last executing test programs: 5.326147074s ago: executing program 2 (id=6797): r0 = socket$netlink(0x10, 0x3, 0x10) r1 = socket(0x28, 0x5, 0x0) connect$vsock_stream(r1, &(0x7f0000000080), 0x10) sendmmsg(r1, &(0x7f0000000480)=[{{0x0, 0x0, 0x0}}], 0x1, 0x24008094) r2 = socket$l2tp(0x2, 0x2, 0x73) connect$inet(r2, &(0x7f0000000200)={0x2, 0xce20, @remote}, 0x10) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000400)="580000001400192340834b80040d8c560a063fbc45ff6205000000000700580003480400945f640094272d7061d328b92d0900000000008000f0fffeffe809000000ffd9dd000000100001000b0808004149224e06040800", 0x58}], 0x1) accept4(r0, 0x0, &(0x7f0000000040), 0x80800) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000200)="d8000000210081044e81f782db44b9040200000000806c0100001500100014000000001209000d2000000401a80018000a000e4006000000036010fab94dcf5c0468c1d67f6f94007134cf6ee062e1c547cbc7225e6756cfb39b0590b4800089e408e8d8ef52b49816277cf4090000001fb791643a5ee4ce1b14d6d930dfe1d9db22fe7c9f8775730d16a4683f1aeb4edbb57a5025ccca9e00360db701000000eafad95667e006dcdf969b3ef35ce3bb9ad809d561cace81ed0bffece0b42a9ecbee5de6ccd40dd6e4edef3d939acd92637429397f632838", 0xd8}], 0x1}, 0x0) 5.166790163s ago: executing program 4 (id=6800): r0 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r0, &(0x7f0000000380)={0x0, 0x4076cbba9945d516, &(0x7f0000000340)={0x0, 0x14}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x53, &(0x7f0000000000)={0x0, 0x0}, 0x10) sendmmsg$unix(r1, &(0x7f0000008280)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000ac0)=[@rights={{0x14, 0x1, 0x1, [r2]}}], 0x18, 0x8001}}], 0x2, 0x80) r3 = accept4$packet(r0, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000001c0)=0x14, 0x800) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000004c0)={'gretap0\x00', &(0x7f00000003c0)={'gretap0\x00', 0x0, 0x7, 0x265219dc6d30c048, 0x1, 0x9, {{0x30, 0x4, 0x0, 0x1, 0xc0, 0x6, 0x0, 0x9, 0x4, 0x0, @local, @multicast2, {[@timestamp_prespec={0x44, 0x14, 0xef, 0x3, 0xd, [{@remote, 0x7fff}, {@initdev={0xac, 0x1e, 0x0, 0x0}, 0x10001}]}, @noop, @ra={0x94, 0x4}, @noop, @cipso={0x86, 0x31, 0xffffffffffffffff, [{0x7, 0xd, "fb68edc13d00f6bc57be96"}, {0x6, 0x2}, {0x5, 0x2}, {0x7, 0x4, '\rY'}, {0x0, 0x3, 'q'}, {0x2, 0x4, "1757"}, {0x1, 0xf, "b56e6ccbd4a4f40d943bd422d0"}]}, @generic={0x7, 0xc, "36f9d0202e6cb02855c7"}, @end, @cipso={0x86, 0x1e, 0x3, [{0x1, 0xa, "ca0cb0725f9b00ba"}, {0x6, 0xe, "c07a32503ddb7b0bf12a638d"}]}, @timestamp_addr={0x44, 0x34, 0x80, 0x1, 0x7, [{@remote, 0x4c74}, {@dev={0xac, 0x14, 0x14, 0x16}, 0x2}, {@rand_addr=0x64010102, 0x765}, {@loopback, 0x6}, {@remote, 0x8001}, {@multicast1, 0x2}]}]}}}}}) sendto$packet(r3, &(0x7f0000000240)="f24a7fc99ae841feae355900727a112514ce9c48272e7255cc36e50f7b86b9fbe0da9402ca1e2aec7f9f6b0bb7bd2d7155467a3af57dd0a90a2a3e1043d0c9d715cab8", 0x43, 0x4090, &(0x7f0000000500)={0x11, 0x1c, r4, 0x1, 0x4, 0x6, @local}, 0x14) getsockname$packet(r0, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a) getsockopt$WPAN_WANTACK(r0, 0x0, 0x0, &(0x7f0000000000), &(0x7f00000000c0)=0x4) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_DELETE(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="580000000202010800000000000000000a0000004400028006000340000000000c0002d905000100000000002c00018014000300fe88000000000000000000001a000001090004"], 0x58}}, 0x0) 5.08480112s ago: executing program 2 (id=6801): socket$inet_udp(0x2, 0x2, 0x0) socket(0x400000000010, 0x3, 0x0) socket$netlink(0x10, 0x3, 0x9) socket$kcm(0x10, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="9feb01001800000000000000180000001800000004000000020000000100000c02000000000000000000000d0000000000005f"], 0x0, 0x34}, 0x28) r0 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r0, 0x84, 0x24, 0x0, 0x0) socket(0x10, 0x3, 0x0) socketpair(0x1, 0x20000000000001, 0x0, &(0x7f0000000100)) socket$inet_mptcp(0x2, 0x1, 0x106) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000040)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a68000000060a0b160000000000000000020000083c00048018000180080001006f7366000c000280080001400000000420000180080001006475700014000280080002250000001408000140000000160900010073797a30000000000900020073797a320000000014000000110001"], 0x90}, 0x1, 0x0, 0x0, 0x850}, 0x4040080) socket$packet(0x11, 0x2, 0x300) r2 = socket(0xa, 0x2, 0x0) sendto$inet6(r2, &(0x7f0000000280)="85bb95b6bf069cdb90e3896ee4fe7ab8d85d7b6b3a9a2108d2d30ba6aea87e6d9716a4fceef16a2c0293f58b1d27d3b1ac768f20eace2d7ed6b0131f4b1b8b6a44b250711d5377c26da20f5dadf484e98eead09427d69a022a668f245fb7d17d55194a32b548f54f1a2570a762a911263ccac8c1876e1f944e7de432f23ea52f84c507c6097a54b063dce88f17867d4d6efccf26c0e2ebead0a62a68fa3fbbc2943ea7cfbc52ff2d4f8549b8b81487d4a1e526717a2af1bd954a38132236f0f1ca5f778a5f606acf8e89cb26316c8c34679ed587", 0xd4, 0x4000014, 0x0, 0x0) socket$rds(0x15, 0x5, 0x0) sendmsg$RDMA_NLDEV_CMD_PORT_GET(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={0x0}, 0x1, 0x0, 0x0, 0x10028050}, 0x1) bind$inet6(r2, &(0x7f0000000000)={0xa, 0x0, 0xc, @empty, 0x7}, 0x1c) r3 = socket(0x2d, 0x2, 0x0) bind$inet(r3, &(0x7f0000000080)={0x2d, 0x4e24, @rand_addr=0x64010100}, 0x10) r4 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_NO_ENOBUFS(r4, 0x10e, 0xc, &(0x7f0000000040)=0x7f, 0x4) sendmsg$nl_route(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="240000001a0001000000ff7f0000000080000000", @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\b\x00', @ANYRES32=r4], 0x24}}, 0x0) 4.811643531s ago: executing program 2 (id=6803): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_STATS_CPU(r0, &(0x7f0000000340)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x14, 0x4, 0x1, 0x401, 0x0, 0x0, {0x5, 0x0, 0x8}, ["", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x40040}, 0x80) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x2, 0x0, 0xa}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x40, 0x3, 0xa, 0x401, 0x0, 0x0, {0x2, 0x0, 0xa}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz0\x00'}, @NFTA_CHAIN_HOOK={0x14, 0x4, 0x0, 0x1, [@NFTA_HOOK_HOOKNUM={0x8, 0x1, 0x1, 0x0, 0x3}, @NFTA_HOOK_PRIORITY={0x8}]}]}, @NFT_MSG_NEWRULE={0x6c, 0x6, 0xa, 0x401, 0x0, 0x0, {0x2, 0x0, 0xa}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_RULE_EXPRESSIONS={0x40, 0x4, 0x0, 0x1, [{0x20, 0x1, 0x0, 0x1, @ct={{0x7}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_CT_DREG={0x8, 0x1, 0x1, 0x0, 0x1}, @NFTA_CT_KEY={0x8}]}}}, {0x1c, 0x1, 0x0, 0x1, @queue={{0xa}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_QUEUE_NUM={0x6}]}}}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0xf4}}, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)={0x38, 0x2, 0x3, 0x101, 0x0, 0x0, {0x2}, [@NFQA_CFG_CMD={0x8, 0x1, {0x1, 0x0, 0x2}}, @NFQA_CFG_PARAMS={0x9, 0x2, {0x0, 0x2}}, @NFQA_CFG_MASK={0x8, 0x4, 0x1, 0x0, 0x2}, @NFQA_CFG_FLAGS={0x8, 0x5, 0x1, 0x0, 0x2}]}, 0x38}}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000300)=ANY=[@ANYBLOB="9feb01001800000000000000200000002000000004000000020000000100000c02000000000000000100000d00000000000000000000000000005f"], 0x0, 0x3c, 0x0, 0x0, 0x3}, 0x28) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000004c0)=ANY=[@ANYBLOB="18000000000000000000000001000000950000000000000089e77f8ebcaddbfc4a227578d1cb976ecc68c344d8ff40ff622e0468de3e8635b575a60c2f52f68a3d09ae0786d54b8566432a45477d69e5253bd7789fc72a4a0a98dffafe6f807759dad9dd8a388bd108b1a1193dfad8076886fe0696fae3d18be4f67b3c32efec1fa3716b5081948eaa4462801032f5629435a871d5f4ed206bc04fb1cfebcaa01f15abc5266dfe125c3159992515f536b9c9108988abdea6df3dbb4d8a8998bdd76dea"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, r3, 0x8, &(0x7f00000000c0)={0x0, 0x1}, 0x1}, 0x90) sendto$inet(r2, &(0x7f0000000200)="11223344", 0x4, 0x0, &(0x7f0000000300)={0x2, 0x4d2, @remote}, 0x10) 4.72117785s ago: executing program 4 (id=6804): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), r1) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="01000000200000001c0012000c000100626f6e64000000000c0002000800010006"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$nl_sock_diag(0x10, 0x3, 0x4) ioctl$sock_SIOCSIFVLAN_SET_VLAN_NAME_TYPE_CMD(r4, 0x8983, &(0x7f0000001a80)={0x6, 'bond_slave_0\x00', {0x2}, 0xf76}) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r4, 0x8983, &(0x7f0000000000)={0x0, 'veth0_vlan\x00', {0x1}, 0x7}) r5 = socket$netlink(0x10, 0x3, 0x0) r6 = socket(0x10, 0x803, 0x4) sendmsg$IPVS_CMD_SET_INFO(r6, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r6, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x66) sendmsg$nl_route(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000001440)=ANY=[@ANYBLOB="5000000010001fff000000008000000000000000", @ANYRES32=0x0, @ANYBLOB="00030000057e010008000a00", @ANYRES32=r7, @ANYBLOB="28001280090001007665746800000000580002801400010000000000", @ANYRES32=0x0, @ANYBLOB="0040000040060000"], 0x50}, 0x1, 0x0, 0x0, 0x2000c0c1}, 0x0) sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000480)=ANY=[@ANYBLOB="3c0000001000030400"/20, @ANYRES32=0x0, @ANYBLOB="a4280400000000001400350076657468305f746f5f626f6e6400000008000a00", @ANYRES32=r2], 0x3c}, 0x1, 0x0, 0x0, 0x4008800}, 0x8000) sendmsg$nl_route(r0, &(0x7f0000000c80)={0x0, 0x0, &(0x7f0000000c40)={&(0x7f00000000c0)=@setlink={0x2c, 0x13, 0x5, 0xb, 0x0, {0x0, 0x0, 0x0, r2, 0x312, 0x800}, [@IFLA_ADDRESS={0xa, 0x1, @remote}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40000}, 0x42) 4.661864477s ago: executing program 2 (id=6805): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="c40000001900674c2cbd70000000000000000000000000000000000000000000ac1eff0100000000000000000000000000000000000000000a00000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0100000000000000000000000000000000000020000000000000000000000000000000000000000000008000000000000000000000000000fcffffffffffffff0000000000000000b0ac00000000000000000000000000000000000000000000000400000000000000000002000000000a00100001"], 0xc4}}, 0x4c050) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) socket$kcm(0x29, 0x2, 0x0) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=@updpolicy={0xfc, 0x19, 0x1, 0x0, 0x0, {{@in6=@rand_addr=' \x01\x00', @in=@local, 0x0, 0x5, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0xa9, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0xa00, 0x40800000000000, 0x800000000000000}}, [@tmpl={0x44, 0x5, [{{@in=@dev={0xac, 0x14, 0x14, 0x40}, 0x0, 0x3c}, 0x0, @in=@broadcast, 0x0, 0x0, 0x3}]}]}, 0xfc}}, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r3 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000000280)={'syzkaller1\x00', @link_local}) write$tun(r1, &(0x7f0000000080)=ANY=[@ANYBLOB="034886dd010000000000140000006000000003082f00fe88a43de1a400000000000000007d01ff020000000000000000000000000012"], 0xfdef) 4.188835989s ago: executing program 1 (id=6809): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0xa, 0x5, 0x2, 0x4}, 0x10) close(r0) r1 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r1, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x310000, 0x1000, 0x4, 0x3}, 0x20) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000004c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'sit0\x00', 0x0}) setsockopt$XDP_TX_RING(r1, 0x11b, 0x3, &(0x7f00000001c0)=0x2, 0x4) bind$xdp(r1, &(0x7f0000000200)={0x2c, 0x1, r3, 0x25, r1}, 0x10) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0xc, &(0x7f0000000180)=@framed={{}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, &(0x7f0000000b80)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0xa, 0x5, 0x2, 0x4}, 0x10) (async) close(r0) (async) socket$xdp(0x2c, 0x3, 0x0) (async) setsockopt$XDP_UMEM_REG(r1, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x310000, 0x1000, 0x4, 0x3}, 0x20) (async) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000004c0)) (async) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'sit0\x00'}) (async) setsockopt$XDP_TX_RING(r1, 0x11b, 0x3, &(0x7f00000001c0)=0x2, 0x4) (async) bind$xdp(r1, &(0x7f0000000200)={0x2c, 0x1, r3, 0x25, r1}, 0x10) (async) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) (async) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0xc, &(0x7f0000000180)=@framed={{}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, &(0x7f0000000b80)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) (async) 4.169541235s ago: executing program 2 (id=6810): r0 = socket$inet_smc(0x2b, 0x1, 0x0) ioctl$int_in(r0, 0x5421, &(0x7f0000000100)=0x100000001) setsockopt$inet_tcp_int(r0, 0x6, 0x1e, &(0x7f0000000180)=0x1, 0x4) connect$inet(r0, &(0x7f0000000480)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0xff}}, 0x10) r1 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r2) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$IOCTL_GET_NCIDEV_IDX(r1, 0x0, &(0x7f00000000c0)=0x0) sendmsg$NFC_CMD_DEV_UP(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000d80)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r3, @ANYBLOB="010426bd7000f8dbdf250200000008000100", @ANYRES32=r5], 0x1c}}, 0x4008054) r6 = socket(0x1e, 0x5, 0x0) listen(r6, 0x0) accept4$nfc_llcp(r6, 0x0, 0x0, 0x0) r7 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000140)={'syz_tun\x00', 0x0}) r9 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000780)={0x6, 0x4, &(0x7f00000006c0)=ANY=[@ANYBLOB="18020000000000000000000000000000850000001700000095"], &(0x7f00000005c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x8}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000180)={r9, r8, 0x25, 0x0, @void}, 0x10) syz_emit_ethernet(0x19, &(0x7f0000000340)={@remote, @empty, @val={@val={0x88a8, 0x0, 0x0, 0x1}, {0x8100, 0x6, 0x0, 0x3}}, {@x25={0x805, {0x1, 0x7, 0xfd}}}}, 0x0) r10 = socket$nl_route(0x10, 0x3, 0x0) r11 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r11, 0x8933, &(0x7f0000000040)={'wlan0\x00', 0x0}) sendmsg$nl_route(r10, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="3800000010000305000020000000000000000000", @ANYRES32=0x0, @ANYBLOB="115a0100000000bcd600128008000100687372000c00028008000100", @ANYRES32=r12, @ANYBLOB], 0x38}}, 0x44) bpf$TOKEN_CREATE(0x24, &(0x7f0000000000)={0x0, r4}, 0x8) bpf$PROG_LOAD(0x5, &(0x7f0000000580)={0x0, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x22, '\x00', 0x0, @fallback=0x33, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r13 = bpf$MAP_CREATE(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="0b00000005000000000400000900000001"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0xd, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18000000000000000000000000000000850000006d"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r14 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000d80)={0x18, 0x5, &(0x7f0000000480)=ANY=[@ANYBLOB="1801000021"], 0x0, 0x40, 0x0, 0x0, 0x0, 0xb4a02fe0ce239f93, '\x00', 0x0, 0x2}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xf, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000800000000000000000000018110000", @ANYRES32=r13], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x59, '\x00', 0x0, @fallback=0x2a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, r14, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={r14, 0x2000000, 0xe, 0x0, &(0x7f0000000040)="610b008646630a74907031320f86", 0x0, 0xcf22, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x80}, 0x50) 3.686431108s ago: executing program 1 (id=6814): socket$netlink(0x10, 0x3, 0x0) r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000340)={&(0x7f00000000c0)={0x2, 0x1, 0x0, 0x3, 0x8, 0x0, 0x0, 0x0, [@sadb_address={0x2, 0x6, 0x0, 0x0, 0x0, @in={0x2, 0x0, @local}}, @sadb_address={0x3, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x4e22, 0x80000000, @empty, 0x2}}]}, 0x40}, 0x1, 0x7}, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000700)={0x0, 0x10, &(0x7f0000000580)=ANY=[@ANYBLOB="18050000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r0, @ANYBLOB="0000000000000000b704000001000000850000007800000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x14, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000007c0)={0x6, 0x10, &(0x7f0000000580)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1c, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = socket(0x28, 0x5, 0x0) setsockopt$sock_int(r4, 0x1, 0x22, &(0x7f00000000c0)=0xb, 0x4) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000500)={r3, 0x5, 0xe, 0x0, &(0x7f0000000380)="2eb33d2ab87cded491717916deb4", 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x18, 0x4, &(0x7f0000000080)=ANY=[@ANYBLOB="18000000000000000000000000000000711221000000000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x5, '\x00', 0x0, 0x24}, 0x94) r6 = socket$inet(0x2, 0x4, 0x100) write(r6, &(0x7f0000000200)="d3e4875b9e08904afe9efa5a7132d92b98ef3a9c81bafe2c5f2f404f4be7b0294c95d9dec40773b0a4b6c6f88a5fd17dbb262ed1332922145cc62f1278cfd0f917ad0efefdb10057d3dee754596336b5f91e32ec56750ff2c630b3f3fcde04810181421848d0c3e833e992c9374796831b09126794430865a60033c27c2ff09cc2c27e91e42470f0168cb147e19a", 0x8e) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r7, 0x0) r8 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000900)={0x1b, 0x0, 0x0, 0x3, 0x0, r0, 0x1, '\x00', 0x0, 0xffffffffffffffff, 0x2, 0x5, 0x3}, 0x50) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000a00)=@bpf_tracing={0x1a, 0x9, &(0x7f00000003c0)=@raw=[@exit, @tail_call={{0x18, 0x2, 0x1, 0x0, r7}}, @map_idx_val={0x18, 0xa, 0x6, 0x0, 0x1, 0x0, 0x0, 0x0, 0xfc}, @jmp={0x5, 0x0, 0x2, 0xa, 0x0, 0x40, 0xffffffffffffffff}], &(0x7f0000000440)='syzkaller\x00', 0x71103513, 0xfa, &(0x7f0000000600)=""/250, 0x41100, 0x61, '\x00', 0x0, 0x18, r6, 0x8, &(0x7f0000000880)={0x4, 0x3}, 0x8, 0x10, &(0x7f00000008c0)={0x4, 0xf, 0xe80000, 0x7f}, 0x10, 0x8301, r2, 0x2, &(0x7f0000000980)=[r0, r0, r8], &(0x7f00000009c0)=[{0x1, 0x1, 0xb, 0xb}, {0x1, 0x1, 0xf, 0xb}], 0x10, 0x40}, 0x94) r9 = openat$cgroup_procs(r5, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) r10 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r10, 0x84, 0x1c, 0x0, &(0x7f0000000080)) r11 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x8, &(0x7f00000026c0)=ANY=[@ANYBLOB="620af8ff0c200021bfa100000000000007010000f8ffffffb702000003000000bd1200000000000085000000d0000000b70000000000000095000000000000003fba6a7d36d9b18ed812a2e2c49e8020a6f4e0e4a9446ca2b5f1cc1a100a9af698393aa0f3881f9c24aa56f15199fad0093c59d66b5ece9f36c70d0f010c5077da80fb982c1e9400c603146cea484a415b76966118b64f751a0f241b072e90080008002d75593a280000c93e64c227c95aa0b784625704f07a72c2918451ebdcf4cef7f9606056fe5c34665c0af9360a1f7a5e6b607130c89f18c0c1089d8b85880000c29c48b45ef4adf634be763288d01aa27ae8b09e13e79ab20b0b8ed8fb7a68af2ad0000000000000006f803c6468082089b302d7bff8f06f7f918d65eae391cb41336023cdcedb5e0125ebbccbddcf10cb2364149215108355ee570f8078be5cab389cd65e7133719acd97cfa107d40224edc5465a932b77e74e712a0d42bc6099ad23000000803a90bce6dc3a13871765df961c2ed3b1006ef6c1ff0900000000000010c63a949e8b7955394ffa82b8e942c89112f40cab87b1586602d985430cea0162ab3fcf4591c926abfb076719237c8d0e60b0eea24492a660583eecdbf5bcd3de3a83209da17a0faf60fd6ad9b97aa5fa68480366c9c6fd6fa5043aa3926b81e3b59c9f081d6a08000000ea2b1a52496dfcaf99431412fd13f4cec49669e443dcb924cfe5f3185418d60532be9c4d2ec7c32f2095e63c8cdc28f74d043ef8dba2f23b01a9ae44cf945b7632f32030916f89c6dad7603f2ba2a790d62d6faec2fed44da4928b30142bdda5e6c5d50b83bae616b5054d1e7c13b1355d6f4a8245eaa4997da9c77af40000000000000005f58351d599e9b61e8caab9c70764b0a8a7583c90b3433b809bdb9fbd48bc873495cbff8a41326eea31ae4e0f75057df3c9d13330ca006bce1a84521f14518c9b476fccbd6c712016219848624b87cec2dbe98223a0eb4fa39f6b5c02e6d6d90756ff57902a8f57010000009700ce0b4b8bc22941330000000000000000000300000000000000000000000010008bc0d955f2a83366b99711e6e8861c46495ba585a4b2d02edc3e28dd279a896249ed85b9806f0b6c4a000000002b43dcacc413b48dafb7a2c8cb482bac0ac502d9ba96ffffff7f00000000df73be83bb7d5ad883ef07000000000000006da21b40216e14ba2d6af8656bfff17addaedab25b30002abbba7fa725f38400be7c1f001b2cd317902f19e385be9e48dccff72943327d830689da6b53ffffffff631c7771429d1200000033ed846197fcff5e1c7c3d1d6e3a52872baef9753fffffffffffffe09fec2271fe010cd7bb2366fde4a59429738fcc917a57f94f6c453cea623cc5ee0c2a5ff870ce5dfd3467decb05cfd9fcd41df54cdbd9d10a64c108285e71b5565b1768ee58969c41595229df17bcad70fb4021428ce978275d5bc8955778567bc79e13b78249788f11f708008b75d4fe32b561d46ea3abe0fa4d30dc94ef241875f3b4b6ab7929a57affe7d7fa29822aea68a660e717a04becff0f719107000000000000002d7e927123d8ecbbc55bf404571be54c72d978cf2804107f0238abccd32368e57040906df0042e19000000000000002c06f815312e086dd022c074eb8a322fb0bf47c0a8d154b405a07feaf3dd95f6ef44cd1fe582786105c7df8be4877084d4173731efe895efc71f665c4d75cf2458e35d2c9062ece84c99e061887a20639b41c8c12ee86c50804042b3eac1f879b136345cf67ca3fb2b5e518a75f9e7d7101d5e186c489b3a06fb99e0aa7f23a054de2f4d92d6bd72ee2c9fdc75aaaf1e3e483b4ad055e4af403269b4a39ce40293947d9a631bcbf3583784acbda216550d7aec6b79e30cbd128f54c2d3335457ac0eaaa99bf0bdc14ae358c3b377327ac9ecc34f24c9ae153ec60ac0694da85bff9f5f4df9b3fdf242b985bf16b99c9cc0ad1857036f1a985f369191ae954febb3df464bfe0f773ee9afe72f32a2befb89d3777399f5874c553a2ebe9061fe86e669642e09c0e5a3bb6d163118e4cbe024fd452277c3887d6116c6cc9d8046c216c1f8a9778cb26e22a2a998de5eaeadea10d3cfb41b92ecbb422a40da8daccf080842a486721737390cbf3a74cb2003efb9a101b51ab63e9600040000b8a8c9ae3d14f93100c2e0893862eef552fcde2981f48c482bde6e4a4304e50c349f4f9ecee27defd83871c5191e10096e7e60fc3541a2c905a1a95e9571bf38aebd15172f94e3245c582909e2a3bce109b6000000000000000000d6d5210d7560eb92d6a97a27602b81f7636df1535bef1497f90100000000000000abf9010000007740890200d627e87306703be8672dc84eeadba6a41891c170d1ab57075228a9f46ed9bd1f08fb8191bbab2dc51de3a61f0868afc4294859323e7a45319f18101288a0268893373750d10a3fc22dd704e4214de5946912d6c98cd1a9fbe1e7ef8c08acaf30235b920500d2eca55f74a23641f61f2d5b308cf0d031b0c7f0ced69b93e9960ff5f74562adae283d9756237badf4e7965bbe2777e808fcba821aa8e8c5c39609ff85000000000000c1fee30a3f7a85d1b29e58c77685efc0ceb1c8e5729c66018d169fc03aa188546b3ad2a182068e1e3a0e2505bc7f41019645466a31c72ad53bc19faa5401120000793ac48c1b539c75ab40743b00020000a1f68df75cf43f8ecc8d3726602111b40e761fd210a1920382f14d12ca3c3431ee97471c781d0d1280fb00818654a53b6df4b2c97cc1c98d85fda8f80fe908b65550b4412331d73062197655b7f0469250a5989cef0e10773920ed3ccee42d2c3eb80159da5c002511e6eb93842054cfce2ac306cb6e472db3fd67a49b6855a694a8d359add43907003223a47a7fae4f3748d5a432825bc40a03aaef1c8488d86dc211dd2a3ba71e0f45492ef1f8b65ccb3dcd251a61b152d02c29ca0a3328fa7753a5cddea1acaae55ae8263fb284b7a6ab2a8826c1b948207c498cf4824ab1ea3225a53072423b907c6682f8999e0311da5b8378bc841e1787e3a8128dda381a26cb2b365702ff8a27831375b2ddaa2f56e21169f7ca4fd9655ccd4a584acd244e965a0afedaff7c415ff682a4044b3381cc2df28278c9a6824c52048a7cfabda294925cc0956bffa8e950ff5e49f41ae600d830207bf728cd9807933c3c16d80bbea611a18becc2dc38ca0a6f5740f340b76edcd100fcffff007231dcef58c7b88b5aeedaf9626cb51ce1737c10ab37d4f98a934b0f900e0eb639878a1200629f5503cf679154d27681d7a3744cbcd42af59407c9c8e39c5271868917954e604352ba26171d004f1cb2976fab3fa19c7d3ef9678bff79f5155524f061378f94fb453786c3a6f78b10d383b49e31d1568bd43ee34ce6e6be235aa6207285665c2fba773671da41959f51610963b48930658e2d6125a26085001345b0473240b7e5e91811312c43663e76f711c6529ecdec75c7ea1cf0f8f8fff40247d59bbde2ebb8659197e0f37a71be1b12a182ed7de3acba28561a04b807f7a4647e2ea6d8fb92541d07c3d5e4ba077d3cad9f8ba1919592014c00c8eccb2ca5d48ba7b1c3fb185a4bb79700cf51f818b0c701c8de47d12281a67bdaf4b0c50bee9e8f5936250df2e15c1172e7ea6619f7db330700d1e9e42a035e6fd532f61fbfed9c4a7124a1e38eee50a6bbcd1d4e3f68c3f27dd9a70f1a7c6046237ddfb0b26e197322226367d998010458cd4df10af249ce717f6f45e5176e0ddae3054d7289d4e13ab0912703ee39ce264572b89194fdf7acecc35cf8309d4b680a08eed367dad855fce210f1a7c7222dd360eafb4bef7d58bf83362930af6e3f3f851abdc0003bdf9401b533019e90feb069189100007a82df8d9b5f44ebf9355e7b1b01c9470608d4f306d21004730396a4d6c6d46e1ffac97aa93c36123532a36186575266be4981c847160079421d0137801e553069f8d025c40f287378810defc7f2ed4e15f6af17b21153394f8bcfa6a23a77c8d61c9bbc127a57b8d631f36558d9093dee08bc53d97a8003363421738650a22c8fd87b13026799caf58e59951b125e7f161ca34e2c0dd65a23d01a3cb191e743de07247c7f993cf01166fa2ac1ba02f60550e63a7f50422e478c6b5d87f9bd0567a279a9d85a380db25c43bd0529ad783b9d64aaac1b793afb44b7126e17d2b7c0d6be650de7eeef3f3605af344015d03c3e7819145cb9fe1978c98bf9cf10773db59505ae33708c728844c872dfd2cb0b29008000000000000005ca18cb72f0944d0e4fea0a0abd0285bdaf1b000000c089d640c2facb0d1e6243873ac4b1e1068c45c715b68effb7d58d1f9e726dbf6bd910ca4ce0e075658ede42192cf393a50dcc197b03402fed75083628e5dd38213d353b9049e71f037064b05e73ec00c710f1ffc5737d397d555d1cf8859cc030ea8dc3c6a5b3b6fa1c81707479db1833d593a271253aa11efd936b74784f2fc286814848e92d8ee541bc179813297a0a4cc3c8f80c28701185bea091f32475e859479b734727afc110e1abcff460172fd1b42e3c0e2a4bf94a060069000010000087c7572a1e7596f89e5c3d5e70640c90815f77b7b13d0000000085a1e1e84900000000000000000000000000b422fc160a458ee5a91a2471e6e56fdabec6c73ce8983fc68f0b7cdcdde632e6f54a07620e8aa116ce9e84fc3cd5e8288a333dcebb233da9186796995ba69487d8f77d2f8800f02d690fc70a08b231cad1bdcf3740a95d4dd1cfe0f417f275493cf33b19ffff93dfdaf7eb00b8ad87cdf7c21bab5af8e2bac54ee5597e6508c1158124a538c36f9bb11fea7d8b8c7e954b1bc7811654a6636b33f271d0923e9ecd1b724b8feffadfc23c07000000f0785fb722f346d6a5dffe1884d4d0cd8f00000092c85ed44db68ab800001f00000000406e6ed9b219ad07125381087298e75965d1cc5932ddf9e66351b9332a34bee3e3d562c914c629933f0b8724cf680889ade72558d191d9890c69a718f9018586c5131c8dc8e0379bafda1a0fd2997ff115215ce23dca8db7236c1554cdaaadcce2f31834c1bd1908d8e1b361034db56be76acb7654a195bc3e98df3a5dffd5b0783883ef7da3433110e37f7c7cb7f3800de7f99abf910d6949e062747a9c87dcfcc716d6a9c0ec53b9cffe3cfd1df69a76f373d7f997edb9b80bdea1a99c2a6fbb25e035deadaadd7917ebfedd6304a19491769476208684e343f86b4d55a7dbbb07283cb1e35a138d24ebc5b4f8e35a82d3a7f84cb1e02a5a92b53567088be0b1ca023ccd518c0e0715b1c8760801a419ebd2e26440ff7493019bdb655cc88d72d6d7b6bca5a2e19b63ec52fce43d8c53a8031e64026e0d36b6401064c49a729f11ab377f7132c5232bb80195dd5d43d29646a9378eea0761b7ed9d2172e33ed87c7413c843b180cc00000000006bedf2ed716ca43a941119b96d82b26d9061de240d85ec2cfa462bd52104489bb7a7548d7cc53627031e909c69cb824233975a1ea645de63522407c3a240a37e946f30ebf075ea97846a0a8d2286f3f446b1b99ab83a12ddf8a1c06294eadc3eb3e339591afd5c00000000000000000000000000000000000000000000000000579dad8347a3d16976bb7483840b32db0158fb6c809349333325a7866ca5d3133e33ef1a183cefdb65a79fa71800988c8445029e024822dbcfcab49c3a0aec9bd43e6e14078b260700d849a2aa14c9b593f6dcb1de334c065ecfd65031606e55949c185bcda9fde4f9b46a76b8a24bbcd31b22373eb0473248150cd179405ee1af1183b0c0ce3483dc1d9bf732b0751b78fb211d6706b55960c6431afbc02b3c7e08086573939290bb9e590a3875f02a828b07f1dc7df9c8e5da22dfb9dacbf5529e4e994128d835f85465173ea7bbcc519a0c9798ce8b1b07567e3e07169c8c3e4da8bf725c050000000000000000000000000000000000000000004775abdf0c62728eb55a9e2849a1ce05bed60dfe4cc9fa43f9684297c02382c0a35829be7a86305792a9d2e80ca9e8fc50f31f6e0fa810303da03d8b74b42c1ebaf16bb343256405a3a07229a54de09a97b269cd29e8b2f0b0d46c51a6a93eec37f4bc6e29a8e19120ae050ab682662e9b2cc3263a4aba62b63ca9123a53c0f4bf3c4463b8144c89bf058a0af0ae9fc2b7cdfc4817703e267cddc193637d7fd97646090da37093657643daae3840c7f5c10f93524f7ae4791ec6e9d9722e5f670ccb358e051a"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x5a}, 