last executing test programs: 7.045530216s ago: executing program 3 (id=3178): unshare(0x60600) r0 = socket$unix(0x1, 0x2, 0x0) r1 = socket$unix(0x1, 0x3, 0x0) pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) write$cgroup_int(r3, &(0x7f0000000080), 0x12) write$cgroup_devices(r3, 0x0, 0x8) setsockopt$inet6_IPV6_HOPOPTS(r2, 0x29, 0x36, &(0x7f0000000200)=ANY=[@ANYBLOB="5c000000070502000707200000000006e706000200000000000000ee0d0000000000000800000000000000c91000000000000000000000ffffac1414aa010400"/80], 0x50) r4 = openat$cgroup_ro(r2, &(0x7f0000000000)='hugetlb.2MB.rsvd.usage_in_bytes\x00', 0x275a, 0x0) connect$unix(r1, &(0x7f0000000180)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) unshare(0x26000200) close(r0) openat$cgroup_procs(r4, &(0x7f0000000100)='cgroup.procs\x00', 0x2, 0x0) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='hugetlb.2MB.usage_in_bytes\x00', 0x275a, 0x0) write$cgroup_subtree(r5, &(0x7f0000000000)=ANY=[], 0x3261e) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000009, 0x12, r5, 0x0) shutdown(r5, 0x0) r6 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r6, 0x0) socket$nl_generic(0x10, 0x3, 0x10) 6.840171941s ago: executing program 3 (id=3182): socket$netlink(0x10, 0x3, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000005c0)={0x3, 0xc, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x41100}, 0x94) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000280)=ANY=[@ANYRES32, @ANYRES32, @ANYRESHEX=r0, @ANYRES32, @ANYBLOB, @ANYRES64=0x0], 0x20) socket$nl_xfrm(0x10, 0x3, 0x6) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) socket$inet6_icmp(0xa, 0x2, 0x3a) setsockopt$inet6_IPV6_RTHDR(r1, 0x29, 0x39, &(0x7f0000000080)=ANY=[@ANYBLOB="00020201"], 0x18) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="1b00"/11], 0x48) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000680)={0x1f, 0x0, 0x0, &(0x7f0000000340)='syzkaller\x00', 0x7, 0x0, 0x0, 0x41000, 0x67, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x1}, 0x94) sendmsg$nl_xfrm(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="3c010000190001000000000000000000e0000001000000000000000000000000fe8000000000000000000000000000aa4e220000000000000a00000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000000000000104000000000000feffffffffffffff030000000000000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000008400050020010000000000000000000000000000000000002b00000000000000000000000000000000000000000500000000000002000700000000000000000000000000e00000020000000000000000000000004000000033"], 0x13c}, 0x1, 0x0, 0x0, 0x20048000}, 0x20040880) r3 = syz_init_net_socket$nfc_llcp(0x27, 0x3, 0x1) bind$nfc_llcp(r3, &(0x7f0000000100)={0x27, 0x0, 0xffffffff, 0x7, 0x0, 0x6, "750538d1ee602ec4802a04ea7cdcd151bb2cd9893bc31f80718336d9bd3517076db9ad1f6a120d8be6d7f81cd81ec275000386e7d95f0669b740a5418d69d0", 0x10000000000001}, 0x60) getsockname(r3, 0x0, &(0x7f0000000080)) r4 = socket$kcm(0x10, 0x2, 0x0) r5 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r5, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r5, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)}, &(0x7f0000000180)=0x10) r7 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r7, 0x84, 0xd, &(0x7f0000000000)=@assoc_value, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r5, 0x84, 0x85, &(0x7f0000000000)={r6, @in={{0x2, 0x4e21, @empty}}, 0x0, 0xfffe}, 0x90) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x0, 0x110, 0xffffffffffffffff, 0x0) r8 = bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x3, 0x8, &(0x7f00000012c0)=ANY=[@ANYRESHEX=r1], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x15}, 0x94) bpf$BPF_PROG_DETACH(0x1c, &(0x7f0000000900)=ANY=[@ANYRES32=r8, @ANYRES32=r8, @ANYBLOB='/\x00'/12, @ANYRES32=r1, @ANYBLOB="deb3af21db8f556e326ac2dde24c350bc3ae962be84cdd948af293aa2dad00cc8c09605e71e87579b288ab23a6198fa4623f1beea18a2c7dea19067a17df9d737f62fb0977bdfcfdc4f2f270304aee8f47062a77767cd9edbea3577e7722d30fd3f8bda7d755f5", @ANYRES64=0x0], 0x20) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000240)={@fallback=r8, 0x2f, 0x0, 0x0, &(0x7f0000000140)=[0x0], 0x1, 0x0, 0x0, 0x0, &(0x7f0000003680)}, 0x40) sendmsg$inet(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f00000001c0)="1800000072006bcd9e3fe3de6e080000070900000d000000", 0x18}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x20000000) sendmsg$nl_route(r9, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000a80)=ANY=[@ANYBLOB="3800ca494ed6000000009f0160052250681f04d6b0457776488f1296688108ca0568fb1f5dc8b0b2d58aafc4f6bc964a4e27cffde928badacf3887c797cdab6f5cd0544026bf34bb6ebd4e351159f3a4fe802db3572645e60092e6732e6a89641b4014bd908fae612e8698aa06a61c", @ANYRES16=r9, @ANYBLOB="0000000000000000180012800b00010069703667726500000800028004001200", @ANYRESHEX=r6], 0x38}, 0x1, 0x0, 0x0, 0x40000}, 0x20040044) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000580)=ANY=[@ANYBLOB="5801000040000701feffffff00000000017c0000040042800c00018006000600800a0000340102802e011480080007"], 0x158}, 0x1, 0x0, 0x0, 0x48815}, 0xc000) sendmmsg$inet6(r1, &(0x7f0000000140)=[{{&(0x7f0000000200)={0xa, 0x4e20, 0x4db, @local, 0x3}, 0x1c, &(0x7f0000000240)=[{&(0x7f0000000400)="fc", 0x1}], 0x1}}], 0x1, 0x4c040) 6.580742198s ago: executing program 3 (id=3184): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) bind$xdp(0xffffffffffffffff, &(0x7f0000000100)={0x2c, 0x2}, 0x10) sendmsg$NFT_BATCH(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="140000001000040000000000000000000000000a20000000000a01020000000000000000010000000900010073797a300000000058000000160a01000000000000000000010000000900010073797a30000000000900020073797a30000000002c0003800800014000000000080002400000000010000380140001007465616d3000000000000000000000005c000000160a0101000b000000000000010000000900020073797a30000000000900010073797a3000000000300003802c00038014"], 0xfc}}, 0x0) write$tun(r0, &(0x7f00000004c0)={@val, @void, @eth={@broadcast, @multicast, @val={@val={0x88a8, 0x5, 0x1, 0x4}, {0x8100, 0x6, 0x0, 0x6}}, {@ipv4={0x800, @generic={{0x5, 0x4, 0x1, 0x6, 0x1c, 0xe4, 0x0, 0x8, 0x11, 0x0, @dev={0xac, 0x14, 0x14, 0x29}, @loopback}, "3eda35701bfb0bc2"}}}}}, 0x36) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) (async) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) (async) socket$kcm(0x2, 0xa, 0x2) (async) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}) (async) socket$nl_netfilter(0x10, 0x3, 0xc) (async) bind$xdp(0xffffffffffffffff, &(0x7f0000000100)={0x2c, 0x2}, 0x10) (async) sendmsg$NFT_BATCH(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="140000001000040000000000000000000000000a20000000000a01020000000000000000010000000900010073797a300000000058000000160a01000000000000000000010000000900010073797a30000000000900020073797a30000000002c0003800800014000000000080002400000000010000380140001007465616d3000000000000000000000005c000000160a0101000b000000000000010000000900020073797a30000000000900010073797a3000000000300003802c00038014"], 0xfc}}, 0x0) (async) write$tun(r0, &(0x7f00000004c0)={@val, @void, @eth={@broadcast, @multicast, @val={@val={0x88a8, 0x5, 0x1, 0x4}, {0x8100, 0x6, 0x0, 0x6}}, {@ipv4={0x800, @generic={{0x5, 0x4, 0x1, 0x6, 0x1c, 0xe4, 0x0, 0x8, 0x11, 0x0, @dev={0xac, 0x14, 0x14, 0x29}, @loopback}, "3eda35701bfb0bc2"}}}}}, 0x36) (async) 6.255738685s ago: executing program 1 (id=3189): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000004c0)={0x26, 'hash\x00', 0x0, 0x0, 'cmac(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f0000000040)=[{0xff8d, 0x0, &(0x7f0000000940)=[{&(0x7f0000000000)="f7", 0x1}, {&(0x7f0000000140)="ebe3a0e9", 0x4}], 0x2}], 0x1, 0x40800) r2 = socket$inet6(0xa, 0x80002, 0x0) setsockopt$inet6_mreq(r2, 0x29, 0x1c, 0x0, 0x41) mmap(&(0x7f0000002000/0x2000)=nil, 0x2000, 0x8, 0x32, 0xffffffffffffffff, 0x0) r3 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x25) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000003c0)={0x18, 0x19, &(0x7f00000005c0)=ANY=[@ANYBLOB="180000008b000000000000000100000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7020000140000c4cf030000000000008500000086000000bf0900000000000055090100000000009500000000000000ad0a060000000000b500f4ff010000001801000020646c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000010000008500000006000000bf91000000000000b702000003000000850000002a000000b70000000000000095"], &(0x7f0000000080)='GPL\x00', 0x6, 0x1001, &(0x7f0000001cc0)=""/4097, 0x41100, 0x24}, 0x94) r4 = socket$inet_icmp_raw(0x2, 0x3, 0x1) getsockname$packet(r1, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000100)=0x14) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) bind$netlink(r6, &(0x7f00000016c0)={0x10, 0x0, 0x25dfdbfb, 0x40000044}, 0xc) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r7, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r7, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000700)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSET={0x168, 0x9, 0xa, 0x401, 0x0, 0x0, {0x0, 0x0, 0x4}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0xfffffffc}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x2}, @NFTA_SET_DESC={0x11c, 0x9, 0x0, 0x1, [@NFTA_SET_DESC_CONCAT={0x108, 0x2, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x7}]}, {0x14, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x7}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x5}]}, {0x1c, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x9b3}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x8001}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x80}]}, {0x14, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x4}, @NFTA_SET_FIELD_LEN={0x8}]}, {0x54, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x80}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x1}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x6}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0xb}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0xc43}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x8}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x4}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x8d}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0xfff}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x3}]}, {0x2c, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x10}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0xfffffffa}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x3ff}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x8000}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x7f}]}, {0xc, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x5633}]}, {0xc, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x2}]}, {0x1c, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x7}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0xfffffffb}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0xffff}]}]}, @NFTA_SET_DESC_SIZE={0x8, 0x1, 0x1, 0x0, 0x4000000}, @NFTA_SET_DESC_SIZE={0x8, 0x1, 0x1, 0x0, 0x4}]}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x11c}, @NFTA_SET_DATA_TYPE={0x8, 0x6, 0x1, 0x0, 0xffffff00}, @NFTA_SET_DESC={0xc, 0x9, 0x0, 0x1, [@NFTA_SET_DESC_SIZE={0x8, 0x1, 0x1, 0x0, 0x4}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x7}}}, 0x190}, 0x1, 0x0, 0x0, 0x24000850}, 0x0) setsockopt$inet_pktinfo(r4, 0x0, 0x8, &(0x7f00000000c0)={r5, @dev={0xac, 0x14, 0x14, 0x26}, @rand_addr=0x64010100}, 0xc) 6.005996493s ago: executing program 1 (id=3191): r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x22, &(0x7f0000000040)=0x1, 0x4) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=0x6, 0xfda2) unshare(0x62040200) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wlan0\x00'}) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_TRIGGER_SCAN(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000}, 0x4000000) r1 = socket$nl_sock_diag(0x10, 0x3, 0x4) sendmsg$TCPDIAG_GETSOCK(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB="4c0000001200010003950000000000000a0900004001"], 0x4c}, 0x1, 0x0, 0x0, 0x24008040}, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0xfffff000) r2 = socket(0x840000000002, 0x3, 0x100) connect$inet(r2, &(0x7f0000000000)={0x2, 0x4e24, @remote}, 0x61) sendmmsg$inet(r2, &(0x7f0000005240), 0x4000095, 0x0) setsockopt$inet_int(r2, 0x0, 0x32, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x84, 0x7b, 0x0, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) r4 = socket$alg(0x26, 0x5, 0x0) bind$alg(r4, &(0x7f0000000600)={0x26, 'rng\x00', 0x0, 0x0, 'jitterentropy_rng\x00'}, 0x58) setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, 0x0, 0x0) sendmsg$NFNL_MSG_ACCT_GET(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000007c0)={&(0x7f0000000840)=ANY=[@ANYBLOB="2000000021ffffffff0000e438000000010000060c0102400000000000000101"], 0x20}, 0x1, 0x0, 0x0, 0xa053}, 0x20800) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) r6 = openat$cgroup_devices(0xffffffffffffffff, &(0x7f0000000100)='devices.allow\x00', 0x2, 0x0) write$cgroup_devices(r6, &(0x7f00000001c0)=ANY=[@ANYBLOB="b0ba95375be82d39e03e5d2d13ee31a77b9fead9283950c7eb6184f7a306ed96b73b508a1b2dc9b76e82def4b7cbbca353bd491c091f7f601a164a5785c7fb"], 0x9) sendmsg$IPSET_CMD_CREATE(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000600)=ANY=[], 0x5c}}, 0x0) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) r8 = bpf$ITER_CREATE(0x21, &(0x7f0000000040), 0x8) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$TUNATTACHFILTER(r8, 0x401054d5, &(0x7f0000000040)={0x0, &(0x7f0000000280)}) sendmsg$IPSET_CMD_ADD(r7, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000440)=ANY=[], 0x44}, 0x1, 0x0, 0x0, 0x8040}, 0x404c8c5) 5.641453915s ago: executing program 3 (id=3192): r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000580)=@mangle={'mangle\x00', 0x1f, 0x6, 0x570, 0x0, 0x2d8, 0xd0, 0x2d8, 0x1c0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x4a0, 0x6, &(0x7f00000004c0), {[{{@ipv6={@mcast2, @private2={0xfc, 0x2, '\x00', 0x1}, [0xff000000, 0xffffffff, 0xffffff00], [0xff, 0xffffff00, 0xffffffff, 0xffffff00], 'macvlan1\x00', 'macvlan0\x00', {}, {}, 0x84, 0x2b, 0x4, 0x38}, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@local, @local, [0x0, 0xffffffff, 0xffffffff, 0xffffff00], [0xff000000, 0xff, 0xffffff00], 'wg2\x00', 'veth0_macvtap\x00', {0xff}, {0xff}, 0xe2, 0xfa, 0x1, 0x28}, 0x0, 0xa8, 0xf0}, @SNPT={0x48, 'SNPT\x00', 0x0, {@ipv6=@private2={0xfc, 0x2, '\x00', 0x1}, @ipv4=@remote, 0x39, 0x3e, 0x5}}}, {{@uncond, 0x0, 0xd0, 0x118, 0x0, {}, [@common=@ipv6header={{0x28}, {0x10, 0x20}}]}, @common=@unspec=@IDLETIMER={0x48, 'IDLETIMER\x00', 0x0, {0x7, 'syz0\x00', {0x3}}}}, {{@ipv6={@remote, @dev={0xfe, 0x80, '\x00', 0xc}, [0xff0000ff], [0x0, 0xff, 0xff000000], 'geneve0\x00', 'veth1_to_team\x00', {}, {}, 0x33, 0x40, 0x4, 0x20}, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@ipv4={'\x00', '\xff\xff', @broadcast}, @mcast1, [0xff, 0xffffffff, 0x0, 0xffffff00], [0xffffff00, 0xffffff00, 0xffffff00], 'wg2\x00', 'team_slave_1\x00', {0xff}, {}, 0x2c, 0x7f, 0x0, 0x39}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}, {0x8}}]}, @inet=@TOS={0x28, 'TOS\x00', 0x0, {0x7, 0x7f}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5d0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x8, &(0x7f00000026c0)=ANY=[@ANYBLOB="620af8ff0c200021bfa100000000000007010000f8ffffffb702000003000000bd1200000000000085000000d0000000b70000000000000095000000000000003fba6a7d36d9b18ed812a2e2c49e8020a6f4e0e4a9446ca2b5f1cc1a100a9af698393aa0f3881f9c24aa56f15199fad0093c59d66b5ece9f36c70d0f010c5077da80fb982c1e9400c603146cea484a415b76966118b64f751a0f241b072e90080008002d75593a280000c93e64c227c95aa0b784625704f07a72c2918451ebdcf4cef7f9606056fe5c34665c0af9360a1f7a5e6b607130c89f18c0c1089d8b85880000c29c48b45ef4adf634be763288d01aa27ae8b09e13e79ab20b0b8ed8fb7a68af2ad0000000000000006f803c6468082089b302d7bff8f06f7f918d65eae391cb41336023cdcedb5e0125ebbccbddcf10cb2364149215108355ee570f8078be5cab389cd65e7133719acd97cfa107d40224edc5465a932b77e74e712a0d42bc6099ad23000000803a90bce6dc3a13871765df961c2ed3b1006ef6c1ff0900000000000010c63a949e8b7955394ffa82b8e942c89112f40cab87b1586602d985430cea0162ab3fcf4591c926abfb076719237c8d0e60b0eea24492a660583eecdbf5bcd3de3a83209da17a0faf60fd6ad9b97aa5fa68480366c9c6fd6fa5043aa3926b81e3b59c9f081d6a08000000ea2b1a52496dfcaf99431412fd13f4cec49669e443dcb924cfe5f3185418d60532be9c4d2ec7c32f2095e63c8cdc28f74d043ef8dba2f23b01a9ae44cf945b7632f32030916f89c6dad7603f2ba2a790d62d6faec2fed44da4928b30142bdda5e6c5d50b83bae616b5054d1e7c13b1355d6f4a8245eaa4997da9c77af40000000000000005f58351d599e9b61e8caab9c70764b0a8a7583c90b3433b809bdb9fbd48bc873495cbff8a41326eea31ae4e0f75057df3c9d13330ca006bce1a84521f14518c9b476fccbd6c712016219848624b87cec2dbe98223a0eb4fa39f6b5c02e6d6d90756ff57902a8f57010000009700ce0b4b8bc22941330000000000000000000300000000000000000000000010008bc0d955f2a83366b99711e6e8861c46495ba585a4b2d02edc3e28dd279a896249ed85b9806f0b6c4a000000002b43dcacc413b48dafb7a2c8cb482bac0ac502d9ba96ffffff7f00000000df73be83bb7d5ad883ef07000000000000006da21b40216e14ba2d6af8656bfff17addaedab25b30002abbba7fa725f38400be7c1f001b2cd317902f19e385be9e48dccff72943327d830689da6b53ffffffff631c7771429d1200000033ed846197fcff5e1c7c3d1d6e3a52872baef9753fffffffffffffe09fec2271fe010cd7bb2366fde4a59429738fcc917a57f94f6c453cea623cc5ee0c2a5ff870ce5dfd3467decb05cfd9fcd41df54cdbd9d10a64c108285e71b5565b1768ee58969c41595229df17bcad70fb4021428ce978275d5bc8955778567bc79e13b78249788f11f708008b75d4fe32b561d46ea3abe0fa4d30dc94ef241875f3b4b6ab7929a57affe7d7fa29822aea68a660e717a04becff0f719107000000000000002d7e927123d8ecbbc55bf404571be54c72d978cf2804107f0238abccd32368e57040906df0042e19000000000000002c06f815312e086dd022c074eb8a322fb0bf47c0a8d154b405a07feaf3dd95f6ef44cd1fe582786105c7df8be4877084d4173731efe895efc71f665c4d75cf2458e35d2c9062ece84c99e061887a20639b41c8c12ee86c50804042b3eac1f879b136345cf67ca3fb2b5e518a75f9e7d7101d5e186c489b3a06fb99e0aa7f23a054de2f4d92d6bd72ee2c9fdc75aaaf1e3e483b4ad055e4af403269b4a39ce40293947d9a631bcbf3583784acbda216550d7aec6b79e30cbd128f54c2d3335457ac0eaaa99bf0bdc14ae358c3b377327ac9ecc34f24c9ae153ec60ac0694da85bff9f5f4df9b3fdf242b985bf16b99c9cc0ad1857036f1a985f369191ae954febb3df464bfe0f773ee9afe72f32a2befb89d3777399f5874c553a2ebe9061fe86e669642e09c0e5a3bb6d163118e4cbe024fd452277c3887d6116c6cc9d8046c216c1f8a9778cb26e22a2a998de5eaeadea10d3cfb41b92ecbb422a40da8daccf080842a486721737390cbf3a74cb2003efb9a101b51ab63e9600040000b8a8c9ae3d14f93100c2e0893862eef552fcde2981f48c482bde6e4a4304e50c349f4f9ecee27defd83871c5191e10096e7e60fc3541a2c905a1a95e9571bf38aebd15172f94e3245c582909e2a3bce109b6000000000000000000d6d5210d7560eb92d6a97a27602b81f7636df1535bef1497f90100000000000000abf9010000007740890200d627e87306703be8672dc84eeadba6a41891c170d1ab57075228a9f46ed9bd1f08fb8191bbab2dc51de3a61f0868afc4294859323e7a45319f18101288a0268893373750d10a3fc22dd704e4214de5946912d6c98cd1a9fbe1e7ef8c08acaf30235b920500d2eca55f74a23641f61f2d5b308cf0d031b0c7f0ced69b93e9960ff5f74562adae283d9756237badf4e7965bbe2777e808fcba821aa8e8c5c39609ff85000000000000c1fee30a3f7a85d1b29e58c77685efc0ceb1c8e5729c66018d169fc03aa188546b3ad2a182068e1e3a0e2505bc7f41019645466a31c72ad53bc19faa5401120000793ac48c1b539c75ab40743b00020000a1f68df75cf43f8ecc8d3726602111b40e761fd210a1920382f14d12ca3c3431ee97471c781d0d1280fb00818654a53b6df4b2c97cc1c98d85fda8f80fe908b65550b4412331d73062197655b7f0469250a5989cef0e10773920ed3ccee42d2c3eb80159da5c002511e6eb93842054cfce2ac306cb6e472db3fd67a49b6855a694a8d359add43907003223a47a7fae4f3748d5a432825bc40a03aaef1c8488d86dc211dd2a3ba71e0f45492ef1f8b65ccb3dcd251a61b152d02c29ca0a3328fa7753a5cddea1acaae55ae8263fb284b7a6ab2a8826c1b948207c498cf4824ab1ea3225a53072423b907c6682f8999e0311da5b8378bc841e1787e3a8128dda381a26cb2b365702ff8a27831375b2ddaa2f56e21169f7ca4fd9655ccd4a584acd244e965a0afedaff7c415ff682a4044b3381cc2df28278c9a6824c52048a7cfabda294925cc0956bffa8e950ff5e49f41ae600d830207bf728cd9807933c3c16d80bbea611a18becc2dc38ca0a6f5740f340b76edcd100fcffff007231dcef58c7b88b5aeedaf9626cb51ce1737c10ab37d4f98a934b0f900e0eb639878a1200629f5503cf679154d27681d7a3744cbcd42af59407c9c8e39c5271868917954e604352ba26171d004f1cb2976fab3fa19c7d3ef9678bff79f5155524f061378f94fb453786c3a6f78b10d383b49e31d1568bd43ee34ce6e6be235aa6207285665c2fba773671da41959f51610963b48930658e2d6125a26085001345b0473240b7e5e91811312c43663e76f711c6529ecdec75c7ea1cf0f8f8fff40247d59bbde2ebb8659197e0f37a71be1b12a182ed7de3acba28561a04b807f7a4647e2ea6d8fb92541d07c3d5e4ba077d3cad9f8ba1919592014c00c8eccb2ca5d48ba7b1c3fb185a4bb79700cf51f818b0c701c8de47d12281a67bdaf4b0c50bee9e8f5936250df2e15c1172e7ea6619f7db330700d1e9e42a035e6fd532f61fbfed9c4a7124a1e38eee50a6bbcd1d4e3f68c3f27dd9a70f1a7c6046237ddfb0b26e197322226367d998010458cd4df10af249ce717f6f45e5176e0ddae3054d7289d4e13ab0912703ee39ce264572b89194fdf7acecc35cf8309d4b680a08eed367dad855fce210f1a7c7222dd360eafb4bef7d58bf83362930af6e3f3f851abdc0003bdf9401b533019e90feb069189100007a82df8d9b5f44ebf9355e7b1b01c9470608d4f306d21004730396a4d6c6d46e1ffac97aa93c36123532a36186575266be4981c847160079421d0137801e553069f8d025c40f287378810defc7f2ed4e15f6af17b21153394f8bcfa6a23a77c8d61c9bbc127a57b8d631f36558d9093dee08bc53d97a8003363421738650a22c8fd87b13026799caf58e59951b125e7f161ca34e2c0dd65a23d01a3cb191e743de07247c7f993cf01166fa2ac1ba02f60550e63a7f50422e478c6b5d87f9bd0567a279a9d85a380db25c43bd0529ad783b9d64aaac1b793afb44b7126e17d2b7c0d6be650de7eeef3f3605af344015d03c3e7819145cb9fe1978c98bf9cf10773db59505ae33708c728844c872dfd2cb0b29008000000000000005ca18cb72f0944d0e4fea0a0abd0285bdaf1b000000c089d640c2facb0d1e6243873ac4b1e1068c45c715b68effb7d58d1f9e726dbf6bd910ca4ce0e075658ede42192cf393a50dcc197b03402fed75083628e5dd38213d353b9049e71f037064b05e73ec00c710f1ffc5737d397d555d1cf8859cc030ea8dc3c6a5b3b6fa1c81707479db1833d593a271253aa11efd936b74784f2fc286814848e92d8ee541bc179813297a0a4cc3c8f80c28701185bea091f32475e859479b734727afc110e1abcff460172fd1b42e3c0e2a4bf94a060069000010000087c7572a1e7596f89e5c3d5e70640c90815f77b7b13d0000000085a1e1e84900000000000000000000000000b422fc160a458ee5a91a2471e6e56fdabec6c73ce8983fc68f0b7cdcdde632e6f54a07620e8aa116ce9e84fc3cd5e8288a333dcebb233da9186796995ba69487d8f77d2f8800f02d690fc70a08b231cad1bdcf3740a95d4dd1cfe0f417f275493cf33b19ffff93dfdaf7eb00b8ad87cdf7c21bab5af8e2bac54ee5597e6508c1158124a538c36f9bb11fea7d8b8c7e954b1bc7811654a6636b33f271d0923e9ecd1b724b8feffadfc23c07000000f0785fb722f346d6a5dffe1884d4d0cd8f00000092c85ed44db68ab800001f00000000406e6ed9b219ad07125381087298e75965d1cc5932ddf9e66351b9332a34bee3e3d562c914c629933f0b8724cf680889ade72558d191d9890c69a718f9018586c5131c8dc8e0379bafda1a0fd2997ff115215ce23dca8db7236c1554cdaaadcce2f31834c1bd1908d8e1b361034db56be76acb7654a195bc3e98df3a5dffd5b0783883ef7da3433110e37f7c7cb7f3800de7f99abf910d6949e062747a9c87dcfcc716d6a9c0ec53b9cffe3cfd1df69a76f373d7f997edb9b80bdea1a99c2a6fbb25e035deadaadd7917ebfedd6304a19491769476208684e343f86b4d55a7dbbb07283cb1e35a138d24ebc5b4f8e35a82d3a7f84cb1e02a5a92b53567088be0b1ca023ccd518c0e0715b1c8760801a419ebd2e26440ff7493019bdb655cc88d72d6d7b6bca5a2e19b63ec52fce43d8c53a8031e64026e0d36b6401064c49a729f11ab377f7132c5232bb80195dd5d43d29646a9378eea0761b7ed9d2172e33ed87c7413c843b180cc00000000006bedf2ed716ca43a941119b96d82b26d9061de240d85ec2cfa462bd52104489bb7a7548d7cc53627031e909c69cb824233975a1ea645de63522407c3a240a37e946f30ebf075ea97846a0a8d2286f3f446b1b99ab83a12ddf8a1c06294eadc3eb3e339591afd5c00000000000000000000000000000000000000000000000000579dad8347a3d16976bb7483840b32db0158fb6c809349333325a7866ca5d3133e33ef1a183cefdb65a79fa71800988c8445029e024822dbcfcab49c3a0aec9bd43e6e14078b260700d849a2aa14c9b593f6dcb1de334c065ecfd65031606e55949c185bcda9fde4f9b46a76b8a24bbcd31b22373eb0473248150cd179405ee1af1183b0c0ce3483dc1d9bf732b0751b78fb211d6706b55960c6431afbc02b3c7e08086573939290bb9e590a3875f02a828b07f1dc7df9c8e5da22dfb9dacbf5529e4e994128d835f85465173ea7bbcc519a0c9798ce8b1b07567e3e07169c8c3e4da8bf725c050000000000000000000000000000000000000000004775abdf0c62728eb55a9e2849a1ce05bed60dfe4cc9fa43f9684297c02382c0a35829be7a86305792a9d2e80ca9e8fc50f31f6e0fa810303da03d8b74b42c1ebaf16bb343256405a3a07229a54de09a97b269cd29e8b2f0b0d46c51a6a93eec37f4bc6e29a8e19120ae050ab682662e9b2cc3263a4aba62b63ca9123a53c0f4bf3c4463b8144c89bf058a0af0ae9fc2b7cdfc4817703e267cddc193637d7fd97646090da37093657643daae3840c7f5c10f93524f7ae4791ec6e9d9722e5f670ccb358e051a"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x5a}, 0x48) bpf$BPF_PROG_DETACH(0x1c, &(0x7f0000000000)={@fallback=r1, r1, 0x2f}, 0x20) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x8, &(0x7f00000026c0)=ANY=[@ANYBLOB="620af8ff0c200021bfa100000000000007010000f8ffffffb702000003000000bd1200000000000085000000d0000000b70000000000000095000000000000003fba6a7d36d9b18ed812a2e2c49e8020a6f4e0e4a9446ca2b5f1cc1a100a9af698393aa0f3881f9c24aa56f15199fad0093c59d66b5ece9f36c70d0f010c5077da80fb982c1e9400c603146cea484a415b76966118b64f751a0f241b072e90080008002d75593a280000c93e64c227c95aa0b784625704f07a72c2918451ebdcf4cef7f9606056fe5c34665c0af9360a1f7a5e6b607130c89f18c0c1089d8b85880000c29c48b45ef4adf634be763288d01aa27ae8b09e13e79ab20b0b8ed8fb7a68af2ad0000000000000006f803c6468082089b302d7bff8f06f7f918d65eae391cb41336023cdcedb5e0125ebbccbddcf10cb2364149215108355ee570f8078be5cab389cd65e7133719acd97cfa107d40224edc5465a932b77e74e712a0d42bc6099ad23000000803a90bce6dc3a13871765df961c2ed3b1006ef6c1ff0900000000000010c63a949e8b7955394ffa82b8e942c89112f40cab87b1586602d985430cea0162ab3fcf4591c926abfb076719237c8d0e60b0eea24492a660583eecdbf5bcd3de3a83209da17a0faf60fd6ad9b97aa5fa68480366c9c6fd6fa5043aa3926b81e3b59c9f081d6a08000000ea2b1a52496dfcaf99431412fd13f4cec49669e443dcb924cfe5f3185418d60532be9c4d2ec7c32f2095e63c8cdc28f74d043ef8dba2f23b01a9ae44cf945b7632f32030916f89c6dad7603f2ba2a790d62d6faec2fed44da4928b30142bdda5e6c5d50b83bae616b5054d1e7c13b1355d6f4a8245eaa4997da9c77af40000000000000005f58351d599e9b61e8caab9c70764b0a8a7583c90b3433b809bdb9fbd48bc873495cbff8a41326eea31ae4e0f75057df3c9d13330ca006bce1a84521f14518c9b476fccbd6c712016219848624b87cec2dbe98223a0eb4fa39f6b5c02e6d6d90756ff57902a8f57010000009700ce0b4b8bc22941330000000000000000000300000000000000000000000010008bc0d955f2a83366b99711e6e8861c46495ba585a4b2d02edc3e28dd279a896249ed85b9806f0b6c4a000000002b43dcacc413b48dafb7a2c8cb482bac0ac502d9ba96ffffff7f00000000df73be83bb7d5ad883ef07000000000000006da21b40216e14ba2d6af8656bfff17addaedab25b30002abbba7fa725f38400be7c1f001b2cd317902f19e385be9e48dccff72943327d830689da6b53ffffffff631c7771429d1200000033ed846197fcff5e1c7c3d1d6e3a52872baef9753fffffffffffffe09fec2271fe010cd7bb2366fde4a59429738fcc917a57f94f6c453cea623cc5ee0c2a5ff870ce5dfd3467decb05cfd9fcd41df54cdbd9d10a64c108285e71b5565b1768ee58969c41595229df17bcad70fb4021428ce978275d5bc8955778567bc79e13b78249788f11f708008b75d4fe32b561d46ea3abe0fa4d30dc94ef241875f3b4b6ab7929a57affe7d7fa29822aea68a660e717a04becff0f719107000000000000002d7e927123d8ecbbc55bf404571be54c72d978cf2804107f0238abccd32368e57040906df0042e19000000000000002c06f815312e086dd022c074eb8a322fb0bf47c0a8d154b405a07feaf3dd95f6ef44cd1fe582786105c7df8be4877084d4173731efe895efc71f665c4d75cf2458e35d2c9062ece84c99e061887a20639b41c8c12ee86c50804042b3eac1f879b136345cf67ca3fb2b5e518a75f9e7d7101d5e186c489b3a06fb99e0aa7f23a054de2f4d92d6bd72ee2c9fdc75aaaf1e3e483b4ad055e4af403269b4a39ce40293947d9a631bcbf3583784acbda216550d7aec6b79e30cbd128f54c2d3335457ac0eaaa99bf0bdc14ae358c3b377327ac9ecc34f24c9ae153ec60ac0694da85bff9f5f4df9b3fdf242b985bf16b99c9cc0ad1857036f1a985f369191ae954febb3df464bfe0f773ee9afe72f32a2befb89d3777399f5874c553a2ebe9061fe86e669642e09c0e5a3bb6d163118e4cbe024fd452277c3887d6116c6cc9d8046c216c1f8a9778cb26e22a2a998de5eaeadea10d3cfb41b92ecbb422a40da8daccf080842a486721737390cbf3a74cb2003efb9a101b51ab63e9600040000b8a8c9ae3d14f93100c2e0893862eef552fcde2981f48c482bde6e4a4304e50c349f4f9ecee27defd83871c5191e10096e7e60fc3541a2c905a1a95e9571bf38aebd15172f94e3245c582909e2a3bce109b6000000000000000000d6d5210d7560eb92d6a97a27602b81f7636df1535bef1497f90100000000000000abf9010000007740890200d627e87306703be8672dc84eeadba6a41891c170d1ab57075228a9f46ed9bd1f08fb8191bbab2dc51de3a61f0868afc4294859323e7a45319f18101288a0268893373750d10a3fc22dd704e4214de5946912d6c98cd1a9fbe1e7ef8c08acaf30235b920500d2eca55f74a23641f61f2d5b308cf0d031b0c7f0ced69b93e9960ff5f74562adae283d9756237badf4e7965bbe2777e808fcba821aa8e8c5c39609ff85000000000000c1fee30a3f7a85d1b29e58c77685efc0ceb1c8e5729c66018d169fc03aa188546b3ad2a182068e1e3a0e2505bc7f41019645466a31c72ad53bc19faa5401120000793ac48c1b539c75ab40743b00020000a1f68df75cf43f8ecc8d3726602111b40e761fd210a1920382f14d12ca3c3431ee97471c781d0d1280fb00818654a53b6df4b2c97cc1c98d85fda8f80fe908b65550b4412331d73062197655b7f0469250a5989cef0e10773920ed3ccee42d2c3eb80159da5c002511e6eb93842054cfce2ac306cb6e472db3fd67a49b6855a694a8d359add43907003223a47a7fae4f3748d5a432825bc40a03aaef1c8488d86dc211dd2a3ba71e0f45492ef1f8b65ccb3dcd251a61b152d02c29ca0a3328fa7753a5cddea1acaae55ae8263fb284b7a6ab2a8826c1b948207c498cf4824ab1ea3225a53072423b907c6682f8999e0311da5b8378bc841e1787e3a8128dda381a26cb2b365702ff8a27831375b2ddaa2f56e21169f7ca4fd9655ccd4a584acd244e965a0afedaff7c415ff682a4044b3381cc2df28278c9a6824c52048a7cfabda294925cc0956bffa8e950ff5e49f41ae600d830207bf728cd9807933c3c16d80bbea611a18becc2dc38ca0a6f5740f340b76edcd100fcffff007231dcef58c7b88b5aeedaf9626cb51ce1737c10ab37d4f98a934b0f900e0eb639878a1200629f5503cf679154d27681d7a3744cbcd42af59407c9c8e39c5271868917954e604352ba26171d004f1cb2976fab3fa19c7d3ef9678bff79f5155524f061378f94fb453786c3a6f78b10d383b49e31d1568bd43ee34ce6e6be235aa6207285665c2fba773671da41959f51610963b48930658e2d6125a26085001345b0473240b7e5e91811312c43663e76f711c6529ecdec75c7ea1cf0f8f8fff40247d59bbde2ebb8659197e0f37a71be1b12a182ed7de3acba28561a04b807f7a4647e2ea6d8fb92541d07c3d5e4ba077d3cad9f8ba1919592014c00c8eccb2ca5d48ba7b1c3fb185a4bb79700cf51f818b0c701c8de47d12281a67bdaf4b0c50bee9e8f5936250df2e15c1172e7ea6619f7db330700d1e9e42a035e6fd532f61fbfed9c4a7124a1e38eee50a6bbcd1d4e3f68c3f27dd9a70f1a7c6046237ddfb0b26e197322226367d998010458cd4df10af249ce717f6f45e5176e0ddae3054d7289d4e13ab0912703ee39ce264572b89194fdf7acecc35cf8309d4b680a08eed367dad855fce210f1a7c7222dd360eafb4bef7d58bf83362930af6e3f3f851abdc0003bdf9401b533019e90feb069189100007a82df8d9b5f44ebf9355e7b1b01c9470608d4f306d21004730396a4d6c6d46e1ffac97aa93c36123532a36186575266be4981c847160079421d0137801e553069f8d025c40f287378810defc7f2ed4e15f6af17b21153394f8bcfa6a23a77c8d61c9bbc127a57b8d631f36558d9093dee08bc53d97a8003363421738650a22c8fd87b13026799caf58e59951b125e7f161ca34e2c0dd65a23d01a3cb191e743de07247c7f993cf01166fa2ac1ba02f60550e63a7f50422e478c6b5d87f9bd0567a279a9d85a380db25c43bd0529ad783b9d64aaac1b793afb44b7126e17d2b7c0d6be650de7eeef3f3605af344015d03c3e7819145cb9fe1978c98bf9cf10773db59505ae33708c728844c872dfd2cb0b29008000000000000005ca18cb72f0944d0e4fea0a0abd0285bdaf1b000000c089d640c2facb0d1e6243873ac4b1e1068c45c715b68effb7d58d1f9e726dbf6bd910ca4ce0e075658ede42192cf393a50dcc197b03402fed75083628e5dd38213d353b9049e71f037064b05e73ec00c710f1ffc5737d397d555d1cf8859cc030ea8dc3c6a5b3b6fa1c81707479db1833d593a271253aa11efd936b74784f2fc286814848e92d8ee541bc179813297a0a4cc3c8f80c28701185bea091f32475e859479b734727afc110e1abcff460172fd1b42e3c0e2a4bf94a060069000010000087c7572a1e7596f89e5c3d5e70640c90815f77b7b13d0000000085a1e1e84900000000000000000000000000b422fc160a458ee5a91a2471e6e56fdabec6c73ce8983fc68f0b7cdcdde632e6f54a07620e8aa116ce9e84fc3cd5e8288a333dcebb233da9186796995ba69487d8f77d2f8800f02d690fc70a08b231cad1bdcf3740a95d4dd1cfe0f417f275493cf33b19ffff93dfdaf7eb00b8ad87cdf7c21bab5af8e2bac54ee5597e6508c1158124a538c36f9bb11fea7d8b8c7e954b1bc7811654a6636b33f271d0923e9ecd1b724b8feffadfc23c07000000f0785fb722f346d6a5dffe1884d4d0cd8f00000092c85ed44db68ab800001f00000000406e6ed9b219ad07125381087298e75965d1cc5932ddf9e66351b9332a34bee3e3d562c914c629933f0b8724cf680889ade72558d191d9890c69a718f9018586c5131c8dc8e0379bafda1a0fd2997ff115215ce23dca8db7236c1554cdaaadcce2f31834c1bd1908d8e1b361034db56be76acb7654a195bc3e98df3a5dffd5b0783883ef7da3433110e37f7c7cb7f3800de7f99abf910d6949e062747a9c87dcfcc716d6a9c0ec53b9cffe3cfd1df69a76f373d7f997edb9b80bdea1a99c2a6fbb25e035deadaadd7917ebfedd6304a19491769476208684e343f86b4d55a7dbbb07283cb1e35a138d24ebc5b4f8e35a82d3a7f84cb1e02a5a92b53567088be0b1ca023ccd518c0e0715b1c8760801a419ebd2e26440ff7493019bdb655cc88d72d6d7b6bca5a2e19b63ec52fce43d8c53a8031e64026e0d36b6401064c49a729f11ab377f7132c5232bb80195dd5d43d29646a9378eea0761b7ed9d2172e33ed87c7413c843b180cc00000000006bedf2ed716ca43a941119b96d82b26d9061de240d85ec2cfa462bd52104489bb7a7548d7cc53627031e909c69cb824233975a1ea645de63522407c3a240a37e946f30ebf075ea97846a0a8d2286f3f446b1b99ab83a12ddf8a1c06294eadc3eb3e339591afd5c00000000000000000000000000000000000000000000000000579dad8347a3d16976bb7483840b32db0158fb6c809349333325a7866ca5d3133e33ef1a183cefdb65a79fa71800988c8445029e024822dbcfcab49c3a0aec9bd43e6e14078b260700d849a2aa14c9b593f6dcb1de334c065ecfd65031606e55949c185bcda9fde4f9b46a76b8a24bbcd31b22373eb0473248150cd179405ee1af1183b0c0ce3483dc1d9bf732b0751b78fb211d6706b55960c6431afbc02b3c7e08086573939290bb9e590a3875f02a828b07f1dc7df9c8e5da22dfb9dacbf5529e4e994128d835f85465173ea7bbcc519a0c9798ce8b1b07567e3e07169c8c3e4da8bf725c050000000000000000000000000000000000000000004775abdf0c62728eb55a9e2849a1ce05bed60dfe4cc9fa43f9684297c02382c0a35829be7a86305792a9d2e80ca9e8fc50f31f6e0fa810303da03d8b74b42c1ebaf16bb343256405a3a07229a54de09a97b269cd29e8b2f0b0d46c51a6a93eec37f4bc6e29a8e19120ae050ab682662e9b2cc3263a4aba62b63ca9123a53c0f4bf3c4463b8144c89bf058a0af0ae9fc2b7cdfc4817703e267cddc193637d7fd97646090da37093657643daae3840c7f5c10f93524f7ae4791ec6e9d9722e5f670ccb358e051a"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls}, 