last executing test programs: 3.233961456s ago: executing program 4 (id=2551): r0 = openat$cgroup(0xffffffffffffffff, &(0x7f0000000000)='syz1\x00', 0x200002, 0x0) r1 = openat$cgroup_devices(r0, &(0x7f0000000040)='devices.deny\x00', 0x2, 0x0) r2 = socket$qrtr(0x2a, 0x2, 0x0) recvmsg$qrtr(r2, &(0x7f0000001a40)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000080)=""/218, 0xda}, {&(0x7f0000000180)=""/89, 0x59}, {&(0x7f0000000200)=""/210, 0xd2}, {&(0x7f0000000300)=""/201, 0xc9}, {&(0x7f0000000400)=""/215, 0xd7}], 0x5, &(0x7f0000000580)=[{0x1010, 0x0, 0x0, ""/4096}, {0xd8, 0x0, 0x0, ""/197}, {0x108, 0x0, 0x0, ""/241}, {0x48, 0x0, 0x0, ""/51}, {0x10}, {0xd0, 0x0, 0x0, ""/192}, {0x68, 0x0, 0x0, ""/85}, {0xa8, 0x0, 0x0, ""/152}, {0x78, 0x0, 0x0, ""/101}], 0x14a0, 0x20}, 0x38, 0x40002143) r3 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000001d40)={0x6, 0x1e, &(0x7f0000001a80)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0xfffffff7, 0x0, 0x0, 0x0, 0x4}, {}, {}, [@printk={@i, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xb}}, @map_idx_val={0x18, 0x0, 0x6, 0x0, 0x10, 0x0, 0x0, 0x0, 0x1}, @tail_call={{0x18, 0x2, 0x1, 0x0, 0x1}}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000001b80)='GPL\x00', 0x800, 0x4d, &(0x7f0000001bc0)=""/77, 0x40f00, 0x2, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, &(0x7f0000001c40)={0x9, 0x2}, 0x8, 0x10, &(0x7f0000001c80)={0x3, 0x3, 0x7fff, 0x10000}, 0x10, 0x0, 0x0, 0x1, &(0x7f0000001cc0)=[0x1, 0xffffffffffffffff, r1, 0xffffffffffffffff, 0x1, 0x1, 0x1], &(0x7f0000001d00)=[{0x3, 0x1, 0x6, 0x1}], 0x10, 0x4d57}, 0x94) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000001e00)='./cgroup/syz0\x00', 0x200002, 0x0) r5 = bpf$BPF_LINK_CREATE(0x1c, &(0x7f0000001e80)={r3, r0, 0x37, 0x0, @val=@iter={&(0x7f0000001e40)=@cgroup={0x2, r4, 0xfffffffffffffff2}, 0x10}}, 0x20) ioctl$FS_IOC_FIEMAP(r0, 0xc020660b, &(0x7f0000001ec0)={0x8, 0x80000000, 0x0, 0xe, 0x8, 0x0, [{0x7fffffffffffffff, 0xeb, 0x707, '\x00', 0x105}, {0x2, 0x0, 0x7, '\x00', 0x1000}, {0x7, 0x0, 0x1, '\x00', 0x1c80}, {0x3c, 0x65, 0x4, '\x00', 0x2001}, {0x10000, 0x4000000000000000, 0x6, '\x00', 0x3}, {0x5, 0x9, 0xfffffffffffffff9, '\x00', 0x3102}, {0x7, 0x5, 0x3, '\x00', 0x2000}, {0x4, 0x4d, 0x5, '\x00', 0x304}]}) getsockopt$PNPIPE_IFINDEX(0xffffffffffffffff, 0x113, 0x2, &(0x7f00000020c0)=0x0, &(0x7f0000002100)=0x4) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000002140)={0x1b, 0x0, 0x0, 0x2, 0x0, 0xffffffffffffffff, 0x3ff000, '\x00', r6, 0xffffffffffffffff, 0x0, 0x1, 0x4}, 0x50) r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$nl802154(&(0x7f00000021c0), r7) r9 = syz_init_net_socket$ax25(0x3, 0x2, 0xca) ioctl$sock_ax25_SIOCADDRT(r9, 0x890b, &(0x7f0000002200)={@netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, 0x7, [@bcast, @bcast, @null, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @default]}) ioctl$int_out(r5, 0x2, &(0x7f0000002280)) r10 = syz_genetlink_get_family_id$net_dm(&(0x7f0000002300), r7) sendmsg$NET_DM_CMD_START(r7, &(0x7f00000023c0)={&(0x7f00000022c0)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000002380)={&(0x7f0000002340)={0x14, r10, 0x200, 0x70bd2d, 0x25dfdbfb, {}, ["", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x40}, 0x4800) r11 = socket$kcm(0x29, 0x7, 0x0) sendmsg$kcm(r11, &(0x7f0000003940)={&(0x7f0000002400)=@rxrpc=@in6={0x21, 0x2, 0x2, 0x1c, {0xa, 0x4e23, 0x4000000, @empty, 0x4}}, 0x80, &(0x7f00000037c0)=[{&(0x7f0000002480)="5e443d3c754a558d6cac2dd6b582c480e550347fe4241b4e1443da0e0f91a6c13bf7db8f7e8be2f8af59900c29a750f3ace159b1b609f02ed4a72caf9d1f0d7480b6223c9dc71893b97082089ee8787f0594988d4419fe43e152f84771d18291a593a8e04fcda810e1d7fb", 0x6b}, {&(0x7f0000002500)="1a9aa1c6d53f6c6056dc2e84295e54fb3c6a0bebcbf7c580eb901c5e06efa68aaf70ab0bd9f1b2a3504007fb5e3cbcf6b1ea4811352284cce14cd99585e2384d9350d8d07a32299d01b5c112c8478dfa8a385272614639bce83dd35d3fe100d0ed22c10c7329c0020cdc27d437ee81cd70786b4a9a6744cddbb66cc2abe62796fb343c179609f34c23d3375d00c821e608e66677c5c7c4441c7c4294e1c322cc3102565afa27ea431cfc5a6e9e182424dfe16e4fcc3556272d6b7c8efc76ba", 0xbf}, {&(0x7f00000025c0)="b178073aaaba75afc8c1e5163d1f5d0a9c3e25911be817db954b4ad14378ee81807c391f72b7d952a8ba547173c23b41fc9227da642c3c79e27808239504d7bf6fb307aeaa35e32088e16d6a365aa1f3b8761e1557dfee958a49f24730d604e582935f749e96e2d8f805918e98840b48de46d1e019c2d91dd35ca7aef643fdb6f2f01387384059331a9db3846c6b2f48b4aeb6c1bd72a9d3bf628cfe43fde5eb5a0f2611563267ffb67a81c15350309530d102579e3dc989c12dfd6a2b164c613e83de38360bab69c49711daa89d6a3fcc0fdd25a4ea844505f87fe2a87298d07e8703fb640a718a783bbb011a63eb645857c327cc38c8bc05fe75c0e55806e5d16d60d0fe02ece230feaaa33f1dd4156bd89543018ee51a9e0bf86da7b6230504c06fd4c5e6ceeaf69560f31464e34cc6bdb8ae6ac84546fed6910af33843209230110bff7f7b51bcbd8718b53bc513b74a4286398d2d937a19ed9712874d4ed41127d41e470dc23cb7f98f663e4b859ba5d0fc3bb7299c497a0e2f76100310dd77d316fa1705bb70cba4197f79d5a34a9ad06355e1503b0a162db7438606d10e89ed2221144fd857e9c0e0f98068f1d62607eb9141c2845ebc69284b02c1dca109c3b4faef7dd185206aba60dd01957374a66205175884fe4a7a4a273bed4310474107c3a6a04557ce3f0cdc33aaea43e0cd3db74c4744e7b81dbbd10886ad71cc81842ad914ef903cecf68e55d071306cd5a59ed9b859a5dce5d13a3a51102c02e2898f25621d789ed31954af9d8a7cc9873318e163107ed75982c046663aa6c0e4a3f286c49fb49deeb52fd21ab26f5e6667332debf7dfb933415659c6778bbe84ed41af3cf6545f2f2bb76f91ea8dfaa343bd3522a30e87883d0855bfcb01d4c443b41509d2579eeb82f2b15200a3045137433691e83478ef391d5738445652487b983902d91d78806411e579be472c9f45020fa9d9214a30f1b7fe65eb85359aa682741aba8aef4a02ac564ba02272eadc77d40d512d2dce60fe5e94f38686fbdea25f4b7321b2cee6b65783a1f1c608ff796d795fa7e4cc830ac21e05fa69f1246f1f4cfdbe6979700c029db67f732320c1f463d61d8ea7180ddbb70ff40ea40bb14a427df1b7b78d6fa5791e200a288773136b6815f7807c8bec801b1180c4eb3d896cdb4c3ad873e6acaabe926ae8b1dbba43ca9e295ed30e35b8ec1fd02f646a200f1cf5895d725e2b6e31502001867c26cadb014dcdd6e2db7595abfcce692a8c2019386e7b9ca1eba18589ba832f0bfa5b08a8e8a9debb35d1e430b41051b7be874ea5bb91a475e36af08e99d88108c6cc7cf30b1092eb5f344ecf6f01bd8c0fd2e6901ad9972f028300905532d65dac106435981fc013b0672817f689e4f47d907d1cd2464ed9d301de8d56e950bff39b56894f69126dbc29922bdfe92913c845d14867c4c60373b4f42b0155826631a3aaba2892c573cddf3ec043281e103fc5e8f6874807f50e712a849a70aa230ace41c86b01dfc85ce889656211eb2d1359c33655045daf36d7c3fbdfbd7c3884cd53946af5aa7c6c5a1b8b13ef128af0a9d3078a20ec29dfa7e858f475cd3e2379b5f8da5b97adb03b9b3432a991acdf444279d56621867f65f25f3230e74b8d9c9ef092f13ce3072547466e5d75b6d09a0fa6969dd9b1d5e84143971c437ea3b66608d9fde7fd3b5af5ae1386193145bd21dc2237c8027d4ac14973b2bff3afb3e16e1857e1ecefcd85d55599e6eb677f6703201b117266b00a2d692ecd1b8566c4f60c0b64a512175730d5d18289c2cdb8cf0ab47bf7e77a70bfca24eb39bda2671b79597cc4685e392ac5a8d8f680ec2d9a042a3f1cbf6d01b1aa1f9ff31d90f316c5e847668901f7b07f7913096f7df0f49752b7364cfed9506d618b58a77301a703d90f1fce3cd12ded032c9b84828cbc0dda02ad1923da8faf34b106edc6c761aea32dc7e0ee9bf7fd00271781a16a6cb067ca3c27ce5ca55cb91da517475939fa52f20e079b7772241d6d70b769e9d8c905d7e98dc6b7b22e1f3930f99a3839046aac0e6ac1071273fb87638ebfabf0654c5c126c6caa16b09a0240fb20bf6ea9f919a37813f5be18dcdd4b13c8ec50eab5f9cd8d7557405884a4e14670274facffd647444ae1bf3ebae68ba3d30c8087b080470f03a6f00957da49563ec0c4df9d9fdb2b354adfc088b1fb0ba43282f510897e4869ef8f5c9c068407e521c6b9c53eef83e885f83b8f131d839aadc55c13c21a67688f4d9ad03907a4c507405da9bf745fdf2ab83a9675549e78bb696bc9dc82d3c367d3836f695e3f2f3cb54fd34ed08c58e31db7cd44f0ccd6bd4eaab6993c380a723668a72431e6c269d66e8f302724b133beb747e731ffdb7daf3e570229e6cb975630a055f23e0afd53ce73824444a951cba140aa29dacca1c359f0938bb6531afc884139aadd43b8864cfcf90c4e08a1ddbf4247e2853d9995d5cb7f98096a7228eeff276ae8b2b97e41269800f3d5bbc59ece3a747b5616beed85b1ac2f858e78dc813889410adbe57e6faebba205b1ba7723891f06771ae2fba7a01c26ed7fbe92807b60aeed124bdad7fd784ccd3e442843876d046fe842e1cb37a4a08d15ee2608aa98844891b9d1c0b8d532bf99651f1c59fbd45d9412f4d9a1a6eed09ef4dc25d032f6059434c2e78e45e10ded2d7c5c66e94b6cc941e08eef0d3e8e0a8d3c57c06181bfec8237f11c233e2fbbf2b07bb193afd7b6002826c67d26fe01a12042a08ea4008280884d77d065b8f984595d3cda75cbc70b2ed1219c671e380000524798f0a12e506687b7737a524a18fdaf58bb4c48b068ee163921dbabaefd97dde85e29df7793e7c7da873380dd97455c70ded3d28b8284191026c7ab87eae4d7fe330fb38f1a2999941b6d3798017463e5c648edfa4131da821b284d1b62557a64843fc5e6c4dc154b18301cab979a6fcb8f299a3dfc00d3a58aeea30e96c9cd24cedd2cbe9542b7137bef824c53a90c944d6c90c9196a5207c8d8d9b0a2bcf965af39942274af94b5ccdc39b05f7c8e21dcd7298789454b66d6aed19d49c982e16dcf6c3282061e7d73f5c386461c507443fc2f854995f90c848bcd7d55c2e9825659b61814aae79a255c50b73c3895963e076069ee4a65d04b93cc8c7df4c2bb7c09b28016de7ca1adf54a3befce4542136eadf0d806ffc3f07eed88b2c022e03f7db51e1ff71f3e5ed20f6965447e0ee739a78eb5ebeaf0c052cbd60e389b4faee9d02659f6065d54d01977282b8e01d800b176e80abc254a6e88342042ae0ec30a0074463d2be7d123c92adba59c5ce9c2d95abb8f5bad5482a2449a96c2dab441e3197e2399d49960aa68ac6403429f24f4eaac1bf46343017efb28d5e195d65748764788190daacd8a9427c546196b2754771d1c50b1dbba5bf743e0f8efd0c9e974616142c4b3a4ec15c58c51f0e5dcb7af144d3dc31e000bb2ad4fc7e9f88c8de856094ecf3f4424329c711ce457b3eec80dee4b8e89f6fb44936208c88d439b952bd6d8aab25880fa08d95aac06e8d2f361a5ce8adf3cffd878478ea6c4d35b2f27ca2323011f39df392e71b68f1734b64645bd9c645cd4b089a7e50db3e7bc28170262ba55794b4f306b7476c47ab1db542b17a2c572081a787a7226f1792e01dd70c2309f9cb9a032cf9b695a0bbb68635d774dc37cd2c7c1b88dfb85c8396d428269e3e1d4603a8af606a1ae86cc659d9833bf9b44e7944d8363375153b40e1446b010d17a997f6f8cbba8dec45289a8210b3436f7e8ece9a129ca59310d1853336768e1f765f292b3ac88186b06e6743506cdb256b283de93b01fce119b4cf2cc61b9b2a04d5f5bbae314558955a653a81117a719f4c7ef95d7cc1eecd56278a2a3186ac3a65bc12183e49fb6cb25db763caf5983f6cac48abac87c731b55f97f22417fa3c346f5c8bcd2a2f358a5c521d7a8aecf9c8ea122b1c70f463049602ee0e3f9b51310e81f3e23141450aa727dd3ad4e2205c843f326f07f76fbc8bad1ccc49710adf8e8bdbd86959e690708dd33b2ae8c256b6054b0dbe7102ada60829cd51fd2e6370c40c774352d56ee592c732a35adab6e722645b58b7fac265ca3f6878fb4bc10bfdc843b3702ca9d19d06bfa7e5aafb9c21e9a7eb2df3899c7d309dc580021c49186fd128c328cc8a8afe1bbeb843bff89558d60c9fc8485090e099f2d5dbf5ee8e2d55044c2fc4868e72fa4ba309b76343c50b96c9eff9c2f6cb6bbe431ad1c8c35af43f37364f37ec8537ed2c5baea3bba1053ad892a2d861d3bef534598bc56157b9fa533232fa3374241428b557095bcb1b45e30dcafaf14f017edd3013900be07087bfe0e3d37acbc69d9f5f9a772f0e7cb66b0aa7c804b278506cf1c0ea29da02dd9526a5c6d885bac0197e8254077638259f1ce91d22b0035d2e76b5e9ad20a3ff31cc670201d1f0031f3836fdff14d7b5cf1556ef1bbe7c9a381fcdcd9e79c0a303d5a01517346bbf998ce348b320376b56604a70ddb000a9738fae1895e87f58a6e479bf63e20cc582ac7e37c1f8183dac5a0cf4b1293c3904bbec6f690f63be69662211e3dcda4e415f10de24b1927a3f8d0108f18f7011e54b00a02f0e52e7dbe28a7be3aa1edb3cd1e97beb6ff0874018cb726e630357638b84d9de74229beb46f9f628ceaed4606c9774f073549b0408016fc04f0f5e18feab02a79d0073eb4d62f58c02b9830e29af0cfd78a26f4516186dfdbc4272c8050bbc9f5d5868132d585f3bdfb8008fc99e1995c661ca1f5a763db90c9db4fc4deddeefc4a0675b29694b3a9d4af046f760d814b991a852365279f000019b544046c8e1d14628fac9bc8ebc46936eba94a40cf00d71b812b0515d21e38decba791b7f149b899141e6d0c85418eaf97bda35b3539396f05b448a71e9214409f3e62d4234493b6b131b4f9fbbf3cc8703cba30ec3c4681ba93bcbec514c45d59a025b1e96786512a6e95e9e1fb13765cce0d72299c6f980db657f07bc716faeed491b01dbcc98c3a01ca346707a11cb9b13842a22a470c26433a79ad6b2b184a0664b1592558790bad89e8fd2ca8ab267c051fed7a323ca63d50069c0f7c10c9defe27257e1b7d995845e04f335997ece76a8c76da49820fac5f5ba22eac4fc6a0b8f0f614fb0b50c4254a9b1ed10b66a53473999fb0a937516245a8a3c1c18205a977cb8853151894619dd35b69da0eafec765d75e97b123a291c141349700508b7ecde702eb16deb87739d2eca3976b4cdd12e55cb128ae2b0403885766197031c3d2d40782d8bcc2568c53d93453422ae41c571bff0a807a0a6b5e388e04a6c189317884676bf15940e310cd0bef628d4b0e3eddd3bb72e15a2c5e206aaae56af96d1b092f90655524e2f9c946f25b6b70ecf9e40a451dbd01546facb316778772ed299662ea2886558b77b10102d3c1347fc734dfc72dbbd1801f42dc7ffd687080fd3a9b0fbcee40e403efc30dee875bcde25868f7e25106cc68068d0cfa5350773b80308377f4bc2e78d1cf3558f1808f82b5dac4bd0da214e8c13b29b51555fed6aa6ee5d0e81ba06d43cf2a31df6784f55ae4866791b40789882965a5f6bb56c32fc6bade8bf1cd91094526d9fe95048448ccfa6154e6304670a19fd5492bbcd795c40c4217663ea0d347bd10d109d89c75afe50f0f3c468c556498a388f3d5fd9d44f9d44d08b6a1e19748995ace894efa4c7a2c42a672c69ea9c6688dfc6", 0x1000}, {&(0x7f00000035c0)="f25a253b9ae454919d6852b2e5d00b2097ae4efd70e043dc34ae888adb536355f1d606d4cbd583c33b6d21a9646a181b21c15f462a6c7bd96ab052eefdae83c4776a07c59f13146b89950d49b0a57e6bb66652bf60d65739ea0470989279a7b1c190485a7874679c218207e7d832bbc52a4c71f9f92e13a566f9ba40712d50a46859d5b9d84d", 0x86}, {&(0x7f0000003680)="2fa17043da1fa74d2cad141dc983e406d0a2441cf66ad348a0ac596a73d22f6f7dc5ebe18fb6b50c170d43614a865f5af3268fe064444fdc93", 0x39}, {&(0x7f00000036c0)="82d57370be32c82c5b7e22939226671f06abceb7817a85dc26dcdc7292b18ec720d2a065f976afecb34955e789c660e59eb48f1e7c41828b58c2a112b32938c895f6a2615034590e1bc5ae11d40a6574205ab528a08490df254838ab63d3b7c2ae748811575dca4f4c1353fdf876ac8aae5d630ea886b5c1ecb18fda36566e77363d3acf928503d1ea8cbf7ca680aa8b811abf19e044a41a613778710cb9a0eefc6bc75ea1bc7e6831b94c039d615ea0733f99039afa36b97198ea67b2b1c9b0753e23d2a30d013de47b4d174417eebbcd7bbe3610b7a97f1783d0a21b11bc545cc5b3c3ee455f23417d", 0xea}], 0x6, &(0x7f0000003840)=[{0xe0, 0x84, 0x5, "5f9a93bfec8c63cf2bef667ab4ea0b2f880bc2f19bad6eedae7695880ec21491b596026d7fa113e16df3439d72d577f2d432d52443ebadf2065fa368fbc4652b1c1eb0b402cf49e23af53206fdbd6691cacfe4914827028d3c2f9f109fb5e2f02788770572324b6e4f8155d68636b12219a67f47889c5798208804be134ae69a2a292163f041c90117a9c8d1eda3546e4ab09079319f61bd9ae121d9a157724bfd6e707e19a1e21a8edf12b7276c9329742582ce26c009298131d99f76e72b97d2cc86aa2209712c3324377a06"}], 0xe0}, 0x20000000) r12 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r12, &(0x7f0000003b00)={0x0, 0x0, &(0x7f0000003ac0)={&(0x7f0000003980)={0x2, 0x9, 0x6, 0x5, 0x22, 0x0, 0x70bd29, 0x25dfdbff, [@sadb_lifetime={0x4, 0x3, 0xfffffff8, 0x7fffffff, 0x200, 0x6}, @sadb_x_sa2={0x2, 0x13, 0x8, 0x0, 0x0, 0x70bd2d, 0x3500}, @sadb_ident={0x2, 0xa, 0x50, 0x0, 0x5a}, @sadb_x_filter={0x5, 0x1a, @in6=@private0={0xfc, 0x0, '\x00', 0x1}, @in6=@remote, 0x26, 0x10, 0x6}, @sadb_x_sec_ctx={0x13, 0x18, 0x1, 0x8, 0x89, "fad24e737e08edb7a1aea0cc38e64e2f25dfc70c52a32c5bd72a539183822ad5b18167c21c82532407563be9953a58acfd724ebc5d2d32fa77ccd7f5baeaf6d3b17ae4e51f83a399b6fbdb918845228ddb044a526267f00235701273661e3c5a2963f43c7f259937c995371c8e52e698e874c98576f346f095c96dfe73f45174b2ef099117f6dbecf9"}]}, 0x110}}, 0x8004) r13 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000003b80), r7) sendmsg$NLBL_UNLABEL_C_ACCEPT(r7, &(0x7f0000003c80)={&(0x7f0000003b40)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000003c40)={&(0x7f0000003bc0)={0x44, r13, 0x20, 0x70bd2c, 0x25dfdbfb, {}, [@NLBL_UNLABEL_A_SECCTX={0x25, 0x7, 'system_u:object_r:var_spool_t:s0\x00'}, @NLBL_UNLABEL_A_IPV4ADDR={0x8, 0x4, @local}]}, 0x44}, 0x1, 0x0, 0x0, 0x4081d}, 0x1) r14 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc(&(0x7f0000003cc0), r14) r15 = syz_genetlink_get_family_id$tipc2(&(0x7f0000003d40), r14) sendmsg$TIPC_NL_MON_SET(r14, &(0x7f0000003fc0)={&(0x7f0000003d00)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000003f80)={&(0x7f0000003d80)={0x200, r15, 0x20, 0x70bd2d, 0x25dfdbfe, {}, [@TIPC_NLA_NODE={0x100, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x800}, @TIPC_NLA_NODE_KEY_MASTER={0x4}, @TIPC_NLA_NODE_KEY={0x4b, 0x4, {'gcm(aes)\x00', 0x23, "549db4501916fa479ee9db7d0c84bb903c3a004d192d8dd44627b0db7cde888951b18e"}}, @TIPC_NLA_NODE_REKEYING={0x8, 0x6, 0x3}, @TIPC_NLA_NODE_KEY_MASTER={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_KEY={0x3f, 0x4, {'gcm(aes)\x00', 0x17, "dcd5461c7db622215dcebe8b4c08c8a5c4f353a095eb89"}}, @TIPC_NLA_NODE_KEY_MASTER={0x4}, @TIPC_NLA_NODE_KEY={0x47, 0x4, {'gcm(aes)\x00', 0x1f, "2f62ae78a282afaf02e34b2ad6da3cdb10745360043ccf09e39dad5761dc25"}}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x5}]}, @TIPC_NLA_PUBL={0x24, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0xfffffffc}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0xb}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x7f}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x38}]}, @TIPC_NLA_LINK={0x4c, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_PROP={0x3c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x5}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x2}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7fff}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x52391786}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x4}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xee}]}]}, @TIPC_NLA_SOCK={0x7c, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_REF={0x8, 0x2, 0x1}, @TIPC_NLA_SOCK_CON={0x4c, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_FLAG={0x8, 0x1, 0x9}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x101}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x2}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0xfffffff9}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0xe}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0xe21}, @TIPC_NLA_CON_FLAG={0x8}, @TIPC_NLA_CON_FLAG={0x8}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x5}]}, @TIPC_NLA_SOCK_CON={0x24, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_FLAG={0x8, 0x1, 0xa}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x65}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x1}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x2000}]}]}]}, 0x200}}, 0x0) bpf$OBJ_PIN_PROG(0x6, &(0x7f0000004040)=@o_path={&(0x7f0000004000)='./file0\x00', r3, 0x4000, r9}, 0x18) ioctl$sock_SIOCGIFINDEX_802154(r7, 0x8933, &(0x7f00000040c0)={'wpan1\x00', 0x0}) sendmsg$NL802154_CMD_SET_TX_POWER(r7, &(0x7f0000004200)={&(0x7f0000004080)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000041c0)={&(0x7f0000004140)={0x70, r8, 0x800, 0x70bd25, 0x25dfdbfc, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000002}, @NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x3}, @NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r16}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000002}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}]}, 0x70}, 0x1, 0x0, 0x0, 0x4010}, 0x4000801) 2.77825069s ago: executing program 4 (id=2557): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@gettaction={0x50, 0x32, 0x20, 0x70bd25, 0x25dfdbfe, {}, [@action_gd=@TCA_ACT_TAB={0x1c, 0x1, [{0xc, 0x1c, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'bpf\x00'}}, {0xc, 0x1d, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'ife\x00'}}]}, @action_gd=@TCA_ACT_TAB={0x20, 0x1, [{0x10, 0xd, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'mirred\x00'}}, {0xc, 0x17, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x40}}]}]}, 0x50}, 0x1, 0x0, 0x0, 0x40000}, 0x4048840) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000380)=@newqdisc={0x1b4, 0x24, 0x1, 0x70bd2a, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, {}, {0xffff, 0x8}, {0x5, 0x10}}, [@TCA_INGRESS_BLOCK={0x8, 0xd, 0x81}, @TCA_STAB={0xd8, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x7, 0x3, 0x80, 0x80000001, 0x0, 0x50e2800, 0xfffffff0, 0x2}}, {0x8, 0x2, [0x1, 0xc]}}, {{0x1c, 0x1, {0x4a, 0xf8, 0x5, 0x0, 0x2, 0x4000000, 0xffff2760, 0x9}}, {0x16, 0x2, [0xc, 0x5, 0x0, 0x400, 0x9, 0x6, 0x4, 0xc4bb, 0x4]}}, {{0x1c, 0x1, {0xd, 0xa, 0x926, 0x9cf, 0x2, 0xffff, 0x4, 0x4}}, {0xc, 0x2, [0x1, 0x6, 0x7, 0x6]}}, {{0x1c, 0x1, {0x4, 0xa1, 0x0, 0x100, 0x2, 0x1, 0xffffffff, 0x2}}, {0x8, 0x2, [0x1, 0x9831]}}, {{0x1c, 0x1, {0x1, 0x81, 0x6, 0x1ff, 0x2, 0x9, 0x6, 0x7}}, {0x12, 0x2, [0x2, 0x8, 0xf000, 0x3, 0x0, 0x7, 0x4db8]}}]}, @TCA_STAB={0xa8, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x6, 0x5, 0x401, 0x5, 0x2, 0x0, 0x4, 0x1}}, {0x6, 0x2, [0x4]}}, {{0x1c, 0x1, {0x8, 0x9, 0x1, 0x7, 0x2, 0x5, 0x4, 0x7}}, {0x12, 0x2, [0x0, 0xb, 0x1b7e, 0xfffa, 0x400, 0x3, 0x3]}}, {{0x1c, 0x1, {0x3, 0x7, 0x3, 0x96c6, 0x0, 0x8, 0x80000000, 0x3}}, {0xa, 0x2, [0x9, 0x4, 0x2]}}, {{0x1c, 0x1, {0x9, 0x7, 0x891, 0x6, 0x1, 0x2, 0x3, 0x3}}, {0xa, 0x2, [0x3, 0x8000, 0x0]}}]}, @TCA_INGRESS_BLOCK={0x8, 0xd, 0x1}]}, 0x1b4}, 0x1, 0x0, 0x0, 0x40}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="4800000010000d0428bd7000fcdbff2500008000", @ANYRES32=0x0, @ANYBLOB="1000000000000000280012800b0001006272696467650000180002"], 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0300000000000000280012800a00010076786c616e00"], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22cca65c15}, 0x4008840) r0 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r0, &(0x7f00000002c0), 0x40000000000009f, 0x0) ioctl$int_in(r0, 0x5421, &(0x7f00000000c0)=0x6) 2.492707503s ago: executing program 4 (id=2561): r0 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000006c0)={0x18, 0xb, &(0x7f0000000640)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020000000000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], &(0x7f00000004c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) r2 = accept(r0, &(0x7f0000000080), &(0x7f0000000000)=0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000002c0)='contention_begin\x00', r1, 0x0, 0xd}, 0x18) syz_init_net_socket$bt_rfcomm(0x1f, 0x3, 0x3) syz_genetlink_get_family_id$nl80211(&(0x7f0000000180), r2) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x1b, 0x0, 0x0) r4 = socket$inet6_udplite(0xa, 0x2, 0x88) sendmmsg$inet6(r4, &(0x7f0000000580)=[{{&(0x7f0000000000)={0xa, 0x4e21, 0x0, @remote, 0x9}, 0x1c, 0x0, 0x0, &(0x7f00000020c0)=ANY=[@ANYBLOB="38020000000000002900000036000000004300000000000004013f040100c910ff010000000000000000000000000001c910fc0000000000000000000000000000000001000740000000000e07010101000000010000000200000000000000000000000000000001000000010000002000000000000000ffffffff00000000ffffffffffffff7f06aeb07c1c192077cc9e7c45705803ad5588ca8b194d23f748fe792cfa3d32221f25d73b8ffe64a4ddda6efcfb7483b588194d29c7a04395d8500965a9a1d07879040c44db1d5d6f618d2ab920f0bf168ddc9acc6a51edd1230760d4ae8bf30f5f82a78e8114849ee8e37364560400000035bfa8197ef2ba99103ee5f5aae28ec5c8e2675db11530f5c466d55f2244d479dc653c854406155eada3eaeb90d39149b8d13bab75a9bd1452c8c76284b9ddfbeff41344e64f1771d78a706e1c5a6d63f1c954e24a1e73f75c26e9f09ec9b606cc3470f11c4842db651926bd2263a4a0a8fe80de8b2f9cb176e51819d5f4d10a5d1f0488d5e46953fbfd750f6137fbebe89a8d462158a87f9622355104b4f68d7a6d3ad85c373ea52a25afad37ffb743a5c361158087904b09fcc806d032bac00ee0e0251fc032446e45a3e12417ff4703526ffc45f71567857777927903799e0ba453334186009d22e38099c67b5350c7e82136bba947a18fb61d36fcba1f9efe3d79485d06252702833dc8ee417f40bb9064878fb89dd75a49135e5df148c4ad1e1d5626b44c8112d822f4c9a05e693fd5ae5595627f8684016b37a2bf6d0040030000000000002900000037000000006500000000000000fb1a63687c244e6df3aecb13d6eb957495b669cc032f6d0a11a5e16eed9937b046c9dc1a61dcf9754b767df4735c3f8c37b4d5cd15a99c5a19cc62c921ad4e90d6e3695ec1891223a53600d5031b5735acafb556e22279975f958ad437c76573e544506e58455772eb11493af933099a5dc7e9e0c8b907e68e23e59d7b94bc774309e2047132758b60955301f277a9032b0bc47e660b243e9e2126733f13ab99055a0999068ada35a38d105a5efe6c7115774effe28695ecae3944413b7764eefde26ed571d857b2cb2dd1b2a4a84c1fec0799cf90f57f7a6d35e2b60cd425b9372ae4a27f453e5d7da2eacd3b98cdb10cec9152d5829c2511eb0f9600a0cd280f3d08849b6cd43d25e3dcd62f7c7dee6123a2682daf4aa9a856b31e9204c5c2b80b84dbeec05d93a64a550f1ebc326488cd620c6fe1aa266a0ce5b24be03b5037786e037cc85ed61f362e081fb694e12e54fcb9eb0f86d6d91fd159023a073278f84d6ada8f9aa25ec223d268f3291b25392c941740932bd1a82f40a8fc586db23d2f6240ce883e3c1dc1e0d07fc3aa73a9ac82a1538d129c9e66cb6a8100abe95bc4064581e8c01ce65ba3ea751db5d8c0a1173fe62b2fd2d415042a97ade4d274a466b6d997eed6bf5d7a305ead804c36b9e1c314b26676ed83412417610d3cf4d07e5b24cf3de9c790ae93850e0f8bba047b710cf340c78a80cef5f6665a647681ff5f7b6ecce8ab65e26406b6a6e0e72ff8501c545bffc00f034dc3a5b251390ae68bb61d936dc9a24e6f66c72e7911c51c716dfd4304566fb32e6c2745d232f990d0bbe0ddf9dc58398dda292c07b16da766a37c60bd9993b4f21e641036a8afa2ccdb47d7990d5a007faccb2f86664179f2e229723bce870aec3f7f4e529c92add713590ce6c0ea1a0499fb76d32636cfd18b6b39fb48f1a6d46f6ae8f45c47ee8260f9531070d170ab92739be0bdf5b76f8a9b93a5e550dfecab79d2e46085a67024b6be883c79ade2873458fda5a7f4eb62b05634356ee3b45723f4cff19c654ad441ff5b8792df7f18d841c351e195151b1b3532e742a6525c86efdb29653f35ce8e0a41c8c6d39f39531e13aeb1172893eeedd83b6afb939f8e6abc5482696aa48918000000000000002900000037"], 0x590}}, {{0x0, 0x0, &(0x7f0000000640)=[{&(0x7f00000000c0)="a11f49623b9293a36a1ed56b82c5d18cbf9c69f908e51f5e513b09a075d931bc4299d0e8e1ee7b7b5c15e1d88d2e25f351b085094c", 0x35}], 0x1}}], 0x2, 0x8008801) r5 = socket$kcm(0x2, 0xa, 0x2) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) r7 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r7, 0x0, 0x0) write$tun(r6, &(0x7f0000000040)={@val, @void, @eth={@broadcast, @remote, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x66, 0x0, 0x0, 0x2f, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @multicast1}, {0x0, 0x86dd, 0x48, 0x0, @wg=@cookie={0x3, 0x2, "6b27f3be82b382c4269a9598e5be2a2129eca8e913620490", "f399a5b101e20c84f5335e76ca45330a2f5842d64c39f77c80d1143a6d906c8d"}}}}}}}, 0x6e) ioctl$SIOCSIFHWADDR(r5, 0x8914, 0x0) sendmmsg$inet6(r4, &(0x7f0000000040)=[{{0x0, 0x0, &(0x7f0000000440)=[{&(0x7f0000000100)="1155df5aa89ba4548654c69e2d3e4719de272df4ea8568f5578c7cb2346ff1a89123636ff6666cb85e4ac94e39a6bd4d039dba8db7306fd03edffba92001ce15ae7495bd296a43c7c4247657416fd3666707afb07f682d1da276c6a33b758283233b90ad1c471b94", 0x68}], 0x1}}], 0x1, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000240)={'wlan0\x00'}) sendmsg$NL80211_CMD_SET_BSS(r2, &(0x7f0000000380)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000280)={0x0, 0x54}, 0x1, 0x0, 0x0, 0x40}, 0x24000000) connect$bt_rfcomm(r0, &(0x7f0000000040)={0x1f, @any, 0x2}, 0xa) r8 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3) r9 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r9, 0x0, 0x884) connect$bt_rfcomm(r8, &(0x7f00000001c0)={0x1f, @none, 0x1}, 0xa) shutdown(r0, 0x1) gettid() sendmmsg$unix(0xffffffffffffffff, &(0x7f0000004c40)=[{{&(0x7f0000000040)=@abs={0x0, 0x0, 0x4e24}, 0x6e, 0x0, 0x0, &(0x7f0000000300)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18, 0x40004}}], 0x1, 0x0) ioctl$NS_GET_OWNER_UID(0xffffffffffffffff, 0xb704, &(0x7f0000000a80)) getgid() 2.392312384s ago: executing program 3 (id=2562): pwrite64(0xffffffffffffffff, &(0x7f0000000240)="e1", 0x1, 0x7fffffffffffffff) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000340)=ANY=[@ANYBLOB="340000001100010027bd7000fddbdf2500000000", @ANYRES32=0x0, @ANYBLOB="20100000000004001400030076657468315f766c616e000000000000651515bf1ee92be363"], 0x34}, 0x1, 0x0, 0x0, 0x801}, 0x4000000) r1 = socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000100), r1) sendmsg$L2TP_CMD_SESSION_DELETE(r1, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000140)={&(0x7f0000000380)={0x44, r2, 0x400, 0x70bd28, 0x25dfdbfd, {}, [@L2TP_ATTR_PEER_SESSION_ID={0x8}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e20}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x2}, @L2TP_ATTR_MRU={0x6, 0x1d, 0x6}, @L2TP_ATTR_UDP_DPORT={0x6, 0x1b, 0x4e20}, @L2TP_ATTR_PW_TYPE={0x6, 0x1, 0x7}]}, 0x44}, 0x1, 0x0, 0x0, 0x100400c1}, 0x840) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r4 = openat$cgroup_procs(r3, &(0x7f0000000200)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r4, &(0x7f0000000c40), 0x12) syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), r1) r5 = socket$vsock_stream(0x28, 0x1, 0x0) setsockopt$SO_VM_SOCKETS_BUFFER_MIN_SIZE(r5, 0x28, 0x1, &(0x7f0000007800)=0xffffffff00000041, 0x8) bind$vsock_stream(r5, &(0x7f0000000940), 0x10) listen(r5, 0x0) r6 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r6, &(0x7f0000000000)={0x28, 0x0, 0x0, @local}, 0x10) r7 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x503d81, 0x0) r8 = socket$inet_smc(0x2b, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r8, 0x8946, &(0x7f0000000000)={'netdevsim0\x00', &(0x7f0000000240)=@ethtool_ringparam={0x33, 0x1, 0xb0e6, 0xfffffffe, 0x0, 0x0, 0x7, 0x8094, 0x445}}) ioctl$PPPIOCNEWUNIT(r7, 0xc004743e, &(0x7f0000000580)) r9 = socket$inet6(0xa, 0x800000000000002, 0x0) setsockopt$inet_opts(r9, 0x0, 0xd, &(0x7f00000008c0)=';', 0x1) ioctl$PPPIOCSACTIVE(r7, 