last executing test programs: 13.416931777s ago: executing program 0 (id=3584): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) (async) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wpan3\x00', 0x0}) (async) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)={'wpan0\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'wpan1\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'wpan4\x00', 0x0}) sendmsg$NL802154_CMD_NEW_SEC_DEVKEY(r0, &(0x7f00000002c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000280)={&(0x7f0000000180)={0xe4, r1, 0x8, 0x70bd2d, 0x25dfdbff, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x3}, @NL802154_ATTR_WPAN_DEV={0xc}, @NL802154_ATTR_SEC_DEVKEY={0x74, 0x2f, 0x0, 0x1, [@NL802154_DEVKEY_ATTR_EXTENDED_ADDR={0xc, 0x2, {0xaaaaaaaaaaaa0002}}, @NL802154_DEVKEY_ATTR_EXTENDED_ADDR={0xc, 0x2, {0xaaaaaaaaaaaa0102}}, @NL802154_DEVKEY_ATTR_ID={0x58, 0x3, 0x0, 0x1, [@NL802154_KEY_ID_ATTR_MODE={0x8, 0x1, 0x2}, @NL802154_KEY_ID_ATTR_SOURCE_SHORT={0x8, 0x4, 0x8}, @NL802154_KEY_ID_ATTR_SOURCE_SHORT={0x8, 0x4, 0x4}, @NL802154_KEY_ID_ATTR_INDEX={0x5, 0x2, 0x3}, @NL802154_KEY_ID_ATTR_SOURCE_SHORT={0x8, 0x4, 0x80}, @NL802154_KEY_ID_ATTR_SOURCE_EXTENDED={0xc, 0x5, 0x1}, @NL802154_KEY_ID_ATTR_SOURCE_SHORT={0x8}, @NL802154_KEY_ID_ATTR_IMPLICIT={0x18, 0x3, 0x0, 0x1, [@NL802154_DEV_ADDR_ATTR_PAN_ID={0x6, 0x1, 0x3}, @NL802154_DEV_ADDR_ATTR_EXTENDED={0xc, 0x4, {0xaaaaaaaaaaaa0102}}]}]}]}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r2}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r3}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r4}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r5}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x3}]}, 0xe4}, 0x1, 0x0, 0x0, 0x4}, 0x840) (async) r6 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r6) (async) r7 = socket$inet6_mptcp(0xa, 0x1, 0x106) preadv(r7, &(0x7f0000000640)=[{&(0x7f0000000340)=""/64, 0x40}, {&(0x7f0000000380)=""/62, 0x3e}, {&(0x7f00000003c0)=""/62, 0x3e}, {&(0x7f0000000400)=""/146, 0x92}, {&(0x7f00000004c0)}, {&(0x7f0000000500)=""/93, 0x5d}, {&(0x7f0000000580)=""/37, 0x25}, {&(0x7f00000005c0)=""/118, 0x76}], 0x8, 0x8, 0x1ff) r8 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000700), r0) sendmsg$IEEE802154_LLSEC_ADD_DEVKEY(r0, &(0x7f00000007c0)={&(0x7f00000006c0)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000780)={&(0x7f0000000740)={0x30, r8, 0x10, 0x70bd25, 0x25dfdbff, {}, [@IEEE802154_ATTR_LLSEC_KEY_SOURCE_SHORT={0x8, 0x2c, 0x7}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x30}, 0x1, 0x0, 0x0, 0x20000091}, 0x0) (async, rerun: 32) r9 = socket$nl_generic(0x10, 0x3, 0x10) (rerun: 32) r10 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000840), r6) (async) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000880)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL(r9, &(0x7f0000000980)={&(0x7f0000000800)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000940)={&(0x7f00000008c0)={0x58, r10, 0x100, 0x70bd26, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r11}, @void}}, [@NL80211_ATTR_COOKIE={0xc, 0x58, 0x62}, @NL80211_ATTR_COOKIE={0xc, 0x58, 0x3}, @NL80211_ATTR_COOKIE={0xc, 0x58, 0x15}, @NL80211_ATTR_COOKIE={0xc, 0x58, 0xb}, @NL80211_ATTR_COOKIE={0xc, 0x58, 0x6c}]}, 0x58}, 0x1, 0x0, 0x0, 0x4000000}, 0x40) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f00000009c0)={'wpan1\x00'}) (async) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000a80)={0x0, 0x0, &(0x7f0000000a40)={&(0x7f0000000a00)={0x3c, r1, 0x2, 0x70bd2d, 0x25dfdbfb, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r3}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x3}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x7}, @NL802154_ATTR_WPAN_DEV={0xc}]}, 0x3c}, 0x1, 0x0, 0x0, 0x24042840}, 0x40000) (async) ioctl$XFS_IOC_FD_TO_HANDLE(r6, 0xc038586a, &(0x7f0000000bc0)={r7, &(0x7f0000000ac0)='(\x00', 0x0, &(0x7f0000000b00)={@_ha_fsid={[0x9, 0x1]}, {0x6, 0xfffd, 0x9, 0xe4fe}}, 0x7f, &(0x7f0000000b40), &(0x7f0000000b80)}) getsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r12, 0x84, 0x9, &(0x7f0000000c00)={0x0, @in6={{0xa, 0x4e21, 0xd, @private0={0xfc, 0x0, '\x00', 0x1}, 0x1}}, 0x7f, 0x0, 0xfffffffc, 0x7, 0x21, 0x7678}, &(0x7f0000000cc0)=0x9c) (async, rerun: 64) mmap(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x810, r9, 0x8dcf1000) (rerun: 64) r13 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000d00), r0) (async) r14 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r15 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000d40), r14) (async) sendmsg$NL802154_CMD_SET_MAX_CSMA_BACKOFFS(r14, &(0x7f0000000e80)={&(0x7f0000000d80)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000e40)={&(0x7f0000000dc0)={0x74, r13, 0x2, 0x70bd27, 0x25dfdbfb, {}, [@NL802154_ATTR_MAX_CSMA_BACKOFFS={0x5, 0x12, 0xa0}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r5}, @NL802154_ATTR_MAX_CSMA_BACKOFFS={0x5, 0x12, 0xff}, @NL802154_ATTR_MAX_CSMA_BACKOFFS={0x5, 0x12, 0x5}, @NL802154_ATTR_WPAN_DEV={0xc}, @NL802154_ATTR_MAX_CSMA_BACKOFFS={0x5, 0x12, 0xff}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x3}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}, @NL802154_ATTR_MAX_CSMA_BACKOFFS={0x5, 0x12, 0x5}]}, 0x74}, 0x1, 0x0, 0x0, 0x14}, 0x40000) r16 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_LLSEC_ADD_SECLEVEL(r16, &(0x7f0000000fc0)={&(0x7f0000000ec0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000f80)={&(0x7f0000000f00)={0x54, r15, 0x2, 0x70bd2b, 0x25dfdbfc, {}, [@IEEE802154_ATTR_LLSEC_SECLEVELS={0x5, 0x35, 0x80}, @IEEE802154_ATTR_LLSEC_FRAME_TYPE={0x5, 0x33, 0x4}, @IEEE802154_ATTR_LLSEC_FRAME_TYPE={0x5, 0x33, 0xd}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5, 0x36, 0x1}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5, 0x36, 0x1}, @IEEE802154_ATTR_LLSEC_FRAME_TYPE={0x5, 0x33, 0x6}, @IEEE802154_ATTR_LLSEC_CMD_FRAME_ID={0x5}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}]}, 0x54}, 0x1, 0x0, 0x0, 0x40411}, 0x4) (async) r17 = syz_genetlink_get_family_id$nbd(&(0x7f0000001040), r0) sendmsg$NBD_CMD_DISCONNECT(r0, &(0x7f0000001140)={&(0x7f0000001000)={0x10, 0x0, 0x0, 0xcf272fe156e4c00}, 0xc, &(0x7f0000001100)={&(0x7f0000001080)={0x4c, r17, 0x100, 0x70bd2c, 0x25dfdbfd, {}, [@NBD_ATTR_SIZE_BYTES={0xc}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x9}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x7}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}]}, 0x4c}, 0x1, 0x0, 0x0, 0x800}, 0x0) 13.094935731s ago: executing program 0 (id=3586): r0 = socket$netlink(0x10, 0x3, 0x0) (async) r1 = socket(0x10, 0x803, 0x0) (async) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0x12, 0x1, 0x4, 0x8}, 0x50) (async) close(0x3) (async) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="06000000040000000400000004"], 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x1, 0xd, &(0x7f0000000300)=ANY=[@ANYBLOB="18000000000000000000000000000000850000002e00000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], &(0x7f0000000440)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r3, 0x0, 0xe, 0x0, &(0x7f00000008c0)="7a7fa22c2aff88df53ef2a2d280f", 0x0, 0xa00, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) (async) sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x1c}}, 0x0) getsockname$packet(r1, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) (async) bpf$ENABLE_STATS(0x20, &(0x7f0000000100), 0x4) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32=r4, @ANYBLOB="f5ff0f00252155b21c0012000c000100626f6e64000000000c0002000800010001"], 0x3c}}, 0x40000) (async) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000003c0)=ANY=[@ANYBLOB="40000000100003052abd70000007000000000000", @ANYRES32=0x0, @ANYBLOB="00000000063800001800128008000100767469000c00028008000400e000000108000a00", @ANYRES32=r4, @ANYBLOB="deb60b2deb99ea2fe789c60fdec1797df36076c14dfda61f65c0f4cb4796164d5a651dbcb30aa04bebdf2df9147cb656723c9e28ed6302cb676705e8699166a90b079f8f3090b68e94682173a885fe1c919d09bbf9212874b70933321aba098b9d5b66d9893d041174c0d0b3f532ba0be44bad02041e9c34f9817948ddd077aa7225b7166544bd984cfb7ef670d10075"], 0x40}}, 0x440b0) 9.412286539s ago: executing program 0 (id=3594): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nfc(&(0x7f0000000000), r0) setsockopt$ALG_SET_AEAD_AUTHSIZE(0xffffffffffffffff, 0x117, 0x5, 0x0, 0x1) (async) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f00000000c0)={'wpan4\x00', 0x0}) sendmsg$NL802154_CMD_SET_MAX_CSMA_BACKOFFS(r0, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x78, r1, 0x100, 0x70bd25, 0x25dfdbfd, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}, @NL802154_ATTR_MAX_CSMA_BACKOFFS={0x5, 0x12, 0x2}, @NL802154_ATTR_WPAN_DEV={0xc}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r2}, @NL802154_ATTR_MAX_CSMA_BACKOFFS={0x5, 0x12, 0xb}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_MAX_CSMA_BACKOFFS={0x5}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x3}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000002}]}, 0x78}, 0x1, 0x0, 0x0, 0x4090}, 0x0) (async) r3 = bpf$OBJ_GET_PROG(0x7, &(0x7f0000000240)=@o_path={&(0x7f0000000200)='./file0\x00', 0x0, 0x8000}, 0x18) mmap(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x3000003, 0x2010, r3, 0x1ce66000) (async) sendmsg$SOCK_DIAG_BY_FAMILY(0xffffffffffffffff, &(0x7f0000001380)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x5e1e26505f5ebaee}, 0xc, &(0x7f0000001340)={&(0x7f00000002c0)={0x1080, 0x14, 0x4, 0x70bd28, 0x25dfdbfd, {0x2, 0x5}, [@INET_DIAG_REQ_BYTECODE={0xa, 0x1, "15c3be2e942e"}, @INET_DIAG_REQ_BYTECODE={0x5b, 0x1, "a408d999008895a60ff518160736256cebffb180d255f69d2cacad3c890ada388b9ec188c79f84d714655d1ec652afe0ec988eb5d4c09448fa772066a3c9d88ff0232f70a9bcb5ad2abbded54b99e8597fa3b77066a1eb"}, @INET_DIAG_REQ_BYTECODE={0x1004, 0x1, "e7366bbea328bebff26c29755fe82e341f7b41450b1a2af4e4e916c4feee70a7ba66156de87d375c6af7b35e1319343e8379b422adb6dfab2392831f0eb2d1c1e780c645902aac63e8dd7c9686aafabda333b0d8c9794cb4ffec51bb9d84d1eb462b0f47a1c988714e29083d1f822414be33e956aac5be2c78bf237ec7f9d5a18289034d5942044021715c3515244446888a79fe300b8232cd3739ce8121af2ad6b7f84565f446532796181602256bf8720e93b6f78e028cc6c5a2f1c2b558b17f852c6585f6bed24eb8895f3d4e166c36e795322a0fcd24832777d7236a2590ff6c6b7be39363f745018c72b59a19308fc73565a804d7971c36986f86a9255ecd785289366571fca589848813917a901f15ecadf174e321a1b7512a2b74cdebf5f4735048ab6a41eef6e86355362f9994859bbc71c5774717f2aaa4a9582194cd8dcbf20fbc29baa52f73985279b7c191d2e4af85dde448f8a95d153176e19af95ece1e8cad875e4f374d44278fa97e5f3462b902080b573d002ee7e60e5aecd6b8887e3df33c6bdbce7944d6a91609c0ef20489ee4eb1aa547b262177ce4b0d008612b5117cc224f2783de00f356321ed1fcc31f65a7084f1c5db15732fc23f3e982ebe29c8525c36aad33b0548366aa93d5d35934ab9ef1f791653d6a3965a4d64cedf11f8e6281c242ae59d6f2e138c41facffe9a926b67495bb722634c367e76b3e3f41045f2dc3468e879db05c833a63523bb638c6f242b631354f1b856a58a08b6f793b82a679cbb687493b209ad5e10bdffd7f2ad537f06084bbd9f9722375beebe26e34fcc51d66837fa4bb7c270d6ea98022cba6537770dcc8739ff7fd9188d8439dd6b5211fbcfd5faa00163ba4d939b7a16c4766fc4b32983663e474a14a363a64754ff15e41001b4cdd668adb36351c9e5ffd5eed88f7a76afe898634b0734b48d4f722dd390d113987e480e12ba59ecbcc0ea0e22163d2de9c5d2d189d8da7d7f63157597d337c47ba56dc3f2cb0a1c8fee5e6e9742c85f605efade12e155e75cc0f4e2ca78a82b0c1ef1dd57df873515b9abb90c3d00800c999300985a1463dd0bdcf8a98e0dd1fa7d1fb9d62cd41cecb25cfb40844df4e30e1afa0e848f989867f7ca1f37f4bbc516c008acb9a3d9ebeaa1d50ee21adda3b8c0651c49f43f5c52c62a9a6fa9eeb69c0a8891dc2c3798b6b9534a30fa9dd7233cfb044d41a7cc8552bdb8a01575993b4e4ab82fcbb653f8e064b4a31cb4ba0f4898cec85a3f890622fc952826232cae97f311310ae817c68f996089922af196b327debf25ed7448f71f63f01af68fbd06e36b98e5793407d55370eafeeac33e6b29f6dd92dfd1b035ce40ab00c503dd1c0e71ba598ff14f75f3e408b8e681e73df5b7c20ec0da3cc5f2bbf1e438fb6f40ff6801301781a13c2b043236e3381c951492794c596a0821d9a91b7263a1e9a95f429ea484e8ced1a80e2cbdd01129054e680ff53679135d302645dc746f8c4b683f91df3977b7d10e1df5eb8b06027b9ed7bea289f1f80edcca9c5148f12ffacb250ae486aac3ac21d1bcc2f6253502be7c85fc723a64eb124bc40c00561ac9721ebfb0ce16f0b0b5c11da1ddcc3eb54701afb383e0bb859bdd3946cebe675d6956cea05cecec7538f4e0d5b5ba4ee5e3d1df67ee27e42855f19873dde2c4079a1266b152a7d9806e2d308754e60f961f70efd2b2e48619c12356e5aeec26f8a8cd8257a99448100a716a3e67034b2730a1e55090e4e0656a13f5bd76ccfa94e169199bf4c0b02b9e722678841193d28c069cb5bd5703cf0fbbd555cf61702aa7defc66091a541653efe6395c3984cb33382d0c13f7fe44798b45e129758efd0819722c7514d781f482fea53cc35a6a6e5995892c0a6c9aab86b610e7aa07dfd36e5ef3c843adb11b19cb2c5de284309315397eb19277bc55afdf8ecd7344fee8eb40a2d92487603ba689b8ff0e6114c8069e4849361ebacfedc5d966e48c476200a5799f7e9290948de816ea778ecc69a34afe0cbfb3071f98aecf9c51c4c777c00e06f0a4d1476296ec265b012fbf1bd7540e8dd7fa97491e32a61080245a4e3f3ca636bbc4fade74300b9fae34cfb76127b1e0bfc744b532a79d5b159b4e3861accd78677479c5e3b620bf1d801263909ef7003db7cf9f9e9d1d084128874e24ec15f9b53c674ffaaac0190dcc9a118561cc37b9501266fef0ab4d2945834ced81bd0d637df22872342c7310b384a4ca1842f6b1dada3de66727a0ac1459c26f89bd1add4687aeedbd9949044f2c724caaa86dd065876a268c2ece479be38321c9ce5780642fca825dbf9ff6788366f8d0771bfc81b7968172fe287b49d94469d5d7c001172cc8c5c950df69601b1f20a33f7b978d6f5b30df31081a7249f17497d1a8d06bd4e8cc6ba4f4d16473340dcc8031659ff38336a2fc7c75ca91cddb9822257e88a06856b000624f357b5bedf2c096e23150c817bb0eba070b9e16861174aecd35004996086d47a9fb8f2007c99af55c8fda7b6e67940373251a24ca41e19ee9be25ecc015e20317d737f83e07aefa8fdf0d8a96d059ac4ff67557a3ed1b607fd96a93d12d57be88507635224e22a1edd8d8062e3fbae96da594edbe660d13a6ed794c646efb49348ea0506f1537042e9c563374338d0ab92ef6fb6ea2b3b2b1f6b967406fd8585312cf1bb03dddc655c4edab006387351ee370acd925558bf37e764a8536bfc172e5a822e9f301e22c9bb2a38ee6b10ae74933897e147b7319589889165d3d139c4b156f3ae35964108cb184c85b391839c05d6e84a095b4c8c5cb9a1cff91faed8a92a86c23e1683429589e2e2026f4fe96977c0167823f2972c5eeb02e958648d3654161841e3451d44498e86594bf0c61735f3e1eca4fd6a3f2616784b295232230f188d8dfb9997107442f7626622762257734d43e5acf7aad81ca927007d10fade67f65cdcb37b48e9d3b6e887d59c688e7d1ffb68a16679ebbbc5eeec8698019357cb5764acb768d07e971674c61cbccc54c851efc4085dc40ee445c8ac753408c5d3ada6d02c45db867fbad01add65fbc9d7d3b413447fd5fdf2cd6a7e893984ab52c1c1766cdbc6ca1bcd76bd5dcb807ac970ddf28b43a9051183fb54a03cb702416724be8a0b2cf05452b84bf7fde4728f93ad9d8305733e277eb2f90bd37563efbcc8236805c5d1d0b181d44b6df0c8e43e3e27f50f22e678f0f905519a5b82f40e319bc98de06bde136aff882c4e9d9332cee9036cd11048d5a76238fa5711bbe503fdfca2729045401385fc4e01c89bb0e4e4239e95e043fe875a7a2be0369f57b209c2032b53cc95c77036f2623f7f4049b00380e149598b62278e8f690b17ce51319e0d30d23405251ed83b4e3875e545008f1635d2dcb747f23a9b40accfb8f9edb5e10731147e09c713cbae469689b5a366d582ee5bfba3552241b720ac01f291a0c4e2b8f8a16445d8d8156a0c23fc2f4e01a10cb9d061bea763d172ce3ab2c7b7ef7bed3de22f8e4410f2a22d7d93432a218032eedad7e978e9b8e7506cf80aeb5eb57a779ad0a13115a107b8487b000accae183ccdc9af2ecd9c8ff8026108e31f471051889e6d9989313dcaab3fc625511e453eb04c2fb1df1ffcd22a74d7b51bb856c3da5843670ee3a11b16318f5ab543418964efec2f26d5c307b1332679ac8078e2b34d70c3f2ecf7aec3494a3520ef2e3d24f954a78a087b80628567f54d0e68a3a47c293ec3824af8bbcbbb70c524a91d5d585742e753dbc5717edd1003582c3543dabe14910f8ef0b464f0978dfdb05914fc1ac2f232a4a3733d31ec4fa838d6e2d040beb0bfd71c15a3580b8c7fa7a6e528fc466b2fe1c171d0b3971f7f38232e977d7b74b79ac3befebb257bfe5f32058ea4c24cd5c650d44ebf8905a7ffedbff4b54e73b390bb047f3c8ac15ba848e1185adab5c1f3c879bfe8dbd197cae6b38a267aaf4865ffd6f4ec4c8d2559934ddd3fa9518c73a5ee6acad251427297f7fb442d9551af9080c8f8dc285adfd576d36417dc72d25ee43a9a951f8714f20b383a591fefb90245d929369c92f968dbb99e0b1f75e005e05f13d7168bce41a8248281f5289cad4f4c88d3c65d573d4a07b52396d53d30fbb9c75ee25669e931e354a644b0ef8ba955a27ca6e49c2abc9d54e9f5c7afe5a2bd26f4c3e0ca462084320c2531b2e4ec2340b1ce9901c438095ecf28bcd6a56d4642663b5eb3adcc04003794a4a5c707715fc9ccf15cf06b20d119bb218652bdabb49c2cad12de3ccda26f70936c4f0578b5950bf402fa901516f606945f91ae9520016c7a544aac27f032f020ce17c4a90de97cdd519b477232894c2216a0b29eacdbc87a623bc3db214f9cf3b9f1383295eb5284304c6fe0732de67da11c898bb45692a2d179a617047ab8e42a1bd9e445674438c3e1bbba6708f6afe8bb634ebc487dace481074952283d5c3f8c45a78564f55bca7e8ed8d561a1f2fbc7212601a48b1d2132968e6ec40638f154628b137da123dfcdd91d127b7b08b8a0bfd0cf4ffd1ec64f772d6147d6ec76732fecf347e4f21eef3f752cbd15a0b2146a54198dc0363da6406148225172b4927029b6078ae47c11052347e88b70691746e5826322f9269fcb293462284a113bb6ad42419add0626da578f94a21536e08c3764053d44cae5cbd0d4c7b5ddb0743507a0ac8013213a72a96d5c62d1e23fe778402c68b5017f32c5eda741e6e6d49f6dc328da27ad68ca679e6e2562438e40f8bb9a925271f041242fe7e17639a59cc61575b23bebb39200f1ba3cacaca4dbc1bf16fe0f1e766ce23517505bafbeb0509a496dd640325f46f3a3b4b1022df60f79d7a668f3c17ad2056bb351827b901a0329fe6bf29705fba64b36d996d58efc203304b615ea061377326a340afd79e8066be2f686a208163981bcb6f256d242c309d2b233c613c2f721e5b24e0160f327dfeb177487adf585def88fa3af4b3887985df3ceadf45aca8b997afc136ce8612847be23e33d1f13292ad82fb4f9dda20622652327ab0c64b4c654fa2204cde8329f3f0803ef299ffc838c831ebb776ddc0b34c1ed3e73e102000898eab047420d1ec5a66c9f03dea9c8c839a37f530af0d5ec06ea356dd70e0192b24907f58dc78f954d0105581b367c4008e73bbcc781f0078597da8233e1da0ac3714de8ab3cf44faa65e89f6c823a67fb615c5c2c62c3d011030d819690976ea23a608bfacc5bd7b563a2ee00ebe9546d0c06447096ccd0e498af0a765e2f61f56fb9d363656bc897d1a56e1c6de153ef6e4c35318318c7788deb5a3e76ddfb4237fe58a7b9659d31c29ee9249814e0796f286297b3fc0d4a0b161cb98c16e9e3053a5fb629bc3dc1a7ca06d54594511bbce33c385f460e0e9b109e67e916a14b5ea0ed2486f94054639dd8ca7954786964761d5aa969dce64865384cf16f381ef448717ff8c08745c611865c6c73691fdecf33ab640644647195d46607f3da03ef51c294a5cddc13e041c401792337723f806bfbcb0b597a18d2d920d1142db53deedc6947951141f84048df96b3bd49aaea8e1514f2f5cfdd2ad646ad68203c9acf2085068a7138dc6babefbcf2dbfce2321c268d1fcdc7f788d1d6e16222fa09d21cba22d1b7837799a0c5b20adc06d03179ea6274893f04b3da856dc99111a0bfe67f9f5a58f9d7d4defef227e0293947782f4d22595fab95a455d7e9975c0a8a2c8b961eefa54f06bc68f0"}]}, 0x1080}, 0x1, 0x0, 0x0, 0x800}, 0x408d5) r4 = socket$nl_generic(0x10, 0x3, 0x10) (async) r5 = socket$alg(0x26, 0x5, 0x0) (async) r6 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) sendmsg$802154_dgram(r6, &(0x7f0000001540)={&(0x7f00000013c0)={0x24, @short={0x2, 0xffff, 0xaaa1}}, 0x14, &(0x7f0000001500)={&(0x7f0000001400)="ec8f353920db12f5e76f7d8cc7315cf3232a27a191a8fe91df238efdcdf3c9b60af004bfeda579c8ce1d5a760c699e9a0a145d6a4272d5a35d974b70b55cb8747c56ff806c214adf9e4ba7faf22c9c33d998626ee009800f76a2c4bbeeda105bf2905b6e4942baf14ea52403d8bfe4b5226dcfcc4fa30852226a0a36c6999daa2a574f5dfacd829fbdce4e53b9ddb5deb21fef28a31f5cc0d4c5f36efdeb49436f6c5c06586a6e9660ca1a89c441458b25d8bc019a958f3e2c57a3634efac258660388545a7c1b98515c1c784665c0fd8377a3ce36d7af1b936a0d9bca", 0xdd}, 0x1, 0x0, 0x0, 0x20000000}, 0x4) (async) sendmsg$DEVLINK_CMD_SB_PORT_POOL_SET(r4, &(0x7f00000017c0)={&(0x7f0000001580)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000001780)={&(0x7f00000015c0)={0x184, 0x0, 0x8, 0x70bd2c, 0x25dfdbff, {}, [{{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8}}, {0x8, 0xb, 0x6}, {0x6, 0x11, 0x2}, {0x8, 0x15, 0x7fffffff}}, {{@pci={{0x8}, {0x11}}, {0x8, 0x3, 0x1}}, {0x8, 0xb, 0x10}, {0x6, 0x11, 0x6}, {0x8}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x3}}, {0x8, 0xb, 0x1d}, {0x6, 0x11, 0xfc01}, {0x8, 0x15, 0x9}}, {{@pci={{0x8}, {0x11}}, {0x8}}, {0x8, 0xb, 0x4}, {0x6}, {0x8, 0x15, 0xfffffeff}}, {{@pci={{0x8}, {0x11}}, {0x8, 0x3, 0x2}}, {0x8, 0xb, 0x5}, {0x6, 0x11, 0x8}, {0x8, 0x15, 0x1}}, {{@pci={{0x8}, {0x11}}, {0x8, 0x3, 0x3}}, {0x8, 0xb, 0xfff}, {0x6, 0x11, 0x7}, {0x8, 0x15, 0x1}}]}, 0x184}}, 0x20000000) syz_genetlink_get_family_id$SEG6(&(0x7f0000001800), r4) (async) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r7, &(0x7f0000001900)={&(0x7f0000001840)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000018c0)={&(0x7f0000001880)={0x28, 0x2, 0x3, 0x801, 0x0, 0x0, {0x3, 0x0, 0x9}, [@NFQA_CFG_PARAMS={0x9, 0x2, {0x1, 0x2}}, @NFQA_CFG_CMD={0x8, 0x1, {0x4, 0x0, 0xa}}]}, 0x28}, 0x1, 0x0, 0x0, 0x4}, 0x40000) ioctl$XFS_IOC_PATH_TO_FSHANDLE(r3, 0xc0385868, &(0x7f0000001a40)={r5, &(0x7f0000001940)='netdevsim\x00', 0x4040, &(0x7f0000001980)={@align=0x100000001, {0x3, 0x5, 0x6, 0x3}}, 0x5, &(0x7f00000019c0)={@_ha_fsid}, &(0x7f0000001a00)=0x8}) setsockopt$CAN_RAW_ERR_FILTER(r8, 0x65, 0x2, &(0x7f0000001a80)=0x5, 0x4) (async) ioctl$F2FS_IOC_RESERVE_COMPRESS_BLOCKS(r7, 0x8008f513, &(0x7f0000001ac0)) (async) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r7, 0x8933, &(0x7f0000001b40)={'batadv0\x00', 0x0}) (async) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r8, 0x89f0, &(0x7f0000001c00)={'syztnl0\x00', &(0x7f0000001b80)={'gretap0\x00', 0x0, 0x80, 0x7800, 0xffff8001, 0x10000, {{0x16, 0x4, 0x2, 0x2e, 0x58, 0x67, 0x0, 0x81, 0x29, 0x0, @broadcast, @initdev={0xac, 0x1e, 0x1, 0x0}, {[@ra={0x94, 0x4}, @timestamp_addr={0x44, 0x34, 0x5d, 0x1, 0xa, [{@multicast2, 0xd9d0903}, {@local, 0x8}, {@initdev={0xac, 0x1e, 0x1, 0x0}, 0x3}, {@multicast2, 0x1}, {@local, 0x78b4}, {@private=0xa010100, 0x3}]}, @timestamp_prespec={0x44, 0xc, 0xfb, 0x3, 0x5, [{@broadcast, 0x8}]}]}}}}}) (async) ioctl$ifreq_SIOCGIFINDEX_vcan(r5, 0x8933, &(0x7f0000001c40)={'vxcan0\x00', 0x0}) sendmsg$ETHTOOL_MSG_FEATURES_GET(r4, &(0x7f0000001e80)={&(0x7f0000001b00), 0xc, &(0x7f0000001e40)={&(0x7f0000001c80)={0x1ac, 0x0, 0x200, 0x70bd25, 0x25dfdbfc, {}, [@HEADER={0x5c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1_macvtap\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1_vlan\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r9}]}, @HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}]}, @HEADER={0x20, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'pim6reg0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8}]}, @HEADER={0x30, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'tunl0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}]}, @HEADER={0x54, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'geneve0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bridge_slave_0\x00'}]}, @HEADER={0x34, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'sit0\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ip6gre0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}]}, @HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'wg1\x00'}]}, @HEADER={0x14, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r10}]}, @HEADER={0x20, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_batadv\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r11}]}, @HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}]}]}, 0x1ac}, 0x1, 0x0, 0x0, 0xc0c0}, 0x40) (async) socket$kcm(0x29, 0x5, 0x0) sendmsg$NFT_MSG_GETSETELEM(r8, &(0x7f0000002440)={&(0x7f0000001ec0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000002400)={&(0x7f0000001f00)={0x4cc, 0xd, 0xa, 0x3, 0x0, 0x0, {0x0, 0x0, 0x4}, [@NFTA_SET_ELEM_LIST_ELEMENTS={0x4}, @NFTA_SET_ELEM_LIST_SET_ID={0x8, 0x4, 0x1, 0x0, 0x1}, @NFTA_SET_ELEM_LIST_SET_ID={0x8, 0x4, 0x1, 0x0, 0x2}, @NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz2\x00'}, @NFTA_SET_ELEM_LIST_SET_ID={0x8, 0x4, 0x1, 0x0, 0x3}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x478, 0x3, 0x0, 0x1, [{0x10, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_TIMEOUT={0xc, 0x4, 0x1, 0x0, 0x7fff}]}, {0x43c, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_SET_ELEM_KEY={0x3f0, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0xef, 0x1, "7d1c184279c295fd9d299e2f17434cc13b2db04d710bb1d767b07cd9e8cb038e4e3eba1aeab7f44b8b4454454327a1821c7a8d36fa4e9e5801aa32397accd8475e1e65f01d31060f92eba7b54e00a76ee11912947a8ac3c6542b46a5fcab894c13483e51173c7c0cd08ba7bc75811eeeaffde02d676014bfc41c6ba5b8ea8aaadc742b883bbf8944ecd4563f9297da72ba5b030d899e940d050a1dc20ffaf2d05415433fc17609856ccde6406164a19c7f8473c28c4b8927644042a6e23dd9e57e9769440942fdc6fd5e53d81f02943b62f36ac2de28a3a4afb645b3e530ff9e51d16a8767af9cc39969d2"}, @NFTA_DATA_VERDICT={0x64, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffc}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xffffffffffffffff}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xffffffffffffffff}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffe}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x3}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}]}, @NFTA_DATA_VALUE={0xcf, 0x1, "314641501e8f54b8361dcdcf44d148cfc7f7bdd6eb3cbb9e7aab1deb636bf29b30f7fd44574fc01783f26eaae50bdba10c3c1ffc6435786c2bd34dff57ef68bb9985fe1546509f51bfb3672f2067e5da946cb9862e76d36388df4b53d2ae60414bfcb37b97c342c271ff169a592bd99bc552bedc53bc1824b4b2339155a553ee08acffe66910db139bcb8b295a9ed3703b0e68b68c399ccfbfcb428a7b4336be7d056f29edd3523ede997b4fc9712b606ddc8173660ec99fc341081fc3aa979f40e23615605d4f8d431030"}, @NFTA_DATA_VERDICT={0x34, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffc}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xffffffffffffffff}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x1}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x2}]}, @NFTA_DATA_VALUE={0x64, 0x1, "2a888df6c91e324e9d02fb93030a59b94d61e98a48898cba7315dbebb5bef8de27901b400c3ca8d5ab07cb9a004ef5fcf824c5f68cc4306a88a88abdaf5375cf1cd27d9eb6e8235717f083d9cc8c8baf8d3ecdd6f7c672c8191a1e88b18886ba"}, @NFTA_DATA_VERDICT={0x30, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x4}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}]}, @NFTA_DATA_VALUE={0x85, 0x1, "5569c1bfaa857b80cc86563506ceca5bacfb98aca36090db6156a6b545d64643471c9a7d2ef8f0154ed88c4ca4dfb46b22e3e607df34f4090127e3a49e471d592b8b6c5d7aa09ff67081ea16460d699e824239193ab3744b7909a68c659e1891baae928059f3105f1bd6402b89d24b0601017d898fe19369e92d7212a8253d4275"}, @NFTA_DATA_VERDICT={0x4c, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffc}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x3}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x1}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xffffffffffffffff}]}, @NFTA_DATA_VERDICT={0x2c, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x1}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x1}]}]}, @NFTA_SET_ELEM_EXPRESSIONS={0x28, 0xb, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, @dup_ipv4={{0x8}, @void}}, {0xc, 0x1, 0x0, 0x1, @fib={{0x8}, @void}}, {0xc, 0x1, 0x0, 0x1, @dup_ipv4={{0x8}, @void}}]}, @NFTA_SET_ELEM_OBJREF={0x9, 0x9, 'syz0\x00'}, @NFTA_SET_ELEM_OBJREF={0x9, 0x9, 'syz0\x00'}]}, {0x24, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0x20, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0x1b, 0x1, "9240fb98324071ba61156473e5777e7b79bde0c039c4f8"}]}]}, {0x4}]}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}]}, 0x4cc}, 0x1, 0x0, 0x0, 0x40}, 0x20000000) r12 = syz_genetlink_get_family_id$batadv(&(0x7f00000024c0), r4) sendmsg$BATADV_CMD_GET_NEIGHBORS(r4, &(0x7f00000025c0)={&(0x7f0000002480)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000002580)={&(0x7f0000002500)={0x54, r12, 0x100, 0x70bd26, 0x25dfdbfb, {}, [@BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x5}, @BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}, @BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0x6}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5, 0x30, 0x1}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x4}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x6}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x5}, @BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x80000000}]}, 0x54}, 0x1, 0x0, 0x0, 0x2004c0d1}, 0x800) recvmmsg(r6, &(0x7f0000003a80)=[{{&(0x7f0000002600)=@alg, 0x80, &(0x7f0000002c00)=[{&(0x7f0000002680)=""/73, 0x49}, {&(0x7f0000002700)=""/127, 0x7f}, {&(0x7f0000002780)=""/33, 0x21}, {&(0x7f00000027c0)=""/169, 0xa9}, {&(0x7f0000002880)=""/140, 0x8c}, {&(0x7f0000002940)=""/24, 0x18}, {&(0x7f0000002980)=""/242, 0xf2}, {&(0x7f0000002a80)=""/85, 0x55}, {&(0x7f0000002b00)=""/207, 0xcf}], 0x9, &(0x7f0000002cc0)=""/199, 0xc7}, 0x6}, {{&(0x7f0000002dc0)=@l2, 0x80, &(0x7f0000002e80)=[{&(0x7f0000002e40)=""/41, 0x29}], 0x1}, 0x4}, {{&(0x7f0000002ec0)=@can, 0x80, &(0x7f0000003240)=[{&(0x7f0000002f40)=""/247, 0xf7}, {&(0x7f0000003040)=""/164, 0xa4}, {&(0x7f0000003100)=""/167, 0xa7}, {&(0x7f00000031c0)=""/67, 0x43}], 0x4, &(0x7f0000003280)=""/133, 0x85}, 0xd7}, {{&(0x7f0000003340)=@hci, 0x80, &(0x7f0000003680)=[{&(0x7f00000033c0)=""/130, 0x82}, {&(0x7f0000003480)=""/151, 0x97}, {&(0x7f0000003540)=""/219, 0xdb}, {&(0x7f0000003640)=""/8, 0x8}], 0x4}, 0x2}, {{&(0x7f00000036c0)=@qipcrtr, 0x80, &(0x7f00000039c0)=[{&(0x7f0000003740)=""/28, 0x1c}, {&(0x7f0000003780)=""/155, 0x9b}, {&(0x7f0000003840)=""/44, 0x2c}, {&(0x7f0000003880)=""/107, 0x6b}, {&(0x7f0000003900)=""/141, 0x8d}], 0x5, &(0x7f0000003a40)=""/35, 0x23}, 0x5}], 0x5, 0x40010100, 0x0) (async) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000003c80)={0x2, 0x4, 0x8, 0x1, 0x80, r8, 0x1, '\x00', 0x0, r8, 0x2, 0x2, 0x4}, 0x50) 8.944887607s ago: executing program 0 (id=3598): r0 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000480)=[{&(0x7f0000000000)="1400000010003507d25a806f8c6394f90324fc60", 