0x48) bpf$LINK_GET_NEXT_ID(0x1f, &(0x7f00000001c0)={0x2, 0x0}, 0x8) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000280)=ANY=[@ANYRES32=r2, @ANYRES32=r2, @ANYBLOB="2f0000002020000004000000", @ANYRES32=r3, @ANYBLOB="8f46f2a2925a9f47272bbd5893ac71c48eefadb67ff4071305003eed6f30ae5391cd387377b45e94e6fe84978c16b57266d297e513081eea158c399d8d01d8a94ffebcb390d99b98da86dcddbf2cb29c7e5a4e9fb8580ae91774e0d34bce010e5d0002000000000000002283928dbda01836fcac67416ec47b307396cf47a1b88a4cae450fcda8368d8306d3617b567867946ad1e0b1a58598f6ffa0873038254bd809d13c485f5e19df02fda0", @ANYRES64=0x0], 0x20) r4 = socket$inet_mptcp(0x2, 0x1, 0x106) r5 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r5, 0x8933, &(0x7f00000000c0)={'vxcan1\x00', 0x0}) bind$can_j1939(r5, &(0x7f0000000240)={0x1d, r6, 0x400000000000, {0x1, 0xff, 0x1}, 0x2}, 0x18) sendmsg$can_j1939(r5, &(0x7f0000000140)={&(0x7f0000000480)={0x1d, 0x0, 0xc7, {0x0, 0x0, 0x4}}, 0x18, &(0x7f0000000180)={0x0}, 0x1, 0x0, 0x0, 0x400c000}, 0x400c02e) r7 = accept$unix(0xffffffffffffffff, 0x0, &(0x7f0000000140)) connect$unix(r7, &(0x7f0000000380)=@file={0x1, './file0\x00'}, 0x6e) getsockopt$inet_int(r4, 0x0, 0xf, 0x0, &(0x7f0000000080)) socket$nl_route(0x10, 0x3, 0x0) r8 = socket(0x10, 0x803, 0x0) r9 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="0200000004000000080000000100000080"], 0x50) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000240)={{r9, 0xffffffffffffffff}, &(0x7f0000000180), &(0x7f00000001c0)='%pB \x00'}, 0x20) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000280)={r10}, 0x4) r11 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x3, 0x11, &(0x7f00000003c0)=ANY=[@ANYBLOB="18000000000000000000000000040000850000002f000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r9, @ANYBLOB="0000000000000000b70500000800000085000000a500000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r12 = socket(0x2a, 0x2, 0x0) getsockname$packet(r12, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000001480)=0x14) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000440)=@newqdisc={0x34, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r13, {}, {0xffff, 0xffff}, {0x0, 0xfff1}}, [@qdisc_kind_options=@q_cake={{0x8}, {0x4}}]}, 0x34}}, 0x0) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000000c0)={0x0}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=@newtfilter={0x38, 0x2c, 0x601, 0x70bd2d, 0x0, {0x0, 0x0, 0x0, r13, {}, {}, {0xc, 0xffe0}}, [@filter_kind_options=@f_fw={{0x7}, {0xc, 0x2, [@TCA_FW_CLASSID={0x0, 0x1, {0xf, 0xfff1}}]}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4884}, 0x24000840) r14 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r14, &(0x7f00000002c0), 0x40000000000009f, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000300)={r11, 0x18000000000002a0, 0xe, 0x0, &(0x7f0000000000)="b979ff03076003008cb89e08f086", 0x0, 0x20fe8, 0x60000000, 0x0, 0x0, 0x0, 0x0}, 0x50) ioctl$sock_SIOCETHTOOL(r8, 0x8946, &(0x7f0000000140)={'dummy0\x00', &(0x7f0000000280)=@ethtool_channels={0x24, 0x0, 0x0, 0x0, 0x3, 0x7fffffff, 0x1, 0x2, 0xfffffffe}}) 5.156871429s ago: executing program 3 (id=3196): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000480)={{0x14}, [@NFT_MSG_NEWRULE={0x50, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2, 0x0, 0xfffe}, [@NFTA_RULE_EXPRESSIONS={0x24, 0x4, 0x0, 0x1, [{0x20, 0x1, 0x0, 0x1, @ct={{0x7}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_CT_KEY={0x8, 0x2, 0x1, 0x0, 0xd}, @NFTA_CT_SREG={0x8, 0x4, 0x1, 0x0, 0x5}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x5}}}, 0x78}, 0x1, 0x0, 0x0, 0x24040840}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000b40)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) write$cgroup_pid(r3, &(0x7f0000000000), 0xffffff98) splice(r1, 0x0, r3, 0x0, 0x2, 0xe) r4 = bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000300), 0x4) r5 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000440)={0xffffffffffffffff, 0x618d1bca, 0x8}, 0xc) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0xb, 0x8, 0x10001, 0x9, 0x1}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, &(0x7f0000000280)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000f00000018110000", @ANYRES32=r6, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000725e850000000100000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000011c0)={{r6}, &(0x7f0000001140), &(0x7f0000001180)}, 0x20) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000540)=@bpf_tracing={0x1a, 0x8, &(0x7f0000000040)=@raw=[@map_fd={0x18, 0x7, 0x1, 0x0, r2}, @tail_call={{0x18, 0x2, 0x1, 0x0, r6}}, @kfunc={0x85, 0x0, 0x2, 0x0, 0x5}], &(0x7f0000000240)='GPL\x00', 0x7, 0x76, &(0x7f0000000280)=""/118, 0x41000, 0x4, '\x00', 0x0, 0x19, r4, 0x8, &(0x7f00000003c0)={0x7, 0x3}, 0x8, 0x10, &(0x7f0000000400)={0x3, 0xd, 0x2, 0xa857}, 0x10, 0x2300b, 0xffffffffffffffff, 0x0, &(0x7f0000000500)=[r5, r3, r3, r3], 0x0, 0x10, 0x9836}, 0x94) 4.635344882s ago: executing program 1 (id=3199): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000100)=ANY=[@ANYBLOB="ec000000100001002d390d00fedbdf2500000000", @ANYRES32=0x0, @ANYBLOB="8121000000000000140003006e657464657673696d30000000000000b0001680ac00018010000600fa010000060000000900000018000c8014000100930a0000f602000005000000810000000c000700e60000000900000068000c8014000100ffffff7f"], 0xec}}, 0x4000844) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x10, &(0x7f00000002c0)=[@in={0x2, 0x4e23, @rand_addr=0x64010100}]}, &(0x7f0000000140)=0x10) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) ppoll(&(0x7f0000000000)=[{r2, 0x228}], 0x1, 0x0, 0x0, 0x0) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) r4 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r4, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_ASSOCINFO(r3, 0x84, 0x1, &(0x7f00000004c0)={r5, 0xf, 0x5, 0x7, 0x1000007f, 0x6}, 0x14) 4.097392287s ago: executing program 3 (id=3202): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r2, 0x0) close(0x3) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x10, &(0x7f00000001c0)=[@in={0x2, 0x4e23, @rand_addr=0x64010100}]}, &(0x7f0000000140)=0x10) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r2, 0x84, 0x7a, &(0x7f0000000340)={r3, @in6={{0xa, 0x3, 0x4, @mcast1}}}, &(0x7f0000000040)=0x84) setsockopt$inet_sctp6_SCTP_DELAYED_SACK(r1, 0x84, 0x10, &(0x7f00000000c0)=@assoc_value, 0x8) getsockopt$inet_sctp6_SCTP_DELAYED_SACK(r1, 0x84, 0x10, &(0x7f0000000700)=@sack_info={0x0, 0x2, 0x6}, &(0x7f0000000740)=0xc) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000200000a5c000000060a0b0400000000454db63102000000300004802c0001800b0001006e756d67656e00001c00028008000240000056a7080003400000000008000140000000110900010073797a30000000000900020073797a320000000014000000110001"], 0x84}, 0x1, 0x0, 0x0, 0x40050}, 0x0) sendmsg$nl_generic(r0, &(0x7f00000029c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000a80)=ANY=[@ANYRESHEX=r6, @ANYRES32=r0, @ANYRES16, @ANYRES16=r4, @ANYRESHEX=0x0, @ANYRESDEC=r2, @ANYRES64=r6, @ANYRES16=r5], 0x24}}, 0x0) r7 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet6_int(r7, 0x29, 0x1a, &(0x7f00000003c0)=0xffffffff, 0x4) r8 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_int(r8, 0x29, 0x38, &(0x7f0000000000)=0x40008000, 0x4) bind$inet6(r8, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x7ff, @empty, 0x9}, 0x1c) setsockopt$inet6_IPV6_DSTOPTS(r8, 0x29, 0x3b, &(0x7f0000000080)=ANY=[], 0x8) recvmmsg(r8, &(0x7f0000001100)=[{{0x0, 0x0, 0x0}, 0x2f}], 0x1, 0x2, 0x0) sendto$inet6(r8, 0x0, 0x0, 0x20004184, &(0x7f0000000200)={0xa, 0x4e20, 0x0, @mcast1}, 0x1c) vmsplice(r7, &(0x7f0000000740)=[{&(0x7f0000000180)="a23192676e695f152ec20e237566bcd8625092f53981af9f28deb9e0d0446c0e315d27950d5f4db554f94c537edf38e756aca15ef8b814adbeec84b9520da0391dc431d8ed5cdb0a8ca37305ec0e42022ba1a23c26f470ea4f0a576b2fa155a047a0d21303d857f5870f7f889f43cf1ea915e3c05f3e661065e9036e4f", 0x7d}, {&(0x7f0000000400)="ef4b432d867b0fa22b4429b4e6af08e1a2be7fadbfc86c7577b21ccdab103375d390d8dd22275a1103963c02a609bc86478497fa8e00a524fc0315322d48cb78548e4168aea19930df8faefa079639c787c4dd21bbb03aa77d1882144c695a0e07a8881fad019b46bd69df4c15a1763f3cdea4c71b7f82031870eba1d1601058e1705a68ee485303dda3e5874183045d5ae63d01e1abc86f9c2890991fc5b4d479b8b3539f6848471450f8fac7cf52", 0xaf}, {&(0x7f00000004c0)="c44c02e78f7a378cf7354fb179648ec0b9b41148ddad16c8e28594fda8873947896d5d511afed8c957f3a6a03680003c32c8f90f71663d8047a512f65997f13aa4247ab4a02494e6075e567d6f71f4a14b18f7e4749affef3da18447101023a61b551ed00c1f1789028d19c5fd71e62ca398db02327c2359a8be5b30a8168dae55fe2821e1798be5f1f2b3", 0x8b}, {&(0x7f0000000580)="1f857a8897560dc21fb3b947b9171df2568fd29c24e64e1091fe19020ca5b407cebff1dfb952d310556d407e530761b74cd0f97552fd871b3fd3fdd5b7c1545e1c825498c6c44329ad243e0f5e261185bf34ca145c5b19e96cc8fe04e8b45581029a324233d21c71c9f7fba7bf04b95d6819934ef2b4140c6a587de3cece4321ca040bbecb9d6f9b592e389a8467ec8c436340e61c90bde8593381093f2b7a4ab9cb", 0xa2}, {&(0x7f0000000640)="bd6648c0e7edcd5a627999d092326c4aa9ae9945f66118ea7e058af518d0b284c869f51de03a863e8e64c51d96ff44d10b91338783a890af24812ed4557f08b2fadb99c28b8fee9c5bc828128968ca8d4cec81877ac5d75fb1d0efb65fc259d7801769880a6d903683ea5bb70346dac7fd6673ac2222095d7dc70d3d99bc591833897955bbb200b1148757c54d6db1a725c84ac3723aec8f867c354824ad1b9cad0f8ab17cd5a3de73489be2b47de2996be8402dc2566b57299e6614009c79b6f58cf8781bc3059a217bdd46dfbbedf36d7a9a8a4c0b", 0xd6}], 0x5, 0x8) r9 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r10 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000440), 0xffffffffffffffff) r11 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r11, 0x8933, &(0x7f0000000100)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r9, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000880)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r10, @ANYBLOB="0103000022f17ec358d10000000000001f00000008000300", @ANYRES32=r12, @ANYBLOB="14867e2a60fde1b5fe78323c02e4f716372bfe2fed0ee51519c68e3d0d5d882111aa5bd581ffb275cb3bf5022afbad947172a818ec0250d4772149d35fb7e61b8eb459ce52f8dc2b0d4941235da1def97855d1c4"], 0x1c}, 0x1, 0x3000000}, 0x0) setsockopt$inet6_int(r7, 0x29, 0x19, &(0x7f0000000240)=0x68, 0x4) r13 = socket(0x6, 0x3, 0x40000) sendmsg$nl_route(r13, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000007c0)=ANY=[@ANYBLOB="4c0000001000010426bd00fddb5f2500000000", @ANYRESDEC=r3, @ANYRES64], 0x4c}, 0x1, 0x0, 0x0, 0x20008000}, 0x24048044) 3.634069512s ago: executing program 1 (id=3207): syz_init_net_socket$bt_hci(0x1f, 0x3, 0x6) r0 = socket$inet_icmp(0x2, 0x2, 0x1) r1 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000040), 0x4) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000100)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000000000), &(0x7f00000000c0)=r1}, 0x20) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000180)={'wlan1\x00', &(0x7f0000000080)=@ethtool_eeprom={0xb, 0x2, 0x6}}) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = epoll_create1(0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@abs, 0x6e) r7 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0) close(r7) getsockopt$inet_opts(r7, 0x0, 0x0, &(0x7f00000002c0)=""/164, &(0x7f0000000380)=0xa4) sendmmsg$unix(r6, &(0x7f00000bd000), 0x318, 0x0) syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) epoll_pwait(r4, &(0x7f0000000140)=[{}], 0x1, 0x2d516fb6, 0x0, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) epoll_ctl$EPOLL_CTL_ADD(r4, 0x1, r6, &(0x7f0000000100)={0x20000014}) r8 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000040)={0x3, 0x5, &(0x7f00000006c0)=ANY=[], &(0x7f0000000680)='GPL\x00'}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000003c0)={r8, 0x0, 0xe, 0x0, &(0x7f0000000180)="5becbc0e0d7cca6073a4f11d1b00", 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) epoll_wait(r4, &(0x7f0000000040)=[{}], 0x1, 0x400) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000280)={r2, &(0x7f00000001c0)="34bf0044dcbe0f02929d950dae5fdd09a4359cefd186", &(0x7f0000000200)=""/85}, 0x20) socket$inet6_tcp(0xa, 0x1, 0x0) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000700)=ANY=[@ANYBLOB="b4050000200080006110600000000000c60000000000000095000000000000009f33ef60916e6e893f1eeb0be20000d072f5b89c3043c47c896ce0bc8731fa595b6b4d45ef26dcca5582054d54d53cd2b685b431c70ea948259c4c869b4fc8db714e4b94bdae214fa68a051d4dca7d2647bec1fc89398d2b9000f224891060017c4700de60beac671e8e8f00cb03588aa6007e71f871ab5c2ff88afc6002084e5b52710aeee835cf0d78e45f70983826fb8579c1fb47d2c59005cff414ed55b0d18a9d446935fb332bb593ee341ab59016f81860324b800c00000000000092d9c5fe34ccb80a61ffcb3363073fd8962823ee45f5d7394e9510f4ac6c702cfabe8a9c55c8dafcdb110036e14c1035cafdfef6a358cbfadb3579a285580a3c080d4e0a48d7bdc38a0437c8c1b3aa408a00000000"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8}, 0x94) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB], 0x48) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000ac0)=ANY=[], 0x10) unshare(0x2c020400) pselect6(0x40, &(0x7f0000000000)={0xa, 0x80000001, 0x2, 0x10000000000006, 0x12, 0x8, 0x80000000, 0x8}, 0x0, 0x0, 0x0, 0x0) setsockopt$SO_TIMESTAMP(r3, 0x1, 0x40, &(0x7f0000000140)=0x7, 0x4) getsockopt$SO_TIMESTAMP(r3, 0x1, 0x1d, 0x0, &(0x7f0000000040)=0x29) close(0x4) 2.86198169s ago: executing program 0 (id=3210): socket(0x10, 0x3, 0x800000) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) sendmsg(r2, &(0x7f0000001900)={&(0x7f0000000000)=@hci={0x1f, 0xffffffffffffffff, 0x2}, 0x80, &(0x7f00000005c0)=[{&(0x7f0000000080)="b611", 0x2}, {0x0}], 0x2}, 0x20000010) r3 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r1) r4 = socket$tipc(0x1e, 0x2, 0x0) bind$tipc(r4, &(0x7f0000000100)=@name={0x1e, 0x2, 0x0, {{0x42}}}, 0x10) r5 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r4, 0x10f, 0x87, &(0x7f0000000040)={0x42, 0x40000, 0x3}, 0x10) setsockopt$TIPC_GROUP_JOIN(r5, 0x10f, 0x87, &(0x7f0000000180)={0x42}, 0x10) sendmmsg$inet(r4, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x200040c0) sendmsg$IEEE802154_LLSEC_ADD_DEVKEY(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000001200)={&(0x7f00000000c0)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="070600000000ffffffff2d00000005a29ac3002b0001000000060006000100000008002f00050000000a0001007770616e30000000"], 0x38}}, 0x20048840) setsockopt$sock_attach_bpf(r0, 0x1, 0xa, &(0x7f0000000480), 0x4) socket$inet6_sctp(0xa, 0x1, 0x84) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) r6 = socket$alg(0x26, 0x5, 0x0) bind$alg(r6, &(0x7f0000000100)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128-generic\x00'}, 0x58) accept4(r6, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f05ebbee1, 0x8031, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x1032, 0xffffffffffffffff, 0x21d67000) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={0x0, 0x0}, 0x28) socket$netlink(0x10, 0x3, 0x0) syz_open_procfs$namespace(0x0, &(0x7f0000000040)='ns/cgroup\x00') r7 = socket$inet6(0xa, 0x3, 0x5) setsockopt$IP6T_SO_SET_REPLACE(r7, 0x29, 0x40, &(0x7f0000000400)=@nat={'nat\x00', 0x1b, 0x5, 0x490, 0x0, 0x0, 0xffffffff, 0x0, 0x210, 0x570, 0x570, 0xffffffff, 0x570, 0x570, 0x5, 0x0, {[{{@uncond, 0x0, 0xa8, 0xf0}, @REDIRECT={0x48, 'REDIRECT\x00', 0x0, {0x5, @ipv4=@multicast1, @ipv6=@ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x1, 0x0}}, @icmp_id=0x64, @port=0x4e22}}}, {{@ipv6={@dev={0xfe, 0x80, '\x00', 0x34}, @dev={0xfe, 0x80, '\x00', 0x39}, [0xff000000, 0x0, 0x0, 0xff000000], [0x0, 0x0, 0xffffff00], 'bond_slave_0\x00', 'veth0_to_bond\x00', {0xff}, {}, 0xc65ec123d57cf83, 0x7, 0x8, 0x12}, 0x0, 0xa8, 0xf0}, @NETMAP={0x48, 'NETMAP\x00', 0x0, {0x11, @ipv4=@multicast1, @ipv4=@private=0xa010101, @port=0x4e20, @gre_key=0xabfc}}}, {{@ipv6={@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @mcast1, [0xff000000, 0xffff00, 0xffffffff, 0xffffff00], [0xffffff00, 0xffffff00, 0xff000000, 0xffffffff], 'nicvf0\x00', 'veth1_to_hsr\x00', {0xff}, {}, 0x3c, 0x6, 0x1, 0x4}, 0x0, 0xa8, 0xf0}, @MASQUERADE={0x48, 'MASQUERADE\x00', 0x0, {0x0, @ipv4=@broadcast, @ipv6=@private2={0xfc, 0x2, '\x00', 0x1}, @icmp_id=0x64, @port=0x4e20}}}, {{@uncond, 0x0, 0xa8, 0xf0}, @MASQUERADE={0x48, 'MASQUERADE\x00', 0x0, {0x8, @ipv4=@rand_addr=0x64010101, @ipv6=@mcast1, @port=0x4e21, @port=0x4e21}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x4f0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeef, 0x8031, 0xffffffffffffffff, 0x215eb000) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x3, 0x4, &(0x7f0000000440)=@framed={{0x18, 0x2, 0x0, 0x0, 0x75, 0x0, 0x0, 0x0, 0x40002}, [@call={0x85, 0x0, 0x0, 0x26}]}, 0x0, 0x0, 0x0, 0x0, 0x1e00, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x100000}, 0x94) socket(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000840)={&(0x7f00000009c0)=ANY=[@ANYBLOB="280000001200010100000000e0ffffff07000000", @ANYRES32=0x0, @ANYBLOB="000000000040ead008001d00c3"], 0x28}}, 0x0) 2.546057764s ago: executing program 4 (id=3212): r0 = bpf$PROG_LOAD(0x5, &(0x7f00000007c0)={0x6, 0xc, &(0x7f00000002c0)=ANY=[@ANYBLOB="180200000400000000000000000000008500000041000000180100002020732500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007200000095"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r0, 0x0, 0xe, 0x0, &(0x7f0000000000)='\x00'/14, 0x0, 0x6ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x50) (async) r1 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r1, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) (async) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x8ac41, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) (async) r3 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000000280)={'syzkaller1\x00', @link_local}) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x40040, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) (async) r5 = socket$unix(0x1, 0x1, 0x0) (async) r6 = socket$kcm(0x11, 0x3, 0x0) r7 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) (async) r9 = socket(0x400000000010, 0x3, 0x0) (async) r10 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r9, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newqdisc={0x50, 0x24, 0x100, 0x70bd0a, 0x25dfdbff, {0x0, 0x0, 0x0, r11, {0x0, 0x4}, {0xffff, 0xffff}, {0xfff2, 0xfff1}}, [@qdisc_kind_options=@q_fq_codel={{0xd}, {0x1c, 0x2, [@TCA_FQ_CODEL_ECN={0x38, 0x4, 0x1}, @TCA_FQ_CODEL_CE_THRESHOLD_MASK={0x5, 0xb, 0x80}, @TCA_FQ_CODEL_INTERVAL={0x8, 0x3, 0x6}]}}]}, 0x50}}, 0x0) sendmsg$nl_route_sched(r9, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000500)=@newtfilter={0x8c, 0x2c, 0xd27, 0x70bd25, 0x25dfdbfe, {0x0, 0x0, 0x0, r8, {0xb, 0xfff3}, {}, {0x7, 0xfff2}}, [@filter_kind_options=@f_matchall={{0xd}, {0x58, 0x2, [@TCA_MATCHALL_ACT={0x54, 0x2, [@m_skbedit={0x50, 0x1, 0x0, 0x0, {{0xc}, {0x24, 0x2, 0x0, 0x1, [@TCA_SKBEDIT_PRIORITY={0x8, 0x3, {0xfff2, 0x3}}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0x535f, 0x6, 0xffffffffffffffff, 0x3, 0xfffffff1}}]}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x2, 0x3}}}}]}]}}]}, 0x8c}, 0x1, 0x0, 0x0, 0x24040894}, 0x0) (async) r12 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r12) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r12, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) (async) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$kcm(r6, &(0x7f00000000c0)={&(0x7f0000000380)=@xdp={0x2c, 0x7, r13, 0x3e}, 0x80, &(0x7f0000000080)=[{&(0x7f0000002300)="81", 0x1}], 0x1}, 0x4) (async) socketpair$tipc(0x1e, 0x7, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$TIPC_IMPORTANCE(r14, 0x10f, 0x7f, &(0x7f0000000040)=0x544, 0x4) (async) sendmsg$NL80211_CMD_SET_NOACK_MAP(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x1}, 0x4040) (async) write$tun(r2, &(0x7f0000000080)=ANY=[@ANYBLOB="00006003ff0208004500002040000000002f907800001fe1e0000001a0006558000c9078410900"/50], 0x32) 1.914464431s ago: executing program 4 (id=3215): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000000)={0x18, 0x2, &(0x7f0000000480)=ANY=[@ANYBLOB="91108a000000000095"], &(0x7f00000003c0)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xbffffffe}, 0x94) 1.766084339s ago: executing program 2 (id=3216): sendmsg$TIPC_NL_BEARER_GET(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000680)=ANY=[@ANYBLOB="08c987b1", @ANYRES16=0x0, @ANYBLOB="000229bd7000fedbdf25040000004000078008000100a40f00000c00040002000000000000000c00030002080000000000000c000400000c000000000000080001007400000008000100050000002c00058014000280080002000400000008000100190000001400028008000200100000000600010019000000"], 0x80}, 0x1, 0x0, 0x0, 0x20004840}, 0xcc00) r0 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000006c0)=ANY=[@ANYBLOB="180100002f00010000000000fcdbdf250601f2800c"], 0x118}], 0x1, 0x0, 0x0, 0x1}, 0x0) 1.743207905s ago: executing program 4 (id=3217): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) mmap(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x800004, 0x40010, 0xffffffffffffffff, 0x0) r2 = socket$inet(0x2, 0x2, 0x1) sendmsg$inet(r2, &(0x7f0000000080)={&(0x7f0000000000)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x17}}, 0x10, &(0x7f0000000140)=[{&(0x7f0000000400)="08001efbb07d586e", 0x8}], 0x1}, 0x20048814) mmap(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x0, 0x13, r1, 0x0) mmap(&(0x7f0000000000/0x95c000)=nil, 0x95c000, 0x9, 0x8c4b815a5465c2b1, 0xffffffffffffffff, 0xb0260000) mmap(&(0x7f0000d8c000/0x1000)=nil, 0x1000, 0x1000001, 0x32, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000040)=@base={0x6, 0x4, 0x1001, 0x2}, 0x50) r3 = socket$nl_route(0x10, 0x3, 0x0) accept$packet(r0, 0x0, &(0x7f0000000100)) sendmsg$nl_route(r3, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000000)=ANY=[@ANYBLOB="480000001000030400000000fdffff0000000300", @ANYRES32=0x0, @ANYBLOB="0000000040000000140012800900010076657468000000000400028008004040", @ANYRES32=0x0, @ANYBLOB="0c001a"], 0x48}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x13, &(0x7f0000000040)=ANY=[@ANYBLOB="1802000000000000000000000000000018e10000202070250000bda106000000000047010000f8ffffffb602000008000000b70300c6cb00000085000000058000001801000020696c250000000000202020db1af8ff5ec3a7a7bda102000000000007010000f8ffffffb702000008000000b703000000000000850000007b0000009500000000000000"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) mmap(&(0x7f0000867000/0x2000)=nil, 0x2000, 0x0, 0x11, r0, 0xffffe000) ioctl$XFS_IOC_BULKSTAT(r0, 0x8040587f, &(0x7f0000000480)={{0xe02, 0x6, 0x7, 0x1000, 0x7}, &(0x7f0000000240)=[{}, {}]}) mmap$xdp(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x7000000, 0x6e073, r1, 0x2000) 1.538979809s ago: executing program 4 (id=3218): r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000000)={0x1b, 0x0, 0x0, 0x8, 0x0, 0x1, 0x42, '\x00', 0x0, 0xffffffffffffffff, 0x5, 0x5}, 0x50) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='blkio.bfq.io_service_bytes_recursive\x00', 0x275a, 0x0) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_INITMSG(r2, 0x84, 0x2, &(0x7f00000000c0)={0xfff9, 0x8}, 0x8) sendto$inet6(r1, &(0x7f0000000200)="6b69582cbda6e5e7716938d5593081", 0xf, 0xc001, &(0x7f0000000280)={0xa, 0x0, 0x0, @loopback, 0x81}, 0x1c) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r2, 0x84, 0x9, 0x0, &(0x7f0000000400)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x28012, r1, 0x0) mmap(&(0x7f00009c5000/0x1000)=nil, 0x1000, 0x3, 0x28012, r1, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000480)={0x1e, 0x5, &(0x7f0000000080)=@raw=[@tail_call={{0x18, 0x2, 0x1, 0x0, r1}}], &(0x7f0000000c40)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x94) r3 = socket(0x1a, 0x4, 0xd828) sendmsg$AUDIT_GET(r3, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x10, 0x3e8, 0x100, 0x70bd28, 0x25dfdbff, "", ["", "", ""]}, 0x10}, 0x1, 0x0, 0x0, 0x40801}, 0x24000880) close(r0) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000000)={0x1b, 0x0, 0x0, 0x8, 0x0, 0x1, 0x42, '\x00', 0x0, 0xffffffffffffffff, 0x5, 0x5}, 0x50) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='blkio.bfq.io_service_bytes_recursive\x00', 0x275a, 0x0) (async) socket$inet6_sctp(0xa, 0x5, 0x84) (async) setsockopt$inet_sctp6_SCTP_INITMSG(r2, 0x84, 0x2, &(0x7f00000000c0)={0xfff9, 0x8}, 0x8) (async) sendto$inet6(r1, &(0x7f0000000200)="6b69582cbda6e5e7716938d5593081", 0xf, 0xc001, &(0x7f0000000280)={0xa, 0x0, 0x0, @loopback, 0x81}, 0x1c) (async) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r2, 0x84, 0x9, 0x0, &(0x7f0000000400)) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x28012, r1, 0x0) (async) mmap(&(0x7f00009c5000/0x1000)=nil, 0x1000, 0x3, 0x28012, r1, 0x0) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000480)={0x1e, 0x5, &(0x7f0000000080)=@raw=[@tail_call={{0x18, 0x2, 0x1, 0x0, r1}}], &(0x7f0000000c40)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x94) (async) socket(0x1a, 0x4, 0xd828) (async) sendmsg$AUDIT_GET(r3, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x10, 0x3e8, 0x100, 0x70bd28, 0x25dfdbff, "", ["", "", ""]}, 0x10}, 0x1, 0x0, 0x0, 0x40801}, 0x24000880) (async) close(r0) (async) 