last executing test programs: 10m2.568328366s ago: executing program 3 (id=1437): ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'vcan0\x00'}) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x1, 0x803, 0x0) socket$can_bcm(0x1d, 0x2, 0x2) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000640)=ANY=[@ANYBLOB="500000001000210400000000fedbdf250000fe00", @ANYRES32=0x0, @ANYBLOB="adffa888e16000002800128009000100766c616e00000000180002800c0002000e0000000a000000060001000001000008000500", @ANYRES32=r2], 0x50}}, 0x2) 10m2.386161628s ago: executing program 3 (id=1440): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000980)=@raw={'raw\x00', 0x8, 0x3, 0x4c8, 0x0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x3f8, 0xffffffff, 0xffffffff, 0x3f8, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'bridge0\x00'}, 0x0, 0x148, 0x170, 0x0, {}, [@common=@unspec=@helper={{0x48}}, @common=@inet=@hashlimit1={{0x58}, {'bond_slave_1\x00', {0x41, 0x1ff, 0x6, 0xb0e2, 0x10001, 0x84e, 0xfffffffb, 0x18, 0x8}, {0x1}}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'erspan0\x00', 'gre0\x00', {0xff}, {}, 0x0, 0x0, 0x0, 0x4b}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'vcan0\x00', {0x3, 0x0, 0x41, 0xfffffffe, 0x2, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x528) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) syz_emit_ethernet(0x6e, &(0x7f00000003c0)=ANY=[@ANYBLOB="bbbbbbbbbbbb00000000000086dd6002adf700383a00fe880000000000400000000000000001ff020000000000000000000000000001"], 0x0) 10m2.103028687s ago: executing program 3 (id=1444): r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$ax25(0x3, 0x4, 0xcc) write$cgroup_int(0xffffffffffffffff, &(0x7f00000000c0)=0x9, 0x12) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000000)={'bridge0\x00', &(0x7f0000000100)=@ethtool_sfeatures={0x3b, 0x3, [{0x7, 0x43e7}, {0x6, 0x8}, {0xd, 0xf5fe}]}}) (async) r1 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000001c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000005fc0)={&(0x7f0000000000)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16, @ANYBLOB="01002dbd0600ffdbdb252100000020000300", @ANYRES32=r2, @ANYBLOB="0600eb00000800000400ec000a00060008021100000100000600f70000ff000008009e"], 0x44}}, 0x28000) syz_emit_ethernet(0x73, &(0x7f00000001c0)={@local, @remote, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "e400ff", 0x3d, 0x3a, 0x0, @private2, @mcast2, {[], @param_prob={0x2, 0x0, 0x0, 0x0, {0x0, 0x6, '\x00', 0x0, 0x11, 0x0, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @ipv4={'\x00', '\xff\xff', @multicast1}, [@fragment={0x33, 0x0, 0x6, 0x1, 0x0, 0x1a, 0x66}], "17c17f0791"}}}}}}}, 0x0) 10m2.032565255s ago: executing program 3 (id=1445): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r3 = socket$igmp(0x2, 0x3, 0x2) ioctl$SIOCGETVIFCNT(r3, 0x89e0, &(0x7f0000000040)={0x1}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x24, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r2, {0x0, 0xfff2}, {0xffff, 0x9}, {0x0, 0xffff}}}, 0x24}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=@newtfilter={0x3c, 0x2c, 0xd27, 0x70bd2c, 0x0, {0x0, 0x0, 0x0, r2, {0x9, 0x9}, {}, {0xc, 0xf}}, [@filter_kind_options=@f_flower={{0xb}, {0xc, 0x2, [@TCA_FLOWER_CLASSID={0x8, 0x1, {0x1, 0xd}}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x60000080}, 0x20000000) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nfc(&(0x7f0000000040), r5) sendmsg$NFC_CMD_DEP_LINK_UP(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="01002abd7000fbdbdf250400000006000a006b983800080001"], 0x24}, 0x1, 0x0, 0x0, 0x40080c0}, 0x8000) ioctl$IOCTL_GET_NCIDEV_IDX(0xffffffffffffffff, 0x0, &(0x7f0000000180)=0x0) r8 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r9 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r10 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r9) ioctl$IOCTL_GET_NCIDEV_IDX(r8, 0x0, &(0x7f00000000c0)=0x0) sendmsg$NFC_CMD_DEV_UP(r9, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000d80)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r10, @ANYBLOB="010426bd7000f8dbdf250200000008000100", @ANYRES32=r11], 0x1c}}, 0x4008054) sendmsg$NFC_CMD_DEP_LINK_UP(r4, &(0x7f0000000300)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000280)={0x44, r6, 0x800, 0x70bd29, 0x25dfdbfd, {}, [@NFC_ATTR_DEVICE_INDEX={0x8}, @NFC_ATTR_COMM_MODE={0x5, 0xa, 0x1}, @NFC_ATTR_DEVICE_INDEX={0x8}, @NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r7}, @NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r11}, @NFC_ATTR_COMM_MODE={0x5}]}, 0x44}, 0x1, 0x0, 0x0, 0x40}, 0x90) r12 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCGIFINDEX(r12, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r12, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000a40)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff5653f, 0x70bd2d, 0x25dfdbfc, {0x0, 0x0, 0x0, r13, {0x0, 0x9}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x81}, 0x0) 10m1.514630933s ago: executing program 3 (id=1452): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r2 = socket(0x27, 0x3, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0x100, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r4 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x3, 0x10, &(0x7f0000000600)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007baaf8ff00000000b7080000341200007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb702000008"], 0x0, 0x4, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @sched_cls=0x2f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0x3, 0x4, &(0x7f0000000740)=@framed={{}, [@call={0x85, 0x0, 0x0, 0x61}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000880)={r6, 0x2f, 0x28, 0x0, &(0x7f0000000640)="c1dfb080cd21d308098e000081007e2288a8", 0x0, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000a40)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff5653f, 0x70bd2d, 0x25dfdbfc, {0x0, 0x0, 0x0, r5, {0x0, 0x9}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x81}, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000080)=@newtfilter={0x38, 0x2c, 0xd3f, 0x70bd25, 0x25dfdbfb, {0x0, 0x0, 0x0, r5, {0xc, 0xfff1}, {0x0, 0x9}, {0x8, 0x2}}, [@filter_kind_options=@f_u32={{0x8}, {0xc, 0x2, [@TCA_U32_FLAGS={0x8, 0xb, 0x3}]}}]}, 0x38}, 0x1, 0x0, 0x0, 0x1}, 0x20048044) r7 = socket$unix(0x1, 0x1, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0x25dfdbfb, {0x0, 0x0, 0x0, r8, {0x0, 0xfff2}, {0xffff, 0xffff}, {0xffff, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}, 0x1, 0x0, 0x0, 0x40004}, 0x4000) sendmsg$nl_route_sched(r2, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=@newtfilter={0x44, 0x2c, 0xc3f, 0x70bd2d, 0x25dfdbf9, {0x0, 0x0, 0x0, r8, {0x3, 0xa}, {}, {0x7, 0xffe0}}, [@filter_kind_options=@f_flower={{0xb}, {0x14, 0x2, [@TCA_FLOWER_KEY_ETH_TYPE={0x6, 0x8, 0x8100}, @TCA_FLOWER_KEY_VLAN_ETH_TYPE={0x6, 0x19, 0x9a8}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x24000810}, 0x20084084) r9 = socket$inet6_sctp(0xa, 0x1, 0x84) sendmmsg$inet6(r9, &(0x7f0000002340)=[{{&(0x7f0000000300)={0xa, 0x4e21, 0x0, @private2={0xfc, 0x2, '\x00', 0x1}, 0x6}, 0x1c, &(0x7f0000000cc0)=[{&(0x7f00000000c0)='O', 0x1}], 0x1}}], 0x1, 0x0) getsockopt$IP6T_SO_GET_ENTRIES(r9, 0x29, 0x41, &(0x7f0000000480)={'security\x00', 0xfd, "8c035b1784d4ddfc41e272011999dfeec6605c78e630f93ccca9cd59b8d5d00590fe6d12ce4034eb03105d3cd0db57f1c7e5ecb7a6fec3bb6ca9e3da8793e993d787f4a1e1d9d79de96416bffa5a55b1f321f3b7429042cae7e78fa757ec3883e668fb6165cadff9f0b25bd0ce9b70b6de356d4e7afd04f683751744b660eab223d3dd39d75b15debe5cb420e13d0557c728adfd619b7e960a18574e8b4f2736aa42cf03fb91b058d72c277a7bb668e2157af1441bf69eaa802538b85e79dd3283685705c34429dce811b190a65adc3a3d116f991ab48094907f5d3542fee69231b586ca7a9c3ce4a64cbb810a41078b02af8c47caccc5ab48b1e51986"}, &(0x7f0000000000)=0x121) shutdown(r9, 0x1) r10 = socket$inet_sctp(0x2, 0x5, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r10, 0x84, 0xc, &(0x7f0000000240)=@assoc_value={0x0}, &(0x7f0000000080)=0x8) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r9, 0x84, 0x6d, &(0x7f00000002c0)={r11}, &(0x7f0000000100)=0x8) sendmsg$nl_route_sched(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000400)=@gettaction={0x60, 0x32, 0x9408f9ce2610ee65, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x40, 0x1, [{0xc, 0x4, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x7ff}}, {0xc, 0xd, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0xf6bc}}, {0xc, 0x1e, 0x0, 0x0, @TCA_ACT_INDEX={0x8}}, {0xc, 0xe, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0xffffffff}}, {0xc, 0x20, 0x0, 0x0, @TCA_ACT_INDEX={0x8}}]}, @action_dump_flags=@TCA_ROOT_FLAGS={0x2e, 0x2, {0x0, 0x1}}]}, 0x60}, 0x1, 0x0, 0x0, 0x44}, 0x0) 9m59.786731692s ago: executing program 3 (id=1468): r0 = socket$nl_route(0x10, 0x3, 0x0) (async) r1 = socket$can_j1939(0x1d, 0x2, 0x7) socket$nl_rdma(0x10, 0x3, 0x14) (async) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)) (async) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f00000000c0)={'vcan0\x00', 0x0}) bind$can_j1939(r1, &(0x7f0000000340)={0x1d, r2, 0x0, {0x2, 0x0, 0x6}, 0xfe}, 0x18) (async) setsockopt$sock_int(r1, 0x1, 0x6, &(0x7f0000000040)=0x1, 0x4) (async) sendmsg$inet(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000003c0)=[{&(0x7f0000000280)="81b641f1f3843704b6", 0x9}], 0x1}, 0x4048081) (async, rerun: 32) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) (rerun: 32) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r4 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000000240)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}}) (async) writev(r3, &(0x7f0000000400)=[{&(0x7f0000000080)="2e9b3d0007e03dd65193dfb6c575963f86ddf0fd26d4eef23248000000f858dbffa19052343f", 0x26}, {&(0x7f0000000580)="051a00000e80006558f2878f020000", 0xf}, {&(0x7f0000000740)="849a231c93", 0x5}], 0x3) (async) setsockopt$SO_J1939_FILTER(r1, 0x6b, 0x1, &(0x7f0000000180)=[{0x2, 0x4, {0x0, 0xf0}, {0x2, 0x0, 0x2}, 0x0, 0x1}], 0x20) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000080)=@newtfilter={0x24, 0x11, 0x1, 0x70bd26, 0x25dfdbfc, {0x0, 0x0, 0x74, r2, {0xb, 0xfff2}, {0xfff1}, {0x2, 0xd}}}, 0x24}, 0x1, 0xf0ffffffffffff, 0x0, 0x4004007}, 0x20000050) (async) r5 = accept$phonet_pipe(0xffffffffffffffff, 0x0, &(0x7f0000000000)) ioctl$XFS_IOC_FD_TO_HANDLE(r0, 0xc038586a, &(0x7f00000004c0)={r1, &(0x7f0000000300)='\x00', 0x4, &(0x7f0000000380)={@align, {0x0, 0x3, 0xb, 0x80000001}}, 0x2, &(0x7f0000000440), &(0x7f0000000480)=0x4}) syz_emit_ethernet(0x42, &(0x7f0000000040)=ANY=[@ANYBLOB="bbbbbbbbbbbb00000000000086dd6076b2af00072f00fc000000000000000000000000000000ff0200000000000000000000000000010000883e00"], 0x0) (async) ioctl$PPPIOCSMRU(r6, 0x40047452, &(0x7f0000000500)=0xfff) (async, rerun: 64) getsockopt$PNPIPE_IFINDEX(r5, 0x113, 0x2, &(0x7f0000000100), &(0x7f00000001c0)=0x4) (rerun: 64) 9m44.434497854s ago: executing program 32 (id=1468): r0 = socket$nl_route(0x10, 0x3, 0x0) (async) r1 = socket$can_j1939(0x1d, 0x2, 0x7) socket$nl_rdma(0x10, 0x3, 0x14) (async) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)) (async) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f00000000c0)={'vcan0\x00', 0x0}) bind$can_j1939(r1, &(0x7f0000000340)={0x1d, r2, 0x0, {0x2, 0x0, 0x6}, 0xfe}, 0x18) (async) setsockopt$sock_int(r1, 0x1, 0x6, &(0x7f0000000040)=0x1, 0x4) (async) sendmsg$inet(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000003c0)=[{&(0x7f0000000280)="81b641f1f3843704b6", 0x9}], 0x1}, 0x4048081) (async, rerun: 32) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) (rerun: 32) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r4 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000000240)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}}) (async) writev(r3, &(0x7f0000000400)=[{&(0x7f0000000080)="2e9b3d0007e03dd65193dfb6c575963f86ddf0fd26d4eef23248000000f858dbffa19052343f", 0x26}, {&(0x7f0000000580)="051a00000e80006558f2878f020000", 0xf}, {&(0x7f0000000740)="849a231c93", 0x5}], 0x3) (async) setsockopt$SO_J1939_FILTER(r1, 0x6b, 0x1, &(0x7f0000000180)=[{0x2, 0x4, {0x0, 0xf0}, {0x2, 0x0, 0x2}, 0x0, 0x1}], 0x20) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000080)=@newtfilter={0x24, 0x11, 0x1, 0x70bd26, 0x25dfdbfc, {0x0, 0x0, 0x74, r2, {0xb, 0xfff2}, {0xfff1}, {0x2, 0xd}}}, 0x24}, 0x1, 0xf0ffffffffffff, 0x0, 0x4004007}, 0x20000050) (async) r5 = accept$phonet_pipe(0xffffffffffffffff, 0x0, &(0x7f0000000000)) ioctl$XFS_IOC_FD_TO_HANDLE(r0, 0xc038586a, &(0x7f00000004c0)={r1, &(0x7f0000000300)='\x00', 0x4, &(0x7f0000000380)={@align, {0x0, 0x3, 0xb, 0x80000001}}, 0x2, &(0x7f0000000440), &(0x7f0000000480)=0x4}) syz_emit_ethernet(0x42, &(0x7f0000000040)=ANY=[@ANYBLOB="bbbbbbbbbbbb00000000000086dd6076b2af00072f00fc000000000000000000000000000000ff0200000000000000000000000000010000883e00"], 0x0) (async) ioctl$PPPIOCSMRU(r6, 0x40047452, &(0x7f0000000500)=0xfff) (async, rerun: 64) getsockopt$PNPIPE_IFINDEX(r5, 0x113, 0x2, &(0x7f0000000100), &(0x7f00000001c0)=0x4) (rerun: 64) 3.02573421s ago: executing program 0 (id=8621): r0 = socket$nl_route(0x10, 0x3, 0x0) (async) r1 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000000180)=[@in={0x2, 0x4e21, @local}], 0x10) (async) getsockopt$inet_sctp_SCTP_GET_LOCAL_ADDRS(r1, 0x84, 0x6d, &(0x7f00000001c0)={0x0, 0x10, "78f976f0b629506672c002a7560ee5b6"}, &(0x7f0000000140)=0x18) (async) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @geneve={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GENEVE_LABEL={0x8, 0xb, 0x1, 0x0, 0x4f3e}]}}}]}, 0x3c}}, 0x0) (async) socket$nl_netfilter(0x10, 0x3, 0xc) (async) sendto$phonet(0xffffffffffffffff, &(0x7f0000000140)="81ef525a16b3e8d1a5750b7cec77ae55370337979e842b651488c514ccb3f6d9cae51ed96daccf13d3638b2e64cca6281e567b1fe8e26cfdec3a0db9f882c87ae79937cc857a59f219e372a15818e2b0020e842819aab4ecb66d92255dbbf59b11a50ac29a92170462b007200fd5eeffdcaf8d4de40feb294297fdccbb0c50445667da10faf43fa2e88792924d7a1470dd7f8c7934aeaebf82a14dbeaf29f742542f20d3876002849a91c0070690e812a4399a42676ecf028d44f2d51bcfd9b77dd54b174708ebc9e9438b136c777435b1332c3b74477cdb6d7ee389c530366d0531cb82d56a946f8b48b39a59d74338aacc63b32d1a19b981fe601fb22f1d5cc6ab7aa5bc0181420809628b84905c034b55f7e51539aad3428c8e9950105e46e6de7f5419370c147084178697c4fdbf21b6c0d5ccf1b317501a4d54443e9f61355097443bb46d04a24f46ed594b31", 0x14f, 0x4000000, &(0x7f0000000100)={0x23, 0xda, 0x7, 0x2}, 0x10) (async) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) (async) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0xe, &(0x7f00000004c0)=ANY=[@ANYBLOB="b702000000000000bfa30000000000000703000000feffff7a0af0fff8ffff1971a4f0ff00000000b7060000080000001e6400000000000045040400010000001704000001000a00b7040000000100006a0af2fe00000000850000001a000000b7000000000000009500000000000000455781a5feee5e1ce784909b849d5550adf200000000000000b61d69f2ffdaa10350e11cb97c8ad51bcda0c4ee6d9674c77404ceb9971e43405d621ffbc9a4fd39b0631f6dde53a9a53608c10556e5734eb84049761471ce540c772e2d9f8004e26f7fcc059c062234d5595f6dba87b81d0806fb0289ce67a66afd9ac3d09e29a9d542ca9d85a5c9c88474895d679838def0a83a733dc6a39b63a5ed69d32394c53361d7480884bd8048a967d9b912ef9f1dcc4ff8546fee53f5b2e7b91c61ced1ebad000000000000e8122a793c080a882add4e1179bd4a44f231b6d753a7be428ba953df4aece69311687f4122073a236c3ad198e3f3a532efa04137d452ff47d2638da3261c8362bb7c7824be6195a66d2e17e122040e11e3bd4a69fc6e8d9f7043e09b9e10dc7777bfae5884e4ba1e9cc4a2bbe99e30816127f46a1aae33d4d63d716c0975e1ce4a655362e7062ff6ab3934555c0184021b829472adefa06d3482c7b2711b98eabdca89b77efd13e6dba4a431ce47910000118093b6cabaa17a57727474e1785ee234835088445aa4a9b677d3d342640e328504aea02a2d727e62b7f097a02dbf8fe1d704765de7482040b2fc3000000000000000008947baeaaf954aff687deaa2f80492461d273ee26d8115cbca081a14cba24788779291745083fccdddc90d7af35c528df8000000d8d79c79ddca066da478c197d4a550470557bc99cca336bd88cd28a5ee651627e3a6fbf6ea53b95ddb64c69c7d8d2f4baddc239828760459564124bad68209d2a1d16ad085886c017679cfcda8b1e152ac1e2bcc5ede5b5687aa418abfa29acd7339e73b2cd185c9eb5fb34fccd20ffa155b16c0c309ed6f6663677df37de0ec0d0f548b273940be5d1fe0bae14d1a76bf741330dacd9cc19c0163bcc93059e8d2d1bfa928e2ba458ecd989cb3581a3f270ad48255ac0dad4923e3e36629589ff6b0ceb3438e4b432dd454c04be2d538aaf60c9f7a7281d32142f2fdbc3d37e5a072b5d7f0a349f1a75f01b5c203d4bdde6ff12de9a37f7fb9a16059ad97e2edefb5e0b0326bd25f6fd1d108efa9d30a9883815654486fe42cf2f676cdbf91f7582ab314be"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000340), 0xfffffffffffffe19}, 0x42) setsockopt$sock_attach_bpf(r3, 0x1, 0x32, &(0x7f0000000200)=r4, 0x4) (async) getsockopt$sock_buf(r3, 0x1, 0x1a, 0x0, &(0x7f00000000c0)) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) (async) r5 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) (async) write$tun(r2, &(0x7f0000000300)=ANY=[@ANYBLOB="1c00000e01000b00000014"], 0x36) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000000c0)={'vxcan1\x00'}) 1.838073756s ago: executing program 0 (id=8627): r0 = socket$nl_route(0x10, 0x3, 0x0) (async) r1 = socket$nl_generic(0x10, 0x3, 0x10) (async) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_LIST(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000040)={0x1c, 0x7, 0x6, 0x801, 0x0, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}]}, 0x1c}}, 0x0) (async) sendmsg$L2TP_CMD_SESSION_CREATE(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16], 0x50}, 0x1, 0x0, 0x0, 0x4900}, 0x20000040) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r3, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x4) (async) connect$inet6(r3, &(0x7f0000000300)={0xa, 0x4e23, 0x0, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r3, 0x6, 0x1f, &(0x7f00000002c0), 0x4) (async) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000400)=0x1, 0x4) (async) sendmsg$NFNL_MSG_CTHELPER_NEW(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000140)=ANY=[], 0x14}, 0x1, 0x0, 0x0, 0x20008041}, 0xc000041) (async) setsockopt$inet6_tcp_TLS_TX(r3, 0x11a, 0x2, &(0x7f0000000e80)=@gcm_256={{0x303, 0x36}, "437e509e2d2800", "8b3de2aabceef2a0640000d5a66fd32f419e59f3000000000400", "7d939a3c"}, 0x38) (async) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000100)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_CHANNEL(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)={0x1c, r4, 0x1, 0x70bd29, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r5}, @void}}}, 0x1c}, 0x1, 0x0, 0x0, 0x40001}, 0x800) (async) r6 = syz_genetlink_get_family_id$batadv(&(0x7f0000000240), r1) sendmsg$BATADV_CMD_GET_GATEWAYS(r1, &(0x7f0000000440)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000280)={0x14, r6, 0x10, 0x70bd2b, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x8885}, 0x80) (async) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000340)=@newlink={0x44, 0x10, 0x609, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x88a8ffad}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @bond={{0x9}, {0x14, 0x2, 0x0, 0x1, [@IFLA_BOND_PEER_NOTIF_DELAY={0x8, 0x1c, 0x48c}, @IFLA_BOND_MODE={0x5, 0x1, 0x4}]}}}]}, 0x44}}, 0x0) 1.837610825s ago: executing program 2 (id=8628): socket$nl_route(0x10, 0x3, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB="bc1b0000400007012bbd700000000000027c00000400c2800c000180060006008847"], 0x1bbc}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='rdma.current\x00', 0x26e1, 0x0) close(r2) ioctl$SIOCSIFHWADDR(r2, 0x8b19, &(0x7f0000000000)={'wlan0\x00', @random="7cf1e97c9e4f"}) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$IPVS_CMD_FLUSH(r2, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000180)={&(0x7f00000000c0)={0x1c, r3, 0x2, 0x70bd2c, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x2}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x4000004) sendmsg$IPSET_CMD_FLUSH(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x40, 0x4, 0x6, 0x801, 0x0, 0x0, {0x5, 0x0, 0xa}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}]}, 0x40}}, 0x20004000) 1.794898463s ago: executing program 4 (id=8629): bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000280)={&(0x7f0000000780)=ANY=[@ANYBLOB="9feb01001800000000000000280000002800000002000000000000000000000105000000000000000000000001000085000000000000000001"], 0x0, 0x42}, 0x28) (async) r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) connect$bt_l2cap(r0, 0x0, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) socket$kcm(0x2, 0x3, 0x2) r2 = socket$kcm(0x10, 0x2, 0x4) sendmsg$kcm(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000100)="4c000000140097f87059ae08060c040002ff0f0200000000000001870182fa73a69d35a2cca84708f7abca1b4e7d06a6bd7c493872f750375ed08a560400000003c48f93b82a03000000461e", 0x4c}], 0x1}, 0x0) (async) getsockname$packet(0xffffffffffffffff, &(0x7f00000000c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000140)=0x14) (async, rerun: 64) r3 = socket$nl_route(0x10, 0x3, 0x0) (async, rerun: 64) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0xe, 0x55, &(0x7f0000000380)=ANY=[@ANYBLOB="180000000000000000000000000000000095000000000000008c3219799f99aa88bcef431740d8a8a6bd3c5dddaf61613d30abbefe42119073786f2ca2c429d2475931213cafc09bf438486cdb8b26f2ecc1c784071988e26565960b89de218cfd81f74b78f1ba4fe10b0d9b4a4a1dce259af2968d5490c93f3f96143dc21af199a0df39b7c5e314"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x90) mmap(&(0x7f0000feb000/0x12000)=nil, 0x12000, 0x8, 0x80010, r1, 0x3df92000) (async) sendmsg$nl_route_sched(r3, &(0x7f0000000b40)={0x0, 0x0, &(0x7f0000000b00)={&(0x7f0000000300)=@newtaction={0x68, 0x30, 0x101, 0x0, 0x0, {}, [{0x54, 0x1, [@m_connmark={0x50, 0x1, 0x0, 0x0, {{0xd}, {0x20, 0x2, 0x0, 0x1, [@TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x0, 0x0, 0x9}}}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x68}}, 0x0) syz_emit_ethernet(0x1f, &(0x7f00000000c0)={@empty, @link_local={0x3}, @void, {@llc_tr={0x11, {@snap={0x0, 0xab, 'I', "282896", 0xd, "f69b32a2a5cb407308"}}}}}, 0x0) (async) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=@newlink={0x24, 0x10, 0x300, 0x0, 0x0, {0x7a}, [@IFLA_IFALIASn={0x4}]}, 0x24}, 0x1, 0x0, 0x0, 0x34041043}, 0x0) socket$inet_sctp(0x2, 0x4, 0x84) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0000000000008000280012800a00010076786c616e00"], 0x50}}, 0x4008840) 1.590046302s ago: executing program 2 (id=8631): bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x6, 0xb, &(0x7f0000000180)=@framed={{0xffffffb7, 0x5, 0x0, 0x0, 0x0, 0x61, 0x10, 0x6a}, [@printk={@li, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x6}}]}, &(0x7f00000002c0)='GPL\x00', 0x5, 0xbc, &(0x7f0000000300)=""/188, 0x0, 0x11, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000080), 0x10, 0xffffffffffffffff}, 0x94) accept4$bt_l2cap(0xffffffffffffffff, &(0x7f00000000c0)={0x1f, 0x0, @none}, &(0x7f0000000100)=0xe, 0x800) r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r1 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) bind$nfc_llcp(r1, &(0x7f0000001040)={0x27, 0x0, 0xffffffffffffffff, 0x5, 0x0, 0x0, "d92984bd1ca44c226af5160e961711a077609475b78411e88509de050000000000f2170e65e3f50327e422000000000000000000000200000000001900", 0x3c}, 0x60) syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) (async) r2 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) bind$nfc_llcp(r2, &(0x7f0000000080)={0x27, 0x0, 0x0, 0x3, 0x0, 0x5, "750538440ff92fe2aaf1beea7cdcc151042cd9893bc31f80716a120d8be6d7f81cd81ec275000386e7255f0669b740a5418d69d00000d51de08a00ee1d9a34", 0x400000011}, 0x60) ioctl$sock_ifreq(r0, 0x8993, &(0x7f0000000040)={'vlan0\x00', @ifru_mtu=0x800}) (async) ioctl$sock_ifreq(r0, 0x8993, &(0x7f0000000040)={'vlan0\x00', @ifru_mtu=0x800}) 1.572463725s ago: executing program 1 (id=8632): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuacct.usage_sys\x00', 0x275a, 0x0) r1 = socket(0x40000000015, 0x5, 0x0) bind$inet(r1, &(0x7f0000000340)={0x2, 0x0, @loopback}, 0x10) r2 = socket(0x15, 0x5, 0x0) getsockopt(r2, 0x200000000114, 0x2715, 0x0, &(0x7f0000000000)) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x300000d, 0x13, r0, 0xd7735000) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x1e, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000005000000000000000000711232000000000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24, r0}, 0x94) 1.506975194s ago: executing program 5 (id=8633): r0 = socket(0x2a, 0x2, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000400)={&(0x7f00000005c0)=@newqdisc={0x24}, 0x24}, 0x1, 0x0, 0x0, 0x800}, 0x0) getsockname$packet(r0, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000040)=0x14) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000440)=@newqdisc={0x44, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_FSC={0x10, 0x2, {0x9, 0x5}}}}]}, 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=@newtfilter={0x58, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {0x0, 0x9}, {}, {0x1, 0xfff1}}, [@filter_kind_options=@f_cgroup={{0xb}, {0xfffffd6d, 0x2, [@TCA_CGROUP_EMATCHES={0x24, 0x3, 0x0, 0x1, [@TCA_EMATCH_TREE_LIST={0x18, 0x2, 0x0, 0x1, [@TCF_EM_IPT={0x14, 0x1, 0x0, 0x0, {{0x3, 0x9, 0x80}, [@TCA_EM_IPT_HOOK={0x8, 0x1, 0x4}]}}]}, @TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x6}}]}]}}]}, 0x58}}, 0x1) r2 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r2, &(0x7f00000002c0), 0x40000000000009f, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=@can_delroute={0x40, 0x19, 0x1, 0x70bd2a, 0x25dfdbff, {0x1d, 0x1, 0x6}, [@CGW_MOD_SET={0x15, 0x4, {{{0x3, 0x1, 0x1, 0x1}, 0x8, 0x1, 0x0, 0x0, "6698c13a70ca67e7"}, 0x2}}, @CGW_FILTER={0xc, 0xb, {{0x4, 0x1}, {0x2, 0x0, 0x0, 0x1}}}, @CGW_CS_XOR={0x8, 0x5, {0x4, 0xfffffffffffffffa, 0xfffffffffffffff8, 0xc}}]}, 0x40}, 0x1, 0x0, 0x0, 0x800}, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f000000c280)={&(0x7f0000000380)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x101, 0x0, 0x0, {0x5}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x60, 0x3, 0xa, 0x301, 0x0, 0x0, {0x5}, [@NFTA_CHAIN_ID={0x8, 0xb, 0x1, 0x0, 0x4}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz0\x00'}, @NFTA_CHAIN_FLAGS={0x8, 0xa, 0x1, 0x0, 0x3}, @NFTA_CHAIN_HOOK={0x28, 0x4, 0x0, 0x1, [@NFTA_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x12}, @NFTA_HOOK_HOOKNUM={0x8}, @NFTA_HOOK_DEV={0x14, 0x3, 'netdevsim0\x00'}]}, @NFTA_CHAIN_POLICY={0x8}]}], {0x14}}, 0xa8}}, 0x0) 1.41781782s ago: executing program 0 (id=8634): ioctl$PPPIOCSNPMODE(0xffffffffffffffff, 0x4008744b, &(0x7f0000000000)={0x3d, 0x1}) r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_tcp_SIOCOUTQNSD(r0, 0x894b, &(0x7f0000000040)) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r1, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x28, 0x2, 0x3, 0x5, 0x0, 0x0, {0x7, 0x0, 0x4}, [@NFQA_CFG_FLAGS={0x8, 0x5, 0x1, 0x0, 0x28}, @NFQA_CFG_PARAMS={0x9, 0x2, {0x7f, 0x2}}]}, 0x28}, 0x1, 0x0, 0x0, 0x20000044}, 0x4040881) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(0xffffffffffffffff, 0x84, 0x72, &(0x7f0000000180)={0x0, 0x9, 0x20}, &(0x7f00000001c0)=0xc) setsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r2, 0x84, 0x6, &(0x7f0000000200)={r3, @in6={{0xa, 0x4e21, 0xd7e, @dev={0xfe, 0x80, '\x00', 0x30}, 0x200}}}, 0x84) getsockopt$inet_sctp6_SCTP_PR_SUPPORTED(r2, 0x84, 0x71, &(0x7f00000002c0)={r3, 0x6}, &(0x7f0000000300)=0x8) r5 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_AUTH_DEACTIVATE_KEY(r5, 0x84, 0x23, &(0x7f0000000340)={r4, 0x6}, 0x8) r6 = socket$inet_sctp(0x2, 0x5, 0x84) getsockopt$inet_sctp_SCTP_RECVNXTINFO(r6, 0x84, 0x21, &(0x7f0000000380), &(0x7f00000003c0)=0x4) r7 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000440), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKINFO_SET(0xffffffffffffffff, &(0x7f0000000500)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000480)={0x2c, r7, 0x100, 0x70bd29, 0x25dfdbfc, {}, [@ETHTOOL_A_LINKINFO_TP_MDIX_CTRL={0x5, 0x5, 0xf}, @ETHTOOL_A_LINKINFO_TP_MDIX_CTRL={0x5, 0x5, 0x1}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x7}]}, 0x2c}, 0x1, 0x0, 0x0, 0x800}, 0x40084) setsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r5, 0x84, 0x18, &(0x7f0000000540)={r3, 0x3}, 0x8) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$nl80211(&(0x7f00000005c0), 0xffffffffffffffff) sendmsg$NL80211_CMD_GET_MPATH(r8, &(0x7f00000006c0)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000680)={&(0x7f0000000600)={0x68, r9, 0x8, 0x70bd25, 