last executing test programs: 1m1.349056444s ago: executing program 4 (id=2482): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=@ipv6_delroute={0x24, 0x19, 0x1, 0x70bd28, 0x0, {0xa, 0x0, 0x0, 0x0, 0xff, 0x3, 0xff, 0xa}, [@RTA_PRIORITY={0x8, 0x6, 0xffffffff}]}, 0x24}}, 0x4000050) r1 = socket(0x1, 0x803, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=ANY=[@ANYBLOB="1c0000001500010300000000000000000c00000008000100", @ANYRES32=r1], 0x1c}, 0x1, 0x0, 0x0, 0xc001}, 0x4000000) ioctl$sock_inet_SIOCSARP(r1, 0x8955, &(0x7f0000000040)={{0x2, 0x4e21, @empty}, {0x1, @remote}, 0x18, {0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x15}}, 'macvlan1\x00'}) 1m1.090324775s ago: executing program 4 (id=2487): r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) getsockopt$inet6_tcp_buf(r0, 0x6, 0xd, 0x0, &(0x7f0000000000)) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=@base={0x12, 0x5, 0x4, 0x2, 0x0, 0x1, 0x1, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0xffffffff}, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000180)={{r2, 0xffffffffffffffff}, &(0x7f0000000040), &(0x7f0000000140)=r1}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000002c0)={{r3}, &(0x7f0000000240), &(0x7f0000000280)=r1}, 0x20) ioctl$sock_inet_SIOCSIFBRDADDR(r0, 0x891a, &(0x7f0000000040)={'veth1_to_batadv\x00', {0x2, 0x4e22, @initdev={0xac, 0x1e, 0x0, 0x0}}}) 1m0.891892298s ago: executing program 4 (id=2492): r0 = socket$tipc(0x1e, 0x2, 0x0) bind$tipc(r0, &(0x7f0000000000)=@id={0x1e, 0x3, 0x1, {0x4e22, 0x4}}, 0x10) 1m0.717626787s ago: executing program 4 (id=2495): r0 = socket(0x1e, 0x4, 0x0) setsockopt$TIPC_DEST_DROPPABLE(r0, 0x10f, 0x8a, 0x0, 0x0) 1m0.445656802s ago: executing program 4 (id=2498): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x6, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="180200000000000000000000000003001800000004000000000000000800000095"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x9}, 0x50) 1m0.161995736s ago: executing program 4 (id=2502): ioctl$sock_SIOCGIFCONF(0xffffffffffffffff, 0x8912, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCETHTOOL(r0, 0x8946, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff) socket(0x10, 0x3, 0x0) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r2 = openat$cgroup_procs(r1, &(0x7f00000002c0)='tasks\x00', 0x2, 0x0) write$cgroup_pid(r2, &(0x7f0000000300), 0x12) 44.961081626s ago: executing program 32 (id=2502): ioctl$sock_SIOCGIFCONF(0xffffffffffffffff, 0x8912, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCETHTOOL(r0, 0x8946, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff) socket(0x10, 0x3, 0x0) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r2 = openat$cgroup_procs(r1, &(0x7f00000002c0)='tasks\x00', 0x2, 0x0) write$cgroup_pid(r2, &(0x7f0000000300), 0x12) 12.317799508s ago: executing program 0 (id=2884): r0 = epoll_create(0xfff) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x48241, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000540)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) (async) r2 = socket$kcm(0x2, 0xa, 0x2) r3 = bpf$PROG_LOAD_XDP(0x5, &(0x7f00000006c0)={0x6, 0x3, &(0x7f0000000140)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x8}, 0x94) r4 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f00000004c0)={'syzkaller1\x00', 0x0}) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) (async) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000200)={r3, r5, 0x25, 0x4, @void}, 0x10) (async) r6 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r6, 0x107, 0x12, &(0x7f0000000040)={0x0, 0x6}, 0x4) setsockopt$packet_fanout_data(r6, 0x107, 0x16, &(0x7f0000000100)={0x2, &(0x7f0000000180)=[{0x6c}, {0x6}]}, 0x10) (async) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) (async) write$tun(r1, &(0x7f0000000780)={@val={0x70}, @void, @eth={@broadcast, @remote, @val={@val={0x88a8, 0x2, 0x1}, {0x8100, 0x5, 0x0, 0x4}}, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x2c, 0x0, 0x0, 0x0, 0x2f, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @multicast1}, {0x0, 0x6558, 0x18, 0x0, @wg=@data={0x4, 0x0, 0xffffdd86}}}}}}}, 0x46) (async) r7 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) connect$bt_l2cap(r7, &(0x7f00000000c0)={0x1f, 0x82, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x5}, 0x0, 0x3}, 0xe) (async) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) (async) r9 = bpf$MAP_CREATE(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="120000001b0000000400000002"], 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000080)={{r9}, &(0x7f0000000040), &(0x7f0000000140)=r8}, 0x20) (async) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r8, &(0x7f0000000400)={0x30000000}) 11.91674496s ago: executing program 0 (id=2888): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) r2 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) bind$bt_l2cap(r2, &(0x7f0000000000)={0x1f, 0x20, @any, 0x0, 0x4f8c9067c96d99f4}, 0xe) (async) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x2c, r1, 0x5, 0x0, 0x25dfdbff, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x4}, @NL80211_ATTR_4ADDR={0x5, 0x53, 0x1}]}, 0x2c}, 0x1, 0x0, 0x0, 0x80}, 0x0) 11.655619281s ago: executing program 0 (id=2889): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="170000000000000004000000ff"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="85000000000014007910480000000000790048000000000095000000"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0x53, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x21) (async) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b704000000000000850000005700000095"], 0x0}, 0x90) (async) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000007808500000070"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x40f03, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r1}, 0xc) 11.422832127s ago: executing program 0 (id=2891): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x8080}, 0x20004450) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000440)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWRULE={0x14, 0x6, 0xa, 0x41f, 0x0, 0x0, {0xa, 0x0, 0x6}}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x5}}}, 0x3c}, 0x1, 0x0, 0x0, 0x200000c4}, 0x24000840) 11.214315965s ago: executing program 0 (id=2893): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="0200000004000000080000000100000080"], 0x48) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000000)={{r0, 0xffffffffffffffff}, &(0x7f00000000c0), &(0x7f0000000680)='%pI4 \x00'}, 0x20) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000380)={r1, 0xffffffffffffffff}, 0x4) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0xa, 0x1c, &(0x7f00000006c0)=@ringbuf={{0x18, 0x8, 0x0, 0x0, 0xff7f0000}, {{0x18, 0x1, 0x1, 0x0, r0}, {}, {}, {0x85, 0x0, 0x0, 0x5}}, {{0x5, 0x0, 0x3}}, [@snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0xfffffffc}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r2}}], {{0x6, 0x1, 0xd, 0x8}, {0x6, 0x0, 0x5, 0x8}, {0x85, 0x0, 0x0, 0x5}}}, &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x94) 11.123089994s ago: executing program 0 (id=2895): r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r2, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x0) (async) recvmsg$unix(r1, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000080), 0x100}, 0x0) (async, rerun: 32) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) (rerun: 32) sendmsg$inet(r4, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) (async, rerun: 32) recvmsg$unix(r3, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000080), 0x100}, 0x0) (async, rerun: 32) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r6, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) (async) recvmsg$unix(r5, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000900), 0x100}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r8, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x40000) (async) recvmsg(r7, &(0x7f00000005c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001dc0)=""/4096, 0x1000}, 0x0) close(r7) syz_init_net_socket$bt_hci(0x1f, 0x5, 0x8) (async) r9 = socket$packet(0x11, 0x3, 0x300) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0x0) (async) setsockopt$packet_tx_ring(r9, 0x107, 0xd, &(0x7f0000000080)=@req={0x800000, 0x1, 0x1000, 0x800}, 0x10) (async) r10 = socket$nl_route(0x10, 0x3, 0x0) (async) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000010000001801000020756c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000020850000000400000095"], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x40, '\x00', 0x0, @fallback=0x27, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="180000000000000000000000000000008500000007"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x3, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) r11 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b7030000000007008500000004"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x27, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r11}, 0xc) (async) sendmsg$nl_route(r10, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=@newlink={0x50, 0x10, 0x401, 0x70bd28, 0x0, {0x0, 0x0, 0x0, 0x0, 0x10842}, [@IFLA_LINKINFO={0x30, 0x12, 0x0, 0x1, @geneve={{0xb}, {0x20, 0x2, 0x0, 0x1, [@IFLA_GENEVE_REMOTE6={0x13, 0x12, @ipv4={'\x00', '\xff\xff', @multicast2}}, @IFLA_GENEVE_REMOTE={0x8, 0x2, @local}]}}}]}, 0x50}, 0x1, 0x0, 0x0, 0x40680c5}, 0x0) r12 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r12, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000007c0)=ANY=[@ANYBLOB="300000001e000100000000000000000007000000", @ANYRES32=r12, @ANYBLOB="000000000a00020000000000000000000800090002"], 0x30}}, 0x0) (async) r13 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r13, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)={0x5c, 0x2, 0x6, 0x201, 0x0, 0x0, {0x7, 0x0, 0x5}, [@IPSET_ATTR_REVISION={0x5, 0x4, 0x1}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_TIMEOUT={0x8, 0x6, 0x0}]}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_TYPENAME={0x16, 0x3, 'hash:net,port,net\x00'}]}, 0x5c}}, 0x0) (async) sendto$packet(r9, 0x0, 0x0, 0x0, &(0x7f0000000100)={0x11, 0x0, 0x1, 0x1, 0x0, 0x0}, 0x14) (async) sendmsg$nl_route(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000380)=ANY=[@ANYBLOB="000000001a000200253d7000fedbdf2502002003ff04000300440000"], 0x34}}, 0x8000000) 9.892403504s ago: executing program 5 (id=2901): r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_int(r0, 0x29, 0x35, &(0x7f0000000000)=0x8000, 0x4) bind$inet6(r0, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) setsockopt$inet6_IPV6_DSTOPTS(r0, 0x29, 0x3b, &(0x7f0000000080)=ANY=[], 0x8) setsockopt$inet6_int(r0, 0x29, 0x3a, &(0x7f0000000040)=0x8, 0x4) recvmmsg(r0, &(0x7f0000002d00)=[{{&(0x7f00000003c0)=@phonet, 0x80, &(0x7f0000000c00)=[{&(0x7f0000000640)=""/141, 0x8d}, {&(0x7f0000000700)=""/85, 0x55}, {&(0x7f0000000800)=""/240, 0xf0}, {&(0x7f0000000900)=""/98, 0x62}, {&(0x7f0000000980)=""/137, 0x89}, {&(0x7f0000000a40)=""/16, 0x10}, {&(0x7f0000000a80)=""/225, 0xe1}], 0x7, &(0x7f0000000c80)=""/56, 0x38}, 0x1000}, {{&(0x7f0000000cc0)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @loopback}}}, 0x80, &(0x7f0000000f40)=[{&(0x7f0000000d40)=""/182, 0xb6}, {&(0x7f0000000e00)=""/158, 0x9e}, {&(0x7f0000000ec0)}, {&(0x7f0000000f00)=""/59, 0x3b}], 0x4, &(0x7f0000000f80)=""/234, 0xea}, 0x6}, {{0x0, 0x0, &(0x7f00000010c0)=[{&(0x7f0000001080)=""/41, 0x29}], 0x1}, 0x6}, {{&(0x7f0000001100)=@isdn, 0x80, &(0x7f0000001400)=[{&(0x7f0000001180)=""/5, 0x5}, {&(0x7f00000011c0)=""/251, 0xfb}, {&(0x7f00000012c0)=""/7, 0x7}, {&(0x7f0000001300)=""/120, 0x78}, {&(0x7f0000001380)=""/109, 0x6d}], 0x5, &(0x7f0000001b40)=""/4096, 0x1000}}, {{&(0x7f0000002b40)=@pppoe={0x18, 0x0, {0x0, @dev}}, 0x80, &(0x7f0000002c00)=[{&(0x7f0000002bc0)=""/37, 0x25}], 0x1, &(0x7f0000002c40)=""/168, 0xa8}, 0xcb9}], 0x5, 0x10102, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f0000000200)={0xa, 0x4e20, 0x0, @mcast1}, 0x1c) 8.789227628s ago: executing program 5 (id=2907): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000280)=@bpf_lsm={0x6, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="18000000003f000000000000000000f195"], &(0x7f0000000140)='GPL\x00'}, 0x80) r2 = bpf$ITER_CREATE(0xb, &(0x7f00000004c0)={r1}, 0x8) r3 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000080)={&(0x7f0000000040)=ANY=[@ANYBLOB="9feb01001800000000000000200000002000000004000000010000000000000104000000200000000100000000000001"], 0x0, 0x3c}, 0x28) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x7, 0x9, &(0x7f00000000c0)=ANY=[@ANYBLOB="18110000", @ANYRES32, @ANYBLOB="0000000000000000b70800000e0000007b000007020000f8ffff3157ffb703800008000000b704e59f1e24e16b00000100000085000000820000000000000000009064cc00000000000000"], &(0x7f0000000500)='GPL\x00', 0x2, 0x0, 0x0, 0x41100, 0x2d, '\x00', 0x0, @fallback=0x33, r3, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, r2, 0x1, 0x0, &(0x7f0000000840)=[{0x0, 0x1, 0xb, 0x6}], 0x10, 0x3ff}, 0x94) r4 = socket$inet6_udp(0xa, 0x2, 0x0) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7001}) r6 = socket(0x400000000010, 0x3, 0x0) r7 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f0000000bc0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd29, 0xffffffff, {0x0, 0x0, 0x0, r8, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x2}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_RSC={0x10, 0x1, {0x8, 0x401, 0x7}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4}, 0x0) sendmsg$nl_route_sched(r6, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000006c0)=@newtfilter={0x84, 0x2c, 0xd27, 0x30bd2c, 0x25dfdc00, {0x0, 0x0, 0x0, r8, {0xfff5, 0x10}, {}, {0x8, 0xd}}, [@filter_kind_options=@f_matchall={{0xd}, {0x50, 0x2, [@TCA_MATCHALL_ACT={0x4c, 0x2, [@m_gact={0x48, 0x1, 0x0, 0x0, {{0x9}, {0x1c, 0x2, 0x0, 0x1, [@TCA_GACT_PARMS={0x18, 0x2, {0x5, 0x5, 0x6, 0xe28c, 0x4}}]}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x3, 0x3}}}}]}]}}]}, 0x84}, 0x1, 0x0, 0x0, 0xfaeccc0edd389ee1}, 0x20000000) r9 = openat$tun(0xffffffffffffff9c, &(0x7f00000004c0), 0x0, 0x0) close(r9) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r9, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r10 = socket$kcm(0x11, 0x3, 0x0) setsockopt$sock_attach_bpf(r10, 0x107, 0xf, &(0x7f0000000600), 0x56) sendmsg$kcm(r10, &(0x7f00000000c0)={&(0x7f0000000500)=@xdp={0x2c, 0x0, r8, 0xe}, 0x80, &(0x7f0000000340)=[{&(0x7f0000000180)="27030200590214000600002fb96dbcf706e10500000086ddffff1144ee163cd4b8bf", 0x22}, {&(0x7f0000000c00)="4307ed2e", 0x4}], 0x2}, 0x4) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000200)={'syzkaller0\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'syzkaller0\x00'}) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000500)=ANY=[@ANYRES8=r11, @ANYRES32=r4, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r11], 0x28}}, 0x0) 8.438135923s ago: executing program 5 (id=2908): socket(0xf, 0x3, 0x0) unshare(0x40000000) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) ioctl$TUNSETLINK(r1, 0x400454cc, 0x338) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000002c0)={'syzkaller0\x00', 0x7101}) r2 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r2, 0x8914, &(0x7f0000000400)={'lo\x00', 0x1}) sendto$inet(r2, &(0x7f0000000000)="12345678000100000000000100000001000000010105000000000001000000ce", 0x20, 0x0, &(0x7f0000000100)={0x2, 0x1b59, @loopback}, 0x10) sendto$inet(r2, &(0x7f0000000000)="12345678000100000000000100000001000000010105000000000001000000ce", 0x20, 0x0, &(0x7f0000000100)={0x2, 0x591b, @loopback}, 0x10) r3 = socket$inet6_udp(0xa, 0x2, 0x0) sendto$inet6(r3, &(0x7f0000000000)="12345678000100000000000100000001000000010105000000000001000000ce", 0x20, 0x0, &(0x7f0000000300)={0xa, 0x1b59, 0x0, @loopback}, 0x1c) sendto$inet6(r3, &(0x7f0000000000)="12345678000100000000000100000001000000010105000000000001000000ce", 0x20, 0x0, &(0x7f0000000300)={0xa, 0x591b, 0x0, @loopback}, 0x1c) recvfrom$inet(r2, &(0x7f0000000500)=""/64, 0x40, 0x40, 0x0, 0x0) nanosleep(&(0x7f0000000200)={0x0, 0x5f5e100}, 0x0) 5.215403854s ago: executing program 2 (id=2926): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'macvlan0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000440)=@newlink={0x4c, 0x10, 0x401, 0xfffffffc, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, 0x31943}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @vlan={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_VLAN_ID={0x6, 0x1, 0x1}]}}}, @IFLA_LINK={0x8, 0x5, r1}, @IFLA_NUM_TX_QUEUES={0x8, 0x1f, 0x6}]}, 0x4c}, 0x1, 0x0, 0x0, 0x2004d808}, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x121800, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r3) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000600)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x4, 0x25dfdbfd, {0x0, 0x0, 0x0, r5, {0x0, 0xb}, {0xffff, 0xffff}, {0x6}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x6364, 0x200005, 0xffffffff, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) sendmsg$nl_route_sched(r4, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=@newqdisc={0x78, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdc01, {0x0, 0x0, 0x0, r5, {0x0, 0x10}, {0x1, 0xb}, {0xffff, 0x8}}, [@qdisc_kind_options=@q_sfq={{0x8}, {0x4c, 0x2, {{0x4, 0x10, 0x6, 0x8, 0x4fbef}, 0x13, 0x1, 0x3, 0x7, 0x10, 0x4, 0x1b, 0x18, 0x5, 0x402, {0x6, 0x8001, 0xfffffffc, 0x0, 0xffffffff, 0x5}}}}]}, 0x78}, 0x1, 0x0, 0x0, 0x240048e4}, 0x4890) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r6 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000040)={'syzkaller0\x00', 0x0}) sendto$packet(r6, &(0x7f0000000180)="05", 0x1, 0x4009, &(0x7f00000002c0)={0x11, 0x8100, r7, 0x1, 0x3, 0x6, @remote}, 0x14) 5.069032453s ago: executing program 5 (id=2928): r0 = socket$kcm(0xa, 0x2, 0x3a) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000fc0)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000fc0)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = socket$inet_tcp(0x2, 0x1, 0x0) connect$inet(0xffffffffffffffff, &(0x7f0000000300)={0x2, 0x15, @loopback}, 0x10) write(0xffffffffffffffff, 0x0, 0x0) r6 = accept4(r5, 0x0, 0x0, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) write(r6, 0x0, 0x0) sendmsg$inet(r3, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001400)=[{&(0x7f0000000080)="3bfdd75fa5717852d59a9367444a2130e72cd4dabc8854532cca0c32a5b9f844a4610c7525650ce3d3b76b15026d93e6dee896115e9364066aa3d14e33ef732b4681335c576902153114bdb9c74b538a71115fb1d1a63d1b04129661b29aab89d0be999a6b7c9bea755adedbf305a79f70b71d3d4c98577b49db4963ce89b0def5e840f459659cb6f86d56b069a5de11d601d348ff88ca6e5e2cfe40176880b33e9e8dbc32ba2e6a99b1b50276dc4f06166000d7069a3cc76f", 0xb9}, {&(0x7f0000000180)="892950e2405ee8629d9384a91c16d1706a3e61f305119f95cac0f1927f4c205b971eb41147cb1f86883d6910e68ac3996551800b3ec64b77f8444b18345a2c8b178eeeba0cde7319a5a46bfe7f5770e019efd9d52069edcced33a758c4e657f3a792dc193a1911b4e82ea800ad7afe03c851a8", 0x73}, {&(0x7f0000000200)="a68cde0d56b170df7710b54f17d9a39c4f98f3547190", 0x20000216}, {&(0x7f0000000240)="45e04400f2b383517a08c397dd0a76e67ecfc8e74573c24dedd3a48fb62418c1412fdcd15e888cb0f5d02e77bfecefda6b064c0bb2b66a9a522e63873dde02330510255eec7dfa1af708cdab59fb71eca786a359a2c3b0cbad35144ec5b069c53f90e43339845dc7fd140c55b0149ab38eb27c140f374bcc2c95b0b121d1a9302f3a01b888243b3fc0d46f0de0", 0x8d}, {&(0x7f0000000300)="87fb74cf4d67adbbd062637f514c1f5eb18d7b442e6457a356c6cb1f71a43dfae773c8489cce5145f92615d4bdb13ef54d6ae90ec7733180fcf5adf3e13fdb05b57b748bd14eda042a97fdd84498304a504a0a159b972e8200c2d0f536a3465ec498ed12b924bd134057df36129d3ebe3dd3ce9f0671e5278143e4afa3d43f444681de1b5f9725fca34fa357fe2154981666fb9dc202fc17a0199eb1c25bdd1005e590e84783ee9894c888998dc25a83c14aeee31d114acfa0bcd235d571cd765f4b9259ba43e6fc30291d8a642146c4771898030b736aeee6b247abb0784b154e104e7dcda401f9b1736fea30a41a4153fe6a9a525bd0a3487571f914f05b590e242341ade289d8f5b842c6be4a93c2755dfd47174def782a2f8f61c068b5a012f02c0801601e860def788121e8808c01fed4c920a3698d0d684920918c95b17f76bbcb4f265c931d8f79560ff8114b70f4dd6791e2ed70cfeb89905791b88be26efe1c5c66b7b50b3d2be0dbc066dfc31618f9507f6f340b85a2f76a6dcac9d6ccc289ace5e5fecd25afe22ffa451f5e365ab33cc985f2e9d7f7fb1be4794740a94215d7db14b0ffcec19e5e3c5ae0d8578ef3b65d2a7a77a11e390a6c3a6b391061c886b961e3c2f42d62047bfe1356a44b840d3d956105f4c0fa95db08c4933f00de77cdc057c28b41fecfc8398c442be1ad065954f6c9dfeb2fd7207e8548a00a1d50bdf522d2abfdafd71723616a34830fbfa8fc81e0c2639cc12f363a4919b7a00ac8189dad3e7e54122a2ef430f623658d5e281c9a19442995bb9b0e3f7d13e3016b6f9523be196bf23bbcc5ec802f43ef8b651d688d9d5a44f35c9847e4c32bce3e9ebed2326adadc76f06a195db32c80b3090d7cd65c9d8518ba4e528c5eb5c7a1c5695b21595fa8a8621734bfda8afddd65e1f37a1990220a00fa9bd2c22b0117ceb08ae6af3c944c2eca924abfddad065d1472d0c3f742a49b1e78c669471873706ad157d831d7482b773f07b0673a6ce1e227a7a4d13744bf459434c0ab1c323a38b1a84cbf1ce9741f2b8fdcc2e073e56171603d035aacd83e71d5132831f4f1e8bf517979f132a33fd03783272e9b8c96dfa4e1d320a58d82acfc8d3d53a5a52daafe4dc8be08f4ad53e11cc21374b6ff4ff5ea2ecc5d3f7c057f74f0098e57d990090475cdaffdef0da917653ed10fb70b94b72e5b4d95cbea0fc1dd2579635ad6ab545ba4d7b6d2f5442bdb78beb6c8ed62942a439117025b4566b48d9f3a17fdf4577e8606a4bc4c26557e58312fd2d1a541ebec3e5ae28eef8b2ab0597083716dd12889335570ee7839530eee879d9b137606cd4dd7103991671b4464bb68529eb19fb7a8845e3491bfbac688a87cf0744f429ea112014402915c4c1f6bae08d689d3cb7d641d7befe8fc74a2242310a9a367a39531b4c86da5b39df524e52f33ff9c40b48cb196ffc9ca855b6e698ade8a83e52b9ddc5031ff09e1907e4f8b0d07e64e1fb8e427f8819a7be907aa216bf8e2a4c7cc87ed53bf9490d4cc788b91f3b9f705e984a7e62c7a495e8421b97c39dc954b35468f17c6682334f4e16308448f457faeffff6d1f818522fa441d3a48168bdb12ffebace436a3915b63076cb6a655718647f87eaaf313b5bbd430421eed3a2215e439600a56eac8c65291eb103326a8034662bd337ab51577d9110ec7151be5cc9c54b2a30891acac5ad006ed537dbeb8f16eecbde7cf4e71373faf3c36b772f6d7ea9346875c8cf1049d49d4f8eb01b946c11e8c8e3ab2015f282167acddcc77fff03e1be9134252af0abfe538b4d25fc4ff874b52b9fb0996b5f32b4141dbd30578ff46e13ef6c63fc1620f62cb11a3dce401993976c272a5f62fde3f2a0e654d19e7a39dcdb622b9526d2a15cc18e6f817c916a00775353dd9c8954e66d0445b59bb0f5e6e3b46447232f52a0e398b057d123ef503afcbd48544db6434d2025bfc8dab72262a4fa5426a03061e7f8966e0086ff8ab5a91ab59f19b830394ee8bc76d6fb4816b8f4cde35b7eb9d3811228d51c54828f97fd1e648196c81bc73ed56249a59f318704e84656a6cedd2b8c1e1808d1cc648749abc643131e494c01336d4a14b8609656f2c972dc23c5c2e43fe40119fb88b5ec2aade35c03646e347354c493de8ab3672ccf94af0df333c6678299129d79be0eec281c5b3858ce3995566a390b674635b356692e3e9c53a089638ba0d69e772b7b410a5ae03de12e7de755ee559e1707b7b8003aabc8e2ce03c01e3183ff2d93262f6d5ceaafecdae66bc7cb3952c5a6571d864d502f281db5a228695badca5d022fdb6da56ab15dc377d1c1f8581ff56e28c2b2a84edb629547d28275c2ed571103b4ca7cdeb0776ba9f9dffcd78d21c3d4caa9289ed199672f4e7b912068c49c817114c37d37ea03954bae87d1ddae3da2ad85feb2fbb735b75a51f7bee5c8d88cc7bf64700d1a46ec6b631ae22ac7b06730a86a26bdcb992e1c7b50142de96b14a8468e4514068a30896fc677fddefaebb125c693a8d460469c7fe535f844781940f66d6abd091191c3122d584f5b0f5b0d443713d7d5186124d73de28aca30b719d4a55e09d259bddbf16995aeb1000880890afbd24d4066b0398985a40999de22ce176348e1c1f57eaf75b92a1e4f1482e89a00ac2cc36b20e36af9ec310599c19a5b1d6f8fadba104c58c801c6633315f82ebfa88faddd0b693e2f827f586c1cc5538e93bcf10f81af6dd7ee727df3b5018c0b4e31e40d040a47503b6ace4d29a1162ce487351825255f5584aff7cbd421f85c3d9fbb3784abd9848f16028b68f0d32ed8bb80106e8cc4acb939ff88bd39976d166b2addebf628b3fcd056da2f60e1b90f7a32702954921908ebccb683622a1f574ceba6951bef5e751c338c8279318dc28e36b9fc2bb17c3ad08aceb00fc388e6db112a738f86a4a1eb11526e1b9d73250b326285ed47c4398d93a3933d9a784249b65ad7d78a1f81d96ef36493ed693045a2150a8eb43cecc0c93e7d20b15b39a0646b081c2923b816365b7fbb41683a41732d942c5aa12faf876ec7f036becde8f3295af6dacff38d076d8e06260fee167703bb610745374a2758a6b88e465ca77d1f3105ae8b6b04a1eb509fb178d6249dbbc84d5d1d069278449a89d03e4a9a395d8170c329a296cfc329798cb9b9f1078d098cf3f989fd4ec53e013fbe917df35292d44fb1f3da4da4432a1847d4721514ade8cda5e5c0b51183580fc35266a970ebba74faeda56d4dcb56df51f96ad237452cedbd0cb2bee112713c3d450835811bf3da9745136d428e148fd0932dc77c8d8e61a16c625241fad8425b4ece394eedd5f165bd94923bfa1172be8edc8a4fcaae5f77ee8cc510192b27964da09c3e84efb4bc7154da1a24da8b7e544b42278d2574687ec76143afa6cf193d52a2a7f4c20ee57b6056a1337d5e408117a6cf1ab49c8980f39597f69902085d3e8d374d44e6ab4ed1185a26be2bc7281e9cfbbeb6bed899aa1924d3faa06d95999fbeaf2337494e0c2c39eef5a73fcde84459a9ea48d4e015d9e5bb5839354967ce02f637bc8678d2595b9a918fc36b927d7501f0ac2e3471ce02b5df355689c87f191ef5390900a41deec29984e45a878ece964b0009aad561316fc3b30ce1b49266d32eb17cd30f3e17e1f59014e8c518940dd0a093d1349c1a7c2581963bbe0ba372b6426e81c33c71b2ec8141c5713e52a37fff0a417a5b259e1420d9fb6a731f5baa0cc494221947895aa8fa14745a986a366bff9d0c239a19f85372497565b5b703da16439019df5f3d29f4247fb528854c9648630f03e9dedde5a08a47728ea6a4d42e62eff6fa3bd402325e0f4387b60171c37c180f958ad80955779c899517e7ea76eed00598e01552eaaf08b723daf9d466e8c57af43a15a46528b1119f5074aa3c51f77357ebe158275bc06b89640d7ce3c0a03af01418d7dc6ae8a1be8ab08c1722d66d1e9277480b8b178447667c024f9b78f8a878a2d7cf8e83e5104f6964b2907a989abafc7d7d0df941abf3d7283b6a11d46c2911a42182ec27ab785d92946e1ee8ef44846d561850d2a98c305c382f36d4cfc9b2bfd3b86ef21a0d187adcafbec8268c7d662a34dda1c83c4967097743133bc8c587edf249f5668c34ddb112fa4eb1bea9c8f6a000f1f34428b54688a5e214a7919868b25dbe930e86a243ecf54afe0b518c647d04873d2cf62cb2ab27f00015537a4fd2ea3dc8777abdf3284622347016566da0b9c406ca8c40694e4013a53fbf2e803d51b0bbe5e9df5fc74f66be618856357ccf803c53ed0e3b3fe79f69f0ede9b565d8f7a8ce5aa8cbb4e8fa61be3fd00ffb07e45065498925c14c0b311942d4ed951ad6237aadb5405bc7b2d79e1fd295b7c2ed8efa883e44c86a5053e2f421c6d4dc0c47d3a05d911db37d6efdb8e50fb3f06139ac147bc7162c21aece79eaf72e9779f19eb5395cec3d15a7594ea70a6b373d98651d2215b210f037ea3f8a57ded74474f6fdb64a08b56af52168da70b30aee03472cd8bee5af04cad7303004a4aba464b99", 0xcb3}], 0x5, &(0x7f0000001480)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @private, @multicast1}}}], 0x20}, 0x0) recvmsg$unix(r4, &(0x7f0000001140)={0x0, 0x0, &(0x7f0000001040)=[{&(0x7f00000015c0)=""/4096, 0x7ffff000}], 0x1, 0x0, 0x2}, 0x40000300) sendmsg$inet(r1, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001400)=[{&(0x7f0000000080)="3bfdd75fa5717852d59a9367444a2130e72cd4dabc8854532cca0c32a5b9f844a4610c7525650ce3d3b76b15026d93e6dee896115e9364066aa3d14e33ef732b4681335c576902153114bdb9c74b538a71115fb1d1a63d1b04129661b29aab89d0be999a6b7c9bea755adedbf305a79f70b71d3d4c98577b49db4963ce89b0def5e840f459659cb6f86d56b069a5de11d601d348ff88ca6e5e2cfe40176880b33e9e8dbc32ba2e6a99b1b50276dc4f06166000d7069a3cc76f", 0xb9}, {&(0x7f0000000180)="892950e2405ee8629d9384a91c16d1706a3e61f305119f95cac0f1927f4c205b971eb41147cb1f86883d6910e68ac3996551800b3ec64b77f8444b18345a2c8b178eeeba0cde7319a5a46bfe7f5770e019efd9d52069edcced33a758c4e657f3a792dc193a1911b4e82ea800ad7afe03c851a8", 0x73}, {&(0x7f0000000200)="a68cde0d56b170df7710b54f17d9a39c4f98f3547190", 