0x14}], 0x1}, 0x200a4800) recvmsg$kcm(r0, &(0x7f0000000100)={0x0, 0xfffffffffffffcb4, &(0x7f0000000040)=[{&(0x7f00000004c0)=""/4135, 0x1027}], 0x1}, 0x120) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x40241, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) write$tun(r1, &(0x7f00000002c0)=ANY=[@ANYBLOB="000086dd03000a0000008d0000006809c2b4006806fffc010000000000000000000000000000ff0200000000000000000000000000015e06000000000000042f109971b5b34577a524ade9493336edb06d7fd8fae7ef4a9983ade23c995c13d5e59395db3e2a23a56365dc62948cf2c6acc1352e289e2480a85c8b01514c0ca1c48736999427e6b300395d4308537a710f026897a4bbff7847c49dc986c121e684dcc1ce12388f5535efedffb3ccee2f16ace4a900acb8e6695e28afa349099c03668230f299c69ade3f8d59a89a2ff0e7a322136eec9080a20833c48111c5622d1007db15c325975992e6de37ae8142681ccf63f6310420521d"], 0x9e) ioctl$int_out(r1, 0x5462, &(0x7f0000000080)) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000880)=ANY=[@ANYBLOB="14040000100001002cbd7000fedbdf25070000000200000008000000", @ANYRES32=r2, @ANYBLOB="f4031a80f0032d80"], 0x414}], 0x1}, 0x0) 8.360812431s ago: executing program 0 (id=3603): socket$netlink(0x10, 0x3, 0x8000000004) socket$inet6_tcp(0xa, 0x1, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="1400000004000000040000002200000000000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00#\x00\x00\x00'], 0x50) r1 = socket$inet(0x2, 0x2, 0x7) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000000040)=0x8, 0x4) bind$inet(r1, &(0x7f0000000200)={0x2, 0x3, @empty}, 0x10) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000500)={r0, &(0x7f00000001c0), &(0x7f00000004c0)=@udp=r1}, 0x20) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$sock_int(r2, 0x1, 0xf, &(0x7f0000000180)=0x800001, 0x4) bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0xd, 0x10, &(0x7f0000000080)=ANY=[@ANYBLOB="1808000000000000000020002000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7"], 0x0, 0x8, 0x0, 0x0, 0x0, 0x6b, '\x00', 0x0, @sock_ops=0x1e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe}, 0x94) r3 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000040)={'macvtap0\x00', 0x0}) sendmsg$nl_route(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="280000001c00010029bd7000ffdbdf2507000000", @ANYRES32=r4, @ANYBLOB="80007f0a0a0002"], 0x28}, 0x1, 0x0, 0x0, 0x1}, 0x4040004) sendmmsg(r3, &(0x7f0000000000), 0x400000000000235, 0x0) listen(r2, 0x0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000140)={r0, &(0x7f0000000280), &(0x7f0000000100)=@tcp6=r2, 0x2}, 0x20) shutdown(r2, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f00000001c0)={'syztnl1\x00', &(0x7f0000000080)={'syztnl2\x00', 0x0, 0x2f, 0x81, 0x2, 0x7, 0x24, @private0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x20, 0x8, 0x7, 0x6}}) setsockopt$inet6_mreq(r2, 0x29, 0x15, &(0x7f0000000240)={@mcast1, r5}, 0x14) 7.945307s ago: executing program 0 (id=3607): bpf$ITER_CREATE(0x21, &(0x7f0000000100), 0x8) (async) r0 = bpf$ITER_CREATE(0x21, &(0x7f0000000100), 0x8) setsockopt$inet_sctp6_SCTP_ADAPTATION_LAYER(r0, 0x84, 0x7, &(0x7f0000000180)={0x8}, 0x4) (async) setsockopt$inet_sctp6_SCTP_ADAPTATION_LAYER(r0, 0x84, 0x7, &(0x7f0000000180)={0x8}, 0x4) socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000200)='ns/pid_for_children\x00') unshare(0x6a040000) (async) unshare(0x6a040000) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x80) (async) sendmsg$NFT_BATCH(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x80) sendmsg$NFT_BATCH(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000300)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a74000000060a0b04000000000000000002000000480004802c0001800b000100736f636b657400001c000280080002400000000b080001400000001908000300000000891800018008000100647570000c000280080001400000000c0900010073797a30000000000900020073797a32"], 0x9c}}, 0x0) r2 = socket(0x40000000015, 0x5, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x6, 0x3, &(0x7f0000000480)=ANY=[@ANYBLOB="1800000002020000000000000000100095"], &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, @fallback=0x2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x6, 0x3, &(0x7f0000000480)=ANY=[@ANYBLOB="1800000002020000000000000000100095"], &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, @fallback=0x2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r5 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f00000004c0)={'syzkaller1\x00', 0x0}) r7 = bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000980)={r4, r6, 0x25, 0x4, @val=@uprobe_multi={0x0, 0x0, 0x0, 0x8}}, 0x40) close(0x3) bpf$BPF_LINK_UPDATE(0x1d, &(0x7f0000000100)={r7, r4, 0x4, r4}, 0x10) (async) bpf$BPF_LINK_UPDATE(0x1d, &(0x7f0000000100)={r7, r4, 0x4, r4}, 0x10) bind$inet6(r2, &(0x7f0000000140)={0xa, 0x1, 0x0, @loopback={0xfec0ffff00000000}}, 0x1c) 6.833853194s ago: executing program 2 (id=3620): r0 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'hsr0\x00', 0x0}) r2 = bpf$TOKEN_CREATE(0x24, &(0x7f0000000680)={0x0, r0}, 0x8) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000640)={&(0x7f0000000480)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x129, 0x129, 0x8, [@struct={0x10, 0x6, 0x0, 0x4, 0x0, 0xfffffff4, [{0xc, 0x5, 0x1}, {0x2, 0x0, 0x3}, {0x7, 0x4, 0x2}, {0xa, 0x4, 0x4800}, {0xd, 0x1, 0x8001}, {0xf, 0x3, 0x57ab}]}, @func_proto={0x0, 0x4, 0x0, 0xd, 0x0, [{0x8, 0x1}, {0x2, 0x4}, {0xe}, {0x4}]}, @datasec={0x6, 0x1, 0x0, 0xf, 0x1, [{0x5, 0x5, 0x4}], "c5"}, @struct={0xa, 0x8, 0x0, 0x4, 0x0, 0x9, [{0x4, 0x3, 0x1}, {0x9, 0x4}, {0xf, 0x2, 0xfffffff6}, {0xf, 0x3, 0x9}, {0x10, 0x5, 0x89d}, {0x5, 0x5, 0x4}, {0x3, 0x5}, {0x6, 0x4, 0x51}]}, @typedef={0x6, 0x0, 0x0, 0x8, 0x5}, @volatile={0x10, 0x0, 0x0, 0x9, 0x4}, @restrict={0x8, 0x0, 0x0, 0xb, 0x2}]}, {0x0, [0x61, 0x30, 0x5f, 0x2e, 0x2e, 0x61]}}, &(0x7f0000000600)=""/7, 0x14c, 0x7, 0x0, 0x6, 0x10000, @value=r2}, 0x28) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$NL80211_CMD_STOP_NAN(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x14, r5, 0x800, 0x70bd25, 0x25dfdbff, {{}, {@void, @void}}, ["", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x20040000}, 0x20000090) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000100)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_CRIT_PROTOCOL_STOP(r4, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x1c, r5, 0x200, 0x70bd2a, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r6}, @void}}, ["", "", "", "", "", "", "", "", ""]}, 0x1c}}, 0x40000) bind$packet(r0, &(0x7f0000000040)={0x11, 0x1, r1, 0x1, 0x9}, 0x14) sendmsg$nl_route_sched(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000440)=@getchain={0x24, 0x11, 0x1, 0xfffffffe, 0x2000001, {0x0, 0x0, 0x0, r1, {0x7, 0xa}, {0xd, 0x9}, {0x8}}}, 0x24}, 0x1, 0x0, 0x0, 0x4000000}, 0x20048054) 6.401200023s ago: executing program 2 (id=3624): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x1f, 0x11, &(0x7f0000001080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe}, [@call={0x85, 0x0, 0x0, 0x11}, @snprintf={{}, {0x3, 0x3, 0x3, 0xa, 0xa}, {0x5}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r0}, {}, {0x85, 0x0, 0x0, 0xa7}}]}, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x10, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000000)={r1}, 0xc) r2 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000040)="2e00000011008188040f46ecdb4cb9cca7480e1211000000e3bd012a128748b429021627e305dd2b7a146efb4400", 0x2e}], 0x1}, 0x4048004) 6.160947157s ago: executing program 2 (id=3627): r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)={0x38, 0x1403, 0xc23, 0x70bd2a, 0x25dfdbff, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth0_to_bond\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x48845}, 0xc000) r1 = socket(0x2a, 0x2, 0x0) sendmsg$TIPC_NL_LINK_GET(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000280)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000040)=0x14) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, 0x0, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=@newqdisc={0x28, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {}, {0xb, 0x10}, {0x0, 0xfff3}}, [@TCA_STAB={0x4}]}, 0x28}}, 0x4880) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000015c0)=@newtfilter={0x4c, 0x2c, 0xd27, 0x70bd29, 0x0, {0x0, 0x0, 0x0, r2, {0xffe0, 0x2}, {0x0, 0xffe0}, {0x10, 0x3}}, [@filter_kind_options=@f_flower={{0xb}, {0x1c, 0x2, [@TCA_FLOWER_KEY_ETH_TYPE={0x6, 0x8, 0x800}, @TCA_FLOWER_KEY_IP_PROTO={0x5, 0x9, 0x84}, @TCA_FLOWER_KEY_PORT_DST_MIN={0x6, 0x59, 0x4e20}]}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4008000}, 0x24004000) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f00000004c0)={0x26, 'aead\x00', 0x0, 0x0, 'rfc4543(gcm(aes))\x00'}, 0x58) bind$alg(r5, &(0x7f0000000040)={0x26, 'aead\x00', 0x0, 0x0, 'pcrypt(generic-gcm-aesni)\x00'}, 0x58) r6 = socket$pppl2tp(0x18, 0x1, 0x1) sendmsg$inet(r6, &(0x7f0000000880)={0x0, 0x0, 0x0}, 0x40084) sendmmsg(r4, &(0x7f00000002c0), 0x40000000000009f, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(r1, 0x0, 0x2a, &(0x7f0000000380)={0x2, {{0x2, 0x4e22, @multicast1}}}, 0x88) 4.704813011s ago: executing program 4 (id=3634): r0 = socket(0x2000000000000021, 0x2, 0x10000000000002) sendmmsg(r0, &(0x7f0000000180)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)=ANY=[], 0x18, 0xe000}, 0x5}], 0x1, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r2 = socket(0x400000000010, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$unix(0x1, 0x1, 0x0) r3 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000080)={'veth0_to_bond\x00'}) sendmsg$L2TP_CMD_NOOP(0xffffffffffffffff, 0x0, 0x4000000) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_DESTROY(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000007c0)=ANY=[@ANYBLOB="1c0000000306010200000000000000000700000a0500010007"], 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x40814) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) r6 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000080)={'bridge0\x00', 0x0}) r8 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r8, &(0x7f00000000c0)={0x0, 0x0, 0x0}, 0x40044) r9 = socket$inet6(0xa, 0x3, 0x87) setsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f0000000280)={{{@in=@multicast2, @in=@local, 0x3, 0x8, 0x4e23, 0x0, 0x2}, {0x0, 0x0, 0x2000000, 0x2, 0xfffffffffffffff6, 0x2000000, 0x1, 0xfffffffffffffffd}, {0x1ff, 0x800000000000, 0x4, 0xffffffffffffff7f}, 0x1, 0x0, 0x2, 0x0, 0x1, 0x3}, {{@in6=@empty, 0xffffffff, 0x2b}, 0x2, @in=@loopback, 0x3504, 0x4, 0x0, 0x0, 0xffffffff, 0x6, 0x4}}, 0xe8) connect$inet6(r9, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0xff}}}, 0x1c) sendmsg$nl_route(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="0000101d00010000000000090000000700000000", @ANYRES32=r7, @ANYBLOB="40009604"], 0x1c}, 0x1, 0x0, 0x0, 0x4040000}, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000001c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="9feb010018000000000000003c0000003c0000000400"], 0x0, 0x58, 0x0, 0xa}, 0x28) sendmsg$IPSET_CMD_CREATE(r5, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000780)=ANY=[@ANYBLOB="580000000206030000000000000000000300000705000100070000000900020073797a31000000000c00078008001240000000050500050002000000050004000100000011000300686173683a69702c706f727400"], 0x58}, 0x1, 0x0, 0x0, 0x4000}, 0x20004000) r10 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r10, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000300)=ANY=[@ANYBLOB="50000000090601020000000000000000020000840900020073797a31000000000500010007000000280007800c00018008000140fffffff70500070088000000200004404e22000006000540"], 0x50}, 0x1, 0x0, 0x0, 0x10000082}, 0x90) connect$rxrpc(r0, &(0x7f00000001c0)=@in4={0x21, 0x3, 0x2, 0x10, {0x2, 0x4e20, @broadcast}}, 0x24) r11 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r11, &(0x7f0000000140)=[{&(0x7f0000000180)="580000001400192340834b80040d8c5610067f0200ff00000ec00000000058000b4824ca945f64009400ff0325010ebc000000000000008000f0fffeffe809005300fff5dd00000008000300090c1000000000800300", 0x56}], 0x1) socket$nl_audit(0x10, 0x3, 0x9) unshare(0x40010100) 4.704350086s ago: executing program 3 (id=3635): r0 = socket$l2tp(0x2, 0x2, 0x73) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x44, 0x6, 0x3c8, 0x0, 0x200, 0x98, 0x298, 0x200, 0x330, 0x330, 0x330, 0x330, 0x330, 0x6, 0x0, {[{{@ip={@multicast1, @dev={0xac, 0x14, 0x14, 0x13}, 0xff, 0xff000000, 'pim6reg1\x00', 'bridge_slave_0\x00', {}, {0xff}, 0x88, 0x3}, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0x168}}, {{@ip={@private=0xa010100, @local, 0x0, 0x0, 'vcan0\x00', 'veth0_virt_wifi\x00', {}, {0xff}}, 0x0, 0x70, 0xd0}, @common=@SET={0x60, 'SET\x00', 0x0, {{0xffffffffffffffff}, {0x0, [0x0, 0x0, 0x0, 0x2, 0x4, 0x11000000]}}}}, {{@uncond, 0x0, 0x70, 0x98}, @unspec=@CHECKSUM={0x28}}, {{@ip={@private=0xa010102, @multicast1, 0x0, 0xffffff00, 'syzkaller0\x00', 'bond0\x00'}, 0x0, 0x70, 0x98}, @unspec=@CHECKSUM={0x28}}, {{@ip={@remote, @initdev={0xac, 0x1e, 0x1, 0x0}, 0xff, 0x0, 'lo\x00', 'batadv_slave_1\x00'}, 0x0, 0x70, 0x98}, @inet=@DSCP={0x28, 'DSCP\x00', 0x0, {0x13}}}], {{'\x00', 0x0, 0x70, 0x98, 0x3000000}, {0x28}}}}, 0x428) 4.55014975s ago: executing program 3 (id=3636): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) sendmsg$AUDIT_SET(r0, &(0x7f0000004000)={0x0, 0x0, &(0x7f0000003fc0)={0x0}, 0x1, 0x0, 0x0, 0x10004001}, 0x40001) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="1c0000002e00090027bd70b8030000000400000004001d0004001f"], 0x1c}, 0x1, 0x0, 0x0, 0x20048010}, 0x4800) 4.534981299s ago: executing program 4 (id=3637): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r0, &(0x7f0000000200), 0x806000) ioctl$FS_IOC_RESVSP(r0, 0x40305829, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x9ffffc}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000300)={'bond_slave_0\x00', 0x0}) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=@base={0x6, 0xc, 0x6, 0x3, 0xa20, 0x1, 0x0, '\x00', r1, r0, 0x3, 0x2, 0x2}, 0x50) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="1c0000006900e97800000000000000000a0000000000000004000400"], 0x1c}}, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_IPV6_HOPOPTS(r6, 0x29, 0x36, &(0x7f0000000180)=ANY=[], 0x8) connect$inet6(r6, &(0x7f00000004c0)={0xa, 0x0, 0x0, @mcast2, 0x7}, 0x1c) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000080)='bridge0\x00', 0x10) sendmmsg$inet6(r6, &(0x7f00000041c0)=[{{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000500)="82", 0x1}, {&(0x7f00000000c0)="4bd07290ded4c02ee31878e3d7fe", 0xe}], 0x2}}, {{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}], 0x3, 0x4400c884) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0xe, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x29, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, r0, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r7, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000740)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x10000, {{@in=@multicast2, @in=@empty, 0x0, 0x0, 0x0, 0x0, 0xa, 0x20}, {0x20008, 0x10, 0x100000002, 0x0, 0xfff, 0xffffffffffffb473, 0xffffffffffffffff, 0x4}, {0x1000000003, 0x2000000000000000, 0x2, 0xffffffffffffffff}, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x3}}, 0xb8}}, 0x4004) r8 = socket$nl_xfrm(0x10, 0x3, 0x6) r9 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000980), r9) ioctl$sock_SIOCGIFINDEX_802154(r9, 0x8933, &(0x7f00000002c0)={'wpan4\x00'}) sendmsg$nl_xfrm(r8, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000004c0)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in=@loopback, @in, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x87}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffb}, {0x0, 0x0, 0x200000000000000}}}, 0xb8}}, 0x2c000010) r10 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000004c0)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in=@multicast1=0xe0000002, @in, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x87}, {0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x5, 0xfffffffffffffffb}, {0x0, 0x40000000000000, 0x200000000000000}, 0x2}}, 0xb8}, 0x1, 0x0, 0x0, 0x4000015}, 0x2c000010) sendto$inet6(r6, &(0x7f00000005c0)="cfc250", 0x3, 0x3b00, 0x0, 0x0) r11 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r11, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000340), 0x0, 0x0, 0x0, 0x60002}, 0x0) sendmsg$nl_route(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000600)=ANY=[@ANYBLOB="2000000076000d0b004000000000000003000000000000000801010002000000c59a5817de55db2fb4b9436840baf650e5daef046c8563534238d473846171fed41c2a90ac3828693eeaaf3477831f6063f354d359a8ca31b8b048b94768fe4386545138d09fef9ea0abdf6820705cb6101fefef2ed9d39ff7662b9ce009aefcab8eb897394f06d58a9ebd010a499d28c6eefe585cb833d804458eac672122902d873c6a04dd8f3a89264d685d9bde92e2011498054a04c4420a89549bd66455729f5b7edb8b6b510aa5feefe1b575fae2cdc89035e3e3cad91a5ca938d95811520743"], 0x20}}, 0x0) sendmsg$nl_route(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="2c0000001900010000000000fedbdf250a140000fd13e4aa5d36000008001e80"], 0x2c}, 0x1, 0x0, 0x0, 0x200000d5}, 0x4050) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000040)={0x15, 0x8, &(0x7f00000001c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, [@tail_call={{0x18, 0x2, 0x1, 0x0, r2}}]}, &(0x7f0000000240)='GPL\x00', 0xa, 0x0, 0x0, 0x0, 0xd}, 0x94) 4.32156589s ago: executing program 3 (id=3638): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) connect$inet6(r0, &(0x7f0000000280)={0xa, 0x1, 0xfffffffe, @ipv4={'\x00', '\xff\xff', @empty}}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f00000000c0), 0x4) setsockopt$inet6_tcp_TLS_TX(r1, 0x11a, 0x1, &(0x7f0000000140)=@gcm_128={{0x303}, "77480552ca790d83", "4a0e8914eaf00085fbbb8f1f1ac7ce62", "3d40e2c4", "730a94eaa0148981"}, 0x28) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nbd(&(0x7f0000000200), r2) sendmsg$NBD_CMD_CONNECT(r2, &(0x7f00000027c0)={0x0, 0x0, &(0x7f0000002780)={&(0x7f00000002c0)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010029bd7000fbdbdf25010000000c00020000000000000000001c0007801800018008000100", @ANYBLOB="04"], 0x3c}, 0x1, 0x0, 0x0, 0x4000004}, 0x4000) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='freezer.state\x00', 0x275a, 0x0) write$cgroup_int(r4, &(0x7f0000000000), 0xffffff6a) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r4, 0x84, 0x1d, &(0x7f0000000100)={0x6, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, &(0x7f00000001c0)=0x1c) socket$inet6_sctp(0xa, 0xb8aaef91f2f438e9, 0x84) socket$inet6_sctp(0xa, 0x6, 0x84) setsockopt$MRT_DEL_VIF(r4, 0x0, 0xcb, &(0x7f0000000480)={0x0, 0x0, 0x7, 0x2b, @vifc_lcl_addr=@local, @broadcast}, 0x10) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) r6 = socket$nl_crypto(0x10, 0x3, 0x15) sendmsg$nl_crypto(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="e00000001300100000000000000000007374726565626f673531322d67656e657269"], 0xe0}}, 0x0) sendmsg$nl_crypto(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000340)=ANY=[], 0xf0}, 0x1, 0x0, 0x0, 0x4004080}, 0x0) sendmsg$NFT_MSG_GETCHAIN(r5, &(0x7f0000000440)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x800800}, 0xc, &(0x7f0000000400)={&(0x7f00000004c0)=ANY=[@ANYBLOB="20000000040a010100000000000000000a0000010900030073797a320000000083df0a63f183422e4215036c08a6377775327d731a22565a505990290b084f38d7af564b530c79f51a3b1c74ad86292d882cae"], 0x20}, 0x1, 0x0, 0x0, 0x40}, 0x80) socket$tipc(0x1e, 0x2, 0x0) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r7) r8 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r7, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty}, 0x1c) listen(r8, 0x0) r9 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r9, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) accept(r8, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) 4.068590956s ago: executing program 4 (id=3639): r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) close(0x3) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_int(0xffffffffffffffff, &(0x7f0000000200), 0x806000) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000096c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000880)=@newtaction={0x104, 0x30, 0xb, 0x0, 0xfffffffd, {}, [{0xf0, 0x1, [@m_sample={0xec, 0xc, 0x0, 0x0, {{0xb}, {0xc, 0x2, 0x0, 0x1, [@TCA_SAMPLE_TRUNC_SIZE={0x8, 0x4, 0x8}]}, {0xb5, 0x6, "ad7fe91012cbc0fb1b564eef112abf69b5f38ef058ec614467360880030de38097451c29e57eb5bb838673ee12d3755cc125bdb18ccbf300537b228a1ff8bd5ee8e65ed3d423079d6dd5e687303bb62764667259c87dce550ba67d44959da78ae57c3125683fdf259afd9792a827c96b801d23fac48eb3af99ab0680f9606fa3cba7da778fa9b2533c7a51500e8dceb4e7874d528de6166e5ce340a42060a1af4f40a971f676e1914563399bc0563ab8a0"}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x2, 0x2}}}}]}]}, 0x104}, 0x1, 0x0, 0x0, 0x8000}, 0x0) r1 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r1, &(0x7f0000000080)={0x0, 0x74, &(0x7f0000000100)=[{&(0x7f00000001c0)="5c00000012006bab9a3fe3d86e17aa0a046b876c1d0048007ea60864160af36504001a0038001d001931a0e69ee517d34460bc06000000a705251e6182949a3651f60a84c9f4d4938037e70e4509c5bb", 0x33fe0}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) recvmsg$kcm(r1, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x40012100) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000500)=ANY=[@ANYBLOB="40000000100003042bbd7000fedbdf2500000300", @ANYRES32=0x0, @ANYBLOB="20100000000001f0200012800b00010067656e65766500001000a2eeea9e62bce1450a07239f7b4ac647f40934020000000000ae53b7ab2a89f456493010f6e4b37e8e8568d80b3589e98e21086cf99e227503a9faa5710a012f39a3660268957c65c6b616c04ab9d464e773e5dc661709d2b08535834c01958e55d349ab974261f04f038c440e00346a06d0d6ffa424e237b506d574c2d88179b93fdef91b0a6ed0e3b67ba45e3d9282a5c9795e4446bc2b4f95972046657c5a7a"], 0x40}, 0x1, 0x0, 0x0, 0xc1}, 0x40080) r3 = socket$packet(0x11, 0x2, 0x300) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1801000011000000000000000000000018120000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa20000000000000702"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x14, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r5 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=ANY=[@ANYBLOB="4400000010001ffffeffffff8000000200000000", @ANYRES32=0x0, @ANYBLOB="00000000003f00001c0012800b00010067726574617000000c00028008000700ac1414220800040000100000"], 0x44}}, 0x4000) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000023c0)={0x0, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="180200000700003b0000000000800000850000007500000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000600)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x22, '\x00', 0x0, @fallback=0x9, r0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$sock_attach_bpf(r3, 0x1, 0x32, &(0x7f0000000180)=r6, 0x4) socket$inet6_sctp(0xa, 0x801, 0x84) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a14000000090a0104000000000000000003000000140000001000410000000000000a"], 0x3c}}, 0x4) ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305829, &(0x7f0000000380)={0x0, 0x0, 0x4000, 0x9ffffc}) r8 = socket(0x10, 0xa, 0x0) write(r8, &(0x7f0000000040)="1c2000001a009b8a14000002009b301f00"/28, 0x1c) r9 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r9, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="640000001000ffff25bd7000fddbdf2500000000", @ANYRES32=0x0, @ANYBLOB="7a0a0500212b000044003400028014000300ff00000000000002040082620000003f14000200fe80"], 0x64}}, 0x24000000) r10 = bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="06000000040000000800000007"], 0x50) r11 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000000085000000b000000018110000", @ANYRES32=r10, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000c300000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r11}, 0xc) socket(0x1e, 0x1, 0x0) 3.66059022s ago: executing program 4 (id=3641): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='devices.list\x00', 0x275a, 0x0) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x3261e) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0) close(0xffffffffffffffff) r3 = socket$kcm(0x29, 0x3, 0x0) r4 = openat$cgroup_ro(r2, &(0x7f0000000140)='blkio.bfq.io_service_time_recursive\x00', 0x275a, 0x0) write$cgroup_int(r4, &(0x7f0000000000), 0xffffff6a) r5 = socket$kcm(0x29, 0x5, 0x0) sendmsg$kcm(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000ac0)=[{&(0x7f0000000b00)="b6bd7e4983a45b31f79d80060400000000000000a33734d88229acf96457ad59d0b87f8659b614043e3d21a7cacecab8bbd26251b93b28b4d83e618673f9c74d0a28a5146c5511549fa617e908352c87d8ddff2ce042a1e58eb7b63759cab3526dd8ae1566ddcfb5fa83", 0x6a}, {&(0x7f0000000880)="3aa854", 0x3}, {0x0}], 0x3}, 0xc854) setsockopt$sock_int(r5, 0x1, 0x12, &(0x7f0000000180)=0x4c, 0x4) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), r2) sendfile(r3, r4, 0x0, 0xffffffff000) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_GET_PROTOCOL_FEATURES(r4, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x400}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x44010}, 0x40000) sendmsg$NL80211_CMD_FLUSH_PMKSA(r1, &(0x7f0000000380)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f00000001c0)={&(0x7f00000003c0)=ANY=[@ANYBLOB="df0ff7c7c8ff78c793b8d3a637c79736bc09ee6f950b2ad428bacf9d5b6092e3ca0e52d84333fb780b85", @ANYRES16=r6, @ANYBLOB="020025bd7000fcdbdf2536000000"], 0x14}, 0x1, 0x0, 0x0, 0xc010}, 0x4040) sendmsg$NL80211_CMD_RELOAD_REGDB(r1, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000340)={0x14, r7, 0x1, 0x70bd2d, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x20000000}, 0x20008004) r8 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r8, &(0x7f0000000000)={0x2, 0x4e21, @broadcast}, 0x2f) connect$inet(r8, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x1b}}, 0x10) sendto$inet(r8, &(0x7f0000000000), 0xffffffffffffff94, 0x0, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r8, 0x6, 0xd, &(0x7f00000000c0)='bbr', 0x3) recvfrom$inet(r8, &(0x7f0000000080)=""/8, 0xfffffffffffffd0b, 0x720, 0x0, 0xfffffffffffffd25) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, 0x0) socket$inet_sctp(0x2, 0x1, 0x84) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x4000000) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000001980)={&(0x7f0000000200)=@newchain={0x2c, 0x64, 0x300, 0x70bd25, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {0x7, 0x7}, {0xfff2}, {0xa, 0x1ffe4}}, [@TCA_CHAIN={0x8, 0xb, 0x9}]}, 0x2c}, 0x1, 0x0, 0x0, 0x48848}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000006c0)=ANY=[@ANYRES32=0x0, @ANYBLOB="000000000000000008001b000000000004001a80180002"], 0x44}}, 0x0) r9 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r9, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) 3.659966704s ago: executing program 1 (id=3642): r0 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000000)=0x800, 0x4) r1 = socket(0x10, 0x3, 0x0) write(r1, &(0x7f0000000000)="240000001a005f0400f9f407000904018000000020000000000000", 0x1b) r2 = socket$kcm(0xa, 0x2, 0x0) pwritev(0xffffffffffffffff, 0x0, 0x0, 0x100, 0x7) socket$nl_netfilter(0x10, 0x3, 0xc) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=@newqdisc={0x5c, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {0x9, 0x1}, {0x4}, {0xe, 0xd}}, [@TCA_EGRESS_BLOCK={0x8, 0xe, 0x401}, @TCA_STAB={0x28, 0x8, 0x0, 0x1, [{{0x1c, 0x1a, {0x0, 0x0, 0x491, 0x0, 0x0, 0x0, 0x8, 0x2}}, {0x8, 0x1b, [0x0, 0x0]}}]}, @TCA_INGRESS_BLOCK={0x8}]}, 0x5c}, 0x1, 0x0, 0x0, 0x90}, 0x4000c00) close(0x4) socket(0x2, 0x80805, 0x0) r4 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$IP_VS_SO_SET_ADD(r4, 0x0, 0x482, &(0x7f0000000040)={0x84, @rand_addr=0x64010101, 0x4e22, 0x3, 'rr\x00', 0x1, 0x80005, 0x6f}, 0x2c) sendmsg$sock(r2, &(0x7f00000000c0)={&(0x7f0000000580)=@in6={0x2, 0x4e21, 0x0, @dev}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0) 3.430674901s ago: executing program 1 (id=3643): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000b00)=ANY=[@ANYBLOB="1e0000000000000005000000ff"], 0x50) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000004c0)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005700000095"], 0x0, 0x8, 0x0, 0x0, 0x0, 0x80}, 0x94) r1 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000540)={&(0x7f0000000300)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x11c, 0x11c, 0xb, [@struct={0x1, 0x9, 0x0, 0x4, 0x0, 0x4, [{0x9, 0x1, 0xdaf}, {0x5, 0x1}, {0xa, 0x2, 0x8}, {0x0, 0x2, 0x5}, {0xc, 0x2, 0x2b}, {0xa, 0x4, 0x7c60}, {0x8, 0x4}, {0x0, 0x4, 0xdf7}, {0x0, 0x0, 0x1}]}, @func_proto={0x0, 0x8, 0x0, 0xd, 0x0, [{0x2, 0x2}, {0x5, 0x4}, {0x1, 0x4}, {0x5, 0x1}, {0x6}, {0x10, 0x2}, {0xe}, {0x8, 0x2}]}, @fwd={0xe}, @int={0x9, 0x0, 0x0, 0x1, 0x0, 0xf, 0x0, 0x6e, 0x3}, @int={0x9, 0x0, 0x0, 0x1, 0x0, 0x66, 0x0, 0x21, 0x4}, @func_proto={0x0, 0x1, 0x0, 0xd, 0x0, [{}]}, @func={0x6, 0x0, 0x0, 0xc, 0x2}, @const={0x4, 0x0, 0x0, 0xa, 0x6}]}, {0x0, [0x2e, 0x2e, 0x30, 0x0, 0x5f, 0x0, 0x0, 0x2e, 0x61]}}, &(0x7f0000000440)=""/254, 0x13f, 0xfe, 0x0, 0x80, 0x10000}, 0x28) bpf$MAP_CREATE(0x0, &(0x7f0000000580)=@bloom_filter={0x1e, 