1.502780198s ago: executing program 2 (id=3219): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-serpent-sse2\x00'}, 0x31) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r1 = accept4(r0, 0x0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000000400)=[{0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe1a}], 0x1, &(0x7f0000000380)=[@op={0x18}], 0x18}], 0x4924924924924b9, 0x0) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f00000000c0)=""/73, 0x49}, {&(0x7f0000000200)=""/83, 0x53}], 0x3a}, 0xf0) socket$alg(0x26, 0x5, 0x0) (async) bind$alg(r0, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-serpent-sse2\x00'}, 0x31) (async) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) (async) accept4(r0, 0x0, 0x0, 0x0) (async) sendmmsg$alg(r1, &(0x7f0000000400)=[{0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe1a}], 0x1, &(0x7f0000000380)=[@op={0x18}], 0x18}], 0x4924924924924b9, 0x0) (async) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f00000000c0)=""/73, 0x49}, {&(0x7f0000000200)=""/83, 0x53}], 0x3a}, 0xf0) (async) 1.365769587s ago: executing program 1 (id=3220): r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) (async) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000001c0)={0x38, r2, 0x1, 0x70bd2c, 0x0, {{0x2}, {@val={0x8, 0x3, r1}, @val={0xc, 0x99, {0x2, 0x25}}}}, [@chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}, @NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x4}]]}, 0x38}, 0x1, 0x0, 0x0, 0x8001}, 0x4040000) (async) bpf$ENABLE_STATS(0x20, 0x0, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) (async) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) bind$bt_sco(r5, &(0x7f00000000c0)={0x1f, @none}, 0x8) getsockopt$bt_BT_DEFER_SETUP(r5, 0x112, 0x7, &(0x7f00000002c0)=0x1, &(0x7f0000000300)=0x4) sendmsg$nl_generic(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)=ANY=[@ANYBLOB="3400000040000701fcffffff00000100017c0000040042800c0001800600060065580000100002800c0008"], 0x34}}, 0x400c010) (async) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_attach_bpf(r7, 0x1, 0x4c, &(0x7f0000000000), 0x4) sendmsg$inet(r6, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) (async) recvmsg$unix(r7, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000300)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) ioctl$TUNSETNOCSUM(r8, 0xc040ff0b, 0x1) (async) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) (async) ioctl$sock_netdev_private(r5, 0x89fe, &(0x7f00000003c0)="71ad7b577726a1957b62230c6b9c5d2ea8244fc7b56bba135843dec24f780002c7855d432760258949efaf54943b982216abb1ab6f19a4eee27cfe5535d6aba5fa1e18c235dce7576f8e89da35fd813f640d76b5586d7cc98fb0993666ebfde9de0b09ab27212f42072d588ef33ad03819ee94fdd1ed2b0dc46815cf89a59ab86ca71111b370babe12b94ae79967b4fb881e3eb52ec7920fdfc2e4e40328ada92c") bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x3e}, 0x94) r9 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x2, 0x4, 0x2, 0xc, 0x1400}, 0x48) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000280)={r9, 0x68, &(0x7f0000000200)}, 0x10) (async) r10 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000000)={&(0x7f00000005c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x28, 0x28, 0x7, [@func_proto={0x0, 0x0, 0x0, 0xd, 0xa}, @enum={0x0, 0x2, 0x0, 0x6, 0x4, [{0x5, 0xb0}, {0x2, 0x80}]}]}, {0x0, [0x2e, 0x0, 0x2e, 0x5f, 0x2e]}}, &(0x7f0000000f40)=""/4086, 0x47, 0xff6, 0x5}, 0x28) (async) getsockopt$inet6_tcp_int(r3, 0x6, 0xf, &(0x7f0000000140), &(0x7f0000000dc0)=0x4) write$cgroup_subtree(r3, &(0x7f0000000080)=ANY=[], 0x10448) (async) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r3, 0x0) r11 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x4, 0xe, &(0x7f0000001f40)=ANY=[@ANYBLOB="b702000000000000bfa30000000000000703000000feffff7a0af0fff8fff7ff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b70500000000e000720aa3fe00000000850000000a000000b70000000000000095000000000000004e6258941c823b7505608556ba4ababb42684e890d31ae450400373a0a5447a801b8c1c4f0c4bd97c6555e61345400f9bd42abeb9ade0105000000000000a21902ff07000094a2b51c21df74924f5436a6ed89b98f75e800230c49c90fe1336481f3b92a63336c36fcd745d61d7739c6554ca201000000bebbe8282f8b1e26407437a397bf8f50e87ed4d27adfd876bffc402887781979461c4363bc5c9b6202ea471428197ef88bc333fbcec0ea4334f1ddb9d679ae95a90fd41d528f587e05000000435883df6c10ce86188c92292b2d0226082960be682836bdff8b0971f2a5405e453228e7b1005bd73479358a90df3e481947de6453736aa572158af6ea63d6d418fbbd2bba050000001da000ef78df03000000d19913a5fb03c79dac2e489f68127892658115e7ffb588a71dffffff951b8535167ab8069a2c92a3aa18e22517000026637b4c34bf2d0aa304ed42bf70480e9e97203fd169411f37fddd1f7fbe16dbbc0f307bceb5064f388a0350c3dc9271aa8b0e638b1e2b2a9d25264233e5d45eb377f56b95241024dbe30f67191c2b56b70328d6d3215dfffe5d89af1d10599bd494d921d1fb2db99b6aba0fa978f41eb1d4c553e5a9326ed550c13f8dd36716a899a1e79234294707c5312b924d142c17b20bb80ee202222c03fa84ccc374e717f694018630366397266090a82343aedfbf7afe892390c2eb775b0d16073da2229958db05de7df6ab7600004000010000006d8081cb3bf251d906c00da0e23b50465f8394820be571e3592d0000c7ef10fdc462e7040e7074ec43aa461fc54401a76406db718d4efd6c1bd10ce1d087cf9bba461162555a95524c84df0952d32093082b7aa71304e0d2d9ec310d1b676b378a5879e47941de1a28c3a8f400000000000000000e032b7d2badd0bc6617a859b7ac273b6304555f664469cec152030f06cc0ca1765838eb5590264736fbccfc3a8f4e3b10daf6a275daf5db2dac7096fe8ac8876acaad043663b3b0fedb05e6d31408fa20140c9d2db1c59ac8a3ce28e489d67d87d3a107ccea3007f58f2c5017e8807107f79ac50cc1d4f546b4443d137eb706b71b1767a10cca7a7c82b76c96e874aff249f36329a6526b354b6e674b08f7ef492b804c4b08fb10de807d79fd782027318cd7632e22d2faa16209272b39b5ec8d239832ea02cc88e249a2e77753a58987547571fbc8de747faab724bebb6401412b496e078fcb6c78ab447e871b76a8b0506f49594aa1d610567e14d739a60ff3ce04d0d2e5681e787c7e1ad25467bb81f2f440128207fe07a83759ec30cf9e0a3fd3f2fcee97fe8d273f8e712a8a64eaf2d89a1fa44554357fcd7ab531ff7a41c27164fca430a62d015b477de61853f5ee2e25b00a63642ec32ece2ff3bb5883deb895f52a923b5c744d8dccdd6a09ded8b90f1eeda8e6e884a4f090edb6ab9fc8107846508d51f3735493d5860cf80200ce31b92eb3563d485b5a7d192092d7a9fd2bc67d305d1d1b4b8345f6501d1cd27657ce17330402dacb78d72d776330711645eed7d4c292f4448733c0826c4eb950f3d40457f82d7f792d106518f6bde874aff9e2bea7d73f74bebeeacfc700000000000000000000d40d73be47803297db004264c8c70b7761b22a7114a078a87d63d63b0c9dcc263a5b773bfeba212abef4181ad9e4872e328c0f105d5100000000b717051d7681ba04552eeba18a000000b22b50d76d85040c9000ea68a528049a60d5e26b20455194f4be3b8466fd66d0e6cefcff7891c485d61cb66f4076cd60a22733cb00cf7cc12ca7d9bb864c0e650236a79a5c85349a9b1e6bbc3bace197e72490c566431cd3a08e9d1b641c1ba1f661d01573b904c3fa1427370fa15cecd294ac21fefe3d161fdf58e8bc5957ef145839f4370176e1be88d2e3516a1998c1621a00b4438b85a4dfee6f61827a1e50e158038b037dfda3ffb35069e41fc740ae720800de53948f176c3c15f3a529c02434b920d87f12a6e3420a2fdcb3559e7a5b1ddbb06b7a5977f63bfac701e673bf626d126b213c92e7169a930beb8d76f9db34e8098bea301baa96916d6458c923866dc192928b320738d1b298fb55f2a64500000000000000000000000000509885a38d9d995a46817e7ff7acddcc5f9253c63f86baf33f92820c9ff497cf76b6482c3ab53fb6ecea6d220b91b99b2fb4279ab09ae0645ab92df309000000000000a4868411948f8e3e259b717d722a1eebd3f6860a17f1ae9e10a1178f6aef4951b192d13e9600c1f700ca7b1d127e451034469bf2a8f93dbae6ad8e932e431dc18323794156238625bb9c45c5a76a68a8646e701b29a71ffbd854f50f195823106a5625ff94221f1f04c72525b50aae69081de9626de9847bf53475d90642d9730101d80b1b0000000000000000822b0641698d60160d9157548302dd2636d12c431f96728ae4a45361e6d47a1c4a52d67c0f0a62585c09fcfd70d0f249f87c44b47283c1c6f2430d70c751e4ada9b646e6e7c1719faee476d88a2943c71a21db55b7497dd7ed385ac2e8cb916390a3a0ed141e69afa07b46ac20f3521fb251b72c82ee1c7eb4f67c0deed5618d0db925ce7a7c50a99835544c540f5d528587d1a26e78df1bc9a8e4d90c57d0b8122eae7b23e4456624f5337c16c42648c7a3d0b799ad409befe0cbe2aa781ba826918df7aa80dff4f62258e54419629eb1d37de7f6a3512bd618781d1ad3a4d4b0da44df9f9a93f0487f79a9b16dfa6f68b06ce6a96ca344d194cded05702c2300d1a4f451b33830765f8131f6c28fada65701851bba089b8a8347900e72d68cea965feb6a06225dd3f0e135323a5bde3b43c9d242b73abf9e05336af040a4a6bb5918146393f1d50705c1d1e986bf2f690de51ee8727d37339df5391db535bb1e9bb3e5dadb6e5a2bb4faa2dcbc6ca9b40ac96e448b9dadeb08fc2cf3a960f22bf20b9e967b7a75687372b8e3edc543896c360674d901a7f56b07ba1479b46eea3d94026a9c7e670ab40bb2c1ca1a7c90299361239bef773140af974c7efc285a64633d21513481b3ac62dec9fa3e8ce6156d76b82baa145bc550b0ccbc0934ccfea45292caa2f0654fe18dc0669a4f2af9fa232a293ad94261f55675cc686db72783a6bacc0df6a1ea943ae266af112f35319980cd681811a369e0d03cf7d22bed7cbe1afe498b88942b1bf7edae441a0d0d88fce65cb4e848793a28cbd7373f6acd3b5a48c034e487750388929d37fa3165f205dab3be5f3e5781a84298687cbf02dcaf0e14a2b260293f349d076eb75a2ddc5382d106f0beea02aa45018fe36d1176cf7704383b6922d10dc80bc7feca3982ae232d4bb47c722c83a7cf6ee8832f038b072eb803a47cd7f753e80c9f6eedb82e4541f92cb59b197a600331887e92dbcbad7b6b9af3c6f2d42ab9e591f57cc93d629b634518686492e0378547e1a33df35cbc133308dc1a87371bba153f03b8f177560732000000", @ANYRESHEX=r2, @ANYRESOCT=r3, @ANYRES32=r10, @ANYRES8=r8], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2a, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8}, 0x6) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r11, 0x300f000, 0xe, 0x0, &(0x7f0000000100)="0049c669c2700000000000000000", 0x0, 0xad27, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r12 = socket$inet(0x2, 0x80c, 0x7fff) bind$inet(r12, &(0x7f0000000480)={0x2, 0x4e21, @loopback}, 0x10) 1.361710262s ago: executing program 4 (id=3221): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYRES32=r0, @ANYRES32=0x0, @ANYBLOB="00000000080002000000000014000100ff"], 0x38}}, 0x0) socket$unix(0x1, 0x2, 0x0) 1.302644413s ago: executing program 4 (id=3222): socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r1, 0x0, r3, 0x0, 0x6, 0x0) close(r2) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x10, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="180000001600000000000000ebffffff91113f000000000095"], &(0x7f0000000c40)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x38, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, 0x94) r4 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r4, 0x10f, 0x87, &(0x7f0000000140)=@req3={0x7813, 0x3, 0x0, 0x81, 0x1ff, 0x1, 0x1}, 0x1c) recvmmsg$unix(r0, &(0x7f0000000540)=[{{0x0, 0xfffffffffffffd67, &(0x7f0000000300)=[{&(0x7f0000001bc0)=""/4100, 0x1004}], 0x1}}], 0x1, 0x0, 0x0) sendmmsg(r4, &(0x7f00000030c0)=[{{0x0, 0xa9cc7003, &(0x7f0000000400)=[{&(0x7f00000000c0)="ee", 0x101d0}], 0x1}}], 0x400000000000181, 0x9200000000000000) write(r0, 0x0, 0x0) mmap(&(0x7f00009fd000/0x600000)=nil, 0x600000, 0x100000d, 0x6031, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x3000007, 0x31, r3, 0x0) r5 = socket$phonet_pipe(0x23, 0x5, 0x2) socketpair$unix(0x1, 0x5, 0x0, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(0xffffffffffffffff, 0xc0c89425, &(0x7f00000002c0)={"6b2f3b6a399bc2f1af59106a2a1667f8", 0x0, 0x0, {0x9, 0x9d5f}, {0xd, 0x41}, 0xffff, [0xde99, 0x8e9, 0xc, 0x1d, 0x43, 0xfffffffffffffffb, 0x28, 0x1, 0x34e0000, 0x7ffffffffffffffb, 0x9, 0x5, 0x6, 0x8, 0x7, 0x4]}) write$cgroup_subtree(r7, &(0x7f0000000280)=ANY=[], 0x10448) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r7, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x1, 0x2, 0x11fe726f7e78fcf0}, 0x28) write(0xffffffffffffffff, 0x0, 0x0) mmap(&(0x7f00009fd000/0x600000)=nil, 0x600000, 0x100000d, 0x6031, 0xffffffffffffffff, 0x0) r8 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r8, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=ANY=[@ANYBLOB="4c0000001000030500"/20, @ANYRES32=0x0, @ANYBLOB="15010000000000002c00128009000100626f6e64000000001c000280050001000600000005000c000200000008000b00", @ANYBLOB="1102"], 0x4c}}, 0x24000000) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x3000007, 0x31, r6, 0x0) r9 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_EVENTS(r9, 0x84, 0xb, &(0x7f0000000080), &(0x7f00000000c0)=0xd) getsockopt$PNPIPE_INITSTATE(r5, 0x113, 0x4, 0x0, &(0x7f0000000040)) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, 0x0, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000400), r8) 1.300380955s ago: executing program 0 (id=3223): r0 = socket$inet6(0xa, 0x800000000000002, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)={0x94, 0x0, 0x1, 0x505, 0x0, 0x0, {0xa, 0x0, 0xfffe}, [@CTA_TUPLE_ORIG={0x3c, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @mcast1}, {0x14, 0x4, @mcast2}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TUPLE_ORIG={0x3c, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @mcast2}, {0x14, 0x4, @rand_addr=' \x01\x00'}}}]}, @CTA_TIMEOUT={0x8, 0x7, 0x1, 0x0, 0x1}]}, 0x94}, 0x1, 0x0, 0x0, 0x4041}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000a80)=ANY=[@ANYBLOB="a00000000001050500000000000000000a0000053c0002802c00018014000300ff01000000000000000000000000000114000400ff0200000000000000000000000000010c0002800500010000000000440001802c00018014000300ff02000000000000000000000d00000114000400200100000000000000000000000000010c000280050001000000000006000340000400000800074000000000040006"], 0xa0}, 0x1, 0x0, 0x0, 0x4010}, 0x0) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x4e1c, 0x0, @loopback, 0x4}, 0x1c) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @ipv4={'\x00', '\xff\xff', @multicast1}}, 0x1c) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, 0x0, 0x0) syz_emit_ethernet(0x3a, &(0x7f0000000180)={@broadcast, @random="050000005bde", @void, {@ipv4={0x800, @icmp={{0x9, 0x4, 0x0, 0x0, 0x2c, 0x64, 0x0, 0x0, 0x1, 0x0, @rand_addr=0x64010100, @local, {[@generic={0x7, 0x9, "0549aee3dae617"}, @generic={0x0, 0x2}, @generic={0x44, 0x2}]}}, @echo={0x8, 0x0, 0x0, 0xb, 0xf}}}}}, 0x0) 1.185401461s ago: executing program 2 (id=3224): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = accept4$packet(0xffffffffffffffff, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f00000001c0)=0x14, 0x0) setsockopt$packet_tx_ring(r1, 0x107, 0xd, &(0x7f0000000200)=@req3={0xebe5, 0xa8, 0x7, 0x5f, 0x47, 0x7, 0x3c00}, 0x1c) r2 = socket$inet_sctp(0x2, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000000)={0x0, @in={{0x2, 0x4e22, @initdev={0xac, 0x1e, 0x1, 0x0}}}, 0xc, 0x3, 0x8, 0x8, 0x4, 0x81, 0x1}, &(0x7f0000000100)=0x9c) setsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(r2, 0x84, 0x72, &(0x7f0000000140)={r3, 0x3}, 0xc) setsockopt$inet6_buf(r0, 0x29, 0x20, &(0x7f00000000c0)="0bbb268dd6ffa80800000000000000000000210d0000aaa8fa017242ba9380d424000000000000000100000051000000", 0xfe60) socket$inet6_tcp(0xa, 0x1, 0x0) (async) accept4$packet(0xffffffffffffffff, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f00000001c0)=0x14, 0x0) (async) setsockopt$packet_tx_ring(r1, 0x107, 0xd, &(0x7f0000000200)=@req3={0xebe5, 0xa8, 0x7, 0x5f, 0x47, 0x7, 0x3c00}, 0x1c) (async) socket$inet_sctp(0x2, 0x5, 0x84) (async) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000000)={0x0, @in={{0x2, 0x4e22, @initdev={0xac, 0x1e, 0x1, 0x0}}}, 0xc, 0x3, 0x8, 0x8, 0x4, 0x81, 0x1}, &(0x7f0000000100)=0x9c) (async) setsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(r2, 0x84, 0x72, &(0x7f0000000140)={r3, 0x3}, 0xc) (async) setsockopt$inet6_buf(r0, 0x29, 0x20, &(0x7f00000000c0)="0bbb268dd6ffa80800000000000000000000210d0000aaa8fa017242ba9380d424000000000000000100000051000000", 0xfe60) (async) 1.106202211s ago: executing program 0 (id=3225): socket$nl_generic(0x10, 0x3, 0x10) r0 = socket$inet(0xa, 0x801, 0x84) connect$inet(r0, &(0x7f0000004cc0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) listen(r0, 0x8) r1 = accept4(r0, 0x0, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_AUTH_DELETE_KEY(r1, 0x84, 0x19, &(0x7f0000000140)={0x0, 0x8}, 0x8) syz_genetlink_get_family_id$tipc(&(0x7f00000003c0), 0xffffffffffffffff) r2 = socket(0x10, 0x803, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'team_slave_1\x00', 0x0}) r5 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r5, 0x29, 0x20, &(0x7f0000000180)={@private2, 0x800, 0x0, 0xff, 0x1}, 0x20) r6 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r6, 0x29, 0x20, &(0x7f0000000180)={@loopback={0x200000000000000}, 0x800, 0x0, 0x2, 0x1}, 0x20) sendmsg$nl_route_sched(r2, &(0x7f0000000700)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000002480)=@newtfilter={0x8b4, 0x2c, 0xd2b, 0x70bd2b, 0x25dfdbfb, {0x0, 0x0, 0x0, r4, {0xf}, {}, {0x7, 0xfff3}}, [@filter_kind_options=@f_u32={{0x8}, {0x880, 0x2, [@TCA_U32_POLICE={0x858, 0x6, [@TCA_POLICE_RATE={0x404, 0x2, [0x1020000, 0x3, 0xf, 0xfdb, 0x1, 0x80, 0x7, 0x7, 0x40000000, 0xaa04, 0x80000001, 0x99, 0x8000, 0x1000, 0x3, 0x0, 0x7fffffff, 0x80, 0x1, 0x7, 0x0, 0x5, 0x4, 0x5, 0x80000001, 0x2, 0xe0, 0x9, 0x1, 0x80000000, 0x1, 0xffff8001, 0x9, 0x10001, 0xf, 0x10000, 0x30, 0x807, 0x1000, 0x8, 0x7, 0x2, 0x5, 0x488, 0x9, 0x1000, 0x7, 0x7198, 0x8, 0x80000001, 0x1, 0x101, 0x3, 0x99, 0x2, 0x8, 0x10000, 0x2, 0x1, 0x2, 0x6, 0x9, 0x13, 0x2, 0xffff, 0x80, 0xbf77, 0x8, 0xc52, 0x6, 0x9, 0x7, 0x9, 0x5, 0x8, 0x3, 0x8, 0x5, 0x8, 0x1, 0x3, 0x7fffffff, 0x8, 0x2845, 0x2, 0xe9, 0x2a, 0x3, 0x891, 0x8, 0x1, 0x12, 0x6, 0xfff, 0xffffc9b5, 0x80000000, 0x2, 0x6, 0x6, 0xaa, 0x0, 0x8, 0x0, 0x0, 0x5, 0x1, 0x4, 0x40, 0x4, 0x7, 0xa, 0x8000, 0x1, 0xffffff2d, 0x3, 0xffff7fff, 0x2, 0x3, 0x6, 0x2f1e, 0x8, 0xfcb, 0x8, 0x1, 0x9, 0x6fe68a84, 0x200, 0x1, 0xfffffff9, 0xb, 0x4, 0xab, 0x8, 0x7, 0x0, 0xe, 0x10001, 0x8, 0xa, 0x6, 0x0, 0xa1, 0x7, 0xffff519d, 0x9, 0x4, 0x2, 0x3, 0x1, 0x2, 0xe34d, 0x3, 0x1, 0x1e9, 0x9, 0x101, 0x200, 0x4, 0x4, 0x1, 0x5, 0x5, 0x7, 0x5, 0x0, 0x7, 0x80, 0x2, 0x2, 0x1, 0x5, 0x101, 0x7, 0x27, 0x9, 0x7e31, 0x8800, 0x1000, 0xf85f, 0x10000, 0x7fe, 0xffffffff, 0x7, 0x4af, 0x7e21, 0x1, 0x5027, 0x8, 0x10000, 0x4, 0x3, 0x7, 0x680, 0xc1, 0x2, 0x7, 0x8, 0x401, 0x74dc, 0x400000, 0x401, 0x92c, 0xffff32d2, 0x4, 0xafcf, 0x7f, 0x5, 0xffff0000, 0x0, 0x8, 0x200, 0x4a, 0x4000, 0x0, 0x9, 0x10000, 0x4d4fbb35, 0xb2, 0x4, 0x5, 0x0, 0x100, 0x8001, 0x6, 0xfffffff8, 0x9, 0x2, 0x81, 0x2, 0xc, 0xa, 0x94, 0x3b0, 0x401, 0x118966c9, 0xe56, 0x8, 0x7, 0x1800000, 0x6a, 0x9d6, 0x200, 0x2, 0x40, 0x7, 0x8000, 0x7e, 0x6, 0x5, 0x7, 0x4, 0x3, 0xff, 0xe, 0x4, 0x5]}, @TCA_POLICE_PEAKRATE={0x404, 0x3, [0x9, 0x1, 0x5, 0x53e5, 0x7f, 0x4, 0x3000000, 0x0, 0xf0000000, 0x7, 0xfff, 0xe, 0x7, 0xf8, 0x1ff, 0x3, 0x800001, 0xfffffffb, 0x8001, 0xff, 0x0, 0xfff, 0x80, 0x1, 0x5, 0xffff, 0x6, 0x1, 0x7, 0x9, 0x10000, 0x0, 0x5, 0xe184, 0x4, 0x1, 0xadd, 0x1, 0x16, 0x4, 0xa35c, 0xc, 0x80, 0xff, 0x6, 0x2, 0xd, 0x4, 0x3, 0x5, 0x4, 0x401, 0x4, 0x4, 0x1, 0x3, 0x8, 0xfffffffc, 0x3, 0xc1, 0x2, 0xffff, 0x80, 0xfffffff1, 0x7ff, 0x9, 0xfffffffe, 0x2, 0x6, 0x80, 0x200, 0x1000, 0xb11a, 0x0, 0x5, 0x8, 0xf49d, 0x5, 0x3361, 0x435, 0x7fffffff, 0x2, 0x6, 0xc8, 0x9, 0x0, 0xee2, 0x4, 0x401, 0xfffffffa, 0x100, 0x2, 0x0, 0x3, 0x5dd3c81c, 0xffffffff, 0x7, 0x3, 0x81, 0x9, 0x5, 0xfffffffc, 0x6, 0x1, 0x8, 0x3, 0x0, 0x6, 0xc, 0x8, 0x6, 0x100, 0x1, 0xb5a, 0x7, 0x4, 0x18, 0x8, 0x31, 0x1ff, 0x4, 0x9, 0x400, 0x2, 0x6, 0x7, 0x9, 0x91e7, 0x5, 0x7, 0x81eb, 0x400, 0xfffc, 0x9, 0x9, 0x6, 0x7, 0x6, 0xea, 0x1000003, 0x9, 0x4, 0x3, 0x7, 0x3, 0x8, 0x1, 0xbf0, 0x7, 0x7, 0x66, 0x7, 0x6, 0x3, 0x9, 0x0, 0x9c4, 0x7fff, 0x7, 0x800, 0x5, 0x9, 0x10001, 0x4, 0x2a64aeea, 0x0, 0x5, 0x2, 0x1, 0xf, 0x1ff, 0x400, 0x3, 0x3ff, 0xb, 0x39, 0x0, 0x8, 0xffffffff, 0x0, 0x8, 0x6, 0x9, 0x2, 0xffffffff, 0x401, 0x9, 0x800, 0x9, 0xeb, 0x8, 0x6ed, 0x5, 0x2004, 0x4c3e, 0x1bd, 0x381, 0x4282, 0x4, 0x7, 0x1, 0x4, 0xfffffff7, 0x5, 0x7, 0x0, 0x46, 0x9, 0x3, 0x3, 0x6, 0x9, 0x4, 0x1, 0x4, 0xfffeffff, 0xe, 0x3ff, 0x80000000, 0x7, 0x80, 0x7, 0x10042b, 0x7, 0x7, 0xfff, 0x5, 0x8, 0xffffffff, 0xffff671f, 0x7, 0x2, 0x80, 0x6, 0x4, 0xd, 0x1, 0xff, 0x2, 0x5be228d5, 0x2, 0x0, 0x8, 0xaff0, 0x8001, 0x7, 0x1, 0x7, 0x0, 0x51e, 0x2, 0x6, 0x4, 0xfffffffc, 0xd97, 0xa8]}, @TCA_POLICE_TBF={0x3c, 0x1, {0x0, 0x3, 0x4, 0x6, 0x0, {0x7, 0x2, 0x3, 0x10, 0x4, 0x8}, {0x5, 0x0, 0x9, 0xe23, 0x100, 0x5}, 0x7, 0x99, 0xef2}}, @TCA_POLICE_AVRATE={0x8, 0x4, 0xadd1}, @TCA_POLICE_RESULT={0x8, 0x5, 0x3ff}]}, @TCA_U32_SEL={0x24, 0x5, {0xd, 0x7, 0x1, 0x3d3f, 0x0, 0xfff, 0x3, 0x58f, [{0x0, 0x20008000, 0x4, 0x1}]}}]}}, @TCA_RATE={0x6, 0x5, {0x2, 0xe}}]}, 0x8b4}, 0x1, 0x0, 0x0, 0x4000000}, 0x24040084) r7 = socket$inet_sctp(0x2, 0x1, 0x84) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r8, 0x8971, &(0x7f0000000000)={'netdevsim0\x00', @remote}) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETSETELEM(r9, &(0x7f0000004ec0)={0x0, 0x0, &(0x7f0000004e80)={&(0x7f0000001440)=ANY=[@ANYBLOB="050000000d0a01030000000000000000000000070900020073797a310000000014000380040000800c0000800800034019bd24e108000440000000010800044000000001"], 0x44}, 0x1, 0x0, 0x0, 0x4000000}, 0x14004000) shutdown(r7, 0x1) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000850}, 0x24000000) r10 = socket(0x1e, 0x4, 0x0) sendmmsg(r10, &(0x7f00000030c0), 0x0, 0x9200000000000000) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000680)=@newtfilter={0x43c, 0x2c, 0xd27, 0x70bd25, 0x8000, {0x0, 0x0, 0x0, 0x0, {0x0, 0x6}, {}, {0xffff, 0x9}}, [@filter_kind_options=@f_flow={{0x9}, {0x40c, 0x2, [@TCA_FLOW_POLICE={0x408, 0xa, 0x0, 0x1, [@TCA_POLICE_PEAKRATE={0x404, 0x3, [0x81, 0xffffffff, 0xda, 0x3, 0x0, 0x2a, 0x100, 0x73d, 0x3509, 0x3, 0x10000, 0x7, 0x1000, 0x9, 0x3, 0x3, 0x882e, 0x8, 0x8, 0x2, 0x9, 0xfffffffb, 0x2, 0x6, 0x80000000, 0x400, 0x9, 0xffff, 0x7a, 0x6, 0x7, 0x7fff, 0xffffff40, 0x9, 0x6, 0x8, 0x2, 0x57, 0x0, 0x4, 0x80, 0x9, 0xfffffffb, 0x2, 0xcf9f, 0x0, 0x7, 0x8, 0x1, 0x5, 0xfffffff9, 0x8, 0x80000001, 0x8, 0x4, 0x9, 0x8, 0xfffffffd, 0x15, 0x7, 0xc, 0x8, 0x4, 0x3, 0xfffffe00, 0x7, 0x3, 0x800, 0x1, 0x4, 0x2, 0x1, 0x1, 0x801e, 0x7, 0x4, 0x0, 0x8, 0x5, 0x48001, 0x5, 0x1, 0x1000, 0x9, 0x1, 0x7ff, 0xd0, 0x8, 0x0, 0x3, 0x1, 0x9, 0x10, 0x7fff, 0xfffffff8, 0x7, 0x0, 0xb1, 0x3, 0xffffff40, 0x1, 0x6ddd, 0xf, 0x6, 0x556, 0x1, 0x2c, 0x5, 0x80000001, 0x1, 0x0, 0x200, 0x3, 0x2, 0x6, 0x9, 0x1c00, 0x5, 0xa2, 0x3, 0x8, 0x0, 0x5, 0x8001, 0xbfffffff, 0x7, 0x80, 0xb, 0x0, 0x743, 0x5, 0x3, 0x0, 0x200, 0x5, 0x0, 0x8, 0x3, 0x100, 0x2, 0x8, 0xfffffffe, 0x6, 0x8, 0xe, 0x5, 0x6, 0x5, 0x7ff, 0x5, 0xfffffffe, 0x1c0, 0xf80, 0x7, 0x116b, 0x2302, 0x9, 0x3ff, 0x2, 0x5, 0x1, 0x6, 0x3, 0x4, 0x10001, 0x512d, 0x1, 0x5, 0x2, 0xa3c0, 0x4, 0x8000, 0x10001, 0x15a, 0x6, 0x120000, 0x9, 0x7fffffff, 0x7, 0x9, 0x80000004, 0x5, 0x7e5, 0x48, 0x9, 0x7, 0x10, 0x5, 0x6, 0xf, 0xff, 0x11, 0x6, 0x9, 0x0, 0x200, 0x9, 0xff, 0x4, 0x7, 0x7, 0x8, 0x4, 0x56, 0x4a82, 0xffff0000, 0x7ff, 0x3e1, 0x6, 0x80000000, 0x4c0, 0x5, 0xa, 0x6, 0x2, 0x10000009, 0x8, 0x48, 0x1a, 0x2000000, 0x1ff, 0x844, 0x6, 0x3ff, 0x2, 0x400000, 0x6, 0xffffffff, 0x200, 0xc26, 0x4, 0x5, 0x1, 0x7fff, 0xf, 0x401, 0x401, 0x4, 0x7, 0x3565, 0x2, 0x2, 0xebf, 0x3, 0x1000, 0x0, 0x71f, 0x2, 0xc59, 0x6e8, 0x8, 0x101, 0x80000000, 0x6, 0xc, 0x2]}]}]}}]}, 0x43c}, 0x1, 0x0, 0x0, 0x1}, 0x800) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000780)=ANY=[@ANYBLOB="f0000000100007000000000000000000fc020000000000000000000000000000e00000020000000000000000000000004e1f000100000000000000003b000000", @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="64010101000000000000000000000000000000003c000000ff01000000000000000000000000000100000000000000000500000000000000020000000000000000010000000000000000001000000000ffffffffffffffff00000000000000010000000000000000070000000000000000002000000000000700000000000000040000000000000000000400fdffffffe80a00002bbd7000000000000a0002003400000000000000"], 0xf0}}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) r11 = socket$nl_route(0x10, 0x3, 0x0) sendmsg(r11, 0x0, 0x0) 1.045869685s ago: executing program 2 (id=3226): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002c80)={0x3, 0x4, &(0x7f0000000680)=ANY=[@ANYBLOB="18020000030000000000000000000000850000009700000095"], &(0x7f0000000240)='syzkaller\x00'}, 0x94) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000680)=ANY=[@ANYBLOB="380000001900010028bd7000fbcbdf240a202000000000020024000008001f"], 0x38}}, 0x8000) (async) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) socket$packet(0x11, 0x2, 0x300) (async) sendmsg$IPCTNL_MSG_EXP_GET(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x14, 0x1, 0x2, 0x801, 0x0, 0x0, {0x1, 0x0, 0x2}}, 0x14}, 0x1, 0x0, 0x0, 0x44800}, 0x804) (async) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r0, 0x0, 0xe, 0x0, &(0x7f0000000200)="c274386d178550cb864bd57221bc", 0x0, 0x1200000, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 1.025134984s ago: executing program 1 (id=3227): r0 = socket(0x400000000010, 0x3, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) (async) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r2) (async) close(r2) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="020000000400000005000000aa"], 0x50) bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000000), 0x0, 0xa7c, r3}, 0x38) (async) bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000000), 0x0, 0xa7c, r3}, 0x38) r4 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000003080)={0x1b, 0x0, 0x0, 0xb86, 0x0, r0, 0xb, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x4}, 0x50) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000003100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4) bpf$PROG_LOAD(0x5, &(0x7f00000031c0)={0x9, 0x17, &(0x7f0000000700)=@framed={{0x18, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x2}, [@kfunc={0x85, 0x0, 0x2, 0x0, 0x4}, @ringbuf_output={{}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x9}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x2}}, @btf_id={0x18, 0x3, 0x3, 0x0, 0x5}, @ldst={0x1, 0x1, 0x3, 0x7, 0x6, 0x20, 0x4}, @btf_id={0x18, 0x5, 0x3, 0x0, 0x4}, @ringbuf_query, @kfunc={0x85, 0x0, 0x2, 0x0, 0x2}]}, &(0x7f00000007c0)='GPL\x00', 0x101, 0x1000, &(0x7f0000001c80)=""/4096, 0x40f00, 0x8, '\x00', 0x0, @fallback=0xb, 0xffffffffffffffff, 0x8, &(0x7f0000002cc0)={0x1, 0x2}, 0x8, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x2, &(0x7f0000003140)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x1, 0xffffffffffffffff, r1, r3, r4, r5], &(0x7f0000003180)=[{0x5, 0x2, 0x7}, {0x0, 0x5, 0xa, 0xc}], 0x10, 0x4}, 0x94) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) (async) sendmsg$NFT_BATCH(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r6, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a4c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc080003400000001408000c4000000e45400000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a310000000014000380100000800c00018006000100d103000014000000110001"], 0xb4}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) (async) sendmsg$NFT_BATCH(r6, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a4c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc080003400000001408000c4000000e45400000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a310000000014000380100000800c00018006000100d103000014000000110001"], 0xb4}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a300000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a310000001a1547fa0004000380140000001100010000000000000000000100000a3804f8c528af8dc2feb9968ab39a9c514305a25e54787ce6c37ac78140bd987f28acd8896764c2c05a95eb45d925fb7183d7d6d8cb987c9cd169ff02edd99bd7e17bbdf0086392be862806056ed794cd0c9cb84a052cb2ba63c728c288707df292d8b7dfac281ea7ea890d54c2df3e4d047405bb3932acbb71e189669553ba5ac74b25a1b337566c13acbecbb73cb8256da537946d39d7c346942cb011aa9344733112f70af5bf4b89b6493de959075ad514075fdd05e30305d70cd8bb67b4069d6cdca6a33853ba4ea600"/305], 0x58}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) (async) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a300000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a310000001a1547fa0004000380140000001100010000000000000000000100000a3804f8c528af8dc2feb9968ab39a9c514305a25e54787ce6c37ac78140bd987f28acd8896764c2c05a95eb45d925fb7183d7d6d8cb987c9cd169ff02edd99bd7e17bbdf0086392be862806056ed794cd0c9cb84a052cb2ba63c728c288707df292d8b7dfac281ea7ea890d54c2df3e4d047405bb3932acbb71e189669553ba5ac74b25a1b337566c13acbecbb73cb8256da537946d39d7c346942cb011aa9344733112f70af5bf4b89b6493de959075ad514075fdd05e30305d70cd8bb67b4069d6cdca6a33853ba4ea600"/305], 0x58}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$NFT_BATCH(r2, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a480000000e"], 0x70}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) (async) sendmsg$NFT_BATCH(r2, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a480000000e"], 0x70}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) setsockopt$netlink_NETLINK_TX_RING(0xffffffffffffffff, 0x10e, 0xc, 0x0, 0x0) r7 = socket$pppl2tp(0x18, 0x1, 0x1) r8 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r7, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r8, 0x9, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @rand_addr=' \x01\x00'}}}, 0x32) sendmmsg$inet(r7, &(0x7f0000001c00)=[{{&(0x7f0000000040)={0x2, 0x4e22, @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x10, 0x0}}, {{&(0x7f0000000600)={0x2, 0x4e22, @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x10, 0x0}}], 0x2, 0xc014) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r9 = socket$unix(0x1, 0x1, 0x0) r10 = socket(0x400000000010, 0x6, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000600)=@newqdisc={0x34, 0x24, 0x4ee4e6a52ff56541, 0x70bd2b, 0xffffffff, {0x0, 0x0, 0x0, r11, {0x2, 0xfff1}, {0xa, 0xffff}, {0x0, 