last executing test programs: 6.033386531s ago: executing program 2 (id=4453): r0 = epoll_create1(0x0) r1 = socket$unix(0x1, 0x1, 0x0) close(r1) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128-generic\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f0000000140)="2c385aa3d49100dc6626c892b6bc436a", 0x10) r3 = accept4(r2, 0x0, 0x0, 0x0) unshare(0x20000400) ppoll(&(0x7f0000000300)=[{r3, 0xc080}], 0x1, 0x0, 0x0, 0x0) sendmsg$nl_xfrm(r3, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000380)=@updsa={0xf0, 0x1a, 0x300, 0x70bd2c, 0x25dfdbfc, {{@in6=@private2={0xfc, 0x2, '\x00', 0x1}, @in=@empty, 0x4e23, 0x5, 0x4e21, 0xff7f, 0x2, 0x20, 0x20, 0xf39c4ca83113b65b}, {@in6=@local, 0x4d2, 0x2b}, @in6=@dev={0xfe, 0x80, '\x00', 0x2a}, {0xfcf, 0x80, 0xffffffffffff654a, 0x5, 0xa, 0x0, 0x401, 0xfffffffffffffffc}, {0x6, 0x100000001, 0x303, 0xb22}, {0x2, 0xc01, 0x3}, 0x70bd2a, 0x34ff, 0x5, 0x0, 0x7, 0x4}}, 0xf0}, 0x1, 0x0, 0x0, 0x20000004}, 0x400c040) socket$nl_generic(0x10, 0x3, 0x10) setsockopt$sock_int(r1, 0x1, 0x2e, &(0x7f0000000040)=0x10009, 0x4) socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r1, &(0x7f00000002c0)={0xa002a014}) 5.458567165s ago: executing program 0 (id=4459): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)={0x80, 0x0, 0x1, 0x5, 0x0, 0x0, {0x2}, [@CTA_TUPLE_ORIG={0x62, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0xffffffc3, 0x1, @dev={0xac, 0x14, 0x14, 0x27}}, {0x8, 0x2, @multicast1}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @broadcast}, {0x8, 0x2, @empty}}}, @CTA_TUPLE_ZONE={0x6}, @CTA_TUPLE_PROTO={0x24, 0x2, 0x0, 0x1, {0x5, 0x1, 0x11}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x88}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x2f}}]}, @CTA_STATUS={0x8, 0x3, 0x1, 0x0, 0x100e}]}, 0x80}}, 0x0) (async) sendmsg$IPCTNL_MSG_CT_NEW(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)={0x80, 0x0, 0x1, 0x5, 0x0, 0x0, {0x2}, [@CTA_TUPLE_ORIG={0x62, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0xffffffc3, 0x1, @dev={0xac, 0x14, 0x14, 0x27}}, {0x8, 0x2, @multicast1}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @broadcast}, {0x8, 0x2, @empty}}}, @CTA_TUPLE_ZONE={0x6}, @CTA_TUPLE_PROTO={0x24, 0x2, 0x0, 0x1, {0x5, 0x1, 0x11}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x88}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x2f}}]}, @CTA_STATUS={0x8, 0x3, 0x1, 0x0, 0x100e}]}, 0x80}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=@newtfilter={0x24, 0x2c, 0x200, 0x70bd25, 0x6, {0x0, 0x0, 0x0, 0x0, {0x0, 0xf}, {0x6, 0xb}, {0x8, 0x4}}}, 0x24}, 0x1, 0x0, 0x0, 0x20000}, 0x8010) (async) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=@newtfilter={0x24, 0x2c, 0x200, 0x70bd25, 0x6, {0x0, 0x0, 0x0, 0x0, {0x0, 0xf}, {0x6, 0xb}, {0x8, 0x4}}}, 0x24}, 0x1, 0x0, 0x0, 0x20000}, 0x8010) socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_init_net_socket$llc(0x1a, 0x801, 0x0) (async) r1 = syz_init_net_socket$llc(0x1a, 0x801, 0x0) bind$llc(r1, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x81, 0x42}, 0x10) (async) bind$llc(r1, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x81, 0x42}, 0x10) listen(r1, 0x2) listen(r1, 0x5) (async) listen(r1, 0x5) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x4, &(0x7f0000000600)=ANY=[@ANYBLOB="810700000000000063119a000000000007000000000000009500000000000000f5c2e20d9f299114c2bd8edd26f601b2f3abe5e0df10392114105b013351ba39492c85906b4e94356deaca7ef49fe4a1f6f4d5277f4fdfafb31df91d8c239cd5d4f3401879863b752b8c2421e944ea3242430d56cb8b1505de0af0861c1d9ac06353ddce65bb9678865211f364f76fd73958a9b398f8597832d58769488b"], &(0x7f00000002c0)='GPL\x00', 0x8, 0xc3, &(0x7f000000cf3d)=""/195}, 0x94) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000080)='ns/ipc\x00') unshare(0x6a040000) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x1e, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x1, 0x2, 0x3, 0x2, 0x1, 0x14}]}, &(0x7f0000000480)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x24}, 0x94) socket$nl_netfilter(0x10, 0x3, 0xc) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000540)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-serpent-avx\x00'}, 0x58) (async) bind$alg(r2, &(0x7f0000000540)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-serpent-avx\x00'}, 0x58) bind$alg(r2, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'rfc4543(generic-gcm-aesni)\x00'}, 0x58) accept4(r2, 0x0, 0x0, 0x80800) (async) r3 = accept4(r2, 0x0, 0x0, 0x80800) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f00000001c0)={0x1, 0x58, &(0x7f0000000400)}, 0x10) (async) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f00000001c0)={0x1, 0x58, &(0x7f0000000400)={0x0, 0x0}}, 0x10) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000380)={r4, 0x6, 0x8}, 0xc) syz_genetlink_get_family_id$batadv(0x0, r3) recvmsg(r3, &(0x7f00000005c0)={0x0, 0x0, 0x0}, 0x0) (async) recvmsg(r3, &(0x7f00000005c0)={0x0, 0x0, 0x0}, 0x0) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) r6 = socket$kcm(0xf, 0x3, 0x2) sendmsg$inet(r6, &(0x7f00000011c0)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000000)="020b070102000000e4a17c455b3a89e0", 0x10}], 0x1}, 0x0) socket$kcm(0xf, 0x3, 0x2) (async) r7 = socket$kcm(0xf, 0x3, 0x2) sendmsg$inet(r7, &(0x7f0000003780)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000000)="020b0700fc670000e4a17c45c8d260c9", 0x33fe0}], 0x1}, 0x0) sendmsg$inet(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)="020a030002000000e4a17c45c8d260c9", 0x10}], 0x1}, 0x0) sendmsg$nl_xfrm(r5, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000880)={&(0x7f00000003c0)=ANY=[@ANYBLOB="63ffffdc00"], 0x38}, 0x13, 0x0, 0x0, 0x880}, 0x940) 5.099763261s ago: executing program 2 (id=4462): socket$inet_icmp_raw(0x2, 0x3, 0x1) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f00000003c0)='ns/cgroup\x00') r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) sendmsg$inet(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000140)="2ae2291b2f388f", 0x7}, {&(0x7f0000000280)="3cc5c48b32b27a215ed6734667e778fd5e31bd2a645c1ad3521f8bb3347afdda1150f0871a3dc29260bd8c43222471588c75a894d31eb4e0a8b9439adf553dd6c343aa6a7cb47d37bfcc1b89ff13a3e68d9ec5751948ea50e29915258db6597fa5c3ed168fe9704d5ecced81fd9dc1400a7b749d9495e6e621", 0x79}], 0x2}, 0x8000880) unshare(0x6a040000) r2 = socket(0x10, 0x3, 0xc0) ioctl$sock_netrom_SIOCADDRT(r2, 0x61d1, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001100010029bd700000000000e9ffffff", @ANYBLOB="150000000000000014000300776c616e30", @ANYRES32=r1, @ANYRESHEX=r2, @ANYRESDEC=r3], 0x48}, 0x1, 0x0, 0x0, 0x20004089}, 0x0) recvfrom$rxrpc(0xffffffffffffffff, 0x0, 0x0, 0x40010001, 0x0, 0x0) sendto$inet6(r2, &(0x7f0000000240)="c4b8dfbd8ace869b3f619fd810", 0xd, 0x10, 0x0, 0x0) r4 = bpf$PROG_LOAD(0x5, 0x0, 0x0) setsockopt$bt_BT_DEFER_SETUP(r0, 0x112, 0x7, &(0x7f0000000000)=0x1, 0x4) bpf$PROG_BIND_MAP(0xa, 0x0, 0x0) setsockopt$MRT_ADD_MFC(0xffffffffffffffff, 0x0, 0xcc, 0x0, 0x0) r5 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r6 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT6_DONE(r2, 0x29, 0xc9, 0x0, 0x0) setsockopt$MRT_INIT(r6, 0x0, 0xc8, &(0x7f0000003d40), 0x4) setsockopt$inet_mreq(r5, 0x0, 0x23, &(0x7f00000001c0)={@broadcast, @broadcast}, 0x8) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x24048044) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) r7 = socket(0x1e, 0x4, 0x0) accept4$inet6(r4, 0x0, &(0x7f0000000100), 0x80800) setsockopt$ARPT_SO_SET_ADD_COUNTERS(r5, 0x0, 0x61, &(0x7f0000000340)={'filter\x00', 0x4}, 0x68) setsockopt$packet_tx_ring(r7, 0x10f, 0x87, 0x0, 0x0) r8 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r8, 0x6, 0x15, 0x0, &(0x7f0000000180)) 3.252534069s ago: executing program 0 (id=4479): sendmsg$NL80211_CMD_UNEXPECTED_FRAME(0xffffffffffffffff, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4040}, 0x4004000) socket$nl_route(0x10, 0x3, 0x0) r0 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000000c0)={'vcan0\x00', 0x0}) bind$can_j1939(r0, &(0x7f0000000340)={0x1d, r1, 0x0, {0x2, 0x0, 0x6}, 0xfe}, 0x18) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000040)=0x1, 0x4) sendmsg$inet(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000003c0)=[{0x0}], 0x1}, 0x4048081) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'syzkaller1\x00', 0x4c02}) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) socket$kcm(0x2, 0xa, 0x2) ioctl$TUNSETVNETHDRSZ(r2, 0x400454d8, &(0x7f0000000600)=0x632) close(0x3) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) getsockopt$inet_mreqsrc(r3, 0x0, 0x28, &(0x7f0000000100)={@remote, @dev}, &(0x7f0000000180)=0xc) syz_open_procfs$namespace(0x0, &(0x7f0000000200)='ns/pid_for_children\x00') unshare(0x6a040000) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000740)=@newtfilter={0x854, 0x2c, 0xd2f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {0x0, 0xfff1}, {}, {0x2}}, [@TCA_RATE={0x6, 0x5, {0x0, 0x2}}, @filter_kind_options=@f_fw={{0x7}, {0x820, 0x2, [@TCA_FW_POLICE={0x81c, 0x2, [@TCA_POLICE_AVRATE={0x8, 0x4, 0x400}, @TCA_POLICE_AVRATE={0x8, 0x4, 0x5}, @TCA_POLICE_PEAKRATE={0x404, 0x3, [0x401, 0xe, 0x80000001, 0x8, 0x200, 0x6, 0x8, 0x4, 0x10200000, 0x4, 0x2000003, 0x9, 0x3, 0xffffffff, 0xb, 0x9, 0x4, 0xd4ae, 0x5, 0x300000, 0xe1b5, 0xc5b, 0x6, 0x4, 0x9, 0x6, 0x9, 0x8, 0x3, 0x9, 0xd, 0x7f, 0x7, 0xce0, 0x1ff, 0x6, 0x6, 0x41, 0xff, 0x800, 0xfff, 0x7, 0x9, 0xd, 0x4, 0xffffff1f, 0xa, 0xc, 0x8, 0xfffffffa, 0x155, 0x7, 0x0, 0x18000, 0xc, 0x9, 0x40000, 0x101, 0x6, 0x3ff, 0x1, 0x3, 0x7554, 0x2, 0x4, 0x1, 0x4, 0xd, 0x8000, 0xff, 0x0, 0xeac2, 0x87, 0x3, 0xfe000000, 0x3, 0x8001, 0xff, 0xffff1cac, 0x2892, 0x6, 0x8c5e, 0x1, 0x5, 0xffffffff, 0x80, 0xffffffac, 0x3, 0xff1, 0x2, 0x2, 0x8, 0x2, 0x1, 0x8, 0x8, 0xfff, 0x80000001, 0x9, 0x8, 0x0, 0x8, 0x487, 0x6, 0x8, 0x1000, 0x1ff800, 0x6, 0xfffffffe, 0x3c78, 0xfa1, 0x3, 0x6, 0x9, 0xffffffff, 0x80000002, 0x2, 0xda, 0x9, 0x401, 0x6, 0x7, 0x2, 0x2, 0xe, 0x835, 0x4, 0x3, 0x6cc7, 0x6, 0x8, 0x8, 0x400, 0x8, 0x4, 0x3, 0x5, 0x5, 0xfffffffe, 0x9, 0x400, 0x3, 0x0, 0x4cc, 0xb, 0x0, 0xce, 0x6, 0x0, 0xc8, 0x4, 0x5, 0xc38, 0x1ff, 0x1ff, 0x968, 0x5, 0x68cff086, 0x2, 0xfff, 0x2, 0x7ff, 0x1000, 0x80000001, 0x9, 0x9, 0x0, 0x8001, 0x1000, 0x8b7f, 0xfe, 0xc, 0x8, 0x7, 0x8000000, 0x0, 0x7fff, 0xfffffffd, 0x5, 0x815d, 0x5, 0x44, 0x4, 0x6, 0x3, 0x1, 0x8, 0x0, 0x7ff, 0x3, 0x8, 0x1, 0x2, 0x800, 0x7, 0x5, 0x10, 0xfffffff7, 0x8, 0x40, 0x1, 0x10001, 0x1000, 0xe42c, 0x1, 0x101, 0x6, 0x8, 0x4, 0x9a14, 0x4, 0x81, 0x7, 0x0, 0x8, 0x8, 0xfffffffa, 0x0, 0x30000, 0x7ff, 0x4, 0x3, 0x5, 0x5, 0x0, 0xfff, 0x3, 0x7b0, 0x7, 0x9, 0xffff, 0x5, 0xff, 0x4, 0x0, 0x4, 0x9, 0x6, 0x100, 0x81, 0x0, 0x7fc, 0x2, 0x5, 0x80, 0x2, 0xe, 0x1, 0x40, 0x1ff, 0x3, 0x380, 0x6, 0x7, 0x8, 0xfffffffb]}, @TCA_POLICE_RATE={0x404, 0x2, [0x4, 0x7, 0x8, 0x7, 0xffff, 0x2, 0x3, 0x7fff, 0x8, 0x0, 0x401, 0x4, 0x0, 0xf7b1, 0xa, 0x40, 0x200, 0x0, 0x1, 0x9, 0x9, 0x8, 0xbf2, 0x1, 0xffff9374, 0x9, 0x1, 0x5, 0x3ff, 0x3, 0x6, 0x5, 0x2, 0x7, 0xe, 0x5, 0x4, 0x9, 0x8, 0xf0, 0x5, 0x8000, 0x0, 0x7, 0xff, 0x2, 0x2, 0x400, 0x0, 0x5, 0x2, 0x401, 0x100, 0xf30, 0x8001, 0x9, 0x370, 0x3, 0x1, 0xfffffff9, 0x9, 0x3, 0x5, 0xb9b, 0x1, 0x5, 0x0, 0x4, 0x7, 0x6, 0x3ff, 0x3, 0x7, 0x76, 0x9, 0xffff, 0x8, 0xd, 0x80, 0x4, 0x9, 0x7ff, 0x7, 0x9, 0x6, 0x7f, 0x9, 0x7ff, 0x3, 0x8, 0x31, 0x1, 0x2d, 0x0, 0xf02, 0x15200, 0xa, 0x1, 0xe148, 0x7, 0x1, 0x3, 0x9, 0x6, 0xb, 0xfffffffa, 0x4, 0xdf, 0x80000000, 0x8001, 0x2, 0x3, 0x2971010e, 0x3b655406, 0x1, 0x8, 0x6, 0x6, 0x0, 0x4, 0x8, 0x80000001, 0x5dd, 0x2d3, 0x7, 0x8, 0x5, 0x79d5, 0x2, 0x800, 0x8d, 0x1, 0x2, 0x1, 0x5, 0x6, 0x338, 0x6, 0x2, 0x4, 0x1, 0x3, 0x0, 0x0, 0x8, 0x1, 0x3ff, 0x8, 0x56, 0x7, 0x401, 0x7, 0x0, 0x0, 0x0, 0xda, 0x5, 0x42, 0x18, 0xfffffff7, 0x5, 0xed2, 0x7, 0x211, 0x0, 0x2, 0xc9, 0x3, 0x8, 0x1, 0x9, 0x58, 0x8, 0x5e5, 0x5, 0x3, 0xfffffffb, 0x3, 0xff, 0x6, 0x10, 0xf7ee907a, 0xff, 0xc9, 0x9, 0x0, 0x400, 0x0, 0x7, 0x6, 0x9, 0x8, 0x8, 0x0, 0x0, 0x7, 0x0, 0x4, 0x7, 0x2, 0x3, 0x9, 0x9, 0x0, 0x7, 0x4, 0x0, 0x4, 0x4, 0x4, 0x6f3, 0x6, 0x10, 0x0, 0x7, 0xfffffff9, 0xfffffffa, 0x9, 0x53a, 0x8, 0x1, 0x4, 0xb, 0x8, 0xfffffff9, 0x400, 0x461, 0x81, 0x8, 0x2, 0x7ff, 0x2, 0x8000, 0x7, 0x4, 0xba95, 0x4, 0x4706, 0x7ff, 0x4, 0xffffffff, 0xf7b1, 0x3, 0x2, 0x5, 0x9, 0x1fffc, 0x80000000, 0x2008001, 0x9, 0x4, 0x3, 0x3, 0x6, 0xce, 0x8]}]}]}}]}, 0x854}, 0x1, 0x0, 0x0, 0x20000005}, 0x40) r4 = socket(0x2b, 0x1, 0x1) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r5, &(0x7f0000000080)=ANY=[@ANYRESHEX, @ANYRESDEC=r0, @ANYRES32], 0x3261e) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r5, 0x0) setsockopt$IPT_SO_SET_REPLACE(r4, 0x29, 0x40, &(0x7f0000000e00)=@raw={'raw\x00', 0x9, 0x3, 0x1c8, 0x0, 0xffffffff, 0xffffffff, 0x98, 0xffffffff, 0x130, 0xffffffff, 0xffffffff, 0x130, 0xffffffff, 0x3, 0x0, {[{{@ip={@broadcast, @multicast2, 0xffffff00, 0x0, 'vcan0\x00', 'vlan0\x00', {}, {0xff}, 0x8, 0x2bbe86e5b28b8fc5, 0x30}, 0x0, 0x70, 0x98}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00', 0x0, {0x4081}}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@inet=@SYNPROXY={0x28, 'SYNPROXY\x00', 0x0, {0x15, 0xa1, 0xfff}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x228) 3.081934427s ago: executing program 4 (id=4481): ioctl$AUTOFS_IOC_CATATONIC(0xffffffffffffffff, 0x9362, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) close(0x4) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = getpid() sendmmsg$unix(r0, &(0x7f0000000bc0)=[{{0x0, 0x0, &(0x7f0000000ac0)=[{&(0x7f0000000340)="3e176874116c3d", 0x7}], 0x1, &(0x7f0000000b40)=[@cred={{0x1c, 0x1, 0x2, {r1}}}], 0x20, 0x24000082}}], 0x1, 0x4044000) syz_open_procfs$namespace(r1, &(0x7f0000000040)='ns/uts\x00') unshare(0x6a040000) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r3, 0x10e, 0xc, &(0x7f0000000180)={0xffffff}, 0x10) write(r3, &(0x7f0000000400)="240000001a005f0214f9f407000904008100000800030000000000000800040006020000", 0x24) ioctl$sock_kcm_SIOCKCMUNATTACH(r3, 0x89e1, &(0x7f0000000000)={r2}) sendmsg$nl_route(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=ANY=[@ANYBLOB="040100001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000240012800b0001006272696467650000140002800800050001"], 0x104}}, 0x0) 2.842624795s ago: executing program 2 (id=4484): r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$inet_group_source_req(r0, 0x0, 0x2e, &(0x7f0000000080)={0x9, {{0x2, 0x0, @multicast2}}, {{0x2, 0x0, @broadcast}}}, 0x108) r1 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r1, &(0x7f0000000080), 0x10) sendmsg$can_bcm(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000400)=ANY=[@ANYBLOB="0500"/16, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYBLOB="000000000100000000fdffffffff"], 0x48}, 0x1, 0x0, 0x0, 0x48850}, 0x0) sendmsg$can_bcm(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=ANY=[@ANYBLOB='\a\x00'/16, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x77359400, @ANYRES64=0x0, @ANYBLOB="000000000100000000007f7e030200"/24], 0x48}, 0x1, 0x0, 0x0, 0x4}, 0x0) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) sendto$inet6(r2, &(0x7f0000000000)="10", 0x1, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0xfffffffe, @loopback, 0xcd03}, 0x1c) sendmsg$inet6(r2, &(0x7f0000000340)={&(0x7f0000000300)={0xa, 0x4e21, 0x5, @private1, 0x29}, 0x1c, &(0x7f0000000100)=[{&(0x7f00000002c0)='\x00', 0x1}], 0x1}, 0x20000000) poll(&(0x7f0000000080)=[{r2, 0x46a8}], 0x1, 0x400) shutdown(r2, 0x1) r3 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r3, &(0x7f0000000100)={0x18, 0x0, {0x2, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xa}, 'lo\x00'}}, 0x1e) socket$nl_route(0x10, 0x3, 0x0) sendmmsg(r3, &(0x7f0000005b00)=[{{0x0, 0x0, &(0x7f0000000040)=[{&(0x7f00000002c0)}, {&(0x7f0000000480)="d7dd7c0ffa7cfab4c63921019c1f0beb9c0849e0fff30b87a631", 0x1a}], 0x2}}, {{0x0, 0x0, 0x0}}], 0x2, 0x20001000) setsockopt$inet_mreq(r0, 0x0, 0x20, &(0x7f0000000000)={@rand_addr=0x64010100, @local}, 0x8) r4 = socket(0x1d, 0x802, 0x6) ioctl$sock_SIOCETHTOOL(r4, 0x8946, &(0x7f0000000040)={'wlan1\x00', &(0x7f0000000080)=@ethtool_ringparam={0x11, 0x9c, 0x7b5, 0x0, 0x0, 0x7579e159, 0x0, 0xfffffdfc, 0xef4}}) setsockopt$inet_MCAST_JOIN_GROUP(r0, 0x0, 0x2a, &(0x7f00000001c0)={0x9, {{0x2, 0x4e20, @multicast2}}}, 0x88) 2.687861844s ago: executing program 1 (id=4486): bpf$BPF_PROG_ATTACH(0x8, &(0x7f00000003c0)=ANY=[@ANYRES32=0x0, @ANYRES32, @ANYBLOB="2600264207200000e614f8424e4d0bee116747d930babbd3f09a4617f88fbc9370411e7eb0ee8a4f2e95f744012dd0771fd9cad8fbebf4f4b859fd4ccc", @ANYRES32, @ANYRES32, @ANYBLOB, @ANYRES64=0x0], 0x20) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="170000000000000004000000ff"], 0x48) r1 = socket$can_raw(0x1d, 0x3, 0x1) getpeername(r1, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000300)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005900000095"], 0x0}, 0x94) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000800)={0x4, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bind$ax25(0xffffffffffffffff, &(0x7f0000000540)={{0x3, @default, 0x1}, [@default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @null, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null]}, 0x48) openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nbd(&(0x7f0000000380), 0xffffffffffffffff) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) r7 = syz_genetlink_get_family_id$nbd(&(0x7f0000000040), 0xffffffffffffffff) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r9 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x1c1341, 0x0) ioctl$TUNSETIFF(r9, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) r10 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r10, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000a40)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff5653f, 0x70bd2d, 0x25dfdbfc, {0x0, 0x0, 0x0, r11, {0x0, 0x9}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x81}, 0x0) sendmsg$nl_route_sched(r10, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=@newtfilter={0x44, 0x2c, 0xd3f, 0x70bd27, 0x25dfdbfb, {0x0, 0x0, 0x0, r11, {0xc}, {0x0, 0x9}, {0xf, 0x9}}, [@filter_kind_options=@f_flower={{0xb}, {0x14, 0x2, [@TCA_FLOWER_KEY_ETH_TYPE={0x6, 0x8, 0x88e5}, @TCA_FLOWER_KEY_MPLS_TTL={0x5}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x1}, 0x20040054) sendmsg$NBD_CMD_CONNECT(r6, &(0x7f0000001ac0)={0x0, 0x0, &(0x7f0000001a80)={&(0x7f00000000c0)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="0100ffffffff0000000001000000100007800c00018008000100", @ANYRES32=r8, @ANYBLOB="08000100000000010c000200ff7f000000000000"], 0x38}}, 0x4000000) sendmsg$NBD_CMD_DISCONNECT(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r5, @ANYBLOB="018027bd7000fcdbdf25020000000800010000000000"], 0x1c}, 0x1, 0x0, 0x0, 0x24040090}, 0xc0) writev(0xffffffffffffffff, &(0x7f00000036c0)=[{&(0x7f00000033c0)="93", 0x1}], 0x1) r12 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r13 = openat$cgroup_int(r12, &(0x7f0000000080)='hugetlb.1GB.rsvd.limit_in_bytes\x00', 0x2, 0x0) writev(r13, &(0x7f0000000a40)=[{&(0x7f00000007c0)='g', 0x1}], 0x1) sendmsg$NL802154_CMD_SET_MAX_CSMA_BACKOFFS(0xffffffffffffffff, &(0x7f00000006c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000680)={&(0x7f00000008c0)=ANY=[@ANYRES32=r2, @ANYRES16=0x0, @ANYBLOB="00042bbd7000fcdbdf2511000000050012000300000008000300", @ANYRES32=0x0, @ANYBLOB="3f3cba83dcfb8ab580a32f11840feffdb64befaa4a84070be4848cd022f048b211e4ebca73f145beae9c0dd0be4111fdaae48c6cc0ad9311ef840fe8cb6f7fe053e84cc01921838b9da20048585da8b2f2e32e54bf328312736972fce7f5db5af81aefe8fd8058837326204ca0a40c39abc7c1fe3bb0faecac6200d74d63767e3144300c7e8b3cfa8ae573b0e74de44b91ba91d57e2ac2f6bac9cbd3d3b133b3aed6ac9b544153753e3adaebea58909238a5cea8587cbbe1e18b2121a72f2d664b59425343be2099da0f7205a7fa90f6c5d41a0e716490d11688b8ffa23ad0c58b22", @ANYRES32=0x0, @ANYBLOB="0c0006000100000001000000"], 0x44}, 0x1, 0x0, 0x0, 0x14}, 0x40) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000280)={@fallback=r13, 0x6, 0x0, 0x400, &(0x7f0000000100)=[0x0, 0x0, 0x0, 0x0], 0x4, 0x0, &(0x7f0000000140)=[0x0, 0x0, 0x0], &(0x7f0000000180)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f00000001c0)=[0x0]}, 0x40) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={r3, 0x2000000, 0xe, 0x0, &(0x7f0000000200)="63eced8e46dc3f0adf33c9f7b986", 0x0, 0x7ffd, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 2.261604297s ago: executing program 1 (id=4487): setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000300)={@in={{0x2, 0x4e22, @initdev={0xac, 0x1e, 0x1, 0x0}}}, 0x0, 0x0, 0x3c, 0x0, "bb02a3c364ca41d6357e544508474004000b42a201ecffffffffffffff8a0e2f964e0000c534a632ab6193fcf19b2df3ee0500faa4ff1f56c54dc46d8b6d2ccd00a0cf0a007bbe00"}, 0xd8) r0 = socket$kcm(0x23, 0x5, 0x0) r1 = socket(0x1e, 0x4, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000600)={&(0x7f00000004c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x24, 0x24, 0x2, [@func_proto={0x0, 0x0, 0x0, 0xd, 0x3}, @volatile={0x0, 0x0, 0x0, 0x9, 0x1}, @const={0x0, 0x0, 0x0, 0xa, 0x2}]}}, 0x0, 0x3e}, 0x28) setsockopt$TIPC_DEST_DROPPABLE(r1, 0x10f, 0x81, &(0x7f0000000480), 0x4) recvmmsg(r1, &(0x7f0000000800)=[{{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000001e40)=""/174, 0xae}], 0x1, &(0x7f0000001fc0)=""/67, 0x43}, 0x1}], 0x1, 0x40002122, 0x0) sendmsg$tipc(r1, &(0x7f0000000100)={&(0x7f0000000040)=@id={0x1e, 0x3, 0x3, {0x4e20}}, 0x10, &(0x7f0000000380)=[{&(0x7f00000000c0)="e8", 0x1}], 0x1}, 0x4800) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0x2000}) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000500)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x3, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x44, 0x9, 0xa, 0x301, 0x0, 0x0, {0x1}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz2\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x1f}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x7}]}, @NFT_MSG_NEWSETELEM={0x48, 0xc, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz2\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x1c, 0x3, 0x0, 0x1, [{0x18, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0x4}, @NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x1}, @NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x2}]}]}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x10}}, 0xd4}}, 0x0) r5 = socket(0x10, 0x803, 0x0) socket$netlink(0x10, 0x3, 0xc) syz_genetlink_get_family_id$devlink(&(0x7f0000000080), r1) r6 = socket(0xa, 0x5, 0x0) sendmsg$inet_sctp(r6, &(0x7f0000000380)={&(0x7f00000000c0)=@in={0x2, 0x4e22, @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x10, &(0x7f00000001c0)=[{&(0x7f0000000240)="af", 0x1}], 0x1, &(0x7f0000000280)=ANY=[@ANYBLOB="180000"], 0x18, 0x20000001}, 0x20008000) setsockopt$inet_sctp_SCTP_AUTO_ASCONF(r6, 0x84, 0x1e, &(0x7f0000000000)=0x5, 0x4) setsockopt$inet_sctp_SCTP_AUTO_ASCONF(r6, 0x84, 0x1e, &(0x7f0000000040)=0x1ff, 0x4) r7 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r7, &(0x7f00000005c0), 0x10) recvmmsg(r7, &(0x7f0000003440)=[{{0x0, 0x0, &(0x7f0000000440)=[{0x0}, {&(0x7f0000000400)=""/40, 0x28}], 0x2}, 0x5}], 0x1, 0x10022, 0x0) sendmsg$can_bcm(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="050000007f0000000000010000000000", @ANYRES64=0x0, @ANYRES64=0x2710], 0x48}}, 0x0) socket$unix(0x1, 0x1, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000680)) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000240)=0x6, 0x4) ioctl$XFS_IOC_PATH_TO_HANDLE(r3, 0xc0385869, &(0x7f0000000400)={r5, &(0x7f0000000140)='devlink\x00', 0x200000, &(0x7f00000001c0)={@_ha_fsid={[0xda, 0x4]}, {0xde, 0x1, 0x2, 0x6}}, 0x6, &(0x7f0000000280)={@_ha_fsid}, &(0x7f00000002c0)=0x81}) write$cgroup_subtree(r8, &(0x7f0000000440)={[{0x2b, 'net'}, {0x2d, 'cpu'}, {0x2d, 'devices'}, {0x2d, 'rlimit'}]}, 0x1b) listen(r0, 0x8) socket$kcm(0x2, 0xa, 0x2) 2.004500452s ago: executing program 4 (id=4488): r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r0, 0x11, 0x68, 0x0, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0xa2f01, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) syz_init_net_socket$llc(0x1a, 0x2, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) connect$inet6(r1, &(0x7f00000007c0)={0xa, 0x4e23, 0x0, @loopback, 0x1170}, 0x1c) r2 = socket$inet(0xa, 0x801, 0x84) connect$inet(r2, &(0x7f0000004cc0)={0x2, 0x4e21, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) listen(r2, 0x8) r3 = accept4(r2, 0x0, 0x0, 0x0) write(r3, &(0x7f0000000000)="ea", 0x1) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r3, 0x84, 0x22, &(0x7f0000000580)={0x5, 0x201, 0xffffffff, 0x1}, 0x10) write(r3, &(0x7f00000002c0)="04", 0x1) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r3, 0x84, 0x22, &(0x7f0000000100)={0x3, 0x0, 0x2}, 0x10) writev(r3, &(0x7f0000000140)=[{&(0x7f0000000040)='w', 0x1}], 0x1) sendto$inet6(r3, &(0x7f0000000200)='x', 0x1, 0x0, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r3, 0x84, 0x7b, &(0x7f0000000080)={0x0, 0x4}, 0x8) close(r3) setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f00000000c0), 0xfefe) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(0xffffffffffffffff, 0x6, 0x14, &(0x7f0000000080)=0x2, 0x4) sendmsg$inet(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000006c0)=[{&(0x7f0000000b80)='n', 0x1}], 0x1}, 0x0) setsockopt$inet6_tcp_TLS_TX(r1, 0x11a, 0x2, &(0x7f0000000680)=@gcm_128={{0x303}, "fb00080000528e46", "252432e72844858a068b92a5a810f4dc", "b5ab0900", "5aee41448c84afb7"}, 0x28) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x2400c0e0}, 0x20004080) bpf$MAP_CREATE_RINGBUF(0x0, 0x0, 0x48) socket$nl_generic(0x10, 0x3, 0x10) sendmsg$BATADV_CMD_GET_ROUTING_ALGOS(r0, 0x0, 0x20000080) r4 = socket$inet6(0xa, 