0x25dfdbff, {{}, {@void, @void}}, [@NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @device_b}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @device_b}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @device_b}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa}]}, 0x68}, 0x1, 0x0, 0x0, 0x1}, 0x4008040) setsockopt$pppl2tp_PPPOL2TP_SO_LNSMODE(r1, 0x111, 0x4, 0x1, 0x4) socket$caif_stream(0x25, 0x1, 0x0) syz_emit_ethernet(0x155, &(0x7f0000000700)={@remote, @random="6b432a975da7", @val={@val={0x88a8, 0x7, 0x1, 0x1}, {0x8100, 0x6, 0x0, 0x3}}, {@mpls_uc={0x8847, {[{0x0, 0x0, 0x1}, {0x81, 0x0, 0x1}, {0x2e4}, {0xffe00, 0x0, 0x1}, {0x9, 0x0, 0x1}, {0x44, 0x0, 0x1}, {0x100, 0x0, 0x1}, {0x2, 0x0, 0x1}, {0x7, 0x0, 0x1}], @ipv4=@dccp={{0x11, 0x4, 0x2, 0x0, 0x11b, 0x68, 0x0, 0xb, 0x21, 0x0, @private=0xa010100, @empty, {[@timestamp_addr={0x44, 0xc, 0x86, 0x1, 0x8, [{@remote, 0x7fffffff}]}, @cipso={0x86, 0x22, 0x2, [{0x3, 0xf, "1e6fa1246f99709882b20d2a4e"}, {0x5, 0xa, "163c67d7cae41ed2"}, {0x2, 0x3, 'O'}]}]}}, {{0x4e20, 0x4e23, 0x4, 0x1, 0x9, 0x0, 0x0, 0xb, 0x2, 'TK\b', 0x5, "1c0469"}, "d6f68e43ed42dd22a5a9e256023d70a37c70ac34d9f23e81f2b4e096fb74f9b16e0a54068b6b94bcbe0efcdf843f6d79e4119aa91d8d5699d79a235b2096fe977af99fbfe2ebc0b5a2f814943bb849234f7023a26c4e0e2a06d9270fe6cd9dda46415cef56bd05660878fe6c8eab3f8c626ba2a1fc32af9c16e6757cf300166e82bbf2c21552864f56d05cac5dda1d5b495c0769e95f92675abb1adf6d53d242967ab43f1b937a4e3eae2314f9532834fef06d959a667ba8617aa1068f86fa751d81e062ef8677"}}}}}}, &(0x7f0000000880)={0x0, 0x2, [0x4, 0x7bb, 0x950, 0x80e]}) ioctl$F2FS_IOC_GET_COMPRESS_BLOCKS(r2, 0x8008f511, &(0x7f00000008c0)) r10 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r11 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000940), 0xffffffffffffffff) sendmsg$IEEE802154_LLSEC_LIST_SECLEVEL(r10, &(0x7f0000000a00)={&(0x7f0000000900)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x14, r11, 0x8, 0x70bd28, 0x25dfdbff, {}, ["", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x804}, 0x80) ioctl$FS_IOC_GETFLAGS(r6, 0x80086601, &(0x7f0000000a40)) r12 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000ac0), r8) sendmsg$TIPC_NL_NAME_TABLE_GET(r8, &(0x7f0000000cc0)={&(0x7f0000000a80)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000c80)={&(0x7f0000000b00)={0x154, r12, 0x200, 0x70bd27, 0x25dfdbfb, {}, [@TIPC_NLA_MEDIA={0x140, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_PROP={0x1c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xf}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xffff0000}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x200}]}, @TIPC_NLA_MEDIA_PROP={0x54, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0xfa7f}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x37ae}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xfff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x4}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}]}, @TIPC_NLA_MEDIA_PROP={0x3c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9d}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x5}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xc}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xd}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x80000001}]}, @TIPC_NLA_MEDIA_PROP={0x34, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x400}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x34}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x9}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xae2}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x67e}]}, @TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_PROP={0x4}, @TIPC_NLA_MEDIA_PROP={0x3c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x4746}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x18}]}, @TIPC_NLA_MEDIA_PROP={0x14, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x9}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}]}]}]}, 0x154}, 0x1, 0x0, 0x0, 0x4010}, 0x80c5) getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(r6, 0x84, 0x6f, &(0x7f0000000d80)={r3, 0x74, &(0x7f0000000d00)=[@in6={0xa, 0x4e24, 0x9, @private2, 0xee5}, @in6={0xa, 0x4e24, 0x9, @loopback, 0x6}, @in6={0xa, 0x4e23, 0x10001, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x4}, @in={0x2, 0x4e22, @multicast1}, @in={0x2, 0x4e21, @multicast2}]}, &(0x7f0000000dc0)=0x10) 1.415754199s ago: executing program 4 (id=8635): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000c80)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_fq={{0x7}, {0x1c, 0x2, [@TCA_FQ_FLOW_DEFAULT_RATE={0x18, 0x10, 0x3}, @TCA_FQ_FLOW_MAX_RATE={0x13, 0x2}, @TCA_FQ_FLOW_PLIMIT]}}]}, 0x48}}, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(r5, &(0x7f0000001980)={0x0, 0x0, &(0x7f0000001940)={0x0, 0xf4}, 0x1, 0x0, 0x0, 0xc001}, 0x4000000) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r6, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c0002000800010005"], 0x3c}}, 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newlink={0x54, 0x10, 0xffffff1f, 0xfffffffc, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x34080}, [@IFLA_LINKINFO={0x2c, 0x12, 0x0, 0x1, @gretap={{0xb}, {0x1c, 0x2, 0x0, 0x1, [@IFLA_GRE_ENCAP_TYPE={0x6, 0xe, 0x2}, @IFLA_GRE_ENCAP_FLAGS={0x6, 0xf, 0x7}, @IFLA_GRE_REMOTE={0x8, 0x7, @dev={0xac, 0x14, 0x14, 0x28}}]}}}, @IFLA_MASTER={0x8, 0xa, r6}]}, 0x54}}, 0x0) socket(0xc, 0x4, 0x0) 1.354458654s ago: executing program 1 (id=8636): r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_SET(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[], 0x18}, 0x1, 0x0, 0x0, 0x4048c90}, 0x240048c1) 1.346980803s ago: executing program 0 (id=8637): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-camellia-aesni-avx2\x00'}, 0x58) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) r2 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$IP_VS_SO_SET_ADD(r2, 0x0, 0x482, &(0x7f0000000000)={0x84, @rand_addr=0x64010100, 0x4e22, 0x2000003, 'sh\x00', 0x2f, 0x4, 0x76}, 0x2c) sendmsg$NFT_BATCH(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01020000000000000000010000000900010073797a30000000006c000000160a01000000000000000000010000000900010073797a30000000000900020073797a3000000000400003800800014000000000080002400000fbff2b0003801400010067656e6576653000000000000000000014000100776732000000000000000000c6e49c0f5c000000180a0101000b000000000000010000000900020073797a30000000000900010073797a3000000000300003802c000380140001"], 0x110}}, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r3 = accept4(r0, 0x0, 0x0, 0x800) r4 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)) sendmsg$nl_route(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000180)=@newlink={0x38, 0x10, 0x439, 0x70bd2c, 0xffffffea, {0x0, 0x0, 0xe403, 0x0, 0x40083, 0x715cb}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @sit={{0x8}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPTUN_PROTO={0x5}]}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x8000}, 0x4040) sendmsg$netlink(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)=[{&(0x7f0000000680)={0x2c8, 0x2d, 0x20, 0x70bd26, 0x25dfdbfd, "", [@nested={0xed, 0x153, 0x0, 0x1, [@typed={0x14, 0xd1, 0x0, 0x0, @ipv6=@dev={0xfe, 0x80, '\x00', 0x15}}, @generic="5880f99bd1cad6b2644d2d5c13f1189f07a308b9079169ec5a99c5f8568c055839421be1980d4181d0045a51789fa718631b3efca253a72d3bdc983748b74bab93f3c9069fa7bbc018c801898b8947fe40cc4791bf93a85fbd141b5438b8f8f46b3b30e68a555f0a608c9332f47fb26c49d99ab38c3ab7022c5cdb73516c37ea01a95d230f510eeef733bda862defa9e773e0e2758764044c2840e3542ff00ab944e26b4841a990fd70dc217eb5a61f091589fbac6fa999e709ebf13090975b2ba", @typed={0x8, 0x13a, 0x0, 0x0, @fd=r3}, @typed={0x8, 0x95, 0x0, 0x0, @u32=0x8}, @nested={0x4, 0x13}]}, @typed={0x8, 0x119, 0x0, 0x0, @fd=r3}, @generic="cfac59c431012902cc88b8ef957075fb2ad1c5e3940e88012a8df97f0b329b14cbce7070b8c691471e70d91b20c06541b9d1e448e424cb23530fa79b008f2dfbd5270db2d1cb7f0a208b96d3d9ca3d5b95bd207d16bcb8a52c48e554595bcd8f4d04e27449823b6cf2", @typed={0x4, 0x152}, @generic="85e5cb70b7cc941e03b4c030ab3e526abd70e37785fe27fd65b53939575ce17754169b9120b8c1fc2c9fab9a78f754029a6d291578aca8cd1162da05d15c4c94f61727c14be962b249735a77802cfe7b4482a163eb1b19ae85309d65d6eb626119106f9b69ab4d84f66873b4e6bef5d9df94ca370b17318d3d3cfd0fbaf92f32155067e85df752dc4c1886d6c579e7aebba7172c56e7ecc27a329eddb5c5e7e68778163a0d773ba1", @nested={0xa5, 0x83, 0x0, 0x1, [@generic="850350eb4fc2470f007e9ff305c4fded15bc97de214a4324d51ab6e3d1c561bdfbe1325aac0333ef0f8218e8f2301924cc9b773a0889b37d1a3abc57664cd5666149d04b8ddd9ff01fa5683c5ef5b964f589bb49b8d259df31d5461c4c374503210adffc17431d0b4b61ee56e692b79c76bee78da1c629e6e6907bf708893428b996760e7cd4f75d715d08710b7e9d2e33a38d1bad37570937", @nested={0x4, 0xfe}, @nested={0x4, 0x153}]}]}, 0x2c8}, {&(0x7f0000003980)={0xf0, 0x1e, 0x200, 0x70bd26, 0x25dfdbfc, "", [@generic="57d052cb8b62b78c947f6a4a44ed981bb86090304eb6c59fc2e04516fcc23beb7367ecf65346a19375c9ce2d29d8c8", @generic="4ec2bc2c0fa538eb5f5f2411c89cf47e2f9a33a5caf1bb2a83ec0a0a0b51ef9f75970f569b1b9ba45bc4dd6bcdbca56c9b89fe79a809205730a6d6aabee9e3cc58e28f41c20d002484b42be7eb435c942c579099a9332322be9f", @typed={0x21, 0x132, 0x0, 0x0, @binary="7fadf946fb6387b73dbf3dce84ac56edf90783df1ffb8d8714095714ed"}, @nested={0x2d, 0x34, 0x0, 0x1, [@nested={0x4, 0x11e}, @generic="fc14272bd63ca0ca0615edb69936c9927dfbd8b8f56a7663e65fcd53d18d13ab6e346f99b3"]}]}, 0xf0}, {&(0x7f0000003a80)={0x48, 0x32, 0x200, 0x70bd27, 0x25dfdbfd, "", [@typed={0x14, 0xcf, 0x0, 0x0, @ipv6=@private2}, @nested={0x21, 0x7b, 0x0, 0x1, [@generic="f587245362da89f9d0f8acb9dc1248b3a87e32fa63ce2813a066421dc4"]}]}, 0x48}], 0x3, 0x0, 0x0, 0x4c0d1}, 0x404c014) recvmsg(r3, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0xff40}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) 1.242652314s ago: executing program 2 (id=8638): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x2000}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket(0x400000000010, 0x3, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r4, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x2}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x0, 0x3}}}]}, 0x38}}, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket(0x400000000010, 0x3, 0x0) r7 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newtfilter={0x70, 0x2c, 0xd27, 0x30bd29, 0x25dfdbfd, {0x0, 0x0, 0x0, r8, {0x4, 0xf}, {}, {0x7, 0xd}}, [@filter_kind_options=@f_cgroup={{0x5}, {0x40, 0x2, [@TCA_CGROUP_EMATCHES={0x3c, 0x3, 0x0, 0x1, [@TCA_EMATCH_TREE_LIST={0x30, 0x2, 0x0, 0x1, [@TCF_EM_CANID={0x14, 0x1, 0x0, 0x0, {{0x800, 0x7, 0x1}, {{0x0, 0x0, 0x1}, {0x3, 0x1, 0x1}}}}, @TCF_EM_CMP={0x18, 0x2, 0x0, 0x0, {{0x3, 0x6e4, 0xc}, {0x4, 0x80000000, 0x3, 0x1, 0xf, 0x1}}}]}, @TCA_EMATCH_TREE_HDR={0x8, 0x1, {0xee4}}]}]}}]}, 0x70}, 0x1, 0x0, 0x0, 0x10}, 0x0) r9 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f0000006040)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000006100)=@delchain={0x24, 0x65, 0x1, 0x70bd2e, 0x25dfdbff, {0x0, 0x0, 0x0, r10, {0xffff, 0xc}, {}, {0xfff2}}}, 0x24}, 0x1, 0x0, 0x0, 0x8848}, 0x20004004) r11 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r11, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000280)=@newtfilter={0x24, 0x2c, 0xd27, 0x70bd28, 0x25dfdbfe, {0x0, 0x0, 0x0, r12, {0x0, 0xffe0}, {}, {0xa, 0xfff3}}}, 0x24}, 0x1, 0x0, 0x0, 0x22044028}, 0x40040) 1.228036273s ago: executing program 5 (id=8639): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000300)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000070000000900010073797a300000000044000000090a090400000000000000000700000008000a40000000000900020073797a31001c00000900010073797a30000000000800054000000031080003400000000114000000110001"], 0x8c}, 0x1, 0x0, 0x0, 0x20008094}, 0x48854) 1.14822747s ago: executing program 1 (id=8640): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1400000016000107030000000000000007"], 0x14}, 0x1, 0x0, 0x0, 0xc4}, 0x0) r1 = socket(0x2a, 0x2, 0x0) sendmsg$TIPC_NL_LINK_GET(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000280)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f00000001c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000380)=@newqdisc={0x2c, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {0x0, 0xffe0}, {0xffff, 0xffff}, {0x0, 0xe}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}}, 0x40000) sendmsg$nl_route_sched(r1, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000140)=@newtfilter={0x3c, 0x2c, 0xd27, 0x0, 0x25dfdbfd, {0x0, 0x0, 0x0, r2, {0xfffa, 0xfff3}, {0x0, 0xffe0}, {0xf, 0xfff9}}, [@filter_kind_options=@f_flower={{0xb}, {0xc, 0x2, [@TCA_FLOWER_KEY_IPV4_SRC={0x8, 0xa, @local}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x1}, 0x4) r3 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r3, &(0x7f00000002c0), 0x40000000000009f, 0x0) 1.078678448s ago: executing program 0 (id=8641): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000700)=ANY=[@ANYBLOB="140000001000010000000000000000000100000a20000000000a010400000000000000000100000309000100737900002c000000030a01010000000000000000010000000900010073797a30000000000900030073797a32000000008c000000060a010400000000000000000100000008000b400000000064000480340001800b000100657874686472000024000280080001400000000c0800034000000000080004400000002205000200070000002c0001800c00010062697477697365001c0002800800034000000002080001400000001408000240000000120900010073797a3000000000140000001100010000000000000000000700000a00000000"], 0x100}, 0x1, 0x0, 0x0, 0x1}, 0x408c4) r1 = socket$vsock_stream(0x28, 0x1, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'xts-aes-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f0000000300)="c99b57381801238c09d0ff0f1d0dbd301e5a47b2f3caa73dcd2a6a370554375a", 0x20) r3 = accept$alg(r2, 0x0, 0x0) sendmmsg$alg(r3, &(0x7f0000005fc0)=[{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800}], 0x1, 0x800) recvmmsg(r3, &(0x7f0000000180)=[{{0x0, 0x0, 0x0}, 0xd78a}, {{0x0, 0x0, &(0x7f00000007c0)=[{&(0x7f0000000380)=""/15, 0xf}], 0x1}}], 0x2, 0x0, 0x0) r4 = socket(0x1, 0x2, 0x0) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0f000000040000000400000012"], 0x50) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000140)={r5, &(0x7f0000000180), &(0x7f00000000c0)=@tcp6=r4}, 0x20) setsockopt$inet6_IPV6_ADDRFORM(0xffffffffffffffff, 0x29, 0x1, &(0x7f0000000400), 0x4) close(r4) getsockopt(r1, 0x200000000114, 0x8, 0x0, 0x0) syz_open_procfs$namespace(0x0, &(0x7f0000000000)) close(0x3) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r6, &(0x7f0000000000)=ANY=[], 0x10448) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r6, 0x0) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='memory.events\x00', 0x275a, 0x0) ioctl$FS_IOC_RESVSP(r7, 0x40305828, &(0x7f0000000180)={0x0, 0x2, 0x8, 0x7100000}) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, r7, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000440)={{r5, 0xffffffffffffffff}, &(0x7f00000002c0), &(0x7f00000003c0)=r3}, 0x20) r9 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0200000004000000e27f000001"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x11, 0xc, &(0x7f0000000480)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r9, @ANYBLOB="0000000000000000b7080000134c2651638af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], &(0x7f0000000e80)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000540)=@bpf_tracing={0x1a, 0x2, &(0x7f0000000080)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x1}], &(0x7f0000000100)='GPL\x00', 0x3, 0x0, 0x0, 0x41000, 0x10, '\x00', 0x0, 0x1c, r6, 0x8, &(0x7f0000000240)={0x7, 0x5}, 0x8, 0x10, &(0x7f0000000280)={0x0, 0x10, 0xfffffff7}, 0x10, 0x24560, r1, 0x6, &(0x7f0000000480)=[r7, r5, r5, r5, r8, r5, r5, r2, r9, r5], &(0x7f00000004c0)=[{0x1, 0x1, 0x5, 0x19}, {0x0, 0x3, 0x4, 0x8}, {0x5, 0x1, 0x10}, {0x1, 0x3, 0xc, 0x4}, {0x4, 0x1, 0xf, 0x1}, {0x4, 0x3, 0xf, 0x1}], 0x10, 0xa}, 0x94) 1.056750532s ago: executing program 4 (id=8642): sendmsg$kcm(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000480)=[{&(0x7f0000000000)="1400000010003507d25a806f8c6394f903", 0x11}], 0x1}, 0x0) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb79100a6c52d922ba2a05dd4242"], 0xfdef) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffe}, 0x90) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000240)={&(0x7f0000000380)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x28, 0x28, 0x3, [@array={0x0, 0x0, 0x0, 0x3, 0x0, {0x3, 0x2, 0x6}}, @var={0x1, 0x0, 0x0, 0xe, 0x5, 0x1}]}, {0x0, [0x61]}}, 0x0, 0x43, 0x0, 0x1, 0x4}, 0x20) r0 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00'}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r0, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) 1.020712223s ago: executing program 5 (id=8643): r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000000)=ANY=[@ANYBLOB="1c00000002030104000000000000"], 0x1c}}, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-asm\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000003c0)={0x1e, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x1, 0x2, 0x3, 0x2, 0x1, 0x11}]}, &(0x7f0000000380)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x4}, 0x94) r3 = accept4(r2, 0x0, 0x0, 0x80800) sendmmsg$alg(r3, &(0x7f0000000040)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r3, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x51}], 0x1}, 0x0) sendmsg$NFQNL_MSG_CONFIG(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=ANY=[@ANYBLOB="1c0000000203030000000000000000000000000008000100020000"], 0x1c}}, 0x0) ioctl$sock_netrom_SIOCADDRT(r0, 0x890b, &(0x7f0000000000)={0x1, @default, @bpq0, 0x400, 'syz0\x00', @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, 0x1, 0x2, [@netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @default, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null]}) 895.783215ms ago: executing program 0 (id=8644): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000004c0)={0xffffffffffffffff}) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET(r2, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000580)={0x44, 0x1, 0x1, 0x201, 0x0, 0x0, {0x2}, [@CTA_TUPLE_ORIG={0x24, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @loopback}, {0x8, 0x2, @empty}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x3a}}]}, @CTA_FILTER={0xc, 0x19, 0x0, 0x1, [@CTA_FILTER_ORIG_FLAGS={0x8, 0x1, 0x94d}]}]}, 0x44}}, 0x0) recvmsg(r1, &(0x7f00000006c0)={0x0, 0x0, 0x0}, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000001140)={0x0}}, 0x0) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x3000004, 0x3032, 0xffffffffffffffff, 0x0) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f0000001580)={0x0, @in={{0x2, 0x0, @empty}}}, &(0x7f0000000540)=0x9c) r4 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_inet_SIOCSIFFLAGS(r4, 0x89f2, &(0x7f0000000280)={'ip6tnl0\x00'}) r5 = socket$inet(0xa, 0x801, 0x84) connect$inet(r5, &(0x7f0000004cc0)={0x2, 0x0, @private=0xa010100}, 0x10) listen(r5, 0x2) r6 = socket$nl_route(0x10, 0x3, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000200)='ns/uts\x00') unshare(0x6a040000) r7 = socket(0x8, 0x3, 0x3) ioctl$sock_netrom_SIOCADDRT(r7, 0x6180, 0x0) ioctl$BTRFS_IOC_RM_DEV(r7, 0x5000940b, &(0x7f0000000e80)={{r6}, "83c6908add422e4e5c53fda7f931b28bd76fb2f7018e45240dfeecc6bcdabd949d6a4934e60711cfc9dbc2e587e5259008533da3f9f6d2d8009b2a74fc14a9a4c5f101a12b9126624fb31c361f1ca0dc0c928af8b9d2ba3bc1774a0f4df48effab76e8090f9a5839165e6b9914020042d039153ce6a1f3cdba480968d37cf7893537851b536b4a984bec0496afa79aec664ca7ce622727b2d593dc61d280c6586557c67e5a71d6599b578d3ba7643806bb4c00ec132589ff0d989728946f6dc89c621f4115e6a8d2b1d02cc33fd328ef6cb06590eb2fe5f06e7e03ac5b402f297ce98ce36ab5a663db45f7f0b3f5aa155f8d9d2cd6d3192312ec7777cf5e9268a7b5b8f2c5c6a879e983ade09fbcaef3eb484376ff6d48ab39c306ff548d865ad24459c38be5f366b8f46189c360ecdabc1338919482aeac731c3a44ddb852d40e7c264690d781de861b4d90088ee065890191bd971f4a1b0df720e73720f9bcae4eb41671c76ddf38e56cf057623af148297f4f2330c039d189b7c3765187305f32161c024561890712b57b2c3eccca6c1bed6f7d394cba5ee1fc92b4048e669c7e0ca054b1eab5dae35d686fbb5e76fc0d994f82d910c4ffcc797f82b962bfedee97f5dabccdbe13b6c1a7e330fe35621fe35db2fe28ddfe7841fb41eb5e2a99cc5e735ddd7ba8ca682cbccf3a9ff272ec56080c181a49d9ddd5e5d620ac3082ef5192a244786650bbfb60f562b6b20b0ff66b89f7208035a91a83ba462bb689e5191c89de00f2809073eb2c43d372e3f32ecdacfeed730cda575ff4601cf183c1f4852c52456791a507517262512f6c5409b730d550dee06e452038114b632c1a8b6effc56ea66e0a9e1a19eaabd02b6046b5a5b6ec7bde25ab28cb14f6d75c915d665634008914946e3fa89ce290849dd61012d51e61243186b190d6e292bb6ebd1801a49c9b6d7a181caf55e19af82677c5720fecac2d25f3ab5cfeba0aece417a8eadb1226236b658d8282fb33f8022b7e96ce8987061c1e9523daba346ce83a36c9fc9674ca020ef1a3dcd8c476419ac09b8590503ca6caff3c95920549386ab179e371b5a066197c4a0e27687c83db64b82b4386fee7e490d0622a52152b510b5132cad151626c5956e3369767ef76044c6ece6f70833dcf2b5b6c505b6fd699835261c9b903cb0b549e767b7f20eeca5946755754081dd6af04cbf8e52546ce7ed84f39618e4ee4dce70436ac6f918bdc4870a76a750af3a89f447e158524d29b981da4703faf6e88b7efb2eb9423f1e805e074a64fd84cf7fb70f00caae366e793b3a47d71c28e40713c6c944c2b54384bbfa9928d62503ca8118fe9ad3de88de0ee259199154b0d97f003336c333ad9ab14e4afdb2edcdf0ab35a650f1e2dc3f7579199bc974bd3f0a526505958b86f15b6f456c695c3f63142754383e1ee72853b6b349a0f39ba9b0c8e13e388ed8a8aa771811ae69b35accd15561378b62085e9563cc08fc7c0ce988d72f888040a7910c84a925eae45b40dcf63c662d4e1c71798d79c3f0c09cb4ddf3cb278e2b19d9b3aa68ee9a12b01cef96bd0b2910ed2acc6134f69123965b7d608db90d0c69e5984e37b11092a089e8d1cc58c1a69dd3af138dd6136367b1128714452d0d0880c297fc79fa3cfa5a97274df1a50442d6d7119aea04aae492bdd451662143b37729313c391fb9f8bd468861fbb2b1aa6f22eb431a87c3ae8793cf03062e39f795bcd4b3dc2e160036f4c9591d28a6fda3528781e1ad779c19a38f73b1f3102e1597cc3206d2722b58360950d72595c0bb1236f6fe24518d8cc3b9cba4854fd5f31689028456b3875a5f8722a8b73c89cb0cbdce7a8681e31dfc61881910f85aa0df0735b55b3a17a030476ad2f5100a1eedacb5984018a1e798411fe87fd597218533fa29c7ca29bd09718a763f2c523523ca1c00a33af53694a7c47346abd5258abadf7df397464b8cc025ae7e1039070aae64fd567ec619f067d92c9d889384cab7575ac8d91a3cc6d9847ddd5233152c52d4ad2f3424521289363aa7396ba85c17a3685504e7a4210038ce5e1ed8a71d32162a76ee3a3c281d717aa97748b4d5ca4be24501c7f668fc11502fd7bbc1ecb0cfaab4b984fb65ae0b883ba90504edb78506a12d2e9b1a7e2dba206c5b586d7ed85afae995e2117adc162aaa51cb544b1d2bf1fed2968b6e9d9a3d634ec85c202a67352022879d965a665651edc8060a70bc38772d28c45d637af5506dd3ba7ac0aa728a447a1535ece659f67b79645a1611c7a33cd93bd07f2edf98395dd4ced4edc5617ae2ae37aa094ed7c6d95d356885b40e07d68bf5ef5fe55f0a6a9946b3dbfa0080cf22ac58a5ff25b1459bb3d45fe1a1cfa3103ccdf67aaa0a0d02448b581b658de820820102a8f72bf6cf95316ebfef4103e8cf945f4b94642809811e448beb605504bec935cab7f460f544f336bd2768131de4664321474ae7d863a05f45bcb2da8d8d314e6d28688e69e92ab9e7bf042c22b3afa08c7e8fdc16789199a195bfdc7f6be45efdd3e37499a9a7f814f3a6ec6a83768ec7d50974a6975594efa07676658e74bbd435090b9d0ffc487d35671750e6a3731d43f5405f97fc1e23d480d0a8381f568b1376059fec71a32c9de27a73660d028c2ab18db06b484a6355200092f785047ea59b4fd6e7433b914ccbda79d0e05145d8a2c3971bafff07a71c0448041f00484fffd971cf0c0f1601a0b1168d7f5dc60934aef2514c2468939967e420154ddc11cb8f410c6e431245129769aaf8302f0b2c4fb0eb95e4a9b515e5bbad42db0b10b9eee2e90f11ebd226ed253a6d375603cf0f1f6a4249a58341688af710f3cbb4cc05af2fbe79285fe989b4020b1e90a04d84d13e8659fe0c0116b558fe56e9f816dbf3c9e0f69e9939e0eca82a326dd68af0a6bfc42ed64f3fcef9ebfe1ff60089ef4ee2799aa6a796ef6276ee94938006f5bc6cbab1020230dcc55c7edf2c2248d2f7e49e9d3b426fab5ed5f23fc2d67be37468477c9cb27ff3e55f7c37bcdde605d8dd973a3945fbab6f2091c277cd7de760014e785bc3d45960c44736a333a0b8de07c7e86634cfd061ab7f0450a613ba4442797e995a8bb5f6f373d9444172a8f9086313c7956cc538535ee4d6056fa05e25ea23b49d27c0df03b44717e5e47985296159e2b19ba1eb9afd283a158b4335a6c4f9127c9149897de05c5d17596ab2f3ba23eb6526519558ed8b9dd5c1de4a2a87d9eea6481a0bb514a405cc970d1a129d46494f0fe9e649b849eb4e20206d021e7cd1fefe4e9fa5ddf4fa6237804599e681464e624da3502f2f6740f86242ff31bf475982246c93b55bcd0c1e60dee7269260063e5380750d0b5dac0e6f5b997e3032fb2edf073324f013b64b058d1c605c60339eea775bde340cb6528cad2e7286eaafbc5139d3ec65f770c90af76c59cbbdc2eb25301447547aa873f040ca25ebbcf715681870f20a27d6bbb3a6c5f5a60c7bd4ff2bf405fff3f5df33044152d668e7a5ffbccd57cd9a7155468791518b7070779191bf64fa2fcab97b95352868f0fec5d3a5faab457839ef0d1231b5db0ac33da7d708cba65591c64bbc0f1822b784dd1a71ba96c99d696512daa87daa1f013da1c503f543bf321c57e8bff746fb5f24cb973914c35a953d03196c140a4ef8dc13790ced3408b97156ea87d39c0497a6fd34c443fae43346978201786a1f30e3463667b255fc0a90ff9f6531149e612ce3ac7ecbf6f37487f2293c800cd96cec0b77317592c69eb6f1c5414b36ab9ff288c6757bd44496a5a16f16c9193e818f1ed828787ff5fe768577a21d5bddee9fa081bee36386b37b7bd4df67613e2ca2743e1aa0c4d093ba202bee3282588c7fca5e983bb2ddda0ba800ab7b8c1c549305205e8fcf9b1858c547d619bd5f44c9d865d8e6182dc08387836d2d8eadc0df277f250f0bfb8be4335f8bb04f35867924ab4ad21ff7c84acf542f12efc8244a156dc0af7cdf0d19b338c4dc223746c21ca5795b1d29a3bb91814a09e9f89701005694515ed8e5e872a9de653676d042659159594a5b5214345aa4bbcf013ae94c46224fe1c0b60190c209db5700574aef0b4b1bc8128317bb023cab8a63ae5b132d64b8b7451394f50447a9620bc7ab8ba155266ff50e2efc9babc291851deda5d8f5a4e3254cf8e8a0a0d60072b0a5fbb29d74358c046f556c9e348d620c3220259eca311f8512c715531f9a5c5d0ba9b7631ac47b2ba9374c8c4aa2c5f766e7263cdc48793056a8c68322663bc8b5dce90cb487406423502191a1d7703a7a09ecad3d50b0a1b0d451a948da85c328e798712f36d2a73f8b094521ccbb1a859528b14ac615c70b5f00a6f58bd76e2406d2c59e49ee344391548a504ca2aed853cc1a737ae7e32f50d6a9b30ae8be6ab70b01d9d988c7f2faa45fb96ff9a488196e6d0faeec219dd03372c76343de555af6dcfbed4b25c8ec393fa3fa584e090ff3008edb0a2eeaf06b0973a6e99869e24c4228134c8226ae612841f86ae7db24889e993f29666519846f37d7292c0b226a2ce089167bd48aea190ae5415606dc6364e360301cf3febaada2c2fe9effeeaee195bda5a7774c03956fe907485882eb2cf5d163321d6e8887c2e632b8803d6ca21120ef1ee1c5cf8f9c50e7cad78df5518caa85c6e99af24eed7fb61feafbc8d010b4143c1d95b3b90a87072837670249360fca9cc76b794bd78a492ae4d43d54642890217f1bfa7c2311e06a7344556295395246f98b777e37af816c874e3ca222a13b6b7aa2bdf43860cbb7d5d9dc1a0dc5557d0b428664aefef672c92364407cf77726e0f1ff56528f879de3c32ba649dafa64e8f1a10561eb411a5abe894e1db87eb5c06c4a64f36c3dea98c076ad91010934f4d08cc65eb8c8ad5d7c7dd1d8f4813d9acfbe303e491202784154ba0eb13f180ca694c5701b4c9c4502177f2d05e357c8062b6628167149a21d436798dad14a9c8b93bd076bb0b2c409d8119cfaef823ea91a5b1947f4206e69230185366de8079266a5901f018db69a2b699708bee51c562926cc5f8bf840009a8311204936f322f8c35366d402d1feda1d0db13b73c413e7b3ee9d81b0120b0119aced58e6da459f1ce26eda96375c5119e9e59d85972b2d1945b7e9fb7673eb6a02e342fc3fcc5c06debe23f4af7e4b0b40e06c95080497a8216a097c17f1d4af0692ce7275e198f4d229fdab94c688c9e0280f3df63d8c0152049a197e26c90cb8f59b9e0697060d7fdc2aa891a3c2407729c90c3fa9303636486d40c6cbd97d70b5162f0dde3285938217676d7f1e40a749e7080445d648cfd869559c3802a64a3734ce58330f9f1d01aedb2bfe5f7b8ae55cf7f8fda3d5a562539bd74c987140b661549bb318522242740f42c886139aaba23272f1ab718ae165186a19ff0ec9d725a2d3d6f3dbf9baee7bd6eef22030c6c7c08306c858bc5aaf2c85bd2bdfee60f348d24c9baaaa215601ed8ead223a8c0c4abc99c53b6dca29b2242cbdddb46fac8710896a0a990bd7c4f73f43fc2e271f6091e385568dd5e66b6ba1c7811b1b7d23f071507f227a94ee50454648c7a6b44d8e606dcc06b29460fffa292df3427ef8c97dabc3b0d3711157bad8fbadf4611630c49b3e6e3b9400727dbdd005dc96d45eb60ddf352ccb36742b0c5674e7ebf7110d2495052b200b2a9915582b91aecff9b55b483400f2c4042586206ec8ecf53a92a7f"}) r8 = accept4(r5, 0x0, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_STATUS(r8, 0x84, 0xe, &(0x7f0000000140)={0x0, 0xfffffc01, 0x3, 0x5, 0xdb32, 0x16e5, 0x9, 0x9, {0x0, @in={{0x2, 0x4e20, @multicast1}}, 0x1, 0x78c, 0x40, 0x2, 0x5}}, &(0x7f0000000000)=0xb0) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r8, &(0x7f0000000200)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000100)={0xa4, 0x3, 0x1, 0x101, 0x0, 0x0, {0x1, 0x0, 0x3}, [@CTA_LABELS={0x10, 0x16, 0x1, 0x0, [0x3, 0x3, 0xc]}, @CTA_TUPLE_MASTER={0xc, 0xe, 0x0, 0x1, [@CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x4}]}, @CTA_LABELS_MASK={0x2c, 0x17, [0x8001, 0x10001, 0x5, 0x5f, 0xffffffff, 0x9, 0x1, 0x0, 0x1, 0x0]}, @CTA_HELP={0x10, 0x5, 0x0, 0x1, {0xb, 0x1, 'amanda\x00'}}, @CTA_PROTOINFO={0x10, 0x4, 0x0, 0x1, @CTA_PROTOINFO_SCTP={0xc, 0x3, 0x0, 0x1, [@CTA_PROTOINFO_SCTP_VTAG_REPLY={0x8, 