0x9, 0x4, 0x3, 0x200, r0, 0x9, '\x00', 0x0, r1, 0x4, 0x3, 0x4, 0x2}, 0x50) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x1, 0xf, &(0x7f0000004280)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0x99f}, {{0x18, 0x1, 0x1, 0x0, r2}}, {{0x5, 0x0, 0x5, 0x9, 0x0, 0x1, 0x20}}, [], {{}, {}, {0x85, 0x0, 0x0, 0xd4}, {0x7, 0x0, 0xb, 0x0, 0x0, 0x0, 0x6400}}}, &(0x7f0000004380)='GPL\x00', 0x5, 0x20, &(0x7f0000000000)=""/32, 0x40f00, 0xa, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3}, 0x94) 3.287567764s ago: executing program 3 (id=3644): r0 = socket$netlink(0x10, 0x3, 0xc) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000200), 0x4) socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r1, 0x0, 0x20004000) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, 0x0, 0x20008054) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x6, 0x6, &(0x7f00000004c0)=ANY=[@ANYBLOB="18020000fdffffff00000000feffffff850000006d000000180000000300000000005d3a9da00040950000000000000065a323a005f1c53516752b259fb404c22a577e8526"], &(0x7f00000001c0)='GPL\x00', 0x2, 0x0, 0x0, 0x40f00, 0x40, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x4}, 0x94) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="19000000040000000400000002"], 0x48) r5 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x16, 0x4, &(0x7f0000000540)=ANY=[@ANYBLOB="b40000000000000079109000000000007b0ae8ff00000000950000000000000018d653c639d6870eb20c3284bd24b8bf66289afc28372f73dc17d8a2f63f4f6a8ecfdf1b02ebb4df730069c2c17bc608b61b80ad4407808f53de1b23f1e3b790402754cbbf433d902ab5a00657321e776cdc"], &(0x7f0000003ff6)='GPL\x00', 0x5, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @flow_dissector, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x3f}, 0x48) ioctl$PPPIOCGFLAGS1(0xffffffffffffffff, 0x8004745a, &(0x7f0000000640)) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r5, r4}, 0xc) close(0x3) socket$inet6_sctp(0xa, 0x5, 0x84) r6 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(0xffffffffffffffff, 0x0) close(0x3) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r6, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x10, &(0x7f00000001c0)=[@in={0x2, 0x4e23, @rand_addr=0x64010100}]}, &(0x7f0000000140)=0x10) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r6, 0x84, 0x7a, &(0x7f0000000340)={r7, @in6={{0xa, 0x3, 0x3, @mcast1}}}, &(0x7f0000000180)=0x84) sendmsg$NL802154_CMD_SET_MAX_CSMA_BACKOFFS(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000100)={0x0}, 0x1, 0x0, 0x0, 0x40000}, 0x44844) openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x800, 0x0) sendmsg$IPSET_CMD_ADD(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000300)=ANY=[@ANYBLOB="50000000090601020000000000000000020000840900020073797a31000000000500010007000000280007800c00018008000140fffffff70500070088000000060004404e22000006000540"], 0x50}, 0x1, 0x0, 0x0, 0x10000082}, 0x90) sendmsg$IPSET_CMD_DESTROY(r3, &(0x7f0000001640)={0x0, 0x0, &(0x7f0000001600)={&(0x7f0000001580)=ANY=[@ANYBLOB="2800000003060500660e0000000000000a000005090002f272017a31000000000500010007000000"], 0x28}, 0x1, 0x0, 0x0, 0x40}, 0x14) syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), r0) ioctl$XFS_IOC_GOINGDOWN(0xffffffffffffffff, 0x8004587d, &(0x7f0000000440)=0x9) syz_genetlink_get_family_id$batadv(&(0x7f0000000380), r0) sendmsg$BATADV_CMD_GET_HARDIF(r2, &(0x7f0000000480)={&(0x7f0000000600)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000400)={&(0x7f00000005c0)=ANY=[@ANYRESOCT, @ANYBLOB, @ANYRES16=r2], 0x3c}, 0x1, 0x0, 0x0, 0x40000}, 0x8000) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x404c896}, 0x0) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="980000000001010400000000000000000a0000003c0001802c00018014000300fe8000000000000000000000000000aa14000400ff0100000000000000000000000000010c00028005000100000000003c0002802c00018014000300fe8000000000000000000000000000aa14000400fe8800000000000000000000000000010c0002800500010000000000080007"], 0x98}}, 0x0) 3.213225742s ago: executing program 1 (id=3645): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000007500)=ANY=[@ANYBLOB="2c0000003e0007012bbd700000000000017c00000400fc800a000180356ee80200000000080002"], 0x2c}, 0x1, 0x0, 0x0, 0xc000}, 0xc040) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000000)={'pim6reg1\x00', 0x2}) ioctl$TUNSETLINK(r2, 0x400454cd, 0x7) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000000100)={'pim6reg1\x00', @broadcast}) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000007500)={0x2c, 0x3e, 0x107, 0x70bd2b, 0x0, {0x1, 0x7c}, [@nested={0x4, 0xfc}, @nested={0xa, 0x1, 0x0, 0x1, [@generic="356ee88bd200"]}, @nested={0x8, 0x2, 0x0, 0x1, [@nested={0x4, 0x33}]}]}, 0x2c}, 0x1, 0x0, 0x0, 0xc000}, 0xc040) 1.865491768s ago: executing program 1 (id=3646): r0 = socket$l2tp(0x2, 0x2, 0x73) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x44, 0x6, 0x3c8, 0x0, 0x200, 0x98, 0x298, 0x200, 0x330, 0x330, 0x330, 0x330, 0x330, 0x6, 0x0, {[{{@ip={@multicast1, @dev={0xac, 0x14, 0x14, 0x13}, 0xff, 0xff000000, 'pim6reg1\x00', 'bridge_slave_0\x00', {}, {0xff}, 0x88, 0x3}, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0x168}}, {{@ip={@private=0xa010100, @local, 0x0, 0x0, 'vcan0\x00', 'veth0_virt_wifi\x00', {}, {0xff}}, 0x0, 0x70, 0xd0}, @common=@SET={0x60, 'SET\x00', 0x0, {{0xffffffffffffffff}, {0x0, [0x0, 0x0, 0x0, 0x2, 0x4, 0x11000000]}}}}, {{@uncond, 0x0, 0x70, 0x98}, @unspec=@CHECKSUM={0x28}}, {{@ip={@private=0xa010102, @multicast1, 0x0, 0xffffff00, 'syzkaller0\x00', 'bond0\x00'}, 0x0, 0x70, 0x98}, @unspec=@CHECKSUM={0x28}}, {{@ip={@remote, @initdev={0xac, 0x1e, 0x1, 0x0}, 0xff, 0x0, 'lo\x00', 'batadv_slave_1\x00'}, 0x0, 0x70, 0x98}, @inet=@DSCP={0x28, 'DSCP\x00', 0x0, {0x13}}}], {{'\x00', 0x0, 0x70, 0x98, 0x4000000}, {0x28}}}}, 0x428) 1.807998876s ago: executing program 2 (id=3647): r0 = socket(0x2000000000000021, 0x2, 0x10000000000002) sendmmsg(r0, &(0x7f0000000180)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)=ANY=[], 0x18, 0xe000}, 0x5}], 0x1, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r2 = socket(0x400000000010, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$unix(0x1, 0x1, 0x0) r3 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000080)={'veth0_to_bond\x00'}) sendmsg$L2TP_CMD_NOOP(0xffffffffffffffff, 0x0, 0x4000000) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_DESTROY(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000007c0)=ANY=[@ANYBLOB="1c0000000306010200000000000000000700000a0500010007"], 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x40814) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) r6 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000080)={'bridge0\x00', 0x0}) r8 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r8, &(0x7f00000000c0)={0x0, 0x0, 0x0}, 0x40044) r9 = socket$inet6(0xa, 0x3, 0x87) setsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f0000000280)={{{@in=@multicast2, @in=@local, 0x3, 0x8, 0x4e23, 0x0, 0x2}, {0x0, 0x0, 0x2000000, 0x2, 0xfffffffffffffff6, 0x2000000, 0x1, 0xfffffffffffffffd}, {0x1ff, 0x800000000000, 0x4, 0xffffffffffffff7f}, 0x1, 0x0, 0x2, 0x0, 0x1, 0x3}, {{@in6=@empty, 0xffffffff, 0x2b}, 0x2, @in=@loopback, 0x3504, 0x4, 0x0, 0x0, 0xffffffff, 0x6, 0x4}}, 0xe8) connect$inet6(r9, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0xff}}}, 0x1c) sendmsg$nl_route(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="0000101d00010000000000090000000700000000", @ANYRES32=r7, @ANYBLOB="40009604"], 0x1c}, 0x1, 0x0, 0x0, 0x4040000}, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000001c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="9feb010018000000000000003c0000003c0000000400"], 0x0, 0x58, 0x0, 0xa}, 0x28) sendmsg$IPSET_CMD_CREATE(r5, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000780)=ANY=[@ANYBLOB="580000000206030000000000000000000300000705000100070000000900020073797a31000000000c00078008001240000000050500050002000000050004000100000011000300686173683a69702c706f727400"], 0x58}, 0x1, 0x0, 0x0, 0x4000}, 0x20004000) r10 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r10, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000300)=ANY=[@ANYBLOB="50000000090601020000000000000000020000840900020073797a31000000000500010007000000280007800c00018008000140fffffff70500070088000000060003404e22000006000540"], 0x50}, 0x1, 0x0, 0x0, 0x10000082}, 0x90) connect$rxrpc(r0, &(0x7f00000001c0)=@in4={0x21, 0x3, 0x2, 0x10, {0x2, 0x4e20, @broadcast}}, 0x24) r11 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r11, &(0x7f0000000140)=[{&(0x7f0000000180)="580000001400192340834b80040d8c5610067f0200ff00000ec00000000058000b4824ca945f64009400ff0325010ebc000000000000008000f0fffeffe809005300fff5dd00000008000300090c1000000000800300", 0x56}], 0x1) socket$nl_audit(0x10, 0x3, 0x9) unshare(0x40010100) 1.791435578s ago: executing program 4 (id=3648): r0 = socket(0x28, 0x5, 0x0) bind$vsock_stream(r0, &(0x7f0000000040), 0x10) listen(r0, 0x0) r1 = socket(0x28, 0x5, 0x0) connect$vsock_stream(r1, &(0x7f0000000080), 0x10) setsockopt$sock_linger(r1, 0x1, 0x3c, &(0x7f0000000180)={0x1, 0x5}, 0x8) sendmmsg(r1, &(0x7f0000000100)=[{{0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000000)="1b", 0x1}], 0x1}}], 0x1, 0x24008094) r2 = accept4$unix(r0, 0x0, 0x0, 0x0) recvfrom$unix(r2, &(0x7f0000000280)=""/279, 0x117, 0x0, 0x0, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r4, 0x8916, &(0x7f0000000040)={'team_slave_1\x00', @random="020000c6fa00"}) r5 = syz_genetlink_get_family_id$tipc(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$TIPC_CMD_SET_LINK_TOL(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)=ANY=[@ANYBLOB='h\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="01002cbd7000fedbdf25010000000000000007410000004c00180000e29804e2f90000696200"/96], 0x68}, 0x1, 0x0, 0x0, 0x4000}, 0x10000000) 1.692979282s ago: executing program 3 (id=3649): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$TIPC_CMD_ENABLE_BEARER(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x34, r1, 0x200, 0x70bd26, 0x25dfdbfe, {{}, {}, {0x18, 0x17, {0x17, 0x1, @l2={'ib', 0x3a, 'pimreg1\x00'}}}}, ["", "", ""]}, 0x34}, 0x1, 0x0, 0x0, 0x4000}, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000180)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_ADD_TX_TS(r0, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x38, 0x0, 0x100, 0x70bd2a, 0x25dfdbff, {{}, {@val={0x8, 0x3, r2}, @val={0xc, 0x99, {0x7fff, 0x4c}}}}, [@NL80211_ATTR_USER_PRIO={0x5, 0xd3, 0x2}, @NL80211_ATTR_USER_PRIO={0x5}]}, 0x38}, 0x1, 0x0, 0x0, 0x4012}, 0x4000000) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETSETELEM(r3, &(0x7f00000003c0)={&(0x7f0000000280), 0xc, &(0x7f0000000380)={&(0x7f00000002c0)={0xb8, 0xd, 0xa, 0x101, 0x0, 0x0, {0x2, 0x0, 0x7}, [@NFTA_SET_ELEM_LIST_ELEMENTS={0xa4, 0x3, 0x0, 0x1, [{0xa0, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_OBJREF={0x9, 0x9, 'syz1\x00'}, @NFTA_SET_ELEM_USERDATA={0x8f, 0x6, 0x1, 0x0, "9b28ccbe365968663422c342c9b0a777d530f9f80bcc36dc61cbb4cb25b047fe08469192fedbd5bc90c0dc1faffef426e297dfcccd5cfd3e7b8c913341bcaa3cc6e364c78d2fa8ad9fcc3af4cb5e05654c01f3f30e472fe19405990d5060f31c7ec3f8461e3f456adbbb1476b734178bc199439a6cb42139c747c223b76f92524cde4dc76b6e9beaedd171"}]}]}]}, 0xb8}, 0x1, 0x0, 0x0, 0x4040000}, 0x4000101) r4 = bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000400)={0xffffffffffffffff, 0x0, 0x25, 0x9, @void}, 0x10) r5 = bpf$ITER_CREATE(0x21, &(0x7f0000000440)={r4}, 0x8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_ULP(r6, 0x6, 0x1f, &(0x7f0000000480), 0x3) r7 = socket$alg(0x26, 0x5, 0x0) ioctl$BTRFS_IOC_SNAP_DESTROY(r7, 0x5000940f, &(0x7f00000004c0)={{r3}, "938e4bed69c6fc06a40dc37fe67f9a7d54747eea0773fcb0d8040402507e93dbec469d23be0663b3fd8b9fd46ce9d77a47e677c39a418fe828e7e63a0424e96d4f01ba5dbec6f540b58c04efde2cf260cc66d0936a77e49c978958ab07efc12fb6e7e89300ec44f330de8a3b575e7a6ea2f9dc230d4830a01d515ed1a3b4ff0d4d6919e4ec90e4a6d3fa70954a14ef95101d15d428adb76454915490b6ee4a47105874c2ad588d0010e4871f43a8bb750a2aa4ebc3509f4b7f32b6c92a0d4b028cf54e67f85faefd3a60083aebdebc38c386003abd438c753a8a564186f5748859797b9b926a474be55494a7fa995aea5a36499871067921f4344f1e6bf3ebfde12c644e459c3c4c829d07bc8f7fbc62e82ba6dbef9273a65ca2567e48b8c70a595f6b98fe1586a2403b40df1082aee02a9b1245230d6109aee8fa013ede020d9130952ccfde32fe7afccc5c0eb993ea8a1ddac4bb8dc737b4592a23ce4b228e88992407edd3de19be5acb225baf66965fb0e0f35f37c9a5bee5a9afeb9f5d82b4338bdaffe204c160fa710dcf97dbe1a42d35e640e9cf6032642eb252f550b67975e4a203d15a56308e851feebc539649034b8209dd392105a9f2d78037c439380270c32b09ba7b0694a96efe41980d9cd090bb1b1a997644fd83bfaa7e300816114e6ba8582d7a46abf8e85dc3273f1680427763016f48545a95688bd2f585042197c080570b8cb8533d5844b7a5613ea80b983360ce8f2958248d19e61195ba6d6daf2af2b5bf68c3991c830bbd6749df5e150b2c383cc071de1cae662250e929e042969fb1ef7032cc8f166bb074da9c980de7789dddcd0eb450c2e79c2678d50b448bb7936c4578d810a269c9760207832c7ae983b61dc25d1ca0ef8a53ddfdd49efac2eac6315eb91698c31aa4682bf7261c8ecb2da847347532b9042ae35e8af3ad362984ec37530cde44551d1c4a094f1ae76df1df893a8d0eb0eb0a7d31964b6f4ed16a008fe54936faa5673314267e0b5ba9d8cc64654c22fd4fe676b5b47c4b00c06c70b592cdd4991441262ce577195fbc810b9b3bafd7a70b37978a43f0cff101802cdb79d9104747ffafa90d5b1120a28abf6f1d686590ba31578c0f04f7e15d08ef3193106cd61ed51bbaa72af2b767ef49bf052012f79317e0c47af18053781e915519d8b608517c8733c252480fc1a623bf503883016892a13eeadda923c4207bd5ca44cf7e4984511fb1fad6ff5def0f9cf620c8697322d66da08241018bc3f25ea26d9e4ed0b5eef043f8ac5bcc99af2b60f7f49bd0abd5fe57c6044e8d452975a4432fc5a38f48bd234681756edede165a225700d3ddb64151f623f8012c4cabab963d75464bbb5d25f68238f38f4fa93fd1e8937c599abeef2660101d0ad23d7235e4fedef313ab9cf4661b61f3d19e67e4c3244f8eb60bcee94873b6ed1091bb296c2a3e543ae20d4dcd0913072a1eb3f910d5818002206c3864cb9ba91e68dd1baafe9d5601e7472b1e9058a20573f13d8f9cdf35e66a2650832032ae9a42a863e33936aa98223cdef3ef9bcc7826bea5abab8d569d1ff443a9539c7afa611795ef2863a63badd61d3d77b3ed799f62e42ae11304f2bfcedcec8bbec6b3a8b97a2c86d0bd023583abaf7a3e4c35d07a50d3c19fbadfcf32d9985e4a3ccc7cbb7663a50fab476e0c3e3ea22c5a53dec6662acbec1c655302aefd15e1b456b627fd8b2177d6e5396dcce0a6af1fefa9c84b85c8c823498ffc1fb96dff25ee08c0d7950238e58591e40cb52c3dc65206b3a4eee928c2519d9f4a2b8f9f4d2a24ab462918426bd8bf5be9d1b66596774b1fcada5834bb85d12e7d9b9e7313960f68eaf3b53cb495299e78930ea4670d84b50018f9e4130cb564932cdffdc8579841c5d6a3de0662cce13fb03fa23e4ad5f27f0bee70cd35db130bd0f470c7a8f2ffcfedf3ab3dffab7a05634cde5ce917ca7c25a95aba334ab1ceff9b80a31f0cafceba49b62fbe9ae9c094547a0886b8c9cb71c09db1827d2703fe2798cfa14fa93159243e27eda1227ae959046dfb1db43e77cb37b1e9324cb56203c3a72f1e2296e474503e3b164ed8ae5b04f0504dd7ef66ff434e4385bbaecd6c6aa17d9116679a567eb7148c88a87a8507af504e00b47265ae0ee3dd57e95a4272673bf64ae36a9278708074e421bf996e7d6485470247fdf6f8ac29b67ee1d2e2b24222e15c3f20a3f019aac7b1b58f2ec2bdd6e1517d700fd773854ffe88b11876a580ba9afef7ecf7bfa9aacaae8dd2ce67bf7d04ea2631951130b529b3662db2d005ff5ea94942abb04329e014e3fc9ae65beb10a46f73ae5d6ce3dfd1fef6fdc5c733747bc2005ba27b76d05f573e861610493e6b997f9c99e5ea6ce0c603144b2e1cac04a86a35d4be5c1af399f410f660f555dde67adc46e2e4cbce86d3fecf13b2a467da72735ec0508a2d15f03c4792024d77f87842fd0af33a636c22b89909c7037637bd4684c7306a280cb8a072f8e1ea283a105d8746662006c5c2d32b0bc563598210f67cef1c968c879cc545015c74ae57aedec48223e136a04dc4348b82d324bfd3db321af5972491f1d25b0a6e67240844ed7f15ca811eb5b41dca7dad7654b65595695891042bc6776a7d5925a98327b93e955ff3d55a4edbfdf31206a71c2c9209546d1a86df19fda4feefd0d9b6de05c87cdec0c47f87f793a94e45dfc6e12409d8fbe477ed756604817ac84c6e5fd50c11060ea3af5c20951f57d520e24aa0e1687a259aac83054eea3dad279a75769f11e7ca2c0f63619c02f62fe24889247a87c1e84818ade3bd169990d74dc295a5be108e5025aeb81049f761bc962d2737dce6ca878fde74a87162d439c413e83fc3abcb2f92c0db5aef1c293a0f6761feffa9c050790b33bef1df4a3c2e9134fa28c8a57e99502ecce4689740e8ff95eaf4125ad13d3b919e110c7be9d2680e1760eec8c3038f336f63727109bda3bf587a07be44072564046ccb3220dc02c43972c142ec469d2db260c73c8f3bfc9839b37980b26fc8cc3f823a154ea413253f330bebfc58c2cb3fc7df4c0ffa5ace1e72448f7654ae4ab5698ba0c350d5b9978e28fa6d2805ec0c843b14c6435b5695b5bcd1bc30822a88559c5cc04713dfb2121da4d801d935d554ea9c5771dd2026e33ac8df100bfd48f7ee06d352bc3782e66aa0b9460faaa885490e0b9a4e1e382034e0eda86334cf209335cd5615c9c01cc753ab4e93f3bfd78d0fd9e12e49bcfe1fc5bfc987d1d2bae57106218a43a8e0e4758fd74d0902d2a383b217a10493ba7953d2948a8c765ee6b50f39604292f4e84dbe3e5ff32ba7d910f1218fae92de9159f1cfbc2fa667455d9a44ce00469fe128c50ac9f98f10312e8ca3edf841288e57ce73e36372b4bc3bebe7eada5cbbd75bb753bd8c00cb040d390e77ee575929a2108d4a94274a364771183f484e343cc5ae2b08cc14331701f479a66a22f0202c25339f706965a9e498eefd99ecf4a8912b0a0b7f1d9a5c4379ecd91d341f2ca484f1ff7d34c524c3533676a59d05a3ff4867089ea7973dceccb576c5107dcbe18d2fad132c234d967c6a705a2f3e2ed79049c9f95326f6b41817f6f6323b4162002e53e1ddfd85b5aa4f57ce5aa4c84cd5232b23d4c8e9c8ba8f4605ca6ac82c8d3cba0b209c627bd174ac46c2a349c978814c9bd56dbfa34b3c60971f79bf6fdd9cb307648e7c12d40509cf723da9c1ebb2ab161ec291806d01a6ccfff05f31a1d03d88ea6f5a6d5d1dd8e7210ace0df11ea2af47da4cfd24eb7cd4cf6e16a898f2e55c9e0c46eee0a11c8f4f4522eda59fc0b9f89abb3f0514d898c256f381ccd48f0d38e06538def73edfdde3320c73c36052d031a239209486374d65755b01f3d64a0158b0aae88c1119503f0a28fc47bd3e45141134beae059518e1951953f7b1bd083337001fa26e0d543878380a931bb997673814dad8c10510eb10eb081274514ff083b6fb2cf7a80950e01a64d9642936c89add26876f7eb1956ca85de121731bc2cfbd1a76c7c8eb350a82739de663906aaa6d161f92e467f7843771dcb51bbb68a38df9610620b4e6cc6bbd708f72dff29e56f4024ec6cd9103698b72837dd1033498a2f7444eade365ef09efda3f5a8df30c85fe226ba29b5da0a17cab180d2d905c36852d0ec9b7bcd4e7f7e51003771d380f704fae6de19e13bc62ce66213ef75584d3141f37a37fb88b96cd1e1e690ef1dbcbf07f076b3b01805626d3078d6d8e200a6fe3f324c02caebf80d7160666e9b8607b69727ae21ab646dbe4887b5b824cfdf654ca54a743455cc3c6f01f342b79c50d90fe74659e6ca903851f404cd002d771adfab97d3bf6139192ebab34fca3d5492bc835f4640c635799ee5a8bed139c2d0c835594b40f6580c80a58919b73903cd746b71798b120b01286de0027d7867ac12396cf14813bd60942b21cbba4f058395cf648cc9a11526d7064a748a54bd1a96b96ded98cb6965846bbcbef28e9fc0fb87610f32cc3fafadbbc09c5813145e50fec64d622ee178185cdd0db98971d4c88882799719aff4a9f808af13e1940c1ec17a38ac66878ed29b3bf64562aa0140f97d52189c91fb78e79d76b0fb3b31189d5792d2022066dae548b91799cdf3e520acd581e931b1fe45cf4478bd5efcbae946787ba7600d47e44ba60962496b8abbdd67317d469fba656571223b8a4ea743081d861ccfcd4b6c1796d65890fbf126f147f2fcd5e93eb9b561c88b4ee9a6bd25df1abc9a19cadff8e4a9b193145ed186fe7abc02288fb4159b03ee19e9010bef0212bcdda477abef3daff988c8bad3381d727f58c26f9c56918e79c9961893c10aca6fe3a88350a41cdd014c9833ed73e3bbaad29b11b1578e665f0b1e845c3f9839013268b6586291fe41316acdc9323d6b2d709d3ea295bca3d9fb8d13255f3e40a010dde3c3dd67ef48ce00e53f0802efd49e64af05e4b625c9b784ef87486de106308794581855c6a311f56ade7761aa9cb3b139b3eb0c216a6aba8f60edeb45004a41f97019504b7da845dac4da724ea88dd211376993e33ab44cd5b2a76620ae5f38865b44733de1337ac56af31012f87a00361234f9a77d46c02e3d39cc33eafa4759951850f7d031d60144ded133787ae2a170882db48916efc9a955cb4436f8613a7306dd2764c729c05755d5ccb2f52f988c78ff6b2714586442b6f77ebb88878d12dc10ced30c761967da01d0ffd9828e3c1f8556afd214dd8d28b4ea03a76340aacb1eb76a1c8f79f5c5caba44026ad6966ad01a65fd53a42aca8a41189e14c8607e400bb95d814c87b228df65c6e7d42e4867ccac5364ba432c90de493a12c05bc4d744b59aa31c50867b3a10b5ee4364f46078eaf162e4212bd9808c14dc0e16b19495934f233301da7504e4f4f439f21f2d31df79c70754fd76d8c637507d4d2dbf069d4c05365304bff2b299d81013d2057e79125c182cfdd512435f54e58edb4c8365713bf0cb02bbb575acf89d18e9810e46dceccf47bd5a78a385c2c6fd26818ffde4a1aba70087488ad6a2d69ff43908b1a36e7cc864dbf29c70308ba0135f47fc13058f659aa9e454a4c7313284a4ac1dccb3234f46e4ce7b19a4528710b946f9c430f6647ba370ec3c27175635defcd1532d8b6907e87787e87a06c5c40ac9a32eb836ec484cf9a9eafda12ef1fcb9c55f66250d927c88c30e5a48884b2569193497522e36d83ba0e45bd42"}) r8 = syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000001600)={&(0x7f00000014c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x3c, 0x3c, 0x6, [@struct={0xd, 0x4, 0x0, 0x4, 0x1, 0xf8f7, [{0xf, 0x4, 0xd}, {0x5, 0x2, 0x6}, {0x6, 0x4, 0xaa}, {0x10, 0x0, 0x7}]}]}, {0x0, [0x61, 0x30, 0x5f, 0x5f]}}, &(0x7f0000001540)=""/159, 0x5a, 0x9f, 0x1, 0x3}, 0x28) r9 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000001640)={0x2, 0x4, 0x8, 0x1, 0x80, r5, 0x9196, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x4, 0x1}, 0x50) r10 = syz_genetlink_get_family_id$team(&(0x7f0000001700), r5) getsockopt$inet_pktinfo(r5, 0x0, 0x8, &(0x7f0000001740)={0x0, @multicast2, @multicast2}, &(0x7f0000001780)=0xc) ioctl$ifreq_SIOCGIFINDEX_team(r5, 0x8933, &(0x7f00000017c0)={'team0\x00', 0x0}) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r5, 0x89f2, &(0x7f00000018c0)={'sit0\x00', &(0x7f0000001800)={'sit0\x00', 0x0, 0x7800, 0x80, 0xfc, 0x400, {{0x19, 0x4, 0x1, 0x0, 0x64, 0x67, 0x0, 0x7b, 0x2f, 0x0, @loopback, @multicast1, {[@generic={0x82, 0x3, "1b"}, @cipso={0x86, 0xd, 0x3, [{0x5, 0x3, '-'}, {0x2, 0x4, '\ne'}]}, @ssrr={0x89, 0x1b, 0xaa, [@initdev={0xac, 0x1e, 0x1, 0x0}, @rand_addr=0x64010102, @empty, @rand_addr=0x64010101, @private=0xa010101, @initdev={0xac, 0x1e, 0x1, 0x0}]}, @timestamp_addr={0x44, 0xc, 0xdc, 0x1, 0x2, [{@multicast2, 0xfffff0d8}]}, @lsrr={0x83, 0x17, 0x18, [@multicast1, @multicast1, @local, @broadcast, @multicast2]}]}}}}}) getsockname$packet(r5, &(0x7f0000001900)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000001940)=0x14) getsockopt$inet_mreqn(r5, 0x0, 0x0, &(0x7f0000001980)={@remote, @empty, 0x0}, &(0x7f00000019c0)=0xc) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r5, 0x89f1, &(0x7f0000001a80)={'ip_vti0\x00', &(0x7f0000001a00)={'syztnl0\x00', 0x0, 0x1, 0x7, 0x3, 0x1, {{0xa, 0x4, 0x1, 0x3e, 0x28, 0x65, 0x0, 0xfe, 0x2f, 0x0, @multicast1, @remote, {[@timestamp={0x44, 0x10, 0x7f, 0x0, 0x7, [0x161, 0xfffffffb, 0x7]}, @end]}}}}}) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000001b40)={r9, 0x58, &(0x7f0000001ac0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0}}, 0x10) ioctl$ifreq_SIOCGIFINDEX_team(r7, 0x8933, &(0x7f0000001b80)={'team0\x00', 0x0}) ioctl$ifreq_SIOCGIFINDEX_team(r8, 0x8933, &(0x7f0000001bc0)={'team0\x00', 0x0}) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000001c00)={'vcan0\x00', 0x0}) getsockname$packet(r5, &(0x7f0000001c40)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000001c80)=0x14) sendmsg$TEAM_CMD_OPTIONS_GET(r0, &(0x7f0000002400)={&(0x7f00000016c0)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f00000023c0)={&(0x7f0000001cc0)={0x6dc, r10, 0x200, 0x70bd28, 0x25dfdbfb, {}, [{{0x8}, {0xfc, 0x2, 0x0, 0x1, [{0x40, 0x1, @name={{0x24}, {0x5}, {0x10, 0x4, 'loadbalance\x00'}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x100}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x3}}, {0x8, 0x6, r11}}}, {0x40, 0x1, @lb_hash_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x2}}, {0x8}}}]}}, {{0x8}, {0x48, 0x2, 0x0, 0x1, [{0x44, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0x14, 0x4, [{0x2, 0x9, 0x1, 0x2}, {0xd42, 0x2, 0x5, 0x4}]}}}]}}, {{0x8, 0x1, r12}, {0x1b8, 0x2, 0x0, 0x1, [{0x44, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0x14, 0x4, [{0x5, 0xfc, 0x7, 0x40}, {0x9, 0x1, 0xdd, 0x6}]}}}, {0x40, 0x1, @lb_port_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x8}}, {0x8}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24}, {0x5}, {0x8}}, {0x8}}}, {0x38, 0x1, @notify_peers_interval={{0x24}, {0x5}, {0x8, 0x4, 0x1}}}, {0x40, 0x1, @lb_port_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x5}}, {0x8, 0x6, r13}}}, {0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8, 0x4, 0x8}}, {0x8, 0x6, r14}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24}, {0x5}, {0x8, 0x4, 0xfffffff8}}}]}}, {{0x8, 0x1, r15}, {0x218, 0x2, 0x0, 0x1, [{0x38, 0x1, @mcast_rejoin_count={{0x24}, {0x5}, {0x8, 0x4, 0xfff}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24}, {0x5}, {0x8, 0x4, 0x1}}}, {0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8, 0x4, 0x6}}, {0x8}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24}, {0x5}, {0x8, 0x4, 0xdc5b}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24}, {0x5}, {0x8, 0x4, r16}}, {0x8}}}, {0x40, 0x1, @lb_port_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x4}}, {0x8, 0x6, r17}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x2}}}, {0x3c, 0x1, @enabled={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r18}}}, {0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8, 0x4, 0x800}}}]}}, {{0x8, 0x1, r19}, {0x18c, 0x2, 0x0, 0x1, [{0x44, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0x14, 0x4, [{0x0, 0x1, 0x7a, 0xf007}, {0x1, 0x8, 0x1}]}}}, {0x44, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0x14, 0x4, [{0x1ade, 0x4, 0x3, 0x1}, {0x41e, 0xa, 0x6, 0x2}]}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24}, {0x5}, {0x8, 0x4, 0x1}}}, {0x40, 0x1, @lb_port_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x5}}, {0x8, 0x6, r20}}}, {0x3c, 0x1, @enabled={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r21}}}, {0x4c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x19, 0x4, 'hash_to_port_mapping\x00'}}}]}}]}, 0x6dc}, 0x1, 0x0, 0x0, 0x800}, 0x0) sendmsg$IPSET_CMD_ADD(r5, &(0x7f0000002540)={&(0x7f0000002440)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000002500)={&(0x7f0000002480)={0x60, 0x9, 0x6, 0x3, 0x0, 0x0, {0x7, 0x0, 0x3}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_LINENO={0x8, 0x9, 0x1, 0x0, 0xc}, @IPSET_ATTR_LINENO={0x8, 0x9, 0x1, 0x0, 0x100}, @IPSET_ATTR_DATA={0x2c, 0x7, 0x0, 0x1, [@IPSET_ATTR_ETHER={0xa, 0x11, @multicast}, @IPSET_ATTR_SKBPRIO={0x8, 0x1c, 0x1, 0x0, 0x6a1}, @IPSET_ATTR_SKBPRIO={0x8, 0x1c, 0x1, 0x0, 0xb}, @IPSET_ATTR_IP2_TO={0xc, 0x16, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @broadcast}}]}]}, 0x60}, 0x1, 0x0, 0x0, 0x800}, 0x20004094) 1.521667898s ago: executing program 1 (id=3650): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x6, 0x13, &(0x7f0000000840)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000020200008500000072000000180100002020732500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000001700000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x16, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r0, 0xfca804a0, 0xe, 0x0, &(0x7f00000007c0)="9b352e98d1dc0621a18bc4c5a6c1", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0xd, 0x4, &(0x7f0000000700)=ANY=[@ANYBLOB="180000000805000000000000000000009500000004000000"], &(0x7f0000000c40)='GPL\x00', 0x3, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x30, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffff9}, 0x94) 1.328651751s ago: executing program 4 (id=3651): r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket$igmp(0x2, 0x3, 0x2) r2 = socket$netlink(0x10, 0x3, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r4, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000003c0)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r5, @ANYBLOB="01030003000000001c0012000c000100626f6e64000000000c0002000800010005"], 0x3c}}, 0x0) sendmsg$nl_route(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000680)=ANY=[@ANYBLOB="4c00000010001ffffcfffffffdffffff00000000", @ANYRES32=0x0, @ANYBLOB="0002010000000000240012800b00010065727370616e000014000280050016000000000008000700ac1414bb08000a00", @ANYRES32=r5], 0x4c}, 0x1, 0x0, 0x0, 0x40}, 0x0) r6 = socket$kcm(0x10, 0x2, 0x4) connect$inet(r1, &(0x7f0000000240)={0x2, 0x8, @loopback}, 0x10) sendmsg$kcm(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000100)="4c000000150097f87059ae08060c040002ff0f020000000000000187ac1414aaa69d35a2cca84708f7abca1bac141410bd7c493872f750375ed08a560400000003c48f93b82a03000000461e", 0x4c}], 0x1}, 0x800c) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e21, @broadcast}, 0x10) r7 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$PPPIOCNEWUNIT(r7, 0xc004743e, &(0x7f00000000c0)) ioctl$PPPIOCSMRRU(r7, 0x4004743c, 0x0) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000940)={&(0x7f0000000100)=@newtclass={0x24, 0x28, 0x2, 0x70bd26, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, {0x9, 0x5}, {0x7, 0xb}, {0xb, 0xf}}}, 0x24}}, 0x0) r8 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r10 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="12000000770000000800000002"], 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000140)={{r10, 0xffffffffffffffff}, &(0x7f0000000180), &(0x7f0000000280)=r9}, 0x20) bpf$BPF_LINK_CREATE(0x1c, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x5, 0x0, @void}, 0x10) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000440)={r11, &(0x7f00000001c0), 0x0}, 0x20) getsockopt$IP_VS_SO_GET_VERSION(r4, 0x0, 0x480, &(0x7f0000000480), &(0x7f00000004c0)=0x40) sendmsg$nl_route(r8, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="840000001000010428bd70000000000000000000", @ANYRES32=0x0, @ANYBLOB="9180030000200000500012800b000100697036746e6c000040000280040013000800080001000000080014000300000008000100", @ANYRES32, @ANYBLOB="0600100003000000080014000000000008000700060000000800140000800000140003006e"], 0x84}, 0x1, 0x0, 0x0, 0x4}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b40000"], 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x94) sendmmsg(r8, &(0x7f00000002c0), 0x40000000000009f, 0x0) setsockopt$inet_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f0000000340)={@in={{0x2, 0x4e24, @local}}, 0x0, 0x0, 0x30, 0x0, "cebd7ceedb7b0ad952e966bbe242b92b746b023df2cb59e32e10366456deac64e782206bd4aee372005a52a40b7161161a8b2749fe184fb0d08bc63f90010a1ed2bf603d2c3fcc250c30136f9ef2ef8b"}, 0xd8) sendto$inet(r0, &(0x7f0000000000), 0xffffffffffffff94, 0x0, 0x0, 0x11) 1.251240355s ago: executing program 1 (id=3652): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f0000000100)=@framed={{0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1800}}, &(0x7f0000000000)='GPL\x00', 0xc, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f00000000c0)={0x0, 0x1}, 0x1, 0x10, 0x0, 0x0, 0x0, 0x0, 0x12}, 0x94) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'sha512\x00'}, 0x58) r2 = accept4(r1, 0x0, 0x0, 0x800) sendmmsg$alg(r2, &(0x7f0000000640)=[{0x0, 0x0, &(0x7f0000000380)=[{&(0x7f0000000140)="b57523cb1a2c90d8acad2e2d98dfc9ea7a5843c3b63b683ced2b3266175599b779617e66e6b3e15c042be90635a2d36160bbf9a2edcacc0bbe015b84150a1928de94397894ff36aa430fc2a0814ba634308d6d0837250dfd1eca5383f9d151449743b1a0c4ffc51242a229c5d6d06f147a61d797ea7ffeda95b76f5623", 0x7d}, {&(0x7f00000001c0)="66f7", 0x3}, {&(0x7f0000000300)='l3', 0x7fffef80}], 0x3}], 0x1, 0x0) setsockopt$sock_linger(r2, 0x1, 0x48, &(0x7f0000000080)={0x80001, 0xffffff82}, 0x8) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000005c0)={0x6, 0x7, &(0x7f0000000700)=ANY=[@ANYBLOB="184100000100000000000000030000008510000003000000184e0000feffffff000000000000000018540000040000000000200000000000"], &(0x7f0000000380)='GPL\x00', 0x6, 0x6, &(0x7f00000004c0)=""/6, 0x40f00, 0x1a, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x8}, 0x94) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000001000010000000000000000000100000a20000000000a01040000000000000000010080030900010073797a30000000002c000000030a01010000000000000000010000000900010073797a30000000000900030073797a3201000000a4000000060a010400000000000000000100000008000b40000000007c000480340001800b000100657874686472000024000280080001400000000c080003400000000008000440000000220500020007000000440001800c0001006269747769736500340002800800034000000004080001400000001408000240000000120c000580084f010088634d580c000480080001006eee7e000900010073797a30"], 0x118}}, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) write$tun(r4, &(0x7f0000001200)=ANY=[@ANYBLOB="000086dd0000120000000000000060ec97000f983a"], 0xfce) r5 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r5, 0x84, 0x64, &(0x7f0000000180)=[@in={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x26}}], 0x10) getsockopt$inet_sctp_SCTP_GET_LOCAL_ADDRS(r5, 0x84, 0x6d, &(0x7f0000000700), &(0x7f0000000740)=0x8) ioctl$TUNSETNOCSUM(r4, 0x400454c8, 0x1) r6 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) getpeername$netlink(r6, 0x0, &(0x7f00000000c0)) ioctl$sock_ifreq(r0, 0x8923, &(0x7f0000000080)={'dummy0\x00', @ifru_ivalue}) 1.065940582s ago: executing program 2 (id=3653): r0 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000000)=0x800, 0x4) r1 = socket(0x10, 0x3, 0x0) write(r1, &(0x7f0000000000)="240000001a005f0400f9f407000904018000000020000000000000", 0x1b) r2 = socket$kcm(0xa, 0x2, 0x0) pwritev(0xffffffffffffffff, 0x0, 0x0, 0x100, 0x7) socket$nl_netfilter(0x10, 0x3, 0xc) openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r3, 0x0, 0x4000c00) close(0x4) socket(0x2, 0x80805, 0x0) r4 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$IP_VS_SO_SET_ADD(r4, 0x0, 0x482, &(0x7f0000000040)={0x84, @rand_addr=0x64010101, 0x4e22, 0x3, 'rr\x00', 0x1, 0x80005, 0x6f}, 0x2c) sendmsg$sock(r2, &(0x7f00000000c0)={&(0x7f0000000580)=@in6={0x2, 0x4e21, 0x0, @dev}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0) 956.293333ms ago: executing program 3 (id=3654): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000080)={'veth0_to_bond\x00', 0x0}) sendmsg$L2TP_CMD_NOOP(0xffffffffffffffff, 0x0, 0x4000000) r6 = socket$inet(0x2b, 0x801, 0x0) connect$inet(r6, &(0x7f00000002c0)={0x2, 0x4e24, @local}, 0x64) listen(r6, 0x7f) r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r7, 0x8933, &(0x7f00000001c0)={'wpan4\x00', 0x0}) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_DESTROY(r9, &(0x7f0000000240)={0x0, 0xffffffffffffff98, &(0x7f0000000200)={&(0x7f00000007c0)=ANY=[@ANYRES32=r6], 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001400)=[{&(0x7f0000000300)="87fb74cf4d67adbbd062637f514c1f5eb18d7b442e6457a356c6cb1f71a43dfae773c8489cce5145f92615d4bdb13ef54d6ae90ec7733180fcf5adf3e13fdb05b57b748bd14eda042a97fdd844", 0x4d}], 0x1}, 0x0) r10 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r10, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000400)=ANY=[@ANYRESHEX=r8], 0x58}, 0x1, 0x0, 0x0, 0x400c881}, 0x2000c80d) r11 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r11, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000300)=ANY=[@ANYBLOB="50000000090601020000000000000000020000840900020073797a31000000000500010007000000280007800c00018008000140fffffff70500070088000000060004404e22000006000540"], 0x50}, 0x1, 0x0, 0x0, 0x10000082}, 0x90) r12 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_LIST(r12, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[@ANYBLOB="1c000900070601030000000000000000010000000500010007000000"], 0x1c}, 0x1, 0x0, 0x0, 0x20000800}, 0x20000040) setsockopt$packet_int(r4, 0x107, 0x14, &(0x7f0000000180)=0x19ca, 0x4) setsockopt$packet_int(r4, 0x107, 0xf, &(0x7f0000000000)=0xf3f, 0x4) sendto$packet(r1, &(0x7f00000000c0)="3f03fe7feee8140006001e0089e9aaa911d7c2290f0086dd1327c9167c643c4a1b7880610cc96655b1b141ab059b24d0fbc50df71548a3f6c5609063382a0c153cfdf9435e3ffe46", 0x48, 0x0, &(0x7f0000000140)={0xc9, 0x0, r5, 0x1, 0x0, 0x6, @multicast}, 0x14) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd26, 0xffffffff, {0x0, 0x0, 0x0, r13, {0x0, 0x6}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_qfg={0x8}]}, 0x2c}}, 0x24000894) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r1, 0x800448d4, &(0x7f0000000140)) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000380)={'nicvf0\x00'}) 0s ago: executing program 2 (id=3655): r0 = socket$inet(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000f00)=@newqdisc={0x8c, 0x24, 0xf0b, 0x70bd2b, 0x0, {0x0, 0x0, 0x12, r1, {}, {0xffff, 0xffff}, {0xe}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x5c, 0x2, [@TCA_TAPRIO_ATTR_PRIOMAP={0x56, 0x1, {0x2, [0x0, 0x1, 0x0, 0x0, 0x0, 0x7, 0x10, 0x0, 0x0, 0x0, 0x1, 0x0, 0xff, 0x0, 0x0, 0x2], 0x0, [0x5, 0x4, 0x2, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3], [0x0, 0x8, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0xfffe, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x8001]}}]}}]}, 0x8c}}, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd26, 0xffffffff, {0x0, 0x0, 0x0, r7, {0x0, 0x6}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_qfg={0x8}]}, 0x2c}}, 0x24040084) sendmsg$nl_route_sched(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000540)={&(0x7f00000001c0)=@newqdisc={0x40, 0x28, 0x100, 0x70bd2d, 0xfffffdfc, {0x0, 0x0, 0x0, r7, {0xffff}, {0xffff, 0xffff}, {0xa70e309437f86d6f, 0xfff1}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x10, 0x2, [@TCA_TAPRIO_ATTR_SCHED_CYCLE_TIME={0xc, 0x8, 0xffc000000000}]}}]}, 0x40}, 0x1, 0x0, 0x0, 0x400dc}, 0x4000000) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) r8 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r8, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x13}}, 0x10) r9 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r9, &(0x7f0000000140)=@pppol2tpin6={0x18, 0x1, {0x0, r8, 0x1, 0x0, 0x0, 0x0, {0xa, 0x0, 0x4000000, @mcast1}}}, 0x32) sendmmsg(r9, &(0x7f0000004380)=[{{0x0, 0x0, 0x0}}], 0x34000, 0x0) connect$inet(r8, &(0x7f0000000080)={0x2, 0x4e23, @multicast2}, 0x10) setsockopt$sock_int(r8, 0x1, 0x3e, &(0x7f0000000180)=0x1, 0x4) r10 = socket$can_bcm(0x1d, 0x2, 0x2) setsockopt$SO_TIMESTAMPING(r10, 0x1, 0x41, &(0x7f0000000000)=0x4011, 0x4) connect$can_bcm(r10, &(0x7f00000005c0), 0x10) recvmmsg(r10, &(0x7f00000099c0)=[{{0x0, 0x0, &(0x7f0000007040)=[{&(0x7f0000006040)=""/4086, 0xff6}], 0x1}, 0x8000}], 0x1, 0x10002, 0x0) sendmsg$can_bcm(r10, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="050000007f0000000000010000000000", @ANYRES64=0x0, @ANYRES64=0x2710], 0x48}}, 0x800) mmap(&(0x7f00004d6000/0x2000)=nil, 0x2000, 0x8, 0x20000000ec072, r3, 0x274bb000) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_route(0x10, 0x3, 0x0) socket(0x2b, 0x1, 0x1) kernel console output (not intermixed with test programs): link: Flow actions may not be safe on all matching packets. [ 488.111642][T16389] lo speed is unknown, defaulting to 1000 [ 489.436803][T16469] openvswitch: netlink: VXLAN extension 307 out of range max 1 [ 489.766667][T16465] bond14: option all_slaves_active: invalid value (127) [ 489.790366][T16465] bond14 (unregistering): Released all slaves [ 489.962576][T16477] __nla_validate_parse: 6 callbacks suppressed [ 489.962599][T16477] netlink: 60 bytes leftover after parsing attributes in process `syz.1.2707'. [ 490.053068][T16489] netlink: 'syz.3.2712': attribute type 1 has an invalid length. [ 490.893693][T16515] tipc: Enabling of bearer rejected, failed to enable media [ 491.074305][T16520] bridge0: port 2(bridge_slave_1) entered disabled state [ 491.081919][T16520] bridge0: port 1(bridge_slave_0) entered disabled state [ 491.781309][T16536] bond15: option ad_select: invalid value (34) [ 491.802024][T16536] bond15 (unregistering): Released all slaves [ 492.149443][T16547] bridge0: port 2(bridge_slave_1) entered blocking state [ 492.156794][T16547] bridge0: port 2(bridge_slave_1) entered listening state [ 492.164265][T16547] bridge0: port 1(bridge_slave_0) entered blocking state [ 492.171534][T16547] bridge0: port 1(bridge_slave_0) entered listening state [ 492.266935][T16550] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2731'. [ 492.281606][T16551] netlink: 36 bytes leftover after parsing attributes in process `syz.1.2729'. [ 492.297918][T16553] SET target dimension over the limit! [ 492.384522][T16547] A link change request failed with some changes committed already. Interface wlan1 may have been left with an inconsistent configuration, please check. [ 492.506910][ C0] ip6_tunnel: ip6tnl3 xmit: Local address not yet configured! [ 492.675888][T16563] sch_tbf: burst 0 is lower than device syzkaller0 mtu (1514) ! [ 493.492940][T16594] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2742'. [ 493.529926][T16594] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2742'. [ 493.801889][T16599] lo speed is unknown, defaulting to 1000 [ 494.278352][T16616] netlink: 148 bytes leftover after parsing attributes in process `syz.0.2749'. [ 494.309119][T16616] netlink: 116 bytes leftover after parsing attributes in process `syz.0.2749'. [ 494.340816][T16616] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2749'. [ 494.375234][T16618] netlink: 16 bytes leftover after parsing attributes in process `syz.0.2749'. [ 494.450358][T16622] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 494.461724][T16620] netlink: 212348 bytes leftover after parsing attributes in process `syz.3.2750'. [ 494.492515][T16620] netlink: Conntrack attr has 4 unknown bytes [ 494.611660][T16622] 8021q: adding VLAN 0 to HW filter on device bond12 [ 494.630013][T16629] bond12 (unregistering): Released all slaves [ 494.709559][T16622] 8021q: adding VLAN 0 to HW filter on device bond12 [ 494.726576][T16599] lo speed is unknown, defaulting to 1000 [ 495.003342][T16641] __nla_validate_parse: 67 callbacks suppressed [ 495.003367][T16641] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2754'. [ 495.362569][T16641] 8021q: adding VLAN 0 to HW filter on device bond13 [ 495.468295][T16643] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 495.484290][T16643] bond13: (slave batadv0): Enslaving as an active interface with an up link [ 496.743678][T16686] syzkaller0: entered promiscuous mode [ 496.761263][T16686] syzkaller0: entered allmulticast mode [ 496.800197][T16686] tipc: Enabled bearer , priority 0 [ 496.866648][T16685] tipc: Resetting bearer [ 496.961960][T16685] tipc: Disabling bearer [ 497.418545][T16708] xt_hashlimit: size too large, truncated to 1048576 [ 497.703865][T16725] netlink: 80 bytes leftover after parsing attributes in process `syz.1.2776'. [ 497.751100][T16721] mac80211_hwsim hwsim5 syzkaller0: entered promiscuous mode [ 497.788802][T16721] mac80211_hwsim hwsim5 syzkaller0: entered allmulticast mode [ 497.792724][T16725] openvswitch: netlink: Flow key attr not present in new flow. [ 498.022237][T16739] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2784'. [ 498.155560][T16744] netlink: 32 bytes leftover after parsing attributes in process `syz.0.2784'. [ 498.190834][T16739] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2784'. [ 498.201063][T16743] netlink: 244 bytes leftover after parsing attributes in process `syz.2.2783'. [ 498.266346][ C0] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 498.381150][T16756] mac80211_hwsim hwsim6 syzkaller0: entered promiscuous mode [ 498.388818][T16756] mac80211_hwsim hwsim6 syzkaller0: entered allmulticast mode [ 498.402723][T16756] tipc: Resetting bearer [ 498.413045][T16756] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2786'. [ 498.446414][T16756] openvswitch: netlink: Missing key (keys=40, expected=100) [ 498.660741][T16766] netlink: 'syz.0.2789': attribute type 1 has an invalid length. [ 498.735296][T16766] 8021q: adding VLAN 0 to HW filter on device bond15 [ 498.795704][T16767] syzkaller0: entered promiscuous mode [ 498.811923][T16767] syzkaller0: entered allmulticast mode [ 498.843386][T16777] netlink: 68 bytes leftover after parsing attributes in process `syz.2.2791'. [ 498.854086][T16777] netlink: 64 bytes leftover after parsing attributes in process `syz.2.2791'. [ 498.881375][T16774] macvlan0: entered promiscuous mode [ 498.910330][T16774] macvlan0: entered allmulticast mode [ 499.110593][T16782] bond15: (slave ip6gretap1): making interface the new active one [ 499.124378][T16782] bond15: (slave ip6gretap1): Enslaving as an active interface with an up link [ 499.500842][T16796] netlink: 'syz.4.2798': attribute type 1 has an invalid length. [ 499.665989][ T5631] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 499.679368][ T5631] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 499.689061][ T5631] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 499.703127][ T5631] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 499.714693][ T5631] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 499.878148][T16811] netlink: 'syz.1.2801': attribute type 16 has an invalid length. [ 499.896905][T16811] netlink: 'syz.1.2801': attribute type 17 has an invalid length. [ 500.089211][ T5737] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 500.214900][T16818] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2803'. [ 500.376912][ T5737] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 500.560526][T16838] netlink: 'syz.4.2807': attribute type 1 has an invalid length. [ 500.587844][T16832] lo speed is unknown, defaulting to 1000 [ 500.620892][T16839] gretap3: entered allmulticast mode [ 500.919627][T16852] netlink: 192 bytes leftover after parsing attributes in process `syz.3.2810'. [ 500.968191][T16852] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2810'. [ 500.983346][T16855] syzkaller1: entered promiscuous mode [ 500.990553][T16852] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2810'. [ 501.000401][T16855] syzkaller1: entered allmulticast mode [ 501.007700][T16852] netlink: 'syz.3.2810': attribute type 11 has an invalid length. [ 501.065532][T16857] netlink: 116 bytes leftover after parsing attributes in process `syz.3.2810'. [ 501.219451][T16861] netlink: 'syz.1.2813': attribute type 13 has an invalid length. [ 501.470061][ T1315] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 501.484399][ T1315] ieee802154 phy1 wpan1: encryption failed: -22 [ 501.488117][ T10] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 501.553102][T16832] lo speed is unknown, defaulting to 1000 [ 501.553121][T16802] lo speed is unknown, defaulting to 1000 [ 501.762554][T16869] netlink: 68 bytes leftover after parsing attributes in process `syz.1.2815'. [ 501.786537][ T5643] Bluetooth: hci5: command tx timeout [ 501.814373][T16869] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2815'. [ 501.875509][T16871] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2816'. [ 502.087594][T16848] lo speed is unknown, defaulting to 1000 [ 502.116480][ T10] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 502.242556][T16802] lo speed is unknown, defaulting to 1000 [ 502.688906][T16879] IPVS: set_ctl: invalid protocol: 59 255.255.255.255:20004 [ 502.761376][T16848] lo speed is unknown, defaulting to 1000 [ 503.037729][T16883] IPVS: rr: FWM 3 0x00000003 - no destination available [ 503.099258][T16885] openvswitch: netlink: Unexpected mask (mask=240040, allowed=10048) [ 503.277195][T16894] pim6reg: left allmulticast mode [ 503.448115][T16895] workqueue: Failed to create a rescuer kthread for wq "bond16": -EINTR [ 503.574058][T16898] mac80211_hwsim hwsim2 syzkaller0: left promiscuous mode [ 503.612361][T16906] netlink: 132 bytes leftover after parsing attributes in process `syz.1.2824'. [ 503.640907][T16898] mac80211_hwsim hwsim2 syzkaller0: left allmulticast mode [ 503.867566][ T5643] Bluetooth: hci5: command tx timeout [ 504.402626][T16802] bridge0: port 1(bridge_slave_0) entered blocking state [ 504.412666][T16802] bridge0: port 1(bridge_slave_0) entered disabled state [ 504.424096][T16802] bridge_slave_0: entered allmulticast mode [ 504.453417][T16802] bridge_slave_0: entered promiscuous mode [ 504.500100][T16802] bridge0: port 2(bridge_slave_1) entered blocking state [ 504.508578][T16802] bridge0: port 2(bridge_slave_1) entered disabled state [ 504.534544][T16802] bridge_slave_1: entered allmulticast mode [ 504.569247][T16802] bridge_slave_1: entered promiscuous mode [ 504.663838][T16802] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 504.677601][T16802] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 504.716468][T16802] team0: Port device team_slave_0 added [ 504.728454][T16802] team0: Port device team_slave_1 added [ 504.895874][T16802] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 504.903857][T16802] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 504.943523][T16802] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 504.977742][T16802] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 504.994981][T16802] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 505.045239][T16802] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 505.314498][T16927] veth0_to_bridge: entered promiscuous mode [ 505.324771][T16927] macvtap2: entered allmulticast mode [ 505.330898][T16927] veth0_to_bridge: entered allmulticast mode [ 505.342517][T16927] veth0_to_bridge: left allmulticast mode [ 505.348824][T16927] veth0_to_bridge: left promiscuous mode [ 505.458066][T16802] hsr_slave_0: entered promiscuous mode [ 505.465247][T16802] hsr_slave_1: entered promiscuous mode [ 505.888774][T16941] IPVS: nq: FWM 3 0x00000003 - no destination available [ 505.947795][ T5643] Bluetooth: hci5: command tx timeout [ 506.524482][T16904] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 506.561774][T16802] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 506.598335][T16802] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 506.628090][T16802] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 506.655921][T16802] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 506.689586][T16802] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 506.765132][T16802] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 506.771926][T16960] netlink: 'syz.1.2835': attribute type 49 has an invalid length. [ 506.795879][T16802] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 506.808646][T16802] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 506.870116][T16959] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2835'. [ 506.896324][T16959] openvswitch: netlink: Key type 2076 is out of range max 32 [ 507.061162][T16802] 8021q: adding VLAN 0 to HW filter on device bond0 [ 507.115529][T16802] 8021q: adding VLAN 0 to HW filter on device team0 [ 507.122314][T16984] xt_hashlimit: size too large, truncated to 1048576 [ 507.173648][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 507.181094][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 507.272080][T16988] bridge0: port 1(bridge_slave_0) entered disabled state [ 507.311813][T16993] netlink: 'syz.1.2841': attribute type 1 has an invalid length. [ 507.356092][T16993] netlink: 224 bytes leftover after parsing attributes in process `syz.1.2841'. [ 507.400029][T16988] bridge_slave_0 (unregistering): left allmulticast mode [ 507.457131][T16988] bridge_slave_0 (unregistering): left promiscuous mode [ 507.485148][T16988] bridge0: port 1(bridge_slave_0) entered disabled state [ 507.494458][T16999] netlink: 68 bytes leftover after parsing attributes in process `syz.1.2841'. [ 507.635679][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 507.642987][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 507.904130][T17010] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2846'. [ 508.026461][ T5643] Bluetooth: hci5: command tx timeout [ 508.356728][T16802] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 508.507730][ C0] ip6_tunnel: ip6tnl3 xmit: Local address not yet configured! [ 508.515610][ C0] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 509.343008][T17064] netlink: 'syz.1.2853': attribute type 8 has an invalid length. [ 510.077991][T17097] xfrm1: left allmulticast mode [ 510.085027][T17097] gtp1: left allmulticast mode [ 510.094722][T17097] team1: left allmulticast mode [ 510.100823][T17097] team2: left allmulticast mode [ 510.122708][T17097] gretap3: left allmulticast mode [ 510.131060][T17097] 8021q: adding VLAN 0 to HW filter on device bond14 [ 510.143214][T17097] 8021q: adding VLAN 0 to HW filter on device bond15 [ 510.337383][T16802] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 510.399124][T17120] IPVS: nq: FWM 3 0x00000003 - no destination available [ 510.421063][T17118] syzkaller1: entered promiscuous mode [ 510.436619][T17118] syzkaller1: entered allmulticast mode [ 510.694319][T17127] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 510.797031][T17127] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 510.830992][T17127] veth1_vlan: left promiscuous mode [ 510.838893][T17127] veth0_vlan: left promiscuous mode [ 510.845607][T17127] veth0_vlan: entered promiscuous mode [ 510.861656][T17127] veth1_vlan: entered promiscuous mode [ 510.874225][T17127] veth1_macvtap: left promiscuous mode [ 510.883160][T17127] veth0_macvtap: left promiscuous mode [ 510.893558][T17127] veth0_macvtap: entered promiscuous mode [ 510.908792][T17127] veth1_macvtap: entered promiscuous mode [ 510.936555][T17127] 8021q: adding VLAN 0 to HW filter on device eth0 [ 510.944868][T17127] 8021q: adding VLAN 0 to HW filter on device eth1 [ 510.967744][T17127] 8021q: adding VLAN 0 to HW filter on device eth2 [ 510.978699][T17127] 8021q: adding VLAN 0 to HW filter on device eth3 [ 511.077685][T17127] batman_adv: batadv0: Interface activated: ipvlan2 [ 511.101202][T17127] 8021q: adding VLAN 0 to HW filter on device bond0 [ 511.257049][T17127] 8021q: adding VLAN 0 to HW filter on device bond1 [ 511.274283][T17127] 8021q: adding VLAN 0 to HW filter on device bond2 [ 511.284603][T17127] mac80211_hwsim hwsim17 wlan0: entered promiscuous mode [ 511.301802][T17127] 8021q: adding VLAN 0 to HW filter on device bond3 [ 511.315100][T17127] 8021q: adding VLAN 0 to HW filter on device bond4 [ 511.335212][T17127] 8021q: adding VLAN 0 to HW filter on device bond5 [ 511.345928][T17127] 8021q: adding VLAN 0 to HW filter on device bond6 [ 511.355375][T17127] 8021q: adding VLAN 0 to HW filter on device bond7 [ 511.368531][T17127] 8021q: adding VLAN 0 to HW filter on device bond8 [ 511.405288][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 511.412584][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 511.426521][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 511.433799][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 511.524927][T17145] netlink: 144 bytes leftover after parsing attributes in process `syz.3.2872'. [ 511.537628][ T9401] netdevsim netdevsim3 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 511.557236][ T9401] netdevsim netdevsim3 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 511.590831][ T9401] netdevsim netdevsim3 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 511.635701][T16802] veth0_vlan: entered promiscuous mode [ 511.694692][ T9401] netdevsim netdevsim3 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 511.740040][ T7889] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 511.752480][ T7889] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 511.767990][ T8094] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 511.783184][ T7889] ip6_tunnel: syztnl0 xmit: Local address not yet configured! [ 511.797616][ T8094] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 511.826072][T16802] veth1_vlan: entered promiscuous mode [ 512.052057][T16802] veth0_macvtap: entered promiscuous mode [ 512.069392][ T8095] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 512.089892][T16802] veth1_macvtap: entered promiscuous mode [ 512.153448][T16802] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 512.175884][T16802] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 512.230168][ T7889] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 512.258897][ T9392] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 512.306118][ T9392] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 512.325918][ T9392] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 512.643164][ T7890] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 512.690035][ T7890] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 512.779387][ T7889] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 512.808170][ T7889] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 513.282188][T17202] IPv6: sit1: Disabled Multicast RS [ 513.294654][T17204] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2891'. [ 513.316974][T17204] netlink: 'syz.0.2891': attribute type 10 has an invalid length. [ 513.483371][T17211] netlink: 'syz.3.2894': attribute type 13 has an invalid length. [ 513.548265][T17216] IPVS: nq: FWM 3 0x00000003 - no destination available [ 513.573326][T17217] --map-set only usable from mangle table [ 513.648476][ T5739] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 513.744046][T17220] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2897'. [ 513.868510][T17229] netlink: 20 bytes leftover after parsing attributes in process `syz.3.2899'. [ 513.945632][ T12] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 513.957113][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 513.972704][ T12] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 513.981374][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 514.001290][ T12] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 514.010439][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 514.054379][ T12] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 514.063056][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 514.080234][ T12] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 514.134628][T17214] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 514.207507][T17233] ipip2: entered promiscuous mode [ 514.421206][T17214] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 514.542113][T17244] syzkaller0: entered promiscuous mode [ 514.549838][T17244] syzkaller0: entered allmulticast mode [ 514.577933][T17255] lo: Caught tx_queue_len zero misconfig [ 514.666614][ T5639] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 515.254582][T17214] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 515.322529][T17258] faux_driver regulatory: loading /lib/firmware/regulatory.db failed with error -4 [ 515.332690][T17258] faux_driver regulatory: Direct firmware load for regulatory.db failed with error -4 [ 515.344037][T17258] faux_driver regulatory: Falling back to sysfs fallback for: regulatory.db [ 515.506005][T17266] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 515.522652][T17266] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 515.534780][T17266] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: ipvlan2 [ 515.556008][T17266] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 515.584679][T17277] SET target dimension over the limit! [ 515.626391][ C1] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 515.639671][T17266] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 