0x48) bpf$BPF_PROG_DETACH(0x1c, &(0x7f0000000000)={@fallback=r11, r11, 0x2f}, 0x20) bpf$BPF_PROG_DETACH(0x9, &(0x7f00000004c0)=ANY=[@ANYRES32=r11, @ANYRES32=0x0, @ANYBLOB='/'], 0x20) write$cgroup_pid(r9, &(0x7f00000001c0), 0x12) 3.626762714s ago: executing program 3 (id=6815): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000004c0), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000080)={'pimreg0\x00', 0x7c2}) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000080)={'pimreg0\x00', 0x7c2}) r3 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000180)={'pimreg0\x00', 0x0}) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x6, 0x3, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0x100}}, &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000140)={r5, r4, 0x25, 0x0, @val=@netfilter={0x1, 0x0, 0x7}}, 0x20) close(r0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r6) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r7, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r7, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a4c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc080003400000001408000c4000000e45400000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a310000000014000380100000800c00018006000100d103000014000000110001"], 0xb4}, 0x1, 0x0, 0x0, 0x4000850}, 0x40000c0) sendmsg$NFT_BATCH(r6, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000340)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSETELEM={0x4c, 0xc, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x6}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x20, 0x3, 0x0, 0x1, [{0x1c, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0xc, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0x6, 0x1, '\x00\x00'}]}, @NFTA_SET_ELEM_TIMEOUT={0xc, 0x4, 0x1, 0x0, 0x7}]}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x74}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSETELEM={0x40, 0xc, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x6}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x14, 0x3, 0x0, 0x1, [{0x10, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0xc, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0x6, 0x1, '\x00\x00'}]}]}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x68}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) 3.588460522s ago: executing program 4 (id=6816): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$NL802154_CMD_NEW_SEC_DEV(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000480)={&(0x7f00000002c0)={0x18, 0x0, 0x4, 0x0, 0x0, {}, [@NL802154_ATTR_SEC_DEVICE={0x4}]}, 0x18}}, 0x0) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f00000000c0)={'syztnl1\x00', &(0x7f0000000040)={'syztnl0\x00', 0x0, 0x80, 0x40, 0x10, 0x80000001, {{0xb, 0x4, 0x1, 0x34, 0x2c, 0x65, 0x0, 0x7, 0x29, 0x0, @broadcast, @dev={0xac, 0x14, 0x14, 0x28}, {[@end, @timestamp_prespec={0x44, 0x14, 0x94, 0x3, 0xf, [{@remote, 0xfd99}, {@local, 0x8}]}, @end]}}}}}) sendmsg$nl_route(r0, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000140)={&(0x7f0000000300)=@ipv4_getnexthop={0x34, 0x6a, 0x100, 0x70bd2b, 0x25dfdbfb, {}, [@NHA_GROUPS={0x4}, @NHA_OIF={0x8, 0x5, r1}, @NHA_OIF={0x8, 0x5, r1}, @NHA_MASTER={0x8, 0xa, 0x2}]}, 0x34}, 0x1, 0x0, 0x0, 0x1}, 0x4040000) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x1, 0x6, 0xf, 0x8, 0x41}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x7, 0xc, &(0x7f0000000440)=@framed={{}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r2}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0xffffffffffffffd4, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x31, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0xe5}, 0x94) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000040), &(0x7f00000004c0), 0xce, r2}, 0x38) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x3, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={r3, 0x2000000, 0xe, 0x0, &(0x7f0000000240)="63eced8e46dc3f0adf33c9f7b986", 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=ANY=[@ANYBLOB="60000000100005040100000000000000000000000000000000000000000000000a00030076657468300000003400128009000100766574680000000024000280200001"], 0x60}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) (async) sendmsg$NL802154_CMD_NEW_SEC_DEV(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000480)={&(0x7f00000002c0)={0x18, 0x0, 0x4, 0x0, 0x0, {}, [@NL802154_ATTR_SEC_DEVICE={0x4}]}, 0x18}}, 0x0) (async) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f00000000c0)={'syztnl1\x00', &(0x7f0000000040)={'syztnl0\x00', 0x0, 0x80, 0x40, 0x10, 0x80000001, {{0xb, 0x4, 0x1, 0x34, 0x2c, 0x65, 0x0, 0x7, 0x29, 0x0, @broadcast, @dev={0xac, 0x14, 0x14, 0x28}, {[@end, @timestamp_prespec={0x44, 0x14, 0x94, 0x3, 0xf, [{@remote, 0xfd99}, {@local, 0x8}]}, @end]}}}}}) (async) sendmsg$nl_route(r0, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000140)={&(0x7f0000000300)=@ipv4_getnexthop={0x34, 0x6a, 0x100, 0x70bd2b, 0x25dfdbfb, {}, [@NHA_GROUPS={0x4}, @NHA_OIF={0x8, 0x5, r1}, @NHA_OIF={0x8, 0x5, r1}, @NHA_MASTER={0x8, 0xa, 0x2}]}, 0x34}, 0x1, 0x0, 0x0, 0x1}, 0x4040000) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x1, 0x6, 0xf, 0x8, 0x41}, 0x50) (async) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x7, 0xc, &(0x7f0000000440)=@framed={{}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r2}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0xffffffffffffffd4, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x31, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0xe5}, 0x94) (async) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000040), &(0x7f00000004c0), 0xce, r2}, 0x38) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x3, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={r3, 0x2000000, 0xe, 0x0, &(0x7f0000000240)="63eced8e46dc3f0adf33c9f7b986", 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) (async) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=ANY=[@ANYBLOB="60000000100005040100000000000000000000000000000000000000000000000a00030076657468300000003400128009000100766574680000000024000280200001"], 0x60}}, 0x0) (async) 3.19517385s ago: executing program 4 (id=6817): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="9feb010018000000000000004c0000004c0000002a0000000100000000000001040000002000000105000000010000040400000013000000010000000000000017000000020000040800000021000000010000000000000025000000020000002000000000696e74006270665f7370696e5f6c6f636b0076616c006d61705f76616c756500636e74006c"], 0x0, 0x8e}, 0x28) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0x2, 0x4, 0x8, 0x1, 0x0, 0x0, 0x0, '\x00', 0x0, r1, 0x1, 0x3}, 0x48) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="2000000004000000080000000000000001"], 0x40) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$PPPIOCNEWUNIT(r3, 0xc004743e, &(0x7f0000000000)) ioctl$PPPIOCSPASS(r3, 0x40107447, &(0x7f0000000100)={0x1fffffffffffffa8, &(0x7f0000000080)=[{}, {}]}) r4 = socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @broadcast}) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000200), 0xffffffffffffffff) syz_genetlink_get_family_id$mptcp(&(0x7f0000000440), r6) r8 = socket(0x10, 0x3, 0x0) sendmsg$nl_generic(r8, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000001240)={&(0x7f0000000180)={0x184, 0x19, 0x1, 0x0, 0x0, {0x1d, 0xd601, 0x9}, [@nested={0x4d, 0x12, 0x0, 0x1, [@generic="25b57e35619bf2be9082cfcd8fba0cd0f2934efacde0a223b473fe77f3e5ba760d3793b2b3589c9fb23ff943b7528ea34883bc4a506cf756740574b89d396af9b59638700500000005"]}, @nested={0x11e, 0x6, 0x0, 0x1, [@typed={0xdd, 0x14d, 0x0, 0x0, @binary="0f46f1849e80333a72c47c602d9970739272ca25d0ed59ba2d54f2dbf1ce1d4305d0ef433df7b8370107edbc85bfb216efdc1b0b64d6a716ab6d8204ff7498a0d528471596a2bffd9f39f5d68ca46f729302ab4cb1bca132d999b0a04b1ddb2404cb28de890a87617e79217b4cafbcb340e885260db96e23db715cecc61ce445ad06cf189c29e6fb925cc6f1c5db4e1f43cd4f582f94a84bf0152dfada7b9826bbbfd394d745fd122010a19f7c2e459f59c5e8cccc8d9d0124b01020e16d5fa1f4882dc1043dec61df7983901630639c97157316c9285b79ba"}, @generic="37c14f9a8ead341bf43ea3970236c74b2e318966b7420623d7f5c9fde55324d4c519e80f9f4d6b22b3f1b672c61240c38914eb560eb9ca62fa58"]}]}, 0x184}}, 0x0) sendmsg$ETHTOOL_MSG_STRSET_GET(r6, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000340)={0x2c, r7, 0x800, 0x0, 0x0, {}, [@ETHTOOL_A_STRSET_STRINGSETS={0x18, 0x2, 0x0, 0x1, [{0x14, 0x1, 0x0, 0x1, [@ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x14}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x6}]}]}]}, 0x2c}}, 0x40080) sendmsg$ETHTOOL_MSG_COALESCE_SET(r5, &(0x7f00000002c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000280)={&(0x7f00000001c0)={0x2c, r7, 0x4, 0x70bd25, 0x25dfdbfe, {}, [@ETHTOOL_A_COALESCE_TX_MAX_FRAMES_LOW={0x8, 0x11, 0x37}, @ETHTOOL_A_COALESCE_USE_CQE_MODE_RX={0x5}, @ETHTOOL_A_COALESCE_USE_CQE_MODE_TX={0x5, 0x18, 0x1}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40001}, 0x84) write$tun(r2, &(0x7f0000000c80)={@void, @val={0x4, 0x4, 0x6488, 0x8, 0x14}, @ipv6=@icmpv6={0x7, 0x6, "bf9849", 0x10, 0x3a, 0x1, @local, @local, {[], @ndisc_ra={0x86, 0x0, 0x0, 0x1, 0x9, 0x28, 0x2, 0x8001}}}}, 0x42) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000800)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000010000000900010073797a30000000003c000000090a010400000000000000000100000008000a40000000000900020073797a32000000000900010073797a3000000000080005400000001f580000000c0a0101000000000000000001001b000900020073797a32000000002c0003802800008008000340000000021c000b80360001800e000100636f6e6e6c696d69740c0000040002800900010073797a3000"], 0xdc}}, 0x0) 3.083391577s ago: executing program 1 (id=6818): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x82600, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$unix(0x1, 0x5, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r4, 0x8933, &(0x7f0000000840)={'batadv_slave_0\x00', 0x0}) r6 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000280)=@bpf_lsm={0x6, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="18000000003f000000000000000000f195"], &(0x7f0000000140)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x40, '\x00', r5}, 0x90) r7 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r7, 0x8933, &(0x7f00000001c0)={'batadv_slave_0\x00', 0x0}) sendmsg$nl_route(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=ANY=[@ANYBLOB="200000001100010025bd7000ffdbdf2500000000", @ANYRES32=r8], 0x20}, 0x1, 0x0, 0x0, 0xc881}, 0x8080) sendmsg$nl_route(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000380)=ANY=[@ANYBLOB="340000001000010027bd70000000000000000000", @ANYRES32=r4, @ANYBLOB="004100000000000014002b8008000100", @ANYRES32=r6], 0x34}}, 0x4008000) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x74bd26, 0xffffffff, {0x0, 0x0, 0x0, r9, {0x0, 0x6}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_qfg={0x8}]}, 0x2c}}, 0x24040084) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) r10 = socket(0x400000000010, 0x3, 0x0) r11 = socket$netlink(0x10, 0x3, 0x0) r12 = socket$nl_route(0x10, 0x3, 0x0) r13 = socket$unix(0x1, 0x1, 0x0) syz_emit_ethernet(0x4e, &(0x7f0000000000)={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}, @empty, @val={@void, {0x8100, 0x0, 0x0, 0x2}}, {@ipv6={0x86dd, @icmpv6={0x3, 0x6, "269fe0", 0x14, 0x3a, 0xff, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @mcast2, {[], @ndisc_ns={0x87, 0x0, 0x0, @mcast2}}}}}}, 0x0) ioctl$sock_SIOCGIFINDEX(r13, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r11, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000400)=@newqdisc={0x34, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdfc, {0x0, 0x0, 0x0, r14, {0xffff}, {0xffff, 0xffff}, {0x2, 0xa}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x400dc}, 0x0) r15 = socket$nl_generic(0x10, 0x3, 0x10) r16 = syz_genetlink_get_family_id$devlink(&(0x7f00000016c0), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RATE_GET(r15, &(0x7f0000001780)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000000c0)={0x14, r16, 0xf1aad47e89fb43b5, 0x0, 0x25dfdbf8}, 0x14}, 0x1, 0x0, 0x0, 0x34040840}, 0x4000) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r18 = syz_genetlink_get_family_id$batadv(&(0x7f0000000140), r11) sendmsg$BATADV_CMD_TP_METER_CANCEL(r11, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x24, r18, 0x104, 0x70bd2c, 0x25dfdbff, {}, [@BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0xb}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0xff}]}, 0x24}, 0x1, 0x0, 0x0, 0x810}, 0x4000) sendmsg$nl_route_sched(r12, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x34, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r17, {0x0, 0xfff2}, {0xffff, 0x6}, {0xfff8}}, [@qdisc_kind_options=@q_pfifo_fast={0xf}]}, 0x34}, 0x1, 0x0, 0x0, 0x4000051}, 0x4004000) 2.995803538s ago: executing program 3 (id=6819): r0 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000100)=@o_path={&(0x7f0000000040)='.\x00', 0x0, 0x4010}, 0x18) (async) r1 = accept4$bt_l2cap(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000180)=0xe, 0x80800) ioctl$XFS_IOC_COMMIT_RANGE(r0, 0x40585883, &(0x7f00000001c0)={r1, 0x0, 0xa0, 0x4, 0x6, 0x2, [0x7, 0x0, 0x1, 0x1000, 0xc483, 0x9]}) (async) r2 = socket$nl_route(0x10, 0x3, 0x0) (async, rerun: 64) r3 = socket$nl_route(0x10, 0x3, 0x0) (rerun: 64) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f00000000c0)={'bridge0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000300)={&(0x7f0000000280)=@newchain={0x4c, 0x64, 0x1, 0x80000001, 0x25dfdbfd, {0x0, 0x0, 0x0, r4, {0xfff1, 0xa}, {0x9, 0x4}, {0x4, 0x9}}, [@TCA_CHAIN={0x8, 0xb, 0x7fffffff}, @filter_kind_options=@f_flower={{0xb}, {0x4}}, @TCA_RATE={0x6, 0x5, {0x7f, 0xd}}, @TCA_RATE={0x6, 0x5, {0x80, 0xa9}}]}, 0x4c}, 0x1, 0x0, 0x0, 0xd5}, 0x20000000) (async, rerun: 32) sendmsg$nl_route(r2, &(0x7f0000003880)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x801, 0xfffffffd, 0x0, {0x0, 0x0, 0x0, r4, 0x0, 0x8010}, [@IFLA_AF_SPEC={0x14, 0x1a, 0x0, 0x1, [@AF_INET={0x10, 0x2, 0x0, 0x1, {0xc, 0x1, 0x0, 0x1, [{0x8, 0x1a, 0x0, 0x0, 0x1}]}}]}]}, 0x34}, 0x1, 0x0, 0x0, 0x4000010}, 0x0) (rerun: 32) 2.698327636s ago: executing program 3 (id=6820): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="c40000001900674c2cbd70000000000000000000000000000000000000000000ac1eff0100000000000000000000000000000000000000000a00000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0100000000000000000000000000000000000020000000000000000000000000000000000000000000008000000000000000000000000000fcffffffffffffff0000000000000000b0ac00000000000000000000000000000000000000000000000400000000000000000002000000000a00100001"], 0xc4}}, 0x4c050) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) socket$kcm(0x29, 0x2, 0x0) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=@updpolicy={0xfc, 0x19, 0x1, 0x0, 0x0, {{@in6=@rand_addr=' \x01\x00', @in=@local, 0x0, 0x5, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0xa9, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0xa00, 0x40800000000000, 0x800000000000000}}, [@tmpl={0x44, 0x5, [{{@in=@dev={0xac, 0x14, 0x14, 0x40}, 0x0, 0x3c}, 0x0, @in=@broadcast, 0x0, 0x0, 0x3}]}]}, 0xfc}}, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r3 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000000280)={'syzkaller1\x00', @link_local}) write$tun(r1, &(0x7f0000000080)=ANY=[@ANYBLOB="034886dd010000000000140000006000000003082f00fe88a43de1a400000000000000007d01ff0200000000000000000000000000fe"], 0xfdef) 2.490493858s ago: executing program 3 (id=6822): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x8080}, 0x20004450) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$sock(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000200)="2e00000013000500000000000000000005010000100002007664706173696d5f626c6b000a000400766470613000", 0x2e}], 0x1}, 0x0) sendmsg$IEEE802154_START_REQ(r2, &(0x7f0000000440)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000400)={&(0x7f00000002c0)={0x54, 0x0, 0x100, 0x70bd2c, 0x25dfdbfd, {}, [@IEEE802154_ATTR_SF_ORD={0x5}, @IEEE802154_ATTR_PAN_COORD={0x5, 0x19, 0xb}, @IEEE802154_ATTR_COORD_SHORT_ADDR={0x6, 0x8, 0xaaa3}, @IEEE802154_ATTR_COORD_SHORT_ADDR={0x6, 0x8, 0xaaa3}, @IEEE802154_ATTR_CHANNEL={0x5, 0x7, 0xa}, @IEEE802154_ATTR_PAGE={0x5, 0x1d, 0x13}, @IEEE802154_ATTR_PAN_COORD={0x5, 0x19, 0x2}, @IEEE802154_ATTR_BCN_ORD={0x5, 0x17, 0xfa}]}, 0x54}, 0x1, 0x0, 0x0, 0x4014}, 0x100) (async) shutdown(r1, 0x0) (async) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x1c, &(0x7f00000000c0)=[@in6={0xa, 0x0, 0x0, @private2}]}, &(0x7f0000000180)=0x10) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r1, 0x84, 0x85, &(0x7f0000000000)={r3, @in={{0x2, 0x0, @empty}}, 0x0, 0x7ffe}, 0x90) (async) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000340)={r3, @in6={{0xa, 0x4e23, 0x5, @empty, 0x2800}}, 0x3, 0x0, 0x20000, 0x81, 0x12, 0x0, 0x4}, 0x9c) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000180)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWRULE={0x70, 0x6, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x1}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_EXPRESSIONS={0x44, 0x4, 0x0, 0x1, [{0x34, 0x1, 0x0, 0x1, @payload={{0xc}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_PAYLOAD_DREG={0x8, 0x1, 0x1, 0x0, 0x9}, @NFTA_PAYLOAD_OFFSET={0x8, 0x3, 0x1, 0x0, 0x4f}, @NFTA_PAYLOAD_LEN={0x8, 0x4, 0x1, 0x0, 0x37}, @NFTA_PAYLOAD_BASE={0x8, 0x2, 0x1, 0x0, 0x2}]}}}, {0xc, 0x1, 0x0, 0x1, @dup_ipv6={{0x8}, @void}}]}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x98}, 0x1, 0x0, 0x0, 0x20004080}, 0x24000840) 2.404370266s ago: executing program 0 (id=6823): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)={{0x14}, [@NFT_MSG_NEWFLOWTABLE={0x40, 0x16, 0xa, 0x203, 0x0, 0x0, {0x2}, [@NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz2\x00'}, @NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_FLOWTABLE_HOOK={0x14, 0x3, 0x0, 0x1, [@NFTA_FLOWTABLE_HOOK_PRIORITY={0x8}, @NFTA_FLOWTABLE_HOOK_NUM={0x8}]}]}], {0x14}}, 0x68}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000340)={{0x14}, [@NFT_MSG_NEWFLOWTABLE={0x38, 0x16, 0xa, 0x801, 0x0, 0x0, {0x2, 0x0, 0x4000}, [@NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz2\x00'}, @NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_FLOWTABLE_HOOK={0xc, 0x3, 0x0, 0x1, [@NFTA_FLOWTABLE_HOOK_NUM={0x8}]}]}], {0x14}}, 0x60}}, 0x0) 2.332773915s ago: executing program 0 (id=6824): r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x50) r1 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) r2 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000040)=@generic={&(0x7f0000000000)='./file0\x00', 0x0, 0x18}, 0x18) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000480)={r2, &(0x7f00000002c0)="5ca882a3679fb1ddf49027f6c7a468c64aef0079b0b87d1f4e76101e823a98ab1c65632491733d33f183117b52b6f41289626cb2c02494f2e1517f3b789653d54a8c2278931a58763c14e3af33169d52cb53b75e227fddd32557c84abae041d2058a923ac1c62d89774b5572703e028259601ab9af22646fff1b2e0f5cf4579a0c3bec12e22d437cb007640ce753c1747838f225259d354e725359492af435326666c2da1bad0ee44ff66cea5a9556f668e0dc799294d12bf14980cbe6a9614184c63222dcb8978048e734bfb129f0000dd64ccc354e285c6f552451729c80e4f1", &(0x7f00000003c0)=""/155}, 0x20) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x12, &(0x7f00000000c0)=ANY=[@ANYBLOB="180000008f000000000000000b00000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000086000000bf090000000000005509010000000000950000000000000018200000", @ANYRES32=r1, @ANYBLOB="000000000100000025000400fcffffffbc91100000000000b702000003000000850000002a000000b70000000000000095"], &(0x7f0000000080)='GPL\x00', 0x7, 0x0, 0x0, 0x41100, 0x2f}, 0x94) r3 = socket$nl_route(0x10, 0x3, 0x0) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000080)={'batadv0\x00', 0x0}) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=@newlink={0x40, 0x10, 0x401, 0xfffffffc, 0x80080, {0x0, 0x0, 0x0, 0x0, 0x1503}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @wireguard={{0xe}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r4}]}, 0x40}, 0x1, 0x0, 0x0, 0x2004d808}, 0x0) 2.059083512s ago: executing program 0 (id=6825): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0100000004000000080000000a"], 0x48) r1 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="9feb010018000000f2ff000034000000340000000e00000001000000000000009559d0ff943aa64800000000000000000c020000160a0000000100000c0200000000696e7400"/87], 0x0, 0x5a}, 0x28) socket$nl_netfilter(0x10, 0x3, 0xc) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet6_int(r2, 0x29, 0x1a, &(0x7f0000000100)=0x8001, 0x4) r3 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$MRT6_PIM(r3, 0x29, 0xd0, &(0x7f0000000040), 0x4) bind$inet6(r2, &(0x7f00000000c0)={0xa, 0x4e23, 0xa, @empty, 0x9}, 0x1c) sendmmsg$inet6(r2, &(0x7f0000000480)=[{{&(0x7f0000000040)={0xa, 0x4e23, 0xb, @loopback, 0x1}, 0x1c, &(0x7f0000000380)=[{&(0x7f0000000140)='2', 0x1}], 0x1}}], 0x1, 0x8000) r4 = socket$inet6_sctp(0xa, 0x1, 0x84) bind$inet6(r4, &(0x7f0000000140)={0xa, 0x4e23, 0x100002, @ipv4={'\x00', '\xff\xff', @empty}, 0x1e}, 0x1c) sendmmsg$inet6(r4, &(0x7f0000000680)=[{{&(0x7f0000000080)={0xa, 0x4e23, 0xab, @loopback, 0x8}, 0x1c, &(0x7f0000000780)=[{&(0x7f0000000900)='2', 0x1}], 0x1}}], 0x1, 0x20000854) shutdown(r4, 0x1) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000900)={0xffffffffffffffff, 0x0, 0x5, 0x0, &(0x7f0000000608)="0900000004", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x5, 0xb, &(0x7f0000000400)=ANY=[@ANYBLOB="18110000", @ANYRES32=r0, @ANYBLOB="000000000000000018420000060000000000000000000000b703000000000000b70400000000000085000000a4000000b7000000000000009500000000000000b7000000000000009500000000000000"], &(0x7f0000000500)='GPL\x00', 0x1, 0x100000, &(0x7f0000000700)=""/1048576, 0x0, 0x0, '\x00', 0x0, @fallback, r1, 0x8, &(0x7f0000000600)={0x0, 0x3}, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x80) 1.203643891s ago: executing program 0 (id=6826): r0 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=@ipv6_newaddr={0x40, 0x14, 0x9535393fea6295b5, 0x40, 0xfffffffc, {0xa, 0x0, 0x55, 0x0, r1}, [@IFA_LOCAL={0x14, 0x2, @local}, @IFA_CACHEINFO={0x14, 0x6, {0x40000000, 0xfffff001, 0x6}}]}, 0x40}, 0x1, 0x0, 0x0, 0x20000080}, 0x0) 1.141826219s ago: executing program 0 (id=6827): r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mtu(r0, 0x0, 0xa, &(0x7f00000019c0)=0x2, 0x4) (async, rerun: 32) r1 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="06000000040000000800000001"], 0x48) (rerun: 32) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0x11, 0x10, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7050000e8f9756985000000a500000095"], &(0x7f0000000300)='GPL\x00', 0x4}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000180)={{0x1, 0xffffffffffffffff}, &(0x7f00000000c0), &(0x7f0000000140)}, 0x20) (async, rerun: 64) getsockopt$inet_mreqn(r0, 0x0, 0x24, &(0x7f00000002c0)={@broadcast, @multicast2, 0x0}, &(0x7f0000000380)=0xc) (async, rerun: 64) r4 = bpf$BPF_BTF_LOAD(0x12, &(0x7f00000007c0)={&(0x7f0000000680)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x64, 0x64, 0xa, [@func_proto={0x0, 0x5, 0x0, 0xd, 0x0, [{0xf, 0x1}, {0x4, 0x3}, {0xf, 0x5}, {0xb, 0x1}, {0xc, 0x5}]}, @enum64={0xa, 0x1, 0x0, 0x13, 0x1, 0x0, [{0xa, 0x3, 0x3}]}, @array={0x0, 0x0, 0x0, 0x3, 0x0, {0x1, 0x3, 0x7}}]}, {0x0, [0x0, 0x30, 0x61, 0x5f, 0x5f, 0x61, 0x5f, 0x30]}}, &(0x7f0000000740)=""/72, 0x86, 0x48, 0x1, 0xe265, 0x10000}, 0x28) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000940)={0x18, 0x13, &(0x7f00000001c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0xfe7, 0x0, 0x0, 0x0, 0x5}, [@tail_call={{0x18, 0x2, 0x1, 0x0, r2}}, @call={0x85, 0x0, 0x0, 0x10}, @func={0x85, 0x0, 0x1, 0x0, 0x5}, @kfunc={0x85, 0x0, 0x2, 0x0, 0x3}, @cb_func={0x18, 0x7, 0x4, 0x0, 0x7}, @tail_call={{0x18, 0x2, 0x1, 0x0, 0x1}}, @exit]}, &(0x7f0000000280)='GPL\x00', 0x8, 0x0, 0x0, 0x41100, 0x41, '\x00', r3, 0x0, r4, 0x8, &(0x7f0000000800)={0x0, 0x1}, 0x8, 0x10, &(0x7f0000000840)={0x2, 0x9, 0x4e}, 0x10, 0x0, 0x0, 0x7, &(0x7f0000000880)=[r1, r1, r1, r1, r1, r1], &(0x7f00000008c0)=[{0x4, 0x5, 0x1, 0x8}, {0x2, 0x1, 0x6, 0x3}, {0x1, 0x4, 0x10, 0xc}, {0x3, 0x1, 0x10, 0x1}, {0x5, 0x5, 0xa, 0x4}, {0x1, 0x2, 0x2}, {0x0, 0x5, 0x10, 0x7}], 0x10, 0x9}, 0x94) (async) connect$inet(r0, &(0x7f0000001a00)={0x2, 0x4e23, @remote}, 0x10) setsockopt$inet6_icmp_ICMP_FILTER(0xffffffffffffffff, 0x1, 0x1, &(0x7f0000000000)={0xff}, 0x4) (async, rerun: 32) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000540)=@newlink={0x3c, 0x10, 0x439, 0x0, 0x0, {0x0, 0x0, 0xe403}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bond={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BOND_MIIMON={0x8, 0x3, 0x4}]}}}]}, 0x3c}}, 0x0) (rerun: 32) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$devlink(&(0x7f0000000dc0), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_TRAP_GET(r5, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000540)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="010000000000fbdbdf25270000000e0001006e657464657673696d0000000f0002006e657464657673696d3000001c0053"], 0x50}, 0x1, 0x0, 0x0, 0x24040011}, 0x0) (async) r7 = socket$inet6(0x10, 0x2, 0x0) sendmsg(r7, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000540)=[{&(0x7f0000000480)="55000000200009afb72d13b2a4a2719302000000030b43026c26236925000400fe7f00000000000000003942cfd8880f0000bd2dca8a9848a3c728f1c46b7b31afdc1338d509a9a1f8baeb1898000000000100005a", 0x55}], 0x1}, 0x4000) write(r7, &(0x7f0000000040)="1c00000021002551071c0165ff00fc0202000000fd100f000ee1000c", 0x1c) ioctl$XFS_IOC_PATH_TO_FSHANDLE(r7, 0xc0385868, &(0x7f0000000640)={0xffffffffffffffff, &(0x7f0000000080)='*(]$!\x00', 0x40, &(0x7f0000000580)={@_ha_fsid={[0x1, 0x2]}, {0x809, 0x3, 0x82, 0x1}}, 0x4, &(0x7f00000005c0)={@_ha_fsid}, &(0x7f0000000600)=0xcf}) 834.16189ms ago: executing program 3 (id=6828): r0 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r0, &(0x7f0000000000)={0x18, 0x0, {0x3, @empty, 'ip6gre0\x00'}}, 0x1e) ioctl$PPPIOCGCHAN(r0, 0x80047437, &(0x7f0000000040)) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) ioctl$PPPIOCNEWUNIT(r1, 0xc004743e, &(0x7f00000000c0)) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl(r2, 0x40047438, &(0x7f0000000040)) ioctl$PPPIOCCONNECT(r2, 0x4004743a, &(0x7f00000000c0)) write$ppp(r1, &(0x7f0000000180)='\x00\x00', 0x2) ioctl$PPPIOCCONNECT(r2, 0x4004743a, &(0x7f0000000080)) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000200)={r0, 0xffffffffffffffff}, 0x4) r4 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000340)=@o_path={&(0x7f0000000300)='./file0\x00', 0x0, 0xc018, r2}, 0x18) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000040)={'dummy0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=@newqdisc={0x24, 0x25, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r6, {0x0, 0x10}, {0xffff, 0xffff}}}, 0x24}}, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(r0, 0xc020f509, &(0x7f00000005c0)={r1, 0x5, 0x3}) r8 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000600)={0xffffffffffffffff, 0x5}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000006c0)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000000640), &(0x7f0000000680)}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000780)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000000700), &(0x7f0000000740)}, 0x20) r11 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000800)=@o_path={&(0x7f00000007c0)='./file0\x00', 0x0, 0x4010, r2}, 0x18) r12 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000840)={0x2, 0x4, 0x8, 0x1, 0x80, 0x1, 0x7, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x2, 0x2}, 0x50) r13 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000900)=@o_path={&(0x7f00000008c0)='./file0\x00', 0x0, 0x8, r1}, 0x18) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000940)={0x1, 0xffffffffffffffff}, 0x4) bpf$PROG_LOAD(0x5, &(0x7f0000000a40)={0x2a, 0x17, &(0x7f0000000440)=@raw=[@map_idx={0x18, 0xb, 0x5, 0x0, 0xf}, @ldst={0x1, 0x2, 0x8518a47e5a137212, 0x8, 0xb, 0x50, 0x1}, @kfunc={0x85, 0x0, 0x2, 0x0, 0x4}, @exit, @snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x800}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r3}}, @map_idx_val={0x18, 0x2, 0x6, 0x0, 0xd, 0x0, 0x0, 0x0, 0xfffff346}, @call={0x85, 0x0, 0x0, 0x94}, @map_fd={0x18, 0x5, 0x1, 0x0, r4}], &(0x7f0000000500)='syzkaller\x00', 0x0, 0x39, &(0x7f0000000540)=""/57, 0x41100, 0x2d, '\x00', r6, @fallback=0x22, r0, 0x8, &(0x7f0000000580)={0x9, 0x1}, 0x8, 0x10, 0x0, 0x0, 0x0, r7, 0x8, &(0x7f0000000980)=[r8, r9, r10, r11, r12, r0, r13, r14], &(0x7f00000009c0)=[{0x1, 0x2, 0x8}, {0x5, 0x3, 0xa, 0x5}, {0x4, 0x1, 0x8, 0xb}, {0x0, 0x3, 0x2, 0x7}, {0x2, 0x3, 0x8, 0x5}, {0x3, 0x4, 0x8, 0x7}, {0x4, 0x3, 0xa, 0x4}, {0x5, 0x1, 0xa, 0x6}], 0x10, 0x3}, 0x94) r15 = syz_init_net_socket$x25(0x9, 0x5, 0x0) setsockopt$SO_ATTACH_FILTER(r15, 0x1, 0x1a, &(0x7f0000000400)={0x2, &(0x7f00000003c0)=[{0x5, 0x9, 0xf2}, {0x6, 0x5, 0x80, 0x7f}]}, 0x10) r16 = socket$nl_generic(0x10, 0x3, 0x10) r17 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240), 0xffffffffffffffff) sendmsg$IPVS_CMD_GET_SERVICE(r16, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)={0x44, r17, 0x711, 0x70bd25, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_DAEMON={0xc, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e24}]}, @IPVS_CMD_ATTR_SERVICE={0xc, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_TIMEOUT={0x8}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x1}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x9}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x4}]}, 0x44}, 0x1, 0x0, 0x0, 0x24044894}, 0x0) 758.207166ms ago: executing program 1 (id=6829): getsockopt$inet_sctp6_SCTP_AUTO_ASCONF(0xffffffffffffffff, 0x84, 0x1e, 0x0, 0x0) (async) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x1}) (async) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'syzkaller0\x00', 0x0}) (async) bpf$MAP_CREATE_RINGBUF(0x0, 0x0, 0x0) r3 = socket$inet(0x2, 0x2, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="b8000000"], 0xb8}}, 0x0) (async) r4 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r4, 0x89f2, 0x0) (async) sendmsg$inet(r4, &(0x7f00000052c0)={&(0x7f0000003fc0)={0x2, 0x4e21, @local}, 0x10, 0x0, 0x0, &(0x7f00000050c0)=[@ip_retopts={{0x2c, 0x0, 0x7, {[@cipso={0x86, 0x1b, 0xffffffffffffffff, [{0x2, 0x4, "dadd"}, {0x2, 0x11, "90261cf17d180c5deb1100b4cd8cc3"}]}]}}}], 0x30}, 0x40) (async) r5 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r5, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) getsockopt$inet_sctp6_SCTP_PR_SUPPORTED(r5, 0x84, 0x71, &(0x7f00000003c0)={r6, 0x68}, &(0x7f0000000400)=0x8) (async) ioctl$sock_inet_SIOCSIFFLAGS(r3, 0x8914, &(0x7f00000000c0)={'syzkaller0\x00', 0x1}) (async) sendmsg$nl_route_sched(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=@newqdisc={0x30, 0x24, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {0x0, 0xffff}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) (async) sendmsg$nl_route_sched(r1, &(0x7f0000000800)={0x0, 0x0, &(0x7f0000000600)={&(0x7f00000003c0)=@newtfilter={0x8c, 0x2c, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {0x1}, {0x0, 0xffff}, {0x300, 0x1}}, [@filter_kind_options=@f_basic={{0xa}, {0x5c, 0x2, [@TCA_BASIC_ACT={0x58, 0x3, [@m_nat={0x54, 0x1, 0x0, 0x0, {{0x8}, {0x2c, 0x2, 0x0, 0x1, [@TCA_NAT_PARMS={0x28, 0x1, {{0x1, 0x5, 0x1, 0x0, 0x100}, @local, @local, 0xff}}]}, {0x4}, {0xc}, {0xc}}}]}]}}]}, 0x8c}}, 0x0) (async) write$tun(r0, &(0x7f0000005880)=ANY=[], 0x40) 737.838393ms ago: executing program 2 (id=6830): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000d40)={{r0, 0xffffffffffffffff}, &(0x7f0000000cc0), &(0x7f0000000000)='%pK \x00'}, 0x20) r2 = openat$nci(0xffffffffffffff9c, &(0x7f00000002c0), 0x2, 0x0) ioctl$IOCTL_GET_NCIDEV_IDX(r2, 0x0, &(0x7f0000000040)=0x0) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nfc(&(0x7f0000000080), r4) sendmsg$NFC_CMD_DEV_UP(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x1c, r5, 0x1, 0x123, 0x234, {}, [@NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r3}]}, 0x1c}}, 0x0) write$nci(r2, &(0x7f0000000880)=@NCI_OP_NFCEE_DISCOVER_NTF={0x2, 0x1, 0x3, 0x0, 0x5, {0x1, 0x9, "189bcc"}}, 0x8) write$nci(r2, &(0x7f0000000300)=@NCI_OP_RF_DISCOVER_MAP_RSP={0x1, 0x0, 0x2, 0x0, 0x1}, 0x4) sendmsg$NFC_CMD_START_POLL(r4, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000480)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="010023010000340200400600000008000100", @ANYRES32=r3, @ANYBLOB='\b\x00\r\x00m'], 0x24}, 0x1, 0x0, 0x0, 0x44000}, 0x0) write$nci(r2, &(0x7f0000000300)=@NCI_OP_CORE_SET_CONFIG_RSP={0x0, 0x0, 0x2, 0x2, 0x2}, 0x5) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000480)={r0}, 0x4) bpf$TOKEN_CREATE(0x24, &(0x7f00000001c0)={0x0, r1}, 0x8) r6 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000002c0)={0x1b, 0x0, 0x0, 0x8, 0x0, 0x1, 0x8, '\x00', 0x0, 0xffffffffffffffff, 0x2, 0x5, 0x4}, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000440)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f00000003c0), &(0x7f0000000400)}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x3, 0x19, &(0x7f00000004c0)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x2}, {{0x18, 0x1, 0x1, 0x0, r6}}, {}, [@exit, @map_val={0x18, 0xb, 0x2, 0x0, r0, 0x0, 0x0, 0x0, 0x8f9}, @ringbuf_query={{0x18, 0x1, 0x1, 0x0, r7}}, @exit, @map_fd={0x18, 0x4, 0x1, 0x0, r0}], {{}, {}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r8, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000280)={0x24, r9, 0x1, 0x70bd2b, 0x25dfdbff, {}, [@NL80211_ATTR_REG_ALPHA2={0x7, 0x21, 'bb\x00'}, @NL80211_ATTR_USER_REG_HINT_TYPE={0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x80}, 0x8840) r10 = socket$rxrpc(0x21, 0x2, 0xa) getpeername(r10, &(0x7f0000000100)=@un=@abs, &(0x7f0000000180)=0x80) 666.270002ms ago: executing program 4 (id=6831): r0 = socket$netlink(0x10, 0x3, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f0000000080)='cgroup.kill\x00', 0x275a, 0x0) write$cgroup_subtree(r2, &(0x7f0000000900)=ANY=[@ANYRESOCT, @ANYRESDEC], 0x44) r3 = socket(0x10, 0x803, 0x0) sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r3, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x1c}}, 0x0) getsockname$packet(r3, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32=r4, @ANYBLOB="f5ff0f00252155b21c0012000c000100626f6e64000000000c0002000800010001"], 0x3c}}, 0x40000) r5 = socket$igmp6(0xa, 0x3, 0x2) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000001c0)={0x3, 0xc, &(0x7f0000000140)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x30}, @printk={@lld, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x7b}}]}, &(0x7f0000000040)='syzkaller\x00'}, 0xce) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r6, 0x0, 0xe, 0x0, &(0x7f0000000100)="0000000000000000000051229dc9", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) setsockopt$IP6T_SO_SET_REPLACE(r5, 0x29, 0x40, &(0x7f0000000440)=@raw={'raw\x00', 0x8, 0x3, 0x4c8, 0x170, 0xffffffff, 0xffffffff, 0x170, 0xffffffff, 0x3f8, 0xffffffff, 0xffffffff, 0x3f8, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'dvmrp1\x00'}, 0x0, 0x120, 0x170, 0x0, {}, [@common=@unspec=@helper={{0x48}}, @common=@inet=@hashlimit1={{0x58}, {'bond_slave_1\x00', {0x41, 0x1ff, 0x6, 0xb0e2, 0x10001, 0x84e, 0xfffffffb, 0x18, 0x8}, {0x1}}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'erspan0\x00', 'gre0\x00'}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'vcan0\x00', {0x3, 0x0, 0x41, 0x0, 0x2, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x528) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket(0x10, 0x803, 0x2) syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), r8) getsockname$packet(r8, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r7, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=@newlink={0x3c, 0x10, 0x403, 0x78bd28, 0x0, {0x0, 0x0, 0x0, 0x0, 0x90646}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r9}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4e00}, 0x0) syz_emit_ethernet(0x21, &(0x7f0000001a40)={@local, @empty, @void, {@llc_tr={0x11, {@snap={0xaa, 0x0, "e3", "dc094a", 0x22eb, "81b5be3181fd3b87d0a0a7"}}}}}, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000280)={&(0x7f0000000780)=ANY=[@ANYBLOB="9feb01001800000000000000280000002800000002000000000000000000000105000000000000000000000001000085000000000000000001"], 0x0, 0x42}, 0x28) sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000680)=ANY=[@ANYBLOB="3c00000010000305000000000007000000000000", @ANYRES32=0x0, @ANYBLOB="0000000006100000140012800b00010062726964676500000400028008000a00", @ANYRES32=r4], 0x3c}, 0x1, 0x0, 0x0, 0x800}, 0x440b0) 516.39416ms ago: executing program 1 (id=6832): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0xa, 0x28e6, 0x50, 0x7, 0x0, 0x1}, 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001940)={{r0}, &(0x7f0000000300), &(0x7f0000000440), 0x2}, 0x20) getpeername$packet(0xffffffffffffffff, &(0x7f0000000080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000140)=0x14) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x10, &(0x7f00000000c0)=@raw=[@cb_func={0x18, 0x5, 0x4, 0x0, 0x7}, @jmp={0x5, 0x0, 0x4, 0x4, 0x7, 0x8, 0x4}, @snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x6}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r0}}], &(0x7f0000000040)='syzkaller\x00', 0xffffffff, 0x0, 0x0, 0x0, 0x0, '\x00', r1, @xdp=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 504.974297ms ago: executing program 3 (id=6833): bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000b00)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], &(0x7f00000002c0)='syzkaller\x00'}, 0x94) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, 0x0, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000300)=ANY=[@ANYBLOB=',\x00\x00\x00'], 0x2c}}, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000100)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(r1, &(0x7f0000000700)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=ANY=[@ANYBLOB='H\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010029bd72007bdbdf253900000008000300", @ANYRES32=r3, @ANYBLOB="2c005a8028000380240008"], 0x48}, 0x1, 0x0, 0x0, 0x40000}, 0x0) sendmsg$NL80211_CMD_UPDATE_FT_IES(0xffffffffffffffff, &(0x7f00000004c0)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000480)={&(0x7f0000000500)={0xc0, r2, 0x100, 0x70bd27, 0x25dfdbfe, {{}, {@val={0x8}, @val={0xc, 0x99, {0x2, 0x29}}}}, [@NL80211_ATTR_MDID={0x6, 0xb1, 0x7}, @NL80211_ATTR_IE={0x78, 0x2a, [@mesh_config={0x71, 0x7, {0x0, 0x1, 0xffffffffffffffff, 0x1, 0x0, 0xf, 0x40}}, @mic={0x8c, 0x18, {0xf02, "e98c9931c0aa", @long="4fa4738ec7fb995974194669e6ad9ba1"}}, @link_id={0x65, 0x12, {@from_mac=@broadcast, @device_b, @broadcast}}, @tim={0x5, 0x2e, {0x31, 0x4a, 0x57, "db40fd5900058a0e3ae068dba2ae97e1716bb5c32c54cd34a6e61e9fe022ff57657d1ac73e1b8ac108491c"}}, @measure_req={0x26, 0x3, {0xf9, 0x5}}, @erp={0x2a, 0x1, {0x1, 0x1, 0x1}}, @channel_switch={0x25, 0x3, {0x0, 0x57638426e754306d, 0x3}}]}, @NL80211_ATTR_MDID={0x6, 0xb1, 0x3}, @NL80211_ATTR_MDID={0x6, 0xb1, 0x2}, @NL80211_ATTR_MDID={0x6, 0xb1, 0x9}]}, 0xc0}, 0x1, 0x0, 0x0, 0x20050010}, 0x4000) 246.351154ms ago: executing program 1 (id=6834): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x82ac2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x20}) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000070000000900010073797a30000000003c000000090a010400000000000000000700000008000a40000000000900020073797a31000000000900010073797a30000000000800054000000021501700001e0a05010000000000000000070000000900020073797a31000000000900010073797a300000000024170380300000802c000180250001007bb0c03ce8ed22d039cce454fd98ae614b08a9f3d4ddf1f742d55995afac076948000000f01600800c00054000000000000000000c00054000000000000000000c00044000000000000000000c00044000000000000000000600064019d20000ac0201802800028008000340000000000900020073797a3100000000080003400000000008000180000000003800028008000340000000000800018000000000080003400000000008000340000000000900020073797a300000000008000340000000002c00028008000340000000000900020073797a31000000000900020073797a32000000000800034000000000d0000100b408b1e286b5c8f7a7321d1f80c982b3c96b4dac7dead86aceee30544dfdb289f2cae899fc3fe86ee3f122505d76d6b5878270ecb40c37908d60b9ed31d97a3e0ee856f3cf3c2fdfee967991f8d1ef7fdce37b30f8842735e543ac808675a64f66eb37009373328ddf992e92b3a5765bd5f765d73c578babbb08efd7b59dab641a88f3099e34bb7fbc04cb298bb0df6eb0dc4ca79864758aff38b7192698c89435c5699f4a9222ad4a2c68c9356b741f04ef667f7a169b8976632c7cb98f18ba558bc302c7b73401c42a76160c0002800800034000000000440002800900020073797a310000000008000340000000000900020073797a32000000000900020073797a320000000008000180000000000900020073797a3200000000fc000100789be1642f8430c460e8692a8f8c45aaf3118316539052ba181a60f03707ec8179fd143ed6c4db73977b77f68686d2ec94b25435ecec60f6ac23db96833cbf99779e33db32e62fe3a078933d3c1122022952988b9550db169ecb6e39fd8720a05d3eeb5d40a7ab91f9b5565dc2b48c9ac61eefd9d0aab86e58ea1940d2240a851dbeabcf0b6cefba164663ad87cbcdb6aa1468529d1206b1fa3aa39118b45ab882df7fb2c6e9c25a706f99002cc42ee9b894b4bbfe66ce8fa1038566ae3407d5c80e28dc3911476785933d1ef923697a44a9cd4271d539e2ecc14d37a5e2074116425f0766b49a6febf9f1b8405ee9de1363b262f1be283921020180380002800900020073797a300000000008000340000000000900020073797a300000000008000180000000000900020073797a30000000003c0002800900020073797a320000000008000180000000000800018000000000080003400000000008000180000000000900020073797a3100000000380002800900020073797a300000000008000180000000000900020073797a320000000008000340000000000900020073797a320000000024000280d3fd0180000000000900020073797a32000000000900020073797a3000000000f3000100a6117a78b9e48d6dd9ad86fc2c54547cbee98c24f4b972c82722771febf3e388f9b3907852ee4adbd95ca25deb487ac3d49d3716931979f6bbf2b8cdcc0bc37f27a54709a59c31c01c5544b11cb9c6ca800d7f23c3cc5237458188f26a04c78ad8dfd3b13e958558dc3b7f0f4cfc16c4fd23e11b25bd23b195b64166e0c3a8ab3ebbd2ead4abf745bcf4d4b0610521d7ec52023ed38c7f9fb1cbab6a9d87c96fd783ff63f9483766557291fcc41f17c423550c1e965a66e30631b271db96cccb68bf8c91656e894ef46a296974170da742b0d13d665f0f2e80d3590b3dc637851b6e7b0adc59ab874ce337a258bc430008000340000000010c0004400000000000000001941001802c0001001943281e8af5fa4de43a18b194246a7a86da4a16357db4bc3d3edaccb333b121e8636c2e1c00e4e13c0002800900020073797a310000000008000340000000040900020073797a310000000008000340000000000800034000000003"], 0x17d4}}, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0xa, 0x3, 0x9) getsockopt$nfc_llcp(r3, 0x3a, 0x0, 0x0, 0x2000005d) bind$bt_hci(r3, &(0x7f0000000000)={0x1f, 0x4, 0x2}, 0x6) r4 = socket$unix(0x1, 0x1, 0x0) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000001280), r5) sendmsg$IEEE802154_LIST_IFACE(r5, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f00000012c0)={0x14, r6, 0x1, 0x70bd29, 0x25dfdbfc}, 0x14}, 0x1, 0x0, 0x0, 0x4}, 0x4) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000400)=ANY=[@ANYBLOB="3c0000002400050600"/20, @ANYRES32=r7, @ANYBLOB="00000000ffffffff000000000c00010063616b655f6d71000c00020008000900e8"], 0x3c}}, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x82ac2, 0x0) (async) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x20}) (async) socket$nl_netfilter(0x10, 0x3, 0xc) (async) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000070000000900010073797a30000000003c000000090a010400000000000000000700000008000a40000000000900020073797a31000000000900010073797a30000000000800054000000021501700001e0a05010000000000000000070000000900020073797a31000000000900010073797a300000000024170380300000802c000180250001007bb0c03ce8ed22d039cce454fd98ae614b08a9f3d4ddf1f742d55995afac076948000000f01600800c00054000000000000000000c00054000000000000000000c00044000000000000000000c00044000000000000000000600064019d20000ac0201802800028008000340000000000900020073797a3100000000080003400000000008000180000000003800028008000340000000000800018000000000080003400000000008000340000000000900020073797a300000000008000340000000002c00028008000340000000000900020073797a31000000000900020073797a32000000000800034000000000d0000100b408b1e286b5c8f7a7321d1f80c982b3c96b4dac7dead86aceee30544dfdb289f2cae899fc3fe86ee3f122505d76d6b5878270ecb40c37908d60b9ed31d97a3e0ee856f3cf3c2fdfee967991f8d1ef7fdce37b30f8842735e543ac808675a64f66eb37009373328ddf992e92b3a5765bd5f765d73c578babbb08efd7b59dab641a88f3099e34bb7fbc04cb298bb0df6eb0dc4ca79864758aff38b7192698c89435c5699f4a9222ad4a2c68c9356b741f04ef667f7a169b8976632c7cb98f18ba558bc302c7b73401c42a76160c0002800800034000000000440002800900020073797a310000000008000340000000000900020073797a32000000000900020073797a320000000008000180000000000900020073797a3200000000fc000100789be1642f8430c460e8692a8f8c45aaf3118316539052ba181a60f03707ec8179fd143ed6c4db73977b77f68686d2ec94b25435ecec60f6ac23db96833cbf99779e33db32e62fe3a078933d3c1122022952988b9550db169ecb6e39fd8720a05d3eeb5d40a7ab91f9b5565dc2b48c9ac61eefd9d0aab86e58ea1940d2240a851dbeabcf0b6cefba164663ad87cbcdb6aa1468529d1206b1fa3aa39118b45ab882df7fb2c6e9c25a706f99002cc42ee9b894b4bbfe66ce8fa1038566ae3407d5c80e28dc3911476785933d1ef923697a44a9cd4271d539e2ecc14d37a5e2074116425f0766b49a6febf9f1b8405ee9de1363b262f1be283921020180380002800900020073797a300000000008000340000000000900020073797a300000000008000180000000000900020073797a30000000003c0002800900020073797a320000000008000180000000000800018000000000080003400000000008000180000000000900020073797a3100000000380002800900020073797a300000000008000180000000000900020073797a320000000008000340000000000900020073797a320000000024000280d3fd0180000000000900020073797a32000000000900020073797a3000000000f3000100a6117a78b9e48d6dd9ad86fc2c54547cbee98c24f4b972c82722771febf3e388f9b3907852ee4adbd95ca25deb487ac3d49d3716931979f6bbf2b8cdcc0bc37f27a54709a59c31c01c5544b11cb9c6ca800d7f23c3cc5237458188f26a04c78ad8dfd3b13e958558dc3b7f0f4cfc16c4fd23e11b25bd23b195b64166e0c3a8ab3ebbd2ead4abf745bcf4d4b0610521d7ec52023ed38c7f9fb1cbab6a9d87c96fd783ff63f9483766557291fcc41f17c423550c1e965a66e30631b271db96cccb68bf8c91656e894ef46a296974170da742b0d13d665f0f2e80d3590b3dc637851b6e7b0adc59ab874ce337a258bc430008000340000000010c0004400000000000000001941001802c0001001943281e8af5fa4de43a18b194246a7a86da4a16357db4bc3d3edaccb333b121e8636c2e1c00e4e13c0002800900020073797a310000000008000340000000040900020073797a310000000008000340000000000800034000000003"], 0x17d4}}, 0x0) (async) socket$nl_route(0x10, 0x3, 0x0) (async) socket(0xa, 0x3, 0x9) (async) getsockopt$nfc_llcp(r3, 0x3a, 0x0, 0x0, 0x2000005d) (async) bind$bt_hci(r3, &(0x7f0000000000)={0x1f, 0x4, 0x2}, 0x6) (async) socket$unix(0x1, 0x1, 0x0) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$ieee802154(&(0x7f0000001280), r5) (async) sendmsg$IEEE802154_LIST_IFACE(r5, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f00000012c0)={0x14, r6, 0x1, 0x70bd29, 0x25dfdbfc}, 0x14}, 0x1, 0x0, 0x0, 0x4}, 0x4) (async) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) (async) sendmsg$nl_route(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000400)=ANY=[@ANYBLOB="3c0000002400050600"/20, @ANYRES32=r7, @ANYBLOB="00000000ffffffff000000000c00010063616b655f6d71000c00020008000900e8"], 0x3c}}, 0x0) (async) 143.988503ms ago: executing program 0 (id=6835): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0xe, 0x4, &(0x7f00000012c0)=@framed={{}, [@call={0x85, 0x0, 0x0, 0x8a}]}, &(0x7f0000000040)='GPL\x00', 0x4}, 0x90) socket(0x23, 0x5, 0x0) (async) r0 = socket(0x23, 0x5, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000280)={0x6, 0x7, &(0x7f0000000380)=ANY=[@ANYBLOB="18000000610600000000000007000000181400002f43585bf48d113de90f19e3ba8c00aad1667423c8d02a153506c50b1af0ca0056fbbd6eeb395930d815674622ab8301204505493578801d61d84b9bcee22f0fd666e17e0da0684b09bf347b1f04ea0d835978cad2ff2ff204218dba0f1f8f4edf641b8994eaf21d9c1dce1c04b36d546e3aac3f8df80f2ab35dc3da", @ANYRES32, @ANYBLOB="0000000000000000183a00000200000000000000000000009500000000000000"], &(0x7f00000000c0)='GPL\x00', 0x3, 0x1e, &(0x7f0000000140)=""/30, 0x41100, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, &(0x7f0000000180)={0x6, 0x1}, 0x8, 0x10, &(0x7f00000001c0)={0x3, 0xa, 0x397, 0x7}, 0x10, 0x0, 0x0, 0x0, &(0x7f0000000240)=[r0], 0x0, 0x10, 0x80000000}, 0x94) (async) r2 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000280)={0x6, 0x7, &(0x7f0000000380)=ANY=[@ANYBLOB="18000000610600000000000007000000181400002f43585bf48d113de90f19e3ba8c00aad1667423c8d02a153506c50b1af0ca0056fbbd6eeb395930d815674622ab8301204505493578801d61d84b9bcee22f0fd666e17e0da0684b09bf347b1f04ea0d835978cad2ff2ff204218dba0f1f8f4edf641b8994eaf21d9c1dce1c04b36d546e3aac3f8df80f2ab35dc3da", @ANYRES32, @ANYBLOB="0000000000000000183a00000200000000000000000000009500000000000000"], &(0x7f00000000c0)='GPL\x00', 0x3, 0x1e, &(0x7f0000000140)=""/30, 0x41100, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, &(0x7f0000000180)={0x6, 0x1}, 0x8, 0x10, &(0x7f00000001c0)={0x3, 0xa, 0x397, 0x7}, 0x10, 0x0, 0x0, 0x0, &(0x7f0000000240)=[r0], 0x0, 0x10, 0x80000000}, 0x94) sendmsg$sock(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000200)="2e00000013000500000000000000000007010000100002007664706173696d5f626c6b000a000400766470613000", 0x2e}], 0x1}, 0x0) (async) sendmsg$sock(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000200)="2e00000013000500000000000000000007010000100002007664706173696d5f626c6b000a000400766470613000", 0x2e}], 0x1}, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r4 = openat$cgroup_pressure(r3, &(0x7f0000000040)='io.pressure\x00', 0x2, 0x0) write$cgroup_pressure(r4, &(0x7f0000000080)={'some', 0x20, 0x2000000008, 0x20, 0x10000000fffff}, 0x2f) close(0x4) ioctl$XFS_IOC_FD_TO_HANDLE(0xffffffffffffffff, 0xc038586a, &(0x7f00000005c0)={r2, &(0x7f0000000040)='GPL\x00', 0x507141, &(0x7f0000000500)={@_ha_fsid={[0x6, 0x101]}, {0x1003, 0xd, 0x10001}}, 0x5, &(0x7f0000000540)={@_ha_fsid}, &(0x7f0000000580)=0x81}) socket$nl_netfilter(0x10, 0x3, 0xc) (async) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000006c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01040000000000000000010000030900010073797a30000000002c000000030a01010000000000000000010000000900010073797a30000000000900030073797a320000000098000000060a010400000000000000000100000208000b400000000070000480340001800b000100657874686472000024000280080001400000000c080003400000000208000440000000220500020007000000380001800c0001006269747769736500280002800800034000000002080001400000001408000240000000120400078008000640000000020900010073797a3000000000140000001100010000000000000000000700000a80122fd77461bd6fbbb419aaa17082af865ce00afcb714ddb674eac92fef1ccfdf7eefbfe9f32d37ed74cf82e7fc32854ff7e1e6b4e977c28e8c30f3bac278de31db02451cb142de1f619f4646aa2caff2bd55be12314778cc94924549bf5a08d3d3b404e7b4cbe5794ec26e9cf39ceba39ac72ff22d9ae663822e955c028077d154f1cfc8c905ad25d4eb526ee96c57dc8f857b9c5a00d6dc0d7892db8d697e0da02c397a24a4ab3416eb9a99e0a24813bf95214d9433a2ff520869d5e4b4c98277c7"], 0x10c}}, 0x40000) (async) sendmsg$NFT_BATCH(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000006c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01040000000000000000010000030900010073797a30000000002c000000030a01010000000000000000010000000900010073797a30000000000900030073797a320000000098000000060a010400000000000000000100000208000b400000000070000480340001800b000100657874686472000024000280080001400000000c080003400000000208000440000000220500020007000000380001800c0001006269747769736500280002800800034000000002080001400000001408000240000000120400078008000640000000020900010073797a3000000000140000001100010000000000000000000700000a80122fd77461bd6fbbb419aaa17082af865ce00afcb714ddb674eac92fef1ccfdf7eefbfe9f32d37ed74cf82e7fc32854ff7e1e6b4e977c28e8c30f3bac278de31db02451cb142de1f619f4646aa2caff2bd55be12314778cc94924549bf5a08d3d3b404e7b4cbe5794ec26e9cf39ceba39ac72ff22d9ae663822e955c028077d154f1cfc8c905ad25d4eb526ee96c57dc8f857b9c5a00d6dc0d7892db8d697e0da02c397a24a4ab3416eb9a99e0a24813bf95214d9433a2ff520869d5e4b4c98277c7"], 0x10c}}, 0x40000) sendmsg$NLBL_CALIPSO_C_ADD(r1, &(0x7f00000008c0)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000480)={0x2c, 0x0, 0x20, 0x70bd26, 0x25dfdbfc, {}, [@NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_DOI={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x800}, 0x4008081) setsockopt$RXRPC_SECURITY_KEY(r0, 0x110, 0x1, &(0x7f0000000340)='\x00', 0x1) bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0xe, 0x6, &(0x7f0000000000)=ANY=[@ANYBLOB="0500000000000000711184000000000085100000020000008500000048000000950000000000000095009d0500000000"], &(0x7f0000000080)='GPL\x00', 0x5, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x6}, 0x94) 0s ago: executing program 4 (id=6836): r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="9feb010018000000000000004c0000004c0000001c000000050000000000000104000000200000000500000001000004040000000100000001000000000000001800000002000004080000001300000001000000000000000100000002000000200000000076616c006270665f7370696e5f6c6f636b006c6f636b0066"], 0x0, 0x80}, 0x28) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x5, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18080000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000700000095"], &(0x7f00000000c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$XFS_IOC_START_COMMIT(r0, 0x80585882, &(0x7f0000000840)={0xffffffffffffffff}) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000100), 0xffffffffffffffff) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_PRIVFLAGS_SET(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000180)=ANY=[@ANYBLOB="14000000", @ANYRES16=r3, @ANYBLOB="05fb00ffffffffffffff1f"], 0x18}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000900)={0x11, 0x0, 0x0}, &(0x7f0000000940)=0x14) sendmsg$ETHTOOL_MSG_LINKMODES_GET(r2, &(0x7f0000000a40)={&(0x7f00000008c0)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000a00)={&(0x7f0000000980)={0x44, r3, 0x400, 0x70bd2a, 0x25dfdbff, {}, [@HEADER={0x30, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'wlan0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r5}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x4}]}]}, 0x44}, 0x1, 0x0, 0x0, 0x240000c0}, 0x20000080) socket$inet6_sctp(0xa, 0x1, 0x84) r6 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r6, 0x8933, &(0x7f0000000100)={'vcan0\x00', 0x0}) connect$can_bcm(r6, &(0x7f00000000c0)={0x1d, r7}, 0x10) sendmsg$can_bcm(r6, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000003c0)=ANY=[@ANYBLOB="01000000000000000000001000000000", @ANYRES64=0x0, @ANYRES64=0x2710, @ANYRES64=0x0, @ANYRES64=0x0, @ANYBLOB="0000000001"], 0x48}}, 0x4008004) sendmsg$can_bcm(r6, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000740)=ANY=[@ANYBLOB="01000000000000000000004a51000000", @ANYRES64, @ANYRESDEC, @ANYRES64=0x0, @ANYRES64=r1], 0x48}}, 0x0) r8 = socket$inet_tcp(0x2, 0x1, 0x0) sendmsg$inet(r6, &(0x7f0000000800)={&(0x7f0000000140)={0x2, 0x4e20, @multicast1}, 0x10, &(0x7f0000000780)=[{&(0x7f0000000240)="0ca639ae316991db5ad2d9cf972771e929faa1ee589b6bd15b2574d9d09d73d55208cd60d258c5a6a77d058b95f1631bf690655132c8f5c4acc5d3ff0706ba26bf802e4245231f805e35d79cffa1b9b6b2fafe859a0184edc1af1510bf4921476b4f50908ea5247274e6f59d225e2a9bc75f3fe3cef6d0a54ec1323d18d0cc3cc2f456a2e15a39bf379ddd743b3b9e", 0x8f}, {&(0x7f0000000480)="7db08f98eda8c930e8ebc87e405eabff32f0143f8b24d4e8b6022691bdb6b4e7a6d910a5536da51f2153dd7a4b86c024a674db02b2c6a2f1199d334125f7fb7fd58bf95005da40b04e75216815d3b317a4c0d36a2ba83320505a245d7268ecb4f5f3baba3be0b4d427f43c472429ad8784ffc60d6cc88793def36255fe80c09f3bee75a70ec59c96f15ee1dee356e45e7a991481979ebe8d99cc0a9c3a93d22ba94a117732", 0xa5}, {&(0x7f0000000540)="fce27de5f4f557b24b3ba3e63a0cae516aeb4c27cb359ca233", 0x19}, {&(0x7f0000000580)="15c809695eb88d48e8cb4a2f754464449232b958c841aa72c99cff07007ef7bde46256be836c2b7c141c33ce9c8827236c1ec27782cc70e526028ca48f908458064161dbdf3722aca09fb07973e796c8f5771d965beb8d0e6b13ae531d6011c8a7343dbff4b08bbae1156622e153f93ea7550d93b65ac9ce8b2cdb25869d3e9ec38f675aeccdb041a273b47827e4610098893a5553aef486e7b66931324f626aadb30db0f1e9835ff22303779f7485a7ac182820ce6f98bc7e205f915cd4a3b2c80e24eeaf484ab3fbb836ced61b887049beeaa01a3cc5b572e65446bb9bbe7165eece867a066b9011d58e88a56736f8f384969521594442442e9346d4fb", 0xfe}], 0x4, &(0x7f00000007c0)}, 0x20040800) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r8, 0x6, 0x14, &(0x7f0000000080)=0x2, 0x4) kernel console output (not intermixed with test programs): on all matching packets. [ 738.254647][T26973] syzkaller0: entered promiscuous mode [ 738.254673][T26973] syzkaller0: entered allmulticast mode [ 738.292551][T26979] netlink: 16 bytes leftover after parsing attributes in process `syz.4.5615'. [ 738.449425][T26989] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5618'. [ 738.450173][T26989] netlink: 12 bytes leftover after parsing attributes in process `syz.0.5618'. [ 738.467119][T26987] netlink: 12 bytes leftover after parsing attributes in process `syz.0.5618'. [ 738.467146][T26987] block nbd8: Unsupported socket: should be TCP or UNIX. [ 738.473520][T26990] netlink: 36 bytes leftover after parsing attributes in process `syz.0.5618'. [ 738.490114][T26991] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 738.580483][ T12] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 738.677031][T26996] netlink: 12 bytes leftover after parsing attributes in process `syz.1.5621'. [ 738.795003][T27004] bridge0: port 2(bridge_slave_1) entered disabled state [ 739.086589][T18851] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 739.110874][T27028] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 739.275522][T27033] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 739.282559][ T5622] Bluetooth: hci5: ACL packet for unknown connection handle 3484 [ 739.552799][T27053] A link change request failed with some changes committed already. Interface wg2 may have been left with an inconsistent configuration, please check. [ 740.119808][T18855] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 741.655540][T19064] udevd[19064]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 741.684073][T19064] udevd[19064]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 741.852535][T27156] __nla_validate_parse: 7 callbacks suppressed [ 741.852556][T27156] netlink: 28 bytes leftover after parsing attributes in process `syz.0.5669'. [ 742.024126][T27163] netlink: 4 bytes leftover after parsing attributes in process `syz.3.5673'. [ 742.294318][T27180] netlink: 40 bytes leftover after parsing attributes in process `syz.4.5676'. [ 742.430205][T27184] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5678'. [ 742.714085][T27202] syzkaller1: entered promiscuous mode [ 742.714112][T27202] syzkaller1: entered allmulticast mode [ 743.232450][T18855] net_ratelimit: 10 callbacks suppressed [ 743.232467][T18855] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 743.309324][T27228] netlink: 24 bytes leftover after parsing attributes in process `syz.4.5691'. [ 743.709509][ T13] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 743.781276][T27244] netlink: 'syz.3.5696': attribute type 10 has an invalid length. [ 743.782766][T27244] dummy0: left promiscuous mode [ 743.815380][T27244] team0: Port device dummy0 added [ 744.037121][T27257] netlink: 12 bytes leftover after parsing attributes in process `syz.3.5696'. [ 744.037146][T27257] netlink: 12 bytes leftover after parsing attributes in process `syz.3.5696'. [ 744.037210][T27257] vlan0: entered promiscuous mode [ 744.097757][T27257] netlink: Unknown conntrack attr (type=8198, max=9) [ 744.097804][T27257] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 744.152526][T27262] Bluetooth: hci0: unsupported parameter 5161 [ 744.152561][T27262] Bluetooth: hci0: unsupported parameter 8192 [ 744.152575][T27262] Bluetooth: hci0: unsupported parameter 5161 [ 744.152587][T27262] Bluetooth: hci0: unsupported parameter 8192 [ 744.193089][T27264] netlink: 'syz.1.5703': attribute type 1 has an invalid length. [ 744.267981][T18855] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 744.282779][T27264] 8021q: adding VLAN 0 to HW filter on device bond11 [ 744.285387][T27264] netlink: 'syz.1.5703': attribute type 1 has an invalid length. [ 744.285614][T27264] netlink: 'syz.1.5703': attribute type 1 has an invalid length. [ 744.314060][T27264] netlink: 'syz.1.5703': attribute type 1 has an invalid length. [ 744.314340][T27264] netlink: 'syz.1.5703': attribute type 1 has an invalid length. [ 744.315774][T27264] netlink: 'syz.1.5703': attribute type 1 has an invalid length. [ 744.316032][T27264] netlink: 'syz.1.5703': attribute type 1 has an invalid length. [ 744.316276][T27264] netlink: 'syz.1.5703': attribute type 1 has an invalid length. [ 744.356228][T27264] netlink: 'syz.1.5703': attribute type 1 has an invalid length. [ 744.357902][T27269] netlink: 40 bytes leftover after parsing attributes in process `syz.4.5704'. [ 744.889573][T27293] netlink: 4 bytes leftover after parsing attributes in process `syz.3.5713'. [ 744.889601][T27293] openvswitch: netlink: Flow actions attr not present in new flow. [ 745.005010][T27298] netlink: 72 bytes leftover after parsing attributes in process `syz.1.5715'. [ 745.311973][T18855] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 745.636273][ T1963] block nbd2: Possible stuck request ffff888027155080: control (read@0,4096B). Runtime 210 seconds [ 746.263973][ T12] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 746.357535][T18854] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 746.669739][T27382] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 746.916449][T27382] bond12 (unregistering): Released all slaves [ 747.546360][ T1313] ieee802154 phy0 wpan0: encryption failed: -22 [ 747.985690][T27426] tipc: Enabling of bearer rejected, failed to enable media [ 748.122268][T27426] __nla_validate_parse: 3 callbacks suppressed [ 748.122291][T27426] netlink: 14 bytes leftover after parsing attributes in process `syz.3.5745'. [ 748.160708][T27426] team0: Port device dummy0 removed [ 748.196506][ T12] tipc: Resetting bearer [ 748.257363][T27439] net_ratelimit: 28 callbacks suppressed [ 748.257385][T27439] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 748.257668][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 748.281402][T27437] FAULT_INJECTION: forcing a failure. [ 748.281402][T27437] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 748.281434][T27437] CPU: 1 UID: 0 PID: 27437 Comm: syz.0.5750 Not tainted syzkaller #0 PREEMPT(full) [ 748.281454][T27437] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 748.281465][T27437] Call Trace: [ 748.281472][T27437] [ 748.281480][T27437] dump_stack_lvl+0xe8/0x150 [ 748.281512][T27437] should_fail_ex+0x410/0x560 [ 748.281538][T27437] _copy_from_user+0x2d/0xb0 [ 748.281562][T27437] ___sys_recvmsg+0x173/0x5a0 [ 748.281592][T27437] ? __pfx____sys_recvmsg+0x10/0x10 [ 748.281621][T27437] ? lock_acquire+0x115/0x350 [ 748.281658][T27437] ? __fget_files+0x3a2/0x420 [ 748.281692][T27437] __x64_sys_recvmsg+0x1ae/0x290 [ 748.281719][T27437] ? __pfx___x64_sys_recvmsg+0x10/0x10 [ 748.281764][T27437] do_syscall_64+0x166/0x520 [ 748.281784][T27437] ? trace_irq_disable+0x3b/0x140 [ 748.281801][T27437] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 748.281819][T27437] ? clear_bhb_loop+0x70/0xc0 [ 748.281841][T27437] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 748.281858][T27437] RIP: 0033:0x7fa32439e159 [ 748.281875][T27437] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 748.281890][T27437] RSP: 002b:00007fa325249028 EFLAGS: 00000246 ORIG_RAX: 000000000000002f [ 748.281910][T27437] RAX: ffffffffffffffda RBX: 00007fa324625fa0 RCX: 00007fa32439e159 [ 748.281922][T27437] RDX: 0000000000000002 RSI: 0000200000002380 RDI: 0000000000000005 [ 748.281933][T27437] RBP: 00007fa325249090 R08: 0000000000000000 R09: 0000000000000000 [ 748.281944][T27437] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 748.281954][T27437] R13: 00007fa324626038 R14: 00007fa324625fa0 R15: 00007ffe58e39e98 [ 748.281984][T27437] [ 748.282611][T27436] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 748.283002][T27436] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 748.426983][T18855] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 748.445272][T27443] netlink: 3 bytes leftover after parsing attributes in process `syz.1.5751'. [ 748.510740][T27447] tipc: Enabling of bearer rejected, media not registered [ 748.594360][T27450] netlink: 16179 bytes leftover after parsing attributes in process `syz.3.5752'. [ 748.663502][T27459] netlink: 56 bytes leftover after parsing attributes in process `syz.0.5756'. [ 748.696922][T27459] nbd: must specify at least one socket [ 748.845418][T27467] IPVS: set_ctl: invalid protocol: 0 10.1.1.0:20004 [ 749.022116][T27469] vlan2: entered allmulticast mode [ 749.022145][T27469] netdevsim netdevsim3 netdevsim0: entered allmulticast mode [ 749.117811][T27472] Cannot find add_set index 65532 as target [ 749.152859][T27477] bond3: option primary: mode dependency failed, not supported in mode balance-rr(0) [ 749.256083][T27477] bond3 (unregistering): Released all slaves [ 749.423232][ T4935] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 749.440102][ T4935] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 749.442345][ T4935] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 749.448200][ T4935] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 749.457856][ T4935] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 749.470056][ T12] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 749.481316][T18855] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 749.835417][T27496] tipc: Resetting bearer [ 749.837007][T27500] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5768'. [ 749.855643][T27496] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 749.965196][T27500] bridge_slave_0: left allmulticast mode [ 749.965227][T27500] bridge_slave_0: left promiscuous mode [ 749.965496][T27500] bridge0: port 1(bridge_slave_0) entered disabled state [ 750.032693][T27500] bridge_slave_1: left allmulticast mode [ 750.032722][T27500] bridge_slave_1: left promiscuous mode [ 750.033022][T27500] bridge0: port 2(bridge_slave_1) entered disabled state [ 750.093322][T27500] team0: Port device team_slave_0 removed [ 750.116398][T27500] team0: Port device team_slave_1 removed [ 750.119204][T27500] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 750.119226][T27500] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 750.130701][T27500] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 750.300194][T27521] netlink: 165 bytes leftover after parsing attributes in process `syz.2.5772'. [ 750.481846][T27527] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5773'. [ 750.525874][T18855] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 750.626943][T27527] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5773'. [ 750.692422][ T13] netdevsim netdevsim0 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 750.692462][ T13] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 751.000869][ T13] netdevsim netdevsim0 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 751.000908][ T13] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 751.071898][T27552] netlink: 40 bytes leftover after parsing attributes in process `syz.4.5776'. [ 751.137818][T27552] netlink: 56 bytes leftover after parsing attributes in process `syz.4.5776'. [ 751.142147][T27550] xt_LOG: level 8 >= 8 [ 751.197416][ T13] netdevsim netdevsim0 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 751.197456][ T13] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 751.422594][T27484] wlan0 speed is unknown, defaulting to 1000 [ 751.480231][T27558] validate_nla: 60 callbacks suppressed [ 751.480253][T27558] netlink: 'syz.2.5777': attribute type 9 has an invalid length. [ 751.618672][ T5622] Bluetooth: hci4: command tx timeout [ 751.877451][T27572] tipc: Resetting bearer [ 752.122631][ T13] bridge_slave_1: left allmulticast mode [ 752.122754][ T13] bridge_slave_1: left promiscuous mode [ 752.123014][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 752.160262][ T13] bridge_slave_0: left allmulticast mode [ 752.160292][ T13] bridge_slave_0: left promiscuous mode [ 752.160528][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 752.845905][ T13] bond3 (unregistering): (slave xfrm1): Releasing backup interface [ 752.845926][ T13] xfrm1 (unregistering): left promiscuous mode [ 753.083005][ T13] .` (unregistering): (slave bond_slave_0): Releasing backup interface [ 753.084915][ T13] .` (unregistering): (slave bond_slave_1): Releasing backup interface [ 753.086659][ T13] .` (unregistering): (slave bond0): Releasing backup interface [ 753.118688][ T13] .` (unregistering): Released all slaves [ 753.123454][ T13] bond1 (unregistering): Released all slaves [ 753.154598][ T13] bond0 (unregistering): (slave macvlan1): Releasing backup interface [ 753.156077][ T13] veth1_vlan: left allmulticast mode [ 753.157221][ T13] bond0 (unregistering): Released all slaves [ 753.186062][ T13] bond2 (unregistering): Released all slaves [ 753.207172][ T13] bond3 (unregistering): Released all slaves [ 753.223877][ T13] bond4 (unregistering): Released all slaves [ 753.238174][ T13] bond5 (unregistering): Released all slaves [ 753.262057][ T13] bond6 (unregistering): Released all slaves [ 753.276716][ T13] bond7 (unregistering): Released all slaves [ 753.287902][ T13] bond8 (unregistering): Released all slaves [ 753.312731][ T13] bond9 (unregistering): Released all slaves [ 753.322980][ T13] bond10 (unregistering): Released all slaves [ 753.335842][ T13] bond11 (unregistering): Released all slaves [ 753.639483][ T13] : left promiscuous mode [ 753.704403][ T5622] Bluetooth: hci4: command tx timeout [ 753.825329][ T13] tipc: Left network mode [ 754.296836][T27484] bridge0: port 1(bridge_slave_0) entered blocking state [ 754.297043][T27484] bridge0: port 1(bridge_slave_0) entered disabled state [ 754.297260][T27484] bridge_slave_0: entered allmulticast mode [ 754.301515][T27484] bridge_slave_0: entered promiscuous mode [ 754.304398][T27484] bridge0: port 2(bridge_slave_1) entered blocking state [ 754.304562][T27484] bridge0: port 2(bridge_slave_1) entered disabled state [ 754.304687][T27484] bridge_slave_1: entered allmulticast mode [ 754.306544][T27484] bridge_slave_1: entered promiscuous mode [ 754.386698][T27484] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 754.417726][T27484] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 754.473090][T27484] team0: Port device team_slave_0 added [ 754.499753][T27484] team0: Port device team_slave_1 added [ 754.560926][T27484] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 754.560946][T27484] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 754.560970][T27484] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 754.563194][T27484] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 754.563210][T27484] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 754.563235][T27484] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 754.687767][ T5282] 8021q: adding VLAN 0 to HW filter on device eth1 [ 754.752201][T27484] hsr_slave_0: entered promiscuous mode [ 754.753336][T27484] hsr_slave_1: entered promiscuous mode [ 755.163879][ T13] hsr_slave_0: left promiscuous mode [ 755.164480][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 755.164494][ T13] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 755.239763][ T13] vlan0: left allmulticast mode [ 755.239789][ T13] v: left allmulticast mode [ 755.239847][ T13] vlan0: left promiscuous mode [ 755.240448][ T13] veth1_macvtap: left promiscuous mode [ 755.240475][ T13] veth0_macvtap: left promiscuous mode [ 755.240598][ T13] veth1_vlan: left promiscuous mode [ 755.240672][ T13] v: left promiscuous mode [ 755.788911][ T5622] Bluetooth: hci4: command tx timeout [ 756.652556][ T52] smc: removing ib device syz2 [ 756.800261][ T13] team0 (unregistering): Port device team_slave_1 removed [ 756.816378][ T13] team0 (unregistering): Port device team_slave_0 removed [ 756.970437][ T5282] 8021q: adding VLAN 0 to HW filter on device eth2 [ 756.979821][T24896] infiniband syz2: ib_query_port failed (-19) [ 757.220627][ T52] smbdirect: ib_dev[syz2] removed [ 757.859452][ T5622] Bluetooth: hci4: command tx timeout [ 758.187886][T27484] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 758.215562][T27484] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 758.218290][T27484] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 758.256771][T27484] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 758.264234][T27484] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 758.295231][T27484] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 758.299458][T27484] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 758.331403][T27484] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 758.611834][T27484] 8021q: adding VLAN 0 to HW filter on device bond0 [ 758.657493][T27484] 8021q: adding VLAN 0 to HW filter on device team0 [ 758.690739][T10100] bridge0: port 1(bridge_slave_0) entered blocking state [ 758.690850][T10100] bridge0: port 1(bridge_slave_0) entered forwarding state [ 758.712552][T10097] bridge0: port 2(bridge_slave_1) entered blocking state [ 758.712661][T10097] bridge0: port 2(bridge_slave_1) entered forwarding state [ 759.774396][T27484] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 759.922425][T27484] veth0_vlan: entered promiscuous mode [ 759.958723][T27484] veth1_vlan: entered promiscuous mode [ 760.014659][ T13] IPVS: stop unused estimator thread 0... [ 760.108992][T27484] veth0_macvtap: entered promiscuous mode [ 760.115459][T27484] veth1_macvtap: entered promiscuous mode [ 760.189901][T27484] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 760.213527][T27484] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 760.392993][T10099] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 760.393043][T10099] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 760.393078][T10099] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 760.393111][T10099] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 760.508274][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 760.508297][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 760.555316][T10100] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 760.555341][T10100] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 760.680441][T27705] tipc: Enabling of bearer rejected, failed to enable media [ 763.756132][ T4987] udevd[4987]: worker [16459] /devices/virtual/block/nbd2 timeout; kill it [ 763.756212][ T4987] udevd[4987]: seq 23912 '/devices/virtual/block/nbd2' killed [ 772.223232][T27821] netlink: 'syz.3.5788': attribute type 1 has an invalid length. [ 772.297314][T27826] bond1: entered promiscuous mode [ 772.515304][T27833] net_ratelimit: 4 callbacks suppressed [ 772.515325][T27833] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 772.654349][T27840] bridge_slave_0: left allmulticast mode [ 772.654382][T27840] bridge_slave_0: left promiscuous mode [ 772.654629][T27840] bridge0: port 1(bridge_slave_0) entered disabled state [ 772.671109][T27840] bridge_slave_1: left allmulticast mode [ 772.671135][T27840] bridge_slave_1: left promiscuous mode [ 772.674725][T27840] bridge0: port 2(bridge_slave_1) entered disabled state [ 772.716726][T27840] bond0: (slave bond_slave_0): Releasing backup interface [ 772.731196][T27840] bond0: (slave bond_slave_1): Releasing backup interface [ 772.776326][T27840] team0: Port device team_slave_0 removed [ 772.798118][T27840] team0: Port device team_slave_1 removed [ 772.800710][T27840] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 772.800733][T27840] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 772.806188][T27840] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 772.806209][T27840] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 772.822780][T27840] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 772.936615][T27856] netlink: NAT flags may be given only when NAT range (SRC or DST) is also specified. [ 772.936653][T27856] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 772.960622][T27847] 8021q: adding VLAN 0 to HW filter on device macsec2 [ 773.012531][T27848] syzkaller0: entered promiscuous mode [ 773.012557][T27848] syzkaller0: entered allmulticast mode [ 773.210679][T10099] netdevsim netdevsim4 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 773.210844][ T13] netdevsim netdevsim4 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 773.210882][ T13] netdevsim netdevsim4 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 773.274433][T27862] __nla_validate_parse: 3 callbacks suppressed [ 773.274456][T27862] netlink: 36 bytes leftover after parsing attributes in process `syz.4.5796'. [ 773.404800][T27865] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 773.466484][T27867] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5797'. [ 773.466523][T27867] netlink: 'syz.1.5797': attribute type 1 has an invalid length. [ 773.466537][T27867] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5797'. [ 773.466607][T27869] netlink: 'syz.4.5799': attribute type 1 has an invalid length. [ 773.466788][T27867] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5797'. [ 773.466811][T27867] netlink: 'syz.1.5797': attribute type 1 has an invalid length. [ 773.466823][T27867] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5797'. [ 773.612947][T27869] netlink: 'syz.4.5799': attribute type 1 has an invalid length. [ 773.614824][T27869] netlink: 'syz.4.5799': attribute type 1 has an invalid length. [ 773.758188][T27870] 8021q: adding VLAN 0 to HW filter on device bond10 [ 773.786452][T27870] bond9: (slave bond10): making interface the new active one [ 773.797589][T27870] bond9: (slave bond10): Enslaving as an active interface with an up link [ 773.797827][T27870] netlink: 'syz.4.5799': attribute type 1 has an invalid length. [ 773.798079][T27870] netlink: 'syz.4.5799': attribute type 1 has an invalid length. [ 773.798339][T27870] netlink: 'syz.4.5799': attribute type 1 has an invalid length. [ 773.817241][T27870] netlink: 'syz.4.5799': attribute type 1 has an invalid length. [ 773.863871][T27871] ipvlan2: entered allmulticast mode [ 773.863894][T27871] bond9: entered allmulticast mode [ 773.863906][T27871] bond10: entered allmulticast mode [ 773.864161][T27871] bond9: (slave ipvlan2): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 773.864179][T27871] bond9: (slave ipvlan2): The slave device specified does not support setting the MAC address [ 774.008129][T27883] ip6t_hbh: too many supported opts specified [ 774.104213][T27902] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 774.132662][T27905] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5805'. [ 774.498187][T27916] netlink: 9 bytes leftover after parsing attributes in process `syz.4.5809'. [ 774.522728][T27916] gretap0: entered promiscuous mode [ 774.536944][T27918] netlink: 244 bytes leftover after parsing attributes in process `syz.4.5809'. [ 774.545298][T27918] x_tables: duplicate entry at hook 1 [ 774.545473][T27919] netlink: 5 bytes leftover after parsing attributes in process `syz.4.5809'. [ 774.551975][T27919] 0ªî{X¹¦: renamed from gretap0 [ 774.577062][T27919] 0ªî{X¹¦: left promiscuous mode [ 774.577085][T27919] 0ªî{X¹¦: entered allmulticast mode [ 774.587097][T27919] A link change request failed with some changes committed already. Interface 30ªî{X¹¦ may have been left with an inconsistent configuration, please check. [ 775.016867][T27945] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 775.238689][T27952] netlink: 28 bytes leftover after parsing attributes in process `syz.2.5819'. [ 775.703202][ T1963] block nbd2: Possible stuck request ffff888027155080: control (read@0,4096B). Runtime 240 seconds [ 775.918057][T27989] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 776.221491][T27995] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 777.920359][T27935] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 778.234723][T28027] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 778.500963][T28039] validate_nla: 124 callbacks suppressed [ 778.500987][T28039] netlink: 'syz.1.5848': attribute type 1 has an invalid length. [ 778.798150][T28039] 8021q: adding VLAN 0 to HW filter on device bond12 [ 778.921750][T18856] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 778.924220][T28050] bond9: (slave bond10): Releasing backup interface [ 778.924248][T28050] bond10: left allmulticast mode [ 779.003322][T28064] bond12: (slave geneve2): making interface the new active one [ 779.035293][T28064] bond12: (slave geneve2): Enslaving as an active interface with an up link [ 779.111107][T28070] netdevsim netdevsim4: Direct firmware load for ÿ failed with error -2 [ 779.111136][T28070] netdevsim netdevsim4: Falling back to sysfs fallback for: ÿ [ 779.262117][T28072] __nla_validate_parse: 3 callbacks suppressed [ 779.262139][T28072] netlink: 196 bytes leftover after parsing attributes in process `syz.2.5857'. [ 779.308758][T18856] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 779.461201][T28080] netlink: 13 bytes leftover after parsing attributes in process `syz.3.5859'. [ 779.462372][T28082] netlink: 20 bytes leftover after parsing attributes in process `syz.2.5860'. [ 779.472498][T28082] netlink: 24 bytes leftover after parsing attributes in process `syz.2.5860'. [ 779.590800][T28088] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 779.731477][T28090] openvswitch: netlink: nsh attr 1 has unexpected len 4 expected 8 [ 779.887336][T28106] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 780.229679][T28117] team0: Port device dummy0 removed [ 780.263738][T28117] bond9: (slave veth0_to_bond): Releasing active interface [ 780.304550][T28117] bond0: (slave bond_slave_0): Releasing backup interface [ 780.307882][T28117] bond_slave_0: left allmulticast mode [ 780.344790][T28117] bond0: (slave bond_slave_1): Releasing backup interface [ 780.347262][T28117] bond_slave_1: left allmulticast mode [ 780.377793][T28117] team0: Port device team_slave_0 removed [ 780.410582][T28117] team0: Port device team_slave_1 removed [ 780.412690][T28117] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 780.412716][T28117] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 780.428638][T28117] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 780.428663][T28117] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 780.458119][T28117] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 780.683326][T28136] netlink: Conntrack attr has 8 unknown bytes [ 780.683365][T28136] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 780.731177][T28142] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5874'. [ 780.752515][T28142] h: entered promiscuous mode [ 780.769375][T28145] netlink: 'syz.4.5875': attribute type 9 has an invalid length. [ 780.824780][T28147] netlink: 28 bytes leftover after parsing attributes in process `syz.4.5875'. [ 780.824819][T28147] netlink: 'syz.4.5875': attribute type 7 has an invalid length. [ 780.824834][T28147] netlink: 12 bytes leftover after parsing attributes in process `syz.4.5875'. [ 782.645701][T28098] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 782.945546][T28177] netlink: 'syz.0.5886': attribute type 8 has an invalid length. [ 782.995802][T28177] openvswitch: netlink: Missing key (keys=c0, expected=480) [ 783.102599][T28190] lo speed is unknown, defaulting to 1000 [ 783.102673][T28190] lo speed is unknown, defaulting to 1000 [ 783.104111][T28190] lo speed is unknown, defaulting to 1000 [ 783.105873][T28190] smbdirect: ib_dev[syz_device_name_32_chars_1234567]: added: RNIC max_fast_reg_page_list_len=256 device_cap_flags=0x200000 kernel_cap_flags=0x10 page_size_cap=0x1000 [ 783.105907][T28190] smbdirect: ib_dev[syz_device_name_32_chars_1234567]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=1 max_cqe=3276800 max_qp_wr=32768 max_send_sge=6 max_recv_sge=6 [ 783.105943][T28190] smbdirect: ib_dev[syz_device_name_32_chars_1234567]PORT[1]: iwarp=1 ib=0 roce=0 v1=0 v2=0 core_cap_flags=0x400008 [ 783.120884][T28179] syzkaller0: entered promiscuous mode [ 783.120907][T28179] syzkaller0: entered allmulticast mode [ 783.179852][T28190] infiniband syz_device_name_32_chars_1234567: RDMA CMA: cma_listen_on_dev, error -22 [ 783.273703][T28190] lo speed is unknown, defaulting to 1000 [ 783.287167][T28195] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5891'. [ 783.287968][T28190] lo speed is unknown, defaulting to 1000 [ 783.290301][T28190] lo speed is unknown, defaulting to 1000 [ 783.293649][T28190] lo speed is unknown, defaulting to 1000 [ 783.298014][T28190] lo speed is unknown, defaulting to 1000 [ 783.303299][T28190] lo speed is unknown, defaulting to 1000 [ 783.305650][T28190] lo speed is unknown, defaulting to 1000 [ 783.450505][T28201] netlink: 4 bytes leftover after parsing attributes in process `syz.4.5893'. [ 783.520664][T28207] netlink: 24 bytes leftover after parsing attributes in process `syz.3.5895'. [ 783.527276][T28208] ip_tables: iptables: counters copy to user failed while replacing table [ 783.569403][T28207] openvswitch: netlink: Message has 8 unknown bytes. [ 784.571356][T28248] netlink: 'syz.3.5906': attribute type 5 has an invalid length. [ 784.906170][T28261] xt_NETMAP: bad rangesize 37. [ 784.909143][T28262] xt_NETMAP: bad rangesize 37. [ 784.924412][T28263] __nla_validate_parse: 9 callbacks suppressed [ 784.924434][T28263] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5909'. [ 784.926642][T28261] nbd: must specify a size in bytes for the device [ 784.957135][T28263] netlink: 12 bytes leftover after parsing attributes in process `syz.0.5909'. [ 785.238051][T28283] SET target dimension over the limit! [ 785.247157][T28285] IPv6: NLM_F_CREATE should be specified when creating new route [ 785.258897][T28286] syzkaller1: tun_chr_ioctl cmd 1074025677 [ 785.258987][T28286] syzkaller1: linktype set to 823 [ 785.314867][T28287] syzkaller1: tun_chr_ioctl cmd 1074025673 [ 785.315207][T28287] syzkaller1: tun_chr_ioctl cmd 1074025677 [ 785.315308][T28287] syzkaller1: linktype set to 823 [ 786.007523][T28307] xt_CT: No such helper "netbios-ns" [ 787.894071][T28261] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 788.472406][T28335] netlink: 'syz.0.5929': attribute type 3 has an invalid length. [ 788.472431][T28335] netlink: 244 bytes leftover after parsing attributes in process `syz.0.5929'. [ 788.575002][T28339] netlink: 'syz.3.5931': attribute type 11 has an invalid length. [ 788.575027][T28339] netlink: 132 bytes leftover after parsing attributes in process `syz.3.5931'. [ 788.695295][T28345] netlink: 'syz.3.5931': attribute type 1 has an invalid length. [ 788.706643][T28345] netlink: 80 bytes leftover after parsing attributes in process `syz.3.5931'. [ 788.795574][T28349] netlink: 'syz.1.5933': attribute type 1 has an invalid length. [ 788.999370][T28349] 8021q: adding VLAN 0 to HW filter on device bond13 [ 789.184244][T28358] bond13: (slave geneve3): making interface the new active one [ 789.200833][T28358] bond13: (slave geneve3): Enslaving as an active interface with an up link [ 789.432671][T28359] bond4: option primary: mode dependency failed, not supported in mode balance-rr(0) [ 789.457181][T28359] bond4 (unregistering): Released all slaves [ 789.491693][T28388] netlink: 12 bytes leftover after parsing attributes in process `syz.3.5936'. [ 789.752381][T28384] bond5: option primary: mode dependency failed, not supported in mode balance-rr(0) [ 789.771849][T28384] bond5 (unregistering): Released all slaves [ 790.317706][T28413] bond5: option packets_per_slave: mode dependency failed, not supported in mode balance-xor(2) [ 790.342684][T28413] bond5 (unregistering): Released all slaves [ 790.532189][ T9661] lo speed is unknown, defaulting to 1000 [ 790.608949][T28430] IPVS: length: 212 != 8 [ 791.170785][T28452] netlink: 72 bytes leftover after parsing attributes in process `syz.4.5955'. [ 791.382931][T28459] tipc: Resetting bearer [ 791.491611][T28466] tipc: Resetting bearer [ 791.856679][T28481] netlink: 'syz.0.5962': attribute type 83 has an invalid length. [ 792.171758][T28491] netlink: 666 bytes leftover after parsing attributes in process `syz.0.5965'. [ 792.277552][ T4935] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 792.284130][ T4935] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 792.292104][ T4935] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 792.310559][ T4935] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 792.313609][ T4935] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 792.325747][T28490] netlink: 16 bytes leftover after parsing attributes in process `syz.4.5966'. [ 793.416679][T28537] openvswitch: netlink: Multiple metadata blocks provided [ 793.528087][T28546] netlink: 244 bytes leftover after parsing attributes in process `syz.4.5976'. [ 793.597686][T28543] netlink: 'syz.4.5976': attribute type 2 has an invalid length. [ 793.597711][T28543] netlink: 11575 bytes leftover after parsing attributes in process `syz.4.5976'. [ 793.692220][T28552] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5979'. [ 793.723518][T28496] wlan0 speed is unknown, defaulting to 1000 [ 793.729725][T28496] lo speed is unknown, defaulting to 1000 [ 793.761441][T28552] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5979'. [ 793.779049][T28554] sctp: [Deprecated]: syz.3.5977 (pid 28554) Use of int in maxseg socket option. [ 793.779049][T28554] Use struct sctp_assoc_value instead [ 794.166149][T28569] netlink: 'syz.3.5981': attribute type 1 has an invalid length. [ 794.242781][T28569] 8021q: adding VLAN 0 to HW filter on device bond5 [ 794.257518][T28576] openvswitch: netlink: IPv4 tunnel dst address is zero [ 794.257556][T28576] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 794.260328][T28578] netlink: 72 bytes leftover after parsing attributes in process `syz.1.5983'. [ 794.314243][T28569] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5981'. [ 794.418687][ T5622] Bluetooth: hci5: command tx timeout [ 794.522042][T28587] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5985'. [ 795.121790][T28496] bridge0: port 1(bridge_slave_0) entered blocking state [ 795.123635][T28496] bridge0: port 1(bridge_slave_0) entered disabled state [ 795.123800][T28496] bridge_slave_0: entered allmulticast mode [ 795.126042][T28496] bridge_slave_0: entered promiscuous mode [ 795.130134][T28496] bridge0: port 2(bridge_slave_1) entered blocking state [ 795.130298][T28496] bridge0: port 2(bridge_slave_1) entered disabled state [ 795.130448][T28496] bridge_slave_1: entered allmulticast mode [ 795.132315][T28496] bridge_slave_1: entered promiscuous mode [ 795.222279][T28496] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 795.261205][T28496] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 795.354950][T28615] netlink: 'syz.0.5995': attribute type 1 has an invalid length. [ 795.381444][T28496] team0: Port device team_slave_0 added [ 795.384700][T28496] team0: Port device team_slave_1 added [ 795.410249][T28613] batman_adv: batadv0: Adding interface: syzkaller0 [ 795.410269][T28613] batman_adv: batadv0: The MTU of interface syzkaller0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 795.410410][T28613] batman_adv: batadv0: Interface activated: syzkaller0 [ 795.483240][T28617] ip6t_REJECT: TCP_RESET illegal for non-tcp [ 795.496573][T28612] batman_adv: batadv0: Interface deactivated: syzkaller0 [ 795.521280][T28612] batman_adv: batadv0: Removing interface: syzkaller0 [ 795.527385][T28496] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 795.527405][T28496] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 795.527430][T28496] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 795.575676][T28496] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 795.575695][T28496] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 795.575720][T28496] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 795.723983][T28496] hsr_slave_0: entered promiscuous mode [ 795.726655][T28496] hsr_slave_1: entered promiscuous mode [ 795.731240][T28496] debugfs: 'hsr0' already exists in 'hsr' [ 795.731263][T28496] Cannot create hsr debugfs directory [ 796.176666][T28623] netlink: NAT flags may be given only when NAT range (SRC or DST) is also specified. [ 796.176706][T28623] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 796.340164][T24899] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 796.498555][ T5622] Bluetooth: hci5: command tx timeout [ 796.523259][T28646] netlink: 'syz.0.6003': attribute type 10 has an invalid length. [ 796.582052][T28646] 8021q: adding VLAN 0 to HW filter on device team0 [ 796.585061][T28646] bond0: (slave team0): Enslaving as an active interface with an up link [ 796.729809][T28656] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 796.754475][T28656] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 796.755459][T28656] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 796.795388][T28496] netdevsim netdevsim2 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 796.795427][T28496] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 796.867694][T28658] batman_adv: batadv0: Adding interface: gretap1 [ 796.867713][T28658] batman_adv: batadv0: The MTU of interface gretap1 is too small (1462) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 796.871492][T28658] batman_adv: batadv0: Interface activated: gretap1 [ 797.048907][T28496] netdevsim netdevsim2 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 797.048947][T28496] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 797.118730][T28672] __nla_validate_parse: 3 callbacks suppressed [ 797.118753][T28672] netlink: 13 bytes leftover after parsing attributes in process `syz.3.6012'. [ 797.121816][T28674] xt_IDLETIMER: label is empty or not nul-terminated [ 797.145847][T28672] netlink: 'syz.3.6012': attribute type 16 has an invalid length. [ 797.145869][T28672] netlink: 20 bytes leftover after parsing attributes in process `syz.3.6012'. [ 797.147484][T28674] netlink: 'syz.4.6010': attribute type 29 has an invalid length. [ 797.171228][ T5622] Bluetooth: hci4: SCO packet for unknown connection handle 0 [ 797.261110][T28496] netdevsim netdevsim2 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 797.261151][T28496] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 797.393841][T28496] netdevsim netdevsim2 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 797.393882][T28496] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 797.491593][T28682] ip_tables: iptables: counters copy to user failed while replacing table [ 797.737565][T28685] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6015'. [ 797.741690][T28685] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6015'. [ 798.045718][T28693] netlink: 84 bytes leftover after parsing attributes in process `syz.1.6018'. [ 798.580348][ T5622] Bluetooth: hci5: command tx timeout [ 798.722611][T28496] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 798.751670][T28496] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 798.752668][T28496] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 798.757291][T28496] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 798.785437][T28496] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 798.800479][T28496] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 798.803324][T28496] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 798.831125][T28496] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 799.167411][T28734] netlink: 'syz.4.6026': attribute type 2 has an invalid length. [ 799.175345][T28496] 8021q: adding VLAN 0 to HW filter on device bond0 [ 799.202056][T28496] 8021q: adding VLAN 0 to HW filter on device team0 [ 799.229851][T10100] bridge0: port 1(bridge_slave_0) entered blocking state [ 799.229986][T10100] bridge0: port 1(bridge_slave_0) entered forwarding state [ 799.237619][T28738] netlink: 'syz.0.6027': attribute type 2 has an invalid length. [ 799.263512][T10100] bridge0: port 2(bridge_slave_1) entered blocking state [ 799.263619][T10100] bridge0: port 2(bridge_slave_1) entered forwarding state [ 799.418850][T24896] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 799.577282][T28746] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6031'. [ 799.577314][T28746] block nbd8: Unsupported socket: should be TCP or UNIX. [ 799.676365][T28749] netlink: 9 bytes leftover after parsing attributes in process `syz.0.6030'. [ 799.690898][T28749] gretap0: entered promiscuous mode [ 800.036468][T28761] netlink: 24 bytes leftover after parsing attributes in process `syz.0.6034'. [ 800.095198][T28764] netlink: 24 bytes leftover after parsing attributes in process `syz.0.6034'. [ 800.155789][T28761] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6034'. [ 800.166469][T28761] netlink: 'syz.0.6034': attribute type 1 has an invalid length. [ 800.539890][T28496] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 800.644611][T28787] IPVS: length: 8 != 1152 [ 800.645481][T28787] xt_TCPMSS: Only works on TCP SYN packets [ 800.660694][ T5622] Bluetooth: hci5: command tx timeout [ 800.777953][T28496] veth0_vlan: entered promiscuous mode [ 800.823256][T28496] veth1_vlan: entered promiscuous mode [ 800.914543][T28797] bond3 (unregistering): Released all slaves [ 801.087409][T28801] bond3 (unregistering): Released all slaves [ 801.309412][T28496] veth0_macvtap: entered promiscuous mode [ 801.353873][T28496] veth1_macvtap: entered promiscuous mode [ 801.456098][T28817] bond11: option ad_actor_sys_prio: mode dependency failed, not supported in mode balance-rr(0) [ 801.495544][T28817] bond11 (unregistering): Released all slaves [ 801.631357][T28496] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 801.651591][T28496] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 801.765575][ T6379] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 801.818688][ T6377] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 801.818755][ T6377] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 801.818792][ T6377] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 802.510631][T24899] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 802.907011][T28828] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 803.037491][T27907] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 803.037515][T27907] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 803.101637][T28856] veth1_vlan: entered allmulticast mode [ 803.112782][T28857] openvswitch: netlink: Unknown key attributes 20 [ 803.133856][T28856] A link change request failed with some changes committed already. Interface wlan1 may have been left with an inconsistent configuration, please check. [ 803.171507][T28856] __nla_validate_parse: 4 callbacks suppressed [ 803.171528][T28856] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6054'. [ 803.276299][T28861] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6056'. [ 803.277418][T28861] openvswitch: netlink: Missing valid actions attribute. [ 803.277454][T28861] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 803.599873][T28883] block nbd0: NBD_DISCONNECT [ 803.599915][T28883] block nbd0: Send disconnect failed -32 [ 803.604764][ T6377] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 803.604803][ T6377] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 803.686864][T28880] vcan0: entered allmulticast mode [ 804.112885][T28899] ip_tables: iptables: counters copy to user failed while replacing table [ 804.549193][T28909] netlink: 16 bytes leftover after parsing attributes in process `syz.3.6063'. [ 804.549223][T28909] openvswitch: netlink: Flow set message rejected, Key attribute missing. [ 804.751473][T28920] SET target dimension over the limit! [ 804.751798][T28920] sctp: [Deprecated]: syz.1.6065 (pid 28920) Use of int in max_burst socket option. [ 804.751798][T28920] Use struct sctp_assoc_value instead [ 805.067083][T28932] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6068'. [ 805.154844][T28934] netlink: 104 bytes leftover after parsing attributes in process `syz.3.6068'. [ 805.225068][ T4935] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 805.227873][ T4935] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 805.243154][ T4935] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 805.263371][ T4935] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 805.286141][ T4935] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 805.540726][T24899] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 805.779536][ T1963] block nbd2: Possible stuck request ffff888027155080: control (read@0,4096B). Runtime 270 seconds [ 806.140768][T28973] netlink: 144 bytes leftover after parsing attributes in process `syz.3.6076'. [ 806.141145][T28977] netlink: 524 bytes leftover after parsing attributes in process `syz.3.6076'. [ 806.176745][T28938] wlan0 speed is unknown, defaulting to 1000 [ 806.183441][T28938] lo speed is unknown, defaulting to 1000 [ 806.229219][T28976] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6077'. [ 806.229256][T28976] netlink: 20 bytes leftover after parsing attributes in process `syz.0.6077'. [ 806.230086][T28976] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6077'. [ 806.373762][T28983] netlink: 'syz.3.6079': attribute type 10 has an invalid length. [ 806.482836][T28983] team0: Device veth0_macvtap failed to register rx_handler [ 806.552880][T28985] netlink: 'syz.1.6080': attribute type 21 has an invalid length. [ 806.552908][T28985] netlink: 'syz.1.6080': attribute type 22 has an invalid length. [ 806.552922][T28985] netlink: 'syz.1.6080': attribute type 23 has an invalid length. [ 806.552936][T28985] netlink: 'syz.1.6080': attribute type 25 has an invalid length. [ 806.552951][T28985] netlink: 'syz.1.6080': attribute type 26 has an invalid length. [ 806.985403][T29004] bond14: option primary: mode dependency failed, not supported in mode balance-rr(0) [ 806.986943][T29004] bond14 (unregistering): Released all slaves [ 807.047093][T29011] tipc: Enabling not permitted [ 807.047133][T29011] tipc: Enabling of bearer rejected, failed to enable media [ 807.378807][ T5622] Bluetooth: hci1: command tx timeout [ 807.579679][T28938] bridge0: port 1(bridge_slave_0) entered blocking state [ 807.579879][T28938] bridge0: port 1(bridge_slave_0) entered disabled state [ 807.580050][T28938] bridge_slave_0: entered allmulticast mode [ 807.586054][T28938] bridge_slave_0: entered promiscuous mode [ 807.695366][T28938] bridge0: port 2(bridge_slave_1) entered blocking state [ 807.695481][T28938] bridge0: port 2(bridge_slave_1) entered disabled state [ 807.695636][T28938] bridge_slave_1: entered allmulticast mode [ 807.722513][T28938] bridge_slave_1: entered promiscuous mode [ 807.896494][T28938] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 807.910620][T28938] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 808.119760][T28938] team0: Port device team_slave_0 added [ 808.124072][T28938] team0: Port device team_slave_1 added [ 808.140755][T29053] Unsupported ieee802154 address type: 0 [ 808.349867][T28938] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 808.349890][T28938] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 808.349915][T28938] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 808.469896][T29063] Cannot find del_set index 4 as target [ 808.472740][T29063] netlink: 'syz.0.6103': attribute type 178 has an invalid length. [ 808.477968][T28938] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 808.477989][T28938] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 808.478017][T28938] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 808.580206][T24896] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 808.683603][T28938] hsr_slave_0: entered promiscuous mode [ 808.684801][T28938] hsr_slave_1: entered promiscuous mode [ 808.686877][T28938] debugfs: 'hsr0' already exists in 'hsr' [ 808.686901][T28938] Cannot create hsr debugfs directory [ 808.907859][T27907] IPVS: starting estimator thread 0... [ 808.955482][T29079] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 808.985464][ T1313] ieee802154 phy0 wpan0: encryption failed: -22 [ 808.990280][T29084] IPVS: using max 26 ests per chain, 62400 per kthread [ 809.287182][T29096] ip6t_ah: unknown flags 5 [ 809.371768][T29099] __nla_validate_parse: 6 callbacks suppressed [ 809.371793][T29099] netlink: 68 bytes leftover after parsing attributes in process `syz.2.6116'. [ 809.423604][T29099] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6116'. [ 809.468844][ T5622] Bluetooth: hci1: command tx timeout [ 809.821621][T28938] netdevsim netdevsim4 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 809.821663][T28938] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 809.875512][T29113] bridge0: port 3(vlan2) entered blocking state [ 809.875646][T29113] bridge0: port 3(vlan2) entered disabled state [ 809.875731][T29113] vlan2: entered allmulticast mode [ 809.875742][T29113] geneve0: entered allmulticast mode [ 809.877164][T29113] vlan2: entered promiscuous mode [ 809.877176][T29113] geneve0: entered promiscuous mode [ 809.934430][T29115] 8021q: adding VLAN 0 to HW filter on device bond6 [ 809.935286][T29111] syzkaller1: entered promiscuous mode [ 809.935306][T29111] syzkaller1: entered allmulticast mode [ 810.055615][T28938] netdevsim netdevsim4 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 810.055653][T28938] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 810.147937][T29130] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 810.188943][T29132] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 810.227487][T29132] netlink: 24 bytes leftover after parsing attributes in process `syz.1.6124'. [ 810.286706][T28938] netdevsim netdevsim4 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 810.286745][T28938] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 810.459691][T29141] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 810.711017][T29156] xt_MASQUERADE: bad rangesize 2147483646 [ 810.733923][T29150] syzkaller1: entered promiscuous mode [ 810.733951][T29150] syzkaller1: entered allmulticast mode [ 811.169986][T28938] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 811.194191][T28938] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 811.194789][T29166] netlink: 16 bytes leftover after parsing attributes in process `syz.1.6131'. [ 811.196201][T28938] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 811.234452][T28938] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 811.236168][T28938] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 811.256114][T28938] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 811.257252][T28938] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 811.278008][T28938] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 811.308054][T29170] netlink: 24 bytes leftover after parsing attributes in process `syz.3.6132'. [ 811.460948][T28938] 8021q: adding VLAN 0 to HW filter on device bond0 [ 811.492720][T28938] 8021q: adding VLAN 0 to HW filter on device team0 [ 811.513934][T27907] bridge0: port 1(bridge_slave_0) entered blocking state [ 811.514027][T27907] bridge0: port 1(bridge_slave_0) entered forwarding state [ 811.524589][T29177] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6133'. [ 811.545279][ T5622] Bluetooth: hci1: command tx timeout [ 811.560100][T29177] 8021q: adding VLAN 0 to HW filter on device batadv1 [ 811.562952][T29177] team0: Port device batadv1 added [ 811.588307][ T1167] bridge0: port 2(bridge_slave_1) entered blocking state [ 811.588440][ T1167] bridge0: port 2(bridge_slave_1) entered forwarding state [ 811.629915][T24899] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 812.512749][T29218] C: renamed from lo (while UP) [ 812.516747][T29218] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check. [ 812.516839][T29215] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check. [ 812.773525][T28938] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 812.815007][T29219] syzkaller1: entered promiscuous mode [ 812.815036][T29219] syzkaller1: entered allmulticast mode [ 812.992634][T29236] tipc: Enabling of bearer rejected, failed to enable media [ 813.220920][T29245] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6148'. [ 813.220958][T29245] netlink: 'syz.3.6148': attribute type 30 has an invalid length. [ 813.279124][T10097] netdevsim netdevsim3 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 813.279172][T10097] netdevsim netdevsim3 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 813.279206][T10097] netdevsim netdevsim3 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 813.380838][T29250] openvswitch: netlink: Missing key (keys=c0, expected=500) [ 813.619136][ T5622] Bluetooth: hci1: command tx timeout [ 813.750347][T29259] netlink: 40 bytes leftover after parsing attributes in process `syz.3.6153'. [ 814.193438][T28938] veth0_vlan: entered promiscuous mode [ 814.227994][T28938] veth1_vlan: entered promiscuous mode [ 814.248938][T29271] syzkaller1: entered promiscuous mode [ 814.249007][T29271] syzkaller1: entered allmulticast mode [ 814.399271][T28938] veth0_macvtap: entered promiscuous mode [ 814.415303][T28938] veth1_macvtap: entered promiscuous mode [ 814.455688][T28938] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 814.552164][T28938] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 814.616113][T27907] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 814.618834][T10100] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 814.618993][T10100] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 814.619065][T10100] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 814.665829][T24899] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 814.857828][T29278] netlink: 12 bytes leftover after parsing attributes in process `syz.2.6158'. [ 814.987256][T29286] netlink: 'syz.0.6161': attribute type 3 has an invalid length. [ 815.579009][T29296] netlink: 'syz.0.6161': attribute type 3 has an invalid length. [ 815.607444][ T1167] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 815.607508][ T1167] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 816.055689][T27907] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 816.055714][T27907] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 816.734362][T29341] netlink: 20 bytes leftover after parsing attributes in process `syz.3.6170'. [ 816.736603][T29341] netlink: 20 bytes leftover after parsing attributes in process `syz.3.6170'. [ 817.053085][T29349] syzkaller1: entered promiscuous mode [ 817.053110][T29349] syzkaller1: entered allmulticast mode [ 817.265933][T29356] xt_hashlimit: size too large, truncated to 1048576 [ 817.365932][T29360] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 817.709676][T24896] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 818.279570][T29383] nbd: nbd1 already in use [ 818.280019][T29383] block nbd1: NBD_DISCONNECT [ 818.312245][T29383] block nbd1: Send disconnect failed -32 [ 818.312277][T29383] block nbd1: shutting down sockets [ 819.035173][T29403] syzkaller1: entered promiscuous mode [ 819.035200][T29403] syzkaller1: entered allmulticast mode [ 819.271776][T29408] syzkaller0: entered promiscuous mode [ 819.271801][T29408] syzkaller0: entered allmulticast mode [ 819.309640][T29408] bridge0: left promiscuous mode [ 819.309666][T29408] bridge0: entered allmulticast mode [ 819.708099][T29433] netlink: 20 bytes leftover after parsing attributes in process `syz.3.6189'. [ 819.920008][T29415] IPVS: set_ctl: invalid protocol: 46 255.255.255.255:20003 [ 820.741389][ T9661] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 821.302540][T29478] netlink: 104 bytes leftover after parsing attributes in process `syz.3.6204'. [ 821.584510][T29483] xt_time: invalid argument - start or stop time greater than 23:59:59 [ 821.771601][T29495] syzkaller1: entered promiscuous mode [ 821.771627][T29495] syzkaller1: entered allmulticast mode [ 821.874212][T29501] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6209'. [ 821.874238][T29501] netlink: 24 bytes leftover after parsing attributes in process `syz.2.6209'. [ 822.062976][T29458] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6197'. [ 822.402178][T29488] netlink: 27 bytes leftover after parsing attributes in process `syz.1.6205'. [ 823.238082][T29537] netlink: 'syz.4.6220': attribute type 2 has an invalid length. [ 823.626868][T29552] raw_sendmsg: syz.3.6224 forgot to set AF_INET. Fix it! [ 823.781962][T24896] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 823.884099][T29561] xt_hashlimit: size too large, truncated to 1048576 [ 823.941577][T29563] sctp: [Deprecated]: syz.3.6228 (pid 29563) Use of struct sctp_assoc_value in delayed_ack socket option. [ 823.941577][T29563] Use struct sctp_sack_info instead [ 825.035411][T29590] 8021q: adding VLAN 0 to HW filter on device bond14 [ 825.039534][T29590] bridge0: port 1(bond14) entered blocking state [ 825.039940][T29590] bridge0: port 1(bond14) entered disabled state [ 825.040428][T29590] bond14: entered allmulticast mode [ 825.047768][T29590] bond14: entered promiscuous mode [ 825.111368][T29597] netlink: 28 bytes leftover after parsing attributes in process `syz.3.6233'. [ 825.591454][T29609] bridge8: trying to set multicast startup query interval above maximum, setting to 8640000 (86400000ms) [ 825.702885][T29609] x_tables: ip6_tables: ipcomp match: only valid for protocol 108 [ 825.898838][T29618] netlink: 'syz.4.6235': attribute type 2 has an invalid length. [ 825.916825][T29621] netlink: 'syz.1.6236': attribute type 3 has an invalid length. [ 825.985496][T29622] netlink: 28 bytes leftover after parsing attributes in process `syz.3.6239'. [ 826.574959][T29640] Bluetooth: MGMT ver 1.23 [ 826.821343][T24900] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 827.395542][T29647] netlink: 24 bytes leftover after parsing attributes in process `syz.2.6243'. [ 827.403649][T29647] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6243'. [ 827.403689][T29647] netlink: 12 bytes leftover after parsing attributes in process `syz.2.6243'. [ 827.562622][T29652] veth1_to_bond: entered allmulticast mode [ 828.087481][T29672] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6246'. [ 828.087574][T29672] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6246'. [ 828.087776][T29672] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6246'. [ 828.322200][T29649] veth1_to_bond: left allmulticast mode [ 828.364931][T29681] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 828.580014][T29683] netlink: 44 bytes leftover after parsing attributes in process `syz.3.6251'. [ 828.617127][T29692] xt_NETMAP: bad rangesize 37. [ 828.626166][T29690] : renamed from bond0 (while UP) [ 828.926600][T29702] Bluetooth: hci0: unsupported parameter 5161 [ 828.926665][T29702] Bluetooth: hci0: unsupported parameter 8192 [ 828.926731][T29702] Bluetooth: hci0: unsupported parameter 5161 [ 828.926789][T29702] Bluetooth: hci0: unsupported parameter 8192 [ 829.003050][T29704] netlink: 'syz.3.6256': attribute type 30 has an invalid length. [ 829.003113][T29704] netlink: 56 bytes leftover after parsing attributes in process `syz.3.6256'. [ 829.201668][T29712] syzkaller1: entered promiscuous mode [ 829.201696][T29712] syzkaller1: entered allmulticast mode [ 829.862043][T24900] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 829.924733][T29734] netlink: 20 bytes leftover after parsing attributes in process `syz.1.6264'. [ 830.043162][T29744] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 830.495950][T29761] netlink: 'syz.1.6269': attribute type 3 has an invalid length. [ 830.513230][T29764] netlink: 12 bytes leftover after parsing attributes in process `syz.0.6271'. [ 830.645157][T29765] macvlan1: entered allmulticast mode [ 830.654142][T29765] veth1_vlan: entered allmulticast mode [ 830.662965][T29765] bond0: (slave macvlan1): Enslaving as an active interface with an up link [ 830.664325][T29765] veth1_vlan: left allmulticast mode [ 830.791531][T29757] bond7: option xmit_hash_policy: invalid value (64) [ 830.819839][T29757] bond7 (unregistering): Released all slaves [ 831.394348][T29786] syzkaller1: entered promiscuous mode [ 831.394375][T29786] syzkaller1: entered allmulticast mode [ 832.557301][T29824] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 832.915732][T24900] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 833.136278][T29841] syzkaller1: entered promiscuous mode [ 833.136304][T29841] syzkaller1: entered allmulticast mode [ 833.837648][T29865] __nla_validate_parse: 2 callbacks suppressed [ 833.837711][T29865] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6299'. [ 834.327766][T29871] openvswitch: netlink: Message has 8 unknown bytes. [ 834.446172][T29884] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6306'. [ 834.480207][T29884] bridge_slave_0: left allmulticast mode [ 834.480249][T29884] bridge_slave_0: left promiscuous mode [ 834.480499][T29884] bridge0: port 1(bridge_slave_0) entered disabled state [ 834.541225][T29884] bridge_slave_1: left allmulticast mode [ 834.541255][T29884] bridge_slave_1: left promiscuous mode [ 834.542487][T29884] bridge0: port 2(bridge_slave_1) entered disabled state [ 834.597116][T29884] bond0: (slave bond_slave_0): Releasing backup interface [ 834.629678][T29884] bond0: (slave bond_slave_1): Releasing backup interface [ 834.682426][T29884] team0: Port device team_slave_0 removed [ 834.706756][T29884] team0: Port device team_slave_1 removed [ 834.707687][T29884] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 834.707711][T29884] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 834.736950][T29884] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 834.736979][T29884] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 834.760896][T29884] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 835.184438][T29905] sch_tbf: burst 0 is lower than device lo mtu (65550) ! [ 835.197204][T29906] sch_tbf: burst 0 is lower than device lo mtu (65550) ! [ 835.329915][T29908] mac80211_hwsim hwsim64 wlan0: entered promiscuous mode [ 835.524538][T29918] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6314'. [ 835.812440][T29923] syzkaller1: entered promiscuous mode [ 835.812508][T29923] syzkaller1: entered allmulticast mode [ 835.859237][ T1963] block nbd2: Possible stuck request ffff888027155080: control (read@0,4096B). Runtime 300 seconds [ 835.939883][T24896] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 835.975755][T29930] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6318'. [ 836.016987][T29930] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 836.442334][T29943] xt_TPROXY: Can be used only with -p tcp or -p udp [ 836.499573][T29947] xt_TPROXY: Can be used only with -p tcp or -p udp [ 836.883545][T29917] RDS: rds_bind could not find a transport for fc01::1, load rds_tcp or rds_rdma? [ 836.888147][T29917] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6315'. [ 837.183690][T29964] netlink: 48 bytes leftover after parsing attributes in process `syz.3.6324'. [ 837.313932][T29971] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 837.330697][T29972] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 837.630906][T29985] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6329'. [ 837.694722][T29985] : (slave team0): Releasing backup interface [ 837.805552][T29985] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 838.005981][T29993] netlink: 'syz.0.6330': attribute type 1 has an invalid length. [ 838.006008][T29993] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6330'. [ 838.415612][T29993] 8021q: adding VLAN 0 to HW filter on device bond3 [ 838.718255][T30005] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 838.718762][T30008] syzkaller1: entered promiscuous mode [ 838.718787][T30008] syzkaller1: entered allmulticast mode [ 838.981359][T24900] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 839.025565][T30017] syzkaller1: entered promiscuous mode [ 839.025636][T30017] syzkaller1: entered allmulticast mode [ 839.679093][T30037] netlink: 4 bytes leftover after parsing attributes in process `syz.3.6340'. [ 839.917244][T30037] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 839.986235][T30041] sit1: entered promiscuous mode [ 839.986264][T30041] sit1: entered allmulticast mode [ 840.004120][T30040] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 840.152724][T30047] netlink: 'syz.0.6341': attribute type 1 has an invalid length. [ 840.272095][T30056] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 840.290023][T30056] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 840.291834][T30056] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 840.294260][T30056] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 840.305645][T30056] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 840.933943][ T3345] IPVS: starting estimator thread 0... [ 841.024071][T30073] IPVS: using max 24 ests per chain, 57600 per kthread [ 841.624047][T30091] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6352'. [ 841.732144][T30054] wlan0 speed is unknown, defaulting to 1000 [ 841.734083][T30054] lo speed is unknown, defaulting to 1000 [ 842.023083][T24896] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 842.380107][T30110] netlink: 4 bytes leftover after parsing attributes in process `syz.3.6357'. [ 842.419435][ T5622] Bluetooth: hci3: command tx timeout [ 842.656687][T30115] netlink: 'syz.4.6360': attribute type 1 has an invalid length. [ 842.715059][T30110] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 842.757727][T30117] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6360'. [ 842.847255][ T30] audit: type=1800 audit(1790042516.662:3): pid=30123 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.6361" name="memory.events" dev="tmpfs" ino=635 res=0 errno=0 [ 842.854687][T30123] netlink: 236 bytes leftover after parsing attributes in process `syz.0.6361'. [ 842.854751][T30123] netlink: 236 bytes leftover after parsing attributes in process `syz.0.6361'. [ 842.936449][T30115] 8021q: adding VLAN 0 to HW filter on device bond1 [ 842.980186][T30122] bond1: (slave bridge1): making interface the new active one [ 842.981944][T30122] bond1: (slave bridge1): Enslaving as an active interface with an up link [ 842.986598][T30119] bridge_slave_1: default FDB implementation only supports local addresses [ 843.030545][T30115] netlink: 44 bytes leftover after parsing attributes in process `syz.4.6360'. [ 843.072516][T30115] netlink: 36 bytes leftover after parsing attributes in process `syz.4.6360'. [ 843.209942][T30054] bridge0: port 1(bridge_slave_0) entered blocking state [ 843.210435][T30054] bridge0: port 1(bridge_slave_0) entered disabled state [ 843.212038][T30054] bridge_slave_0: entered allmulticast mode [ 843.218328][T30054] bridge_slave_0: entered promiscuous mode [ 843.254538][T30054] bridge0: port 2(bridge_slave_1) entered blocking state [ 843.254966][T30054] bridge0: port 2(bridge_slave_1) entered disabled state [ 843.257973][T30054] bridge_slave_1: entered allmulticast mode [ 843.308662][T30054] bridge_slave_1: entered promiscuous mode [ 843.437189][T30054] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 843.455055][T30054] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 843.613395][T30140] FAULT_INJECTION: forcing a failure. [ 843.613395][T30140] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 843.613439][T30140] CPU: 0 UID: 0 PID: 30140 Comm: syz.4.6365 Not tainted syzkaller #0 PREEMPT(full) [ 843.613462][T30140] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 843.613474][T30140] Call Trace: [ 843.613484][T30140] [ 843.613492][T30140] dump_stack_lvl+0xe8/0x150 [ 843.613530][T30140] should_fail_ex+0x410/0x560 [ 843.613561][T30140] _copy_from_iter+0x1d3/0x1660 [ 843.613630][T30140] ? __lock_acquire+0x747/0x2de0 [ 843.613664][T30140] ? __pfx__copy_from_iter+0x10/0x10 [ 843.613734][T30140] tun_get_user+0x52f/0x44d0 [ 843.613783][T30140] ? aa_file_perm+0x18b/0x15f0 [ 843.613816][T30140] ? aa_file_perm+0x4ed/0x15f0 [ 843.613840][T30140] ? __pfx_tun_get_user+0x10/0x10 [ 843.613865][T30140] ? __lock_acquire+0x747/0x2de0 [ 843.613888][T30140] ? kstrtoull+0x137/0x1d0 [ 843.613924][T30140] ? ref_tracker_alloc+0x341/0x4b0 [ 843.613954][T30140] ? lock_acquire+0x115/0x350 [ 843.613975][T30140] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 843.614000][T30140] ? lock_acquire+0x115/0x350 [ 843.614021][T30140] ? tun_get+0x1c/0x2f0 [ 843.614053][T30140] ? tun_get+0x1c/0x2f0 [ 843.614081][T30140] ? tun_get+0x1c/0x2f0 [ 843.614105][T30140] tun_chr_write_iter+0x113/0x200 [ 843.614130][T30140] vfs_write+0x612/0xba0 [ 843.614172][T30140] ? __pfx_vfs_write+0x10/0x10 [ 843.614218][T30140] ? __fget_files+0x2a/0x420 [ 843.614254][T30140] ksys_write+0x150/0x270 [ 843.614285][T30140] ? __pfx_ksys_write+0x10/0x10 [ 843.614323][T30140] do_syscall_64+0x166/0x520 [ 843.614350][T30140] ? trace_irq_disable+0x3b/0x140 [ 843.614372][T30140] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 843.614396][T30140] ? clear_bhb_loop+0x70/0xc0 [ 843.614430][T30140] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 843.614452][T30140] RIP: 0033:0x7f9a3699e159 [ 843.614473][T30140] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 843.614491][T30140] RSP: 002b:00007f9a378ca028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 843.614515][T30140] RAX: ffffffffffffffda RBX: 00007f9a36c26090 RCX: 00007f9a3699e159 [ 843.614531][T30140] RDX: 000000000000fdef RSI: 0000200000001440 RDI: 0000000000000003 [ 843.614544][T30140] RBP: 00007f9a378ca090 R08: 0000000000000000 R09: 0000000000000000 [ 843.614557][T30140] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 843.614570][T30140] R13: 00007f9a36c26128 R14: 00007f9a36c26090 R15: 00007fff89d9bf18 [ 843.614609][T30140] [ 843.634767][T30137] gretap0: entered promiscuous mode [ 843.696990][T30137] A link change request failed with some changes committed already. Interface vxlan0 may have been left with an inconsistent configuration, please check. [ 843.721915][T30054] team0: Port device team_slave_0 added [ 843.724901][T30136] syzkaller1: entered promiscuous mode [ 843.724938][T30136] syzkaller1: entered allmulticast mode [ 844.425751][T30054] team0: Port device team_slave_1 added [ 844.499242][ T5622] Bluetooth: hci3: command tx timeout [ 844.641094][T30054] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 844.641114][T30054] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 844.641139][T30054] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 844.647259][T30054] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 844.647280][T30054] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 844.647308][T30054] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 845.065716][T24900] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 845.403826][T30054] hsr_slave_0: entered promiscuous mode [ 845.412732][T30054] hsr_slave_1: entered promiscuous mode [ 845.419493][T30054] debugfs: 'hsr0' already exists in 'hsr' [ 845.419554][T30054] Cannot create hsr debugfs directory [ 845.722471][T30178] netlink: 'syz.2.6375': attribute type 11 has an invalid length. [ 845.722497][T30178] netlink: 'syz.2.6375': attribute type 11 has an invalid length. [ 845.722508][T30178] netlink: 228 bytes leftover after parsing attributes in process `syz.2.6375'. [ 845.813901][T30181] netlink: 'syz.4.6376': attribute type 4 has an invalid length. [ 845.877039][T30184] syzkaller0: entered promiscuous mode [ 845.877109][T30184] syzkaller0: entered allmulticast mode [ 846.179448][ T6379] wlan1: Trigger new scan to find an IBSS to join [ 846.520827][T30201] veth1_macvtap: left promiscuous mode [ 846.582453][ T5622] Bluetooth: hci3: command tx timeout [ 847.076449][T30209] syzkaller1: entered promiscuous mode [ 847.076473][T30209] syzkaller1: entered allmulticast mode [ 847.414038][T30054] netdevsim netdevsim1 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 847.494134][T30232] netlink: 59 bytes leftover after parsing attributes in process `syz.4.6387'. [ 847.530789][T30229] netlink: 24 bytes leftover after parsing attributes in process `syz.3.6385'. [ 847.742776][T30054] netdevsim netdevsim1 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 847.943396][T30242] bond7: Unable to set up delay as MII monitoring is disabled [ 847.976421][T30242] bond7 (unregistering): Released all slaves [ 848.100932][ T9661] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 848.164589][T30054] netdevsim netdevsim1 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 848.391983][T30238] netlink: 256 bytes leftover after parsing attributes in process `syz.4.6389'. [ 848.396812][T30054] netdevsim netdevsim1 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 848.557854][T30253] netlink: 204 bytes leftover after parsing attributes in process `syz.3.6394'. [ 848.661614][ T5622] Bluetooth: hci3: command tx timeout [ 848.888162][T30262] bridge0: port 1(veth1_to_bridge) entered blocking state [ 848.888269][T30262] bridge0: port 1(veth1_to_bridge) entered disabled state [ 848.906265][T30262] veth1_to_bridge: entered allmulticast mode [ 848.919366][T30262] veth1_to_bridge: entered promiscuous mode [ 848.922455][T30262] bridge0: port 1(veth1_to_bridge) entered blocking state [ 848.922591][T30262] bridge0: port 1(veth1_to_bridge) entered forwarding state [ 849.017994][T30262] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6396'. [ 849.035026][T30262] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6396'. [ 849.229501][T30265] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6397'. [ 849.615314][T30284] openvswitch: netlink: Unexpected mask (mask=4000010, allowed=10058) [ 849.618131][T30275] bridge9: trying to set multicast startup query interval below minimum, setting to 100 (1000ms) [ 849.643471][T30276] netlink: 52 bytes leftover after parsing attributes in process `syz.4.6399'. [ 849.996696][T30273] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6399'. [ 850.124828][T30054] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 850.144773][T30054] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 850.145859][T30054] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 850.167477][T30054] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 850.234854][T30054] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 850.255526][T30054] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 850.257051][T30054] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 850.278590][T30054] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 850.320203][T30296] sch_tbf: burst 0 is lower than device lo mtu (65550) ! [ 850.418361][T30304] netlink: 'syz.4.6404': attribute type 6 has an invalid length. [ 850.638245][T30308] xt_addrtype: both incoming and outgoing interface limitation cannot be selected [ 850.736890][T30310] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 850.737234][T30310] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 850.737562][T30310] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 850.737883][T30310] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 850.779048][T30310] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 850.779411][T30310] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 850.779753][T30310] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 850.780077][T30310] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 850.928751][T30313] dvmrp1: entered allmulticast mode [ 851.021292][T30054] 8021q: adding VLAN 0 to HW filter on device bond0 [ 851.082712][T30054] 8021q: adding VLAN 0 to HW filter on device team0 [ 851.149833][T27907] wlan1: Trigger new scan to find an IBSS to join [ 851.183980][T17697] bridge0: port 1(bridge_slave_0) entered blocking state [ 851.184234][T17697] bridge0: port 1(bridge_slave_0) entered forwarding state [ 851.256548][T30322] x_tables: ip6_tables: mh match: only valid for protocol 135 [ 851.267936][ T6377] bridge0: port 2(bridge_slave_1) entered blocking state [ 851.268114][ T6377] bridge0: port 2(bridge_slave_1) entered forwarding state [ 851.427255][T30324] netlink: 'syz.0.6410': attribute type 11 has an invalid length. [ 851.427322][T30324] __nla_validate_parse: 1 callbacks suppressed [ 851.427362][T30324] netlink: 3800 bytes leftover after parsing attributes in process `syz.0.6410'. [ 851.630913][T30331] netlink: 36 bytes leftover after parsing attributes in process `syz.4.6414'. [ 851.738765][T30332] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6412'. [ 852.001235][T30342] netlink: 'syz.4.6418': attribute type 21 has an invalid length. [ 852.001263][T30342] netlink: 128 bytes leftover after parsing attributes in process `syz.4.6418'. [ 852.001341][T30342] netlink: 3 bytes leftover after parsing attributes in process `syz.4.6418'. [ 853.114654][T30388] net_ratelimit: 9 callbacks suppressed [ 853.114678][T30388] openvswitch: netlink: Missing key (keys=c0, expected=500) [ 853.115089][T30388] openvswitch: netlink: Missing key (keys=c0, expected=500) [ 853.115461][T30388] openvswitch: netlink: Missing key (keys=c0, expected=500) [ 853.115825][T30388] openvswitch: netlink: Missing key (keys=c0, expected=500) [ 853.190524][T30388] openvswitch: netlink: Missing key (keys=c0, expected=500) [ 853.190913][T30388] openvswitch: netlink: Missing key (keys=c0, expected=500) [ 853.191280][T30388] openvswitch: netlink: Missing key (keys=c0, expected=500) [ 853.232862][T30388] openvswitch: netlink: Missing key (keys=c0, expected=500) [ 853.233251][T30388] openvswitch: netlink: Missing key (keys=c0, expected=500) [ 853.233649][T30388] openvswitch: netlink: Missing key (keys=c0, expected=500) [ 853.536397][ T13] wlan1: Creating new IBSS network, BSSID 0a:83:14:cc:c8:b1 [ 853.888011][T30402] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6426'. [ 853.893942][T30402] netlink: 'syz.3.6426': attribute type 83 has an invalid length. [ 853.916603][T30054] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 854.022210][T30054] veth0_vlan: entered promiscuous mode [ 854.040859][T30054] veth1_vlan: entered promiscuous mode [ 854.067872][T30408] netlink: 6024 bytes leftover after parsing attributes in process `syz.4.6429'. [ 854.111955][T30054] veth0_macvtap: entered promiscuous mode [ 854.117883][T30054] veth1_macvtap: entered promiscuous mode [ 854.160398][T30054] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 854.164890][T30054] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 854.239229][T27907] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 854.239325][T27907] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 854.239420][T27907] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 854.239527][T27907] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 854.563235][T30415] sch_tbf: burst 7 is lower than device syzkaller0 mtu (1514) ! [ 854.577885][T30415] sch_tbf: burst 7 is lower than device syzkaller0 mtu (1514) ! [ 854.579308][T30416] netlink: 'syz.4.6432': attribute type 1 has an invalid length. [ 854.819188][T30416] bond2: entered promiscuous mode [ 854.819860][T30416] 8021q: adding VLAN 0 to HW filter on device bond2 [ 854.835159][T17697] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 854.835182][T17697] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 854.873377][T30415] sch_tbf: burst 7 is lower than device syzkaller0 mtu (1514) ! [ 854.890188][T30422] sch_tbf: burst 7 is lower than device syzkaller0 mtu (1514) ! [ 854.897879][T30426] netlink: 28 bytes leftover after parsing attributes in process `syz.4.6432'. [ 855.032536][T30437] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6436'. [ 855.312755][T30437] veth1_to_bridge: left allmulticast mode [ 855.312786][T30437] veth1_to_bridge: left promiscuous mode [ 855.313412][T30437] bridge0: port 1(veth1_to_bridge) entered disabled state [ 855.412684][T17697] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 855.412712][T17697] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 855.777768][T30447] netlink: 'syz.1.6345': attribute type 2 has an invalid length. [ 855.871771][T30450] SET target dimension over the limit! [ 855.877283][T30443] netlink: 24 bytes leftover after parsing attributes in process `syz.3.6437'. [ 855.956125][T30450] xt_hashlimit: overflow, try lower: 18446744073709551613/4 [ 856.010768][T30456] can: request_module (can-proto-5) failed. [ 856.505104][T30056] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 856.511987][T30056] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 856.519363][T30056] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 856.536199][T30056] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 856.538360][T30470] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6442'. [ 856.539455][T30056] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 856.567690][T30464] veth1_to_batadv: entered promiscuous mode [ 857.109950][T30478] netlink: 'syz.2.6446': attribute type 1 has an invalid length. [ 857.359995][T30481] 8021q: adding VLAN 0 to HW filter on device bond2 [ 857.364447][T30481] bond1: (slave bond2): making interface the new active one [ 857.364973][T30481] bond1: (slave bond2): Enslaving as an active interface with an up link [ 857.402655][T30484] bond1: (slave gretap1): Enslaving as a backup interface with an up link [ 857.417569][T30478] 8021q: adding VLAN 0 to HW filter on device bond1 [ 857.470769][T30489] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6449'. [ 857.873879][T30465] wlan0 speed is unknown, defaulting to 1000 [ 857.893967][T30465] lo speed is unknown, defaulting to 1000 [ 858.123465][T30504] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6451'. [ 858.123493][T30504] netlink: 172 bytes leftover after parsing attributes in process `syz.4.6451'. [ 858.123543][T30504] netlink: 24 bytes leftover after parsing attributes in process `syz.4.6451'. [ 858.154872][T30504] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6451'. [ 858.155674][T30501] syzkaller1: entered promiscuous mode [ 858.155740][T30501] syzkaller1: entered allmulticast mode [ 858.531928][T30512] xt_hl: Unknown TTL match mode: 255 [ 858.658712][T30056] Bluetooth: hci2: command tx timeout [ 859.110347][T30533] netlink: 'syz.4.6459': attribute type 4 has an invalid length. [ 859.110374][T30533] netlink: 'syz.4.6459': attribute type 17 has an invalid length. [ 859.210438][T30537] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6461'. [ 859.306886][T30534] syzkaller1: entered promiscuous mode [ 859.306950][T30534] syzkaller1: entered allmulticast mode [ 859.347877][T30541] netlink: 132 bytes leftover after parsing attributes in process `syz.2.6462'. [ 859.375870][T30544] bridge_slave_0: left allmulticast mode [ 859.375900][T30544] bridge_slave_0: left promiscuous mode [ 859.376138][T30544] bridge0: port 1(bridge_slave_0) entered disabled state [ 859.489810][T30544] bridge_slave_1: left allmulticast mode [ 859.489841][T30544] bridge_slave_1: left promiscuous mode [ 859.490092][T30544] bridge0: port 2(bridge_slave_1) entered disabled state [ 859.553794][T30544] bond0: (slave bond_slave_0): Releasing backup interface [ 859.597334][T30544] bond0: (slave bond_slave_1): Releasing backup interface [ 859.630521][T30544] team0: Port device team_slave_0 removed [ 859.646813][T30544] team0: Port device team_slave_1 removed [ 859.647900][T30544] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 859.647922][T30544] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 859.671911][T30544] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 859.671937][T30544] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 859.675563][T30544] net_ratelimit: 59 callbacks suppressed [ 859.675584][T30544] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 859.970353][T30550] bond0: Error: Cannot enslave bond to itself. [ 860.031942][T30561] syzkaller1: entered promiscuous mode [ 860.031968][T30561] syzkaller1: entered allmulticast mode [ 860.038639][T30561] FAULT_INJECTION: forcing a failure. [ 860.038639][T30561] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 860.038674][T30561] CPU: 0 UID: 0 PID: 30561 Comm: syz.4.6465 Not tainted syzkaller #0 PREEMPT(full) [ 860.038696][T30561] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 860.038709][T30561] Call Trace: [ 860.038717][T30561] [ 860.038725][T30561] dump_stack_lvl+0xe8/0x150 [ 860.038760][T30561] should_fail_ex+0x410/0x560 [ 860.038792][T30561] _copy_from_iter+0x1d3/0x1660 [ 860.038813][T30561] ? skb_set_owner_w+0x263/0x3d0 [ 860.038864][T30561] ? __pfx__copy_from_iter+0x10/0x10 [ 860.038895][T30561] ? __pfx_sock_alloc_send_pskb+0x10/0x10 [ 860.038927][T30561] skb_copy_datagram_from_iter+0xe6/0x720 [ 860.038962][T30561] ? skb_put+0x112/0x210 [ 860.038989][T30561] tun_get_user+0xc7f/0x44d0 [ 860.039027][T30561] ? aa_file_perm+0x18b/0x15f0 [ 860.039058][T30561] ? aa_file_perm+0x4ed/0x15f0 [ 860.039082][T30561] ? __pfx_tun_get_user+0x10/0x10 [ 860.039106][T30561] ? __lock_acquire+0x747/0x2de0 [ 860.039130][T30561] ? kstrtoull+0x137/0x1d0 [ 860.039167][T30561] ? ref_tracker_alloc+0x341/0x4b0 [ 860.039190][T30561] ? lock_acquire+0x115/0x350 [ 860.039211][T30561] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 860.039237][T30561] ? lock_acquire+0x115/0x350 [ 860.039257][T30561] ? tun_get+0x1c/0x2f0 [ 860.039284][T30561] ? tun_get+0x1c/0x2f0 [ 860.039304][T30561] ? tun_get+0x1c/0x2f0 [ 860.039329][T30561] tun_chr_write_iter+0x113/0x200 [ 860.039352][T30561] vfs_write+0x612/0xba0 [ 860.039390][T30561] ? __pfx_vfs_write+0x10/0x10 [ 860.039430][T30561] ? __fget_files+0x2a/0x420 [ 860.039467][T30561] ksys_write+0x150/0x270 [ 860.039498][T30561] ? __pfx_ksys_write+0x10/0x10 [ 860.039539][T30561] do_syscall_64+0x166/0x520 [ 860.039563][T30561] ? trace_irq_disable+0x3b/0x140 [ 860.039582][T30561] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 860.039604][T30561] ? clear_bhb_loop+0x70/0xc0 [ 860.039628][T30561] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 860.039647][T30561] RIP: 0033:0x7f9a3699e159 [ 860.039668][T30561] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 860.039685][T30561] RSP: 002b:00007f9a378eb028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 860.039708][T30561] RAX: ffffffffffffffda RBX: 00007f9a36c25fa0 RCX: 00007f9a3699e159 [ 860.039723][T30561] RDX: 000000000000fdef RSI: 0000200000001440 RDI: 0000000000000003 [ 860.039737][T30561] RBP: 00007f9a378eb090 R08: 0000000000000000 R09: 0000000000000000 [ 860.039750][T30561] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 860.039762][T30561] R13: 00007f9a36c26038 R14: 00007f9a36c25fa0 R15: 00007fff89d9bf18 [ 860.039795][T30561] [ 860.291619][T24900] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 860.362626][T30465] bridge0: port 1(bridge_slave_0) entered blocking state [ 860.362801][T30465] bridge0: port 1(bridge_slave_0) entered disabled state [ 860.362976][T30465] bridge_slave_0: entered allmulticast mode [ 860.365126][T30465] bridge_slave_0: entered promiscuous mode [ 860.665197][T17697] tipc: Resetting bearer [ 860.738761][T30056] Bluetooth: hci2: command tx timeout [ 861.167276][T30583] ieee802154 phy0 wpan0: encryption failed: -22 [ 861.174428][T30584] ieee802154 phy0 wpan0: encryption failed: -22 [ 861.493686][T17697] tipc: Disabling bearer [ 861.823646][T17697] .` (unregistering): Released all slaves [ 861.840082][T17697] bond1 (unregistering): Released all slaves [ 861.864452][T17697] bond2 (unregistering): Released all slaves [ 861.893329][T17697] bond3 (unregistering): Released all slaves [ 861.915343][T17697] bond4 (unregistering): Released all slaves [ 861.964121][T17697] bond5 (unregistering): Released all slaves [ 861.992242][T17697] bond6 (unregistering): Released all slaves [ 862.013949][T17697] bond7 (unregistering): Released all slaves [ 862.045310][T17697] bond0 (unregistering): Released all slaves [ 862.071371][T17697] bond8 (unregistering): Released all slaves [ 862.086161][T17697] bond9 (unregistering): Released all slaves [ 862.113233][T17697] bond10 (unregistering): Released all slaves [ 862.140348][T30465] bridge0: port 2(bridge_slave_1) entered blocking state [ 862.140541][T30465] bridge0: port 2(bridge_slave_1) entered disabled state [ 862.140712][T30465] bridge_slave_1: entered allmulticast mode [ 862.142713][T30465] bridge_slave_1: entered promiscuous mode [ 862.582765][T17697] tipc: Left network mode [ 862.601674][T30465] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 862.613073][T30465] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 862.781512][T30601] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 862.830070][T30056] Bluetooth: hci2: command tx timeout [ 862.875869][T30465] team0: Port device team_slave_0 added [ 862.889192][T30465] team0: Port device team_slave_1 added [ 863.117134][T30465] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 863.117156][T30465] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 863.117180][T30465] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 863.163964][T30465] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 863.163984][T30465] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 863.164007][T30465] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 863.210034][T30611] syzkaller1: entered promiscuous mode [ 863.210058][T30611] syzkaller1: entered allmulticast mode [ 863.512846][T30627] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 863.656934][T30465] hsr_slave_0: entered promiscuous mode [ 863.665705][T30465] hsr_slave_1: entered promiscuous mode [ 863.670215][T30465] debugfs: 'hsr0' already exists in 'hsr' [ 863.670240][T30465] Cannot create hsr debugfs directory [ 864.071288][T30639] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6483'. [ 864.115117][T30639] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6483'. [ 864.206541][T30647] netlink: 48 bytes leftover after parsing attributes in process `syz.2.6485'. [ 864.504046][T30654] netlink: 'syz.1.6486': attribute type 32 has an invalid length. [ 864.765474][T30659] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6488'. [ 864.904162][T30056] Bluetooth: hci2: command tx timeout [ 865.002630][T30659] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 865.094639][T30669] sctp: [Deprecated]: syz.2.6491 (pid 30669) Use of struct sctp_assoc_value in delayed_ack socket option. [ 865.094639][T30669] Use struct sctp_sack_info instead [ 865.121872][T30671] netlink: zone id is out of range [ 865.121890][T30671] netlink: zone id is out of range [ 865.121900][T30671] netlink: zone id is out of range [ 865.121908][T30671] netlink: zone id is out of range [ 865.121916][T30671] netlink: zone id is out of range [ 865.121925][T30671] netlink: zone id is out of range [ 865.121937][T30671] netlink: zone id is out of range [ 865.121944][T30671] netlink: zone id is out of range [ 865.121951][T30671] netlink: zone id is out of range [ 865.276849][T30670] syzkaller1: entered promiscuous mode [ 865.276876][T30670] syzkaller1: entered allmulticast mode [ 865.546393][T30465] netdevsim netdevsim3 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 865.546433][T30465] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 865.797022][T30465] netdevsim netdevsim3 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 865.797062][T30465] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 865.944945][ T1963] block nbd2: Possible stuck request ffff888027155080: control (read@0,4096B). Runtime 330 seconds [ 866.281423][T30465] netdevsim netdevsim3 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 866.281461][T30465] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 866.396122][T30698] netlink: 48 bytes leftover after parsing attributes in process `syz.0.6499'. [ 866.508352][T17697] veth1_macvtap: left promiscuous mode [ 866.527614][T17697] veth0_macvtap: left promiscuous mode [ 866.532594][T17697] veth1_vlan: left promiscuous mode [ 866.532632][T17697] veth0_vlan: left promiscuous mode [ 867.466265][T30725] netlink: 'syz.0.6502': attribute type 9 has an invalid length. [ 867.612949][T30730] netlink: 36 bytes leftover after parsing attributes in process `syz.2.6504'. [ 869.067995][T30761] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6511'. [ 869.097552][T17697] IPVS: stop unused estimator thread 0... [ 869.512048][T30763] veth3: entered promiscuous mode [ 869.512075][T30763] veth3: entered allmulticast mode [ 870.353650][T30465] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 870.440931][ T1313] ieee802154 phy0 wpan0: encryption failed: -22 [ 870.696982][T30465] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 870.698123][T30465] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 870.785690][T30465] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 870.787736][T30800] netlink: 48 bytes leftover after parsing attributes in process `syz.4.6518'. [ 870.790749][T30465] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 870.859408][T30465] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 870.861972][T30465] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 870.897438][T30465] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 871.247515][T30816] netlink: 44 bytes leftover after parsing attributes in process `syz.4.6521'. [ 871.452217][T30465] 8021q: adding VLAN 0 to HW filter on device bond0 [ 871.577030][T30465] 8021q: adding VLAN 0 to HW filter on device team0 [ 871.580844][T30825] netlink: 'syz.0.6523': attribute type 11 has an invalid length. [ 871.627978][T30832] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6524'. [ 871.781886][T30832] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6524'. [ 871.785104][T30832] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6524'. [ 871.914074][T30832] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6524'. [ 871.914945][T10097] bridge0: port 1(bridge_slave_0) entered blocking state [ 871.915101][T10097] bridge0: port 1(bridge_slave_0) entered forwarding state [ 871.934375][T10097] netdevsim netdevsim4 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 871.934624][T10097] netdevsim netdevsim4 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 871.934659][T10097] netdevsim netdevsim4 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 871.934691][T10097] netdevsim netdevsim4 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 871.935114][T30832] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6524'. [ 871.935355][T30832] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6524'. [ 871.935675][T30832] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6524'. [ 871.935886][T30832] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6524'. [ 871.959708][T10097] bridge0: port 2(bridge_slave_1) entered blocking state [ 871.959835][T10097] bridge0: port 2(bridge_slave_1) entered forwarding state [ 872.105998][T30844] net_ratelimit: 502 callbacks suppressed [ 872.106022][T30844] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 872.251394][T30845] netlink: 'syz.0.6526': attribute type 8 has an invalid length. [ 872.674081][T30858] tipc: Enabling of bearer rejected, failed to enable media [ 874.642719][T30465] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 874.773647][T30918] dvmrp1: entered allmulticast mode [ 874.981746][T30465] veth0_vlan: entered promiscuous mode [ 875.072071][T30465] veth1_vlan: entered promiscuous mode [ 875.278099][T30465] veth0_macvtap: entered promiscuous mode [ 875.310118][T30465] veth1_macvtap: entered promiscuous mode [ 875.402159][T30465] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 875.472227][T30465] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 875.561015][ T6379] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 875.562037][ T6379] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 875.562354][ T6379] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 875.562401][ T6379] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 876.062606][T17699] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 876.062634][T17699] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 876.275334][T10097] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 876.275358][T10097] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 876.901427][T30975] __nla_validate_parse: 59 callbacks suppressed [ 876.901451][T30975] netlink: 12 bytes leftover after parsing attributes in process `syz.0.6553'. [ 877.027078][T30982] geneve2: entered allmulticast mode [ 877.055635][T30984] openvswitch: netlink: Tunnel attr 2 has unexpected len 0 expected 4 [ 877.381869][T30993] netlink: 24 bytes leftover after parsing attributes in process `syz.2.6557'. [ 878.278088][T31025] netlink: 'syz.2.6566': attribute type 2 has an invalid length. [ 878.672185][T31038] netlink: 'syz.3.6569': attribute type 4 has an invalid length. [ 878.947507][T31045] syzkaller1: entered promiscuous mode [ 878.947532][T31045] syzkaller1: entered allmulticast mode [ 879.005005][T31045] FAULT_INJECTION: forcing a failure. [ 879.005005][T31045] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 879.005040][T31045] CPU: 0 UID: 0 PID: 31045 Comm: syz.1.6571 Not tainted syzkaller #0 PREEMPT(full) [ 879.005063][T31045] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 879.005074][T31045] Call Trace: [ 879.005083][T31045] [ 879.005092][T31045] dump_stack_lvl+0xe8/0x150 [ 879.005131][T31045] should_fail_ex+0x410/0x560 [ 879.005164][T31045] _copy_from_iter+0x1d3/0x1660 [ 879.005197][T31045] ? _copy_from_iter+0x21b/0x1660 [ 879.005222][T31045] ? __pfx__copy_from_iter+0x10/0x10 [ 879.005252][T31045] ? __pfx__copy_from_iter+0x10/0x10 [ 879.005285][T31045] copy_page_from_iter+0x219/0x2d0 [ 879.005313][T31045] skb_copy_datagram_from_iter+0x2f4/0x720 [ 879.005359][T31045] tun_get_user+0xc7f/0x44d0 [ 879.005401][T31045] ? aa_file_perm+0x18b/0x15f0 [ 879.005433][T31045] ? aa_file_perm+0x4ed/0x15f0 [ 879.005460][T31045] ? __pfx_tun_get_user+0x10/0x10 [ 879.005486][T31045] ? __lock_acquire+0x747/0x2de0 [ 879.005513][T31045] ? kstrtoull+0x137/0x1d0 [ 879.005561][T31045] ? ref_tracker_alloc+0x341/0x4b0 [ 879.005586][T31045] ? lock_acquire+0x115/0x350 [ 879.005609][T31045] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 879.005636][T31045] ? lock_acquire+0x115/0x350 [ 879.005658][T31045] ? tun_get+0x1c/0x2f0 [ 879.005686][T31045] ? tun_get+0x1c/0x2f0 [ 879.005707][T31045] ? tun_get+0x1c/0x2f0 [ 879.005734][T31045] tun_chr_write_iter+0x113/0x200 [ 879.005761][T31045] vfs_write+0x612/0xba0 [ 879.005810][T31045] ? __pfx_vfs_write+0x10/0x10 [ 879.005850][T31045] ? __fget_files+0x2a/0x420 [ 879.005887][T31045] ksys_write+0x150/0x270 [ 879.005920][T31045] ? __pfx_ksys_write+0x10/0x10 [ 879.005961][T31045] do_syscall_64+0x166/0x520 [ 879.005989][T31045] ? trace_irq_disable+0x3b/0x140 [ 879.006016][T31045] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 879.006038][T31045] ? clear_bhb_loop+0x70/0xc0 [ 879.006064][T31045] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 879.006085][T31045] RIP: 0033:0x7f7b3e19e159 [ 879.006106][T31045] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 879.006124][T31045] RSP: 002b:00007f7b3f057028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 879.006149][T31045] RAX: ffffffffffffffda RBX: 00007f7b3e425fa0 RCX: 00007f7b3e19e159 [ 879.006164][T31045] RDX: 000000000000fdef RSI: 0000200000001440 RDI: 0000000000000003 [ 879.006179][T31045] RBP: 00007f7b3f057090 R08: 0000000000000000 R09: 0000000000000000 [ 879.006192][T31045] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 879.006205][T31045] R13: 00007f7b3e426038 R14: 00007f7b3e425fa0 R15: 00007ffc062d2618 [ 879.006240][T31045] [ 879.404444][T31055] sctp: [Deprecated]: syz.0.6574 (pid 31055) Use of struct sctp_assoc_value in delayed_ack socket option. [ 879.404444][T31055] Use struct sctp_sack_info instead [ 879.778035][T31066] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6577'. [ 879.997410][T31068] netlink: 4 bytes leftover after parsing attributes in process `syz.3.6576'. [ 880.108189][T31072] bridge_slave_0: left allmulticast mode [ 880.108220][T31072] bridge_slave_0: left promiscuous mode [ 880.142558][T31072] bridge0: port 1(bridge_slave_0) entered disabled state [ 880.192002][T31072] bridge_slave_1: left allmulticast mode [ 880.192071][T31072] bridge_slave_1: left promiscuous mode [ 880.194585][T31072] bridge0: port 2(bridge_slave_1) entered disabled state [ 880.263507][T31072] bond0: (slave bond_slave_0): Releasing backup interface [ 880.296653][T31072] bond0: (slave bond_slave_1): Releasing backup interface [ 880.329466][T31072] team0: Port device team_slave_0 removed [ 880.335565][T31072] team0: Port device team_slave_1 removed [ 880.336613][T31072] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 880.336636][T31072] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 880.342220][T31072] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 880.342243][T31072] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 880.379906][T31072] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 880.870257][T31097] x_tables: ip6_tables: icmp6 match: only valid for protocol 58 [ 882.336696][T31138] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6591'. [ 882.336724][T31138] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6591'. [ 882.995062][T31156] openvswitch: netlink: IP tunnel attribute has 5413 unknown bytes. [ 883.123876][T31166] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6597'. [ 883.294209][T31172] x_tables: unsorted entry at hook 3 [ 883.548145][T31176] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6600'. [ 883.621580][T31176] netdevsim netdevsim1 netdevsim0: entered promiscuous mode [ 883.627056][T31176] netlink: 152 bytes leftover after parsing attributes in process `syz.1.6600'. [ 883.968085][T31191] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 883.997129][T31191] netlink: 24 bytes leftover after parsing attributes in process `syz.0.6606'. [ 883.997158][T31191] netlink: 'syz.0.6606': attribute type 3 has an invalid length. [ 883.997174][T31191] netlink: 24 bytes leftover after parsing attributes in process `syz.0.6606'. [ 883.997449][T31191] netlink: 'syz.0.6606': attribute type 3 has an invalid length. [ 884.245470][T31199] netlink: 12 bytes leftover after parsing attributes in process `syz.2.6609'. [ 884.297484][T31201] netlink: 160 bytes leftover after parsing attributes in process `syz.3.6610'. [ 884.300426][T31201] netlink: 28 bytes leftover after parsing attributes in process `syz.3.6610'. [ 885.114229][T31228] netlink: 'syz.2.6619': attribute type 1 has an invalid length. [ 885.313278][T31233] 8021q: adding VLAN 0 to HW filter on device bond4 [ 885.315993][T31233] bond3: (slave bond4): making interface the new active one [ 885.316619][T31233] bond3: (slave bond4): Enslaving as an active interface with an up link [ 885.359902][T31243] netlink: 'syz.1.6622': attribute type 1 has an invalid length. [ 885.359968][T31243] netlink: 'syz.1.6622': attribute type 2 has an invalid length. [ 885.389340][T31228] 8021q: adding VLAN 0 to HW filter on device bond3 [ 885.682360][T31253] netlink: 'syz.2.6626': attribute type 1 has an invalid length. [ 885.842309][T31256] 8021q: adding VLAN 0 to HW filter on device bond6 [ 885.865779][T31256] bond5: (slave bond6): making interface the new active one [ 885.866473][T31256] bond5: (slave bond6): Enslaving as an active interface with an up link [ 886.037419][T31266] netlink: 'syz.0.6629': attribute type 7 has an invalid length. [ 886.248020][T31273] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 886.422636][ T3402] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 