0x3, 0x1, 0x0, 0x1}]}}, @CTA_LABELS={0x28, 0x16, 0x1, 0x0, [0x42, 0xc91, 0xe, 0x0, 0x3, 0x4, 0x8, 0x1, 0x9b1e]}]}, 0xa4}, 0x1, 0x0, 0x0, 0x40000}, 0x4000) r9 = socket$packet(0x11, 0x2, 0x300) sendmsg$NL80211_CMD_VENDOR(r8, &(0x7f0000000380)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000340)={&(0x7f00000002c0)={0x54, 0x0, 0x100, 0x70bd25, 0x25dfdbfd, {{}, {@void, @val={0x8}, @val={0xc, 0x99, {0xc, 0x12}}}}, [@NL80211_ATTR_VENDOR_DATA={0x1a, 0xc5, "42de0fa6f0f4bbf075ca9a3565af769d23b5213b890b"}, @NL80211_ATTR_VENDOR_ID={0x8, 0xc3, 0x3}, @NL80211_ATTR_VENDOR_ID={0x8, 0xc3, 0x4}]}, 0x54}, 0x1, 0x0, 0x0, 0x4004004}, 0x8000) setsockopt$packet_fanout(r9, 0x107, 0x12, &(0x7f0000000040)={0x0, 0x6}, 0x4) setsockopt$packet_fanout_data(r9, 0x107, 0x16, &(0x7f0000000000)={0x2, &(0x7f0000000180)=[{0x4}, {0x6}]}, 0x10) sendmsg$IPCTNL_MSG_TIMEOUT_NEW(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="500000000308010100000000000000000000000005000300ff0000000600024088ca00002c0004"], 0x50}}, 0x0) 794.447649ms ago: executing program 5 (id=8645): r0 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'wlan0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000140)=ANY=[@ANYBLOB="440000001000030500"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000240012800b0001006d616373656300001400028005000d000000000005000c"], 0x44}}, 0x0) r4 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$IP6T_SO_SET_REPLACE(r4, 0x29, 0x40, &(0x7f0000000980)=@raw={'raw\x00', 0x8, 0x3, 0x4c0, 0x190, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x3f0, 0xffffffff, 0xffffffff, 0x3f0, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [0x0, 0x0, 0x0, 0xff0000ff], [], 'veth0_macvtap\x00', 'dvmrp1\x00', {}, {}, 0x0, 0x0, 0x2}, 0x0, 0x128, 0x190, 0x0, {}, [@common=@unspec=@addrtype1={{0x28}, {0x81, 0x0, 0x9}}, @common=@inet=@hashlimit1={{0x58}, {'bond_slave_1\x00', {0x29, 0x1ff, 0x6, 0xb0e6, 0x10001, 0x84e, 0xfffffffb, 0x18, 0x8}, {0x1}}}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x18, 0x800, 0x93, 0x6, 'netbios-ns\x00', 'syz0\x00', {0x6}}}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'erspan0\x00', 'gre0\x00'}, 0x0, 0x1f8, 0x260, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@recent0={{0xf8}, {0xffff, 0x40, 0x10, 0x1, 'syz0\x00', 0xa}}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x1, 0x8, 0x2, 0x8, 'pptp\x00', 'syz1\x00', {0x5a}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x520) sendmsg$nl_route(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="b400000010000904000000000000000000002200", @ANYRES32=0x0, @ANYBLOB="fffffffed9526cfd8400128009000100766c616e000000007400028006000100000600000c000200367da1650e000000280003800c00010001800000002000000c000100a1000000c84200000c0001000800000008000000340004800c00010006000000ff0300000c0001e003000000080000000c00010004000000020000000c000100050000000300000008000500", @ANYRES32=r1], 0xb4}}, 0x0) 457.517315ms ago: executing program 4 (id=8646): r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000940)={'sit0\x00', &(0x7f0000000900)={@private2, @empty, 0x10, 0xd}}) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r2, 0x84, 0x8, &(0x7f0000000000)=0x7c, 0x4) r3 = socket$kcm(0x11, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)=ANY=[@ANYRESDEC=r3, @ANYBLOB="707f6861f494643604d7d46f834b622515b114a33150f85ee62bdc2e17c2a28a740dce82b1fce4b37b319b8652cfca16cd785e996e528a3d1f3681d0f3c341938b782a3793aec3d232ad4456d1b6d211dc63f92c2883ab04f8bda2ecbf6ffb242532a9be2f50afaddcad88636bb5fa0166a30c3646d0406ebebe6e1827d9b3dcca2b5b3aeb6b1ba154862c9a5adaf6b9d198b51aaafa2dd4e8220808ddfd1916aa3fed4d3abd5d5e02a890f3dd78d12ad334e9aa9c32392c71414d76f1b2c9894125fcf28b0220e0a5ac666f138de5d3f398b001fbe97eb6ccd50e7a16f675bcbe94e59e2a315237b30dd1004079d5", @ANYBLOB="20000100", @ANYRES64=r1, @ANYRESOCT=r3], 0x38}}, 0x0) ioctl$BTRFS_IOC_SNAP_CREATE(r3, 0x50009401, &(0x7f0000001200)={{r1}, "6977c65a8577b621ebaee4e9d5114aed4f11b399d7c220f0e6354bd39b8252be999b748b2e6f325841e60930981d7828e1e229dae93ee109263b39dcfeca2219dc168d8c635525f9879a93cc0c0c8ad569767815fe1180ab3e8e38a274b15a56a92ac1d12e058e715e2c656423eab9e7c47eb16f328a76bb7e60c29351511409bc655d2385bb7862dd785ad35e1e21ce445929b4b0e057df13eea9928a497e3000d0931f24a54fdb4bc05a21e5d23b5cbd25caee936ef345f86f0cc810e2a7ed476d63ec345095c7850e5b7230b4d9fc361b0bfecec8f537e27322b65650f06dec4b77154b1e18997b4ad25b19089d04d9887f91a78b89c0a0dccdfbc485b21b3bf7ffd0052886674a4b91615cdeee096c919f1519a404eab4ddefcb9d0818b61257fc2b6b31039d392cebf1e2ff26b68d7864115fcaf8919da7c3c3a570ab7d36fa69563a81f8c7080372f88fcbc733cb201568a2a0629b313ebe3eaa17bca91437e4f3aac785032e88ade579c93275a52d9e9ac852d7409634e2d08424cf38600805b93bef591bf0b7c326eb387aa42553404660ed515324ae142a5ce881a2b2a29e58f67911119206305b34d1b104cd4d210615eed9465d66ad359113c15c2e0a80e0310b769454d61a1336d86a61d5f3239b17d30eedfdab1b55ae1e72818e9879ee6576d8224e5586fada5cf32b6e24836dd5a7988aa98493d5caa3e766aba777cce952d2ca121c203b4660f6608b07b6d6c7b13ab48fd8d7e7a33940943f8675446a5757f06e9fb58c8b5b94195e08af2d9792bae084769076bc7c7f4799cb09407ff7cf0531b87e659c7fdef02ec909b3331668caee1414e850863f30aa927a9be058c14d4a16289450f4050cbac7d1bbb5cab76c397a5c4967cb88cc101ab8cd09fbab18269f647bedfd4db11b8ae2eff81df880562a93c2f00e5257bab2e0a49c85e7d9edb77a2037e6bdea192bb79d6976254f9fcba9a40c8e275a2e8f1e4f0ba45f3772c2cbd0204bfb85dbe079b26aa7c7f4f4176a6b644ae126c63317a8568f36eb66577e7973d0edb6dbb74c29cebc56eb10f8e71044598cf3fc0144a8132582e34b04a578a80500a58b76960a3adc98ca391fe4311eee4d3dceeff4ea275d78bfc2ea4a089b7c3576b04a84440d608e3a6491560bdd7bc88065d51efa4cb02b352b56d2aa7f598158cf185db0cc09b86fe1feb342ea4e9a19e72d9a0edcb97eb3157f7570c63f8facc249a8943fe443762a39e1c59c68aa1763b6f33cecb868f198246b3e488e821544752b1897028d48bfea630aeb987a83ab84e01c70f0e40183c823238db7411d77d01b8344fe211818acf62438f38fd122fd1e6264ef7a54d84db0226e3f04cd88cd2ae7a2e3e4f66c559250f5ef835b8de19ab5a2c4c2b7acb83d56a3dfee067a07797796a8e25b997a82da62f473a059790f42a3dfcee9f240541ce2f55d5a401e085997ec6be04af839378c6a622faf0b56c716b071eda154321b09894f2331f28a0bbe354a766add3ff9270efec30f2939eabbe683dd8fea8c3168d0a737a5e943f4a1e43bd5b9be2c9c4e67c02d0047e546039ed4cb8c023af9a2e1af26219e0461c0166e0d8bed6718a906d4ce32388e13eb97d5b216e0c66d203082092013e48bcea699ed67289b27bbc7d51be04db5ab0f6608be003e4f0089ca88a94db5381433d9bad31597b174a9cde8ecaff26bfcdb064c6b2f404046183d004a99f3b8d42c1c5bb3ce349618edf60b15e7409a33e24dfb0a96d0d1804d42a19ee570d092d39a4419e2407a2e65f536a8b95bab15fd7e81d013139bb9c11fdf8ccb101779b9c92f6eb49ce560aa0a4f8cea5f6e13fef623dea315c9598387ef3e1028bec16fdda566040cbf9765ebb01556489be09af420b0cee857b3c914c4d97b5b5307a712d293d576fad08af4c3a439e992561924c886d95f36d5a24f0c4ca396511f239c690deb713459e7f01f7d1515882bbe39d530f8d5f50395df7d8518b77c9c7379d139446deca3e9e9b1e7de3e0d303bfadcc4443ad31a813d20a5343efe82b4c8d6e9bdb3803a4e24e470d7e7c414ceb18cd0538b0877b33879aa355786abe01e7d76a41005ddafc35464018d2fa58d950df4d73a73dea66f0c508a135831366f95bbf4fadabd18c8c64d23c68c4182b89cc7e1056308e5a613ae78d5def0141e97997d0937d3ad50f10289ea727b68331d07bb65bf53a0afd7d759144610f6e2ed90343665be4906e37d1faade60853295521f4162637653f12a1cd0c032897d50b92b51c3b9a83cb41e538a9ef7e775fbc5d42a92ddc6e74f04c2414329428505127e1297c33f057ebb58f95e68d095890a621e8c3ee2371350709f20476109af3f0d38ce1c1193a38cae52a13782f7576123d09e5473902157d12233af1477cf958270d72182416a20ec19840221899462ecf8ac231cfd4a050edb49842a3cbe17bdbaa3b27e8806ace2c46a7243b6d093576b7e260e31cc7477e518fe4b2782751c72612fa67c8bed9e40be68973e2e95f944fa6487a17113035bdabf1a3d8bb25f937a0dd5cd92c2a1e4d1baf76089c6d9be505010ae9a8bf542be9f98c4e7ec3c517dad4aabc4bf18f348295ef2ed836006b6b301eba5c9eef03cb1fbc94b77939970c759adfcab86c8e6bdb00a4e63cdc60a84d987c9802e6b0357c017e4b061ba8a3de715743963305541206663a828476c1a4b2f438ee416bbce4576fb8d1621b5f129924d6a990b80bb3c82ba7d2864eb9831d66d1ee8025a4949548a2cd81ea1284837355a4063794dd4ddfda8f5b94679708e8d0db73e39a89e8a977fd4215194143b7b601a970708be006cb7edb3bd3992fc0d1f635f60deec15ef1400430f6710bf19abb3851553f827ebc7aff08de26cc621c02b9dc273316e28eb497a7f48886b1249fac770a870a60dde3d680b2e454e78c81a278fb2d974d72ed7df9bff1364139c1825e74b35a5b8be26af30231d56fc4ed271247e99f4ade17d3bc3cf7bc738c88f7a31be6998912d7df6a1556e6c5b758164b9fadb47a4cb6c0599b8d4cb89536aa1e76c8bdd1e9f15200d2bedbfedcd4eaa414c240df798de8e06b6202ead6338c3774100dac81acf79852c451bbd693a593d09398c3ce5ceeb1e94d5e6f4c1a986f941be451a5f566bfb6710983bf79c848dbcd2d9ef7cbb8c7d867fef4ae50716a60a3d2794f99d605f34cc278cecff3bde69116d3f79efbccfcfcc3589bc710497e3d5437613e59e9783f73116eacde7342acac8bd6e3786120f24d6e70edab09fe3fcc5d114e3f59e9b46d3712024444c9be42fbecb99e01a89b64cfb5a8d849ad268aa072e995506a930dfd98a8130243372b81ad53188ded79fa8439a8e90dabcbdc78aa72677a04b70ecda3c24693a4bfbf44af1c0f7047723012ffc59521fb05a640e7d65a0b1e83062ecbc9529417f3072c95af193ce57d7b17e06c096d3a03e1191579e944107a1c6f89b537575730b4c525bb43f40dfda41c643322016ee1488ef09abd970f71b9e66232cacdeb959a3f57b19e1a8e37d84d19e28f1c6ad23368218c3279134b5c27e2ffcc3e4ec8039b5ab1b535288c6199225f780f71aebcceb68dedb5400a53a5472becc4de13860704e3286c6e0ba2d8c574e47340907c870b3287e00829eb2e49e4c13583d6d9345a535358ab2d6c2338cb72c4c0a9b50e6ab7e5719ac86c36b5ebaee6386e858bf0771a9bc1669498a8d1097841d5b5e7fc9c5bf6b4b9dc1696e3851040b2ae5b2d322a6c028b78235d5039512abf209d3875acb2549c69bca4a24e904f8243192e55d25bc690e7a0b6fa57d757624e931f00a22b7ebaed3005078e5156c94ecf30e936263bcceda8f87158433de0c9d7acf525695af4c35b647a8eb1af136b8545c0e459245c3a5f1d1c51319699777430b9c270d96a26b511f486a3deabb1ace60a7c9ddc7f86225b7f27404e5c649548524a08097a38482cc7f358930a627b2ba54fd6f29e69afbfdf8b80d0c2652c0c7b92eeed678f52528dcdb0306e3f7442b3fa6047f72e998ecb4f31d9665028ce206956956da62ae33c796965e78dacad6684e26e6e21080dd6251d138c95e6ba4a6092cb4488034587444c14fe519cdb74fd7cf8f2285cf431ed73401d1fcfa96c9c04107fc28a35a1a4f30f6dab0d56c687455db95c1f657cfbfbc6da32b602c3a63ceec49e8048d9fc9b1e82f3ebe6378e8f95794f16e8ee152a2d2331e93198633add4a9a916b3f050d02fd3568f3bc656cdb8b17c32109ac89b75564436de1964eef9b5192487fb069249dc61d2349e6a7fe447207112b61c0a7bfb4c726cf5e8d07f8ef0fe792c67e80f3218a408c4657f5ad96ac8b5ed96239db996315d94c4f58bc84dbd28aad67167af1cced9a962116b5b4a944e19a389263c65100852e66fb942f01895af99df9ecf1aada736581d30706c88a6b3beb0812b6443a9b2bc4ecb2136823ea9b032099939ac9d2b6de9e6e1d4d7829fa84ec91855ccf635505a6d4106231c577715a29416a130cc537318c92fb55b87665acb47c15c53c38221dc9f011fb0463245a4c56233d2d5f77a3836d375142424e60d47ae088422e3339718fd60a6dfe65ecdb8e6f1b6c0475c6557df7f1a4902fbc239a6dde907eba093547bc657fa9fc1bfa6e82a9303d5cefd73c188c905707db7330d51dc5656562db74771e9f8cb889e68ee5b05ce58a59f591d7714fe5f46f4adace8f75e5a14cc908fb271a007875a560df240a22709b830b91f823cc34009def3276a01b6f8b3d6ad69dcb8568d45410bc5b7d230ad671c68a80a09b47ea6e7239fd148b6f0c1b4f23908db3cef57a9dd1e97a621e635661d347af6b7bd595c590066cc194462dc06fcb45ea3ae31c05c800b9c3acfcd56d9f3d80f750d7ba421f9a7c535aa4e7b78627cf11dc5d2a61298c4a2e96904ec1fde8201176b0e023007dadb01acc2b86a2ce959e674cb261465585bf272551ce8407e7e14e730c9b37dba76014e598efa3a996979f9d6730e13465d5cc736554ad39516b60c64eb071565f7d2c117e5784e2892b659acf5f171cac550adea1f26d6533c9a9ebcbdfb08e2397c2d4e486fd16864ce8f194b3ce7ae4e2c13c648c2a04d393b7cde9e8cec0ba49120bed155411a89ce0d1c6ab027c6d5819a40d447bf20f9c3d28991b377ba9fa2af3b571ae1d472f2c4b0bf8c2c6437c810c92c7da8269effdaa9eeda3ab35b9badae832345de51681e6d752a32a9c8dd849fac70541657e7caeb97d064d3f20bf311be6e6ea372ee13dd9551c92f00e3661aba031e153ba29ff036e9bb4a81f1b58a3a6e5e873334210448afce3247c5e88e9790edcb91a8af8c21f30a9ba8b65fb45c400497f694b67c466be3490eea1918884355c100c4454198d062d6c87f39673774fb19c75c5bd1c61ed9eb5c710bf8eb5a8d734c79c3a05bfe7594adf8e7c6e77fccb6399b6757a2aeb1c82a96e2842ec88a1a6b6091c8c02825ee9aeebf67410e1a9aecfafa23c7c820efe0738f947f5a1e468b0786402abc8d7e1d2cae52884631b8eb81623b78edb9461344420959ce2edf34b8e7715da7838abf4b94a059dfee482e265930b6e01addda6553dd68a3a681a19171fc609d953460c0915b4c164d0d6de52c0bf65d883604a073107966797857f095fa00352311e5f0a51b0df40bfa522bfa48cd5581626c68271ba86fe9553ff08d7e5d49159a4c8b27c49493444b6f40da70e8a2ffa6"}) 378.790475ms ago: executing program 2 (id=8647): unshare(0x20000400) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) sendto$inet(r0, &(0x7f00000001c0)="6b75821d737663c742c33a23e773a8412e89d51fa1b1f61ce2b46e51156b2b3df2f8b767153d942751c2c7ade4de187bfa1501e771f9b3a8cffc7ae14bbb92441dada6ea12319a0a96770d99a56f0cc69e80082ee1d61010bfca2caae19e3f2010809c7192d72b9ec754502afe0161a8bba79b9a6f503a8ca46b8e5d2cdcaf2e2a89f90b354b037d7a11979f8f13c5767a42c458f3039af3faaf234b1257b2ca42c2ff18ae4678c010622b7feba6505f0e7102acf1eb54d877115bea75707f6a321fd412c8e3ff7c60cf908cb77272f295805a4910c6", 0xd6, 0x0, &(0x7f0000000040)={0x2, 0x4e23, @empty}, 0x10) setsockopt$inet_tcp_int(r0, 0x6, 0x10, &(0x7f00000000c0)=0x7b, 0x4) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x4, &(0x7f0000000100)=ANY=[@ANYBLOB="b40500000000000071106200ff0000000500000000000000f000000001000000fccf0363023bbbae3caba8c467ddd0dd14e073358545ffe93ae553070228d18a6ac0282b2a3144a4a41642334439ac90099879704e35be11ab2c07842cdff4ee0b062ff256c76a5c1d2c5c8b79877c31c813778275257b70aa7c40eb107554641f8c0f2ab84bff55699d0278b662aa8136d65df8cbb904f33f109700f377a81399ee827619e37868499cfdf7"], &(0x7f0000003ff6)='GPL\x00', 0x5, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f00000000c0), 0x366, 0x10, &(0x7f0000000000), 0x2b2}, 0x48) 373.877603ms ago: executing program 1 (id=8648): r0 = syz_init_net_socket$x25(0x9, 0x5, 0x0) ioctl$sock_SIOCGSKNS(r0, 0x894c, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x16, 0xb, &(0x7f0000000580)=ANY=[@ANYBLOB="18000000000000000000000000000000180000002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000007000000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @flow_dissector=0x11, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x94) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000004c0)={r1, 0x3, 0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x44) r2 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000002000000b704000000000000850000005700000095"], 0x0}, 0x90) r3 = socket$vsock_stream(0x28, 0x1, 0x0) ioctl$int_in(r3, 0x5421, &(0x7f0000000080)=0x2) connect$vsock_stream(r3, &(0x7f0000000440)={0x28, 0x0, 0x0, @local}, 0x10) connect$vsock_stream(r3, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000001a00)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18090000000000000000000000000000850000006d0000001801000020696c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000071"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000b40)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000070000001801000020756c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b70300000000a5df"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r5 = socket$unix(0x1, 0x1, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000c80)={0x1f, 0xd, &(0x7f00000003c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x9}, [@map_idx_val={0x18, 0x7, 0x6, 0x0, 0x3, 0x0, 0x0, 0x0, 0x3}, @cb_func={0x18, 0x3, 0x4, 0x0, 0x9}, @kfunc={0x85, 0x0, 0x2, 0x0, 0x1}, @map_idx_val={0x18, 0x8, 0x6, 0x0, 0x4, 0x0, 0x0, 0x0, 0x4}, @map_fd={0x18, 0x5}, @func]}, &(0x7f00000006c0)='GPL\x00', 0x5, 0xb2, &(0x7f0000000700)=""/178, 0x41000, 0x19, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, r2, 0x0, &(0x7f0000000b00), 0x0, 0x10, 0x1}, 0x94) recvmsg$unix(r5, &(0x7f0000000680)={&(0x7f0000000500), 0x6e, &(0x7f0000000300)=[{&(0x7f0000000580)=""/216, 0xd8}], 0x1}, 0x20012141) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f000000c2c0)={0x0, 0xfffffffffffffe01, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a78000000060a0b0400000000000000000200000038000480340001800b00010074617267657400002400028010000100434f4e4e5345434d41524b0005000300ef00000008000240000000000900010073797a30000000000900020073797a3200000000140005800800024000000000080001400080"], 0xa0}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_attach_bpf(r7, 0x1, 0x32, &(0x7f0000000180)=r4, 0x4) sendmsg$inet(r8, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x20000000) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) r9 = socket$packet(0x11, 0x3, 0x300) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=ANY=[@ANYBLOB="f0010000160001000000000000000000ff010000000000000000000000000001ac1414bb00000000000000000000000000000000000000000000802000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fe8000000000000000000000000000bb0000000033000000e000000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000efffffffffffffff03000000000000000000000000000000000000000000000000000000000000000000000000000000feffffffffffffff040000000000000000000000040000001000000000000000000000000000000002000000b1a0010008000c00c40000000c001c00", @ANYRES32=0x0, @ANYBLOB="00000000e4000683"], 0x1f0}}, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r9, 0x8b04, &(0x7f0000000040)={'wlan0\x00'}) syz_genetlink_get_family_id$devlink(&(0x7f0000000100), 0xffffffffffffffff) socket$nl_generic(0x10, 0x3, 0x10) r10 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000000)={@multicast2, @dev={0xac, 0x14, 0x14, 0x10}}, 0xc) getsockopt$inet_buf(r10, 0x0, 0x29, &(0x7f0000000000)=""/137, &(0x7f0000695ffc)=0xbf) 346.810472ms ago: executing program 5 (id=8649): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000880)=ANY=[@ANYBLOB="500100001000130402000000fcdbdf2500000000000000000000000000000001e0000002000000000000000000000000fffd00004e240000020000201d000000", @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="fe8000000000000000000000000000bb000004d3320000000a0101000000000000000000000000000000000000000000000000000000000000000000000000000000001a00008000ffffffffffffffff00000000000000000800000000020000fdffffffffffffff00000000000000001000000000000000cc000000000000000000000000000000f600000000000000000000002cbd7000000000000a00010900000000000000005f001200726663343330392863636d28616573292900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000009800000040"], 0x150}, 0x1, 0x0, 0x0, 0x80c0}, 0x0) 272.195197ms ago: executing program 4 (id=8650): r0 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$kcm(0x2d, 0x2, 0x0) syz_emit_ethernet(0x11f, &(0x7f0000000c40)={@broadcast, @empty, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, '\x00', 0xe9, 0x3a, 0xff, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @local, {[], @ndisc_na={0x88, 0x0, 0x0, 0x0, '\x00', @rand_addr=' \x01\x00', [{0x5, 0x1a, "b378b4ab7e6dec5a1bae2cabd9103dd505a4386e8716ff04a2f49e69485a91d1ff1a1fb0e3f2e0a68f507561d6a3f31d51ad78b4b8b0e81ef6ea021f561712d79e77c6b552fbaa4835d8b7ab763f33a96e5f8af87c5b64d51ea7bb6a01fb8d0f33f70755673c52b570661399f764fc770c5d88ecb6e516acacda6e3c75ec17351059b22af4887d6659c0e2daec240c6656dcd17718814a0808766225500115c2f274e13c40b5005b76dfa6583c9d0b682bf1e028287faea12c2b4c6be79c950510ccda59d6da46ff2b084d7ee085ee"}]}}}}}}, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(r2, 0x89e2, &(0x7f0000000100)={r2}) bind$xdp(r3, &(0x7f0000000080)={0x2d, 0x0, 0x0, 0xc}, 0x10) close(r2) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000840)={'batadv_slave_0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)=@getqdisc={0x40, 0x26, 0x8, 0x70bd2d, 0x65dfdbfc, {0x0, 0x0, 0x0, r4, {0x6, 0x8}, {0xa, 0x3}, {0xd, 0x9}}, [{0x4}, {0x4}, {0x4}, {0x4}, {0x4}, {0x4}, {0x4}]}, 0x40}, 0x1, 0x0, 0x0, 0x24008040}, 0x4000080) r5 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000280)=@bpf_lsm={0x6, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="18000000003f000000000000000000f195"], &(0x7f0000000140)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x40, '\x00', r4}, 0x90) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000380)=ANY=[@ANYBLOB="340000001000010027bd70000000000000000000", @ANYRES32=r1, @ANYBLOB="004100000000000014002b8008000100", @ANYRES32=r5], 0x34}}, 0x4008000) 186.753874ms ago: executing program 2 (id=8651): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) socket(0x400000000010, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) bind$netlink(r1, &(0x7f00000001c0)={0x10, 0x0, 0x0, 0x100}, 0xc) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) bind$netlink(0xffffffffffffffff, &(0x7f0000000000)={0x10, 0x0, 0xfffffffe, 0x200000}, 0xc) r2 = socket$nl_route(0x10, 0x3, 0x0) bind$netlink(r2, &(0x7f0000000240)={0x10, 0x0, 0x0, 0x8000}, 0xc) r3 = socket$netlink(0x10, 0x3, 0x0) bind$netlink(r3, &(0x7f00000002c0)={0x10, 0x0, 0x25dfdbfb, 0x400000}, 0xc) r4 = socket$nl_route(0x10, 0x3, 0x0) bind$netlink(r4, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x8}, 0xc) r5 = socket$nl_route(0x10, 0x3, 0x0) bind$netlink(r5, &(0x7f00000000c0)={0x10, 0x0, 0x0, 0x2000000}, 0xc) r6 = socket$netlink(0x10, 0x3, 0x9) bind$netlink(r6, &(0x7f0000000340)={0x10, 0x0, 0x0, 0x22ffffffff}, 0xc) r7 = socket$netlink(0x10, 0x3, 0xb) bind$netlink(r7, &(0x7f0000000200)={0x10, 0x0, 0x25dfdbfc, 0x400}, 0xc) r8 = socket$netlink(0x10, 0x3, 0x0) bind$netlink(r8, &(0x7f0000000300)={0x10, 0x0, 0x25dfdbfc, 0x1000}, 0xc) r9 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r9, &(0x7f0000000340)={0x10, 0x0, 0x0, 0x22ffffffff}, 0xc) r10 = socket$netlink(0x10, 0x3, 0x12) bind$netlink(r10, &(0x7f0000000340)={0x10, 0x0, 0x0, 0x1}, 0xc) socket$netlink(0x10, 0x3, 0xa) bind$netlink(r9, &(0x7f0000000140)={0x10, 0x0, 0x80000000, 0x10000000}, 0xc) r11 = socket$nl_route(0x10, 0x3, 0x0) bind$netlink(r11, &(0x7f0000000280)={0x10, 0x0, 0x0, 0x200000}, 0xc) 186.228185ms ago: executing program 5 (id=8652): r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x2, 0x6, 0x750, 0x360, 0x1b0, 0x1b0, 0x1b0, 0x450, 0x680, 0x680, 0x680, 0x680, 0x680, 0x6, 0x0, {[{{@ipv6={@mcast1, @private1={0xfc, 0x1, '\x00', 0x1}, [], [], 'pimreg0\x00', 'macvtap0\x00', {}, {}, 0x21}, 0x0, 0x188, 0x1b0, 0x0, {0x7a00000010000000}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @local, @mcast2, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}}, @common=@inet=@multiport={{0x50}, {0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8]}}]}, @HL={0x28}}, {{@ipv6={@mcast2, @dev, [], [], 'macsec0\x00', 'veth1_vlan\x00', {}, {}, 0x0, 0x1}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38, 'SET\x00', 0x3, {{}, {}, {}, 0x300}}}, {{@ipv6={@ipv4, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, [], [], '\x00', 'bond_slave_0\x00', {0xff}}, 0x0, 0xa8, 0xd0, 0x48000000}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffc}}, {{@uncond, 0x0, 0xa8, 0xf0}, @SNPT={0x48, 'SNPT\x00', 0x0, {@ipv4, @ipv4=@loopback}}}, {{@uncond, 0x0, 0x208, 0x230, 0x0, {}, [@inet=@rpfilter={{0x28}}, @common=@rt={{0x138}, {0x0, [], 0x0, 0x0, 0x0, [@empty, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @private0, @ipv4={'\x00', '\xff\xff', @broadcast}, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @empty, @mcast2, @mcast2, @private1, @ipv4={'\x00', '\xff\xff', @multicast1}, @loopback, @ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}, @remote, @private1, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @private0={0xfc, 0x0, '\x00', 0x1}]}}]}, @HL={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x7b0) bpf$TOKEN_CREATE(0x24, &(0x7f00000007c0)={0x0, r0}, 0x8) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000900)=ANY=[@ANYBLOB="2c0000003f00070dfeffffff00000000017c0000040077000c0003"], 0x2c}, 0x1, 0x0, 0x0, 0x4048011}, 0x4044000) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r2, &(0x7f0000000100)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r2, 0x0) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) socket$kcm(0xa, 0x3, 0x87) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r5 = socket$kcm(0x2, 0xa, 0x2) pselect6(0x40, &(0x7f0000000040)={0x1, 0x100000000, 0x100000000000000, 0x5, 0xfffd, 0xc, 0x2881000004000009, 0x5}, 0x0, 0x0, 0x0, 0x0) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r4, &(0x7f0000000040)=ANY=[@ANYBLOB="034886dd010000000000140000006000000003088700fe88a43de1a400000000000000007d01ff020000000000000000000000000001"], 0xfdef) socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(r3, &(0x7f0000000000)='blkio.throttle.io_service_bytes_recursive\x00', 0x0, 0x0) ioctl$FICLONE(r6, 0x40049409, r2) bpf$MAP_CREATE(0x0, &(0x7f0000000880)=@base={0x5, 0x5, 0x7, 0x84, 0x2808, 0xffffffffffffffff, 0x5, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x2}, 0x50) 186.011642ms ago: executing program 1 (id=8653): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000100)=@newqdisc={0x44, 0x24, 0x4, 0x80000000, 0x0, {0x0, 0x0, 0x0, 0x0, {0x4}, {0xa, 0xfff3}, {0x0, 0x1}}, [@qdisc_kind_options=@q_fq_pie={{0xb}, {0x14, 0x8002, [@TCA_FQ_PIE_ECN_PROB={0x8, 0x9, 0x32}, @TCA_FQ_PIE_FLOWS={0x8, 0x2, 0x64bf}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0xc5}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0000000000008000280012800a00010076786c616e00"], 0x50}}, 0x4008840) ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE(r0, 0x4048587b, &(0x7f0000001a00)={{r0, &(0x7f0000000040)='fq_pie\x00', 0x102, &(0x7f0000000180)={@align, {0x4, 0x400, 0x7, 0x8}}, 0x48b, &(0x7f00000001c0)={@_ha_fsid}, &(0x7f0000000200)=0xfffffffe}, 0x8, &(0x7f0000001900)=[{0x3, 0x0, &(0x7f0000000280)='\x00', &(0x7f0000001ac0)="8776bb915652cf8100f9942dfe83c2337b2ba57e69a0244e3fbb753dc3d3fd8b18143e2cda81d636f3b767e42110cd9f7500b175f50839afa9ceb70980aaa7993d56d1e59905a433529c1e11f82c5fd4f21904320863a2e2ee7ccdc82aa4e50f870e8597c75f27344a25e3dceae4eb394c04e69e7efe9c42bddc39006caf51a8108c174c9e63e05e5a878ed3757ce2eec34d78d9df0c03e0ceae9def0bbcef16aa71c9e4e4f1ed9ad5eff7ec3988f21a4c38815a49e98e956d45", 0xba, 0x10}, {0x1, 