515.652423][T17266] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 515.698126][ T5739] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 515.843068][T17214] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 515.988729][ T5633] hsr0: entered promiscuous mode [ 516.134780][T17289] netlink: 200 bytes leftover after parsing attributes in process `syz.2.2913'. [ 516.174693][T17289] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2913'. [ 516.202796][T17292] netlink: 'syz.1.2914': attribute type 1 has an invalid length. [ 516.230669][T17290] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2910'. [ 516.248369][T17286] lo speed is unknown, defaulting to 1000 [ 516.252968][T17292] workqueue: Failed to create a rescuer kthread for wq "bond14": -EINTR [ 516.260939][ T48] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 516.270842][ C1] ip6_tunnel: syztnl0 xmit: Local address not yet configured! [ 516.402586][ T48] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 516.428816][ T5739] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 516.561453][ T9394] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 516.638478][ T13] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 516.656965][T17305] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2915'. [ 516.756765][T17305] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2915'. [ 516.854501][T17305] netlink: 348 bytes leftover after parsing attributes in process `syz.1.2915'. [ 516.877035][T17305] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2915'. [ 517.099004][T17286] lo speed is unknown, defaulting to 1000 [ 517.135075][T17312] netlink: 'syz.0.2917': attribute type 3 has an invalid length. [ 518.361129][T17327] 8021q: adding VLAN 0 to HW filter on device eth0 [ 518.375736][T17327] 8021q: adding VLAN 0 to HW filter on device eth1 [ 518.407602][T17327] 8021q: adding VLAN 0 to HW filter on device eth2 [ 518.423397][T17327] 8021q: adding VLAN 0 to HW filter on device eth3 [ 518.678687][T17353] __nla_validate_parse: 3 callbacks suppressed [ 518.678710][T17353] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2923'. [ 518.694735][T17353] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2923'. [ 518.709174][T17353] netlink: 'syz.3.2923': attribute type 14 has an invalid length. [ 518.742089][T17353] netlink: 'syz.3.2923': attribute type 12 has an invalid length. [ 518.974555][T17362] netlink: 36 bytes leftover after parsing attributes in process `syz.1.2924'. [ 519.363684][T17360] net_ratelimit: 1393 callbacks suppressed [ 519.363706][T17360] A link change request failed with some changes committed already. Interface wlan1 may have been left with an inconsistent configuration, please check. [ 519.530551][T17381] SET target dimension over the limit! [ 520.092976][T17388] netlink: 'syz.1.2930': attribute type 1 has an invalid length. [ 520.112195][T17389] tipc: Enabled bearer , priority 0 [ 520.135523][T17388] workqueue: Failed to create a rescuer kthread for wq "bond14": -EINTR [ 520.326375][T17394] lo: Caught tx_queue_len zero misconfig [ 520.399182][T17400] IPVS: set_ctl: invalid protocol: 58 100.1.1.0:20004 [ 520.475780][T17401] netlink: 'syz.3.2931': attribute type 3 has an invalid length. [ 520.649889][T17399] netlink: 32 bytes leftover after parsing attributes in process `syz.0.2933'. [ 521.106981][ T8095] tipc: Node number set to 2962790851 [ 521.724265][T17444] netlink: 'syz.4.2941': attribute type 111 has an invalid length. [ 521.787668][ T8095] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 521.897594][T17444] gretap0: entered promiscuous mode [ 521.919835][T17444] vlan3: entered promiscuous mode [ 522.058888][T17442] syzkaller1: entered promiscuous mode [ 522.065558][T17452] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2945'. [ 522.077828][T17442] syzkaller1: entered allmulticast mode [ 522.189207][ T8095] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 522.310822][T17456] veth1_to_bond: entered allmulticast mode [ 522.329541][T17456] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2948'. [ 522.424340][T17456] veth1_to_bond (unregistering): left allmulticast mode [ 522.599823][ C1] bridge0: port 2(bridge_slave_1) entered learning state [ 522.899174][T17467] tipc: Enabled bearer , priority 0 [ 523.189591][T17482] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2954'. [ 523.206540][T17482] netlink: 24 bytes leftover after parsing attributes in process `syz.4.2954'. [ 523.421356][T17494] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2958'. [ 523.440039][T17494] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2958'. [ 523.450234][T17491] mac80211_hwsim hwsim2 syzkaller0: Caught tx_queue_len zero misconfig [ 523.488535][T17489] syzkaller1: entered promiscuous mode [ 523.500430][T17489] syzkaller1: entered allmulticast mode [ 523.623380][T17500] vxcan2: entered allmulticast mode [ 523.866869][ C1] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 523.963520][T17517] __nla_validate_parse: 2 callbacks suppressed [ 523.963542][T17517] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2965'. [ 523.991283][T17519] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2966'. [ 524.007605][T17517] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2965'. [ 524.027428][T17519] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2966'. [ 524.130829][T17522] xt_hashlimit: size too large, truncated to 1048576 [ 524.231123][T17527] bridge0: port 1(bridge_slave_0) entered disabled state [ 524.270137][T17531] netlink: 'syz.3.2967': attribute type 1 has an invalid length. [ 524.295808][T17531] netlink: 224 bytes leftover after parsing attributes in process `syz.3.2967'. [ 524.340616][T17527] bridge_slave_0 (unregistering): left allmulticast mode [ 524.373591][T17527] bridge_slave_0 (unregistering): left promiscuous mode [ 524.382783][T17527] bridge0: port 1(bridge_slave_0) entered disabled state [ 524.500089][T17526] dvmrp0: entered allmulticast mode [ 524.533455][T17539] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2970'. [ 524.676881][T17534] netlink: 176 bytes leftover after parsing attributes in process `syz.2.2970'. [ 524.693510][T17548] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2972'. [ 524.801563][T17534] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2970'. [ 524.871536][T17539] netlink: 'syz.2.2970': attribute type 4 has an invalid length. [ 524.931793][T17555] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2973'. [ 525.243527][T17565] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci5/hci5:200/input9 [ 525.522936][T17578] netlink: 'syz.0.2979': attribute type 1 has an invalid length. [ 525.790248][ C1] ip6_tunnel: syztnl0 xmit: Local address not yet configured! [ 526.780657][T17611] netlink: 'syz.1.2986': attribute type 4 has an invalid length. [ 526.883747][T17616] 8021q: VLANs not supported on lo [ 527.312957][T17636] netlink: 'syz.3.2992': attribute type 39 has an invalid length. [ 527.578105][T17642] netlink: 'syz.0.2996': attribute type 15 has an invalid length. [ 530.352693][T17666] netlink: 'syz.3.3003': attribute type 1 has an invalid length. [ 530.370552][T17666] __nla_validate_parse: 6 callbacks suppressed [ 530.370573][T17666] netlink: 224 bytes leftover after parsing attributes in process `syz.3.3003'. [ 530.584022][T17681] batadv1: entered promiscuous mode [ 530.643140][T17681] batadv1: entered allmulticast mode [ 530.931622][T17678] netlink: 'syz.2.3006': attribute type 8 has an invalid length. [ 530.963936][T17678] netlink: 'syz.2.3006': attribute type 9 has an invalid length. [ 530.982713][T17694] PKCS7: Unknown OID: [4] (bad) [ 531.039525][T17694] PKCS7: Only support pkcs7_signedData type [ 531.099163][ T5631] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 531.115796][ T5631] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 531.125568][ T5631] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 531.141641][ T5631] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 531.150539][ T5631] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 531.688395][T17726] ip6tnl0: entered promiscuous mode [ 532.029454][T17697] lo speed is unknown, defaulting to 1000 [ 532.186426][ C0] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 532.267230][T17744] can: request_module (can-proto-5) failed. [ 532.598759][T17760] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3024'. [ 532.620430][T17761] vlan3: entered promiscuous mode [ 532.631259][T17761] geneve1: entered promiscuous mode [ 532.644821][T17761] vlan3: entered allmulticast mode [ 532.654570][T17764] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3024'. [ 532.655040][T17761] geneve1: entered allmulticast mode [ 532.727904][T17760] team1: entered promiscuous mode [ 532.733204][T17760] team1: entered allmulticast mode [ 532.739083][T17760] 8021q: adding VLAN 0 to HW filter on device team1 [ 532.758202][T17763] netlink: 'syz.4.3026': attribute type 1 has an invalid length. [ 532.772865][T17764] team2 (uninitialized): Failed to send options change via netlink (err -105) [ 532.888242][T17764] team2: entered promiscuous mode [ 532.893460][T17764] team2: entered allmulticast mode [ 532.901634][T17764] 8021q: adding VLAN 0 to HW filter on device team2 [ 532.919113][T17697] lo speed is unknown, defaulting to 1000 [ 533.024916][T17777] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3029'. [ 533.132453][T17782] netlink: 68 bytes leftover after parsing attributes in process `syz.1.3031'. [ 533.226754][ T5643] Bluetooth: hci0: command tx timeout [ 534.146767][T17816] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3035'. [ 534.992696][T17845] netlink: 1148 bytes leftover after parsing attributes in process `syz.1.3037'. [ 535.306789][ T5643] Bluetooth: hci0: command 0x041b tx timeout [ 535.705984][T17879] netlink: 28 bytes leftover after parsing attributes in process `syz.4.3048'. [ 535.819366][T17875] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3045'. [ 536.070646][T17697] bridge0: port 1(bridge_slave_0) entered blocking state [ 536.082614][T17697] bridge0: port 1(bridge_slave_0) entered disabled state [ 536.096644][T17697] bridge_slave_0: entered allmulticast mode [ 536.104763][T17697] bridge_slave_0: entered promiscuous mode [ 536.114588][T17697] bridge0: port 2(bridge_slave_1) entered blocking state [ 536.122451][T17697] bridge0: port 2(bridge_slave_1) entered disabled state [ 536.129931][T17697] bridge_slave_1: entered allmulticast mode [ 536.138375][T17697] bridge_slave_1: entered promiscuous mode [ 536.147858][T17902] netlink: 'syz.4.3052': attribute type 2 has an invalid length. [ 536.177760][T17892] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3045'. [ 536.287230][T17697] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 536.305450][T17697] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 536.423560][T17697] team0: Port device team_slave_0 added [ 536.454341][T17697] team0: Port device team_slave_1 added [ 536.584816][T17910] FAULT_INJECTION: forcing a failure. [ 536.584816][T17910] name failslab, interval 1, probability 0, space 0, times 0 [ 536.600422][T17910] CPU: 0 UID: 0 PID: 17910 Comm: syz.0.3056 Not tainted syzkaller #0 PREEMPT(full) [ 536.600453][T17910] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 536.600472][T17910] Call Trace: [ 536.600552][T17910] [ 536.600622][T17910] dump_stack_lvl+0xe8/0x150 [ 536.600783][T17910] should_fail_ex+0x412/0x560 [ 536.600920][T17910] should_failslab+0xa8/0x100 [ 536.600989][T17910] __kmalloc_cache_noprof+0x88/0x660 [ 536.601026][T17910] ? __asan_memset+0x22/0x50 [ 536.601082][T17910] ? alloc_netdev_mqs+0xbf0/0x1210 [ 536.601203][T17910] ? __xdp_rxq_info_reg+0x171/0x280 [ 536.601276][T17910] alloc_netdev_mqs+0xbf0/0x1210 [ 536.601313][T17910] rtnl_create_link+0x31f/0xd70 [ 536.601398][T17910] rtnl_newlink_create+0x277/0xb70 [ 536.601422][T17910] ? __pfx___nla_validate_parse+0x10/0x10 [ 536.601463][T17910] ? __mutex_lock+0x608/0x1550 [ 536.601551][T17910] ? __pfx_rtnl_newlink_create+0x10/0x10 [ 536.601580][T17910] ? __pfx___mutex_lock+0x10/0x10 [ 536.601616][T17910] ? ns_capable+0x89/0xe0 [ 536.601664][T17910] rtnl_newlink+0x166a/0x1bb0 [ 536.601704][T17910] ? __pfx_rtnl_newlink+0x10/0x10 [ 536.601735][T17910] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 536.601818][T17910] ? kasan_quarantine_put+0xbb/0x1f0 [ 536.601847][T17910] ? lockdep_hardirqs_on+0x7a/0x110 [ 536.601873][T17910] ? nlmon_xmit+0xb0/0x100 [ 536.601977][T17910] ? kmem_cache_free+0x182/0x650 [ 536.602022][T17910] ? __lock_acquire+0x6b5/0x2cf0 [ 536.602068][T17910] ? __dev_queue_xmit+0x2b6/0x3950 [ 536.602122][T17910] ? __local_bh_enable_ip+0xd0/0x130 [ 536.602145][T17910] ? lockdep_hardirqs_on+0x7a/0x110 [ 536.602164][T17910] ? __dev_queue_xmit+0x2b6/0x3950 [ 536.602188][T17910] ? __local_bh_enable_ip+0xd0/0x130 [ 536.602208][T17910] ? __dev_queue_xmit+0x2b6/0x3950 [ 536.602242][T17910] ? rtnetlink_rcv_msg+0x1b9/0xbe0 [ 536.602295][T17910] ? __pfx_rtnl_newlink+0x10/0x10 [ 536.602328][T17910] rtnetlink_rcv_msg+0x7d5/0xbe0 [ 536.602365][T17910] ? rtnetlink_rcv_msg+0x1b9/0xbe0 [ 536.602399][T17910] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 536.602429][T17910] ? ref_tracker_free+0x693/0x840 [ 536.602492][T17910] ? __pfx_ref_tracker_free+0x10/0x10 [ 536.602543][T17910] netlink_rcv_skb+0x232/0x4b0 [ 536.602632][T17910] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 536.602668][T17910] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 536.602708][T17910] ? netlink_deliver_tap+0x2e/0x1b0 [ 536.602733][T17910] ? netlink_deliver_tap+0x2e/0x1b0 [ 536.602764][T17910] netlink_unicast+0x75c/0x8e0 [ 536.602800][T17910] netlink_sendmsg+0x813/0xb40 [ 536.602837][T17910] ? __pfx_netlink_sendmsg+0x10/0x10 [ 536.602866][T17910] ? aa_sock_msg_perm+0xf1/0x1b0 [ 536.602970][T17910] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 536.603021][T17910] ____sys_sendmsg+0x972/0x9f0 [ 536.603094][T17910] ? __might_fault+0xaf/0x130 [ 536.603137][T17910] ? __pfx_____sys_sendmsg+0x10/0x10 [ 536.603173][T17910] ? import_iovec+0x73/0xa0 [ 536.603262][T17910] ___sys_sendmsg+0x2a5/0x360 [ 536.603285][T17910] ? __lock_acquire+0x6b5/0x2cf0 [ 536.603314][T17910] ? __pfx____sys_sendmsg+0x10/0x10 [ 536.603382][T17910] ? __fget_files+0x2a/0x420 [ 536.603420][T17910] ? __fget_files+0x3a0/0x420 [ 536.603459][T17910] __x64_sys_sendmsg+0x1bd/0x2a0 [ 536.603487][T17910] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 536.603529][T17910] ? __pfx_ksys_write+0x10/0x10 [ 536.603578][T17910] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 536.603603][T17910] do_syscall_64+0x15f/0xf80 [ 536.603648][T17910] ? trace_irq_disable+0x3b/0x140 [ 536.603691][T17910] ? clear_bhb_loop+0x40/0x90 [ 536.603717][T17910] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 536.603738][T17910] RIP: 0033:0x7f219319ce59 [ 536.603791][T17910] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 536.603838][T17910] RSP: 002b:00007f21940a2028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 536.603891][T17910] RAX: ffffffffffffffda RBX: 00007f2193415fa0 RCX: 00007f219319ce59 [ 536.603907][T17910] RDX: 0000000000000000 RSI: 0000200000000280 RDI: 0000000000000004 [ 536.603921][T17910] RBP: 00007f21940a2090 R08: 0000000000000000 R09: 0000000000000000 [ 536.603934][T17910] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 536.603946][T17910] R13: 00007f2193416038 R14: 00007f2193415fa0 R15: 00007ffdd52b2a98 [ 536.603983][T17910] [ 536.613645][T17697] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 537.114437][T17697] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 537.141344][T17697] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 537.199292][T17697] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 537.229494][T17697] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 537.289182][T17697] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 537.309506][ C0] bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:1c, vlan:0) [ 537.387298][ T5631] Bluetooth: hci0: command 0x041b tx timeout [ 537.545664][T17697] hsr_slave_0: entered promiscuous mode [ 537.564707][T17697] hsr_slave_1: entered promiscuous mode [ 537.584856][T17697] debugfs: 'hsr0' already exists in 'hsr' [ 537.600978][T17697] Cannot create hsr debugfs directory [ 537.617428][T17934] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3063'. [ 537.644573][T17934] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3063'. [ 537.672953][T17935] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3063'. [ 537.682342][T17935] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3063'. [ 538.008519][T17958] FAULT_INJECTION: forcing a failure. [ 538.008519][T17958] name failslab, interval 1, probability 0, space 0, times 0 [ 538.066591][T17958] CPU: 0 UID: 0 PID: 17958 Comm: syz.0.3068 Not tainted syzkaller #0 PREEMPT(full) [ 538.066622][T17958] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 538.066635][T17958] Call Trace: [ 538.066644][T17958] [ 538.066653][T17958] dump_stack_lvl+0xe8/0x150 [ 538.066683][T17958] should_fail_ex+0x412/0x560 [ 538.066719][T17958] should_failslab+0xa8/0x100 [ 538.066754][T17958] __kmalloc_cache_noprof+0x88/0x660 [ 538.066783][T17958] ? __asan_memset+0x22/0x50 [ 538.066808][T17958] ? alloc_netdev_mqs+0xbf0/0x1210 [ 538.066833][T17958] ? __xdp_rxq_info_reg+0x171/0x280 [ 538.066861][T17958] alloc_netdev_mqs+0xbf0/0x1210 [ 538.066895][T17958] rtnl_create_link+0x31f/0xd70 [ 538.066930][T17958] rtnl_newlink_create+0x277/0xb70 [ 538.066954][T17958] ? __pfx___nla_validate_parse+0x10/0x10 [ 538.066993][T17958] ? __mutex_lock+0x608/0x1550 [ 538.067018][T17958] ? __pfx_rtnl_newlink_create+0x10/0x10 [ 538.067046][T17958] ? __pfx___mutex_lock+0x10/0x10 [ 538.067080][T17958] ? ns_capable+0x89/0xe0 [ 538.067107][T17958] rtnl_newlink+0x166a/0x1bb0 [ 538.067145][T17958] ? __pfx_rtnl_newlink+0x10/0x10 [ 538.067174][T17958] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 538.067248][T17958] ? kasan_quarantine_put+0xbb/0x1f0 [ 538.067276][T17958] ? lockdep_hardirqs_on+0x7a/0x110 [ 538.067301][T17958] ? nlmon_xmit+0xb0/0x100 [ 538.067330][T17958] ? kmem_cache_free+0x182/0x650 [ 538.067373][T17958] ? __lock_acquire+0x6b5/0x2cf0 [ 538.067403][T17958] ? __dev_queue_xmit+0x2b6/0x3950 [ 538.067432][T17958] ? __local_bh_enable_ip+0xd0/0x130 [ 538.067454][T17958] ? lockdep_hardirqs_on+0x7a/0x110 [ 538.067473][T17958] ? __dev_queue_xmit+0x2b6/0x3950 [ 538.067495][T17958] ? __local_bh_enable_ip+0xd0/0x130 [ 538.067515][T17958] ? __dev_queue_xmit+0x2b6/0x3950 [ 538.067551][T17958] ? rtnetlink_rcv_msg+0x1b9/0xbe0 [ 538.067600][T17958] ? __pfx_rtnl_newlink+0x10/0x10 [ 538.067633][T17958] rtnetlink_rcv_msg+0x7d5/0xbe0 [ 538.067670][T17958] ? rtnetlink_rcv_msg+0x1b9/0xbe0 [ 538.067702][T17958] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 538.067732][T17958] ? ref_tracker_free+0x693/0x840 [ 538.067766][T17958] ? __pfx_ref_tracker_free+0x10/0x10 [ 538.067809][T17958] netlink_rcv_skb+0x232/0x4b0 [ 538.067835][T17958] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 538.067871][T17958] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 538.067910][T17958] ? netlink_deliver_tap+0x2e/0x1b0 [ 538.067932][T17958] ? netlink_deliver_tap+0x2e/0x1b0 [ 538.067961][T17958] netlink_unicast+0x75c/0x8e0 [ 538.067996][T17958] netlink_sendmsg+0x813/0xb40 [ 538.068030][T17958] ? __pfx_netlink_sendmsg+0x10/0x10 [ 538.068059][T17958] ? aa_sock_msg_perm+0xf1/0x1b0 [ 538.068090][T17958] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 538.068125][T17958] ____sys_sendmsg+0x972/0x9f0 [ 538.068149][T17958] ? __might_fault+0xaf/0x130 [ 538.068185][T17958] ? __pfx_____sys_sendmsg+0x10/0x10 [ 538.068219][T17958] ? import_iovec+0x73/0xa0 [ 538.068263][T17958] ___sys_sendmsg+0x2a5/0x360 [ 538.068286][T17958] ? __lock_acquire+0x6b5/0x2cf0 [ 538.068315][T17958] ? __pfx____sys_sendmsg+0x10/0x10 [ 538.068382][T17958] ? __fget_files+0x2a/0x420 [ 538.068407][T17958] ? __fget_files+0x3a0/0x420 [ 538.068445][T17958] __x64_sys_sendmsg+0x1bd/0x2a0 [ 538.068473][T17958] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 538.068509][T17958] ? __pfx_ksys_write+0x10/0x10 [ 538.068550][T17958] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 538.068573][T17958] do_syscall_64+0x15f/0xf80 [ 538.068593][T17958] ? trace_irq_disable+0x3b/0x140 [ 538.068626][T17958] ? clear_bhb_loop+0x40/0x90 [ 538.068653][T17958] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 538.068675][T17958] RIP: 0033:0x7f219319ce59 [ 538.068695][T17958] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 538.068713][T17958] RSP: 002b:00007f21940a2028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 538.068736][T17958] RAX: ffffffffffffffda RBX: 00007f2193415fa0 RCX: 00007f219319ce59 [ 538.068753][T17958] RDX: 0000000000000000 RSI: 0000200000000280 RDI: 0000000000000004 [ 538.068766][T17958] RBP: 00007f21940a2090 R08: 0000000000000000 R09: 0000000000000000 [ 538.068780][T17958] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 538.068792][T17958] R13: 00007f2193416038 R14: 00007f2193415fa0 R15: 00007ffdd52b2a98 [ 538.068829][T17958] [ 538.695625][T17697] netdevsim netdevsim3 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 538.706700][T17697] netdevsim netdevsim3 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 538.823960][T17697] netdevsim netdevsim3 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 538.842078][T17697] netdevsim netdevsim3 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 538.951838][T17697] netdevsim netdevsim3 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 538.968158][T17697] netdevsim netdevsim3 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 539.118269][T17697] netdevsim netdevsim3 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 539.136691][T17981] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 539.145860][T17697] netdevsim netdevsim3 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 539.226644][ C0] ip6_tunnel: ip6tnl3 xmit: Local address not yet configured! [ 539.234088][ C1] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 539.398969][T17997] netlink: 'syz.2.3076': attribute type 13 has an invalid length. [ 539.431355][T17997] netlink: 'syz.2.3076': attribute type 17 has an invalid length. [ 539.485624][ T5631] Bluetooth: hci0: command 0x041b tx timeout [ 539.674942][T18013] netlink: 44 bytes leftover after parsing attributes in process `syz.2.3076'. [ 539.954770][T18023] xt_NFQUEUE: number of total queues is 0 [ 540.117989][T18037] xt_NFQUEUE: number of total queues is 0 [ 540.644045][T17991] ip6gretap0: left allmulticast mode [ 540.809472][T17991] tipc: Resetting bearer [ 540.912535][ T8095] lo speed is unknown, defaulting to 1000 [ 540.984562][T17997] ip6gretap0: left promiscuous mode [ 541.018014][T17997] 8021q: adding VLAN 0 to HW filter on device  [ 541.029301][T17997] 8021q: adding VLAN 0 to HW filter on device team0 [ 541.046845][T17997] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 541.123950][T17997] veth1_macvtap: left promiscuous mode [ 541.130914][T17997] veth0_macvtap: left promiscuous mode [ 541.147292][T17997] veth0_macvtap: entered promiscuous mode [ 541.168860][T17997] veth1_macvtap: entered promiscuous mode [ 541.183106][T17997] mac80211_hwsim hwsim5 wlan0: left allmulticast mode [ 541.195788][T17997] 8021q: adding VLAN 0 to HW filter on device eth0 [ 541.209373][T17997] 8021q: adding VLAN 0 to HW filter on device eth1 [ 541.223237][T17997] 8021q: adding VLAN 0 to HW filter on device eth2 [ 541.236009][T17997] 8021q: adding VLAN 0 to HW filter on device eth3 [ 541.255483][T17997] 8021q: adding VLAN 0 to HW filter on device bond0 [ 541.274721][T17997] bond1: left promiscuous mode [ 541.280200][T17997] bond1: left allmulticast mode [ 541.285456][T17997] 8021q: adding VLAN 0 to HW filter on device bond1 [ 541.299875][T17997] ip6gretap0: entered promiscuous mode [ 541.305385][T17997] ip6gretap0: entered allmulticast mode [ 541.313417][T17997] macvtap1: left promiscuous mode [ 541.318728][T17997] macvtap1: left allmulticast mode [ 541.323883][T17997] ip6gretap0: left allmulticast mode [ 541.357021][T17997] 8021q: adding VLAN 0 to HW filter on device bond2 [ 541.371188][T17997] gtp1: left promiscuous mode [ 541.375911][T17997] gtp1: left allmulticast mode [ 541.385479][T17997] bond3: left promiscuous mode [ 541.390685][T17997] erspan2: left promiscuous mode [ 541.397202][T17997] bond3: left allmulticast mode [ 541.403364][T17997] 8021q: adding VLAN 0 to HW filter on device bond3 [ 541.412687][T17997] erspan2: left allmulticast mode [ 541.422651][T17997] gtp2: left allmulticast mode [ 541.430513][T17997] ip6tnl1: left allmulticast mode [ 541.438589][T17997] bond4: left promiscuous mode [ 541.443809][T17997] 8021q: adding VLAN 0 to HW filter on device bond4 [ 541.454091][T17997] bridge5: left promiscuous mode [ 541.459943][T17997] bridge5: left allmulticast mode [ 541.467797][T17997] bridge6: left promiscuous mode [ 541.472883][T17997] bridge6: left allmulticast mode [ 541.489096][T17997] mac80211_hwsim hwsim5 syzkaller0: left promiscuous mode [ 541.497470][T17997] mac80211_hwsim hwsim5 syzkaller0: left allmulticast mode [ 541.504841][T17997] A link change request failed with some changes committed already. Interface syzkaller0 may have been left with an inconsistent configuration, please check. [ 541.528625][T18014] FAULT_INJECTION: forcing a failure. [ 541.528625][T18014] name failslab, interval 1, probability 0, space 0, times 0 [ 541.547293][ T5631] Bluetooth: hci0: command 0x041b tx timeout [ 541.562511][T18014] CPU: 1 UID: 0 PID: 18014 Comm: syz.1.3079 Not tainted syzkaller #0 PREEMPT(full) [ 541.562540][T18014] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 541.562553][T18014] Call Trace: [ 541.562561][T18014] [ 541.562569][T18014] dump_stack_lvl+0xe8/0x150 [ 541.562601][T18014] should_fail_ex+0x412/0x560 [ 541.562637][T18014] should_failslab+0xa8/0x100 [ 541.562673][T18014] __kmalloc_cache_noprof+0x88/0x660 [ 541.562705][T18014] ? macvlan_common_newlink+0x5e1/0x19e0 [ 541.562821][T18014] macvlan_common_newlink+0x5e1/0x19e0 [ 541.562850][T18014] ? __kvmalloc_node_noprof+0x393/0x8a0 [ 541.562888][T18014] ? validate_linkmsg+0x765/0x950 [ 541.562921][T18014] ? __pfx_macvlan_common_newlink+0x10/0x10 [ 541.562956][T18014] ? __pfx_macvlan_newlink+0x10/0x10 [ 541.563013][T18014] rtnl_newlink_create+0x329/0xb70 [ 541.563037][T18014] ? __pfx___nla_validate_parse+0x10/0x10 [ 541.563077][T18014] ? __mutex_lock+0x608/0x1550 [ 541.563103][T18014] ? __pfx_rtnl_newlink_create+0x10/0x10 [ 541.563131][T18014] ? __pfx___mutex_lock+0x10/0x10 [ 541.563165][T18014] ? ns_capable+0x89/0xe0 [ 541.563192][T18014] rtnl_newlink+0x166a/0x1bb0 [ 541.563232][T18014] ? __pfx_rtnl_newlink+0x10/0x10 [ 541.563263][T18014] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 541.563330][T18014] ? kasan_quarantine_put+0xbb/0x1f0 [ 541.563359][T18014] ? lockdep_hardirqs_on+0x7a/0x110 [ 541.563384][T18014] ? nlmon_xmit+0xb0/0x100 [ 541.563413][T18014] ? kmem_cache_free+0x182/0x650 [ 541.563456][T18014] ? __lock_acquire+0x6b5/0x2cf0 [ 541.563492][T18014] ? __dev_queue_xmit+0x2b6/0x3950 [ 541.563521][T18014] ? __local_bh_enable_ip+0xd0/0x130 [ 541.563544][T18014] ? lockdep_hardirqs_on+0x7a/0x110 [ 541.563564][T18014] ? __dev_queue_xmit+0x2b6/0x3950 [ 541.563587][T18014] ? __local_bh_enable_ip+0xd0/0x130 [ 541.563608][T18014] ? __dev_queue_xmit+0x2b6/0x3950 [ 541.563642][T18014] ? rtnetlink_rcv_msg+0x1b9/0xbe0 [ 541.563694][T18014] ? __pfx_rtnl_newlink+0x10/0x10 [ 541.563726][T18014] rtnetlink_rcv_msg+0x7d5/0xbe0 [ 541.563764][T18014] ? rtnetlink_rcv_msg+0x1b9/0xbe0 [ 541.563796][T18014] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 541.563827][T18014] ? ref_tracker_free+0x693/0x840 [ 541.563861][T18014] ? __pfx_ref_tracker_free+0x10/0x10 [ 541.563905][T18014] netlink_rcv_skb+0x232/0x4b0 [ 541.563930][T18014] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 541.563970][T18014] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 541.564011][T18014] ? netlink_deliver_tap+0x2e/0x1b0 [ 541.564034][T18014] ? netlink_deliver_tap+0x2e/0x1b0 [ 541.564064][T18014] netlink_unicast+0x75c/0x8e0 [ 541.564099][T18014] netlink_sendmsg+0x813/0xb40 [ 541.564135][T18014] ? __pfx_netlink_sendmsg+0x10/0x10 [ 541.564164][T18014] ? aa_sock_msg_perm+0xf1/0x1b0 [ 541.564195][T18014] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 541.564229][T18014] ____sys_sendmsg+0x972/0x9f0 [ 541.564252][T18014] ? __might_fault+0xaf/0x130 [ 541.564288][T18014] ? __pfx_____sys_sendmsg+0x10/0x10 [ 541.564323][T18014] ? import_iovec+0x73/0xa0 [ 541.564360][T18014] ___sys_sendmsg+0x2a5/0x360 [ 541.564382][T18014] ? __lock_acquire+0x6b5/0x2cf0 [ 541.564411][T18014] ? __pfx____sys_sendmsg+0x10/0x10 [ 541.564478][T18014] ? __fget_files+0x2a/0x420 [ 541.564509][T18014] ? __fget_files+0x3a0/0x420 [ 541.564547][T18014] __x64_sys_sendmsg+0x1bd/0x2a0 [ 541.564575][T18014] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 