last executing test programs: 12.542484466s ago: executing program 2 (id=2111): sendmsg$IPCTNL_MSG_EXP_GET_STATS_CPU(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x14, 0x3, 0x2, 0x5, 0x0, 0x0, {0x0, 0x0, 0x3}, [""]}, 0x14}}, 0x10) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_RENAME(r0, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x1c, 0x5, 0x6, 0x600, 0x0, 0x0, {0x0, 0x0, 0x7}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4e3dda24dc15c422}, 0x4) readv(r0, &(0x7f0000000440)=[{&(0x7f0000000200)=""/59, 0x3b}, {&(0x7f0000000240)=""/155, 0x9b}, {&(0x7f0000000300)=""/186, 0xba}, {&(0x7f00000003c0)=""/78, 0x4e}], 0x4) readv(r0, &(0x7f0000001740)=[{&(0x7f0000000480)=""/229, 0xe5}, {&(0x7f0000000580)=""/206, 0xce}, {&(0x7f0000000680)=""/4096, 0x1000}, {&(0x7f0000001680)=""/68, 0x44}, {&(0x7f0000001700)=""/51, 0x33}], 0x5) r1 = socket$l2tp6(0xa, 0x2, 0x73) bind$inet6(r1, &(0x7f00000017c0)={0xa, 0x4e21, 0x415d, @empty, 0x6}, 0x1c) writev(r1, &(0x7f00000029c0)=[{&(0x7f0000001800)="4546ffb214c27cc8473f3a54ad70bad83fe30b1cf8043368c2170e99bbff13fc38ca2a30b327664f25c95c2e049f3006690e1d565e5208699758e7d49b83d21a203e85a2535f3eb77f6ea5f70eb06b804d2d221ed2ab8238d0438136b5e646a2630ea8d0022031b6", 0x68}, {&(0x7f0000001880)="8b9d2e73a341446730852851fd0dd2378dd8859889fa5751412808", 0x1b}, {&(0x7f00000018c0)="c564b9fc0d37966d0545a4fcdd5f7b500401f7942456ba2d14458990430c965a3f6752f442b8023bc4f448f7739732cc4fc0e2fa4d7774ede52aefd4cd9599760d29b9ad8ef6cab5d9da8a8465a2ed2127d069a0cbe4dc48e2259f350a1b5c4fc326468d979ed26b561e6fd1503b6aefd2a6532e8e56c72a70a58ec925aca36b501da4b28a9b2b502e80fe8b37fccb71b7acc2c84098113aa51836a2c38a90323a7cf051230fc6dc2c05b23e02b6e60f4ef496107c571cd40e215a17ebf918c32a993074c3a70c001b2cdc", 0xcb}, {&(0x7f00000019c0)="cab915adb178ef0d0b79f8520f021166ee21238c776646afddea832a87ba7f4f221a6976ab6cec071fa5f98225f4cfe45080060614bd03f005398b5f476b88fc498c61bb61771ccafe217bfb5fb03756e6821114008902d607d696a7f2defc705b5fa28883ab2d3bd0fb29be70f108651eddf9f14172b5a31042e3030a725a588fdcbffd0cc8575852e6478db666027eaf8bf88ea0eeefec17ac85220095789c2b28d77db8472d3332bc2f7bd846110585616d2d4b08f1116bda3f9de10c31c02d4625518df2b7b09d0fd751f1f1741d53a23fed8b285991dc49add8dfbbdd5025f71614d75ee6fc6b833058e4669ecc7310e68baa93ed4cc184a2890877722a9f6cb838a27e662cec5200cd409ec7a76109f36a5b2133c84def84154a14367928062fbd48767942e7a715b3deae21cf74ec77977b4b9cf2702ec34fe178fc387ba967dba197901d1044bf2eb2a6a93f7bb83259c911e39d172b4399ce0b3370262a0448cae7cfa539167e67aa1310b2ff877b2e26b11fd17d1462594499430673f11587cac60b3f9d6794252c13105724544178fa19ffedc5582cec8a93c67ecfb48cf022c545aa1a2cf10fb343a10ef76b8f2971faff306ff6b178724cde43d2d4215027987f65ff50052e72aea1cb373a70dffe1ce9816676ea62d65793613e7b73a98e570d35d9bf6e4c0ee9d7399fe81e5ca16ffcb967c1a19f2a35a209bb46b739b939eab576322931532e231696f0895dea2c19927c1bd3ff59789a931918b6b6329bba4403f207bbb70d9ec7ac63831f0e6c85401f14adc7f2e06507dfc3e10da7f8a3b9c77f4f1d67cc7215fca543984f653f9c1e2b709b7991c173f99165e3d1b91fef16107d539bdf7122914ab67bae1096ac8fbc4005212a6233cd68fe279a12b93e767697884e137d938679f72944ceb7107929c7db90b40f59e48610a2f016e4fd0f41538b9cc2eaad00e1c98c79259b4d80b1d3e4eeafb3fc6e9af412d59f36d02b99b522697bb2fc21ccc663c2dd3b90a7e35410a0cd0731a8f6387ca755743b68ad04a0c9d8d643ec370913977d4425e25fe26ee1868603627666d6a4cfa32f76973c7ae63b3a276b29730242ab4b5590b6d00b3d85ef505cbb41164fa1ddb7a2546dc5f0cd95ee35580642df8c2d968eb0cbe776955dc4bec2775b7ef568f1c44f6c912e91acd917c54f8ba09544653d69085794d9f71281b5dde516b6912cef1ff9b1394038227decfbc10504816cde9b26c868d1599a28c107fff228537d54a5701fb442f9d71f440079723705296c39c678004b4cf93dee5499c1d5ecc7543858798239f48b1116dfdab4d4b3fb2952da2297d03210d7052a937449cad563ff187ef8fe61b384e9c81bc4f470b3e58ef3f9bbad8125ed36539129ce1cd9f83c088023b0242b86e96f3395a6433a94949a8e348f56a5f779282cd8dd285f51d46e95b282957d6ef1a0d8d0a4001226280fafc6c47f0dfb8c799b9bc1104aa595e442b9df50278bcc9a40323923432d8cb6431c842ed469a801949aedc20756fcfcd9d14ecffdaddc1f19ca7bafd0b266ee96c6d09a671fcfff09c58b4abb97679b5c86b8f08d020a12c81230480d48c21f5229d4d3513b33a32e5dbf49855fe656ddd6079905fdace1166b78697292016c62ff1949d99b0052a77216f0cca8bb562d457360489f8086a3fe00720af3c5d3d10a44aded1c77fab193d4c3ca0ca7a6760108f2c45b8e81d8a40af65a92a4053aa85b312e1b8210632e7d33e72a7c16410c3940089ee560985fe1de9502bf189834330a08b1968c5f4979a4527be82036511e3c5787c006a151742aa91025b95c45667f03176304757707742cabdb4a792b79c1a0d9c2f03b78d752b82df9a5850fc110f91dc4484195a7758bf1322d7f1cf2c81b0c73bc9911de12a466386bde605751317313b2c3e96daa2668efe0d5d201f7059192d241b410e0da716772d8e176094c484420626aefe7ea61b5871020bfc209aa417682ba8a56d7352acecd7234cc57c874075f0bd4692dc2ff939bf3acf2619eea8cf33db67b2e36b113eb073c85e1fe7d659d59902c612aec760d1143662ada1838ffb51541a266326f0f485aa21b86628d7301f7884aff02c3b97da13350731cfc839a33a7a021f0f5178c58327ef6f37f216d4ca833ce5a399bd228bf1b1e91704133fd75cda5560ab706832f135db1547aeb1b4a8da929a3b15aa71903eddf7fc86ae8ba59ba9ed40527ad9eafd72c541a0a94b04af5357ac93533ed96e28cf7dee8d8e209208bc1610f7398c095349f95763a3d6479d5ce1e61f5d5bf2214eb8367e980d04e789fa79a510ef3920a2d6e03c55a867056aa2cb7329d9419e384539b8d33157718f9a4954e932bb1acd510707c92acd432039f1b42317933e88dd1dabba41c93b195596b8e1411319df3517e88711395d10e9aa4f8c987eb104577cea29d7424493fa0e1e595a25e7d4695bfff9aa089bc104616e160a0c76879f8eb6b6a1a4c6b65c3d3c77ace51c6c46e998bff505c781e3b8beda1d2fe7d977d21e0579bf9a22c43df8016dc9318420415f7c882744bcd0cc0f9488aa2de8af884e275dc32ae634c0d8cd63586fd42ad469ed0e5d6d1e0e13f67b53d9537c5b4fbe82ab30a0dceaefd3f3b9e2d6fec40578c2a5ef140c212804bca1f819bd6f109a0e44e8932311484e0f9ed23278a638adc152bab98f2ca205bf2e8b68246a545557e888015dbb9edc82bba5861251afb10182448a49815965d6a9f9f6d45e7ef8321f8e5401064f76c73a58ce6ac773f85e10c0b7486675b6293a5a303dfa8615e62e27b08aaf010ad4412cc0c73af67b68dff29ab5a5f5fa4ee3fe4d400002016d7d0ca578a837ae2382914cec785cd55982c19df06586fc52919b9ddb9012515b936026f63267710ce9f4f631af10d4d4281886faf3e8746aaf0f4cb18f81a57992eb4e45b16666314ceed2f528cf00c2c75dff568e1ed40dd4a518380dde0ee3ef1d6cce96c3972e5ab3014583300a31cf80e43a8a1d7bc5b5a309eb0203ecc5ad0b5fbf8c996b05f28d0d516c10c542e8d782de48cbb9ee3e6cca3f0f44c4536d0c9809e1977be0ac9140a9d503af6a073bdfadf10ecda5f0e47503f0df3de1938b00906a7892e1dffd43f03bc222de79acdb35e7159cc2c96b978691460bf562f84aa1b20b96a5626afd171e26dbce5d23825346223ad425df650600e3d9acc0418234fefaef2d0a0ecbae5717db2c3ab02cef7a5c5ac5c6c12a2a0a24071712cddaf3972e683d75ab7ad2e378996284f08110a081e4198bab095dbe893abc266cbc71091231ce8096e3b61d8f7b5f723ebc52a71f7c703db3667283ef75b2778e044b93ba8680e2e1015f21a68e03f9a69f407745adb44e428c7917a13573e169b3b878721ee98ee7372a2c618074fce1b8207b9c2de3b01075bce9ba48230603bdb79f11892d36ae40f5036931c2a0da1a961dd812dfb9f01d9be983965a9aa808ca9dc5028798c7d3491979a1e3c0a79731c87f3544d9e9baa300c5d067b71cdffc7e25153b950bd43dbf4f076ea02c877753b7cab520ca9f576b737eb4465e814de222a4e689bbf1b6b5b1f55bf14a9b038e64c19926f0d31a2d4f49eaba8ec1332ee123851e952be19e028227e7ca0641794d57a297a5e96559096ec79a458b2011ab5635364c72344439f20abec1225276f36115ccdde6f3b82eece85c27a7548a55430f118aafeecf5938f874058e79d2800d182c70bca17172f2217410acd1b7f84297b934843b89fc755d8c7864a790ecdccde8dba8c6abc1db23503b276986e1cd6ad29315ae7bea8d0f70f56a4bd6731f6dd25ed64ed3125d20d00d98a169b4f66d82cb4590dbe3b565eb8ed282d8198ac82a92a2e55cf64f4eef106723cb237537c1e74b26c3c618b94f39fb18b8381353a86f3ad3827392746b4826690edfa877467164645b1add75f0260c724cbfd895dafebff285e39388e701daf58c1146a1866ae10eec401db38795b4a848cbb3ecf0b61bcd37a9f7e510327bb85d0fe2ba1d84cd079c34d7cbeb2c98d1424c8f8c14ab5273282de6b25c30f6114d56106b14987c3e0b834b17a8890711b0d51b19d03ba4ba12c6705bb65f0915a83acd72b3a753a01a1ae58721f5315d53ac01ce32c28232c4c4b8abba48e96dc9c2bb6d54dc81c64627215d521c8dde8903620b2e4905a98de19cf49d8540fdf65d04024ed3bdf7e5611646c77f5e1ff7177944b01f346d320157a6cf9f375b04f6f319bf61ccdf46dd6b3c209730e2bfe9172558379424d10bf91ecd0cf19a3a41654a01e9643e4cb436434e85ee344111af6277641d5de7f165782df8e09a375f47616dae47c96c27c764308e339364c156209b411de1d4bcb7d4d0578222dd6e0758f8c4f3cb0c3f08a801a7a9df7017b51374acec387b0af91e1a7c6a8af3f7330938165208351d79e7fce74484861eef475bf7a2a98d456df59669bc3602d46a29af0c2d42bca4fe6825cca07262ffed6528ad1cbcb988d27fccad1542f8b9e1481ab4f6d67cb6df776cdc9b50512ae8883b4bc049e5330f7d74f9610823dc128385de37c4f2c6da110a2c0f138e036530830b752f6ae7828a677451160839af2289345ace69b75ee41f2446c837d1b4ebf55828689121f0cb675800c7d47d53f9c86dd6101f5e1b7a143748c81d49af37a8d8384740a9e51650e73757e9478f322dbcf4e931ad5750f7008bc8b3c2177204009394cfab76a674a7a1fec6e9f92817e667d1b7fd75f71ecb604a6ae0c1afc823a8764eaeb363f03810a8af288f0b84e91147435880e94416eeb73adc9d0e07f808d7ebd8a660e9d7dcd0a5ccc075b23d069ee99af8f59b5b11f501c6c15aefbad954eca48a1e9aa174fd7255a9fae9f5a4a8e18144cdac557e679f8845f5e36d382ef453692bb852fde8b671860d10b779cbdd305ab7f67c1b21ed3ee5f2cf3a885a9b732290700331a75e5b8628d7d6bb9f3a506eb47f98c1a4b21a07e1f50b771f931253192d0882109af33f19c8872e7e8fc27f42d7f52699db36788232ce0763f1bc42b8ff55353f25114bfe0b56d02da866f0ac95bf072e6f528c3f41621a36ea995416e03e5b80cfb6ebc6d3c0dfda623ad7973db58a51e7de1f515fbc1b48edb10c32f410559a9bc03ac3993c61f53a84f1f1f9de6c51ba4e9b066f92370938b8c0bee224b12616824dfabc5fb1650fa34cd6ff1d7b41920bfd6bc6c02eeb4ba17fc94d1d8def63092fca2fd385d593e55c9bb64470f50537692ea7d62e2fb3da9f6f3a16d0726ec2917e0c35757d3c7e3b6602fce773f7a5b8e204c35107014b35f121b2b22e06476884feec7d34ff89db485d108594973bb0bed5e48365281cc02b6194ebca6ea3622296fbe1e3c66289cff5b868d33b737b7a5588c113a19f3fe44c490d5a75edba0e507a830a3adbdd5cd4fe78b3429a51cf0980864b052af16820e6c50f580e850563ac3073fe497d633b270693628492e12efc39710c62f64eff4e7d6edf4bc7d7bf35cc2a96f92b207a4ce862e44af7d3abc173b29f1fab42e9213655a93980b8b3647b78a68009c7bf7dfd74f83df4420b4fe471107649b18e911c322b9b2405423ea1d6d8b1a88e94bd67e8d024b8f7fdc849c48457594cc3c6fd202d9432ee07b91d717834c3d38628de1b4efbc0a976151d5145d2ef253defcd8d40b81b7b2f0b524a920a30c14c33a7b3f4d7a2484fc84159e9899875e9d20df7ea4136aaa47", 0x1000}], 0x4) r2 = socket$l2tp(0x2, 0x2, 0x73) readv(r2, &(0x7f0000003c40)=[{&(0x7f0000002a00)=""/253, 0xfd}, {&(0x7f0000002b00)=""/4096, 0x1000}, {&(0x7f0000003b00)=""/227, 0xe3}, {&(0x7f0000003c00)=""/57, 0x39}], 0x4) socketpair(0x11, 0x2, 0x8, &(0x7f0000003c80)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_qrtr_TIOCINQ(r3, 0x541b, &(0x7f0000003cc0)) r5 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) writev(r5, &(0x7f0000003d40)=[{&(0x7f0000003d00)="b63ef60f0f29b87296", 0x9}], 0x1) socket$igmp6(0xa, 0x3, 0x2) socket$inet6_sctp(0xa, 0x5, 0x84) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r6, &(0x7f0000003e40)={&(0x7f0000003d80)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000003e00)={&(0x7f0000003dc0)={0x14, 0x30, 0x7, 0x70bd26, 0x25dfdbfd, {0x15}}, 0x14}, 0x1, 0x0, 0x0, 0x800}, 0x20008080) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r4, 0x89f0, &(0x7f0000003fc0)={'gre0\x00', &(0x7f0000003ec0)={'sit0\x00', 0x0, 0x1, 0x0, 0x4, 0x4, {{0x30, 0x4, 0x3, 0x0, 0xc0, 0x64, 0x0, 0x2, 0x2f, 0x0, @multicast1, @local, {[@generic={0x88, 0x5, "105ecb"}, @timestamp_prespec={0x44, 0x44, 0xd, 0x3, 0xf, [{@multicast2, 0x4}, {@empty, 0xc}, {@private=0xa010100, 0x57e6}, {@initdev={0xac, 0x1e, 0x0, 0x0}, 0xb}, {@multicast1, 0xfffffffe}, {@multicast1, 0x80}, {@remote, 0x3}, {@local, 0x10}]}, @rr={0x7, 0x23, 0x1d, [@broadcast, @empty, @multicast2, @loopback, @multicast1, @loopback, @multicast2, @dev={0xac, 0x14, 0x14, 0x2b}]}, @lsrr={0x83, 0x1b, 0x28, [@loopback, @loopback, @broadcast, @multicast2, @broadcast, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @lsrr={0x83, 0x1b, 0x56, [@initdev={0xac, 0x1e, 0x1, 0x0}, @initdev={0xac, 0x1e, 0x1, 0x0}, @initdev={0xac, 0x1e, 0x0, 0x0}, @rand_addr=0x64010102, @remote, @loopback]}, @ssrr={0x89, 0x7, 0xd0, [@multicast2]}]}}}}}) sendmsg$ETHTOOL_MSG_DEBUG_SET(r4, &(0x7f00000040c0)={&(0x7f0000003e80)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000004080)={&(0x7f0000004000)={0x54, 0x0, 0x4, 0x70bd28, 0x25dfdbff, {}, [@ETHTOOL_A_DEBUG_MSGMASK={0xc, 0x2, 0x0, 0x1, [@ETHTOOL_A_BITSET_SIZE={0x8, 0x2, 0xa512}]}, @ETHTOOL_A_DEBUG_HEADER={0x34, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_vlan\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'wlan1\x00'}]}]}, 0x54}, 0x1, 0x0, 0x0, 0x8040}, 0x8000) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_GET(r8, &(0x7f00000042c0)={&(0x7f0000004100)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000004280)={&(0x7f0000004140)={0x114, 0x1, 0x2, 0x201, 0x0, 0x0, {0x3, 0x0, 0x7}, [@CTA_EXPECT_TUPLE={0x84, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @private0={0xfc, 0x0, '\x00', 0x1}}, {0x14, 0x4, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x3}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x3a}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x1}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x2}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x95}}, @CTA_TUPLE_ZONE={0x6}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x88}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x6}}]}, @CTA_EXPECT_TUPLE={0xc, 0x2, 0x0, 0x1, [@CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x2}]}, @CTA_EXPECT_ID={0x8}, @CTA_EXPECT_FN={0xa, 0xb, 'Q.931\x00'}, @CTA_EXPECT_MASTER={0x54, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @local}, {0x8, 0x2, @dev={0xac, 0x14, 0x14, 0x3f}}}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x6}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x21}}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @empty}, {0x8, 0x2, @dev={0xac, 0x14, 0x14, 0x1c}}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x21}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x3}]}, @CTA_EXPECT_TIMEOUT={0x8, 0x4, 0x1, 0x0, 0xf}]}, 0x114}, 0x1, 0x0, 0x0, 0x80}, 0x801) r9 = syz_genetlink_get_family_id$nl80211(&(0x7f0000004340), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000004380)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_REGISTER_BEACONS(r4, &(0x7f0000004440)={&(0x7f0000004300)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000004400)={&(0x7f00000043c0)={0x28, r9, 0x100, 0x70bd26, 0x25dfdbfd, {{}, {@void, @val={0x8, 0x3, r10}, @val={0xc, 0x99, {0x9, 0x6a}}}}, [""]}, 0x28}}, 0x41) listen(r2, 0x7) ioctl$sock_SIOCGIFVLAN_GET_VLAN_EGRESS_PRIORITY_CMD(r3, 0x8982, &(0x7f0000004480)) r11 = syz_genetlink_get_family_id$nl80211(&(0x7f0000004500), r3) sendmsg$NL80211_CMD_PEER_MEASUREMENT_START(r6, &(0x7f0000005200)={&(0x7f00000044c0)={0x10, 0x0, 0x0, 0x802}, 0xc, &(0x7f00000051c0)={&(0x7f0000004540)={0xc48, r11, 0x100, 0x70bd2b, 0x25dfdbfd, {{}, {@void, @val={0xc, 0x99, {0x100, 0x75}}}}, [@NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_PEER_MEASUREMENTS={0xc1c, 0x111, 0x0, 0x1, {0xc18, 0x5, 0x0, 0x1, [{0x10, 0x0, 0x0, 0x1, [@NL80211_PMSR_PEER_ATTR_ADDR={0xa}]}, {0x688, 0x0, 0x0, 0x1, [@NL80211_PMSR_PEER_ATTR_CHAN={0x1c, 0x2, 0x0, 0x1, [@NL80211_ATTR_WIPHY_FREQ={0x8}, @NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0x1}, @NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0x9c91}]}, @NL80211_PMSR_PEER_ATTR_ADDR={0xa, 0x1, @device_b}, @NL80211_PMSR_PEER_ATTR_CHAN={0x44, 0x2, 0x0, 0x1, [@NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0x3ff}, @NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x28}, @NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x5}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8}, @NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0x8}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x2}, @NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0x6}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x1}]}, @NL80211_PMSR_PEER_ATTR_REQ={0x2f4, 0x3, 0x0, 0x1, [@NL80211_PMSR_REQ_ATTR_DATA={0x60, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0x30, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0xe}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0x4}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x1f}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x2c, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x2}, @NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0xb}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x3}, @NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}]}]}, @NL80211_PMSR_REQ_ATTR_GET_AP_TSF={0x4}, @NL80211_PMSR_REQ_ATTR_DATA={0x8c, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0x24, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x7fd}]}, @NL80211_PMSR_TYPE_FTM={0x14, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0xb}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x14, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x3c, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x1}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x3}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0x7}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x8001}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0xe}, @NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK={0x4}]}]}, @NL80211_PMSR_REQ_ATTR_DATA={0xb0, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0x20, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x1c}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x7}]}, @NL80211_PMSR_TYPE_FTM={0x1c, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0x3}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0x8}]}, @NL80211_PMSR_TYPE_FTM={0x28, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0xb}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0xfff}, @NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x8, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}]}, @NL80211_PMSR_TYPE_FTM={0xc, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x3}]}, @NL80211_PMSR_TYPE_FTM={0xc, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x1c, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0x2}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0x7}]}, @NL80211_PMSR_TYPE_FTM={0xc, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}]}]}, @NL80211_PMSR_REQ_ATTR_DATA={0x110, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0x10, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0x81}, @NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x2c, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0xfe}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x1a}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x28, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0xf484}, @NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0xbcba}, @NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x48, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0x2}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0xa}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x18}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0xc}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x52}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x2}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x9}]}, @NL80211_PMSR_TYPE_FTM={0x14, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0xf}, @NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x38, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x1}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0xb}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0xa}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x15}, @NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x9}]}, @NL80211_PMSR_TYPE_FTM={0x14, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x9}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x1}]}]}, @NL80211_PMSR_REQ_ATTR_DATA={0x40, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0xc, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x14, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0xffff}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x1c, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x3}]}]}]}, @NL80211_PMSR_PEER_ATTR_ADDR={0xa, 0x1, @device_b}, @NL80211_PMSR_PEER_ATTR_ADDR={0xa, 0x1, @device_b}, @NL80211_PMSR_PEER_ATTR_ADDR={0xa}, @NL80211_PMSR_PEER_ATTR_CHAN={0x2c, 0x2, 0x0, 0x1, [@NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x1}, @NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x19}, @NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x6}, @NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0x10}, @NL80211_ATTR_CHANNEL_WIDTH={0x8}]}, @NL80211_PMSR_PEER_ATTR_REQ={0x100, 0x3, 0x0, 0x1, [@NL80211_PMSR_REQ_ATTR_GET_AP_TSF={0x4}, @NL80211_PMSR_REQ_ATTR_DATA={0xa8, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0x44, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0xe8}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x58a}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0xa}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x3}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0xa}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x7913}]}, @NL80211_PMSR_TYPE_FTM={0x38, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0xf}, @NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x5}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0x8}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0x8}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x8}]}, @NL80211_PMSR_TYPE_FTM={0x14, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0xc}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8}]}, @NL80211_PMSR_TYPE_FTM={0x14, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0x5}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}]}]}, @NL80211_PMSR_REQ_ATTR_GET_AP_TSF={0x4}, @NL80211_PMSR_REQ_ATTR_DATA={0x4c, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0x2c, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x1ff}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x8}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x1c, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0x9}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}]}]}]}, @NL80211_PMSR_PEER_ATTR_REQ={0x1d4, 0x3, 0x0, 0x1, [@NL80211_PMSR_REQ_ATTR_DATA={0x1c, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0x18, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x7}]}]}, @NL80211_PMSR_REQ_ATTR_DATA={0x24, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0x20, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x5}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x9}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}]}]}, @NL80211_PMSR_REQ_ATTR_GET_AP_TSF={0x4}, @NL80211_PMSR_REQ_ATTR_DATA={0xec, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0x1c, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x1b}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x3}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0xe}]}, @NL80211_PMSR_TYPE_FTM={0x10, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0xc}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x8, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x2c, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x19}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0x4}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x8}]}, @NL80211_PMSR_TYPE_FTM={0x1c, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x8}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x19}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x3}]}, @NL80211_PMSR_TYPE_FTM={0xc, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x8}]}, @NL80211_PMSR_TYPE_FTM={0x1c, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x555}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x7d}]}, @NL80211_PMSR_TYPE_FTM={0x20, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0xd}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x1b}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0x4}]}, @NL80211_PMSR_TYPE_FTM={0x24, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x1b}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0x9}, @NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}]}]}, @NL80211_PMSR_REQ_ATTR_DATA={0x94, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0x24, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x1}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0xfc}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x3}]}, @NL80211_PMSR_TYPE_FTM={0x20, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x9}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x18}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x2c, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x7}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0x3}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x20, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0x1}]}]}, @NL80211_PMSR_REQ_ATTR_GET_AP_TSF={0x4}, @NL80211_PMSR_REQ_ATTR_GET_AP_TSF={0x4}, @NL80211_PMSR_REQ_ATTR_GET_AP_TSF={0x4}]}]}, {0x290, 0x0, 0x0, 0x1, [@NL80211_PMSR_PEER_ATTR_REQ={0x184, 0x3, 0x0, 0x1, [@NL80211_PMSR_REQ_ATTR_DATA={0xb4, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0x8, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}]}, @NL80211_PMSR_TYPE_FTM={0xc, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x9}]}, @NL80211_PMSR_TYPE_FTM={0x1c, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0x8}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x20, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x3}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x3}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x7}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x8, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}]}, @NL80211_PMSR_TYPE_FTM={0xc, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x401}]}, @NL80211_PMSR_TYPE_FTM={0x1c, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0xb7}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x81}, @NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x4}, @NL80211_PMSR_TYPE_FTM={0x2c, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0xa}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x20}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0x3}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}]}]}, @NL80211_PMSR_REQ_ATTR_DATA={0x18, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0x14, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0xf}]}]}, @NL80211_PMSR_REQ_ATTR_DATA={0xb4, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0x14, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0x5}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x14}]}, @NL80211_PMSR_TYPE_FTM={0x28, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0x3}, @NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x1}]}, @NL80211_PMSR_TYPE_FTM={0x10, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}]}, @NL80211_PMSR_TYPE_FTM={0xc, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x38, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x2}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0xe}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x8}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0xd}]}, @NL80211_PMSR_TYPE_FTM={0x20, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0x6}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}]}]}]}, @NL80211_PMSR_PEER_ATTR_REQ={0x108, 0x3, 0x0, 0x1, [@NL80211_PMSR_REQ_ATTR_GET_AP_TSF={0x4}, @NL80211_PMSR_REQ_ATTR_DATA={0x5c, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0x8, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x30, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0x8}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x6}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0xf}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x8, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x18, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0x6}, @NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK={0x4}]}]}, @NL80211_PMSR_REQ_ATTR_GET_AP_TSF={0x4}, @NL80211_PMSR_REQ_ATTR_GET_AP_TSF={0x4}, @NL80211_PMSR_REQ_ATTR_DATA={0x84, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0x44, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x1d}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x1}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0x3}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x2}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x3}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0xb}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0xe}]}, @NL80211_PMSR_TYPE_FTM={0x28, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x40}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x81}]}, @NL80211_PMSR_TYPE_FTM={0x14, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0x4}]}]}, @NL80211_PMSR_REQ_ATTR_DATA={0x14, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0x10, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0xb}]}]}, @NL80211_PMSR_REQ_ATTR_GET_AP_TSF={0x4}]}]}, {0x180, 0x0, 0x0, 0x1, [@NL80211_PMSR_PEER_ATTR_CHAN={0x34, 0x2, 0x0, 0x1, [@NL80211_ATTR_WIPHY_FREQ_OFFSET={0x8, 0x122, 0xb2}, @NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0xb}, @NL80211_ATTR_WIPHY_EDMG_BW_CONFIG={0x5, 0x119, 0xf}, @NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0x4}, @NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x11}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x2}]}, @NL80211_PMSR_PEER_ATTR_REQ={0x148, 0x3, 0x0, 0x1, [@NL80211_PMSR_REQ_ATTR_GET_AP_TSF={0x4}, @NL80211_PMSR_REQ_ATTR_DATA={0x94, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0x28, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x3}, @NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}]}, @NL80211_PMSR_TYPE_FTM={0xc, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x1e}]}, @NL80211_PMSR_TYPE_FTM={0x20, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0xff}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0x5}, @NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x10, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x8}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x10, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x1c, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0x2}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x5}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}]}]}, @NL80211_PMSR_REQ_ATTR_DATA={0x18, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0x14, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x2}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK={0x4}]}]}, @NL80211_PMSR_REQ_ATTR_DATA={0x1c, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0x8, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x10, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0xc}]}]}, @NL80211_PMSR_REQ_ATTR_GET_AP_TSF={0x4}, @NL80211_PMSR_REQ_ATTR_DATA={0x74, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0x1c, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x8, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x14, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x1}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0xb}]}, @NL80211_PMSR_TYPE_FTM={0x10, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0x2}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x1c, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x8, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x4}]}]}]}, {0x60, 0x0, 0x0, 0x1, [@NL80211_PMSR_PEER_ATTR_CHAN={0x24, 0x2, 0x0, 