last executing test programs: 1m19.152579866s ago: executing program 0 (id=11207): r0 = socket$nl_route(0x10, 0x3, 0x0) poll(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) socket$nl_route(0x10, 0x3, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000002c0)={'bridge_slave_0\x00'}) socket(0x10, 0x80002, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0xd, &(0x7f0000000000)=@assoc_value, &(0x7f0000000040)=0x8) socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000240)={'bridge_slave_1\x00', 0x0}) socket$can_raw(0x1d, 0x3, 0x1) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[@ANYRES32=r3, @ANYBLOB="0000faffffff000034001280110001006272696467655f736c617665000000001c000580050021000000000006001f0000000000080022"], 0x54}}, 0x0) 1m14.623500466s ago: executing program 0 (id=11209): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r4 = socket$kcm(0x11, 0x3, 0x0) r5 = socket$unix(0x1, 0x5, 0x0) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x200800, 0x0) close(r6) r7 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r9 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r9, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000280)=@newqdisc={0x34, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdbfd, {0x0, 0x0, 0x0, r8, {0x0, 0x5}, {0xffff, 0xb}, {0x0, 0x1}}, [@qdisc_kind_options=@q_codel={{0xa}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x4004}, 0x4850) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$kcm(r4, &(0x7f00000000c0)={&(0x7f0000000580)=@xdp={0x2c, 0x1200, r10, 0x25}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000180)="270302", 0x3}], 0x1}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0x1}, {0xffff, 0xffff}, {0x0, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x1, 0x8}}}]}, 0x38}}, 0x0) 1m8.961518627s ago: executing program 0 (id=11228): r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) (async) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) bind$bt_sco(r1, &(0x7f00000004c0)={0x1f, @fixed}, 0x8) getsockopt$bt_BT_DEFER_SETUP(r1, 0x112, 0x7, &(0x7f0000000100), &(0x7f0000000140)=0x4) (async, rerun: 64) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x1, 0x41071, 0xffffffffffffffff, 0x0) (rerun: 64) getsockopt$inet6_tcp_buf(r0, 0x6, 0x21, 0x0, &(0x7f0000001800)) 1m8.629253284s ago: executing program 0 (id=11234): r0 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) socket$nl_rdma(0x10, 0x3, 0x14) r2 = syz_genetlink_get_family_id$nfc(&(0x7f0000000300), r1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000540)=ANY=[], 0x38}}, 0x0) ioctl$IOCTL_GET_NCIDEV_IDX(r0, 0x0, &(0x7f00000000c0)=0x0) sendmsg$NFC_CMD_DEV_UP(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000d80)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r2, @ANYBLOB="010426bd7000f8dbdf250200000008000100", @ANYRES32=r3], 0x1c}}, 0x4008054) write$nci(r0, 0x0, 0xc) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f03", 0x3}], 0x1}, 0x0) write$nci(r0, &(0x7f0000000040)=ANY=[@ANYBLOB="5001"], 0x14) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000004c0)) 1m8.223173794s ago: executing program 0 (id=11238): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r4 = socket$kcm(0x11, 0x3, 0x0) r5 = socket$unix(0x1, 0x5, 0x0) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x200800, 0x0) close(r6) r7 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r9 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r9, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000280)=@newqdisc={0x34, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdbfd, {0x0, 0x0, 0x0, r8, {0x0, 0x5}, {0xffff, 0xb}, {0x0, 0x1}}, [@qdisc_kind_options=@q_codel={{0xa}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x4004}, 0x4850) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$kcm(r4, &(0x7f00000000c0)={&(0x7f0000000580)=@xdp={0x2c, 0x1200, r10, 0x25}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000180)="270302", 0x3}], 0x1}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0x1}, {0xffff, 0xffff}, {0x0, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x1, 0x8}}}]}, 0x38}}, 0x0) 1m2.73395013s ago: executing program 0 (id=11253): r0 = socket$netlink(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff) sendto(r0, 0x0, 0x0, 0x4010, &(0x7f00000001c0)=@rxrpc=@in6={0x21, 0x1, 0x2, 0x1c, {0xa, 0x4e21, 0x1ff, @remote, 0x727d69d8}}, 0x80) sendmsg$DEVLINK_CMD_RATE_NEW(r0, &(0x7f0000000080)={0x0, 0x3f, &(0x7f0000000700)={&(0x7f0000000300)={0x34, r1, 0x1, 0x0, 0x25dfdbfb, {0x25}, [@handle=@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}]}, 0x34}, 0x1, 0x0, 0x0, 0x41}, 0x0) 47.668013658s ago: executing program 32 (id=11253): r0 = socket$netlink(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff) sendto(r0, 0x0, 0x0, 0x4010, &(0x7f00000001c0)=@rxrpc=@in6={0x21, 0x1, 0x2, 0x1c, {0xa, 0x4e21, 0x1ff, @remote, 0x727d69d8}}, 0x80) sendmsg$DEVLINK_CMD_RATE_NEW(r0, &(0x7f0000000080)={0x0, 0x3f, &(0x7f0000000700)={&(0x7f0000000300)={0x34, r1, 0x1, 0x0, 0x25dfdbfb, {0x25}, [@handle=@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}]}, 0x34}, 0x1, 0x0, 0x0, 0x41}, 0x0) 2.715441066s ago: executing program 3 (id=11537): sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000600)}, 0x0) r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) ioctl$sock_ifreq(r0, 0x8910, &(0x7f0000000000)={'veth0_vlan\x00', @ifru_ivalue=0x4}) ioctl$sock_netdev_private(r0, 0x89f0, &(0x7f0000000000)) r1 = syz_init_net_socket$nfc_raw(0x27, 0x5, 0x0) syz_emit_ethernet(0x5e, &(0x7f0000000140)={@local, @remote, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "8a37f2", 0x28, 0x2c, 0x0, @remote, @local, {[], {{0x4e21, 0x3, 0x41424344, 0x41424344, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, {[@generic={0x22, 0x2}, @exp_smc={0xfe, 0x6}, @exp_smc={0xfe, 0x6}, @mss={0x2, 0x4, 0xc5}]}}}}}}}}, 0x0) connect$802154_dgram(r1, &(0x7f0000000180)={0x27, @short}, 0x14) r2 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r4 = socket(0x10, 0x3, 0x0) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000a80)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYBLOB="953a04"], 0x24}}, 0x0) recvmmsg$unix(r4, &(0x7f0000002a40)=[{{0x0, 0x0, &(0x7f0000000bc0)=[{&(0x7f0000001100)=""/263, 0x107}, {&(0x7f0000004480)=""/4098, 0x1002}, {&(0x7f0000000740)=""/13, 0xd}, {&(0x7f00000003c0)=""/97, 0x61}, {&(0x7f00000004c0)=""/113, 0x71}, {&(0x7f0000000540)=""/130, 0x82}, {&(0x7f00000009c0)=""/123, 0x7b}], 0x7}}], 0x1, 0x40, 0x0) write(r4, &(0x7f0000000100)="1400000052004f7fb3e4bf80a000080000000000", 0x14) r5 = syz_genetlink_get_family_id$smc(&(0x7f0000000000), 0xffffffffffffffff) r6 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$SMC_PNETID_ADD(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f00000005c0)={0x14, r5, 0x1, 0x70bd27, 0x25dfd3fb}, 0x14}, 0x1, 0x0, 0x0, 0x4}, 0x0) sendmsg$SMC_PNETID_ADD(r4, &(0x7f0000000400)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000280)={&(0x7f0000000200)={0x68, r5, 0x800, 0x70bd2c, 0x25dfdbfe, {}, [@SMC_PNETID_ETHNAME={0x14}, @SMC_PNETID_NAME={0x9, 0x1, 'syz2\x00'}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'gretap0\x00'}, @SMC_PNETID_NAME={0x9, 0x1, 'syz0\x00'}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'ip6gretap0\x00'}]}, 0x68}, 0x1, 0x0, 0x0, 0x20000054}, 0x0) r7 = openat$cgroup_ro(r3, &(0x7f0000000080)='cgroup.kill\x00', 0x275a, 0x0) write$cgroup_subtree(r7, &(0x7f0000000900)=ANY=[@ANYRESOCT, @ANYRESDEC], 0x44) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r9, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r8, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000080), 0x100}, 0x0) close(0x3) socket$inet6(0xa, 0x2, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) r10 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x3, 0xc, &(0x7f0000000140)=ANY=[@ANYRESDEC=0x0], &(0x7f0000000080)='GPL\x00', 0x100000, 0x0, 0x0, 0x41100}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r10, 0x0, 0xe, 0x0, &(0x7f0000000000)="7084c3d1b35891ae8b1ccb110ec1", 0x0, 0x200, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) sendmsg$netlink(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000002580)=[{&(0x7f0000000180)=ANY=[@ANYBLOB="1400000013000100000000000000000008"], 0x14}], 0x1}, 0x0) 2.22075041s ago: executing program 3 (id=11544): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socket(0x1d, 0x2, 0x6) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000100)={0x60, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IE={0xe, 0x2a, [@random={0xdd, 0x8, 'Abcdefgh'}]}, @NL80211_ATTR_SCAN_SSIDS={0x10, 0x2d, 0x0, 0x1, [{0xa, 0x0, @default_ap_ssid}]}, @NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST={0x6, 0xf7, {0x2, 0xff}}, @NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI={0x5, 0xf6, 0x5}, @NL80211_ATTR_SCHED_SCAN_DELAY={0x8, 0xdc, 0x7}, @NL80211_ATTR_MAC={0xa}]}, 0x60}}, 0x0) syz_80211_inject_frame(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="5000000008021100000108021100000008025400000000000000000000000000640001000006020202020202010882848b960c121824"], 0x36) 2.100562255s ago: executing program 2 (id=11545): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f00000000c0)={0x0, 0x1}, 0x8}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000000b80)=ANY=[], 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x6, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x6, 0x0, 0x0, 0x40f00, 0x62, '\x00', 0x0, @fallback=0x2e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x8000}, 0x94) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x40040, 0x0) r0 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000300), 0xffffffffffffffff) sendmsg$IEEE802154_ASSOCIATE_REQ(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000180)={0x2c, r0, 0x1, 0x70bd28, 0x25dfdbff, {}, [@IEEE802154_ATTR_COORD_PAN_ID={0x6, 0xa, 0x1}, @IEEE802154_ATTR_CHANNEL={0x5, 0x7, 0xa}, @IEEE802154_ATTR_COORD_SHORT_ADDR={0x6, 0x8, 0xaaa0}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4044080}, 0x0) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'wg1\x00', &(0x7f0000000680)=@ethtool_drvinfo={0x3, "4c8c7347e32aa9e1919c70c199bc62daad66ce3db4830992be0a07d0e2edda49", "43ef0626e0c081542132d0ce4926e3c71697d7b2861b69fd144fbdd555d2b463", "48fc56f4f7189546b945e630bca6536abb8675503d0db872c33a48925fe26d22", "caf0c036527a0de8195ff3b19db6bee4baa2f54d3422c3f42344f6ba6e042706", "b5e2c9e1b009a67f0335ead0bda0c05ce1595fe59060e5efc038ddc648d30394", "356b668d9c9fd670b74d5817", 0xa51d, 0x612780, 0x4, 0x2, 0x7}}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000080)=ANY=[@ANYBLOB="24000000120001fbffffff000200000007"], 0x24}, 0x1, 0x0, 0x0, 0x40014}, 0x14) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5) r2 = accept4(r1, 0x0, 0x0, 0x800) sendmmsg$alg(r2, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3", 0x8}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0x4d}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11", 0xce}], 0x3, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r2, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r3 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r3, 0x107, 0xf, &(0x7f0000000100)=0x207, 0x4) sendmsg$netlink(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000004c0)=ANY=[@ANYBLOB="140100002000010000000000fbdbdf250401"], 0x114}], 0x1, 0x0, 0x0, 0x1}, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000040)={'ip6tnl0\x00', 0x0}) sendto$packet(r3, &(0x7f00000002c0)="05031600d3fc140000004788031c09103c28", 0xfce0, 0x4, &(0x7f0000000140)={0x11, 0x86dd, r4, 0x1, 0x0, 0x6, @multicast}, 0x14) 1.897653449s ago: executing program 2 (id=11547): setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(0xffffffffffffffff, 0x84, 0x6e, &(0x7f0000000000)=[@in={0x2, 0x4e23, @initdev={0xac, 0x1e, 0x1, 0x0}}, @in6={0xa, 0x4e21, 0x8001, @private0, 0x140000}, @in6={0xa, 0x4e24, 0x1, @private0={0xfc, 0x0, '\x00', 0x1}, 0x2}, @in6={0xa, 0x4e20, 0x6, @remote, 0xff}], 0x64) r0 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r0, 0x84, 0x6b, &(0x7f0000000080)=[@in6={0xa, 0x4e22, 0x6, @ipv4={'\x00', '\xff\xff', @remote}, 0xfffffa60}, @in6={0xa, 0x4e24, 0xffffffff, @private0, 0xffffffff}, @in6={0xa, 0x4e22, 0x1, @loopback, 0xfffffff9}, @in={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x27}}, @in={0x2, 0x4e24, @multicast1}], 0x74) r1 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r0, 0x84, 0x1d, &(0x7f0000000100)={0x2, [0x0, 0x0]}, &(0x7f0000000140)=0xc) getsockopt$inet_sctp_SCTP_GET_LOCAL_ADDRS(r1, 0x84, 0x6d, &(0x7f0000000180)={r3, 0x95, "ed94be7937af106630f4e0d144b1d275552d2e961aa60ffe0d60b2552e9780e0fda60be29444be0e4a0456c78e255d87bc45059dc13cab3fa7292f70bb67d677630b2c1803e9410eba4c6cec8eceb224a54f93c44d0d5d05f07682566a35d02fed7c1b0f8627e3ee3abd65c9f9388f1c50e43c2bcd303e8ef0487362302193e391b0e2ed002f2ca2526b18f71af6975c0614979b43"}, &(0x7f0000000240)=0x9d) setsockopt$inet_sctp6_SCTP_ADAPTATION_LAYER(r0, 0x84, 0x7, &(0x7f0000000280)={0x7fffffff}, 0x4) listen(r0, 0x9) setsockopt$inet6_int(r0, 0x29, 0x35, &(0x7f00000002c0)=0x1, 0x4) setsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(r1, 0x84, 0x22, &(0x7f0000000300)={0x401, 0xa, 0x5, 0x9, r4}, 0x10) r5 = socket$kcm(0x29, 0x7, 0x0) r6 = socket$xdp(0x2c, 0x3, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(r5, 0x89e2, &(0x7f0000000340)={r6}) r8 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000380), r8) setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r7, 0x6, 0x21, &(0x7f00000003c0)="16b92c60d65cd0f6e072e43e63b156c5", 0x10) syz_genetlink_get_family_id$net_dm(&(0x7f0000000400), r8) sendmsg$IEEE802154_SET_MACPARAMS(r8, &(0x7f0000000540)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000500)={&(0x7f0000000480)={0x54, r9, 0x100, 0x70bd28, 0x25dfdbfb, {}, [@IEEE802154_ATTR_CSMA_MIN_BE={0x5, 0x26, 0xb}, @IEEE802154_ATTR_LBT_ENABLED={0x5}, @IEEE802154_ATTR_CSMA_RETRIES={0x5, 0x25, 0x36}, @IEEE802154_ATTR_CSMA_MAX_BE={0x5, 0x27, 0xf9}, @IEEE802154_ATTR_FRAME_RETRIES={0x5, 0x28, 0x7}, @IEEE802154_ATTR_CSMA_MAX_BE={0x5, 0x27, 0xa9}, @IEEE802154_ATTR_CCA_ED_LEVEL={0x8, 0x24, 0x4}, @IEEE802154_ATTR_FRAME_RETRIES={0x5}]}, 0x54}, 0x1, 0x0, 0x0, 0x1}, 0x0) ioctl$AUTOFS_IOC_CATATONIC(r5, 0x9362, 0x0) r10 = socket$netlink(0x10, 0x3, 0x14) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r7, 0x84, 0x66, &(0x7f0000000580)={r2, 0xffff}, &(0x7f00000005c0)=0x8) sendmsg$MPTCP_PM_CMD_SUBFLOW_CREATE(r10, &(0x7f0000000700)={&(0x7f0000000600)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f00000006c0)={&(0x7f0000000640)={0x4c, 0x0, 0x1, 0x70bd2d, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_LOC_ID={0x5, 0x5, 0x7}, @MPTCP_PM_ATTR_LOC_ID={0x5, 0x5, 0x5}, @MPTCP_PM_ATTR_TOKEN={0x8, 0x4, 0x2}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}, @MPTCP_PM_ATTR_LOC_ID={0x5, 0x5, 0x9}, @MPTCP_PM_ATTR_TOKEN={0x8, 0x4, 0x3ff}, @MPTCP_PM_ATTR_TOKEN={0x8, 0x4, 0x7fffffff}]}, 0x4c}, 0x1, 0x0, 0x0, 0x20000800}, 0x4000) write$bt_hci(r7, &(0x7f0000000740)={0x1, @change_conn_ptype={{0x40f, 0x4}, {0xc9, 0x81}}}, 0x8) r11 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000780)={0x1b, 0x0, 0x0, 0x7214, 0x0, 0xffffffffffffffff, 0x1a7, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x3, 0x3}, 0x50) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000a40)={r0, 0x58, &(0x7f00000009c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0}}, 0x10) r13 = bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000a80), 0x4) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000bc0)={{0x1, 0xffffffffffffffff}, &(0x7f0000000b40), &(0x7f0000000b80)='%ps \x00'}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f0000000d00)={0x18, 0x10, &(0x7f0000000800)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x401}, {{0x18, 0x1, 0x1, 0x0, r11}}, {}, [@func={0x85, 0x0, 0x1, 0x0, 0x7}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000880)='syzkaller\x00', 0x8, 0xc6, &(0x7f00000008c0)=""/198, 0x41100, 0x0, '\x00', r12, @fallback=0x13, r13, 0x8, &(0x7f0000000ac0)={0x3, 0x2}, 0x8, 0x10, &(0x7f0000000b00)={0x5, 0xa, 0x4, 0xfffffffb}, 0x10, 0x0, 0xffffffffffffffff, 0x9, &(0x7f0000000c00)=[r14], &(0x7f0000000c40)=[{0x2, 0x2, 0x9, 0xb}, {0x2, 0x3, 0x10, 0x6}, {0x3, 0x1, 0x7, 0xb}, {0x4, 0x4, 0x10, 0x2}, {0x0, 0x5, 0x0, 0xe}, {0x5, 0x2, 0x7, 0x6}, {0x1, 0x4, 0xa, 0x6}, {0x3, 0x5, 0xd, 0x2}, {0x0, 0x5, 0x4}], 0x10, 0x2}, 0x94) ioctl$XFS_IOC_ATTRLIST_BY_HANDLE(r10, 0x4058587a, &(0x7f0000000fc0)={{r13, &(0x7f0000000dc0), 0x20280, &(0x7f0000000e00)={@_ha_fsid={[0x4, 0x6]}, {0x0, 0xbd44, 0x8}}, 0xe, &(0x7f0000000e40), &(0x7f0000000e80)=0x3}, {[0x5, 0x8001, 0x3, 0x8]}, 0x827f, 0xc8, &(0x7f0000000ec0)=""/200}) sendmsg$NFNL_MSG_CTHELPER_NEW(r15, &(0x7f0000001100)={&(0x7f0000001040)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f00000010c0)={&(0x7f0000001080)={0x30, 0x0, 0x9, 0x3, 0x0, 0x0, {0x2e69af9acdde82ae, 0x0, 0x9}, [@NFCTH_NAME={0x9, 0x1, 'syz0\x00'}, @NFCTH_STATUS={0x8, 0x6, 0x1, 0x0, 0x1}, @NFCTH_QUEUE_NUM={0x8, 0x3, 0x1, 0x0, 0x4}]}, 0x30}, 0x1, 0x0, 0x0, 0x4004000}, 0x88) 1.765083428s ago: executing program 4 (id=11549): ioctl(0xffffffffffffffff, 0x8b26, &(0x7f0000000040)) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x4, &(0x7f0000000300)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000ae00000095"], &(0x7f00000001c0)='GPL\x00'}, 0x90) bind$packet(0xffffffffffffffff, 0x0, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000003800)=@delchain={0x184, 0x65, 0x400, 0x70bd27, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, {0xe, 0x2}, {0x0, 0x1}, {0xa, 0x3}}, [@filter_kind_options=@f_bpf={{0x8}, {0x4}}, @filter_kind_options=@f_route={{0xa}, {0x24, 0x2, [@TCA_ROUTE4_IIF={0x8}, @TCA_ROUTE4_IIF={0x8}, @TCA_ROUTE4_IIF={0x8}, @TCA_ROUTE4_TO={0x8, 0x2, 0x2e}]}}, @filter_kind_options=@f_bpf={{0x8}, {0x11c, 0x2, [@TCA_BPF_NAME={0xc, 0x7, './file0\x00'}, @TCA_BPF_ACT={0x10c, 0x1, [@m_mpls={0x0, 0x6, 0x0, 0x0, {{}, {0x0, 0x2, 0x0, 0x1, [@TCA_MPLS_TC={0x0, 0x6, 0x5}, @TCA_MPLS_TC={0x0, 0x6, 0x2}]}, {0x0, 0x6, "da242dad998785cf17d3a87bd18a91b6541724d244a93165b94be07866f23d8ad95090daead2384a45d91f46468715f7e8a438b097c13b75c3e767c560082b6b7c3757a634d0df11c6538f26905269f8a4681c6094d36965d9d478404c1ce5b7040413e725ebac"}, {0x0, 0x7, {0x0, 0x1}}, {0x0, 0x8, {0x1, 0x3}}}}, @m_simple={0xd8, 0xb, 0x0, 0x0, {{0xb}, {0xffffffffffffff0f}, {0xffffffffffffff7f, 0x6, "a94602294e188360eb528c2b665cb7f2ccf55594dbfa813879047231e81ee1054afa9d4ab36ed28219a84ebb8a8c23d25d60b0abba2251450fda697af709aaee8c9580073d243a92c000038647258d49dec1515cd64b696b179963aefd422ec50fc84a7641d71d3798b18f89ab923f2de9962e5b1174f1c74857ee14b5ca9a9c77c7eed439d1a10ddd0983583cc272fab1b1577305eeeaf0f6a15a66e0bb2a74b6e766087bc5010941a36523d43fe2cfd09a1e7029fa18917a223f543b42945301fb35bb6e0fd8c4d5380769c638763855ad26ae64f3ac74342379d27c003b1488054886e2244f0064f1ab65aeb42e02d7b0f3a5fa995af59be1f19d9d5ba335e2a1129b946549990fffea737bf5990de3aae61b81f2a5d3dd9692cbf1b8279955ead75400aab5626f0ccab7b5f2424e8db4bc0bde58495a5ffe9a3076f9de68253b77f994031d5125de92b3dcfdb238790b0c60"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x1, 0x2}}}}]}]}}]}, 0x184}, 0x1, 0x0, 0x0, 0x2404c080}, 0x20000080) setsockopt$MRT6_FLUSH(0xffffffffffffffff, 0x29, 0xd4, &(0x7f0000000080)=0x1, 0x4) r1 = accept$nfc_llcp(0xffffffffffffffff, &(0x7f0000002e40), &(0x7f0000002ec0)=0x60) r2 = gettid() r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0}, &(0x7f0000000080)=0xc) sendmsg$netlink(r3, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000280)=[{&(0x7f00000000c0)={0x1c, 0x2c, 0x1, 0x0, 0x0, "", [@typed={0x8, 0x0, 0x0, 0x0, @uid=r5}, @nested={0x4}]}, 0x1c}], 0x1}, 0x84) r6 = getgid() r7 = socket$l2tp(0x2, 0x2, 0x73) r8 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_int(r8, 0x1, 0x3c, &(0x7f0000000040)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR(r8, 0x6, 0x13, &(0x7f00000000c0)=0x1, 0x4) connect$inet(r8, &(0x7f0000000080)={0x2, 0x0, @loopback}, 0x10) setsockopt$inet_tcp_TCP_REPAIR(r8, 0x6, 0x13, &(0x7f00000001c0)=0xffffffffffffffff, 0x4) sendmmsg$inet(r8, &(0x7f0000000fc0)=[{{0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000003640)='ck', 0x2}], 0x1}}], 0x1, 0x400c001) sendmmsg$inet(r8, &(0x7f00000060c0)=[{{0x0, 0x0, &(0x7f0000000a40)=[{&(0x7f0000000140)='@', 0x1}, {&(0x7f00000007c0)='y', 0x1}, {&(0x7f0000000340)="b9", 0x1}, {&(0x7f0000000940)="99", 0xffffffffffffff9f}, {&(0x7f00000008c0)='z', 0x1}, {&(0x7f00000009c0)='~', 0x1}, {&(0x7f0000000a00)='x', 0x1}, {&(0x7f0000000440)="06", 0x1}, {&(0x7f0000000580)='k', 0xffffffc6}, {&(0x7f00000006c0)="1d", 0x1}, {&(0x7f0000000800)='a', 0x1}, {&(0x7f0000000280)='$', 0x1}], 0xc}}, {{0x0, 0x0, &(0x7f00000035c0)=[{&(0x7f0000001040)="fc"}, {&(0x7f0000001080)="c9", 0x1}, {&(0x7f0000002180)='-', 0x1}, {&(0x7f0000002240)='R', 0x1}, {&(0x7f00000033c0)="c4", 0x1}], 0x5}}], 0x2, 0x4000000) r9 = gettid() r10 = socket$netlink(0x10, 0x3, 0x0) r11 = socket$netlink(0x10, 0x3, 0x0) getsockopt$sock_cred(r11, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0}, &(0x7f0000000080)=0xc) sendmsg$netlink(r10, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000280)=[{&(0x7f00000000c0)={0x1c, 0x2c, 0x1, 0x0, 0x0, "", [@typed={0x8, 0x0, 0x0, 0x0, @uid=r12}, @nested={0x4}]}, 0x1c}], 0x1}, 0x84) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000002f00)={0x0, 0x0, 0x0}, &(0x7f0000002f40)=0xc) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000030c0)=[{{&(0x7f0000000000)=@abs={0x0, 0x0, 0x4e22}, 0x6e, &(0x7f0000000340)=[{&(0x7f0000000080)="0434280657b2815e915ba186514d003fd57efecc31847dcc2e0b11b8c6197d6a7f186b2705b0563d4f05ca619756efed000ff999d54bb2267b428fc23a3b44b54aa98f4db5ff", 0x46}, {&(0x7f0000000100)="d560a184b4892b20ae5358f627ef3569d0", 0x11}], 0x2, &(0x7f0000000540)=[@rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, r0]}}], 0x18, 0x15}}, {{&(0x7f0000000580)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000000a00)=[{&(0x7f0000000880)="23420d50e833c6be3a630d71c2b2fe4bbfdb2b15051eee8876c2f1d5b9fd94c718a97d03fdba3ba2f3730876310b90e2f218a4af9ba817e6e577db5dd27d3f453304382ef950fc422b2dcd26828f7940c197351a8d9d9c5501ca30a4935ee26b25d1a9f6faadc2a37bab847ab52bf3202c3c715e02455de9ad0b482f7d6f1a5d362c98140f54c3afc9310c9a3ad6443b70effddd304a36e720357ac6c9f26427ff0fede7ee45f26a4f317cb368e9fa79889d1d433c2bab6a563d384635018c20f3f21b0099e85296ad8d6b9f00d740140170f5e6c0a06830c0da0066", 0xdc}], 0x1, &(0x7f0000001fc0)=[@rights={{0x20, 0x1, 0x1, [r0, r0, r0, r0]}}, @rights={{0x2c, 0x1, 0x1, [0xffffffffffffffff, r0, r0, r0, 0xffffffffffffffff, r0, r0]}}, @rights={{0x2c, 0x1, 0x1, [r0, r0, r0, r0, r0, r0, r0]}}, @cred={{0x1c}}, @rights={{0x28, 0x1, 0x1, [r0, r0, r0, 0xffffffffffffffff, r0, r0]}}, @rights={{0x24, 0x1, 0x1, [r0, r0, r0, 0xffffffffffffffff, r0]}}, @cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x28, 0x1, 0x1, [r0, r0, r0, r0, r0, r0]}}, @cred={{0x1c}}], 0x178, 0x10}}, {{&(0x7f0000002140)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f00000022c0)=[{&(0x7f00000021c0)="51f6d14409e0910c15c578971586f1ec4a747e230689528c5b67869775a2368046d5f8b6e8418e0932fbbbc4197cda578d2b0bc9fafc2ccd63df13eb6f7c13cfe2fceab4836a1c36f0331bc0d7e06d182569196eae62da16ea45b775e61d7de8acb9eadf0ba86f883e80323561dc6f171fbea6f74b21043c6fa07730527f729069531262b93e94061076373db5caf0f2d42d61227a2df0d0f56dbf5a5c8925acf0c768beac1fefc95f0740b2d6d0fdedaaa6154d31afb08a6fa4b67b27f1148e1807ff892c18a357e3cd9ac23e9421694b7a21d2aad53a55255a6e826f5d3f8565b777aee243f4", 0xe7}], 0x1, &(0x7f0000002300)=ANY=[@ANYBLOB="14000000000000000100000001000000", @ANYRES32, @ANYBLOB="0025a4ec"], 0x18, 0x20000000}}, {{&(0x7f0000002340)=@file={0x0, './file0\x00'}, 0x6e, &(0x7f0000002500)=[{&(0x7f00000023c0)="97650b4c15640c55a90081fc564b78bf0648f480a0f437f2b43773c27bb7e6979da3c32543b935df5f6871a5c609ad6bda46879668e17c891dccbd01fa0c959829df321b91a9127c22015c0410a7b731f1eb06af87455882311adfd53641312c895f71e9ece4a1d20fa7829a980a93bbdbea9e0b5b384e772852ab435475c4", 0x7f}, {&(0x7f0000002440)="488411b1b7d27d694c5964491cc21f4e7488a0786abfcba78562d95e57c8993938bc25d336119133cdde08e2e5b7cc4a93990547053f00d6d23b8c182eef8fe6f0456354e24305c3dc0d12ec49a588e64e699804ca5a9a6b5ad30a7a089eb274e662b98f878bed2ea284cf27b43309fa6c7a167696a48de1d6ba09f56c90df67bb408a4ec10b7ed35ae15538097f703e25c64f9211f4b4c48e3f75e5225c782298c4e69c3d9890ecdb68b9a54fcc07f3e3", 0xb1}], 0x2, 0x0, 0x0, 0xc000}}, {{&(0x7f0000002540)=@abs={0x0, 0x0, 0x4e22}, 0x6e, &(0x7f0000002640)=[{&(0x7f00000025c0)="e1ca7aedc7a0d28351493299d70e19c464e2317506e0", 0x16}, {&(0x7f0000002600)="226553226eeb4a50893b9abe9150f0b8181ed1a2d2563b0aeed0920c4da3cdea7d", 0x21}], 0x2, &(0x7f0000002840)=[@cred={{0x1c}}], 0x20, 0x1}}, {{&(0x7f0000000b00)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000002c40)=[{&(0x7f0000002900)="cd7eaf5af38b26cb2a1ebb24a6869272e2fd92c34e18732eaf618c6861ba7f04863451d3dada272821eb3f0d4d52a0a9d49402602f9424141e1e7651d8236c66683dbcb059dff171455546a5aa56c45ef80aa9eb22b2ccec8532d5d7b99f1304cab6898e23ad3d2c577ea7c7e23c1cdc", 0x70}, {&(0x7f0000002980)="70999ecb821081fefe1d6eb665a6e770600864561e3022cdd364ec74147a50597bf57aee2023ed499c29cec90838e2cc8fb9b99cd5e6ad7aa38eb607ba02f6e5932e0386689a032f3617fa6583f9172968be1c", 0x53}, {&(0x7f0000002a00)="5ec94f9ed97f16e0cdcd2e5f63c3b7d0abdf1c571b1056197992cd62454b349a0ef5ca223d3ac38fb34ff1762127c261209876ecda71ca97e4705103c6b44ff748af73ba6ed243947fc7336ba443f949936a1488efa2549131721a63c68232fa57e6ef41c011489ec06d0df8ad1039b954b91d162f3857751f279c66779a6414f5f1b1ddf0515cf64e2d0114aec23576083253b797a069e7df591283277c2786f08da8e133a8b1b73e9ceb47b234c91a86212b970af14fe5fad7ce870f356f10f258b90713da47440ea2b1ea5626629c047dae299df5f484b9761fcb878ce3d5e77c88120ff126805b7a907555", 0xed}, {&(0x7f0000002b00)="d388e25c3305d3c2f6daab967843cf69ea97f0eb4bc1574001bcb25c246064698c7d07f933bc6a6410ade40f2addb17f707d626da14da92e279357324477c03a7b21f5eb45a28de6fe9e9941005cc280f370892f04f9426c6a3aac5cf296465c45ec7d5d3726", 0x66}, {&(0x7f0000002b80)="4d81e4a652ed7b61dbde6dad1631e0af0c720d152f7749ef42e1f7d8c76626a54bab93e8ff894f96a78afb24ec3229bcc7b5013e469068445beabf73601fdba5a9218d3b79ec53312cd9da4a09836779a2a72bf7562c881358ef6361382fe6081177c56eda55b559946e7e37b4c6e4e75a0762ac23538d864331dc737a428401bffc91dcc86bb8e3a92805edfbeeff2ea499d298741115aabf36282613bbdc09ea9d3eb3824fb3", 0xa7}], 0x5, &(0x7f0000002f80)=[@cred={{0x1c}}, @rights={{0x24, 0x1, 0x1, [r0, r0, r0, r0, r0]}}, @cred={{0x1c}}, @rights={{0x14, 0x1, 0x1, [r0]}}, @rights={{0x30, 0x1, 0x1, [r0, r0, r0, r0, r0, r0, 0xffffffffffffffff, r1]}}, @cred={{0x1c, 0x1, 0x2, {r2, r5, r6}}}, @rights={{0x18, 0x1, 0x1, [r7, r0]}}, @rights={{0x30, 0x1, 0x1, [r0, r0, r0, r0, r8, r0, r0, r0]}}, @cred={{0x1c, 0x1, 0x2, {r9, r12, r13}}}], 0x138, 0x4040004}}], 0x6, 0xf0) r14 = socket(0x10, 0x803, 0x0) sendto(r14, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r14, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x365}, {&(0x7f0000000280)=""/85, 0x7c}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000400)=""/106, 0x645}, {&(0x7f0000000980)=""/73, 0x1b}, {&(0x7f0000000200)=""/77, 0x14}, {&(0x7f00000007c0)=""/154, 0x21}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0xffffffffffffff2f}}], 0x4000000000003b4, 0x2040000, &(0x7f0000003700)={0x77359400}) 1.764855586s ago: executing program 2 (id=11550): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=ANY=[@ANYBLOB="3c0000001000010800000100000f000000000000", @ANYRES32=0x0, @ANYBLOB="000000009002010014001a80100002800600018008001b000600000008001b0000"], 0x3c}, 0x1, 0x0, 0x0, 0x1}, 0x0) 1.626533838s ago: executing program 4 (id=11552): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000000)={'batadv0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)=ANY=[@ANYBLOB="200000001100010027bd7000fedbdf250000", @ANYRES32=r1], 0x20}, 0x1, 0x0, 0x0, 0x50}, 0x80) 1.553938798s ago: executing program 2 (id=11553): syz_open_procfs$namespace(0xffffffffffffffff, 0x0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0x1c, 0x0, 0x0) (async) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) bind$netlink(r0, &(0x7f0000000000)={0x10, 0x0, 0x0, 0x80065c9}, 0xc) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000380)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a05000000000000000000010000000900010073797a30000000002c000000030a01020000000000000000010000000900010073797a30000000000900030073797a310000000084000000060a010400000000000000000100000008000b40000000005c0004802c000180090001007866726d000000001c0002800800024000000004050003000000000008000140000000092c00018008000100636d7000200002800c00038005000100ac000000080001400000000c08000240000000000900010073797a300000000014000000110001"], 0xf8}, 0x1, 0x0, 0x0, 0x40010}, 0x0) (async) r2 = socket$rds(0x15, 0x5, 0x0) (async) r3 = socket$can_bcm(0x1d, 0x2, 0x2) (async) r4 = socket(0x2a, 0x2, 0x0) getsockname$packet(r4, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000001480)=0x14) connect$can_bcm(r3, &(0x7f0000000380)={0x1d, r5}, 0x10) bind$rds(r2, &(0x7f0000000040)={0x2, 0x4e21, @local}, 0x10) (async) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) getsockopt$bt_hci(r3, 0x0, 0x0, &(0x7f0000000240)=""/95, &(0x7f00000002c0)=0x5f) (async) sendmsg$NFT_BATCH(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x3, 0x0, 0x0, {0x7}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x68, 0x9, 0xa, 0x401, 0x0, 0x0, {0x7}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz0\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0xd}, @NFTA_SET_EXPRESSIONS={0x24, 0x12, 0x0, 0x1, [{0x14, 0x1, 0x0, 0x1, @counter={{0xc}, @val={0x4}}}, {0x37, 0x1, 0x0, 0x1, @dup_ipv4={{0x8}, @void}}]}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x110}]}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x0, 0x84}}}, 0xb0}}, 0x20050800) (async) sendmsg$rds(r2, &(0x7f0000000140)={&(0x7f00000000c0)={0x2, 0x1, @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x488c4}, 0x0) 1.448430735s ago: executing program 5 (id=11555): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000200), 0xffffffffffffffff) sendmsg$TIPC_NL_MON_SET(r2, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f0000000040)={0x28, r3, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_MON={0x14, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}, @TIPC_NLA_MON_REF={0xfd96}]}]}, 0x28}}, 0x0) sendmsg$TIPC_NL_PEER_REMOVE(r1, &(0x7f0000000280)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000240)={&(0x7f0000000100)={0x128, r3, 0x800, 0x70bd2b, 0x25dfdbfc, {}, [@TIPC_NLA_MEDIA={0x40, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_PROP={0x24, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x9}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1f}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xd9b3}]}, @TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}]}, @TIPC_NLA_LINK={0xd4, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x24, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x5}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x9}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1a}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x6}]}, @TIPC_NLA_LINK_PROP={0x3c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x20}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xe}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xa}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x5}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xb}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x2}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1e}]}, @TIPC_NLA_LINK_PROP={0x2c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8000}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x9}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}]}, @TIPC_NLA_LINK_PROP={0x2c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x4}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x10}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz0\x00'}]}]}, 0x128}, 0x1, 0x0, 0x0, 0x40}, 0x10002) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)={0x30, 0x40, 0x107, 0xfffffefe, 0x0, {0x1, 0x7c}, [@nested={0x4, 0x142}, @nested={0x14, 0x1, 0x0, 0x1, [@typed={0x6, 0x6, 0x0, 0x0, @str='\x80\n'}, @typed={0x8, 0x3, 0x0, 0x0, @uid}]}, @nested={0x4, 0x2}]}, 0x30}, 0x1, 0x0, 0x0, 0x48815}, 0xc000) 1.345718788s ago: executing program 3 (id=11556): r0 = socket$unix(0x1, 0x1, 0x0) r1 = socket$unix(0x1, 0x1, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r3 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r5 = socket(0x400000000010, 0x3, 0x0) r6 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd26, 0x25dfdbfd, {0x0, 0x0, 0x0, r7, {0x0, 0x4}, {0xffff, 0xffff}, {0x0, 0x3}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x11}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000280)=@newtfilter={0x84, 0x2c, 0xd27, 0x30bd29, 0x25dfdc00, {0x0, 0x0, 0x0, r4, {0xe, 0xf}, {}, {0x7, 0x3}}, [@filter_kind_options=@f_matchall={{0xd}, {0x50, 0x2, [@TCA_MATCHALL_ACT={0x4c, 0x2, [@m_ife={0x48, 0x1, 0x0, 0x0, {{0x8}, {0x20, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c, 0x1, {{0x1ff, 0x5, 0x3, 0x3, 0x400}, 0x1}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x3}}}}]}]}}]}, 0x84}}, 0x800) r8 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r8) socket$igmp(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r8, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}) r9 = socket$kcm(0x11, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, 0x0) sendmsg$kcm(r9, &(0x7f00000000c0)={&(0x7f0000000380)=@xdp={0x2c, 0x7, 0x0, 0x3e}, 0x80, &(0x7f0000000080)=[{&(0x7f00000009c0)="f1", 0x1}], 0x1}, 0x24024024) 1.220689292s ago: executing program 2 (id=11557): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x40841, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) ioctl$TUNSETLINK(r0, 0x400454cd, 0x18) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000240)={'syzkaller1\x00', @link_local}) r2 = socket$nl_route(0x10, 0x3, 0x0) shutdown(r2, 0x1) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f00000000c0)={'ip6tnl0\x00', &(0x7f0000000000)={'syztnl0\x00', 0x0, 0x421ebb56194025df, 0x40, 0x7, 0x6, 0x0, @rand_addr=' \x01\x00', @empty, 0x7, 0x7, 0x5, 0x8001}}) sendmsg$nl_route(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=@newlink={0x54, 0x10, 0x1, 0x0, 0x2, {0x0, 0x0, 0x0, 0x0, 0x440}, [@IFLA_LINKINFO={0x34, 0x12, 0x0, 0x1, @bond={{0x9}, {0x24, 0x2, 0x0, 0x1, [@IFLA_BOND_MIIMON={0x8, 0x3, 0x23e3}, @IFLA_BOND_ALL_SLAVES_ACTIVE={0x5, 0x11, 0x2}, @IFLA_BOND_MODE={0x5, 0x1, 0x5}, @IFLA_BOND_AD_LACP_RATE={0x5}]}}}]}, 0x54}, 0x1, 0x0, 0x0, 0x40000000}, 0x24004014) 1.161679442s ago: executing program 1 (id=11558): r0 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x89f0, &(0x7f0000001440)={'bridge0\x00', &(0x7f0000000000)=@ethtool_eeprom={0xb, 0x0, 0xffff0000}}) (async) setsockopt$TIPC_MCAST_REPLICAST(r0, 0x10f, 0x86) 1.136979882s ago: executing program 5 (id=11559): bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0xe, 0x4, &(0x7f0000000700)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x8}, [@generic={0x91, 0x1, 0x1, 0x7e, 0x3010000}]}, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x94) 1.121676394s ago: executing program 4 (id=11560): r0 = socket(0x840000000002, 0x3, 0x9) setsockopt$IPT_SO_SET_REPLACE(r0, 0x4000000000000, 0x40, &(0x7f00000002c0)=@raw={'raw\x00', 0x4001, 0x3, 0x250, 0x0, 0x700001b, 0x148, 0x0, 0x148, 0x1b8, 0x206, 0x260, 0x1b8, 0x240, 0x7fffffe, 0x0, {[{{@ip={@loopback, @empty, 0xffffffff, 0x0, 'tunl0\x00', 'veth0_to_bond\x00', {0xff}, {}, 0x1}, 0x1ea, 0xc0, 0x120, 0x0, {0x390, 0x8f00}, [@common=@inet=@socket3={{0x28}, 0x1}, @common=@icmp={{0x28}, {0x12, "e07c", 0x1}}]}, @common=@SET={0x60, 'SET\x00', 0x0, {{0xffffffffffffffff, [0x2, 0x2, 0x3, 0x1, 0x2, 0x7], 0x2, 0x5}, {0x0, [0x3, 0x6f455bfb4ce26171, 0x6, 0x6, 0x2, 0x21debfafc4f76fce], 0x3}}}}, {{@ip={@remote, @initdev={0xac, 0x1e, 0x0, 0x0}, 0xe2002454fb7b9fcc, 0xff, 'team0\x00', 'gre0\x00', {}, {0xff}, 0x8, 0x2, 0x5}, 0x0, 0x70, 0x98}, @common=@inet=@SYNPROXY={0x28, 'SYNPROXY\x00', 0x0, {0x10, 0x9, 0xf9}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x2b0) 945.233364ms ago: executing program 4 (id=11561): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) getsockname$packet(r1, 0x0, &(0x7f0000000300)) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000005c0)=@newlink={0x98, 0x10, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x2205, 0x10660}, [@IFLA_LINKINFO={0x34, 0x12, 0x0, 0x1, @vlan={{0x9}, {0x24, 0x2, 0x0, 0x1, [@IFLA_VLAN_FLAGS={0xc}, @IFLA_VLAN_EGRESS_QOS={0x10, 0x3, 0x0, 0x1, [@IFLA_VLAN_QOS_MAPPING={0xc, 0x1, {0x3, 0x8}}]}, @IFLA_VLAN_INGRESS_QOS={0x4}]}}}, @IFLA_LINKINFO={0x44, 0x12, 0x0, 0x1, @ip6gre={{0xb}, {0x34, 0x2, 0x0, 0x1, [@IFLA_GRE_IFLAGS={0x6, 0x2, 0x7}, @IFLA_GRE_ERSPAN_HWID={0x6, 0x18, 0x100}, @IFLA_GRE_ENCAP_DPORT={0x6, 0x11, 0x4e20}, @IFLA_GRE_FLAGS={0x8, 0xd, 0x5}, @IFLA_GRE_ENCAP_FLAGS={0x6, 0xf, 0x6}, @IFLA_GRE_FWMARK={0x8, 0x14, 0x7ff}]}}}]}, 0x98}, 0x1, 0xba01}, 0x0) r2 = socket(0x2, 0x2, 0x1) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000040)={'team_slave_0\x00', 0x0}) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="240000001c0035742bbd7000fedbdf2502000000", @ANYRES32=r3, @ANYBLOB="1e002606080001"], 0x24}, 0x1, 0x0, 0x0, 0x20000005}, 0x4000004) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="240000001c0035742bbd7000fedbdf2502000000", @ANYRES32=r3, @ANYBLOB='!'], 0x24}, 0x1, 0x0, 0x0, 0x8803}, 0x0) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000080)={'syztnl0\x00', &(0x7f0000000000)={'gre0\x00', r3, 0x20, 0x1, 0x1, 0xfff, {{0xb, 0x4, 0x0, 0x3d, 0x2c, 0x8067, 0x0, 0x80, 0x4, 0x0, @dev={0xac, 0x14, 0x14, 0x3e}, @broadcast, {[@noop, @ssrr={0x89, 0x17, 0xa6, [@empty, @empty, @empty, @initdev={0xac, 0x1e, 0x1, 0x0}, @local]}]}}}}}) socket$nl_route(0x10, 0x3, 0x0) (async) syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) (async) getsockname$packet(r1, 0x0, &(0x7f0000000300)) (async) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000005c0)=@newlink={0x98, 0x10, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x2205, 0x10660}, [@IFLA_LINKINFO={0x34, 0x12, 0x0, 0x1, @vlan={{0x9}, {0x24, 0x2, 0x0, 0x1, [@IFLA_VLAN_FLAGS={0xc}, @IFLA_VLAN_EGRESS_QOS={0x10, 0x3, 0x0, 0x1, [@IFLA_VLAN_QOS_MAPPING={0xc, 0x1, {0x3, 0x8}}]}, @IFLA_VLAN_INGRESS_QOS={0x4}]}}}, @IFLA_LINKINFO={0x44, 0x12, 0x0, 0x1, @ip6gre={{0xb}, {0x34, 0x2, 0x0, 0x1, [@IFLA_GRE_IFLAGS={0x6, 0x2, 0x7}, @IFLA_GRE_ERSPAN_HWID={0x6, 0x18, 0x100}, @IFLA_GRE_ENCAP_DPORT={0x6, 0x11, 0x4e20}, @IFLA_GRE_FLAGS={0x8, 0xd, 0x5}, @IFLA_GRE_ENCAP_FLAGS={0x6, 0xf, 0x6}, @IFLA_GRE_FWMARK={0x8, 0x14, 0x7ff}]}}}]}, 0x98}, 0x1, 0xba01}, 0x0) (async) socket(0x2, 0x2, 0x1) (async) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000040)={'team_slave_0\x00'}) (async) socket$nl_route(0x10, 0x3, 0x0) (async) sendmsg$nl_route(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="240000001c0035742bbd7000fedbdf2502000000", @ANYRES32=r3, @ANYBLOB="1e002606080001"], 0x24}, 0x1, 0x0, 0x0, 0x20000005}, 0x4000004) (async) socket$nl_route(0x10, 0x3, 0x0) (async) sendmsg$nl_route(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="240000001c0035742bbd7000fedbdf2502000000", @ANYRES32=r3, @ANYBLOB='!'], 0x24}, 0x1, 0x0, 0x0, 0x8803}, 0x0) (async) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000080)={'syztnl0\x00', &(0x7f0000000000)={'gre0\x00', r3, 0x20, 0x1, 0x1, 0xfff, {{0xb, 0x4, 0x0, 0x3d, 0x2c, 0x8067, 0x0, 0x80, 0x4, 0x0, @dev={0xac, 0x14, 0x14, 0x3e}, @broadcast, {[@noop, @ssrr={0x89, 0x17, 0xa6, [@empty, @empty, @empty, @initdev={0xac, 0x1e, 0x1, 0x0}, @local]}]}}}}}) (async) 944.761563ms ago: executing program 1 (id=11562): r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) ioctl$sock_ifreq(r0, 0x8910, &(0x7f0000000000)={'ip6gretap0\x00', @ifru_mtu=0x6}) (async, rerun: 32) ioctl$sock_netdev_private(r0, 0x8914, &(0x7f0000000000)) (async, rerun: 32) socket$inet6_mptcp(0xa, 0x1, 0x106) (async, rerun: 32) r1 = socket$xdp(0x2c, 0x3, 0x0) (async, rerun: 32) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000004c0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_emit_ethernet(0x7e, &(0x7f0000000140)={@local, @broadcast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0xfd, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @dest_unreach={0x3, 0x5, 0x0, 0x0, 0x5, 0x1, {0x15, 0x4, 0x0, 0x9, 0x686, 0x67, 0xfff9, 0x7, 0x89, 0x1000, @multicast1, @rand_addr=0x64010102, {[@timestamp_prespec={0x44, 0x24, 0xc7, 0x3, 0xc, [{@broadcast, 0x4}, {@multicast1, 0x9}, {@private=0xa010100, 0x1000}, {@empty, 0x100}]}, @timestamp_addr={0x44, 0x14, 0xf2, 0x1, 0x2, [{@initdev={0xac, 0x1e, 0x0, 0x0}}, {@broadcast, 0x6}]}, @timestamp={0x44, 0x4, 0xb3, 0x0, 0xd}, @lsrr={0x83, 0x3, 0x71}]}}}}}}}, 0x0) (async) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'sit0\x00', 0x0}) setsockopt$XDP_TX_RING(r1, 0x11b, 0x3, &(0x7f00000001c0)=0x2, 0x4) (async) bind$xdp(r1, &(0x7f0000000100)={0x2c, 0x0, r3}, 0x10) (async) r4 = socket$inet6(0x10, 0x3, 0x0) (async) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="2c000000190001000000000000000000021800000000fd000000ed0008000100ac141400340008"], 0x2c}}, 0x0) r5 = socket$l2tp(0x2, 0x2, 0x73) r6 = accept4(r5, &(0x7f00000002c0)=@caif=@dbg, &(0x7f0000000340)=0x80, 0x800) ioctl$sock_netdev_private(r6, 0x89f0, &(0x7f0000000500)="8efe8d060c70b70c4d3dea2c41666148c938c2fcbd36084fccba6ddc16587af04d5e7c4704f038570ae5ff4efe7638f47868b6e548f0705b2a3816cb1970c308157b12c7f79afe79b13df15ba9c5880ef2e7dc6b31868f26e1adc729947d188e9a4a30fd001c809d3e5543016bee7b900bd92c60fd13aa37d783ba921cea177bb99b2f0e98dff2004fc74f1e0202beda7c2d3415f2db79ab03ae6692ca46cb7151d61a4be98a80a0102829a4d88a3f38c835051588083b1f5d2874dd9f316ce58d6650d7f7b686972a244e857b29eb67128bcad5fd7fa20bf284b4a1b3cb26bf079cbe39ed584f2636f66bc92e7baceb92af1e2615478ac943b8fa7f8e0ad21f489bc5c81385d78f85ead6b8a54ed26a2d04bbfe30b270b8bb476bca87a8957a1529d7f4dc1405d02f19031a04043afebf1e2bcdfa7a15619ec1ea724acb71b7925891abf579e05686f35aa0aa3a2d3154f9ae23a3c574f2a4ca1e9df5edbe5ea5e656837e14aece439e36c95d64387b78189525305831a6298f2e857036bb930529c1a56388acde4cecd208a04a82e1ccb2fb135c98597cdedc8f859544ef71a2ec0ae4f823476810655869243afdd77a80b4242af50e420e9b4aff2a9d5a0a0090247e84705a3c93f4447aa78eae5086f3cbb7e470848f534c8abccada7a34a5ce442973946041b4ee4c2f9890d93d6dbe9793ccd12434e63ea825796bea34cac61444e9a5ba222581da9e2127e53a46c17e6306376009d3717ff370844e969b0cafcd34142afef222f23fa331028e64500a95fdad882b45ed9768d32042d3d88daf881bf6b596a09b8f25ceb2e5e3a36bbac3ea1e081541fcecd8318591bc2fe2ffba935bd1c2308ff660035736879668e314ba86647b89b17b4d22d75486daf5609a1668af3c8c29de2dfba92b33fbbb0f0a95d3e3d61762b8ec796353975cde7af3ae5a120ab9d038384a1e53e2597f573c6a87492816d78fece63dc99822aa7db440aa924c97519db5eda62e66e32df122922ea832c04e866164be0968ebb5026397d770d457a36b8cbf88b5f761dae43605ec3f64ef1b80177563022b14880a801d4c72355c0fe280b0b8a4b36ad0db9c4d24c5174b995f79cf8e0d72a19699751a8dce8a2e22f6fa1d5ceb612165e1ac4dd71f1c82a7c3a60bc9f1092b228af7ed4cd4be21b1b6c5e47f0cd583f7b4c5d0a5c0f94e9b1b1d30a1d12d7e6933ce49c1ad8dff17b4922704f0bfc1eae0306d04138d0a9b597e0898d24cb06e5cbf28bf5793948dcb7f515dd514a505c25b142cc94efd769b28f86d60be8c8c670484762969ca72036327a695a8910b011db8234db7d5d86d2e26087df8c8b003d55019568dc74da1ec511fb942b0b8d0ad0d7151bcdcc6d60deca939338fa5d254aa3e0df51f935626ace79fd51ae7c85efcf0534eb0e72801d1affa58e36cbedc5a4c554fca4884a551733b7cabc8ac34752b8f80d0a60e0c1e0ac2a4448e4f5f0da761590c901406077ede93656c4d7de59e1d22d7b8dfc1d59791912f658e5440ad18d40acfd65c36e5075ec8c2b557c91180bafcc9d72f31cfb4d69c973c9e6a8ac8e57b28393c4515db18effdcc3a05a9cb81ff7f0b2516759a8bcc70b81544970306affcdbfdaf0a27369dba03596db0eb9d802cf69fa09430aea2558ede51cac26aea8d9c6adadd510429475051228c8b6b65b74a34e8b862c48a91c595788ae57e46cc3870855d8f1360acc4be5cb494df3e439ac3c3a6a694381152e615bdaddde5baf3d2b717dd35ee9faf67288e152457d87fcf8a007ffcb494da76b90ffb0d1fe91f721f259153d73aa82864a3756b2759356be31b0b5d27297deddf087827d26e5cfcb24c71a6d135b0e18db5da21a792f279c511e6c94968d0e554567274c542459e498a8ef36b139c93417f1208ef8be64cbf39101be7d242d2a43c47ddcade4a87e7d6821ea7783489c230a2137fdaa209ca52877dae8872e6c7d433f9a3f67a288202d6bbf0ad1c05ed64b385ad73a2e6c6a114535828b2f0a6416f0c4e37f2da1fad6ab3a5571a5e8312c3110505aacc0bac0bd06d5d159913d01a8b831a497139d87823af6bc2329a8c17ef19a04a410957a94082bd6bec7eb348296c09c2eb2199ba4c99fa6c6613df0bab5481e2ec4018d66ac156a333dd52f7e0965b3ba6761fa81007b6b2929907c7d1e58c17467a9c1d5a04da10f942bb313cb8c845868b9d5dbc16f7d78a5f30c555eda97c48a6ec7f014ba38a5b209aaaf9b4feb89e6065e701b112c6ccd6a8a5225bed43174e44e2725f29f0f6e096cedc50743138bffab5bbe49407b8fe33bd1784d9eb6891aa7bc7adf6d74131248aaea493e1aa87a9e6ede9fc065884e4f60bb282b74fc0139305217e025cb30639be5484cfd9cbcdffdc150e7f7c0227fc6cd6256723a9d383064be2f585e84cf73e3a3f41f0e1e7c4facd39971b43df51190a8e3f60e6d3644494678106ca9e92c6ebf59dfa4b308d47fb8617d89d6951c95562a9637f51485da128d9be30d54af538f0ebbdca921cffb112a7c6c069be5d97e190245fd9e332a2cd4c2b1d7f850d9d1efc9ca40ab07e06c8996caed69a6f7f538c092c323195cd69deed470d0eab0fe17c336083216ea0fb0bb3e935bf02d134ce429edf629b968b897fdcd1b5c40c7b60633de098baac0852549a5502f63585e01453cb58dce56181e6c1775a8f86e0d69eb503514cfd5dd765f70b453240960ca6bc6e732f55b9e15baff659bb4df82101da4f06fe19bd1244dbc50e294a3ad08f12dce9e7af58e023b94904c74b20ac4ffa2cf22a7e7f6bb8b68b5f7619dd480c426964728340205fef76d9f41084b7c162bc8f54f2b06d6e6b7e23403a8edc649b6083e66fae77bd1a0c769f01483dc810ea05eeb4bb865cd0f4e650fae3bcf669d5628a5cc7acbb96daf44177e152c9fdd7fd929e64ffe7b7346e9faee85f06f44e4a333b72b41720f7000779423eada3e77eca9039d0f1cc53b8622cf2cdbd4c36eee3c4442fe905e116555e0dda456246f06a52491e2386a3a29b5024c2da005a3a9c95bd02940fcb92bbbf7b0b6bb1b1876fd4bcece11686cc483902297c8a35049df087b8f700a205fa30f9346c0ca37024421c86b7035519b5a991106f45bdc1662809b3f3dbaaa15e9d7b73908ac898cd7bb611df56766188a136893efa75f39f2056c19ddc4039040afa87cfb528574e6f8998a444e5828c77c7d478d4f6c2b0d3f50d2074a43c78c50a68a8329b3d99f4ee2b79e417784cc5696ce79b94f050d0a9406fa8c733218f3cd39edd2ed02fc4f3e2ef9ae8f4fed0b741399c611b91fa1f6ac9854afb5a944ce3ab37819545b9524b518171c0566a22a6beffeb441ff369f801c71748f15217b0984f68369ff66c0aef52c43ead37ee323a1e467992379e743ba20bb140ba4dc166e5b1d941642e29b06baa3b110e4c84389de24754d8b3a934ee2432dc29b5368a00aca3a598fc3ba12dbfa5d72eff3cd34c6e3f06b0cb9b6289b919253109f44d4fdd776e6f7a5d4d48dda1d7e47d8fc65be2a57d2efc9dd256b106e86977d53e424bc2f0fcf8bbb9a922727a9a16a1433e2958ad0750e4489b9ea1cf8498c8aec7dbf4db6de639e8e682cd86b395997b841c82ecf2d511e4c3e9dec36c72b866138ebf6fd03c62f6fa083e4cfed848160842a0536fe453d16673dd04838878a4f62bb50e41678dd648a88a35e971b17f0bbb6704f43010655df711c29ea8ebb7a805d9f9db79c6c8f5ae6743d50f0e1a6db2f39266a227a1c94605b68e8ab72f111bd817f637862b6f11aa5f291a54b5b42fe415b318464aa86bb2b4544cfa271f1cadd88ea8a47687a7875ecff77382c1ee9068e9c7e64182441504e509449e193cd89150ceee21062c556a4af3e4f5a88a790c2b710f6d19da986052f0e94078e2527a391addb35923f940ea92f45f7346e9b278b5f0bc5cae1ca373ce83ade7ae4d9ac98e08e89db4534b6195080d6b89411ce521d9149387e16a01262624431de9fda303b4685b25717ffaf6b1b3db072de0c591d93e37340c494686a8fe3f5f900fdc088997b7e8ff54cb57004d9ab9dc89034e88017a84214f405119e31a48545bf21faaf57dd643d72b0a8f874b9955a9a31ce96f9028cff77fa9aeec483de1b8864891c28abd45d66dd0c353912dadd33661010b766b6b3fac0cc58b364a759d67fe6ac7bb69c11dd7fa0bf913643ba04286a96c8dd099da767f8fc2ebf78e86d5f4b73805c1f14df2174363e492ce1030c409902db76c0fb80b5acaa681cbdd3b55227a1754eca6add7288623bf372a2de34fccd88bff23f6211df40c17eb82afb3571e7c02864ba3b0a1d01b26b5fd6565f091a2b7da855555e257ebe3f8b097436f21f1355fc5e891ec8207e99a18fa40d60a19620ddaf7cf34f3fe9df82ad8814b8261aaaea75fe7cae627980d9760c151243558b884ed9405c8288f95496f3c376e84470bd4e5dacc9eff9d35473004036ede5b9ab049e470a3150a0825e50513e378cf74cdd0c7bfb62ee891519dd91af73667c2c85fe674ba7f473bef3ac33749b400a155b05d8bd1469e4e69ce7764c8becd2b60c5c3b1b4ffec5d171a084f9e1af5136eea8499fd74de89f528fd95807f0b7780d7a947547fbdaac547b6f079a2d81696290cc00ffa8a967ff6829fcae6c90941f3a7ff48a2d097c6d2d259d67360eacf1a69a3dee39c7fd44a95f4da6292066b54e84ebb0cf4b705cc5486f6bdf82124793a4b8be264f02422a6b088fc8a95b2b6d1d264645963d433d8f42f2e13a2f86deb2fa839e85071e0c93ea7317d4e2275e394b1947432d72568aaeed889a41919f5a271526aab7a6b4851cbf665b20dfa0cfe10bbe99bd84ae56c5f944fdb94a6fa974cab43ebcdb7bf434a188518bb5378c5ff16bef86e5a2670d1df36bb8e1f5f330f735bd03f3ec3c5b1ced650e1a6c941a61a9bfa4089796de19f02a5576a544afd4d549600340378dfc7e9ed92189870e23b56970f3eb9bf1f3ec4e1e5509bfdd8822c91e02749c266e50d17c2a2ef97f7596f28fe7e61495b34a8e6e13bffa112acde71d94d7b3ee7a60c3a614eaa2c8ed6722255c901cef99b54dff882974b334edb04e8c9d6e5b4ad2a07da2fd304f10cae422b7a4521c7dde9314389de57f5249c8391b782a4cdbb2d3698198ae03bbf256aff2537e8baa9b7c9f1d217b3b0d74972983c16f94da5b30ef96ffc4d8d554b1b43bddb6a4300552b9a9ee78e05fa5501961920f086c1a12ad364daed96eaa36dc44f0241a4f5c72c78a21d5eed972456592fab4ba62a98baa92225285c9e08a53f7b76314af9d9aa36bb7367414350e22b458ce74b3d39b2ee3bdbf85f08567a7c0547e7f1ae3cb7bd5ad74f9fcbcca834e958b0f587008d40cbc5557d1fbe1ccca45e9277678663c7202ec1de95a8d9f776e22908295f08aca4edb3a0ff0af68be29c1a59dcba7b24e5e8a7a06d60684a525e814d0513d4b7a2c9eccaf1f8a04b9fba4f878cc4c031e6efe3fe7ca32d38ae19100891e62a24ea8826fac6bb6355631158182da5fc5102bc69c4d73ffab49519114a4daf221dd921d3c0a48f4e3eedc20db745c7d78734ba872ff1456f3dea6e6367cd9607e16b714bf35e5d2a356e0d501e99649a98bf9383277e3a154d8d8daa732243e9a25c37cff361cafb7cc1da992330ceb1d49ec4977bc74a821188cc4127afabe7a442b984222adf282d10b1ec7b9b19ce58e9d228a3a2f32432") (async) setsockopt$inet_buf(r5, 0x0, 0x4, &(0x7f0000000180)="6e54922475cc82ac929c77e2efee814133c8cef498f82ac131d79c4a43707d0ada99235f87de5e0c77", 0x29) (async) r7 = socket$inet6_sctp(0xa, 0x801, 0x84) sendto$inet6(r7, &(0x7f0000000140)="96", 0x1, 0x0, &(0x7f0000000280)={0xa, 0x0, 0x0, @private2}, 0x1c) (async, rerun: 64) r8 = bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000040), 0x4) (rerun: 64) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0200000004000000080000000100000080000000", @ANYRES32=r5, @ANYBLOB="030000eafbffff004b8d77860000000000000000", @ANYRES32=r3, @ANYRES32=r8, @ANYBLOB="02000000020000000500"/28], 0x50) (async, rerun: 64) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000001500)=ANY=[@ANYBLOB="b80000001300020000000000fbdbdf25fc000000000000000000000000000000fc02000000000000000000000000000000000007000100000a0060003b000000", @ANYRES32=0x0, @ANYRES32=0xee01, @ANYBLOB="800000000000000004000000000000000000000000000000fdffffffffffffff0000000000000000fdffffffffffffff09000000000000000000000000000000feffffffffffffff040000000000000000000000000000000000000000000000090010000000000000010200000000003a025b5a2a902c438eada0ffd4c9d9effd5a8f6a10604db867099161d5db7990e96270f82452e3c4c80ace43c94d93bd56cae2f70470a603b67201eeea01f5"], 0xb8}}, 0x50) (async, rerun: 64) r9 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r9, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000040)=ANY=[@ANYBLOB="7c0000002000010000000000000000000a00100000000001000000001400110076657446305f746f5f6873720000000014000100fc01000000000007000000000000000008000a000700000008000f00ffffffff140002"], 0x7c}}, 0x0) (async) setsockopt$inet_mreqn(r5, 0x0, 0x20, &(0x7f0000000200)={@loopback, @remote, r3}, 0xc) (async, rerun: 64) setsockopt$inet_sctp6_SCTP_AUTO_ASCONF(r7, 0x84, 0x1e, &(0x7f0000000180)=0x2, 0x4) (async, rerun: 64) setsockopt$inet_sctp6_SCTP_AUTO_ASCONF(r7, 0x84, 0x1e, &(0x7f0000000000)=0x6, 0x4) (async, rerun: 64) setsockopt$inet_sctp6_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, 0x0, 0x0) (rerun: 64) sendto$inet6(r4, &(0x7f0000000000)='s', 0x10a73, 0x800, 0x0, 0x4b6ae4f95a5de35b) 876.993979ms ago: executing program 5 (id=11563): r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_RES_PD_GET(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000340)=ANY=[@ANYBLOB="200000001e1401"], 0x20}, 0x1, 0xffffffffffffffef, 0x0, 0x40080c0}, 0x0) 866.519602ms ago: executing program 3 (id=11564): r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r0, &(0x7f0000000080)={0x0, 0x74, &(0x7f0000000100)=[{&(0x7f00000001c0)="5c00000012006bab9a3fe3d86e17aa0a046b876c1d0048007ea60864160af36504001a0038001d001931a0e69ee517d34460bc06000000a705251e6182949a3651f60a84c9f4d4938037e70e4509c5bb", 0x33fe0}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) recvmsg$kcm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000440)=[{&(0x7f0000000ac0)=""/97, 0x61}, {&(0x7f0000000580)=""/232, 0xe8}, {&(0x7f0000000000)=""/57, 0x39}, {&(0x7f0000002c40)=""/4106, 0x100a}, {&(0x7f0000000300)=""/176, 0xb0}, {&(0x7f0000000740)=""/118, 0x76}, {&(0x7f0000000140)=""/95, 0x5f}, {&(0x7f00000000c0)=""/59, 0x3b}, {&(0x7f0000000240)=""/161, 0xa1}], 0x9, 0x0, 0x0, 0x3580}, 0x0) 686.071163ms ago: executing program 1 (id=11565): socket$nl_route(0x10, 0x3, 0x0) r0 = socket$can_j1939(0x1d, 0x2, 0x7) r1 = socket$inet6_icmp(0xa, 0x2, 0x3a) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f00000000c0)={'vxcan0\x00', 0x0}) bind$can_j1939(r0, &(0x7f0000000340)={0x1d, r2, 0x0, {0x2, 0x0, 0x6}, 0xfe}, 0x18) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000040)=0x1, 0x4) sendmsg$inet(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000003c0)=[{&(0x7f0000000540)="81b641f1f3843704b6", 0x9}], 0x1}, 0x4048081) close(0x4) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b70800000d0000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="0b00000005000000000400000900000001"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xa, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="1800"/11], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000d80)={0x18, 0x5, &(0x7f0000000480)=ANY=[@ANYBLOB="1801000021"], 0x0, 0x40, 0x0, 0x0, 0x0, 0xb4a02fe0ce239f93, '\x00', 0x0, 0x2}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xe, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000800000000000000000000018110000", @ANYRES32=r3], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x59, '\x00', 0x0, @fallback=0x2a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, r4, 0x0, 0x0, 0x0, 0x0}, 0x94) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={r5, 0x2000000, 0xe, 0x0, &(0x7f0000000040)="630b008646dc3f0adf33c9f7b986", 0x0, 0xcf25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x80}, 0x50) 685.825012ms ago: executing program 2 (id=11566): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socket(0x1d, 0x2, 0x6) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000100)={0x60, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IE={0xe, 0x2a, [@random={0xdd, 0x8, 'Abcdefgh'}]}, @NL80211_ATTR_SCAN_SSIDS={0x10, 0x2d, 0x0, 0x1, [{0xa, 0x0, @default_ap_ssid}]}, @NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST={0x6, 0xf7, {0x2, 0xff}}, @NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI={0x5, 0xf6, 0x5}, @NL80211_ATTR_SCHED_SCAN_DELAY={0x8, 0xdc, 0x7}, @NL80211_ATTR_MAC={0xa}]}, 0x60}}, 0x0) syz_80211_inject_frame(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="5000000008021100000108021100000008025400000000000000000000000000640001000006020202020202010882848b960c121824"], 0x36) 685.047359ms ago: executing program 4 (id=11567): socket$nl_generic(0x10, 0x3, 0x10) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000780)=ANY=[@ANYBLOB="580000000206030000000000000002000300000705000100070000000900020073797a31000000000c00078008001240000000050500050002000000050004000100000011000300686173683a69702c706f7274"], 0x58}, 0x1, 0x0, 0x0, 0x4000}, 0x20004000) 631.208855ms ago: executing program 5 (id=11568): ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba9432}) r0 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000380)={'lo\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x5d, &(0x7f0000000580)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001400b59500000000000000000a000000", @ANYRES32=r1, @ANYBLOB="14000200fe8000000000000000000000000000aa080009003f0c0000140001"], 0x48}}, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r2, &(0x7f0000000080)=ANY=[], 0x10448) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r2, 0x0) r3 = bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f00000001c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xdc, 0xdc, 0x9, [@array={0x0, 0x0, 0x0, 0x3, 0x0, {0x4, 0x3, 0x6}}, @struct={0x10, 0x7, 0x0, 0x4, 0x1, 0x4, [{0x8, 0x1, 0x5}, {0xe, 0x5, 0x80}, {0x1, 0x4, 0x93f}, {0x3, 0x1, 0x6}, {0x6, 0x2, 0x74c00000}, {0xd, 0x1, 0x3}, {0xc, 0x2, 0x3}]}, @type_tag={0x9, 0x0, 0x0, 0x12, 0x2}, @enum={0xd, 0x2, 0x0, 0x6, 0x4, [{0xc, 0xfffffffd}, {0x3, 0x7}]}, @enum={0x10, 0x6, 0x0, 0x6, 0x4, [{0xa, 0xa541}, {0x7, 0x2}, {0xd, 0x3}, {0x0, 0xc}, {0x9, 0x3ff}, {0x10}]}]}, {0x0, [0x0, 0x2e, 0x5f, 0x61, 0x61, 0x5f, 0x30]}}, &(0x7f00000002c0)=""/171, 0xfd, 0xab, 0x1, 0x1b200, 0x10000}, 0x28) bpf$MAP_CREATE(0x0, &(0x7f0000000400)=@base={0x2, 0x9, 0x822, 0x2, 0x808, r2, 0x2, '\x00', 0x0, r3, 0x1, 0x4, 0x1}, 0x50) r4 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB='h'], 0x68}, 0x1, 0x0, 0x0, 0x1}, 0x8000002) sendmmsg(r4, &(0x7f0000000000), 0x4000000000001f2, 0xfc) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba9432}) (async) socket(0x10, 0x803, 0x0) (async) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000380)={'lo\x00'}) (async) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x5d, &(0x7f0000000580)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001400b59500000000000000000a000000", @ANYRES32=r1, @ANYBLOB="14000200fe8000000000000000000000000000aa080009003f0c0000140001"], 0x48}}, 0x0) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) (async) write$cgroup_subtree(r2, &(0x7f0000000080)=ANY=[], 0x10448) (async) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r2, 0x0) (async) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f00000001c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xdc, 0xdc, 0x9, [@array={0x0, 0x0, 0x0, 0x3, 0x0, {0x4, 0x3, 0x6}}, @struct={0x10, 0x7, 0x0, 0x4, 0x1, 0x4, [{0x8, 0x1, 0x5}, {0xe, 0x5, 0x80}, {0x1, 0x4, 0x93f}, {0x3, 0x1, 0x6}, {0x6, 0x2, 0x74c00000}, {0xd, 0x1, 0x3}, {0xc, 0x2, 0x3}]}, @type_tag={0x9, 0x0, 0x0, 0x12, 0x2}, @enum={0xd, 0x2, 0x0, 0x6, 0x4, [{0xc, 0xfffffffd}, {0x3, 0x7}]}, @enum={0x10, 0x6, 0x0, 0x6, 0x4, [{0xa, 0xa541}, {0x7, 0x2}, {0xd, 0x3}, {0x0, 0xc}, {0x9, 0x3ff}, {0x10}]}]}, {0x0, [0x0, 0x2e, 0x5f, 0x61, 0x61, 0x5f, 0x30]}}, &(0x7f00000002c0)=""/171, 0xfd, 0xab, 0x1, 0x1b200, 0x10000}, 0x28) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000400)=@base={0x2, 0x9, 0x822, 0x2, 0x808, r2, 0x2, '\x00', 0x0, r3, 0x1, 0x4, 0x1}, 0x50) (async) socket(0x10, 0x3, 0x0) (async) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB='h'], 0x68}, 0x1, 0x0, 0x0, 0x1}, 0x8000002) (async) sendmmsg(r4, &(0x7f0000000000), 0x4000000000001f2, 0xfc) (async) 454.563199ms ago: executing program 3 (id=11569): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000540)=@newlink={0x48, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @gretap={{0xb}, {0x32, 0x2, 0x0, 0x1, [@IFLA_GRE_IGNORE_DF={0x5, 0x13, 0x1}, @IFLA_GRE_PMTUDISC={0x5}, @IFLA_GRE_COLLECT_METADATA={0x4}]}}}]}, 0x48}}, 0x0) 417.617378ms ago: executing program 4 (id=11570): sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f00000000c0)="d800000019000100000212ba0d8105040a600000ff0f040b067c55a1bc0009007d0006000000000015001500fe808178a80035fd00e4ff3f0200000901ac040000d67f6f94007100a007a290457f0189b316277ce06b9e9dfc487d5d32bace8017cbec4c2ee5a71602b2a10c11ce1b14d600741f795025ccca262f3d40fad95667e04adcdf634c1f215ce3bb9ad809d5e1cace81ed0b7fec114c5d46a73290f9eaef6288", 0xa4}], 0x1}, 0x0) sendmsg$IPCTNL_MSG_EXP_GET_STATS_CPU(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000140)={0x14, 0x3, 0x2, 0x201, 0x0, 0x0, {0x5}}, 0x14}, 0x1, 0x0, 0x0, 0x4000000}, 0x8040) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000080)={0x26, 'skcipher\x00', 0x0, 0x0, 'cts(cbc(aes))\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5910fae9d6dcd3292ea54c7b6ef915d564c90c200", 0x18) r1 = accept4(r0, 0x0, 0x0, 0x0) sendmsg$TIPC_NL_MEDIA_SET(r1, &(0x7f0000001800)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[], 0x12f4}, 0x1, 0x0, 0x0, 0x4044010}, 0x0) recvmsg$unix(r1, &(0x7f0000000840)={0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000240)=""/54, 0x36}], 0x1}, 0x0) syz_emit_ethernet(0x36, &(0x7f0000000240)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaaaa080045000028006700000a06"], 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, 0x0) r3 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) close(r3) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000340)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x70bd25, 0x25dfdbfd, {0x0, 0x0, 0x0, r5, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x4361, 0x7, 0xffffffff, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x8000}, 0x0) sendmsg$nl_route_sched(r4, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000005c0)=@newqdisc={0x3c, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdbfc, {0x0, 0x0, 0x0, r5, {0x0, 0xd}, {0x6, 0xb}, {0xffff, 0x2}}, [@qdisc_kind_options=@q_cake={{0x9}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8, 0x10, 0x2}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x240040e0}, 0x4890) r6 = socket$packet(0x11, 0x3, 0x300) sendto$packet(r6, &(0x7f0000000240)="800000800000210ee7", 0x9, 0x40, &(0x7f00000001c0)={0x11, 0x8100, r5, 0x1, 0xd8, 0x6, @broadcast}, 0x14) 417.01044ms ago: executing program 1 (id=11571): r0 = socket$inet6(0xa, 0x2, 0x3a) r1 = epoll_create(0x38e) r2 = bpf$ITER_CREATE(0x21, &(0x7f0000000040), 0x8) epoll_ctl$EPOLL_CTL_DEL(r1, 0x2, r2) r3 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$inet_sctp_SCTP_AUTH_DEACTIVATE_KEY(r3, 0x84, 0x1d, &(0x7f0000000380), 0x8) socket$inet6_mptcp(0xa, 0x1, 0x106) sendmmsg$inet6(r0, &(0x7f00000003c0)=[{{&(0x7f0000000380)={0xa, 0x0, 0x0, @mcast2={0xff, 0x5, '\x00', 0x0}, 0x20000}, 0x1c, &(0x7f0000000000)=[{&(0x7f0000000480)="a0002883781ecc0edc2808", 0xb}], 0x1}}, {{0x0, 0x0, 0x0}}], 0x2, 0x40) 253.493958ms ago: executing program 5 (id=11572): r0 = socket$l2tp(0x2, 0x2, 0x73) ioctl$SIOCGSTAMPNS(r0, 0x8907, &(0x7f0000000000)) r1 = socket$inet(0x2, 0x6, 0xf29a) setsockopt$inet_int(r1, 0x0, 0x6, &(0x7f0000000040)=0x575, 0x4) sendto$l2tp(r0, &(0x7f0000000080)="d0b47a6a3a6cbbc9ba8379b3907d36977c04093778253aa38228e767a249f9f3453f303153335e2702366010fec8248611a88511032ebad8a36b86a8f2e68f9d31796f95122b0866f2c9c14c1efd12982e02d5892af1b150c30fab272f4ffc7d90d7eba9aaddc515ed8e751eccf6cbf20b1e3226df91197e83ce012e0d48055aef69ed999faf8709dc404a7269cf1b365c5421c1ab7623ba511c48d8f9c1b3342deb7dea13a15d2e4ea90817aa43ec413cbf15fa9f70ac0201f713c98b2bb6e9ff5dbf833060eb6be90a159a37417e19422d4d8beb7aaf3ec11f7ef96bed130d345b5b9f446056b02f2671a75bbee55d1bc47bc5dea4f90c3c", 0xf9, 0x20004011, &(0x7f0000000180)={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, 0x1}, 0x10) getsockopt$PNPIPE_IFINDEX(0xffffffffffffffff, 0x113, 0x2, &(0x7f00000001c0)=0x0, &(0x7f0000000200)=0x4) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000240)={r2, @private=0xa010102, @local}, 0xc) r3 = accept4(r0, 0x0, &(0x7f0000000280), 0x80000) getsockopt$inet_sctp_SCTP_AUTOCLOSE(r3, 0x84, 0x4, &(0x7f00000002c0), &(0x7f0000000300)=0x4) r4 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000340)={0x0, 0x5, 0x28}, 0xc) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4) r7 = bpf$MAP_CREATE(0x0, &(0x7f0000000400)=@bloom_filter={0x1e, 0xa, 0x3, 0x3ff, 0x40, 0x1, 0x5, '\x00', r2, 0xffffffffffffffff, 0x0, 0x0, 0x4, 0xf}, 0x50) r8 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000a80)=@bpf_lsm={0x1d, 0x20, &(0x7f00000007c0)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x7115, 0x0, 0x0, 0x0, 0x5}, {}, {}, [@func={0x85, 0x0, 0x1, 0x0, 0x4}, @exit, @btf_id={0x18, 0x5, 0x3, 0x0, 0x3}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, 0x1}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x5}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @initr0={0x18, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x6}, @map_val={0x18, 0x6, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0xcfa}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f00000008c0)='syzkaller\x00', 0x637d41e5, 0x44, &(0x7f0000000900)=""/68, 0x41100, 0x58, '\x00', r2, 0x1b, 0xffffffffffffffff, 0x8, &(0x7f0000000980)={0x3, 0x5}, 0x8, 0x10, &(0x7f00000009c0)={0x4, 0x1, 0x8, 0xfffffff0}, 0x10, 0x0, 0x0, 0x4, &(0x7f0000000a00)=[0x1, 0xffffffffffffffff], &(0x7f0000000a40)=[{0x1, 0x3, 0xb, 0x7}, {0x5, 0x2, 0xc, 0x9}, {0x4, 0x5, 0x9, 0x3}, {0x2, 0x2, 0x0, 0x6}], 0x10, 0x401}, 0x94) r9 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000b40)={0x1b, 0x0, 0x0, 0x4, 0x0, 0x1, 0x9, '\x00', r2, 0xffffffffffffffff, 0x1, 0x5}, 0x50) r10 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000bc0)={0x1b, 0x0, 0x0, 0x3, 0x0, 0xffffffffffffffff, 0x9, '\x00', r2, 0xffffffffffffffff, 0x1, 0x3, 0x3}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000cc0)={0x1b, 0x31, &(0x7f0000000480)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0xb584}, {{0x18, 0x1, 0x1, 0x0, r4}}, {}, [@kfunc={0x85, 0x0, 0x2, 0x0, 0x1}, @snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x10001}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r5}}, @snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x7f}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r6}}, @initr0={0x18, 0x0, 0x0, 0x0, 0x3ff, 0x0, 0x0, 0x0, 0x6a5}, @ringbuf_query={{0x18, 0x1, 0x1, 0x0, r7}}, @generic={0x9, 0x5, 0x2, 0x8, 0xace3}], {{}, {}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000640)='syzkaller\x00', 0x7f, 0xcc, &(0x7f0000000680)=""/204, 0x21680, 0x20, '\x00', r2, @fallback=0xc, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000780)={0x5, 0xc, 0x3, 0x10000}, 0x10, 0x0, r8, 0x3, &(0x7f0000000c40)=[r9, r10, 0x1], &(0x7f0000000c80)=[{0x1, 0x5, 0x5, 0x9}, {0x0, 0x1, 0xf}, {0x1, 0x5, 0xc, 0xb}], 0x10, 0xe}, 0x94) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r3, 0x84, 0x64, &(0x7f0000000d80)=[@in={0x2, 0x4e20, @loopback}, @in={0x2, 0x4e20, @loopback}, @in6={0xa, 0x4e24, 0x800, @mcast2, 0xe204}], 0x3c) r11 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$BTRFS_IOC_QGROUP_CREATE(r11, 0x4010942a, &(0x7f0000000dc0)={0x1}) getsockopt$sock_timeval(r1, 0x1, 0x15, &(0x7f0000000e00), &(0x7f0000000e40)=0x10) recvmmsg(r1, &(0x7f0000001040)=[{{&(0x7f0000000e80)=@ethernet={0x0, @random}, 0x80, &(0x7f0000000f40)=[{&(0x7f0000000f00)=""/1, 0x1}], 0x1, &(0x7f0000000f80)=""/172, 0xac}, 0x7}], 0x1, 0x62, &(0x7f0000001080)={0x77359400}) ioctl$XFS_IOC_FD_TO_HANDLE(r4, 0xc038586a, &(0x7f00000011c0)={r5, &(0x7f00000010c0)='k$-$-@:\x00', 0x440080, &(0x7f0000001100)={@_ha_fsid={[0x8001, 0x8001]}, {0x8, 0x3, 0x3ff, 0x3}}, 0x3, &(0x7f0000001140), &(0x7f0000001180)=0x30}) r13 = openat$cgroup_ro(r12, &(0x7f0000001200)='freezer.self_freezing\x00', 0x0, 0x0) socketpair(0xf, 0x4, 0x8000, &(0x7f0000001240)={0xffffffffffffffff}) getsockopt$inet_sctp6_SCTP_CONTEXT(r12, 0x84, 0x11, &(0x7f0000001280)={0x0, 0x3}, &(0x7f00000012c0)=0x8) setsockopt$inet_sctp6_SCTP_PR_SUPPORTED(r3, 0x84, 0x71, &(0x7f0000001300)={r15, 0xfffffff7}, 0x8) ioctl$sock_SIOCGPGRP(r1, 0x8904, &(0x7f0000002580)=0x0) getsockopt$inet_IP_XFRM_POLICY(r13, 0x0, 0x11, &(0x7f00000025c0)={{{@in=@broadcast, @in=@initdev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@dev}, 0x0, @in6=@empty}}, &(0x7f00000026c0)=0xe8) sendmsg$unix(r14, &(0x7f0000002c80)={&(0x7f0000001340)=@abs={0x1, 0x0, 0x4e20}, 0x6e, &(0x7f0000002540)=[{&(0x7f00000013c0)="97dceabbac9ea23e34aefc8cf1ea9a5c2af9addcb6e0e4ef5bdb6c765c2304fbec95e4470b01ca4c0a2d5ea3f46aba709a35ed5bbb3b98e0bf95f053d2c3e768ac0b4875204a6d0fb3d241136eb1715bf8e783220c0aed728f357f3e44234fe358ca3a1459d04daf4a17ed37696e0ddb40ffd4bef2189a2ec3cabce344b17dc65ce7764b1cdbfa6a85656806b4f0a206a79df86bb8993f18254a539b5d5acb4a6160a9c7e16caa80a6c24cef99d4d03fc474f54c0a9a47a23598c367a7222b145980bf66bddc67e7bdbe", 0xca}, {&(0x7f00000014c0)="28bf0e9189996cdfb0a277ea7bfd2921eba21735b0cd0506513c6701fc730b", 0x1f}, {&(0x7f0000001500)="d41da47939f287e58909c72345ca8a7e31fb5e326e51745f6499c14f51a9633ddff483b2d830d4c8761e709ca3e514a94f9bbe42f08220a7e46201db692e", 0x3e}, {&(0x7f0000001540)="17e49a2e3a1c753013bc6c37e9a58b0cde7e379f23f1e89260deeba997c9dd5773d02cbfbfffeeec59d1113b79e7d094504b5364fa39518469bf29dd8bdb32465e92d9d815466b888dcd09671fd710f05aae368faa1835379a1c710348f0a3957c8384fa158d08dd0742401b00a65bfb0f3301e8a4dcb2a637fd1ff00af39a7d76e47ab698969041e4c3991805340a6b13b928c2d0fddf0020af58f733fa104518112a570c7fb5d620f6de8c1265855cec33cfb1e5f4e83067bdeeeb4a047f84d55a848f7d1166e20310d7fca93be9770e2aa8676acc60fbe90f62394d283ae3d8302899ed8e663f39d3c7531ec472b43fd3d860ea3c02702dac4bb88a7ee304dc05dc4e9ae46f66ce812f6e41d6a2685454aaebf7042a1c86c2a43cba6b12506e4f3076ffb9d32106fd7f5bdfc39375345d8bd95d623e239a555d02251444fb8efe280a45df28ad60d63585008fd61fdc43dae4dae09376b5ec70fed1da48ab254809f1cb42f8f5cd8b7044c6305950a1c4f8a445829dbbaf4855afcc720154e293550df2924f42dbb63b63145ad6f347b0f8d387e646da59d2fb038713104a6ae8771adb6b2ca2cadc929da9b0c06d2c8f5d463307e93b3c89fd927db56b2cfae49f874a240c0d7abb594c45154ee0e47e2266fb27910da5500071d17a7aaeec0477b301b16f9593ac77095b783c93649897e575547523fd88d0e67cddd3043dd840b7108db3edec2ad66da42d9519b4aa0ae29fd74c7062428dcaad7fabc00cce8d9d73dc8e33e4aa086ec7389d0eaea0bd81ea5e1d6ce3564e29be1ca287f8e635bcad25d85d9337f84317ce64dfb9d0eeab2aecc38bae3b4063eacae1ed04767115004f11a63222235aa35de726295de72ce3b3d559d3b834080da487cc21cd83b8a4336ff78dc083cf969d0652a036f84f464317b8010493c73e47a1348521880e1af26fd4a762391bdb98036af9a077213210a2c6bf3cdfdb8d4d463cf0b18a72d43be4f17d7da5fe38d9b07b5ffbcd4364fdcb430b9aab6340e092c4c45f35bbfd8c6975d03e6906a6dbe58e6714c747b1e0b28f45eba4aa036bbd55a58ef0a3652b2b961adb14e34c013abf370d8a25acf9be1babdb16207123b16b74393987f306b94f813a3e370597f6b9eab535f869d4d7774346e35596011c763ed63aaa10509d573faaaa6cee30d0e15bd04620f8b0960609dfef83c2fad341e4951e88909953920dddaa813a8d333642ae62691a2a6c9869d65fddc5b6ad567559d3e6e6b6d5dc57521313cba019bc2aaca7e11ae2560a4cebc3a9e4da999450c9403d2e6ff0778f368a945715667d77600562efad6825c018600af6234429b3029142642b056f513080a60be79ee701e855cff571f7933ad32c71703a2d930fb509c0d6b33fa6f947fdc0be16d4da75bd33bca24366c247cc42f119b6264f76df2ea2b2dd837d6cd8894d5bc3d8eae402d523aa4f66671f186e9299b82e34a4d694d54ab80738d604285c35c00396ea96a035af85135ea081ab0fb18045e3be626837aad8696b23ba4f3fced395800ed5bcaffe86749bdf1091264ac1350eba9b8857aeac9e8331df4c93b1571488ebef78be60dd0ab6d49aa75700e54d4005d04bd545a85e50427144261662c45bf732dbbd450322b933a67bd2306e2711a260685506f340ea41452fda7849ba53653e746b2af2fa9fb2cf99755f38036af4e97506b200549a48e3730467dd496e879a2f74f63985d82786388e4a93b3bfb584a0f90264698454bea2c30f768ccec907055004ed6c40ab8d0e3c075f4b5afbfdcb4eaf11170e2581e71d8a1d2120f0ee0061b354a343b94cb3179ba100c89b6e75aa5f8e40e4e5c416a76b49338e2f721af9d215fb12d28268683cc785c8f61f529dc118fae49d098751eb970eadf785a919185c68af57c76452aa8c293b0fff7921da2a1c8e76f4f4dd2885816c1b45c134506cc7495e47ffbeb762c388c224776cc41a2c8bf012d1aceef79f38f53ac9b5aa1d1fa29626c7db2832d9023231ddeb0ee35b6264dd136903015083e2e98161059df949c931c9f1d54b8a9fe883c705057d85077c5c50d402926f451956528f311e98bd71a7c138ba1533bfc85a81152bcb16dc2b3b9a042e644fde6c5d65bbdc586fb5701767879ea90bdc970a4534bff564fb76352265516edcc3ba0060bafc1837d827858cdd40ce47d4228230658db8c4f5733af2bffe398901b1f13d6a1c56227bb7113686e199dc43443932f0ad11bcf559d042267f11a2fa852adcf4e028db42b1dffaa10712e6848c26275cf79bd9d487e015c01683760d3de423237141923ca7e5868d9557b92642b01a0ced57a59e4e86a3357fbaf9ad1f625a26f1d878cd0d9c22832c34da5d9a5e72738e1388435ce66695afbeb2e7d8efe0dc71827e3b73f5045e2b380f0a1e6b402f0ea4202a2916c57a48e9d4758f614127e2103359a224b450b950d27416652c98378f6fdb2eb6ced79b7e702bf1a418c7194d854982a70dca725676f23ed5b26caf1c42b1fb9ff1e0d058fc701a0b766f27ba9417ca10ab819e55d9d1ad2f0712bb50b37fbb9a8af4bb8a3dce6f52f7269e1291ec7babc83d53b1f83e8552eb40cf85da76395ad546fd6d67a64b498936dd19526782670c4a85ca6b9df851788b06f83700c499fd84bf2832d7728d88dab19ade93203bf7b061164c127cb28f82b2b2257701bd8cf2d7c9e6e9995da9ec22e8697820b6eee0fd0583f0cd71ff1c3fecbd16d694ee0e1a3be1d2e243788acff6c2e00bc1381021d8f9c1e75111bb068e11f53068d32ce3ada42b50e0a0909bd6ed7f7229d57cdd0c72969a06cd06410f9c246c74d1a3485989c8aedf1bd6b557320602f692f70a7481a35ccf9026aa75b0e926951011ccc3d959dbbf36b80aa8660ce2c490c72b5af8e5f4e2117cedacc211741ae4ae130d9bf32800be3831540d24277dd34409ef490629f16722f2b4efbd2716aff7a1a38f649ceb0dc7993e3a4b8da1e173ef0949feb1907e492b4215c89da5cd5eb8628e259e580c74a33dd05f8650773e5306fd555aa3f21593759052ce12fbf6e9ea17fd03ba1dabd8d52ddd8938446d8bb30c2a22cb4d57fededdc24862dd6df19fff091aa966e0451a2f6ef6d136f62001bf6df809a06f26a9ca4ac120814f9498e637a60a7582fc99cbb8dbb7f668839cd4e7db6aec8de740743c05165e5437d6ba92f8f42cbedfbadca9c18ef7fed723b623262053a9ea3e9a8fec688b41b5bc5c5a923dab01a929b024df2af43c49dccdf8c41bee455c2ad38f22a83ed9b0ffcf87463609f38d21056435286b9efee681b1585498f6c8a1303cdaf6556ec37a1a3baa41b8817077fe726435e0224e1896ce394e58bce4dcef35ea7f81b1ccec79640a2800a503c059e0d949266cb392343c54a56bc7c456bd8cf9104432c891d46ca751ca912825610cfd96504ea8e1299d50eefaec30b34b66375f7e41dbf35a5874ac022b705046602a55ac63385d3df75b92356cd97c1af307f356f51f53d932fa80e4510a053cea85b9d0e365e0aa63e9368c28342211cc7667a9cd316a866d4485560e7650b894f3f4f75c59bbc78704f7106baa9cd1b33daf9c1239b9f599679fab229fad1fa5512579ad1aae7e43aca3f8b290bb1fe08cb257d7e9ee071ed865ac8a1b4aaa45b8f7251be52395698d133d4b02294671d906ccb4f787ae3091732b4e4efaa732326ded5fe3441d770a3a6863f6206124087546ade52771728d700662654ae8d1fa7b46ad0cc4d16e461ca5ed52c5d1cdfbbdf73a794f855c3c13dd9d1bd17be509cc554d221297fe5d0f73bc4617e28922ad8ef2f23846c5895eb6932a6bfed90719d26e4a25f20ce8f2f52e6d8618e405f7b465c6c682db506706d9aaa9dba1437e32aafb1ca833d5ec9677c69a570afd80afbacd7ddeae1d06e164fd61ff9a04bad535813e94a83992dc54ed531301f7d061e9fb59c4e1316ad85685da0bc78473a5bd13f826eea2070ed1cc6af7e0c6d2740e4501e6254d2126f54b5b73fa97831adb74bdd5e388c5f393ca9086af5b174c5cf2a0b58e5ebad21c06dfd20700d004a4d7aeabd551e41d168ce989939bbeafa21c3f9eb0b4b63c118ca745404ffcb19089b320368e7cb5638d39d90a7a3854f7acdb4c17a4500f320e572a06f6675cf620fb01deb0d50aa53e4b0e56db5f3b18c83c4d413f1690e334448947be02d0dc0a88068014e21a9a6f19a1e95989cb9e5bc489fd34e998f8efc766f22d2c6368f8fa03d680bc2ecb2f6736d5b188b1fb3bd08950849f7ebe9d27a655a14ecf579cf71b2e9c18f2111749c836f983fbb028db9608543cbd4da433b43d57a4349a4638511f7367d7b1d2a0cd13bbdb69c410ec2a216e875819d608557c9996b6d9eff065cf5bd94a5a175c28e96241504c45fa2b1a69ded369e4832479a35374a618b927ba866f267db9d79210b69de33d5dcc471274fc07bdc3ab8fdab8156bc9519b834b54ad68cdccac88d2f2a6d39b7e91d1f99b3a06d1ad377e92029f533a1a4245d92be19c125b54c9030dc21b547ecf2c9252dc2358a0e57e40c3c8be1f5ce5b3587ca7798704966891bc05b0b5047cfa94f01b4480e458eb9b649f36d7622c32d019d9d6eabec09461b02566ddb77d563fea5e594a9cab4c40a206d6d30dd2cee660f85cc4d57fb0c8023041c18fe2bda58c53ab1d7c1622d050ccf246d51be77ffb4a6a2bd3bd18ba350b0afa61c814a2877a40815bae411092ed8564e1b91fff0e04fe1eb32d1352fd49518457cd9e82d63c3e47bc17f72ca33876d18bd9a364ac4633c0bcf7851c4a053c6fffdd9a59245ec5ac57c59e17835c5af63684baea1a82ced327bb8c55ad2c23b1cb38c1d16c7aa2b42840a720550d814759547559be8ecdd16133e7daaa4ffc46dad0d0a394fdfea2f12d5ccad41166f30229a47d776ff2b04129781afe726bdb5efb96680eb8b8062e49d6b78d6d95396925b28810a67ed2b9be6365d3b897e2b3ae44d721280be542e9c78ac80c1b87d9b85c0714f4039796ab01289fdd1f9e105b140dfcf1db91085fc66fcbd30c4c499562d187a7ed1b371dff7b591b6a4d0b5f181c68934359f23aaf46e6997302f5649f945eb64570e99184f39944e8c0356a09a49f8cc29b465a82b5a1cca0ed7b73fc3b9bc94e5690844ef1b09fe89fac21e2f8a06a94d7f47134dcc07fa082a851fd0ec1fb10984c24d85af2ed216be360a52971729ba4dc7c3826ec640612a230071cabb6d4ba11502a0a61a55ac642846fde3892f8b15586ad8b2d1ef514ff028a5613ba7bb779843d1367b74ec4bf493c187a7e2db65cd004312f6a3cbd76e247ea15778585b2b61cc95e610914cb3b1e4ec317772b093851650527f2b125f8886fb9be3b673a0cecd44de4609956054baee4384ca47d14ebc4f05efc7c84c4b390b57678e02771f083757b8911c8442953eccc28d17322b9631b8ff3cd793d3031f53f7e011a879c5f6b4d762a804ca389f3b700e21b36d126fa6f18f69303516a9cfb50981bf72385e5e28d30cf3818898e46e7cb6cb3549ebda2e6beba94a1dd420b9567950c2b69e7ca7a014abdf38489017d6b478e356b47775103240360b42e70914fd2f0cf356f3de85de040b3de59e9fe91d1097dce42d876e5a0e5e81b256b53b4a9dba2f790698ef5f19a5cafb5d866d27c189bc16fc2ae84487a34569b49525471e825b25d531b08f538b3b364b82caec55ad671d7dfa962684094dd", 0x1000}], 0x4, &(0x7f0000002b80)=[@cred={{0x1c, 0x1, 0x2, {r16, r17}}}, @cred={{0x1c, 0x1, 0x2, {0xffffffffffffffff, 0xee01}}}, @cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x38, 0x1, 0x1, [r7, 0xffffffffffffffff, 0xffffffffffffffff, r8, r6, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r1, r14]}}, @cred={{0x1c}}], 0xd8, 0x80}, 0x4000001) 237.912687ms ago: executing program 1 (id=11573): bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0xe, 0x4, &(0x7f0000000700)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x8}, [@generic={0x91, 0x1, 0x1, 0x7e, 0x4000000}]}, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x94) 184.682366ms ago: executing program 3 (id=11574): r0 = socket$unix(0x1, 0x1, 0x0) r1 = socket$unix(0x1, 0x1, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r3 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r5 = socket(0x400000000010, 0x3, 0x0) r6 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd26, 0x25dfdbfd, {0x0, 0x0, 0x0, r7, {0x0, 0x4}, {0xffff, 0xffff}, {0x0, 0x3}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x11}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000280)=@newtfilter={0x84, 0x2c, 0xd27, 0x30bd29, 0x25dfdc00, {0x0, 0x0, 0x0, r4, {0xe, 0xf}, {}, {0x7, 0x3}}, [@filter_kind_options=@f_matchall={{0xd}, {0x50, 0x2, [@TCA_MATCHALL_ACT={0x4c, 0x2, [@m_ife={0x48, 0x1, 0x0, 0x0, {{0x8}, {0x20, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c, 0x1, {{0x1ff, 0x5, 0x3, 0x3, 0x400}, 0x1}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x3}}}}]}]}}]}, 0x84}}, 0x800) r8 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r8) socket$igmp(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r8, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}) r9 = socket$kcm(0x11, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, 0x0) sendmsg$kcm(r9, &(0x7f00000000c0)={&(0x7f0000000380)=@xdp={0x2c, 0x7, 0x0, 0x3e}, 0x80, &(0x7f0000000080)=[{&(0x7f00000009c0)="f1", 0x1}], 0x1}, 0x24024024) 1.637303ms ago: executing program 1 (id=11575): sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="4c00df250700"/20, @ANYRES32=0x0], 0x4c}, 0x1, 0x0, 0x0, 0x20044850}, 0x8000) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000540)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x70bd27, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x2}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x4, 0xffff2153, 0x2, 0xa, 0xd, 0x1c4, 0x7, 0x2, 0x6}}}}]}, 0x58}}, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) r5 = socket$unix(0x1, 0x1, 0x0) r6 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000340)=@newtfilter={0x84, 0x2c, 0xd27, 0x30bd29, 0x25dfdc00, {0x0, 0x0, 0x0, r7, {0x4, 0x5}, {}, {0x7, 0x5}}, [@filter_kind_options=@f_matchall={{0xd}, {0x50, 0x2, [@TCA_MATCHALL_ACT={0x4c, 0x2, [@m_ife={0x48, 0x1, 0x0, 0x0, {{0x8}, {0x20, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c, 0x1, {{0x4, 0xb, 0x10000000, 0x9, 0x3}}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x3}}}}]}]}}]}, 0x84}, 0x1, 0x0, 0x0, 0x20048091}, 0x0) r8 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x149540, 0x0) close(r8) socket$nl_route(0x10, 0x3, 0x0) ioctl$SIOCSIFHWADDR(r8, 0x8914, &(0x7f0000000000)={'syzkaller0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}}) r9 = socket$kcm(0x11, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$kcm(r9, &(0x7f00000001c0)={&(0x7f0000000840)=@xdp={0x2c, 0x7, r10, 0x31}, 0x80, &(0x7f00000000c0)=[{&(0x7f00000002c0)='\x00', 0x5dc}], 0x1}, 0x4) 0s ago: executing program 5 (id=11576): r0 = socket$nl_route(0x10, 0x3, 0x0) (async, rerun: 64) r1 = socket$netlink(0x10, 0x3, 0x0) (async, rerun: 64) r2 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={0x0, 0x14}}, 0x0) (async, rerun: 32) getsockname$packet(r2, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) (rerun: 32) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="480000001000050700000086d7c0d6c878f064eb", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000900)=@newqdisc={0x30, 0x24, 0xf1d, 0x70bd2d, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_clsact={0xb}]}, 0x30}}, 0x4000800) r4 = socket$netlink(0x10, 0x3, 0x0) (async) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000001f80)=ANY=[@ANYBLOB="b702000009000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2e6405000000000065060400010000000404000001007d60b7030000000000006a0a00fe00000000850000000d000000b70000000000000095000000000000002c3f2cc2b7956244cef7baf48e6d2885a09a87507ebfc75b5b0f4e4309ebcdac5f7a860c008cbdd3b4c3b7f28754860c9c781f6410457253e89ad528d985636a86ec0f68f59cd1159a2c2e85d726859a919cc9548a349980d1ccdce27f94bc074c27f81078545c146a0857153b7b8f00034debae58a4ab415b0d7ff0575cc272cd3d7e8d974927676468ff2d86e0ffac94792ed9cf6b40b3cf252a47c05ae8a70d57cc3e067d1867b54d24e20000000000000020009ebf84d3b042d6e432cd080e3b57239f0127473e6ba922aff649609d40b47ec331ccba3cf96f9483ff19a6471bf5abc742d9cbcfb964b11b31034694a6aad86cf08a6c7b2235dc99de9aa3e6b77c7a2877261ed32da90864987f30926c9013eec3b86836ae50447aa5a79f40c235000000453302712c3d8fc4e2b61adb0695e800000000d4f4e91f0000002c33df424d1bafe5725c8a404724f8a4f1cda7997b65954f74097560b91da309b887af2485c2d9ab09b523000000000000000bf7b2ff4602aec1eea200000064881c5630521a08e051374cf05c921a06fb7818000000009dc8d95e0e5b365d10e1004dae58b3b5b89709b0ff47b200000000004000cbef88811dc8c1b27ac7d9a6bb70f60eb9c01dd2fc79b85e4d961498f3a80131d21d856177a2189f45d011ef1da5c6d57bb8fd387ccea9c3899a914e47e82f040000009d81003f927355408f87264797d3fa970949793b94329d580500d1f91c0d22587e05a61e3d8576ca168e88d7a9af95b04a37c27bfffab9abbb31fa8c0080258cfa6d3f166e695f3c56490aeef464d9965d70a50f1282619344f223548e750339643adac1322c87ca253ff2fb1882760d6feab16bacdf83c11816dbe959ebc5ec479c8319f73e2249eab0486b110702a481d3b51976a52303056e800b4ae5acc2dfae60ab958e9f3ef9b4aaa4e8d6166f636a65eb1d672bf2000000cda8462cc9b16624998be65683321e970000000009b8e20762c1bf4a3eb6769f2b23e842bacd9c685edea0ffa3e975424f8ede49e61a4de808a38ba3512d64dc71867df4eee3f1ff791cf7c9862f98b45852e4b2f78721b978a2df2f2a29a387c6f0576b36038f819286eca99a6a434811cf2a117d775fe986a49fb82cf5f15972d5ab18f1045384501adabb20f7b0e15ff47f1744e2341b59034959a1289ba6e243668e6735305707e3de7652bfc5b60c76deff43a1d6fd6a4180ab723735abbeffe7f2ec3a0bb86f9eddfc0f3d1d503d7a54b49e1ae6c5aa620d27e91aa0aa0ed6fcacfc91fbb4c256409e54daefbb107c381fa729ff5f3907d93430da178d685d7730f5e129438a5214f722096d2986334c2576bef69145d3fbd78a9059e454474f92e65828b018174a9f4738b8c71fbdeac26ab95e02f9a847182766964976b1fccdb9f35721e43e33883cf16ed1343fb7429eb395123b0a4262b7023c22039b9002589a378ed4c6267965af78b861bd025312538cec97966b8973d4e299d9802264d06e40ae118e1d242d1128dcedeb44030df12ef68f78215d65f96eb55db8cbcb060008000d988374f85451a694ffe38a1d03916ff10dc82b31c98d42e1a1bda1290de1a499a5a385b31112a48ba3e6d6849914c1788a7aca37177cc341fff44fec5c5e0abae01c439a1b0311e074e81ae9993b5b3459553e4ece78d4c1501c70f5d81e0725d5b273755c0000000000000000aa4234ff82182952a76233d18e7d49638aeb04e7a9e9e7eafb7c255372795d2d192a0a33cab0f5bf2e93e0544fcdf2df2bc6ce96e5a11993d54f97a23754ac828674dbb93c0ad345715be4a13678b01edf76d8a923655800a2c88cce004505ab45d8f5f88aa887bbce5c18970428516f6099bdbb2cd7a2356397f1a0a23e662e2a6c4834400cbaa41c3c574e6e6aefb7a68da5ec1ae49f968bbe0e0bf9878516f553639f5b4828e92019b61f5874be1c7cdd9482df50bc24b8a1fa10d291390eb84e26a2e8dbeaa45604b05a116c1210a7540bf81005044273f5a8ffc538db289350eb248e483bd8920efcf30a798c2b636243e0a37262ca47dfeefa753ba528f7ba77e825051ce69b4475d7d714ba0c636e6ae9f710411d30ef424aeaabe057c7df6ff8f767bcd9012e1047c686f5ccb76ab3a5df53cbc22ba7ea8f6a8e220bb4d83de1e4dc19d6c1be841503850803bc2c2d5e0e34270a7f1cca0c6c53a8e5f891f7a793a70da62d6d88fbb90d220acc687931b42d6be83ab870da3c0a567f5e65ec0457f4ad2a4ec0b671b36388afd5520a8483a4b11f7d02a409315f0f9e59f47668d68a74838d6976e12fd45200014041dffacbf60892ec8bd7560686f137a806d3dfaba900b47cac62f828342fff009adb5b2251461a1b9d6ba625b8fe04e69a1a4be2696f0000000086e172932e03000000000000005942e1b9d6dc28ab8e19e1111dd893e801015642faf21eef40d6e7de3ef62c4bc5ff17e7aeb2841098f845d1cc9ec4eee79c298fb0ba939b13707044e2e9cc0d350438c1c8c6bb9a38c6ac5ca0d9cf1f3d6915f25cb26edfc28b3079b97df32601240e454db103fb0c4a143673a3f160d3a7b83ecd0509ce9eba0c7bf7843799b1b56a234f9eaab8a3f14f1472bb6aaeb8ac9ee4054605558ab31f339f6a4caf2ee2fd01f34dca3300000000000000000000000000000000f59f8e6e00000000c44130098d833a24000000000095e6f945ba9a941cef5e70b8c152321e24b5b29bcf374dcf5a29a35d76e6e2bf8df95462690a4fc9ec8129e92b6ebb4b40a992a75d3c595426ae40d0bfc87db24d856359079b29b3c374d081c300b2cfaa596d24e800ef8e2201f2fb7a9946f89f9f31f7cbd603fd7f8898c70b5c65f2e28f22e1a79a6af3a54861b07f124642e98389557affbdede09b5566a4a1ee73b20846810030a754acddcdafe3ceeeebc0b5f2fedfe7d198e3067f3dbac9441a9ab8409cbbb7e15b9ae3944097de34de2001c8533a3766e6e4c4c4702ccb932a27a3962814cd6aa8fc684beeaa3932efae3a9052be8eec1e95f6ad8d41dd34829503ba4b66e27154cb6e34aa13450522df1723130b6fe347c93f00e40e293c98d849a33f773c743728992f40faccd5c23130a1c6bfd6fc661bca1598137ddd1090ded672f5a48a40cab3f640c8241a364cbdd3f188eec7da7bccafbd5bf28a46f0eecc6b550471b0b0770c6a5a411c0e0b19e15a461e7c6833ba936e214b013f2819ec6572a43b5cd32b11d7e4f8dcf8f7820a17b7b2ee6178a03351dd25091e46bfd82a3979b9cad109fd6217cd52aa81bdabd50826a674bd16b8f7e6aed12a305366599f5f029a7b24558c027518c669760500002f1c19d16a6f391906000000cc0bbbfb8c698ecc137d96711100e0108d3bd2afed0b279ebf0527552a9331e646c424b14ffbb815622bfd2f635855bed1b164d0a56bd104be069854111c5b26ec3c652b5f0a6b9676dae987ec23456ba05a4dfb15321ef6b76e7e547a688c67ab531cfc784c9f940d9fb0464a6cce635e14b80dc5c1c64e75e6bd5355d84f8df272f18f58c570e7afd83ee77f157c146aa747b728969aeb4aba1d8f9de1b3fb8ab6ea50e884c2ea98e6400bf0c5ae2887cd1da0e57ccfdf5eca2b455247efcc13102846c0a85f20c80007c0ce6efce627b95b8ad3003385de97101678fb2163ecea6e70a77a6fbc089e31a5ccece932229b8f79faa6863d6857c3d9a9710f9f8ad16eeb8342278f311cbc226498028234d21466892983378fe64acbb44f694cd78e43c74aa75505cb1c91b189f8f89f233a05f5cd4e173a373178557843dd705268f74a9e5429945503195aefd6706b584d8408c9652b3fe68500747f7ee8375fa559c3ad195d3795df1a8364cd13acc3256ee4634c73eeb6954d0fcf09ab84df0b8900e0c6fea2ccb600ae7a4b128cae19df160e7c207b89132d1d5bdc9ffc79f0549b82df521817651d5fead5128205b92ccdccc69407ab556217af277af911dbd456dfc43dd061b6c91485dcc208cf0b3d0bf851de413f5de5ec015e296914afab6411109355e027ce04990d9aae251b9deb11b7db45b9f15b7b55d8fdbedd9e6cf891205694f02be8b9ea8ecd41308a0e1b93ae3435bfa88b440b1f701b4d0fc49c82193f27f8023b630ea97edbf3bf421a0a1a2b4ac7bb30bcd1cdd172c0df37408fd6827bb03e8742fc1c7a2befd1299928c5f79e846a8dc7ca648d960a759e6711b69776896a9656d59af6d44bc5348229fa84ae78af8421a22c4b4c17a3d24a4a0104000000000000d77cc4eef51c2b417c8c7458ddd7dd9d1a863bf0a9e1a30a19020490038017a5c7e474c83302a2c2b5c976dacf3dda7191c757f208000000000000005f7ed983f65723fbb36b9b51abb0dbcd335700000000000000000000000000000086666201251aa4f139d0485ffcf89f01639fd1579a3802f720a0215c720a97071f5065a23642a58275dbca444b00e2e5835185d5d5b2796eb0fe32cf3b0633f58ecc7648c3c6efe82f93a3008052416512eea30ea9472e0b456a652883c0907323cf03be193a05008cdef7a98a1671a1918df310dc4bfd61c3db4819ab1c57b348a8ff1ed36364a20fe846f1cd086058d139ce528425b31c5d08b433562ffb318c1285011f9b78b2401989384311101e452f54661ecdb2514a6ae50dbdd422de0f0f8c670000000000390be79688f80c47314cb1b14afcaa5d23f9032e0ec51f45f447d6a7c798fcf7e60e2180e289410801e4f03a0e140f388f25b92da1025d8409e171a2336ed71cca86eb4658fe06df286e0e20276b0618eeffd05774f15686cd9d3182ca2fec863875f305fed6baf48a594db12582a38cfdffffffffffffff0cf8d920517835fe7d09cfcb624f6931f1cc6f6b71f58de9ddc38e0c43992f6bc57a718d0cfd197b5324b4e05ef1caa96db3ae1f2f2e5791faba2ebbe1a6faf21f2748fb1fb6743c3ca8af4e6b02518c9b7fdc1b5721eb1c3ed98db25536f74ac7861afc94544e52dcb5c60460a05802e3b437ac977bfa26b887a2443e8d559c58187f004eb82b07937df6e96f77ed551926bec4e0188fae10a35d1c5f1768ac6be829bea46f1babc3d74adc31ca71bdab9079e4288881b434484eadde9da6b81802842abd462d546c59d87acc014f81d3414759bda12d2a2c6bc1bfa807bd3101eb227184a61107b6d0618e2a3b842671e084ac3f0ff94dc48b51601247318ab4d1c5106458000000000008000000000000cfee0107e6c2fe8639d926829fdbbd86bf591a8c3c235d8939af9d923f648165881a6c29997234406400b3b1c321cc158dbe17123eace30000000000009ea77cb4d3ca892600000000796de6ae4ae40bdf9a6e8c5dc29562262af9cd54e8e3ecc7e3c8cba0ecc791683496c4e5c1a5729714d9f9031f49b400cd2667b4ea6df54809615a4f973f93e6ccec72f16ff998e29ed99df733680a9d5cea57f99cc139b6ea9014f3000000000000000000000000000000000000feeab45a4046a622b0dceb413e4e39b7317e92cbed46b41ab5115bfb542c933783d750852dfdc6656aaf15e10615a88821f2f1bc53969b52d6852755e7681ad5beda80b38ccd34116b99f50b4fdd967b3f20f260455412b67563e40e323bde9d673fceda0ad6981565c8a183d928903b4f4472dde41b6dcd75314c31e704dfcb222c8359fe88944f852242270c932abfaeece0843d708f5cd25b2a63ae1e79723c1c3c013836b47da0a35d0f34c070000000000000422ae2c148d444dd437a7d2f5e575009bc2d17a199802409329dae8baa58d3de63ad45328a9d4dc1ace543dfe11913c6c6413f8f7a15657d012fea460bb4656a20df1ba26932b0ef49f8ea88d7b4c1289314ba789661640f1b5d7cbae103fa95b0035f1e8e866207d4796eab0992704f9e00be4b1af8dfa9e94ad74e607ea9d7d7a95ed5a15429426abbed8d2c657018305c6f9e5159a5453f958991a908ff4cb2e8cbccb1d3c8daf754e4b01b2edd023e5bfdf293bd28fc1f8885f6edd5a715df4d180247feb08e9e2e5126c48be6098e711f0d86de5d76fdccae34eef9197c32ab4e6fcb52eb9ce18fdb621a75913a97254d783778203ec0bd1a8859683e1d01da4e81fb73bb3b358340a0310bf5ae17b917208da607fd7b125cf99fd3e9056f5184df7570ede94b736ae354b5b8ae2cc473b455f2f86d47c69027676bf1141f316b0f278f1692406572ee82766f8e5ff1cfec2a7a6cab7d0f2582a877c9bd4ca81089373f738d02e6bb4d3df30ac0f041e51ad36e1ff140812baf54b80635cc80963c8f69fa4506f7a30c99d3e538cc0aeafcad86ead38ed949aa3c204aea50e5e0039f01b82595b7dc921a8acc1f76340f060cc9a3acad3451c17dc9b5ca5d10a0cb1708592d1900a046f33761d50895febd9fd58cb132989766cf7c252daac259576ec218e3857e6fa97fe445d1fab51d87302a4bb28a4cfe462ee4849cc6832650188ca187d85509d8beccf9d9cf752368985804195b9fd2faf1aff8248f3981bd55cbbf514cd8365fee72cc7af053e5388ceadadb96a9acd5261df6a90cab13f58f6d563c9ab4ad37297aecffd8446cb2b14ec36a99af8393e3760d5970ba1debdcbccd54012c559ee2797ff962328aa6a252c0756e396ce4d52937546675203bdf1d6b120acac576523f8b1daa922188bf61536312f90dba92fb380c3c6fb5f9883a2c4dd99a1bac9b7cb25ff2ef9bd58ff97ddfdd2d4bcc371ee82245b57cd91a7fa3479cd339f54a5c422b753cd42d441ea881d46e419312db1f0cccced13468a188df7ab4840b9961e2a8b5202c9d9b00ee912572eea15d13abdf3b21ad680c88a513021c1d3a7b30d64960c03a01364b2324966bd89d917b15dcb4f8cbacfe05ddcc213d14189edcd9f8b828ebaaab4f56470d3abef47b6d88dc438c9b0a253c26c386464754e76c0d7bfbc1dfa7248982ec26bd725eb623bb12f96e63eb5d1a0030e58a6653247c986c7ca9f15fd84d5eb1cd5ee35c4f464dc1a789b06c6c7074fc927680eac8546b2aee2f8867d6bf36b88a99ff67c7b2dd68ae3380622653efcad276a0f4b446091b80653014e67629dfde0091c7f090a22b5c427d03ddbc"], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa6, 0x0, 0x0, 0x10, 0x3}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000000c0)={r5, 0x20e, 0xe40, 0xfd000004, &(0x7f00000004c0)="b9180bb76003070c009e40f088471fff31000000330020010010ac14142ee0080001c699da153f0ae0e6e380f60115f683317585d7473ce0ab4439f0f570ff155bc5f73ba3f8bb99a6e8ded1ce485cf058105cd981b42493481cd659416a2e10c9119664f36eb00b333c20c9ec0c222d644bdcb178c1cc53d6960fbb842d6a33dfcde3a1e1848135214baf139753866cadcbe3ce52505e992818cc452bee339d9ab076f484020eaa348a21d7911e4c44905256ec2cc54cca47a198b00c10aff62a4bed43a2ebcad92743fb22c593f28fd4bb7c703cde9cae0569d4c8d9a823f2c12863f7a6c0cf88ed22aae4f6f084508833b61429a25773eedf63dd9f33d430f2a0a30a7761db16fe0f743b95ded898c28aac1256ce2751b3d738899b8b19d9052b7f13ff94", 0x0, 0x31, 0x6000000000000000, 0xfffffffffffffe7e, 0x1d4}, 0x28) bind$netlink(r4, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) (async) sendmsg$nl_route_sched(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000300)=@delchain={0x4c, 0x64, 0xf31, 0xfffffffb, 0x2, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xfff3, 0xffff}, {0x0, 0x1b}}, [@TCA_CHAIN={0x0, 0xb, 0xe0d}]}, 0x4c}, 0x1, 0x0, 0x0, 0x10}, 0x0) (async) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r6, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000980)=@newtaction={0x48, 0x30, 0x1, 0x0, 0x0, {}, [{0x34, 0x1, [@m_mpls={0x30, 0x1, 0x0, 0x0, {{0x9}, {0x4}, {0x4, 0x2}, {0xc}, {0xc}}}]}]}, 0x48}, 0x1, 0x0, 0x0, 0x4040005}, 0x0) (async) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$ethtool(&(0x7f00000003c0), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKMODES_GET(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)={0x20, r8, 0x309, 0x0, 0x0, {0x1d}, [@HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x7}]}]}, 0x20}}, 0x0) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) (async) syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), r7) (async, rerun: 64) r10 = socket$inet6_udp(0xa, 0x2, 0x0) (async, rerun: 64) r11 = socket$inet_mptcp(0x2, 0x1, 0x106) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r11, 0x6, 0x23, &(0x7f0000000180)={&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x0, 0x0, 0x0, &(0x7f0000000080)=""/111, 0x6f, 0x0, &(0x7f0000000100)=""/44, 0x2c}, &(0x7f00000001c0)=0x40) (async, rerun: 32) bind$inet6(r10, &(0x7f0000000000)={0xa, 0xe22, 0x0, @empty}, 0x1c) (async, rerun: 32) connect$inet6(r10, &(0x7f0000000140)={0xa, 0x4e20, 0x6, @local, 0xb}, 0x1c) (async) setsockopt$SO_BINDTODEVICE(r10, 0x1, 0x19, &(0x7f0000000040)='tunl0\x00', 0x10) (async) syz_emit_ethernet(0xdd, &(0x7f0000000300)={@local, @local, @void, {@ipv6={0x86dd, @udp={0x0, 0x6, "fa0500", 0x48, 0x11, 0x0, @local, @local, {[], {0x4e20, 0xe22, 0x48, 0x0, @wg=@cookie={0x3, 0x2, "88c73b21f267636d01dbe5712c1c941e1cdafbbb43f09c28", "e138060072381f41e5fff9620915b6f78670dfaf9a195fcb2a79cf6b7931c9b4"}}}}}}}, 0x0) sendmsg$NFT_BATCH(r9, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWFLOWTABLE={0x58, 0x16, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz0\x00'}, @NFTA_FLOWTABLE_HOOK={0x2c, 0x3, 0x0, 0x1, [@NFTA_FLOWTABLE_HOOK_NUM={0x8}, @NFTA_FLOWTABLE_HOOK_PRIORITY={0x8}, @NFTA_FLOWTABLE_HOOK_DEVS={0x18, 0x3, 0x0, 0x1, [{0x14, 0x1, 'geneve0\x00'}]}]}]}, @NFT_MSG_DELFLOWTABLE={0x5c, 0x18, 0xa, 0x101, 0xb00, 0x0, {0x1}, [@NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz0\x00'}, @NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_FLOWTABLE_HOOK={0x30, 0x3, 0x0, 0x1, [@NFTA_FLOWTABLE_HOOK_DEVS={0x2c, 0x3, 0x0, 0x1, [{0x14, 0x1, 'geneve0\x00'}, {0x14, 0x1, 'virt_wifi0\x00'}]}]}]}], {0x14, 0x10}}, 0xfc}}, 0x0) kernel console output (not intermixed with test programs): ast mode [ 566.037740][T27537] tipc: Enabled bearer , priority 0 [ 566.049511][T27537] syzkaller0: entered promiscuous mode [ 566.057504][T27537] syzkaller0: entered allmulticast mode [ 566.110096][T27532] tipc: Resetting bearer [ 566.131129][T27531] tipc: Resetting bearer [ 566.199846][T27531] tipc: Disabling bearer [ 566.240166][T27537] tipc: Resetting bearer [ 566.318213][T27533] tipc: Resetting bearer [ 566.422201][T27533] tipc: Disabling bearer [ 566.922575][T27577] syzkaller0: entered promiscuous mode [ 566.945373][T27586] TCP: request_sock_TCPv6: Possible SYN flooding on port [::]:20002. Sending cookies. [ 566.945392][T27577] syzkaller0: entered allmulticast mode [ 569.869915][T27598] syzkaller0: entered promiscuous mode [ 569.902711][T27598] syzkaller0: entered allmulticast mode [ 573.434883][T27671] syzkaller0: entered promiscuous mode [ 573.461358][T27671] syzkaller0: entered allmulticast mode [ 573.729593][T27680] syzkaller0: entered promiscuous mode [ 573.743947][T27680] syzkaller0: entered allmulticast mode [ 573.890310][T27680] tipc: Enabled bearer , priority 0 [ 573.959382][T27678] tipc: Resetting bearer [ 574.019806][T27678] tipc: Disabling bearer [ 574.042818][T27684] syzkaller0: entered promiscuous mode [ 574.049306][T27684] syzkaller0: entered allmulticast mode [ 574.220375][T27695] netlink: 12 bytes leftover after parsing attributes in process `syz.0.9740'. [ 574.425078][T27697] bridge8: port 1(veth13) entered blocking state [ 574.431675][T27697] bridge8: port 1(veth13) entered disabled state [ 574.441181][T27697] veth13: entered allmulticast mode [ 574.451866][T27697] veth13: entered promiscuous mode [ 574.466641][T27698] bond5: (slave veth0_to_bond): Releasing active interface [ 574.484271][T27698] bond5: (slave veth0_to_bond): the permanent HWaddr of slave - aa:aa:aa:aa:aa:1d - is still in use by bond - set the HWaddr of slave to a different address to avoid conflicts [ 574.527913][T27698] bridge8: port 2(veth0_to_bond) entered blocking state [ 574.557590][T27698] bridge8: port 2(veth0_to_bond) entered disabled state [ 574.579169][T27698] veth0_to_bond: entered allmulticast mode [ 574.592612][T27698] veth0_to_bond: entered promiscuous mode [ 574.733262][T27702] syzkaller0: entered promiscuous mode [ 574.739645][T27702] syzkaller0: entered allmulticast mode [ 574.860821][T27711] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 575.019879][T27720] syzkaller0: entered promiscuous mode [ 575.053600][T27720] syzkaller0: entered allmulticast mode [ 575.291687][T27731] netlink: 14 bytes leftover after parsing attributes in process `syz.2.9747'. [ 575.326972][T27734] netlink: 'syz.3.9750': attribute type 1 has an invalid length. [ 575.369770][T27731] team0: Port device dummy0 removed [ 575.472598][T27739] bond9: (slave geneve3): making interface the new active one [ 575.484813][T27739] bond9: (slave geneve3): Enslaving as an active interface with an up link [ 575.538408][ T12] netdevsim netdevsim3 netdevsim0: set [1, 1] type 2 family 0 port 20000 - 0 [ 575.576347][ T12] netdevsim netdevsim3 netdevsim1: set [1, 1] type 2 family 0 port 20000 - 0 [ 575.581000][T27734] netlink: 28 bytes leftover after parsing attributes in process `syz.3.9750'. [ 575.605582][ T12] netdevsim netdevsim3 netdevsim2: set [1, 1] type 2 family 0 port 20000 - 0 [ 575.622803][T27742] netlink: 4 bytes leftover after parsing attributes in process `syz.4.9751'. [ 575.647631][T27734] 8021q: adding VLAN 0 to HW filter on device bond9 [ 575.674860][ T3379] netdevsim netdevsim3 netdevsim3: set [1, 1] type 2 family 0 port 20000 - 0 [ 575.698840][T27748] netlink: 108 bytes leftover after parsing attributes in process `syz.2.9753'. [ 575.752382][T27750] lo speed is unknown, defaulting to 1000 [ 575.781300][T27750] lo speed is unknown, defaulting to 1000 [ 575.831195][T27752] »»»»»»: renamed from lo (while UP) [ 575.882187][T27750] »»»»»» speed is unknown, defaulting to 1000 [ 575.955982][T27750] smbdirect: ib_dev[syú2]: added: RNIC max_fast_reg_page_list_len=256 device_cap_flags=0x200000 kernel_cap_flags=0x10 page_size_cap=0x1000 [ 576.025310][T27758] syzkaller0: entered promiscuous mode [ 576.038948][T27750] smbdirect: ib_dev[syú2]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=1 max_cqe=3276800 max_qp_wr=32768 max_send_sge=6 max_recv_sge=6 [ 576.048836][T27758] syzkaller0: entered allmulticast mode [ 576.101403][T27760] syzkaller0: entered promiscuous mode [ 576.103717][T27750] smbdirect: ib_dev[syú2]PORT[1]: iwarp=1 ib=0 roce=0 v1=0 v2=0 core_cap_flags=0x400008 [ 576.111182][T27760] syzkaller0: entered allmulticast mode [ 576.279722][T27750] infiniband syú2: RDMA CMA: cma_listen_on_dev, error -98 [ 576.635913][T27750] »»»»»» speed is unknown, defaulting to 1000 [ 576.667643][T27750] »»»»»» speed is unknown, defaulting to 1000 [ 576.749588][T27750] »»»»»» speed is unknown, defaulting to 1000 [ 576.768510][T27750] »»»»»» speed is unknown, defaulting to 1000 [ 576.883333][ T30] audit: type=1804 audit(1779894810.619:6): pid=27791 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.0.9762" name="/newroot/1959/cgroup.controllers" dev="tmpfs" ino=9874 res=1 errno=0 [ 576.925564][ T30] audit: type=1800 audit(1779894810.619:7): pid=27791 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.9762" name="cgroup.controllers" dev="tmpfs" ino=9874 res=0 errno=0 [ 577.030914][T27750] »»»»»» speed is unknown, defaulting to 1000 [ 577.090916][T27797] tipc: Failed to remove unknown binding: 66,1,1/1:3351690245/3351690247 [ 577.126713][T27797] tipc: Failed to remove unknown binding: 66,1,1/1:3351690245/3351690247 [ 577.171502][T27797] netlink: 'syz.0.9764': attribute type 142 has an invalid length. [ 577.289954][T27806] block nbd4: NBD_DISCONNECT [ 577.294815][T27806] block nbd4: Send disconnect failed -32 [ 577.304263][T27806] block nbd4: shutting down sockets [ 577.325412][ C0] blk_print_req_error: 135 callbacks suppressed [ 577.325456][ C0] I/O error, dev nbd4, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 577.341088][ C0] buffer_io_error: 135 callbacks suppressed [ 577.341110][ C0] Buffer I/O error on dev nbd4, logical block 0, async page read [ 577.363567][ C0] I/O error, dev nbd4, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 577.372725][ C0] Buffer I/O error on dev nbd4, logical block 1, async page read [ 577.383287][ C0] I/O error, dev nbd4, sector 4 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 577.392614][ C0] Buffer I/O error on dev nbd4, logical block 2, async page read [ 577.400508][ C0] I/O error, dev nbd4, sector 6 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 577.409804][ C0] Buffer I/O error on dev nbd4, logical block 3, async page read [ 577.419375][ T5646] I/O error, dev nbd4, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 577.432027][ T5646] Buffer I/O error on dev nbd4, logical block 0, async page read [ 577.440442][ T5646] I/O error, dev nbd4, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 577.449981][ T5646] Buffer I/O error on dev nbd4, logical block 1, async page read [ 577.459541][ T5646] I/O error, dev nbd4, sector 4 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 577.472575][ T5646] Buffer I/O error on dev nbd4, logical block 2, async page read [ 577.520027][ T5646] I/O error, dev nbd4, sector 6 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 577.552042][ T5646] Buffer I/O error on dev nbd4, logical block 3, async page read [ 577.586144][ T5646] I/O error, dev nbd4, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 577.614667][ T5646] Buffer I/O error on dev nbd4, logical block 0, async page read [ 577.643530][ T5646] I/O error, dev nbd4, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 577.668265][T27812] syzkaller0: entered promiscuous mode [ 577.682895][T27812] syzkaller0: entered allmulticast mode [ 577.688356][ T5646] Buffer I/O error on dev nbd4, logical block 1, async page read [ 577.727099][ T5646] ldm_validate_partition_table(): Disk read failed. [ 577.746330][ T5646] Dev nbd4: unable to read RDB block 0 [ 577.799523][ T5646] nbd4: unable to read partition table [ 577.852000][ T5646] ldm_validate_partition_table(): Disk read failed. [ 577.867413][ T5646] Dev nbd4: unable to read RDB block 0 [ 577.879272][ T5646] nbd4: unable to read partition table [ 577.898714][T27816] syzkaller0: entered promiscuous mode [ 577.923440][T27816] syzkaller0: entered allmulticast mode [ 578.308673][T27836] TC_ACT_REPEAT abuse ? [ 578.551989][T27845] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 579.109514][T27858] syzkaller0: entered promiscuous mode [ 579.124676][T27858] syzkaller0: entered allmulticast mode [ 579.334901][T27875] xt_hashlimit: size too large, truncated to 1048576 [ 579.444500][T27878] erspan0: left promiscuous mode [ 579.566021][T27878] 8021q: adding VLAN 0 to HW filter on device bond0 [ 579.602124][T27878] 8021q: adding VLAN 0 to HW filter on device team0 [ 579.690510][T27878] batadv0: left promiscuous mode [ 579.745870][T27878] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 579.798857][T27878] tipc: Resetting bearer [ 580.006132][T27878] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 580.042388][T27878] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 580.056503][T27878] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 580.070321][T27878] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 580.094458][T27878] veth1_vlan: left promiscuous mode [ 580.101412][T27878] veth0_vlan: left promiscuous mode [ 580.117785][T27878] veth0_vlan: entered promiscuous mode [ 580.128843][T27878] veth1_vlan: entered promiscuous mode [ 580.138423][T27878] tipc: Resetting bearer [ 580.145708][T27878] tipc: Resetting bearer [ 580.159569][T27878] veth1_macvtap: left promiscuous mode [ 580.176773][T27878] veth0_macvtap: left promiscuous mode [ 580.200467][T27878] veth0_macvtap: entered promiscuous mode [ 580.212390][T27878] veth1_macvtap: entered promiscuous mode [ 580.254609][T27878] 8021q: adding VLAN 0 to HW filter on device bond1 [ 580.270559][T27878] 8021q: adding VLAN 0 to HW filter on device batadv1 [ 580.292764][T27878] batadv0: entered promiscuous mode [ 580.299981][T27878] 8021q: adding VLAN 0 to HW filter on device macsec1 [ 580.312738][T27878] 8021q: adding VLAN 0 to HW filter on device bond2 [ 580.323956][T27878] erspan0: entered promiscuous mode [ 580.372903][T27878] 8021q: adding VLAN 0 to HW filter on device eth0 [ 580.383135][T27878] 8021q: adding VLAN 0 to HW filter on device eth1 [ 580.395979][T27878] 8021q: adding VLAN 0 to HW filter on device eth2 [ 580.407800][T27878] 8021q: adding VLAN 0 to HW filter on device eth3 [ 580.419603][T27878] 8021q: adding VLAN 0 to HW filter on device bond3 [ 580.444456][T27878] 8021q: adding VLAN 0 to HW filter on device bond4 [ 580.454622][T27878] 8021q: adding VLAN 0 to HW filter on device bond5 [ 580.467056][T27878] 8021q: adding VLAN 0 to HW filter on device bond6 [ 580.481492][T27878] 8021q: adding VLAN 0 to HW filter on device bond7 [ 580.499305][T27878] 8021q: adding VLAN 0 to HW filter on device bond8 [ 580.528361][ T5742] gretap2: entered promiscuous mode [ 580.556193][ T3379] bridge0: port 1(bridge_slave_0) entered blocking state [ 580.563493][ T3379] bridge0: port 1(bridge_slave_0) entered listening state [ 580.574816][ T3379] bridge0: port 2(bridge_slave_1) entered blocking state [ 580.582123][ T3379] bridge0: port 2(bridge_slave_1) entered listening state [ 580.776910][ T13] netdevsim netdevsim1 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 580.798335][ T13] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 580.817710][ T13] netdevsim netdevsim1 eth0: set [1, 1] type 2 family 0 port 60208 - 0 [ 580.849563][T27909] bridge0: port 2(bridge_slave_1) entered blocking state [ 580.856877][T27909] bridge0: port 2(bridge_slave_1) entered forwarding state [ 580.864603][T27909] bridge0: port 1(bridge_slave_0) entered blocking state [ 580.871812][T27909] bridge0: port 1(bridge_slave_0) entered forwarding state [ 580.940677][ T13] netdevsim netdevsim1 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 580.977016][ T13] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 581.022440][ T13] netdevsim netdevsim1 eth1: set [1, 1] type 2 family 0 port 60208 - 0 [ 581.060190][ T13] netdevsim netdevsim1 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 581.106385][ T13] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 581.151931][ T13] netdevsim netdevsim1 eth2: set [1, 1] type 2 family 0 port 60208 - 0 [ 581.212705][ T13] netdevsim netdevsim1 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 581.230265][ T13] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 581.241098][ T13] netdevsim netdevsim1 eth3: set [1, 1] type 2 family 0 port 60208 - 0 [ 581.280665][T27929] netlink: 'syz.0.9794': attribute type 13 has an invalid length. [ 581.496977][T27927] syzkaller0: entered promiscuous mode [ 581.509998][T27927] syzkaller0: entered allmulticast mode [ 581.563446][T27940] netlink: 'syz.3.9800': attribute type 1 has an invalid length. [ 581.618376][T26717] bond8: (slave veth0_to_bond): link status definitely up, 10000 Mbps full duplex [ 581.647996][T26717] bond8: (slave veth0_to_bond): making interface the new active one [ 581.668093][T26717] veth0_to_bond: entered promiscuous mode [ 581.675161][T26717] veth0_to_bond: entered allmulticast mode [ 581.695323][T26717] bond8: active interface up! [ 581.902130][T27942] bond10: (slave vxcan5): The slave device specified does not support setting the MAC address [ 581.913023][T27950] netlink: 'syz.1.9803': attribute type 1 has an invalid length. [ 581.922100][T27942] bond10: (slave vxcan5): Error -95 calling set_mac_address [ 582.006663][T27946] bond10: (slave bridge9): Enslaving as an active interface with a down link [ 582.026453][T27952] netlink: 20 bytes leftover after parsing attributes in process `syz.1.9803'. [ 582.092838][T27948] bond10: (slave gretap2): making interface the new active one [ 582.135675][T27957] netlink: 28 bytes leftover after parsing attributes in process `syz.1.9803'. [ 582.167524][T27948] bond10: (slave gretap2): Enslaving as an active interface with an up link [ 582.399205][T27952] bond10: (slave bridge7): making interface the new active one [ 582.415059][T27952] bond10: (slave bridge7): Enslaving as an active interface with an up link [ 582.435134][T27957] 8021q: adding VLAN 0 to HW filter on device bond10 [ 582.498091][T27971] netlink: 76 bytes leftover after parsing attributes in process `syz.2.9809'. [ 582.555609][T27968] syzkaller0: entered promiscuous mode [ 582.584867][T27968] syzkaller0: entered allmulticast mode [ 582.610397][T27966] mac80211_hwsim hwsim8 syzkaller0: entered promiscuous mode [ 582.622892][T27966] mac80211_hwsim hwsim8 syzkaller0: entered allmulticast mode [ 582.643788][T27968] TC_ACT_REPEAT abuse ? [ 582.794667][ T13] wlan1: Trigger new scan to find an IBSS to join [ 582.921803][T27985] syzkaller0: entered promiscuous mode [ 582.942895][T27985] syzkaller0: entered allmulticast mode [ 583.044124][T27989] netlink: 'syz.1.9818': attribute type 1 has an invalid length. [ 583.052639][T27986] syzkaller0: entered promiscuous mode [ 583.058708][T27986] syzkaller0: entered allmulticast mode [ 583.135895][T27989] bond11: entered promiscuous mode [ 583.141798][T27989] 8021q: adding VLAN 0 to HW filter on device bond11 [ 583.218366][T27985] tipc: Enabled bearer , priority 0 [ 583.255463][T28000] macvtap1: entered allmulticast mode [ 583.355453][T27989] macvtap2: entered allmulticast mode [ 583.408766][T27984] tipc: Resetting bearer [ 583.483751][ T30] audit: type=1804 audit(1779894817.199:8): pid=28007 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.3.9820" name="/newroot/1940/cgroup.controllers" dev="tmpfs" ino=9788 res=1 errno=0 [ 583.551553][ T30] audit: type=1800 audit(1779894817.199:9): pid=28007 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.9820" name="cgroup.controllers" dev="tmpfs" ino=9788 res=0 errno=0 [ 583.565099][T27984] tipc: Disabling bearer [ 583.671245][T28005] bond11: (slave bridge8): making interface the new active one [ 583.687262][T28005] bridge8: entered promiscuous mode [ 583.701264][T28005] bond11: (slave bridge8): Enslaving as an active interface with an up link [ 583.735668][ T3379] netdevsim netdevsim4 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 583.759215][ T3379] netdevsim netdevsim4 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 584.191706][T28015] bond17: entered allmulticast mode [ 584.345828][T28019] veth11: entered allmulticast mode [ 584.399556][T28019] bond17: (slave veth11): Enslaving as an active interface with an up link [ 584.492964][T28022] bond17 (unregistering): (slave veth11): Releasing backup interface [ 584.546454][T28022] bond17 (unregistering): Released all slaves [ 584.931185][T28046] netlink: 'syz.4.9834': attribute type 1 has an invalid length. [ 585.008634][T28046] veth13: entered promiscuous mode [ 585.017976][T28046] bond17: (slave veth13): Enslaving as a backup interface with a down link [ 585.063109][T28046] netlink: 28 bytes leftover after parsing attributes in process `syz.4.9834'. [ 585.765342][ T13] wlan1: Trigger new scan to find an IBSS to join [ 587.694312][T28046] 8021q: adding VLAN 0 to HW filter on device bond17 [ 587.861706][T28063] syzkaller0: entered promiscuous mode [ 587.869366][T28063] syzkaller0: entered allmulticast mode [ 587.882077][T28063] tc action pedit offset must be on 32 bit boundaries [ 588.202874][T28078] 0: reclassify loop, rule prio 0, protocol 700 [ 588.379440][T28083] syzkaller0: entered promiscuous mode [ 588.398028][T28083] syzkaller0: entered allmulticast mode [ 588.511925][T28088] syzkaller0: entered promiscuous mode [ 588.524976][T28088] syzkaller0: entered allmulticast mode [ 588.715084][ T3379] wlan1: Trigger new scan to find an IBSS to join [ 588.930170][T28100] syzkaller0: entered promiscuous mode [ 588.955998][T28100] syzkaller0: entered allmulticast mode [ 588.982863][T28105] netlink: 56 bytes leftover after parsing attributes in process `syz.0.9854'. [ 589.075481][T28100] tipc: Enabled bearer , priority 0 [ 589.101839][T28099] tipc: Resetting bearer [ 589.172305][T28099] tipc: Disabling bearer [ 589.480536][T28119] netlink: 216 bytes leftover after parsing attributes in process `syz.3.9859'. [ 589.525145][T28119] netlink: 'syz.3.9859': attribute type 2 has an invalid length. [ 589.635867][T26717] wlan1: Creating new IBSS network, BSSID 4e:9d:13:7b:49:f4 [ 589.789897][T28125] syzkaller0: entered promiscuous mode [ 589.817795][T28125] syzkaller0: entered allmulticast mode [ 590.090526][T28134] syzkaller0: entered promiscuous mode [ 590.096463][T28134] syzkaller0: entered allmulticast mode [ 590.231106][T28136] 8021q: adding VLAN 0 to HW filter on device bond12 [ 590.376726][T28136] bond8: (slave veth0_to_bond): Releasing active interface [ 590.400351][T28136] veth0_to_bond: left promiscuous mode [ 590.433035][T28136] veth0_to_bond: left allmulticast mode [ 590.512788][T28136] bond12: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 590.654770][T28157] netlink: 12 bytes leftover after parsing attributes in process `syz.2.9872'. [ 590.762130][T28150] syzkaller0: entered promiscuous mode [ 590.786048][T28150] syzkaller0: entered allmulticast mode [ 594.502907][T28153] syzkaller0: entered promiscuous mode [ 594.508890][T28153] syzkaller0: entered allmulticast mode [ 594.531993][T28179] netlink: 76 bytes leftover after parsing attributes in process `syz.1.9874'. [ 596.085181][ C1] bridge0: port 2(bridge_slave_1) entered learning state [ 596.092559][ C1] bridge0: port 1(bridge_slave_0) entered learning state [ 598.420764][T28230] netlink: 8 bytes leftover after parsing attributes in process `syz.1.9882'. [ 598.508946][T28230] syzkaller0: entered promiscuous mode [ 598.524373][T28230] syzkaller0: entered allmulticast mode [ 598.547428][T28235] mac80211_hwsim hwsim8 syzkaller0: left promiscuous mode [ 598.574171][T28235] mac80211_hwsim hwsim8 syzkaller0: left allmulticast mode [ 598.738576][T28249] netlink: 120 bytes leftover after parsing attributes in process `syz.0.9887'. [ 598.776930][T28249] netlink: 'syz.0.9887': attribute type 1 has an invalid length. [ 598.802736][T28249] netlink: 64 bytes leftover after parsing attributes in process `syz.0.9887'. [ 599.694009][T28263] syzkaller0: entered promiscuous mode [ 599.713492][T28263] syzkaller0: entered allmulticast mode [ 599.748732][T28268] tc action pedit offset must be on 32 bit boundaries [ 600.041607][T28242] »»»»»» speed is unknown, defaulting to 1000 [ 600.157219][T28266] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 600.449413][T28283] veth1_macvtap: renamed from vlan0 [ 600.659649][T28301] netlink: 'syz.4.9898': attribute type 1 has an invalid length. [ 601.023675][T28301] netlink: 28 bytes leftover after parsing attributes in process `syz.4.9898'. [ 601.123014][T28309] veth15: entered promiscuous mode [ 601.178307][T28309] bond18: (slave veth15): Enslaving as a backup interface with a down link [ 601.458834][T28297] syzkaller0: entered promiscuous mode [ 601.476002][T28297] syzkaller0: entered allmulticast mode [ 601.492478][T28301] 8021q: adding VLAN 0 to HW filter on device bond18 [ 601.519453][T28325] mac80211_hwsim hwsim8 syzkaller0: entered promiscuous mode [ 601.562700][T28325] mac80211_hwsim hwsim8 syzkaller0: entered allmulticast mode [ 603.772920][ C0] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 606.937556][T28335] syzkaller0: entered promiscuous mode [ 606.947536][T28335] syzkaller0: entered allmulticast mode [ 607.351944][T28366] syzkaller0: entered promiscuous mode [ 607.379967][T28366] syzkaller0: entered allmulticast mode [ 608.168280][T28381] sctp: [Deprecated]: syz.3.9910 (pid 28381) Use of int in maxseg socket option. [ 608.168280][T28381] Use struct sctp_assoc_value instead [ 608.773048][T28407] syzkaller0: entered promiscuous mode [ 608.802131][T28407] syzkaller0: entered allmulticast mode [ 609.005701][T28407] tipc: Enabled bearer , priority 0 [ 609.020085][T28415] tipc: Enabled bearer , priority 0 [ 609.057080][T28406] tipc: Resetting bearer [ 609.115033][T28406] tipc: Disabling bearer [ 609.150799][T28415] syzkaller0: entered promiscuous mode [ 609.168755][T28415] syzkaller0: entered allmulticast mode [ 609.211826][T28417] mac80211_hwsim hwsim2 wlan0: entered promiscuous mode [ 609.401361][T28415] tipc: Resetting bearer [ 609.568312][T28414] tipc: Resetting bearer [ 609.650629][T28414] tipc: Disabling bearer [ 609.951525][T28457] netlink: 4 bytes leftover after parsing attributes in process `syz.4.9934'. [ 610.054867][T28460] Unknown metaid 0 dlen 28 [ 610.577853][T28483] netlink: 16 bytes leftover after parsing attributes in process `syz.1.9946'. [ 611.434084][ C1] bridge0: port 1(bridge_slave_0) entered forwarding state [ 611.444037][ C1] bridge0: topology change detected, propagating [ 611.450705][ C1] bridge0: port 2(bridge_slave_1) entered forwarding state [ 611.458007][ C1] bridge0: topology change detected, propagating [ 612.597044][T28440] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 613.069342][ T3314] bond0: (slave bond_slave_0): interface is now down [ 613.149979][T28510] syzkaller0: entered promiscuous mode [ 613.164988][T28510] syzkaller0: entered allmulticast mode [ 613.353059][T28520] netlink: 4 bytes leftover after parsing attributes in process `syz.0.9961'. [ 613.414265][T28523] netlink: 'syz.0.9961': attribute type 3 has an invalid length. [ 613.459623][T28524] nbd: couldn't find a device at index 2 [ 613.707132][T28532] netlink: 277 bytes leftover after parsing attributes in process `syz.0.9966'. [ 614.525637][T28571] mac80211_hwsim hwsim8 syzkaller0: left promiscuous mode [ 614.547350][T28571] mac80211_hwsim hwsim8 syzkaller0: left allmulticast mode [ 614.855490][T28583] netlink: 312 bytes leftover after parsing attributes in process `syz.1.9984'. [ 615.166907][T28598] netlink: 'syz.2.9990': attribute type 1 has an invalid length. [ 615.235494][T28598] netlink: 20 bytes leftover after parsing attributes in process `syz.2.9990'. [ 615.263956][T28598] netlink: 28 bytes leftover after parsing attributes in process `syz.2.9990'. [ 615.276488][T28598] 8021q: adding VLAN 0 to HW filter on device bond6 [ 615.675753][ T3314] bond0: (slave bond_slave_0): interface is now down [ 615.889383][ T3314] bond0: now running without any active interface! [ 616.019841][T28636] netlink: 'syz.1.10004': attribute type 8 has an invalid length. [ 616.030715][T28636] sch_fq: defrate 0 ignored. [ 616.204071][T28643] netlink: 'syz.4.10005': attribute type 1 has an invalid length. [ 616.287719][T28648] netlink: 20 bytes leftover after parsing attributes in process `syz.4.10005'. [ 616.364160][T28651] netlink: 28 bytes leftover after parsing attributes in process `syz.4.10005'. [ 616.466946][T28651] 8021q: adding VLAN 0 to HW filter on device bond19 [ 616.730332][T28666] netem: change failed [ 617.820565][T28719] netlink: 76 bytes leftover after parsing attributes in process `syz.3.10035'. [ 618.631087][T28755] 8021q: adding VLAN 0 to HW filter on device macsec1 [ 618.662365][T26475] netdevsim netdevsim4 netdevsim0: entered promiscuous mode [ 619.217946][T28783] netlink: 32 bytes leftover after parsing attributes in process `syz.1.10061'. [ 619.471773][T28796] bridge0: port 2(bridge_slave_1) entered blocking state [ 619.479192][T28796] bridge0: port 2(bridge_slave_1) entered forwarding state [ 619.490526][T28796] bridge0: port 1(bridge_slave_0) entered blocking state [ 619.497923][T28796] bridge0: port 1(bridge_slave_0) entered forwarding state [ 620.098957][T28821] netlink: 'syz.4.10075': attribute type 12 has an invalid length. [ 620.125811][T28821] netlink: 'syz.4.10075': attribute type 29 has an invalid length. [ 620.158879][T28821] netlink: 148 bytes leftover after parsing attributes in process `syz.4.10075'. [ 620.201368][T28821] netlink: 'syz.4.10075': attribute type 1 has an invalid length. [ 620.238685][T28821] netlink: 'syz.4.10075': attribute type 2 has an invalid length. [ 620.276628][T28821] netlink: 11 bytes leftover after parsing attributes in process `syz.4.10075'. [ 620.731747][T28845] netlink: 40 bytes leftover after parsing attributes in process `syz.2.10080'. [ 621.009775][T28860] mac80211_hwsim hwsim8 syzkaller0: entered promiscuous mode [ 621.039206][T28860] mac80211_hwsim hwsim8 syzkaller0: entered allmulticast mode [ 621.417450][T28879] syzkaller1: entered promiscuous mode [ 621.450066][T28879] syzkaller1: entered allmulticast mode [ 621.858491][T28894] netlink: 72 bytes leftover after parsing attributes in process `syz.4.10097'. [ 621.904268][T28900] bridge0: vlan filtering disabled, automatically disabling multicast vlan snooping [ 621.916993][T28899] netlink: 8 bytes leftover after parsing attributes in process `syz.2.10098'. [ 622.183618][T28913] netlink: 8 bytes leftover after parsing attributes in process `syz.0.10104'. [ 622.224610][T28913] tunl0: Caught tx_queue_len zero misconfig [ 622.314485][ T68] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 622.335728][T28908] syzkaller0: entered promiscuous mode [ 622.358504][T28908] syzkaller0: entered allmulticast mode [ 622.530287][T28925] netlink: 65011 bytes leftover after parsing attributes in process `syz.0.10104'. [ 623.042926][T28950] netlink: 32 bytes leftover after parsing attributes in process `syz.3.10112'. [ 623.471089][T28969] xt_hashlimit: max too large, truncated to 1048576 [ 623.646510][T28973] syzkaller0: entered promiscuous mode [ 623.682119][T28973] syzkaller0: entered allmulticast mode [ 623.942494][T28986] macvtap0: entered promiscuous mode [ 623.998144][T28986] macvtap0: entered allmulticast mode [ 624.010341][T28986] veth1_vlan: entered allmulticast mode [ 624.115501][T28989] macvtap1: entered promiscuous mode [ 624.155293][T28989] macvtap1: entered allmulticast mode [ 624.239955][ T1317] ieee802154 phy0 wpan0: encryption failed: -22 [ 624.248179][ T1317] aoe: packet could not be sent on ipvlan1. consider increasing tx_queue_len [ 624.818695][T29024] xt_hashlimit: size too large, truncated to 1048576 [ 625.058194][T29032] syzkaller0: entered promiscuous mode [ 625.073124][T29032] syzkaller0: entered allmulticast mode [ 625.322087][T29038] PF_CAN: dropped non conform CAN XL skbuff: dev type 65534, len 40 [ 625.644329][T29055] lo: Caught tx_queue_len zero misconfig [ 625.704498][T29058] blkio.reset_stats is deprecated [ 627.050543][T29116] No such timeout policy "syz1" [ 627.627348][T29142] netlink: 68 bytes leftover after parsing attributes in process `syz.3.10181'. [ 627.891436][T29151] syzkaller1: entered promiscuous mode [ 627.908149][T29151] syzkaller1: entered allmulticast mode [ 628.165355][T29162] syzkaller0: entered promiscuous mode [ 628.171527][T29162] syzkaller0: entered allmulticast mode [ 633.491216][T29209] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 633.771526][T29222] mac80211_hwsim hwsim8 syzkaller0: left promiscuous mode [ 633.806715][T29222] mac80211_hwsim hwsim8 syzkaller0: left allmulticast mode [ 633.938524][T29229] xt_hashlimit: size too large, truncated to 1048576 [ 633.950930][T29222] netlink: 76 bytes leftover after parsing attributes in process `syz.2.10207'. [ 634.044568][T29231] syzkaller1: entered promiscuous mode [ 634.067812][T29231] syzkaller1: entered allmulticast mode [ 634.302766][T29244] xt_hashlimit: size too large, truncated to 1048576 [ 634.484769][T29252] netlink: 'syz.1.10221': attribute type 14 has an invalid length. [ 634.510672][T29252] netlink: 4 bytes leftover after parsing attributes in process `syz.1.10221'. [ 634.511230][T29250] syzkaller0: entered promiscuous mode [ 634.553491][T29250] syzkaller0: entered allmulticast mode [ 634.588459][T29252] netlink: 'syz.1.10221': attribute type 14 has an invalid length. [ 634.603794][T29252] netlink: 4 bytes leftover after parsing attributes in process `syz.1.10221'. [ 635.279239][T29278] netlink: 36 bytes leftover after parsing attributes in process `syz.3.10227'. [ 635.310261][T29268] tipc: Resetting bearer [ 635.447495][T29268] veth1_vlan (unregistering): left allmulticast mode [ 636.151284][T29268] tipc: Disabling bearer [ 637.023059][T29326] mac80211_hwsim hwsim8 syzkaller0: entered promiscuous mode [ 637.052877][T29326] mac80211_hwsim hwsim8 syzkaller0: entered allmulticast mode [ 637.079328][T29330] syzkaller1: entered promiscuous mode [ 637.095475][T29330] syzkaller1: entered allmulticast mode [ 637.965173][T29366] netlink: 20 bytes leftover after parsing attributes in process `syz.1.10252'. [ 638.179860][T29374] syzkaller0: entered promiscuous mode [ 638.204689][T29374] syzkaller0: entered allmulticast mode [ 639.454948][T29422] syzkaller0: entered promiscuous mode [ 639.475843][T29422] syzkaller0: entered allmulticast mode [ 640.869824][T29471] netlink: 'syz.4.10284': attribute type 5 has an invalid length. [ 641.142520][T29483] syzkaller1: entered promiscuous mode [ 641.149748][T29483] syzkaller1: entered allmulticast mode [ 643.423753][T29453] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 644.517755][T29582] netlink: 'syz.1.10315': attribute type 2 has an invalid length. [ 644.542147][T29582] netlink: 'syz.1.10315': attribute type 2 has an invalid length. [ 645.013889][T29600] netlink: 92 bytes leftover after parsing attributes in process `syz.2.10321'. [ 645.902852][T29635] xt_hashlimit: size too large, truncated to 1048576 [ 648.006852][T29602] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 648.441559][T29694] netlink: 'syz.4.10353': attribute type 2 has an invalid length. [ 648.451119][T29694] netlink: 'syz.4.10353': attribute type 2 has an invalid length. [ 650.487144][T29741] netlink: 20 bytes leftover after parsing attributes in process `syz.4.10369'. [ 650.548701][T29743] netlink: 24 bytes leftover after parsing attributes in process `syz.3.10370'. [ 651.001720][T29764] netlink: 72 bytes leftover after parsing attributes in process `syz.0.10376'. [ 651.266908][T29773] netlink: 'syz.0.10379': attribute type 1 has an invalid length. [ 651.365941][T29777] netlink: 20 bytes leftover after parsing attributes in process `syz.0.10379'. [ 651.459439][T29780] netlink: 28 bytes leftover after parsing attributes in process `syz.0.10379'. [ 651.804965][T29790] netlink: 180 bytes leftover after parsing attributes in process `syz.1.10382'. [ 652.478143][T29803] syzkaller0: entered promiscuous mode [ 652.510337][T29803] syzkaller0: entered allmulticast mode [ 652.699090][T29817] netlink: 72 bytes leftover after parsing attributes in process `syz.3.10389'. [ 654.319523][ T48] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 655.337427][T29807] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 657.211296][T29819] ve: renamed from ip6_vti0 (while UP) [ 657.380954][T29825] netlink: 'syz.3.10394': attribute type 1 has an invalid length. [ 657.461687][T29835] netlink: 20 bytes leftover after parsing attributes in process `syz.3.10394'. [ 657.547839][T29825] netlink: 28 bytes leftover after parsing attributes in process `syz.3.10394'. [ 657.596484][T29837] netlink: 8 bytes leftover after parsing attributes in process `syz.2.10398'. [ 658.549223][T29871] netlink: 76 bytes leftover after parsing attributes in process `syz.1.10405'. [ 658.752647][T29879] netlink: 156 bytes leftover after parsing attributes in process `syz.0.10408'. [ 658.791374][T29873] syzkaller0: entered promiscuous mode [ 658.798408][T29873] syzkaller0: entered allmulticast mode [ 658.806227][T29881] netlink: 12 bytes leftover after parsing attributes in process `syz.0.10408'. [ 659.096157][T29889] netlink: 64 bytes leftover after parsing attributes in process `syz.4.10411'. [ 659.595858][ T29] page_pool_release_retry() stalled pool shutdown: id 164, 1 inflight 60 sec [ 659.763818][ T48] wlan1: Trigger new scan to find an IBSS to join [ 662.795422][T14587] wlan1: Trigger new scan to find an IBSS to join [ 663.408279][T29899] netlink: 4 bytes leftover after parsing attributes in process `syz.1.10412'. [ 663.417909][T29899] netlink: 4 bytes leftover after parsing attributes in process `syz.1.10412'. [ 664.016214][T29921] xt_connbytes: Forcing CT accounting to be enabled [ 664.092365][T29932] netlink: 76 bytes leftover after parsing attributes in process `syz.3.10422'. [ 664.152740][T29935] xt_CT: You must specify a L4 protocol and not use inversions on it [ 664.330228][T29943] netlink: 'syz.1.10424': attribute type 1 has an invalid length. [ 664.368892][T29943] netlink: 224 bytes leftover after parsing attributes in process `syz.1.10424'. [ 665.759652][T14586] wlan1: Creating new IBSS network, BSSID ce:97:da:35:8c:55 [ 666.598969][T29984] syzkaller1: entered promiscuous mode [ 666.620314][T29984] syzkaller1: entered allmulticast mode [ 666.651158][T29985] netlink: 12 bytes leftover after parsing attributes in process `syz.1.10438'. [ 667.154612][T30001] netlink: 8 bytes leftover after parsing attributes in process `syz.1.10444'. [ 667.275829][T30004] tipc: Enabled bearer , priority 0 [ 667.478089][T30004] syzkaller0: entered promiscuous mode [ 667.494914][T30004] syzkaller0: entered allmulticast mode [ 667.515695][T30004] tipc: Resetting bearer [ 667.782071][T30003] tipc: Resetting bearer [ 668.012788][T30019] netlink: 'syz.3.10449': attribute type 1 has an invalid length. [ 668.805914][T30032] netlink: 'syz.2.10452': attribute type 21 has an invalid length. [ 672.736928][T30003] tipc: Disabling bearer [ 672.764072][T30019] workqueue: Failed to create a rescuer kthread for wq "bond12": -EINTR [ 672.943011][T30032] netlink: 'syz.2.10452': attribute type 6 has an invalid length. [ 672.990611][T30032] netlink: 132 bytes leftover after parsing attributes in process `syz.2.10452'. [ 673.001363][T30042] netlink: 12 bytes leftover after parsing attributes in process `syz.1.10453'. [ 673.074432][T30040] syzkaller0: entered promiscuous mode [ 673.080627][T30040] syzkaller0: entered allmulticast mode [ 674.337183][T30077] tipc: Enabled bearer , priority 0 [ 674.344668][T30034] »»»»»» speed is unknown, defaulting to 1000 [ 674.416724][T30079] syzkaller0: entered promiscuous mode [ 674.422395][T30079] syzkaller0: entered allmulticast mode [ 674.432492][T30079] tipc: Resetting bearer [ 674.461777][T30070] tipc: Resetting bearer [ 674.474101][T30087] netlink: 'syz.3.10465': attribute type 1 has an invalid length. [ 675.842857][ T5647] Bluetooth: hci0: Opcode 0x0c03 failed: -110 [ 679.302583][T30070] tipc: Disabling bearer [ 679.319990][T30087] workqueue: Failed to create a rescuer kthread for wq "bond12": -EINTR [ 679.322363][T30090] workqueue: Failed to create a rescuer kthread for wq "bond12": -EINTR [ 679.371994][T30107] bond5: entered allmulticast mode [ 679.385813][T30107] vcan1: entered allmulticast mode [ 679.398786][T30110] bond0: entered promiscuous mode [ 679.406924][T30110] bond_slave_0: entered promiscuous mode [ 679.413031][T30110] bond_slave_1: entered promiscuous mode [ 679.750697][T30120] syzkaller0: entered promiscuous mode [ 679.788184][T30120] syzkaller0: entered allmulticast mode [ 680.371852][T30141] netlink: 76 bytes leftover after parsing attributes in process `syz.0.10477'. [ 680.416136][T30132] syzkaller0: entered promiscuous mode [ 680.423319][T30132] syzkaller0: entered allmulticast mode [ 680.540978][T30142] syzkaller0: entered promiscuous mode [ 680.565589][T30142] syzkaller0: entered allmulticast mode [ 681.068140][ T48] syzkaller0: tun_net_xmit 76 [ 681.077364][T30158] syzkaller0: create flow: hash 1707423786 index 1 [ 681.090627][ T48] syzkaller0: tun_net_xmit 48 [ 681.103868][ T24] syzkaller0: tun_net_xmit 76 [ 681.164656][ T24] syzkaller0: tun_net_xmit 76 [ 681.258749][T30160] syzkaller0: delete flow: hash 1707423786 index 1 [ 685.612739][T30169] syzkaller0: entered promiscuous mode [ 685.633462][T30169] syzkaller0: entered allmulticast mode [ 685.962356][T30197] netlink: 12 bytes leftover after parsing attributes in process `syz.0.10490'. [ 685.985693][T30198] syzkaller0: entered promiscuous mode [ 686.007612][T30198] syzkaller0: entered allmulticast mode [ 686.159401][T30207] bond8: entered promiscuous mode [ 686.173071][T30207] bond8: entered allmulticast mode [ 686.314530][ T68] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 686.420050][T30219] syzkaller0: entered promiscuous mode [ 686.433911][T30219] syzkaller0: entered allmulticast mode [ 686.684011][T30221] syzkaller0: entered promiscuous mode [ 686.699128][T30221] syzkaller0: entered allmulticast mode [ 686.736533][T30222] 0: reclassify loop, rule prio 0, protocol 800 [ 686.877219][T30224] syzkaller0: entered promiscuous mode [ 686.883069][T30224] syzkaller0: entered allmulticast mode [ 687.327807][T30232] bridge0: port 2(bridge_slave_1) entered disabled state [ 687.535358][T30240] syzkaller0: entered promiscuous mode [ 687.548203][T30240] syzkaller0: entered allmulticast mode [ 687.768471][T30230] netlink: 'syz.3.10500': attribute type 16 has an invalid length. [ 687.781331][T30230] netlink: 'syz.3.10500': attribute type 17 has an invalid length. [ 687.869584][T30230] A link change request failed with some changes committed already. Interface teql0 may have been left with an inconsistent configuration, please check. [ 687.979867][T30248] mac80211_hwsim hwsim8 syzkaller0: left promiscuous mode [ 688.021390][T30248] mac80211_hwsim hwsim8 syzkaller0: left allmulticast mode [ 688.271194][T30261] bridge_slave_0: left allmulticast mode [ 688.287174][T30261] bridge0: port 1(bridge_slave_0) entered disabled state [ 688.308349][T30261] bridge_slave_1: left allmulticast mode [ 688.314445][T30261] bridge_slave_1: left promiscuous mode [ 688.320344][T30261] bridge0: port 2(bridge_slave_1) entered disabled state [ 688.335712][T30261] bond0: (slave bond_slave_0): Releasing backup interface [ 688.375042][T30261] team0: Port device team_slave_0 removed [ 688.406552][T30261] team0: Port device team_slave_1 removed [ 688.439746][T30261] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 688.469308][T30261] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 688.505220][T30261] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 688.527493][T30261] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 688.561652][T30261] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 688.605458][ T9] »»»»»» speed is unknown, defaulting to 1000 [ 688.622978][T30265] ip6gre2: entered allmulticast mode [ 688.658911][T30265] team0: Port device ip6gre2 added [ 688.701066][T30272] syzkaller0: entered promiscuous mode [ 688.721172][T30272] syzkaller0: entered allmulticast mode [ 689.022569][T30275] syzkaller0: entered promiscuous mode [ 689.041160][T30275] syzkaller0: entered allmulticast mode [ 689.344552][T30291] netlink: 4 bytes leftover after parsing attributes in process `syz.1.10510'. [ 689.838440][ C0] vxcan0: j1939_tp_rxtimer: 0xffff888082e4ec00: rx timeout, send abort [ 690.354254][ C0] vxcan0: j1939_tp_rxtimer: 0xffff888082e4ec00: abort rx timeout. Force session deactivation [ 693.819737][T30291] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 693.944673][T30291] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 694.562910][T30324] syzkaller0: entered promiscuous mode [ 694.586776][T30324] syzkaller0: entered allmulticast mode [ 695.307353][T30345] tc action pedit offset must be on 32 bit boundaries [ 695.678134][T30362] netlink: 76 bytes leftover after parsing attributes in process `syz.2.10531'. [ 695.870943][T30372] netlink: 'syz.4.10533': attribute type 12 has an invalid length. [ 695.916604][T30372] netlink: 'syz.4.10533': attribute type 29 has an invalid length. [ 695.949624][T30372] netlink: 148 bytes leftover after parsing attributes in process `syz.4.10533'. [ 695.999478][T30359] syzkaller0: entered promiscuous mode [ 696.041994][T30359] syzkaller0: entered allmulticast mode [ 697.077470][T30415] syzkaller0: entered promiscuous mode [ 697.111536][T30415] syzkaller0: entered allmulticast mode [ 697.835713][ T77] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 697.891468][T30445] netlink: 76 bytes leftover after parsing attributes in process `syz.3.10551'. [ 698.670368][T30477] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 699.467302][T30498] syzkaller0: entered promiscuous mode [ 699.473209][T30498] syzkaller0: entered allmulticast mode [ 699.650234][T30514] netlink: 8 bytes leftover after parsing attributes in process `syz.3.10575'. [ 704.758004][T30518] L: renamed from dummy0 (while UP) [ 706.019363][T30583] syzkaller0: entered promiscuous mode [ 706.050182][T30583] syzkaller0: entered allmulticast mode [ 706.282628][T30599] netlink: 12 bytes leftover after parsing attributes in process `syz.4.10597'. [ 706.313390][T30599] netlink: 4 bytes leftover after parsing attributes in process `syz.4.10597'. [ 710.828503][T30601] netlink: 8 bytes leftover after parsing attributes in process `syz.1.10598'. [ 710.834408][T30599] netlink: 12 bytes leftover after parsing attributes in process `syz.4.10597'. [ 710.847844][T30599] netlink: 4 bytes leftover after parsing attributes in process `syz.4.10597'. [ 713.166031][T30672] syzkaller0: entered promiscuous mode [ 713.171857][T30672] syzkaller0: entered allmulticast mode [ 714.599084][T30645] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 714.620057][T30652] netlink: 12 bytes leftover after parsing attributes in process `syz.4.10614'. [ 718.316688][ T3314] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 718.415438][T30704] netlink: 8 bytes leftover after parsing attributes in process `syz.2.10633'. [ 718.451767][T30704] netlink: 8 bytes leftover after parsing attributes in process `syz.2.10633'. [ 718.536834][T30703] batman_adv: batadv0: Adding interface: dummy0 [ 718.560080][T30703] batman_adv: batadv0: The MTU of interface dummy0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 718.594254][T30703] batman_adv: batadv0: Interface activated: dummy0 [ 718.622155][T30709] geneve2: entered promiscuous mode [ 718.649770][T30711] netlink: 4 bytes leftover after parsing attributes in process `syz.0.10637'. [ 718.652716][T30703] batadv0: mtu less than device minimum [ 718.661820][T30711] netlink: 4 bytes leftover after parsing attributes in process `syz.0.10637'. [ 718.680744][T30703] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 718.696357][T30703] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 718.708275][T30703] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 718.720291][T30703] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 718.732245][T30703] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 718.746545][T30703] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 718.758680][T30703] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 718.770701][T30703] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 718.782611][T30703] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 719.921063][ T29] page_pool_release_retry() stalled pool shutdown: id 164, 1 inflight 120 sec [ 724.150725][T30731] tipc: Enabling of bearer rejected, failed to enable media [ 726.529777][T30812] syzkaller0: entered promiscuous mode [ 726.564410][T30812] syzkaller0: entered allmulticast mode [ 727.026559][T30827] syzkaller0: entered promiscuous mode [ 727.032518][T30827] syzkaller0: entered allmulticast mode [ 728.803027][T30787] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 729.195528][T14587] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 733.189597][T30879] bridge0: port 1(bridge_slave_0) entered disabled state [ 733.246304][T30879] bond0: left promiscuous mode [ 733.251634][T30879] bond_slave_0: left promiscuous mode [ 733.259142][T30879] bond_slave_1: left promiscuous mode [ 733.275695][T30879] batman_adv: batadv0: Interface deactivated: dummy0 [ 733.308736][T30879] tipc: Resetting bearer [ 733.510456][T30879] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 733.731020][T30879] tipc: Resetting bearer [ 734.086671][T30879] bond8: left promiscuous mode [ 734.091711][T30879] bond8: left allmulticast mode [ 734.102728][T30879] gretap2: left promiscuous mode [ 734.123656][T30879] bond11: left promiscuous mode [ 734.128691][T30879] bridge8: left promiscuous mode [ 734.138070][T30879] macvtap1: left allmulticast mode [ 734.144395][T30879] macvtap2: left allmulticast mode [ 734.186199][T30884] bridge0: port 2(bridge_slave_1) entered disabled state [ 734.205026][T30892] mac80211_hwsim hwsim8 syzkaller0: entered promiscuous mode [ 734.217025][T30892] mac80211_hwsim hwsim8 syzkaller0: entered allmulticast mode [ 734.254878][T26718] netdevsim netdevsim1 eth0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 734.282852][T26718] netdevsim netdevsim1 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 734.327626][T26718] netdevsim netdevsim1 eth0: unset [1, 1] type 2 family 0 port 60208 - 0 [ 734.365986][T26718] netdevsim netdevsim1 eth1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 734.406128][T26718] netdevsim netdevsim1 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 734.438210][T26718] netdevsim netdevsim1 eth1: unset [1, 1] type 2 family 0 port 60208 - 0 [ 734.539500][T26718] netdevsim netdevsim1 eth2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 734.578295][T26718] netdevsim netdevsim1 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 734.613270][T26718] netdevsim netdevsim1 eth2: unset [1, 1] type 2 family 0 port 60208 - 0 [ 734.842531][T30907] syzkaller0: entered promiscuous mode [ 734.853781][T30907] syzkaller0: entered allmulticast mode [ 734.861351][T26718] netdevsim netdevsim1 eth3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 734.887131][T26718] netdevsim netdevsim1 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 734.914624][T26718] netdevsim netdevsim1 eth3: unset [1, 1] type 2 family 0 port 60208 - 0 [ 734.942374][T30920] syzkaller0: entered promiscuous mode [ 734.956431][T30920] syzkaller0: entered allmulticast mode [ 740.264771][T30959] syzkaller0: entered promiscuous mode [ 740.271642][T30959] syzkaller0: entered allmulticast mode [ 744.984929][T30983] pimreg: entered allmulticast mode [ 744.991477][T30985] pimreg: left allmulticast mode [ 745.369954][T31007] netlink: 12 bytes leftover after parsing attributes in process `syz.4.10705'. [ 745.407811][T30989] syzkaller0: entered promiscuous mode [ 745.429595][T30989] syzkaller0: entered allmulticast mode [ 745.823063][T31016] netlink: 12 bytes leftover after parsing attributes in process `syz.3.10707'. [ 750.894202][T31007] ipvlan2: entered allmulticast mode [ 750.899605][T31007] syz_tun: entered allmulticast mode [ 751.238626][T31029] ip6tnl1: entered allmulticast mode [ 751.409571][T31026] syzkaller0: entered promiscuous mode [ 751.415757][T31026] syzkaller0: entered allmulticast mode [ 751.430831][T31039] tc action pedit offset must be on 32 bit boundaries [ 751.440510][T31039] tc action pedit offset must be on 32 bit boundaries [ 751.447513][T31039] tc action pedit offset must be on 32 bit boundaries [ 751.454545][T31039] tc action pedit offset must be on 32 bit boundaries [ 751.461391][T31039] tc action pedit offset must be on 32 bit boundaries [ 751.468319][T31039] tc action pedit offset must be on 32 bit boundaries [ 751.475193][T31039] tc action pedit offset must be on 32 bit boundaries [ 751.482087][T31039] tc action pedit offset must be on 32 bit boundaries [ 751.489008][T31039] tc action pedit offset must be on 32 bit boundaries [ 751.495884][T31039] tc action pedit offset must be on 32 bit boundaries [ 751.502859][T31039] net_ratelimit: 10 callbacks suppressed [ 751.502981][T31039] TC_ACT_REPEAT abuse ? [ 751.737771][T31051] netlink: 640 bytes leftover after parsing attributes in process `syz.0.10718'. [ 751.748404][T31051] openvswitch: netlink: VXLAN extension message has 4 unknown bytes. [ 756.632792][T31044] syzkaller0: entered promiscuous mode [ 756.641054][T31044] syzkaller0: entered allmulticast mode [ 756.869432][T31066] netlink: 12 bytes leftover after parsing attributes in process `syz.4.10724'. [ 757.012791][T31063] syzkaller0: entered promiscuous mode [ 757.020042][T31063] syzkaller0: entered allmulticast mode [ 761.198022][ T48] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 762.873688][T31115] : entered promiscuous mode [ 762.925929][T31121] netlink: 32 bytes leftover after parsing attributes in process `syz.0.10733'. [ 763.104394][T31130] syzkaller0: entered promiscuous mode [ 763.110154][T31130] syzkaller0: entered allmulticast mode [ 763.827986][T31162] netlink: 'syz.0.10746': attribute type 29 has an invalid length. [ 763.849892][T31167] netlink: 'syz.0.10746': attribute type 29 has an invalid length. [ 763.878002][T31170] xt_HMARK: spi-set and port-set can't be combined [ 766.495719][T31151] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 766.657331][T31179] netlink: 28 bytes leftover after parsing attributes in process `syz.1.10750'. [ 766.831083][T31187] FAULT_INJECTION: forcing a failure. [ 766.831083][T31187] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 766.849248][T31187] CPU: 1 UID: 0 PID: 31187 Comm: syz.0.10753 Not tainted syzkaller #0 PREEMPT(full) [ 766.849277][T31187] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 766.849297][T31187] Call Trace: [ 766.849399][T31187] [ 766.849475][T31187] dump_stack_lvl+0xe8/0x150 [ 766.849614][T31187] should_fail_ex+0x412/0x560 [ 766.849722][T31187] _copy_from_user+0x2d/0xb0 [ 766.849801][T31187] do_ipv6_setsockopt+0x25c/0x3150 [ 766.849951][T31187] ? get_pid_task+0x20/0x1f0 [ 766.850038][T31187] ? __pfx_do_ipv6_setsockopt+0x10/0x10 [ 766.850088][T31187] ? get_pid_task+0x20/0x1f0 [ 766.850117][T31187] ? get_pid_task+0x20/0x1f0 [ 766.850137][T31187] ? get_pid_task+0x20/0x1f0 [ 766.850170][T31187] ? __lock_acquire+0x6b5/0x2cf0 [ 766.850231][T31187] ? aa_sk_perm+0x6d5/0x900 [ 766.850335][T31187] ? __fget_files+0x2a/0x420 [ 766.850392][T31187] ? __pfx_aa_sk_perm+0x10/0x10 [ 766.850420][T31187] ? __fget_files+0x2a/0x420 [ 766.850439][T31187] ? aa_sock_opt_perm+0xff/0x1a0 [ 766.850491][T31187] ipv6_setsockopt+0x59/0x170 [ 766.850509][T31187] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 766.850586][T31187] do_sock_setsockopt+0x17c/0x1b0 [ 766.850662][T31187] __x64_sys_setsockopt+0x13d/0x1b0 [ 766.850690][T31187] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 766.850733][T31187] do_syscall_64+0x174/0xf80 [ 766.850850][T31187] ? trace_irq_disable+0x3b/0x140 [ 766.850899][T31187] ? clear_bhb_loop+0x40/0x90 [ 766.850922][T31187] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 766.850940][T31187] RIP: 0033:0x7f11b479ce59 [ 766.850994][T31187] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 766.851039][T31187] RSP: 002b:00007f11b5719028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 766.851086][T31187] RAX: ffffffffffffffda RBX: 00007f11b4a15fa0 RCX: 00007f11b479ce59 [ 766.851099][T31187] RDX: 000000000000000b RSI: 0000000000000029 RDI: 0000000000000003 [ 766.851117][T31187] RBP: 00007f11b5719090 R08: 000000000000fee3 R09: 0000000000000000 [ 766.851128][T31187] R10: 00002000000002c0 R11: 0000000000000246 R12: 0000000000000001 [ 766.851140][T31187] R13: 00007f11b4a16038 R14: 00007f11b4a15fa0 R15: 00007ffcd2955598 [ 766.851171][T31187] [ 769.500352][T31199] mac80211_hwsim hwsim8 syzkaller0: left promiscuous mode [ 769.516857][T31205] netlink: 12 bytes leftover after parsing attributes in process `syz.0.10761'. [ 769.531804][T31199] mac80211_hwsim hwsim8 syzkaller0: left allmulticast mode [ 769.545210][T31205] netlink: 56 bytes leftover after parsing attributes in process `syz.0.10761'. [ 769.563533][T31205] netlink: 8 bytes leftover after parsing attributes in process `syz.0.10761'. [ 769.615732][T31201] syzkaller0: entered promiscuous mode [ 769.638172][T31201] syzkaller0: entered allmulticast mode [ 769.746669][T31212] FAULT_INJECTION: forcing a failure. [ 769.746669][T31212] name failslab, interval 1, probability 0, space 0, times 1 [ 769.767972][T31212] CPU: 0 UID: 0 PID: 31212 Comm: syz.2.10763 Not tainted syzkaller #0 PREEMPT(full) [ 769.768012][T31212] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 769.768027][T31212] Call Trace: [ 769.768037][T31212] [ 769.768046][T31212] dump_stack_lvl+0xe8/0x150 [ 769.768080][T31212] should_fail_ex+0x412/0x560 [ 769.768111][T31212] should_failslab+0xa8/0x100 [ 769.768182][T31212] kmem_cache_alloc_node_noprof+0x8f/0x690 [ 769.768227][T31212] ? __alloc_skb+0x186/0x7d0 [ 769.768256][T31212] ? __alloc_skb+0x1d0/0x7d0 [ 769.768281][T31212] ? __local_bh_enable_ip+0xd0/0x130 [ 769.768310][T31212] __alloc_skb+0x1d0/0x7d0 [ 769.768337][T31212] ? bpf_lsm_socket_getpeersec_dgram+0x9/0x20 [ 769.768385][T31212] netlink_sendmsg+0x5d4/0xb40 [ 769.768545][T31212] ? __pfx_netlink_sendmsg+0x10/0x10 [ 769.768581][T31212] ? aa_sock_msg_perm+0xf1/0x1b0 [ 769.768615][T31212] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 769.768648][T31212] ____sys_sendmsg+0x972/0x9f0 [ 769.768681][T31212] ? __might_fault+0xaf/0x130 [ 769.768725][T31212] ? __pfx_____sys_sendmsg+0x10/0x10 [ 769.768768][T31212] ? import_iovec+0x73/0xa0 [ 769.768799][T31212] ___sys_sendmsg+0x2a5/0x360 [ 769.768831][T31212] ? __lock_acquire+0x6b5/0x2cf0 [ 769.768859][T31212] ? __pfx____sys_sendmsg+0x10/0x10 [ 769.768935][T31212] ? __fget_files+0x2a/0x420 [ 769.768960][T31212] ? __fget_files+0x3a0/0x420 [ 769.768999][T31212] __x64_sys_sendmsg+0x1bd/0x2a0 [ 769.769043][T31212] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 769.769087][T31212] ? __pfx_ksys_write+0x10/0x10 [ 769.769128][T31212] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 769.769153][T31212] do_syscall_64+0x174/0xf80 [ 769.769185][T31212] ? trace_irq_disable+0x3b/0x140 [ 769.769217][T31212] ? clear_bhb_loop+0x40/0x90 [ 769.769245][T31212] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 769.769267][T31212] RIP: 0033:0x7f12deb9ce59 [ 769.769288][T31212] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 769.769308][T31212] RSP: 002b:00007f12dfaf6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 769.769332][T31212] RAX: ffffffffffffffda RBX: 00007f12dee15fa0 RCX: 00007f12deb9ce59 [ 769.769347][T31212] RDX: 0000000000000000 RSI: 0000200000000080 RDI: 0000000000000003 [ 769.769361][T31212] RBP: 00007f12dfaf6090 R08: 0000000000000000 R09: 0000000000000000 [ 769.769374][T31212] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 769.769387][T31212] R13: 00007f12dee16038 R14: 00007f12dee15fa0 R15: 00007fffa1cb68d8 [ 769.769424][T31212] [ 770.054360][T31214] FAULT_INJECTION: forcing a failure. [ 770.054360][T31214] name failslab, interval 1, probability 0, space 0, times 0 [ 770.068217][T31214] CPU: 0 UID: 0 PID: 31214 Comm: syz.0.10765 Not tainted syzkaller #0 PREEMPT(full) [ 770.068248][T31214] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 770.068261][T31214] Call Trace: [ 770.068274][T31214] [ 770.068287][T31214] dump_stack_lvl+0xe8/0x150 [ 770.068318][T31214] should_fail_ex+0x412/0x560 [ 770.068349][T31214] should_failslab+0xa8/0x100 [ 770.068372][T31214] kmem_cache_alloc_node_noprof+0x8f/0x690 [ 770.068403][T31214] ? __alloc_skb+0x186/0x7d0 [ 770.068431][T31214] ? __alloc_skb+0x1d0/0x7d0 [ 770.068454][T31214] ? __local_bh_enable_ip+0xd0/0x130 [ 770.068482][T31214] __alloc_skb+0x1d0/0x7d0 [ 770.068517][T31214] netlink_sendmsg+0x5d4/0xb40 [ 770.068558][T31214] ? __pfx_netlink_sendmsg+0x10/0x10 [ 770.068593][T31214] ? aa_sock_msg_perm+0xf1/0x1b0 [ 770.068626][T31214] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 770.068658][T31214] ____sys_sendmsg+0x972/0x9f0 [ 770.068690][T31214] ? __might_fault+0xaf/0x130 [ 770.068725][T31214] ? __pfx_____sys_sendmsg+0x10/0x10 [ 770.068767][T31214] ? import_iovec+0x73/0xa0 [ 770.068796][T31214] ___sys_sendmsg+0x2a5/0x360 [ 770.068833][T31214] ? __lock_acquire+0x6b5/0x2cf0 [ 770.068862][T31214] ? __pfx____sys_sendmsg+0x10/0x10 [ 770.068935][T31214] ? __fget_files+0x2a/0x420 [ 770.068959][T31214] ? __fget_files+0x3a0/0x420 [ 770.068997][T31214] __x64_sys_sendmsg+0x1bd/0x2a0 [ 770.069031][T31214] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 770.069074][T31214] ? __pfx_ksys_write+0x10/0x10 [ 770.069114][T31214] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 770.069138][T31214] do_syscall_64+0x174/0xf80 [ 770.069171][T31214] ? trace_irq_disable+0x3b/0x140 [ 770.069201][T31214] ? clear_bhb_loop+0x40/0x90 [ 770.069228][T31214] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 770.069250][T31214] RIP: 0033:0x7f11b479ce59 [ 770.069271][T31214] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 770.069289][T31214] RSP: 002b:00007f11b5719028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 770.069313][T31214] RAX: ffffffffffffffda RBX: 00007f11b4a15fa0 RCX: 00007f11b479ce59 [ 770.069328][T31214] RDX: 0000000000000000 RSI: 00002000000001c0 RDI: 0000000000000003 [ 770.069341][T31214] RBP: 00007f11b5719090 R08: 0000000000000000 R09: 0000000000000000 [ 770.069354][T31214] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 770.069366][T31214] R13: 00007f11b4a16038 R14: 00007f11b4a15fa0 R15: 00007ffcd2955598 [ 770.069402][T31214] [ 770.360954][T31216] FAULT_INJECTION: forcing a failure. [ 770.360954][T31216] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 770.464746][T31216] CPU: 1 UID: 0 PID: 31216 Comm: syz.3.10766 Not tainted syzkaller #0 PREEMPT(full) [ 770.464779][T31216] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 770.464794][T31216] Call Trace: [ 770.464802][T31216] [ 770.464813][T31216] dump_stack_lvl+0xe8/0x150 [ 770.464845][T31216] should_fail_ex+0x412/0x560 [ 770.464877][T31216] _copy_to_user+0x31/0xb0 [ 770.464907][T31216] simple_read_from_buffer+0xe1/0x170 [ 770.464951][T31216] proc_fail_nth_read+0x1bb/0x230 [ 770.465041][T31216] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 770.465073][T31216] ? rw_verify_area+0x2a6/0x4d0 [ 770.465104][T31216] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 770.465134][T31216] vfs_read+0x20c/0xa70 [ 770.465171][T31216] ? __pfx___mutex_lock+0x10/0x10 [ 770.465264][T31216] ? __pfx_vfs_read+0x10/0x10 [ 770.465298][T31216] ? __fget_files+0x2a/0x420 [ 770.465331][T31216] ? __fget_files+0x3a0/0x420 [ 770.465355][T31216] ? __fget_files+0x2a/0x420 [ 770.465393][T31216] ksys_read+0x150/0x270 [ 770.465427][T31216] ? __pfx_ksys_read+0x10/0x10 [ 770.465472][T31216] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 770.465497][T31216] do_syscall_64+0x174/0xf80 [ 770.465528][T31216] ? trace_irq_disable+0x3b/0x140 [ 770.465562][T31216] ? clear_bhb_loop+0x40/0x90 [ 770.465589][T31216] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 770.465611][T31216] RIP: 0033:0x7ffaefb5d68e [ 770.465633][T31216] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 770.465651][T31216] RSP: 002b:00007ffaf0ac7fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 770.465674][T31216] RAX: ffffffffffffffda RBX: 00007ffaf0ac86c0 RCX: 00007ffaefb5d68e [ 770.465691][T31216] RDX: 000000000000000f RSI: 00007ffaf0ac80a0 RDI: 0000000000000004 [ 770.465704][T31216] RBP: 00007ffaf0ac8090 R08: 0000000000000000 R09: 0000000000000000 [ 770.465717][T31216] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 770.465730][T31216] R13: 00007ffaefe16038 R14: 00007ffaefe15fa0 R15: 00007fff0921b1c8 [ 770.465768][T31216] [ 770.825518][T31220] netlink: 'syz.0.10767': attribute type 21 has an invalid length. [ 770.849536][T31228] netlink: 16 bytes leftover after parsing attributes in process `syz.3.10770'. [ 770.925375][T31231] FAULT_INJECTION: forcing a failure. [ 770.925375][T31231] name failslab, interval 1, probability 0, space 0, times 0 [ 770.995621][T31231] CPU: 1 UID: 0 PID: 31231 Comm: syz.3.10772 Not tainted syzkaller #0 PREEMPT(full) [ 770.995652][T31231] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 770.995666][T31231] Call Trace: [ 770.995674][T31231] [ 770.995684][T31231] dump_stack_lvl+0xe8/0x150 [ 770.995716][T31231] should_fail_ex+0x412/0x560 [ 770.995745][T31231] should_failslab+0xa8/0x100 [ 770.995769][T31231] kmem_cache_alloc_node_noprof+0x8f/0x690 [ 770.995801][T31231] ? __alloc_skb+0x186/0x7d0 [ 770.995829][T31231] ? __alloc_skb+0x1d0/0x7d0 [ 770.995865][T31231] ? __local_bh_enable_ip+0xd0/0x130 [ 770.995893][T31231] __alloc_skb+0x1d0/0x7d0 [ 770.995921][T31231] ? __pfx_ip6_pol_route+0x10/0x10 [ 770.996055][T31231] alloc_skb_with_frags+0xc8/0x760 [ 770.996119][T31231] ? __lock_acquire+0x6b5/0x2cf0 [ 770.996155][T31231] sock_alloc_send_pskb+0x878/0x990 [ 770.996202][T31231] ? __pfx_sock_alloc_send_pskb+0x10/0x10 [ 770.996230][T31231] ? ipv6_addr_label+0x2f/0x240 [ 770.996257][T31231] ? ipv6_addr_label+0x2f/0x240 [ 770.996283][T31231] __ip6_append_data+0x2c6c/0x3f60 [ 770.996361][T31231] ? __lock_acquire+0x6b5/0x2cf0 [ 770.996398][T31231] ? ipv6_dev_get_saddr+0x934/0xbb0 [ 770.996425][T31231] ? __pfx_ip_generic_getfrag+0x10/0x10 [ 770.996496][T31231] ? ip6_mtu+0x7d/0x490 [ 770.996538][T31231] ? ip6_mtu+0x7d/0x490 [ 770.996571][T31231] ? __pfx___ip6_append_data+0x10/0x10 [ 770.996603][T31231] ? __pfx_ip6_mtu+0x10/0x10 [ 770.996642][T31231] ip6_make_skb+0x2af/0x320 [ 770.996675][T31231] ? __pfx_ip_generic_getfrag+0x10/0x10 [ 770.996703][T31231] ? __pfx_ip6_make_skb+0x10/0x10 [ 770.996732][T31231] ? sk_dst_check+0x25/0x480 [ 770.996776][T31231] ? udpv6_sendmsg+0x1864/0x25c0 [ 770.996813][T31231] udpv6_sendmsg+0x1db8/0x25c0 [ 770.996871][T31231] ? __pfx_udpv6_sendmsg+0x10/0x10 [ 770.996897][T31231] ? udp_lib_get_port+0x177a/0x1c60 [ 770.996965][T31231] ? ip6_datagram_release_cb+0x7c/0x550 [ 770.997066][T31231] ? inet_send_prepare+0x1b9/0x270 [ 770.997114][T31231] ? inet_send_prepare+0x1b9/0x270 [ 770.997142][T31231] ? inet_send_prepare+0x1b9/0x270 [ 770.997162][T31231] ? __local_bh_enable_ip+0xd0/0x130 [ 770.997184][T31231] ? inet_send_prepare+0x1b9/0x270 [ 770.997211][T31231] ? inet6_sendmsg+0xe4/0x120 [ 770.997239][T31231] ____sys_sendmsg+0x5c7/0x9f0 [ 770.997283][T31231] ? __pfx_____sys_sendmsg+0x10/0x10 [ 770.997326][T31231] ? import_iovec+0x73/0xa0 [ 770.997357][T31231] ___sys_sendmsg+0x2a5/0x360 [ 770.997387][T31231] ? __lock_acquire+0x6b5/0x2cf0 [ 770.997415][T31231] ? __pfx____sys_sendmsg+0x10/0x10 [ 770.997452][T31231] ? kstrtouint+0x6e/0xe0 [ 770.997517][T31231] ? __fget_files+0x2a/0x420 [ 770.997542][T31231] ? __fget_files+0x3a0/0x420 [ 770.997580][T31231] __sys_sendmmsg+0x27c/0x4e0 [ 770.997619][T31231] ? __pfx___sys_sendmmsg+0x10/0x10 [ 770.997650][T31231] ? __mutex_unlock_slowpath+0x1be/0x6f0 [ 770.997703][T31231] ? ksys_write+0x242/0x270 [ 770.997737][T31231] ? __pfx_ksys_write+0x10/0x10 [ 770.997776][T31231] __x64_sys_sendmmsg+0xa0/0xc0 [ 770.997808][T31231] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 770.997833][T31231] do_syscall_64+0x174/0xf80 [ 770.997873][T31231] ? trace_irq_disable+0x3b/0x140 [ 770.997905][T31231] ? clear_bhb_loop+0x40/0x90 [ 770.997932][T31231] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 770.997954][T31231] RIP: 0033:0x7ffaefb9ce59 [ 770.997976][T31231] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 770.997995][T31231] RSP: 002b:00007ffaf0ac8028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 770.998019][T31231] RAX: ffffffffffffffda RBX: 00007ffaefe15fa0 RCX: 00007ffaefb9ce59 [ 770.998034][T31231] RDX: 0000000000000002 RSI: 0000200000002280 RDI: 0000000000000003 [ 770.998048][T31231] RBP: 00007ffaf0ac8090 R08: 0000000000000000 R09: 0000000000000000 [ 770.998062][T31231] R10: 0000000020044800 R11: 0000000000000246 R12: 0000000000000001 [ 770.998075][T31231] R13: 00007ffaefe16038 R14: 00007ffaefe15fa0 R15: 00007fff0921b1c8 [ 770.998113][T31231] [ 771.675749][T31251] FAULT_INJECTION: forcing a failure. [ 771.675749][T31251] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 771.715387][T31251] CPU: 1 UID: 0 PID: 31251 Comm: syz.2.10779 Not tainted syzkaller #0 PREEMPT(full) [ 771.715417][T31251] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 771.715430][T31251] Call Trace: [ 771.715438][T31251] [ 771.715449][T31251] dump_stack_lvl+0xe8/0x150 [ 771.715479][T31251] should_fail_ex+0x412/0x560 [ 771.715511][T31251] _copy_to_user+0x31/0xb0 [ 771.715540][T31251] simple_read_from_buffer+0xe1/0x170 [ 771.715572][T31251] proc_fail_nth_read+0x1bb/0x230 [ 771.715603][T31251] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 771.715648][T31251] ? rw_verify_area+0x2a6/0x4d0 [ 771.715677][T31251] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 771.715706][T31251] vfs_read+0x20c/0xa70 [ 771.715739][T31251] ? __pfx___mutex_lock+0x10/0x10 [ 771.715762][T31251] ? __pfx_vfs_read+0x10/0x10 [ 771.715792][T31251] ? __fget_files+0x2a/0x420 [ 771.715823][T31251] ? __fget_files+0x3a0/0x420 [ 771.715846][T31251] ? __fget_files+0x2a/0x420 [ 771.715880][T31251] ksys_read+0x150/0x270 [ 771.715913][T31251] ? __pfx_ksys_read+0x10/0x10 [ 771.715952][T31251] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 771.715975][T31251] do_syscall_64+0x174/0xf80 [ 771.716005][T31251] ? trace_irq_disable+0x3b/0x140 [ 771.716036][T31251] ? clear_bhb_loop+0x40/0x90 [ 771.716062][T31251] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 771.716083][T31251] RIP: 0033:0x7f12deb5d68e [ 771.716102][T31251] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 771.716119][T31251] RSP: 002b:00007f12dfaf5fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 771.716142][T31251] RAX: ffffffffffffffda RBX: 00007f12dfaf66c0 RCX: 00007f12deb5d68e [ 771.716156][T31251] RDX: 000000000000000f RSI: 00007f12dfaf60a0 RDI: 0000000000000004 [ 771.716168][T31251] RBP: 00007f12dfaf6090 R08: 0000000000000000 R09: 0000000000000000 [ 771.716181][T31251] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 771.716192][T31251] R13: 00007f12dee16038 R14: 00007f12dee15fa0 R15: 00007fffa1cb68d8 [ 771.716226][T31251] [ 771.963645][T31253] netlink: 32 bytes leftover after parsing attributes in process `syz.1.10778'. [ 772.351693][T31273] netlink: 'syz.0.10784': attribute type 29 has an invalid length. [ 772.380562][T31273] netlink: 'syz.0.10784': attribute type 29 has an invalid length. [ 772.455118][T31273] syzkaller0: entered promiscuous mode [ 772.503355][T31273] syzkaller0: entered allmulticast mode [ 772.547355][T31281] FAULT_INJECTION: forcing a failure. [ 772.547355][T31281] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 772.599208][T31281] CPU: 0 UID: 0 PID: 31281 Comm: syz.3.10786 Not tainted syzkaller #0 PREEMPT(full) [ 772.599240][T31281] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 772.599254][T31281] Call Trace: [ 772.599263][T31281] [ 772.599272][T31281] dump_stack_lvl+0xe8/0x150 [ 772.599305][T31281] should_fail_ex+0x412/0x560 [ 772.599336][T31281] _copy_from_user+0x2d/0xb0 [ 772.599364][T31281] copy_from_sockptr_offset+0x66/0xa0 [ 772.599536][T31281] do_ipt_set_ctl+0x934/0xe00 [ 772.599565][T31281] ? rcu_is_watching+0x15/0xb0 [ 772.599607][T31281] ? trace_contention_end+0x3d/0x140 [ 772.599637][T31281] ? __pfx_do_ipt_set_ctl+0x10/0x10 [ 772.599683][T31281] ? __pfx_do_ip_setsockopt+0x10/0x10 [ 772.599711][T31281] ? __pfx___mutex_lock+0x10/0x10 [ 772.599743][T31281] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 772.599772][T31281] ? __pfx_aa_sk_perm+0x10/0x10 [ 772.599809][T31281] nf_setsockopt+0x26f/0x290 [ 772.599891][T31281] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 772.599921][T31281] do_sock_setsockopt+0x17c/0x1b0 [ 772.599957][T31281] __x64_sys_setsockopt+0x13d/0x1b0 [ 772.599989][T31281] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 772.600013][T31281] do_syscall_64+0x174/0xf80 [ 772.600044][T31281] ? trace_irq_disable+0x3b/0x140 [ 772.600075][T31281] ? clear_bhb_loop+0x40/0x90 [ 772.600101][T31281] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 772.600122][T31281] RIP: 0033:0x7ffaefb9ce59 [ 772.600143][T31281] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 772.600163][T31281] RSP: 002b:00007ffaf0ac8028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 772.600187][T31281] RAX: ffffffffffffffda RBX: 00007ffaefe15fa0 RCX: 00007ffaefb9ce59 [ 772.600203][T31281] RDX: 0000000000000040 RSI: 0004000000000000 RDI: 0000000000000003 [ 772.600217][T31281] RBP: 00007ffaf0ac8090 R08: 00000000000002b0 R09: 0000000000000000 [ 772.600231][T31281] R10: 00002000000002c0 R11: 0000000000000246 R12: 0000000000000001 [ 772.600243][T31281] R13: 00007ffaefe16038 R14: 00007ffaefe15fa0 R15: 00007fff0921b1c8 [ 772.600281][T31281] [ 773.194344][T31288] syzkaller0: entered promiscuous mode [ 773.203432][T31288] syzkaller0: entered allmulticast mode [ 773.246705][T31300] netlink: 8 bytes leftover after parsing attributes in process `syz.2.10794'. [ 773.256207][T31300] netlink: 4 bytes leftover after parsing attributes in process `syz.2.10794'. [ 773.290097][T31300] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 773.388952][T31307] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 774.814725][T14586] wlan1: Trigger new scan to find an IBSS to join [ 778.617189][T31344] netlink: 207952 bytes leftover after parsing attributes in process `syz.3.10805'. [ 779.192182][T31361] FAULT_INJECTION: forcing a failure. [ 779.192182][T31361] name failslab, interval 1, probability 0, space 0, times 0 [ 779.205159][T31361] CPU: 0 UID: 0 PID: 31361 Comm: syz.2.10811 Not tainted syzkaller #0 PREEMPT(full) [ 779.205185][T31361] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 779.205197][T31361] Call Trace: [ 779.205207][T31361] [ 779.205217][T31361] dump_stack_lvl+0xe8/0x150 [ 779.205246][T31361] should_fail_ex+0x412/0x560 [ 779.205272][T31361] should_failslab+0xa8/0x100 [ 779.205291][T31361] ? skb_clone+0x212/0x3a0 [ 779.205319][T31361] kmem_cache_alloc_noprof+0x87/0x650 [ 779.205346][T31361] ? __netlink_lookup+0xc6/0x8b0 [ 779.205389][T31361] skb_clone+0x212/0x3a0 [ 779.205421][T31361] __netlink_deliver_tap+0x404/0x850 [ 779.205460][T31361] ? netlink_deliver_tap+0x2e/0x1b0 [ 779.205499][T31361] netlink_deliver_tap+0x19c/0x1b0 [ 779.205526][T31361] netlink_unicast+0x730/0x8e0 [ 779.205561][T31361] netlink_sendmsg+0x813/0xb40 [ 779.205598][T31361] ? __pfx_netlink_sendmsg+0x10/0x10 [ 779.205627][T31361] ? aa_sock_msg_perm+0xf1/0x1b0 [ 779.205656][T31361] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 779.205686][T31361] ____sys_sendmsg+0x972/0x9f0 [ 779.205713][T31361] ? __might_fault+0xaf/0x130 [ 779.205744][T31361] ? __pfx_____sys_sendmsg+0x10/0x10 [ 779.205781][T31361] ? import_iovec+0x73/0xa0 [ 779.205807][T31361] ___sys_sendmsg+0x2a5/0x360 [ 779.205832][T31361] ? __lock_acquire+0x6b5/0x2cf0 [ 779.205857][T31361] ? __pfx____sys_sendmsg+0x10/0x10 [ 779.205922][T31361] ? __fget_files+0x2a/0x420 [ 779.205944][T31361] ? __fget_files+0x3a0/0x420 [ 779.205976][T31361] __x64_sys_sendmsg+0x1bd/0x2a0 [ 779.206009][T31361] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 779.206046][T31361] ? __pfx_ksys_write+0x10/0x10 [ 779.206083][T31361] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 779.206104][T31361] do_syscall_64+0x174/0xf80 [ 779.206131][T31361] ? trace_irq_disable+0x3b/0x140 [ 779.206159][T31361] ? clear_bhb_loop+0x40/0x90 [ 779.206181][T31361] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 779.206200][T31361] RIP: 0033:0x7f12deb9ce59 [ 779.206220][T31361] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 779.206236][T31361] RSP: 002b:00007f12dfaf6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 779.206258][T31361] RAX: ffffffffffffffda RBX: 00007f12dee15fa0 RCX: 00007f12deb9ce59 [ 779.206271][T31361] RDX: 0000000000000000 RSI: 0000200000000080 RDI: 0000000000000003 [ 779.206282][T31361] RBP: 00007f12dfaf6090 R08: 0000000000000000 R09: 0000000000000000 [ 779.206293][T31361] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 779.206303][T31361] R13: 00007f12dee16038 R14: 00007f12dee15fa0 R15: 00007fffa1cb68d8 [ 779.206335][T31361] [ 779.755360][T14587] wlan1: Trigger new scan to find an IBSS to join [ 780.749175][ T48] wlan1: Creating new IBSS network, BSSID 22:60:a7:eb:92:d5 [ 780.875327][ T29] page_pool_release_retry() stalled pool shutdown: id 164, 1 inflight 181 sec [ 783.919678][T31361] netlink: 'syz.2.10811': attribute type 29 has an invalid length. [ 784.192355][T31386] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 784.245570][T31386] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 784.415081][T31401] netlink: 8 bytes leftover after parsing attributes in process `syz.0.10823'. [ 784.685797][T31408] netlink: 4 bytes leftover after parsing attributes in process `syz.4.10826'. [ 784.699544][T31408] netlink: 12 bytes leftover after parsing attributes in process `syz.4.10826'. [ 785.557661][ T3314] nci: nci_ntf_packet: unknown ntf opcode 0x3c [ 786.285874][T31440] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 790.928962][T31495] netlink: 16 bytes leftover after parsing attributes in process `syz.0.10857'. [ 791.082553][T31506] netlink: 207952 bytes leftover after parsing attributes in process `syz.1.10859'. [ 791.092790][T31506] FAULT_INJECTION: forcing a failure. [ 791.092790][T31506] name failslab, interval 1, probability 0, space 0, times 0 [ 791.106254][T31506] CPU: 1 UID: 0 PID: 31506 Comm: syz.1.10859 Not tainted syzkaller #0 PREEMPT(full) [ 791.106284][T31506] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 791.106298][T31506] Call Trace: [ 791.106306][T31506] [ 791.106315][T31506] dump_stack_lvl+0xe8/0x150 [ 791.106349][T31506] should_fail_ex+0x412/0x560 [ 791.106381][T31506] should_failslab+0xa8/0x100 [ 791.106405][T31506] __kmalloc_noprof+0xe8/0x760 [ 791.106436][T31506] ? ovs_nla_copy_actions+0x68/0x3d0 [ 791.106583][T31506] ovs_nla_copy_actions+0x68/0x3d0 [ 791.106613][T31506] ovs_packet_cmd_execute+0x648/0xea0 [ 791.106679][T31506] ? __pfx_ovs_packet_cmd_execute+0x10/0x10 [ 791.106711][T31506] ? genl_family_rcv_msg_attrs_parse+0x20b/0x2f0 [ 791.106738][T31506] ? genl_family_rcv_msg_attrs_parse+0x265/0x2f0 [ 791.106772][T31506] genl_family_rcv_msg_doit+0x22a/0x330 [ 791.106817][T31506] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 791.106857][T31506] ? bpf_lsm_capable+0x9/0x20 [ 791.106877][T31506] ? security_capable+0x7e/0x2c0 [ 791.106976][T31506] genl_rcv_msg+0x61c/0x7a0 [ 791.107015][T31506] ? __pfx_genl_rcv_msg+0x10/0x10 [ 791.107039][T31506] ? __pfx_ovs_packet_cmd_execute+0x10/0x10 [ 791.107083][T31506] netlink_rcv_skb+0x232/0x4b0 [ 791.107119][T31506] ? __pfx_genl_rcv_msg+0x10/0x10 [ 791.107145][T31506] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 791.107194][T31506] ? down_read+0x270/0x2e0 [ 791.107215][T31506] ? genl_rcv+0xd/0x40 [ 791.107240][T31506] genl_rcv+0x28/0x40 [ 791.107260][T31506] netlink_unicast+0x75c/0x8e0 [ 791.107301][T31506] netlink_sendmsg+0x813/0xb40 [ 791.107343][T31506] ? __pfx_netlink_sendmsg+0x10/0x10 [ 791.107379][T31506] ? aa_sock_msg_perm+0xf1/0x1b0 [ 791.107413][T31506] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 791.107444][T31506] ____sys_sendmsg+0x972/0x9f0 [ 791.107476][T31506] ? __might_fault+0xaf/0x130 [ 791.107511][T31506] ? __pfx_____sys_sendmsg+0x10/0x10 [ 791.107554][T31506] ? import_iovec+0x73/0xa0 [ 791.107585][T31506] ___sys_sendmsg+0x2a5/0x360 [ 791.107614][T31506] ? __lock_acquire+0x6b5/0x2cf0 [ 791.107644][T31506] ? __pfx____sys_sendmsg+0x10/0x10 [ 791.107737][T31506] ? __fget_files+0x2a/0x420 [ 791.107761][T31506] ? __fget_files+0x3a0/0x420 [ 791.107807][T31506] __x64_sys_sendmsg+0x1bd/0x2a0 [ 791.107842][T31506] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 791.107886][T31506] ? __pfx_ksys_write+0x10/0x10 [ 791.107927][T31506] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 791.107951][T31506] do_syscall_64+0x174/0xf80 [ 791.107981][T31506] ? trace_irq_disable+0x3b/0x140 [ 791.108012][T31506] ? clear_bhb_loop+0x40/0x90 [ 791.108039][T31506] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 791.108060][T31506] RIP: 0033:0x7f22df19ce59 [ 791.108080][T31506] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 791.108099][T31506] RSP: 002b:00007f22e0029028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 791.108121][T31506] RAX: ffffffffffffffda RBX: 00007f22df415fa0 RCX: 00007f22df19ce59 [ 791.108136][T31506] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000003 [ 791.108149][T31506] RBP: 00007f22e0029090 R08: 0000000000000000 R09: 0000000000000000 [ 791.108162][T31506] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 791.108174][T31506] R13: 00007f22df416038 R14: 00007f22df415fa0 R15: 00007ffd13b64988 [ 791.108211][T31506] [ 791.709426][T31515] syzkaller0: entered promiscuous mode [ 791.715510][T31515] syzkaller0: entered allmulticast mode [ 791.800953][T31519] netlink: 28 bytes leftover after parsing attributes in process `syz.1.10861'. [ 792.320992][T31537] netlink: 36 bytes leftover after parsing attributes in process `syz.4.10868'. [ 792.363550][T31537] netlink: 12 bytes leftover after parsing attributes in process `syz.4.10868'. [ 792.822303][T31531] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 793.148522][T31555] netlink: 56 bytes leftover after parsing attributes in process `syz.0.10873'. [ 793.198459][T31557] xt_hashlimit: size too large, truncated to 1048576 [ 793.215357][T14586] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 797.138397][T31537] bridge0: port 1(bridge_slave_0) entered disabled state [ 797.167043][T31549] netlink: 'syz.2.10871': attribute type 29 has an invalid length. [ 797.186400][T31555] workqueue: Failed to create a rescuer kthread for wq "bond9": -EINTR [ 797.298790][T31565] netlink: 16 bytes leftover after parsing attributes in process `syz.4.10875'. [ 797.398150][T31561] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 797.415869][T31561] A link change request failed with some changes committed already. Interface wlan1 may have been left with an inconsistent configuration, please check. [ 797.449578][ T964] syz0: Port: 1 Link ACTIVE [ 797.583978][T31574] tipc: Enabled bearer , priority 0 [ 797.631927][T31565] syzkaller0: entered promiscuous mode [ 797.638338][T31578] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 797.687336][T31565] syzkaller0: entered allmulticast mode [ 797.717133][T31587] netlink: 12 bytes leftover after parsing attributes in process `syz.0.10876'. [ 797.830887][T31565] tipc: Resetting bearer [ 797.861230][T31564] tipc: Resetting bearer [ 797.915609][T31564] tipc: Disabling bearer [ 798.115915][T31598] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 798.135918][T31598] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 799.129718][T31626] netlink: 48 bytes leftover after parsing attributes in process `syz.2.10896'. [ 803.214601][T31633] kthread_run failed with err -4 [ 803.415519][T31644] x_tables: duplicate underflow at hook 1 [ 803.426756][T31643] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 803.644156][T31659] netlink: 8 bytes leftover after parsing attributes in process `syz.3.10907'. [ 804.307038][T31692] netlink: 'syz.4.10912': attribute type 29 has an invalid length. [ 804.316650][T31692] netlink: 'syz.4.10912': attribute type 29 has an invalid length. [ 804.477810][T31698] netlink: 'syz.3.10913': attribute type 1 has an invalid length. [ 804.491186][T31670] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 804.921615][T31717] netlink: 'syz.0.10917': attribute type 5 has an invalid length. [ 804.945413][T31717] netlink: 140 bytes leftover after parsing attributes in process `syz.0.10917'. [ 805.374468][T31739] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 810.060754][T31751] netlink: 207952 bytes leftover after parsing attributes in process `syz.1.10927'. [ 810.146657][T31759] netlink: 'syz.3.10930': attribute type 1 has an invalid length. [ 810.413239][T31771] bridge0: port 2(bridge_slave_1) entered disabled state [ 810.491703][T31779] netlink: 'syz.4.10934': attribute type 29 has an invalid length. [ 810.529024][T31779] netlink: 8 bytes leftover after parsing attributes in process `syz.4.10934'. [ 810.567010][T31785] netlink: 'syz.4.10934': attribute type 29 has an invalid length. [ 810.590212][T31785] netlink: 8 bytes leftover after parsing attributes in process `syz.4.10934'. [ 810.914916][T31766] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 811.609130][T31817] netlink: 20 bytes leftover after parsing attributes in process `syz.1.10940'. [ 811.794373][T31836] netlink: 40 bytes leftover after parsing attributes in process `syz.1.10940'. [ 811.924870][T31836] netlink: 24 bytes leftover after parsing attributes in process `syz.1.10940'. [ 812.157896][T31855] netlink: 4 bytes leftover after parsing attributes in process `syz.0.10942'. [ 812.504513][T31855] bond0: (slave lo): Releasing backup interface [ 812.530047][T31855] bond0: (slave lo): last VLAN challenged slave left bond - VLAN blocking is removed [ 812.590691][T31855] bridge_slave_0: left allmulticast mode [ 812.617083][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 812.650088][T31855] bridge_slave_0: left promiscuous mode [ 812.685540][T31855] bridge0: port 1(bridge_slave_0) entered disabled state [ 812.754684][T31855] bridge_slave_1: left allmulticast mode [ 812.799010][T31855] bridge_slave_1: left promiscuous mode [ 812.817791][T31882] netlink: 4 bytes leftover after parsing attributes in process `syz.2.10945'. [ 812.845610][T31855] bridge0: port 2(bridge_slave_1) entered disabled state [ 812.896523][T31885] netlink: 212024 bytes leftover after parsing attributes in process `syz.2.10945'. [ 812.915047][T31855] veth0_to_bond: left allmulticast mode [ 812.920747][T31855] veth0_to_bond: left promiscuous mode [ 812.949888][T31855] bridge8: port 2(veth0_to_bond) entered disabled state [ 812.984623][T31855] : (slave bond_slave_0): Releasing backup interface [ 813.029506][T31855] : (slave bond_slave_1): Releasing backup interface [ 813.068791][T31855] team0: Port device team_slave_0 removed [ 813.108275][T31855] team0: Port device team_slave_1 removed [ 813.136604][T31855] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 813.165826][T31849] ip6tnl0: Caught tx_queue_len zero misconfig [ 813.577681][T31899] netlink: 256 bytes leftover after parsing attributes in process `syz.1.10952'. [ 814.828661][T31961] netlink: 'syz.4.10976': attribute type 29 has an invalid length. [ 814.849405][T31961] netlink: 'syz.4.10976': attribute type 29 has an invalid length. [ 815.306184][T31979] mac80211_hwsim hwsim8 syzkaller0: entered promiscuous mode [ 815.330584][T31990] __nla_validate_parse: 6 callbacks suppressed [ 815.330608][T31990] netlink: 20 bytes leftover after parsing attributes in process `syz.4.10988'. [ 815.341268][T31979] mac80211_hwsim hwsim8 syzkaller0: entered allmulticast mode [ 815.403682][T31991] tipc: Enabling of bearer rejected, failed to enable media [ 816.050447][T32019] syzkaller0: entered promiscuous mode [ 816.065477][T32019] syzkaller0: entered allmulticast mode [ 816.517174][T32034] syzkaller0: entered promiscuous mode [ 816.544952][T32034] syzkaller0: entered allmulticast mode [ 816.764350][T32046] bond5: left allmulticast mode [ 816.800551][T32053] netlink: 48 bytes leftover after parsing attributes in process `syz.3.11005'. [ 816.800916][T32046] vcan1: left allmulticast mode [ 816.959038][T32061] FAULT_INJECTION: forcing a failure. [ 816.959038][T32061] name failslab, interval 1, probability 0, space 0, times 0 [ 817.019209][T32061] CPU: 1 UID: 0 PID: 32061 Comm: syz.2.11006 Not tainted syzkaller #0 PREEMPT(full) [ 817.019241][T32061] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 817.019254][T32061] Call Trace: [ 817.019261][T32061] [ 817.019271][T32061] dump_stack_lvl+0xe8/0x150 [ 817.019303][T32061] should_fail_ex+0x412/0x560 [ 817.019332][T32061] should_failslab+0xa8/0x100 [ 817.019354][T32061] kmem_cache_alloc_node_noprof+0x8f/0x690 [ 817.019386][T32061] ? __alloc_skb+0x1d0/0x7d0 [ 817.019420][T32061] __alloc_skb+0x1d0/0x7d0 [ 817.019452][T32061] tipc_msg_build+0x162/0xf00 [ 817.019646][T32061] ? tipc_node_find+0x3bd/0x490 [ 817.019676][T32061] ? tipc_node_find+0xb3/0x490 [ 817.019704][T32061] ? __pfx_tipc_msg_build+0x10/0x10 [ 817.019741][T32061] ? __lock_acquire+0x6b5/0x2cf0 [ 817.019772][T32061] __tipc_sendmsg+0x1902/0x2bc0 [ 817.019849][T32061] ? process_measurement+0x451/0x1c80 [ 817.019909][T32061] ? __pfx___tipc_sendmsg+0x10/0x10 [ 817.019955][T32061] ? process_measurement+0x7ce/0x1c80 [ 817.019984][T32061] ? up_write+0x1ab/0x410 [ 817.020020][T32061] ? process_measurement+0x195e/0x1c80 [ 817.020044][T32061] ? process_measurement+0x281/0x1c80 [ 817.020086][T32061] ? __pfx_process_measurement+0x10/0x10 [ 817.020111][T32061] ? tomoyo_check_open_permission+0x38e/0x470 [ 817.020179][T32061] ? __pfx_woken_wake_function+0x10/0x10 [ 817.020213][T32061] ? __pfx_aa_label_sk_perm+0x10/0x10 [ 817.020244][T32061] ? look_up_lock_class+0x57/0x110 [ 817.020310][T32061] ? register_lock_class+0x31/0x2e0 [ 817.020337][T32061] __tipc_sendstream+0x104e/0x1280 [ 817.020402][T32061] ? do_raw_spin_lock+0x12b/0x2f0 [ 817.020436][T32061] ? __pfx___tipc_sendstream+0x10/0x10 [ 817.020471][T32061] ? tipc_send_packet+0x6e/0xa0 [ 817.020505][T32061] ? __local_bh_enable_ip+0xd0/0x130 [ 817.020533][T32061] tipc_send_packet+0x7c/0xa0 [ 817.020566][T32061] ____sys_sendmsg+0x972/0x9f0 [ 817.020619][T32061] ? __pfx_____sys_sendmsg+0x10/0x10 [ 817.020662][T32061] ? import_iovec+0x73/0xa0 [ 817.020694][T32061] ___sys_sendmsg+0x2a5/0x360 [ 817.020723][T32061] ? __lock_acquire+0x6b5/0x2cf0 [ 817.020750][T32061] ? __pfx____sys_sendmsg+0x10/0x10 [ 817.020825][T32061] ? __fget_files+0x2a/0x420 [ 817.020849][T32061] ? __fget_files+0x3a0/0x420 [ 817.020885][T32061] __x64_sys_sendmsg+0x1bd/0x2a0 [ 817.020920][T32061] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 817.020948][T32061] ? sched_clock_cpu+0x74/0x440 [ 817.020982][T32061] ? rcu_is_watching+0x15/0xb0 [ 817.021019][T32061] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 817.021043][T32061] do_syscall_64+0x174/0xf80 [ 817.021076][T32061] ? clear_bhb_loop+0x40/0x90 [ 817.021103][T32061] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 817.021124][T32061] RIP: 0033:0x7f12deb9ce59 [ 817.021144][T32061] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 817.021162][T32061] RSP: 002b:00007f12dfaf6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 817.021185][T32061] RAX: ffffffffffffffda RBX: 00007f12dee15fa0 RCX: 00007f12deb9ce59 [ 817.021200][T32061] RDX: 00000000040008d1 RSI: 0000200000000580 RDI: 0000000000000003 [ 817.021214][T32061] RBP: 00007f12dfaf6090 R08: 0000000000000000 R09: 0000000000000000 [ 817.021226][T32061] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 817.021238][T32061] R13: 00007f12dee16038 R14: 00007f12dee15fa0 R15: 00007fffa1cb68d8 [ 817.021275][T32061] [ 817.474227][T32062] syzkaller0: entered promiscuous mode [ 817.503329][T32062] syzkaller0: entered allmulticast mode [ 818.108664][T32091] syzkaller0: entered promiscuous mode [ 818.137577][T32091] syzkaller0: entered allmulticast mode [ 818.163611][T32096] netlink: 'syz.2.11019': attribute type 29 has an invalid length. [ 818.177752][T32093] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 818.238175][T32093] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 818.259664][T32098] netlink: 207952 bytes leftover after parsing attributes in process `syz.1.11020'. [ 818.271978][T32096] netlink: 'syz.2.11019': attribute type 29 has an invalid length. [ 818.767723][T32117] netlink: 212368 bytes leftover after parsing attributes in process `syz.3.11027'. [ 819.319962][T32141] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 819.398188][T32120] syzkaller0: entered promiscuous mode [ 819.413794][T32120] syzkaller0: entered allmulticast mode [ 819.454483][T32146] netlink: 28 bytes leftover after parsing attributes in process `syz.2.11035'. [ 819.463967][T32146] netlink: 'syz.2.11035': attribute type 7 has an invalid length. [ 819.479322][T32146] netlink: 'syz.2.11035': attribute type 8 has an invalid length. [ 819.510859][T32146] netlink: 4 bytes leftover after parsing attributes in process `syz.2.11035'. [ 819.534846][T32147] netlink: 12 bytes leftover after parsing attributes in process `syz.2.11035'. [ 824.893938][T32152] syzkaller0: entered promiscuous mode [ 824.904152][T32152] syzkaller0: entered allmulticast mode [ 825.232582][T32191] netlink: 4 bytes leftover after parsing attributes in process `syz.2.11046'. [ 825.365759][T32191] netlink: 16 bytes leftover after parsing attributes in process `syz.2.11046'. [ 826.340998][T32242] mac80211_hwsim hwsim8 syzkaller0: left promiscuous mode [ 826.367904][T32242] mac80211_hwsim hwsim8 syzkaller0: left allmulticast mode [ 826.460752][T32248] syzkaller0: entered promiscuous mode [ 826.478509][T32248] syzkaller0: entered allmulticast mode [ 826.657877][T32256] netlink: 72 bytes leftover after parsing attributes in process `syz.4.11066'. [ 826.804698][T32263] netlink: 'syz.4.11070': attribute type 1 has an invalid length. [ 826.823590][T32260] syzkaller1: entered promiscuous mode [ 826.831129][T32260] syzkaller1: entered allmulticast mode [ 826.899441][T32260] x_tables: ip_tables: DNAT target: used from hooks POSTROUTING, but only usable from PREROUTING/OUTPUT [ 826.953949][T32263] workqueue: Failed to create a rescuer kthread for wq "bond20": -EINTR [ 827.032668][T32273] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 827.083746][T32273] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 827.906173][T32312] syzkaller0: entered promiscuous mode [ 827.919505][T32312] syzkaller0: entered allmulticast mode [ 828.268280][T32327] netlink: 12 bytes leftover after parsing attributes in process `syz.1.11084'. [ 828.860412][T32337] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 828.935606][T32337] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 829.097403][T32363] netlink: 'syz.0.11093': attribute type 4 has an invalid length. [ 829.112112][T32357] netlink: 'syz.2.11091': attribute type 10 has an invalid length. [ 829.122828][T32363] netlink: 244 bytes leftover after parsing attributes in process `syz.0.11093'. [ 829.153473][T32362] syzkaller0: entered promiscuous mode [ 829.164919][T32362] syzkaller0: entered allmulticast mode [ 829.970206][T32398] syzkaller0: entered promiscuous mode [ 829.976002][T32398] syzkaller0: entered allmulticast mode [ 830.099590][T32408] netlink: 16 bytes leftover after parsing attributes in process `syz.1.11104'. [ 830.202052][T32414] netlink: 'syz.2.11105': attribute type 1 has an invalid length. [ 830.270289][T32417] netlink: 20 bytes leftover after parsing attributes in process `syz.4.11103'. [ 833.126152][T32422] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 835.080054][T32414] workqueue: Failed to create a rescuer kthread for wq "bond7": -EINTR [ 835.237790][T32439] syzkaller0: entered promiscuous mode [ 835.271876][T32439] syzkaller0: entered allmulticast mode [ 835.327835][T32454] netlink: 8 bytes leftover after parsing attributes in process `syz.3.11109'. [ 835.417730][T32460] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 835.448982][T32460] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 840.790510][T32456] netlink: 44 bytes leftover after parsing attributes in process `syz.4.11110'. [ 841.043867][T32481] netlink: 'syz.3.11117': attribute type 1 has an invalid length. [ 841.064122][T32482] tipc: New replicast peer: fe80:0000:0000:0000:0000:0000:0000:00bb [ 841.091701][T32482] tipc: Enabled bearer , priority 10 [ 841.161797][T32481] bond14: entered promiscuous mode [ 841.177135][T32481] 8021q: adding VLAN 0 to HW filter on device bond14 [ 841.406211][T32505] syzkaller0: entered promiscuous mode [ 841.421442][T32505] syzkaller0: entered allmulticast mode [ 841.433852][ T24] page_pool_release_retry() stalled pool shutdown: id 164, 1 inflight 242 sec [ 841.579650][T32511] netlink: 16 bytes leftover after parsing attributes in process `syz.0.11126'. [ 841.613949][T32512] netlink: 16 bytes leftover after parsing attributes in process `syz.0.11126'. [ 841.738657][T32519] netlink: 12 bytes leftover after parsing attributes in process `syz.0.11128'. [ 841.790202][T32519] 8021q: adding VLAN 0 to HW filter on device bond9 [ 841.851978][T32519] netlink: 4 bytes leftover after parsing attributes in process `syz.0.11128'. [ 841.906761][T32521] bond9: (slave dummy0): Enslaving as an active interface with an up link [ 842.106180][T32519] bond9 (unregistering): (slave dummy0): Releasing backup interface [ 842.129434][T32519] bond9 (unregistering): Released all slaves [ 842.234220][T32537] mac80211_hwsim hwsim8 syzkaller0: entered promiscuous mode [ 842.292260][T32537] mac80211_hwsim hwsim8 syzkaller0: entered allmulticast mode [ 842.371748][T32529] netdevsim netdevsim0: Direct firmware load for .. failed with error -2 [ 842.423428][T32529] netdevsim netdevsim0: Falling back to sysfs fallback for: .. [ 842.507443][T32526] syzkaller0: entered promiscuous mode [ 842.525439][T32526] syzkaller0: entered allmulticast mode [ 842.835490][T32551] netlink: 'syz.1.11135': attribute type 5 has an invalid length. [ 842.860983][T32551] netlink: 4 bytes leftover after parsing attributes in process `syz.1.11135'. [ 847.868458][T32562] netlink: 'syz.3.11138': attribute type 29 has an invalid length. [ 848.043962][T32571] netlink: 28 bytes leftover after parsing attributes in process `syz.3.11141'. [ 848.210496][T32574] syzkaller0: entered promiscuous mode [ 848.223336][T32580] nbd: must specify an index to disconnect [ 848.229353][T32574] syzkaller0: entered allmulticast mode [ 849.050717][T32603] netlink: 'syz.2.11153': attribute type 5 has an invalid length. [ 849.061714][T32603] netlink: 4 bytes leftover after parsing attributes in process `syz.2.11153'. [ 849.432659][T32605] netlink: 28 bytes leftover after parsing attributes in process `syz.1.11154'. [ 849.451823][T32605] netlink: 8 bytes leftover after parsing attributes in process `syz.1.11154'. [ 853.005844][T32615] netlink: 'syz.3.11158': attribute type 23 has an invalid length. [ 853.107009][T32630] netlink: 'syz.0.11161': attribute type 1 has an invalid length. [ 853.147504][T32630] netlink: 44 bytes leftover after parsing attributes in process `syz.0.11161'. [ 853.162629][T32630] netlink: 28 bytes leftover after parsing attributes in process `syz.0.11161'. [ 853.175218][T32630] 8021q: adding VLAN 0 to HW filter on device bond9 [ 853.468624][T32641] netlink: 'syz.0.11166': attribute type 5 has an invalid length. [ 853.518647][T32641] netlink: 4 bytes leftover after parsing attributes in process `syz.0.11166'. [ 853.581332][T32646] netlink: 28 bytes leftover after parsing attributes in process `syz.2.11167'. [ 853.598188][T32646] netlink: 8 bytes leftover after parsing attributes in process `syz.2.11167'. [ 853.617473][T32643] dvmrp0: entered allmulticast mode [ 853.763625][T32650] netlink: 12 bytes leftover after parsing attributes in process `syz.0.11169'. [ 853.800528][T32650] veth0: Caught tx_queue_len zero misconfig [ 853.984874][T32650] netlink: 4 bytes leftover after parsing attributes in process `syz.0.11169'. [ 854.095009][T32657] netlink: 12 bytes leftover after parsing attributes in process `syz.0.11169'. [ 854.118878][T32663] netlink: 'syz.2.11175': attribute type 21 has an invalid length. [ 854.135482][T32663] netlink: 128 bytes leftover after parsing attributes in process `syz.2.11175'. [ 854.176931][T32674] netlink: 'syz.2.11175': attribute type 21 has an invalid length. [ 854.200845][T32663] netlink: 'syz.2.11175': attribute type 4 has an invalid length. [ 854.242339][T32663] netlink: 'syz.2.11175': attribute type 5 has an invalid length. [ 854.247005][T32674] netlink: 128 bytes leftover after parsing attributes in process `syz.2.11175'. [ 854.363834][T32674] netlink: 'syz.2.11175': attribute type 4 has an invalid length. [ 854.405735][T32674] netlink: 'syz.2.11175': attribute type 5 has an invalid length. [ 854.705415][T32689] tipc: Enabled bearer , priority 0 [ 854.857544][T32688] tipc: Disabling bearer [ 855.038710][T32697] syzkaller0: entered promiscuous mode [ 855.044534][T32697] syzkaller0: entered allmulticast mode [ 855.084980][T32702] syzkaller1: entered promiscuous mode [ 855.101196][T32702] syzkaller1: entered allmulticast mode [ 855.357666][ C0] vxcan0: j1939_tp_rxtimer: 0xffff8880591b6000: rx timeout, send abort [ 855.857830][ C0] vxcan0: j1939_tp_rxtimer: 0xffff8880591b6c00: rx timeout, send abort [ 855.866429][ C0] vxcan0: j1939_tp_rxtimer: 0xffff8880591b6000: abort rx timeout. Force session deactivation [ 856.375810][ C0] vxcan0: j1939_tp_rxtimer: 0xffff8880591b6c00: abort rx timeout. Force session deactivation [ 860.086530][T32735] netlink: 'syz.4.11196': attribute type 29 has an invalid length. [ 860.301050][T32747] __nla_validate_parse: 5 callbacks suppressed [ 860.301073][T32747] netlink: 16 bytes leftover after parsing attributes in process `syz.3.11199'. [ 860.580956][T32757] netlink: 14 bytes leftover after parsing attributes in process `syz.3.11201'. [ 860.805134][ T302] netlink: 212348 bytes leftover after parsing attributes in process `syz.3.11201'. [ 860.873922][ T302] netlink: Conntrack attr has 3 unknown bytes [ 861.036500][ T48] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 865.540512][ T315] netlink: 8 bytes leftover after parsing attributes in process `syz.3.11210'. [ 865.568392][ T315] netlink: 'syz.3.11210': attribute type 39 has an invalid length. [ 865.648658][ T317] syzkaller0: entered promiscuous mode [ 865.654554][ T317] syzkaller0: entered allmulticast mode [ 865.745556][ T315] syz_tun (unregistering): left allmulticast mode [ 865.882848][ T338] netlink: 'syz.1.11217': attribute type 3 has an invalid length. [ 868.743179][ T330] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 869.085943][ T360] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 869.119166][ T360] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 870.944313][ T362] mac80211_hwsim hwsim8 syzkaller0: left promiscuous mode [ 870.969975][ T362] mac80211_hwsim hwsim8 syzkaller0: left allmulticast mode [ 871.127930][ T373] netlink: 198076 bytes leftover after parsing attributes in process `syz.3.11226'. [ 871.145642][ T377] netlink: 8 bytes leftover after parsing attributes in process `syz.2.11229'. [ 871.158767][ T377] netlink: 8 bytes leftover after parsing attributes in process `syz.2.11229'. [ 871.927087][ T415] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 871.958244][ T415] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 872.190908][ T418] syzkaller0: entered promiscuous mode [ 872.212374][ T418] syzkaller0: entered allmulticast mode [ 872.317660][ T441] x_tables: ip6_tables: icmp6 match: only valid for protocol 58 [ 877.248310][ T465] netlink: 20 bytes leftover after parsing attributes in process `syz.1.11250'. [ 877.313765][ T465] netlink: 'syz.1.11250': attribute type 1 has an invalid length. [ 877.338190][ T465] netlink: 224 bytes leftover after parsing attributes in process `syz.1.11250'. [ 877.382279][ T465] NCSI netlink: No device for ifindex 0 [ 877.451201][ T465] xt_hashlimit: size too large, truncated to 1048576 [ 877.627486][ T484] netlink: 8 bytes leftover after parsing attributes in process `syz.3.11256'. [ 877.824088][ T489] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 877.858463][ T489] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 877.919216][ T497] netlink: 288 bytes leftover after parsing attributes in process `syz.3.11260'. [ 878.530414][ T513] syzkaller0: entered promiscuous mode [ 878.536296][ T513] syzkaller0: entered allmulticast mode [ 879.087258][ T501] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 879.341118][ T536] netlink: 52 bytes leftover after parsing attributes in process `syz.4.11266'. [ 879.751882][ T548] FAULT_INJECTION: forcing a failure. [ 879.751882][ T548] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 879.765696][ T548] CPU: 0 UID: 0 PID: 548 Comm: syz.2.11271 Not tainted syzkaller #0 PREEMPT(full) [ 879.765724][ T548] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 879.765737][ T548] Call Trace: [ 879.765744][ T548] [ 879.765752][ T548] dump_stack_lvl+0xe8/0x150 [ 879.765784][ T548] should_fail_ex+0x412/0x560 [ 879.765809][ T548] _copy_from_iter+0x1d3/0x1670 [ 879.765833][ T548] ? rcu_is_watching+0x15/0xb0 [ 879.765863][ T548] ? __pfx__copy_from_iter+0x10/0x10 [ 879.765895][ T548] ? netlink_sendmsg+0x650/0xb40 [ 879.765925][ T548] ? skb_put+0x11b/0x210 [ 879.765959][ T548] netlink_sendmsg+0x6c0/0xb40 [ 879.766000][ T548] ? __pfx_netlink_sendmsg+0x10/0x10 [ 879.766036][ T548] ? aa_sock_msg_perm+0xf1/0x1b0 [ 879.766070][ T548] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 879.766104][ T548] ____sys_sendmsg+0x972/0x9f0 [ 879.766135][ T548] ? __might_fault+0xaf/0x130 [ 879.766173][ T548] ? __pfx_____sys_sendmsg+0x10/0x10 [ 879.766215][ T548] ? import_iovec+0x73/0xa0 [ 879.766245][ T548] ___sys_sendmsg+0x2a5/0x360 [ 879.766275][ T548] ? __lock_acquire+0x6b5/0x2cf0 [ 879.766304][ T548] ? __pfx____sys_sendmsg+0x10/0x10 [ 879.766378][ T548] ? __fget_files+0x2a/0x420 [ 879.766404][ T548] ? __fget_files+0x3a0/0x420 [ 879.766442][ T548] __x64_sys_sendmsg+0x1bd/0x2a0 [ 879.766477][ T548] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 879.766521][ T548] ? __pfx_ksys_write+0x10/0x10 [ 879.766561][ T548] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 879.766597][ T548] do_syscall_64+0x174/0xf80 [ 879.766627][ T548] ? trace_irq_disable+0x3b/0x140 [ 879.766655][ T548] ? clear_bhb_loop+0x40/0x90 [ 879.766682][ T548] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 879.766701][ T548] RIP: 0033:0x7f12deb9ce59 [ 879.766720][ T548] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 879.766736][ T548] RSP: 002b:00007f12dfaf6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 879.766757][ T548] RAX: ffffffffffffffda RBX: 00007f12dee15fa0 RCX: 00007f12deb9ce59 [ 879.766770][ T548] RDX: 0000000000000000 RSI: 0000200000000240 RDI: 0000000000000004 [ 879.766782][ T548] RBP: 00007f12dfaf6090 R08: 0000000000000000 R09: 0000000000000000 [ 879.766793][ T548] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 879.766803][ T548] R13: 00007f12dee16038 R14: 00007f12dee15fa0 R15: 00007fffa1cb68d8 [ 879.766835][ T548] [ 883.996549][ T555] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 884.034950][ T555] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 884.659984][ T587] netlink: 52 bytes leftover after parsing attributes in process `syz.4.11285'. [ 884.770420][ T589] syzkaller0: entered promiscuous mode [ 884.776342][ T589] syzkaller0: entered allmulticast mode [ 884.953290][ T564] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 885.187111][ T597] netlink: 207952 bytes leftover after parsing attributes in process `syz.2.11289'. [ 885.266203][ T599] netlink: 24 bytes leftover after parsing attributes in process `syz.1.11287'. [ 889.678569][ T631] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 889.746652][ T631] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 889.820593][ T638] netlink: 52 bytes leftover after parsing attributes in process `syz.3.11296'. [ 890.271541][ T658] syzkaller0: entered promiscuous mode [ 890.277685][ T658] syzkaller0: entered allmulticast mode [ 890.659821][ T678] mac80211_hwsim hwsim8 syzkaller0: entered promiscuous mode [ 890.689727][ T678] mac80211_hwsim hwsim8 syzkaller0: entered allmulticast mode [ 890.758265][ T682] netlink: 36 bytes leftover after parsing attributes in process `syz.4.11307'. [ 890.775111][ T643] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 891.078237][ T690] tipc: Resetting bearer [ 891.186553][ T703] netlink: 52 bytes leftover after parsing attributes in process `syz.3.11310'. [ 891.662968][ T717] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 891.697261][ T717] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 892.147892][T14587] netdevsim netdevsim4 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 892.183988][T14587] netdevsim netdevsim4 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 892.202092][T14587] netdevsim netdevsim4 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 892.219483][T14587] netdevsim netdevsim4 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 892.238561][T14587] netdevsim netdevsim4 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 892.269940][T14587] netdevsim netdevsim4 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 892.557556][ T741] openvswitch: netlink: Missing key (keys=40, expected=2000) [ 892.567650][ T735] syzkaller0: entered promiscuous mode [ 892.607505][ T735] syzkaller0: entered allmulticast mode [ 892.688460][T30073] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 892.712758][T30073] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 892.735324][T30073] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 892.749711][T30073] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 892.764940][T30073] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 893.036687][T14587] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 894.877795][ T5647] Bluetooth: hci5: command tx timeout [ 896.968160][ T5647] Bluetooth: hci5: command tx timeout [ 898.162245][ T771] netlink: 8 bytes leftover after parsing attributes in process `syz.2.11327'. [ 898.235208][ T771] netlink: 24 bytes leftover after parsing attributes in process `syz.2.11327'. [ 898.313435][ T775] netlink: 52 bytes leftover after parsing attributes in process `syz.4.11328'. [ 898.551672][ T788] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 898.598194][ T788] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 898.630725][ T791] netlink: 'syz.4.11333': attribute type 11 has an invalid length. [ 898.660873][ T791] netlink: 132 bytes leftover after parsing attributes in process `syz.4.11333'. [ 899.033688][ T5647] Bluetooth: hci5: command tx timeout [ 899.070026][ T806] netlink: 8 bytes leftover after parsing attributes in process `syz.4.11338'. [ 899.109877][ T806] netlink: 24 bytes leftover after parsing attributes in process `syz.4.11338'. [ 899.153533][ T806] netlink: 8 bytes leftover after parsing attributes in process `syz.4.11338'. [ 899.177965][ T806] netlink: 24 bytes leftover after parsing attributes in process `syz.4.11338'. [ 899.417603][ T815] netlink: 52 bytes leftover after parsing attributes in process `syz.4.11342'. [ 899.498503][ T744] »»»»»» speed is unknown, defaulting to 1000 [ 899.769128][ T827] vcan0: left allmulticast mode [ 899.839992][ T827] L: renamed from vcan0 [ 900.406444][ T849] syzkaller0: entered promiscuous mode [ 900.422380][ T849] syzkaller0: entered allmulticast mode [ 900.588575][ T863] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 900.651812][ T858] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 900.684036][ T869] netlink: 40 bytes leftover after parsing attributes in process `syz.4.11351'. [ 901.131877][ T5647] Bluetooth: hci5: command tx timeout [ 901.838439][ T24] page_pool_release_retry() stalled pool shutdown: id 164, 1 inflight 302 sec [ 905.312766][ T888] netlink: 52 bytes leftover after parsing attributes in process `syz.4.11354'. [ 905.467645][ T744] bridge0: port 1(bridge_slave_0) entered blocking state [ 905.507481][ T744] bridge0: port 1(bridge_slave_0) entered disabled state [ 905.550800][ T744] bridge_slave_0: entered allmulticast mode [ 905.593268][ T744] bridge_slave_0: entered promiscuous mode [ 905.645585][ T744] bridge0: port 2(bridge_slave_1) entered blocking state [ 905.677315][ T744] bridge0: port 2(bridge_slave_1) entered disabled state [ 905.705111][ T744] bridge_slave_1: entered allmulticast mode [ 905.731912][ T744] bridge_slave_1: entered promiscuous mode [ 905.967816][ T744] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 906.032427][ T744] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 906.216754][ T744] team0: Port device team_slave_0 added [ 906.251310][ T744] team0: Port device team_slave_1 added [ 906.325593][ T948] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 906.341714][ T954] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 906.401731][ T954] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 906.475430][ T966] netlink: 'syz.2.11366': attribute type 1 has an invalid length. [ 906.547374][ T969] netlink: 52 bytes leftover after parsing attributes in process `syz.2.11366'. [ 906.628209][ T966] bond7: entered promiscuous mode [ 906.664260][ T966] 8021q: adding VLAN 0 to HW filter on device bond7 [ 906.707551][ T744] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 906.723249][ T744] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 906.749837][ T744] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 906.798563][ T970] syzkaller0: entered promiscuous mode [ 906.804672][ T970] syzkaller0: entered allmulticast mode [ 906.816393][ T744] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 906.824389][ T744] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 906.854073][ T744] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 907.018004][ T976] netlink: 52 bytes leftover after parsing attributes in process `syz.2.11367'. [ 911.768104][ T744] hsr_slave_0: entered promiscuous mode [ 911.791218][ T744] hsr_slave_1: entered promiscuous mode [ 911.812292][ T744] debugfs: 'hsr0' already exists in 'hsr' [ 911.827032][ T744] Cannot create hsr debugfs directory [ 912.150155][ T1012] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 912.179611][ T1012] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 912.359551][ T1019] netlink: 212356 bytes leftover after parsing attributes in process `syz.2.11381'. [ 912.408554][ T1023] netlink: 52 bytes leftover after parsing attributes in process `syz.3.11382'. [ 912.461805][ T744] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 912.506750][ T744] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 912.527174][ T744] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 912.569859][ T744] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 912.596780][ T744] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 912.631482][ T744] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 912.668754][ T744] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 912.698216][ T744] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 912.931036][ T1038] syzkaller0: entered promiscuous mode [ 912.938278][ T1038] syzkaller0: entered allmulticast mode [ 918.050592][ T744] 8021q: adding VLAN 0 to HW filter on device bond0 [ 918.170699][ T1075] netlink: 8 bytes leftover after parsing attributes in process `syz.4.11390'. [ 918.242116][ T744] 8021q: adding VLAN 0 to HW filter on device team0 [ 918.264148][ T1083] netlink: 52 bytes leftover after parsing attributes in process `syz.3.11393'. [ 918.312579][T14586] bridge0: port 1(bridge_slave_0) entered blocking state [ 918.319935][T14586] bridge0: port 1(bridge_slave_0) entered forwarding state [ 918.363048][T14586] bridge0: port 2(bridge_slave_1) entered blocking state [ 918.370410][T14586] bridge0: port 2(bridge_slave_1) entered forwarding state [ 918.447288][ T1090] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 918.547103][ T1090] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 918.765306][ T1100] netlink: 'syz.3.11398': attribute type 29 has an invalid length. [ 918.782410][ T1100] netlink: 'syz.3.11398': attribute type 29 has an invalid length. [ 919.195586][ T1117] syzkaller0: entered promiscuous mode [ 919.206915][ T1117] syzkaller0: entered allmulticast mode [ 919.800333][ T1133] netlink: 52 bytes leftover after parsing attributes in process `syz.1.11407'. [ 919.873313][ T1136] netlink: 212368 bytes leftover after parsing attributes in process `syz.3.11408'. [ 925.043789][T14586] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 925.512100][ T744] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 925.544078][ T1150] netlink: 'syz.2.11411': attribute type 1 has an invalid length. [ 925.595881][ T1148] netlink: 12 bytes leftover after parsing attributes in process `syz.2.11411'. [ 925.646695][ T1150] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 925.656994][ T1158] netlink: 'syz.3.11413': attribute type 7 has an invalid length. [ 926.263220][ T1179] FAULT_INJECTION: forcing a failure. [ 926.263220][ T1179] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 926.316039][ T1179] CPU: 1 UID: 0 PID: 1179 Comm: syz.4.11417 Not tainted syzkaller #0 PREEMPT(full) [ 926.316069][ T1179] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 926.316083][ T1179] Call Trace: [ 926.316091][ T1179] [ 926.316100][ T1179] dump_stack_lvl+0xe8/0x150 [ 926.316132][ T1179] should_fail_ex+0x412/0x560 [ 926.316162][ T1179] _copy_to_user+0x31/0xb0 [ 926.316189][ T1179] simple_read_from_buffer+0xe1/0x170 [ 926.316219][ T1179] proc_fail_nth_read+0x1bb/0x230 [ 926.316250][ T1179] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 926.316280][ T1179] ? rw_verify_area+0x2a6/0x4d0 [ 926.316307][ T1179] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 926.316335][ T1179] vfs_read+0x20c/0xa70 [ 926.316370][ T1179] ? __pfx___mutex_lock+0x10/0x10 [ 926.316395][ T1179] ? __pfx_vfs_read+0x10/0x10 [ 926.316425][ T1179] ? __fget_files+0x2a/0x420 [ 926.316454][ T1179] ? __fget_files+0x3a0/0x420 [ 926.316477][ T1179] ? __fget_files+0x2a/0x420 [ 926.316512][ T1179] ksys_read+0x150/0x270 [ 926.316544][ T1179] ? __pfx_ksys_read+0x10/0x10 [ 926.316583][ T1179] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 926.316607][ T1179] do_syscall_64+0x174/0xf80 [ 926.316640][ T1179] ? clear_bhb_loop+0x40/0x90 [ 926.316666][ T1179] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 926.316686][ T1179] RIP: 0033:0x7fc36fd5d68e [ 926.316706][ T1179] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 926.316724][ T1179] RSP: 002b:00007fc36dfedfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 926.316747][ T1179] RAX: ffffffffffffffda RBX: 00007fc36dfee6c0 RCX: 00007fc36fd5d68e [ 926.316762][ T1179] RDX: 000000000000000f RSI: 00007fc36dfee0a0 RDI: 0000000000000005 [ 926.316775][ T1179] RBP: 00007fc36dfee090 R08: 0000000000000000 R09: 0000000000000000 [ 926.316787][ T1179] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 926.316799][ T1179] R13: 00007fc370016038 R14: 00007fc370015fa0 R15: 00007ffee9ef1028 [ 926.316835][ T1179] [ 926.793130][ T1189] netlink: 52 bytes leftover after parsing attributes in process `syz.2.11421'. [ 927.250831][ T744] veth0_vlan: entered promiscuous mode [ 927.326676][ T744] veth1_vlan: entered promiscuous mode [ 927.545041][ T744] veth0_macvtap: entered promiscuous mode [ 927.571031][ T744] veth1_macvtap: entered promiscuous mode [ 927.637157][ T744] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 927.676290][ T744] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 927.733957][ T1223] netlink: 36 bytes leftover after parsing attributes in process `syz.2.11429'. [ 927.836864][ T12] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 927.928991][ T36] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 928.035406][ T1239] vlan5: entered promiscuous mode [ 928.052930][ T1239] bridge0: entered promiscuous mode [ 928.119324][ T36] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 928.138893][ T36] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 928.428238][ T1252] netlink: 28 bytes leftover after parsing attributes in process `syz.2.11436'. [ 928.438086][ T1252] netlink: 28 bytes leftover after parsing attributes in process `syz.2.11436'. [ 928.455818][T14587] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 928.468776][T14587] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 928.562477][ T1252] netlink: 28 bytes leftover after parsing attributes in process `syz.2.11436'. [ 928.586211][ T1252] netlink: 28 bytes leftover after parsing attributes in process `syz.2.11436'. [ 928.637796][ T141] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 928.666953][ T141] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 928.689940][ T1262] netlink: 8 bytes leftover after parsing attributes in process `syz.3.11438'. [ 928.938468][ T1262] netlink: 8 bytes leftover after parsing attributes in process `syz.3.11438'. [ 930.266089][ T1307] netlink: 'syz.1.11449': attribute type 1 has an invalid length. [ 931.038452][ T1348] Cannot find add_set index 65532 as target [ 931.368027][ T1357] tipc: Enabled bearer , priority 0 [ 931.418019][ T1357] syzkaller0: entered promiscuous mode [ 931.479133][ T1357] syzkaller0: entered allmulticast mode [ 931.748484][ T1352] tipc: Resetting bearer [ 931.905735][ T1352] tipc: Disabling bearer [ 932.388998][ T1393] SET target dimension over the limit! [ 933.159901][ T1418] netlink: 8 bytes leftover after parsing attributes in process `syz.2.11484'. [ 933.767488][ T1446] netlink: 'syz.5.11494': attribute type 11 has an invalid length. [ 933.788469][ T1441] xt_CT: No such helper "pptp" [ 934.690063][ T1478] netlink: 72 bytes leftover after parsing attributes in process `syz.3.11503'. [ 934.725896][ T1478] netlink: 72 bytes leftover after parsing attributes in process `syz.3.11503'. [ 934.830959][ T1487] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 934.849172][ T1489] mac80211_hwsim hwsim8 syzkaller0: left promiscuous mode [ 934.876170][ T1489] mac80211_hwsim hwsim8 syzkaller0: left allmulticast mode [ 935.318111][ T1509] netlink: 'syz.5.11514': attribute type 4 has an invalid length. [ 935.374051][ T1509] netlink: 'syz.5.11514': attribute type 4 has an invalid length. [ 935.415799][ T1509] netlink: 4 bytes leftover after parsing attributes in process `syz.5.11514'. [ 935.889310][ T1528] netlink: 12 bytes leftover after parsing attributes in process `syz.3.11518'. [ 936.291471][ T1543] Bluetooth: hci0: Opcode 0x0c1a failed: -22 [ 936.330654][ T1545] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 936.919186][ T1571] netlink: 12 bytes leftover after parsing attributes in process `syz.2.11533'. [ 937.099098][ T1573] netlink: 'syz.5.11534': attribute type 1 has an invalid length. [ 937.107195][ T1573] netlink: 224 bytes leftover after parsing attributes in process `syz.5.11534'. [ 937.545655][ T1585] netlink: 'syz.1.11539': attribute type 12 has an invalid length. [ 937.581046][ T1585] netlink: 'syz.1.11539': attribute type 29 has an invalid length. [ 937.610292][ T1585] netlink: 148 bytes leftover after parsing attributes in process `syz.1.11539'. [ 937.769280][ T1598] netlink: 'syz.2.11542': attribute type 21 has an invalid length. [ 937.982538][ T1601] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 938.199301][ T1611] Bluetooth: hci0: Opcode 0x0c1a failed: -22 [ 938.211847][ T1607] netlink: 4 bytes leftover after parsing attributes in process `syz.5.11546'. [ 938.799441][ T1632] netlink: 8 bytes leftover after parsing attributes in process `syz.5.11555'. [ 938.998713][ T1643] SET target dimension over the limit! [ 939.268695][ T1655] netlink: 16 bytes leftover after parsing attributes in process `syz.5.11563'. [ 939.291091][ T1657] netlink: 'syz.3.11564': attribute type 29 has an invalid length. [ 939.399041][ T1658] netlink: 'syz.3.11564': attribute type 29 has an invalid length. [ 939.453490][ T1659] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 939.695001][ T1673] netlink: 24 bytes leftover after parsing attributes in process `syz.3.11569'. [ 939.979581][ T1269] ------------[ cut here ]------------ [ 939.987939][ T1269] wlan1: Dropped data frame as no usable bitrate found while scanning and associated. Target station: 08:02:11:00:00:00 on 5 GHz band [ 940.001840][ T1269] WARNING: net/mac80211/tx.c:757 at ieee80211_tx_h_rate_ctrl+0xd82/0x1760, CPU#0: kworker/u8:8/1269 [ 940.012948][ T1269] Modules linked in: [ 940.017877][ T1269] CPU: 0 UID: 0 PID: 1269 Comm: kworker/u8:8 Not tainted syzkaller #0 PREEMPT(full) [ 940.027452][ T1269] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 940.037669][ T1269] Workqueue: events_unbound cfg80211_wiphy_work [ 940.044191][ T1269] RIP: 0010:ieee80211_tx_h_rate_ctrl+0xded/0x1760 [ 940.050704][ T1269] Code: 1c 08 00 00 48 8b 44 24 38 8b 30 45 31 ed 83 e6 07 41 0f 95 c5 31 ff e8 d1 69 a3 f6 43 8d 4c 6d 02 48 89 df 4c 89 f6 4c 89 fa <67> 48 0f b9 3a 41 bd 01 00 00 00 e9 73 01 00 00 e8 6e 65 a3 f6 e9 [ 940.070428][ T1269] RSP: 0018:ffffc90005c3f420 EFLAGS: 00010293 [ 940.076628][ T1269] RAX: ffffffff8b22610f RBX: ffffffff9041a8f0 RCX: 0000000000000005 [ 940.084709][ T1269] RDX: ffff88803f5013c4 RSI: ffff8880783ed888 RDI: ffffffff9041a8f0 [ 940.092835][ T1269] RBP: ffffc90005c3f588 R08: ffff88807db02a8f R09: 1ffff1100fb60551 [ 940.100944][ T1269] R10: dffffc0000000000 R11: ffffed100fb60552 R12: dffffc0000000000 [ 940.109110][ T1269] R13: 0000000000000001 R14: ffff8880783ed888 R15: ffff88803f5013c4 [ 940.117177][ T1269] FS: 0000000000000000(0000) GS:ffff8881252a1000(0000) knlGS:0000000000000000 [ 940.126650][ T1269] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 940.133413][ T1269] CR2: 0000555589b32a38 CR3: 000000005d114000 CR4: 00000000003526f0 [ 940.141450][ T1269] Call Trace: [ 940.144820][ T1269] [ 940.147824][ T1269] ? __pfx_ieee80211_tx_h_rate_ctrl+0x10/0x10 [ 940.154022][ T1269] ? ieee80211_is_bufferable_mmpdu+0x103/0x200 [ 940.160354][ T1269] invoke_tx_handlers_late+0xba/0x18a0 [ 940.165956][ T1269] ? invoke_tx_handlers_early+0xa0c/0x1d50 [ 940.171863][ T1269] ieee80211_tx+0x2d7/0x4b0 [ 940.176502][ T1269] ? __pfx_ieee80211_tx+0x10/0x10 [ 940.181642][ T1269] ? __ieee80211_tx_skb_tid_band+0x4cb/0x680 [ 940.187733][ T1269] __ieee80211_tx_skb_tid_band+0x50f/0x680 [ 940.193831][ T1269] ? ieee80211_scan_state_send_probe+0x4e8/0xa00 [ 940.200451][ T1269] ieee80211_scan_state_send_probe+0x594/0xa00 [ 940.206755][ T1269] ieee80211_scan_work+0x64d/0x1c60 [ 940.212103][ T1269] cfg80211_wiphy_work+0x2cf/0x460 [ 940.217343][ T1269] ? process_scheduled_works+0xa70/0x1860 [ 940.223189][ T1269] process_scheduled_works+0xb5d/0x1860 [ 940.228844][ T1269] ? __pfx_process_scheduled_works+0x10/0x10 [ 940.234941][ T1269] ? assign_work+0x3d5/0x5e0 [ 940.239607][ T1269] worker_thread+0xa53/0xfc0 [ 940.244343][ T1269] kthread+0x389/0x470 [ 940.248499][ T1269] ? __pfx_worker_thread+0x10/0x10 [ 940.253705][ T1269] ? __pfx_kthread+0x10/0x10 [ 940.258367][ T1269] ret_from_fork+0x514/0xb70 [ 940.263136][ T1269] ? __pfx_ret_from_fork+0x10/0x10 [ 940.268312][ T1269] ? __switch_to+0xc79/0x1410 [ 940.273102][ T1269] ? __pfx_kthread+0x10/0x10 [ 940.277760][ T1269] ret_from_fork_asm+0x1a/0x30 [ 940.282792][ T1269] [ 940.286017][ T1269] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 940.294330][ T1269] CPU: 0 UID: 0 PID: 1269 Comm: kworker/u8:8 Not tainted syzkaller #0 PREEMPT(full) [ 940.304191][ T1269] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 940.314302][ T1269] Workqueue: events_unbound cfg80211_wiphy_work [ 940.320599][ T1269] Call Trace: [ 940.323911][ T1269] [ 940.326873][ T1269] vpanic+0x56c/0xa60 [ 940.330941][ T1269] ? __pfx__printk+0x10/0x10 [ 940.335584][ T1269] ? __pfx_vpanic+0x10/0x10 [ 940.340150][ T1269] ? is_bpf_text_address+0x292/0x2b0 [ 940.345564][ T1269] ? is_bpf_text_address+0x26/0x2b0 [ 940.350814][ T1269] panic+0xc5/0xd0 [ 940.354581][ T1269] ? __pfx_panic+0x10/0x10 [ 940.359054][ T1269] ? ret_from_fork_asm+0x1a/0x30 [ 940.364053][ T1269] __warn+0x315/0x4c0 [ 940.368089][ T1269] ? ieee80211_tx_h_rate_ctrl+0xd82/0x1760 [ 940.373947][ T1269] ? ieee80211_tx_h_rate_ctrl+0xd82/0x1760 [ 940.379804][ T1269] __report_bug+0x29a/0x540 [ 940.384479][ T1269] ? ieee80211_tx_h_rate_ctrl+0xd82/0x1760 [ 940.390355][ T1269] ? __pfx___report_bug+0x10/0x10 [ 940.395433][ T1269] ? stack_trace_save+0xa9/0x100 [ 940.400455][ T1269] ? kasan_save_track+0x4f/0x80 [ 940.405373][ T1269] ? kasan_save_track+0x3e/0x80 [ 940.410282][ T1269] ? __kasan_slab_alloc+0x6c/0x80 [ 940.415384][ T1269] report_bug_entry+0x19a/0x290 [ 940.420293][ T1269] ? ieee80211_tx_h_rate_ctrl+0xded/0x1760 [ 940.426143][ T1269] ? ieee80211_tx_h_rate_ctrl+0xdf2/0x1760 [ 940.431992][ T1269] handle_bug+0xce/0x200 [ 940.436264][ T1269] exc_invalid_op+0x1a/0x50 [ 940.440808][ T1269] asm_exc_invalid_op+0x1a/0x20 [ 940.445698][ T1269] RIP: 0010:ieee80211_tx_h_rate_ctrl+0xded/0x1760 [ 940.452163][ T1269] Code: 1c 08 00 00 48 8b 44 24 38 8b 30 45 31 ed 83 e6 07 41 0f 95 c5 31 ff e8 d1 69 a3 f6 43 8d 4c 6d 02 48 89 df 4c 89 f6 4c 89 fa <67> 48 0f b9 3a 41 bd 01 00 00 00 e9 73 01 00 00 e8 6e 65 a3 f6 e9 [ 940.472087][ T1269] RSP: 0018:ffffc90005c3f420 EFLAGS: 00010293 [ 940.478300][ T1269] RAX: ffffffff8b22610f RBX: ffffffff9041a8f0 RCX: 0000000000000005 [ 940.486847][ T1269] RDX: ffff88803f5013c4 RSI: ffff8880783ed888 RDI: ffffffff9041a8f0 [ 940.494877][ T1269] RBP: ffffc90005c3f588 R08: ffff88807db02a8f R09: 1ffff1100fb60551 [ 940.502906][ T1269] R10: dffffc0000000000 R11: ffffed100fb60552 R12: dffffc0000000000 [ 940.510943][ T1269] R13: 0000000000000001 R14: ffff8880783ed888 R15: ffff88803f5013c4 [ 940.518964][ T1269] ? ieee80211_tx_h_rate_ctrl+0xddf/0x1760 [ 940.524858][ T1269] ? __pfx_ieee80211_tx_h_rate_ctrl+0x10/0x10 [ 940.530981][ T1269] ? ieee80211_is_bufferable_mmpdu+0x103/0x200 [ 940.537181][ T1269] invoke_tx_handlers_late+0xba/0x18a0 [ 940.542696][ T1269] ? invoke_tx_handlers_early+0xa0c/0x1d50 [ 940.548555][ T1269] ieee80211_tx+0x2d7/0x4b0 [ 940.553111][ T1269] ? __pfx_ieee80211_tx+0x10/0x10 [ 940.558206][ T1269] ? __ieee80211_tx_skb_tid_band+0x4cb/0x680 [ 940.564225][ T1269] __ieee80211_tx_skb_tid_band+0x50f/0x680 [ 940.570086][ T1269] ? ieee80211_scan_state_send_probe+0x4e8/0xa00 [ 940.576465][ T1269] ieee80211_scan_state_send_probe+0x594/0xa00 [ 940.582686][ T1269] ieee80211_scan_work+0x64d/0x1c60 [ 940.587971][ T1269] cfg80211_wiphy_work+0x2cf/0x460 [ 940.593139][ T1269] ? process_scheduled_works+0xa70/0x1860 [ 940.598917][ T1269] process_scheduled_works+0xb5d/0x1860 [ 940.604543][ T1269] ? __pfx_process_scheduled_works+0x10/0x10 [ 940.610578][ T1269] ? assign_work+0x3d5/0x5e0 [ 940.615211][ T1269] worker_thread+0xa53/0xfc0 [ 940.619859][ T1269] kthread+0x389/0x470 [ 940.623976][ T1269] ? __pfx_worker_thread+0x10/0x10 [ 940.629123][ T1269] ? __pfx_kthread+0x10/0x10 [ 940.633763][ T1269] ret_from_fork+0x514/0xb70 [ 940.638424][ T1269] ? __pfx_ret_from_fork+0x10/0x10 [ 940.643595][ T1269] ? __switch_to+0xc79/0x1410 [ 940.648323][ T1269] ? __pfx_kthread+0x10/0x10 [ 940.653064][ T1269] ret_from_fork_asm+0x1a/0x30 [ 940.657899][ T1269] [ 940.662053][ T1269] Kernel Offset: disabled [ 940.666456][ T1269] Rebooting in 86400 seconds..