0x20000216}, {&(0x7f0000000240)="45e04400f2b383517a08c397dd0a76e67ecfc8e74573c24dedd3a48fb62418c1412fdcd15e888cb0f5d02e77bfecefda6b064c0bb2b66a9a522e63873dde02330510255eec7dfa1af708cdab59fb71eca786a359a2c3b0cbad35144ec5b069c53f90e43339845dc7fd140c55b0149ab38eb27c140f374bcc2c95b0b121d1a9302f3a01b888243b3fc0d46f0de0", 0x8d}, {&(0x7f0000000300)="87fb74cf4d67adbbd062637f514c1f5eb18d7b442e6457a356c6cb1f71a43dfae773c8489cce5145f92615d4bdb13ef54d6ae90ec7733180fcf5adf3e13fdb05b57b748bd14eda042a97fdd84498304a504a0a159b972e8200c2d0f536a3465ec498ed12b924bd134057df36129d3ebe3dd3ce9f0671e5278143e4afa3d43f444681de1b5f9725fca34fa357fe2154981666fb9dc202fc17a0199eb1c25bdd1005e590e84783ee9894c888998dc25a83c14aeee31d114acfa0bcd235d571cd765f4b9259ba43e6fc30291d8a642146c4771898030b736aeee6b247abb0784b154e104e7dcda401f9b1736fea30a41a4153fe6a9a525bd0a3487571f914f05b590e242341ade289d8f5b842c6be4a93c2755dfd47174def782a2f8f61c068b5a012f02c0801601e860def788121e8808c01fed4c920a3698d0d684920918c95b17f76bbcb4f265c931d8f79560ff8114b70f4dd6791e2ed70cfeb89905791b88be26efe1c5c66b7b50b3d2be0dbc066dfc31618f9507f6f340b85a2f76a6dcac9d6ccc289ace5e5fecd25afe22ffa451f5e365ab33cc985f2e9d7f7fb1be4794740a94215d7db14b0ffcec19e5e3c5ae0d8578ef3b65d2a7a77a11e390a6c3a6b391061c886b961e3c2f42d62047bfe1356a44b840d3d956105f4c0fa95db08c4933f00de77cdc057c28b41fecfc8398c442be1ad065954f6c9dfeb2fd7207e8548a00a1d50bdf522d2abfdafd71723616a34830fbfa8fc81e0c2639cc12f363a4919b7a00ac8189dad3e7e54122a2ef430f623658d5e281c9a19442995bb9b0e3f7d13e3016b6f9523be196bf23bbcc5ec802f43ef8b651d688d9d5a44f35c9847e4c32bce3e9ebed2326adadc76f06a195db32c80b3090d7cd65c9d8518ba4e528c5eb5c7a1c5695b21595fa8a8621734bfda8afddd65e1f37a1990220a00fa9bd2c22b0117ceb08ae6af3c944c2eca924abfddad065d1472d0c3f742a49b1e78c669471873706ad157d831d7482b773f07b0673a6ce1e227a7a4d13744bf459434c0ab1c323a38b1a84cbf1ce9741f2b8fdcc2e073e56171603d035aacd83e71d5132831f4f1e8bf517979f132a33fd03783272e9b8c96dfa4e1d320a58d82acfc8d3d53a5a52daafe4dc8be08f4ad53e11cc21374b6ff4ff5ea2ecc5d3f7c057f74f0098e57d990090475cdaffdef0da917653ed10fb70b94b72e5b4d95cbea0fc1dd2579635ad6ab545ba4d7b6d2f5442bdb78beb6c8ed62942a439117025b4566b48d9f3a17fdf4577e8606a4bc4c26557e58312fd2d1a541ebec3e5ae28eef8b2ab0597083716dd12889335570ee7839530eee879d9b137606cd4dd7103991671b4464bb68529eb19fb7a8845e3491bfbac688a87cf0744f429ea112014402915c4c1f6bae08d689d3cb7d641d7befe8fc74a2242310a9a367a39531b4c86da5b39df524e52f33ff9c40b48cb196ffc9ca855b6e698ade8a83e52b9ddc5031ff09e1907e4f8b0d07e64e1fb8e427f8819a7be907aa216bf8e2a4c7cc87ed53bf9490d4cc788b91f3b9f705e984a7e62c7a495e8421b97c39dc954b35468f17c6682334f4e16308448f457faeffff6d1f818522fa441d3a48168bdb12ffebace436a3915b63076cb6a655718647f87eaaf313b5bbd430421eed3a2215e439600a56eac8c65291eb103326a8034662bd337ab51577d9110ec7151be5cc9c54b2a30891acac5ad006ed537dbeb8f16eecbde7cf4e71373faf3c36b772f6d7ea9346875c8cf1049d49d4f8eb01b946c11e8c8e3ab2015f282167acddcc77fff03e1be9134252af0abfe538b4d25fc4ff874b52b9fb0996b5f32b4141dbd30578ff46e13ef6c63fc1620f62cb11a3dce401993976c272a5f62fde3f2a0e654d19e7a39dcdb622b9526d2a15cc18e6f817c916a00775353dd9c8954e66d0445b59bb0f5e6e3b46447232f52a0e398b057d123ef503afcbd48544db6434d2025bfc8dab72262a4fa5426a03061e7f8966e0086ff8ab5a91ab59f19b830394ee8bc76d6fb4816b8f4cde35b7eb9d3811228d51c54828f97fd1e648196c81bc73ed56249a59f318704e84656a6cedd2b8c1e1808d1cc648749abc643131e494c01336d4a14b8609656f2c972dc23c5c2e43fe40119fb88b5ec2aade35c03646e347354c493de8ab3672ccf94af0df333c6678299129d79be0eec281c5b3858ce3995566a390b674635b356692e3e9c53a089638ba0d69e772b7b410a5ae03de12e7de755ee559e1707b7b8003aabc8e2ce03c01e3183ff2d93262f6d5ceaafecdae66bc7cb3952c5a6571d864d502f281db5a228695badca5d022fdb6da56ab15dc377d1c1f8581ff56e28c2b2a84edb629547d28275c2ed571103b4ca7cdeb0776ba9f9dffcd78d21c3d4caa9289ed199672f4e7b912068c49c817114c37d37ea03954bae87d1ddae3da2ad85feb2fbb735b75a51f7bee5c8d88cc7bf64700d1a46ec6b631ae22ac7b06730a86a26bdcb992e1c7b50142de96b14a8468e4514068a30896fc677fddefaebb125c693a8d460469c7fe535f844781940f66d6abd091191c3122d584f5b0f5b0d443713d7d5186124d73de28aca30b719d4a55e09d259bddbf16995aeb1000880890afbd24d4066b0398985a40999de22ce176348e1c1f57eaf75b92a1e4f1482e89a00ac2cc36b20e36af9ec310599c19a5b1d6f8fadba104c58c801c6633315f82ebfa88faddd0b693e2f827f586c1cc5538e93bcf10f81af6dd7ee727df3b5018c0b4e31e40d040a47503b6ace4d29a1162ce487351825255f5584aff7cbd421f85c3d9fbb3784abd9848f16028b68f0d32ed8bb80106e8cc4acb939ff88bd39976d166b2addebf628b3fcd056da2f60e1b90f7a32702954921908ebccb683622a1f574ceba6951bef5e751c338c8279318dc28e36b9fc2bb17c3ad08aceb00fc388e6db112a738f86a4a1eb11526e1b9d73250b326285ed47c4398d93a3933d9a784249b65ad7d78a1f81d96ef36493ed693045a2150a8eb43cecc0c93e7d20b15b39a0646b081c2923b816365b7fbb41683a41732d942c5aa12faf876ec7f036becde8f3295af6dacff38d076d8e06260fee167703bb610745374a2758a6b88e465ca77d1f3105ae8b6b04a1eb509fb178d6249dbbc84d5d1d069278449a89d03e4a9a395d8170c329a296cfc329798cb9b9f1078d098cf3f989fd4ec53e013fbe917df35292d44fb1f3da4da4432a1847d4721514ade8cda5e5c0b51183580fc35266a970ebba74faeda56d4dcb56df51f96ad237452cedbd0cb2bee112713c3d450835811bf3da9745136d428e148fd0932dc77c8d8e61a16c625241fad8425b4ece394eedd5f165bd94923bfa1172be8edc8a4fcaae5f77ee8cc510192b27964da09c3e84efb4bc7154da1a24da8b7e544b42278d2574687ec76143afa6cf193d52a2a7f4c20ee57b6056a1337d5e408117a6cf1ab49c8980f39597f69902085d3e8d374d44e6ab4ed1185a26be2bc7281e9cfbbeb6bed899aa1924d3faa06d95999fbeaf2337494e0c2c39eef5a73fcde84459a9ea48d4e015d9e5bb5839354967ce02f637bc8678d2595b9a918fc36b927d7501f0ac2e3471ce02b5df355689c87f191ef5390900a41deec29984e45a878ece964b0009aad561316fc3b30ce1b49266d32eb17cd30f3e17e1f59014e8c518940dd0a093d1349c1a7c2581963bbe0ba372b6426e81c33c71b2ec8141c5713e52a37fff0a417a5b259e1420d9fb6a731f5baa0cc494221947895aa8fa14745a986a366bff9d0c239a19f85372497565b5b703da16439019df5f3d29f4247fb528854c9648630f03e9dedde5a08a47728ea6a4d42e62eff6fa3bd402325e0f4387b60171c37c180f958ad80955779c899517e7ea76eed00598e01552eaaf08b723daf9d466e8c57af43a15a46528b1119f5074aa3c51f77357ebe158275bc06b89640d7ce3c0a03af01418d7dc6ae8a1be8ab08c1722d66d1e9277480b8b178447667c024f9b78f8a878a2d7cf8e83e5104f6964b2907a989abafc7d7d0df941abf3d7283b6a11d46c2911a42182ec27ab785d92946e1ee8ef44846d561850d2a98c305c382f36d4cfc9b2bfd3b86ef21a0d187adcafbec8268c7d662a34dda1c83c4967097743133bc8c587edf249f5668c34ddb112fa4eb1bea9c8f6a000f1f34428b54688a5e214a7919868b25dbe930e86a243ecf54afe0b518c647d04873d2cf62cb2ab27f00015537a4fd2ea3dc8777abdf3284622347016566da0b9c406ca8c40694e4013a53fbf2e803d51b0bbe5e9df5fc74f66be618856357ccf803c53ed0e3b3fe79f69f0ede9b565d8f7a8ce5aa8cbb4e8fa61be3fd00ffb07e45065498925c14c0b311942d4ed951ad6237aadb5405bc7b2d79e1fd295b7c2ed8efa883e44c86a5053e2f421c6d4dc0c47d3a05d911db37d6efdb8e50fb3f06139ac147bc7162c21aece79eaf72e9779f19eb5395cec3d15a7594ea70a6b373d98651d2215b210f037ea3f8a57ded74474f6fdb64a08b56af52168da70b30aee03472cd8bee5af04cad7303004a4aba464b99", 0xcb3}], 0x5, &(0x7f0000001480)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @private, @multicast1}}}], 0x20}, 0x0) getsockopt$IP_VS_SO_GET_DAEMON(r1, 0x0, 0x487, &(0x7f0000000000), 0x0) recvmsg$unix(r2, &(0x7f0000001140)={0x0, 0x0, &(0x7f0000001040)=[{&(0x7f00000015c0)=""/4096, 0x7ffff000}], 0x1, 0x0, 0x2}, 0x40000300) sendmsg$kcm(r0, &(0x7f0000000200)={&(0x7f0000000000)=@nfc_llcp={0xa, 0x0, 0x0, 0x4, 0x7, 0x0, "be467b1f4cfd8c642c13334c2a9f91732d13e85b10bdb7e8d20dd064e66a4278b3c76f275da083e92b3fdaae3b991ffc48ca221108c4d3aa623010eab68d95"}, 0x80, &(0x7f0000000300)=[{&(0x7f0000000780)="80005b020eaa4da2", 0x8}], 0x1, 0x0, 0x0, 0x900}, 0x0) 4.468397494s ago: executing program 2 (id=2930): r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_int(r0, 0x29, 0x35, &(0x7f0000000000)=0x8000, 0x4) bpf$MAP_LOOKUP_BATCH(0x1b, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x1}, 0x38) bind$inet6(r0, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) setsockopt$inet6_IPV6_DSTOPTS(r0, 0x29, 0x3b, &(0x7f0000000080)=ANY=[], 0x8) setsockopt$inet6_int(r0, 0x29, 0x3a, &(0x7f0000000040)=0x8, 0x4) recvmmsg(r0, &(0x7f0000002d00)=[{{&(0x7f00000003c0)=@phonet, 0x80, &(0x7f0000000c00)=[{&(0x7f0000000640)=""/141, 0x8d}, {&(0x7f0000000700)=""/85, 0x55}, {&(0x7f0000000800)=""/240, 0xf0}, {&(0x7f0000000900)=""/98, 0x62}, {&(0x7f0000000980)=""/137, 0x89}, {&(0x7f0000000a40)=""/16, 0x10}, {&(0x7f0000000a80)=""/225, 0xe1}], 0x7, &(0x7f0000000c80)=""/56, 0x38}, 0x1000}, {{&(0x7f0000000cc0)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @loopback}}}, 0x80, &(0x7f0000000f40)=[{&(0x7f0000000d40)=""/182, 0xb6}, {&(0x7f0000000e00)=""/158, 0x9e}, {&(0x7f0000000ec0)}, {&(0x7f0000000f00)=""/59, 0x3b}], 0x4, &(0x7f0000000f80)=""/234, 0xea}, 0x6}, {{0x0, 0x0, &(0x7f00000010c0)=[{&(0x7f0000001080)=""/41, 0x29}], 0x1}, 0x6}, {{&(0x7f0000001100)=@isdn, 0x80, &(0x7f0000001400)=[{&(0x7f0000001180)=""/5, 0x5}, {&(0x7f00000011c0)=""/251, 0xfb}, {&(0x7f00000012c0)=""/7, 0x7}, {&(0x7f0000001300)=""/120, 0x78}, {&(0x7f0000001380)=""/109, 0x6d}], 0x5, &(0x7f0000001b40)=""/4096, 0x1000}}, {{&(0x7f0000002b40)=@pppoe={0x18, 0x0, {0x0, @dev}}, 0x80, &(0x7f0000002c00)=[{&(0x7f0000002bc0)=""/37, 0x25}], 0x1, &(0x7f0000002c40)=""/168, 0xa8}, 0xcb9}], 0x5, 0x10102, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f0000000200)={0xa, 0x4e20, 0x0, @mcast1}, 0x1c) r1 = socket$packet(0x11, 0x3, 0x300) r2 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f0000000040)='syzkaller\x00'}, 0x94) mmap(&(0x7f00000fb000/0x12000)=nil, 0x12000, 0x2000008, 0x10, 0xffffffffffffffff, 0xf4d66000) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x19, 0x4, 0x4, 0x2}, 0x50) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xd, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bca2000000000000a6020000f8ffffffb703000003000000b7040000020000008500000033000000850000000700000095"], &(0x7f00000004c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000001c0)={{r3}, &(0x7f0000000080), &(0x7f0000000180)=r4}, 0x20) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000b80)={r4, 0x2000012, 0xe, 0x0, &(0x7f0000000280)="63ec33c9e9b98600000000000000", 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xb}, 0x50) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000000c0)={r2, 0x5, 0x14, 0x0, &(0x7f00000001c0)="2e9a53f271a76d2608004c6588a80a38667d2f15", 0x0, 0xd0e, 0x2a0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1, 0x3, &(0x7f0000001a00)=ANY=[@ANYBLOB="850000002f000000840000000000000095000000000000008560fc2b2062f611fc2f864ef177d634e46e8dcfe61b4fb9f600344d592fee49e176fe6ad28fbcb1f9259bfc63e9030971917e30b6f42e8f9dd6ab0ce07312a135cd363aa7e5bcef8fd0e8c7d2082584156c52ebfd69e8e13b7a8b477abc86468e11b6242133ce882f05e16b91c37b3437347f6058b4489c759783b9d4dfb55d0085a26e41201a6d8c8ced33e10048e756a40538b32bf653fa3c831a4e60599ed7a0f999d18de9984522a7cdb6fc30015633a0132c9578b7da5bd7280a5f7e28fd858ba712020b23ef8a2785b6c146c48b48ca7e232d0489661396e9303b38aa5d26d06e2e676795fd2733f95da570bab301000000ffffffff2a2792a630d8fcdc"], &(0x7f0000000180)='GPL\x00'}, 0x48) setsockopt$sock_attach_bpf(r1, 0x1, 0x32, &(0x7f0000000040)=r5, 0x4) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000bc0), r6) sendmsg$NLBL_CIPSOV4_C_ADD(r6, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000006040)={0x44, r7, 0x1, 0x0, 0x0, {}, [@NLBL_CIPSOV4_A_TAGLST={0x4}, @NLBL_CIPSOV4_A_MTYPE={0x8, 0x2, 0x1}, @NLBL_CIPSOV4_A_DOI={0x8}, @NLBL_CIPSOV4_A_MLSLVLLST={0x4}, @NLBL_CIPSOV4_A_MLSCATLST={0x18, 0xc, 0x0, 0x1, [{0x14, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xee8f}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8}]}]}]}, 0x44}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) r8 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$nl802154(&(0x7f00000000c0), r8) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r8, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000140)={0x20, r9, 0x301, 0x70bd2b, 0x25dfdbfe, {0x2b}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}]}, 0x20}, 0x1, 0x0, 0x0, 0x4080}, 0x0) r10 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r11 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000140), r10) ioctl$sock_SIOCGIFINDEX_802154(r10, 0x8933, &(0x7f00000001c0)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_SET_PAN_ID(r10, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000200)={0x24, r11, 0x1, 0x70bd29, 0x25dfdbfd, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r12}, @NL802154_ATTR_PAN_ID={0x6, 0x9, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x20044090}, 0x20000000) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f00000002c0)={'wpan4\x00'}) 3.800824187s ago: executing program 5 (id=2933): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000040), r3) sendmsg$TIPC_NL_KEY_FLUSH(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000740)={0x328, r4, 0x1, 0x70bd22, 0x25dfdbfc, {}, [@TIPC_NLA_MEDIA={0x8c, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_PROP={0x24, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x80000000}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x5}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x6}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x30b}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_PROP={0x1c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xfffffffa}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4}]}, @TIPC_NLA_MEDIA_PROP={0x24, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1d}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xf}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x10000}]}, @TIPC_NLA_MEDIA_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}]}, @TIPC_NLA_NODE={0x288, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_ID={0x86, 0x3, "2920aadf60a408caefad07eb05388c7238c48874d2ab0a1866ef5573a113989f25345cab94e721b9145297825ead5b626344e7241d5f259c4e1774f57e84846fafc69d86553bfe4e7572e7e0cfd3ce6d543e7e62603fe4cb6165a683a34dfb16f29fcbc4bac033f2d193366e8c8d5b58409553cda127039755fa68e72f6585fbfafc"}, @TIPC_NLA_NODE_KEY_MASTER={0x4}, @TIPC_NLA_NODE_ID={0xe1, 0x3, "41f5bf1b2c15c70acef18097c1ec156e6a0d410cca9a045a1e5de6899ae755db340ff36d836e189be9daebaa6f83a9ae344a8447df06169e45aa3f71258b1bbc88675698e881118c95be8f70623659a5e03dc3574105f283793b79949ccf502369ad2c57908b49e18c75735f2fef00e7679d29ca0f6cb0004406c4f75ba24600e45f65d7ef7a0e12d178d2b77996d50500626b4483bf751dd8369c5d553e46e7ef6af59a9d06dce47af04c373048f3606c992928c9556c32e5edd2ae3d0248c92fa45712da3a5ae146df719036ba76981f0518664d7f66152726279e2c"}, @TIPC_NLA_NODE_KEY={0x40, 0x4, {'gcm(aes)\x00', 0x18, "dd5e6f3b85f1b702556d56c13ef3e8c367a40060a078e352"}}, @TIPC_NLA_NODE_KEY_MASTER={0x4}, @TIPC_NLA_NODE_ID={0xc6, 0x3, "b6bc2adaae8c8bbdf8c21a11496a0615fe51729faeaeb7fa2894eb5bafa7a3415d97306ae8eeadec91871d25612ee78242b035c2e552a7cda15557d31c8236cad0897cff696e20525c5af16a8f38814bd7a608a8c25ab2a3f96725641323fe29e9e47dca1e5a060a5f0a525fb75bc80d13d64527f53744cb1b793586d55a977c25143b80b246369650f2b5b89a36419278b14d201d962a715fddce7f8efe4f9dd863f89134d161420e20527033f99b9d6a0bdb63c7fdd302216dcd557383b9b97b66"}, @TIPC_NLA_NODE_REKEYING={0x8, 0x6, 0xdfb}]}]}, 0x328}, 0x1, 0x0, 0x0, 0x80}, 0x2400c880) bind$can_j1939(r1, &(0x7f0000000480)={0x1d, r2, 0x0, {0x2, 0xf0, 0x4}, 0x1}, 0x18) setsockopt$sock_int(r1, 0x1, 0x6, &(0x7f0000000040)=0x1, 0x4) sendmmsg(r1, &(0x7f00000002c0)=[{{0x0, 0xfffffffffffffd0f, &(0x7f0000000700)=[{&(0x7f0000000540)="050000eb3a49a8d125", 0x9}], 0x1}}], 0xfffffffffffffd9e, 0x4000041) setsockopt$SO_J1939_FILTER(r1, 0x6b, 0x1, &(0x7f0000000140)=[{0x4000003, 0x0, {0x0, 0xff, 0x4}, {0x2}, 0x0, 0xfd}, {0x1, 0x2, {0x1, 0x0, 0x4}, {0x2, 0xff, 0x4}, 0xfe, 0xfe}], 0x40) sendmsg$nl_route_sched(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=@newtfilter={0x24, 0x11, 0xbdba17846774e43b, 0x70bd27, 0x25dfdbfc, {0x0, 0x0, 0x74, r2, {0x19, 0xfff2}, {0xf, 0xffff}, {0x1}}}, 0x24}, 0x1, 0xf0ffffffffffff, 0x0, 0x2004c016}, 0x20000050) 3.6420519s ago: executing program 2 (id=2936): bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000100)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000000040), &(0x7f00000000c0)='%pS \x00'}, 0x20) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x5001}) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340), 0x400401, 0x0) ioctl$TUNSETVNETHDRSZ(r2, 0x400454d8, &(0x7f00000002c0)=0x40004) r3 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r3, &(0x7f0000000140)={0xa, 0x20e6, 0x0, @empty}, 0x1c) r4 = socket$inet6(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r4, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', 0x1}) write$tun(r1, &(0x7f0000000300)=ANY=[@ANYBLOB="010530000a00140006000000600000000012114020010000000000000000000000000001ff02000000000000000000000000000120e620e6"], 0x64) ioctl$BTRFS_IOC_BALANCE_CTL(r0, 0x40049421, 0x2) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff) write$tun(r5, &(0x7f0000000000)=ANY=[], 0x38) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x10012, r5, 0x0) r6 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) getsockopt$bt_BT_FLUSHABLE(r6, 0x112, 0x8, &(0x7f00000000c0)=0x2, &(0x7f0000000100)=0x4) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000380)={'rose0\x00'}) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x4000, 0x0) getsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r4, 0x84, 0x72, &(0x7f00000001c0)={0x0, 0xfffff5d3, 0x20}, &(0x7f0000000200)=0xc) r8 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0xc0a41, 0x0) ioctl$TUNSETIFF(r8, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0x4002}) r9 = epoll_create1(0x80000) r10 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r10, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) recvmsg$unix(r11, &(0x7f0000000700)={0x0, 0x0, 0x0}, 0x40002000) epoll_ctl$EPOLL_CTL_ADD(r9, 0x1, r8, &(0x7f0000000600)={0x1000000c}) getsockopt$inet_sctp_SCTP_RESET_STREAMS(r5, 0x84, 0x77, &(0x7f0000000240)={r7, 0xfffc, 0x3, [0x0, 0xb, 0x7]}, &(0x7f0000000280)=0xe) 3.334190665s ago: executing program 5 (id=2938): unshare(0x6a020400) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0xa, 0xe, &(0x7f0000000740)=ANY=[@ANYBLOB="bf16000000000000b70100003b0204007b1ae0ff00000000b7010000000000007b1ae8ff000000007b1af0ff00000000bf61000000000000b702000001000000bfa300000000000007030000e0ffffffb7040000180000008500000049000000b70000000000000095"], &(0x7f0000000440)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000007c0)={r1, 0x0, 0x36, 0x0, &(0x7f00000002c0)="52540012345652540012345786dd600000000000bb4000000000000000002000000000000001fc000000000000000020000000000001", 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000040), 0xffffffffffffffff) pipe(&(0x7f00000007c0)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r3, &(0x7f00000000c0), 0x0, 0x1) close(r3) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) sendto$unix(r3, &(0x7f0000000100)="3682", 0x2, 0x48c71, 0x0, 0x0) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r5, 0x6, 0x1e, &(0x7f0000000180)=0x400000001, 0xc2) setsockopt$inet6_tcp_int(r5, 0x6, 0x2000000000000022, &(0x7f0000000040)=0x1, 0x4) connect$inet6(r5, &(0x7f0000000000)={0xa, 0xc00, 0xbf28, @loopback, 0x25745580}, 0x1c) setsockopt$SO_BINDTODEVICE(r5, 0x1, 0x19, &(0x7f00000000c0)='team_slave_0\x00', 0x10) sendto$inet6(r5, 0x0, 0x0, 0x800, 0x0, 0x0) openat$nci(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) r6 = socket$packet(0x11, 0x3, 0x300) bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x1, 0x5, &(0x7f0000000840)=ANY=[@ANYRESOCT=r3, @ANYRESDEC=r4, @ANYRES32, @ANYRES16=r2, @ANYRESHEX=r3, @ANYBLOB, @ANYBLOB="3b61e65409791a3a0cc9f84107ff2af1930b98ca99f764b20a5aaa1410593d0706fee3c15dd5dcaf3c8a843411013da12c06be1c51abd497693d1c58c69c9780cf5db5dd387e8bd22601b277de46dbcb1fe34972113cbd4fe1e9c06f05f7e86997e72c3b38c074d88e740f02dc9674000b5b2ac1cdd2ddadc5ba2637913446c9328c0ff3f64064fffe177085f74e7b18e8a06535599f4c5e68efcdc39faa45b931ab21f4889311bd7a049976de335c1c3006ac5dbec97c60ad57090c43dd960d7a80fc0f8155e2b80cfd53b13f25b2053fe8ea02b3dcf2387ed19ce416", @ANYRESDEC=r0, @ANYRES64], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x7, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x1}, 0x94) r7 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="9feb010018000000000000004c0000004c0000001c000000000000000000000104000000200000000500000001000004040000000100000001000000000000001800000002000004080000001300000002000000000000000100000001000000200000000076616c006270665f7370696e5f6c6f636b006c6f636b0066"], 0x0, 0x80, 0x0, 0x0, 0x9}, 0x28) r8 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="2300100d", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32=r7, @ANYBLOB="010000000300"/28], 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100), &(0x7f0000000a80), 0x407f, r8, 0x4}, 0x38) r9 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000240)={'syz_tun\x00', 0x0}) sendmsg$IPCTNL_MSG_TIMEOUT_DELETE(r3, &(0x7f0000000480)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="640000000208010400000000000000000600000106000240891200000900010073797a31000000003c00048008000740000000000800094000000db10800ddad709616a6758c0140000088d2080002400000000808000640000001010800064000000009"], 0x64}, 0x1, 0x0, 0x0, 0x8090}, 0xc004) bind$packet(r9, &(0x7f0000000300)={0x11, 0x0, r10, 0x1, 0x0, 0x6, @remote}, 0x14) bind$packet(r6, &(0x7f00000006c0)={0x11, 0x0, r10, 0x1, 0xb, 0x6, @remote}, 0x14) syz_emit_ethernet(0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="ffffffffffff000000000000867078c30000880100000000000000"], 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000540)={0x1e, 0x4, &(0x7f0000000240)=ANY=[@ANYBLOB="1800000001000000000000000000000089120e000000000095"], &(0x7f0000000100)='GPL\x00', 0xb, 0x0, 0x0, 0x0, 0x63, '\x00', 0x0, @sk_lookup=0x24, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3fffffc}, 0x94) 2.79383734s ago: executing program 2 (id=2942): r0 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000080)=ANY=[@ANYBLOB="540000001400b595000000000000000002000000", @ANYRES32=r0, @ANYBLOB="140001000040000000000000000000000000000014000200fe8000000000000000000000000000aa140006"], 0x54}, 0x1, 0x0, 0x0, 0x800}, 0x80) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000080)=ANY=[], 0x6c}, 0x1, 0x0, 0x0, 0x20008824}, 0x4800) r1 = socket$inet6(0xa, 0x3, 0x1) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000580)=@raw={'raw\x00', 0x8, 0x3, 0x560, 0x0, 0xffffffff, 0xffffffff, 0xf0, 0xffffffff, 0x490, 0xffffffff, 0xffffffff, 0x490, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'dvmrp1\x00'}, 0x0, 0xa8, 0xf0}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@mcast2, 'vxcan1\x00', {0x8}}}}, {{@ipv6={@empty, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0xfd}}, [], [0x0, 0xffffffff], 'pim6reg\x00', 'gre0\x00', {}, {}, 0x62}, 0x0, 0x358, 0x3a0, 0x0, {}, [@common=@inet=@hashlimit3={{0x158}, {'veth0_virt_wifi\x00', {0x4, 0x8, 0x20, 0x5e1b2d47, 0xf91, 0x5, 0x4, 0x9f7, 0x18}, {0x8}}}, @common=@inet=@hashlimit3={{0x158}, {'wg1\x00', {0x3, 0x0, 0x41, 0x0, 0x0, 0x1000, 0x6, 0x5}}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@mcast2, 'bridge_slave_0\x00', {0x53}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x5c0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000400)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWRULE={0x58, 0x6, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x405}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_EXPRESSIONS={0x2c, 0x4, 0x0, 0x1, [{0x28, 0x1, 0x0, 0x1, @fib={{0x8}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_FIB_RESULT={0x8, 0x2, 0x1, 0x0, 0x2}, @NFTA_FIB_DREG={0x8, 0x1, 0x1, 0x0, 0x11}, @NFTA_FIB_FLAGS={0x8, 0x3, 0x1, 0x0, 0x31}]}}}]}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x80}, 0x1, 0x0, 0x0, 0x4004000}, 0x24000000) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x23, &(0x7f0000000b40)={&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x0, 0x0, &(0x7f0000000100)=""/65, 0x41, 0x1, &(0x7f0000000480)=""/220, 0xdc}, &(0x7f0000000b80)=0x40) ioctl$SIOCSIFHWADDR(r3, 0x8923, &(0x7f00000000c0)={'bond_slave_1\x00', @random="0163014030d9"}) 2.310765599s ago: executing program 2 (id=2944): sendmsg$IPCTNL_MSG_EXP_NEW(0xffffffffffffffff, 0x0, 0x4008000) r0 = socket(0x10, 0x803, 0x0) socket(0x10, 0x3, 0x0) sendto(r0, &(0x7f0000000c40)="120000001200e7ef007b0000000000faffa0", 0x12, 0x8800, 0x0, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=@newlink={0x3c, 0x10, 0xffffffffffffffff, 0x70bd27, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, 0x11d15}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @geneve={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GENEVE_REMOTE={0x8, 0x2, @dev={0xac, 0x14, 0x14, 0x25}}]}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x2c001}, 0x8000) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000040)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x0, 0x0, 0x4}, {0x0, [0x5f, 0x61]}}, &(0x7f0000000080)=""/112, 0x1c, 0x70, 0x0, 0x6, 0x10000}, 0x28) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0x80, &(0x7f0000000380), 0x0, &(0x7f0000000600)=""/191, 0xbf}, 0x5}], 0x1, 0x2000, &(0x7f0000003700)={0x77359400}) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f00000001c0)={'batadv_slave_1\x00'}) 1.967851861s ago: executing program 2 (id=2947): socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) syz_emit_ethernet(0x56, &(0x7f0000000440)={@local, @broadcast, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "4dd318", 0x20, 0x6, 0x0, @initdev={0xfe, 0x88, '\x00', 0xff, 0x0}, @local, {[], {{0x0, 0x4001, 0x41424344, 0x41424344, 0x0, 0x0, 0x8, 0xc2, 0x0, 0x0, 0x1800, {[@generic={0x4, 0x7, "0000c9f498"}, @fastopen={0x22, 0x2}]}}}}}}}}, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r1, 0x0, 0x6, 0x0) write$cgroup_devices(r1, 0x0, 0x6) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB, @ANYRES16=r3, @ANYBLOB], 0x24}}, 0x0) sendmsg$NL80211_CMD_SET_KEY(r2, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="050002000000000000000a00000008000300", @ANYRES32=r4, @ANYBLOB="10005080050002000600000004000a00"], 0x2c}}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x1f, 0xb, &(0x7f00000002c0)=ANY=[@ANYBLOB="180000000000000000000000ffffffff180100002020642500000000bfa100000000000007010000f8ffffffb702000008000078050000000000000056ff00006c000000953abfb85ac4187a0000000000000026b4f7e70e60820e8fa27bef59ede5d47e754b0926b658beeed810defecab510a6ea97728c26e3b39da5a6c3e21b534f48133e6a42cdbd9f1c10506481b35ec7c4415f17f4c5c0316ad5ae299891f2e33d10676c132a4410518a7d3079544d"], &(0x7f0000000140)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x11, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x7ff}, 0x94) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x3000007, 0x31, r1, 0x0) write$cgroup_pressure(r1, &(0x7f0000000080)={'full', 0x20, 0xff, 0x20, 0x7}, 0x2f) r5 = socket$inet_smc(0x2b, 0x1, 0x0) listen(r5, 0xe) ioctl$PPPIOCSACTIVE(r1, 0x40107446, &(0x7f0000000100)={0x3, &(0x7f00000000c0)=[{0x3, 0x2e, 0xfa, 0x2}, {0x3, 0xa2, 0xc7, 0x7fff}, {0x9, 0xd1, 0x4, 0xbf}]}) bind$inet(r5, &(0x7f0000000040)={0x2, 0x4e22, @private=0xa010102}, 