541.564611][T18014] ? __pfx_ksys_write+0x10/0x10 [ 541.564653][T18014] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 541.564676][T18014] do_syscall_64+0x15f/0xf80 [ 541.564696][T18014] ? trace_irq_disable+0x3b/0x140 [ 541.564728][T18014] ? clear_bhb_loop+0x40/0x90 [ 541.564754][T18014] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 541.564776][T18014] RIP: 0033:0x7f03a639ce59 [ 541.564797][T18014] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 541.564815][T18014] RSP: 002b:00007f03a733b028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 541.564838][T18014] RAX: ffffffffffffffda RBX: 00007f03a6615fa0 RCX: 00007f03a639ce59 [ 541.564855][T18014] RDX: 0000000000000000 RSI: 0000200000000280 RDI: 0000000000000004 [ 541.564869][T18014] RBP: 00007f03a733b090 R08: 0000000000000000 R09: 0000000000000000 [ 541.564882][T18014] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 541.564895][T18014] R13: 00007f03a6616038 R14: 00007f03a6615fa0 R15: 00007fffde64e7f8 [ 541.564931][T18014] [ 541.786913][ C0] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 542.010510][ T7890] bond2: (slave veth5): link status definitely up, 10000 Mbps full duplex [ 542.141914][ T7890] bond2: (slave veth5): making interface the new active one [ 542.157634][ T7890] bond2: active interface up! [ 542.204895][T18049] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3086'. [ 542.215399][ T7889] netdevsim netdevsim2 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 542.261282][ T7889] netdevsim netdevsim2 eth0: set [1, 1] type 2 family 0 port 20000 - 0 [ 542.281283][ T7889] netdevsim netdevsim2 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 542.303018][ T7889] netdevsim netdevsim2 eth1: set [1, 1] type 2 family 0 port 20000 - 0 [ 542.334662][T18008] lo speed is unknown, defaulting to 1000 [ 542.357776][T18055] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3088'. [ 542.370684][T18053] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3087'. [ 542.385529][ T7889] netdevsim netdevsim2 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 542.404355][ T7889] netdevsim netdevsim2 eth2: set [1, 1] type 2 family 0 port 20000 - 0 [ 542.422151][ T7889] netdevsim netdevsim2 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 542.443223][ T7889] netdevsim netdevsim2 eth3: set [1, 1] type 2 family 0 port 20000 - 0 [ 542.463896][ T8094] lo speed is unknown, defaulting to 1000 [ 542.543821][T18063] netlink: 28 bytes leftover after parsing attributes in process `syz.4.3090'. [ 542.707273][ C1] bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:1c, vlan:0) [ 542.783859][T18064] vlan3: left promiscuous mode [ 542.791750][T18064] geneve1: left promiscuous mode [ 542.801296][T18064] vlan3: left allmulticast mode [ 542.806437][T18064] geneve1: left allmulticast mode [ 542.813311][T18064] gretap0: entered promiscuous mode [ 542.876519][T18076] netlink: 44 bytes leftover after parsing attributes in process `syz.2.3091'. [ 542.899494][T18069] hsr0: entered promiscuous mode [ 542.925161][ T7893] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 542.940056][ C1] bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:1c, vlan:0) [ 542.981488][T18076] hsr_slave_0: left promiscuous mode [ 543.003473][T18076] hsr_slave_1: left promiscuous mode [ 543.042469][T18076] hsr0 (unregistering): left promiscuous mode [ 543.073383][T18076] smc: removing net device hsr0 with user defined pnetid SYZ2 [ 543.380146][T17697] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 543.412695][T17697] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 543.439904][T17697] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 543.455948][T17697] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 543.457024][T18086] netlink: 120 bytes leftover after parsing attributes in process `syz.4.3096'. [ 543.478338][T18084] pim6reg0: tun_chr_ioctl cmd 1074025675 [ 543.492838][T18084] pim6reg0: persist disabled [ 543.516888][T17697] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 543.551262][T17697] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 543.575424][T17697] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 543.600664][T17697] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 543.603002][T18088] netlink: 'syz.2.3097': attribute type 1 has an invalid length. [ 543.707150][ C1] ip6_tunnel: syztnl0 xmit: Local address not yet configured! [ 543.756630][T18084] tipc: Resetting bearer [ 543.987424][T18108] netlink: 84 bytes leftover after parsing attributes in process `syz.1.3099'. [ 544.008680][T18108] netlink: 72 bytes leftover after parsing attributes in process `syz.1.3099'. [ 544.024285][T18108] netlink: 40 bytes leftover after parsing attributes in process `syz.1.3099'. [ 544.223774][T18113] netlink: 'syz.4.3101': attribute type 1 has an invalid length. [ 544.817094][T18141] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3107'. [ 544.889941][T18141] 8021q: adding VLAN 0 to HW filter on device bond7 [ 544.909832][T18120] lo speed is unknown, defaulting to 1000 [ 545.151395][T18145] bond7 (unregistering): Released all slaves [ 545.554022][T18141] bond7 (unregistering): Released all slaves [ 545.718296][T17697] 8021q: adding VLAN 0 to HW filter on device bond0 [ 545.821512][T17697] 8021q: adding VLAN 0 to HW filter on device team0 [ 545.868854][T18153] netlink: 'syz.0.3109': attribute type 1 has an invalid length. [ 545.939829][ T7890] bridge0: port 1(bridge_slave_0) entered blocking state [ 545.947085][ T7890] bridge0: port 1(bridge_slave_0) entered forwarding state [ 545.978719][ T7890] bridge0: port 2(bridge_slave_1) entered blocking state [ 545.987830][ T7890] bridge0: port 2(bridge_slave_1) entered forwarding state [ 546.013825][T18120] lo speed is unknown, defaulting to 1000 [ 546.163853][T18164] 8021q: adding VLAN 0 to HW filter on device bond1 [ 546.273352][T18157] bond1: (slave ip6gretap1): Enslaving as a backup interface with an up link [ 546.308088][ T93] bond1: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 546.360953][T18161] veth3: entered promiscuous mode [ 546.468515][ T3398] bond1: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 546.746334][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 547.770249][T17697] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 548.065765][T17697] veth0_vlan: entered promiscuous mode [ 548.139999][T17697] veth1_vlan: entered promiscuous mode [ 548.274583][T17697] veth0_macvtap: entered promiscuous mode [ 548.299385][T17697] veth1_macvtap: entered promiscuous mode [ 548.371201][T17697] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 548.417226][T17697] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 548.474284][ T3398] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 548.499803][ T3398] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 548.560282][ T3398] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 548.609259][ T3398] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 548.707137][T18229] __nla_validate_parse: 3 callbacks suppressed [ 548.707158][T18229] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3126'. [ 548.866016][T18232] netlink: 'syz.0.3126': attribute type 1 has an invalid length. [ 548.930747][T18234] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3128'. [ 548.951831][T18238] netlink: 28 bytes leftover after parsing attributes in process `syz.0.3126'. [ 549.062481][T18232] bond2: entered promiscuous mode [ 549.082145][T18232] 8021q: adding VLAN 0 to HW filter on device bond2 [ 549.211267][T18238] bond2: entered allmulticast mode [ 549.389712][T18232] bond2: (slave bridge1): making interface the new active one [ 549.418866][T18232] bridge1: entered promiscuous mode [ 549.434547][T18232] bridge1: entered allmulticast mode [ 549.453515][T18232] bond2: (slave bridge1): Enslaving as an active interface with an up link [ 549.676899][T18244] hmac(sh: entered promiscuous mode [ 549.690392][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 549.726366][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 549.842531][ T3398] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 549.879527][ T3398] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 549.931279][T18246] scsi_nl_rcv_msg: discarding partial skb [ 550.110058][T18251] bond3: option tlb_dynamic_lb: mode dependency failed, not supported in mode balance-rr(0) [ 550.164850][T18258] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3134'. [ 550.333525][T18251] bond3 (unregistering): Released all slaves [ 550.401753][T18248] lo speed is unknown, defaulting to 1000 [ 550.511018][T18258] 8021q: adding VLAN 0 to HW filter on device bond14 [ 550.615397][T18259] bond14: (slave veth9): Enslaving as an active interface with an up link [ 550.636766][T18268] netlink: 'syz.2.3133': attribute type 1 has an invalid length. [ 550.982305][T18278] netlink: 16178 bytes leftover after parsing attributes in process `syz.3.3138'. [ 551.077788][T18248] lo speed is unknown, defaulting to 1000 [ 551.131098][T18278] syzkaller1: entered promiscuous mode [ 551.161622][T18278] syzkaller1: entered allmulticast mode [ 551.205247][ T5643] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 551.223455][ T5643] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 551.233687][ T5643] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 551.243358][ T5643] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 551.255414][ T5643] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 551.401138][T18290] bond7: option lp_interval: invalid value (0) [ 551.430922][T18290] bond7: option lp_interval: allowed values 1 - 2147483647 [ 551.497933][T18290] bond7 (unregistering): Released all slaves [ 551.687461][T18296] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3142'. [ 551.738650][T18294] netlink: 68 bytes leftover after parsing attributes in process `syz.0.3142'. [ 551.764382][T18294] netlink: 28 bytes leftover after parsing attributes in process `syz.0.3142'. [ 552.565839][T18285] lo speed is unknown, defaulting to 1000 [ 552.610093][T18323] Bluetooth: MGMT ver 1.23 [ 552.666756][ C1] bridge0: port 2(bridge_slave_1) entered forwarding state [ 552.674082][ C1] bridge0: topology change detected, propagating [ 552.935826][T18332] netlink: 'syz.3.3151': attribute type 9 has an invalid length. [ 552.943862][T18332] netlink: 'syz.3.3151': attribute type 11 has an invalid length. [ 552.953030][T18332] netlink: 190972 bytes leftover after parsing attributes in process `syz.3.3151'. [ 553.009002][T18332] netlink: 44 bytes leftover after parsing attributes in process `syz.3.3151'. [ 553.051096][T18285] lo speed is unknown, defaulting to 1000 [ 553.062798][T18332] netlink: 'syz.3.3151': attribute type 3 has an invalid length. [ 553.084078][T18332] netlink: 'syz.3.3151': attribute type 1 has an invalid length. [ 553.102416][T18332] netlink: 'syz.3.3151': attribute type 1 has an invalid length. [ 553.122531][T18332] NCSI netlink: No device for ifindex 65545 [ 553.310247][ T5631] Bluetooth: hci3: command tx timeout [ 553.820114][T18348] __nla_validate_parse: 1 callbacks suppressed [ 553.820138][T18348] netlink: 212368 bytes leftover after parsing attributes in process `syz.0.3157'. [ 553.958338][T18350] netlink: 20 bytes leftover after parsing attributes in process `syz.0.3158'. [ 554.469084][T18365] nbd: socks must be embedded in a SOCK_ITEM attr [ 554.522616][T18369] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3162'. [ 554.555902][T18369] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3162'. [ 554.588802][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 554.600465][T18369] netlink: 'syz.2.3162': attribute type 32 has an invalid length. [ 554.745822][T18369] netlink: 'syz.2.3162': attribute type 16 has an invalid length. [ 554.767624][T18369] netlink: 'syz.2.3162': attribute type 17 has an invalid length. [ 555.160427][T18369] A link change request failed with some changes committed already. Interface syzkaller0 may have been left with an inconsistent configuration, please check. [ 555.386566][ T5631] Bluetooth: hci3: command tx timeout [ 555.485931][T18397] netlink: 'syz.3.3170': attribute type 2 has an invalid length. [ 555.558901][T18403] netlink: 'syz.2.3172': attribute type 153 has an invalid length. [ 555.570260][T18402] netlink: 'syz.2.3172': attribute type 153 has an invalid length. [ 555.678374][T18407] netlink: 'syz.3.3173': attribute type 1 has an invalid length. [ 555.738826][T18407] gretap1: entered allmulticast mode [ 555.957626][ T3398] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 555.980075][ T3398] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 555.994711][T18044] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 556.196629][T18421] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3176'. [ 556.289712][T18431] netlink: 'syz.3.3178': attribute type 12 has an invalid length. [ 556.324996][T18285] bridge0: port 1(bridge_slave_0) entered blocking state [ 556.355251][T18285] bridge0: port 1(bridge_slave_0) entered disabled state [ 556.366861][T18285] bridge_slave_0: entered allmulticast mode [ 556.375104][T18285] bridge_slave_0: entered promiscuous mode [ 556.385034][T18285] bridge0: port 2(bridge_slave_1) entered blocking state [ 556.392469][T18285] bridge0: port 2(bridge_slave_1) entered disabled state [ 556.401225][T18285] bridge_slave_1: entered allmulticast mode [ 556.410113][T18285] bridge_slave_1: entered promiscuous mode [ 556.446391][T18435] netlink: 20 bytes leftover after parsing attributes in process `syz.2.3179'. [ 556.525421][T18285] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 556.563386][T18285] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 556.634823][T18285] team0: Port device team_slave_0 added [ 556.660584][T18285] team0: Port device team_slave_1 added [ 556.749502][ T8094] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 556.772449][T18285] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 556.786242][T18285] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 556.820446][T18285] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 556.838108][T18285] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 556.847161][T18285] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 556.874693][T18285] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 556.886618][T18450] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3184'. [ 556.890676][T18446] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 556.986506][ T8094] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 557.031241][T18285] hsr_slave_0: entered promiscuous mode [ 557.048669][T18285] hsr_slave_1: entered promiscuous mode [ 557.058931][T18285] debugfs: 'hsr0' already exists in 'hsr' [ 557.070487][T18285] Cannot create hsr debugfs directory [ 557.093526][T18460] nbd: must specify a size in bytes for the device [ 557.476500][ T5631] Bluetooth: hci3: command tx timeout [ 557.498992][T18470] netlink: 40 bytes leftover after parsing attributes in process `syz.2.3188'. [ 557.551237][T18468] can: request_module (can-proto-0) failed. [ 557.583681][T18468] netlink: 48 bytes leftover after parsing attributes in process `syz.3.3189'. [ 557.697246][T18285] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 557.786383][ C0] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 557.864337][T18285] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 558.209127][T18285] team0: Port device netdevsim1 removed [ 558.236038][T18285] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 558.516638][T18501] netlink: 60 bytes leftover after parsing attributes in process `syz.3.3197'. [ 558.548458][T18285] netdevsim netdevsim1 €Â (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 558.791748][T18510] netlink: 'syz.0.3199': attribute type 1 has an invalid length. [ 558.847126][T18510] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3199'. [ 559.209353][T18525] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3205'. [ 559.239734][T18528] netlink: 'syz.3.3203': attribute type 23 has an invalid length. [ 559.250020][T18528] IPv6: NLM_F_CREATE should be specified when creating new route [ 559.301277][T18529] netlink: 16402 bytes leftover after parsing attributes in process `syz.4.3204'. [ 559.449452][T18538] netlink: 60 bytes leftover after parsing attributes in process `syz.0.3207'. [ 559.550670][ T5631] Bluetooth: hci3: command tx timeout [ 559.571147][T18541] netlink: 64 bytes leftover after parsing attributes in process `syz.0.3207'. [ 559.652013][T18285] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 559.684773][T18285] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 559.702859][T18285] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 559.759676][T18285] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 559.794475][T18285] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 559.804267][T18548] netlink: 48 bytes leftover after parsing attributes in process `syz.4.3211'. [ 559.827884][T18285] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 559.847439][T18548] netlink: 56 bytes leftover after parsing attributes in process `syz.4.3211'. [ 559.883022][T18285] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 559.914266][T18285] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 559.941889][T18555] netlink: 'syz.0.3213': attribute type 1 has an invalid length. [ 560.012279][T18555] 8021q: adding VLAN 0 to HW filter on device bond3 [ 560.079416][T18555] netlink: 20 bytes leftover after parsing attributes in process `syz.0.3213'. [ 560.129090][T18571] netlink: 220 bytes leftover after parsing attributes in process `syz.2.3212'. [ 560.337973][T18563] bond3: (slave veth3): Enslaving as an active interface with a down link [ 560.426377][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 560.586094][T18557] lo speed is unknown, defaulting to 1000 [ 560.642216][T18582] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3217'. [ 560.832696][T18285] 8021q: adding VLAN 0 to HW filter on device bond0 [ 561.012529][T18285] 8021q: adding VLAN 0 to HW filter on device team0 [ 561.058398][ T9398] bridge0: port 1(bridge_slave_0) entered blocking state [ 561.065621][ T9398] bridge0: port 1(bridge_slave_0) entered forwarding state [ 561.099657][ T9398] bridge0: port 2(bridge_slave_1) entered blocking state [ 561.106930][ T9398] bridge0: port 2(bridge_slave_1) entered forwarding state [ 561.533414][T18602] ip6gretap1: entered promiscuous mode [ 561.890681][T18619] ICMPv6: Received fragmented ndisc packet. Carefully consider disabling suppress_frag_ndisc. [ 561.941037][T18619] tipc: Started in network mode [ 561.969486][T18619] tipc: Node identity ac1414aa, cluster identity 4711 [ 561.991359][T18619] tipc: Enabled bearer , priority 10 [ 562.048610][T18624] bridge1: the hash_elasticity option has been deprecated and is always 16 [ 562.079151][T18624] bridge1: entered allmulticast mode [ 562.115016][T18557] lo speed is unknown, defaulting to 1000 [ 562.213547][T18003] hsr0: entered promiscuous mode [ 562.464658][T18285] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 562.567759][T18638] tipc: Enabled bearer , priority 0 [ 562.581437][T18638] syzkaller0: entered promiscuous mode [ 562.603283][T18638] syzkaller0: entered allmulticast mode [ 562.668021][T18637] tipc: Resetting bearer [ 562.749760][T18637] tipc: Disabling bearer [ 562.778942][T18285] veth0_vlan: entered promiscuous mode [ 562.894577][T18285] veth1_vlan: entered promiscuous mode [ 562.910406][ T1315] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 563.033122][T18285] veth0_macvtap: entered promiscuous mode [ 563.058006][T18285] veth1_macvtap: entered promiscuous mode [ 563.109643][T18285] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 563.132253][T18005] tipc: Node number set to 2886997162 [ 563.186899][T18285] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 563.241179][ T9389] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 563.279449][ T93] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 563.314982][ T93] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 563.337107][ T93] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 563.620516][T18665] RDS: rds_bind could not find a transport for fec0:ffff::1, load rds_tcp or rds_rdma? [ 563.647877][ T7889] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 563.669578][ T7889] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 563.798493][T18664] lo speed is unknown, defaulting to 1000 [ 563.837411][ T9398] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 563.861099][ T9398] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 564.405222][T18680] __nla_validate_parse: 3 callbacks suppressed [ 564.405247][T18680] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3237'. [ 564.481835][T18681] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3237'. [ 564.769977][T18664] lo speed is unknown, defaulting to 1000 [ 565.503425][T18714] netlink: 'syz.0.3242': attribute type 39 has an invalid length. [ 565.791453][T18723] netlink: 'syz.1.3243': attribute type 21 has an invalid length. [ 565.826375][T18723] netlink: 132 bytes leftover after parsing attributes in process `syz.1.3243'. [ 566.617663][T18741] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3246'. [ 566.974757][T18754] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3250'. [ 567.361418][T18752] syzkaller0: entered promiscuous mode [ 567.393277][T18752] syzkaller0: entered allmulticast mode [ 567.508300][T18769] netlink: 136 bytes leftover after parsing attributes in process `syz.1.3253'. [ 567.573834][T18769] A link change request failed with some changes committed already. Interface erspan0 may have been left with an inconsistent configuration, please check. [ 567.709720][T18783] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 568.032893][ C0] bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:1c, vlan:0) [ 568.678557][ C1] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 569.316422][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 571.047409][T18798] Cannot find del_set index 0 as target [ 571.069088][T18798] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3258'. [ 571.834999][T18815] block nbd0: Unsupported socket: should be TCP or UNIX. [ 571.850153][ T5643] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 571.875765][ T5643] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 571.892283][ T5643] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 571.910287][ T5643] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 571.920319][ T5643] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 572.032056][T18822] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 572.952405][T18813] lo speed is unknown, defaulting to 1000 [ 573.304501][T18813] lo speed is unknown, defaulting to 1000 [ 573.508579][T18851] IPv6: NLM_F_CREATE should be specified when creating new route [ 573.533555][T18851] IPv6: NLM_F_REPLACE set, but no existing node found! [ 573.685257][T18857] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3272'. [ 573.730466][T18857] tipc: Enabling of bearer rejected, failed to enable media [ 573.966626][T18873] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 573.983974][T18874] netlink: 'syz.3.3276': attribute type 3 has an invalid length. [ 574.009482][T18871] netlink: 'syz.3.3276': attribute type 3 has an invalid length. [ 574.031948][ T5631] Bluetooth: hci1: command tx timeout [ 574.059556][T18873] netlink: 'syz.0.3277': attribute type 5 has an invalid length. [ 574.467891][T18864] xt_hashlimit: size too large, truncated to 1048576 [ 575.133046][T18904] netlink: 'syz.3.3284': attribute type 5 has an invalid length. [ 575.240255][T18813] bridge0: port 1(bridge_slave_0) entered blocking state [ 575.271562][T18813] bridge0: port 1(bridge_slave_0) entered disabled state [ 575.294176][T18813] bridge_slave_0: entered allmulticast mode [ 575.329248][T18813] bridge_slave_0: entered promiscuous mode [ 575.368394][T18813] bridge0: port 2(bridge_slave_1) entered blocking state [ 575.392639][T18813] bridge0: port 2(bridge_slave_1) entered disabled state [ 575.407247][T18813] bridge_slave_1: entered allmulticast mode [ 575.434690][T18813] bridge_slave_1: entered promiscuous mode [ 575.452338][T18923] netlink: 68 bytes leftover after parsing attributes in process `syz.1.3286'. [ 575.540830][T18925] workqueue: Failed to create a rescuer kthread for wq "bond1": -EINTR [ 575.552673][T18931] netlink: 72 bytes leftover after parsing attributes in process `syz.4.3289'. [ 575.572689][T18931] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3289'. [ 575.584857][T18931] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3289'. [ 575.664657][T18813] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 575.700973][T18813] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 575.819285][T18939] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3292'. [ 575.830771][T18937] netlink: 20 bytes leftover after parsing attributes in process `syz.3.3291'. [ 575.963379][T18939] bond4: option lacp_active: invalid value (8) [ 575.990432][T18939] bond4 (unregistering): Released all slaves [ 576.061622][T18813] team0: Port device team_slave_0 added [ 576.080935][T18813] team0: Port device team_slave_1 added [ 576.106589][ T5631] Bluetooth: hci1: command tx timeout [ 576.132614][T18813] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 576.140484][T18813] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 576.168587][T18813] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 576.182090][T18813] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 576.189192][T18813] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 576.220399][T18813] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 576.274020][T18949] tipc: Started in network mode [ 576.282290][T18949] tipc: Node identity a600f36638db, cluster identity 4711 [ 576.291833][T18949] tipc: Enabled bearer , priority 0 [ 576.302337][T18948] syzkaller0: entered promiscuous mode [ 576.308463][T18948] syzkaller0: entered allmulticast mode [ 576.350195][T18951] netlink: 132 bytes leftover after parsing attributes in process `syz.3.3296'. [ 576.398703][T18948] tipc: Resetting bearer [ 576.449971][T18813] hsr_slave_0: entered promiscuous mode [ 576.465278][T18813] hsr_slave_1: entered promiscuous mode [ 576.477551][T18813] debugfs: 'hsr0' already exists in 'hsr' [ 576.483514][T18813] Cannot create hsr debugfs directory [ 576.692607][T18962] netlink: 'syz.3.3301': attribute type 1 has an invalid length. [ 576.716327][T18962] netlink: 'syz.3.3301': attribute type 2 has an invalid length. [ 576.777834][T18966] : renamed from bond0 (while UP) [ 576.888182][T18969] netlink: 48 bytes leftover after parsing attributes in process `syz.3.3303'. [ 576.901293][T18945] tipc: Resetting bearer [ 576.995581][T18945] tipc: Disabling bearer [ 577.002293][T18976] netlink: 'syz.0.3305': attribute type 1 has an invalid length. [ 577.125136][T18976] bond0: entered promiscuous mode [ 577.131396][T18976] 8021q: adding VLAN 0 to HW filter on device bond0 [ 577.225188][T18983] netlink: 48 bytes leftover after parsing attributes in process `syz.1.3307'. [ 577.435593][T18813] netdevsim netdevsim2 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 577.446999][T18813] netdevsim netdevsim2 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 577.458678][T18813] netdevsim netdevsim2 eth3 (unregistering): unset [1, 1] type 2 family 0 port 20000 - 0 [ 577.475942][T18991] FAULT_INJECTION: forcing a failure. [ 577.475942][T18991] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 577.496318][T18991] CPU: 0 UID: 0 PID: 18991 Comm: syz.3.3311 Not tainted syzkaller #0 PREEMPT(full) [ 577.496348][T18991] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 577.496361][T18991] Call Trace: [ 577.496370][T18991] [ 577.496379][T18991] dump_stack_lvl+0xe8/0x150 [ 577.496411][T18991] should_fail_ex+0x412/0x560 [ 577.496446][T18991] _copy_from_iter+0x1d3/0x1670 [ 577.496510][T18991] ? rcu_is_watching+0x15/0xb0 [ 577.496553][T18991] ? __pfx__copy_from_iter+0x10/0x10 [ 577.496591][T18991] ? netlink_sendmsg+0x650/0xb40 [ 577.496614][T18991] ? skb_put+0x11b/0x210 [ 577.496690][T18991] netlink_sendmsg+0x6c0/0xb40 [ 577.496724][T18991] ? __pfx_netlink_sendmsg+0x10/0x10 [ 577.496753][T18991] ? aa_sock_msg_perm+0xf1/0x1b0 [ 577.496784][T18991] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 577.496816][T18991] ____sys_sendmsg+0x972/0x9f0 [ 577.496839][T18991] ? __might_fault+0xaf/0x130 [ 577.496882][T18991] ? __pfx_____sys_sendmsg+0x10/0x10 [ 577.496916][T18991] ? import_iovec+0x73/0xa0 [ 577.496952][T18991] ___sys_sendmsg+0x2a5/0x360 [ 577.496974][T18991] ? __lock_acquire+0x6b5/0x2cf0 [ 577.497002][T18991] ? __pfx____sys_sendmsg+0x10/0x10 [ 577.497066][T18991] ? __fget_files+0x2a/0x420 [ 577.497095][T18991] ? __fget_files+0x3a0/0x420 [ 577.497132][T18991] __x64_sys_sendmsg+0x1bd/0x2a0 [ 577.497159][T18991] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 577.497193][T18991] ? __pfx_ksys_write+0x10/0x10 [ 577.497235][T18991] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 577.497259][T18991] do_syscall_64+0x15f/0xf80 [ 577.497279][T18991] ? trace_irq_disable+0x3b/0x140 [ 577.497311][T18991] ? clear_bhb_loop+0x40/0x90 [ 577.497337][T18991] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 577.497359][T18991] RIP: 0033:0x7f510919ce59 [ 577.497379][T18991] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 577.497397][T18991] RSP: 002b:00007f510a116028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 577.497420][T18991] RAX: ffffffffffffffda RBX: 00007f5109415fa0 RCX: 00007f510919ce59 [ 577.497436][T18991] RDX: 0000000000000000 RSI: 0000200000000280 RDI: 0000000000000004 [ 577.497450][T18991] RBP: 00007f510a116090 R08: 0000000000000000 R09: 0000000000000000 [ 577.497463][T18991] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 577.497476][T18991] R13: 00007f5109416038 R14: 00007f5109415fa0 R15: 00007fff8fa55958 [ 577.497511][T18991] [ 577.800639][T18983] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3307'. [ 577.811404][T18989] mac80211_hwsim hwsim35 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 578.061738][T19003] netlink: set zone limit has 4 unknown bytes [ 578.103602][T19004] netlink: 20 bytes leftover after parsing attributes in process `syz.4.3316'. [ 578.127049][T18813] netdevsim netdevsim2 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 578.150282][T18813] netdevsim netdevsim2 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 578.164019][T18813] netdevsim netdevsim2 eth2 (unregistering): unset [1, 1] type 2 family 0 port 20000 - 0 [ 578.196596][ T5631] Bluetooth: hci1: command tx timeout [ 578.249550][T19003] bond1: Unable to set peer notification delay as MII monitoring is disabled [ 578.260739][T19003] bond1 (unregistering): Released all slaves [ 578.593410][T19026] FAULT_INJECTION: forcing a failure. [ 578.593410][T19026] name failslab, interval 1, probability 0, space 0, times 0 [ 578.626381][T18813] netdevsim netdevsim2 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 578.645788][T18813] netdevsim netdevsim2 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 578.658743][T19026] CPU: 1 UID: 0 PID: 19026 Comm: syz.1.3322 Not tainted syzkaller #0 PREEMPT(full) [ 578.658772][T19026] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 578.658786][T19026] Call Trace: [ 578.658794][T19026] [ 578.658804][T19026] dump_stack_lvl+0xe8/0x150 [ 578.658834][T19026] should_fail_ex+0x412/0x560 [ 578.658871][T19026] should_failslab+0xa8/0x100 [ 578.658904][T19026] ? skb_clone+0x212/0x3a0 [ 578.658929][T19026] kmem_cache_alloc_noprof+0x87/0x650 [ 578.658959][T19026] ? __netlink_lookup+0xc6/0x8b0 [ 578.658992][T19026] skb_clone+0x212/0x3a0 [ 578.659021][T19026] __netlink_deliver_tap+0x404/0x850 [ 578.659060][T19026] ? netlink_deliver_tap+0x2e/0x1b0 [ 578.659085][T19026] netlink_deliver_tap+0x19c/0x1b0 [ 578.659112][T19026] netlink_unicast+0x730/0x8e0 [ 578.659146][T19026] netlink_sendmsg+0x813/0xb40 [ 578.659182][T19026] ? __pfx_netlink_sendmsg+0x10/0x10 [ 578.659211][T19026] ? aa_sock_msg_perm+0xf1/0x1b0 [ 578.659249][T19026] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 578.659284][T19026] ____sys_sendmsg+0x972/0x9f0 [ 578.659307][T19026] ? __might_fault+0xaf/0x130 [ 578.659342][T19026] ? __pfx_____sys_sendmsg+0x10/0x10 [ 578.659376][T19026] ? import_iovec+0x73/0xa0 [ 578.659413][T19026] ___sys_sendmsg+0x2a5/0x360 [ 578.659436][T19026] ? __lock_acquire+0x6b5/0x2cf0 [ 578.659465][T19026] ? __pfx____sys_sendmsg+0x10/0x10 [ 578.659530][T19026] ? __fget_files+0x2a/0x420 [ 578.659555][T19026] ? __fget_files+0x3a0/0x420 [ 578.659594][T19026] __x64_sys_sendmsg+0x1bd/0x2a0 [ 578.659621][T19026] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 578.659660][T19026] ? __pfx_ksys_write+0x10/0x10 [ 578.659701][T19026] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 578.659725][T19026] do_syscall_64+0x15f/0xf80 [ 578.659747][T19026] ? trace_irq_disable+0x3b/0x140 [ 578.659779][T19026] ? clear_bhb_loop+0x40/0x90 [ 578.659806][T19026] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 578.659827][T19026] RIP: 0033:0x7f5802b9ce59 [ 578.659847][T19026] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 578.659866][T19026] RSP: 002b:00007f5803980028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 578.659889][T19026] RAX: ffffffffffffffda RBX: 00007f5802e15fa0 RCX: 00007f5802b9ce59 [ 578.659904][T19026] RDX: 0000000000000000 RSI: 0000200000000280 RDI: 0000000000000004 [ 578.659918][T19026] RBP: 00007f5803980090 R08: 0000000000000000 R09: 0000000000000000 [ 578.659931][T19026] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 578.659944][T19026] R13: 00007f5802e16038 R14: 00007f5802e15fa0 R15: 00007ffeaf791678 [ 578.659980][T19026] [ 578.931073][T18813] netdevsim netdevsim2 eth1 (unregistering): unset [1, 1] type 2 family 0 port 20000 - 0 [ 579.404706][T19043] IPVS: set_ctl: invalid protocol: 46 224.0.0.2:20002 [ 579.404988][T18813] netdevsim netdevsim2 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 579.481959][T18813] netdevsim netdevsim2 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 579.511107][T18813] netdevsim netdevsim2 eth0 (unregistering): unset [1, 1] type 2 family 0 port 20000 - 0 [ 579.547444][ C1] ip6_tunnel: syztnl0 xmit: Local address not yet configured! [ 579.631386][T18004] IPVS: starting estimator thread 0... [ 579.726217][T19053] IPVS: using max 24 ests per chain, 57600 per kthread [ 579.860521][T19039] lo speed is unknown, defaulting to 1000 [ 580.176664][T19067] netlink: 'syz.1.3333': attribute type 6 has an invalid length. [ 580.192936][T19067] netlink: 'syz.1.3333': attribute type 23 has an invalid length. [ 580.229749][T19067] IPv6: NLM_F_CREATE should be specified when creating new route [ 580.266504][ T5631] Bluetooth: hci1: command tx timeout [ 580.321056][T18813] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 580.343256][T18813] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 580.355358][T18813] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 580.394405][T18813] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 580.413618][T18813] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 580.435562][T18813] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 580.453557][T18813] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 580.475303][T18813] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 580.490105][T19071] netlink: 'syz.4.3334': attribute type 11 has an invalid length. [ 580.541057][T19039] lo speed is unknown, defaulting to 1000 [ 580.713581][T18813] 8021q: adding VLAN 0 to HW filter on device bond0 [ 580.742428][T18813] 8021q: adding VLAN 0 to HW filter on device team0 [ 580.764863][ T9398] bridge0: port 1(bridge_slave_0) entered blocking state [ 580.772110][ T9398] bridge0: port 1(bridge_slave_0) entered forwarding state [ 580.812732][ T9398] bridge0: port 2(bridge_slave_1) entered blocking state [ 580.819995][ T9398] bridge0: port 2(bridge_slave_1) entered forwarding state [ 581.105066][T19093] bond1: option min_links: invalid value (18446744073709551612) [ 581.113180][T19093] bond1: option min_links: allowed values 0 - 2147483647 [ 581.123814][T19093] bond1 (unregistering): Released all slaves [ 581.232847][T19095] syzkaller1: entered promiscuous mode [ 581.257957][T19095] syzkaller1: entered allmulticast mode [ 581.277773][T19093] openvswitch: netlink: Unexpected mask (mask=200240, allowed=10048) [ 581.553403][T19102] openvswitch: netlink: Flow actions attr not present in new flow. [ 582.684131][T19144] : renamed from bond0 (while UP) [ 582.727166][T19140] lo speed is unknown, defaulting to 1000 [ 582.991817][T18813] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 583.170551][T18813] veth0_vlan: entered promiscuous mode [ 583.198237][T18813] veth1_vlan: entered promiscuous mode [ 583.420331][T18813] veth0_macvtap: entered promiscuous mode [ 583.447831][T18813] veth1_macvtap: entered promiscuous mode [ 583.515890][T18813] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 583.582644][T18813] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 583.640227][ T9398] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 583.670011][ T9398] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 583.702446][ T9398] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 583.724769][ T9398] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 584.031900][ T9389] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 584.069391][ T9389] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 584.132438][T19140] lo speed is unknown, defaulting to 1000 [ 584.158321][ T7893] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 584.188467][ T7893] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 584.415588][T19164] netlink: 'syz.0.3355': attribute type 2 has an invalid length. [ 584.440803][T19164] netlink: 'syz.0.3355': attribute type 2 has an invalid length. [ 585.039677][T19186] netlink: 60 bytes leftover after parsing attributes in process `syz.0.3359'. [ 585.051816][T19186] unsupported nlmsg_type 40 [ 585.762847][ T5643] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 585.782409][ T5643] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 585.798119][ T5643] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 585.813391][ T5643] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 585.825102][ T5643] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 586.753185][T19233] veth0: entered promiscuous mode [ 586.771412][T19232] veth0: left promiscuous mode [ 586.936830][T19242] netlink: 'syz.2.3371': attribute type 1 has an invalid length. [ 587.102436][T19251] netlink: 104 bytes leftover after parsing attributes in process `syz.2.3371'. [ 587.349217][T19242] 8021q: adding VLAN 0 to HW filter on device bond1 [ 587.402006][T19242] bond0: (slave bond1): Enslaving as an active interface with an up link [ 587.739824][T19277] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3376'. [ 587.878034][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 587.903805][T19205] lo speed is unknown, defaulting to 1000 [ 587.932112][T19283] netlink: 40 bytes leftover after parsing attributes in process `syz.2.3378'. [ 587.946340][ T5643] Bluetooth: hci2: command tx timeout [ 589.035119][T19205] lo speed is unknown, defaulting to 1000 [ 589.620974][T19321] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 589.656840][T19318] netlink: 'syz.1.3384': attribute type 4 has an invalid length. [ 590.027413][ T5643] Bluetooth: hci2: command tx timeout [ 590.375556][T19344] bridge0: port 3(ipvlan2) entered blocking state [ 590.382779][T19344] bridge0: port 3(ipvlan2) entered disabled state [ 590.389906][T19344] ipvlan2: entered allmulticast mode [ 590.395480][T19344] bridge0: entered allmulticast mode [ 590.404063][T19344] ipvlan2: left allmulticast mode [ 590.409305][T19344] bridge0: left allmulticast mode [ 590.542105][T19205] bridge0: port 1(bridge_slave_0) entered blocking state [ 590.579266][T19205] bridge0: port 1(bridge_slave_0) entered disabled state [ 590.614910][T19205] bridge_slave_0: entered allmulticast mode [ 590.643296][T19205] bridge_slave_0: entered promiscuous mode [ 590.662304][T19205] bridge0: port 2(bridge_slave_1) entered blocking state [ 590.677317][T19205] bridge0: port 2(bridge_slave_1) entered disabled state [ 590.684791][T19205] bridge_slave_1: entered allmulticast mode [ 590.697429][T19205] bridge_slave_1: entered promiscuous mode [ 590.764244][T19205] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 590.799867][T19205] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 590.855929][T19205] team0: Port device team_slave_0 added [ 590.867083][T19205] team0: Port device team_slave_1 added [ 590.970769][T19205] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 590.978257][T19205] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 591.012358][T19205] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 591.030467][T19205] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 591.040859][T19205] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 591.074730][T19205] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 591.175801][T19205] hsr_slave_0: entered promiscuous mode [ 591.198005][T19205] hsr_slave_1: entered promiscuous mode [ 591.204685][T19205] debugfs: 'hsr0' already exists in 'hsr' [ 591.222731][T19205] Cannot create hsr debugfs directory [ 591.621937][T19205] netdevsim netdevsim4 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 591.634061][T19205] netdevsim netdevsim4 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 591.724010][T19205] netdevsim netdevsim4 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 591.738198][T19205] netdevsim netdevsim4 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 591.836631][T19205] netdevsim netdevsim4 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 591.848473][T19205] netdevsim netdevsim4 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 591.916792][T19205] netdevsim netdevsim4 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 591.947677][T19205] netdevsim netdevsim4 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 592.107466][ T5643] Bluetooth: hci2: command tx timeout [ 592.899979][T19331] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 592.932644][T19205] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 592.975129][T19205] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 593.022592][T19205] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 593.095240][T19205] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 593.140623][T19205] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 593.198897][T19205] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 593.207425][T19205] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 593.218968][T19205] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 593.413572][T19402] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3396'. [ 593.579675][T19419] netlink: 16 bytes leftover after parsing attributes in process `syz.0.3398'. [ 593.724540][T19205] 8021q: adding VLAN 0 to HW filter on device bond0 [ 593.755546][T19205] 8021q: adding VLAN 0 to HW filter on device team0 [ 593.773404][ T9389] bridge0: port 1(bridge_slave_0) entered blocking state [ 593.780660][ T9389] bridge0: port 1(bridge_slave_0) entered forwarding state [ 593.808934][ T9389] bridge0: port 2(bridge_slave_1) entered blocking state [ 593.816202][ T9389] bridge0: port 2(bridge_slave_1) entered forwarding state [ 594.187097][ T5643] Bluetooth: hci2: command tx timeout [ 594.301460][T19445] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3403'. [ 595.168594][T19487] netlink: 14 bytes leftover after parsing attributes in process `syz.2.3412'. [ 595.415194][T19205] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 595.679626][T19499] ipip0: entered allmulticast mode [ 596.044982][T19518] netlink: 'syz.1.3422': attribute type 1 has an invalid length. [ 596.279405][T19528] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3426'. [ 596.290183][T19528] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3426'. [ 596.302510][T19205] veth0_vlan: entered promiscuous mode [ 596.347773][T19205] veth1_vlan: entered promiscuous mode [ 596.483034][T19205] veth0_macvtap: entered promiscuous mode [ 596.527720][T19205] veth1_macvtap: entered promiscuous mode [ 596.623015][T19205] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 596.654424][T19205] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 596.686196][ T7890] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 596.710345][ T7890] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 596.736883][ T7890] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 596.761489][ T7890] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 596.964701][T19547] netlink: 20 bytes leftover after parsing attributes in process `syz.1.3430'. [ 597.006678][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 597.022362][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 597.097572][ T7889] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 597.127560][ T7889] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 597.245491][T19553] netlink: 'syz.0.3432': attribute type 1 has an invalid length. [ 597.261944][T19550] netlink: 'syz.2.3431': attribute type 1 has an invalid length. [ 597.399334][T19553] 8021q: adding VLAN 0 to HW filter on device bond4 [ 597.464833][T19559] bond4: option tlb_dynamic_lb: unable to set because the bond device is up [ 597.496617][T19564] netlink: 76 bytes leftover after parsing attributes in process `syz.3.3434'. [ 597.507510][T19562] gretap0: entered promiscuous mode [ 597.924734][T19579] netlink: 'syz.1.3438': attribute type 13 has an invalid length. [ 597.937360][T19566] lo speed is unknown, defaulting to 1000 [ 598.476374][T19586] netlink: 56 bytes leftover after parsing attributes in process `syz.2.3439'. [ 598.556589][ T30] audit: type=1804 audit(1779467323.720:12): pid=19586 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.2.3439" name="/newroot/21/cgroup.controllers" dev="tmpfs" ino=126 res=1 errno=0 [ 598.625391][T19589] openvswitch: netlink: Message has 4 unknown bytes. [ 598.643264][ T30] audit: type=1800 audit(1779467323.720:13): pid=19586 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.3439" name="cgroup.controllers" dev="tmpfs" ino=126 res=0 errno=0 [ 598.852354][T19600] netlink: 332 bytes leftover after parsing attributes in process `syz.1.3445'. [ 598.864374][T19600] netlink: 'syz.1.3445': attribute type 9 has an invalid length. [ 598.874810][T19600] netlink: 108 bytes leftover after parsing attributes in process `syz.1.3445'. [ 598.893514][T19600] netlink: 32 bytes leftover after parsing attributes in process `syz.1.3445'. [ 598.930940][T19605] openvswitch: netlink: Unexpected mask (mask=5000040, allowed=1010048) [ 598.968649][T19608] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3446'. [ 599.133665][T19611] syzkaller0: entered promiscuous mode [ 599.140855][T19611] syzkaller0: entered allmulticast mode [ 599.286947][T19568] lo speed is unknown, defaulting to 1000 [ 599.286976][T19566] lo speed is unknown, defaulting to 1000 [ 599.298591][T19617] netlink: 76 bytes leftover after parsing attributes in process `syz.4.3447'. [ 599.332815][T19611] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3447'. [ 599.355138][T19611] ip_vti0: Master is either lo or non-ether device [ 599.495468][T19621] netlink: 'syz.2.3450': attribute type 2 has an invalid length. [ 599.504467][T19621] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3450'. [ 599.713398][T19629] netlink: 212348 bytes leftover after parsing attributes in process `syz.4.3454'. [ 599.760394][T19629] openvswitch: netlink: Message has 3 unknown bytes. [ 599.806940][T19637] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci2/hci2:200/input10 [ 599.882217][T19631] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3454'. [ 600.292582][T19655] netlink: 'syz.0.3455': attribute type 83 has an invalid length. [ 600.738146][T19568] lo speed is unknown, defaulting to 1000 [ 600.855073][T19663] openvswitch: netlink: Flow actions attr not present in new flow. [ 601.602670][T19675] sctp: [Deprecated]: syz.0.3462 (pid 19675) Use of struct sctp_assoc_value in delayed_ack socket option. [ 601.602670][T19675] Use struct sctp_sack_info instead [ 601.627645][T19675] sctp: [Deprecated]: syz.0.3462 (pid 19675) Use of struct sctp_assoc_value in delayed_ack socket option. [ 601.627645][T19675] Use struct sctp_sack_info instead [ 603.157803][T19708] Bluetooth: MGMT ver 1.23 [ 603.615429][T19706] lo speed is unknown, defaulting to 1000 [ 603.866941][ C0] ip6_tunnel: ip6tnl3 xmit: Local address not yet configured! [ 603.931209][T19726] netlink: 'syz.4.3477': attribute type 61 has an invalid length. [ 604.164321][T19728] __nla_validate_parse: 7 callbacks suppressed [ 604.165071][T19728] netlink: 52 bytes leftover after parsing attributes in process `syz.4.3478'. [ 604.214842][T19728] netlink: 36 bytes leftover after parsing attributes in process `syz.4.3478'. [ 604.244655][T19728] hsr_slave_0: entered allmulticast mode [ 604.288538][T19728] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3478'. [ 604.482910][T19731] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3479'. [ 604.806337][T19740] netlink: 68 bytes leftover after parsing attributes in process `syz.4.3479'. [ 604.984231][T19740] veth3: entered allmulticast mode [ 605.059311][T19736] hsr_slave_1 (unregistering): left promiscuous mode [ 605.215707][T19706] lo speed is unknown, defaulting to 1000 [ 605.381303][T19745] syzkaller0: entered promiscuous mode [ 605.388082][T19745] syzkaller0: entered allmulticast mode [ 605.484627][T19754] netlink: 'syz.1.3483': attribute type 1 has an invalid length. [ 608.640730][T19754] workqueue: Failed to create a rescuer kthread for wq "bond0": -EINTR [ 608.795753][T19759] netlink: 'syz.4.3484': attribute type 1 has an invalid length. [ 608.822652][T19759] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3484'. [ 608.835345][T19759] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3484'. [ 608.986730][ C0] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 612.181755][T19785] netlink: 'syz.4.3489': attribute type 7 has an invalid length. [ 612.209841][T19785] netlink: 'syz.4.3489': attribute type 8 has an invalid length. [ 612.817602][T19790] bond5: option min_links: invalid value (18446744073709551612) [ 612.853513][T19790] bond5: option min_links: allowed values 0 - 2147483647 [ 612.879704][T19790] bond5 (unregistering): Released all slaves [ 614.222032][T19826] pim6reg1: entered promiscuous mode [ 614.235232][T19826] pim6reg1: entered allmulticast mode [ 614.528060][T19832] netlink: 'syz.2.3501': attribute type 1 has an invalid length. [ 614.734460][T19835] syzkaller0: entered promiscuous mode [ 614.755718][T19835] syzkaller0: entered allmulticast mode [ 614.790282][T19838] syzkaller0: entered promiscuous mode [ 614.805588][T19838] syzkaller0: entered allmulticast mode [ 615.087282][T19850] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3505'. [ 615.102635][T19854] syzkaller0: entered promiscuous mode [ 615.130700][T19854] syzkaller0: entered allmulticast mode [ 615.231118][T19857] netlink: 'syz.3.3505': attribute type 10 has an invalid length. [ 615.267836][T19857] netlink: 40 bytes leftover after parsing attributes in process `syz.3.3505'. [ 615.282878][T19856] bridge3: port 1(dummy0) entered blocking state [ 615.290229][T19856] bridge3: port 1(dummy0) entered disabled state [ 615.298928][T19856] dummy0: entered allmulticast mode [ 615.310459][T19856] dummy0: entered promiscuous mode [ 615.415636][T19857] bridge3: port 1(dummy0) entered blocking state [ 615.422241][T19857] bridge3: port 1(dummy0) entered forwarding state [ 615.462947][T19857] dummy0: left allmulticast mode [ 615.470045][T19861] netlink: 'syz.2.3508': attribute type 1 has an invalid length. [ 615.481911][T19857] bridge3: port 1(dummy0) entered disabled state [ 615.558271][T19861] 8021q: adding VLAN 0 to HW filter on device bond3 [ 615.574231][T19860] bond3: (slave veth0_to_bond): making interface the new active one [ 615.588025][T19860] bond3: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 615.607777][T19866] netlink: 'syz.4.3510': attribute type 10 has an invalid length. [ 615.638575][T19861] bond3: entered promiscuous mode [ 615.645326][T19866] netlink: 40 bytes leftover after parsing attributes in process `syz.4.3510'. [ 615.665880][T19861] veth0_to_bond: entered promiscuous mode [ 615.691324][T19861] bond3: entered allmulticast mode [ 615.722178][T19861] veth0_to_bond: entered allmulticast mode [ 615.754780][T19866] team0: Failed to send options change via netlink (err -105) [ 615.764227][T19866] team0: Port device geneve1 added [ 616.066749][T19876] A link change request failed with some changes committed already. Interface vlan0 may have been left with an inconsistent configuration, please check. [ 616.313648][T19884] syzkaller1: entered promiscuous mode [ 616.328933][T19884] syzkaller1: entered allmulticast mode [ 616.512563][T19891] netlink: 212408 bytes leftover after parsing attributes in process `syz.3.3514'. [ 616.735237][T19901] netlink: 16402 bytes leftover after parsing attributes in process `syz.0.3516'. [ 617.302555][T19924] xt_CT: No such helper "snmp" [ 617.859737][T19942] syzkaller1: entered promiscuous mode [ 617.887801][T19942] syzkaller1: entered allmulticast mode [ 618.023605][T19942] sch_tbf: burst 0 is lower than device tunl0 mtu (1480) ! [ 618.268315][T19962] bridge1: the hash_elasticity option has been deprecated and is always 16 [ 618.375495][T19966] netdevsim netdevsim3: loading /lib/firmware/. failed with error -22 [ 618.433533][T19966] netdevsim netdevsim3: Direct firmware load for . failed with error -22 [ 618.471061][T19966] netdevsim netdevsim3: Falling back to sysfs fallback for: . [ 618.551365][T19973] pim6reg: entered allmulticast mode [ 618.636747][T19979] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3532'. [ 618.718365][T19982] netlink: 'syz.0.3533': attribute type 2 has an invalid length. [ 618.743333][T19982] netlink: 14 bytes leftover after parsing attributes in process `syz.0.3533'. [ 618.807871][T19976] pim6reg: left allmulticast mode [ 619.199889][T20003] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 619.851352][T20022] netlink: 'syz.3.3542': attribute type 1 has an invalid length. [ 620.001489][T20028] rdma_op ffff8880a87b41f0 conn xmit_rdma 0000000000000000 [ 620.054385][T20029] bond1: (slave veth3): Enslaving as an active interface with a down link [ 620.162972][T20029] netlink: 28 bytes leftover after parsing attributes in process `syz.3.3542'. [ 620.355371][T20022] bond1: (slave veth5): Enslaving as an active interface with a down link [ 620.495779][T20029] 8021q: adding VLAN 0 to HW filter on device bond1 [ 620.969827][T20058] netlink: 76 bytes leftover after parsing attributes in process `syz.0.3551'. [ 621.011348][T20058] syzkaller0: entered promiscuous mode [ 621.033067][T20058] syzkaller0: entered allmulticast mode [ 621.072316][T20058] netlink: 28 bytes leftover after parsing attributes in process `syz.0.3551'. [ 621.102864][T20065] netlink: 'syz.3.3554': attribute type 4 has an invalid length. [ 621.112039][T20058] netlink: 28 bytes leftover after parsing attributes in process `syz.0.3551'. [ 621.121920][T20058] tc action pedit offset must be on 32 bit boundaries [ 621.121999][T20058] tc action pedit offset must be on 32 bit boundaries [ 621.122014][T20058] tc action pedit offset must be on 32 bit boundaries [ 621.122027][T20058] tc action pedit offset must be on 32 bit boundaries [ 621.122039][T20058] tc action pedit offset must be on 32 bit boundaries [ 621.122053][T20058] tc action pedit offset must be on 32 bit boundaries [ 621.122067][T20058] tc action pedit offset must be on 32 bit boundaries [ 621.122080][T20058] tc action pedit offset must be on 32 bit boundaries [ 621.122094][T20058] tc action pedit offset must be on 32 bit boundaries [ 621.122107][T20058] tc action pedit offset must be on 32 bit boundaries [ 621.122136][T20058] 0: reclassify loop, rule prio 0, protocol 800 [ 621.206946][T20066] netlink: 'syz.1.3553': attribute type 2 has an invalid length. [ 621.279644][T20067] netlink: 'syz.3.3554': attribute type 4 has an invalid length. [ 621.309863][T20064] netlink: 'syz.3.3554': attribute type 4 has an invalid length. [ 621.324090][T20070] netlink: 'syz.2.3555': attribute type 1 has an invalid length. [ 621.371910][T20070] 8021q: adding VLAN 0 to HW filter on device bond4 [ 621.389133][T20070] netlink: 'syz.2.3555': attribute type 1 has an invalid length. [ 621.690365][T20076] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3558'. [ 621.715910][T20076] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3558'. [ 621.937481][T20089] netlink: 'syz.0.3560': attribute type 32 has an invalid length. [ 621.949861][T20089] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3560'. [ 622.041395][T20089] bond5: option coupled_control: invalid value (7) [ 622.199191][T20089] bond5 (unregistering): Released all slaves [ 622.732441][T20117] netlink: 'syz.0.3570': attribute type 13 has an invalid length. [ 622.842889][T20108] netlink: 264 bytes leftover after parsing attributes in process `syz.1.3567'. [ 622.859452][T20124] IPVS: rr: FWM 3 0x00000003 - no destination available [ 622.883014][T18006] IPVS: starting estimator thread 0... [ 622.986318][T20130] IPVS: using max 24 ests per chain, 57600 per kthread [ 623.034671][T20117] hsr0: left promiscuous mode [ 623.234959][T20140] batadv_slave_0: Caught tx_queue_len zero misconfig [ 623.243553][ T7890] bond1: (slave ip6gretap1): link status up again after 0 ms [ 623.274436][T20140] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3576'. [ 623.302698][T20140] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3576'. [ 623.318126][ T7890] bond1: (slave ip6gretap1): link