last executing test programs: 5.779340369s ago: executing program 1 (id=17937): r0 = socket$kcm(0x29, 0x5, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000ac0)=[{0x0}, {&(0x7f0000000880)="3aa854", 0x3}, {&(0x7f0000000a40)="746b9120a32aaf78043a9b07000000000000003c44", 0x15}], 0x3}, 0xc854) setsockopt$sock_int(r0, 0x1, 0x10, &(0x7f0000000180)=0x4c, 0x4) 5.636157811s ago: executing program 1 (id=17939): r0 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) connect$bt_l2cap(r1, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) ioctl$sock_bt_hidp_HIDPCONNADD(r0, 0x400448c8, &(0x7f0000000340)={r1, r1, 0x7fff, 0x0, 0x0, 0x9, 0xc1, 0x16c0, 0x9, 0x97d8, 0x1, 0x9, 'syz1\x00'}) ioctl$sock_bt_hidp_HIDPCONNDEL(r0, 0x400448c9, &(0x7f0000000000)={@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}) r2 = socket$key(0xf, 0x3, 0x2) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$SMC_PNETID_GET(r5, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(r5, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000000c0)=0x14) sendmsg$nl_route(r4, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000900)=@newlink={0x38, 0x10, 0x437, 0x0, 0x0, {0x0, 0x0, 0x0, r6, 0x40489}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @sit={{0x8}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPTUN_LINK={0x8, 0x1, r6}]}}}]}, 0x38}}, 0x0) sendmsg$nl_route(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000000)=@newlink={0x38, 0x10, 0x439, 0x0, 0x0, {0x0, 0x0, 0xe403, r6}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @sit={{0x8}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPTUN_REMOTE={0x8, 0x3, @broadcast}]}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x10}, 0x200080d0) bind$bt_hci(r3, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r3, &(0x7f0000000340)="0a000300010000", 0x7) recvmmsg(r3, &(0x7f0000000280)=[{{0x0, 0x0, 0x0}, 0x40}], 0x15, 0x10040, 0x0) r7 = socket$inet6(0xa, 0x800000000000002, 0x0) setsockopt$SO_TIMESTAMPING(r7, 0x1, 0x41, &(0x7f0000000340)=0x63ba, 0x4) r8 = socket$nl_generic(0x10, 0x3, 0x10) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080)={0x0, 0x0}, &(0x7f00000000c0)=0xc) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=ANY=[@ANYBLOB="240000001a000100feff11ff00000004020000601bb136ebbaa98a943d82139ee8ccf137a168010000007452da8b0ca4f84db9f8c6dec027fd25e39261c1e352201114bc7324559256edcb8dcd218779ac773e88888dcb322ae080153f20e66b81f01734218afb3530ac70674d0a0a384ab29f1262bfe09a9b1cff0a2707be98913f31f58cc89f9903cb89869aaba99e4ad6aa51833f64d7a2", @ANYRES32=r9, @ANYBLOB], 0x24}}, 0x24008800) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000e40)={&(0x7f0000000b40)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000e00)={&(0x7f0000000c80)=@updpolicy={0x12c, 0x19, 0x4, 0x70bd2c, 0x25dfdbfc, {{@in6=@remote, @in6=@private0, 0x4e20, 0xf9b5, 0x4e22, 0x3dfd, 0x2, 0x80, 0xa0, 0x5e, 0x0, r9}, {0x1, 0x8000, 0x3, 0xffffffffffffffff, 0x6, 0x9, 0x5, 0x1}, {0x7, 0x1000, 0xfffffffffffffb88, 0x3}, 0x200, 0x6e6bb3, 0x2, 0x0, 0x1}, [@extra_flags={0x8, 0x18, 0x3}, @algo_auth_trunc={0x6c, 0x14, {{'blake2s-256-arm\x00'}, 0x100, 0x40, "14dcd58949e1d2cc79ea65290933ecf3c37f79b62373d6a930e3ab52cc1bf50a"}}]}, 0x12c}, 0x1, 0x0, 0x0, 0x804}, 0x810) ioctl$XFS_IOC_START_COMMIT(r3, 0x80585882, &(0x7f0000000100)) socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_generic(r8, &(0x7f0000001840)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000001800)={0x0}, 0x1, 0x0, 0x0, 0x40880}, 0x40) setsockopt$inet6_int(r7, 0x29, 0x33, &(0x7f0000000380)=0x8, 0x4) sendmmsg$inet6(r7, &(0x7f0000000300)=[{{&(0x7f0000000000)={0xa, 0x4e1e, 0x3, @empty, 0xfff}, 0x1c, 0x0}}], 0x1, 0x60080004) recvmmsg(r7, &(0x7f00000003c0), 0x1, 0x40002142, 0x0) sendmsg$key(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000001980)={0x2, 0xe, 0x0, 0x0, 0x2, 0x0, 0xfffffffc, 0x25dfdbfe}, 0x10}}, 0x0) 5.492668078s ago: executing program 1 (id=17942): r0 = socket$netlink(0x10, 0x3, 0x0) bind$netlink(r0, &(0x7f00000000c0)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000240), 0x4) r1 = socket$netlink(0x10, 0x3, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) bind$netlink(r1, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x4000000) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000001980)={&(0x7f00000019c0)=@newtaction={0x14, 0x30, 0x0, 0x70bd26, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x40}, 0x80) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000006c0)=ANY=[@ANYBLOB="440000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="000000000000000008001b"], 0x44}}, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r2, &(0x7f00000002c0), 0x40000000000009f, 0x0) r3 = socket(0x10, 0x3, 0x0) sendmsg$inet(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000180)="1c00000021006bcd210002006e04fcff80000010000000017aa60864", 0x1c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)) sendmsg(r5, &(0x7f0000000740)={0x0, 0x0, &(0x7f00000005c0)=[{&(0x7f0000000540)="c6", 0xffffff39}], 0x1}, 0x0) ioctl$SIOCSIFHWADDR(r4, 0x8905, &(0x7f0000000340)={'syzkaller1\x00', @remote}) r6 = socket$inet6(0xa, 0x3, 0x7) r7 = accept$inet6(r6, 0x0, &(0x7f0000000040)) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000180)=ANY=[@ANYBLOB="9feb010018000000000000000c0000000c000000020000000000000000000004"], 0x0, 0x26}, 0x20) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) socket$can_raw(0x1d, 0x3, 0x1) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x1e, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000000000000852000000400000095000000e4000000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x24, '\x00', 0x0, 0x24, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x62}, 0x94) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) bpf$MAP_LOOKUP_ELEM(0x5, 0x0, 0x0) setsockopt$inet6_int(r7, 0x29, 0x49, &(0x7f0000000000)=0x5, 0x4) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x4c831, 0xffffffffffffffff, 0x0) mmap$xdp(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x2, 0x7e832, 0xffffffffffffffff, 0x0) 5.048826402s ago: executing program 0 (id=17945): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r0, 0x1) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x10, &(0x7f00000001c0)=[@in={0x2, 0x4e23, @rand_addr=0x64010100}]}, &(0x7f0000000140)=0x10) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(0xffffffffffffffff, 0x84, 0x7b, &(0x7f0000000080)={r2, 0x8000}, 0x8) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = socket$tipc(0x1e, 0x4, 0x0) bind$tipc(r4, &(0x7f0000000000)=@nameseq={0x1e, 0x1, 0x0, {0x41}}, 0x10) r5 = socket$tipc(0x1e, 0x5, 0x0) sendmsg$tipc(r5, &(0x7f0000000240)={&(0x7f00000001c0)=@name={0x1e, 0x2, 0x0, {{0x41}}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x1000a8d0}, 0x0) close(0x4) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000880)={@cgroup, 0xffffffffffffffff, 0x1a, 0x4}, 0x20) r6 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000600), 0xffffffffffffffff) sendmsg$WG_CMD_SET_DEVICE(r3, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000fc0)={&(0x7f00000007c0)=ANY=[@ANYBLOB="fc000000", @ANYRES16=r6, @ANYBLOB="0100000000000000000001000000140002007767310000000000000000000000000024000300a0cb879a47f5bc644c0e693fa6d031c74a1553b6e901b9ff2f518c78042fb542b00008807c0000805400098028000080060001000a0000001400020000000000000000000000000000000001050003000000000028000080060001000a00000014000200000000000000000000000000000000000500030001000000240001"], 0xfc}, 0x1, 0x0, 0x0, 0x4084}, 0x20000010) close(0x3) socket(0x2, 0x80805, 0x0) sendmsg$NFT_MSG_GETRULE(0xffffffffffffffff, &(0x7f0000001140)={&(0x7f0000001080)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000001100)={&(0x7f00000010c0)={0x40, 0x7, 0xa, 0x5, 0x0, 0x0, {0x1, 0x0, 0xa}, [@NFTA_RULE_CHAIN_ID={0x8, 0xb, 0x1, 0x0, 0x2}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz0\x00'}]}, 0x40}, 0x1, 0x0, 0x0, 0x11}, 0x4000) r7 = socket$inet6_sctp(0xa, 0x5, 0x84) r8 = socket(0xa, 0x3, 0x3a) setsockopt$MRT6_DEL_MIF(r8, 0x29, 0xc8, 0x0, 0xc000000) setsockopt$MRT6_ADD_MFC(r8, 0x29, 0xcc, &(0x7f0000000000)={{0xa, 0x0, 0x0, @local}, {0xa, 0x0, 0x0, @empty}}, 0x5c) setsockopt$MRT6_FLUSH(r8, 0x29, 0xd4, &(0x7f0000000100)=0xa, 0x4) shutdown(r7, 0x0) close(0x3) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000480)=ANY=[@ANYRES32, @ANYRES32, @ANYBLOB="000000db4007ee040000da00", @ANYRES32=0x0, @ANYRES64=0x0], 0x20) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r7, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x10, &(0x7f00000001c0)=[@in={0x2, 0x4e23, @rand_addr=0x64010100}]}, &(0x7f0000000140)=0x10) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x200000a, 0xc3072, 0xffffffffffffffff, 0x2fd15000) socket$inet(0x2, 0x3, 0x4) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r7, 0x84, 0x7a, &(0x7f0000000340)={r9, @in6={{0xa, 0x4e22, 0x4, @dev={0xfe, 0x80, '\x00', 0x13}, 0xf75}}}, &(0x7f0000000040)=0x84) 4.503495243s ago: executing program 1 (id=17948): socket$nl_route(0x10, 0x3, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0) close(0xffffffffffffffff) r2 = socket$kcm(0x29, 0x5, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='blkio.bfq.io_service_time_recursive\x00', 0x275a, 0x0) write$cgroup_int(r3, &(0x7f0000000000), 0xffffff6a) r4 = socket$kcm(0x29, 0x5, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0xffe4, &(0x7f0000000ac0)=[{&(0x7f0000000b00)="b6bd7e4983a45b31f79d80060400000000000000a33734d88229acf96457ad59d0b87f8659b614043e3d21a7cacecab8bbd26251b93b28b4d83e618673f9c74d0a28a5146c5511549fa617e908352c87d8ddff2ce042a1e58eb7b63759cab3526dd8ae1566ddcfb5fa83e8b2940b3ed1b8", 0x71}, {&(0x7f0000000880)="3aa854", 0x3}, {&(0x7f0000000a40)="746b9120a32aaf78043a9b07000000000000003c44", 0xfffffe16}], 0x3}, 0xc854) setsockopt$sock_int(r4, 0x1, 0x12, &(0x7f0000000180)=0x4c, 0x4) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), r1) sendfile(r2, r3, 0x0, 0xffffffff000) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_GET_PROTOCOL_FEATURES(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000001c0)={0x14, r5, 0x0, 0x70bd2c, 0x25dfdbfd, {}, ["", "", "", "", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x44010}, 0x40000) sendmsg$NL80211_CMD_RELOAD_REGDB(r0, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000340)={0x14, r6, 0x1, 0x70bd2d, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x20000000}, 0x20008004) r7 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r7, &(0x7f0000000000)={0x2, 0x4e21, @broadcast}, 0x2f) connect$inet(r7, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x1b}}, 0x10) sendto$inet(r7, &(0x7f0000000000), 0xffffffffffffff94, 0x0, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r7, 0x6, 0xd, &(0x7f00000000c0)='bbr', 0x3) recvfrom$inet(r7, &(0x7f0000000080)=""/8, 0xfffffffffffffd0b, 0x720, 0x0, 0xfffffffffffffd25) ioctl$AUTOFS_IOC_CATATONIC(r0, 0x9362, 0x0) socket$inet_sctp(0x2, 0x1, 0x84) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x4000000) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000001980)={&(0x7f0000009b80)=@newchain={0x24, 0x64, 0x300, 0x70bd25, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {0x7, 0xfff2}, {0xf}, {0xa, 0x1ffe4}}}, 0x24}, 0x1, 0x0, 0x0, 0x40}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x10) r8 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r8, 0x0, 0x0, 0x0) 4.065865901s ago: executing program 0 (id=17950): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r1, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000011"], 0x128}, 0x24004004) recvmsg$unix(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000080)}, 0x40004240) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r4 = socket(0x2, 0x80805, 0x0) r5 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r5, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r5, 0x84, 0x6f, &(0x7f0000000280)={0x0, 0x10, &(0x7f00000001c0)=[@in={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x21}}]}, &(0x7f0000000140)=0x10) setsockopt$inet_sctp6_SCTP_RESET_STREAMS(r4, 0x84, 0x77, &(0x7f0000000180)={r6}, 0x8) setsockopt$inet_sctp_SCTP_NODELAY(r4, 0x84, 0x3, &(0x7f0000000300)=0xc6a, 0x4) r7 = socket$nl_route(0x10, 0x3, 0x0) ioctl$F2FS_IOC_RELEASE_COMPRESS_BLOCKS(r1, 0x8008f512, &(0x7f0000000340)) sendmsg$nl_route(r7, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000006c0)=ANY=[@ANYRES8=r0, @ANYRESDEC=r5, @ANYRESDEC=r3, @ANYRES64, @ANYRES64=r7, @ANYRES64=0x0, @ANYBLOB="1cc0403955e99e0edcd8f490cbdc2f6ceb05be1249a44b46d3f318f62e6cb1dc83f2bdeddd8a645ee229133de3768280a63902837666206e0d9fbbf2205efffa77ef9645daf75e1169a594bef819413f28299861851f67bb3d91df737969c9978d16cce9f4a4a7b65c6cf6e76a4129db32105664bd2e342556ee907cec96fb4bfdeb1da19f99a927c040", @ANYRES8=r0, @ANYRES64=r5], 0x44}, 0x1, 0x0, 0x0, 0x4814}, 0x7bc58dfa0bc7dd6a) r8 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff) r9 = socket$nl_generic(0x10, 0x3, 0x10) r10 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x20, 0x3, &(0x7f0000000080)=ANY=[@ANYBLOB="18f800000000f38b5f784255a7d7f942dfd17500000029a1aab8e424c114"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x15, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x99ee}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000002c0)={r10, 0x0, 0x2d, 0x10, @val=@iter={&(0x7f00000000c0), 0x10}}, 0x20) sendmsg$DEVLINK_CMD_PORT_GET(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r8, @ANYBLOB="0100000000080000000054000000080001007063690011000200303030303a30303a31302e30000000000800030000000000"], 0x38}, 0x1, 0x0, 0x0, 0x20008040}, 0x0) ioctl$HCIINQUIRY(r3, 0x400448ca, 0x0) bind$bt_hci(r3, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) socket$inet_udp(0x2, 0x2, 0x0) write$bt_hci(r3, &(0x7f0000000440)=ANY=[@ANYRES8=r2], 0xa) syz_genetlink_get_family_id$smc(&(0x7f0000000000), 0xffffffffffffffff) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) r11 = bpf$ITER_CREATE(0xb, &(0x7f0000000240), 0x8) close(r11) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) 3.996451745s ago: executing program 2 (id=17951): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$unix(0x1, 0x1, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) r3 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000600)=@newqdisc={0x24, 0x24, 0x4ee4e6a52ff56541, 0x1070bd2a, 0xffffffff, {0x0, 0x0, 0x0, r4, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xb}}}, 0x24}, 0x1, 0x0, 0x0, 0x40}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000cc0)=@newtfilter={0x90, 0x2c, 0xd27, 0x70bd2a, 0x25dfdc00, {0x0, 0x0, 0x0, r4, {0xffff, 0x3}, {}, {0x7, 0x3}}, [@filter_kind_options=@f_matchall={{0xd}, {0x5c, 0x2, [@TCA_MATCHALL_ACT={0x58, 0x2, [@m_vlan={0x54, 0x1, 0x0, 0x0, {{0x9}, {0x28, 0x2, 0x0, 0x1, [@TCA_VLAN_PUSH_VLAN_ID={0x6, 0x3, 0x57f}, @TCA_VLAN_PARMS={0x1c, 0x2, {{0x4e3, 0xca0b, 0x6, 0x3}, 0x2}}]}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc}}}]}]}}]}, 0x90}, 0x1, 0x0, 0x0, 0x40800}, 0x44000) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r5) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @link_local}) r6 = socket$kcm(0x11, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$kcm(r6, &(0x7f00000000c0)={&(0x7f0000000380)=@xdp={0x2c, 0x7, r7, 0x3e}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000140)='\r', 0x1}], 0x1, 0x0, 0x0, 0x86dd}, 0x4) 3.876113261s ago: executing program 0 (id=17952): socket$inet6_sctp(0xa, 0x1, 0x84) sendmsg$TIPC_CMD_GET_LINKS(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000340)={0x24, 0x0, 0x800, 0x70bd25, 0x25dfdbff, {{}, {}, {0x8, 0x11, 0x2}}, ["", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0xc000}, 0x1) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) connect$inet6(r0, &(0x7f0000000300)={0xa, 0x1, 0xfffffffe, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x2e}}}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f00000000c0), 0x4) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000280)=@gcm_256={{0x303}, "1afc7c14d332bcc6", "a9ba0c85d68723369f51322151d9f41aaa2832bb07cc1e49ad714beac6f1ade8", "49960d8f", "bff2a81527ae4190"}, 0x38) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nbd(&(0x7f0000000200), r1) sendmsg$NBD_CMD_CONNECT(r1, &(0x7f00000027c0)={0x0, 0x0, &(0x7f0000002780)={&(0x7f00000002c0)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010029bd7000fbdbdf25010000000c00020000000000000000001c0007801800018008000100", @ANYBLOB="04"], 0x3c}, 0x1, 0x0, 0x0, 0x4000004}, 0x4000) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='freezer.state\x00', 0x275a, 0x0) write$cgroup_int(r3, &(0x7f0000000000), 0xffffff6a) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r3, 0x84, 0x1d, &(0x7f0000000100)={0x6, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, &(0x7f00000001c0)=0x1c) r4 = socket$inet6_sctp(0xa, 0x1, 0x84) r5 = socket$inet6_sctp(0xa, 0x6, 0x84) setsockopt$MRT_DEL_VIF(r3, 0x0, 0xcb, 0x0, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) r7 = socket$nl_crypto(0x10, 0x3, 0x15) sendmsg$nl_crypto(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[], 0xe0}}, 0x0) sendmsg$nl_crypto(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000340)=ANY=[], 0xf0}, 0x1, 0x0, 0x0, 0x4004080}, 0x0) sendmsg$NFT_MSG_GETCHAIN(r6, &(0x7f0000000440)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x800800}, 0xc, &(0x7f0000000400)={&(0x7f00000004c0)=ANY=[@ANYBLOB="20000000040a010100000000000000000a0000010900030073797a320000000083df0a63f183422e4215036c08a6377775327d731a22565a505990290b084f38d7af564b530c79f51a3b1c74ad86292d882cae"], 0x20}, 0x1, 0x0, 0x0, 0x40}, 0x80) r8 = socket$tipc(0x1e, 0x2, 0x0) bind$bt_hci(r8, &(0x7f0000000040), 0x6) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r5, 0x84, 0x64, &(0x7f0000000000)=[@in={0x2, 0x4e22, @empty}], 0x10) listen(r5, 0x3) sendmsg$inet6(r4, &(0x7f0000001dc0)={&(0x7f0000000840)={0xa, 0x4e22, 0x906, @loopback, 0x7}, 0x1c, &(0x7f0000001d40)=[{&(0x7f0000000880)="fa", 0x1}], 0x1}, 0x40085) socket$netlink(0x10, 0x3, 0x4) writev(0xffffffffffffffff, &(0x7f0000000000)=[{0x0}], 0x1) sendfile(r0, r3, 0x0, 0x20000000002) 3.841514111s ago: executing program 2 (id=17953): ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) socket(0x400000000010, 0x3, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd26, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0x6}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_qfg={0x8}]}, 0x2c}}, 0x24040084) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r4, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) connect$inet6(r4, &(0x7f0000000100)={0xa, 0x0, 0x0, @loopback}, 0x1c) ioctl$FS_IOC_SETFSLABEL(r4, 0x41009432, 0x0) setsockopt$inet6_tcp_TCP_ULP(r4, 0x6, 0x1f, &(0x7f00000000c0), 0x4) setsockopt$inet6_tcp_TLS_TX(r4, 0x11a, 0x1, &(0x7f0000000140)=@gcm_256={{0x303}, "6ae04425ace3f60c", "acba84f091ccf68a710300f23c58140000ffffffffffffffdf002100", "0f9dafb4", "ffffffffffffffff"}, 0x38) writev(r4, &(0x7f0000000080)=[{&(0x7f00000002c0)="ec", 0xfdef}], 0x1) sendmsg$nl_route_sched(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000400)=@newqdisc={0x34, 0x28, 0x4ee4e6a52ff56541, 0x70bd2c, 0xfffffdfc, {0x0, 0x0, 0x0, r3, {0xfff2}, {0xffff, 0xffff}, {0x2, 0xa}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x2004805d}, 0x0) r5 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000800)={'syzkaller0\x00'}) socket$inet_icmp_raw(0x2, 0x3, 0x1) socket$nl_netfilter(0x10, 0x3, 0xc) r6 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$nfc(&(0x7f0000000480), r7) ioctl$IOCTL_GET_NCIDEV_IDX(r6, 0x0, &(0x7f00000000c0)=0x0) r10 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r10, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000080)={0x5c, 0x2, 0x6, 0x5, 0x0, 0x0, {0x7}, [@IPSET_ATTR_DATA={0x14, 0x7, 0x0, 0x1, [@IPSET_ATTR_TIMEOUT={0x8, 0x11}, @IPSET_ATTR_HASHSIZE={0x8, 0x12, 0x1, 0x0, 0xffff}]}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_TYPENAME={0x10, 0x3, 'hash:ip,mac\x00'}]}, 0x5c}, 0x1, 0x0, 0x0, 0x810}, 0x4084) sendmsg$NFC_CMD_DEV_UP(r7, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r8, @ANYBLOB="010026bd7000fcdbdf250200000008000100", @ANYRES32=r9], 0x1c}}, 0x840) unshare(0x2c020400) write$nci(r6, &(0x7f0000000280)=ANY=[@ANYBLOB="400404"], 0x7) write$nci(r6, &(0x7f0000000140)=ANY=[@ANYBLOB="000501"], 0x4) 3.505729067s ago: executing program 1 (id=17955): socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000200)='ns/pid_for_children\x00') unshare(0x6a040000) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="bc0000001900010000000000000000001c140000fe0000010000000084001200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005001a000d00000008000400", @ANYRES32, @ANYBLOB='\f\x00\t'], 0xbc}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[], 0xc3}, 0x1, 0x100000000000000}, 0x0) r0 = socket(0x10, 0x3, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x202000, 0x0) ioctl$TUNSETTXFILTER(r2, 0x400454d1, &(0x7f00000001c0)={0x1, 0x1, [@multicast]}) close(r1) sendmsg$netlink(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)={0x14, 0x14, 0x1, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1}, 0x0) r3 = socket$inet6_mptcp(0xa, 0x1, 0x106) socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket$packet(0x11, 0x2, 0x300) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x1}, 0x1c) listen(r3, 0x0) r4 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r4, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) sendmsg$NL80211_CMD_LEAVE_MESH(r4, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000440)=ANY=[@ANYBLOB, @ANYRES32=0x0], 0x1c}, 0x1, 0x0, 0x0, 0x895}, 0x40c0) r5 = accept(r3, 0x0, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r5, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000140)=ANY=[@ANYRES64], 0xfffffdef}, 0x1, 0x0, 0x0, 0x800}, 0x10) recvfrom(r4, 0x0, 0x0, 0x101, 0x0, 0x0) 3.361597098s ago: executing program 2 (id=17956): sendmsg$sock(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, 0x0}, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000004140)=[{{0x0, 0xfffffffffffffe2f, 0x0}, 0x40000004}], 0x1, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b70800000d0000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="0b00000005000000000400000900000001"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xa, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18000000000000000000000000000000850000006d"], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000d80)={0x18, 0x5, &(0x7f0000000480)=ANY=[@ANYBLOB="1801000021"], 0x0, 0x40, 0x0, 0x0, 0x0, 0xb4a02fe0ce239f93, '\x00', 0x0, 0x2}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xe, 0x21e4, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000800000000000000000000018110000", @ANYRES32=r1], 0x0, 0x0, 0x0, 0x0, 0x0, 0x59, '\x00', 0x0, @fallback=0xd, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x401}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={r2, 0x2000000, 0xe, 0x0, &(0x7f00000004c0)="630b008646dc3f0adf33c9f7b986", 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x20}, 0x50) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000240)=0x9, 0x4) r3 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r0, &(0x7f0000000380)=ANY=[@ANYBLOB="1c0000f500000000000000862dfdff00000002"], 0x78) 2.991218826s ago: executing program 2 (id=17958): sendmsg$ETHTOOL_MSG_DEBUG_GET(0xffffffffffffffff, &(0x7f0000000d40)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4008004}, 0x20000080) r0 = socket$alg(0x26, 0x5, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000700)=ANY=[@ANYBLOB="640100001900010000000000040000001d0100001500040001000080fe02000031171e44b2b50e8f040000001e0106000000fd0000ec058cdecf0fa4f69652b23bf9968d372a0ddfe196faa30f83514813d0527685407bc8366e2838397d6abc25357799ac708b65efffdb10e1376a4f6d4ab9949102000036dbf30bf928c37695658578feb8f3cce47f43a42919c288f7d5430ffc0226139916866a978312dd970e64629d7cd799c5e08b64de41458eb8951a54a7cf29a810823e869f5c087d15d9d3bae1c089701f970f8e7ce853654222f07959e7cdcfcf27332cb82016ccd91be54e588f6ea7b5c35a62c0ceaa4e90b29c3edc16f20db3d7fb4d6236232de07ccd7d7301f46a287dd296abe9baba499721311e1597853a2d0c7e1e64f827d31e6917175792398e0edaa900000000000000000002c900c08ac1d7b606000000000000000000000000000008000900", @ANYRES32, @ANYBLOB="080005"], 0x164}}, 0x0) bind$alg(r0, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000fc0)={&(0x7f0000000080)=ANY=[], 0x40}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x16, 0x6, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @flow_dissector, 0xffffffffffffffff, 0x8, 0x0, 0xffffffc5}, 0x94) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000280)="2c385a7af3", 0x5) r2 = accept4(r0, 0x0, 0x0, 0x800) getsockopt$inet_sctp_SCTP_LOCAL_AUTH_CHUNKS(r2, 0x84, 0x1b, &(0x7f0000000600)={0x0, 0xfe, "3fca707c6985dc9c4fc8f5946015ef8e91429dccdf2c3d148d23c776993342fdc5e0f8707c223e4669ce38d293e4a514b6bdbb19947d10e61d31c2a5150aa96902000000bf2cb1095a04a70215c1ab0fc3089ada7f881d0a000000000000000000000000000000007ea249a87365613693a5e3cdba734ad84b1c269ff53101d190d358a6ebbc8df2d1bef5b7bae7c4bf5de7ed7316ba6541bb1b2f789eb7b62b07a224f9451e0b72137f692c86a53232c5610f7867b5439fead43c9d401abcaa09f3531920f1aba7a622dc95a84f5d6c13a485102d8f41c3473accb6333a802c77bb02f776a660951dff3bca6211d9a0f5705e56bcef9bf0234b0776c825"}, &(0x7f0000000540)=0x106) setsockopt$inet_sctp6_SCTP_CONTEXT(0xffffffffffffffff, 0x84, 0x11, &(0x7f0000000500)={r3, 0x2}, 0x8) sendmmsg$alg(r2, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r2, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r5 = socket(0x400000000010, 0x3, 0x0) r6 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000005c0)=@newqdisc={0x24, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0x25dfdbfd, {0x0, 0x0, 0x0, r7, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x5, 0xf}}}, 0x24}}, 0x0) sendmsg$nl_route_sched(r5, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x22044028}, 0x0) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r8, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r8, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r9, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r10, @ANYBLOB="d50633008000009effffffffffff080211000001"], 0x6f4}}, 0x8044) r11 = socket$rxrpc(0x21, 0x2, 0xa) setsockopt$SO_TIMESTAMPING(r11, 0x1, 0x41, &(0x7f0000000000)=0x6170, 0x4) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x8, 0x32, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000000c0)=ANY=[], 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000001c0)={0x18, 0x1f, &(0x7f0000000280)=ANY=[@ANYBLOB, @ANYBLOB="0000000000000000b702000014000000b7030000fffe00008500000086002a0b5de5efde36fd0000550901000000008095000000000000001801000020696c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000faffffff85000000060000001801000020646c2500000000002020207b1af8ff00000000bfa100000000000007010000f4ffffffb702000008000000b7030000080000008500000006000000bf91000000000000b702000003000000850000002a000000b7000000000500009500000000000000ed4164aefcbe900e21bea05c2030e587447353c671e2959b5950b6b7d66f2abda4cebc2c6a195d8a5e024abae68745a59a9b315d58895da828fb127c967b3558b86932cad59eaa48846ec436a14d89dd37148068fadc6d639047c7c1ec124d9a24837680ef5cf5869a9aaaa1387bfdd433fdc30e3c4ea431db0ea50a8913ad2a87723dc351c6ba9c022216c97a694cbafa69c6432af7130995515b6511800dee98dcc7e19e4af86c343c1573626c7f48e973a81a"], &(0x7f0000000080)='GPL\x00', 0x3, 0xff8, &(0x7f0000000780)=""/4088, 0x41000, 0x4b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x8000d}, 0x94) 2.928926656s ago: executing program 3 (id=17959): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) setsockopt$sock_int(r0, 0x1, 0x2b, 0x0, 0x0) r1 = socket$igmp(0x2, 0x3, 0x2) socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0x6, 0xb, &(0x7f0000000240)=ANY=[@ANYBLOB="18000000000000e50000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300001e334185850000007300000095"], &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x27, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = socket(0x40000000015, 0x5, 0x0) connect$inet(r2, &(0x7f0000000040)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$SO_RDS_TRANSPORT(r2, 0x114, 0x8, &(0x7f00000008c0)=0x2, 0x4) setsockopt$sock_int(r2, 0x1, 0x21, &(0x7f00006dbffc), 0x4) bind$inet(r2, &(0x7f0000000340)={0x2, 0x4e20, @loopback}, 0x57) sendmsg$xdp(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000840)=[{&(0x7f0000000d00)="0f198d5aa5caa1c55b84b414797cbdd4e8c576a921a070fc828060506683fd1106a961ac55b5b8ea3342ca7de5559ca2c14e05e42aed8ba14b2c78cb540f71a817d80fbf1945a046ebda494a8048a106a4d49d7f214735ada53397db3b203885ce39ee48d69465935eade21ce36e61826c52c82f038341d9bab5687c740ed3c18897094e7e1391eb84a4052e03c0c7c39ae86d454938f65e284620b99481c33d9f5e5b7a6c0d7548723f55b213c76be37f40c850c38e265758ebd8238257a146d6eced16fd658a784c928fea7a841db1a7fd6520442dae5fc0d3a3d3a5f16fcf6fe4f062ecdad7d0f3c6cd339339533c0ef28ad1e2729907094c3de93c1b1b00ad6df89507000000fb7565d3a8e9eaea020ed173c2179fb03e0944460989240a689c7fe795d310be4e7a6b778a903280dbf426b39c3603c49049980767e31edb997f59785184cbd7b9070400000073c745f71db0906cb51780f908fa61634af8ac85d9f04f3dff0a948e81cd3229a59aaeb00995358155343e3239588a0383e4df109d5ca24276d0d83a27d0e9bf681c1bbea12a6f3c20ad50f63430333bb327eb6ae32fe8809065bce26d2dc2fbb2b48d404637d61fd86852e0e1b6ccc6f75b1107aaa5f60ef45f94e953b3f213c3cb4ca4c716565078c666f84e1a99bb4cb5c7190648132f6ff1f6cb79b93f20752753c938da6241607a742361d995188b23cb4b8269e98e822585695962620673433748e476f7cc3e37db88639c525ff3a502c82c283b00aecfe7734ab369e1ed7c75e27a5a333641817baa3ea37844e20e6266c5095abf9d47ca5f8ad93f1a4d8795daec222ada00d65cf91425fae7939ceaa8d94ec1ab5082e1d251c27b3132119b350e81771f3733be232ffb90c03a818bf458aac3314007c3e35d5e4bed6b897608b01e7e26a54433e5f5c74a2ee3c2fc50067be05a677f122b7dba7010830b879a41b579d44158fb89ea05761d2d369853bea84dfb8081ed7b891dcb3bb3361534fdc5252e4964aed936ad2838e7af14fc65c7c1c6d44c6256f2462ae83cfd6a6b2651da607fe79d345e5080098e9e6e7482cc5c267e00d8d09dcde70b60fe6220fe9530547201664db91cf1885ecc2f106b66cd99131523c99f6102ddd7403791b3a7ac59b256cc4c938fe01740ae4f19b5204ca305b1666b0c2a7e5015d6d530995843adfbac3954306d4cd82257d4d2c3283d45dbae43548fed9879328f114f7c8238ac955391b24614d91be1701ae07c170a9c299fcf3d0ac4cea07e88fbf66b697883af17a06ac3f9954eb2fbd20f101802cd023fc48c5d464c16059cc9dce8558c5322ac7612db0e2725427628c2c41a21f0d2f3962e32f710bf9e216ff1694e8d88c8a81328744b36d9ef9f08c0ea3ccd4f8729e2f00a048162834a95", 