887.936332][T31229] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 888.913231][T31299] netlink: 'syz.4.6639': attribute type 4 has an invalid length. [ 888.974198][T31287] syzkaller1: entered promiscuous mode [ 888.974228][T31287] syzkaller1: entered allmulticast mode [ 889.247733][T31307] netlink: 'syz.4.6641': attribute type 1 has an invalid length. [ 889.547157][T31307] bond3: entered promiscuous mode [ 889.547612][T31307] 8021q: adding VLAN 0 to HW filter on device bond3 [ 889.770774][T31307] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for gretap1 [ 889.800078][T31307] batman_adv: batadv0: Adding interface: gretap1 [ 889.800098][T31307] batman_adv: batadv0: The MTU of interface gretap1 is too small (1462) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 889.800324][T31307] batman_adv: batadv0: Interface activated: gretap1 [ 889.902033][T31324] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 889.985075][T31307] bond3: (slave bridge2): making interface the new active one [ 889.985142][T31307] bridge2: entered promiscuous mode [ 889.996715][T31307] bond3: (slave bridge2): Enslaving as an active interface with an up link [ 890.047009][T31330] openvswitch: netlink: Unknown VXLAN extension attribute 0 [ 890.047644][T31328] __nla_validate_parse: 3 callbacks suppressed [ 890.047693][T31328] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6647'. [ 890.478918][T31340] ip_tables: iptables: counters copy to user failed while replacing table [ 890.528060][T31345] ip_tables: iptables: counters copy to user failed while replacing table [ 890.795877][T31351] syzkaller1: entered promiscuous mode [ 890.795946][T31351] syzkaller1: entered allmulticast mode [ 891.055459][T31357] netlink: 'syz.3.6655': attribute type 12 has an invalid length. [ 891.209940][T31366] netlink: 12 bytes leftover after parsing attributes in process `syz.1.6657'. [ 891.214167][T31366] netlink: 12 bytes leftover after parsing attributes in process `syz.1.6657'. [ 891.886422][T31391] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6665'. [ 891.887344][T31392] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6665'. [ 891.928117][T31391] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6665'. [ 891.941927][T31391] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6665'. [ 891.942512][T31391] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6665'. [ 891.943130][T31391] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6665'. [ 891.943674][T31391] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6665'. [ 892.675020][T31415] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 893.044951][T31428] sctp: [Deprecated]: syz.4.6677 (pid 31428) Use of struct sctp_assoc_value in delayed_ack socket option. [ 893.044951][T31428] Use struct sctp_sack_info instead [ 893.174493][T31435] sctp: [Deprecated]: syz.3.6679 (pid 31435) Use of struct sctp_assoc_value in delayed_ack socket option. [ 893.174493][T31435] Use struct sctp_sack_info instead [ 893.540021][T31442] netlink: 'syz.3.6681': attribute type 1 has an invalid length. [ 893.615276][T31447] gretap0: entered promiscuous mode [ 893.717744][T31451] 8021q: adding VLAN 0 to HW filter on device bond2 [ 893.728330][T31451] bond1: (slave bond2): making interface the new active one [ 893.732127][T31451] bond1: (slave bond2): Enslaving as an active interface with an up link [ 893.834880][T31442] bond1: (slave gretap1): Enslaving as a backup interface with an up link [ 893.901048][T31448] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 895.466229][T31501] __nla_validate_parse: 69 callbacks suppressed [ 895.466252][T31501] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6699'. [ 895.624339][T31520] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6704'. [ 895.835831][T31528] netlink: 20 bytes leftover after parsing attributes in process `syz.1.6706'. [ 895.933095][T31528] veth2: entered promiscuous mode [ 895.933119][T31528] veth2: entered allmulticast mode [ 896.020603][ T1963] block nbd2: Possible stuck request ffff888027155080: control (read@0,4096B). Runtime 360 seconds [ 896.422513][T31538] netlink: 44 bytes leftover after parsing attributes in process `syz.2.6708'. [ 896.489591][T31538] netlink: 'syz.2.6708': attribute type 1 has an invalid length. [ 896.556254][T31547] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6711'. [ 896.581001][T31548] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 896.612057][T31548] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6708'. [ 896.801777][T31555] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 896.865512][T31557] tipc: Failed to remove unknown binding: 66,0,0/0:876476207/876476208 [ 896.886908][T31551] bond7: (slave gretap2): making interface the new active one [ 896.888044][T31551] bond7: (slave gretap2): Enslaving as an active interface with an up link [ 896.920543][T31547] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 896.924478][T31560] netlink: 244 bytes leftover after parsing attributes in process `syz.3.6715'. [ 897.163855][T31560] netlink: 20 bytes leftover after parsing attributes in process `syz.3.6715'. [ 897.891565][T31599] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6724'. [ 897.927173][T31598] netlink: 20 bytes leftover after parsing attributes in process `syz.0.6725'. [ 898.222661][T31606] bridge_slave_0: left allmulticast mode [ 898.222692][T31606] bridge_slave_0: left promiscuous mode [ 898.225763][T31606] bridge0: port 1(bridge_slave_0) entered disabled state [ 898.262212][T31611] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 898.263647][T31606] bridge_slave_1: left allmulticast mode [ 898.263675][T31606] bridge_slave_1: left promiscuous mode [ 898.265524][T31606] bridge0: port 2(bridge_slave_1) entered disabled state [ 898.366478][T31606] bond0: (slave bond_slave_0): Releasing backup interface [ 898.395515][T31606] bond0: (slave bond_slave_1): Releasing backup interface [ 898.441072][T31606] team0: Port device team_slave_0 removed [ 898.455104][T31606] team0: Port device team_slave_1 removed [ 898.456656][T31606] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 898.456681][T31606] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 898.479023][T31606] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 898.479055][T31606] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 898.525451][T31606] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 899.388052][T31642] sock: sock_timestamping_bind_phc: sock not bind to device [ 899.936705][T31661] batman_adv: batadv0: Adding interface: veth0 [ 899.936727][T31661] batman_adv: batadv0: The MTU of interface veth0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 899.936757][T31661] batman_adv: batadv0: Interface activated: veth0 [ 900.102520][T31668] x_tables: duplicate underflow at hook 2 [ 900.311541][T31674] xt_CT: You must specify a L4 protocol and not use inversions on it [ 900.453564][T31677] xt_hashlimit: Unknown mode mask 2000, kernel too old? [ 901.227449][T31702] __nla_validate_parse: 4 callbacks suppressed [ 901.227472][T31702] netlink: 44 bytes leftover after parsing attributes in process `syz.0.6755'. [ 901.237794][T31702] netlink: 16 bytes leftover after parsing attributes in process `syz.0.6755'. [ 901.461252][T31713] IPVS: set_ctl: invalid protocol: 0 0.0.0.0:0 [ 901.732125][T31723] netlink: 'syz.0.6759': attribute type 1 has an invalid length. [ 901.789478][T31723] netlink: 56 bytes leftover after parsing attributes in process `syz.0.6759'. [ 902.079509][T31735] syzkaller0: entered promiscuous mode [ 902.079535][T31735] syzkaller0: entered allmulticast mode [ 902.286639][T31736] ipvlan2: entered allmulticast mode [ 902.286663][T31736] virt_wifi0: entered allmulticast mode [ 902.304464][T31736] batman_adv: batadv0: Adding interface: ipvlan2 [ 902.304485][T31736] batman_adv: batadv0: The MTU of interface ipvlan2 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 902.304514][T31736] batman_adv: batadv0: Interface activated: ipvlan2 [ 902.355517][T31735] macvtap0: entered promiscuous mode [ 902.355754][T31735] macvtap0: entered allmulticast mode [ 902.355770][T31735] veth0_macvtap: entered allmulticast mode [ 902.377900][T31751] netlink: 'syz.2.6767': attribute type 8 has an invalid length. [ 902.377922][T31751] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6767'. [ 902.377955][T31751] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6767'. [ 903.037693][T31770] netlink: 16 bytes leftover after parsing attributes in process `syz.2.6771'. [ 903.350327][T31781] netlink: 20 bytes leftover after parsing attributes in process `syz.4.6775'. [ 903.839449][T31797] netlink: 'syz.1.6777': attribute type 2 has an invalid length. [ 903.839476][T31797] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6777'. [ 903.906133][T31798] netlink: 16 bytes leftover after parsing attributes in process `syz.2.6779'. [ 904.142035][T31804] netlink: 33 bytes leftover after parsing attributes in process `syz.1.6782'. [ 904.142065][T31804] openvswitch: netlink: Flow key attr not present in new flow. [ 904.204436][T31804] syzkaller1: entered promiscuous mode [ 904.204462][T31804] syzkaller1: entered allmulticast mode [ 904.504428][T31817] openvswitch: netlink: Unexpected mask (mask=440, allowed=10048) [ 904.669519][T31814] tipc: Started in network mode [ 904.669583][T31814] tipc: Node identity , cluster identity 4711 [ 904.669644][T31814] tipc: Failed to obtain node identity [ 904.669741][T31814] tipc: Enabling of bearer rejected, failed to enable media [ 905.158265][T31836] openvswitch: netlink: Duplicate or invalid key (type 0). [ 905.249775][T31837] netlink: 'syz.3.6789': attribute type 10 has an invalid length. [ 905.250221][T31837] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 905.251902][T31841] netlink: 'syz.3.6789': attribute type 10 has an invalid length. [ 905.252362][T31841] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 905.533003][T31848] macsec1: entered promiscuous mode [ 905.533030][T31848] bridge0: entered promiscuous mode [ 905.533253][T31848] macsec1: entered allmulticast mode [ 905.533269][T31848] bridge0: entered allmulticast mode [ 905.574403][T31848] syzkaller1: entered promiscuous mode [ 905.574429][T31848] syzkaller1: entered allmulticast mode [ 906.272529][T31871] __nla_validate_parse: 6 callbacks suppressed [ 906.272552][T31871] netlink: 24 bytes leftover after parsing attributes in process `syz.3.6799'. [ 906.706053][T31889] netlink: 'syz.4.6804': attribute type 1 has an invalid length. [ 907.003110][T31889] netlink: 24 bytes leftover after parsing attributes in process `syz.4.6804'. [ 907.005201][T31892] erspan1: entered promiscuous mode [ 907.005235][T31892] erspan1: entered allmulticast mode [ 907.258691][T31889] veth3: entered allmulticast mode [ 907.261161][T31911] netlink: 48 bytes leftover after parsing attributes in process `syz.3.6812'. [ 907.292187][T31889] bond4: (slave veth3): Enslaving as an active interface with a down link [ 907.340714][T31884] bond4: (slave veth0_to_bond): Enslaving as an active interface with a down link [ 907.377641][T31911] netlink: 48 bytes leftover after parsing attributes in process `syz.3.6812'. [ 907.443361][T31913] netlink: 24 bytes leftover after parsing attributes in process `syz.2.6810'. [ 907.586037][T31923] netlink: 12 bytes leftover after parsing attributes in process `syz.0.6813'. [ 907.659813][T31923] netlink: 16 bytes leftover after parsing attributes in process `syz.0.6813'. [ 907.783356][T31930] netlink: 'syz.4.6816': attribute type 46 has an invalid length. [ 907.842252][T31930] netlink: 'syz.4.6816': attribute type 46 has an invalid length. [ 908.189221][T31942] syzkaller1: entered promiscuous mode [ 908.189247][T31942] syzkaller1: entered allmulticast mode [ 908.192484][T31946] sit0: entered promiscuous mode [ 908.238258][T31946] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6818'. [ 908.827520][T31968] wireguard0: entered promiscuous mode [ 910.098065][T31978] netlink: 'syz.0.6827': attribute type 4 has an invalid length. [ 910.098128][T31978] netlink: 17 bytes leftover after parsing attributes in process `syz.0.6827'. [ 910.147495][T31904] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 910.603849][T31993] netlink: 'syz.4.6831': attribute type 1 has an invalid length. [ 910.806717][T31993] bond5: entered promiscuous mode [ 910.808323][T31993] 8021q: adding VLAN 0 to HW filter on device bond5 [ 910.860276][T32004] netlink: 4552 bytes leftover after parsing attributes in process `syz.1.6834'. [ 910.918207][T31999] macvtap1: entered allmulticast mode [ 911.018217][T31993] bond5: (slave bridge3): making interface the new active one [ 911.018275][T31993] bridge3: entered promiscuous mode [ 911.033748][T31993] bond5: (slave bridge3): Enslaving as an active interface with an up link [ 911.382662][ T32] INFO: task udevd:16459 blocked in I/O wait for more than 143 seconds. [ 911.382728][ T32] Not tainted syzkaller #0 [ 911.382739][ T32] Blocked by coredump. [ 911.382765][ T32] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. ** replaying previous printk message ** [ 911.382765][ T32] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 911.382792][ T32] task:udevd state:D stack:22856 pid:16459 tgid:16459 ppid:4987 task_flags:0x40054c flags:0x00080803 [ 911.382892][ T32] Call Trace: [ 911.382900][ T32] [ 911.382931][ T32] __schedule+0x17db/0x58f0 [ 911.383093][ T32] ? __pfx___schedule+0x10/0x10 [ 911.383167][ T32] ? schedule+0x90/0x2b0 [ 911.383225][ T32] schedule+0x164/0x2b0 [ 911.383288][ T32] io_schedule+0x7f/0xd0 [ 911.383329][ T32] folio_wait_bit_common+0x836/0xbc0 [ 911.383421][ T32] ? __pfx_folio_wait_bit_common+0x10/0x10 [ 911.383458][ T32] ? filemap_get_entry+0x374/0x3f0 [ 911.383516][ T32] ? __pfx_wake_page_function+0x10/0x10 [ 911.383625][ T32] ? __filemap_get_folio_mpol+0x84/0x1000 [ 911.383682][ T32] __filemap_get_folio_mpol+0x140/0x1000 [ 911.383752][ T32] truncate_inode_pages_range+0x46d/0xd80 [ 911.383854][ T32] ? __pfx_truncate_inode_pages_range+0x10/0x10 [ 911.383989][ T32] ? __pfx_call_function_single_prep_ipi+0x10/0x10 [ 911.390112][ T32] ? __pfx_invalidate_bh_lru+0x10/0x10 [ 911.390271][ T32] ? __pfx_smp_call_function_many_cond+0x10/0x10 [ 911.390334][ T32] ? __pfx___mutex_lock+0x10/0x10 [ 911.392169][ T32] blkdev_flush_mapping+0x109/0x2f0 [ 911.392307][ T32] bdev_release+0x443/0x690 [ 911.392398][ T32] ? __pfx_blkdev_release+0x10/0x10 [ 911.392440][ T32] blkdev_release+0x15/0x20 [ 911.392496][ T32] __fput+0x418/0xa50 [ 911.392568][ T32] task_work_run+0x1d9/0x270 [ 911.392633][ T32] ? __pfx_task_work_run+0x10/0x10 [ 911.392691][ T32] ? do_raw_spin_unlock+0xf5/0x200 [ 911.392763][ T32] do_exit+0x73a/0x2360 [ 911.392829][ T32] ? lock_acquire+0x115/0x350 [ 911.392887][ T32] ? __pfx_do_exit+0x10/0x10 [ 911.392929][ T32] ? do_raw_spin_lock+0x12b/0x2f0 [ 911.394796][ T32] do_group_exit+0x22d/0x2f0 [ 911.394856][ T32] ? _raw_spin_unlock_irq+0x23/0x50 [ 911.394957][ T32] get_signal+0x121b/0x12c0 [ 911.395088][ T32] arch_do_signal_or_restart+0xbb/0x860 [ 911.395179][ T32] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 911.395252][ T32] ? ksys_read+0x1fc/0x270 [ 911.395344][ T32] exit_to_user_mode_loop+0x10e/0x770 [ 911.395386][ T32] ? rcu_is_watching+0x16/0xb0 [ 911.395450][ T32] do_syscall_64+0x328/0x520 [ 911.395510][ T32] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 911.395551][ T32] ? clear_bhb_loop+0x70/0xc0 [ 911.395612][ T32] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 911.395652][ T32] RIP: 0033:0x7ffa316a7407 [ 911.395706][ T32] RSP: 002b:00007ffeff626e80 EFLAGS: 00000202 ORIG_RAX: 0000000000000000 [ 911.395748][ T32] RAX: fffffffffffffffc RBX: 00007ffa31e24880 RCX: 00007ffa316a7407 [ 911.395800][ T32] RDX: 0000000000000200 RSI: 00007ffa31e23000 RDI: 0000000000000009 [ 911.395813][ T32] RBP: 0000562a53992c50 R08: 0000000000000000 R09: 0000000000000000 [ 911.396130][ T32] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000 [ 911.396147][ T32] R13: 0000000000000000 R14: 0000562a5399bfb8 R15: 00007ffa31f4b39c [ 911.396232][ T32] [ 911.396430][ T32] [ 911.396430][ T32] Showing all locks held in the system: [ 911.396459][ T32] locks held by pr/ttyS0/16: 2, last CPU#0: [ 911.396493][ T32] #0: ffffffff8ec364f8 (console_srcu){....}-{0:0}, at: console_srcu_read_lock+0x30/0x60 [ 911.396623][ T32] #1: ffffffff9ad3d098 (&port_lock_key){-.-.}-{3:3}, at: univ8250_console_device_lock+0x67/0xc0 [ 911.396825][ T32] locks held by khungtaskd/32: 1, last CPU#1: [ 911.396858][ T32] #0: ffffffff8ed5c8e0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 [ 911.399977][ T32] locks held by kworker/u8:6/191: 4, last CPU#1: [ 911.400028][ T32] #0: ffff88804db2b140 ((wq_completion)wg-kex-wg1#16){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 911.400162][ T32] #1: ffffc90002df7c40 ((work_completion)(&peer->transmit_handshake_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 911.400270][ T32] #2: ffff888054661440 (&wg->static_identity.lock){++++}-{4:4}, at: wg_noise_handshake_create_initiation+0x12e/0x810 [ 911.400465][ T32] #3: ffff88807a5caad0 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_create_initiation+0x13f/0x810 [ 911.400631][ T32] locks held by getty/5377: 2, on CPU#0: [ 911.400689][ T32] #0: ffff8880363260a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 [ 911.401279][ T32] #1: ffffc9000322b2e8 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x45a/0x1360 [ 911.401574][ T32] locks held by kworker/u9:2/5622: 3, on CPU#1: [ 911.401607][ T32] #0: ffff888055984940 ((wq_completion)hci4){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 911.401714][ T32] #1: ffffc900043a7c40 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 911.401875][ T32] #2: ffff888081874ea0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_cmd_sync_work+0x1cb/0x3f0 [ 911.402071][ T32] locks held by udevd/16459: 1, on CPU#1: [ 911.402333][ T32] #0: ffff8880270a0350 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_release+0x1b8/0x690 [ 911.402488][ T32] locks held by kworker/0:16/18852: 3, on CPU#0: [ 911.402520][ T32] #0: ffff88801b06b140 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 911.402627][ T32] #1: ffffc90003f27c40 ((work_completion)(&w->w)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 911.402786][ T32] #2: ffffffff905b2000 (nfc_devlist_mutex){+.+.}-{4:4}, at: nfc_urelease_event_work+0xb5/0x330 [ 911.402979][ T32] locks held by kworker/0:17/18853: 2, last CPU#0: [ 911.403019][ T32] #0: ffff88801b069d40 ((wq_completion)events_power_efficient){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 911.403142][ T32] #1: ffffc90003f07c40 ((gc_work).work){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 911.404659][ T32] locks held by kworker/1:30/24899: 4, on CPU#1: [ 911.404692][ T32] #0: ffff88801b06b140 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 911.404816][ T32] #1: ffffc9000703fc40 ((work_completion)(&w->w)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 911.404922][ T32] #2: ffffffff905b2000 (nfc_devlist_mutex){+.+.}-{4:4}, at: nfc_urelease_event_work+0xb5/0x330 [ 911.405143][ T32] #3: ffff88802a627560 (&genl_data->genl_data_mutex){+.+.}-{4:4}, at: nfc_urelease_event_work+0x11e/0x330 [ 911.405284][ T32] locks held by syz.2.6830/31982: 1, on CPU#0: [ 911.405316][ T32] #0: ffff88802a627140 (&dev->mutex){....}-{4:4}, at: nfc_unregister_rfkill+0x63/0x280 [ 911.406297][ T32] locks held by syz.2.6830/31985: 2, on CPU#0: [ 911.406332][ T32] #0: ffffffff902c4448 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 [ 911.407962][ T32] #1: ffffffff902c4280 (genl_mutex){+.+.}-{4:4}, at: genl_rcv_msg+0x10b/0x7a0 [ 911.408103][ T32] locks held by syz.2.6830/31995: 5, on CPU#1: [ 911.408140][ T32] #0: ffffffff902c4448 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 [ 911.408259][ T32] #1: ffffffff902c4280 (genl_mutex){+.+.}-{4:4}, at: genl_rcv_msg+0x10b/0x7a0 [ 911.408493][ T32] #2: ffff88802a627560 (&genl_data->genl_data_mutex){+.+.}-{4:4}, at: nfc_genl_start_poll+0x1cd/0x370 [ 911.408617][ T32] #3: ffff88802a627140 (&dev->mutex){....}-{4:4}, at: nfc_start_poll+0x53/0x300 [ 911.408718][ T32] #4: ffff88805a708348 (&ndev->req_lock){+.+.}-{4:4}, at: nci_start_poll+0x525/0xd20 [ 911.411640][ T32] locks held by syz.3.6833/31998: 2, on CPU#0: [ 911.411696][ T32] #0: ffffffff902c4448 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 [ 911.411805][ T32] #1: ffffffff902c4280 (genl_mutex){+.+.}-{4:4}, at: genl_rcv_msg+0x10b/0x7a0 [ 911.411926][ T32] locks held by syz.1.6834/32004: 2, on CPU#0: [ 911.411959][ T32] #0: ffffffff902c4448 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 [ 911.412068][ T32] #1: ffffffff902c4280 (genl_mutex){+.+.}-{4:4}, at: genl_rcv_msg+0x10b/0x7a0 [ 911.412188][ T32] locks held by syz.1.6834/32007: 2, on CPU#0: [ 911.412220][ T32] #0: ffffffff902c4448 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 [ 911.412363][ T32] #1: ffffffff902c4280 (genl_mutex){+.+.}-{4:4}, at: genl_rcv_msg+0x10b/0x7a0 [ 911.412484][ T32] locks held by syz.0.6835/32013: 2, on CPU#0: [ 911.412516][ T32] #0: ffffffff902c4448 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 [ 911.412618][ T32] #1: ffffffff902c4280 (genl_mutex){+.+.}-{4:4}, at: genl_rcv_msg+0x10b/0x7a0 [ 911.413176][ T32] locks held by syz.0.6835/32014: 2, on CPU#0: [ 911.413209][ T32] #0: ffffffff902c4448 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 [ 911.413312][ T32] #1: ffffffff902c4280 (genl_mutex){+.+.}-{4:4}, at: genl_rcv_msg+0x10b/0x7a0 [ 911.413434][ T32] locks held by syz.4.6836/32018: 2, on CPU#1: [ 911.413466][ T32] #0: ffffffff902c4448 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 [ 911.413566][ T32] #1: ffffffff902c4280 (genl_mutex){+.+.}-{4:4}, at: genl_rcv_msg+0x10b/0x7a0 [ 911.413672][ T32] [ 911.413696][ T32] ============================================= [ 911.413696][ T32] [ 911.413705][ T32] NMI backtrace for cpu 1 [ 911.413722][ T32] CPU: 1 UID: 0 PID: 32 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) [ 911.413742][ T32] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 911.413753][ T32] Call Trace: [ 911.413762][ T32] [ 911.413771][ T32] dump_stack_lvl+0xe8/0x150 [ 911.413798][ T32] nmi_cpu_backtrace+0x274/0x2d0 [ 911.413885][ T32] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 911.413928][ T32] nmi_trigger_cpumask_backtrace+0x17d/0x390 [ 911.413957][ T32] sys_info+0x135/0x170 [ 911.413981][ T32] watchdog+0xfd7/0x1030 [ 911.414016][ T32] ? watchdog+0x1c7/0x1030 [ 911.414041][ T32] kthread+0x38b/0x480 [ 911.414061][ T32] ? __pfx_watchdog+0x10/0x10 [ 911.414077][ T32] ? __pfx_kthread+0x10/0x10 [ 911.414097][ T32] ret_from_fork+0x514/0xb70 [ 911.414118][ T32] ? __pfx_ret_from_fork+0x10/0x10 [ 911.414136][ T32] ? __switch_to+0xc89/0x1420 [ 911.414163][ T32] ? __pfx_kthread+0x10/0x10 [ 911.414182][ T32] ret_from_fork_asm+0x1a/0x30 [ 911.414223][ T32] [ 911.414321][ T32] Sending NMI from CPU 1 to CPUs 0: [ 911.414366][ C0] NMI backtrace for cpu 0 [ 911.414383][ C0] CPU: 0 UID: 0 PID: 16 Comm: pr/ttyS0 Not tainted syzkaller #0 PREEMPT(full) [ 911.414404][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 911.414417][ C0] RIP: 0010:io_serial_in+0x77/0xc0 [ 911.414478][ C0] Code: e8 2e de 54 fc 44 89 f9 d3 e3 49 83 c6 40 4c 89 f0 48 c1 e8 03 42 80 3c 20 00 74 08 4c 89 f7 e8 ef e5 c4 fc 41 03 1e 89 da ec <0f> b6 c0 5b 41 5c 41 5e 41 5f e9 da d4 75 06 cc 44 89 f9 80 e1 07 [ 911.414494][ C0] RSP: 0018:ffffc900001578b8 EFLAGS: 00000002 [ 911.414521][ C0] RAX: 1ffffffff35a7a00 RBX: 00000000000003fd RCX: 0000000000000000 [ 911.414536][ C0] RDX: 00000000000003fd RSI: 0000000000000000 RDI: 0000000000000020 [ 911.414549][ C0] RBP: dffffc0000000000 R08: 0000000000000003 R09: 0000000000000004 [ 911.414562][ C0] R10: dffffc0000000000 R11: ffffffff8572f400 R12: dffffc0000000000 [ 911.414578][ C0] R13: 0000000000000000 R14: ffffffff9ad3d0c0 R15: 0000000000000000 [ 911.414591][ C0] FS: 0000000000000000(0000) GS:ffff888124cce000(0000) knlGS:0000000000000000 [ 911.414608][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 911.414622][ C0] CR2: 0000001b3451bff8 CR3: 000000004349e000 CR4: 00000000003526f0 [ 911.414641][ C0] Call Trace: [ 911.414649][ C0] [ 911.414658][ C0] wait_for_lsr+0x184/0x2f0 [ 911.414683][ C0] __serial8250_console_fifo_write+0xcd/0x3e0 [ 911.414715][ C0] serial8250_console_write+0xaa1/0x1200 [ 911.414735][ C0] ? lockdep_hardirqs_on+0x7b/0x110 [ 911.414762][ C0] ? __pfx_serial8250_console_write+0x10/0x10 [ 911.414782][ C0] ? __schedule+0x17f1/0x58f0 [ 911.414812][ C0] nbcon_emit_next_record+0xef5/0x1a90 [ 911.414843][ C0] ? __pfx_nbcon_emit_next_record+0x10/0x10 [ 911.414867][ C0] ? nbcon_context_try_acquire+0x819/0xbd0 [ 911.414897][ C0] ? _raw_spin_lock_irqsave+0x4c/0x60 [ 911.414919][ C0] nbcon_kthread_func+0x679/0x880 [ 911.414944][ C0] ? nbcon_kthread_func+0x163/0x880 [ 911.414964][ C0] ? __pfx_nbcon_kthread_func+0x10/0x10 [ 911.414987][ C0] ? __kthread_parkme+0x71/0x1f0 [ 911.415015][ C0] ? __kthread_parkme+0x199/0x1f0 [ 911.415044][ C0] kthread+0x38b/0x480 [ 911.415063][ C0] ? __pfx_nbcon_kthread_func+0x10/0x10 [ 911.415083][ C0] ? __pfx_kthread+0x10/0x10 [ 911.415104][ C0] ret_from_fork+0x514/0xb70 [ 911.415123][ C0] ? __pfx_ret_from_fork+0x10/0x10 [ 911.415143][ C0] ? __switch_to+0xc89/0x1420 [ 911.415170][ C0] ? __pfx_kthread+0x10/0x10 [ 911.415189][ C0] ret_from_fork_asm+0x1a/0x30 [ 911.415226][ C0] [ 911.415607][ T32] Kernel panic - not syncing: hung_task: blocked tasks [ 912.619981][ T32] CPU: 1 UID: 0 PID: 32 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) [ 912.629111][ T32] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 912.639174][ T32] Call Trace: [ 912.642457][ T32] [ 912.645401][ T32] vpanic+0x56d/0xa60 [ 912.649425][ T32] ? __pfx___schedule+0x10/0x10 [ 912.654311][ T32] ? __pfx_vpanic+0x10/0x10 [ 912.658858][ T32] panic+0xc5/0xd0 [ 912.662621][ T32] ? __pfx_panic+0x10/0x10 [ 912.667145][ T32] ? preempt_schedule_common+0x7f/0xd0 [ 912.672617][ T32] ? preempt_schedule_thunk+0x16/0x40 [ 912.678003][ T32] ? nmi_trigger_cpumask_backtrace+0x31a/0x390 [ 912.684177][ T32] ? nmi_trigger_cpumask_backtrace+0x31f/0x390 [ 912.690446][ T32] watchdog+0x1030/0x1030 [ 912.694797][ T32] ? watchdog+0x1c7/0x1030 [ 912.699273][ T32] kthread+0x38b/0x480 [ 912.703351][ T32] ? __pfx_watchdog+0x10/0x10 [ 912.708029][ T32] ? __pfx_kthread+0x10/0x10 [ 912.712623][ T32] ret_from_fork+0x514/0xb70 [ 912.717220][ T32] ? __pfx_ret_from_fork+0x10/0x10 [ 912.722338][ T32] ? __switch_to+0xc89/0x1420 [ 912.727029][ T32] ? __pfx_kthread+0x10/0x10 [ 912.731633][ T32] ret_from_fork_asm+0x1a/0x30 [ 912.736550][ T32] [ 912.739870][ T32] Kernel Offset: disabled [ 912.744264][ T32] Rebooting in 86400 seconds..