0x21, &(0x7f0000000380)='\x00', &(0x7f00000003c0)="5f31e9c47e1fb8be5bd1697fb30da065977e831b60939d8076de9cbd040090581a91f1ee1ef83d895fb325a074cb2b80a0a4b263b4e8ac68831a8935b359cb63f9471e6ab87817326bcc2e994cbe118b553f8e4bfb97fea27c3de76679127eea2558b8830c617171f033ad57e1886d605d4e525869da5b4ccace8c30f279640649721bf33abfeae0156a96d4589216509e3c425552ec5b4edf1544cfcd9fad77ff11f160b80d0013aa2813fc6b03e07ba1ddea0adb72c5aa181bd4a2c0a7780feadb518faad4ba55e85df8bdabca079d044fcbae27a75ddabd240138886245b6dd40dc9176e039f489fb8a7111a8e6075924a9c8b2b42daf3967a5aabe075c9ab7247b37c466dc11a5e5888cb2749116900980a6128b5c15de4d25ed067d5e955b2da647775e562d50d5f62594da583a212eb2808799c0f3f2cf4c0b5da645ca62f1c3210d437609cb7c4deadcafc1303e28d5aa29d1ac69107eea6cb5d90305748b8ad9728f77d9c775ce4ffc5b473430cfcee0f076eb7a85a85f8ee15b3b80c53fbfec5cef293b567bf3445a4f51928c8b6fa3313692a3c9dceda0ffb06f655678662d03fb44165e7f9cbbe277c7b530bffa3a67960c84d6dda33ea1ea6d80a0f01ca580193599a8a333e9e1ed81fae521cf08f78ff5ca2288d2f86f20c010d6b4f89965302707825662570a6efc4b5a109278af87d866545eeda47543b14aa93c1326967bdfd29548efb42f56cebcc1ec6fa11ba050c1fdde318c7351f38fb2d3c65cdf12f70c66865eb105531bc276ba882dd64ad3d2103f98449e6db9653e02fc601d76a57ce3164471ad86f35105f74de0acbaad8d5601664cbf72ff216128ec54c9e28f073a79fd9e7a553f9a84f8a7ea6c0f10edb86433d24f8cb462c521beecd92dff4b2dab49d35a0cdcdb2578a374d40858ad56dfb1a69d26b24adaaaf5281c4968fd70f7753a5f103cc4a4e5c462c5029ec05445e516ce6062ed0de842069cd907fdb8843484c60e4acacff2488580db66006835d4266345f4cb6c01140ac8e26f0b34b95c2b8a85715e4c18094b86c17f071dc72630f7b8e5fb5c4b714b86b09b838e675a58a855bf52279346ee995c26f7ed69ebb05ba865b997137c1976d5f5381ef59cdc577aeef8df7e81ee033dedb53067bfe6144b09f802524bff0e103f5dcd9ab0aaed84741389e8cbaf154b25dee488c003780a20aa76812f114689cb5272df8d19c15188902ae1ceffdf26f76e556066041bd9eb9ac82a3f1f49c33d61c3ae89c7aca8c7d69077a246869921f11a7ab6a77a9fd73ecce89ab0b74b122329a3ca8d555e56f172af541ff9c8b3787c5b642b136216b1502fbe36f13ddb65352294e171159592bcdbc9327d88538da5171216e0018f100a8fdfa475a917bc7b5b792e76b4d88156dba546405a8539e721595cdcf9eac8d7b2460d46cad7dd86ba8308a7bf6d16ba5786d9e19234716032a5fc4215d65f424338c707cef5cf9b2153cd9ddda24bda661b73a86b9f18c1f1ed0bfd178bc5acd817e71f2b45700c92bfc9541096640995cbfa86e77693bcba3e25ed9ece1e4f9c0f612bf51dbb27d43cf05a47c6e296e5224ab2974ac831a36b016ab4e13b64f03dae11d7325df4b4116c58369b62545058166a1d954da05bf32834660d05d88cd8bfbc2c1604085feb642d6df1dc3519c9466a65d8682490f089ff557fb7195f041e0188d0edf27afade8152fd9aaaf7192b45022b93ca69f5e46e25775ab47bc8a2607cd38138efeb6c22bcdcb488ae04b4adcd566d9b2c01175429ffb22b4c03c190a858f6305d5cb96c18bd8fad9c140c10e58a2b236bd0516909ac7bfffc5d23b2e98fecf695b66c0b8de0a6528bc9b9a26ecf5d047048b61392a80e4def70e3551877d4d11e1d78916e76d7ddb6239da89e32623732c3b7813a0bf3b07ae052aa226a05fa1613e67badf1f6b2968ba8bd51ec0b2413849899c0015ef512fe9820a7d069bece80c37c59acc0b9e5de41ebff8c63c5b49b25b7612f9eb59f4f6626a97b62e75106e0ada97996eda33cee0ae20bfa8dc862646e4d18675d652b10cf36b84a47b2a9b2da88e6a998e85ee445f8f7264e587e15b86cedc6c4ea1763ee8364ee425330a28c35fc08d256c14e3b816eeefbef96660bfafaa99d225fbbffbff0801166ba5775ab1a7162806bfc8a4321d45295886f1c83c90dbe6cd2064aeb4bc04eb84d4267fe9c6957c82fdbab0676350408ab976d9a9deb3531303e62ba2a4bb97e9fbe6beb13feeaf236b13edb525ff62b7af9727b374e8924c36a687f7cb91cba3a6a76ee51c54a3654c1e4df94cb37a01356fb510d3439ea5d9377b320882d78e022753b0bdcc41186a704bfc0915babda7eda071e5999d0cdfd6d306f98f6847df0364ec63833809ad64e9d3c371d2676f37f7bc7c833fc0467e3289d32cfcab9bcab3530af4c80afdda71affeaeeb3b31466bcc34a9ad69670bb7756ecda5fc5d74c53cf41161c00818083d0054a367c64089a3bd494aa167e7b5186764ee653c3d3fcd630c26669c921d728141101f0baacf56234d0669f6d855a31134e4c740ac2191d7405d8971809757f1529449dbc67df5851e51f6a8f587f88af24f075ce544a4e259939e5dd0bb927c678ba95f4e76a9e3f4bedb3c75996d282bc52e4e711300be4ea9e31d44ff3aba024ed0ca474236950c2a85a06ab74cb8a60ee0c1ee4dcf75fbf02a40001461025f8752ef3b41d4a58cc35f5dbc07b9491af78246bed51defc0fbc6e759c9f93a7cbb93bfe2a414176b313d345f9b9a2374e310cf1a17072795fbea5c2b8cf33c2455362527cad9326c24a18cf857884bdb86f762f6d137c7c307918817047da1ba075857c397cf184e16683262afbe6b8565016290d81302878d1982060864c133fb04ac211ec643495ee763900d92270c7bbb3cb42929ffb1d2f4ae5657d807f6ccd622c77afdfe15e1c3b869b6d63c1685ae62af164e72ba8a66ea511c66e839ebb5681c84ff3eb48f8f5e49dfb3a382c32110b9f02dc01c0b6ea3e0a7b6a251745c2006adb3ec950bca47bbf9ab3f958722f73a2118cc018f283060d21aad0930c857ab881c72d91ef4106ba2b91c9a3973399dfc81c344b03e633b712da8bbd2a7296e7249f6820d327d6f51959b0620524b2ed7b078bad07d5b7248d84d9d861870843aea4ab64bc511c75d958603a2676d88d888a583748f21d8f4509e06993ed51378b6c164dfd7785b2e0e0d19f1d65bbcaffb425057c3dd2c3673204decc4496a5d54a64257d387c48feb81bddf86df6f7429bb0b445cb1d54ffc310237bcf1a8705dd39d2b39f065cbb695adf31a4ae7f46f1f6fe5e9ebb0a6c72aef8e4beefc42c387bd6be25e9f7973dbc6af17e2a7e9e7fb651b2c217bcc6104c3a1cecbe000136ac685f2370983c8eb8718b4f841a874f43a2e8d5aef03eafdd3df62e9752fb6371e08282db8595d1cec008dadac407a7606677cd4cc0e2f20984388b1a047d076722feca40c9899597dda11184c6f309890752a776c9a0b97d9d6ea998d557cbc933070e802cf017e5c7e57f6be43a0e64ae08bc526386fe50d569192bf5d8e1568e2c24b29924d7b9588dffdba215877cd2bc7313254587ab8adb1c90fd0c766838d8c1368b669f8035eabee506174ea923ca3ff14b7cc0fe6f404beaa48b685dfbcd155195d8bd7c809aab3c2e03810eb3ea350f4e37d609d065aedd2a71cad25d8285c8b6f024c8fe0f0ecc71f555b14d6fdf856f43ab7d6db5b39016e2d315a5c8ebc2f0de36d707eee72e519ffd54dcb34489ee19bbfb85d4b8c634fa69ae60dd6e701b54001837242020fb39260b184f2893a2f3196f8a1689a229b8f3f0585c5c6b48fb1a1f3c96442a1ce07fc71e0d3cd5bc33aeacdc9fa27b5f04bc5a46accd67107d9a12f0cce14caa6218e4bcb70e1ca2d6c0abf24d5f38edac679f53f00f777ef44fa2e80903f8f3110d2c59755fdbc474af94e4cb24e6ff417ea84ff992682d7ef5eab1ae8e0a0c049723700d90e6c3103f77e1bdf30194abc2b26674e7b4caa3ddfb24e618d9722ee49fa6edeba4969fb8260f6eece2c89b19cf0b2a70e8ef2e087627362079dcdf97cf4f9a554930e9f5029542a5b3a1bb597b2e85eb2883285f8876daacabd2b292885a70e53fc2b4ef5a53d7096f342fd9cf087bb9a14557749b2c2982380d25f1680cfe9978dc8e02f9fdf613e44d34b5fcca3d381f2be0b0836108400741a96f45a21a7318315847553c2855442c538de727417ed5114aeb20382c24bd03af485f421b5abea6c05bd7081f6334480dd4f8663e9393b273a581b3cc272440940cce17213cd05970fed4da73240776fb79302b23b628655a0b8c36f54fead908cb85faf7705c09e6fc92585b476361d8cecb2b7e8dbcd7dbf5075c6129d83ca20f71bb22c74a3ac9f4b3643e110db1548473cbca9f84c96e5911b40e498ef75017ec8b7e3e952d77da935243c61e855348cfa810d0e0afcf692aed5328abcaef657c466d7636a44427cec8c1c450373a0f8d566fc17b187f316ff5fe143872b53d8cba3d8b07d91c604400da07ada9d7f84eea92c75069005601080bc285d9a2e5026ba9c3a863d65d1d38159956e915be140d8ddd64f668304f442356a6e429a7699a6ccb6ceecd4671f4f0f258b76c5ea93cb18b7613a7d893fc293f5f6d6f19ec488ed23587cbe32f973c6f51dd3484652b738c85cb748f3a6b1e9e41e7f5c2973e68f8725c1406e82cd971afef96621231c85e81daa3f8ed5f3aa7f2c679bc8a83399b30939886e854bc9a1684a3426361ca99463f8a6bdcbc6736051fbf80dee82ba664f878023ddcd8f548d076f867e61ee76b1423618c41e04dd3221d76b8dd38f793f0ef464be8e055bc578da2cbf12d2241da813f4cb4e19a377e1cd9b67a4114581ad0a641dde1e0dcd38c8549b72a267b36e293887a2153e48d41a747e83fdbf7395e03ec43adbe6440331e148857d147d1c25fd4f8e4c16b087c9d1985f3cca019e6c284274d938bd6bef9afe5530e11c46368729b7728007da8d46ba8d62a680416a0d689100e8c93236ce32a80aefd16374e4438d844b1fa4c7a26809e8cbdde13c9cb62c063cb9474dcead9bd3d0abd48343f145196745f37f6a52d8b860441357a010cc36ff0ff9a7223c816cd4da3381939b47ce0dbab907259849e9af3b73d5f4650e06fad0099efab029e540cbe030539322cc3cf519cfbf25f567af05210b6bae78843afabf0e8a2376af4cf6fe6f6a2ac11b8915e66fe5eeeb8785d0bcf34a38bc6ee4b8b038fa5811ac5ddc773e25b50266fd82ceb7910c8f5c054f21075e5cb413fd937d5104f57b8208bc6a389f1406b598854a6b06482ff8d768cf9912895bd35f9a61809f389476ee5204a55b8823b850541134ab3ed705be72d25a7694da224d2d775f7bffd6f2694695b17a8e14c95e82f7926d88cee2911d47455875ad12f2dc6b96088b45e0383250f630defb96748f53cde7756a42a2cd703b9293007a94de1bde13257b9029aab1ac9772a4b22dd5f1987bab29a4b55188667b17624cdbd0f30f69dcd102366674677ca65ef2256a2c3302e13fb11b020c5eb3212a4dbb366b4ae2dbabdd755934bfd15f58f7a0a29687a6bdcd29a8767f5ce4b5f47283d35a0c9602988ffb7e876acf10bc1cb0e0b0ce278d1287fbd55cab0bf34466f404e25535f2eaf60d477539db6c5191461f6ae8eed874f4c117a0dee71d19527b015f771a1", 0x1000, 0x18}, {0x3, 0x0, &(0x7f00000013c0)=',}+%\x00', &(0x7f0000001400)="ffd96760f26c475a56a0b0d61b4d8dae2f5e36fbd434484d6c1b3d38a964d3e57b81fe1c69e8938a5b82443d06eeecc3cb65b6ee8f407654a0590727f6b6288909812106b04bf0528739d8b600cbfcb23b6098628d67cba089bad5c80a8a57763c59ce027a3012da8ac8bbb7cb7fad09eb5105cef855050083a8193aeb5c5adbb841c1198b0e4c09d8647f7aa49b8b4281a91f3ec0802f83c83f22d3cda7fa4efec47bb6f447bdfdd27a6fcca7fab8e41725343ec15b03e3ebf715c1dc4a17b2b6a9a0b3e42d0e843f09c9c052de50c5587c1ebcf871b09b828a2786161455", 0xdf, 0x10}, {0x1, 0x52, &(0x7f0000001500)='fq_pie\x00', &(0x7f0000001540)="67fd9822dc5a093c44450cd624f79e67dea23fa67964ca7abe8724ce14981f652e037c5d87c6af28057ccbb20fadbdd4c2f4655cdd0aa114e350b3585c2dea661e67bfa015c5e188855051a2d934264ce31337a9c3f7c52cdf9ded7526f930158b61c7f4d29f1d21082f26a389a165726dd6e2ee2571b8e89c826b", 0x7b, 0x20}, {0x1, 0x9, &(0x7f00000015c0)='!~/\x00', &(0x7f0000001600)="f6faf7cc8fb195badb6d3454857755fb41de932c563dddcdfe37c52832a6a895fd3203c444c75f222ae2fd6c11", 0x2d, 0xa}, {0x2, 0x7, &(0x7f0000001640)='\x00', &(0x7f0000001680)="c7bc0fe2aac85c27e0747ee759c1eac3e41e7a93d707868d9a1df6781eb8d131ae575622c9498a69986c05d45872df323ff66b92782c706c15115664e430df3bf1ed2f1dee5f3efcee6d44b4ee25cc8d3aab660dff552a6320378dfacd741ce5f3f23a79dd3a1b4cad5280ed20b816a4c15a34657d77405e5acd74ff609008f7a9224a7250f33c55bcd4d2e8d76046a11e305b41aff0920055518e8cd25c45dda4689985d92f179fe06ec26964040d1d47", 0xb1}, {0x3, 0xa1, &(0x7f0000001740)='-\xb1:\x9e%\x00', &(0x7f0000001780)="617d5e08bd5a3a80212d24a51310479ceba8ab9c913de1141de5f6cfaa0aad10bea10195d8cf66301432a88a424beb1b689335b88db30fccd6b731c407e14a844f057e9504212e7342620fb63180e2f0f402a4ae81457e341cac5d792c3492424d388b26d5814b22af740b560c40c436745b387e4fbcda6ad383a12851ec8c70ba45747653514dc74fb63a5ef9fc0bb75e88800dcf8870d687753472b407cf4d43b5227f2722d14a1e55fe5b564b3abefedf3cff642d6e6594648f", 0xbb, 0x8}, {0x2, 0x1248, &(0x7f0000001840)='\x00', &(0x7f0000001880)="92414558b17e79f3f1c3057dba2e7a0e5f806842baa2e9b6481845c70bfde6bcedf1db26464ec948422353adf6472ad236e0694c1a80f710e3066e8eb73a744a19e073cf660fc0fd2235825112db8efc589f468841", 0x55, 0x2}]}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000001a80)={'pimreg1\x00'}) 112.992723ms ago: executing program 4 (id=8654): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040), 0xffffffffffffffff) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000001c0)={0x18, 0x7, &(0x7f0000000300)=@framed={{}, [@jmp={0x5, 0x0, 0xe, 0x0, 0x0, 0x3}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffffc}, @jmp={0x5, 0x0, 0x2, 0x0, 0x0, 0xffffffffffffffff, 0x10}, @ldst={0x2, 0x3, 0x3, 0xa, 0x0, 0xffffffffffffffc0, 0x10}]}, &(0x7f0000000140)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x24}, 0x94) sendmsg$BATADV_CMD_GET_TRANSTABLE_GLOBAL(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x3c, r1, 0x1, 0x70bd29, 0x25dfdbff, {}, [@BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x0, 0x37, 0x1}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5, 0x2e, 0x1}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x1}]}, 0x3c}, 0x1, 0x0, 0x0, 0x800}, 0x20000000) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) openat$cgroup_subtree(r2, &(0x7f0000000200), 0x2, 0x0) (async) r3 = openat$cgroup_subtree(r2, &(0x7f0000000200), 0x2, 0x0) write$cgroup_subtree(r3, &(0x7f00000001c0)=ANY=[@ANYBLOB='Fcpu'], 0x5) r4 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) socket$nl_route(0x10, 0x3, 0x0) (async) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000c80)={'lo\x00'}) (async) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000c80)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=@newqdisc={0x148, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r7, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_fq={{0x7}, {0x3c, 0x2, [@TCA_FQ_INITIAL_QUANTUM={0x8}, @TCA_FQ_LOW_RATE_THRESHOLD={0x8, 0xb, 0xffffffff}, @TCA_FQ_FLOW_DEFAULT_RATE={0x8}, @TCA_FQ_FLOW_MAX_RATE={0x8}, @TCA_FQ_LOW_RATE_THRESHOLD={0x8}, @TCA_FQ_FLOW_DEFAULT_RATE={0x8}, @TCA_FQ_FLOW_MAX_RATE={0x8, 0x7, 0x2}]}}, @TCA_STAB={0xe0, 0x8, 0x0, 0x1, [{{0x1c}, {0x4}}, {{0x1c, 0x1, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}}, {0x10, 0x2, [0x0, 0x0, 0xffff, 0x0, 0x0, 0x0]}}, {{0x19, 0x1, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}}, {0xe, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0]}}, {{0x1c, 0x1, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffff60}}, {0x8, 0x2, [0x0, 0x0]}}, {{0x1c}, {0x4}}, {{0x1c}, {0x4}}]}]}, 0x148}}, 0x0) ioctl$sock_netrom_SIOCDELRT(r4, 0x891e, 0x0) (async) ioctl$sock_netrom_SIOCDELRT(r4, 0x891e, 0x0) 1.913336ms ago: executing program 1 (id=8655): r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000000)=ANY=[@ANYBLOB="1c00000002030104000000000000"], 0x1c}}, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-asm\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000003c0)={0x1e, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x1, 0x2, 0x3, 0x2, 0x1, 0x11}]}, &(0x7f0000000380)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x4}, 0x94) r3 = accept4(r2, 0x0, 0x0, 0x80800) sendmmsg$alg(r3, &(0x7f0000000040)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r3, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x51}], 0x1}, 0x0) sendmsg$NFQNL_MSG_CONFIG(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=ANY=[@ANYBLOB="1c0000000203030000000000000000000000000008000100020000"], 0x1c}}, 0x0) ioctl$sock_netrom_SIOCADDRT(r0, 0x890b, &(0x7f0000000000)={0x1, @default, @bpq0, 0x400, 'syz0\x00', @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, 0x1, 0x2, [@netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @default, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null]}) 0s ago: executing program 2 (id=8656): r0 = syz_init_net_socket$x25(0x9, 0x5, 0x0) listen(r0, 0xc) (async) setsockopt$sock_timeval(r0, 0x1, 0x42, &(0x7f0000000000)={0x0, 0xea60}, 0x10) (async, rerun: 64) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x2, 0x4, 0x4, 0x8, 0x1014}, 0x50) (rerun: 64) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="0c00000004000000040000000700000000000000", @ANYRES32=r1, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000000000000000700000000000000800000000000000000000000d319fade76bd9ca203000385c6050400000000000000114430c8"], 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000200)={{r2, 0xffffffffffffffff}, &(0x7f0000000180), &(0x7f00000001c0)=r1}, 0x20) bpf$BPF_MAP_LOOKUP_AND_DELETE_ELEM(0x15, &(0x7f0000000140)={r3, &(0x7f0000000080), 0x0}, 0x20) socket$kcm(0x29, 0x6, 0x0) (async) accept(r0, 0x0, 0x0) kernel console output (not intermixed with test programs): 1][T31208] sctp: [Deprecated]: syz.5.7099 (pid 31208) Use of int in maxseg socket option. [ 630.587711][T31208] Use struct sctp_assoc_value instead [ 630.679270][T31213] xt_hashlimit: size too large, truncated to 1048576 [ 632.079832][T31280] veth0: entered promiscuous mode [ 632.195052][T31277] veth0: left promiscuous mode [ 632.490821][T31310] syzkaller0: entered promiscuous mode [ 632.497026][T31310] syzkaller0: entered allmulticast mode [ 632.679469][T31317] netlink: 'syz.2.7136': attribute type 21 has an invalid length. [ 632.687829][T31317] __nla_validate_parse: 85 callbacks suppressed [ 632.687847][T31317] netlink: 128 bytes leftover after parsing attributes in process `syz.2.7136'. [ 632.704224][T31317] netlink: 3 bytes leftover after parsing attributes in process `syz.2.7136'. [ 632.997237][T31325] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 633.313958][T31330] batadv_slave_0: entered promiscuous mode [ 633.326662][T31330] batadv_slave_0: left promiscuous mode [ 634.562326][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 634.573104][ T1167] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 634.581385][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 635.202996][ T6160] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 635.211303][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 635.241619][T31289] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 635.725349][T31366] Bluetooth: MGMT ver 1.23 [ 635.746520][ T29] audit: type=1800 audit(1773312452.848:35): pid=31368 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.5.7155" name="memory.events" dev="tmpfs" ino=2705 res=0 errno=0 [ 635.768839][T31371] netlink: 104 bytes leftover after parsing attributes in process `syz.2.7154'. [ 635.770571][ T6150] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 635.812726][ T6150] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 635.834461][ T29] audit: type=1804 audit(1773312452.888:36): pid=31368 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.5.7155" name="/newroot/529/memory.events" dev="tmpfs" ino=2705 res=1 errno=0 [ 635.861243][ T6150] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 635.893635][T31362] syzkaller0: entered promiscuous mode [ 635.899229][T31362] syzkaller0: entered allmulticast mode [ 635.926974][ T6150] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 635.993993][T31388] netlink: 212368 bytes leftover after parsing attributes in process `syz.2.7159'. [ 636.038825][T31391] netlink: 'syz.1.7161': attribute type 2 has an invalid length. [ 636.058905][T31392] netlink: 'syz.1.7161': attribute type 2 has an invalid length. [ 636.485286][ T5926] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 636.570658][T31432] netlink: 16 bytes leftover after parsing attributes in process `syz.1.7175'. [ 636.580410][T31432] netlink: 12 bytes leftover after parsing attributes in process `syz.1.7175'. [ 636.621459][T31435] openvswitch: netlink: Tunnel attr 204 out of range max 16 [ 637.683755][T31443] netlink: 4 bytes leftover after parsing attributes in process `syz.4.7177'. [ 637.696544][T31443] netlink: 4 bytes leftover after parsing attributes in process `syz.4.7177'. [ 637.846545][T31450] netlink: 24 bytes leftover after parsing attributes in process `syz.4.7180'. [ 637.950818][T31453] netlink: 8 bytes leftover after parsing attributes in process `syz.4.7181'. [ 637.961067][T31453] netlink: 'syz.4.7181': attribute type 1 has an invalid length. [ 637.969017][T31453] netlink: 8 bytes leftover after parsing attributes in process `syz.4.7181'. [ 637.978389][T31453] netlink: 8 bytes leftover after parsing attributes in process `syz.4.7181'. [ 637.987492][T31453] netlink: 'syz.4.7181': attribute type 1 has an invalid length. [ 637.995411][T31453] netlink: 8 bytes leftover after parsing attributes in process `syz.4.7181'. [ 638.858130][T31377] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 638.890158][ T13] wlan1: Trigger new scan to find an IBSS to join [ 639.028603][T31458] xt_CHECKSUM: unsupported CHECKSUM operation 68 [ 639.083710][T31460] tipc: New replicast peer: 255.255.255.255 [ 639.101135][T31460] tipc: Enabled bearer , priority 10 [ 639.137747][T31468] netlink: 24 bytes leftover after parsing attributes in process `syz.0.7188'. [ 639.210049][T31475] netlink: 12 bytes leftover after parsing attributes in process `syz.4.7186'. [ 639.247779][T31464] bond2: Unable to set up delay as MII monitoring is disabled [ 639.257860][T31464] bond2 (unregistering): Released all slaves [ 639.294079][T31472] netlink: 40 bytes leftover after parsing attributes in process `syz.2.7185'. [ 639.304253][ T1167] netdevsim netdevsim5 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 639.315571][ T1167] netdevsim netdevsim5 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 639.327332][ T1167] netdevsim netdevsim5 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 639.361593][T31475] bridge2: trying to set multicast query interval above maximum, setting to 8640000 (86400000ms) [ 639.394967][ T1167] netdevsim netdevsim5 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 639.432087][T31482] netlink: 'syz.5.7190': attribute type 39 has an invalid length. [ 639.527400][T31489] netlink: 12 bytes leftover after parsing attributes in process `syz.4.7193'. [ 639.684694][ T1167] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 639.693119][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 639.704816][T31502] xt_CHECKSUM: unsupported CHECKSUM operation 68 [ 639.806945][T31510] sctp: [Deprecated]: syz.2.7201 (pid 31510) Use of struct sctp_assoc_value in delayed_ack socket option. [ 639.806945][T31510] Use struct sctp_sack_info instead [ 639.834317][T31511] xt_AUDIT: Audit type out of range (valid range: 0..2) [ 640.553781][T31538] netlink: 'syz.5.7207': attribute type 4 has an invalid length. [ 640.963282][ T13] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 640.971590][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 642.548670][T31491] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 642.724369][T31543] xt_CHECKSUM: unsupported CHECKSUM operation 68 [ 642.790612][T31547] tipc: Enabling not permitted [ 642.797767][T31547] tipc: Enabling of bearer rejected, failed to enable media [ 642.907505][T31554] netlink: 8 bytes leftover after parsing attributes in process `syz.0.7211'. [ 642.940879][T31564] netlink: 'syz.5.7213': attribute type 10 has an invalid length. [ 642.968702][T31564] netlink: 228 bytes leftover after parsing attributes in process `syz.5.7213'. [ 643.101519][T31574] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 643.148038][T31574] netlink: 28 bytes leftover after parsing attributes in process `syz.4.7216'. [ 643.805483][T31623] syzkaller0: entered promiscuous mode [ 643.811391][T31623] syzkaller0: entered allmulticast mode [ 643.843675][ T6160] wlan1: Trigger new scan to find an IBSS to join [ 643.874071][T31611] wg1 speed is unknown, defaulting to 1000 [ 644.421111][T31636] x9: renamed from bridge_slave_0 (while UP) [ 644.758717][T31638] bridge_slave_0: left allmulticast mode [ 644.764466][T31638] bridge_slave_0: left promiscuous mode [ 644.770198][T31638] bridge0: port 1(bridge_slave_0) entered disabled state [ 644.779390][ T12] wlan1: Creating new IBSS network, BSSID e6:d1:47:55:01:66 [ 644.788818][T31638] bridge_slave_1: left allmulticast mode [ 644.795686][T31638] bridge_slave_1: left promiscuous mode [ 644.801397][T31638] bridge0: port 2(bridge_slave_1) entered disabled state [ 644.813765][ T6160] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 644.822290][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 644.836837][T31638] bond0: (slave bond_slave_0): Releasing backup interface [ 644.847912][T31638] bond0: (slave bond_slave_1): Releasing backup interface [ 644.858693][T31638] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 644.868188][T31638] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 644.877500][T31638] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 644.886258][T31638] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 644.895902][T31638] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 646.003779][ T1167] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 646.012165][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 646.085561][ T5892] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 646.375502][T31595] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 646.982013][T31656] netlink: 32 bytes leftover after parsing attributes in process `syz.4.7238'. [ 646.991576][T31661] netlink: 'syz.0.7241': attribute type 4 has an invalid length. [ 647.071320][T31680] xt_hashlimit: size too large, truncated to 1048576 [ 647.235637][T31694] netlink: 14 bytes leftover after parsing attributes in process `syz.1.7248'. [ 647.471533][T31703] netlink: 12 bytes leftover after parsing attributes in process `syz.1.7250'. [ 647.483043][T31703] netlink: 12 bytes leftover after parsing attributes in process `syz.1.7250'. [ 647.498030][T31703] netlink: 4 bytes leftover after parsing attributes in process `syz.1.7250'. [ 648.520466][T31720] netlink: 'syz.1.7252': attribute type 10 has an invalid length. [ 648.530183][T31720] team0: Device vxcan1 is of different type [ 648.540031][T31720] netlink: 4 bytes leftover after parsing attributes in process `syz.1.7252'. [ 649.804365][T31673] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 649.926151][ T12] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 649.935028][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 649.954134][T31722] team0: Device ip6gre3 is of different type [ 650.098858][T31732] netlink: 8 bytes leftover after parsing attributes in process `syz.2.7254'. [ 650.133574][T31732] netdevsim netdevsim2 netdevsim0: entered promiscuous mode [ 650.164857][T31732] netlink: 148 bytes leftover after parsing attributes in process `syz.2.7254'. [ 650.174126][T31740] netlink: 'syz.1.7261': attribute type 11 has an invalid length. [ 650.182637][T31741] block nbd0: reconnected socket [ 650.195514][T22286] block nbd0: Receive control failed (result -107) [ 650.333755][T31751] netlink: 'syz.2.7263': attribute type 1 has an invalid length. [ 650.372646][T31743] netlink: 1956 bytes leftover after parsing attributes in process `syz.0.7260'. [ 650.382946][T31755] netlink: 'syz.1.7264': attribute type 11 has an invalid length. [ 650.391141][T31755] netlink: 'syz.1.7264': attribute type 11 has an invalid length. [ 650.421830][T31755] netlink: 204 bytes leftover after parsing attributes in process `syz.1.7264'. [ 650.449292][T31746] netlink: 28 bytes leftover after parsing attributes in process `syz.5.7262'. [ 650.468313][T31746] netlink: 28 bytes leftover after parsing attributes in process `syz.5.7262'. [ 650.579639][T31769] netlink: 104 bytes leftover after parsing attributes in process `syz.5.7269'. [ 650.591375][T31770] netlink: 104 bytes leftover after parsing attributes in process `syz.5.7269'. [ 650.602850][T31771] netlink: 104 bytes leftover after parsing attributes in process `syz.5.7269'. [ 650.820052][T31789] FAULT_INJECTION: forcing a failure. [ 650.820052][T31789] name failslab, interval 1, probability 0, space 0, times 0 [ 650.840717][T31789] CPU: 1 UID: 0 PID: 31789 Comm: syz.1.7274 Not tainted syzkaller #0 PREEMPT(full) [ 650.840741][T31789] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/27/2026 [ 650.840751][T31789] Call Trace: [ 650.840758][T31789] [ 650.840766][T31789] dump_stack_lvl+0xe8/0x150 [ 650.840793][T31789] should_fail_ex+0x412/0x560 [ 650.840820][T31789] should_failslab+0xa8/0x100 [ 650.840840][T31789] ? dst_alloc+0x105/0x170 [ 650.840861][T31789] kmem_cache_alloc_noprof+0x87/0x650 [ 650.840890][T31789] dst_alloc+0x105/0x170 [ 650.840914][T31789] ip6_blackhole_route+0x59/0x340 [ 650.841023][T31789] xfrm_lookup_route+0xd7/0x1c0 [ 650.841098][T31789] ? ip6_datagram_dst_update+0x512/0xd20 [ 650.841149][T31789] ip6_datagram_dst_update+0x73a/0xd20 [ 650.841185][T31789] __ip6_datagram_connect+0xbd1/0x1150 [ 650.841221][T31789] ? __pfx___ip6_datagram_connect+0x10/0x10 [ 650.841256][T31789] ? ip6_datagram_connect_v6_only+0x56/0xa0 [ 650.841286][T31789] ? __local_bh_enable_ip+0xd0/0x130 [ 650.841314][T31789] ip6_datagram_connect_v6_only+0x63/0xa0 [ 650.841343][T31789] __sys_connect+0x312/0x450 [ 650.841372][T31789] ? __pfx___sys_connect+0x10/0x10 [ 650.841411][T31789] ? __pfx_ksys_write+0x10/0x10 [ 650.841440][T31789] __x64_sys_connect+0x7a/0x90 [ 650.841466][T31789] do_syscall_64+0x14d/0xf80 [ 650.841486][T31789] ? trace_irq_disable+0x3b/0x150 [ 650.841512][T31789] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 650.841532][T31789] ? clear_bhb_loop+0x40/0x90 [ 650.841556][T31789] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 650.841574][T31789] RIP: 0033:0x7f4f9359c799 [ 650.841593][T31789] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 650.841609][T31789] RSP: 002b:00007f4f94489028 EFLAGS: 00000246 ORIG_RAX: 000000000000002a [ 650.841629][T31789] RAX: ffffffffffffffda RBX: 00007f4f93815fa0 RCX: 00007f4f9359c799 [ 650.841643][T31789] RDX: 000000000000001c RSI: 0000200000000000 RDI: 0000000000000004 [ 650.841655][T31789] RBP: 00007f4f94489090 R08: 0000000000000000 R09: 0000000000000000 [ 650.841668][T31789] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 650.841677][T31789] R13: 00007f4f93816038 R14: 00007f4f93815fa0 R15: 00007ffd770471f8 [ 650.841704][T31789] [ 651.477175][ T6154] netdevsim netdevsim4 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 651.486202][ T6154] netdevsim netdevsim4 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 651.529509][ T6154] netdevsim netdevsim4 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 651.544548][ T6154] netdevsim netdevsim4 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 651.640687][T31830] FAULT_INJECTION: forcing a failure. [ 651.640687][T31830] name failslab, interval 1, probability 0, space 0, times 0 [ 651.656244][T31830] CPU: 0 UID: 0 PID: 31830 Comm: syz.0.7287 Not tainted syzkaller #0 PREEMPT(full) [ 651.656270][T31830] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/27/2026 [ 651.656281][T31830] Call Trace: [ 651.656289][T31830] [ 651.656297][T31830] dump_stack_lvl+0xe8/0x150 [ 651.656327][T31830] should_fail_ex+0x412/0x560 [ 651.656355][T31830] should_failslab+0xa8/0x100 [ 651.656378][T31830] ? dst_alloc+0x105/0x170 [ 651.656398][T31830] kmem_cache_alloc_noprof+0x87/0x650 [ 651.656427][T31830] dst_alloc+0x105/0x170 [ 651.656450][T31830] xfrm_lookup_with_ifid+0x7cf/0x1b90 [ 651.656473][T31830] ? __pfx_ip6_dst_lookup_tail+0x10/0x10 [ 651.656586][T31830] ? __pfx_xfrm_lookup_with_ifid+0x10/0x10 [ 651.656611][T31830] ? ip6_datagram_dst_update+0x512/0xd20 [ 651.656644][T31830] xfrm_lookup_route+0x3c/0x1c0 [ 651.656667][T31830] ? ip6_datagram_dst_update+0x512/0xd20 [ 651.656690][T31830] ip6_datagram_dst_update+0x73a/0xd20 [ 651.656722][T31830] __ip6_datagram_connect+0xbd1/0x1150 [ 651.656758][T31830] ? __pfx___ip6_datagram_connect+0x10/0x10 [ 651.656784][T31830] ? ip6_datagram_connect_v6_only+0x56/0xa0 [ 651.656816][T31830] ? __local_bh_enable_ip+0xd0/0x130 [ 651.656844][T31830] ip6_datagram_connect_v6_only+0x63/0xa0 [ 651.656877][T31830] __sys_connect+0x312/0x450 [ 651.656904][T31830] ? __pfx___sys_connect+0x10/0x10 [ 651.656942][T31830] ? __pfx_ksys_write+0x10/0x10 [ 651.656970][T31830] __x64_sys_connect+0x7a/0x90 [ 651.657011][T31830] do_syscall_64+0x14d/0xf80 [ 651.657028][T31830] ? trace_irq_disable+0x3b/0x150 [ 651.657052][T31830] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 651.657071][T31830] ? clear_bhb_loop+0x40/0x90 [ 651.657094][T31830] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 651.657112][T31830] RIP: 0033:0x7f36fe99c799 [ 651.657130][T31830] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 651.657146][T31830] RSP: 002b:00007f36ff7ce028 EFLAGS: 00000246 ORIG_RAX: 000000000000002a [ 651.657166][T31830] RAX: ffffffffffffffda RBX: 00007f36fec15fa0 RCX: 00007f36fe99c799 [ 651.657186][T31830] RDX: 000000000000001c RSI: 0000200000000000 RDI: 0000000000000004 [ 651.657198][T31830] RBP: 00007f36ff7ce090 R08: 0000000000000000 R09: 0000000000000000 [ 651.657209][T31830] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 651.657220][T31830] R13: 00007f36fec16038 R14: 00007f36fec15fa0 R15: 00007ffc753a3ae8 [ 651.657252][T31830] [ 651.864009][ T1145] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 651.910799][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 652.002842][T22286] Bluetooth: hci5: command 0x0406 tx timeout [ 653.515739][T31763] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 653.793404][T31855] __nla_validate_parse: 7 callbacks suppressed [ 653.793438][T31855] netlink: 20 bytes leftover after parsing attributes in process `syz.1.7295'. [ 653.886742][T31866] FAULT_INJECTION: forcing a failure. [ 653.886742][T31866] name failslab, interval 1, probability 0, space 0, times 0 [ 653.908552][T31866] CPU: 0 UID: 0 PID: 31866 Comm: syz.4.7298 Not tainted syzkaller #0 PREEMPT(full) [ 653.908577][T31866] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/27/2026 [ 653.908588][T31866] Call Trace: [ 653.908596][T31866] [ 653.908604][T31866] dump_stack_lvl+0xe8/0x150 [ 653.908634][T31866] should_fail_ex+0x412/0x560 [ 653.908664][T31866] should_failslab+0xa8/0x100 [ 653.908686][T31866] ? dst_alloc+0x105/0x170 [ 653.908706][T31866] kmem_cache_alloc_noprof+0x87/0x650 [ 653.908733][T31866] dst_alloc+0x105/0x170 [ 653.908757][T31866] ip6_blackhole_route+0x59/0x340 [ 653.908785][T31866] xfrm_lookup_route+0xd7/0x1c0 [ 653.908808][T31866] ? ip6_datagram_dst_update+0x512/0xd20 [ 653.908833][T31866] ip6_datagram_dst_update+0x73a/0xd20 [ 653.908867][T31866] __ip6_datagram_connect+0xbd1/0x1150 [ 653.908903][T31866] ? __pfx___ip6_datagram_connect+0x10/0x10 [ 653.908938][T31866] ? ip6_datagram_connect_v6_only+0x56/0xa0 [ 653.908967][T31866] ? __local_bh_enable_ip+0xd0/0x130 [ 653.908995][T31866] ip6_datagram_connect_v6_only+0x63/0xa0 [ 653.909023][T31866] __sys_connect+0x312/0x450 [ 653.909051][T31866] ? __pfx___sys_connect+0x10/0x10 [ 653.909088][T31866] ? __pfx_ksys_write+0x10/0x10 [ 653.909117][T31866] __x64_sys_connect+0x7a/0x90 [ 653.909142][T31866] do_syscall_64+0x14d/0xf80 [ 653.909159][T31866] ? trace_irq_disable+0x3b/0x150 [ 653.909184][T31866] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 653.909203][T31866] ? clear_bhb_loop+0x40/0x90 [ 653.909226][T31866] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 653.909244][T31866] RIP: 0033:0x7f5ac679c799 [ 653.909262][T31866] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 653.909277][T31866] RSP: 002b:00007f5ac7585028 EFLAGS: 00000246 ORIG_RAX: 000000000000002a [ 653.909297][T31866] RAX: ffffffffffffffda RBX: 00007f5ac6a15fa0 RCX: 00007f5ac679c799 [ 653.909311][T31866] RDX: 000000000000001c RSI: 0000200000000000 RDI: 0000000000000004 [ 653.909322][T31866] RBP: 00007f5ac7585090 R08: 0000000000000000 R09: 0000000000000000 [ 653.909333][T31866] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 653.909344][T31866] R13: 00007f5ac6a16038 R14: 00007f5ac6a15fa0 R15: 00007fffbf913998 [ 653.909375][T31866] [ 654.277668][T31877] netlink: 28 bytes leftover after parsing attributes in process `syz.1.7300'. [ 654.440327][T31890] netlink: 'syz.1.7306': attribute type 5 has an invalid length. [ 654.461261][T31890] netlink: 8 bytes leftover after parsing attributes in process `syz.1.7306'. [ 654.616152][T31908] netlink: 'syz.1.7309': attribute type 1 has an invalid length. [ 655.682282][ T6154] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 655.690444][ T5922] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 655.698596][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 655.924050][T22286] Bluetooth: hci1: command 0x0405 tx timeout [ 657.316849][T31880] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 657.339886][T31902] netlink: 'syz.5.7308': attribute type 1 has an invalid length. [ 657.492422][T31916] netlink: 4 bytes leftover after parsing attributes in process `syz.2.7311'. [ 657.529783][T31919] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 657.569401][T31923] sctp: [Deprecated]: syz.5.7315 (pid 31923) Use of int in maxseg socket option. [ 657.569401][T31923] Use struct sctp_assoc_value instead [ 657.583696][T31925] netlink: 'syz.1.7312': attribute type 10 has an invalid length. [ 657.605028][ T13] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 657.613420][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 657.623777][T31924] syzkaller1: entered promiscuous mode [ 657.632357][T31924] syzkaller1: entered allmulticast mode [ 657.640934][T31925] team0: Device vxcan1 is of different type [ 657.642250][T31924] netlink: 36 bytes leftover after parsing attributes in process `syz.4.7314'. [ 658.079533][T31957] openvswitch: netlink: IP tunnel TTL not specified. [ 658.243541][T31970] netlink: 48 bytes leftover after parsing attributes in process `syz.2.7329'. [ 658.448098][T31956] wg1 speed is unknown, defaulting to 1000 [ 658.677990][T31992] netlink: 16 bytes leftover after parsing attributes in process `syz.2.7334'. [ 658.732023][T31993] netlink: 16 bytes leftover after parsing attributes in process `syz.2.7334'. [ 659.342051][T32034] netlink: 212408 bytes leftover after parsing attributes in process `syz.2.7344'. [ 659.575968][T32049] netlink: 104 bytes leftover after parsing attributes in process `syz.1.7352'. [ 659.642981][T32053] netlink: 20 bytes leftover after parsing attributes in process `syz.4.7354'. [ 659.668008][T32054] netlink: 20 bytes leftover after parsing attributes in process `syz.4.7354'. [ 659.737256][T32064] netlink: 'syz.1.7356': attribute type 21 has an invalid length. [ 659.774575][T32064] netlink: 152 bytes leftover after parsing attributes in process `syz.1.7356'. [ 659.812904][T32069] netlink: 8 bytes leftover after parsing attributes in process `syz.2.7360'. [ 659.979097][T32079] netlink: 12 bytes leftover after parsing attributes in process `syz.2.7364'. [ 659.999663][T32085] netlink: 68 bytes leftover after parsing attributes in process `syz.4.7365'. [ 660.034126][T32079] netlink: 10 bytes leftover after parsing attributes in process `syz.2.7364'. [ 660.352698][T32107] netlink: 16 bytes leftover after parsing attributes in process `syz.5.7371'. [ 660.371204][T18926] IPVS: starting estimator thread 0... [ 660.472465][T32111] IPVS: using max 36 ests per chain, 86400 per kthread [ 660.581611][T32123] bond13: entered promiscuous mode [ 660.589537][T32123] bond13: entered allmulticast mode [ 660.595843][T32123] 8021q: adding VLAN 0 to HW filter on device bond13 [ 661.443178][ T12] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 661.451522][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 662.242222][T22286] Bluetooth: hci4: command 0x0406 tx timeout [ 662.722318][ T6154] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 662.730624][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 662.922405][T32076] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 663.041288][T32130] netlink: 'syz.1.7378': attribute type 10 has an invalid length. [ 663.053516][T32130] bridge0: port 2(bridge_slave_1) entered disabled state [ 663.061149][T32130] bridge_slave_1: left allmulticast mode [ 663.095627][T32130] bridge_slave_1: left promiscuous mode [ 663.109661][T32130] bridge0: port 2(bridge_slave_1) entered disabled state [ 663.117334][T32133] netlink: 'syz.0.7380': attribute type 1 has an invalid length. [ 663.144496][T32130] bond0: (slave bridge_slave_1): Enslaving as an active interface with an up link [ 663.196817][T32142] bond2: (slave gretap2): making interface the new active one [ 663.205796][T32142] bond2: (slave gretap2): Enslaving as an active interface with an up link [ 663.219279][T32133] netlink: 'syz.0.7380': attribute type 1 has an invalid length. [ 663.227218][T32133] netlink: 'syz.0.7380': attribute type 2 has an invalid length. [ 663.557483][T32175] tap0: tun_chr_ioctl cmd 1074025672 [ 663.563125][T32175] tap0: ignored: set checksum disabled [ 663.739067][T32187] netlink: Unknown conntrack attr (0) [ 663.888700][T32194] xt_CHECKSUM: unsupported CHECKSUM operation 68 [ 665.286022][ T5926] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 666.434201][T32160] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 666.667155][T32217] __nla_validate_parse: 7 callbacks suppressed [ 666.667175][T32217] netlink: 4 bytes leftover after parsing attributes in process `syz.5.7403'. [ 666.834196][T32228] netlink: 72 bytes leftover after parsing attributes in process `syz.5.7409'. [ 666.854974][T32231] Cannot find del_set index 4 as target [ 666.861833][T32231] netlink: 8 bytes leftover after parsing attributes in process `syz.0.7410'. [ 666.875019][T32232] netlink: 'syz.4.7407': attribute type 1 has an invalid length. [ 666.883052][T32232] netlink: 'syz.4.7407': attribute type 2 has an invalid length. [ 666.891143][T32232] netlink: 'syz.4.7407': attribute type 1 has an invalid length. [ 666.899105][T32232] netlink: 'syz.4.7407': attribute type 3 has an invalid length. [ 666.907559][T32231] netlink: 224 bytes leftover after parsing attributes in process `syz.0.7410'. [ 666.916854][T32232] netlink: 4 bytes leftover after parsing attributes in process `syz.4.7407'. [ 666.929286][T32231] netlink: 8 bytes leftover after parsing attributes in process `syz.0.7410'. [ 667.202846][ T6160] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 667.211165][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 667.649629][T32272] netlink: 28 bytes leftover after parsing attributes in process `syz.2.7419'. [ 667.667765][T32272] netlink: 28 bytes leftover after parsing attributes in process `syz.2.7419'. [ 667.746382][T32275] syzkaller0: entered promiscuous mode [ 667.756818][T32275] syzkaller0: entered allmulticast mode [ 667.768104][T32275] x_tables: duplicate underflow at hook 1 [ 667.839909][T32277] openvswitch: netlink: IP tunnel dst address not specified [ 667.999581][T32289] netlink: 4 bytes leftover after parsing attributes in process `syz.5.7424'. [ 668.014893][T32289] macsec2: entered promiscuous mode [ 668.020225][T32289] bridge0: entered promiscuous mode [ 668.025916][T32289] macsec2: entered allmulticast mode [ 668.031324][T32289] bridge0: entered allmulticast mode [ 668.037203][T32289] bridge0: port 1(macsec2) entered blocking state [ 668.044208][T32289] bridge0: port 1(macsec2) entered disabled state [ 668.053959][T32289] bridge0: left allmulticast mode [ 668.059209][T32289] bridge0: left promiscuous mode [ 668.191004][T32296] xt_hashlimit: overflow, try lower: 3/0 [ 668.321648][T32303] syzkaller0: entered promiscuous mode [ 668.328010][T32303] syzkaller0: entered allmulticast mode [ 668.482256][ T1167] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 668.490529][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 670.272549][T32245] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 670.504010][T32316] netlink: 12 bytes leftover after parsing attributes in process `syz.1.7431'. [ 670.534729][T32316] syzkaller0: entered promiscuous mode [ 670.540328][T32316] syzkaller0: entered allmulticast mode [ 671.112345][T32374] Cannot find add_set index 2 as target [ 671.596858][T32391] netlink: 'syz.0.7453': attribute type 1 has an invalid length. [ 671.744942][T32400] openvswitch: netlink: Tunnel attr 288 out of range max 16 [ 672.057308][T32403] wg1 speed is unknown, defaulting to 1000 [ 672.977983][ T6150] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 672.986351][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 673.877908][T32350] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 674.228747][T32435] block nbd0: reconnected socket [ 674.242806][ T1167] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 674.251177][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 674.320086][T21302] block nbd0: Receive control failed (result -32) [ 674.406534][T32447] openvswitch: netlink: Tunnel attr 78 out of range max 16 [ 674.686699][T32471] netlink: 'syz.2.7473': attribute type 33 has an invalid length. [ 674.709530][T32474] __nla_validate_parse: 3 callbacks suppressed [ 674.709549][T32474] netlink: 28 bytes leftover after parsing attributes in process `syz.5.7467'. [ 674.752001][T32474] netlink: 28 bytes leftover after parsing attributes in process `syz.5.7467'. [ 674.819552][ T13] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 674.822994][T32478] netlink: 52 bytes leftover after parsing attributes in process `syz.0.7475'. [ 674.832108][T32476] netlink: 16 bytes leftover after parsing attributes in process `syz.4.7476'. [ 674.868083][T32479] netlink: 'syz.0.7475': attribute type 2 has an invalid length. [ 674.882688][ T5926] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 674.898793][T32476] syzkaller0: entered promiscuous mode [ 674.905330][T32476] syzkaller0: entered allmulticast mode [ 674.917598][T32476] netlink: 260 bytes leftover after parsing attributes in process `syz.4.7476'. [ 674.970331][T32488] netlink: 232 bytes leftover after parsing attributes in process `syz.5.7479'. [ 675.014776][T32490] netlink: 8 bytes leftover after parsing attributes in process `syz.0.7480'. [ 675.034572][T32490] netdevsim netdevsim0 netdevsim0: entered promiscuous mode [ 675.126257][T32489] netlink: 'syz.1.7477': attribute type 1 has an invalid length. [ 675.142642][T32489] netlink: 236 bytes leftover after parsing attributes in process `syz.1.7477'. [ 675.200104][T32504] netlink: 'syz.4.7481': attribute type 3 has an invalid length. [ 675.287601][T32500] ipt_REJECT: ECHOREPLY no longer supported. [ 675.653640][T32524] netlink: 28 bytes leftover after parsing attributes in process `syz.2.7490'. [ 675.668254][T32524] netlink: 28 bytes leftover after parsing attributes in process `syz.2.7490'. [ 675.690447][T32537] netlink: 'syz.4.7493': attribute type 7 has an invalid length. [ 676.278093][T32585] xt_ipcomp: unknown flags 1D [ 676.479620][T32598] xt_hashlimit: size too large, truncated to 1048576 [ 676.790500][T32623] netlink: 'syz.0.7517': attribute type 1 has an invalid length. [ 679.460313][T32596] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 679.677275][T32648] xt_hashlimit: size too large, truncated to 1048576 [ 679.728567][T32646] __nla_validate_parse: 8 callbacks suppressed [ 679.728588][T32646] netlink: 348 bytes leftover after parsing attributes in process `syz.0.7522'. [ 680.105977][T22286] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 680.117933][T22286] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 680.133965][T22286] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 680.144370][T32663] netlink: 4 bytes leftover after parsing attributes in process `syz.4.7528'. [ 680.165770][T22286] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 680.183649][T22286] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 680.256129][T32668] netlink: 'syz.2.7530': attribute type 2 has an invalid length. [ 680.272343][T32663] hsr_slave_0 (unregistering): left promiscuous mode [ 680.285823][T32668] netlink: 188 bytes leftover after parsing attributes in process `syz.2.7530'. [ 680.593631][T32682] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 680.600922][T32682] IPv6: NLM_F_CREATE should be set when creating new route [ 680.608298][T32682] IPv6: NLM_F_CREATE should be set when creating new route [ 680.615573][T32682] IPv6: NLM_F_CREATE should be set when creating new route [ 680.635087][T32681] netlink: 108 bytes leftover after parsing attributes in process `syz.4.7535'. [ 680.657634][T32682] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 680.665853][T32681] netlink: 'syz.4.7535': attribute type 64 has an invalid length. [ 680.695312][T32682] netlink: 'syz.2.7533': attribute type 7 has an invalid length. [ 680.753055][T32682] netlink: 'syz.2.7533': attribute type 8 has an invalid length. [ 680.920725][T32661] wg1 speed is unknown, defaulting to 1000 [ 681.108826][ T1145] netdevsim netdevsim5 eth5: set [0, 0] type 1 family 0 port 8472 - 0 [ 681.144155][ T1145] netdevsim netdevsim5 eth6: set [0, 0] type 1 family 0 port 8472 - 0 [ 681.284098][ T13] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 681.292488][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 681.348534][ T6154] netdevsim netdevsim5 eth7: set [0, 0] type 1 family 0 port 8472 - 0 [ 681.419072][ T6154] netdevsim netdevsim5 eth8: set [0, 0] type 1 family 0 port 8472 - 0 [ 681.650032][ T12] erspan0: left allmulticast mode [ 681.673670][ T12] erspan0: left promiscuous mode [ 681.688956][ T12] bridge21: port 1(erspan0) entered disabled state [ 681.985678][ T12] bond7 (unregistering): (slave gretap1): Releasing active interface [ 682.155843][ T12] bond4 (unregistering): (slave bridge2): Releasing backup interface [ 682.164513][ T12] bond4 (unregistering): (slave bridge2): the permanent HWaddr of slave - 06:8c:6d:1f:8b:01 - is still in use by bond - set the HWaddr of slave to a different address to avoid conflicts [ 682.183769][ T12] bridge2 (unregistering): left promiscuous mode [ 682.190135][ T12] bond4 (unregistering): (slave bridge3): making interface the new active one [ 682.199753][ T12] bridge3 (unregistering): entered promiscuous mode [ 682.242183][T22286] Bluetooth: hci3: command tx timeout [ 682.251573][ T12] bond4 (unregistering): (slave bridge3): Releasing backup interface [ 682.259859][ T12] bridge3 (unregistering): left promiscuous mode [ 682.266326][ T12] bond4 (unregistering): (slave bridge4): making interface the new active one [ 682.275649][ T12] bridge4 (unregistering): entered promiscuous mode [ 682.297285][ T12] bond4 (unregistering): (slave bridge4): Releasing backup interface [ 682.305952][ T12] bridge4 (unregistering): left promiscuous mode [ 682.313407][ T12] bond4 (unregistering): (slave bridge5): making interface the new active one [ 682.324036][ T12] bridge5 (unregistering): entered promiscuous mode [ 682.345345][ T12] bond4 (unregistering): (slave bridge5): Releasing backup interface [ 682.354049][ T12] bridge5 (unregistering): left promiscuous mode [ 682.360488][ T12] bond4 (unregistering): (slave bridge6): making interface the new active one [ 682.369937][ T12] bridge6 (unregistering): entered promiscuous mode [ 682.385415][ T12] bond4 (unregistering): (slave bridge6): Releasing backup interface [ 682.393760][ T12] bridge6 (unregistering): left promiscuous mode [ 682.400269][ T12] bond4 (unregistering): (slave bridge7): making interface the new active one [ 682.409408][ T12] bridge7 (unregistering): entered promiscuous mode [ 682.434963][ T12] bond4 (unregistering): (slave bridge7): Releasing backup interface [ 682.443287][ T12] bridge7 (unregistering): left promiscuous mode [ 682.449665][ T12] bond4 (unregistering): (slave bridge8): making interface the new active one [ 682.458941][ T12] bridge8 (unregistering): entered promiscuous mode [ 682.506062][ T12] bond4 (unregistering): (slave bridge8): Releasing backup interface [ 682.514381][ T12] bridge8 (unregistering): left promiscuous mode [ 682.520822][ T12] bond4 (unregistering): (slave bridge9): making interface the new active one [ 682.529909][ T12] bridge9 (unregistering): entered promiscuous mode [ 682.566057][ T12] bond4 (unregistering): (slave bridge9): Releasing backup interface [ 682.574545][ T12] bridge9 (unregistering): left promiscuous mode [ 682.580941][ T12] bond4 (unregistering): (slave bridge10): making interface the new active one [ 682.590030][ T12] bridge10 (unregistering): entered promiscuous mode [ 682.616625][ T12] bond4 (unregistering): (slave bridge10): Releasing backup interface [ 682.624898][ T12] bridge10 (unregistering): left promiscuous mode [ 682.631351][ T12] bond4 (unregistering): (slave bridge11): making interface the new active one [ 682.640450][ T12] bridge11 (unregistering): entered promiscuous mode [ 682.675694][ T12] bond4 (unregistering): (slave bridge11): Releasing backup interface [ 682.684044][ T12] bridge11 (unregistering): left promiscuous mode [ 682.690468][ T12] bond4 (unregistering): (slave bridge12): making interface the new active one [ 682.699540][ T12] bridge12 (unregistering): entered promiscuous mode [ 682.715257][ T12] bond4 (unregistering): (slave bridge12): Releasing backup interface [ 682.725368][ T12] bridge12 (unregistering): left promiscuous mode [ 682.731972][ T12] bond4 (unregistering): (slave bridge13): making interface the new active one [ 682.741012][ T12] bridge13 (unregistering): entered promiscuous mode [ 682.787056][ T12] bond4 (unregistering): (slave bridge13): Releasing backup interface [ 682.795474][ T12] bridge13 (unregistering): left promiscuous mode [ 682.803098][ T12] bond4 (unregistering): (slave bridge14): making interface the new active one [ 682.812497][ T12] bridge14 (unregistering): entered promiscuous mode [ 682.835068][ T12] bond4 (unregistering): (slave bridge14): Releasing backup interface [ 682.843427][ T12] bridge14 (unregistering): left promiscuous mode [ 682.849859][ T12] bond4 (unregistering): (slave bridge15): making interface the new active one [ 682.858964][ T12] bridge15 (unregistering): entered promiscuous mode [ 682.886218][ T12] bond4 (unregistering): (slave bridge15): Releasing backup interface [ 682.894694][ T12] bridge15 (unregistering): left promiscuous mode [ 682.901136][ T12] bond4 (unregistering): (slave bridge16): making interface the new active one [ 682.910356][ T12] bridge16 (unregistering): entered promiscuous mode [ 682.975351][ T12] bond4 (unregistering): (slave bridge16): Releasing backup interface [ 682.983797][ T12] bridge16 (unregistering): left promiscuous mode [ 682.990369][ T12] bond4 (unregistering): (slave bridge17): making interface the new active one [ 683.000474][ T12] bridge17 (unregistering): entered promiscuous mode [ 683.024613][ T12] bond4 (unregistering): (slave bridge17): Releasing backup interface [ 683.033010][ T12] bridge17 (unregistering): left promiscuous mode [ 683.039458][ T12] bond4 (unregistering): (slave bridge18): making interface the new active one [ 683.048880][ T12] bridge18 (unregistering): entered promiscuous mode [ 683.084697][ T12] bond4 (unregistering): (slave bridge18): Releasing backup interface [ 683.093149][ T12] bridge18 (unregistering): left promiscuous mode [ 683.099591][ T12] bond4 (unregistering): (slave bridge19): making interface the new active one [ 683.108688][ T12] bridge19 (unregistering): entered promiscuous mode [ 683.154552][ T12] bond4 (unregistering): (slave bridge19): Releasing backup interface [ 683.163638][ T12] bridge19 (unregistering): left promiscuous mode [ 683.276607][ T12] bond6 (unregistering): (slave bridge22): Releasing backup interface [ 683.286669][ T12] bridge22 (unregistering): left promiscuous mode [ 683.497008][ T12] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 683.507040][ T12] bond0 (unregistering): (slave bridge_slave_1): Releasing backup interface [ 683.517345][ T12] bond0 (unregistering): (slave wlan1): Releasing backup interface [ 683.527142][ T12] bond0 (unregistering): Released all slaves [ 683.538392][ T12] bond1 (unregistering): Released all slaves [ 683.550756][ T12] bond2 (unregistering): Released all slaves [ 683.563286][ T12] bond3 (unregistering): Released all slaves [ 683.576328][ T12] bond4 (unregistering): Released all slaves [ 683.590668][ T12] bond5 (unregistering): Released all slaves [ 683.612841][ T12] bond6 (unregistering): Released all slaves [ 683.625976][ T12] bond7 (unregistering): Released all slaves [ 683.641547][ T12] bond8 (unregistering): Released all slaves [ 683.661536][ T12] bond9 (unregistering): (slave veth0_to_bond): Releasing active interface [ 683.671481][ T12] bond9 (unregistering): (slave bond10): Releasing active interface [ 683.683567][ T12] bond9 (unregistering): Released all slaves [ 683.696723][ T12] bond10 (unregistering): Released all slaves [ 683.709007][ T12] bond11 (unregistering): Released all slaves [ 683.724090][ T12] bond12 (unregistering): (slave vcan1): Releasing backup interface [ 683.732702][ T12] bond12 (unregistering): Released all slaves [ 683.746230][ T12] bond13 (unregistering): Released all slaves [ 683.765745][T32733] kthread_run failed with err -4 [ 683.797380][T32661] chnl_net:caif_netlink_parms(): no params data found [ 683.988325][T32750] xt_hashlimit: size too large, truncated to 1048576 [ 684.033976][ T12] 9: left promiscuous mode [ 684.047215][T32748] netlink: 32 bytes leftover after parsing attributes in process `syz.1.7549'. [ 684.286387][ T12] tipc: Disabling bearer [ 684.298934][ T12] tipc: Left network mode [ 684.312938][T32661] bridge0: port 1(bridge_slave_0) entered blocking state [ 684.327482][T22286] Bluetooth: hci3: command tx timeout [ 684.337333][ T301] Unsupported ieee802154 address type: 0 [ 684.350877][T32661] bridge0: port 1(bridge_slave_0) entered disabled state [ 684.392036][T32661] bridge_slave_0: entered allmulticast mode [ 684.427512][T32661] bridge_slave_0: entered promiscuous mode [ 684.468524][T32661] bridge0: port 2(bridge_slave_1) entered blocking state [ 684.482253][ T9] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 684.499068][ T307] netlink: 8 bytes leftover after parsing attributes in process `syz.1.7556'. [ 684.520346][T32661] bridge0: port 2(bridge_slave_1) entered disabled state [ 684.535358][ T313] netlink: 56 bytes leftover after parsing attributes in process `syz.4.7555'. [ 684.550714][ T307] openvswitch: netlink: Missing key (keys=40, expected=80) [ 684.558748][T32661] bridge_slave_1: entered allmulticast mode [ 684.605613][T32661] bridge_slave_1: entered promiscuous mode [ 684.699700][ T324] netlink: 12 bytes leftover after parsing attributes in process `syz.0.7557'. [ 684.906436][T32661] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 685.064200][ T339] netlink: 4 bytes leftover after parsing attributes in process `syz.4.7559'. [ 685.073373][ T339] netlink: 24 bytes leftover after parsing attributes in process `syz.4.7559'. [ 685.073486][T32661] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 685.093523][ T339] netlink: 12 bytes leftover after parsing attributes in process `syz.4.7559'. [ 685.144915][ T343] netlink: 224 bytes leftover after parsing attributes in process `syz.4.7559'. [ 685.290154][T32661] team0: Port device team_slave_0 added [ 685.313267][T32661] team0: Port device team_slave_1 added [ 685.471132][ T356] netlink: 4 bytes leftover after parsing attributes in process `syz.0.7564'. [ 685.492024][ T357] IPVS: set_ctl: invalid protocol: 51 100.1.1.2:20003 [ 685.509557][ T356] openvswitch: netlink: nsh attr 255 is out of range max 3 [ 685.674587][ T361] netlink: 'syz.2.7566': attribute type 10 has an invalid length. [ 685.709956][ T375] netlink: 144 bytes leftover after parsing attributes in process `syz.4.7563'. [ 685.778022][ T1302] lec:lec_start_xmit: lec0:No lecd attached [ 686.042831][T32661] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 686.054303][T32661] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 686.163272][T32661] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 686.221249][ T396] netlink: 40 bytes leftover after parsing attributes in process `syz.1.7571'. [ 686.259423][T32661] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 686.273871][T32661] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 686.303732][T32661] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 686.387195][ T407] xt_CHECKSUM: unsupported CHECKSUM operation 68 [ 686.412250][T22286] Bluetooth: hci3: command tx timeout [ 686.786151][ T428] netlink: 28 bytes leftover after parsing attributes in process `syz.2.7578'. [ 686.791909][ T422] netlink: 8 bytes leftover after parsing attributes in process `syz.1.7575'. [ 686.798967][T32661] hsr_slave_0: entered promiscuous mode [ 686.838746][T32661] hsr_slave_1: entered promiscuous mode [ 686.857505][T32661] debugfs: 'hsr0' already exists in 'hsr' [ 686.881530][T32661] Cannot create hsr debugfs directory [ 686.901139][ T425] netlink: 'syz.1.7575': attribute type 9 has an invalid length. [ 687.021529][ T425] syzkaller0: entered promiscuous mode [ 687.043555][ T1145] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 687.051948][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 687.060156][ T425] syzkaller0: entered allmulticast mode [ 687.064393][ T6160] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 687.074339][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 687.096828][ T440] netlink: 28 bytes leftover after parsing attributes in process `syz.2.7580'. [ 687.261107][ T448] geneve2: entered promiscuous mode [ 687.269696][ T448] geneve2: entered allmulticast mode [ 687.398141][ T458] xt_CHECKSUM: unsupported CHECKSUM operation 68 [ 687.872483][ T486] netlink: 'syz.4.7589': attribute type 16 has an invalid length. [ 687.880349][ T486] netlink: 'syz.4.7589': attribute type 17 has an invalid length. [ 687.974700][ T479] netlink: 'syz.4.7589': attribute type 16 has an invalid length. [ 687.998951][ T479] netlink: 'syz.4.7589': attribute type 17 has an invalid length. [ 688.484544][T22286] Bluetooth: hci3: command tx timeout [ 689.021048][ T486] sit1: left promiscuous mode [ 689.029156][ T486] sit1: left allmulticast mode [ 689.072313][ T486] geneve2: left promiscuous mode [ 689.077282][ T486] geneve2: left allmulticast mode [ 689.257636][ T13] netdevsim netdevsim4 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 689.280595][ T13] netdevsim netdevsim4 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 689.308370][ T13] netdevsim netdevsim4 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 689.320060][ T13] netdevsim netdevsim4 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 689.355044][T32661] netdevsim netdevsim5 eth8 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 689.436867][ T13] netdevsim netdevsim4 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 689.459131][ T533] netlink: 'syz.2.7601': attribute type 2 has an invalid length. [ 689.468179][ T13] netdevsim netdevsim4 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 689.500403][ T13] netdevsim netdevsim4 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 689.527562][ T13] netdevsim netdevsim4 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 689.691150][T32661] netdevsim netdevsim5 eth7 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 689.817783][ T12] hsr_slave_0: left promiscuous mode [ 689.905060][ T552] netlink: 'syz.2.7607': attribute type 21 has an invalid length. [ 689.972288][ T558] netlink: 'syz.2.7607': attribute type 1 has an invalid length. [ 690.045676][ T12] pim6reg (unregistering): left allmulticast mode [ 690.213281][ T12] team0 (unregistering): Port device team_slave_1 removed [ 690.232599][ T12] team0 (unregistering): Port device team_slave_0 removed [ 690.336016][T32661] netdevsim netdevsim5 eth6 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 690.368405][ T552] __nla_validate_parse: 6 callbacks suppressed [ 690.368423][ T552] netlink: 132 bytes leftover after parsing attributes in process `syz.2.7607'. [ 690.424534][ T563] vxcan3: entered allmulticast mode [ 690.656858][T32661] netdevsim netdevsim5 eth5 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 690.758445][ T588] xt_CHECKSUM: unsupported CHECKSUM operation 68 [ 690.768049][ T589] netlink: 8 bytes leftover after parsing attributes in process `syz.2.7611'. [ 690.801149][ T589] netlink: 20 bytes leftover after parsing attributes in process `syz.2.7611'. [ 690.883580][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5100 ms [ 690.886661][ T589] netlink: 8 bytes leftover after parsing attributes in process `syz.2.7611'. [ 690.891606][ C0] lec:lec_tx_timeout: lec0 [ 690.892897][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 690.921875][ T589] netlink: 20 bytes leftover after parsing attributes in process `syz.2.7611'. [ 690.973306][ T600] netlink: 8 bytes leftover after parsing attributes in process `syz.1.7615'. [ 690.979163][ T12] IPVS: stop unused estimator thread 0... [ 691.036660][ T600] netlink: 20 bytes leftover after parsing attributes in process `syz.1.7615'. [ 691.160387][ T1167] netdevsim netdevsim1 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 691.189049][ T1167] netdevsim netdevsim1 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 691.253319][ T1167] netdevsim netdevsim1 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 691.291936][ T1167] netdevsim netdevsim1 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 691.370480][T32661] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 691.423614][T32661] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 691.504743][T32661] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 691.558364][ T631] netlink: 64 bytes leftover after parsing attributes in process `syz.0.7621'. [ 691.579332][T32661] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 691.783343][ T644] openvswitch: netlink: VXLAN extension 0 has unexpected len 2 expected 0 [ 691.888296][ T648] netlink: 12 bytes leftover after parsing attributes in process `syz.4.7625'. [ 691.917278][ T652] IPVS: set_ctl: invalid protocol: 51 172.20.20.170:20001 [ 691.979895][T32661] 8021q: adding VLAN 0 to HW filter on device bond0 [ 691.992230][ T652] x_tables: duplicate underflow at hook 2 [ 692.050685][T32661] 8021q: adding VLAN 0 to HW filter on device team0 [ 692.078468][ T6154] bridge0: port 1(bridge_slave_0) entered blocking state [ 692.085665][ T6154] bridge0: port 1(bridge_slave_0) entered forwarding state [ 692.115012][ T663] netlink: 32 bytes leftover after parsing attributes in process `syz.4.7629'. [ 692.190898][ T6160] bridge0: port 2(bridge_slave_1) entered blocking state [ 692.198107][ T6160] bridge0: port 2(bridge_slave_1) entered forwarding state [ 692.603658][ T695] workqueue: Failed to create a rescuer kthread for wq "nfc3_nci_tx_wq": -EINTR [ 692.808645][ T6154] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 692.827087][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 692.835249][ T13] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 692.843915][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 692.891333][T32661] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 693.156998][ T734] xt_CHECKSUM: unsupported CHECKSUM operation 68 [ 693.209064][ T733] syzkaller0: entered promiscuous mode [ 693.239317][ T733] syzkaller0: entered allmulticast mode [ 693.266020][ T733] simple: basic_1 [ 693.270151][ T733] simple: basic_2 [ 693.273880][ T733] simple: basic_3 [ 693.277526][ T733] simple: basic_4 [ 693.281164][ T733] simple: basic_5 [ 693.284924][ T733] simple: basic_6 [ 693.288568][ T733] simple: basic_7 [ 693.292243][ T733] simple: basic_8 [ 693.295889][ T733] simple: basic_9 [ 693.299532][ T733] simple: basic_10 [ 693.303307][ T733] simple: basic_11 [ 693.307033][ T733] simple: basic_12 [ 693.310758][ T733] simple: basic_13 [ 693.314517][ T733] simple: basic_14 [ 693.318276][ T733] simple: basic_15 [ 693.322075][ T733] simple: basic_16 [ 693.325803][ T733] simple: basic_17 [ 693.329705][ T733] 0: reclassify loop, rule prio 0, protocol 800 [ 693.953319][ T759] bond5: option all_slaves_active: invalid value (222) [ 693.989169][ T759] bond5 (unregistering): Released all slaves [ 694.065451][ T775] C: renamed from lo (while UP) [ 694.073928][ T775] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check. [ 694.092805][ T5922] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 694.222340][T32661] veth0_vlan: entered promiscuous mode [ 694.265813][T32661] veth1_vlan: entered promiscuous mode [ 694.357782][T32661] veth0_macvtap: entered promiscuous mode [ 694.378923][ T800] 8021q: VLANs not supported on lo [ 694.396940][T32661] veth1_macvtap: entered promiscuous mode [ 694.470589][T32661] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 694.508548][T32661] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 694.540340][ T1167] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 694.597601][ T1167] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 694.654688][ T1167] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 694.733113][ T1167] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 694.874713][ T6150] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 694.896160][ T6150] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 695.008663][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 695.028788][T22286] Bluetooth: hci2: link tx timeout [ 695.034353][T22286] Bluetooth: hci2: killing stalled connection 10:aa:aa:aa:aa:aa [ 695.044412][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 695.135245][ T835] syzkaller1: tun_chr_ioctl cmd 1074025677 [ 695.141599][ T835] syzkaller1: Refused to change device type [ 695.389489][ T850] __nla_validate_parse: 4 callbacks suppressed [ 695.389509][ T850] netlink: 36 bytes leftover after parsing attributes in process `syz.2.7673'. [ 695.475414][ T850] netlink: 72 bytes leftover after parsing attributes in process `syz.2.7673'. [ 695.529701][ T858] xt_CHECKSUM: unsupported CHECKSUM operation 68 [ 695.563697][ T861] netlink: 'syz.4.7677': attribute type 83 has an invalid length. [ 695.585552][ T862] netlink: 'syz.2.7679': attribute type 11 has an invalid length. [ 695.621964][ T862] netlink: 224 bytes leftover after parsing attributes in process `syz.2.7679'. [ 695.635085][ T862] netlink: 'syz.2.7679': attribute type 11 has an invalid length. [ 695.643659][ T862] netlink: 224 bytes leftover after parsing attributes in process `syz.2.7679'. [ 695.670787][ T862] netlink: 'syz.2.7679': attribute type 11 has an invalid length. [ 695.679060][ T862] netlink: 224 bytes leftover after parsing attributes in process `syz.2.7679'. [ 695.689757][ T862] netlink: 'syz.2.7679': attribute type 11 has an invalid length. [ 695.701353][ T862] netlink: 224 bytes leftover after parsing attributes in process `syz.2.7679'. [ 695.719704][ T862] netlink: 'syz.2.7679': attribute type 11 has an invalid length. [ 695.730484][ T867] netlink: 'syz.0.7680': attribute type 1 has an invalid length. [ 695.737665][ T872] netlink: 'syz.4.7683': attribute type 3 has an invalid length. [ 695.738436][ T862] netlink: 224 bytes leftover after parsing attributes in process `syz.2.7679'. [ 695.769668][ T862] netlink: 'syz.2.7679': attribute type 11 has an invalid length. [ 695.802117][ T862] netlink: 224 bytes leftover after parsing attributes in process `syz.2.7679'. [ 695.833911][ T862] netlink: 'syz.2.7679': attribute type 11 has an invalid length. [ 695.843631][ T862] netlink: 224 bytes leftover after parsing attributes in process `syz.2.7679'. [ 695.859599][ T862] netlink: 'syz.2.7679': attribute type 11 has an invalid length. [ 695.869589][ T862] netlink: 224 bytes leftover after parsing attributes in process `syz.2.7679'. [ 695.880432][ T862] netlink: 'syz.2.7679': attribute type 11 has an invalid length. [ 695.903865][ T867] 8021q: adding VLAN 0 to HW filter on device bond5 [ 695.916285][ T862] netlink: 'syz.2.7679': attribute type 11 has an invalid length. [ 695.924223][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5020 ms [ 695.924248][ C0] lec:lec_tx_timeout: lec0 [ 696.026471][ T876] bond5: (slave geneve2): making interface the new active one [ 696.049374][ T876] bond5: (slave geneve2): Enslaving as an active interface with an up link [ 696.083451][ T1145] netdevsim netdevsim0 netdevsim0: set [1, 1] type 2 family 0 port 20004 - 0 [ 696.124610][ T1145] netdevsim netdevsim0 netdevsim1: set [1, 1] type 2 family 0 port 20004 - 0 [ 696.294307][ T1145] netdevsim netdevsim0 netdevsim2: set [1, 1] type 2 family 0 port 20004 - 0 [ 696.314609][ T1145] netdevsim netdevsim0 netdevsim3: set [1, 1] type 2 family 0 port 20004 - 0 [ 696.380897][ T898] syzkaller0: entered promiscuous mode [ 696.402334][ T898] syzkaller0: entered allmulticast mode [ 696.493681][ T907] xt_CT: You must specify a L4 protocol and not use inversions on it [ 697.122366][T21302] Bluetooth: hci2: command 0x0406 tx timeout [ 697.871234][T28663] syz-executor invoked oom-killer: gfp_mask=0x100cca(GFP_HIGHUSER_MOVABLE), order=0, oom_score_adj=0 [ 697.951609][T28663] CPU: 0 UID: 0 PID: 28663 Comm: syz-executor Not tainted syzkaller #0 PREEMPT(full) [ 697.951633][T28663] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/27/2026 [ 697.951644][T28663] Call Trace: [ 697.951651][T28663] [ 697.951662][T28663] dump_stack_lvl+0xe8/0x150 [ 697.951692][T28663] dump_header+0xd3/0x4c0 [ 697.951715][T28663] oom_kill_process+0x3ab/0x970 [ 697.951746][T28663] out_of_memory+0x106c/0x1410 [ 697.951764][T28663] ? percpu_ref_put+0x19/0x180 [ 697.951788][T28663] ? __pfx___mutex_lock+0x10/0x10 [ 697.951815][T28663] ? __pfx_out_of_memory+0x10/0x10 [ 697.951831][T28663] ? do_raw_spin_unlock+0xf5/0x210 [ 697.951860][T28663] try_charge_memcg+0xc53/0x1560 [ 697.951883][T28663] ? __lock_acquire+0x6b5/0x2cf0 [ 697.951917][T28663] ? __pfx_try_charge_memcg+0x10/0x10 [ 697.951934][T28663] ? xa_load+0x60/0x210 [ 697.951958][T28663] ? mem_cgroup_swapin_charge_folio+0x36/0x4d0 [ 697.951983][T28663] ? mem_cgroup_swapin_charge_folio+0x36/0x4d0 [ 697.952008][T28663] mem_cgroup_swapin_charge_folio+0x2e3/0x4d0 [ 697.952033][T28663] __swap_cache_prepare_and_add+0x52a/0x700 [ 697.952077][T28663] swap_cache_alloc_folio+0xf1/0x240 [ 697.952107][T28663] swap_cluster_readahead+0x53a/0x690 [ 697.952139][T28663] ? __pfx_swap_cluster_readahead+0x10/0x10 [ 697.952178][T28663] ? get_vma_policy+0x27b/0x3c0 [ 697.952203][T28663] swapin_readahead+0x196/0xc50 [ 697.952241][T28663] ? __pfx_swapin_readahead+0x10/0x10 [ 697.952269][T28663] ? swap_table_get+0x1e/0x260 [ 697.952291][T28663] ? swap_table_get+0x1e/0x260 [ 697.952314][T28663] ? swap_table_get+0x1e/0x260 [ 697.952339][T28663] ? swap_table_get+0x216/0x260 [ 697.952365][T28663] ? swap_cache_get_folio+0x513/0x520 [ 697.952394][T28663] do_swap_page+0x54f/0x58d0 [ 697.952419][T28663] ? __lock_acquire+0x6b5/0x2cf0 [ 697.952440][T28663] ? bcache_device_detach+0x290/0x350 [ 697.952593][T28663] ? do_swap_page+0x12c/0x58d0 [ 697.952616][T28663] ? __pfx_do_swap_page+0x10/0x10 [ 697.952638][T28663] ? __pte_offset_map+0x1ae/0x240 [ 697.952668][T28663] ? pte_offset_map_rw_nolock+0xea/0x160 [ 697.952698][T28663] handle_mm_fault+0x12d2/0x3310 [ 697.952746][T28663] ? handle_mm_fault+0xee/0x3310 [ 697.952781][T28663] ? __pfx_handle_mm_fault+0x10/0x10 [ 697.952804][T28663] ? lock_vma_under_rcu+0x45a/0x500 [ 697.952850][T28663] do_user_addr_fault+0xa73/0x1340 [ 697.952883][T28663] ? rcu_is_watching+0x15/0xb0 [ 697.952908][T28663] ? trace_page_fault_user+0x84/0x210 [ 697.952934][T28663] exc_page_fault+0x6a/0xc0 [ 697.952961][T28663] asm_exc_page_fault+0x26/0x30 [ 697.952980][T28663] RIP: 0033:0x7f5ac675cfce [ 697.952998][T28663] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 697.953013][T28663] RSP: 002b:00007fffbf913c78 EFLAGS: 00010246 [ 697.953031][T28663] RAX: 0000000000000000 RBX: 000055557dae7500 RCX: 00007f5ac675cfce [ 697.953044][T28663] RDX: 00007fffbf913cd0 RSI: 0000000000000000 RDI: 0000000000000000 [ 697.953055][T28663] RBP: 00007fffbf913d3c R08: 0000000000000000 R09: 0000000000000000 [ 697.953067][T28663] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000001388 [ 697.953078][T28663] R13: 00000000000927c0 R14: 00000000000aa2d5 R15: 00007fffbf913d90 [ 697.953110][T28663] [ 698.274405][ C0] vcan0: j1939_tp_rxtimer: 0xffff888076ff0000: rx timeout, send abort [ 698.286394][ C0] vcan0: j1939_xtp_rx_abort_one: 0xffff888076ff0000: 0x00000: (3) A timeout occurred and this is the connection abort to close the session. [ 698.321907][T28663] memory: usage 307200kB, limit 307200kB, failcnt 802 [ 698.329236][T28663] memory+swap: usage 307376kB, limit 9007199254740988kB, failcnt 0 [ 698.338441][T28663] kmem: usage 307188kB, limit 9007199254740988kB, failcnt 0 [ 698.346835][T28663] Memory cgroup stats for /syz4: [ 698.346944][T28663] cache 0 [ 698.381848][T28663] rss 0 [ 698.421260][T28663] rss_huge 0 [ 698.436508][T28663] shmem 0 [ 698.468518][T28663] mapped_file 0 [ 698.490235][T28663] dirty 0 [ 698.503430][T28663] writeback 0 [ 698.512430][T28663] workingset_refault_anon 16 [ 698.528238][T28663] workingset_refault_file 4 [ 698.545147][T28663] swap 180224 [ 698.571741][ T1145] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 698.580248][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 698.592433][ T13] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 698.600776][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 698.621860][T28663] swapcached 192512 [ 698.655477][T28663] pgpgin 105216 [ 698.671105][T28663] pgpgout 105213 [ 698.678281][T28663] pgfault 272653 [ 698.691847][T28663] pgmajfault 15 [ 698.695351][T28663] inactive_anon 12288 [ 698.699425][T28663] active_anon 0 [ 698.751731][T28663] inactive_file 0 [ 698.755416][T28663] active_file 0 [ 698.782061][T28663] unevictable 0 [ 698.801910][T28663] hierarchical_memory_limit 314572800 [ 698.807619][T28663] hierarchical_memsw_limit 9223372036854771712 [ 698.838594][T28663] total_cache 0 [ 698.851833][T28663] total_rss 0 [ 698.855162][T28663] total_rss_huge 0 [ 698.858886][T28663] total_shmem 0 [ 698.871837][T28663] total_mapped_file 0 [ 698.878808][T28663] total_dirty 0 [ 698.891080][T28663] total_writeback 0 [ 698.901586][T28663] total_workingset_refault_anon 16 [ 698.929569][T28663] total_workingset_refault_file 4 [ 698.942484][T28663] total_swap 180224 [ 698.946330][T28663] total_swapcached 192512 [ 698.971076][T28663] total_pgpgin 105219 [ 698.990191][T28663] total_pgpgout 105216 [ 699.004948][T28663] total_pgfault 272660 [ 699.009054][T28663] total_pgmajfault 15 [ 699.022311][T28663] total_inactive_anon 12288 [ 699.032225][T28663] total_active_anon 0 [ 699.036243][T28663] total_inactive_file 0 [ 699.060926][T28663] total_active_file 0 [ 699.066742][T28663] total_unevictable 0 [ 699.070757][T28663] anon_cost 0 [ 699.081923][T28663] file_cost 0 [ 699.085245][T28663] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=/,mems_allowed=0-1,oom_memcg=/syz4,task_memcg=/syz4,task=syz.4.7700,pid=949,uid=0 [ 699.123194][T28663] Memory cgroup out of memory: Killed process 949 (syz.4.7700) total-vm:102288kB, anon-rss:1272kB, file-rss:23356kB, shmem-rss:0kB, UID:0 pgtables:136kB oom_score_adj:1000 [ 699.363377][ T1020] netlink: 'syz.4.7708': attribute type 4 has an invalid length. [ 699.387772][ T1024] netlink: 'syz.4.7708': attribute type 4 has an invalid length. [ 699.661570][ T1040] syzkaller0: entered promiscuous mode [ 699.668899][ T1040] syzkaller0: entered allmulticast mode [ 700.018614][ T953] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 700.043162][ T968] netlink: 'syz.2.7702': attribute type 1 has an invalid length. [ 700.583603][ T1085] __nla_validate_parse: 37 callbacks suppressed [ 700.583622][ T1085] netlink: 8 bytes leftover after parsing attributes in process `syz.2.7718'. [ 701.149682][ T1129] openvswitch: netlink: IP tunnel attribute has 30 unknown bytes. [ 701.468564][ T1146] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 701.572684][ T1154] netlink: 'syz.1.7735': attribute type 16 has an invalid length. [ 701.589754][ T1154] netlink: 'syz.1.7735': attribute type 17 has an invalid length. [ 701.647098][ T1154] bridge0: port 3(gretap0) entered disabled state [ 701.675000][ T1159] Bluetooth: MGMT ver 1.23 [ 701.702950][ T1159] netlink: 'syz.2.7736': attribute type 1 has an invalid length. [ 701.710883][ T1154] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 701.928830][ T1165] syzkaller0: entered promiscuous mode [ 701.942308][ T1165] syzkaller0: entered allmulticast mode [ 701.948150][ T1181] netlink: 20 bytes leftover after parsing attributes in process `syz.2.7740'. [ 702.195449][ T1198] netlink: 40 bytes leftover after parsing attributes in process `syz.0.7742'. [ 702.233189][ T1202] xt_l2tp: v2 doesn't support IP mode [ 702.404600][ T1214] netlink: 8 bytes leftover after parsing attributes in process `syz.1.7746'. [ 702.446030][ T1214] xt_limit: Overflow, try lower: 271964/0 [ 703.689577][ T5926] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 704.322788][ T13] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 704.330927][ T6154] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 704.339087][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 704.347200][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 704.706346][ T1264] netlink: 12 bytes leftover after parsing attributes in process `syz.0.7759'. [ 704.740693][ T1265] netlink: 12 bytes leftover after parsing attributes in process `syz.0.7759'. [ 704.952720][ T1277] netlink: 8 bytes leftover after parsing attributes in process `syz.2.7761'. [ 704.965000][ T1277] netlink: 4 bytes leftover after parsing attributes in process `syz.2.7761'. [ 705.144773][ T1289] xt_CHECKSUM: unsupported CHECKSUM operation 68 [ 705.351487][ T1299] xt_hashlimit: size too large, truncated to 1048576 [ 705.415709][ T1304] mac80211_hwsim hwsim58 wlan0: entered promiscuous mode [ 705.755471][ T1322] bridge2: trying to set multicast startup query interval below minimum, setting to 100 (1000ms) [ 705.811225][ T1328] netlink: 8 bytes leftover after parsing attributes in process `syz.5.7774'. [ 705.846768][ T6154] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 706.265577][ T1360] netlink: 16 bytes leftover after parsing attributes in process `syz.1.7781'. [ 706.325436][ T1167] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 706.335756][ T1167] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 706.351941][ T5926] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 706.447930][ T1369] netlink: 32 bytes leftover after parsing attributes in process `syz.2.7784'. [ 706.550858][ T1374] netlink: 128 bytes leftover after parsing attributes in process `syz.1.7785'. [ 706.592173][ T1374] netlink: 128 bytes leftover after parsing attributes in process `syz.1.7785'. [ 706.661942][ T5926] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 706.773813][ T1377] netlink: 4 bytes leftover after parsing attributes in process `syz.2.7786'. [ 706.992937][ T1387] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 707.194379][ T1386] netlink: 'syz.1.7788': attribute type 1 has an invalid length. [ 707.204638][ T1386] netlink: 760 bytes leftover after parsing attributes in process `syz.1.7788'. [ 707.223956][ T1402] sctp: [Deprecated]: syz.5.7790 (pid 1402) Use of int in max_burst socket option. [ 707.223956][ T1402] Use struct sctp_assoc_value instead [ 707.274919][ T1367] wg1 speed is unknown, defaulting to 1000 [ 707.362277][ T5892] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 707.390891][ T1405] netlink: 16 bytes leftover after parsing attributes in process `syz.2.7791'. [ 707.412659][ T1411] xt_TPROXY: Can be used only with -p tcp or -p udp [ 707.569642][ T1420] netlink: 12 bytes leftover after parsing attributes in process `syz.5.7795'. [ 707.582431][ T1420] openvswitch: netlink: Flow actions attr not present in new flow. [ 707.614152][ T1423] netlink: 256 bytes leftover after parsing attributes in process `syz.1.7794'. [ 707.952829][ T1438] xt_CHECKSUM: unsupported CHECKSUM operation 68 [ 708.215343][ T1442] bond_slave_0: entered allmulticast mode [ 708.358476][ T1459] syzkaller0: entered promiscuous mode [ 708.402733][ T1459] syzkaller0: entered allmulticast mode [ 708.639369][ T1473] xt_CHECKSUM: unsupported CHECKSUM operation 68 [ 708.677006][ T1476] xt_hashlimit: size too large, truncated to 1048576 [ 708.894899][ T29] audit: type=1804 audit(1773312525.998:37): pid=1489 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.5.7817" name="/newroot/30/cgroup.controllers" dev="tmpfs" ino=169 res=1 errno=0 [ 708.968615][ T29] audit: type=1800 audit(1773312525.998:38): pid=1489 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.5.7817" name="cgroup.controllers" dev="tmpfs" ino=169 res=0 errno=0 [ 709.001651][ T1494] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 709.333485][ T1523] xt_CHECKSUM: unsupported CHECKSUM operation 68 [ 709.448443][ T1532] IPVS: sync thread started: state = BACKUP, mcast_ifn = vcan0, syncid = 0, id = 0 [ 709.516658][ T1536] xt_hashlimit: size too large, truncated to 1048576 [ 709.859652][ T1559] bridge0: trying to set multicast startup query interval below minimum, setting to 100 (1000ms) [ 709.879326][ T1559] bridge0: port 1(1x9) entered disabled state [ 709.887592][ T1559] bridge0: entered allmulticast mode [ 709.985869][ T1567] vlan6: entered promiscuous mode [ 709.991037][ T1567] geneve1: entered promiscuous mode [ 710.024703][ T1567] vlan6: entered allmulticast mode [ 710.031024][ T1567] geneve1: entered allmulticast mode [ 710.084222][ T6150] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 710.092408][ T6150] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 710.101291][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 710.109652][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 710.356372][ T1607] xt_hashlimit: size too large, truncated to 1048576 [ 710.722312][ C0] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 710.724023][ T1616] wg1 speed is unknown, defaulting to 1000 [ 710.828125][ T1625] __nla_validate_parse: 6 callbacks suppressed [ 710.828143][ T1625] netlink: 232 bytes leftover after parsing attributes in process `syz.2.7857'. [ 713.073143][ T1577] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 713.282028][ T5922] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 713.322390][ T1656] xt_hashlimit: size too large, truncated to 1048576 [ 713.374313][ T1659] netlink: 16 bytes leftover after parsing attributes in process `syz.4.7862'. [ 713.396907][ T1659] netlink: 13 bytes leftover after parsing attributes in process `syz.4.7862'. [ 713.594902][ T1659] veth7: entered promiscuous mode [ 713.625859][ T1680] netdevsim netdevsim5 netdevsim0: entered promiscuous mode [ 713.664490][ T1680] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 713.700305][ T1664] netlink: 8 bytes leftover after parsing attributes in process `syz.2.7868'. [ 713.830404][ T1692] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 713.867554][ T1693] netlink: 40 bytes leftover after parsing attributes in process `syz.5.7874'. [ 713.897505][ T1693] netlink: 40 bytes leftover after parsing attributes in process `syz.5.7874'. [ 714.075937][ T1715] bond1 (unregistering): Released all slaves [ 714.212575][ T1726] syzkaller1: entered promiscuous mode [ 714.218149][ T1726] syzkaller1: entered allmulticast mode [ 715.843294][ T1145] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 715.851455][ T1145] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 715.860161][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 715.868400][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 716.790711][ T1690] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 716.955687][ T1750] netlink: 100 bytes leftover after parsing attributes in process `syz.1.7888'. [ 716.983047][ T1755] xt_CHECKSUM: unsupported CHECKSUM operation 68 [ 717.096514][ T1760] netlink: 12 bytes leftover after parsing attributes in process `syz.0.7895'. [ 717.147367][ T1760] 8021q: adding VLAN 0 to HW filter on device batadv3 [ 717.170147][ T1760] team0: Port device batadv3 added [ 717.276607][ T1780] xt_connbytes: Forcing CT accounting to be enabled [ 717.451028][ T1796] netlink: 12 bytes leftover after parsing attributes in process `syz.0.7904'. [ 717.487203][ T1796] vxcan2: entered allmulticast mode [ 717.608441][ T1793] netlink: 28 bytes leftover after parsing attributes in process `syz.2.7902'. [ 717.624778][ T1793] netlink: 28 bytes leftover after parsing attributes in process `syz.2.7902'. [ 717.877173][ T1813] xt_CHECKSUM: unsupported CHECKSUM operation 68 [ 717.885228][ T1811] netlink: 'syz.4.7908': attribute type 3 has an invalid length. [ 718.147467][ T1832] netdevsim netdevsim4 netdevsim0: entered promiscuous mode [ 718.210770][ T1843] netlink: 260 bytes leftover after parsing attributes in process `syz.5.7918'. [ 718.465314][ T1853] netlink: 44 bytes leftover after parsing attributes in process `syz.0.7920'. [ 718.491075][ T1858] netlink: 'syz.5.7921': attribute type 3 has an invalid length. [ 718.535963][ T1858] netlink: 16 bytes leftover after parsing attributes in process `syz.5.7921'. [ 718.726827][ T1867] netlink: 8 bytes leftover after parsing attributes in process `syz.1.7925'. [ 718.836419][ T1881] syzkaller0: entered promiscuous mode [ 718.842810][ T1881] syzkaller0: entered allmulticast mode [ 719.078047][ T1895] netlink: 16 bytes leftover after parsing attributes in process `syz.2.7931'. [ 719.221581][ T1908] netlink: 'syz.1.7936': attribute type 3 has an invalid length. [ 719.440801][ T1920] netlink: 'syz.0.7939': attribute type 1 has an invalid length. [ 719.538428][ T1927] syzkaller0: entered promiscuous mode [ 719.544594][ T1927] syzkaller0: entered allmulticast mode [ 719.569916][ T1927] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 719.586242][ T1930] IPVS: Unknown mcast interface: vcan0 [ 719.681864][ C0] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 719.832349][ T1937] xt_CT: No such helper "pptp" [ 720.075697][ T1950] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 720.099772][ T1946] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 720.101418][ T1958] netlink: 'syz.0.7950': attribute type 3 has an invalid length. [ 720.197223][ T1960] syzkaller0: entered promiscuous mode [ 720.230428][ T1960] syzkaller0: entered allmulticast mode [ 720.321122][ T1974] netlink: 'syz.0.7953': attribute type 1 has an invalid length. [ 720.419345][ T1974] bond6: entered promiscuous mode [ 720.446695][ T1974] 8021q: adding VLAN 0 to HW filter on device bond6 [ 720.460683][ T1986] netlink: 'syz.1.7955': attribute type 7 has an invalid length. [ 720.487888][ T1974] 8021q: adding VLAN 0 to HW filter on device bond6 [ 720.496485][ T1974] bond6: (slave vti0): The slave device specified does not support setting the MAC address [ 720.507454][ T1974] bond6: (slave vti0): Setting fail_over_mac to active for active-backup mode [ 720.512770][ T1989] openvswitch: netlink: Unexpected mask (mask=20040, allowed=10048) [ 720.521835][ T1974] bond6: (slave vti0): making interface the new active one [ 720.532964][ T1974] vti0: entered promiscuous mode [ 720.539575][ T1974] bond6: (slave vti0): Enslaving as an active interface with an up link [ 720.563821][ T1981] bond0: entered promiscuous mode [ 720.570828][ T1981] bond0: left promiscuous mode [ 720.965626][ T6160] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 720.974617][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 721.013210][ T2021] bridge1: entered promiscuous mode [ 721.018700][ T2021] bridge1: entered allmulticast mode [ 721.123792][ T2031] netlink: 'syz.1.7968': attribute type 1 has an invalid length. [ 721.133773][ T2031] netlink: 'syz.1.7968': attribute type 2 has an invalid length. [ 721.250091][ T2034] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 721.264765][ T2037] xt_TPROXY: Can be used only with -p tcp or -p udp [ 721.604185][ T6154] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 721.612829][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 722.216132][ T2104] IPVS: wlc: UDP 224.0.0.2:0 - no destination available [ 722.336313][ T2113] __nla_validate_parse: 8 callbacks suppressed [ 722.336332][ T2113] netlink: 12 bytes leftover after parsing attributes in process `syz.4.7990'. [ 722.356050][ T2113] workqueue: Failed to create a rescuer kthread for wq "bond3": -EINTR [ 722.363742][ T2117] xt_addrtype: ipv6 does not support BROADCAST matching [ 722.883594][ T5926] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 724.928784][ T2084] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 724.951349][ T2109] netlink: 'syz.0.7988': attribute type 1 has an invalid length. [ 724.973678][ T2109] netlink: 224 bytes leftover after parsing attributes in process `syz.0.7988'. [ 724.991150][ T2109] workqueue: Failed to create a rescuer kthread for wq "phy3": -EINTR [ 725.109376][ T2127] netlink: 'syz.2.7993': attribute type 1 has an invalid length. [ 725.237583][ T2127] 8021q: adding VLAN 0 to HW filter on device bond8 [ 725.508607][ T2163] netlink: 4 bytes leftover after parsing attributes in process `syz.0.8003'. [ 725.646291][ T2181] netlink: 'syz.0.8006': attribute type 10 has an invalid length. [ 725.650999][ T2174] xt_hashlimit: size too large, truncated to 1048576 [ 725.660472][ T2182] netlink: 'syz.0.8006': attribute type 2 has an invalid length. [ 725.677330][ T2181] bridge0: port 2(bridge_slave_1) entered disabled state [ 725.701539][ T2182] netlink: 12 bytes leftover after parsing attributes in process `syz.0.8006'. [ 725.703056][ T2181] bridge_slave_1: left allmulticast mode [ 725.742545][ T2181] bridge_slave_1: left promiscuous mode [ 725.748361][ T2181] bridge0: port 2(bridge_slave_1) entered disabled state [ 725.789042][ T2181] bond0: (slave bridge_slave_1): Enslaving as an active interface with an up link [ 725.956833][ T2201] xt_CHECKSUM: unsupported CHECKSUM operation 68 [ 726.092832][ T13] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 726.101116][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 726.723020][ T6160] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 726.731286][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 728.607970][ T2171] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 728.745075][ T2213] vlan3: entered promiscuous mode [ 728.750444][ T2213] vlan3: entered allmulticast mode [ 728.773550][ T2213] hsr_slave_1: entered allmulticast mode [ 728.935643][ T2238] netlink: 28 bytes leftover after parsing attributes in process `syz.0.8021'. [ 728.967509][ T2242] xt_hashlimit: size too large, truncated to 1048576 [ 729.120528][ T2246] xt_connbytes: Forcing CT accounting to be enabled [ 729.162523][ T2246] Cannot find set identified by id 65534 to match [ 729.395952][ T2216] wg1 speed is unknown, defaulting to 1000 [ 729.558936][ T2266] netlink: 20 bytes leftover after parsing attributes in process `syz.4.8028'. [ 729.936593][ T2278] netlink: 8 bytes leftover after parsing attributes in process `syz.5.8031'. [ 729.947365][ T2278] netlink: 4 bytes leftover after parsing attributes in process `syz.5.8031'. [ 729.959204][ T2278] netlink: 'syz.5.8031': attribute type 12 has an invalid length. [ 729.967429][ T2278] netlink: 'syz.5.8031': attribute type 11 has an invalid length. [ 730.179657][ T2285] netlink: 80 bytes leftover after parsing attributes in process `syz.5.8033'. [ 731.843620][ T6152] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 731.852360][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 732.450652][ T2258] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 732.461376][ T2268] netlink: 'syz.0.8029': attribute type 1 has an invalid length. [ 732.485619][ T5922] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 732.493812][ T13] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 732.502702][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 732.512700][ T2268] netlink: 224 bytes leftover after parsing attributes in process `syz.0.8029'. [ 732.551895][ T2269] netlink: 'syz.0.8029': attribute type 1 has an invalid length. [ 732.755977][ T2300] nla_validate_range_unsigned: 23 callbacks suppressed [ 732.755998][ T2300] netlink: 'syz.5.8040': attribute type 11 has an invalid length. [ 732.775239][ T2300] netlink: 224 bytes leftover after parsing attributes in process `syz.5.8040'. [ 733.137756][ T2329] bridge: RTM_NEWNEIGH bridge0 without NUD_PERMANENT [ 733.189417][ T2329] bond3: entered promiscuous mode [ 733.197578][ T2329] bond3: entered allmulticast mode [ 733.209000][ T2329] 8021q: adding VLAN 0 to HW filter on device bond3 [ 733.359439][ T2347] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 733.482757][ T2324] wg1 speed is unknown, defaulting to 1000 [ 736.022370][ T2319] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 736.132979][ T2373] netlink: 'syz.4.8054': attribute type 2 has an invalid length. [ 736.169336][ T2373] v: entered promiscuous mode [ 736.212129][ T2375] sch_tbf: burst 4 is lower than device syzkaller0 mtu (1500) ! [ 736.284654][ T2381] netlink: 24 bytes leftover after parsing attributes in process `syz.0.8057'. [ 736.476082][ T2392] netlink: 4 bytes leftover after parsing attributes in process `syz.1.8060'. [ 736.507005][ T2392] netlink: 24 bytes leftover after parsing attributes in process `syz.1.8060'. [ 736.752741][ T2424] netlink: 16 bytes leftover after parsing attributes in process `syz.2.8067'. [ 736.874719][ T6160] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 736.987340][ T2451] syzkaller1: entered promiscuous mode [ 736.993977][ T2451] syzkaller1: entered allmulticast mode [ 737.604779][ T6160] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 737.613744][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 738.242063][ C0] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 738.242913][ T6150] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 738.258284][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 739.720688][ T2418] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 739.733580][ T2467] netlink: 'syz.2.8076': attribute type 4 has an invalid length. [ 739.903901][ T2507] netlink: 220 bytes leftover after parsing attributes in process `syz.2.8086'. [ 739.917756][ T2507] netlink: 220 bytes leftover after parsing attributes in process `syz.2.8086'. [ 740.087476][ T2532] netlink: 12 bytes leftover after parsing attributes in process `syz.5.8090'. [ 740.113412][ T2537] netlink: 16 bytes leftover after parsing attributes in process `syz.5.8090'. [ 740.174438][ T2546] netlink: 'syz.4.8093': attribute type 25 has an invalid length. [ 740.198012][ T2546] netlink: 12 bytes leftover after parsing attributes in process `syz.4.8093'. [ 740.216023][ T2532] bond1: entered promiscuous mode [ 740.222218][ T2532] 8021q: adding VLAN 0 to HW filter on device bond1 [ 740.330041][ T2554] netlink: zone id is out of range [ 740.356179][ T2554] netlink: zone id is out of range [ 740.369160][ T2554] netlink: zone id is out of range [ 740.377763][ T2554] netlink: zone id is out of range [ 740.386848][ T2554] netlink: zone id is out of range [ 740.399628][ T2554] netlink: zone id is out of range [ 740.470725][ T2551] netlink: 12 bytes leftover after parsing attributes in process `syz.4.8093'. [ 741.181355][ T2627] xt_CHECKSUM: unsupported CHECKSUM operation 68 [ 741.315335][ T2634] batadv0: entered allmulticast mode [ 741.438536][ T2646] __nla_validate_parse: 1 callbacks suppressed [ 741.438555][ T2646] netlink: 24 bytes leftover after parsing attributes in process `syz.4.8116'. [ 741.475178][ T2648] netlink: 24 bytes leftover after parsing attributes in process `syz.4.8116'. [ 741.758606][ T2666] netlink: 24 bytes leftover after parsing attributes in process `syz.5.8122'. [ 741.777743][ T2671] netlink: 'syz.1.8123': attribute type 4 has an invalid length. [ 741.796125][ T2666] netlink: 208 bytes leftover after parsing attributes in process `syz.5.8122'. [ 741.806063][ T2666] netlink: 8 bytes leftover after parsing attributes in process `syz.5.8122'. [ 741.834279][ T2666] netlink: 12 bytes leftover after parsing attributes in process `syz.5.8122'. [ 741.850852][ T2675] netlink: 24 bytes leftover after parsing attributes in process `syz.5.8122'. [ 742.051577][ T2693] netlink: 'syz.0.8130': attribute type 3 has an invalid length. [ 742.314699][ T2713] netlink: 4 bytes leftover after parsing attributes in process `syz.5.8135'. [ 742.467599][ T6160] bond0 (unregistering): (slave bridge0): Releasing backup interface [ 742.476179][ T6160] bridge0 (unregistering): left promiscuous mode [ 742.567981][ T6160] bond0 (unregistering): Released all slaves [ 742.581026][ T6160] bond1 (unregistering): Released all slaves [ 742.595467][ T6160] bond2 (unregistering): Released all slaves [ 742.617299][ T2713] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 742.706987][ T2713] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 742.729624][ T6150] net_ratelimit: 141 callbacks suppressed [ 742.729636][ T6150] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 742.743745][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 742.828283][ T6160] tipc: Disabling bearer [ 742.845487][ T6160] tipc: Left network mode [ 743.075315][ T2753] netlink: 'syz.5.8143': attribute type 2 has an invalid length. [ 743.102886][ T2746] xt_hashlimit: size too large, truncated to 1048576 [ 743.120725][ T2753] 9: entered promiscuous mode [ 743.379194][ T2771] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 743.468328][ T2771] syzkaller1: entered promiscuous mode [ 743.474764][ T2771] syzkaller1: entered allmulticast mode [ 743.482883][ T2774] netlink: 28 bytes leftover after parsing attributes in process `syz.5.8150'. [ 743.560021][ T2778] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 743.666387][ T2782] syzkaller0: entered promiscuous mode [ 743.672263][ T2782] syzkaller0: entered allmulticast mode [ 743.692663][ T2785] xt_CHECKSUM: unsupported CHECKSUM operation 68 [ 743.829363][ T6160] veth1_vlan: left allmulticast mode [ 743.836625][ T6160] veth0_macvtap: left promiscuous mode [ 743.854715][ T6160] veth1_vlan: left promiscuous mode [ 743.860018][ T6160] veth0_vlan: left promiscuous mode [ 743.999462][ T6160] team0 (unregistering): Port device batadv1 removed [ 744.006819][ T6152] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 744.007022][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 744.103337][ T2803] netlink: 20 bytes leftover after parsing attributes in process `syz.5.8157'. [ 744.979188][ T2878] bond4: option ad_actor_sys_prio: mode dependency failed, not supported in mode balance-rr(0) [ 745.012942][ T2878] bond4 (unregistering): Released all slaves [ 745.199679][ T6160] IPVS: stop unused estimator thread 0... [ 745.256478][ T2893] netlink: 'syz.2.8174': attribute type 1 has an invalid length. [ 745.817074][ T2938] xt_CHECKSUM: unsupported CHECKSUM operation 68 [ 745.960882][ T2947] netlink: 'syz.0.8190': attribute type 5 has an invalid length. [ 746.219123][ T2958] openvswitch: netlink: Missing valid actions attribute. [ 746.258252][ T2958] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 746.531316][ T2971] __nla_validate_parse: 6 callbacks suppressed [ 746.531335][ T2971] netlink: 32 bytes leftover after parsing attributes in process `syz.2.8201'. [ 747.072534][ T2991] netlink: 212348 bytes leftover after parsing attributes in process `syz.2.8206'. [ 747.254291][ T1302] lec:lec_start_xmit: lec0:No lecd attached [ 747.312178][ T3001] siw: device registration error -23 [ 747.594127][ T3007] netlink: 64 bytes leftover after parsing attributes in process `syz.5.8211'. [ 747.980366][ T3019] tun0: tun_chr_ioctl cmd 1074025675 [ 747.985838][ T3019] tun0: persist disabled [ 748.484528][ T6154] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 748.493213][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 748.548465][ T3046] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 748.594708][ T3049] netlink: 20 bytes leftover after parsing attributes in process `syz.0.8223'. [ 749.299661][ T3083] xt_CHECKSUM: unsupported CHECKSUM operation 68 [ 749.339608][ T3086] netlink: 100 bytes leftover after parsing attributes in process `syz.2.8231'. [ 749.363655][ T3087] netlink: 'syz.5.8229': attribute type 4 has an invalid length. [ 749.399489][ T5892] hid-generic 0005:04F3:5508.0001: item fetching failed at offset 0/5 [ 749.410732][ T5892] hid-generic 0005:04F3:5508.0001: probe with driver hid-generic failed with error -22 [ 749.764035][ T6160] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 749.773079][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 749.788951][ T3106] netlink: 8 bytes leftover after parsing attributes in process `syz.1.8237'. [ 750.274255][ T3125] xt_CHECKSUM: unsupported CHECKSUM operation 68 [ 750.331357][ T2924] Set syz1 is full, maxelem 65536 reached [ 750.467028][ T3134] netlink: 'syz.0.8247': attribute type 2 has an invalid length. [ 750.571179][ T3144] netlink: 4 bytes leftover after parsing attributes in process `syz.2.8248'. [ 750.747403][ T3160] xt_CHECKSUM: unsupported CHECKSUM operation 68 [ 750.756950][ T3161] netlink: 'syz.0.8251': attribute type 32 has an invalid length. [ 750.849955][ T3165] netlink: 64 bytes leftover after parsing attributes in process `syz.1.8255'. [ 750.863263][ T3161] netlink: 88 bytes leftover after parsing attributes in process `syz.0.8251'. [ 750.892594][ T3165] netlink: 4 bytes leftover after parsing attributes in process `syz.1.8255'. [ 751.075428][ T3185] netlink: 'syz.0.8260': attribute type 3 has an invalid length. [ 751.087345][ T3185] tipc: Enabled bearer , priority 2 [ 751.204125][ T3202] netlink: 'syz.0.8263': attribute type 2 has an invalid length. [ 751.355878][ T3204] sctp: [Deprecated]: syz.4.8261 (pid 3204) Use of int in maxseg socket option. [ 751.355878][ T3204] Use struct sctp_assoc_value instead [ 751.611660][ T3227] xt_cgroup: xt_cgroup: no path or classid specified [ 751.697372][ T5926] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 751.973590][ T3254] netlink: 'syz.2.8280': attribute type 3 has an invalid length. [ 751.998149][ T3256] xt_CHECKSUM: unsupported CHECKSUM operation 68 [ 752.027338][ T3258] netlink: 'syz.0.8282': attribute type 21 has an invalid length. [ 752.060786][ T3258] IPv6: NLM_F_CREATE should be specified when creating new route [ 752.084756][ T3258] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 752.092063][ T3258] IPv6: NLM_F_CREATE should be set when creating new route [ 752.099309][ T3258] IPv6: NLM_F_CREATE should be set when creating new route [ 752.106558][ T3258] IPv6: NLM_F_CREATE should be set when creating new route [ 752.158985][ T3262] netlink: 'syz.2.8283': attribute type 10 has an invalid length. [ 752.205625][ T518] tipc: Node number set to 3758096385 [ 752.234673][T22286] block nbd6: Receive control failed (result -32) [ 752.442998][ T3289] syzkaller1: entered promiscuous mode [ 752.450854][ T3289] syzkaller1: entered allmulticast mode [ 752.523254][ T3299] xt_hashlimit: overflow, try lower: 18446744073709551613/4 [ 752.549731][ T3299] openvswitch: netlink: Missing valid actions attribute. [ 752.560606][ T3299] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 752.690507][ T3312] xt_CHECKSUM: unsupported CHECKSUM operation 68 [ 752.806858][ T3316] __nla_validate_parse: 1 callbacks suppressed [ 752.806877][ T3316] netlink: 12 bytes leftover after parsing attributes in process `syz.5.8298'. [ 752.849820][ T3323] netlink: 'syz.2.8299': attribute type 3 has an invalid length. [ 752.891739][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5640 ms [ 752.899895][ C0] lec:lec_tx_timeout: lec0 [ 752.905122][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 753.058519][ T3336] netlink: 11 bytes leftover after parsing attributes in process `syz.0.8304'. [ 753.109631][ T3336] netlink: 11 bytes leftover after parsing attributes in process `syz.0.8304'. [ 753.332865][ T3356] netlink: 'syz.5.8308': attribute type 39 has an invalid length. [ 753.577026][ T3373] bond4: entered promiscuous mode [ 753.582326][ T3373] bond4: entered allmulticast mode [ 753.587960][ T3373] 8021q: adding VLAN 0 to HW filter on device bond4 [ 753.604664][ T1145] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 753.613046][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 753.628209][ T3376] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 753.649384][ T3365] syzkaller0: entered promiscuous mode [ 753.655582][ T3365] syzkaller0: entered allmulticast mode [ 753.705549][ T3378] netlink: 4 bytes leftover after parsing attributes in process `syz.0.8315'. [ 753.768449][ T3380] netlink: 12 bytes leftover after parsing attributes in process `syz.0.8316'. [ 753.781821][ T3380] netlink: 658 bytes leftover after parsing attributes in process `syz.0.8316'. [ 753.860615][ T3382] netlink: 132 bytes leftover after parsing attributes in process `syz.0.8317'. [ 753.877749][ T3382] netlink: 196 bytes leftover after parsing attributes in process `syz.0.8317'. [ 753.881847][ T3384] netlink: 12 bytes leftover after parsing attributes in process `syz.1.8318'. [ 753.887824][ T3382] netlink: 196 bytes leftover after parsing attributes in process `syz.0.8317'. [ 754.049618][ T3398] bond0: (slave wlan1): Enslaving as an active interface with an up link [ 754.405435][ T3425] validate_nla: 8 callbacks suppressed [ 754.405452][ T3425] netlink: 'syz.1.8325': attribute type 17 has an invalid length. [ 754.490486][ T3425] netlink: 'syz.1.8325': attribute type 17 has an invalid length. [ 754.587395][ T3425] netlink: 'syz.1.8325': attribute type 17 has an invalid length. [ 754.713655][ T3425] netlink: 'syz.1.8325': attribute type 17 has an invalid length. [ 754.806352][ T3425] netlink: 'syz.1.8325': attribute type 17 has an invalid length. [ 754.937030][ T3425] netlink: 'syz.1.8325': attribute type 17 has an invalid length. [ 755.064691][ T3481] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 755.219953][ T3491] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check. [ 755.330272][ T3499] Cannot find add_set index 46338 as target [ 755.536437][ T6154] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 755.545372][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 755.585691][ T3512] syzkaller1: entered promiscuous mode [ 755.591200][ T3512] syzkaller1: entered allmulticast mode [ 755.600314][ T3513] netlink: 'syz.5.8351': attribute type 3 has an invalid length. [ 755.941165][ T3534] netlink: 'syz.5.8357': attribute type 1 has an invalid length. [ 756.014955][ T3482] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 756.021116][ T3482] Bluetooth: hci5: Error when powering off device on rfkill (-4) [ 756.046062][ T3540] syzkaller0: entered promiscuous mode [ 756.058521][ T3540] syzkaller0: entered allmulticast mode [ 756.317451][ T3482] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 756.318439][ T3566] netlink: 'syz.4.8362': attribute type 4 has an invalid length. [ 756.345837][ T3482] Bluetooth: hci4: Error when powering off device on rfkill (-4) [ 756.435429][ T3482] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 756.449673][ T3482] Bluetooth: hci2: Error when powering off device on rfkill (-4) [ 756.508310][ T3482] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 756.510179][ T3578] netlink: 'syz.4.8364': attribute type 3 has an invalid length. [ 756.542289][ T3482] Bluetooth: hci1: Error when powering off device on rfkill (-4) [ 756.578124][ T3482] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 756.609174][ T3482] Bluetooth: hci3: Error when powering off device on rfkill (-4) [ 757.534374][ T3649] tipc: Started in network mode [ 757.553860][ T3649] tipc: Node identity aaaaaaaaaa35, cluster identity 4711 [ 757.576970][ T3649] tipc: Enabled bearer , priority 2 [ 757.653843][ T3652] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check. [ 757.912007][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 757.920098][ C0] lec:lec_tx_timeout: lec0 [ 757.955584][ T3669] FAULT_INJECTION: forcing a failure. [ 757.955584][ T3669] name failslab, interval 1, probability 0, space 0, times 0 [ 757.968481][ T3669] CPU: 0 UID: 0 PID: 3669 Comm: syz.0.8381 Not tainted syzkaller #0 PREEMPT(full) [ 757.968506][ T3669] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/27/2026 [ 757.968518][ T3669] Call Trace: [ 757.968526][ T3669] [ 757.968534][ T3669] dump_stack_lvl+0xe8/0x150 [ 757.968565][ T3669] should_fail_ex+0x412/0x560 [ 757.968595][ T3669] should_failslab+0xa8/0x100 [ 757.968617][ T3669] ? skb_clone+0x212/0x3a0 [ 757.968637][ T3669] kmem_cache_alloc_noprof+0x87/0x650 [ 757.968656][ T3669] ? __netlink_lookup+0xc6/0x8b0 [ 757.968770][ T3669] skb_clone+0x212/0x3a0 [ 757.968792][ T3669] __netlink_deliver_tap+0x404/0x850 [ 757.968827][ T3669] ? netlink_deliver_tap+0x2e/0x1b0 [ 757.968852][ T3669] netlink_deliver_tap+0x19c/0x1b0 [ 757.968877][ T3669] netlink_unicast+0x7e3/0x9b0 [ 757.968906][ T3669] ? __pfx_netlink_unicast+0x10/0x10 [ 757.968930][ T3669] ? netlink_sendmsg+0x650/0xb40 [ 757.968951][ T3669] ? skb_put+0x11b/0x210 [ 757.968980][ T3669] netlink_sendmsg+0x813/0xb40 [ 757.969012][ T3669] ? __pfx_netlink_sendmsg+0x10/0x10 [ 757.969039][ T3669] ? aa_sock_msg_perm+0xf1/0x1b0 [ 757.969066][ T3669] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 757.969091][ T3669] ____sys_sendmsg+0x972/0x9f0 [ 757.969118][ T3669] ? __pfx_____sys_sendmsg+0x10/0x10 [ 757.969144][ T3669] ? import_iovec+0x73/0xa0 [ 757.969176][ T3669] ___sys_sendmsg+0x2a5/0x360 [ 757.969207][ T3669] ? __pfx____sys_sendmsg+0x10/0x10 [ 757.969259][ T3669] ? __fget_files+0x2a/0x420 [ 757.969284][ T3669] ? __fget_files+0x3a0/0x420 [ 757.969320][ T3669] __x64_sys_sendmsg+0x1bd/0x2a0 [ 757.969341][ T3669] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 757.969368][ T3669] ? __pfx_ksys_write+0x10/0x10 [ 757.969400][ T3669] do_syscall_64+0x14d/0xf80 [ 757.969416][ T3669] ? trace_irq_disable+0x3b/0x150 [ 757.969442][ T3669] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 757.969461][ T3669] ? clear_bhb_loop+0x40/0x90 [ 757.969483][ T3669] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 757.969502][ T3669] RIP: 0033:0x7f36fe99c799 [ 757.969519][ T3669] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 757.969535][ T3669] RSP: 002b:00007f36ff7ce028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 757.969555][ T3669] RAX: ffffffffffffffda RBX: 00007f36fec15fa0 RCX: 00007f36fe99c799 [ 757.969568][ T3669] RDX: 0000000000028000 RSI: 0000200000000080 RDI: 0000000000000003 [ 757.969580][ T3669] RBP: 00007f36ff7ce090 R08: 0000000000000000 R09: 0000000000000000 [ 757.969592][ T3669] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 757.969603][ T3669] R13: 00007f36fec16038 R14: 00007f36fec15fa0 R15: 00007ffc753a3ae8 [ 757.969633][ T3669] [ 758.652750][ T5892] tipc: Node number set to 10463914 [ 759.013128][ T3711] syzkaller0: entered promiscuous mode [ 759.018688][ T3711] syzkaller0: entered allmulticast mode [ 759.065330][ T3711] __nla_validate_parse: 41 callbacks suppressed [ 759.065350][ T3711] netlink: 4 bytes leftover after parsing attributes in process `syz.4.8385'. [ 759.233431][ T3727] IPv6: NLM_F_CREATE should be specified when creating new route [ 759.366663][ T6150] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 759.375184][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 759.595819][ T3730] netlink: 20 bytes leftover after parsing attributes in process `syz.5.8388'. [ 759.844146][ T3757] netlink: 24 bytes leftover after parsing attributes in process `syz.4.8393'. [ 759.885057][ T3761] validate_nla: 3 callbacks suppressed [ 759.885075][ T3761] netlink: 'syz.1.8394': attribute type 3 has an invalid length. [ 760.285297][ T3791] IPVS: Scheduler module ip_vs_sip not found [ 760.567859][ T3814] bridge: RTM_NEWNEIGH bridge0 with NTF_USE is not supported [ 760.653527][ T3818] netlink: 8 bytes leftover after parsing attributes in process `syz.5.8409'. [ 760.670669][ T3818] netlink: 8 bytes leftover after parsing attributes in process `syz.5.8409'. [ 760.692879][ T3816] syzkaller0: entered promiscuous mode [ 760.702573][ T3816] syzkaller0: entered allmulticast mode [ 760.709990][ T3818] ipt_rpfilter: unknown options [ 760.731239][ T3824] netlink: 16178 bytes leftover after parsing attributes in process `syz.4.8412'. [ 760.783088][ T3818] netlink: 228 bytes leftover after parsing attributes in process `syz.5.8409'. [ 760.849228][ T3827] netlink: 4 bytes leftover after parsing attributes in process `syz.4.8413'. [ 760.906678][ T3832] netlink: 8 bytes leftover after parsing attributes in process `syz.2.8415'. [ 760.921208][ T3833] netlink: 4 bytes leftover after parsing attributes in process `syz.2.8415'. [ 761.065296][ T3840] syzkaller1: entered promiscuous mode [ 761.070821][ T3840] syzkaller1: entered allmulticast mode [ 761.138835][ T3843] bond3: option arp_all_targets: invalid value (18446744073709551613) [ 761.154068][ T3843] bond3 (unregistering): Released all slaves [ 761.282661][ T12] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 761.290881][ T5922] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 761.299013][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 761.817282][ T3873] syzkaller0: entered promiscuous mode [ 761.823621][ T3873] syzkaller0: entered allmulticast mode [ 762.055637][ T3890] syzkaller1: entered promiscuous mode [ 762.076696][ T3890] syzkaller1: entered allmulticast mode [ 762.099532][ T3894] netlink: 'syz.1.8435': attribute type 3 has an invalid length. [ 762.107608][ T3894] netlink: 'syz.1.8435': attribute type 1 has an invalid length. [ 762.517616][ T3923] netlink: 'syz.5.8445': attribute type 1 has an invalid length. [ 762.563797][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 