0x70) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000000ac0)=ANY=[@ANYBLOB="b700000081000000bfa30000000000000703000005feffff720af0fff8ffffff71a4f0ff000000002d030000000000001d400500000000004704000001ed000072030000000000001d44000000000000db0a00fee10000007303000000000000b500f3ff000000009500000000000000023bc065b58111c6dfa041b63af4a3912435f1a864a710aad58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a7168c50000000190f32050e436fe275daf51efd601b6bf01c8e8b1b526375ec4dd6fcd82e4fee5bef7af9aa0d7d600c095199fe3ff3128e599b0eaebbdbd732c9cc00eec363e4a8f6456e2cc21557c0afc646cb7798b3e6440c2fbdb00a3e35208b0bb0d2cd829e654400e2438ec649dc74a28610643a98d9ec21ead2ed51b104d4d91af25b845d8a7925c3109b151b8b9f75dd08d123deda88c658d42ecbf28bf7076c15b463bebc72f526d8e8afcb913466aaa7f6df70252e79166d858fcd0e06dd31af9612f2460d0b11008e59a5923906f88b53987ad1714e72ba7a54f0c33d39000d06a59ff616236fd9aa58f2477184b6a89adaf17b0a6041bdef728d236619074d6ebdfd1f5089048ddff6da40f9411fe722631cb467600ade70063e5291569b33d21dae356e1c51f03a801be8189679a16da18ec0ae564162a27afea62d84f3a10746443d6438e959532e0617d419c6bc6ea9f2bca4464f56e24e6d2105bd901204a1deeed4155617572652d950ad31928b0b0c3dc2869f478341d02d0f5ad94b081fcd507acb4b9c65fee9d5a17f48a7382f13d000000225d85ae49cee383dc5049076b989b40000000000000da60d2ae20cfb91d6a49964757cdf538f9ce2bdb1ab062cd54e67011d355d84ce97bb0c6b4a595e487efbb2d71cde2c140952f9a0f0bc6980fe78683ac5c0c31032599ddd71063be9261b2e1aab1675b34a22048ef8c126aeef5f510a8f1aded94a129e4aec6f8d9ab06faffc3a15d96c2ea3e2e04cfe031b2875353193f82ade69d0540059fe6c7fe7cd8697502c7596566d674e425da5e87e59602a9f6590521d31d3804b3e0a1053abdc31282dfb15eb6841bb64a1b304502dda787343ce3c953992e4a982f3c48153baae244e7bf37548c7f1a4cad2422ee965a38f7defbd2160242b104e20dc2d9b0c35608d402ccdd9069bd50b994fda7a9de44028d6112a0c2d21b2dc98816106dec28eaeb883418f562ae00003ea96d10f172c0374d6eed826416050000000bfe9b4a9c5a90ff59d54d1f92ecc4e95dd2d18383117c039862198899b212c55318294270a1ad10c80fef7c24d47afce829ba0f85da6d888f18ea40ab959f6074ab2a40d85d15017ab513cdc6c0e57fb1c1ca571380d7b4ead35a385e0b4a26b702396df7e0c1e02b6e4114f244a9bf93f04bf072f0861f7580e69db384ac7eeedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba34015ea5aacb1188883ad2a3b1832371fe5bc621426d1ed0a4a99702cc1b6912a1e717d29135753208165b9cdbae2ed9dc7358f0ebadde0b727f27feeb744ddcc536cbae315c7d1fe1399562ba6824840bd2951680f6f2f9a6a8346962a350845ffa0d829e4f79adc287906943408e6df3c391e97ba48db0a5adbfd03aac93df8866fb010aec0e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00000000c95265b2bd83d64a532869d701723fedcbada1ee7baa5b6a686b50f0937f778af083e055f6138a757ebd0ed91124a6b244f9acf41ac5d73a008364e0606a594817031fc2f52c8785fe0721719b3d654026c6ea08b83b123145ab5703dad844ceb201ddeb6dc5f6a903792283c42efc54fa84323afc4c10eff462c8843187f1dd48ef3fa293774d582956ff0f40b10ca94f6feeb2893c17888e1cdba94a6ea80c33ead5722c3293a493f1479531dd88261458f40d31fe8df15efaaeea831555877f9538d6ee6ba65893ff1f908ba7554ba583fef3ec7932f5954f31a878e2fae6691d1aee1da02ba516467df3e7d1daac43738012e4fee18a22da19fcdb4c2890cda1f96b952511e3a69d694d625e0b2f808890205f3a6da2819d2f9e77c7c64affa54fec0136cbafa5f62e96753b639a924599c1f69219927ea5301fff0a6063d427f0688430754c02180d61542c2571f983e9673560000000000000000005a7b57f03ca91a01ba2e30ca99e8ebc15ecb4d91675767999d146aef7799738b292fd640dfef6b04d086f737a159d7e0c6e4d81ad64a8bbca48568325b2969e2b15f36b788bce5ccdbaf75c94cb93499f6947a967a7bce14c6de4e7c0660d80010f5c653d22d49030a8c2a4ab595bf4238f18ca428dafc7ac96d404607a0000000051a2104f22e6db5a62b5089c1b45282d38864daa3ae81d6b0968d1d2867b91b7d120617d12d91db2633d6864da40b54783a17aaeb6737c323f9f98e354cc98dcfe23ad01bd1c61563e69ffe1c2c73e1661261173f359e93d2c5e424c17998809ec8f0232b3955e052a4cecd89008f70314a0bdd491ec86a4555d89fe0120f64c62e8e3ed8bcb45202c3d4bbec8d722824c0ebca8db1ea4a003d2fbdc1f9be78537756ab5bbe4fe9af5d785d0128171c90d9900ce2532b0f9d01c4b45294fbba468df3e1b393cb4e62e754598e47df6bd06431c94bc5d047899fd219f448bf9189c65c9d91eda6b52a373803a9efe44f86909bc90addb7b9aee813df534aac4b3093c91b8068cd849904568916694d461b76a58d88cf0f520310a1e9fdc18cde98d662eee077515d0a8811922929e085392ab3d1311b8243266d87047f601fa88a0da36b9f302e8262395174328f2482d14008de83070744f143fdec90ba5a82668d5fac114c13955ad6dca5db2231d8ba14c54c47ed04a4b4ace17e357e1d6432399f87a7a14245bbd796a09313b247b95d37ff40a404bdad74bd20000000000000000000099fef7cd7af3ce64a92f95d89d125b1e641240d7e5e27a3d1f7684448c3e3822d617e205061298b939a191be4b48e169bde2cae3accc5bd40a2968b59c93d35f8e42366fdef9a2abae1cf01ce68abff28861aac8302d268569dd42e194e330c7aaa54ebbcefd23f21ce8153b9926e12e925cb56119df72c7533a48d028ad0c74e2a9478fa3be18a1a2b65079cc1c7bc46dd12305a1ae9dd19e8d525206c0a728cfd42193abe8130bc01a2d69841f3d7799ac04bdc590bb1c89b9c695f163e57343c9bfb59909433c9001c5f8b23e38534a538fc933cac6c2a92d038df638a0f226df9fb857bd414c2cd69985e8053e3dfa41614d7c74d04d8c2471041d17c730fad28395f8d4688898cd58b9d600c851626529bb58aa364b55e73f053450665e7b94ad1012fd7a8139166fd5e59c84f4ab279b1b99c028db4cb9680c8035f967db18de738844da7e260a830c1ffa49f5af3c15423a0e315acb82a3e89218cb314e68fda4d94aa1d815babc13b9fd336d205c5913ef67"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0xfffffffffffffd00}, 0x48) 1.663139214s ago: executing program 1 (id=2951): r0 = socket$kcm(0x10, 0x2, 0x0) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="180000001800599c6d0e0000ded650492d"], 0xfe33) syz_emit_ethernet(0xfdef, &(0x7f0000000000)=ANY=[@ANYBLOB="aaaaaaaaaaaa00000000000088a800008100000086dd605f106000242f00fc000000000000000000000000000000ff020000000000000000000000b9a3a4c13672447200000000000800000086dd080088be86ddffff100000000100000000000000080022eb00000000200000000200000000000000000000000800655800000000"], 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000440)={'batadv_slave_1\x00', 0x0}) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000540)) sendmsg$inet(r0, &(0x7f0000000500)={&(0x7f00000000c0)={0x2, 0x4e20, @remote}, 0x10, &(0x7f0000000400)=[{&(0x7f0000000100)="781a70b402f43103eccf7c13d30d8c658e7ce8d708bcbb66d8cae9a464e49c425efc61b97c5b37165a79e3eb54381a127fdd90425afdb9501076fe3c13b4f5cb3f62ee13d97e9ea7bb344a337c1906d7923e371c38bb3821889722cb2a828bc66a572d58b94f3d5041d686954da3293757150906e8077ba98a9fcd128e91f99b2d34659acbd0add36c2f0c95c777e69367c33f78d0c44a73d0d6614136c075a83b85dd03199eb5fcfca5a1dad5fc9d9b7c2bd2dc82b97959b2b837d04a60a4b69c", 0xc1}, {&(0x7f0000000200)="1c81f8319ec6bb34969b0c255dc2f59274c296e2008219b54a7eea057d30c9f65ed8d5fef6ccfa8dd8e2e219c680a43a3144036ba77c25488135ddfa197ade678792f881000a48f03b5b64c1d0c36f366f9ed2a057c02707d6d33f788dbb63b81e3f73ede0df3bf8765fdc4783499e2747ea1ab3242806cfff809c601f9d05fbf006c7eeb0fbe22fcda6bf8cf1d9c4b8d518a9d5f36e50df06a9f8a1bad7", 0x9e}, {&(0x7f00000002c0)="658f098fe7da869a56419fb2aa5547fe33ed11b283f3211cacd6497a248dd2ed0d2a7b6d15d4fc5f05231bc6b6272143044f37d92c63d4ec04f7678a34e4cebaee24a70ebcfde8ffb0d3b7", 0x4b}, {&(0x7f0000000340)="2a57d318017f790821d371c30addd6fb9fdbe08170d35d32fbf8fdeb1d58c00a415f996cd9a355f8eb0f64e531859afe988e828399d90cada0043072c07e82bd497b49138560c1d2795805e96dac6a1101dee2e87cd9d1289ca5e4bae4099f4b5f8a1ca5fbb7ec584579ec43624e7c91f213325ff51ecb89023952a540495676ec8652767ae09bdf13a23e03cba7d111752c18d6cdcbc9856a08747b", 0x9c}], 0x4, &(0x7f0000000480)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {r1, @rand_addr=0x64010101, @empty}}}, @ip_tos_int={{0x14, 0x0, 0x1, 0x2}}, @ip_retopts={{0x18, 0x0, 0x7, {[@ssrr={0x89, 0x7, 0xd8, [@local]}, @end]}}}], 0x50}, 0x20000090) 1.525933709s ago: executing program 3 (id=2952): bpf$MAP_CREATE(0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="100000000400000008000000665a90f099700500590900000000c603dbec8680a688a6309623976adc4786ef8c8b3efa26f8b68a2143b94d91cb2941d083c48dc7cee3c8d371a4f3a222f4a7773b02d77165dd4a8ca5cde42b60ef83e0f8ded7eb58a443f855dc7a79c942c205b35c09519c141fab15059eaaadd68b08807f7fcba9c2d4b0d6148e1ac03e232f35543fa1909c8486d2f6b34250dfdf48642a6cf98d1549f0c79e9a6db67e3a8fe97a814ab27949982e26a57eaf16e83724918292", @ANYRES32, @ANYBLOB="1000"/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) openat$cgroup_int(r0, &(0x7f0000000100)='cpuset.cpus\x00', 0x2, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x1e, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x1, 0x2, 0x3, 0x2, 0x1, 0x25}]}, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x80) r1 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000000c0), 0x48) bpf$MAP_LOOKUP_ELEM(0x5, &(0x7f00000000c0)={r1, &(0x7f0000000000), &(0x7f0000000040)=""/73}, 0x70) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f00000001c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bc82000000000000a6020000f8ffffffb703000008000000b703000000000000850000003300000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_COALESCE_SET(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000001c0)={0x3c, r5, 0x1, 0x170bf2a, 0x25dfdbff, {}, [@ETHTOOL_A_COALESCE_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'netdevsim0\x00'}]}, @ETHTOOL_A_COALESCE_USE_ADAPTIVE_RX={0x5}, @ETHTOOL_A_COALESCE_RX_MAX_FRAMES_LOW={0x8, 0xf, 0x4}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4920}, 0x44820) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000300)={r3, 0x18000000000002a0, 0xa4, 0x0, &(0x7f0000000380)="b9ff03076804368c989e14f0882844618566ccc4c6c47e9720e4b8c79e9a71f2ebdde23cdcbba84ec843973caac76ca048428ea05521c9733017fbc69b144a5dad2ff5b860311ea353a5cb2530e980793e60d12ae17f1f0115d6ef748404b1c6a59f7bf59dadaf21d4331ce8e4cfc06ef9866b3cbc35dbf460f588a8ebab9a14f5c00c1d0d6c629bfc1bbea20a293a831f05c467b27494509300"/164, 0x0, 0x53e, 0x60000000, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x9}, 0x22) 1.378198904s ago: executing program 3 (id=2953): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="2c0000001800050000000000000000002d00000000000000010100000500010008000000080004"], 0x2c}}, 0x0) ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE(r0, 0x4048587b, &(0x7f0000000280)={{r0, &(0x7f0000000040)=':\x00', 0x109081, &(0x7f0000000080)={@_ha_fsid={[0xe, 0x7fff]}, {0x3, 0x800, 0xc6, 0x7fffffffffffffff}}, 0x0, &(0x7f00000000c0)={@_ha_fsid}, &(0x7f0000000140)=0x3f9}, 0x1, &(0x7f0000000240)=[{0x1, 0x9, &(0x7f0000000180)='\x00', &(0x7f00000001c0), 0x0, 0x38}]}) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000340), 0xffffffffffffffff) syz_emit_ethernet(0x82, &(0x7f0000000100)={@multicast, @remote, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x74, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x3, 0x1, 0x0, 0x3, 0x61, 0x0, {0x16, 0x4, 0x0, 0x0, 0x0, 0x0, 0x4000, 0x0, 0x2f, 0x9, @dev={0xac, 0x14, 0x14, 0x10}, @dev={0xac, 0x14, 0x14, 0x26}, {[@timestamp_addr={0x44, 0x44, 0x0, 0x1, 0x0, [{@rand_addr=0x86dd}, {@remote}, {@dev={0xac, 0x14, 0x14, 0x32}, 0x800000}, {@rand_addr, 0x800}, {@multicast2}, {@loopback}, {@local, 0x10}, {@multicast1}]}]}}}}}}}, 0x0) sendmsg$NL80211_CMD_JOIN_MESH(r1, &(0x7f0000000400)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x2c, r2, 0x4, 0x70bd29, 0x25dfdbfc, {{}, {@void, @val={0xc, 0x99, {0xcb97, 0x3e}}}}, [@NL80211_ATTR_MESH_ID={0xa}]}, 0x2c}, 0x1, 0x0, 0x0, 0x8800}, 0x0) 1.352000645s ago: executing program 3 (id=2954): r0 = socket$packet(0x11, 0x4, 0x300) sendto$packet(r0, 0x0, 0x0, 0x40000, &(0x7f0000000080)={0x11, 0xe3, 0x0, 0x1, 0xa, 0x6, @random="481036ad4396"}, 0x14) socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) socket$packet(0x11, 0x3, 0x300) r2 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000001c0)={'macsec0\x00', 0x0}) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000440)=@getchain={0x24, 0x11, 0x1, 0xfffffffe, 0x2000001, {0x0, 0x0, 0x0, r3, {0x5, 0xa}, {0xd, 0x9}, {0x8}}}, 0x24}, 0x1, 0x0, 0x0, 0x4000000}, 0x20040054) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000500)=ANY=[@ANYBLOB="ec00000010000108000000008100000000000000", @ANYRES32, @ANYBLOB="0b00000000000000cc001a8018000a80140007"], 0xec}, 0x1, 0x0, 0x0, 0x20000010}, 0x200080c4) sendmsg$nl_generic(r1, 0x0, 0x84) 1.283985057s ago: executing program 1 (id=2955): r0 = socket$igmp6(0xa, 0x3, 0x3a) setsockopt$MRT6_ADD_MFC(r0, 0x29, 0x22, &(0x7f0000000080)={{0xa, 0x0, 0x101, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}, {0xa, 0x4e23, 0x3, @dev, 0x400000}, 0xffffffffffffffff, {[0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0xa4ffffff, 0x200]}}, 0x5c) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket$can_j1939(0x1d, 0x2, 0x7) socket$nl_generic(0x10, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f00000000c0)={'vcan0\x00', 0x0}) bind$can_j1939(r2, &(0x7f0000000340)={0x1d, r3, 0x0, {0x2, 0x0, 0x6}, 0xfe}, 0x18) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000002100)={&(0x7f0000000080)=ANY=[@ANYBLOB="4800000010001fff2bbd70000000000000000000", @ANYRES32=r3, @ANYBLOB="23000000bb10030028001280090001007665746800000000180002801400010000000000", @ANYRES32=0x0, @ANYBLOB="d41250284cb48261"], 0x48}, 0x1, 0x0, 0x0, 0x20000081}, 0x24008000) connect$netlink(r1, &(0x7f0000000000)=@proc={0x10, 0x0, 0x25dfdbfd}, 0xc) 1.129766944s ago: executing program 3 (id=2956): setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f00000000c0)={0x0, 0x3, 0x5}, 0x8) r0 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt(r0, 0x84, 0x71, &(0x7f0000000000)="03040000008002ff", 0x8) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x161042, 0x0) ioctl$PPPIOCNEWUNIT(r1, 0xc004743e, &(0x7f0000000000)=0x3) ioctl$PPPIOCSPASS(r1, 0x40107447, &(0x7f0000000080)={0x1, &(0x7f00000001c0)=[{0x6, 0x0, 0x0, 0x8}]}) close(0x3) 1.092854133s ago: executing program 1 (id=2957): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x8080}, 0x20004450) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000440)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWRULE={0x2c, 0x6, 0xa, 0x41f, 0x0, 0x0, {0xa, 0x0, 0x6}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x5}}}, 0x54}, 0x1, 0x0, 0x0, 0x200000c4}, 0x24000840) 1.010691129s ago: executing program 3 (id=2958): r0 = socket$igmp6(0xa, 0x3, 0x2) shutdown(r0, 0x0) recvmmsg(r0, &(0x7f0000004cc0)=[{{0x0, 0x0, 0x0}, 0x8}, {{0x0, 0x0, 0x0}, 0x1ff}], 0x2, 0x40010000, 0x0) r1 = socket(0xa, 0x3, 0x3a) setsockopt$MRT6_INIT(r1, 0x29, 0xc8, &(0x7f0000000340), 0x4) setsockopt$MRT6_ADD_MIF(r1, 0x29, 0xca, 0x0, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000400)=ANY=[@ANYBLOB="440014001000010429bd15bc9af6010000100200", @ANYRES32=0x0, @ANYBLOB="0000000000000000240012800e00010069703665727370616e00000010000280080005000200000004001200"], 0x44}, 0x1, 0x0, 0x0, 0x4}, 0x0) r3 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) close(r3) socket$netlink(0x10, 0x3, 0x0) r4 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4000000000000007910480000000000610400000000000095000080"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x48) r5 = syz_genetlink_get_family_id$tipc(&(0x7f0000000140), r1) sendmsg$TIPC_CMD_ENABLE_BEARER(r1, &(0x7f0000000480)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000180)={0x34, r5, 0x100, 0x70bd29, 0x25dfdbff, {{}, {}, {0x18, 0x17, {0x19, 0x0, @udp='udp:syz1\x00'}}}, ["", "", "", "", "", "", "", "", ""]}, 0x34}, 0x1, 0x0, 0x0, 0x80}, 0x20004010) close(r4) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000029c0)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000540)=ANY=[@ANYBLOB="b4050000fdff7f006110580000000000c60000000000000095000000000000009f33ef60916e6e713f1eeb0b725ad99b817fd98cd8073a46b08b94214d816f770600dcca55f21f3ca9e822d182054d54d53cd2b6db714e4beb4147000001000000008f2b9000f22425e4097ed62cbc891061017cfa6f6148a1c1e43f00001bde60beac671e8e8fdecb03588aa623fa71f31bf0f871ab5c2ff88afc60027f4e5b5271ed58e835cf0d0000000098b51fe68db8d9dbe87dcff414ed000000000000000000000000000000000000000000000000000000b347abe6352a080f8140e5fd10747b6ecdb3542646bf636e3d6e700e5b0500000000000000eb9e1403e6c8f7a187eaf60f3a17f0f046a307a403c19d9829c90bd2114252581567acae715cbe1b57d5cda432c5b910400623d24195405f2e76ccb7b37b41215c184e731fb1"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x366, 0x10, &(0x7f0000000000), 0x1dd}, 0x48) r8 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0f00000004000000040000001200000000000000", @ANYRES32, @ANYBLOB="0021040000000000000000003b49166f34af7201", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000380)=ANY=[@ANYRES32=r8, @ANYRES32=r7, @ANYBLOB='&'], 0x10) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f00000007c0)={0x0}}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000740)={0x11, 0x0, 0x0, &(0x7f00000001c0)='GPL\x00', 0x9, 0x6a, &(0x7f00000002c0)=""/106, 0x41000, 0x27, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000006c0)=[r8], &(0x7f0000000700), 0x10, 0x10}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000000c0)={{r8}, &(0x7f0000000000), &(0x7f0000000080)=r4}, 0x20) sendmsg$inet(r6, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000001740)=[{&(0x7f0000000280)='>', 0x20000281}], 0x1}, 0x0) recvmmsg(r3, &(0x7f00000055c0), 0x400023c, 0x300, 0x0) r9 = socket$inet(0x2, 0x2, 0x0) setsockopt$MRT6_DEL_MFC(r1, 0x29, 0xcd, &(0x7f0000000080)={{0xa, 0x4e20, 0xfffffffd, @private2={0xfc, 0x2, '\x00', 0x1}, 0xd}, {0xa, 0x4e22, 0x762e7e93, @private2={0xfc, 0x2, '\x00', 0x1}, 0x8001}, 0x0, {[0x8000, 0x800008, 0x0, 0x4, 0x8, 0x4, 0x7, 0x2c0]}}, 0x5c) setsockopt$IPT_SO_SET_REPLACE(r9, 0x0, 0x40, &(0x7f0000000600)=@nat={'nat\x00', 0x670, 0x5, 0x368, 0xd8, 0x170, 0xffffffff, 0xd8, 0x228, 0x2d0, 0x2d0, 0xffffffff, 0x2d0, 0x2d0, 0x5, 0x0, {[{{@ip={@rand_addr=0x64010100, @rand_addr=0x64010101, 0xff, 0x0, 'veth1_macvtap\x00', 'ipvlan1\x00', {0xff}, {}, 0x33, 0x2, 0x14}, 0x0, 0xa0, 0xd8, 0x48, {}, [@common=@ah={{0x30}, {[0x1, 0x3]}}]}, @DNAT0={0x38, 'DNAT\x00', 0x0, {0x1, {0xf, @local, @initdev={0xac, 0x1e, 0x0, 0x0}, @icmp_id=0x67, @port=0x4e24}}}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffffffffffff}}, {{@ip={@initdev={0xac, 0x1e, 0x0, 0x0}, @broadcast, 0x0, 0x0, 'virt_wifi0\x00', 'veth1_vlan\x00'}, 0x0, 0x70, 0xb8}, @unspec=@SNAT1={0x48, 'SNAT\x00', 0x1, {0xe, @ipv6=@ipv4={'\x00', '\xff\xff', @empty}, @ipv6=@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @icmp_id=0x65, @port=0x4e21}}}, {{@ip={@private=0xa010100, @empty, 0x0, 0x0, 'nicvf0\x00', 'nr0\x00'}, 0x0, 0x70, 0xa8}, @DNAT0={0x38, 'DNAT\x00', 0x0, {0x1, {0x0, @rand_addr, @dev={0xac, 0x14, 0x14, 0x2a}, @gre_key=0xe, @icmp_id}}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x3c8) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, 0x0, 0x0) close(0x3) 907.795751ms ago: executing program 1 (id=2959): r0 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000280)=@bpf_lsm={0x6, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="18000000003f000000000000000000f195"], &(0x7f0000000140)='GPL\x00'}, 0x80) r1 = bpf$ITER_CREATE(0xb, &(0x7f00000004c0)={r0}, 0x8) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000080)={&(0x7f0000000040)=ANY=[@ANYBLOB="9feb0100180000000000000020000000200000000400000001000000000000010400000020000000010000000000000108"], 0x0, 0x3c}, 0x28) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=ANY=[@ANYRES32=r2, @ANYRESHEX=r3, @ANYRESDEC=r3], 0x40) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000240)={{r4}, &(0x7f00000000c0), &(0x7f0000000140)='%+9llu \x00'}, 0x20) r5 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0) close(0x4) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$nbd(&(0x7f00000000c0), 0xffffffffffffffff) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000040)={&(0x7f0000000540)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x28, 0x28, 0x4, [@datasec={0x2, 0x1, 0x0, 0xf, 0x3, [{0x2, 0x1, 0x3}], "44942d"}, @datasec={0x0, 0x0, 0x0, 0xf, 0x1, [], "9a"}]}, {0x0, [0x2e, 0x2e]}}, 0x0, 0x44, 0x0, 0x1}, 0x28) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) sendmsg$NBD_CMD_RECONFIGURE(r6, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="63812bbd7000fcdbdf25030000000800010000000000280007800c00018008000100", @ANYRES32=r8, @ANYBLOB="0c00018008000100", @ANYRES32=r9], 0x44}, 0x1, 0x0, 0x0, 0x440c0}, 0x40040) socket$inet6(0xa, 0x5, 0x0) r10 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000200)=@newlink={0x48, 0x10, 0xffffff1f, 0x0, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, 0x4412c}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x18, 0x2, 0x0, 0x1, [@IFLA_BR_GROUP_ADDR={0xa, 0x14, @broadcast}, @IFLA_BR_AGEING_TIME={0x8, 0x9}]}}}]}, 0x48}}, 0x4040) r11 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000180), 0xffffffffffffffff) r12 = socket$nl_generic(0x10, 0x3, 0x10) r13 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$WG_CMD_SET_DEVICE(r12, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000001940)=ANY=[@ANYBLOB="40010000", @ANYRES16=r13, @ANYBLOB="01000000000004000000010000002400030000000000000000000000000000000000000000000000000000000000000000001400020077673100000000000000000000000000f4000880"], 0x140}, 0x1, 0x0, 0x0, 0x8000}, 0x0) sendmsg$WG_CMD_SET_DEVICE(r12, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB='L\x00\x00\x00', @ANYRES16=r13, @ANYBLOB="01002dbd7000fcdbdf25010000001400020077673100000000000000000000000069d42de66eaf0c0024000300a05ca852600cb00845174f08076f8d7843"], 0x4c}, 0x1, 0x0, 0x0, 0x40090}, 0x44000) sendmsg$NL80211_CMD_SET_STATION(r10, &(0x7f0000000240)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x28, r11, 0x100, 0x70bd2d, 0x25dfdbfc, {{}, {@void, @val={0xc, 0x99, {0x6, 0x37}}}}, [@NL80211_ATTR_AIRTIME_WEIGHT={0x6, 0x112, 0x3}]}, 0x67}, 0x1, 0x0, 0x0, 0x4000020}, 0x40040) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000004c0)=ANY=[@ANYBLOB="18000000260001031dbd7002fadbdf25010000000400ae"], 0x18}}, 0x0) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r1, 0x84, 0x18, &(0x7f0000000400)={0x0, 0x1}, &(0x7f0000000440)=0x8) setsockopt$inet_sctp_SCTP_ADD_STREAMS(r5, 0x84, 0x79, &(0x7f0000000480)={r14, 0x7, 0x3}, 0x8) recvmmsg(0xffffffffffffffff, &(0x7f0000000800)=[{{0x0, 0x0, &(0x7f00000009c0)=[{&(0x7f0000000500)=""/145, 0x91}, {&(0x7f0000003800)=""/4133, 0x1025}, {&(0x7f0000000040)=""/185, 0xb9}, {&(0x7f0000000340)=""/122, 0x7a}, {&(0x7f0000000a40)=""/4093, 0xffd}, {&(0x7f0000000280)=""/65, 0x41}, {&(0x7f0000000300)=""/22, 0x16}], 0x7}, 0xd}, {{0x0, 0x0, 0x0}, 0xffff}, {{0x0, 0x0, 0x0}, 0x10001}, {{0x0, 0x0, 0x0}, 0x7}], 0x4, 0x40000102, 0x0) 603.837856ms ago: executing program 1 (id=2960): r0 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000003c0)={0x1, 0x4, &(0x7f00000005c0)=ANY=[@ANYBLOB="18000000068a00800000000004000000cb2004000001000095"], &(0x7f0000000200)='syzkaller\x00', 0x5, 0xfe5, &(0x7f0000001840)=""/4069, 0x0, 0x2}, 0x94) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IPVS_CMD_NEW_SERVICE(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)={0x4c, r0, 0x1, 0x0, 0x0, {}, [@IPVS_CMD_ATTR_SERVICE={0x38, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_AF={0x6, 0x1, 0x2}, @IPVS_SVC_ATTR_FWMARK={0x8}, @IPVS_SVC_ATTR_FLAGS={0xc}, @IPVS_SVC_ATTR_NETMASK={0x8}, @IPVS_SVC_ATTR_TIMEOUT={0x8}, @IPVS_SVC_ATTR_PE_NAME={0x8, 0x6}]}]}, 0x4c}}, 0x0) 396.571109ms ago: executing program 1 (id=2961): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, &(0x7f0000000200)) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x410c0}, 0x14) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000400)=@bpf_lsm={0x6, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x1, 0x0, 0x3, 0x0, 0x4, 0x10}]}, &(0x7f0000000100)='GPL\x00', 0x5}, 0x94) socket$netlink(0x10, 0x3, 0x0) unshare(0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000003c0)}, 0x0) r2 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) connect$bt_l2cap(r2, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) r3 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000180)={@fallback=r0, 0x33, 0x0, 0x1, &(0x7f0000000040)=[0x0], 0x1, 0x0, &(0x7f00000000c0), &(0x7f0000000100)=[0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000140)=[0x0, 0x0, 0x0]}, 0x40) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x48815, 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) ioctl$sock_bt_hidp_HIDPCONNADD(r3, 0x400448c8, &(0x7f0000000500)={r2, r2, 0x206, 0x0, 0x0, 0x2, 0x72, 0x1, 0x3, 0x7, 0x2, 0x8, 'syz1\x00'}) setsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000000)=0x70c9, 0x4) 0s ago: executing program 3 (id=2962): bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$inet_sctp_SCTP_MAX_BURST(r0, 0x84, 0x14, &(0x7f0000000080)=@int=0x8001, 0x4) bpf$ENABLE_STATS(0x20, 0x0, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x3, 0x4, &(0x7f00000003c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, [@call={0x85, 0x0, 0x0, 0x97}]}, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @sched_cls=0x2f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r1, 0x0, 0x14, 0xe40, &(0x7f00000002c0)='\x00\x00\x00\x00\x00\x00\x00\x00', &(0x7f0000000300)=""/8, 0x320e, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) bpf$MAP_CREATE(0x0, 0x0, 0x0) kernel console output (not intermixed with test programs): robability 0, space 0, times 0 [ 405.491210][T13507] CPU: 1 UID: 0 PID: 13507 Comm: syz.0.1905 Not tainted syzkaller #0 PREEMPT(full) [ 405.491236][T13507] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 405.491250][T13507] Call Trace: [ 405.491259][T13507] [ 405.491269][T13507] dump_stack_lvl+0xe8/0x150 [ 405.491309][T13507] should_fail_ex+0x410/0x560 [ 405.491343][T13507] should_failslab+0xa8/0x100 [ 405.491375][T13507] __kvmalloc_node_noprof+0x176/0x820 [ 405.491406][T13507] ? __rhashtable_init_noprof+0x545/0xaf0 [ 405.491432][T13507] ? __rhashtable_init_noprof+0x545/0xaf0 [ 405.491469][T13507] __rhashtable_init_noprof+0x545/0xaf0 [ 405.491502][T13507] __rhltable_init_noprof+0x26/0x70 [ 405.491530][T13507] sta_info_init+0x62/0x130 [ 405.491638][T13507] ieee80211_alloc_hw_nm+0x808/0x1f00 [ 405.491670][T13507] ? __pfx_ieee80211_emulate_add_chanctx+0x10/0x10 [ 405.491705][T13507] mac80211_hwsim_new_radio+0x1ea/0x5720 [ 405.491753][T13507] ? rcu_is_watching+0x16/0xb0 [ 405.491783][T13507] ? trace_kmalloc+0x2a/0xf0 [ 405.491815][T13507] ? __kmalloc_node_track_caller_noprof+0x4d2/0x720 [ 405.491853][T13507] ? __kmalloc_node_track_caller_noprof+0x2eb/0x720 [ 405.491880][T13507] ? __pfx_mac80211_hwsim_new_radio+0x10/0x10 [ 405.491905][T13507] ? kstrndup+0xbd/0x160 [ 405.491936][T13507] ? kstrndup+0xbd/0x160 [ 405.491963][T13507] hwsim_new_radio_nl+0xd8b/0xf90 [ 405.492014][T13507] genl_family_rcv_msg_doit+0x233/0x340 [ 405.492054][T13507] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 405.492101][T13507] ? bpf_lsm_capable+0x9/0x20 [ 405.492122][T13507] ? security_capable+0x7e/0x2c0 [ 405.492158][T13507] genl_rcv_msg+0x614/0x7a0 [ 405.492197][T13507] ? __pfx_genl_rcv_msg+0x10/0x10 [ 405.492225][T13507] ? __pfx_hwsim_new_radio_nl+0x10/0x10 [ 405.492270][T13507] netlink_rcv_skb+0x226/0x4a0 [ 405.492295][T13507] ? __pfx_genl_rcv_msg+0x10/0x10 [ 405.492327][T13507] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 405.492381][T13507] ? down_read+0x2be/0x330 [ 405.492420][T13507] genl_rcv+0x28/0x40 [ 405.492445][T13507] netlink_unicast+0x7bd/0x940 [ 405.492495][T13507] netlink_sendmsg+0x813/0xb40 [ 405.492532][T13507] ? __pfx_netlink_sendmsg+0x10/0x10 [ 405.492567][T13507] ? apparmor_socket_sendmsg+0x98/0x360 [ 405.492597][T13507] ? __pfx_netlink_sendmsg+0x10/0x10 [ 405.492619][T13507] sock_sendmsg_nosec+0x14e/0x190 [ 405.492647][T13507] ____sys_sendmsg+0x54e/0x850 [ 405.492686][T13507] ? __pfx_____sys_sendmsg+0x10/0x10 [ 405.492730][T13507] ? import_iovec+0x73/0xa0 [ 405.492765][T13507] ___sys_sendmsg+0x2a5/0x360 [ 405.492795][T13507] ? __lock_acquire+0x747/0x2de0 [ 405.492825][T13507] ? __pfx____sys_sendmsg+0x10/0x10 [ 405.492910][T13507] ? __fget_files+0x2a/0x420 [ 405.492941][T13507] ? __fget_files+0x3a2/0x420 [ 405.492987][T13507] __x64_sys_sendmsg+0x1b1/0x290 [ 405.493022][T13507] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 405.493082][T13507] do_syscall_64+0x166/0x520 [ 405.493112][T13507] ? trace_irq_disable+0x3b/0x140 [ 405.493136][T13507] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 405.493160][T13507] ? clear_bhb_loop+0x70/0xc0 [ 405.493189][T13507] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 405.493212][T13507] RIP: 0033:0x7f278e79e159 [ 405.493235][T13507] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 405.493255][T13507] RSP: 002b:00007f278f6eb028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 405.493281][T13507] RAX: ffffffffffffffda RBX: 00007f278ea25fa0 RCX: 00007f278e79e159 [ 405.493298][T13507] RDX: 0000000000000084 RSI: 0000200000000100 RDI: 0000000000000003 [ 405.493313][T13507] RBP: 00007f278f6eb090 R08: 0000000000000000 R09: 0000000000000000 [ 405.493328][T13507] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 405.493342][T13507] R13: 00007f278ea26038 R14: 00007f278ea25fa0 R15: 00007fff1d828ad8 [ 405.493381][T13507] [ 406.180135][T13511] netlink: 'syz.1.1906': attribute type 15 has an invalid length. [ 406.214043][T13514] netlink: 'syz.4.1907': attribute type 2 has an invalid length. [ 406.571440][T13535] FAULT_INJECTION: forcing a failure. [ 406.571440][T13535] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 406.571586][T13535] CPU: 0 UID: 0 PID: 13535 Comm: syz.1.1912 Not tainted syzkaller #0 PREEMPT(full) [ 406.571612][T13535] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 406.571627][T13535] Call Trace: [ 406.571636][T13535] [ 406.571645][T13535] dump_stack_lvl+0xe8/0x150 [ 406.571685][T13535] should_fail_ex+0x410/0x560 [ 406.571718][T13535] _copy_from_iter+0x1d3/0x1660 [ 406.571745][T13535] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 406.571881][T13535] ? __pfx__copy_from_iter+0x10/0x10 [ 406.571913][T13535] ? packet_cached_dev_get+0x1c/0x2b0 [ 406.572021][T13535] ? packet_cached_dev_get+0x1c/0x2b0 [ 406.572058][T13535] packet_sendmsg+0x3088/0x5150 [ 406.572099][T13535] ? __pfx_aa_label_sk_perm+0x10/0x10 [ 406.572163][T13535] ? ktime_get+0x45/0x220 [ 406.572205][T13535] ? __lock_acquire+0x747/0x2de0 [ 406.572241][T13535] ? __pfx_packet_sendmsg+0x10/0x10 [ 406.572265][T13535] ? aa_sk_perm+0x713/0x900 [ 406.572326][T13535] ? percpu_is_read_locked+0x130/0x190 [ 406.572361][T13535] ? __pfx_aa_sk_perm+0x10/0x10 [ 406.572393][T13535] ? aa_sock_msg_perm+0x144/0x210 [ 406.572431][T13535] ? apparmor_socket_sendmsg+0x98/0x360 [ 406.572460][T13535] ? __pfx_packet_sendmsg+0x10/0x10 [ 406.572486][T13535] sock_sendmsg_nosec+0x14e/0x190 [ 406.572514][T13535] ____sys_sendmsg+0x54e/0x850 [ 406.572551][T13535] ? __pfx_____sys_sendmsg+0x10/0x10 [ 406.572593][T13535] ? import_iovec+0x73/0xa0 [ 406.572627][T13535] ___sys_sendmsg+0x2a5/0x360 [ 406.572656][T13535] ? __lock_acquire+0x747/0x2de0 [ 406.572685][T13535] ? __pfx____sys_sendmsg+0x10/0x10 [ 406.572756][T13535] ? __fget_files+0x2a/0x420 [ 406.572787][T13535] ? __fget_files+0x3a2/0x420 [ 406.572830][T13535] __x64_sys_sendmsg+0x1b1/0x290 [ 406.572864][T13535] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 406.572921][T13535] do_syscall_64+0x166/0x520 [ 406.572952][T13535] ? trace_irq_disable+0x3b/0x140 [ 406.572975][T13535] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 406.572998][T13535] ? clear_bhb_loop+0x70/0xc0 [ 406.573026][T13535] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 406.573049][T13535] RIP: 0033:0x7fdfce19e159 [ 406.573071][T13535] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 406.573091][T13535] RSP: 002b:00007fdfcf0fb028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 406.573116][T13535] RAX: ffffffffffffffda RBX: 00007fdfce425fa0 RCX: 00007fdfce19e159 [ 406.573134][T13535] RDX: 00000000040488d0 RSI: 0000200000002ac0 RDI: 0000000000000005 [ 406.573157][T13535] RBP: 00007fdfcf0fb090 R08: 0000000000000000 R09: 0000000000000000 [ 406.573172][T13535] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 406.573186][T13535] R13: 00007fdfce426038 R14: 00007fdfce425fa0 R15: 00007ffd6722e0b8 [ 406.573223][T13535] [ 407.086186][T13542] netlink: 88 bytes leftover after parsing attributes in process `syz.1.1914'. [ 407.086227][T13542] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1914'. [ 407.170410][T13547] netlink: 32 bytes leftover after parsing attributes in process `syz.0.1916'. [ 407.254704][T13551] netlink: 32 bytes leftover after parsing attributes in process `syz.0.1916'. [ 407.386936][T13549] tipc: Enabling of bearer rejected, failed to enable media [ 407.569403][T13564] FAULT_INJECTION: forcing a failure. [ 407.569403][T13564] name failslab, interval 1, probability 0, space 0, times 0 [ 407.569441][T13564] CPU: 0 UID: 0 PID: 13564 Comm: syz.4.1918 Not tainted syzkaller #0 PREEMPT(full) [ 407.569466][T13564] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 407.569479][T13564] Call Trace: [ 407.569488][T13564] [ 407.569498][T13564] dump_stack_lvl+0xe8/0x150 [ 407.569537][T13564] should_fail_ex+0x410/0x560 [ 407.569571][T13564] should_failslab+0xa8/0x100 [ 407.569603][T13564] __kvmalloc_node_noprof+0x176/0x820 [ 407.569635][T13564] ? __rhashtable_init_noprof+0x545/0xaf0 [ 407.569661][T13564] ? __rhashtable_init_noprof+0x545/0xaf0 [ 407.569696][T13564] __rhashtable_init_noprof+0x545/0xaf0 [ 407.569729][T13564] __rhltable_init_noprof+0x26/0x70 [ 407.569759][T13564] sta_info_init+0x62/0x130 [ 407.569784][T13564] ieee80211_alloc_hw_nm+0x808/0x1f00 [ 407.569815][T13564] ? __pfx_ieee80211_emulate_add_chanctx+0x10/0x10 [ 407.569850][T13564] mac80211_hwsim_new_radio+0x1ea/0x5720 [ 407.569896][T13564] ? rcu_is_watching+0x16/0xb0 [ 407.569932][T13564] ? trace_kmalloc+0x2a/0xf0 [ 407.569957][T13564] ? __kmalloc_node_track_caller_noprof+0x4d2/0x720 [ 407.569984][T13564] ? __kmalloc_node_track_caller_noprof+0x2eb/0x720 [ 407.570009][T13564] ? __pfx_mac80211_hwsim_new_radio+0x10/0x10 [ 407.570035][T13564] ? kstrndup+0xbd/0x160 [ 407.570065][T13564] ? kstrndup+0xbd/0x160 [ 407.570092][T13564] hwsim_new_radio_nl+0xd8b/0xf90 [ 407.570142][T13564] genl_family_rcv_msg_doit+0x233/0x340 [ 407.570182][T13564] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 407.570225][T13564] ? bpf_lsm_capable+0x9/0x20 [ 407.570247][T13564] ? security_capable+0x7e/0x2c0 [ 407.570282][T13564] genl_rcv_msg+0x614/0x7a0 [ 407.570324][T13564] ? __pfx_genl_rcv_msg+0x10/0x10 [ 407.570353][T13564] ? __pfx_hwsim_new_radio_nl+0x10/0x10 [ 407.570396][T13564] netlink_rcv_skb+0x226/0x4a0 [ 407.570421][T13564] ? __pfx_genl_rcv_msg+0x10/0x10 [ 407.570452][T13564] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 407.570507][T13564] ? down_read+0x2be/0x330 [ 407.570548][T13564] genl_rcv+0x28/0x40 [ 407.570574][T13564] netlink_unicast+0x7bd/0x940 [ 407.570622][T13564] netlink_sendmsg+0x813/0xb40 [ 407.570656][T13564] ? __pfx_netlink_sendmsg+0x10/0x10 [ 407.570690][T13564] ? apparmor_socket_sendmsg+0x98/0x360 [ 407.570720][T13564] ? __pfx_netlink_sendmsg+0x10/0x10 [ 407.570743][T13564] sock_sendmsg_nosec+0x14e/0x190 [ 407.570770][T13564] ____sys_sendmsg+0x54e/0x850 [ 407.570809][T13564] ? __pfx_____sys_sendmsg+0x10/0x10 [ 407.570852][T13564] ? import_iovec+0x73/0xa0 [ 407.570887][T13564] ___sys_sendmsg+0x2a5/0x360 [ 407.570924][T13564] ? __lock_acquire+0x747/0x2de0 [ 407.570954][T13564] ? __pfx____sys_sendmsg+0x10/0x10 [ 407.571030][T13564] ? __fget_files+0x2a/0x420 [ 407.571062][T13564] ? __fget_files+0x3a2/0x420 [ 407.571107][T13564] __x64_sys_sendmsg+0x1b1/0x290 [ 407.571142][T13564] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 407.571200][T13564] do_syscall_64+0x166/0x520 [ 407.571231][T13564] ? trace_irq_disable+0x3b/0x140 [ 407.571254][T13564] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 407.571279][T13564] ? clear_bhb_loop+0x70/0xc0 [ 407.571308][T13564] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 407.571332][T13564] RIP: 0033:0x7f2e85f9e159 [ 407.571352][T13564] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 407.571373][T13564] RSP: 002b:00007f2e86dbf028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 407.571397][T13564] RAX: ffffffffffffffda RBX: 00007f2e86225fa0 RCX: 00007f2e85f9e159 [ 407.571415][T13564] RDX: 0000000000000084 RSI: 0000200000000100 RDI: 0000000000000003 [ 407.571430][T13564] RBP: 00007f2e86dbf090 R08: 0000000000000000 R09: 0000000000000000 [ 407.571445][T13564] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 407.571458][T13564] R13: 00007f2e86226038 R14: 00007f2e86225fa0 R15: 00007ffee700f488 [ 407.571498][T13564] [ 408.045641][T13567] erspan0: entered promiscuous mode [ 408.050808][T13567] erspan0: left promiscuous mode [ 408.283201][T13584] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1923'. [ 408.572925][T13595] netlink: 'syz.2.1927': attribute type 7 has an invalid length. [ 408.572952][T13595] netlink: 'syz.2.1927': attribute type 8 has an invalid length. [ 408.723771][T13605] netlink: 64 bytes leftover after parsing attributes in process `syz.4.1929'. [ 408.763120][T13605] syzkaller1: entered promiscuous mode [ 408.763145][T13605] syzkaller1: entered allmulticast mode [ 409.034441][T13603] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1928'. [ 409.146066][T13618] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1933'. [ 409.146094][T13618] openvswitch: netlink: Key type 29 is not supported [ 409.254659][T13628] netlink: 'syz.4.1934': attribute type 1 has an invalid length. [ 409.371003][T13632] bond5: (slave geneve3): making interface the new active one [ 409.381044][T13632] bond5: (slave geneve3): Enslaving as an active interface with an up link [ 409.397830][T13628] netlink: 28 bytes leftover after parsing attributes in process `syz.4.1934'. [ 409.400470][T13628] 8021q: adding VLAN 0 to HW filter on device bond5 [ 409.405843][T11551] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 20000 - 0 [ 409.405986][T11551] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 20000 - 0 [ 409.406098][T11551] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 20000 - 0 [ 409.406205][T11551] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 20000 - 0 [ 409.477142][T13628] netlink: 24 bytes leftover after parsing attributes in process `syz.4.1934'. [ 409.477177][T13628] netlink: 'syz.4.1934': attribute type 5 has an invalid length. [ 409.502286][T13630] netlink: 'syz.2.1933': attribute type 1 has an invalid length. [ 409.627871][T13630] bond6: option mode: invalid value (233) [ 409.674681][T13630] bond6 (unregistering): Released all slaves [ 410.236388][T13666] xt_CONNSECMARK: only valid in 'mangle' or 'security' table, not 'raw' [ 410.375724][T13666] xt_CT: No such helper "netbios-ns" [ 410.662824][T13685] ip_tables: iptables: counters copy to user failed while replacing table [ 410.747099][T13679] 8021q: adding VLAN 0 to HW filter on device bond0 [ 410.765518][T13679] 8021q: adding VLAN 0 to HW filter on device team0 [ 410.847556][T13679] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 410.848719][T13679] tipc: Resetting bearer [ 410.849026][T13679] tipc: Resetting bearer [ 410.879448][T13679] veth1_vlan: left promiscuous mode [ 410.880727][T13679] veth0_vlan: left promiscuous mode [ 410.893774][T13679] veth0_vlan: entered promiscuous mode [ 410.897057][T13679] veth1_vlan: entered promiscuous mode [ 410.916152][T13679] veth1_macvtap: left promiscuous mode [ 410.918466][T13679] veth0_macvtap: left promiscuous mode [ 410.919639][T13679] veth0_macvtap: entered promiscuous mode [ 410.920891][T13679] veth1_macvtap: entered promiscuous mode [ 410.960280][T13679] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 410.970586][T13679] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 410.979888][T13679] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 410.981326][T13679] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 411.003901][T13679] mac80211_hwsim hwsim8 wlan0: entered promiscuous mode [ 411.024585][T13679] 8021q: adding VLAN 0 to HW filter on device bond1 [ 411.040716][T13679] 8021q: adding VLAN 0 to HW filter on device bond2 [ 411.057314][T13679] 8021q: adding VLAN 0 to HW filter on device bond3 [ 411.059826][T13679] 8021q: adding VLAN 0 to HW filter on device bond4 [ 411.081895][T13679] bridge0: port 1(vlan6) entered blocking state [ 411.082029][T13679] bridge0: port 1(vlan6) entered forwarding state [ 411.085135][T13679] geneve0: entered promiscuous mode [ 411.087562][T13679] 8021q: adding VLAN 0 to HW filter on device batadv1 [ 411.119131][T13679] 8021q: adding VLAN 0 to HW filter on device bond5 [ 411.323984][T11546] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 411.324023][T11546] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 411.475056][ T5832] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 411.475292][ T5832] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 411.495040][ T5832] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 411.500172][ T5832] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 411.548697][T11549] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 411.549031][T11549] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 411.572164][T11550] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 411.572204][T11550] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 411.576217][ T7274] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 411.576901][ T7274] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 411.635310][ T7274] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 411.655424][T11550] bond3: (slave veth5): link status definitely up, 10000 Mbps full duplex [ 411.655747][T11550] bond3: (slave veth5): making interface the new active one [ 411.658447][T11550] bond3: active interface up! [ 411.704292][T13717] netlink: 'syz.2.1956': attribute type 1 has an invalid length. [ 411.713495][T12474] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 411.795017][T11546] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 411.795062][T11546] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 411.915514][T11549] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 411.915554][T11549] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 412.049445][T13736] ip6erspan0: entered allmulticast mode [ 412.340340][T13753] __nla_validate_parse: 11 callbacks suppressed [ 412.340362][T13753] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1969'. [ 412.341313][T13753] IPVS: stopping master sync thread 6244 ... [ 412.409721][T13756] netlink: 'syz.2.1968': attribute type 4 has an invalid length. [ 412.410550][T13757] netlink: 'syz.2.1968': attribute type 4 has an invalid length. [ 412.866704][T13780] IPv6: Can't replace route, no match found [ 412.924115][T13776] xt_CT: No such helper "netbios-ns" [ 413.078518][T13783] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1977'. [ 413.080373][T13783] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1977'. [ 413.500125][T13795] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 413.923385][T13816] netlink: 88 bytes leftover after parsing attributes in process `syz.3.1990'. [ 413.923420][T13816] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1990'. [ 413.945919][T13802] bridge0: port 2(wlan1) entered blocking state [ 413.948657][T13802] bridge0: port 2(wlan1) entered disabled state [ 413.949198][T13802] mac80211_hwsim hwsim9 wlan1: entered allmulticast mode [ 413.977504][T13802] mac80211_hwsim hwsim9 wlan1: entered promiscuous mode [ 413.984643][T13802] vlan6: entered promiscuous mode [ 414.015259][T13816] tipc: Enabling of bearer rejected, failed to enable media [ 414.071985][T13810] bridge0: port 2(wlan1) entered disabled state [ 414.114528][T13810] mac80211_hwsim hwsim9 wlan1 (unregistering): left allmulticast mode [ 414.114566][T13810] mac80211_hwsim hwsim9 wlan1 (unregistering): left promiscuous mode [ 414.121778][T13810] bridge0: port 2(wlan1) entered disabled state [ 414.175249][T13810] vlan6: left promiscuous mode [ 414.175284][T13810] geneve0: left promiscuous mode [ 414.178536][T13810] geneve0: entered promiscuous mode [ 414.238412][T13828] netlink: 1164 bytes leftover after parsing attributes in process `syz.4.1989'. [ 414.550289][T13846] netlink: 1164 bytes leftover after parsing attributes in process `syz.0.1993'. [ 414.618521][T13855] syzkaller0: entered promiscuous mode [ 414.618545][T13855] syzkaller0: entered allmulticast mode [ 414.644149][T13841] syzkaller0: left promiscuous mode [ 414.644173][T13841] syzkaller0: left allmulticast mode [ 414.770007][T13860] veth0_to_hsr: mtu greater than device maximum [ 414.784710][T13861] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1998'. [ 414.900167][T13863] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2000'. [ 414.924445][T13863] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2000'. [ 414.925485][T13862] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 416.594531][T13914] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 20000 - 0 [ 416.647528][T11549] ip6_tnl_xmit_ctl: 9 callbacks suppressed [ 416.647546][T11549] ip6_tunnel: ip6gretap2 xmit: Local address not yet configured! [ 416.810466][T13914] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 20000 - 0 [ 416.836364][T13929] x_tables: duplicate underflow at hook 2 [ 416.953083][ T7274] ip6_tunnel: ip6gretap2 xmit: Local address not yet configured! [ 417.108647][T13914] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 20000 - 0 [ 417.251652][T13914] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 20000 - 0 [ 417.735194][T11550] ip6_tunnel: ip6gretap2 xmit: Local address not yet configured! [ 417.736236][T11550] ip6_tunnel: ip6gretap2 xmit: Local address not yet configured! [ 417.873306][T12474] ip6_tunnel: ip6gretap2 xmit: Local address not yet configured! [ 417.947835][ T5837] netdevsim netdevsim4 eth3: set [1, 0] type 2 family 0 port 20000 - 0 [ 417.959812][ T5837] netdevsim netdevsim4 eth2: set [1, 0] type 2 family 0 port 20000 - 0 [ 417.972127][T11546] netdevsim netdevsim4 eth1: set [1, 0] type 2 family 0 port 20000 - 0 [ 417.976022][T11550] netdevsim netdevsim4 eth0: set [1, 0] type 2 family 0 port 20000 - 0 [ 418.099373][T13961] __nla_validate_parse: 4 callbacks suppressed [ 418.099397][T13961] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2025'. [ 418.099425][T13961] netlink: 'syz.2.2025': attribute type 4 has an invalid length. [ 418.099440][T13961] netlink: 'syz.2.2025': attribute type 1 has an invalid length. [ 418.529142][T13989] netlink: 'syz.1.2030': attribute type 4 has an invalid length. [ 419.295576][T14013] netlink: zone id is out of range [ 419.295596][T14013] netlink: zone id is out of range [ 419.295606][T14013] netlink: zone id is out of range [ 419.295615][T14013] netlink: zone id is out of range [ 419.295625][T14013] netlink: zone id is out of range [ 419.295634][T14013] netlink: zone id is out of range [ 419.295643][T14013] netlink: zone id is out of range [ 419.295651][T14013] netlink: zone id is out of range [ 419.295660][T14013] netlink: zone id is out of range [ 419.295669][T14013] netlink: set zone limit has 4 unknown bytes [ 419.363089][T14014] netlink: 76 bytes leftover after parsing attributes in process `syz.0.2035'. [ 419.363117][T14014] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2035'. [ 419.414215][T13963] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 419.525123][T14016] netlink: 20 bytes leftover after parsing attributes in process `syz.0.2035'. [ 419.815773][T14026] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2036'. [ 419.908049][T12845] gre0 speed is unknown, defaulting to 1000 [ 419.908096][T12845] syz2: Port: 1 Link DOWN [ 419.908357][T12845] gre0 speed is unknown, defaulting to 1000 [ 420.140490][T14018] bond7 (unregistering): Released all slaves [ 420.161956][T14038] netlink: 20 bytes leftover after parsing attributes in process `syz.0.2038'. [ 420.229155][T14041] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2039'. [ 420.261666][T11550] netdevsim netdevsim3 netdevsim1: unset [1, 0] type 2 family 0 port 20000 - 0 [ 420.261717][T11550] netdevsim netdevsim3 netdevsim3: unset [1, 0] type 2 family 0 port 20000 - 0 [ 420.261753][T11550] netdevsim netdevsim3 netdevsim2: unset [1, 0] type 2 family 0 port 20000 - 0 [ 420.261789][T11550] netdevsim netdevsim3 netdevsim0: unset [1, 0] type 2 family 0 port 20000 - 0 [ 420.582634][T14043] netlink: 1164 bytes leftover after parsing attributes in process `syz.4.2041'. [ 421.351775][ C0] ip6_tunnel: ip6gretap2 xmit: Local address not yet configured! [ 421.467805][T14099] tipc: Enabling of bearer rejected, already enabled [ 421.468407][T14099] syzkaller0: entered promiscuous mode [ 421.468427][T14099] syzkaller0: entered allmulticast mode [ 421.469857][T14099] sch_tbf: burst 255 is lower than device syzkaller0 mtu (65589) ! [ 421.598004][T14105] netdevsim netdevsim1 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 421.598045][T14105] netdevsim netdevsim1 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 421.616920][T14109] netlink: 156 bytes leftover after parsing attributes in process `syz.1.2055'. [ 421.672418][T14111] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2058'. [ 422.058796][T14135] lo: entered promiscuous mode [ 422.059005][T14135] tunl0: entered promiscuous mode [ 422.059177][T14135] gre0: entered promiscuous mode [ 422.059314][T14135] gretap0: entered promiscuous mode [ 422.059443][T14135] erspan0: entered promiscuous mode [ 422.059570][T14135] ip_vti0: entered promiscuous mode [ 422.059728][T14135] ip6_vti0: entered promiscuous mode [ 422.059855][T14135] sit0: entered promiscuous mode [ 422.059993][T14135] ip6tnl0: entered promiscuous mode [ 422.060137][T14135] ip6gre0: entered promiscuous mode [ 422.064465][T14135] syz_tun: entered promiscuous mode [ 422.064914][T14135] ip6gretap0: entered promiscuous mode [ 422.244242][T14135] bridge0: entered promiscuous mode [ 422.249435][T14135] bond0: entered promiscuous mode [ 422.250491][T14135] nlmon0: entered promiscuous mode [ 422.250655][T14135] veth0: entered promiscuous mode [ 422.250812][T14135] veth1: entered promiscuous mode [ 422.250983][T14135] wg0: entered promiscuous mode [ 422.251149][T14135] wg1: entered promiscuous mode [ 422.308196][T14135] veth0_to_bridge: entered promiscuous mode [ 422.308408][T14135] bridge_slave_0: entered promiscuous mode [ 422.308571][T14135] veth1_to_bridge: entered promiscuous mode [ 422.308730][T14135] bridge_slave_1: entered promiscuous mode [ 422.308888][T14135] veth0_to_bond: entered promiscuous mode [ 422.310523][T14135] bond_slave_0: entered promiscuous mode [ 422.310696][T14135] veth0_to_team: entered promiscuous mode [ 422.310856][T14135] team_slave_0: entered promiscuous mode [ 422.311019][T14135] veth1_to_team: entered promiscuous mode [ 422.311177][T14135] team_slave_1: entered promiscuous mode [ 422.317773][T14135] veth0_to_batadv: entered promiscuous mode [ 422.325607][T14135] batadv_slave_0: entered promiscuous mode [ 422.326074][T14135] veth1_to_batadv: entered promiscuous mode [ 422.350935][T14135] batadv_slave_1: entered promiscuous mode [ 422.351965][T14135] xfrm0: entered promiscuous mode [ 422.352402][T14135] veth0_to_hsr: entered promiscuous mode [ 422.376795][T14135] veth1_to_hsr: entered promiscuous mode [ 422.377623][T14135] hsr0: entered promiscuous mode [ 422.405981][T14135] vlan0: entered promiscuous mode [ 422.424607][T14135] vlan1: entered promiscuous mode [ 422.424953][T14135] macvlan0: entered promiscuous mode [ 422.425110][T14135] macvlan1: entered promiscuous mode [ 422.425583][T14135] ipvlan0: entered promiscuous mode [ 422.425741][T14135] ipvlan1: entered promiscuous mode [ 422.428726][T14135] macvtap0: entered promiscuous mode [ 422.428919][T14135] geneve0: entered promiscuous mode [ 422.429081][T14135] geneve1: entered promiscuous mode [ 422.429224][T14135] mac80211_hwsim hwsim11 wlan1: entered promiscuous mode [ 422.430717][T14135] macvtap1: entered promiscuous mode [ 422.430976][T14135] dvmrp16: entered promiscuous mode [ 422.431111][T14135] ): entered promiscuous mode [ 422.431239][T14135] n: entered promiscuous mode [ 422.431363][T14135] vlan2: entered promiscuous mode [ 422.444746][T14135] ip6gretap1: entered promiscuous mode [ 422.445199][T14135] mac80211_hwsim hwsim14 wlan2: entered promiscuous mode [ 422.448542][T14135] veth2: entered promiscuous mode [ 422.448985][T14135] veth3: entered promiscuous mode [ 422.450930][T14135] geneve2: entered promiscuous mode [ 422.454091][T14135] bridge1: entered promiscuous mode [ 422.457524][T14135] syztnl2: entered promiscuous mode [ 422.459144][T14135] vlan3: entered promiscuous mode [ 422.467391][T14135] veth4: entered promiscuous mode [ 422.471113][T14135] veth5: entered promiscuous mode [ 422.495591][T14135] vxlan0: entered promiscuous mode [ 422.496040][T14135] ip6gre1: entered promiscuous mode [ 422.499467][T14135] bond1: entered promiscuous mode [ 422.499885][T14135] bond2: entered promiscuous mode [ 422.516066][T14135] tipc: Resetting bearer [ 422.569449][T14135] ip6tnl1: entered promiscuous mode [ 422.595427][T14135] mac80211_hwsim hwsim20 wlan0: entered promiscuous mode [ 422.596048][T14135] ip6gre2: entered promiscuous mode [ 422.603729][T14135] gretap1: entered promiscuous mode [ 422.604137][T14135] bridge_slave_0.: entered promiscuous mode [ 422.605040][T14135] mac80211_hwsim hwsim23 wlan3: entered promiscuous mode [ 422.630032][T14135] mac80211_hwsim hwsim28 wlan4: entered promiscuous mode [ 422.630552][T14135] mac80211_hwsim hwsim33 wlan5: entered promiscuous mode [ 422.639196][T14135] bridge2: entered promiscuous mode [ 422.653076][T14135] dvmrp1: entered promiscuous mode [ 422.653260][T14135] mac80211_hwsim hwsim41 wlan6: entered promiscuous mode [ 422.653421][T14135] ip6gre3: entered promiscuous mode [ 422.653686][T14135] bond3: entered promiscuous mode [ 422.653846][T14135] mac80211_hwsim hwsim54 wlan7: entered promiscuous mode [ 422.654034][T14135] mac80211_hwsim hwsim55 wlan8: entered promiscuous mode [ 422.654219][T14135] mac80211_hwsim hwsim56 wlan9: entered promiscuous mode [ 422.656749][T14135] bond4: entered promiscuous mode [ 422.659168][T14135] mac80211_hwsim hwsim58 wlan10: entered promiscuous mode [ 422.659350][T14135] gtp0: entered promiscuous mode [ 422.661295][T14135] bond5: entered promiscuous mode [ 422.661316][T14135] geneve3: entered promiscuous mode [ 422.740820][T14135] mac80211_hwsim hwsim61 wlan11: entered promiscuous mode [ 422.741018][T14135] mac80211_hwsim hwsim63 wlan12: entered promiscuous mode [ 422.741220][T14135] mac80211_hwsim hwsim65 wlan13: entered promiscuous mode [ 422.741435][T14135] netdevsim