0x3f1}, {&(0x7f00000004c0)="128b9306006d4810e5ac5040ad9201847839fc378469d5765b9cc241840896c1498194a7197b45d74a8532b82037b02c9e6045c361eb2d94ae3ac4cb94c12da07d3bceae3a03adc690049e5ac1ec24deaba6fb08f165386aff710d042de332fc1062b0e9306ea7639c0e30d94ceaf76afb36ec8e373ae26899025043ab655ec699608b7e8d844ae5774ca70584a7e9e7", 0x90}], 0x2, 0x0, 0x0, 0x10}, 0x0) setsockopt$RDS_CONG_MONITOR(r2, 0x114, 0x6, &(0x7f0000000680)=0x1, 0x4) socket$rds(0x15, 0x5, 0x0) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x0, 0x3, 0xfffffffffffffffd}, 0x0, &(0x7f00000002c0)={0x3ff, 0x0, 0x0, 0x9, 0x0, 0x0, 0x7fffffff}, 0x0, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x32, 0xffffffffffffffff, 0x0) sendmsg$NL80211_CMD_JOIN_MESH(r2, &(0x7f00000001c0)={0x0, 0x0, 0x0}, 0x40) recvmmsg(r2, &(0x7f0000006fc0)=[{{0x0, 0x0, 0x0}, 0x81}], 0x1, 0x20000020, 0x0) 2.845431922s ago: executing program 4 (id=17960): socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = syz_init_net_socket$x25(0x9, 0x5, 0x0) r3 = syz_init_net_socket$x25(0x9, 0x5, 0x0) bind$x25(r3, &(0x7f0000000e00), 0x12) bind$x25(r2, &(0x7f0000000080), 0x12) close(r2) r4 = socket(0x10, 0x3, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000000200), r4) getsockname$packet(r4, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) r6 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x50) r7 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000002c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x4, 0x1c, &(0x7f0000000040)=@ringbuf={{0x18, 0x8, 0x0, 0x0, 0xff90}, {{0x18, 0x1, 0x1, 0x0, r7}, {}, {}, {0x85, 0x0, 0x0, 0x5}, {0x4, 0x1, 0xb, 0x9, 0xa}}, {{0x5, 0x0, 0x3, 0x9, 0x0, 0x1, 0x3801}, {0x2c}}, [@snprintf={{0x7, 0x0, 0xb, 0x2}, {0x3, 0x3, 0x3, 0xa, 0x9}, {0x5, 0x0, 0xb, 0x9}, {0x3, 0x3, 0x6, 0xa, 0xa, 0xfff8, 0x110}, {0x7, 0x1, 0xb, 0x6, 0x8}, {0x7, 0x0, 0x0, 0x8}, {}, {}, {0x7, 0x0, 0xc}, {0x18, 0x2, 0x2, 0x0, r6}, {}, {0x46, 0x8, 0xfff0, 0x76}}], {{0x7, 0x1, 0xb, 0x8}, {0x6, 0x0, 0x5, 0x8}, {0x85, 0x0, 0x0, 0x7}}}, &(0x7f0000000980)='GPL\x00', 0x7, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x30, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x94) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="480000001000050700000086d7c0d6c878f064eb", @ANYRES32=r5, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000900)=@newqdisc={0x30, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_clsact={0xb}]}, 0x30}}, 0x4000800) sendmsg$nl_route_sched(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000340)=@delchain={0x54, 0x64, 0xf31, 0xfffffffd, 0x0, {0x0, 0x0, 0x0, r5, {0x0, 0xfff3}, {0xfff3, 0xffff}, {0xa, 0x1b}}, [@filter_kind_options=@f_flower={{0xb}, {0x24, 0x2, [@TCA_FLOWER_KEY_ENC_OPTS={0x18, 0x54, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPTS_ERSPAN={0x14, 0x3, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPT_ERSPAN_INDEX={0x8, 0x2, 0x8}, @TCA_FLOWER_KEY_ENC_OPT_ERSPAN_VER={0x5, 0x1, 0x1}]}]}, @TCA_FLOWER_KEY_ENC_OPTS_MASK={0x8, 0x55, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPTS_GENEVE={0x4}]}]}}]}, 0x54}, 0x1, 0x0, 0x0, 0x40044}, 0x4804) ioctl$NILFS_IOCTL_GET_SUSTAT(r2, 0x80306e85, &(0x7f0000000140)) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) r9 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000040)={'lo\x00', 0x0}) sendmsg$nl_route(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="300000001c00357428bd7000fed3df2502000000", @ANYRES32=r10, @ANYBLOB="080026040a000100000000000000000008000f0005"], 0x30}, 0x1, 0x0, 0x0, 0x240400c0}, 0x80c0) r11 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSARP(r11, 0x8953, &(0x7f0000000180)={{0x2, 0x0, @empty}, {}, 0x0, {0x440, 0x0, @multicast1=0xe000cc02}}) sendmsg$NFNL_MSG_ACCT_GET(r8, &(0x7f0000000800)={0x0, 0x0, &(0x7f00000007c0)={&(0x7f0000000780)={0x14, 0x1, 0x7, 0xd03, 0x0, 0x0, {0x2, 0x0, 0x2}}, 0x14}, 0x1, 0x0, 0x0, 0xa053}, 0x20800) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(0xffffffffffffffff, 0x84, 0x64, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=ANY=[@ANYBLOB="3000000010000100"/20, @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=0x0, @ANYRES64], 0x30}}, 0xc000000) 2.76784686s ago: executing program 2 (id=17961): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000380)={0x2, 0x4e22, @multicast1}, 0x10) setsockopt$sock_int(r1, 0x1, 0x800000000f, &(0x7f0000000080)=0x7, 0x4) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$kcm(0xa, 0x1, 0x106) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="5d0000001507010325bd7000fcffffff8700000011667df188c4c07a678848e9ee9cb4c1f493ce3aedf71d172de005fb22794a35d04c0666ebc9bca9b523e2093ec1dd094a668b965729b270f58a46e4f7f1e6b334ce58c4dc834820d8"], 0x14}, 0x1, 0x0, 0x0, 0x40000}, 0x0) syz_genetlink_get_family_id$nl80211(0x0, r6) sendmsg$kcm(r5, &(0x7f0000000780)={&(0x7f0000000000)=@in6={0xa, 0xfffe, 0x0, @ipv4={'\x00', '\xff\xff', @remote}, 0x2}, 0x80, 0x0}, 0xe07e872420dfefca) r7 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_tx_ring(r7, 0x107, 0x5, &(0x7f00000000c0)=@req3={0x808000, 0x4, 0x20300, 0xfc}, 0x1c) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0xf, &(0x7f0000000100)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x8b, 0x0, 0x0, 0x0, 0x80}, {{0x18, 0x1, 0x1, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x3010000}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xfeff}, {0x85, 0x0, 0x0, 0x86}, {0x7, 0x1, 0xb, 0x9, 0x0, 0x20}}, {{0x5, 0x0, 0x5, 0x9, 0x0, 0x1, 0x80000000}}, [], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x3}, {0x85, 0x0, 0x0, 0x84}, {0x7, 0x0, 0xb, 0x0, 0x0, 0x0, 0x500}}}, &(0x7f0000000000)='GPL\x00', 0x3, 0x0, 0x0, 0x41000, 0x4b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x6}, 0x94) poll(&(0x7f0000000300)=[{r6, 0x8000}], 0x1, 0x101) r8 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000003580)={0x20, 0x24, 0x107, 0x70bd2e, 0x25dfdbfb, {0x2, 0x7c}, [@nested={0xc, 0x1, 0x0, 0x1, [@typed={0x8, 0x2, 0x0, 0x0, @u32=0x1}]}]}, 0x20}, 0x1, 0x0, 0x0, 0x4048011}, 0x8010) sendmsg$nl_route_sched(r4, &(0x7f0000000b00)={0x0, 0x0, &(0x7f00000000c0)={0x0}, 0x1, 0x0, 0x0, 0xc044}, 0x4000814) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000080)={'veth1_macvtap\x00'}) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={0x0, 0x44}, 0x1, 0x0, 0x0, 0x2004d808}, 0x0) bind$inet6(r2, &(0x7f0000000140)={0xa, 0xce22, 0x7f, @ipv4={'\x00', '\xff\xff', @multicast1}, 0xffffffff}, 0x1c) listen(r1, 0x0) listen(r2, 0x2) r9 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$sock_int(r9, 0x1, 0xf, &(0x7f0000000180)=0x800001, 0x4) bind$inet6(r9, &(0x7f0000000140)={0xa, 0x4e22, 0x7f, @ipv4={'\x00', '\xff\xff', @multicast1}, 0xffffffff}, 0x20) listen(r9, 0x2) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)=ANY=[@ANYBLOB="20000000400019070000000000000025037c00000c0042800800"], 0x20}, 0x1, 0x0, 0x0, 0x48814}, 0xc000) 2.678890905s ago: executing program 3 (id=17962): bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000080)=ANY=[], 0xe) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000100)={0x50, 0x2, 0x6, 0x3, 0x0, 0x0, {}, [@IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_TYPENAME={0x16, 0x3, 'hash:net,port,net\x00'}]}, 0x50}}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) r3 = socket(0x2b, 0x80801, 0x1) shutdown(r3, 0x7ffffffe) socket$nl_netfilter(0x10, 0x3, 0xc) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f00000037c0)={0x0, 0x0, &(0x7f0000003780)={&(0x7f0000000340)=@newtaction={0x14, 0x30, 0x13f}, 0x14}, 0x1, 0x0, 0x0, 0x84}, 0x0) r5 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_SET(r5, &(0x7f0000002640)={0x0, 0x0, &(0x7f0000002600)={&(0x7f0000000400)={0x18, 0x1402, 0x1, 0x70bd26, 0x25dfdbfb, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x2}]}, 0x18}, 0x1, 0x0, 0x0, 0x81}, 0x4850) sendmsg$IPSET_CMD_ADD(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000780)=ANY=[@ANYBLOB="74000000090601020000000000000000030000000900020073797a310000000005000100070000004c0007801800018014000240fe8000000000000000000000000000aa1800148014000240fc000000000000000000000000000000060004404e1f0000050007008400000006000540"], 0x74}, 0x1, 0x0, 0x0, 0x10040003}, 0x0) sendmsg$IPSET_CMD_LIST(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, 0x7, 0x6, 0x5, 0x0, 0x0, {0x1, 0x0, 0x2}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20004080}, 0x48810) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x6, 0x13, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000000085000000b0000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000007000000095"], &(0x7f0000000200)='GPL\x00', 0xd, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r6, 0xffffffff, 0xe, 0x0, &(0x7f00000000c0)="05004013ffffffffa000c4353512", 0x0, 0x60ff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) bpf$LINK_DETACH(0x22, 0x0, 0x0) syz_genetlink_get_family_id$nl802154(&(0x7f00000001c0), 0xffffffffffffffff) syz_genetlink_get_family_id$nl802154(&(0x7f0000001000), 0xffffffffffffffff) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) close(0x3) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000180)=@newtaction={0x44, 0x30, 0xb, 0x5, 0x25df5bfc, {}, [{0x30, 0x1, [@m_ct={0x2c, 0x1, 0x0, 0x0, {{0x7}, {0x4}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc}}}]}]}, 0x44}, 0x1, 0x0, 0x0, 0xf646d5f7286d7fdb}, 0x40) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000080)=@ipv6_getaddrlabel={0x30, 0x4a, 0x3, 0x2000, 0x0, {0xa, 0x0, 0x80}, [@IFAL_ADDRESS={0x14, 0x1, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}]}, 0x30}, 0x1, 0x0, 0x0, 0x44090}, 0x900) socket$nl_crypto(0x10, 0x3, 0x15) r8 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x2, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000300000000000000feffff10850000000700000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x100, 0x70, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000240)={r8, 0x0, 0x30, 0x0, @val=@uprobe_multi={&(0x7f00000002c0)='./cgroup/cgroup.procs\x00', &(0x7f0000000300), 0x0, 0x0, 0x40}}, 0x40) mmap(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x0, 0x13, 0xffffffffffffffff, 0x0) 2.677526477s ago: executing program 0 (id=17963): r0 = socket$inet_udp(0x2, 0x2, 0x0) socket$unix(0x1, 0x5, 0x0) pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r2, &(0x7f00000000c0)=[{&(0x7f0000000180)="77690addcfbe1f", 0x7}], 0x1, 0x1) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000014c0)={&(0x7f00000003c0)=@allocspi={0x11c, 0x16, 0x1, 0x70bd28, 0x25dfdbfc, {{{@in=@multicast1, @in=@empty, 0x4e21, 0x3, 0x4e22, 0x10, 0x2, 0x80, 0xa0, 0x3b}, {@in=@remote, 0x4d4, 0x32}, @in6=@rand_addr=' \x01\x00', {0x373a, 0x4, 0x2, 0xab8, 0x8, 0x1, 0x4, 0x3}, {0x22, 0xd2, 0x4, 0x3}, {0x0, 0xce, 0x7}, 0x70bd2c, 0x3504, 0xf016e6580cc0e8b0, 0x1, 0x0, 0x2c}, 0x1, 0x2}, [@encap={0x1c, 0x4, {0x1, 0x4e22, 0x4e20, @in6=@rand_addr=' \x01\x00'}}, @replay_thresh={0x8, 0xb, 0x10}]}, 0x11c}, 0x1, 0x0, 0x0, 0x48095}, 0x4000014) r4 = socket$nl_audit(0x10, 0x3, 0x9) splice(r1, 0x0, r4, 0x0, 0x2, 0x8) bind$inet(0xffffffffffffffff, 0x0, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$AUTOFS_IOC_CATATONIC(0xffffffffffffffff, 0x9362, 0x0) sendmsg$nl_route(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@newlink={0x28, 0x10, 0x1, 0x70bd29, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, 0x1021, 0x3}, [@IFLA_GROUP={0x8}]}, 0x28}, 0x1, 0x0, 0x0, 0x801}, 0x4000000) r6 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r6, &(0x7f0000000240)={0x2, 0x0, @local}, 0x6f) connect$inet(r6, &(0x7f0000000480)={0x2, 0xfffc, @multicast1}, 0x10) sendmmsg(r6, &(0x7f0000007fc0), 0x800001d, 0x300) setsockopt$inet_int(r6, 0x0, 0x13, &(0x7f0000000140)=0x2, 0x4) setsockopt$inet_int(r6, 0x0, 0x17, 0x0, 0x0) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x4) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000080)=0x1f6, 0x4) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r8) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r9, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r9, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a5c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc200011800e000100636f6e6e6c696d69740000040c00028008000140fffff27414000000110001"], 0x84}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$NFT_BATCH(r8, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSETELEM={0x40, 0xc, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x6}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x14, 0x3, 0x0, 0x1, [{0x10, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0xc, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0x6, 0x1, '\x00\x00'}]}]}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x68}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$NFT_BATCH(r7, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000001c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a480000001e0a010100000000000000000a0000060900020073797a31000000000900010073797a31000000001c000380180000800c000180060001"], 0x70}, 0x1, 0x0, 0x0, 0x4451099e661a63b1}, 0x0) 2.303164149s ago: executing program 4 (id=17964): r0 = socket$inet_smc(0x2b, 0x1, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r4 = socket$inet_smc(0x2b, 0x1, 0x0) ioctl$XFS_IOC_ATTRLIST_BY_HANDLE(r2, 0x4058587a, 0x0) setsockopt$IP_VS_SO_SET_TIMEOUT(r4, 0x0, 0x48a, &(0x7f0000000700)={0x7fff, 0x0, 0x2}, 0xc) connect$llc(r3, &(0x7f0000000180)={0x1a, 0x0, 0x0, 0x8, 0x0, 0x0, @multicast}, 0x10) recvmmsg(r3, &(0x7f00000050c0)=[{{0x0, 0x0, 0x0}, 0x4}], 0x40000000000018c, 0x2, 0x0) socket$tipc(0x1e, 0x5, 0x0) r5 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r5, 0x10f, 0x87, &(0x7f0000000100)={0x43, 0x0, 0x3, 0x3}, 0x10) r6 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r6, 0x10f, 0x87, &(0x7f0000000300)={0x43, 0x3, 0x3, 0x3}, 0x10) sendmmsg(r3, &(0x7f0000001380), 0x3fffffffffffeed, 0x0) syz_genetlink_get_family_id$wireguard(&(0x7f0000000480), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000c80)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0x0, {0x0, 0x0, 0x0, r7, {0x0, 0x2}, {0xffff, 0xffff}, {0x10}}, [@qdisc_kind_options=@q_gred={{0x9}, {0x14, 0x2, [@TCA_GRED_DPS={0x10, 0x3, {0x10, 0x3, 0x0, 0x1}}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x51}, 0x0) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r8, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="4c0000001800ddd000000000000000000200000000000d05000000000600150005000000280016802400010003"], 0x4c}}, 0x0) r9 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x1f, 0x4, &(0x7f0000000180)=@framed={{0x18, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0xa}, [@call={0x85, 0x0, 0x0, 0x75}]}, &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x34}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000500)={r9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) setsockopt$ARPT_SO_SET_REPLACE(r0, 0xa02000000000000, 0x60, &(0x7f0000000000)={'filter\x00', 0xb001, 0x4, 0x3f0, 0x220, 0x308, 0x220, 0x308, 0x308, 0x308, 0x7fffffe, 0x0, {[{{@arp={@local, @empty, 0x0, 0xffffff00, 0x1, 0x0, {@empty, {[0x0, 0x0, 0xff]}}, {@mac=@local}, 0x0, 0x7, 0x2, 0x0, 0x800, 0x0, 'pimreg\x00', 'veth0_to_bridge\x00', {}, {}, 0x0, 0x180}, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@empty, @mac=@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}, @loopback, @broadcast, 0x6, 0xfffffffe}}}, {{@arp={@initdev={0xac, 0x1e, 0x1, 0x0}, @rand_addr=0x64010101, 0x0, 0x0, 0x0, 0xfd, {}, {@empty, {[0x0, 0x0, 0x0, 0x0, 0x0, 0xff]}}, 0x9, 0x4, 0x0, 0x0, 0x0, 0x0, 'veth0_to_team\x00', 'ip6tnl0\x00', {}, {}, 0x0, 0xc}, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@empty, @mac=@dev={'\xaa\xaa\xaa\xaa\xaa', 0x3b}, @broadcast, @dev={0xac, 0x14, 0x14, 0x12}, 0x1}}}, {{@uncond, 0xc0, 0xe8}, @unspec=@CLASSIFY={0x28, 'CLASSIFY\x00', 0x0, {0x9}}}], {{'\x00', 0xc0, 0xe8}, {0x28}}}}, 0x440) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(0xffffffffffffffff, 0x84, 0x7d, 0x0, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(&(0x7f00000003c0), 0xffffffffffffffff) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) 2.247404308s ago: executing program 3 (id=17965): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000200)='ns/pid_for_children\x00') unshare(0x6a040000) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r0) getsockopt$nfc_llcp(0xffffffffffffffff, 0x118, 0x1, &(0x7f00000003c0)=""/208, 0xd0) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) openat$ppp(0xffffffffffffff9c, &(0x7f00000000c0), 0x379080, 0x0) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x1, 0x4, &(0x7f00000001c0)=ANY=[], &(0x7f00000001c0)='syzkaller\x00', 0xaee6, 0x0, 0x0, 0x40f00, 0x7f, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0xfffffe3b}, 0x94) socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket$packet(0x11, 0x2, 0x300) socketpair(0x1, 0x80000, 0x40000, 0x0) sendto$packet(0xffffffffffffffff, 0x0, 0x0, 0x4004800, &(0x7f0000000080)={0x11, 0x10, 0x0, 0x1, 0x7f, 0x6, @local}, 0x14) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x1}, 0x1c) listen(r1, 0x0) r3 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r3, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) r4 = accept(r1, 0x0, 0x0) r5 = socket$netlink(0x10, 0x3, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, &(0x7f0000000080)) sendmsg$nl_route(r5, 0x0, 0x40000) r6 = syz_init_net_socket$llc(0x1a, 0x2, 0x0) bind$tipc(r6, 0x0, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000140)=ANY=[@ANYRES64=r2], 0xfffffdef}, 0x1, 0x0, 0x0, 0x800}, 0x10) recvfrom(r3, &(0x7f0000000080)=""/60, 0xfffffffffffffeeb, 0x101, 0x0, 0x0) 1.959203551s ago: executing program 4 (id=17966): r0 = socket$kcm(0x29, 0x5, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000ac0)=[{0x0}, {&(0x7f0000000880)="3aa854", 0x3}, {&(0x7f0000000a40)="746b9120a32aaf78043a9b07000000000000003c44", 0x15}], 0x3}, 0xc854) setsockopt$sock_int(r0, 0x1, 0x10, &(0x7f0000000180)=0x4c, 0x4) 1.799771155s ago: executing program 4 (id=17967): socket$netlink(0x10, 0x3, 0xf) socket$nl_route(0x10, 0x3, 0x0) r0 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_ADD_VIF(r0, 0x0, 0xca, &(0x7f00000000c0)={0x0, 0x1, 0xfc, 0xfffffff7, @vifc_lcl_addr=@rand_addr=0x64010102, @broadcast}, 0x10) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'geneve0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@deltaction={0x1c, 0x31, 0x100, 0x70bd2b, 0x25dfdbff, {}, [@TCA_ACT_TAB={0x4}, @TCA_ACT_TAB={0x4}]}, 0x34}, 0x1, 0x0, 0x0, 0x4000000}, 0x20040084) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r3, &(0x7f0000000800)=[{&(0x7f0000000f80)="4191062c1421f8d286fea25179d3bff47ffb95a24f597e0388f330e7dfb81fde917ae89f97d5fde0855ce2942ff541f21652a7409dad35f8886d587bb6e698986ca5f808b1b92c1a374dbc7424a26c0ad2b6840cf3049fc728f9109eb576c388dca33df6129f9efd43ccbd58a93f146ce183a410b8959fe192652e32068e0d8e24d8eab4ecbd5ebaa165771a07c890804037074a1ebad3bcdd46b8f34ecb2f4a6e1bbc6ac3d80ea44fbfedf338583f63ba4607f430acc0a98b4fcbb501006052cb83625cbf60ebf28e9095458c1e9971417b2912bbe30037dd5c1ac06f612816e97ac304404619b0c75222e9339f6ba14eac3c1486ac997f919248490b14a5e12ef47e61857f6d43ebc490155bf06e801547ed96f1264b5c220cf3f66d", 0x11d}, {&(0x7f0000000280)="09ec8b684fbd9f0a18960e84defd08b28dc2f98b5aad5cfeb075441d6d15233b802af831523479391b7297416ddff60a6500da9864b052a3105e6fa49014cb2ce5f295aaff14d9077735f34eaec042e8252a6456999297ed02a01da56a3809f0c58184192ebf4bead7e8618412536273bf08e0f6847e436dc74fd4450e8ff88199f35a0c759aff55639834dc4c945dfb330a7b92b049700cb67e0f14337d8390091514253c2f2d4499d89b5f04759319e2c7b6856f03c69029b689f0be37093c79e8ff2405eb93cbfe5487143a294c3e61b0c9be8323cd4d01c37e5f5d4bf94546d02d4dc988dbb4717ee61e5be16f4c7701cc671d25", 0xf6}, {&(0x7f0000000080)="6a5b3986af4597e55298f14c7f201f060fe2bafbdf16a0ace97ea54e624ac84ccc7fc7f393c4ece5273773faa8c63f157edf2a0d41a7c6340c630b50b30c42d156fa375b30d31bf6a611fd29e60958434b6f597e0bb9ec6731ad3c9b2ee1dc975565bc1d534aae4c0693aebccc5caa31bf5b1c194f52f63257b81e71d68ab2fd", 0xfeed}, {&(0x7f00000001c0)="f3ba9e8346ddfd46f5ba7fbc25c6aed71214dcfaa44b98dfdbc07b1c8dc80c42d5501285b1bc305d7f699524d78bca1a151bfd74ca3d4f468f1244e6951083a7e19dec984cc37874a28db922c628a534fb91191d25f636a589", 0x59}, {&(0x7f0000001780)="12dfbd793db81fe455d97618c2aedf67f1b166ec59876a1fbbe13986e69655d6f600262371ef8dae091786d7f9a4d7ca234f8852df8f05000f02b5258ec56ec5fdd5f3531f795bf2f172d6fb23f3549b9734f2eef416b7698a93335a94b8cda61325b62cda1807b03675c6347b431f2d71baa6bc59e9047069153d70ffba20956e58971501c2d9f299fdfa3a38fa73a5da43ba2506d8704592ee5c19ca0d2075ddc9313d8bd2202a89dae6a689d3900818f892f3f17957cd53023399810da5655e0fd0f0f394c9a8bedc", 0xca}, {&(0x7f0000000500)="0f15ce0e2a894e2afb7a77dc4a4ec84b8109b2c95397d40adb9d5e8df8fd9a3167faa56aa764e61ba1a6cc8fd041bb89bee6d17105e169dd8d68d5b79eb5958574299b9035fbed2942a75e731b7571c29a760623e725792c", 0x58}, {&(0x7f0000000580)="2ee97d629c7e44f81166cb7f6ff136f276b93d54b74333781a4c68225b61bae187918e", 0x23}, {&(0x7f0000000b00)="ed48f08c19f5d937fe3f92802a25b07496a34825b6d3fbf57fec343be7e4b6531b0e0f0637b3c46e072578521ad417549bae2e00ad7b67f769ec533e3c9c62b6955e9005ca02506938aeb5adac5798e85f440385c7f26cced77e12ecffa7b98c962259e08cffa0eb0ad803bfdf8336da8df2e85a2a8b407329650ee71f68ca7de83df1c45914bedd1b8add5bc677e5590af05aea657a8b2b7dd4fc76010e259917ab727d4065cee39115ca3d322533bb48b5b8a23e8557688d783d0e5c444fd5ae3e02d7245c498d9c6675c8a9626ecde62915d6ada50bb3a0496c87f77457a664a250ba9d037a463f44057ad767bb933fa0790f660401baa2575729ec0306acedbdda2144218960158223a8759efb5bb977d9ff572bd597b13cf7b1647ffe268d5951288ca88461e1d8739e5aa3c6efda01a565dd2db4eb927815060123eb9d2b945305cad0caef49497b593f4b9f17db2323ffcbc7d743bd572811a09ec96ee3823858205f275fbccc94ca558a3bece72bdb26869f255617e4f10b6f16f9fd0e093508889b46e730834e135889", 0x18e}, {&(0x7f0000000cc0)="be5af0a1b77fdb78379e4aed4f731b0f88920d1b033228f04a8d7f22afacc5c5014861b7715c3de8745083b4869ba515422c01c49a3eea697223ac78b4a3a20fc9364c30aacbebb3c28dedbf525eecad1436bb61f54dd04b7623dd1369e86bcf162595858a39618ac38f8766af0430a83e786a00eb966ffb0cd5a5af2f88781da8c146b566692815d64c86a50d395e6c8c4cea408323066e100694eac314590b63aa97afdfc99a5f3198be8347fe7664ca80f2d586576ece61cf5e334d43a1449f4eb920030e615a06baa50100e3962897b3af4ad468ec87671c0f706bcd47b06ce112f8b19465dbbdff78bea7af7d7bc3cf65b8dd45aeb9e55783bb550679f7ff68e94308492ef12024d7e7677d1a4239cecc3545bfb424fd9f57815a7030041088b74d082f3e0b294951c8d1", 0xfe68}, {&(0x7f00000005c0)="23c8f8e7bb8d0ba65b2d53e1b98cbeae874b769afbb97c7f46c8969c2772e02e5d80add492fdba14dee6fbc6f2cdc93b86fb8199b61a03a801c262c343c6bbf5856dc1d3c7dd7eeb196ddcf13456cff281c807953060a280f32e718b432d2031c73f6ca657519e04cf1b39497f7d785fff277a2a5612abf6c830c8b72579207ac0dda5", 0x83}, {&(0x7f0000000780)="ca3fcea77620b98213d60f78fe2e503ccb6662d189d191886f4fe8db857b07f574782f7bb888b8333220361011eec01501a2772a0392eaa06aca70b89b89f7ffd6ad7838ab27f246f9b78fa61a5ee5", 0x4f}], 0xb, 0x8) pipe(&(0x7f0000000080)={0xffffffffffffffff}) unshare(0x20040600) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)=@base={0x1, 0x42, 0x6, 0x8, 0x0, 0x1, 0x9}, 0x50) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)=@base={0xc, 0x4, 0x4, 0x8001, 0x0, r5}, 0x50) bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x8000, r6, 0x800000}, 0x38) vmsplice(r4, &(0x7f00000001c0)=[{&(0x7f0000000640)="ec", 0x1}], 0x100000000000029d, 0xf) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) getsockopt$sock_buf(r8, 0x1, 0x1c, &(0x7f0000001040)=""/196, &(0x7f0000001140)=0xc4) sendmsg$nl_route(r7, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000240)=@ipv4_newroute={0x1c, 0x18, 0x35f32a6dfa748ddb, 0x0, 0x0, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}}, 0x1c}}, 0x60800) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000002900)=ANY=[@ANYBLOB="541000001800dd8d000000000000000002001000ff000006003e000008000300", @ANYRES32=0x0, @ANYBLOB="08001e000300000008001e000f0000000410088010a1e4769ff0f76ab823120a9bc4f54949799a5493accf8eca9a6d08f6921f23e74f305de253078008517024b0682f4a41515f9d3ec8521a174ec7b3e3618750b4e3aaa184e138cf3a2ad5b51ffb0ac7bcc179c7b8394ed57b781d5af1c0f5b91e1cd286f4f80376be767ffebb5f3448617137134686f546aa624b1325e56b1cbba48ebf31a90503a8a97e4f34a4c4dfddbe9305711251783025ecc7f85433c2282fc6043a203750dad9addaab116c27b033869756d6750bcd5610a56d7040f32c1531d46cde3a59459501a771c1491c9b4eefe8adf09f96ac458cf3a1ab2b43a26f5f8d2d71bb3bebd7c2ecef2ad80c07f604ea6f8822bee2f55bc2970caacdbceb2120f955fb1b6d70c9bcac690118d91c2edb02b9f500bee328c7f495c10192e8a942736b9afad9e55b7102a97c9a31703b53ae190b710f383e28da86d97cd807baf3a044952f24346cec7b2c9c07a7c14b27ed5970ac585bd07e5a5e294379ddf2b7b2a9c58a6d0a007101498445864786c8df9750c9f01944b3c91745965873dd27a60cf1a4a8711c50f8cf9ca5eb746e6553bf78cb3e0c0d8ed7fffc9383a2506de6253a662aacd7f65480b0ea19e253861db5ba693b3c3b170280c3f4d800ca8f65693e36d0c133c1b85a8fb13c3418a076e2f6153dd3acf68cd3c9708b8f23e46d198e829127e17a1ea135d86e5838f4058850354090be5eee6cdd02dad4823a63e3d002553c877e87c7062e753a29f8db1f04bd9d885b9253f07977bfdae7c4d0f9dce99817fe88534eac77b9de3722232fb7c7cbc585f1e0f1d042cabc2143d2e3cdb0a008e8d6be7cbb553d51065bce3cfef20375678645ad3707e6660fdb378e3de74b49523b367e7133df3ed23c002b431a1e1ad98f3c9cb78d3b1967aaaf2ec7aeab4320c4bb1b876946c1a32869f76b8fe271c43668469650894dfbbf19376a19501f44dcc802d5b2b27eac1829a89e021e64f3ad71cd9d0adbd9d80ca53987405d3440b1d67900c1b0383413f0d7a1527d56b67a6c1ba6a2d621a0345b1a71b646e6d9af9e355119a52f5402c12bac93f3a3795aab448dfcd0c28bfa1d354e547060c80e39c81ab85c2e6bb70a51d151592cb1934cded7ab9be57a1c24f050d9297cc2b4d8e9f120e98124045f1fe9c49789b7943498db9f19650a7ac5928e44f43d80c1ddb7b3bc32f4942e4ac8e8b71f282aa7b9b3d77ded4afcd317ba5d1feb597183f3b577f3b44f6828b553bd19e9053e53f91aa6392874ffd3cee8d5858d89b5d46821f7288fe49501db20691b5cc54f92d4f359af44cc9b1f00fe2690c44f5d4063044d3e11d474e8188ae4c275209d9f3bf2464e8fa5355fc1ef330c0c1fd5f4f7f612245262a1b8a4f6027759a2e709c81c0f58358e5fda20e27b4ac499a7ae4908c091174587f4f3d3e6afc35474b0af9bc8d5bbf59d3b28fc92d740cb9aceda5b2ea7df2449a9b0d79e8a90ab78cb8ffcbcf3b827bdd1204988a1128cee6aeedc8f13e0b309f0fe1b058dacd6734e87a1597cb00c65911deea27aec7904d5366a7149f75259100215c8cfd5b39b6f2eba68d1bbc24fb27904cb3ef4a7a7b26ebfe24db71642d7f21c77fba746ebc4736d2d36ce9b143922913d5531e88d91a2a59260185f96230286b0a14b137b95c53864c2e5b12867e5a8d00a23459b0d0e8f4997004b286a5bfff12a062bd5a3ee9a0b33a421afac775672300bc85bd41dac25258c61e1368b05095226e5af1290ae834d3db90c51e66ca4aebb7a67a3255086551ad8b6c9d28c715ebb88d00ff4e05849de1304a02b5ded36cf07313db3844d7b54680dc7e3c7feb13b33790c9b78660a80b831eee23817fcbed05c4f448fbe6c2bed3baea8c19b05f8c9065a85947e653580e7e10b6fd24c7485861283d9bbfeac040f27bdca82961e65d3af1ac466410b834c7745516938309ec1d4374873c50027795a044a56246aa63af490466b7d33323267c842f5a1776afbc3ad648d16b8f3a074590b56d5dee87dc12a7d44abc622da5bb591cba4deccd4584d79f497b77ae07330ce60ef334eec54c0e50d37e1fc1e4024b91edc8377aec959658dbf830d4964ff346f5b354a1b55eec4e64e9a8c35b01e608b97dcdbb9173388d71332d2bbe871508700730a0d3b977f07000000000000001c35ad19c93313421e6a1e52fc1d2b0f1f62566ca76c2ff9d3dc208ac8cfb617d30ad110287002ad9cb96c2270d6e4e5af719ea6da256b53e8f4fa8bc85b90240c5f9e9f775063462596aabc75dbb4f11e95a1e93635ad4baf77f4493f372450a1c262b833ae0b486b4666542dfd4ee4dcfae4a86951d1f33b2bedbdf999a48cec69b1591128d01f594b31b9233182ced0a278eab8826506e13e221d84be62fb86424ee3bdb32c9bc73cfd1f32dd717e60a1587a3b0313b54ab059072d5978fb0c5597da005b14a332c54d24d4105d9cb4c6236e3b2236869c5b5b97466cf63d89a044c3dcbdfa8025feae30af3837ce01d6aa57707f50984bbdc45b3aa191415aab450f171bcbe11600154a2054b5b823226182bdb7cd1f75c38bcdfe73739d3f2b2ab241c519551f603e02c053d5bf69f9f08023b81f86fbda737973574289946bec06490075f1a803cdb1549ae80282c7e86fae6c30bb9004a9af5ca038a228ee9dd227e9bafbc703df021023fe2201dcf6dbc5ce267252ebff98430f3566e09acb41f7ade090606719286ca25b3f91e432b8b396bc4f858ecc189a2fa0541a4528fefc3c5c21058e4231454289e592a4a72293d87793ddd2c04a96782fdab7903f1a4e724b867b4ad7d26132a4cf2077fbd2ce90a17f2066f7808b9c53523e2c301e32e886c39c544ffc0b9f774c126888c18507ac3f2ceb20888c65c90373e0a27fb0bdf8442f0238a4cf6a70f2318df93264d801d818f8fd348b440dd495a699104b171d5bdff9d0d532fea7e3f8757545072f8900a3b9ec73b3deb3605746d5aa975641f6992dac2f61e5a7c9890875f941e17f75bccab9c5671c9304382fe1b2a3c2ae4f26ae57a5cc88b058047e5a443f57e38dd8e78ea7d2c73bd12dd2ed1e4bc77cc32bbf0d706e28f5e5d87f41a6666200c9845bf2e184fdc6679f3084aa0816dde2e5304a41f34f20bfe9bc2f5e33aa880b98fad7826869932aa7f45ddbd09e20e2d94427ee47e55c0bd59b39a86b206687b26808d06b05be9038d1d00cfa9fb0facb511f1bb10d6a23f5b616e9a198ef6802bf72d3bb6e9bfd8e614c4675b1a2027c290b5366fde32aa4cb5ade82c37342f5880965fe47667c47c868cfd7ed398a1e7974d244e8e1c29bb915d432829db9b73b901641283c31833c39520301b0affe52ea9cabeaadb537019d4629e7ef8cb45e89e6d1f3260275cf178d150dc29676d215da1a1dd5b72699b29f6a71e22412b17c56183f25ef842e309c0959ad02ed17ea4efba787a5cb1e5310d76a4e779d9e3881c7b0b18a50c4858aa6dc54a9cc520c467b6cff482f88a0331739d26de78fdfa7e22cf148ad878e5648eda64f0f77fce8a6678c94069ecf22aaf71073ced9dc6afe7d4b3ca6a0dc31564cb0c7eecb917573c74550746b8984a3b7ee3689986ab94a526285691db41325febaf5f645f0b71644532da23683df1eed4480d53d74a2cc96d89bbbe3e5a851cd4aee8dcc5a6b97a21686f3439a378a2ef89c9a95e6a86e973b1feecbd848bdb9463a0e06389cb6b8754f9a0cfebf593f41dc9a1fdb760175ed2095d9804e03212c1f8fec02585141e558906e017c6616e5db8e7406a01f27f16a5dc0aafeb687ccc11de286ae55c0221e65fa7438cb935950bbda8b9d2dae07deeba0c8ea671861e7a44ace99666f7a3a92c6bec76c25521074861874620f703877113a43f5c688f81c3e34ab309285f6c708cbcead2b7b7e369d1fcfafe138b967f4bc1bea26ba3b32dc494a93f36224bbe746439357153522e0ac1672392ee581f916929b819ad466d4da5e096a124c41987ce8bdae0a52efcec75921a96efb22ff11537d3fd01ec4fd2bbc8728a1ae37f48c51c9b755fc57959dc67056324f57c44f95d63b29c4eeb9b097b5d9bb30d505b57ae1ad2248f980daf30b51b603b1e6537371fc42be06a5734174e5a092ecefb80211776322a7995100a0b7bd2c20f8688ff4e24a8340ab464b8800ea8c247395dd80544184fdaef9c8d791f1a65b9f4c783a7c4257a3a6763787da643edf89e6f1d256a515462d319f8d8d72ef0aaa54d3d42ebcc8e28a60329137c697d229b0a4b5d8eb9baa98944deb55820925f8a4d5275a2e689521eb1a76368704d8ba049386389d57da6a5e11fa447eb2e84172ed1fe800e2872f27288272815e6d222c2dcb6dee8163467cbc8afab3c0d3d0eec5d663fd19caecb66ec0ad3e7599f121bc4b8eb29ef7a1672939d365484e1325e29d797e43c7e80a118db6a7a7bae048f34dc571b25c5872fae9185e244e8a18db789ba3188dea38f1385f7f583a34c57260b67d17fb7a473fd74d815b76d29809d05b66f1ee0204e9a3b63db16fbb30f2bded7fe4182653b5e3c41fd858fdbb5396c68e4f8b354baf804ce18bb3595ea5b87b59dc777e1c78ac75faf91860d7ea13ff753402488682e072e5025d0c26bae9ba094b3de92a7f5a83a224577c27662b829a087d3046e90e0e73e8039a30706880abea4221be19c97d1472a5a0a56cace72042a1a804c480757f1078a708de1271f875689fa48a38f3aaf96fa86521f454660ac098f1ac4f0ff07bc89e9e9cf151e234b6eabb6550f967a66a560d0be205c9e57b41ebfb1d9bf721309557b93ab3afa12474ff7d4abc9b28a0d072e374e79ad88637b67c65fc649fbdcb72d58982ed93e65543599aa65ba1574c8842b230d441142737cf6779fbb850022361c02658bd868cc9753fd5069576bf51072ee7b26d9dc8be098e9ef4f4dd0e779d00b80e88d0652957013750927107cdd0a2fa395f82eabf915d4c07e7e9d062e86276211dce5349263a9d9e05fbc69b1b9d333d4af78434b37f4410c798ed59a8ba6d0697b776f81e7bffb5ce874f126bedabd84e90b95845f32ebcf3fb8c9278c351fd6670d2479151f26489bacd7add0dcf3adbffc9d236c2ff8b7d231f4c1bfadfef10a254e5dd01d11816746d74c5f71fba7855a204329bd7fd3f616eea93447f5da450d952e63f9b4ee062a28276a23b9637d14c9c82efcb1a094bccfe3e516369fd1e02f4417619bc376fab914839869cb8809dc30407d91cf4937908d3d065cfcce37c5070a3ccc24acc76e5c1db3f691fa6919d572ce77dc176beb29ecda0990fc510c3a821edc3437ff6e9f038a3d19c73095661b680908ac737792e861f1235daca2997dedea87db981da3344c8681020d23deddd784f0ec12bb958081c1756714a3a17779f1d69c45340f06e49bd91cd0326796a5c8b6828e6f5cbe746884fccad3104baee27d454d277a5783986ffaff655270437f5c295e0886497171a78c42a482cb96524e3f94b86789d94e86d41e93ef3eb75b91bb0a5dedc46a30afd9913bcceafb049a3df07db967b65c2ff4d549ed35bbeabc7876a8195e89ab0fed675d7d5759ac58ab1b1eef293b76d299610af4350679485d60e48829a1bbb53a23b0213fd6e7f864ba085ead99a4a4a0ece776d0b9aedf2df23301f758be18e94a50ee813c7101d91e9a22786677820467c8c28a4868d800ff1cb73732637b8f1b663f1081122e8d64f792c5f5b61275c119a9111d996f87fdce39b599c85ee9de9487cc2e30d0c0009b6f159affc6ca4452f71809ee878cc32d195e6f0c5c048669402488e642276b0c8a9ab99d40117e8a9fecce8d182c7107e7cedb014697d09f34ad340a254936d9eeafbad5d8f3634ca6a363f9a2460b4b7095a7b5094629ad25a0bc2b2db3127fdb32ed15b", @ANYRES32=r2, @ANYBLOB="0800100008000000080007007f000001"], 