0x2, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000080)={&(0x7f0000000c40)=ANY=[@ANYBLOB="9feb0100180000000000000024000000240000000600000000000000020000840900000e00000005"], 0x0, 0x42, 0x0, 0x8}, 0x28) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r4, 0x29, 0x20, &(0x7f0000000140)={@loopback={0x0, 0x7ffffffff000}, 0x200800, 0x0, 0x3, 0x9, 0x0, 0x66c3}, 0x20) 1.983639476s ago: executing program 4 (id=4489): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$GTP_CMD_ECHOREQ(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000400)=ANY=[@ANYRESHEX=r0, @ANYRES16=r0, @ANYRESHEX=r0, @ANYRES32=r0, @ANYRESDEC=r0, @ANYRES16=r0, @ANYRES16=0x0], 0x24}, 0x1, 0x0, 0x0, 0x4000000}, 0x80) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000600)=ANY=[@ANYBLOB="140000001000010000000000000000000100000a20000000000a01040000000000000000010080030900010073797a30000000002c000000030a01010000000000000000010000000900010073797a30000000000900030073797a320000000090000000060a010400000000000000000100000008000b400000000068000480340001800b000100657874686472000024000280080001400000000c080003400000000008000440000000220500fb0707000000300001800c0001006269747769736500200002800800034000000002080001400000001408010073797a3000000000140000001100010000000000000000000700000a00"/260], 0x104}}, 0x40063) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb3b0000ce220000000004000000e3"], 0xfdef) r1 = bpf$TOKEN_CREATE(0x24, &(0x7f0000000100), 0x8) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000040)={0x6, 0x3, &(0x7f0000000280)=ANY=[@ANYRES32=r1, @ANYBLOB="1e308e42db7144b16f4ce09d70c16f02cc351dc2936f4518ed93b248e89a529a", @ANYRES16=r1, @ANYRES32, @ANYRESHEX=r1, @ANYRES64=r1, @ANYRESHEX=r1, @ANYRES64=r1, @ANYRES32=r1, @ANYRESHEX], &(0x7f0000000240)='syzkaller\x00', 0xfb, 0x0, 0x0, 0x1f00}, 0x94) socket(0x400000000010, 0x3, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000000b80), 0x0, 0x94) pipe(&(0x7f0000000000)) epoll_pwait(0xffffffffffffffff, &(0x7f0000000140), 0x0, 0x2d516fb6, 0x0, 0x0) pipe(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x3c, &(0x7f0000000000)={0x0, 0x0}, 0x10) vmsplice(r3, &(0x7f00000000c0)=[{&(0x7f0000000180)="77690addcfbe1fbb66ec", 0xff3b}], 0x1, 0x1) close(r3) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000000)={'bond_slave_1\x00', 0x0}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=ANY=[@ANYBLOB="4400000010000100"/20, @ANYRES32=r5, @ANYBLOB="000024000000000024001200140001006272696467655f736c617665800000000c000500080005"], 0x3}, 0x1, 0x0, 0x0, 0x40900}, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), 0x0) socket$xdp(0x2c, 0x3, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) mmap(&(0x7f000062b000/0x2000)=nil, 0x2000, 0x2000004, 0x110, 0xffffffffffffffff, 0xa51bd000) r7 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, 0x0) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@netrom={'nr', 0x0}, 0x10) ioctl$sock_netrom_SIOCADDRT(r7, 0x890b, &(0x7f0000000000)={0x0, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bpq0, 0x4, 'syz1\x00', @default, 0x1, 0x0, [@null, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default, @default]}) splice(r2, 0x0, r4, 0x0, 0x10d00, 0xf) socket$nl_netfilter(0x10, 0x3, 0xc) 1.908776036s ago: executing program 2 (id=4490): r0 = epoll_create1(0x0) r1 = socket$unix(0x1, 0x1, 0x0) close(r1) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128-generic\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f0000000140)="2c385aa3d49100dc6626c892b6bc436a", 0x10) r3 = accept4(r2, 0x0, 0x0, 0x0) unshare(0x20000400) ppoll(&(0x7f0000000300)=[{r3, 0xc080}], 0x1, 0x0, 0x0, 0x0) sendmsg$nl_xfrm(r3, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000380)=@updsa={0xf0, 0x1a, 0x300, 0x70bd2c, 0x25dfdbfc, {{@in6=@private2={0xfc, 0x2, '\x00', 0x1}, @in=@empty, 0x4e23, 0x5, 0x4e21, 0xff7f, 0x2, 0x20, 0x20, 0xf39c4ca83113b65b}, {@in6=@local, 0x4d2, 0x2b}, @in6=@dev={0xfe, 0x80, '\x00', 0x2a}, {0xfcf, 0x80, 0xffffffffffff654a, 0x5, 0xa, 0x0, 0x401, 0xfffffffffffffffc}, {0x6, 0x100000001, 0x303, 0xb22}, {0x2, 0xc01, 0x3}, 0x70bd2a, 0x34ff, 0x5, 0x0, 0x7, 0x4}}, 0xf0}, 0x1, 0x0, 0x0, 0x20000004}, 0x400c040) socket$nl_generic(0x10, 0x3, 0x10) setsockopt$sock_int(r1, 0x1, 0x2e, &(0x7f0000000040)=0x10009, 0x4) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r1, &(0x7f00000002c0)={0xa002a014}) 1.811854479s ago: executing program 0 (id=4493): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000540), r2) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_CIPSOV4_C_ADD(r4, &(0x7f0000000700)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="02000000", @ANYRES16=r3, @ANYBLOB="01000000000000000000010000002c0004800500030000000000050003000200000005000300000000000500030002000000050003000200000008000100ffffffff0800020002000000"], 0x50}}, 0x0) (async) sendmsg$NLBL_CIPSOV4_C_ADD(r4, &(0x7f0000000700)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="02000000", @ANYRES16=r3, @ANYBLOB="01000000000000000000010000002c0004800500030000000000050003000200000005000300000000000500030002000000050003000200000008000100ffffffff0800020002000000"], 0x50}}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a58000000090a010400000000010000000a0000040900010073797a310000000008000a40fffffffc08000540000000020900020073797a0000080003400000011c08000640ffffff000c000980080001400000003900000000000000000000000700000af492f0ded4bbcbbc4b635e2f68ba42fde884911c913b710a0fff91415b00000071f80000"], 0x80}, 0x1, 0x0, 0x0, 0x4000850}, 0x0) (async) sendmsg$NFT_BATCH(r1, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a58000000090a010400000000010000000a0000040900010073797a310000000008000a40fffffffc08000540000000020900020073797a0000080003400000011c08000640ffffff000c000980080001400000003900000000000000000000000700000af492f0ded4bbcbbc4b635e2f68ba42fde884911c913b710a0fff91415b00000071f80000"], 0x80}, 0x1, 0x0, 0x0, 0x4000850}, 0x0) sendmsg$IPCTNL_MSG_EXP_GET_STATS_CPU(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x14, 0x3, 0x2, 0x0, 0x0, 0x0, {0x7, 0x0, 0xa}, ["", "", "", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x40010}, 0x10) sendmsg$NFT_BATCH(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000700)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01030000000000000000010000010900010073797a310000000054000000030a01040000000000000000010000000900030073797a31000000000900010073797a3100000000280004800800014000000005080002401b2fd2c514000300ad81366772653000000000000000000028000000000a05000000000000000000010000080900010073797a3100000000080002400000000114000000110001"], 0xc4}, 0x1, 0x0, 0x0, 0x20004000}, 0x4000) socket$inet6_sctp(0xa, 0x5, 0x84) (async) r5 = socket$inet6_sctp(0xa, 0x5, 0x84) ioctl$sock_inet6_SIOCSIFDSTADDR(r5, 0x8918, &(0x7f0000000000)={@mcast2, 0x75}) (async) ioctl$sock_inet6_SIOCSIFDSTADDR(r5, 0x8918, &(0x7f0000000000)={@mcast2, 0x75}) syz_init_net_socket$ax25(0x3, 0x3, 0x0) (async) r6 = syz_init_net_socket$ax25(0x3, 0x3, 0x0) setsockopt$ax25_int(r6, 0x101, 0xa, &(0x7f0000000040)=0x1ff, 0x4) 1.655888728s ago: executing program 0 (id=4495): mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040), 0x200002, 0x0) bpf$MAP_CREATE(0x100000000000000, &(0x7f0000000140)=ANY=[@ANYBLOB="0a00000016000000b3"], 0x48) r1 = bpf$MAP_CREATE(0x100000000000000, &(0x7f0000000680)=@base={0xa, 0x16, 0xb4, 0x3}, 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0xa, &(0x7f00000002c0)=ANY=[@ANYBLOB="18080000000000000000002a50000000851000000600000018100000", @ANYRES32=r1, @ANYBLOB="000000000000000079000000000000001800000000000000000000000000000095000000000000009500000000000000"], &(0x7f0000000000)='GPL\x00', 0x2, 0x0, 0x0, 0x0, 0x1}, 0x94) r2 = openat$cgroup_devices(r0, &(0x7f00000000c0)='devices.allow\x00', 0x2, 0x0) write$cgroup_devices(r2, &(0x7f0000000140)=ANY=[@ANYBLOB='c 75:*\t\n'], 0xa) 1.612589584s ago: executing program 3 (id=4496): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = socket$unix(0x1, 0x1, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0800000004000000040000000e00000000000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000fffffff200"/28], 0x48) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000140)={r2, &(0x7f0000000280), 0x0}, 0x20) unshare(0x60600) r3 = socket$xdp(0x2c, 0x3, 0x0) getsockopt$XDP_STATISTICS(r3, 0x11b, 0x7, 0x0, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) setsockopt$SO_ATTACH_FILTER(r4, 0x1, 0x1a, &(0x7f0000000000)={0x3, &(0x7f0000000040)=[{0x20, 0x1, 0x81, 0xfffff034}, {0x20, 0x0, 0x0, 0xfffff010}, {0x6}]}, 0x10) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x159a41, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r6 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r5, &(0x7f0000000440)={@val={0x2000}, @void, @eth={@broadcast, @multicast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x3, 0x2, 0x1c, 0x68, 0x0, 0x4, 0x1, 0x0, @multicast2, @private=0xa010101}, @echo_reply={0x0, 0x0, 0x0, 0x66, 0x7}}}}}}, 0x2e) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000280)=@deltfilter={0x94, 0x2d, 0x800, 0x70bd2d, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, {0x5, 0x7}, {0x1, 0xc}, {0x9, 0x9}}, [@TCA_RATE={0x6, 0x5, {0x4, 0xb}}, @TCA_RATE={0x6, 0x5, {0x3, 0x7}}, @TCA_RATE={0x6, 0x5, {0x0, 0xcf}}, @filter_kind_options=@f_flower={{0xb}, {0x4c, 0x2, [@TCA_FLOWER_KEY_TCP_SRC_MASK={0x6}, @TCA_FLOWER_KEY_ARP_SHA={0xa, 0x3f, @remote}, @TCA_FLOWER_KEY_ICMPV4_TYPE_MASK={0x5}, @TCA_FLOWER_KEY_MPLS_TC={0x5}, @TCA_FLOWER_KEY_TCP_DST={0x6}, @TCA_FLOWER_KEY_PORT_SRC_MIN={0x6, 0x57, 0x4e21}, @TCA_FLOWER_KEY_ETH_SRC={0xa}, @TCA_FLOWER_KEY_ENC_UDP_SRC_PORT_MASK={0x6}]}}]}, 0x94}, 0x1, 0x0, 0x0, 0x20000001}, 0x0) sendmsg$nl_route_sched(r7, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000500)=@newqdisc={0x34, 0x24, 0x4ee4e6a52ff56441, 0x70b925, 0x80000, {0x0, 0x0, 0x0, r8, {0x0, 0xfff2}, {0x0, 0xb}, {0xe}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x8820}, 0x20008844) r9 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_buf(r9, 0x0, 0x8008000000010, &(0x7f00000003c0)="17000000020001000003d68c5ee17688a2003308030300ecff3f0000000300000a0000000098fc5ad9485bbb6a880000d6c8db0000dba67e06000000e28900000200df018000000000f50607bdff59100ac45761547a681f009cee4a5acb3da400001fb700674f00c88ebbf9315033bf79ac2dff060115003901000000000000ea000000000000000002ffff02dfccebf6ba0008400200000000e90554062a80e605007f71174aa951f3c63e5c83f1ba2112ce68bf17a6e0", 0xb8) r10 = socket$netlink(0x10, 0x3, 0x0) r11 = socket$unix(0x1, 0x1, 0x0) r12 = socket$kcm(0x21, 0x2, 0x2) sendmsg$inet(r12, &(0x7f0000002780)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="1400000000000000100100000200000001000000001b000014000000000000001001000002"], 0x30}, 0x0) ioctl$sock_SIOCGIFINDEX(r11, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=@newqdisc={0x24, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffe00, {0x0, 0x0, 0x0, r13, {0x8}, {0xffff, 0xfff2}, {0xfff2, 0xffe1}}}, 0x24}, 0x1, 0x0, 0x0, 0x400dc}, 0x0) 1.580614049s ago: executing program 0 (id=4497): r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) r1 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) getsockopt$WPAN_WANTACK(r1, 0x0, 0x0, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x4001, 0x0, @ipv4={'\x00', '\xff\xff', @loopback}}, 0x1c) listen(r0, 0x3) socket$inet6_mptcp(0xa, 0x1, 0x106) (async) syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) (async) getsockopt$WPAN_WANTACK(r1, 0x0, 0x0, 0x0, 0x0) (async) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x4001, 0x0, @ipv4={'\x00', '\xff\xff', @loopback}}, 0x1c) (async) listen(r0, 0x3) (async) 1.436276769s ago: executing program 0 (id=4498): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000002c0)={'macvlan0\x00'}) socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'bridge0\x00'}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000640)=ANY=[@ANYBLOB="153da6dacc3e497974534d0a39cfa61d546141708a304614667665c7b3d371ee2d26caea017de555ac4ee20d8c2c5c0454fcd713a91f298e197c18a4b0bf13f04b048712aea5a7eb7769418002c367f84b22b580575c3030fa889e7ad73c63537391d618e595937ad602bb05d04a1af4ff5e2c84ebfdaea8bcdfce64ef58ab437be973888905434897e34fc976b087224df41ec206234d6278421dbfded795c5114f2d13b8c08b40265870486cd37373751ba0144fce18a9eb106f4148d71a2e188576fa7e8f38c06ab705cc8768a854ba0f02966b7c4a5b5f9d055ce1", @ANYBLOB="f5fff994b86f6cf195468f4534fc0e348e36ea49a74592384579b4ae911c25f64543ca8d6bc71abeb4f94e2839f82295f7d6d460dde654ecb5c3cc67ad35dc0f8d74af1fdf2d850681efa97fa39e47ad11b409161b0527fc49d22e35f1ed5bca527fbc96"], 0x60}}, 0x20000000) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r3 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000380)={'syzkaller0\x00'}) socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_wireguard(r3, 0x8933, &(0x7f0000000340)={'wg2\x00', 0x0}) sendmsg$WG_CMD_SET_DEVICE(r3, &(0x7f0000000540)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000180)={&(0x7f00000003c0)=ANY=[@ANYBLOB="bf76dec45b425b95b3ea85a1a423d6", @ANYRES16=0x0, @ANYBLOB="08002dbd7000fedbdf250100000008000100", @ANYRES32=r4, @ANYBLOB="140002007767320000000000000000000000000024000300000000000000000000000000000000000000000000000000000000000000000008000700060000001400020077673100000000000000000000000000140002007767310000000000000000000000000024000300b08073e8d44e91e3da922c22438244bb885c69e269c8e9d835b114293a4ddc6e1400020077673000000000000000000000000000060006004e210000060006004e200000"], 0xcc}, 0x1, 0x0, 0x0, 0x60048090}, 0xc0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) r5 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000005d00)=ANY=[@ANYBLOB="140100002e00010000000000fbdbdd250401f2800c00160002ac0f0000000000140017"], 0x114}], 0x1, 0x0, 0x0, 0x41}, 0x4008080) r6 = syz_init_net_socket$rose(0xb, 0x5, 0x0) ioctl$sock_rose_SIOCADDRT(r6, 0x890b, &(0x7f00000007c0)={@dev={0xbb, 0xbb, 0xbb, 0x1, 0x0}, 0x5, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bpq0, 0x5, [@rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @null, @null, @null, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @default]}) connect$rose(r6, &(0x7f0000000040)=@short={0xb, @dev={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, 0x1, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}}, 0x1c) connect$rose(r6, &(0x7f0000000240)=@short={0xb, @dev={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, 0x1, @null}, 0x1c) connect$rose(r6, &(0x7f0000000300)=@short={0xb, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null, 0x1, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}}, 0x1c) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(r7, 0x29, 0x1a, &(0x7f0000001a80)=0x5, 0x4) r8 = syz_genetlink_get_family_id$batadv(&(0x7f00000004c0), r3) sendmsg$BATADV_CMD_GET_TRANSTABLE_GLOBAL(r5, &(0x7f0000000840)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0xd570205de19f8195}, 0xc, &(0x7f0000000500)={&(0x7f00000005c0)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r8, @ANYBLOB="100028bd7000fcdbdf250700000005002f000000000005002f000000000008002b004200000108003b0001010000050035003500"/62], 0x44}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) bind$inet6(r7, &(0x7f0000000140)={0xa, 0x4e22}, 0x1c) r9 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r9, &(0x7f0000000080)={0x2, 0x4e22, @empty}, 0x10) connect$unix(r9, &(0x7f0000000540)=@abs={0x0, 0x0, 0x4e23}, 0x6e) 1.388082704s ago: executing program 3 (id=4499): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) mmap(&(0x7f0000002000/0x4000)=nil, 0x4000, 0xedc623580215bdcd, 0x12, r0, 0x0) r1 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) (async) r2 = socket$netlink(0x10, 0x3, 0xf) bind$netlink(r2, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0x11, 0x10, &(0x7f0000000000)=ANY=[@ANYRES32=r2, @ANYRES32=r1, @ANYBLOB="0000000002000000b70500000800000085000000aa00000095"], &(0x7f0000000300)='GPL\x00', 0x8, 0x1009, &(0x7f0000002500)=""/4105, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffe}, 0x94) 1.367769925s ago: executing program 1 (id=4500): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x101801, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_START_AP(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x44, r3, 0x5, 0x0, 0x0, {{}, {@val={0x8}, @void}}, [@beacon=[@NL80211_ATTR_BEACON_HEAD={0x28, 0xe, {{{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}}]]}, 0x44}}, 0x0) sendmsg$nl_xfrm(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)=@newpolicy={0xcc, 0x13, 0x101, 0x0, 0x0, {{@in6=@local, @in6=@private1, 0x0, 0x0, 0x0, 0x0, 0x2}}, [@XFRMA_IF_ID={0x8}, @offload={0xc}]}, 0xcc}}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r6, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000680)={0x0, 0x18}}, 0x0) getsockname$packet(r6, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)=ANY=[@ANYBLOB="5000000010008105e9c51c000000000000000000", @ANYRES32=r7, @ANYBLOB="01000000000000002800128009000100766c616e000000001800028006000100000000000c0002000c0000000d00000008000500", @ANYRES64=r5], 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x0) sendmsg$nl_route(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000700)=@newlink={0x40, 0x10, 0x1, 0x1, 0x25dfdbff, {0x0, 0x0, 0x0, r7, 0x10b85, 0x49060}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @vlan={{0x9}, {0x10, 0x2, 0x0, 0x1, [@IFLA_VLAN_FLAGS={0xc, 0x2, {0x10, 0xd}}]}}}]}, 0x40}, 0x1, 0x0, 0x0, 0x90}, 0x0) sendmsg$DCCPDIAG_GETSOCK(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000040), 0xc, &(0x7f00000001c0)={&(0x7f0000000080)={0xec, 0x13, 0x200, 0x70bd2c, 0x25dfdbfb, {0x9, 0x2, 0xff, 0x2, {0x4e24, 0x4e24, [0x3, 0x5, 0x0, 0x3382], [0x7453, 0x9, 0x3, 0x25383fa3], r7, [0x6, 0x3]}, 0x5, 0x3}, [@INET_DIAG_REQ_BYTECODE={0x1d, 0x1, "483fe1f72de39aae15add104b45ccf7735a1ac47ec7f7cad92"}, @INET_DIAG_REQ_BYTECODE={0x2b, 0x1, "42d4069882020bbaff020c1380f68a9dd18d9f8f256cb0de895c83b5abc9bb45960a29fd363a69"}, @INET_DIAG_REQ_BYTECODE={0x47, 0x1, "b5e30bfd9c5c0add37adfaa6088fc625e796a825128f84ae23509eaf3f98d4bd8f9f6dbe0995befbec1e051e445a43432f8b29a788ff94f104055b446616490f946686"}, @INET_DIAG_REQ_BYTECODE={0x8, 0x1, "3dac1ca3"}, @INET_DIAG_REQ_BYTECODE={0x4}]}, 0xec}, 0x1, 0x0, 0x0, 0x41}, 0x4000) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000580)={'pim6reg\x00', 0x1}) ioctl$TUNATTACHFILTER(r0, 0x401054d5, 0x0) r8 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000003140)={0x3c, 0x3e, 0x107, 0x3, 0x0, {0x1, 0x7c}, [@nested={0x4, 0x142}, @typed={0x11, 0x1, 0x0, 0x0, @str='l24)\x00\x00\x00\x00\x00\x00\x00\x00\x00'}, @nested={0x10, 0x2, 0x0, 0x1, [@typed={0xc, 0xa, 0x0, 0x0, @u64=0x1000}]}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4000811}, 0x400c000) 1.29669213s ago: executing program 4 (id=4501): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) connect$bt_l2cap(r0, &(0x7f0000000000)={0x1f, 0xffff, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x12}, 0x9, 0x2}, 0xe) setsockopt$bt_l2cap_L2CAP_OPTIONS(r0, 0x6, 0x1, 0x0, 0x0) 1.296365983s ago: executing program 3 (id=4502): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000600)={0x26, 'hash\x00', 0x0, 0x0, 'cbcmac(camellia-generic)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7be", 0x10) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmsg$NFT_BATCH(r1, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000a00)={{0x14, 0x10, 0x1, 0xfff0}, [@NFT_MSG_DELTABLE={0x14, 0x2, 0xa, 0x201, 0x0, 0x0, {0x3, 0x0, 0x1}}, @NFT_MSG_NEWSETELEM={0x5c, 0xc, 0xa, 0x101, 0x0, 0x0, {0x3, 0x0, 0x6}, [@NFTA_SET_ELEM_LIST_SET_ID={0x8}, @NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz2\x00'}, @NFTA_SET_ELEM_LIST_SET_ID={0x8, 0x4, 0x1, 0x0, 0x3}, @NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x8, 0x3, 0x0, 0x1, [{0x4}]}]}, @NFT_MSG_NEWSETELEM={0x3c, 0xc, 0xa, 0x3, 0x0, 0x0, {0x3, 0x0, 0x2}, [@NFTA_SET_ELEM_LIST_ELEMENTS={0x4}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x18, 0x3, 0x0, 0x1, [{0x4}, {0x4}, {0x8, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_USERDATA={0x4}]}, {0x4}]}]}, @NFT_MSG_NEWSET={0x14, 0x9, 0xa, 0x201, 0x0, 0x0, {0x0, 0x0, 0x1}}, @NFT_MSG_NEWTABLE={0x28, 0x0, 0xa, 0x101, 0x0, 0x0, {0x7, 0x0, 0xa}, [@NFTA_TABLE_FLAGS={0x8, 0x2, 0x1, 0x0, 0x4}, @NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_DELOBJ={0x2c, 0x14, 0xa, 0x200, 0x0, 0x0, {0x7, 0x0, 0x5}, [@NFTA_OBJ_HANDLE={0xc, 0x6, 0x1, 0x0, 0x1}, @NFTA_OBJ_TABLE={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_DELOBJ={0x14, 0x14, 0xa, 0x301, 0x0, 0x0, {0x5, 0x0, 0x8}}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x7}}}, 0x150}, 0x1, 0x0, 0x0, 0x20008800}, 0x4004) 1.250060276s ago: executing program 3 (id=4503): sendmsg$NL80211_CMD_UNEXPECTED_FRAME(0xffffffffffffffff, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4040}, 0x4004000) socket$nl_route(0x10, 0x3, 0x0) r0 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000000c0)={'vcan0\x00', 0x0}) bind$can_j1939(r0, &(0x7f0000000340)={0x1d, r1, 0x0, {0x2, 0x0, 0x6}, 0xfe}, 0x18) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000040)=0x1, 0x4) sendmsg$inet(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000003c0)=[{0x0}], 0x1}, 0x4048081) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'syzkaller1\x00', 0x4c02}) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) socket$kcm(0x2, 0xa, 0x2) ioctl$TUNSETVNETHDRSZ(r2, 0x400454d8, &(0x7f0000000600)=0x632) close(0x3) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) getsockopt$inet_mreqsrc(r3, 0x0, 0x28, &(0x7f0000000100)={@remote, @dev}, &(0x7f0000000180)=0xc) syz_open_procfs$namespace(0x0, &(0x7f0000000200)='ns/pid_for_children\x00') sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000740)=@newtfilter={0x854, 0x2c, 0xd2f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {0x0, 0xfff1}, {}, {0x2}}, [@TCA_RATE={0x6, 0x5, {0x0, 0x2}}, @filter_kind_options=@f_fw={{0x7}, {0x820, 0x2, [@TCA_FW_POLICE={0x81c, 0x2, [@TCA_POLICE_AVRATE={0x8, 0x4, 0x400}, @TCA_POLICE_AVRATE={0x8, 0x4, 0x5}, @TCA_POLICE_PEAKRATE={0x404, 0x3, [0x401, 0xe, 0x80000001, 0x8, 0x200, 0x6, 0x8, 0x4, 0x10200000, 0x4, 0x2000003, 0x9, 0x3, 0xffffffff, 0xb, 0x9, 0x4, 0xd4ae, 0x5, 0x300000, 0xe1b5, 0xc5b, 0x6, 0x4, 0x9, 0x6, 0x9, 0x8, 0x3, 0x9, 0xd, 0x7f, 0x7, 0xce0, 0x1ff, 0x6, 0x6, 0x41, 0xff, 0x800, 0xfff, 0x7, 0x9, 0xd, 0x4, 0xffffff1f, 0xa, 0xc, 0x8, 0xfffffffa, 0x155, 0x7, 0x0, 0x18000, 0xc, 0x9, 0x40000, 0x101, 0x6, 0x3ff, 0x1, 0x3, 0x7554, 0x2, 0x4, 0x1, 0x4, 0xd, 0x8000, 0xff, 0x0, 0xeac2, 0x87, 0x3, 0xfe000000, 0x3, 0x8001, 0xff, 0xffff1cac, 0x2892, 0x6, 0x8c5e, 0x1, 0x5, 0xffffffff, 0x80, 0xffffffac, 0x3, 0xff1, 0x2, 0x2, 0x8, 0x2, 0x1, 0x8, 0x8, 0xfff, 0x80000001, 0x9, 0x8, 0x0, 0x8, 0x487, 0x6, 0x8, 0x1000, 0x1ff800, 0x6, 0xfffffffe, 0x3c78, 0xfa1, 0x3, 0x6, 0x9, 0xffffffff, 0x80000002, 0x2, 0xda, 0x9, 0x401, 0x6, 0x7, 0x2, 0x2, 0xe, 0x835, 0x4, 0x3, 0x6cc7, 0x6, 0x8, 0x8, 0x400, 0x8, 0x4, 0x3, 0x5, 0x5, 0xfffffffe, 0x9, 0x400, 0x3, 0x0, 0x4cc, 0xb, 0x0, 0xce, 0x6, 0x0, 0xc8, 0x4, 0x5, 0xc38, 0x1ff, 0x1ff, 0x968, 0x5, 0x68cff086, 0x2, 0xfff, 0x2, 0x7ff, 0x1000, 0x80000001, 0x9, 0x9, 0x0, 0x8001, 0x1000, 0x8b7f, 0xfe, 0xc, 0x8, 0x7, 0x8000000, 0x0, 0x7fff, 0xfffffffd, 0x5, 0x815d, 0x5, 0x44, 0x4, 0x6, 0x3, 0x1, 0x8, 0x0, 0x7ff, 0x3, 0x8, 0x1, 0x2, 0x800, 0x7, 0x5, 0x10, 0xfffffff7, 0x8, 0x40, 0x1, 0x10001, 0x1000, 0xe42c, 0x1, 0x101, 0x6, 0x8, 0x4, 0x9a14, 0x4, 0x81, 0x7, 0x0, 0x8, 0x8, 0xfffffffa, 0x0, 0x30000, 0x7ff, 0x4, 0x3, 0x5, 0x5, 0x0, 0xfff, 0x3, 0x7b0, 0x7, 0x9, 0xffff, 0x5, 0xff, 0x4, 0x0, 0x4, 0x9, 0x6, 0x100, 0x81, 0x0, 0x7fc, 0x2, 0x5, 0x80, 0x2, 0xe, 0x1, 0x40, 0x1ff, 0x3, 0x380, 0x6, 0x7, 0x8, 0xfffffffb]}, @TCA_POLICE_RATE={0x404, 0x2, [0x4, 0x7, 0x8, 0x7, 0xffff, 0x2, 0x3, 0x7fff, 0x8, 0x0, 0x401, 0x4, 0x0, 0xf7b1, 0xa, 0x40, 0x200, 0x0, 0x1, 0x9, 0x9, 0x8, 0xbf2, 0x1, 0xffff9374, 0x9, 0x1, 0x5, 0x3ff, 0x3, 0x6, 0x5, 0x2, 0x7, 0xe, 0x5, 0x4, 0x9, 0x8, 0xf0, 0x5, 0x8000, 0x0, 0x7, 0xff, 0x2, 0x2, 0x400, 0x0, 0x5, 0x2, 0x401, 0x100, 0xf30, 0x8001, 0x9, 0x370, 0x3, 0x1, 0xfffffff9, 0x9, 0x3, 0x5, 0xb9b, 0x1, 0x5, 0x0, 0x4, 0x7, 0x6, 0x3ff, 0x3, 0x7, 0x76, 0x9, 0xffff, 0x8, 0xd, 0x80, 0x4, 0x9, 0x7ff, 0x7, 0x9, 0x6, 0x7f, 0x9, 0x7ff, 0x3, 0x8, 0x31, 0x1, 0x2d, 0x0, 0xf02, 0x15200, 0xa, 0x1, 0xe148, 0x7, 0x1, 0x3, 0x9, 0x6, 0xb, 0xfffffffa, 0x4, 0xdf, 0x80000000, 0x8001, 0x2, 0x3, 0x2971010e, 0x3b655406, 0x1, 0x8, 0x6, 0x6, 0x0, 0x4, 0x8, 0x80000001, 0x5dd, 0x2d3, 0x7, 0x8, 0x5, 0x79d5, 0x2, 0x800, 0x8d, 0x1, 0x2, 0x1, 0x5, 0x6, 0x338, 0x6, 0x2, 0x4, 0x1, 0x3, 0x0, 0x0, 0x8, 0x1, 0x3ff, 0x8, 0x56, 0x7, 0x401, 0x7, 0x0, 0x0, 0x0, 0xda, 0x5, 0x42, 0x18, 0xfffffff7, 0x5, 0xed2, 0x7, 0x211, 0x0, 0x2, 0xc9, 0x3, 0x8, 0x1, 0x9, 0x58, 0x8, 0x5e5, 0x5, 0x3, 0xfffffffb, 0x3, 0xff, 0x6, 0x10, 0xf7ee907a, 0xff, 0xc9, 0x9, 0x0, 0x400, 0x0, 0x7, 0x6, 0x9, 0x8, 0x8, 0x0, 0x0, 0x7, 0x0, 0x4, 0x7, 0x2, 0x3, 0x9, 0x9, 0x0, 0x7, 0x4, 0x0, 0x4, 0x4, 0x4, 0x6f3, 0x6, 0x10, 0x0, 0x7, 0xfffffff9, 0xfffffffa, 0x9, 0x53a, 0x8, 0x1, 0x4, 0xb, 0x8, 0xfffffff9, 0x400, 0x461, 0x81, 0x8, 0x2, 0x7ff, 0x2, 0x8000, 0x7, 0x4, 0xba95, 0x4, 0x4706, 0x7ff, 0x4, 0xffffffff, 0xf7b1, 0x3, 0x2, 0x5, 0x9, 0x1fffc, 0x80000000, 0x2008001, 0x9, 0x4, 0x3, 0x3, 0x6, 0xce, 0x8]}]}]}}]}, 0x854}, 0x1, 0x0, 0x0, 0x20000005}, 0x40) r4 = socket(0x2b, 0x1, 0x1) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r5, &(0x7f0000000080)=ANY=[@ANYRESHEX, @ANYRESDEC=r0, @ANYRES32], 0x3261e) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r5, 0x0) setsockopt$IPT_SO_SET_REPLACE(r4, 0x29, 0x40, &(0x7f0000000e00)=@raw={'raw\x00', 0x9, 0x3, 0x1c8, 0x0, 0xffffffff, 0xffffffff, 0x98, 0xffffffff, 0x130, 0xffffffff, 0xffffffff, 0x130, 0xffffffff, 0x3, 0x0, {[{{@ip={@broadcast, @multicast2, 0xffffff00, 0x0, 'vcan0\x00', 'vlan0\x00', {}, {0xff}, 0x8, 0x2bbe86e5b28b8fc5, 0x30}, 0x0, 0x70, 0x98}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00', 0x0, {0x4081}}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@inet=@SYNPROXY={0x28, 'SYNPROXY\x00', 0x0, {0x15, 0xa1, 0xfff}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x228) 1.231498434s ago: executing program 4 (id=4504): r0 = socket$inet(0x2, 0x3, 0x6) ioctl$sock_inet_SIOCSARP(r0, 0x8955, &(0x7f0000000000)={{0x2, 0x0, @dev}, {0x1, @local}, 0x4a, {0x2, 0x0, @dev}}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000380)=@newlink={0x40, 0x10, 0x503, 0x70bd2a, 0x4, {0x0, 0x0, 0x0, 0x0, 0x3a, 0x201a0}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_ADDRESS={0xa, 0x1, @local}]}, 0x40}}, 0x800) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0xe, 0x4, 0x4, 0xc}, 0x50) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r4, &(0x7f0000000100)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x1}, 0x1c) setsockopt$sock_int(r4, 0x1, 0x9, &(0x7f00000000c0)=0x8, 0x4) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000040)={r3, &(0x7f0000000180)}, 0x20) r5 = socket$inet_sctp(0x2, 0x1, 0x84) ioctl$sock_SIOCADDDLCI(r5, 0x8980, &(0x7f0000000000)={'ip_vti0\x00', 0x84b}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) socket$inet6(0xa, 0x80000, 0x4) 1.100981357s ago: executing program 1 (id=4505): r0 = socket$netlink(0x10, 0x3, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) socket$inet_icmp_raw(0x2, 0x3, 0x1) getsockname$packet(0xffffffffffffffff, 0x0, &(0x7f0000000080)) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$IP_VS_SO_SET_ADD(r1, 0x0, 0x482, &(0x7f0000000080)={0x84, @local, 0x4e20, 0x3, 'lblcr\x00', 0x0, 0x5, 0x33}, 0x2c) r2 = socket$kcm(0xa, 0x2, 0x0) r3 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$IP_VS_SO_SET_ADDDEST(r3, 0x0, 0x487, &(0x7f0000000140)={{0x11, @private=0xa010102, 0x4e20, 0x3, 'lc\x00', 0x5, 0x8, 0x77}, {@loopback, 0x4e20, 0x10000, 0x2, 0x2}}, 0x44) sendmsg$sock(r2, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4f23, 0x0, @private0={0xfc, 0x0, '\x00', 0x1}, 0xfffffffc}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0) ioctl$BTRFS_IOC_RM_DEV(0xffffffffffffffff, 0x5000940b, &(0x7f0000002ac0)={{}, "6fbbddfe1db87fe0aa3d4715eed26c3f33c7bc1da15c8e72736f33db12266c5570e2c0828a5797f0fa077780a1027dfbe0bbd78257b9bc5d139900cad3b4138c395a8d1ecebcd9e15757cb13ad486ad4996555e6d7e790f4fe416b3e6156ab039ac74ea661a1fffb1a809b78afe2c1f23970b22d0193af209c5bc2f982517dd2689ef92727d9acd5384a0d6848c993940a5313e2903ff7682832fa736fdc9882b4174c758f5405c904e13474023e0f44e4e3f89596e2b1b61c769a7276a2fe862ac2ebbbd944ef984e344f731a47d99507acecf2bdb54e3501b6d5f631efa678413f75ba6b537a0aa3df4d4b9a0019e7d2f4d557cc85c269e16afd59f4320fb9503f3ffaebed3b9e5b226d3617181e5a1bf4e8e3a29f61205facafe703901e0da75cd7d1b95f01608204c87875c17416c4e5cb1e82393a0bbdb5875a5b5981c3b85e9a55bc93c8f95c3c08729222dde7f5bade86e21c3845ed02ea356f9ca29fb297b2cc9aad3cb19bd3346ff5688de062d20e55626e1506c00e8d4219591d0275f9525963fee6955391b1c973e4deac2056181297665c9e4e4133c21c121c7288c7c67b48b93512503544ade884958cbce9adbfa85d0643e0102895eabc8694c9c7d67ffe974be032f9ead90ea1117de563b3dacdd352e65d0c6547d856cf7c5f3120aba3cc987b4c699fe50b670c9cb6fca49465917dd39d46802702edd95167fe5d2d7db6b9c2af13995c42f67214573d71be4f7fcaa9cc03ff39142a5660ef0b3ae2ba115a410cb513b4bdc9f66888a025290e1552536eb825ca39f4c2f4f9690299ed3b78dac547b49efe57551561cb35bfd51ff17e057751e88a6cb64da2d3b9fc3f61fce3823517d807dcdbd6666eb553292920af21cfaf479561befdc3235599acfa5e100e388e2e459655febe4d7baa13205cf92e545b857e86711707ad75e6ce7148b3f51a54e10b87e6b5d7deae9e63d9ad3454bc74a60393882f540a8f0e60a85821c47b88d777abafbf047bf4d812adb8e83cf4f36c2a8b747a1bdf8adab47aa98b316b75ad106cebdad07213b1eb9b34c0ad46dc0ec1a3eac0b3037133e86b5a82b4d1bb82651232be355f93f30f2f6cd539498610fe407c9dd743f84b033e1819dd1c771980edbf5d0ddcfdf79709475bf7e1ab45a3644138a8fd5b907d891ff533bc04c0ca52db95e9cfc0cf1fafa55a44c3a0a8d00d10a555a1c620ad11bd4ca172ad6901a8c6d1418bb75b9ba0815b8f311d1b6826e983323e406eb22a8aa2b4e94824080a7882e38e41d8d2e7051cc69592e987c75a0e5c59a3383ddc1ab93636c6eea75b6e67d2e634570207b635b5e04fc37ead26984d89aa494b9f8b4807882b690e9173eb02635ff27d76ae192f52bea13195ae25b957d558d6f8430b79edbd6750093894d134f221411019f7cc652d92c02cde74a197ee5b6a21ad84f6f1f4c5935730a6a961c21a90efae3b92dd66a53feba6fb860bde918b5b0f9ecf232294b110bd62008a1ec61e5525762543644f7050691e8e2e88a1c3308494c497c6b7adaf00f7344c91c022fa5cbc3cb3e407aea4a4429446fc3e85d872546dde1fe29e432268e3c65f15a077ba8a50a0abc1935709b6dc7b6d726df5e18d11a2e6dbe55f8e722358684f83057ef95bdab38118cbfe71ebe5282e144ac2ca647a339040ddddbbda921879572f5b1f30871f505b5da8113a8ce273b9feeb396bcdb8569f59848d0702ddd4726b4fac18b7cfc1cbcc8f360e58fc0cecdc87bc51be81043887936d733501e87933f2715fd5723beec1213f41461ac09389c30f1120463919a7e1b5524f355135175502416a97f7581b8784b1396f22c3e91173b71bb4dd51efabab767be3f13f43444b92c3904d20258ad9418a64d240c7e157e19bf074bc5c2a3a91a2df733cf7f132daa1a6885a9770b4faa6807a2b7c7c118df835491ae063d9a2273a0c6df1aeac9ef3ee1d231be0faabdb126354b99198a7c7ba2caf53b51793da72057bb451d96fbde88a3f2698366f7fe9e5d8a3fbb1b65f9a7ed4f461e740acb547deb9a5078d0523049e5183325ca0b2c68a157bfc91ddf020f9212fea9cf1e77e143b5a7a6b89e9217c89ddb7cc477190fefd0e039660dbd8cb434f72c45030cef3f1f94e52e3a709cb9295efc6166d3fc493ec28a825c31a975c28f326759d1cc849bf79ef60e4c4e740402f3ffc9881f1c0605d8a6dd4a689cc0689e7112bed99710241c675bde573ff1465024bd4bae9824ebd38502ae15658ba5b0d33aca6e259bfadbc0f2db1a09ad0ccd17ffe4a95ea7ce724cf6639e08a3e1a15bcc1106adab70feef49d7435c1dbe9e580b9c5687c907dd0c188a02ee07de084c9a130b97a2fb7db0b172b7c197244451b7c3535004816713674953a401ecd82013f0bdf345f37649a6748237936f52e3deb3a1f510e12e5ace8c248c1b966f9bcb6533d45a0cb9d3d9f847802d80b650a635574f6c96b1d5264ce810bfb010f3496f5957cf769dd4ae1f4a3cab43a58ed7e4419b6bb5dc88674e8e6a94e7081de8fc46e1fb21cafc7761e77406e638008e9561bb3832b47a8b7841e6bcd47311dd00bec406d78145a2f9f72180315e2e41e18c9212e54ff4779f66c066c879a03334deddbf4ae92ab8b18a37797fba128f43f30a668d1ce024846588250221b06d03362eaecbd52bcc7bf55670ff05385df84fa7b4e6e2ba2d2ee63e16c5164c972f909acc82240600ea8c6b8babf6be99be2f89ad11152cc7fd387a75303e6258fb92d263223b717bfcf2caaf41973027b6b875c45ed2f9ae381298653d91d684a592ccefdad06d4ca0bdd29bb65410c200b0ccfdd479257694ed72d196be6d80fdf0ac5d0382905dca3f419416b80f8196f98902dadc977c9b6e804b2f5e70d345dfebebd4962ec8b133a6adbaa1034a41adae91c44f9a0e86f40a62a0a546887fe91752eefb430ca340efc229a8fa3adcf09fa4303d9f032fbe2c18ac86512b21209c26f8137a650458802f6329e0743f8e0da049cd456c52374cc6bbe713f44bc89ef1f5831b2c72f8798b1901fb487c2f3c248772a2762508b5cf1f7017f7279f6fdbc14e4e98845ee78466e9d38845b7c586a00736b4265008014c8f2188f7e3cb7478e207f7d206e57732482e46f24a4aa0e56f31e519f596bc40ad63513e6453f6b33e2cd0f19420470385ad62eb2d6bc4ccd6e8f75f8ec5b0a3f2fe33cd9863c86b953aa83e66849725f87630e44df53db416f9d9b16e413e6c46cc004f8a3f8c8924730c0ec2f1ffae033d24854ae0dd1a2f64aafd4d4f3d0d567c788e25f7ab5b9819824617219b28f14b8bdfbf45ae14c4118fe4b3f09fd32ce2598434b0064204ebbe4d6c597fce3b5e457ccc8c5203808ac8f37eed67278112eccb21793f6b3644a753d63e22febc65b9560700d1a6600e937e59b55e0e3adf0c07402603b5cd259c6d5688e72d3db1f983b9a2551bc5c5ddff44b5b00e072d18672377006fcacfe83e5dd987cb6f0e758bf24a588169068c6d6a3be798f2b5317d10f91676113badda706685b188fb6ba0e6194ae97d6b4bc72faae56d502ccd0375f9edf8d2e7d373bb1a61a7629cac53573584dd885d37d0a8dbc4d5984161d3b6a127793592f6dc7c1d82c5ac7e82b8b54e9e5f82c2bb2e97383f817487d2c7522acbad877c0568dfd905912e187d394b13dc24811ebe7fc8f8c8599672397c7c0c4930a511dbcf36581757d2be79530d479ad2e981771ccdb788de4f1e941558b850f832493bfc9a1ca8183acb648a69c33d7f0534db9b5e48ded84544e5927d59ffcce97ca1d45e2bdef6f875bbfc96f4564144d0454a997f356d7e58e32a2fe09a68963ada367f7418e9ee7b5c9664c3b0cda537222f8b14857eef535a4e2af44fdbac958984e6f554e9844b2150b9457089288750a6904f85f5d98012fb00b1ea992805ef9aaeb401df30e86284c8fc99f52f870e238bcc56f0d8eb84901ecbbe66d5803f4eb6100e0d03df43bc1e578696ab1aacec63385e20390dbce71cbc01cc7c63b44f5eee3bc52ee773002326e792867ecb942e808d088f61e6159d037f615f294d1504601eb0cfc7568771a9c0603a8ed34a0074c45e13d2fe038289d0cf55e5903a1ecd658c0b7393df0625d2805ced36894bd72a0e94b3499a82051ed598878ae2cce961d023c11494d82b7eb3ee795165c4fdff0bd951f9e0bcad366b2cf31db1a4194d70bbb3d5afa671e41ae35f2e4913e6ab9a0ccb367e1fa43ef7124c8af85dbe1341e498a9514efc9abfda3003e33a34f39fc880426186cd0b4daec4e4b73f776cb3b7d303dc9d55cda05f05f534506eb208fc594f95fbc95c64b517b56bfd1387b60f5e6786ea775d277d61fd997aadb900b2455c54a524dd97c248f52d52f8e9e71b94ae930057957f37c82ae3ea444b8be1ebeae90a011fba8a59f276ae9037ef953bb53d4b21e107ce8709f5e0c935a70231ab1d389912f5f3215b5f57833a70dca69bb35220e96382011437624e4eda13ee3af609c1c359fc524606524168581711ec94be5e399ff4570743db854308526d4d90a1215c23d5ca3897bddc45d1ca52a5073847701ffc941feb792ce79c8f5fd93e67f77a26542f5bc855cc0ed6656155a0315d23343bede7d9413c865886ca2b26bb4ec9842c8c14520f192bec05848ce965dd0e501df41f8e2674e4db1c9afd23bd27ce53db293c74a87948908448efb469bc97019be737308082827719599c927b3a42f9bcf6f6d48edf974d4be39615aa25be062f22ff856cd8feb3773e8faf44faf0bd751752d997fc138c645460b3d593f64f41988d7e43058110db29cbd4090988c697fdc5b015fec6398645edb974cf3fce10a01dce87b5b3737e899da86f63ed65c736506315ae036db186fe5e1cf15459c8c7f66496ef49e7ba0d2789a83dcf88c9316c0ba3fa3602dfb8e4cf4a618196b2a904390c823a69b4b86637810906d6059cde2ea8deb8f300233edf543a77c7039aa8979f8fca9399bf0bd7b55022bbbbb6d0a4c2b30cba29ab5f034239f2b7fd8de1e95ffe24f53dff753986ac482b433bb5c39773f5909ee23a93a5a142b1b30972505b4403456bcac6ff5898b3a95e26df94ee93c4670fb2baeb8f15ea2d39b0ea3109727f5fcd8e552cd2a5736cdb13da3efcc99ca6867b0b2d0512ab4fb37a4ba3385a050fe5b3fa6c7d3208ab66f6f47a91dacb806f42a0b64b562106388597405dceff887ee29a92ee5266f20705cd60c7619cdf081d2c9e0004e3152de22a3aa76139f549ac7ff85f3cbbeeb3bb3e94f4deceef137f3a72ab89358e1fc3375cc4e9a138447ac61d585d6784b81df85bcc46f31700407bb8587a6c98d729c4407ce7a8dce14b1938912794742949a10ae8f7d7e1a58643ba35eef01702c30abc3a05bb5f17773c0034ae5dc87236159fc595dfef57d306ad7106bc44cf63272ee08f0074f06810a28b2fc7a6d10ec1d81c5a2a78b6b16b084c7bccef97360020c174fc5b313ae9762a58aa16a95e12e94a256e74d45a67baf9d0f59160ea9200b3e194a93183aec854d3768678ffeee42c70ea8958c568542914439482ae27750d2441d4ea0bd52be09e5fddfd2f6a162fe50c3b7c14f844c89c588625069b2a49b625040d97cc7198f0b2583c80cbb236bafdae49ba50459c558bfd77313981aa85ffaa08ef53437c345fcd8bd5734d4b9b13377e22244adc981b7824c5dc70018fba61909df8eb1c45e033c"}) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, &(0x7f0000000a80)={'syzkaller0\x00', @broadcast}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)={'veth1_macvtap\x00'}) socket$netlink(0x10, 0x3, 0x0) socket$inet6(0xa, 0x1, 0x0) r4 = socket(0x10, 0x803, 0x4) sendmsg$IPVS_CMD_SET_INFO(r4, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) r5 = socket$rds(0x15, 0x5, 0x0) sendmsg$rds(r5, &(0x7f0000003880)={&(0x7f0000000e00)={0x2, 0x4e24, @broadcast}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x8080}, 0x4000040) syz_genetlink_get_family_id$wireguard(&(0x7f0000000100), r0) getsockname$packet(r4, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) r6 = socket$packet(0x11, 0x2, 0x300) socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'nr0\x00'}) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000000)={'syz_tun\x00', 0x0}) bind$packet(r6, &(0x7f0000000040)={0x11, 0x4, r7, 0x1, 0x3, 0x6, @remote}, 0x14) syz_genetlink_get_family_id$ipvs(0x0, 0xffffffffffffffff) syz_emit_ethernet(0x2a, &(0x7f0000000100)=ANY=[], 0x0) socket$nl_route(0x10, 0x3, 0x0) 1.034536379s ago: executing program 3 (id=4506): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)={0x2, 0x4, 0x8, 0x1, 0x80, 0x1, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$PROG_BIND_MAP(0xa, 0x0, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000600)={0x26, 'hash\x00', 0x0, 0x0, 'cbcmac(camellia-generic)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7be", 0x10) r2 = accept4(r1, 0x0, 0x0, 0x800) sendmsg$ETHTOOL_MSG_EEE_SET(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={0x0}, 0x1, 0x0, 0x0, 0x40}, 0x10) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000001880)=ANY=[@ANYBLOB], 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000)={0x0, 0x3}, 0x10}, 0x94) sendmsg$NFT_BATCH(r2, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000a00)={{0x14}, [@NFT_MSG_DELTABLE={0x64, 0x2, 0xa, 0x201, 0x0, 0x0, {0x3, 0x0, 0x1}, [@NFTA_TABLE_HANDLE={0xc, 0x4, 0x1, 0x0, 0x4}, @NFTA_TABLE_FLAGS={0x8, 0x2, 0x1, 0x0, 0x4}, @NFTA_TABLE_HANDLE={0xc, 0x4, 0x1, 0x0, 0x4}, @NFTA_TABLE_HANDLE={0xc, 0x4, 0x1, 0x0, 0x1}, @NFTA_TABLE_HANDLE={0xc, 0x4, 0x1, 0x0, 0x5}, @NFTA_TABLE_HANDLE={0xc, 0x4, 0x1, 0x0, 0x5}, @NFTA_TABLE_HANDLE={0xc, 0x4, 0x1, 0x0, 0x3}]}, @NFT_MSG_NEWSETELEM={0x360, 0xc, 0xa, 0x101, 0x0, 0x0, {0x3, 0x0, 0x6}, [@NFTA_SET_ELEM_LIST_SET_ID={0x8}, @NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz2\x00'}, @NFTA_SET_ELEM_LIST_SET_ID={0x8, 0x4, 0x1, 0x0, 0x3}, @NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x30c, 0x3, 0x0, 0x1, [{0x10, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_OBJREF={0x9, 0x9, 'syz0\x00'}]}, {0x2f8, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_OBJREF={0x9, 0x9, 'syz2\x00'}, @NFTA_SET_ELEM_TIMEOUT={0xc, 0x4, 0x1, 0x0, 0xec}, @NFTA_SET_ELEM_TIMEOUT={0xc, 0x4, 0x1, 0x0, 0x116f}, @NFTA_SET_ELEM_DATA={0x1c4, 0x2, 0x0, 0x1, [@NFTA_DATA_VALUE={0xc9, 0x1, "950ca8a800c20b10fbc6cc002f2708e079576a8e6206c21a95b6624f07ecbc9aeb179dc2d41b12c0b303b56e71c4a50c44be40174d5a6e5c333a0b4e402b4685e939bf6b3dc02600e75d7d5bc7c64930ace6720f72a0585d4c99720a2bdad9007acbf42e94f61b458cfa35c134e83480ba2fc649d991c8640254bae6273e51bc3ae8c5724835df01b2e2a214e8536d9dd017e1b33fb7351f48a6cce2849b2e9a8db418b082efbee60d911eb17e3ad06fd7058624099d52f1f6f0c67e4e23d96a828cc4fcaf"}, @NFTA_DATA_VALUE={0xf1, 0x1, "6e551079fd23b1cba3ddaea863db6c79fd55be53dbaa0a69062a45261c29ef0a654fbbc62592c05fd8a9cbc56cf2ec8c38c543b4f124754977e09966d9d5a53f15d6b9d14b4308a2f2092c16d5ddd1a1d7a39c53a0af43f8b348b6b8a9f5f31f8965122e26e6c38f151cf2d558b86ab82cc00ad3031cff2ad41bc265e69afe95291b421bda525e6b1e95d2ac0d7ddbfdf77a3f4372f08ca13a7e03c8ba2b969b14cc9d4006d299a8391df6926334c806f13d9b662327795f9c84d7c8d0b56ebbc928635f93ec0481fb3f5c24402a6605804427bc0f71fa992c1b95c2ba08db5288112c6bed62aa4bda1a5aa974"}]}, @NFTA_SET_ELEM_EXPIRATION={0xc, 0x5, 0x1, 0x0, 0xea3}, @NFTA_SET_ELEM_TIMEOUT={0xc, 0x4, 0x1, 0x0, 0x8f4f}, @NFTA_SET_ELEM_KEY_END={0xd8, 0xa, 0x0, 0x1, [@NFTA_DATA_VALUE={0xd2, 0x1, "109a4a61eab209372fd0b891e56237f6c70f4d281c1edd2904570b270f93bf024583fa65c19f350a4cd796351f24a9ca16973d6dfb7b3cb50833dc16ac45a4e4f3609bd4f250a97b11781ec77355e5cbe205354e445e6b7169dec3e62894f800d9eae322cc346aa3c4b795ff89763961e8ee738eb1b0e18857e474140ccbd219040f386008b0e6fb076ce0a1e3a7d449dc2d1e831fbcca5b1b0441411d5d718de6a20089372c1d6f5c7d5530b64566e93777b5e2a8abe26791acf6f333fb0ac0bcfbf46ee949cdac6fbfbc665c0c"}]}, @NFTA_SET_ELEM_EXPIRATION={0xc, 0x5, 0x1, 0x0, 0x4}, @NFTA_SET_ELEM_DATA={0x4}, @NFTA_SET_ELEM_OBJREF={0x9, 0x9, 'syz1\x00'}]}]}]}, @NFT_MSG_NEWSETELEM={0x248, 0xc, 0xa, 0x3, 0x0, 0x0, {0x3, 0x0, 0x2}, [@NFTA_SET_ELEM_LIST_ELEMENTS={0x190, 0x3, 0x0, 0x1, [{0x174, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_TIMEOUT={0xc, 0x4, 0x1, 0x0, 0x549}, @NFTA_SET_ELEM_EXPRESSIONS={0x4}, @NFTA_SET_ELEM_TIMEOUT={0xc, 0x4, 0x1, 0x0, 0x2}, @NFTA_SET_ELEM_EXPRESSIONS={0x148, 0xb, 0x0, 0x1, [{0x10, 0x1, 0x0, 0x1, @last={{0x9}, @void}}, {0x18, 0x1, 0x0, 0x1, @osf={{0x8}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_OSF_FLAGS={0x8}]}}}, {0x10, 0x1, 0x0, 0x1, @tunnel={{0xb}, @void}}, {0x14, 0x1, 0x0, 0x1, @tunnel={{0xb}, @val={0x4}}}, {0x10, 0x1, 0x0, 0x1, @masq={{0x9}, @void}}, {0x14, 0x1, 0x0, 0x1, @immediate={{0xe}, @void}}, {0x34, 0x1, 0x0, 0x1, @match={{0xa}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_MATCH_NAME={0xc, 0x1, 'cluster\x00'}, @NFTA_MATCH_REV={0x8, 0x2, 0x1, 0x0, 0x2}, @NFTA_MATCH_NAME={0xa, 0x1, 'limit\x00'}]}}}, {0x1c, 0x1, 0x0, 0x1, @last={{0x9}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_LAST_SET={0x8, 0x1, 0x1, 0x0, 0x8}]}}}, {0x10, 0x1, 0x0, 0x1, @masq={{0x9}, @void}}, {0x74, 0x1, 0x0, 0x1, @quota={{0xa}, @val={0x64, 0x2, 0x0, 0x1, [@NFTA_QUOTA_BYTES={0xc, 0x1, 0x1, 0x0, 0x800}, @NFTA_QUOTA_CONSUMED={0xc, 0x4, 0x1, 0x0, 0x100000000}, @NFTA_QUOTA_CONSUMED={0xc, 0x4, 0x1, 0x0, 0x9}, @NFTA_QUOTA_CONSUMED={0xc, 0x4, 0x1, 0x0, 0x5}, @NFTA_QUOTA_FLAGS={0x8, 0x2, 0x1, 0x0, 0x2}, @NFTA_QUOTA_FLAGS={0x8, 0x2, 0x1, 0x0, 0x2}, @NFTA_QUOTA_FLAGS={0x8, 0x2, 0x1, 0x0, 0x2}, @NFTA_QUOTA_CONSUMED={0xc, 0x4, 0x1, 0x0, 0x80000000}, @NFTA_QUOTA_CONSUMED={0xc, 0x4, 0x1, 0x0, 0x94}]}}}]}, @NFTA_SET_ELEM_OBJREF={0x9, 0x9, 'syz2\x00'}]}, {0x18, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_EXPR={0x14, 0x7, 0x0, 0x1, @connlimit={{0xe}, @void}}]}]}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x98, 0x3, 0x0, 0x1, [{0x54, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_USERDATA={0x4}, @NFTA_SET_ELEM_TIMEOUT={0xc}, @NFTA_SET_ELEM_USERDATA={0x3e, 0x6, 0x1, 0x0, "8227da43a352b984e57322de5ba9909fcbb98387699e85028f2b28a084cbfcea37c54833c46621b25b5694d3c1cea01ce134bb1491bd0408b24a"}]}, {0x34, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_EXPIRATION={0xc, 0x5, 0x1, 0x0, 0x100000000}, @NFTA_SET_ELEM_EXPR={0xc, 0x7, 0x0, 0x1, @dup={{0x8}, @void}}, @NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x1}, @NFTA_SET_ELEM_USERDATA={0x4}, @NFTA_SET_ELEM_EXPIRATION={0xc, 0x5, 0x1, 0x0, 0x6}]}, {0x8, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_USERDATA={0x4}]}, {0x4}]}]}, @NFT_MSG_NEWSET={0x44, 0x9, 0xa, 0x201, 0x0, 0x0, {0x0, 0x0, 0x1}, [@NFTA_SET_NAME={0x9, 0x2, 'syz2\x00'}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x102}, @NFTA_SET_OBJ_TYPE={0x8, 0xf, 0x1, 0x0, 0x8}, @NFTA_SET_DATA_LEN={0x8, 0x7, 0x1, 0x0, 0x4}]}, @NFT_MSG_NEWTABLE={0x28, 0x0, 0xa, 0x101, 0x0, 0x0, {0x7, 0x0, 0xa}, [@NFTA_TABLE_FLAGS={0x8, 0x2, 0x1, 0x0, 0x4}, @NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_DELOBJ={0x2c, 0x14, 0xa, 0x200, 0x0, 0x0, {0x7, 0x0, 0x5}, [@NFTA_OBJ_HANDLE={0xc, 0x6, 0x1, 0x0, 0x1}, @NFTA_OBJ_TABLE={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_DELOBJ={0x14, 0x14, 0xa, 0x301, 0x0, 0x0, {0x5, 0x0, 0x8}}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x7}}}, 0x6e0}, 0x1, 0x0, 0x0, 0x20008800}, 0x4004) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x7, 0xa, &(0x7f0000000680)=ANY=[@ANYBLOB="18080000000000000000000000000000851000000600000018000000", @ANYRES32, @ANYBLOB="00000000000000993e0000000000000018000000000000000000000000000000950000000000000095"], &(0x7f0000000000)='GPL\x00', 0x4}, 0x94) ioctl$XFS_IOC_FSGROWFSDATA(r1, 0x4010586e, &(0x7f0000000040)={0xff, 0x8000}) syz_init_net_socket$bt_l2cap(0x1f, 0x6, 0x0) bind$bt_hci(0xffffffffffffffff, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) recvmmsg(r2, &(0x7f0000005200)=[{{0x0, 0x0, 0x0}, 0x88b1}], 0x1, 0x40000120, 0x0) setsockopt$SO_TIMESTAMP(0xffffffffffffffff, 0x1, 0x40, &(0x7f0000000200)=0x4, 0x4) write$bt_hci(0xffffffffffffffff, &(0x7f0000000200)=ANY=[], 0x6) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000070000000900010073797a300000000044000000090a090400000000000000000700000308000a40000000000900020073797a31000000000900010073797a30000000000800054000000021080003400000000114000000110001"], 0x8c}, 0x1, 0x0, 0x0, 0x80}, 0x4080) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="19000000040000000800000008"], 0x50) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x6, 0xc, &(0x7f0000000180)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001}, [@ringbuf_output={{0x18, 0x5, 0x1, 0x0, r4}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x45}}]}, &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x42, '\x00', 0x0, @fallback=0x1a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000000c0)={r5, 0xf0, 0xe, 0x0, &(0x7f0000000200)="e02742e86c0d85ff9783763a0a00", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) setsockopt(r0, 0x84, 0x81, &(0x7f0000000000)="0000000000000002", 0x8) 1.027857263s ago: executing program 1 (id=4507): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'veth0_to_hsr\x00', 0x0}) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000380)={0x6, 0x3, &(0x7f0000000080)=@framed, &(0x7f0000000300)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x40, '\x00', r1}, 0x90) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48000, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000440)={&(0x7f00000006c0)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r6, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x10}}, [@qdisc_kind_options=@q_prio={{0x9}, {0x18, 0x2, {0x8}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x4000000}, 0x20040084) r7 = socket(0x400000000010, 0x3, 0x0) r8 = socket$unix(0x1, 0x1, 0x0) unshare(0x22020600) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x10d00, 0xf) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000003c0)=@delqdisc={0x24, 0x25, 0x1, 0x70bd25, 0x255fdbff, {0x0, 0x0, 0x0, r9, {}, {0x8, 0xfff1}, {0x4, 0xfff1}}}, 0x24}, 0x1, 0x0, 0x0, 0x20081054}, 0x24008088) ioctl$TUNSETDEBUG(r2, 0x400454c9, &(0x7f00000000c0)=0x9) socket$nl_route(0x10, 0x3, 0x0) (async) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'veth0_to_hsr\x00'}) (async) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000380)={0x6, 0x3, &(0x7f0000000080)=@framed, &(0x7f0000000300)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x40, '\x00', r1}, 0x90) (async) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48000, 0x0) (async) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) (async) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) (async) socket$nl_route(0x10, 0x3, 0x0) (async) socket$unix(0x1, 0x1, 0x0) (async) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) (async) sendmsg$nl_route_sched(r4, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000440)={&(0x7f00000006c0)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r6, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x10}}, [@qdisc_kind_options=@q_prio={{0x9}, {0x18, 0x2, {0x8}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x4000000}, 0x20040084) (async) socket(0x400000000010, 0x3, 0x0) (async) socket$unix(0x1, 0x1, 0x0) (async) unshare(0x22020600) (async) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x10d00, 0xf) (async) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) (async) sendmsg$nl_route_sched(r7, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000003c0)=@delqdisc={0x24, 0x25, 0x1, 0x70bd25, 0x255fdbff, {0x0, 0x0, 0x0, r9, {}, {0x8, 0xfff1}, {0x4, 0xfff1}}}, 0x24}, 0x1, 0x0, 0x0, 0x20081054}, 0x24008088) (async) ioctl$TUNSETDEBUG(r2, 0x400454c9, &(0x7f00000000c0)=0x9) (async) 982.483832ms ago: executing program 2 (id=4508): socket$nl_route(0x10, 0x3, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="12000000040000000400000008"], 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x16, 0xd, &(0x7f0000000f80)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000003000000850000000700000095"], &(0x7f0000000340)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x3, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r3, 0x0, 0xe, 0x0, &(0x7f0000000100)="e0b9547ed387dbe9abc89b6f5bec", 0x0, 0x4002000, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r4 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r4, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r5, @ANYBLOB="01000000020000001c0012000c000100626f6e64000000000c0002000800010005"], 0x3c}}, 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000540)=ANY=[@ANYBLOB="6c00000010001fff109e00008000000000000000", @ANYRES32=0x0, @ANYBLOB="00000000003f0000440012800b00010067656e6576650000340002800500030003000000060005004e20000005000400ab000000050009000100000005000a0001000000050009000100000008000a00", @ANYRES32=r5], 0x6c}, 0x1, 0x0, 0x0, 0x1}, 0x0) socket(0x10, 0x803, 0x2) sendmsg$NL80211_CMD_UPDATE_FT_IES(r4, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2b2088}, 0xc, &(0x7f0000000040)={0xffffffffffffffff}, 0x1, 0x0, 0x0, 0x40001}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r6, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000180)=@newtfilter={0x2c, 0x11, 0x1, 0x8070bd2c, 0x25dfdbfc, {0x0, 0x0, 0x74, r5, {0x10, 0x10}, {0xfff1, 0x8}, {0x5, 0x8}}, [@TCA_CHAIN={0x8, 0xb, 0x7}]}, 0x2c}, 0x1, 0xf0ffffffffffff, 0x0, 0x48044}, 0x40000) 924.885882ms ago: executing program 4 (id=4509): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) r1 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r1, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/74, 0x328000, 0x1000, 0x0, 0x4}, 0x20) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x3}}, [@NFT_MSG_NEWSET={0x3c, 0x9, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x2}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0xfffffffc}]}, @NFT_MSG_NEWSETELEM={0x50, 0xc, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x6}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x24, 0x3, 0x0, 0x1, [{0x20, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_SET_ELEM_EXPRESSIONS={0x14, 0xb, 0x0, 0x1, [{0x10, 0x1, 0x0, 0x1, @last={{0x9}, @void}}]}]}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x3}}}, 0xb4}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r3 = socket(0x400000000010, 0x3, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0xffffffff, {0x0, 0x0, 0x0, r5, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x1, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x28}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000440)={&(0x7f00000021c0)=@newtfilter={0x30, 0x2c, 0xd27, 0x70bd25, 0x8000, {0x0, 0x0, 0x0, r5, {0x0, 0xffff}, {}, {0xffff, 0x8}}, [@filter_kind_options=@f_fw={{0x7}, {0x4}}]}, 0x30}, 0x1, 0x0, 0x0, 0x1}, 0x800) r6 = socket(0x400000000010, 0x3, 0x0) r7 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000140)=@newtfilter={0x24, 0x2c, 0xd27, 0x70bd25, 0x8000, {0x0, 0x0, 0x0, r8, {0x7, 0x7}, {}, {0xffff, 0x8}}}, 0x24}, 0x1, 0x0, 0x0, 0x1}, 0x810) r9 = socket(0x1e, 0x5, 0x0) setsockopt$packet_tx_ring(r9, 0x10f, 0x87, &(0x7f0000000040)=@req3={0x80000000}, 0xfeda) listen(r9, 0x0) r10 = bpf$MAP_CREATE(0x0, &(0x7f00000007c0)=@base={0xa, 0xb, 0x42, 0x3e, 0x42}, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000300)={{r10}, &(0x7f0000000100), &(0x7f0000000180)}, 0x20) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x11, 0xc, &(0x7f00000001c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0xcc8, 0x0, 0x0, 0x0, 0x2}, [@ringbuf_output={{}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0xfff}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, &(0x7f0000000240)='GPL\x00', 0x8, 0x1005, &(0x7f00000014c0)=""/4101, 0x0, 0xc, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x1}, 0x94) r11 = socket(0x1e, 0x805, 0x0) sendmsg$tipc(r11, &(0x7f0000000080)={&(0x7f0000000100)=@name, 0x10, 0x0}, 0x0) setsockopt$packet_tx_ring(r11, 0x10f, 0x87, &(0x7f00000000c0)=@req3={0x80000000, 0x0, 0x2}, 0x1c) sendmsg$tipc(r11, &(0x7f0000000640)={&(0x7f0000000380), 0x10, 0x0}, 0x0) close(0x3) close(0x3) socket$igmp6(0xa, 0x3, 0x2) 914.321071ms ago: executing program 3 (id=4510): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @broadcast}) writev(r0, &(0x7f00000003c0)=[{&(0x7f0000000080)="2e9b020007e03dd65193dfb6c575963f86dd6067", 0x14}, {&(0x7f00000002c0)="b7f1dd0f0400dee69c3679904c9187295ca4266748ada3b383d7c2bc344b", 0x1e}, {&(0x7f00000001c0)="0590909c0000000045eb421fe47490e54229aedb500c5dece67d477b", 0x1c}], 0x3) 17.134373ms ago: executing program 1 (id=4511): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$packet(0x11, 0x3, 0x300) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$unix(0x1, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd26, 0xffffffff, {0x0, 0x0, 0x0, r7, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x8, 0x4}}]}}]}, 0x48}}, 0x20040084) sendmsg$nl_route_sched(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000300)=@newtfilter={0x3c, 0x2c, 0xd3f, 0x70bd24, 0x25dfdbfc, {0x0, 0x0, 0x0, r7, {0xfff1, 0x3}, {}, {0x7, 0x2}}, [@filter_kind_options=@f_flower={{0xb}, {0xc, 0x2, [@TCA_FLOWER_KEY_CT_ZONE={0x6}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x8848}, 0x20004804) sendmsg$nl_route(r3, &(0x7f0000000380)={0x0, 0x4076cbba9945d516, &(0x7f0000000340)={0x0, 0x14}}, 0x0) getsockname$packet(r3, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000080)=@newlink={0x38, 0x10, 0x439, 0x10000000, 0x0, {0x0, 0x0, 0x0, r8, 0x69801}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @gre={{0x8}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GRE_REMOTE={0x8, 0x7, @dev={0xac, 0x14, 0x14, 0x2}}]}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x20040000}, 0x0) sendto$packet(r1, &(0x7f00000001c0)="11eb0300fc0baf745836da8886dd", 0xe, 0x2404c081, &(0x7f0000000200)={0x11, 0x88a8, r8, 0x1, 0x4, 0x6, @multicast}, 0x14) ioctl$FS_IOC_GETFSLABEL(r3, 0x81009431, &(0x7f00000003c0)) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="200000002e00090027bd7000001000000400000004001d00070011"], 0x20}, 0x1, 0x0, 0x0, 0x42804}, 0x0) 0s ago: executing program 2 (id=4512): r0 = socket$nl_crypto(0x10, 0x3, 0x15) sendmsg$netlink(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f0000000840)=[{&(0x7f0000000080)=ANY=[@ANYBLOB="e00000001000090500000000000000006f6d8864d22a3f2ffaa46c88bca90000002b0e13e735a3184f123d6da2f1acfac0ee2dd2b184b27db1f302de337c0004060000000000bf852c8986626691b01b2d44e4ce28715f5f"], 0xe0}], 0x1, 0x0, 0x0, 0x810}, 0x40040) kernel console output (not intermixed with test programs): evsim netdevsim4 netdevsim1: renamed from eth1 [ 588.935463][T17597] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 588.939507][T17826] __nla_validate_parse: 7 callbacks suppressed [ 588.939524][T17826] netlink: 40 bytes leftover after parsing attributes in process `syz.1.3050'. [ 588.969209][T17597] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 589.108386][T17597] 8021q: adding VLAN 0 to HW filter on device bond0 [ 589.153841][T17597] 8021q: adding VLAN 0 to HW filter on device team0 [ 589.170023][T10138] bridge0: port 1(bridge_slave_0) entered blocking state [ 589.177260][T10138] bridge0: port 1(bridge_slave_0) entered forwarding state [ 589.196296][T12427] bridge0: port 2(bridge_slave_1) entered blocking state [ 589.203529][T12427] bridge0: port 2(bridge_slave_1) entered forwarding state [ 589.348929][ T5836] Bluetooth: hci2: command tx timeout [ 589.397242][T17822] lo speed is unknown, defaulting to 1000 [ 589.514008][T17840] lo speed is unknown, defaulting to 1000 [ 589.777679][T17597] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 590.483832][T17597] veth0_vlan: entered promiscuous mode [ 590.526086][T17597] veth1_vlan: entered promiscuous mode [ 590.557312][T17896] netlink: 192 bytes leftover after parsing attributes in process `syz.3.3065'. [ 590.558415][T17892] lo speed is unknown, defaulting to 1000 [ 590.586380][T17896] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3065'. [ 590.588038][T17890] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3064'. [ 590.611080][T17597] veth0_macvtap: entered promiscuous mode [ 590.623630][T17597] veth1_macvtap: entered promiscuous mode [ 590.695198][T17597] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 590.727224][T17597] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 590.759667][T10138] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 590.784047][T10138] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 590.839531][T10138] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 590.863962][T10138] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 590.926443][T17906] IPVS: sync thread started: state = BACKUP, mcast_ifn = veth0_to_bond, syncid = 0, id = 0 [ 591.024241][T17892] lo speed is unknown, defaulting to 1000 [ 591.184208][T10138] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 591.198759][T10138] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 591.287124][ T42] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 591.301755][ T42] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 591.429472][ T5836] Bluetooth: hci2: command tx timeout [ 591.492435][T17930] lo speed is unknown, defaulting to 1000 [ 591.622997][T17940] netlink: 20 bytes leftover after parsing attributes in process `syz.4.2993'. [ 591.811772][T17930] lo speed is unknown, defaulting to 1000 [ 591.990012][T16997] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 592.011934][T16997] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 592.020309][T16997] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 592.028242][T16997] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 592.036188][T16997] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 592.046459][T17954] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3082'. [ 592.209676][T17956] xt_hashlimit: size too large, truncated to 1048576 [ 592.283609][T17950] lo speed is unknown, defaulting to 1000 [ 592.315233][T17956] xt_limit: Overflow, try lower: 268435457/134217728 [ 592.473973][T17960] netlink: 212348 bytes leftover after parsing attributes in process `syz.4.3086'. [ 592.671302][T17950] lo speed is unknown, defaulting to 1000 [ 593.052104][T17950] chnl_net:caif_netlink_parms(): no params data found [ 593.173447][T17994] netlink: 'syz.0.3096': attribute type 3 has an invalid length. [ 593.189057][T17950] bridge0: port 1(bridge_slave_0) entered blocking state [ 593.196469][T17950] bridge0: port 1(bridge_slave_0) entered disabled state [ 593.203961][T17950] bridge_slave_0: entered allmulticast mode [ 593.213982][T17950] bridge_slave_0: entered promiscuous mode [ 593.227165][T17950] bridge0: port 2(bridge_slave_1) entered blocking state [ 593.234768][T17950] bridge0: port 2(bridge_slave_1) entered disabled state [ 593.258833][T17950] bridge_slave_1: entered allmulticast mode [ 593.266595][T17950] bridge_slave_1: entered promiscuous mode [ 593.313597][T18001] netlink: 36 bytes leftover after parsing attributes in process `syz.1.3099'. [ 593.406698][T18001] bond7: entered promiscuous mode [ 593.414636][T17950] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 593.429830][T17950] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 593.473844][T17950] team0: Port device team_slave_0 added [ 593.482638][T17950] team0: Port device team_slave_1 added [ 593.525386][T17950] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 593.532611][T17950] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 593.555298][T18016] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3101'. [ 593.566993][T17950] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 593.590759][T17950] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 593.597736][T17950] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 593.649545][T17950] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 593.807026][T18021] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3103'. [ 593.816248][T18021] netlink: 'syz.1.3103': attribute type 12 has an invalid length. [ 593.825460][T18021] netlink: 'syz.1.3103': attribute type 13 has an invalid length. [ 593.835605][T18014] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 593.991216][T18014] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 594.007005][T18028] __nla_validate_parse: 2 callbacks suppressed [ 594.007023][T18028] netlink: 312 bytes leftover after parsing attributes in process `syz.0.3106'. [ 594.070303][T16997] Bluetooth: hci4: command tx timeout [ 594.094075][T17950] hsr_slave_0: entered promiscuous mode [ 594.114093][T17950] hsr_slave_1: entered promiscuous mode [ 594.134052][T17950] debugfs: 'hsr0' already exists in 'hsr' [ 594.148926][T17950] Cannot create hsr debugfs directory [ 594.185926][T18014] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 594.302644][T18014] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 594.316588][ T29] audit: type=1800 audit(1772919992.081:4): pid=18043 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.3113" name=CB dev="tmpfs" ino=3184 res=0 errno=0 [ 594.556736][ T13] netdevsim netdevsim4 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 594.597464][T18050] netlink: 'syz.1.3116': attribute type 1 has an invalid length. [ 594.600602][ T12] netdevsim netdevsim4 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 594.605598][T18050] netlink: 248 bytes leftover after parsing attributes in process `syz.1.3116'. [ 594.626534][ T12] netdevsim netdevsim4 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 594.663702][ T12] netdevsim netdevsim4 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 594.759807][T18055] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3117'. [ 594.779276][T17130] lo speed is unknown, defaulting to 1000 [ 594.785037][T17130] syz2: Port: 1 Link DOWN [ 594.961021][T17950] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 594.997420][T17950] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 595.058044][T17950] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 595.083268][T17950] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 595.356691][T17950] 8021q: adding VLAN 0 to HW filter on device bond0 [ 595.407115][T17950] 8021q: adding VLAN 0 to HW filter on device team0 [ 595.435232][T12427] bridge0: port 1(bridge_slave_0) entered blocking state [ 595.442441][T12427] bridge0: port 1(bridge_slave_0) entered forwarding state [ 595.483689][ T42] bridge0: port 2(bridge_slave_1) entered blocking state [ 595.490908][ T42] bridge0: port 2(bridge_slave_1) entered forwarding state [ 595.810518][T18104] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3127'. [ 596.058838][T17950] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 596.148933][T16997] Bluetooth: hci4: command tx timeout [ 596.164426][T17950] veth0_vlan: entered promiscuous mode [ 596.279107][T18115] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 596.327434][T18117] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 596.361318][T18126] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3135'. [ 596.408408][T17950] veth1_vlan: entered promiscuous mode [ 596.524290][T17950] veth0_macvtap: entered promiscuous mode [ 596.557617][T17950] veth1_macvtap: entered promiscuous mode [ 596.620025][T17950] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 596.669752][T17950] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 596.712875][ T42] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 596.751866][ T42] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 596.815732][T18145] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3142'. [ 596.816886][T18143] lo speed is unknown, defaulting to 1000 [ 596.831957][ T42] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 596.984046][T10146] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 597.047600][T18145] tipc: Enabling of bearer rejected, already enabled [ 597.059654][T17786] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 597.069149][T18145] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3142'. [ 597.112013][T17786] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 597.226624][T18143] lo speed is unknown, defaulting to 1000 [ 597.231286][T10146] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 597.262936][T10146] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 597.523835][T18167] netlink: 'syz.1.3148': attribute type 10 has an invalid length. [ 597.552833][T18167] netlink: 'syz.1.3148': attribute type 10 has an invalid length. [ 597.889031][T18187] netlink: 'syz.4.3150': attribute type 12 has an invalid length. [ 597.929855][T18181] lo speed is unknown, defaulting to 1000 [ 598.043882][ T5836] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 598.060915][ T5836] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 598.099148][ T5836] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 598.123840][ T5836] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 598.138995][ T5836] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 598.228770][ T5836] Bluetooth: hci4: command tx timeout [ 598.238357][T18192] netlink: 48 bytes leftover after parsing attributes in process `syz.4.3154'. [ 598.553548][T18203] netlink: 'syz.1.3158': attribute type 4 has an invalid length. [ 598.578832][T18203] netlink: 17 bytes leftover after parsing attributes in process `syz.1.3158'. [ 598.594796][T18201] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3157'. [ 598.735580][T18186] dvmrp0: entered allmulticast mode [ 598.744894][T18211] A link change request failed with some changes committed already. Interface gre1 may have been left with an inconsistent configuration, please check. [ 598.837906][T18188] lo speed is unknown, defaulting to 1000 [ 598.837927][T18181] lo speed is unknown, defaulting to 1000 [ 599.015629][T18227] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 599.196965][T18188] lo speed is unknown, defaulting to 1000 [ 599.505656][T18244] __nla_validate_parse: 4 callbacks suppressed [ 599.505674][T18244] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3170'. [ 599.548561][T18244] bridge0: port 2(bridge_slave_1) entered disabled state [ 599.555997][T18244] bridge0: port 1(bridge_slave_0) entered disabled state [ 599.646492][T18244] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 599.662407][T18244] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 599.840798][T18254] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3171'. [ 599.863927][T12427] netdevsim netdevsim3 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 599.874228][T12427] netdevsim netdevsim3 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 599.901589][T12427] netdevsim netdevsim3 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 599.918054][T12427] netdevsim netdevsim3 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 599.943732][T18188] chnl_net:caif_netlink_parms(): no params data found [ 600.229511][ T5836] Bluetooth: hci1: command tx timeout [ 600.252922][T18281] tipc: Resetting bearer [ 600.262043][T18188] bridge0: port 1(bridge_slave_0) entered blocking state [ 600.279570][T18188] bridge0: port 1(bridge_slave_0) entered disabled state [ 600.287263][T18188] bridge_slave_0: entered allmulticast mode [ 600.304926][T18188] bridge_slave_0: entered promiscuous mode [ 600.311264][ T5836] Bluetooth: hci4: command tx timeout [ 600.320128][T18188] bridge0: port 2(bridge_slave_1) entered blocking state [ 600.327424][T18188] bridge0: port 2(bridge_slave_1) entered disabled state [ 600.335264][T18188] bridge_slave_1: entered allmulticast mode [ 600.343758][T18188] bridge_slave_1: entered promiscuous mode [ 600.407054][T18188] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 600.420690][T18188] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 600.495184][T18296] netlink: 20 bytes leftover after parsing attributes in process `syz.4.3182'. [ 600.537788][T18188] team0: Port device team_slave_0 added [ 600.551954][T18188] team0: Port device team_slave_1 added [ 600.590993][T18188] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 600.597970][T18188] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 600.624420][T18188] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 600.637984][T18188] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 600.645482][T18188] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 600.671600][T18188] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 600.756696][T18307] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3186'. [ 600.864205][T18188] hsr_slave_0: entered promiscuous mode [ 600.892167][T18188] hsr_slave_1: entered promiscuous mode [ 600.910624][T18188] debugfs: 'hsr0' already exists in 'hsr' [ 600.923791][T18188] Cannot create hsr debugfs directory [ 600.968133][T17813] udevd[17813]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 600.969584][T18307] bond0: entered promiscuous mode [ 601.018695][T18307] bond_slave_0: entered promiscuous mode [ 601.024568][T18307] bond_slave_1: entered promiscuous mode [ 601.036683][T18307] bond0: left promiscuous mode [ 601.042900][T18307] bond_slave_0: left promiscuous mode [ 601.049245][T18307] bond_slave_1: left promiscuous mode [ 601.066393][T18325] xt_HMARK: spi-set and port-set can't be combined [ 601.161803][T18327] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3192'. [ 601.217154][T18329] netlink: 'syz.3.3194': attribute type 10 has an invalid length. [ 601.226778][T18327] veth3: entered promiscuous mode [ 601.262560][T18327] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 601.289686][T18329] netdevsim netdevsim3 netdevsim0: entered promiscuous mode [ 601.331943][T18338] macsec1: entered promiscuous mode [ 601.337226][T18338] net veth1_virt_wifi virt_wifi0: entered promiscuous mode [ 601.465724][T18340] lo speed is unknown, defaulting to 1000 [ 601.489345][T18344] netlink: 32 bytes leftover after parsing attributes in process `syz.4.3195'. [ 601.545890][T18344] netlink: 20 bytes leftover after parsing attributes in process `syz.4.3195'. [ 601.849612][T18340] lo speed is unknown, defaulting to 1000 [ 601.977772][T18365] netlink: 'syz.1.3203': attribute type 32 has an invalid length. [ 601.986402][T18365] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3203'. [ 602.015618][T18370] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3202'. [ 602.213761][T18368] lo speed is unknown, defaulting to 1000 [ 602.214931][T18377] syzkaller0: entered promiscuous mode [ 602.238844][T18377] syzkaller0: entered allmulticast mode [ 602.268997][T18373] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3205'. [ 602.308601][ T5836] Bluetooth: hci1: command tx timeout [ 602.453249][T18188] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 602.515155][T18188] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 602.544447][T18188] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 602.573574][T18188] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 602.626274][T18368] lo speed is unknown, defaulting to 1000 [ 602.913167][T18188] 8021q: adding VLAN 0 to HW filter on device bond0 [ 602.935532][T18188] 8021q: adding VLAN 0 to HW filter on device team0 [ 602.955750][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 602.962967][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 602.988949][T10146] bridge0: port 2(bridge_slave_1) entered blocking state [ 602.996159][T10146] bridge0: port 2(bridge_slave_1) entered forwarding state [ 603.311404][T18188] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 603.390318][T18188] veth0_vlan: entered promiscuous mode [ 603.401777][T18418] : renamed from bond_slave_0 [ 603.412381][T18188] veth1_vlan: entered promiscuous mode [ 603.472875][T18421] netlink: 'syz.1.3218': attribute type 1 has an invalid length. [ 603.551307][T18188] veth0_macvtap: entered promiscuous mode [ 603.596626][T18188] veth1_macvtap: entered promiscuous mode [ 603.665175][T18188] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 603.708999][T18188] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 603.740305][T18431] Cannot find set identified by id 0 to match [ 603.791984][ T12] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 603.812505][ T12] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 603.869130][ T12] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 603.924591][ T12] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 604.021772][T18451] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 604.062371][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 604.101477][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 604.209770][T18461] syzkaller1: entered promiscuous mode [ 604.216739][T18461] syzkaller1: entered allmulticast mode [ 604.256719][T12427] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 604.279946][T12427] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 604.388614][ T5836] Bluetooth: hci1: command tx timeout [ 604.641662][T18481] batman_adv: batadv0: Adding interface: dummy0 [ 604.647985][T18481] batman_adv: batadv0: The MTU of interface dummy0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 604.649795][T18484] __nla_validate_parse: 2 callbacks suppressed [ 604.649812][T18484] netlink: 20 bytes leftover after parsing attributes in process `syz.0.3238'. [ 604.708732][T18481] batman_adv: batadv0: Interface activated: dummy0 [ 604.780562][T18488] xt_CONNSECMARK: only valid in 'mangle' or 'security' table, not 'raw' [ 604.843058][T16997] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 604.852965][T16997] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 604.862497][T16997] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 604.870435][T16997] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 604.878124][T16997] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 604.997609][T18498] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3242'. [ 605.025928][T18492] lo speed is unknown, defaulting to 1000 [ 605.209882][T18505] netlink: 44 bytes leftover after parsing attributes in process `syz.2.3246'. [ 605.294790][T18508] netlink: 212344 bytes leftover after parsing attributes in process `syz.4.3247'. [ 605.470042][T18519] netlink: 20 bytes leftover after parsing attributes in process `syz.4.3250'. [ 605.480730][T18492] lo speed is unknown, defaulting to 1000 [ 605.637714][T18531] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3251'. [ 605.796898][T18492] chnl_net:caif_netlink_parms(): no params data found [ 606.022220][T18544] netlink: 'syz.0.3254': attribute type 3 has an invalid length. [ 606.373626][T18552] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3257'. [ 606.387375][T18552] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3257'. [ 606.429536][T10138] bond0 (unregistering): Released all slaves [ 606.453702][T10138] bond1 (unregistering): Released all slaves [ 606.467432][T10138] bond2 (unregistering): Released all slaves [ 606.473544][T16997] Bluetooth: hci1: command tx timeout [ 606.491032][T10138] bond3 (unregistering): Released all slaves [ 606.504698][T10138] bond4 (unregistering): Released all slaves [ 606.516764][ T798] IPVS: starting estimator thread 0... [ 606.534492][T10138] bond5 (unregistering): Released all slaves [ 606.547308][T10138] bond6 (unregistering): Released all slaves [ 606.564368][T10138] bond7 (unregistering): Released all slaves [ 606.580587][T10138] bond8 (unregistering): Released all slaves [ 606.596068][T18536] bridge0: port 2(bridge_slave_1) entered disabled state [ 606.603617][T18536] bridge0: port 1(bridge_slave_0) entered disabled state [ 606.612635][T18536] bridge0: entered allmulticast mode [ 606.623756][T18556] IPVS: using max 27 ests per chain, 64800 per kthread [ 606.651289][T18541] bridge_slave_1: left allmulticast mode [ 606.657152][T18541] bridge_slave_1: left promiscuous mode [ 606.665104][T18541] bridge0: port 2(bridge_slave_1) entered disabled state [ 606.676781][T18541] bridge_slave_0: left allmulticast mode [ 606.683166][T18541] bridge_slave_0: left promiscuous mode [ 606.689334][T18541] bridge0: port 1(bridge_slave_0) entered disabled state [ 606.781775][T18551] A link change request failed with some changes committed already. Interface veth0_to_batadv may have been left with an inconsistent configuration, please check. [ 606.805363][T18552] batadv0: entered promiscuous mode [ 606.812349][T18552] erspan0: entered promiscuous mode [ 606.819276][T18552] debugfs: 'hsr1' already exists in 'hsr' [ 606.825242][T18552] Cannot create hsr debugfs directory [ 606.926156][T10138] tipc: Disabling bearer [ 606.945274][T10138] tipc: Left network mode [ 606.958873][T16997] Bluetooth: hci0: command tx timeout [ 607.245538][T18492] bridge0: port 1(bridge_slave_0) entered blocking state [ 607.257275][T18492] bridge0: port 1(bridge_slave_0) entered disabled state [ 607.277884][T18492] bridge_slave_0: entered allmulticast mode [ 607.300791][T18492] bridge_slave_0: entered promiscuous mode [ 607.360589][T18583] netlink: 16 bytes leftover after parsing attributes in process `syz.0.3265'. [ 607.387427][T18492] bridge0: port 2(bridge_slave_1) entered blocking state [ 607.417928][T18492] bridge0: port 2(bridge_slave_1) entered disabled state [ 607.434001][T18590] netlink: 20 bytes leftover after parsing attributes in process `syz.3.3268'. [ 607.443388][T18492] bridge_slave_1: entered allmulticast mode [ 607.455221][T18492] bridge_slave_1: entered promiscuous mode [ 607.588752][T18600] nbd: nbd64 already in use [ 607.598148][T17669] block nbd64: NBD_DISCONNECT [ 607.862243][T18492] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 607.915599][T18492] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 608.216019][T18631] netlink: ct family unspecified [ 609.029761][T16997] Bluetooth: hci0: command tx timeout [ 609.887622][T18492] team0: Port device team_slave_0 added [ 609.898813][T18492] team0: Port device team_slave_1 added [ 609.914362][T18635] batman_adv: batadv0: Adding interface: gretap1 [ 609.926384][T18635] batman_adv: batadv0: The MTU of interface gretap1 is too small (1462) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 609.952276][T18635] batman_adv: batadv0: Interface activated: gretap1 [ 610.076020][T18663] siw: device registration error -23 [ 610.083914][T18661] siw: device registration error -23 [ 610.121868][T18492] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 610.130150][T18492] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 610.174095][T18492] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 610.188389][T18492] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 610.195612][T18492] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 610.244637][T18492] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 610.304876][T18675] tap0: tun_chr_ioctl cmd 35111 [ 610.474166][T18492] hsr_slave_0: entered promiscuous mode [ 610.494437][T18492] hsr_slave_1: entered promiscuous mode [ 610.512814][T18492] debugfs: 'hsr0' already exists in 'hsr' [ 610.538601][T18492] Cannot create hsr debugfs directory [ 610.582175][T18681] lo speed is unknown, defaulting to 1000 [ 610.782294][T18681] lo speed is unknown, defaulting to 1000 [ 611.111880][T16997] Bluetooth: hci0: command tx timeout [ 611.216645][T18728] __nla_validate_parse: 3 callbacks suppressed [ 611.216665][T18728] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3294'. [ 611.287668][T18730] x_tables: duplicate underflow at hook 3 [ 611.512725][T18742] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 611.765874][T18753] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3303'. [ 612.525440][T18776] syzkaller0: entered allmulticast mode [ 612.679809][T18793] SET target dimension over the limit! [ 612.779769][T18797] netlink: 'syz.4.3308': attribute type 1 has an invalid length. [ 612.842382][T18798] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3309'. [ 612.932706][T18797] bond1: entered promiscuous mode [ 612.938314][T18797] 8021q: adding VLAN 0 to HW filter on device bond1 [ 612.986498][T18806] netlink: 44 bytes leftover after parsing attributes in process `syz.2.3311'. [ 613.005546][T18806] netlink: 'syz.2.3311': attribute type 5 has an invalid length. [ 613.023940][T18806] smc: net device wlan0 erased user defined pnetid SYZ0 [ 613.065598][T18801] bond1: (slave bridge1): making interface the new active one [ 613.073968][T18801] bridge1: entered promiscuous mode [ 613.083030][T18801] bond1: (slave bridge1): Enslaving as an active interface with an up link [ 613.188729][T16997] Bluetooth: hci0: command tx timeout [ 613.232051][T18804] lo speed is unknown, defaulting to 1000 [ 613.257189][T18812] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3314'. [ 613.319455][T18815] netlink: 27 bytes leftover after parsing attributes in process `syz.2.3315'. [ 613.425753][T18816] netlink: 'syz.4.3313': attribute type 83 has an invalid length. [ 613.473594][T17130] IPVS: starting estimator thread 0... [ 613.494030][T18823] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3316'. [ 613.511381][T18492] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 613.587154][T18824] IPVS: using max 37 ests per chain, 88800 per kthread [ 613.854959][T18492] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 613.944049][T18845] netlink: 'syz.2.3318': attribute type 29 has an invalid length. [ 614.022945][T18492] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 614.116395][T18492] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 614.435005][T18869] netlink: 'syz.4.3323': attribute type 30 has an invalid length. [ 614.480368][T18869] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3323'. [ 614.628467][T18869] bond2: option arp_missed_max: mode dependency failed, not supported in mode 802.3ad(4) [ 614.660400][T18869] bond2 (unregistering): Released all slaves [ 614.853062][T18492] 8021q: adding VLAN 0 to HW filter on device bond0 [ 614.914939][T18492] 8021q: adding VLAN 0 to HW filter on device team0 [ 614.958165][T18892] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3327'. [ 615.052345][T10138] bridge0: port 1(bridge_slave_0) entered blocking state [ 615.059524][T10138] bridge0: port 1(bridge_slave_0) entered forwarding state [ 615.102394][T10138] bridge0: port 2(bridge_slave_1) entered blocking state [ 615.109599][T10138] bridge0: port 2(bridge_slave_1) entered forwarding state [ 615.365268][ T2103] block nbd6: Possible stuck request ffff888026340000: control (read@0,1024B). Runtime 30 seconds [ 615.379053][ T2103] block nbd6: Possible stuck request ffff888026340200: control (read@1024,1024B). Runtime 30 seconds [ 615.390119][ T2103] block nbd6: Possible stuck request ffff888026340400: control (read@2048,1024B). Runtime 30 seconds [ 615.401165][ T2103] block nbd6: Possible stuck request ffff888026340600: control (read@3072,1024B). Runtime 30 seconds [ 615.643264][T18918] lo speed is unknown, defaulting to 1000 [ 615.665681][T18919] x_tables: duplicate underflow at hook 1 [ 616.074401][T18492] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 616.314762][T18954] netlink: 'syz.2.3334': attribute type 33 has an invalid length. [ 616.356669][T18954] netlink: 152 bytes leftover after parsing attributes in process `syz.2.3334'. [ 616.411242][T18963] netlink: 32 bytes leftover after parsing attributes in process `syz.0.3337'. [ 616.474449][T18965] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3337'. [ 616.568875][T18955] batman_adv: batadv0: Interface deactivated: dummy0 [ 616.643809][T18955] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 616.705374][T18955] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 616.773135][T18973] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3337'. [ 616.963388][T18955] veth3: left promiscuous mode [ 616.982014][T18955] bond1: left promiscuous mode [ 616.986999][T18955] bridge1: left promiscuous mode [ 617.067848][T18966] netlink: 28 bytes leftover after parsing attributes in process `syz.0.3337'. [ 617.117720][T18973] ip6gretap1: entered promiscuous mode [ 617.128707][T18973] ip6gretap1: entered allmulticast mode [ 617.165798][T10138] netdevsim netdevsim4 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 617.220936][ T42] netdevsim netdevsim4 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 617.286707][ T42] netdevsim netdevsim4 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 617.338823][ T42] netdevsim netdevsim4 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 617.370163][T18492] veth0_vlan: entered promiscuous mode [ 617.419688][T19001] A link change request failed with some changes committed already. Interface bridge_slave_0 may have been left with an inconsistent configuration, please check. [ 617.477822][T18997] openvswitch: netlink: Message has -2 unknown bytes. [ 617.503005][T18997] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 617.613448][T18992] syzkaller0: entered promiscuous mode [ 617.658271][T18992] syzkaller0: entered allmulticast mode [ 617.898349][T19027] netlink: 224 bytes leftover after parsing attributes in process `syz.0.3344'. [ 618.241689][T19030] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3345'. [ 619.413599][T18492] veth1_vlan: entered promiscuous mode [ 619.489874][T18492] veth0_macvtap: entered promiscuous mode [ 619.501180][T18492] veth1_macvtap: entered promiscuous mode [ 619.513383][T19038] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3347'. [ 619.593707][T18492] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 619.601758][T19045] tipc: Enabling of bearer rejected, failed to enable media [ 619.640527][T18492] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 619.665617][ T42] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 619.685017][ T42] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 619.705469][ T42] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 619.719110][ T42] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 619.900258][T19067] netlink: 'syz.4.3356': attribute type 15 has an invalid length. [ 619.914280][T12427] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 619.929673][T19067] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3356'. [ 619.940165][T12427] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 619.955105][T19061] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3354'. [ 619.966414][T19061] netlink: 'syz.3.3354': attribute type 12 has an invalid length. [ 619.989523][T19061] netlink: 'syz.3.3354': attribute type 12 has an invalid length. [ 620.012523][ T13] netdevsim netdevsim3 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 620.029146][ T13] netdevsim netdevsim3 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 620.069673][T18946] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 620.077204][T19076] netlink: 'syz.4.3358': attribute type 10 has an invalid length. [ 620.085724][T18946] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 620.106903][ T13] netdevsim netdevsim3 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 620.121054][ T13] netdevsim netdevsim3 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 620.130113][T19078] xt_hashlimit: size too large, truncated to 1048576 [ 620.171708][T19076] 8021q: adding VLAN 0 to HW filter on device bond0 [ 620.193770][T19076] team0: Port device bond0 added [ 620.233431][T19083] syzkaller1: entered promiscuous mode [ 620.246767][T19083] syzkaller1: entered allmulticast mode [ 620.356419][T19083] macsec0: entered promiscuous mode [ 620.638197][T19103] vlan2: entered promiscuous mode [ 620.659820][T19103] bridge0: entered promiscuous mode [ 620.664636][T19105] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 620.713628][T19106] netlink: 'syz.3.3366': attribute type 11 has an invalid length. [ 621.102389][T19125] lo speed is unknown, defaulting to 1000 [ 621.630790][T19149] __nla_validate_parse: 11 callbacks suppressed [ 621.630809][T19149] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3377'. [ 621.648163][T19149] netlink: 312 bytes leftover after parsing attributes in process `syz.0.3377'. [ 621.728283][T19149] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3377'. [ 622.333429][T19184] tipc: Started in network mode [ 622.338431][T19184] tipc: Node identity fa69fc64665e, cluster identity 4711 [ 622.342391][T19190] netlink: 68 bytes leftover after parsing attributes in process `syz.4.3392'. [ 622.349204][T19184] tipc: Enabled bearer , priority 0 [ 622.402442][T19184] syzkaller0: entered promiscuous mode [ 622.407962][T19184] syzkaller0: entered allmulticast mode [ 622.467644][T19184] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3389'. [ 622.480921][T19184] tipc: Resetting bearer [ 622.492053][T19183] tipc: Resetting bearer [ 622.564956][T19183] tipc: Disabling bearer [ 622.729406][T19212] netlink: 'syz.0.3395': attribute type 162 has an invalid length. [ 623.272234][T19244] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 623.856525][T19281] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3409'. [ 623.941048][T19279] netlink: 'syz.4.3410': attribute type 1 has an invalid length. [ 623.968580][T19279] netlink: 224 bytes leftover after parsing attributes in process `syz.4.3410'. [ 624.320355][T19301] syzkaller0: entered promiscuous mode [ 624.334952][T19301] syzkaller0: entered allmulticast mode [ 624.363656][T19301] netlink: 'syz.3.3417': attribute type 1 has an invalid length. [ 624.453739][T19301] bond1: (slave veth3): Enslaving as an active interface with a down link [ 624.498255][T19301] bond1: (slave dummy0): making interface the new active one [ 624.507257][T19301] bond1: (slave dummy0): Enslaving as an active interface with an up link [ 624.555880][T19301] netlink: 14 bytes leftover after parsing attributes in process `syz.3.3417'. [ 624.580446][T19301] bond1: (slave dummy0): Releasing active interface [ 624.590563][T19314] netlink: 'syz.4.3421': attribute type 1 has an invalid length. [ 625.256954][T19329] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3423'. [ 625.436894][T19335] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3426'. [ 625.861606][T19348] ip6_tunnel: non-ECT from fe80:0000:0000:0000:0000:0000:0000:00bb with DS=0x15 [ 625.880677][T19348] ip6_tunnel: non-ECT from fe80:0000:0000:0000:0000:0000:0000:00bb with DS=0x15 [ 625.929120][T19348] ip6_tunnel: non-ECT from fe80:0000:0000:0000:0000:0000:0000:00bb with DS=0x15 [ 625.949695][T19349] workqueue: Failed to create a rescuer kthread for wq "nfc2_nci_cmd_wq": -EINTR [ 625.971608][T19348] ip6_tunnel: non-ECT from fe80:0000:0000:0000:0000:0000:0000:00bb with DS=0x15 [ 626.217667][T19366] netlink: 'syz.1.3437': attribute type 21 has an invalid length. [ 626.246150][T19366] bond0: option lacp_rate: mode dependency failed, not supported in mode balance-rr(0) [ 626.507828][T19385] dvmrp0: left allmulticast mode [ 626.542208][T19387] netlink: 'syz.4.3445': attribute type 2 has an invalid length. [ 626.597157][ T6615] netdevsim netdevsim1 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 626.631845][ T6615] netdevsim netdevsim1 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 626.642190][T19384] lo speed is unknown, defaulting to 1000 [ 626.648098][ T6615] netdevsim netdevsim1 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 626.688786][ T6615] netdevsim netdevsim1 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 626.970169][T19398] netlink: 'syz.4.3448': attribute type 1 has an invalid length. [ 626.988257][T19398] __nla_validate_parse: 3 callbacks suppressed [ 626.988275][T19398] netlink: 244 bytes leftover after parsing attributes in process `syz.4.3448'. [ 627.596487][T19425] pimreg: entered allmulticast mode [ 627.688829][T19428] netlink: 816 bytes leftover after parsing attributes in process `syz.2.3456'. [ 628.218271][T19435] netlink: 'syz.3.3458': attribute type 3 has an invalid length. [ 628.236856][T19435] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3458'. [ 628.246691][T19435] openvswitch: netlink: Invalid VLAN frame [ 628.380400][T19440] netlink: 'syz.3.3459': attribute type 4 has an invalid length. [ 628.484888][T19444] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 628.552661][T19449] wg1: entered promiscuous mode [ 628.557561][T19449] wg1: entered allmulticast mode [ 628.722408][T19316] Set syz1 is full, maxelem 65536 reached [ 628.736539][T19462] netlink: 20 bytes leftover after parsing attributes in process `syz.3.3466'. [ 629.012416][T19483] netlink: 'syz.0.3469': attribute type 29 has an invalid length. [ 629.059670][T19483] netlink: 'syz.0.3469': attribute type 29 has an invalid length. [ 629.106072][T19468] lo speed is unknown, defaulting to 1000 [ 629.735924][T19506] lo speed is unknown, defaulting to 1000 [ 629.879666][T19510] netlink: 32 bytes leftover after parsing attributes in process `syz.3.3481'. [ 629.926613][T19520] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3483'. [ 630.123164][T19530] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3484'. [ 630.141045][T19530] syzkaller1: entered promiscuous mode [ 630.168133][T19530] syzkaller1: entered allmulticast mode [ 630.282138][T19532] netlink: 87 bytes leftover after parsing attributes in process `syz.3.3485'. [ 630.706695][T19539] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3487'. [ 630.954696][T19547] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3489'. [ 631.465512][T19558] A link change request failed with some changes committed already. Interface team0 may have been left with an inconsistent configuration, please check. [ 631.589904][T19562] bond_slave_0: entered promiscuous mode [ 631.596100][T19562] bond_slave_1: entered promiscuous mode [ 631.605260][T19562] vlan2: entered promiscuous mode [ 631.610462][T19562] bond0: entered promiscuous mode [ 631.795795][T19573] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 632.105241][T19586] __nla_validate_parse: 4 callbacks suppressed [ 632.105259][T19586] netlink: 64 bytes leftover after parsing attributes in process `syz.3.3503'. [ 632.144715][T19582] syzkaller0: entered promiscuous mode [ 632.150408][T19582] syzkaller0: entered allmulticast mode [ 632.167419][T19587] netlink: 'syz.2.3502': attribute type 1 has an invalid length. [ 632.176969][T19587] netlink: 'syz.2.3502': attribute type 2 has an invalid length. [ 632.191799][T19587] rdma_op ffff8880494ff9f0 conn xmit_rdma 0000000000000000 [ 632.620794][T19595] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3505'. [ 632.667661][T19594] netlink: 'syz.2.3505': attribute type 13 has an invalid length. [ 632.686341][T19594] netlink: 'syz.2.3505': attribute type 17 has an invalid length. [ 632.842851][T19594] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 633.388639][T19617] 8021q: VLANs not supported on caif0 [ 633.460489][T19619] tc_dump_action: action bad kind [ 633.804392][T19628] batman_adv: batadv0: Adding interface: macvtap1 [ 633.818690][T19628] batman_adv: batadv0: The MTU of interface macvtap1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 633.879506][T19628] batman_adv: batadv0: Not using interface macvtap1 (retrying later): interface not active [ 634.107950][T19648] RDS: rds_bind could not find a transport for ::ffff:172.30.1.4, load rds_tcp or rds_rdma? [ 634.200085][T19648] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3517'. [ 634.232050][T19648] netlink: 'syz.3.3517': attribute type 10 has an invalid length. [ 634.250633][T19648] netlink: 'syz.3.3517': attribute type 10 has an invalid length. [ 634.448560][ T29] audit: type=1107 audit(1772920032.211:5): pid=19659 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='' [ 634.885011][T19673] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 634.914094][T19516] Set syz1 is full, maxelem 65536 reached [ 634.951460][T19624] Cannot find del_set index 4 as target [ 635.045679][T19670] netlink: 'syz.2.3523': attribute type 1 has an invalid length. [ 635.156696][T19683] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3527'. [ 635.176429][T19670] erspan1: entered allmulticast mode [ 635.455238][T19688] lo speed is unknown, defaulting to 1000 [ 635.556209][T19703] netlink: 'syz.4.3532': attribute type 1 has an invalid length. [ 635.575533][T19703] netlink: 224 bytes leftover after parsing attributes in process `syz.4.3532'. [ 635.819714][T19716] netlink: 'syz.2.3537': attribute type 1 has an invalid length. [ 635.916743][T19718] gretap2: entered allmulticast mode [ 635.970956][T19718] bond1: (slave gretap2): making interface the new active one [ 635.992659][T19718] bond1: (slave gretap2): Enslaving as an active interface with an up link [ 636.162652][T19726] siw: device registration error -23 [ 636.181567][T19725] lo speed is unknown, defaulting to 1000 [ 636.331143][T19725] lo speed is unknown, defaulting to 1000 [ 636.348055][T19725] lo speed is unknown, defaulting to 1000 [ 636.385348][T19725] infiniband syz2: RDMA CMA: cma_listen_on_dev, error -98 [ 636.431164][T19740] sctp: [Deprecated]: syz.4.3544 (pid 19740) Use of struct sctp_assoc_value in delayed_ack socket option. [ 636.431164][T19740] Use struct sctp_sack_info instead [ 636.461821][T19743] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3543'. [ 636.485155][T19743] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3543'. [ 636.500947][T19743] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3543'. [ 636.517735][T19725] lo speed is unknown, defaulting to 1000 [ 636.525468][T19691] netlink: 20 bytes leftover after parsing attributes in process `syz.0.3529'. [ 636.564517][T19742] netdevsim netdevsim1 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 636.576023][T19742] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 636.601738][T19725] lo speed is unknown, defaulting to 1000 [ 636.628149][T19748] netlink: 60 bytes leftover after parsing attributes in process `syz.3.3545'. [ 636.632149][T19725] lo speed is unknown, defaulting to 1000 [ 636.649427][T19725] lo speed is unknown, defaulting to 1000 [ 636.656965][T19725] lo speed is unknown, defaulting to 1000 [ 636.665204][T19725] lo speed is unknown, defaulting to 1000 [ 636.684760][T19725] lo speed is unknown, defaulting to 1000 [ 636.736990][T19742] netdevsim netdevsim1 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 636.752017][T19742] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 636.767966][T19725] lo speed is unknown, defaulting to 1000 [ 636.822688][T19725] lo speed is unknown, defaulting to 1000 [ 636.855342][T19742] netdevsim netdevsim1 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 636.870089][T19742] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 636.889868][T19725] lo speed is unknown, defaulting to 1000 [ 636.987665][T19742] netdevsim netdevsim1 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 637.012243][T19742] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 637.027466][T19764] openvswitch: netlink: Duplicate or invalid key (type 0). [ 637.048036][T19764] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 637.048059][T19766] openvswitch: netlink: Unexpected mask (mask=20440, allowed=10048) [ 637.314186][ T1157] netdevsim netdevsim1 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 637.334048][ T1157] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 637.426638][T10138] netdevsim netdevsim1 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 637.469238][T10138] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 637.519305][T10138] netdevsim netdevsim1 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 637.531011][T10138] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 637.551530][ T1157] netdevsim netdevsim1 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 637.562490][ T1157] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 637.780398][T19798] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3556'. [ 637.802342][T19798] openvswitch: netlink: Flow actions attr not present in new flow. [ 637.915340][T19802] netlink: 64 bytes leftover after parsing attributes in process `syz.1.3559'. [ 637.942311][T19802] vlan2: entered promiscuous mode [ 637.947850][T19802] geneve1: entered promiscuous mode [ 638.167921][T19812] netlink: 148 bytes leftover after parsing attributes in process `syz.3.3565'. [ 638.196304][T19812] A link change request failed with some changes committed already. Interface gre0 may have been left with an inconsistent configuration, please check. [ 638.560018][T19848] netlink: 120 bytes leftover after parsing attributes in process `syz.1.3574'. [ 638.683405][T19858] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3572'. [ 638.718655][T19858] netlink: 92 bytes leftover after parsing attributes in process `syz.3.3572'. [ 638.758440][T19858] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3572'. [ 638.767917][T19858] A link change request failed with some changes committed already. Interface team0 may have been left with an inconsistent configuration, please check. [ 638.813547][T19866] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3578'. [ 638.826067][T19866] netlink: 10 bytes leftover after parsing attributes in process `syz.2.3578'. [ 638.844446][T19866] vlan2: entered promiscuous mode [ 638.849850][T19866] geneve1: entered promiscuous mode [ 638.855533][T19866] vlan2: entered allmulticast mode [ 638.861337][T19866] geneve1: entered allmulticast mode [ 638.971268][T19875] netlink: 36 bytes leftover after parsing attributes in process `syz.1.3579'. [ 639.036564][T19875] bridge0: port 2(bridge_slave_1) entered disabled state [ 639.044262][T19875] bridge0: port 1(bridge_slave_0) entered disabled state [ 639.066576][T19882] openvswitch: netlink: Unexpected mask (mask=1040, allowed=10048) [ 639.151110][T19875] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 639.164681][T19875] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 639.266702][ T13] netdevsim netdevsim1 eth0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 639.279036][ T13] netdevsim netdevsim1 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 639.336542][T19890] bond1: (slave bond_slave_1): Device is not our slave [ 639.358755][T19890] bond1: option active_slave: invalid value (bond_slave_1) [ 639.372573][T19890] bond1 (unregistering): Released all slaves [ 639.408905][ T13] netdevsim netdevsim1 eth1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 639.415812][T19897] netlink: 'syz.2.3585': attribute type 11 has an invalid length. [ 639.426171][ T13] netdevsim netdevsim1 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 639.436492][ T13] netdevsim netdevsim1 eth2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 639.446287][ T13] netdevsim netdevsim1 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 639.490741][ T13] netdevsim netdevsim1 eth3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 639.506232][ T13] netdevsim netdevsim1 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 639.587076][T19898] lo speed is unknown, defaulting to 1000 [ 639.622111][T19906] x_tables: duplicate underflow at hook 1 [ 640.081860][T19898] lo speed is unknown, defaulting to 1000 [ 640.226746][T19941] bridge1: entered allmulticast mode [ 641.185397][T19988] bridge4: trying to set multicast query interval below minimum, setting to 100 (1000ms) [ 641.203102][T17130] IPVS: starting estimator thread 0... [ 641.299261][T19989] IPVS: using max 31 ests per chain, 74400 per kthread [ 641.321640][T19988] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 641.410552][T19988] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 641.507435][T20011] syzkaller0: entered promiscuous mode [ 641.513134][T20011] syzkaller0: entered allmulticast mode [ 641.542195][T19988] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 643.085905][T19988] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 643.212239][T10138] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 643.233190][T10138] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 643.253873][T10138] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 643.275423][T10138] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 644.303225][T19998] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 644.497135][T20047] netlink: 'syz.3.3628': attribute type 8 has an invalid length. [ 644.524749][T20049] vlan3: entered promiscuous mode [ 644.533507][T20049] bridge0: entered promiscuous mode [ 644.690886][T20067] netlink: 'syz.3.3633': attribute type 11 has an invalid length. [ 644.699606][T20067] __nla_validate_parse: 152 callbacks suppressed [ 644.699623][T20067] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3633'. [ 644.849581][T20079] dummy0: entered allmulticast mode [ 644.855673][T20082] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3635'. [ 644.874673][T20082] geneve2: entered promiscuous mode [ 644.886131][T10135] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 644.898917][T10135] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 644.907882][T10135] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 644.917311][T10135] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 644.926821][T20081] dummy0: left allmulticast mode [ 645.272066][T20101] Cannot find map_set index 135 as target [ 645.333201][T20103] bpq0: entered allmulticast mode [ 645.344431][T20103] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3643'. [ 645.387740][T20107] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3642'. [ 645.440655][ T2103] block nbd6: Possible stuck request ffff888026340000: control (read@0,1024B). Runtime 60 seconds [ 645.453381][ T2103] block nbd6: Possible stuck request ffff888026340200: control (read@1024,1024B). Runtime 60 seconds [ 645.467534][ T2103] block nbd6: Possible stuck request ffff888026340400: control (read@2048,1024B). Runtime 60 seconds [ 645.480698][ T2103] block nbd6: Possible stuck request ffff888026340600: control (read@3072,1024B). Runtime 60 seconds [ 645.640981][T20124] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3647'. [ 645.698998][T20125] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3647'. [ 645.753343][T20125] workqueue: Failed to create a rescuer kthread for wq "bond1": -EINTR [ 645.785172][T20124] workqueue: Failed to create a rescuer kthread for wq "bond1": -EINTR [ 646.682575][T20169] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3661'. [ 646.701743][T20169] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3661'. [ 648.153138][T20094] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 648.366407][T20183] syzkaller1: entered promiscuous mode [ 648.393720][T20183] syzkaller1: entered allmulticast mode [ 648.404932][T20188] : renamed from dummy0 [ 649.309956][T20243] netlink: 'syz.0.3679': attribute type 1 has an invalid length. [ 649.327019][T20241] lo speed is unknown, defaulting to 1000 [ 649.410401][T20246] netlink: 212368 bytes leftover after parsing attributes in process `syz.3.3680'. [ 649.560485][T20252] mac80211_hwsim hwsim38 wlan1: entered allmulticast mode [ 649.571598][T20252] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3683'. [ 649.595992][T20252] bridge_slave_0: left allmulticast mode [ 649.602461][T20252] bridge_slave_0: left promiscuous mode [ 649.608248][T20252] bridge0: port 1(bridge_slave_0) entered disabled state [ 649.699325][T20252] bridge_slave_1: left allmulticast mode [ 649.705075][T20252] bridge_slave_1: left promiscuous mode [ 649.713373][T20252] bridge0: port 2(bridge_slave_1) entered disabled state [ 649.732938][T20252] bond0: (slave bond_slave_0): Releasing backup interface [ 649.761168][T20252] bond0: (slave bond_slave_1): Releasing backup interface [ 649.795306][T20252] team0: Port device team_slave_0 removed [ 649.810256][T20252] team0: Port device team_slave_1 removed [ 649.816573][T20252] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 649.830694][T20252] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 649.848933][T20252] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 649.891597][T20241] lo speed is unknown, defaulting to 1000 [ 650.033953][T20261] netlink: 'syz.0.3685': attribute type 1 has an invalid length. [ 650.278132][T20261] bond1: entered promiscuous mode [ 650.287427][T20261] 8021q: adding VLAN 0 to HW filter on device bond1 [ 650.296229][T20268] 8021q: VLANs not supported on caif0 [ 650.364781][T20274] bond1: (slave bridge5): making interface the new active one [ 650.396191][T20274] bridge5: entered promiscuous mode [ 650.422545][T20274] bond1: (slave bridge5): Enslaving as an active interface with an up link [ 650.837521][T20296] aoe: error packet from 57979.68@lo; ecode=101 'no such error' [ 650.845710][T20296] aoe: error packet from 57979.68@lo; ecode=101 'no such error' [ 650.853436][T20296] aoe: error packet from 57979.68@lo; ecode=101 'no such error' [ 650.861133][T20296] aoe: error packet from 57979.68@lo; ecode=101 'no such error' [ 650.861620][T20299] lo speed is unknown, defaulting to 1000 [ 650.868809][T20296] aoe: error packet from 57979.68@lo; ecode=101 'no such error' [ 650.868845][T20296] aoe: error packet from 57979.68@lo; ecode=101 'no such error' [ 650.868875][T20296] aoe: error packet from 57979.68@lo; ecode=101 'no such error' [ 650.868904][T20296] aoe: error packet from 57979.68@lo; ecode=101 'no such error' [ 650.868933][T20296] aoe: error packet from 57979.68@lo; ecode=101 'no such error' [ 650.885562][T20302] netlink: 40 bytes leftover after parsing attributes in process `syz.1.3695'. [ 650.965887][T20304] syzkaller1: entered promiscuous mode [ 650.972838][T20304] syzkaller1: entered allmulticast mode [ 651.045394][T20304] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3696'. [ 651.155005][T20312] netlink: 60 bytes leftover after parsing attributes in process `syz.3.3697'. [ 651.427099][T20299] lo speed is unknown, defaulting to 1000 [ 652.253729][T20337] 8021q: adding VLAN 0 to HW filter on device bond0 [ 652.270923][T20337] 8021q: adding VLAN 0 to HW filter on device team0 [ 652.480077][T20343] xt_CT: You must specify a L4 protocol and not use inversions on it [ 652.727676][T20358] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3708'. [ 652.809776][T20358] : entered promiscuous mode [ 652.889735][T20363] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3709'. [ 652.928649][T20363] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3709'. [ 652.937592][T20363] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3709'. [ 652.948294][T20364] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3709'. [ 652.972163][T20363] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3709'. [ 652.988414][T20363] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3709'. [ 653.144142][ T13] nci: nci_rx_work: unknown MT 0x1 [ 653.150941][T20379] bond4: entered promiscuous mode [ 653.156558][T20379] 8021q: adding VLAN 0 to HW filter on device bond4 [ 653.188364][T20382] bond2: entered promiscuous mode [ 653.230657][T20382] 8021q: adding VLAN 0 to HW filter on device bond2 [ 653.352133][T20389] xt_policy: too many policy elements [ 653.712614][T20363] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 653.873177][T20408] xt_l2tp: v2 tid > 0xffff: 37482740 [ 654.300058][T20431] tun0: tun_chr_ioctl cmd 1074025672 [ 654.305574][T20431] tun0: ignored: set checksum disabled [ 654.411317][T20440] lo speed is unknown, defaulting to 1000 [ 654.444434][T20443] netlink: 'syz.3.3732': attribute type 1 has an invalid length. [ 654.463489][T20443] netlink: 'syz.3.3732': attribute type 1 has an invalid length. [ 654.663156][T20440] lo speed is unknown, defaulting to 1000 [ 654.663238][T20452] lo speed is unknown, defaulting to 1000 [ 654.824613][T20459] netlink: 'syz.3.3736': attribute type 10 has an invalid length. [ 655.202902][T20452] lo speed is unknown, defaulting to 1000 [ 655.400814][T20487] netlink: 'syz.4.3744': attribute type 1 has an invalid length. [ 655.570061][T20487] bond5: entered promiscuous mode [ 655.593994][T20487] 8021q: adding VLAN 0 to HW filter on device bond5 [ 655.621756][T20498] net_ratelimit: 1018 callbacks suppressed [ 655.621856][T20498] openvswitch: netlink: Message has 4 unknown bytes. [ 655.655387][T20498] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 655.986376][T20492] lo speed is unknown, defaulting to 1000 [ 656.811163][T20552] netlink: 'syz.0.3760': attribute type 2 has an invalid length. [ 656.825482][T20552] hmac(sha224: entered promiscuous mode [ 656.851426][T20552] __nla_validate_parse: 20 callbacks suppressed [ 656.851447][T20552] netlink: 36 bytes leftover after parsing attributes in process `syz.0.3760'. [ 656.922556][T20552] netlink: 36 bytes leftover after parsing attributes in process `syz.0.3760'. [ 656.942163][T20552] netlink: 36 bytes leftover after parsing attributes in process `syz.0.3760'. [ 656.986805][T20552] netlink: 36 bytes leftover after parsing attributes in process `syz.0.3760'. [ 656.996381][T20552] netlink: 36 bytes leftover after parsing attributes in process `syz.0.3760'. [ 657.013136][T20552] netlink: 36 bytes leftover after parsing attributes in process `syz.0.3760'. [ 657.022484][T20552] netlink: 36 bytes leftover after parsing attributes in process `syz.0.3760'. [ 657.036767][T20552] netlink: 36 bytes leftover after parsing attributes in process `syz.0.3760'. [ 657.046585][T20552] netlink: 36 bytes leftover after parsing attributes in process `syz.0.3760'. [ 657.061363][T20552] netlink: 36 bytes leftover after parsing attributes in process `syz.0.3760'. [ 657.094226][T20552] bridge0: port 2(bridge_slave_1) entered disabled state [ 657.102022][T20552] bridge0: port 1(bridge_slave_0) entered disabled state [ 657.206511][T20552] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 657.225983][T20552] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 657.356494][T20492] lo speed is unknown, defaulting to 1000 [ 657.366431][T20546] lo speed is unknown, defaulting to 1000 [ 657.373196][T17786] netdevsim netdevsim0 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 657.382087][T17786] netdevsim netdevsim0 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 657.395117][T17786] netdevsim netdevsim0 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 657.419439][T17786] netdevsim netdevsim0 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 657.740873][T20582] bond2: entered promiscuous mode [ 657.745959][T20582] bond2: entered allmulticast mode [ 657.832697][T20582] 8021q: adding VLAN 0 to HW filter on device bond2 [ 657.892856][T20546] lo speed is unknown, defaulting to 1000 [ 658.214784][T20601] : renamed from batadv_slave_0 [ 658.416681][T20612] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 658.554694][T20619] netlink: 'syz.1.3772': attribute type 1 has an invalid length. [ 658.690194][T20631] bond0: (slave rose0): Enslaving as an active interface with an up link [ 658.954915][T20638] xt_CHECKSUM: unsupported CHECKSUM operation 68 [ 658.976373][T20645] lo speed is unknown, defaulting to 1000 [ 659.004545][T20638] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 659.055994][T20638] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 659.114859][T20638] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 659.459643][T20679] vlan3: entered promiscuous mode [ 659.502000][T20683] netlink: 'syz.1.3787': attribute type 21 has an invalid length. [ 659.662970][T20645] lo speed is unknown, defaulting to 1000 [ 659.698340][T20637] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 659.729195][T20637] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 660.493277][T20713] bridge4: entered allmulticast mode [ 660.502844][T20713] team0: Failed to send port change of device bridge4 via netlink (err -105) [ 660.525677][T20713] team0: Failed to send options change via netlink (err -105) [ 660.555683][T20713] team0: Port device bridge4 added [ 660.829006][T20727] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 661.095013][T20736] bond2: option ad_actor_sys_prio: mode dependency failed, not supported in mode balance-rr(0) [ 661.119184][T20736] bond2 (unregistering): Released all slaves [ 661.148286][T20747] bridge: RTM_NEWNEIGH with invalid state 0x0 [ 661.276361][T20739] syzkaller0: entered promiscuous mode [ 661.290637][T20739] syzkaller0: entered allmulticast mode [ 661.382874][T20764] netlink: zone id is out of range [ 663.300689][T20792] netlink: 'syz.1.3813': attribute type 21 has an invalid length. [ 663.311835][T20792] __nla_validate_parse: 256 callbacks suppressed [ 663.311853][T20792] netlink: 132 bytes leftover after parsing attributes in process `syz.1.3813'. [ 663.435269][T20802] netlink: 'syz.2.3816': attribute type 1 has an invalid length. [ 663.540086][T20802] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3816'. [ 663.550777][T20802] netlink: 11 bytes leftover after parsing attributes in process `syz.2.3816'. [ 663.562959][T20802] netlink: 11 bytes leftover after parsing attributes in process `syz.2.3816'. [ 663.572982][T20802] netlink: 52 bytes leftover after parsing attributes in process `syz.2.3816'. [ 663.576419][T20812] netlink: 20 bytes leftover after parsing attributes in process `syz.2.3816'. [ 663.616088][T20813] netlink: 148 bytes leftover after parsing attributes in process `syz.3.3820'. [ 663.740277][T20816] netlink: 'syz.4.3821': attribute type 21 has an invalid length. [ 663.748988][T20816] netlink: 128 bytes leftover after parsing attributes in process `syz.4.3821'. [ 663.758111][T20816] netlink: 'syz.4.3821': attribute type 5 has an invalid length. [ 663.766339][T20816] netlink: 'syz.4.3821': attribute type 6 has an invalid length. [ 663.774643][T20816] netlink: 3 bytes leftover after parsing attributes in process `syz.4.3821'. [ 663.902091][T20823] netlink: 32 bytes leftover after parsing attributes in process `syz.1.3824'. [ 663.937822][T20837] x_tables: duplicate underflow at hook 2 [ 663.997712][T20823] macvtap0: entered promiscuous mode [ 664.040197][T20823] macvtap0 (unregistering): left promiscuous mode [ 664.305405][T20861] hsr_slave_1 (unregistering): left promiscuous mode [ 664.676088][T20881] bridge_slave_0: left allmulticast mode [ 664.688346][T20881] bridge_slave_0: left promiscuous mode [ 664.694354][T20881] bridge0: port 1(bridge_slave_0) entered disabled state [ 664.707898][T20881] bridge_slave_1: left allmulticast mode [ 664.713058][T20884] siw: device registration error -23 [ 664.719747][T20881] bridge_slave_1: left promiscuous mode [ 664.740818][T20881] bridge0: port 2(bridge_slave_1) entered disabled state [ 664.754986][T20881] bond0: (slave bond_slave_0): Releasing backup interface [ 664.765284][T20881] bond0: (slave bond_slave_1): Releasing backup interface [ 664.776934][T20881] team0: Port device team_slave_0 removed [ 664.785662][T20881] team0: Port device team_slave_1 removed [ 664.794502][T20881] batman_adv: batadv0: Removing interface: 1 [ 664.804771][T20881] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 664.815305][T20881] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 664.834840][T20890] .70: renamed from hsr0 (while UP) [ 664.865313][T20891] Timeout policy `syz0' can only be used by L3 protocol number 34997 [ 664.886410][T20890] .70: entered allmulticast mode [ 664.907145][T20890] hsr_slave_0: entered allmulticast mode [ 664.917419][T20890] A link change request failed with some changes committed already. Interface .70 may have been left with an inconsistent configuration, please check. [ 665.049196][T20866] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 665.066050][T20866] Bluetooth: hci5: Error when powering off device on rfkill (-4) [ 665.248870][T20866] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 665.260140][T20866] Bluetooth: hci2: Error when powering off device on rfkill (-4) [ 665.305188][T20915] batman_adv: batadv0: Adding interface: gretap1 [ 665.343574][T20915] batman_adv: batadv0: The MTU of interface gretap1 is too small (1462) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 665.387766][T20915] batman_adv: batadv0: Interface activated: gretap1 [ 665.461881][T20918] bond3: option primary: mode dependency failed, not supported in mode balance-rr(0) [ 665.487940][T20918] bond3 (unregistering): Released all slaves [ 665.594355][T20866] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 665.614152][T20866] Bluetooth: hci4: Error when powering off device on rfkill (-4) [ 665.752703][T20866] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 665.782385][T20866] Bluetooth: hci1: Error when powering off device on rfkill (-4) [ 665.801370][T20866] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 665.808996][T20866] Bluetooth: hci0: Error when powering off device on rfkill (-4) [ 666.254748][T20975] vlan5: entered allmulticast mode [ 666.269121][T20975] bond0: entered allmulticast mode [ 666.274304][T20975] bond_slave_0: entered allmulticast mode [ 666.303782][T20975] bond_slave_1: entered allmulticast mode [ 666.347580][T20982] team0: Port device bond0 removed [ 666.397428][T20982] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 666.474252][T20982] bond_slave_0: left allmulticast mode [ 666.502507][T20982] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 666.589270][T20982] bond_slave_1: left allmulticast mode [ 666.595286][T20982] bond0 (unregistering): Released all slaves [ 666.989307][T21025] netlink: 'syz.4.3867': attribute type 1 has an invalid length. [ 667.146038][T21025] 8021q: adding VLAN 0 to HW filter on device bond0 [ 667.221149][T21039] dvmrp0: entered allmulticast mode [ 668.017573][T21075] lo speed is unknown, defaulting to 1000 [ 668.781778][T21102] __nla_validate_parse: 15 callbacks suppressed [ 668.781798][T21102] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3883'. [ 668.823006][T20867] udevd[20867]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 668.836768][T21106] netlink: 11562 bytes leftover after parsing attributes in process `syz.3.3885'. [ 668.875014][T21075] lo speed is unknown, defaulting to 1000 [ 668.875086][T21079] lo speed is unknown, defaulting to 1000 [ 668.910067][T21112] netlink: 'syz.4.3886': attribute type 11 has an invalid length. [ 668.929574][T21112] netlink: 140 bytes leftover after parsing attributes in process `syz.4.3886'. [ 669.150664][T21123] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3890'. [ 669.356125][T21133] syzkaller0: entered promiscuous mode [ 669.362052][T21133] syzkaller0: entered allmulticast mode [ 669.370906][T21134] syzkaller0: entered promiscuous mode [ 669.377632][T21134] syzkaller0: entered allmulticast mode [ 669.386031][T21079] lo speed is unknown, defaulting to 1000 [ 669.452164][T21134] tipc: Started in network mode [ 669.457195][T21134] tipc: Node identity 2ac277775423, cluster identity 4711 [ 669.475173][T21134] tipc: Enabled bearer , priority 0 [ 669.505623][T21139] netlink: 5 bytes leftover after parsing attributes in process `syz.2.3893'. [ 669.737979][T21149] xt_CT: You must specify a L4 protocol and not use inversions on it [ 671.114798][T21139] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 671.139958][T21131] tipc: Resetting bearer [ 671.168855][T21131] tipc: Disabling bearer [ 671.182472][T18985] tipc: Node number set to 2128705399 [ 671.200761][T17125] lo speed is unknown, defaulting to 1000 [ 671.278683][T21155] netlink: 60 bytes leftover after parsing attributes in process `syz.3.3900'. [ 671.410684][T21159] netlink: 'syz.2.3901': attribute type 27 has an invalid length. [ 671.434362][T21165] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3903'. [ 671.441511][T21159] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3901'. [ 671.469244][T21166] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3903'. [ 671.580991][T21162] lo speed is unknown, defaulting to 1000 [ 671.727167][T21179] netlink: 'syz.2.3906': attribute type 22 has an invalid length. [ 671.752104][T21177] netlink: 'syz.3.3908': attribute type 1 has an invalid length. [ 671.758996][T21179] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3906'. [ 671.781574][T21179] netlink: 'syz.2.3906': attribute type 22 has an invalid length. [ 671.956550][T21162] lo speed is unknown, defaulting to 1000 [ 672.109102][T21202] netlink: 'syz.2.3915': attribute type 4 has an invalid length. [ 672.173350][T21203] syzkaller1: entered promiscuous mode [ 672.179627][T21203] syzkaller1: entered allmulticast mode [ 672.294268][T21213] netlink: 'syz.3.3917': attribute type 5 has an invalid length. [ 672.396481][T21217] netlink: 'syz.2.3918': attribute type 2 has an invalid length. [ 672.444613][T21217] Bluetooth: MGMT ver 1.23 [ 672.637736][T21235] xt_HMARK: proto mask must be zero with L3 mode [ 673.245585][T21241] netlink: 'syz.2.3925': attribute type 21 has an invalid length. [ 673.365343][T21262] vlan5: entered promiscuous mode [ 673.370651][T21262] gretap0: entered promiscuous mode [ 673.556716][T21276] openvswitch: netlink: Missing key (keys=40, expected=2000) [ 673.883253][T21293] __nla_validate_parse: 20 callbacks suppressed [ 673.883273][T21293] netlink: 364 bytes leftover after parsing attributes in process `syz.1.3939'. [ 673.888815][ T29] audit: type=1800 audit(1772920071.651:6): pid=21283 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.3937" name="memory.events" dev="tmpfs" ino=697 res=0 errno=0 [ 674.056420][T21301] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3941'. [ 674.473186][T21328] netlink: 'syz.3.3951': attribute type 2 has an invalid length. [ 674.536096][T21328] hmac(sha224): entered promiscuous mode [ 674.614061][T21339] netlink: 'syz.0.3953': attribute type 1 has an invalid length. [ 674.622537][T21339] netlink: 216 bytes leftover after parsing attributes in process `syz.0.3953'. [ 674.731311][T21346] netlink: 44 bytes leftover after parsing attributes in process `syz.4.3954'. [ 674.785391][T21349] lo speed is unknown, defaulting to 1000 [ 675.026178][T21362] netlink: 68 bytes leftover after parsing attributes in process `syz.4.3959'. [ 675.175197][T21349] lo speed is unknown, defaulting to 1000 [ 675.510258][ T2103] block nbd6: Possible stuck request ffff888026340000: control (read@0,1024B). Runtime 90 seconds [ 675.521458][ T2103] block nbd6: Possible stuck request ffff888026340200: control (read@1024,1024B). Runtime 90 seconds [ 675.543978][ T2103] block nbd6: Possible stuck request ffff888026340400: control (read@2048,1024B). Runtime 90 seconds [ 675.558866][ T2103] block nbd6: Possible stuck request ffff888026340600: control (read@3072,1024B). Runtime 90 seconds [ 675.948219][T21395] lo speed is unknown, defaulting to 1000 [ 676.232323][T21404] netlink: 44 bytes leftover after parsing attributes in process `syz.2.3971'. [ 676.318938][T21404] netlink: 43 bytes leftover after parsing attributes in process `syz.2.3971'. [ 676.340952][T21404] netlink: 'syz.2.3971': attribute type 6 has an invalid length. [ 676.401908][T21404] netlink: 'syz.2.3971': attribute type 5 has an invalid length. [ 676.431458][T21410] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3971'. [ 676.462347][T21404] netlink: 43 bytes leftover after parsing attributes in process `syz.2.3971'. [ 676.698012][T21395] lo speed is unknown, defaulting to 1000 [ 676.764379][T21409] lo speed is unknown, defaulting to 1000 [ 676.783389][T21420] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3975'. [ 677.120881][T21425] geneve3: entered promiscuous mode [ 677.142152][T21425] geneve3: entered allmulticast mode [ 677.158889][ T6615] netdevsim netdevsim3 netdevsim0: set [1, 1] type 2 family 0 port 20000 - 0 [ 677.167944][ T6615] netdevsim netdevsim3 netdevsim1: set [1, 1] type 2 family 0 port 20000 - 0 [ 677.179236][ T6615] netdevsim netdevsim3 netdevsim2: set [1, 1] type 2 family 0 port 20000 - 0 [ 677.201219][T10135] netdevsim netdevsim3 netdevsim3: set [1, 1] type 2 family 0 port 20000 - 0 [ 677.332661][T21418] IPVS: length: 132 != 8 [ 677.343529][T21418] pimreg: entered allmulticast mode [ 677.359350][T21418] pimreg: left allmulticast mode [ 677.408666][T21403] lo speed is unknown, defaulting to 1000 [ 677.490117][T21433] FAULT_INJECTION: forcing a failure. [ 677.490117][T21433] name failslab, interval 1, probability 0, space 0, times 0 [ 677.547037][T21433] CPU: 1 UID: 0 PID: 21433 Comm: syz.3.3979 Not tainted syzkaller #0 PREEMPT(full) [ 677.547064][T21433] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 677.547083][T21433] Call Trace: [ 677.547156][T21433] [ 677.547197][T21433] dump_stack_lvl+0xe8/0x150 [ 677.547348][T21433] should_fail_ex+0x412/0x560 [ 677.547466][T21433] should_failslab+0xa8/0x100 [ 677.547515][T21433] ? skb_clone+0x212/0x3a0 [ 677.547626][T21433] kmem_cache_alloc_noprof+0x87/0x650 [ 677.547644][T21433] ? __netlink_lookup+0xc6/0x8b0 [ 677.547719][T21433] skb_clone+0x212/0x3a0 [ 677.547741][T21433] __netlink_deliver_tap+0x404/0x850 [ 677.547777][T21433] ? netlink_deliver_tap+0x2e/0x1b0 [ 677.547802][T21433] netlink_deliver_tap+0x19c/0x1b0 [ 677.547827][T21433] netlink_unicast+0x7e3/0x9b0 [ 677.547858][T21433] ? __pfx_netlink_unicast+0x10/0x10 [ 677.547882][T21433] ? netlink_sendmsg+0x650/0xb40 [ 677.547904][T21433] ? skb_put+0x11b/0x210 [ 677.547963][T21433] netlink_sendmsg+0x813/0xb40 [ 677.547996][T21433] ? __pfx_netlink_sendmsg+0x10/0x10 [ 677.548025][T21433] ? aa_sock_msg_perm+0xf1/0x1b0 [ 677.548100][T21433] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 677.548142][T21433] ____sys_sendmsg+0x972/0x9f0 [ 677.548193][T21433] ? __pfx_____sys_sendmsg+0x10/0x10 [ 677.548220][T21433] ? import_iovec+0x73/0xa0 [ 677.548309][T21433] ___sys_sendmsg+0x2a5/0x360 [ 677.548333][T21433] ? __pfx____sys_sendmsg+0x10/0x10 [ 677.548388][T21433] ? __fget_files+0x2a/0x420 [ 677.548423][T21433] ? __fget_files+0x3a0/0x420 [ 677.548458][T21433] __x64_sys_sendmsg+0x1bd/0x2a0 [ 677.548478][T21433] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 677.548500][T21433] ? __pfx_ksys_write+0x10/0x10 [ 677.548542][T21433] do_syscall_64+0x14d/0xf80 [ 677.548661][T21433] ? trace_irq_disable+0x3b/0x150 [ 677.548699][T21433] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 677.548731][T21433] ? clear_bhb_loop+0x40/0x90 [ 677.548754][T21433] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 677.548776][T21433] RIP: 0033:0x7f04e6d9c799 [ 677.548820][T21433] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 677.548835][T21433] RSP: 002b:00007f04e7bdf028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 677.548881][T21433] RAX: ffffffffffffffda RBX: 00007f04e7015fa0 RCX: 00007f04e6d9c799 [ 677.548894][T21433] RDX: 0000000020000000 RSI: 0000200000000140 RDI: 0000000000000004 [ 677.548905][T21433] RBP: 00007f04e7bdf090 R08: 0000000000000000 R09: 0000000000000000 [ 677.548916][T21433] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 677.548926][T21433] R13: 00007f04e7016038 R14: 00007f04e7015fa0 R15: 00007fffcd667908 [ 677.548972][T21433] [ 677.880398][T21417] lo speed is unknown, defaulting to 1000 [ 677.916449][T21435] FAULT_INJECTION: forcing a failure. [ 677.916449][T21435] name failslab, interval 1, probability 0, space 0, times 0 [ 677.929778][T21435] CPU: 1 UID: 0 PID: 21435 Comm: syz.3.3980 Not tainted syzkaller #0 PREEMPT(full) [ 677.929803][T21435] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 677.929814][T21435] Call Trace: [ 677.929822][T21435] [ 677.929829][T21435] dump_stack_lvl+0xe8/0x150 [ 677.929860][T21435] should_fail_ex+0x412/0x560 [ 677.929888][T21435] should_failslab+0xa8/0x100 [ 677.929913][T21435] __kvmalloc_node_noprof+0x178/0x8a0 [ 677.929932][T21435] ? xt_alloc_table_info+0x40/0xb0 [ 677.930084][T21435] ? do_ip6t_set_ctl+0x90c/0xe10 [ 677.930149][T21435] ? translate_table+0x191/0x20b0 [ 677.930178][T21435] translate_table+0x191/0x20b0 [ 677.930201][T21435] ? __lock_acquire+0x6b5/0x2cf0 [ 677.930258][T21435] ? __pfx_translate_table+0x10/0x10 [ 677.930305][T21435] ? _copy_from_user+0x94/0xb0 [ 677.930370][T21435] do_ip6t_set_ctl+0x9fe/0xe10 [ 677.930396][T21435] ? rcu_is_watching+0x15/0xb0 [ 677.930426][T21435] ? trace_contention_end+0x3d/0x150 [ 677.930462][T21435] ? __pfx_do_ip6t_set_ctl+0x10/0x10 [ 677.930501][T21435] ? __pfx___mutex_lock+0x10/0x10 [ 677.930548][T21435] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 677.930563][T21435] ? __lock_acquire+0x6b5/0x2cf0 [ 677.930586][T21435] ? __pfx___mutex_lock+0x10/0x10 [ 677.930612][T21435] nf_setsockopt+0x26f/0x290 [ 677.930664][T21435] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 677.930685][T21435] smc_setsockopt+0x249/0xac0 [ 677.930778][T21435] ? __pfx_smc_setsockopt+0x10/0x10 [ 677.930795][T21435] ? aa_sock_opt_perm+0xff/0x1a0 [ 677.930816][T21435] ? bpf_lsm_socket_setsockopt+0x9/0x20 [ 677.930833][T21435] ? __pfx_smc_setsockopt+0x10/0x10 [ 677.930853][T21435] do_sock_setsockopt+0x17c/0x1b0 [ 677.930902][T21435] __x64_sys_setsockopt+0x13d/0x1b0 [ 677.930928][T21435] do_syscall_64+0x14d/0xf80 [ 677.930941][T21435] ? trace_irq_disable+0x3b/0x150 [ 677.930960][T21435] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 677.930975][T21435] ? clear_bhb_loop+0x40/0x90 [ 677.930992][T21435] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 677.931006][T21435] RIP: 0033:0x7f04e6d9c799 [ 677.931021][T21435] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 677.931033][T21435] RSP: 002b:00007f04e7bdf028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 677.931056][T21435] RAX: ffffffffffffffda RBX: 00007f04e7015fa0 RCX: 00007f04e6d9c799 [ 677.931066][T21435] RDX: 0000000000000040 RSI: 0000000000000029 RDI: 0000000000000003 [ 677.931075][T21435] RBP: 00007f04e7bdf090 R08: 0000000000000228 R09: 0000000000000000 [ 677.931083][T21435] R10: 0000200000000e00 R11: 0000000000000246 R12: 0000000000000001 [ 677.931092][T21435] R13: 00007f04e7016038 R14: 00007f04e7015fa0 R15: 00007fffcd667908 [ 677.931116][T21435] [ 678.322501][T21417] lo speed is unknown, defaulting to 1000 [ 678.363410][T21403] lo speed is unknown, defaulting to 1000 [ 678.378435][T21409] lo speed is unknown, defaulting to 1000 [ 678.821366][T21454] netdevsim netdevsim3 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 678.846630][T21454] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 678.862266][T21454] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 1] type 2 family 0 port 20000 - 0 [ 679.112108][T21457] syzkaller0: entered promiscuous mode [ 679.142824][T21457] syzkaller0: entered allmulticast mode [ 679.260653][T21454] netdevsim netdevsim3 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 679.274455][T21454] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 679.305649][T21454] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 1] type 2 family 0 port 20000 - 0 [ 679.460394][T21454] netdevsim netdevsim3 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 679.475159][T21454] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 679.501161][T21454] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 1] type 2 family 0 port 20000 - 0 [ 679.567654][T21470] 8021q: adding VLAN 0 to HW filter on device bond0 [ 679.576148][T21470] 8021q: adding VLAN 0 to HW filter on device team0 [ 679.594678][T21470] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 679.655621][T21454] netdevsim netdevsim3 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 679.686365][T21454] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 679.694512][T21483] __nla_validate_parse: 3 callbacks suppressed [ 679.694530][T21483] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3991'. [ 679.717698][T21454] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 1] type 2 family 0 port 20000 - 0 [ 679.740568][T21471] netlink: 136 bytes leftover after parsing attributes in process `syz.0.3988'. [ 679.910738][T17786] netdevsim netdevsim3 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 679.949413][T17786] netdevsim netdevsim3 eth0: set [1, 0] type 2 family 0 port 20000 - 0 [ 679.957715][T17786] netdevsim netdevsim3 eth0: set [1, 1] type 2 family 0 port 6081 - 0 [ 679.972691][T21490] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3992'. [ 679.997806][T10138] netdevsim netdevsim3 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 680.009086][T10138] netdevsim netdevsim3 eth1: set [1, 0] type 2 family 0 port 20000 - 0 [ 680.024802][T10138] netdevsim netdevsim3 eth1: set [1, 1] type 2 family 0 port 6081 - 0 [ 680.069042][T21494] xt_CHECKSUM: unsupported CHECKSUM operation 68 [ 680.090181][T10138] netdevsim netdevsim3 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 680.100058][T10138] netdevsim netdevsim3 eth2: set [1, 0] type 2 family 0 port 20000 - 0 [ 680.108343][T10138] netdevsim netdevsim3 eth2: set [1, 1] type 2 family 0 port 6081 - 0 [ 680.139911][T21499] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3995'. [ 680.154268][T21491] lo speed is unknown, defaulting to 1000 [ 680.173053][T21499] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3995'. [ 680.204720][T17786] netdevsim netdevsim3 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 680.222922][T17786] netdevsim netdevsim3 eth3: set [1, 0] type 2 family 0 port 20000 - 0 [ 680.252974][T17786] netdevsim netdevsim3 eth3: set [1, 1] type 2 family 0 port 6081 - 0 [ 680.381602][T21511] netlink: 20 bytes leftover after parsing attributes in process `syz.4.3998'. [ 680.597814][T21491] lo speed is unknown, defaulting to 1000 [ 680.605034][T21517] siw: device registration error -23 [ 680.611375][T21523] netlink: 'syz.3.4002': attribute type 3 has an invalid length. [ 680.629316][T21523] nbd: nbd3 already in use [ 680.634206][T21523] block nbd3: NBD_DISCONNECT [ 680.668742][T21523] block nbd3: Send disconnect failed -32 [ 680.679035][T21523] block nbd3: shutting down sockets [ 680.730697][T21528] dvmrp0: left allmulticast mode [ 680.784343][T21523] siw: device registration error -23 [ 680.816660][T21533] netlink: 80 bytes leftover after parsing attributes in process `syz.0.4006'. [ 680.856256][T21523] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 680.995186][T10138] bond2 (unregistering): (slave ip6gretap1): Releasing backup interface [ 681.229577][T21556] No such timeout policy "syz0" [ 681.459909][T10138] bond7 (unregistering): (slave gretap2): Releasing active interface [ 681.902428][T10138] .` (unregistering): Released all slaves [ 681.919668][T10138] bond1 (unregistering): Released all slaves [ 681.939626][T10138] bond2 (unregistering): Released all slaves [ 681.960007][T10138] bond3 (unregistering): Released all slaves [ 681.982718][T10138] bond4 (unregistering): Released all slaves [ 682.005122][T10138] bond5 (unregistering): Released all slaves [ 682.026705][T10138] bond6 (unregistering): Released all slaves [ 682.050644][T10138] bond7 (unregistering): Released all slaves [ 682.073686][T10138] bond8 (unregistering): Released all slaves [ 682.102947][T10138] bond0 (unregistering): (slave wireguard0): Releasing backup interface [ 682.111775][T10138] wireguard0: left promiscuous mode [ 682.121167][T10138] bond0 (unregistering): Released all slaves [ 682.143733][T10138] bond9 (unregistering): Released all slaves [ 682.170740][T10138] bond10 (unregistering): Released all slaves [ 682.350865][T21559] bridge0: entered allmulticast mode [ 682.362584][T21559] team0: Port device bridge0 added [ 682.401634][T10138] 9: left promiscuous mode [ 682.602741][T21572] netlink: 124 bytes leftover after parsing attributes in process `syz.3.4016'. [ 682.708396][T10138] : left promiscuous mode [ 682.866100][T10138] tipc: Left network mode [ 682.960275][T21590] bridge0: entered promiscuous mode [ 682.974344][T21590] macsec1: entered allmulticast mode [ 682.993237][T21590] bridge0: entered allmulticast mode [ 683.026688][T10138] IPVS: stopping backup sync thread 10209 ... [ 683.029098][T21592] netlink: 'syz.2.4022': attribute type 1 has an invalid length. [ 683.051072][T21590] bridge0: port 3(macsec1) entered blocking state [ 683.079668][T21590] bridge0: port 3(macsec1) entered disabled state [ 683.102806][T21590] bridge0: left allmulticast mode [ 683.108418][T21590] bridge0: left promiscuous mode [ 683.257616][T21592] 8021q: adding VLAN 0 to HW filter on device bond4 [ 683.267061][T21595] syzkaller0: entered promiscuous mode [ 683.278262][T21595] syzkaller0: entered allmulticast mode [ 683.313096][T21597] bond4: (slave veth5): Enslaving as an active interface with a down link [ 683.335839][T21600] 8021q: adding VLAN 0 to HW filter on device batadv1 [ 683.346211][T21600] bond4: (slave batadv1): dev_set_mac_address on slave failed! ALB mode requires that the base driver support setting the hw address also when the network device's interface is open [ 683.408284][T21608] netlink: 'syz.1.4025': attribute type 3 has an invalid length. [ 683.693684][T21621] netlink: 'syz.2.4030': attribute type 1 has an invalid length. [ 683.761443][T21628] netlink: 24 bytes leftover after parsing attributes in process `syz.4.4031'. [ 683.772078][T21628] netlink: 20 bytes leftover after parsing attributes in process `syz.4.4031'. [ 683.973609][T21621] 8021q: adding VLAN 0 to HW filter on device bond5 [ 684.091344][T21623] lo speed is unknown, defaulting to 1000 [ 684.430979][T21643] syzkaller0: entered promiscuous mode [ 684.440460][T21651] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 684.451572][T21643] syzkaller0: entered allmulticast mode [ 684.572184][T21644] lo speed is unknown, defaulting to 1000 [ 684.736948][T21668] __nla_validate_parse: 1 callbacks suppressed [ 684.736964][T21668] netlink: 168 bytes leftover after parsing attributes in process `syz.4.4041'. [ 684.909158][T21678] netlink: 'syz.4.4045': attribute type 1 has an invalid length. [ 684.909202][T21679] netdevsim netdevsim2 netdevsim0: entered allmulticast mode [ 685.056084][T21688] netlink: 'syz.2.4047': attribute type 1 has an invalid length. [ 685.061302][T21644] lo speed is unknown, defaulting to 1000 [ 685.063978][T21688] netlink: 224 bytes leftover after parsing attributes in process `syz.2.4047'. [ 685.082412][T21690] netlink: 32 bytes leftover after parsing attributes in process `syz.4.4048'. [ 685.163996][T21623] lo speed is unknown, defaulting to 1000 [ 685.184807][T21694] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4048'. [ 685.353778][T10138] hsr_slave_0: left promiscuous mode [ 685.361543][T10138] hsr_slave_1: left promiscuous mode [ 685.375893][T10138] veth1: left allmulticast mode [ 685.752594][ T1299] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 686.081450][T21710] netlink: 24 bytes leftover after parsing attributes in process `syz.0.4052'. [ 686.120555][T21711] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4052'. [ 686.344522][T21714] netlink: 'syz.0.4053': attribute type 1 has an invalid length. [ 686.507956][T21721] netlink: 'syz.2.4055': attribute type 83 has an invalid length. [ 686.853528][T10138] IPVS: stop unused estimator thread 0... [ 687.045231][T21746] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4060'. [ 687.102804][T21739] vxcan7: entered promiscuous mode [ 687.264784][T21755] netlink: 'syz.3.4063': attribute type 1 has an invalid length. [ 687.375474][T21755] 8021q: adding VLAN 0 to HW filter on device bond3 [ 687.504256][T21758] bond3: (slave veth7): Enslaving as an active interface with a down link [ 687.567386][T21755] netlink: 44 bytes leftover after parsing attributes in process `syz.3.4063'. [ 687.697949][T21769] FAULT_INJECTION: forcing a failure. [ 687.697949][T21769] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 687.729467][T21769] CPU: 1 UID: 0 PID: 21769 Comm: syz.2.4068 Not tainted syzkaller #0 PREEMPT(full) [ 687.729493][T21769] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 687.729504][T21769] Call Trace: [ 687.729511][T21769] [ 687.729519][T21769] dump_stack_lvl+0xe8/0x150 [ 687.729547][T21769] should_fail_ex+0x412/0x560 [ 687.729576][T21769] _copy_from_user+0x2d/0xb0 [ 687.729601][T21769] do_sock_getsockopt+0x165/0x3f0 [ 687.729631][T21769] ? __pfx_do_sock_getsockopt+0x10/0x10 [ 687.729657][T21769] ? __fget_files+0x3a0/0x420 [ 687.729680][T21769] ? __fget_files+0x2a/0x420 [ 687.729710][T21769] __x64_sys_getsockopt+0x1a4/0x240 [ 687.729744][T21769] do_syscall_64+0x14d/0xf80 [ 687.729761][T21769] ? trace_irq_disable+0x3b/0x150 [ 687.729786][T21769] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 687.729804][T21769] ? clear_bhb_loop+0x40/0x90 [ 687.729826][T21769] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 687.729843][T21769] RIP: 0033:0x7ffa58d9c799 [ 687.729860][T21769] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 687.729875][T21769] RSP: 002b:00007ffa59cd4028 EFLAGS: 00000246 ORIG_RAX: 0000000000000037 [ 687.729895][T21769] RAX: ffffffffffffffda RBX: 00007ffa59015fa0 RCX: 00007ffa58d9c799 [ 687.729908][T21769] RDX: 0000000000000022 RSI: 0000000000000001 RDI: 0000000000000003 [ 687.729918][T21769] RBP: 00007ffa59cd4090 R08: 0000200000000000 R09: 0000000000000000 [ 687.729929][T21769] R10: 0000200000000180 R11: 0000000000000246 R12: 0000000000000001 [ 687.729940][T21769] R13: 00007ffa59016038 R14: 00007ffa59015fa0 R15: 00007fff05c818d8 [ 687.729970][T21769] [ 688.100657][T21778] netlink: 36 bytes leftover after parsing attributes in process `syz.3.4070'. [ 688.267098][T21788] lo speed is unknown, defaulting to 1000 [ 688.527626][T21797] netlink: 212344 bytes leftover after parsing attributes in process `syz.2.4076'. [ 688.816223][T21788] lo speed is unknown, defaulting to 1000 [ 688.978062][T21814] FAULT_INJECTION: forcing a failure. [ 688.978062][T21814] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 689.013140][T21814] CPU: 1 UID: 0 PID: 21814 Comm: syz.2.4081 Not tainted syzkaller #0 PREEMPT(full) [ 689.013168][T21814] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 689.013179][T21814] Call Trace: [ 689.013186][T21814] [ 689.013194][T21814] dump_stack_lvl+0xe8/0x150 [ 689.013225][T21814] should_fail_ex+0x412/0x560 [ 689.013253][T21814] _copy_from_user+0x2d/0xb0 [ 689.013281][T21814] sk_getsockopt+0x1d4/0x2840 [ 689.013313][T21814] ? __pfx_sk_getsockopt+0x10/0x10 [ 689.013349][T21814] ? aa_sk_perm+0x6d5/0x900 [ 689.013480][T21814] do_sock_getsockopt+0x223/0x3f0 [ 689.013509][T21814] ? __pfx_do_sock_getsockopt+0x10/0x10 [ 689.013532][T21814] ? __fget_files+0x3a0/0x420 [ 689.013553][T21814] ? __fget_files+0x2a/0x420 [ 689.013582][T21814] __x64_sys_getsockopt+0x1a4/0x240 [ 689.013615][T21814] do_syscall_64+0x14d/0xf80 [ 689.013631][T21814] ? trace_irq_disable+0x3b/0x150 [ 689.013653][T21814] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 689.013669][T21814] ? clear_bhb_loop+0x40/0x90 [ 689.013688][T21814] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 689.013703][T21814] RIP: 0033:0x7ffa58d9c799 [ 689.013719][T21814] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 689.013733][T21814] RSP: 002b:00007ffa59cd4028 EFLAGS: 00000246 ORIG_RAX: 0000000000000037 [ 689.013751][T21814] RAX: ffffffffffffffda RBX: 00007ffa59015fa0 RCX: 00007ffa58d9c799 [ 689.013761][T21814] RDX: 0000000000000022 RSI: 0000000000000001 RDI: 0000000000000003 [ 689.013769][T21814] RBP: 00007ffa59cd4090 R08: 0000200000000000 R09: 0000000000000000 [ 689.013777][T21814] R10: 0000200000000180 R11: 0000000000000246 R12: 0000000000000001 [ 689.013785][T21814] R13: 00007ffa59016038 R14: 00007ffa59015fa0 R15: 00007fff05c818d8 [ 689.013807][T21814] [ 689.871113][T21839] syzkaller0: entered promiscuous mode [ 689.942536][T21839] syzkaller0: entered allmulticast mode [ 690.190139][T21856] FAULT_INJECTION: forcing a failure. [ 690.190139][T21856] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 690.204018][T21856] CPU: 1 UID: 0 PID: 21856 Comm: syz.3.4094 Not tainted syzkaller #0 PREEMPT(full) [ 690.204044][T21856] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 690.204054][T21856] Call Trace: [ 690.204061][T21856] [ 690.204069][T21856] dump_stack_lvl+0xe8/0x150 [ 690.204097][T21856] should_fail_ex+0x412/0x560 [ 690.204124][T21856] _copy_to_user+0x31/0xb0 [ 690.204151][T21856] sk_getsockopt+0x1c11/0x2840 [ 690.204183][T21856] ? __pfx_sk_getsockopt+0x10/0x10 [ 690.204242][T21856] ? aa_sk_perm+0x6d5/0x900 [ 690.204286][T21856] do_sock_getsockopt+0x223/0x3f0 [ 690.204315][T21856] ? __pfx_do_sock_getsockopt+0x10/0x10 [ 690.204340][T21856] ? __fget_files+0x3a0/0x420 [ 690.204362][T21856] ? __fget_files+0x2a/0x420 [ 690.204392][T21856] __x64_sys_getsockopt+0x1a4/0x240 [ 690.204426][T21856] do_syscall_64+0x14d/0xf80 [ 690.204442][T21856] ? trace_irq_disable+0x3b/0x150 [ 690.204467][T21856] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 690.204485][T21856] ? clear_bhb_loop+0x40/0x90 [ 690.204507][T21856] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 690.204523][T21856] RIP: 0033:0x7f04e6d9c799 [ 690.204540][T21856] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 690.204555][T21856] RSP: 002b:00007f04e7bdf028 EFLAGS: 00000246 ORIG_RAX: 0000000000000037 [ 690.204574][T21856] RAX: ffffffffffffffda RBX: 00007f04e7015fa0 RCX: 00007f04e6d9c799 [ 690.204587][T21856] RDX: 0000000000000022 RSI: 0000000000000001 RDI: 0000000000000003 [ 690.204598][T21856] RBP: 00007f04e7bdf090 R08: 0000200000000000 R09: 0000000000000000 [ 690.204609][T21856] R10: 0000200000000180 R11: 0000000000000246 R12: 0000000000000001 [ 690.204621][T21856] R13: 00007f04e7016038 R14: 00007f04e7015fa0 R15: 00007fffcd667908 [ 690.204650][T21856] [ 690.501777][T21850] lo speed is unknown, defaulting to 1000 [ 690.903679][T21850] lo speed is unknown, defaulting to 1000 [ 691.111893][T21882] syzkaller0: entered promiscuous mode [ 691.117437][T21882] syzkaller0: entered allmulticast mode [ 691.131032][T21882] syzkaller0: left promiscuous mode [ 691.136285][T21882] syzkaller0: left allmulticast mode [ 691.307844][T21891] lo speed is unknown, defaulting to 1000 [ 691.338209][T21894] __nla_validate_parse: 2 callbacks suppressed [ 691.338229][T21894] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4105'. [ 691.767579][T21907] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 692.111219][T21891] lo speed is unknown, defaulting to 1000 [ 692.189451][T21927] lo speed is unknown, defaulting to 1000 [ 692.712640][T21927] lo speed is unknown, defaulting to 1000 [ 692.871288][T21965] can-isotp: isotp_sendmsg: can_send_ret -ENETDOWN [ 693.703757][T21995] xt_TCPMSS: Only works on TCP SYN packets [ 696.180545][T21980] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 696.193786][T22001] workqueue: name exceeds WQ_NAME_LEN. Truncating to: . ΁ *] [ 696.300471][T22027] netlink: 148 bytes leftover after parsing attributes in process `syz.1.4134'. [ 696.459455][T22035] syzkaller0: entered promiscuous mode [ 696.468791][T22035] syzkaller0: entered allmulticast mode [ 696.493169][T22042] netlink: 1053 bytes leftover after parsing attributes in process `syz.4.4140'. [ 696.605965][T22045] rdma_rxe: rxe_newlink: failed to add wg1 [ 696.735646][T22054] lo speed is unknown, defaulting to 1000 [ 696.845140][T22066] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4145'. [ 696.932695][T22076] netlink: 212368 bytes leftover after parsing attributes in process `syz.2.4148'. [ 696.956491][T22077] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4147'. [ 696.977319][T22076] openvswitch: netlink: Message has 4 unknown bytes. [ 696.991771][T22076] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 697.228103][T22054] lo speed is unknown, defaulting to 1000 [ 697.518965][T22113] netlink: 44 bytes leftover after parsing attributes in process `syz.3.4161'. [ 697.579057][T22115] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 697.597526][T22120] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 697.621166][T22115] tipc: Started in network mode [ 697.626098][T22115] tipc: Node identity 3670e7181dfb, cluster identity 4711 [ 697.633903][T22115] tipc: Enabled bearer , priority 0 [ 697.652003][T22115] syzkaller0: entered promiscuous mode [ 697.680204][T22115] syzkaller0: entered allmulticast mode [ 697.716037][T22125] netlink: 52 bytes leftover after parsing attributes in process `syz.1.4163'. [ 697.720654][T22120] tipc: Resetting bearer [ 697.823545][T22120] tipc: Resetting bearer [ 697.909476][T22120] tipc: Disabling bearer [ 697.926313][T22140] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4166'. [ 697.938023][T22136] tipc: Started in network mode [ 697.943104][T22136] tipc: Node identity , cluster identity 4711 [ 697.978867][T22136] tipc: Failed to obtain node identity [ 697.988704][T22136] tipc: Enabling of bearer rejected, failed to enable media [ 698.064535][T22148] syzkaller0: entered promiscuous mode [ 698.076614][T22148] syzkaller0: entered allmulticast mode [ 698.098243][T22153] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4169'. [ 698.173705][T22147] x_tables: ip_tables: recent.0 match: invalid size 216 (kernel) != (user) 4096 [ 698.231693][T22163] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4172'. [ 698.270098][T22164] netlink: 'syz.1.4170': attribute type 21 has an invalid length. [ 699.873796][T22153] tipc: Enabling of bearer rejected, failed to enable media [ 699.893372][T22164] netlink: 132 bytes leftover after parsing attributes in process `syz.1.4170'. [ 699.913152][T22164] netlink: 'syz.1.4170': attribute type 1 has an invalid length. [ 699.974828][T22173] netlink: 'syz.0.4174': attribute type 1 has an invalid length. [ 699.983570][T22173] netlink: 'syz.0.4174': attribute type 1 has an invalid length. [ 699.992556][T22173] netlink: 'syz.0.4174': attribute type 8 has an invalid length. [ 700.019980][T22179] smc: net device wlan0 applied user defined pnetid SYZ0 [ 700.046183][T22175] lo speed is unknown, defaulting to 1000 [ 700.338403][T22188] xt_CT: No such helper "pptp" [ 700.480557][T22188] xt_CT: No such helper "pptp" [ 700.581353][T22188] xt_CT: No such helper "pptp" [ 700.674095][T22188] xt_CT: No such helper "pptp" [ 700.758754][T22188] xt_CT: No such helper "pptp" [ 700.827582][T22188] xt_CT: No such helper "pptp" [ 700.829504][T22220] ip6t_srh: unknown srh invflags BA61 [ 700.858842][T22175] lo speed is unknown, defaulting to 1000 [ 700.930411][T22188] xt_CT: No such helper "pptp" [ 701.016506][T22188] xt_CT: No such helper "pptp" [ 701.040527][T22188] xt_CT: No such helper "pptp" [ 701.615804][T22259] __nla_validate_parse: 8 callbacks suppressed [ 701.615826][T22259] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4195'. [ 701.787052][T22278] netlink: 24 bytes leftover after parsing attributes in process `syz.0.4200'. [ 702.079603][T22297] netlink: 20 bytes leftover after parsing attributes in process `syz.0.4205'. [ 702.138351][T22302] veth0_to_bond: entered promiscuous mode [ 702.150167][T22302] veth0_to_bond: entered allmulticast mode [ 702.156841][T22302] A link change request failed with some changes committed already. Interface veth0_to_bond may have been left with an inconsistent configuration, please check. [ 702.182515][T22306] netlink: 40 bytes leftover after parsing attributes in process `syz.0.4205'. [ 702.882627][T22339] netlink: 36 bytes leftover after parsing attributes in process `syz.1.4219'. [ 702.903941][T22328] lo speed is unknown, defaulting to 1000 [ 703.535861][T22358] netlink: 'syz.0.4223': attribute type 1 has an invalid length. [ 704.998695][T22328] lo speed is unknown, defaulting to 1000 [ 705.022106][T22358] workqueue: Failed to create a rescuer kthread for wq "bond3": -EINTR [ 705.081270][T22369] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4225'. [ 705.116935][T22366] macvtap0: entered promiscuous mode [ 705.153967][T22369] macvtap0 (unregistering): left promiscuous mode [ 705.238085][T22370] lo speed is unknown, defaulting to 1000 [ 705.408690][T22384] tipc: Enabling of bearer rejected, failed to enable media [ 705.520972][T22370] lo speed is unknown, defaulting to 1000 [ 705.590536][ T2103] block nbd6: Possible stuck request ffff888026340000: control (read@0,1024B). Runtime 120 seconds [ 705.601702][ T2103] block nbd6: Possible stuck request ffff888026340200: control (read@1024,1024B). Runtime 120 seconds [ 705.612779][ T2103] block nbd6: Possible stuck request ffff888026340400: control (read@2048,1024B). Runtime 120 seconds [ 705.624027][ T2103] block nbd6: Possible stuck request ffff888026340600: control (read@3072,1024B). Runtime 120 seconds [ 705.888716][T22403] x_tables: ip_tables: icmp match: only valid for protocol 1 [ 706.095767][T22409] Bluetooth: hci0: Opcode 0x0401 failed: -22 [ 706.126100][T22412] unsupported nla_type 142 [ 706.143238][T22412] GUP no longer grows the stack in syz.1.4239 (22412): 200000003000-20000000a000 (200000001000) [ 706.181648][T22412] CPU: 1 UID: 0 PID: 22412 Comm: syz.1.4239 Not tainted syzkaller #0 PREEMPT(full) [ 706.181678][T22412] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 706.181690][T22412] Call Trace: [ 706.181698][T22412] [ 706.181707][T22412] dump_stack_lvl+0xe8/0x150 [ 706.181741][T22412] __get_user_pages+0x2453/0x29d0 [ 706.181813][T22412] ? __lock_acquire+0x6b5/0x2cf0 [ 706.181859][T22412] ? __gup_longterm_locked+0xc4e/0x1630 [ 706.181889][T22412] ? down_read_killable+0x1bb/0x340 [ 706.181919][T22412] __gup_longterm_locked+0xdcf/0x1630 [ 706.181976][T22412] gup_fast_fallback+0x1d82/0x22e0 [ 706.182040][T22412] ? __pfx_gup_fast_fallback+0x10/0x10 [ 706.182073][T22412] ? is_valid_gup_args+0x11f/0x200 [ 706.182112][T22412] ? get_user_pages_fast+0x4d/0xb0 [ 706.182145][T22412] __iov_iter_get_pages_alloc+0x3b6/0xb10 [ 706.182185][T22412] ? __pfx_pipe_clear_nowait+0x10/0x10 [ 706.182210][T22412] iov_iter_get_pages2+0x5e/0xa0 [ 706.182244][T22412] __se_sys_vmsplice+0x7b3/0x1490 [ 706.182296][T22412] ? __pfx___se_sys_vmsplice+0x10/0x10 [ 706.182331][T22412] ? __pfx_futex_wake+0x10/0x10 [ 706.182378][T22412] ? lockdep_hardirqs_on+0x7a/0x110 [ 706.182468][T22412] do_syscall_64+0x14d/0xf80 [ 706.182487][T22412] ? trace_irq_disable+0x3b/0x150 [ 706.182516][T22412] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 706.182536][T22412] ? clear_bhb_loop+0x40/0x90 [ 706.182561][T22412] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 706.182580][T22412] RIP: 0033:0x7f16ca39c799 [ 706.182601][T22412] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 706.182618][T22412] RSP: 002b:00007f16cb227028 EFLAGS: 00000246 ORIG_RAX: 0000000000000116 [ 706.182640][T22412] RAX: ffffffffffffffda RBX: 00007f16ca615fa0 RCX: 00007f16ca39c799 [ 706.182655][T22412] RDX: 0000000000000001 RSI: 00002000000000c0 RDI: 0000000000000009 [ 706.182668][T22412] RBP: 00007f16ca432bd9 R08: 0000000000000000 R09: 0000000000000000 [ 706.182681][T22412] R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000000 [ 706.182692][T22412] R13: 00007f16ca616038 R14: 00007f16ca615fa0 R15: 00007ffcd8387478 [ 706.182724][T22412] [ 706.608033][T22414] netlink: 'syz.1.4240': attribute type 1 has an invalid length. [ 706.824220][T22426] lo speed is unknown, defaulting to 1000 [ 706.895640][T22436] netlink: 16 bytes leftover after parsing attributes in process `syz.2.4245'. [ 706.937053][T22436] xt_connbytes: Forcing CT accounting to be enabled [ 707.251002][T22426] lo speed is unknown, defaulting to 1000 [ 707.257121][T22450] netlink: 148 bytes leftover after parsing attributes in process `syz.1.4250'. [ 707.269469][T22450] netlink: 116 bytes leftover after parsing attributes in process `syz.1.4250'. [ 707.283205][T22450] netlink: 24 bytes leftover after parsing attributes in process `syz.1.4250'. [ 707.613573][T22467] team_slave_0: entered promiscuous mode [ 707.639893][T22467] team_slave_0: entered allmulticast mode [ 707.784329][T22479] netlink: 'syz.3.4259': attribute type 12 has an invalid length. [ 707.845175][T22483] x_tables: ip_tables: recent.0 match: invalid size 216 (kernel) != (user) 4096 [ 707.917105][T22488] openvswitch: netlink: ERSPAN option length err (len 256, max 255). [ 707.930840][T22488] openvswitch: netlink: ERSPAN option length err (len 256, max 255). [ 708.283537][T22499] lo speed is unknown, defaulting to 1000 [ 708.607213][T22520] lo speed is unknown, defaulting to 1000 [ 708.695076][T22499] lo speed is unknown, defaulting to 1000 [ 709.015977][T22520] lo speed is unknown, defaulting to 1000 [ 709.113616][T22549] x_tables: ip6_tables: mh match: only valid for protocol 135 [ 709.460365][T22562] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4277'. [ 709.640245][T22571] syzkaller0: entered promiscuous mode [ 709.645778][T22571] syzkaller0: entered allmulticast mode [ 709.859072][T22580] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4284'. [ 709.937716][T22587] netlink: 'syz.4.4287': attribute type 9 has an invalid length. [ 709.945947][T22587] netlink: 212368 bytes leftover after parsing attributes in process `syz.4.4287'. [ 709.960193][T22587] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4287'. [ 709.988904][T22580] ip6gretap2: entered promiscuous mode [ 709.994415][T22580] ip6gretap2: entered allmulticast mode [ 710.040826][T22595] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4289'. [ 710.050237][T22596] netlink: 'syz.4.4290': attribute type 13 has an invalid length. [ 710.074448][T22594] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4288'. [ 710.131873][T22601] x_tables: ip6_tables: rpfilter match: used from hooks OUTPUT, but only valid from PREROUTING [ 710.328842][T22614] xt_TCPMSS: Only works on TCP SYN packets [ 710.437075][T22623] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 710.458994][ T798] lo speed is unknown, defaulting to 1000 [ 710.466405][ T798] syz2: Port: 1 Link DOWN [ 710.627758][T22635] tipc: Enabled bearer , priority 0 [ 710.632635][T22636] netlink: 'syz.2.4300': attribute type 10 has an invalid length. [ 710.665498][T22636] team0: Device veth1_macvtap failed to register rx_handler [ 710.681330][T22635] syzkaller0: entered promiscuous mode [ 710.687765][T22635] syzkaller0: entered allmulticast mode [ 710.715675][T22635] tipc: Resetting bearer [ 710.779486][T22645] A link change request failed with some changes committed already. Interface bridge_slave_1 may have been left with an inconsistent configuration, please check. [ 711.062628][T22661] xt_CT: No such helper "pptp" [ 711.083460][T22667] netlink: del zone limit has 4 unknown bytes [ 711.453657][T22634] tipc: Resetting bearer [ 711.492621][T22634] tipc: Disabling bearer [ 711.660803][T22708] netlink: 'syz.0.4325': attribute type 1 has an invalid length. [ 711.679897][T22708] netlink: 'syz.0.4325': attribute type 10 has an invalid length. [ 711.969054][T22733] __nla_validate_parse: 4 callbacks suppressed [ 711.969073][T22733] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4330'. [ 712.260519][T22744] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 712.322049][T22738] lo speed is unknown, defaulting to 1000 [ 712.695629][T22738] lo speed is unknown, defaulting to 1000 [ 712.914110][T22772] rdma_rxe: rxe_newlink: failed to add lo [ 713.187989][T22796] netlink: 24 bytes leftover after parsing attributes in process `syz.4.4343'. [ 713.281105][T22789] lo speed is unknown, defaulting to 1000 [ 713.640877][T22827] netlink: 40 bytes leftover after parsing attributes in process `syz.1.4350'. [ 713.746103][T22832] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4352'. [ 713.762817][T22832] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 713.827447][T22789] lo speed is unknown, defaulting to 1000 [ 714.279795][T22844] netlink: 'syz.2.4356': attribute type 2 has an invalid length. [ 714.554260][T22852] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4360'. [ 714.590406][T22854] netlink: 'syz.2.4359': attribute type 2 has an invalid length. [ 714.598358][T22854] netlink: 'syz.2.4359': attribute type 1 has an invalid length. [ 714.606830][T22854] netlink: 224 bytes leftover after parsing attributes in process `syz.2.4359'. [ 714.818922][T22865] netlink: 'syz.3.4364': attribute type 1 has an invalid length. [ 714.836111][T22865] netlink: 236 bytes leftover after parsing attributes in process `syz.3.4364'. [ 714.875872][T22870] syzkaller1: entered promiscuous mode [ 714.883814][T22870] syzkaller1: entered allmulticast mode [ 714.982118][T22865] lo speed is unknown, defaulting to 1000 [ 715.168157][T22888] pim6reg99999999: entered allmulticast mode [ 715.264848][T22892] tipc: Started in network mode [ 715.270286][T22892] tipc: Node identity 12c3f0751d82, cluster identity 4711 [ 715.281261][T22892] tipc: Enabled bearer , priority 0 [ 715.309797][T22891] tipc: Disabling bearer [ 715.488211][T22865] lo speed is unknown, defaulting to 1000 [ 715.725836][T22906] bridge0: port 2(bridge_slave_1) entered disabled state [ 715.733542][T22906] bridge0: port 1(bridge_slave_0) entered disabled state [ 715.743284][T22906] bridge0: entered allmulticast mode [ 716.054556][T22919] syzkaller1: entered promiscuous mode [ 716.069476][T22919] syzkaller1: entered allmulticast mode [ 716.585912][T22936] Bluetooth: hci0: Opcode 0x0401 failed: -22 [ 716.638566][T22939] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4385'. [ 716.647757][T22939] openvswitch: netlink: Flow actions attr not present in new flow. [ 716.788183][T22944] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4387'. [ 717.029382][T22958] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4394'. [ 717.113908][T22959] xt_CHECKSUM: unsupported CHECKSUM operation 68 [ 717.129501][T22969] netlink: 7 bytes leftover after parsing attributes in process `syz.3.4396'. [ 717.138442][T22966] lo speed is unknown, defaulting to 1000 [ 717.212746][T22973] netlink: 44 bytes leftover after parsing attributes in process `syz.0.4393'. [ 717.233458][T22969] netlink: 7 bytes leftover after parsing attributes in process `syz.3.4396'. [ 717.417494][T22981] netlink: 36 bytes leftover after parsing attributes in process `syz.3.4399'. [ 717.543878][T22988] netlink: 20 bytes leftover after parsing attributes in process `syz.4.4400'. [ 717.588116][T22990] team0: Device lo is loopback device. Loopback devices can't be added as a team port [ 717.599279][T22990] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 717.641644][T22990] bond5: up delay (1024) is not a multiple of miimon (100), value rounded to 1000 ms [ 717.668976][T22992] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4402'. [ 717.676444][T22990] bond5: down delay (4) is not a multiple of miimon (100), value rounded to 0 ms [ 717.719377][T22990] bond5: entered promiscuous mode [ 717.724750][T22990] 8021q: adding VLAN 0 to HW filter on device bond5 [ 717.740543][T22966] lo speed is unknown, defaulting to 1000 [ 718.171357][T23015] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4409'. [ 718.284627][T23015] bridge_slave_1 (unregistering): left allmulticast mode [ 718.309034][T23015] bridge_slave_1 (unregistering): left promiscuous mode [ 718.326884][T23015] bridge0: port 2(bridge_slave_1) entered disabled state [ 718.327737][T23020] netlink: 'syz.0.4412': attribute type 1 has an invalid length. [ 718.389628][T23020] sctp: [Deprecated]: syz.0.4412 (pid 23020) Use of struct sctp_assoc_value in delayed_ack socket option. [ 718.389628][T23020] Use struct sctp_sack_info instead [ 718.656846][T23037] netlink: 20 bytes leftover after parsing attributes in process `syz.0.4415'. [ 718.675114][T23035] netlink: 56 bytes leftover after parsing attributes in process `syz.3.4413'. [ 718.685013][T23037] netlink: 'syz.0.4415': attribute type 18 has an invalid length. [ 718.712892][T10138] netdevsim netdevsim0 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 718.724376][T10138] netdevsim netdevsim0 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 718.733355][T23037] netlink: 'syz.0.4415': attribute type 18 has an invalid length. [ 718.745063][T10138] netdevsim netdevsim0 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 718.786045][T10138] netdevsim netdevsim0 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 719.213939][T23059] sch_tbf: burst 32855 is lower than device lo mtu (65550) ! [ 719.881017][T23067] net veth1_virt_wifi virt_wifi0: left promiscuous mode [ 719.923634][T18946] netdevsim netdevsim3 eth0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 719.946264][T18946] netdevsim netdevsim3 eth0: unset [1, 0] type 2 family 0 port 20000 - 0 [ 719.981233][T18946] netdevsim netdevsim3 eth0: unset [1, 1] type 2 family 0 port 6081 - 0 [ 720.000450][T18946] netdevsim netdevsim3 eth1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 720.027573][T18946] netdevsim netdevsim3 eth1: unset [1, 0] type 2 family 0 port 20000 - 0 [ 720.049808][T18946] netdevsim netdevsim3 eth1: unset [1, 1] type 2 family 0 port 6081 - 0 [ 720.062767][T18946] netdevsim netdevsim3 eth2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 720.072696][T18946] netdevsim netdevsim3 eth2: unset [1, 0] type 2 family 0 port 20000 - 0 [ 720.084568][T18946] netdevsim netdevsim3 eth2: unset [1, 1] type 2 family 0 port 6081 - 0 [ 720.131422][T18946] netdevsim netdevsim3 eth3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 720.155775][T18946] netdevsim netdevsim3 eth3: unset [1, 0] type 2 family 0 port 20000 - 0 [ 720.180490][T18946] netdevsim netdevsim3 eth3: unset [1, 1] type 2 family 0 port 6081 - 0 [ 720.221335][T23089] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 720.237852][T23085] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 720.246796][T23085] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 720.254931][T23085] batman_adv: batadv0: Removing interface: [ 720.476733][T23103] veth0_to_bridge: entered promiscuous mode [ 720.510937][ T29] audit: type=1800 audit(1772920118.281:7): pid=23106 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.4435" name="memory.events" dev="tmpfs" ino=1650 res=0 errno=0 [ 720.632505][T23102] veth0_to_bridge: left promiscuous mode [ 720.746517][T23123] tipc: Enabling of bearer rejected, failed to enable media [ 721.106637][T23138] tipc: Enabled bearer , priority 0 [ 721.114565][T23138] syzkaller0: entered promiscuous mode [ 721.121016][T23138] syzkaller0: entered allmulticast mode [ 721.145069][T23138] tipc: Resetting bearer [ 721.152647][T23137] tipc: Resetting bearer [ 721.169383][T23137] tipc: Disabling bearer [ 721.366695][T23151] netlink: 'syz.0.4444': attribute type 4 has an invalid length. [ 721.440540][T23158] netlink: 'syz.0.4447': attribute type 1 has an invalid length. [ 721.469536][T23158] NCSI netlink: No device for ifindex 0 [ 721.593432][T23167] lo speed is unknown, defaulting to 1000 [ 721.950589][T23167] lo speed is unknown, defaulting to 1000 [ 722.150492][T23188] lo speed is unknown, defaulting to 1000 [ 722.273156][T23196] RDS: rds_bind could not find a transport for ::ffff:100.1.1.1, load rds_tcp or rds_rdma? [ 722.333491][T23203] __nla_validate_parse: 14 callbacks suppressed [ 722.333573][T23203] netlink: 34 bytes leftover after parsing attributes in process `syz.0.4459'. [ 722.354852][T23204] netlink: 34 bytes leftover after parsing attributes in process `syz.0.4459'. [ 722.553112][T23188] lo speed is unknown, defaulting to 1000 [ 722.568949][T23203] lo speed is unknown, defaulting to 1000 [ 722.900846][T23227] netlink: 40 bytes leftover after parsing attributes in process `syz.2.4462'. [ 722.969765][T23239] x_tables: duplicate underflow at hook 3 [ 723.282132][T23231] lo speed is unknown, defaulting to 1000 [ 723.349540][T23203] lo speed is unknown, defaulting to 1000 [ 723.540976][T23271] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4471'. [ 723.550967][T23271] netlink: 24 bytes leftover after parsing attributes in process `syz.1.4471'. [ 723.899670][T23231] lo speed is unknown, defaulting to 1000 [ 724.082622][T23282] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4475'. [ 724.117956][T23285] batadv0: entered promiscuous mode [ 724.135505][T23285] batadv_slave_0: entered promiscuous mode [ 724.150927][T23285] debugfs: 'hsr1' already exists in 'hsr' [ 724.185971][T23285] Cannot create hsr debugfs directory [ 724.196152][T23285] hsr1: Slave A (batadv0) is not up; please bring it up to get a fully working HSR network [ 724.208918][T23285] hsr1: Slave B (batadv_slave_0) is not up; please bring it up to get a fully working HSR network [ 724.220035][T23285] hsr1: entered promiscuous mode [ 724.384731][T23295] sch_tbf: burst 0 is lower than device veth1_virt_wifi mtu (1514) ! [ 724.645407][T23301] bond6: (slave lo): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 724.688257][T23301] bond6: (slave lo): Enslaving as an active interface with an up link [ 724.714824][T23301] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 724.817651][T23312] lo speed is unknown, defaulting to 1000 [ 725.036954][T23312] lo speed is unknown, defaulting to 1000 [ 725.037060][T23299] lo speed is unknown, defaulting to 1000 [ 725.267462][T23326] nbd: illegal input index 16777216 [ 725.273894][T23326] nbd: couldn't find device at index 0 [ 725.382554][T23299] lo speed is unknown, defaulting to 1000 [ 726.008891][T23345] netlink: 28 bytes leftover after parsing attributes in process `syz.0.4493'. [ 726.026450][T23348] netlink: 28 bytes leftover after parsing attributes in process `syz.0.4493'. [ 726.085531][T23350] netlink: 'syz.3.4494': attribute type 10 has an invalid length. [ 726.096690][T23350] syz_tun: entered promiscuous mode [ 726.110670][T23350] bond0: (slave syz_tun): Enslaving as an active interface with an up link [ 726.361812][T23366] netlink: 'syz.0.4498': attribute type 11 has an invalid length. [ 726.410674][T23366] netlink: 'syz.0.4498': attribute type 23 has an invalid length. [ 726.456509][T23366] netlink: 224 bytes leftover after parsing attributes in process `syz.0.4498'. [ 726.489925][T23372] 8021q: VLANs not supported on ip6_vti0 [ 726.513457][T23372] netlink: 'syz.1.4500': attribute type 2 has an invalid length. [ 726.535951][T23372] l24): entered promiscuous mode [ 726.671953][T17130] IPVS: starting estimator thread 0... [ 726.680724][T23387] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4505'. [ 726.758916][T23388] IPVS: using max 31 ests per chain, 74400 per kthread [ 726.899229][T23400] netlink: 'syz.2.4508': attribute type 1 has an invalid length. [ 727.687754][T23402] syzkaller1: entered promiscuous mode [ 727.693425][T23402] syzkaller1: entered allmulticast mode [ 727.702428][T23400] workqueue: Failed to create a rescuer kthread for wq "bond6": -EINTR [ 727.809934][T23369] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000006: 0000 [#1] SMP KASAN PTI [ 727.822042][T23369] KASAN: null-ptr-deref in range [0x0000000000000030-0x0000000000000037] [ 727.830743][T23369] CPU: 0 UID: 0 PID: 23369 Comm: syz.0.4498 Not tainted syzkaller #0 PREEMPT(full) [ 727.840125][T23369] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 727.850191][T23369] RIP: 0010:rose_transmit_link+0x32/0xac0 [ 727.856075][T23369] Code: 56 41 55 41 54 53 48 83 ec 40 48 89 f3 48 89 fd 49 bc 00 00 00 00 00 fc ff df e8 a9 44 2f f7 4c 8d 73 36 4c 89 f0 48 c1 e8 03 <42> 0f b6 04 20 84 c0 0f 85 13 09 00 00 45 0f b6 36 31 ff 44 89 f6 [ 727.875696][T23369] RSP: 0018:ffffc9000cbff8e8 EFLAGS: 00010207 [ 727.881785][T23369] RAX: 0000000000000006 RBX: 0000000000000000 RCX: 0000000000080000 [ 727.889764][T23369] RDX: ffffc9000e197000 RSI: 00000000000002fc RDI: 00000000000002fd [ 727.897736][T23369] RBP: ffff88805fa4f3c0 R08: ffff888032545b80 R09: 0000000000000008 [ 727.905711][T23369] R10: 000000000000000f R11: 0000000000000002 R12: dffffc0000000000 [ 727.913687][T23369] R13: dffffc0000000000 R14: 0000000000000036 R15: 1ffff9200197ff3c [ 727.921663][T23369] FS: 00007f3f2da676c0(0000) GS:ffff888125465000(0000) knlGS:0000000000000000 [ 727.930590][T23369] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 727.937166][T23369] CR2: 00007ffd7b1b6e40 CR3: 000000007c15c000 CR4: 00000000003526f0 [ 727.945135][T23369] Call Trace: [ 727.948408][T23369] [ 727.951352][T23369] ? __alloc_skb+0x4e5/0x7d0 [ 727.955942][T23369] ? skb_put+0x11b/0x210 [ 727.960182][T23369] rose_write_internal+0x1256/0x1b60 [ 727.965470][T23369] ? lockdep_hardirqs_on+0x7a/0x110 [ 727.970676][T23369] ? __pfx_rose_write_internal+0x10/0x10 [ 727.976313][T23369] ? timer_delete+0x245/0x340 [ 727.980987][T23369] rose_release+0x25b/0x510 [ 727.985494][T23369] sock_close+0xc3/0x240 [ 727.989732][T23369] ? __pfx_sock_close+0x10/0x10 [ 727.994596][T23369] __fput+0x44f/0xa70 [ 727.998610][T23369] task_work_run+0x1d9/0x270 [ 728.003210][T23369] ? __pfx_task_work_run+0x10/0x10 [ 728.008315][T23369] ? task_work_add+0x395/0x440 [ 728.013072][T23369] ? __pfx_task_work_add+0x10/0x10 [ 728.018175][T23369] get_signal+0x11eb/0x1330 [ 728.022679][T23369] arch_do_signal_or_restart+0xbc/0x830 [ 728.028258][T23369] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 728.034415][T23369] exit_to_user_mode_loop+0x86/0x480 [ 728.039704][T23369] ? rcu_is_watching+0x15/0xb0 [ 728.044485][T23369] do_syscall_64+0x32d/0xf80 [ 728.049087][T23369] ? trace_irq_disable+0x3b/0x150 [ 728.054141][T23369] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 728.060204][T23369] ? clear_bhb_loop+0x40/0x90 [ 728.064878][T23369] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 728.070777][T23369] RIP: 0033:0x7f3f2cb9c799 [ 728.075197][T23369] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 728.094886][T23369] RSP: 002b:00007f3f2da67028 EFLAGS: 00000246 ORIG_RAX: 000000000000002a [ 728.103300][T23369] RAX: 0000000000000000 RBX: 00007f3f2ce16090 RCX: 00007f3f2cb9c799 [ 728.111350][T23369] RDX: 000000000000001c RSI: 0000200000000240 RDI: 000000000000000d [ 728.119313][T23369] RBP: 00007f3f2cc32bd9 R08: 0000000000000000 R09: 0000000000000000 [ 728.127302][T23369] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 728.135361][T23369] R13: 00007f3f2ce16128 R14: 00007f3f2ce16090 R15: 00007ffe1aaba658 [ 728.143336][T23369] [ 728.146364][T23369] Modules linked in: [ 728.151673][T23369] ---[ end trace 0000000000000000 ]--- [ 728.162871][T23369] RIP: 0010:rose_transmit_link+0x32/0xac0 [ 728.168807][T23369] Code: 56 41 55 41 54 53 48 83 ec 40 48 89 f3 48 89 fd 49 bc 00 00 00 00 00 fc ff df e8 a9 44 2f f7 4c 8d 73 36 4c 89 f0 48 c1 e8 03 <42> 0f b6 04 20 84 c0 0f 85 13 09 00 00 45 0f b6 36 31 ff 44 89 f6 [ 728.189064][T23369] RSP: 0018:ffffc9000cbff8e8 EFLAGS: 00010207 [ 728.195249][T23369] RAX: 0000000000000006 RBX: 0000000000000000 RCX: 0000000000080000 [ 728.203364][T23369] RDX: ffffc9000e197000 RSI: 00000000000002fc RDI: 00000000000002fd [ 728.211692][T23369] RBP: ffff88805fa4f3c0 R08: ffff888032545b80 R09: 0000000000000008 [ 728.222791][T23369] R10: 000000000000000f R11: 0000000000000002 R12: dffffc0000000000 [ 728.234098][T23369] R13: dffffc0000000000 R14: 0000000000000036 R15: 1ffff9200197ff3c [ 728.242451][T23369] FS: 00007f3f2da676c0(0000) GS:ffff888125465000(0000) knlGS:0000000000000000 [ 728.253274][T23369] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 728.259969][T23369] CR2: 00007f04e6fe82f8 CR3: 000000007c15c000 CR4: 00000000003526f0 [ 728.268060][T23369] Kernel panic - not syncing: Fatal exception [ 728.274444][T23369] Kernel Offset: disabled [ 728.278757][T23369] Rebooting in 86400 seconds..