0x40107446, &(0x7f00000001c0)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0xff}]}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000940)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r11, 0x0, r13, 0x0, 0xf3a, 0x0) ioctl$int_in(r12, 0x5452, &(0x7f0000000000)=0xc) write(r10, 0x0, 0x0) 2.369711637s ago: executing program 2 (id=2563): bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000640)=@bpf_lsm={0x6, 0x2f, &(0x7f0000000a00)=ANY=[@ANYBLOB="1800000008000000000000000300000018110000", @ANYRES32, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf090000000000005509010000000000950000000000000018120000", @ANYRES32, @ANYBLOB="0000000000000000b703000000000000850000000c000000b700000000000000185300000b000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7020000000000008500000086000000180100002020782500000000002020207b1af8ff00000000bf39decf47f145dacdbfefcb38a100000000000007010000f8faffffb70200000000090000008500000006000100", @ANYRES32, @ANYBLOB="0000000000000000b7080000020000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000020000008500000082000000850000005700000018530000090000000000000000000000bf91000000000000b7020000010000008500000084000000b7000000000000009500000000000000"], &(0x7f00000002c0)='GPL\x00'}, 0x94) (async) r0 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) (async) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r1) ioctl$IOCTL_GET_NCIDEV_IDX(r0, 0x0, &(0x7f00000000c0)=0x0) sendmsg$NFC_CMD_DEV_UP(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000004c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r2, @ANYBLOB="010026bd70003c0200000200000008000100", @ANYRES32=r3], 0xfd45}}, 0x0) write$nci(r0, &(0x7f0000000480)=ANY=[@ANYBLOB="7105040902020766cb440484b907eb0101f8"], 0x12) (async) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000480)=@newtaction={0x18, 0x31, 0x10b, 0x0, 0x0, {}, [{0x4}]}, 0x18}}, 0x0) (async) close(0x3) connect$netrom(0xffffffffffffffff, &(0x7f0000000300)={{0x6, @rose, 0x1}, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @default]}, 0x48) (async) r6 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$IOCTL_GET_NCIDEV_IDX(r6, 0x0, &(0x7f00000000c0)) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.current\x00', 0x275a, 0x0) write$cgroup_pid(r7, &(0x7f0000000000), 0x2a979d) (async) r8 = bpf$MAP_CREATE(0x0, &(0x7f0000000240)=@base={0xe, 0x4, 0x4, 0xc, 0x0, 0xffffffffffffffff, 0x6}, 0x50) r9 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0500000004000000ff0f000007"], 0x48) (async) r10 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='blkio.bfq.io_service_time\x00', 0x26e1, 0x0) close(r10) (async) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)) (async) ioctl$SIOCSIFHWADDR(r10, 0x8b20, &(0x7f0000000000)={'wlan1\x00', @random="c32014016800"}) r11 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x20, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r9, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b70400000000000085000000c300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @netfilter, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) r12 = bpf$PROG_LOAD(0x5, &(0x7f0000000580)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000880)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x5, '\x00', 0x0, @fallback=0x18, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00', r12, 0x0, 0x7fff}, 0x18) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000280)={{r9}, &(0x7f0000000200), &(0x7f0000000240)=r11}, 0x20) (async) r13 = bpf$PROG_LOAD(0x5, &(0x7f0000000c00)={0x20, 0x3, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @netfilter=0x2d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000580)={r13, 0x0, 0x77, 0x0, &(0x7f0000000380)="f6f4e9a1000f00502468da5eb1c6b2feff8833c000c51284d3f4cdbe039b6e141e00000000000080fad24b9b169a274087b1a12a634c6ea0e1c5840fb08832601d4f5013e826b74ff8f1cbcfd24fa17fa9748116fb3f2b2ef4aa2f992a017e425355d3298d18b5f64d91f21e00"/119, 0x0, 0x86, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) (async) r14 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, &(0x7f0000000040)=ANY=[@ANYBLOB="18000000000000000000000000000000850000007b00000018110000", @ANYRES32=r8, @ANYRES64=r4], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000000)='mmap_lock_acquire_returned\x00', r14}, 0x10) 2.196444473s ago: executing program 0 (id=2565): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000040)={'team0\x00', 0x0}) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000000)={0x54, 0x2, 0x6, 0x5, 0x7, 0x0, {0x0, 0x0, 0x3}, [@IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_HASHSIZE={0x8, 0x12, 0x0}]}, @IPSET_ATTR_REVISION={0x5, 0x4, 0x3}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_TYPENAME={0xd, 0x3, 'hash:net\x00'}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x54}, 0x1, 0x0, 0x0, 0x4}, 0x20044454) (async) sendmsg$nl_route_sched(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000004c00)=@newtfilter={0x24, 0x11, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x74, r1, {}, {}, {0x8, 0x5}}}, 0x24}, 0x1, 0xf0ffffffffffff, 0x0, 0x8881}, 0x0) 2.141366151s ago: executing program 2 (id=2566): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(des3_ede)\x00'}, 0x58) (async) r1 = accept4(r0, 0x0, 0x0, 0x800) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f0000000440)=0x400, 0x4) (async) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f00000002c0), r3) sendmsg$IEEE802154_LLSEC_ADD_DEV(r2, &(0x7f0000000240)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f00000006c0)={&(0x7f0000000100)={0x14, r4, 0x100, 0x70bd27, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4044000}, 0x4) (async) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000240)={0x0, 0xffffffffffffffff, 0x0, 0x1a, &(0x7f0000000480)='hgroup\x00\x9c>\xad\xf9uR\tS+u\xc6\x8e\xbc9\xddf\xc40\x97'}, 0x30) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) (async) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000600)=ANY=[@ANYRES64], 0x27) (async) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) ioctl$ifreq_SIOCGIFINDEX_wireguard(0xffffffffffffffff, 0x8933, &(0x7f0000000440)={'wg0\x00'}) getsockopt$inet6_buf(0xffffffffffffffff, 0x29, 0xd2, &(0x7f00000004c0)=""/201, &(0x7f00000005c0)=0xc9) (async) r5 = socket$kcm(0x10, 0x2, 0x0) sendmmsg$inet_sctp(0xffffffffffffffff, &(0x7f0000001f00)=[{&(0x7f0000000000)=@in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, 0x0}], 0x1, 0x0) (async) r6 = socket$inet_sctp(0x2, 0x5, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r6, 0x84, 0xd, &(0x7f0000000000)=@assoc_value, &(0x7f0000000280)=0x8) sendmsg$kcm(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000040)="2e00000010008108040f80ecdb4cb92e0a480e000f000000e8bd6efb250314000e000100240248ff050005001200", 0x2e}], 0x1}, 0x40880) 1.668268234s ago: executing program 2 (id=2568): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000004c0)=@updpolicy={0x1fc, 0x19, 0x1, 0x0, 0x1, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0xfffffffffffffffc}}, [@tmpl={0x144, 0x5, [{{@in=@local, 0x0, 0x3c}, 0x0, @in=@broadcast, 0xfffffffe, 0x2, 0x0, 0x0, 0x0, 0x0, 0x40}, {{@in6=@mcast1, 0x4, 0x3c}, 0x2, @in6=@dev}, {{@in=@empty, 0x4d2, 0x6c}, 0x0, @in=@local}, {{@in6=@local, 0x0, 0x3c}, 0x0, @in=@empty, 0xffffffff}, {{@in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x0, 0x6c}, 0x0, @in=@rand_addr=0x64010101, 0x0, 0x4}]}]}, 0x1fc}, 0x1, 0x0, 0x0, 0x1}, 0x84) socket$nl_route(0x10, 0x3, 0x0) (async) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000640)=@newlink={0x44, 0x10, 0x437, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @bond={{0x9}, {0x14, 0x2, 0x0, 0x1, [@IFLA_BOND_ALL_SLAVES_ACTIVE={0x5}, @IFLA_BOND_NUM_PEER_NOTIF={0x5}]}}}]}, 0x44}}, 0x0) 1.667481211s ago: executing program 3 (id=2569): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x1, 0x4, &(0x7f0000000000)=@framed={{0x18, 0x0, 0x0, 0x0, 0x30}, [@alu={0x4, 0x0, 0x3, 0x0, 0x0, 0x1, 0xffffffffffffffff}]}, &(0x7f00000002c0)='GPL\x00', 0xf, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) close(0x4) r0 = socket$key(0xf, 0x3, 0x2) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000140), 0x4) sendmsg$key(r0, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sendmsg$key(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="0212000002"], 0x10}}, 0x4040) r1 = socket$inet6(0xa, 0x3, 0x5) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000280)={{{@in=@broadcast, @in=@multicast2, 0x0, 0x966, 0x0, 0xfffc, 0x2, 0x20, 0x0, 0x88}, {0x1, 0x4, 0x0, 0x80000000, 0x6, 0x9, 0x0, 0x40000000000000}, {0x0, 0x9, 0x53e5, 0x23}, 0x0, 0x1, 0x1, 0x0, 0x3, 0x1}, {{@in6=@mcast1, 0x0, 0x32}, 0x2, @in=@multicast1, 0x1502, 0x4, 0x0, 0x0, 0x4, 0xfffffffd, 0x1}}, 0xe8) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_I_WANT_MAPPED_V4_ADDR(r2, 0x84, 0xc, 0x0, 0x0) getsockopt(r0, 0x101, 0x4, &(0x7f00000003c0)=""/150, &(0x7f0000000540)=0x96) socket$netlink(0x10, 0x3, 0x10) r3 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_INIT(r3, 0x0, 0xc8, 0x0, 0x0) setsockopt$MRT_ADD_VIF(r3, 0x0, 0xca, &(0x7f0000003d80)={0x0, 0x4, 0x0, 0x0, @vifc_lcl_addr=@local, @dev={0xac, 0x14, 0x14, 0xff}}, 0x10) openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) setsockopt$MRT_ADD_VIF(r3, 0x0, 0xca, &(0x7f00000000c0)={0x8, 0x1, 0x0, 0x0, @vifc_lcl_ifindex, @dev={0xac, 0x14, 0x14, 0x2e}}, 0x10) close(0x3) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, 0x0, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000e00)={0x0, 0x0, &(0x7f0000000040)={0x0, 0x2c}, 0x1, 0x0, 0x0, 0x80}, 0x4000000) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) sendmsg$TIPC_NL_LINK_SET(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000080)={0x40, 0x0, 0x1, 0x70bd2d, 0x25dfdbff, {}, [@TIPC_NLA_LINK={0x2c, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_NAME={0x55, 0x1, 'broadcast-link\x00'}]}]}, 0x40}, 0x1, 0x0, 0x0, 0x24048011}, 0x20040800) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@ipmr_getroute={0x1c, 0x1a, 0x300, 0x70bd25, 0x25dfdbfc, {0x80, 0x20, 0x20, 0x3, 0x8a5b95a07e67d250, 0x3, 0xfe, 0x0, 0x1f00}, ["", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x800) r7 = openat$cgroup(r5, &(0x7f0000000180)='syz1\x00', 0x200002, 0x0) mkdirat$cgroup(r7, &(0x7f0000000380)='syz1\x00', 0x1ff) ioctl$BTRFS_IOC_TREE_SEARCH_V2(r5, 0xc0709411, &(0x7f0000000600)={{0x0, 0x3, 0x10001, 0xbb, 0x0, 0xfffffffffffffffa, 0x6, 0x95, 0x87dd, 0x8, 0x6, 0x9, 0x1, 0x5a, 0x3}, 0x20, [0x0, 0x0, 0x0, 0x0]}) 1.666336109s ago: executing program 0 (id=2571): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000280)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="01002b087000000002000000000018000180140002006e030064657673696d3000000000ffee05001900000000009371c53dff5e622021bfb4b5e359a8aa79c3b4b0e46680c5ef9ef4d080c4aedc37e33b92ed7d072ed0a27c3d8c5decbd1ba2691ff4b84f334f13b45189362514da681393b625401e3b53c70430fb9f91b80f9aeec6d7c8bb5550aa4d6316698d0e44250b2327497738552eaca499f0e9c8a02e99496023d3ad12ae6d2084903715cc"], 0x34}, 0x1, 0x0, 0x0, 0x4044050}, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="5000000020000103feffffff000000000a000000000000000400010008000a000008000005001e"], 0x50}}, 0x4000850) r2 = socket(0x400000000010, 0x3, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000380)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000005000000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) unshare(0x60600) r6 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000140)={&(0x7f0000000040)='sched_switch\x00', r5}, 0x10) bpf$BPF_LINK_UPDATE(0x1d, &(0x7f0000000000)={r6, r5, 0x4, r5}, 0x10) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r4, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x2}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x0, 0x3}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000e40)=@newtfilter={0x84, 0x2c, 0xd27, 0x70bd2d, 0x25dfdc00, {0x0, 0x0, 0x0, r4, {0x0, 0x3}, {}, {0xfff3, 0xffe0}}, [@filter_kind_options=@f_matchall={{0xd}, {0x50, 0x2, [@TCA_MATCHALL_ACT={0x4c, 0x2, [@m_ife={0x48, 0x1, 0x0, 0x0, {{0x8}, {0x20, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c, 0x1, {{0xd, 0xd0ea, 0x20000001, 0x3, 0x4}, 0x1}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x3, 0x3}}}}]}]}}]}, 0x84}, 0x1, 0x0, 0x0, 0x50}, 0x0) r7 = socket(0x400000000010, 0x3, 0x0) r8 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000006080)=@delchain={0x2c, 0x66, 0x1, 0x70bd29, 0x25dfdbff, {0x0, 0x0, 0x0, r9, {0xfff2, 0xfff2}, {0xb}, {0xb, 0xfff3}}, [@TCA_CHAIN={0x0, 0xb, 0x4}]}, 0xfffffffa}, 0x1, 0x0, 0x0, 0x24008858}, 0x0) 1.528437274s ago: executing program 4 (id=2572): bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000740)='scsi_dispatch_cmd_start\x00'}, 0x10) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000040)={0x5, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x41000}, 0x94) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x1, 0x3, 0x5, 0x7, 0xc1}, 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040), &(0x7f0000000100), 0x3f, r0}, 0x38) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f00000002c0)={r0, &(0x7f0000000200), 0x0}, 0x20) r1 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r1, 0x10f, 0x87, &(0x7f0000000140)=@req3={0x7813, 0x3, 0x0, 0x7ff, 0x1fb, 0x1, 0x2}, 0x1c) recvmmsg$unix(r1, &(0x7f0000000b00)=[{{0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000003100)=""/4096, 0x1000}], 0x1}}], 0x1, 0x400122a0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x10, 0xe, &(0x7f0000001540)=ANY=[@ANYBLOB="b7020000f53f6314bfa300000000000024020000fffeff7f7a03f0fff0ffffff79a4f0ff00000000b7060000ffffffff2e64050000000000750afaff07cd02020404000000247d60b7030000030a00006a0a00fe0000000c850000007a000000b70000000000002995000000000000001da5ad3548ebb63d18c5071c7e821c9b767ac8308fbcd5c5e4a5ad1065b572c2c9ff215ac60c2ceaea4c0ec908abb6e7325ec1956bd8660bf3664148a2c96752fe2bb328dff1a15750ab9a780001000000000000d4bf20c2bd152d814f01f2cd519e078d4ffab418e4682b2aec5e4a35629e8ef040c50287c37a7f4182f32333b08c6e497687e10a4daea5cac0ceafdbb126eb02a1f5104d16ddb64963d84d91814cd5817e0b8f6f5e6ee7a39e180b5a18ed786b782ab1321ea5e82ae5ba2c42a5e23ea6253d5df768d0cb9f35e4f41a6211e52bb3598e9b5d4f22d8c19f958e8b34de35949a7a48ce18799ee53da177a81ea65e652c1d71b7ee86a75b0100000042127a8f84538a9a311c757f7169f006f3f5c95177fbd0b14b36259e2905ef911785c88a16aae46084d676d8ef8aa6ecc2d32e3f4ee367c5a769c0a606636c9f4a4413c098f4fcc96623b7c373b0ef04d55b846b094bf97e2ef5987b6e09a6a7cab79bffda141f65e7d9ebe3be70c436432b70a80cce69df30d3d67d84ccf3f9db9b690111de2ddc4b153c989ef100bbf76063d3f6ffffb73d70e9c3d7b90aecf48e7565efff2dbbb512218c98442406333c890923a797e00b75481739952fe87fde27ce81893f54ec0ea8e792414f639bc9ce1fea3f6ac0d7025759d4b45576c205c70631e8ad585951950e521f4e210b6494e3c52d927195737945cc03d5668483151710de246420a1b6c55b73876a6ed7fd0d9338923789a1edcd8043fe83919088383268324a25df14010c8ed6b8d43400eaa00ff9bc46e1cfecbdc0e451ac53b409d04544d3a7edd4d447d2fb431e226ae182b8dcc86fe09b404e0b7c723d3b19c3dc382fa91fb0fb8f9f3f13296bb1758b24aad0922091d49e2bc408a5a37deee7a60b903d2d9fe9d451cafcc8dc389671c2d08b6e264150a6b9445b00cee4585af04fa69e0380be0d66649dcf3bf8a906b029faca75ce34c41aec7aa86e596119109ea8b3f7c65c902499227c087301643baab1c95bb22cedd913b22dcaa197ccc34586dc50bd9f4628e3e77a0de32e356521df06f995cb57f97052fc4158250ccecfb67ea8faf509593fadc7eafb613327b052397af1ede94d87590ce90a0a7579766f0e5eb09d38ac46e99e7ec4fcd3cb0b1a8c531724d5ef6b334803cedaa9cedf16dc3af6e0b67f62a83a256474c97c925d9d447175b535c87dbdeb0dcca5303eed6689ea91e1665c691df736368dde47e6672e93a314c5f60e7b68c2242bd0f0d8c66449d8687dcf2d0f76668b2b9bf8b32b99b7daf34b2d825d192ade90a1162acfe9749d516d014cef5f99126324ea02baea5808c430985749901b09e4902a6f5addc0103756b894418e4591c624a9b206abbfb888d413d923b0d7c9d997d6d8e64787c4d397f57a15b6e0b4212b6cb55b9c207bbe08f483b1bea05f41b9a1d3af087047c568ae6ebfc0bb5ec10b6290dc757a4903a88fb2c035b2349b6d2f0c051b8b7718384eebd5fc19928cea713ff09e179c308fbe9bd64374d96ef2447a2a4af5ca0c39e7ca2e801e57560a55e9cfa095cf3f74398219ad1030a79517a88de7596429a20793e12616aa32b3e720c6521fbe93963e9536d16f3db211fca7dd99c0a0125ff8ef534b93dcb34e1da2c008a9f2a29e30823bf0ec3639cadaf9be9608358e1e5ab17eea477b1754f78f45468c9568471667f82f5e250b979b9f2bd0d1b6bc03d11811ac6eec9a3ecd9e3c3299ee5eb3c6cac8fbd06514b7ee743ece79c04566d02a08fd5fcabbab3d129c0cced3ce11dafa380700000000000000c114d0b423e64c6157fac5e4e2168f33541daeff9983d0e488a78bef538f870b84798272b2101e0abf1cd64500b79e01e11d727389653bd80a39d5bbe2e23d2f5ff10047423429981bd9b4ce680e174c266391e3e7689452654e5cd5ada6e025327a1942b5a068f15fa58eaa267d4e0881783dddbdd777f8be0824ffdf6d06c621880dbbe9534f15e8c2e364d3ec67deb6ab9f2a0f03212972dbd38500000008173553a67be48633103809eee0be51d67d7ce230b389607b4c3b18da1c48f3180f2e0d79e54565fdd9a099b5b5ba2761905b88b7cbfc39c35dd153609da3da263438f12769602c2195245ff83e249119d4f6cabfbdef84ada19ef4a67ed66d7043036515d0be5a231f99e71aba5d5ae04676eff3e85f0844c41bbcfde7a931d1ec55c01f703bfd1b97756bfe55a91f6b379f34a018906339771157c66dbd7471d1beec7f029ef552cf5e92a1a0db21b59355763967ce26a577bc514b6d22a09c385c5ba6caf524e1688fc0f29f8bb35ae7bc8eb5ba51aebdf7d972c3267cedbe77ed70d9c539bc455a6f88b39196c8a224b0acf4d796fea59a07baa34cc270fb096ef330fbebdf872d7d0bc4f9a963355c554abc5cdb91464faabcd09cd9a53f5d1b2ea7e96f428f7cd6735c19c61dc9942d30bf29ef85ed01c2fcd6060aa40eeff971477b4fde48507b7bad95a496540adff7e4a72fd1f94d7c703ab1525c946c54e0da3d7ebfcc8cea2e84c3b310aaea5a1627df898c00a9aaf2d88a36afa4c5b1816384310600001c33125ad7f7970beeb256aec06e39fc6c66544e1d1dc5fea4b68a82e3568ca30aea9a1d097f06f11dc362f4bae5ef57c67686a15855cd351bf26f40fb1348cfce79897682228e6d9643530c81bab27bf7b1c4a76a5be180bb830cf06827c3f38a9c9c580c732c30aaceda78b0297de35a922b1375b129655beb31899e26052cc216f832fdb0a0015f93c9cff77f59cda1ec5f3e358848756cebb074266a47e39ae26e80e8c65aaf73c24925458520a9ca98760d1005c9f81846459ae6d5baa4f02807939ddc29c3520f7c58ed9bc5a569c7a1bc33cf4f330a18276ffb4550b9166c3939e8041094bec034aa0ec6638b74fe34f0f1ec6903a1135808d5d8d26c9203c3f87e66c407b7c5c0888d4558dd657cc0213efad68e76fdd7b23e68064fd4b271ed79c50abacdd2871b0c1f8c971df59a5a1901ddf804bed43e391f882d2a45c51cdbba86b2a1b7c0c4923642a731ea4dcbad2b6ebbebe787a8e28e781d75beee924b3b1e390750f316648133922c021f98fd2d5d71a7a3679397ef6cf432837b7e264831ec01c4c3146ba0caac3b13d55945ec00e978a1c1712cd51187936200606c9cd6877b2f72125295c54721f8e15df2ae282a8becb99a726fd92acc92141e1f574b4b0b3c992a61af3372d0d9217776b1a42cd2cee816a70bf1ddd69b590d53e28ba356e74b38e23e50d898e95cdc7cc809e462c884b53f672aab1411ecfd4c91e7a9782fc6763f0efd4bcbaf1fc3a00000000000000000000000000000000500000000000000000000000048e510340087caf22439d5304bd704a6a78a512269a9b1cbd13bea78c807bbc73853ae187cbb768673e9d1bf74a3b0a6c234accd8506adf314f4c5e08174540b69d3c0da660052b43b86baf49e7ac64d9c21598b1e01dc1e1b5a53626b090496dbf7af441e397016c3c094d5c91ffe0a7ceacfd225ed9a6c905f79ad7052747dd6cceef4c310e0e935311118bc6bf0e5ca6c7cca7d5c03be570308da8a40578b4db14961fbccf6e2f2d56e9509c434126515b56d032e20c12e830d1bc64826fc9b318da5911e466878dbb81edeff69363fb75af5cd80536f14d2eaa7764db23acdbd394bbbbccfd8b129258bb0a93cee1d44f8665172c06933d20f184b78b435462c52a85149451ffd564c56a7cbf11a1127c77242915e43b2bc"], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_msg, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x200000, 0x10, &(0x7f0000000000), 0x143}, 0x48) r2 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000080)={0x1b, 0x0, 0x0, 0x77, 0x0, 0x1, 0x79, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x2, 0x3}, 0x50) bpf$OBJ_PIN_MAP(0x6, &(0x7f0000000100)=@generic={&(0x7f0000000040)='./file0\x00', r2}, 0x18) 1.527225135s ago: executing program 2 (id=2573): r0 = socket$inet6(0xa, 0x1, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f00000004c0)={'syztnl1\x00', &(0x7f0000000740)={'syztnl1\x00', 0x0, 0x29, 0x0, 0x3, 0x0, 0x0, @loopback, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x8, 0x7, 0x2, 0x8}}) getsockopt$inet_sctp6_SCTP_GET_ASSOC_NUMBER(r0, 0x84, 0x1c, &(0x7f0000000240), &(0x7f0000000300)=0x4) syz_init_net_socket$llc(0x1a, 0x1, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x10}) r2 = socket(0x2, 0x2, 0x1) bind$unix(r2, &(0x7f0000000000)=@abs={0x1, 0x0, 0x4e24}, 0x6e) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r3) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r4) sendmsg$TIPC_CMD_ENABLE_BEARER(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}}, 0x0) syz_emit_ethernet(0x2ce, 0x0, 0x0) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x100, 0x0) close(r6) r7 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000280)={0xffffffffffffffff, 0xfff, 0x18}, 0xc) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f00000003c0)={r7, &(0x7f0000000500)="b96a172030cb7c6ed039dd203bc4823ed28b221c530a8a034474fc740795e81976bbfb6af131483b56eef2ecc873c6ed415fe38337241f66c0ec4a38647ddb57cbb391eaf0d18d4094fdf47556e8267126d2bfb75583319b12f1d559c50574a5906441c09bf06b519d8196dcbe465b74e6a56e824cfdddad2a0f2f7c06c5d385e77fb699fd15ace52aadae417199aefefe246d8e5e283dbecb610d08526cea4fa6a7855df2c564205180a170d36142c23aa720ac19b89ba9e4064a62a8", &(0x7f0000000380)}, 0x20) r8 = socket$unix(0x1, 0x2, 0x0) r9 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000440)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0x8000000, {0x0, 0x0, 0x0, r10, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x28, 0x2, {{0x100, 0x6, 0x6361, 0x5, 0xfffffffd, 0x1}, [@TCA_NETEM_LATENCY64={0xc, 0xa, 0x7}]}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x20000001}, 0x0) sendmsg$nl_route_sched(r9, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000140)=@newqdisc={0x3c, 0x24, 0x4ee4e6a52ff56541, 0x70bd29, 0x80000, {0x0, 0x0, 0x0, r10, {0x0, 0x11}, {0xffe6, 0xb}, {0xb, 0xc}}, [@qdisc_kind_options=@q_plug={{0x9}, {0xc, 0x2, {0x1, 0x2}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x2000c061}, 0x4000000) r11 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r12, 0x8933, &(0x7f00000002c0)={'erspan0\x00', 0x0}) sendmsg$nl_route(r11, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000400)={&(0x7f00000005c0)=ANY=[@ANYBLOB="4800000010003b0c28bd70000000000000000000", @ANYRES32=r13, @ANYBLOB="00800b00010065727370616e00f7187c08b71ff35b32010782ed00028004120006000f000b000000060010004e23000000000000000000000000004e5b645bf2caf938ff12cea0b570d59f3799291231ec39ef095f1ab7744e1901f3dce5dc6148361526149394746f1b7fd03b97c2392a9c3a478f09d8f7ea1c2d"], 0x48}}, 0x0) r14 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r14, 0x107, 0x12, &(0x7f0000000040)={0x0, 0x2}, 0x4) 1.455305489s ago: executing program 3 (id=2575): bpf$BPF_BTF_LOAD(0x12, &(0x7f0000001c40)={&(0x7f0000000000)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x18, 0x18, 0x5, [@struct={0x3, 0x1, 0x0, 0xf, 0x0, 0x7, [{0x3, 0x1, 0x5}]}]}, {0x0, [0x4f, 0x0, 0x30]}}, &(0x7f00000006c0)=""/262, 0x35, 0x106, 0x9}, 0x28) (async) r0 = socket(0x10, 0x80002, 0x0) (async) r1 = bpf$MAP_CREATE(0x100000000000000, &(0x7f0000000440)=@base={0xa, 0x9, 0x8, 0x2}, 0x48) bpf$BPF_MAP_LOOKUP_AND_DELETE_BATCH(0x19, &(0x7f00000001c0)={0xffffffffffffffff, 0x0, 0x0, 0x0, 0xffffff80, r1}, 0x38) (async) r2 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$IOCTL_GET_NCIDEV_IDX(r2, 0x0, &(0x7f00000000c0)=0x0) (async) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r4) sendmsg$NFC_CMD_DEV_UP(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r5, @ANYBLOB="010023010000340200000200000008000100", @ANYRES32=r3], 0x1c}}, 0x0) (async, rerun: 32) write$nci(r2, 0x0, 0x0) (async, rerun: 32) sendmsg$nl_route_sched(r0, &(0x7f0000001240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000800)=@newtaction={0x214, 0x30, 0x51b, 0x0, 0x0, {}, [{0x200, 0x1, [@m_skbmod={0x68, 0x1, 0x0, 0x0, {{0xb}, {0x3c, 0x2, 0x0, 0x1, [@TCA_SKBMOD_PARMS={0x24}, @TCA_SKBMOD_SMAC={0x0, 0x4, @multicast}, @TCA_SKBMOD_SMAC={0xa, 0x4, @broadcast}]}, {0x4, 0x14}, {0xc}, {0xc, 0x6}}}, @m_ct={0xa8, 0x0, 0x0, 0x0, {{0x7}, {0x1c, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18}]}, {0x68, 0x6, "9f9b3fc2ddc24af6f0e10a015de0eee6fc0900c6e7d94c24ec368c475d7486514b6d2677226afad90c7d6c3ad311a9dee1f031afe3919c34f8636d67f86e3ebd80589ce5f55db46e88a14f002788b194b3ccfdf8c4b86ba094bef19b3a0cddb8831b84bb"}, {0xc}, {0xc, 0x8, {0x1, 0x2}}}}, @m_tunnel_key={0xec, 0x0, 0x0, 0x0, {{0xf}, {0x54, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_ENC_IPV6_DST={0x14, 0x6, @mcast2}, @TCA_TUNNEL_KEY_PARMS={0x1c}, @TCA_TUNNEL_KEY_ENC_DST_PORT={0x6}, @TCA_TUNNEL_KEY_ENC_DST_PORT={0x6}, @TCA_TUNNEL_KEY_ENC_DST_PORT={0x6}, @TCA_TUNNEL_KEY_NO_CSUM={0xfffffffffffffede}]}, {0x69, 0x6, "9c52af17f462814d38170f632f883a02e6a90db7e490d2b8bd19fcb7872621f629a33220c9b5f21052aa40bb9616cbe2ae3debc7ea8dcc879c436c50c4b2e001d6b687516d71ee6b27e990693d6b67974963a28a690808e192e0ecf03e7f3535c9492c8e09"}, {0xc}, {0xc, 0x8, {0x0, 0x1}}}}]}]}, 0x214}}, 0x0) 1.361351649s ago: executing program 0 (id=2576): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r0, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000700)=ANY=[@ANYBLOB="b4050000200080006110600000000000c60000000000000095000000000000009f33ef60916e6e893f1eeb0be20000d072f5b89c3043c47c896ce0bc8731fa595b6b4d45ef26dcca5582054d54d53cd2b685b431c70ea948259c4c869b4fc8db714e4b94bdae214fa68a051d4dca7d2647bec1fc89398d2b9000f224891060017c4700de60beac671e8e8f00cb03588aa6007e71f871ab5c2ff88afc6002084e5b52710aeee835cf0d78e45f70983826fb8579c1fb47d2c59005cff414ed55b0d18a9d446935fb332bb593ee341ab59016f81860324b800c00000000000092d9c5fe34ccb80a61ffcb3363073fd8962823ee45f5d7394e9510f4ac6c702cfabe8a9c55c8dafcdb110036e14c1035cafdfef6a358cbfadb3579a285580a3c080d4e0a48d7bdc38a0437c8c1b3aa408a0000000000002248950b000000"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x366, 0x10, &(0x7f0000000000), 0x1dd}, 0x48) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="12000000040000000400000012"], 0x48) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000ac0)=ANY=[@ANYRES32=r2, @ANYRES32=r1, @ANYBLOB='&'], 0x10) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000048c0)={r2, &(0x7f00000047c0), &(0x7f0000004880)=@udp=r0}, 0x20) recvfrom$inet6(r0, &(0x7f0000000180)=""/47, 0x78, 0x10062, 0x0, 0x0) syz_emit_ethernet(0x4e, &(0x7f00000020c0)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaa3986dd6c370c8900182b01fecff6a9250000000000000000000025fe8000000000000000000000000000aa"], 0x0) 1.232252533s ago: executing program 0 (id=2577): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000600)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01020000000000000000010000000900010073797a300000000058000000160a01000000000000000000010000000900010073797a30000000000900020073797a31000000002c0003800800014000000000180003801400010076657468315f746f5f626f6e6400000008000240000000006c000000160a0101000b000000000000010000000900020073797a30000000000900010073797a30000000004000038008000140000000002c0003801400010067656e657665300000000000000000001400010076657468315f746f5f626f6e64000000080002"], 0x10c}}, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$IP_VS_SO_SET_ADD(r3, 0x0, 0x482, &(0x7f0000000040)={0x84, @dev={0xac, 0x14, 0x14, 0xb}, 0x5, 0x3, 'sh\x00', 0x1, 0x4, 0x72}, 0x2c) setsockopt$IP_VS_SO_SET_ADDDEST(r3, 0x0, 0x487, &(0x7f0000000000)={{0x84, @multicast2, 0x4e1f, 0x3, 'lc\x00', 0x34, 0x83, 0x5}, {@private=0xa010100, 0x4e23, 0x1, 0x1, 0x12d59, 0x12d5c}}, 0x44) r4 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000100)={&(0x7f00000003c0)=ANY=[@ANYBLOB="9feb010018000000000000de24000080240000000a0000000800000002000413020000d9ad6f73f5db40000700000009000000570f00000600000005001c56a1244c2197e730000061615f2e00"], 0x0, 0x46, 0x0, 0x1, 0x5}, 0x28) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), r2) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000340)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYBLOB="08000500060000000a00e8000802110000010000", @ANYRES8=r4, @ANYRES32=r6, @ANYBLOB="050025bd7000fedbdf250600000000", @ANYRESOCT=r5], 0x30}, 0x1, 0x0, 0x0, 0x40048}, 0x0) sendmsg$NL80211_CMD_GET_PROTOCOL_FEATURES(r1, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x14, r5, 0x800, 0x70bd2c, 0x25dfdbfc, {}, ["", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x10}, 0x1000c410) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={0x0}, 0x1, 0x0, 0x0, 0x4000811}, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) bind$netlink(r7, &(0x7f0000514ff4)={0x10, 0x0, 0x25dfdbfc, 0x2ffffffff}, 0xc) r8 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000a40)=@newtaction={0x68, 