netdevsim4 eth0: entered promiscuous mode [ 422.772509][T14135] netdevsim netdevsim4 eth1: entered promiscuous mode [ 422.772665][T14135] netdevsim netdevsim4 eth2: entered promiscuous mode [ 422.772800][T14135] netdevsim netdevsim4 eth3: entered promiscuous mode [ 422.772930][T14135] macvlan2: entered promiscuous mode [ 422.773108][T14135] mac80211_hwsim hwsim68 wlan14: entered promiscuous mode [ 422.773267][T14135] mac80211_hwsim hwsim69 wlan15: entered promiscuous mode [ 422.798119][T11551] netdevsim netdevsim4 eth3: unset [1, 0] type 2 family 0 port 20000 - 0 [ 422.799474][T11551] netdevsim netdevsim4 eth2: unset [1, 0] type 2 family 0 port 20000 - 0 [ 422.799583][T11551] netdevsim netdevsim4 eth1: unset [1, 0] type 2 family 0 port 20000 - 0 [ 422.799670][T11551] netdevsim netdevsim4 eth0: unset [1, 0] type 2 family 0 port 20000 - 0 [ 423.250562][T14158] __nla_validate_parse: 4 callbacks suppressed [ 423.250587][T14158] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2068'. [ 423.403592][T14158] 8021q: adding VLAN 0 to HW filter on device bond2 [ 423.429567][T14166] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2071'. [ 423.429632][T14166] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2071'. [ 423.462091][T14164] nbd1: detected capacity change from 0 to 63 [ 423.484442][T14164] block nbd0: NBD_DISCONNECT [ 423.484473][T14164] block nbd0: Send disconnect failed -32 [ 423.484494][T14164] block nbd0: shutting down sockets [ 423.588447][ T5631] block nbd1: Receive control failed (result -104) [ 423.749801][T14169] netlink: 1164 bytes leftover after parsing attributes in process `syz.4.2072'. [ 424.393252][ C0] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 424.898105][T14190] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2076'. [ 425.033599][ C0] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 425.034027][ C0] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 426.193621][ T5284] netdevsim netdevsim1 netdevsim3: default qdisc (pfifo_fast) fail, fallback to noqueue [ 426.208476][ T5284] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 426.551318][T14199] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2081'. [ 426.785369][T14213] bridge0: port 2(bridge_slave_0) entered blocking state [ 426.785569][T14213] bridge0: port 2(bridge_slave_0) entered disabled state [ 426.791307][T14213] bridge_slave_0: entered promiscuous mode [ 426.805729][ T4952] block nbd1: Possible stuck request ffff888028137000: control (read@0,1024B). Runtime 2 seconds [ 426.807956][ T4952] block nbd1: Possible stuck request ffff8880281371c0: control (read@1024,1024B). Runtime 2 seconds [ 426.807996][ T4952] block nbd1: Possible stuck request ffff888028137380: control (read@2048,1024B). Runtime 2 seconds [ 426.808026][ T4952] block nbd1: Possible stuck request ffff888028137540: control (read@3072,1024B). Runtime 2 seconds [ 426.808180][T14213] vlan6: entered promiscuous mode [ 426.832277][T14213] bridge0: port 2(bridge_slave_0) entered blocking state [ 426.832603][T14213] bridge0: port 2(bridge_slave_0) entered forwarding state [ 426.904849][T14213] bridge_slave_0: left promiscuous mode [ 426.905199][T14213] bridge0: port 2(bridge_slave_0) entered disabled state [ 426.926282][T14213] vlan6: left promiscuous mode [ 426.926306][T14213] geneve0: left promiscuous mode [ 426.926803][T14213] geneve0: entered promiscuous mode [ 426.979205][T14213] vlan6: left allmulticast mode [ 426.979229][T14213] geneve0: left allmulticast mode [ 426.979541][T14213] bridge0: port 1(vlan6) entered disabled state [ 427.004707][T14212] netlink: 1164 bytes leftover after parsing attributes in process `syz.4.2084'. [ 427.100319][ T7275] geneve0: left promiscuous mode [ 427.166086][T14237] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2088'. [ 427.366927][T14241] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2090'. [ 427.386968][T14245] netlink: 20 bytes leftover after parsing attributes in process `syz.1.2091'. [ 427.389519][T14245] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 427.528256][T14249] dummy0: entered promiscuous mode [ 427.613331][T14249] SET target dimension over the limit! [ 428.455440][T14279] pim6reg: entered allmulticast mode [ 428.632106][T14281] x_tables: ip_tables: DNAT target: used from hooks POSTROUTING, but only usable from PREROUTING/OUTPUT [ 428.688717][T14285] net_ratelimit: 2 callbacks suppressed [ 428.688900][T14285] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 428.753044][T14286] openvswitch: netlink: Tunnel attr 4 has unexpected len 0 expected 1 [ 428.759512][T14286] __nla_validate_parse: 1 callbacks suppressed [ 428.759536][T14286] netlink: 20 bytes leftover after parsing attributes in process `syz.0.2102'. [ 428.759560][T14286] openvswitch: netlink: IPv4 frag type 4 is out of range max 2 [ 428.811301][T14285] netlink: 'syz.0.2102': attribute type 1 has an invalid length. [ 428.871693][ C0] ip6_tunnel: ip6gretap2 xmit: Local address not yet configured! [ 428.996057][T14278] pim6reg: left allmulticast mode [ 429.184858][T14295] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2104'. [ 429.204186][T14300] tunl0: left promiscuous mode [ 429.204210][T14300] tunl0: left allmulticast mode [ 429.225011][T14300] dummy0: left promiscuous mode [ 429.261672][T14300] 0·: left allmulticast mode [ 429.261699][T14300] hsr_slave_0: left allmulticast mode [ 429.261714][T14300] hsr_slave_1: left allmulticast mode [ 429.384928][T14311] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2106'. [ 429.449830][T14306] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2107'. [ 429.534040][T14300] veth1_vlan: left allmulticast mode [ 429.534754][T14300] macvlan0: left promiscuous mode [ 429.534772][T14300] macvlan0: left allmulticast mode [ 429.577824][T14300] +: left promiscuous mode [ 429.577852][T14300] +: left allmulticast mode [ 429.598289][T14300] bond3: left promiscuous mode [ 429.598315][T14300] gre1: left promiscuous mode [ 429.613438][T14300] bond5: left allmulticast mode [ 429.633153][T14300] gre2: left promiscuous mode [ 429.633179][T14300] gre2: left allmulticast mode [ 429.666894][T14309] bridge0: port 3(erspan0) entered blocking state [ 429.667022][T14309] bridge0: port 3(erspan0) entered disabled state [ 429.669518][T14309] erspan0: entered allmulticast mode [ 429.696778][T14309] erspan0: entered promiscuous mode [ 429.825941][T14322] netlink: 'syz.4.2108': attribute type 14 has an invalid length. [ 430.033207][T14328] netlink: 'syz.3.2111': attribute type 6 has an invalid length. [ 430.034815][T14328] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2111'. [ 430.039101][T14328] netlink: 'syz.3.2111': attribute type 6 has an invalid length. [ 430.067611][T14332] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2111'. [ 430.152239][ T4952] block nbd1: Possible stuck request ffff888028137000: control (read@0,1024B). Runtime 4 seconds [ 430.152281][ T4952] block nbd1: Possible stuck request ffff8880281371c0: control (read@1024,1024B). Runtime 4 seconds [ 430.152305][ T4952] block nbd1: Possible stuck request ffff888028137380: control (read@2048,1024B). Runtime 4 seconds [ 430.152331][ T4952] block nbd1: Possible stuck request ffff888028137540: control (read@3072,1024B). Runtime 4 seconds [ 430.223049][T14335] netlink: 'syz.4.2113': attribute type 2 has an invalid length. [ 430.531236][T14364] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2119'. [ 430.573124][T14364] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2119'. [ 430.647391][T14364] veth7: entered allmulticast mode [ 430.664613][T14360] syzkaller0: left promiscuous mode [ 430.669058][T14360] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2120'. [ 430.670163][T14361] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2120'. [ 430.786337][T14377] sch_tbf: peakrate 7 is lower than or equals to rate 7 ! [ 430.806012][T14380] sch_tbf: peakrate 7 is lower than or equals to rate 7 ! [ 431.204548][T14408] syzkaller0: entered promiscuous mode [ 431.209225][T14407] tipc: Enabling of bearer rejected, already enabled [ 431.209583][T14407] tipc: Enabling of bearer rejected, already enabled [ 431.232131][T14407] tipc: Enabling of bearer rejected, already enabled [ 431.242910][T14407] tipc: Enabling of bearer rejected, already enabled [ 431.243411][T14407] tipc: Enabling of bearer rejected, already enabled [ 431.243898][T14407] tipc: Enabling of bearer rejected, already enabled [ 431.245105][T14407] tipc: Enabling of bearer rejected, already enabled [ 431.248768][T14407] tipc: Enabling of bearer rejected, already enabled [ 431.249103][T14407] tipc: Enabling of bearer rejected, already enabled [ 431.249431][T14407] tipc: Enabling of bearer rejected, already enabled [ 431.249761][T14407] tipc: Enabling of bearer rejected, already enabled [ 431.250080][T14407] tipc: Enabling of bearer rejected, already enabled [ 431.254951][T14407] tipc: Enabling of bearer rejected, already enabled [ 431.255609][T14407] tipc: Enabling of bearer rejected, already enabled [ 431.257996][T14407] tipc: Enabling of bearer rejected, already enabled [ 431.266885][T14407] tipc: Enabling of bearer rejected, already enabled [ 431.277052][T14407] tipc: Enabling of bearer rejected, already enabled [ 431.307712][T14407] tipc: Enabling of bearer rejected, already enabled [ 431.324710][T14407] tipc: Enabling of bearer rejected, already enabled [ 431.325705][T14407] tipc: Enabling of bearer rejected, already enabled [ 431.345687][T14407] tipc: Enabling of bearer rejected, already enabled [ 431.359051][T14407] tipc: Enabling of bearer rejected, already enabled [ 431.372962][T14407] tipc: Enabling of bearer rejected, already enabled [ 431.374076][T14407] tipc: Enabling of bearer rejected, already enabled [ 431.375075][T14407] tipc: Enabling of bearer rejected, already enabled [ 431.375914][T14407] tipc: Enabling of bearer rejected, already enabled [ 431.376852][T14407] tipc: Enabling of bearer rejected, already enabled [ 431.377711][T14407] tipc: Enabling of bearer rejected, already enabled [ 431.467016][T14407] tipc: Enabling of bearer rejected, already enabled [ 433.030738][T14462] sctp: [Deprecated]: syz.0.2146 (pid 14462) Use of int in maxseg socket option. [ 433.030738][T14462] Use struct sctp_assoc_value instead [ 433.511973][ T4952] block nbd1: Possible stuck request ffff888028137000: control (read@0,1024B). Runtime 6 seconds [ 433.512007][ T4952] block nbd1: Possible stuck request ffff8880281371c0: control (read@1024,1024B). Runtime 6 seconds [ 433.512028][ T4952] block nbd1: Possible stuck request ffff888028137380: control (read@2048,1024B). Runtime 6 seconds [ 433.512048][ T4952] block nbd1: Possible stuck request ffff888028137540: control (read@3072,1024B). Runtime 6 seconds [ 434.521857][T14422] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 434.739193][T14467] pim6reg: entered allmulticast mode [ 434.854551][T14472] x_tables: ip_tables: DNAT target: used from hooks POSTROUTING, but only usable from PREROUTING/OUTPUT [ 434.961169][T14476] Bluetooth: hci0: invalid length 0, exp 2 for type 0 [ 434.987997][T14480] __nla_validate_parse: 7 callbacks suppressed [ 434.988022][T14480] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2153'. [ 435.042873][T14483] netlink: 32 bytes leftover after parsing attributes in process `syz.3.2155'. [ 435.043445][T14480] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2153'. [ 435.113872][T14478] netlink: 'syz.3.2155': attribute type 1 has an invalid length. [ 435.113897][T14478] netlink: 272 bytes leftover after parsing attributes in process `syz.3.2155'. [ 435.236341][T14490] netlink: 164 bytes leftover after parsing attributes in process `syz.3.2157'. [ 435.276612][T14466] pim6reg: left allmulticast mode [ 435.313422][T14492] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2157'. [ 435.916299][T14523] syzkaller0: left promiscuous mode [ 435.916324][T14523] syzkaller0: left allmulticast mode [ 436.055521][T14528] netlink: 32 bytes leftover after parsing attributes in process `syz.4.2167'. [ 436.147995][T14531] netlink: 72 bytes leftover after parsing attributes in process `syz.0.2166'. [ 436.442294][T14548] batadv_slave_1: entered promiscuous mode [ 436.442714][T14549] netlink: 'syz.2.2174': attribute type 61 has an invalid length. [ 436.442740][T14549] netlink: 'syz.2.2174': attribute type 105 has an invalid length. [ 436.444338][T14546] batadv_slave_1: left promiscuous mode [ 436.883136][ T4952] block nbd1: Possible stuck request ffff888028137000: control (read@0,1024B). Runtime 8 seconds [ 436.883187][ T4952] block nbd1: Possible stuck request ffff8880281371c0: control (read@1024,1024B). Runtime 8 seconds [ 436.883217][ T4952] block nbd1: Possible stuck request ffff888028137380: control (read@2048,1024B). Runtime 8 seconds [ 436.883246][ T4952] block nbd1: Possible stuck request ffff888028137540: control (read@3072,1024B). Runtime 8 seconds [ 437.096604][T14565] lo: left promiscuous mode [ 437.603126][T14580] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2183'. [ 437.603884][T14580] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2183'. [ 437.608122][T14580] IPVS: set_ctl: invalid protocol: 43 172.20.20.187:20001 [ 437.672955][T14589] netlink: 'syz.4.2186': attribute type 1 has an invalid length. [ 437.712681][T14589] bond6: entered promiscuous mode [ 437.713173][T14589] 8021q: adding VLAN 0 to HW filter on device bond6 [ 437.746456][T14589] ipvlan2: entered allmulticast mode [ 437.746488][T14589] bond6: entered allmulticast mode [ 437.770774][T14589] ipvlan3: entered allmulticast mode [ 437.812540][T14589] bond6: (slave bridge3): making interface the new active one [ 437.812569][T14589] bridge3: entered promiscuous mode [ 437.812746][T14589] bridge3: entered allmulticast mode [ 437.817246][T14589] bond6: (slave bridge3): Enslaving as an active interface with an up link [ 438.260621][T14606] syzkaller0: entered promiscuous mode [ 438.260649][T14606] syzkaller0: entered allmulticast mode [ 438.281863][ T5837] netdevsim netdevsim3 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 438.281919][ T5837] netdevsim netdevsim3 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 438.281970][ T5837] netdevsim netdevsim3 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 438.282011][ T5837] netdevsim netdevsim3 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 438.513812][T14619] sctp: [Deprecated]: syz.2.2192 (pid 14619) Use of struct sctp_assoc_value in delayed_ack socket option. [ 438.513812][T14619] Use struct sctp_sack_info instead [ 438.523514][T14618] sctp: [Deprecated]: syz.2.2192 (pid 14618) Use of struct sctp_assoc_value in delayed_ack socket option. [ 438.523514][T14618] Use struct sctp_sack_info instead [ 438.794718][T14628] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 438.795752][T11550] IPVS: starting estimator thread 0... [ 438.883802][T14644] IPVS: using max 29 ests per chain, 69600 per kthread [ 439.354502][T14660] netlink: 'syz.2.2200': attribute type 1 has an invalid length. [ 439.451410][T14660] 8021q: adding VLAN 0 to HW filter on device bond7 [ 439.606215][T14666] bond7: (slave veth7): Enslaving as an active interface with a down link [ 439.654397][T14676] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 439.673047][T14660] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 439.678237][T14660] bond7: (slave batadv0): making interface the new active one [ 439.699296][T14660] batadv0: entered promiscuous mode [ 439.700066][T14660] bond7: (slave batadv0): Enslaving as an active interface with an up link [ 439.764965][T14684] openvswitch: netlink: Missing key (keys=40, expected=2000) [ 439.980603][T14692] ip_tables: iptables: counters copy to user failed while replacing table [ 440.165562][T14691] bond9: entered promiscuous mode [ 440.169671][T14691] 8021q: adding VLAN 0 to HW filter on device bond9 [ 440.233696][ T4952] block nbd1: Possible stuck request ffff888028137000: control (read@0,1024B). Runtime 10 seconds [ 440.233744][ T4952] block nbd1: Possible stuck request ffff8880281371c0: control (read@1024,1024B). Runtime 10 seconds [ 440.233775][ T4952] block nbd1: Possible stuck request ffff888028137380: control (read@2048,1024B). Runtime 10 seconds [ 440.233804][ T4952] block nbd1: Possible stuck request ffff888028137540: control (read@3072,1024B). Runtime 10 seconds [ 440.367117][T14709] tipc: Resetting bearer [ 440.369532][T14709] tipc: Resetting bearer [ 440.369953][T14709] tipc: Resetting bearer [ 440.472968][ T7272] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 440.490379][ T7272] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 440.492652][T14709] tipc: Resetting bearer [ 440.493984][T14709] tipc: Resetting bearer [ 440.651348][ T5832] tipc: Resetting bearer [ 440.669454][ T5832] tipc: Resetting bearer [ 440.913717][T14726] netlink: Failed to add helper -22 [ 440.913772][T14726] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 440.990702][T14736] syzkaller0: entered promiscuous mode [ 440.990727][T14736] syzkaller0: entered allmulticast mode [ 440.991159][T14736] tipc: Resetting bearer [ 441.003349][ T7272] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 441.145986][T14734] IPVS: Scheduler module ip_vs_sip not found [ 441.192154][ T7272] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 441.285484][T14755] __nla_validate_parse: 10 callbacks suppressed [ 441.285511][T14755] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2216'. [ 441.387795][T14758] syzkaller0: entered promiscuous mode [ 441.387821][T14758] syzkaller0: entered allmulticast mode [ 441.681326][T14773] macsec0: entered allmulticast mode [ 441.681356][T14773] netdevsim netdevsim0 netdevsim0: entered allmulticast mode [ 441.695143][T14773] 8021q: adding VLAN 0 to HW filter on device macsec0 [ 441.712817][T14773] netdevsim netdevsim0 netdevsim0: left allmulticast mode [ 442.312867][ C0] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 442.313157][ C0] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 442.500348][T14800] netlink: 'syz.0.2228': attribute type 1 has an invalid length. [ 442.632400][T14807] netlink: 32 bytes leftover after parsing attributes in process `syz.0.2228'. [ 442.634024][T14800] 8021q: adding VLAN 0 to HW filter on device bond7 [ 442.951695][ C0] ip6_tunnel: ip6gretap2 xmit: Local address not yet configured! [ 443.592322][ C0] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 443.611327][ T4952] block nbd1: Possible stuck request ffff888028137000: control (read@0,1024B). Runtime 12 seconds [ 443.611376][ T4952] block nbd1: Possible stuck request ffff8880281371c0: control (read@1024,1024B). Runtime 12 seconds [ 443.611406][ T4952] block nbd1: Possible stuck request ffff888028137380: control (read@2048,1024B). Runtime 12 seconds [ 443.611547][ T4952] block nbd1: Possible stuck request ffff888028137540: control (read@3072,1024B). Runtime 12 seconds [ 443.803623][T14800] workqueue: Failed to create a rescuer kthread for wq "bond8": -EINTR [ 443.826506][T14803] bond7 (unregistering): Released all slaves [ 443.885760][T14812] tipc: Enabling of bearer rejected, failed to enable media [ 444.015442][T14823] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2231'. [ 444.055778][T14815] gre1: entered promiscuous mode [ 444.085248][T14825] netlink: 28 bytes leftover after parsing attributes in process `syz.0.2232'. [ 444.280745][T14832] tipc: Enabling of bearer rejected, already enabled [ 444.294437][T14832] syzkaller0: mtu less than device minimum [ 444.400096][T14848] netlink: 'syz.1.2237': attribute type 1 has an invalid length. [ 444.481934][T14848] 8021q: adding VLAN 0 to HW filter on device bond3 [ 444.548493][T14857] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2238'. [ 444.805065][T14865] netlink: 'syz.1.2240': attribute type 11 has an invalid length. [ 444.893442][T14853] bond0: (slave ip6gretap0): Enslaving as an active interface with an up link [ 446.952790][ T4952] block nbd1: Possible stuck request ffff888028137000: control (read@0,1024B). Runtime 14 seconds [ 446.952839][ T4952] block nbd1: Possible stuck request ffff8880281371c0: control (read@1024,1024B). Runtime 14 seconds [ 446.952869][ T4952] block nbd1: Possible stuck request ffff888028137380: control (read@2048,1024B). Runtime 14 seconds [ 446.952898][ T4952] block nbd1: Possible stuck request ffff888028137540: control (read@3072,1024B). Runtime 14 seconds [ 447.331124][T14858] bond0 (unregistering): (slave netdevsim1): Releasing backup interface [ 447.360497][T14858] bond0 (unregistering): (slave ip6gretap0): Releasing backup interface [ 447.379266][T14858] bond0 (unregistering): Released all slaves [ 447.518701][T14866] A link change request failed with some changes committed already. Interface veth1_to_bod may have been left with an inconsistent configuration, please check. [ 447.774148][T14898] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2247'. [ 447.785219][T14897] netlink: 20 bytes leftover after parsing attributes in process `syz.1.2248'. [ 447.879950][T14903] netlink: 40 bytes leftover after parsing attributes in process `syz.0.2246'. [ 447.894403][T14906] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2251'. [ 447.894872][T14906] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2251'. [ 447.925403][T14907] block nbd0: server does not support multiple connections per device. [ 447.926020][T14907] block nbd0: shutting down sockets [ 447.927975][T14908] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2251'. [ 448.099423][T14917] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2255'. [ 448.113918][T14917] netlink: 'syz.3.2255': attribute type 49 has an invalid length. [ 448.239629][T14925] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2256'. [ 448.818023][T14951] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2263'. [ 448.866585][T14954] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2262'. [ 449.446016][T14979] veth0: left allmulticast mode [ 449.446043][T14979] veth0: left promiscuous mode [ 449.446603][T14979] bridge0: port 1(veth0) entered disabled state [ 449.537510][T14979] : (slave 17ÿÿÿ): Releasing backup interface [ 449.541385][T14981] x_tables: duplicate underflow at hook 3 [ 449.564673][T14979] : (slave bond_slave_1): Releasing backup interface [ 449.605160][T14979] team0: Port device team_slave_0 removed [ 449.642503][T14979] team0: Port device team_slave_1 removed [ 450.320992][T15025] syzkaller0: entered promiscuous mode [ 450.321017][T15025] syzkaller0: entered allmulticast mode [ 450.352826][ T4952] block nbd1: Possible stuck request ffff888028137000: control (read@0,1024B). Runtime 16 seconds [ 450.352874][ T4952] block nbd1: Possible stuck request ffff8880281371c0: control (read@1024,1024B). Runtime 16 seconds [ 450.352905][ T4952] block nbd1: Possible stuck request ffff888028137380: control (read@2048,1024B). Runtime 16 seconds [ 450.352940][ T4952] block nbd1: Possible stuck request ffff888028137540: control (read@3072,1024B). Runtime 16 seconds [ 450.462516][T15030] netlink: 'syz.1.2276': attribute type 12 has an invalid length. [ 450.830147][T15051] netlink: 'syz.2.2280': attribute type 1 has an invalid length. [ 450.972858][T15058] xt_TCPMSS: Only works on TCP SYN packets [ 451.005188][ T5837] batadv0: left promiscuous mode [ 451.133230][T15058] bond4: left allmulticast mode [ 451.133260][T15058] bond4: left promiscuous mode [ 451.133506][T15058] bridge0: port 3(bond4) entered disabled state [ 451.151886][T15058] bridge_slave_1: left allmulticast mode [ 451.151916][T15058] bridge_slave_1: left promiscuous mode [ 451.154226][T15058] bridge0: port 2(bridge_slave_1) entered disabled state [ 451.182998][T15058] bridge_slave_0: left allmulticast mode [ 451.183029][T15058] bridge_slave_0: left promiscuous mode [ 451.183246][T15058] bridge0: port 1(bridge_slave_0) entered disabled state [ 451.266526][T15070] wg2 speed is unknown, defaulting to 1000 [ 451.386769][T15080] x_tables: ip_tables: DNAT target: used from hooks POSTROUTING, but only usable from PREROUTING/OUTPUT [ 451.592528][T15070] gre0 speed is unknown, defaulting to 1000 [ 451.597619][T15085] x_tables: ip_tables: DNAT target: used from hooks POSTROUTING, but only usable from PREROUTING/OUTPUT [ 451.643646][T15087] x_tables: ip_tables: DNAT target: used from hooks POSTROUTING, but only usable from PREROUTING/OUTPUT [ 452.069006][T15089] gretap0: entered promiscuous mode [ 452.070823][T15089] vlan2: entered promiscuous mode [ 452.340278][T15095] syzkaller0: entered promiscuous mode [ 452.340304][T15095] syzkaller0: entered allmulticast mode [ 452.447402][T15101] syzkaller1: entered promiscuous mode [ 452.447428][T15101] syzkaller1: entered allmulticast mode [ 452.465891][T11546] netdevsim netdevsim0 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 452.465939][T11546] netdevsim netdevsim0 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 452.466028][T11546] netdevsim netdevsim0 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 452.466064][T11546] netdevsim netdevsim0 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 453.657407][T15150] __nla_validate_parse: 8 callbacks suppressed [ 453.657431][T15150] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2305'. [ 453.672921][ T4952] block nbd1: Possible stuck request ffff888028137000: control (read@0,1024B). Runtime 18 seconds [ 453.673038][ T4952] block nbd1: Possible stuck request ffff8880281371c0: control (read@1024,1024B). Runtime 18 seconds [ 453.673114][ T4952] block nbd1: Possible stuck request ffff888028137380: control (read@2048,1024B). Runtime 18 seconds [ 453.680120][ T4952] block nbd1: Possible stuck request ffff888028137540: control (read@3072,1024B). Runtime 18 seconds [ 453.846525][T15162] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2306'. [ 454.111752][T15176] netlink: 20 bytes leftover after parsing attributes in process `syz.3.2310'. [ 454.232358][T15182] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 454.556421][T15192] veth7: entered allmulticast mode [ 454.808135][T15203] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2319'. [ 454.849841][T15206] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2320'. [ 454.944913][T15211] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2322'. [ 454.950522][T15211] netlink: 28 bytes leftover after parsing attributes in process `syz.0.2322'. [ 455.004312][T15204] netlink: 1156 bytes leftover after parsing attributes in process `syz.4.2318'. [ 455.415155][T15239] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2330'. [ 455.713417][T15251] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2331'. [ 456.799475][T15290] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 457.032123][ T4952] block nbd1: Possible stuck request ffff888028137000: control (read@0,1024B). Runtime 20 seconds [ 457.032169][ T4952] block nbd1: Possible stuck request ffff8880281371c0: control (read@1024,1024B). Runtime 20 seconds [ 457.032198][ T4952] block nbd1: Possible stuck request ffff888028137380: control (read@2048,1024B). Runtime 