762.589545][ T3936] netlink: 'syz.2.8444': attribute type 1 has an invalid length. [ 762.592797][ T3923] 8021q: adding VLAN 0 to HW filter on device bond3 [ 762.641190][ T3938] bond3: (slave geneve3): making interface the new active one [ 762.667165][ T3938] bond3: (slave geneve3): Enslaving as an active interface with an up link [ 762.709901][ T3936] 8021q: adding VLAN 0 to HW filter on device bond9 [ 762.728513][ T3696] netdevsim netdevsim5 netdevsim0: set [1, 1] type 2 family 0 port 20004 - 0 [ 762.772376][ T3696] netdevsim netdevsim5 netdevsim1: set [1, 1] type 2 family 0 port 20004 - 0 [ 762.810358][ T3696] netdevsim netdevsim5 netdevsim2: set [1, 1] type 2 family 0 port 20004 - 0 [ 762.851654][ T3696] netdevsim netdevsim5 netdevsim3: set [1, 1] type 2 family 0 port 20004 - 0 [ 763.166362][ T3981] netlink: 'syz.0.8460': attribute type 6 has an invalid length. [ 763.261648][ T3983] x_tables: duplicate underflow at hook 3 [ 763.566284][ T4004] xt_recent: hitcount (4294901760) is larger than allowed maximum (65535) [ 763.750460][ T4017] netlink: 'syz.5.8477': attribute type 4 has an invalid length. [ 763.785019][ T4017] netlink: 'syz.5.8477': attribute type 4 has an invalid length. [ 763.898497][ T4027] bridge0: port 1(syz_tun) entered blocking state [ 763.918656][ T4027] bridge0: port 1(syz_tun) entered disabled state [ 763.927541][ T4027] syz_tun: entered allmulticast mode [ 763.935292][ T4027] syz_tun: entered promiscuous mode [ 763.943572][ T4027] bridge0: port 1(syz_tun) entered blocking state [ 763.950470][ T4027] bridge0: port 1(syz_tun) entered listening state [ 763.970685][ T4036] xt_hashlimit: size too large, truncated to 1048576 [ 763.984959][ T4037] xt_nfacct: accounting object `\$9ZM#mU|^c\F9YⳈ' does not exist [ 764.107467][ T4046] bridge: RTM_NEWNEIGH bridge0 with NTF_USE is not supported [ 764.204495][ T4050] syzkaller0: entered promiscuous mode [ 764.210619][ T4050] syzkaller0: entered allmulticast mode [ 764.262725][ T4052] __nla_validate_parse: 11 callbacks suppressed [ 764.262746][ T4052] netlink: 16 bytes leftover after parsing attributes in process `syz.5.8489'. [ 764.302842][ T4052] netlink: 12 bytes leftover after parsing attributes in process `syz.5.8489'. [ 764.319406][ T4052] netlink: 12 bytes leftover after parsing attributes in process `syz.5.8489'. [ 764.404852][ T4061] bond7: invalid ARP target 0.0.0.0 specified for addition [ 764.413314][ T4061] bond7: option arp_ip_target: invalid value (0) [ 764.425635][ T4061] bond7 (unregistering): Released all slaves [ 764.457486][ T4064] Bluetooth: hci4: Opcode 0x0401 failed: -22 [ 764.636747][ T4079] netlink: 'syz.0.8498': attribute type 3 has an invalid length. [ 764.762784][ T4086] netlink: 256 bytes leftover after parsing attributes in process `syz.5.8499'. [ 764.800059][ T4086] netlink: 'syz.5.8499': attribute type 9 has an invalid length. [ 765.123656][ T12] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 765.132653][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 765.366562][ T4114] mac80211_hwsim hwsim73 wlan0: entered promiscuous mode [ 765.443842][ T4116] netlink: 12 bytes leftover after parsing attributes in process `syz.5.8510'. [ 765.497097][ T4119] netlink: 'syz.5.8510': attribute type 21 has an invalid length. [ 765.536131][ T4121] netlink: 'syz.2.8511': attribute type 3 has an invalid length. [ 765.880994][ T4143] bond10: (slave C): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 765.910867][ T4151] netlink: 56 bytes leftover after parsing attributes in process `syz.1.8519'. [ 765.914436][ T4153] netlink: 36 bytes leftover after parsing attributes in process `syz.0.8520'. [ 765.948016][ T4143] bond10: (slave C): Enslaving as an active interface with an up link [ 765.970879][ T4143] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 766.003767][ C0] bridge0: port 1(syz_tun) entered learning state [ 766.200281][ T4166] netlink: 'syz.5.8523': attribute type 3 has an invalid length. [ 766.452774][ T4177] 8021q: adding VLAN 0 to HW filter on device bond4 [ 766.485436][ T4174] netlink: 28 bytes leftover after parsing attributes in process `syz.4.8524'. [ 766.495158][ T4174] netlink: 28 bytes leftover after parsing attributes in process `syz.4.8524'. [ 766.606286][ T4183] netlink: 4 bytes leftover after parsing attributes in process `syz.5.8526'. [ 766.783368][ T4192] netlink: 'syz.2.8530': attribute type 3 has an invalid length. [ 767.045164][ T58] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 767.054611][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 767.134683][ T4214] bond0: entered promiscuous mode [ 767.140948][ T4214] bond0: entered allmulticast mode [ 767.150808][ T4214] 8021q: adding VLAN 0 to HW filter on device bond0 [ 767.294887][ T4218] bridge: RTM_NEWNEIGH bridge0 with NTF_USE is not supported [ 767.478286][ T4233] xt_hashlimit: size too large, truncated to 1048576 [ 767.571139][ T4237] netlink: 'syz.2.8543': attribute type 1 has an invalid length. [ 767.996943][ T4262] netlink: 'syz.5.8547': attribute type 3 has an invalid length. [ 768.081792][ C0] bridge0: port 1(syz_tun) entered forwarding state [ 768.088473][ C0] bridge0: topology change detected, propagating [ 768.430306][ T4291] xt_hashlimit: size too large, truncated to 1048576 [ 768.534715][ T4286] tipc: Enabled bearer , priority 0 [ 768.637014][ T4285] tipc: Disabling bearer [ 768.863160][ T4309] netlink: 'syz.1.8560': attribute type 58 has an invalid length. [ 768.923270][ T5486] veth1_macvtap: left promiscuous mode [ 768.963223][ T4311] veth0: entered promiscuous mode [ 768.977302][ T4310] veth0: left promiscuous mode [ 768.981865][ T4313] xt_CHECKSUM: unsupported CHECKSUM operation 68 [ 769.083855][ T4318] netlink: 'syz.4.8563': attribute type 3 has an invalid length. [ 769.139319][ T4321] netlink: 'syz.1.8564': attribute type 1 has an invalid length. [ 769.286987][ T4327] __nla_validate_parse: 3 callbacks suppressed [ 769.287007][ T4327] netlink: 28 bytes leftover after parsing attributes in process `syz.0.8566'. [ 769.305814][ T4327] netlink: 28 bytes leftover after parsing attributes in process `syz.0.8566'. [ 769.364706][ T4329] netlink: 'syz.1.8567': attribute type 11 has an invalid length. [ 769.507576][ T4338] netlink: 'syz.4.8569': attribute type 3 has an invalid length. [ 769.594163][ T4345] syzkaller0: entered promiscuous mode [ 769.613210][ T4347] xt_CHECKSUM: unsupported CHECKSUM operation 68 [ 769.631952][ T4345] syzkaller0: entered allmulticast mode [ 769.654596][ T4345] tipc: Enabled bearer , priority 0 [ 769.726388][ T4344] tipc: Resetting bearer [ 769.769179][ T4344] tipc: Disabling bearer [ 769.819478][ T4361] netlink: 68 bytes leftover after parsing attributes in process `syz.1.8577'. [ 769.839294][ T4361] netlink: 12 bytes leftover after parsing attributes in process `syz.1.8577'. [ 769.949284][ T4366] netlink: 16 bytes leftover after parsing attributes in process `syz.2.8579'. [ 769.973702][ T4355] bridge0: port 2(bridge_slave_1) entered disabled state [ 769.981377][ T4355] bridge0: port 1(bridge_slave_0) entered disabled state [ 769.989211][ T4366] openvswitch: netlink: Flow key attr not present in new flow. [ 770.125860][ T4355] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 770.162339][ T1167] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 770.170663][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 770.266053][ T4368] A link change request failed with some changes committed already. Interface xfrm0 may have been left with an inconsistent configuration, please check. [ 770.290377][ T4370] netlink: 28 bytes leftover after parsing attributes in process `syz.0.8578'. [ 770.319234][ T4370] netlink: 28 bytes leftover after parsing attributes in process `syz.0.8578'. [ 770.372187][ T58] netdevsim netdevsim5 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 770.389436][ T58] netdevsim netdevsim5 netdevsim0: unset [1, 1] type 2 family 0 port 20004 - 0 [ 770.399760][ T58] netdevsim netdevsim5 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 770.410333][ T58] netdevsim netdevsim5 netdevsim1: unset [1, 1] type 2 family 0 port 20004 - 0 [ 770.420561][ T4381] workqueue: Failed to create a rescuer kthread for wq "bond4": -EINTR [ 770.463398][ T58] netdevsim netdevsim5 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 770.509603][ T58] netdevsim netdevsim5 netdevsim2: unset [1, 1] type 2 family 0 port 20004 - 0 [ 770.529426][ T58] netdevsim netdevsim5 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 770.565713][ T58] netdevsim netdevsim5 netdevsim3: unset [1, 1] type 2 family 0 port 20004 - 0 [ 770.735675][ T4408] netlink: 44 bytes leftover after parsing attributes in process `syz.1.8590'. [ 770.759386][ T4408] netlink: 24 bytes leftover after parsing attributes in process `syz.1.8590'. [ 770.844868][ T4418] netlink: 28 bytes leftover after parsing attributes in process `syz.4.8591'. [ 770.871049][ T4418] gretap0: entered promiscuous mode [ 770.882669][ T5926] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 770.900924][ T4418] gretap0: left promiscuous mode [ 770.915391][ T4421] validate_nla: 2 callbacks suppressed [ 770.915408][ T4421] netlink: 'syz.1.8592': attribute type 3 has an invalid length. [ 770.947346][ T4423] netlink: 'syz.0.8593': attribute type 1 has an invalid length. [ 771.319619][T22286] block nbd7: Receive control failed (result -107) [ 771.356289][ T4445] nbd7: detected capacity change from 0 to 127 [ 771.376975][ T4242] block nbd7: Dead connection, failed to find a fallback [ 771.396745][ T4242] block nbd7: shutting down sockets [ 771.413336][ T4242] blk_print_req_error: 24 callbacks suppressed [ 771.413354][ T4242] I/O error, dev nbd7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 771.443446][ T4242] buffer_io_error: 23 callbacks suppressed [ 771.443463][ T4242] Buffer I/O error on dev nbd7, logical block 0, async page read [ 771.464434][ T4242] I/O error, dev nbd7, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 771.474957][ T4242] Buffer I/O error on dev nbd7, logical block 1, async page read [ 771.483657][ T4242] I/O error, dev nbd7, sector 4 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 771.527882][ T4242] Buffer I/O error on dev nbd7, logical block 2, async page read [ 771.543585][ T4242] I/O error, dev nbd7, sector 6 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 771.556950][ T4242] Buffer I/O error on dev nbd7, logical block 3, async page read [ 771.574943][ T4242] I/O error, dev nbd7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 771.585444][ T4242] Buffer I/O error on dev nbd7, logical block 0, async page read [ 771.586467][ T4461] syzkaller1: entered promiscuous mode [ 771.593528][ T4242] I/O error, dev nbd7, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 771.599666][ T4461] syzkaller1: entered allmulticast mode [ 771.627773][ T4242] Buffer I/O error on dev nbd7, logical block 1, async page read [ 771.659892][ T4242] I/O error, dev nbd7, sector 4 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 771.670795][ T4242] Buffer I/O error on dev nbd7, logical block 2, async page read [ 771.679659][ T4242] I/O error, dev nbd7, sector 6 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 771.689548][ T4242] Buffer I/O error on dev nbd7, logical block 3, async page read [ 771.697994][ T4242] I/O error, dev nbd7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 771.708088][ T4242] Buffer I/O error on dev nbd7, logical block 0, async page read [ 771.717668][ T4242] I/O error, dev nbd7, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 771.730226][ T4242] Buffer I/O error on dev nbd7, logical block 1, async page read [ 771.739927][ T4242] ldm_validate_partition_table(): Disk read failed. [ 771.747990][ T4242] Dev nbd7: unable to read RDB block 0 [ 771.755096][ T4242] nbd7: unable to read partition table [ 771.770255][ T4242] ldm_validate_partition_table(): Disk read failed. [ 771.778183][ T4242] Dev nbd7: unable to read RDB block 0 [ 771.787128][ T4242] nbd7: unable to read partition table [ 772.652656][ T4505] lo: entered promiscuous mode [ 772.682360][ T4505] tunl0: entered promiscuous mode [ 772.687847][ T4505] gre0: entered promiscuous mode [ 772.725518][ T4505] gretap0: entered promiscuous mode [ 772.732813][ T4514] x_tables: duplicate underflow at hook 1 [ 772.743290][ T4505] erspan0: entered promiscuous mode [ 772.760495][ T4505] ip_vti0: entered promiscuous mode [ 772.805034][ T1167] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 772.813968][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 772.952786][ T4524] PF_CAN: dropped non conform CAN XL skbuff: dev type 65534, len 40 [ 772.973382][ T4522] C: entered promiscuous mode [ 772.983879][ T4522] tunl0: entered promiscuous mode [ 773.010704][ T4522] gre0: entered promiscuous mode [ 773.105582][ T4522] erspan0: entered promiscuous mode [ 773.130020][ T4522] ip_vti0: entered promiscuous mode [ 773.151560][ T4522] ip6_vti0: entered promiscuous mode [ 773.164025][ T4522] sit0: entered promiscuous mode [ 773.208777][ T4522] ip6tnl0: entered promiscuous mode [ 773.222411][ T4522] ip6gre0: entered promiscuous mode [ 773.233758][ T4522] syz_tun: entered promiscuous mode [ 773.251264][ T4522] ip6gretap0: entered promiscuous mode [ 773.263302][ T4522] bridge0: entered promiscuous mode [ 773.271017][ T4522] bridge0: left allmulticast mode [ 773.277173][ T4522] vcan0: entered promiscuous mode [ 773.285987][ T4522] bond0: entered promiscuous mode [ 773.288315][ T4539] netlink: 'syz.5.8624': attribute type 10 has an invalid length. [ 773.291101][ T4522] bond_slave_0: entered promiscuous mode [ 773.307076][ T4522] bond_slave_1: entered promiscuous mode [ 773.313380][ T4522] bridge_slave_1: entered promiscuous mode [ 773.319670][ T4522] mac80211_hwsim hwsim56 wlan1: entered promiscuous mode [ 773.331377][ T4522] team0: entered promiscuous mode [ 773.340354][ T4522] team_slave_0: entered promiscuous mode [ 773.347714][ T4522] team_slave_1: entered promiscuous mode [ 773.355435][ T4522] nlmon0: entered promiscuous mode [ 773.365108][ T4522] caif0: entered promiscuous mode [ 773.370569][ T4522] vxcan0: entered promiscuous mode [ 773.377501][ T4522] vxcan1: entered promiscuous mode [ 773.383700][ T4522] veth0: entered promiscuous mode [ 773.392720][ T4522] veth1: entered promiscuous mode [ 773.401495][ T4522] wg0: entered promiscuous mode [ 773.411204][ T4522] wg1: entered promiscuous mode [ 773.419564][ T4522] wg2: entered promiscuous mode [ 773.427408][ T4522] veth0_to_bridge: entered promiscuous mode [ 773.439661][ T4522] veth1_to_bridge: entered promiscuous mode [ 773.453474][ T4522] veth0_to_bond: entered promiscuous mode [ 773.464142][ T4522] veth1_to_bond: entered promiscuous mode [ 773.474401][ T4522] veth0_to_team: entered promiscuous mode [ 773.484750][ T4522] veth1_to_team: entered promiscuous mode [ 773.495807][ T4522] veth0_to_batadv: entered promiscuous mode [ 773.505333][ T4522] batadv_slave_0: entered promiscuous mode [ 773.516107][ T4522] veth1_to_batadv: entered promiscuous mode [ 773.526521][ T4522] batadv_slave_1: entered promiscuous mode [ 773.537844][ T4522] xfrm0: entered promiscuous mode [ 773.546153][ T4522] veth0_to_hsr: entered promiscuous mode [ 773.560114][ T4522] veth1_to_hsr: entered promiscuous mode [ 773.574958][ T4522] hsr0: entered promiscuous mode [ 773.583133][ T4522] veth1_virt_wifi: entered promiscuous mode [ 773.593174][ T4522] veth0_virt_wifi: entered promiscuous mode [ 773.602775][ T4522] net veth1_virt_wifi virt_wifi0: entered promiscuous mode [ 773.610374][ T4522] veth0_macvtap: entered promiscuous mode [ 773.621019][ T4522] macvtap0: entered promiscuous mode [ 773.627536][ T4522] geneve0: entered promiscuous mode [ 773.639865][ T4522] mac80211_hwsim hwsim55 wlan0: entered promiscuous mode [ 773.647713][ T4522] vlan2: entered promiscuous mode [ 773.656569][ T4522] netdevsim netdevsim1 eth0: entered promiscuous mode [ 773.663952][ T4522] netdevsim netdevsim1 eth1: entered promiscuous mode [ 773.670953][ T4522] netdevsim netdevsim1 eth2: entered promiscuous mode [ 773.680119][ T4522] netdevsim netdevsim1 eth3: entered promiscuous mode [ 773.687873][ T4522] bond1: entered promiscuous mode [ 773.694398][ T4522] gretap1: entered promiscuous mode [ 773.701197][ T4522] macvlan2: entered promiscuous mode [ 773.707260][ T4522] bond2: entered promiscuous mode [ 773.713821][ T4522] bond3: left allmulticast mode [ 773.720019][ T4522] veth2: entered promiscuous mode [ 773.725938][ T4522] veth3: left allmulticast mode [ 773.732718][ T4522] vlan3: entered promiscuous mode [ 773.737985][ T4522] vlan3: left allmulticast mode [ 773.743804][ T4522] mac80211_hwsim hwsim55 wlan0: left allmulticast mode [ 773.753331][ T4522] ipvlan2: entered promiscuous mode [ 773.761416][ T4522] ip6gretap1: entered promiscuous mode [ 773.767597][ T4522] vlan4: entered promiscuous mode [ 773.775257][ T4522] vxcan2: entered promiscuous mode [ 773.780647][ T4522] vxcan3: entered promiscuous mode [ 773.786293][ T4522] vxcan3: left allmulticast mode [ 773.794303][ T4522] vxlan0: entered promiscuous mode [ 773.801539][ T4522] gretap2: entered promiscuous mode [ 773.807777][ T4522] vlan5: entered promiscuous mode [ 773.813791][ T4522] ip6gre1: entered promiscuous mode [ 773.821088][ T4522] vlan6: left allmulticast mode [ 773.826573][ T4522] geneve1: left allmulticast mode [ 773.833263][ T4522] bridge1: left allmulticast mode [ 773.840760][ T4522] mac80211_hwsim hwsim55 dvmrp0: entered promiscuous mode [ 773.849455][ T4522] ipvlan3: entered promiscuous mode [ 773.857758][ T4522] bond4: left allmulticast mode [ 773.864844][ T4522] bridge2: entered promiscuous mode [ 773.873309][ T4522] ipip0: entered promiscuous mode [ 773.880434][ T4522] bond5: entered promiscuous mode [ 773.886369][ T4522] bridge3: entered promiscuous mode [ 773.941452][ T4535] workqueue: Failed to create a rescuer kthread for wq "bond4": -EINTR [ 773.990704][ T4539] team0 (unregistering): Port device team_slave_0 removed [ 774.046892][ T4539] team0 (unregistering): Port device team_slave_1 removed [ 774.077961][ T6150] netdevsim netdevsim1 eth0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 774.114644][ T6150] netdevsim netdevsim1 eth0: unset [1, 0] type 2 family 0 port 48078 - 0 [ 774.136657][ T4553] openvswitch: netlink: Missing key (keys=40, expected=200000) [ 774.138246][ T6150] netdevsim netdevsim1 eth0: unset [1, 1] type 2 family 0 port 6081 - 0 [ 774.237552][ T4549] bond7: peer notification delay (1164) is not a multiple of miimon (100), value rounded to 1100 ms [ 774.257318][ T4549] bond7: entered promiscuous mode [ 774.275854][ T4549] bond7: entered allmulticast mode [ 774.313168][ T4549] 8021q: adding VLAN 0 to HW filter on device bond7 [ 774.326501][ T6150] netdevsim netdevsim1 eth1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 774.381856][ T6150] netdevsim netdevsim1 eth1: unset [1, 0] type 2 family 0 port 48078 - 0 [ 774.392958][ T6150] netdevsim netdevsim1 eth1: unset [1, 1] type 2 family 0 port 6081 - 0 [ 774.437469][ T6150] netdevsim netdevsim1 eth2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 774.466096][ T6150] netdevsim netdevsim1 eth2: unset [1, 0] type 2 family 0 port 48078 - 0 [ 774.503848][ T6150] netdevsim netdevsim1 eth2: unset [1, 1] type 2 family 0 port 6081 - 0 [ 774.522473][ T6150] netdevsim netdevsim1 eth3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 774.531029][ T6150] netdevsim netdevsim1 eth3: unset [1, 0] type 2 family 0 port 48078 - 0 [ 774.560720][ T6150] netdevsim netdevsim1 eth3: unset [1, 1] type 2 family 0 port 6081 - 0 [ 774.635332][ T4582] netlink: 'syz.4.8635': attribute type 1 has an invalid length. [ 774.845779][ T4602] __nla_validate_parse: 16 callbacks suppressed [ 774.845800][ T4602] netlink: 68 bytes leftover after parsing attributes in process `syz.2.8638'. [ 774.989450][ T4613] netlink: 8 bytes leftover after parsing attributes in process `syz.5.8643'. [ 775.246795][ T4625] xt_CT: You must specify a L4 protocol and not use inversions on it [ 775.288342][ T4625] netlink: 8 bytes leftover after parsing attributes in process `syz.5.8645'. [ 775.346564][ T4620] netlink: 40 bytes leftover after parsing attributes in process `syz.0.8644'. [ 775.386077][ T3696] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 775.394683][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 775.424684][ T4625] vlan3: entered allmulticast mode [ 775.429851][ T4625] mac80211_hwsim hwsim80 wlan0: entered allmulticast mode [ 775.710434][ T4638] netlink: 8 bytes leftover after parsing attributes in process `syz.4.8650'. [ 775.789031][ T4645] netlink: 8 bytes leftover after parsing attributes in process `syz.1.8653'. [ 775.805463][ T4646] mapping of prio or/and queue is allowed only from OUTPUT/FORWARD/POSTROUTING chains [ 775.824761][ T4645] netlink: 4 bytes leftover after parsing attributes in process `syz.1.8653'. [ 775.874864][ T4646] netlink: 8 bytes leftover after parsing attributes in process `syz.5.8652'. [ 775.963133][ T4626] wg1 speed is unknown, defaulting to 1000 [ 775.964304][ T4656] netlink: 8 bytes leftover after parsing attributes in process `syz.1.8655'. [ 776.013250][ T4656] [ 776.015617][ T4656] ====================================================== [ 776.022639][ T4656] WARNING: possible circular locking dependency detected [ 776.029680][ T4656] syzkaller #0 Not tainted [ 776.034097][ T4656] ------------------------------------------------------ [ 776.041118][ T4656] syz.1.8655/4656 is trying to acquire lock: [ 776.047155][ T4656] ffffffff8fd49d58 (nr_neigh_list_lock){+...}-{3:3}, at: nr_remove_neigh+0x25/0xe0 [ 776.056605][ T4656] [ 776.056605][ T4656] but task is already holding lock: [ 776.064195][ T4656] ffff8880250c9970 (&nr_node->node_lock){+...}-{3:3}, at: nr_add_node+0x1039/0x2630 [ 776.073820][ T4656] [ 776.073820][ T4656] which lock already depends on the new lock. [ 776.073820][ T4656] [ 776.084317][ T4656] [ 776.084317][ T4656] the existing dependency chain (in reverse order) is: [ 776.093336][ T4656] [ 776.093336][ T4656] -> #2 (&nr_node->node_lock){+...}-{3:3}: [ 776.101418][ T4656] _raw_spin_lock_bh+0x36/0x50 [ 776.106779][ T4656] nr_rt_device_down+0x153/0x860 [ 776.112260][ T4656] nr_device_event+0x137/0x150 [ 776.117543][ T4656] notifier_call_chain+0x1be/0x400 [ 776.123207][ T4656] __dev_notify_flags+0x16d/0x310 [ 776.129022][ T4656] netif_change_flags+0xe8/0x1a0 [ 776.134486][ T4656] dev_change_flags+0x130/0x260 [ 776.139873][ T4656] dev_ioctl+0x7b4/0x1150 [ 776.144804][ T4656] sock_do_ioctl+0x23e/0x320 [ 776.149921][ T4656] sock_ioctl+0x5c6/0x7f0 [ 776.154778][ T4656] __se_sys_ioctl+0xfc/0x170 [ 776.159884][ T4656] do_syscall_64+0x14d/0xf80 [ 776.164982][ T4656] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 776.171385][ T4656] [ 776.171385][ T4656] -> #1 (nr_node_list_lock){+...}-{3:3}: [ 776.179208][ T4656] _raw_spin_lock_bh+0x36/0x50 [ 776.184516][ T4656] nr_rt_device_down+0xbe/0x860 [ 776.189894][ T4656] nr_device_event+0x137/0x150 [ 776.195177][ T4656] notifier_call_chain+0x1be/0x400 [ 776.200810][ T4656] __dev_notify_flags+0x16d/0x310 [ 776.206353][ T4656] netif_change_flags+0xe8/0x1a0 [ 776.211807][ T4656] dev_change_flags+0x130/0x260 [ 776.217173][ T4656] dev_ioctl+0x7b4/0x1150 [ 776.222019][ T4656] sock_do_ioctl+0x23e/0x320 [ 776.227142][ T4656] sock_ioctl+0x5c6/0x7f0 [ 776.231981][ T4656] __se_sys_ioctl+0xfc/0x170 [ 776.237184][ T4656] do_syscall_64+0x14d/0xf80 [ 776.242315][ T4656] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 776.248770][ T4656] [ 776.248770][ T4656] -> #0 (nr_neigh_list_lock){+...}-{3:3}: [ 776.256686][ T4656] __lock_acquire+0x15a5/0x2cf0 [ 776.262073][ T4656] lock_acquire+0xf0/0x2e0 [ 776.267006][ T4656] _raw_spin_lock_bh+0x36/0x50 [ 776.272433][ T4656] nr_remove_neigh+0x25/0xe0 [ 776.277544][ T4656] nr_add_node+0x1e41/0x2630 [ 776.282657][ T4656] nr_rt_ioctl+0xe59/0xf90 [ 776.287592][ T4656] sock_do_ioctl+0x101/0x320 [ 776.292725][ T4656] sock_ioctl+0x5c6/0x7f0 [ 776.297579][ T4656] __se_sys_ioctl+0xfc/0x170 [ 776.302684][ T4656] do_syscall_64+0x14d/0xf80 [ 776.307871][ T4656] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 776.314273][ T4656] [ 776.314273][ T4656] other info that might help us debug this: [ 776.314273][ T4656] [ 776.324575][ T4656] Chain exists of: [ 776.324575][ T4656] nr_neigh_list_lock --> nr_node_list_lock --> &nr_node->node_lock [ 776.324575][ T4656] [ 776.338391][ T4656] Possible unsafe locking scenario: [ 776.338391][ T4656] [ 776.345832][ T4656] CPU0 CPU1 [ 776.351193][ T4656] ---- ---- [ 776.356545][ T4656] lock(&nr_node->node_lock); [ 776.361307][ T4656] lock(nr_node_list_lock); [ 776.368404][ T4656] lock(&nr_node->node_lock); [ 776.375676][ T4656] lock(nr_neigh_list_lock); [ 776.380343][ T4656] [ 776.380343][ T4656] *** DEADLOCK *** [ 776.380343][ T4656] [ 776.388467][ T4656] 1 lock held by syz.1.8655/4656: [ 776.393472][ T4656] #0: ffff8880250c9970 (&nr_node->node_lock){+...}-{3:3}, at: nr_add_node+0x1039/0x2630 [ 776.403320][ T4656] [ 776.403320][ T4656] stack backtrace: [ 776.409205][ T4656] CPU: 1 UID: 0 PID: 4656 Comm: syz.1.8655 Not tainted syzkaller #0 PREEMPT(full) [ 776.409227][ T4656] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/27/2026 [ 776.409238][ T4656] Call Trace: [ 776.409247][ T4656] [ 776.409256][ T4656] dump_stack_lvl+0xe8/0x150 [ 776.409282][ T4656] print_circular_bug+0x2e1/0x300 [ 776.409309][ T4656] check_noncircular+0x12e/0x150 [ 776.409335][ T4656] __lock_acquire+0x15a5/0x2cf0 [ 776.409365][ T4656] lock_acquire+0xf0/0x2e0 [ 776.409383][ T4656] ? nr_remove_neigh+0x25/0xe0 [ 776.409401][ T4656] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 776.409418][ T4656] ? nr_remove_neigh+0x25/0xe0 [ 776.409433][ T4656] _raw_spin_lock_bh+0x36/0x50 [ 776.409455][ T4656] ? nr_remove_neigh+0x25/0xe0 [ 776.409471][ T4656] nr_remove_neigh+0x25/0xe0 [ 776.409487][ T4656] nr_add_node+0x1e41/0x2630 [ 776.409515][ T4656] ? nr_call_to_digi+0x126/0x1b0 [ 776.409530][ T4656] nr_rt_ioctl+0xe59/0xf90 [ 776.409559][ T4656] ? kasan_quarantine_put+0xbb/0x1f0 [ 776.409576][ T4656] ? __pfx_nr_rt_ioctl+0x10/0x10 [ 776.409604][ T4656] ? apparmor_capable+0x126/0x170 [ 776.409703][ T4656] ? capable+0x88/0xe0 [ 776.409724][ T4656] ? nr_ioctl+0x1b1/0x3b0 [ 776.409745][ T4656] sock_do_ioctl+0x101/0x320 [ 776.409766][ T4656] ? __pfx_sock_do_ioctl+0x10/0x10 [ 776.409783][ T4656] ? do_futex+0x395/0x420 [ 776.409818][ T4656] sock_ioctl+0x5c6/0x7f0 [ 776.409836][ T4656] ? __pfx_sock_ioctl+0x10/0x10 [ 776.409854][ T4656] ? __fget_files+0x2a/0x420 [ 776.409880][ T4656] ? __fget_files+0x3a0/0x420 [ 776.409902][ T4656] ? __fget_files+0x2a/0x420 [ 776.409925][ T4656] ? bpf_lsm_file_ioctl+0x9/0x20 [ 776.409946][ T4656] ? __pfx_sock_ioctl+0x10/0x10 [ 776.409963][ T4656] __se_sys_ioctl+0xfc/0x170 [ 776.409982][ T4656] do_syscall_64+0x14d/0xf80 [ 776.409997][ T4656] ? trace_irq_disable+0x3b/0x150 [ 776.410020][ T4656] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 776.410037][ T4656] ? clear_bhb_loop+0x40/0x90 [ 776.410061][ T4656] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 776.410078][ T4656] RIP: 0033:0x7f4f9359c799 [ 776.410093][ T4656] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 776.410108][ T4656] RSP: 002b:00007f4f94489028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 776.410126][ T4656] RAX: ffffffffffffffda RBX: 00007f4f93815fa0 RCX: 00007f4f9359c799 [ 776.410138][ T4656] RDX: 0000200000000000 RSI: 000000000000890b RDI: 0000000000000004 [ 776.410149][ T4656] RBP: 00007f4f93632c99 R08: 0000000000000000 R09: 0000000000000000 [ 776.410160][ T4656] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 776.410170][ T4656] R13: 00007f4f93816038 R14: 00007f4f93815fa0 R15: 00007ffd770471f8 [ 776.410188][ T4656] [ 777.922765][ T1167] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 777.931044][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 780.483120][ T9] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 781.122114][ T3696] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 781.130385][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 783.043398][ T1167] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 783.051603][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog