last executing test programs: 1m58.673546714s ago: executing program 0 (id=12303): syz_emit_ethernet(0x6e, &(0x7f0000000240)=ANY=[@ANYBLOB="ffffffffffffffffffffffff86dd6708100000003aff00034000000000000000ffffac1414aaff020000000000000000000000000001"], 0x0) (async, rerun: 64) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, &(0x7f0000000040)={0x1, 0x2c, &(0x7f0000000000)=[@in6={0xa, 0x4e24, 0xa73, @private0, 0xa}, @in={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x37}}]}, &(0x7f0000000080)=0x10) (rerun: 64) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f00000000c0)={r0, 0x2, 0x5}, &(0x7f0000000140)=0x8) pipe(&(0x7f0000000180)={0xffffffffffffffff}) (async) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x20000004}, 0x0) (async, rerun: 64) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x16, 0x16, &(0x7f0000000400)=ANY=[@ANYBLOB="61124c00000000006113500000000000bf2000000000000007000000180000003d030100000000009500f000000000006926000000000000bf67100000000000560602000fff00006706000020000000170200000ee60000bf250000000000002d350000000000006507000002080000070700004c0000001f75000000000000bf54000000000000070400000400f9ffbd35010000000000840400000000000014000000100000009500000000000000db13d5d8b741f2cdaabc8383c8f56b8c2b848b00ea6553f304000000815dcf00c3ee7b042d1937ba52037fdedb2150e1918c30b6301f0212feb0cff9fc67357d81b2cc1a9e37d7b75c020b070000003eb22062bafaca036d9ec7db6671573e202e0a92ee4ba12b064981cc32d1ac0b9ecc8f604dca20563e1c1e7624cc3b88b330ad416c4c1d8c60589b6445a4ffff50df4d34bc5847bebb943a84cb56956931ba9cc39c4a9deea5d77aa843240000000000"], &(0x7f0000000580)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @flow_dissector}, 0x48) (async, rerun: 64) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$tipc(&(0x7f00000005c0), 0xffffffffffffffff) (async) r3 = socket$nl_route(0x10, 0x3, 0x0) syz_genetlink_get_family_id$devlink(&(0x7f0000000600), r3) (async) sendmsg$nl_route(r3, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000680)={&(0x7f00000006c0)=ANY=[@ANYBLOB="3000000010000100"/20, @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=0x0, @ANYBLOB="08001b"], 0x30}}, 0x0) (async) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$team(&(0x7f0000000700), 0xffffffffffffffff) sendmsg$TEAM_CMD_OPTIONS_SET(r4, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000007c0)={0x64, r5, 0x405, 0x70bd27, 0x25dfdbff, {}, [{{0x8}, {0x48, 0x2, 0x0, 0x1, [{0x44, 0x1, @name={{0x24}, {0x5}, {0x11, 0x4, 'activebackup\x00'}}}]}}]}, 0x64}, 0x1, 0x0, 0x0, 0x800}, 0x4c004) (async) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r6, 0x8933, &(0x7f0000000840)={'team0\x00', 0x0}) (async, rerun: 64) r8 = socket$inet_udp(0x2, 0x2, 0x0) (rerun: 64) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r8, 0x89f2, &(0x7f0000000880)={'syztnl2\x00', &(0x7f00000008c0)={'syztnl1\x00', r7, 0x8000, 0x0, 0x0, 0x0, {{0x13, 0x4, 0x3, 0x1, 0x4c, 0x66, 0x0, 0x8, 0x2f, 0x0, @dev={0xac, 0x14, 0x14, 0xc}, @remote, {[@generic={0x3bf9dea7a7f65c83, 0xf, "9245e45615005ac194ce468a8a"}, @lsrr={0x83, 0x23, 0x23, [@remote, @private=0xa010101, @loopback, @empty, @dev={0xac, 0x14, 0x14, 0x2c}, @private=0xa010102, @multicast1, @private=0xa010101]}, @ssrr={0x89, 0x3, 0x41}]}}}}}) (async) r9 = accept4(r1, &(0x7f0000000940)=@ax25={{0x3, @null}, [@rose, @default, @rose, @remote, @netrom, @netrom, @default]}, &(0x7f00000009c0)=0x80, 0x0) bind$bt_hci(r9, &(0x7f0000000a00)={0x1f, 0x2, 0x3}, 0x6) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000a40)) (async) socket$nl_netfilter(0x10, 0x3, 0xc) (async, rerun: 32) r10 = socket$kcm(0x2, 0x1, 0x84) (rerun: 32) sendmsg$nl_route(r6, &(0x7f0000000a80)={0x0, 0x0, &(0x7f0000000ac0)={&(0x7f0000000b00)=@newlink={0x3c, 0x10, 0x7, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x10156}, [@IFLA_IFNAME={0x14, 0x3, 'vlan0\x00'}, @IFLA_MASTER={0x8, 0xa, r7}]}, 0x3c}}, 0x0) r11 = bpf$MAP_CREATE(0x0, &(0x7f0000000b40)=ANY=[@ANYBLOB="0a00000009000000080000000180000000000000", @ANYRES32=0x1, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000bc0)={0x0, 0x0, &(0x7f0000000c00), &(0x7f0000000c40), 0x1000, r11}, 0x38) (async) sendmsg$TIPC_CMD_ENABLE_BEARER(r4, &(0x7f0000000c80)={0x0, 0x0, &(0x7f0000000cc0)={&(0x7f0000000d00)=ANY=[@ANYRES32=r10, @ANYRES32=r11], 0x34}, 0x1, 0x0, 0x0, 0x4000010}, 0x0) (async) sendmsg$NFT_BATCH(r2, &(0x7f0000000d40)={0x0, 0x0, &(0x7f0000000d80)={&(0x7f0000000dc0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a80000000060a0b0400000000000000000200fffe540004802800018007000100637400001c0002800800014000000002080002400000001405000300010000002800018007000100637400001c0002800800024000000011080004400000000c05000300010000000900010073797a30000000000900020073797a320000000014000000110001"], 0xa8}, 0x1, 0x0, 0x0, 0x840}, 0x0) 1m57.478826546s ago: executing program 0 (id=12309): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r0, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000800)={0x0, 0x2c, &(0x7f0000000840)=[@in={0x2, 0x4e21, @rand_addr=0x64010100}, @in6={0xa, 0x4e21, 0x3, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x9}]}, &(0x7f0000000880)=0x10) r2 = accept$packet(0xffffffffffffffff, 0x0, &(0x7f0000000100)) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$unix(0x1, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000200)={'syzkaller1\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r6, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000002c0)=@newqdisc={0x30, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {0x0, 0xffff}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r7, &(0x7f0000000480)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000500)={0x28, 0x26, 0x1, 0x270bd1d, 0x25dfdbf7, {0x15}, [@nested={0x14, 0x138, 0x0, 0x1, [@nested={0x10, 0xef, 0x0, 0x1, [@typed={0xc, 0xfd, 0x0, 0x0, @u64=0x100000000000}]}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x40088c4}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)=@newtfilter={0x88, 0x2c, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {0xb, 0x7}, {0x5, 0xffff}, {0x300}}, [@filter_kind_options=@f_matchall={{0xd}, {0x54, 0x2, [@TCA_MATCHALL_ACT={0x50, 0x2, [@m_mpls={0x4c, 0x1, 0x0, 0x0, {{0x9}, {0x20, 0x2, 0x0, 0x1, [@TCA_MPLS_PARMS={0x1c, 0x2, {{0x0, 0x0, 0x8, 0x0, 0x102}, 0x3}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x1}}}}]}]}}]}, 0x88}, 0x1, 0x0, 0x0, 0x2400c8d0}, 0x0) sendto$packet(r2, &(0x7f0000000140)="80ae2f9c68c38b2c01dd28e455bb837bb97913097bf552c31c2a8f214af1e6da28fdcef82db999b8eeb83eea9792580e8027d21cf22054b0852ff407495b8e53e86df57c6f488d63ffe2a8f8e03f43f8bf3e2df046e6f987b31c3669e57ca98c4ea80f7b21047609ecd2abb0f8e46ae12fe4a346a52cd4bce6b8ffcfcedb38bde8cc8971a01960adac60445a6fe566e8ea3357515fbee3d2937ec1612ead703c2c1ea3ea2071181321aabf967c7d48f71720f5e6bab3", 0xb6, 0x44810, &(0x7f0000000440)={0x11, 0x8, r5, 0x1, 0x81, 0x6, @local}, 0x14) getsockopt$inet_sctp6_SCTP_RECVNXTINFO(0xffffffffffffffff, 0x84, 0x21, &(0x7f0000000080), &(0x7f00000000c0)=0x4) r8 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000580), 0xffffffffffffffff) r9 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r10 = syz_genetlink_get_family_id$ieee802154(&(0x7f00000005c0), r9) ioctl$sock_SIOCGIFINDEX_802154(r9, 0x8933, &(0x7f0000000600)={'wpan0\x00', 0x0}) sendmsg$IEEE802154_LLSEC_ADD_DEV(r9, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000680)={&(0x7f00000006c0)={0x14, r10, 0x601}, 0x14}}, 0x0) ioctl$sock_SIOCSIFVLAN_DEL_VLAN_CMD(r7, 0x8983, &(0x7f00000007c0)={0x1, 'syz_tun\x00', {}, 0x3}) sendmsg$IEEE802154_LLSEC_ADD_SECLEVEL(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x80000200}, 0xc, &(0x7f0000000740)={&(0x7f0000000700)={0x30, r8, 0x100, 0x70bd29, 0x25dfdbfd, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r11}, @IEEE802154_ATTR_LLSEC_SECLEVELS={0x5, 0x35, 0x40}]}, 0x30}, 0x1, 0x0, 0x0, 0x20004094}, 0x4000) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r0, 0x84, 0x7a, &(0x7f00000008c0)={r1, @in6={{0xa, 0x0, 0x4, @mcast1, 0x80000000}}}, &(0x7f0000000980)=0x84) 1m56.543412356s ago: executing program 0 (id=12317): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000380), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000003c0)={'syzkaller1\x00', 0x5001}) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$int_in(r2, 0x5452, &(0x7f0000000000)=0x80000000) listen(r2, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)=@base={0x12, 0x4, 0x4, 0x12}, 0x50) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000000c0)={r3, &(0x7f0000000100), &(0x7f0000000140)=@tcp6=r2}, 0x20) recvmmsg(r2, &(0x7f0000000180)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000240)=""/52, 0x34}], 0x1}, 0xe}], 0x2, 0x0, 0x0) shutdown(r2, 0x1) r4 = socket$unix(0x1, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000c80)={'syzkaller1\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000d00)={&(0x7f0000000d40)=@newqdisc={0x30, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000280)=0x14) r7 = socket$inet6_sctp(0xa, 0x1, 0x84) r8 = socket(0x2, 0x80805, 0x0) sendmmsg$inet(r8, &(0x7f00000002c0)=[{{&(0x7f0000000300)={0x2, 0x0, @rand_addr=0x640100ff}, 0x10, &(0x7f0000000340)=[{&(0x7f0000000400)="83", 0x1}], 0x1}}], 0x1, 0x41) r9 = socket$inet(0x2, 0x80001, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r9, 0x84, 0x14, &(0x7f0000000440)=@assoc_value={0x0}, &(0x7f0000000480)=0x8) setsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(r8, 0x84, 0xa, &(0x7f00000004c0)={0x8, 0x1, 0x200, 0x3, 0x2, 0x7ff, 0xfff, 0x6e4c8f, r10}, 0x20) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r7, 0x84, 0x1f, &(0x7f0000000500)={r10, @in={{0x2, 0x4e24, @private=0xa010100}}, 0x6, 0x7}, 0x90) sendmsg$nl_route_sched(r1, &(0x7f0000000d80)={0x0, 0x0, &(0x7f0000000dc0)={&(0x7f0000000e00)=@getchain={0x54, 0x66, 0x100, 0x70bd2c, 0x25dfdbfe, {0x0, 0x0, 0x0, r6, {0x4, 0xfffb}, {0xffff, 0x10}, {0x2}}, [{0x8, 0xb, 0x7}, {0x8, 0xb, 0x8}, {0x8, 0xb, 0x7fff}, {0x8, 0xb, 0x6}, {0x8, 0xb, 0x8000}, {0x8, 0xb, 0x5}]}, 0x54}}, 0x0) 1m55.522290719s ago: executing program 0 (id=12323): mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x8, 0x32, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x18, 0xf, &(0x7f00000002c0)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x8c, 0x0, 0x0, 0x0, 0xec5}, {{0x18, 0x1, 0x1, 0x0, r0}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xfeff}, {0x85, 0x0, 0x0, 0x86}, {0x7, 0x1, 0xb, 0x9, 0x0, 0x20}}, {{0x5, 0x0, 0x5, 0x9, 0x0, 0x1, 0xffffffff}}, [], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x3}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000340)='GPL\x00', 0xf, 0x1002, &(0x7f00000005c0)=""/4098, 0x41100, 0x4b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffa}, 0x94) (fail_nth: 16) 1m54.64785099s ago: executing program 0 (id=12325): pipe(0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="1e0000000000000004000000ff"], 0x48) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="020000000400000005000000aa"], 0x50) bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000019c0), &(0x7f0000001a00), 0xa7c, r2, 0x4}, 0xfffffffffffffd35) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r3, &(0x7f0000001a40)={0x0, 0x0, &(0x7f0000001a80)={&(0x7f0000001ac0)=ANY=[@ANYBLOB="7400000040000901feffffff00000000017c0000040042800c0001800600060065580000500002804a0011"], 0x74}, 0x1, 0x0, 0x0, 0x48815}, 0xc000) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000001b00)={0x3, 0xc, &(0x7f00000003c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b704000000000000850000005700000095"], 0x0, 0x0, 0x0, 0x0, 0x20880}, 0x94) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x11, 0x14, &(0x7f00000005c0)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b7030000000007008500000004"], &(0x7f0000000640)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x7e, '\x00', 0x0, @fallback=0x27, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000700)={r4}, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000080)=ANY=[@ANYBLOB, @ANYRESOCT=r0, @ANYRES8], 0x58}, 0x1, 0x0, 0x0, 0x20015051}, 0x4801) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000380)='memory.events\x00', 0x275a, 0x0) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='memory.events\x00', 0x7a05, 0x1700) syz_emit_ethernet(0x46, &(0x7f00000003c0)=ANY=[], 0x0) bind$inet(0xffffffffffffffff, 0x0, 0x0) bpf$ENABLE_STATS(0x20, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$packet(0x11, 0x2, 0x300) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NL80211_CMD_SET_POWER_SAVE(0xffffffffffffffff, &(0x7f0000000840)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000800)={&(0x7f00000007c0)=ANY=[@ANYBLOB='@\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00012abd7000fcdbdf253d00000008000300", @ANYRES32=0x0, @ANYBLOB="0c040000000000001100000008005d000000"], 0x40}, 0x1, 0x0, 0x0, 0x20004000}, 0x480c4) sendmsg$IPSET_CMD_CREATE(r6, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000005c0)=ANY=[], 0x5c}, 0x1, 0x0, 0x0, 0x24000024}, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000000)={0xffffffffffffffff, 0x20, &(0x7f00000000c0)={&(0x7f0000000140)=""/115, 0x73, 0x0, 0x0}}, 0x10) r8 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$bt_hci(r8, 0x84, 0x80, &(0x7f0000000940)=""/4127, &(0x7f0000001980)=0x101f) sendmsg$nl_generic(r7, &(0x7f0000000680)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000740)=ANY=[@ANYBLOB="1c000000290001000000000000000000020000000800010000000000ceae1be3ae0900e94354c9b413af6ca98fc175f4e08dc98f156e8970158c7361d8d3b90900094d0c041f5c3a"], 0x1c}}, 0x20000040) write$cgroup_int(r5, &(0x7f0000000200)=0x10001, 0x12) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x12, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, @cgroup_sock_addr=0x1d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x94) socket$inet_tcp(0x2, 0x1, 0x0) socket$netlink(0x10, 0x3, 0x0) 1m53.40818926s ago: executing program 0 (id=12333): bpf$PROG_LOAD(0x5, &(0x7f0000000400)={0x1b, 0x20000000000001e4, &(0x7f00000004c0)=ANY=[@ANYBLOB="18020000040000000000000000000000850000002c0000001801000020207325bfa100000000000007010000f8ffffffb7020000080000000000000000000000850000007200000095"], &(0x7f0000000540)='GPL\x00', 0x5, 0x0, 0x0, 0x41000, 0x10, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mmap(0x0, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000580)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000640)={0x1c, r0, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}}, 0x1c}}, 0x40000) r3 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r3, &(0x7f0000000680)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000700)=ANY=[@ANYBLOB="380000000314010000000000000000000900020073797a30000000000800410072786500140033006c6f00000000000000000000000000001af22379f6f64aa154ee2dca26004df0523570b4fa9156dad7e5899142bada7d62f9ab92ae0ee52ac6d508cd99a994255f3c6499229bdf2ae39789def694f3da38c891c02f126efffe144b1496fd563d0afc21fcfc0fddbe10a63ab4ee27dfed1917c9da8d169386aede8537d1d7a29c5013e0858594c78342df9dda8d1358fad037a78e3dc36251"], 0x38}}, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f00000007c0)={'erspan0\x00', &(0x7f0000000800)={'syztnl2\x00', 0x0, 0x20, 0x20, 0xffff8aa7, 0x800, {{0x16, 0x4, 0x0, 0x0, 0x58, 0x66, 0x0, 0x2, 0x29, 0x0, @dev={0xac, 0x14, 0x14, 0x1f}, @multicast1, {[@generic={0xf, 0x5, "1579b5"}, @ssrr={0x89, 0x27, 0x40, [@dev={0xac, 0x14, 0x14, 0x22}, @local, @dev={0xac, 0x14, 0x14, 0xc}, @multicast2, @initdev={0xac, 0x1e, 0x1, 0x0}, @initdev={0xac, 0x1e, 0x1, 0x0}, @initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, @loopback]}, @ssrr={0x89, 0x17, 0x6d, [@loopback, @remote, @local, @empty, @multicast2]}, @noop]}}}}}) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000880)={0x2, 0x3, &(0x7f0000000940)=ANY=[@ANYBLOB="180a000000000000000000000000000095000000000000006bef80454bb38dde38e864e1f61a8c4724a0f85a6e8a20c3611a69e61f596a41fa23999b06b8c8a423bdefe28232440d7611557ae3284f0d3bd364f14c49259a8b50ef4dcd7c20f841babb9797b2efc9107ca7ce3dc6d53389702f2a8ea4cae5a3712c06de8ed2687a228104a80cd4ce3f38e6f63af1ef5ca3208a360b9f83c512eaed8937a2acf9b48a519d073665ece5d3ff7e264f0bb9f18acdacf00ba1db3753e9c9127e6484c691130a88bacc2f291182cb94c0ae15142d2dd18b589ec79520"], &(0x7f0000000a40)='syzkaller\x00', 0x4, 0x0, 0xffffffffffffffff, 0x0, 0x0, '\x00', r4}, 0x94) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000a80)={0xffffffffffffffff, &(0x7f0000000ac0), 0x0}, 0x20) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000b00)='cgroup.controllers\x00', 0x275a, 0x0) mmap(&(0x7f00006b7000/0x14000)=nil, 0x14000, 0x4, 0x1010, r5, 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000b40)='rdma.current\x00', 0x0, 0x0) r6 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000b80)={&(0x7f0000000bc0)=ANY=[@ANYBLOB="9feb010018000000000000006000000060000000080000000700000002000085040000000200000005000000070000000b00000002000000bb0200000a00000004000013060000000500000087df862a090000000200000001000000aba0fd440b0000000000700004000000030000000600000001000000005f006161613000"], &(0x7f0000000000), 0x80, 0x0, 0x0, 0x7, 0x10000}, 0x28) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000c80)={0xffffffffffffffff, 0x20, &(0x7f0000000cc0)={&(0x7f0000000d00)=""/115, 0x73, 0x0, &(0x7f0000000d80)=""/247, 0xf7}}, 0x10) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000e80)={0xe, 0x4, &(0x7f0000001340)=ANY=[@ANYBLOB="b4050000fdff7f006110580000000000c60000000000000095000000000000009f33ef60916e6e713f1eeb0b725ad99b817fd98cd824498949714ffaac8a6f770600dcca55f21f3ca9e822d182054d54d53cd2b6db714e4beb5447000001000000008f2b9000f22425e4097ed62cbc891061017cfa6fa26fa7088c60897d4a6148a1c1e43f00001bde60beac671e8e8fdecb03588aa623fa71f31bf0f871ab3b2ff88afc60027f4e5b5271ed58e835cf0d0000000098b51fe6b1b8d9dbe87dcff414ed000000000000000000000000000000000000000000000000000000b347abe6352a080f8140e5fd10747b6ecdb3540546bf636e3d6e700e5b0500000000000000eb9e1403e6c8f7a187eaf60f3a17f0f046a307a403c19d9829c90bd2114252581567acae715cbe1b57d5cda432c5b910400623d24195405f2e76ccb7b37b41215c184e731fb1"], &(0x7f00000010c0)='GPL\x00', 0x4, 0xc3, &(0x7f0000001100)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback=0xe, 0xffffffffffffffff, 0x8, &(0x7f0000001200), 0x8, 0x10, &(0x7f0000000280)={0x0, 0x9}, 0x10, 0x0, 0xffffffffffffffff, 0x5a}, 0x94) r8 = bpf$MAP_CREATE(0x0, &(0x7f0000001280)=ANY=[@ANYRESHEX=r6], 0x48) bpf$BPF_LINK_CREATE(0x1c, &(0x7f0000000040)={r7, r8, 0x26, 0x0, @val=@netkit={@void, @value=r7}}, 0x1c) bpf$BPF_LINK_CREATE(0x1c, &(0x7f0000001300)={r7, r8, 0x5, 0x0, @val=@tracing={0x0, 0xfff}}, 0x20) r9 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r9, 0x107, 0xa, &(0x7f0000000000)=0x1, 0x4) setsockopt$packet_rx_ring(r9, 0x107, 0x5, &(0x7f0000000080)=@req3={0x1000, 0x3a, 0x1000, 0x3a, 0x7ff, 0xf83, 0x4682}, 0x1c) socket$packet(0x11, 0x2, 0x300) r10 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r10, &(0x7f00000000c0)={0x0, 0x4076cbba9945d516, &(0x7f0000000100)={0x0, 0x14}}, 0x0) getsockname$packet(r10, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$nl_route(r10, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)=@newlink={0x38, 0x10, 0x439, 0x10000000, 0x0, {0x0, 0x0, 0x0, r11, 0x69801}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @sit={{0x8}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPTUN_LOCAL={0x8, 0x2, @broadcast}]}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x20040010}, 0x0) 1m37.782703906s ago: executing program 32 (id=12333): bpf$PROG_LOAD(0x5, &(0x7f0000000400)={0x1b, 0x20000000000001e4, &(0x7f00000004c0)=ANY=[@ANYBLOB="18020000040000000000000000000000850000002c0000001801000020207325bfa100000000000007010000f8ffffffb7020000080000000000000000000000850000007200000095"], &(0x7f0000000540)='GPL\x00', 0x5, 0x0, 0x0, 0x41000, 0x10, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mmap(0x0, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000580)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000640)={0x1c, r0, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}}, 0x1c}}, 0x40000) r3 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r3, &(0x7f0000000680)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000700)=ANY=[@ANYBLOB="380000000314010000000000000000000900020073797a30000000000800410072786500140033006c6f00000000000000000000000000001af22379f6f64aa154ee2dca26004df0523570b4fa9156dad7e5899142bada7d62f9ab92ae0ee52ac6d508cd99a994255f3c6499229bdf2ae39789def694f3da38c891c02f126efffe144b1496fd563d0afc21fcfc0fddbe10a63ab4ee27dfed1917c9da8d169386aede8537d1d7a29c5013e0858594c78342df9dda8d1358fad037a78e3dc36251"], 0x38}}, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f00000007c0)={'erspan0\x00', &(0x7f0000000800)={'syztnl2\x00', 0x0, 0x20, 0x20, 0xffff8aa7, 0x800, {{0x16, 0x4, 0x0, 0x0, 0x58, 0x66, 0x0, 0x2, 0x29, 0x0, @dev={0xac, 0x14, 0x14, 0x1f}, @multicast1, {[@generic={0xf, 0x5, "1579b5"}, @ssrr={0x89, 0x27, 0x40, [@dev={0xac, 0x14, 0x14, 0x22}, @local, @dev={0xac, 0x14, 0x14, 0xc}, @multicast2, @initdev={0xac, 0x1e, 0x1, 0x0}, @initdev={0xac, 0x1e, 0x1, 0x0}, @initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, @loopback]}, @ssrr={0x89, 0x17, 0x6d, [@loopback, @remote, @local, @empty, @multicast2]}, @noop]}}}}}) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000880)={0x2, 0x3, &(0x7f0000000940)=ANY=[@ANYBLOB="180a000000000000000000000000000095000000000000006bef80454bb38dde38e864e1f61a8c4724a0f85a6e8a20c3611a69e61f596a41fa23999b06b8c8a423bdefe28232440d7611557ae3284f0d3bd364f14c49259a8b50ef4dcd7c20f841babb9797b2efc9107ca7ce3dc6d53389702f2a8ea4cae5a3712c06de8ed2687a228104a80cd4ce3f38e6f63af1ef5ca3208a360b9f83c512eaed8937a2acf9b48a519d073665ece5d3ff7e264f0bb9f18acdacf00ba1db3753e9c9127e6484c691130a88bacc2f291182cb94c0ae15142d2dd18b589ec79520"], &(0x7f0000000a40)='syzkaller\x00', 0x4, 0x0, 0xffffffffffffffff, 0x0, 0x0, '\x00', r4}, 0x94) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000a80)={0xffffffffffffffff, &(0x7f0000000ac0), 0x0}, 0x20) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000b00)='cgroup.controllers\x00', 0x275a, 0x0) mmap(&(0x7f00006b7000/0x14000)=nil, 0x14000, 0x4, 0x1010, r5, 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000b40)='rdma.current\x00', 0x0, 0x0) r6 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000b80)={&(0x7f0000000bc0)=ANY=[@ANYBLOB="9feb010018000000000000006000000060000000080000000700000002000085040000000200000005000000070000000b00000002000000bb0200000a00000004000013060000000500000087df862a090000000200000001000000aba0fd440b0000000000700004000000030000000600000001000000005f006161613000"], &(0x7f0000000000), 0x80, 0x0, 0x0, 0x7, 0x10000}, 0x28) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000c80)={0xffffffffffffffff, 0x20, &(0x7f0000000cc0)={&(0x7f0000000d00)=""/115, 0x73, 0x0, &(0x7f0000000d80)=""/247, 0xf7}}, 0x10) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000e80)={0xe, 0x4, &(0x7f0000001340)=ANY=[@ANYBLOB="b4050000fdff7f006110580000000000c60000000000000095000000000000009f33ef60916e6e713f1eeb0b725ad99b817fd98cd824498949714ffaac8a6f770600dcca55f21f3ca9e822d182054d54d53cd2b6db714e4beb5447000001000000008f2b9000f22425e4097ed62cbc891061017cfa6fa26fa7088c60897d4a6148a1c1e43f00001bde60beac671e8e8fdecb03588aa623fa71f31bf0f871ab3b2ff88afc60027f4e5b5271ed58e835cf0d0000000098b51fe6b1b8d9dbe87dcff414ed000000000000000000000000000000000000000000000000000000b347abe6352a080f8140e5fd10747b6ecdb3540546bf636e3d6e700e5b0500000000000000eb9e1403e6c8f7a187eaf60f3a17f0f046a307a403c19d9829c90bd2114252581567acae715cbe1b57d5cda432c5b910400623d24195405f2e76ccb7b37b41215c184e731fb1"], &(0x7f00000010c0)='GPL\x00', 0x4, 0xc3, &(0x7f0000001100)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback=0xe, 0xffffffffffffffff, 0x8, &(0x7f0000001200), 0x8, 0x10, &(0x7f0000000280)={0x0, 0x9}, 0x10, 0x0, 0xffffffffffffffff, 0x5a}, 0x94) r8 = bpf$MAP_CREATE(0x0, &(0x7f0000001280)=ANY=[@ANYRESHEX=r6], 0x48) bpf$BPF_LINK_CREATE(0x1c, &(0x7f0000000040)={r7, r8, 0x26, 0x0, @val=@netkit={@void, @value=r7}}, 0x1c) bpf$BPF_LINK_CREATE(0x1c, &(0x7f0000001300)={r7, r8, 0x5, 0x0, @val=@tracing={0x0, 0xfff}}, 0x20) r9 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r9, 0x107, 0xa, &(0x7f0000000000)=0x1, 0x4) setsockopt$packet_rx_ring(r9, 0x107, 0x5, &(0x7f0000000080)=@req3={0x1000, 0x3a, 0x1000, 0x3a, 0x7ff, 0xf83, 0x4682}, 0x1c) socket$packet(0x11, 0x2, 0x300) r10 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r10, &(0x7f00000000c0)={0x0, 0x4076cbba9945d516, &(0x7f0000000100)={0x0, 0x14}}, 0x0) getsockname$packet(r10, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$nl_route(r10, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)=@newlink={0x38, 0x10, 0x439, 0x10000000, 0x0, {0x0, 0x0, 0x0, r11, 0x69801}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @sit={{0x8}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPTUN_LOCAL={0x8, 0x2, @broadcast}]}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x20040010}, 0x0) 4.088922577s ago: executing program 5 (id=12907): mmap(&(0x7f0000003000/0x2000)=nil, 0x2000, 0x0, 0x32, 0xffffffffffffffff, 0xa2fab000) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000040)={0x11, 0x13, &(0x7f0000000180)=ANY=[@ANYBLOB="18080000000000000000000002000000851000000600000018020000", @ANYRES32, @ANYBLOB="00000000000000006600020080ffffff18000000fffffffe00000000000000109500040000000000360a02000c000000180100002020782500000000002020207b1a00fe00000000bfa100000000000007010000f8ffffffb702000008000000b50afdff0000000085000000060000009500000000000000"], &(0x7f00000002c0)='GPL\x00', 0x2, 0xff5c, &(0x7f0000000300)=""/222}, 0x78) 3.707527791s ago: executing program 3 (id=12911): r0 = socket$inet6(0xa, 0x3, 0x8000000003c) connect$inet6(r0, &(0x7f0000000280)={0xa, 0x4ea4, 0x0, @mcast1, 0x9}, 0x19) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000000180)={0x1, &(0x7f00000001c0)=[{0x35, 0xff, 0x0, 0x10001}]}, 0x10) r2 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) bind$bt_l2cap(r2, &(0x7f0000000200)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x12}, 0x4}, 0xe) connect$bt_l2cap(r2, &(0x7f0000000240)={0x1f, 0x0, @any, 0x4, 0x1}, 0xe) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000100)={0xffffffffffffffff, &(0x7f0000000140), 0x0}, 0x20) socket$nl_route(0x10, 0x3, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0x1}, 0x50) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x6, 0xd, &(0x7f0000000400)=@framed={{0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0xfffffffe}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r3}, {}, {}, {0x4}, {0x6, 0x0, 0xa}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x33}}, @call={0x85, 0x0, 0x0, 0x7}]}, &(0x7f0000000480)='GPL\x00', 0x4, 0x0, 0x0, 0x40f00, 0x40, '\x00', 0x0, @fallback=0xf, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, 0x94) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000780)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000900)=@newlink={0x44, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x600, 0x0, 0x0, 0x6}, [@IFLA_ADDRESS={0xa, 0x3, @random="0900b15184f4"}, @IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @wireguard={{0xe}, {0x4}}}]}, 0x44}}, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000004c0)={r4, 0x2000012, 0xe, 0x0, &(0x7f0000000540)="63eced8e46dc3f2ddf33c9e9b986", 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xb}, 0x50) ioctl$TUNGETIFF(0xffffffffffffffff, 0x800454d2, 0x0) sendmsg$IPCTNL_MSG_EXP_GET(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)={0x1c, 0x1, 0x2, 0x3, 0x0, 0x0, {0x2, 0x0, 0x1}, [@CTA_EXPECT_CLASS={0x8, 0x9, 0x1, 0x0, 0x10000}]}, 0x1c}, 0x1, 0x0, 0x0, 0x488d4}, 0x2000810) sendmsg$kcm(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000600)=[{&(0x7f0000000640)="d8000000140081054e81f782db44b904021d080225000000040000a118000200fcffffff00000e1208000f0100810401a80016ea1f", 0x35}], 0x1, 0x0, 0x0, 0x7400}, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_DELETE(r6, &(0x7f0000000680)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000700)={0x60, 0x2, 0x1, 0x201, 0x0, 0x0, {0x2, 0x0, 0x1}, [@CTA_TUPLE_REPLY={0x4c, 0x2, 0x0, 0x1, [@CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x4}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @loopback}, {0x8, 0x2, @local}}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @remote}, {0x4, 0x4, @remote}}}]}]}, 0x60}, 0x1, 0x0, 0x0, 0x20000040}, 0x24000080) r7 = socket$kcm(0x10, 0x2, 0x0) write$cgroup_subtree(r7, &(0x7f0000000780)=ANY=[], 0xfe33) bpf$PROG_LOAD(0x5, &(0x7f00000007c0)={0x5, 0x5, &(0x7f0000000880)=ANY=[@ANYBLOB="1808000000000000000000000000000018000000e5"], 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, @fallback=0x1d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r8 = socket$kcm(0x10, 0x2, 0x0) write$cgroup_subtree(r8, &(0x7f00000008c0)=ANY=[], 0xfe33) r9 = socket$inet(0x2, 0x2, 0x0) r10 = socket(0x11, 0x3, 0x1) ioctl$sock_inet_SIOCSIFADDR(r10, 0x8954, 0x0) setsockopt$SO_ATTACH_FILTER(r9, 0x1, 0x33, &(0x7f0000000000)={0x1, &(0x7f0000000040)=[{0x6, 0x8, 0x1, 0xfffffffd}]}, 0x10) unshare(0x40000100) 3.23188449s ago: executing program 3 (id=12914): openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) (async) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0600000004000000080000000001000000000000", @ANYRES32=0x0, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000000000000000000000000000000000000000000047fbb4986db220b50b435a222943d1603ea4912404cd37f1fe4baaaab7e756c9609a18d80823766cb0f6e02f45876b3b3e83b03c88ddb38f031c6cb0daae0ec96e2150869ae5d417b0bd256f2fc4548bdd39e88507998c88f0486b5a9bd2356580008de4c48c4f5975cc5776e447bd48132a3d0ed37201015b2bd5c4ddf9679173ae0daf48b166dd8ab6d182f86d4cbf5f7f45ad591a3456bc6ad311c432b8322dd490b8f6d0da1ce6c78ede3278bf575c02639ddbab708dbce1f0f73a0e1b1f49d5a7418cf484607d67eba9e42e1b61fce7f6e580b5b37d196c379c5fd0afcb4fb49e13ff8b4fe355bd7048c34e80de77408a141938326386cd0cfdf40efd3852"], 0x50) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000480)={0x16, 0xc, &(0x7f0000000540)=ANY=[@ANYBLOB="180000000000000000000000000000007a0af0ff00000000181100", @ANYRES32=r1, @ANYBLOB="0000000000000000bfa200000000000007020000f8ffffffbfa300000000000007030000f0ffffffb7040000ff070000850000000200000095"], &(0x7f00000005c0)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r2, 0x0, 0xe, 0x0, &(0x7f0000000680)='\x00'/14, 0x0, 0x3b66, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) socket$kcm(0x11, 0x3, 0x0) (async) r3 = socket$kcm(0x11, 0x3, 0x0) setsockopt$sock_attach_bpf(r3, 0x107, 0xf, &(0x7f00000006c0), 0x4) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000700), 0x48241, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000740)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) socket$kcm(0x2, 0xa, 0x2) (async) r5 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000000780)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}) (async) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000000780)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}) writev(r4, &(0x7f00000007c0)=[{&(0x7f0000000800)="2e9b3d0007e03dd65193dfb6c575963f8864", 0x12}, {&(0x7f0000000840)="1100f8ae", 0x4}, {&(0x7f0000000880)="00050090b4", 0x5}, {&(0x7f00000008c0)="237f7c", 0x3}], 0x4) sendmsg$kcm(r3, &(0x7f0000000900)={&(0x7f0000000940)=@hci={0x1f, 0x0, 0x12}, 0x80, &(0x7f00000009c0)=[{&(0x7f0000000a00)="62042720920101000001ad2f1eafbcf706e12b30087f5c582d26116642c47a5f8786ee601e65ab3c06d4b8bf4a81cb3e247345af215542f41ddf82f618438a34f90186cee8441e2305e495d04ad68ab8fef69df82de6456fbb48b63f60c9c9097be968ea872c4801e5d0711b4373c7224ed7a9cbd49d40f82bdb6afc0036824be26fc96e49a70e90797e6caa1b38ddacb3cb2b3eac7c068a185b644582f25edfa3d6a46e2a894ca809a422a6a29bd7145bb6e7992570484d6a710292ea0c3f97b7cbff701684b13c5593262534a7af9eab48f2ca2d74d9a4de33", 0xda}, {&(0x7f0000000b00)="294f28dfe56d2c8ba23606bc7ecd1f634665cb5bed07bac5684da6eb21da1d6926910c5a0c653b0106869a804dd2a44ce42557b2e32e2bd367e9d01a5e7380cc4fc8e7c9044cc4115b978ca7427d749beaefdf2e48b369cb169ad7b1ced26bb161297c7e56a3e83e91b379c179017f8b4657d1b22eca6bca33036d33e1a684059c53cea91ca6637ac780ab2bcfc22a666cd4e5876f11e9aee4724b7cb59731c97e70ebd7f7483994eb07de2f3c6a9448c3206cff6d290b433f331c2399e99ee3bdecf5689eddc3e549966c1106a933bbc47b65ca6e9d7efbee6e3b1dbe87313111e85336d6890002db17751b6044f964dc90ea466f90856112be7f0a54b39a3f66cc4c39544300093158af39cdde429f50d8c750", 0x114}, {&(0x7f0000000c40)="0a985d7879f1bbff16c7d66e33657e452299fd0ef8c2afda588eb05891b7da030e01452a7986bea19b59c98dc2996c0ea09604d00ea48336d0c813d83025aca8623a5915ddddce2c11c5e374f2e0f387d2398fe0b899ff60dc7a73addcf253cf32aafbe2b9f90799e7fc583bdd9b564697ba988080270bdceb4714219a2d4c229fffb0d86fb286e3553a8b3ac02badc66ada5fceabe5f63c79da96e641a45901128063d6e1e31b11bcfbc3e70bd3c8c6c0be9f653f977f16", 0xfff0}, {&(0x7f0000000d00)="6f4720baeb54", 0x6}], 0x4}, 0x0) (async) sendmsg$kcm(r3, &(0x7f0000000900)={&(0x7f0000000940)=@hci={0x1f, 0x0, 0x12}, 0x80, &(0x7f00000009c0)=[{&(0x7f0000000a00)="62042720920101000001ad2f1eafbcf706e12b30087f5c582d26116642c47a5f8786ee601e65ab3c06d4b8bf4a81cb3e247345af215542f41ddf82f618438a34f90186cee8441e2305e495d04ad68ab8fef69df82de6456fbb48b63f60c9c9097be968ea872c4801e5d0711b4373c7224ed7a9cbd49d40f82bdb6afc0036824be26fc96e49a70e90797e6caa1b38ddacb3cb2b3eac7c068a185b644582f25edfa3d6a46e2a894ca809a422a6a29bd7145bb6e7992570484d6a710292ea0c3f97b7cbff701684b13c5593262534a7af9eab48f2ca2d74d9a4de33", 0xda}, {&(0x7f0000000b00)="294f28dfe56d2c8ba23606bc7ecd1f634665cb5bed07bac5684da6eb21da1d6926910c5a0c653b0106869a804dd2a44ce42557b2e32e2bd367e9d01a5e7380cc4fc8e7c9044cc4115b978ca7427d749beaefdf2e48b369cb169ad7b1ced26bb161297c7e56a3e83e91b379c179017f8b4657d1b22eca6bca33036d33e1a684059c53cea91ca6637ac780ab2bcfc22a666cd4e5876f11e9aee4724b7cb59731c97e70ebd7f7483994eb07de2f3c6a9448c3206cff6d290b433f331c2399e99ee3bdecf5689eddc3e549966c1106a933bbc47b65ca6e9d7efbee6e3b1dbe87313111e85336d6890002db17751b6044f964dc90ea466f90856112be7f0a54b39a3f66cc4c39544300093158af39cdde429f50d8c750", 0x114}, {&(0x7f0000000c40)="0a985d7879f1bbff16c7d66e33657e452299fd0ef8c2afda588eb05891b7da030e01452a7986bea19b59c98dc2996c0ea09604d00ea48336d0c813d83025aca8623a5915ddddce2c11c5e374f2e0f387d2398fe0b899ff60dc7a73addcf253cf32aafbe2b9f90799e7fc583bdd9b564697ba988080270bdceb4714219a2d4c229fffb0d86fb286e3553a8b3ac02badc66ada5fceabe5f63c79da96e641a45901128063d6e1e31b11bcfbc3e70bd3c8c6c0be9f653f977f16", 0xfff0}, {&(0x7f0000000d00)="6f4720baeb54", 0x6}], 0x4}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) (async) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r7, &(0x7f0000000d40)={0x0, 0x0, &(0x7f0000000d80)={0x0, 0xb8}, 0x1, 0x0, 0x0, 0x800}, 0x8008010) r8 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r8, &(0x7f0000000dc0)={0x0, 0x0, &(0x7f0000000e00)={&(0x7f0000002140)=ANY=[@ANYBLOB="b8000000190001000000000000000000e00000020000000000000000000000000000000000000000000000000000000000000000000000000a00000029000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000e9fc000000000000000000000000000700000000000000000000000000000000000000000000000200000000000000020000000000000000979c1377000000000000000000000000000000000000000000000000000000000000ffffffffffffffff0000000000000000000000000040e502d2419fbc4c66d783e884ef5af502419c33a1678cb9c6710a96898907b0809c6e8c01f5cd60c3fb3c92e5416a90265745a2cce708f18f07a7c5838fd48f84bab43485469bd52c5dcc576f89c48ece9aa0e5c27e4a2e8fe5e89627383312defc66688b42a84669d45386727b07d3961d4e0f231780cecc1d181f19b569e4ad026255eaa884756b47672745bae597a8c504b3e45c9bf43781e83553f49988fd36c160a48a3dab3ebf3a481a4acad18a67954ac6ec608d0a22690ad2a12523f1deaf242e98aaf5be4986b7479fca10cc43f3b2597ac5ce4a9fe2"], 0xb8}}, 0x20004004) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_route(0x10, 0x3, 0x0) (async) r9 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000f00)={'bridge0\x00', 0x0}) sendmsg$nl_route(r9, &(0x7f0000000f40)={0x0, 0x0, &(0x7f0000000f80)={&(0x7f0000000fc0)=@newlink={0x50, 0x10, 0xffffffffffffffff, 0x70bd27, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, 0x11d15}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @vlan={{0x9}, {0x18, 0x2, 0x0, 0x1, [@IFLA_VLAN_FLAGS={0xc, 0x2, {0x1a, 0x1a}}, @IFLA_VLAN_ID={0x6, 0x1, 0x1}]}}}, @IFLA_LINK={0x8, 0x5, r10}]}, 0x50}, 0x1, 0x0, 0x0, 0x28041}, 0x0) r11 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r11, &(0x7f0000001040)={0x0, 0x0, &(0x7f0000001080)={&(0x7f00000010c0)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in=@multicast2, @in=@empty, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x20, 0x29}, {0x0, 0xfffffffffffffffc, 0x9, 0x0, 0x0, 0x2, 0xffffffffffffffff}, {0x0, 0x200000000, 0x0, 0xffffffffffffffff}, 0x7}}, 0xb8}}, 0x10) sendmsg$nl_route_sched(r6, &(0x7f0000001180)={0x0, 0x0, &(0x7f00000011c0)={&(0x7f0000001200)=@newtaction={0xe98, 0x30, 0x871a15abc695fa3d, 0xfffffffd, 0x0, {}, [{0xe84, 0x1, [@m_pedit={0xe80, 0x1, 0x0, 0x0, {{0xa}, {0xe54, 0x2, 0x0, 0x1, [@TCA_PEDIT_PARMS={0xe50, 0x2, {{{}, 0x97, 0x0, [{}, {}]}, [{}, {}, {}, {}, {}, {0x448eade7}, {0x0, 0x0, 0x80000000}, {}, {}, {}, {}, {}, {}, {0x2}, {}, {}, {0x0, 0x20000000, 0x0, 0x0, 0x3}, {}, {}, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, {}, {0x1021}, {}, {0x0, 0x0, 0x80000000}, {0xfffffffc, 0x0, 0x0, 0x0, 0x2}, {}, {}, {}, {0x0, 0x4}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, {}, {}, {}, {0x0, 0x9}, {}, {}, {}, {}, {}, {}, {0xfffffffe}, {}, {0xd5}, {}, {}, {}, {0x9}, {}, {}, {}, {}, {}, {0x0, 0x10}, {0x80000000}, {0x8eb9, 0x0, 0x800}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, {0x0, 0x0, 0x4, 0x0, 0x7ee}, {}, {}, {}, {0x0, 0x0, 0x0, 0x1}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x9}, {}, {}, {}, {}, {0x5}, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffb}, {}, {0x0, 0x9, 0x0, 0x0, 0x0, 0xfffffffd}, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x401}, {}, {0x0, 0x18}, {}, {0x4, 0x0, 0x0, 0x0, 0x6}, {}, {0x0, 0x0, 0x0, 0xfffffffc}, {}, {0x0, 0x0, 0x0, 0x4, 0x2}, {}, {}, {}, {}, {}, {0x10000}, {}, {0x0, 0x0, 0x1}, {0x0, 0x0, 0x6}, {}, {}, {0x0, 0x0, 0x0, 0x8}, {}, {}, {}, {}, {}, {}, {0x0, 0x0, 0x0, 0x0, 0xfffffffe}, {}, {}, {}, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0xb}], [{}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x3}, {}, {}, {}, {}, {}, {0x0, 0x1}, {0x7}, {0x0, 0x1}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x1}, {0x0, 0x1}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x1}, {}, {}, {0x0, 0x1}, {}, {}, {}, {}, {}, {}, {0x0, 0x1}, {}, {}, {}, {}, {}, {0x2}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x1}, {0x3}, {}, {}, {}, {}, {}, {}, {0x0, 0x1}, {}, {}, {0x3}]}}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0xe98}, 0x1, 0x0, 0x0, 0x4000010}, 0x0) socket$kcm(0x2, 0xa, 0x2) (async) socket$kcm(0x2, 0xa, 0x2) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_generic(0x10, 0x3, 0x10) (async) r12 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f00000020c0), 0xffffffffffffffff) (async) syz_genetlink_get_family_id$nl80211(&(0x7f00000020c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r12, 0x8933, &(0x7f0000002100)={'wlan0\x00'}) 3.049402896s ago: executing program 5 (id=12915): openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) (async) unshare(0x60600) (async) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000300), 0x2, 0x0) (async) mmap(&(0x7f0000002000/0x2000)=nil, 0x2000, 0x8, 0x32, 0xffffffffffffffff, 0x0) (async) r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000340)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000003c0)={0x18, 0x11, &(0x7f0000000480)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x580d9462, 0x0, 0x0, 0x0, 0x58b}, {{0x18, 0x1, 0x1, 0x0, r1}, {}, {}, {0x85, 0x0, 0x0, 0x86}}, {}, [@jmp={0x5, 0x1, 0x4, 0xa, 0x0, 0xffffffffffffffff}, @jmp={0x5, 0x0, 0xc, 0x0, 0x0, 0xfffffffffffffff4, 0xffffffffffffffff}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0xaf}}}, &(0x7f0000000540)='GPL\x00', 0x9, 0x0, 0x0, 0x41100, 0x22}, 0x94) (async) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000580)={'syzkaller0\x00', 0x1001}) (async) r2 = socket$inet6(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r2, 0x8914, &(0x7f00000005c0)={'ip6_vti0\x00'}) (async, rerun: 64) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) (rerun: 64) sendmsg$nl_xfrm(r3, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000680)=@updpolicy={0x17c, 0x19, 0x1, 0x70bd25, 0x0, {{@in=@dev={0xac, 0x14, 0x14, 0x3}, @in=@empty, 0x0, 0x3, 0x0, 0x0, 0x2, 0x0, 0x20, 0x8}, {0xfffffffffffffffd, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1d}, {0x0, 0xfffffffffffffffa, 0x0, 0x2dd}, 0x0, 0x6e6bc0}, [@tmpl={0xc4, 0x5, [{{@in=@loopback, 0x0, 0x32}, 0x0, @in6=@empty, 0x0, 0x2}, {{@in6=@mcast2, 0x0, 0x3c}, 0x2, @in=@remote, 0x0, 0x1, 0x3, 0x0, 0x7ff}, {{@in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x0, 0x33}, 0x0, @in=@loopback, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xfffffffe}]}]}, 0x17c}}, 0x0) (async, rerun: 32) r4 = socket$packet(0x11, 0x3, 0x300) (rerun: 32) setsockopt$SO_ATTACH_FILTER(r4, 0x1, 0x1a, &(0x7f0000000800)={0x3, &(0x7f0000000840)=[{0x20, 0x2, 0x81, 0xfffff034}, {0x20, 0x0, 0x8, 0xfffff010}, {0x6, 0xba, 0x2, 0xefff}]}, 0x10) (async) syz_emit_ethernet(0x0, 0x0, 0x0) (async, rerun: 32) socket$nl_crypto(0x10, 0x3, 0x15) (rerun: 32) pipe(0x0) (async) vmsplice(0xffffffffffffffff, &(0x7f0000000880)=[{&(0x7f00000008c0)="a26776", 0x3}, {0x0}], 0x2, 0x4) (async, rerun: 32) r5 = socket$inet_udp(0x2, 0x2, 0x0) (rerun: 32) bind$inet(r5, &(0x7f0000000900)={0x2, 0x0, @local}, 0x10) connect$inet(r5, &(0x7f0000000940)={0x2, 0x0, @multicast1}, 0x10) write$cgroup_devices(0xffffffffffffffff, &(0x7f0000000980)={'a', ' *:* ', 'rwm\x00'}, 0xa) (async) splice(0xffffffffffffffff, 0x0, r5, 0x0, 0x2000000002ffff, 0x0) (async) ioctl$sock_inet_SIOCSIFFLAGS(r2, 0x8914, &(0x7f00000009c0)={'syzkaller0\x00', 0x1}) (async) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000a00)={'syzkaller0\x00', 0x0}) ioctl$sock_inet6_SIOCSIFADDR(r2, 0x8916, &(0x7f0000000a40)={@local, 0x40, r6}) socket$nl_xfrm(0x10, 0x3, 0x6) (async) write$tun(r0, &(0x7f0000000a80)={@void, @void, @ipv6=@generic={0x0, 0x6, '\x00', 0x1a, 0x33, 0x40, @remote, @local, {[], "3b040000000012340000000100"/26}}}, 0x42) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TUNSETIFF(r7, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x4c02}) (async) readv(r7, &(0x7f0000000100)=[{&(0x7f00000001c0)=""/196, 0xc4}, {0x0}], 0x2) 2.787241622s ago: executing program 2 (id=12916): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)={0x38, 0x0, 0x1, 0x101, 0x0, 0x0, {0x2, 0x0, 0x2}, [@CTA_TUPLE_ORIG={0x24, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @multicast1}, {0x8, 0x2, @multicast1}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}]}, 0x38}, 0x1, 0x0, 0x0, 0x4004881}, 0x20008820) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000080), r0) r3 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f00000000c0)={'lo\x00', 0x0}) setsockopt$CAN_RAW_FILTER(r3, 0x65, 0x1, &(0x7f0000000000)=[{{0x1}}, {{0x0, 0x1, 0x1, 0x1}, {0x1, 0x1, 0x1}}], 0x10) sendmsg$ETHTOOL_MSG_TSINFO_GET(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x28, r2, 0x6a98047402e98331, 0x4070bd29, 0x25dfdbff, {}, [@HEADER={0x14, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r4}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x6}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x4004110}, 0x28000) 2.616451612s ago: executing program 4 (id=12917): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x18, 0x24, &(0x7f0000000000)=@framed={{0x18, 0x0, 0x0, 0x0, 0xffffffa1, 0x0, 0x0, 0x0, 0x9}, [@snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x2f3}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, 0x1}}, @map_idx={0x18, 0xa, 0x5, 0x0, 0xe}, @map_fd={0x18, 0x1}, @call={0x85, 0x0, 0x0, 0xc2}, @snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x2b4b}}, @map_val={0x18, 0x7, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x1ff}]}, &(0x7f0000000140)='syzkaller\x00', 0x6, 0xb7, &(0x7f0000000180)=""/183, 0x41100, 0x4, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000240)={0x4, 0x3}, 0x8, 0x10, &(0x7f0000000280)={0x4, 0xa, 0x0, 0x9}, 0x10, 0x0, 0x0, 0x0, &(0x7f00000002c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff], 0x0, 0x10, 0x5}, 0x94) ioctl$BTRFS_IOC_SCRUB(r0, 0xc400941b, &(0x7f00000003c0)={0x0, 0x1, 0x29}) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000800), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_NEIGHBORS(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x3}, 0xc, &(0x7f0000000880)={&(0x7f0000000840)={0x28, r1, 0x0, 0x70bd29, 0x25dfdbfc, {}, [@BATADV_ATTR_ORIG_ADDRESS={0xa}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}]}, 0x28}, 0x1, 0x0, 0x0, 0x80}, 0x42080) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$BATADV_CMD_GET_BLA_CLAIM(r2, &(0x7f00000009c0)={&(0x7f0000000900)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000980)={&(0x7f0000000940)={0x30, r1, 0x300, 0x70bd2d, 0x25dfdbfc, {}, [@BATADV_ATTR_GW_MODE={0x5, 0x33, 0x2}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0xff}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}]}, 0x30}}, 0x4000) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000c40)={r0, 0x0, 0x4f, 0x12, &(0x7f0000000a00)="1440ddbb4f7d3f539adf9aab91c47f809c787ec331e6dbbf6c14e2edd4ed46fe5c1925d5074da8c9423373a52fd08d5cecfa1becf64fc92ffcb87d2821b7d28e99c4f251acd58c60b4ccbffe09d315", &(0x7f0000000a80)=""/18, 0x9, 0x0, 0xc5, 0x61, &(0x7f0000000ac0)="3a2d80aae6461149a9f55d608c75b41a26ecea861952d10af6cc828aaa32c0934b0924a5ac4f9fea4c6182e56f77a75295b60a49f81ebc68550a4682c3f294431426ae7bf0b988820f51000f021fd7d5b2549129aff0acb9e162643b18b59a7f7742da40ead65a987ee10db8828ce4d95b7bfc0f0e1dcb7e8e7b4253c16aae46e1fcd4b3c42420d0bf076c92ccb34f02256756fe97572ef07a07791dd02cf5497f2303d780adaa7a097493380a02dc2d375f374b7e39cb9837c95b5f745385363f54ceccb2", &(0x7f0000000bc0)="83567ef3ab2a9a8a0ecb0fa41f8ce2ccfaa02a669b9c33dabccc9408b6b6dffd40b2e7708efdcc499c0574711a260a034e39acc59ee7ce793011da5b537c2f1515fbac08f20fa05f1bfe1a8545ba0958fbda60d1f93f7677635804f9ea9494715a", 0x7, 0x0, 0x2}, 0x50) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000cc0), 0x18080, 0x0) write$tun(r3, &(0x7f0000000d00)={@void, @val={0x2, 0x7, 0x1, 0x3, 0xd, 0x1}, @x25={0x3, 0xf5, 0xfd, "3a7be35b8d36cf41e377ae429274dd29d52622a62a919464673adf3b0e64c0c80e2e6d70e3fe2471a7bf06e340b256c3f84af96eb582943db2b3a63bee0a54557a5e80ba78af26ca62143502b809b4b5316f7ea0805ce87e2e94362ff58ac601e7a43fa95b7b9e00600116d5cfb50f693a4ae009892a05f281ad14dba29edad319a793d92c92e4b27cb44209d207cb4316237ed1e2ad79c282aaea0888d48646818e8d4722570b348900b5f424e5b465360b9c915c6a493e4a6ed5c36f4eb2bed202f6e55b2abc4948213a709d39d2e8dd8b94374222a94a1bd2ecde4f626188d9ef62d8d782dc3c5c1cab5bb3cf44382e102f7663f2455feed185"}}, 0x108) ioctl$TUNSETNOCSUM(r3, 0x400454c8, 0x1) r4 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000e80)=@generic={&(0x7f0000000e40)='./file0\x00', 0x0, 0x18}, 0x18) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000fc0)={r4, &(0x7f0000000ec0)="28658a084b033b03f34ed0224186c63bc277ed438393b07aeeb22f74253965ed4c446376cc887b8b015060e2a5ab76f8be5088ddc8aeb739077538707cf019d3e2667d7a2e97604e204eeedb0272143c68fe7d8a28c101e2a85459c6359cfe11cdd7bd7f3d8b7f52adf294ae1011c3a9377d49ad9d3e767e103e", &(0x7f0000000f40)=""/68}, 0x20) mmap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0xc, 0x30, r4, 0xb6d3f000) ioctl$TUNSETDEBUG(r3, 0x400454c9, &(0x7f0000001000)) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001080), r2) sendmsg$NL80211_CMD_GET_KEY(r2, &(0x7f0000001180)={&(0x7f0000001040)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000001140)={&(0x7f00000010c0)={0x44, r5, 0x100, 0x70bd27, 0x25dfdbff, {{}, {@void, @val={0xc, 0x99, {0xfffff000, 0x5b}}}}, [@NL80211_ATTR_KEY_CIPHER={0x8, 0x9, 0xfac01}, @NL80211_ATTR_KEY_CIPHER={0x8, 0x9, 0xfac01}, @NL80211_ATTR_KEY_TYPE={0x8, 0x37, 0x2}, @NL80211_ATTR_KEY_DATA_WEP40={0x9, 0x7, "6af00994f3"}]}, 0x44}, 0x1, 0x0, 0x0, 0x40}, 0x30) sendmsg$FOU_CMD_GET(r2, &(0x7f00000012c0)={&(0x7f00000011c0)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000001280)={&(0x7f0000001200)={0x4c, 0x0, 0x808, 0x70bd29, 0x25dfdbfc, {}, [@FOU_ATTR_REMCSUM_NOPARTIAL={0x4}, @FOU_ATTR_LOCAL_V6={0x14, 0x7, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, @FOU_ATTR_PEER_V4={0x8, 0x8, @rand_addr=0x64010101}, @FOU_ATTR_PEER_PORT={0x6, 0xa, 0x4e20}, @FOU_ATTR_AF={0x5, 0x2, 0xa}, @FOU_ATTR_TYPE={0x5, 0x4, 0x2}]}, 0x4c}, 0x1, 0x0, 0x0, 0x10}, 0x6004040) mmap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x3000004, 0x11, r0, 0x6fb3f000) ioctl$BTRFS_IOC_QUOTA_RESCAN_STATUS(r0, 0x8040942d, &(0x7f0000001300)) r6 = accept$inet6(0xffffffffffffffff, &(0x7f0000001340)={0xa, 0x0, 0x0, @mcast1}, &(0x7f0000001380)=0x1c) getsockopt$inet_sctp6_SCTP_INITMSG(r6, 0x84, 0x2, &(0x7f00000013c0), &(0x7f0000001400)=0x8) socket$nl_route(0x10, 0x3, 0x0) sendmsg$NL80211_CMD_SET_STATION(r2, &(0x7f00000015c0)={&(0x7f0000001440)={0x10, 0x0, 0x0, 0xb180400}, 0xc, &(0x7f0000001580)={&(0x7f0000001480)={0xd8, r5, 0x200, 0x70bd2c, 0x25dfdbfe, {{}, {@void, @void}}, [@NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_PEER_AID={0x6, 0xb5, 0x6eb}, @NL80211_ATTR_LOCAL_MESH_POWER_MODE={0x8, 0xa4, 0x2}, @NL80211_ATTR_STA_EXT_CAPABILITY={0x98, 0xac, "8efdc426f90d75e14147bc6424574d036dd0df4c3ae31d23cd50aab81e85f8ccf2e61494c8af0077a7c0cc8188788f01f3523d42903d1be4f170361bc268e2c6ec309c22402a97f152c5c439c5fb33ee16fe8ec029538383cbb25929dcc955168097394ed6fb956a1b4d384766023a03aae1b21fe4bcce1a51653954540b99a9e7e10d2aff86c2e76fa6a41f67eb2cb8f3320f91"}, @NL80211_ATTR_STA_PLINK_STATE={0x5, 0x74, 0x3}, @NL80211_ATTR_STA_TX_POWER={0x6, 0x114, 0xd1e}]}, 0xd8}, 0x1, 0x0, 0x0, 0x14}, 0x20000050) syz_emit_ethernet(0x56, &(0x7f0000001600)={@empty, @empty, @void, {@canfd={0xd, {{0x3, 0x1, 0x1, 0x1}, 0x26, 0x2, 0x0, 0x0, "1efe6e02f24e15c23511c4497e156c10bfab3c2088e6a5c5202853db920a14c8dae39434b476a699e944f5082225e390b89dfd227ae582d8ff3983a313e5b0d0"}}}}, 0x0) r7 = socket$can_j1939(0x1d, 0x2, 0x7) r8 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) ioctl$XFS_IOC_AG_GEOMETRY(r8, 0xc080583d, &(0x7f0000001680)={0x7, 0x101, 0x0, 0x8, 0x2, 0x4, 0xfffffff9, 0x100}) getsockopt$inet_sctp6_SCTP_STATUS(r6, 0x84, 0xe, &(0x7f0000001700)={0x1, 0x2, 0x8, 0x6, 0x9, 0x0, 0x4011, 0x7f, {0x2, @in={{0x2, 0x4e22, @broadcast}}, 0x7fffffff, 0x9, 0x7, 0xfd}}, &(0x7f00000017c0)=0xb0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r7, 0x84, 0x1f, &(0x7f0000001800)={r9, @in={{0x2, 0x4e23, @private=0xa010102}}, 0x6, 0x8000}, 0x90) sendmsg$DEVLINK_CMD_TRAP_GET(r0, &(0x7f0000001b00)={&(0x7f00000018c0)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000001ac0)={&(0x7f0000001940)={0x16c, 0x0, 0x2, 0x70bd27, 0x25dfdbff, {}, [{@pci={{0x8}, {0x11}}, {0x1c}}, {@pci={{0x8}, {0x11}}, {0x1c}}, {@pci={{0x8}, {0x11}}, {0x1c}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x1c}}, {@pci={{0x8}, {0x11}}, {0x1c}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x1c}}]}, 0x16c}}, 0x40) 2.611234495s ago: executing program 2 (id=12918): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000240)={'syzkaller0\x00', 0x7101}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) close(r1) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000002c0)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2, 0xfff1}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x3}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000400)={&(0x7f00000005c0)=@newqdisc={0x50, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdc01, {0x0, 0x0, 0x0, r3, {0x0, 0x7}, {0x1, 0xb}, {0xffff, 0xfffd}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x20, 0x2, [@TCA_CAKE_BASE_RATE64={0xc, 0x2, 0x8}, @TCA_CAKE_ATM={0x8, 0x4, 0x2}, @TCA_CAKE_SPLIT_GSO={0x8}]}}]}, 0x50}, 0x1, 0x0, 0x0, 0x240448a0}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000480)={'syzkaller0\x00', @multicast}) r4 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r4, 0x107, 0xf, &(0x7f00000004c0)=0x207, 0x4) r5 = socket$igmp(0x2, 0x3, 0x2) getsockopt$EBT_SO_GET_INIT_ENTRIES(r5, 0x0, 0x83, &(0x7f0000000080)={'nat\x00', 0x0, 0x3, 0x17, [0x2e, 0x8, 0x4, 0x2, 0xfff, 0x200], 0x1, &(0x7f0000000000)=[{}], &(0x7f0000000040)=""/23}, &(0x7f0000000140)=0x78) socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000500)={'syzkaller0\x00', 0x0}) sendto$packet(r4, &(0x7f0000000540)="05031c00d3fc140000004788031c09102c28", 0xfdef, 0x4, &(0x7f0000000580)={0x11, 0x0, r6, 0x1, 0x0, 0x6, @multicast}, 0x14) 2.35952411s ago: executing program 4 (id=12919): r0 = socket$inet6_sctp(0xa, 0x801, 0x84) sendmmsg$inet(r0, &(0x7f0000000380)=[{{&(0x7f0000000400)={0x2, 0x4e24, @remote}, 0x10, &(0x7f0000000440)=[{&(0x7f0000000480)="13", 0x1}], 0x1}}, {{&(0x7f00000004c0)={0x2, 0x4e24, @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x10, &(0x7f00000005c0)=[{&(0x7f0000000600)="a6e8", 0x2}], 0x1}}], 0x2, 0x800) 2.277543983s ago: executing program 1 (id=12920): sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000002c0)=@newlink={0x48, 0x10, 0x1, 0x70bd2b, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, 0x1438a}, [@IFLA_VFINFO_LIST={0x14, 0x16, 0x0, 0x1, [{0x10, 0x1, 0x0, 0x1, [@IFLA_VF_TX_RATE={0xc, 0x3, {0x2efe}}]}]}, @IFLA_IFNAME={0x14, 0x3, 'wlan0\x00'}]}, 0x48}}, 0x0) 2.142021699s ago: executing program 5 (id=12921): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$gtp(&(0x7f0000000200), 0xffffffffffffffff) sendmsg$GTP_CMD_NEWPDP(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)={0x24, r2, 0x1, 0x70bd27, 0x25dfdbfe, {}, [@GTPA_LINK={0x8}, @GTPA_VERSION={0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x40000}, 0x4004800) mmap(0x0, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r3 = socket$kcm(0x23, 0x2, 0x0) sendmsg$sock(r3, 0x0, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000440), 0x40241, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000480)={'syzkaller1\x00', 0xc201}) recvfrom(r3, 0x0, 0x53, 0x20, 0x0, 0x1e) setsockopt$sock_int(r3, 0x1, 0x6, &(0x7f00000004c0)=0x9, 0x4) r5 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000000500)={'syzkaller1\x00', @link_local}) write$tun(r4, &(0x7f0000000540)=ANY=[@ANYBLOB="1c0000f500000000000000862dfdff00000065"], 0x78) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0xc201}) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x40241, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x4001}) r7 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r7, 0x8914, &(0x7f0000000100)={'syzkaller1\x00', @remote}) r8 = socket$kcm(0x2, 0xa, 0x2) ioctl$sock_inet_SIOCSIFADDR(r8, 0x8916, &(0x7f0000000140)={'syzkaller1\x00', {0x2, 0x0, @rand_addr=0x64010101}}) write$tun(r6, &(0x7f00000001c0)=ANY=[@ANYBLOB="0000080001031400e803140008004500005c000000004084b019640101026401010104d2270f00ffffffffffffffc100003c"], 0xfdef) r9 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r9, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) r10 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r10, &(0x7f0000000400)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x2c, 0x2, 0x3, 0x801, 0x0, 0x0, {0x2, 0x0, 0xa}, [@NFQA_CFG_PARAMS={0x9, 0x2, {0xd}}, @NFQA_CFG_PARAMS={0x9, 0x2, {0xc0, 0x2}}]}, 0x2c}, 0x1, 0x0, 0x0, 0x1}, 0x20000000) write$tun(0xffffffffffffffff, &(0x7f0000000240)={@val={0x0, 0x86dd}, @val={0x0, 0x0, 0x12}, @mpls={[], @ipv6=@icmpv6={0x0, 0x6, "fc0300", 0x8, 0x2c, 0x0, @local, @mcast2, {[], @ndisc_rs}}}}, 0x3e) write$tun(r0, &(0x7f0000000240)=ANY=[], 0xfdef) 2.064564261s ago: executing program 1 (id=12922): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x9, 0x1000, 0x8, 0x40, 0x42, 0x1, 0x6f85}, 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000a40)={0x0, 0x0, &(0x7f0000000a80), &(0x7f0000000ac0), 0xffc, r0}, 0x38) 2.06148407s ago: executing program 4 (id=12923): r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_SET(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000080)=ANY=[], 0x24}, 0x1, 0x0, 0x0, 0x60408a0}, 0x488c0) 1.911839699s ago: executing program 4 (id=12924): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0) writev(0xffffffffffffffff, &(0x7f00000006c0)=[{0x0}, {&(0x7f0000000700)="8a226ff432407a7f5fd09590d734f795e12e57ce9fed3f0300eb6368ed559a85603b0080", 0x24}], 0x2) r2 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(0xffffffffffffffff, &(0x7f0000000a40)={0x0, 0x0, &(0x7f0000000a80)={&(0x7f0000000ac0)=ANY=[], 0x20}, 0x1, 0x0, 0x0, 0x2000a0c0}, 0x6584f2c77c205b5) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8b36, &(0x7f0000000b40)={'wlan1\x00'}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x1}) r3 = socket$unix(0x1, 0x3, 0x0) r4 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000000)='cpuacct.usage_percpu_user\x00', 0x0, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000540)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000500)={&(0x7f0000000340)=@deltaction={0x180, 0x31, 0x800, 0x70bd28, 0x25dfdbfb, {}, [@TCA_ACT_TAB={0x80, 0x1, [{0xc, 0x1d, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x7f}}, {0xc, 0x8, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'ife\x00'}}, {0xc, 0x1a, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x5}}, {0xc, 0x12, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x3}}, {0xc, 0xd, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x9}}, {0xc, 0x5, 0x0, 0x0, @TCA_ACT_KIND={0x7, 0x1, 'ct\x00'}}, {0xc, 0x14, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x7}}, {0xc, 0x1d, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x2}}, {0xc, 0xf, 0x0, 0x0, @TCA_ACT_KIND={0x7, 0x1, 'xt\x00'}}, {0x10, 0x18, 0x0, 0x0, @TCA_ACT_KIND={0x9, 0x1, 'gate\x00'}}]}, @TCA_ACT_TAB={0x88, 0x1, [{0xc, 0x14, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0xd}}, {0x10, 0x10, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'ctinfo\x00'}}, {0x10, 0x16, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'mirred\x00'}}, {0x10, 0xe, 0x0, 0x0, @TCA_ACT_KIND={0x9, 0x1, 'csum\x00'}}, {0x10, 0x15, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'mirred\x00'}}, {0x14, 0x19, 0x0, 0x0, @TCA_ACT_KIND={0xf, 0x1, 'tunnel_key\x00'}}, {0xc, 0xc, 0x0, 0x0, @TCA_ACT_KIND={0x7, 0x1, 'ct\x00'}}, {0xc, 0xc, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'ife\x00'}}, {0xc, 0xd, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x6}}]}, @TCA_ACT_TAB={0x54, 0x1, [{0xc, 0x3ffc, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x2}}, {0x10, 0x3, 0x0, 0x0, @TCA_ACT_KIND={0xc, 0x1, 'skbedit\x00'}}, {0x10, 0x16, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'mirred\x00'}}, {0xc, 0xe, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x6}}, {0xc, 0x1b, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x8000}}, {0xc, 0x8, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x6}}]}, @TCA_ACT_TAB={0x10, 0x1, [{0xc, 0x13, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0xa92}}]}]}, 0x180}, 0x1, 0x0, 0x0, 0x4000000}, 0x48000) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000780)=@base={0x1, 0x6, 0x4, 0x80c, 0x40, 0xffffffffffffffff, 0x2000}, 0x50) close(0x3) bpf$MAP_CREATE(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="0a000000030000004200000040"], 0x50) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x11, 0xd, &(0x7f0000000940)=ANY=[@ANYBLOB="18000000000000000000000000000000850000007b00000018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000010b704000000000000850000000100000095"], &(0x7f00000009c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000a00)={r6}, 0xc) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller1\x00', 0x0}) r8 = socket(0x2, 0x3, 0xff) sendmmsg$inet(r8, &(0x7f00000001c0), 0x0, 0x20044000) r9 = socket$nl_generic(0x10, 0x3, 0x10) r10 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), 0xffffffffffffffff) sendmsg$NL80211_CMD_VENDOR(r9, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000600)=ANY=[@ANYBLOB="0c010000", @ANYRES16=r10, @ANYBLOB="ffaf00000000000000006700000008000100030000000800c400ff0300000800c3"], 0x10c}, 0x1, 0x0, 0x0, 0x400c080}, 0x4880) r11 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r11, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000680)={0x14, 0x15, 0x301, 0x0, 0x0, {0xa}}, 0x14}}, 0x0) sendmsg$NL80211_CMD_SET_WIPHY(r8, 0x0, 0x800) socket$inet(0x2, 0x5, 0x5) ioctl$sock_inet_SIOCSIFFLAGS(r3, 0x8914, &(0x7f0000000200)={'syzkaller1\x00', 0x1}) sendmsg$nl_route_sched(r0, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=@newqdisc={0x30, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r7, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000800)=@newtfilter={0x80, 0x2c, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r7, {0xb, 0x7}, {0xfff1, 0xffff}, {0x300}}, [@filter_kind_options=@f_matchall={{0xd}, {0x4c, 0x2, [@TCA_MATCHALL_ACT={0x48, 0x2, [@m_ct={0x44, 0x1, 0x0, 0x0, {{0x7}, {0x1c, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0x0, 0x0, 0x3}}]}, {0x4}, {0xc}, {0xc}}}]}]}}]}, 0x80}}, 0x0) write(r1, &(0x7f0000000140)="000008004500001c123400004011e5c8ac141401ac14140204d204d200080000", 0x20) 1.715663612s ago: executing program 1 (id=12925): mmap(&(0x7f0000003000/0x2000)=nil, 0x2000, 0x0, 0x32, 0xffffffffffffffff, 0xa2fab000) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000040)={0x11, 0x13, &(0x7f0000000180)=ANY=[@ANYBLOB="18080000000000000000000002000000851000000600000018020000", @ANYRES32, @ANYBLOB="00000000000000006600020080ffffff18000000fffffffe00000000000000109500040000000000360a02000f000000180100002020782500000000002020207b1a00fe00000000bfa100000000000007010000f8ffffffb702000008000000b50afdff0000000085000000060000009500000000000000"], &(0x7f00000002c0)='GPL\x00', 0x2, 0xff5c, &(0x7f0000000300)=""/222}, 0x78) 1.60132044s ago: executing program 3 (id=12926): r0 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r0, &(0x7f0000000840)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000900), 0x4) sendmsg$nl_generic(r0, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000980)={&(0x7f0000000a00)={0x14, 0x31, 0x9, 0x70bd2a, 0x0, {0x4}}, 0x14}, 0x1, 0x1000000, 0x0, 0x46810}, 0x22000084) 1.582065021s ago: executing program 2 (id=12927): socket$nl_netfilter(0x10, 0x3, 0xc) r0 = bpf$TOKEN_CREATE(0x24, &(0x7f0000000100), 0x8) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) socket$unix(0x1, 0x5, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB], 0x24}, 0x1, 0x0, 0x0, 0x26000801}, 0x4004000) sendmmsg(r2, &(0x7f0000000200), 0x40000000000009f, 0x0) sendmsg$nl_route(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000002c0)=ANY=[@ANYBLOB="2c000067094ec5a729bd7000fddbdf250a0000cdfe0000030200010008004e23fd5e000008000a0001000000"], 0x2c}, 0x1, 0x0, 0x0, 0x20008045}, 0x44) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$l2tp(0x0, r3) sendmsg$L2TP_CMD_TUNNEL_CREATE(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000340)={0x0}, 0x1, 0x0, 0x0, 0x4044000}, 0x0) sendmsg$L2TP_CMD_SESSION_CREATE(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000400)={0x34, r4, 0x1, 0x0, 0x0, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_SESSION_ID={0x8, 0xb, 0x1}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x1}, @L2TP_ATTR_PW_TYPE={0x6, 0x1, 0x5}]}, 0x34}}, 0x0) socket$netlink(0x10, 0x3, 0x10) bind$netlink(r2, &(0x7f0000000440)={0x10, 0x0, 0x4000000, 0x4000000}, 0x4) r5 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r5, &(0x7f0000000480)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$sock_int(r5, 0x1, 0x8, &(0x7f00000004c0), 0x4) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r5, 0x10e, 0x4, &(0x7f0000000500)=0xcde, 0x4) r6 = socket$nl_route(0x10, 0x3, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000540), r3) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_MEDIA_GET(r7, &(0x7f0000000580)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000600)={&(0x7f0000000640)={0x48, 0x0, 0x222, 0x70bd26, 0x25dfdbff, {}, [@TIPC_NLA_NET={0x34, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x10}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x200}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x7fff}, @TIPC_NLA_NET_NODEID_W1={0xc}]}]}, 0x48}}, 0x4000000) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f00000006c0), 0xffffffffffffffff) r9 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r9, 0x8933, &(0x7f0000000700)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_COALESCE(r7, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000007c0)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r8, @ANYBLOB="010000004000ffffffff0200000008000300", @ANYRES32=r10, @ANYBLOB="080002"], 0x24}, 0x1, 0x6c00, 0x0, 0x4d080}, 0x0) sendmsg$nl_route(r6, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000800)={&(0x7f0000000840)=ANY=[@ANYRESDEC=r0], 0x0, 0x2d}, 0x28) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) 1.159624305s ago: executing program 3 (id=12928): bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0xe, 0x16, &(0x7f00000000c0)=ANY=[@ANYBLOB="61105c00000000006113380000000000bfa00000000000000700000008ffffffd50301001874004095000600000000006916360000000000bf67000000000000360607000fff07201706000020190000160300000ee60060bf050000000000007b650000000000006507f9ff01000000070700004ddfffff1e75000000000000bf54000000000000070400000400f9ffad4301000000000095000000000000001500000000000000950000000000000032ed3c12dc8c27df8ecf264e0f84f9f17d3c30e32f17540faf80250aa20c669a5e12814cb1cea5d4601d295c45a6a0b9bdb7dd399703cac4f6f3be4b369289aa6812b8e007e733a9a4f1b0af3dda82ee45a010fb94fe9de57b9d8a814261bdb94a05000400c6c60bf70d742a81762bab8395fa64810b5b40d893ea8fe0185473d51b546cad3f1d5ab2af27546e7c955ccefa1f6ab689b555202da2e0ec2871b4a7e65836429a527dc47ebe84a423b6c8d345dc8da3085b0ab71ca1b901627b562ed04ae76002d4519af619e3cca4d69e0dee5eb106774a8f3e6916dfec88158f0200000000c8fb730a5c1bf2b2bb71a629361997a75fd552bdc206438b8ef4901fd03c16dfda44221b235c8ac86d8a297dff0445a15f21dce431e56723888fb126a163f16f920ae2fb494059bba8e3b680324a188076eb685d55c4e9b2ad9bc1172ba7cbebe174aba210d739a018f9bbec63222d20cecac4d03723f1c932b3a6aa57f1ad2e99e0e67ab93716d20000009f0f53acbb40b4f8e2738270b31562ed834f2af97787f696649a462e7ee4bcf8b07a10fd7ed6735154beb4000000000000000000000000004000bc00f6746a9709e7e78f4ddc211bc3ebe6bd9d42ca0140a7afaab43176e65ec1118d50d1e827f3472f4445d253887a5ad103649afa17690884f800031e03a651bb96589a7e2e509bcc1d161347623cb5e7ac4629c8ab04871bc47287cd31cc43ea0ffb567b40407d000000210000000000000000005f37d8703f37ca364a601ae899a56715a0a62a34c1d926a0f6a5480a55c22fe3a5ac00000000000000000000000500002000000000fb79ea00000000000000000000e4007be511fe32fbc90e2364a55e9bb66ac64423d2d00fea2594e14d90deae46e26c596f84eba90000000000000000fffb0000000082fb0d3cc3aa39ee4b1386bab561cda886fa642994cacd473b543ccb5f0d7b63924f17c67b13631d22a11dc3c693962895496d4f6e9cc54db6c7205a6b06ff7f0000000000007f31d7c8cc5d325c5379b0363ce8bd1f61b007e1ff5f1be1969a1ba791ad46d800000000c7f26a0337302f3b41eae59809fd05d12f6106f117b062df67d3a6473265dd1410eea68208a3f26b2989b832d8b34a34a4f08b34b3042065acaa10856e858d27adee7daf32903d3fc78700d429a2d4c8b6d803eb83eecfe4c7ff9e6ab5a52e83d089e0b1c23c0f3cdad7a8710e0254f1b11cced7bc3c8da0c44d2ebf9f6f3ff3be4d1458077c2253b0c7c7a0a9fdd63bf910dc20e5cb2a88e59febc47f1212a21f631d22bad050e9856b48ae3a03a497c37758537650fe6db89da3c41fdc3d78e046f6160e1741299e8dc29906870e6431ed1eab5d067a183f064b060a8ec12725d42e3a74863d66bee966b1574f8e01b3f34a267ff0af1cb3f1f815f8989d78854ca4d3116dbc7e2bf2402a75fd7a55733360040855ed5d1c0d634fc5fb38f84d9d87b27f8a5d91217b728f13e3ee20e69e0ffb2780b1a7af137ff7b4ff139604faf0453bedf0c5d744b5272b44c23488b2bdbff947c4dfa108cbb88202eeb81f428a5b3c29984864961a57ff52f657a67463d7dbf85ae9321fc2cc17dc4a29b9cba8ded5de8206c812439ab129ae818837ee15620789c524b3baf49a0be9bb7d958d5e87c6c09bf71a894bad62934782cc308e936d7637e07c4a2b4dc87b0da20000d9ef418cf19e7a8c4c328be0ce91798adc2dca87ddd9d064e081383409ed2912c811ae63f03212a5331c2a4ead000000000000000000000000000000000000000000000000001386866b311bd144bc32e059658c9f8342c90c1ade31b78072841b8b5a943d62a44cea6b050c42e3c205fad6a23fb43c93da0f49d911877265e6ee443e37397ecf89021e7f579e8d3a74c12b52938d91e9de07fc8eeeb9505f4a9c26266bf5449484ccc1317c747664e9f7478f8200000000000000"], &(0x7f0000000700)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_skb}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000b40)={0x1, 0x4, &(0x7f0000000c00)=ANY=[@ANYBLOB="1800000001000000000000000000000071125a000000000095"], &(0x7f0000000c40)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0xa, '\x00', 0x0, @fallback=0x38, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffd}, 0x94) 1.150415558s ago: executing program 2 (id=12929): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0x0}, 0x48) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r2 = socket$netlink(0x10, 0x3, 0x4) writev(r2, &(0x7f0000000300)=[{&(0x7f0000000340)="a10100001500add427323b470c45b4560a067fffffff81004e22000d00ff0028925aa80020007b00090080000efffeffe809000000ff0000f03ac7100003ffffffffffffffffffffffe7ee00000000000000000200000000", 0x1a1}], 0x1) ioctl$EXT4_IOC_SETFSUUID(r1, 0x4008662c, &(0x7f0000000180)={0x0, 0x0, "1dac05ebbdc8ef43c3c115b51926505c"}) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$gtp(&(0x7f0000000400), r3) r5 = socket(0x10, 0x3, 0x0) ioctl$BTRFS_IOC_SNAP_DESTROY(r3, 0x5000940f, &(0x7f0000001900)={{r1}, "6a50fd85a5a30780756717c62f9b8f42a9a76339d9b58b4b98a0512be231f946187753d8f0e665d32d184c7a10381e5c4d27dc24c117c8764133b8a68682f848fcfb36d473899575b865db66444c806c8bdbe78306f5959c4ab3f9b8267414a700e8c6add5080c0ec9485495026810847aad5a2903884763b86d49edb9d7ff901af7c640550f808323c0155dadadeeabcfdd15503731fc58612229ace2983871f3ebe3a3753f46491a8ef6f59247447ff842c98b5547e359cc8768277b4f63f426b69ca79b6c50995256ca3bf3b81e927d3f76d8f9cff6873c56610d6574d76887cf20f9765b240fa21ad6ea391b8b3bad082cdb63fb349ddb8c09333c42e31762f59de4e1ee538784b08bb28df1a7ec6ec544755419e19d6190e4cd451df1184962aac1e16452e8643f7f10ff31891864edc607647539448706d076a65f7ef19242b75effc26e1f00de820e7adad630701a996bb247928e59c87b6033616a09e828c5f9219af018ea49e7511d59b8f5acb695a5d54b772f4d39fee761d2cea037cb09abeec3f854db44d7bffd0aaa9c4c0c95f49440fc3542651efe17553a41a895136634e2f0dbb4987adc563cc0022b228e4ee4039be581c5c0caa658b4d12317ee589fab295ba62cb248a19eed61f56a256b74d02d90074e8d6d7a41529761ea33449048b99d2b4825a0cd4ba91daae6362f4d114be0d069c6a443aa92fa3cf12124e4efd2580ee248e36f9d2a86c09caa52a0f053c34434841c4917ce5fa2f1ba919dfcf03b0826990a7f9ed3083e2abc67fc83c8e64c44569cbc051c47e1533189c9792b526bd7629184fd8700485ddc760309973f4871920f73c67540816e9f3f0ebac807f5708fabfbc3a414b04b619eaeace689b93c74c983169fd06cff8f858b3b1fa44899b30e1f7f2f1cc813efcbc3b7393a8793ea5e41f652a69883e1097e2ab5b59b1dcb624b97c2c51c8f191a5bca7f3a8fad51a0516be3c1ebf2d06457f012652dd55bc332b7dd2f7f7e41f1e0e60fe2c9f01a6b20a12f0859bbab7a7bf55350501dac3b1a69ed2174773b6b758ca11bc054f5073906bd9c098d8aab6f935a656ec75e59ec87298b3c057c766bc8489edf770ac433d291503c5d4346bff08aa5190f6f77d468a94c9e18c9b36194832d926a34ff7f57065bd75f2333c220926a01232e8fb84740c9500d2f9484fd1606de750b9fd46815eaf5e542bd6556901bf0d4241f001ab2e305c5e3f458f0582a97da3ed4c8eddbee775a0c430301944ac9394c74fb0d2f04be3306f3fbc47fa6aa18105a6e9e71c15e8071ee8e31d73a190aa265381827c3c132ee945111b80f7e167effc3b6a0aaeee2893ab44be36a8476ff6ef909608f778197a5afce205f9e2cbdbc95015814fa882a2fb4d93aea26a0af1776cb3d7b15eeb03fbb782a96b66e1bc39054aa95b688dd6f4d666855b33b314b43f909e8bf97dc6eaf0b79db2b2f9205b2a0594da22a5e1b229523efca91bfab62203387ba61c8b817ec8092f4a77ceab927ff0b37d25d5afc1b32af75b80a024a2875b1420e8f70440e0163d3c8c7713a4b417dba71311483575525e926587a3dfeeed586a038e2aeb81ad54f74f06e36cf7a55d4c05781f0492c615131e4be739cf61a1834c208c6cbe8e18e1fd6097917541058efbcd06c2716eb7e0daa9557f69fb91f3af675f7257120acab19162cad58a8326171fd4f1a18ae800dc179c367ca51f54f8137e79bd59ca6f83f828499dacd8e060722e0ce7268f9523add3cc41d2028e954ede7ee13c27e11fff10ec971d5fff6f82f69712dc5b482d1675b521ac625cfa2393acda1f70204db83b627baf5da8ffb345fc170a7b186f2c4bc8fd0d8cce41c3f023177eddfe4fddf4c91288d4366dc43ad6b3dd1afa1e29653a6487483723dd3e79d36f2046ac0440807c57e3fccbafe049f74702a3221b3f963d67e8237e79ddcccf5359cf3ea8b4dcf4f2a32cae7f7d3385e33e4bfecc5d6e01b196e9e73b8157477becb853063167af7ce7a3c6784295935e905bdae8e50bae1a41d878341cd832ef56089ac7efd6ce0959f61f85ccb884061f4d0cb1a30de915e6e1555caeda844b088bee28a679f5542ab019284387ce59ed6f36c3b8fb39e980095fa03e660751d8009aca87bad857ba099d8e21ebe292ccd21763709358d3307ee8b49402280abdc3282941dfbfc08a9ae0a57841d37256e0172d58c17b632767135ab027f200ed36e4388c515a4ca60f614d0183d1c9d8e8efc73aa890d3d7bf4a597bbd801f340cb6573eafd3cfffd61e18b394ff2ea2d36b6043d12ef84161b3b69097d7b9fa0bc37d35452b179a9e152093200bbc0c75b9f4dab81560a8cfb83fee354ca52db61a9a5ecd6eb52eccbf870d44724ec76d6887b8c8b2b39dc09adab932bbc09b1cc2fe9d992379b154f9c079823a8171bb904e97dec426736d743a614e55d90d6e53e01e9ab34661ec5974614190995e26c7d56275db96e766e0a5950205e74bdacfce652e3c4f788bd65662afd4bf32a2b9f039e1b66a4b6970fcf0790dfd5d8e637a2e562debf9479ebda6359d000b99eab45fce84cf2582ae6f1f259bade1eae83f76f67e445397d94157a75e81a610d4c7f4ce235ccb4b5e3fbbf2cff9bae8d7f0a3d1c5f0c3473240f09e99eb5761132c0c605c461cfa09a1b58db47f5ef09b96c2bf807ca14124f9a2a7a242c269281f463242a7d5dc520553baaee9aa5c43bebded40e9970683e306920257af3bdf8fc4c354a6fc42a9edf0e0a3a2957361a9182510a6a069707b24b079be73cd37f284db010bad2fded79d48e58450b064451b8cc1675321dce16de7219424fc2aa15e104c5a204927eacbb8bd7d51b13d093d01e2b33abdef334b2860a63326c3a4da13388e17e0cfe33ea58f2ac7dd7a99c707fb10505aef3da5848f1d3a6a301688176c04cd4ea43d883a70a58bf9c2813e4522bf8f4eaae1e6dd8f790d18be912aa0d00e5da33807a75ef9269240db6c72cd25ed6668c9702bae959ccbc25c48940ca5066fabfbd643289957ae7f9a650bbc30d6e10d9f71e398f01b5f662df4684e12b7d3b49bd521a4b88f89b691a470907ee8b737195399257477c29a238e675eb128a8d1600fa086a1465455831e3fa883448d0a6b5d82f01f5685f0e3a58a372d621864200112fc6a63ba473a6d47bfe29b99b2506207a8f4f20a1aa53f0d20fd6a370b51bb26aa9c5f4a4f96897ebcd57b26dfd0252f4e0784eaba38e5c1ffc58083c5889865f6f90bc2f615514dfd8cf9e311b13975793700e6581c12788b3e6e7dd495408c0b6d9c8b8e5a5ea14b6ddde116c3158f28c3dedc53cf24f709ec1a166fe44ff3fcb4cb53cce723bf66f0488a2409aab77c1e3bd94c31155e39376146e755c9e929abe32b3f3c8aaeb1e89e4dfe59a20be028a4f18933ea33808b56598f6cbe978f36e1f637a594ead682664fbcf5f38c70265ea06e7e8672a3fd4a340576d556592f2f609a9ad7503d5f846feb12509e4a7208b777818f7e8bfea03e86ac20eb476f6e471187a6551aa3ceb33d6dd2b8b54f3cdce266809f8a67b867ebc7b42ca682af5e4dd9632c4e1a8470bafe585d29024b8b29cf6b4cc363c1cdc0cdc105c2e09d084c63510ae29675f9f440ad58dfb57cc8faf8aa2c4f093a29b1f94e726afd87b15a9d27af49f281804ab60337bdaf8298a63fa87efd958e2719019ece4c962580096d0c26e9cd26c7f5933f7854a2f7e21771c136f7f508394a17484046a6d60953e5f82d594997cc26250b4e7846d65d5b55c4a21ab6b5ecf23be1ec8c95b49eb41a623f56401a950471538c170833fab4c8d045bad4d01977c4ad4285a6c89f7bcaf153989163b2fd859283ebf5faf1bce32ed3f533bf206bb165793792108841dc8d4bbf52dfadddf88fb9eb52ced47515ffe477c287834f128f876144c8f36e96d7211e732eff814f50e9911e453971dc30b1ed66b365d0caaeef0e7f66a11e47ff13d017f0cc292e50c11529669debf1ed883854beea1a0563a9b3437fb40358305a0eeaa2fc7a23f0e7775d07925689aa589cb4299ce205dcbdd40cf9c22f2fbe655478bc6df73e20dcc5c180efc8ef2efbfc7a50fc509e0936615065edf778cfcec3e1e829ea839cb177478d3e25665e835bb7b76c6176a116ac04c264a7a9f7000fe8a7dca007bb0aa05b62186dd9117c2b70568a8954655040e25c00e1d8884736036f0413127c2960b18004d091293a8b09d84b18c77ebc2fdf113a2e3791d0cc9381bd8a1dbd55a1dc83a9bc2c001dd715bc5f1a8c901ee0cd49068a09f0c676de023489329f0fadcfe52771f5098b1e58a734665695ba08c08eefc4493c6e0161d69e883158e9510726de22adc67b02705677785a099820836088259256f83bf707ec47fcbe28e8f010522a83f7cac1c7528eb43e40976a26bb556bb9b5f8632124e49b4a5305c01f9823818a7c81d916368d3bc843f3bd62c9dd4319fa11926264453d0de6d8ebde1960e6a1951ed80e0baa1338f5f7befef8d7db4d159885ed48022274ae6eb63e9d78945028f4958e1fb0de3ec5f7a0c5eb7b756a0ffb4942385c2dc8ccc9f338d47372b30f703c4e3ca91b6b62b2c046cad3ead8ce727412d60e602405e702f62c7c8ff2e9ac87727073e96bfa49fb566b47b42e6b665de1aac0d06e18b72724c7fdcf5a5fbbab56f789f9368514a6666f60f27348921c821ba4b9f8ea81b003b23bd2f32d31a1c092324ffdaa908b718f68babfe975dde22e346ff803f4faff57d59e1586cecab38a46fed7742f7db1e38ee8f1a5063df0c6e3de1517e1b5bf502d21ac7b935f1696f5bf3a29518526b0a66b709e4c99c9e26fab9c89591d23f0b5cf30922266414c8e5aa0a7aa1c5b922cc9270ba3f97afa85ce14107d54b6915f6175a5b24cbf8a2a080f22826bb000cca852c57d6d51fc06eeff0b9bc921a5a45aa465fc659a3e98fa26ff3e1a6926cbec4271d3522478272ca81cda0a5d74f04a395c1a3a3b8f3775113ab1fbc56ad42686f2e9953f4f107ba476aa956d7ec910c5aa96d6b47c341535be69998325b9c6579195bf0a5b0aac755ff5d6267b30022badd3abf4cd246c28b50a50c14de07364c3e9c5238e2c500d535c6d1f1b4b94bacdc08b8a4138b10016f4b233f5d1ef8eebfdacccf803899dd721ef52e95573f28cc36ee5252d3a73df20a244af24766e1a8d0535a52f2718238a68ac04e34421fba0ccf0315ab9a524b9ec8dac16481638de296e3d947b18c9909a2cbdbca0b0e1cd7b5c09beb41ebb8a94000c0d19176e08e3719415646b04e29203d3924714d49e9393df27df32f2c8fe92fef8ce44b5f86ec9ef7b96d0ffeb1c33ca0d7d815149d15dce8b5022afcbd90325503d5fd1e207824da1ac237ff0f0993e0f344f7b9867a4e01d5f41ac177080d8e43310c0e3d91f1099fcd1ffa1926df6a86cd5c7dde3ebb366660f38203ca10a5608c0ae21e671f33d48721fb8008d3dcdd35d115b6c35a767984a474eb2c856df6a00212bb2364b1196d9b74e197a31c53c3f3a97449456f13a1eb27d984ec3dbc8cc9499457a89df2624f58f3464707227a39fbc5d9777f52cd1a8af0be814bf933da7c992eb24a152cd9a1fa934534a2bcee4f381a3b53c6bff3837527dbb96be55b72fbe323fd7d3dc006139f43d3da984bacd1f7a77435f9dcc9a1952aa3f12e5517e6886038ab4588c1fecff48ce2960772c49bb583a2c4e7b1c36ae509"}) setsockopt$netlink_NETLINK_TX_RING(r5, 0x10e, 0xc, &(0x7f00000001c0)={0xfffffffb}, 0x10) sendmsg$nl_route(r5, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000018c0)=ANY=[@ANYBLOB="3c000000120069b17abdb4fd7fb82cbb2100fcbd"], 0x3c}, 0x1, 0x0, 0x0, 0x40000}, 0x0) r6 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000000440), r6) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_LIST(r8, &(0x7f00000029c0)={0x0, 0x0, &(0x7f0000002a00)={&(0x7f0000002a40)={0x1c, 0x7, 0x6, 0x301, 0x0, 0x0, {0x3, 0x0, 0x2}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x90}, 0x4000044) close(r8) sendmsg$NFULNL_MSG_CONFIG(r7, &(0x7f0000002900)={0x0, 0x0, &(0x7f0000002940)={&(0x7f0000002980)={0x1c, 0x1, 0x4, 0x3, 0x0, 0x0, {0xe502846252f2bae2, 0x0, 0x80}, [@NFULA_CFG_CMD={0x5, 0x1, 0x4}]}, 0x1c}, 0x1, 0x0, 0x0, 0x2000c010}, 0x4000844) getsockname$packet(r6, &(0x7f0000000480)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000004c0)=0x14) sendmsg$nl_route(r6, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000580)=@newlink={0x38, 0x10, 0x437, 0x800000, 0x0, {0x0, 0x0, 0x0, r9, 0x504c3}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @gtp={{0x8}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GTP_FD0={0x8, 0x1, @udp6}]}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x2000c014}, 0x0) sendmsg$GTP_CMD_DELPDP(r3, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000640)={0x24, r4, 0x3, 0x70bd29, 0xe, {}, [@GTPA_LINK={0x8, 0x1, r9}, @GTPA_VERSION={0x8, 0x2, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x44800}, 0x20000000) socket(0x28, 0x1, 0xb69e) sendmsg$GTP_CMD_DELPDP(r2, &(0x7f0000000700)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f00000006c0)={&(0x7f0000000680)={0x1c, r4, 0x2, 0x70bd27, 0x25dfdbfc, {}, [@GTPA_PEER_ADDRESS={0x8, 0x4, @multicast1}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20040000}, 0x20008818) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, &(0x7f0000000800)={0x0, 0x0, "a2e3108f0d2e7d07f23f7764cd15a5718acc8d041ab32060a49cada6205e5e8eab09d5502b3e72f76fe93c606c32147f426520d7497f4344bcc8d3f4b4611aaf6da75f83869625910f0f445631d9192dba2759d39df8205fa6babb429ce7d6978b234bf828a2c80fe36e7788ba5e7c4ebc562a7d1d8a0065a4e0e7781567a77bfd318eadecd64cb805967c67006acbef358b98a268344fb3cb2a12c8f3615e99dea8315a8e7bb97daf1c2784f5dd1476b8b27b2a8f3d6fda3e1b430e22143151519b6ad5d9fdaad205eddd551e5c36ab1b7582a0405629912c3dc6f8e300273f9d9577c3c2f1b8385827a6dbfcab188acb5070bd0035dcce82f1d3d17576200e", "70e7139c14e7b569af3324fe1c3b9c8630fe7ed31b0b1ca15ea42a1219d196c52eae04d73b850c2ea6d996ee26c8f21a9327530cc029fa0a91252e614695f10d0af831ba5d47923038e8103993ca23aa9f67d3b6bbb541075792569ac7183b859b124a97346de8add4a90ab21cf5e0bda69ba080ef9352a9800eda6533d6aa2a0a71a8b82fc54bfdd94c98eaf176bdd3a65505f34b7bc372257b6585d65f16f236990b641e57502faa28624b671a3706dabdbd0ebbdca1461fcc47af6f2016414b86ca7cb8e39e0eebfb9168a51f81d5cc15779872d12e6016a381232778894896eeae8cffeb6ac309e6228a7e3b6ed877257054c79cff4f416ba0d2a85b2bcd522be4e21b53a638ac6760e1ab5b8e3eebd17256492804c5c8cf922b29c81999b7b624e9a74c16a57d1ea66bab3173813a1ee85b0943870429da767e2b3dcdd4fca52d580637f8588dac1963ae38658677a8f45c98004e2b8b32ca5ddb77dbb2b7cee5daa8fb2da6d56d37c72593a640a04f32ab3bd01a8ecd3307985d26ca31e9e40e97efd9cfb316b32259a898f782748ab5ed74f8993fb23b66485899d5415a3c7b97035bbf1aa3ff95933ffeb8e9902fb96b0bd91393cc91fefad78a65302f7d85ccf2295329007e48956cc54b935fd586302198ca172452a20c66d7ae2fc2a2612f9d094e9660806f7158b3112cb1ca3e615729fd32b66a45bb69276dc867f2deee04e3c383441e7f178a5ad6555c909bbe203796b55bc198b13347c56418e87b445c370659e425063e479f4bb9da0de0b516e4120e897e46e60941a936442cd620b330e96200d5f2014a7cae8bd43182fbdbf80bc9cd04cc287479b5d66e8a4408444e69fd5fb031e79977fd0bb135a201e5c59c8c4aff7f5199bc59d4efa5266e3048ffc16764222d614f415e583df1cfc1e9e361d9441469ef99a5027aa54512340728d128c374fa137b4375a82df2374d456316acfa9a5dab7b8454fbdbc7eed9f386e83cd6431befb7480bcccffd755f44d3d437dbe47b6c16f05505078eb6f56c96a463bd3d938224aa5484c896adaa607b7411c60645d06ea548c6bc2f5cb9a859a75a18b5acd5a12e478524009acaa529e34f8cceee38a19b22dc270d53a1bf4582b0ec2a3dd1b41d917a8f80ee168a971cfd66482db7d1e7e1a88899dfa080a71bf5ab09c5217719205cb4809dbdb3802acea1a79a5c754901b7b9139d4f8231b8312de6788303b8a0a7e0e18e31481432cdf2dc5bb0b211b4c2d51f494dfc6b1aabf16a2b820c3e94f3d80030b1b84c299cdee24d6a2f243d038596f806ba42710df2a8c3a1541f1caa6e02dd128232b404f3205072ee2efb448e089b327aec3883e3c2c0f151bb24a32e8602bff481541c446fa041b9e932f0da67ed4e2ff8e9875a348c14649964e0bbf403ae8fac49dfca06962d58650591005f99086a7b1f73a75945448957357880283a36cd3c253859138c373bd15dc40bf0f3c41dcf2a6298223ab48335faf862572eec6cd66ad553f890157fe3df33dcbf1ef76421f79d6cd8a0e1c9fe98ace6eaf1099db35d853a6772ec8e4081133ba384818137c5494db932f533caa691527734d5e6378c79c9df19bf4967d08922253dc537a1f857d33124fafb6cebc2a28b362d5f0bf498f1d7736c2c4382c0caf9b4609a1a4dfe8edf2dc919baf86f858171f012841075d91b1c3c572a8da7ef77462b7c7f926435dab9c76ffadf31e68fee61ce07373703355c7c4a26abc9c99cb74abfb5e9b93e71d0f08317426fe2a929d73291d12e9bc42325ba66140a25cd280bd660d40c54c5191271ce0e338338addf6b81271a0e0405c1c8dd53103f6f012dbcb579fc7c7402447f469d2cc280503797f2070546148f51a4d93b0287194d9b82113a2713e77bb4c0d468a8c9896a7f73d832bda3b1a80f8611c455dc43a49a63450e763be73c141ad6c5a514d56d2aab648751173cf1d39055a7cd9fa519f31a69e878a407b0cddcdae2600a113cc85c539e5fa001e8f5e2dc14735b822bb6d47b009fa1b7f9eb864c9f374067b667e0c4e8eea6293ca2131a71b28323d1f421cab53e5c519f1ff5f7d16e897da98e40ae4d8441918a6cd824bcb5512fdceacce8b228a22eb768badf1983caf94d6f97e852c79c8cdcff14c01ac805dab0e31aa49ec4d75e657845d711830c02e0ab3d8b64c72da43808416c129c3b1f6a27cba3040bdccef5577ded808196412ef5af11d2bd6b1db6bb2db2377794afcf80308179613ad228f3ea08b9f6f78ac8dc47ccf0052ea914d41ac56569086392d4fa924cd916e9f63267bb89457e167971d6887d6789c81e78e5789bd19507998bf9d5c61f7452f075098b4e0a25cd9286ca853e3b71341c30b1bc0ebe1f2808a0e954f00a3741e2b1f37b89fb5e4d8bc96a32013b0614a4882b075fdadac5e9379fa50e36a7d81e6f6db9acc429b7f8b72cae447e1d7511e887c580f494c643e130380620b5658c85d9c4e65f40875c3cf5c181a4ff169be3ac3d9fe47c7f5ae889e4e7e0a7c956f5ba0d2fa04977cbc2672a1a77dff39bbca2d27f00fa532e5c2bcfef9aa1e76ca703209ef92b2980392f02db0740394b407d28b74a1e4d8cedab98cb102e3b0d39d26f211921bd87021101b014255ef8e35aff13dec320959f3d1bd845cb47bc85a228f8e9a1b542fe5522ad5bdd1caabe0fbacbc8b4804436274f85fadc8c0c9ebe82a55d51e63f317d00da0d3303a3944f448ed5237268159704ad5222ece9dc051a64d74889a87c791b1194bce05068c3b8d1653f02e7ee0e78a93c224328bf5ef1ad74af48ef949b26f7257299acaec514864b6a43ab12201426e885ce43eec269258b06d08e9f35cf98a7229e5a6e62ed3842e16b3e31b8f660235bf80121304b74df4b32e73bad72d28e09e36b69102cbfb2c31a6bed8c1d6876c97e1390b47441087ea4e26f0b7854312c2c5345ccc0d6f02808144c22e12a7d36f8a2061f97ac81436cbc23d6fe60679d0a3b22faed3727f3d1a1a1a6afc587738bd63dba6b821fe1a4cbd32aa2e306e90350fdf2b5c434080bdd0ea25a2d8a2ad37327ab8f3c620ae376f448f90cf01793473a50f6fa390d21666fb2f66215df5cf78e9d083a855fec4fb0e1880adbfb37c103a26a836c3bdb5da20fc6f5287db212b8244cfe4f7cb874be778ce0330541bb0e37fac2437b49d3e96962456b77630fb53a131eac19fcc975985f50971da2fff4aad12845b40f7077f426dacfe8054f4eeaebe9968f6d35a864b9326738ff812c2990264fa5356986e1bba97a662753d822bdf0e96abbd2989bd09b85ebdb669b563569d5cec18513a712990996b8b22c09b31f16778545090ea3852a94d1dc4e43be7b29019d544608bede0831f300f52f298d819ebf9409cbc027a57b0f477910396c7d731000f6a31a3d84ed56ab531e90aef05e88450c107e626ec37513f05062d95aaf97d0228d130a3b2c24cd1aa9720f1cf794237771620b8773d83f528db0e7fea6f58b8ccbbacdd523b8bc632b9a5324217ddab3c5bc21d34427712172f015b2d0c0ef9b0dfd86bcbf11df7a91dc571429ba7a51ea446f796f1bf85ef9c9e9411f8211617a45b17384067e040e0fa971ce5c8bea9306ba96af396e1307bb512899775b44210ef654ab60bee01dd604d69795c905acd8e01b1413d619eda9085b2c15cef2adc1b921542ec929057cc06fa55d61bbe240b9bba7f127141a41f50082b6b7fd006ec7e02395f30c9ab89ec75be8d901b9db4ce8eb9d5c1122efdc519c0aac20263337f1238fa0fbed5242ea21567f0c6ff74b69b1419b7713f480d6f972d567ed3bfb9866657c3388fce41dc66cbba720ed7ba7466847c708e19903ee9835ca2737ea7f124916f9bd0fd0c9a271c9b52eaec0b7d873b5af18f0cf5b30ff8c7c0df2464ba6b74f1db1af52209546b537951aed9d4f074c2f708c156435902a2d474c594fd567a99567344e492d6e32f2e98420adab450a206e927be44c2cff9ab0892f3749c1f19260050bcde10d35d3d00142fb96676ff5dadf19801f6a7e3368f144587f23c8112d0b552257f68a6651fd59d6c3532373fa2dc1747e16d455e1bc0fa2c0f73f110004d7856db75f1cb632d6ffe0a4c11c9cc00743fcc56ebabc6256b2103f757ece12d8460c6ea247f1c2b923cc8a2af630572710aca769271e0800e121636da42a330af85c3e7ce30b73658f6942b3c0f10425e5bb1bb2c365fff5ac9a475e76f1966338c282a1008b4edc658f5ac226332a8c44daa3686ccf6b33ad0d83c7d33fc6e02de4760b9cfa6f6109c1baa89f808b0a01b86668424ba0551ac21c22f6a180a80cf958079b8f53d4cc2715b937464f32f53eb9fbfdacb75a436567a935bbc2b79d6226e0c456d15c735fbbe3648275b8dc8ed0a943d057bd020d75e200d131f3433a9abb6977d86bb4737781c2da164d74a4685705ab0371dedc42573282a39e90d00a00685b9b53bfdc2e0a47cd512c71fdc9fb802bad8782609e84dff3a1969ed8c6cb1a929d7e6ac6e7586327d76e055bda604f09aae30e5296b42f73f1c7cc6e0d624b67d8c4a8d2487788e620338cae143b7d52d25489255c4e4d788fcb81ce941d6b9fb1e7e149f7588066cde7ff426fa3c834c24000f42f56b0787514ae9a5aafd7631bd5e4eea9fbdbc7c09dd9a0baddf9d8f607c76f3eed319c64a8d16d740d892fc6479c820ae42ad73b8396a52e222ed379d2e6163d0e77461618d466076e29ac6d6e32b71a16c1268b1ee79ceea3edb79d1d032bafd89413d4964d2243073e5dbef40d0a59a5528ce79629d365c703b5d027401b1c0de8f6295f7be2d65b4189ccb01c24e662c6c4fe88ebbdd0a4b1f18bd39d81cec16a4dd91e0d7e329dcc816da81de9cf945ebe0d21b60957f9340cd7f6fd8e8ff8866e7df9c5fce641b24d6380a761750aaf5d356546e342634308777b849f1259788cbea5a1440d30f2af29d2342de679eb0e80d3c8473c4edacef564f820bf7527933e13f46de5b6948aeee50c8b1e268708a086c0550382cee064fcf6485c4e250ed2b8fa181d9de96d3e86710a23fedf35c24a63ec203872882572e2e3e080d5c03a734618472fad7dafdf6141d96442a1d35af378cf733e95e01a7cb67eed568806b9025da88b9d5c18a7dfbed44e581f1dd54fb48b8553deb3d9b72a2c4f46d335f49082db0157568a9d4e55d4535337281e9e34ded408f8e40f1584cd1c1e897b9cea119d94fb834eff3358643243e005b5acde27756e233e70b692cbd06690b2505c50c5c0700c778b69750f51d29cbbf19d2e54ebecb5bf415de9b9a88d52fcc63650e4abbfdf5b3757b3aa5a27cab92fa26b408d5b9f37ab32d3b1c66d8ca41f"}) ioctl$BTRFS_IOC_TREE_SEARCH_V2(r1, 0xc0709411, &(0x7f0000001800)={{r10, 0x5, 0x5, 0x7f, 0x8000000000000001, 0xfffffffffffffff8, 0x8, 0xfffffff1, 0x6, 0x5dc, 0x89, 0x4, 0x3ff, 0x4, 0x9d2f}, 0x18, [0x0, 0x0, 0x0]}) getsockopt$sock_int(r1, 0x1, 0x22, 0x0, &(0x7f00000002c0)) r11 = socket$inet(0x2, 0x80000, 0x7a) setsockopt$inet_mreq(r11, 0x0, 0x23, &(0x7f0000000200)={@rand_addr=0x64010102, @dev={0xac, 0x14, 0x14, 0x37}}, 0x8) r12 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x7, 0x1c, &(0x7f0000000100)=ANY=[@ANYRESHEX=r3, @ANYRES32=r12, @ANYRES64=r11, @ANYRES32=r0, @ANYBLOB="0000000000000000b7050000080000004608ebff76000000bf9800000000000056080000000000008500000000000000b70000000000000095"], &(0x7f0000000000)='GPL\x00', 0x5, 0x0, 0x0, 0x41000, 0x16, '\x00', r9, @fallback=0x21, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff}, 0x94) 1.016884202s ago: executing program 4 (id=12930): socket$nl_route(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x7, 0x8, &(0x7f0000000380)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x9e, 0x72, 0xa, 0xff00}, [@call={0x79, 0x0, 0x20}, @exit, @map_fd, @jmp={0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10}]}, &(0x7f00000003c0)='GPL\x00', 0x2, 0x95, &(0x7f0000000400)=""/149}, 0x94) r0 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f00000004c0)={0x8, 0x230}, 0x10) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000900)={0x0, 0x0, 0x0}, 0x44000) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000940), 0x40482, 0x0) ioctl$PPPIOCNEWUNIT(r1, 0xc004743e, &(0x7f0000000980)) pwritev(r1, &(0x7f00000009c0)=[{&(0x7f0000000a00)="80fd06000040", 0x27}], 0x2, 0x0, 0x4) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000a40), 0xffffffffffffffff) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="380000001a0001000000000000000a20802020", @ANYRESOCT=r5], 0x38}}, 0x0) sendmsg$NL80211_CMD_GET_SCAN(r3, &(0x7f0000000ac0)={0x0, 0x0, &(0x7f0000000b00)={&(0x7f0000000280)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r4, @ANYBLOB="210f0022bb5600000000200000cd6d5b5f468ca276030008000300", @ANYRES32=0x0, @ANYBLOB], 0x1c}, 0x1, 0x0, 0x0, 0x20000015}, 0x44000) r6 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r6, &(0x7f0000000b80)={0x3, 0x0, &(0x7f0000000bc0)={&(0x7f0000000c00)=ANY=[@ANYBLOB="020200000d0000000000000000000000030006000000000002000000ac1414bb00000000000000000200010000000000000000fc00000000030005000000000002000000ac1414aa000000000000000001001500000000000100140000000000010016"], 0x68}, 0x1, 0x7}, 0x0) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000c80)={0xffffffffffffffff, 0xffffffffffffffff}) r9 = epoll_create(0x200) epoll_ctl$EPOLL_CTL_ADD(r9, 0x1, r8, &(0x7f0000000cc0)={0xa0000008}) close(r7) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000d00)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_CQM(r2, &(0x7f0000000d40)={&(0x7f0000000d80)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000dc0)={&(0x7f0000000e00)={0x28, r4, 0x400, 0x70bd25, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r10}, @val={0xc, 0x99, {0x270, 0x66}}}}}, 0x28}, 0x1, 0x0, 0x0, 0x40840}, 0x8881) openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/tcp_wmem\x00', 0x1, 0x0) socket$nl_route(0x10, 0x3, 0x0) r11 = syz_init_net_socket$x25(0x9, 0x5, 0x0) ioctl$sock_proto_private(r11, 0x89e7, &(0x7f0000000e40)="00c3") r12 = bpf$MAP_CREATE(0x0, &(0x7f0000000e80)=ANY=[@ANYBLOB="0e000000040000000800000007"], 0x50) setsockopt$inet_sctp_SCTP_RESET_ASSOC(r0, 0x84, 0x78, &(0x7f0000000680), 0x4) r13 = bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0xc, 0xd, &(0x7f0000000140)=ANY=[@ANYRESOCT, @ANYRES32=r12, @ANYBLOB="0000000000000000b7080000000000007b5af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000001e000000850000000700000095"], &(0x7f0000001000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000001040)={r13, 0x0, 0xe, 0x0, &(0x7f00000010c0)="d9b9547ed3c0021a6fd6a67ab922", 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 835.131905ms ago: executing program 3 (id=12931): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), r1) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="01000000200000001c0012000c000100626f6e64000000000c0002000800010006"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x4) sendmsg$IPVS_CMD_SET_INFO(r5, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r5, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000001440)=@newlink={0x50, 0x10, 0xffffff1f, 0x0, 0x80, {0x0, 0x0, 0x0, 0x0, 0x300, 0x17e05}, [@IFLA_MASTER={0x8, 0xa, r6}, @IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @veth={{0x9}, {0x18, 0x2, 0x0, 0x1, @val=@VETH_INFO_PEER={0x14, 0x1, {{0x0, 0x0, 0x0, 0x0, 0x4000, 0x640}}}}}}]}, 0x50}, 0x1, 0x0, 0x0, 0x2000c0c1}, 0x0) sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000480)=ANY=[@ANYBLOB="3c0000001000030400"/20, @ANYRES32=0x0, @ANYBLOB="a4280400000000001400350076657468305f746f5f626f6e6400000008000a00", @ANYRES32=r2], 0x3c}, 0x1, 0x0, 0x0, 0x4008800}, 0x8000) r7 = socket(0x1, 0x803, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="4c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="00030000000900001c0012800c0001006d6163766c616e000c000280080001000800000008000500", @ANYRES32=r8, @ANYBLOB='\b\x00\n\x00', @ANYRES32=r8], 0x4c}}, 0x884) 813.005844ms ago: executing program 5 (id=12932): sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000002c0)=@newlink={0x48, 0x10, 0x1, 0x70bd2b, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, 0x1438a}, [@IFLA_VFINFO_LIST={0x14, 0x16, 0x0, 0x1, [{0x10, 0x1, 0x0, 0x1, [@IFLA_VF_TX_RATE={0xc, 0x3, {0x2efe}}]}]}, @IFLA_IFNAME={0x14, 0x3, 'wlan0\x00'}]}, 0x48}}, 0x0) 672.325074ms ago: executing program 1 (id=12933): r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000880)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x9}, 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000b00)={0x11, 0x10, &(0x7f0000000bc0)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x9}, {{0x18, 0x1, 0x1, 0x0, r0}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x700}, {0x85, 0x0, 0x0, 0x86}}, {{0x5, 0x0, 0x5, 0x9, 0x0, 0x1, 0x41}}, [@jmp={0x5, 0x1, 0x8, 0x0, 0xdad1124f55525050}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x2a}}}, &(0x7f0000000c40)='GPL\x00', 0x5, 0x0, 0x0, 0x41100, 0x67, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value=0x7000000}, 0x94) 579.340266ms ago: executing program 2 (id=12934): r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_SET(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000080)=ANY=[], 0x24}, 0x1, 0x0, 0x0, 0x60408a0}, 0x488c0) 399.905548ms ago: executing program 5 (id=12935): unshare(0x60600) (async) r0 = syz_init_net_socket$x25(0x9, 0x5, 0x0) bind$x25(r0, 0x0, 0x0) unshare(0x4020000) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x8, 0x2, 0x0, 0x1}, 0x48) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000080)={r1, 0x0, &(0x7f00000000c0)=""/255}, 0x20) (async) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000580)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x1, 0x0, 0x9}, [@NFTA_TABLE_NAME={0x6, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}]}, @NFT_MSG_NEWRULE={0x68, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1, 0x0, 0x4}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x40, 0x4, 0x0, 0x1, [{0x3c, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0x2c, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_DREG={0x8, 0x1, 0x1, 0x0, 0xc}, @NFTA_EXTHDR_OFFSET={0x8, 0x3, 0x1, 0x0, 0x7a}, @NFTA_EXTHDR_LEN={0x8, 0x4, 0x1, 0x0, 0x22}, @NFTA_EXTHDR_TYPE={0x5, 0x2, 0x89}, @NFTA_EXTHDR_OP={0x8, 0x6, 0x1, 0x0, 0x2}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x7}}}, 0xdc}}, 0x8) 370.744519ms ago: executing program 2 (id=12936): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r0, &(0x7f0000000040), 0x651, 0x0) pselect6(0x40, &(0x7f0000000080)={0x0, 0x0, 0xffffffffffffffff}, &(0x7f00000000c0)={0x1f, 0x0, 0x0, 0x1}, 0x0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x3a) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_GET(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB="38000000010201030000000000000000020000072400018004000280050001"], 0x38}, 0x1, 0x0, 0x0, 0x90}, 0x800) r3 = socket$inet6_sctp(0xa, 0x801, 0x84) connect$inet6(r3, &(0x7f0000000200)={0xa, 0x0, 0x0, @private1, 0x200000}, 0x1c) sendto$inet6(r3, &(0x7f0000000240)='O', 0x1, 0x80, &(0x7f0000000280)={0xa, 0x0, 0x0, @private2}, 0x1c) shutdown(r3, 0x1) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r3, 0x84, 0x7b, &(0x7f00000002c0)={0x0, 0x4}, 0x8) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r3, 0x84, 0x7c, &(0x7f0000000300), &(0x7f0000000340)=0x8) sendto$inet6(r1, &(0x7f0000000040)="8000633cd1b1b5e7", 0x8, 0x2004c0c4, &(0x7f0000000100)={0x3f, 0xfffd, 0xc9, @rand_addr=' \x01\x00'}, 0x1c) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000fc0)={0x1a, 0x4, &(0x7f0000001080)=@framed={{0x18, 0x2, 0x0, 0x0, 0xb2b3, 0x0, 0x0, 0x0, 0x18}, [@kfunc={0x85, 0x0, 0x2, 0x0, 0x34d6d}]}, &(0x7f00000010c0)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x40, '\x00', 0x0, 0x3d}, 0x94) 239.934826ms ago: executing program 1 (id=12937): bpf$PROG_LOAD(0x5, &(0x7f00000011c0)={0x10, 0x16, &(0x7f0000001280)=ANY=[@ANYBLOB="61122800000000006113380000000000bf3000000000000025000200091bfeff3d20fcff000000008701000000000020bc26000000000000bf67000000000000150300000ee600f0670200000300000015030000ffffffffbf050000000000000f650000000000006507f4ff02000400070700006b3128fe1f75000000000000bf540000000000000705000003001500ae430100000000009500000000000000050000000000000095000000000000004d9bd591d568253e9988431ec068e3a82983d58719d72183f2cb7f43dd55788be820b236dcb695dbfd737cbf719506d2d6b05fe70305863f970eac3590ac99b798f8125f1c322c2a154a8a8d"], &(0x7f0000001380)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, @sk_msg}, 0x48) 191.956776ms ago: executing program 4 (id=12938): socket$inet_icmp_raw(0x2, 0x3, 0x1) (async) sendto(0xffffffffffffffff, &(0x7f00000003c0)="120000004300e7ef", 0x8, 0x0, 0x0, 0x0) (async) r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000009c0), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000a00)={'syzkaller0\x00', 0x1}) (async) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000a40)={'syzkaller0\x00', 0x0}) r3 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r3, 0x8914, &(0x7f0000000a80)={'syzkaller0\x00', 0x1}) (async) sendmsg$nl_route_sched(r1, &(0x7f0000000ac0)={0x0, 0x0, &(0x7f0000000b00)={&(0x7f0000000b40)=@newqdisc={0x30, 0x24, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {0x0, 0xffff}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) r4 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000f00), 0x102, 0x0) ioctl$PPPIOCSDEBUG(r4, 0x40047440, &(0x7f0000000f40)=0x1) (async) r5 = socket(0x28, 0x1, 0xb) ioctl$OCFS2_IOC_REFLINK(r5, 0x40186f04, &(0x7f0000000d00)={&(0x7f0000000c80)='\x00', &(0x7f0000000cc0)='.#\x00'}) (async) sendmsg$nl_route_sched(r1, &(0x7f0000000b80)={0x0, 0x0, &(0x7f0000000bc0)={&(0x7f0000000c00)=@newtfilter={0x74, 0x2c, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {0x1, 0x7}, {0xd, 0xffff}, {0x300, 0x6}}, [@filter_kind_options=@f_basic={{0xa}, {0x44, 0x2, [@TCA_BASIC_EMATCHES={0x40, 0x2, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x2}}, @TCA_EMATCH_TREE_LIST={0x34, 0x2, 0x0, 0x1, [@TCF_EM_CANID={0x14, 0x1, 0x0, 0x0, {{0xf, 0x7, 0x6}, {{0x0, 0x0, 0x1, 0x1}, {0x3, 0x1, 0x1}}}}, @TCF_EM_U32={0x1c, 0x2, 0x0, 0x0, {{0x7ff}, {0x7, 0xab5d, 0x47b, 0x7e000000}}}]}]}]}}]}, 0x74}}, 0x0) write$tun(r0, &(0x7f0000000c80)=ANY=[], 0x46) r6 = socket$inet_smc(0x2b, 0x1, 0x0) (async) r7 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0), 0x40241, 0x0) ioctl$TUNSETIFF(r7, 0x400454ca, &(0x7f0000000300)={'syzkaller1\x00', 0xc201}) (async) r8 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r8, 0x8914, &(0x7f0000000340)={'syzkaller1\x00', @link_local}) (async) write$tun(r7, &(0x7f0000000380)=ANY=[@ANYBLOB="1c0088a801000b00000014"], 0x36) (async) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000940)={0xffffffffffffffff, 0x20, &(0x7f0000000900)={&(0x7f0000000740)=""/203, 0xcb, 0x0, &(0x7f0000000840)=""/185, 0xb9}}, 0x10) bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000980)=r9, 0x4) (async) setsockopt$EBT_SO_SET_ENTRIES(r6, 0x0, 0x80, &(0x7f0000000000)=@filter={'filter\x00', 0xe, 0x2, 0x2f8, [0x6, 0x200000000080, 0x2000000001d0, 0x200000000348], 0x0, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff01000000030000004e000000006076657468315f766c616e000000000000626174616476300000000000000000007465616d3000000000000000000000006272696467655f736c6176655f300000bbbbbbbbbbbbffff00000000aaaaaaaaaa32ffffffffff000000a0000000d0000000200100006370750000000000000000000000000000000000000000000000000000000000080000000000000005000000000000004155444954000000000000000000000000000000000000000000000000000000780000000000000001000000000000006c6f670000000000000000000000000000000000000000000000000000000000280000000000000004803c62c6efde74f32fefc0bc8fdcfc2d81062234183aa51af2b8b46794f900020000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000ffffffff01000000050000000000000080356d6163766c616e31000000000000000076657468305f746f5f626f6e6400000076657468305f766972745f776966690074756e6c300000000000000000000000aaaaaaaaaabb000000ffffffe4ed0e118111ffff00ffffff0000100100001001000048010000636f6e6e776162656c000000000000000000000000000000000000000000000008000000000000000f00020000000000737470000000000000000000000000000000000000000000000000000000000048000000000000000700000005000500ff07aaaaaaaaaaaaffff000000000000010000000900000008000800aaaaaaaaaa1d000000ffffff4e244e200700ff0703000100ff0304000500000041001200646e617400000000000000000000000000000000000000000000000000000000100000000000000071c8278bf4a10000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000ffffffff00000000512304ce48f81466a4d90c35ac94"]}, 0x37e) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x12, 0xf, &(0x7f0000000240)=ANY=[@ANYBLOB="180800001fffffff000000000000000003000000", @ANYRES32, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000000000000bf9100000000000076080000000000008500000085000000b7000000000000009500000000000000"], 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r10 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000d40)={0x0, 0x0, &(0x7f0000000d80)={&(0x7f0000000dc0)=@newqdisc={0x44, 0x24, 0x200, 0x70b528, 0x0, {0x60, 0x0, 0x0, 0x0, {0xfff2, 0x10}, {0xffff, 0xffff}, {0x0, 0x9}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x14, 0x2, [@TCA_CAKE_AUTORATE={0x8, 0x9, 0xd}, @TCA_CAKE_MPU={0x8, 0xe, 0x23}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x20040041}, 0x41) (async) sendmsg$nl_route(r10, &(0x7f0000000e40)={0x0, 0x0, &(0x7f0000000e80)={&(0x7f0000000ec0)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0000000000008000280012800a00010076786c616e"], 0x50}}, 0x4000000) (async) r11 = accept$nfc_llcp(0xffffffffffffffff, 0x0, &(0x7f0000000080)) accept$nfc_llcp(r11, &(0x7f00000000c0), &(0x7f0000000140)=0x60) 33.569845ms ago: executing program 1 (id=12939): r0 = socket$tipc(0x1e, 0x5, 0x0) r1 = socket$inet_icmp(0x2, 0x2, 0x1) setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f0000000700)=@raw={'raw\x00', 0x4001, 0x3, 0x290, 0x0, 0x720d, 0x148, 0x0, 0x148, 0x1f8, 0x240, 0x240, 0x1f8, 0x240, 0x7fffffe, 0x0, {[{{@uncond, 0x0, 0x98, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}, {0x4}}]}, @common=@SET={0x60, 'SET\x00', 0x0, {{0xffffffffffffffff, [0x1, 0x1e04, 0x1, 0x3, 0x4], 0x1, 0x6}, {0xffffffffffffffff, [0x7, 0xb2cc575b459b5b37, 0x4, 0x1], 0x6, 0x7}}}}, {{@ip={@broadcast, @multicast1, 0x0, 0xffffffff, 'veth0_to_batadv\x00', 'vlan1\x00', {0xff}, {0xff}, 0x1, 0x0, 0x40}, 0x0, 0x98, 0x100, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x1, 0x0, 0x5, 0x7a, 'snmp\x00', 'syz0\x00', {0x3}}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x2f0) bind$tipc(r0, &(0x7f0000000040)=@nameseq={0x1e, 0x1, 0x1, {0x42, 0x0, 0x2}}, 0x10) r2 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r0, &(0x7f0000000080)=@name={0x1e, 0x2, 0x3, {{0x42}, 0x40004}}, 0x10) (async) bind$tipc(r0, &(0x7f0000000080)=@name={0x1e, 0x2, 0x3, {{0x42}, 0x40004}}, 0x10) bind$tipc(r2, &(0x7f00000000c0)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x0, 0xfffffffd}}, 0x10) (async) bind$tipc(r2, &(0x7f00000000c0)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x0, 0xfffffffd}}, 0x10) bind$tipc(r2, &(0x7f0000000100)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x0, 0x2}}, 0x10) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000140)={0x42}, 0x10) bind$tipc(r0, 0x0, 0x0) (async) bind$tipc(r0, 0x0, 0x0) close(r0) socketpair(0x1, 0x1, 0x0, &(0x7f0000000580)) (async) socketpair(0x1, 0x1, 0x0, &(0x7f0000000580)={0xffffffffffffffff}) ioctl$PPPIOCATTACH(0xffffffffffffffff, 0x4004743d, &(0x7f0000000000)) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$XFS_IOC_FSGEOMETRY_V4(r2, 0x8070587c, &(0x7f0000000280)) syz_genetlink_get_family_id$nbd(&(0x7f00000005c0), 0xffffffffffffffff) (async) r5 = syz_genetlink_get_family_id$nbd(&(0x7f00000005c0), 0xffffffffffffffff) sendmsg$NBD_CMD_CONNECT(r4, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000680)={0x48, r5, 0x1, 0x70bd2b, 0x1000, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x9}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r3}}, {0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r3}}]}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x122}]}, 0x48}, 0x1, 0x0, 0x0, 0x8805}, 0x400400c) (async) sendmsg$NBD_CMD_CONNECT(r4, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000680)={0x48, r5, 0x1, 0x70bd2b, 0x1000, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x9}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r3}}, {0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r3}}]}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x122}]}, 0x48}, 0x1, 0x0, 0x0, 0x8805}, 0x400400c) r6 = socket(0x1000000000000010, 0x80802, 0x0) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x1, 0x5, &(0x7f0000000a00)=ANY=[@ANYBLOB="bf16000000000000b70700000100f0ff5070000000000000200000000000c00095000000000000002ba728041598d6fbd30cb599e83d24a3aa81d36b26fb0b71d0e6adfefcf1d8f7faf75e0f226bd99eea7960717142fa9ea4318123741c4a0e168c1886d0d4d94f2f4e345c652fbc16ee988e6e0dc8cedf3ce99fbfbf9b0a4def23d410f6296b32a334388107200759cda9036b4e369a9e152ddcc7f05a5f3c4744aeaccd3641110bec4e9027a0c8055bbfc3a96d2e8910c2c3b35967deabe802f5ab3e89bd6c662ed4048d3b3e22278d00031e5388ee5c867ddd58211d6ececb0cd2b6d357b85a0218ce740068725837074e098ee207d2f73902fbcfcf49822775985bf32d715f5888b24efa000000000000ffffffdf000000000000000000000089a7b9b00000000000000000000000000000b27cf3d1848a54d7132be1ffb0adf9deab29ea3323aa9fdfb52faf449c3bfd09000000b91ab219efdebb7b3de8f67581cf796a1d4223b9ff7ffcad3f6c962b9f292324b7ab7f91a31cf41ab11f12fb1e0a494034127de7c6592df1a6c64d8f20a67745409e011f1264d43e153b3d34899f40159e800ea2474b544035a30b23bcee46762c2093bcc9eae5dff5adbdee3e980026c96f80ee1a74e04bde740750fa4d9aaa705989b8e673e3296e52d337c56abf1128744bab6677fcb78e313841ec309baed0495f06d058a75fa4c81e5c9f42d9383e41d277b10392a912ffaf6f658f3fadd16286744f839c3f128f8f92d0992239eafce5c1b3f97a297c9e49a0c3510ef74080e6d1e0c8a868a353409e34d3e82279637598f37ad380a447483cac394c7bbdcd0e3b1c39b6e00916de48a4e70f03cc4146a77af02c1d4cef5379da860aed8477dfa8ceefb405005c6977c78cdbf37704ec73755539280b064bda154910fe050038ec9e47de89298b7bf4d769ccc18eede00e8ca5457870eb30d211e23ccc8e06cd58b61799257ab55ff413c86ba9affb12ec757c7234c270246c87a901160e6c07bc6cf8809c3a0d46ff7f008000000000ad1e1f493354b2822b98371d000000167d78e65b90eba0768e825972ea3b774a1467c89fa0f82e8440105051e5510a33dcda5e143fbfff161c12ca389cbe4c51b3fa00675cd1b66c5fd9c26a54d43fa050645bd9109b7e7131421c0f39113be7664e08bdd7115c61afcb718cf3c4680b2f6c7a84a4e3344b155cc20f49e298727340e97cdefb40e56e9cfad973347d0de7ba4754ff231a1b033d8f931ba3442b2c7c503f3d0e7ab0e958adb862822e40009995ae166deb9856291a43a6f7eb2e32cefbf46306f2ef79b8d4c2ff030000000000000007b82e6044f643068cd47ae636a5dbe9864a117d27326850a7c3b570863f532c218b10af13d7be94987005088a83880ccab9c99220002af8c5e53d52c83ac3fa7c3a3ee6c08384865b66d2b4dcb5dd9cba16b64ebbbf8702ae12c77e6e34991a225c120a3c950942fe0bc9f2a1a7506d35e5b439edeb7088aeda890cf8a4a6f31ba6d9b8cb098f935bdcbb29fd0f1a342c9eed00000000ab6648a9dea0b6c91996d65da6c24a702a86c814459f3cdaaf99000000000000000000bfb32c826563c518d0ad23bc83ba3f3757210a057eff7615c868bd7d74233da1a3b56d4e04a7ec4792b1c4cffddbbdcfdd23ab5268f1b3d08ebb8ce498cbaaf5aaab812201d1aba3d70471fcd9b466569f3ef72f39d87fcccab514fc02b70be8629c9b73ce7bc4be7f8be71cb7b2d0a4acff8f6abe7dbad64dfa44966945d93c33b038ce0d890f851811e387723a25dda119f64b35e71c5400000000000000000000000000000034c751ebdf3f20a95b817ea3df3d6c0002a41783058e56c70afe8016b3dd9dc7785b36e609f173cc6b893ecd138289709839747837d6a6283b3452c57a5d44cacd363589845637071320921d22c1663964eddec902fc7cc33158bc306d8c3bdae8108a23d2dc96a5cdb518f58832ec0906aaec43659c79c8ad37b0f961f3beaa3e02f7762c5dd633d13b5e487e996597b2ab42c898b7dd8390e13b395aacce4683e55bcfe8c17615257364365fd48bd77da79e52ce9adfe6dca9c42c4d719347f39ef006c2df747ee6adb7cd04faf05c36de72354c64ebaf28a3de18607ebc4b70f50f71dae565749568a23319232dc213342fb472e98c9a412199ce7976bee5eaf40e60cb3fbe8b92dae5008e92d17d05ce74ffffe74ae71d5b8bd43a4e0bf0390335aa489689f5e3a4ac5adca96caab658b43cd499d95d3876c220d147ad1d0e626621d88f1370982f663793cac52ea0d14e595ff1f56427a0a813bb3b84d31d021eeea8faeff25bb66f5940d08a5509a66fc43962bcb2f7415bc38e355e80ec935aa6fe2d74bd475d89449fb46320fee40faff2fd005549fe6a042bd95decfde5e166971935f4cfd9c9e5bfd2d803644f4e5b7e6dc1a7a35df7134e2fad79269bf24bea4eb0213068e3054d9e4a8d1a9eb032cb390e2016d0ce10549728cb4732dc5adab16fa19ac70780b29e079be27c95d3dd2bd91a584c46d84d430fc6ea31ce0ba62fa27be9f6bc435203da7c3a5d68bf4dd4f81cbfaa1c87a15b9272853c9837db930952dca667194b71815a9eb49b495360dcdf31e0e560857d0541a916d6b5469ac1b36babc5a91e1d58925f20d9d5f8a0da3c30711b0d101cabceffbe072be69613ea0003c6e9bb5cd2413c8ddc17cfa319cf7aaeed0ffb07a08f8fb439f709dfe0732fe42192819870bdd87d5f612ade03540a28be446095269d9ea5a60bba1f2462f9921f2a731dbcf1d03964ea1e4f79514914d37877f57617b60fa2b58aa694fcb023024653c4b73efb12a57ffc6f8943262b77be933051e12bd4d768a422ea652d45b04a9c43b5c97fc3edea7002d51a0a74889334ee"], &(0x7f0000001240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000001280), 0x0, 0x10, &(0x7f00000012c0), 0x29}, 0x48) setsockopt$sock_attach_bpf(r6, 0x1, 0x32, &(0x7f0000001300)=r7, 0x4) sendmsg(r6, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001380)=[{&(0x7f00000013c0)="5500000018007fd500fe01b2a4a280930a06000000a843089100fe800c00080008001100080000002d000f009b2c136ef75afb83de448daa72540d8102d2c55327c43ab82286ef1fdd20642383656d4d2449155037", 0x55}], 0x1}, 0x0) sendmsg$nl_generic(r3, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x2c, 0x17, 0x300, 0x70bd2b, 0x25dfdbfb, {0xa}, [@nested={0x4, 0x7e}, @generic="40b9c0a3a02d1b2ad8dec8f967245ef586e9f0"]}, 0x2c}, 0x1, 0x0, 0x0, 0x50}, 0x20000054) (async) sendmsg$nl_generic(r3, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x2c, 0x17, 0x300, 0x70bd2b, 0x25dfdbfb, {0xa}, [@nested={0x4, 0x7e}, @generic="40b9c0a3a02d1b2ad8dec8f967245ef586e9f0"]}, 0x2c}, 0x1, 0x0, 0x0, 0x50}, 0x20000054) 220.788µs ago: executing program 3 (id=12940): ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000440)={'syzkaller1\x00', 0xc201}) r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @broadcast}, 0x10) setsockopt$inet_tcp_int(r0, 0x6, 0x2, &(0x7f00000001c0)=0x8a1, 0x4) socket$nl_netfilter(0x10, 0x3, 0xc) setsockopt$inet_mtu(r0, 0x0, 0xa, &(0x7f0000000300)=0x3, 0x4) connect$inet(r0, &(0x7f0000000340)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x1f}}, 0x10) sendto$inet(r0, &(0x7f0000000380), 0xffffffffffffff94, 0x10000000, 0x0, 0x0) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f00000003c0)={0x1, &(0x7f0000000540)=[{0x6, 0x7, 0x0, 0x8001}]}, 0x10) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f00000005c0)={0x2, 0xffff, @remote}, 0x10, 0x0, 0x0, 0x0, 0xe}, 0x20008024) recvfrom$inet(r0, &(0x7f00000009c0)=""/8, 0xfffffffffffffd0b, 0x720, 0x0, 0xfffffffffffffd25) bind$vsock_stream(0xffffffffffffffff, 0x0, 0x0) accept4$unix(0xffffffffffffffff, 0x0, 0x0, 0x800) socket$kcm(0x2, 0x3, 0x2) socket$kcm(0x2, 0x3, 0x2) 0s ago: executing program 5 (id=12941): mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x8, 0x32, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x18, 0xf, &(0x7f00000002c0)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x8c, 0x0, 0x0, 0x0, 0xec5}, {{0x18, 0x1, 0x1, 0x0, r0}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xfeff}, {0x85, 0x0, 0x0, 0x86}, {0x7, 0x1, 0xb, 0x9, 0x0, 0x20}}, {{0x5, 0x0, 0x5, 0x9, 0x0, 0x1, 0xffffffff}}, [], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x3}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000340)='GPL\x00', 0xf, 0x1002, &(0x7f00000005c0)=""/4098, 0x41100, 0x4b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffa}, 0x94) (fail_nth: 84) kernel console output (not intermixed with test programs): purge local tt entries to fit new maximum table response size (-320) [ 1670.502825][T31295] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum table response size (-320) [ 1670.504483][T31295] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum table response size (-320) [ 1670.692525][T31295] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1670.715582][T31295] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1670.819424][T23442] netlink: 'syz.2.12395': attribute type 1 has an invalid length. [ 1670.853625][T31295] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1670.855795][T31295] batman_adv: batadv0: Interface deactivated: dummy0 [ 1670.855818][T31295] batman_adv: batadv0: Removing interface: dummy0 [ 1670.875568][T31295] veth0_macvtap: left promiscuous mode [ 1670.875941][T31295] veth1_vlan: left promiscuous mode [ 1670.876123][T31295] veth0_vlan: left promiscuous mode [ 1670.990145][T23445] netlink: 4 bytes leftover after parsing attributes in process `syz.2.12395'. [ 1671.198025][T29247] Bluetooth: hci1: command tx timeout [ 1671.232229][T23453] netlink: 28 bytes leftover after parsing attributes in process `syz.1.12396'. [ 1671.629655][T31295] team0 (unregistering): Port device team_slave_1 removed [ 1671.648659][T23441] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1671.701902][T31295] team0 (unregistering): Port device team_slave_0 removed [ 1672.132564][T23442] 8021q: adding VLAN 0 to HW filter on device bond2 [ 1672.488945][T23490] FAULT_INJECTION: forcing a failure. [ 1672.488945][T23490] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1672.488984][T23490] CPU: 1 UID: 0 PID: 23490 Comm: syz.4.12400 Not tainted syzkaller #0 PREEMPT(full) [ 1672.489010][T23490] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 1672.489024][T23490] Call Trace: [ 1672.489033][T23490] [ 1672.489044][T23490] dump_stack_lvl+0xe8/0x150 [ 1672.489087][T23490] should_fail_ex+0x3eb/0x540 [ 1672.489121][T23490] _copy_to_user+0x31/0xb0 [ 1672.489154][T23490] bpf_verifier_vlog+0x496/0x900 [ 1672.489195][T23490] verbose+0x11d/0x1a0 [ 1672.489235][T23490] ? __pfx_verbose+0x10/0x10 [ 1672.489271][T23490] ? lock_acquire+0x115/0x350 [ 1672.489309][T23490] print_bpf_insn+0x1b81/0x2a90 [ 1672.489338][T23490] ? __pfx_verbose+0x10/0x10 [ 1672.489369][T23490] ? __might_fault+0xaf/0x130 [ 1672.489395][T23490] ? __pfx_print_bpf_insn+0x10/0x10 [ 1672.489419][T23490] ? _copy_to_user+0x8a/0xb0 [ 1672.489447][T23490] ? bpf_verifier_vlog+0x58d/0x900 [ 1672.489483][T23490] ? bpf_verifier_log_write+0x11d/0x1a0 [ 1672.489513][T23490] bpf_verbose_insn+0xcb/0x130 [ 1672.489545][T23490] ? __pfx_bpf_verbose_insn+0x10/0x10 [ 1672.489576][T23490] ? __pfx_verbose+0x10/0x10 [ 1672.489604][T23490] ? __pfx_bpf_disasm_kfunc_name+0x10/0x10 [ 1672.489638][T23490] ? record_arg_access+0x14f/0xa80 [ 1672.489677][T23490] analyze_subprog+0x649d/0xb150 [ 1672.489765][T23490] ? __pfx_analyze_subprog+0x10/0x10 [ 1672.489794][T23490] ? kasan_save_track+0x4f/0x80 [ 1672.489823][T23490] ? kasan_save_track+0x3e/0x80 [ 1672.489851][T23490] ? __kasan_kmalloc+0x93/0xb0 [ 1672.489880][T23490] ? __kvmalloc_node_noprof+0x50a/0x820 [ 1672.489910][T23490] ? call_instance+0x263/0x560 [ 1672.489936][T23490] ? bpf_compute_subprog_arg_access+0x2cb/0x15c0 [ 1672.489965][T23490] ? bpf_compute_live_registers+0x10b0/0x1df0 [ 1672.490003][T23490] ? bpf_check+0x2d0b/0x34e0 [ 1672.490025][T23490] ? bpf_prog_load+0x14da/0x1c60 [ 1672.490047][T23490] ? __sys_bpf+0xd86/0xe00 [ 1672.490065][T23490] ? __x64_sys_bpf+0xba/0xd0 [ 1672.490096][T23490] ? mas_next_node+0xa72/0xe50 [ 1672.490119][T23490] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1672.490186][T23490] ? call_instance+0x263/0x560 [ 1672.490214][T23490] ? rcu_is_watching+0x16/0xb0 [ 1672.490247][T23490] ? call_instance+0x263/0x560 [ 1672.490275][T23490] ? trace_kmalloc+0x2a/0xf0 [ 1672.490309][T23490] ? call_instance+0x263/0x560 [ 1672.490337][T23490] ? __kvmalloc_node_noprof+0x52a/0x820 [ 1672.490370][T23490] ? __kvmalloc_node_noprof+0x340/0x820 [ 1672.490400][T23490] ? call_instance+0x263/0x560 [ 1672.490428][T23490] ? call_instance+0x263/0x560 [ 1672.490475][T23490] bpf_compute_subprog_arg_access+0x2f1/0x15c0 [ 1672.490532][T23490] ? __pfx_bpf_compute_subprog_arg_access+0x10/0x10 [ 1672.490569][T23490] ? __kvmalloc_node_noprof+0x340/0x820 [ 1672.490599][T23490] ? bpf_compute_live_registers+0x142/0x1df0 [ 1672.490629][T23490] ? bpf_compute_live_registers+0x142/0x1df0 [ 1672.490669][T23490] bpf_compute_live_registers+0x10b0/0x1df0 [ 1672.490724][T23490] ? __pfx_bpf_compute_live_registers+0x10/0x10 [ 1672.490767][T23490] bpf_check+0x2d0b/0x34e0 [ 1672.490804][T23490] ? ktime_get_with_offset+0x93/0x2d0 [ 1672.490836][T23490] ? ktime_get_with_offset+0x93/0x2d0 [ 1672.490866][T23490] ? __pfx_bpf_check+0x10/0x10 [ 1672.490894][T23490] ? bpf_obj_name_cpy+0x194/0x1e0 [ 1672.490928][T23490] bpf_prog_load+0x14da/0x1c60 [ 1672.490965][T23490] ? __pfx_bpf_prog_load+0x10/0x10 [ 1672.491013][T23490] ? __might_fault+0xaf/0x130 [ 1672.491045][T23490] __sys_bpf+0xd86/0xe00 [ 1672.491078][T23490] ? __pfx___sys_bpf+0x10/0x10 [ 1672.491114][T23490] ? __fget_files+0x2a/0x420 [ 1672.491162][T23490] ? ksys_write+0x242/0x270 [ 1672.491197][T23490] ? __pfx_ksys_write+0x10/0x10 [ 1672.491234][T23490] __x64_sys_bpf+0xba/0xd0 [ 1672.491270][T23490] do_syscall_64+0x166/0x520 [ 1672.491300][T23490] ? trace_irq_disable+0x3b/0x140 [ 1672.491330][T23490] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1672.491354][T23490] ? clear_bhb_loop+0x70/0xc0 [ 1672.491381][T23490] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1672.491404][T23490] RIP: 0033:0x7fd0925a8f19 [ 1672.491425][T23490] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1672.491445][T23490] RSP: 002b:00007fd0933a8028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1672.491468][T23490] RAX: ffffffffffffffda RBX: 00007fd092825fa0 RCX: 00007fd0925a8f19 [ 1672.491485][T23490] RDX: 0000000000000094 RSI: 0000200000000180 RDI: 0000000000000005 [ 1672.491500][T23490] RBP: 00007fd0933a8090 R08: 0000000000000000 R09: 0000000000000000 [ 1672.491514][T23490] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1672.491527][T23490] R13: 00007fd092826038 R14: 00007fd092825fa0 R15: 00007ffc3c595728 [ 1672.491564][T23490] [ 1673.054927][T23487] tipc: Started in network mode [ 1673.054964][T23487] tipc: Node identity 56cbfe46ee68, cluster identity 4711 [ 1673.055130][T23487] tipc: Enabled bearer , priority 0 [ 1673.193470][T23485] tipc: Disabling bearer [ 1673.277828][T29247] Bluetooth: hci1: command tx timeout [ 1673.323581][T23506] Bluetooth: MGMT ver 1.23 [ 1673.377459][T31295] IPVS: stop unused estimator thread 0... [ 1673.861816][T23525] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for gretap1 [ 1673.864412][T23525] batman_adv: batadv0: Adding interface: gretap1 [ 1673.864432][T23525] batman_adv: batadv0: The MTU of interface gretap1 is too small (1462) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1673.864477][T23525] batman_adv: batadv0: Interface activated: gretap1 [ 1674.441850][T23541] netlink: 'syz.2.12407': attribute type 1 has an invalid length. [ 1674.672025][T23551] netlink: 4 bytes leftover after parsing attributes in process `syz.2.12407'. [ 1674.711596][T23541] 8021q: adding VLAN 0 to HW filter on device bond3 [ 1674.963353][T23561] FAULT_INJECTION: forcing a failure. [ 1674.963353][T23561] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1674.963383][T23561] CPU: 1 UID: 0 PID: 23561 Comm: syz.1.12410 Not tainted syzkaller #0 PREEMPT(full) [ 1674.963404][T23561] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 1674.963415][T23561] Call Trace: [ 1674.963423][T23561] [ 1674.963432][T23561] dump_stack_lvl+0xe8/0x150 [ 1674.963467][T23561] should_fail_ex+0x3eb/0x540 [ 1674.963497][T23561] _copy_to_user+0x31/0xb0 [ 1674.963529][T23561] bpf_verifier_vlog+0x496/0x900 [ 1674.963563][T23561] bpf_verifier_log_write+0x11d/0x1a0 [ 1674.963588][T23561] ? __pfx_bpf_verifier_log_write+0x10/0x10 [ 1674.963610][T23561] ? record_arg_access+0x14f/0xa80 [ 1674.963641][T23561] analyze_subprog+0x648d/0xb150 [ 1674.963709][T23561] ? __pfx_analyze_subprog+0x10/0x10 [ 1674.963733][T23561] ? kasan_save_track+0x4f/0x80 [ 1674.963756][T23561] ? kasan_save_track+0x3e/0x80 [ 1674.963783][T23561] ? __kasan_kmalloc+0x93/0xb0 [ 1674.963815][T23561] ? __kvmalloc_node_noprof+0x50a/0x820 [ 1674.963838][T23561] ? call_instance+0x263/0x560 [ 1674.963860][T23561] ? bpf_compute_subprog_arg_access+0x2cb/0x15c0 [ 1674.963884][T23561] ? bpf_compute_live_registers+0x10b0/0x1df0 [ 1674.963907][T23561] ? bpf_check+0x2d0b/0x34e0 [ 1674.963926][T23561] ? bpf_prog_load+0x14da/0x1c60 [ 1674.963942][T23561] ? __sys_bpf+0xd86/0xe00 [ 1674.963957][T23561] ? __x64_sys_bpf+0xba/0xd0 [ 1674.963981][T23561] ? mas_next_node+0xa72/0xe50 [ 1674.964000][T23561] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1674.964053][T23561] ? call_instance+0x263/0x560 [ 1674.964077][T23561] ? rcu_is_watching+0x16/0xb0 [ 1674.964107][T23561] ? call_instance+0x263/0x560 [ 1674.964130][T23561] ? trace_kmalloc+0x2a/0xf0 [ 1674.964156][T23561] ? call_instance+0x263/0x560 [ 1674.964182][T23561] ? __kvmalloc_node_noprof+0x52a/0x820 [ 1674.964208][T23561] ? __kvmalloc_node_noprof+0x340/0x820 [ 1674.964231][T23561] ? call_instance+0x263/0x560 [ 1674.964251][T23561] ? call_instance+0x263/0x560 [ 1674.964287][T23561] bpf_compute_subprog_arg_access+0x2f1/0x15c0 [ 1674.964335][T23561] ? __pfx_bpf_compute_subprog_arg_access+0x10/0x10 [ 1674.964366][T23561] ? __kvmalloc_node_noprof+0x340/0x820 [ 1674.964391][T23561] ? bpf_compute_live_registers+0x142/0x1df0 [ 1674.964413][T23561] ? bpf_compute_live_registers+0x142/0x1df0 [ 1674.964443][T23561] bpf_compute_live_registers+0x10b0/0x1df0 [ 1674.964490][T23561] ? __pfx_bpf_compute_live_registers+0x10/0x10 [ 1674.964527][T23561] bpf_check+0x2d0b/0x34e0 [ 1674.964559][T23561] ? ktime_get_with_offset+0x93/0x2d0 [ 1674.964587][T23561] ? ktime_get_with_offset+0x93/0x2d0 [ 1674.964612][T23561] ? __pfx_bpf_check+0x10/0x10 [ 1674.964635][T23561] ? bpf_obj_name_cpy+0x194/0x1e0 [ 1674.964667][T23561] bpf_prog_load+0x14da/0x1c60 [ 1674.964698][T23561] ? __pfx_bpf_prog_load+0x10/0x10 [ 1674.964734][T23561] ? __might_fault+0xaf/0x130 [ 1674.964766][T23561] __sys_bpf+0xd86/0xe00 [ 1674.964808][T23561] ? __pfx___sys_bpf+0x10/0x10 [ 1674.964844][T23561] ? __fget_files+0x2a/0x420 [ 1674.964893][T23561] ? ksys_write+0x242/0x270 [ 1674.964928][T23561] ? __pfx_ksys_write+0x10/0x10 [ 1674.964964][T23561] __x64_sys_bpf+0xba/0xd0 [ 1674.964999][T23561] do_syscall_64+0x166/0x520 [ 1674.965028][T23561] ? trace_irq_disable+0x3b/0x140 [ 1674.965059][T23561] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1674.965083][T23561] ? clear_bhb_loop+0x70/0xc0 [ 1674.965112][T23561] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1674.965134][T23561] RIP: 0033:0x7ffbe6da8f19 [ 1674.965157][T23561] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1674.965177][T23561] RSP: 002b:00007ffbe7c9f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1674.965202][T23561] RAX: ffffffffffffffda RBX: 00007ffbe7025fa0 RCX: 00007ffbe6da8f19 [ 1674.965219][T23561] RDX: 0000000000000094 RSI: 0000200000000180 RDI: 0000000000000005 [ 