0x30, 0x400, 0x0, 0x0, {}, [{0x54, 0x1, [@m_tunnel_key={0x50, 0x1, 0x0, 0x0, {{0xf}, {0x20, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_PARMS={0x1c, 0x2, {{0x1, 0x0, 0x0, 0x8}, 0x2}}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x68}, 0x1, 0x0, 0x0, 0x4}, 0x0) sendmmsg(r8, &(0x7f00000002c0), 0x40000000000009f, 0x0) r9 = syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/ipc\x00') r10 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r10, &(0x7f0000000200)={0x28, 0x0, 0xffffffff, @my=0x1}, 0x10) r11 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r11, &(0x7f0000000200), 0x806000) recvfrom$packet(r11, &(0x7f0000000700)=""/252, 0xfc, 0x40014000, &(0x7f0000000440)={0x11, 0x1a, 0x0, 0x1, 0x4}, 0x14) r12 = syz_genetlink_get_family_id$l2tp(&(0x7f00000004c0), r8) sendmsg$L2TP_CMD_TUNNEL_GET(r7, &(0x7f0000000800)={&(0x7f0000000480)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000840)=ANY=[@ANYBLOB='t\x00\x00\x00', @ANYRES16=r12, @ANYBLOB="04002bbd7000fcdb35000000000000000d000400000006001c00010000000500070002000000080009000000000014002000ff010000000000000000000000000001080018000a010100140008007663616e300000000000000000000000080009000000000006001d0006000000bc63b64f451f"], 0x74}, 0x1, 0x0, 0x0, 0x80}, 0x80) connect$vsock_stream(r10, &(0x7f0000000080)={0x28, 0x0, 0x0, @local}, 0x10) ioctl$F2FS_IOC_DECOMPRESS_FILE(r9, 0xf517, 0x0) socket$nl_route(0x10, 0x3, 0x0) 1.177783784s ago: executing program 1 (id=2579): r0 = socket$kcm(0x10, 0x2, 0x10) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)=@newtaction={0x48, 0x30, 0x53b, 0x0, 0x0, {0x9}, [{0x34, 0x1, [@m_sample={0x30, 0x1, 0x0, 0x0, {{0xb}, {0x4}, {0x4}, {0xc}, {0xc, 0x4, {0x3}}}}]}]}, 0x48}}, 0x0) r1 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0) close(r1) syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000300)='ns/net\x00') bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1e, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000001000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x24}, 0x94) r2 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1e, 0x3, &(0x7f00000000c0)=ANY=[], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x94) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000005c0)={r2, 0x0, 0x24, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0xa) r3 = socket$kcm(0x10, 0x2, 0x4) r4 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1e, 0x3, &(0x7f00000000c0)=ANY=[], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x94) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000005c0)={r4, 0x0, 0x24, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0xa) sendmsg$inet(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000240)="5c00000012006b04000000d86e6c1d0002887ea6ea65670000000000000090f9c3dc90f8f41f8ecff32c6e020075e300250045586c8da718ad4b4460bc24eab55600000000000000bf9367b4fa51f60a64c9f4d4938037e786a6d0bd", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000040)=@RTM_NEWMDB={0x38, 0x54, 0x1, 0x1, 0x0, {}, [@MDBA_SET_ENTRY={0x20, 0x1, {0x0, 0x1, 0x0, 0x3, {@ip4=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x86dd}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4}, 0x0) write(0xffffffffffffffff, &(0x7f00000000c0)="842a0a65bd8c2b", 0x7) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0xd18c9b25, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f03003f000b05d25a806c8c6394f90324fc60100002000a000300053582c137153e3704020180fc0b09000c00", 0x33fe0}], 0x1}, 0x0) 1.085958864s ago: executing program 1 (id=2580): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)={0x2, 0x4, 0x8, 0x1, 0x80, 0x1, 0x0, '\x00', 0x0, 0x0}, 0x48) sendfile(r0, r0, &(0x7f0000000040)=0x6, 0xffffffff) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x1f, 0x11, &(0x7f0000001540)=@framed={{}, [@call={0x85, 0x0, 0x0, 0xe}, @snprintf={{}, {0x3, 0x3, 0x3, 0xa, 0xa}, {0x5, 0x0, 0xb, 0x8, 0x0, 0x0, 0x4}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r0}, {}, {0x85, 0x0, 0x0, 0xb3}}]}, &(0x7f0000000440)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x38, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000000)={r1}, 0xc) 1.016596444s ago: executing program 2 (id=2581): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet6_int(r0, 0x29, 0x9, 0x0, 0x0) syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff) sendto$inet6(r0, &(0x7f0000847fff)='X', 0x1, 0xe0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x2, @loopback, 0x1}, 0x1c) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000000)={0x6000200d}) 978.966859ms ago: executing program 1 (id=2582): bpf$PROG_LOAD_XDP(0x5, &(0x7f00000000c0)={0x12, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xf, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) (async) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000000c0)={0x12, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xf, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) r0 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r0, 0x84, 0xf, &(0x7f00000000c0)={0x0, @in6={{0xa, 0x4e21, 0x6, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x5}}, 0xfff, 0x4345f3af, 0x1, 0x7, 0x3}, &(0x7f0000000180)=0x98) socket(0x1, 0x803, 0x0) (async) r1 = socket(0x1, 0x803, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000037c0)={0x0, 0x0, &(0x7f0000003780)={&(0x7f0000000340)=@newtaction={0x84, 0x30, 0x12f, 0x0, 0x0, {}, [{0x70, 0x1, [@m_police={0x6c, 0x1, 0x0, 0x0, {{0xb}, {0x40, 0x2, 0x0, 0x1, [[@TCA_POLICE_TBF={0x3c, 0x1, {0x0, 0x0, 0x0, 0x0, 0x0, {0xcb, 0x0, 0x0, 0x0, 0x0, 0x7}, {0x7, 0x0, 0x0, 0x0, 0x0, 0x7}}}]]}, {0x4}, {0xc, 0xb}, {0xc, 0xa, {0x2}}}}]}]}, 0x84}}, 0x0) accept$packet(r1, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000000080)=0x14) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) (async) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000001900)=@newlink={0x60, 0x10, 0x403, 0x300, 0x0, {}, [@IFLA_LINKINFO={0x30, 0x12, 0x0, 0x1, @vlan={{0x9}, {0x20, 0x2, 0x0, 0x1, [@IFLA_VLAN_FLAGS={0xc, 0x2, {0x1e, 0x1b}}, @IFLA_VLAN_ID={0x6, 0x1, 0xffe}, @IFLA_VLAN_PROTOCOL={0x6, 0x5, 0x88a8}]}}}, @IFLA_LINK={0x8, 0x5, r3}, @IFLA_MASTER={0x8, 0xa, r3}]}, 0x60}, 0x1, 0x0, 0x0, 0x4000010}, 0x8000) 902.899992ms ago: executing program 1 (id=2583): r0 = socket(0x2a, 0x2, 0x0) sendto$isdn(r0, 0x0, 0xfffffeb3, 0x0, &(0x7f00000003c0)={0x22, 0xff, 0x4, 0xd, 0x81}, 0x6) r1 = socket$pppl2tp(0x18, 0x1, 0x1) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = socket$pppl2tp(0x18, 0x1, 0x1) r4 = socket$inet_udp(0x2, 0x2, 0x0) connect$pppl2tp(r3, &(0x7f0000000980)=@pppol2tpin6={0x18, 0x1, {0x0, r4, 0x1, 0x0, 0x0, 0x0, {0xa, 0xfffe, 0x0, @local, 0x80000}}}, 0x32) connect$pppl2tp(r1, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r2, 0x2, 0x0, 0x0, 0x1, {0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0xa}}}, 0x32) r5 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r5, &(0x7f0000000080)=@pppol2tpv3={0x18, 0x1, {0x3, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x2, 0xfffffffd}}, 0x2e) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_GET(r6, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="14000000", @ANYRES16=r7, @ANYBLOB="2503000000000600000008"], 0x14}}, 0x50) socket(0x2a, 0x2, 0x0) (async) sendto$isdn(r0, 0x0, 0xfffffeb3, 0x0, &(0x7f00000003c0)={0x22, 0xff, 0x4, 0xd, 0x81}, 0x6) (async) socket$pppl2tp(0x18, 0x1, 0x1) (async) socket$inet_udp(0x2, 0x2, 0x0) (async) socket$pppl2tp(0x18, 0x1, 0x1) (async) socket$inet_udp(0x2, 0x2, 0x0) (async) connect$pppl2tp(r3, &(0x7f0000000980)=@pppol2tpin6={0x18, 0x1, {0x0, r4, 0x1, 0x0, 0x0, 0x0, {0xa, 0xfffe, 0x0, @local, 0x80000}}}, 0x32) (async) connect$pppl2tp(r1, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r2, 0x2, 0x0, 0x0, 0x1, {0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0xa}}}, 0x32) (async) socket$pppl2tp(0x18, 0x1, 0x1) (async) connect$pppl2tp(r5, &(0x7f0000000080)=@pppol2tpv3={0x18, 0x1, {0x3, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x2, 0xfffffffd}}, 0x2e) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) (async) sendmsg$L2TP_CMD_TUNNEL_GET(r6, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="14000000", @ANYRES16=r7, @ANYBLOB="2503000000000600000008"], 0x14}}, 0x50) (async) 572.01437ms ago: executing program 4 (id=2584): socket$netlink(0x10, 0x3, 0x10) r0 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r0, &(0x7f0000514ff4)={0x10, 0x0, 0x25dfdbfb, 0x2ffffffff}, 0xc) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000300), 0x4) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000001c0)={&(0x7f0000000700)=ANY=[@ANYBLOB], 0x0, 0x4c}, 0x28) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r0, 0x10e, 0x4, &(0x7f0000000040)=0x1800, 0x4) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = socket$netlink(0x10, 0x3, 0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000100)="29000000140005b7ff000000040860eb0101b6ff021596db2d6d6974b5d728aa4b5d02c26ed638eeb7", 0x29) sendmsg$nl_generic(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000001ac0)={&(0x7f0000000000)=ANY=[@ANYBLOB="2c0000002d00010026bd7000fcdbdf2504"], 0x2c}, 0x1, 0x0, 0x0, 0x4000d}, 0x20008010) syz_genetlink_get_family_id$fou(&(0x7f0000000080), r1) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000000)="2e00000010008188e6b62aa73772cc9f1ba1f848430000005e1406ca000000000e000a000f000000028000001294", 0xffffffffffffff4e}], 0x1}, 0x0) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$cgroup_int(r5, &(0x7f0000000200), 0xffffffc1) getsockopt$IP_SET_OP_GET_BYNAME(r3, 0x1, 0x53, &(0x7f0000000180)={0x6, 0x7, 'syz0\x00'}, &(0x7f0000000340)=0x28) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x22052, r5, 0x0) setsockopt$inet_sctp_SCTP_RTOINFO(r5, 0x84, 0x0, &(0x7f0000000280)={0x0, 0x7, 0x2}, 0x10) mmap(&(0x7f0000a74000/0x4000)=nil, 0x4000, 0x0, 0x13, r2, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_TID_CONFIG(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)=ANY=[], 0x28}}, 0x0) sendmsg$NFT_BATCH(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=ANY=[@ANYRES8=r0, @ANYRESDEC=r0], 0x2f8}, 0x1, 0x0, 0x0, 0x20000841}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000940)=ANY=[@ANYBLOB="58000000020601080000000000000000030000000900020073797a3100000000050001000700000005000500020000000c000780080006400000040111000300686173683a6e65742c6e657400000000050004"], 0x58}, 0x1, 0x0, 0x0, 0x20008000}, 0x0) socket$can_raw(0x1d, 0x3, 0x1) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r7, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000580)=ANY=[@ANYBLOB="4c0000000906010200000000000000000300fffd0900020073797a31000000000500010007000000240700000000018008000140ffffffff0c00148008000140ac1414bb080009400000007f"], 0x4c}, 0x1, 0x0, 0x0, 0xd24f4d5778621d46}, 0x4) 502.248208ms ago: executing program 0 (id=2585): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000ac0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a5c010000090a010200000000000000000500000408000440000000010800054000000004080109800800014000000005fc0002801c000180080001400000000108000140000000d408000140000008000c00018008000140470018741c000180080001400000000008000140fffffffa080001400000000124000180080001400000001008000140000007ff08000140ffff7fff08000140000000091c000180080001400000000108000140000000040800014000001b2924000180080001400000000e0800014000000003080001400000000508000140000000043c0001800800014000000002080001400000000e08000140000000040800014000000004080001400000000408000140000000040800014000000006140001800800014000000004080001400000384908000340000000000900010073797a3000000000080006400000000008000a4000000002090002"], 0x3cc}, 0x1, 0x0, 0x0, 0x8000}, 0x20000854) (async) r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x4a, &(0x7f0000000200)=0x47c5, 0x4) (async) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) (async) socket$inet_icmp_raw(0x2, 0x3, 0x1) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) (async) syz_open_procfs$namespace(0x0, &(0x7f0000000200)='ns/pid_for_children\x00') (async) r4 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) connect$netrom(r4, &(0x7f0000000300)={{0x6, @rose, 0x1}, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @default]}, 0x48) r5 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) bind$netrom(r5, &(0x7f00000004c0)={{0x6, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, 0x1}, [@null, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @null]}, 0x48) (async) listen(0xffffffffffffffff, 0x80) r6 = accept$netrom(r5, 0x0, 0x0) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x275a, 0x0) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r7, &(0x7f0000000200)=0x200000000000000, 0x12) ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305829, &(0x7f0000000380)={0x0, 0x1, 0x4804, 0x6}) (async) recvmmsg(r4, &(0x7f0000007cc0)=[{{0x0, 0x0, 0x0}, 0x80}], 0x1, 0x32000, 0x0) close(0x3) recvmmsg(r4, &(0x7f0000003f00)=[{{0x0, 0x0, 0x0}, 0x7ff}], 0x1, 0x10000, 0x0) (async) unshare(0x6a040000) r8 = accept4(0xffffffffffffffff, 0x0, 0x0, 0x80800) (async) r9 = socket(0x8, 0x0, 0x8000) getsockopt$TIPC_DEST_DROPPABLE(r9, 0x10f, 0x81, &(0x7f0000000040), &(0x7f00000000c0)=0x4) (async) r10 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYRESOCT=r3, @ANYRES32=0x0, @ANYRESDEC=r4, @ANYRES64=r9, @ANYRESDEC=r6, @ANYRESDEC=r8, @ANYRESHEX=r0, @ANYRESDEC, @ANYRESHEX=r5], &(0x7f00000002c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0xc}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r10, 0x5, 0xb68, 0xfffffffffffffd2e, &(0x7f0000000000)='e', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x4}, 0x48) setsockopt$sock_attach_bpf(r8, 0x1, 0x32, &(0x7f0000000080)=r10, 0x4) (async) ioctl$sock_netrom_SIOCADDRT(r9, 0x400261f3, 0x0) sendmmsg$inet6(r2, &(0x7f0000002400)=[{{&(0x7f0000000140)={0xa, 0x4e21, 0x0, @local}, 0x1c, &(0x7f0000000240), 0x4}}, {{&(0x7f0000000180)={0xa, 0x4e21, 0x100, @ipv4={'\x00', '\xff\xff', @remote}, 0xffff}, 0x1c, &(0x7f00000003c0)=[{&(0x7f0000000100)="ae00e8f5", 0x4}], 0x1}}], 0x2, 0x20008144) 492.745143ms ago: executing program 2 (id=2586): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCSIFBR(r0, 0x8941, &(0x7f0000001240)=@add_del={0x2, &(0x7f0000001200)='syzkaller0\x00'}) recvmmsg(r0, &(0x7f0000000fc0)=[{{&(0x7f0000000000)=@llc, 0x80, &(0x7f0000000540)=[{&(0x7f0000000080)=""/218, 0xda}, {&(0x7f0000000180)=""/37, 0x25}, {&(0x7f00000001c0)=""/154, 0x9a}, {&(0x7f0000000280)=""/245, 0xf5}, {&(0x7f0000000380)=""/19, 0x13}, {&(0x7f00000003c0)=""/215, 0xd7}, {&(0x7f00000004c0)=""/92, 0x5c}, {&(0x7f0000001280)=""/4096, 0x1000}, {&(0x7f0000002280)=""/4096, 0x1000}], 0x9, &(0x7f0000000600)=""/51, 0x33}, 0x1}, {{&(0x7f0000000640)=@caif=@dbg, 0x80, &(0x7f00000008c0)=[{&(0x7f00000006c0)=""/158, 0x9e}, {&(0x7f0000003280)=""/4096, 0x1000}, {&(0x7f0000000780)=""/90, 0x5a}, {&(0x7f0000000800)=""/192, 0xc0}], 0x4}, 0x9}, {{&(0x7f0000000900)=@xdp, 0x80, &(0x7f0000000b40)=[{&(0x7f0000000980)=""/250, 0xfa}, {&(0x7f0000000a80)=""/90, 0x5a}, {&(0x7f0000000b00)=""/21, 0x15}], 0x3, &(0x7f0000000b80)=""/57, 0x39}, 0x40}, {{&(0x7f0000000bc0), 0x80, &(0x7f0000000e80)=[{&(0x7f0000000c40)=""/230, 0xe6}, {&(0x7f0000000d40)=""/181, 0xb5}, {&(0x7f0000000e00)=""/123, 0x7b}], 0x3, &(0x7f0000000ec0)=""/171, 0xab}, 0xffffffff}, {{0x0, 0x0, &(0x7f0000000f80)=[{&(0x7f0000004280)=""/4096, 0x1000}], 0x1, &(0x7f0000005280)=""/4096, 0x1000}, 0xc}], 0x5, 0x0, &(0x7f0000001100)={0x0, 0x989680}) 444.040362ms ago: executing program 1 (id=2587): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r0, &(0x7f0000000100)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r0, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000580)={0xc, 0xe, &(0x7f0000000400)=ANY=[], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x28}, 0x94) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000001200)={0x6}, 0x8) bpf$PROG_BIND_MAP(0x23, &(0x7f0000000100)={r1, 0x1}, 0xc) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\n\x00\v\x00'], 0x1c}}, 0x0) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, &(0x7f0000000280)=@framed={{}, [@call={0x85, 0x0, 0x0, 0xae}, @ringbuf_output={{}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, &(0x7f0000000180)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x27, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='tlb_flush\x00', r4}, 0x10) connect$inet6(r2, &(0x7f0000000200)={0xa, 0x0, 0x2, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r2, 0x6, 0x1f, &(0x7f00000000c0), 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r2, 0x6, 0x14, &(0x7f0000000080)=0x1, 0x4) r5 = socket$inet(0x2b, 0x801, 0x0) setsockopt$IP_VS_SO_SET_ADD(r5, 0x0, 0x48f, &(0x7f0000000000)={0x6, @empty, 0x4e23, 0x0, 'lc\x00', 0x3e48fd5b307ee845, 0x6000000, 0x60}, 0x2c) writev(r2, &(0x7f0000000180)=[{&(0x7f0000000280)="581a17919cc77431510e7fc4ed9fb860505f1495ff92f16a44f8a13d48751d926def1f80b315bdc726cdd8b5d1a91f485854af8fc854b0da7a02522fe7b2c21db7a46c79afc0d444e6c78b0216d2201b128df9d4ed5b4dbe676fe56a6354f819d997a6acb8595633cff6f77473b2b3abcc65b51cb3d3a30bf9b0b2ce59d568d3a89b49331904da2a37c89ea236f5d5640c32c3ac74e4bde1a62c560cb63836552f881c8a8305d2a13d838a5160a6c06c63decc865a92e9539f3513af3a1e6f78608890f912f087214dac06387a94d5e1b31c35be117ee540dc4560aa500269b81a0bbc", 0xe3}, {&(0x7f0000000500)="1d4ac370cf8c47025bd7a6546c8bd2123991596dfcd1abdb72276d5f80b1d38cedd7d704de6e472fa6961cd700b4f8e0f594861c0296ca9277c9bbf83e11a3ab33449d0e26aa8bcb6c2ef92371cef7a8fe1397dbd240e487b11f3012914b4acc767c16ae7b3dd1866d92c688", 0x6c}, {&(0x7f0000000380)="88e584aac45d6d83e6c2e7857149eb55d2c259a747dbdfc0787e87150d7e40953e657417f2c201284dd4714eb14ce94fb9be03e73d06a982f5502b3ae3a800c03902057e1ec6", 0x46}, {&(0x7f0000000980)="83c0b58e5bcffe6c14ab199d81f63d9e77512d040c3f3a7b41a3a1ed6cf40450443e4e377139b523e33dd725f87a1ed934fafcda19e1fc6ea21fe2eef736ec85289f34830b89c7169369862871b9608f1b976924a41f64f236a395543ddbbb994b75f6c4ad06013851713e9d30f195383be99db35611dd11a69721e423fcf5904c2af8ca4b1774bc6438d1c6218a2ada56e5fe64f49c2d986d6ecd4aafbd01536f931c84ec7f95ce8c6d118d1dec3bfa645c3e72018e9c154a80fd84b6e0233520ee1dc56ec624728200000000daec103b8b3d308b6d95a100000000004b4b8c69a213b72547a209a1646fac7c50e91ce31a4ef520eb4ae4a6cf96270c7ba700"/267, 0x10b}, {&(0x7f0000004480)="d21e96a9f6be3d72e3f91fa2db455d6b88df49377d7988389bd1ecc97042b565d013ec3fcee93a43afdf71b3751d0f53e4ca87fd4b71713fcc3b729c601778385e68ae4e55370c965ca8189dcf4f4e8c70fc343965f9c540163a19215f1d988f1bf6b6f57ce74575d0a1223da74c72adeed27d968bfdcd14597ebe90fc5167cbc1f5856d6b387bc5c419db52f682bcf13ce9e1d6110291bce66848b7392445ffb232c6b70bff2783564b2a62fa6cf3783f6cf6e84c90162b7cbf0192971f05c597dc20b3c879bd342e9e29e93c8240e8dbb137d3d8fcc8f49b37938a52ef12f7d963ff76b91f1473369d06d500d9b88c4f0e0b0ca9049d6b2f3c1886ff41404fab2855eaf1310fa65425a3e9513e33cee970a08de795368e9fe8055fdc5786010c764b3d3ccebec687d242267e932df33cf50c665ea82f1dcf1af952b0e4bf2e35d3c1bdead12e22b371543769fc19a0d893ebb9d71c4da000e2d18a572fdf7c23d921d959caebfbe3ab9157fc9ab6e3dcb88eaa5a5a8af223d7a25a8f198b10dedf68b6d2759a806b6a5bcf3693734ceebeea16b995304511db8d97b62f548213c614bc2dd9b843450eb575c8a8f290af70331a269f1cab6fd6e1f9ef687d80952ba7f14da8cf892d0a5b16dd181d8a7b780055d3b79782a2f4c29c6b9c64bdcde1175ef26c75d0bca19e2be27acb3fdf22a7cff8a659899de59fb2d3e4920881a0900958685263b3fb8dafa6402f5812f16de9e53eda3c86520d5267df729d2add8724d7541b60a3e9a4b70b5f1af83e81071d7e3eb6a9817383632008fbfff89f1c1ab39d9d898d555a0190fa11c8bdfd2d1b49d06fc56acdc426568ccbebbf6f3ce278148f319a1f84adcfb49a675c6d119f52e10386cdd0740199b20087f7c8f75d93959e39d2948a17789f6c6fda65dcb42743b466bcdd06bbe7afccd2b59c0c3f4dc62b8cee2a785ce704bbc47f480079b5f21ace7e5f2f149360370e866565af026b14ec4d9214884661156b5313c233ef1abd2807eb9b586845e3df8001e56b8d4f7c5c9b7e46b81e278ea0a7afb8286183285c390558d750277a7d72a6dab2cf1f29b0d4c847991ec65dd1757889dc9a6e94ce22b58e25cfac06c73532a53663a27208daaf3b4ad5a8c74e4e62b160219f49b6983674f7a71e56f45c3df8c13c93b2ed468749843dd8954a0d03acc61e5008ccc5a5db5a42d04abdf112e71e4d5876c3ea0db715648a5bb55b5ffd2377aea32f19a07e610456b5a6dda7ab4e6d11a88a5910f7f394c7a53d7c032e5506c3b26d54cbe73bfb37cda2439b23c785566668d8111570b7004fa565a156e45c9b672c6ebfb4d08bc681de9ea0215a43a1eefe7a0fb72caf494414c61510c00a8c5e37c4efeca3a1d171f44abbca94a9899b299363bbd1ecdc91d19d6a179f00bd958e372916fde873aaa167bb6be50219c76e6bee7a207f43b729eea5c00052eccb9986b6c137019c47f3fc1d69d68569f8c1d97ecc6b3dec37813f358778edfa2515fd9c4ca7e73966942f65c1a3cc9770065836625671725e3617030df067961c50d2e53a1c69d0e116eb9e0c052e71b3bcc85354829b71295cae5ffbcd5c2794fd16f8601ff5d7278693e384d477920e4619be578ac11f4ef327e5c5298d24ba29fddc7317fc90c69ddc991ee2f3a34c40c2afcd77350c008b9f70b76c97f51bd1359d376cfc83ec0f14a183cef8eccc014bf36d8384262edd4bb03f743c4628bccfef1050deafd13bdcbd73a356a8c630cc4f0665420d414c59276ff1d85ef058069a1ea280b9ae476ea9aa64652c4a83b9b086fd02a3372ae9683521d81ce846ce9b030e81b7523e8f5355c26c66d9182b9b3e089917089a07bf5159f1439200ad74d735b020ccb78225a015c76a57c19344556bce75da0d44e88e2227f5f4a90bb00eb27decf0d0dcf1b6dd0f9146f0191a7f58e3c6a1568e747ba674c33fd6715678232ea1385e8e54955e70ce306fad514235c8bc2576e84444a674c149a67d8db5fea81813aa311fa701bc401101b14661b0f091dad3a1895f3d32fc7012e59e090f487fc9f19e878e04c40eb906deedb29cf65839486f11c4fb7d9c1be6a1c95471d939cc0c85f6fead85e4d081ccc6e2a51784ec4d3f0b13796609161bfcb38a029c10b084e87ceff5483ec6c9691b0ad6a3d05e13e8c48d0700cc58b9436d8011c48381d6ca0ac279c3c71a625585c8b257c54fcb9e9d07183ee0d90b0b5255d153fae38c6c25636846c31142f269229ac4a1d35df88eeaa9413dde791642c9b0ce903cef64609886d18df63515de769df208c9db2acda7db5181f52bb99e74f84b01106c8419543ec2b5106623789316cd825995e42d0cf9f8296f2e5155dbaae8113de5c7a1dddfe42770064e2aae3f100f97d890e3e7eb63ca80d1a8c672ae8e8eaee5b838653a20a58171dc78509a55ea2c590bcffe3f0ca7731edecc2cf3e63c8e8ce335a4f9541691282df4f24a208cd1400dce5e40ddde35dd22c9e75ded061cb349d8cbc92bc00f9c9c4ff49fe887ea630ffc66a087065a90e072b56c9386f3cccda4acb0f10538f361cd860a7efec0eb83ea5165d6a6612800a8d6c7426b0916fc6aec0e7d81ee1a57657ac5c32b58d4e573bf820bc67cc0896012ccff2ace1de0b13f70a744e116a300aaffd1a6ad24513532fb9b9452454874a432cb5f5f6fa2f35668e6e3eb98fdc5c15dc5513c44a26d318d2b7372d6dc1da69d342b95ecb05777716264c79f4a3b953d6acc1006318fd352eb92621360d62b1c651c1fa0dec9a9fe674347902228373bed540251eebb2a8ede5e4f47bacf6acde6f8c5b95dc8b8214175d5649994c710709a5bfdd73360c35af7fc2ea4d35f14994bdccce242be14bff1ce7010b1c353479a1f038dc52e76d5d97340d98e3ad783a4ad95a469eee9193c7e5f93d84f847a6710230fb26f6e0122cb3f0400e7c485b704e3916c4fb0340bed2b4e7640b3ea40a9741f32f81e761119919e9e3fe16aba0b691e9d4e8fc959ae97dad37225a0d3fff627d6241fc0826cc863ec6e0a6c78956dc8878bb8c34dec173161c844462baf2a0d40fb6ea7c6bcf6a4501b92b1bf35c9b1c7d09ad3ee84b5c846404062d6fef2e53f4121b3a04341b58c05460bfa09ff6b92275923798897293e4cc80e6ee6facbab718550e838724ac19c2f86ee656fd607106951936eb56a3263819a69525b9d8bd4b1196ae503b6ee7071f881d740c5781040a78168037ccf819e24a9e3b55dc629aa788972a018d72371e2d64905bcc52b68977a5be41c52dfd42c6dd106a073682ef6c1b09c3d6004436bb6f59c06445768c217b3f36cf8f231e5128944f15fca908e1340cb4d175e9da1f15d5cbdf8fdc2493620b62dee93dfcaf1a56f781b04ef16d0b33e774d89deb827c6ccc4cb83d510c5ba6029317379896b3880f1b2d9f08e6aaf1518b9378f87b135c526782c09eb28b5d74d09cae156dc1809ae258753a59a6b453f28580c3f8ca41cd2977fb2c8f78159e5b5360417b2a72e359e8dc3ee76bed00cce7018286ddd88ee211457683b8136380c1f6281c23308dc08943bdcc36a4bd310d097ac2f5603b214fc3616e1092f3f4c2cda3e098709cf98cbfbd20995c8daa7ece6bb4349c17f07c591eebf1a94c94f1211c6e52837c1e75409c7e7c115b3871fc5cdf1262ece5894a9a4cb264931047074ddc6b4cccf6707b160be4558c6cc0d8c7dc2de6b86af7489815c84517d106ba538c1f4ea22ec6fd29cbc76f94467c51684778649d867041e2c952f4717c6d20345c94ad67f343985f7db04bf6010f6f9308d4ec9ed41620efc7c95fd8c596d22d0302654f81f96a31a05b954768deb359c624537a6fdb450ad54324618b14df9e03f82cbf3f7b73f3535bfe44553c0a37dad2070b5c0565111da8ecf31d412b744d897ebc8e98fbb1e25312686539fd021b68ce5cfada2682a617932911350326eab213b43f436b0d65922bfbc459238d54708f39bdff1ee745aa1bf072670fa55a13e146df08c157927326556667f98002b54fe3ed150a59d359c2b481708b92e204dc3b9a30aae1489cfdc37a17669f5b5077945e0a8ae33c8c1c228486a313560773b32b05aec13f3fd9c42a1824d7c82c7b0b04d55064cf7a0924b243cf184567d26bd4095fbe0dc326ca71b0a3dba3b66511ad69cfb9dabcf71b85342db0bb9d23f29b7d1f1213d48e215eaf70e132e8ce34cf5e2dfd93bbbe7420a6db52641d1be52abeccb216193a993a18f0620a70b479776ccc705f095e915b9cc4a0fb62d11228fb1e5bcc0efa78969639969799dbe63f5f27be3d3fd7f2f5134f5ac3abf3a0a5601480296a6b85bea2090bf13c8f3d3c3a7ffa858b20775f249aaea7d753e9129bae065332bad8d783f9967322a2c358147f450fb5d6a7176c8015b33333106d30d2c690781703c18afb5e88423ffd8b6da20901db90e28647cb4727dbed71210db7ab7c9909b6a142e26757f22f742f84148ac2d88c6ec3bb24832a4b9889705571ced0e0d541a6ae909e3aa854c7f52e939c7062563711890e7046f0736b92188fdbae304953dc5e0bf9de92558ef9d41524ea68ec5f380902fd00719afd0bbc77e9b5034004f0820f22cac8ba92557c9186050a8aa7065a5d5d06b7d8b7bd0fcc4a30aaff5fa0bb2fdd85e801b53859dad6151be7c00f68c34ca8fcd96ddf9980d809d28730d1a86d057f2716637bea7ae9c34dcbf69a9e400cf42dfbbea8b03dc34683df85b3696c7570bed2bfee77bcbbaf3035d81a0308371ff1df315c5", 0xd52}], 0x5) r6 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), r6) setsockopt$inet6_tcp_TLS_TX(r2, 0x11a, 0x2, &(0x7f0000000680)=@gcm_128={{0x303}, "000037d7009400", "c0b6c5b29ca2b838d41ac2fc7ddf972d", "e9be1eae", "bb10000000000001"}, 0x28) readv(r2, &(0x7f0000000e80)=[{&(0x7f0000001040)=""/262, 0x106}, {&(0x7f0000000e00)=""/65, 0x41}], 0x2) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000180), r7) sendmsg$L2TP_CMD_TUNNEL_DELETE(r7, &(0x7f0000001000)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000140}, 0xc, &(0x7f0000000fc0)={&(0x7f0000000440)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r8, @ANYBLOB="200025bd7000060000000200000005001300010000008ea72ee5e05641390dc3ce13673a001dc5766cf869bde6f16229e18b28a267b4c3260d73bcdc03cef48b325382f773f1103aa5c6d5fe13d243e7a1"], 0x1c}, 0x1, 0x0, 0x0, 0x20008000}, 0x24008045) r9 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000100), 0xffffffffffffffff) syz_emit_ethernet(0x46, &(0x7f00000003c0)={@multicast, @remote, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "122d92", 0x10, 0x3a, 0xff, @ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}, @mcast2, {[], @ndisc_ra={0x86, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40000000}}}}}}, 0x0) sendmsg$TIPC_NL_KEY_SET(r7, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB='h\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="0100000000000000000017000000540006803c00040067636d286165732900000000000000000000000000000000000000000000000014000000e3de3d7b4cd07ec3ee777de774fc7987cca41989140003"], 0x68}, 0x1, 0x0, 0x0, 0x4}, 0x4008014) sendmsg$TIPC_NL_SOCK_GET(r2, &(0x7f00000011c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000001180)={&(0x7f0000000ec0)={0x14c, r9, 0x200, 0x70bd2a, 0x25dfdbfc, {}, [@TIPC_NLA_PUBL={0x34, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0xfff}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x202}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x8000}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x4}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0xff}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x5}]}, @TIPC_NLA_SOCK={0x88, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_CON={0x34, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_FLAG={0x8, 0x1, 0xa04}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x8001}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x2}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x7}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x2}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0xffff}]}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x2}, @TIPC_NLA_SOCK_CON={0x3c, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_FLAG={0x8, 0x1, 