0xb}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x4}}]}, 0x34}}, 0x4810) (async) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000600)=@newqdisc={0x34, 0x24, 0x4ee4e6a52ff56541, 0x70bd2b, 0xffffffff, {0x0, 0x0, 0x0, r11, {0x2, 0xfff1}, {0xa, 0xffff}, {0x0, 0xb}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x4}}]}, 0x34}}, 0x4810) sendmsg$nl_route_sched(r10, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000001c0)=@newtfilter={0x40, 0x2c, 0xd27, 0x30bd29, 0x25dfdc00, {0x0, 0x0, 0x0, r11, {0xffff, 0xc}, {}, {0x7, 0x1}}, [@filter_kind_options=@f_matchall={{0xd}, {0x4}}, @TCA_CHAIN={0x8, 0xb, 0x3}]}, 0x40}, 0x1, 0x0, 0x0, 0x40000}, 0x44000) r12 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r12, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000001c0)={0x114, 0x2d, 0x1, 0x0, 0x0, "", [@nested={0x102, 0x0, 0x0, 0x1, [@typed={0xc, 0x2, 0x0, 0x0, @u64}, @typed={0x14, 0x4, 0x0, 0x0, @ipv6=@loopback={0x100000000000000}}, @generic="50bb2d6f67d29d6fabadb107d0def49c88ea04abde1d5e8d3fb22a1b5046778bdafefc46b0449ade68bf84b36ec72dd71265fc2e882348c26c2126237dd5b37f5ae655b1086cda40e00aec58754734be31d750351dc076eb43d9621dc08c029d1608a487f26fbe816b89f7cb81bff81a8b9482565856555ee923c65973deb0a99b962bc0fe94a3fcae3697bd7b85b3a682167c43dbf137115a40ebddcad74875ec58e9a3ddb9ad02a078cf0d972df9e99f079767734f69ce475f55ac64337803f5eb4e5842f4d98fe3fa370d47eb640dc5061dc35817c8a66c29be82fd3f"]}]}, 0x114}], 0x1, 0x0, 0x0, 0x1}, 0x0) (async) sendmsg$netlink(r12, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000001c0)={0x114, 0x2d, 0x1, 0x0, 0x0, "", [@nested={0x102, 0x0, 0x0, 0x1, [@typed={0xc, 0x2, 0x0, 0x0, @u64}, @typed={0x14, 0x4, 0x0, 0x0, @ipv6=@loopback={0x100000000000000}}, @generic="50bb2d6f67d29d6fabadb107d0def49c88ea04abde1d5e8d3fb22a1b5046778bdafefc46b0449ade68bf84b36ec72dd71265fc2e882348c26c2126237dd5b37f5ae655b1086cda40e00aec58754734be31d750351dc076eb43d9621dc08c029d1608a487f26fbe816b89f7cb81bff81a8b9482565856555ee923c65973deb0a99b962bc0fe94a3fcae3697bd7b85b3a682167c43dbf137115a40ebddcad74875ec58e9a3ddb9ad02a078cf0d972df9e99f079767734f69ce475f55ac64337803f5eb4e5842f4d98fe3fa370d47eb640dc5061dc35817c8a66c29be82fd3f"]}]}, 0x114}], 0x1, 0x0, 0x0, 0x1}, 0x0) r13 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r13, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) (async) ioctl$sock_SIOCGIFINDEX(r13, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000006040)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000006100)=@delchain={0x24, 0x65, 0x1, 0x70bd2e, 0x25dfdbff, {0x0, 0x0, 0x0, r14, {0xffff, 0xc}, {}, {0xfff2}}}, 0x24}, 0x1, 0x0, 0x0, 0x8848}, 0x20004004) 803.338472ms ago: executing program 0 (id=3228): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000002c0)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x80000001, '\x00', 0x0, 0x0}, 0x48) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000100)={0x5c, 0x2, 0x6, 0x5, 0x0, 0x0, {}, [@IPSET_ATTR_DATA={0x14, 0x7, 0x0, 0x1, [@IPSET_ATTR_CADT_FLAGS={0x8, 0x8, 0x0}, @IPSET_ATTR_TIMEOUT={0x8}]}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_FAMILY={0x5}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_TYPENAME={0xd, 0x3, 'hash:mac\x00'}]}, 0x5c}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0xa, 0x1c, &(0x7f0000000d80)=@ringbuf={{0x18, 0x8}, {{0x18, 0x1, 0x1, 0x0, r0}, {}, {}, {0x85, 0x0, 0x0, 0x5}, {0x4}}, {{0x5, 0x0, 0x3}}, [@snprintf={{0x7, 0x0, 0xb, 0x2}, {0x3, 0x3, 0x3, 0xa, 0x9}, {0x5, 0x0, 0xb, 0x9, 0x0, 0xb}, {0x3, 0x3, 0x3, 0xa, 0xa}, {0x7, 0x1, 0xb, 0x7, 0x8}, {0x7, 0x0, 0x0, 0x8, 0x0, 0x0, 0xfffffdff}, {0x4}, {0x7, 0x0, 0xa}, {0x4, 0x0, 0x7, 0x2, 0x0, 0x0, 0x1d}, {0x18, 0x9, 0x2, 0x0, r0}, {}, {0x46, 0x8, 0xfff0, 0x76}}], {{0x7, 0x1, 0xc, 0x9, 0x4}, {0x6, 0x0, 0x5, 0x8}}}, &(0x7f0000000980)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x2e, '\x00', 0x0, @fallback=0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) close(0x3) 802.280372ms ago: executing program 2 (id=3229): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000080)={0x26, 'skcipher\x00', 0x0, 0x0, 'lrw(serpent)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5910fae9d6dcd3292ea54c7b6", 0x10) r1 = accept4(r0, 0x0, 0x0, 0x0) sendmsg$nl_route_sched_retired(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000025c0)=@newtaction={0x1000, 0x30, 0x800, 0x70bd2b, 0x25dfdbfc, {}, [{0xfec, 0x1, [@m_ipt={0xfe8, 0xd, 0x0, 0x0, {{0x8}, {0xee4, 0x2, 0x0, 0x1, [@TCA_IPT_INDEX={0x8, 0x3, 0x4}, @TCA_IPT_INDEX={0x8, 0x3, 0x6}, @TCA_IPT_TARG={0xecd, 0x6, {0x4, 'security\x00', 0x8, 0x5, "fd19bb28017ce6fd2d4f6b70df11ad503f0c58f1e8389ae1bad5c9a84f86d8c2d51e06420da572c1443fe6aa0cc06abe1848041f942b6822e8f958672598e2ab2d4e5eb762bc4b68d7b13a60e54a7fad5321f3ca4fa513873518eb32f8a9e4d82aa9afe997dceade15dd3895b7a09d8102b6d17306b47eed4ec66360505e7111ac55932dd38f0c11b52e08a956e31712c5b2ba787af3f08e589ce8c1eef514bcc42eb9500d8fdfb391312554e45105a24ff987494179aeda787a2e0c64161784c04696e14b1f27f1cc119e809a8679de937241e4e83a2c60e451a196a9fe0dadb9c2bd5ab9fc6a4241ff61a8fb6bec8c7d4cb80e332b747f647b01d43f516ac6176ce39f01f431f3b6124f42f787eaa16d0a4643a019d5c33eea9ea6e17192bc05808993409137b8794d1c95cfb8458f4c329b9e280b3777f7b7c85f35cbf2407b1fa3a8dc0275ca33a764bfea869a6e794cc1ada93b0d7e2cbf7ba648de4dddac12f131cb446911814601f3a8fa97701ddb9526cfdec38ce1711bd18d9215720e343ee1d9236e5032b5bbe4bab7266372f0987dab36e0c20844a9bdcd18ae2a9d8310304bdb680ce672e17a61a51db2edf496b3e06cd5e2526017b97f79758069bbfe42772ee4812c980fce091be48da0c1b41c3865152773ccd8239ad32bbb50fc1371e9cda7f5e6391e9822d963679b6504661e856f474a24f0aff2126ef68fad3121ec8b66bcf2b3e295c08ffc682982a1d05f844d4f7688f5b6bb33841ada4ba9935c098fad656e063dbd2ec8447587d09edbc87683744f631479d6ce57b2fca45e2dfcb6f233a258423a9a340ab364ea6a6942bda34e9a59626eef6798873574c22990393ace982f5bb7f62e8ce90403da6a662624e64aee517a80bc6d8f241ea3cb42a007ccc81b2792f7512dbb1253d20c4246574a8a1ce07c9c6254b2d1a7fa3af69fb77443a58f074cc5024c914d5fd65e639d25d2a5da24457d475c9dde2e8fcb4aebbf8bf6ce5a1cfa78363a2f04f6f51b32488ff9602d7b2d90e334ee88ac4477ca557c762e06b2e5f06e0b748d64da5b0092cffb0c8d3696289555b612f5fe3801787078d400f8b4beef16f6739b9b66df3620c047abd814bdaec064ecef87761a611509903c3511178d1c3091cd886974ff0605af3ccadc810733e2899b450bb883d5f85f8066634ba46b0ad889a17b1a6d35769794a4614b769604ec5e9b3673b59edd50e95890d5a3ce7915dcff5377256d3f10cd4ab3340d7397436ba11ea07103e0be09bf10099f2bc246ae03b997bf942751f38538cc4d5eba2fd4820c7afeae4a0666170bdca0737e51364775cc77efe9ee6d552a72143ec318a44070e4e426c54dd4bbb59a23f2c3ad0d53582c5ddb5d83616f8f08ac751b082865464ee80374b31754df9f817bb199bf8c077f0fff394446b5dd83737e3bc069cce6417374495cb1aae8831c2c09977ecbe08b628f29f74e75781e7aee596da27f1c937746efca638f66b57e63dd9c5104afe9e63938a46468f16214a18e1a5f757e50ad1e9e2889a03177e70c9a000f0b8c56dc7484eb71ef5df2f8d58cf764f05d6dce50ca3727910c8ace17666370aceaadfcab5499846e736b214d61d51f6badb8e62baafc3f958f29bbdd12720ce22592f0d5185a94d817c3064489f04365f6ed3a18d761eb278feb3037c8247291255a145710b8f6ceb093121536a7e16f814365a64ba1e49ce1147617182d7fcb64572fd37840ce912844bf41958fefad5a24f57903ef7bb29d4a1aff47284a6fbc90d804e4f1507aa892702976eb8f5e447bc3b48e41910cb82914c1de111ecc6a0b13184e6ea12ff24521fa5a9963c9b7a016585e831448eeaf58a9f35063beb2652371a61c45902049e96ceb89e1c8ce05655c683f574a585f6d892ef2f4ba76111fa92a2b5e1fc8c7cd9d1e90ff470c04c6554885e426ae4d09ee492892cbd0948e8e98750f3c4eba4b320455ebe6c64bc2063b91ce9686018851df2f5e89dfacbfecdbe6c71c17975c9e67adb7179aa868e83499c0f723bb2e101c1392be7f6422b0b06b054d730681342327bfa805dbf9f1a8fa1186a353618b2a12a735e6a6b0a4b718ec97d0ef870e5b84cf9d6bd65a0f9181ffde9ac86f81874493a9451ab81ccaf674b47feaa8d52f1caa56e9bb3e220b4b095b564805ef7aac33042abb6baca2fc96bb7ecc68d7da82518eb14e32d966222a57ca1537e5a867ecbbf6157b73dcc0f3a3519a2473b11bb6a90c9a699724bd702530a1c59b06aa16e848dd049fa1aef534cdccdea94998bfdbfce9856905dcd647a2e5f3d6349d5cdfd26f94f04d97fb5c44283b625ceba7af5e47da7e58fb0575f1cd1e28ce555a9ad0ad85fbaba0f9c0f89aa2166c3ea5ddd98dca5d146486f994fea3f79f76b9446e761decd4a6881de91c91bb088104ef2c4eb5ede8d8fd12d7411de89894d3aa5602864e8a2c6884f2c4a1c3614a7e54eecdd25ba1f7ad7cc08ccc99816867f4305bab7369255a17a1a10cf972caa989977f328f7eb61e04a0b02270f9a1add0b1fe134edb0119b9ef695d3c975c1cb5478f62b64e869878cff5e48005594db6e5e122aa1a34b3539c8956cd74981447e0eb8e7f63577390ed6b9a6c9bfc8b7339e49f4d88743719b7a1ca3b8695095a640b9293e032bbad5ee28dbcbb686529e61001d3d7a60cc88cc4df4d6f9767137fe9c7f37361dfe90c9cd22eb2c0a95a1481b9809a9e8c26bfda3a0ab1b01e289f350aed3a03ea521f6624d10861f81beef936f58972834fc0619cc2879ebdc54834cb6572b8cd376af30bdbe39b4cd484bbdc4d63f7144bcd2374223d837a9af51809c2df59c2ee857a1680f3c0d35e01adb9ad426813c4131d2a33473980019d9844e00c2a1d7dd3d0b2290d048929edba30e2fb8403920a22e44698b84ab3ababefbb49ec88bd0d50f5884f3e92035cf83419cf3b1e686757033f05d4f6b98d40f0b32c1a134e1b0c0bdd1108425a6199085876d70cf27b9540c9884653742e7707aa9891d08e61bd9045e8b99a3316cfb8348f77ed3a7ac6ba683f0df7177819e967f602fdd6dec4a987b55c535d29fb5da3b3670430833010844a6969b5f57d18dd3e0bc4bcc8847540b5c7986706a4d5ab9c3038b71ffd106e69c73cf40474623cd260ba2634b438d160e37d9035dd2419fc6d151260a65568c68b4baa1c5f393549686d0519eb4b4378971e4a477b14b562d919bb89279083be989eaceccc0bcd11c861a7c3b714c9a9007dee78ba8519879548079a648bbaaa11f3b677a3a718baf896dad3270a7dda6c62a0b632f97ae7b1717a82ae1456d2cd9380d02e53d5107db7dff534f185a86cc9261539b45ad98631b5ef28057da8bb91d9da9429870e94dbaca29d063a6a3617057241c6e3acb14bbff7bffa27a2046fe1c2788607bb28efbd2f5e47bfc18cc3dcf89ac4049caa55996034911e20caa33449b77ac0fb27f8f29c1d9dac80d5dca39a94cba15176247c5d93c0fcd5be22fd739837b5dd57dd969aadbacbd6cff1230406483ae3de2947ea1402a869c7f7fd79fcd0987adc5621af32d4082870e6602bd5e0d4d4d58f2de053f5fcf396c0be8051694eb84d2c3921aef998e4b6b48da623c195409518220860799c6867c6c6224420f7d154cdb2faa53f6f55f6e5787254f00a10cf4463fe48494801550658b8bff5d9d4aaa0f6f4992e0717a62b942e89dc953e2442cafc1f6739be286e66bf5919c185f7040485a151138132e47f930a77240c1226e6ce87e39ff2b4eac3b062fd0fd0346f580fed4849653407cbdaf6925542da905715339e4d94b746511de94ef11eaff870a56b12a226622405cd5210f198071a7388dce725f3d44a0a1ba23f633221048639eed9a8b66ff139cc2bcdc72cca92575d5415f9d8cde66a3dee6e3e3ce1b5070b939cb704bc2520f8d6a084ff7e0dda52bfb61e719226dbde44b21ee0989158b25693abc48cfec76255fc057ff0054b37321c626021abb901085f94f6fbbb4dd64031d97fe6f8fba3475d1d64e6672d58500d06fba0a102d7ac8a39737ed55d4f498bc1e01f9f4ed4cd7458b2ed652a1e841cec9fb55217603a57ee5ea0cb058211e9113a3b16e6214472a056cdfe9f69115cfc2475e85c223b22321da3ecfa0ed905be0b5554a0f6a9dde5c141aef10723441b16f8b5d8f92dcca3d2f9b9868b07b846b95dde5b8ad14428784f64e898abe8ba5db83bfe9af6da1f8574b3bc118f16515c0bd9bd4ce186eb157ee1fc4533157bad2551b4b2533389ef1c88c1b6a513d6869caade0501f30ae8917a153b9cb1bc81a8f06fd873979cabf771a9f8ef6c37f44e35c06fa9e604940414efeb72536969e78971609a0bd95d5c869ff9f1fdf3315245b0bf494342721f42a661d8e89aa177e372f874e0d7fabb0716602d593576e100cdd7b7815e0e02abb5b145467e58a0dd209f3d1c2da5df2787d9171d01a35442f83a22d0988377c2d366fbad52790001392a413b44f5247ff944a981b2f20aed5bb1134533016107ea425821061312ae0d60eb83b18f6238a38a362b5bc1428de462d5c30ac714c4b6a6f240766f28c49db5a392c91f7d54ea8aeabe69ed4237cf09111be631ac5a8244f52e090646ce891f49f1562085d7f0ea8e7d7bb0b4f02cab44a8756480739df554f2a78eccedc7c753f211b9e10220804e3ed71ea5adbec1e9642fa3c56bf986df155f0b3e585063ae0d1926998b4eddc41b09d95a20569d2d6138a4efb4e4f30eead6c017bc829f2e887f2327264d39fe8fed57c698dc4999f9df5607955ad6174ccac89cbcde128ad661f7a05a5d0c45f00a0a576840769b429b1daa2b5eb9f57a7e224f0d44019ab6c6933ec4991497d52d3871fca581875fa02a5c51d84952b07c52940cc4073b4cb8b1d6bf5634ce1a0125b36082dbd543369ff58c5727a622cb11145aed1fb9c322aa921a46c88f047ab2860ee5e12844e9961d1cbefbe6e6e3ded69f5a0a2c4338891ea7685b49b33a5f5be6c433fd2fb297ce76de142ea99474668dea5a77e87b6f1e06fea4ad9bac056c2777990b7b6b601eca9bcc69099c905aa447b59c08eaa357827c889d30716ae5fba532e99923970796d082f340c82f2b0fd2a9d0b751542db16a8906e570726af6c184923871119e3d62eaebba119548367150e035a4d7c7b08d49424e4018fd5d2b88f88e6a660b9046cf5faf59f294c9c8da8275a0f7a449244fb6e8acd068ffcc8d44dc28e6d6e52672fd3277a4"}}]}, {0xdd, 0x6, "7e7579ad8f441cf3ed4db3a12799a7370b9a7e31ee6ba8833f2d42ab7a9c3cf55fd690e3aeec0560156bb90473043b6c6eb1cc7e2234da9d0a0c593e65351125f105929dfda2181ed6d7881e4d0dae0893e2580a0ab132ffceb539d7c670535a28b3e064d8cbc990e204111dae8c27b9c553345b8abc94639fb230edbf49d39ecf0d3f7b1681aa73b9a8bd9ac2db614bb398b3c4e49338ad8d0f474116114417a9ff14ba4e6e313387d59f8e6f0d0adf1380d173ae480cc3b7187d107fd58c1793864d2145bb6bfcbd509d8c5c8af765e577ec94d21ecc11a2"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x1}}}}]}]}, 0x1000}}, 0x4008800) recvmmsg$unix(r1, &(0x7f0000000e00)=[{{0x0, 0x0, &(0x7f0000000700)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x8, 0x32, 0xffffffffffffffff, 0x0) connect$rds(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x4e23, @empty}, 0x10) r2 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x50) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r3, &(0x7f0000000000)=ANY=[], 0x3261e) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x9, 0x13, r3, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000280)={0x18, 0x17, &(0x7f0000000380)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x9}, {{0x18, 0x1, 0x1, 0x0, r2}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xfeff}, {0x85, 0x0, 0x0, 0x86}}, {{0x5, 0x0, 0x5, 0x9, 0x0, 0x1, 0x80000000}}, [@printk={@li, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x2}}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x3}, {0x85, 0x0, 0x0, 0x85}, {0x7, 0x0, 0xb, 0x0, 0x0, 0x0, 0x500}}}, &(0x7f0000000080)='GPL\x00', 0xa, 0xff8, &(0x7f0000000780)=""/4088, 0x41000, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3}, 0x94) 557.9766ms ago: executing program 2 (id=3230): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_buf(r1, 0x29, 0x30, &(0x7f0000000200)="7ee7a8a95072049f61a78d6839361705cd04240dfed881a36cabf592b2dbde338ea9f830af5abd06eb54c9f092b0cac6bb7ba773c6c01a6ed5202bfc228c4593af8881254964a9fd7ee479ec8ff521e1072d4a9282371caf4ba43579e828a60de33ea64fe5e3c66219542d9c2258fb535b678a5c8e59caf79254af123c944a81ebe6ec49411af5f5e8c80579a350c94f", 0x90) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'batadv_slave_1\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="6400000010000104000002000004000000000000", @ANYRES32=0x0, @ANYBLOB="8bd00500b072060008000500", @ANYRES32=r2, @ANYBLOB="3c00128009000100766c616e000000002c0002800600010004000000040004801c0003800c", @ANYRESHEX=r2], 0x64}, 0x1, 0x0, 0x0, 0x240008c4}, 0x4054) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r1, 0x8982, &(0x7f0000000040)={0x0, 'ip6gretap0\x00', {0x3}, 0x7}) 204.458996ms ago: executing program 0 (id=3231): bpf$TOKEN_CREATE(0x24, &(0x7f0000000000), 0x8) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f00000002c0)={'syztnl2\x00', &(0x7f00000001c0)={'sit0\x00', 0x0, 0x80, 0x1, 0x8, 0x3, {{0x35, 0x4, 0x3, 0x1, 0xd4, 0x68, 0x0, 0xc, 0x2f, 0x0, @local, @private=0xa010100, {[@timestamp_addr={0x44, 0x4c, 0xf3, 0x1, 0xa, [{@multicast1, 0x401}, {@rand_addr=0x64010100, 0xfffffffb}, {@local, 0xb}, {@broadcast, 0x8}, {@initdev={0xac, 0x1e, 0x1, 0x0}, 0x7}, {@multicast2, 0x9}, {@multicast1, 0x57b4f945}, {@dev={0xac, 0x14, 0x14, 0x16}, 0x7}, {@multicast1, 0x6}]}, @end, @timestamp_addr={0x44, 0x34, 0x23, 0x1, 0x4, [{@multicast1, 0x5b}, {@empty, 0xac2d}, {@multicast1, 0x5}, {@local, 0x7ff}, {@dev={0xac, 0x14, 0x14, 0xb}, 0x10}, {@private=0xa010101, 0x40}]}, @timestamp_addr={0x44, 0x3c, 0xf9, 0x1, 0x8, [{@broadcast, 0x31d6}, {@private=0xa010102, 0x7}, {@remote}, {@dev={0xac, 0x14, 0x14, 0x2d}, 0x8}, {@multicast2, 0x1}, {@initdev={0xac, 0x1e, 0x8, 0x0}, 0x7b0e9381}, {@rand_addr=0x64010102, 0x10001}]}]}}}}}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)={'geneve1\x00', 0x0}) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000180)={'syztnl0\x00', &(0x7f0000000100)={'syztnl0\x00', r0, 0x4, 0x9, 0x2, 0x1, 0x40, @mcast1, @loopback, 0x7800, 0x80, 0x0, 0x5}}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x0, 0x0, &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x1e, '\x00', r1}, 0x94) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r2, 0x6, 0x20, &(0x7f0000000040)=0x2, 0xf6) 0s ago: executing program 0 (id=3232): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0f000000040000000400000012"], 0x48) socket(0x2a, 0x4, 0x9d32) ioctl$XFS_IOC_PATH_TO_FSHANDLE(0xffffffffffffffff, 0xc0385868, &(0x7f0000000180)={0xffffffffffffffff, &(0x7f0000000000)='cgroup\x00', 0x101, 0x0, 0xf, 0x0, 0x0}) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r2 = socket$netlink(0x10, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=@newtaction={0x6c, 0x30, 0xffff, 0x0, 0x0, {}, [{0x58, 0x1, [@m_ife={0x54, 0x1, 0x0, 0x0, {{0x8}, {0x2c, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c, 0x1, {{0xa, 0x80, 0x3, 0x0, 0x10}}}, @TCA_IFE_METALST={0xc, 0x6, [@IFE_META_TCINDEX={0x6, 0x5, @val=0x6}]}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x6c}}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd27, 0xffffffff, {0x0, 0x0, 0x0, r4, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x8, 0x4}}]}}]}, 0x48}}, 0x20040084) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x2c, &(0x7f0000000540)={&(0x7f00000008c0)=@newqdisc={0x3c, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdfc, {0x0, 0x0, 0x0, r4, {0xffe0}, {0x3, 0xffff}, {0xffe0, 0x1}}}, 0x3c}, 0x1, 0x0, 0x0, 0x400dc}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = openat$ppp(0xffffffffffffff9c, &(0x7f00000001c0), 0x88802, 0x0) ioctl$PPPIOCNEWUNIT(r7, 0xc004743e, &(0x7f0000000140)) ioctl$PPPIOCSFLAGS1(r7, 0x40047459, &(0x7f00000000c0)=0x41) ioctl$TUNSETTXFILTER(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)=ANY=[@ANYBLOB='..']) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r8, &(0x7f0000000100)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r8, 0x0) ioctl$PPPIOCSFLAGS1(r7, 0x40047459, &(0x7f0000000000)=0x4210) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=@newqdisc={0x8c, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffe00, {0x0, 0x0, 0x0, r9, {0x8}, {0xffff}, {0xfff2, 0xffe1}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x5c, 0x2, [@TCA_TAPRIO_ATTR_PRIOMAP={0x56, 0x1, {0xe, [0xc, 0x5, 0x0, 0xf, 0x10, 0x2, 0x4, 0x2, 0xf, 0x6, 0x6, 0x1, 0x8, 0x4, 0x10, 0x4], 0x3, [0xb, 0x5, 0x7fff, 0x2002, 0x1, 0x4, 0x2, 0xd06, 0xff05, 0x8000, 0xb, 0x3, 0x1, 0x6, 0xd, 0x100], [0x2, 0x5, 0x2, 0xfff5, 0x4, 0x8, 0x7, 0x9, 0x5, 0x2, 0xc, 0x40, 0xfffc, 0x3, 0x1, 0x1]}}]}}]}, 0x8c}, 0x1, 0x0, 0x0, 0x400dc}, 0x0) socket$unix(0x1, 0x1, 0x0) r10 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cpuacct.usage_percpu_sys\x00', 0x275a, 0x0) vmsplice(r10, &(0x7f0000000040)=[{&(0x7f0000000300)="5d119872", 0x4}], 0x1, 0x2) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000080)={{r0, 0xffffffffffffffff}, &(0x7f0000000000), &(0x7f0000000040)}, 0x20) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x7, &(0x7f00000001c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0xfffffffe}, [@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r11}}]}, &(0x7f0000000180)='syzkaller\x00', 0x8, 0x102f, &(0x7f0000001200)=""/4121, 0x40f00, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x9}, 0x94) kernel console output (not intermixed with test programs): .2399': attribute type 1 has an invalid length. [ 450.880782][T15600] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2401'. [ 450.905586][T15588] syzkaller0: entered promiscuous mode [ 450.913806][T15586] netlink: 256 bytes leftover after parsing attributes in process `syz.0.2399'. [ 450.928098][T15607] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2401'. [ 450.950804][T15588] syzkaller0: entered allmulticast mode [ 450.965272][T11777] netdevsim netdevsim3 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 450.979958][T11777] netdevsim netdevsim3 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 451.006759][ T6750] bond0: (slave dummy0): failed to get link speed/duplex [ 451.093760][ T6736] netdevsim netdevsim3 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 451.104135][ T6736] netdevsim netdevsim3 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 451.127200][T11777] bond0: (slave dummy0): failed to get link speed/duplex [ 451.162467][ T84] netdevsim netdevsim3 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 451.193319][ T84] netdevsim netdevsim3 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 451.291302][T15620] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2406'. [ 451.304820][T11777] netdevsim netdevsim3 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 451.328589][T11777] netdevsim netdevsim3 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 451.376091][ T6750] bond0: (slave dummy0): failed to get link speed/duplex [ 451.591040][T15635] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2408'. [ 451.856815][T15653] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2412'. [ 451.919636][T15650] xt_CT: You must specify a L4 protocol and not use inversions on it [ 452.126182][T15654] lo speed is unknown, defaulting to 1000 [ 452.298641][T15665] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2414'. [ 452.361359][T15669] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2416'. [ 452.780212][T15675] batadv_slave_1: entered promiscuous mode [ 452.910956][T15678] atomic_op ffff888056fe8998 conn xmit_atomic 0000000000000000 [ 453.002477][T15682] netlink: 34 bytes leftover after parsing attributes in process `syz.3.2419'. [ 453.186375][ T5636] Bluetooth: hci4: command 0x0c20 tx timeout [ 453.300084][T15680] netlink: 'syz.2.2418': attribute type 1 has an invalid length. [ 453.563745][T15695] unsupported nlmsg_type 40 [ 453.833511][T15709] bond10: down delay (5) is not a multiple of miimon (2), value rounded to 4 ms [ 453.864700][T15709] bond10: entered promiscuous mode [ 453.876365][T15703] lo speed is unknown, defaulting to 1000 [ 454.098171][T15724] netlink: 'syz.0.2428': attribute type 3 has an invalid length. [ 454.366116][ T185] net_ratelimit: 21 callbacks suppressed [ 454.366140][ T185] bond0: (slave dummy0): failed to get link speed/duplex [ 454.635537][ T47] bond0: (slave dummy0): failed to get link speed/duplex [ 454.816100][ T47] bond0: (slave dummy0): failed to get link speed/duplex [ 454.936406][ T47] bond0: (slave dummy0): failed to get link speed/duplex [ 455.085722][ T6750] bond0: (slave dummy0): failed to get link speed/duplex [ 455.226279][T15757] 8021q: adding VLAN 0 to HW filter on device macvlan4 [ 455.247583][ T6750] bond0: (slave dummy0): failed to get link speed/duplex [ 455.387639][ T6750] bond0: (slave dummy0): failed to get link speed/duplex [ 455.454186][T15764] netlink: 'syz.4.2436': attribute type 10 has an invalid length. [ 455.526899][T15765] netlink: 'syz.4.2436': attribute type 10 has an invalid length. [ 455.539296][ T185] bond0: (slave dummy0): failed to get link speed/duplex [ 455.666430][ T185] bond0: (slave dummy0): failed to get link speed/duplex [ 455.796583][T11777] bond0: (slave dummy0): failed to get link speed/duplex [ 456.337140][T15778] __nla_validate_parse: 9 callbacks suppressed [ 456.337155][T15778] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2440'. [ 457.971507][T15749] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 457.983893][T15757] netlink: 'syz.4.2436': attribute type 1 has an invalid length. [ 457.994938][T15757] netlink: 224 bytes leftover after parsing attributes in process `syz.4.2436'. [ 458.514768][T15821] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2449'. [ 458.672716][T15821] 8021q: adding VLAN 0 to HW filter on device bond11 [ 458.918468][T15848] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2456'. [ 458.988441][T15850] netlink: 'syz.3.2457': attribute type 13 has an invalid length. [ 459.003737][T15850] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2457'. [ 459.018002][T15854] netlink: 36 bytes leftover after parsing attributes in process `syz.0.2459'. [ 459.028975][T15848] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2456'. [ 459.050903][T15854] netlink: 40 bytes leftover after parsing attributes in process `syz.0.2459'. [ 459.165866][T15856] lo speed is unknown, defaulting to 1000 [ 459.406557][ T47] net_ratelimit: 30 callbacks suppressed [ 459.406579][ T47] bond0: (slave dummy0): failed to get link speed/duplex [ 459.555597][ T47] bond0: (slave dummy0): failed to get link speed/duplex [ 459.654285][T15878] ip6tnl0: left promiscuous mode [ 459.664752][T15878] ip6tnl0: left allmulticast mode [ 459.694031][T15878] 8021q: adding VLAN 0 to HW filter on device .` [ 459.702852][T15889] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2468'. [ 459.707619][T15878] 8021q: adding VLAN 0 to HW filter on device team0 [ 459.724637][T15878] batman_adv: batadv0: Interface activated: dummy0 [ 459.731953][T15878] batadv0: mtu less than device minimum [ 459.739873][T15878] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 459.751833][T15878] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 459.763763][T15878] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 459.775726][T15878] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 459.787484][T15878] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 459.799195][T15878] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 459.811046][T15878] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 459.871472][T15896] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2468'. [ 459.908713][T15878] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 460.097039][T15878] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 460.185802][T15878] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 460.196355][T15878] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 460.218979][T15884] tipc: Enabling of bearer rejected, failed to enable media [ 460.325076][T15889] 8021q: adding VLAN 0 to HW filter on device bond9 [ 460.518830][T15894] 8021q: adding VLAN 0 to HW filter on device bond9 [ 460.534516][T15894] bond9: (slave vti0): The slave device specified does not support setting the MAC address [ 460.546935][T15894] bond9: (slave vti0): Error -95 calling set_mac_address [ 460.842562][T15857] lo speed is unknown, defaulting to 1000 [ 461.201167][T15952] IPVS: set_ctl: invalid protocol: 41 10.1.1.2:20004 [ 461.228388][T15945] tc action pedit 'at' offset 9 out of bounds [ 461.492523][T15961] tipc: Enabling of bearer rejected, failed to enable media [ 461.663289][T15969] __nla_validate_parse: 3 callbacks suppressed [ 461.663308][T15969] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2485'. [ 462.071342][T15988] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2489'. [ 462.090482][T15989] xt_policy: too many policy elements [ 462.436114][T15999] netlink: 'syz.2.2494': attribute type 1 has an invalid length. [ 462.744770][T16002] bond10: (slave veth23): Enslaving as an active interface with a down link [ 462.803625][T16003] bond10: (slave vlan3): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 462.832444][T16013] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2496'. [ 462.861029][T16013] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2496'. [ 463.238312][T16016] sctp: [Deprecated]: syz.2.2497 (pid 16016) Use of int in maxseg socket option. [ 463.238312][T16016] Use struct sctp_assoc_value instead [ 464.139454][T16053] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2508'. [ 464.150846][T16055] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2509'. [ 464.190124][T16055] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2509'. [ 464.297475][T16055] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2509'. [ 464.298982][ T84] netdevsim netdevsim4 eth0: set [0, 1] type 1 family 0 port 8472 - 0 [ 464.343645][ T84] netdevsim netdevsim4 eth1: set [0, 1] type 1 family 0 port 8472 - 0 [ 464.344097][T16055] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2509'. [ 464.380343][ T84] netdevsim netdevsim4 eth2: set [0, 1] type 1 family 0 port 8472 - 0 [ 464.401841][ T84] netdevsim netdevsim4 eth3: set [0, 1] type 1 family 0 port 8472 - 0 [ 464.426095][ T6750] net_ratelimit: 69 callbacks suppressed [ 464.426117][ T6750] bond0: (slave dummy0): failed to get link speed/duplex [ 464.535722][ T6750] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 464.550793][ T6750] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 464.567551][ T6749] bond0: (slave dummy0): failed to get link speed/duplex [ 464.675644][ T6750] bond0: (slave dummy0): failed to get link speed/duplex [ 464.684857][T16072] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2514'. [ 464.816413][T11777] bond0: (slave dummy0): failed to get link speed/duplex [ 464.995743][ T6750] bond0: (slave dummy0): failed to get link speed/duplex [ 465.126481][ T6749] bond0: (slave dummy0): failed to get link speed/duplex [ 465.146011][ T84] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 465.160474][ T84] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 465.773625][T16107] netlink: 'syz.4.2523': attribute type 8 has an invalid length. [ 465.916449][T16114] rdma_rxe: rxe_newlink: failed to add bridge_slave_1 [ 465.972391][T16114] netdevsim netdevsim4 eth3 (unregistering): unset [0, 0] type 1 