0x1054}, 0x1, 0x0, 0x0, 0x40084}, 0x0) r9 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r9, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000004c0)=@updpolicy={0x1bc, 0x19, 0x1, 0x1, 0x25dfdbfd, {{@in=@multicast1, @in=@remote, 0x3, 0xb, 0xffff, 0x0, 0xa, 0x80, 0x0, 0x6, 0x0, 0xffffffffffffffff}, {}, {0x1, 0x0, 0x80}, 0x0, 0x0, 0x0, 0x0, 0x2, 0x2}, [@tmpl={0x104, 0x5, [{{@in=@local, 0x2000000, 0x3c}, 0x0, @in=@broadcast, 0x34ff, 0x2, 0x2}, {{@in=@rand_addr=0x64010102, 0x0, 0x3c}, 0xa, @in6=@empty, 0x2, 0x0, 0x0, 0x0, 0x800, 0x800, 0xfffffffc}, {{@in6=@empty, 0x0, 0x32}, 0x0, @in=@loopback, 0x3503, 0x4, 0x3, 0x0, 0x0, 0x200}, {{@in=@remote, 0x0, 0x2b}, 0x0, @in6=@mcast1, 0x3504, 0x1, 0x1, 0x1, 0x0, 0xabf, 0x1000000}]}]}, 0x1bc}}, 0x4000) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, &(0x7f0000000100)={0x10000014}) r10 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x3) ioctl$FS_IOC_GETFSLABEL(r10, 0x800452d2, &(0x7f0000000100)) r11 = socket$inet6(0xa, 0x3, 0x28) r12 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFULNL_MSG_CONFIG(r12, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={0x0}, 0x1, 0x0, 0x0, 0x4}, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r11, 0x29, 0x40, &(0x7f00000001c0)=@raw={'raw\x00', 0x3c1, 0x3, 0x538, 0x3a0, 0x150, 0x150, 0x3a0, 0xf8010000, 0x468, 0x238, 0x238, 0x468, 0x238, 0x3, 0x0, {[{{@ipv6={@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}, [], [], 'team_slave_0\x00', 'hsr0\x00', {}, {}, 0x84}, 0x0, 0x338, 0x3a0, 0x0, {}, [@common=@inet=@sctp={{0x148}, {[], [], [], 0x2, [], 0x0, 0x4}}, @common=@inet=@sctp={{0x148}, {[], [], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe], 0x0, [], 0x0, 0x7, 0x5}}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'pptp\x00', 'syz0\x00'}}}, {{@ipv6={@empty, @mcast1, [], [], 'batadv_slave_0\x00', 'veth1\x00'}, 0x0, 0xa8, 0xc8}, @unspec=@NOTRACK={0x20}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x598) 1.63799778s ago: executing program 4 (id=17968): bpf$MAP_CREATE(0x0, &(0x7f0000000500)=@base={0x14, 0x3, 0x8, 0x7, 0x141, 0xffffffffffffffff, 0xfca1, '\x00', 0x0, 0xffffffffffffffff, 0x5}, 0x50) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'hash\x00', 0x0, 0x0, 'cmac(des3_ede-generic)\x00'}, 0x58) bind$alg(0xffffffffffffffff, &(0x7f00000006c0)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_pr_hmac_sha384\x00'}, 0x58) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, 0x0, 0x0) r1 = accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) recvmmsg$unix(r1, &(0x7f0000000d40)=[{{0x0, 0x0, &(0x7f0000000880)=[{0x0}, {&(0x7f0000000640)=""/11, 0xb}, {0x0}], 0x3}}, {{0x0, 0x0, &(0x7f0000000240)}}], 0x2, 0x40000000, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0x0, {0x0, 0x0, 0x0, 0x0, {0x0, 0xffe0}, {0xffff, 0xffff}, {0x10}}, [@qdisc_kind_options=@q_gred={{0x9}, {0x14, 0x2, [@TCA_GRED_DPS={0x10, 0x3, {0xe, 0x3, 0x1, 0x1}}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x51}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000540)=@newqdisc={0x170, 0x24, 0xd0f, 0x200000, 0x0, {0x60, 0x0, 0x0, 0x0, {}, {0xffff, 0xffff}, {0x8, 0xb}}, [@qdisc_kind_options=@q_gred={{0x9}, {0x140, 0x2, [@TCA_GRED_STAB={0x104, 0x2, "abcc61b4e508c02286f1bafc7a22c407a52b0e13291c865d493f15736245f220cd4e40006df455836aa3bd3aaa2c9b95578719c46f89e0179832927deecf7465ea95bd97b018b7afaccdcb28bb42d677b73c44e790f0875fb4b795ca95b7dd712d2c5d69945535f92f74a71236749b077cc85e96554beb53c986a216051bd5979a8cfcfe9f98be58ff7944f6cfda8579dbaedceee578bfd1fb554b6e185e9315425ef0a3fc69d17ede93fc7c46357990604b9f12033688caa0b04adecfc926b3f6ca25bcb5432905e3f30ccbf10cf0f2d00858ba2bbd2702b8d4a7a7c744fbaa2fa35b1c586020d600"}, @TCA_GRED_PARMS={0x38, 0x1, {0x40, 0x9, 0x20000003, 0x5, 0x3, 0x100, 0x7, 0x5, 0xdce, 0x1, 0xa, 0x1a, 0x1d, 0x0, 0xffff8004, 0x9}}]}}]}, 0x170}}, 0x24040004) r2 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'bridge0\x00', 0x0}) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000380)=@newlink={0x54, 0x10, 0x403, 0x0, 0x25dfdbfc, {0x0, 0x0, 0x74, r3, 0xc80, 0x55007}, [@IFLA_LINKINFO={0x34, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x24, 0x2, 0x0, 0x1, [@IFLA_BR_MCAST_QUERIER={0x5, 0x19, 0x2}, @IFLA_BR_MCAST_STARTUP_QUERY_INTVL={0xc, 0x23, 0x1}, @IFLA_BR_MCAST_QUERY_RESPONSE_INTVL={0xc, 0x22, 0x6}]}}}]}, 0x54}}, 0x0) ioctl$sock_inet6_SIOCSIFDSTADDR(r2, 0x8918, &(0x7f0000000040)={@remote, 0x54, r3}) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000040)={'vxcan0\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'bond0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r7, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_RSC={0x10, 0x1, {0x3, 0x3, 0xda8}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000000}, 0x20040084) sendmsg$nl_route_sched(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=@newqdisc={0x30, 0x28, 0x4ee4e6a52ff56541, 0x5000, 0xfffffdfc, {0x0, 0x0, 0x0, r7, {0x0, 0xfff1}, {0xb}, {0x2, 0xfff1}}, [@qdisc_kind_options=@q_red={{0x8}, {0x4}}]}, 0x30}}, 0x400c804) r8 = socket$nl_route(0x10, 0x3, 0x0) r9 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000240)={'veth0_to_bridge\x00', 0x0}) sendmsg$nl_route_sched(r8, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000600)=@deltfilter={0x24, 0x2d, 0x1, 0x70bd28, 0x25dfdbfe, {0x0, 0x0, 0x0, r10, {0xfff3, 0x5}, {0xfff2, 0xffff}, {0x1, 0xffe4}}}, 0x24}}, 0x20044800) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r1, 0x89f3, &(0x7f0000000100)={'gre0\x00', &(0x7f0000000080)={'syztnl1\x00', 0x0, 0x700, 0x7800, 0x4, 0x200, {{0x17, 0x4, 0x0, 0x3, 0x5c, 0x65, 0x0, 0x8, 0x2f, 0x0, @multicast1, @multicast2, {[@noop, @timestamp_prespec={0x44, 0x44, 0xfe, 0x3, 0x2, [{@dev={0xac, 0x14, 0x14, 0x19}, 0x8}, {@empty, 0x5}, {@dev={0xac, 0x14, 0x14, 0x39}, 0x1}, {@rand_addr=0x64010100, 0xf0b2}, {@private=0xa010100, 0x2}, {@initdev={0xac, 0x1e, 0x1, 0x0}, 0x9}, {@multicast2, 0xd}, {@local, 0x101}]}]}}}}}) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000200)={'batadv_slave_1\x00', 0x0}) getsockopt$PNPIPE_IFINDEX(r1, 0x113, 0x2, &(0x7f0000000240)=0x0, &(0x7f0000000280)=0x4) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f00000002c0)={0x0, @initdev, @dev}, &(0x7f0000000300)=0xc) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f0000000c80)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000c40)={&(0x7f00000008c0)=ANY=[@ANYBLOB="44030000", @ANYRES16=0x0, @ANYBLOB="000026bd7000fedbdf250100000008000100", @ANYRES32=0x0, @ANYBLOB="7400028038000100240001006d636173745f72656a6f696e5f636f756e7400000000000000000000000000000500030003000000080004000700000038000100240001006e6f746966795f70656572735f696e74657276616c00000000000000000000000500030003000000080004000800000008000100", @ANYRES32=0x0, @ANYBLOB="7800028038000100240001006e6f746966795f70656572735f636f756e740000000000000000000000000000050003000300000008000400ff0700003c000100240001006d6f64650000000000000000000000000000000000000000000000000000000005000300050000000b00040072616e646f6d000008000100", @ANYRES32=r3, @ANYBLOB="e400028038000100240001006e6f746966795f70656572735f636f756e740000000000000000000000000000050003000300000008000400fffeffff38000100240001006e6f746966795f70656572735f636f756e740000000000000000000000000000050003000300000008000400070000003800010024000100616374697665706f727400000000000000000000000000000000000000000000050003000300000008000400", @ANYRES32=r5, @ANYBLOB="3800010024000100616374697665706f727400000000000000000000000000000000000000000000050003000300000008000400", @ANYRES32=r7, @ANYBLOB='\b\x00', @ANYRES32=r10, @ANYBLOB="f800028038000100240001006c625f73746174735f726566726573685f696e74657276616c000000000000000500030003000000080004000e0000003c00010024000100757365725f6c696e6b75705f656e61626c65640000000000000000000000000005000300060000000400040008000600", @ANYRES32=r11, @ANYBLOB="44000100240001006d6f6465000000000000000000000000000000000000000000000000000000000500030005000000110004006163746976656261636b7570000000003c00010024000100757365725f6c696e6b7570000000000000257072f84fbbb0c30000000000000005000300060000000400040008000600", @ANYRES32=r12, @ANYBLOB="08000100", @ANYRES32=r13, @ANYBLOB="400002803c00010024000100757365725f6c696e6b75705f656e61626c65640000000000000000000000000005000300060000000400040008000600", @ANYRES32=r14, @ANYBLOB], 0x344}, 0x1, 0x0, 0x0, 0x40080}, 0x24000000) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000001c0)="ad5600008100006c78400000e000"/25, 0x19) 1.613408208s ago: executing program 0 (id=17969): r0 = gettid() r1 = syz_open_procfs$namespace(r0, &(0x7f0000000040)) mkdirat$cgroup(r1, &(0x7f0000000000)='syz0\x00', 0x1ff) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={0x0, 0x0, 0x4e, 0x0, 0x40001}, 0x28) r2 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000004640)={&(0x7f0000000540)=@newqdisc={0x48, 0x24, 0xf0b, 0x0, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, {0x0, 0x2}, {0xffff, 0xffff}, {0x0, 0xb}}, [@qdisc_kind_options=@q_hhf={{0x8}, {0x1c, 0x2, [@TCA_HHF_QUANTUM={0x8, 0x2, 0x40}, @TCA_HHF_ADMIT_BYTES={0x8, 0x5, 0x4d26909a}, @TCA_HHF_BACKLOG_LIMIT={0x8, 0x1, 0x2}]}}]}, 0x48}}, 0x70170b405cc25fb9) socket$nl_route(0x10, 0x3, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=ANY=[@ANYBLOB="380000002e00090027bd700000002100040000002400118031f9e05e2f82591487b094f5cbed0a33ec55488635157213ba426e9c8fe61b5c"], 0x38}, 0x1, 0x0, 0x0, 0x42804}, 0x0) r4 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) bind$bt_l2cap(r4, &(0x7f00000005c0)={0x1f, 0x0, @none, 0x4}, 0xe) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbee7, 0x8031, 0xffffffffffffffff, 0x2000) socket$nl_route(0x10, 0x3, 0x0) r5 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) r7 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="10000000040000000800000005"], 0x48) r8 = socket(0x10, 0x80002, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000c00)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff0000", @ANYRES32=0x0, @ANYBLOB="c30c424700000000280012800a00010076786c616e00000018000280140010", @ANYRES8=0x0, @ANYBLOB="fe88"], 0x48}}, 0x0) sendmmsg$alg(r8, &(0x7f00000000c0), 0x492492492492627, 0x0) r9 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f00000001c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r7, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bc82000000000000a6020000f8ffffffb703000008900000b703000000000000850000003300000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) ioctl$sock_SIOCDELDLCI(r4, 0x8981, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000080)={{r7}, &(0x7f0000000000), &(0x7f0000000040)=r9}, 0x20) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000003c0)={r9, r6}, 0x14) syz_emit_ethernet(0x0, 0x0, 0x0) syz_emit_ethernet(0xd84, &(0x7f0000001c00)={@local, @empty, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0xd76, 0x2, 0x0, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x4e20, 0xd62, 0x0, @wg=@data={0x4, 0x7407, 0xfffffffffffffffd, "9c67524ed6ed152d4f775bbc411126513b67aa2818e6f3aeb55bee6ae1049f195705bc8bd9b1085cd41af77353267df8a1d4cecdb01908186ea04e641c89a2ee0432e9c0894a8d7aff0c865e96548d507f048f907320b0f8b1e83b5f1425b63ad9c6adfd09578bbda92c9bd8f57d6efd752a6f20487ebea241d612212e3ccb077a5150c08f56aed6ee45acd4439043886b78cc5562b00bc57cf509d90b02a7bc86919f1b882f556e6aac5e9b93ee545b2b68bd014e2a49c332432ef4adeb61ac418aa4e20ee299f1a8b7a72e985223996b11a8913f3b1c23b10f88c3de28660457a37126fd3b6394536da0cd962f532ff22c496e1df4ffe049b193514c02571399d3618383a287068f4f15d51d1781cc0bc2af66ddc68135bfd33634e1a75be80630ce76ef79c86c9abb2fdc6d84367ea10fd8a6ee3c99eaec83c66bf5ffce6eb5ccc2546b6df905ff1aea223029ba2f7eb2469c5b8637b79347361f8cf0fa9d58a039e7811f343961b22c23d68b2c04eb8b5aeee7c6f71ce95cab886bf2694e0643d18761043e2d1dcb8ce0bdd15817a75f591b05146424797f729689e2a7bd53cb6c02fd15c339057c714794b407b342d12e69ec383b6ea6c99f845d04fd5128203c78a388fb0a1caf1f725f7636eb41e415951f8284a9c475760eb9312f7d6307037d472fbda509d56a0cf8e36d44f3f0b67fabdd2842ab4241cbfc7d309188d3a634129a13bfcac3b39b75d46bed585550ff7b41746dfd7e0f0c8a25e9f39deb7e2a4f0e068b86c6593b3b37838d2809eef3eb2f3120fde2fe3e9fef4e4bea1ddf3d17c40f753b37baaa110a8b4ad805d500e0235e9371b828993da25c5697d1001c8971b3862eef047730b242350403c851cd74cdea94501c0e2875a5830aa71733a0f022cb37e1cfffaee8eb0a23d51181a0691dadcd6b30a86a5fbf5c499120e265938f6430ffde09eb173327c2e25bdf22ae0d742141db856c4beee07af0ce37c078f6e59b41a29502cc01737c984185f6622a3ce02ed04daf2a7eb03c92a5a5ecce5973ef704aba9efcb99bf52f5c662d52f4399a13af760f9f9ff3d5930c3fae014b92ee0aded4ba51d95cf946d5f55f5b5d4603f8b76087d681ad77fc385fe114331c24a4ada85eaebf5405467dbe656b31b79a0f893864a13bda309a2fec2f4fc4858d9daf946df31f4077338bfc3116a45827ce8907ad691d241d3a8859a3672aeee3878e45b0be6f68194638dee30ba6735a6424e51f8b9a4965d37ab7ca96e167a5c32c8a935ff34693e24d067039db0f4ffe4dc5fe7c56a0d6e52a7cef9a6f1cc8b88d61d2258e3e0e8f2d7b699d4a22ab661f6afae5b48cc8fbc9ddfe57e76f274e65b210994fd96cd4deb6fdb795df4147ca0d876b1b08b64d20a28a358f48086c0f8d1f0741260f95adabba51f2d3f36107d49d46ba0c666232597bf08bfab60b5a432a1652e2c503fcf977ea6ff15c8e8f3bd9b7a3017c36be787d5a6579f5236b17d7bdc2c3918d9257e266bdf7929bb366d98d2b225c08c3c5ed22113b8c051c811bd1e52ecbe619dbc9579270c7cf69ac129e84a7141e689d9745d56e1cda6affdc1856757a6e39039b17d5286cf393186b99b20c54987087ece9972c39b4a05f1ca218c35254c666e7fcb7df4aa401cc79e1aade63732064ca80af164709a85fcf8ac72fa5ace60aa04d2ee0d5f051cb032f7c25100facb7ec1c247812b0de4f1c3c1ab98f904d9752cc427bc0445d8e27b51d5a8084087ea61f82ccc1114679f673753eddc7cfc00ba7e25db3391579ecdf638ab73078133e49b522d3d16bf2ebd06e7cefc24154088965ad3c9291c68f19f7cdd2943abc716ecf0b33fe249108da2b1f9abdbcb4dba89746a8c5711a41556efe5537327e253bd9ac68dc56516392292152b86ef118e25cac4e3c7c2b20bbc5bbc2d825c8dc14e9807aa6a423fdebfa7deee913c8f9f58bd967d43af1d65dc5ce72b2cd1a17ce34facd199bf2c62beeb752d156d6f31ea0323bc3ec0500587c485d8141f5b5ac81457df9396fbf98222212ef70527b6ed8d6e4d11156c8ecaee4692e068a72cb3b12686436028a7297956c48ee8fc393907edd3695fddbb786808c0a48182e3334e73fedcef0ee1bfbb13dce8a79b8822fd1ca0ed645f64d134c240844be5a7ac3aa15419ae79e7b1d721ae5abe1b0896c6189f23b65d79f5c3677b89f40aceff98dfca244a160dff264a2b14a3774064e1152fe0cabfc23e3e16dba5f46ea6af09fb3b8529022837c7e9303e3ecd0170fcc0e6fb0f3981d9f8f838412eae1a3dd13b7a980a642739e8abebed29db34c06460f09e27ddba1ed76b4ac6290235f6f81fcd3eb12af9821575b050aaf80d5c6c695807f7480f24e4bc0159744f9045a2d37574508d7e687482f775d0a4c471c4914e6a64b0d444037407b8d079751ddf4b14ed0ee6f1e622952a331a1a147f3a805fb7ca29c3c7feb2dddd0db795ac0ca327d95b19ff37bd8d553703014e5137f8c41b947d199f95f245d3354f9679876db736da5cfbd7cb9f80a12e50c895b999b670c9e161aa12e82c79d98fed5017e11674158a2f258ecc7c550f10dee6bb9d159316c567e3973e8aa30f157f6d30f239877021e7161c0a93c7b6bedccc7a3d8c9313f6f860d33ae0c162236853ae29d7a619bc306998e51c5d91a73475119a648700fbf3a41701ef87b440b83573a44339aea5806c0883470613e38baa518466dee2c671d96768f8d842feb5a812ea3ecd1e307a913a1032f06af2656b0a969b38366c39ca149205540391f36c897efb80aa43707c12e21544386fc232a45c9eb40a64c35edd4db20bd4970d642c0c2a0ee43ce8bf4d1bd84b3c3fa198cfc8d1f83960a1c3cd85a164926dc962a9078c5b079e0f4bb0b4e94b0aec3d13e7c47edc936927da2e6e7fe9485b0489bc4fdd1699611aeb00d767057602b8e53dfb4a6651c0f2873e5f60fdd7e2542d6aba79f491f87522f77427323e87386c89e1df9dd6e4f32be85c9eefbd6e6b177dde573b0d0bb8df828185aedc7aba2e6c3d4d9df393b203c1147f005860a6dd44dbcebead0eeb29fe3216930ef4a5994a93851df960d3be82d4294b64ba8295a59d099fd10afe39c2a79727a5447fa27909d53df6a00a63897261619e853036a6852e95ac6da62276007f2f3f386267cd8a0d136e645247e76db84e466e56ba42618b4fdef3e6d8c48dae5d03e1e369cd74042146e361cd6b4e654c8adc75446c454d3275a7d91646c4fb721966df9df3f761f10bebd212bfc87db9c48ffa0c6efcb17db3955f4a6f58919a036cda4f0a0c07a7306d2909adeeb474bd0bbec58865c4a5804108a014838673ff26438c162ec61e71bb880b154d475c71d500bfda3128b9fac2bccecb790dbd3075f424b1244f111c7eb5cbb7af0b6f3ec9cac20f82b1631822b940c03d697e213747627a5a7ed57414f2826888e515b88e61e69b742b053fe086ffc916abe00a41870cd332201d96c96bd174b369094b0da81ddc50affefa3709a358a5c00308d30a41d10b1c3f91a011bd246588336ff76dd60c10c3bbc8eec06adb3e73cc21d218b83eb9306e0650dd4e41bd65e15bb99a0653fc312251c174abed9e3ed04ef0378feaf78d839ebf61fda85c290f140cd3690cff881c348c57f504c50ca61986b29e58fdb0cbe276e42c982154762110c0f65b240aebe4291c66157629f0a45ea48e8e6a5dfe062214d635c5f828d1c888ec83a279ddac80f748c00e984248bef8e884590dcc1322aceb2d3b525618450fa0649e4ae8722769c6a32eb47161f7bf08bd59f903240ab9f790313b41607554b21ce45f10cde937f9f68fbb23ace0eaebd86b1201ea230c7f4c57f6594e655904db2a6d3d294f98fe630a524573f52c145b19eea382bc3adac7c7b62863bfa04f2d9fb9b93e7cda0fff4af897281580b879912ebd2c9c9d433ef479e886a477ce4538590179049aaff5e8e51b25db6c0300393a37c25c350e1e4effdd657f26de15199d39e134d1e7fe278b68377674a0e31a12e67096d44f62bd0353147041050fe44d9fbfc95fa8aa368e5868148a9e7a6f5551cf55f677b48ac2b4cd29a300d3cb9cd3a5ef486b9b3138018fb1568ce3f59385b98e93b7113dc85cd242bb57e545d6c151727d1c33ced565b2e29419bc6c458b45ab2107a55793618d20bd476e81ff79543cbace7b26a53a67a3f17ad0e2f2c0cc55f45d374ddc3cf8ada0c52cf1251cc4a6e1c7e84a1536cf328a0a392a3b79bbef1b40ad6e69811f3ec73b971c7cf6d64bfd0b183135d76fbb121aa99c753dce310f3288d460a1158a0c1c2ca4a66eadb38c6669dae4742a1da14b007555ffdae4e60f535ee23018dde93863b028346edc0f8da3ee5208b06fb107e921492ed9f2f2064d865afb5f955c80b1a6c5dbc540f1af7dd68925353d288fce304243f09d1791661027ea11f21ade9abb81a71343f1d405f35b01a504a99e08514f3b8307dce0b7c4305c0e531a538c6c11d8021183a87c2de3e1e384d114559601b948359f153d9845067683d8ef3dc75829a46211368ddf4837c021bf3ba1cc8005ab6902e094635f86f2f090851d5ac0af51c3aec46bdf9024ebe196351e2acd483f71821f033aa02d7bdee2fe987412bda115a5ce7f51dfdb78ce378485801fa10180339d3c5372a65cc46d2f0ef8ad3317062af5c243f81d920075e4874ea69081ba22d8be502422e973128c657da28f4f63d34919b5a4663544e244524263bae0a9a6c7455a16b5b860aedea7a2ea8"}}}}}}, 0x0) setsockopt$packet_fanout(r8, 0x107, 0x12, &(0x7f0000000300)={0x3, 0x3}, 0x4) getsockopt$PNPIPE_IFINDEX(0xffffffffffffffff, 0x113, 0x2, 0x0, &(0x7f00000000c0)) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'vcan0\x00'}) socket$packet(0x11, 0x3, 0x300) 1.506907203s ago: executing program 2 (id=17970): r0 = epoll_create1(0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) r3 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) connect$802154_dgram(r3, &(0x7f0000000200)={0x2, @long}, 0x8) epoll_pwait(r0, &(0x7f0000000140)=[{}], 0x1, 0x2d516fb6, 0x0, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000040)={0x3, 0x5, &(0x7f00000006c0)=ANY=[], &(0x7f0000000680)='GPL\x00'}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000003c0)={r4, 0x0, 0xe, 0x0, &(0x7f0000000180)="5becbc0e0d7cca6073a4f11d1b00", 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) epoll_wait(r0, &(0x7f0000000040)=[{}], 0x1, 0x400) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r5, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000700)=ANY=[@ANYBLOB="b4050000200080006110600000000000c60000000000000095000000000000009f33ef60916e6e893f1eeb0be20000d072f5b89c3043c47c896ce0bc8731fa595b6b4d45ef26dcca5582054d54d53cd2b685b431c70ea948259c4c869b4fc8db714e4b94bdae214fa68a051d4dca7d2647bec1fc89398d2b9000f224891060017c4700de60beac671e8e8f00cb03588aa6007e71f871ab5c2ff88afc6002084e5b52710aeee835cf0d78e45f70983826fb8579c1fb47d2c59005cff414ed55b0d18a9d446935fb332bb593ee341ab59016f81860324b800c00000000000092d9c5fe34ccb80a61ffcb3363073fd8962823ee45f5d7394e9510f4ac6c702cfabe8a9c55c8dafcdb110036e14c1035cafdfef6a358cbfadb3579a285580a3c080d4e0a48d7bdc38a0437c8c1b3aa408a0000000000002248950b000000"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x366, 0x10, &(0x7f0000000000), 0x1dd}, 0x48) r7 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="12000000040000000400000012"], 0x48) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000ac0)=ANY=[@ANYRES32=r7, @ANYRES32=r6, @ANYBLOB='&'], 0x10) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000048c0)={r7, &(0x7f00000047c0), &(0x7f0000004880)=@udp=r5}, 0x20) unshare(0x2c020400) pselect6(0x40, &(0x7f0000000000)={0xa, 0x80000001, 0x2, 0x10000000000006, 0x12, 0x8, 0x80000000, 0x8}, 0x0, 0x0, 0x0, 0x0) 898.502491ms ago: executing program 4 (id=17971): openat$ppp(0xffffffffffffff9c, &(0x7f00000010c0), 0x40000, 0x0) socket$inet6_mptcp(0xa, 0x1, 0x106) unshare(0x6a040000) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040), 0x200002, 0x0) r1 = openat$cgroup_devices(r0, &(0x7f0000000080)='devices.deny\x00', 0x2, 0x0) write$cgroup_devices(r1, &(0x7f0000000140)=ANY=[@ANYBLOB], 0xa) r2 = socket$netlink(0x10, 0x3, 0xf) r3 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_ADD_VIF(r3, 0x0, 0xca, &(0x7f00000000c0)={0x0, 0x1, 0xfc, 0xfffffff7, @vifc_lcl_addr=@rand_addr=0x64010102, @dev={0xac, 0x14, 0x14, 0x20}}, 0x10) r4 = socket(0x10, 0x3, 0x0) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r4, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) recvmmsg$unix(r4, &(0x7f00000003c0)=[{{0x0, 0x0, &(0x7f0000001780)=[{&(0x7f00000016c0)=""/172, 0xac}, {&(0x7f0000004400)=""/65, 0x41}, {&(0x7f0000000480)=""/4088, 0xff8}, {&(0x7f0000001840)=""/115, 0x73}, {&(0x7f0000001480)=""/195, 0xc3}, {&(0x7f00000002c0)=""/230, 0xe6}, {&(0x7f0000000000)=""/120, 0x78}, {&(0x7f00000018c0)=""/120, 0x78}], 0x8}}], 0x1, 0x40010122, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001b40)={0x18, 0xc, &(0x7f0000000140)=ANY=[], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x76, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x5}, 0x94) write(r4, &(0x7f0000000100)="1400000052004f7fb3e4bf80a000080000000000", 0x14) ioctl$FIONCLEX(r2, 0x5450) accept4$llc(r4, 0x0, &(0x7f0000000040), 0x80800) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000780), 0x2, 0x0) r5 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_INIT(r5, 0x0, 0xc8, &(0x7f0000003d40), 0x4) pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$int_in(r7, 0x5421, &(0x7f00000000c0)=0x7) write$cgroup_int(r6, &(0x7f0000000440)=0x2, 0xe4270493) write$nci(r7, 0x0, 0xffffffd1) bind$bt_hci(0xffffffffffffffff, &(0x7f00000458c0)={0x1f, 0x2}, 0xffffffffffffff17) write$bt_hci(0xffffffffffffffff, &(0x7f00000001c0)=ANY=[@ANYBLOB="0103080ac900800009000900b38f5c6e46aaa1240600"], 0xe) setsockopt$inet_int(r5, 0x0, 0x5, &(0x7f0000000000)=0x13, 0x4) 878.284374ms ago: executing program 3 (id=17972): r0 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x23, 0x0, 0x0) r1 = socket(0x11, 0x80805, 0x0) r2 = accept$phonet_pipe(0xffffffffffffffff, &(0x7f0000000080), &(0x7f00000000c0)=0x10) sendmmsg$inet(r2, &(0x7f0000000540), 0x0, 0xc000) socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000200)={'dummy0\x00'}) r3 = socket$inet_tcp(0x2, 0x1, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCBRDELBR(r4, 0x89a2, &(0x7f0000000200)='bridge0\x00') ioctl$sock_SIOCBRDELBR(r3, 0x89a3, &(0x7f0000000200)='bridge0\x00') r5 = socket$inet(0x2, 0x80001, 0x84) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=ANY=[@ANYBLOB="2c0000002100010000000000000000000a000040000000000000000005001600001b000008001700", @ANYRES64], 0x2c}, 0x1, 0x0, 0x0, 0x20004894}, 0x20000080) r7 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$team(&(0x7f00000044c0), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_team(r7, 0x8933, &(0x7f0000004700)) sendmsg$TEAM_CMD_OPTIONS_SET(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=ANY=[@ANYBLOB="1c000000", @ANYRES32, @ANYRESDEC=r2, @ANYRESDEC=r6], 0x5c}, 0x1, 0x0, 0x0, 0x4000401}, 0x400e8c0) getsockopt$inet_sctp_SCTP_MAX_BURST(r5, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0xfffffcbe, &(0x7f0000000100)={&(0x7f0000000240)=ANY=[], 0x64}, 0x1, 0x0, 0x0, 0x40040}, 0x0) sendmsg$IPCTNL_MSG_CT_NEW(r9, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000004c0)=ANY=[@ANYRES32=r8], 0xe0}, 0x1, 0x0, 0x0, 0x800}, 0x0) getsockopt$inet_mreqsrc(r1, 0x0, 0x25, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r1, 0x84, 0x72, &(0x7f00000003c0)={r8, 0x0, 0x20}, 0xc) setsockopt$inet_mreqsrc(0xffffffffffffffff, 0x0, 0x24, 0x0, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r10 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r10, &(0x7f0000000340)={0x1f, 0xffff, 0x3}, 0x6) 375.649275ms ago: executing program 3 (id=17973): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) setsockopt$sock_int(r0, 0x1, 0x2b, 0x0, 0x0) r1 = socket$igmp(0x2, 0x3, 0x2) socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0x6, 0xb, &(0x7f0000000240)=ANY=[@ANYBLOB="18000000000000e50000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300001e334185850000007300000095"], &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x27, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = socket(0x40000000015, 0x5, 0x0) connect$inet(r2, &(0x7f0000000040)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$SO_RDS_TRANSPORT(r2, 0x114, 0x8, &(0x7f00000008c0)=0x2, 0x4) setsockopt$sock_int(r2, 0x1, 0x21, &(0x7f00006dbffc), 0x4) bind$inet(r2, &(0x7f0000000340)={0x2, 0x4e20, @loopback}, 0x57) sendmsg$xdp(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000840)=[{&(0x7f0000000d00)="0f198d5aa5caa1c55b84b414797cbdd4e8c576a921a070fc828060506683fd1106a961ac55b5b8ea3342ca7de5559ca2c14e05e42aed8ba14b2c78cb540f71a817d80fbf1945a046ebda494a8048a106a4d49d7f214735ada53397db3b203885ce39ee48d69465935eade21ce36e61826c52c82f038341d9bab5687c740ed3c18897094e7e1391eb84a4052e03c0c7c39ae86d454938f65e284620b99481c33d9f5e5b7a6c0d7548723f55b213c76be37f40c850c38e265758ebd8238257a146d6eced16fd658a784c928fea7a841db1a7fd6520442dae5fc0d3a3d3a5f16fcf6fe4f062ecdad7d0f3c6cd339339533c0ef28ad1e2729907094c3de93c1b1b00ad6df89507000000fb7565d3a8e9eaea020ed173c2179fb03e0944460989240a689c7fe795d310be4e7a6b778a903280dbf426b39c3603c49049980767e31edb997f59785184cbd7b9070400000073c745f71db0906cb51780f908fa61634af8ac85d9f04f3dff0a948e81cd3229a59aaeb00995358155343e3239588a0383e4df109d5ca24276d0d83a27d0e9bf681c1bbea12a6f3c20ad50f63430333bb327eb6ae32fe8809065bce26d2dc2fbb2b48d404637d61fd86852e0e1b6ccc6f75b1107aaa5f60ef45f94e953b3f213c3cb4ca4c716565078c666f84e1a99bb4cb5c7190648132f6ff1f6cb79b93f20752753c938da6241607a742361d995188b23cb4b8269e98e822585695962620673433748e476f7cc3e37db88639c525ff3a502c82c283b00aecfe7734ab369e1ed7c75e27a5a333641817baa3ea37844e20e6266c5095abf9d47ca5f8ad93f1a4d8795daec222ada00d65cf91425fae7939ceaa8d94ec1ab5082e1d251c27b3132119b350e81771f3733be232ffb90c03a818bf458aac3314007c3e35d5e4bed6b897608b01e7e26a54433e5f5c74a2ee3c2fc50067be05a677f122b7dba7010830b879a41b579d44158fb89ea05761d2d369853bea84dfb8081ed7b891dcb3bb3361534fdc5252e4964aed936ad2838e7af14fc65c7c1c6d44c6256f2462ae83cfd6a6b2651da607fe79d345e5080098e9e6e7482cc5c267e00d8d09dcde70b60fe6220fe9530547201664db91cf1885ecc2f106b66cd99131523c99f6102ddd7403791b3a7ac59b256cc4c938fe01740ae4f19b5204ca305b1666b0c2a7e5015d6d530995843adfbac3954306d4cd82257d4d2c3283d45dbae43548fed9879328f114f7c8238ac955391b24614d91be1701ae07c170a9c299fcf3d0ac4cea07e88fbf66b697883af17a06ac3f9954eb2fbd20f101802cd023fc48c5d464c16059cc9dce8558c5322ac7612db0e2725427628c2c41a21f0d2f3962e32f710bf9e216ff1694e8d88c8a81328744b36d9ef9f08c0ea3ccd4f8729e2f00a048162834a95", 0x3f1}, {&(0x7f00000004c0)="128b9306006d4810e5ac5040ad9201847839fc378469d5765b9cc241840896c1498194a7197b45d74a8532b82037b02c9e6045c361eb2d94ae3ac4cb94c12da07d3bceae3a03adc690049e5ac1ec24deaba6fb08f165386aff710d042de332fc1062b0e9306ea7639c0e30d94ceaf76afb36ec8e373ae26899025043ab655ec699608b7e8d844ae5774ca70584a7e9e7", 0x90}], 0x2, 0x0, 0x0, 0x10}, 0x0) setsockopt$RDS_CONG_MONITOR(r2, 0x114, 0x6, &(0x7f0000000680)=0x1, 0x4) socket$rds(0x15, 0x5, 0x0) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x0, 0x3, 0xfffffffffffffffd}, 0x0, &(0x7f00000002c0)={0x3ff, 0x0, 0x0, 0x9, 0x0, 0x0, 0x7fffffff}, 0x0, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x32, 0xffffffffffffffff, 0x0) sendmsg$NL80211_CMD_JOIN_MESH(r2, &(0x7f00000001c0)={0x0, 0x0, 0x0}, 0x40) recvmmsg(r2, &(0x7f0000006fc0)=[{{0x0, 0x0, 0x0}, 0x81}], 0x1, 0x20000020, 0x0) 338.892419ms ago: executing program 1 (id=17974): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x7a44, 