0xfffffff8}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x2}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0xff}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x5}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x1}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x9}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x9}]}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0xffff7fff}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}]}, @TIPC_NLA_LINK={0x68, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x34, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x800}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xa}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x2}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x4}]}, @TIPC_NLA_LINK_PROP={0x24, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1ff}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1e}]}, @TIPC_NLA_LINK_PROP={0xc, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0xb}]}]}, @TIPC_NLA_PUBL={0x14, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x200}, @TIPC_NLA_PUBL_LOWER={0x8}]}]}, 0x14c}, 0x1, 0x0, 0x0, 0x410c0}, 0x41) 437.953569ms ago: executing program 3 (id=2588): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) bind$bt_l2cap(r1, &(0x7f0000000000)={0x1f, 0x0, @any, 0x0, 0x1}, 0xe) shutdown(r1, 0x0) recvmmsg(r1, &(0x7f0000000080), 0x72a, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r0, 0x84, 0x18, 0x0, 0x0) 358.626809ms ago: executing program 0 (id=2589): unshare(0x6a040000) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={0x0}, 0x1, 0x0, 0x0, 0x880}, 0x804) r1 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="0200000004000000080000000100000080000000", @ANYRES32=0x0, @ANYBLOB="000000000000000000000000eaefffff00000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB='\x00'/28], 0x48) unshare(0x600) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r2, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) bind$inet(r2, &(0x7f0000000080)={0x2, 0x4e23, @local}, 0x10) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000000140)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x0, 0xe3}]}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x40007bd, &(0x7f0000000000)={0x2, 0x4e23, @private=0xa010101}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r2, 0x6, 0xd, &(0x7f0000000100)='bbr\x00', 0x4) sendmmsg$inet(r2, &(0x7f0000001e40)=[{{0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000ac0)="89e4192d92359cb3ee294530ae76ad6dc4ff20cc3ccc9d41018dd482ad1f395d4e38bd22b6fcae05c49fbdfdf66ae2994f191e9222effcb97205d0aaed4b29919f9e3bab7fdb276ca29501903c98de0b0cc8afca563f94fe69b6927ae594d1b53ad9f4a9f9f5c84a518d37939c84a5bd15048115ac421e9c56866ab6f91b0e8181d8999dd86c0177a971a39bf35b38eb0504bf70c02cc307c62d6f06c80b146153ca56a182831696c8cf46d2b065744e6dd4415ceff773e8d3a45aacc4fd8972cbe77878ce48d531066ec9e4790196e4a17b08ea09d4d3febf6721a44390383c7261e9e09f20c23f95e9c04d3c10220f3962d98b2bd98d5c3e50169a4c0c99f29c7a336489c26259957c4bdeae1c8cdf60d817db09336f680bbe954dc05669c9d48cb0a0488ed2385d935a7166b3187189e08d421903d546126289651db812f9c8754c0dc6f24a22ca988a2ac131cc52d724bb086a53a94e515e09fef354e9ca0daacaa347e96b3efd7c5c4063f6eb0cf55f08ff942780e6846d78410057ca2b845e69eeda4066de60a033e2f3c7e47b2f0c0c4c7da98b1d658c620f70dbe6eb8b5dd90216caa82c91db4c0f7ea02df5d5f8d6815d2d7868e6a6053f31a4fbe8732a1310ca7a79814177a981e5ab68dfeba4fe46ed4c51819be1308f73455e311f511ce4360cc7c24836c9b895ee5ce93cc42dd88f02d91b479c1748339024343700cce897087bbaae4fbd8e2ad5da016265ef097043acaf87504dde24216c805b40cf4d6edf2ae6564182acdf06580dde3fb66ab01625ffadc22f1ac7b97b9dec871edd96e86af127be1ef27548917a49476ce87f1719173369caf69d35d25637f0514e3e06069877968eb874a1c1adc92e760670e42b6cccd2fe0a5f9c543a44b382befc422d4486416b6fabe2f11944a3f08cded6fad9e3304a202d1c58841a6ab78b28a4162db2671d9ea74ee6f3b33a282f42abc911e3245531a34f5567cfcaa1cf762677c9f61d3aa2c4d76210edf440bf53e816d008ab2ea29cf42de9b88442d6b2eec4fbf23f7d23eaab316335dfc2dc10f9148df0b83d92c3a94fb0b49365af5ba599a1ea8e6fc7aea8df9208795cbbdf0af04f5f08fc828cb347a6e9daddbe514675b31e5134c7dfbb060dfc632ad82141ddea4e77e6c63c1843ca6fc820558b7355bae86e106c2be9c9b500c5134ab62444a8423d596bfe0e3b2df47dabf5abe271ae947f4878132915332e4fcc5b81ad6f12570de44f0fdd6a96397acebf95421c88ff274365be770edd1bd1f69bc2d2883fa70fa68828bddcb98f90b0b77e28f9c4726e5b0c52fa6f30a8d57321dfd2f2678bbc6511f39019f49d7dde6f19adeac78e4064b8288f5b4ac7d8ca35f7f70dfb376f5f3af98f02e76e57e21a00bac677703c8e2169816f5cf6c4d1bf803e0b2987544eeeffd197bcc10fe1d9a7b826a6693dc8bb32f19f25a88a15c3dcd30e7f48f0cda06ca99152bd1c892735598c32c6098ae12ef493334be720cb0ba3c710954fe0a80c3dec255f194761e5e904262118307bb49901808f9ca1af58648e9d57ffb744fd4f1d01b5ccaeaa5231def3f800cb8341d9109d93e3871c395892f8ffe25d6d9a7faa7073fd9c3b3aac94c554dab9c35667eb49d5f0e47fd6bb41ca4b2f420b1e3915fa653aaf8d842cc4b0fec5011bd0ba372601fb7930ce98402d2e3d64f8422550a621fa23b128e66b6afe1a74dab2b53de22214844e53441ab7998d4ac3557cca9ffe4997c778243c943ca2de0b1deba8468a5fe3c0f1fa93a9a7bb5dbc3ec2058ac7ad4ffa64966bbd90a5f3f53de5c44af6e93f248471ca09cabe6e6c0a87586ff04a5a8cea539d049d82929277cfba7e46fddcdc0f4c2995def4ac27d65bde4bb88dbed3b9cf9eb9501273ca533da1220422f6585bfa77f5df5faaf3250349b514f44bfd55f106792bc7c766eddde2267a12888db542803efcf48357368880fa7771a2d962ae0bb14934a93d28a18da7d39ed6be7d1897e33d3ba0f6db99325a12f64670f22c762a395c9c6ef4e8ef15c0798465b1c9d406ed5731002a0ce72ca4adf125124046d5ac76b6782257587ff6ed55a55f98f8c377e36983b81c4b775cf0d41a9070cd1adeddf2083b635ae671f4e559990164e3a3e32a07c9faa438d73b1662e9eabf061703c7afb7adf2ae5f3acf2fcd57fef779f6b6e68656da61c8d45858d26f3858492e7797fb65d21f47ba805283f74fd473fcbd8b217ab628d62917dd96d5c49ad16d1616a946b8d4108a4d3f11c4f9260d9e01729beaf96231e6fb9d1181a1e032a71adde4c529f14029b728d163714e69f968340f7e2f9f420339bee64275474787d6b14cc9bbcbe1973cad7c29bfa1002adcb67b15c6edc01b00bca7823eb8fb6db7548fdd1ac1f7b3a69ed481c9cd2af0a09abd12e9a4e26e23d69790bdcd07b8da72da3ba97b0f2bc92a7da43845b70ae351f7ccc7cc7d92288f51f45e4d9d31a6bfeaa36621674170aad5d23a194921e81142505ec02020816a855eb162a9a5fefbc10121a534516be5fa2a17ed437cfb09d5085413a883ebf81538c2fd11edd0689bc339fc754d22ac9dec26d1e594f2cd14c605d069df81f876bf8c8b775108db76cac14088b9ea08d72a7f6c552e2954d8afd07f826085b2d67c828acb01943e576035f04c710a7f0edc8b6b9fa11325643d35193c9bb5a17c6e670ed0fc8be003c9fd769c1fe0480b10d7533cf3aeac0d2a157459a06af57d1ae20fb373f430f41c37cb0fb6745bb61f771e18a661dd58d9932eb543b0fb90dafbf495f1568e77a03864b66bfcd91918ceb9c28a1011fa5a3521ecb2042bd98955827a61480cf285739a6b5451a5a7e8d79b883e2782591dfe7817adb263d64bfc7375e68fdcf931661e39a48632335a659eb9daa52907a92dc55225767e2541ffc463faf51d612d874a01fe284b900dfc3ae07a718985e73a96ed4a67b31c6b0605afd89c2d306fac76c44f381bf9dba32f6ea259d1d51b02987b9e1bd3f39730976f1ddee002cb5d30ba518f5209d473fc8182e71a9531c1fec4a5caddef4734d49a16380f8a375c7cd4bced3999cb43da0b8d87ad5ab9f2d39fb4fc761ecfaaa9c0520a57f3c5fe25fea7df7bba7640f0aeb5e5901bee7f69b10a5485dc57ffa9c5328346a282cad3576d6b815e012865edfd25660ca63f7b67f029e31b8e601640983b5cdbb62616b9285f8054982a56ac5618c321b87234b66b10f827e6a1d3094093b75f73dff52cbe4b86e49f19266416804defe3d5488d5d7a1ec2f0276c57944c8064b1243df01c50f3225e87b7cf474becea28f905dd298e793fee5b996b86395c2cec08a1d85df43d855784502797e9de7d8f2fcd9745b9bd7aab3d4cd46d9e1ad3f6c137e9e78316fe0b8474146b27b3e857de06b3a64aa48bcbd185ea51eb83dece2e374be75167c915191a68", 0x999}], 0x1}}], 0x1, 0x40) setsockopt$sock_int(r2, 0x1, 0x8, &(0x7f0000000480)=0x1df9, 0x4) sendto$inet(r2, &(0x7f0000000580)="17", 0x1d4c, 0x10048095, 0x0, 0x0) write(0xffffffffffffffff, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=@newlink={0x24, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x2031}, [@IFLA_XDP={0x4}]}, 0x24}, 0x1, 0x0, 0x0, 0x20048054}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="240000006800010009000000000000000a000000000000000800050001fffe0004000b"], 0x24}, 0x1, 0x0, 0x0, 0x4000080}, 0x0) r4 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x10, 0x1c, &(0x7f0000000040)=@ringbuf={{0x18, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, {{0x18, 0x1, 0x1, 0x0, r4}, {}, {}, {0x85, 0x0, 0x0, 0x5}, {0x4, 0x1, 0xb, 0x9, 0xa}}, {{0x5, 0x0, 0x3}}, [@snprintf={{0x7, 0x0, 0xb, 0x2}, {0x3, 0x0, 0x3, 0xa, 0x2}, {0x5, 0x0, 0xb, 0x9}, {0x3, 0x3, 0x6, 0xa, 0xa, 0xfff8, 0xf1}, {0x7, 0x1, 0xb, 0x6, 0x8}, {0x7, 0x0, 0x0, 0x8}, {}, {0x7, 0x0, 0x0, 0x9}, {0x7, 0x0, 0xc}, {0x18, 0x2, 0x2, 0x0, r1}, {}, {0x46, 0x8, 0xfff1, 0x76}}], {{0x7, 0x1, 0xb, 0x8}, {0x6, 0x0, 0x5, 0x8}, {0x85, 0x0, 0x0, 0x7}}}, &(0x7f0000000980)='GPL\x00', 0x5, 0x0, 0x0, 0x0, 0x9, '\x00', 0x0, @sk_msg, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) connect$pppl2tp(0xffffffffffffffff, &(0x7f00000006c0)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x2, 0x4, 0x1, {0xa, 0x4e20, 0x2ca0, @private2, 0x80000000}}}, 0x32) 283.759572ms ago: executing program 3 (id=2590): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_HEADER(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000480)={&(0x7f00000002c0)={0x28, 0xc, 0x6, 0x101, 0x0, 0x0, {0x0, 0x0, 0x2}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}]}, 0x28}, 0x1, 0x0, 0x0, 0x40000}, 0x400c080) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="0b00000008000000010001000900000001"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f00000002c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYRES64], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f00000002c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r4 = openat$cgroup_int(r3, &(0x7f0000000080)='cpuacct.usage\x00', 0x2, 0x0) sendfile(r4, r4, 0x0, 0x2000000000000002) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000500)={&(0x7f0000000040)='sys_exit\x00', r2}, 0x10) r5 = socket$netlink(0x10, 0x3, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=@newlink={0x5c, 0x10, 0x1, 0x70bd2a, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x40}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @macvlan={{0xc}, {0x18, 0x2, 0x0, 0x1, [@IFLA_MACVLAN_MACADDR={0xa, 0x4, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x1d}}, @IFLA_MACVLAN_MACADDR_MODE={0x8}]}}}, @IFLA_ALT_IFNAME={0x14, 0x35, 'macvlan0\x00'}]}, 0x5c}}, 0x8000) ioctl$SIOCSIFMTU(r5, 0x8922, &(0x7f0000000280)={'macsec0\x00', 0x3}) r7 = socket$inet_udp(0x2, 0x2, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000180)={0x0, 0xffffffffffffffff, 0x0, 0x47, &(0x7f0000000340)='cgroup\x00'}, 0x30) r8 = syz_open_procfs$namespace(0x0, &(0x7f0000000340)) preadv(r8, &(0x7f0000000100)=[{&(0x7f0000000380)=""/21, 0x15}, {&(0x7f0000000400)=""/4096, 0x1000}], 0x2, 0x0, 0x0) ioctl$sock_inet_SIOCGARP(r7, 0x8954, &(0x7f0000000000)={{0x2, 0x4e21, @private=0xa010100}, {0x1, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}, 0x18, {0x2, 0x4e21, @loopback}, 'lo\x00'}) 130.273957ms ago: executing program 4 (id=2591): r0 = socket$kcm(0x21, 0x2, 0x2) ioctl$int_in(r0, 0x5452, &(0x7f0000000100)=0x8) sendmsg$kcm(r0, &(0x7f0000000040)={&(0x7f0000000080)=@rxrpc=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x0, @local}}, 0x80, 0x0, 0x0, &(0x7f0000001a00)=ANY=[@ANYBLOB="180000000000000010010000010000007d95df16a39b1a6c90003f000000000001000005040500002b24ec10064b6f2f000000fb71658bda99b49720fdda5b00000009860f5878c37ffe36e1165814d435be5b317c6c8189767d2f97879f07a515bb7c169f46933d9338f4ab04834e6f618988c5944741afe403461323110f62055394412158e7a3adb164d641aa40d4ab077fe34232aa8b319d7666d0998a61d7da0c86d70000001010"], 0x10b8}, 0x0) 129.285177ms ago: executing program 3 (id=2592): r0 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r0, &(0x7f0000000340)=@nameseq={0x1e, 0x1, 0x3, {0x43}}, 0x10) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000100)={0x43, 0x0, 0x3, 0x3}, 0x10) sendmsg$tipc(r0, &(0x7f00000005c0)={&(0x7f0000000000), 0x10, 0x0}, 0x0) sendmsg$tipc(r0, &(0x7f0000000300)={&(0x7f0000000140)=@nameseq={0x1e, 0x1, 0x1, {0x41}}, 0x10, &(0x7f0000000280)=[{&(0x7f0000000740)='Z', 0x1}], 0x1, 0x0, 0x0, 0x8000000}, 0x4000) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=@newlink={0x44, 0x10, 0xffffff1f, 0x70bd2b, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x11298}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x14, 0x2, 0x0, 0x1, [@IFLA_BR_MCAST_MLD_VERSION={0x5, 0x2c, 0x6}, @IFLA_BR_MCAST_IGMP_VERSION={0x5, 0x2b, 0x2}]}}}]}, 0x44}}, 0x4000) socket$tipc(0x1e, 0x5, 0x0) (async) bind$tipc(r0, &(0x7f0000000340)=@nameseq={0x1e, 0x1, 0x3, {0x43}}, 0x10) (async) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000100)={0x43, 0x0, 0x3, 0x3}, 0x10) (async) sendmsg$tipc(r0, &(0x7f00000005c0)={&(0x7f0000000000), 0x10, 0x0}, 0x0) (async) sendmsg$tipc(r0, &(0x7f0000000300)={&(0x7f0000000140)=@nameseq={0x1e, 0x1, 0x1, {0x41}}, 0x10, &(0x7f0000000280)=[{&(0x7f0000000740)='Z', 0x1}], 0x1, 0x0, 0x0, 0x8000000}, 0x4000) (async) socket$netlink(0x10, 0x3, 0x0) (async) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=@newlink={0x44, 0x10, 0xffffff1f, 0x70bd2b, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x11298}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x14, 0x2, 0x0, 0x1, [@IFLA_BR_MCAST_MLD_VERSION={0x5, 0x2c, 0x6}, @IFLA_BR_MCAST_IGMP_VERSION={0x5, 0x2b, 0x2}]}}}]}, 0x44}}, 0x4000) (async) 0s ago: executing program 1 (id=2593): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000600)={0x10, 0x0, 0x0, 0x10000000}, 0xc, 0x0}, 0x0) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000600), 0x1e) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000140)={'batadv0\x00', 0x0}) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x18, 0x4, &(0x7f0000000040)=ANY=[], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000080)={0x0, 0x0, 0xe}, 0x10}, 0x94) sendmsg$BATADV_CMD_GET_NEIGHBORS(r0, &(0x7f0000004340)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000040)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="31032abd7000000000000900000008000300", @ANYRES32=r2, @ANYBLOB="03798906f45411d408df06"], 0x24}}, 0x4000) kernel console output (not intermixed with test programs): ngth. [ 233.884829][ T9186] netlink: 8 bytes leftover after parsing attributes in process `syz.1.862'. [ 233.913201][ T9186] ip_vti0: Master is either lo or non-ether device [ 233.957446][ T9190] netlink: 8 bytes leftover after parsing attributes in process `syz.1.862'. [ 233.975315][ T9190] ip_vti0: Master is either lo or non-ether device [ 234.127748][ T9199] netlink: 4 bytes leftover after parsing attributes in process `syz.1.866'. [ 234.155369][ T9199] netlink: 4 bytes leftover after parsing attributes in process `syz.1.866'. [ 234.224299][ T9208] netlink: 28 bytes leftover after parsing attributes in process `syz.4.868'. [ 234.333001][ T9212] netlink: 12 bytes leftover after parsing attributes in process `syz.0.870'. [ 234.525874][ T9224] netlink: 'syz.4.874': attribute type 1 has an invalid length. [ 234.566431][ T9224] bond0: (slave lo): Releasing backup interface [ 234.576296][ T9224] bond0: (slave lo): last VLAN challenged slave left bond - VLAN blocking is removed [ 234.789631][ T9241] syzkaller0: entered promiscuous mode [ 234.801218][ T9241] syzkaller0: entered allmulticast mode [ 236.614149][ T9253] __nla_validate_parse: 1 callbacks suppressed [ 236.614170][ T9253] netlink: 36 bytes leftover after parsing attributes in process `syz.4.881'. [ 236.837496][ T51] Bluetooth: hci4: command 0x0405 tx timeout [ 236.956095][ T9291] netlink: 72 bytes leftover after parsing attributes in process `syz.3.890'. [ 237.011318][ T9291] netlink: 12 bytes leftover after parsing attributes in process `syz.3.890'. [ 237.020494][ T9291] netlink: 8 bytes leftover after parsing attributes in process `syz.3.890'. [ 237.511016][ T9309] syzkaller0: entered promiscuous mode [ 237.516685][ T9309] syzkaller0: entered allmulticast mode [ 238.158002][ T9326] netlink: 3 bytes leftover after parsing attributes in process `syz.2.899'. [ 238.908624][ T9326] batadv1: entered promiscuous mode [ 238.920626][ T9326] batadv1: entered allmulticast mode [ 239.540790][ T8340] hid-generic 0005:0007:0008.0002: unknown main item tag 0x0 [ 239.569423][ T8340] hid-generic 0005:0007:0008.0002: hidraw0: BLUETOOTH HID v0.08 Device [syz0] on aa:aa:aa:aa:aa:aa [ 239.595604][ T9374] netlink: 'syz.1.910': attribute type 1 has an invalid length. [ 239.649415][ T9379] netlink: 4 bytes leftover after parsing attributes in process `syz.1.910'. [ 239.653304][ T9374] netlink: 2 bytes leftover after parsing attributes in process `syz.1.910'. [ 239.727755][ T9381] (unnamed net_device) (uninitialized): Removing last ns target with arp_interval on [ 240.050638][ T9397] FAULT_INJECTION: forcing a failure. [ 240.050638][ T9397] name failslab, interval 1, probability 0, space 0, times 0 [ 240.072615][ T9397] CPU: 0 UID: 0 PID: 9397 Comm: syz.1.916 Not tainted syzkaller #0 PREEMPT(full) [ 240.072644][ T9397] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 240.072657][ T9397] Call Trace: [ 240.072665][ T9397] [ 240.072674][ T9397] dump_stack_lvl+0x189/0x250 [ 240.072705][ T9397] ? __pfx____ratelimit+0x10/0x10 [ 240.072727][ T9397] ? __pfx_dump_stack_lvl+0x10/0x10 [ 240.072752][ T9397] ? __pfx__printk+0x10/0x10 [ 240.072783][ T9397] ? __pfx___might_resched+0x10/0x10 [ 240.072803][ T9397] ? fs_reclaim_acquire+0x7d/0x100 [ 240.072828][ T9397] should_fail_ex+0x414/0x560 [ 240.072865][ T9397] should_failslab+0xa8/0x100 [ 240.072898][ T9397] __kmalloc_cache_noprof+0x70/0x3d0 [ 240.072926][ T9397] ? rxrpc_alloc_peer+0x7d/0x330 [ 240.072954][ T9397] rxrpc_alloc_peer+0x7d/0x330 [ 240.072974][ T9397] ? rxrpc_lookup_peer+0x268/0xa60 [ 240.072999][ T9397] rxrpc_lookup_peer+0x3fd/0xa60 [ 240.073021][ T9397] ? _raw_read_unlock+0x28/0x50 [ 240.073045][ T9397] rxrpc_do_sendmsg+0xb0a/0x1220 [ 240.073085][ T9397] ? __pfx_rxrpc_do_sendmsg+0x10/0x10 [ 240.073108][ T9397] ? __local_bh_enable_ip+0x12d/0x1c0 [ 240.073133][ T9397] ? do_raw_spin_unlock+0x122/0x240 [ 240.073166][ T9397] ? rxrpc_sendmsg+0x4cc/0x710 [ 240.073198][ T9397] ? __pfx_rxrpc_sendmsg+0x10/0x10 [ 240.073225][ T9397] __sock_sendmsg+0x21c/0x270 [ 240.073250][ T9397] ____sys_sendmsg+0x505/0x830 [ 240.073285][ T9397] ? __pfx_____sys_sendmsg+0x10/0x10 [ 240.073323][ T9397] ? import_iovec+0x74/0xa0 [ 240.073355][ T9397] ___sys_sendmsg+0x21f/0x2a0 [ 240.073385][ T9397] ? __pfx____sys_sendmsg+0x10/0x10 [ 240.073462][ T9397] ? __fget_files+0x2a/0x420 [ 240.073480][ T9397] ? __fget_files+0x3a0/0x420 [ 240.073510][ T9397] __x64_sys_sendmsg+0x19b/0x260 [ 240.073541][ T9397] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 240.073585][ T9397] ? __pfx_ksys_write+0x10/0x10 [ 240.073610][ T9397] ? rcu_is_watching+0x15/0xb0 [ 240.073636][ T9397] ? do_syscall_64+0xbe/0x3b0 [ 240.073663][ T9397] do_syscall_64+0xfa/0x3b0 [ 240.073684][ T9397] ? lockdep_hardirqs_on+0x9c/0x150 [ 240.073706][ T9397] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 240.073726][ T9397] ? clear_bhb_loop+0x60/0xb0 [ 240.073751][ T9397] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 240.073770][ T9397] RIP: 0033:0x7f7dc8d8ec29 [ 240.073788][ T9397] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 240.073805][ T9397] RSP: 002b:00007f7dc6ff6038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 240.073826][ T9397] RAX: ffffffffffffffda RBX: 00007f7dc8fd5fa0 RCX: 00007f7dc8d8ec29 [ 240.073841][ T9397] RDX: 0000000000000000 RSI: 0000200000000040 RDI: 0000000000000003 [ 240.073853][ T9397] RBP: 00007f7dc6ff6090 R08: 0000000000000000 R09: 0000000000000000 [ 240.073865][ T9397] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 240.073877][ T9397] R13: 00007f7dc8fd6038 R14: 00007f7dc8fd5fa0 R15: 00007fff442a2d98 [ 240.073911][ T9397] [ 240.635887][ T9396] netlink: 8 bytes leftover after parsing attributes in process `syz.4.915'. [ 240.927422][ T9411] netlink: 104 bytes leftover after parsing attributes in process `syz.1.919'. [ 240.988411][ T9396] syz.4.915 (9396) used greatest stack depth: 17608 bytes left [ 241.302925][ T9429] netlink: 24 bytes leftover after parsing attributes in process `syz.1.924'. [ 241.347967][ T9432] openvswitch: netlink: Flow actions attr not present in new flow. [ 241.470467][ T9441] nbd: must specify at least one socket [ 241.511078][ T9443] FAULT_INJECTION: forcing a failure. [ 241.511078][ T9443] name failslab, interval 1, probability 0, space 0, times 0 [ 241.541182][ T9443] CPU: 1 UID: 0 PID: 9443 Comm: syz.3.928 Not tainted syzkaller #0 PREEMPT(full) [ 241.541211][ T9443] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 241.541223][ T9443] Call Trace: [ 241.541231][ T9443] [ 241.541240][ T9443] dump_stack_lvl+0x189/0x250 [ 241.541277][ T9443] ? __pfx____ratelimit+0x10/0x10 [ 241.541300][ T9443] ? __pfx_dump_stack_lvl+0x10/0x10 [ 241.541324][ T9443] ? __pfx__printk+0x10/0x10 [ 241.541356][ T9443] ? __pfx___might_resched+0x10/0x10 [ 241.541375][ T9443] ? fs_reclaim_acquire+0x7d/0x100 [ 241.541400][ T9443] should_fail_ex+0x414/0x560 [ 241.541437][ T9443] should_failslab+0xa8/0x100 [ 241.541470][ T9443] __kmalloc_cache_noprof+0x70/0x3d0 [ 241.541498][ T9443] ? rxrpc_alloc_peer+0x7d/0x330 [ 241.541525][ T9443] rxrpc_alloc_peer+0x7d/0x330 [ 241.541546][ T9443] ? rxrpc_lookup_peer+0x268/0xa60 [ 241.541570][ T9443] rxrpc_lookup_peer+0x3fd/0xa60 [ 241.541592][ T9443] ? _raw_read_unlock+0x28/0x50 [ 241.541617][ T9443] rxrpc_do_sendmsg+0xb0a/0x1220 [ 241.541657][ T9443] ? __pfx_rxrpc_do_sendmsg+0x10/0x10 [ 241.541680][ T9443] ? __local_bh_enable_ip+0x12d/0x1c0 [ 241.541705][ T9443] ? do_raw_spin_unlock+0x122/0x240 [ 241.541737][ T9443] ? rxrpc_sendmsg+0x4cc/0x710 [ 241.541768][ T9443] ? __pfx_rxrpc_sendmsg+0x10/0x10 [ 241.541794][ T9443] __sock_sendmsg+0x21c/0x270 [ 241.541818][ T9443] ____sys_sendmsg+0x505/0x830 [ 241.541851][ T9443] ? __pfx_____sys_sendmsg+0x10/0x10 [ 241.541888][ T9443] ? import_iovec+0x74/0xa0 [ 241.541919][ T9443] ___sys_sendmsg+0x21f/0x2a0 [ 241.541948][ T9443] ? __pfx____sys_sendmsg+0x10/0x10 [ 241.542012][ T9443] ? __fget_files+0x2a/0x420 [ 241.542030][ T9443] ? __fget_files+0x3a0/0x420 [ 241.542059][ T9443] __x64_sys_sendmsg+0x19b/0x260 [ 241.542089][ T9443] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 241.542128][ T9443] ? __pfx_ksys_write+0x10/0x10 [ 241.542152][ T9443] ? rcu_is_watching+0x15/0xb0 [ 241.542178][ T9443] ? do_syscall_64+0xbe/0x3b0 [ 241.542205][ T9443] do_syscall_64+0xfa/0x3b0 [ 241.542225][ T9443] ? lockdep_hardirqs_on+0x9c/0x150 [ 241.542247][ T9443] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 241.542273][ T9443] ? clear_bhb_loop+0x60/0xb0 [ 241.542296][ T9443] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 241.542314][ T9443] RIP: 0033:0x7fa99678ec29 [ 241.542332][ T9443] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 241.542348][ T9443] RSP: 002b:00007fa997581038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 241.542369][ T9443] RAX: ffffffffffffffda RBX: 00007fa9969d5fa0 RCX: 00007fa99678ec29 [ 241.542384][ T9443] RDX: 0000000000000000 RSI: 0000200000000040 RDI: 0000000000000003 [ 241.542396][ T9443] RBP: 00007fa997581090 R08: 0000000000000000 R09: 0000000000000000 [ 241.542408][ T9443] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 241.542419][ T9443] R13: 00007fa9969d6038 R14: 00007fa9969d5fa0 R15: 00007ffd13fb6078 [ 241.542452][ T9443] [ 242.166865][ T9471] __nla_validate_parse: 2 callbacks suppressed [ 242.166884][ T9471] netlink: 12 bytes leftover after parsing attributes in process `syz.3.937'. [ 242.467945][ T9481] netlink: 'syz.1.941': attribute type 1 has an invalid length. [ 242.540586][ T9481] 8021q: adding VLAN 0 to HW filter on device bond10 [ 242.579384][ T9490] netlink: 8 bytes leftover after parsing attributes in process `syz.3.944'. [ 242.614958][ T9490] netlink: 'syz.3.944': attribute type 30 has an invalid length. [ 242.697338][ T1152] netdevsim netdevsim3 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 242.810281][ T1152] netdevsim netdevsim3 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 242.820321][ T9500] FAULT_INJECTION: forcing a failure. [ 242.820321][ T9500] name failslab, interval 1, probability 0, space 0, times 0 [ 242.833712][ T1152] netdevsim netdevsim3 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 242.845337][ T9500] CPU: 0 UID: 0 PID: 9500 Comm: syz.0.947 Not tainted syzkaller #0 PREEMPT(full) [ 242.845367][ T9500] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 242.845378][ T9500] Call Trace: [ 242.845387][ T9500] [ 242.845396][ T9500] dump_stack_lvl+0x189/0x250 [ 242.845425][ T9500] ? __pfx____ratelimit+0x10/0x10 [ 242.845447][ T9500] ? __pfx_dump_stack_lvl+0x10/0x10 [ 242.845471][ T9500] ? __pfx__printk+0x10/0x10 [ 242.845506][ T9500] ? __pfx___might_resched+0x10/0x10 [ 242.845531][ T9500] should_fail_ex+0x414/0x560 [ 242.845566][ T9500] ? rxrpc_alloc_call+0x78/0xd50 [ 242.845595][ T9500] should_failslab+0xa8/0x100 [ 242.845626][ T9500] ? rxrpc_alloc_call+0x78/0xd50 [ 242.845652][ T9500] kmem_cache_alloc_noprof+0x73/0x3c0 [ 242.845679][ T9500] ? rxrpc_alloc_call+0x278/0xd50 [ 242.845711][ T9500] ? rxrpc_alloc_call+0x78/0xd50 [ 242.845739][ T9500] rxrpc_alloc_call+0x278/0xd50 [ 242.845774][ T9500] rxrpc_new_client_call+0x121/0x1500 [ 242.845818][ T9500] rxrpc_do_sendmsg+0xc70/0x1220 [ 242.845858][ T9500] ? __pfx_rxrpc_do_sendmsg+0x10/0x10 [ 242.845881][ T9500] ? __local_bh_enable_ip+0x12d/0x1c0 [ 242.845905][ T9500] ? do_raw_spin_unlock+0x122/0x240 [ 242.845944][ T9500] ? rxrpc_sendmsg+0x4cc/0x710 [ 242.845975][ T9500] ? __pfx_rxrpc_sendmsg+0x10/0x10 [ 242.846002][ T9500] __sock_sendmsg+0x21c/0x270 [ 242.846031][ T9500] ____sys_sendmsg+0x505/0x830 [ 242.846071][ T9500] ? __pfx_____sys_sendmsg+0x10/0x10 [ 242.846109][ T9500] ? import_iovec+0x74/0xa0 [ 242.846140][ T9500] ___sys_sendmsg+0x21f/0x2a0 [ 242.846174][ T9500] ? __pfx____sys_sendmsg+0x10/0x10 [ 242.846243][ T9500] ? __fget_files+0x2a/0x420 [ 242.846261][ T9500] ? __fget_files+0x3a0/0x420 [ 242.846291][ T9500] __x64_sys_sendmsg+0x19b/0x260 [ 242.846322][ T9500] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 242.846360][ T9500] ? __pfx_ksys_write+0x10/0x10 [ 242.846385][ T9500] ? rcu_is_watching+0x15/0xb0 [ 242.846411][ T9500] ? do_syscall_64+0xbe/0x3b0 [ 242.846439][ T9500] do_syscall_64+0xfa/0x3b0 [ 242.846460][ T9500] ? lockdep_hardirqs_on+0x9c/0x150 [ 242.846481][ T9500] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 242.846501][ T9500] ? clear_bhb_loop+0x60/0xb0 [ 242.846526][ T9500] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 242.846545][ T9500] RIP: 0033:0x7f035998ec29 [ 242.846563][ T9500] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 242.846579][ T9500] RSP: 002b:00007f035a747038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 242.846600][ T9500] RAX: ffffffffffffffda RBX: 00007f0359bd5fa0 RCX: 00007f035998ec29 [ 242.846614][ T9500] RDX: 0000000000000000 RSI: 0000200000000040 RDI: 0000000000000003 [ 242.846625][ T9500] RBP: 00007f035a747090 R08: 0000000000000000 R09: 0000000000000000 [ 242.846638][ T9500] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 242.846648][ T9500] R13: 00007f0359bd6038 R14: 00007f0359bd5fa0 R15: 00007ffdb3f12398 [ 242.846681][ T9500] [ 243.169380][ T1152] netdevsim netdevsim3 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 243.404939][ T9519] netlink: 4 bytes leftover after parsing attributes in process `syz.1.952'. [ 243.409266][ T9518] netlink: 12 bytes leftover after parsing attributes in process `syz.4.953'. [ 244.098809][ T9532] netlink: 24 bytes leftover after parsing attributes in process `syz.0.956'. [ 244.159753][ T9529] netlink: 4 bytes leftover after parsing attributes in process `syz.0.956'. [ 244.308824][ T9539] netlink: 136 bytes leftover after parsing attributes in process `syz.1.959'. [ 244.395453][ T9545] openvswitch: netlink: Unexpected mask (mask=40040, allowed=10048) [ 244.669849][ T9553] netlink: 24 bytes leftover after parsing attributes in process `syz.0.963'. [ 245.044454][ T9583] netlink: 12 bytes leftover after parsing attributes in process `syz.1.968'. [ 245.413438][ T30] audit: type=1800 audit(1758451299.695:4): pid=9601 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.974" name="blkio.bfq.time_recursive" dev="tmpfs" ino=1028 res=0 errno=0 [ 245.418962][ T9533] netlink: 'syz.4.958': attribute type 1 has an invalid length. [ 246.413452][ T9620] FAULT_INJECTION: forcing a failure. [ 246.413452][ T9620] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 246.464356][ T9620] CPU: 0 UID: 0 PID: 9620 Comm: syz.1.978 Not tainted syzkaller #0 PREEMPT(full) [ 246.464384][ T9620] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 246.464396][ T9620] Call Trace: [ 246.464404][ T9620] [ 246.464413][ T9620] dump_stack_lvl+0x189/0x250 [ 246.464443][ T9620] ? __pfx____ratelimit+0x10/0x10 [ 246.464465][ T9620] ? __pfx_dump_stack_lvl+0x10/0x10 [ 246.464490][ T9620] ? __pfx__printk+0x10/0x10 [ 246.464518][ T9620] ? __might_fault+0xb0/0x130 [ 246.464558][ T9620] should_fail_ex+0x414/0x560 [ 246.464595][ T9620] _copy_from_user+0x2d/0xb0 [ 246.464622][ T9620] ___sys_sendmsg+0x158/0x2a0 [ 246.464665][ T9620] ? __pfx____sys_sendmsg+0x10/0x10 [ 246.464730][ T9620] ? __fget_files+0x2a/0x420 [ 246.464748][ T9620] ? __fget_files+0x3a0/0x420 [ 246.464777][ T9620] __x64_sys_sendmsg+0x19b/0x260 [ 246.464807][ T9620] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 246.464845][ T9620] ? __pfx_ksys_write+0x10/0x10 [ 246.464870][ T9620] ? rcu_is_watching+0x15/0xb0 [ 246.464896][ T9620] ? do_syscall_64+0xbe/0x3b0 [ 246.464924][ T9620] do_syscall_64+0xfa/0x3b0 [ 246.464945][ T9620] ? lockdep_hardirqs_on+0x9c/0x150 [ 246.464966][ T9620] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 246.464987][ T9620] ? clear_bhb_loop+0x60/0xb0 [ 246.465011][ T9620] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 246.465030][ T9620] RIP: 0033:0x7f7dc8d8ec29 [ 246.465049][ T9620] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 246.465065][ T9620] RSP: 002b:00007f7dc6ff6038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 246.465086][ T9620] RAX: ffffffffffffffda RBX: 00007f7dc8fd5fa0 RCX: 00007f7dc8d8ec29 [ 246.465100][ T9620] RDX: 0000000000000000 RSI: 0000200000000040 RDI: 0000000000000003 [ 246.465113][ T9620] RBP: 00007f7dc6ff6090 R08: 0000000000000000 R09: 0000000000000000 [ 246.465125][ T9620] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 246.465137][ T9620] R13: 00007f7dc8fd6038 R14: 00007f7dc8fd5fa0 R15: 00007fff442a2d98 [ 246.465169][ T9620] [ 246.732509][ T6079] netdevsim netdevsim1 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 246.741693][ T6079] netdevsim netdevsim1 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 246.750653][ T6079] netdevsim netdevsim1 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 247.033960][ T9631] netlink: 'syz.3.979': attribute type 1 has an invalid length. [ 247.076838][ T6079] netdevsim netdevsim1 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 247.164707][ T9650] A link change request failed with some changes committed already. Interface wg1 may have been left with an inconsistent configuration, please check. [ 247.429089][ T9662] netlink: 8 bytes leftover after parsing attributes in process `syz.2.987'. [ 247.439461][ T9662] netlink: 8 bytes leftover after parsing attributes in process `syz.2.987'. [ 247.532712][ T30] audit: type=1800 audit(1758451301.815:5): pid=9626 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.981" name="memory.events" dev="tmpfs" ino=1016 res=0 errno=0 [ 247.597667][ T9666] veth1_to_bond: mtu less than device minimum [ 247.704872][ T9671] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 247.848230][ T9678] FAULT_INJECTION: forcing a failure. [ 247.848230][ T9678] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 247.873120][ T9678] CPU: 1 UID: 0 PID: 9678 Comm: syz.4.993 Not tainted syzkaller #0 PREEMPT(full) [ 247.873149][ T9678] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 247.873162][ T9678] Call Trace: [ 247.873170][ T9678] [ 247.873179][ T9678] dump_stack_lvl+0x189/0x250 [ 247.873210][ T9678] ? __pfx____ratelimit+0x10/0x10 [ 247.873233][ T9678] ? __pfx_dump_stack_lvl+0x10/0x10 [ 247.873257][ T9678] ? __pfx__printk+0x10/0x10 [ 247.873301][ T9678] should_fail_ex+0x414/0x560 [ 247.873338][ T9678] _copy_from_user+0x2d/0xb0 [ 247.873366][ T9678] __copy_msghdr+0x3c5/0x5b0 [ 247.873399][ T9678] ___sys_sendmsg+0x1a5/0x2a0 [ 247.873429][ T9678] ? __pfx____sys_sendmsg+0x10/0x10 [ 247.873506][ T9678] ? __fget_files+0x2a/0x420 [ 247.873523][ T9678] ? __fget_files+0x3a0/0x420 [ 247.873553][ T9678] __x64_sys_sendmsg+0x19b/0x260 [ 247.873584][ T9678] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 247.873623][ T9678] ? __pfx_ksys_write+0x10/0x10 [ 247.873657][ T9678] ? do_syscall_64+0xbe/0x3b0 [ 247.873685][ T9678] do_syscall_64+0xfa/0x3b0 [ 247.873706][ T9678] ? lockdep_hardirqs_on+0x9c/0x150 [ 247.873728][ T9678] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 247.873748][ T9678] ? clear_bhb_loop+0x60/0xb0 [ 247.873773][ T9678] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 247.873792][ T9678] RIP: 0033:0x7f49f178ec29 [ 247.873810][ T9678] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 247.873826][ T9678] RSP: 002b:00007f49f269f038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 247.873848][ T9678] RAX: ffffffffffffffda RBX: 00007f49f19d5fa0 RCX: 00007f49f178ec29 [ 247.873863][ T9678] RDX: 0000000000000000 RSI: 0000200000000040 RDI: 0000000000000003 [ 247.873875][ T9678] RBP: 00007f49f269f090 R08: 0000000000000000 R09: 0000000000000000 [ 247.873887][ T9678] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 247.873898][ T9678] R13: 00007f49f19d6038 R14: 00007f49f19d5fa0 R15: 00007fff9be3cce8 [ 247.873930][ T9678] [ 248.297684][ T9689] netlink: 4 bytes leftover after parsing attributes in process `syz.4.999'. [ 248.314520][ T9692] netlink: 4 bytes leftover after parsing attributes in process `syz.4.999'. [ 248.498249][ T9702] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1001'. [ 248.512652][ T9702] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1001'. [ 248.589110][ T9704] netlink: 40 bytes leftover after parsing attributes in process `syz.4.1002'. [ 248.613681][ T9704] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 248.621283][ T9704] IPv6: NLM_F_CREATE should be set when creating new route [ 248.628651][ T9704] IPv6: NLM_F_CREATE should be set when creating new route [ 249.028554][ T9722] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1008'. [ 249.107502][ T9724] netlink: 'syz.3.1008': attribute type 1 has an invalid length. [ 249.418325][ T9736] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1011'. [ 249.875456][ T9744] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1014'. [ 249.903851][ T6085] netdevsim netdevsim4 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 249.921135][ T6085] netdevsim netdevsim4 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 249.940691][ T6085] netdevsim netdevsim4 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 249.968286][ T6085] netdevsim netdevsim4 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 250.325169][ T9767] bond0: (slave vlan3): Opening slave failed [ 250.436413][ T9767] bond0: (slave vlan3): Opening slave failed [ 250.514922][ T9767] bond0: (slave vlan3): Opening slave failed [ 250.584590][ T9767] bond0: (slave vlan3): Opening slave failed [ 250.646384][ T9779] nbd: must specify at least one socket [ 250.652469][ T9780] nbd: must specify at least one socket [ 250.682878][ T9767] bond0: (slave vlan3): Opening slave failed [ 250.858343][ T9792] openvswitch: netlink: nsh attr 7 is out of range max 3 [ 250.865577][ T9792] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 250.876317][ T9792] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 250.956773][ T9767] bond0: (slave vlan3): Opening slave failed [ 251.044888][ T9798] netlink: 'syz.4.1027': attribute type 3 has an invalid length. [ 251.058725][ T9799] netlink: zone id is out of range [ 251.058798][ T9798] netlink: zone id is out of range [ 251.089821][ T9798] netlink: del zone limit has 8 unknown bytes [ 251.090977][ T9799] netlink: del zone limit has 8 unknown bytes [ 251.339376][ T9804] netlink: 'syz.1.1029': attribute type 10 has an invalid length. [ 251.348258][ T9806] netlink: 'syz.4.1028': attribute type 1 has an invalid length. [ 251.383027][ T9804] team0: Port device geneve0 added [ 251.399754][ T6090] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 251.414099][ T6090] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 251.494120][ T6090] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 251.523682][ T6090] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 251.533726][ T9812] netlink: 'syz.2.1030': attribute type 5 has an invalid length. [ 251.961664][ T9836] (unnamed net_device) (uninitialized): Removing last arp target with arp_interval on [ 252.052375][ T9840] syzkaller0: entered promiscuous mode [ 252.057912][ T9840] syzkaller0: entered allmulticast mode [ 252.503153][ T9873] netlink: 'syz.3.1045': attribute type 27 has an invalid length. [ 252.531332][ T9873] __nla_validate_parse: 6 callbacks suppressed [ 252.531354][ T9873] netlink: 32 bytes leftover after parsing attributes in process `syz.3.1045'. [ 253.786142][ T9927] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1054'. [ 253.925231][ T9932] netlink: 'syz.0.1056': attribute type 1 has an invalid length. [ 253.966862][ T9937] netlink: 44 bytes leftover after parsing attributes in process `syz.2.1057'. [ 254.060025][ T9941] bond4: (slave ipvlan2): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 254.082228][ T9941] bond4: (slave ipvlan2): The slave device specified does not support setting the MAC address [ 254.123784][ T9941] bond4: (slave ipvlan2): Setting fail_over_mac to active for active-backup mode [ 254.606624][ T9983] netlink: 48 bytes leftover after parsing attributes in process `syz.4.1065'. [ 254.813571][ T9994] netlink: 60 bytes leftover after parsing attributes in process `syz.3.1067'. [ 254.825785][ T9992] netlink: 60 bytes leftover after parsing attributes in process `syz.3.1067'. [ 254.963498][T10002] IPVS: set_ctl: invalid protocol: 137 172.20.20.187:20001 [ 255.054275][T10006] netlink: 24 bytes leftover after parsing attributes in process `syz.4.1072'. [ 255.394744][T10028] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1076'. [ 255.419759][T10028] net_ratelimit: 52 callbacks suppressed [ 255.419781][T10028] openvswitch: netlink: Unknown nsh attribute 0 [ 255.460622][T10028] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 255.480475][T10031] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1078'. [ 255.722541][ T1304] ieee802154 phy0 wpan0: encryption failed: -22 [ 255.732036][ T1304] ieee802154 phy1 wpan1: encryption failed: -22 [ 255.844996][ T5952] IPVS: starting estimator thread 0... [ 255.882300][T10048] netlink: 104 bytes leftover after parsing attributes in process `syz.4.1082'. [ 255.902746][T10044] ieee802154 phy0 wpan0: encryption failed: -22 [ 255.971235][T10046] IPVS: using max 34 ests per chain, 81600 per kthread [ 256.201850][T10052] netlink: 'syz.2.1083': attribute type 1 has an invalid length. [ 256.302953][T10061] bond2: (slave bridge2): making interface the new active one [ 256.311889][T10061] bond2: (slave bridge2): Enslaving as an active interface with an up link [ 256.538157][T10078] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 257.431980][T10117] netlink: 'syz.3.1097': attribute type 2 has an invalid length. [ 257.599582][T10117] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 257.902844][T10138] netdevsim netdevsim2 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 257.979611][T10138] netdevsim netdevsim2 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 258.074533][T10138] netdevsim netdevsim2 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 258.122387][T10150] __nla_validate_parse: 4 callbacks suppressed [ 258.122407][T10150] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1107'. [ 258.176723][T10150] 8021q: adding VLAN 0 to HW filter on device bond11 [ 258.193666][T10138] netdevsim netdevsim2 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 258.430485][ T6088] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 258.494159][ T12] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 258.565941][ T79] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 258.638922][ T36] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 258.700822][T10171] netlink: 60 bytes leftover after parsing attributes in process `syz.4.1113'. [ 258.758941][T10182] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1115'. [ 258.769308][T10186] netlink: 20 bytes leftover after parsing attributes in process `syz.2.1116'. [ 258.787219][T10182] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1115'. [ 258.914074][T10184] lo: entered promiscuous mode [ 258.919088][T10184] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 259.887276][T10219] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1124'. [ 260.353983][T10251] netlink: 'syz.0.1135': attribute type 1 has an invalid length. [ 260.371659][T10251] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1135'. [ 260.646246][T10265] FAULT_INJECTION: forcing a failure. [ 260.646246][T10265] name failslab, interval 1, probability 0, space 0, times 0 [ 260.732734][T10265] CPU: 0 UID: 0 PID: 10265 Comm: syz.2.1136 Not tainted syzkaller #0 PREEMPT(full) [ 260.732764][T10265] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 260.732777][T10265] Call Trace: [ 260.732785][T10265] [ 260.732794][T10265] dump_stack_lvl+0x189/0x250 [ 260.732825][T10265] ? __pfx____ratelimit+0x10/0x10 [ 260.732848][T10265] ? __pfx_dump_stack_lvl+0x10/0x10 [ 260.732872][T10265] ? __pfx__printk+0x10/0x10 [ 260.732908][T10265] ? __pfx___might_resched+0x10/0x10 [ 260.732925][T10265] ? fs_reclaim_acquire+0x7d/0x100 [ 260.732950][T10265] should_fail_ex+0x414/0x560 [ 260.732986][T10265] should_failslab+0xa8/0x100 [ 260.733018][T10265] __kmalloc_noprof+0xcb/0x4f0 [ 260.733044][T10265] ? security_sk_alloc+0x52/0x390 [ 260.733075][T10265] security_sk_alloc+0x52/0x390 [ 260.733103][T10265] sk_prot_alloc+0x101/0x220 [ 260.733135][T10265] sk_alloc+0x3a/0x370 [ 260.733166][T10265] inet_create+0x7a0/0x1000 [ 260.733191][T10265] ? inet_create+0x9c/0x1000 [ 260.733219][T10265] __sock_create+0x4b0/0x9f0 [ 260.733252][T10265] udp_sock_create4+0xbe/0x4b0 [ 260.733278][T10265] ? __pfx_udp_sock_create4+0x10/0x10 [ 260.733316][T10265] rxrpc_lookup_local+0xcae/0x1410 [ 260.733366][T10265] ? __pfx_rxrpc_lookup_local+0x10/0x10 [ 260.733406][T10265] ? __local_bh_enable_ip+0x12d/0x1c0 [ 260.733431][T10265] ? __local_bh_enable_ip+0x12d/0x1c0 [ 260.733455][T10265] ? do_raw_spin_unlock+0x122/0x240 [ 260.733486][T10265] rxrpc_sendmsg+0x399/0x710 [ 260.733519][T10265] ? __pfx_rxrpc_sendmsg+0x10/0x10 [ 260.733547][T10265] __sock_sendmsg+0x21c/0x270 [ 260.733570][T10265] ____sys_sendmsg+0x505/0x830 [ 260.733605][T10265] ? __pfx_____sys_sendmsg+0x10/0x10 [ 260.733644][T10265] ? import_iovec+0x74/0xa0 [ 260.733675][T10265] ___sys_sendmsg+0x21f/0x2a0 [ 260.733706][T10265] ? __pfx____sys_sendmsg+0x10/0x10 [ 260.733776][T10265] ? __fget_files+0x2a/0x420 [ 260.733794][T10265] ? __fget_files+0x3a0/0x420 [ 260.733824][T10265] __x64_sys_sendmsg+0x19b/0x260 [ 260.733856][T10265] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 260.733896][T10265] ? __pfx_ksys_write+0x10/0x10 [ 260.733920][T10265] ? rcu_is_watching+0x15/0xb0 [ 260.733947][T10265] ? do_syscall_64+0xbe/0x3b0 [ 260.733975][T10265] do_syscall_64+0xfa/0x3b0 [ 260.733997][T10265] ? lockdep_hardirqs_on+0x9c/0x150 [ 260.734017][T10265] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 260.734036][T10265] ? clear_bhb_loop+0x60/0xb0 [ 260.734061][T10265] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 260.734080][T10265] RIP: 0033:0x7f65bfd8ec29 [ 260.734097][T10265] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 260.734113][T10265] RSP: 002b:00007f65c0cec038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 260.734134][T10265] RAX: ffffffffffffffda RBX: 00007f65bffd5fa0 RCX: 00007f65bfd8ec29 [ 260.734149][T10265] RDX: 0000000000000000 RSI: 0000200000000040 RDI: 0000000000000003 [ 260.734160][T10265] RBP: 00007f65c0cec090 R08: 0000000000000000 R09: 0000000000000000 [ 260.734171][T10265] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 260.734182][T10265] R13: 00007f65bffd6038 R14: 00007f65bffd5fa0 R15: 00007ffc8b31a0c8 [ 260.734215][T10265] [ 261.077180][T10276] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1138'. [ 261.091086][T10270] netlink: 22 bytes leftover after parsing attributes in process `syz.0.1138'. [ 261.647476][T10299] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1145'. [ 261.845782][ T30] audit: type=1800 audit(1758451316.125:6): pid=10315 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.1148" name=CB dev="tmpfs" ino=1145 res=0 errno=0 [ 261.868379][T10312] netlink: 'syz.2.1150': attribute type 1 has an invalid length. [ 261.877416][T10308] nbd0: detected capacity change from 0 to 127 [ 261.890016][ T5871] block nbd0: Receive control failed (result -32) [ 261.974343][T10318] netlink: 'syz.3.1151': attribute type 1 has an invalid length. [ 261.988624][T10320] netlink: 'syz.2.1152': attribute type 10 has an invalid length. [ 262.005184][T10320] team0: Port device dummy0 removed [ 262.018520][T10320] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 262.142033][T10325] sysfs: cannot create duplicate filename '/class/ieee80211/!å' [ 262.151320][T10325] CPU: 0 UID: 0 PID: 10325 Comm: syz.1.1153 Not tainted syzkaller #0 PREEMPT(full) [ 262.151351][T10325] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 262.151369][T10325] Call Trace: [ 262.151378][T10325] [ 262.151387][T10325] dump_stack_lvl+0x189/0x250 [ 262.151423][T10325] ? __pfx_dump_stack_lvl+0x10/0x10 [ 262.151449][T10325] ? __pfx__printk+0x10/0x10 [ 262.151495][T10325] ? kernfs_path_from_node+0x2f/0x290 [ 262.151518][T10325] ? kernfs_path_from_node+0x250/0x290 [ 262.151540][T10325] ? kernfs_path_from_node+0x2f/0x290 [ 262.151568][T10325] sysfs_warn_dup+0x8e/0xa0 [ 262.151591][T10325] sysfs_do_create_link_sd+0xc0/0x110 [ 262.151617][T10325] device_add_class_symlinks+0x1cf/0x240 [ 262.151648][T10325] device_add+0x475/0xb50 [ 262.151678][T10325] wiphy_register+0x1c81/0x2aa0 [ 262.151726][T10325] ? __pfx_wiphy_register+0x10/0x10 [ 262.151752][T10325] ? minstrel_ht_alloc+0x6dd/0x7e0 [ 262.151792][T10325] ? ieee80211_init_rate_ctrl_alg+0x56d/0x5f0 [ 262.151827][T10325] ieee80211_register_hw+0x3442/0x40a0 [ 262.151877][T10325] ? ieee80211_register_hw+0x13b1/0x40a0 [ 262.151921][T10325] ? __pfx_ieee80211_register_hw+0x10/0x10 [ 262.151959][T10325] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 262.151989][T10325] ? __hrtimer_setup+0x187/0x210 [ 262.152008][T10325] ? __pfx_mac80211_hwsim_beacon+0x10/0x10 [ 262.152034][T10325] mac80211_hwsim_new_radio+0x2f0e/0x5340 [ 262.152103][T10325] ? __pfx_mac80211_hwsim_new_radio+0x10/0x10 [ 262.152132][T10325] ? trace_kmalloc+0x1f/0xd0 [ 262.152158][T10325] ? __kmalloc_node_track_caller_noprof+0x28e/0x4e0 [ 262.152187][T10325] ? kstrndup+0xbf/0x160 [ 262.152221][T10325] hwsim_new_radio_nl+0xea4/0x1b10 [ 262.152257][T10325] ? __pfx___nla_validate_parse+0x10/0x10 [ 262.152297][T10325] ? __pfx_hwsim_new_radio_nl+0x10/0x10 [ 262.152344][T10325] ? __nla_parse+0x40/0x60 [ 262.152371][T10325] ? genl_family_rcv_msg_attrs_parse+0x1c9/0x2a0 [ 262.152423][T10325] genl_family_rcv_msg_doit+0x215/0x300 [ 262.152470][T10325] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 262.152524][T10325] ? bpf_lsm_capable+0x9/0x20 [ 262.152551][T10325] ? security_capable+0x7e/0x2e0 [ 262.152593][T10325] genl_rcv_msg+0x60e/0x790 [ 262.152632][T10325] ? __pfx_genl_rcv_msg+0x10/0x10 [ 262.152662][T10325] ? __pfx_hwsim_new_radio_nl+0x10/0x10 [ 262.152712][T10325] netlink_rcv_skb+0x208/0x470 [ 262.152733][T10325] ? __lock_acquire+0xab9/0xd20 [ 262.152765][T10325] ? __pfx_genl_rcv_msg+0x10/0x10 [ 262.152797][T10325] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 262.152846][T10325] ? down_read+0x1ad/0x2e0 [ 262.152875][T10325] genl_rcv+0x28/0x40 [ 262.152902][T10325] netlink_unicast+0x82f/0x9e0 [ 262.152933][T10325] ? __pfx_netlink_unicast+0x10/0x10 [ 262.152957][T10325] ? netlink_sendmsg+0x642/0xb30 [ 262.152980][T10325] ? skb_put+0x11b/0x210 [ 262.153011][T10325] netlink_sendmsg+0x805/0xb30 [ 262.153048][T10325] ? __pfx_netlink_sendmsg+0x10/0x10 [ 262.153078][T10325] ? aa_sock_msg_perm+0xf1/0x1d0 [ 262.153101][T10325] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 262.153123][T10325] ? __pfx_netlink_sendmsg+0x10/0x10 [ 262.153150][T10325] __sock_sendmsg+0x21c/0x270 [ 262.153174][T10325] ____sys_sendmsg+0x505/0x830 [ 262.153210][T10325] ? __pfx_____sys_sendmsg+0x10/0x10 [ 262.153244][T10325] ? import_iovec+0x74/0xa0 [ 262.153272][T10325] ___sys_sendmsg+0x21f/0x2a0 [ 262.153304][T10325] ? __pfx____sys_sendmsg+0x10/0x10 [ 262.153379][T10325] ? __fget_files+0x2a/0x420 [ 262.153397][T10325] ? __fget_files+0x3a0/0x420 [ 262.153429][T10325] __x64_sys_sendmsg+0x19b/0x260 [ 262.153469][T10325] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 262.153512][T10325] ? rcu_is_watching+0x15/0xb0 [ 262.153540][T10325] ? do_syscall_64+0xbe/0x3b0 [ 262.153569][T10325] do_syscall_64+0xfa/0x3b0 [ 262.153591][T10325] ? lockdep_hardirqs_on+0x9c/0x150 [ 262.153612][T10325] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 262.153633][T10325] ? clear_bhb_loop+0x60/0xb0 [ 262.153659][T10325] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 262.153679][T10325] RIP: 0033:0x7f7dc8d8ec29 [ 262.153699][T10325] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 262.153716][T10325] RSP: 002b:00007f7dc6ff6038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 262.153739][T10325] RAX: ffffffffffffffda RBX: 00007f7dc8fd5fa0 RCX: 00007f7dc8d8ec29 [ 262.153754][T10325] RDX: 0000000000000000 RSI: 0000200000000040 RDI: 0000000000000007 [ 262.153766][T10325] RBP: 00007f7dc8e11e41 R08: 0000000000000000 R09: 0000000000000000 [ 262.153779][T10325] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 262.153791][T10325] R13: 00007f7dc8fd6038 R14: 00007f7dc8fd5fa0 R15: 00007fff442a2d98 [ 262.153836][T10325] [ 262.905823][T10352] netlink: 'syz.1.1162': attribute type 1 has an invalid length. [ 262.922793][T10352] netlink: 'syz.1.1162': attribute type 3 has an invalid length. [ 262.937292][T10346] sit0: left promiscuous mode [ 262.950646][T10352] NCSI netlink: No device for ifindex 246 [ 263.037390][T10346] bridge0: port 2(bridge_slave_1) entered blocking state [ 263.044659][T10346] bridge0: port 2(bridge_slave_1) entered forwarding state [ 263.052320][T10346] bridge0: port 1(bridge_slave_0) entered blocking state [ 263.059513][T10346] bridge0: port 1(bridge_slave_0) entered forwarding state [ 263.119253][T10346] A link change request failed with some changes committed already. Interface dummy0 may have been left with an inconsistent configuration, please check. [ 263.340478][T10377] netlink: 'syz.1.1169': attribute type 13 has an invalid length. [ 263.350821][T10377] netlink: 'syz.1.1169': attribute type 17 has an invalid length. [ 263.363165][T10375] __nla_validate_parse: 3 callbacks suppressed [ 263.363186][T10375] netlink: 64 bytes leftover after parsing attributes in process `syz.0.1170'. [ 263.432762][T10377] IPVS: Scheduler module ip_vs_sip not found [ 263.444835][T10381] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1171'. [ 263.461395][T10381] geneve3: entered promiscuous mode [ 263.466830][T10381] geneve3: entered allmulticast mode [ 263.478691][ T12] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 42715 - 0 [ 263.488316][ T12] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 42715 - 0 [ 263.499547][ T12] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 42715 - 0 [ 263.509821][ T12] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 42715 - 0 [ 263.719862][T10400] llcp: llcp_sock_recvmsg: Recv datagram failed state 4 -107 0 [ 264.185252][T10415] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 264.309952][T10419] netlink: 'syz.1.1182': attribute type 10 has an invalid length. [ 264.334225][T10419] team0: Device ipvlan1 failed to register rx_handler [ 264.403982][T10423] tipc: Enabled bearer , priority 0 [ 264.458370][T10424] syzkaller0: entered promiscuous mode [ 264.469897][T10424] syzkaller0: entered allmulticast mode [ 264.483659][T10426] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1179'. [ 264.512943][T10426] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1179'. [ 264.528353][T10426] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1179'. [ 264.537824][T10426] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1179'. [ 264.548205][T10426] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1179'. [ 264.562383][T10426] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1179'. [ 264.571693][T10426] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1179'. [ 264.581330][T10426] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1179'. [ 264.686118][T10423] tipc: Resetting bearer [ 264.744811][T10423] tipc: Disabling bearer [ 265.195788][T10459] netlink: 'syz.3.1195': attribute type 1 has an invalid length. [ 265.233605][T10459] gretap1: entered promiscuous mode [ 266.923432][T10524] 8021q: adding VLAN 0 to HW filter on device bond4 [ 267.003972][T10523] 8021q: adding VLAN 0 to HW filter on device bond4 [ 267.012677][T10523] bond4: (slave wireguard0): The slave device specified does not support setting the MAC address [ 267.025879][T10523] bond4: (slave wireguard0): Error -95 calling set_mac_address [ 267.251456][T10523] bond4: (slave wireguard0): The slave device specified does not support setting the MAC address [ 267.282730][T10523] bond4: (slave wireguard0): Error -95 calling set_mac_address [ 267.367296][T10530] syzkaller1: entered promiscuous mode [ 267.386849][T10530] syzkaller1: entered allmulticast mode [ 267.495046][T10523] bond4: (slave wireguard0): The slave device specified does not support setting the MAC address [ 267.507220][T10523] bond4: (slave wireguard0): Error -95 calling set_mac_address [ 267.726914][T10523] workqueue: Failed to create a rescuer kthread for wq "wg-crypt-wireguard%d": -EINTR [ 268.475234][T10593] netlink: 'syz.4.1229': attribute type 13 has an invalid length. [ 268.488512][T10593] netlink: 'syz.4.1229': attribute type 17 has an invalid length. [ 268.573402][T10593] 8021q: adding VLAN 0 to HW filter on device bond0 [ 268.583374][T10593] 8021q: adding VLAN 0 to HW filter on device team0 [ 268.595243][T10593] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 268.650560][T10604] sit0: entered promiscuous mode [ 268.666288][T10604] netlink: 'syz.0.1232': attribute type 1 has an invalid length. [ 268.691276][T10604] __nla_validate_parse: 116 callbacks suppressed [ 268.691296][T10604] netlink: 1 bytes leftover after parsing attributes in process `syz.0.1232'. [ 269.036170][T10632] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 269.141396][T10636] netlink: 'syz.3.1241': attribute type 11 has an invalid length. [ 269.307912][T10647] netlink: 'syz.4.1245': attribute type 2 has an invalid length. [ 269.317704][T10646] 8021q: VLANs not supported on ip6_vti0 [ 269.640478][T10670] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1251'. [ 269.847423][T10678] tipc: Enabling of bearer rejected, failed to enable media [ 270.539778][T10697] FAULT_INJECTION: forcing a failure. [ 270.539778][T10697] name failslab, interval 1, probability 0, space 0, times 0 [ 270.567397][T10697] CPU: 1 UID: 0 PID: 10697 Comm: syz.1.1256 Not tainted syzkaller #0 PREEMPT(full) [ 270.567428][T10697] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 270.567467][T10697] Call Trace: [ 270.567475][T10697] [ 270.567485][T10697] dump_stack_lvl+0x189/0x250 [ 270.567515][T10697] ? __pfx____ratelimit+0x10/0x10 [ 270.567537][T10697] ? __pfx_dump_stack_lvl+0x10/0x10 [ 270.567561][T10697] ? __pfx__printk+0x10/0x10 [ 270.567596][T10697] ? __pfx___might_resched+0x10/0x10 [ 270.567615][T10697] ? fs_reclaim_acquire+0x7d/0x100 [ 270.567639][T10697] should_fail_ex+0x414/0x560 [ 270.567676][T10697] should_failslab+0xa8/0x100 [ 270.567709][T10697] __kmalloc_cache_noprof+0x70/0x3d0 [ 270.567737][T10697] ? rxrpc_send_data+0xbf3/0x2160 [ 270.567762][T10697] ? remove_wait_queue+0x33/0x120 [ 270.567792][T10697] rxrpc_send_data+0xbf3/0x2160 [ 270.567830][T10697] ? rxrpc_send_data+0x31a/0x2160 [ 270.567879][T10697] ? __pfx_rxrpc_send_data+0x10/0x10 [ 270.567904][T10697] ? __pfx_default_wake_function+0x10/0x10 [ 270.567945][T10697] ? rcu_is_watching+0x15/0xb0 [ 270.567971][T10697] rxrpc_do_sendmsg+0x1098/0x1220 [ 270.568012][T10697] ? __pfx_rxrpc_do_sendmsg+0x10/0x10 [ 270.568036][T10697] ? __local_bh_enable_ip+0x12d/0x1c0 [ 270.568062][T10697] ? do_raw_spin_unlock+0x122/0x240 [ 270.568094][T10697] ? rxrpc_sendmsg+0x4cc/0x710 [ 270.568126][T10697] ? __pfx_rxrpc_sendmsg+0x10/0x10 [ 270.568153][T10697] __sock_sendmsg+0x21c/0x270 [ 270.568178][T10697] ____sys_sendmsg+0x505/0x830 [ 270.568212][T10697] ? __pfx_____sys_sendmsg+0x10/0x10 [ 270.568249][T10697] ? import_iovec+0x74/0xa0 [ 