family 0 port 4352 - 0 [ 465.996033][T16085] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 466.005252][T16114] netdevsim netdevsim4 eth3 (unregistering): unset [0, 1] type 1 family 0 port 8472 - 0 [ 466.025546][T16085] Bluetooth: hci1: Error when powering off device on rfkill (-4) [ 466.048152][T16114] netdevsim netdevsim4 eth3 (unregistering): unset [1, 0] type 2 family 0 port 20000 - 0 [ 466.063885][T16114] netdevsim netdevsim4 eth3 (unregistering): unset [1, 1] type 2 family 0 port 6081 - 0 [ 466.143922][T16122] xt_CT: You must specify a L4 protocol and not use inversions on it [ 466.164220][T16114] netdevsim netdevsim4 eth2 (unregistering): unset [0, 0] type 1 family 0 port 4352 - 0 [ 466.181452][T16085] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 466.187688][T16085] Bluetooth: hci2: Error when powering off device on rfkill (-4) [ 466.195958][T16114] netdevsim netdevsim4 eth2 (unregistering): unset [0, 1] type 1 family 0 port 8472 - 0 [ 466.206028][T16114] netdevsim netdevsim4 eth2 (unregistering): unset [1, 0] type 2 family 0 port 20000 - 0 [ 466.216447][T16114] netdevsim netdevsim4 eth2 (unregistering): unset [1, 1] type 2 family 0 port 6081 - 0 [ 466.254655][T16085] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 466.261458][T16085] Bluetooth: hci3: Error when powering off device on rfkill (-4) [ 466.321796][T16114] netdevsim netdevsim4 eth1 (unregistering): unset [0, 0] type 1 family 0 port 4352 - 0 [ 466.357846][T16114] netdevsim netdevsim4 eth1 (unregistering): unset [0, 1] type 1 family 0 port 8472 - 0 [ 466.368214][T16085] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 466.381905][T16085] Bluetooth: hci4: Error when powering off device on rfkill (-4) [ 466.395554][T16114] netdevsim netdevsim4 eth1 (unregistering): unset [1, 0] type 2 family 0 port 20000 - 0 [ 466.409319][T16114] netdevsim netdevsim4 eth1 (unregistering): unset [1, 1] type 2 family 0 port 6081 - 0 [ 466.443707][T16122] lo speed is unknown, defaulting to 1000 [ 466.592935][T16114] netdevsim netdevsim4 eth0 (unregistering): unset [0, 0] type 1 family 0 port 4352 - 0 [ 466.605686][T16114] netdevsim netdevsim4 eth0 (unregistering): unset [0, 1] type 1 family 0 port 8472 - 0 [ 466.632904][T16114] netdevsim netdevsim4 eth0 (unregistering): unset [1, 0] type 2 family 0 port 20000 - 0 [ 466.669421][T16114] netdevsim netdevsim4 eth0 (unregistering): unset [1, 1] type 2 family 0 port 6081 - 0 [ 466.766963][T16131] syzkaller0: entered promiscuous mode [ 466.783969][T16131] syzkaller0: entered allmulticast mode [ 466.822085][T16149] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 466.880019][T16150] syzkaller1: entered promiscuous mode [ 466.885768][T16150] syzkaller1: entered allmulticast mode [ 467.122042][T11777] netdevsim netdevsim4 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 467.142956][T11777] netdevsim netdevsim4 eth0: set [0, 1] type 1 family 0 port 4352 - 0 [ 467.169069][T11777] netdevsim netdevsim4 eth0: set [1, 0] type 2 family 0 port 20000 - 0 [ 467.185506][T11777] netdevsim netdevsim4 eth0: set [1, 1] type 2 family 0 port 6081 - 0 [ 467.363465][T11777] netdevsim netdevsim4 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 467.386200][T11777] netdevsim netdevsim4 eth1: set [0, 1] type 1 family 0 port 4352 - 0 [ 467.394778][T11777] netdevsim netdevsim4 eth1: set [1, 0] type 2 family 0 port 20000 - 0 [ 467.404096][T11777] netdevsim netdevsim4 eth1: set [1, 1] type 2 family 0 port 6081 - 0 [ 467.459307][ T6749] netdevsim netdevsim4 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 467.467894][ T6749] netdevsim netdevsim4 eth2: set [0, 1] type 1 family 0 port 4352 - 0 [ 467.476745][ T6749] netdevsim netdevsim4 eth2: set [1, 0] type 2 family 0 port 20000 - 0 [ 467.488440][ T6749] netdevsim netdevsim4 eth2: set [1, 1] type 2 family 0 port 6081 - 0 [ 467.499829][T16167] __nla_validate_parse: 2 callbacks suppressed [ 467.499849][T16167] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2537'. [ 467.624291][T11777] netdevsim netdevsim4 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 467.643251][T11777] netdevsim netdevsim4 eth3: set [0, 1] type 1 family 0 port 4352 - 0 [ 467.661822][T11777] netdevsim netdevsim4 eth3: set [1, 0] type 2 family 0 port 20000 - 0 [ 467.690542][T11777] netdevsim netdevsim4 eth3: set [1, 1] type 2 family 0 port 6081 - 0 [ 467.773164][T16179] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2540'. [ 467.784055][T16177] vxcan1: tx drop: invalid sa for name 0x0000400000000000 [ 467.818747][T16177] syzkaller0: entered promiscuous mode [ 467.831531][T16177] syzkaller0: entered allmulticast mode [ 467.920650][T16188] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2540'. [ 467.972043][T16188] netlink: 'syz.2.2540': attribute type 3 has an invalid length. [ 468.005340][T16154] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 468.309258][T16201] netlink: 'syz.1.2547': attribute type 30 has an invalid length. [ 468.464931][T16211] netlink: 60 bytes leftover after parsing attributes in process `syz.1.2549'. [ 468.518084][T16216] netlink: 60 bytes leftover after parsing attributes in process `syz.1.2549'. [ 468.541614][T16214] netlink: 'syz.2.2548': attribute type 12 has an invalid length. [ 468.698142][T16218] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2551'. [ 468.840675][T16218] veth13: entered allmulticast mode [ 468.858833][T16218] bond10: (slave veth13): Enslaving as an active interface with an up link [ 468.886276][T16218] bond10 (unregistering): (slave veth13): Releasing backup interface [ 468.899024][T16218] bond10 (unregistering): Released all slaves [ 468.931282][T16221] syzkaller0: entered promiscuous mode [ 468.940252][T16221] syzkaller0: entered allmulticast mode [ 468.949864][T16227] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2553'. [ 469.003406][T16227] netlink: 141 bytes leftover after parsing attributes in process `syz.2.2553'. [ 469.391648][T16258] netlink: 'syz.4.2567': attribute type 4 has an invalid length. [ 469.401411][T16258] netlink: 152 bytes leftover after parsing attributes in process `syz.4.2567'. [ 469.465985][ T185] net_ratelimit: 36 callbacks suppressed [ 469.466009][ T185] bond0: (slave dummy0): failed to get link speed/duplex [ 469.595745][T16270] sctp: [Deprecated]: syz.4.2570 (pid 16270) Use of struct sctp_assoc_value in delayed_ack socket option. [ 469.595745][T16270] Use struct sctp_sack_info instead [ 469.612539][T11777] bond0: (slave dummy0): failed to get link speed/duplex [ 469.735739][T11777] bond0: (slave dummy0): failed to get link speed/duplex [ 469.795556][ T6749] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 469.810046][ T6749] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 469.845721][T11777] bond0: (slave dummy0): failed to get link speed/duplex [ 469.955583][ T84] bond0: (slave dummy0): failed to get link speed/duplex [ 470.066644][ T6749] bond0: (slave dummy0): failed to get link speed/duplex [ 470.177432][ T84] bond0: (slave dummy0): failed to get link speed/duplex [ 470.314582][T11777] bond0: (slave dummy0): failed to get link speed/duplex [ 470.609861][T16302] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2586'. [ 471.058069][T16319] x_tables: duplicate entry at hook 1 [ 471.214387][T16328] lo speed is unknown, defaulting to 1000 [ 471.323274][T16332] netlink: 'syz.1.2595': attribute type 1 has an invalid length. [ 471.390377][T16332] netlink: 'syz.1.2595': attribute type 1 has an invalid length. [ 471.420960][T16332] netlink: 'syz.1.2595': attribute type 8 has an invalid length. [ 471.611348][T16338] bond10 (unregistering): Released all slaves [ 472.055746][T16363] FAULT_INJECTION: forcing a failure. [ 472.055746][T16363] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 472.094735][T16363] CPU: 1 UID: 0 PID: 16363 Comm: syz.3.2605 Not tainted syzkaller #0 PREEMPT(full) [ 472.094766][T16363] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 472.094785][T16363] Call Trace: [ 472.094798][T16363] [ 472.094808][T16363] dump_stack_lvl+0xe8/0x150 [ 472.094851][T16363] should_fail_ex+0x40c/0x560 [ 472.094893][T16363] _copy_to_user+0x31/0xb0 [ 472.094922][T16363] simple_read_from_buffer+0xe1/0x170 [ 472.094958][T16363] proc_fail_nth_read+0x1bb/0x230 [ 472.094990][T16363] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 472.095023][T16363] ? rw_verify_area+0x24a/0x4c0 [ 472.095055][T16363] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 472.095082][T16363] vfs_read+0x213/0xa80 [ 472.095118][T16363] ? __pfx___mutex_lock+0x10/0x10 [ 472.095149][T16363] ? __pfx_vfs_read+0x10/0x10 [ 472.095181][T16363] ? __fget_files+0x2a/0x420 [ 472.095214][T16363] ? __fget_files+0x3a2/0x420 [ 472.095238][T16363] ? __fget_files+0x2a/0x420 [ 472.095275][T16363] ksys_read+0x150/0x270 [ 472.095309][T16363] ? __pfx_ksys_read+0x10/0x10 [ 472.095348][T16363] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 472.095375][T16363] do_syscall_64+0x174/0x580 [ 472.095400][T16363] ? trace_irq_disable+0x3b/0x140 [ 472.095433][T16363] ? clear_bhb_loop+0x40/0x90 [ 472.095461][T16363] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 472.095482][T16363] RIP: 0033:0x7f8c3815d68e [ 472.095503][T16363] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 472.095522][T16363] RSP: 002b:00007f8c39122fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 472.095544][T16363] RAX: ffffffffffffffda RBX: 00007f8c391236c0 RCX: 00007f8c3815d68e [ 472.095582][T16363] RDX: 000000000000000f RSI: 00007f8c391230a0 RDI: 0000000000000005 [ 472.095596][T16363] RBP: 00007f8c39123090 R08: 0000000000000000 R09: 0000000000000000 [ 472.095610][T16363] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 472.095623][T16363] R13: 00007f8c38416038 R14: 00007f8c38415fa0 R15: 00007ffdaa6b61d8 [ 472.095659][T16363] [ 472.483651][T16374] xt_CHECKSUM: CHECKSUM should be avoided. If really needed, restrict with "-p udp" and only use in OUTPUT [ 472.839634][T16387] bridge11: entered promiscuous mode [ 472.860751][T16387] bridge11: entered allmulticast mode [ 473.140695][T16400] __nla_validate_parse: 6 callbacks suppressed [ 473.140715][T16400] netlink: 20 bytes leftover after parsing attributes in process `syz.0.2616'. [ 473.167177][T16400] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2616'. [ 474.040200][T16433] netlink: 'syz.0.2627': attribute type 1 has an invalid length. [ 474.102147][T16436] netlink: 1 bytes leftover after parsing attributes in process `syz.0.2627'. [ 474.127949][T16438] netlink: 'syz.2.2629': attribute type 3 has an invalid length. [ 474.567699][T11777] net_ratelimit: 48 callbacks suppressed [ 474.567720][T11777] bond0: (slave dummy0): failed to get link speed/duplex [ 474.717677][T11777] bond0: (slave dummy0): failed to get link speed/duplex [ 474.770065][T16467] block nbd1: not configured, cannot reconfigure [ 474.850714][T16472] netlink: 'syz.2.2638': attribute type 1 has an invalid length. [ 474.864851][T16458] netlink: 24 bytes leftover after parsing attributes in process `syz.4.2636'. [ 474.874920][ T47] bond0: (slave dummy0): failed to get link speed/duplex [ 474.892317][T16473] IPv6: NLM_F_CREATE should be specified when creating new route [ 474.958378][ T47] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 474.973105][ T47] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 475.055092][T16472] 8021q: adding VLAN 0 to HW filter on device bond11 [ 475.175942][ T84] bond0: (slave dummy0): failed to get link speed/duplex [ 475.285849][ T84] bond0: (slave dummy0): failed to get link speed/duplex [ 475.416684][ T84] bond0: (slave dummy0): failed to get link speed/duplex [ 475.577158][ T47] bond0: (slave dummy0): failed to get link speed/duplex [ 475.595900][ T185] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 475.659987][T16503] netlink: 240 bytes leftover after parsing attributes in process `syz.1.2647'. [ 475.687570][T16503] netlink: 56 bytes leftover after parsing attributes in process `syz.1.2647'. [ 475.720449][T16507] netlink: 'syz.2.2649': attribute type 3 has an invalid length. [ 475.912914][T16514] netlink: 'syz.4.2651': attribute type 11 has an invalid length. [ 476.134066][T16519] bond10: option lacp_active: mode dependency failed, not supported in mode balance-rr(0) [ 476.213328][T16519] bond10 (unregistering): Released all slaves [ 476.393748][T16525] netlink: 'syz.3.2653': attribute type 15 has an invalid length. [ 476.616159][T16542] x_tables: duplicate underflow at hook 3 [ 476.831199][T16552] xt_time: invalid argument - start or stop time greater than 23:59:59 [ 476.871533][T16552] netlink: 'syz.2.2660': attribute type 21 has an invalid length. [ 476.984093][T16549] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2659'. [ 477.283798][T16569] netlink: 292 bytes leftover after parsing attributes in process `syz.3.2665'. [ 477.467115][T16575] netlink: 'syz.3.2667': attribute type 1 has an invalid length. [ 477.487597][T16578] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2666'. [ 477.491894][T16575] netlink: 'syz.3.2667': attribute type 7 has an invalid length. [ 477.545693][T16575] netlink: 'syz.3.2667': attribute type 8 has an invalid length. [ 477.567339][T16575] netlink: 208 bytes leftover after parsing attributes in process `syz.3.2667'. [ 477.588932][T16575] NCSI netlink: No device for ifindex 1073545264 [ 477.857125][T16588] xt_l2tp: invalid flags combination: 8 [ 477.870983][T16591] tipc: Enabling of bearer rejected, failed to enable media [ 478.234735][T16591] netdevsim netdevsim1 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 478.268990][T16591] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 478.464647][T16591] netdevsim netdevsim1 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 478.506799][T16591] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 478.648208][T16620] __nla_validate_parse: 1 callbacks suppressed [ 478.648228][T16620] netlink: 72 bytes leftover after parsing attributes in process `syz.2.2677'. [ 478.719426][T16591] team0: Port device netdevsim1 removed [ 478.748453][T16591] netdevsim netdevsim1 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 478.765952][T16591] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 478.774662][T16621] SET target dimension over the limit! [ 478.802188][T16622] syzkaller0: entered promiscuous mode [ 478.810017][T16622] syzkaller0: entered allmulticast mode [ 478.882130][T16591] netdevsim netdevsim1 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 478.894632][T16591] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 479.696331][ T185] net_ratelimit: 31 callbacks suppressed [ 479.696353][ T185] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 479.718563][ T185] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 479.861276][T16651] netlink: 260 bytes leftover after parsing attributes in process `syz.3.2684'. [ 479.871062][T16651] netlink: 104 bytes leftover after parsing attributes in process `syz.3.2684'. [ 479.884277][T16651] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2684'. [ 480.300521][ T47] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 480.316682][ T47] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 480.846418][ T6750] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 480.861216][ T6750] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 481.395681][ T6736] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 481.410124][ T6736] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 481.768225][ T6742] netdevsim netdevsim1 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 481.777078][ T6742] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 481.796150][ T84] bond0: (slave dummy0): failed to get link speed/duplex [ 481.844905][T11777] netdevsim netdevsim1 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 481.862636][T11777] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 481.926192][T11777] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 481.964054][T16660] tipc: Failed to remove unknown binding: 66,0,0/0:634000370/634000372 [ 481.976885][T16660] tipc: Failed to remove unknown binding: 66,0,0/0:634000370/634000371 [ 481.981802][ T6736] netdevsim netdevsim1 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 481.990426][T16660] tipc: Failed to remove unknown binding: 66,0,0/0:634000370/634000372 [ 482.011126][ T6736] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 482.024492][T16660] tipc: Failed to remove unknown binding: 66,0,0/0:634000370/634000371 [ 482.042722][ T6736] netdevsim netdevsim1 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 482.051504][ T6736] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 482.257514][T16672] tipc: Enabled bearer , priority 0 [ 482.278888][T16674] tipc: Enabling of bearer rejected, already enabled [ 482.303984][T16672] syzkaller0: entered promiscuous mode [ 482.322538][T16672] syzkaller0: entered allmulticast mode [ 482.401489][T16674] netlink: 44 bytes leftover after parsing attributes in process `syz.1.2692'. [ 482.438381][T16674] tipc: Resetting bearer [ 482.463488][T16672] netlink: 44 bytes leftover after parsing attributes in process `syz.1.2692'. [ 482.519347][T16672] tipc: Resetting bearer [ 482.571777][T16672] tipc: Disabling bearer [ 483.316932][T16694] netlink: 76 bytes leftover after parsing attributes in process `syz.2.2697'. [ 483.728211][T16730] x_tables: ip6_tables: dccp match: only valid for protocol 33 [ 483.841646][T16732] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2705'. [ 483.863723][T16732] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2705'. [ 483.911647][T16739] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2707'. [ 483.996629][ T6197] IPVS: starting estimator thread 0... [ 484.002045][T16739] bond10: entered allmulticast mode [ 484.057774][T16749] netlink: 'syz.3.2710': attribute type 58 has an invalid length. [ 484.083584][T16749] netlink: 20 bytes leftover after parsing attributes in process `syz.3.2710'. [ 484.135648][T16747] IPVS: using max 25 ests per chain, 60000 per kthread [ 484.204306][T16752] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2711'. [ 484.237148][T16752] netlink: 44 bytes leftover after parsing attributes in process `syz.4.2711'. [ 484.247892][T16752] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2711'. [ 484.594002][T16772] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 484.601765][T16772] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 484.636658][T16772] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 484.644682][T16772] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 484.845665][T11777] net_ratelimit: 29 callbacks suppressed [ 484.845686][T11777] bond0: (slave dummy0): failed to get link speed/duplex [ 485.006386][ T185] bond0: (slave dummy0): failed to get link speed/duplex [ 485.035702][ T185] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 485.050223][ T185] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 485.281234][T16794] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2725'. [ 485.386021][T16799] x_tables: ip6_tables: icmp6 match: only valid for protocol 58 [ 485.647167][ T6736] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 485.661689][ T6736] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 485.663801][T16807] netlink: 'syz.4.2729': attribute type 1 has an invalid length. [ 485.779304][T16809] netlink: 60 bytes leftover after parsing attributes in process `syz.4.2729'. [ 486.189059][ T84] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 486.203735][ T84] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 486.727087][ T6750] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 486.741735][ T6750] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 487.966879][T16798] veth27: entered promiscuous mode [ 488.033395][T16800] veth29: entered promiscuous mode [ 488.047522][T16806] kthread_run failed with err -4 [ 488.057301][T16807] workqueue: Failed to create a rescuer kthread for wq "bond11": -EINTR [ 488.533010][T16840] netlink: 'syz.4.2736': attribute type 1 has an invalid length. [ 488.557094][T16844] netlink: 'syz.4.2736': attribute type 1 has an invalid length. [ 489.585243][T16893] netlink: 132 bytes leftover after parsing attributes in process `syz.4.2747'. [ 490.307964][ T47] net_ratelimit: 18 callbacks suppressed [ 490.307987][ T47] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 490.328579][ T47] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 490.847835][ T185] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 490.862775][ T185] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 490.974895][ T6214] lo speed is unknown, defaulting to 1000 [ 490.985731][ T6214] syz2: Port: 1 Link DOWN [ 491.024568][ T47] netdevsim netdevsim3 eth0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 491.058190][ T47] netdevsim netdevsim3 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 491.085483][ T47] netdevsim netdevsim3 eth1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 491.127183][ T47] netdevsim netdevsim3 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 491.176950][ T47] netdevsim netdevsim3 eth2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 491.185791][ C0] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 491.261091][ T47] netdevsim netdevsim3 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 491.299895][ T47] netdevsim netdevsim3 eth3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 491.334016][T16905] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2752'. [ 491.334787][ T47] netdevsim netdevsim3 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 491.395588][ T6742] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 491.410350][ T6742] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 491.413352][T16913] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2752'. [ 491.529120][T16918] netlink: 40 bytes leftover after parsing attributes in process `syz.3.2754'. [ 491.840242][T16924] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 491.955609][T11777] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 491.970183][T11777] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 492.253626][T16928] netlink: 36 bytes leftover after parsing attributes in process `syz.1.2758'. [ 492.341982][T16932] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2760'. [ 492.457695][T16936] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2760'. [ 492.485533][ T47] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 492.499900][ T47] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 492.580548][T16932] team1: entered promiscuous mode [ 492.596245][T16932] team1: entered allmulticast mode [ 492.612955][T16932] 8021q: adding VLAN 0 to HW filter on device team1 [ 492.872155][T16957] netlink: 84 bytes leftover after parsing attributes in process `syz.4.2766'. [ 492.899668][T16957] tipc: Enabled bearer , priority 0 [ 492.914600][T16955] tipc: Disabling bearer [ 492.939999][T16963] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2768'. [ 493.132177][T16963] lo speed is unknown, defaulting to 1000 [ 493.984178][T16999] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2777'. [ 493.998088][T16995] netlink: 'syz.4.2775': attribute type 1 has an invalid length. [ 494.333601][T17013] geneve3: entered promiscuous mode [ 494.343921][ T6750] netdevsim netdevsim1 eth0: set [1, 1] type 2 family 0 port 39037 - 0 [ 494.365833][ T6750] netdevsim netdevsim1 eth1: set [1, 1] type 2 family 0 port 39037 - 0 [ 494.523823][ T6750] netdevsim netdevsim1 eth2: set [1, 1] type 2 family 0 port 39037 - 0 [ 494.560294][ T6750] netdevsim netdevsim1 eth3: set [1, 1] type 2 family 0 port 39037 - 0 [ 495.075680][T17020] syzkaller1: entered promiscuous mode [ 495.089714][T17020] syzkaller1: entered allmulticast mode [ 495.579827][T17051] __nla_validate_parse: 1 callbacks suppressed [ 495.579850][T17051] netlink: 96 bytes leftover after parsing attributes in process `syz.3.2790'. [ 495.619629][T17051] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2790'. [ 495.660212][ T185] net_ratelimit: 10 callbacks suppressed [ 495.660236][ T185] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 495.680618][ T185] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 496.124509][T17076] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2793'. [ 496.160761][T17064] bridge0: trying to set multicast startup query interval below minimum, setting to 100 (1000ms) [ 496.206403][ T185] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 496.221164][ T185] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 496.755587][ T47] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 496.770064][ T47] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 496.817421][T17093] syzkaller0: entered promiscuous mode [ 496.837007][T17093] syzkaller0: entered allmulticast mode [ 496.943839][T17097] netlink: 32 bytes leftover after parsing attributes in process `syz.3.2803'. [ 496.979834][T17099] x_tables: duplicate underflow at hook 1 [ 497.128383][T17104] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2806'. [ 497.181369][T17106] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2807'. [ 497.230115][T17106] netlink: 'syz.0.2807': attribute type 1 has an invalid length. [ 497.275954][T17101] netdevsim netdevsim2 netdevsim0: IPsec offload requires 128 bit authentication [ 497.315612][ T6750] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 497.330070][ T6750] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 497.411170][T17106] 8021q: adding VLAN 0 to HW filter on device bond0 [ 497.481522][T17106] netlink: 16 bytes leftover after parsing attributes in process `syz.0.2807'. [ 497.504797][T17121] netlink: 'syz.2.2805': attribute type 1 has an invalid length. [ 497.516296][T17121] netlink: 224 bytes leftover after parsing attributes in process `syz.2.2805'. [ 497.543438][T17113] bond0: (slave geneve5): making interface the new active one [ 497.557115][T17113] bond0: (slave geneve5): Enslaving as an active interface with an up link [ 497.566700][T17116] netlink: 'syz.0.2807': attribute type 8 has an invalid length. [ 497.582669][T17116] sch_fq: defrate 0 ignored. [ 497.593401][T17101] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2805'. [ 497.611347][T17101] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2805'. [ 497.638830][ T6750] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 497.661090][ T6750] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 497.691272][ T6750] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 497.710534][ T6750] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 497.852025][T17130] netlink: 'syz.1.2814': attribute type 6 has an invalid length. [ 497.884363][T17130] tipc: Failed to remove unknown binding: 66,1,1/1608999693:4113994491/4113994493 [ 497.925529][ T6736] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 497.940002][ T6736] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 498.572453][T17170] syzkaller0: entered promiscuous mode [ 498.586004][T17170] syzkaller0: entered allmulticast mode [ 498.708668][T17180] FAULT_INJECTION: forcing a failure. [ 498.708668][T17180] name failslab, interval 1, probability 0, space 0, times 0 [ 498.755571][T17180] CPU: 1 UID: 0 PID: 17180 Comm: syz.0.2827 Not tainted syzkaller #0 PREEMPT(full) [ 498.755603][T17180] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 498.755616][T17180] Call Trace: [ 498.755626][T17180] [ 498.755636][T17180] dump_stack_lvl+0xe8/0x150 [ 498.755668][T17180] should_fail_ex+0x40c/0x560 [ 498.755711][T17180] should_failslab+0xa8/0x100 [ 498.755736][T17180] __kmalloc_noprof+0xe8/0x750 [ 498.755767][T17180] ? __pfx_dynamic_dname+0x10/0x10 [ 498.755822][T17180] ? tomoyo_encode+0x2ad/0x570 [ 498.755864][T17180] tomoyo_encode+0x2ad/0x570 [ 498.755903][T17180] tomoyo_realpath_from_path+0x5fa/0x640 [ 498.755949][T17180] ? tomoyo_path_number_perm+0x219/0x5f0 [ 498.755978][T17180] tomoyo_path_number_perm+0x246/0x5f0 [ 498.756010][T17180] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 498.756038][T17180] ? __lock_acquire+0x683/0x2cd0 [ 498.756080][T17180] ? hook_file_ioctl+0x1f0/0x5c0 [ 498.756132][T17180] ? __fget_files+0x2a/0x420 [ 498.756162][T17180] ? __fget_files+0x2a/0x420 [ 498.756187][T17180] ? __fget_files+0x3a2/0x420 [ 498.756212][T17180] ? __fget_files+0x2a/0x420 [ 498.756244][T17180] security_file_ioctl+0xc3/0x2a0 [ 498.756382][T17180] __se_sys_ioctl+0x47/0x170 [ 498.756416][T17180] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 498.756441][T17180] do_syscall_64+0x174/0x580 [ 498.756466][T17180] ? trace_irq_disable+0x3b/0x140 [ 498.756499][T17180] ? clear_bhb_loop+0x40/0x90 [ 498.756527][T17180] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 498.756549][T17180] RIP: 0033:0x7f04fdb9ce59 [ 498.756569][T17180] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 498.756589][T17180] RSP: 002b:00007f04feae0028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 498.756613][T17180] RAX: ffffffffffffffda RBX: 00007f04fde15fa0 RCX: 00007f04fdb9ce59 [ 498.756628][T17180] RDX: 0000200000000100 RSI: 0000000000008946 RDI: 0000000000000004 [ 498.756643][T17180] RBP: 00007f04feae0090 R08: 0000000000000000 R09: 