0x1700) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a3c000000120a01020000000000000000020000000900020073797a310000000008000440000000000900010073797a3000000000080003400000000a140000000c0a050000000000000000000000000714000000000a01080000000000000000090002de140000001100010000000000000000000000000aa2672adcbb97aad782a51ec6f3b44d636efdf1d5282f2549e180a9fcc121ede523bfd8f6f44f23a24e917340cc1c9bf9da57ffb84ace242047e798850d830d00d77e663d2090842c2f60af0c4136b1bff656d4c5b768b8e7744683d1728447856e90c7d93ddb119b295a96dd3538e28906232f8721458e9fa69d161ce8830c2a5c1995325b4971d4d87b610c6f0ff4fe43c8178de7a06488ccf1fb7d5bf9aec6fe7d1fb4508c"], 0x8c}}, 0x0) unshare(0x400) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000001240)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a6ddf00000000000000000700000009000100738a7a30000000004c000000090a010400000000000000000700000008000a40000000000900020073797a310000797a3000000000080005400000000d08000640000000000800034000000038480000000c0a01010000000000000000070000000900020073797a31000000000900010073797a30000000001c0003801800008004000280040001800900090073797a3200000000140000001000010000000000000000000084000a"], 0xdc}}, 0x0) syz_emit_ethernet(0x56, &(0x7f0000000140)={@local, @remote, @void, {@ipv4={0x800, @tcp={{0xd, 0x4, 0x0, 0x0, 0x48, 0x0, 0x0, 0x0, 0x5, 0x0, @dev={0xac, 0x14, 0x14, 0x32}, @private=0xa010100, {[@timestamp_addr={0x44, 0x14, 0x5, 0x3, 0x1, [{@broadcast}, {@dev={0xac, 0x14, 0x14, 0x20}}]}, @ssrr={0x89, 0x7, 0xce, [@private=0xa010101]}, @lsrr={0x83, 0x3, 0x4a}]}}, {{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x6, 0x5, 0x4, 0xfffd}}}}}}, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x41, 0x0) close(r4) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000200)={@fallback=r0, r1, 0x8, 0x10, 0x0, @void, @value=r1}, 0x20) openat$nci(0xffffffffffffff9c, &(0x7f00000003c0), 0x2, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) ioctl$TUNSETOFFLOAD(r4, 0xc004743e, 0x110e22fff7) socket$packet(0x11, 0x3, 0x300) ioctl$TUNGETVNETLE(r4, 0x4004743b, &(0x7f0000001a00)) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000400)=ANY=[@ANYRES32=0x0, @ANYRES32, @ANYBLOB="f3ffff000000000000000004cc"], 0x20) write$cgroup_type(r1, &(0x7f00000000c0), 0x9) sendfile(r1, r0, 0x0, 0x10000) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r5 = socket(0xa, 0x3, 0x3a) ioctl$PPPIOCGIDLE32(r1, 0x8008743f, 0x0) setsockopt$MRT6_ADD_MFC_PROXY(r5, 0x29, 0xd2, &(0x7f00000000c0)={{0xa, 0x0, 0x0, @private2={0xfc, 0x2, '\x00', 0x1}}, {0xa, 0x0, 0x0, @empty}, 0x0, {[0xfffffffe]}}, 0x5c) r6 = socket(0x400000000010, 0x3, 0x0) r7 = socket$unix(0x1, 0x1, 0x0) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="1b000000000000000000000000000400000008"], 0x50) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'erspan0\x00'}) sendmsg$nl_route_sched(r6, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@gettaction={0x178, 0x32, 0x1, 0x70bd2d, 0x25dfdbfd, {}, [@action_gd=@TCA_ACT_TAB={0x60, 0x1, [{0x10, 0x9, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'sample\x00'}}, {0xc, 0xc, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'ipt\x00'}}, {0xc, 0x18, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0xa}}, {0x10, 0x1e, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'police\x00'}}, {0xc, 0x2, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'ipt\x00'}}, {0xc, 0xf, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x4}}, {0xc, 0x12, 0x0, 0x0, @TCA_ACT_INDEX={0x8}}]}, @action_dump_flags=@TCA_ROOT_TIME_DELTA={0x8, 0x4, 0x4}, @action_dump_flags=@TCA_ROOT_FLAGS={0xc, 0x2, {0x1, 0x1}}, @action_gd=@TCA_ACT_TAB={0x70, 0x1, [{0x10, 0xe, 0x0, 0x0, @TCA_ACT_KIND={0x9, 0x1, 'csum\x00'}}, {0x10, 0x20, 0x0, 0x0, @TCA_ACT_KIND={0x9, 0x1, 'vlan\x00'}}, {0x10, 0x4, 0x0, 0x0, @TCA_ACT_KIND={0x9, 0x1, 'gact\x00'}}, {0xc, 0x14, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x4}}, {0x10, 0x1d, 0x0, 0x0, @TCA_ACT_KIND={0x9, 0x1, 'vlan\x00'}}, {0x10, 0xe, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'mirred\x00'}}, {0x10, 0x13, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'mirred\x00'}}]}, @action_dump_flags=@TCA_ROOT_TIME_DELTA={0x8, 0x4, 0x1000}, @action_gd=@TCA_ACT_TAB={0x4c, 0x1, [{0x10, 0x8, 0x0, 0x0, @TCA_ACT_KIND={0x9, 0x1, 'gact\x00'}}, {0x10, 0x20, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'sample\x00'}}, {0xc, 0x3, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x7}}, {0x10, 0xa, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'sample\x00'}}, {0xc, 0xf, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x8}}]}, @action_gd=@TCA_ACT_TAB={0x2c, 0x1, [{0x14, 0x18, 0x0, 0x0, @TCA_ACT_KIND={0xd, 0x1, 'connmark\x00'}}, {0x14, 0x12, 0x0, 0x0, @TCA_ACT_KIND={0xd, 0x1, 'connmark\x00'}}]}]}, 0x178}, 0x1, 0x0, 0x0, 0x8001}, 0x20000c40) syz_genetlink_get_family_id$mptcp(&(0x7f0000000040), r6) 71.957664ms ago: executing program 3 (id=17975): r0 = socket(0x10, 0x5, 0x0) syz_emit_ethernet(0xa6, &(0x7f0000000000)=ANY=[@ANYBLOB="ffffffffffffe984c6f2f1cd1377f3768d75d2ca8d01aaaa021000703afffe8000000000000000000000000000bbff02000000000000000000000000000186009078000000000000000000000000030aa78ce54006598080a8030037004023493b87aafaffffffffffffff23732472eefa45ad96579269748e254c1e4a8a8b3f0ab0c430d3be27df3e34066d42ca0a5c15b37adac15084dbaf736b41e5af0000000000000000"], 0x0) write$tun(0xffffffffffffffff, &(0x7f00000000c0)={@void, @val={0x1, 0x4, 0x200, 0x0, 0x8000, 0x3}, @llc={@llc={0x6, 0xf5, "fe", "752aefd5fd30217c3e9be63bebd52c7f30"}}}, 0x1e) socket$unix(0x1, 0x1, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) getsockopt$inet_sctp_SCTP_CONTEXT(r0, 0x84, 0x11, &(0x7f0000000000)={0x0, 0x10000}, &(0x7f0000000040)=0x8) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f00000001c0)={r2, @in={{0x2, 0x4e21, @local}}, 0x2, 0x1, 0x5, 0x0, 0x80, 0x80000001, 0x7}, &(0x7f0000000280)=0x9c) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ethtool(&(0x7f0000001880), r3) sendmsg$ETHTOOL_MSG_TSINFO_GET(r3, &(0x7f00000020c0)={0x0, 0x0, &(0x7f0000002080)={&(0x7f0000001ec0)={0x2c, r4, 0x1, 0x70bd27, 0x25dfdbff, {}, [@HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'dummy0\x00'}]}]}, 0x2c}, 0x1, 0x0, 0x0, 0x8000}, 0x4) r5 = socket(0x15, 0x5, 0x0) getsockopt(r5, 0x200000000114, 0x2711, &(0x7f0000019580)=""/102397, &(0x7f0000000040)=0x18ffd) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000840)={{0x14}, [@NFT_MSG_NEWRULE={0x60, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x34, 0x4, 0x0, 0x1, [{0x30, 0x1, 0x0, 0x1, @range={{0xa}, @val={0x20, 0x2, 0x0, 0x1, [@NFTA_RANGE_TO_DATA={0x4}, @NFTA_RANGE_FROM_DATA={0x8, 0x3, 0x0, 0x1, [@NFTA_DATA_VALUE={0x4}]}, @NFTA_RANGE_SREG={0x8, 0x1, 0x1, 0x0, 0x9}, @NFTA_RANGE_OP={0x8, 0x2, 0x1, 0x0, 0x1}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x88}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000500)={&(0x7f0000000100)=@rxrpc=@in6={0x21, 0x2, 0x2, 0x1c, {0xa, 0x4e23, 0x997, @ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x40}}, 0x80, 0x0, 0x0, 0x0, 0x0, 0x68000000}, 0x4040010) r7 = socket$kcm(0xa, 0x5, 0x0) sendmsg$inet(r7, &(0x7f00000004c0)={&(0x7f0000000200)={0x2, 0x4e23, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, &(0x7f0000000480)=[{&(0x7f0000000240)='*', 0x1}], 0x1}, 0x4000) setsockopt$sock_attach_bpf(r7, 0x84, 0x1f, &(0x7f0000000100), 0x129) sendmsg$nl_route(r1, &(0x7f00000018c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=ANY=[@ANYBLOB="380000001e00010000000000040000000207"], 0x38}, 0x1, 0x0, 0x0, 0x4080}, 0x20000080) syz_open_procfs$namespace(0x0, &(0x7f0000000100)='ns/ipc\x00') ioctl$TUNSETTXFILTER(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)=ANY=[@ANYBLOB='..']) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r8, &(0x7f0000000100)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r8, 0x0) syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/ipc\x00') r9 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r9, 0x84, 0x64, &(0x7f0000000540)=[@in={0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0x19}}, @in={0x2, 0x4e22, @loopback}], 0x20) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r9, 0x84, 0x6d, &(0x7f0000000000), &(0x7f0000000040)=0x8) 0s ago: executing program 0 (id=17976): r0 = socket$unix(0x1, 0x5, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r2, 0x10f, 0x87, &(0x7f0000000100)=@req={0x3fc, 0x0, 0x0, 0x6}, 0x10) r3 = socket(0x1e, 0x4, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) r5 = socket$igmp6(0xa, 0x3, 0x2) syz_genetlink_get_family_id$mptcp(&(0x7f0000000240), r3) r6 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @random="2b0436d23321"}) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r5, 0x8983, &(0x7f0000000480)={0x0, 'veth0_to_hsr\x00', {0x2}, 0x51}) write$tun(r4, &(0x7f0000000340)=ANY=[@ANYBLOB="aaaaaaaaaabb0180c200000e88a800008100007eab91b32dd80cffd20adf8cf828782802010045fc006953d778f6c9a77f00"], 0x32) setsockopt$packet_tx_ring(r3, 0x10f, 0x87, &(0x7f0000000440)=@req={0x3fc}, 0x10) r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$nbd(&(0x7f0000000000), 0xffffffffffffffff) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) sendmsg$NBD_CMD_CONNECT(r8, &(0x7f0000001ac0)={0x0, 0x0, &(0x7f0000001a80)={&(0x7f0000000140)={0x38, r9, 0x1, 0xffffffff, 0x0, {}, [@NBD_ATTR_SOCKETS={0x10, 0x7, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r10}}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7fff}]}, 0x38}}, 0x20000000) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)={0x1c, r9, 0x1, 0x70bd2d, 0x25dfdbfb, {}, [@NBD_ATTR_INDEX={0x8, 0x1, 0x0}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000011}, 0x4000810) recvmmsg$unix(r2, &(0x7f0000001bc0)=[{{0x0, 0x0, &(0x7f0000000080)}}], 0x1, 0x0, 0x0) r11 = socket$inet6_tcp(0xa, 0x1, 0x0) r12 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r12, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x1, 0x70bd25, 0x25dfdbf9, {0x0, 0x0, 0x600, 0x0, 0x48815, 0x40103}, [@IFLA_GROUP={0x8}, @IFLA_TXQLEN={0x8, 0xd, 0x3}]}, 0x30}, 0x1, 0x0, 0x0, 0x40801}, 0x4000000) readv(r11, &(0x7f0000000780), 0x0) recvmmsg(r2, &(0x7f0000008280)=[{{0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000040)=""/55, 0x37}], 0x1}, 0x8}], 0x1, 0x40000180, 0x0) preadv(r6, &(0x7f0000003c00)=[{&(0x7f0000001480)=""/255, 0xff}, {&(0x7f00000000c0)=""/1, 0x1}, {0x0}, {&(0x7f0000001c00)=""/4096, 0x1000}, {&(0x7f0000002c00)=""/4096, 0x1000}], 0x5, 0x23a1, 0x1) close(r3) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000080)={'wlan0\x00'}) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(r1, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) kernel console output (not intermixed with test programs): 659513][T13804] bond16: (slave geneve5): making interface the new active one [ 1087.670952][T13804] bond16: (slave geneve5): Enslaving as an active interface with an up link [ 1087.683053][T13808] netlink: 56 bytes leftover after parsing attributes in process `syz.2.17026'. [ 1087.700314][ T12] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1087.709474][ T12] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1087.723816][ T12] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1087.741395][ T12] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1087.751009][T13806] tipc: Enabled bearer , priority 0 [ 1087.760496][T13806] syzkaller0: entered promiscuous mode [ 1087.767911][T13806] syzkaller0: entered allmulticast mode [ 1087.850724][T13806] tipc: Resetting bearer [ 1087.862418][T13805] tipc: Resetting bearer [ 1087.896805][T13805] tipc: Disabling bearer [ 1088.137152][T13818] tipc: Enabling of bearer rejected, already enabled [ 1088.285023][T13825] syz.3.17031: vmalloc error: size 8589938688, exceeds total pages, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 1088.292830][T13826] syzkaller0: entered promiscuous mode [ 1088.307101][T13826] syzkaller0: entered allmulticast mode [ 1088.330020][T13825] CPU: 0 UID: 0 PID: 13825 Comm: syz.3.17031 Not tainted syzkaller #0 PREEMPT(full) [ 1088.330048][T13825] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1088.330068][T13825] Call Trace: [ 1088.330079][T13825] [ 1088.330088][T13825] dump_stack_lvl+0xe8/0x150 [ 1088.330171][T13825] warn_alloc+0x249/0x340 [ 1088.330231][T13825] ? stack_trace_save+0xa9/0x100 [ 1088.330281][T13825] ? __pfx_warn_alloc+0x10/0x10 [ 1088.330317][T13825] ? kasan_save_track+0x4f/0x80 [ 1088.330348][T13825] ? kasan_save_track+0x3e/0x80 [ 1088.330371][T13825] ? __kasan_kmalloc+0x93/0xb0 [ 1088.330397][T13825] ? __kmalloc_cache_noprof+0x31c/0x660 [ 1088.330425][T13825] ? xskq_create+0x56/0x170 [ 1088.330546][T13825] ? xsk_setsockopt+0x54c/0x990 [ 1088.330572][T13825] ? do_sock_setsockopt+0x17c/0x1b0 [ 1088.330652][T13825] ? __x64_sys_setsockopt+0x13d/0x1b0 [ 1088.330672][T13825] ? do_syscall_64+0x174/0x580 [ 1088.330704][T13825] __vmalloc_node_range_noprof+0x132/0x1750 [ 1088.330767][T13825] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 1088.330802][T13825] ? __kasan_kmalloc+0x93/0xb0 [ 1088.330835][T13825] vmalloc_user_noprof+0xad/0xe0 [ 1088.330872][T13825] ? xskq_create+0xbf/0x170 [ 1088.330900][T13825] xskq_create+0xbf/0x170 [ 1088.330930][T13825] xsk_init_queue+0x8a/0xe0 [ 1088.330960][T13825] xsk_setsockopt+0x54c/0x990 [ 1088.330991][T13825] ? __pfx_xsk_setsockopt+0x10/0x10 [ 1088.331018][T13825] ? __pfx_aa_sk_perm+0x10/0x10 [ 1088.331147][T13825] ? aa_sock_opt_perm+0xff/0x1a0 [ 1088.331201][T13825] ? bpf_lsm_socket_setsockopt+0x9/0x20 [ 1088.331233][T13825] ? __pfx_xsk_setsockopt+0x10/0x10 [ 1088.331260][T13825] do_sock_setsockopt+0x17c/0x1b0 [ 1088.331285][T13825] __x64_sys_setsockopt+0x13d/0x1b0 [ 1088.331310][T13825] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1088.331352][T13825] do_syscall_64+0x174/0x580 [ 1088.331372][T13825] ? trace_irq_disable+0x3b/0x140 [ 1088.331412][T13825] ? clear_bhb_loop+0x40/0x90 [ 1088.331429][T13825] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1088.331443][T13825] RIP: 0033:0x7f6de959ce59 [ 1088.331458][T13825] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1088.331472][T13825] RSP: 002b:00007f6de77ee028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 1088.331488][T13825] RAX: ffffffffffffffda RBX: 00007f6de9815fa0 RCX: 00007f6de959ce59 [ 1088.331499][T13825] RDX: 0000000000000006 RSI: 000000000000011b RDI: 0000000000000004 [ 1088.331508][T13825] RBP: 00007f6de9632d6f R08: 0000000000000004 R09: 0000000000000000 [ 1088.331517][T13825] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1088.331526][T13825] R13: 00007f6de9816038 R14: 00007f6de9815fa0 R15: 00007fff9ac132b8 [ 1088.331554][T13825] [ 1088.341166][T13826] tipc: Enabled bearer , priority 0 [ 1088.356231][T13825] Mem-Info: [ 1088.405010][T13826] tipc: Resetting bearer [ 1088.446101][T13825] active_anon:6956 inactive_anon:15 isolated_anon:0 [ 1088.446101][T13825] active_file:2447 inactive_file:40973 isolated_file:0 [ 1088.446101][T13825] unevictable:768 dirty:358 writeback:0 [ 1088.446101][T13825] slab_reclaimable:12728 slab_unreclaimable:127247 [ 1088.446101][T13825] mapped:29538 shmem:2033 pagetables:1468 [ 1088.446101][T13825] sec_pagetables:0 bounce:0 [ 1088.446101][T13825] kernel_misc_reclaimable:0 [ 1088.446101][T13825] free:1272408 free_pcp:23297 free_cma:0 [ 1088.667384][T13825] Node 0 active_anon:36824kB inactive_anon:60kB active_file:9788kB inactive_file:163692kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:122252kB dirty:1432kB writeback:0kB shmem:15596kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:16036kB pagetables:5744kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 1088.669031][T13823] tipc: Resetting bearer [ 1088.705921][T13825] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:64kB pagetables:128kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 1088.747044][T13825] Node 0 DMA free:15212kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:148kB local_pcp:80kB free_cma:0kB [ 1088.823964][T13825] lowmem_reserve[]: 0 2492 2493 2493 2493 [ 1088.829850][T13825] Node 0 DMA32 free:1179400kB boost:0kB min:34188kB low:42732kB high:51276kB reserved_highatomic:0KB free_highatomic:0KB active_anon:41688kB inactive_anon:60kB active_file:9788kB inactive_file:163692kB unevictable:1536kB writepending:1400kB zspages:0kB present:3129332kB managed:2552544kB mlocked:0kB bounce:0kB free_pcp:32532kB local_pcp:17896kB free_cma:0kB [ 1088.866549][T13823] tipc: Disabling bearer [ 1088.872360][T13825] lowmem_reserve[]: 0 0 0 0 0 [ 1088.877284][T13825] Node 0 Normal free:8kB boost:0kB min:8kB low:8kB high:8kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:672kB mlocked:0kB bounce:0kB free_pcp:20kB local_pcp:8kB free_cma:0kB [ 1088.907074][T13825] lowmem_reserve[]: 0 0 0 0 0 [ 1088.911844][T13825] Node 1 Normal free:3886856kB boost:0kB min:55704kB low:69628kB high:83552kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:1536kB writepending:0kB zspages:0kB present:4194300kB managed:4111100kB mlocked:0kB bounce:0kB free_pcp:56028kB local_pcp:27352kB free_cma:0kB [ 1088.954672][T13825] lowmem_reserve[]: 0 0 0 0 0 [ 1088.959473][T13825] Node 0 DMA: 1*4kB (U) 1*8kB (U) 2*16kB (U) 2*32kB (U) 2*64kB (U) 3*128kB (U) 3*256kB (U) 3*512kB (U) 4*1024kB (U) 2*2048kB (UM) 1*4096kB (U) = 15212kB [ 1088.977025][T13825] Node 0 DMA32: 4734*4kB (U) 4756*8kB (U) 3750*16kB (UM) 830*32kB (UM) 204*64kB (UME) 810*128kB (UM) 780*256kB (UME) 469*512kB (UME) 272*1024kB (UM) 98*2048kB (UM) 0*4096kB = 1179320kB [ 1089.001325][T13825] Node 0 Normal: 2*4kB (U) 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 8kB [ 1089.033886][T13825] Node 1 Normal: 8*4kB (UM) 11*8kB (UM) 19*16kB (UM) 9*32kB (UM) 17*64kB (UM) 10*128kB (UM) 13*256kB (UM) 9*512kB (UM) 9*1024kB (UM) 8*2048kB (U) 940*4096kB (UM) = 3886856kB [ 1089.078276][T13825] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 1089.098972][T13825] Node 0 hugepages_total=6 hugepages_free=0 hugepages_surp=4 hugepages_size=2048kB [ 1089.122118][T13825] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 1089.148436][T13841] netlink: 75 bytes leftover after parsing attributes in process `syz.1.17037'. [ 1089.157715][T13825] Node 1 hugepages_total=2 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB [ 1089.167395][T13825] 47892 total pagecache pages [ 1089.183497][T13825] 0 pages in swap cache [ 1089.195700][T13825] Free swap = 124996kB [ 1089.200059][T13825] Total swap = 124996kB [ 1089.214827][T13825] 2097051 pages RAM [ 1089.220214][T13843] IPv6: Can't replace route, no match found [ 1089.227236][T13843] IPv6: Can't replace route, no match found [ 1089.233417][T13825] 0 pages HighMem/MovableOnly [ 1089.239960][T13825] 427132 pages reserved [ 1089.244395][T13825] 0 pages cma reserved [ 1089.358111][T13841] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1089.379484][T13841] 8021q: adding VLAN 0 to HW filter on device team0 [ 1089.400961][T13851] netlink: 8 bytes leftover after parsing attributes in process `syz.2.17040'. [ 1089.415354][T13841] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1089.427042][T13851] netlink: 60 bytes leftover after parsing attributes in process `syz.2.17040'. [ 1089.480349][T13841] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 1089.491376][T13841] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 1089.507506][T13841] veth1_vlan: left promiscuous mode [ 1089.514655][T13841] veth0_vlan: left promiscuous mode [ 1089.521803][T13841] veth0_vlan: entered promiscuous mode [ 1089.552075][T13841] veth1_vlan: entered promiscuous mode [ 1089.583090][T13841] veth1_macvtap: left promiscuous mode [ 1089.596147][T13841] veth0_macvtap: left promiscuous mode [ 1089.606357][T13841] veth0_macvtap: entered promiscuous mode [ 1089.628858][T13841] veth1_macvtap: entered promiscuous mode [ 1089.642749][T13841] A link change request failed with some changes committed already. Interface wlan0 may have been left with an inconsistent configuration, please check. [ 1089.752827][ T853] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1089.766106][ T853] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1089.789347][ T853] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1089.849714][ T853] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1090.048561][T13869] netlink: 'syz.1.17045': attribute type 13 has an invalid length. [ 1090.071388][T13871] syzkaller0: entered promiscuous mode [ 1090.090086][T13871] syzkaller0: entered allmulticast mode [ 1090.254531][T13881] netlink: 'syz.1.17045': attribute type 2 has an invalid length. [ 1090.296860][T13881] netlink: 14 bytes leftover after parsing attributes in process `syz.1.17045'. [ 1090.480741][T13875] netlink: 4 bytes leftover after parsing attributes in process `syz.1.17045'. [ 1091.386479][T13921] netlink: 4 bytes leftover after parsing attributes in process `syz.4.17051'. [ 1091.461962][T13928] xt_cgroup: invalid path, errno=-2 [ 1091.618322][T13914] vlan6: entered promiscuous mode [ 1091.623531][T13914] hsr0: entered promiscuous mode [ 1091.628741][T13914] vlan6: entered allmulticast mode [ 1091.656266][T13914] hsr0: entered allmulticast mode [ 1091.671004][T13914] hsr_slave_0: entered allmulticast mode [ 1091.678836][T13914] hsr_slave_1: entered allmulticast mode [ 1091.726833][T13921] hsr_slave_0: left promiscuous mode [ 1091.735435][T13921] hsr_slave_1: left promiscuous mode [ 1091.764324][T13919] syzkaller0: entered promiscuous mode [ 1091.770113][T13919] syzkaller0: entered allmulticast mode [ 1091.785337][T13909] tipc: Enabled bearer , priority 0 [ 1091.800486][T13908] tipc: Resetting bearer [ 1091.830029][T13908] tipc: Disabling bearer [ 1091.939450][T13939] : renamed from bond0 [ 1091.972216][T13939] netlink: 4 bytes leftover after parsing attributes in process `syz.4.17055'. [ 1092.058574][T13945] netlink: 4 bytes leftover after parsing attributes in process `syz.4.17055'. [ 1092.068940][T13939] team3: entered promiscuous mode [ 1092.075883][T13939] team3: entered allmulticast mode [ 1092.084770][T13939] 8021q: adding VLAN 0 to HW filter on device team3 [ 1092.093717][T13944] netlink: 204 bytes leftover after parsing attributes in process `syz.1.17057'. [ 1092.105156][T13944] netlink: 'syz.1.17057': attribute type 1 has an invalid length. [ 1092.113074][T13944] netlink: 96 bytes leftover after parsing attributes in process `syz.1.17057'. [ 1092.134230][T13945] team4 (uninitialized): Failed to send options change via netlink (err -105) [ 1092.179255][T13945] team4: entered promiscuous mode [ 1092.184680][T13945] team4: entered allmulticast mode [ 1092.195953][T13945] 8021q: adding VLAN 0 to HW filter on device team4 [ 1092.253145][T13941] virt_wifi0 speed is unknown, defaulting to 1000 [ 1092.785725][T13948] syzkaller1: entered promiscuous mode [ 1092.805814][T13948] syzkaller1: entered allmulticast mode [ 1093.350180][T13980] netlink: 'syz.1.17066': attribute type 1 has an invalid length. [ 1093.636851][ T29] audit: type=1804 audit(1781104547.392:22): pid=13985 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.0.17068" name="/newroot/3438/cgroup.controllers" dev="tmpfs" ino=17346 res=1 errno=0 [ 1093.708079][ T29] audit: type=1800 audit(1781104547.392:23): pid=13985 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.17068" name="cgroup.controllers" dev="tmpfs" ino=17346 res=0 errno=0 [ 1093.814205][T13988] tipc: Enabled bearer , priority 0 [ 1093.838211][T13988] syzkaller0: entered promiscuous mode [ 1093.849682][T13988] syzkaller0: entered allmulticast mode [ 1093.935948][T13988] tipc: Resetting bearer [ 1093.957707][T13986] tipc: Resetting bearer [ 1093.981767][T13986] tipc: Disabling bearer [ 1093.994533][T13993] syzkaller1: entered promiscuous mode [ 1094.000139][T13993] syzkaller1: entered allmulticast mode [ 1094.011147][T13995] syzkaller0: entered promiscuous mode [ 1094.018874][T13995] syzkaller0: entered allmulticast mode [ 1094.566020][T14021] netlink: 'syz.3.17079': attribute type 13 has an invalid length. [ 1094.590922][T14010] tipc: Resetting bearer [ 1094.621135][T14024] IPVS: ip_vs_add_dest(): lower threshold is higher than upper threshold [ 1094.662766][T14010] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1094.893714][ T853] netdevsim netdevsim0 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1094.928379][ T853] netdevsim netdevsim0 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1094.949122][ T853] netdevsim netdevsim0 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1094.958553][ T853] netdevsim netdevsim0 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1095.026610][ T29] audit: type=1804 audit(1781104548.782:24): pid=14039 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.2.17082" name="/newroot/3435/cgroup.controllers" dev="tmpfs" ino=17353 res=1 errno=0 [ 1095.099935][ T29] audit: type=1800 audit(1781104548.782:25): pid=14039 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.17082" name="cgroup.controllers" dev="tmpfs" ino=17353 res=0 errno=0 [ 1095.180856][T14043] __nla_validate_parse: 6 callbacks suppressed [ 1095.180875][T14043] netlink: 28 bytes leftover after parsing attributes in process `syz.3.17083'. [ 1095.201888][T14043] netlink: 'syz.3.17083': attribute type 7 has an invalid length. [ 1095.213528][T14043] netlink: 'syz.3.17083': attribute type 8 has an invalid length. [ 1095.242757][T14043] netlink: 4 bytes leftover after parsing attributes in process `syz.3.17083'. [ 1095.615183][T14054] syzkaller0: entered promiscuous mode [ 1095.624695][T14054] syzkaller0: entered allmulticast mode [ 1095.652763][T14054] tipc: Enabled bearer , priority 0 [ 1095.746547][T14053] tipc: Resetting bearer [ 1095.767943][T14053] tipc: Disabling bearer [ 1095.857720][T14060] syzkaller1: entered promiscuous mode [ 1095.872624][T14060] syzkaller1: entered allmulticast mode [ 1095.978817][T14062] team0: left promiscuous mode [ 1095.985853][T14062] team0: left allmulticast mode [ 1096.353224][T14078] netlink: 'syz.3.17095': attribute type 1 has an invalid length. [ 1096.370378][T14062] bridge1: left promiscuous mode [ 1096.376347][T14062] geneve2: left promiscuous mode [ 1096.381626][T14062] gre1: left allmulticast mode [ 1096.387127][T14062] ip6erspan0: left allmulticast mode [ 1096.392885][T14062] bond3: left promiscuous mode [ 1096.401365][T14062] ip6erspan1: left allmulticast mode [ 1096.415167][T14062] ip6gre3: left promiscuous mode [ 1096.420145][T14062] ip6gre3: left allmulticast mode [ 1096.425692][T14062] geneve4: left promiscuous mode [ 1096.430651][T14062] geneve4: left allmulticast mode [ 1096.437881][T14062] bond6: left allmulticast mode [ 1096.443894][T14062] bond8: left allmulticast mode [ 1096.449370][T14062] bond12: left promiscuous mode [ 1096.454607][T14062] bridge17: left promiscuous mode [ 1096.460082][T14062] macvtap1: left allmulticast mode [ 1096.468749][T14062] macvtap2: left allmulticast mode [ 1096.474327][T14082] netlink: 12 bytes leftover after parsing attributes in process `syz.2.17093'. [ 1096.474428][T14082] netlink: 60 bytes leftover after parsing attributes in process `syz.2.17093'. [ 1096.496529][T14062] veth33: left promiscuous mode [ 1096.667828][T14078] 8021q: adding VLAN 0 to HW filter on device bond23 [ 1096.678430][ T12] netdevsim netdevsim1 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1096.693613][T14080] netlink: 105 bytes leftover after parsing attributes in process `syz.2.17093'. [ 1096.706798][T14081] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1096.717640][T14081] bond23: (slave batadv0): Enslaving as a backup interface with an up link [ 1096.732613][ T12] netdevsim netdevsim1 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1096.743605][ T12] netdevsim netdevsim1 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1096.762297][ T3306] netdevsim netdevsim1 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1096.784939][T12368] bond23: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 1096.973439][ T5895] bond23: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 1097.250984][T14109] tipc: Failed to remove unknown binding: 66,0,0/769:509514549/509514551 [ 1097.275690][T14109] tipc: Failed to remove unknown binding: 66,0,0/769:509514549/509514550 [ 1097.542970][T14120] mac80211_hwsim hwsim6 syzkaller0: Caught tx_queue_len zero misconfig [ 1098.049709][T14130] netlink: 'syz.0.17111': attribute type 1 has an invalid length. [ 1098.111829][T14130] bond17: (slave geneve6): making interface the new active one [ 1098.144141][T14130] bond17: (slave geneve6): Enslaving as an active interface with an up link [ 1098.158706][T14132] netlink: 28 bytes leftover after parsing attributes in process `syz.0.17111'. [ 1098.173882][ T12] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 20000 - 0 [ 1098.188095][T14132] 8021q: adding VLAN 0 to HW filter on device bond17 [ 1098.202607][ T12] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 20000 - 0 [ 1098.213603][ T12] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 20000 - 0 [ 1098.222281][ T12] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 20000 - 0 [ 1098.255611][T14130] tipc: Resetting bearer [ 1098.403569][T16029] virt_wifi0 speed is unknown, defaulting to 1000 [ 1099.094070][T14155] netlink: 8 bytes leftover after parsing attributes in process `syz.0.17117'. [ 1099.616708][T14169] netlink: 4 bytes leftover after parsing attributes in process `syz.0.17123'. [ 1099.690136][T14169] bond6: (slave syz_tun): Removing an active aggregator [ 1099.729004][T14169] bond6: (slave syz_tun): Releasing backup interface [ 1099.812154][T14173] netlink: 'syz.4.17124': attribute type 1 has an invalid length. [ 1100.312383][T14189] team0: No ports can be present during mode change [ 1100.445347][T14196] netlink: 8 bytes leftover after parsing attributes in process `syz.4.17130'. [ 1100.578679][T14202] netlink: 12 bytes leftover after parsing attributes in process `syz.2.17133'. [ 1100.818805][T14213] SET target dimension over the limit! [ 1100.830919][T14213] netlink: 8 bytes leftover after parsing attributes in process `syz.3.17136'. [ 1100.889690][T14215] IPVS: set_ctl: invalid protocol: 47 255.255.255.255:20001 [ 1101.398837][T14228] netlink: 12 bytes leftover after parsing attributes in process `syz.1.17142'. [ 1101.537419][T14239] netlink: 'syz.2.17144': attribute type 1 has an invalid length. [ 1101.597996][T14239] 