270.568279][T10697] ___sys_sendmsg+0x21f/0x2a0 [ 270.568310][T10697] ? __pfx____sys_sendmsg+0x10/0x10 [ 270.568380][T10697] ? __fget_files+0x2a/0x420 [ 270.568398][T10697] ? __fget_files+0x3a0/0x420 [ 270.568429][T10697] __x64_sys_sendmsg+0x19b/0x260 [ 270.568469][T10697] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 270.568509][T10697] ? __pfx_ksys_write+0x10/0x10 [ 270.568534][T10697] ? rcu_is_watching+0x15/0xb0 [ 270.568560][T10697] ? do_syscall_64+0xbe/0x3b0 [ 270.568588][T10697] do_syscall_64+0xfa/0x3b0 [ 270.568609][T10697] ? lockdep_hardirqs_on+0x9c/0x150 [ 270.568631][T10697] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 270.568651][T10697] ? clear_bhb_loop+0x60/0xb0 [ 270.568677][T10697] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 270.568697][T10697] RIP: 0033:0x7f7dc8d8ec29 [ 270.568716][T10697] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 270.568734][T10697] RSP: 002b:00007f7dc6ff6038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 270.568756][T10697] RAX: ffffffffffffffda RBX: 00007f7dc8fd5fa0 RCX: 00007f7dc8d8ec29 [ 270.568771][T10697] RDX: 0000000000000000 RSI: 0000200000000040 RDI: 0000000000000003 [ 270.568784][T10697] RBP: 00007f7dc6ff6090 R08: 0000000000000000 R09: 0000000000000000 [ 270.568796][T10697] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 270.568809][T10697] R13: 00007f7dc8fd6038 R14: 00007f7dc8fd5fa0 R15: 00007fff442a2d98 [ 270.568843][T10697] [ 270.955773][T10703] netlink: 48 bytes leftover after parsing attributes in process `syz.0.1257'. [ 270.970158][T10703] tipc: Enabled bearer , priority 10 [ 270.981940][T10703] netlink: 'syz.0.1257': attribute type 8 has an invalid length. [ 271.202197][T10711] IPVS: lblc: FWM 3 0x00000003 - no destination available [ 271.239880][T10723] syzkaller0: entered promiscuous mode [ 271.258021][T10723] syzkaller0: entered allmulticast mode [ 271.282857][T10722] tipc: Enabled bearer , priority 0 [ 271.461358][T10723] tipc: Resetting bearer [ 271.553949][T10723] tipc: Disabling bearer [ 271.564992][T10742] FAULT_INJECTION: forcing a failure. [ 271.564992][T10742] name failslab, interval 1, probability 0, space 0, times 0 [ 271.631145][T10742] CPU: 0 UID: 0 PID: 10742 Comm: syz.4.1269 Not tainted syzkaller #0 PREEMPT(full) [ 271.631175][T10742] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 271.631188][T10742] Call Trace: [ 271.631196][T10742] [ 271.631205][T10742] dump_stack_lvl+0x189/0x250 [ 271.631235][T10742] ? __pfx____ratelimit+0x10/0x10 [ 271.631256][T10742] ? __pfx_dump_stack_lvl+0x10/0x10 [ 271.631280][T10742] ? __pfx__printk+0x10/0x10 [ 271.631315][T10742] ? __pfx___might_resched+0x10/0x10 [ 271.631339][T10742] should_fail_ex+0x414/0x560 [ 271.631373][T10742] should_failslab+0xa8/0x100 [ 271.631403][T10742] __kmalloc_cache_noprof+0x70/0x3d0 [ 271.631429][T10742] ? rxrpc_alloc_data_txbuf+0x8a/0x640 [ 271.631463][T10742] rxrpc_alloc_data_txbuf+0x8a/0x640 [ 271.631491][T10742] ? rcu_is_watching+0x15/0xb0 [ 271.631511][T10742] ? trace_rxrpc_tq+0x85/0x200 [ 271.631546][T10742] rxrpc_send_data+0xf3b/0x2160 [ 271.631585][T10742] ? rxrpc_send_data+0x31a/0x2160 [ 271.631643][T10742] ? __pfx_rxrpc_send_data+0x10/0x10 [ 271.631670][T10742] ? __pfx_default_wake_function+0x10/0x10 [ 271.631707][T10742] ? rcu_is_watching+0x15/0xb0 [ 271.631732][T10742] rxrpc_do_sendmsg+0x1098/0x1220 [ 271.631773][T10742] ? __pfx_rxrpc_do_sendmsg+0x10/0x10 [ 271.631797][T10742] ? __local_bh_enable_ip+0x12d/0x1c0 [ 271.631823][T10742] ? do_raw_spin_unlock+0x122/0x240 [ 271.631855][T10742] ? rxrpc_sendmsg+0x4cc/0x710 [ 271.631903][T10742] ? __pfx_rxrpc_sendmsg+0x10/0x10 [ 271.631932][T10742] __sock_sendmsg+0x21c/0x270 [ 271.631957][T10742] ____sys_sendmsg+0x505/0x830 [ 271.631991][T10742] ? __pfx_____sys_sendmsg+0x10/0x10 [ 271.632030][T10742] ? import_iovec+0x74/0xa0 [ 271.632062][T10742] ___sys_sendmsg+0x21f/0x2a0 [ 271.632091][T10742] ? __pfx____sys_sendmsg+0x10/0x10 [ 271.632165][T10742] ? __fget_files+0x2a/0x420 [ 271.632183][T10742] ? __fget_files+0x3a0/0x420 [ 271.632214][T10742] __x64_sys_sendmsg+0x19b/0x260 [ 271.632246][T10742] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 271.632285][T10742] ? __pfx_ksys_write+0x10/0x10 [ 271.632310][T10742] ? rcu_is_watching+0x15/0xb0 [ 271.632336][T10742] ? do_syscall_64+0xbe/0x3b0 [ 271.632363][T10742] do_syscall_64+0xfa/0x3b0 [ 271.632385][T10742] ? lockdep_hardirqs_on+0x9c/0x150 [ 271.632407][T10742] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 271.632428][T10742] ? clear_bhb_loop+0x60/0xb0 [ 271.632454][T10742] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 271.632474][T10742] RIP: 0033:0x7f49f178ec29 [ 271.632493][T10742] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 271.632511][T10742] RSP: 002b:00007f49f269f038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 271.632533][T10742] RAX: ffffffffffffffda RBX: 00007f49f19d5fa0 RCX: 00007f49f178ec29 [ 271.632549][T10742] RDX: 0000000000000000 RSI: 0000200000000040 RDI: 0000000000000003 [ 271.632562][T10742] RBP: 00007f49f269f090 R08: 0000000000000000 R09: 0000000000000000 [ 271.632575][T10742] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 271.632587][T10742] R13: 00007f49f19d6038 R14: 00007f49f19d5fa0 R15: 00007fff9be3cce8 [ 271.632627][T10742] [ 272.081131][ T9613] tipc: Node number set to 2180135058 [ 272.652541][T10756] pim6reg1: entered promiscuous mode [ 272.678264][T10756] pim6reg1: entered allmulticast mode [ 272.779769][T10786] netlink: 'syz.4.1276': attribute type 4 has an invalid length. [ 272.950489][T10796] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1279'. [ 272.995458][T10796] netlink: 32 bytes leftover after parsing attributes in process `syz.1.1279'. [ 273.094321][T10801] netlink: 52 bytes leftover after parsing attributes in process `syz.2.1281'. [ 273.231388][T10806] netlink: 'syz.4.1282': attribute type 1 has an invalid length. [ 273.271451][T10806] netlink: 'syz.4.1282': attribute type 1 has an invalid length. [ 273.283778][T10809] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 273.354251][T10799] IPVS: wrr: UDP 224.0.0.2:0 - no destination available [ 273.366013][ T5952] IPVS: starting estimator thread 0... [ 273.463061][T10815] IPVS: using max 28 ests per chain, 67200 per kthread [ 273.889994][T10839] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1290'. [ 273.893112][T10835] dvmrp0: entered allmulticast mode [ 274.279766][T10843] lo: left promiscuous mode [ 274.327870][T10843] macsec0: left promiscuous mode [ 274.539665][T10857] netlink: 'syz.2.1292': attribute type 1 has an invalid length. [ 274.563754][T10843] macsec0: left allmulticast mode [ 274.604090][T10843] bond1: left promiscuous mode [ 274.608931][T10843] bond1: left allmulticast mode [ 274.641614][T10843] gretap2: left allmulticast mode [ 274.657372][T10843] ip6tnl1: left promiscuous mode [ 274.662736][T10843] ip6tnl1: left allmulticast mode [ 274.671614][T10843] vlan2: left allmulticast mode [ 274.676532][T10843] batadv0: left allmulticast mode [ 274.691529][T10843] bond7: left promiscuous mode [ 274.701244][T10843] bond7: left allmulticast mode [ 274.926772][T10857] 8021q: adding VLAN 0 to HW filter on device bond3 [ 274.942268][ T1152] netdevsim netdevsim1 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 274.953678][ T1152] netdevsim netdevsim1 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 275.033448][T10859] bond3: entered promiscuous mode [ 275.056515][ T1152] netdevsim netdevsim1 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 275.081286][ T1152] netdevsim netdevsim1 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 275.206604][T10868] netlink: 'syz.2.1296': attribute type 1 has an invalid length. [ 275.238468][T10868] workqueue: Failed to create a rescuer kthread for wq "bond4": -EINTR [ 275.239483][T10871] syzkaller1: entered promiscuous mode [ 275.278197][T10871] syzkaller1: entered allmulticast mode [ 275.319787][T10867] delete_channel: no stack [ 275.333764][T10883] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1294'. [ 275.522260][T10893] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1302'. [ 275.546739][T10893] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1302'. [ 275.557010][T10893] netlink: 'syz.0.1302': attribute type 1 has an invalid length. [ 275.566072][T10893] netlink: 10 bytes leftover after parsing attributes in process `syz.0.1302'. [ 275.602379][T10893] nbd: socks must be embedded in a SOCK_ITEM attr [ 275.623562][T10893] block nbd1: shutting down sockets [ 275.704434][T10906] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 275.768450][T10906] bond0: (slave ipvlan2): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 275.800257][T10906] bond0: (slave ipvlan2): The slave device specified does not support setting the MAC address [ 275.813071][T10906] bond0: (slave ipvlan2): Error -95 calling set_mac_address [ 276.050337][T10924] netlink: 'syz.0.1309': attribute type 29 has an invalid length. [ 276.749970][T10942] netlink: 72 bytes leftover after parsing attributes in process `syz.2.1312'. [ 276.781060][T10942] A link change request failed with some changes committed already. Interface bridge_slave_0 may have been left with an inconsistent configuration, please check. [ 277.024982][ T8340] hid-generic 0005:15C2:5505.0003: unknown main item tag 0x0 [ 277.050636][ T8340] hid-generic 0005:15C2:5505.0003: unknown main item tag 0x0 [ 277.103919][ T8340] hid-generic 0005:15C2:5505.0003: reserved main item tag 0xe [ 277.172831][ T8340] hid-generic 0005:15C2:5505.0003: hidraw0: BLUETOOTH HID vc3.b8 Device [syz0] on aa:aa:aa:aa:aa:aa [ 277.298781][T10960] netlink: 'syz.0.1316': attribute type 2 has an invalid length. [ 277.312863][ T51] Bluetooth: hci4: command 0x0405 tx timeout [ 277.517137][T10974] netlink: 'syz.2.1321': attribute type 1 has an invalid length. [ 277.608434][T10974] bond4: (slave ip6gretap1): Enslaving as a backup interface with an up link [ 277.631839][T10980] openvswitch: netlink: IP tunnel dst address not specified [ 277.639425][T10972] openvswitch: netlink: IP tunnel dst address not specified [ 277.816531][T10974] veth3: entered promiscuous mode [ 277.826476][T10974] bond4: (slave veth3): Enslaving as a backup interface with a down link [ 278.419483][T11002] netlink: 20 bytes leftover after parsing attributes in process `syz.3.1327'. [ 278.472468][T11002] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1327'. [ 278.575097][T11002] bond3: entered promiscuous mode [ 278.613599][T11002] bond3: entered allmulticast mode [ 278.619820][T11002] 8021q: adding VLAN 0 to HW filter on device bond3 [ 278.675901][T11018] tipc: Enabled bearer , priority 0 [ 278.704925][T11018] syzkaller0: entered promiscuous mode [ 278.710464][T11018] syzkaller0: entered allmulticast mode [ 278.795426][T11026] pimreg: entered allmulticast mode [ 278.806281][T11018] tipc: Resetting bearer [ 278.862711][T11017] tipc: Resetting bearer [ 278.918731][T11017] tipc: Disabling bearer [ 278.968783][T11026] netlink: 88 bytes leftover after parsing attributes in process `syz.0.1333'. [ 278.990503][T11042] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1337'. [ 279.097515][T11046] pim6reg1: entered promiscuous mode [ 279.133624][T11046] pim6reg1: entered allmulticast mode [ 279.345173][T11061] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1340'. [ 279.355138][T11061] IPVS: length: 209 != 24 [ 279.511248][T11072] IPVS: lblc: FWM 3 0x00000003 - no destination available [ 279.807362][T11078] syzkaller0: default qdisc (pfifo_fast) fail, fallback to noqueue [ 280.961410][T11113] ieee802154 phy0 wpan0: encryption failed: -22 [ 281.926648][T11117] netlink: 'syz.4.1354': attribute type 1 has an invalid length. [ 281.935020][T11117] netlink: 'syz.4.1354': attribute type 4 has an invalid length. [ 281.945053][T11117] netlink: 212 bytes leftover after parsing attributes in process `syz.4.1354'. [ 282.000571][T11118] netlink: 120 bytes leftover after parsing attributes in process `syz.2.1353'. [ 282.307958][T11123] netlink: 24 bytes leftover after parsing attributes in process `syz.4.1355'. [ 282.882407][T11136] netlink: 'syz.4.1359': attribute type 2 has an invalid length. [ 282.943582][T11144] netlink: 'syz.4.1359': attribute type 2 has an invalid length. [ 283.094313][T11147] netlink: 'syz.2.1361': attribute type 32 has an invalid length. [ 283.191613][T11149] netlink: 244 bytes leftover after parsing attributes in process `syz.0.1362'. [ 283.299662][T11167] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1366'. [ 283.319945][T11167] netlink: 32 bytes leftover after parsing attributes in process `syz.1.1366'. [ 283.348929][T11167] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1366'. [ 283.549342][T11177] bond5: entered promiscuous mode [ 283.554874][T11177] bond5: entered allmulticast mode [ 283.560657][T11177] 8021q: adding VLAN 0 to HW filter on device bond5 [ 283.916378][ T1152] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 283.925629][ T1152] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 284.605322][T11243] __nla_validate_parse: 4 callbacks suppressed [ 284.605342][T11243] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1385'. [ 284.740827][T11252] openvswitch: netlink: IP tunnel attribute has 12 unknown bytes. [ 284.755810][T11252] openvswitch: netlink: IP tunnel attribute has 12 unknown bytes. [ 284.782893][T11252] openvswitch: netlink: IP tunnel attribute has 12 unknown bytes. [ 284.826615][T11252] openvswitch: netlink: IP tunnel attribute has 12 unknown bytes. [ 284.879240][T11252] openvswitch: netlink: IP tunnel attribute has 12 unknown bytes. [ 284.897765][T11252] openvswitch: netlink: IP tunnel attribute has 12 unknown bytes. [ 284.907064][T11252] openvswitch: netlink: IP tunnel attribute has 12 unknown bytes. [ 284.917620][T11257] !: renamed from dummy0 (while UP) [ 284.924910][T11252] openvswitch: netlink: IP tunnel attribute has 12 unknown bytes. [ 284.953341][T11252] openvswitch: netlink: IP tunnel attribute has 12 unknown bytes. [ 284.966945][T11255] veth5: entered promiscuous mode [ 284.975011][T11252] openvswitch: netlink: IP tunnel attribute has 12 unknown bytes. [ 285.255342][T11271] 8021q: VLANs not supported on ip6tnl0 [ 285.291241][T11277] tc_dump_action: action bad kind [ 285.363829][T11279] smc: net device bond0 applied user defined pnetid SYZ2 [ 285.406916][T11291] netlink: 32 bytes leftover after parsing attributes in process `syz.0.1398'. [ 285.425070][T11291] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1398'. [ 285.452124][T11291] netlink: 52 bytes leftover after parsing attributes in process `syz.0.1398'. [ 285.511615][T11291] netlink: 'syz.0.1398': attribute type 23 has an invalid length. [ 285.613114][T11296] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1399'. [ 287.052675][T11396] netlink: 'syz.1.1420': attribute type 12 has an invalid length. [ 287.297466][T11412] vlan4: entered allmulticast mode [ 287.456733][T11425] only policy match revision 0 supported [ 287.456756][T11425] unable to load match [ 287.836329][T11434] netlink: 'syz.2.1431': attribute type 29 has an invalid length. [ 287.841341][T11439] netlink: 104 bytes leftover after parsing attributes in process `syz.4.1432'. [ 287.981532][T11442] vcan0: tx drop: invalid da for name 0x0000000000000003 [ 288.064604][T11453] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 288.244970][T11465] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1440'. [ 288.245129][T11461] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1440'. [ 288.266928][T11462] netlink: 'syz.2.1439': attribute type 1 has an invalid length. [ 288.299261][T11462] netlink: 140 bytes leftover after parsing attributes in process `syz.2.1439'. [ 288.335817][T11474] netlink: 'syz.1.1442': attribute type 2 has an invalid length. [ 288.346576][T11475] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1439'. [ 288.396044][T11465] macvtap1: entered promiscuous mode [ 288.401790][T11465] veth1_to_bridge: entered promiscuous mode [ 288.408066][T11465] macvtap1: entered allmulticast mode [ 288.413799][T11465] veth1_to_bridge: entered allmulticast mode [ 288.578373][T11484] (unnamed net_device) (uninitialized): option primary_reselect: invalid value (6) [ 288.817230][T11505] tipc: Can't bind to reserved service type 0 [ 289.157082][T11524] netdevsim netdevsim0 netdevsim0: entered allmulticast mode [ 289.224234][T11526] pim6reg1: entered promiscuous mode [ 289.243583][T11526] pim6reg1: entered allmulticast mode [ 289.462432][T11544] netlink: 'syz.0.1463': attribute type 1 has an invalid length. [ 290.031364][T11565] block nbd1: server does not support multiple connections per device. [ 290.049478][T11565] block nbd1: shutting down sockets [ 291.453223][T11633] ip6gretap1: entered allmulticast mode [ 291.516984][T11637] __nla_validate_parse: 12 callbacks suppressed [ 291.517005][T11637] netlink: 224 bytes leftover after parsing attributes in process `syz.4.1489'. [ 291.544708][T11637] netlink: 16 bytes leftover after parsing attributes in process `syz.4.1489'. [ 291.599161][T11647] bridge2: entered promiscuous mode [ 291.605080][T11647] bridge2: entered allmulticast mode [ 291.732177][T11660] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1493'. [ 291.762754][T11660] netlink: 'syz.3.1493': attribute type 1 has an invalid length. [ 292.222291][T11682] netlink: 25 bytes leftover after parsing attributes in process `syz.0.1499'. [ 292.849210][T11705] netlink: 'syz.1.1502': attribute type 13 has an invalid length. [ 292.859571][T11705] netlink: 'syz.1.1502': attribute type 17 has an invalid length. [ 293.079112][T11705] 8021q: adding VLAN 0 to HW filter on device bond0 [ 293.134318][T11705] 8021q: adding VLAN 0 to HW filter on device team0 [ 293.149987][T11705] net_ratelimit: 56 callbacks suppressed [ 293.150000][T11705] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 293.227101][T11724] openvswitch: netlink: Unknown key attributes 2 [ 293.327399][T11730] netlink: 120 bytes leftover after parsing attributes in process `syz.0.1509'. [ 293.731073][ T30] audit: type=1804 audit(1758451348.005:7): pid=11747 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.2.1514" name="/newroot/289/cgroup.controllers" dev="tmpfs" ino=1503 res=1 errno=0 [ 293.813464][ T30] audit: type=1800 audit(1758451348.005:8): pid=11747 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.1514" name="cgroup.controllers" dev="tmpfs" ino=1503 res=0 errno=0 [ 293.846293][T11751] netlink: 36 bytes leftover after parsing attributes in process `syz.1.1516'. [ 294.029122][T11754] tipc: Enabled bearer , priority 0 [ 294.081647][T11754] syzkaller0: entered promiscuous mode [ 294.087283][T11754] syzkaller0: entered allmulticast mode [ 294.201521][T11754] tipc: Resetting bearer [ 294.298136][T11748] tipc: Resetting bearer [ 294.362910][T11748] tipc: Disabling bearer [ 294.642939][T11777] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1522'. [ 294.808677][T11779] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 294.815397][T11791] netlink: 60 bytes leftover after parsing attributes in process `syz.0.1527'. [ 294.821407][T11780] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 294.853531][T11781] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 294.971726][T11799] macvtap2: entered promiscuous mode [ 294.977091][T11799] mac80211_hwsim hwsim12 wlan1: entered promiscuous mode [ 294.987914][T11799] mac80211_hwsim hwsim12 wlan1: left promiscuous mode [ 295.033245][T11807] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1530'. [ 295.137937][T11810] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1532'. [ 295.442458][T11841] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 295.580797][T11848] netlink: 'syz.1.1540': attribute type 16 has an invalid length. [ 295.909650][T11864] netlink: 'syz.0.1544': attribute type 1 has an invalid length. [ 296.251349][T11870] tipc: Enabled bearer , priority 0 [ 296.264457][T11866] tipc: Resetting bearer [ 296.305997][T11876] syzkaller0: entered promiscuous mode [ 296.311728][T11876] syzkaller0: entered allmulticast mode [ 296.340279][T11865] tipc: Resetting bearer [ 296.426015][T11865] tipc: Disabling bearer [ 296.869276][T11914] openvswitch: netlink: IP tunnel attribute has 16 unknown bytes. [ 297.395849][T11936] bond0: (slave dummy0): Releasing backup interface [ 297.428246][T11936] bridge_slave_0: left allmulticast mode [ 297.442624][T11936] bridge_slave_0: left promiscuous mode [ 297.454971][T11936] bridge0: port 1(bridge_slave_0) entered disabled state [ 297.517015][T11936] bridge_slave_1: left allmulticast mode [ 297.564053][T11951] netlink: 'syz.3.1561': attribute type 10 has an invalid length. [ 297.619169][T11936] bridge_slave_1: left promiscuous mode [ 297.674226][T11936] bridge0: port 2(bridge_slave_1) entered disabled state [ 297.775362][T11936] bond0: (slave bond_slave_0): Releasing backup interface [ 297.790146][T11936] bond0: (slave bond_slave_1): Releasing backup interface [ 297.803268][T11936] team0: Port device team_slave_0 removed [ 297.843681][T11936] team0: Port device team_slave_1 removed [ 297.850513][T11936] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 297.879866][T11936] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 297.923405][T11951] bond0: (slave wlan1): Enslaving as an active interface with an up link [ 298.230636][T11979] netlink: 'syz.3.1571': attribute type 4 has an invalid length. [ 298.313573][T11978] netlink: 'syz.3.1571': attribute type 4 has an invalid length. [ 298.337724][T11978] __nla_validate_parse: 8 callbacks suppressed [ 298.337746][T11978] netlink: 156 bytes leftover after parsing attributes in process `syz.3.1571'. [ 298.493124][T11996] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 298.627267][T12004] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1578'. [ 298.802312][T12016] netlink: 68 bytes leftover after parsing attributes in process `syz.4.1579'. [ 298.846121][T12019] netlink: 32 bytes leftover after parsing attributes in process `syz.1.1582'. [ 299.200825][T12038] sit0: entered promiscuous mode [ 299.226452][T12038] netlink: 'syz.4.1586': attribute type 1 has an invalid length. [ 299.238044][T12038] netlink: 1 bytes leftover after parsing attributes in process `syz.4.1586'. [ 299.659039][T12061] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1594'. [ 299.754253][T12063] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1595'. [ 299.950330][T12078] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1598'. [ 300.012077][T12079] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1599'. [ 300.247982][T12087] syzkaller0: entered promiscuous mode [ 300.260697][T12087] syzkaller0: entered allmulticast mode [ 300.278307][T11363] syzkaller0: tun_net_xmit 70 [ 300.289706][T12087] syzkaller0: tun_chr_ioctl cmd 1074025677 [ 300.305460][T12087] syzkaller0: Linktype set failed because interface is up [ 300.418109][T12092] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1604'. [ 300.735893][T12098] bridge6: entered allmulticast mode [ 301.176605][T12104] syzkaller0: entered promiscuous mode [ 301.191368][T12104] syzkaller0: entered allmulticast mode [ 301.209242][T12106] tipc: Enabling of bearer rejected, failed to enable media [ 303.206773][T12114] batadv2: entered promiscuous mode [ 303.212408][T12114] batadv2: entered allmulticast mode [ 303.230465][T12137] (unnamed net_device) (uninitialized): option lp_interval: invalid value (0) [ 303.249551][T12137] (unnamed net_device) (uninitialized): option lp_interval: allowed values 1 - 2147483647 [ 303.343418][T12143] _ÐZ`Ô€@S!: entered promiscuous mode [ 303.391296][T12147] syz_tun: entered allmulticast mode [ 303.430047][T12148] netlink: 'syz.0.1617': attribute type 12 has an invalid length. [ 303.459726][T12147] dvmrp8: entered allmulticast mode [ 303.579451][T12161] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 303.620693][T12156] netlink: 'syz.1.1620': attribute type 23 has an invalid length. [ 303.847886][T12144] syz_tun: left allmulticast mode [ 303.853368][T12144] dvmrp8: left allmulticast mode [ 303.984541][T12179] __nla_validate_parse: 1 callbacks suppressed [ 303.984562][T12179] netlink: 36 bytes leftover after parsing attributes in process `syz.3.1626'. [ 304.002677][T12179] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1626'. [ 304.220288][T12179] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1626'. [ 304.334521][T12195] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1630'. [ 304.498231][T12208] netdevsim netdevsim4 netdevsim0: entered allmulticast mode [ 304.510698][T12208] netdevsim netdevsim4 netdevsim0: refused to change device tx_queue_len [ 304.545839][T12208] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1636'. [ 304.704177][T12224] netlink: 'syz.4.1640': attribute type 2 has an invalid length. [ 304.808106][T12227] tipc: Enabled bearer , priority 0 [ 304.898283][T12227] tipc: Disabling bearer [ 305.067269][T12239] netlink: 32 bytes leftover after parsing attributes in process `syz.1.1643'. [ 305.259295][T12259] netlink: 'syz.1.1647': attribute type 13 has an invalid length. [ 305.268328][T12259] netlink: 'syz.1.1647': attribute type 17 has an invalid length. [ 305.285408][T12259] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 305.378433][T12259] xfrm0: entered promiscuous mode [ 305.389834][T12259] xfrm0: entered allmulticast mode [ 305.859119][T12278] netlink: 36 bytes leftover after parsing attributes in process `syz.4.1650'. [ 305.863330][T12276] A link change request failed with some changes committed already. Interface team0 may have been left with an inconsistent configuration, please check. [ 306.284865][T12288] 8021q: VLANs not supported on lo [ 306.341460][T12298] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1656'. [ 306.350597][T12298] netlink: 108 bytes leftover after parsing attributes in process `syz.2.1656'. [ 306.401272][T12298] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1656'. [ 306.435942][T12304] bond6: entered promiscuous mode [ 306.435968][T12302] openvswitch: netlink: VXLAN extension 0 has unexpected len 4 expected 0 [ 306.442034][T12304] bond6: entered allmulticast mode [ 306.456132][T12304] 8021q: adding VLAN 0 to HW filter on device bond6 [ 306.471598][T12301] openvswitch: netlink: VXLAN extension 0 has unexpected len 4 expected 0 [ 306.790689][T12304] bond6 (unregistering): Released all slaves [ 307.517499][T12348] netlink: 'syz.4.1666': attribute type 1 has an invalid length. [ 307.594780][T12348] 8021q: adding VLAN 0 to HW filter on device bond6 [ 307.713572][T12357] bond6: (slave gretap1): making interface the new active one [ 307.751541][T12357] bond6: (slave gretap1): Enslaving as an active interface with an up link [ 307.946265][T12368] netlink: 'syz.2.1672': attribute type 8 has an invalid length. [ 308.208376][T12377] (unnamed net_device) (uninitialized): Removing last ns target with arp_interval on [ 308.221364][T12379] sctp: [Deprecated]: syz.4.1675 (pid 12379) Use of struct sctp_assoc_value in delayed_ack socket option. [ 308.221364][T12379] Use struct sctp_sack_info instead [ 309.018503][T12425] !: renamed from dummy0 (while UP) [ 309.110745][T12432] netlink: 'syz.0.1690': attribute type 13 has an invalid length. [ 309.119424][T12432] netlink: 'syz.0.1690': attribute type 17 has an invalid length. [ 309.129939][T12432] sit0: left promiscuous mode [ 309.203157][T12432] syz_tun: left promiscuous mode [ 309.220753][T12432] 8021q: adding VLAN 0 to HW filter on device team0 [ 309.230779][T12432] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 310.085977][T12498] netlink: 'syz.3.1708': attribute type 1 has an invalid length. [ 310.248686][ T30] audit: type=1800 audit(1758451364.525:9): pid=12510 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.1709" name="blkio.bfq.time_recursive" dev="tmpfs" ino=1766 res=0 errno=0 [ 310.251112][T12506] bond5: (slave vxcan3): The slave device specified does not support setting the MAC address [ 310.287776][T12506] bond5: (slave vxcan3): Error -95 calling set_mac_address [ 310.426441][T12508] gretap1: entered promiscuous mode [ 310.452925][T12508] bond5: (slave gretap1): making interface the new active one [ 310.462356][T12508] bond5: (slave gretap1): Enslaving as an active interface with an up link [ 310.508317][T12515] C: entered promiscuous mode [ 310.513402][T12515] team_slave_1: entered promiscuous mode [ 310.519983][T12515] macsec1: entered promiscuous mode [ 310.539758][T12515] team0: entered promiscuous mode [ 310.547361][T12516] __nla_validate_parse: 9 callbacks suppressed [ 310.547379][T12516] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1710'. [ 310.762653][T12528] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1713'. [ 310.772244][T12528] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1713'. [ 310.799710][T12528] syz_tun: entered promiscuous mode [ 310.834785][T12533] openvswitch: netlink: IP tunnel TTL not specified. [ 310.844620][T12528] syz_tun: left promiscuous mode [ 312.196013][T12574] Àÿ: renamed from team_slave_1 [ 312.523138][T12599] (unnamed net_device) (uninitialized): option primary_reselect: invalid value (6) [ 312.548938][T12599] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1736'. [ 312.697222][T12608] netlink: 'syz.1.1737': attribute type 7 has an invalid length. [ 312.870463][T12608] : entered promiscuous mode [ 313.662900][T12658] netlink: 44 bytes leftover after parsing attributes in process `syz.4.1749'. [ 314.426676][T12689] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1754'. [ 314.598347][T12698] netlink: 'syz.4.1756': attribute type 3 has an invalid length. [ 314.614592][T12698] netlink: 'syz.4.1756': attribute type 1 has an invalid length. [ 314.626915][T12698] netlink: 212 bytes leftover after parsing attributes in process `syz.4.1756'. [ 314.686208][T12698] netlink: 'syz.4.1756': attribute type 3 has an invalid length. [ 314.695975][T12698] netlink: 'syz.4.1756': attribute type 1 has an invalid length. [ 314.704159][T12698] netlink: 212 bytes leftover after parsing attributes in process `syz.4.1756'. [ 314.787307][T12704] tipc: Enabled bearer , priority 0 [ 314.803745][T12704] syzkaller0: entered promiscuous mode [ 314.818966][T12704] syzkaller0: entered allmulticast mode [ 314.862376][T12709] netlink: 'syz.0.1759': attribute type 1 has an invalid length. [ 314.903907][T12709] 8021q: adding VLAN 0 to HW filter on device bond5 [ 314.929403][T12704] tipc: Resetting bearer [ 314.950021][T12709] gretap1: entered promiscuous mode [ 315.082610][T12721] netlink: 28 bytes leftover after parsing attributes in process `syz.4.1763'. [ 315.122924][T12727] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1762'. [ 315.145770][T12718] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 315.244080][T12738] netlink: 'syz.0.1762': attribute type 10 has an invalid length. [ 315.585958][T12746] __nla_validate_parse: 2 callbacks suppressed [ 315.585978][T12746] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1764'. [ 315.612865][T12704] tipc: Resetting bearer [ 315.655033][T12704] tipc: Disabling bearer [ 315.826224][T12758] netlink: 'syz.2.1768': attribute type 1 has an invalid length. [ 315.849590][T12758] netlink: 'syz.2.1768': attribute type 4 has an invalid length. [ 315.882725][T12758] netlink: 212 bytes leftover after parsing attributes in process `syz.2.1768'. [ 315.929193][T12758] netlink: 'syz.2.1768': attribute type 3 has an invalid length. [ 315.937984][T12758] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1768'. [ 315.984271][T12768] netlink: 'syz.0.1770': attribute type 1 has an invalid length. [ 316.013949][T12768] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1770'. [ 316.094896][T12774] netlink: 140 bytes leftover after parsing attributes in process `syz.2.1773'. [ 316.309894][T12784] netlink: 788 bytes leftover after parsing attributes in process `syz.1.1777'. [ 316.751151][ T5871] Bluetooth: hci4: command 0x0405 tx timeout [ 317.155709][ T1304] ieee802154 phy1 wpan1: encryption failed: -22 [ 317.262680][T12824] openvswitch: netlink: Flow actions attr not present in new flow. [ 317.349132][T12829] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1786'. [ 317.362238][T12833] netlink: 200 bytes leftover after parsing attributes in process `syz.3.1787'. [ 317.392588][T12834] netlink: 200 bytes leftover after parsing attributes in process `syz.3.1787'. [ 317.720849][ T30] audit: type=1804 audit(1758451371.995:10): pid=12851 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.0.1791" name="/newroot/351/cgroup.controllers" dev="tmpfs" ino=1812 res=1 errno=0 [ 317.822350][ T30] audit: type=1800 audit(1758451371.995:11): pid=12851 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.1791" name="cgroup.controllers" dev="tmpfs" ino=1812 res=0 errno=0 [ 317.899618][T12863] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1796'. [ 318.974082][T12891] Bluetooth: hci0: Opcode 0x0401 failed: -22 [ 319.181909][T12910] ip6gre0: entered allmulticast mode [ 319.203214][T12901] ieee802154 phy1 wpan1: encryption failed: -22 [ 319.215990][ T5868] IPVS: starting estimator thread 0... [ 319.343535][T12911] IPVS: using max 29 ests per chain, 69600 per kthread [ 320.222066][T12934] xfrm0: left promiscuous mode [ 320.233553][T12934] xfrm0: left allmulticast mode [ 320.411070][T12934] bond3: left promiscuous mode [ 320.416259][T12934] bond3: left allmulticast mode [ 320.427136][T12934] veth1_to_bridge: left allmulticast mode [ 320.433988][T12934] veth1_to_bridge: left promiscuous mode [ 320.441795][T12934] macvtap1: left promiscuous mode [ 320.460432][T12934] macvtap1: left allmulticast mode [ 320.476730][T12934] bridge2: left promiscuous mode [ 320.481918][T12934] bridge2: left allmulticast mode [ 320.491425][T12934] gretap1: left promiscuous mode [ 320.754712][ T6088] netdevsim netdevsim3 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 320.771142][ T6088] netdevsim netdevsim3 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 320.854347][T12961] vlan0: entered allmulticast mode [ 320.865087][T12961] dummy0: entered allmulticast mode [ 320.955054][ T6088] netdevsim netdevsim3 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 321.001732][ T5871] Bluetooth: hci0: command tx timeout [ 321.020546][ T6088] netdevsim netdevsim3 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 321.083886][T12973] validate_nla: 4 callbacks suppressed [ 321.083909][T12973] netlink: 'syz.3.1822': attribute type 1 has an invalid length. [ 321.136090][T12973] __nla_validate_parse: 11 callbacks suppressed [ 321.136112][T12973] netlink: 228 bytes leftover after parsing attributes in process `syz.3.1822'. [ 321.291479][T12982] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1827'. [ 321.621744][T12986] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1828'. [ 321.706856][T12995] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1830'. [ 321.786544][T12995] netlink: 'syz.3.1830': attribute type 1 has an invalid length. [ 321.954030][T13003] netlink: 664 bytes leftover after parsing attributes in process `syz.1.1832'. [ 321.969088][T13003] netlink: 664 bytes leftover after parsing attributes in process `syz.1.1832'. [ 321.984907][T13002] netlink: 'syz.3.1833': attribute type 10 has an invalid length. [ 321.993291][T13002] netlink: 40 bytes leftover after parsing attributes in process `syz.3.1833'. [ 322.009717][T13002] dummy0: entered promiscuous mode [ 322.019244][T13002] bridge0: port 1(dummy0) entered blocking state [ 322.027539][T13002] bridge0: port 1(dummy0) entered disabled state [ 322.094812][T13009] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1834'. [ 323.714396][T13051] netlink: 'syz.3.1847': attribute type 4 has an invalid length. [ 323.714396][T13050] netlink: 'syz.3.1847': attribute type 4 has an invalid length. [ 323.736923][T13048] tipc: Enabled bearer , priority 0 [ 323.762265][T13048] syzkaller0: entered promiscuous mode [ 323.770506][T13048] syzkaller0: entered allmulticast mode [ 323.821603][T13048] syz_tun: mtu less than device minimum [ 323.966313][T13070] netlink: 71 bytes leftover after parsing attributes in process `syz.3.1851'. [ 323.976790][T13070] netlink: 'syz.3.1851': attribute type 39 has an invalid length. [ 324.115130][T13075] openvswitch: netlink: Duplicate or invalid key (type 0). [ 324.144094][T13075] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 324.158885][T13047] tipc: Resetting bearer [ 324.304971][T13047] tipc: Disabling bearer [ 324.444923][T13081] : renamed from bond_slave_0 (while UP) [ 325.320145][T13114] netlink: 24 bytes leftover after parsing attributes in process `syz.4.1866'. [ 325.596465][T13133] !: renamed from dummy0 (while UP) [ 325.715395][T13142] pimreg: entered allmulticast mode [ 325.726206][T13141] netlink: 'syz.0.1873': attribute type 10 has an invalid length. [ 326.283486][T13172] IPVS: Error connecting to the multicast addr [ 326.648197][T13198] __nla_validate_parse: 3 callbacks suppressed [ 326.648219][T13198] netlink: 36 bytes leftover after parsing attributes in process `syz.2.1889'. [ 326.755064][T13205] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1895'. [ 326.790326][T13208] IPVS: sync thread started: state = BACKUP, mcast_ifn = macvlan1, syncid = 3, id = 0 [ 326.812235][T13205] netlink: 'syz.1.1895': attribute type 3 has an invalid length. [ 326.977303][T13217] netlink: 256 bytes leftover after parsing attributes in process `syz.3.1897'. [ 326.988482][T13217] unsupported nlmsg_type 40 [ 327.048694][T13212] bond_slave_0: entered allmulticast mode [ 327.837280][T13266] team0: Device ipip0 is of different type [ 327.959433][T13277] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1914'. [ 327.983339][T13279] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1916'. [ 328.300197][T13303] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1921'. [ 328.428494][T13307] netlink: 48 bytes leftover after parsing attributes in process `syz.1.1923'. [ 328.563437][T13313] netlink: 'syz.2.1925': attribute type 1 has an invalid length. [ 328.902691][T13326] netlink: 'syz.2.1927': attribute type 2 has an invalid length. [ 329.426065][T13349] netlink: 48 bytes leftover after parsing attributes in process `syz.1.1935'. [ 329.705226][T13375] netlink: 16 bytes leftover after parsing attributes in process `syz.3.1942'. [ 329.839606][T13380] netlink: 'syz.2.1943': attribute type 8 has an invalid length. [ 330.152897][T13388] netlink: 'syz.3.1945': attribute type 10 has an invalid length. [ 330.160778][T13388] netlink: 40 bytes leftover after parsing attributes in process `syz.3.1945'. [ 330.213080][T13388] batman_adv: batadv0: Adding interface: virt_wifi0 [ 330.219920][T13388] batman_adv: batadv0: The MTU of interface virt_wifi0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 330.248078][T13388] batman_adv: batadv0: Interface activated: virt_wifi0 [ 330.442334][T13390] syzkaller1: entered promiscuous mode [ 330.452637][T13390] syzkaller1: entered allmulticast mode [ 331.195078][T13431] netlink: 'syz.0.1958': attribute type 8 has an invalid length. [ 331.263521][T13431] bond0: entered promiscuous mode [ 331.268618][T13431] syz_tun: entered promiscuous mode [ 331.371584][T13431] bond0: left promiscuous mode [ 331.411147][T13431] syz_tun: left promiscuous mode [ 331.509987][T13432] : renamed from veth0_to_bond (while UP) [ 331.770655][T13456] __nla_validate_parse: 3 callbacks suppressed [ 331.770676][T13456] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1964'. [ 332.044931][T13460] netlink: 20 bytes leftover after parsing attributes in process `syz.4.1967'. [ 332.057320][T13458] netlink: 'syz.1.1965': attribute type 10 has an invalid length. [ 332.123162][T13461] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1967'. [ 332.197039][T13470] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 332.204358][T13470] IPv6: NLM_F_CREATE should be set when creating new route [ 332.211671][T13470] IPv6: NLM_F_CREATE should be set when creating new route [ 332.218914][T13470] IPv6: NLM_F_CREATE should be set when creating new route [ 332.267296][T13478] openvswitch: netlink: IP tunnel attribute has 12 unknown bytes. [ 332.319069][T13480] C: renamed from team_slave_0 [ 332.348835][T13480] netlink: 'syz.0.1972': attribute type 2 has an invalid length. [ 332.378752][T13480] netlink: 116 bytes leftover after parsing attributes in process `syz.0.1972'. [ 332.389041][T13480] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check. [ 332.395338][T13491] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1975'. [ 332.553884][T13501] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1976'. [ 332.596712][T13505] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1979'. [ 332.609630][T13490] delete_channel: no stack [ 332.614152][T13502] macsec1: entered promiscuous mode [ 332.614175][T13502] team0: entered promiscuous mode [ 332.646458][T13505] IPVS: set_ctl: invalid protocol: 58 172.20.20.170:0 [ 332.935854][T13520] netlink: 'syz.4.1985': attribute type 29 has an invalid length. [ 332.946301][T13520] netlink: 'syz.4.1985': attribute type 29 has an invalid length. [ 332.976950][T13520] netlink: 500 bytes leftover after parsing attributes in process `syz.4.1985'. [ 333.008478][T13523] netlink: 'syz.2.1986': attribute type 12 has an invalid length. [ 333.011357][T13520] unsupported nla_type 59 [ 333.018422][T13516] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1983'. [ 333.034032][T13523] netlink: 104 bytes leftover after parsing attributes in process `syz.2.1986'. [ 333.325997][T13540] bond0: entered promiscuous mode [ 333.651301][T13550] IPVS: Scheduler module ip_vs_sip not found [ 334.078200][T13570] bridge0: port 1(0!) entered blocking state [ 334.084655][T13570] bridge0: port 1(0!) entered forwarding state [ 334.113252][T13570] team0: Port device bridge0 added [ 334.308246][T13575] A link change request failed with some changes committed already. Interface team0 may have been left with an inconsistent configuration, please check. [ 334.423151][T13578] netlink: 'syz.4.2001': attribute type 3 has an invalid length. [ 334.909470][T13605] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 335.660688][T13619] tipc: Enabled bearer , priority 0 [ 335.809964][T13637] netlink: 'syz.1.2015': attribute type 1 has an invalid length. [ 335.840528][T13637] netlink: 'syz.1.2015': attribute type 1 has an invalid length. [ 335.865433][T13614] syzkaller0: entered promiscuous mode [ 335.871293][T13614] syzkaller0: entered allmulticast mode [ 335.877386][T13637] netlink: 'syz.1.2015': attribute type 1 has an invalid length. [ 335.902161][T13637] netlink: 'syz.1.2015': attribute type 1 has an invalid length. [ 337.324752][T13627] tipc: Resetting bearer [ 337.371295][T13611] tipc: Resetting bearer [ 337.489318][T13611] tipc: Disabling bearer [ 337.501976][T13664] __nla_validate_parse: 6 callbacks suppressed [ 337.501996][T13664] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2024'. [ 337.529492][T13667] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2023'. [ 337.541992][T13664] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2024'. [ 338.029175][T13698] netlink: 120 bytes leftover after parsing attributes in process `syz.0.2031'. [ 338.233658][T13704] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 338.533079][T13716] batadv2: entered promiscuous mode [ 338.623144][T13725] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 338.827683][T13739] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2042'. [ 338.862123][T13739] netlink: 24 bytes leftover after parsing attributes in process `syz.1.2042'. [ 338.931804][T13739] geneve3: entered promiscuous mode [ 338.937547][T13739] geneve3: entered allmulticast mode [ 338.945223][T11476] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 338.956300][T11476] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 339.039842][T11476] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 339.078532][T13755] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2047'. [ 339.121762][T13757] netlink: 152 bytes leftover after parsing attributes in process `syz.1.2048'. [ 339.219561][T13764] netlink: 104 bytes leftover after parsing attributes in process `syz.0.2047'. [ 339.317243][T13753] sit0: left promiscuous mode [ 339.361468][T13753] bond0: left promiscuous mode [ 339.370061][T13753] netdevsim netdevsim4 netdevsim0: left allmulticast mode [ 339.549009][T13753] geneve3: left promiscuous mode [ 339.558441][T13753] geneve3: left allmulticast mode [ 339.605474][T13753] bond5: left promiscuous mode [ 339.620671][T13753] bond5: left allmulticast mode [ 339.692444][T11476] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 339.703547][T11476] netdevsim netdevsim4 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 339.716575][T11476] netdevsim netdevsim4 netdevsim0: unset [1, 0] type 2 family 0 port 42715 - 0 [ 339.725817][T13757] netlink: 20 bytes leftover after parsing attributes in process `syz.1.2048'. [ 339.742213][T13765] syzkaller1: entered promiscuous mode [ 339.748018][T13765] syzkaller1: entered allmulticast mode [ 339.755644][T11476] netdevsim netdevsim4 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 339.766875][T11476] netdevsim netdevsim4 netdevsim1: unset [1, 0] type 2 family 0 port 42715 - 0 [ 339.777967][T11476] netdevsim netdevsim4 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 339.787889][T11476] netdevsim netdevsim4 netdevsim2: unset [1, 0] type 2 family 0 port 42715 - 0 [ 339.899162][T11476] netdevsim netdevsim4 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 339.925317][T11476] netdevsim netdevsim4 netdevsim3: unset [1, 0] type 2 family 0 port 42715 - 0 [ 339.978261][T13782] validate_nla: 62 callbacks suppressed [ 339.978282][T13782] netlink: 'syz.2.2053': attribute type 6 has an invalid length. [ 340.005779][T13782] netlink: 'syz.2.2053': attribute type 12 has an invalid length. [ 340.230790][T13804] bond0: option ad_user_port_key: mode dependency failed, not supported in mode balance-rr(0) [ 340.363535][T13807] ipvlan2: entered promiscuous mode [ 340.487160][T13810] A link change request failed with some changes committed already. Interface batadv_slave_0 may have been left with an inconsistent configuration, please check. [ 341.496663][T13863] mac80211_hwsim hwsim8 wlan0: entered promiscuous mode [ 341.507156][T13863] A link change request failed with some changes committed already. Interface wlan0 may have been left with an inconsistent configuration, please check. [ 341.524612][T13868] A link change request failed with some changes committed already. Interface wlan0 may have been left with an inconsistent configuration, please check. [ 341.683830][T13880] openvswitch: netlink: IP tunnel attribute has 12 unknown bytes. [ 341.702338][T13878] sctp: [Deprecated]: syz.0.2083 (pid 13878) Use of int in max_burst socket option. [ 341.702338][T13878] Use struct sctp_assoc_value instead [ 341.922373][T13904] tap0: tun_chr_ioctl cmd 1074812118 [ 342.188813][T13921] netlink: 'syz.0.2094': attribute type 32 has an invalid length. [ 342.255964][T13924] vlan2: entered allmulticast mode [ 342.361942][T13926] ip6gretap2: entered promiscuous mode [ 342.429678][T13933] ip_vti0: entered promiscuous mode [ 342.480120][T13933] ip_vti0: entered allmulticast mode [ 343.373379][T13951] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 343.405105][T13951] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 1] type 2 family 0 port 49537 - 0 [ 343.471367][T13951] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 2] type 2 family 0 port 53511 - 0 [ 343.854207][T13951] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 343.870614][T13951] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 1] type 2 family 0 port 49537 - 0 [ 343.891161][T13951] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 2] type 2 family 0 port 53511 - 0 [ 344.009761][T13980] __nla_validate_parse: 13 callbacks suppressed [ 344.009779][T13980] netlink: 260 bytes leftover after parsing attributes in process `syz.4.2106'. [ 344.044779][T13951] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 344.055339][T13951] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 1] type 2 family 0 port 49537 - 0 [ 344.066924][T13951] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 2] type 2 family 0 port 53511 - 0 [ 344.171374][T13951] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 344.196389][T13951] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 1] type 2 family 0 port 49537 - 0 [ 344.219058][T13951] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 2] type 2 family 0 port 53511 - 0 [ 344.420109][ T6088] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 53511 - 0 [ 344.431358][ T6088] netdevsim netdevsim0 eth0: set [1, 1] type 2 family 0 port 49537 - 0 [ 344.449690][ T6088] netdevsim netdevsim0 eth0: set [1, 2] type 2 family 0 port 6081 - 0 [ 344.490844][ T6088] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 53511 - 0 [ 344.505270][ T6088] netdevsim netdevsim0 eth1: set [1, 1] type 2 family 0 port 49537 - 0 [ 344.515450][ T6088] netdevsim netdevsim0 eth1: set [1, 2] type 2 family 0 port 6081 - 0 [ 344.525056][T13992] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2109'. [ 344.666399][T13998] bond6: (slave vxcan3): The slave device specified does not support setting the MAC address [ 344.697885][T13998] bond6: (slave vxcan3): Error -95 calling set_mac_address [ 344.786795][T11391] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 53511 - 0 [ 344.796356][T11391] netdevsim netdevsim0 eth2: set [1, 1] type 2 family 0 port 49537 - 0 [ 344.833672][T11391] netdevsim netdevsim0 eth2: set [1, 2] type 2 family 0 port 6081 - 0 [ 344.877259][ T6088] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 53511 - 0 [ 344.888100][ T6088] netdevsim netdevsim0 eth3: set [1, 1] type 2 family 0 port 49537 - 0 [ 344.897837][ T6088] netdevsim netdevsim0 eth3: set [1, 2] type 2 family 0 port 6081 - 0 [ 345.251392][T14028] bond0: (slave 0!): Releasing backup interface [ 345.284953][T14028] bridge_slave_0: left promiscuous mode [ 345.314366][T14028] bridge0: port 1(bridge_slave_0) entered disabled state [ 345.357919][T14028] bridge_slave_1: left allmulticast mode [ 345.366881][T14028] bridge_slave_1: left promiscuous mode [ 345.375491][T14028] bridge0: port 2(bridge_slave_1) entered disabled state [ 345.415775][T14028] bond0: (slave 30): Releasing backup interface [ 345.429686][T14028] bond0: (slave bond_slave_1): Releasing backup interface [ 345.446318][T14028] C: left promiscuous mode [ 345.458394][T14028] team0: Port device C removed [ 345.466053][T14028] team_slave_1: left promiscuous mode [ 345.478778][T14028] team0: Port device team_slave_1 removed [ 345.487208][T14028] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 345.496008][T14028] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 345.508695][T14028] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 345.516622][T14028] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 345.528931][T14028] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 345.791360][T14059] openvswitch: netlink: Tunnel attr 14 has unexpected len 4 expected 0 [ 345.855556][T14063] netlink: 80 bytes leftover after parsing attributes in process `syz.1.2122'. [ 346.103850][T14074] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2127'. [ 346.126291][T14079] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2128'. [ 346.128086][T14076] netlink: 'syz.3.2125': attribute type 21 has an invalid length. [ 346.283632][T14093] netlink: 'syz.2.2130': attribute type 1 has an invalid length. [ 346.284397][T14092] netlink: 44 bytes leftover after parsing attributes in process `syz.0.2131'. [ 346.294602][T14093] netlink: 'syz.2.2130': attribute type 2 has an invalid length. [ 346.304281][T14092] netlink: 43 bytes leftover after parsing attributes in process `syz.0.2131'. [ 346.319987][T14092] netlink: 'syz.0.2131': attribute type 5 has an invalid length. [ 346.327899][T14092] netlink: 43 bytes leftover after parsing attributes in process `syz.0.2131'. [ 346.385890][T14096] sctp: [Deprecated]: syz.0.2132 (pid 14096) Use of int in max_burst socket option deprecated. [ 346.385890][T14096] Use struct sctp_assoc_value instead [ 346.677275][T14109] netlink: 20 bytes leftover after parsing attributes in process `syz.4.2137'. [ 346.694570][T14109] netlink: 36 bytes leftover after parsing attributes in process `syz.4.2137'. [ 346.825455][T14120] pim6reg: entered allmulticast mode [ 346.842504][T14120] pim6reg: left allmulticast mode [ 347.216966][T14115] iwpm_register_pid: Unable to send a nlmsg (client = 2) [ 347.238614][T14115] infiniband syz1: RDMA CMA: cma_listen_on_dev, error -98 [ 347.668977][T14155] sit0: entered promiscuous mode [ 347.717546][T14155] netlink: 'syz.0.2148': attribute type 1 has an invalid length. [ 347.807868][T14154] dvmrp1: entered allmulticast mode [ 347.882917][ T51] Bluetooth: hci4: command 0x0405 tx timeout [ 347.958741][T14162] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 348.209893][T14151] infiniband syz!: set down [ 348.214910][T14151] infiniband syz!: added team_slave_0 [ 348.292355][T14151] RDS/IB: syz!: added [ 348.306197][T14151] smc: adding ib device syz! with port count 1 [ 348.313121][T14151] smc: ib device syz! port 1 has no pnetid [ 348.435418][T14176] bridge0: port 1(0!) entered disabled state [ 348.463966][T14176] team0: Port device bridge0 removed [ 348.483290][T14176] bridge0: port 1(0!) entered disabled state [ 348.513233][T14176] batman_adv: batadv0: Interface deactivated: virt_wifi0 [ 348.521812][T14176] batman_adv: batadv0: Removing interface: virt_wifi0 [ 348.537623][T14176] bond0: (slave wlan1): Releasing backup interface [ 348.552451][T14176] bond5: (slave gretap1): Releasing active interface [ 348.578628][T14181] team0: Failed to send options change via netlink (err -105) [ 348.601792][T14181] team0: Mode changed to "activebackup" [ 349.794569][T14238] __nla_validate_parse: 7 callbacks suppressed [ 349.794590][T14238] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2171'. [ 350.016696][T14246] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2173'. [ 350.031257][T14245] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2173'. [ 350.150252][T14253] netlink: 'syz.2.2176': attribute type 1 has an invalid length. [ 350.158946][T14253] netlink: 'syz.2.2176': attribute type 3 has an invalid length. [ 350.185184][T14253] netlink: 'syz.2.2176': attribute type 1 has an invalid length. [ 350.226381][T14253] netlink: 204 bytes leftover after parsing attributes in process `syz.2.2176'. [ 350.251464][T14253] NCSI netlink: No device for ifindex 0 [ 350.273175][T14258] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2178'. [ 350.326604][T14258] netlink: 'syz.0.2178': attribute type 1 has an invalid length. [ 350.345837][T14258] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2178'. [ 350.407757][T14262] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2179'. [ 350.605929][T14238] netlink: 'syz.1.2171': attribute type 4 has an invalid length. [ 350.708761][T14272] batadv1: entered promiscuous mode [ 350.731128][T14272] batadv1: entered allmulticast mode [ 351.290664][T14295] syzkaller1: entered promiscuous mode [ 351.312369][T14295] syzkaller1: entered allmulticast mode [ 351.442147][T14302] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2189'. [ 351.466106][T14302] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2189'. [ 351.545481][T14307] netlink: 24 bytes leftover after parsing attributes in process `syz.4.2189'. [ 352.041961][T14334] openvswitch: netlink: Flow set message rejected, Key attribute missing. [ 353.336342][T14390] tipc: Enabling of bearer rejected, failed to enable media [ 353.812472][T14411] tipc: Enabled bearer , priority 0 [ 353.830723][T14411] mac80211_hwsim hwsim8 syzkaller0: entered promiscuous mode [ 353.849894][T14411] mac80211_hwsim hwsim8 syzkaller0: entered allmulticast mode [ 353.860618][T14411] tipc: Resetting bearer [ 353.881655][T14411] mac80211_hwsim hwsim8 syzkaller0: Caught tx_queue_len zero misconfig [ 354.294623][T14421] bridge5: port 1(veth9) entered blocking state [ 354.304224][T14421] bridge5: port 1(veth9) entered disabled state [ 354.310849][T14421] veth9: entered allmulticast mode [ 354.333546][T14421] veth9: entered promiscuous mode [ 354.377950][T14420] bridge5: port 2(veth0_to_bond) entered blocking state [ 354.385783][T14420] bridge5: port 2(veth0_to_bond) entered disabled state [ 354.401592][T14420] veth0_to_bond: entered allmulticast mode [ 