20 seconds [ 457.032227][ T4952] block nbd1: Possible stuck request ffff888028137540: control (read@3072,1024B). Runtime 20 seconds [ 457.185497][T15292] A link change request failed with some changes committed already. Interface veth1_to_bod may have been left with an inconsistent configuration, please check. [ 457.285397][T15309] bond10: option ad_select: invalid value (34) [ 457.288103][T15309] bond10 (unregistering): Released all slaves [ 457.813126][T15318] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 458.789058][T15345] __nla_validate_parse: 7 callbacks suppressed [ 458.789098][T15345] netlink: 1156 bytes leftover after parsing attributes in process `syz.3.2355'. [ 459.096772][T15373] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2365'. [ 459.226747][T15371] wg2 speed is unknown, defaulting to 1000 [ 459.300438][T15386] netlink: 'syz.0.2368': attribute type 1 has an invalid length. [ 459.359884][T15391] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2367'. [ 459.660615][T15386] bond7: entered promiscuous mode [ 459.661191][T15386] 8021q: adding VLAN 0 to HW filter on device bond7 [ 459.708679][T15403] netlink: 2 bytes leftover after parsing attributes in process `syz.2.2369'. [ 459.728493][T15403] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 459.746660][T15400] veth7: entered allmulticast mode [ 459.781213][T15400] bond7: (slave veth7): making interface the new active one [ 459.781241][T15400] veth7: entered promiscuous mode [ 459.845160][T15400] bond7: (slave veth7): Enslaving as an active interface with an up link [ 459.904921][T15402] veth9: entered allmulticast mode [ 459.937234][T15402] bond7: (slave veth9): Enslaving as a backup interface with an up link [ 460.018284][T15371] gre0 speed is unknown, defaulting to 1000 [ 460.304055][T15412] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 460.414193][ T4952] block nbd1: Possible stuck request ffff888028137000: control (read@0,1024B). Runtime 22 seconds [ 460.414242][ T4952] block nbd1: Possible stuck request ffff8880281371c0: control (read@1024,1024B). Runtime 22 seconds [ 460.414271][ T4952] block nbd1: Possible stuck request ffff888028137380: control (read@2048,1024B). Runtime 22 seconds [ 460.414316][ T4952] block nbd1: Possible stuck request ffff888028137540: control (read@3072,1024B). Runtime 22 seconds [ 460.491386][T15422] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2373'. [ 461.166330][T15477] x_tables: ip_tables: DNAT target: used from hooks POSTROUTING, but only usable from PREROUTING/OUTPUT [ 461.279484][T15487] dvmrp16: entered allmulticast mode [ 461.330577][T15508] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2387'. [ 461.330713][T15508] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2387'. [ 461.397187][T15487] batadv_slave_0: Caught tx_queue_len zero misconfig [ 461.937799][T15519] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2391'. [ 462.337472][T15541] netlink: 20 bytes leftover after parsing attributes in process `syz.1.2397'. [ 462.908618][T15562] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2399'. [ 463.034700][T15564] Bluetooth: ISO socket layer initialized [ 463.143833][T15572] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 463.314742][T15584] x_tables: ip_tables: DNAT target: used from hooks POSTROUTING, but only usable from PREROUTING/OUTPUT [ 463.754035][ T4952] block nbd1: Possible stuck request ffff888028137000: control (read@0,1024B). Runtime 24 seconds [ 463.754098][ T4952] block nbd1: Possible stuck request ffff8880281371c0: control (read@1024,1024B). Runtime 24 seconds [ 463.754128][ T4952] block nbd1: Possible stuck request ffff888028137380: control (read@2048,1024B). Runtime 24 seconds [ 463.754156][ T4952] block nbd1: Possible stuck request ffff888028137540: control (read@3072,1024B). Runtime 24 seconds [ 464.113354][T15605] __nla_validate_parse: 3 callbacks suppressed [ 464.113379][T15605] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2415'. [ 464.395789][T15627] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2419'. [ 464.929325][T15656] geneve3: entered promiscuous mode [ 464.929350][T15656] geneve3: entered allmulticast mode [ 465.006487][T15659] x_tables: ip_tables: DNAT target: used from hooks POSTROUTING, but only usable from PREROUTING/OUTPUT [ 465.077890][T15667] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 465.479317][T15678] af_packet: tpacket_rcv: packet too big, clamped from 44 to 4294967272. macoff=96 [ 465.503344][T15683] pim6reg99999990: entered allmulticast mode [ 465.628132][T15686] netlink: zone id is out of range [ 465.628150][T15686] netlink: zone id is out of range [ 465.628158][T15686] netlink: zone id is out of range [ 465.628167][T15686] netlink: zone id is out of range [ 465.628663][T15686] netlink: zone id is out of range [ 465.628673][T15686] netlink: zone id is out of range [ 465.628686][T15686] netlink: zone id is out of range [ 465.628694][T15686] netlink: zone id is out of range [ 466.039750][T15700] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2441'. [ 466.170058][T15711] netlink: 'syz.0.2444': attribute type 8 has an invalid length. [ 466.310979][T15720] RDS: rds_bind could not find a transport for 2001::1, load rds_tcp or rds_rdma? [ 466.313069][T15720] netlink: 324 bytes leftover after parsing attributes in process `syz.0.2446'. [ 466.591072][T15727] smc: net device lo applied user defined pnetid SYZ0 [ 467.112417][ T4952] block nbd1: Possible stuck request ffff888028137000: control (read@0,1024B). Runtime 26 seconds [ 467.112465][ T4952] block nbd1: Possible stuck request ffff8880281371c0: control (read@1024,1024B). Runtime 26 seconds [ 467.112495][ T4952] block nbd1: Possible stuck request ffff888028137380: control (read@2048,1024B). Runtime 26 seconds [ 467.112524][ T4952] block nbd1: Possible stuck request ffff888028137540: control (read@3072,1024B). Runtime 26 seconds [ 467.219000][T15754] syzkaller0: left promiscuous mode [ 467.219025][T15754] syzkaller0: left allmulticast mode [ 467.640462][T15777] netlink: 'syz.0.2462': attribute type 1 has an invalid length. [ 467.680258][T15777] bond8: entered promiscuous mode [ 467.680780][T15777] 8021q: adding VLAN 0 to HW filter on device bond8 [ 467.706678][T15778] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2462'. [ 467.774735][T15781] bond8: (slave bridge2): making interface the new active one [ 467.774764][T15781] bridge2: entered promiscuous mode [ 467.776456][T15781] bond8: (slave bridge2): Enslaving as an active interface with an up link [ 467.822159][ T31] audit: type=1804 audit(1790847322.095:13): pid=15783 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.2.2463" name="/newroot/509/cgroup.controllers" dev="tmpfs" ino=2651 res=1 errno=0 [ 467.825660][ T31] audit: type=1800 audit(1790847322.095:14): pid=15783 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.2463" name="cgroup.controllers" dev="tmpfs" ino=2651 res=0 errno=0 [ 468.007597][T15780] netlink: 14 bytes leftover after parsing attributes in process `syz.4.2461'. [ 468.069579][T15796] netlink: 'syz.2.2465': attribute type 1 has an invalid length. [ 468.087291][T15798] dvmrp16: entered allmulticast mode [ 468.388033][T15807] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2467'. [ 468.522377][T15813] netlink: 56 bytes leftover after parsing attributes in process `syz.2.2469'. [ 469.051362][T15833] xt_hashlimit: size too large, truncated to 1048576 [ 469.517807][T15852] netlink: 48 bytes leftover after parsing attributes in process `syz.2.2479'. [ 469.973663][T15881] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2488'. [ 470.478362][ T4952] block nbd1: Possible stuck request ffff888028137000: control (read@0,1024B). Runtime 28 seconds [ 470.478414][ T4952] block nbd1: Possible stuck request ffff8880281371c0: control (read@1024,1024B). Runtime 28 seconds [ 470.478449][ T4952] block nbd1: Possible stuck request ffff888028137380: control (read@2048,1024B). Runtime 28 seconds [ 470.478483][ T4952] block nbd1: Possible stuck request ffff888028137540: control (read@3072,1024B). Runtime 28 seconds [ 470.680746][T15904] netlink: 104 bytes leftover after parsing attributes in process `syz.2.2500'. [ 471.111746][ C0] ip6_tunnel: ip6gretap2 xmit: Local address not yet configured! [ 471.337195][T15939] netlink: 664 bytes leftover after parsing attributes in process `syz.3.2517'. [ 471.700149][T15962] netlink: 91 bytes leftover after parsing attributes in process `syz.2.2529'. [ 471.776548][T15966] netlink: 128 bytes leftover after parsing attributes in process `syz.2.2531'. [ 471.776577][T15966] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2531'. [ 472.115666][T15980] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2538'. [ 472.292363][T15988] xt_hashlimit: size too large, truncated to 1048576 [ 473.431706][ T5631] Bluetooth: hci0: Opcode 0x0c03 failed: -110 [ 473.834096][ T4952] block nbd1: Possible stuck request ffff888028137000: control (read@0,1024B). Runtime 30 seconds [ 473.834144][ T4952] block nbd1: Possible stuck request ffff8880281371c0: control (read@1024,1024B). Runtime 30 seconds [ 473.834173][ T4952] block nbd1: Possible stuck request ffff888028137380: control (read@2048,1024B). Runtime 30 seconds [ 473.834203][ T4952] block nbd1: Possible stuck request ffff888028137540: control (read@3072,1024B). Runtime 30 seconds [ 474.526575][T16076] netlink: 124 bytes leftover after parsing attributes in process `syz.2.2583'. [ 475.081214][T16095] Unsupported ieee802154 address type: 0 [ 475.538178][T16111] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2600'. [ 476.234223][ C0] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 476.797568][T16155] net_ratelimit: 16657 callbacks suppressed [ 476.797596][T16155] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 477.044908][T16165] ip_tables: iptables: counters copy to user failed while replacing table [ 477.192311][ T4952] block nbd1: Possible stuck request ffff888028137000: control (read@0,1024B). Runtime 32 seconds [ 477.192374][ T4952] block nbd1: Possible stuck request ffff8880281371c0: control (read@1024,1024B). Runtime 32 seconds [ 477.192405][ T4952] block nbd1: Possible stuck request ffff888028137380: control (read@2048,1024B). Runtime 32 seconds [ 477.192434][ T4952] block nbd1: Possible stuck request ffff888028137540: control (read@3072,1024B). Runtime 32 seconds [ 477.381271][T16184] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2633'. [ 478.100557][T16206] netlink: 32 bytes leftover after parsing attributes in process `syz.0.2645'. [ 478.257953][T16212] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2646'. [ 478.260217][T16212] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2646'. [ 478.361004][T16215] pim6reg: entered allmulticast mode [ 478.502976][T16222] x_tables: ip_tables: DNAT target: used from hooks POSTROUTING, but only usable from PREROUTING/OUTPUT [ 478.623230][T16226] netlink: 164 bytes leftover after parsing attributes in process `syz.0.2652'. [ 478.642492][T16227] bridge4: entered promiscuous mode [ 478.642517][T16227] bridge4: entered allmulticast mode [ 478.689921][T16221] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2649'. [ 478.705471][T16213] pim6reg: left allmulticast mode [ 478.740311][T16231] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2652'. [ 478.749102][T16232] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2651'. [ 478.792530][ C0] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 478.802544][T16236] netlink: 'syz.3.2651': attribute type 2 has an invalid length. [ 478.963487][T16232] netlink: 'syz.3.2651': attribute type 1 has an invalid length. [ 478.963513][T16232] netlink: 'syz.3.2651': attribute type 2 has an invalid length. [ 479.023529][T16240] dvmrp0: entered allmulticast mode [ 479.040858][T16240] dvmrp1: entered allmulticast mode [ 479.051027][T16240] dvmrp0: left allmulticast mode [ 479.051154][T16240] dvmrp1: left allmulticast mode [ 479.051249][T16240] syz_tun: left allmulticast mode [ 479.051359][T16240] dvmrp16: left allmulticast mode [ 479.434806][ C0] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 479.794530][T16266] xt_l2tp: wrong L2TP version: 0 [ 479.855493][T16267] netlink: 'syz.0.2662': attribute type 4 has an invalid length. [ 479.973725][T16264] netlink: 'syz.0.2662': attribute type 4 has an invalid length. [ 479.991123][T16269] wg2 speed is unknown, defaulting to 1000 [ 480.059993][T16267] __nla_validate_parse: 1 callbacks suppressed [ 480.060021][T16267] netlink: 44 bytes leftover after parsing attributes in process `syz.0.2662'. [ 480.354066][T16269] gre0 speed is unknown, defaulting to 1000 [ 480.532264][T16285] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2667'. [ 480.552250][ T4952] block nbd1: Possible stuck request ffff888028137000: control (read@0,1024B). Runtime 34 seconds [ 480.552304][ T4952] block nbd1: Possible stuck request ffff8880281371c0: control (read@1024,1024B). Runtime 34 seconds [ 480.552335][ T4952] block nbd1: Possible stuck request ffff888028137380: control (read@2048,1024B). Runtime 34 seconds [ 480.552380][ T4952] block nbd1: Possible stuck request ffff888028137540: control (read@3072,1024B). Runtime 34 seconds [ 480.623890][T16290] pim6reg: entered allmulticast mode [ 480.878905][T16296] x_tables: ip_tables: DNAT target: used from hooks POSTROUTING, but only usable from PREROUTING/OUTPUT [ 481.171025][ T4938] block nbd0: Receive control failed (result -32) [ 481.171025][ T5631] block nbd0: Receive control failed (result -32) [ 481.387299][T16287] pim6reg: left allmulticast mode [ 481.709495][T16320] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2675'. [ 482.281849][T16345] tipc: Bearer : already 2 bearers with priority 10 [ 482.281873][T16345] tipc: Bearer : trying with adjusted priority [ 482.282041][T16345] tipc: Enabled bearer , priority 9 [ 482.971612][T16353] netlink: 'syz.3.2681': attribute type 15 has an invalid length. [ 483.334028][T16379] pim6reg: entered allmulticast mode [ 483.334352][T16375] wg2 speed is unknown, defaulting to 1000 [ 483.398336][T16381] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 483.602044][T16387] x_tables: ip_tables: DNAT target: used from hooks POSTROUTING, but only usable from PREROUTING/OUTPUT [ 483.768305][T16390] FAULT_INJECTION: forcing a failure. [ 483.768305][T16390] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 483.768344][T16390] CPU: 0 UID: 0 PID: 16390 Comm: syz.1.2689 Not tainted syzkaller #0 PREEMPT(full) [ 483.768379][T16390] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 483.768392][T16390] Call Trace: [ 483.768402][T16390] [ 483.768411][T16390] dump_stack_lvl+0xe8/0x150 [ 483.768446][T16390] should_fail_ex+0x410/0x560 [ 483.768474][T16390] _copy_from_user+0x2d/0xb0 [ 483.768501][T16390] do_sys_poll+0x258/0x1110 [ 483.768537][T16390] ? __lock_acquire+0x747/0x2de0 [ 483.768565][T16390] ? __pfx_do_sys_poll+0x10/0x10 [ 483.768594][T16390] ? lock_acquire+0x115/0x350 [ 483.768747][T16390] ? __pfx_timespec64_add_safe+0x10/0x10 [ 483.768790][T16390] __x64_sys_poll+0x190/0x360 [ 483.768823][T16390] ? __pfx___x64_sys_poll+0x10/0x10 [ 483.768866][T16390] do_syscall_64+0x166/0x520 [ 483.768897][T16390] ? trace_irq_disable+0x3b/0x140 [ 483.768920][T16390] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 483.768943][T16390] ? clear_bhb_loop+0x70/0xc0 [ 483.768972][T16390] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 483.768995][T16390] RIP: 0033:0x7fdfce19e159 [ 483.769016][T16390] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 483.769035][T16390] RSP: 002b:00007fdfcf0fb028 EFLAGS: 00000246 ORIG_RAX: 0000000000000007 [ 483.769060][T16390] RAX: ffffffffffffffda RBX: 00007fdfce425fa0 RCX: 00007fdfce19e159 [ 483.769077][T16390] RDX: 0000000000000009 RSI: 20000000000000b5 RDI: 0000200000000000 [ 483.769092][T16390] RBP: 00007fdfcf0fb090 R08: 0000000000000000 R09: 0000000000000000 [ 483.769107][T16390] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 483.769120][T16390] R13: 00007fdfce426038 R14: 00007fdfce425fa0 R15: 00007ffd6722e0b8 [ 483.769157][T16390] [ 483.915186][ T4952] block nbd1: Possible stuck request ffff888028137000: control (read@0,1024B). Runtime 36 seconds [ 483.915312][ T4952] block nbd1: Possible stuck request ffff8880281371c0: control (read@1024,1024B). Runtime 36 seconds [ 483.915386][ T4952] block nbd1: Possible stuck request ffff888028137380: control (read@2048,1024B). Runtime 36 seconds [ 483.915459][ T4952] block nbd1: Possible stuck request ffff888028137540: control (read@3072,1024B). Runtime 36 seconds [ 484.100348][T16372] pim6reg: left allmulticast mode [ 484.148078][T16375] gre0 speed is unknown, defaulting to 1000 [ 484.293291][T16398] netlink: 'syz.3.2692': attribute type 11 has an invalid length. [ 484.333034][T16395] netlink: 1136 bytes leftover after parsing attributes in process `syz.1.2690'. [ 484.451285][T16403] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2693'. [ 484.470512][T16403] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2693'. [ 484.470551][T16403] netlink: 'syz.2.2693': attribute type 8 has an invalid length. [ 484.470566][T16403] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2693'. [ 484.521254][T16405] netlink: 'syz.3.2694': attribute type 1 has an invalid length. [ 484.606158][T16405] 8021q: adding VLAN 0 to HW filter on device bond10 [ 484.652999][T16406] netlink: 316 bytes leftover after parsing attributes in process `syz.2.2693'. [ 484.685507][T16408] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 484.700396][T16408] bond10: (slave batadv0): making interface the new active one [ 484.710976][T16408] bond10: (slave batadv0): Enslaving as an active interface with an up link [ 484.730837][T16411] netdevsim netdevsim1: Firmware load for './file0/file0/..' refused, path contains '..' component [ 484.767876][T16405] bond10 (unregistering): (slave batadv0): Releasing active interface [ 484.810791][T16405] bond10 (unregistering): Released all slaves [ 484.927127][T16419] bond_slave_1: Caught tx_queue_len zero misconfig [ 485.042347][T16422] netlink: 68 bytes leftover after parsing attributes in process `syz.2.2697'. [ 485.252627][T16434] FAULT_INJECTION: forcing a failure. [ 485.252627][T16434] name failslab, interval 1, probability 0, space 0, times 0 [ 485.252664][T16434] CPU: 1 UID: 0 PID: 16434 Comm: syz.1.2700 Not tainted syzkaller #0 PREEMPT(full) [ 485.252689][T16434] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 485.252703][T16434] Call Trace: [ 485.252713][T16434] [ 485.252722][T16434] dump_stack_lvl+0xe8/0x150 [ 485.252761][T16434] should_fail_ex+0x410/0x560 [ 485.252794][T16434] should_failslab+0xa8/0x100 [ 485.252827][T16434] __kmalloc_cache_noprof+0xa3/0x600 [ 485.252852][T16434] ? __pollwait+0x27f/0x430 [ 485.252878][T16434] ? __pollwait+0x27f/0x430 [ 485.252911][T16434] __pollwait+0x27f/0x430 [ 485.252942][T16434] ? __pfx___pollwait+0x10/0x10 [ 485.252969][T16434] pipe_poll+0x20f/0x570 [ 485.252996][T16434] ? __pfx_pipe_poll+0x10/0x10 [ 485.253022][T16434] do_sys_poll+0x990/0x1110 [ 485.253070][T16434] ? __pfx_do_sys_poll+0x10/0x10 [ 485.253101][T16434] ? lock_acquire+0x115/0x350 [ 485.253131][T16434] ? __pfx___pollwait+0x10/0x10 [ 485.253163][T16434] ? __pfx_pollwake+0x10/0x10 [ 485.253196][T16434] ? __pfx_pollwake+0x10/0x10 [ 485.253229][T16434] ? __pfx_pollwake+0x10/0x10 [ 485.253262][T16434] ? __pfx_pollwake+0x10/0x10 [ 485.253295][T16434] ? __pfx_pollwake+0x10/0x10 [ 485.253328][T16434] ? __pfx_pollwake+0x10/0x10 [ 485.253361][T16434] ? __pfx_pollwake+0x10/0x10 [ 485.253394][T16434] ? __pfx_pollwake+0x10/0x10 [ 485.253436][T16434] ? __pfx_pollwake+0x10/0x10 [ 485.253511][T16434] ? __pfx_timespec64_add_safe+0x10/0x10 [ 485.253552][T16434] __x64_sys_poll+0x190/0x360 [ 485.253584][T16434] ? __pfx___x64_sys_poll+0x10/0x10 [ 485.253627][T16434] do_syscall_64+0x166/0x520 [ 485.253657][T16434] ? trace_irq_disable+0x3b/0x140 [ 485.253682][T16434] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 485.253705][T16434] ? clear_bhb_loop+0x70/0xc0 [ 485.253734][T16434] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 485.253756][T16434] RIP: 0033:0x7fdfce19e159 [ 485.253777][T16434] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 485.253796][T16434] RSP: 002b:00007fdfcf0fb028 EFLAGS: 00000246 ORIG_RAX: 0000000000000007 [ 485.253821][T16434] RAX: ffffffffffffffda RBX: 00007fdfce425fa0 RCX: 00007fdfce19e159 [ 485.253838][T16434] RDX: 0000000000000009 RSI: 20000000000000b5 RDI: 0000200000000000 [ 485.253854][T16434] RBP: 00007fdfcf0fb090 R08: 0000000000000000 R09: 0000000000000000 [ 485.253867][T16434] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 485.253881][T16434] R13: 00007fdfce426038 R14: 00007fdfce425fa0 R15: 00007ffd6722e0b8 [ 485.253917][T16434] [ 485.742239][T16439] pim6reg: entered allmulticast mode [ 485.895259][T16441] x_tables: ip_tables: DNAT target: used from hooks POSTROUTING, but only usable from PREROUTING/OUTPUT [ 486.140616][ T4938] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 486.152333][ T4938] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 486.154844][ T4938] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 486.158390][ T4938] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 486.160677][ T4938] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 486.218716][T16451] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2705'. [ 486.218740][T16451] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2705'. [ 486.246860][T16447] 8021q: adding VLAN 0 to HW filter on device bond9 [ 486.276209][T16451] bond9: (slave bond0): making interface the new active one [ 486.279435][T16451] bond9: (slave bond0): Enslaving as an active interface with an up link [ 486.310299][T15498] bond0: (slave bond_slave_0): link status definitely down, disabling slave [ 486.321403][T15498] bond0: (slave c@0Ù): link status definitely down, disabling slave [ 486.327273][T15498] bond0: now running without any active interface! [ 486.385179][T15498] bond9: (slave bond0): link status definitely down, disabling slave [ 486.389665][T15498] bond9: now running without any active interface! [ 486.410646][T16452] netlink: 'syz.0.2705': attribute type 2 has an invalid length. [ 486.410673][T16452] netlink: 40 bytes leftover after parsing attributes in process `syz.0.2705'. [ 486.481994][T16437] pim6reg: left allmulticast mode [ 486.680669][T16462] dvmrp0: entered allmulticast mode [ 486.724839][T16448] wg2 speed is unknown, defaulting to 1000 [ 486.955288][T16448] gre0 speed is unknown, defaulting to 1000 [ 487.272746][ T4952] block nbd1: Possible stuck request ffff888028137000: control (read@0,1024B). Runtime 38 seconds [ 487.272808][ T4952] block nbd1: Possible stuck request ffff8880281371c0: control (read@1024,1024B). Runtime 38 seconds [ 487.272838][ T4952] block nbd1: Possible stuck request ffff888028137380: control (read@2048,1024B). Runtime 38 seconds [ 487.272867][ T4952] block nbd1: Possible stuck request ffff888028137540: control (read@3072,1024B). Runtime 38 seconds [ 487.422095][T16448] bridge0: port 1(bridge_slave_0) entered blocking state [ 487.422269][T16448] bridge0: port 1(bridge_slave_0) entered disabled state [ 487.422710][T16448] bridge_slave_0: entered allmulticast mode [ 487.424138][T16448] bridge_slave_0: entered promiscuous mode [ 487.448620][T16448] bridge0: port 2(bridge_slave_1) entered blocking state [ 487.448916][T16448] bridge0: port 2(bridge_slave_1) entered disabled state [ 487.449738][T16448] bridge_slave_1: entered allmulticast mode [ 487.465530][T16448] bridge_slave_1: entered promiscuous mode [ 487.506559][T16448] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 487.510518][T16448] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 487.550875][T16448] team0: Port device team_slave_0 added [ 487.558399][T16448] team0: Port device team_slave_1 added [ 487.594528][T16448] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 487.594551][T16448] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 487.594583][T16448] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 487.596322][T16448] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 487.596342][T16448] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 487.596373][T16448] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 487.713642][T16448] hsr_slave_0: entered promiscuous mode [ 487.714668][T16448] hsr_slave_1: entered promiscuous mode [ 487.928023][T16422] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 487.953716][T16448] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 487.984603][T16448] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 487.987437][T16448] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 488.072155][T16448] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 488.089438][T16448] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 488.112061][T16448] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 488.116525][T16448] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 488.148909][T16448] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 488.200396][T16448] bridge0: port 2(bridge_slave_1) entered blocking state [ 488.200535][T16448] bridge0: port 2(bridge_slave_1) entered forwarding state [ 488.200869][T16448] bridge0: port 1(bridge_slave_0) entered blocking state [ 488.200995][T16448] bridge0: port 1(bridge_slave_0) entered forwarding state [ 488.233842][ T5631] Bluetooth: hci5: command tx timeout [ 488.249839][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 488.260545][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 488.402831][T16490] FAULT_INJECTION: forcing a failure. [ 488.402831][T16490] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 488.402871][T16490] CPU: 1 UID: 0 PID: 16490 Comm: syz.0.2711 Not tainted syzkaller #0 PREEMPT(full) [ 488.402895][T16490] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 488.402910][T16490] Call Trace: [ 488.402920][T16490] [ 488.402930][T16490] dump_stack_lvl+0xe8/0x150 [ 488.402972][T16490] should_fail_ex+0x410/0x560 [ 488.403005][T16490] _copy_to_user+0x31/0xb0 [ 488.403039][T16490] simple_read_from_buffer+0xe1/0x170 [ 488.403079][T16490] proc_fail_nth_read+0x1bb/0x230 [ 488.403102][T16490] ? common_file_perm+0x20e/0x2b0 [ 488.403136][T16490] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 488.403171][T16490] ? rw_verify_area+0x24a/0x4c0 [ 488.403209][T16490] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 488.403234][T16490] vfs_read+0x213/0xa80 [ 488.403277][T16490] ? __pfx_vfs_read+0x10/0x10 [ 488.403319][T16490] ? __pfx_timespec64_add_safe+0x10/0x10 [ 488.403360][T16490] ksys_read+0x150/0x270 [ 488.403405][T16490] ? __pfx_ksys_read+0x10/0x10 [ 488.403452][T16490] do_syscall_64+0x166/0x520 [ 488.403483][T16490] ? trace_irq_disable+0x3b/0x140 [ 488.403506][T16490] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 488.403530][T16490] ? clear_bhb_loop+0x70/0xc0 [ 488.403559][T16490] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 488.403582][T16490] RIP: 0033:0x7f278e75e98e [ 488.403603][T16490] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 488.403623][T16490] RSP: 002b:00007f278f6eafe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 488.403649][T16490] RAX: ffffffffffffffda RBX: 00007f278f6eb6c0 RCX: 00007f278e75e98e [ 488.403666][T16490] RDX: 000000000000000f RSI: 00007f278f6eb0a0 RDI: 0000000000000004 [ 488.403681][T16490] RBP: 00007f278f6eb090 R08: 0000000000000000 R09: 0000000000000000 [ 488.403695][T16490] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 488.403708][T16490] R13: 00007f278ea26038 R14: 00007f278ea25fa0 R15: 00007fff1d828ad8 [ 488.403744][T16490] [ 488.778082][T16448] 8021q: adding VLAN 0 to HW filter on device bond0 [ 488.866981][T16448] 8021q: adding VLAN 0 to HW filter on device team0 [ 488.921365][T15498] bridge0: port 1(bridge_slave_0) entered blocking state [ 488.921583][T15498] bridge0: port 1(bridge_slave_0) entered forwarding state [ 488.970638][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 488.970756][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 489.049748][T16504] netlink: 36 bytes leftover after parsing attributes in process `syz.3.2718'. [ 489.106891][T16505] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2717'. [ 489.206270][T16448] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 489.316422][T16510] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2719'. [ 489.543321][T16522] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2723'. [ 489.566017][T16519] netlink: 32 bytes leftover after parsing attributes in process `syz.2.2722'. [ 489.567335][T16519] ip6_tunnel: non-ECT from fc00:0000:0000:0000:0000:0000:0000:0000 with DS=0x6 [ 489.725199][T16529] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2726'. [ 489.755994][T16530] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2725'. [ 489.778518][T16530] syzkaller0: left promiscuous mode [ 489.778544][T16530] syzkaller0: left allmulticast mode [ 489.779296][T16530] tipc: Resetting bearer [ 490.229550][T16448] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 490.314258][ T5631] Bluetooth: hci5: command tx timeout [ 490.429003][T16558] netlink: 'syz.3.2734': attribute type 1 has an invalid length. [ 490.492288][T16558] bond10: entered promiscuous mode [ 490.492376][T16558] bond10: entered allmulticast mode [ 490.492810][T16558] 8021q: adding VLAN 0 to HW filter on device bond10 [ 490.633601][ T4952] block nbd1: Possible stuck request ffff888028137000: control (read@0,1024B). Runtime 40 seconds [ 490.633648][ T4952] block nbd1: Possible stuck request ffff8880281371c0: control (read@1024,1024B). Runtime 40 seconds [ 490.633678][ T4952] block nbd1: Possible stuck request ffff888028137380: control (read@2048,1024B). Runtime 40 seconds [ 490.633706][ T4952] block nbd1: Possible stuck request ffff888028137540: control (read@3072,1024B). Runtime 40 seconds [ 491.118932][T16585] IPv6: addrconf: prefix option has invalid lifetime [ 491.299498][T16448] veth0_vlan: entered promiscuous mode [ 491.325617][T16448] veth1_vlan: entered promiscuous mode [ 491.386412][T16448] veth0_macvtap: entered promiscuous mode [ 491.398714][T16448] veth1_macvtap: entered promiscuous mode [ 491.460551][T16448] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 491.505503][T16448] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 491.553504][T15459] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 491.556159][T15459] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 491.556219][T15459] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 491.556256][T15459] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 491.929779][T16608] __nla_validate_parse: 6 callbacks suppressed [ 491.929801][T16608] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2745'. [ 491.952773][ T5830] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 491.952797][ T5830] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 492.037169][ T5830] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 492.037201][ T5830] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 492.336690][T16621] netlink: 52 bytes leftover after parsing attributes in process `syz.3.2749'. [ 492.391684][ T5631] Bluetooth: hci5: command tx timeout [ 492.846479][T16610] tipc: Resetting bearer [ 493.439872][T16610] tipc: Resetting bearer [ 493.672422][ T5830] netdevsim netdevsim2 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 493.672462][ T5830] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 493.742119][ T5830] netdevsim netdevsim2 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 493.742157][ T5830] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 493.742212][ T5830] netdevsim netdevsim2 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 493.742253][ T5830] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 493.742291][ T5830] netdevsim netdevsim2 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 493.742318][ T5830] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 493.883635][T16634] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2753'. [ 493.993037][T16639] Bluetooth: hci0: unsupported parameter 5135 [ 493.993063][T16639] Bluetooth: hci0: unsupported parameter 8192 [ 493.993078][T16639] Bluetooth: hci0: unsupported parameter 5135 [ 493.993090][T16639] Bluetooth: hci0: unsupported parameter 8192 [ 494.045556][ T4952] block nbd1: Possible stuck request ffff888028137000: control (read@0,1024B). Runtime 42 seconds [ 494.045605][ T4952] block nbd1: Possible stuck request ffff8880281371c0: control (read@1024,1024B). Runtime 42 seconds [ 494.045635][ T4952] block nbd1: Possible stuck request ffff888028137380: control (read@2048,1024B). Runtime 42 seconds [ 494.045663][ T4952] block nbd1: Possible stuck request ffff888028137540: control (read@3072,1024B). Runtime 42 seconds [ 494.259782][T16642] wg2 speed is unknown, defaulting to 1000 [ 494.471889][ T5631] Bluetooth: hci5: command tx timeout [ 494.592505][T16656] netlink: 'syz.2.2757': attribute type 16 has an invalid length. [ 494.592532][T16656] netlink: 'syz.2.2757': attribute type 17 has an invalid length. [ 494.689784][T16656] ip6erspan0: left allmulticast mode [ 494.698575][T16656] gre1: left promiscuous mode [ 494.707105][T16656] geneve3: left promiscuous mode [ 494.707128][T16656] geneve3: left allmulticast mode [ 494.798614][T16642] gre0 speed is unknown, defaulting to 1000 [ 495.343994][T16692] netlink: 'syz.2.2764': attribute type 9 has an invalid length. [ 495.521094][T16669] Bluetooth: hci0: Opcode 0x0401 failed: -4 [ 495.536906][T16701] netlink: 40 bytes leftover after parsing attributes in process `syz.2.2766'. [ 495.731951][T16711] syzkaller0: entered promiscuous mode [ 495.731976][T16711] syzkaller0: entered allmulticast mode [ 495.843981][T16711] tipc: Enabling of bearer rejected, already enabled [ 496.042090][T16722] tipc: Enabling of bearer rejected, failed to enable media [ 496.044592][T16722] netlink: 196 bytes leftover after parsing attributes in process `syz.0.2773'. [ 496.361637][T16732] netlink: 24 bytes leftover after parsing attributes in process `syz.5.2776'. [ 496.597986][T16741] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 496.780290][T16751] lo: entered promiscuous mode [ 497.056268][T16751] tunl0: entered promiscuous mode [ 497.058312][T16751] gre0: entered promiscuous mode [ 497.074835][T16751] gretap0: entered promiscuous mode [ 497.079709][T16751] erspan0: entered promiscuous mode [ 497.099164][T16751] ip_vti0: entered promiscuous mode [ 497.108968][T16751] ip6_vti0: entered promiscuous mode [ 497.123864][T16751] sit0: entered promiscuous mode [ 497.130485][T16751] ip6tnl0: entered promiscuous mode [ 497.145363][T16751] ip6gre0: entered promiscuous mode [ 497.158221][T16751] syz_tun: entered promiscuous mode [ 497.170087][T16751] ip6gretap0: entered promiscuous mode [ 497.180672][T16751] bridge0: port 2(bridge_slave_1) entered disabled state [ 497.181357][T16751] bridge0: port 1(bridge_slave_0) entered disabled state [ 497.196734][T16751] bridge0: entered promiscuous mode [ 497.200239][T16751] vcan0: entered promiscuous mode [ 497.207693][T16751] bond0: entered promiscuous mode [ 497.207717][T16751] bond_slave_0: entered promiscuous mode [ 497.207934][T16751] bond_slave_1: entered promiscuous mode [ 497.233728][T16751] team0: entered promiscuous mode [ 497.233755][T16751] team_slave_0: entered promiscuous mode [ 497.233982][T16751] team_slave_1: entered promiscuous mode [ 497.237708][T16751] dummy0: entered promiscuous mode [ 497.241259][T16751] nlmon0: entered promiscuous mode [ 497.250126][T16751] batadv0: entered promiscuous mode [ 497.277126][T16751] vxcan0: entered promiscuous mode [ 497.278223][T16751] vxcan1: entered promiscuous mode [ 497.280328][T16751] veth0: entered promiscuous mode [ 497.302166][T16751] veth1: entered promiscuous mode [ 497.307174][T16751] wg0: entered promiscuous mode [ 497.310616][T16751] wg1: entered promiscuous mode [ 497.325075][T16751] wg2: entered promiscuous mode [ 497.336517][T16751] veth0_to_bridge: entered promiscuous mode [ 497.353368][ T4952] block nbd1: Possible stuck request ffff888028137000: control (read@0,1024B). Runtime 44 seconds [ 497.353416][ T4952] block nbd1: Possible stuck request ffff8880281371c0: control (read@1024,1024B). Runtime 44 seconds [ 497.353446][ T4952] block nbd1: Possible stuck request ffff888028137380: control (read@2048,1024B). Runtime 44 seconds [ 497.353476][ T4952] block nbd1: Possible stuck request ffff888028137540: control (read@3072,1024B). Runtime 44 seconds [ 497.357034][T16751] veth1_to_bridge: entered promiscuous mode [ 497.380930][T16751] veth0_to_bond: entered promiscuous mode [ 497.430186][T16751] veth1_to_bond: entered promiscuous mode [ 497.447245][T16751] veth0_to_team: entered promiscuous mode [ 497.459620][T16751] veth1_to_team: entered promiscuous mode [ 497.475670][T16751] veth0_to_batadv: entered promiscuous mode [ 497.481180][T16751] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 497.481245][T16751] batadv_slave_0: entered promiscuous mode [ 497.503357][T16751] veth1_to_batadv: entered promiscuous mode [ 497.506637][T16751] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 497.506700][T16751] batadv_slave_1: entered promiscuous mode [ 497.509980][T16751] xfrm0: entered promiscuous mode [ 497.544161][T16751] veth0_to_hsr: entered promiscuous mode [ 497.557292][T16751] veth1_to_hsr: entered promiscuous mode [ 497.569864][T16751] hsr0: entered promiscuous mode [ 497.578608][T16751] veth1_virt_wifi: entered promiscuous mode [ 497.588827][T16751] veth0_virt_wifi: entered promiscuous mode [ 497.601089][T16751] virt_wifi0: entered promiscuous mode [ 497.617192][T16751] vlan0: entered promiscuous mode [ 497.620670][T16751] vlan1: entered promiscuous mode [ 497.635295][T16751] macvlan0: entered promiscuous mode [ 497.639870][T16751] macvlan1: entered promiscuous mode [ 497.649263][T16751] ipvlan0: entered promiscuous mode [ 497.650063][T16751] ipvlan1: entered promiscuous mode [ 497.671162][T16751] macvtap0: entered promiscuous mode [ 497.684701][T16751] macsec0: entered promiscuous mode [ 497.689065][T16751] geneve0: entered promiscuous mode [ 497.706054][T16751] geneve1: entered promiscuous mode [ 497.719859][T16751] netdevsim netdevsim5 netdevsim0: entered promiscuous mode [ 497.734755][T16751] netdevsim netdevsim5 netdevsim1: entered promiscuous mode [ 497.738952][T16751] netdevsim netdevsim5 netdevsim2: entered promiscuous mode [ 497.760531][T16751] netdevsim netdevsim5 netdevsim3: entered promiscuous mode [ 497.782936][T16751] mac80211_hwsim hwsim94 wlan0: entered promiscuous mode [ 497.801743][T16751] mac80211_hwsim hwsim95 wlan1: entered promiscuous mode [ 497.803848][T16751] syztnl0: entered promiscuous mode [ 497.903717][ T5830] netdevsim netdevsim5 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 497.904835][ T5830] netdevsim netdevsim5 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 497.904875][ T5830] netdevsim netdevsim5 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 497.904907][ T5830] netdevsim netdevsim5 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 497.932435][T16766] netlink: 36 bytes leftover after parsing attributes in process `syz.0.2786'. [ 497.932631][T16766] netlink: 36 bytes leftover after parsing attributes in process `syz.0.2786'. [ 497.989460][T16772] netlink: 40 bytes leftover after parsing attributes in process `syz.5.2787'. [ 498.039156][T16772] netlink: 40 bytes leftover after parsing attributes in process `syz.5.2787'. [ 498.108136][T16766] netlink: 36 bytes leftover after parsing attributes in process `syz.0.2786'. [ 498.108208][T16766] netlink: 36 bytes leftover after parsing attributes in process `syz.0.2786'. [ 498.501853][ T4938] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 498.508728][ T4938] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 498.508797][T16766] netlink: 36 bytes leftover after parsing attributes in process `syz.0.2786'. [ 498.508860][T16766] netlink: 36 bytes leftover after parsing attributes in process `syz.0.2786'. [ 498.510093][ T4938] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 498.555854][ T4938] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 498.570985][ T4938] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 498.997084][T16816] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2797'. [ 498.997111][T16816] netlink: 24 bytes leftover after parsing attributes in process `syz.1.2797'. [ 499.154061][ T5624] syz_tun (unregistering): left allmulticast mode [ 499.168172][T16820] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 499.806442][T16794] wg2 speed is unknown, defaulting to 1000 [ 500.338668][T16794] gre0 speed is unknown, defaulting to 1000 [ 500.631651][ T5631] Bluetooth: hci6: command tx timeout [ 500.711765][ T4952] block nbd1: Possible stuck request ffff888028137000: control (read@0,1024B). Runtime 46 seconds [ 500.711810][ T4952] block nbd1: Possible stuck request ffff8880281371c0: control (read@1024,1024B). Runtime 46 seconds [ 500.711840][ T4952] block nbd1: Possible stuck request ffff888028137380: control (read@2048,1024B). Runtime 46 seconds [ 500.711869][ T4952] block nbd1: Possible stuck request ffff888028137540: control (read@3072,1024B). Runtime 46 seconds [ 500.912046][T16836] netlink: 'syz.1.2802': attribute type 2 has an invalid length. [ 501.407620][ T5830] bond1 (unregistering): (slave geneve2): Releasing active interface [ 501.483844][T16874] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 501.539413][T16873] x_tables: ip_tables: DNAT target: used from hooks POSTROUTING, but only usable from PREROUTING/OUTPUT [ 501.620580][ T5830] team0: Port device bridge2 removed [ 501.655885][ T5830] team0: Port device bridge3 removed [ 501.673408][ T5830] bond5 (unregistering): (slave bridge4): Releasing backup interface [ 501.765159][ T5830] bond1 (unregistering): Released all slaves [ 501.825673][ T5830] bond2 (unregistering): Released all slaves [ 501.858365][ T5830] bond3 (unregistering): (slave veth5): Releasing active interface [ 501.864133][ T5830] bond3 (unregistering): Released all slaves [ 501.915413][ T5830] bond4 (unregistering): Released all slaves [ 501.938837][ T5830] bond5 (unregistering): Released all slaves [ 501.964537][ T5830] bond6 (unregistering): Released all slaves [ 501.987711][ T5830] bond7 (unregistering): (slave veth7): Releasing active interface [ 501.987749][ T5830] batadv0: entered promiscuous mode [ 501.989583][ T5830] bond7 (unregistering): (slave batadv0): Releasing active interface [ 501.989606][ T5830] batadv0: left promiscuous mode [ 501.990921][ T5830] bond7 (unregistering): Released all slaves [ 502.157598][T16858] pim6reg: entered allmulticast mode [ 502.188664][T16863] dvmrp16: entered allmulticast mode [ 502.190112][T16865] syz_tun: entered allmulticast mode [ 502.326487][T16858] pim6reg: left allmulticast mode [ 502.417678][ T5830] tipc: Disabling bearer [ 502.418160][ T5830] tipc: Disabling bearer [ 502.421042][ T5830] tipc: Left network mode [ 502.712142][ T5631] Bluetooth: hci6: command tx timeout [ 502.907223][T16891] syzkaller0: create flow: hash 1616195488 index 2 [ 502.919209][T16917] netlink: 'syz.5.2814': attribute type 4 has an invalid length. [ 502.941984][T16919] netlink: 'syz.5.2814': attribute type 4 has an invalid length. [ 502.966578][T15498] syzkaller0: tun_net_xmit 76 [ 502.966836][T15498] syzkaller0: tun_net_xmit 48 [ 502.992409][ T7269] syzkaller0: tun_net_xmit 76 [ 503.103793][ T7269] syzkaller0: tun_net_xmit 76 [ 503.151757][T16889] syzkaller0: delete flow: hash 1616195488 index 2 [ 503.171740][ T6460] syzkaller0: tun_net_xmit 76 [ 503.202176][ T7269] syzkaller0: tun_net_xmit 76 [ 503.802213][T16918] Bluetooth: hci0: Opcode 0x0401 failed: -4 [ 504.021592][T16948] netlink: 'syz.5.2820': attribute type 10 has an invalid length. [ 504.084505][ T4952] block nbd1: Possible stuck request ffff888028137000: control (read@0,1024B). Runtime 48 seconds [ 504.084558][ T4952] block nbd1: Possible stuck request ffff8880281371c0: control (read@1024,1024B). Runtime 48 seconds [ 504.084586][ T4952] block nbd1: Possible stuck request ffff888028137380: control (read@2048,1024B). Runtime 48 seconds [ 504.084613][ T4952] block nbd1: Possible stuck request ffff888028137540: control (read@3072,1024B). Runtime 48 seconds [ 504.791957][ T5631] Bluetooth: hci6: command tx timeout [ 505.005102][T16955] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 506.886889][ T5631] Bluetooth: hci6: command tx timeout [ 507.442118][ T4952] block nbd1: Possible stuck request ffff888028137000: control (read@0,1024B). Runtime 50 seconds [ 507.442163][ T4952] block nbd1: Possible stuck request ffff8880281371c0: control (read@1024,1024B). Runtime 50 seconds [ 507.442192][ T4952] block nbd1: Possible stuck request ffff888028137380: control (read@2048,1024B). Runtime 50 seconds [ 507.442220][ T4952] block nbd1: Possible stuck request ffff888028137540: control (read@3072,1024B). Runtime 50 seconds [ 507.515376][ T4989] udevd[4989]: worker [14046] /devices/virtual/block/nbd1 is taking a long time [ 508.074398][ T5284] 8021q: adding VLAN 0 to HW filter on device eth1 [ 508.138971][T16948] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 508.152547][T16948] bond0: (slave netdevsim1): Enslaving as an active interface with an up link [ 508.674285][T16984] __nla_validate_parse: 3 callbacks suppressed [ 508.674307][T16984] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2829'. [ 508.709280][T16979] x_tables: ip_tables: rpfilter match: used from hooks OUTPUT, but only valid from PREROUTING [ 508.830664][T16981] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2827'. [ 509.440500][T17018] netlink: 'syz.5.2833': attribute type 1 has an invalid length. [ 509.571075][T16794] bridge0: port 1(bridge_slave_0) entered blocking state [ 509.578999][T16794] bridge0: port 1(bridge_slave_0) entered disabled state [ 509.589186][T16794] bridge_slave_0: entered allmulticast mode [ 509.604834][T16794] bridge_slave_0: entered promiscuous mode [ 509.636275][T16794] bridge0: port 2(bridge_slave_1) entered blocking state [ 509.636388][T16794] bridge0: port 2(bridge_slave_1) entered disabled state [ 509.636558][T16794] bridge_slave_1: entered allmulticast mode [ 509.657976][T16794] bridge_slave_1: entered promiscuous mode [ 510.013770][T16794] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 510.040831][T16794] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 510.267494][ T5284] 8021q: adding VLAN 0 to HW filter on device eth2 [ 510.290909][T16794] team0: Port device team_slave_0 added [ 510.310576][T16794] team0: Port device team_slave_1 added [ 510.410969][T17051] netlink: 'syz.1.2841': attribute type 1 has an invalid length. [ 510.425459][T17053] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2839'. [ 510.530267][T17051] 8021q: adding VLAN 0 to HW filter on device bond4 [ 510.590496][T16794] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 510.590517][T16794] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 510.590546][T16794] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 510.750983][T17056] bond4: (slave dummy0): making interface the new active one [ 510.766941][T17056] bond4: (slave dummy0): Enslaving as an active interface with an up link [ 510.767247][T17058] : renamed from dummy0 (while UP) [ 510.793477][ T4952] block nbd1: Possible stuck request ffff888028137000: control (read@0,1024B). Runtime 52 seconds [ 510.793540][ T4952] block nbd1: Possible stuck request ffff8880281371c0: control (read@1024,1024B). Runtime 52 seconds [ 510.793570][ T4952] block nbd1: Possible stuck request ffff888028137380: control (read@2048,1024B). Runtime 52 seconds [ 510.793599][ T4952] block nbd1: Possible stuck request ffff888028137540: control (read@3072,1024B). Runtime 52 seconds [ 510.815890][T16794] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 510.815982][T16794] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 510.816058][T16794] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 511.130590][T17072] netlink: 48 bytes leftover after parsing attributes in process `syz.3.2842'. [ 511.537716][T16794] hsr_slave_0: entered promiscuous mode [ 511.550454][T16794] hsr_slave_1: entered promiscuous mode [ 511.559115][T17088] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 511.572547][T16794] debugfs: 'hsr0' already exists in 'hsr' [ 511.572573][T16794] Cannot create hsr debugfs directory [ 511.919791][T17099] netlink: 20 bytes leftover after parsing attributes in process `syz.5.2847'. [ 512.026784][T17112] openvswitch: netlink: Missing key (keys=c0, expected=480) [ 512.496265][ T5830] hsr_slave_0: left promiscuous mode [ 512.710986][T14171] udevd[14171]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 512.924746][T17131] RDS: rds_bind could not find a transport for 2001::1, load rds_tcp or rds_rdma? [ 513.330497][ T5284] 8021q: adding VLAN 0 to HW filter on device eth3 [ 513.368791][T17128] batman_adv: batadv0: Adding interface: gretap1 [ 513.368816][T17128] batman_adv: batadv0: The MTU of interface gretap1 is too small (1462) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 513.368852][T17128] batman_adv: batadv0: Interface activated: gretap1 [ 513.552596][T17140] netlink: 9 bytes leftover after parsing attributes in process `syz.5.2852'. [ 513.620647][T17141] netlink: 5 bytes leftover after parsing attributes in process `syz.5.2852'. [ 513.620799][T17142] netlink: 5 bytes leftover after parsing attributes in process `syz.5.2852'. [ 513.654140][T17141] 0ªî{X¹¦: renamed from gretap0 [ 513.682489][T17141] 0ªî{X¹¦: left promiscuous mode [ 513.682519][T17141] 0ªî{X¹¦: entered allmulticast mode [ 513.689847][T17141] A link change request failed with some changes committed already. Interface 30ªî{X¹¦ may have been left with an inconsistent configuration, please check. [ 513.690778][T17142] 1ªî{X¹¦: renamed from 30ªî{X¹¦ (while UP) [ 513.732914][T17142] A link change request failed with some changes committed already. Interface 31ªî{X¹¦ may have been left with an inconsistent configuration, please check. [ 514.155348][ T4952] block nbd1: Possible stuck request ffff888028137000: control (read@0,1024B). Runtime 54 seconds [ 514.155400][ T4952] block nbd1: Possible stuck request ffff8880281371c0: control (read@1024,1024B). Runtime 54 seconds [ 514.155427][ T4952] block nbd1: Possible stuck request ffff888028137380: control (read@2048,1024B). Runtime 54 seconds [ 514.155456][ T4952] block nbd1: Possible stuck request ffff888028137540: control (read@3072,1024B). Runtime 54 seconds [ 514.782623][ T5830] IPVS: stop unused estimator thread 0... [ 515.146805][T17194] netlink: 24 bytes leftover after parsing attributes in process `syz.5.2858'. [ 515.329921][T17210] netlink: 24 bytes leftover after parsing attributes in process `syz.5.2858'. [ 515.818451][T17225] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2862'. [ 515.819955][T17225] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2862'. [ 516.308481][T17252] netlink: 32 bytes leftover after parsing attributes in process `syz.0.2868'. [ 516.339779][T17252] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2868'. [ 516.383130][T16794] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 516.407144][T16794] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 516.409948][T16794] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 516.433283][T16794] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 516.435300][T16794] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 516.440347][T16794] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 516.441352][T16794] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 516.482133][T16794] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 516.662184][T16794] 8021q: adding VLAN 0 to HW filter on device bond0 [ 516.700612][T16794] 8021q: adding VLAN 0 to HW filter on device team0 [ 516.764975][T17268] gretap0: entered allmulticast mode [ 516.816266][ T5830] bridge0: port 1(bridge_slave_0) entered blocking state [ 516.816394][ T5830] bridge0: port 1(bridge_slave_0) entered forwarding state [ 516.858745][T15455] bridge0: port 2(bridge_slave_1) entered blocking state [ 516.858905][T15455] bridge0: port 2(bridge_slave_1) entered forwarding state [ 517.127753][T17280] syzkaller1: entered promiscuous mode [ 517.127784][T17280] syzkaller1: entered allmulticast mode [ 517.537196][ T4952] block nbd1: Possible stuck request ffff888028137000: control (read@0,1024B). Runtime 56 seconds [ 517.537250][ T4952] block nbd1: Possible stuck request ffff8880281371c0: control (read@1024,1024B). Runtime 56 seconds [ 517.537279][ T4952] block nbd1: Possible stuck request ffff888028137380: control (read@2048,1024B). Runtime 56 seconds [ 517.537305][ T4952] block nbd1: Possible stuck request ffff888028137540: control (read@3072,1024B). Runtime 56 seconds [ 518.072241][T17330] netlink: 32 bytes leftover after parsing attributes in process `syz.5.2882'. [ 518.198700][T17331] netlink: 44 bytes leftover after parsing attributes in process `syz.5.2882'. [ 518.198731][T17331] netlink: 44 bytes leftover after parsing attributes in process `syz.5.2882'. [ 518.521199][T17325] batman_adv: batadv0: Interface deactivated: gretap1 [ 518.825623][T17352] xt_hashlimit: size too large, truncated to 1048576 [ 518.895080][T17354] xt_hashlimit: size too large, truncated to 1048576 [ 519.450916][T16794] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 519.654612][T16794] veth0_vlan: entered promiscuous mode [ 519.698988][T16794] veth1_vlan: entered promiscuous mode [ 519.847195][T16794] veth0_macvtap: entered promiscuous mode [ 519.886894][T16794] veth1_macvtap: entered promiscuous mode [ 519.935976][T16794] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 519.974744][T16794] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 520.011127][T17412] siw: device registration error -23 [ 520.022259][T17412] netlink: Only one type of NAT may be specified [ 