status up again after 0 ms [ 623.356265][ T93] bond1: (slave ip6gretap1): link status up again after 0 ms [ 623.401162][ T9389] netdevsim netdevsim1 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 623.417053][ T7890] bond1: (slave ip6gretap1): link status up again after 0 ms [ 623.431248][ T9389] netdevsim netdevsim1 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 623.456495][ T7890] bond1: (slave ip6gretap1): link status up again after 0 ms [ 623.467163][ T9389] netdevsim netdevsim1 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 623.496878][ T9389] bond1: (slave ip6gretap1): link status up again after 0 ms [ 623.498530][ T93] netdevsim netdevsim1 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 623.527813][ T9389] bond1: (slave ip6gretap1): link status up again after 0 ms [ 623.575096][ T9389] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 623.630362][T20152] IPVS: set_ctl: invalid protocol: 59 172.20.20.60:20001 [ 624.649417][T20158] bridge0: port 2(bridge_slave_1) entered disabled state [ 624.657296][T20158] bridge0: port 1(bridge_slave_0) entered disabled state [ 624.986724][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 625.132906][T20189] validate_nla: 2 callbacks suppressed [ 625.133087][T20189] netlink: 'syz.4.3589': attribute type 3 has an invalid length. [ 625.675106][T20158] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 625.752177][T20158] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 626.709788][ T7889] bridge_slave_1: left promiscuous mode [ 626.719426][ T7889] bridge0: port 2(bridge_slave_1) entered disabled state [ 626.777525][ T7889] ip6tnl0: left allmulticast mode [ 626.782704][ T7889] dvmrp2: left allmulticast mode [ 627.203830][ T7889] bond6 (unregistering): (slave erspan2): Releasing backup interface [ 627.296641][ T7889] bond3 (unregistering): (slave gretap3): Releasing active interface [ 627.442032][ T7889] bond3 (unregistering): (slave bridge5): Releasing active interface [ 627.477552][ T7889]  (unregistering): (slave bond_slave_0): Releasing backup interface [ 627.489904][ T7889] bond_slave_0: left promiscuous mode [ 627.501037][ T7889]  (unregistering): Released all slaves [ 627.519587][ T7889] bond0 (unregistering): Released all slaves [ 627.538590][ T7889] bond1 (unregistering): Released all slaves [ 627.560161][ T7889] bond2 (unregistering): Released all slaves [ 627.584754][ T7889] bond3 (unregistering): Released all slaves [ 627.602833][ T7889] bond4 (unregistering): Released all slaves [ 627.625928][ T7889] bond5 (unregistering): Released all slaves [ 627.653657][ T7889] bond6 (unregistering): Released all slaves [ 627.674727][ T7889] bond7 (unregistering): Released all slaves [ 627.705346][ T7889] bond8 (unregistering): Released all slaves [ 627.740221][ T7890] netdevsim netdevsim1 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 627.767847][ T7890] netdevsim netdevsim1 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 627.782177][ T7890] netdevsim netdevsim1 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 627.824974][ T7890] netdevsim netdevsim1 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 627.900082][ T12] net_ratelimit: 2 callbacks suppressed [ 627.900102][ T12] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 627.990154][ T7890] netdevsim netdevsim1 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 627.996761][T20202] __nla_validate_parse: 2 callbacks suppressed [ 627.996815][T20202] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3592'. [ 628.042477][ T7890] netdevsim netdevsim1 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 628.069182][T20202] netlink: 64138 bytes leftover after parsing attributes in process `syz.2.3592'. [ 628.083549][ T7890] netdevsim netdevsim1 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 628.156345][ T7890] netdevsim netdevsim1 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 628.189736][ T7890] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 628.250172][ T7889] tipc: Disabling bearer [ 628.272631][ T7889] tipc: Left network mode [ 628.304895][T20218] netlink: 'syz.3.3595': attribute type 12 has an invalid length. [ 628.508136][ T93] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 628.551735][T20228] netlink: 'syz.2.3597': attribute type 2 has an invalid length. [ 628.758536][ T7893] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 629.044132][T20244] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3602'. [ 629.116271][ T9394] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 629.464451][ T9401] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 629.685786][T20263] lo speed is unknown, defaulting to 1000 [ 629.697814][ T9401] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 629.837400][T20274] netlink: 'syz.2.3610': attribute type 4 has an invalid length. [ 629.876698][ T7893] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 630.034018][ T7893] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 630.152043][T20284] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3614'. [ 630.253489][T20284] veth5: entered allmulticast mode [ 630.309809][T20284] bond0: (slave veth5): Enslaving as an active interface with an up link [ 630.409372][T20293] bond0 (unregistering): (slave veth5): Releasing backup interface [ 630.425669][T20302] netlink: 56 bytes leftover after parsing attributes in process `syz.4.3619'. [ 630.449298][T20293] bond0 (unregistering): Released all slaves [ 630.497753][T20265] lo speed is unknown, defaulting to 1000 [ 630.517828][ T9394] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 630.594709][T20305] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3620'. [ 630.639697][T20305] hsr_slave_0: left promiscuous mode [ 630.649329][T20305] hsr_slave_1: left promiscuous mode [ 631.038798][T20322] netlink: 14 bytes leftover after parsing attributes in process `syz.2.3624'. [ 631.161835][T20324] nbd6: detected capacity change from 0 to 127 [ 631.321154][T20324] ip6gretap0: entered promiscuous mode [ 631.364058][T20265] lo speed is unknown, defaulting to 1000 [ 631.440102][ T5643] block nbd6: Receive control failed (result -104) [ 631.884299][T20365] netlink: 'syz.3.3631': attribute type 13 has an invalid length. [ 631.950892][ T5740] IPVS: starting estimator thread 0... [ 632.067432][T20368] IPVS: using max 32 ests per chain, 76800 per kthread [ 632.118355][T20263] lo speed is unknown, defaulting to 1000 [ 632.166334][T20339] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 632.455678][T20377] netlink: 72 bytes leftover after parsing attributes in process `syz.3.3632'. [ 632.640130][T20381] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3634'. [ 632.668846][T20384] SET target dimension over the limit! [ 632.993455][T20388] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3637'. [ 633.074974][T20394] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3638'. [ 633.132621][ T5643] block nbd7: Receive control failed (result -1) [ 633.307460][ T13] net_ratelimit: 19 callbacks suppressed [ 633.307483][ T13] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 633.381487][T20401] netlink: 'syz.4.3639': attribute type 29 has an invalid length. [ 633.476238][ T13] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 633.616767][ T13] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 633.726881][ T9394] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 633.765176][T20411] netlink: 'syz.1.3642': attribute type 13 has an invalid length. [ 634.156917][T20334] smbdirect: ib_dev[syz1]: added: RNIC max_fast_reg_page_list_len=256 device_cap_flags=0x200000 kernel_cap_flags=0x10 page_size_cap=0x1000 [ 634.230881][T20334] smbdirect: ib_dev[syz1]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=1 max_cqe=3276800 max_qp_wr=32768 max_send_sge=6 max_recv_sge=6 [ 634.286450][T20334] smbdirect: ib_dev[syz1]PORT[1]: iwarp=1 ib=0 roce=0 v1=0 v2=0 core_cap_flags=0x400008 [ 634.311152][T20418] 5nè: entered promiscuous mode [ 634.389336][T20334] iwpm_register_pid: Unable to send a nlmsg (client = 2) [ 634.512799][ T4960] block nbd6: Connection timed out, retrying (0/1 alive) [ 634.525383][ T4960] block nbd6: Connection timed out, retrying (0/1 alive) [ 634.534740][ T4960] block nbd6: Connection timed out, retrying (0/1 alive) [ 634.542755][ T4960] block nbd6: Connection timed out, retrying (0/1 alive) [ 634.551448][ T12] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 634.561266][ T4960] block nbd6: Dead connection, failed to find a fallback [ 634.574591][ T4960] block nbd6: shutting down sockets [ 634.580558][ T4960] blk_print_req_error: 19 callbacks suppressed [ 634.580579][ T4960] I/O error, dev nbd6, sector 6 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 634.605719][ T4960] buffer_io_error: 19 callbacks suppressed [ 634.605737][ T4960] Buffer I/O error on dev nbd6, logical block 3, async page read [ 634.620847][ T4960] I/O error, dev nbd6, sector 4 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 634.632876][ T4960] Buffer I/O error on dev nbd6, logical block 2, async page read [ 634.640920][ T4960] I/O error, dev nbd6, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 634.650097][ T4960] Buffer I/O error on dev nbd6, logical block 1, async page read [ 634.658743][ T4960] I/O error, dev nbd6, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 634.668247][ T4960] Buffer I/O error on dev nbd6, logical block 0, async page read [ 634.680389][T20240] I/O error, dev nbd6, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 634.691369][T20240] Buffer I/O error on dev nbd6, logical block 0, async page read [ 634.701414][T20240] I/O error, dev nbd6, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 634.711881][T20240] Buffer I/O error on dev nbd6, logical block 1, async page read [ 634.720647][T20240] I/O error, dev nbd6, sector 4 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 634.729795][T20240] Buffer I/O error on dev nbd6, logical block 2, async page read [ 634.740385][T20240] I/O error, dev nbd6, sector 6 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 634.750845][T20240] Buffer I/O error on dev nbd6, logical block 3, async page read [ 634.759019][T20240] I/O error, dev nbd6, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 634.768273][T20240] Buffer I/O error on dev nbd6, logical block 0, async page read [ 634.776253][T20240] I/O error, dev nbd6, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 634.787071][T20240] Buffer I/O error on dev nbd6, logical block 1, async page read [ 634.798672][T20240] ldm_validate_partition_table(): Disk read failed. [ 634.814823][T20334] infiniband syz1: RDMA CMA: cma_listen_on_dev, error -98 [ 634.830758][T20240] Dev nbd6: unable to read RDB block 0 [ 634.869002][T20240] nbd6: unable to read partition table [ 634.924301][T20240] ldm_validate_partition_table(): Disk read failed. [ 634.955494][T20240] Dev nbd6: unable to read RDB block 0 [ 635.002013][T20240] nbd6: unable to read partition table [ 635.108874][T20418] 5nè‹Ò: entered promiscuous mode [ 635.116560][ T9389] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 635.308103][ T9389] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 635.426771][ T9389] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 635.568488][ T3398] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 635.640414][T20435] SET target dimension over the limit! [ 635.795565][T20446] netlink: 'syz.2.3647': attribute type 3 has an invalid length. [ 635.872350][ T93] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 636.154619][T20456] netlink: 'syz.4.3651': attribute type 1 has an invalid length. [ 636.340942][T20467] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3652'. [ 636.404201][T18008] IPVS: starting estimator thread 0... [ 636.498086][T20469] IPVS: using max 24 ests per chain, 57600 per kthread [ 636.665251][T20456] bond1: entered promiscuous mode [ 636.721721][T20456] bond1: entered allmulticast mode [ 636.767429][T20456] 8021q: adding VLAN 0 to HW filter on device bond1 [ 636.940193][T20462] erspan1: entered allmulticast mode [ 637.087421][T20462] bond1: (slave erspan1): making interface the new active one [ 637.120920][T20462] erspan1: entered promiscuous mode [ 637.161573][T20462] bond1: (slave erspan1): Enslaving as an active interface with an up link [ 637.411279][ T7889] [ 637.413676][ T7889] ====================================================== [ 637.420735][ T7889] WARNING: possible circular locking dependency detected [ 637.427816][ T7889] syzkaller #0 Not tainted [ 637.432278][ T7889] ------------------------------------------------------ [ 637.439343][ T7889] kworker/u8:11/7889 is trying to acquire lock: [ 637.445621][ T7889] ffff88801be8d210 (&root->kernfs_iattr_rwsem){++++}-{4:4}, at: kernfs_unlink_sibling+0x71/0x180 [ 637.456340][ T7889] [ 637.456340][ T7889] but task is already holding lock: [ 637.464148][ T7889] ffff88801be8d180 (&root->kernfs_rwsem){++++}-{4:4}, at: kernfs_rename_ns+0x76/0x830 [ 637.473781][ T7889] [ 637.473781][ T7889] which lock already depends on the new lock. [ 637.473781][ T7889] [ 637.484307][ T7889] [ 637.484307][ T7889] the existing dependency chain (in reverse order) is: [ 637.493351][ T7889] [ 637.493351][ T7889] -> #10 (&root->kernfs_rwsem){++++}-{4:4}: [ 637.501529][ T7889] down_write+0x96/0x200 [ 637.506368][ T7889] kernfs_add_one+0x41/0x5c0 [ 637.511501][ T7889] kernfs_create_dir_ns+0xde/0x130 [ 637.517163][ T7889] internal_create_group+0x425/0x1180 [ 637.523117][ T7889] cpuhp_invoke_callback+0x445/0x860 [ 637.528969][ T7889] cpuhp_issue_call+0x430/0x7a0 [ 637.534371][ T7889] __cpuhp_setup_state_cpuslocked+0x3d9/0x6b0 [ 637.540997][ T7889] __cpuhp_setup_state+0x3f/0x60 [ 637.546481][ T7889] do_one_initcall+0x250/0x870 [ 637.551926][ T7889] do_initcall_level+0x104/0x190 [ 637.557564][ T7889] do_initcalls+0x59/0xa0 [ 637.562441][ T7889] kernel_init_freeable+0x2a6/0x3e0 [ 637.568194][ T7889] kernel_init+0x1d/0x1d0 [ 637.573087][ T7889] ret_from_fork+0x514/0xb70 [ 637.578254][ T7889] ret_from_fork_asm+0x1a/0x30 [ 637.583573][ T7889] [ 637.583573][ T7889] -> #9 (cpuhp_state_mutex){+.+.}-{4:4}: [ 637.591417][ T7889] [ 637.591417][ T7889] -> #8 (cpu_hotplug_lock){++++}-{0:0}: [ 637.599180][ T7889] cpus_read_lock+0x42/0x160 [ 637.604501][ T7889] static_key_slow_inc+0x12/0x30 [ 637.610023][ T7889] ipv6_flowlabel_opt+0x1b94/0x29c0 [ 637.615847][ T7889] do_ipv6_setsockopt+0xd9f/0x3150 [ 637.621576][ T7889] ipv6_setsockopt+0x59/0x170 [ 637.626896][ T7889] do_sock_setsockopt+0x17c/0x1b0 [ 637.632469][ T7889] __x64_sys_setsockopt+0x13d/0x1b0 [ 637.638212][ T7889] do_syscall_64+0x15f/0xf80 [ 637.643353][ T7889] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 637.649796][ T7889] [ 637.649796][ T7889] -> #7 (sk_lock-AF_INET6){+.+.}-{0:0}: [ 637.657558][ T7889] lock_sock_nested+0x41/0x100 [ 637.662871][ T7889] inet_shutdown+0x6a/0x390 [ 637.668033][ T7889] nbd_mark_nsock_dead+0x2e9/0x560 [ 637.673842][ T7889] recv_work+0x1c2e/0x1d40 [ 637.678811][ T7889] process_scheduled_works+0xb5d/0x1860 [ 637.685107][ T7889] worker_thread+0xa53/0xfc0 [ 637.690334][ T7889] kthread+0x389/0x470 [ 637.694961][ T7889] ret_from_fork+0x514/0xb70 [ 637.700092][ T7889] ret_from_fork_asm+0x1a/0x30 [ 637.705412][ T7889] [ 637.705412][ T7889] -> #6 (&nsock->tx_lock){+.+.}-{4:4}: [ 637.713099][ T7889] __mutex_lock+0x1a3/0x1550 [ 637.718241][ T7889] nbd_queue_rq+0x37b/0x1100 [ 637.723395][ T7889] blk_mq_dispatch_rq_list+0xa70/0x1910 [ 637.729603][ T7889] __blk_mq_sched_dispatch_requests+0xdcc/0x1600 [ 637.736508][ T7889] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 637.743038][ T7889] blk_mq_run_hw_queue+0x348/0x4f0 [ 637.748706][ T7889] blk_mq_dispatch_list+0xd16/0xe10 [ 637.754464][ T7889] blk_mq_flush_plug_list+0x48d/0x570 [ 637.760392][ T7889] __blk_flush_plug+0x3ed/0x4d0 [ 637.765880][ T7889] __submit_bio+0x28d/0x580 [ 637.770933][ T7889] submit_bio_noacct_nocheck+0x2f4/0xa40 [ 637.777133][ T7889] block_read_full_folio+0x7b7/0x830 [ 637.782985][ T7889] filemap_read_folio+0x137/0x3b0 [ 637.788584][ T7889] do_read_cache_folio+0x358/0x590 [ 637.794255][ T7889] read_part_sector+0xb6/0x2b0 [ 637.799630][ T7889] adfspart_check_ICS+0xb1/0x960 [ 637.805110][ T7889] bdev_disk_changed+0x817/0x1770 [ 637.810699][ T7889] blkdev_get_whole+0x380/0x510 [ 637.816154][ T7889] bdev_open+0x31e/0xd30 [ 637.820993][ T7889] blkdev_open+0x470/0x610 [ 637.825961][ T7889] do_dentry_open+0x785/0x14e0 [ 637.831281][ T7889] vfs_open+0x3b/0x340 [ 637.835899][ T7889] path_openat+0x2e08/0x3860 [ 637.841048][ T7889] do_file_open+0x23e/0x4a0 [ 637.846107][ T7889] do_sys_openat2+0x113/0x200 [ 637.851330][ T7889] __x64_sys_openat+0x138/0x170 [ 637.856725][ T7889] do_syscall_64+0x15f/0xf80 [ 637.861863][ T7889] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 637.868308][ T7889] [ 637.868308][ T7889] -> #5 (&cmd->lock){+.+.}-{4:4}: [ 637.875567][ T7889] __mutex_lock+0x1a3/0x1550 [ 637.880709][ T7889] nbd_queue_rq+0xc6/0x1100 [ 637.885758][ T7889] blk_mq_dispatch_rq_list+0xa70/0x1910 [ 637.891865][ T7889] __blk_mq_sched_dispatch_requests+0xdcc/0x1600 [ 637.898819][ T7889] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 637.905339][ T7889] blk_mq_run_hw_queue+0x348/0x4f0 [ 637.911008][ T7889] blk_mq_dispatch_list+0xd16/0xe10 [ 637.916769][ T7889] blk_mq_flush_plug_list+0x48d/0x570 [ 637.922711][ T7889] __blk_flush_plug+0x3ed/0x4d0 [ 637.928120][ T7889] __submit_bio+0x28d/0x580 [ 637.933162][ T7889] submit_bio_noacct_nocheck+0x2f4/0xa40 [ 637.939350][ T7889] block_read_full_folio+0x7b7/0x830 [ 637.945178][ T7889] filemap_read_folio+0x137/0x3b0 [ 637.950756][ T7889] do_read_cache_folio+0x358/0x590 [ 637.956423][ T7889] read_part_sector+0xb6/0x2b0 [ 637.961741][ T7889] adfspart_check_ICS+0xb1/0x960 [ 637.967226][ T7889] bdev_disk_changed+0x817/0x1770 [ 637.972812][ T7889] blkdev_get_whole+0x380/0x510 [ 637.978203][ T7889] bdev_open+0x31e/0xd30 [ 637.983001][ T7889] blkdev_open+0x470/0x610 [ 637.987959][ T7889] do_dentry_open+0x785/0x14e0 [ 637.993269][ T7889] vfs_open+0x3b/0x340 [ 637.997881][ T7889] path_openat+0x2e08/0x3860 [ 638.003023][ T7889] do_file_open+0x23e/0x4a0 [ 638.008166][ T7889] do_sys_openat2+0x113/0x200 [ 638.013394][ T7889] __x64_sys_openat+0x138/0x170 [ 638.018803][ T7889] do_syscall_64+0x15f/0xf80 [ 638.023954][ T7889] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 638.030390][ T7889] [ 638.030390][ T7889] -> #4 (set->srcu){.+.+}-{0:0}: [ 638.037552][ T7889] __synchronize_srcu+0xca/0x300 [ 638.043040][ T7889] elevator_switch+0x1e8/0x7a0 [ 638.048354][ T7889] elevator_change+0x2cc/0x450 [ 638.053670][ T7889] elevator_set_default+0x36c/0x430 [ 638.059423][ T7889] blk_register_queue+0x3e9/0x4e0 [ 638.064994][ T7889] __add_disk+0x677/0xd50 [ 638.069870][ T7889] add_disk_fwnode+0xfb/0x480 [ 638.075095][ T7889] nbd_dev_add+0x72c/0xb50 [ 638.080063][ T7889] nbd_init+0x168/0x1f0 [ 638.084874][ T7889] do_one_initcall+0x250/0x870 [ 638.090191][ T7889] do_initcall_level+0x104/0x190 [ 638.096124][ T7889] do_initcalls+0x59/0xa0 [ 638.101008][ T7889] kernel_init_freeable+0x2a6/0x3e0 [ 638.106749][ T7889] kernel_init+0x1d/0x1d0 [ 638.111631][ T7889] ret_from_fork+0x514/0xb70 [ 638.116777][ T7889] ret_from_fork_asm+0x1a/0x30 [ 638.122106][ T7889] [ 638.122106][ T7889] -> #3 (&q->elevator_lock){+.+.}-{4:4}: [ 638.129962][ T7889] __mutex_lock+0x1a3/0x1550 [ 638.135107][ T7889] elevator_change+0x1b3/0x450 [ 638.140428][ T7889] elevator_set_none+0xb5/0x140 [ 638.145832][ T7889] blk_mq_update_nr_hw_queues+0x5e7/0x1a60 [ 638.152190][ T7889] nbd_start_device+0x17f/0xb10 [ 638.157584][ T7889] nbd_genl_connect+0x165b/0x1cf0 [ 638.163155][ T7889] genl_family_rcv_msg_doit+0x22a/0x330 [ 638.169250][ T7889] genl_rcv_msg+0x61c/0x7a0 [ 638.174308][ T7889] netlink_rcv_skb+0x232/0x4b0 [ 638.179613][ T7889] genl_rcv+0x28/0x40 [ 638.184149][ T7889] netlink_unicast+0x75c/0x8e0 [ 638.189459][ T7889] netlink_sendmsg+0x813/0xb40 [ 638.194773][ T7889] ____sys_sendmsg+0x972/0x9f0 [ 638.200088][ T7889] ___sys_sendmsg+0x2a5/0x360 [ 638.205306][ T7889] __x64_sys_sendmsg+0x1bd/0x2a0 [ 638.210787][ T7889] do_syscall_64+0x15f/0xf80 [ 638.215921][ T7889] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 638.222364][ T7889] [ 638.222364][ T7889] -> #2 (&q->q_usage_counter(io)#49){++++}-{0:0}: [ 638.231083][ T7889] blk_alloc_queue+0x546/0x680 [ 638.236407][ T7889] __blk_mq_alloc_disk+0x197/0x390 [ 638.242062][ T7889] nbd_dev_add+0x499/0xb50 [ 638.247020][ T7889] nbd_init+0x168/0x1f0 [ 638.251722][ T7889] do_one_initcall+0x250/0x870 [ 638.257032][ T7889] do_initcall_level+0x104/0x190 [ 638.262523][ T7889] do_initcalls+0x59/0xa0 [ 638.267401][ T7889] kernel_init_freeable+0x2a6/0x3e0 [ 638.273151][ T7889] kernel_init+0x1d/0x1d0 [ 638.278034][ T7889] ret_from_fork+0x514/0xb70 [ 638.283279][ T7889] ret_from_fork_asm+0x1a/0x30 [ 638.288607][ T7889] [ 638.288607][ T7889] -> #1 (fs_reclaim){+.+.}-{0:0}: [ 638.295852][ T7889] fs_reclaim_acquire+0x71/0x100 [ 638.301351][ T7889] kmem_cache_alloc_noprof+0x40/0x650 [ 638.307288][ T7889] __kernfs_iattrs+0xdf/0x320 [ 638.312523][ T7889] kernfs_iop_setattr+0xea/0x3f0 [ 638.318019][ T7889] notify_change+0xc1a/0xf40 [ 638.323161][ T7889] do_truncate+0x1c2/0x250 [ 638.328139][ T7889] path_openat+0x2f89/0x3860 [ 638.333290][ T7889] do_file_open+0x23e/0x4a0 [ 638.338344][ T7889] do_sys_openat2+0x113/0x200 [ 638.343559][ T7889] __x64_sys_openat+0x138/0x170 [ 638.348949][ T7889] do_syscall_64+0x15f/0xf80 [ 638.354084][ T7889] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 638.360510][ T7889] [ 638.360510][ T7889] -> #0 (&root->kernfs_iattr_rwsem){++++}-{4:4}: [ 638.369045][ T7889] __lock_acquire+0x15a5/0x2cf0 [ 638.374443][ T7889] lock_acquire+0x106/0x350 [ 638.379482][ T7889] down_write+0x96/0x200 [ 638.384259][ T7889] kernfs_unlink_sibling+0x71/0x180 [ 638.389999][ T7889] kernfs_rename_ns+0x4a6/0x830 [ 638.395399][ T7889] sysfs_rename_link_ns+0x16e/0x1b0 [ 638.401137][ T7889] device_rename+0x110/0x210 [ 638.406358][ T7889] __dev_change_net_namespace+0x15d3/0x20a0 [ 638.412809][ T7889] cfg802154_switch_netns+0xbf/0x3d0 [ 638.418717][ T7889] cfg802154_pernet_exit+0x75/0xe0 [ 638.424380][ T7889] ops_undo_list+0x49f/0x940 [ 638.429516][ T7889] cleanup_net+0x56b/0x800 [ 638.434481][ T7889] process_scheduled_works+0xb5d/0x1860 [ 638.440578][ T7889] worker_thread+0xa53/0xfc0 [ 638.445721][ T7889] kthread+0x389/0x470 [ 638.450342][ T7889] ret_from_fork+0x514/0xb70 [ 638.455493][ T7889] ret_from_fork_asm+0x1a/0x30 [ 638.460798][ T7889] [ 638.460798][ T7889] other info that might help us debug this: [ 638.460798][ T7889] [ 638.471044][ T7889] Chain exists of: [ 638.471044][ T7889] &root->kernfs_iattr_rwsem --> cpuhp_state_mutex --> &root->kernfs_rwsem [ 638.471044][ T7889] [ 638.485649][ T7889] Possible unsafe locking scenario: [ 638.485649][ T7889] [ 638.493175][ T7889] CPU0 CPU1 [ 638.498601][ T7889] ---- ---- [ 638.504019][ T7889] lock(&root->kernfs_rwsem); [ 638.508814][ T7889] lock(cpuhp_state_mutex); [ 638.515939][ T7889] lock(&root->kernfs_rwsem); [ 638.523245][ T7889] lock(&root->kernfs_iattr_rwsem); [ 638.528558][ T7889] [ 638.528558][ T7889] *** DEADLOCK *** [ 638.528558][ T7889] [ 638.536714][ T7889] 5 locks held by kworker/u8:11/7889: [ 638.542106][ T7889] #0: ffff88801be8e140 ((wq_completion)netns){+.+.}-{0:0}, at: process_scheduled_works+0xa35/0x1860 [ 638.553074][ T7889] #1: ffffc9000560fc40 (net_cleanup_work){+.+.}-{0:0}, at: process_scheduled_works+0xa70/0x1860 [ 638.563623][ T7889] #2: ffffffff8fdc36e8 (pernet_ops_rwsem){++++}-{4:4}, at: cleanup_net+0xf4/0x800 [ 638.572956][ T7889] #3: ffffffff8fdd2400 (rtnl_mutex){+.+.}-{4:4}, at: cfg802154_pernet_exit+0x19/0xe0 [ 638.582559][ T7889] #4: ffff88801be8d180 (&root->kernfs_rwsem){++++}-{4:4}, at: kernfs_rename_ns+0x76/0x830 [ 638.592681][ T7889] [ 638.592681][ T7889] stack backtrace: [ 638.598585][ T7889] CPU: 0 UID: 0 PID: 7889 Comm: kworker/u8:11 Not tainted syzkaller #0 PREEMPT(full) [ 638.598606][ T7889] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 638.598618][ T7889] Workqueue: netns cleanup_net [ 638.598636][ T7889] Call Trace: [ 638.598645][ T7889] [ 638.598655][ T7889] dump_stack_lvl+0xe8/0x150 [ 638.598675][ T7889] print_circular_bug+0x2e1/0x300 [ 638.598700][ T7889] check_noncircular+0x12e/0x150 [ 638.598726][ T7889] __lock_acquire+0x15a5/0x2cf0 [ 638.598748][ T7889] ? __lock_acquire+0x6b5/0x2cf0 [ 638.598768][ T7889] ? __lock_acquire+0x6b5/0x2cf0 [ 638.598788][ T7889] ? kernfs_unlink_sibling+0x71/0x180 [ 638.598814][ T7889] lock_acquire+0x106/0x350 [ 638.598831][ T7889] ? kernfs_unlink_sibling+0x71/0x180 [ 638.598864][ T7889] down_write+0x96/0x200 [ 638.598883][ T7889] ? kernfs_unlink_sibling+0x71/0x180 [ 638.598908][ T7889] ? __pfx_down_write+0x10/0x10 [ 638.598926][ T7889] ? kernfs_root+0x1c/0x230 [ 638.598947][ T7889] ? kernfs_root+0x1c/0x230 [ 638.598967][ T7889] ? kernfs_root+0x1c/0x230 [ 638.598988][ T7889] ? kernfs_root+0x1ea/0x230 [ 638.599010][ T7889] kernfs_unlink_sibling+0x71/0x180 [ 638.599038][ T7889] kernfs_rename_ns+0x4a6/0x830 [ 638.599068][ T7889] sysfs_rename_link_ns+0x16e/0x1b0 [ 638.599092][ T7889] device_rename+0x110/0x210 [ 638.599116][ T7889] __dev_change_net_namespace+0x15d3/0x20a0 [ 638.599149][ T7889] ? __pfx___dev_change_net_namespace+0x10/0x10 [ 638.599174][ T7889] ? trace_irq_disable+0x3b/0x140 [ 638.599204][ T7889] ? do_raw_spin_lock+0x12b/0x2f0 [ 638.599237][ T7889] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 638.599262][ T7889] ? lockdep_hardirqs_on+0x7a/0x110 [ 638.599279][ T7889] ? __mutex_lock+0xef8/0x1550 [ 638.599298][ T7889] ? __mutex_lock+0x608/0x1550 [ 638.599318][ T7889] ? __pfx___mutex_lock+0x10/0x10 [ 638.599338][ T7889] ? __pfx_netdev_run_todo+0x10/0x10 [ 638.599359][ T7889] cfg802154_switch_netns+0xbf/0x3d0 [ 638.599383][ T7889] cfg802154_pernet_exit+0x75/0xe0 [ 638.599406][ T7889] ops_undo_list+0x49f/0x940 [ 638.599423][ T7889] ? __pfx_ops_undo_list+0x10/0x10 [ 638.599445][ T7889] ? idr_destroy+0x218/0x290 [ 638.599526][ T7889] ? do_raw_spin_unlock+0xf5/0x210 [ 638.599553][ T7889] cleanup_net+0x56b/0x800 [ 638.599569][ T7889] ? __pfx_cleanup_net+0x10/0x10 [ 638.599587][ T7889] ? process_scheduled_works+0xa70/0x1860 [ 638.599604][ T7889] ? process_scheduled_works+0xa70/0x1860 [ 638.599622][ T7889] process_scheduled_works+0xb5d/0x1860 [ 638.599653][ T7889] ? __pfx_process_scheduled_works+0x10/0x10 [ 638.599673][ T7889] ? assign_work+0x3d5/0x5e0 [ 638.599691][ T7889] worker_thread+0xa53/0xfc0 [ 638.599721][ T7889] kthread+0x389/0x470 [ 638.599742][ T7889] ? __pfx_worker_thread+0x10/0x10 [ 638.599759][ T7889] ? __pfx_kthread+0x10/0x10 [ 638.599781][ T7889] ret_from_fork+0x514/0xb70 [ 638.599801][ T7889] ? __pfx_ret_from_fork+0x10/0x10 [ 638.599818][ T7889] ? __switch_to+0xc79/0x1410 [ 638.599844][ T7889] ? __pfx_kthread+0x10/0x10 [ 638.599866][ T7889] ret_from_fork_asm+0x1a/0x30 [ 638.599894][ T7889] [ 638.935115][ T7889] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 638.945084][ T7889] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 638.998449][ T7889] batman_adv: batadv0: Interface deactivated: ipvlan2 [ 639.006587][ T7889] batman_adv: batadv0: Removing interface: ipvlan2 [ 639.043592][ T7889] veth1_macvtap: left promiscuous mode [ 639.049560][ T7889] veth0_macvtap: left promiscuous mode [ 639.055208][ T7889] veth1_vlan: left promiscuous mode [ 639.061628][ T7889] veth0_vlan: left promiscuous mode [ 639.479941][ T12] net_ratelimit: 3 callbacks suppressed [ 639.479963][ T12] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 639.635089][ T9398] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 639.724924][ T7889] IPVS: stop unused estimator thread 0... [ 639.746241][ T12] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 639.866607][ T9394] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 639.977184][ T9394] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 640.086370][ T9398] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 640.206451][ T9398] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 640.316457][ T9394] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 640.426687][ T9394] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 640.536988][ T9394] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 644.516262][ T7889] net_ratelimit: 35 callbacks suppressed [ 644.516321][ T7889] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 644.636258][ T9401] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 644.748234][ T9398] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 644.866318][ T12] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 644.976365][ T9398] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 645.086567][ T13] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 645.196849][ T9398] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 645.306913][ T9398] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 645.416369][ T13] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 645.527338][ T9398] bond1: (slave ip6gretap1): failed to get link speed/duplex