354.421682][T14420] veth0_to_bond: entered promiscuous mode [ 354.462557][T14429] tipc: Enabling of bearer rejected, already enabled [ 354.835074][T14438] lo speed is unknown, defaulting to 1000 [ 354.851032][ T5952] tipc: Node number set to 915771239 [ 354.858692][T14438] lo speed is unknown, defaulting to 1000 [ 354.914076][T14438] lo speed is unknown, defaulting to 1000 [ 354.945821][T14438] infiniband syz2: RDMA CMA: cma_listen_on_dev, error -98 [ 355.187288][T14438] lo speed is unknown, defaulting to 1000 [ 355.204670][T14438] lo speed is unknown, defaulting to 1000 [ 355.232699][T14438] lo speed is unknown, defaulting to 1000 [ 355.240727][T14438] lo speed is unknown, defaulting to 1000 [ 355.250316][T14438] lo speed is unknown, defaulting to 1000 [ 355.260147][T14438] lo speed is unknown, defaulting to 1000 [ 355.648537][T14462] tipc: Enabled bearer , priority 0 [ 355.677439][T14463] tipc: Enabled bearer , priority 0 [ 355.689186][T14462] syzkaller0: entered promiscuous mode [ 355.699011][T14462] syzkaller0: entered allmulticast mode [ 355.708441][T14463] syzkaller0: entered promiscuous mode [ 355.716392][T14463] syzkaller0: entered allmulticast mode [ 355.786136][T14468] bond12: entered promiscuous mode [ 355.794279][T14468] 8021q: adding VLAN 0 to HW filter on device bond12 [ 355.828624][T14462] tipc: Resetting bearer [ 355.887942][T14468] workqueue: Failed to create a rescuer kthread for wq "bond13": -EINTR [ 355.888858][T14463] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 355.954347][T14457] tipc: Resetting bearer [ 355.975718][T14457] tipc: Disabling bearer [ 355.995931][T14460] tipc: Resetting bearer [ 356.015425][T14460] tipc: Disabling bearer [ 356.046818][T14480] tipc: Enabled bearer , priority 0 [ 356.057498][T14480] syzkaller0: entered promiscuous mode [ 356.070784][T14480] syzkaller0: entered allmulticast mode [ 356.119510][T14480] tipc: Resetting bearer [ 356.171667][T14479] tipc: Resetting bearer [ 356.412458][T14479] tipc: Disabling bearer [ 357.177174][T14518] __nla_validate_parse: 9 callbacks suppressed [ 357.177196][T14518] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2239'. [ 357.815261][T14551] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 357.995061][T14551] syzkaller1: entered allmulticast mode [ 358.239804][T14568] syz!: rxe_newlink: already configured on team_slave_0 [ 358.684330][T14582] pim6reg: entered allmulticast mode [ 358.712978][T14585] pim6reg: left allmulticast mode [ 358.785061][T14582] netlink: 80 bytes leftover after parsing attributes in process `syz.0.2255'. [ 359.116151][T14586] netlink: 16402 bytes leftover after parsing attributes in process `syz.3.2256'. [ 359.135421][T14583] netlink: 16402 bytes leftover after parsing attributes in process `syz.3.2256'. [ 359.243881][T14601] validate_nla: 1 callbacks suppressed [ 359.243905][T14601] netlink: 'syz.2.2260': attribute type 2 has an invalid length. [ 359.281565][T14601] netlink: 51 bytes leftover after parsing attributes in process `syz.2.2260'. [ 359.299015][T14601] syzkaller1: tun_chr_ioctl cmd 1074025677 [ 359.313172][T14601] syzkaller1: linktype set to 823 [ 360.372531][T14630] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2266'. [ 360.382480][T14630] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2266'. [ 360.958706][T14624] lo speed is unknown, defaulting to 1000 [ 360.978100][T14653] netlink: 256 bytes leftover after parsing attributes in process `syz.4.2273'. [ 360.987951][T14653] netlink: 48 bytes leftover after parsing attributes in process `syz.4.2273'. [ 361.008949][T14656] netlink: 'syz.3.2274': attribute type 2 has an invalid length. [ 361.017889][T14653] dvmrp1: left allmulticast mode [ 361.023866][T14656] netlink: 224 bytes leftover after parsing attributes in process `syz.3.2274'. [ 361.104800][ T8331] hid-generic 0005:0007:0008.0004: unknown main item tag 0x0 [ 361.159601][ T8331] hid-generic 0005:0007:0008.0004: hidraw0: BLUETOOTH HID v0.08 Device [syz0] on aa:aa:aa:aa:aa:aa [ 361.204257][T14665] tipc: Enabled bearer , priority 0 [ 361.232858][T14665] syzkaller0: entered promiscuous mode [ 361.238568][T14665] syzkaller0: entered allmulticast mode [ 361.376675][T14665] tipc: Resetting bearer [ 361.394559][T14669] netlink: 'syz.4.2278': attribute type 23 has an invalid length. [ 361.448919][T14664] tipc: Resetting bearer [ 361.482122][T14664] tipc: Disabling bearer [ 361.505024][T14674] tipc: Enabling of bearer rejected, already enabled [ 362.395427][T14707] syzkaller0: entered promiscuous mode [ 362.405915][T14707] syzkaller0: entered allmulticast mode [ 362.575026][T14724] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2292'. [ 364.353806][T14744] bridge7: trying to set multicast query interval below minimum, setting to 100 (1000ms) [ 364.375865][T14749] openvswitch: netlink: Key 6 has unexpected len 4096 expected 2 [ 364.551653][T14755] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 364.655207][T14760] tipc: Enabling of bearer rejected, failed to enable media [ 364.692082][T14760] netlink: 'syz.3.2300': attribute type 13 has an invalid length. [ 364.815359][T14775] netlink: 'syz.4.2304': attribute type 8 has an invalid length. [ 365.126274][T14788] pim6reg1: entered promiscuous mode [ 365.132197][T14788] pim6reg1: entered allmulticast mode [ 365.221720][T14797] netlink: 'syz.2.2308': attribute type 3 has an invalid length. [ 365.326717][T14800] tipc: Enabled bearer , priority 0 [ 365.349712][T14800] tipc: Resetting bearer [ 365.362632][T14806] sctp: [Deprecated]: syz.3.2312 (pid 14806) Use of struct sctp_assoc_value in delayed_ack socket option. [ 365.362632][T14806] Use struct sctp_sack_info instead [ 365.382935][T14799] tipc: Disabling bearer [ 365.415899][T14808] pimreg: entered allmulticast mode [ 366.300258][T14841] netlink: 200 bytes leftover after parsing attributes in process `syz.4.2320'. [ 366.345070][T14819] lo speed is unknown, defaulting to 1000 [ 366.727028][T14848] netlink: 24 bytes leftover after parsing attributes in process `syz.4.2321'. [ 366.749424][T14846] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2322'. [ 366.760541][T14837] lo speed is unknown, defaulting to 1000 [ 366.888423][T14848] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2321'. [ 366.913273][T11367] wlan0: Trigger new scan to find an IBSS to join [ 367.293943][T14866] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2325'. [ 367.379554][T14866] netlink: 284 bytes leftover after parsing attributes in process `syz.4.2325'. [ 367.598636][T14878] netlink: 124 bytes leftover after parsing attributes in process `syz.3.2328'. [ 367.987378][T14895] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2332'. [ 368.316884][T14909] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2338'. [ 368.329243][T14920] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2336'. [ 369.068793][T14928] mac80211_hwsim hwsim2 wlan0: entered promiscuous mode [ 369.077265][T14928] A link change request failed with some changes committed already. Interface wlan0 may have been left with an inconsistent configuration, please check. [ 369.345636][T14954] netlink: 316 bytes leftover after parsing attributes in process `syz.2.2348'. [ 369.403228][T14953] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2346'. [ 369.433976][T14953] macvtap1: entered promiscuous mode [ 369.439340][T14953] mac80211_hwsim hwsim4 wlan1: entered promiscuous mode [ 369.493498][T14959] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2349'. [ 369.524687][T14959] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2349'. [ 369.587694][T14948] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2346'. [ 369.871814][T11363] wlan0: Trigger new scan to find an IBSS to join [ 370.004000][T14974] netlink: 48 bytes leftover after parsing attributes in process `syz.4.2352'. [ 370.505885][T14979] lo speed is unknown, defaulting to 1000 [ 371.186435][T15016] netlink: 'syz.2.2366': attribute type 7 has an invalid length. [ 371.195657][T15016] netlink: 'syz.2.2366': attribute type 8 has an invalid length. [ 371.243827][T15016] ip6gretap0: entered promiscuous mode [ 371.265893][T15016] syz_tun: entered promiscuous mode [ 371.274580][T15016] ip6gretap0: left promiscuous mode [ 371.286222][T15016] syz_tun: left promiscuous mode [ 371.392045][ T51] Bluetooth: hci4: command 0x0405 tx timeout [ 372.261754][T15081] netlink: 'syz.3.2387': attribute type 10 has an invalid length. [ 372.272796][T15081] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 372.284358][T15081] bond0: (slave batadv0): Enslaving as an active interface with an up link [ 372.313843][T15084] netlink: 'syz.3.2387': attribute type 10 has an invalid length. [ 372.361639][T15084] batadv0: entered promiscuous mode [ 372.378784][T15084] batadv0: entered allmulticast mode [ 372.453569][T15084] bond0: (slave batadv0): Releasing backup interface [ 372.513167][T15084] bridge0: port 1(batadv0) entered blocking state [ 372.558418][T15084] bridge0: port 1(batadv0) entered disabled state [ 372.912346][T11363] wlan0: Trigger new scan to find an IBSS to join [ 372.932489][T11391] batman_adv: batadv0: No IGMP Querier present - multicast optimizations disabled [ 372.943796][T11391] batman_adv: batadv0: No MLD Querier present - multicast optimizations disabled [ 373.139765][T15078] lo speed is unknown, defaulting to 1000 [ 373.367431][T15126] syzkaller1: entered promiscuous mode [ 373.381724][T15126] syzkaller1: entered allmulticast mode [ 373.696307][T15131] __nla_validate_parse: 14 callbacks suppressed [ 373.696327][T15131] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2401'. [ 373.764554][T15131] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2401'. [ 373.777151][T15131] bridge0: port 1(syz_tun) entered blocking state [ 373.785848][T15131] bridge0: port 1(syz_tun) entered disabled state [ 373.793768][T15131] syz_tun: entered allmulticast mode [ 373.804236][T15131] syz_tun: entered promiscuous mode [ 373.872494][T11367] wlan0: Creating new IBSS network, BSSID 56:bd:e5:b9:be:fc [ 373.904813][T15100] lo speed is unknown, defaulting to 1000 [ 373.968766][T15116] lo speed is unknown, defaulting to 1000 [ 374.655930][T15139] netlink: 'syz.3.2404': attribute type 1 has an invalid length. [ 374.718822][T15139] bond7: (slave bridge6): making interface the new active one [ 374.727549][T15139] bond7: (slave bridge6): Enslaving as an active interface with an up link [ 374.875968][T15147] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2407'. [ 374.929303][T15147] ip6gre1: entered allmulticast mode [ 375.296705][T15168] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2415'. [ 375.308876][T15169] netlink: 96 bytes leftover after parsing attributes in process `syz.3.2414'. [ 375.316711][T15168] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 375.376025][T15171] syz_tun: entered allmulticast mode [ 375.424403][T15174] veth0_to_team: Caught tx_queue_len zero misconfig [ 375.432486][T15174] sch_tbf: burst 0 is lower than device veth0_to_team mtu (1514) ! [ 375.803319][T15181] netlink: 64 bytes leftover after parsing attributes in process `syz.3.2418'. [ 375.869170][T15171] lo speed is unknown, defaulting to 1000 [ 376.126479][T15176] syz_tun: left allmulticast mode [ 376.180231][T15170] Bluetooth: hci2: Opcode 0x0401 failed: -4 [ 376.579592][T15216] netlink: 'syz.2.2427': attribute type 21 has an invalid length. [ 376.612962][T15221] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2423'. [ 376.926111][T15227] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2429'. [ 377.119808][T15239] netlink: 'syz.3.2433': attribute type 12 has an invalid length. [ 377.138620][T15239] netlink: 9472 bytes leftover after parsing attributes in process `syz.3.2433'. [ 377.305523][T15254] veth0_to_hsr: Caught tx_queue_len zero misconfig [ 377.316510][T15254] netlink: 68 bytes leftover after parsing attributes in process `syz.3.2436'. [ 377.391531][ T5871] Bluetooth: hci2: command 0x0406 tx timeout [ 377.692503][T15275] netlink: 'syz.1.2443': attribute type 1 has an invalid length. [ 377.712238][T15275] netlink: 'syz.1.2443': attribute type 7 has an invalid length. [ 377.723865][T15275] netlink: 'syz.1.2443': attribute type 8 has an invalid length. [ 377.920618][T15286] netlink: 'syz.1.2445': attribute type 3 has an invalid length. [ 378.012122][T15292] _ÐZ`Ô€@S!: entered promiscuous mode [ 378.951766][T15305] geneve2: left promiscuous mode [ 378.995540][T15305] bond3: left promiscuous mode [ 379.004446][T15305] veth3: left promiscuous mode [ 379.013399][T15305] team0: left promiscuous mode [ 379.018661][T15305] macsec1: left promiscuous mode [ 379.031194][T15305] ip6gretap2: left promiscuous mode [ 379.057430][T15313] hsr_slave_0: left promiscuous mode [ 379.066430][T15313] hsr_slave_1: left promiscuous mode [ 379.113275][T15321] tipc: Resetting bearer [ 379.130444][T11476] netdevsim netdevsim2 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 379.150304][T11476] netdevsim netdevsim2 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 379.180049][T11476] netdevsim netdevsim2 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 379.197402][T11476] netdevsim netdevsim2 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 379.449002][T15324] __nla_validate_parse: 5 callbacks suppressed [ 379.449022][T15324] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2455'. [ 379.463860][T15320] lo speed is unknown, defaulting to 1000 [ 380.131442][T15342] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2460'. [ 380.487911][T15356] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2463'. [ 380.877036][T15374] netlink: 'syz.1.2468': attribute type 4 has an invalid length. [ 380.929249][T15374] netlink: 'syz.1.2468': attribute type 4 has an invalid length. [ 380.998107][T15378] netlink: 96 bytes leftover after parsing attributes in process `syz.3.2467'. [ 381.239366][T15341] sit0: entered promiscuous mode [ 381.245531][T15341] netlink: 'syz.4.2459': attribute type 1 has an invalid length. [ 381.279016][T15341] netlink: 1 bytes leftover after parsing attributes in process `syz.4.2459'. [ 381.294148][T15341] netlink: 24 bytes leftover after parsing attributes in process `syz.4.2459'. [ 381.369502][T15397] team0: Caught tx_queue_len zero misconfig [ 381.604065][T15406] netlink: 'syz.0.2476': attribute type 32 has an invalid length. [ 381.798960][T15413] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2478'. [ 381.880793][T15424] netlink: 132 bytes leftover after parsing attributes in process `syz.3.2478'. [ 381.897989][T15425] nft_compat: unsupported protocol 0 [ 381.922739][T15413] team1: entered promiscuous mode [ 381.936896][T15413] team1: entered allmulticast mode [ 381.949526][T15413] 8021q: adding VLAN 0 to HW filter on device team1 [ 382.097120][T15411] lo speed is unknown, defaulting to 1000 [ 382.550165][T15454] netlink: 36 bytes leftover after parsing attributes in process `syz.0.2489'. [ 382.601821][T15447] netlink: 'syz.3.2487': attribute type 58 has an invalid length. [ 382.610206][T15447] netlink: 20 bytes leftover after parsing attributes in process `syz.3.2487'. [ 382.899700][T15461] bridge0: trying to set multicast startup query interval below minimum, setting to 100 (1000ms) [ 382.920481][T15463] bridge0: trying to set multicast startup query interval below minimum, setting to 100 (1000ms) [ 383.356267][T15486] tipc: Resetting bearer [ 384.174178][T15513] tipc: Resetting bearer [ 384.250629][T15513] sit0: left promiscuous mode [ 384.658089][T15513] batadv_slave_0: left promiscuous mode [ 384.692594][T15513] veth1_vlan: left allmulticast mode [ 384.732368][T15513] mac80211_hwsim hwsim2 wlan0: left promiscuous mode [ 384.739847][T15513] bond1: left promiscuous mode [ 384.745273][T15513] bond1: left allmulticast mode [ 384.754746][T15513] gtp0: left promiscuous mode [ 384.759611][T15513] gtp0: left allmulticast mode [ 384.773769][T15513] geneve3: left promiscuous mode [ 384.778740][T15513] geneve3: left allmulticast mode [ 384.797667][T15513] bridge6: left allmulticast mode [ 384.808205][T15513] gretap1: left promiscuous mode [ 384.816549][T15513] team0: left promiscuous mode [ 384.822219][T15513] macsec1: left promiscuous mode [ 384.829416][T15513] mac80211_hwsim hwsim4 wlan1: left promiscuous mode [ 384.838842][T15513] macvtap1: left promiscuous mode [ 384.848203][ T9613] lo speed is unknown, defaulting to 1000 [ 384.854758][ T9613] syz2: Port: 1 Link DOWN [ 384.909285][T15525] ipvlan0: entered promiscuous mode [ 384.922531][T15525] 8021q: adding VLAN 0 to HW filter on device ipvlan0 [ 385.016665][T11476] netdevsim netdevsim0 eth0: unset [1, 0] type 2 family 0 port 53511 - 0 [ 385.036006][T11476] netdevsim netdevsim0 eth0: unset [1, 1] type 2 family 0 port 49537 - 0 [ 385.054444][T11476] netdevsim netdevsim0 eth0: unset [1, 2] type 2 family 0 port 6081 - 0 [ 385.065477][T11476] netdevsim netdevsim0 eth1: unset [1, 0] type 2 family 0 port 53511 - 0 [ 385.075837][T11476] netdevsim netdevsim0 eth1: unset [1, 1] type 2 family 0 port 49537 - 0 [ 385.086076][T11476] netdevsim netdevsim0 eth1: unset [1, 2] type 2 family 0 port 6081 - 0 [ 385.104359][T11476] netdevsim netdevsim0 eth2: unset [1, 0] type 2 family 0 port 53511 - 0 [ 385.122267][T11476] netdevsim netdevsim0 eth2: unset [1, 1] type 2 family 0 port 49537 - 0 [ 385.151698][T11476] netdevsim netdevsim0 eth2: unset [1, 2] type 2 family 0 port 6081 - 0 [ 385.170825][T11476] netdevsim netdevsim0 eth3: unset [1, 0] type 2 family 0 port 53511 - 0 [ 385.181708][T11476] netdevsim netdevsim0 eth3: unset [1, 1] type 2 family 0 port 49537 - 0 [ 385.190496][T11476] netdevsim netdevsim0 eth3: unset [1, 2] type 2 family 0 port 6081 - 0 [ 385.298870][T15550] __nla_validate_parse: 2 callbacks suppressed [ 385.298890][T15550] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2515'. [ 385.483289][T15570] netlink: 'syz.3.2517': attribute type 1 has an invalid length. [ 388.297283][T15570] bond8: entered promiscuous mode [ 388.307654][T15570] bond8: entered allmulticast mode [ 388.351856][T15585] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 388.588119][T15595] netlink: 56 bytes leftover after parsing attributes in process `syz.2.2523'. [ 388.686733][T15601] netlink: 5636 bytes leftover after parsing attributes in process `syz.3.2525'. [ 388.711749][T15591] netlink: 'syz.1.2521': attribute type 1 has an invalid length. [ 388.721884][T15591] netlink: 224 bytes leftover after parsing attributes in process `syz.1.2521'. [ 388.802854][T15604] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2522'. [ 389.164349][T15616] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2527'. [ 389.262134][T15616] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 389.317468][T15597] lo speed is unknown, defaulting to 1000 [ 389.356380][T15622] bridge0: port 1(erspan0) entered blocking state [ 389.380117][T15622] bridge0: port 1(erspan0) entered disabled state [ 389.397854][T15622] erspan0: entered allmulticast mode [ 389.407286][T15622] erspan0: entered promiscuous mode [ 389.415851][T15626] erspan0: left allmulticast mode [ 389.422414][T15626] erspan0: left promiscuous mode [ 389.430214][T15626] bridge0: port 1(erspan0) entered disabled state [ 390.193810][T15644] bond0: Caught tx_queue_len zero misconfig [ 390.599486][T15638] lo speed is unknown, defaulting to 1000 [ 390.629816][T15662] team_slave_1: Caught tx_queue_len zero misconfig [ 390.880720][T15669] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2541'. [ 390.890340][T15669] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2541'. [ 390.911990][T15669] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2541'. [ 391.214950][T15682] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2544'. [ 391.382003][T15684] gretap0: entered promiscuous mode [ 391.595395][T15656] netlink: 40 bytes leftover after parsing attributes in process `syz.2.2539'. [ 392.105589][T15702] netlink: 20 bytes leftover after parsing attributes in process `syz.0.2549'. [ 392.220648][T15721] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2554'. [ 392.504327][T15731] netlink: 'syz.4.2557': attribute type 13 has an invalid length. [ 392.542793][T15731] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2557'. [ 392.563447][T15733] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2558'. [ 392.579996][T15731] netlink: 'syz.4.2557': attribute type 13 has an invalid length. [ 392.593013][ T51] Bluetooth: hci4: command 0x0405 tx timeout [ 392.593432][T15731] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2557'. [ 392.897301][T15751] workqueue: Failed to create a rescuer kthread for wq "nfc3_nci_cmd_wq": -EINTR [ 393.387101][T15769] bond0: entered promiscuous mode [ 393.412834][T15776] pim6reg: entered allmulticast mode [ 393.548282][T15781] dvmrp8: entered allmulticast mode [ 393.649842][T15789] tipc: Enabling of bearer rejected, failed to enable media [ 393.933296][T15810] IPVS: ip_vs_add_dest(): lower threshold is higher than upper threshold [ 395.459458][T15847] lo speed is unknown, defaulting to 1000 [ 395.585062][T15879] netlink: 'syz.3.2595': attribute type 10 has an invalid length. [ 395.599520][T15879] ieee802154 phy0 wpan0: default qdisc (pfifo_fast) fail, fallback to noqueue [ 395.615205][T15879] bond0: (slave wpan0): Enslaving as an active interface with an up link [ 395.626015][ T8331] ================================================================== [ 395.634130][ T8331] BUG: KASAN: null-ptr-deref in mac802154_header_create+0x144/0x5f0 [ 395.642192][ T8331] Write of size 4 at addr 000000000000004c by task kworker/0:10/8331 [ 395.650375][ T8331] [ 395.652746][ T8331] CPU: 0 UID: 0 PID: 8331 Comm: kworker/0:10 Not tainted syzkaller #0 PREEMPT(full) [ 395.652788][ T8331] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 395.652803][ T8331] Workqueue: mld mld_ifc_work [ 395.652838][ T8331] Call Trace: [ 395.652846][ T8331] SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=-1 (errno 104: Connection reset by peer) [ 395.652855][ T8331] dump_stack_lvl+0x189/0x250 [ 395.652884][ T8331] ? __pfx_dump_stack_lvl+0x10/0x10 [ 395.652907][ T8331] ? _raw_spin_lock_irqsave+0xb3/0xf0 [ 395.652938][ T8331] ? __virt_addr_valid+0x7c/0x5c0 [ 395.652966][ T8331] ? mac802154_header_create+0x144/0x5f0 [ 395.652993][ T8331] kasan_report+0x118/0x150 [ 395.653023][ T8331] ? mac802154_header_create+0x144/0x5f0 [ 395.653055][ T8331] kasan_check_range+0x2b0/0x2c0 [ 395.653086][ T8331] mac802154_header_create+0x144/0x5f0 [ 395.653115][ T8331] ? __pfx_mac802154_header_create+0x10/0x10 [ 395.653145][ T8331] ? read_seqbegin+0x122/0x250 [ 395.653165][ T8331] ? neigh_connected_output+0x1ea/0x460 [ 395.653186][ T8331] ? lockdep_hardirqs_on+0x9c/0x150 [ 395.653215][ T8331] ? ___neigh_create+0x1c83/0x2260 [ 395.653234][ T8331] ? __pfx_mac802154_header_create+0x10/0x10 [ 395.653263][ T8331] neigh_connected_output+0x283/0x460 [ 395.653295][ T8331] ip6_finish_output2+0xfb3/0x1480 [ 395.653327][ T8331] ? __pfx_ip6_finish_output2+0x10/0x10 [ 395.653350][ T8331] ? ip6_mtu+0x7d/0x490 [ 395.653368][ T8331] ? ip6_mtu+0x38c/0x490 [ 395.653387][ T8331] ? ip6_finish_output+0x2ef/0x4e0 [ 395.653406][ T8331] ? ip6_output+0x126/0x550 [ 395.653425][ T8331] ip6_output+0x340/0x550 [ 395.653445][ T8331] NF_HOOK+0x9e/0x380 [ 395.653469][ T8331] ? __pfx_NF_HOOK+0x10/0x10 [ 395.653490][ T8331] ? __pfx_xfrm_lookup_with_ifid+0x10/0x10 [ 395.653508][ T8331] ? do_raw_spin_unlock+0x122/0x240 [ 395.653531][ T8331] ? icmp6_dst_alloc+0x3a5/0x420 [ 395.653552][ T8331] ? icmp6_dst_alloc+0x3a5/0x420 [ 395.653573][ T8331] mld_sendpack+0x8d4/0xe60 [ 395.653604][ T8331] ? mld_sendpack+0x1e7/0xe60 [ 395.653626][ T8331] ? __pfx_mld_sendpack+0x10/0x10 [ 395.653669][ T8331] mld_ifc_work+0x83e/0xd60 [ 395.653693][ T8331] ? process_scheduled_works+0x9ef/0x17b0 [ 395.653715][ T8331] process_scheduled_works+0xae1/0x17b0 [ 395.653749][ T8331] ? __pfx_process_scheduled_works+0x10/0x10 [ 395.653779][ T8331] worker_thread+0x8a0/0xda0 [ 395.653813][ T8331] kthread+0x70e/0x8a0 [ 395.653839][ T8331] ? __pfx_worker_thread+0x10/0x10 [ 395.653859][ T8331] ? __pfx_kthread+0x10/0x10 [ 395.653884][ T8331] ? _raw_spin_unlock_irq+0x23/0x50 [ 395.653903][ T8331] ? lockdep_hardirqs_on+0x9c/0x150 [ 395.653922][ T8331] ? __pfx_kthread+0x10/0x10 [ 395.653946][ T8331] ret_from_fork+0x439/0x7d0 [ 395.653968][ T8331] ? __pfx_ret_from_fork+0x10/0x10 [ 395.653991][ T8331] ? __switch_to_asm+0x39/0x70 [ 395.654017][ T8331] ? __switch_to_asm+0x33/0x70 [ 395.654043][ T8331] ? __pfx_kthread+0x10/0x10 [ 395.654067][ T8331] ret_from_fork_asm+0x1a/0x30 [ 395.654104][ T8331] [ 395.654111][ T8331] ================================================================== [ 395.944599][ T8331] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 395.951853][ T8331] CPU: 0 UID: 0 PID: 8331 Comm: kworker/0:10 Not tainted syzkaller #0 PREEMPT(full) [ 395.961331][ T8331] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 395.971501][ T8331] Workqueue: mld mld_ifc_work [ 395.976216][ T8331] Call Trace: [ 395.979507][ T8331] [ 395.982451][ T8331] dump_stack_lvl+0x99/0x250 [ 395.987054][ T8331] ? __asan_memcpy+0x40/0x70 [ 395.991654][ T8331] ? __pfx_dump_stack_lvl+0x10/0x10 [ 395.996865][ T8331] ? __pfx__printk+0x10/0x10 [ 396.001468][ T8331] vpanic+0x281/0x750 [ 396.005453][ T8331] ? preempt_schedule+0xae/0xc0 [ 396.010308][ T8331] ? __pfx_vpanic+0x10/0x10 [ 396.014901][ T8331] ? preempt_schedule_common+0x83/0xd0 [ 396.020418][ T8331] ? preempt_schedule+0xae/0xc0 [ 396.025270][ T8331] ? __pfx_preempt_schedule+0x10/0x10 [ 396.030648][ T8331] panic+0xb9/0xc0 [ 396.034380][ T8331] ? __pfx_panic+0x10/0x10 [ 396.038801][ T8331] ? _raw_spin_unlock_irqrestore+0xfd/0x110 [ 396.044700][ T8331] ? mac802154_header_create+0x144/0x5f0 [ 396.050342][ T8331] check_panic_on_warn+0x89/0xb0 [ 396.055297][ T8331] ? mac802154_header_create+0x144/0x5f0 [ 396.060936][ T8331] end_report+0x78/0x160 [ 396.065190][ T8331] kasan_report+0x129/0x150 [ 396.069704][ T8331] ? mac802154_header_create+0x144/0x5f0 [ 396.075349][ T8331] kasan_check_range+0x2b0/0x2c0 [ 396.080312][ T8331] mac802154_header_create+0x144/0x5f0 [ 396.085793][ T8331] ? __pfx_mac802154_header_create+0x10/0x10 [ 396.091786][ T8331] ? read_seqbegin+0x122/0x250 [ 396.096589][ T8331] ? neigh_connected_output+0x1ea/0x460 [ 396.102154][ T8331] ? lockdep_hardirqs_on+0x9c/0x150 [ 396.107382][ T8331] ? ___neigh_create+0x1c83/0x2260 [ 396.112495][ T8331] ? __pfx_mac802154_header_create+0x10/0x10 [ 396.118484][ T8331] neigh_connected_output+0x283/0x460 [ 396.123871][ T8331] ip6_finish_output2+0xfb3/0x1480 [ 396.128994][ T8331] ? __pfx_ip6_finish_output2+0x10/0x10 [ 396.134545][ T8331] ? ip6_mtu+0x7d/0x490 [ 396.138708][ T8331] ? ip6_mtu+0x38c/0x490 [ 396.142958][ T8331] ? ip6_finish_output+0x2ef/0x4e0 [ 396.148160][ T8331] ? ip6_output+0x126/0x550 [ 396.152665][ T8331] ip6_output+0x340/0x550 [ 396.157005][ T8331] NF_HOOK+0x9e/0x380 [ 396.161012][ T8331] ? __pfx_NF_HOOK+0x10/0x10 [ 396.165605][ T8331] ? __pfx_xfrm_lookup_with_ifid+0x10/0x10 [ 396.171420][ T8331] ? do_raw_spin_unlock+0x122/0x240 [ 396.176718][ T8331] ? icmp6_dst_alloc+0x3a5/0x420 [ 396.181665][ T8331] ? icmp6_dst_alloc+0x3a5/0x420 [ 396.186613][ T8331] mld_sendpack+0x8d4/0xe60 [ 396.191138][ T8331] ? mld_sendpack+0x1e7/0xe60 [ 396.195834][ T8331] ? __pfx_mld_sendpack+0x10/0x10 [ 396.200881][ T8331] mld_ifc_work+0x83e/0xd60 [ 396.205402][ T8331] ? process_scheduled_works+0x9ef/0x17b0 [ 396.211127][ T8331] process_scheduled_works+0xae1/0x17b0 [ 396.216774][ T8331] ? __pfx_process_scheduled_works+0x10/0x10 [ 396.222850][ T8331] worker_thread+0x8a0/0xda0 [ 396.227462][ T8331] kthread+0x70e/0x8a0 [ 396.231543][ T8331] ? __pfx_worker_thread+0x10/0x10 [ 396.236657][ T8331] ? __pfx_kthread+0x10/0x10 [ 396.241262][ T8331] ? _raw_spin_unlock_irq+0x23/0x50 [ 396.246473][ T8331] ? lockdep_hardirqs_on+0x9c/0x150 [ 396.251700][ T8331] ? __pfx_kthread+0x10/0x10 [ 396.256297][ T8331] ret_from_fork+0x439/0x7d0 [ 396.260906][ T8331] ? __pfx_ret_from_fork+0x10/0x10 [ 396.266039][ T8331] ? __switch_to_asm+0x39/0x70 [ 396.271002][ T8331] ? __switch_to_asm+0x33/0x70 [ 396.275784][ T8331] ? __pfx_kthread+0x10/0x10 [ 396.280400][ T8331] ret_from_fork_asm+0x1a/0x30 [ 396.285187][ T8331] [ 396.288387][ T8331] Kernel Offset: disabled [ 396.292714][ T8331] Rebooting in 86400 seconds..