127] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3087'. [ 515.984495][T18144] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 515.995637][T18141] netlink: 60 bytes leftover after parsing attributes in process `syz.1.3092'. [ 516.008319][T18138] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3091'. [ 516.379966][T18156] netlink: 'syz.1.3093': attribute type 1 has an invalid length. [ 516.480078][T18156] bond16: entered promiscuous mode [ 516.540545][T18156] 8021q: adding VLAN 0 to HW filter on device bond16 [ 516.659380][T18161] 8021q: adding VLAN 0 to HW filter on device bond17 [ 516.685993][T18161] bond16: (slave bond17): making interface the new active one [ 516.709112][T18161] bond17: entered promiscuous mode [ 516.727159][T18171] netlink: 32 bytes leftover after parsing attributes in process `syz.0.3094'. [ 516.765044][T18161] bond16: (slave bond17): Enslaving as an active interface with an up link [ 516.995286][T17828] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 517.091700][T17828] veth0_vlan: entered promiscuous mode [ 517.139948][T17828] veth1_vlan: entered promiscuous mode [ 517.243859][T17828] veth0_macvtap: entered promiscuous mode [ 517.292761][T17828] veth1_macvtap: entered promiscuous mode [ 517.303831][T18190] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3099'. [ 517.387256][T17828] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 517.409039][T18190] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 517.434290][T17828] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 517.507736][ T12] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 517.537379][T18190] netlink: 'syz.1.3099': attribute type 10 has an invalid length. [ 517.545734][ T12] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 517.581168][T18190] bond0: (slave wlan1): Enslaving as an active interface with an up link [ 517.600816][T18193] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3099'. [ 517.625916][ T12] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 517.654919][ T12] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 518.015071][ T995] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 518.018535][ T11] block nbd1: Possible stuck request ffff8880269f0000: control (read@0,1024B). Runtime 270 seconds [ 518.033967][ T11] block nbd1: Possible stuck request ffff8880269f0200: control (read@1024,1024B). Runtime 270 seconds [ 518.035736][ T995] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 518.046383][ T11] block nbd1: Possible stuck request ffff8880269f0400: control (read@2048,1024B). Runtime 270 seconds [ 518.063568][ T11] block nbd1: Possible stuck request ffff8880269f0600: control (read@3072,1024B). Runtime 270 seconds [ 518.263482][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 518.293330][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 518.382127][T18185] netlink: 'syz.0.3098': attribute type 8 has an invalid length. [ 518.583478][T18240] netlink: 'syz.3.3024': attribute type 3 has an invalid length. [ 518.700810][T18245] netlink: 'syz.2.3108': attribute type 21 has an invalid length. [ 518.731460][T18245] netlink: 132 bytes leftover after parsing attributes in process `syz.2.3108'. [ 518.757058][T18249] netlink: 'syz.1.3109': attribute type 1 has an invalid length. [ 518.762260][T18245] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3108'. [ 518.807782][T18250] netlink: 'syz.2.3108': attribute type 21 has an invalid length. [ 518.859960][T18249] 8021q: adding VLAN 0 to HW filter on device bond18 [ 518.940077][T18254] vlan4: entered promiscuous mode [ 518.949156][T18254] bond18: entered promiscuous mode [ 518.954793][T18254] vlan4: entered allmulticast mode [ 518.960094][T18254] bond18: entered allmulticast mode [ 519.042892][T18249] bond18: (slave bridge0): making interface the new active one [ 519.067921][T18249] bridge0: entered promiscuous mode [ 519.085567][T18249] bridge0: entered allmulticast mode [ 519.108512][T18249] bond18: (slave bridge0): Enslaving as an active interface with an up link [ 519.136819][T18254] x_tables: duplicate underflow at hook 2 [ 519.183854][T18258] bond1: option updelay: invalid value (18446744073709493611) [ 519.191909][T18258] bond1: option updelay: allowed values 0 - 2147483647 [ 519.295508][T18258] bond1 (unregistering): Released all slaves [ 519.376659][T18260] team0: entered allmulticast mode [ 519.382013][T18260] team_slave_0: entered allmulticast mode [ 519.388571][T18260] team_slave_1: entered allmulticast mode [ 519.397118][T18260] A link change request failed with some changes committed already. Interface team0 may have been left with an inconsistent configuration, please check. [ 519.480148][T18277] netlink: 'syz.1.3115': attribute type 1 has an invalid length. [ 519.536590][T18273] A link change request failed with some changes committed already. Interface veth0_vlan may have been left with an inconsistent configuration, please check. [ 519.801066][T18288] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 520.453237][T18330] __nla_validate_parse: 7 callbacks suppressed [ 520.453257][T18330] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3132'. [ 520.496545][T18330] hsr_slave_0: left promiscuous mode [ 520.511327][T18330] hsr_slave_1: left promiscuous mode [ 520.547945][T18333] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3133'. [ 520.559871][T18333] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3133'. [ 520.569388][T18333] netlink: 58 bytes leftover after parsing attributes in process `syz.1.3133'. [ 520.749732][T18343] netlink: 'syz.3.3138': attribute type 1 has an invalid length. [ 520.775008][T18346] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3139'. [ 520.822074][T18352] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3138'. [ 520.859452][T18348] xt_CT: No such helper "snmp_trap" [ 520.878000][T18356] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3138'. [ 521.029238][T18360] netlink: 'syz.0.3142': attribute type 1 has an invalid length. [ 521.050859][T18360] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 521.192095][T18368] netlink: 592 bytes leftover after parsing attributes in process `syz.3.3143'. [ 521.204067][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 6250 ms [ 521.212145][ C1] lec:lec_tx_timeout: lec0 [ 521.217422][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 521.764493][T18392] ip6gretap0: entered promiscuous mode [ 521.868187][T18392] syzkaller0: entered promiscuous mode [ 521.873861][T18392] syzkaller0: entered allmulticast mode [ 522.005915][T18403] netlink: 212348 bytes leftover after parsing attributes in process `syz.2.3153'. [ 522.025202][T18403] netlink: Unknown conntrack attr (0) [ 522.103391][ T5841] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 522.127093][ T5841] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 522.135382][ T5841] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 522.143941][ T5841] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 522.164663][ T5841] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 522.327622][T18412] wg1 speed is unknown, defaulting to 1000 [ 522.526332][ T7428] IPVS: starting estimator thread 0... [ 522.585643][T18432] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3162'. [ 522.654186][T18428] IPVS: using max 28 ests per chain, 67200 per kthread [ 522.689369][T18426] bond2: option ad_actor_sys_prio: mode dependency failed, not supported in mode balance-rr(0) [ 522.719243][T18426] bond2 (unregistering): Released all slaves [ 522.802640][T18444] pim6reg: entered allmulticast mode [ 522.856202][T18450] pim6reg: left allmulticast mode [ 523.140817][T18412] chnl_net:caif_netlink_parms(): no params data found [ 523.407168][T18485] xt_policy: input policy not valid in POSTROUTING and OUTPUT [ 523.520045][T18476] wg1 speed is unknown, defaulting to 1000 [ 523.720872][T18412] bridge0: port 1(bridge_slave_0) entered blocking state [ 523.736072][T18412] bridge0: port 1(bridge_slave_0) entered disabled state [ 523.745432][T18412] bridge_slave_0: entered allmulticast mode [ 523.753870][T18412] bridge_slave_0: entered promiscuous mode [ 523.789632][T18412] bridge0: port 2(bridge_slave_1) entered blocking state [ 523.797078][T18412] bridge0: port 2(bridge_slave_1) entered disabled state [ 523.804748][T18412] bridge_slave_1: entered allmulticast mode [ 523.813446][T18412] bridge_slave_1: entered promiscuous mode [ 523.958120][T18504] netlink: 'syz.3.3179': attribute type 1 has an invalid length. [ 524.098096][T18412] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 524.126693][T18412] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 524.320783][T18412] team0: Port device team_slave_0 added [ 524.412866][T18412] team0: Port device team_slave_1 added [ 524.531888][T18412] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 524.540378][T18412] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 524.572519][T18412] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 524.585992][T18412] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 524.592980][T18412] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 524.621646][T18412] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 524.981809][T18412] hsr_slave_0: entered promiscuous mode [ 524.995198][T18412] hsr_slave_1: entered promiscuous mode [ 525.001567][T18412] debugfs: 'hsr0' already exists in 'hsr' [ 525.008426][T18412] Cannot create hsr debugfs directory [ 525.572331][T18562] netlink: 'syz.3.3194': attribute type 1 has an invalid length. [ 525.601241][T18562] 8021q: adding VLAN 0 to HW filter on device bond2 [ 526.954331][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5740 ms [ 526.962401][ C1] lec:lec_tx_timeout: lec0 [ 526.967090][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 527.286222][T18520] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 527.316881][T18412] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 527.373004][T18412] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 527.454824][T18412] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 527.499284][T18412] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 527.806231][T18412] 8021q: adding VLAN 0 to HW filter on device bond0 [ 527.816665][T18600] __nla_validate_parse: 4 callbacks suppressed [ 527.816681][T18600] netlink: 32 bytes leftover after parsing attributes in process `syz.2.3205'. [ 527.892222][T18599] 8021q: adding VLAN 0 to HW filter on device team0 [ 527.906334][T18599] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 527.929042][T18603] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 527.978087][T18412] 8021q: adding VLAN 0 to HW filter on device team0 [ 528.028992][T12004] bridge0: port 1(bridge_slave_0) entered blocking state [ 528.036171][T12004] bridge0: port 1(bridge_slave_0) entered forwarding state [ 528.108323][T12010] bridge0: port 2(bridge_slave_1) entered blocking state [ 528.115541][T12010] bridge0: port 2(bridge_slave_1) entered forwarding state [ 528.226268][T18621] tipc: Started in network mode [ 528.231352][T18621] tipc: Node identity ac14140f, cluster identity 4711 [ 528.243129][T18621] tipc: New replicast peer: 255.255.255.255 [ 528.252261][T18621] tipc: Enabled bearer , priority 10 [ 528.607515][T18633] wg1 speed is unknown, defaulting to 1000 [ 528.611339][T18642] netlink: 212368 bytes leftover after parsing attributes in process `syz.3.3212'. [ 528.870396][T18412] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 529.094434][T18662] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3220'. [ 529.170072][T18412] veth0_vlan: entered promiscuous mode [ 529.197578][T18412] veth1_vlan: entered promiscuous mode [ 529.206305][T18666] netlink: 20 bytes leftover after parsing attributes in process `syz.4.3221'. [ 529.260979][T18412] veth0_macvtap: entered promiscuous mode [ 529.358832][T18412] veth1_macvtap: entered promiscuous mode [ 529.370367][ T7925] tipc: Node number set to 2886997007 [ 529.407681][T18412] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 529.465121][T18412] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 529.490171][T12010] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 529.501144][T12010] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 529.527935][T12010] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 529.579041][T12010] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 529.590716][T18680] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3225'. [ 529.647277][T18680] 8021q: adding VLAN 0 to HW filter on device bond3 [ 529.829298][ T49] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 529.841148][ T49] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 529.932186][T12010] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 529.960368][T12010] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 530.177019][T18697] netlink: 160 bytes leftover after parsing attributes in process `syz.3.3230'. [ 530.450461][T18708] ipvlan2: entered promiscuous mode [ 530.458725][T18708] bridge0: port 3(ipvlan2) entered blocking state [ 530.465985][T18708] bridge0: port 3(ipvlan2) entered disabled state [ 530.472669][T18708] ipvlan2: entered allmulticast mode [ 530.478898][T18708] bridge0: entered allmulticast mode [ 530.487085][T18708] ipvlan2: left allmulticast mode [ 530.492272][T18708] bridge0: left allmulticast mode [ 530.690187][T18725] GUP no longer grows the stack in syz.4.3239 (18725): 200000003000-20000000a000 (200000001000) [ 530.715175][T18725] CPU: 0 UID: 0 PID: 18725 Comm: syz.4.3239 Not tainted syzkaller #0 PREEMPT(full) [ 530.715203][T18725] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 530.715216][T18725] Call Trace: [ 530.715224][T18725] [ 530.715233][T18725] dump_stack_lvl+0xe8/0x150 [ 530.715287][T18725] __get_user_pages+0x2453/0x29d0 [ 530.715336][T18725] ? __lock_acquire+0x6b5/0x2cf0 [ 530.715383][T18725] ? __gup_longterm_locked+0xc4e/0x1630 [ 530.715415][T18725] ? down_read_killable+0x1bb/0x340 [ 530.715445][T18725] __gup_longterm_locked+0xdcf/0x1630 [ 530.715501][T18725] gup_fast_fallback+0x1d82/0x22e0 [ 530.715568][T18725] ? __pfx_gup_fast_fallback+0x10/0x10 [ 530.715604][T18725] ? is_valid_gup_args+0x11f/0x200 [ 530.715637][T18725] ? get_user_pages_fast+0x4d/0xb0 [ 530.715672][T18725] __iov_iter_get_pages_alloc+0x3b6/0xb10 [ 530.715707][T18725] ? __pfx_pipe_clear_nowait+0x10/0x10 [ 530.715735][T18725] iov_iter_get_pages2+0x5e/0xa0 [ 530.715775][T18725] __se_sys_vmsplice+0x7b3/0x1490 [ 530.715817][T18725] ? __pfx___se_sys_vmsplice+0x10/0x10 [ 530.715842][T18725] ? __pfx_futex_wake+0x10/0x10 [ 530.715889][T18725] ? lockdep_hardirqs_on+0x7a/0x110 [ 530.715973][T18725] do_syscall_64+0x14d/0xf80 [ 530.715993][T18725] ? trace_irq_disable+0x3b/0x150 [ 530.716011][T18725] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 530.716032][T18725] ? clear_bhb_loop+0x40/0x90 [ 530.716059][T18725] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 530.716079][T18725] RIP: 0033:0x7fc09b79c819 [ 530.716099][T18725] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 530.716117][T18725] RSP: 002b:00007fc09c5a2028 EFLAGS: 00000246 ORIG_RAX: 0000000000000116 [ 530.716140][T18725] RAX: ffffffffffffffda RBX: 00007fc09ba15fa0 RCX: 00007fc09b79c819 [ 530.716155][T18725] RDX: 0000000000000001 RSI: 00002000000000c0 RDI: 000000000000000b [ 530.716168][T18725] RBP: 00007fc09b832c91 R08: 0000000000000000 R09: 0000000000000000 [ 530.716180][T18725] R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000000 [ 530.716192][T18725] R13: 00007fc09ba16038 R14: 00007fc09ba15fa0 R15: 00007fffb03f3bc8 [ 530.716228][T18725] [ 530.718605][T18725] netlink: 'syz.4.3239': attribute type 39 has an invalid length. [ 531.077397][T18740] netlink: 16 bytes leftover after parsing attributes in process `syz.0.3242'. [ 531.115148][T18740] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3242'. [ 531.151946][T18740] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3242'. [ 531.443478][T18747] bridge1: entered promiscuous mode [ 531.473261][T18747] bridge1: entered allmulticast mode [ 531.828150][T18759] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3249'. [ 531.835297][T18755] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 531.885969][T18756] xt_hashlimit: max too large, truncated to 1048576 [ 531.904600][T18756] xt_hashlimit: Unknown mode mask 300, kernel too old? [ 531.923387][T18753] [ 531.925766][T18753] ====================================================== [ 531.932808][T18753] WARNING: possible circular locking dependency detected [ 531.939862][T18753] syzkaller #0 Not tainted [ 531.944294][T18753] ------------------------------------------------------ [ 531.951327][T18753] syz.4.3248/18753 is trying to acquire lock: [ 531.957414][T18753] ffffffff8fd47c78 (nr_node_list_lock){+...}-{3:3}, at: nr_rt_device_down+0xbe/0x860 [ 531.966966][T18753] [ 531.966966][T18753] but task is already holding lock: [ 531.974345][T18753] ffffffff8fd47c18 (nr_neigh_list_lock){+...}-{3:3}, at: nr_rt_device_down+0x28/0x860 [ 531.983945][T18753] [ 531.983945][T18753] which lock already depends on the new lock. [ 531.983945][T18753] [ 531.994369][T18753] [ 531.994369][T18753] the existing dependency chain (in reverse order) is: [ 532.003429][T18753] [ 532.003429][T18753] -> #2 (nr_neigh_list_lock){+...}-{3:3}: [ 532.011363][T18753] _raw_spin_lock_bh+0x36/0x50 [ 532.016684][T18753] nr_rt_ioctl+0x40c/0xf90 [ 532.021650][T18753] sock_do_ioctl+0x101/0x320 [ 532.026816][T18753] sock_ioctl+0x5c6/0x7f0 [ 532.031691][T18753] __se_sys_ioctl+0xfc/0x170 [ 532.036843][T18753] do_syscall_64+0x14d/0xf80 [ 532.041994][T18753] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 532.048437][T18753] [ 532.048437][T18753] -> #1 (&nr_node->node_lock){+...}-{3:3}: [ 532.056462][T18753] _raw_spin_lock_bh+0x36/0x50 [ 532.061788][T18753] nr_rt_ioctl+0x215/0xf90 [ 532.066755][T18753] sock_do_ioctl+0x101/0x320 [ 532.071989][T18753] sock_ioctl+0x5c6/0x7f0 [ 532.076867][T18753] __se_sys_ioctl+0xfc/0x170 [ 532.082025][T18753] do_syscall_64+0x14d/0xf80 [ 532.087171][T18753] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 532.093615][T18753] [ 532.093615][T18753] -> #0 (nr_node_list_lock){+...}-{3:3}: [ 532.101465][T18753] __lock_acquire+0x15a5/0x2cf0 [ 532.106873][T18753] lock_acquire+0xf0/0x2e0 [ 532.111838][T18753] _raw_spin_lock_bh+0x36/0x50 [ 532.117156][T18753] nr_rt_device_down+0xbe/0x860 [ 532.122732][T18753] nr_device_event+0x137/0x150 [ 532.128052][T18753] notifier_call_chain+0x1be/0x400 [ 532.133717][T18753] __dev_notify_flags+0x16d/0x310 [ 532.139302][T18753] netif_change_flags+0xe8/0x1a0 [ 532.144794][T18753] dev_change_flags+0x130/0x260 [ 532.150188][T18753] dev_ioctl+0x7b4/0x1150 [ 532.155067][T18753] sock_do_ioctl+0x23e/0x320 [ 532.160217][T18753] sock_ioctl+0x5c6/0x7f0 [ 532.165088][T18753] __se_sys_ioctl+0xfc/0x170 [ 532.170223][T18753] do_syscall_64+0x14d/0xf80 [ 532.175354][T18753] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 532.181790][T18753] [ 532.181790][T18753] other info that might help us debug this: [ 532.181790][T18753] [ 532.192034][T18753] Chain exists of: [ 532.192034][T18753] nr_node_list_lock --> &nr_node->node_lock --> nr_neigh_list_lock [ 532.192034][T18753] [ 532.205897][T18753] Possible unsafe locking scenario: [ 532.205897][T18753] [ 532.213367][T18753] CPU0 CPU1 [ 532.218753][T18753] ---- ---- [ 532.224151][T18753] lock(nr_neigh_list_lock); [ 532.228850][T18753] lock(&nr_node->node_lock); [ 532.236212][T18753] lock(nr_neigh_list_lock); [ 532.243436][T18753] lock(nr_node_list_lock); [ 532.248046][T18753] [ 532.248046][T18753] *** DEADLOCK *** [ 532.248046][T18753] [ 532.256207][T18753] 2 locks held by syz.4.3248/18753: [ 532.261505][T18753] #0: ffffffff8fbcb188 (rtnl_mutex){+.+.}-{4:4}, at: dev_ioctl+0x7a4/0x1150 [ 532.270342][T18753] #1: ffffffff8fd47c18 (nr_neigh_list_lock){+...}-{3:3}, at: nr_rt_device_down+0x28/0x860 [ 532.280382][T18753] [ 532.280382][T18753] stack backtrace: [ 532.286295][T18753] CPU: 1 UID: 0 PID: 18753 Comm: syz.4.3248 Not tainted syzkaller #0 PREEMPT(full) [ 532.286317][T18753] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 532.286329][T18753] Call Trace: [ 532.286336][T18753] [ 532.286344][T18753] dump_stack_lvl+0xe8/0x150 [ 532.286373][T18753] print_circular_bug+0x2e1/0x300 [ 532.286405][T18753] check_noncircular+0x12e/0x150 [ 532.286436][T18753] __lock_acquire+0x15a5/0x2cf0 [ 532.286465][T18753] ? __lock_acquire+0x6b5/0x2cf0 [ 532.286493][T18753] lock_acquire+0xf0/0x2e0 [ 532.286517][T18753] ? nr_rt_device_down+0xbe/0x860 [ 532.286542][T18753] ? nr_rt_device_down+0xbe/0x860 [ 532.286563][T18753] _raw_spin_lock_bh+0x36/0x50 [ 532.286589][T18753] ? nr_rt_device_down+0xbe/0x860 [ 532.286609][T18753] nr_rt_device_down+0xbe/0x860 [ 532.286630][T18753] ? nr_device_event+0x12f/0x150 [ 532.286653][T18753] nr_device_event+0x137/0x150 [ 532.286674][T18753] notifier_call_chain+0x1be/0x400 [ 532.286705][T18753] __dev_notify_flags+0x16d/0x310 [ 532.286739][T18753] ? __pfx___dev_notify_flags+0x10/0x10 [ 532.286763][T18753] ? __dev_change_flags+0x4c6/0x690 [ 532.286791][T18753] ? __pfx___dev_change_flags+0x10/0x10 [ 532.286818][T18753] ? full_name_hash+0x92/0xe0 [ 532.286846][T18753] netif_change_flags+0xe8/0x1a0 [ 532.286874][T18753] dev_change_flags+0x130/0x260 [ 532.286900][T18753] dev_ioctl+0x7b4/0x1150 [ 532.286923][T18753] sock_do_ioctl+0x23e/0x320 [ 532.286943][T18753] ? __pfx_sock_do_ioctl+0x10/0x10 [ 532.286961][T18753] ? do_futex+0x395/0x420 [ 532.286991][T18753] sock_ioctl+0x5c6/0x7f0 [ 532.287010][T18753] ? __pfx_sock_ioctl+0x10/0x10 [ 532.287028][T18753] ? __fget_files+0x2a/0x420 [ 532.287043][T18753] ? __fget_files+0x3a0/0x420 [ 532.287058][T18753] ? __fget_files+0x2a/0x420 [ 532.287074][T18753] ? bpf_lsm_file_ioctl+0x9/0x20 [ 532.287098][T18753] ? __pfx_sock_ioctl+0x10/0x10 [ 532.287116][T18753] __se_sys_ioctl+0xfc/0x170 [ 532.287138][T18753] do_syscall_64+0x14d/0xf80 [ 532.287154][T18753] ? trace_irq_disable+0x3b/0x150 [ 532.287170][T18753] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 532.287188][T18753] ? clear_bhb_loop+0x40/0x90 [ 532.287208][T18753] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 532.287226][T18753] RIP: 0033:0x7fc09b79c819 [ 532.287242][T18753] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 532.287258][T18753] RSP: 002b:00007fc09c5a2028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 532.287278][T18753] RAX: ffffffffffffffda RBX: 00007fc09ba15fa0 RCX: 00007fc09b79c819 [ 532.287291][T18753] RDX: 0000200000000000 RSI: 0000000000008914 RDI: 0000000000000005 [ 532.287303][T18753] RBP: 00007fc09b832c91 R08: 0000000000000000 R09: 0000000000000000 [ 532.287314][T18753] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 532.287325][T18753] R13: 00007fc09ba16038 R14: 00007fc09ba15fa0 R15: 00007fffb03f3bc8 [ 532.287347][T18753] [ 532.714058][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5750 ms [ 532.722100][ C1] lec:lec_tx_timeout: lec0 [ 532.727388][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 532.736988][ T11] block nbd0: Possible stuck request ffff8880269c0000: control (read@0,1024B). Runtime 300 seconds [ 532.748159][ T11] block nbd0: Possible stuck request ffff8880269c0200: control (read@1024,1024B). Runtime 300 seconds [ 532.761326][ T11] block nbd0: Possible stuck request ffff8880269c0400: control (read@2048,1024B). Runtime 300 seconds [ 532.772495][ T11] block nbd0: Possible stuck request ffff8880269c0600: control (read@3072,1024B). Runtime 300 seconds [ 534.314484][ T5841] Bluetooth: hci5: command 0x0406 tx timeout [ 537.756385][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5030 ms [ 537.764429][ C1] lec:lec_tx_timeout: lec0 [ 537.769140][ C1] lec:lec_start_xmit: lec0:No lecd attached