1674.965234][T23561] RBP: 00007ffbe7c9f090 R08: 0000000000000000 R09: 0000000000000000 [ 1674.965248][T23561] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1674.965261][T23561] R13: 00007ffbe7026038 R14: 00007ffbe7025fa0 R15: 00007ffc3f3b3428 [ 1674.965297][T23561] [ 1675.242043][T23539] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1675.351273][T31295] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1675.367119][T29247] Bluetooth: hci0: Opcode 0x0c13 failed: -110 [ 1675.369205][T29247] Bluetooth: hci0: command 0x0c13 tx timeout [ 1675.482797][T23321] bridge0: port 1(bridge_slave_0) entered blocking state [ 1675.482875][T23321] bridge0: port 1(bridge_slave_0) entered disabled state [ 1675.483005][T23321] bridge_slave_0: entered allmulticast mode [ 1675.491102][T23321] bridge_slave_0: entered promiscuous mode [ 1675.551330][T23541] mac80211_hwsim hwsim87 wlan1: entered promiscuous mode [ 1675.597446][T23541] bond3: (slave wlan1): Enslaving as an active interface with a down link [ 1675.611062][T23321] bridge0: port 2(bridge_slave_1) entered blocking state [ 1675.611918][T23321] bridge0: port 2(bridge_slave_1) entered disabled state [ 1675.615728][T23321] bridge_slave_1: entered allmulticast mode [ 1675.629746][T23321] bridge_slave_1: entered promiscuous mode [ 1675.848410][T31295] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1675.907490][T23321] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1675.924184][T23321] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1675.952911][T23129] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1676.080151][T31295] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1676.124373][T23321] team0: Port device team_slave_0 added [ 1676.148032][T23321] team0: Port device team_slave_1 added [ 1676.307968][T23321] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1676.307988][T23321] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1676.308018][T23321] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1676.405469][T31295] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1676.426013][T23321] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1676.426028][T23321] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1676.426049][T23321] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1676.723853][T23321] hsr_slave_0: entered promiscuous mode [ 1676.730813][T23321] hsr_slave_1: entered promiscuous mode [ 1676.740061][T23321] debugfs: 'hsr0' already exists in 'hsr' [ 1676.740084][T23321] Cannot create hsr debugfs directory [ 1677.017247][T23613] netlink: 'syz.1.12422': attribute type 1 has an invalid length. [ 1677.025925][T23129] veth0_vlan: entered promiscuous mode [ 1677.062352][T23601] netlink: 24 bytes leftover after parsing attributes in process `syz.2.12418'. [ 1677.084883][T23613] 8021q: adding VLAN 0 to HW filter on device bond3 [ 1677.123204][T23129] veth1_vlan: entered promiscuous mode [ 1677.136301][T23613] netlink: 4 bytes leftover after parsing attributes in process `syz.1.12422'. [ 1677.356095][T23617] mac80211_hwsim hwsim83 wlan1: entered promiscuous mode [ 1677.383879][T23617] bond3: (slave wlan1): Enslaving as an active interface with a down link [ 1677.428674][T23611] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1677.936451][T31295] bond0 (unregistering): Released all slaves [ 1678.145820][T31295] tipc: Left network mode [ 1678.433223][T23129] veth0_macvtap: entered promiscuous mode [ 1678.446584][T23644] tipc: Enabled bearer , priority 0 [ 1678.499883][T23643] tipc: Disabling bearer [ 1678.513993][T23129] veth1_macvtap: entered promiscuous mode [ 1678.726312][T23321] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 1678.745545][T23321] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1678.759271][T23321] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 1678.790848][T23321] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1678.791928][T23321] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 1678.793515][T23660] netlink: 8 bytes leftover after parsing attributes in process `syz.1.12432'. [ 1678.828395][T23321] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1678.878708][T23129] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1678.878804][T23321] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 1678.993270][T23321] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1679.070577][T23129] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1679.165404][T23671] netlink: 'syz.2.12435': attribute type 1 has an invalid length. [ 1679.358419][T23676] netlink: 4 bytes leftover after parsing attributes in process `syz.2.12435'. [ 1679.401928][T23671] 8021q: adding VLAN 0 to HW filter on device bond4 [ 1679.417413][ T9442] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1679.417468][ T9442] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1679.417509][ T9442] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1679.417548][ T9442] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1679.814521][T23671] bond3: (slave wlan1): Releasing active interface [ 1679.867688][T23671] bond4: (slave wlan1): Enslaving as an active interface with a down link [ 1679.905071][T23670] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1680.192805][ T1372] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1680.192831][ T1372] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1680.373051][T31295] hsr_slave_0: left promiscuous mode [ 1680.385039][T31295] hsr_slave_1: left promiscuous mode [ 1680.413758][T31295] veth1_macvtap: left promiscuous mode [ 1680.413804][T31295] veth0_macvtap: left promiscuous mode [ 1680.414776][T31295] veth1_vlan: left promiscuous mode [ 1680.901475][T31295] team0 (unregistering): Port device vlan0 removed [ 1681.291428][ T38] smc: removing ib device syz0 [ 1681.345656][ T38] smbdirect: ib_dev[syz0] removed [ 1681.404233][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1681.404260][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1681.554018][ T5297] 8021q: adding VLAN 0 to HW filter on device eth3 [ 1681.565099][T24994] infiniband syz0: ib_query_port failed (-19) [ 1681.773875][T23321] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1681.917286][T23321] 8021q: adding VLAN 0 to HW filter on device team0 [ 1681.979574][ T1368] bridge0: port 1(bridge_slave_0) entered blocking state [ 1681.979692][ T1368] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1682.041166][ T1373] bridge0: port 2(bridge_slave_1) entered blocking state [ 1682.041292][ T1373] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1682.374492][T23729] netlink: 16 bytes leftover after parsing attributes in process `syz.2.12446'. [ 1682.672086][T23747] FAULT_INJECTION: forcing a failure. [ 1682.672086][T23747] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1682.672118][T23747] CPU: 0 UID: 0 PID: 23747 Comm: syz.1.12450 Not tainted syzkaller #0 PREEMPT(full) [ 1682.672145][T23747] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 1682.672159][T23747] Call Trace: [ 1682.672168][T23747] [ 1682.672179][T23747] dump_stack_lvl+0xe8/0x150 [ 1682.672221][T23747] should_fail_ex+0x3eb/0x540 [ 1682.672256][T23747] _copy_to_user+0x31/0xb0 [ 1682.672289][T23747] bpf_verifier_vlog+0x496/0x900 [ 1682.672334][T23747] bpf_verifier_log_write+0x11d/0x1a0 [ 1682.672369][T23747] ? __pfx_bpf_verifier_log_write+0x10/0x10 [ 1682.672399][T23747] ? record_arg_access+0x14f/0xa80 [ 1682.672442][T23747] analyze_subprog+0x7888/0xb150 [ 1682.672534][T23747] ? __pfx_analyze_subprog+0x10/0x10 [ 1682.672565][T23747] ? kasan_save_track+0x4f/0x80 [ 1682.672597][T23747] ? kasan_save_track+0x3e/0x80 [ 1682.672634][T23747] ? __kasan_kmalloc+0x93/0xb0 [ 1682.672665][T23747] ? __kvmalloc_node_noprof+0x50a/0x820 [ 1682.672696][T23747] ? call_instance+0x263/0x560 [ 1682.672770][T23747] ? bpf_compute_subprog_arg_access+0x2cb/0x15c0 [ 1682.672802][T23747] ? bpf_compute_live_registers+0x10b0/0x1df0 [ 1682.672832][T23747] ? bpf_check+0x2d0b/0x34e0 [ 1682.672855][T23747] ? bpf_prog_load+0x14da/0x1c60 [ 1682.672877][T23747] ? __sys_bpf+0xd86/0xe00 [ 1682.672896][T23747] ? __x64_sys_bpf+0xba/0xd0 [ 1682.672925][T23747] ? mas_next_node+0xa72/0xe50 [ 1682.672948][T23747] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1682.673007][T23747] ? call_instance+0x263/0x560 [ 1682.673035][T23747] ? rcu_is_watching+0x16/0xb0 [ 1682.673067][T23747] ? call_instance+0x263/0x560 [ 1682.673093][T23747] ? trace_kmalloc+0x2a/0xf0 [ 1682.673123][T23747] ? call_instance+0x263/0x560 [ 1682.673150][T23747] ? __kvmalloc_node_noprof+0x52a/0x820 [ 1682.673181][T23747] ? __kvmalloc_node_noprof+0x340/0x820 [ 1682.673210][T23747] ? call_instance+0x263/0x560 [ 1682.673236][T23747] ? call_instance+0x263/0x560 [ 1682.673284][T23747] bpf_compute_subprog_arg_access+0x2f1/0x15c0 [ 1682.673339][T23747] ? __pfx_bpf_compute_subprog_arg_access+0x10/0x10 [ 1682.673374][T23747] ? __kvmalloc_node_noprof+0x340/0x820 [ 1682.673405][T23747] ? bpf_compute_live_registers+0x142/0x1df0 [ 1682.673433][T23747] ? bpf_compute_live_registers+0x142/0x1df0 [ 1682.673471][T23747] bpf_compute_live_registers+0x10b0/0x1df0 [ 1682.673524][T23747] ? __pfx_bpf_compute_live_registers+0x10/0x10 [ 1682.673567][T23747] bpf_check+0x2d0b/0x34e0 [ 1682.673605][T23747] ? ktime_get_with_offset+0x93/0x2d0 [ 1682.673637][T23747] ? ktime_get_with_offset+0x93/0x2d0 [ 1682.673668][T23747] ? __pfx_bpf_check+0x10/0x10 [ 1682.673696][T23747] ? bpf_obj_name_cpy+0x194/0x1e0 [ 1682.673739][T23747] bpf_prog_load+0x14da/0x1c60 [ 1682.673777][T23747] ? __pfx_bpf_prog_load+0x10/0x10 [ 1682.673814][T23747] ? __might_fault+0xaf/0x130 [ 1682.673847][T23747] __sys_bpf+0xd86/0xe00 [ 1682.673879][T23747] ? __pfx___sys_bpf+0x10/0x10 [ 1682.673915][T23747] ? __fget_files+0x2a/0x420 [ 1682.673963][T23747] ? ksys_write+0x242/0x270 [ 1682.673998][T23747] ? __pfx_ksys_write+0x10/0x10 [ 1682.674035][T23747] __x64_sys_bpf+0xba/0xd0 [ 1682.674072][T23747] do_syscall_64+0x166/0x520 [ 1682.674101][T23747] ? trace_irq_disable+0x3b/0x140 [ 1682.674133][T23747] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1682.674157][T23747] ? clear_bhb_loop+0x70/0xc0 [ 1682.674185][T23747] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1682.674208][T23747] RIP: 0033:0x7ffbe6da8f19 [ 1682.674230][T23747] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1682.674250][T23747] RSP: 002b:00007ffbe7c9f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1682.674275][T23747] RAX: ffffffffffffffda RBX: 00007ffbe7025fa0 RCX: 00007ffbe6da8f19 [ 1682.674292][T23747] RDX: 0000000000000094 RSI: 0000200000000180 RDI: 0000000000000005 [ 1682.674308][T23747] RBP: 00007ffbe7c9f090 R08: 0000000000000000 R09: 0000000000000000 [ 1682.674322][T23747] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1682.674337][T23747] R13: 00007ffbe7026038 R14: 00007ffbe7025fa0 R15: 00007ffc3f3b3428 [ 1682.674373][T23747] [ 1683.077127][T23752] net_ratelimit: 31 callbacks suppressed [ 1683.077180][T23752] ip_tables: iptables: counters copy to user failed while replacing table [ 1683.388870][T23765] netlink: 8 bytes leftover after parsing attributes in process `syz.1.12452'. [ 1683.462736][T23758] netlink: 16 bytes leftover after parsing attributes in process `syz.3.12342'. [ 1683.564258][T23771] netlink: 'syz.3.12453': attribute type 2 has an invalid length. [ 1683.564290][T23771] nbd: illegal input index -2130444284 [ 1683.734695][T23765] bond4: up delay (10) is not a multiple of miimon (7), value rounded to 7 ms [ 1683.812713][T23765] bond4 (unregistering): Released all slaves [ 1684.187009][T23776] tipc: Started in network mode [ 1684.187045][T23776] tipc: Node identity be47c6f74ef6, cluster identity 4711 [ 1684.187214][T23776] tipc: Enabled bearer , priority 0 [ 1684.483303][T23773] tipc: Disabling bearer [ 1684.525200][T23797] FAULT_INJECTION: forcing a failure. [ 1684.525200][T23797] name failslab, interval 1, probability 0, space 0, times 0 [ 1684.525237][T23797] CPU: 1 UID: 0 PID: 23797 Comm: syz.2.12457 Not tainted syzkaller #0 PREEMPT(full) [ 1684.525263][T23797] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 1684.525278][T23797] Call Trace: [ 1684.525287][T23797] [ 1684.525297][T23797] dump_stack_lvl+0xe8/0x150 [ 1684.525339][T23797] should_fail_ex+0x3eb/0x540 [ 1684.525374][T23797] should_failslab+0xa8/0x100 [ 1684.525399][T23797] __kvmalloc_node_noprof+0x171/0x820 [ 1684.525435][T23797] ? __kvmalloc_node_noprof+0x340/0x820 [ 1684.525467][T23797] ? bpf_compute_postorder+0x179/0x9a0 [ 1684.525499][T23797] ? bpf_compute_postorder+0x179/0x9a0 [ 1684.525538][T23797] bpf_compute_postorder+0x179/0x9a0 [ 1684.525572][T23797] ? __pfx_resolve_func_ptrs+0x10/0x10 [ 1684.525611][T23797] bpf_check+0x298f/0x34e0 [ 1684.525649][T23797] ? ktime_get_with_offset+0x93/0x2d0 [ 1684.525681][T23797] ? ktime_get_with_offset+0x93/0x2d0 [ 1684.525713][T23797] ? __pfx_bpf_check+0x10/0x10 [ 1684.525768][T23797] ? bpf_obj_name_cpy+0x194/0x1e0 [ 1684.525803][T23797] bpf_prog_load+0x14da/0x1c60 [ 1684.525841][T23797] ? __pfx_bpf_prog_load+0x10/0x10 [ 1684.525884][T23797] ? __might_fault+0xaf/0x130 [ 1684.525917][T23797] __sys_bpf+0xd86/0xe00 [ 1684.525949][T23797] ? __pfx___sys_bpf+0x10/0x10 [ 1684.525986][T23797] ? __fget_files+0x2a/0x420 [ 1684.526035][T23797] ? ksys_write+0x242/0x270 [ 1684.526071][T23797] ? __pfx_ksys_write+0x10/0x10 [ 1684.526109][T23797] __x64_sys_bpf+0xba/0xd0 [ 1684.526146][T23797] do_syscall_64+0x166/0x520 [ 1684.526176][T23797] ? trace_irq_disable+0x3b/0x140 [ 1684.526207][T23797] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1684.526230][T23797] ? clear_bhb_loop+0x70/0xc0 [ 1684.526259][T23797] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1684.526282][T23797] RIP: 0033:0x7f55c61a8f19 [ 1684.526303][T23797] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1684.526323][T23797] RSP: 002b:00007f55c6fee028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1684.526348][T23797] RAX: ffffffffffffffda RBX: 00007f55c6425fa0 RCX: 00007f55c61a8f19 [ 1684.526365][T23797] RDX: 0000000000000094 RSI: 0000200000000140 RDI: 0000000000000005 [ 1684.526379][T23797] RBP: 00007f55c6fee090 R08: 0000000000000000 R09: 0000000000000000 [ 1684.526393][T23797] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1684.526407][T23797] R13: 00007f55c6426038 R14: 00007f55c6425fa0 R15: 00007fffd45187a8 [ 1684.526441][T23797] [ 1685.065622][ T5297] 8021q: adding VLAN 0 to HW filter on device eth4 [ 1685.587126][T23827] netlink: 44 bytes leftover after parsing attributes in process `syz.1.12467'. [ 1685.587156][T23827] netlink: 43 bytes leftover after parsing attributes in process `syz.1.12467'. [ 1685.587173][T23827] netlink: 'syz.1.12467': attribute type 6 has an invalid length. [ 1685.587187][T23827] netlink: 'syz.1.12467': attribute type 5 has an invalid length. [ 1685.587201][T23827] netlink: 43 bytes leftover after parsing attributes in process `syz.1.12467'. [ 1685.675193][T23321] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1686.040612][T23841] tipc: Enabled bearer , priority 0 [ 1686.828927][T23321] veth0_vlan: entered promiscuous mode [ 1686.865504][T23321] veth1_vlan: entered promiscuous mode [ 1687.004795][T23321] veth0_macvtap: entered promiscuous mode [ 1687.024033][T23321] veth1_macvtap: entered promiscuous mode [ 1687.065345][T23321] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1687.138539][T23321] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1687.161763][T24996] tipc: Node number set to 4038182647 [ 1687.200556][ T13] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1687.217983][ T1366] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1687.218580][ T1366] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1687.219287][ T1366] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1688.147817][ T5297] 8021q: adding VLAN 0 to HW filter on device eth5 [ 1688.520959][T23839] tipc: Disabling bearer [ 1689.312875][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1689.312900][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1689.723870][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1689.723895][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1689.976066][T23916] FAULT_INJECTION: forcing a failure. [ 1689.976066][T23916] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1689.976100][T23916] CPU: 1 UID: 0 PID: 23916 Comm: syz.3.12482 Not tainted syzkaller #0 PREEMPT(full) [ 1689.976126][T23916] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 1689.976140][T23916] Call Trace: [ 1689.976149][T23916] [ 1689.976159][T23916] dump_stack_lvl+0xe8/0x150 [ 1689.976201][T23916] should_fail_ex+0x3eb/0x540 [ 1689.976236][T23916] _copy_to_user+0x31/0xb0 [ 1689.976268][T23916] bpf_verifier_vlog+0x3a2/0x900 [ 1689.976308][T23916] verbose+0x11d/0x1a0 [ 1689.976349][T23916] ? rcu_is_watching+0x16/0xb0 [ 1689.976389][T23916] ? __pfx_verbose+0x10/0x10 [ 1689.976418][T23916] ? sort_subprogs_topo+0xf4/0x1130 [ 1689.976447][T23916] ? __kvmalloc_node_noprof+0x340/0x820 [ 1689.976481][T23916] ? sort_subprogs_topo+0xf4/0x1130 [ 1689.976514][T23916] sort_subprogs_topo+0xfbf/0x1130 [ 1689.976565][T23916] bpf_check+0x2c4c/0x34e0 [ 1689.976602][T23916] ? ktime_get_with_offset+0x93/0x2d0 [ 1689.976634][T23916] ? ktime_get_with_offset+0x93/0x2d0 [ 1689.976666][T23916] ? __pfx_bpf_check+0x10/0x10 [ 1689.976694][T23916] ? bpf_obj_name_cpy+0x194/0x1e0 [ 1689.976728][T23916] bpf_prog_load+0x14da/0x1c60 [ 1689.976764][T23916] ? __pfx_bpf_prog_load+0x10/0x10 [ 1689.976806][T23916] ? __might_fault+0xaf/0x130 [ 1689.976839][T23916] __sys_bpf+0xd86/0xe00 [ 1689.976871][T23916] ? __pfx___sys_bpf+0x10/0x10 [ 1689.976907][T23916] ? __fget_files+0x2a/0x420 [ 1689.976956][T23916] ? ksys_write+0x242/0x270 [ 1689.976990][T23916] ? __pfx_ksys_write+0x10/0x10 [ 1689.977028][T23916] __x64_sys_bpf+0xba/0xd0 [ 1689.977065][T23916] do_syscall_64+0x166/0x520 [ 1689.977094][T23916] ? trace_irq_disable+0x3b/0x140 [ 1689.977125][T23916] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1689.977149][T23916] ? clear_bhb_loop+0x70/0xc0 [ 1689.977177][T23916] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1689.977199][T23916] RIP: 0033:0x7f3e361a8f19 [ 1689.977221][T23916] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1689.977240][T23916] RSP: 002b:00007f3e36fae028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1689.977264][T23916] RAX: ffffffffffffffda RBX: 00007f3e36425fa0 RCX: 00007f3e361a8f19 [ 1689.977281][T23916] RDX: 0000000000000094 RSI: 0000200000000140 RDI: 0000000000000005 [ 1689.977296][T23916] RBP: 00007f3e36fae090 R08: 0000000000000000 R09: 0000000000000000 [ 1689.977309][T23916] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1689.977323][T23916] R13: 00007f3e36426038 R14: 00007f3e36425fa0 R15: 00007ffede515788 [ 1689.977367][T23916] [ 1691.400879][ T5297] 8021q: adding VLAN 0 to HW filter on device eth6 [ 1691.674360][T23964] netlink: 76 bytes leftover after parsing attributes in process `syz.2.12494'. [ 1691.696398][T23964] ip_tables: iptables: counters copy to user failed while replacing table [ 1691.897275][T23971] netlink: 8 bytes leftover after parsing attributes in process `syz.3.12496'. [ 1691.897675][T23971] 8021q: VLANs not supported on vcan0 [ 1691.994964][T23972] netlink: 'syz.4.12497': attribute type 10 has an invalid length. [ 1691.994987][T23972] netlink: 2 bytes leftover after parsing attributes in process `syz.4.12497'. [ 1691.995233][T23972] bridge0: port 2(bridge_slave_1) entered disabled state [ 1691.995803][T23972] bridge0: port 1(bridge_slave_0) entered disabled state [ 1692.064056][T23972] bridge0: port 2(bridge_slave_1) entered blocking state [ 1692.064198][T23972] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1692.064549][T23972] bridge0: port 1(bridge_slave_0) entered blocking state [ 1692.064697][T23972] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1692.140545][T23972] bond0: (slave bridge0): Enslaving as an active interface with an up link [ 1692.181019][T23988] netlink: 236 bytes leftover after parsing attributes in process `syz.1.12498'. [ 1692.185511][T23988] netlink: 24 bytes leftover after parsing attributes in process `syz.1.12498'. [ 1692.185536][T23988] openvswitch: netlink: Flow key attr not present in new flow. [ 1692.679158][T24004] netlink: 'syz.1.12503': attribute type 5 has an invalid length. [ 1692.724212][T23994] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1694.021068][T24044] x_tables: duplicate underflow at hook 2 [ 1694.181999][T24049] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1694.611885][T24029] netlink: 8 bytes leftover after parsing attributes in process `syz.2.12506'. [ 1694.842636][T24071] FAULT_INJECTION: forcing a failure. [ 1694.842636][T24071] name failslab, interval 1, probability 0, space 0, times 0 [ 1694.842671][T24071] CPU: 1 UID: 0 PID: 24071 Comm: syz.3.12517 Not tainted syzkaller #0 PREEMPT(full) [ 1694.842697][T24071] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 1694.842710][T24071] Call Trace: [ 1694.842719][T24071] [ 1694.842730][T24071] dump_stack_lvl+0xe8/0x150 [ 1694.842769][T24071] should_fail_ex+0x3eb/0x540 [ 1694.842799][T24071] should_failslab+0xa8/0x100 [ 1694.842821][T24071] __kvmalloc_node_noprof+0x171/0x820 [ 1694.842863][T24071] ? bpf_compute_scc+0xd2/0xdb0 [ 1694.842895][T24071] ? bpf_compute_scc+0xd2/0xdb0 [ 1694.842934][T24071] bpf_compute_scc+0xd2/0xdb0 [ 1694.842966][T24071] ? sort_subprogs_topo+0xe5f/0x1130 [ 1694.843017][T24071] bpf_check+0x2c70/0x34e0 [ 1694.843055][T24071] ? ktime_get_with_offset+0x93/0x2d0 [ 1694.843085][T24071] ? ktime_get_with_offset+0x93/0x2d0 [ 1694.843116][T24071] ? __pfx_bpf_check+0x10/0x10 [ 1694.843144][T24071] ? bpf_obj_name_cpy+0x194/0x1e0 [ 1694.843182][T24071] bpf_prog_load+0x14da/0x1c60 [ 1694.843220][T24071] ? __pfx_bpf_prog_load+0x10/0x10 [ 1694.843262][T24071] ? __might_fault+0xaf/0x130 [ 1694.843295][T24071] __sys_bpf+0xd86/0xe00 [ 1694.843328][T24071] ? __pfx___sys_bpf+0x10/0x10 [ 1694.843364][T24071] ? __fget_files+0x2a/0x420 [ 1694.843412][T24071] ? ksys_write+0x242/0x270 [ 1694.843446][T24071] ? __pfx_ksys_write+0x10/0x10 [ 1694.843484][T24071] __x64_sys_bpf+0xba/0xd0 [ 1694.843521][T24071] do_syscall_64+0x166/0x520 [ 1694.843550][T24071] ? trace_irq_disable+0x3b/0x140 [ 1694.843582][T24071] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1694.843605][T24071] ? clear_bhb_loop+0x70/0xc0 [ 1694.843633][T24071] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1694.843656][T24071] RIP: 0033:0x7f3e361a8f19 [ 1694.843678][T24071] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1694.843698][T24071] RSP: 002b:00007f3e36fae028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1694.843721][T24071] RAX: ffffffffffffffda RBX: 00007f3e36425fa0 RCX: 00007f3e361a8f19 [ 1694.843738][T24071] RDX: 0000000000000094 RSI: 0000200000000140 RDI: 0000000000000005 [ 1694.843752][T24071] RBP: 00007f3e36fae090 R08: 0000000000000000 R09: 0000000000000000 [ 1694.843767][T24071] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1694.843780][T24071] R13: 00007f3e36426038 R14: 00007f3e36425fa0 R15: 00007ffede515788 [ 1694.843817][T24071] [ 1695.512315][T24084] Bluetooth: MGMT ver 1.23 [ 1695.525391][T24084] Bluetooth: MGMT ver 1.23 [ 1695.885900][T24095] netlink: 'syz.5.12523': attribute type 1 has an invalid length. [ 1695.951723][T24095] netlink: 4 bytes leftover after parsing attributes in process `syz.5.12523'. [ 1696.118133][T24095] mac80211_hwsim hwsim105 wlan1: entered promiscuous mode [ 1696.172134][T24094] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1696.475914][T24110] Cannot find del_set index 1 as target [ 1696.659146][T24120] syzkaller0: entered promiscuous mode [ 1696.659172][T24120] syzkaller0: entered allmulticast mode [ 1697.385317][T24156] netlink: 8 bytes leftover after parsing attributes in process `syz.3.12539'. [ 1698.138838][T24190] netlink: 4 bytes leftover after parsing attributes in process `syz.5.12548'. [ 1698.412830][T24206] FAULT_INJECTION: forcing a failure. [ 1698.412830][T24206] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1698.412863][T24206] CPU: 1 UID: 0 PID: 24206 Comm: syz.5.12552 Not tainted syzkaller #0 PREEMPT(full) [ 1698.412886][T24206] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 1698.412900][T24206] Call Trace: [ 1698.412908][T24206] [ 1698.412918][T24206] dump_stack_lvl+0xe8/0x150 [ 1698.412959][T24206] should_fail_ex+0x3eb/0x540 [ 1698.412993][T24206] _copy_to_user+0x31/0xb0 [ 1698.413024][T24206] bpf_verifier_vlog+0x496/0x900 [ 1698.413064][T24206] bpf_verifier_log_write+0x11d/0x1a0 [ 1698.413097][T24206] ? __pfx_bpf_verifier_log_write+0x10/0x10 [ 1698.413121][T24206] ? __kvmalloc_node_noprof+0x52a/0x820 [ 1698.413156][T24206] ? record_arg_access+0x14f/0xa80 [ 1698.413198][T24206] analyze_subprog+0x64ac/0xb150 [ 1698.413286][T24206] ? __pfx_analyze_subprog+0x10/0x10 [ 1698.413314][T24206] ? kasan_save_track+0x4f/0x80 [ 1698.413343][T24206] ? kasan_save_track+0x3e/0x80 [ 1698.413372][T24206] ? __kasan_kmalloc+0x93/0xb0 [ 1698.413403][T24206] ? __kvmalloc_node_noprof+0x50a/0x820 [ 1698.413431][T24206] ? call_instance+0x263/0x560 [ 1698.413459][T24206] ? bpf_compute_subprog_arg_access+0x2cb/0x15c0 [ 1698.413488][T24206] ? bpf_compute_live_registers+0x10b0/0x1df0 [ 1698.413518][T24206] ? bpf_check+0x2d0b/0x34e0 [ 1698.413538][T24206] ? bpf_prog_load+0x14da/0x1c60 [ 1698.413560][T24206] ? __sys_bpf+0xd86/0xe00 [ 1698.413579][T24206] ? __x64_sys_bpf+0xba/0xd0 [ 1698.413608][T24206] ? mas_next_node+0xa72/0xe50 [ 1698.413640][T24206] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1698.413709][T24206] ? call_instance+0x263/0x560 [ 1698.413738][T24206] ? rcu_is_watching+0x16/0xb0 [ 1698.413772][T24206] ? call_instance+0x263/0x560 [ 1698.413799][T24206] ? trace_kmalloc+0x2a/0xf0 [ 1698.413829][T24206] ? call_instance+0x263/0x560 [ 1698.413858][T24206] ? __kvmalloc_node_noprof+0x52a/0x820 [ 1698.413892][T24206] ? __kvmalloc_node_noprof+0x340/0x820 [ 1698.413936][T24206] ? call_instance+0x263/0x560 [ 1698.413963][T24206] ? call_instance+0x263/0x560 [ 1698.414013][T24206] bpf_compute_subprog_arg_access+0x2f1/0x15c0 [ 1698.414071][T24206] ? __pfx_bpf_compute_subprog_arg_access+0x10/0x10 [ 1698.414110][T24206] ? __kvmalloc_node_noprof+0x340/0x820 [ 1698.414141][T24206] ? bpf_compute_live_registers+0x142/0x1df0 [ 1698.414171][T24206] ? bpf_compute_live_registers+0x142/0x1df0 [ 1698.414211][T24206] bpf_compute_live_registers+0x10b0/0x1df0 [ 1698.414269][T24206] ? __pfx_bpf_compute_live_registers+0x10/0x10 [ 1698.414313][T24206] bpf_check+0x2d0b/0x34e0 [ 1698.414353][T24206] ? ktime_get_with_offset+0x93/0x2d0 [ 1698.414384][T24206] ? ktime_get_with_offset+0x93/0x2d0 [ 1698.414416][T24206] ? __pfx_bpf_check+0x10/0x10 [ 1698.414444][T24206] ? bpf_obj_name_cpy+0x194/0x1e0 [ 1698.414482][T24206] bpf_prog_load+0x14da/0x1c60 [ 1698.414520][T24206] ? __pfx_bpf_prog_load+0x10/0x10 [ 1698.414563][T24206] ? __might_fault+0xaf/0x130 [ 1698.414597][T24206] __sys_bpf+0xd86/0xe00 [ 1698.414639][T24206] ? __pfx___sys_bpf+0x10/0x10 [ 1698.414681][T24206] ? __fget_files+0x2a/0x420 [ 1698.414732][T24206] ? ksys_write+0x242/0x270 [ 1698.414769][T24206] ? __pfx_ksys_write+0x10/0x10 [ 1698.414807][T24206] __x64_sys_bpf+0xba/0xd0 [ 1698.414845][T24206] do_syscall_64+0x166/0x520 [ 1698.414875][T24206] ? trace_irq_disable+0x3b/0x140 [ 1698.414907][T24206] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1698.414931][T24206] ? clear_bhb_loop+0x70/0xc0 [ 1698.414960][T24206] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1698.414984][T24206] RIP: 0033:0x7f168eda8f19 [ 1698.415007][T24206] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1698.415027][T24206] RSP: 002b:00007f168fd42028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1698.415051][T24206] RAX: ffffffffffffffda RBX: 00007f168f025fa0 RCX: 00007f168eda8f19 [ 1698.415069][T24206] RDX: 0000000000000094 RSI: 0000200000000180 RDI: 0000000000000005 [ 1698.415084][T24206] RBP: 00007f168fd42090 R08: 0000000000000000 R09: 0000000000000000 [ 1698.415099][T24206] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000003 [ 1698.415112][T24206] R13: 00007f168f026038 R14: 00007f168f025fa0 R15: 00007ffeeacdae58 [ 1698.415149][T24206] [ 1698.876804][T19300] Bluetooth: hci0: Opcode 0x0c13 failed: -110 [ 1698.877089][T19300] Bluetooth: hci0: command 0x0c13 tx timeout [ 1699.426363][T24233] vlan2: entered promiscuous mode [ 1699.426390][T24233] bridge0: entered promiscuous mode [ 1699.803627][T24245] netlink: 8 bytes leftover after parsing attributes in process `syz.5.12562'. [ 1699.803971][T24245] 8021q: VLANs not supported on ip_vti0 [ 1701.089388][T24285] netlink: 12 bytes leftover after parsing attributes in process `syz.1.12573'. [ 1701.258826][T24291] vlan4: entered allmulticast mode [ 1701.258854][T24291] bridge1: entered allmulticast mode [ 1701.424990][T24293] syzkaller1: entered promiscuous mode [ 1701.425016][T24293] syzkaller1: entered allmulticast mode [ 1701.643942][T24308] netlink: 'syz.3.12576': attribute type 1 has an invalid length. [ 1701.712050][T24310] netlink: 44 bytes leftover after parsing attributes in process `syz.3.12576'. [ 1701.813787][T24314] netlink: 12 bytes leftover after parsing attributes in process `syz.1.12577'. [ 1701.844733][T24314] netlink: 4 bytes leftover after parsing attributes in process `syz.1.12577'. [ 1702.162016][T24320] netlink: 8 bytes leftover after parsing attributes in process `syz.4.12578'. [ 1702.403738][T24325] netlink: 'syz.5.12579': attribute type 1 has an invalid length. [ 1702.539693][T24318] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1702.688183][T24328] veth3: entered allmulticast mode [ 1702.830578][T24318] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1703.053252][T24318] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1703.198499][T24356] netlink: 20 bytes leftover after parsing attributes in process `syz.1.12587'. [ 1703.233607][T24355] netlink: 64 bytes leftover after parsing attributes in process `syz.5.12586'. [ 1703.256930][T24318] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1703.477969][ T12] netdevsim netdevsim4 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1703.489785][ T12] netdevsim netdevsim4 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1703.587370][ T12] netdevsim netdevsim4 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1703.601699][ T12] netdevsim netdevsim4 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1703.672212][T24368] v: renamed from vlan1 (while UP) [ 1703.880552][T24375] netlink: 'syz.4.12591': attribute type 1 has an invalid length. [ 1704.392791][T24405] netlink: 12 bytes leftover after parsing attributes in process `syz.1.12600'. [ 1704.691780][T24410] netlink: 'syz.2.12601': attribute type 1 has an invalid length. [ 1705.468883][T24438] netlink: 20 bytes leftover after parsing attributes in process `syz.3.12605'. [ 1705.509597][T24439] netlink: 'syz.1.12606': attribute