0000000000000000 [ 498.756657][T17180] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 498.756669][T17180] R13: 00007f04fde16038 R14: 00007f04fde15fa0 R15: 00007ffea40e8f58 [ 498.756705][T17180] [ 498.760014][T17180] ERROR: Out of memory at tomoyo_realpath_from_path. [ 499.187303][T17191] bond12 (unregistering): Released all slaves [ 499.539816][T17216] syzkaller0: entered promiscuous mode [ 499.556475][T17216] syzkaller0: entered allmulticast mode [ 499.638345][T17216] netlink: 'syz.4.2837': attribute type 10 has an invalid length. [ 499.801520][T17232] FAULT_INJECTION: forcing a failure. [ 499.801520][T17232] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 499.828151][T17232] CPU: 1 UID: 0 PID: 17232 Comm: syz.3.2840 Not tainted syzkaller #0 PREEMPT(full) [ 499.828182][T17232] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 499.828196][T17232] Call Trace: [ 499.828205][T17232] [ 499.828214][T17232] dump_stack_lvl+0xe8/0x150 [ 499.828264][T17232] should_fail_ex+0x40c/0x560 [ 499.828306][T17232] _copy_from_user+0x2d/0xb0 [ 499.828332][T17232] sock_do_ioctl+0x195/0x320 [ 499.828367][T17232] ? __pfx_sock_do_ioctl+0x10/0x10 [ 499.828393][T17232] ? hook_file_ioctl+0x1f0/0x5c0 [ 499.828442][T17232] sock_ioctl+0x57a/0x7e0 [ 499.828471][T17232] ? __pfx_sock_ioctl+0x10/0x10 [ 499.828499][T17232] ? __fget_files+0x2a/0x420 [ 499.828524][T17232] ? __fget_files+0x3a2/0x420 [ 499.828549][T17232] ? __fget_files+0x2a/0x420 [ 499.828579][T17232] ? bpf_lsm_file_ioctl+0x9/0x20 [ 499.828612][T17232] ? __pfx_sock_ioctl+0x10/0x10 [ 499.828639][T17232] __se_sys_ioctl+0xfc/0x170 [ 499.828672][T17232] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 499.828696][T17232] do_syscall_64+0x174/0x580 [ 499.828721][T17232] ? trace_irq_disable+0x3b/0x140 [ 499.828753][T17232] ? clear_bhb_loop+0x40/0x90 [ 499.828780][T17232] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 499.828801][T17232] RIP: 0033:0x7f8c3819ce59 [ 499.828821][T17232] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 499.828837][T17232] RSP: 002b:00007f8c39123028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 499.828860][T17232] RAX: ffffffffffffffda RBX: 00007f8c38415fa0 RCX: 00007f8c3819ce59 [ 499.828876][T17232] RDX: 0000200000000100 RSI: 0000000000008946 RDI: 0000000000000004 [ 499.828890][T17232] RBP: 00007f8c39123090 R08: 0000000000000000 R09: 0000000000000000 [ 499.828903][T17232] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 499.828915][T17232] R13: 00007f8c38416038 R14: 00007f8c38415fa0 R15: 00007ffdaa6b61d8 [ 499.828950][T17232] [ 500.413323][T17247] netlink: 'syz.3.2846': attribute type 1 has an invalid length. [ 500.797391][T17252] __nla_validate_parse: 11 callbacks suppressed [ 500.797415][T17252] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2848'. [ 500.830538][T17252] netlink: 24 bytes leftover after parsing attributes in process `syz.4.2848'. [ 501.108831][ T6736] net_ratelimit: 10 callbacks suppressed [ 501.108853][ T6736] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 501.129627][ T6736] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 501.152961][T17277] netlink: 280 bytes leftover after parsing attributes in process `syz.0.2853'. [ 501.209650][T17277] netlink: 128 bytes leftover after parsing attributes in process `syz.0.2853'. [ 501.227713][T17277] A link change request failed with some changes committed already. Interface team0 may have been left with an inconsistent configuration, please check. [ 501.266456][T17276] lo speed is unknown, defaulting to 1000 [ 501.334988][T17286] netlink: 124 bytes leftover after parsing attributes in process `syz.4.2854'. [ 501.447126][T17286] netlink: 124 bytes leftover after parsing attributes in process `syz.4.2854'. [ 501.482239][T17291] lo: entered allmulticast mode [ 501.581598][T17286] netlink: 36 bytes leftover after parsing attributes in process `syz.4.2854'. [ 501.658087][ T6749] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 501.672649][ T6749] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 502.245628][ T6742] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 502.260126][ T6742] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 502.444855][ T5643] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 502.471661][ T5643] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 502.483334][ T5643] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 502.497210][ T5643] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 502.506262][ T5643] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 502.537660][ T5636] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 502.546061][ T5636] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 502.553511][ T5636] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 502.562546][ T5636] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 502.570406][ T5636] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 502.856170][ T6742] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 502.870756][ T6742] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 503.475742][ T6742] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 503.683476][ T5627] syz_tun (unregistering): left allmulticast mode [ 503.866997][T17309] lo speed is unknown, defaulting to 1000 [ 504.002564][T17335] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2866'. [ 504.522538][T17351] FAULT_INJECTION: forcing a failure. [ 504.522538][T17351] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 504.540171][T17351] CPU: 0 UID: 0 PID: 17351 Comm: syz.4.2871 Not tainted syzkaller #0 PREEMPT(full) [ 504.540201][T17351] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 504.540213][T17351] Call Trace: [ 504.540221][T17351] [ 504.540230][T17351] dump_stack_lvl+0xe8/0x150 [ 504.540262][T17351] should_fail_ex+0x40c/0x560 [ 504.540309][T17351] _copy_from_user+0x2d/0xb0 [ 504.540335][T17351] dev_ethtool+0x608/0x2930 [ 504.540363][T17351] ? __lock_acquire+0x683/0x2cd0 [ 504.540402][T17351] ? __pfx_dev_ethtool+0x10/0x10 [ 504.540430][T17351] ? kasan_quarantine_put+0xbb/0x1f0 [ 504.540464][T17351] ? dev_load+0x21/0x1f0 [ 504.540507][T17351] ? dev_load+0x21/0x1f0 [ 504.540540][T17351] ? dev_load+0x21/0x1f0 [ 504.540573][T17351] dev_ioctl+0x392/0x1150 [ 504.540609][T17351] sock_do_ioctl+0x23e/0x320 [ 504.540639][T17351] ? __pfx_sock_do_ioctl+0x10/0x10 [ 504.540663][T17351] ? hook_file_ioctl+0x1f0/0x5c0 [ 504.540728][T17351] sock_ioctl+0x57a/0x7e0 [ 504.540759][T17351] ? __pfx_sock_ioctl+0x10/0x10 [ 504.540786][T17351] ? __fget_files+0x2a/0x420 [ 504.540813][T17351] ? __fget_files+0x3a2/0x420 [ 504.540838][T17351] ? __fget_files+0x2a/0x420 [ 504.540869][T17351] ? bpf_lsm_file_ioctl+0x9/0x20 [ 504.540901][T17351] ? __pfx_sock_ioctl+0x10/0x10 [ 504.540927][T17351] __se_sys_ioctl+0xfc/0x170 [ 504.540961][T17351] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 504.540985][T17351] do_syscall_64+0x174/0x580 [ 504.541011][T17351] ? trace_irq_disable+0x3b/0x140 [ 504.541046][T17351] ? clear_bhb_loop+0x40/0x90 [ 504.541074][T17351] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 504.541095][T17351] RIP: 0033:0x7f0f9bf9ce59 [ 504.541115][T17351] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 504.541134][T17351] RSP: 002b:00007f0f9ceaf028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 504.541157][T17351] RAX: ffffffffffffffda RBX: 00007f0f9c215fa0 RCX: 00007f0f9bf9ce59 [ 504.541172][T17351] RDX: 0000200000000100 RSI: 0000000000008946 RDI: 0000000000000004 [ 504.541187][T17351] RBP: 00007f0f9ceaf090 R08: 0000000000000000 R09: 0000000000000000 [ 504.541200][T17351] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 504.541213][T17351] R13: 00007f0f9c216038 R14: 00007f0f9c215fa0 R15: 00007ffe9d3dbcc8 [ 504.541250][T17351] [ 504.781883][ T5636] Bluetooth: hci5: command tx timeout [ 505.543765][T17364] faux_driver regulatory: loading /lib/firmware/regulatory.db failed with error -4 [ 505.575978][T17364] faux_driver regulatory: Direct firmware load for regulatory.db failed with error -4 [ 505.602807][T17364] faux_driver regulatory: Falling back to sysfs fallback for: regulatory.db [ 506.145134][T17389] netlink: 56 bytes leftover after parsing attributes in process `syz.3.2880'. [ 506.305058][T11777] pimreg: left allmulticast mode [ 506.469773][T17407] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2884'. [ 506.562693][T17409] netlink: 'syz.3.2886': attribute type 27 has an invalid length. [ 506.563303][ T185] net_ratelimit: 11 callbacks suppressed [ 506.563347][ T185] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 506.589626][T17413] Bluetooth: MGMT ver 1.23 [ 506.591574][ T185] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 506.878243][ T5636] Bluetooth: hci5: command tx timeout [ 507.150848][T11777] team0: Port device gtp1 removed [ 507.208695][ T47] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 507.223160][ T47] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 507.279577][T11777] batman_adv: batadv0: Removing interface: vxlan0 [ 507.369618][T11777] .` (unregistering): Released all slaves [ 507.381159][T11777] bond0 (unregistering): Released all slaves [ 507.401368][T11777] bond1 (unregistering): (slave veth9): Releasing active interface [ 507.417169][T11777] bond1 (unregistering): Released all slaves [ 507.435139][T11777] bond2 (unregistering): Released all slaves [ 507.452699][T11777] bond3 (unregistering): (slave bond4): Releasing backup interface [ 507.462075][T11777] bond3 (unregistering): Released all slaves [ 507.484633][T11777] bond4 (unregistering): Released all slaves [ 507.504213][T11777] bond5 (unregistering): (slave veth17): Releasing backup interface [ 507.519181][T11777] bond5 (unregistering): Released all slaves [ 507.535785][T11777] bond6 (unregistering): Released all slaves [ 507.552349][T11777] bond7 (unregistering): Released all slaves [ 507.568805][T11777] bond8 (unregistering): Released all slaves [ 507.593072][T11777] bond9 (unregistering): Released all slaves [ 507.616635][T11777] bond10 (unregistering): (slave veth23): Releasing active interface [ 507.628253][T11777] bond10 (unregistering): Released all slaves [ 507.650685][T11777] bond11 (unregistering): Released all slaves [ 507.667339][T17397] FAULT_INJECTION: forcing a failure. [ 507.667339][T17397] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 507.680712][T17397] CPU: 0 UID: 0 PID: 17397 Comm: syz.0.2882 Not tainted syzkaller #0 PREEMPT(full) [ 507.680740][T17397] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 507.680753][T17397] Call Trace: [ 507.680763][T17397] [ 507.680780][T17397] dump_stack_lvl+0xe8/0x150 [ 507.680804][T17397] should_fail_ex+0x40c/0x560 [ 507.680833][T17397] _copy_from_user+0x2d/0xb0 [ 507.680852][T17397] ethtool_set_per_queue+0xef/0x1f0 [ 507.680871][T17397] ? __pfx_ethtool_set_per_queue+0x10/0x10 [ 507.680942][T17397] dev_ethtool+0x1d4d/0x2930 [ 507.680961][T17397] ? __lock_acquire+0x683/0x2cd0 [ 507.680988][T17397] ? __pfx_dev_ethtool+0x10/0x10 [ 507.681009][T17397] ? kasan_quarantine_put+0xbb/0x1f0 [ 507.681032][T17397] ? dev_load+0x21/0x1f0 [ 507.681062][T17397] ? dev_load+0x21/0x1f0 [ 507.681086][T17397] ? dev_load+0x21/0x1f0 [ 507.681109][T17397] dev_ioctl+0x392/0x1150 [ 507.681135][T17397] sock_do_ioctl+0x23e/0x320 [ 507.681157][T17397] ? __pfx_sock_do_ioctl+0x10/0x10 [ 507.681174][T17397] ? hook_file_ioctl+0x1f0/0x5c0 [ 507.681217][T17397] sock_ioctl+0x57a/0x7e0 [ 507.681239][T17397] ? __pfx_sock_ioctl+0x10/0x10 [ 507.681258][T17397] ? __fget_files+0x2a/0x420 [ 507.681276][T17397] ? __fget_files+0x3a2/0x420 [ 507.681294][T17397] ? __fget_files+0x2a/0x420 [ 507.681315][T17397] ? bpf_lsm_file_ioctl+0x9/0x20 [ 507.681339][T17397] ? __pfx_sock_ioctl+0x10/0x10 [ 507.681358][T17397] __se_sys_ioctl+0xfc/0x170 [ 507.681381][T17397] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 507.681398][T17397] do_syscall_64+0x174/0x580 [ 507.681417][T17397] ? trace_irq_disable+0x3b/0x140 [ 507.681439][T17397] ? clear_bhb_loop+0x40/0x90 [ 507.681458][T17397] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 507.681473][T17397] RIP: 0033:0x7f04fdb9ce59 [ 507.681488][T17397] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 507.681501][T17397] RSP: 002b:00007f04feae0028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 507.681517][T17397] RAX: ffffffffffffffda RBX: 00007f04fde15fa0 RCX: 00007f04fdb9ce59 [ 507.681528][T17397] RDX: 0000200000000100 RSI: 0000000000008946 RDI: 0000000000000004 [ 507.681538][T17397] RBP: 00007f04feae0090 R08: 0000000000000000 R09: 0000000000000000 [ 507.681547][T17397] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 507.681555][T17397] R13: 00007f04fde16038 R14: 00007f04fde15fa0 R15: 00007ffea40e8f58 [ 507.681580][T17397] [ 507.932048][ T84] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 507.946487][ T84] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 508.032774][ T6750] tipc: Resetting bearer [ 508.044631][ T5289] 8021q: adding VLAN 0 to HW filter on device eth1 [ 508.468069][ T84] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 508.482568][ T84] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 508.553432][T11777] tipc: Disabling bearer [ 508.574927][T11777] tipc: Left network mode [ 508.575738][T17450] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2892'. [ 508.681241][T17309] bridge0: port 1(bridge_slave_0) entered blocking state [ 508.688819][T17309] bridge0: port 1(bridge_slave_0) entered disabled state [ 508.698626][T17309] bridge_slave_0: entered allmulticast mode [ 508.707596][T17309] bridge_slave_0: entered promiscuous mode [ 508.723084][T17467] netlink: 'syz.3.2895': attribute type 8 has an invalid length. [ 508.882427][T17309] bridge0: port 2(bridge_slave_1) entered blocking state [ 508.900365][T17309] bridge0: port 2(bridge_slave_1) entered disabled state [ 508.908994][T17474] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci5/hci5:200/input8 [ 508.927935][T17309] bridge_slave_1: entered allmulticast mode [ 508.955738][ T5636] Bluetooth: hci5: command tx timeout [ 508.981078][T17309] bridge_slave_1: entered promiscuous mode [ 509.036092][ T6750] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 509.050513][ T6750] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 509.361446][T17309] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 509.488321][T17493] netlink: 'syz.3.2899': attribute type 1 has an invalid length. [ 509.510823][T17309] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 509.786964][T17309] team0: Port device team_slave_0 added [ 509.818242][T17309] team0: Port device team_slave_1 added [ 509.942911][T17309] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 509.981705][T17309] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 510.055112][T17309] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 510.083391][T17309] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 510.100039][T17309] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 510.164388][T17309] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 510.333439][T17309] hsr_slave_0: entered promiscuous mode [ 510.341137][T17309] hsr_slave_1: entered promiscuous mode [ 510.351197][T17309] debugfs: 'hsr0' already exists in 'hsr' [ 510.362372][T17309] Cannot create hsr debugfs directory [ 510.372395][T17533] xt_hashlimit: size too large, truncated to 1048576 [ 510.533053][ T5289] 8021q: adding VLAN 0 to HW filter on device eth2 [ 510.688994][T17545] netlink: 16 bytes leftover after parsing attributes in process `syz.0.2910'. [ 510.793905][T17547] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2911'. [ 510.963711][T17552] geneve0: entered promiscuous mode [ 511.026397][ T5636] Bluetooth: hci5: command tx timeout [ 511.058085][ T6747] netdevsim netdevsim3 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 511.080398][ T6747] netdevsim netdevsim3 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 511.209399][ T6747] netdevsim netdevsim3 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 511.224719][ T6747] netdevsim netdevsim3 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 511.677997][ T185] net_ratelimit: 8 callbacks suppressed [ 511.678020][ T185] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 511.700487][ T185] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 512.119758][ T5289] 8021q: adding VLAN 0 to HW filter on device eth3 [ 512.227661][ T6747] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 512.242190][ T6747] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 512.334962][T17625] netlink: 'syz.0.2926': attribute type 4 has an invalid length. [ 512.342950][T17625] netlink: 224 bytes leftover after parsing attributes in process `syz.0.2926'. [ 512.785925][ T84] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 512.800377][ T84] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 512.908422][T17642] netlink: 'syz.1.2927': attribute type 4 has an invalid length. [ 512.970654][T17607] lo speed is unknown, defaulting to 1000 [ 513.049298][T11777] hsr_slave_0: left promiscuous mode [ 513.057902][T11777] hsr_slave_1: left promiscuous mode [ 513.072651][T11777] batman_adv: batadv0: Removing interface: veth3 [ 513.098370][T11777] batman_adv: batadv0: Removing interface: veth5 [ 513.370480][T17652] netlink: 'syz.4.2928': attribute type 7 has an invalid length. [ 513.386059][ T6750] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 513.400619][ T6750] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 513.524062][T17663] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2928'. [ 513.553184][T17663] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2928'. [ 513.609430][T17667] netlink: 40 bytes leftover after parsing attributes in process `syz.4.2928'. [ 513.971335][ T6750] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 513.986105][ T6750] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 514.414859][T17685] netlink: 36 bytes leftover after parsing attributes in process `syz.1.2930'. [ 514.432461][ T10] uyz0: Port: 1 Link DOWN [ 514.636275][T17688] workqueue: Failed to create a rescuer kthread for wq "bond12": -EINTR [ 514.713555][T17696] bond12: option lacp_rate: invalid value (128) [ 514.751682][T17702] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2934'. [ 514.799374][T17696] bond12 (unregistering): Released all slaves [ 514.851123][T17704] 8021q: VLANs not supported on ip_vti0 [ 515.057459][ T6750] smc: removing ib device uyz0 [ 515.360701][ T6750] smbdirect: ib_dev[uyz0] removed [ 516.008243][T17734] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2942'. [ 516.374087][T17734] 8021q: adding VLAN 0 to HW filter on device bond12 [ 516.661626][T17759] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2945'. [ 516.951388][T17767] netlink: 104 bytes leftover after parsing attributes in process `syz.4.2946'. [ 517.076138][ T47] net_ratelimit: 10 callbacks suppressed [ 517.076159][ T47] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 517.096480][ T47] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 517.256951][T17309] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 517.341366][T17309] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 517.381661][T17309] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 517.422655][T17309] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 517.453213][T17309] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 517.550167][T17309] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 517.609454][T17309] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 517.646474][ T47] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 517.660995][ T47] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 517.730836][T17309] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 517.951744][T17782] netlink: 20 bytes leftover after parsing attributes in process `syz.4.2949'. [ 518.077388][T17309] 8021q: adding VLAN 0 to HW filter on device bond0 [ 518.182118][T17309] 8021q: adding VLAN 0 to HW filter on device team0 [ 518.190573][ T6747] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 518.205001][ T6747] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 518.301253][ T185] bridge0: port 1(bridge_slave_0) entered blocking state [ 518.308482][ T185] bridge0: port 1(bridge_slave_0) entered forwarding state [ 518.349693][ T6736] bridge0: port 2(bridge_slave_1) entered blocking state [ 518.356939][ T6736] bridge0: port 2(bridge_slave_1) entered forwarding state [ 518.776370][ T47] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 518.791668][ T47] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 519.211393][T17824] veth17: entered promiscuous mode [ 519.379168][ T84] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 519.393716][ T84] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 519.667623][T11777] IPVS: stop unused estimator thread 0... [ 519.678687][T17833] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2956'. [ 519.967953][T17833] macsec1: entered promiscuous mode [ 520.158872][T17852] xt_hashlimit: Unknown mode mask 3FFFF, kernel too old? [ 520.301509][T17309] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 520.492883][T17309] veth0_vlan: entered promiscuous mode [ 520.546513][T17309] veth1_vlan: entered promiscuous mode [ 520.696977][T17309] veth0_macvtap: entered promiscuous mode [ 520.731408][T17309] veth1_macvtap: entered promiscuous mode [ 520.820613][T17309] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 520.890091][T17309] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 520.997743][T11777] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 521.034016][T11777] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 521.065728][T11777] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 521.093258][T11777] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 521.326126][T11777] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 521.354309][T11777] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 521.462320][ T6747] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 521.487555][ T6747] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 521.662102][T17882] netlink: 'syz.3.2967': attribute type 8 has an invalid length. [ 521.688777][T17882] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2967'. [ 521.926737][T17894] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2969'. [ 521.976730][T17895] x_tables: duplicate underflow at hook 3 [ 522.477358][ T6749] net_ratelimit: 10 callbacks suppressed [ 522.477380][ T6749] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 522.497667][ T6749] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 522.561117][T17914] netlink: 60 bytes leftover after parsing attributes in process `syz.4.2974'. [ 522.605018][T17914] netlink: 35 bytes leftover after parsing attributes in process `syz.4.2974'. [ 522.918519][T17930] syz.0.2978: vmalloc error: size 8589938688, exceeds total pages, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 522.973963][T17930] CPU: 0 UID: 0 PID: 17930 Comm: syz.0.2978 Not tainted syzkaller #0 PREEMPT(full) [ 522.973994][T17930] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 522.974010][T17930] Call Trace: [ 522.974020][T17930] [ 522.974029][T17930] dump_stack_lvl+0xe8/0x150 [ 522.974064][T17930] warn_alloc+0x249/0x340 [ 522.974099][T17930] ? __pfx_stack_trace_save+0x10/0x10 [ 522.974176][T17930] ? __pfx_warn_alloc+0x10/0x10 [ 522.974216][T17930] ? __kasan_kmalloc+0x93/0xb0 [ 522.974249][T17930] ? __kmalloc_cache_noprof+0x318/0x660 [ 522.974286][T17930] ? xskq_create+0x56/0x170 [ 522.974379][T17930] ? xsk_init_queue+0x8a/0xe0 [ 522.974437][T17930] ? xsk_setsockopt+0x52a/0x960 [ 522.974475][T17930] ? do_sock_setsockopt+0x17c/0x1b0 [ 522.974502][T17930] ? __x64_sys_setsockopt+0x13d/0x1b0 [ 522.974523][T17930] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 522.974554][T17930] __vmalloc_node_range_noprof+0x12c/0x1730 [ 522.974653][T17930] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 522.974695][T17930] ? __kasan_kmalloc+0x93/0xb0 [ 522.974736][T17930] vmalloc_user_noprof+0xad/0xe0 [ 522.974770][T17930] ? xskq_create+0xbf/0x170 [ 522.974792][T17930] xskq_create+0xbf/0x170 [ 522.974819][T17930] xsk_init_queue+0x8a/0xe0 [ 522.974857][T17930] xsk_setsockopt+0x52a/0x960 [ 522.974891][T17930] ? __fget_files+0x2a/0x420 [ 522.974920][T17930] ? __pfx_xsk_setsockopt+0x10/0x10 [ 522.974955][T17930] ? __pfx_aa_sk_perm+0x10/0x10 [ 522.974991][T17930] ? aa_sock_opt_perm+0xff/0x1a0 [ 522.975073][T17930] ? bpf_lsm_socket_setsockopt+0x9/0x20 [ 522.975105][T17930] ? __pfx_xsk_setsockopt+0x10/0x10 [ 522.975141][T17930] do_sock_setsockopt+0x17c/0x1b0 [ 522.975170][T17930] __x64_sys_setsockopt+0x13d/0x1b0 [ 522.975195][T17930] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 522.975220][T17930] do_syscall_64+0x174/0x580 [ 522.975247][T17930] ? trace_irq_disable+0x3b/0x140 [ 522.975280][T17930] ? clear_bhb_loop+0x40/0x90 [ 522.975309][T17930] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 522.975331][T17930] RIP: 0033:0x7f04fdb9ce59 [ 522.975356][T17930] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 522.975375][T17930] RSP: 002b:00007f04feae0028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 522.975400][T17930] RAX: ffffffffffffffda RBX: 00007f04fde15fa0 RCX: 00007f04fdb9ce59 [ 522.975417][T17930] RDX: 0000000000000006 RSI: 000000000000011b RDI: 0000000000000004 [ 522.975430][T17930] RBP: 00007f04fdc32d6f R08: 0000000000000004 R09: 0000000000000000 [ 522.975444][T17930] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000000 [ 522.975458][T17930] R13: 00007f04fde16038 R14: 00007f04fde15fa0 R15: 00007ffea40e8f58 [ 522.975493][T17930] [ 523.244501][ T6747] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 523.258985][ T6747] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 523.341798][T17930] Mem-Info: [ 523.345111][T17930] active_anon:11375 inactive_anon:8 isolated_anon:0 [ 523.345111][T17930] active_file:2961 inactive_file:40605 isolated_file:0 [ 523.345111][T17930] unevictable:768 dirty:128 writeback:0 [ 523.345111][T17930] slab_reclaimable:11835 slab_unreclaimable:175083 [ 523.345111][T17930] mapped:29615 shmem:2966 pagetables:1427 [ 523.345111][T17930] sec_pagetables:0 bounce:0 [ 523.345111][T17930] kernel_misc_reclaimable:0 [ 523.345111][T17930] free:1233656 free_pcp:15113 free_cma:0 [ 523.404742][T17938] geneve4: entered promiscuous mode [ 523.437643][T17930] Node 0 active_anon:48100kB inactive_anon:32kB active_file:11844kB inactive_file:162212kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:118660kB dirty:512kB writeback:0kB shmem:12728kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:14256kB pagetables:5680kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 523.472754][T17930] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:208kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:32kB pagetables:128kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 523.506089][T17930] Node 0 DMA free:15352kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:8kB local_pcp:0kB free_cma:0kB [ 523.536374][T17930] lowmem_reserve[]: 0 2493 2493 2493 2493 [ 523.542251][T17930] Node 0 DMA32 free:996568kB boost:0kB min:34188kB low:42732kB high:51276kB reserved_highatomic:0KB free_highatomic:0KB active_anon:48100kB inactive_anon:32kB active_file:11844kB inactive_file:162212kB unevictable:1536kB writepending:512kB zspages:0kB present:3129332kB managed:2552916kB mlocked:0kB bounce:0kB free_pcp:36876kB local_pcp:15764kB free_cma:0kB [ 523.577482][T17930] lowmem_reserve[]: 0 0 0 0 0 [ 523.582316][T17930] Node 0 Normal free:0kB boost:0kB min:8kB low:8kB high:8kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:684kB mlocked:0kB bounce:0kB free_pcp:4kB local_pcp:4kB free_cma:0kB [ 523.658247][T17939] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2981'. [ 523.671731][T17930] lowmem_reserve[]: 0 0 0 0 0 [ 523.681874][T17939] netlink: 32 bytes leftover after parsing attributes in process `syz.4.2981'. [ 523.705101][T17939] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2981'. [ 523.705116][T17930] Node 1 [ 523.735036][T17938] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2981'. [ 523.739885][T17930] Normal free:3922004kB boost:0kB min:55704kB low:69628kB high:83552kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:208kB unevictable:1536kB writepending:0kB zspages:0kB present:4194300kB managed:4111100kB mlocked:0kB bounce:0kB free_pcp:22152kB local_pcp:0kB free_cma:0kB [ 523.781059][T17938] netlink: 40 bytes leftover after parsing attributes in process `syz.4.2981'. [ 523.800704][T17930] lowmem_reserve[]: 0 0 0 0 0 [ 523.809933][T17930] Node 0 DMA: 0*4kB 1*8kB (U) 1*16kB (U) 1*32kB (U) 1*64kB (U) 1*128kB (U) 1*256kB (U) 1*512kB (U) 2*1024kB (U) 2*2048kB (UM) 2*4096kB (M) = 15352kB [ 523.847911][T17934] netlink: 'syz.0.2978': attribute type 10 has an invalid length. [ 523.867442][T17934] batman_adv: batadv0: Interface deactivated: dummy0 [ 523.881610][T17934] batman_adv: batadv0: Removing interface: dummy0 [ 523.898138][T17930] Node 0 DMA32: 5007*4kB (UE) [ 523.898872][T17942] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2978'. [ 523.932228][T17930] 3759*8kB (UME) 2219*16kB (UME) 1077*32kB (UM) 636*64kB (UM) 466*128kB (UME) 519*256kB (UM) 312*512kB (UM) 183*1024kB (UME) 78*2048kB (UM) 34*4096kB (UM) = 999428kB [ 523.952731][T17942] openvswitch: netlink: Message has 2 unknown bytes. [ 523.974334][T17934] team0: Port device dummy0 added [ 523.983198][T17952] netlink: 'syz.0.2978': attribute type 10 has an invalid length. [ 524.002227][T17930] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 524.045286][T17952] team0: Port device dummy0 removed [ 524.057048][T17930] Node 1 Normal: 2*4kB (UM) 13*8kB (UM) 10*16kB (UM) 8*32kB (UM) 11*64kB (UM) 3*128kB (UM) 3*256kB (UM) 4*512kB (UM) 2*1024kB (UM) 2*2048kB (U) 955*4096kB (UM) = 3922256kB [ 524.120990][T17930] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 524.155630][T17930] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 524.172761][T17952] .