520.022295][T17412] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 520.083353][T15474] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 520.132998][T15455] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 520.135495][T15455] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 520.135544][T15455] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 520.307848][T15494] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 520.307870][T15494] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 520.475233][ T5830] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 520.475266][ T5830] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 520.872093][ T4952] block nbd1: Possible stuck request ffff888028137000: control (read@0,1024B). Runtime 58 seconds [ 520.872141][ T4952] block nbd1: Possible stuck request ffff8880281371c0: control (read@1024,1024B). Runtime 58 seconds [ 520.872170][ T4952] block nbd1: Possible stuck request ffff888028137380: control (read@2048,1024B). Runtime 58 seconds [ 520.872199][ T4952] block nbd1: Possible stuck request ffff888028137540: control (read@3072,1024B). Runtime 58 seconds [ 521.549465][ T4938] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 521.569118][ T4938] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 521.579665][ T4938] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 521.594325][ T4938] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 521.597395][ T4938] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 522.091037][ T5621] syz_tun (unregistering): left allmulticast mode [ 522.366319][T17481] syzkaller0: entered promiscuous mode [ 522.366347][T17481] syzkaller0: entered allmulticast mode [ 522.404281][ T5839] smbdirect: ib_dev[s`z1] removed [ 522.749075][T17502] lo: left promiscuous mode [ 522.772930][T17498] wg2 speed is unknown, defaulting to 1000 [ 522.876725][T17509] IPVS: rr: FWM 3 0x00000003 - no destination available [ 523.466363][T17462] wg2 speed is unknown, defaulting to 1000 [ 523.483301][T17498] gre0 speed is unknown, defaulting to 1000 [ 523.672346][ T4938] Bluetooth: hci3: command tx timeout [ 523.740277][T17534] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2915'. [ 524.069202][T17539] netlink: 'syz.1.2917': attribute type 11 has an invalid length. [ 524.115150][T17462] gre0 speed is unknown, defaulting to 1000 [ 524.245036][ T4952] block nbd1: Possible stuck request ffff888028137000: control (read@0,1024B). Runtime 60 seconds [ 524.245082][ T4952] block nbd1: Possible stuck request ffff8880281371c0: control (read@1024,1024B). Runtime 60 seconds [ 524.245112][ T4952] block nbd1: Possible stuck request ffff888028137380: control (read@2048,1024B). Runtime 60 seconds [ 524.245140][ T4952] block nbd1: Possible stuck request ffff888028137540: control (read@3072,1024B). Runtime 60 seconds [ 524.375380][T14602] udevd[14602]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 524.807646][T17560] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2920'. [ 525.464878][T17570] netlink: 48 bytes leftover after parsing attributes in process `syz.3.2922'. [ 525.525779][T17577] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2922'. [ 525.550402][T17570] netlink: 48 bytes leftover after parsing attributes in process `syz.3.2922'. [ 525.564325][T17578] netlink: 281 bytes leftover after parsing attributes in process `syz.1.2924'. [ 525.617013][T17577] openvswitch: netlink: IPv4 frag type 228 is out of range max 2 [ 525.762595][ T4938] Bluetooth: hci3: command tx timeout [ 525.844697][T17587] vlan2: entered promiscuous mode [ 525.844723][T17587] macvlan0: entered promiscuous mode [ 525.868969][T17590] pim6reg: entered allmulticast mode [ 525.938394][T17462] bridge0: port 1(bridge_slave_0) entered blocking state [ 525.938577][T17462] bridge0: port 1(bridge_slave_0) entered disabled state [ 525.938755][T17462] bridge_slave_0: entered allmulticast mode [ 525.940874][T17462] bridge_slave_0: entered promiscuous mode [ 525.978927][T17462] bridge0: port 2(bridge_slave_1) entered blocking state [ 525.979274][T17462] bridge0: port 2(bridge_slave_1) entered disabled state [ 525.979470][T17462] bridge_slave_1: entered allmulticast mode [ 526.004003][T17462] bridge_slave_1: entered promiscuous mode [ 526.028772][T17587] syzkaller0: entered promiscuous mode [ 526.028799][T17587] syzkaller0: entered allmulticast mode [ 526.067011][T17462] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 526.070578][T17462] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 526.113613][T17599] x_tables: ip_tables: DNAT target: used from hooks POSTROUTING, but only usable from PREROUTING/OUTPUT [ 526.344441][T17462] team0: Port device team_slave_0 added [ 526.358168][T17462] team0: Port device team_slave_1 added [ 526.434868][T17462] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 526.434888][T17462] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 526.434922][T17462] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 526.437046][T17462] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 526.437064][T17462] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 526.437093][T17462] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 526.703275][T17462] hsr_slave_0: entered promiscuous mode [ 526.707744][T17462] hsr_slave_1: entered promiscuous mode [ 526.721169][T17462] debugfs: 'hsr0' already exists in 'hsr' [ 526.721242][T17462] Cannot create hsr debugfs directory [ 527.137115][T17614] ip6_tunnel: non-ECT from fc00:0000:0000:0000:0000:0000:0000:0000 with DS=0x6 [ 527.229088][T17462] netdevsim netdevsim0 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 527.259452][T17619] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2933'. [ 527.358854][T17621] netlink: 40 bytes leftover after parsing attributes in process `syz.1.2935'. [ 527.358886][T17621] netlink: 40 bytes leftover after parsing attributes in process `syz.1.2935'. [ 527.550362][T17462] netdevsim netdevsim0 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 527.591777][ T4952] block nbd1: Possible stuck request ffff888028137000: control (read@0,1024B). Runtime 62 seconds [ 527.591822][ T4952] block nbd1: Possible stuck request ffff8880281371c0: control (read@1024,1024B). Runtime 62 seconds [ 527.591853][ T4952] block nbd1: Possible stuck request ffff888028137380: control (read@2048,1024B). Runtime 62 seconds [ 527.591882][ T4952] block nbd1: Possible stuck request ffff888028137540: control (read@3072,1024B). Runtime 62 seconds [ 527.594176][T17627] netlink: 316 bytes leftover after parsing attributes in process `syz.3.2937'. [ 527.731389][T17626] batman_adv: batadv0: Adding interface: syzkaller0 [ 527.739495][T17626] batman_adv: batadv0: The MTU of interface syzkaller0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 527.739616][T17626] batman_adv: batadv0: Interface activated: syzkaller0 [ 527.841834][ T4938] Bluetooth: hci3: command tx timeout [ 527.846902][T17462] netdevsim netdevsim0 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 528.148157][T17653] netlink: 'syz.2.2942': attribute type 1 has an invalid length. [ 528.148183][T17653] netlink: 'syz.2.2942': attribute type 2 has an invalid length. [ 528.148661][T17653] netlink: 'syz.2.2942': attribute type 1 has an invalid length. [ 528.148682][T17653] netlink: 'syz.2.2942': attribute type 2 has an invalid length. [ 528.149488][T17653] xt_hashlimit: size too large, truncated to 1048576 [ 528.206051][T17462] netdevsim netdevsim0 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 528.246524][T17636] wg2 speed is unknown, defaulting to 1000 [ 528.289266][T17657] @0Ù: renamed from bond_slave_1 (while UP) [ 528.349334][T17650] batman_adv: batadv0: Interface deactivated: syzkaller0 [ 528.349361][T17650] batman_adv: batadv0: Removing interface: syzkaller0 [ 528.593463][T17656] bond5: option ad_actor_sys_prio: mode dependency failed, not supported in mode balance-rr(0) [ 528.620012][T17656] bond5 (unregistering): Released all slaves [ 528.792202][T17670] geneve2: entered promiscuous mode [ 529.033358][T17677] netlink: 'syz.3.2948': attribute type 1 has an invalid length. [ 529.033392][T17677] __nla_validate_parse: 2 callbacks suppressed [ 529.033404][T17677] netlink: 140 bytes leftover after parsing attributes in process `syz.3.2948'. [ 529.033418][T17677] netlink: 'syz.3.2948': attribute type 1 has an invalid length. [ 529.033429][T17677] netlink: 'syz.3.2948': attribute type 2 has an invalid length. [ 529.120554][T17636] gre0 speed is unknown, defaulting to 1000 [ 529.323252][T17462] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 529.350330][T17462] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 529.351161][T17462] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 529.391679][T17462] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 529.396328][T17462] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 529.415911][T17462] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 529.426477][T17462] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 529.457230][T17462] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 529.644100][T17706] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2954'. [ 529.822635][T17462] 8021q: adding VLAN 0 to HW filter on device bond0 [ 529.869944][T17462] 8021q: adding VLAN 0 to HW filter on device team0 [ 529.889794][ T5839] bridge0: port 1(bridge_slave_0) entered blocking state [ 529.889927][ T5839] bridge0: port 1(bridge_slave_0) entered forwarding state [ 529.922103][ T4938] Bluetooth: hci3: command tx timeout [ 529.968028][T15494] bridge0: port 2(bridge_slave_1) entered blocking state [ 529.968145][T15494] bridge0: port 2(bridge_slave_1) entered forwarding state [ 530.083684][T17716] block nbd0: reconnected socket [ 530.083793][T17716] block nbd0: reconnected socket [ 530.098574][T17716] netlink: 'syz.1.2959': attribute type 9 has an invalid length. [ 530.200472][ T5631] block nbd0: Receive control failed (result -32) [ 530.202063][ T4938] block nbd0: Receive control failed (result -32) [ 530.287262][T17720] x_tables: ip_tables: DNAT target: used from hooks POSTROUTING, but only usable from PREROUTING/OUTPUT [ 530.822363][T17728] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci3/hci3:200/input6 [ 530.896593][T17728] [ 530.899006][T17728] ====================================================== [ 530.906161][T17728] WARNING: possible circular locking dependency detected [ 530.913293][T17728] syzkaller #0 Not tainted [ 530.918277][T17728] ------------------------------------------------------ [ 530.925419][T17728] syz.1.2961/17728 is trying to acquire lock: [ 530.931527][T17728] ffff88801c2d4a10 (&root->kernfs_iattr_rwsem){++++}-{4:4}, at: kernfs_link_sibling+0x4c7/0x5a0 [ 530.942183][T17728] [ 530.942183][T17728] but task is already holding lock: [ 530.949681][T17728] ffff88801c2d4980 (&root->kernfs_rwsem){++++}-{4:4}, at: kernfs_add_one+0x41/0x6f0 [ 530.959159][T17728] [ 530.959159][T17728] which lock already depends on the new lock. [ 530.959159][T17728] [ 530.969604][T17728] [ 530.969604][T17728] the existing dependency chain (in reverse order) is: [ 530.978667][T17728] [ 530.978667][T17728] -> #9 (&root->kernfs_rwsem){++++}-{4:4}: [ 530.987052][T17728] down_write+0x96/0x200 [ 530.991888][T17728] kernfs_add_one+0x41/0x6f0 [ 530.997053][T17728] kernfs_create_dir_ns+0x1a1/0x230 [ 531.002829][T17728] internal_create_group+0x440/0x1180 [ 531.008776][T17728] cpuhp_invoke_callback+0x434/0x810 [ 531.014644][T17728] cpuhp_issue_call+0x3f0/0x750 [ 531.020078][T17728] __cpuhp_setup_state_cpuslocked+0x3f4/0x6f0 [ 531.026807][T17728] __cpuhp_setup_state+0x3f/0x60 [ 531.032323][T17728] do_one_initcall+0x250/0x870 [ 531.037657][T17728] do_initcall_level+0x10a/0x1a0 [ 531.043323][T17728] do_initcalls+0x59/0xa0 [ 531.048489][T17728] kernel_init_freeable+0x29d/0x3e0 [ 531.054263][T17728] kernel_init+0x22/0x1d0 [ 531.059165][T17728] ret_from_fork+0x514/0xb70 [ 531.064362][T17728] ret_from_fork_asm+0x1a/0x30 [ 531.069696][T17728] [ 531.069696][T17728] -> #8 (cpuhp_state_mutex){+.+.}-{4:4}: [ 531.077664][T17728] [ 531.077664][T17728] -> #7 (cpu_hotplug_lock){++++}-{0:0}: [ 531.085690][T17728] cpus_read_lock+0x42/0x160 [ 531.090842][T17728] static_key_slow_inc+0x12/0x30 [ 531.096457][T17728] nbd_genl_reconnect_sock_cb+0x69a/0xbb0 [ 531.102924][T17728] nbd_genl_foreach_sock+0x265/0x450 [ 531.108789][T17728] nbd_genl_reconfigure+0xbbb/0x1040 [ 531.114639][T17728] genl_family_rcv_msg_doit+0x233/0x340 [ 531.120860][T17728] genl_rcv_msg+0x614/0x7a0 [ 531.125939][T17728] netlink_rcv_skb+0x226/0x4a0 [ 531.131311][T17728] genl_rcv+0x28/0x40 [ 531.135912][T17728] netlink_unicast+0x7bd/0x940 [ 531.141340][T17728] netlink_sendmsg+0x813/0xb40 [ 531.146703][T17728] sock_sendmsg_nosec+0x14e/0x190 [ 531.152377][T17728] ____sys_sendmsg+0x54e/0x850 [ 531.157715][T17728] ___sys_sendmsg+0x2a5/0x360 [ 531.163437][T17728] __x64_sys_sendmsg+0x1b1/0x290 [ 531.168984][T17728] do_syscall_64+0x166/0x520 [ 531.174149][T17728] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 531.180604][T17728] [ 531.180604][T17728] -> #6 (&nsock->tx_lock){+.+.}-{4:4}: [ 531.188284][T17728] __mutex_lock+0x19d/0x1550 [ 531.193433][T17728] nbd_queue_rq+0x373/0xff0 [ 531.198493][T17728] blk_mq_dispatch_rq_list+0x499/0x1990 [ 531.204732][T17728] __blk_mq_sched_dispatch_requests+0xd36/0x1580 [ 531.211925][T17728] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 531.218781][T17728] blk_mq_run_work_fn+0x16c/0x300 [ 531.224646][T17728] process_scheduled_works+0xc3d/0x1630 [ 531.230959][T17728] worker_thread+0xa47/0xfb0 [ 531.236129][T17728] kthread+0x38b/0x480 [ 531.240942][T17728] ret_from_fork+0x514/0xb70 [ 531.246092][T17728] ret_from_fork_asm+0x1a/0x30 [ 531.251430][T17728] [ 531.251430][T17728] -> #5 (&cmd->lock){+.+.}-{4:4}: [ 531.258698][T17728] __mutex_lock+0x19d/0x1550 [ 531.263868][T17728] nbd_queue_rq+0xc1/0xff0 [ 531.268844][T17728] blk_mq_dispatch_rq_list+0x499/0x1990 [ 531.274948][T17728] __blk_mq_sched_dispatch_requests+0xd36/0x1580 [ 531.281849][T17728] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 531.288524][T17728] blk_mq_run_work_fn+0x16c/0x300 [ 531.294143][T17728] process_scheduled_works+0xc3d/0x1630 [ 531.300660][T17728] worker_thread+0xa47/0xfb0 [ 531.305860][T17728] kthread+0x38b/0x480 [ 531.310512][T17728] ret_from_fork+0x514/0xb70 [ 531.315721][T17728] ret_from_fork_asm+0x1a/0x30 [ 531.321077][T17728] [ 531.321077][T17728] -> #4 (set->srcu){.+.+}-{0:0}: [ 531.328269][T17728] __synchronize_srcu+0xc9/0x2f0 [ 531.333814][T17728] elevator_switch+0x1e8/0x7b0 [ 531.339239][T17728] elevator_change+0x2fa/0x480 [ 531.344624][T17728] elevator_set_default+0x375/0x440 [ 531.350597][T17728] blk_register_queue+0x3f3/0x4e0 [ 531.356646][T17728] __add_disk+0x6b8/0xdb0 [ 531.361554][T17728] add_disk_fwnode+0x100/0x3a0 [ 531.366908][T17728] nbd_dev_add+0x733/0xb60 [ 531.371895][T17728] nbd_init+0x168/0x1f0 [ 531.376799][T17728] do_one_initcall+0x250/0x870 [ 531.382136][T17728] do_initcall_level+0x10a/0x1a0 [ 531.387641][T17728] do_initcalls+0x59/0xa0 [ 531.392607][T17728] kernel_init_freeable+0x29d/0x3e0 [ 531.398423][T17728] kernel_init+0x22/0x1d0 [ 531.403312][T17728] ret_from_fork+0x514/0xb70 [ 531.408495][T17728] ret_from_fork_asm+0x1a/0x30 [ 531.413924][T17728] [ 531.413924][T17728] -> #3 (&q->elevator_lock){+.+.}-{4:4}: [ 531.421954][T17728] __mutex_lock+0x19d/0x1550 [ 531.427218][T17728] elevator_change+0x1af/0x480 [ 531.432536][T17728] elevator_set_none+0xb5/0x140 [ 531.437935][T17728] blk_mq_update_nr_hw_queues+0x5ef/0x19f0 [ 531.444294][T17728] nbd_start_device+0x189/0xb30 [ 531.449695][T17728] nbd_genl_connect+0x167d/0x1cd0 [ 531.455282][T17728] genl_family_rcv_msg_doit+0x233/0x340 [ 531.461637][T17728] genl_rcv_msg+0x614/0x7a0 [ 531.466706][T17728] netlink_rcv_skb+0x226/0x4a0 [ 531.472027][T17728] genl_rcv+0x28/0x40 [ 531.476574][T17728] netlink_unicast+0x7bd/0x940 [ 531.481917][T17728] netlink_sendmsg+0x813/0xb40 [ 531.487254][T17728] sock_sendmsg_nosec+0x14e/0x190 [ 531.492930][T17728] ____sys_sendmsg+0x54e/0x850 [ 531.498252][T17728] ___sys_sendmsg+0x2a5/0x360 [ 531.503489][T17728] __x64_sys_sendmsg+0x1b1/0x290 [ 531.509171][T17728] do_syscall_64+0x166/0x520 [ 531.514664][T17728] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 531.521118][T17728] [ 531.521118][T17728] -> #2 (&q->q_usage_counter(io)#49){++++}-{0:0}: [ 531.529982][T17728] blk_alloc_queue+0x544/0x690 [ 531.535492][T17728] __blk_mq_alloc_disk+0x194/0x390 [ 531.541339][T17728] nbd_dev_add+0x494/0xb60 [ 531.546317][T17728] nbd_init+0x168/0x1f0 [ 531.551132][T17728] do_one_initcall+0x250/0x870 [ 531.556465][T17728] do_initcall_level+0x10a/0x1a0 [ 531.561976][T17728] do_initcalls+0x59/0xa0 [ 531.566875][T17728] kernel_init_freeable+0x29d/0x3e0 [ 531.572716][T17728] kernel_init+0x22/0x1d0 [ 531.577595][T17728] ret_from_fork+0x514/0xb70 [ 531.582742][T17728] ret_from_fork_asm+0x1a/0x30 [ 531.588072][T17728] [ 531.588072][T17728] -> #1 (fs_reclaim){+.+.}-{0:0}: [ 531.595576][T17728] fs_reclaim_acquire+0x71/0x100 [ 531.601062][T17728] kmem_cache_alloc_noprof+0x5f/0x600 [ 531.606988][T17728] __kernfs_iattrs+0xdd/0x380 [ 531.612233][T17728] kernfs_iop_setattr+0xe6/0x3f0 [ 531.618281][T17728] notify_change+0xbba/0xea0 [ 531.623555][T17728] do_truncate+0x1c2/0x250 [ 531.628915][T17728] path_openat+0x15b5/0x1d60 [ 531.634082][T17728] do_file_open+0x23e/0x4a0 [ 531.639147][T17728] do_sys_openat2+0x115/0x200 [ 531.644383][T17728] __x64_sys_openat+0x138/0x170 [ 531.649793][T17728] do_syscall_64+0x166/0x520 [ 531.654947][T17728] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 531.661411][T17728] [ 531.661411][T17728] -> #0 (&root->kernfs_iattr_rwsem){++++}-{4:4}: [ 531.670064][T17728] __lock_acquire+0x164c/0x2de0 [ 531.675468][T17728] lock_acquire+0x115/0x350 [ 531.680545][T17728] down_write+0x96/0x200 [ 531.685342][T17728] kernfs_link_sibling+0x4c7/0x5a0 [ 531.691199][T17728] kernfs_add_one+0x2db/0x6f0 [ 531.696419][T17728] kernfs_create_dir_ns+0x1a1/0x230 [ 531.702201][T17728] sysfs_create_dir_ns+0x12f/0x2a0 [ 531.707888][T17728] kobject_add_internal+0x622/0xcd0 [ 531.713904][T17728] kobject_add+0x163/0x240 [ 531.718967][T17728] device_add+0x3fa/0xb80 [ 531.723992][T17728] device_create_with_groups+0x26a/0x300 [ 531.730178][T17728] led_classdev_register_ext+0x498/0x990 [ 531.736498][T17728] input_leds_connect+0x4de/0x750 [ 531.742226][T17728] input_register_device+0xd08/0x1150 [ 531.748233][T17728] hidp_session_probe+0x1a5/0x8a0 [ 531.753905][T17728] l2cap_register_user+0xbd/0x1d0 [ 531.759620][T17728] hidp_connection_add+0x1570/0x1a00 [ 531.765473][T17728] hidp_sock_ioctl+0x403/0x650 [ 531.770819][T17728] sock_do_ioctl+0x101/0x320 [ 531.775954][T17728] sock_ioctl+0x57a/0x7e0 [ 531.780844][T17728] __se_sys_ioctl+0xfc/0x170 [ 531.785988][T17728] do_syscall_64+0x166/0x520 [ 531.791219][T17728] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 531.797656][T17728] [ 531.797656][T17728] other info that might help us debug this: [ 531.797656][T17728] [ 531.807997][T17728] Chain exists of: [ 531.807997][T17728] &root->kernfs_iattr_rwsem --> cpuhp_state_mutex --> &root->kernfs_rwsem [ 531.807997][T17728] [ 531.822471][T17728] Possible unsafe locking scenario: [ 531.822471][T17728] [ 531.830029][T17728] CPU0 CPU1 [ 531.835470][T17728] ---- ---- [ 531.840859][T17728] lock(&root->kernfs_rwsem); [ 531.845652][T17728] lock(cpuhp_state_mutex); [ 531.852798][T17728] lock(&root->kernfs_rwsem); [ 531.860127][T17728] lock(&root->kernfs_iattr_rwsem); [ 531.865490][T17728] [ 531.865490][T17728] *** DEADLOCK *** [ 531.865490][T17728] [ 531.873668][T17728] locks held by syz.1.2961/17728: 5, last CPU#0: [ 531.880149][T17728] #0: ffff88802a9f42f8 (&conn->lock#2){+.+.}-{4:4}, at: l2cap_register_user+0x34/0x1d0 [ 531.890058][T17728] #1: ffffffff90406a08 (hidp_session_sem){++++}-{4:4}, at: hidp_session_probe+0x98/0x8a0 [ 531.900547][T17728] #2: ffffffff8fcc8740 (input_mutex){+.+.}-{4:4}, at: input_register_device+0xa7f/0x1150 [ 531.910517][T17728] #3: ffff888085f262f0 (&led_cdev->led_access){+.+.}-{4:4}, at: led_classdev_register_ext+0x45e/0x990 [ 531.921624][T17728] #4: ffff88801c2d4980 (&root->kernfs_rwsem){++++}-{4:4}, at: kernfs_add_one+0x41/0x6f0 [ 531.931513][T17728] [ 531.931513][T17728] stack backtrace: [ 531.937443][T17728] CPU: 0 UID: 0 PID: 17728 Comm: syz.1.2961 Not tainted syzkaller #0 PREEMPT(full) [ 531.946846][T17728] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 531.956951][T17728] Call Trace: [ 531.960266][T17728] [ 531.963326][T17728] dump_stack_lvl+0xe8/0x150 [ 531.968496][T17728] print_circular_bug+0x2e2/0x300 [ 531.973704][T17728] check_noncircular+0x12f/0x150 [ 531.978733][T17728] __lock_acquire+0x164c/0x2de0 [ 531.983625][T17728] ? __lock_acquire+0x747/0x2de0 [ 531.988737][T17728] lock_acquire+0x115/0x350 [ 531.993306][T17728] ? kernfs_link_sibling+0x4c7/0x5a0 [ 531.998633][T17728] down_write+0x96/0x200 [ 532.002924][T17728] ? kernfs_link_sibling+0x4c7/0x5a0 [ 532.008299][T17728] ? __pfx_down_write+0x10/0x10 [ 532.013208][T17728] ? kernfs_root+0x1c/0x230 [ 532.017783][T17728] ? kernfs_root+0x1c/0x230 [ 532.022321][T17728] ? kernfs_root+0x1c/0x230 [ 532.026878][T17728] ? kernfs_root+0x1ea/0x230 [ 532.031509][T17728] kernfs_link_sibling+0x4c7/0x5a0 [ 532.036658][T17728] kernfs_add_one+0x2db/0x6f0 [ 532.041389][T17728] kernfs_create_dir_ns+0x1a1/0x230 [ 532.046650][T17728] sysfs_create_dir_ns+0x12f/0x2a0 [ 532.051855][T17728] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 532.057676][T17728] ? do_raw_spin_unlock+0xf5/0x200 [ 532.062841][T17728] kobject_add_internal+0x622/0xcd0 [ 532.068116][T17728] kobject_add+0x163/0x240 [ 532.072587][T17728] ? __pfx_kobject_add+0x10/0x10 [ 532.077662][T17728] ? get_device_parent+0x366/0x3a0 [ 532.082869][T17728] device_add+0x3fa/0xb80 [ 532.087262][T17728] device_create_with_groups+0x26a/0x300 [ 532.092936][T17728] ? led_classdev_register_ext+0x45e/0x990 [ 532.098792][T17728] ? __pfx___mutex_lock+0x10/0x10 [ 532.103881][T17728] ? class_find_device+0x30a/0x380 [ 532.109161][T17728] ? __pfx_device_match_name+0x10/0x10 [ 532.114700][T17728] ? __pfx_device_create_with_groups+0x10/0x10 [ 532.120900][T17728] led_classdev_register_ext+0x498/0x990 [ 532.126586][T17728] ? __pfx_led_classdev_register_ext+0x10/0x10 [ 532.132968][T17728] ? input_open_device+0x2e3/0x560 [ 532.138126][T17728] input_leds_connect+0x4de/0x750 [ 532.143225][T17728] input_register_device+0xd08/0x1150 [ 532.148654][T17728] hidp_session_probe+0x1a5/0x8a0 [ 532.153729][T17728] ? l2cap_register_user+0x34/0x1d0 [ 532.158989][T17728] ? __pfx_hidp_session_probe+0x10/0x10 [ 532.164600][T17728] ? __init_waitqueue_head+0xa8/0x150 [ 532.170019][T17728] l2cap_register_user+0xbd/0x1d0 [ 532.175267][T17728] hidp_connection_add+0x1570/0x1a00 [ 532.180699][T17728] hidp_sock_ioctl+0x403/0x650 [ 532.185633][T17728] ? __pfx_hidp_sock_ioctl+0x10/0x10 [ 532.191166][T17728] ? do_vfs_ioctl+0x116f/0x1530 [ 532.196055][T17728] sock_do_ioctl+0x101/0x320 [ 532.200693][T17728] ? __pfx_sock_do_ioctl+0x10/0x10 [ 532.205835][T17728] ? hook_file_ioctl+0x1f2/0x600 [ 532.210838][T17728] sock_ioctl+0x57a/0x7e0 [ 532.215228][T17728] ? __pfx_sock_ioctl+0x10/0x10 [ 532.220121][T17728] ? __fget_files+0x2a/0x420 [ 532.224758][T17728] ? __fget_files+0x3a2/0x420 [ 532.229501][T17728] ? __fget_files+0x2a/0x420 [ 532.234159][T17728] ? bpf_lsm_file_ioctl+0x9/0x20 [ 532.239143][T17728] ? __pfx_sock_ioctl+0x10/0x10 [ 532.244038][T17728] __se_sys_ioctl+0xfc/0x170 [ 532.248669][T17728] do_syscall_64+0x166/0x520 [ 532.253420][T17728] ? trace_irq_disable+0x3b/0x140 [ 532.258502][T17728] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 532.264618][T17728] ? clear_bhb_loop+0x70/0xc0 [ 532.269349][T17728] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 532.275289][T17728] RIP: 0033:0x7fdfce19e159 [ 532.279746][T17728] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 532.299652][T17728] RSP: 002b:00007fdfcf0fb028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 532.308132][T17728] RAX: ffffffffffffffda RBX: 00007fdfce425fa0 RCX: 00007fdfce19e159 [ 532.316152][T17728] RDX: 0000200000000500 RSI: 00000000400448c8 RDI: 0000000000000008 [ 532.324152][T17728] RBP: 00007fdfce23506b R08: 0000000000000000 R09: 0000000000000000 [ 532.332154][T17728] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 532.340186][T17728] R13: 00007fdfce426038 R14: 00007fdfce425fa0 R15: 00007ffd6722e0b8 [ 532.348341][T17728] [ 532.356672][ T4952] block nbd1: Possible stuck request ffff888028137000: control (read@0,1024B). Runtime 64 seconds [ 532.356710][ T4952] block nbd1: Possible stuck request ffff8880281371c0: control (read@1024,1024B). Runtime 64 seconds [ 532.356736][ T4952] block nbd1: Possible stuck request ffff888028137380: control (read@2048,1024B). Runtime 64 seconds [ 532.356763][ T4952] block nbd1: Possible stuck request ffff888028137540: control (read@3072,1024B). Runtime 64 seconds [ 532.579854][T17462] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 532.636281][T17462] veth0_vlan: entered promiscuous mode [ 532.640445][T17462] veth1_vlan: entered promiscuous mode [ 532.673920][T17462] veth0_macvtap: entered promiscuous mode [ 532.677351][T17462] veth1_macvtap: entered promiscuous mode [ 532.698952][T17462] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 532.713560][T17462] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 532.731560][ T5839] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 532.731601][ T5839] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 532.770216][T17462] ieee80211 phy102: Selected rate control algorithm 'minstrel_ht' [ 532.801505][ T5830] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 532.803326][ T5830] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 532.803422][ T5830] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 532.803437][ T5830] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 532.805396][T17462] ieee80211 phy103: Selected rate control algorithm 'minstrel_ht' [ 532.864573][ T5830] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 532.864598][ T5830] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 535.673189][ T4952] block nbd1: Possible stuck request ffff888028137000: control (read@0,1024B). Runtime 66 seconds [ 535.673256][ T4952] block nbd1: Possible stuck request ffff8880281371c0: control (read@1024,1024B). Runtime 66 seconds [ 535.673285][ T4952] block nbd1: Possible stuck request ffff888028137380: control (read@2048,1024B). Runtime 66 seconds [ 535.673314][ T4952] block nbd1: Possible stuck request ffff888028137540: control (read@3072,1024B). Runtime 66 seconds [ 539.032572][ T4952] block nbd1: Possible stuck request ffff888028137000: control (read@0,1024B). Runtime 68 seconds [ 539.032616][ T4952] block nbd1: Possible stuck request ffff8880281371c0: control (read@1024,1024B). Runtime 68 seconds [ 539.032649][ T4952] block nbd1: Possible stuck request ffff888028137380: control (read@2048,1024B). Runtime 68 seconds [ 539.032668][ T4952] block nbd1: Possible stuck request ffff888028137540: control (read@3072,1024B). Runtime 68 seconds