8021q: adding VLAN 0 to HW filter on device bond20 [ 1101.732851][T14246] netlink: 8 bytes leftover after parsing attributes in process `syz.1.17147'. [ 1101.753666][T14246] netlink: 8 bytes leftover after parsing attributes in process `syz.1.17147'. [ 1101.961630][ T29] audit: type=1804 audit(1781104555.712:26): pid=14259 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.4.17150" name="/newroot/3427/cgroup.controllers" dev="tmpfs" ino=17285 res=1 errno=0 [ 1101.994635][T14261] netlink: 8 bytes leftover after parsing attributes in process `syz.2.17148'. [ 1102.019674][ T29] audit: type=1800 audit(1781104555.742:27): pid=14259 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.17150" name="cgroup.controllers" dev="tmpfs" ino=17285 res=0 errno=0 [ 1102.342495][T14272] netlink: 28 bytes leftover after parsing attributes in process `syz.2.17154'. [ 1102.385234][T14269] netlink: 32 bytes leftover after parsing attributes in process `syz.4.17152'. [ 1102.914970][T14299] lo: Caught tx_queue_len zero misconfig [ 1102.931006][T14301] netlink: 4 bytes leftover after parsing attributes in process `syz.0.17160'. [ 1102.946192][T14299] tipc: Failed to remove unknown binding: 66,0,0/20185096:2333801386/2333801388 [ 1102.953411][T14301] openvswitch: netlink: IPv4 frag type 127 is out of range max 2 [ 1102.973505][T14299] tipc: Failed to remove unknown binding: 66,0,0/20185096:2333801386/2333801387 [ 1102.988000][T14299] tipc: Failed to remove unknown binding: 66,0,0/20185096:2333801386/2333801388 [ 1103.014328][T14299] tipc: Failed to remove unknown binding: 66,0,0/20185096:2333801386/2333801387 [ 1103.982605][ T3306] smbdirect: ib_dev[syz2] removed [ 1104.247845][T14337] netlink: 'syz.0.17172': attribute type 1 has an invalid length. [ 1104.349393][T14337] 8021q: adding VLAN 0 to HW filter on device bond18 [ 1104.499459][T14341] bond18: (slave veth17): Enslaving as an active interface with a down link [ 1104.511023][T14337] bond18: entered allmulticast mode [ 1104.550421][T14345] 8021q: adding VLAN 0 to HW filter on device team0 [ 1104.579272][T14345] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1104.611211][T14352] tipc: Enabled bearer , priority 0 [ 1104.627124][T14352] syzkaller0: entered promiscuous mode [ 1104.642821][T14352] syzkaller0: entered allmulticast mode [ 1104.758870][T14352] tipc: Resetting bearer [ 1104.787284][T14350] tipc: Resetting bearer [ 1104.826938][T14350] tipc: Disabling bearer [ 1104.944778][T14366] pim6reg: entered allmulticast mode [ 1105.390778][T14381] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 1105.474350][T14389] netlink: 'syz.2.17182': attribute type 10 has an invalid length. [ 1105.478207][T14390] netlink: 'syz.1.17185': attribute type 1 has an invalid length. [ 1105.579795][T14390] 8021q: adding VLAN 0 to HW filter on device bond16 [ 1105.629062][T14393] bond16: entered allmulticast mode [ 1105.643519][T14400] __nla_validate_parse: 8 callbacks suppressed [ 1105.643536][T14400] netlink: 14 bytes leftover after parsing attributes in process `syz.0.17184'. [ 1105.848954][T14405] tipc: Failed to remove unknown binding: 66,0,0/769:1250586067/1250586069 [ 1105.875230][T14405] tipc: Failed to remove unknown binding: 66,0,0/769:1250586067/1250586068 [ 1106.019662][T14418] tipc: Failed to remove unknown binding: 66,0,0/769:1250586067/1250586069 [ 1106.023994][T14417] netlink: 12 bytes leftover after parsing attributes in process `syz.2.17191'. [ 1106.038355][T14411] hsr0: entered promiscuous mode [ 1106.067819][T14417] 8021q: adding VLAN 0 to HW filter on device bond21 [ 1106.073307][T14418] tipc: Failed to remove unknown binding: 66,0,0/769:1250586067/1250586068 [ 1106.098281][T14411] netlink: 44 bytes leftover after parsing attributes in process `syz.0.17189'. [ 1106.188525][T14417] bond21: (slave veth25): Enslaving as an active interface with an up link [ 1106.216816][T14411] hsr_slave_0: left promiscuous mode [ 1106.228274][T14411] hsr_slave_1: left promiscuous mode [ 1106.251333][T14411] hsr0 (unregistering): left promiscuous mode [ 1106.325134][T14420] netlink: 200 bytes leftover after parsing attributes in process `syz.2.17191'. [ 1106.402992][T14425] pim6reg0: tun_chr_ioctl cmd 35111 [ 1106.411378][T14420] netlink: 20 bytes leftover after parsing attributes in process `syz.2.17191'. [ 1106.511463][T14420] bond21: (slave bridge16): Enslaving as an active interface with an up link [ 1106.519387][T14435] netlink: 4 bytes leftover after parsing attributes in process `syz.4.17195'. [ 1106.564295][T14433] bond5: (slave 26aD): Releasing backup interface [ 1106.577107][T14438] netlink: 4 bytes leftover after parsing attributes in process `syz.4.17195'. [ 1106.598795][T14433] bond5: (slave 26aD): last VLAN challenged slave left bond - VLAN blocking is removed [ 1106.623162][T14433] team0: Port device team_slave_1 removed [ 1106.640671][T14433] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1106.656317][T14433] team0: Port device geneve1 removed [ 1106.682334][T14433] team0: Port device bridge4 removed [ 1106.694523][T14433] batman_adv: batadv0: Removing interface: macvtap1 [ 1106.708853][T14433] bond7: (slave ipip0): Releasing backup interface [ 1106.718124][T14433] ipip0: left promiscuous mode [ 1106.725156][T14433] ipip0: left allmulticast mode [ 1106.732693][T14433] bond8: (slave veth5): Releasing active interface [ 1106.740090][T14433] bond8: (slave veth5): the permanent HWaddr of slave - 92:6e:9d:61:83:93 - is still in use by bond - set the HWaddr of slave to a different address to avoid conflicts [ 1106.757322][T14433] batadv1: entered promiscuous mode [ 1106.765815][T14433] bond8: (slave batadv1): Releasing active interface [ 1106.772643][T14433] batadv1: left promiscuous mode [ 1106.781760][T14433] bond9: (slave veth7): Releasing active interface [ 1106.791312][T14433] bond11: (slave bond12): Releasing backup interface [ 1106.799110][T14433] bond11: (slave bond12): the permanent HWaddr of slave - 2e:08:30:03:2b:ec - is still in use by bond - set the HWaddr of slave to a different address to avoid conflicts [ 1106.821836][T14433] bond11: (slave gretap4): Releasing backup interface [ 1106.832775][T14433] bond14: (slave veth15): Releasing active interface [ 1106.842584][T14433] bond16: (slave geneve5): Releasing active interface [ 1106.856545][T14433] bond17: (slave geneve6): Releasing active interface [ 1106.871094][T14433] bond18: (slave veth17): Releasing active interface [ 1106.919195][T14435] team5: entered promiscuous mode [ 1106.933456][T14435] team5: entered allmulticast mode [ 1106.943787][T14435] 8021q: adding VLAN 0 to HW filter on device team5 [ 1106.961986][T14438] team6 (uninitialized): Failed to send options change via netlink (err -105) [ 1106.990605][T14438] team6: entered promiscuous mode [ 1106.995900][T14438] team6: entered allmulticast mode [ 1107.001519][T14438] 8021q: adding VLAN 0 to HW filter on device team6 [ 1107.024102][T14439] veth1_to_team: Caught tx_queue_len zero misconfig [ 1107.046305][ T3306] netdevsim netdevsim0 eth0: unset [1, 0] type 2 family 0 port 20000 - 0 [ 1107.057293][ T3306] netdevsim netdevsim0 eth1: unset [1, 0] type 2 family 0 port 20000 - 0 [ 1107.073820][ T3306] netdevsim netdevsim0 eth2: unset [1, 0] type 2 family 0 port 20000 - 0 [ 1107.082985][ T3306] netdevsim netdevsim0 eth3: unset [1, 0] type 2 family 0 port 20000 - 0 [ 1107.150858][T14448] netlink: 'syz.4.17199': attribute type 1 has an invalid length. [ 1107.197085][T14448] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1107.219240][T14448] bond0: entered allmulticast mode [ 1107.685146][ T29] audit: type=1804 audit(1781104561.442:28): pid=14471 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.1.17206" name="/newroot/3404/cgroup.controllers" dev="tmpfs" ino=17161 res=1 errno=0 [ 1107.712844][T14469] netlink: 75 bytes leftover after parsing attributes in process `syz.3.17204'. [ 1107.730903][ T29] audit: type=1800 audit(1781104561.472:29): pid=14471 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.17206" name="cgroup.controllers" dev="tmpfs" ino=17161 res=0 errno=0 [ 1107.777936][T14473] IPv6: Can't replace route, no match found [ 1107.808767][T14473] IPv6: Can't replace route, no match found [ 1107.861481][T14469] 8021q: adding VLAN 0 to HW filter on device team0 [ 1107.903533][ T5895] bond23: (slave batadv0): link status up again after 0 ms [ 1107.948365][T14469] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1107.963559][ T5895] bond23: (slave batadv0): link status up again after 0 ms [ 1107.976207][T14469] 0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 1108.003663][ T5895] bond23: (slave batadv0): link status up again after 0 ms [ 1108.017819][T14469] A link change request failed with some changes committed already. Interface virt_wifi0 may have been left with an inconsistent configuration, please check. [ 1108.039564][ T853] bridge0: port 1(bridge_slave_0) entered blocking state [ 1108.046817][ T853] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1108.055193][ T5896] bond23: (slave batadv0): link status up again after 0 ms [ 1108.083038][ T853] bridge0: port 2(bridge_slave_1) entered blocking state [ 1108.090296][ T853] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1108.099169][ T5896] bond23: (slave batadv0): link status up again after 0 ms [ 1108.123499][ T5896] bond23: (slave batadv0): link status up again after 0 ms [ 1108.156081][T12368] bond23: (slave batadv0): link status up again after 0 ms [ 1108.177885][ T853] bridge0: port 3(team0) entered blocking state [ 1108.183431][ T5896] bond23: (slave batadv0): link status up again after 0 ms [ 1108.184269][ T853] bridge0: port 3(team0) entered forwarding state [ 1108.213791][ T5896] bond23: (slave batadv0): link status up again after 0 ms [ 1108.234083][ T5896] bond23: (slave batadv0): link status up again after 0 ms [ 1108.255025][T14482] netlink: 'syz.0.17209': attribute type 3 has an invalid length. [ 1108.382959][T14481] 8021q: adding VLAN 0 to HW filter on device macvlan3 [ 1108.459886][T14490] 8021q: adding VLAN 0 to HW filter on device macvlan4 [ 1108.873190][T14505] bond10: (slave lo): Releasing backup interface [ 1108.901875][T14505] bond10: (slave lo): last VLAN challenged slave left bond - VLAN blocking is removed [ 1108.960934][T14505] team0: Port device team_slave_0 removed [ 1108.984415][T14505] team0: Port device team_slave_1 removed [ 1109.001624][T14505] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1109.001974][T14513] netlink: 'syz.1.17215': attribute type 13 has an invalid length. [ 1109.021877][T14505] bond12: (slave gretap1): Releasing active interface [ 1109.031568][T14513] netlink: 'syz.1.17215': attribute type 17 has an invalid length. [ 1109.032087][T14505] bond13: (slave gretap2): Releasing active interface [ 1109.051559][T14505] bond14: (slave bridge7): Releasing backup interface [ 1109.062160][T14505] bond16: (slave veth5): Releasing active interface [ 1109.074550][T14505] bond17: (slave veth7): Releasing backup interface [ 1109.081484][T14505] bond17: (slave veth7): the permanent HWaddr of slave - 92:0e:53:ab:2a:f8 - is still in use by bond - set the HWaddr of slave to a different address to avoid conflicts [ 1109.102035][T14505] bond17: (slave batadv2): Releasing backup interface [ 1109.125353][T14505] bond18: (slave veth9): Releasing active interface [ 1109.137496][T14505] bond18: (slave veth9): the permanent HWaddr of slave - 3e:9c:83:a9:7a:16 - is still in use by bond - set the HWaddr of slave to a different address to avoid conflicts [ 1109.160641][T14505] bond18: (slave veth11): Releasing active interface [ 1109.205095][T14505] bond19: (slave bridge11): Releasing backup interface [ 1109.225901][T14505] bond20: (slave bridge12): Releasing backup interface [ 1109.238085][T14505] bond21: (slave bond22): Releasing backup interface [ 1109.245677][T14505] bond21: (slave bond22): the permanent HWaddr of slave - 96:2b:62:e2:dd:c0 - is still in use by bond - set the HWaddr of slave to a different address to avoid conflicts [ 1109.264922][T14505] bond21: (slave gretap3): making interface the new active one [ 1109.307133][T14505] bond21: (slave gretap3): Releasing backup interface [ 1109.317077][T14505] bond23: (slave veth13): Releasing active interface [ 1109.410096][T14513] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1109.421646][T14513] 8021q: adding VLAN 0 to HW filter on device team0 [ 1109.432892][T14513] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1109.481206][T14513] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 1109.492506][T14513] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 1109.505884][T14513] veth1_vlan: left promiscuous mode [ 1109.512688][T14513] veth0_vlan: left promiscuous mode [ 1109.519051][T14513] veth0_vlan: entered promiscuous mode [ 1109.528836][T14513] veth1_vlan: entered promiscuous mode [ 1109.538869][T14513] veth1_macvtap: left promiscuous mode [ 1109.547291][T14513] veth0_macvtap: left promiscuous mode [ 1109.554227][T14513] veth0_macvtap: entered promiscuous mode [ 1109.568027][T14513] veth1_macvtap: entered promiscuous mode [ 1109.670501][ T5896] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1109.705015][ T29] audit: type=1804 audit(1781104563.452:30): pid=14529 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.0.17218" name="/newroot/3470/cgroup.controllers" dev="tmpfs" ino=17513 res=1 errno=0 [ 1109.748937][ T5896] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1109.758495][ T29] audit: type=1800 audit(1781104563.452:31): pid=14529 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.17218" name="cgroup.controllers" dev="tmpfs" ino=17513 res=0 errno=0 [ 1109.767068][ T5896] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1109.800055][ T5896] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1110.186809][T14550] netlink: 'syz.3.17222': attribute type 16 has an invalid length. [ 1110.195243][T14550] netlink: 'syz.3.17222': attribute type 17 has an invalid length. [ 1110.266365][ T29] audit: type=1804 audit(1781104564.022:32): pid=14556 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.1.17224" name="/newroot/3408/cgroup.controllers" dev="tmpfs" ino=17184 res=1 errno=0 [ 1110.294976][ T29] audit: type=1800 audit(1781104564.022:33): pid=14556 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.17224" name="cgroup.controllers" dev="tmpfs" ino=17184 res=0 errno=0 [ 1110.705634][ T29] audit: type=1804 audit(1781104564.452:34): pid=14559 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.2.17226" name="/newroot/3464/cgroup.controllers" dev="tmpfs" ino=17507 res=1 errno=0 [ 1110.791186][ T29] audit: type=1800 audit(1781104564.462:35): pid=14559 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.17226" name="cgroup.controllers" dev="tmpfs" ino=17507 res=0 errno=0 [ 1111.319255][T14578] team0: left allmulticast mode [ 1111.338564][T14578] team_slave_0: left allmulticast mode [ 1111.377743][T14578] team_slave_1: left allmulticast mode [ 1111.406034][T14578] batadv2: left allmulticast mode [ 1111.412000][T14584] netlink: 12 bytes leftover after parsing attributes in process `syz.1.17233'. [ 1111.424448][T14578] netdevsim netdevsim3 netdevsim1: left allmulticast mode [ 1111.432253][T14578] team0: left promiscuous mode [ 1111.438437][T14578] team_slave_0: left promiscuous mode [ 1111.445508][T14578] team_slave_1: left promiscuous mode [ 1111.451164][T14578] batadv2: left promiscuous mode [ 1111.456981][T14578] netdevsim netdevsim3 netdevsim1: left promiscuous mode [ 1111.465687][T14578] bridge0: port 3(team0) entered disabled state [ 1111.483787][T14578] bond23: (slave batadv0): Removing an active aggregator [ 1111.504448][T14578] bond23: (slave batadv0): Releasing backup interface [ 1111.544183][T14578] bridge_slave_0: left allmulticast mode [ 1111.562444][T14578] bridge_slave_0: left promiscuous mode [ 1111.577016][T14578] bridge0: port 1(bridge_slave_0) entered disabled state [ 1111.625545][T14578] bridge_slave_1: left allmulticast mode [ 1111.643740][T14578] bridge_slave_1: left promiscuous mode [ 1111.662116][T14578] bridge0: port 2(bridge_slave_1) entered disabled state [ 1111.684286][T14578] bond0: (slave bond_slave_0): Releasing backup interface [ 1111.716855][T14595] netlink: 44 bytes leftover after parsing attributes in process `syz.1.17233'. [ 1111.732120][T14578] bond0: (slave bond_slave_1): Releasing backup interface [ 1111.823886][T14578] team0: Port device team_slave_0 removed [ 1111.850826][T14578] team0: Port device team_slave_1 removed [ 1111.864445][T14578] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1111.887216][T14578] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1111.992427][T14584] 8021q: adding VLAN 0 to HW filter on device bond17 [ 1112.100040][T14590] bond17: (slave veth39): Enslaving as an active interface with an up link [ 1112.172540][T14594] netlink: 200 bytes leftover after parsing attributes in process `syz.1.17233'. [ 1112.325821][T14600] netlink: 8 bytes leftover after parsing attributes in process `syz.3.17235'. [ 1112.598800][T14610] netlink: 'syz.1.17239': attribute type 1 has an invalid length. [ 1112.947223][T14622] netlink: 'syz.3.17242': attribute type 3 has an invalid length. [ 1112.992481][T14610] bond18: (slave gretap2): making interface the new active one [ 1113.002215][T14610] bond18: (slave gretap2): Enslaving as an active interface with an up link [ 1113.019476][T14616] macvlan5: entered promiscuous mode [ 1113.025058][T14616] macvlan5: entered allmulticast mode [ 1113.033196][T14616] bond18: entered promiscuous mode [ 1113.038870][T14616] gretap2: entered promiscuous mode [ 1113.055722][T14616] 8021q: adding VLAN 0 to HW filter on device macvlan5 [ 1113.064673][T14616] bond18: (slave macvlan5): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 1113.081325][T14616] bond18: left promiscuous mode [ 1113.086481][T14616] gretap2: left promiscuous mode [ 1113.101435][T14628] team0: Mode changed to "broadcast" [ 1113.109071][T14618] syzkaller1: entered promiscuous mode [ 1113.116153][T14618] syzkaller1: entered allmulticast mode [ 1113.273012][T14622] block nbd3: NBD_DISCONNECT [ 1113.397287][T14640] netlink: 4 bytes leftover after parsing attributes in process `syz.4.17245'. [ 1113.801803][T14662] netlink: 24 bytes leftover after parsing attributes in process `syz.4.17251'. [ 1114.148789][ T846] netdevsim netdevsim1 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1114.174922][ T846] netdevsim netdevsim1 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1114.200512][ T846] netdevsim netdevsim1 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1114.219561][ T846] netdevsim netdevsim1 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1114.280833][T14668] netlink: 8 bytes leftover after parsing attributes in process `syz.0.17252'. [ 1114.327892][T14672] netlink: 8 bytes leftover after parsing attributes in process `syz.4.17253'. [ 1114.377414][T14672] netlink: 4 bytes leftover after parsing attributes in process `syz.4.17253'. [ 1114.579265][T14678] bond0: option active_slave: mode dependency failed, not supported in mode balance-rr(0) [ 1115.323144][T14688] netlink: 4 bytes leftover after parsing attributes in process `syz.3.17256'. [ 1115.589018][T14703] netlink: 'syz.2.17260': attribute type 13 has an invalid length. [ 1115.685788][ T29] audit: type=1804 audit(1781104569.442:36): pid=14711 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.0.17262" name="/newroot/3477/cgroup.controllers" dev="tmpfs" ino=17551 res=1 errno=0 [ 1115.750195][ T29] audit: type=1800 audit(1781104569.442:37): pid=14711 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.17262" name="cgroup.controllers" dev="tmpfs" ino=17551 res=0 errno=0 [ 1116.224707][T14719] 8021q: adding VLAN 0 to HW filter on device team0 [ 1116.261503][T14719] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1116.417741][T14719] veth1_vlan: left promiscuous mode [ 1116.436305][T14719] veth0_vlan: entered promiscuous mode [ 1116.462735][T14719] veth1_vlan: entered promiscuous mode [ 1116.498000][T14719] net_ratelimit: 30 callbacks suppressed [ 1116.498019][T14719] A link change request failed with some changes committed already. Interface may have been left with an inconsistent configuration, please check. [ 1116.608775][ T5896] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1116.634351][ T5896] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1116.667005][ T853] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1116.690806][ T853] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1116.920889][T14758] tipc: New replicast peer: 255.255.255.255 [ 1116.957959][T14758] tipc: Enabled bearer , priority 10 [ 1116.991726][T14763] __nla_validate_parse: 1 callbacks suppressed [ 1116.991746][T14763] netlink: 12 bytes leftover after parsing attributes in process `syz.0.17269'. [ 1117.058549][T14758] netlink: 'syz.0.17269': attribute type 1 has an invalid length. [ 1117.183471][T14758] bond19: entered promiscuous mode [ 1117.189942][T14758] 8021q: adding VLAN 0 to HW filter on device bond19 [ 1117.321265][T14758] bond19: (slave bridge6): making interface the new active one [ 1117.335341][T14758] bridge6: entered promiscuous mode [ 1117.351223][T14758] bond19: (slave bridge6): Enslaving as an active interface with an up link [ 1117.361631][T14773] netlink: 12 bytes leftover after parsing attributes in process `syz.2.17274'. [ 1117.383178][T14773] veth1_to_batadv: entered allmulticast mode [ 1117.439891][T14773] IPVS: stopping master sync thread 23032 ... [ 1117.770046][T14777] smbdirect: ib_dev[uyz0] renamed to [syz2] [ 1117.823503][T14792] netlink: zone id is out of range [ 1117.839761][T14792] netlink: zone id is out of range [ 1117.854686][T14792] netlink: zone id is out of range [ 1117.869459][T14792] netlink: zone id is out of range [ 1117.890127][T14792] netlink: zone id is out of range [ 1117.928449][T14792] netlink: zone id is out of range [ 1118.010706][T14792] netlink: zone id is out of range [ 1118.041041][T14792] netlink: zone id is out of range [ 1118.074701][T14792] netlink: zone id is out of range [ 1118.736079][T14807] bond23: left allmulticast mode [ 1118.745647][T14807] team3: left promiscuous mode [ 1118.754502][T14807] team3: left allmulticast mode [ 1118.765290][T14807] team4: left promiscuous mode [ 1118.772235][T14807] team4: left allmulticast mode [ 1118.784944][T14807] team5: left promiscuous mode [ 1118.789811][T14807] team5: left allmulticast mode [ 1118.799830][T14807] team6: left promiscuous mode [ 1118.809349][T14807] team6: left allmulticast mode [ 1118.817728][T14807] bond0: left allmulticast mode [ 1118.890797][T14812] bond20 (unregistering): Released all slaves [ 1119.065207][T14828] netlink: 76 bytes leftover after parsing attributes in process `syz.1.17285'. [ 1119.187964][T14847] netlink: 'syz.3.17289': attribute type 10 has an invalid length. [ 1119.297476][T14847] team0 (unregistering): Failed to send port change of device batadv2 via netlink (err -105) [ 1119.317513][T14847] team0 (unregistering): Port device batadv2 removed [ 1119.419135][T14847] team0 (unregistering): Failed to send options change via netlink (err -105) [ 1119.430499][T14847] team0 (unregistering): Failed to send port change of device netdevsim1 via netlink (err -105) [ 1119.441959][T14847] team0 (unregistering): Port device netdevsim1 removed [ 1119.774821][T14868] netlink: 4 bytes leftover after parsing attributes in process `syz.4.17293'. [ 1121.101180][T14877] netlink: 'syz.3.17297': attribute type 1 has an invalid length. [ 1122.782180][T14850] lo: Caught tx_queue_len zero misconfig [ 1122.788075][T14850] netlink: 'syz.2.17290': attribute type 14 has an invalid length. [ 1122.812432][T14855] syzkaller0: entered promiscuous mode [ 1122.819029][T14855] syzkaller0: entered allmulticast mode [ 1122.947700][T14885] netlink: 24 bytes leftover after parsing attributes in process `syz.2.17298'. [ 1122.958377][T14877] workqueue: Failed to create a rescuer kthread for wq "bond24": -EINTR [ 1125.129973][T14932] netlink: 8 bytes leftover after parsing attributes in process `syz.0.17315'. [ 1125.558502][T14946] netlink: 'syz.4.17322': attribute type 1 has an invalid length. [ 1125.657199][T14946] 8021q: adding VLAN 0 to HW filter on device bond24 [ 1125.685433][T14952] netlink: 32 bytes leftover after parsing attributes in process `syz.3.17320'. [ 1125.698465][T14952] netlink: 16 bytes leftover after parsing attributes in process `syz.3.17320'. [ 1125.724094][T14952] netlink: 28 bytes leftover after parsing attributes in process `syz.3.17320'. [ 1125.820090][T14960] tipc: Enabled bearer , priority 0 [ 1125.839563][T14960] syzkaller0: entered promiscuous mode [ 1125.853137][T14960] syzkaller0: entered allmulticast mode [ 1126.732178][T14964] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1126.796346][T14964] net_ratelimit: 391 callbacks suppressed [ 1126.796364][T14964] A link change request failed with some changes committed already. Interface virt_wifi0 may have been left with an inconsistent configuration, please check. [ 1126.832880][T14967] tipc: Resetting bearer [ 1126.844510][T14967] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1126.854885][T14967] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1126.887543][T14959] tipc: Resetting bearer [ 1126.930533][T14959] tipc: Disabling bearer [ 1126.941525][T14972] lo: entered allmulticast mode [ 1126.961185][T14973] lo: left allmulticast mode [ 1126.974290][T14973] pim6reg: left allmulticast mode [ 1127.142714][T14978] gretap0: left promiscuous mode [ 1127.150757][T14978] erspan0: left promiscuous mode [ 1127.184045][T14991] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1127.327865][T16029] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 1127.414323][T14995] tipc: Enabling of bearer rejected, already enabled [ 1127.429058][T14995] netlink: 'syz.2.17334': attribute type 1 has an invalid length. [ 1127.530065][T15000] netlink: 28 bytes leftover after parsing attributes in process `syz.2.17334'. [ 1127.627627][T14995] bond23: entered promiscuous mode [ 1127.633522][T14995] 8021q: adding VLAN 0 to HW filter on device bond23 [ 1127.641397][ T3256] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 1127.670009][T15009] nbd3: detected capacity change from 0 to 63 [ 1127.691256][T15013] block nbd3: NBD_DISCONNECT [ 1127.727813][T15013] block nbd3: Disconnected due to user request. [ 1127.786436][T15015] 8021q: adding VLAN 0 to HW filter on device team0 [ 1127.810506][T15013] block nbd3: shutting down sockets [ 1127.842252][ C1] blk_print_req_error: 138 callbacks suppressed [ 1127.842267][ C1] I/O error, dev nbd3, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 1127.857895][ C1] buffer_io_error: 18 callbacks suppressed [ 1127.857913][ C1] Buffer I/O error on dev nbd3, logical block 1, async page read [ 1127.884709][ C1] I/O error, dev nbd3, sector 4 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 1127.893824][ C1] Buffer I/O error on dev nbd3, logical block 2, async page read [ 1127.901638][ C1] I/O error, dev nbd3, sector 6 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 1127.910740][ C1] Buffer I/O error on dev nbd3, logical block 3, async page read [ 1127.918599][ C1] I/O error, dev nbd3, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 1127.927709][ C1] Buffer I/O error on dev nbd3, logical block 0, async page read [ 1127.935585][ T9465] I/O error, dev nbd3, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 1127.945351][ T9465] Buffer I/O error on dev nbd3, logical block 0, async page read [ 1127.953971][T16029] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 1127.967658][ T9465] I/O error, dev nbd3, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 1127.977593][ T9465] Buffer I/O error on dev nbd3, logical block 1, async page read [ 1127.992483][ T9465] I/O error, dev nbd3, sector 4 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 1128.014311][ T9465] Buffer I/O error on dev nbd3, logical block 2, async page read [ 1128.030085][ T9465] I/O error, dev nbd3, sector 6 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 1128.040730][ T9465] Buffer I/O error on dev nbd3, logical block 3, async page read [ 1128.054823][ T9465] I/O error, dev nbd3, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 1128.072916][ T9465] Buffer I/O error on dev nbd3, logical block 0, async page read [ 1128.083076][ T9465] I/O error, dev nbd3, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 1128.093776][ T9465] Buffer I/O error on dev nbd3, logical block 1, async page read [ 1128.112915][T15015] A link change request failed with some changes committed already. Interface virt_wifi0 may have been left with an inconsistent configuration, please check. [ 1128.114522][ T9465] ldm_validate_partition_table(): Disk read failed. [ 1128.142582][T15000] bond23: entered allmulticast mode [ 1128.170140][T15017] bond23: (slave bridge17): making interface the new active one [ 1128.173052][ T9465] Dev nbd3: unable to read RDB block 0 [ 1128.185978][ T9465] nbd3: unable to read partition table [ 1128.193957][T15017] bridge17: entered promiscuous mode [ 1128.199948][T15017] bridge17: entered allmulticast mode [ 1128.216100][T15017] bond23: (slave bridge17): Enslaving as an active interface with an up link [ 1128.227942][ T9465] ldm_validate_partition_table(): Disk read failed. [ 1128.236914][ T9465] Dev nbd3: unable to read RDB block 0 [ 1128.245400][ T9465] nbd3: unable to read partition table [ 1128.420441][T15026] : renamed from bond0 [ 1128.441705][T15026] netlink: 4 bytes leftover after parsing attributes in process `syz.0.17337'. [ 1128.481301][T15030] netlink: 244 bytes leftover after parsing attributes in process `syz.2.17338'. [ 1128.504019][T15031] netlink: 4 bytes leftover after parsing attributes in process `syz.0.17337'. [ 1128.577440][ T29] audit: type=1804 audit(1781104582.332:38): pid=15038 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.4.17340" name="/newroot/3471/cgroup.controllers" dev="tmpfs" ino=17515 res=1 errno=0 [ 1128.627434][ T29] audit: type=1800 audit(1781104582.332:39): pid=15038 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.17340" name="cgroup.controllers" dev="tmpfs" ino=17515 res=0 errno=0 [ 1128.636679][T15026] team1: entered promiscuous mode [ 1128.677168][T15026] team1: entered allmulticast mode [ 1128.687965][T15026] 8021q: adding VLAN 0 to HW filter on device team1 [ 1128.708027][T15031] team2 (uninitialized): Failed to send options change via netlink (err -105) [ 1128.848109][T15031] team2: entered promiscuous mode [ 1128.853438][T15031] team2: entered allmulticast mode [ 1128.859185][T15031] 8021q: adding VLAN 0 to HW filter on device team2 [ 1128.938944][ T846] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 1128.973206][ T846] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 1129.119023][T15057] netlink: 20 bytes leftover after parsing attributes in process `syz.1.17344'. [ 1129.153365][ T29] audit: type=1804 audit(1781104582.902:40): pid=15059 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.2.17343" name="/newroot/3481/cgroup.controllers" dev="tmpfs" ino=17597 res=1 errno=0 [ 1129.164808][T15057] openvswitch: netlink: Flow get message rejected, Key attribute missing. [ 1129.229130][T15064] netlink: 'syz.3.17346': attribute type 62 has an invalid length. [ 1129.232701][ T29] audit: type=1800 audit(1781104582.902:41): pid=15059 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.17343" name="cgroup.controllers" dev="tmpfs" ino=17597 res=0 errno=0 [ 1129.247209][T15065] RDS: rds_bind could not find a transport for ::ffff:172.20.20.170, load rds_tcp or rds_rdma? [ 1129.386629][T15073] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 1129.426278][T15066] netlink: 12 bytes leftover after parsing attributes in process `syz.0.17345'. [ 1129.435979][ T9536] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 1129.589815][T15080] bond8: entered allmulticast mode [ 1129.604745][T15080] ip6gre3: entered allmulticast mode [ 1129.624910][T15080] bond0: entered promiscuous mode [ 1129.638350][T15080] erspan1: entered promiscuous mode [ 1129.851384][ T29] audit: type=1804 audit(1781104583.602:42): pid=15090 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.3.17351" name="/newroot/3464/cgroup.controllers" dev="tmpfs" ino=17498 res=1 errno=0 [ 1129.865326][T15087] netlink: 76 bytes leftover after parsing attributes in process `syz.2.17350'. [ 1129.903631][T15087] mac80211_hwsim hwsim6 syzkaller0: Caught tx_queue_len zero misconfig [ 1129.941655][ T29] audit: type=1800 audit(1781104583.602:43): pid=15090 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.17351" name="cgroup.controllers" dev="tmpfs" ino=17498 res=0 errno=0 [ 1130.144964][T15098] netlink: 'syz.4.17349': attribute type 32 has an invalid length. [ 1130.154094][T15087] netlink: 108 bytes leftover after parsing attributes in process `syz.2.17350'. [ 1130.192033][T15087] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1130.203623][T16029] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 1130.252437][T15087] 8021q: adding VLAN 0 to HW filter on device 60X [ 1130.432027][T15087] hsr0: A HSR master's MTU cannot be greater than the smallest MTU of its slaves minus the HSR Tag length (6 octets). [ 1130.523854][ T9536] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 1130.552658][T15091] hsr0: A HSR master's MTU cannot be greater than the smallest MTU of its slaves minus the HSR Tag length (6 octets). [ 1130.613498][T15112] netlink: 'syz.1.17357': attribute type 62 has an invalid length. [ 1130.631595][T16029] syz2: Port: 1 Link ACTIVE [ 1130.640830][T15109] netlink: 4 bytes leftover after parsing attributes in process `syz.3.17356'. [ 1131.111460][T15125] netlink: 4 bytes leftover after parsing attributes in process `syz.4.17360'. [ 1131.283819][T16029] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 1131.357530][T15144] netlink: 52 bytes leftover after parsing attributes in process `syz.1.17363'. [ 1131.401624][T15144] netlink: 'syz.1.17363': attribute type 1 has an invalid length. [ 1131.450652][T15153] netlink: 'syz.0.17365': attribute type 13 has an invalid length. [ 1131.476872][T15154] IPVS: ip_vs_add_dest(): server weight less than zero [ 1131.484053][T15153] netlink: 'syz.0.17365': attribute type 17 has an invalid length. [ 1131.484610][T15152] netlink: 'syz.3.17366': attribute type 16 has an invalid length. [ 1131.562744][T15147] tipc: Resetting bearer [ 1131.758606][T15168] netlink: 'syz.4.17369': attribute type 62 has an invalid length. [ 1131.846529][T15147] veth0_vlan: left promiscuous mode [ 1132.085270][T15153] 8021q: adding VLAN 0 to HW filter on device team0 [ 1132.119747][T15153] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1132.160738][T15153] bridge_slave_1: left allmulticast mode [ 1132.258651][T15153] veth1_vlan: left promiscuous mode [ 1132.279377][T15153] veth0_vlan: entered promiscuous mode [ 1132.307439][T15153] veth1_vlan: entered promiscuous mode [ 1132.360271][T15153] A link change request failed with some changes committed already. Interface may have been left with an inconsistent configuration, please check. [ 1132.580977][T15181] netlink: 'syz.3.17371': attribute type 1 has an invalid length. [ 1132.634068][T15184] netlink: 'syz.0.17372': attribute type 1 has an invalid length. [ 1132.671758][T15181] 8021q: adding VLAN 0 to HW filter on device bond24 [ 1132.726169][T15184] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1132.844829][T15189] bond0: (slave veth19): Enslaving as an active interface with a down link [ 1132.900548][T15184] bond0: entered allmulticast mode [ 1132.925676][T15197] xt_NFQUEUE: number of total queues is 0 [ 1133.315406][T15211] gre7: entered promiscuous mode [ 1133.363609][ C1] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 1133.493948][T15192] __nla_validate_parse: 14 callbacks suppressed [ 1133.493967][T15192] netlink: 4 bytes leftover after parsing attributes in process `syz.1.17374'. [ 1133.583590][T15192] netlink: 348 bytes leftover after parsing attributes in process `syz.1.17374'. [ 1133.621930][T15192] netlink: 4 bytes leftover after parsing attributes in process `syz.1.17374'. [ 1133.653020][T15192] netlink: 348 bytes leftover after parsing attributes in process `syz.1.17374'. [ 1133.687817][T15225] netlink: 'syz.3.17380': attribute type 16 has an invalid length. [ 1133.700703][T15192] netlink: 4 bytes leftover after parsing attributes in process `syz.1.17374'. [ 1134.085330][T15238] netlink: 'syz.3.17383': attribute type 62 has an invalid length. [ 1134.128229][T15219] netlink: 28 bytes leftover after parsing attributes in process `syz.2.17378'. [ 1134.854487][T15251] netlink: 'syz.2.17385': attribute type 1 has an invalid length. [ 1134.937417][T15255] netlink: 'syz.0.17386': attribute type 1 has an invalid length. [ 1135.074718][T15255] 8021q: adding VLAN 0 to HW filter on device bond20 [ 1135.163904][T15260] bond20: (slave veth21): Enslaving as an active interface with a down link [ 1135.211737][T15265] bond20: entered allmulticast mode [ 1135.403930][T15270] netlink: 60 bytes leftover after parsing attributes in process `syz.2.17389'. [ 1135.476257][T15273] netlink: 'syz.0.17391': attribute type 16 has an invalid length. [ 1135.712434][T15280] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 1135.738975][ T9536] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 1135.804648][T16029] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 1135.916841][T15283] ip6gre5: entered allmulticast mode [ 1136.288333][T15295] netlink: 'syz.3.17398': attribute type 62 has an invalid length. [ 1136.636174][T15305] netlink: 'syz.0.17399': attribute type 5 has an invalid length. [ 1136.841791][T15307] syzkaller0: entered promiscuous mode [ 1136.856059][T15307] syzkaller0: entered allmulticast mode [ 1137.741527][T15341] hsr0: A HSR master's MTU cannot be greater than the smallest MTU of its slaves minus the HSR Tag length (6 octets). [ 1137.760802][ T9525] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 1138.099751][T15350] netlink: 1044 bytes leftover after parsing attributes in process `syz.2.17416'. [ 1138.135813][T15350] sctp: [Deprecated]: syz.2.17416 (pid 15350) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1138.135813][T15350] Use struct sctp_sack_info instead [ 1138.303932][ T9525] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 1138.483887][T15352] netlink: 'syz.1.17417': attribute type 62 has an invalid length. [ 1138.941861][T15362] netlink: 'syz.4.17420': attribute type 2 has an invalid length. [ 1138.987846][T15362] netlink: 'syz.4.17420': attribute type 2 has an invalid length. [ 1139.068102][T15370] netlink: 24 bytes leftover after parsing attributes in process `syz.0.17423'. [ 1139.415458][T15375] bridge0: port 1(vlan7) entered blocking state [ 1139.454877][T15375] bridge0: port 1(vlan7) entered disabled state [ 1139.475508][T15375] vlan7: entered allmulticast mode [ 1139.490321][T15375] geneve0: entered allmulticast mode [ 1139.502237][ T29] audit: type=1804 audit(1781104593.252:44): pid=15378 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.1.17425" name="/newroot/3447/cgroup.controllers" dev="tmpfs" ino=17385 res=1 errno=0 [ 1139.509695][T15375] vlan7: entered promiscuous mode [ 1139.594490][T15375] geneve0: entered promiscuous mode [ 1139.594904][ T29] audit: type=1800 audit(1781104593.252:45): pid=15378 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.17425" name="cgroup.controllers" dev="tmpfs" ino=17385 res=0 errno=0 [ 1139.628362][T15382] netlink: 88 bytes leftover after parsing attributes in process `syz.0.17426'. [ 1139.663054][T15384] netlink: 8 bytes leftover after parsing attributes in process `syz.2.17427'. [ 1139.680722][T15380] netlink: 44 bytes leftover after parsing attributes in process `syz.0.17426'. [ 1139.696242][T15384] netlink: 8 bytes leftover after parsing attributes in process `syz.2.17427'. [ 1140.269243][T15403] syzkaller0: entered promiscuous mode [ 1140.285465][T15403] syzkaller0: entered allmulticast mode [ 1140.312484][T15403] netlink: 'syz.4.17432': attribute type 1 has an invalid length. [ 1140.347806][T15403] tipc: Enabled bearer , priority 0 [ 1140.447063][T15409] netlink: 28 bytes leftover after parsing attributes in process `syz.3.17434'. [ 1140.586634][T15413] vlan8: entered promiscuous mode [ 1140.970764][T15424] netlink: 'syz.3.17439': attribute type 4 has an invalid length. [ 1141.003418][T15424] netlink: 17 bytes leftover after parsing attributes in process `syz.3.17439'. [ 1141.059463][T15424] openvswitch: netlink: IP tunnel attribute has 5 unknown bytes. [ 1141.109147][T15424] netlink: 12 bytes leftover after parsing attributes in process `syz.3.17439'. [ 1141.203137][T15431] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 1141.248108][T15431] team0: Mode changed to "roundrobin" [ 1141.275624][T15431] vlan0: entered promiscuous mode [ 1141.301868][T15431] tipc: Enabled bearer , priority 0 [ 1141.416066][T15436] netlink: 4 bytes leftover after parsing attributes in process `syz.2.17444'. [ 1141.457522][T15436] openvswitch: netlink: Missing key (keys=c0, expected=200000) [ 1141.678277][T15445] netlink: 20 bytes leftover after parsing attributes in process `syz.2.17446'. [ 1142.087365][T15449] netlink: 'syz.2.17447': attribute type 4 has an invalid length. [ 1142.643410][ C1] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 1142.791627][T15474] debugfs: 'netdev:syzkaller0' already exists in 'phy4' [ 1143.067325][T15481] batadv_slave_1: entered promiscuous mode [ 1143.841469][T15492] netlink: 'syz.1.17459': attribute type 1 has an invalid length. [ 1143.900359][T15492] 8021q: adding VLAN 0 to HW filter on device bond19 [ 1144.000137][T15492] bond19: (slave veth41): Enslaving as an active interface with a down link [ 1144.062518][T15494] bond19: entered allmulticast mode [ 1144.096304][T15502] __nla_validate_parse: 3 callbacks suppressed [ 1144.096352][T15502] netlink: 240 bytes leftover after parsing attributes in process `syz.0.17462'. [ 1144.209997][T15505] netlink: 4 bytes leftover after parsing attributes in process `syz.2.17463'. [ 1144.272829][T15502] bond21: option primary: mode dependency failed, not supported in mode balance-rr(0) [ 1144.385365][T15502] bond21 (unregistering): Released all slaves [ 1144.490224][T15523] netlink: 'syz.1.17464': attribute type 1 has an invalid length. [ 1144.504453][T15523] netlink: 'syz.1.17464': attribute type 2 has an invalid length. [ 1144.572497][T15507] bond21: option lacp_rate: invalid value (128) [ 1144.610254][T15507] bond21 (unregistering): Released all slaves [ 1144.627244][T15508] netlink: 8 bytes leftover after parsing attributes in process `syz.1.17464'. [ 1144.643410][T15512] batadv_slave_1: entered promiscuous mode [ 1144.659999][T15519] bridge0: entered promiscuous mode [ 1144.668638][T15519] bridge0: entered allmulticast mode [ 1144.734843][T15501] batadv_slave_1: left promiscuous mode [ 1144.907160][T15536] netlink: 4 bytes leftover after parsing attributes in process `syz.2.17471'. [ 1145.082924][T15546] netlink: 'syz.1.17474': attribute type 1 has an invalid length. [ 1145.180108][T15546] 8021q: adding VLAN 0 to HW filter on device bond20 [ 1145.236033][T15552] bond20: entered allmulticast mode [ 1145.326390][T15549] bond20: (slave veth43): Enslaving as an active interface with a down link [ 1145.971640][T15567] netlink: 4 bytes leftover after parsing attributes in process `syz.4.17478'. [ 1146.000214][T15567] openvswitch: netlink: Missing key (keys=40, expected=10000000) [ 1146.069358][T15569] netlink: 4 bytes leftover after parsing attributes in process `syz.0.17479'. [ 1147.126851][T15581] geneve4: left promiscuous mode [ 1147.131839][T15581] geneve4: left allmulticast mode [ 1147.137654][T15581] bond5: left promiscuous mode [ 1147.142442][T15581] vti0: left promiscuous mode [ 1147.147780][T15581] ip6gre3: left promiscuous mode [ 1147.152739][T15581] ip6gre3: left allmulticast mode [ 1147.158282][T15581] bond6: left promiscuous mode [ 1147.163925][T15581] gre5: left promiscuous mode [ 1147.169029][T15581] bond7: left promiscuous mode [ 1147.173900][T15581] ip6gre4: left promiscuous mode [ 1147.179583][T15581] bond9: left promiscuous mode [ 1147.184635][T15581] veth11: left promiscuous mode [ 1147.190017][T15581] bond11: left promiscuous mode [ 1147.195469][T15581] ip6tnl2: left promiscuous mode [ 1147.201523][T15581] ipip0: left promiscuous mode [ 1147.206774][T15581] bond18: left promiscuous mode [ 1147.211642][T15581] bond18: left allmulticast mode [ 1147.217200][T15581] bond19: left promiscuous mode [ 1147.222072][T15581] bridge19: left promiscuous mode [ 1147.231731][T15581] ipvlan3: left allmulticast mode [ 1147.242666][T15581] bond19: left allmulticast mode [ 1147.247828][T15581] bridge19: left allmulticast mode [ 1147.256777][T15581] bond20: left allmulticast mode [ 1147.335907][T15581] gre7: left promiscuous mode [ 1147.452173][T15594] netlink: 4 bytes leftover after parsing attributes in process `syz.3.17486'. [ 1149.848250][T15596] faux_driver regulatory: loading /lib/firmware/regulatory.db failed with error -4 [ 1149.867876][T15596] faux_driver regulatory: Direct firmware load for regulatory.db failed with error -4 [ 1149.893891][T15596] faux_driver regulatory: Falling back to sysfs fallback for: regulatory.db [ 1150.703725][T15627] netlink: 12 bytes leftover after parsing attributes in process `syz.1.17495'. [ 1150.712938][T15627] netlink: 12 bytes leftover after parsing attributes in process `syz.1.17495'. [ 1150.722373][T15627] netlink: 58 bytes leftover after parsing attributes in process `syz.1.17495'. [ 1150.889580][T15627] tipc: Disabling bearer [ 1150.932866][T15635] netlink: 'syz.4.17497': attribute type 3 has an invalid length. [ 1150.964969][T15635] nbd: nbd4 already in use [ 1150.979765][T15635] block nbd4: NBD_DISCONNECT [ 1150.995464][T15635] block nbd4: Send disconnect failed -32 [ 1151.007517][T15635] block nbd4: shutting down sockets [ 1151.068155][T15636] netlink: 12 bytes leftover after parsing attributes in process `syz.2.17496'. [ 1151.170761][T15638] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1151.233159][T15638] 0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 1151.249030][T15638] A link change request failed with some changes committed already. Interface virt_wifi0 may have been left with an inconsistent configuration, please check. [ 1151.422495][T15648] A link change request failed with some changes committed already. Interface virt_wifi0 may have been left with an inconsistent configuration, please check. [ 1151.891676][T15654] ipt_rpfilter: unknown options [ 1152.034418][ T29] audit: type=1804 audit(1781104605.792:46): pid=15659 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.0.17503" name="/newroot/3525/cgroup.controllers" dev="tmpfs" ino=17802 res=1 errno=0 [ 1152.074343][ T29] audit: type=1800 audit(1781104605.822:47): pid=15659 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.17503" name="cgroup.controllers" dev="tmpfs" ino=17802 res=0 errno=0 [ 1152.225627][T15664] xt_l2tp: invalid flags combination: 0 [ 1152.465344][T15676] netlink: 'syz.3.17510': attribute type 1 has an invalid length. [ 1152.572865][T15679] netlink: 44 bytes leftover after parsing attributes in process `syz.3.17510'. [ 1152.594398][T15676] bond25: entered promiscuous mode [ 1152.599989][T15676] 8021q: adding VLAN 0 to HW filter on device bond25 [ 1152.686456][T15676] bond25: (slave bridge21): making interface the new active one [ 1152.715017][T15676] bridge21: entered promiscuous mode [ 1152.728737][T15684] netlink: 'syz.4.17512': attribute type 1 has an invalid length. [ 1152.746325][T15676] bond25: (slave bridge21): Enslaving as an active interface with an up link [ 1153.115165][T15699] netlink: 'syz.4.17516': attribute type 1 has an invalid length. [ 1153.154683][T15699] 8021q: adding VLAN 0 to HW filter on device bond25 [ 1154.815031][T15742] netlink: 4 bytes leftover after parsing attributes in process `syz.3.17526'. [ 1155.064090][T15705] syz.1.17518 invoked oom-killer: gfp_mask=0x408d40(GFP_NOFS|__GFP_ZERO|__GFP_NOFAIL|__GFP_ACCOUNT), order=0, oom_score_adj=1000 [ 1155.113351][T15705] CPU: 0 UID: 0 PID: 15705 Comm: syz.1.17518 Not tainted syzkaller #0 PREEMPT(full) [ 1155.113377][T15705] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1155.113388][T15705] Call Trace: [ 1155.113396][T15705] [ 1155.113403][T15705] dump_stack_lvl+0xe8/0x150 [ 1155.113434][T15705] dump_header+0xd3/0x4c0 [ 1155.113500][T15705] oom_kill_process+0x3ab/0x970 [ 1155.113548][T15705] out_of_memory+0x106c/0x1410 [ 1155.113569][T15705] ? try_charge_memcg+0xbb9/0x1570 [ 1155.113603][T15705] ? __pfx___mutex_lock+0x10/0x10 [ 1155.113689][T15705] ? __pfx_out_of_memory+0x10/0x10 [ 1155.113709][T15705] ? do_raw_spin_unlock+0xf5/0x210 [ 1155.113751][T15705] try_charge_memcg+0xc77/0x1570 [ 1155.113798][T15705] ? __pfx_try_charge_memcg+0x10/0x10 [ 1155.113828][T15705] ? percpu_ref_tryget+0x15/0x180 [ 1155.113850][T15705] ? __memcg_slab_post_alloc_hook+0x65b/0xe80 [ 1155.113879][T15705] ? __memcg_slab_post_alloc_hook+0x65b/0xe80 [ 1155.113905][T15705] ? __memcg_slab_post_alloc_hook+0x65b/0xe80 [ 1155.113927][T15705] __memcg_slab_post_alloc_hook+0x84e/0xe80 [ 1155.113970][T15705] ? alloc_buffer_head+0x2a/0x270 [ 1155.114007][T15705] kmem_cache_alloc_noprof+0x347/0x650 [ 1155.114030][T15705] ? alloc_buffer_head+0x2a/0x270 [ 1155.114054][T15705] ? get_mem_cgroup_from_folio+0x57/0x2c0 [ 1155.114072][T15705] ? kmem_cache_alloc_noprof+0x15a/0x650 [ 1155.114102][T15705] alloc_buffer_head+0x2a/0x270 [ 1155.114126][T15705] ? folio_alloc_buffers+0x17d/0x640 [ 1155.114155][T15705] folio_alloc_buffers+0x19b/0x640 [ 1155.114187][T15705] create_empty_buffers+0x3a/0x530 [ 1155.114213][T15705] __block_write_begin_int+0x3c2/0x1910 [ 1155.114245][T15705] ? __mark_inode_dirty+0x6ec/0x13b0 [ 1155.114280][T15705] ? __pfx_ext4_da_get_block_prep+0x10/0x10 [ 1155.114324][T15705] ? __pfx___block_write_begin_int+0x10/0x10 [ 1155.114356][T15705] block_page_mkwrite+0x335/0x3d0 [ 1155.114375][T15705] ? __pfx_ext4_da_get_block_prep+0x10/0x10 [ 1155.114404][T15705] ext4_page_mkwrite+0xcf2/0x1150 [ 1155.114443][T15705] ? __pfx_ext4_page_mkwrite+0x10/0x10 [ 1155.114478][T15705] do_page_mkwrite+0x14d/0x310 [ 1155.114509][T15705] do_pte_missing+0x6dc/0x33f0 [ 1155.114551][T15705] ? handle_mm_fault+0xf1/0x3170 [ 1155.114576][T15705] handle_mm_fault+0x1bf2/0x3170 [ 1155.114612][T15705] ? handle_mm_fault+0xf1/0x3170 [ 1155.114642][T15705] ? __pfx_handle_mm_fault+0x10/0x10 [ 1155.114683][T15705] ? lock_mm_and_find_vma+0xa7/0x340 [ 1155.114712][T15705] do_user_addr_fault+0x75b/0x1340 [ 1155.114766][T15705] exc_page_fault+0x6a/0xc0 [ 1155.114819][T15705] asm_exc_page_fault+0x26/0x30 [ 1155.114837][T15705] RIP: 0033:0x7f9eff265728 [ 1155.114855][T15705] Code: be 08 00 00 00 48 89 ef 48 8d 50 ff 48 89 15 4f 00 ee 00 44 88 78 ff 44 8b 3d 34 00 ee 00 e8 2f 52 ff ff 48 8b 05 40 00 ee 00 <44> 89 38 41 bf 04 00 00 00 48 83 c0 08 66 44 89 78 fc 83 05 2f 00 [ 1155.114869][T15705] RSP: 002b:00007ffe470fc2c0 EFLAGS: 00010206 [ 1155.114884][T15705] RAX: 0000001b34224220 RBX: 0000000000000026 RCX: ffffffff823acde1 [ 1155.114896][T15705] RDX: 0000001b34224220 RSI: 0000000000000008 RDI: 00007f9f00145720 [ 1155.114907][T15705] RBP: 00007f9f00145720 R08: 00007f9eff600000 R09: 00007f9eff616128 [ 1155.114918][T15705] R10: 0000000000000001 R11: 0000000000000017 R12: 0000000000000000 [ 1155.114929][T15705] R13: 0000000000000200 R14: 0000000000000000 R15: 0000000000000201 [ 1155.114950][T15705] ? __reset_page_owner+0x1a1/0x1f0 [ 1155.114979][T15705] [ 1155.122830][T15705] memory: usage 307200kB, limit 307200kB, failcnt 677 [ 1155.479571][T15705] memory+swap: usage 307392kB, limit 9007199254740988kB, failcnt 0 [ 1155.513149][T15705] kmem: usage 307176kB, limit 9007199254740988kB, failcnt 0 [ 1155.530041][T15753] netlink: 8 bytes leftover after parsing attributes in process `syz.2.17530'. [ 1155.561139][T15705] Memory cgroup stats for /syz1: [ 1155.561563][T15705] cache 4096 [ 1155.580275][T15753] netlink: 4 bytes leftover after parsing attributes in process `syz.2.17530'. [ 1155.608022][T15705] rss 0 [ 1155.615189][T15705] rss_huge 0 [ 1155.627515][T15705] shmem 0 [ 1155.635200][T15705] mapped_file 0 [ 1155.641480][T15753] netlink: 'syz.2.17530': attribute type 18 has an invalid length. [ 1155.655770][T15705] dirty 0 [ 1155.665166][T15705] writeback 0 [ 1155.675107][T15705] workingset_refault_anon 8 [ 1155.693115][T15705] workingset_refault_file 91 [ 1155.707804][T15705] swap 196608 [ 1155.719501][T15705] swapcached 249856 [ 1155.729750][T15705] pgpgin 296202 [ 1155.745297][T15705] pgpgout 296196 [ 1155.753059][T15705] pgfault 645776 [ 1155.765361][T15705] pgmajfault 8 [ 1155.779210][T15705] inactive_anon 20480 [ 1155.792534][T15705] active_anon 0 [ 1155.808089][T15705] inactive_file 4096 [ 1155.819751][T15705] active_file 0 [ 1155.831894][T15705] unevictable 0 [ 1155.848205][T15705] hierarchical_memory_limit 314572800 [ 1155.867820][T15705] hierarchical_memsw_limit 9223372036854771712 [ 1155.884198][T15705] total_cache 4096 [ 1155.909604][T15705] total_rss 0 [ 1155.917692][T15705] total_rss_huge 0 [ 1155.925555][T15705] total_shmem 0 [ 1155.937271][T15705] total_mapped_file 0 [ 1155.946958][T15705] total_dirty 0 [ 1155.956845][T15705] total_writeback 0 [ 1155.963726][T15705] total_workingset_refault_anon 8 [ 1155.975039][T15705] total_workingset_refault_file 91 [ 1155.993486][T15705] total_swap 196608 [ 1156.001880][T15705] total_swapcached 249856 [ 1156.013367][T15705] total_pgpgin 296202 [ 1156.025278][T15705] total_pgpgout 296196 [ 1156.036982][T15705] total_pgfault 645785 [ 1156.046125][T15705] total_pgmajfault 8 [ 1156.055139][T15705] total_inactive_anon 20480 [ 1156.071315][T15705] total_active_anon 0 [ 1156.086229][T15705] total_inactive_file 4096 [ 1156.096816][T15705] total_active_file 0 [ 1156.108460][T15705] total_unevictable 0 [ 1156.122286][T15705] anon_cost 0 [ 1156.133332][T15705] file_cost 0 [ 1156.145086][T15705] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=/,mems_allowed=0-1,oom_memcg=/syz1,task_memcg=/syz1,task=syz.1.17518,pid=15705,uid=0 [ 1156.197629][T15705] Memory cgroup out of memory: Killed process 15705 (syz.1.17518) total-vm:102364kB, anon-rss:1240kB, file-rss:23044kB, shmem-rss:0kB, UID:0 pgtables:136kB oom_score_adj:1000 [ 1156.424965][T15775] netlink: 4 bytes leftover after parsing attributes in process `syz.2.17533'. [ 1156.476081][T15775] netlink: 16178 bytes leftover after parsing attributes in process `syz.2.17533'. [ 1156.856813][T15769] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 1157.506604][ T29] audit: type=1804 audit(1781104611.262:48): pid=15792 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.1.17538" name="/newroot/3470/cgroup.controllers" dev="tmpfs" ino=17506 res=1 errno=0 [ 1157.569947][ T29] audit: type=1800 audit(1781104611.292:49): pid=15792 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.17538" name="cgroup.controllers" dev="tmpfs" ino=17506 res=0 errno=0 [ 1157.619523][T15799] netlink: 'syz.4.17537': attribute type 16 has an invalid length. [ 1157.688085][T15799] netlink: 'syz.4.17537': attribute type 17 has an invalid length. [ 1157.830358][T15796] tipc: Resetting bearer [ 1157.848032][T15796] tipc: Resetting bearer [ 1157.873847][T15797] netlink: 24 bytes leftover after parsing attributes in process `syz.0.17539'. [ 1158.060226][T15799] A link change request failed with some changes committed already. Interface virt_wifi0 may have been left with an inconsistent configuration, please check. [ 1158.338935][T15823] netlink: 3 bytes leftover after parsing attributes in process `syz.0.17544'. [ 1158.410996][T15823] 0X: renamed from batadv0 (while UP) [ 1158.424068][T15827] netlink: 4 bytes leftover after parsing attributes in process `syz.1.17546'. [ 1158.437244][T15823] A link change request failed with some changes committed already. Interface 60X may have been left with an inconsistent configuration, please check. [ 1158.804107][T15838] netlink: 8 bytes leftover after parsing attributes in process `syz.1.17551'. [ 1158.808266][T15844] netlink: 24 bytes leftover after parsing attributes in process `syz.4.17550'. [ 1158.820849][T15838] bond0: Unable to set peer notification delay as MII monitoring is disabled [ 1158.886592][T15842] block nbd3: server does not support multiple connections per device. [ 1158.903840][T15842] block nbd3: shutting down sockets [ 1158.950355][T15850] bridge22: trying to set multicast startup query interval below minimum, setting to 100 (1000ms) [ 1158.992142][T15850] netlink: 8 bytes leftover after parsing attributes in process `syz.3.17554'. [ 1159.151520][T15851] bond26: (slave lo): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 1159.191863][T15851] bond26: (slave lo): Enslaving as an active interface with an up link [ 1159.215081][T15851] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 1160.012207][T15890] netlink: 3 bytes leftover after parsing attributes in process `syz.2.17565'. [ 1160.062328][T15890] netlink: 4 bytes leftover after parsing attributes in process `syz.2.17565'. [ 1160.573709][ C1] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 1160.849977][T15914] A link change request failed with some changes committed already. Interface may have been left with an inconsistent configuration, please check. [ 1161.049557][T15927] A link change request failed with some changes committed already. Interface virt_wifi0 may have been left with an inconsistent configuration, please check. [ 1161.234508][T15936] netlink: 'syz.4.17575': attribute type 12 has an invalid length. [ 1161.422184][T15948] netlink: 'syz.3.17579': attribute type 1 has an invalid length. [ 1161.439983][T15939] mac80211_hwsim hwsim6 syzkaller0: left promiscuous mode [ 1161.451872][T15939] mac80211_hwsim hwsim6 syzkaller0: left allmulticast mode [ 1161.460871][T15946] __nla_validate_parse: 5 callbacks suppressed [ 1161.460887][T15946] netlink: 8 bytes leftover after parsing attributes in process `syz.4.17575'. [ 1161.573419][T15946] macsec0: entered promiscuous mode [ 1161.644725][T15936] netlink: 4 bytes leftover after parsing attributes in process `syz.4.17575'. [ 1161.678218][T15936] macsec0 (unregistering): left promiscuous mode [ 1161.689148][T15960] netlink: 24 bytes leftover after parsing attributes in process `syz.1.17581'. [ 1161.860951][T15969] netlink: 12 bytes leftover after parsing attributes in process `syz.4.17585'. [ 1161.924703][T15962] netlink: 80 bytes leftover after parsing attributes in process `syz.3.17584'. [ 1162.025179][T15962] netlink: 8 bytes leftover after parsing attributes in process `syz.3.17584'. [ 1162.422841][T15994] vlan3: entered promiscuous mode [ 1162.432157][T15995] netlink: 'syz.0.17589': attribute type 1 has an invalid length. [ 1162.453166][T15995] netlink: 224 bytes leftover after parsing attributes in process `syz.0.17589'. [ 1163.065094][T15999] tipc: Resetting bearer [ 1163.082661][T16001] netlink: 'syz.1.17591': attribute type 4 has an invalid length. [ 1163.264628][T16014] netlink: 'syz.3.17596': attribute type 1 has an invalid length. [ 1163.272618][T16014] netlink: 4 bytes leftover after parsing attributes in process `syz.3.17596'. [ 1163.281928][T16014] netlink: 'syz.3.17596': attribute type 1 has an invalid length. [ 1163.314813][T16016] netlink: 'syz.4.17595': attribute type 1 has an invalid length. [ 1163.361382][ T29] audit: type=1804 audit(1781104617.112:50): pid=16019 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.1.17593" name="/newroot/3485/cgroup.controllers" dev="tmpfs" ino=17583 res=1 errno=0 [ 1163.506652][ T29] audit: type=1800 audit(1781104617.112:51): pid=16019 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.17593" name="cgroup.controllers" dev="tmpfs" ino=17583 res=0 errno=0 [ 1163.681958][T16014] syzkaller1: entered promiscuous mode [ 1163.695512][T16014] syzkaller1: entered allmulticast mode [ 1163.918516][T16028] mac80211_hwsim hwsim6 syzkaller0: entered promiscuous mode [ 1163.942875][T16028] mac80211_hwsim hwsim6 syzkaller0: entered allmulticast mode [ 1164.128529][T16050] netlink: 4 bytes leftover after parsing attributes