0x1, [@NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x11}, @NL80211_ATTR_CENTER_FREQ1={0x8}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x1}, @NL80211_ATTR_WIPHY_FREQ_OFFSET={0x8, 0x122, 0x260}]}, @NL80211_PMSR_PEER_ATTR_ADDR={0xa, 0x1, @broadcast}, @NL80211_PMSR_PEER_ATTR_CHAN={0x2c, 0x2, 0x0, 0x1, [@NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8}, @NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0xfffffffc}, @NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0x2}, @NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0xfffff800}, @NL80211_ATTR_WIPHY_FREQ={0x8}]}]}, {0x10c, 0x0, 0x0, 0x1, [@NL80211_PMSR_PEER_ATTR_ADDR={0xa}, @NL80211_PMSR_PEER_ATTR_ADDR={0xa}, @NL80211_PMSR_PEER_ATTR_ADDR={0xa}, @NL80211_PMSR_PEER_ATTR_REQ={0xe4, 0x3, 0x0, 0x1, [@NL80211_PMSR_REQ_ATTR_DATA={0x14, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0x10, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK={0x4}]}]}, @NL80211_PMSR_REQ_ATTR_DATA={0x50, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0xc, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x28, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0xa}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x18, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0xd}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}]}]}, @NL80211_PMSR_REQ_ATTR_DATA={0x1c, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0x18, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0xb}]}]}, @NL80211_PMSR_REQ_ATTR_GET_AP_TSF={0x4}, @NL80211_PMSR_REQ_ATTR_GET_AP_TSF={0x4}, @NL80211_PMSR_REQ_ATTR_DATA={0x58, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0x38, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x13}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0x3}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x2}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x7}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x8}]}, @NL80211_PMSR_TYPE_FTM={0x1c, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0x7}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}]}]}]}]}]}}]}, 0xc48}, 0x1, 0x0, 0x0, 0x50}, 0x8000) sendmsg$MPTCP_PM_CMD_SET_FLAGS(0xffffffffffffffff, &(0x7f0000005380)={&(0x7f0000005280)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000005340)={&(0x7f00000052c0)={0x44, 0x0, 0x400, 0x70bd2d, 0x25dfdbfd, {}, [@MPTCP_PM_ATTR_TOKEN={0x8, 0x4, 0x6}, @MPTCP_PM_ATTR_TOKEN={0x8, 0x4, 0xffffffff}, @MPTCP_PM_ATTR_LOC_ID={0x5, 0x5, 0x2}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x8}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x7}]}, 0x44}, 0x1, 0x0, 0x0, 0x40010}, 0x24008000) 11.606646183s ago: executing program 2 (id=2127): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'generic-gcm-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000140)="2c385aa3d49100dc6626c892b6bc436a", 0x10) r1 = accept4(r0, 0x0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000004e00)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=[@assoc={0x18, 0x117, 0x4, 0x4}], 0x18}], 0x1, 0xc1) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4) r3 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, r2, 0xfffffffe, '\x00', 0x0, 0x0}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x15, 0xf, &(0x7f0000000000)=@ringbuf={{0x18, 0x8}, {{0x18, 0x1, 0x1, 0x0, r3}, {}, {0x7, 0x0, 0xb, 0x6}, {0x85, 0x0, 0x0, 0x52}}, {{0x5, 0x0, 0x3}}, [], {{0x7, 0x1, 0xb, 0x8}, {0x6, 0x0, 0x5, 0x8}}}, &(0x7f0000000380)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_reuseport, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bind$alg(r0, &(0x7f00000000c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ctr(des3_ede)\x00'}, 0x58) syz_genetlink_get_family_id$nl80211(&(0x7f00000002c0), r1) 11.436395464s ago: executing program 2 (id=2129): r0 = socket$kcm(0x10, 0x2, 0x0) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f00000000c0)={0xffffffffffffffff, 0x0, 0x0, 0x2}, 0x20) bpf$MAP_GET_NEXT_KEY(0x2, 0x0, 0x0) bpf$MAP_GET_NEXT_KEY(0x2, 0x0, 0x0) bpf$MAP_DELETE_ELEM(0x3, 0x0, 0x0) socket$kcm(0x10, 0x2, 0x10) (async) socket$kcm(0x10, 0x2, 0x10) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0x32600) (async) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r1, 0x0) (async) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r1, 0x0) r2 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r2, &(0x7f00000000c0), 0x10) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000080)={'ip_vti0\x00'}) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="19000000040072340c000000020000000ca80000", @ANYRES32=0x1, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=r1, @ANYBLOB='\x00\x00\x00\x00'], 0x50) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000100)={r1, 0xffffffffffffffff}, 0x4) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000140)={r4, &(0x7f00000000c0), &(0x7f0000000000)=""/10, 0x2}, 0x20) (async) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000140)={r4, &(0x7f00000000c0), &(0x7f0000000000)=""/10, 0x2}, 0x20) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000200)={r3, &(0x7f0000000080), &(0x7f0000000000)=""/10, 0x2}, 0x20) (async) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000200)={r3, &(0x7f0000000080), &(0x7f0000000000)=""/10, 0x2}, 0x20) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000040)="2e00000011008108090f9becdb4cb92e264831371900000069bd6efb2502eaf60d002700020400bf050005001201", 0x2e}], 0x1}, 0x0) 11.297157682s ago: executing program 2 (id=2133): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0xd, 0xb, &(0x7f0000000000)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000646c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300002000000085000000c800000095"], &(0x7f0000000300)='GPL\x00', 0x9, 0xff6, &(0x7f0000001e00)=""/4086}, 0x90) socket$kcm(0x10, 0x2, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x20, &(0x7f0000000040)=0x4, 0x4) connect$inet(r0, &(0x7f0000000280)={0x2, 0x4e21, @empty}, 0x10) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x9, 0x4, &(0x7f00000006c0)=ANY=[@ANYBLOB="180000000000000000000000000000006112000000000000950000000000000051fa7824c74186dc02ec0696c37b64e3b24da3180100000005345c0f63cdc2e82818254950ee03568b8809a1f04c7c4750eabfafcb9531b31e6a86827d1010c5a909ab98e00e19644a88e95ba26d1c9eecddb2d11c541418ceeb29b9b6829c6e433822bdb3cc85244aab66c1aae9314d7381fcfeb970bea672010000000000000043144648a07a975bd89dc398712376610faa54f12495b4659be8673086f6f3543205d4bc4ce05b8b961103673dff7f158052e62bfbdcddde6985f3f1ac5d9a94cc53207899762a07282a1914452d11858e795a3ca30a101af5574f9035f2b5f703e5be7e4acf8b78c2834ae5805fffee38a9a0033d520bcf6b08ede50899d47bb9bdf85c71c5ed44039aab46419496362e54cfad05b4004ac71a003d7b85d07191bed4e5a8908263722d4146f7ed569985439baa355cf3d8731f5e7a237bc06d035a8d601f21746d880819f38b34a495040000d0d071c2f0cce8c93cc17e9afa314fcb2ba15d646c5b9f87d988c9fbd2b9d9b4e2d71753b1549fa734f0b2e5fcf9549804cddad721971637f9c9730a9cc384eed30345979db9c93e1c52f42cad0a4d4f9436d3f39b0ed09c395dc6e970366087a8e4daeeb1b017006f25caf0cbcefd13d68839893e39c588eb032905f91cafa4996dbf0cc8228d02a3092c0830b8f587a5624515298b2d4eb2bde6f9a2eb83d53f710c490ecd085d2811a7555c53030000007f00000000bfa6478eb96b079c277e2910b7ccdc3d672ed34aa65278c549e2abb549ad954884289130bc71cee2b7de62bf48129ae1af052a2d46a6165eb0954dac7265f1f425735acf6377793946b3229e861d8ea49806b3b533345d36ecef9df700000000f337b1ceb2d8a65dcdcd895d7ba37098d2593fdaaef445af5bee02019c000000aaae37f044bcadeb0f6846582b7653665aa336db9f0384d3c7ddf79c2e0000000000000000000000000000000000000000000000e154aa0d3e41986a668ee1e5ef060000000000000095e26742f895f287111f8ee86f7e3ffb63cfb0e345cf7fc63dd2b0d30977899c6f03640040af4db71f7452bfc79a05118d8bb42b63b195771e42f9942ec626bd4b5461b74324012164e8"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_sock}, 0x94) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c0000003700000828bd7000eddbe825170000001000420007000000"], 0x1c}, 0x1, 0x0, 0x0, 0x24841}, 0x4840) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_START_AP(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000280)=ANY=[@ANYBLOB="80000000", @ANYRES16=r3, @ANYBLOB="050000000000000000000200000008000300", @ANYRES32=r4, @ANYBLOB="2d000e0080000000ffffffffffff08021100000008021100000000000000000000000000640000002503000000000000080026006c09"], 0x80}}, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000ac0)={0x0, 0xffffffffffffffff, 0x0, 0x7, &(0x7f0000000000)='cgroup\x00'}, 0x30) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x9, 0x4, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000006112000000000000950000000000000051fa7824c74186dc02ec0696c37b64e3b24da3180100000005345c0f63cdc2e82818254950ee03568b8809a1f04c7c4750eabfafcb9531b31e6a86827d1010c5a909ab98e00e19644a88e95ba26d1c9eecddb2d11c541418ceeb29b9b6829c6e433822bdb3cc85244aab66c1aae9314d7381fcfeb970bea672010000000000000043144648a07a975bd89dc398712376610faa54f12495b4659be8673086f6f3543205d4bc4ce05b8b961103673dff7f158052e62bfbdcddde6985f3f1ac5d9a94cc53207899762a07282a1914452d11858e795a3ca30a101af5574f9035f2b5f703e5be7e4acf8b78c2834ae5805fffee38a9a0033d520bcf6b08ede50899d4b9bdf85c71c5ed44039aab46419496362e54cfad05b4004ac71a003d7b85d07191bed4e5a8908263722d4146f7ed569985439baa355cf3d8731f5e7a237bc06d035a8d601f21746d880819f38b34a495040000000071c2f0cce8c93cc17e9afa314fcb2ba15d646c5b9f87d988c9fbd2b9d9b4e2d71753b1549fa734f0b2e5fcf9549804cddad721971637f9c9730a9cc384eed30345979db9c93e1c52f42cad0a4d4f9436d3f39b0ed09c395dc6e970366087a8e4daeeb1b017006f25caf0cbcefd13d68839893e39c588eb032905f91cafa4996dbf0cc8228d02a3092c0830b8f587a5624515298b2d4eb2bde6f9a2eb83d53f710c490ecd085d2811a7555c53030000007f00000000bfa6478eb96b079c277e2910b7ccdc3d672ed34aa65278c549e2abb549ad954884289130bc71cee2b7de62bf48129ae1af052a2d46a6165eb0954dac7265f1f425735acf6377793946b3229e861d8ea49806b3b533345d36ecef9df700000000f337b1ceb2d8a65dcdcd895d7ba37098d2593fdaaef445af5bee02019c000000aaae37f044bcadeb0f6846582b7653665aa336db9f0384d3c7ddf79c2e0000000000000000000000000000000000000000000000e154aa0d3e41986a668ee1e5ef93a8ceac75f44aae95e26742f895f287111f8ee86f7e3ffb63cfb0e345cf7fc63dd2b0d30977899c6f03640040af4db71f7452bfc79a05118d8bb42b63b195771e42f9942ec626bd4b5461b74324012164e8"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_sock}, 0x70) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0xb, 0x3, &(0x7f0000000000)=@framed={{0x62, 0xa, 0x0, 0xffc4, 0x0, 0x71, 0x10, 0x99}}, &(0x7f0000000480)='GPL\x00'}, 0x90) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000240)=ANY=[@ANYRES32=r6, @ANYRES32=r5, @ANYBLOB="02"], 0x10) r7 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000f00)=ANY=[@ANYRES32=r7, @ANYRES32=r1, @ANYBLOB="02"], 0x10) sendmmsg$inet(r0, &(0x7f0000004d00)=[{{0x0, 0x6000, 0x0, 0x0, 0x0, 0x0, 0x30000}}], 0x300, 0xf00) 11.038450808s ago: executing program 2 (id=2137): bpf$PROG_LOAD(0x5, 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x10d082, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x10, 0x803, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2b, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0x7}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x2}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newtfilter={0x34, 0x2c, 0xd27, 0x30bd29, 0x2, {0x0, 0x0, 0x0, r3, {0x0, 0xc}, {}, {0xb, 0xa}}, [@filter_kind_options=@f_basic={{0xa}, {0x4}}]}, 0x34}}, 0x0) r4 = socket$kcm(0x10, 0x400000002, 0x0) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) ioctl$FS_IOC_SETFLAGS(r5, 0x40086602, &(0x7f0000000000)=0x40000000) openat$cgroup_ro(r5, &(0x7f00000000c0)='cgroup.freeze\x00', 0x0, 0x0) sendmsg$inet(r4, &(0x7f0000000100)={0x0, 0x2, &(0x7f0000000080)=[{&(0x7f0000000140)="600000002e000d190a762d7f089e", 0xfca2}, {&(0x7f0000000280)="68cabf2dfb58fc0a1d6b689866f05d490d010088a8ffff0200258f2e4409b8f9e6aaeb88bea123dc2c6726e89b1ae2f6e8bcb5ee52dcd7298d39093c510293bca0b646a3ce904f6e6b788b3204c233e60ddc", 0x52}], 0x2}, 0x0) ioctl$FS_IOC_RESVSP(r2, 0x40305828, &(0x7f0000000180)={0x0, 0x3, 0x9, 0x8}) bpf$PROG_LOAD(0x5, 0x0, 0x0) (async) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x10d082, 0x0) (async) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) (async) socket(0x10, 0x803, 0x0) (async) socket$unix(0x1, 0x1, 0x0) (async) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) (async) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2b, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0x7}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x2}}}]}, 0x38}}, 0x0) (async) sendmsg$nl_route_sched(r1, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newtfilter={0x34, 0x2c, 0xd27, 0x30bd29, 0x2, {0x0, 0x0, 0x0, r3, {0x0, 0xc}, {}, {0xb, 0xa}}, [@filter_kind_options=@f_basic={{0xa}, {0x4}}]}, 0x34}}, 0x0) (async) socket$kcm(0x10, 0x400000002, 0x0) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) (async) ioctl$FS_IOC_SETFLAGS(r5, 0x40086602, &(0x7f0000000000)=0x40000000) (async) openat$cgroup_ro(r5, &(0x7f00000000c0)='cgroup.freeze\x00', 0x0, 0x0) (async) sendmsg$inet(r4, &(0x7f0000000100)={0x0, 0x2, &(0x7f0000000080)=[{&(0x7f0000000140)="600000002e000d190a762d7f089e", 0xfca2}, {&(0x7f0000000280)="68cabf2dfb58fc0a1d6b689866f05d490d010088a8ffff0200258f2e4409b8f9e6aaeb88bea123dc2c6726e89b1ae2f6e8bcb5ee52dcd7298d39093c510293bca0b646a3ce904f6e6b788b3204c233e60ddc", 0x52}], 0x2}, 0x0) (async) ioctl$FS_IOC_RESVSP(r2, 0x40305828, &(0x7f0000000180)={0x0, 0x3, 0x9, 0x8}) (async) 10.844354516s ago: executing program 2 (id=2141): syz_emit_ethernet(0x46, &(0x7f0000000080)={@multicast, @local, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "f4adf7", 0x10, 0x2c, 0x0, @dev, @mcast2, {[@hopopts={0x3c}], @echo_reply}}}}}, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r0 = socket$kcm(0x10, 0x2, 0x10) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0x6, &(0x7f00000002c0)=ANY=[@ANYBLOB="18080000000000000000000000000000180000000000000000002d19acb01f1f15000040000000bf0000000000000000"], &(0x7f0000000000)='GPL\x00', 0xb}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x8, 0x3, &(0x7f0000000000)=ANY=[@ANYBLOB="7a0a00ff00000000711053000000000095"], &(0x7f0000000480)='syzkaller\x00'}, 0x90) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000000c0)={{0x1}, &(0x7f0000000040), &(0x7f0000000080)=r1}, 0x20) pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$PNPIPE_IFINDEX(0xffffffffffffffff, 0x113, 0x2, &(0x7f0000000240), &(0x7f0000000280)=0x4) r3 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000700)={0x0, 0x10, &(0x7f0000000580)=ANY=[@ANYBLOB="18050000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r3, @ANYBLOB="0000000000000000b704000001000000850000007800000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x14, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x11, 0x10, &(0x7f0000000580)=ANY=[], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x13, 0x0, 0x0, 0x31, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r2, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000cc0), 0x1c1341, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000000)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) syz_emit_ethernet(0x22, &(0x7f0000000180)={@multicast, @remote, @void, {@ipv4={0x800, @generic={{0x5, 0x4, 0x1, 0x37, 0x14, 0x67, 0x0, 0x7, 0x6, 0x0, @broadcast, @initdev={0xac, 0x1e, 0x1, 0x0}}}}}}, 0x0) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close(r5) socket$netlink(0x10, 0x3, 0x0) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) write$cgroup_subtree(r4, &(0x7f0000000180)=ANY=[], 0x36) r6 = socket$kcm(0x2, 0xa, 0x2) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r7, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000780)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a01010000000000000000020000000900010073797a3000000000080002400000000098000000030a01020000000000000000020000000900010073797a30000000000900030073797a32000000006b00030091abc1", @ANYBLOB="3baa7d57c5e2dc1040"], 0xfc}}, 0x0) ioctl$sock_SIOCETHTOOL(r6, 0x8946, &(0x7f0000000000)={'bridge0\x00', &(0x7f0000000040)=@ethtool_dump={0x3e, 0x2, 0x5}}) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000380)={&(0x7f0000000300)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x58, 0x58, 0x7, [@decl_tag={0x10, 0x0, 0x0, 0x11, 0x4, 0x9}, @struct={0x10, 0x4, 0x0, 0x4, 0x1, 0x6, [{0xd, 0x8003, 0x9}, {0x8, 0x4, 0xfffffff8}, {0x8, 0x4, 0x7}, {0x1, 0x4, 0xc}]}, @restrict={0xd, 0x0, 0x0, 0xb, 0x2}]}, {0x0, [0x0, 0x61, 0x0, 0x5f, 0x0]}}, &(0x7f0000000500)=""/4096, 0x77, 0x1000, 0x0, 0x8000, 0x10000}, 0x28) r8 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_RES_MR_GET(r8, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x140d, 0x321, 0x70bd29, 0x25dfdbfb}, 0x10}, 0x1, 0x0, 0x0, 0x8000}, 0x44010) syz_emit_ethernet(0x4a, &(0x7f0000000200)={@local, @broadcast, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, '\x00', 0x14, 0x6, 0x0, @private1={0xfc, 0x1, '\x00', 0x2}, @local, {[], {{0x0, 0xc001, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x2, 0x9}}}}}}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)=@newtaction={0x18, 0x30, 0x53b, 0x0, 0x0, {0x9}, [{0x4}]}, 0x18}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000040)=@RTM_NEWMDB={0x38, 0x54, 0x1, 0x1, 0x0, {}, [@MDBA_SET_ENTRY={0x20, 0x1, {0x0, 0x1, 0x0, 0x2003, {@ip4=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x86dd}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4}, 0x24000050) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0xd18c9b25, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f03003f000b05d25a806c8c6394f90324fc60100002000a000300053582c137153e3704020180fc0b09000c00", 0x33fe0}], 0x1}, 0x0) 2.644087731s ago: executing program 4 (id=2228): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000180)={0x26, 'skcipher\x00', 0x0, 0x0, 'chacha20\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000000)="b7f2288d3aaea2bc0000def1260a00"/32, 0x20) r1 = accept(r0, 0x0, 0x0) syz_genetlink_get_family_id$wireguard(&(0x7f00000013c0), r1) sendmsg$nl_xfrm(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000002140)=ANY=[], 0x1198}, 0x1, 0x0, 0x0, 0x20044014}, 0x4080) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$NL80211_CMD_DEL_PMKSA(r1, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x34, r2, 0x400, 0x70bd27, 0x25dfdbfe, {{}, {@void, @void}}, [@NL80211_ATTR_MAC={0xa, 0x6, @random="10735bc7d68c"}, @NL80211_ATTR_PMKID={0x14, 0x55, "288d7db585359c090aa3375c7e37a6f2"}]}, 0x34}, 0x1, 0x0, 0x0, 0xc0810}, 0x2000085) socket$nl_route(0x10, 0x3, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x0, &(0x7f0000000340)={&(0x7f0000000280)={0x2, 0xb, 0xfe, 0x2, 0xf, 0x0, 0x0, 0x0, [@sadb_address={0x3, 0x6}, @sadb_x_sa2={0x2, 0x13, 0x6, 0x0, 0x0, 0x70bd2d, 0x3505}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x4e23, 0x4c3, @empty, 0xfff}}, @sadb_key={0x2, 0x9, 0x8, 0x0, '4'}, @sadb_x_nat_t_type={0x1, 0x14, 0x35}]}, 0x78}, 0x1, 0x7}, 0x0) r3 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f00000003c0)={0x0, @in, 0x0, 0x0, 0x0, 0x0, 0x300}, 0x9c) getsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f0000001c00)={0x0, @in, 0x0, 0x0, 0xffffffff}, &(0x7f0000001cc0)=0x9c) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='cgroup.controllers\x00', 0x275a, 0x0) close(r4) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r5, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000540)=ANY=[@ANYBLOB="b4050000fdff7f006110580000000000c60000000000000095000000000000009f33ef60916e6e713f1eeb0b725ad99b817fd98cd824498949714ffaac8a6f770600dcca55f21f3ca9e822d182054d54d53cd2b6db714e4beb5447000001000000008f2b9000f22425e4097ed62cbc891061017cfa6fa26fa7088c60897d4a6148a1c1e43f00001bde60beac671e8e8fdecb03588aa623fa71f31bf0f871ab5c2ff88afc60027f4e5b5271ed58e835cf0d0000000098b51fe6b1b8d9dbe87dcff414ed000000000000000000000000000000000000000000000000000000b347abe6352a080f8140e5fd10747b6ecdb3540546bf636e3d6e700e5b0500000000000000eb9e1403e6c8f7a187eaf60f3a17f0f046a307a403c19d9829c90bd2114252581567acae715cbe1b57d5cda432c5b910400623d24195405f2e76ccb7b37b41215c184e731fb1"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x366, 0x10, &(0x7f0000000000), 0x1dd}, 0x48) r7 = bpf$MAP_CREATE(0x0, &(0x7f00000007c0)=@base={0xf, 0x4, 0x4000004, 0x12, 0x0, 0xffffffffffffffff, 0x8}, 0x50) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000080)={@map=r7, r6, 0x26}, 0x10) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000a80)={r7, &(0x7f0000000940), &(0x7f0000000a40)=@tcp6=r5}, 0x20) recvmmsg(r5, &(0x7f0000000280)=[{{0x0, 0x0, &(0x7f0000000640)=[{&(0x7f0000001840)=""/4096, 0x1000}], 0x1}}], 0x1, 0x10003, 0x0) r8 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r8, 0x10e, 0xc, &(0x7f0000000280)={0xffffffff}, 0x10) openat$cgroup_int(0xffffffffffffffff, &(0x7f0000000080)='hugetlb.2MB.limit_in_bytes\x00', 0x2, 0x0) sendmsg$nl_generic(r8, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)={0x20, 0x12, 0xa01, 0x0, 0x0, {0xa}}, 0x26}}, 0x0) shutdown(r4, 0x1) socket$nl_route(0x10, 0x3, 0x0) r9 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000140)={'bridge_slave_1\x00'}) 2.39372757s ago: executing program 4 (id=2232): r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000480)={0xa, 0x4e20, 0x0, @mcast1, 0x2}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x15, 0x4, &(0x7f00000005c0)=@framed={{}, [@ldst={0x1, 0x2, 0x4, 0x0, 0x1, 0x1f}]}, &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_reuseport, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r1, &(0x7f0000f67fe4)={0xa, 0x4e20, 0x0, @ipv4={'\x00', '\xff\xff', @multicast2}}, 0x1c) r2 = accept4(r1, &(0x7f0000000080), &(0x7f0000000100)=0x80, 0x40800) ioctl$SIOCGSTAMP(r1, 0x8906, &(0x7f0000000280)) sendmsg$IPCTNL_MSG_CT_NEW(r2, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)={0x64, 0x0, 0x1, 0x301, 0x0, 0x0, {0x0, 0x0, 0x1}, [@CTA_PROTOINFO={0x50, 0x4, 0x0, 0x1, @CTA_PROTOINFO_TCP={0x4c, 0x1, 0x0, 0x1, [@CTA_PROTOINFO_TCP_STATE={0x5, 0x1, 0x3}, @CTA_PROTOINFO_TCP_WSCALE_REPLY={0x5, 0x3, 0x4}, @CTA_PROTOINFO_TCP_FLAGS_REPLY={0x6, 0x5, {0xac, 0x6}}, @CTA_PROTOINFO_TCP_WSCALE_ORIGINAL={0x5}, @CTA_PROTOINFO_TCP_WSCALE_REPLY={0x5, 0x3, 0x4}, @CTA_PROTOINFO_TCP_WSCALE_ORIGINAL={0x5, 0x2, 0x7}, @CTA_PROTOINFO_TCP_STATE={0x5, 0x1, 0x3}, @CTA_PROTOINFO_TCP_STATE={0x5, 0x1, 0x9}, @CTA_PROTOINFO_TCP_WSCALE_REPLY={0x5, 0x3, 0xf}]}}]}, 0x64}, 0x1, 0x0, 0x0, 0x20000000}, 0x4c010) sendto$inet(r2, &(0x7f00000002c0)="e0fe169bfe418f468afd5ea0b3acd8665ec9f15d753d06aabb8e3edce76d3e0256ab1479", 0x24, 0x4084, &(0x7f0000000300)={0x2, 0x4e23, @multicast1}, 0x10) r3 = socket$nl_rdma(0x10, 0x3, 0x14) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_init_net_socket$bt_bnep(0x1f, 0x3, 0x4) ioctl$sock_bt_bnep_BNEPCONNDEL(r5, 0x400442c9, &(0x7f0000000040)={0x0, @broadcast}) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) r7 = socket$inet(0xa, 0x801, 0x84) connect$inet(r7, &(0x7f0000004cc0)={0x2, 0x4e22, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10) listen(r7, 0x8) r8 = accept4(r7, 0x0, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_MAX_BURST(r8, 0x84, 0x83, &(0x7f0000000200)=@assoc_value, &(0x7f0000000180)=0x8) r9 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x8003, 0x60388}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @ipoib={{0xa}, {0x4}}}, @IFLA_LINK={0x8}]}, 0x3c}}, 0x0) r10 = socket$inet6_mptcp(0xa, 0x1, 0x106) setsockopt$SO_TIMESTAMPING(r10, 0x1, 0x25, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000640)={'wlan0\x00', 0x0}) r12 = socket$nl_generic(0x10, 0x3, 0x10) r13 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$IPVS_CMD_DEL_DAEMON(r12, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000340)=ANY=[@ANYBLOB="88000000", @ANYRES16=r13, @ANYBLOB="010000000000000000000a0000003c000380080001"], 0x88}}, 0x0) sendmsg$NL80211_CMD_CONNECT(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)={0x3c, r6, 0x5, 0x70bd28, 0x4, {{}, {@val={0x8, 0x3, r11}, @void}}, [@NL80211_ATTR_SSID={0xb, 0x34, @random="c3edcbfd94746b"}, @NL80211_ATTR_IE={0xc, 0x2a, [@mesh_id={0x72, 0x6}]}, @NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x29}]}, 0x3c}, 0x1, 0x0, 0x0, 0x800}, 0x44) sendmsg$RDMA_NLDEV_CMD_RES_CQ_GET(r3, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)={0x10, 0x1409, 0x1, 0x0, 0x25dfdbff}, 0x10}, 0x1, 0x0, 0x0, 0x1}, 0x10) 2.232784552s ago: executing program 1 (id=2236): r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x10) sendmsg$NFT_BATCH(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a90000000060a0b0400000000000000000200000064000480600001800a000100696e6e65720000005000028008000240000000840800034000000007080004400000000f08000140000000152c0005800c0001007061796c6f6164001c00028008000340000000e1080004400000008b08000240000000050900010073797a30000000000900020073797a32"], 0xb8}}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0xcb, 0x7, 0x8, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x5}, 0x50) setsockopt$inet6_int(r0, 0x29, 0x50, 0x0, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = socket$alg(0x26, 0x5, 0x0) bind$alg(r4, &(0x7f0000000080)={0x26, 'skcipher\x00', 0x0, 0x0, 'pcbc(fcrypt)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, &(0x7f0000412ff8)="3665a1ab415b7ac7", 0x8) r5 = accept(r4, 0x0, 0x0) sendmmsg(r5, &(0x7f0000000280)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000780)=[{0x10, 0x114, 0xaca0}], 0x10}}], 0x1, 0x8001) r6 = syz_genetlink_get_family_id$fou(&(0x7f0000000480), 0xffffffffffffffff) r7 = socket$caif_seqpacket(0x25, 0x5, 0x3) ioctl$ifreq_SIOCGIFINDEX_vcan(r7, 0x8933, 0x0) r8 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000340)={0x140, 0x41, 0x107, 0x10000000, 0x7, {0x1, 0x7c}, [@nested={0x4, 0xfc}, @nested={0x128, 0x1, 0x0, 0x1, [@typed={0x122, 0x70, 0x0, 0x0, @str='\x80\n\xe5\xc6S\xb3\xdd\xf8m\a\xfe\xa3\x17xc\xd5\x11g\xd4\xbbG3\xb0\xe1\x8e\xa9Dv\xd1\xab\t\x10\x1c\x84\x82\xc0\xc4x\x91\xb1\'\x8c!\x9f\xc3%3\a+\xb1Y\xcd\x936I~!\xc7\v\xe5f\xb1z\xd1\xeb\xd4\xd4\tY\xfc>\\NS\xf3\xaf\xa8\xdf\xc9\x97\xd5\xb9\xefb\x90$\xeb!\xe3\xff\xc1{\xf0\xc7;\x7f\xc5\xb5e1\xf1$\x05\xfcy\xcck\x1b\xdfR-\xea\xa5;N\xd7\xbcH-s\x91\f+b\xdc\xd1\xe7\xebazZB\x82=\'|\x88\xbe\xf5\x7fd\x86\xad\xd9\xae\x0f\xaa\xbcrE5\xd3%\xf5\xed\xe1,\x99\v$n\xba%\xb5E\xb4~\xcf\xaf\x86\x87\xe7\xb2k\x18\xb8\x9b\x12\n\x18\x8b\xf8\x8b@@\x9f\xe3k@\xae\xaf\x10\xbb\xf8F\xb7B\xba\x19\xf3\xcee`\xea\x7f\xbb\x02\xaf\x12?u\xde3v.I\x15\xb6\rm\xeb\x0e\x17&\xe9\x02\x96\x808\xf7(,\x83\xb5\xd2si\x17\x82\xe8\x92\x98>t\x9c\xd1G\x9f+\x83H>Z\xba!\xe2y,\xccN\x05e\x91\xaaR_\xe4\xca\x82W\x96\xaa\x9b~\xf7\x03\xd2\xda\xaa`\xd84W\xd1\xac\x96'}]}]}, 0x140}}, 0x44800) sendmsg$FOU_CMD_ADD(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000080)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="01002dbd7000000004000100000006000a004e2400"/38], 0x2c}, 0x1, 0x0, 0x0, 0x20048091}, 0x0) sendmsg$FOU_CMD_ADD(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000180)={0x1c, r6, 0x209, 0x0, 0x0, {}, [@FOU_ATTR_TYPE={0x5, 0x4, 0x2}]}, 0x1c}}, 0x0) r9 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$RDMA_NLDEV_CMD_PORT_GET(r9, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x30, 0x1405, 0x400, 0x70bd26, 0x25dfdbff, "", [{{0x8}, {0x8, 0x3, 0x4}}, {{0x8, 0x1, 0x2}, {0x8}}]}, 0x30}}, 0x40000) 2.082819135s ago: executing program 4 (id=2238): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$TIPC_NL_PUBL_GET(r0, &(0x7f00000009c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)={0x14, r1, 0x1, 0x0, 0x0, {0x2}}, 0x14}}, 0x0) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_COALESCE_GET(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000280)={0x2c, r2, 0x1, 0x0, 0x0, {0x1a}, [@HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'lo\x00'}]}]}, 0x2c}}, 0x0) 1.879433012s ago: executing program 4 (id=2241): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ctr-aes-aesni\x00'}, 0x58) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0xa, 0x6, &(0x7f0000000000)=@framed={{0x5, 0x0, 0x0, 0x0, 0x0, 0x73, 0x11, 0x37}, [@func={0x85, 0x0, 0x1, 0x0, 0x2}, @call={0x85, 0x0, 0x0, 0x76}, @exit={0x95, 0x0, 0x1008}], {0x95, 0x0, 0x5a5}}, &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x6}, 0x70) (async, rerun: 64) sendmsg$NL80211_CMD_SET_WIPHY(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x1c, 0x0, 0x800, 0x70bd2c, 0x25dfdbfe, {}, [@NL80211_ATTR_WIPHY_RTS_THRESHOLD={0x8, 0x40, 0x9}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8000}, 0x10) (async, rerun: 64) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r1 = accept4(r0, 0x0, 0x0, 0x0) sendmsg$NL80211_CMD_CONNECT(0xffffffffffffffff, 0x0, 0x0) (async) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r2, &(0x7f0000000100)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r2, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), r1) 1.688322268s ago: executing program 1 (id=2244): r0 = socket(0x10, 0x3, 0x0) r1 = socket$inet6(0xa, 0x3, 0x5) sendmmsg(r1, &(0x7f0000001500)=[{{&(0x7f0000000180)=@l2tp6={0xa, 0x500, 0x80000, @remote, 0x0, 0x3}, 0x80, 0x0}, 0x5b4}], 0x1, 0x0) syz_emit_ethernet(0x4e, &(0x7f0000000880)={@link_local, @multicast, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "010448", 0x18, 0x3a, 0xff, @local, @local, {[], @ndisc_na={0x88, 0x0, 0x0, 0x0, '\x00', @remote}}}}}}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)=ANY=[@ANYBLOB="2000000052e5000000000068000000001c00000009000100020000000600000000000000d7ee332d0000"], 0x20}}, 0x0) 1.626301483s ago: executing program 1 (id=2245): r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) r2 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) socket(0x40000000015, 0x5, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = socket$kcm(0x1e, 0x1, 0x0) sendmsg$kcm(r5, &(0x7f0000000540)={&(0x7f0000000280)=@tipc=@name={0x1e, 0x2, 0x2, {{0x0, 0x1}}}, 0x80, 0x0}, 0x4880) setsockopt$sock_attach_bpf(r4, 0x1, 0x4c, &(0x7f0000000000), 0x4) sendmsg$inet(r3, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) recvmsg$unix(r4, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000300)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x0, 0x3, 0xfffffffffffffffd, 0x9323, 0xfffffffffffffffe, 0x0, 0x2}, 0x0, &(0x7f00000002c0)={0x3ff, 0x0, 0x0, 0x9, 0x0, 0x7dc48146, 0x7fffffff, 0x5539e0cf}, 0x0, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0x16, 0xf, &(0x7f0000000580)=ANY=[@ANYRES16=r1, @ANYRES32=r2, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000800000000bf91000000000000b702000043e7b5538500000085000000b70000000000000095"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x23, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000140)='kmem_cache_free\x00', r6}, 0x10) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r1, &(0x7f0000000100)={0xa000000d}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r2, &(0x7f0000000400)={0xa}) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r2, &(0x7f00000003c0)={0x1008}) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000140)=@newlink={0x4c, 0x10, 0x437, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x2c, 0x12, 0x0, 0x1, @ip6erspan={{0xe}, {0x18, 0x2, 0x0, 0x1, [@IFLA_GRE_REMOTE={0x14, 0x7, @empty}]}}}]}, 0x4c}}, 0x0) 1.456120115s ago: executing program 0 (id=2248): r0 = socket$key(0xf, 0x3, 0x2) r1 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'sit0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000380)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd2b, 0xffffffff, {0x0, 0x0, 0x0, r2, {0x0, 0x7}, {0xffff, 0xffff}, {0xfff1, 0xd}}, [@qdisc_kind_options=@q_cbs={{0x8}, {0x1c, 0x2, @TCA_CBS_PARMS={0x13, 