type 1 has an invalid length. [ 1705.833747][T24436] bond4: (slave geneve2): making interface the new active one [ 1705.834871][T24436] bond4: (slave geneve2): Enslaving as an active interface with an up link [ 1705.835169][ T12] netdevsim netdevsim1 netdevsim0: set [1, 1] type 2 family 0 port 20004 - 0 [ 1705.870519][ T1373] netdevsim netdevsim1 netdevsim1: set [1, 1] type 2 family 0 port 20004 - 0 [ 1705.870571][ T1373] netdevsim netdevsim1 netdevsim2: set [1, 1] type 2 family 0 port 20004 - 0 [ 1705.870607][ T1373] netdevsim netdevsim1 netdevsim3: set [1, 1] type 2 family 0 port 20004 - 0 [ 1706.007489][T24454] netlink: 'syz.5.12608': attribute type 1 has an invalid length. [ 1706.664571][T24483] FAULT_INJECTION: forcing a failure. [ 1706.664571][T24483] name failslab, interval 1, probability 0, space 0, times 0 [ 1706.664606][T24483] CPU: 1 UID: 0 PID: 24483 Comm: syz.4.12617 Not tainted syzkaller #0 PREEMPT(full) [ 1706.664632][T24483] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 1706.664646][T24483] Call Trace: [ 1706.664656][T24483] [ 1706.664667][T24483] dump_stack_lvl+0xe8/0x150 [ 1706.664713][T24483] should_fail_ex+0x3eb/0x540 [ 1706.664756][T24483] should_failslab+0xa8/0x100 [ 1706.664779][T24483] ? skb_clone+0x212/0x3a0 [ 1706.664808][T24483] kmem_cache_alloc_noprof+0x9c/0x600 [ 1706.664840][T24483] ? skb_clone+0x212/0x3a0 [ 1706.664875][T24483] skb_clone+0x212/0x3a0 [ 1706.664907][T24483] bpf_clone_redirect+0x170/0x4b0 [ 1706.664939][T24483] ? bpf_test_run+0x1d1/0x830 [ 1706.664975][T24483] bpf_prog_2f59963de350c2d2+0x5e/0x67 [ 1706.665002][T24483] ? __kernel_text_address+0xd/0x30 [ 1706.665035][T24483] ? arch_stack_walk+0xfb/0x150 [ 1706.665072][T24483] ? __pfx___schedule+0x10/0x10 [ 1706.665116][T24483] ? preempt_schedule_thunk+0x16/0x40 [ 1706.665149][T24483] ? preempt_schedule_common+0x7f/0xd0 [ 1706.665176][T24483] ? bpf_test_run+0x1d1/0x830 [ 1706.665215][T24483] ? bpf_test_timer_continue+0x114/0x390 [ 1706.665244][T24483] bpf_test_run+0x354/0x830 [ 1706.665303][T24483] ? __pfx_bpf_test_run+0x10/0x10 [ 1706.665356][T24483] ? __kasan_krealloc+0xec/0x110 [ 1706.665395][T24483] ? eth_type_trans+0x33f/0x640 [ 1706.665433][T24483] ? skb_dst_set+0x72/0x140 [ 1706.665469][T24483] bpf_prog_test_run_skb+0xe7e/0x22e0 [ 1706.665526][T24483] ? __fget_files+0x3a2/0x420 [ 1706.665554][T24483] ? __fget_files+0x2a/0x420 [ 1706.665589][T24483] ? __pfx_bpf_prog_test_run_skb+0x10/0x10 [ 1706.665626][T24483] bpf_prog_test_run+0x2c5/0x340 [ 1706.665656][T24483] __sys_bpf+0xb1e/0xe00 [ 1706.665687][T24483] ? __pfx___sys_bpf+0x10/0x10 [ 1706.665729][T24483] ? __fget_files+0x2a/0x420 [ 1706.665802][T24483] ? ksys_write+0x242/0x270 [ 1706.665838][T24483] ? __pfx_ksys_write+0x10/0x10 [ 1706.665876][T24483] __x64_sys_bpf+0xba/0xd0 [ 1706.665914][T24483] do_syscall_64+0x166/0x520 [ 1706.665942][T24483] ? trace_irq_disable+0x3b/0x140 [ 1706.665974][T24483] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1706.665997][T24483] ? clear_bhb_loop+0x70/0xc0 [ 1706.666026][T24483] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1706.666050][T24483] RIP: 0033:0x7fd0925a8f19 [ 1706.666071][T24483] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1706.666092][T24483] RSP: 002b:00007fd0933a8028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1706.666117][T24483] RAX: ffffffffffffffda RBX: 00007fd092825fa0 RCX: 00007fd0925a8f19 [ 1706.666134][T24483] RDX: 0000000000000028 RSI: 00002000000000c0 RDI: 000000000000000a [ 1706.666149][T24483] RBP: 00007fd0933a8090 R08: 0000000000000000 R09: 0000000000000000 [ 1706.666162][T24483] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1706.666175][T24483] R13: 00007fd092826038 R14: 00007fd092825fa0 R15: 00007ffc3c595728 [ 1706.666229][T24483] [ 1707.008094][T24485] vlan2: entered promiscuous mode [ 1707.008118][T24485] bond0: entered promiscuous mode [ 1707.008133][T24485] bond_slave_0: entered promiscuous mode [ 1707.008358][T24485] bond_slave_1: entered promiscuous mode [ 1707.229460][T24498] netlink: 'syz.4.12620': attribute type 21 has an invalid length. [ 1707.229551][T24498] netlink: 132 bytes leftover after parsing attributes in process `syz.4.12620'. [ 1707.295779][T24457] netlink: 16 bytes leftover after parsing attributes in process `syz.2.12609'. [ 1707.876067][T24523] netlink: 24 bytes leftover after parsing attributes in process `syz.2.12626'. [ 1708.181341][T24539] netlink: 'syz.1.12632': attribute type 1 has an invalid length. [ 1708.255320][T24543] netlink: 'syz.3.12633': attribute type 1 has an invalid length. [ 1708.425967][T24539] veth3: entered allmulticast mode [ 1708.450706][T24539] bond5: (slave veth3): Enslaving as an active interface with a down link [ 1708.484767][T24548] bond5: (slave veth0_to_bond): making interface the new active one [ 1708.507172][T24548] bond5: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 1708.603640][T24543] veth3: entered allmulticast mode [ 1708.632496][T24543] bond2: (slave veth3): Enslaving as an active interface with a down link [ 1708.712818][T24554] bond2: (slave veth0_to_bond): making interface the new active one [ 1708.724426][T24554] bond2: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 1708.794134][T24552] bond5: entered promiscuous mode [ 1708.794162][T24552] veth0_to_bond: entered promiscuous mode [ 1708.811799][T24552] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 1708.827956][T24552] bond5: (slave macvlan2): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 1708.828087][T24552] bond5: left promiscuous mode [ 1708.828106][T24552] veth0_to_bond: left promiscuous mode [ 1708.947364][T24555] bond2: entered promiscuous mode [ 1708.947390][T24555] veth0_to_bond: entered promiscuous mode [ 1708.951775][T24555] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 1708.954412][T24555] bond2: (slave macvlan2): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 1708.954526][T24555] bond2: left promiscuous mode [ 1708.954545][T24555] veth0_to_bond: left promiscuous mode [ 1709.344613][T24577] netlink: 'syz.2.12639': attribute type 1 has an invalid length. [ 1709.350168][T24577] netlink: 'syz.2.12639': attribute type 1 has an invalid length. [ 1709.365438][T24577] netlink: 'syz.2.12639': attribute type 1 has an invalid length. [ 1709.365697][T24577] netlink: 'syz.2.12639': attribute type 1 has an invalid length. [ 1709.365898][T24577] netlink: 'syz.2.12639': attribute type 1 has an invalid length. [ 1709.366105][T24577] netlink: 'syz.2.12639': attribute type 1 has an invalid length. [ 1709.366332][T24577] netlink: 'syz.2.12639': attribute type 1 has an invalid length. [ 1709.687706][T24590] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1709.774448][T24597] Bluetooth: hci0: unsupported parameter 5135 [ 1709.774476][T24597] Bluetooth: hci0: unsupported parameter 8192 [ 1709.774511][T24597] Bluetooth: hci0: unsupported parameter 5135 [ 1709.774527][T24597] Bluetooth: hci0: unsupported parameter 8192 [ 1710.082110][T24602] syzkaller0: entered promiscuous mode [ 1710.082135][T24602] syzkaller0: entered allmulticast mode [ 1713.844695][T24654] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1713.914797][T24656] xt_l2tp: v2 sid > 0xffff: 33554432 [ 1713.916215][T24656] validate_nla: 26 callbacks suppressed [ 1713.916234][T24656] netlink: 'syz.2.12658': attribute type 1 has an invalid length. [ 1713.916250][T24656] netlink: 244 bytes leftover after parsing attributes in process `syz.2.12658'. [ 1714.110165][T24665] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1714.113668][T24665] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1714.123554][T24665] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1714.138982][T24665] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1714.140300][T24665] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1714.161493][T24665] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1714.174305][T24665] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1714.191829][T24665] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1714.425672][T24677] syzkaller0: entered promiscuous mode [ 1714.425698][T24677] syzkaller0: entered allmulticast mode [ 1714.608256][T24685] FAULT_INJECTION: forcing a failure. [ 1714.608256][T24685] name failslab, interval 1, probability 0, space 0, times 0 [ 1714.608290][T24685] CPU: 0 UID: 0 PID: 24685 Comm: syz.2.12666 Not tainted syzkaller #0 PREEMPT(full) [ 1714.608315][T24685] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 1714.608332][T24685] Call Trace: [ 1714.608341][T24685] [ 1714.608350][T24685] dump_stack_lvl+0xe8/0x150 [ 1714.608393][T24685] should_fail_ex+0x3eb/0x540 [ 1714.608424][T24685] should_failslab+0xa8/0x100 [ 1714.608449][T24685] __kvmalloc_node_noprof+0x171/0x820 [ 1714.608495][T24685] ? __kvmalloc_node_noprof+0x340/0x820 [ 1714.608528][T24685] ? bpf_compute_loops+0x137/0x3e80 [ 1714.608552][T24685] ? bpf_compute_loops+0x137/0x3e80 [ 1714.608586][T24685] bpf_compute_loops+0x137/0x3e80 [ 1714.608611][T24685] ? bpf_compute_idoms+0x18b5/0x1940 [ 1714.608662][T24685] bpf_check+0x2ce7/0x34e0 [ 1714.608699][T24685] ? ktime_get_with_offset+0x93/0x2d0 [ 1714.608731][T24685] ? ktime_get_with_offset+0x93/0x2d0 [ 1714.608764][T24685] ? __pfx_bpf_check+0x10/0x10 [ 1714.608792][T24685] ? bpf_obj_name_cpy+0x194/0x1e0 [ 1714.608827][T24685] bpf_prog_load+0x14da/0x1c60 [ 1714.608865][T24685] ? __pfx_bpf_prog_load+0x10/0x10 [ 1714.608907][T24685] ? __might_fault+0xaf/0x130 [ 1714.608941][T24685] __sys_bpf+0xd86/0xe00 [ 1714.608972][T24685] ? __pfx___sys_bpf+0x10/0x10 [ 1714.609006][T24685] ? __fget_files+0x2a/0x420 [ 1714.609053][T24685] ? ksys_write+0x242/0x270 [ 1714.609087][T24685] ? __pfx_ksys_write+0x10/0x10 [ 1714.609124][T24685] __x64_sys_bpf+0xba/0xd0 [ 1714.609159][T24685] do_syscall_64+0x166/0x520 [ 1714.609186][T24685] ? trace_irq_disable+0x3b/0x140 [ 1714.609219][T24685] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1714.609244][T24685] ? clear_bhb_loop+0x70/0xc0 [ 1714.609273][T24685] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1714.609297][T24685] RIP: 0033:0x7f55c61a8f19 [ 1714.609320][T24685] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1714.609342][T24685] RSP: 002b:00007f55c6fee028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1714.609367][T24685] RAX: ffffffffffffffda RBX: 00007f55c6425fa0 RCX: 00007f55c61a8f19 [ 1714.609384][T24685] RDX: 0000000000000094 RSI: 0000200000000140 RDI: 0000000000000005 [ 1714.609399][T24685] RBP: 00007f55c6fee090 R08: 0000000000000000 R09: 0000000000000000 [ 1714.609413][T24685] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1714.609426][T24685] R13: 00007f55c6426038 R14: 00007f55c6425fa0 R15: 00007fffd45187a8 [ 1714.609463][T24685] [ 1715.088634][T24695] batman_adv: batadv0: Adding interface: veth0 [ 1715.088656][T24695] batman_adv: batadv0: The MTU of interface veth0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1715.088691][T24695] batman_adv: batadv0: Interface activated: veth0 [ 1715.090497][T24698] netlink: 16 bytes leftover after parsing attributes in process `syz.2.12671'. [ 1715.705845][T24723] sctp: [Deprecated]: syz.4.12676 (pid 24723) Use of int in max_burst socket option. [ 1715.705845][T24723] Use struct sctp_assoc_value instead [ 1715.778131][T24729] FAULT_INJECTION: forcing a failure. [ 1715.778131][T24729] name failslab, interval 1, probability 0, space 0, times 0 [ 1715.778165][T24729] CPU: 0 UID: 0 PID: 24729 Comm: syz.3.12679 Not tainted syzkaller #0 PREEMPT(full) [ 1715.778190][T24729] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 1715.778205][T24729] Call Trace: [ 1715.778214][T24729] [ 1715.778225][T24729] dump_stack_lvl+0xe8/0x150 [ 1715.778267][T24729] should_fail_ex+0x3eb/0x540 [ 1715.778302][T24729] should_failslab+0xa8/0x100 [ 1715.778331][T24729] __kvmalloc_node_noprof+0x171/0x820 [ 1715.778366][T24729] ? __kvmalloc_node_noprof+0x340/0x820 [ 1715.778395][T24729] ? bpf_compute_subprog_arg_access+0x194/0x15c0 [ 1715.778427][T24729] ? bpf_compute_subprog_arg_access+0x194/0x15c0 [ 1715.778464][T24729] bpf_compute_subprog_arg_access+0x194/0x15c0 [ 1715.778528][T24729] ? __pfx_bpf_compute_subprog_arg_access+0x10/0x10 [ 1715.778567][T24729] ? __kvmalloc_node_noprof+0x340/0x820 [ 1715.778597][T24729] ? bpf_compute_live_registers+0x142/0x1df0 [ 1715.778625][T24729] ? bpf_compute_live_registers+0x142/0x1df0 [ 1715.778662][T24729] bpf_compute_live_registers+0x10b0/0x1df0 [ 1715.778716][T24729] ? __pfx_bpf_compute_live_registers+0x10/0x10 [ 1715.778757][T24729] bpf_check+0x2d0b/0x34e0 [ 1715.778794][T24729] ? ktime_get_with_offset+0x93/0x2d0 [ 1715.778825][T24729] ? ktime_get_with_offset+0x93/0x2d0 [ 1715.778854][T24729] ? __pfx_bpf_check+0x10/0x10 [ 1715.778881][T24729] ? bpf_obj_name_cpy+0x194/0x1e0 [ 1715.778915][T24729] bpf_prog_load+0x14da/0x1c60 [ 1715.778953][T24729] ? __pfx_bpf_prog_load+0x10/0x10 [ 1715.778994][T24729] ? __might_fault+0xaf/0x130 [ 1715.779026][T24729] __sys_bpf+0xd86/0xe00 [ 1715.779056][T24729] ? __pfx___sys_bpf+0x10/0x10 [ 1715.779092][T24729] ? __fget_files+0x2a/0x420 [ 1715.779146][T24729] ? ksys_write+0x242/0x270 [ 1715.779181][T24729] ? __pfx_ksys_write+0x10/0x10 [ 1715.779218][T24729] __x64_sys_bpf+0xba/0xd0 [ 1715.779254][T24729] do_syscall_64+0x166/0x520 [ 1715.779283][T24729] ? trace_irq_disable+0x3b/0x140 [ 1715.779314][T24729] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1715.779338][T24729] ? clear_bhb_loop+0x70/0xc0 [ 1715.779366][T24729] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1715.779389][T24729] RIP: 0033:0x7f3e361a8f19 [ 1715.779410][T24729] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1715.779429][T24729] RSP: 002b:00007f3e36fae028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1715.779452][T24729] RAX: ffffffffffffffda RBX: 00007f3e36425fa0 RCX: 00007f3e361a8f19 [ 1715.779479][T24729] RDX: 0000000000000094 RSI: 0000200000000140 RDI: 0000000000000005 [ 1715.779494][T24729] RBP: 00007f3e36fae090 R08: 0000000000000000 R09: 0000000000000000 [ 1715.779508][T24729] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1715.779522][T24729] R13: 00007f3e36426038 R14: 00007f3e36425fa0 R15: 00007ffede515788 [ 1715.779560][T24729] [ 1716.201392][T24736] macsec0: entered promiscuous mode [ 1716.205541][T24736] netlink: 4 bytes leftover after parsing attributes in process `syz.4.12680'. [ 1716.227103][T24736] veth1_macvtap: left promiscuous mode [ 1716.245179][T24736] macsec0 (unregistering): left promiscuous mode [ 1716.330792][T24740] syzkaller0: entered promiscuous mode [ 1716.330818][T24740] syzkaller0: entered allmulticast mode [ 1716.508163][T24715] netlink: 8 bytes leftover after parsing attributes in process `syz.2.12675'. [ 1716.897175][T24755] raw_sendmsg: syz.1.12684 forgot to set AF_INET. Fix it! [ 1717.843447][T24787] netlink: 'syz.1.12693': attribute type 1 has an invalid length. [ 1718.054024][T24798] netlink: 'syz.2.12695': attribute type 1 has an invalid length. [ 1718.054048][T24798] netlink: 224 bytes leftover after parsing attributes in process `syz.2.12695'. [ 1718.054068][T24798] nbd: must specify at least one socket [ 1718.102484][T24799] net_ratelimit: 25 callbacks suppressed [ 1718.102507][T24799] Dead loop on virtual device lo (net 1649), fix it urgently! [ 1718.102771][T24799] Dead loop on virtual device lo (net 1649), fix it urgently! [ 1718.102968][T24799] Dead loop on virtual device lo (net 1649), fix it urgently! [ 1718.104730][T24799] Dead loop on virtual device lo (net 1649), fix it urgently! [ 1718.104942][T24799] Dead loop on virtual device lo (net 1649), fix it urgently! [ 1718.105142][T24799] Dead loop on virtual device lo (net 1649), fix it urgently! [ 1718.105851][T24799] Dead loop on virtual device lo (net 1649), fix it urgently! [ 1718.106057][T24799] Dead loop on virtual device lo (net 1649), fix it urgently! [ 1718.106262][T24799] Dead loop on virtual device lo (net 1649), fix it urgently! [ 1718.111522][T24799] Dead loop on virtual device lo (net 1649), fix it urgently! [ 1718.244305][T24787] veth5: entered allmulticast mode [ 1718.312501][T24787] bond6: (slave veth5): Enslaving as an active interface with a down link [ 1718.370155][T24789] gtp0: entered promiscuous mode [ 1718.462495][T24791] bond5: (slave veth0_to_bond): Releasing active interface [ 1718.483458][T24791] bond6: (slave veth0_to_bond): making interface the new active one [ 1718.484582][T24791] bond6: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 1718.586037][T24800] bond6: entered promiscuous mode [ 1718.586064][T24800] veth0_to_bond: entered promiscuous mode [ 1718.602112][T24800] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 1718.608554][T24800] bond6: (slave macvlan2): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 1718.608938][T24800] bond6: left promiscuous mode [ 1718.609014][T24800] veth0_to_bond: left promiscuous mode [ 1719.774954][T24858] netlink: 4 bytes leftover after parsing attributes in process `syz.4.12706'. [ 1719.991851][T24868] netlink: 'syz.5.12710': attribute type 1 has an invalid length. [ 1720.084104][T24874] netlink: 16 bytes leftover after parsing attributes in process `syz.3.12708'. [ 1720.204363][T24868] batman_adv: batadv0: Adding interface: dummy0 [ 1720.204384][T24868] batman_adv: batadv0: The MTU of interface dummy0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1720.204420][T24868] batman_adv: batadv0: Interface activated: dummy0 [ 1720.252492][T24868] netlink: 'syz.5.12710': attribute type 10 has an invalid length. [ 1720.252519][T24868] netlink: 40 bytes leftover after parsing attributes in process `syz.5.12710'. [ 1720.289405][T24874] ip6gre1: entered promiscuous mode [ 1720.289433][T24874] ip6gre1: entered allmulticast mode [ 1720.372232][T24882] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 1720.372253][T24882] IPv6: NLM_F_CREATE should be set when creating new route [ 1720.372306][T24882] IPv6: NLM_F_CREATE should be set when creating new route [ 1720.468542][T24868] batadv0: entered promiscuous mode [ 1720.468567][T24868] batadv0: entered allmulticast mode [ 1720.474135][T24868] bridge0: port 3(batadv0) entered blocking state [ 1720.475677][T24868] bridge0: port 3(batadv0) entered disabled state [ 1720.520111][T24868] batadv0: failed to initialize vlan filtering on this port [ 1720.551471][T24885] FAULT_INJECTION: forcing a failure. [ 1720.551471][T24885] name failslab, interval 1, probability 0, space 0, times 0 [ 1720.551504][T24885] CPU: 1 UID: 0 PID: 24885 Comm: syz.2.12711 Not tainted syzkaller #0 PREEMPT(full) [ 1720.551533][T24885] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 1720.551547][T24885] Call Trace: [ 1720.551556][T24885] [ 1720.551565][T24885] dump_stack_lvl+0xe8/0x150 [ 1720.551615][T24885] should_fail_ex+0x3eb/0x540 [ 1720.551649][T24885] should_failslab+0xa8/0x100 [ 1720.551674][T24885] __kvmalloc_node_noprof+0x171/0x820 [ 1720.551710][T24885] ? alloc_netdev_mqs+0x915/0x1240 [ 1720.551739][T24885] ? alloc_netdev_mqs+0x915/0x1240 [ 1720.551776][T24885] alloc_netdev_mqs+0x915/0x1240 [ 1720.551806][T24885] ? __pfx_ipvlan_link_setup+0x10/0x10 [ 1720.551860][T24885] rtnl_create_link+0x321/0xd70 [ 1720.551900][T24885] rtnl_newlink_create+0x258/0x7b0 [ 1720.551937][T24885] ? __pfx_rtnl_newlink_create+0x10/0x10 [ 1720.551970][T24885] ? __pfx___mutex_lock+0x10/0x10 [ 1720.552013][T24885] ? ns_capable+0x84/0xe0 [ 1720.552050][T24885] rtnl_newlink+0x167a/0x1c30 [ 1720.552093][T24885] ? __pfx_rtnl_newlink+0x10/0x10 [ 1720.552117][T24885] ? __netlink_deliver_tap+0x4f1/0x6e0 [ 1720.552150][T24885] ? netlink_deliver_tap+0x19c/0x1b0 [ 1720.552183][T24885] ? netlink_unicast+0x8c1/0xa80 [ 1720.552212][T24885] ? netlink_sendmsg+0x7f0/0xb20 [ 1720.552232][T24885] ? sock_sendmsg_nosec+0x14e/0x190 [ 1720.552262][T24885] ? ____sys_sendmsg+0x54e/0x850 [ 1720.552285][T24885] ? ___sys_sendmsg+0x2a5/0x360 [ 1720.552308][T24885] ? __x64_sys_sendmsg+0x1b1/0x290 [ 1720.552332][T24885] ? do_syscall_64+0x166/0x520 [ 1720.552361][T24885] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1720.552428][T24885] ? kasan_quarantine_put+0xbb/0x1f0 [ 1720.552459][T24885] ? lockdep_hardirqs_on+0x7b/0x110 [ 1720.552493][T24885] ? nlmon_xmit+0xb0/0x100 [ 1720.552519][T24885] ? kmem_cache_free+0x182/0x650 [ 1720.552561][T24885] ? __lock_acquire+0x747/0x2de0 [ 1720.552606][T24885] ? __pfx_hook_capable+0x10/0x10 [ 1720.552628][T24885] ? __dev_queue_xmit+0x29b/0x3920 [ 1720.552662][T24885] ? __pfx_hook_capable+0x10/0x10 [ 1720.552685][T24885] ? lockdep_hardirqs_on+0x7b/0x110 [ 1720.552745][T24885] ? __pfx_rtnl_newlink+0x10/0x10 [ 1720.552770][T24885] rtnetlink_rcv_msg+0x802/0xc00 [ 1720.552800][T24885] ? rtnetlink_rcv_msg+0x1c9/0xc00 [ 1720.552824][T24885] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 1720.552853][T24885] ? __copy_skb_header+0xa3/0x4a0 [ 1720.552894][T24885] netlink_rcv_skb+0x226/0x4a0 [ 1720.552930][T24885] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 1720.552958][T24885] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 1720.553009][T24885] ? netlink_deliver_tap+0x2e/0x1b0 [ 1720.553044][T24885] ? netlink_deliver_tap+0x2e/0x1b0 [ 1720.553086][T24885] netlink_unicast+0x8ef/0xa80 [ 1720.553140][T24885] netlink_sendmsg+0x7f0/0xb20 [ 1720.553171][T24885] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1720.553198][T24885] ? aa_sock_msg_perm+0x144/0x210 [ 1720.553227][T24885] ? apparmor_socket_sendmsg+0x98/0x360 [ 1720.553263][T24885] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1720.553284][T24885] sock_sendmsg_nosec+0x14e/0x190 [ 1720.553320][T24885] ____sys_sendmsg+0x54e/0x850 [ 1720.553354][T24885] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1720.553392][T24885] ? import_iovec+0x73/0xa0 [ 1720.553426][T24885] ___sys_sendmsg+0x2a5/0x360 [ 1720.553450][T24885] ? __lock_acquire+0x747/0x2de0 [ 1720.553484][T24885] ? __pfx____sys_sendmsg+0x10/0x10 [ 1720.553555][T24885] ? __fget_files+0x3a2/0x420 [ 1720.553583][T24885] ? __fget_files+0x2a/0x420 [ 1720.553630][T24885] __x64_sys_sendmsg+0x1b1/0x290 [ 1720.553660][T24885] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1720.553712][T24885] do_syscall_64+0x166/0x520 [ 1720.553741][T24885] ? trace_irq_disable+0x3b/0x140 [ 1720.553772][T24885] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1720.553795][T24885] ? clear_bhb_loop+0x70/0xc0 [ 1720.553824][T24885] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1720.553847][T24885] RIP: 0033:0x7f55c61a8f19 [ 1720.553869][T24885] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1720.553888][T24885] RSP: 002b:00007f55c6fee028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1720.553912][T24885] RAX: ffffffffffffffda RBX: 00007f55c6425fa0 RCX: 00007f55c61a8f19 [ 1720.553929][T24885] RDX: 0000000000000000 RSI: 0000200000000080 RDI: 0000000000000003 [ 1720.553943][T24885] RBP: 00007f55c6fee090 R08: 0000000000000000 R09: 0000000000000000 [ 1720.553957][T24885] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1720.553970][T24885] R13: 00007f55c6426038 R14: 00007f55c6425fa0 R15: 00007fffd45187a8 [ 1720.554007][T24885] [ 1721.516667][T19300] Bluetooth: hci0: command 0x0c13 tx timeout [ 1721.516784][T29247] Bluetooth: hci0: Opcode 0x0c13 failed: -110 [ 1721.708266][T24928] rxe_eth0 speed is unknown, defaulting to 1000 [ 1722.357643][T24956] xt_HMARK: spi-set and port-set can't be combined [ 1722.366866][T24954] xt_HMARK: spi-set and port-set can't be combined [ 1722.652773][T24967] netlink: 8 bytes leftover after parsing attributes in process `syz.3.12723'. [ 1724.313023][T24908] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1724.601026][T24979] netlink: 'syz.1.12725': attribute type 1 has an invalid length. [ 1724.720042][T24986] netlink: 64 bytes leftover after parsing attributes in process `syz.2.12730'. [ 1724.803467][T24983] veth7: entered allmulticast mode [ 1724.813480][T24983] bond7: (slave veth7): Enslaving as an active interface with a down link [ 1724.875894][T24979] bond6: (slave veth0_to_bond): Releasing active interface [ 1724.926975][T24999] netlink: 388 bytes leftover after parsing attributes in process `syz.4.12732'. [ 1724.934691][T24990] netlink: 12 bytes leftover after parsing attributes in process `syz.5.12729'. [ 1724.955851][T24979] bond7: (slave veth0_to_bond): making interface the new active one [ 1725.009654][T24979] bond7: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 1725.052406][T25004] netlink: 'syz.3.12726': attribute type 1 has an invalid length. [ 1725.074914][T24983] bond7: entered promiscuous mode [ 1725.081095][T24983] veth0_to_bond: entered promiscuous mode [ 1725.086081][T24983] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 1725.100866][T24983] bond7: (slave macvlan2): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 1725.100965][T24983] bond7: left promiscuous mode [ 1725.100984][T24983] veth0_to_bond: left promiscuous mode [ 1725.539124][T25019] netlink: 'syz.1.12735': attribute type 1 has an invalid length. [ 1725.611207][T25024] netlink: 8 bytes leftover after parsing attributes in process `syz.5.12736'. [ 1725.611231][T25024] netlink: 4 bytes leftover after parsing attributes in process `syz.5.12736'. [ 1725.640869][T25032] netlink: 'syz.3.12737': attribute type 1 has an invalid length. [ 1725.742523][T25034] FAULT_INJECTION: forcing a failure. [ 1725.742523][T25034] name failslab, interval 1, probability 0, space 0, times 0 [ 1725.742557][T25034] CPU: 1 UID: 0 PID: 25034 Comm: syz.2.12738 Not tainted syzkaller #0 PREEMPT(full) [ 1725.742583][T25034] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 1725.742597][T25034] Call Trace: [ 1725.742606][T25034] [ 1725.742616][T25034] dump_stack_lvl+0xe8/0x150 [ 1725.742658][T25034] should_fail_ex+0x3eb/0x540 [ 1725.742692][T25034] should_failslab+0xa8/0x100 [ 1725.742715][T25034] ? skb_clone+0x212/0x3a0 [ 1725.742743][T25034] kmem_cache_alloc_noprof+0x9c/0x600 [ 1725.742774][T25034] ? skb_clone+0x212/0x3a0 [ 1725.742810][T25034] skb_clone+0x212/0x3a0 [ 1725.742845][T25034] bpf_clone_redirect+0x170/0x4b0 [ 1725.742877][T25034] ? bpf_test_run+0x1d1/0x830 [ 1725.742912][T25034] bpf_prog_2f59963de350c2d2+0x5e/0x67 [ 1725.742938][T25034] ? __kernel_text_address+0xd/0x30 [ 1725.742971][T25034] ? arch_stack_walk+0xfb/0x150 [ 1725.743007][T25034] ? __pfx___schedule+0x10/0x10 [ 1725.743049][T25034] ? preempt_schedule_thunk+0x16/0x40 [ 1725.743082][T25034] ? preempt_schedule_common+0x7f/0xd0 [ 1725.743109][T25034] ? bpf_test_run+0x1d1/0x830 [ 1725.743147][T25034] ? bpf_test_timer_continue+0x114/0x390 [ 1725.743175][T25034] bpf_test_run+0x354/0x830 [ 1725.743235][T25034] ? __pfx_bpf_test_run+0x10/0x10 [ 1725.743287][T25034] ? __kasan_krealloc+0xec/0x110 [ 1725.743333][T25034] ? eth_type_trans+0x33f/0x640 [ 1725.743373][T25034] ? skb_dst_set+0x72/0x140 [ 1725.743411][T25034] bpf_prog_test_run_skb+0xe7e/0x22e0 [ 1725.743467][T25034] ? __fget_files+0x3a2/0x420 [ 1725.743495][T25034] ? __fget_files+0x2a/0x420 [ 1725.743530][T25034] ? __pfx_bpf_prog_test_run_skb+0x10/0x10 [ 1725.743566][T25034] bpf_prog_test_run+0x2c5/0x340 [ 1725.743596][T25034] __sys_bpf+0xb1e/0xe00 [ 1725.743628][T25034] ? __pfx___sys_bpf+0x10/0x10 [ 1725.743665][T25034] ? __fget_files+0x2a/0x420 [ 1725.743714][T25034] ? ksys_write+0x242/0x270 [ 1725.743749][T25034] ? __pfx_ksys_write+0x10/0x10 [ 1725.743787][T25034] __x64_sys_bpf+0xba/0xd0 [ 1725.743825][T25034] do_syscall_64+0x166/0x520 [ 1725.743854][T25034] ? trace_irq_disable+0x3b/0x140 [ 1725.743884][T25034] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1725.743908][T25034] ? clear_bhb_loop+0x70/0xc0 [ 1725.743935][T25034] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1725.743960][T25034] RIP: 0033:0x7f55c61a8f19 [ 1725.743981][T25034] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1725.744001][T25034] RSP: 002b:00007f55c6fee028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1725.744026][T25034] RAX: ffffffffffffffda RBX: 00007f55c6425fa0 RCX: 00007f55c61a8f19 [ 1725.744043][T25034] RDX: 0000000000000028 RSI: 00002000000000c0 RDI: 000000000000000a [ 1725.744058][T25034] RBP: 00007f55c6fee090 R08: 0000000000000000 R09: 0000000000000000 [ 1725.744073][T25034] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1725.744086][T25034] R13: 00007f55c6426038 R14: 00007f55c6425fa0 R15: 00007fffd45187a8 [ 1725.744124][T25034] [ 1725.950327][T25030] veth9: entered allmulticast mode [ 1726.077995][T25030] bond8: (slave veth9): Enslaving as an active interface with a down link [ 1726.224754][T25019] bond7: (slave veth0_to_bond): Releasing active interface [ 1726.252262][T25019] bond8: (slave veth0_to_bond): making interface the new active one [ 1726.254895][T25019] bond8: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 1726.390141][T25026] veth5: entered allmulticast mode [ 1726.431465][T25026] bond4: (slave veth5): Enslaving as an active interface with a down link [ 1726.462310][T25037] bond2: (slave veth0_to_bond): Releasing active interface [ 1726.486363][T25047] netlink: 8 bytes leftover after parsing attributes in process `syz.5.12741'. [ 1726.519481][T25037] bond4: (slave veth0_to_bond): making interface the new active one [ 1726.520732][T25037] bond4: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 1726.547224][T25036] bond8: entered promiscuous mode [ 1726.547258][T25036] veth0_to_bond: entered promiscuous mode [ 1726.548472][T25036] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 1726.549393][T25036] bond8: (slave macvlan2): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 1726.549483][T25036] bond8: left promiscuous mode [ 1726.549498][T25036] veth0_to_bond: left promiscuous mode [ 1726.643884][T25039] bond4: entered promiscuous mode [ 1726.643912][T25039] veth0_to_bond: entered promiscuous mode [ 1726.644834][T25039] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 1726.678371][T25039] bond4: (slave macvlan2): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 1726.678483][T25039] bond4: left promiscuous mode [ 1726.678501][T25039] veth0_to_bond: left promiscuous mode [ 1726.798354][T25056] netlink: 12 bytes leftover after parsing attributes in process `syz.4.12742'. [ 1726.798420][T25056] block nbd1: Unsupported socket: should be TCP or UNIX. [ 1727.076689][T25050] netlink: 'syz.4.12742': attribute type 9 has an invalid length. [ 1727.154927][T25047] bond2: up delay (10) is not a multiple of miimon (7), value rounded to 7 ms [ 1727.179741][T25047] bond2 (unregistering): Released all slaves [ 1727.247854][T25070] netlink: 'syz.1.12746': attribute type 1 has an invalid length. [ 1727.247878][T25070] netlink: 8 bytes leftover after parsing attributes in process `syz.1.12746'. [ 1727.415937][T25055] bond5: option tlb_dynamic_lb: mode dependency failed, not supported in mode balance-rr(0) [ 1727.437073][T25055] bond5 (unregistering): Released all slaves [ 1727.531528][T25074] sctp: [Deprecated]: syz.5.12747 (pid 25074) Use of int in maxseg socket option. [ 1727.531528][T25074] Use struct sctp_assoc_value instead [ 1727.607765][T25087] FAULT_INJECTION: forcing a failure. [ 1727.607765][T25087] name failslab, interval 1, probability 0, space 0, times 0 [ 1727.607800][T25087] CPU: 0 UID: 0 PID: 25087 Comm: syz.1.12750 Not tainted syzkaller #0 PREEMPT(full) [ 1727.607825][T25087] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 1727.607839][T25087] Call Trace: [ 1727.607848][T25087] [ 1727.607858][T25087] dump_stack_lvl+0xe8/0x150 [ 1727.607899][T25087] should_fail_ex+0x3eb/0x540 [ 1727.607932][T25087] should_failslab+0xa8/0x100 [ 1727.607953][T25087] ? skb_clone+0x212/0x3a0 [ 1727.607980][T25087] kmem_cache_alloc_noprof+0x9c/0x600 [ 1727.608010][T25087] ? skb_clone+0x212/0x3a0 [ 1727.608044][T25087] skb_clone+0x212/0x3a0 [ 1727.608076][T25087] bpf_clone_redirect+0x170/0x4b0 [ 1727.608106][T25087] ? bpf_test_run+0x1d1/0x830 [ 1727.608141][T25087] bpf_prog_2f59963de350c2d2+0x5e/0x67 [ 1727.608171][T25087] ? __kernel_text_address+0xd/0x30 [ 1727.608203][T25087] ? arch_stack_walk+0xfb/0x150 [ 1727.608237][T25087] ? __pfx___schedule+0x10/0x10 [ 1727.608279][T25087] ? preempt_schedule_thunk+0x16/0x40 [ 1727.608311][T25087] ? preempt_schedule_common+0x7f/0xd0 [ 1727.608336][T25087] ? bpf_test_run+0x1d1/0x830 [ 1727.608371][T25087] ? bpf_test_timer_continue+0x114/0x390 [ 1727.608398][T25087] bpf_test_run+0x354/0x830 [ 1727.608455][T25087] ? __pfx_bpf_test_run+0x10/0x10 [ 1727.608504][T25087] ? __kasan_krealloc+0xec/0x110 [ 1727.608538][T25087] ? eth_type_trans+0x33f/0x640 [ 1727.608573][T25087] ? skb_dst_set+0x72/0x140 [ 1727.608626][T25087] bpf_prog_test_run_skb+0xe7e/0x22e0 [ 1727.608685][T25087] ? __fget_files+0x3a2/0x420 [ 1727.608710][T25087] ? __fget_files+0x2a/0x420 [ 1727.608742][T25087] ? __pfx_bpf_prog_test_run_skb+0x10/0x10 [ 1727.608775][T25087] bpf_prog_test_run+0x2c5/0x340 [ 1727.608801][T25087] __sys_bpf+0xb1e/0xe00 [ 1727.608832][T25087] ? __pfx___sys_bpf+0x10/0x10 [ 1727.608865][T25087] ? __fget_files+0x2a/0x420 [ 1727.608912][T25087] ? ksys_write+0x242/0x270 [ 1727.608947][T25087] ? __pfx_ksys_write+0x10/0x10 [ 1727.608984][T25087] __x64_sys_bpf+0xba/0xd0 [ 1727.609019][T25087] do_syscall_64+0x166/0x520 [ 1727.609046][T25087] ? trace_irq_disable+0x3b/0x140 [ 1727.609074][T25087] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1727.609098][T25087] ? clear_bhb_loop+0x70/0xc0 [ 1727.609126][T25087] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1727.609149][T25087] RIP: 0033:0x7ffbe6da8f19 [ 1727.609170][T25087] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1727.609190][T25087] RSP: 002b:00007ffbe7c9f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1727.609214][T25087] RAX: ffffffffffffffda RBX: 00007ffbe7025fa0 RCX: 00007ffbe6da8f19 [ 1727.609232][T25087] RDX: 0000000000000028 RSI: 00002000000000c0 RDI: 000000000000000a [ 1727.609247][T25087] RBP: 00007ffbe7c9f090 R08: 0000000000000000 R09: 0000000000000000 [ 1727.609262][T25087] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1727.609277][T25087] R13: 00007ffbe7026038 R14: 00007ffbe7025fa0 R15: 00007ffc3f3b3428 [ 1727.609315][T25087] [ 1727.866269][T25085] netlink: 4 bytes leftover after parsing attributes in process `syz.3.12749'. [ 1728.402466][T29247] Bluetooth: hci2: command 0x0406 tx timeout [ 1728.510653][T25111] netlink: 40 bytes leftover after parsing attributes in process `syz.2.12757'. [ 1728.531987][T25110] syzkaller0: entered promiscuous mode [ 1728.532014][T25110] syzkaller0: entered allmulticast mode [ 1728.565635][T25110] tipc: Enabled bearer , priority 0 [ 1728.589817][T25109] tipc: Resetting bearer [ 1728.684627][T25117] sctp: [Deprecated]: syz.4.12755 (pid 25117) Use of int in max_burst socket option. [ 1728.684627][T25117] Use struct sctp_assoc_value instead [ 1728.744395][T25109] tipc: Disabling bearer [ 1729.275784][T25143] vxcan2: entered allmulticast mode [ 1730.182588][T25175] syzkaller0: entered promiscuous mode [ 1730.182615][T25175] syzkaller0: entered allmulticast mode [ 1730.220007][T25169] tipc: Enabled bearer , priority 0 [ 1730.271516][T25178] syzkaller0: entered promiscuous mode [ 1730.271544][T25178] syzkaller0: entered allmulticast mode [ 1730.323431][T25168] tipc: Resetting bearer [ 1730.412648][T25168] tipc: Disabling bearer [ 1730.911624][T25212] Cannot find set identified by id 0 to match [ 1731.474213][T25230] netlink: 'syz.4.12782': attribute type 1 has an invalid length. [ 1731.780816][T25237] netlink: 12 bytes leftover after parsing attributes in process `syz.3.12783'. [ 1732.091340][T25253] FAULT_INJECTION: forcing a failure. [ 1732.091340][T25253] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1732.091374][T25253] CPU: 0 UID: 0 PID: 25253 Comm: syz.4.12789 Not tainted syzkaller #0 PREEMPT(full) [ 1732.091409][T25253] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 1732.091423][T25253] Call Trace: [ 1732.091433][T25253] [ 1732.091443][T25253] dump_stack_lvl+0xe8/0x150 [ 1732.091486][T25253] should_fail_ex+0x3eb/0x540 [ 1732.091526][T25253] _copy_to_user+0x31/0xb0 [ 1732.091563][T25253] bpf_verifier_vlog+0x3a2/0x900 [ 1732.091603][T25253] bpf_verifier_log_write+0x11d/0x1a0 [ 1732.091637][T25253] ? __pfx_bpf_verifier_log_write+0x10/0x10 [ 1732.091666][T25253] ? record_arg_access+0x14f/0xa80 [ 1732.091710][T25253] analyze_subprog+0x6cbe/0xb150 [ 1732.091800][T25253] ? __pfx_analyze_subprog+0x10/0x10 [ 1732.091830][T25253] ? kasan_save_track+0x4f/0x80 [ 1732.091861][T25253] ? kasan_save_track+0x3e/0x80 [ 1732.091891][T25253] ? __kasan_kmalloc+0x93/0xb0 [ 1732.091921][T25253] ? __kvmalloc_node_noprof+0x50a/0x820 [ 1732.091952][T25253] ? call_instance+0x263/0x560 [ 1732.091980][T25253] ? bpf_compute_subprog_arg_access+0x2cb/0x15c0 [ 1732.092010][T25253] ? bpf_compute_live_registers+0x10b0/0x1df0 [ 1732.092040][T25253] ? bpf_check+0x2d0b/0x34e0 [ 1732.092062][T25253] ? bpf_prog_load+0x14da/0x1c60 [ 1732.092084][T25253] ? __sys_bpf+0xd86/0xe00 [ 1732.092103][T25253] ? __x64_sys_bpf+0xba/0xd0 [ 1732.092133][T25253] ? mas_next_node+0xa72/0xe50 [ 1732.092157][T25253] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1732.092223][T25253] ? call_instance+0x263/0x560 [ 1732.092252][T25253] ? rcu_is_watching+0x16/0xb0 [ 1732.092286][T25253] ? call_instance+0x263/0x560 [ 1732.092314][T25253] ? trace_kmalloc+0x2a/0xf0 [ 1732.092345][T25253] ? call_instance+0x263/0x560 [ 1732.092374][T25253] ? __kvmalloc_node_noprof+0x52a/0x820 [ 1732.092408][T25253] ? __kvmalloc_node_noprof+0x340/0x820 [ 1732.092439][T25253] ? call_instance+0x263/0x560 [ 1732.092467][T25253] ? call_instance+0x263/0x560 [ 1732.092531][T25253] bpf_compute_subprog_arg_access+0x2f1/0x15c0 [ 1732.092588][T25253] ? __pfx_bpf_compute_subprog_arg_access+0x10/0x10 [ 1732.092624][T25253] ? __kvmalloc_node_noprof+0x340/0x820 [ 1732.092654][T25253] ? bpf_compute_live_registers+0x142/0x1df0 [ 1732.092683][T25253] ? bpf_compute_live_registers+0x142/0x1df0 [ 1732.092719][T25253] bpf_compute_live_registers+0x10b0/0x1df0 [ 1732.092772][T25253] ? __pfx_bpf_compute_live_registers+0x10/0x10 [ 1732.092814][T25253] bpf_check+0x2d0b/0x34e0 [ 1732.092852][T25253] ? ktime_get_with_offset+0x93/0x2d0 [ 1732.092882][T25253] ? ktime_get_with_offset+0x93/0x2d0 [ 1732.092912][T25253] ? __pfx_bpf_check+0x10/0x10 [ 1732.092939][T25253] ? bpf_obj_name_cpy+0x194/0x1e0 [ 1732.092973][T25253] bpf_prog_load+0x14da/0x1c60 [ 1732.093010][T25253] ? __pfx_bpf_prog_load+0x10/0x10 [ 1732.093051][T25253] ? __might_fault+0xaf/0x130 [ 1732.093084][T25253] __sys_bpf+0xd86/0xe00 [ 1732.093116][T25253] ? __pfx___sys_bpf+0x10/0x10 [ 1732.093152][T25253] ? __fget_files+0x2a/0x420 [ 1732.093201][T25253] ? ksys_write+0x242/0x270 [ 1732.093235][T25253] ? __pfx_ksys_write+0x10/0x10 [ 1732.093273][T25253] __x64_sys_bpf+0xba/0xd0 [ 1732.093310][T25253] do_syscall_64+0x166/0x520 [ 1732.093339][T25253] ? trace_irq_disable+0x3b/0x140 [ 1732.093371][T25253] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1732.093394][T25253] ? clear_bhb_loop+0x70/0xc0 [ 1732.093423][T25253] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1732.093446][T25253] RIP: 0033:0x7fd0925a8f19 [ 1732.093468][T25253] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1732.093488][T25253] RSP: 002b:00007fd0933a8028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1732.093521][T25253] RAX: ffffffffffffffda RBX: 00007fd092825fa0 RCX: 00007fd0925a8f19 [ 1732.093538][T25253] RDX: 0000000000000094 RSI: 0000200000000140 RDI: 0000000000000005 [ 1732.093553][T25253] RBP: 00007fd0933a8090 R08: 0000000000000000 R09: 0000000000000000 [ 1732.093568][T25253] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1732.093581][T25253] R13: 00007fd092826038 R14: 00007fd092825fa0 R15: 00007ffc3c595728 [ 1732.093618][T25253] [ 1732.205526][T25256] FAULT_INJECTION: forcing a failure. [ 1732.205526][T25256] name failslab, interval 1, probability 0, space 0, times 0 [ 1732.205555][T25256] CPU: 0 UID: 0 PID: 25256 Comm: syz.2.12791 Not tainted syzkaller #0 PREEMPT(full) [ 1732.205582][T25256] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 1732.205598][T25256] Call Trace: [ 1732.205607][T25256] [ 1732.205628][T25256] dump_stack_lvl+0xe8/0x150 [ 1732.205670][T25256] should_fail_ex+0x3eb/0x540 [ 1732.205704][T25256] should_failslab+0xa8/0x100 [ 1732.205728][T25256] __kmalloc_node_track_caller_noprof+0xf6/0x720 [ 1732.205761][T25256] ? kobject_set_name_vargs+0x61/0x110 [ 1732.205782][T25256] ? kobject_set_name_vargs+0x61/0x110 [ 1732.205812][T25256] kstrdup+0x42/0x100 [ 1732.205841][T25256] kobject_set_name_vargs+0x61/0x110 [ 1732.205867][T25256] dev_set_name+0xe2/0x140 [ 1732.205906][T25256] ? __pfx_dev_set_name+0x10/0x10 [ 1732.205938][T25256] ? __init_waitqueue_head+0xa8/0x150 [ 1732.205979][T25256] ? device_initialize+0x394/0x470 [ 1732.206005][T25256] netdev_register_kobject+0xb7/0x350 [ 1732.206046][T25256] register_netdevice+0x17be/0x2280 [ 1732.206094][T25256] ? __pfx_register_netdevice+0x10/0x10 [ 1732.206123][T25256] ? __hw_addr_insert+0x1f8/0x220 [ 1732.206149][T25256] ? dev_addr_mod+0x174/0x350 [ 1732.206182][T25256] ? dev_addr_mod+0x1ba/0x350 [ 1732.206215][T25256] ipvlan_link_new+0x3e6/0xa10 [ 1732.206243][T25256] ? rtnl_create_link+0xa04/0xd70 [ 1732.206275][T25256] ? __pfx_ipvlan_link_new+0x10/0x10 [ 1732.206306][T25256] rtnl_newlink_create+0x305/0x7b0 [ 1732.206342][T25256] ? __pfx_rtnl_newlink_create+0x10/0x10 [ 1732.206375][T25256] ? __pfx___mutex_lock+0x10/0x10 [ 1732.206425][T25256] ? ns_capable+0x84/0xe0 [ 1732.206459][T25256] rtnl_newlink+0x167a/0x1c30 [ 1732.206500][T25256] ? __pfx_rtnl_newlink+0x10/0x10 [ 1732.206522][T25256] ? __netlink_deliver_tap+0x4f1/0x6e0 [ 1732.206554][T25256] ? netlink_deliver_tap+0x19c/0x1b0 [ 1732.206588][T25256] ? netlink_unicast+0x8c1/0xa80 [ 1732.206617][T25256] ? netlink_sendmsg+0x7f0/0xb20 [ 1732.206635][T25256] ? sock_sendmsg_nosec+0x14e/0x190 [ 1732.206663][T25256] ? ____sys_sendmsg+0x54e/0x850 [ 1732.206685][T25256] ? ___sys_sendmsg+0x2a5/0x360 [ 1732.206707][T25256] ? __x64_sys_sendmsg+0x1b1/0x290 [ 1732.206784][T25256] ? do_syscall_64+0x166/0x520 [ 1732.206875][T25256] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1732.207051][T25256] ? kasan_quarantine_put+0xbb/0x1f0 [ 1732.207141][T25256] ? lockdep_hardirqs_on+0x7b/0x110 [ 1732.207225][T25256] ? nlmon_xmit+0xb0/0x100 [ 1732.207290][T25256] ? kmem_cache_free+0x182/0x650 [ 1732.207397][T25256] ? __lock_acquire+0x747/0x2de0 [ 1732.207490][T25256] ? __pfx_hook_capable+0x10/0x10 [ 1732.207543][T25256] ? __dev_queue_xmit+0x29b/0x3920 [ 1732.207626][T25256] ? __pfx_hook_capable+0x10/0x10 [ 1732.207685][T25256] ? lockdep_hardirqs_on+0x7b/0x110 [ 1732.207868][T25256] ? __pfx_rtnl_newlink+0x10/0x10 [ 1732.207925][T25256] rtnetlink_rcv_msg+0x802/0xc00 [ 1732.207999][T25256] ? rtnetlink_rcv_msg+0x1c9/0xc00 [ 1732.208055][T25256] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 1732.208128][T25256] ? __copy_skb_header+0xa3/0x4a0 [ 1732.208240][T25256] netlink_rcv_skb+0x226/0x4a0 [ 1732.208360][T25256] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 1732.208435][T25256] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 1732.208562][T25256] ? netlink_deliver_tap+0x2e/0x1b0 [ 1732.208646][T25256] ? netlink_deliver_tap+0x2e/0x1b0 [ 1732.208723][T25256] netlink_unicast+0x8ef/0xa80 [ 1732.208854][T25256] netlink_sendmsg+0x7f0/0xb20 [ 1732.208919][T25256] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1732.208983][T25256] ? aa_sock_msg_perm+0x144/0x210 [ 1732.209056][T25256] ? apparmor_socket_sendmsg+0x98/0x360 [ 1732.209142][T25256] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1732.209194][T25256] sock_sendmsg_nosec+0x14e/0x190 [ 1732.209282][T25256] ____sys_sendmsg+0x54e/0x850 [ 1732.209365][T25256] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1732.209460][T25256] ? import_iovec+0x73/0xa0 [ 1732.209544][T25256] ___sys_sendmsg+0x2a5/0x360 [ 1732.209614][T25256] ? __lock_acquire+0x747/0x2de0 [ 1732.209718][T25256] ? __pfx____sys_sendmsg+0x10/0x10 [ 1732.209888][T25256] ? __fget_files+0x3a2/0x420 [ 1732.209960][T25256] ? __fget_files+0x2a/0x420 [ 1732.210057][T25256] __x64_sys_sendmsg+0x1b1/0x290 [ 1732.210132][T25256] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1732.210267][T25256] do_syscall_64+0x166/0x520 [ 1732.210343][T25256] ? trace_irq_disable+0x3b/0x140 [ 1732.210425][T25256] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1732.210478][T25256] ? clear_bhb_loop+0x70/0xc0 [ 1732.210550][T25256] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1732.210611][T25256] RIP: 0033:0x7f55c61a8f19 [ 1732.210664][T25256] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1732.210715][T25256] RSP: 002b:00007f55c6fee028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1732.210772][T25256] RAX: ffffffffffffffda RBX: 00007f55c6425fa0 RCX: 00007f55c61a8f19 [ 1732.210813][T25256] RDX: 0000000000000000 RSI: 0000200000000080 RDI: 0000000000000003 [ 1732.210863][T25256] RBP: 00007f55c6fee090 R08: 0000000000000000 R09: 0000000000000000 [ 1732.210899][T25256] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1732.210938][T25256] R13: 00007f55c6426038 R14: 00007f55c6425fa0 R15: 00007fffd45187a8 [ 1732.211047][T25256] [ 1733.303145][T25268] netlink: 'syz.1.12790': attribute type 1 has an invalid length. [ 1733.383261][T25268] 8021q: adding VLAN 0 to HW filter on device bond9 [ 1733.634346][T25276] bond3: (slave wlan1): Releasing active interface [ 1733.666859][T25276] bond9: (slave wlan1): Enslaving as an active interface with a down link [ 1733.723497][T25284] syzkaller0: entered promiscuous mode [ 1733.723523][T25284] syzkaller0: entered allmulticast mode [ 1733.819908][T25265] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1734.119540][T25283] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1734.300362][T25312] netlink: 12 bytes leftover after parsing attributes in process `syz.3.12803'. [ 1734.316167][T19300] block nbd1: Receive control failed (result -107) [ 1734.396714][T25283] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1734.599245][T25321] FAULT_INJECTION: forcing a failure. [ 1734.599245][T25321] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1734.599279][T25321] CPU: 0 UID: 0 PID: 25321 Comm: syz.1.12804 Not tainted syzkaller #0 PREEMPT(full) [ 1734.599304][T25321] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 1734.599321][T25321] Call Trace: [ 1734.599331][T25321] [ 1734.599342][T25321] dump_stack_lvl+0xe8/0x150 [ 1734.599385][T25321] should_fail_ex+0x3eb/0x540 [ 1734.599419][T25321] _copy_to_user+0x31/0xb0 [ 1734.599452][T25321] bpf_verifier_vlog+0x3a2/0x900 [ 1734.599492][T25321] verbose+0x11d/0x1a0 [ 1734.599530][T25321] ? __pfx_verbose+0x10/0x10 [ 1734.599564][T25321] ? lock_acquire+0x115/0x350 [ 1734.599603][T25321] print_bpf_insn+0x15bb/0x2a90 [ 1734.599632][T25321] ? __pfx_verbose+0x10/0x10 [ 1734.599668][T25321] ? __pfx_print_bpf_insn+0x10/0x10 [ 1734.599694][T25321] ? _copy_to_user+0x8a/0xb0 [ 1734.599726][T25321] ? bpf_verifier_vlog+0x55a/0x900 [ 1734.599763][T25321] ? bpf_verifier_log_write+0x11d/0x1a0 [ 1734.599793][T25321] bpf_verbose_insn+0xcb/0x130 [ 1734.599827][T25321] ? __pfx_bpf_verbose_insn+0x10/0x10 [ 1734.599859][T25321] ? __pfx_verbose+0x10/0x10 [ 1734.599886][T25321] ? __pfx_bpf_disasm_kfunc_name+0x10/0x10 [ 1734.599918][T25321] ? record_arg_access+0x14f/0xa80 [ 1734.599958][T25321] analyze_subprog+0x6cce/0xb150 [ 1734.600046][T25321] ? __pfx_analyze_subprog+0x10/0x10 [ 1734.600076][T25321] ? kasan_save_track+0x4f/0x80 [ 1734.600107][T25321] ? kasan_save_track+0x3e/0x80 [ 1734.600136][T25321] ? __kasan_kmalloc+0x93/0xb0 [ 1734.600167][T25321] ? __kvmalloc_node_noprof+0x50a/0x820 [ 1734.600205][T25321] ? call_instance+0x263/0x560 [ 1734.600232][T25321] ? bpf_compute_subprog_arg_access+0x2cb/0x15c0 [ 1734.600261][T25321] ? bpf_compute_live_registers+0x10b0/0x1df0 [ 1734.600289][T25321] ? bpf_check+0x2d0b/0x34e0 [ 1734.600312][T25321] ? bpf_prog_load+0x14da/0x1c60 [ 1734.600333][T25321] ? __sys_bpf+0xd86/0xe00 [ 1734.600352][T25321] ? __x64_sys_bpf+0xba/0xd0 [ 1734.600382][T25321] ? mas_next_node+0xa72/0xe50 [ 1734.600405][T25321] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1734.600470][T25321] ? call_instance+0x263/0x560 [ 1734.600497][T25321] ? rcu_is_watching+0x16/0xb0 [ 1734.600531][T25321] ? call_instance+0x263/0x560 [ 1734.600558][T25321] ? trace_kmalloc+0x2a/0xf0 [ 1734.600588][T25321] ? call_instance+0x263/0x560 [ 1734.600616][T25321] ? __kvmalloc_node_noprof+0x52a/0x820 [ 1734.600650][T25321] ? __kvmalloc_node_noprof+0x340/0x820 [ 1734.600680][T25321] ? call_instance+0x263/0x560 [ 1734.600708][T25321] ? call_instance+0x263/0x560 [ 1734.600754][T25321] bpf_compute_subprog_arg_access+0x2f1/0x15c0 [ 1734.600810][T25321] ? __pfx_bpf_compute_subprog_arg_access+0x10/0x10 [ 1734.600848][T25321] ? __kvmalloc_node_noprof+0x340/0x820 [ 1734.600879][T25321] ? bpf_compute_live_registers+0x142/0x1df0 [ 1734.600907][T25321] ? bpf_compute_live_registers+0x142/0x1df0 [ 1734.600941][T25321] bpf_compute_live_registers+0x10b0/0x1df0 [ 1734.600993][T25321] ? __pfx_bpf_compute_live_registers+0x10/0x10 [ 1734.601035][T25321] bpf_check+0x2d0b/0x34e0 [ 1734.601071][T25321] ? ktime_get_with_offset+0x93/0x2d0 [ 1734.601102][T25321] ? ktime_get_with_offset+0x93/0x2d0 [ 1734.601133][T25321] ? __pfx_bpf_check+0x10/0x10 [ 1734.601160][T25321] ? bpf_obj_name_cpy+0x194/0x1e0 [ 1734.601202][T25321] bpf_prog_load+0x14da/0x1c60 [ 1734.601237][T25321] ? __pfx_bpf_prog_load+0x10/0x10 [ 1734.601274][T25321] ? __might_fault+0xaf/0x130 [ 1734.601304][T25321] __sys_bpf+0xd86/0xe00 [ 1734.601333][T25321] ? __pfx___sys_bpf+0x10/0x10 [ 1734.601365][T25321] ? __fget_files+0x2a/0x420 [ 1734.601410][T25321] ? ksys_write+0x242/0x270 [ 1734.601443][T25321] ? __pfx_ksys_write+0x10/0x10 [ 1734.601478][T25321] __x64_sys_bpf+0xba/0xd0 [ 1734.601515][T25321] do_syscall_64+0x166/0x520 [ 1734.601543][T25321] ? trace_irq_disable+0x3b/0x140 [ 1734.601574][T25321] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1734.601597][T25321] ? clear_bhb_loop+0x70/0xc0 [ 1734.601625][T25321] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1734.601654][T25321] RIP: 0033:0x7ffbe6da8f19 [ 1734.601676][T25321] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1734.601695][T25321] RSP: 002b:00007ffbe7c9f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1734.601719][T25321] RAX: ffffffffffffffda RBX: 00007ffbe7025fa0 RCX: 00007ffbe6da8f19 [ 1734.601736][T25321] RDX: 0000000000000094 RSI: 0000200000000140 RDI: 0000000000000005 [ 1734.601750][T25321] RBP: 00007ffbe7c9f090 R08: 0000000000000000 R09: 0000000000000000 [ 1734.601764][T25321] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1734.601777][T25321] R13: 00007ffbe7026038 R14: 00007ffbe7025fa0 R15: 00007ffc3f3b3428 [ 1734.601814][T25321] [ 1735.201568][T25283] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1735.340227][T25283] netdevsim netdevsim5 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1735.445851][T25332] netlink: 16 bytes leftover after parsing attributes in process `syz.1.12809'. [ 1735.595480][T25336] netlink: 8 bytes leftover after parsing attributes in process `syz.1.12811'. [ 1735.595505][T25336] netlink: 8 bytes leftover after parsing attributes in process `syz.1.12811'. [ 1735.747032][ T9445] netdevsim netdevsim5 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1735.747083][ T9445] netdevsim netdevsim5 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1735.807252][ T1373] netdevsim netdevsim5 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1735.807319][ T1373] netdevsim netdevsim5 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1735.897872][T25344] netlink: 16 bytes leftover after parsing attributes in process `syz.1.12812'. [ 1736.077892][T25359] FAULT_INJECTION: forcing a failure. [ 1736.077892][T25359] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1736.077926][T25359] CPU: 0 UID: 0 PID: 25359 Comm: syz.2.12816 Not tainted syzkaller #0 PREEMPT(full) [ 1736.077951][T25359] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 1736.077964][T25359] Call Trace: [ 1736.077973][T25359] [ 1736.077983][T25359] dump_stack_lvl+0xe8/0x150 [ 1736.078028][T25359] should_fail_ex+0x3eb/0x540 [ 1736.078061][T25359] _copy_to_user+0x31/0xb0 [ 1736.078093][T25359] bpf_verifier_vlog+0x3a2/0x900 [ 1736.078133][T25359] bpf_verifier_log_write+0x11d/0x1a0 [ 1736.078174][T25359] ? __pfx_bpf_verifier_log_write+0x10/0x10 [ 1736.078204][T25359] ? record_arg_access+0x14f/0xa80 [ 1736.078247][T25359] analyze_subprog+0x7888/0xb150 [ 1736.078334][T25359] ? __pfx_analyze_subprog+0x10/0x10 [ 1736.078362][T25359] ? kasan_save_track+0x4f/0x80 [ 1736.078393][T25359] ? kasan_save_track+0x3e/0x80 [ 1736.078423][T25359] ? __kasan_kmalloc+0x93/0xb0 [ 1736.078453][T25359] ? __kvmalloc_node_noprof+0x50a/0x820 [ 1736.078485][T25359] ? call_instance+0x263/0x560 [ 1736.078512][T25359] ? bpf_compute_subprog_arg_access+0x2cb/0x15c0 [ 1736.078542][T25359] ? bpf_compute_live_registers+0x10b0/0x1df0 [ 1736.078573][T25359] ? bpf_check+0x2d0b/0x34e0 [ 1736.078595][T25359] ? bpf_prog_load+0x14da/0x1c60 [ 1736.078617][T25359] ? __sys_bpf+0xd86/0xe00 [ 1736.078636][T25359] ? __x64_sys_bpf+0xba/0xd0 [ 1736.078666][T25359] ? mas_next_node+0xa72/0xe50 [ 1736.078689][T25359] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1736.078755][T25359] ? call_instance+0x263/0x560 [ 1736.078785][T25359] ? rcu_is_watching+0x16/0xb0 [ 1736.078816][T25359] ? call_instance+0x263/0x560 [ 1736.078842][T25359] ? trace_kmalloc+0x2a/0xf0 [ 1736.078872][T25359] ? call_instance+0x263/0x560 [ 1736.078900][T25359] ? __kvmalloc_node_noprof+0x52a/0x820 [ 1736.078934][T25359] ? __kvmalloc_node_noprof+0x340/0x820 [ 1736.078965][T25359] ? call_instance+0x263/0x560 [ 1736.078992][T25359] ? call_instance+0x263/0x560 [ 1736.079040][T25359] bpf_compute_subprog_arg_access+0x2f1/0x15c0 [ 1736.079093][T25359] ? __pfx_bpf_compute_subprog_arg_access+0x10/0x10 [ 1736.079131][T25359] ? __kvmalloc_node_noprof+0x340/0x820 [ 1736.079170][T25359] ? bpf_compute_live_registers+0x142/0x1df0 [ 1736.079197][T25359] ? bpf_compute_live_registers+0x142/0x1df0 [ 1736.079237][T25359] bpf_compute_live_registers+0x10b0/0x1df0 [ 1736.079292][T25359] ? __pfx_bpf_compute_live_registers+0x10/0x10 [ 1736.079334][T25359] bpf_check+0x2d0b/0x34e0 [ 1736.079368][T25359] ? ktime_get_with_offset+0x93/0x2d0 [ 1736.079400][T25359] ? ktime_get_with_offset+0x93/0x2d0 [ 1736.079429][T25359] ? __pfx_bpf_check+0x10/0x10 [ 1736.079456][T25359] ? bpf_obj_name_cpy+0x194/0x1e0 [ 1736.079489][T25359] bpf_prog_load+0x14da/0x1c60 [ 1736.079525][T25359] ? __pfx_bpf_prog_load+0x10/0x10 [ 1736.079558][T25359] ? __might_fault+0xaf/0x130 [ 1736.079589][T25359] __sys_bpf+0xd86/0xe00 [ 1736.079616][T25359] ? __pfx___sys_bpf+0x10/0x10 [ 1736.079650][T25359] ? __fget_files+0x2a/0x420 [ 1736.079692][T25359] ? ksys_write+0x242/0x270 [ 1736.079724][T25359] ? __pfx_ksys_write+0x10/0x10 [ 1736.079759][T25359] __x64_sys_bpf+0xba/0xd0 [ 1736.079791][T25359] do_syscall_64+0x166/0x520 [ 1736.079819][T25359] ? trace_irq_disable+0x3b/0x140 [ 1736.079849][T25359] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1736.079873][T25359] ? clear_bhb_loop+0x70/0xc0 [ 1736.079901][T25359] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1736.079923][T25359] RIP: 0033:0x7f55c61a8f19 [ 1736.079945][T25359] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1736.079965][T25359] RSP: 002b:00007f55c6fee028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1736.079989][T25359] RAX: ffffffffffffffda RBX: 00007f55c6425fa0 RCX: 00007f55c61a8f19 [ 1736.080006][T25359] RDX: 0000000000000094 RSI: 0000200000000140 RDI: 0000000000000005 [ 1736.080020][T25359] RBP: 00007f55c6fee090 R08: 0000000000000000 R09: 0000000000000000 [ 1736.080033][T25359] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1736.080045][T25359] R13: 00007f55c6426038 R14: 00007f55c6425fa0 R15: 00007fffd45187a8 [ 1736.080078][T25359] [ 1736.292775][ T12] IPVS: starting estimator thread 0... [ 1736.388271][T25363] IPVS: using max 25 ests per chain, 60000 per kthread [ 1736.833528][T25375] sctp: [Deprecated]: syz.2.12820 (pid 25375) Use of int in maxseg socket option. [ 1736.833528][T25375] Use struct sctp_assoc_value instead [ 1737.040935][T25386] netlink: 'syz.4.12823': attribute type 46 has an invalid length. [ 1737.741162][T25382] netlink: 16 bytes leftover after parsing attributes in process `syz.5.12824'. [ 1738.194938][T25423] FAULT_INJECTION: forcing a failure. [ 1738.194938][T25423] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1738.194972][T25423] CPU: 1 UID: 0 PID: 25423 Comm: syz.1.12829 Not tainted syzkaller #0 PREEMPT(full) [ 1738.194998][T25423] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 1738.195013][T25423] Call Trace: [ 1738.195022][T25423] [ 1738.195032][T25423] dump_stack_lvl+0xe8/0x150 [ 1738.195075][T25423] should_fail_ex+0x3eb/0x540 [ 1738.195109][T25423] _copy_to_user+0x31/0xb0 [ 1738.195142][T25423] bpf_verifier_vlog+0x3a2/0x900 [ 1738.195182][T25423] bpf_verifier_log_write+0x11d/0x1a0 [ 1738.195220][T25423] ? __pfx_bpf_verifier_log_write+0x10/0x10 [ 1738.195246][T25423] ? __kvmalloc_node_noprof+0x52a/0x820 [ 1738.195281][T25423] ? record_arg_access+0x14f/0xa80 [ 1738.195323][T25423] analyze_subprog+0x6cbe/0xb150 [ 1738.195421][T25423] ? __pfx_analyze_subprog+0x10/0x10 [ 1738.195453][T25423] ? kasan_save_track+0x4f/0x80 [ 1738.195484][T25423] ? kasan_save_track+0x3e/0x80 [ 1738.195513][T25423] ? __kasan_kmalloc+0x93/0xb0 [ 1738.195545][T25423] ? __kvmalloc_node_noprof+0x50a/0x820 [ 1738.195575][T25423] ? call_instance+0x263/0x560 [ 1738.195602][T25423] ? bpf_compute_subprog_arg_access+0x2cb/0x15c0 [ 1738.195633][T25423] ? bpf_compute_live_registers+0x10b0/0x1df0 [ 1738.195664][T25423] ? bpf_check+0x2d0b/0x34e0 [ 1738.195686][T25423] ? bpf_prog_load+0x14da/0x1c60 [ 1738.195707][T25423] ? __sys_bpf+0xd86/0xe00 [ 1738.195727][T25423] ? __x64_sys_bpf+0xba/0xd0 [ 1738.195757][T25423] ? mas_next_node+0xa72/0xe50 [ 1738.195780][T25423] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1738.195847][T25423] ? call_instance+0x263/0x560 [ 1738.195875][T25423] ? rcu_is_watching+0x16/0xb0 [ 1738.195907][T25423] ? call_instance+0x263/0x560 [ 1738.195933][T25423] ? trace_kmalloc+0x2a/0xf0 [ 1738.195969][T25423] ? call_instance+0x263/0x560 [ 1738.195997][T25423] ? __kvmalloc_node_noprof+0x52a/0x820 [ 1738.196031][T25423] ? __kvmalloc_node_noprof+0x340/0x820 [ 1738.196062][T25423] ? call_instance+0x263/0x560 [ 1738.196090][T25423] ? call_instance+0x263/0x560 [ 1738.196138][T25423] bpf_compute_subprog_arg_access+0x2f1/0x15c0 [ 1738.196195][T25423] ? __pfx_bpf_compute_subprog_arg_access+0x10/0x10 [ 1738.196234][T25423] ? __kvmalloc_node_noprof+0x340/0x820 [ 1738.196265][T25423] ? bpf_compute_live_registers+0x142/0x1df0 [ 1738.196295][T25423] ? bpf_compute_live_registers+0x142/0x1df0 [ 1738.196334][T25423] bpf_compute_live_registers+0x10b0/0x1df0 [ 1738.196388][T25423] ? __pfx_bpf_compute_live_registers+0x10/0x10 [ 1738.196442][T25423] bpf_check+0x2d0b/0x34e0 [ 1738.196478][T25423] ? ktime_get_with_offset+0x93/0x2d0 [ 1738.196511][T25423] ? ktime_get_with_offset+0x93/0x2d0 [ 1738.196543][T25423] ? __pfx_bpf_check+0x10/0x10 [ 1738.196571][T25423] ? bpf_obj_name_cpy+0x194/0x1e0 [ 1738.196605][T25423] bpf_prog_load+0x14da/0x1c60 [ 1738.196641][T25423] ? __pfx_bpf_prog_load+0x10/0x10 [ 1738.196680][T25423] ? __might_fault+0xaf/0x130 [ 1738.196711][T25423] __sys_bpf+0xd86/0xe00 [ 1738.196741][T25423] ? __pfx___sys_bpf+0x10/0x10 [ 1738.196774][T25423] ? __fget_files+0x2a/0x420 [ 1738.196819][T25423] ? ksys_write+0x242/0x270 [ 1738.196852][T25423] ? __pfx_ksys_write+0x10/0x10 [ 1738.196889][T25423] __x64_sys_bpf+0xba/0xd0 [ 1738.196925][T25423] do_syscall_64+0x166/0x520 [ 1738.196954][T25423] ? trace_irq_disable+0x3b/0x140 [ 1738.196990][T25423] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1738.197013][T25423] ? clear_bhb_loop+0x70/0xc0 [ 1738.197040][T25423] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1738.197063][T25423] RIP: 0033:0x7ffbe6da8f19 [ 1738.197085][T25423] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1738.197106][T25423] RSP: 002b:00007ffbe7c9f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1738.197131][T25423] RAX: ffffffffffffffda RBX: 00007ffbe7025fa0 RCX: 00007ffbe6da8f19 [ 1738.197149][T25423] RDX: 0000000000000094 RSI: 0000200000000140 RDI: 0000000000000005 [ 1738.197163][T25423] RBP: 00007ffbe7c9f090 R08: 0000000000000000 R09: 0000000000000000 [ 1738.197179][T25423] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1738.197193][T25423] R13: 00007ffbe7026038 R14: 00007ffbe7025fa0 R15: 00007ffc3f3b3428 [ 1738.197230][T25423] [ 1738.641679][T24135] Bluetooth: hci5: command 0x0406 tx timeout [ 1738.830996][T25431] netlink: 40 bytes leftover after parsing attributes in process `syz.2.12833'. [ 1738.988474][T25435] netlink: 'syz.5.12834': attribute type 3 has an invalid length. [ 1738.988502][T25435] netlink: 666 bytes leftover after parsing attributes in process `syz.5.12834'. [ 1739.180146][T25443] syzkaller0: entered promiscuous mode [ 1739.180173][T25443] syzkaller0: entered allmulticast mode [ 1739.294040][T25446] netlink: 12 bytes leftover after parsing attributes in process `syz.2.12837'. [ 1739.459846][T25446] netlink: 8 bytes leftover after parsing attributes in process `syz.2.12837'. [ 1739.459873][T25446] netlink: 24 bytes leftover after parsing attributes in process `syz.2.12837'. [ 1739.520294][T25456] netlink: 28 bytes leftover after parsing attributes in process `syz.5.12839'. [ 1739.520355][T25456] netlink: 28 bytes leftover after parsing attributes in process `syz.5.12839'. [ 1739.520376][T25456] netlink: 24 bytes leftover after parsing attributes in process `syz.5.12839'. [ 1739.558625][T25454] netlink: 4 bytes leftover after parsing attributes in process `syz.4.12840'. [ 1739.576212][T25455] net_ratelimit: 66 callbacks suppressed [ 1739.576234][T25455] openvswitch: netlink: IP tunnel dst address not specified [ 1739.607746][T25446] veth7: entered allmulticast mode [ 1739.640910][T25446] bond5: (slave veth7): Enslaving as an active interface with an up link [ 1739.733691][T25448] bond5 (unregistering): (slave veth7): Releasing backup interface [ 1739.796966][T25448] bond5 (unregistering): Released all slaves [ 1740.001624][T25454] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1740.048022][T25454] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1740.512696][T25495] batman_adv: batadv0: Adding interface: veth0 [ 1740.512717][T25495] batman_adv: batadv0: The MTU of interface veth0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1740.512754][T25495] batman_adv: batadv0: Interface activated: veth0 [ 1740.601250][T25495] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1740.601281][T25495] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1740.603464][T25495] batman_adv: batadv0: Interface deactivated: gretap1 [ 1740.603488][T25495] batman_adv: batadv0: Removing interface: gretap1 [ 1740.606349][T25495] batman_adv: batadv0: Interface deactivated: veth0 [ 1740.606370][T25495] batman_adv: batadv0: Removing interface: veth0 [ 1740.825238][T25503] batman_adv: batadv0: Adding interface: veth0 [ 1740.825259][T25503] batman_adv: batadv0: The MTU of interface veth0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1740.825309][T25503] batman_adv: batadv0: Interface activated: veth0 [ 1740.825328][T25503] batadv0: mtu less than device minimum [ 1740.826894][T25503] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum table response size (-320) [ 1740.830566][T25503] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum table response size (-320) [ 1740.834215][T25503] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum table response size (-320) [ 1740.837905][T25503] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum table response size (-320) [ 1740.841455][T25503] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum table response size (-320) [ 1740.844995][T25503] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum table response size (-320) [ 1740.848833][T25503] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum table response size (-320) [ 1740.852306][T25503] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum table response size (-320) [ 1741.143693][T25503] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1741.178766][T25503] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1741.204953][T25503] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1741.381844][T25503] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1741.400176][T25503] batman_adv: batadv0: Interface deactivated: dummy0 [ 1741.400203][T25503] batman_adv: batadv0: Removing interface: dummy0 [ 1741.422798][T25503] batman_adv: batadv0: Interface deactivated: veth0 [ 1741.422823][T25503] batman_adv: batadv0: Removing interface: veth0 [ 1741.736208][T25525] bond0: entered promiscuous mode [ 1741.736234][T25525] bond_slave_0: entered promiscuous mode [ 1741.748644][T25525] bond_slave_1: entered promiscuous mode [ 1741.752464][T25525] batadv0: entered promiscuous mode [ 1741.774330][T25525] 8021q: adding VLAN 0 to HW filter on device hsr1 [ 1741.791144][T25525] bond0: left promiscuous mode [ 1741.791170][T25525] bond_slave_0: left promiscuous mode [ 1741.791416][T25525] bond_slave_1: left promiscuous mode [ 1741.795134][T25525] batadv0: left promiscuous mode [ 1742.711786][T25560] bridge_slave_0: left allmulticast mode [ 1742.711817][T25560] bridge_slave_0: left promiscuous mode [ 1742.735683][T25560] bridge0: port 1(bridge_slave_0) entered disabled state [ 1742.778072][T25560] bridge_slave_1: left allmulticast mode [ 1742.778102][T25560] bridge_slave_1: left promiscuous mode [ 1742.778407][T25560] bridge0: port 2(bridge_slave_1) entered disabled state [ 1742.829232][T25583] FAULT_INJECTION: forcing a failure. [ 1742.829232][T25583] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1742.829267][T25583] CPU: 0 UID: 0 PID: 25583 Comm: syz.1.12869 Not tainted syzkaller #0 PREEMPT(full) [ 1742.829293][T25583] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 1742.829311][T25583] Call Trace: [ 1742.829320][T25583] [ 1742.829331][T25583] dump_stack_lvl+0xe8/0x150 [ 1742.829374][T25583] should_fail_ex+0x3eb/0x540 [ 1742.829409][T25583] _copy_to_user+0x31/0xb0 [ 1742.829443][T25583] bpf_verifier_vlog+0x3a2/0x900 [ 1742.829485][T25583] bpf_verifier_log_write+0x11d/0x1a0 [ 1742.829520][T25583] ? __pfx_bpf_verifier_log_write+0x10/0x10 [ 1742.829546][T25583] ? __kvmalloc_node_noprof+0x52a/0x820 [ 1742.829580][T25583] ? record_arg_access+0x14f/0xa80 [ 1742.829623][T25583] analyze_subprog+0x7888/0xb150 [ 1742.829715][T25583] ? __pfx_analyze_subprog+0x10/0x10 [ 1742.829744][T25583] ? kasan_save_track+0x4f/0x80 [ 1742.829774][T25583] ? kasan_save_track+0x3e/0x80 [ 1742.829801][T25583] ? __kasan_kmalloc+0x93/0xb0 [ 1742.829832][T25583] ? __kvmalloc_node_noprof+0x50a/0x820 [ 1742.829861][T25583] ? call_instance+0x263/0x560 [ 1742.829889][T25583] ? bpf_compute_subprog_arg_access+0x2cb/0x15c0 [ 1742.829918][T25583] ? bpf_compute_live_registers+0x10b0/0x1df0 [ 1742.829947][T25583] ? bpf_check+0x2d0b/0x34e0 [ 1742.829970][T25583] ? bpf_prog_load+0x14da/0x1c60 [ 1742.829991][T25583] ? __sys_bpf+0xd86/0xe00 [ 1742.830011][T25583] ? __x64_sys_bpf+0xba/0xd0 [ 1742.830041][T25583] ? mas_next_node+0xa72/0xe50 [ 1742.830065][T25583] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1742.830133][T25583] ? call_instance+0x263/0x560 [ 1742.830162][T25583] ? rcu_is_watching+0x16/0xb0 [ 1742.830196][T25583] ? call_instance+0x263/0x560 [ 1742.830231][T25583] ? trace_kmalloc+0x2a/0xf0 [ 1742.830262][T25583] ? call_instance+0x263/0x560 [ 1742.830291][T25583] ? __kvmalloc_node_noprof+0x52a/0x820 [ 1742.830325][T25583] ? __kvmalloc_node_noprof+0x340/0x820 [ 1742.830356][T25583] ? call_instance+0x263/0x560 [ 1742.830384][T25583] ? call_instance+0x263/0x560 [ 1742.830438][T25583] bpf_compute_subprog_arg_access+0x2f1/0x15c0 [ 1742.830498][T25583] ? __pfx_bpf_compute_subprog_arg_access+0x10/0x10 [ 1742.830538][T25583] ? __kvmalloc_node_noprof+0x340/0x820 [ 1742.830569][T25583] ? bpf_compute_live_registers+0x142/0x1df0 [ 1742.830599][T25583] ? bpf_compute_live_registers+0x142/0x1df0 [ 1742.830638][T25583] bpf_compute_live_registers+0x10b0/0x1df0 [ 1742.830697][T25583] ? __pfx_bpf_compute_live_registers+0x10/0x10 [ 1742.830743][T25583] bpf_check+0x2d0b/0x34e0 [ 1742.830787][T25583] ? ktime_get_with_offset+0x93/0x2d0 [ 1742.830820][T25583] ? ktime_get_with_offset+0x93/0x2d0 [ 1742.830853][T25583] ? __pfx_bpf_check+0x10/0x10 [ 1742.830881][T25583] ? bpf_obj_name_cpy+0x194/0x1e0 [ 1742.830916][T25583] bpf_prog_load+0x14da/0x1c60 [ 1742.830955][T25583] ? __pfx_bpf_prog_load+0x10/0x10 [ 1742.830998][T25583] ? __might_fault+0xaf/0x130 [ 1742.831032][T25583] __sys_bpf+0xd86/0xe00 [ 1742.831066][T25583] ? __pfx___sys_bpf+0x10/0x10 [ 1742.831102][T25583] ? __fget_files+0x2a/0x420 [ 1742.831153][T25583] ? ksys_write+0x242/0x270 [ 1742.831188][T25583] ? __pfx_ksys_write+0x10/0x10 [ 1742.831233][T25583] __x64_sys_bpf+0xba/0xd0 [ 1742.831271][T25583] do_syscall_64+0x166/0x520 [ 1742.831301][T25583] ? trace_irq_disable+0x3b/0x140 [ 1742.831333][T25583] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1742.831357][T25583] ? clear_bhb_loop+0x70/0xc0 [ 1742.831386][T25583] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1742.831409][T25583] RIP: 0033:0x7ffbe6da8f19 [ 1742.831431][T25583] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1742.831452][T25583] RSP: 002b:00007ffbe7c9f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1742.831476][T25583] RAX: ffffffffffffffda RBX: 00007ffbe7025fa0 RCX: 00007ffbe6da8f19 [ 1742.831494][T25583] RDX: 0000000000000094 RSI: 0000200000000140 RDI: 0000000000000005 [ 1742.831509][T25583] RBP: 00007ffbe7c9f090 R08: 0000000000000000 R09: 0000000000000000 [ 1742.831524][T25583] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1742.831538][T25583] R13: 00007ffbe7026038 R14: 00007ffbe7025fa0 R15: 00007ffc3f3b3428 [ 1742.831576][T25583] [ 1743.314439][T25560] bond0: (slave bond_slave_0): Releasing backup interface [ 1743.333223][T25560] bond_slave_0: left promiscuous mode [ 1743.373770][T25560] bond0: (slave bond_slave_1): Releasing backup interface [ 1743.395352][T25560] bond_slave_1: left promiscuous mode [ 1743.467900][T25560] team0: Port device team_slave_0 removed [ 1743.490972][T25585] netlink: 'syz.2.12871': attribute type 1 has an invalid length. [ 1743.525972][T25560] team0: Port device team_slave_1 removed [ 1743.691333][T25585] 8021q: adding VLAN 0 to HW filter on device bond5 [ 1743.790187][T25590] bond4: (slave wlan1): Releasing active interface [ 1743.838813][T25590] bond5: (slave wlan1): Enslaving as an active interface with a down link [ 1743.919491][T25584] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1744.105087][T25613] syzkaller1: entered allmulticast mode [ 1744.481714][T25630] netlink: 'syz.5.12882': attribute type 1 has an invalid length. [ 1744.520950][T25630] bond2: entered promiscuous mode [ 1744.521514][T25630] 8021q: adding VLAN 0 to HW filter on device bond2 [ 1744.580984][T25630] 8021q: adding VLAN 0 to HW filter on device bond2 [ 1744.581590][T25630] bond2: (slave ip6gre1): The slave device specified does not support setting the MAC address [ 1744.581616][T25630] bond2: (slave ip6gre1): Setting fail_over_mac to active for active-backup mode [ 1744.618874][T25630] bond2: (slave ip6gre1): making interface the new active one [ 1744.618903][T25630] ip6gre1: entered promiscuous mode [ 1744.644364][T25630] bond2: (slave ip6gre1): Enslaving as an active interface with an up link [ 1744.933607][T25648] __nla_validate_parse: 1 callbacks suppressed [ 1744.933627][T25648] netlink: 52 bytes leftover after parsing attributes in process `syz.5.12885'. [ 1744.954364][T25649] netlink: 52 bytes leftover after parsing attributes in process `syz.5.12885'. [ 1756.194895][T26011] netlink: 36 bytes leftover after parsing attributes in process `syz.4.12896'. [ 1756.225914][T26013] netlink: 'syz.1.12897': attribute type 1 has an invalid length. [ 1756.331221][T26013] 8021q: adding VLAN 0 to HW filter on device bond10 [ 1756.469175][T26027] netlink: 'syz.2.12899': attribute type 1 has an invalid length. [ 1756.680345][T26027] bond6: entered promiscuous mode [ 1756.680832][T26027] 8021q: adding VLAN 0 to HW filter on device bond6 [ 1756.739161][T26045] netlink: 96 bytes leftover after parsing attributes in process `syz.3.12901'. [ 1756.854787][T26049] syz_tun: entered allmulticast mode [ 1756.892020][T26049] syzkaller1: entered promiscuous mode [ 1756.892046][T26049] syzkaller1: entered allmulticast mode [ 1757.117124][T26047] syz_tun: left allmulticast mode [ 1757.441275][T26064] netlink: 16 bytes leftover after parsing attributes in process `syz.4.12906'. [ 1758.395788][T26095] vlan3: entered promiscuous mode [ 1758.395828][T26095] bridge0: entered promiscuous mode [ 1758.974159][T26117] syzkaller0: entered promiscuous mode [ 1758.974186][T26117] syzkaller0: entered allmulticast mode [ 1759.117076][T29247] Bluetooth: hci4: command 0x0406 tx timeout [ 1759.543744][T26148] syzkaller1: entered allmulticast mode [ 1759.580191][T26139] netlink: 224 bytes leftover after parsing attributes in process `syz.4.12924'. [ 1759.629898][T26130] syzkaller1: left allmulticast mode [ 1760.446928][T26170] netlink: 28 bytes leftover after parsing attributes in process `syz.4.12930'. [ 1760.447862][T26170] netlink: 8 bytes leftover after parsing attributes in process `syz.4.12930'. [ 1760.590862][T26175] netlink: 'syz.3.12931': attribute type 1 has an invalid length. [ 1760.702523][T26175] veth7: entered allmulticast mode [ 1760.718381][T26175] bond5: (slave veth7): Enslaving as an active interface with a down link [ 1760.763287][T26175] bond4: (slave veth0_to_bond): Releasing active interface [ 1760.797162][T26175] bond5: (slave veth0_to_bond): making interface the new active one [ 1760.798081][T26175] bond5: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 1760.865778][T26175] macvlan2: entered promiscuous mode [ 1760.866409][T26175] bond5: entered promiscuous mode [ 1760.879429][T26175] veth0_to_bond: entered promiscuous mode [ 1760.881264][T26175] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 1760.882332][T26175] bond5: (slave macvlan2): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 1760.882427][T26175] bond5: left promiscuous mode [ 1760.882444][T26175] veth0_to_bond: left promiscuous mode [ 1761.069030][T26195] netlink: 4 bytes leftover after parsing attributes in process `syz.5.12935'. [ 1761.273711][T26209] tipc: Failed to remove unknown binding: 66,0,2/0:2332814697/2332814698 [ 1761.279265][T26209] tipc: Failed to remove unknown binding: 66,0,2/0:2332814697/2332814698 [ 1761.363725][T26211] netlink: 8 bytes leftover after parsing attributes in process `syz.4.12938'. [ 1761.363751][T26211] netlink: 24 bytes leftover after parsing attributes in process `syz.4.12938'. [ 1761.409944][T26217] FAULT_INJECTION: forcing a failure. [ 1761.409944][T26217] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1761.409977][T26217] CPU: 0 UID: 0 PID: 26217 Comm: syz.5.12941 Not tainted syzkaller #0 PREEMPT(full) [ 1761.410003][T26217] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 1761.410017][T26217] Call Trace: [ 1761.410026][T26217] [ 1761.410037][T26217] dump_stack_lvl+0xe8/0x150 [ 1761.410078][T26217] should_fail_ex+0x3eb/0x540 [ 1761.410113][T26217] _copy_to_user+0x31/0xb0 [ 1761.410146][T26217] bpf_verifier_vlog+0x3a2/0x900 [ 1761.410187][T26217] verbose+0x11d/0x1a0 [ 1761.410231][T26217] ? __pfx_verbose+0x10/0x10 [ 1761.410268][T26217] ? lock_acquire+0x115/0x350 [ 1761.410305][T26217] print_bpf_insn+0x197b/0x2a90 [ 1761.410335][T26217] ? __pfx_verbose+0x10/0x10 [ 1761.410369][T26217] ? __pfx_print_bpf_insn+0x10/0x10 [ 1761.410394][T26217] ? _copy_to_user+0x8a/0xb0 [ 1761.410425][T26217] ? bpf_verifier_vlog+0x55a/0x900 [ 1761.410464][T26217] ? bpf_verifier_log_write+0x11d/0x1a0 [ 1761.410495][T26217] bpf_verbose_insn+0xcb/0x130 [ 1761.410529][T26217] ? __pfx_bpf_verbose_insn+0x10/0x10 [ 1761.410561][T26217] ? __kvmalloc_node_noprof+0x52a/0x820 [ 1761.410592][T26217] ? __pfx_verbose+0x10/0x10 [ 1761.410622][T26217] ? __pfx_bpf_disasm_kfunc_name+0x10/0x10 [ 1761.410656][T26217] ? record_arg_access+0x14f/0xa80 [ 1761.410699][T26217] analyze_subprog+0x6cce/0xb150 [ 1761.410792][T26217] ? __pfx_analyze_subprog+0x10/0x10 [ 1761.410823][T26217] ? kasan_save_track+0x4f/0x80 [ 1761.410853][T26217] ? kasan_save_track+0x3e/0x80 [ 1761.410883][T26217] ? __kasan_kmalloc+0x93/0xb0 [ 1761.410921][T26217] ? __kvmalloc_node_noprof+0x50a/0x820 [ 1761.410952][T26217] ? call_instance+0x263/0x560 [ 1761.410980][T26217] ? bpf_compute_subprog_arg_access+0x2cb/0x15c0 [ 1761.411010][T26217] ? bpf_compute_live_registers+0x10b0/0x1df0 [ 1761.411041][T26217] ? bpf_check+0x2d0b/0x34e0 [ 1761.411063][T26217] ? bpf_prog_load+0x14da/0x1c60 [ 1761.411084][T26217] ? __sys_bpf+0xd86/0xe00 [ 1761.411103][T26217] ? __x64_sys_bpf+0xba/0xd0 [ 1761.411134][T26217] ? mas_next_node+0xa72/0xe50 [ 1761.411157][T26217] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1761.411224][T26217] ? call_instance+0x263/0x560 [ 1761.411253][T26217] ? rcu_is_watching+0x16/0xb0 [ 1761.411287][T26217] ? call_instance+0x263/0x560 [ 1761.411314][T26217] ? trace_kmalloc+0x2a/0xf0 [ 1761.411344][T26217] ? call_instance+0x263/0x560 [ 1761.411373][T26217] ? __kvmalloc_node_noprof+0x52a/0x820 [ 1761.411408][T26217] ? __kvmalloc_node_noprof+0x340/0x820 [ 1761.411438][T26217] ? call_instance+0x263/0x560 [ 1761.411466][T26217] ? call_instance+0x263/0x560 [ 1761.411515][T26217] bpf_compute_subprog_arg_access+0x2f1/0x15c0 [ 1761.411574][T26217] ? __pfx_bpf_compute_subprog_arg_access+0x10/0x10 [ 1761.411613][T26217] ? __kvmalloc_node_noprof+0x340/0x820 [ 1761.411644][T26217] ? bpf_compute_live_registers+0x142/0x1df0 [ 1761.411674][T26217] ? bpf_compute_live_registers+0x142/0x1df0 [ 1761.411715][T26217] bpf_compute_live_registers+0x10b0/0x1df0 [ 1761.411773][T26217] ? __pfx_bpf_compute_live_registers+0x10/0x10 [ 1761.411818][T26217] bpf_check+0x2d0b/0x34e0 [ 1761.411856][T26217] ? ktime_get_with_offset+0x93/0x2d0 [ 1761.411889][T26217] ? ktime_get_with_offset+0x93/0x2d0 [ 1761.411929][T26217] ? __pfx_bpf_check+0x10/0x10 [ 1761.411958][T26217] ? bpf_obj_name_cpy+0x194/0x1e0 [ 1761.411992][T26217] bpf_prog_load+0x14da/0x1c60 [ 1761.412030][T26217] ? __pfx_bpf_prog_load+0x10/0x10 [ 1761.412073][T26217] ? __might_fault+0xaf/0x130 [ 1761.412107][T26217] __sys_bpf+0xd86/0xe00 [ 1761.412140][T26217] ? __pfx___sys_bpf+0x10/0x10 [ 1761.412177][T26217] ? __fget_files+0x2a/0x420 [ 1761.412228][T26217] ? ksys_write+0x242/0x270 [ 1761.412263][T26217] ? __pfx_ksys_write+0x10/0x10 [ 1761.412302][T26217] __x64_sys_bpf+0xba/0xd0 [ 1761.412339][T26217] do_syscall_64+0x166/0x520 [ 1761.412369][T26217] ? trace_irq_disable+0x3b/0x140 [ 1761.412401][T26217] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1761.412425][T26217] ? clear_bhb_loop+0x70/0xc0 [ 1761.412454][T26217] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1761.412477][T26217] RIP: 0033:0x7f168eda8f19 [ 1761.412500][T26217] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1761.412519][T26217] RSP: 002b:00007f168fd42028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1761.412543][T26217] RAX: ffffffffffffffda RBX: 00007f168f025fa0 RCX: 00007f168eda8f19 [ 1761.412562][T26217] RDX: 0000000000000094 RSI: 0000200000000140 RDI: 0000000000000005 [ 1761.412576][T26217] RBP: 00007f168fd42090 R08: 0000000000000000 R09: 0000000000000000 [ 1761.412590][T26217] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1761.412605][T26217] R13: 00007f168f026038 R14: 00007f168f025fa0 R15: 00007ffeeacdae58 [ 1761.412643][T26217] [ 1761.499411][T26212] netlink: 'syz.1.12939': attribute type 15 has an invalid length. [ 1761.937720][T26209] [ 1761.940138][T26209] ====================================================== [ 1761.947190][T26209] WARNING: possible circular locking dependency detected [ 1761.954257][T26209] syzkaller #0 Not tainted [ 1761.958703][T26209] ------------------------------------------------------ [ 1761.965761][T26209] syz.1.12939/26209 is trying to acquire lock: [ 1761.971986][T26209] ffff8880272bb418 (&q->elevator_lock){+.+.}-{4:4}, at: elevator_change+0x1af/0x480 [ 1761.981464][T26209] [ 1761.981464][T26209] but task is already holding lock: [ 1761.988860][T26209] ffff8880272baef0 (&q->q_usage_counter(io)#51){++++}-{0:0}, at: elevator_change+0x194/0x480 [ 1761.999112][T26209] [ 1761.999112][T26209] which lock already depends on the new lock. [ 1761.999112][T26209] [ 1762.009549][T26209] [ 1762.009549][T26209] the existing dependency chain (in reverse order) is: [ 1762.018613][T26209] [ 1762.018613][T26209] -> #6 (&q->q_usage_counter(io)#51){++++}-{0:0}: [ 1762.027389][T26209] blk_alloc_queue+0x544/0x690 [ 1762.032712][T26209] __blk_mq_alloc_disk+0x194/0x390 [ 1762.038363][T26209] nbd_dev_add+0x494/0xb60 [ 1762.043322][T26209] nbd_init+0x168/0x1f0 [ 1762.048032][T26209] do_one_initcall+0x250/0x870 [ 1762.053352][T26209] do_initcall_level+0x10a/0x1a0 [ 1762.058836][T26209] do_initcalls+0x59/0xa0 [ 1762.063710][T26209] kernel_init_freeable+0x29d/0x3e0 [ 1762.069454][T26209] kernel_init+0x22/0x1d0 [ 1762.074330][T26209] ret_from_fork+0x514/0xb70 [ 1762.079464][T26209] ret_from_fork_asm+0x1a/0x30 [ 1762.084775][T26209] [ 1762.084775][T26209] -> #5 (fs_reclaim){+.+.}-{0:0}: [ 1762.092014][T26209] fs_reclaim_acquire+0x71/0x100 [ 1762.097505][T26209] __kmalloc_cache_node_noprof+0x66/0x620 [ 1762.103800][T26209] create_worker+0x112/0x7c0 [ 1762.108936][T26209] workqueue_prepare_cpu+0xe4/0x170 [ 1762.114685][T26209] cpuhp_invoke_callback+0x434/0x810 [ 1762.120521][T26209] _cpu_up+0x2ce/0x5b0 [ 1762.125134][T26209] cpu_up+0x1d2/0x220 [ 1762.129658][T26209] cpuhp_bringup_mask+0xb2/0x1a0 [ 1762.135145][T26209] cpuhp_bringup_cpus_parallel+0x109/0x120 [ 1762.141496][T26209] bringup_nonboot_cpus+0x17/0x30 [ 1762.147069][T26209] smp_init+0x32/0x110 [ 1762.151695][T26209] kernel_init_freeable+0x27f/0x3e0 [ 1762.157437][T26209] kernel_init+0x22/0x1d0 [ 1762.162304][T26209] ret_from_fork+0x514/0xb70 [ 1762.167452][T26209] ret_from_fork_asm+0x1a/0x30 [ 1762.172758][T26209] [ 1762.172758][T26209] -> #4 (cpu_hotplug_lock){++++}-{0:0}: [ 1762.180513][T26209] cpus_read_lock+0x3d/0x160 [ 1762.185676][T26209] static_key_slow_inc+0x12/0x30 [ 1762.191156][T26209] nbd_genl_reconnect_sock_cb+0x69a/0xbb0 [ 1762.197512][T26209] nbd_genl_foreach_sock+0x265/0x450 [ 1762.203352][T26209] nbd_genl_reconfigure+0xbbb/0x1040 [ 1762.209203][T26209] genl_family_rcv_msg_doit+0x233/0x340 [ 1762.215325][T26209] genl_rcv_msg+0x614/0x7a0 [ 1762.220382][T26209] netlink_rcv_skb+0x226/0x4a0 [ 1762.225709][T26209] genl_rcv+0x28/0x40 [ 1762.230232][T26209] netlink_unicast+0x8ef/0xa80 [ 1762.235548][T26209] netlink_sendmsg+0x7f0/0xb20 [ 1762.240850][T26209] sock_sendmsg_nosec+0x14e/0x190 [ 1762.246441][T26209] ____sys_sendmsg+0x54e/0x850 [ 1762.251756][T26209] ___sys_sendmsg+0x2a5/0x360 [ 1762.256982][T26209] __x64_sys_sendmsg+0x1b1/0x290 [ 1762.262460][T26209] do_syscall_64+0x166/0x520 [ 1762.267599][T26209] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1762.274032][T26209] [ 1762.274032][T26209] -> #3 (&nsock->tx_lock){+.+.}-{4:4}: [ 1762.281695][T26209] __mutex_lock+0x197/0x15a0 [ 1762.286828][T26209] nbd_queue_rq+0x373/0xff0 [ 1762.291873][T26209] blk_mq_dispatch_rq_list+0x499/0x1990 [ 1762.297993][T26209] __blk_mq_sched_dispatch_requests+0xd36/0x1580 [ 1762.304861][T26209] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 1762.311380][T26209] blk_mq_run_work_fn+0x167/0x2f0 [ 1762.316985][T26209] process_scheduled_works+0xc3d/0x1630 [ 1762.323076][T26209] worker_thread+0xa47/0xfb0 [ 1762.328209][T26209] kthread+0x38b/0x480 [ 1762.332815][T26209] ret_from_fork+0x514/0xb70 [ 1762.338030][T26209] ret_from_fork_asm+0x1a/0x30 [ 1762.343335][T26209] [ 1762.343335][T26209] -> #2 (&cmd->lock){+.+.}-{4:4}: [ 1762.350566][T26209] __mutex_lock+0x197/0x15a0 [ 1762.355703][T26209] nbd_queue_rq+0xc1/0xff0 [ 1762.360664][T26209] blk_mq_dispatch_rq_list+0x499/0x1990 [ 1762.366764][T26209] __blk_mq_sched_dispatch_requests+0xd36/0x1580 [ 1762.373636][T26209] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 1762.380158][T26209] blk_mq_run_work_fn+0x167/0x2f0 [ 1762.385729][T26209] process_scheduled_works+0xc3d/0x1630 [ 1762.391830][T26209] worker_thread+0xa47/0xfb0 [ 1762.396978][T26209] kthread+0x38b/0x480 [ 1762.401593][T26209] ret_from_fork+0x514/0xb70 [ 1762.406728][T26209] ret_from_fork_asm+0x1a/0x30 [ 1762.412032][T26209] [ 1762.412032][T26209] -> #1 (set->srcu){.+.+}-{0:0}: [ 1762.419180][T26209] __synchronize_srcu+0xca/0x2f0 [ 1762.424662][T26209] elevator_switch+0x1e8/0x7b0 [ 1762.429980][T26209] elevator_change+0x2fa/0x480 [ 1762.435290][T26209] elevator_set_default+0x375/0x440 [ 1762.441045][T26209] blk_register_queue+0x404/0x4f0 [ 1762.446622][T26209] __add_disk+0x6b8/0xdb0 [ 1762.451526][T26209] add_disk_fwnode+0x100/0x3a0 [ 1762.456848][T26209] nbd_dev_add+0x733/0xb60 [ 1762.461809][T26209] nbd_init+0x168/0x1f0 [ 1762.466515][T26209] do_one_initcall+0x250/0x870 [ 1762.471849][T26209] do_initcall_level+0x10a/0x1a0 [ 1762.477331][T26209] do_initcalls+0x59/0xa0 [ 1762.482207][T26209] kernel_init_freeable+0x29d/0x3e0 [ 1762.487954][T26209] kernel_init+0x22/0x1d0 [ 1762.492844][T26209] ret_from_fork+0x514/0xb70 [ 1762.497997][T26209] ret_from_fork_asm+0x1a/0x30 [ 1762.503314][T26209] [ 1762.503314][T26209] -> #0 (&q->elevator_lock){+.+.}-{4:4}: [ 1762.511258][T26209] __lock_acquire+0x164c/0x2de0 [ 1762.516660][T26209] lock_acquire+0x115/0x350 [ 1762.521708][T26209] __mutex_lock+0x197/0x15a0 [ 1762.526843][T26209] elevator_change+0x1af/0x480 [ 1762.532161][T26209] elevator_set_none+0xb5/0x140 [ 1762.537563][T26209] blk_mq_update_nr_hw_queues+0x60b/0x1b70 [ 1762.543914][T26209] nbd_start_device+0x189/0xb30 [ 1762.549395][T26209] nbd_genl_connect+0x167d/0x1cd0 [ 1762.554964][T26209] genl_family_rcv_msg_doit+0x233/0x340 [ 1762.561053][T26209] genl_rcv_msg+0x614/0x7a0 [ 1762.566099][T26209] netlink_rcv_skb+0x226/0x4a0 [ 1762.571405][T26209] genl_rcv+0x28/0x40 [ 1762.575960][T26209] netlink_unicast+0x8ef/0xa80 [ 1762.581291][T26209] netlink_sendmsg+0x7f0/0xb20 [ 1762.586595][T26209] sock_sendmsg_nosec+0x14e/0x190 [ 1762.592256][T26209] ____sys_sendmsg+0x54e/0x850 [ 1762.597564][T26209] ___sys_sendmsg+0x2a5/0x360 [ 1762.602799][T26209] __x64_sys_sendmsg+0x1b1/0x290 [ 1762.608289][T26209] do_syscall_64+0x166/0x520 [ 1762.613465][T26209] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1762.619905][T26209] [ 1762.619905][T26209] other info that might help us debug this: [ 1762.619905][T26209] [ 1762.630153][T26209] Chain exists of: [ 1762.630153][T26209] &q->elevator_lock --> fs_reclaim --> &q->q_usage_counter(io)#51 [ 1762.630153][T26209] [ 1762.643911][T26209] Possible unsafe locking scenario: [ 1762.643911][T26209] [ 1762.651411][T26209] CPU0 CPU1 [ 1762.656800][T26209] ---- ---- [ 1762.662178][T26209] lock(&q->q_usage_counter(io)#51); [ 1762.667576][T26209] lock(fs_reclaim); [ 1762.674097][T26209] lock(&q->q_usage_counter(io)#51); [ 1762.682009][T26209] lock(&q->elevator_lock); [ 1762.686619][T26209] [ 1762.686619][T26209] *** DEADLOCK *** [ 1762.686619][T26209] [ 1762.694780][T26209] locks held by syz.1.12939/26209: 6, last CPU#1: [ 1762.701218][T26209] #0: ffffffff916f7c28 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 [ 1762.709438][T26209] #1: ffffffff916f7a60 (genl_mutex){+.+.}-{4:4}, at: genl_rcv_msg+0x10b/0x7a0 [ 1762.718456][T26209] #2: ffff8880273969c0 (&set->update_nr_hwq_lock){++++}-{4:4}, at: blk_mq_update_nr_hw_queues+0xab/0x1b70 [ 1762.729898][T26209] #3: ffff8880273968d0 (&set->tag_list_lock){+.+.}-{4:4}, at: blk_mq_update_nr_hw_queues+0xbe/0x1b70 [ 1762.740884][T26209] #4: ffff8880272baef0 (&q->q_usage_counter(io)#51){++++}-{0:0}, at: elevator_change+0x194/0x480 [ 1762.751543][T26209] #5: ffff8880272baf28 (&q->q_usage_counter(queue)#35){+.+.}-{0:0}, at: elevator_change+0x194/0x480 [ 1762.762461][T26209] [ 1762.762461][T26209] stack backtrace: [ 1762.768377][T26209] CPU: 1 UID: 0 PID: 26209 Comm: syz.1.12939 Not tainted syzkaller #0 PREEMPT(full) [ 1762.777854][T26209] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 1762.787923][T26209] Call Trace: [ 1762.791225][T26209] [ 1762.794178][T26209] dump_stack_lvl+0xe8/0x150 [ 1762.798811][T26209] print_circular_bug+0x2e2/0x300 [ 1762.803890][T26209] check_noncircular+0x12f/0x150 [ 1762.808871][T26209] __lock_acquire+0x164c/0x2de0 [ 1762.813781][T26209] lock_acquire+0x115/0x350 [ 1762.818320][T26209] ? elevator_change+0x1af/0x480 [ 1762.823298][T26209] __mutex_lock+0x197/0x15a0 [ 1762.827924][T26209] ? elevator_change+0x1af/0x480 [ 1762.832896][T26209] ? rcu_is_watching+0x16/0xb0 [ 1762.837691][T26209] ? work_grab_pending+0x3d1/0x930 [ 1762.842825][T26209] ? elevator_change+0x1af/0x480 [ 1762.847800][T26209] ? __pfx___mutex_lock+0x10/0x10 [ 1762.852853][T26209] ? lockdep_hardirqs_on+0x7b/0x110 [ 1762.858076][T26209] ? cancel_delayed_work_sync+0xd9/0xf0 [ 1762.863679][T26209] ? blk_mq_cancel_work_sync+0xa5/0xe0 [ 1762.869158][T26209] elevator_change+0x1af/0x480 [ 1762.873972][T26209] elevator_set_none+0xb5/0x140 [ 1762.878848][T26209] ? __pfx_elevator_set_none+0x10/0x10 [ 1762.884337][T26209] ? xa_load+0x1db/0x210 [ 1762.888620][T26209] blk_mq_update_nr_hw_queues+0x60b/0x1b70 [ 1762.894447][T26209] ? kernfs_add_one+0xfc/0x510 [ 1762.899243][T26209] ? __pfx_blk_mq_update_nr_hw_queues+0x10/0x10 [ 1762.905513][T26209] ? sysfs_add_file_mode_ns+0x258/0x300 [ 1762.911097][T26209] nbd_start_device+0x189/0xb30 [ 1762.915973][T26209] ? device_create_file+0xf4/0x1b0 [ 1762.921104][T26209] nbd_genl_connect+0x167d/0x1cd0 [ 1762.926156][T26209] ? __pfx_nbd_genl_connect+0x10/0x10 [ 1762.931568][T26209] ? rcu_is_watching+0x16/0xb0 [ 1762.936368][T26209] ? __nla_parse+0x40/0x60 [ 1762.940819][T26209] ? genl_family_rcv_msg_attrs_parse+0x265/0x2f0 [ 1762.947174][T26209] genl_family_rcv_msg_doit+0x233/0x340 [ 1762.952762][T26209] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 1762.958896][T26209] ? __lock_acquire+0x747/0x2de0 [ 1762.963887][T26209] genl_rcv_msg+0x614/0x7a0 [ 1762.968428][T26209] ? __pfx_genl_rcv_msg+0x10/0x10 [ 1762.973476][T26209] ? __pfx_nbd_genl_connect+0x10/0x10 [ 1762.978880][T26209] netlink_rcv_skb+0x226/0x4a0 [ 1762.983676][T26209] ? __pfx_genl_rcv_msg+0x10/0x10 [ 1762.988728][T26209] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 1762.994051][T26209] ? down_read+0x2b9/0x320 [ 1762.998506][T26209] genl_rcv+0x28/0x40 [ 1763.002520][T26209] netlink_unicast+0x8ef/0xa80 [ 1763.007329][T26209] netlink_sendmsg+0x7f0/0xb20 [ 1763.012115][T26209] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1763.017427][T26209] ? aa_sock_msg_perm+0x144/0x210 [ 1763.022470][T26209] ? apparmor_socket_sendmsg+0x98/0x360 [ 1763.028046][T26209] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1763.033348][T26209] sock_sendmsg_nosec+0x14e/0x190 [ 1763.038418][T26209] ____sys_sendmsg+0x54e/0x850 [ 1763.043208][T26209] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1763.048526][T26209] ? import_iovec+0x73/0xa0 [ 1763.053075][T26209] ___sys_sendmsg+0x2a5/0x360 [ 1763.057779][T26209] ? __lock_acquire+0x747/0x2de0 [ 1763.062750][T26209] ? __pfx____sys_sendmsg+0x10/0x10 [ 1763.067968][T26209] ? futex_wake+0x51b/0x5f0 [ 1763.072504][T26209] ? __fget_files+0x3a2/0x420 [ 1763.077223][T26209] ? __fget_files+0x2a/0x420 [ 1763.081845][T26209] __x64_sys_sendmsg+0x1b1/0x290 [ 1763.086810][T26209] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1763.092303][T26209] do_syscall_64+0x166/0x520 [ 1763.096923][T26209] ? trace_irq_disable+0x3b/0x140 [ 1763.101989][T26209] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1763.108078][T26209] ? clear_bhb_loop+0x70/0xc0 [ 1763.112809][T26209] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1763.118727][T26209] RIP: 0033:0x7ffbe6da8f19 [ 1763.123162][T26209] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1763.142799][T26209] RSP: 002b:00007ffbe7c7e028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1763.151250][T26209] RAX: ffffffffffffffda RBX: 00007ffbe7026090 RCX: 00007ffbe6da8f19 [ 1763.159256][T26209] RDX: 000000000400400c RSI: 0000200000000600 RDI: 000000000000000a [ 1763.167251][T26209] RBP: 00007ffbe6e37f6d R08: 0000000000000000 R09: 0000000000000000 [ 1763.175243][T26209] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1763.183234][T26209] R13: 00007ffbe7026128 R14: 00007ffbe7026090 R15: 00007ffc3f3b3428 [ 1763.191242][T26209] [ 1763.291882][T24135] block nbd2: Receive control failed (result -32) [ 1763.291952][T24135] block nbd2: Receive control failed (result -32)