`: (slave dummy0): Enslaving as an active interface with an up link [ 524.226548][T17958] netlink: 'syz.2.2985': attribute type 1 has an invalid length. [ 524.234483][T17930] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 524.261621][T17930] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 524.273051][T17930] 44901 total pagecache pages [ 524.278447][T17930] 0 pages in swap cache [ 524.282757][T17930] Free swap = 124996kB [ 524.287907][T17930] Total swap = 124996kB [ 524.292139][T17930] 2097051 pages RAM [ 524.296654][T17930] 0 pages HighMem/MovableOnly [ 524.303222][T17930] 427036 pages reserved [ 524.311101][T17930] 0 pages cma reserved [ 524.418958][T17956] syzkaller1: entered promiscuous mode [ 524.424747][T17956] syzkaller1: entered allmulticast mode [ 524.831509][T17985] FAULT_INJECTION: forcing a failure. [ 524.831509][T17985] name failslab, interval 1, probability 0, space 0, times 0 [ 524.854014][T17985] CPU: 1 UID: 0 PID: 17985 Comm: syz.0.2992 Not tainted syzkaller #0 PREEMPT(full) [ 524.854046][T17985] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 524.854059][T17985] Call Trace: [ 524.854068][T17985] [ 524.854078][T17985] dump_stack_lvl+0xe8/0x150 [ 524.854109][T17985] should_fail_ex+0x40c/0x560 [ 524.854151][T17985] should_failslab+0xa8/0x100 [ 524.854175][T17985] __kvmalloc_node_noprof+0x16e/0x890 [ 524.854209][T17985] ? __kmalloc_cache_node_noprof+0x3dd/0x690 [ 524.854238][T17985] ? page_pool_create_percpu+0x2ef/0xc70 [ 524.854374][T17985] ? page_pool_create_percpu+0xa7/0xc70 [ 524.854410][T17985] page_pool_create_percpu+0x2ef/0xc70 [ 524.854445][T17985] bpf_test_run_xdp_live+0x23a/0x1c20 [ 524.854476][T17985] ? bpf_dispatcher_change_prog+0xc4a/0xf20 [ 524.854511][T17985] ? __mutex_unlock_slowpath+0x1be/0x6f0 [ 524.854547][T17985] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 524.854579][T17985] ? __pfx_bpf_test_run_xdp_live+0x10/0x10 [ 524.854628][T17985] ? 0xffffffffa0205190 [ 524.854647][T17985] ? 0xffffffffa0207148 [ 524.854693][T17985] ? __pfx_xdp_test_run_init_page+0x10/0x10 [ 524.854730][T17985] ? _copy_from_user+0x94/0xb0 [ 524.854764][T17985] ? bpf_test_init+0x113/0x150 [ 524.854794][T17985] ? xdp_convert_md_to_buff+0x5b/0x330 [ 524.854822][T17985] bpf_prog_test_run_xdp+0x7d8/0x11d0 [ 524.854864][T17985] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 524.854895][T17985] ? __fget_files+0x2a/0x420 [ 524.854928][T17985] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 524.854953][T17985] bpf_prog_test_run+0x2c5/0x340 [ 524.854979][T17985] __sys_bpf+0x643/0x950 [ 524.855015][T17985] ? __pfx___sys_bpf+0x10/0x10 [ 524.855065][T17985] ? ksys_write+0x242/0x270 [ 524.855101][T17985] ? __pfx_ksys_write+0x10/0x10 [ 524.855136][T17985] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 524.855161][T17985] __x64_sys_bpf+0x7c/0x90 [ 524.855192][T17985] do_syscall_64+0x174/0x580 [ 524.855215][T17985] ? trace_irq_disable+0x3b/0x140 [ 524.855247][T17985] ? clear_bhb_loop+0x40/0x90 [ 524.855273][T17985] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 524.855295][T17985] RIP: 0033:0x7f04fdb9ce59 [ 524.855315][T17985] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 524.855334][T17985] RSP: 002b:00007f04feae0028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 524.855356][T17985] RAX: ffffffffffffffda RBX: 00007f04fde15fa0 RCX: 00007f04fdb9ce59 [ 524.855372][T17985] RDX: 0000000000000048 RSI: 0000200000000600 RDI: 000000000000000a [ 524.855385][T17985] RBP: 00007f04feae0090 R08: 0000000000000000 R09: 0000000000000000 [ 524.855398][T17985] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 524.855411][T17985] R13: 00007f04fde16038 R14: 00007f04fde15fa0 R15: 00007ffea40e8f58 [ 524.855447][T17985] [ 525.144315][T17985] page_pool_create_percpu() gave up with errno -12 [ 525.722804][T17995] syzkaller0: entered promiscuous mode [ 525.745744][T17995] syzkaller0: entered allmulticast mode [ 525.771332][T18003] bridge0: port 2(bridge_slave_1) entered disabled state [ 525.779221][T18003] bridge0: port 1(bridge_slave_0) entered disabled state [ 528.071505][ T5643] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 528.100988][ T5643] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 528.121009][ T5643] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 528.146323][ T5643] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 528.181413][ T5643] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 530.112610][T18023] 8021q: adding VLAN 0 to HW filter on device team0 [ 530.152974][T18023] team_slave_0: entered promiscuous mode [ 530.160789][T18023] team_slave_1: entered promiscuous mode [ 530.169509][T18030] netlink: 67 bytes leftover after parsing attributes in process `syz.4.3001'. [ 530.192497][T18032] FAULT_INJECTION: forcing a failure. [ 530.192497][T18032] name failslab, interval 1, probability 0, space 0, times 0 [ 530.207741][T18032] CPU: 1 UID: 0 PID: 18032 Comm: syz.0.3003 Not tainted syzkaller #0 PREEMPT(full) [ 530.207775][T18032] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 530.207789][T18032] Call Trace: [ 530.207797][T18032] [ 530.207807][T18032] dump_stack_lvl+0xe8/0x150 [ 530.207906][T18032] should_fail_ex+0x40c/0x560 [ 530.207974][T18032] should_failslab+0xa8/0x100 [ 530.208021][T18032] __kmalloc_cache_noprof+0x88/0x660 [ 530.208058][T18032] ? __xdp_reg_mem_model+0x1e2/0x5a0 [ 530.208191][T18032] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 530.208254][T18032] __xdp_reg_mem_model+0x1e2/0x5a0 [ 530.208288][T18032] ? __pfx___xdp_reg_mem_model+0x10/0x10 [ 530.208324][T18032] xdp_reg_mem_model+0x22/0x40 [ 530.208349][T18032] bpf_test_run_xdp_live+0x292/0x1c20 [ 530.208387][T18032] ? bpf_dispatcher_change_prog+0xc4a/0xf20 [ 530.208433][T18032] ? __mutex_unlock_slowpath+0x1be/0x6f0 [ 530.208467][T18032] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 530.208499][T18032] ? __pfx_bpf_test_run_xdp_live+0x10/0x10 [ 530.208548][T18032] ? 0xffffffffa0205190 [ 530.208566][T18032] ? 0xffffffffa020624c [ 530.208612][T18032] ? __pfx_xdp_test_run_init_page+0x10/0x10 [ 530.208650][T18032] ? _copy_from_user+0x94/0xb0 [ 530.208682][T18032] ? bpf_test_init+0x113/0x150 [ 530.208702][T18032] ? xdp_convert_md_to_buff+0x5b/0x330 [ 530.208730][T18032] bpf_prog_test_run_xdp+0x7d8/0x11d0 [ 530.208771][T18032] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 530.208802][T18032] ? __fget_files+0x2a/0x420 [ 530.208854][T18032] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 530.208880][T18032] bpf_prog_test_run+0x2c5/0x340 [ 530.208915][T18032] __sys_bpf+0x643/0x950 [ 530.208949][T18032] ? __pfx___sys_bpf+0x10/0x10 [ 530.208999][T18032] ? ksys_write+0x242/0x270 [ 530.209038][T18032] ? __pfx_ksys_write+0x10/0x10 [ 530.209075][T18032] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 530.209115][T18032] __x64_sys_bpf+0x7c/0x90 [ 530.209145][T18032] do_syscall_64+0x174/0x580 [ 530.209170][T18032] ? trace_irq_disable+0x3b/0x140 [ 530.209206][T18032] ? clear_bhb_loop+0x40/0x90 [ 530.209233][T18032] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 530.209255][T18032] RIP: 0033:0x7f04fdb9ce59 [ 530.209275][T18032] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 530.209294][T18032] RSP: 002b:00007f04feae0028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 530.209318][T18032] RAX: ffffffffffffffda RBX: 00007f04fde15fa0 RCX: 00007f04fdb9ce59 [ 530.209334][T18032] RDX: 0000000000000048 RSI: 0000200000000600 RDI: 000000000000000a [ 530.209353][T18032] RBP: 00007f04feae0090 R08: 0000000000000000 R09: 0000000000000000 [ 530.209366][T18032] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 530.209378][T18032] R13: 00007f04fde16038 R14: 00007f04fde15fa0 R15: 00007ffea40e8f58 [ 530.209411][T18032] [ 530.280488][T18023] 8021q: adding VLAN 0 to HW filter on device bond4 [ 530.366693][ T5636] Bluetooth: hci0: command tx timeout [ 530.450004][T18023] ip6gretap0: entered promiscuous mode [ 530.450127][T18023] ip6gretap0: entered allmulticast mode [ 530.539384][T18023] 8021q: adding VLAN 0 to HW filter on device bond0 [ 530.648377][T18023] 8021q: adding VLAN 0 to HW filter on device eth0 [ 530.667788][T18023] 8021q: adding VLAN 0 to HW filter on device eth1 [ 530.687889][T18023] 8021q: adding VLAN 0 to HW filter on device eth2 [ 530.701672][T18023] 8021q: adding VLAN 0 to HW filter on device eth3 [ 530.714987][T18023] 8021q: adding VLAN 0 to HW filter on device bond10 [ 530.730161][T18023] 8021q: adding VLAN 0 to HW filter on device bond11 [ 531.002038][ T6747] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 531.063782][T18012] lo speed is unknown, defaulting to 1000 [ 531.170138][T18052] netlink: 36 bytes leftover after parsing attributes in process `syz.2.3010'. [ 531.218329][T18049] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 531.487229][ T6749] bond5: (slave veth7): link status definitely up, 10000 Mbps full duplex [ 531.509586][ T6749] bond5: (slave veth7): making interface the new active one [ 531.529973][T18067] netlink: 'syz.3.3014': attribute type 13 has an invalid length. [ 531.534697][ T6749] bond5: active interface up! [ 531.639454][T18066] netlink: 'syz.2.3013': attribute type 1 has an invalid length. [ 531.726028][T18067] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3014'. [ 531.740130][T18067] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3014'. [ 531.762388][T18072] netlink: 212408 bytes leftover after parsing attributes in process `syz.4.3015'. [ 531.773344][T18067] netlink: 'syz.3.3014': attribute type 6 has an invalid length. [ 531.782176][T18067] netlink: 'syz.3.3014': attribute type 5 has an invalid length. [ 531.903845][ T6747] netdevsim netdevsim3 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 531.926152][ T6747] netdevsim netdevsim3 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 531.944992][ T6747] netdevsim netdevsim3 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 531.954530][ T6747] netdevsim netdevsim3 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 532.030770][T18012] bridge0: port 1(bridge_slave_0) entered blocking state [ 532.038344][T18012] bridge0: port 1(bridge_slave_0) entered disabled state [ 532.039678][T18082] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3018'. [ 532.048023][T18012] bridge_slave_0: entered allmulticast mode [ 532.064189][T18012] bridge_slave_0: entered promiscuous mode [ 532.073444][T18012] bridge0: port 2(bridge_slave_1) entered blocking state [ 532.080857][T18012] bridge0: port 2(bridge_slave_1) entered disabled state [ 532.088457][T18012] bridge_slave_1: entered allmulticast mode [ 532.101014][T18012] bridge_slave_1: entered promiscuous mode [ 532.114823][T18084] netlink: 'syz.3.3019': attribute type 1 has an invalid length. [ 532.157365][T18012] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 532.257072][T18091] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3021'. [ 532.281682][T18084] 8021q: adding VLAN 0 to HW filter on device bond8 [ 532.306749][T18012] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 532.353359][T18088] bond8: (slave geneve3): making interface the new active one [ 532.363478][T18088] bond8: (slave geneve3): Enslaving as an active interface with an up link [ 532.428246][T18095] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3022'. [ 532.437605][T18095] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3022'. [ 532.458695][T18095] netlink: 58 bytes leftover after parsing attributes in process `syz.4.3022'. [ 532.492624][ T6736] netdevsim netdevsim1 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 532.519073][ T6736] netdevsim netdevsim1 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 532.529812][ T6736] netdevsim netdevsim1 eth3 (unregistering): unset [1, 1] type 2 family 0 port 39037 - 0 [ 532.546211][ T5636] Bluetooth: hci0: command tx timeout [ 532.569539][T18096] syzkaller0: entered promiscuous mode [ 532.575254][T18096] syzkaller0: entered allmulticast mode [ 532.689732][T18099] team_slave_0: left promiscuous mode [ 532.695206][T18099] team_slave_1: left promiscuous mode [ 532.932317][T18099] team0 (unregistering): Port device team_slave_0 removed [ 532.948627][T18117] netlink: 'syz.2.3027': attribute type 16 has an invalid length. [ 532.967782][T18099] team0 (unregistering): Port device team_slave_1 removed [ 533.009417][T18012] team0: Port device team_slave_0 added [ 533.029639][T18012] team0: Port device team_slave_1 added [ 533.097904][ T6736] netdevsim netdevsim1 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 533.110172][ T6736] netdevsim netdevsim1 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 533.135637][ T6736] netdevsim netdevsim1 eth2 (unregistering): unset [1, 1] type 2 family 0 port 39037 - 0 [ 533.574799][T18126] 8021q: adding VLAN 0 to HW filter on device .` [ 533.587965][T18126] 8021q: adding VLAN 0 to HW filter on device team0 [ 533.599956][T18012] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 533.615774][T18012] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 533.644814][T18012] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 533.658898][T18012] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 533.667300][T18012] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 533.711441][T18012] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 533.800167][ T6736] netdevsim netdevsim1 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 533.825881][ T6736] netdevsim netdevsim1 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 533.849015][ T6736] netdevsim netdevsim1 eth1 (unregistering): unset [1, 1] type 2 family 0 port 39037 - 0 [ 534.022159][ T6736] netdevsim netdevsim1 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 534.047390][ T6736] netdevsim netdevsim1 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 534.062551][ T6736] netdevsim netdevsim1 eth0 (unregistering): unset [1, 1] type 2 family 0 port 39037 - 0 [ 534.971047][T18012] hsr_slave_0: entered promiscuous mode [ 534.982277][T18012] hsr_slave_1: entered promiscuous mode [ 535.082441][T18167] syzkaller0: entered promiscuous mode [ 535.096137][T18167] syzkaller0: entered allmulticast mode [ 535.106777][ C0] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 535.249225][T18178] __nla_validate_parse: 2 callbacks suppressed [ 535.249260][T18178] netlink: 44 bytes leftover after parsing attributes in process `syz.0.3041'. [ 535.265480][T18178] netlink: 43 bytes leftover after parsing attributes in process `syz.0.3041'. [ 535.274622][T18178] netlink: 'syz.0.3041': attribute type 6 has an invalid length. [ 535.283551][T18178] netlink: 'syz.0.3041': attribute type 5 has an invalid length. [ 535.294238][T18178] netlink: 43 bytes leftover after parsing attributes in process `syz.0.3041'. [ 535.309371][T18178] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3041'. [ 535.830105][ T6736] bridge_slave_1: left promiscuous mode [ 535.854374][ T6736] bridge0: port 2(bridge_slave_1) entered disabled state [ 535.893400][ T6736] bridge_slave_0: left allmulticast mode [ 535.899557][ T6736] bridge_slave_0: left promiscuous mode [ 535.905576][ T6736] bridge0: port 1(bridge_slave_0) entered disabled state [ 535.979040][ T6736] lo: left allmulticast mode [ 536.456412][ T6736] bond3 (unregistering): (slave gretap2): Releasing active interface [ 536.597428][ T6736] bond1 (unregistering): (slave bridge1): Releasing backup interface [ 536.611553][ T6736] bond7 (unregistering): (slave bridge2): Releasing backup interface [ 536.619980][ T6736] bridge2 (unregistering): left promiscuous mode [ 536.628885][ T6736] bridge2 (unregistering): left allmulticast mode [ 536.650992][ T6736] team0: Port device bridge4 removed [ 536.698964][ T6736] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 536.709951][ T6736] bond0 (unregistering): Released all slaves [ 536.722229][ T6736] bond1 (unregistering): Released all slaves [ 536.742410][ T6736] bond2 (unregistering): (slave veth3): Releasing backup interface [ 536.760213][ T6736] bond2 (unregistering): Released all slaves [ 536.776662][ T6736] ÷ÿÿÿ (unregistering): Released all slaves [ 536.795186][ T6736] bond3 (unregistering): Released all slaves [ 536.825185][ T6736] bond4 (unregistering): (slave veth5): Releasing backup interface [ 536.835241][ T6736] bond4 (unregistering): Released all slaves [ 536.852941][ T6736] bond5 (unregistering): Released all slaves [ 536.869511][ T6736] bond6 (unregistering): Released all slaves [ 536.891483][ T6736] bond7 (unregistering): Released all slaves [ 536.913207][ T6736] bond8 (unregistering): Released all slaves [ 536.940474][ T6736] bond9 (unregistering): Released all slaves [ 536.956727][ T6736] bond10 (unregistering): Released all slaves [ 536.979754][ T6736] bond11 (unregistering): Released all slaves [ 536.997208][ T6736] bond12 (unregistering): Released all slaves [ 537.229211][T18226] netlink: 'syz.0.3053': attribute type 1 has an invalid length. [ 537.341026][T18230] netlink: 76 bytes leftover after parsing attributes in process `syz.3.3054'. [ 537.408272][T18236] netlink: 36 bytes leftover after parsing attributes in process `syz.0.3053'. [ 537.541382][T18226] workqueue: Failed to create a rescuer kthread for wq "bond12": -EINTR [ 537.541640][ T6736] m1Ie5nè‹Ò: left promiscuous mode [ 537.800535][ T6736] tipc: Left network mode [ 538.041511][T18254] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3058'. [ 538.317336][T18261] bridge7: the hash_elasticity option has been deprecated and is always 16 [ 538.406719][T18261] bridge7: entered allmulticast mode [ 538.815129][T18280] bond0: (slave dummy0): Removing an active aggregator [ 538.847487][T18280] bond0: (slave dummy0): Releasing backup interface [ 538.889712][T18280] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 539.206668][T18275] lo speed is unknown, defaulting to 1000 [ 539.339090][T18299] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3065'. [ 539.373434][T18297] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3065'. [ 539.449357][T18297] IPv6: sit2: Disabled Multicast RS [ 539.470388][T18297] sit2: entered allmulticast mode [ 539.489637][T18012] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 539.523598][T18012] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 539.665994][T18012] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 539.690883][T18012] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 539.701293][T18012] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 539.730762][T18012] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 539.816919][T18012] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 539.828673][T18012] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 539.903536][T18310] syzkaller0: entered promiscuous mode [ 539.910805][T18310] syzkaller0: entered allmulticast mode [ 540.304329][T18341] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3071'. [ 543.540625][T18373] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3075'. [ 543.617067][T18373] veth1: entered promiscuous mode [ 543.645685][T18373] macsec0: entered promiscuous mode [ 543.651383][T18373] macsec0: entered allmulticast mode [ 543.666494][ C0] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 543.691314][T18373] veth1: entered allmulticast mode [ 543.780908][T18387] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3078'. [ 543.925268][T18012] 8021q: adding VLAN 0 to HW filter on device bond0 [ 543.944514][T18381] lo speed is unknown, defaulting to 1000 [ 544.169222][T18012] 8021q: adding VLAN 0 to HW filter on device team0 [ 544.222372][ T6736] veth1_vlan: left promiscuous mode [ 544.240061][ T6736] ve: left promiscuous mode [ 544.644595][T18410] netlink: 'syz.0.3082': attribute type 16 has an invalid length. [ 544.653626][T18410] netlink: 'syz.0.3082': attribute type 17 has an invalid length. [ 544.781639][ T6736] team0 (unregistering): Port device team_slave_1 removed [ 544.851683][T18424] IPVS: set_ctl: invalid protocol: 33 172.20.20.170:20003 [ 545.251871][ T5289] veth1_macvtap: left promiscuous mode [ 545.362285][T18410] veth1_vlan: left promiscuous mode [ 545.378808][T18410] veth0_vlan: left promiscuous mode [ 545.389772][T18410] veth0_vlan: entered promiscuous mode [ 545.401534][T18410] veth1_vlan: entered promiscuous mode [ 545.420190][T18410] veth0_macvtap: left promiscuous mode [ 545.431122][T18410] veth0_macvtap: entered promiscuous mode [ 545.445252][T18410] netdevsim netdevsim0 netdevsim0: left promiscuous mode [ 545.459035][T18410] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 545.468279][T18410] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 545.478186][T18410] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 545.486998][T18410] mac80211_hwsim hwsim6 wlan0: left promiscuous mode [ 545.499709][T18410] mac80211_hwsim hwsim6 wlan0: entered promiscuous mode [ 545.524931][T18410] 8021q: adding VLAN 0 to HW filter on device bond1 [ 545.541914][T18410] 8021q: adding VLAN 0 to HW filter on device bond2 [ 545.554452][T18410] 8021q: adding VLAN 0 to HW filter on device bond3 [ 545.562870][T18410] 8021q: adding VLAN 0 to HW filter on device bond4 [ 545.593438][T18410] 8021q: adding VLAN 0 to HW filter on device bond5 [ 545.609052][T18410] 8021q: adding VLAN 0 to HW filter on device bond6 [ 545.622843][T18410] 8021q: adding VLAN 0 to HW filter on device bond7 [ 545.634059][T18410] 8021q: adding VLAN 0 to HW filter on device bond8 [ 545.689657][T18410] 8021q: adding VLAN 0 to HW filter on device bond9 [ 545.719783][T18410] 8021q: adding VLAN 0 to HW filter on device bond10 [ 545.740275][T18410] 8021q: adding VLAN 0 to HW filter on device bond11 [ 545.761117][T18410] batadv0: entered promiscuous mode [ 545.772872][T18410] 8021q: adding VLAN 0 to HW filter on device macvtap5 [ 545.782850][T18410] gretap0: left allmulticast mode [ 545.801070][T18410] A link change request failed with some changes committed already. Interface geneve4 may have been left with an inconsistent configuration, please check. [ 545.976133][ T84] bridge0: port 1(bridge_slave_0) entered blocking state [ 545.983397][ T84] bridge0: port 1(bridge_slave_0) entered forwarding state [ 545.994440][T18452] netlink: 32 bytes leftover after parsing attributes in process `syz.0.3086'. [ 546.009815][ T6749] netdevsim netdevsim0 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 546.020152][ T6749] netdevsim netdevsim0 netdevsim0: set [0, 1] type 1 family 0 port 2816 - 0 [ 546.061512][T18452] netlink: 16 bytes leftover after parsing attributes in process `syz.0.3086'. [ 546.090303][ T84] bond7: (slave veth7): link status definitely up, 10000 Mbps full duplex [ 546.099809][ T84] bond7: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 546.156017][ T84] bond7: active interface up! [ 546.205822][ T6749] netdevsim netdevsim0 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 546.231156][ T6749] netdevsim netdevsim0 netdevsim1: set [0, 1] type 1 family 0 port 2816 - 0 [ 546.270959][ T6749] netdevsim netdevsim0 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 546.299707][ T6749] netdevsim netdevsim0 netdevsim2: set [0, 1] type 1 family 0 port 2816 - 0 [ 546.310637][T18464] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3088'. [ 546.322263][ T84] netdevsim netdevsim0 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 546.337694][ T84] netdevsim netdevsim0 netdevsim3: set [0, 1] type 1 family 0 port 2816 - 0 [ 546.365263][ T47] bridge0: port 2(bridge_slave_1) entered blocking state [ 546.373428][ T47] bridge0: port 2(bridge_slave_1) entered forwarding state [ 546.392010][T18466] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3089'. [ 546.404622][T18466] netlink: 16186 bytes leftover after parsing attributes in process `syz.0.3089'. [ 546.675629][T18458] syzkaller0: entered promiscuous mode [ 546.686793][T18458] syzkaller0: entered allmulticast mode [ 546.750995][ T6736] IPVS: stop unused estimator thread 0... [ 546.752227][ T6747] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 546.795838][ T6217] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 546.804210][ T6747] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 546.915796][ T6202] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 546.969162][ T6747] ip6_tunnel: ip6gre3 xmit: Local address not yet configured! [ 547.004600][ T6217] ip6_tunnel: ip6gre3 xmit: Local address not yet configured! [ 547.014079][ T6747] ip6_tunnel: ip6gre3 xmit: Local address not yet configured! [ 547.205982][ T6217] ip6_tunnel: ip6gre3 xmit: Local address not yet configured! [ 547.544721][T18509] netlink: 'syz.0.3096': attribute type 1 has an invalid length. [ 547.583340][T18507] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3097'. [ 547.614542][T18507] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3097'. [ 547.825848][ T6217] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 548.202018][T18523] tipc: Enabled bearer , priority 0 [ 548.228551][T18523] syzkaller0: entered promiscuous mode [ 548.249179][T18523] syzkaller0: entered allmulticast mode [ 548.275019][T18523] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 548.387572][T18523] tipc: Resetting bearer [ 548.424161][T18522] tipc: Resetting bearer [ 548.516813][T18522] tipc: Disabling bearer [ 548.582431][T18547] smc: net device wlan0 applied user defined pnetid SYZ0 [ 549.025654][T18565] netlink: 'syz.2.3109': attribute type 8 has an invalid length. [ 549.035879][T18568] netlink: 20 bytes leftover after parsing attributes in process `syz.4.3110'. [ 549.045919][T18568] netlink: 20 bytes leftover after parsing attributes in process `syz.4.3110'. [ 549.082108][T18570] IPv6: NLM_F_REPLACE set, but no existing node found! [ 549.100655][T18568] geneve5: entered promiscuous mode [ 549.174528][T18012] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 549.239917][T18574] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3111'. [ 549.298768][T18576] nbd: must specify a size in bytes for the device [ 549.323632][T18574] ipvlan1: entered promiscuous mode [ 549.332606][T18574] ipvlan1: left promiscuous mode [ 549.442996][T18012] veth0_vlan: entered promiscuous mode [ 549.496604][T18012] veth1_vlan: entered promiscuous mode [ 549.654397][T18012] veth0_macvtap: entered promiscuous mode [ 549.693751][T18012] veth1_macvtap: entered promiscuous mode [ 549.824784][T18012] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 549.866045][T18012] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 549.937697][T11777] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 549.956508][T11777] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 549.958280][T18603] netlink: 'syz.3.3118': attribute type 9 has an invalid length. [ 549.994368][T11777] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 550.008236][T18607] netlink: 'syz.3.3118': attribute type 1 has an invalid length. [ 550.023344][T11777] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 550.036412][T18607] nbd: illegal input index 871591272 [ 550.060945][T18603] netlink: 'syz.3.3118': attribute type 6 has an invalid length. [ 550.258798][ T47] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 550.287989][ T47] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 550.375868][ T6750] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 550.407467][ T6750] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 550.865812][ C1] ip6_tnl_xmit_ctl: 1 callbacks suppressed [ 550.865832][ C1] ip6_tunnel: ip6gre3 xmit: Local address not yet configured! [ 550.879533][ C1] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 551.252042][T18651] __nla_validate_parse: 5 callbacks suppressed [ 551.252064][T18651] netlink: 184 bytes leftover after parsing attributes in process `syz.1.3127'. [ 551.284645][ T5643] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 551.305251][ T5643] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 551.314228][ T5643] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 551.322515][T18651] netlink: 184 bytes leftover after parsing attributes in process `syz.1.3127'. [ 551.335636][ T5643] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 551.349274][ T5643] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 551.402633][T18651] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3127'. [ 551.423472][T18651] syzkaller0: entered promiscuous mode [ 551.464497][T18651] syzkaller0: entered allmulticast mode [ 551.519756][T18651] TC_ACT_REPEAT abuse ? [ 552.149888][T18686] openvswitch: netlink: ufid size 20 bytes exceeds the range (1, 16) [ 552.170889][T18686] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 552.352414][ T6202] IPVS: starting estimator thread 0... [ 552.410454][ T6747] netdevsim netdevsim4 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 552.462645][T18700] netlink: 212408 bytes leftover after parsing attributes in process `syz.0.3136'. [ 552.475581][T18693] IPVS: using max 27 ests per chain, 64800 per kthread [ 552.485186][ T6747] netdevsim netdevsim4 eth3 (unregistering): unset [0, 1] type 1 family 0 port 4352 - 0 [ 552.528463][ T6747] netdevsim netdevsim4 eth3 (unregistering): unset [1, 0] type 2 family 0 port 20000 - 0 [ 552.552290][ T6747] netdevsim netdevsim4 eth3 (unregistering): unset [1, 1] type 2 family 0 port 6081 - 0 [ 552.579014][T18706] IPVS: rr: FWM 3 0x00000003 - no destination available [ 552.738300][ T6747] netdevsim netdevsim4 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 552.756693][ T6747] netdevsim netdevsim4 eth2 (unregistering): unset [0, 1] type 1 family 0 port 4352 - 0 [ 552.776845][ T6747] netdevsim netdevsim4 eth2 (unregistering): unset [1, 0] type 2 family 0 port 20000 - 0 [ 552.799673][ T6747] netdevsim netdevsim4 eth2 (unregistering): unset [1, 1] type 2 family 0 port 6081 - 0 [ 552.883677][ T6747] netdevsim netdevsim4 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 552.895166][ T6747] netdevsim netdevsim4 eth1 (unregistering): unset [0, 1] type 1 family 0 port 4352 - 0 [ 552.906788][ T6747] netdevsim netdevsim4 eth1 (unregistering): unset [1, 0] type 2 family 0 port 20000 - 0 [ 552.917694][ T6747] netdevsim netdevsim4 eth1 (unregistering): unset [1, 1] type 2 family 0 port 6081 - 0 [ 552.944978][T18652] lo speed is unknown, defaulting to 1000 [ 553.036293][ T6747] netdevsim netdevsim4 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 553.046517][ T6747] netdevsim netdevsim4 eth0 (unregistering): unset [0, 1] type 1 family 0 port 4352 - 0 [ 553.056925][ T6747] netdevsim netdevsim4 eth0 (unregistering): unset [1, 0] type 2 family 0 port 20000 - 0 [ 553.068457][ T6747] netdevsim netdevsim4 eth0 (unregistering): unset [1, 1] type 2 family 0 port 6081 - 0 [ 553.426960][ T5643] Bluetooth: hci2: command tx timeout [ 553.535388][ T6747] bridge10: port 1(erspan0) entered disabled state [ 553.558214][ T6747] pim6reg: left allmulticast mode [ 553.816704][ T6747] ip6gretap0 (unregistering): left allmulticast mode [ 554.278327][ T6747] bond6 (unregistering): (slave geneve3): Releasing active interface [ 554.464309][ T6747] bond9 (unregistering): (slave bridge9): Releasing active interface [ 554.519140][ T6747] bond1 (unregistering): Released all slaves [ 554.541449][ T6747] bond2 (unregistering): (slave veth3): Releasing backup interface [ 554.559928][ T6747] bond2 (unregistering): Released all slaves [ 554.581923][ T6747] bond3 (unregistering): Released all slaves [ 554.598271][ T6747] bond4 (unregistering): Released all slaves [ 554.617650][ T6747] bond5 (unregistering): (slave veth7): Releasing active interface [ 554.628983][ T6747] bond5 (unregistering): Released all slaves [ 554.649965][ T6747] bond6 (unregistering): Released all slaves [ 554.666606][ T6747] bond0 (unregistering): Released all slaves [ 554.687747][ T6747] bond7 (unregistering): Released all slaves [ 554.703946][ T6747] bond8 (unregistering): Released all slaves [ 554.721275][ T6747] bond9 (unregistering): Released all slaves [ 554.737751][ T6747] bond10 (unregistering): Released all slaves [ 554.762947][ T6747] bond11 (unregistering): Released all slaves [ 554.923854][T18652] bridge0: port 1(bridge_slave_0) entered blocking state [ 554.934496][T18652] bridge0: port 1(bridge_slave_0) entered disabled state [ 554.955307][T18652] bridge_slave_0: entered allmulticast mode [ 554.977777][T18652] bridge_slave_0: entered promiscuous mode [ 554.986966][T18652] bridge0: port 2(bridge_slave_1) entered blocking state [ 554.994274][T18652] bridge0: port 2(bridge_slave_1) entered disabled state [ 555.002036][T18652] bridge_slave_1: entered allmulticast mode [ 555.010319][T18652] bridge_slave_1: entered promiscuous mode [ 555.121849][T18652] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 555.141796][ T6747] tipc: Disabling bearer [ 555.151815][ T6747] tipc: Left network mode [ 555.158314][T18652] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 555.198303][T18652] team0: Port device team_slave_0 added [ 555.207282][T18652] team0: Port device team_slave_1 added [ 555.270249][T18652] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 555.278565][T18652] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 555.304977][T18652] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 555.317301][T18694] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 555.329280][T18652] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 555.337770][T18652] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 555.383767][T18652] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 555.511508][ T5643] Bluetooth: hci2: command tx timeout [ 555.839049][ T6747] hsr_slave_0: left promiscuous mode [ 555.862986][ T6747] hsr_slave_1: left promiscuous mode [ 555.903759][ T6747] veth1_vlan: left promiscuous mode [ 555.917144][ T6747] veth0_vlan: left promiscuous mode [ 556.098596][T18791] netlink: 'syz.0.3146': attribute type 1 has an invalid length. [ 556.151128][T18793] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3144'. [ 557.003782][T18652] hsr_slave_0: entered promiscuous mode [ 557.012066][T18652] hsr_slave_1: entered promiscuous mode [ 557.019114][T18652] debugfs: 'hsr0' already exists in 'hsr' [ 557.025109][T18652] Cannot create hsr debugfs directory [ 557.039307][T18791] workqueue: Failed to create a rescuer kthread for wq "bond12": -EINTR [ 557.040788][T18795] workqueue: Failed to create a rescuer kthread for wq "bond12": -EINTR [ 557.080271][T18797] batman_adv: batadv0: Adding interface: ip6gretap1 [ 557.119151][T18797] batman_adv: batadv0: The MTU of interface ip6gretap1 is too small (1434) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 557.184439][T18797] batman_adv: batadv0: Not using interface ip6gretap1 (retrying later): interface not active [ 557.484111][T18831] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3151'. [ 557.550739][T18832] xt_l2tp: invalid flags combination: 8 [ 557.589291][ T5643] Bluetooth: hci2: command tx timeout [ 557.600380][T18829] openvswitch: netlink: nsh attribute has 4 unknown bytes. [ 557.626356][T18835] netlink: 56 bytes leftover after parsing attributes in process `syz.2.3153'. [ 557.645951][T18829] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 557.662868][T18837] netlink: 136 bytes leftover after parsing attributes in process `syz.0.3152'. [ 557.679992][T18837] netlink: 308 bytes leftover after parsing attributes in process `syz.0.3152'. [ 557.683779][ T6747] IPVS: stop unused estimator thread 0... [ 557.693069][T18837] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3152'. [ 558.525899][T18873] syzkaller1: tun_chr_ioctl cmd 1074025677 [ 558.542751][T18873] syzkaller1: linktype set to 825 [ 558.782073][T18887] xt_TCPMSS: Only works on TCP SYN packets [ 559.025579][ C1] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 559.033421][ C1] ip6_tunnel: ip6gre3 xmit: Local address not yet configured! [ 559.593941][T18652] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 559.633631][T18652] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 559.661016][T18652] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 559.677147][ T5643] Bluetooth: hci2: command tx timeout [ 559.741606][T18652] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 559.781726][T18652] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 559.807716][T18652] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 559.823574][T18928] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3172'. [ 559.835867][T18652] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 559.861146][T18652] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 560.358239][T18941] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3174'. [ 560.477751][T18943] vxcan1: tx drop: invalid sa for name 0x0000000000000001 [ 560.627327][T18652] 8021q: adding VLAN 0 to HW filter on device bond0 [ 560.692010][T18652] 8021q: adding VLAN 0 to HW filter on device team0 [ 560.721865][ T6747] bridge0: port 1(bridge_slave_0) entered blocking state [ 560.729216][ T6747] bridge0: port 1(bridge_slave_0) entered forwarding state [ 560.753866][ T6747] bridge0: port 2(bridge_slave_1) entered blocking state [ 560.761187][ T6747] bridge0: port 2(bridge_slave_1) entered forwarding state [ 561.173769][T18963] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3181'. [ 561.209328][T18963] vlan0: entered promiscuous mode [ 561.221533][T18963] geneve1: entered promiscuous mode [ 561.236019][T18963] vlan0: entered allmulticast mode [ 561.251269][T18963] geneve1: entered allmulticast mode [ 561.314834][T18974] netlink: 'syz.1.3183': attribute type 1 has an invalid length. [ 561.340964][T18974] netlink: 244 bytes leftover after parsing attributes in process `syz.1.3183'. [ 561.461513][T18979] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3184'. [ 561.635845][T18990] netlink: 'syz.2.3188': attribute type 1 has an invalid length. [ 561.643920][T18990] netlink: 'syz.2.3188': attribute type 3 has an invalid length. [ 561.822500][T18999] sctp: [Deprecated]: syz.2.3190 (pid 18999) Use of int in max_burst socket option. [ 561.822500][T18999] Use struct sctp_assoc_value instead [ 561.964835][T18652] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 562.014151][T19004] lo speed is unknown, defaulting to 1000 [ 562.305254][T19012] x_tables: duplicate underflow at hook 1 [ 562.416450][T19015] lo: Caught tx_queue_len zero misconfig [ 562.693529][T19028] netlink: 'syz.0.3194': attribute type 1 has an invalid length. [ 562.841746][T19028] 8021q: adding VLAN 0 to HW filter on device bond12 [ 562.873801][T19033] geneve2: entered promiscuous mode [ 562.921709][T19035] bond12: (slave veth0_to_bond): making interface the new active one [ 562.943310][T19035] bond12: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 562.997283][T19028] bond12: entered promiscuous mode [ 563.002571][T19028] veth0_to_bond: entered promiscuous mode [ 563.008967][T19028] bond12: entered allmulticast mode [ 563.014265][T19028] veth0_to_bond: entered allmulticast mode [ 563.035656][T19041] macvlan2: entered promiscuous mode [ 563.041240][T19041] macvlan2: entered allmulticast mode [ 563.048277][T19041] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 563.059995][T19041] bond12: (slave macvlan2): the slave hw address is in use by the bond; giving it the hw address of veth0_to_bond [ 563.143365][T18652] veth0_vlan: entered promiscuous mode [ 563.310340][T18652] veth1_vlan: entered promiscuous mode [ 563.388833][T19047] __nla_validate_parse: 3 callbacks suppressed [ 563.388855][T19047] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3199'. [ 563.396867][T18652] veth0_macvtap: entered promiscuous mode [ 563.458286][T19047] netdevsim netdevsim1 netdevsim0: entered promiscuous mode [ 563.479624][T19047] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3199'. [ 563.487125][T19049] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3200'. [ 563.500783][T18652] veth1_macvtap: entered promiscuous mode [ 563.529567][T19049] bond13: option ad_actor_sys_prio: invalid value (0) [ 563.537304][T19049] bond13: option ad_actor_sys_prio: allowed values 1 - 65535 [ 563.548810][T19049] bond13 (unregistering): Released all slaves [ 563.601691][T18652] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 563.618828][T18652] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 563.639869][ T84] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 563.650813][ T84] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 563.660452][ T84] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 563.679166][ T84] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 563.885255][ T84] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 563.912015][ T84] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 563.940847][T19057] sctp: [Deprecated]: syz.3.3202 (pid 19057) Use of struct sctp_assoc_value in delayed_ack socket option. [ 563.940847][T19057] Use struct sctp_sack_info instead [ 564.004957][ T5926] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 564.021140][ T5926] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 564.513173][T19079] bridge_slave_0 (unregistering): left allmulticast mode [ 564.549318][T19079] bridge_slave_0 (unregistering): left promiscuous mode [ 564.576150][T19079] bridge0: port 1(bridge_slave_0) entered disabled state [ 564.709875][ T5636] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 564.728410][ T5636] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 564.739864][ T5636] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 564.750925][ T5636] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 564.759975][ T5636] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 565.088878][T19097] sctp: [Deprecated]: syz.2.3209 (pid 19097) Use of struct sctp_assoc_value in delayed_ack socket option. [ 565.088878][T19097] Use struct sctp_sack_info instead [ 565.186784][T19101] netlink: 36 bytes leftover after parsing attributes in process `syz.0.3210'. [ 565.489935][ T5926] netdevsim netdevsim3 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 565.549750][ T5926] netdevsim netdevsim3 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 565.768820][ T5926] netdevsim netdevsim3 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 565.810067][ T5926] netdevsim netdevsim3 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 565.964586][T19127] netlink: 108 bytes leftover after parsing attributes in process `syz.2.3214'. [ 565.993194][T19127] netlink: 108 bytes leftover after parsing attributes in process `syz.2.3214'. [ 566.031211][ T5926] netdevsim netdevsim3 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 566.056594][ T5926] netdevsim netdevsim3 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 566.198960][ T5926] netdevsim netdevsim3 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 566.214855][ T5926] netdevsim netdevsim3 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 566.245769][T19136] netlink: 216 bytes leftover after parsing attributes in process `syz.2.3216'. [ 566.276673][T19136] netlink: 'syz.2.3216': attribute type 2 has an invalid length. [ 566.295572][T19085] lo speed is unknown, defaulting to 1000 [ 566.304043][T19136] netlink: 'syz.2.3216': attribute type 1 has an invalid length. [ 566.786136][ T5636] Bluetooth: hci3: command tx timeout [ 566.994918][T19174] netlink: 20 bytes leftover after parsing attributes in process `syz.2.3226'. [ 567.163322][ T5926] bond3: left allmulticast mode [ 567.178728][ T5926] bond3: left promiscuous mode [ 567.203732][ T5926] bridge0: port 3(bond3) entered disabled state [ 567.411618][ T5926] dvmrp0: left allmulticast mode [ 567.431460][ T5926] pimreg9: left allmulticast mode [ 567.474293][T19196] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3230'. [ 567.718383][ T5926] bond5 (unregistering): (slave ip6gre3): Releasing backup interface [ 567.739423][ T5926] ip6gre3 (unregistering): left promiscuous mode [ 567.783422][T19163] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3222'. [ 567.998112][ C0] ================================================================== [ 568.006254][ C0] BUG: KASAN: slab-use-after-free in fib_rules_lookup+0x15e/0xeb0 [ 568.014169][ C0] Read of size 8 at addr ffff88801ef69480 by task swapper/0/0 [ 568.021691][ C0] [ 568.024075][ C0] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted syzkaller #0 PREEMPT(full) [ 568.024110][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 568.024125][ C0] Call Trace: [ 568.024138][ C0] [ 568.024147][ C0] dump_stack_lvl+0xe8/0x150 [ 568.024182][ C0] print_address_description+0x55/0x1e0 [ 568.024233][ C0] ? fib_rules_lookup+0x15e/0xeb0 [ 568.024258][ C0] print_report+0x58/0x70 [ 568.024278][ C0] kasan_report+0x117/0x150 [ 568.024317][ C0] ? fib_rules_lookup+0x15e/0xeb0 [ 568.024343][ C0] ? fib_rules_lookup+0x99/0xeb0 [ 568.024367][ C0] fib_rules_lookup+0x15e/0xeb0 [ 568.024393][ C0] ? fib_rules_lookup+0x99/0xeb0 [ 568.024420][ C0] ? __pfx_fib_rules_lookup+0x10/0x10 [ 568.024445][ C0] ? l3mdev_update_flow+0x26/0x610 [ 568.024540][ C0] ? l3mdev_update_flow+0x4ad/0x610 [ 568.024568][ C0] __fib_lookup+0x106/0x210 [ 568.024666][ C0] ? __pfx___fib_lookup+0x10/0x10 [ 568.024694][ C0] ? fib_lookup+0x49/0x440 [ 568.024754][ C0] ? ip_route_output_key_hash_rcu+0x274/0x2720 [ 568.024810][ C0] ip_route_output_key_hash_rcu+0x294/0x2720 [ 568.024843][ C0] ? irq_exit_rcu+0x9/0x30 [ 568.024880][ C0] ? pv_native_safe_halt+0xf/0x20 [ 568.024905][ C0] ? ip_route_output_key_hash+0xd8/0x2a0 [ 568.024936][ C0] ? ip_route_output_key_hash+0xd8/0x2a0 [ 568.024977][ C0] ip_route_output_key_hash+0x18d/0x2a0 [ 568.025010][ C0] ? __pfx_ip_route_output_key_hash+0x10/0x10 [ 568.025048][ C0] ? dst_cache_get+0x10e/0x5a0 [ 568.025137][ C0] ip_route_output_flow+0x2a/0x150 [ 568.025167][ C0] tipc_udp_xmit+0x1f3/0xb30 [ 568.025235][ C0] ? tipc_udp_xmit+0xb8/0xb30 [ 568.025260][ C0] ? __pfx_tipc_udp_xmit+0x10/0x10 [ 568.025290][ C0] ? __asan_memcpy+0x40/0x70 [ 568.025316][ C0] ? __pskb_copy_fclone+0xb7e/0x1200 [ 568.025373][ C0] ? __asan_memcpy+0x40/0x70 [ 568.025398][ C0] ? __pskb_copy_fclone+0xb7e/0x1200 [ 568.025427][ C0] tipc_udp_send_msg+0x27f/0x3f0 [ 568.025458][ C0] tipc_bearer_xmit_skb+0x2b3/0x400 [ 568.025531][ C0] ? tipc_bearer_xmit_skb+0xa9/0x400 [ 568.025554][ C0] ? __pfx_tipc_bearer_xmit_skb+0x10/0x10 [ 568.025576][ C0] ? tipc_disc_timeout+0x5d7/0x750 [ 568.025598][ C0] ? __local_bh_enable_ip+0xd0/0x130 [ 568.025623][ C0] tipc_disc_timeout+0x5f6/0x750 [ 568.025646][ C0] ? __pfx_tipc_disc_timeout+0x10/0x10 [ 568.025669][ C0] ? do_raw_spin_lock+0x12b/0x2f0 [ 568.025717][ C0] call_timer_fn+0x192/0x5e0 [ 568.025748][ C0] ? __pfx_tipc_disc_timeout+0x10/0x10 [ 568.025769][ C0] ? call_timer_fn+0xd4/0x5e0 [ 568.025792][ C0] ? __pfx_call_timer_fn+0x10/0x10 [ 568.025820][ C0] ? _raw_spin_unlock_irq+0x23/0x50 [ 568.025866][ C0] ? __pfx_tipc_disc_timeout+0x10/0x10 [ 568.025888][ C0] __run_timer_base+0x652/0x8b0 [ 568.025908][ C0] ? ktime_get+0x45/0x220 [ 568.025945][ C0] ? __pfx___run_timer_base+0x10/0x10 [ 568.025976][ C0] ? ktime_get+0x1f5/0x220 [ 568.026007][ C0] ? lapic_next_event+0x11/0x20 [ 568.026041][ C0] run_timer_softirq+0xb7/0x170 [ 568.026061][ C0] handle_softirqs+0x225/0x840 [ 568.026084][ C0] ? __irq_exit_rcu+0xca/0x220 [ 568.026109][ C0] __irq_exit_rcu+0xca/0x220 [ 568.026130][ C0] irq_exit_rcu+0x9/0x30 [ 568.026148][ C0] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 568.026172][ C0] [ 568.026180][ C0] [ 568.026188][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 568.026213][ C0] RIP: 0010:pv_native_safe_halt+0xf/0x20 [ 568.026238][ C0] Code: eb 80 02 c3 cc cc cc cc cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d 83 c2 23 00 fb f4 7c ff 02 00 cc cc cc cc cc cc cc cc cc cc cc cc 90 90 90 90 90 [ 568.026258][ C0] RSP: 0018:ffffffff8e607dc0 EFLAGS: 00000242 [ 568.026278][ C0] RAX: 000000000013f20b RBX: ffffffff819a301a RCX: 0000000080000001 [ 568.026295][ C0] RDX: 0000000000000001 RSI: ffffffff8dfad1b9 RDI: ffffffff8c2886a0 [ 568.026310][ C0] RBP: ffffffff8e607eb8 R08: ffff8880b86339db R09: 1ffff110170c673b [ 568.026326][ C0] R10: dffffc0000000000 R11: ffffed10170c673c R12: 0000000000000000 [ 568.026342][ C0] R13: 1ffffffff1cd1dd8 R14: 0000000000000000 R15: 1ffffffff1cd1dd8 [ 568.026360][ C0] ? do_idle+0x36a/0x5f0 [ 568.026389][ C0] default_idle+0x9/0x20 [ 568.026416][ C0] default_idle_call+0x72/0xb0 [ 568.026443][ C0] do_idle+0x36a/0x5f0 [ 568.026465][ C0] ? asm_sysvec_call_function_single+0x1a/0x20 [ 568.026492][ C0] ? __pfx_do_idle+0x10/0x10 [ 568.026521][ C0] cpu_startup_entry+0x43/0x60 [ 568.026545][ C0] rest_init+0x2de/0x300 [ 568.026576][ C0] start_kernel+0x38a/0x3e0 [ 568.026657][ C0] x86_64_start_reservations+0x24/0x30 [ 568.026719][ C0] x86_64_start_kernel+0x137/0x1b0 [ 568.026746][ C0] common_startup_64+0x13e/0x147 [ 568.026800][ C0] [ 568.026808][ C0] [ 568.490707][ C0] Allocated by task 5628: [ 568.495158][ C0] kasan_save_track+0x3e/0x80 [ 568.499881][ C0] __kasan_kmalloc+0x93/0xb0 [ 568.504521][ C0] __kmalloc_node_track_caller_noprof+0x4d7/0x7b0 [ 568.511012][ C0] kmemdup_noprof+0x2b/0x70 [ 568.515594][ C0] fib_rules_register+0x2f/0x400 [ 568.520574][ C0] fib4_rules_init+0x21/0x160 [ 568.525298][ C0] fib_net_init+0x17a/0x3e0 [ 568.529958][ C0] ops_init+0x35d/0x5d0 [ 568.534262][ C0] setup_net+0x118/0x350 [ 568.538556][ C0] copy_net_ns+0x4f9/0x720 [ 568.543020][ C0] create_new_namespaces+0x3f0/0x6b0 [ 568.548381][ C0] unshare_nsproxy_namespaces+0x149/0x190 [ 568.554142][ C0] ksys_unshare+0x57d/0xa00 [ 568.558690][ C0] __x64_sys_unshare+0x38/0x50 [ 568.563503][ C0] do_syscall_64+0x174/0x580 [ 568.568141][ C0] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 568.574066][ C0] [ 568.576425][ C0] Freed by task 23: [ 568.580257][ C0] kasan_save_track+0x3e/0x80 [ 568.584988][ C0] kasan_save_free_info+0x40/0x50 [ 568.590062][ C0] __kasan_slab_free+0x5c/0x80 [ 568.594915][ C0] __rcu_free_sheaf_prepare+0x12d/0x2a0 [ 568.600506][ C0] rcu_free_sheaf+0x31/0x200 [ 568.605147][ C0] rcu_core+0x78b/0x10a0 [ 568.609439][ C0] handle_softirqs+0x225/0x840 [ 568.614235][ C0] run_ksoftirqd+0x36/0x60 [ 568.618666][ C0] smpboot_thread_fn+0x57c/0xa80 [ 568.623730][ C0] kthread+0x389/0x470 [ 568.627859][ C0] ret_from_fork+0x514/0xb70 [ 568.632455][ C0] ret_from_fork_asm+0x1a/0x30 [ 568.637239][ C0] [ 568.639577][ C0] The buggy address belongs to the object at ffff88801ef69400 [ 568.639577][ C0] which belongs to the cache kmalloc-192 of size 192 [ 568.653667][ C0] The buggy address is located 128 bytes inside of [ 568.653667][ C0] freed 192-byte region [ffff88801ef69400, ffff88801ef694c0) [ 568.667569][ C0] [ 568.669931][ C0] The buggy address belongs to the physical page: [ 568.676420][ C0] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1ef69 [ 568.685280][ C0] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) [ 568.692459][ C0] page_type: f5(slab) [ 568.696527][ C0] raw: 00fff00000000000 ffff88813fe163c0 dead000000000100 dead000000000122 [ 568.705125][ C0] raw: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000 [ 568.713724][ C0] page dumped because: kasan: bad access detected [ 568.720231][ C0] page_owner tracks the page as allocated [ 568.725972][ C0] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 4667124545, free_ts 0 [ 568.745027][ C0] post_alloc_hook+0x22d/0x280 [ 568.749823][ C0] get_page_from_freelist+0x24ae/0x2530 [ 568.755407][ C0] __alloc_frozen_pages_noprof+0x18d/0x380 [ 568.761279][ C0] allocate_slab+0x77/0x660 [ 568.765853][ C0] refill_objects+0x336/0x3d0 [ 568.770577][ C0] __pcs_replace_empty_main+0x320/0x720 [ 568.776148][ C0] __kmalloc_cache_noprof+0x388/0x660 [ 568.781563][ C0] kset_create_and_add+0x5a/0x170 [ 568.786722][ C0] o2cb_sys_init+0x47/0xd0 [ 568.791267][ C0] init_o2nm+0x5b/0xa0 [ 568.795486][ C0] do_one_initcall+0x250/0x870 [ 568.800302][ C0] do_initcall_level+0x10a/0x1a0 [ 568.805284][ C0] do_initcalls+0x59/0xa0 [ 568.809660][ C0] kernel_init_freeable+0x29d/0x3e0 [ 568.814874][ C0] kernel_init+0x1d/0x1d0 [ 568.819233][ C0] ret_from_fork+0x514/0xb70 [ 568.823847][ C0] page_owner free stack trace missing [ 568.829219][ C0] [ 568.831550][ C0] Memory state around the buggy address: [ 568.837185][ C0] ffff88801ef69380: 00 00 00 00 00 00 00 07 fc fc fc fc fc fc fc fc [ 568.845261][ C0] ffff88801ef69400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 568.853442][ C0] >ffff88801ef69480: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 568.861567][ C0] ^ [ 568.865650][ C0] ffff88801ef69500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 568.865885][ T5636] Bluetooth: hci3: command tx timeout [ 568.873776][ C0] ffff88801ef69580: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc [ 568.873791][ C0] ================================================================== [ 568.873982][ C0] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 568.874001][ C0] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted syzkaller #0 PREEMPT(full) [ 568.874018][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 568.874029][ C0] Call Trace: [ 568.874036][ C0] [ 568.874043][ C0] vpanic+0x56c/0xa60 [ 568.874069][ C0] ? __pfx_vpanic+0x10/0x10 [ 568.874091][ C0] panic+0xc5/0xd0 [ 568.874107][ C0] ? __pfx_panic+0x10/0x10 [ 568.874125][ C0] ? fib_rules_lookup+0x15e/0xeb0 [ 568.874148][ C0] ? fib_rules_lookup+0x15e/0xeb0 [ 568.874165][ C0] check_panic_on_warn+0x89/0xb0 [ 568.874188][ C0] ? fib_rules_lookup+0x15e/0xeb0 [ 568.874204][ C0] end_report+0x73/0x170 [ 568.874229][ C0] ? fib_rules_lookup+0x15e/0xeb0 [ 568.874245][ C0] kasan_report+0x128/0x150 [ 568.874269][ C0] ? fib_rules_lookup+0x15e/0xeb0 [ 568.874289][ C0] ? fib_rules_lookup+0x99/0xeb0 [ 568.874305][ C0] fib_rules_lookup+0x15e/0xeb0 [ 568.874323][ C0] ? fib_rules_lookup+0x99/0xeb0 [ 568.874343][ C0] ? __pfx_fib_rules_lookup+0x10/0x10 [ 568.874361][ C0] ? l3mdev_update_flow+0x26/0x610 [ 568.874382][ C0] ? l3mdev_update_flow+0x4ad/0x610 [ 568.874401][ C0] __fib_lookup+0x106/0x210 [ 568.874418][ C0] ? __pfx___fib_lookup+0x10/0x10 [ 568.874438][ C0] ? fib_lookup+0x49/0x440 [ 568.874458][ C0] ? ip_route_output_key_hash_rcu+0x274/0x2720 [ 568.874493][ C0] ip_route_output_key_hash_rcu+0x294/0x2720 [ 568.874518][ C0] ? irq_exit_rcu+0x9/0x30 [ 568.874534][ C0] ? pv_native_safe_halt+0xf/0x20 [ 568.874552][ C0] ? ip_route_output_key_hash+0xd8/0x2a0 [ 568.874575][ C0] ? ip_route_output_key_hash+0xd8/0x2a0 [ 568.874600][ C0] ip_route_output_key_hash+0x18d/0x2a0 [ 568.874625][ C0] ? __pfx_ip_route_output_key_hash+0x10/0x10 [ 568.874653][ C0] ? dst_cache_get+0x10e/0x5a0 [ 568.874679][ C0] ip_route_output_flow+0x2a/0x150 [ 568.874702][ C0] tipc_udp_xmit+0x1f3/0xb30 [ 568.874725][ C0] ? tipc_udp_xmit+0xb8/0xb30 [ 568.874745][ C0] ? __pfx_tipc_udp_xmit+0x10/0x10 [ 568.874767][ C0] ? __asan_memcpy+0x40/0x70 [ 568.874786][ C0] ? __pskb_copy_fclone+0xb7e/0x1200 [ 568.874806][ C0] ? __asan_memcpy+0x40/0x70 [ 568.874825][ C0] ? __pskb_copy_fclone+0xb7e/0x1200 [ 568.874849][ C0] tipc_udp_send_msg+0x27f/0x3f0 [ 568.874871][ C0] tipc_bearer_xmit_skb+0x2b3/0x400 [ 568.874889][ C0] ? tipc_bearer_xmit_skb+0xa9/0x400 [ 568.874905][ C0] ? __pfx_tipc_bearer_xmit_skb+0x10/0x10 [ 568.874922][ C0] ? tipc_disc_timeout+0x5d7/0x750 [ 568.874939][ C0] ? __local_bh_enable_ip+0xd0/0x130 [ 568.874957][ C0] tipc_disc_timeout+0x5f6/0x750 [ 568.874978][ C0] ? __pfx_tipc_disc_timeout+0x10/0x10 [ 568.874996][ C0] ? do_raw_spin_lock+0x12b/0x2f0 [ 568.875023][ C0] call_timer_fn+0x192/0x5e0 [ 568.875042][ C0] ? __pfx_tipc_disc_timeout+0x10/0x10 [ 568.875057][ C0] ? call_timer_fn+0xd4/0x5e0 [ 568.875076][ C0] ? __pfx_call_timer_fn+0x10/0x10 [ 568.875099][ C0] ? _raw_spin_unlock_irq+0x23/0x50 [ 568.875117][ C0] ? __pfx_tipc_disc_timeout+0x10/0x10 [ 568.875132][ C0] __run_timer_base+0x652/0x8b0 [ 568.875148][ C0] ? ktime_get+0x45/0x220 [ 568.875175][ C0] ? __pfx___run_timer_base+0x10/0x10 [ 568.875192][ C0] ? ktime_get+0x1f5/0x220 [ 568.875215][ C0] ? lapic_next_event+0x11/0x20 [ 568.875236][ C0] run_timer_softirq+0xb7/0x170 [ 568.875252][ C0] handle_softirqs+0x225/0x840 [ 568.875269][ C0] ? __irq_exit_rcu+0xca/0x220 [ 568.875289][ C0] __irq_exit_rcu+0xca/0x220 [ 568.875305][ C0] irq_exit_rcu+0x9/0x30 [ 568.875325][ C0] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 568.875344][ C0] [ 568.875350][ C0] [ 568.875357][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 568.875381][ C0] RIP: 0010:pv_native_safe_halt+0xf/0x20 [ 568.875405][ C0] Code: eb 80 02 c3 cc cc cc cc cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d 83 c2 23 00 fb f4 7c ff 02 00 cc cc cc cc cc cc cc cc cc cc cc cc 90 90 90 90 90 [ 568.875424][ C0] RSP: 0018:ffffffff8e607dc0 EFLAGS: 00000242 [ 568.875444][ C0] RAX: 000000000013f20b RBX: ffffffff819a301a RCX: 0000000080000001 [ 568.875470][ C0] RDX: 0000000000000001 RSI: ffffffff8dfad1b9 RDI: ffffffff8c2886a0 [ 568.875539][ C0] RBP: ffffffff8e607eb8 R08: ffff8880b86339db R09: 1ffff110170c673b [ 568.875598][ C0] R10: dffffc0000000000 R11: ffffed10170c673c R12: 0000000000000000 [ 568.875663][ C0] R13: 1ffffffff1cd1dd8 R14: 0000000000000000 R15: 1ffffffff1cd1dd8 [ 568.875718][ C0] ? do_idle+0x36a/0x5f0 [ 568.875796][ C0] default_idle+0x9/0x20 [ 568.875871][ C0] default_idle_call+0x72/0xb0 [ 568.875946][ C0] do_idle+0x36a/0x5f0 [ 568.876012][ C0] ? asm_sysvec_call_function_single+0x1a/0x20 [ 568.876078][ C0] ? __pfx_do_idle+0x10/0x10 [ 568.876161][ C0] cpu_startup_entry+0x43/0x60 [ 568.876229][ C0] rest_init+0x2de/0x300 [ 568.876306][ C0] start_kernel+0x38a/0x3e0 [ 568.876372][ C0] x86_64_start_reservations+0x24/0x30 [ 568.876448][ C0] x86_64_start_kernel+0x137/0x1b0 [ 568.876524][ C0] common_startup_64+0x13e/0x147 [ 568.876630][ C0] [ 568.881455][ C0] Kernel Offset: disabled