0x1, {0x1, '\x00', 0x5, 0x28e3, 0x5, 0x200}}}}]}, 0x48}}, 0x40) (async) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0xa000)=nil, 0xa000, 0x2, 0x2172, 0xffffffffffffffff, 0x0) (async) r4 = socket$nl_generic(0x10, 0x3, 0x10) mmap(&(0x7f0000005000/0x1000)=nil, 0x1000, 0x0, 0x13, r4, 0x0) (async) getsockopt$inet6_tcp_buf(r3, 0x6, 0x2f, &(0x7f0000000240)=""/80, &(0x7f00000000c0)=0x50) (async) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r5, &(0x7f0000000200)=0x5, 0xfffffe97) (async) r6 = socket$inet6_sctp(0xa, 0x801, 0x84) sendto$inet6(r6, &(0x7f0000000180)="c2", 0x1, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, 0x1c) (async) shutdown(r6, 0x1) (async) getsockopt$bt_hci(r6, 0x84, 0x14, &(0x7f0000002140)=""/4092, &(0x7f0000001080)=0xffc) sendmsg$key(r0, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000340)={&(0x7f0000000100)=ANY=[@ANYBLOB="020300031000000000000000000000000200090008000000e40000000000000005000600000000000a00002c09bbfc00fc01000000000000000000000000000000000000000000000200010000000000000000160000000005000500000000000a"], 0x80}, 0x1, 0x7}, 0x0) 1.284254839s ago: executing program 0 (id=2250): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)={0x28, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_MESH_ID={0xa}]}, 0x28}}, 0x0) sendmsg$NL80211_CMD_CONNECT(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x44, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_MAC={0xa, 0x6, @from_mac}, @NL80211_ATTR_AUTH_TYPE={0x8}, @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}]]}, 0x44}}, 0x0) syz_80211_inject_frame(&(0x7f00000002c0)=@device_b, &(0x7f0000000300)=@mgmt_frame=@probe_response={{{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void}, 0x36) nanosleep(&(0x7f0000000340)={0x0, 0x2faf080}, &(0x7f0000000380)) sendmsg$IPVS_CMD_GET_CONFIG(r0, &(0x7f00000005c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000540)={0x60, 0x0, 0x2, 0x70bd27, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x8}, @IPVS_CMD_ATTR_DEST={0xc, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x1}]}, @IPVS_CMD_ATTR_DAEMON={0x38, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @loopback}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'wg0\x00'}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x3}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0x101}]}]}, 0x60}, 0x1, 0x0, 0x0, 0x40000}, 0x40) syz_80211_inject_frame(&(0x7f00000003c0)=@device_b, &(0x7f0000000400)=@mgmt_frame=@auth={{{}, {}, @device_b, @device_a, @from_mac, {0x0, 0x1}}, 0x0, 0x2, 0x0, @void}, 0x1e) nanosleep(&(0x7f0000000440)={0x0, 0x2faf080}, &(0x7f0000000480)) syz_80211_inject_frame(&(0x7f00000004c0)=@device_b, &(0x7f0000000500)=@mgmt_frame=@assoc_resp={{{}, {}, @device_b, @device_a, @from_mac, {0x0, 0x2}}, 0x1, 0x0, @default, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void}, 0x28) r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000640)='freezer.state\x00', 0x0, 0x0) syz_genetlink_get_family_id$ipvs(&(0x7f0000000600), r3) 1.143488793s ago: executing program 3 (id=2252): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f0000000180)=ANY=[@ANYBLOB="18010000002304e800000000000000ea850000007b00000095"], &(0x7f0000000100)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) r1 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000002c0)={&(0x7f00000001c0)='netlink_extack\x00', r0}, 0x10) r2 = socket$netlink(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000240)={0x0, 0x24}}, 0x0) getsockname$packet(r3, &(0x7f00000000c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000440)=0xfe3b) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000680)=@bpf_ext={0x1c, 0x1e, &(0x7f0000000480)=@framed={{0x18, 0x0, 0x0, 0x0, 0x2398, 0x0, 0x0, 0x0, 0x4}, [@printk={@lu, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x10}}, @initr0={0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r1}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x9255}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @printk={@p, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x8}}]}, &(0x7f0000000140)='GPL\x00', 0x5, 0x0, 0x0, 0x41000, 0x21, '\x00', r4, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000340)={0x5, 0x7, 0x8, 0x6}, 0x10, 0x17bec, r0, 0x6, &(0x7f00000003c0), &(0x7f0000000580)=[{0x3, 0x3, 0x7, 0x3}, {0x0, 0x2, 0xf, 0x1}, {0x4, 0x2, 0x4, 0x4}, {0x4, 0x4, 0x6, 0xb}, {0x4, 0x2, 0xb, 0xb}, {0x2, 0x3, 0xe, 0xb}], 0x10, 0x1}, 0x94) (async) sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r4, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) (async) sendmsg$nl_route_sched(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000640)=@newqdisc={0x38, 0x24, 0xf0b, 0x0, 0x25dfdbfd, {0x0, 0x0, 0x0, r4, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xe}}, [@qdisc_kind_options=@q_fq_codel={{0xd}, {0x4}}]}, 0x38}}, 0x0) (async) sendmsg$nl_route_sched(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000380)=@delchain={0x24, 0x25, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {}, {0x0, 0xfff1}}}, 0x24}}, 0x0) 980.404126ms ago: executing program 3 (id=2253): r0 = socket$netlink(0x10, 0x3, 0x0) (async) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="54000000100001002fbd7000fddbdf2500000000", @ANYRES32=0x0, @ANYBLOB="0201000000000000140003006e657464657673696d30000000000000200016801c00018018000c8014000100080088a8"], 0x54}}, 0x24040800) r2 = syz_init_net_socket$bt_bnep(0x1f, 0x3, 0x4) (async, rerun: 64) r3 = socket$inet_udp(0x2, 0x2, 0x0) (async, rerun: 64) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000000)={&(0x7f0000000080)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x10, 0x10, 0x6, [@var={0x4, 0x0, 0x0, 0xe, 0x4, 0x2}]}, {0x0, [0x0, 0x2e, 0x0, 0x2e]}}, &(0x7f0000000100)=""/141, 0x19, 0x8d, 0x1, 0x7}, 0x28) (async) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f0000001500)={0x0, 0x0, &(0x7f00000014c0)={&(0x7f0000000d80)={{0x14, 0x10, 0x1, 0x0, 0x0, {0xa}}, [@NFT_MSG_DELCHAIN={0x14, 0x5, 0xa, 0x101, 0x0, 0x0, {0x7, 0x0, 0x1}}, @NFT_MSG_DELTABLE={0x20, 0x2, 0xa, 0x101, 0x0, 0x0, {0x0, 0x0, 0x2}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz1\x00'}]}, @NFT_MSG_NEWFLOWTABLE={0x14, 0x16, 0xa, 0x801, 0x0, 0x0, {0x73c3bfc5edc560a0, 0x0, 0x7}}, @NFT_MSG_DELSET={0x14, 0xb, 0xa, 0x5, 0x0, 0x0, {0x0, 0x0, 0x8}}, @NFT_MSG_DELRULE={0x14, 0x8, 0xa, 0x5, 0x0, 0x0, {0x3, 0x0, 0x1}}], {0x14, 0x11, 0x1, 0x0, 0x0, {0xa}}}, 0x98}, 0x1, 0x0, 0x0, 0x4}, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$TIPC_NL_MEDIA_SET(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000300)={0x20, r6, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_MEDIA={0xc, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}]}]}, 0x20}}, 0x0) (async) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) ioctl$TUNSETIFF(r7, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) (async) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000100)=ANY=[@ANYRES8, @ANYRES32, @ANYBLOB="0000000000000000400012800c0001"], 0x68}}, 0x0) (async) r8 = socket$igmp6(0xa, 0x3, 0x2) (async) r9 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r9, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r8, 0x8983, &(0x7f0000000300)={0x0, 'syzkaller1\x00', {0x2}}) (async) write$tun(r7, &(0x7f0000000100)=ANY=[@ANYBLOB="06000000bbbbbbbbbbbbaaaaaaaaaabb88f5"], 0x72) (async) setsockopt$SO_TIMESTAMP(r3, 0x1, 0x12, &(0x7f0000000080)=0xffffffff, 0x4) (async) ioctl$F2FS_IOC_RESERVE_COMPRESS_BLOCKS(r2, 0x8008f513, &(0x7f0000000040)) (async) r10 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r10, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000005d00)={0x114, 0x2e, 0x1, 0x0, 0x25dfdbfc, "", [@nested={0x104, 0xf2, 0x0, 0x1, [@typed={0xc, 0x18, 0x0, 0x0, @u64=0xfac08}, @typed={0x14, 0x1, 0x0, 0x0, @ipv6=@ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x16}}}, @generic="50bb2d6f67d29d6fabadb107d0def49c88ea04abde1d5e8d3fb22a1b5046778bdafefc46b0449ade68bf84b36ec72dd71265fc2e882348c26c2126237dd5b37f5ae655b1086cda40e00aec58754734be31d750351dc076eb43d9621dc08c029d1608a46cf26fbe816b89f7cb81bff81a8b9482565856555ee923c65973deb0a99b962bc0fe94a3fcae3697bd7b85b3a682167c43dbf137115a40ebddcad74875ec58e9a3ddb9ad02a078cf0d972df9e99f079767734f69ce475f00ac64337803f5eb4e5842f4d98fe3fa370d47eb640dc5061dc35817c8a66c29be82", @typed={0x4, 0xe9}]}]}, 0x114}], 0x1, 0x0, 0x0, 0x1}, 0x0) (async) r11 = socket$inet6_tcp(0xa, 0x1, 0x0) (async) r12 = socket$inet_icmp_raw(0x2, 0x3, 0x1) (async) getpeername$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000040)=0x14) setsockopt$inet_mreqn(r12, 0x0, 0x23, &(0x7f0000000140)={@local, @loopback, r13}, 0xc) (async) r14 = socket(0x10, 0x3, 0x0) sendto$inet6(r14, &(0x7f0000000080)="7800000018002507b9409b14ffff00000200be040205fe056402040c5c0009003f0020030a0000000d0085a168d0bf46d32345653600648d27000b000a00000049935ade4a460c89b6ec0cff3959547f509058ba86c902007a00004a32000402160008000a0000000000e000e218d1ddf66ed538f2523250", 0x78, 0x0, 0x0, 0xa00000000000000) (async) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x11, &(0x7f00000000c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="4c0000001800010800000000000000850a603f00000000000500000014000500200100000000000000000100000000001c00090008000000", @ANYRES32=r11], 0x4c}}, 0x0) 941.385523ms ago: executing program 3 (id=2254): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r1, 0x0, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x8, 0x3, 0x2e8, 0x0, 0x25, 0x148, 0x138, 0x60, 0x250, 0x2a8, 0x2a8, 0x250, 0x2a8, 0x3, 0x0, {[{{@uncond, 0x0, 0xf0, 0x138, 0x0, {0x200003ae, 0x7f00}, [@common=@inet=@hashlimit1={{0x58}, {'geneve0\x00', {0x44, 0x0, 0x21a, 0x0, 0x0, 0xffffffff, 0x7}}}, @inet=@rpfilter={{0x28}}]}, @common=@unspec=@IDLETIMER={0x48, 'IDLETIMER\x00', 0x0, {0x6, 'syz1\x00'}}}, {{@uncond, 0x0, 0xd0, 0x118, 0x0, {}, [@common=@unspec=@cgroup0={{0x28}, {0x4}}, @common=@unspec=@statistic={{0x38}}]}, @common=@unspec=@IDLETIMER={0x48, 'IDLETIMER\x00', 0x0, {0x8000, 'syz0\x00', {0x481c}}}}], {{'\x00', 0xc8, 0x70, 0x98}, {0x28}}}}, 0x348) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000000)={'syztnl2\x00', &(0x7f00000000c0)={'syztnl1\x00', 0x0, 0x20, 0x7f00, 0xffff1c3d, 0x4, {{0x2c, 0x4, 0x0, 0x4, 0xb0, 0x67, 0x0, 0xc, 0x2f, 0x0, @dev={0xac, 0x14, 0x14, 0x2d}, @multicast2, {[@timestamp={0x44, 0xc, 0x5f, 0x0, 0xb, [0x9, 0xe8b]}, @rr={0x7, 0x23, 0xb3, [@multicast2, @initdev={0xac, 0x1e, 0x0, 0x0}, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, @rand_addr=0x64010101, @private=0xa010100, @local, @broadcast]}, @lsrr={0x83, 0x1b, 0x47, [@remote, @broadcast, @loopback, @remote, @local, @multicast1]}, @timestamp_prespec={0x44, 0x14, 0x1c, 0x3, 0x0, [{@rand_addr=0x64010102, 0x1}, {@loopback, 0x5eb4}]}, @lsrr={0x83, 0x7, 0xd5, [@initdev={0xac, 0x1e, 0x1, 0x0}]}, @cipso={0x86, 0x34, 0xffffffffffffffff, [{0x7, 0x12, "6503e9740482654c23e724e4a91f3175"}, {0x0, 0xe, "9be2570dad4988f905a6fa75"}, {0x2, 0x8, 'j\tVHs\''}, {0x2, 0x6, "31de4630"}]}]}}}}}) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=ANY=[@ANYBLOB="500008000000000000007000ffdbdf250a001f00", @ANYRES32=r2, @ANYBLOB="0300000014000100fc01000000000000000000000000000108000200060000000800020005000000080002000b0000000800020001000000"], 0x50}}, 0x2) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000002c0)={{0x1, 0xffffffffffffffff}, &(0x7f0000000040), &(0x7f0000000240)}, 0x20) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='memory.events\x00', 0x275a, 0x0) writev(r4, &(0x7f0000000400)=[{&(0x7f00000002c0)="a609a89c9edd34187123b5adceb38c8557f4e107445a53c0815c9636d00f896d1e8cd8de77a79f1e3e2c53ddf1bb9f8ac5cb5257ff4e8b960026bc4244c4b09179a97dffdf02563e23546d3e78f944e7e2fee2a0e354223318badb21d8c086669c5f7772f4a6d90d0997babdf79f7d557e055b3e6f2e4f41ec06a39a57b9ccc00b", 0x81}], 0x1) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, r4, 0x0) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000000440)={0x0, 0x0}, 0x8) r6 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000480)={0xffffffffffffffff}, 0x4) r7 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)=@base={0xf, 0x4, 0x4, 0x7}, 0x48) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001fc0)={r7, &(0x7f0000001e80), 0x0}, 0x20) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f00000004c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4) r9 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000500)={0xffffffffffffffff, 0x4, 0x10}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000005c0)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000000540), &(0x7f0000000580)}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0xa, 0x4, &(0x7f0000000300)=@raw=[@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r3}}], &(0x7f0000000340)='syzkaller\x00', 0x7ff, 0x0, &(0x7f0000000380), 0x40f00, 0x28, '\x00', 0x0, @fallback=0x28, r4, 0x8, &(0x7f00000003c0)={0x0, 0x1}, 0x8, 0x10, &(0x7f0000000400)={0x2, 0x1, 0x100, 0x8000}, 0x10, r5, r6, 0x1, &(0x7f0000000600)=[0xffffffffffffffff, r7, r8, r9, r10], &(0x7f0000000640)=[{0x2, 0x2, 0xf}], 0x10, 0x3}, 0x94) 916.634495ms ago: executing program 4 (id=2255): socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000100), r1) sendmsg$IEEE802154_ASSOCIATE_REQ(r0, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000000)=ANY=[@ANYBLOB="04000000", @ANYRES16=r2, @ANYBLOB="ffffff7f000000000000010000001d34f3a99c551c9e8012d87e68fb5e8119acb7aba78e1880f4294129d2af6a1294f548a4b7f7484a2df2383f859d0fd98aca46c4bb4eea370548f994b01073dd65751d12b2a52d9f4d33b077394c22f9"], 0x14}}, 0x0) close(0x4) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000140)={'wpan0\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000180)={'wpan0\x00', 0x0}) sendmsg$IEEE802154_LLSEC_ADD_DEV(r0, &(0x7f0000000280)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x48, r2, 0x200, 0x70bd27, 0x25dfdbfd, {}, [@IEEE802154_ATTR_SHORT_ADDR={0x6, 0x4, 0xaaa2}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r3}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5, 0x36, 0x1}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r4}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5, 0x37, 0x1}]}, 0x48}, 0x1, 0x0, 0x0, 0x4000}, 0x4000090) syz_open_procfs$namespace(0x0, &(0x7f0000000080)='ns/ipc\x00') unshare(0x6a040000) r5 = socket$inet(0xa, 0x801, 0x84) r6 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000380)="1800000069006bcd8e0300dc6e3640030003010000040000", 0x18}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) connect$inet(r5, &(0x7f0000000340)={0x2, 0x4e23, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) 724.189032ms ago: executing program 3 (id=2256): r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$gtp(&(0x7f0000005680), 0xffffffffffffffff) sendmsg$GTP_CMD_GETPDP(r1, &(0x7f0000005a80)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="0900000000000000000003000000080002000000000008000400ac1414aa08000500e000000208000100", @ANYRES8=r0], 0x34}}, 0x48044) r3 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000080)={'wlan0\x00', 0x0}) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL80211_CMD_TDLS_OPER(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000000c0)={0x30, r5, 0x1, 0x70bd29, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r4}, @void}}, [@NL80211_ATTR_TDLS_OPERATION={0x5, 0x8a, 0x3}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}]}, 0x30}, 0x1, 0x0, 0x0, 0x20000004}, 0xc000) r6 = socket(0x10, 0x803, 0x0) r7 = socket$nl_crypto(0x10, 0x3, 0x15) sendmsg$nl_crypto(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000280)=@getstat={0xe0, 0x15, 0x0, 0x0, 0x0, {{'aegis128-generic\x00'}}}, 0xe0}}, 0x0) sendmsg$nl_crypto(r7, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="e8000000110001"], 0xe8}}, 0x0) r8 = socket$inet6_mptcp(0xa, 0x1, 0x106) connect$inet6(r8, &(0x7f0000000000)={0xa, 0x1, 0x0, @dev={0xfe, 0x80, '\x00', 0x27}, 0x7}, 0x1c) setsockopt$inet6_int(r8, 0x29, 0xb, 0x0, 0xbb97c160b71b9a0d) sendmsg$nl_route(r6, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000100)=@newlink={0x40, 0x10, 0x437, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x51483}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @gtp={{0x8}, {0x14, 0x2, 0x0, 0x1, [@IFLA_GTP_CREATE_SOCKETS={0x5, 0x5, 0x1}, @IFLA_GTP_LOCAL={0x8, 0x7, @rand_addr=0x64010101}]}}}]}, 0x40}}, 0x8040) r9 = socket$netlink(0x10, 0x3, 0x2) r10 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000280)=ANY=[@ANYBLOB="440000003e000701feffffff00000000017c0000040042800c00018006000600800a0000200002801c00178018"], 0x44}, 0x1, 0x0, 0x0, 0x40040c0}, 0xc000) r11 = syz_genetlink_get_family_id$tipc(&(0x7f0000000080), r6) r12 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r12, 0x400454ca, &(0x7f0000000080)={'\x00', 0x52d35ce30131f272}) ioctl$TUNSETLINK(r12, 0x400454cd, 0x10e) sendmsg$TIPC_CMD_GET_BEARER_NAMES(r10, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000400)={0x1c, r11, 0x300, 0x70bd28, 0x25dfdbfe, {}, ["", "", "", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x8040}, 0x0) connect$netlink(r9, &(0x7f0000000000)=@unspec, 0xc) 599.387758ms ago: executing program 1 (id=2257): r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$bt_BT_VOICE(r0, 0x112, 0xb, &(0x7f0000000000)=0x3, 0x2) r1 = socket$inet(0xa, 0x801, 0x84) connect$inet(r1, &(0x7f0000004cc0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) r2 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_ADD_VIF(r2, 0x0, 0xca, &(0x7f00000002c0)={0x1, 0x4, 0x0, 0x0, @vifc_lcl_ifindex, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10) setsockopt$MRT_ADD_MFC_PROXY(r2, 0x0, 0xd2, &(0x7f0000000280)={@broadcast, @empty, 0x0, "ffff01e03d64a831683fdc3fd440829c82cfc400"}, 0x3c) listen(r1, 0xfffffffd) r3 = accept4(r1, 0x0, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_EVENTS(r3, 0x84, 0xb, &(0x7f00000002c0)={0x3, 0x1, 0x2, 0xff, 0xa4, 0x0, 0x1, 0x0, 0x5, 0x8, 0x0, 0x0, 0x2, 0x20}, 0xe) syz_emit_ethernet(0x92, &(0x7f0000000080)={@local, @broadcast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x84, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0xb, 0x3, 0x0, 0x3, 0x0, 0x0, {0x1a, 0x4, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x2f, 0x0, @broadcast=0xac14140a, @multicast1, {[@timestamp_addr={0x44, 0xc, 0xb9, 0x1, 0x3, [{@remote, 0x7}]}, @timestamp_addr={0x44, 0x2c, 0x19, 0x1, 0xe, [{@multicast1, 0x88}, {@initdev={0xac, 0x1e, 0x1, 0x0}, 0x800}, {@broadcast, 0x8}, {@multicast1, 0x852}, {@dev={0xac, 0x14, 0x14, 0x37}, 0x4}]}, @ssrr={0x89, 0x17, 0xbd, [@multicast2, @rand_addr=0x64010101, @rand_addr=0x64010102, @dev={0xac, 0x14, 0x14, 0x3b}, @loopback]}, @ra={0x94, 0x4}]}}}}}}}, 0x0) connect$bt_sco(r0, &(0x7f0000000040)={0x1f, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}, 0x8) 572.384097ms ago: executing program 0 (id=2258): r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_int(r0, 0x29, 0x33, 0x0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) socket$nl_route(0x10, 0x3, 0x0) (async) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=@newlink={0x44, 0x10, 0x44b, 0x0, 0x0, {0x7a}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x14, 0x2, 0x0, 0x1, [@IFLA_BR_MCAST_ROUTER={0x5, 0x16, 0x3}, @IFLA_BR_AGEING_TIME={0x8}]}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x40000000}, 0x0) r3 = socket$pppl2tp(0x18, 0x1, 0x1) ioctl$PPPIOCGL2TPSTATS(r3, 0x80487436, &(0x7f0000000040)="7b6d4babf3cc010f0c241a96b42aa1d5fd69b3de0937b83d730fae048b0b12c4c98d35089371a8a445ef6beedfb56b41392c669f3fdba6e1ef29b21aa34eab6b3007df03881fa26a5e547fb8cd3e5648615e44bf57960293f7f9d8d109573ec85d9682b40aec80bdc098d1eba82cbfde14519bd15f938e64e0360d8ae1b7988abae97f340177a210e4e4b9e37547e56db97fdf3ce5817592228373ed2949ba1151561bc6fd36caf3ef2f19cab3fbc56806c3ffe969950443cb578e") bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000580)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x200}, 0x50) (async) r4 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000580)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x200}, 0x50) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000080)={r4}, 0x4) (async) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000080)={r4}, 0x4) bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0xb, 0x10, &(0x7f0000000200)=@framed={{}, [@snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x1000}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r4}, {}, {0x85, 0x0, 0x0, 0xb6}}]}, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x2a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0xb, 0x10, &(0x7f0000000200)=@framed={{}, [@snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x1000}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r4}, {}, {0x85, 0x0, 0x0, 0xb6}}]}, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x2a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000640)={r5, 0x0, 0x10, 0x10, &(0x7f00000006c0)="0000000005000000", &(0x7f0000000700)=""/8, 0x2f00, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f00000004c0)=@filter={'filter\x00', 0x2, 0x4, 0x440, 0xffffffff, 0x0, 0xd0, 0x0, 0xfeffffff, 0xffffffff, 0x370, 0x370, 0x370, 0xffffffff, 0x4, 0x0, {[{{@ipv6={@dev, @mcast2, [], [], 'macsec0\x00', 'wlan1\x00', {}, {}, 0x6, 0x0, 0x1, 0x48}, 0x2f2, 0xa8, 0xd0}, @common=@unspec=@CONNSECMARK={0x0, 'CONNSECMARK\x00', 0x0, {0x5}}}, {{@ipv6={@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @empty, [], [0x0, 0xffffff00], 'sit0\x00', 'dvmrp0\x00'}, 0x0, 0xa8, 0xd0}, @REJECT={0x0, 'REJECT\x00', 0x0, {0x8}}}, {{@uncond, 0x0, 0xa8, 0x1d0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x4, 'system_u:object_r:zero_device_t:s0\x00'}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0xffffffffffffff84) 436.112045ms ago: executing program 4 (id=2259): unshare(0x28000600) r0 = socket$inet_sctp(0x2, 0x5, 0x84) read(r0, &(0x7f00000006c0)=""/231, 0xe7) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000008000)={0x15, 0x3, &(0x7f0000000900)=ANY=[@ANYBLOB="b700000000000000070000000000000095000000000000005b1953e7203b3833b487e3c4bd4540e4b6e87b7891e0f159182f542be18de00d9d95e1c4a6b62a3c065fc1a7b4c144cc2508eba2540e3425abc138dbaf9f6da59d9c77cbe2a8a9666a08ed1704c6bb2e422f01d64cae3050d7bd3c10b0e80d9483a2e36568cf0c6a1b78d9ca2f8065a1d7b4b0eeeecaa3c865de68042c9ab36e8a43b97955b04e5351f99c682a939832582c0dfd64028580c33fca4ca652f4c4e116c16e0f76fd9379599b54e06a8662f81fe375751e06007efabbd87b82d35367257d1bc15f92370261aace269013bc00b86daae71e253200000000b1467c86aff0ee8ff6c53939acb3866e8247eff7c10f000200000e6bd59e5b4dbc12ce8f0a5f816382fc66bcf14bb83ce2336b93b90594b78301e696503eea3404fe7dc3a8a5f9fde10f53e458e9efbe57fb52e85ea5346ed9f42418aefc6052afd588f8ae73eaab3af38936bfdadc91cda3983de6513ef3c2e58a54ffb1921aab1df971cdc2b2ab17bc9e421b5991b6036f845313a4a5f9d8a36472d7d758d73e9be967ca3fdae7d7ba03a8d9e5962c67ca30e5b6eb3c524c22632e47f18c879f0564361ef35aba5ed3f2d1b0bc6954e7e2dc49106ce8a49b48812ad3f5f8391c14ecde831be42d15bdc797c2b9ab30a8e90d7d53784e7add8e5bd5b6797a63e48efa0eb4d1df88ea8b388e94c6a15ac4e22447dad331244a38a5a2e294905611bfeadcac35f6ccf6af94191954c6b840a3092ef94d1e0e23019fbbdcd5b47e4a565ce42d0bbd7b14f9df1139c15ee4d687fe0861a8210071ebeb63606d28dcb5404e077400bd04453c49d0e2e0bb2700000046a4e564ba31c3d62f2d0fb6b7630f66f086e36885c3634a522888f1c4049361cfb8914f59073ba6a8a6ea283acfa3d3bc40e7a70f71b27686ac5307918ac06f1a396fe1accc74e9eabfea"], &(0x7f0000003ff6)='syzkaller\x00', 0x1, 0xc3, &(0x7f00000002c0)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_reuseport}, 0x48) r2 = socket(0x10, 0x800000000080002, 0x6) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000500)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01020000000000000000010000000900010073797a300000000058000000160a01000000000000000000010000000900010073797a30000000000900020073797a30000000002c00038008000140000000000800024000000000180003801400010076657468305f746f5f687372000000005c000000160a0101000b000000000000010000000900020073797a30000000000900010073797a3000000000300003802c0003801400010076657468305f746f5f687372"], 0xfc}}, 0x0) setsockopt$sock_attach_bpf(r2, 0x1, 0x34, &(0x7f00000000c0)=r1, 0x4) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) r5 = socket$kcm(0x2, 0x5, 0x84) sendmsg$inet(r5, &(0x7f0000000b00)={&(0x7f0000000340)={0x2, 0x4e20, @private=0xa010100}, 0x10, &(0x7f00000004c0)=[{&(0x7f0000000740)='!', 0x1}], 0x1}, 0x54) sendmsg$inet(r5, &(0x7f0000000280)={&(0x7f0000000140)={0x2, 0x4e23, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, &(0x7f0000000200)=[{&(0x7f0000000180)='W', 0x1}], 0x1}, 0x0) r6 = socket$kcm(0x10, 0x2, 0x4) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$gtp(&(0x7f0000000ac0), 0xffffffffffffffff) sendmsg$GTP_CMD_ECHOREQ(r7, &(0x7f0000000b80)={0x0, 0x0, &(0x7f0000000b40)={&(0x7f0000000b00)={0x14, r8, 0x1}, 0x14}}, 0x0) recvmsg(r6, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x10000) sendmsg$inet(r6, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000000)="5c00000014006b03000000d86e6c1d0002847ea622fb564500004e23e3f58e76110165f450e71b0075e3002500028d459e37000f0000000000bf9367b47e51f60a64c9f4d4938037e786a6d0bdd700"/92, 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r4, 0x10e, 0x1, &(0x7f0000000400)=0x1, 0x2c) sendmmsg(r2, &(0x7f0000000680)=[{{&(0x7f0000000100)=@ax25={{0x3, @default}, [@default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @null, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}]}, 0x80, &(0x7f0000000600)=[{&(0x7f0000000000)="9fd6b1417133ab031923647c6943806c08ed7ac021", 0x15}, {&(0x7f0000000180)="35de1471eebcea5cde1c8d81c849b1418608d8926f6fe97297cd4421bc02a49cb087f01acf31601c597f547ebab46eef14a576423dd984e30754f20f17bbdf244c72bade7a47258975fe4614f53c910f59ba1fd7a8cd942cd0c9bbfea10a4f4356a2a4812035093df91bcb177799b684ba051ef3846e6b19ed4dbc9ddae02f17cc812cfb56be9f2a53", 0x89}, {&(0x7f0000000440)="9a2e205124c700223df28e8c3ced1871e40e010d6513e45264d248878420039647a3852b82a026f28f3705e83b1a8aa11e8814b8f3e73a00c2619bfa87a2198bf0d624ad9e7f3c9afa6f48d721e40a671e55cb3d3b025db10ed14aca688d543d0b92e2302081098f52d0d809b22d704ed90cb600cce8653bf22a73d19a6ced7de6cadd2047e38603b1295d808ecae4560f0b3a061e4c", 0x96}, {&(0x7f0000000240)="47f8f0c041e461e094ddda189ff91a367a428c286c13f5b7c5bbaa8d0cf3ebedbe26b5207626a33bb8d0c89d6bcb869e7d05", 0x32}, {&(0x7f00000003c0)="cb73a6ce70e07903a9af4037ca", 0xd}, {&(0x7f0000000500)="366da9e5f8c7d4842efdc360e783041c7617abc7af123dde7919b51f2b735dedecc8297465dc30890ff6728a846c0dd13b7766f469182fe85e6a6636ff2f77", 0x3f}, {&(0x7f0000000540)="cd87c20245199e04a61823b42b87ce5562ae730967474cf60d1ede0b157700f8c26c7ea8083edff4e9246a59d850b087aa084f052b125d28ed03d0e132f8bb1fd2419990fc1ad8d1353f9e298db2bf79b9fe3fd7f51ad2c7b70ad5f9c4f14c8d066729426a41febb6d76468ecc0809e00eebac8e5d70d08df7447263108a84746f522d177dabc68d70b11aec534498eaa9c014ae35aec09482828fe263d9ad842962c8d4cef2885c2e6d2b2fa29b364769c24105a6b2dcba43", 0xb9}], 0x7, &(0x7f0000000bc0)=[{0x68, 0x11, 0x0, "96181e29a962a7dc60f26f4d82a94fc49efd2e237d4102589a30cc1ab7c4b7b420b6f2390333c750fd03840999b14feb68893d9713fa6b54e630b3f704c3d34ebf0638fa63d0f833b86fc31dcb18a4ea9bbe"}, {0x1010, 0xff, 0x6, "322e0f853bd0657937cb58d115dad9f1834b2a343a35b2894fbe1ceee64bb5ca5a73cd2b349b1a7c8f0dce4a6a9f2dd34effa3e06d3da37dc6234a9049071d3e2ac1781b0c61ffbcf311144e936a151b1f1d29a442c11c0871ce31e693f9b632994b0d990bcbfd3f1c93471bf2a3ca3a8f6919db5cd55ebb7b827aa882a47d8bf0342f3e3d13645a8c420fd4278691df6394bd342d7b87a23fc59c90191c1147e288e92cb58ee4a00a68af501c9d9ef75e2e4223a9c860171a6aa48c3e41874d289b4848dfd57870b0a5ad154e52f588c544d0aa9f0e7519ef24a9eef339bc55d1361d1a71070743e74c0736c78cfe24d87dc77cfe003e02d5fb0f2ea06255bbe49f9dd2e75e1f21325a38450e4b0d9d2b700d889ef1f090ec95b9459a3e4f3ecdb4d5392bacc037f55c8f57664d3f1fe2895b2b969bd11aab07c79c033727f0d6931842e51355c631f1ab18e6abb590489109c4121a7fddc80889144755d794c4275b08992ce587614a1ee16d3d020638c45d6ac1f9cece214e8c033ac4e464cb8b84f2ac9214fce4083539223ca3bd63e54e0106f41e3a5450335b612eeeba21cdd6bcef9af1cd310ccda6712708bed53ff9b9baadd256041bf333c58befcc0edbda09b0197a7a036eae3d77e7019bfb5d4a09dd61580752137e5b9a77b5be5d93365907cd7ca04891bfdf355dfcfd5a78e9f9d4b591e127531295c984e30f1ac0d05d951d29e8657dd8702110b0d86433643cd015819c6235b2d376db65c461e2242e3f902bf4c3b4e5b7491f47e8f01c9f3dc36943d43160b17588194544e2b5d81b32ce9635eaa33b800cc754f2087b7eb3001ec3aae300e84a5fd4c4e7be581745947794b7a921d99eef20465ae0ee5c953d4cb535457e39052d23075c7905f09205dc755edbf098f7a2689832636f6cf12f4f0fda202f997e413f7bcd7fdb015b6305b1114c699fc7c677490dd74b72187d0ba2639c62f2619f2759a109e3d90584b7edeeea4c36e6d790c67f3628b737de0fd5f6fd7e1631e1f573f1d02a9c871c41bce44962e7a6e22b5718521ac764d48e70bb65e522d8fc47a5df8644a59e87b9569b4ad6a42e33687b413d5de47926f53443520a0a16b1a85dd873ac7c431249863241104a01266c632a09328dc33cb4aa1a186da2d9f10574191f0e371145caac2b2139967902863d1dc2a932d71c71d16b30fad2dce261833992a64e65121f3ff6041c46f6956c71ef57cce1b5368508804d636674dd3f5f140fb5288742fe83aa92d5d59f526d42eae6d531862dd7f62165a38c9c2eca586ec67cb15105841641cccb487f2af6cfc45e899f1376e3e37919d57ee71d9d0c0d3433530b44639204adba44609fa12d9165674d9bfe53860e3c764f71aabbf4910aba1b63c9f20cbafe32b7386d84b2d6d71f2ca27c3a7c11357dbd48d4d0e679e628d6b6fec65ca1c7338b93ff05057b1f80fd5f4b5a0f5ab63e0a69ba22348a1d18679593a06f38b2014781fdb2445935bdb559a56a50d945c06be479dc2ac0bd3f8b9590b854f2acd84dd836ed03cf9108070cc6d6acd47e33ce60fde59658de9207c7f4455936e8086bf4ec9239e76cf6e31e7b93bca22bb7f0bcd2fa31d3d27bfa20466279cc35321bb09324285030aff3ebf085d2b50b434b5eb997b125a0bff16454c30ce1c5a123986483bc61e94430b270c82ffa41b515a754efde8e1c75ce348a0a9b8d9bf3736d0764f8ecfc90c99158f998d883e7bf7183a7fea79756fa537774b161ffd56ef1da42ee570177ab4bb3d8cd2ce998b1f877e85231b2d87b8fa72d4bc87ad54584c01dddbdc4584154c1a129f803ba952abb59a60f5ef88582173848f9a6ed24e1f980a16ab3d44f45a568976cb6c832297671a41483d245d29b624f9a3b2d664d0fd0f57cdb85a360230073bad8cfb0491fdccc891336a78fc51d71f6ab226202c87927d3b6c20c2ebc2889ac41f31e1c9c4a6aad94e83af56702c5feb275b9172835253a05603f36d5f07c9139d80c0cb5073e475e68c139b69db1f3eea1bc4de4f7b473cfd2960dd5252f3ddb987d05fae7bc4f0838aa42d2b0be341787acaa14c5de365bfe2b05b9938be8f1026751ac677808a224180b8fdca42aad598611dfc692e47dc9dc272b6e9617048b729cbb33b1b5d3b2c9b1d0ca199af73118dcef47adb0bb51ecf1738ba7659df8bc6221cc2b12f1186485b754a6d7b3481a34cce9ea0c77ac9483d69d478570f55fce9ded12ac24ce381838b122959f6e01a0ae29477b33af74c10d17738518f9763a1df64adba5b23ba22780a23bed6362b04f2557eb0a1196f2e9d4772835b58c1c24fc0344ec1d589fcf2c603bad88741ccfe0a4a06b4a42e060b8dc0bbe1d5a32f353f6e27a91f5d0ee29e3296a86b142fab8d6cf506674880f62712f27bd02ba337b4f9305d6998a532f5c1745468c6a9834cf2846eb5626d68e52eaec07447ea54599b1b2551e7267335fc01b0cb2fb76d5b8a9b7961009916292af6ef9b740a990eb32a36f2d30eb374f5bb82824d62078959bf903643a79ffc55b4f0dd96ccbcdd6ca26898677fc0e1843581166c4c619b827a3baa9bd7f4f2c29be72ba9edccb91816271ff0cf887ff465bdee739118b451324d019ecf006de0b2e51677988005bfa54ae3f1cef59dfee5a5d7e3658fab30e34e706fd445079a6f5828e1e09f635b5e48f93ae2b32ce1d165997859dc667b6193b63fd0866991704e0b2eb8d73f42772b01ddd43b0531838246a6a03e9cfd1681ef219d062e3bbf81bd0d01fc742e906f7f639a581591c5289bfca335a4f0656110556b3dcdc9d0a646328b502e2641181e1be289c8c055fa51f6db4ca809f11f18bf462e4c5989927196703b41d171178cfc6a6425681512b469c375e03ba043a7c03561a742bf3352d1fbedcc89dd3a44537ea3834dce3fbb8ed32aa0331c8528f3f0a87f70945c062132c3f215b4cbbc53999247ada82458499656eb00e4a3f992b7a8e9f04d2cd7ba36dc34019c5ed82e9b60aa0d53d472d56c136b1164b40a0b3a797bf7de617c09f02830ca526996dbe52ea282cee10b75b07f403ac6178136a4b72b83f1375283473af738c8551539caf2bfc388506806014d5ef28d7e7722bf4b6356b12af5f88604dc47584a4c01999739ed11e5bcb1ff676b34cfb9deae00e1caa8ed2dea6e4c7369f3b24aeb1d48214188a267f81330959a34dae5361417704a74a22b9d813c0aaadfa3107c17a1d460d2f1f4a6a1320d9846d7d8601de2917727d3e53e5791787f109919ec5d033b232ba72809fc5538d050e892aca1cc53d2321e427795d33cb5bb686e6c4f67269481316f7bbd9e8e4e8d9f15dc4579c2bd4e9d33a862e2951a0547d786f8462caea572cf7a49b1b025e3a1c2a27fce97c66efe316b4f9249800d89fd1b89cc1c0da178f4cdb86b9bbabb05fd056ec0d7e14e79fa9af93269975661d61840cf14bb9131dfaaf3ac0b8c2985d9f3e44a28d362b89ec7f09616fd044d717036185d4a590c990e5b782135cf95d8ba1046a13199353ad79d5152c2b97dc8e4b1612dd3ac0e76a6343ab2eedb87687acba3b1b2b1d6ad96b0fa6fe8116fecc30a4f1ca1de06f8d24dbfc907c1518232092dd0101054aef1b89db62c38b6573c0a6608234c407fe1e18d4668d481b97f478ad0f503d1ed6a955c835f1168f6ae9f3b8524282c603952e28b36a6da712da27db3802e23b2f5ebe8d05fbfa52c1236a99f2ac25141ad6bd8c2d0ba58efa7cc69fd7f6de8d5a166277e49f31df626112341e5849eb9b04e6a328c9c82a2f11c224b9c91fd8f25f07c5db17f86b250af0118859972d24421401d6a7c0a5b78cff9a91508be1989e1cfd01d18885df89f54f42627472b743403f12861b8578caabf844528ba7892fe83a8fb98392ca49f3ef924008a40a0881c918d88d10f0f99688cb1c4e36109ed7f21fbb720ac9245be53754b023ea3a80e4962659fd70f7255b27362f8fce158428c10500b9d93cba057bd32061160f12008eafbe285054cec30a1007a2aee2e54e73a1b2f6cd6b768cc69a77bda009b2ae6c83a06af1ab60f85f9d653c9f1655d8d5ae9c74698df86de867212ca6437e981273798053a04d820b70eb79f993ed457e379d4353caaf79d191685e2d206aef7df2285ca97e274f573f3c7165f837b2ffde50afef26842c6dcde01694cb48ecaeb40955307ca61be5722cd1b3526c65a12a2539153befc985e87c828534ba1e5b3ceeb3addb7371b532468a26b067d83feb26ed3d158c6bd35be1d88310e9a4e63f1853e8b75672037adfb1539e2e1a3f7ef6ef95fceae242de3a48e54a5f90b5b71811480ec6e81c63dd9da2f39bf0b4dbfe7001d27cfa00b7ffbf7585989884ba638c5bdea7cd1e0f26cddaec243e2b268b4d736667acfdcbf87106f18e133c2b173aa387a792b8e3045028afb0b02f82816c9b959d2b15400cf3607a12e555ebc7bf95fb6afa6feeb11147301ee15c9dd9ed40f900cfb7d078ea97126853d3c6523437cb77bfca0fb03e0782e8a0e1948193459d377992da0640069321eb1d6d86638a1601bc2e4f080f7553594de8a807ca799b1599c80a8646a771df9a7146b920b5dbdbc7bf6376d799e8ac9ebe8d1b5114c01091c9ff1de18f0d548fa2071555ff003a4635f234d4388bd6c4bbdeab3d5ed9c8dfcb9ba704f4689f05c20024ad7b94967b32cdc0d2e7014760623d3df79a3d5d084b90d595e0e332ae76d060773badcbc04d8c5f89ee5dc02851084d2dd54fcd3a0e27b331d65cb53d16b9367b4609ef32c84c010810dee4adceae36e15efe6cdfe66906ee8aa89446d78980f264c1f1c46244cfda09e4a2d4eb56a5a0fc4f00e5cd8f4fc8205930ad901bc529410fbd0be0bf7326cd7c60dbf485bd1fa0ae583d5941cc5148b931542381fe733fa6959616f717a6565c6bf799b9e2eff08283e924507baf53f4ec6bc062285a6ac61e210ab48480da94b65ed10f890cea6455ad5928c1a4f704d82990e7e9c5d03c0f68d1067182d9c6bf546ef3b7047b842ca7131509c89f80778479c433dbba04f4ad51f86c5b5760ce4030e83939e96b5d1b64af504507a120a39c50f0ead30dae123b911bfc4548bc72999cbe9e8cc8189e1c2e64e299d701a668695b36e42cc2d1b4eed807d00477f5bc0da8cb7731ec31110294e6526f6e9964e7c07eef24e78842c406a9e226984921d6f982c5e0bbf27c62034460a27d278e4ee2017ea31d1ff5f45d2ab445985cd31b693890a8bbbbd6d8307a185b909d060cbf60a7474011215d92f500f86a61d7a5ed9a09dcd2abd623ea78206941c1e2607877ea5a7df2d8d561c3df72d54808994f68546b96d5f1839e1b9242e889252443c1d862241fbc0967c926dfa4b9bd127a2f6207b5a143d8467815fab1dcc1f456411b7c415bf71c257f1bf8ce602c808fac76cf9ebdb8d83f13cc37fa4087e908ee14c4321d7fdb86ea2eb33fde30b8a205abe39f78125872aa099ad85e7aaff1be9ec60e4e9150039d6e6f9cbd8414a7ba0fac0b8e6c5cf2cc6f6f0a3af6e0ba235f0ead1effd1d57ce89ad0d0d6a1de5abc4d2d33191859e78d15d40e1a824d352f90a1087edbebf2a221cbce2fdb7bb7514cdd2c46a82633866a82ae150a97b0427fdb8407d8e14058fc085f4c3dee1d5f1327277a284c1d9d943f41ea5898525bfaa134efa6fef35dc33d2c17880175c7eb404b82279e811d101f6664cdc391781176769465a96b98f31ddd0ee344"}, {0x68, 0x84, 0x0, "34c83abc85b9d6f89ecc995a7e9dd481f14b96a4e347c49e6665ab73cc787308648ec255dbf97295f1a8713c5819a88295cc4f11f5f35369718b45417f7dee06dccfc51a7d7341bb4b707e83db4c70c9ee465231b46c42cb"}, {0x28, 0x117, 0x1, "82b8f061be035a5d87d9b74a2c3eb03a222f19a48f"}, {0x50, 0x111, 0x5, "6c21c78cb2686a6068c434149e2f49876daad820d9fd482fbe37e3be84caa4c733378b115fe3131e921a1fb0f638fe5f3fbcbdd50fe12eb0ec869cbf34"}, {0x80, 0x10d, 0x1c, "eb81d12e4336dd6118e4db5d3217ed1d96f3eb5e96daeacc7afa8a8018e50b353fe05252c7b56cf382cd06533a33cc4d4fc5dfc2c6289024e9cd43eb2bb142c2dbf37e5ba8edb90c6d28568e95a8a375ef83d29e061542d4ab0f1bcea241913e3b0d36abea49506c28"}, {0x20, 0x1, 0x7441f34b, "bbf092d3ce5677892e95ac0a"}, {0x100, 0x1, 0xfffffffa, "4722a6af3ba973cfe98327653f891a359bec462095116467315dc11235c6ed8481277e37232a1e2e68c1daa9ed533945905ce66e25c3cc379507e372c137df1d3807a7021d9c97bea00c96c10f3a812cf366614c48df45200cefa28bee0ceb20654338561f76e1351d8f4dafbd5c18a7ce80976c0e2567772a6f79b58144695e441745f7e365190aeed41f6bf881e68d7f61a81aa7f6b1dbccf61152de6614d9bc4a6481fd197e48d215b7d325310637becf88dc61d7eba3fe52d8bdea27101cefe72fa365057ab18936dd931cee772f6244425a5dac84e3b9e38c1466d98f54bc0aafb53aeba33641da7fff48d57bf0"}, {0x108, 0x1, 0x4, "f5e9b7f05c8efe925bfa5667f920d819c3f6e9c862d072396d3c531ff0376e50e9d2d80b028d3d007a0876700ad7fc2205334f8ee0950617f3cd48191e7298da4c20ea6dd1284b6c2bac89a2370df2e17861f69c8450e7274efa33d109da8a0e2ffb5c28dd9f12e77ce30438400424674c2964a656185e157d5a86391b70f348a11affd53935af0bedb8339ad7cfe28bd83ee995e398a8cb85f0d0043f17531e92574fb706b0314794e0a6b95695efeb892b718e5c4dd71c89203fd3285f7783013e6fe465b6fe533ccfe81db52de99bbbc43ebc565353cd4848874063adc876547386074c0d0a4c10bd55e72d9dc8c419ccf4b82b560a"}, {0x38, 0x1, 0x9, "cfc5289742196e9f57e8e11fa1f541b9d0dc364b047cb89fc823adf68fc87c8eb37abc6769e5b50e"}], 0x1438}}], 0x1, 0x0) r9 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r9, &(0x7f0000000280)=[{&(0x7f0000000040)="580000001400192340834b80040d8c5610067fbc45ff810540010000000058000b480400945f64009400050038925a01000000000000008004000000ffe809000000fff5dd0000000800030006010000418e01400004fcff", 0x58}], 0x1) 366.299665ms ago: executing program 0 (id=2260): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$l2tp(0x2, 0x2, 0x73) setsockopt$EBT_SO_SET_COUNTERS(r1, 0x0, 0x81, &(0x7f00000000c0)={'nat\x00', 0x0, 0x0, 0x0, [0x7, 0x9, 0x5, 0x7, 0x3], 0x1, &(0x7f0000000040)=[{}, {}, {}, {}, {}, {}], 0x0, [{}]}, 0x88) sendmsg$can_bcm(0xffffffffffffffff, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000540)={0x7, 0x0, 0x0, {0x0, 0x2710}, {0x77359400}, {}, 0x1, @canfd={{0x4, 0x0, 0x1, 0x1}, 0x7, 0x2, 0x0, 0x0, "a8a1f4ca7c78a954b1c552dd0c694cfb9602293ae990ec006080f3af9c8a0daf8b6b3b8d8872515970eb87b0d439267b81c9bcb68c54e503e21e9b5bd7df8755"}}, 0x80}}, 0x0) r2 = syz_genetlink_get_family_id$devlink(&(0x7f0000000dc0), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_TRAP_GET(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000000)=ANY=[@ANYRES8=r0, @ANYRES16=r2, @ANYBLOB="010000000000fbdbdf25270000000e0001006e657464657673696d0000000f0002006e657464657673696d3000001c0053"], 0x50}, 0x1, 0x0, 0x0, 0x24040011}, 0x800) 311.772389ms ago: executing program 3 (id=2261): r0 = bpf$ITER_CREATE(0x21, &(0x7f0000000000), 0x8) r1 = accept$phonet_pipe(0xffffffffffffffff, &(0x7f0000000040), &(0x7f0000000080)=0x10) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r1, &(0x7f00000000c0)={0x20000000}) r2 = accept4$nfc_llcp(r0, &(0x7f0000000100), &(0x7f0000000180)=0x60, 0x80000) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r2, &(0x7f00000001c0)) ioctl$sock_SIOCSIFVLAN_SET_VLAN_INGRESS_PRIORITY_CMD(r0, 0x8983, &(0x7f0000000200)={0x2, 'pimreg1\x00', {0x100}, 0xffff}) getsockopt$ax25_int(r0, 0x101, 0x7, &(0x7f0000000240), &(0x7f0000000280)=0x4) setsockopt$inet6_tcp_int(r0, 0x6, 0x1e, &(0x7f00000002c0)=0x3ff, 0x4) r3 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000580)={0x6, 0xc, &(0x7f0000000300)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x763}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x800}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x2}}]}, &(0x7f0000000380)='GPL\x00', 0x7b2, 0xde, &(0x7f00000003c0)=""/222, 0x41100, 0x52, '\x00', 0x0, 0x25, r0, 0x8, &(0x7f00000004c0)={0x9, 0x3}, 0x8, 0x10, 0x0, 0x0, 0x0, 0x0, 0x2, &(0x7f0000000500)=[r0], &(0x7f0000000540)=[{0x0, 0x5, 0xf, 0x7}, {0x2, 0x4, 0x8, 0xf}], 0x10, 0x3}, 0x94) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000740)={@map=r0, 0x1e, 0x1, 0x2117, &(0x7f0000000640)=[0x0, 0x0], 0x2, 0x0, &(0x7f0000000680)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f00000006c0)=[0x0, 0x0, 0x0, 0x0], &(0x7f0000000700)=[0x0, 0x0, 0x0], 0x0}, 0x40) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000007c0)={'team0\x00', 0x0}) r6 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000001980)={0x6, 0x18, &(0x7f0000000800)=@raw=[@kfunc={0x85, 0x0, 0x2, 0x0, 0x2}, @jmp={0x5, 0x1, 0x5, 0x3, 0x9, 0x2, 0x1}, @printk={@u, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xffffffff}}, @cb_func={0x18, 0x4, 0x4, 0x0, 0x6}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0xfffffff9}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @kfunc={0x85, 0x0, 0x2, 0x0, 0x4}, @btf_id={0x18, 0x4, 0x3, 0x0, 0x2}], &(0x7f00000008c0)='GPL\x00', 0xed, 0x1000, &(0x7f0000000900)=""/4096, 0x41000, 0x42, '\x00', 0x0, 0x25, r0, 0x8, 0x0, 0x0, 0x10, &(0x7f0000001900)={0x1, 0x6, 0x7, 0x5}, 0x10, 0x0, 0x0, 0x1, 0x0, &(0x7f0000001940)=[{0x0, 0x5, 0xd, 0x7}]}, 0x94) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000780)={@ifindex=r5, r3, 0xb, 0x0, r0, @void, @value=r6, @void, @void, r4}, 0x20) accept4$nfc_llcp(r2, &(0x7f0000001a40), &(0x7f0000001ac0)=0x60, 0x800) r7 = socket$inet_icmp_raw(0x2, 0x3, 0x1) listen(r7, 0x539e) socketpair(0x5, 0x1, 0xf, &(0x7f0000001b00)={0xffffffffffffffff, 0xffffffffffffffff}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_ax25_SIOCDELRT(r9, 0x890c, &(0x7f0000001b40)={@netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @default, 0x0, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}]}) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000001bc0)={0xffffffffffffffff}) sendmsg$nl_route(r8, &(0x7f0000001cc0)={&(0x7f0000001c00)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000001c80)={&(0x7f0000001c40)=@newlink={0x28, 0x10, 0x20, 0x70bd26, 0x25dfdbfc, {0x0, 0x0, 0x0, r5, 0x11114, 0x2000}, [@IFLA_OPERSTATE={0x5, 0x10, 0x81}]}, 0x28}, 0x1, 0x0, 0x0, 0x20008084}, 0x20004080) recvfrom$inet6(r9, &(0x7f0000001d00)=""/91, 0x5b, 0x2, 0x0, 0x0) getsockopt$ax25_int(r1, 0x101, 0x0, &(0x7f0000001d80), &(0x7f0000001dc0)=0x4) getsockopt$ax25_int(r9, 0x101, 0x9, &(0x7f0000001e00), &(0x7f0000001e40)=0x4) ioctl$BTRFS_IOC_INO_PATHS(r10, 0xc0389423, &(0x7f0000001ec0)={0x2, 0x8, [0x100000001, 0x9, 0x6, 0x3ff], &(0x7f0000001e80)=[0x0]}) r11 = syz_genetlink_get_family_id$devlink(&(0x7f0000001f40), r0) sendmsg$DEVLINK_CMD_RATE_SET(r0, &(0x7f00000020c0)={&(0x7f0000001f00)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000002080)={&(0x7f0000001f80)={0xe0, r11, 0x300, 0x70bd2b, 0x25dfdbfb, {}, [@DEVLINK_ATTR_RATE_NODE_NAME={0xab, 0xa8, @random="bfe86c717d889e2263d0f57998a5c0891bfc0d025ccb706ddfd1f7c74c87282997b0f2381da6b36aa43ec4e59d93b92d42153cd8a3e745b8eaaca97780b9e8b87f49617f9f377601faa109f5085498d759d8c18eda9094095d858eb412938706e520e78e20b433f0a924f75357a8cb2ab4af5c4ca8037622248db108129aec6652d27ead570e7de1b8c5a1c0c4b96682a5003975e923625e7a99de33139dbc5b2533c36734e809"}, @handle=@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}]}, 0xe0}, 0x1, 0x0, 0x0, 0x20000000}, 0x800) setsockopt$TIPC_MCAST_BROADCAST(r8, 0x10f, 0x85) setsockopt$MRT6_DEL_MFC_PROXY(r9, 0x29, 0xd3, &(0x7f0000002100)={{0xa, 0x4e20, 0xb57e, @remote, 0x3}, {0xa, 0x4e20, 0x20, @remote, 0x4f5a}, 0x1, {[0x6e, 0x6, 0xfffffff4, 0x8, 0x400, 0x0, 0x2, 0xd]}}, 0x5c) getsockopt$ax25_int(r9, 0x101, 0x7, &(0x7f0000002180), &(0x7f00000021c0)=0x4) 216.362926ms ago: executing program 1 (id=2262): r0 = socket$netlink(0x10, 0x3, 0x0) sendto$rxrpc(0xffffffffffffffff, &(0x7f0000000080)="e3710f00217d24965647c62556fdfd5a1c8fa69473fa99bc395b70edf18e3d94a3c2d0f4fdf009c830bb0000000000006e37126edf502069303187fde7bf2ad4841bdac1a83d6b8519b298517c", 0x4d, 0x24000884, 0x0, 0x0) (async) r1 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000100)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x18, 0x18, 0x4, [@func={0x5, 0x0, 0x0, 0xc, 0x2}, @func_proto]}, {0x0, [0x0, 0x5f]}}, 0x0, 0x34}, 0x28) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f0000000080)=ANY=[], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, r1, 0x8, &(0x7f00000000c0)={0x0, 0x1}, 0x8}, 0x94) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)=ANY=[@ANYBLOB="380000006c0015000000d9fece23b82004000000", @ANYRES32=r0, @ANYBLOB="000080000000000018003480050035"], 0x38}, 0x1, 0x300}, 0x0) 208.800204ms ago: executing program 0 (id=2263): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000012c0)={0x2c, 0x3e, 0x107, 0xfffffffe, 0x0, {0x1, 0x7c}, [@nested={0x4, 0x142}, @nested={0xc, 0x1, 0x0, 0x1, [@typed={0x6, 0x6, 0x0, 0x0, @str='\x80\n'}]}, @nested={0x8, 0x2, 0x0, 0x1, [@nested={0x4, 0x10}]}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) sendmsg$DEVLINK_CMD_TRAP_POLICER_GET(r0, &(0x7f0000000200)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f00000001c0)={&(0x7f0000000080)={0xf4, 0x0, 0x0, 0x70bd2c, 0x25dfdbfc, {}, [{@pci={{0x8}, {0x11}}, {0x8, 0x8e, 0x1}}, {@pci={{0x8}, {0x11}}, {0x8, 0x8e, 0x3}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x8e, 0x1}}, {@pci={{0x8}, {0x11}}, {0x8, 0x8e, 0x1}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x8e, 0x1}}, {@pci={{0x8}, {0x11}}, {0x8}}]}, 0xf4}, 0x1, 0x0, 0x0, 0x4001000}, 0x91) 92.944357ms ago: executing program 1 (id=2264): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) r2 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) connect$bt_l2cap(r2, &(0x7f0000000000)={0x1f, 0x8ef, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}, 0xe) syz_init_net_socket$bt_bnep(0x1f, 0x3, 0x4) (async) r3 = syz_init_net_socket$bt_bnep(0x1f, 0x3, 0x4) socket$nl_route(0x10, 0x3, 0x0) (async) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)=@newlink={0x5c, 0x10, 0x401, 0x70bd26, 0x0, {}, [@IFLA_LINKINFO={0x3c, 0x12, 0x0, 0x1, @ip6erspan={{0xe}, {0x28, 0x2, 0x0, 0x1, [@IFLA_GRE_ENCAP_DPORT={0x6, 0x11, 0x4e21}, @IFLA_GRE_ERSPAN_VER={0x5, 0x16, 0x2}, @IFLA_GRE_COLLECT_METADATA={0x4}, @IFLA_GRE_LINK={0x8}, @IFLA_GRE_ENCAP_SPORT={0x6, 0x10, 0x4e23}]}}}]}, 0x5c}}, 0x0) ioctl$sock_bt_bnep_BNEPCONNADD(r3, 0x400442c8, &(0x7f0000000540)=ANY=[@ANYRES32=r2]) ioctl$sock_bt_bnep_BNEPGETCONNLIST(r3, 0x800442d2, 0x0) (async) ioctl$sock_bt_bnep_BNEPGETCONNLIST(r3, 0x800442d2, 0x0) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='memory.swap.current\x00', 0x275a, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) (async) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r7 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r7, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r6, &(0x7f0000000280)={@val={0x0, 0x800}, @val={0x1, 0x0, 0x0, 0x0, 0x3d}, @mpls={[], @ipv4=@tcp={{0x6, 0x4, 0x0, 0x0, 0x40, 0x0, 0x0, 0x0, 0x84, 0x0, @empty=0x3fffffff, @local}, {{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x2, 0xb, 0x0, 0x0, 0x0, 0x4, {[@window={0xa, 0x3}, @timestamp={0x5, 0x2}, @generic={0x0, 0x2, "d58838068b91"}]}}}}}}, 0x4e) (async) write$tun(r6, &(0x7f0000000280)={@val={0x0, 0x800}, @val={0x1, 0x0, 0x0, 0x0, 0x3d}, @mpls={[], @ipv4=@tcp={{0x6, 0x4, 0x0, 0x0, 0x40, 0x0, 0x0, 0x0, 0x84, 0x0, @empty=0x3fffffff, @local}, {{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x2, 0xb, 0x0, 0x0, 0x0, 0x4, {[@window={0xa, 0x3}, @timestamp={0x5, 0x2}, @generic={0x0, 0x2, "d58838068b91"}]}}}}}}, 0x4e) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, r5, 0x0) r8 = socket$rds(0x15, 0x5, 0x0) setsockopt$RDS_RECVERR(r8, 0x114, 0x3f, 0x0, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000000)) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000180)={'veth1_macvtap\x00'}) (async) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000180)={'veth1_macvtap\x00', 0x0}) setsockopt$packet_add_memb(r1, 0x107, 0x1, &(0x7f0000000140)={r9, 0x1, 0x6}, 0x10) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)={0x0, 0x20}, 0x1, 0x0, 0x0, 0x20000080}, 0x0) 568.475µs ago: executing program 0 (id=2265): socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000b40)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r0, 0x8b04, &(0x7f0000000000)={'wg2\x00', @random="020000000100"}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000b40)) (async) ioctl$SIOCSIFHWADDR(r0, 0x8b04, &(0x7f0000000000)={'wg2\x00', @random="020000000100"}) (async) 0s ago: executing program 3 (id=2266): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000080)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_CQM(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000001100)={0x2c, r3, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @val={0xc, 0x99, {0x4, 0x6e}}}}, [@NL80211_ATTR_CQM={0x4}]}, 0x2c}}, 0x0) getsockopt$bt_hci(r0, 0x84, 0x82, &(0x7f0000000080)=""/4076, &(0x7f00000010c0)=0xfec) socket$nl_netfilter(0x10, 0x3, 0xc) r4 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000001080)={'wlan0\x00'}) bpf$PROG_LOAD(0x5, 0x0, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc2(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$TIPC_NL_LINK_GET(r5, &(0x7f00000002c0)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r7 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r7, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x2, 0x6, 0x750, 0x1b0, 0x0, 0x290, 0x290, 0x0, 0x680, 0x680, 0x680, 0x680, 0x680, 0x6, 0x0, {[{{@ipv6={@mcast1, @private1, [], [], 'pimreg0\x00', 'macvtap0\x00', {}, {}, 0x21}, 0x0, 0x188, 0x1b0, 0x0, {0x7a00000010000000}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @local, @mcast2, @private2}}, @common=@inet=@multiport={{0x50}}]}, @HL={0x28}}, {{@ipv6={@mcast2, @dev, [], [], 'veth1_macvtap\x00', 'veth1_vlan\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}, {{@ipv6={@ipv4, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0xa8, 0xd0, 0x48000000}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffc}}, {{@uncond, 0x0, 0xa8, 0xf0}, @SNPT={0x48, 'SNPT\x00', 0x0, {@ipv4, @ipv4=@loopback}}}, {{@uncond, 0x0, 0x208, 0x230, 0x0, {}, [@inet=@rpfilter={{0x28}}, @common=@rt={{0x138}, {0x0, [], 0x0, 0x0, 0x0, [@empty, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @private0, @empty, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @empty, @mcast2, @mcast2, @private1, @empty, @loopback, @ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}, @remote, @private1, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @private0]}}]}, @HL={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x7b0) r8 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x11, 0x6, &(0x7f0000001240)=ANY=[@ANYBLOB="050000000000000061110c00000000008510000002000000850000000500000095000000000000009500a5050000000077d8f3b423cdac8d80000000000000002be16ad10a48b243ccc42606d25dfd73a015e0ca7fc2506a0f7535f7866907dc6751dfb265a0e3ccae669e17fd6587d452d6453559c3421eed73d56615fe6c54c3b3ffe1b4ce25d7c983c044c03bf3a48dfe47ec9dd6c091c30b93bfae76d9ebacd3ed3e26e7a23129d6606fd28a69989d552af6bda9df2c3af36effff9af2551ce896165127cb3f011a7d06602e2fd52347125907000000000000003ed38ae89d24e1cebfba2f87925bfacba83109751fe6c05405d027edd68149ee99eef6a6992308a4fc0b7c70bc677d6dd4aed4af7500d7900a820b6347184e9a217b5614cd50cbe43a1ed2526814bc0000e9e086ce48e90defb6670c3df262ad0a97aec7291c25447c106a99893e10db21901eb397b2f5fd71400fa7a050fbbef9e326ea27e513e96068fd1e8a43e89f9c85c822a961546ed5363c17ff1432d08806bc376e3e49ee52b59d13182e1f24ed200ada12f7a1001500a710eb1affb87ba55b2d72078e9f40b4ae7d01000000d11cd22c35d32940000088dde499000000fdffffff000000000000000000000000000000000000000000000c52f4ebd2c893bb97a068bd10734a83584898eccb26f7b789cfc4cd995fa3e11a5c74c85404e2df3ad37b729ac83b0dcb4f48f3c3356b9997fc455a17690b6f7f9ccbe4b1701941b18a904c0e585a66c3b84b138efc20a546d3d5227e23b03f2a834391ad24fe7d9b20cf92cb151763d41f5c76e2ff3e93ee296c4082ee73e7e197253a2b66c353312c9d75711ce1623e9c54bdff59d2a69dcb7d84c235b23a4480c2461b405cfd1a38992f295ad3adc94cd07c850d1ce6d0b2fea02c24e9280333152fb794e4ddea02017a6c139b50101caecaf2abc0842b99a96fc4275ad107274e2934a87a4ddcdb112754ca5bdec0ead14b6c0f19a43a2f04c7f0be31491eb8c9ff68236c8600000000000000000000000066e034c81c3cab4e33fc8dc55ce0ada18dcbf31c6e82893add3bee3e10fc873d1d922b0877cbcd95b839d3059d5140a1f742f6e75741e39e5cb6a193e06a1043375b0f61b5d4e17c81baa31b924d84f2243471221c15fa12313ffbfa7c2730309f66705b71e6205e7cbf3643561eabb9a63fcd604d5cc27e1317ad94cf438d71873e540be16b6ca205081173bd03c4754fc4674812daab482fd390a1c903b5d28a1eb247b53c3fca5206cb0000003fdbbd3892c52c2e7612e05de32322e980a3d69931e2c9312dd517c96f2ee90362476ed853c4c9b7d4ebf13cbaa795860e92a3d7d004f2c491db38eb", @ANYRES64=r6], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2f, 0xffffffffffffffff, 0x6, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x800000}, 0x94) r9 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={0x0, r8}, 0x18) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000140)={r9, 0x34}, 0x10) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000040)=ANY=[], 0x27) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0x4000) recvmmsg(0xffffffffffffffff, &(0x7f0000000080)=[{{0x0, 0x0, 0x0}, 0x5}], 0x1, 0x2, 0x0) close(r5) syz_genetlink_get_family_id$tipc2(0x0, r5) sendmsg$TIPC_NL_KEY_SET(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x4}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x200e1054}, 0x801) r10 = socket$inet_tcp(0x2, 0x1, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r4, &(0x7f0000001680)={&(0x7f0000001140)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000001640)={&(0x7f00000011c0)={0x50, 0x0, 0x300, 0x70bd25, 0x25dfdbfd, {}, [@L2TP_ATTR_CONN_ID={0x8, 0x9, 0x4}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e21}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5}, @L2TP_ATTR_VLAN_ID={0x6, 0xe, 0x988}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x4}]}, 0x50}}, 0x10) setsockopt$IPT_SO_SET_REPLACE(r10, 0x0, 0x40, 0x0, 0x0) kernel console output (not intermixed with test programs): idge0: port 1(bridge_slave_0) entered forwarding state [ 78.414360][ T36] bridge0: port 2(bridge_slave_1) entered blocking state [ 78.421684][ T36] bridge0: port 2(bridge_slave_1) entered forwarding state [ 78.483189][ T5844] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 78.674030][ T5852] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 78.889282][ T5852] veth0_vlan: entered promiscuous mode [ 78.985032][ T5854] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 79.004379][ T5852] veth1_vlan: entered promiscuous mode [ 79.190611][ T5858] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 79.198908][ T5854] veth0_vlan: entered promiscuous mode [ 79.244447][ T5852] veth0_macvtap: entered promiscuous mode [ 79.253087][ T5854] veth1_vlan: entered promiscuous mode [ 79.274703][ T5852] veth1_macvtap: entered promiscuous mode [ 79.323851][ T5848] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 79.354828][ T5844] veth0_vlan: entered promiscuous mode [ 79.376046][ T5854] veth0_macvtap: entered promiscuous mode [ 79.387694][ T5844] veth1_vlan: entered promiscuous mode [ 79.399205][ T5852] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 79.413219][ T5854] veth1_macvtap: entered promiscuous mode [ 79.441548][ T5852] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 79.467163][ T5852] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 79.476632][ T5852] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 79.485918][ T5852] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 79.494777][ T5852] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 79.516802][ T5858] veth0_vlan: entered promiscuous mode [ 79.522581][ T51] Bluetooth: hci0: command tx timeout [ 79.565158][ T5854] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 79.583691][ T5844] veth0_macvtap: entered promiscuous mode [ 79.593014][ T5858] veth1_vlan: entered promiscuous mode [ 79.603470][ T5854] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 79.611506][ T51] Bluetooth: hci2: command tx timeout [ 79.623252][ T5844] veth1_macvtap: entered promiscuous mode [ 79.646610][ T5854] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 79.656543][ T5854] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 79.665977][ T5854] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 79.675062][ T5854] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 79.680546][ T51] Bluetooth: hci4: command tx timeout [ 79.684492][ T5847] Bluetooth: hci3: command tx timeout [ 79.694564][ T5849] Bluetooth: hci1: command tx timeout [ 79.739909][ T5844] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 79.787093][ T5844] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 79.807565][ T5848] veth0_vlan: entered promiscuous mode [ 79.826994][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 79.830944][ T5844] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 79.849779][ T5844] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 79.858505][ T5844] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 79.867841][ T5844] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 79.868258][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 79.933937][ T5858] veth0_macvtap: entered promiscuous mode [ 79.944731][ T5848] veth1_vlan: entered promiscuous mode [ 79.976962][ T5858] veth1_macvtap: entered promiscuous mode [ 80.002042][ T59] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 80.011119][ T59] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 80.026003][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 80.034550][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 80.056764][ T5858] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 80.123521][ T5858] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 80.157185][ T5852] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 80.163591][ T5858] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 80.185513][ T5858] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 80.194566][ T5858] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 80.204699][ T5858] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 80.224681][ T36] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 80.225421][ T5848] veth0_macvtap: entered promiscuous mode [ 80.238742][ T36] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 80.254131][ T5848] veth1_macvtap: entered promiscuous mode [ 80.369380][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 80.404397][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 80.455937][ T5848] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 80.504499][ T5848] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 80.514391][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 80.526089][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 80.544490][ T5848] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 80.553792][ T5848] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 80.566850][ T5848] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 80.576511][ T5967] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1'. [ 80.577117][ T5848] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 80.620952][ T1334] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 80.664776][ T1334] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 80.834592][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 80.851582][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 80.955870][ T1334] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 80.995735][ T1334] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 81.142403][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 81.154697][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 81.488742][ T5990] netlink: 'syz.0.8': attribute type 4 has an invalid length. [ 81.511507][ T5999] netlink: 268 bytes leftover after parsing attributes in process `syz.1.2'. [ 81.600276][ T5849] Bluetooth: hci0: command tx timeout [ 81.709670][ T5849] Bluetooth: hci2: command tx timeout [ 81.760143][ T5847] Bluetooth: hci1: command tx timeout [ 81.765612][ T5847] Bluetooth: hci3: command tx timeout [ 81.771483][ T5849] Bluetooth: hci4: command tx timeout [ 82.202006][ T6020] netlink: 12 bytes leftover after parsing attributes in process `syz.0.13'. [ 82.358080][ T6030] Zero length message leads to an empty skb [ 82.608048][ T6037] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 82.800349][ T6043] netlink: 'syz.4.21': attribute type 12 has an invalid length. [ 83.018182][ T6055] netlink: 'syz.2.24': attribute type 1 has an invalid length. [ 83.051728][ T6060] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 83.066156][ T6060] netlink: 165 bytes leftover after parsing attributes in process `syz.1.26'. [ 83.076966][ T6060] netlink: 165 bytes leftover after parsing attributes in process `syz.1.26'. [ 83.089306][ T6060] netlink: 165 bytes leftover after parsing attributes in process `syz.1.26'. [ 83.102932][ T6060] netlink: 165 bytes leftover after parsing attributes in process `syz.1.26'. [ 83.113249][ T6060] netlink: 165 bytes leftover after parsing attributes in process `syz.1.26'. [ 83.136160][ T6060] netlink: 165 bytes leftover after parsing attributes in process `syz.1.26'. [ 83.204093][ T6060] netlink: 165 bytes leftover after parsing attributes in process `syz.1.26'. [ 83.793906][ T6071] netlink: 'syz.4.25': attribute type 1 has an invalid length. [ 83.927952][ T6099] netlink: 'syz.2.33': attribute type 1 has an invalid length. [ 84.098266][ T6106] trusted_key: syz.1.37 sent an empty control message without MSG_MORE. [ 84.184688][ T6099] vlan2: entered allmulticast mode [ 84.199709][ T6099] veth1: entered allmulticast mode [ 84.311713][ T6117] netlink: 'syz.0.38': attribute type 12 has an invalid length. [ 84.345483][ T6120] sctp: [Deprecated]: syz.3.40 (pid 6120) Use of struct sctp_assoc_value in delayed_ack socket option. [ 84.345483][ T6120] Use struct sctp_sack_info instead [ 84.597000][ T6128] bridge_slave_0: left allmulticast mode [ 84.634684][ T6128] bridge_slave_0: left promiscuous mode [ 84.649699][ T6128] bridge0: port 1(bridge_slave_0) entered disabled state [ 84.731233][ T6128] bridge_slave_1: left allmulticast mode [ 84.738212][ T6128] bridge_slave_1: left promiscuous mode [ 84.769006][ T6128] bridge0: port 2(bridge_slave_1) entered disabled state [ 84.799707][ T6128] bond0: (slave bond_slave_0): Releasing backup interface [ 84.818388][ T6128] bond0: (slave bond_slave_1): Releasing backup interface [ 84.861482][ T6128] team0: Port device team_slave_0 removed [ 84.874984][ T6128] team0: Port device team_slave_1 removed [ 84.905568][ T6128] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 84.930912][ T6128] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 84.965018][ T6128] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 84.974692][ T6128] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 84.986799][ T6150] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 85.007636][ T6141] netlink: 'syz.1.47': attribute type 29 has an invalid length. [ 85.075659][ T6147] netlink: 'syz.1.47': attribute type 29 has an invalid length. [ 85.121912][ T6148] netlink: 'syz.1.47': attribute type 29 has an invalid length. [ 85.180341][ T6151] netlink: 'syz.1.47': attribute type 29 has an invalid length. [ 85.612094][ T6181] __nla_validate_parse: 37 callbacks suppressed [ 85.612110][ T6181] netlink: 12 bytes leftover after parsing attributes in process `syz.3.59'. [ 85.643706][ T6180] netlink: 28 bytes leftover after parsing attributes in process `syz.1.58'. [ 86.086369][ T6199] netlink: 784 bytes leftover after parsing attributes in process `syz.2.63'. [ 86.428143][ T6213] sctp: failed to load transform for md5: -2 [ 86.627429][ T6229] xt_connbytes: Forcing CT accounting to be enabled [ 86.657976][ T6229] Cannot find add_set index 0 as target [ 86.806331][ T981] cfg80211: failed to load regulatory.db [ 86.963114][ T6244] netlink: 4 bytes leftover after parsing attributes in process `syz.4.74'. [ 87.168438][ T6244] warning: `syz.4.74' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 87.628284][ T6265] netlink: 24 bytes leftover after parsing attributes in process `syz.4.78'. [ 87.664810][ T6271] sock: sock_timestamping_bind_phc: sock not bind to device [ 87.732959][ T6272] netlink: 40 bytes leftover after parsing attributes in process `syz.2.80'. [ 87.739804][ T6268] netlink: 24 bytes leftover after parsing attributes in process `syz.4.78'. [ 87.749359][ T6272] netlink: 8 bytes leftover after parsing attributes in process `syz.2.80'. [ 87.922878][ T6284] netlink: 12 bytes leftover after parsing attributes in process `syz.3.83'. [ 87.950107][ T6288] netlink: 12 bytes leftover after parsing attributes in process `syz.3.83'. [ 88.239808][ T5847] Bluetooth: hci4: command tx timeout [ 88.258749][ T6297] IPVS: set_ctl: invalid protocol: 50 224.0.0.1:20000 [ 88.630421][ T6326] netdevsim netdevsim2: Direct firmware load for -. failed with error -2 [ 88.679258][ T6326] netdevsim netdevsim2: Falling back to sysfs fallback for: -. [ 88.901279][ T6337] validate_nla: 2 callbacks suppressed [ 88.901297][ T6337] netlink: 'syz.0.95': attribute type 1 has an invalid length. [ 89.578984][ T6372] netlink: 'syz.2.103': attribute type 10 has an invalid length. [ 89.606027][ T6372] 8021q: adding VLAN 0 to HW filter on device team0 [ 89.637998][ T6372] bond0: (slave team0): Enslaving as an active interface with an up link [ 90.222199][ T6388] ipt_REJECT: TCP_RESET invalid for non-tcp [ 90.440270][ T6416] netlink: 'syz.4.118': attribute type 1 has an invalid length. [ 90.448156][ T6416] netlink: 'syz.4.118': attribute type 2 has an invalid length. [ 90.469962][ T6417] netlink: 'syz.1.119': attribute type 15 has an invalid length. [ 90.665959][ T6428] Unknown options in mask 1f4 [ 90.880224][ T6436] __nla_validate_parse: 7 callbacks suppressed [ 90.880242][ T6436] netlink: 24 bytes leftover after parsing attributes in process `syz.1.124'. [ 90.943352][ T6436] netlink: 24 bytes leftover after parsing attributes in process `syz.1.124'. [ 91.299698][ T5847] Bluetooth: hci2: command tx timeout [ 91.320811][ T6464] nft_compat: unsupported protocol 0 [ 91.749253][ T6484] netlink: 12 bytes leftover after parsing attributes in process `syz.1.139'. [ 91.809769][ T6484] nbd: must specify at least one socket [ 92.145049][ T6506] netlink: 8 bytes leftover after parsing attributes in process `syz.4.147'. [ 92.179259][ T6506] netlink: 12 bytes leftover after parsing attributes in process `syz.4.147'. [ 92.200796][ T6506] netlink: 'syz.4.147': attribute type 14 has an invalid length. [ 92.326641][ T6512] netlink: 248 bytes leftover after parsing attributes in process `syz.3.148'. [ 92.343622][ T6509] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 92.398989][ T6514] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 92.748730][ T6539] x_tables: unsorted underflow at hook 3 [ 92.779485][ T6541] x_tables: unsorted underflow at hook 3 [ 92.937542][ T6544] netlink: 12 bytes leftover after parsing attributes in process `syz.1.158'. [ 93.095761][ T6547] netlink: 132 bytes leftover after parsing attributes in process `syz.3.159'. [ 93.121302][ T6547] netlink: 40 bytes leftover after parsing attributes in process `syz.3.159'. [ 93.139089][ T6553] netlink: 4 bytes leftover after parsing attributes in process `syz.4.161'. [ 93.593985][ T6578] IPVS: set_ctl: invalid protocol: 0 0.0.0.0:0 [ 93.607491][ T6578] IPVS: set_ctl: invalid protocol: 0 0.0.0.0:0 [ 94.018800][ T6597] ip6_vti0: entered allmulticast mode [ 95.747024][ T6668] netlink: 'syz.1.191': attribute type 3 has an invalid length. [ 96.074565][ T6691] __nla_validate_parse: 5 callbacks suppressed [ 96.074581][ T6691] netlink: 23 bytes leftover after parsing attributes in process `syz.2.196'. [ 96.207276][ T6698] netlink: 12 bytes leftover after parsing attributes in process `syz.3.197'. [ 96.298696][ T6700] unsupported nla_type 52263 [ 96.335436][ T6698] 8021q: adding VLAN 0 to HW filter on device bond1 [ 96.380856][ T6709] 8021q: VLANs not supported on caif0 [ 96.525678][ T6715] netlink: 'syz.4.205': attribute type 7 has an invalid length. [ 96.547183][ T6715] netlink: 'syz.4.205': attribute type 8 has an invalid length. [ 96.559176][ T6715] netlink: 'syz.4.205': attribute type 2 has an invalid length. [ 96.588164][ T6715] netlink: 4 bytes leftover after parsing attributes in process `syz.4.205'. [ 96.733166][ T6729] netlink: 260 bytes leftover after parsing attributes in process `syz.2.207'. [ 96.768007][ T6730] netlink: 260 bytes leftover after parsing attributes in process `syz.2.207'. [ 96.774465][ T6722] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 96.955055][ T6722] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 97.012414][ T6741] netlink: 16 bytes leftover after parsing attributes in process `syz.2.209'. [ 97.101874][ T6722] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 97.179066][ T6746] xt_CT: You must specify a L4 protocol and not use inversions on it [ 97.392671][ T6722] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 97.433466][ T6763] netlink: 8 bytes leftover after parsing attributes in process `syz.2.214'. [ 97.442839][ T6757] netlink: 40 bytes leftover after parsing attributes in process `syz.0.203'. [ 97.453399][ T6757] netlink: 40 bytes leftover after parsing attributes in process `syz.0.203'. [ 97.673950][ T6722] netdevsim netdevsim4 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 97.689137][ T6776] netlink: 'syz.2.216': attribute type 10 has an invalid length. [ 97.726200][ T6722] netdevsim netdevsim4 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 97.765240][ T6776] team0: Device ipvlan1 failed to register rx_handler [ 97.827720][ T6722] netdevsim netdevsim4 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 97.902177][ T6722] netdevsim netdevsim4 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 97.948394][ T6785] netlink: 104 bytes leftover after parsing attributes in process `syz.2.219'. [ 98.211243][ T6797] netlink: 'syz.2.223': attribute type 39 has an invalid length. [ 98.594300][ T6816] dvmrp0: entered allmulticast mode [ 98.649339][ T6819] dvmrp0: left allmulticast mode [ 98.842729][ T6826] sctp: [Deprecated]: syz.2.232 (pid 6826) Use of struct sctp_assoc_value in delayed_ack socket option. [ 98.842729][ T6826] Use struct sctp_sack_info instead [ 99.606178][ T6863] syz.2.244 uses obsolete (PF_INET,SOCK_PACKET) [ 99.886935][ T6874] gretap1: entered promiscuous mode [ 99.931739][ T6873] pimreg7: entered allmulticast mode [ 100.136577][ T6890] netdevsim netdevsim0 netdevsim0: entered promiscuous mode [ 100.375896][ T6901] openvswitch: netlink: IPv4 tunnel dst address is zero [ 100.472900][ T5910] IPVS: starting estimator thread 0... [ 100.505726][ T6905] pim6reg: entered allmulticast mode [ 100.619843][ T6906] IPVS: using max 33 ests per chain, 79200 per kthread [ 100.907968][ T6918] bridge0: entered allmulticast mode [ 101.056407][ T6927] bridge_slave_1: left allmulticast mode [ 101.097873][ T6927] bridge_slave_1: left promiscuous mode [ 101.139378][ T6927] bridge0: port 2(bridge_slave_1) entered disabled state [ 101.225148][ T6927] bridge_slave_0: left allmulticast mode [ 101.249678][ T6927] bridge_slave_0: left promiscuous mode [ 101.259221][ T6927] bridge0: port 1(bridge_slave_0) entered disabled state [ 101.288407][ T6946] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 101.398527][ T6940] sit0: Master is either lo or non-ether device [ 101.615510][ T6961] netlink: 'syz.3.276': attribute type 25 has an invalid length. [ 101.632755][ T6961] netlink: 'syz.3.276': attribute type 1 has an invalid length. [ 101.641771][ T6961] bridge0: port 1(bridge_slave_0) entered learning state [ 101.876868][ T6975] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 101.933363][ T6978] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 101.941163][ T6978] IPv6: NLM_F_CREATE should be set when creating new route [ 102.032087][ T6985] __nla_validate_parse: 76 callbacks suppressed [ 102.032105][ T6985] netlink: 16 bytes leftover after parsing attributes in process `syz.1.283'. [ 102.083441][ T6985] netlink: 16 bytes leftover after parsing attributes in process `syz.1.283'. [ 102.275476][ T6998] netlink: 'syz.3.286': attribute type 1 has an invalid length. [ 102.298813][ T6998] netlink: 'syz.3.286': attribute type 1 has an invalid length. [ 102.623434][ T7011] netlink: 'syz.1.290': attribute type 8 has an invalid length. [ 103.331668][ T7052] netlink: 4 bytes leftover after parsing attributes in process `syz.1.303'. [ 103.522296][ T7064] tunl0: entered promiscuous mode [ 103.548220][ T7064] netlink: 'syz.2.306': attribute type 3 has an invalid length. [ 103.563708][ T7064] netlink: 9 bytes leftover after parsing attributes in process `syz.2.306'. [ 103.577099][ T7068] netlink: 12 bytes leftover after parsing attributes in process `syz.2.306'. [ 103.596178][ T7069] netlink: 24 bytes leftover after parsing attributes in process `syz.1.308'. [ 103.782666][ T7077] bridge0: entered allmulticast mode [ 103.943348][ T7081] netlink: 96 bytes leftover after parsing attributes in process `syz.1.313'. [ 104.115217][ T7102] IPVS: set_ctl: invalid protocol: 29 172.20.20.187:20004 [ 104.135294][ T7101] netlink: 12 bytes leftover after parsing attributes in process `syz.1.317'. [ 104.345410][ T3139] tipc: Subscription rejected, illegal request [ 104.659771][ T7130] raw_sendmsg: syz.2.325 forgot to set AF_INET. Fix it! [ 104.702330][ T7132] netlink: 'syz.1.327': attribute type 1 has an invalid length. [ 104.826343][ T7135] netlink: 'syz.3.328': attribute type 32 has an invalid length. [ 104.838535][ T7135] netlink: 8 bytes leftover after parsing attributes in process `syz.3.328'. [ 104.866081][ T7132] veth3: entered promiscuous mode [ 104.878054][ T7132] bond2: (slave veth3): Enslaving as a backup interface with a down link [ 104.889075][ T7135] (unnamed net_device) (uninitialized): option coupled_control: invalid value (8) [ 104.906498][ T7140] xt_NFQUEUE: number of total queues is 0 [ 104.918440][ T7144] xt_policy: output policy not valid in PREROUTING and INPUT [ 105.038899][ T7150] netlink: 28 bytes leftover after parsing attributes in process `syz.1.332'. [ 105.554052][ T7174] netlink: 'syz.4.342': attribute type 21 has an invalid length. [ 105.588126][ T7174] netlink: 'syz.4.342': attribute type 6 has an invalid length. [ 106.110776][ T7195] ip6gretap0: entered promiscuous mode [ 106.117682][ T7195] batadv_slave_1: entered promiscuous mode [ 106.359946][ T7208] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 106.755725][ T7228] validate_nla: 1 callbacks suppressed [ 106.755741][ T7228] netlink: 'syz.3.360': attribute type 8 has an invalid length. [ 106.904065][ T7223] netlink: 'syz.4.359': attribute type 3 has an invalid length. [ 107.153423][ T7240] __nla_validate_parse: 9 callbacks suppressed [ 107.153440][ T7240] netlink: 16 bytes leftover after parsing attributes in process `syz.0.363'. [ 107.200450][ T7241] netlink: 4 bytes leftover after parsing attributes in process `syz.0.363'. [ 107.242597][ T7241] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 107.251681][ T7241] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 107.273882][ T7241] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 107.299166][ T7241] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 107.344735][ T7252] IPVS: set_ctl: invalid protocol: 59 224.0.0.1:20004 [ 107.495944][ T7260] netlink: 165 bytes leftover after parsing attributes in process `syz.1.372'. [ 107.598955][ T7264] netlink: 'syz.3.373': attribute type 10 has an invalid length. [ 107.642070][ T7264] bridge0: port 2(bridge_slave_1) entered disabled state [ 107.680997][ T7264] bridge_slave_1: left allmulticast mode [ 107.690281][ T7264] bridge_slave_1: left promiscuous mode [ 107.696121][ T7264] bridge0: port 2(bridge_slave_1) entered disabled state [ 107.741907][ T7277] xt_hashlimit: size too large, truncated to 1048576 [ 107.787489][ T7264] bond0: (slave bridge_slave_1): Enslaving as an active interface with an up link [ 107.857586][ T7278] netlink: 24 bytes leftover after parsing attributes in process `syz.2.377'. [ 107.860935][ T7279] : renamed from bridge_slave_0 (while UP) [ 108.017611][ T7289] netlink: 32 bytes leftover after parsing attributes in process `syz.2.377'. [ 108.424093][ T7311] netlink: 48 bytes leftover after parsing attributes in process `syz.1.385'. [ 108.563263][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 108.815028][ T978] IPVS: starting estimator thread 0... [ 108.864568][ T7340] netlink: 24 bytes leftover after parsing attributes in process `syz.2.393'. [ 108.910452][ T7338] IPVS: using max 26 ests per chain, 62400 per kthread [ 109.001571][ T7347] sctp: [Deprecated]: syz.3.394 (pid 7347) Use of int in max_burst socket option deprecated. [ 109.001571][ T7347] Use struct sctp_assoc_value instead [ 109.057954][ T7352] netlink: 4 bytes leftover after parsing attributes in process `syz.1.396'. [ 109.248225][ T7362] netlink: 'syz.0.399': attribute type 13 has an invalid length. [ 109.266659][ T7362] netlink: 12 bytes leftover after parsing attributes in process `syz.0.399'. [ 109.294028][ T7362] openvswitch: netlink: Flow actions attr not present in new flow. [ 109.447937][ T7367] netlink: 'syz.0.399': attribute type 5 has an invalid length. [ 109.551731][ T7382] netlink: 12 bytes leftover after parsing attributes in process `syz.1.404'. [ 109.773703][ T7398] netlink: 'syz.4.408': attribute type 1 has an invalid length. [ 109.796202][ T7398] netlink: 'syz.4.408': attribute type 2 has an invalid length. [ 109.857697][ T7399] netlink: 'syz.1.409': attribute type 2 has an invalid length. [ 110.042931][ T7408] x_tables: arp_tables: MARK.2 target: invalid size 8 (kernel) != (user) 0 [ 110.519358][ T7430] tc_dump_action: action bad kind [ 110.804131][ T7438] bridge0: port 1(bridge_slave_0) entered disabled state [ 110.996216][ T7438] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 111.018623][ T7438] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 111.103312][ T7438] netdevsim netdevsim3 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 111.114517][ T7438] netdevsim netdevsim3 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 111.125927][ T7438] netdevsim netdevsim3 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 111.135120][ T7438] netdevsim netdevsim3 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 111.350914][ T7466] netlink: 'syz.2.426': attribute type 29 has an invalid length. [ 111.373166][ T7466] netlink: 'syz.2.426': attribute type 29 has an invalid length. [ 111.856794][ T7493] netlink: 'syz.0.433': attribute type 2 has an invalid length. [ 112.044504][ T7505] netlink: 'syz.3.438': attribute type 11 has an invalid length. [ 112.206940][ T7514] __nla_validate_parse: 10 callbacks suppressed [ 112.206959][ T7514] netlink: 4 bytes leftover after parsing attributes in process `syz.3.441'. [ 112.245912][ T7514] netlink: 12 bytes leftover after parsing attributes in process `syz.3.441'. [ 112.436140][ T7524] bridge1: entered promiscuous mode [ 112.479686][ T7524] bridge1: entered allmulticast mode [ 112.492332][ T7529] netlink: 12 bytes leftover after parsing attributes in process `syz.1.444'. [ 112.506145][ T7529] netlink: 12 bytes leftover after parsing attributes in process `syz.1.444'. [ 112.524301][ T7529] bridge0: port 3(vlan2) entered blocking state [ 112.531836][ T7529] bridge0: port 3(vlan2) entered disabled state [ 112.538453][ T7529] vlan2: entered allmulticast mode [ 112.546033][ T7529] bridge0: entered allmulticast mode [ 112.572898][ T7529] vlan2: left allmulticast mode [ 112.594182][ T7529] bridge0: left allmulticast mode [ 112.613824][ T7534] netlink: 4 bytes leftover after parsing attributes in process `syz.3.445'. [ 112.634528][ T7534] bridge_slave_0: left allmulticast mode [ 112.642991][ T7534] bridge_slave_0: left promiscuous mode [ 112.648805][ T7534] bridge0: port 1(bridge_slave_0) entered disabled state [ 112.735441][ T7543] netlink: 8 bytes leftover after parsing attributes in process `syz.2.446'. [ 112.897147][ T7550] netlink: 'syz.0.449': attribute type 1 has an invalid length. [ 112.940233][ T7550] netlink: 220 bytes leftover after parsing attributes in process `syz.0.449'. [ 112.969483][ T7550] netlink: 'syz.0.449': attribute type 1 has an invalid length. [ 112.999478][ T7555] Bluetooth: MGMT ver 1.23 [ 113.446164][ T7578] xt_hashlimit: invalid rate [ 113.577657][ T7588] openvswitch: netlink: VXLAN extension 1 has unexpected len 0 expected 4 [ 113.674877][ T7597] netlink: 4 bytes leftover after parsing attributes in process `syz.0.461'. [ 113.699241][ T7597] netlink: 20 bytes leftover after parsing attributes in process `syz.0.461'. [ 113.715519][ T7597] netlink: 20 bytes leftover after parsing attributes in process `syz.0.461'. [ 113.890575][ T7606] tunl0: left promiscuous mode [ 113.994988][ T7616] syz.3.466: vmalloc error: size 8589938688, exceeds total pages, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 114.014503][ T7606] bridge0: left allmulticast mode [ 114.016895][ T7616] CPU: 1 UID: 0 PID: 7616 Comm: syz.3.466 Not tainted 6.16.0-rc5-syzkaller-00186-ga059ef8e8889 #0 PREEMPT(full) [ 114.016921][ T7616] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 114.016939][ T7616] Call Trace: [ 114.016947][ T7616] [ 114.016956][ T7616] dump_stack_lvl+0x189/0x250 [ 114.016989][ T7616] ? __pfx_dump_stack_lvl+0x10/0x10 [ 114.017011][ T7616] ? __pfx__printk+0x10/0x10 [ 114.017034][ T7616] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 114.017058][ T7616] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 114.017083][ T7616] ? cpuset_print_current_mems_allowed+0x2ee/0x360 [ 114.017107][ T7616] warn_alloc+0x214/0x310 [ 114.017130][ T7616] ? stack_depot_save_flags+0x40/0x900 [ 114.017169][ T7616] ? __pfx_warn_alloc+0x10/0x10 [ 114.017194][ T7616] ? kasan_save_track+0x4f/0x80 [ 114.017214][ T7616] ? xskq_create+0x56/0x170 [ 114.017238][ T7616] ? xsk_init_queue+0xb0/0x110 [ 114.017259][ T7616] ? xsk_setsockopt+0x43f/0x710 [ 114.017280][ T7616] ? do_sock_setsockopt+0x25a/0x3e0 [ 114.017299][ T7616] ? __x64_sys_setsockopt+0x18b/0x220 [ 114.017317][ T7616] ? do_syscall_64+0xfa/0x3b0 [ 114.017333][ T7616] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 114.017358][ T7616] __vmalloc_node_range_noprof+0x125/0x12f0 [ 114.017409][ T7616] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 114.017438][ T7616] ? __kasan_kmalloc+0x93/0xb0 [ 114.017460][ T7616] vmalloc_user_noprof+0xad/0xf0 [ 114.017482][ T7616] ? xskq_create+0xbf/0x170 [ 114.017507][ T7616] xskq_create+0xbf/0x170 [ 114.017534][ T7616] xsk_init_queue+0xb0/0x110 [ 114.017560][ T7616] xsk_setsockopt+0x43f/0x710 [ 114.017586][ T7616] ? __pfx_xsk_setsockopt+0x10/0x10 [ 114.017608][ T7616] ? __lock_acquire+0xab9/0xd20 [ 114.017636][ T7616] ? bpf_lsm_socket_setsockopt+0x9/0x20 [ 114.017659][ T7616] ? __pfx_xsk_setsockopt+0x10/0x10 [ 114.017684][ T7616] do_sock_setsockopt+0x25a/0x3e0 [ 114.017708][ T7616] ? __pfx_do_sock_setsockopt+0x10/0x10 [ 114.017733][ T7616] ? __fget_files+0x2a/0x420 [ 114.017765][ T7616] __x64_sys_setsockopt+0x18b/0x220 [ 114.017793][ T7616] do_syscall_64+0xfa/0x3b0 [ 114.017809][ T7616] ? lockdep_hardirqs_on+0x9c/0x150 [ 114.017833][ T7616] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 114.017853][ T7616] ? clear_bhb_loop+0x60/0xb0 [ 114.017874][ T7616] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 114.017891][ T7616] RIP: 0033:0x7f60cfd8e929 [ 114.017912][ T7616] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 114.017926][ T7616] RSP: 002b:00007f60d0c9a038 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 114.017944][ T7616] RAX: ffffffffffffffda RBX: 00007f60cffb5fa0 RCX: 00007f60cfd8e929 [ 114.017957][ T7616] RDX: 0000000000000006 RSI: 000000000000011b RDI: 0000000000000004 [ 114.017968][ T7616] RBP: 00007f60cfe10b39 R08: 0000000000000004 R09: 0000000000000000 [ 114.017979][ T7616] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000000 [ 114.017991][ T7616] R13: 0000000000000000 R14: 00007f60cffb5fa0 R15: 00007ffdc3ad7558 [ 114.018020][ T7616] [ 114.018103][ T7616] Mem-Info: [ 114.329874][ T7616] active_anon:5791 inactive_anon:0 isolated_anon:0 [ 114.329874][ T7616] active_file:1257 inactive_file:39834 isolated_file:0 [ 114.329874][ T7616] unevictable:768 dirty:55 writeback:0 [ 114.329874][ T7616] slab_reclaimable:10182 slab_unreclaimable:97038 [ 114.329874][ T7616] mapped:30242 shmem:1364 pagetables:1258 [ 114.329874][ T7616] sec_pagetables:0 bounce:0 [ 114.329874][ T7616] kernel_misc_reclaimable:0 [ 114.329874][ T7616] free:1334962 free_pcp:13738 free_cma:0 [ 114.383523][ T7616] Node 0 active_anon:23264kB inactive_anon:0kB active_file:5028kB inactive_file:159132kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:120968kB dirty:220kB writeback:0kB shmem:3920kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:12372kB pagetables:5004kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 114.455199][ T7616] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:48kB pagetables:128kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 114.491300][ T7616] Node 0 DMA free:15360kB boost:0kB min:204kB low:252kB high:300kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 114.521943][ T7616] lowmem_reserve[]: 0 2498 2500 2500 2500 [ 114.527976][ T7616] Node 0 DMA32 free:1429816kB boost:0kB min:34248kB low:42808kB high:51368kB reserved_highatomic:0KB free_highatomic:0KB active_anon:22916kB inactive_anon:0kB active_file:5028kB inactive_file:157568kB unevictable:1536kB writepending:220kB present:3129332kB managed:2558392kB mlocked:0kB bounce:0kB free_pcp:35388kB local_pcp:12704kB free_cma:0kB [ 114.563895][ T7616] lowmem_reserve[]: 0 0 1 1 1 [ 114.568941][ T7616] Node 0 Normal free:24kB boost:0kB min:20kB low:24kB high:28kB reserved_highatomic:0KB free_highatomic:0KB active_anon:48kB inactive_anon:0kB active_file:0kB inactive_file:1564kB unevictable:0kB writepending:0kB present:1048580kB managed:1644kB mlocked:0kB bounce:0kB free_pcp:8kB local_pcp:8kB free_cma:0kB [ 114.609384][ T7616] lowmem_reserve[]: 0 0 0 0 0 [ 114.615474][ T7616] Node 1 Normal free:3894348kB boost:0kB min:55632kB low:69540kB high:83448kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:1536kB writepending:0kB present:4194300kB managed:4111164kB mlocked:0kB bounce:0kB free_pcp:20352kB local_pcp:12896kB free_cma:0kB [ 114.648506][ T7616] lowmem_reserve[]: 0 0 0 0 0 [ 114.654016][ T7616] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 114.668033][ T7616] Node 0 DMA32: 466*4kB (UME) 381*8kB (UME) 201*16kB (UME) 353*32kB (UME) 73*64kB (UM) 14*128kB (UM) 21*256kB (UM) 12*512kB (UME) 8*1024kB (UME) 6*2048kB (ME) 335*4096kB (M) = 1430048kB [ 114.687243][ T7616] Node 0 Normal: 0*4kB 1*8kB (M) 1*16kB (M) 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 24kB [ 114.700485][ T7616] Node 1 Normal: 183*4kB (UE) 42*8kB (UME) 44*16kB (UME) 53*32kB (UME) 25*64kB (UME) 7*128kB (UME) 5*256kB (UME) 4*512kB (UME) 2*1024kB (UM) 2*2048kB (UE) 947*4096kB (M) = 3894348kB [ 114.723750][ T7616] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 114.734792][ T7616] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 114.749137][ T7616] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 114.759242][ T7606] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 114.759739][ T7616] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 114.769387][ T7606] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 114.778804][ T7616] 42451 total pagecache pages [ 114.791151][ T7606] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 114.791958][ T7616] 0 pages in swap cache [ 114.804538][ T7606] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 114.804906][ T7616] Free swap = 124996kB [ 114.824473][ T7616] Total swap = 124996kB [ 114.828850][ T7616] 2097051 pages RAM [ 114.833360][ T7616] 0 pages HighMem/MovableOnly [ 114.838177][ T7616] 425411 pages reserved [ 114.844656][ T7616] 0 pages cma reserved [ 114.893767][ T7606] bridge1: left promiscuous mode [ 114.898743][ T7606] bridge1: left allmulticast mode [ 115.198719][ T7644] openvswitch: netlink: Unexpected mask (mask=440, allowed=10048) [ 115.218703][ T7645] netlink: 'syz.1.472': attribute type 10 has an invalid length. [ 115.231201][ T7645] veth1_vlan: entered allmulticast mode [ 115.293647][ T7645] team0: Device veth1_vlan failed to register rx_handler [ 115.355247][ T7650] tipc: Started in network mode [ 115.364090][ T7650] tipc: Node identity aaaaaaaaaa2e, cluster identity 4711 [ 115.372945][ T7650] tipc: Enabled bearer , priority 10 [ 115.613991][ T7666] geneve2: entered promiscuous mode [ 115.624964][ T7666] geneve2: entered allmulticast mode [ 115.795043][ T7686] netlink: 'syz.3.486': attribute type 11 has an invalid length. [ 116.102750][ T7700] openvswitch: netlink: Flow key attr not present in new flow. [ 116.233382][ T7703] netlink: zone id is out of range [ 116.238593][ T7703] netlink: zone id is out of range [ 116.247906][ T7703] netlink: zone id is out of range [ 116.253212][ T7703] netlink: get zone limit has 8 unknown bytes [ 116.493334][ T978] tipc: Node number set to 8694442 [ 117.137864][ T7724] netlink: 'syz.1.497': attribute type 83 has an invalid length. [ 117.301030][ T7729] __nla_validate_parse: 7 callbacks suppressed [ 117.301046][ T7729] netlink: 16 bytes leftover after parsing attributes in process `syz.1.500'. [ 117.331468][ T7732] netlink: 'syz.2.501': attribute type 1 has an invalid length. [ 117.359447][ T7733] netlink: 40 bytes leftover after parsing attributes in process `syz.0.502'. [ 117.380373][ T7733] netlink: 64 bytes leftover after parsing attributes in process `syz.0.502'. [ 117.614311][ T7748] veth0: entered promiscuous mode [ 117.740691][ T7747] veth0: left promiscuous mode [ 117.805537][ T7758] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 117.823148][ T7758] netlink: 108 bytes leftover after parsing attributes in process `syz.0.512'. [ 117.898446][ T7772] netlink: 'syz.3.515': attribute type 4 has an invalid length. [ 117.925890][ T7772] netlink: 17 bytes leftover after parsing attributes in process `syz.3.515'. [ 118.077024][ T7789] netlink: 40 bytes leftover after parsing attributes in process `syz.3.519'. [ 118.150573][ T7791] netlink: 'syz.2.520': attribute type 1 has an invalid length. [ 118.210260][ T7791] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 20000 - 0 [ 118.220225][ T7791] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 20000 - 0 [ 118.241351][ T7791] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 20000 - 0 [ 118.257193][ T7791] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 20000 - 0 [ 118.269443][ T7791] bond1: (slave geneve2): making interface the new active one [ 118.278725][ T7791] bond1: (slave geneve2): Enslaving as an active interface with an up link [ 118.305032][ T7791] bond1: (slave ip6gretap1): Enslaving as an active interface with an up link [ 118.316659][ T7791] netlink: 28 bytes leftover after parsing attributes in process `syz.2.520'. [ 118.328503][ T7791] 8021q: adding VLAN 0 to HW filter on device bond1 [ 118.337976][ T7791] netlink: 88 bytes leftover after parsing attributes in process `syz.2.520'. [ 118.349506][ T7791] syz.2.520 (7791) used greatest stack depth: 18456 bytes left [ 118.393472][ T7803] netlink: 60 bytes leftover after parsing attributes in process `syz.0.524'. [ 118.412557][ T7803] unsupported nlmsg_type 40 [ 118.708879][ T7820] netlink: 8 bytes leftover after parsing attributes in process `syz.3.531'. [ 119.903357][ T7890] openvswitch: netlink: Missing key (keys=40, expected=200000) [ 119.978091][ T7892] netlink: 'syz.0.552': attribute type 12 has an invalid length. [ 120.292288][ T7908] netlink: 'syz.0.555': attribute type 20 has an invalid length. [ 120.816688][ T7932] ieee802154 phy0 wpan0: encryption failed: -22 [ 120.885286][ T7934] ieee802154 phy0 wpan0: encryption failed: -22 [ 120.953596][ T7939] netlink: zone id is out of range [ 120.958794][ T7939] netlink: get zone limit has 8 unknown bytes [ 121.021207][ T7939] netlink: zone id is out of range [ 121.026408][ T7939] netlink: get zone limit has 8 unknown bytes [ 121.672358][ T7988] pim6reg1: entered promiscuous mode [ 121.692995][ T7988] pim6reg1: entered allmulticast mode [ 122.399312][ T8036] __nla_validate_parse: 44 callbacks suppressed [ 122.399329][ T8036] netlink: 16 bytes leftover after parsing attributes in process `syz.4.594'. [ 122.663763][ T8045] x_tables: duplicate underflow at hook 3 [ 123.237845][ T8088] netlink: 8 bytes leftover after parsing attributes in process `syz.3.606'. [ 123.417518][ T8099] ipt_rpfilter: only valid in 'raw' or 'mangle' table, not '' [ 123.736670][ T8115] netlink: 8 bytes leftover after parsing attributes in process `syz.2.615'. [ 123.770393][ T8115] netlink: 'syz.2.615': attribute type 4 has an invalid length. [ 123.988623][ T8126] netlink: 'syz.2.619': attribute type 4 has an invalid length. [ 124.202917][ T8139] netlink: 212408 bytes leftover after parsing attributes in process `syz.4.621'. [ 124.214890][ T8139] netlink: zone id is out of range [ 124.250092][ T8139] netlink: zone id is out of range [ 124.255480][ T8139] netlink: get zone limit has 8 unknown bytes [ 124.354515][ T8143] : entered promiscuous mode [ 124.565759][ T8154] netlink: 12 bytes leftover after parsing attributes in process `syz.4.628'. [ 124.575154][ T8154] netlink: 'syz.4.628': attribute type 11 has an invalid length. [ 124.652619][ T8162] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 124.831058][ T8174] netlink: 168 bytes leftover after parsing attributes in process `syz.0.633'. [ 124.849726][ T8174] openvswitch: netlink: Flow actions attr not present in new flow. [ 124.921899][ T8178] netlink: 12 bytes leftover after parsing attributes in process `syz.4.636'. [ 124.967654][ T8178] geneve2: entered promiscuous mode [ 125.027682][ T8182] netlink: 8 bytes leftover after parsing attributes in process `syz.3.637'. [ 125.143966][ T8190] lo: entered allmulticast mode [ 125.342240][ T8204] netlink: 212408 bytes leftover after parsing attributes in process `syz.3.642'. [ 125.496027][ T8209] netlink: 28 bytes leftover after parsing attributes in process `syz.4.646'. [ 125.551560][ T8216] ieee802154 phy0 wpan0: encryption failed: -22 [ 125.589564][ T8217] ieee802154 phy0 wpan0: encryption failed: -22 [ 125.963127][ T8250] bridge0: port 3(batadv0) entered blocking state [ 125.977487][ T8250] bridge0: port 3(batadv0) entered disabled state [ 125.994375][ T8250] batadv0: entered allmulticast mode [ 126.034569][ T8250] batadv0: entered promiscuous mode [ 126.473471][ T59] batman_adv: batadv0: No IGMP Querier present - multicast optimizations disabled [ 126.483635][ T59] batman_adv: batadv0: No MLD Querier present - multicast optimizations disabled [ 127.344819][ T8327] netlink: 'syz.2.685': attribute type 2 has an invalid length. [ 127.387854][ T8329] 8021q: adding VLAN 0 to HW filter on device bond0 [ 127.444642][ T8329] bond0: (slave rose0): Enslaving as an active interface with an up link [ 127.476588][ T8338] openvswitch: netlink: IP tunnel attribute has 20 unknown bytes. [ 127.492859][ T8329] openvswitch: netlink: IP tunnel attribute has 20 unknown bytes. [ 127.588201][ T8330] netlink: 'syz.4.687': attribute type 2 has an invalid length. [ 127.596139][ T8330] __nla_validate_parse: 13 callbacks suppressed [ 127.596159][ T8330] netlink: 119 bytes leftover after parsing attributes in process `syz.4.687'. [ 127.644474][ T8347] x_tables: ip6_tables: rpfilter match: used from hooks FORWARD, but only valid from PREROUTING [ 127.696188][ T8347] openvswitch: netlink: VXLAN extension 1 has unexpected len 0 expected 4 [ 127.737901][ T8354] netlink: 20 bytes leftover after parsing attributes in process `syz.2.691'. [ 127.953128][ T8358] geneve2: entered promiscuous mode [ 127.973257][ T8358] geneve2: entered allmulticast mode [ 128.339184][ T8386] netlink: 132 bytes leftover after parsing attributes in process `syz.3.701'. [ 128.413852][ T8391] netlink: 12 bytes leftover after parsing attributes in process `syz.4.702'. [ 128.444998][ T8386] netlink: 36 bytes leftover after parsing attributes in process `syz.3.701'. [ 128.457030][ T8391] netlink: 'syz.4.702': attribute type 2 has an invalid length. [ 128.479849][ T8386] bond0: entered allmulticast mode [ 128.486572][ T8391] netlink: 16 bytes leftover after parsing attributes in process `syz.4.702'. [ 128.522713][ T8386] bond_slave_0: entered allmulticast mode [ 128.540029][ T8386] bond_slave_1: entered allmulticast mode [ 128.546434][ T8386] bridge_slave_1: entered allmulticast mode [ 128.561997][ T8400] openvswitch: netlink: IP tunnel attribute has 20 unknown bytes. [ 128.685050][ T8401] syz.4.702 (8401) used greatest stack depth: 17464 bytes left [ 128.699897][ T8403] netem: change failed [ 128.841153][ T8415] batadv1: entered allmulticast mode [ 129.844175][ T8487] bond0: entered promiscuous mode [ 129.855079][ T8487] team0: entered promiscuous mode [ 129.872573][ T8487] batadv0: entered promiscuous mode [ 129.879181][ T8487] debugfs: Directory 'hsr1' with parent 'hsr' already present! [ 129.891072][ T8487] Cannot create hsr debugfs directory [ 129.896799][ T8487] hsr1: Slave A (bond0) is not up; please bring it up to get a fully working HSR network [ 129.906921][ T8487] hsr1: Slave B (batadv0) is not up; please bring it up to get a fully working HSR network [ 129.919005][ T8490] netlink: 512 bytes leftover after parsing attributes in process `syz.1.731'. [ 129.941000][ T8487] 8021q: adding VLAN 0 to HW filter on device hsr1 [ 129.954648][ T8487] bond0: left promiscuous mode [ 129.960448][ T8487] team0: left promiscuous mode [ 129.966987][ T8487] batadv0: left promiscuous mode [ 129.985405][ T8492] netlink: 'syz.0.733': attribute type 6 has an invalid length. [ 130.361061][ T8512] syz_tun: entered allmulticast mode [ 130.380457][ T8514] netlink: 256 bytes leftover after parsing attributes in process `syz.0.739'. [ 130.405685][ T8518] bridge0: port 1(syz_tun) entered blocking state [ 130.425902][ T8518] bridge0: port 1(syz_tun) entered disabled state [ 130.441992][ T8518] syz_tun: entered allmulticast mode [ 130.463168][ T8518] syz_tun: entered promiscuous mode [ 130.564936][ T8525] netlink: 12 bytes leftover after parsing attributes in process `syz.0.741'. [ 130.644426][ T8525] netlink: 12 bytes leftover after parsing attributes in process `syz.0.741'. [ 131.007301][ T8511] syz_tun: left allmulticast mode [ 131.846324][ T8586] A link change request failed with some changes committed already. Interface bond0 may have been left with an inconsistent configuration, please check. [ 132.105039][ T8607] netlink: 'syz.4.766': attribute type 3 has an invalid length. [ 132.440519][ T8628] gretap0: entered promiscuous mode [ 132.467207][ T8628] gretap0: left promiscuous mode [ 132.509443][ T8637] netlink: 'syz.0.775': attribute type 29 has an invalid length. [ 132.528915][ T8637] netlink: 'syz.0.775': attribute type 29 has an invalid length. [ 132.602585][ T8640] __nla_validate_parse: 10 callbacks suppressed [ 132.602602][ T8640] netlink: 588 bytes leftover after parsing attributes in process `syz.0.775'. [ 132.661659][ T8645] ieee802154 phy0 wpan0: encryption failed: -22 [ 132.886384][ T1301] ieee802154 phy0 wpan0: encryption failed: -22 [ 133.263870][ T8680] delete_channel: no stack [ 133.284164][ T8679] delete_channel: no stack [ 133.384907][ T8689] xt_hashlimit: Unknown mode mask 115, kernel too old? [ 133.750054][ T8704] netlink: 'syz.1.795': attribute type 10 has an invalid length. [ 133.781440][ T8704] netlink: 32 bytes leftover after parsing attributes in process `syz.1.795'. [ 133.887302][ T8720] netlink: 4552 bytes leftover after parsing attributes in process `syz.3.801'. [ 133.935686][ T8720] netlink: 4552 bytes leftover after parsing attributes in process `syz.3.801'. [ 134.247230][ T8742] netlink: 8 bytes leftover after parsing attributes in process `syz.1.808'. [ 134.600058][ T8747] "syz.1.808" (8747) uses obsolete ecb(arc4) skcipher [ 134.975734][ T8779] SET target dimension over the limit! [ 135.101545][ T8784] x_tables: ip_tables: rpfilter match: used from hooks OUTPUT, but only valid from PREROUTING [ 135.242505][ T8796] netlink: 'syz.4.823': attribute type 8 has an invalid length. [ 135.266713][ T8792] : entered promiscuous mode [ 135.379156][ T8807] (unnamed net_device) (uninitialized): option all_slaves_active: invalid value (222) [ 135.618713][ T8818] netlink: 36 bytes leftover after parsing attributes in process `syz.2.831'. [ 135.657768][ T8826] netlink: 36 bytes leftover after parsing attributes in process `syz.2.831'. [ 135.666067][ T8823] x_tables: duplicate underflow at hook 1 [ 135.925141][ T8839] sch_tbf: burst 8 is lower than device ip6tnl0 mtu (1452) ! [ 136.053814][ T8849] bridge1: entered promiscuous mode [ 136.059659][ T8849] bridge1: entered allmulticast mode [ 136.276384][ T8864] netlink: 28 bytes leftover after parsing attributes in process `syz.1.844'. [ 136.280295][ T8866] netlink: 8 bytes leftover after parsing attributes in process `syz.0.845'. [ 136.285840][ T8864] netlink: 'syz.1.844': attribute type 7 has an invalid length. [ 136.319908][ T8864] netlink: 'syz.1.844': attribute type 8 has an invalid length. [ 136.338624][ T8864] netlink: 4 bytes leftover after parsing attributes in process `syz.1.844'. [ 136.394376][ T8864] erspan0: entered promiscuous mode [ 136.423675][ T8864] batadv_slave_1: entered promiscuous mode [ 136.439137][ T8864] debugfs: Directory 'hsr1' with parent 'hsr' already present! [ 136.476941][ T8864] Cannot create hsr debugfs directory [ 137.114720][ T8914] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 137.434303][ T8932] netlink: 'syz.4.864': attribute type 1 has an invalid length. [ 137.546205][ T8935] netlink: 'syz.4.865': attribute type 5 has an invalid length. [ 137.993170][ T8961] __nla_validate_parse: 5 callbacks suppressed [ 137.993187][ T8961] netlink: 252 bytes leftover after parsing attributes in process `syz.4.872'. [ 138.005300][ T8951] syz.0.870: vmalloc error: size 134221824, failed to allocated page array size 262152, mode:0xdc2(GFP_KERNEL|__GFP_HIGHMEM|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 138.075695][ T8951] CPU: 1 UID: 0 PID: 8951 Comm: syz.0.870 Not tainted 6.16.0-rc5-syzkaller-00186-ga059ef8e8889 #0 PREEMPT(full) [ 138.075724][ T8951] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 138.075734][ T8951] Call Trace: [ 138.075741][ T8951] [ 138.075749][ T8951] dump_stack_lvl+0x189/0x250 [ 138.075779][ T8951] ? __pfx_dump_stack_lvl+0x10/0x10 [ 138.075800][ T8951] ? __pfx__printk+0x10/0x10 [ 138.075822][ T8951] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 138.075845][ T8951] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 138.075868][ T8951] ? cpuset_print_current_mems_allowed+0x2ee/0x360 [ 138.075893][ T8951] warn_alloc+0x214/0x310 [ 138.075924][ T8951] ? __pfx_warn_alloc+0x10/0x10 [ 138.075956][ T8951] ? __get_vm_area_node+0x28f/0x300 [ 138.075979][ T8951] ? xskq_create+0xbf/0x170 [ 138.076008][ T8951] __vmalloc_node_range_noprof+0x67e/0x12f0 [ 138.076061][ T8951] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 138.076085][ T8951] ? xskq_create+0x56/0x170 [ 138.076111][ T8951] ? __kasan_kmalloc+0x93/0xb0 [ 138.076135][ T8951] vmalloc_user_noprof+0xad/0xf0 [ 138.076157][ T8951] ? xskq_create+0xbf/0x170 [ 138.076181][ T8951] xskq_create+0xbf/0x170 [ 138.076207][ T8951] xsk_init_queue+0xb0/0x110 [ 138.076234][ T8951] xsk_setsockopt+0x43f/0x710 [ 138.076260][ T8951] ? __pfx_xsk_setsockopt+0x10/0x10 [ 138.076282][ T8951] ? __lock_acquire+0xab9/0xd20 [ 138.076310][ T8951] ? bpf_lsm_socket_setsockopt+0x9/0x20 [ 138.076333][ T8951] ? __pfx_xsk_setsockopt+0x10/0x10 [ 138.076358][ T8951] do_sock_setsockopt+0x25a/0x3e0 [ 138.076384][ T8951] ? __pfx_do_sock_setsockopt+0x10/0x10 [ 138.076409][ T8951] ? __fget_files+0x2a/0x420 [ 138.076439][ T8951] __x64_sys_setsockopt+0x18b/0x220 [ 138.076465][ T8951] do_syscall_64+0xfa/0x3b0 [ 138.076481][ T8951] ? lockdep_hardirqs_on+0x9c/0x150 [ 138.076505][ T8951] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 138.076522][ T8951] ? clear_bhb_loop+0x60/0xb0 [ 138.076542][ T8951] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 138.076566][ T8951] RIP: 0033:0x7fd03d38e929 [ 138.076588][ T8951] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 138.076602][ T8951] RSP: 002b:00007fd03e224038 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 138.076621][ T8951] RAX: ffffffffffffffda RBX: 00007fd03d5b5fa0 RCX: 00007fd03d38e929 [ 138.076632][ T8951] RDX: 0000000000000006 RSI: 000000000000011b RDI: 0000000000000003 [ 138.076641][ T8951] RBP: 00007fd03d410b39 R08: 0000000000000004 R09: 0000000000000000 [ 138.076652][ T8951] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000000 [ 138.076662][ T8951] R13: 0000000000000000 R14: 00007fd03d5b5fa0 R15: 00007ffd12177a88 [ 138.076691][ T8951] [ 138.077873][ T8951] Mem-Info: [ 138.396849][ T8951] active_anon:4869 inactive_anon:0 isolated_anon:0 [ 138.396849][ T8951] active_file:1290 inactive_file:39847 isolated_file:0 [ 138.396849][ T8951] unevictable:768 dirty:66 writeback:0 [ 138.396849][ T8951] slab_reclaimable:10772 slab_unreclaimable:98184 [ 138.396849][ T8951] mapped:29086 shmem:1365 pagetables:1069 [ 138.396849][ T8951] sec_pagetables:0 bounce:0 [ 138.396849][ T8951] kernel_misc_reclaimable:0 [ 138.396849][ T8951] free:1327475 free_pcp:16583 free_cma:0 [ 138.452857][ T8951] Node 0 active_anon:19476kB inactive_anon:0kB active_file:5160kB inactive_file:159184kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:116344kB dirty:264kB writeback:0kB shmem:3924kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:11876kB pagetables:4148kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 138.510193][ T8977] Cannot find del_set index 4 as target [ 138.511158][ T8951] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:48kB pagetables:128kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 138.547836][ T8951] Node 0 DMA free:15360kB boost:0kB min:204kB low:252kB high:300kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 138.618370][ T8951] lowmem_reserve[]: 0 2498 2500 2500 2500 [ 138.640367][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 138.664487][ T8951] Node 0 DMA32 free:1399668kB boost:0kB min:34248kB low:42808kB high:51368kB reserved_highatomic:0KB free_highatomic:0KB active_anon:19428kB inactive_anon:0kB active_file:5160kB inactive_file:157620kB unevictable:1536kB writepending:264kB present:3129332kB managed:2558392kB mlocked:0kB bounce:0kB free_pcp:45824kB local_pcp:28396kB free_cma:0kB [ 138.762378][ T9001] netlink: 4 bytes leftover after parsing attributes in process `syz.2.880'. [ 138.782832][ T9003] netlink: 8 bytes leftover after parsing attributes in process `syz.4.881'. [ 138.792162][ T9003] netlink: 12 bytes leftover after parsing attributes in process `syz.4.881'. [ 138.796875][ T8951] lowmem_reserve[]: 0 0 1 1 1 [ 138.829636][ T8951] Node 0 Normal free:24kB boost:0kB min:20kB low:24kB high:28kB reserved_highatomic:0KB free_highatomic:0KB active_anon:48kB inactive_anon:0kB active_file:0kB inactive_file:1564kB unevictable:0kB writepending:0kB present:1048580kB managed:1644kB mlocked:0kB bounce:0kB free_pcp:8kB local_pcp:8kB free_cma:0kB [ 138.889778][ T8951] lowmem_reserve[]: 0 0 0 0 0 [ 138.894944][ T8951] Node 1 Normal free:3894860kB boost:0kB min:55632kB low:69540kB high:83448kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:1536kB writepending:0kB present:4194300kB managed:4111164kB mlocked:0kB bounce:0kB free_pcp:19904kB local_pcp:7456kB free_cma:0kB [ 138.903257][ T9009] netlink: 27 bytes leftover after parsing attributes in process `syz.1.882'. [ 138.927705][ T8951] lowmem_reserve[]: 0 0 0 0 0 [ 138.943895][ T8997] IPVS: Error joining to the multicast group [ 138.963771][ T8951] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 138.977555][ T8951] Node 0 DMA32: 1062*4kB (M) 150*8kB (M) 29*16kB (UME) 6*32kB (M) 6*64kB (M) 21*128kB (UM) 8*256kB (UME) 7*512kB (UM) 8*1024kB (UME) 4*2048kB (M) 334*4096kB (M) = 1399256kB [ 139.006628][ T8951] Node 0 Normal: 0*4kB 1*8kB (M) 1*16kB (M) 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 24kB [ 139.024372][ T8951] Node 1 Normal: 183*4kB (UE) 42*8kB (UME) 44*16kB (UME) 63*32kB (UME) 28*64kB (UME) 7*128kB (UME) 5*256kB (UME) 4*512kB (UME) 2*1024kB (UM) 2*2048kB (UE) 947*4096kB (M) = 3894860kB [ 139.051763][ T8951] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 139.061494][ T8951] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 139.083186][ T8951] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 139.093117][ T8951] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 139.093829][ T9005] netlink: 32 bytes leftover after parsing attributes in process `syz.4.881'. [ 139.102472][ T8951] 42550 total pagecache pages [ 139.102483][ T8951] 0 pages in swap cache [ 139.102490][ T8951] Free swap = 124996kB [ 139.102498][ T8951] Total swap = 124996kB [ 139.102507][ T8951] 2097051 pages RAM [ 139.102514][ T8951] 0 pages HighMem/MovableOnly [ 139.102521][ T8951] 425411 pages reserved [ 139.102529][ T8951] 0 pages cma reserved [ 139.418619][ T9023] netlink: 4 bytes leftover after parsing attributes in process `syz.2.887'. [ 140.027655][ T9042] IPVS: set_ctl: invalid protocol: 12 224.0.0.2:20004 [ 140.065137][ T9024] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 140.094335][ T9043] netlink: 28 bytes leftover after parsing attributes in process `syz.3.890'. [ 140.111165][ T9024] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 140.398265][ T9024] netdevsim netdevsim4 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 140.407006][ T9024] netdevsim netdevsim4 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 140.415480][ T9024] netdevsim netdevsim4 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 140.424503][ T9024] netdevsim netdevsim4 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 140.545465][ T9023] macvtap1: entered promiscuous mode [ 140.552399][ T9023] vlan0: entered promiscuous mode [ 140.558109][ T9023] macvtap1: entered allmulticast mode [ 140.564838][ T9023] vlan0: entered allmulticast mode [ 140.570607][ T9023] veth0_vlan: entered allmulticast mode [ 141.175692][ T9079] netlink: 8 bytes leftover after parsing attributes in process `syz.3.901'. [ 141.186245][ T9073] netlink: 212376 bytes leftover after parsing attributes in process `syz.1.900'. [ 141.342396][ T9087] IPVS: sync thread started: state = MASTER, mcast_ifn = dummy0, syncid = 3, id = 0 [ 141.345569][ T9086] netlink: 'syz.3.904': attribute type 4 has an invalid length. [ 141.413396][ T9086] netlink: 'syz.3.904': attribute type 4 has an invalid length. [ 141.715453][ T9103] netlink: 'syz.3.905': attribute type 10 has an invalid length. [ 141.768805][ T9097] xt_hashlimit: overflow, rate too high: 0 [ 141.782014][ T9103] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 141.805081][ T9103] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 141.833538][ T9103] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 141.879072][ T9103] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 141.914874][ T9103] team0: Failed to send port change of device geneve0 via netlink (err -105) [ 141.925216][ T9103] team0: Failed to send options change via netlink (err -105) [ 141.938790][ T9103] team0: Port device geneve0 added [ 142.118437][ T9131] tipc: Started in network mode [ 142.130947][ T9126] Bluetooth: hci0: Opcode 0x0401 failed: -22 [ 142.143653][ T9131] tipc: Node identity ba5f0f8908ab, cluster identity 4711 [ 142.173444][ T9127] Bluetooth: hci0: Opcode 0x0401 failed: -22 [ 142.198610][ T9131] tipc: Enabled bearer , priority 0 [ 142.212877][ T9138] syzkaller0: entered promiscuous mode [ 142.248180][ T9138] syzkaller0: entered allmulticast mode [ 142.349987][ T9131] tipc: Resetting bearer [ 142.366011][ T9130] tipc: Resetting bearer [ 142.414863][ T9130] tipc: Disabling bearer [ 142.541797][ T9155] xt_cluster: you have exceeded the maximum number of cluster nodes (257 > 32) [ 142.592591][ T9159] netlink: 'syz.3.924': attribute type 10 has an invalid length. [ 142.618897][ T9159] dummy0: entered allmulticast mode [ 142.636138][ T9159] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 142.820409][ T9169] netlink: 'syz.4.927': attribute type 12 has an invalid length. [ 142.843000][ T9169] netlink: 'syz.4.927': attribute type 11 has an invalid length. [ 142.874935][ T9168] tipc: Invalid UDP bearer configuration [ 142.874993][ T9168] tipc: Enabling of bearer rejected, failed to enable media [ 142.994009][ T6033] IPVS: starting estimator thread 0... [ 143.001428][ T9167] IPVS: sed: UDP 224.0.0.2:0 - no destination available [ 143.037077][ T9176] __nla_validate_parse: 12 callbacks suppressed [ 143.037796][ T9176] netlink: 16 bytes leftover after parsing attributes in process `syz.4.932'. [ 143.101675][ T9179] IPVS: using max 29 ests per chain, 69600 per kthread [ 143.175692][ T9185] netlink: 16 bytes leftover after parsing attributes in process `syz.0.936'. [ 143.212915][ T9188] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 143.281702][ T9188] netlink: 24 bytes leftover after parsing attributes in process `syz.3.935'. [ 143.291294][ T9187] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 143.314110][ T9188] netlink: 24 bytes leftover after parsing attributes in process `syz.3.935'. [ 143.368241][ T9194] netlink: 'syz.3.935': attribute type 26 has an invalid length. [ 143.533816][ T9200] netlink: 8 bytes leftover after parsing attributes in process `syz.1.939'. [ 143.610421][ T9204] netlink: 8 bytes leftover after parsing attributes in process `syz.3.941'. [ 143.643236][ T9204] netdevsim netdevsim3 netdevsim0: entered promiscuous mode [ 143.733973][ T9204] netlink: 184 bytes leftover after parsing attributes in process `syz.3.941'. [ 143.761603][ T9209] netlink: 'syz.2.943': attribute type 2 has an invalid length. [ 143.820862][ T9215] netlink: 8 bytes leftover after parsing attributes in process `syz.0.942'. [ 143.936842][ T9210] bridge0: port 1(bridge_slave_0) entered disabled state [ 143.944645][ T9218] netlink: 16 bytes leftover after parsing attributes in process `syz.2.946'. [ 143.979721][ T9210] bridge0: port 1(bridge_slave_0) entered blocking state [ 143.986943][ T9210] bridge0: port 1(bridge_slave_0) entered forwarding state [ 144.146626][ T9224] netlink: 60 bytes leftover after parsing attributes in process `syz.4.948'. [ 144.161234][ T5847] Bluetooth: hci0: command tx timeout [ 144.221018][ T9228] sctp: [Deprecated]: syz.0.951 (pid 9228) Use of int in max_burst socket option. [ 144.221018][ T9228] Use struct sctp_assoc_value instead [ 144.236548][ T9222] x_tables: ip_tables: rpfilter match: used from hooks OUTPUT, but only valid from PREROUTING [ 144.323195][ T5847] Bluetooth: hci4: command 0x0405 tx timeout [ 144.398366][ T9237] sch_tbf: burst 0 is lower than device lo mtu (65550) ! [ 144.710020][ T9257] 8021q: adding VLAN 0 to HW filter on device bond1 [ 144.718833][ T9257] bond0: (slave bond1): Enslaving as an active interface with an up link [ 144.758465][ T9259] batadv1: entered allmulticast mode [ 145.374541][ T9301] pim6reg1: entered promiscuous mode [ 145.396972][ T9301] pim6reg1: entered allmulticast mode [ 145.840373][ T9335] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 145.883606][ T9337] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 146.094263][ T9354] tipc: Enabled bearer , priority 0 [ 146.110380][ T9355] tipc: Enabling of bearer rejected, already enabled [ 146.123582][ T9361] Unsupported ieee802154 address type: 0 [ 146.129460][ T9354] tipc: Resetting bearer [ 146.175960][ T9351] tipc: Disabling bearer [ 146.274990][ T9369] netlink: 'syz.1.999': attribute type 2 has an invalid length. [ 146.305071][ T9369] netlink: 'syz.1.999': attribute type 2 has an invalid length. [ 146.313776][ T9366] C: renamed from team_slave_0 [ 146.324450][ T9366] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check. [ 146.564630][ T30] audit: type=1107 audit(1752456191.170:2): pid=9380 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='£;¯:A÷™M2…†Waªþ~Üüø¸’ m§UÈ”xª&ÔæûOÉã-ÃñDS¥*ÿÿŸö¼U¹:HÈ „^ªØ=þlŽFzÿ,¬ÆýŸ¡Ÿ9~~ÎbÖÉ4†ïm"öÛ"öÖùô´)ãôé}fö¥ fßôÒê)…-Iwéó¯0¿z¹Àó8|øH‰HAyº‚%Œ³DÐÏG¸á' [ 146.852639][ T9367] infiniband syz!: set down [ 146.869775][ T9367] infiniband syz!: added team_slave_0 [ 146.924731][ T9398] IPVS: set_ctl: invalid protocol: 2 172.30.0.5:20003 [ 146.992402][ T9402] ip6t_REJECT: TCP_RESET illegal for non-tcp [ 147.145671][ T9367] RDS/IB: syz!: added [ 147.172510][ T9367] smc: adding ib device syz! with port count 1 [ 147.178932][ T9367] smc: ib device syz! port 1 has pnetid [ 147.973791][ T9453] Bluetooth: MGMT ver 1.23 [ 148.191404][ T9461] validate_nla: 1 callbacks suppressed [ 148.191421][ T9461] netlink: 'syz.0.1027': attribute type 10 has an invalid length. [ 148.290648][ T9467] __nla_validate_parse: 16 callbacks suppressed [ 148.290665][ T9467] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1031'. [ 148.406278][ T9477] netlink: 'syz.1.1035': attribute type 13 has an invalid length. [ 148.415999][ T9477] netlink: 'syz.1.1035': attribute type 58 has an invalid length. [ 148.424465][ T9477] netlink: 152 bytes leftover after parsing attributes in process `syz.1.1035'. [ 148.447106][ T9479] netem: unknown loss type 0 [ 148.460515][ T9482] ksmbd: Daemon and kernel module version mismatch. ksmbd: 124, kernel module: 1. User-space ksmbd should terminate. [ 148.502868][ T9479] netem: change failed [ 148.829365][ T9493] bond0: left allmulticast mode [ 148.835929][ T9493] bond_slave_0: left allmulticast mode [ 148.844963][ T9493] bond_slave_1: left allmulticast mode [ 148.851743][ T9493] bridge_slave_1: left allmulticast mode [ 148.857680][ T9493] dummy0: left allmulticast mode [ 148.871468][ T9493] A link change request failed with some changes committed already. Interface dummy0 may have been left with an inconsistent configuration, please check. [ 148.994138][ T9497] netlink: 'syz.3.1042': attribute type 1 has an invalid length. [ 149.004954][ T9497] netlink: 784 bytes leftover after parsing attributes in process `syz.3.1042'. [ 149.591833][ T9526] netlink: 32 bytes leftover after parsing attributes in process `syz.0.1052'. [ 149.636135][ T9526] netlink: 32 bytes leftover after parsing attributes in process `syz.0.1052'. [ 149.662450][ T9526] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1052'. [ 149.728312][ T9530] netlink: 'syz.4.1053': attribute type 1 has an invalid length. [ 149.885292][ T9530] 8021q: adding VLAN 0 to HW filter on device bond2 [ 150.076324][ T9545] netlink: 13 bytes leftover after parsing attributes in process `syz.4.1060'. [ 150.097120][ T9543] netlink: 'syz.0.1058': attribute type 10 has an invalid length. [ 150.132024][ T9543] netlink: 40 bytes leftover after parsing attributes in process `syz.0.1058'. [ 150.214243][ T9543] team0: Port device geneve0 added [ 150.235121][ T9550] A link change request failed with some changes committed already. Interface syz_tun may have been left with an inconsistent configuration, please check. [ 150.272486][ T9555] openvswitch: netlink: Unexpected mask (mask=200040, allowed=10048) [ 150.550537][ T9575] netlink: 28 bytes leftover after parsing attributes in process `syz.2.1068'. [ 150.921312][ T9593] netlink: 28 bytes leftover after parsing attributes in process `syz.4.1076'. [ 151.076132][ T9594] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 152.515258][ T9694] tc_dump_action: action bad kind [ 152.713137][ T9703] xt_cluster: node mask cannot exceed total number of nodes [ 153.192953][ T9734] xt_TCPMSS: Only works on TCP SYN packets [ 153.312463][ T9731] __nla_validate_parse: 2 callbacks suppressed [ 153.312483][ T9731] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1114'. [ 153.334861][ T9745] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1118'. [ 153.436300][ T9746] bridge0: entered promiscuous mode [ 153.453498][ T9732] IPv6: NLM_F_REPLACE set, but no existing node found! [ 153.870088][ T9774] x_tables: ip_tables: osf match: only valid for protocol 6 [ 153.877037][ T9768] x_tables: ip_tables: osf match: only valid for protocol 6 [ 153.902033][ T9775] netlink: 'syz.2.1128': attribute type 4 has an invalid length. [ 154.145495][ T9791] netlink: 'syz.2.1134': attribute type 1 has an invalid length. [ 154.189818][ T9796] netlink: 44 bytes leftover after parsing attributes in process `syz.4.1136'. [ 154.205967][ T9796] netlink: 128 bytes leftover after parsing attributes in process `syz.4.1136'. [ 154.520127][ T9807] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1142'. [ 154.699161][ T9827] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1147'. [ 154.768113][ T9831] x_tables: ip_tables: osf match: only valid for protocol 6 [ 154.887890][ T9837] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1149'. [ 154.906430][ T9839] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1150'. [ 154.919207][ T9837] netlink: 'syz.2.1149': attribute type 3 has an invalid length. [ 154.931065][ T9841] netlink: 256 bytes leftover after parsing attributes in process `syz.4.1151'. [ 155.335813][ T9861] netlink: 64 bytes leftover after parsing attributes in process `syz.4.1158'. [ 155.391607][ T9867] netlink: 'syz.3.1157': attribute type 1 has an invalid length. [ 155.399987][ T9868] netlink: 'syz.3.1157': attribute type 1 has an invalid length. [ 155.509084][ T9868] 8021q: adding VLAN 0 to HW filter on device bond5 [ 155.604009][ T9871] 8021q: adding VLAN 0 to HW filter on device bond5 [ 155.621219][ T9871] bond5: (slave vxcan1): The slave device specified does not support setting the MAC address [ 155.633801][ T9871] bond5: (slave vxcan1): Error -95 calling set_mac_address [ 155.875717][ T9901] xt_policy: input policy not valid in POSTROUTING and OUTPUT [ 156.040685][ T9905] netlink: 'syz.2.1171': attribute type 39 has an invalid length. [ 156.103683][ T9911] netlink: 'syz.0.1173': attribute type 10 has an invalid length. [ 156.328805][ T9925] IPVS: wlc: UDP 224.0.0.2:0 - no destination available [ 156.330119][ T6033] IPVS: starting estimator thread 0... [ 156.459912][ T9931] IPVS: using max 28 ests per chain, 67200 per kthread [ 156.586693][ T9946] veth1_to_team: mtu less than device minimum [ 156.894704][ T9965] netlink: 'syz.3.1190': attribute type 5 has an invalid length. [ 156.903418][ T9964] (unnamed net_device) (uninitialized): Unable to set down delay as MII monitoring is disabled [ 156.966211][ T9965] netdevsim netdevsim3 netdevsim0: set [1, 1] type 2 family 0 port 256 - 0 [ 156.989662][ T9965] netdevsim netdevsim3 netdevsim1: set [1, 1] type 2 family 0 port 256 - 0 [ 157.029901][ T9965] netdevsim netdevsim3 netdevsim2: set [1, 1] type 2 family 0 port 256 - 0 [ 157.062668][ T9965] netdevsim netdevsim3 netdevsim3: set [1, 1] type 2 family 0 port 256 - 0 [ 157.093382][ T9965] geneve2: entered promiscuous mode [ 157.099907][ T9965] geneve2: entered allmulticast mode [ 157.710952][T10008] netdevsim netdevsim1 netdevsim0: entered promiscuous mode [ 157.746538][T10008] batman_adv: batadv0: Adding interface: netdevsim0 [ 157.776397][T10008] batman_adv: batadv0: The MTU of interface netdevsim0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 157.833575][T10008] batman_adv: batadv0: Not using interface netdevsim0 (retrying later): interface not active [ 158.468093][T10049] xt_CT: No such helper "snmp" [ 158.509243][T10049] __nla_validate_parse: 16 callbacks suppressed [ 158.509262][T10049] netlink: 9 bytes leftover after parsing attributes in process `syz.4.1213'. [ 158.525693][T10049] gretap0: entered promiscuous mode [ 158.611760][T10057] netlink: 'syz.1.1215': attribute type 11 has an invalid length. [ 158.620089][T10057] netlink: 224 bytes leftover after parsing attributes in process `syz.1.1215'. [ 158.734237][T10064] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1218'. [ 159.016524][T10077] netlink: 104 bytes leftover after parsing attributes in process `syz.2.1221'. [ 159.057701][T10077] netlink: 44 bytes leftover after parsing attributes in process `syz.2.1221'. [ 159.850908][T10109] netlink: 152 bytes leftover after parsing attributes in process `syz.1.1232'. [ 159.906435][T10114] lo: entered allmulticast mode [ 159.942718][T10114] lo: left allmulticast mode [ 160.190337][T10135] netlink: 48 bytes leftover after parsing attributes in process `syz.0.1236'. [ 160.569790][T10158] netlink: 224 bytes leftover after parsing attributes in process `syz.4.1246'. [ 160.624356][ T5948] hid-generic 0005:16C0:5505.0001: unknown main item tag 0x0 [ 160.635751][ T5948] hid-generic 0005:16C0:5505.0001: unknown main item tag 0x0 [ 160.677734][ T5948] hid-generic 0005:16C0:5505.0001: unknown main item tag 0x0 [ 160.678726][T10174] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1246'. [ 160.689564][ T5948] hid-generic 0005:16C0:5505.0001: unknown main item tag 0x0 [ 160.703495][ T5948] hid-generic 0005:16C0:5505.0001: unknown main item tag 0x0 [ 160.711008][ T5948] hid-generic 0005:16C0:5505.0001: unknown main item tag 0x3 [ 160.738917][ T5948] hid-generic 0005:16C0:5505.0001: hidraw0: BLUETOOTH HID v0.8b Device [syz0] on aa:aa:aa:aa:aa:aa [ 160.846375][T10176] fido_id[10176]: Failed to open report descriptor at '/sys/devices/virtual/bluetooth/hci4/hci4:200/report_descriptor': No such file or directory [ 161.056399][T10191] netlink: 28 bytes leftover after parsing attributes in process `syz.4.1253'. [ 161.142916][T10191] IPVS: Error connecting to the multicast addr [ 161.158886][T10195] 8021q: VLANs not supported on ip6tnl0 [ 161.175700][T10195] x_tables: duplicate underflow at hook 2 [ 161.411956][T10208] netlink: 'syz.4.1260': attribute type 11 has an invalid length. [ 161.486569][T10210] x_tables: duplicate underflow at hook 2 [ 162.226750][T10256] bridge_slave_0: left allmulticast mode [ 162.272439][T10256] bridge_slave_0: left promiscuous mode [ 162.314441][T10256] bridge0: port 1(bridge_slave_0) entered disabled state [ 162.382043][T10256] bridge_slave_1: left allmulticast mode [ 162.387747][T10256] bridge_slave_1: left promiscuous mode [ 162.415042][T10256] bridge0: port 2(bridge_slave_1) entered disabled state [ 162.487375][T10256] bond0: (slave bond_slave_0): Releasing backup interface [ 162.512513][T10256] bond0: (slave bond_slave_1): Releasing backup interface [ 162.541761][T10256] team0: Port device team_slave_0 removed [ 162.556479][T10256] team0: Port device team_slave_1 removed [ 162.575169][T10256] team0: Port device geneve0 removed [ 162.583632][T10256] batadv0: left allmulticast mode [ 162.588710][T10256] batadv0: left promiscuous mode [ 162.595382][T10256] bridge0: port 3(batadv0) entered disabled state [ 162.607678][T10265] team0: Mode changed to "activebackup" [ 163.081732][T10302] netlink: 'syz.4.1289': attribute type 5 has an invalid length. [ 163.473514][T10331] netlink: 'syz.3.1300': attribute type 1 has an invalid length. [ 163.503632][T10331] netlink: 'syz.3.1300': attribute type 2 has an invalid length. [ 163.545510][T10334] netlink: 'syz.2.1301': attribute type 27 has an invalid length. [ 163.576835][T10331] __nla_validate_parse: 13 callbacks suppressed [ 163.576853][T10331] netlink: 1172 bytes leftover after parsing attributes in process `syz.3.1300'. [ 163.735497][T10348] netlink: 'syz.0.1305': attribute type 30 has an invalid length. [ 163.754173][T10348] (unnamed net_device) (uninitialized): option arp_missed_max: invalid value (0) [ 163.776295][T10348] (unnamed net_device) (uninitialized): option arp_missed_max: allowed values 1 - 255 [ 163.820000][T10354] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1308'. [ 163.858035][T10359] xt_CT: You must specify a L4 protocol and not use inversions on it [ 163.884711][T10354] bond2: (slave vcan1): The slave device specified does not support setting the MAC address [ 163.896474][T10354] bond2: (slave vcan1): Error -95 calling set_mac_address [ 163.954334][T10359] xt_CT: You must specify a L4 protocol and not use inversions on it [ 164.002589][T10359] xt_CT: You must specify a L4 protocol and not use inversions on it [ 164.017007][T10359] xt_CT: You must specify a L4 protocol and not use inversions on it [ 164.032332][T10359] xt_CT: You must specify a L4 protocol and not use inversions on it [ 164.045760][T10359] xt_CT: You must specify a L4 protocol and not use inversions on it [ 164.100894][T10359] xt_CT: You must specify a L4 protocol and not use inversions on it [ 164.126391][T10372] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 164.152182][T10359] xt_CT: You must specify a L4 protocol and not use inversions on it [ 164.166034][T10359] xt_CT: You must specify a L4 protocol and not use inversions on it [ 164.186613][T10359] xt_CT: You must specify a L4 protocol and not use inversions on it [ 164.228597][T10374] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1314'. [ 164.320228][T10374] bond0: (slave bridge_slave_1): Releasing backup interface [ 164.388397][T10379] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1316'. [ 164.399475][T10377] tipc: Enabling of bearer rejected, media not registered [ 164.425438][T10381] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1316'. [ 164.584262][T10389] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 164.604056][T10392] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1319'. [ 164.613891][T10390] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1319'. [ 164.815403][T10400] sctp: [Deprecated]: syz.2.1321 (pid 10400) Use of int in max_burst socket option deprecated. [ 164.815403][T10400] Use struct sctp_assoc_value instead [ 164.842017][T10411] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1323'. [ 164.855183][T10411] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1323'. [ 164.961785][T10410] netlink: 44 bytes leftover after parsing attributes in process `syz.4.1323'. [ 164.973131][T10409] xt_CT: No such helper "netbios-ns" [ 165.032676][T10416] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci4/hci4:200/input5 [ 165.179886][T10425] netlink: 'syz.3.1327': attribute type 1 has an invalid length. [ 165.717600][T10453] syzkaller1: entered promiscuous mode [ 165.723791][T10453] syzkaller1: entered allmulticast mode [ 166.027173][ T30] audit: type=1107 audit(1752456210.630:3): pid=10473 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='' [ 166.592146][T10502] pim6reg1: entered promiscuous mode [ 166.604014][T10502] pim6reg1: entered allmulticast mode [ 166.818617][T10510] netlink: 'syz.0.1351': attribute type 9 has an invalid length. [ 167.476039][T10544] dvmrp0: renamed from vxcan1 [ 167.846795][T10564] netlink: 'syz.4.1366': attribute type 1 has an invalid length. [ 168.089376][T10565] netlink: 'syz.4.1366': attribute type 1 has an invalid length. [ 168.104860][T10579] netlink: 'syz.0.1369': attribute type 1 has an invalid length. [ 168.290216][T10588] nbd0: detected capacity change from 0 to 127 [ 168.304984][ T5847] block nbd0: Receive control failed (result -104) [ 168.729920][T10621] __nla_validate_parse: 17 callbacks suppressed [ 168.729939][T10621] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1381'. [ 168.863651][T10628] xt_recent: hitcount (4294967295) is larger than allowed maximum (65535) [ 168.875372][T10627] nbd: nbd0 already in use [ 168.984965][T10631] netlink: 'syz.2.1384': attribute type 1 has an invalid length. [ 169.039359][T10636] rdma_rxe: rxe_newlink: failed to add team_slave_0 [ 169.064125][T10631] netlink: 224 bytes leftover after parsing attributes in process `syz.2.1384'. [ 169.134323][T10636] netlink: 9 bytes leftover after parsing attributes in process `syz.0.1386'. [ 169.502298][T10658] netlink: 'syz.3.1391': attribute type 13 has an invalid length. [ 169.536635][T10665] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1393'. [ 169.551210][T10665] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1393'. [ 169.639205][T10658] 8021q: adding VLAN 0 to HW filter on device bond0 [ 169.650270][T10658] 8021q: adding VLAN 0 to HW filter on device team0 [ 169.662926][T10658] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 169.722789][T10670] erspan0: entered promiscuous mode [ 169.737912][T10670] vlan2: entered promiscuous mode [ 170.050574][T10683] netlink: 'syz.3.1398': attribute type 10 has an invalid length. [ 170.061598][T10682] netlink: 56 bytes leftover after parsing attributes in process `syz.0.1399'. [ 170.320750][T10695] netlink: 'syz.1.1397': attribute type 4 has an invalid length. [ 170.347920][T10694] netlink: 'syz.1.1397': attribute type 4 has an invalid length. [ 170.380692][T10702] Illegal XDP return value 16128 on prog (id 208) dev syz_tun, expect packet loss! [ 170.467404][T10715] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1403'. [ 170.505149][T10707] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1403'. [ 170.655354][T10728] netlink: 'syz.2.1409': attribute type 4 has an invalid length. [ 170.884249][T10746] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 171.010864][T10754] wg1: entered promiscuous mode [ 171.076186][T10757] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1419'. [ 171.388003][T10778] netlink: 40 bytes leftover after parsing attributes in process `syz.3.1425'. [ 172.812626][T10853] openvswitch: netlink: Flow key attr not present in new flow. [ 173.104248][T10868] validate_nla: 4 callbacks suppressed [ 173.104266][T10868] netlink: 'syz.0.1451': attribute type 5 has an invalid length. [ 173.728973][T10893] openvswitch: netlink: IP tunnel TTL not specified. [ 173.856971][T10899] __nla_validate_parse: 6 callbacks suppressed [ 173.856988][T10899] netlink: 16178 bytes leftover after parsing attributes in process `syz.0.1465'. [ 174.248958][T10922] netlink: 'syz.3.1471': attribute type 20 has an invalid length. [ 174.323881][T10925] netlink: 20 bytes leftover after parsing attributes in process `syz.2.1472'. [ 174.369251][T10925] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1472'. [ 174.427687][T10925] veth5: entered allmulticast mode [ 174.609936][T10941] netlink: 'syz.0.1477': attribute type 29 has an invalid length. [ 174.726911][T10945] bond0: (slave bond_slave_0): Releasing backup interface [ 174.756659][T10945] bond0: (slave bond_slave_1): Releasing backup interface [ 174.806578][T10945] team0: Port device team_slave_0 removed [ 174.847762][T10945] team0: Port device team_slave_1 removed [ 174.885495][T10945] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 174.923102][T10945] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 174.943926][T10945] bond0: (slave bond1): Releasing backup interface [ 174.965406][T10955] team0: Mode changed to "activebackup" [ 175.038554][T10963] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1483'. [ 175.137808][T10968] sch_tbf: burst 0 is lower than device bridge3 mtu (1514) ! [ 175.176862][T10973] sctp: [Deprecated]: syz.4.1485 (pid 10973) Use of struct sctp_assoc_value in delayed_ack socket option. [ 175.176862][T10973] Use struct sctp_sack_info instead [ 175.204700][T10972] netlink: 172 bytes leftover after parsing attributes in process `syz.3.1486'. [ 175.212153][T10970] sctp: [Deprecated]: syz.4.1485 (pid 10970) Use of struct sctp_assoc_value in delayed_ack socket option. [ 175.212153][T10970] Use struct sctp_sack_info instead [ 175.246154][T10975] netlink: 172 bytes leftover after parsing attributes in process `syz.3.1486'. [ 175.277706][T10972] netlink: 'syz.3.1486': attribute type 9 has an invalid length. [ 175.325919][T10972] netlink: 'syz.3.1486': attribute type 9 has an invalid length. [ 176.222478][T11030] netlink: 'syz.2.1498': attribute type 10 has an invalid length. [ 176.330048][T11035] netlink: 28 bytes leftover after parsing attributes in process `syz.4.1502'. [ 176.351728][T11035] netlink: 'syz.4.1502': attribute type 7 has an invalid length. [ 176.383734][T11035] netlink: 'syz.4.1502': attribute type 8 has an invalid length. [ 176.407961][T11035] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1502'. [ 176.642963][T11040] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 176.776741][T11047] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1506'. [ 176.815305][T11047] openvswitch: netlink: Flow actions attr not present in new flow. [ 176.833635][T11050] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1506'. [ 176.844142][T11050] openvswitch: netlink: Flow actions attr not present in new flow. [ 176.960513][ T5847] Bluetooth: hci0: Opcode 0x0c03 failed: -110 [ 177.077020][T11059] openvswitch: netlink: Flow key attribute not present in set flow. [ 177.353016][T11074] veth0_vlan: left promiscuous mode [ 177.358884][T11064] x_tables: duplicate underflow at hook 1 [ 177.389910][T11074] veth0_vlan: entered allmulticast mode [ 177.406370][T11074] veth0_vlan: entered promiscuous mode [ 177.461391][T11082] netlink: 'syz.0.1515': attribute type 1 has an invalid length. [ 177.540293][T11087] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 177.560576][T11084] 0ªX¹¦D: renamed from gretap0 [ 177.577128][T11084] 0ªX¹¦D: entered allmulticast mode [ 177.593484][T11084] A link change request failed with some changes committed already. Interface 30ªX¹¦D may have been left with an inconsistent configuration, please check. [ 177.768727][T11096] ip6t_REJECT: TCP_RESET illegal for non-tcp [ 177.966884][T11109] netlink: 'syz.2.1527': attribute type 39 has an invalid length. [ 178.282395][T11129] bond4: entered promiscuous mode [ 178.287549][T11129] bond4: entered allmulticast mode [ 178.293517][T11129] 8021q: adding VLAN 0 to HW filter on device bond4 [ 178.359617][T11088] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 178.476396][T11144] validate_nla: 1 callbacks suppressed [ 178.476413][T11144] netlink: 'syz.3.1537': attribute type 6 has an invalid length. [ 178.520935][T11147] llcp: llcp_sock_recvmsg: Recv datagram failed state 4 -107 0 [ 179.011118][T11187] __nla_validate_parse: 15 callbacks suppressed [ 179.011137][T11187] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1548'. [ 179.048494][T11191] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1550'. [ 179.057736][T11191] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1550'. [ 179.264520][T11203] sctp: [Deprecated]: syz.0.1554 (pid 11203) Use of int in max_burst socket option. [ 179.264520][T11203] Use struct sctp_assoc_value instead [ 179.280978][T11203] IPVS: set_ctl: invalid protocol: 22 172.20.20.170:20000 [ 179.290651][T11203] IPVS: set_ctl: invalid protocol: 29 172.20.20.30:20004 [ 179.699333][T11214] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1559'. [ 179.723545][T11214] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1559'. [ 179.937598][T11232] : entered promiscuous mode [ 179.943703][T11230] netlink: 64985 bytes leftover after parsing attributes in process `syz.4.1563'. [ 180.266881][T11252] netlink: 52 bytes leftover after parsing attributes in process `syz.1.1568'. [ 180.450615][T11261] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1572'. [ 180.589410][T11261] tipc: Started in network mode [ 180.594635][T11261] tipc: Node identity f6ea194bb7c6, cluster identity 4711 [ 180.607164][T11261] tipc: Enabled bearer , priority 0 [ 180.617353][T11271] ipvlan0: entered promiscuous mode [ 180.639663][T11271] ipvlan0: entered allmulticast mode [ 180.651079][T11271] veth0_vlan: entered allmulticast mode [ 180.677082][T11261] tipc: Resetting bearer [ 180.705747][T11259] tipc: Disabling bearer [ 180.781451][T11275] tipc: Enabled bearer , priority 10 [ 180.905289][T11275] tipc: Resetting bearer [ 181.013656][T11274] tipc: Resetting bearer [ 182.473569][T11274] tipc: Disabling bearer [ 182.666962][T11318] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1592'. [ 182.683533][T11318] netlink: 56 bytes leftover after parsing attributes in process `syz.0.1592'. [ 182.787902][T11318] sch_tbf: burst 0 is lower than device lo mtu (81) ! [ 182.828341][ T981] IPVS: starting estimator thread 0... [ 182.931717][T11327] IPVS: using max 31 ests per chain, 74400 per kthread [ 183.676975][T11361] netlink: 'syz.4.1607': attribute type 9 has an invalid length. [ 183.987196][T11386] IPVS: wlc: UDP 224.0.0.2:0 - no destination available [ 184.131801][T11395] __nla_validate_parse: 6 callbacks suppressed [ 184.131818][T11395] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1617'. [ 184.268990][T11405] netlink: 'syz.4.1621': attribute type 5 has an invalid length. [ 184.300107][T11406] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1620'. [ 184.320647][T11406] openvswitch: netlink: nsh attribute has 1 unknown bytes. [ 184.327920][T11406] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 184.552795][T11421] bond0: entered promiscuous mode [ 184.558227][T11421] bond0: entered allmulticast mode [ 184.646194][T11421] syzkaller0: entered promiscuous mode [ 184.670029][T11421] syzkaller0: entered allmulticast mode [ 185.306139][T11470] openvswitch: netlink: IP tunnel attribute has 16 unknown bytes. [ 185.310193][T11471] openvswitch: netlink: IP tunnel attribute has 16 unknown bytes. [ 185.402541][T11471] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1638'. [ 186.688588][T11472] tipc: Enabling of bearer rejected, failed to enable media [ 186.914972][T11501] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1641'. [ 187.207935][T11520] openvswitch: netlink: Unexpected mask (mask=c0, allowed=10048) [ 187.260678][T11522] netlink: 32 bytes leftover after parsing attributes in process `syz.1.1649'. [ 187.324111][T11528] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1651'. [ 187.340074][T11528] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1651'. [ 187.387422][T11529] netem: unknown loss type 0 [ 187.436353][T11529] netem: change failed [ 187.676828][T11549] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1659'. [ 187.701970][T11551] netlink: 'syz.3.1660': attribute type 23 has an invalid length. [ 188.048273][T11569] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1667'. [ 188.117820][T11576] (unnamed net_device) (uninitialized): Unable to set peer notification delay as MII monitoring is disabled [ 188.163957][T11577] sctp: [Deprecated]: syz.4.1668 (pid 11577) Use of int in maxseg socket option. [ 188.163957][T11577] Use struct sctp_assoc_value instead [ 188.366022][T11583] netlink: 48 bytes leftover after parsing attributes in process `syz.0.1670'. [ 188.387037][T11583] vlan2: entered promiscuous mode [ 188.396652][T11583] bridge0: entered promiscuous mode [ 188.525654][T11589] netlink: 'syz.0.1673': attribute type 13 has an invalid length. [ 188.659053][T11589] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 188.865806][T11602] netlink: 'syz.0.1678': attribute type 1 has an invalid length. [ 188.883201][T11605] bridge_slave_1: default FDB implementation only supports local addresses [ 188.994059][T11609] netdevsim netdevsim0 netdevsim0: set [1, 1] type 2 family 0 port 20000 - 0 [ 189.054324][T11609] netdevsim netdevsim0 netdevsim1: set [1, 1] type 2 family 0 port 20000 - 0 [ 189.063842][T11609] netdevsim netdevsim0 netdevsim2: set [1, 1] type 2 family 0 port 20000 - 0 [ 189.073201][T11609] netdevsim netdevsim0 netdevsim3: set [1, 1] type 2 family 0 port 20000 - 0 [ 189.088456][T11609] bond5: (slave geneve3): making interface the new active one [ 189.102030][T11609] bond5: (slave geneve3): Enslaving as an active interface with an up link [ 189.190621][T11602] 8021q: adding VLAN 0 to HW filter on device bond5 [ 189.294552][T11630] __nla_validate_parse: 7 callbacks suppressed [ 189.294570][T11630] netlink: 212364 bytes leftover after parsing attributes in process `syz.3.1684'. [ 189.310936][T11630] openvswitch: netlink: Message has 5 unknown bytes. [ 189.384855][T11628] pim6reg: entered allmulticast mode [ 189.391776][T11632] netlink: 16 bytes leftover after parsing attributes in process `syz.4.1685'. [ 189.450097][T11628] netlink: 'syz.3.1684': attribute type 4 has an invalid length. [ 189.512039][T11634] xt_hashlimit: size too large, truncated to 1048576 [ 190.238040][T11664] FAULT_INJECTION: forcing a failure. [ 190.238040][T11664] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 190.269788][T11664] CPU: 1 UID: 0 PID: 11664 Comm: syz.1.1694 Not tainted 6.16.0-rc5-syzkaller-00186-ga059ef8e8889 #0 PREEMPT(full) [ 190.269816][T11664] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 190.269827][T11664] Call Trace: [ 190.269835][T11664] [ 190.269842][T11664] dump_stack_lvl+0x189/0x250 [ 190.269867][T11664] ? __pfx____ratelimit+0x10/0x10 [ 190.269893][T11664] ? __pfx_dump_stack_lvl+0x10/0x10 [ 190.269912][T11664] ? __pfx__printk+0x10/0x10 [ 190.269949][T11664] should_fail_ex+0x414/0x560 [ 190.269979][T11664] _copy_to_user+0x31/0xb0 [ 190.270001][T11664] simple_read_from_buffer+0xe1/0x170 [ 190.270027][T11664] proc_fail_nth_read+0x1df/0x250 [ 190.270054][T11664] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 190.270081][T11664] ? rw_verify_area+0x258/0x650 [ 190.270099][T11664] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 190.270124][T11664] vfs_read+0x200/0x980 [ 190.270150][T11664] ? __pfx___mutex_lock+0x10/0x10 [ 190.270169][T11664] ? __pfx_vfs_read+0x10/0x10 [ 190.270190][T11664] ? __fget_files+0x2a/0x420 [ 190.270217][T11664] ? __fget_files+0x3a0/0x420 [ 190.270235][T11664] ? __fget_files+0x2a/0x420 [ 190.270263][T11664] ksys_read+0x145/0x250 [ 190.270284][T11664] ? __pfx_ksys_read+0x10/0x10 [ 190.270298][T11664] ? rcu_is_watching+0x15/0xb0 [ 190.270323][T11664] ? do_syscall_64+0xbe/0x3b0 [ 190.270344][T11664] do_syscall_64+0xfa/0x3b0 [ 190.270359][T11664] ? lockdep_hardirqs_on+0x9c/0x150 [ 190.270381][T11664] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 190.270397][T11664] ? clear_bhb_loop+0x60/0xb0 [ 190.270432][T11664] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 190.270448][T11664] RIP: 0033:0x7f9c4c98d33c [ 190.270465][T11664] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 190.270479][T11664] RSP: 002b:00007f9c4d8e2030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 190.270497][T11664] RAX: ffffffffffffffda RBX: 00007f9c4cbb5fa0 RCX: 00007f9c4c98d33c [ 190.270510][T11664] RDX: 000000000000000f RSI: 00007f9c4d8e20a0 RDI: 0000000000000004 [ 190.270520][T11664] RBP: 00007f9c4d8e2090 R08: 0000000000000000 R09: 000000000000001c [ 190.270528][T11664] R10: 0000000000004000 R11: 0000000000000246 R12: 0000000000000001 [ 190.270546][T11664] R13: 0000000000000000 R14: 00007f9c4cbb5fa0 R15: 00007ffeb3f67ec8 [ 190.270575][T11664] [ 190.856361][T11687] No such timeout policy "syz0" [ 190.944175][T11691] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1704'. [ 190.954645][T11691] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1704'. [ 190.973376][T11692] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1701'. [ 191.098125][T11700] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1706'. [ 191.263888][T11702] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1708'. [ 191.297960][T11702] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1708'. [ 191.475106][T11712] syzkaller0: entered promiscuous mode [ 191.487971][T11712] syzkaller0: entered allmulticast mode [ 191.570660][T11717] openvswitch: netlink: IPv6 tunnel dst address is zero [ 191.884403][T11728] workqueue: Failed to create a rescuer kthread for wq "nfc3_nci_rx_wq": -EINTR [ 192.120836][T11749] xt_hashlimit: size too large, truncated to 1048576 [ 192.190256][T11758] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1718'. [ 192.216255][T11756] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1720'. [ 193.169048][T11794] team0: Device vti0 is up. Set it down before adding it as a team port [ 194.002193][T11840] IPVS: Scheduler module ip_vs_sip not found [ 194.466182][T11863] __nla_validate_parse: 9 callbacks suppressed [ 194.466199][T11863] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1747'. [ 194.468003][T11865] netlink: 24 bytes leftover after parsing attributes in process `syz.4.1748'. [ 194.498042][T11865] netlink: 24 bytes leftover after parsing attributes in process `syz.4.1748'. [ 194.528472][T11867] netlink: 64 bytes leftover after parsing attributes in process `syz.3.1749'. [ 194.609237][T11874] netlink: 20 bytes leftover after parsing attributes in process `syz.2.1750'. [ 194.668460][T11878] netlink: 'syz.4.1751': attribute type 39 has an invalid length. [ 194.801826][T11886] netlink: 212376 bytes leftover after parsing attributes in process `syz.0.1753'. [ 195.078055][T11895] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1757'. [ 195.084990][T11907] netlink: 32 bytes leftover after parsing attributes in process `syz.3.1759'. [ 195.195247][T11911] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1760'. [ 195.462918][T11928] delete_channel: no stack [ 195.526371][ T5851] Bluetooth: hci4: command 0x0405 tx timeout [ 195.640824][T11936] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1769'. [ 195.687238][T11942] netlink: 'syz.2.1775': attribute type 11 has an invalid length. [ 195.763784][T11948] unknown channel width for channel at 909000KHz? [ 195.785354][T11948] unknown channel width for channel at 909000KHz? [ 196.142110][T11977] openvswitch: netlink: Actions may not be safe on all matching packets [ 196.162908][T11978] openvswitch: netlink: Actions may not be safe on all matching packets [ 196.401435][ T5847] Bluetooth: hci2: command 0x0406 tx timeout [ 196.402112][ T5851] Bluetooth: hci1: command 0x0406 tx timeout [ 196.407572][ T5857] Bluetooth: hci3: command 0x0406 tx timeout [ 196.560338][T12000] netlink: 'syz.3.1791': attribute type 10 has an invalid length. [ 196.578821][T12000] netdevsim netdevsim3 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 196.597782][T12000] netdevsim netdevsim3 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 196.608089][T12000] netdevsim netdevsim3 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 196.623430][T12000] netdevsim netdevsim3 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 196.652196][T12002] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 197.666088][T12056] tipc: MTU too low for tipc bearer [ 197.966836][T12068] 0ªX¹¦D: left allmulticast mode [ 198.623226][T12109] netlink: 'syz.0.1824': attribute type 1 has an invalid length. [ 198.809639][ T96] block nbd0: Possible stuck request ffff8880252f7000: control (read@0,1024B). Runtime 30 seconds [ 198.822049][ T96] block nbd0: Possible stuck request ffff8880252f71c0: control (read@1024,1024B). Runtime 30 seconds [ 198.834736][ T96] block nbd0: Possible stuck request ffff8880252f7380: control (read@2048,1024B). Runtime 30 seconds [ 198.845874][ T96] block nbd0: Possible stuck request ffff8880252f7540: control (read@3072,1024B). Runtime 30 seconds [ 199.135808][T12141] vlan2: entered allmulticast mode [ 199.152933][T12141] veth1: entered allmulticast mode [ 199.592912][T12168] netlink: 'syz.0.1846': attribute type 12 has an invalid length. [ 199.604041][T12168] (unnamed net_device) (uninitialized): option primary_reselect: invalid value (255) [ 199.647943][T12168] __nla_validate_parse: 21 callbacks suppressed [ 199.647960][T12168] netlink: 48 bytes leftover after parsing attributes in process `syz.0.1846'. [ 199.670660][T12170] Can not set IPV6_FL_F_REFLECT if flowlabel_consistency sysctl is enable [ 199.870212][T12189] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1852'. [ 199.962550][T12197] netlink: 'syz.2.1855': attribute type 25 has an invalid length. [ 200.082521][T12204] veth1_macvtap: left promiscuous mode [ 200.226494][T12211] netlink: 112 bytes leftover after parsing attributes in process `syz.2.1861'. [ 200.253238][T12211] x_tables: ip6_tables: TPROXY target: used from hooks FORWARD, but only usable from PREROUTING [ 200.338847][T12217] netlink: 112 bytes leftover after parsing attributes in process `syz.0.1863'. [ 200.365697][T12217] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 200.608978][T12227] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1866'. [ 200.641581][T12227] netlink: 20 bytes leftover after parsing attributes in process `syz.3.1866'. [ 200.680973][T12231] netlink: 32 bytes leftover after parsing attributes in process `syz.4.1868'. [ 200.707535][T12232] netlink: 44 bytes leftover after parsing attributes in process `syz.3.1866'. [ 200.727192][T12227] netlink: 40 bytes leftover after parsing attributes in process `syz.3.1866'. [ 200.977960][T12238] netlink: 'syz.0.1869': attribute type 10 has an invalid length. [ 201.038264][T12238] bridge_slave_1: entered promiscuous mode [ 201.069063][T12238] bridge_slave_1: entered allmulticast mode [ 201.079140][T12238] bond0: (slave bridge_slave_1): Enslaving as an active interface with an up link [ 201.156010][T12252] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 201.171490][T12252] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 201.408066][T12267] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1880'. [ 201.442890][T12267] xt_CHECKSUM: CHECKSUM should be avoided. If really needed, restrict with "-p udp" and only use in OUTPUT [ 201.568939][T12275] openvswitch: netlink: Multiple metadata blocks provided [ 201.592559][T12276] (unnamed net_device) (uninitialized): option resend_igmp: invalid value (32767) [ 201.628297][T12276] (unnamed net_device) (uninitialized): option resend_igmp: allowed values 0 - 255 [ 201.676864][T12276] netlink: 'syz.3.1883': attribute type 10 has an invalid length. [ 201.740987][T12276] 8021q: adding VLAN 0 to HW filter on device team0 [ 201.761350][T12276] bond0: (slave team0): Enslaving as an active interface with an up link [ 202.318728][T12306] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 202.495528][T12334] netlink: 'syz.4.1896': attribute type 4 has an invalid length. [ 202.522119][T12334] netlink: 'syz.4.1896': attribute type 4 has an invalid length. [ 202.886179][T12347] netlink: 'syz.1.1903': attribute type 1 has an invalid length. [ 203.585495][T12381] bridge_slave_0: entered promiscuous mode [ 204.562316][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 205.733859][T12395] vlan2: entered allmulticast mode [ 205.739016][T12395] mac80211_hwsim hwsim2 wlan0: entered allmulticast mode [ 205.757356][T12404] tipc: Enabled bearer , priority 0 [ 205.849924][T12416] macvtap1: entered promiscuous mode [ 205.855360][T12416] vlan0: entered promiscuous mode [ 205.864341][T12416] macvtap1: entered allmulticast mode [ 205.872571][T12416] vlan0: entered allmulticast mode [ 205.878152][T12416] veth0_vlan: entered allmulticast mode [ 205.884173][T12431] netlink: 'syz.2.1925': attribute type 1 has an invalid length. [ 205.911967][T12404] tipc: Disabling bearer [ 206.006163][T12438] __nla_validate_parse: 6 callbacks suppressed [ 206.006181][T12438] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1927'. [ 206.092922][T12444] netlink: 58 bytes leftover after parsing attributes in process `syz.4.1929'. [ 206.275135][T12453] netlink: 256 bytes leftover after parsing attributes in process `syz.2.1932'. [ 206.505827][T12469] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1935'. [ 206.532280][T12472] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1937'. [ 206.558357][T12472] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1937'. [ 206.563925][T12469] A link change request failed with some changes committed already. Interface bridge_slave_1 may have been left with an inconsistent configuration, please check. [ 206.834872][T12489] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1940'. [ 206.964292][T12493] xt_ipcomp: unknown flags B [ 206.995333][T12493] netem: change failed [ 207.225715][T12512] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1943'. [ 208.101619][ C1] vcan0: j1939_xtp_rx_dat: no tx connection found [ 208.242394][T12524] workqueue: Failed to create a rescuer kthread for wq "bond3": -EINTR [ 208.254099][T12537] bridge_slave_0: entered promiscuous mode [ 208.425243][T12551] netem: change failed [ 208.858322][ C1] vcan0: j1939_tp_rxtimer: 0xffff888056cdf800: rx timeout, send abort [ 209.099466][T12583] netlink: 256 bytes leftover after parsing attributes in process `syz.4.1965'. [ 209.262932][T12600] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1969'. [ 209.353400][T12601] ksmbd: Unknown IPC event: 3, ignore. [ 209.367736][ C1] vcan0: j1939_tp_rxtimer: 0xffff888056cdf800: abort rx timeout. Force session deactivation [ 209.739393][T12627] team0: Device vti0 is of different type [ 210.158255][T12650] sch_tbf: burst 8 is lower than device ip6tnl0 mtu (1452) ! [ 210.218736][T12658] syzkaller0: entered promiscuous mode [ 210.226505][T12658] syzkaller0: entered allmulticast mode [ 210.432191][T12665] sit0: entered promiscuous mode [ 210.453606][T12665] netlink: 'syz.0.1992': attribute type 1 has an invalid length. [ 210.529392][T12671] netlink: 'syz.1.1995': attribute type 7 has an invalid length. [ 210.600524][T12676] openvswitch: netlink: ct_state flags 0000ee01 unsupported [ 210.846718][T12688] Unknown options in mask 1f4 [ 211.047788][T12703] __nla_validate_parse: 7 callbacks suppressed [ 211.047807][T12703] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2006'. [ 211.335147][T12717] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2012'. [ 211.350454][T12717] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2012'. [ 211.386900][T12720] workqueue: name exceeds WQ_NAME_LEN. Truncating to: !寿$ûÌÌULÙvy¸ÚØ¢…D£øUDŒžóúz [ 211.522873][T12724] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2015'. [ 211.807696][T12742] netlink: 160 bytes leftover after parsing attributes in process `syz.2.2022'. [ 211.824014][T12744] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2021'. [ 211.831927][T12737] netlink: 'syz.1.2019': attribute type 10 has an invalid length. [ 211.934984][T12737] bond0: (slave wlan1): Enslaving as an active interface with an up link [ 211.960046][T12750] netlink: 'syz.3.2024': attribute type 21 has an invalid length. [ 211.968242][T12750] IPv6: NLM_F_CREATE should be specified when creating new route [ 211.995915][T12750] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 212.003220][T12750] IPv6: NLM_F_CREATE should be set when creating new route [ 212.010514][T12750] IPv6: NLM_F_CREATE should be set when creating new route [ 212.017760][T12750] IPv6: NLM_F_CREATE should be set when creating new route [ 212.065874][T12752] xt_CT: You must specify a L4 protocol and not use inversions on it [ 212.663403][T12785] netlink: 'syz.2.2033': attribute type 11 has an invalid length. [ 212.680557][T12785] netlink: 224 bytes leftover after parsing attributes in process `syz.2.2033'. [ 212.931417][T12794] netlink: 'syz.0.2036': attribute type 1 has an invalid length. [ 212.945662][T12794] netlink: 224 bytes leftover after parsing attributes in process `syz.0.2036'. [ 213.156097][T12802] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2038'. [ 213.435473][T12820] netlink: 32 bytes leftover after parsing attributes in process `syz.2.2044'. [ 213.467897][T12813] netlink: 'syz.1.2041': attribute type 24 has an invalid length. [ 213.709340][T12832] bond3: entered promiscuous mode [ 213.729948][T12832] bond3: entered allmulticast mode [ 213.735788][T12832] 8021q: adding VLAN 0 to HW filter on device bond3 [ 213.795175][T12842] chnl_net:caif_netlink_parms(): no params data found [ 215.828122][T12848] iwpm_register_pid: Unable to send a nlmsg (client = 2) [ 215.857480][T12848] infiniband syz1: RDMA CMA: cma_listen_on_dev, error -98 [ 215.933514][T12866] tipc: New replicast peer: 255.255.255.255 [ 215.941735][T12866] tipc: Enabled bearer , priority 10 [ 215.978924][T12865] tipc: Enabling of bearer rejected, already enabled [ 216.050108][T12870] netlink: 'syz.0.2058': attribute type 1 has an invalid length. [ 216.144784][T12870] bond6: entered promiscuous mode [ 216.151045][T12870] bond6: entered allmulticast mode [ 216.156740][T12870] 8021q: adding VLAN 0 to HW filter on device bond6 [ 216.164757][T12876] __nla_validate_parse: 2 callbacks suppressed [ 216.164772][T12876] netlink: 48 bytes leftover after parsing attributes in process `syz.4.2059'. [ 216.174671][T12870] ip6gretap1: entered promiscuous mode [ 216.186780][T12870] ip6gretap1: entered allmulticast mode [ 216.198008][T12870] bond6: (slave ip6gretap1): Enslaving as a backup interface with an up link [ 216.239289][T12879] syz_tun: left allmulticast mode [ 216.252822][ T13] bond6: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 216.281997][T12879] syz_tun: left promiscuous mode [ 216.287201][T12879] bridge0: port 1(syz_tun) entered disabled state [ 216.364130][T12879] bond0: (slave team0): Releasing backup interface [ 216.410605][ T59] bond6: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 216.490718][T12879] bond0: (slave dummy0): Releasing backup interface [ 216.509097][T12879] bond0: (slave bond_slave_0): Releasing backup interface [ 216.535522][T12879] bond0: (slave bond_slave_1): Releasing backup interface [ 216.552726][T12879] team0: Port device C removed [ 216.563426][T12879] team0: Port device team_slave_1 removed [ 216.570264][T12879] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 216.579767][T12879] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 216.593629][T12879] team0: Port device geneve0 removed [ 216.608428][T12887] tipc: Enabled bearer , priority 0 [ 217.059784][ T981] tipc: Node number set to 1093409099 [ 217.087195][T12927] netlink: 'syz.2.2075': attribute type 4 has an invalid length. [ 217.222666][T12946] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2079'. [ 217.487675][T12952] netlink: 100 bytes leftover after parsing attributes in process `syz.4.2081'. [ 217.599783][ T6033] tipc: Node number set to 3002339209 [ 217.661814][T12959] IPVS: set_ctl: invalid protocol: 41 0.0.0.0:20004 [ 218.051806][T12974] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2087'. [ 218.307295][T12995] x_tables: ip_tables: cgroup.0 match: invalid size 8 (kernel) != (user) 16 [ 218.317023][T12996] xt_addrtype: both incoming and outgoing interface limitation cannot be selected [ 218.348174][T12998] openvswitch: netlink: VXLAN extension message has 1 unknown bytes. [ 218.356907][T12997] openvswitch: netlink: VXLAN extension message has 1 unknown bytes. [ 218.479411][T13001] netlink: 44 bytes leftover after parsing attributes in process `syz.2.2097'. [ 218.491871][T13006] netlink: 156 bytes leftover after parsing attributes in process `syz.4.2098'. [ 218.650934][T13016] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 218.690220][T13017] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 218.804174][T13030] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2104'. [ 219.045598][T13040] netlink: 'syz.0.2109': attribute type 1 has an invalid length. [ 219.065884][T13040] netlink: 172 bytes leftover after parsing attributes in process `syz.0.2109'. [ 219.159927][T13047] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci4/hci4:200/input6 [ 219.473922][T13067] netlink: 20 bytes leftover after parsing attributes in process `syz.3.2118'. [ 219.484483][T13067] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2118'. [ 219.748843][T13084] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 219.793071][T13087] ip6t_srh: unknown srh match flags 4001 [ 219.904746][T13091] netlink: 'syz.0.2126': attribute type 1 has an invalid length. [ 219.915193][T13092] netlink: 'syz.0.2126': attribute type 1 has an invalid length. [ 219.961038][T13091] veth3: entered promiscuous mode [ 220.177473][T13103] netlink: 'syz.1.2130': attribute type 2 has an invalid length. [ 220.285127][T13111] openvswitch: netlink: Invalid MD length 0 for MD type 0 [ 220.293541][T13111] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 220.407389][T13117] macsec0: entered promiscuous mode [ 220.417524][T13119] netlink: 'syz.2.2133': attribute type 66 has an invalid length. [ 220.792526][ T6225] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 20000 - 0 [ 220.911638][ T6225] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 20000 - 0 [ 221.016237][T13137] IPVS: set_ctl: invalid protocol: 43 224.0.0.2:20003 [ 221.057583][ T6225] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 20000 - 0 [ 221.207255][ T6225] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 20000 - 0 [ 221.345700][T13149] netlink: 'syz.0.2145': attribute type 1 has an invalid length. [ 221.356138][T13151] netlink: 'syz.1.2147': attribute type 21 has an invalid length. [ 221.388451][T13151] __nla_validate_parse: 4 callbacks suppressed [ 221.388467][T13151] netlink: 132 bytes leftover after parsing attributes in process `syz.1.2147'. [ 221.643670][ T5167] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 221.655680][ T5167] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 221.664737][ T5167] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 221.675164][ T5167] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 221.685017][ T5167] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 221.717023][ T6225] bond1 (unregistering): (slave ip6gretap1): Releasing active interface [ 221.820497][T13166] netlink: 'syz.1.2150': attribute type 1 has an invalid length. [ 222.003196][ T6225] bond1 (unregistering): (slave geneve2): Releasing active interface [ 222.398489][ T6225] bond0 (unregistering): (slave team0): Releasing backup interface [ 222.408613][ T6225] bond0 (unregistering): Released all slaves [ 222.507776][ T6225] bond1 (unregistering): Released all slaves [ 222.522356][ T6225] bond2 (unregistering): Released all slaves [ 222.624117][ T6225] bond3 (unregistering): Released all slaves [ 222.848993][ T6225] : left promiscuous mode [ 222.972863][T13190] veth0: entered promiscuous mode [ 222.988485][T13190] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2159'. [ 223.127039][T13190] veth0 (unregistering): left promiscuous mode [ 223.127285][T13202] netlink: 68 bytes leftover after parsing attributes in process `syz.0.2161'. [ 223.147950][T13202] netlink: 68 bytes leftover after parsing attributes in process `syz.0.2161'. [ 223.194819][ T6225] tipc: Disabling bearer [ 223.222774][ T6225] tipc: Left network mode [ 223.766979][ T51] Bluetooth: hci2: command tx timeout [ 224.023457][T13252] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2176'. [ 224.143367][T13260] netlink: 'syz.1.2178': attribute type 83 has an invalid length. [ 224.144064][T13262] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2178'. [ 224.387755][T13268] bpf setsockopt: ignoring program buffer with optlen=65187 (max_optlen=4096) [ 224.724636][ T6225] hsr_slave_0: left promiscuous mode [ 224.761219][ T6225] hsr_slave_1: left promiscuous mode [ 224.772521][ T6225] vlan0: left allmulticast mode [ 224.772895][T13286] netlink: 20 bytes leftover after parsing attributes in process `syz.0.2187'. [ 224.777410][ T6225] veth0_vlan: left allmulticast mode [ 224.777470][ T6225] vlan0: left promiscuous mode [ 225.037963][T13302] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2188'. [ 225.049112][T13302] netlink: 'syz.1.2188': attribute type 30 has an invalid length. [ 225.061413][T13302] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2188'. [ 225.712484][ T1334] smc: removing ib device syz! [ 225.842303][ T51] Bluetooth: hci2: command tx timeout [ 226.125269][T13158] chnl_net:caif_netlink_parms(): no params data found [ 226.288711][T13311] sctp: [Deprecated]: syz.1.2190 (pid 13311) Use of int in maxseg socket option. [ 226.288711][T13311] Use struct sctp_assoc_value instead [ 226.551054][T13332] netlink: 16 bytes leftover after parsing attributes in process `syz.0.2192'. [ 226.624662][T13335] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2196'. [ 226.706538][T13158] bridge0: port 1(bridge_slave_0) entered blocking state [ 226.749620][T13158] bridge0: port 1(bridge_slave_0) entered disabled state [ 226.757086][T13158] bridge_slave_0: entered allmulticast mode [ 226.774206][T13158] bridge_slave_0: entered promiscuous mode [ 226.793455][T13158] bridge0: port 2(bridge_slave_1) entered blocking state [ 226.801339][T13158] bridge0: port 2(bridge_slave_1) entered disabled state [ 226.808715][T13158] bridge_slave_1: entered allmulticast mode [ 226.845317][T13158] bridge_slave_1: entered promiscuous mode [ 227.046474][T13158] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 227.106711][T13158] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 227.322549][T13158] team0: Port device team_slave_0 added [ 227.345505][T13158] team0: Port device team_slave_1 added [ 227.365450][T13359] IPVS: set_ctl: invalid protocol: 22 224.0.0.1:20000 [ 227.373668][T13359] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2204'. [ 227.573546][T13158] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 227.599208][T13158] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 227.636950][T13158] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 227.650078][T13158] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 227.658100][T13158] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 227.709367][T13158] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 227.915911][T13381] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2210'. [ 227.933269][ T51] Bluetooth: hci2: command tx timeout [ 227.947589][T13380] SET target dimension over the limit! [ 227.996270][T13158] hsr_slave_0: entered promiscuous mode [ 228.003077][T13158] hsr_slave_1: entered promiscuous mode [ 228.010612][T13158] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 228.018296][T13158] Cannot create hsr debugfs directory [ 228.230806][T13397] netlink: 36 bytes leftover after parsing attributes in process `syz.3.2214'. [ 228.263066][T13397] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2214'. [ 228.314297][T13397] netlink: 'syz.3.2214': attribute type 21 has an invalid length. [ 228.441606][T13408] netlink: 576 bytes leftover after parsing attributes in process `syz.1.2218'. [ 228.663414][T13418] netlink: 48 bytes leftover after parsing attributes in process `syz.4.2222'. [ 228.809779][T13427] netlink: 'syz.0.2225': attribute type 1 has an invalid length. [ 228.828397][T13427] netlink: 'syz.0.2225': attribute type 1 has an invalid length. [ 228.837192][T13427] netlink: 'syz.0.2225': attribute type 1 has an invalid length. [ 228.845364][T13427] netlink: 'syz.0.2225': attribute type 2 has an invalid length. [ 228.855116][T13427] netlink: 76 bytes leftover after parsing attributes in process `syz.0.2225'. [ 228.884300][ T96] block nbd0: Possible stuck request ffff8880252f7000: control (read@0,1024B). Runtime 60 seconds [ 228.895502][ T96] block nbd0: Possible stuck request ffff8880252f71c0: control (read@1024,1024B). Runtime 60 seconds [ 228.907264][ T96] block nbd0: Possible stuck request ffff8880252f7380: control (read@2048,1024B). Runtime 60 seconds [ 228.918540][ T96] block nbd0: Possible stuck request ffff8880252f7540: control (read@3072,1024B). Runtime 60 seconds [ 229.038585][T13437] (unnamed net_device) (uninitialized): option resend_igmp: invalid value (32767) [ 229.068298][T13437] (unnamed net_device) (uninitialized): option resend_igmp: allowed values 0 - 255 [ 229.086494][T13443] (unnamed net_device) (uninitialized): option resend_igmp: invalid value (32767) [ 229.097453][T13443] (unnamed net_device) (uninitialized): option resend_igmp: allowed values 0 - 255 [ 229.180215][T13447] xt_hashlimit: invalid rate [ 229.211158][T13449] netlink: 'syz.0.2233': attribute type 1 has an invalid length. [ 229.375071][T13454] netlink: 56 bytes leftover after parsing attributes in process `syz.4.2232'. [ 229.430754][T13158] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 229.462266][T13158] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 229.490842][T13457] netlink: zone id is out of range [ 229.496001][T13457] netlink: zone id is out of range [ 229.501279][T13457] netlink: zone id is out of range [ 229.506409][T13457] netlink: zone id is out of range [ 229.512043][T13457] netlink: zone id is out of range [ 229.517184][T13457] netlink: zone id is out of range [ 229.527866][T13158] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 229.543281][T13462] x_tables: ip_tables: rpfilter match: used from hooks OUTPUT, but only valid from PREROUTING [ 229.563853][T13158] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 229.567142][T13457] netlink: zone id is out of range [ 229.626452][T13457] netlink: zone id is out of range [ 229.653107][T13457] netlink: zone id is out of range [ 229.658348][T13457] netlink: zone id is out of range [ 229.854773][T13482] netlink: 'syz.0.2242': attribute type 2 has an invalid length. [ 229.912257][T13158] 8021q: adding VLAN 0 to HW filter on device bond0 [ 229.947714][T13158] 8021q: adding VLAN 0 to HW filter on device team0 [ 229.965723][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 229.972945][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 229.999963][ T51] Bluetooth: hci2: command tx timeout [ 230.034429][ T59] bridge0: port 2(bridge_slave_1) entered blocking state [ 230.041630][ T59] bridge0: port 2(bridge_slave_1) entered forwarding state [ 230.245596][T13502] netlink: 'syz.3.2249': attribute type 4 has an invalid length. [ 230.339392][T13507] netlink: 'syz.3.2251': attribute type 1 has an invalid length. [ 230.532104][T13158] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 230.608312][T13158] veth0_vlan: entered promiscuous mode [ 230.638399][T13158] veth1_vlan: entered promiscuous mode [ 230.730852][T13158] veth0_macvtap: entered promiscuous mode [ 230.749041][T13158] veth1_macvtap: entered promiscuous mode [ 230.795641][T13158] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 230.815927][T13158] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 230.841063][T13158] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 230.850893][T13158] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 230.860201][T13158] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 230.869035][T13158] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 231.173274][T13533] pimreg: entered allmulticast mode [ 231.287461][ T36] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 231.308425][ T36] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 231.386117][ T36] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 231.405522][ T36] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 231.595743][T13552] ================================================================== [ 231.603865][T13552] BUG: KASAN: slab-use-after-free in cfusbl_device_notify+0x150/0x6a0 [ 231.612058][T13552] Read of size 8 at addr ffff888028960c50 by task syz.1.2264/13552 [ 231.619969][T13552] [ 231.622289][T13552] CPU: 1 UID: 0 PID: 13552 Comm: syz.1.2264 Not tainted 6.16.0-rc5-syzkaller-00186-ga059ef8e8889 #0 PREEMPT(full) [ 231.622304][T13552] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 231.622311][T13552] Call Trace: [ 231.622317][T13552] [ 231.622322][T13552] dump_stack_lvl+0x189/0x250 [ 231.622338][T13552] ? __virt_addr_valid+0x1c8/0x5c0 [ 231.622351][T13552] ? rcu_is_watching+0x15/0xb0 [ 231.622362][T13552] ? __kasan_check_byte+0x12/0x40 [ 231.622374][T13552] ? __pfx_dump_stack_lvl+0x10/0x10 [ 231.622387][T13552] ? rcu_is_watching+0x15/0xb0 [ 231.622398][T13552] ? lock_release+0x4b/0x3e0 [ 231.622409][T13552] ? __virt_addr_valid+0x1c8/0x5c0 [ 231.622420][T13552] ? __virt_addr_valid+0x4a5/0x5c0 [ 231.622432][T13552] print_report+0xd2/0x2b0 [ 231.622442][T13552] ? cfusbl_device_notify+0x150/0x6a0 [ 231.622454][T13552] kasan_report+0x118/0x150 [ 231.622466][T13552] ? cfusbl_device_notify+0x150/0x6a0 [ 231.622479][T13552] cfusbl_device_notify+0x150/0x6a0 [ 231.622490][T13552] ? net_generic+0x1e/0x240 [ 231.622501][T13552] ? __pfx_cfusbl_device_notify+0x10/0x10 [ 231.622512][T13552] ? caif_device_notify+0x250/0xfc0 [ 231.622524][T13552] ? smc_pnet_netdev_event+0x3b5/0x6c0 [ 231.622541][T13552] notifier_call_chain+0x1b3/0x3e0 [ 231.622564][T13552] register_netdevice+0x12ee/0x1ae0 [ 231.622592][T13552] ? __pfx_register_netdevice+0x10/0x10 [ 231.622616][T13552] ? __asan_memset+0x22/0x50 [ 231.622631][T13552] ? dev_addr_mod+0x2ce/0x3d0 [ 231.622660][T13552] register_netdev+0x40/0x60 [ 231.622680][T13552] bnep_add_connection+0x6bf/0xbf0 [ 231.622707][T13552] ? __pfx_bnep_add_connection+0x10/0x10 [ 231.622724][T13552] ? __fget_files+0x3a0/0x420 [ 231.622739][T13552] do_bnep_sock_ioctl+0x40e/0x640 [ 231.622754][T13552] ? __pfx_do_bnep_sock_ioctl+0x10/0x10 [ 231.622770][T13552] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 231.622784][T13552] ? tomoyo_path_number_perm+0x4e2/0x5a0 [ 231.622796][T13552] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 231.622811][T13552] sock_do_ioctl+0xd9/0x300 [ 231.622827][T13552] ? __pfx_sock_do_ioctl+0x10/0x10 [ 231.622839][T13552] ? __lock_acquire+0xab9/0xd20 [ 231.622852][T13552] sock_ioctl+0x576/0x790 [ 231.622866][T13552] ? __pfx_sock_ioctl+0x10/0x10 [ 231.622880][T13552] ? __fget_files+0x2a/0x420 [ 231.622891][T13552] ? __fget_files+0x3a0/0x420 [ 231.622902][T13552] ? __fget_files+0x2a/0x420 [ 231.622914][T13552] ? bpf_lsm_file_ioctl+0x9/0x20 [ 231.622925][T13552] ? __pfx_sock_ioctl+0x10/0x10 [ 231.622937][T13552] __se_sys_ioctl+0xfc/0x170 [ 231.622948][T13552] do_syscall_64+0xfa/0x3b0 [ 231.622958][T13552] ? lockdep_hardirqs_on+0x9c/0x150 [ 231.622971][T13552] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 231.622981][T13552] ? clear_bhb_loop+0x60/0xb0 [ 231.622991][T13552] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 231.623000][T13552] RIP: 0033:0x7f9c4c98e929 [ 231.623011][T13552] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 231.623020][T13552] RSP: 002b:00007f9c4d8e2038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 231.623031][T13552] RAX: ffffffffffffffda RBX: 00007f9c4cbb5fa0 RCX: 00007f9c4c98e929 [ 231.623038][T13552] RDX: 0000200000000540 RSI: 00000000400442c8 RDI: 0000000000000008 [ 231.623045][T13552] RBP: 00007f9c4ca10b39 R08: 0000000000000000 R09: 0000000000000000 [ 231.623051][T13552] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 231.623057][T13552] R13: 0000000000000000 R14: 00007f9c4cbb5fa0 R15: 00007ffeb3f67ec8 [ 231.623068][T13552] [ 231.623071][T13552] [ 231.968802][T13552] Allocated by task 51: [ 231.972946][T13552] kasan_save_track+0x3e/0x80 [ 231.977620][T13552] __kasan_kmalloc+0x93/0xb0 [ 231.982200][T13552] __kmalloc_cache_noprof+0x230/0x3d0 [ 231.987563][T13552] __hci_conn_add+0x233/0x1b30 [ 231.992316][T13552] hci_conn_request_evt+0x53e/0xb60 [ 231.997501][T13552] hci_event_packet+0x7e0/0x1200 [ 232.002434][T13552] hci_rx_work+0x46a/0xe80 [ 232.006834][T13552] process_scheduled_works+0xae1/0x17b0 [ 232.012374][T13552] worker_thread+0x8a0/0xda0 [ 232.016952][T13552] kthread+0x70e/0x8a0 [ 232.021013][T13552] ret_from_fork+0x3fc/0x770 [ 232.025589][T13552] ret_from_fork_asm+0x1a/0x30 [ 232.030345][T13552] [ 232.032656][T13552] Freed by task 13552: [ 232.036708][T13552] kasan_save_track+0x3e/0x80 [ 232.041374][T13552] kasan_save_free_info+0x46/0x50 [ 232.046392][T13552] __kasan_slab_free+0x62/0x70 [ 232.051233][T13552] kfree+0x18e/0x440 [ 232.055125][T13552] device_release+0x99/0x1c0 [ 232.059711][T13552] kobject_put+0x22b/0x480 [ 232.064122][T13552] device_add+0x6bb/0xb50 [ 232.068444][T13552] netdev_register_kobject+0x156/0x2f0 [ 232.073907][T13552] register_netdevice+0x126c/0x1ae0 [ 232.079105][T13552] register_netdev+0x40/0x60 [ 232.083689][T13552] bnep_add_connection+0x6bf/0xbf0 [ 232.088796][T13552] do_bnep_sock_ioctl+0x40e/0x640 [ 232.093822][T13552] sock_do_ioctl+0xd9/0x300 [ 232.098321][T13552] sock_ioctl+0x576/0x790 [ 232.102646][T13552] __se_sys_ioctl+0xfc/0x170 [ 232.107225][T13552] do_syscall_64+0xfa/0x3b0 [ 232.111723][T13552] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 232.117607][T13552] [ 232.119931][T13552] Last potentially related work creation: [ 232.125644][T13552] kasan_save_stack+0x3e/0x60 [ 232.130314][T13552] kasan_record_aux_stack+0xbd/0xd0 [ 232.135509][T13552] insert_work+0x3d/0x330 [ 232.139829][T13552] __queue_work+0xcfc/0xfe0 [ 232.144324][T13552] queue_delayed_work_on+0x18b/0x280 [ 232.149599][T13552] l2cap_chan_del+0x285/0x5e0 [ 232.154270][T13552] l2cap_conn_del+0x388/0x680 [ 232.158939][T13552] hci_conn_hash_flush+0x10d/0x230 [ 232.164046][T13552] hci_dev_close_sync+0xaef/0x1330 [ 232.169155][T13552] hci_unregister_dev+0x21a/0x510 [ 232.174172][T13552] vhci_release+0x80/0xd0 [ 232.178493][T13552] __fput+0x449/0xa70 [ 232.182473][T13552] task_work_run+0x1d1/0x260 [ 232.187062][T13552] do_exit+0x6b5/0x22e0 [ 232.191225][T13552] do_group_exit+0x21c/0x2d0 [ 232.195821][T13552] __x64_sys_exit_group+0x3f/0x40 [ 232.200843][T13552] x64_sys_call+0x21ba/0x21c0 [ 232.205521][T13552] do_syscall_64+0xfa/0x3b0 [ 232.210018][T13552] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 232.215906][T13552] [ 232.218216][T13552] The buggy address belongs to the object at ffff888028960000 [ 232.218216][T13552] which belongs to the cache kmalloc-8k of size 8192 [ 232.232258][T13552] The buggy address is located 3152 bytes inside of [ 232.232258][T13552] freed 8192-byte region [ffff888028960000, ffff888028962000) [ 232.246222][T13552] [ 232.248538][T13552] The buggy address belongs to the physical page: [ 232.254946][T13552] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x28960 [ 232.263698][T13552] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 232.272207][T13552] ksm flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 232.280095][T13552] page_type: f5(slab) [ 232.284070][T13552] raw: 00fff00000000040 ffff88801a442280 ffffea0001db9a00 0000000000000003 [ 232.292644][T13552] raw: 0000000000000000 0000000000020002 00000000f5000000 0000000000000000 [ 232.301228][T13552] head: 00fff00000000040 ffff88801a442280 ffffea0001db9a00 0000000000000003 [ 232.309894][T13552] head: 0000000000000000 0000000000020002 00000000f5000000 0000000000000000 [ 232.318566][T13552] head: 00fff00000000003 ffffea0000a25801 00000000ffffffff 00000000ffffffff [ 232.327324][T13552] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 232.336076][T13552] page dumped because: kasan: bad access detected [ 232.342494][T13552] page_owner tracks the page as allocated [ 232.348224][T13552] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd28c0(GFP_NOWAIT|__GFP_IO|__GFP_FS|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 11572, tgid 11571 (syz.0.1666), ts 188162228700, free_ts 188111060484 [ 232.369753][T13552] post_alloc_hook+0x240/0x2a0 [ 232.374527][T13552] get_page_from_freelist+0x21e4/0x22c0 [ 232.380072][T13552] __alloc_frozen_pages_noprof+0x181/0x370 [ 232.385877][T13552] alloc_pages_mpol+0x232/0x4a0 [ 232.390720][T13552] allocate_slab+0x8a/0x3b0 [ 232.395310][T13552] ___slab_alloc+0xbfc/0x1480 [ 232.399979][T13552] __kmalloc_node_track_caller_noprof+0x2f8/0x4e0 [ 232.406386][T13552] kmalloc_reserve+0x136/0x290 [ 232.411142][T13552] __alloc_skb+0x142/0x2d0 [ 232.415548][T13552] netlink_dump+0x161/0xe60 [ 232.420041][T13552] netlink_recvmsg+0x676/0xa30 [ 232.424807][T13552] sock_recvmsg_nosec+0x186/0x1c0 [ 232.429819][T13552] ____sys_recvmsg+0x3aa/0x460 [ 232.434577][T13552] ___sys_recvmsg+0x1b5/0x510 [ 232.439250][T13552] do_recvmmsg+0x307/0x770 [ 232.443662][T13552] __x64_sys_recvmmsg+0x190/0x240 [ 232.448680][T13552] page last free pid 11575 tgid 11575 stack trace: [ 232.455166][T13552] __free_frozen_pages+0xc71/0xe70 [ 232.460270][T13552] __put_partials+0x161/0x1c0 [ 232.464946][T13552] put_cpu_partial+0x17c/0x250 [ 232.469703][T13552] __slab_free+0x2f7/0x400 [ 232.474113][T13552] qlist_free_all+0x97/0x140 [ 232.478690][T13552] kasan_quarantine_reduce+0x148/0x160 [ 232.484137][T13552] __kasan_slab_alloc+0x22/0x80 [ 232.488985][T13552] __kmalloc_cache_noprof+0x1be/0x3d0 [ 232.494437][T13552] load_elf_binary+0x1e3c/0x2790 [ 232.499370][T13552] bprm_execve+0x99c/0x1450 [ 232.503878][T13552] kernel_execve+0x8f0/0x9f0 [ 232.508460][T13552] call_usermodehelper_exec_async+0x210/0x360 [ 232.514518][T13552] ret_from_fork+0x3fc/0x770 [ 232.519096][T13552] ret_from_fork_asm+0x1a/0x30 [ 232.523859][T13552] [ 232.526199][T13552] Memory state around the buggy address: [ 232.531817][T13552] ffff888028960b00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 232.539865][T13552] ffff888028960b80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 232.547916][T13552] >ffff888028960c00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 232.555964][T13552] ^ [ 232.562623][T13552] ffff888028960c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 232.571019][T13552] ffff888028960d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 232.580557][T13552] ================================================================== [ 232.611603][T13552] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 232.618856][T13552] CPU: 0 UID: 0 PID: 13552 Comm: syz.1.2264 Not tainted 6.16.0-rc5-syzkaller-00186-ga059ef8e8889 #0 PREEMPT(full) [ 232.631018][T13552] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 232.641082][T13552] Call Trace: [ 232.644362][T13552] [ 232.647290][T13552] dump_stack_lvl+0x99/0x250 [ 232.651883][T13552] ? __asan_memcpy+0x40/0x70 [ 232.656467][T13552] ? __pfx_dump_stack_lvl+0x10/0x10 [ 232.661917][T13552] ? __pfx__printk+0x10/0x10 [ 232.666505][T13552] panic+0x2db/0x790 [ 232.670394][T13552] ? __pfx_panic+0x10/0x10 [ 232.674807][T13552] ? _raw_spin_unlock_irqrestore+0xfd/0x110 [ 232.680694][T13552] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 232.687014][T13552] ? print_memory_metadata+0x314/0x400 [ 232.692471][T13552] ? cfusbl_device_notify+0x150/0x6a0 [ 232.697838][T13552] check_panic_on_warn+0x89/0xb0 [ 232.702791][T13552] ? cfusbl_device_notify+0x150/0x6a0 [ 232.708176][T13552] end_report+0x78/0x160 [ 232.712421][T13552] kasan_report+0x129/0x150 [ 232.716918][T13552] ? cfusbl_device_notify+0x150/0x6a0 [ 232.722287][T13552] cfusbl_device_notify+0x150/0x6a0 [ 232.727480][T13552] ? net_generic+0x1e/0x240 [ 232.731974][T13552] ? __pfx_cfusbl_device_notify+0x10/0x10 [ 232.737685][T13552] ? caif_device_notify+0x250/0xfc0 [ 232.742875][T13552] ? smc_pnet_netdev_event+0x3b5/0x6c0 [ 232.748328][T13552] notifier_call_chain+0x1b3/0x3e0 [ 232.753437][T13552] register_netdevice+0x12ee/0x1ae0 [ 232.758638][T13552] ? __pfx_register_netdevice+0x10/0x10 [ 232.764340][T13552] ? __asan_memset+0x22/0x50 [ 232.768918][T13552] ? dev_addr_mod+0x2ce/0x3d0 [ 232.773586][T13552] register_netdev+0x40/0x60 [ 232.778171][T13552] bnep_add_connection+0x6bf/0xbf0 [ 232.783278][T13552] ? __pfx_bnep_add_connection+0x10/0x10 [ 232.788907][T13552] ? __fget_files+0x3a0/0x420 [ 232.793672][T13552] do_bnep_sock_ioctl+0x40e/0x640 [ 232.798692][T13552] ? __pfx_do_bnep_sock_ioctl+0x10/0x10 [ 232.804239][T13552] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 232.809880][T13552] ? tomoyo_path_number_perm+0x4e2/0x5a0 [ 232.815538][T13552] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 232.821531][T13552] sock_do_ioctl+0xd9/0x300 [ 232.826039][T13552] ? __pfx_sock_do_ioctl+0x10/0x10 [ 232.831143][T13552] ? __lock_acquire+0xab9/0xd20 [ 232.835987][T13552] sock_ioctl+0x576/0x790 [ 232.840314][T13552] ? __pfx_sock_ioctl+0x10/0x10 [ 232.845159][T13552] ? __fget_files+0x2a/0x420 [ 232.849741][T13552] ? __fget_files+0x3a0/0x420 [ 232.854410][T13552] ? __fget_files+0x2a/0x420 [ 232.858993][T13552] ? bpf_lsm_file_ioctl+0x9/0x20 [ 232.863918][T13552] ? __pfx_sock_ioctl+0x10/0x10 [ 232.868762][T13552] __se_sys_ioctl+0xfc/0x170 [ 232.873345][T13552] do_syscall_64+0xfa/0x3b0 [ 232.877838][T13552] ? lockdep_hardirqs_on+0x9c/0x150 [ 232.883037][T13552] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 232.889091][T13552] ? clear_bhb_loop+0x60/0xb0 [ 232.893760][T13552] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 232.899645][T13552] RIP: 0033:0x7f9c4c98e929 [ 232.904060][T13552] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 232.923657][T13552] RSP: 002b:00007f9c4d8e2038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 232.932066][T13552] RAX: ffffffffffffffda RBX: 00007f9c4cbb5fa0 RCX: 00007f9c4c98e929 [ 232.940029][T13552] RDX: 0000200000000540 RSI: 00000000400442c8 RDI: 0000000000000008 [ 232.947989][T13552] RBP: 00007f9c4ca10b39 R08: 0000000000000000 R09: 0000000000000000 [ 232.955949][T13552] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 232.963906][T13552] R13: 0000000000000000 R14: 00007f9c4cbb5fa0 R15: 00007ffeb3f67ec8 [ 232.971882][T13552] [ 232.975023][T13552] Kernel Offset: disabled [ 232.979335][T13552] Rebooting in 86400 seconds..