in process `syz.4.17599'. [ 1164.148537][T16050] netlink: 348 bytes leftover after parsing attributes in process `syz.4.17599'. [ 1164.828569][ T29] audit: type=1804 audit(1781104618.582:52): pid=16065 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.1.17604" name="/newroot/3488/cgroup.controllers" dev="tmpfs" ino=17600 res=1 errno=0 [ 1164.909623][ T29] audit: type=1800 audit(1781104618.582:53): pid=16065 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.17604" name="cgroup.controllers" dev="tmpfs" ino=17600 res=0 errno=0 [ 1165.115297][T16073] tipc: Enabling of bearer rejected, already enabled [ 1165.174189][T16073] netlink: 'syz.2.17607': attribute type 1 has an invalid length. [ 1165.293805][T16073] bond24: entered promiscuous mode [ 1165.316451][T16073] 8021q: adding VLAN 0 to HW filter on device bond24 [ 1165.347132][T16077] bond24: entered allmulticast mode [ 1165.429677][T16073] bond24: (slave bridge18): making interface the new active one [ 1165.460060][T16073] bridge18: entered promiscuous mode [ 1165.467505][T16073] bridge18: entered allmulticast mode [ 1165.488001][T16073] bond24: (slave bridge18): Enslaving as an active interface with an up link [ 1165.540233][T16086] sctp: [Deprecated]: syz.0.17611 (pid 16086) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1165.540233][T16086] Use struct sctp_sack_info instead [ 1165.872659][T16104] netlink: 'syz.4.17617': attribute type 4 has an invalid length. [ 1165.898459][T16104] netlink: 'syz.4.17617': attribute type 4 has an invalid length. [ 1166.082042][ T29] audit: type=1804 audit(1781104619.832:54): pid=16112 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.4.17619" name="/newroot/3533/cgroup.controllers" dev="tmpfs" ino=17832 res=1 errno=0 [ 1166.150572][ T29] audit: type=1800 audit(1781104619.832:55): pid=16112 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.17619" name="cgroup.controllers" dev="tmpfs" ino=17832 res=0 errno=0 [ 1166.611720][T16126] __nla_validate_parse: 12 callbacks suppressed [ 1166.611734][T16126] netlink: 4 bytes leftover after parsing attributes in process `syz.4.17623'. [ 1166.663358][T16126] netlink: 348 bytes leftover after parsing attributes in process `syz.4.17623'. [ 1166.693321][T16126] netlink: 4 bytes leftover after parsing attributes in process `syz.4.17623'. [ 1166.702554][T16126] netlink: 348 bytes leftover after parsing attributes in process `syz.4.17623'. [ 1166.712030][T16126] netlink: 4 bytes leftover after parsing attributes in process `syz.4.17623'. [ 1167.579306][T16155] netlink: 24 bytes leftover after parsing attributes in process `syz.4.17627'. [ 1167.726986][T16157] netlink: 'syz.3.17631': attribute type 3 has an invalid length. [ 1168.296323][T16180] tipc: Resetting bearer [ 1168.727053][T16199] netlink: 32 bytes leftover after parsing attributes in process `syz.2.17640'. [ 1169.371692][ T9536] IPVS: starting estimator thread 0... [ 1169.377572][T16200] IPVS: wrr: UDP 224.0.0.2:0 - no destination available [ 1169.473951][T16219] IPVS: using max 39 ests per chain, 93600 per kthread [ 1169.561913][T16214] bridge0: port 3(wlan1) entered blocking state [ 1169.580914][T16214] bridge0: port 3(wlan1) entered disabled state [ 1169.597516][T16214] mac80211_hwsim hwsim8 wlan1: entered allmulticast mode [ 1169.619841][T16214] mac80211_hwsim hwsim8 wlan1: entered promiscuous mode [ 1169.642404][ T9536] syz2: Port: 1 Link DOWN [ 1169.866210][ T29] audit: type=1804 audit(1781104623.622:56): pid=16230 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.1.17646" name="/newroot/3497/cgroup.controllers" dev="tmpfs" ino=17647 res=1 errno=0 [ 1169.936510][ T29] audit: type=1800 audit(1781104623.642:57): pid=16230 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.17646" name="cgroup.controllers" dev="tmpfs" ino=17647 res=0 errno=0 [ 1170.079572][T16239] netlink: 'syz.2.17648': attribute type 1 has an invalid length. [ 1170.330478][ T29] audit: type=1804 audit(1781104624.082:58): pid=16253 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.0.17649" name="/newroot/3555/cgroup.controllers" dev="tmpfs" ino=17960 res=1 errno=0 [ 1170.347542][T16239] 8021q: adding VLAN 0 to HW filter on device bond25 [ 1170.356786][ T29] audit: type=1800 audit(1781104624.082:59): pid=16253 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.17649" name="cgroup.controllers" dev="tmpfs" ino=17960 res=0 errno=0 [ 1170.388863][T16254] netlink: 8 bytes leftover after parsing attributes in process `syz.1.17650'. [ 1170.519418][T16244] macvlan8: entered promiscuous mode [ 1170.543385][T16244] macvlan8: entered allmulticast mode [ 1170.629983][T16265] netlink: 280 bytes leftover after parsing attributes in process `syz.0.17651'. [ 1170.640355][T16250] bond25: (slave ip6gretap2): making interface the new active one [ 1170.659137][T16250] bond25: (slave ip6gretap2): Enslaving as an active interface with an up link [ 1170.696479][T16268] netlink: 4 bytes leftover after parsing attributes in process `syz.3.17652'. [ 1170.761568][T16251] bridge18: trying to set multicast startup query interval below minimum, setting to 100 (1000ms) [ 1170.911523][T16260] bond21: (slave 26): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 1170.930962][T16260] bond21: (slave 26): Enslaving as an active interface with an up link [ 1170.940373][T16260] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 1171.839528][T16325] netlink: 40 bytes leftover after parsing attributes in process `syz.0.17659'. [ 1171.886248][T16322] nbd: couldn't find a device at index 0 [ 1171.895154][ T29] audit: type=1804 audit(1781104625.642:60): pid=16327 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.2.17660" name="/newroot/3539/cgroup.controllers" dev="tmpfs" ino=17895 res=1 errno=0 [ 1171.991552][ T29] audit: type=1800 audit(1781104625.652:61): pid=16327 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.17660" name="cgroup.controllers" dev="tmpfs" ino=17895 res=0 errno=0 [ 1172.028070][T16325] nbd: couldn't find a device at index 0 [ 1172.588298][ T29] audit: type=1804 audit(1781104626.342:62): pid=16340 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.3.17661" name="/newroot/3521/cgroup.controllers" dev="tmpfs" ino=17795 res=1 errno=0 [ 1172.630673][ T29] audit: type=1800 audit(1781104626.342:63): pid=16340 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.17661" name="cgroup.controllers" dev="tmpfs" ino=17795 res=0 errno=0 [ 1173.148470][T16361] netlink: 4 bytes leftover after parsing attributes in process `syz.3.17666'. [ 1173.328462][T16363] netlink: 'syz.0.17667': attribute type 13 has an invalid length. [ 1173.651244][T16374] netlink: 'syz.4.17670': attribute type 10 has an invalid length. [ 1173.678805][T16374] syz_tun: entered promiscuous mode [ 1173.873859][T16380] netlink: 4 bytes leftover after parsing attributes in process `syz.4.17671'. [ 1173.894755][T16380] netlink: 4 bytes leftover after parsing attributes in process `syz.4.17671'. [ 1173.960326][T16384] netlink: 'syz.0.17672': attribute type 13 has an invalid length. [ 1173.969430][T16380] tipc: Resetting bearer [ 1174.037793][T16388] netlink: 8 bytes leftover after parsing attributes in process `syz.0.17672'. [ 1174.481894][T16384] tipc: Resetting bearer [ 1174.820759][T16384] veth0_vlan: left promiscuous mode [ 1175.001136][T16380] bond0: option arp_interval: mode dependency failed, not supported in mode balance-alb(6) [ 1175.078249][T16403] mac80211_hwsim hwsim3 syzkaller0: entered promiscuous mode [ 1175.091218][T16403] mac80211_hwsim hwsim3 syzkaller0: entered allmulticast mode [ 1175.097372][ T29] audit: type=1804 audit(1781104628.852:64): pid=16415 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.0.17675" name="/newroot/3563/cgroup.controllers" dev="tmpfs" ino=18005 res=1 errno=0 [ 1175.158434][ T29] audit: type=1800 audit(1781104628.872:65): pid=16415 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.17675" name="cgroup.controllers" dev="tmpfs" ino=18005 res=0 errno=0 [ 1175.218656][ T853] netdevsim netdevsim0 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1175.257735][ T853] netdevsim netdevsim0 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1175.297410][ T853] netdevsim netdevsim0 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1175.327799][ T853] netdevsim netdevsim0 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1175.373978][T16424] syzkaller0: left promiscuous mode [ 1175.412295][T16424] syzkaller0: left allmulticast mode [ 1175.427150][T16424] tipc: Resetting bearer [ 1175.475743][T16430] IPVS: set_ctl: invalid protocol: 0 10.1.1.0:20001 [ 1175.682252][T16439] netlink: 'syz.3.17680': attribute type 14 has an invalid length. [ 1176.127331][T16454] bond22: option packets_per_slave: invalid value (1048582) [ 1176.155116][T16454] bond22: option packets_per_slave: allowed values 0 - 65535 [ 1176.202857][T16454] bond22 (unregistering): Released all slaves [ 1176.655985][T16469] netlink: 8 bytes leftover after parsing attributes in process `syz.0.17683'. [ 1176.939260][ T29] audit: type=1804 audit(1781104630.692:66): pid=16483 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.0.17687" name="/newroot/3566/cgroup.controllers" dev="tmpfs" ino=18021 res=1 errno=0 [ 1176.998847][ T29] audit: type=1800 audit(1781104630.702:67): pid=16483 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.17687" name="cgroup.controllers" dev="tmpfs" ino=18021 res=0 errno=0 [ 1178.311811][ T29] audit: type=1804 audit(1781104632.062:68): pid=16518 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.4.17689" name="/newroot/3544/cgroup.controllers" dev="tmpfs" ino=17892 res=1 errno=0 [ 1178.338480][ T29] audit: type=1800 audit(1781104632.092:69): pid=16518 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.17689" name="cgroup.controllers" dev="tmpfs" ino=17892 res=0 errno=0 [ 1178.475725][T16521] bridge0: port 1(ipvlan2) entered blocking state [ 1178.482814][T16521] bridge0: port 1(ipvlan2) entered disabled state [ 1178.491471][T16521] ipvlan2: entered allmulticast mode [ 1178.501034][T16521] ipvlan2: left allmulticast mode [ 1178.526130][T16527] netlink: 292 bytes leftover after parsing attributes in process `syz.3.17692'. [ 1178.697890][T16536] netlink: 36 bytes leftover after parsing attributes in process `syz.2.17694'. [ 1178.728724][T16536] netlink: 60 bytes leftover after parsing attributes in process `syz.2.17694'. [ 1178.750265][T16527] tipc: Disabling bearer [ 1178.905457][T16540] IPv6: NLM_F_CREATE should be specified when creating new route [ 1179.028449][T16552] sctp: [Deprecated]: syz.0.17695 (pid 16552) Use of int in max_burst socket option. [ 1179.028449][T16552] Use struct sctp_assoc_value instead [ 1179.520019][T16571] tipc: Enabled bearer , priority 0 [ 1179.536600][T16571] netlink: 8 bytes leftover after parsing attributes in process `syz.3.17700'. [ 1179.913387][ T29] audit: type=1804 audit(1781104633.662:70): pid=16586 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.0.17702" name="/newroot/3570/cgroup.controllers" dev="tmpfs" ino=18047 res=1 errno=0 [ 1180.021499][ T29] audit: type=1800 audit(1781104633.662:71): pid=16586 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.17702" name="cgroup.controllers" dev="tmpfs" ino=18047 res=0 errno=0 [ 1180.356307][T16595] mac80211_hwsim hwsim3 syzkaller0: left promiscuous mode [ 1180.376638][T16595] mac80211_hwsim hwsim3 syzkaller0: left allmulticast mode [ 1180.550779][T16606] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1180.663445][T16612] bond26: invalid ARP target 0.0.0.0 specified for addition [ 1180.670913][T16612] bond26: option arp_ip_target: invalid value (0) [ 1180.974766][T16612] bond26 (unregistering): Released all slaves [ 1181.270240][T16640] netlink: 52 bytes leftover after parsing attributes in process `syz.3.17710'. [ 1181.478104][T16650] netlink: 8 bytes leftover after parsing attributes in process `syz.2.17713'. [ 1181.528616][T16650] bridge0: entered allmulticast mode [ 1181.565931][T16650] netlink: 'syz.2.17713': attribute type 1 has an invalid length. [ 1181.588786][T16650] netlink: 'syz.2.17713': attribute type 2 has an invalid length. [ 1181.612658][T16653] bond21: (slave 26): Releasing backup interface [ 1181.637843][T16653] bond21: (slave 26): last VLAN challenged slave left bond - VLAN blocking is removed [ 1181.706378][T16653] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 1181.720382][T16656] netlink: 'syz.1.17714': attribute type 3 has an invalid length. [ 1181.821512][T16656] netlink: 132 bytes leftover after parsing attributes in process `syz.1.17714'. [ 1182.512316][T16687] tipc: Resetting bearer [ 1182.526934][T16687] netlink: 'syz.4.17724': attribute type 3 has an invalid length. [ 1182.535874][T16687] netlink: 132 bytes leftover after parsing attributes in process `syz.4.17724'. [ 1182.765028][T16694] netlink: 'syz.4.17726': attribute type 27 has an invalid length. [ 1183.034458][T16696] xt_hashlimit: max too large, truncated to 1048576 [ 1183.648566][T16721] tipc: Resetting bearer [ 1183.690093][T16728] netlink: 'syz.4.17733': attribute type 13 has an invalid length. [ 1183.703426][T16728] netlink: 'syz.4.17733': attribute type 17 has an invalid length. [ 1183.896515][T16734] netlink: 4 bytes leftover after parsing attributes in process `syz.4.17733'. [ 1184.146801][T16728] syz_tun: left promiscuous mode [ 1184.171741][T16728] 8021q: adding VLAN 0 to HW filter on device team0 [ 1184.290407][T16728] A link change request failed with some changes committed already. Interface virt_wifi0 may have been left with an inconsistent configuration, please check. [ 1184.462998][T16743] netlink: 16 bytes leftover after parsing attributes in process `syz.0.17735'. [ 1185.321495][T16771] netlink: 'syz.3.17742': attribute type 1 has an invalid length. [ 1185.559649][T16783] netlink: 12 bytes leftover after parsing attributes in process `syz.0.17747'. [ 1185.852678][T16791] netlink: 80 bytes leftover after parsing attributes in process `syz.2.17748'. [ 1185.891712][T16791] netlink: 8 bytes leftover after parsing attributes in process `syz.2.17748'. [ 1185.984801][T16800] netlink: 4 bytes leftover after parsing attributes in process `syz.3.17752'. [ 1186.030912][T16800] : renamed from sit0 (while UP) [ 1186.092327][T16805] netlink: 24 bytes leftover after parsing attributes in process `syz.4.17753'. [ 1186.138612][T16805] gre6: entered promiscuous mode [ 1186.507178][T16825] netlink: 16 bytes leftover after parsing attributes in process `syz.3.17758'. [ 1186.567320][T16829] netlink: 4 bytes leftover after parsing attributes in process `syz.0.17760'. [ 1186.711480][T16833] netlink: 4 bytes leftover after parsing attributes in process `syz.0.17760'. [ 1187.035308][T16843] : renamed from sit0 [ 1187.046213][T16846] netlink: 'syz.3.17765': attribute type 12 has an invalid length. [ 1189.171999][T16932] netlink: 'syz.4.17789': attribute type 1 has an invalid length. [ 1189.308343][T16941] __nla_validate_parse: 6 callbacks suppressed [ 1189.308362][T16941] netlink: 4 bytes leftover after parsing attributes in process `syz.2.17793'. [ 1189.334007][T16939] netlink: 12 bytes leftover after parsing attributes in process `syz.1.17792'. [ 1189.484848][T16945] RDS: rds_bind could not find a transport for fc02::, load rds_tcp or rds_rdma? [ 1189.645482][T16959] netlink: 4 bytes leftover after parsing attributes in process `syz.0.17799'. [ 1189.665362][T16959] netlink: 256 bytes leftover after parsing attributes in process `syz.0.17799'. [ 1189.675648][T16960] netlink: 'syz.2.17797': attribute type 1 has an invalid length. [ 1190.107641][T16980] netlink: 20 bytes leftover after parsing attributes in process `syz.1.17802'. [ 1190.390317][T16995] netlink: 12 bytes leftover after parsing attributes in process `syz.4.17805'. [ 1190.459965][T17000] netlink: 4 bytes leftover after parsing attributes in process `syz.4.17805'. [ 1191.911202][T17042] netlink: 4 bytes leftover after parsing attributes in process `syz.3.17808'. [ 1192.062038][T17049] xt_hashlimit: size too large, truncated to 1048576 [ 1192.151503][T17056] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1192.247889][T17051] openvswitch: netlink: Unexpected mask (mask=240, allowed=10048) [ 1192.465030][T17056] netlink: 4 bytes leftover after parsing attributes in process `syz.2.17814'. [ 1192.588481][T17072] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1193.123939][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1193.306986][T17083] netlink: 36 bytes leftover after parsing attributes in process `syz.3.17818'. [ 1193.396432][T17090] netlink: 'syz.2.17820': attribute type 62 has an invalid length. [ 1193.665459][T17095] 8021q: adding VLAN 0 to HW filter on device team0 [ 1193.691853][T17095] 8021q: adding VLAN 0 to HW filter on device 60X [ 1193.875718][T17095] veth1_vlan: left promiscuous mode [ 1193.882870][T17095] veth0_vlan: entered promiscuous mode [ 1193.894666][T17095] veth1_vlan: entered promiscuous mode [ 1193.922494][T17095] A link change request failed with some changes committed already. Interface may have been left with an inconsistent configuration, please check. [ 1194.018578][ T5895] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1194.035960][ T5895] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1194.049414][ T5895] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1194.070435][ T5895] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1194.396548][ T29] audit: type=1804 audit(1781104648.152:72): pid=17118 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.2.17825" name="/newroot/3575/cgroup.controllers" dev="tmpfs" ino=18081 res=1 errno=0 [ 1194.454597][ T29] audit: type=1800 audit(1781104648.182:73): pid=17118 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.17825" name="cgroup.controllers" dev="tmpfs" ino=18081 res=0 errno=0 [ 1194.507043][ T29] audit: type=1804 audit(1781104648.202:74): pid=17121 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.4.17826" name="/newroot/3576/cgroup.controllers" dev="tmpfs" ino=18055 res=1 errno=0 [ 1194.606082][ T29] audit: type=1800 audit(1781104648.202:75): pid=17121 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.17826" name="cgroup.controllers" dev="tmpfs" ino=18055 res=0 errno=0 [ 1194.627588][T17127] __nla_validate_parse: 2 callbacks suppressed [ 1194.627607][T17127] netlink: 20 bytes leftover after parsing attributes in process `syz.3.17828'. [ 1194.644600][T17128] bridge0: left allmulticast mode [ 1194.677537][ T29] audit: type=1804 audit(1781104648.212:76): pid=17121 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.4.17826" name="/newroot/3576/cgroup.controllers" dev="tmpfs" ino=18055 res=1 errno=0 [ 1194.689751][T17128] vlan0: left promiscuous mode [ 1194.745004][T17128] bond16: left allmulticast mode [ 1194.750841][T17128] bond19: left allmulticast mode [ 1194.762269][T17128] bond20: left allmulticast mode [ 1194.775487][T17128] vlan3: left promiscuous mode [ 1194.780271][T17128] bridge0: left promiscuous mode [ 1195.134217][ T846] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1195.145466][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1195.549365][T17156] netlink: 8 bytes leftover after parsing attributes in process `syz.4.17834'. [ 1195.764264][ T846] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1195.775697][ T3256] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1195.787286][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1195.825276][T17162] netlink: 40 bytes leftover after parsing attributes in process `syz.4.17835'. [ 1195.899439][T17164] netlink: 'syz.2.17836': attribute type 62 has an invalid length. [ 1195.959254][T17166] netlink: 44 bytes leftover after parsing attributes in process `syz.0.17837'. [ 1195.968589][T17166] netlink: 47 bytes leftover after parsing attributes in process `syz.0.17837'. [ 1195.978471][T17166] netlink: 'syz.0.17837': attribute type 6 has an invalid length. [ 1195.986800][T17166] netlink: 'syz.0.17837': attribute type 6 has an invalid length. [ 1196.213551][T17170] netlink: 56 bytes leftover after parsing attributes in process `syz.0.17838'. [ 1196.233969][T17170] netlink: 4 bytes leftover after parsing attributes in process `syz.0.17838'. [ 1196.555905][T17183] netlink: 12 bytes leftover after parsing attributes in process `syz.4.17841'. [ 1196.702577][T17186] netlink: 'syz.4.17843': attribute type 3 has an invalid length. [ 1196.847620][T17190] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1197.131052][T17188] block nbd4: NBD_DISCONNECT [ 1197.186188][T17197] A link change request failed with some changes committed already. Interface may have been left with an inconsistent configuration, please check. [ 1197.346955][T17197] mac80211_hwsim hwsim38 wlan0: entered promiscuous mode [ 1197.376538][T17205] netlink: 8 bytes leftover after parsing attributes in process `syz.2.17846'. [ 1197.383349][T17197] mac80211_hwsim hwsim38 wlan0: entered allmulticast mode [ 1197.609606][T17211] netlink: 4 bytes leftover after parsing attributes in process `syz.1.17848'. [ 1197.727130][T17214] netlink: 'syz.1.17850': attribute type 13 has an invalid length. [ 1198.243577][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1198.382551][T17234] netlink: 'syz.3.17854': attribute type 62 has an invalid length. [ 1200.254441][ T3306] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1200.263259][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1200.884193][ T5895] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1200.893475][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1201.088871][T17242] netlink: 'syz.4.17856': attribute type 4 has an invalid length. [ 1201.113536][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1201.140141][T17242] netlink: 'syz.4.17856': attribute type 4 has an invalid length. [ 1201.162524][T17249] __nla_validate_parse: 3 callbacks suppressed [ 1201.162543][T17249] netlink: 36 bytes leftover after parsing attributes in process `syz.2.17858'. [ 1201.223533][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1201.363952][ T9536] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 1201.523676][ T5896] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1201.564652][T17263] netlink: 8 bytes leftover after parsing attributes in process `syz.4.17860'. [ 1201.687616][T17265] syzkaller1: entered promiscuous mode [ 1201.703318][T17265] syzkaller1: entered allmulticast mode [ 1201.739930][T17240] RDS: rds_bind could not find a transport for ::ffff:172.20.20.170, load rds_tcp or rds_rdma? [ 1202.083448][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1202.174804][ T9537] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 1202.183529][T17281] netlink: 'syz.2.17865': attribute type 62 has an invalid length. [ 1202.329290][T12368] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 1202.383572][T17292] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1202.403496][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1202.431336][T17292] tipc: Enabled bearer , priority 10 [ 1202.494620][T17295] Bluetooth: hci0: Opcode 0x0401 failed: -22 [ 1202.513629][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1202.613493][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1202.783769][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1202.922300][T17309] netlink: 28 bytes leftover after parsing attributes in process `syz.4.17873'. [ 1202.951804][T17318] netlink: 8 bytes leftover after parsing attributes in process `syz.3.17874'. [ 1202.997118][T17320] netlink: 'syz.4.17873': attribute type 1 has an invalid length. [ 1203.046424][T17304] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for gretap5 [ 1203.286037][T17332] netlink: 4 bytes leftover after parsing attributes in process `syz.3.17876'. [ 1203.313480][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1203.376932][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1204.323505][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1205.371494][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1205.374095][ T846] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1206.188184][ T5896] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 1206.216914][ T5896] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 1206.218617][T17342] netlink: 8 bytes leftover after parsing attributes in process `syz.2.17877'. [ 1206.418026][T17349] bond11: entered allmulticast mode [ 1206.809538][ T9537] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 1206.858943][T17369] netlink: 4456 bytes leftover after parsing attributes in process `syz.2.17881'. [ 1207.443845][ C0] net_ratelimit: 5 callbacks suppressed [ 1207.443898][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1207.458144][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1208.488167][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1208.496645][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1208.505072][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1209.526814][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1209.535001][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1209.697998][T17380] faux_driver regulatory: loading /lib/firmware/regulatory.db failed with error -4 [ 1209.743354][T17380] faux_driver regulatory: Direct firmware load for regulatory.db failed with error -4 [ 1209.761026][T17380] faux_driver regulatory: Falling back to sysfs fallback for: regulatory.db [ 1209.820707][T17387] netlink: 8 bytes leftover after parsing attributes in process `syz.4.17884'. [ 1209.898242][T17381] tipc: Resetting bearer [ 1209.968793][T17397] netlink: 'syz.0.17885': attribute type 62 has an invalid length. [ 1210.075075][T17393] bridge20: entered promiscuous mode [ 1210.101346][T17393] bridge20: entered allmulticast mode [ 1210.163863][ C1] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 1210.169828][T17404] netlink: 4 bytes leftover after parsing attributes in process `syz.4.17889'. [ 1210.246111][T17402] bridge19: entered promiscuous mode [ 1210.262632][T17402] bridge19: entered allmulticast mode [ 1210.304987][T17393] bridge20: entered promiscuous mode [ 1210.310533][T17393] bridge20: entered allmulticast mode [ 1210.485358][ T3306] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1210.494100][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1210.532022][T17420] netlink: 8 bytes leftover after parsing attributes in process `syz.4.17891'. [ 1210.563674][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1210.597472][T17423] netlink: 8 bytes leftover after parsing attributes in process `syz.1.17892'. [ 1210.613982][T17425] netlink: 'syz.2.17893': attribute type 13 has an invalid length. [ 1210.638696][T17425] netlink: 'syz.2.17893': attribute type 17 has an invalid length. [ 1210.714526][T17427] netlink: 4 bytes leftover after parsing attributes in process `syz.3.17894'. [ 1210.814253][T17428] netlink: 4 bytes leftover after parsing attributes in process `syz.2.17893'. [ 1210.859788][T17425] ip_vti0: left promiscuous mode [ 1210.870150][T17425] : left promiscuous mode [ 1210.916255][T17425] bond0: left promiscuous mode [ 1210.928245][T17425] erspan1: left promiscuous mode [ 1210.935275][T17425] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1210.946649][T17425] 0X: left allmulticast mode [ 1210.952614][T17425] 8021q: adding VLAN 0 to HW filter on device 60X [ 1210.984680][T17425] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 1210.995178][T17425] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 1211.007487][T17425] veth1_vlan: left promiscuous mode [ 1211.016188][T17425] veth0_vlan: left promiscuous mode [ 1211.022096][T17425] veth0_vlan: entered promiscuous mode [ 1211.030876][T17425] veth1_vlan: entered promiscuous mode [ 1211.048633][T17425] mac80211_hwsim hwsim6 wlan0: left promiscuous mode [ 1211.057034][T17425] mac80211_hwsim hwsim6 wlan0: left allmulticast mode [ 1211.066607][T17424] netlink: 28 bytes leftover after parsing attributes in process `syz.3.17894'. [ 1211.162792][T17430] bridge0: port 1(batadv0) entered blocking state [ 1211.169650][T17430] bridge0: port 1(batadv0) entered disabled state [ 1211.176673][T17430] batadv0: entered allmulticast mode [ 1211.183885][T17430] batadv0: entered promiscuous mode [ 1211.454493][T17445] netlink: 8 bytes leftover after parsing attributes in process `syz.3.17898'. [ 1211.485118][T17442] netlink: 16 bytes leftover after parsing attributes in process `syz.1.17899'. [ 1211.526526][T17452] netlink: 4 bytes leftover after parsing attributes in process `syz.2.17900'. [ 1211.663529][ T3256] batman_adv: batadv0: No IGMP Querier present - multicast optimizations disabled [ 1211.672875][ T3256] batman_adv: batadv0: No MLD Querier present - multicast optimizations disabled [ 1211.924900][T17435] tipc: Resetting bearer [ 1211.970329][ T9535] syz2: Port: 1 Link ACTIVE [ 1211.975095][ T853] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1211.986644][ T853] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1212.035169][ T853] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1212.056691][ T853] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1212.249140][T17460] netlink: 24 bytes leftover after parsing attributes in process `syz.4.17901'. [ 1212.272925][T17472] netlink: 20 bytes leftover after parsing attributes in process `syz.2.17904'. [ 1212.420686][T17476] netlink: 8 bytes leftover after parsing attributes in process `syz.4.17906'. [ 1212.651858][ C0] net_ratelimit: 11 callbacks suppressed [ 1212.651872][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1213.693050][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1214.243673][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1214.729045][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1215.042802][T17486] netlink: 24 bytes leftover after parsing attributes in process `syz.4.17907'. [ 1215.128728][ T29] audit: type=1804 audit(1781104668.882:77): pid=17490 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.0.17909" name="/newroot/3608/cgroup.controllers" dev="tmpfs" ino=18241 res=1 errno=0 [ 1215.178364][ T29] audit: type=1800 audit(1781104668.912:78): pid=17490 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.17909" name="cgroup.controllers" dev="tmpfs" ino=18241 res=0 errno=0 [ 1215.228006][T17495] netlink: 24 bytes leftover after parsing attributes in process `syz.2.17908'. [ 1215.763604][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1216.803435][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1217.843524][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1218.063007][ T5896] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 1218.099226][T17511] netlink: 292 bytes leftover after parsing attributes in process `syz.3.17913'. [ 1218.137632][T17511] netlink: 4 bytes leftover after parsing attributes in process `syz.3.17913'. [ 1218.158824][T17511] vlan7 (unregistering): left allmulticast mode [ 1218.167577][T17511] geneve0 (unregistering): left allmulticast mode [ 1218.197150][T17511] vlan7 (unregistering): left promiscuous mode [ 1218.210128][T17511] geneve0 (unregistering): left promiscuous mode [ 1218.217237][T17511] bridge0: port 1(vlan7) entered disabled state [ 1218.305852][T17518] GUP no longer grows the stack in syz.2.17916 (17518): 200000003000-20000000a000 (200000001000) [ 1218.319865][T17522] netlink: 8 bytes leftover after parsing attributes in process `syz.0.17917'. [ 1218.336340][T17518] CPU: 0 UID: 0 PID: 17518 Comm: syz.2.17916 Not tainted syzkaller #0 PREEMPT(full) [ 1218.336367][T17518] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1218.336380][T17518] Call Trace: [ 1218.336389][T17518] [ 1218.336397][T17518] dump_stack_lvl+0xe8/0x150 [ 1218.336426][T17518] __get_user_pages+0x2378/0x2730 [ 1218.336471][T17518] ? __gup_longterm_locked+0xc4e/0x1630 [ 1218.336495][T17518] ? down_read_killable+0x1bb/0x340 [ 1218.336527][T17518] __gup_longterm_locked+0xdcf/0x1630 [ 1218.336555][T17518] ? lock_acquire+0x106/0x350 [ 1218.336593][T17518] gup_fast_fallback+0x1d84/0x20d0 [ 1218.336649][T17518] ? __pfx_gup_fast_fallback+0x10/0x10 [ 1218.336671][T17518] ? futex_unqueue+0x22/0x240 [ 1218.336729][T17518] ? futex_unqueue+0x22/0x240 [ 1218.336745][T17518] ? futex_unqueue+0x22/0x240 [ 1218.336764][T17518] ? is_valid_gup_args+0x11f/0x200 [ 1218.336790][T17518] ? get_user_pages_fast+0x4d/0xb0 [ 1218.336815][T17518] __iov_iter_get_pages_alloc+0x370/0xa10 [ 1218.336930][T17518] ? __pfx_pipe_clear_nowait+0x10/0x10 [ 1218.336965][T17518] iov_iter_get_pages2+0x5e/0xa0 [ 1218.336993][T17518] __se_sys_vmsplice+0x7c7/0x1620 [ 1218.337042][T17518] ? __pfx___se_sys_vmsplice+0x10/0x10 [ 1218.337070][T17518] ? __pfx_futex_wait+0x10/0x10 [ 1218.337110][T17518] ? fdget+0x148/0x1e0 [ 1218.337153][T17518] ? put_files_struct+0x256/0x350 [ 1218.337175][T17518] ? 0xffffffffff600000 [ 1218.337227][T17518] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1218.337261][T17518] do_syscall_64+0x174/0x580 [ 1218.337283][T17518] ? trace_irq_disable+0x3b/0x140 [ 1218.337315][T17518] ? clear_bhb_loop+0x40/0x90 [ 1218.337341][T17518] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1218.337361][T17518] RIP: 0033:0x7f4a7cb9ce59 [ 1218.337377][T17518] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1218.337396][T17518] RSP: 002b:00007f4a7dafa028 EFLAGS: 00000246 ORIG_RAX: 0000000000000116 [ 1218.337417][T17518] RAX: ffffffffffffffda RBX: 00007f4a7ce15fa0 RCX: 00007f4a7cb9ce59 [ 1218.337432][T17518] RDX: 0000000000000001 RSI: 00002000000000c0 RDI: 0000000000000008 [ 1218.337446][T17518] RBP: 00007f4a7cc32d6f R08: 0000000000000000 R09: 0000000000000000 [ 1218.337458][T17518] R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000000 [ 1218.337470][T17518] R13: 00007f4a7ce16038 R14: 00007f4a7ce15fa0 R15: 00007ffcb84bb338 [ 1218.337505][T17518] [ 1218.862436][T17535] netlink: 12 bytes leftover after parsing attributes in process `syz.2.17919'. [ 1218.883459][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1218.991786][T17535] veth31: entered allmulticast mode [ 1219.040108][T17535] bond27: (slave veth31): Enslaving as an active interface with an up link [ 1219.075430][T17537] bond27 (unregistering): (slave veth31): Releasing backup interface [ 1219.103943][T17537] bond27 (unregistering): Released all slaves [ 1219.283541][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1219.385993][T17548] syzkaller0: entered promiscuous mode [ 1219.399267][T17548] syzkaller0: entered allmulticast mode [ 1219.406012][T17546] netlink: 8 bytes leftover after parsing attributes in process `syz.3.17922'. [ 1219.427698][T17546] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1219.469663][T17557] netlink: 24 bytes leftover after parsing attributes in process `syz.4.17926'. [ 1219.668265][T17566] netlink: 36 bytes leftover after parsing attributes in process `syz.4.17927'. [ 1219.933008][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1220.967378][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1222.008540][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1222.252003][ C1] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 1222.820647][T17570] xt_CT: No such helper "snmp" [ 1222.927542][T17575] netlink: 80 bytes leftover after parsing attributes in process `syz.2.17929'. [ 1223.026785][T17590] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for gretap4 [ 1223.043413][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1223.078843][T17584] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1223.091404][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1223.138568][T17584] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1223.158976][ T9532] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1223.176237][ T9513] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1223.452330][T17580] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1223.465659][ T9513] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1223.509142][T17580] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1223.569120][T17580] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1223.744982][T17617] mac80211_hwsim hwsim6 syzkaller0: left promiscuous mode [ 1223.752392][T17617] mac80211_hwsim hwsim6 syzkaller0: left allmulticast mode [ 1223.899843][T17624] netlink: 28 bytes leftover after parsing attributes in process `syz.1.17942'. [ 1225.498369][T17670] netlink: 12 bytes leftover after parsing attributes in process `syz.0.17952'. [ 1225.595410][ T4946] block nbd3: Receive control failed (result -1) [ 1225.886892][T17683] netlink: 8 bytes leftover after parsing attributes in process `syz.3.17954'. [ 1226.272671][T17693] tipc: Resetting bearer [ 1226.297837][T17698] tipc: Enabled bearer , priority 0 [ 1226.435215][T17701] netlink: 8 bytes leftover after parsing attributes in process `syz.2.17958'. [ 1226.696764][T17710] netlink: 'syz.2.17961': attribute type 2 has an invalid length. [ 1226.732997][T17706] netlink: 24 bytes leftover after parsing attributes in process `syz.4.17960'. [ 1226.747012][T17710] netlink: 'syz.2.17961': attribute type 2 has an invalid length. [ 1226.886604][T17706] netlink: 8 bytes leftover after parsing attributes in process `syz.4.17960'. [ 1227.136097][T17718] netlink: 8 bytes leftover after parsing attributes in process `syz.0.17963'. [ 1227.576395][T17730] dvmrp0: entered allmulticast mode [ 1227.829348][T17733] bridge0: trying to set multicast startup query interval below minimum, setting to 100 (1000ms) [ 1227.925025][T17734] sysfs: cannot create duplicate filename '/class/ieee80211/1^!Y [ 1227.925025][T17734] 3UH5rBn\' [ 1227.954784][T17734] CPU: 0 UID: 0 PID: 17734 Comm: syz.0.17969 Not tainted syzkaller #0 PREEMPT(full) [ 1227.954814][T17734] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1227.954834][T17734] Call Trace: [ 1227.954842][T17734] [ 1227.954851][T17734] dump_stack_lvl+0xe8/0x150 [ 1227.954885][T17734] sysfs_warn_dup+0x8e/0xa0 [ 1227.954942][T17734] sysfs_do_create_link_sd+0xc0/0x110 [ 1227.954972][T17734] device_add_class_symlinks+0x1cf/0x240 [ 1227.955187][T17734] device_add+0x475/0xbb0 [ 1227.955223][T17734] wiphy_register+0x1fb1/0x2fe0 [ 1227.955349][T17734] ? __pfx_wiphy_register+0x10/0x10 [ 1227.955381][T17734] ? __pfx_netdev_run_todo+0x10/0x10 [ 1227.955449][T17734] ? minstrel_ht_alloc+0x6e0/0x7e0 [ 1227.955544][T17734] ? ieee80211_init_rate_ctrl_alg+0x55d/0x5d0 [ 1227.955644][T17734] ieee80211_register_hw+0x3c53/0x4910 [ 1227.955705][T17734] ? ieee80211_register_hw+0x19b1/0x4910 [ 1227.955759][T17734] ? __pfx_ieee80211_register_hw+0x10/0x10 [ 1227.955786][T17734] ? __asan_memset+0x22/0x50 [ 1227.955815][T17734] ? __hrtimer_setup+0x1b7/0x260 [ 1227.955848][T17734] ? __pfx_mac80211_hwsim_beacon+0x10/0x10 [ 1227.955927][T17734] mac80211_hwsim_new_radio+0x3306/0x57b0 [ 1227.955984][T17734] ? __pfx_mac80211_hwsim_new_radio+0x10/0x10 [ 1227.956012][T17734] ? __asan_memcpy+0x40/0x70 [ 1227.956043][T17734] hwsim_new_radio_nl+0xd96/0xfa0 [ 1227.956081][T17734] genl_family_rcv_msg_doit+0x22a/0x330 [ 1227.956182][T17734] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 1227.956227][T17734] ? bpf_lsm_capable+0x9/0x20 [ 1227.956248][T17734] ? security_capable+0x7e/0x2c0 [ 1227.956347][T17734] genl_rcv_msg+0x61c/0x7a0 [ 1227.956385][T17734] ? __pfx_genl_rcv_msg+0x10/0x10 [ 1227.956414][T17734] ? __pfx_hwsim_new_radio_nl+0x10/0x10 [ 1227.956436][T17734] ? __pfx_ref_tracker_free+0x10/0x10 [ 1227.956508][T17734] netlink_rcv_skb+0x232/0x4b0 [ 1227.956535][T17734] ? __pfx_genl_rcv_msg+0x10/0x10 [ 1227.956566][T17734] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 1227.956609][T17734] ? down_read+0x270/0x2e0 [ 1227.956633][T17734] ? genl_rcv+0xd/0x40 [ 1227.956664][T17734] genl_rcv+0x28/0x40 [ 1227.956690][T17734] netlink_unicast+0x75c/0x8e0 [ 1227.956724][T17734] netlink_sendmsg+0x813/0xb40 [ 1227.956760][T17734] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1227.956789][T17734] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1227.956822][T17734] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1227.956860][T17734] ____sys_sendmsg+0x972/0x9f0 [ 1227.956885][T17734] ? __might_fault+0xaf/0x130 [ 1227.956920][T17734] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1227.956955][T17734] ? import_iovec+0x73/0xa0 [ 1227.956984][T17734] ___sys_sendmsg+0x2a5/0x360 [ 1227.957006][T17734] ? __lock_acquire+0x6b5/0x2cf0 [ 1227.957034][T17734] ? __pfx____sys_sendmsg+0x10/0x10 [ 1227.957066][T17734] ? futex_wake+0x4ac/0x580 [ 1227.957124][T17734] ? __fget_files+0x2a/0x420 [ 1227.957149][T17734] ? __fget_files+0x3a0/0x420 [ 1227.957186][T17734] __x64_sys_sendmsg+0x1bd/0x2a0 [ 1227.957214][T17734] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1227.957248][T17734] ? rcu_is_watching+0x15/0xb0 [ 1227.957294][T17734] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1227.957318][T17734] do_syscall_64+0x174/0x580 [ 1227.957341][T17734] ? clear_bhb_loop+0x40/0x90 [ 1227.957367][T17734] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1227.957388][T17734] RIP: 0033:0x7fdaba39ce59 [ 1227.957409][T17734] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1227.957427][T17734] RSP: 002b:00007fdabb248028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1227.957449][T17734] RAX: ffffffffffffffda RBX: 00007fdaba615fa0 RCX: 00007fdaba39ce59 [ 1227.957464][T17734] RDX: 0000000000000000 RSI: 00002000000000c0 RDI: 0000000000000006 [ 1227.957477][T17734] RBP: 00007fdaba432d6f R08: 0000000000000000 R09: 0000000000000000 [ 1227.957491][T17734] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1227.957504][T17734] R13: 00007fdaba616038 R14: 00007fdaba615fa0 R15: 00007fff2e391718 [ 1227.957540][T17734] [ 1228.346678][ C0] net_ratelimit: 6 callbacks suppressed [ 1228.346696][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1229.077038][T17762] netlink: 36 bytes leftover after parsing attributes in process `syz.1.17974'. [ 1229.321893][T17769] netlink: 4 bytes leftover after parsing attributes in process `syz.1.17974'. [ 1229.363385][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1229.619842][T17776] [ 1229.622208][T17776] ====================================================== [ 1229.629225][T17776] WARNING: possible circular locking dependency detected [ 1229.636256][T17776] syzkaller #0 Not tainted [ 1229.640672][T17776] ------------------------------------------------------ [ 1229.647708][T17776] syz.0.17976/17776 is trying to acquire lock: [ 1229.653945][T17776] ffff888047ff3f18 (set->srcu){.+.+}-{0:0}, at: __synchronize_srcu+0xb6/0x300 [ 1229.662852][T17776] [ 1229.662852][T17776] but task is already holding lock: [ 1229.670223][T17776] ffff88802b852ac8 (&q->elevator_lock){+.+.}-{4:4}, at: elevator_change+0x1b3/0x450 [ 1229.679772][T17776] [ 1229.679772][T17776] which lock already depends on the new lock. [ 1229.679772][T17776] [ 1229.690185][T17776] [ 1229.690185][T17776] the existing dependency chain (in reverse order) is: [ 1229.699212][T17776] [ 1229.699212][T17776] -> #6 (&q->elevator_lock){+.+.}-{4:4}: [ 1229.707054][T17776] __mutex_lock+0x1a3/0x1550 [ 1229.712192][T17776] elevator_change+0x1b3/0x450 [ 1229.717579][T17776] elevator_set_none+0xb5/0x140 [ 1229.722959][T17776] blk_mq_update_nr_hw_queues+0x5e7/0x1a60 [ 1229.729376][T17776] nbd_start_device+0x17f/0xb10 [ 1229.735053][T17776] nbd_genl_connect+0x165b/0x1cf0 [ 1229.740599][T17776] genl_family_rcv_msg_doit+0x22a/0x330 [ 1229.746693][T17776] genl_rcv_msg+0x61c/0x7a0 [ 1229.751712][T17776] netlink_rcv_skb+0x232/0x4b0 [ 1229.756996][T17776] genl_rcv+0x28/0x40 [ 1229.761494][T17776] netlink_unicast+0x75c/0x8e0 [ 1229.766771][T17776] netlink_sendmsg+0x813/0xb40 [ 1229.772055][T17776] ____sys_sendmsg+0x972/0x9f0 [ 1229.777327][T17776] ___sys_sendmsg+0x2a5/0x360 [ 1229.782533][T17776] __x64_sys_sendmsg+0x1bd/0x2a0 [ 1229.787981][T17776] do_syscall_64+0x174/0x580 [ 1229.793081][T17776] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1229.799489][T17776] [ 1229.799489][T17776] -> #5 (&q->q_usage_counter(io)#54){++++}-{0:0}: [ 1229.808086][T17776] blk_alloc_queue+0x546/0x680 [ 1229.813433][T17776] __blk_mq_alloc_disk+0x197/0x390 [ 1229.819145][T17776] nbd_dev_add+0x499/0xb50 [ 1229.824078][T17776] nbd_init+0x168/0x1f0 [ 1229.828880][T17776] do_one_initcall+0x250/0x870 [ 1229.834154][T17776] do_initcall_level+0x104/0x190 [ 1229.839631][T17776] do_initcalls+0x59/0xa0 [ 1229.844814][T17776] kernel_init_freeable+0x2a6/0x3e0 [ 1229.850522][T17776] kernel_init+0x1d/0x1d0 [ 1229.855362][T17776] ret_from_fork+0x514/0xb70 [ 1229.860497][T17776] ret_from_fork_asm+0x1a/0x30 [ 1229.865773][T17776] [ 1229.865773][T17776] -> #4 (fs_reclaim){+.+.}-{0:0}: [ 1229.872982][T17776] fs_reclaim_acquire+0x71/0x100 [ 1229.878443][T17776] kmem_cache_alloc_node_noprof+0x4a/0x690 [ 1229.884869][T17776] __alloc_skb+0x1d0/0x7d0 [ 1229.889892][T17776] __ip6_append_data+0x2d3c/0x3f60 [ 1229.895596][T17776] ip6_append_data+0x10f/0x280 [ 1229.900871][T17776] rawv6_sendmsg+0x12d3/0x18e0 [ 1229.906210][T17776] ____sys_sendmsg+0x80a/0x9f0 [ 1229.911482][T17776] ___sys_sendmsg+0x2a5/0x360 [ 1229.916760][T17776] __x64_sys_sendmsg+0x1bd/0x2a0 [ 1229.922210][T17776] do_syscall_64+0x174/0x580 [ 1229.927401][T17776] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1229.933801][T17776] [ 1229.933801][T17776] -> #3 (sk_lock-AF_INET6){+.+.}-{0:0}: [ 1229.941554][T17776] lock_sock_nested+0x41/0x100 [ 1229.946901][T17776] inet_shutdown+0x6a/0x390 [ 1229.951973][T17776] nbd_mark_nsock_dead+0x2e9/0x560 [ 1229.957627][T17776] recv_work+0x1c2e/0x1d40 [ 1229.962559][T17776] process_scheduled_works+0xb5d/0x1860 [ 1229.968642][T17776] worker_thread+0xa53/0xfc0 [ 1229.973838][T17776] kthread+0x389/0x470 [ 1229.978430][T17776] ret_from_fork+0x514/0xb70 [ 1229.983528][T17776] ret_from_fork_asm+0x1a/0x30 [ 1229.988801][T17776] [ 1229.988801][T17776] -> #2 (&nsock->tx_lock){+.+.}-{4:4}: [ 1229.996432][T17776] __mutex_lock+0x1a3/0x1550 [ 1230.001533][T17776] nbd_queue_rq+0x37b/0x1100 [ 1230.006635][T17776] blk_mq_dispatch_rq_list+0xa70/0x1910 [ 1230.012716][T17776] __blk_mq_sched_dispatch_requests+0xdcc/0x1600 [ 1230.019623][T17776] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 1230.026118][T17776] blk_mq_run_hw_queue+0x348/0x4f0 [ 1230.031740][T17776] blk_mq_dispatch_list+0xd16/0xe10 [ 1230.037445][T17776] blk_mq_flush_plug_list+0x48d/0x570 [ 1230.043585][T17776] __blk_flush_plug+0x3ed/0x4d0 [ 1230.048947][T17776] __submit_bio+0x28d/0x580 [ 1230.053961][T17776] submit_bio_noacct_nocheck+0x2f4/0xa40 [ 1230.060101][T17776] block_read_full_folio+0x599/0x830 [ 1230.065902][T17776] filemap_read_folio+0x137/0x3b0 [ 1230.071461][T17776] do_read_cache_folio+0x358/0x590 [ 1230.077099][T17776] read_part_sector+0xb6/0x2b0 [ 1230.082382][T17776] adfspart_check_ICS+0xb1/0x960 [ 1230.087908][T17776] bdev_disk_changed+0x817/0x1770 [ 1230.093443][T17776] blkdev_get_whole+0x380/0x510 [ 1230.098803][T17776] bdev_open+0x31e/0xd30 [ 1230.103556][T17776] blkdev_open+0x470/0x610 [ 1230.108507][T17776] do_dentry_open+0x822/0x13a0 [ 1230.113783][T17776] vfs_open+0x3b/0x340 [ 1230.118364][T17776] path_openat+0x2e08/0x3860 [ 1230.123466][T17776] do_file_open+0x23e/0x4a0 [ 1230.128493][T17776] do_sys_openat2+0x113/0x200 [ 1230.133701][T17776] __x64_sys_openat+0x138/0x170 [ 1230.139068][T17776] do_syscall_64+0x174/0x580 [ 1230.144186][T17776] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1230.150593][T17776] [ 1230.150593][T17776] -> #1 (&cmd->lock){+.+.}-{4:4}: [ 1230.157798][T17776] __mutex_lock+0x1a3/0x1550 [ 1230.162911][T17776] nbd_queue_rq+0xc6/0x1100 [ 1230.167931][T17776] blk_mq_dispatch_rq_list+0xa70/0x1910 [ 1230.173991][T17776] __blk_mq_sched_dispatch_requests+0xdcc/0x1600 [ 1230.180932][T17776] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 1230.187453][T17776] blk_mq_run_hw_queue+0x348/0x4f0 [ 1230.193094][T17776] blk_mq_dispatch_list+0xd16/0xe10 [ 1230.198805][T17776] blk_mq_flush_plug_list+0x48d/0x570 [ 1230.204690][T17776] __blk_flush_plug+0x3ed/0x4d0 [ 1230.210054][T17776] __submit_bio+0x28d/0x580 [ 1230.215161][T17776] submit_bio_noacct_nocheck+0x2f4/0xa40 [ 1230.221307][T17776] block_read_full_folio+0x599/0x830 [ 1230.227102][T17776] filemap_read_folio+0x137/0x3b0 [ 1230.232643][T17776] do_read_cache_folio+0x358/0x590 [ 1230.238264][T17776] read_part_sector+0xb6/0x2b0 [ 1230.243541][T17776] adfspart_check_ICS+0xb1/0x960 [ 1230.249024][T17776] bdev_disk_changed+0x817/0x1770 [ 1230.254558][T17776] blkdev_get_whole+0x380/0x510 [ 1230.259926][T17776] bdev_open+0x31e/0xd30 [ 1230.264690][T17776] blkdev_open+0x470/0x610 [ 1230.269629][T17776] do_dentry_open+0x822/0x13a0 [ 1230.274910][T17776] vfs_open+0x3b/0x340 [ 1230.279494][T17776] path_openat+0x2e08/0x3860 [ 1230.284709][T17776] do_file_open+0x23e/0x4a0 [ 1230.289814][T17776] do_sys_openat2+0x113/0x200 [ 1230.295019][T17776] __x64_sys_openat+0x138/0x170 [ 1230.300391][T17776] do_syscall_64+0x174/0x580 [ 1230.305495][T17776] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1230.311912][T17776] [ 1230.311912][T17776] -> #0 (set->srcu){.+.+}-{0:0}: [ 1230.319023][T17776] __lock_acquire+0x15a5/0x2cf0 [ 1230.324395][T17776] lock_sync+0x9d/0x120 [ 1230.329066][T17776] __synchronize_srcu+0xca/0x300 [ 1230.334596][T17776] elevator_switch+0x1e8/0x7a0 [ 1230.339869][T17776] elevator_change+0x2cc/0x450 [ 1230.345136][T17776] elevator_set_default+0x36c/0x430 [ 1230.350844][T17776] blk_register_queue+0x3e9/0x4e0 [ 1230.356377][T17776] __add_disk+0x677/0xd50 [ 1230.361220][T17776] add_disk_fwnode+0xfb/0x480 [ 1230.366414][T17776] nbd_dev_add+0x72c/0xb50 [ 1230.371353][T17776] nbd_genl_connect+0x962/0x1cf0 [ 1230.376801][T17776] genl_family_rcv_msg_doit+0x22a/0x330 [ 1230.382866][T17776] genl_rcv_msg+0x61c/0x7a0 [ 1230.387883][T17776] netlink_rcv_skb+0x232/0x4b0 [ 1230.393166][T17776] genl_rcv+0x28/0x40 [ 1230.397767][T17776] netlink_unicast+0x75c/0x8e0 [ 1230.403047][T17776] netlink_sendmsg+0x813/0xb40 [ 1230.408328][T17776] ____sys_sendmsg+0x972/0x9f0 [ 1230.413616][T17776] ___sys_sendmsg+0x2a5/0x360 [ 1230.418814][T17776] __x64_sys_sendmsg+0x1bd/0x2a0 [ 1230.424266][T17776] do_syscall_64+0x174/0x580 [ 1230.429365][T17776] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1230.435764][T17776] [ 1230.435764][T17776] other info that might help us debug this: [ 1230.435764][T17776] [ 1230.445975][T17776] Chain exists of: [ 1230.445975][T17776] set->srcu --> &q->q_usage_counter(io)#54 --> &q->elevator_lock [ 1230.445975][T17776] [ 1230.459619][T17776] Possible unsafe locking scenario: [ 1230.459619][T17776] [ 1230.467066][T17776] CPU0 CPU1 [ 1230.472418][T17776] ---- ---- [ 1230.477769][T17776] lock(&q->elevator_lock); [ 1230.482365][T17776] lock(&q->q_usage_counter(io)#54); [ 1230.490252][T17776] lock(&q->elevator_lock); [ 1230.497348][T17776] sync(set->srcu); [ 1230.501230][T17776] [ 1230.501230][T17776] *** DEADLOCK *** [ 1230.501230][T17776] [ 1230.509354][T17776] 6 locks held by syz.0.17976/17776: [ 1230.514625][T17776] #0: ffffffff8fe39f88 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 [ 1230.522812][T17776] #1: ffffffff8fe39dc0 (genl_mutex){+.+.}-{4:4}, at: genl_rcv_msg+0x10b/0x7a0 [ 1230.531773][T17776] #2: ffff8880773e29c0 (&set->update_nr_hwq_lock){++++}-{4:4}, at: add_disk_fwnode+0xe7/0x480 [ 1230.542121][T17776] #3: ffff88802b852b50 (&q->sysfs_lock){+.+.}-{4:4}, at: blk_register_queue+0x119/0x4e0 [ 1230.551948][T17776] #4: ffff88802b8525d8 (&q->q_usage_counter(queue)#54){+.+.}-{0:0}, at: elevator_change+0x198/0x450 [ 1230.562823][T17776] #5: ffff88802b852ac8 (&q->elevator_lock){+.+.}-{4:4}, at: elevator_change+0x1b3/0x450 [ 1230.572654][T17776] [ 1230.572654][T17776] stack backtrace: [ 1230.578533][T17776] CPU: 0 UID: 0 PID: 17776 Comm: syz.0.17976 Not tainted syzkaller #0 PREEMPT(full) [ 1230.578552][T17776] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1230.578563][T17776] Call Trace: [ 1230.578572][T17776] [ 1230.578581][T17776] dump_stack_lvl+0xe8/0x150 [ 1230.578601][T17776] print_circular_bug+0x2e1/0x300 [ 1230.578630][T17776] check_noncircular+0x12e/0x150 [ 1230.578651][T17776] __lock_acquire+0x15a5/0x2cf0 [ 1230.578671][T17776] ? lockdep_unlock+0x5d/0xd0 [ 1230.578684][T17776] ? __lock_acquire+0x146e/0x2cf0 [ 1230.578701][T17776] ? __lock_acquire+0x146e/0x2cf0 [ 1230.578718][T17776] ? __synchronize_srcu+0xb6/0x300 [ 1230.578732][T17776] lock_sync+0x9d/0x120 [ 1230.578747][T17776] ? __synchronize_srcu+0xb6/0x300 [ 1230.578764][T17776] __synchronize_srcu+0xca/0x300 [ 1230.578779][T17776] ? do_raw_spin_lock+0x12b/0x2f0 [ 1230.578799][T17776] ? __pfx___synchronize_srcu+0x10/0x10 [ 1230.578818][T17776] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 1230.578843][T17776] ? ktime_get_mono_fast_ns+0x2d2/0x2f0 [ 1230.578866][T17776] ? synchronize_srcu+0x20d/0x270 [ 1230.578882][T17776] elevator_switch+0x1e8/0x7a0 [ 1230.578899][T17776] ? blk_mq_cancel_work_sync+0xa5/0xe0 [ 1230.578920][T17776] elevator_change+0x2cc/0x450 [ 1230.578937][T17776] ? do_raw_spin_unlock+0xf5/0x210 [ 1230.578959][T17776] elevator_set_default+0x36c/0x430 [ 1230.578977][T17776] ? __pfx_elevator_set_default+0x10/0x10 [ 1230.578998][T17776] ? disk_register_independent_access_ranges+0x2db/0x380 [ 1230.579043][T17776] ? blk_crypto_sysfs_register+0x11c/0x170 [ 1230.579111][T17776] blk_register_queue+0x3e9/0x4e0 [ 1230.579135][T17776] __add_disk+0x677/0xd50 [ 1230.579157][T17776] ? down_read+0x270/0x2e0 [ 1230.579176][T17776] add_disk_fwnode+0xfb/0x480 [ 1230.579198][T17776] nbd_dev_add+0x72c/0xb50 [ 1230.579222][T17776] ? __pfx_nbd_dev_add+0x10/0x10 [ 1230.579249][T17776] ? bpf_lsm_capable+0x9/0x20 [ 1230.579265][T17776] ? security_capable+0x7e/0x2c0 [ 1230.579286][T17776] ? radix_tree_lookup+0x240/0x290 [ 1230.579346][T17776] nbd_genl_connect+0x962/0x1cf0 [ 1230.579366][T17776] ? __pfx___nla_validate_parse+0x10/0x10 [ 1230.579413][T17776] ? __pfx_nbd_genl_connect+0x10/0x10 [ 1230.579436][T17776] ? rcu_is_watching+0x15/0xb0 [ 1230.579454][T17776] ? trace_kmalloc+0x2a/0xf0 [ 1230.579476][T17776] ? __nla_parse+0x40/0x60 [ 1230.579495][T17776] ? genl_family_rcv_msg_attrs_parse+0x20b/0x2f0 [ 1230.579518][T17776] ? genl_family_rcv_msg_attrs_parse+0x265/0x2f0 [ 1230.579543][T17776] genl_family_rcv_msg_doit+0x22a/0x330 [ 1230.579568][T17776] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 1230.579593][T17776] ? __lock_acquire+0x6b5/0x2cf0 [ 1230.579617][T17776] genl_rcv_msg+0x61c/0x7a0 [ 1230.579644][T17776] ? __pfx_genl_rcv_msg+0x10/0x10 [ 1230.579664][T17776] ? __pfx_nbd_genl_connect+0x10/0x10 [ 1230.579689][T17776] netlink_rcv_skb+0x232/0x4b0 [ 1230.579706][T17776] ? __pfx_genl_rcv_msg+0x10/0x10 [ 1230.579727][T17776] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 1230.579750][T17776] ? down_read+0x270/0x2e0 [ 1230.579766][T17776] ? genl_rcv+0xd/0x40 [ 1230.579785][T17776] genl_rcv+0x28/0x40 [ 1230.579804][T17776] netlink_unicast+0x75c/0x8e0 [ 1230.579823][T17776] netlink_sendmsg+0x813/0xb40 [ 1230.579844][T17776] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1230.579862][T17776] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1230.579884][T17776] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1230.579906][T17776] ____sys_sendmsg+0x972/0x9f0 [ 1230.579922][T17776] ? __might_fault+0xaf/0x130 [ 1230.579943][T17776] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1230.579963][T17776] ? import_iovec+0x73/0xa0 [ 1230.579981][T17776] ___sys_sendmsg+0x2a5/0x360 [ 1230.579997][T17776] ? __lock_acquire+0x6b5/0x2cf0 [ 1230.580014][T17776] ? __pfx____sys_sendmsg+0x10/0x10 [ 1230.580033][T17776] ? futex_wait+0x2a2/0x390 [ 1230.580063][T17776] ? __fget_files+0x2a/0x420 [ 1230.580081][T17776] ? __fget_files+0x3a0/0x420 [ 1230.580102][T17776] __x64_sys_sendmsg+0x1bd/0x2a0 [ 1230.580121][T17776] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1230.580141][T17776] ? rcu_is_watching+0x15/0xb0 [ 1230.580162][T17776] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1230.580178][T17776] do_syscall_64+0x174/0x580 [ 1230.580194][T17776] ? trace_irq_disable+0x3b/0x140 [ 1230.580216][T17776] ? clear_bhb_loop+0x40/0x90 [ 1230.580233][T17776] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1230.580248][T17776] RIP: 0033:0x7fdaba39ce59 [ 1230.580264][T17776] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1230.580279][T17776] RSP: 002b:00007fdabb227028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1230.580296][T17776] RAX: ffffffffffffffda RBX: 00007fdaba616090 RCX: 00007fdaba39ce59 [ 1230.580308][T17776] RDX: 0000000020000000 RSI: 0000200000001ac0 RDI: 000000000000000c [ 1230.580319][T17776] RBP: 00007fdaba432d6f R08: 0000000000000000 R09: 0000000000000000 [ 1230.580329][T17776] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1230.580339][T17776] R13: 00007fdaba616128 R14: 00007fdaba616090 R15: 00007fff2e391718 [ 1230.580358][T17776] [ 1230.984098][ C1] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 1230.988196][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1231.315120][T17782] A link change request failed with some changes committed already. Interface may have been left with an inconsistent configuration, please check. [ 1231.326174][T17781] netlink: 16 bytes leftover after parsing attributes in process `syz.2.17977'. [ 1231.385044][T17776] nbd0: detected capacity change from 0 to 63 [ 1231.391845][T17773] block nbd0: NBD_DISCONNECT [ 1231.396613][T17773] block nbd0: Disconnected due to user request. [ 1231.402873][T17773] block nbd0: shutting down sockets [ 1231.433352][ C0] blk_print_req_error: 138 callbacks suppressed [ 1231.433375][ C0] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 1231.448758][ C0] buffer_io_error: 138 callbacks suppressed [ 1231.448776][ C0] Buffer I/O error on dev nbd0, logical block 0, async page read [ 1231.462695][ C0] I/O error, dev nbd0, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 1231.471790][ C0] Buffer I/O error on dev nbd0, logical block 1, async page read [ 1231.473329][ C1] I/O error, dev nbd0, sector 4 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 1231.488578][ C1] Buffer I/O error on dev nbd0, logical block 2, async page read [ 1231.496369][ C1] I/O error, dev nbd0, sector 6 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 1231.505444][ C1] Buffer I/O error on dev nbd0, logical block 3, async page read [ 1231.513955][T17576] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 1231.523070][T17576] Buffer I/O error on dev nbd0, logical block 0, async page read [ 1231.541622][T17576] I/O error, dev nbd0, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 1231.550791][T17576] Buffer I/O error on dev nbd0, logical block 1, async page read [ 1231.569510][T17576] I/O error, dev nbd0, sector 4 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 1231.578743][T17576] Buffer I/O error on dev nbd0, logical block 2, async page read [ 1231.586622][T17576] I/O error, dev nbd0, sector 6 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 1231.595900][T17576] Buffer I/O error on dev nbd0, logical block 3, async page read [ 1231.605953][T17576] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 1231.615140][T17576] Buffer I/O error on dev nbd0, logical block 0, async page read [ 1231.623806][T17576] I/O error, dev nbd0, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 1231.633136][T17576] Buffer I/O error on dev nbd0, logical block 1, async page read [ 1231.644889][T17576] ldm_validate_partition_table(): Disk read failed. [ 1231.652268][T17576] Dev nbd0: unable to read RDB block 0 [ 1231.659019][T17576] nbd0: unable to read partition table [ 1231.670464][T17576] ldm_validate_partition_table(): Disk read failed. [ 1231.677897][T17576] Dev nbd0: unable to read RDB block 0 [ 1231.684486][T17576] nbd0: unable to read partition table [ 1232.003346][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1232.011839][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1233.043539][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1234.083356][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1235.123520][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1236.163341][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1236.643500][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1237.203524][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1238.243343][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1239.283650][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog