last executing test programs: 8.420717714s ago: executing program 1 (id=1342): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0xd, 0x4, &(0x7f0000000700)=ANY=[@ANYBLOB="1800000041ffffff00000000080000009111bc000000000095"], &(0x7f0000000c40)='GPL\x00', 0x3, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x1d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffff9}, 0x94) r2 = socket(0x10, 0x3, 0x0) recvfrom$l2tp(r2, &(0x7f0000000080)=""/7, 0x7, 0x12020, 0x0, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000000200), r2) getsockname$packet(r2, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route_sched(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000900)=@newqdisc={0x30, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_clsact={0xb}]}, 0x30}}, 0x4000800) sendmsg$nl_route_sched(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000500)=@delchain={0x4c, 0x64, 0xf31, 0xfffffffb, 0x0, {0x0, 0x0, 0x0, r3, {0x0, 0xfff3}, {0xfff3, 0xffff}, {0xa, 0x1b}}, [@filter_kind_options=@f_flower={{0xb}, {0x1c, 0x2, [@TCA_FLOWER_KEY_ENC_OPTS={0x10, 0x54, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPTS_VXLAN={0x2a, 0x2, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x1}]}]}, @TCA_FLOWER_KEY_ENC_OPTS_MASK={0x8, 0x55, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPTS_ERSPAN={0x4}]}]}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40044}, 0x4804) 7.457226371s ago: executing program 1 (id=1351): r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000280)=ANY=[@ANYBLOB="8c00000010001fff28bd70000000800000000000", @ANYRES32=0x0, @ANYBLOB="efb00000800000046c0012800b00010062726964676500005c00028008000500010000000c002e00feff000005"], 0x8c}, 0x1, 0x0, 0x0, 0x4000084}, 0x14) (async) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000280)=ANY=[@ANYBLOB="8c00000010001fff28bd70000000800000000000", @ANYRES32=0x0, @ANYBLOB="efb00000800000046c0012800b00010062726964676500005c00028008000500010000000c002e00feff000005"], 0x8c}, 0x1, 0x0, 0x0, 0x4000084}, 0x14) r1 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000000)={0x0, 0x0}, &(0x7f0000000040)=0xc) setsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000000300)={{{@in6=@local, @in6=@remote, 0x4e20, 0x0, 0x4e21, 0xfb, 0x2, 0x20, 0xa0, 0x2b, 0x0, r2}, {0xa, 0x6e57, 0x401, 0x8000, 0x7d, 0x6cee, 0x4, 0x200}, {0x1ff, 0x9, 0x104, 0x4}, 0x5, 0x0, 0x1}, {{@in6=@ipv4={'\x00', '\xff\xff', @multicast2}, 0x4d5}, 0xa, @in=@rand_addr=0x64010100, 0x3500, 0x3, 0x3, 0xe, 0x1, 0x200, 0x8}}, 0xe8) 7.18057101s ago: executing program 1 (id=1355): r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f00000001c0)=0x1000000, 0xc7) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0a00000005000000020000000700000000000000", @ANYRES32, @ANYBLOB, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) r1 = socket$inet6(0xa, 0x2, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000003c0)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x801, 0x0, 0x0, {0x7}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz1\x00'}]}, @NFT_MSG_NEWSET={0x9c, 0x9, 0xa, 0x401, 0x0, 0x0, {0x7}, [@NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0x1}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_EXPR={0x5c, 0x11, 0x0, 0x1, @payload={{0xc}, @val={0x4c, 0x2, 0x0, 0x1, [@NFTA_PAYLOAD_BASE={0x8, 0x2, 0x1, 0x0, 0x4}, @NFTA_PAYLOAD_LEN={0x8, 0x4, 0x1, 0x0, 0x9b}, @NFTA_PAYLOAD_CSUM_OFFSET={0x8, 0x7, 0x1, 0x0, 0x5666de88}, @NFTA_PAYLOAD_CSUM_FLAGS={0x8}, @NFTA_PAYLOAD_DREG={0x8, 0x1, 0x1, 0x0, 0x12}, @NFTA_PAYLOAD_DREG={0x8, 0x1, 0x1, 0x0, 0x4}, @NFTA_PAYLOAD_CSUM_TYPE={0x8, 0x6, 0x1, 0x0, 0x2}, @NFTA_PAYLOAD_DREG={0x8}, @NFTA_PAYLOAD_BASE={0x8, 0x2, 0x1, 0x0, 0x2}]}}}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0xc}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x8}, @NFTA_SET_DATA_TYPE={0x8, 0x6, 0x1, 0x0, 0xffffff00}]}, @NFT_MSG_NEWCHAIN={0x78, 0x3, 0xa, 0x3, 0x0, 0x0, {0x3, 0x0, 0xa}, [@NFTA_CHAIN_HANDLE={0xc, 0x2, 0x1, 0x0, 0x4000000000000003}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_COUNTERS={0x28, 0x8, 0x0, 0x1, [@NFTA_COUNTER_PACKETS={0xc, 0x2, 0x1, 0x0, 0x2c}, @NFTA_COUNTER_PACKETS={0xc, 0x2, 0x1, 0x0, 0x7}, @NFTA_COUNTER_PACKETS={0xc, 0x2, 0x1, 0x0, 0x1}]}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x0, 0x84}}}, 0x15c}}, 0x4004810) socket$nl_xfrm(0x10, 0x3, 0x6) bind$inet6(r1, &(0x7f0000000dc0)={0xa, 0x4e20, 0x0, @ipv4={'\x00', '\xff\xff', @empty}}, 0x1c) sendto$inet6(r1, 0x0, 0x0, 0x0, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) syz_emit_ethernet(0x2a, &(0x7f0000000e00)={@local, @link_local, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x11, 0x0, @empty, @empty}, {0x300, 0x4e20, 0x8}}}}}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000000080000000000000", @ANYRES32, @ANYBLOB="000000e400"/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB], 0x48) r3 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r3, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$sock_int(r3, 0x1, 0x8, &(0x7f0000000000)=0x80, 0x4) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r3, 0x10e, 0x4, &(0x7f0000000180)=0x10000800, 0x4) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=@newlink={0x54, 0x10, 0x421, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x20}, [@IFLA_LINKINFO={0x34, 0x12, 0x0, 0x1, @ipip={{0x9}, {0x24, 0x2, 0x0, 0x1, [@IFLA_IPTUN_FWMARK={0x8, 0x14, 0x7}, @IFLA_IPTUN_ENCAP_FLAGS={0x6, 0x10, 0x7ff}, @IFLA_IPTUN_TTL={0x5, 0x4, 0x3}, @IFLA_IPTUN_FWMARK={0x8, 0x14, 0x7}]}}}]}, 0x54}}, 0x0) r5 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RATE_NEW(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000540)={0x50, r5, 0x1, 0x0, 0x25dfdbff, {0x25}, [@handle=@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, @DEVLINK_ATTR_RATE_TX_MAX={0xc, 0xa7, 0x800}, @DEVLINK_ATTR_RATE_PARENT_NODE_NAME={0xe}]}, 0x50}, 0x1, 0x0, 0x0, 0x41}, 0x24004804) r6 = socket$inet_mptcp(0x2, 0x1, 0x106) sendmmsg$inet(r6, &(0x7f0000004980)=[{{&(0x7f0000000000)={0x2, 0x4e24, @loopback}, 0x10, 0x0}}], 0x1, 0x20008000) ioctl$sock_inet_SIOCDARP(r6, 0x8953, &(0x7f00000002c0)={{0x2, 0x4e24, @initdev={0xac, 0x1e, 0x0, 0x0}}, {0x6, @multicast}, 0xe2b276ab3525f17b, {0x2, 0x4e20, @local}, 'dummy0\x00'}) socket(0x15, 0x5, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0), 0xffffffffffffffff) r9 = syz_genetlink_get_family_id$nl80211(&(0x7f00000006c0), 0xffffffffffffffff) r10 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r10, 0x8933, &(0x7f0000001240)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_TID_CONFIG(r10, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000bc0)={&(0x7f0000000380)={0x3c, r9, 0x1, 0x71bd25, 0x3, {{}, {@val={0x8, 0x3, r11}, @void}}, [@NL80211_ATTR_TID_CONFIG={0x20, 0x11d, 0x0, 0x1, [{0x1c, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_TIDS={0x6, 0x5, 0xb0}, @NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE={0x5, 0xc, 0x1}, @NL80211_TID_CONFIG_ATTR_AMSDU_CTRL={0x5}]}]}]}, 0x3c}}, 0x4) sendmsg$TIPC_NL_KEY_SET(r7, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB='\x00\x00\x00\x00', @ANYRES16=r8, @ANYBLOB="010000000000fedbdf2503000000"], 0x14}, 0x1, 0x0, 0x0, 0x2400c085}, 0x40000000) 4.441812619s ago: executing program 4 (id=1374): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = socket$packet(0x11, 0x3, 0x300) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r2) r3 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000480)=[{&(0x7f0000000000)="1400000010003507d25a806f8c6394f90324fc60", 0x14}], 0x1}, 0x200a4800) recvmsg$kcm(r3, &(0x7f0000000100)={0x0, 0xfffffffffffffcb4, &(0x7f0000000040)=[{&(0x7f00000004c0)=""/4135, 0x1027}], 0x1}, 0x120) r4 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000880)=ANY=[@ANYBLOB="14040000100001002cbd7000fedbdf25070000000200000008000000", @ANYRES32=r4, @ANYBLOB="f4031a80f0032d80"], 0x414}], 0x1}, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r7, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_FSC={0x10, 0x2, {0x4d, 0xfffffffb, 0x7fffffff}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000000}, 0x20040084) r8 = socket(0x400000000010, 0x3, 0x0) r9 = socket$unix(0x1, 0x1, 0x0) r10 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r10, 0x84, 0x22, &(0x7f0000000100)={0xfffb}, 0x10) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r8, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000022c0)=@newtfilter={0x3c, 0x2c, 0xd27, 0x30bd29, 0x25dfdc00, {0x0, 0x0, 0x0, r11, {0x4, 0xfff1}, {}, {0x8, 0xf}}, [@filter_kind_options=@f_basic={{0xa}, {0xc, 0x2, [@TCA_BASIC_CLASSID={0x8, 0x1, {0x1, 0xfff1}}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0xf7513c36066f8950}, 0x20000010) r12 = bpf$PROG_LOAD(0x5, &(0x7f0000000540)={0x3, 0x3, &(0x7f0000000480)=@framed, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0xa, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x94) bpf$BPF_PROG_ATTACH(0x8, &(0x7f00000000c0)={@fallback=r12, r12, 0x2f, 0x8, 0xffffffffffffffff, @void, @value=0x0}, 0x20) bpf$BPF_PROG_DETACH(0x9, &(0x7f00000001c0)=ANY=[@ANYRES32=r12, @ANYRES32=r12, @ANYBLOB='/\x00'/12, @ANYRES32=r12], 0x20) sendmsg$nl_route_sched(r5, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000001740)=@newqdisc={0x6c, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdf8, {0x0, 0x0, 0x0, r7, {0x5}, {}, {0xa, 0x3}}, [@qdisc_kind_options=@q_gred={{0x9}, {0x3c, 0x2, [@TCA_GRED_PARMS={0x38, 0x1, {0xa32, 0x6, 0x1, 0xc, 0x0, 0x4, 0x8, 0x4, 0x68d8, 0x5, 0x4, 0x3, 0x12, 0x6, 0xfffffffd, 0xfffffe01}}]}}]}, 0x6c}, 0x1, 0x0, 0x0, 0x40098}, 0x0) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000000)={'syzkaller0\x00', @local}) r13 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r13, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000004c0)=@newsa={0x104, 0x10, 0x7, 0x0, 0x0, {{@in6=@mcast2, @in=@multicast2, 0x4e20, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x2, 0x0, 0xee00}, {@in6=@mcast1, 0x0, 0x2b}, @in6=@private0, {0x0, 0x0, 0x2, 0x0, 0x10000000, 0xffffffffffffffff}, {0x0, 0x200000, 0x7}, {0x40000, 0xfffffffd, 0xae8}, 0x0, 0x0, 0xa, 0x2, 0x0, 0x34}, [@coaddr={0x14, 0xe, @in6=@remote}]}, 0x104}}, 0x0) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000000100)=0x207, 0x4) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000040)={'syzkaller0\x00', 0x0}) sendto$packet(r1, &(0x7f00000002c0)="05031600d3fc140000004788031c09102c28", 0xfd1e, 0x4, &(0x7f0000000140)={0x11, 0x0, r14, 0x1, 0x0, 0x6, @multicast}, 0x14) 3.878956131s ago: executing program 2 (id=1380): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000940)={0x3, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4000000000000006b113600000000009f000000000000009500000000000000"], &(0x7f0000000300)='syzkaller\x00', 0x1, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback=0xa}, 0x94) r0 = socket$unix(0x1, 0x2, 0x0) bind$unix(r0, &(0x7f0000000100)=@file={0x1, './file0\x00'}, 0x6e) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_netdev_private(r1, 0x894a, &(0x7f0000000440)="a6cc04e2d8f1c38afbf14b29b86e3a") r2 = socket$unix(0x1, 0x2, 0x0) connect$unix(r2, &(0x7f0000000180)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) writev(r2, &(0x7f00000004c0)=[{&(0x7f0000000200)="a8bf9d", 0x3}], 0x1) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x1010, 0xffffffffffffffff, 0xffffe000) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000000)={0x0, 0x0, 0x0, &(0x7f00000006c0)="518fc7dfd35c53dce578ceaa9bd5c075b2f50a355993d70060b27907acad8e2301165b47505f7fd1a6642c99fcbb1bec320b0bf7513d1634788ff096492e205bbccc103e7c78dab5650d3795cb261f55b314f50926e52b88c2e63851a8a56bfd44be8e23782723e54eeb51e87e270e1a809d66a1a48cf87535a9f2e8851823b1684d83b352250c14ecb98375ada8bb2e0e4590cfa028312b1948d0bf77c1cd0b6dccb0812c7271bb", 0xfffffffe, 0xffffffffffffffff, 0x4}, 0x38) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="1c0000000206030000000000000000000100000005000100aa24215d"], 0x1c}, 0x1, 0x0, 0x0, 0x4000}, 0x4000) bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x1a, 0x0, 0x0, 0x0, 0x80000002, 0x57, 0x0, 0x0, 0x0, '\x00', 0x0, @tracing=0x1c, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000000)={0x0, 0x1000, 0x0, 0xde0}, 0x10, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x6}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x15, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_reuseport, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8}, 0x94) r3 = socket$inet6_mptcp(0xa, 0x1, 0x106) listen(r3, 0x0) getsockopt$inet6_mptcp_buf(0xffffffffffffffff, 0x11c, 0x4, &(0x7f0000000a00)=""/152, &(0x7f0000000340)=0x98) recvmmsg(r0, &(0x7f0000000300), 0x40000000000049e, 0x1000000000fe, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000500)={0x1f, 0x10, &(0x7f0000000780)=ANY=[@ANYBLOB="1800000005000000000000008000000018110000", @ANYRES32, @ANYRESHEX=r2, @ANYRES32, @ANYBLOB="0000000000040004b7080000050000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008001ad0b75f0dfd7e559911f967628be3f8907de749d6e0fffceee8da5427e2de1a3ca459b66626ceb64666a073f6bbef1b5084"], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x11}, 0x94) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x48241, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) write$tun(r4, &(0x7f0000000600)=ANY=[@ANYBLOB="70000000ffffffffffffaaaaaaaaaabb810026f9b5004500002cfcffffffff2e9078ac1e0001e13b1a6caef9e00000010000655800189078040000000000000086ddffff0000000026a8ba4d733cd0267496b558f9e92ab775b9f98f531aaae849717f9aea27ee3e9ca3c28722c584845b7e5603be2d77efeb9bc48378232f05d7c74359"], 0x42) sendmsg$IPVS_CMD_NEW_DAEMON(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000080)=ANY=[@ANYBLOB='p\x00@\x00', @ANYRES16, @ANYRES8=r4], 0x30}, 0x1, 0x0, 0x0, 0x1}, 0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) accept4$unix(r5, &(0x7f0000000240), &(0x7f00000002c0)=0x6e, 0x800) r6 = socket$kcm(0x15, 0x5, 0x0) setsockopt$sock_attach_bpf(r6, 0x114, 0x3, 0x0, 0x10) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), r6) socket(0x15, 0x5, 0x0) 3.481092095s ago: executing program 4 (id=1381): r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) shutdown(r1, 0x1) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev}, 0x2}}, 0x2e) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=ANY=[@ANYBLOB="440000001afdffffff0a000000000000000000e8", @ANYRES32=0x0, @ANYBLOB="0000000014000300040000000000000000000000000000001400"], 0x44}, 0x1, 0x0, 0x0, 0xc0}, 0x0) r2 = socket$inet(0x2, 0x2, 0x1) sendmsg$inet(r2, &(0x7f0000000600)={&(0x7f0000000040)={0x2, 0xffff, @rand_addr=0x64010102}, 0x10, &(0x7f00000000c0)=[{&(0x7f0000000400)='\b\x00', 0x2}, {&(0x7f0000000180)="2d0000008058", 0x6}], 0x2, &(0x7f0000000100)=ANY=[@ANYBLOB="1c000000000000000000000007000000890b040a0101027f00000100000000001c000000000000000000000008"], 0x40}, 0x20000000) r3 = syz_genetlink_get_family_id$l2tp(&(0x7f00000008c0), 0xffffffffffffffff) r4 = socket$nl_generic(0x10, 0x3, 0x10) close(0x3) sendmsg$L2TP_CMD_SESSION_DELETE(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES32=r3, @ANYBLOB="010020bd70100600010007000000080009000200000008000b"], 0x3c}, 0x1, 0x0, 0x0, 0x20008000}, 0x30) 3.401687527s ago: executing program 4 (id=1382): unshare(0x20400) r0 = socket$igmp6(0xa, 0x3, 0x2) socket$inet6_mptcp(0xa, 0x1, 0x106) ioctl$XFS_IOC_FD_TO_HANDLE(0xffffffffffffffff, 0xc038586a, 0x0) r1 = bpf$MAP_CREATE(0x0, 0x0, 0x48) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) close(0x4) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, 0x0, 0x4028801) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4) r4 = bpf$MAP_CREATE(0x1900000000000000, &(0x7f0000000040)=ANY=[@ANYBLOB="1b00000000000000000000000020"], 0x48) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000e40)={0x11, 0x7, &(0x7f0000000240)=@framed={{0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x5}, [@cb_func={0x18, 0x0, 0x4, 0x0, 0x4}, @map_val={0x18, 0x4, 0x2, 0x0, r3, 0x0, 0x0, 0x0, 0x8001}]}, &(0x7f0000000200)='syzkaller\x00', 0x2, 0x0, 0x0, 0x41000, 0x43, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x7}, 0x94) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000cc0)={0x6, 0x26, &(0x7f0000000f00)=ANY=[@ANYBLOB="1800000000000000000000000300000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf090000000000005509010000000000950000000000000018450000fcffffff0000000000000000183500000500000000", @ANYRES32=r1, @ANYBLOB="0000000000000000b703000000000000850000000c000000b7000000000000001857000005000000000000000000000018010000696c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300001000000085000000060000001834000004000000000000000000000018630000040000000000000008000000bf91000000000000b7023d3ab9454de423d70000020000008500000085000000b700000000000000"], &(0x7f0000000b80)='GPL\x00', 0x2, 0xd, &(0x7f0000000bc0)=""/13, 0x41000, 0x58, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, &(0x7f0000000c00)={0x5, 0x1}, 0x8, 0x10, &(0x7f0000000c40)={0x2, 0x6, 0x0, 0x400}, 0x10, 0x0, 0x0, 0x0, &(0x7f0000000c80)=[r4, r1, 0xffffffffffffffff], 0x0, 0x10, 0xffff0001}, 0x94) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000440)=@raw={'raw\x00', 0x8, 0x3, 0x4c8, 0x0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x3f8, 0xffffffff, 0xffffffff, 0x3f8, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'bridge0\x00'}, 0x0, 0x148, 0x170, 0x0, {}, [@common=@unspec=@helper={{0x48}}, @common=@inet=@hashlimit1={{0x58}, {'bond_slave_1\x00', {0x41, 0x1ff, 0x6, 0xb0e2, 0x10001, 0x84e, 0xfffffffb, 0x18, 0x8}, {0x1}}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'erspan0\x00', 'gre0\x00', {0xff}, {}, 0x0, 0x0, 0x0, 0x4b}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'vcan0\x00', {0x3, 0x0, 0x41, 0xfffffffe, 0x2, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x528) syz_emit_ethernet(0x7e, &(0x7f0000000d80)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaabb86dd6026843500480601fe80000000000000000000e5584a010100aa00004e224a85d32fd87108b9f4f74b3f9009f8d0eb499bea1011cd92f0", @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB="2002f3d8907800101e160840a8c62540169d563df1167b340b68027cd8ac1e0302040205160000004000000200000001ff0000000100000800000000"], 0x0) pipe(&(0x7f0000000100)) socket$kcm(0xa, 0x5, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000001680)=ANY=[@ANYBLOB="282000002e00090027bd7000000000000400000004001d001020098008"], 0x2028}, 0x1, 0x0, 0x0, 0x42804}, 0x4000000) unshare(0x18000900) socket$nl_route(0x10, 0x3, 0x0) write(0xffffffffffffffff, 0x0, 0x0) bpf$BPF_PROG_QUERY(0x10, 0x0, 0x0) r6 = socket$alg(0x26, 0x5, 0x0) setsockopt$ALG_SET_KEY(r6, 0x117, 0x1, &(0x7f0000000300), 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r7 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r7, 0x84, 0xd, &(0x7f0000000000)=@assoc_value, &(0x7f0000000100)=0x8) pwritev(r0, &(0x7f0000000500)=[{&(0x7f0000000080)="023543b7ef1d308e3ebe3d63f02c25687784f2e974db65b45ea209712c53034ffcfd9f1eb6246af726179c95", 0x2c}, {&(0x7f00000000c0)="a5fd8c3462d1148fcaa007041db271fb80a511c68a9fc2dd6e75", 0x1a}, {&(0x7f0000000140)="1ec3657da9896e25673c43055d16a7aeb8b8bcc8bcffdbb635a5398453794b2d1f5c289f0fdfa0468fb31b0cca681197d980fad7add50d5247a8b32b08d93ce800abf904b0f5bfc010bac55b1e1d961e80b84c079c2d32f2e0a0972dde7b949375fbdab156b93a364ccf3b60f6270a5cb547e11531e820da9ce37f343d8b1422f39a484bdb71552a7dec68a5cccd1aa9e84211f100e80e9b240cf2b86d63d6ec6bc7d0866263a9ab4d290352eb938d0fa777f41f97ba340ed27437a48807a3177d8efdd7bbb8c8bed600a93b1c32fb", 0xcf}, {&(0x7f0000000980)="9d39d80002643cf5dec9e86679bb94633875f5dbbed3eed4546d4e4c52b0027c3222b5aa331ea56312daada82cc35368e1333fe20d4c9883862df3fee6c65f55ad814572a9a064dc7eda2bce1702adb63e353355445e88", 0x57}, {&(0x7f00000002c0)="ec439586502ae17086cf030070286280ddb6033200000080000000002bc63d35ce1120e85fb508632e9e5652f6ff063501dc1801e6561d0a404e66b0a880cfdfdebe463ae6db97536a18a55a4e0190276cbc5bef6302fb2738fe2bec69003c7b5eb1047fbfcf4c1a4b2d79a4383f61be682e104a", 0x74}, {&(0x7f0000000340)="3895d403922f94648c193f09d7fadaeec11a2fad103e32186d42117ab426f56204eb883e4d6022c622261cb5c5ed05d82867bd5e41f30f762ddebb1f8c586069def37c1fe1ade6c10bc08e63084ca0fd2e6227c7727b80555f65b90ea4b9eb21d6d0b10827aa71b8fc07250f8f95e3688299fc69c911c5ec3061d6f384be2406375b1d7bca90dd7c343f4456b1053b33d274fb82f36afe8d88d9b9da6bcfdefcbb32210300f30287e2d3b5a40371148380b8c8ca0834b20c80e13eabc432b1ed9cc4be8e39c5634ca98bd1b94cf5a1fd1b049b56e20523582987c69cd67ba6330a5e350e6a0e5a907e5334afc4c710d8097a80", 0xf3}, {&(0x7f0000000600)="79d978635f5dfd6c6fc40cef2004e873833ed5d02a5f8ad80500317e5848787917030000004a97f82b55348eae04a6dab050cac46714e36f0c3003c450a555e5a32640cb32795b1485b30d67509c304170fd13042ef7e743652d90bd9624089b981359947943f6f0d3a78e27fb16f1a662d0d760b94be038db350c8d858830dad78515dba0aab3a5", 0x88}], 0x7, 0x69, 0xa) 3.23622774s ago: executing program 2 (id=1384): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000400)=ANY=[@ANYBLOB="180000002500010324bd5502ffdbdf25010000000400ae"], 0x18}, 0x1, 0x0, 0x0, 0x4008}, 0x0) recvmsg(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000740)=[{&(0x7f00000016c0)=""/4086, 0xff6}, {&(0x7f0000003700)=""/4087, 0xff7}, {&(0x7f0000000280)=""/58, 0x3a}, {&(0x7f00000026c0)=""/4083, 0xff3}, {&(0x7f0000004700)=""/4096, 0x1000}, {&(0x7f00000000c0)=""/58, 0x3a}], 0x6}, 0x32120) socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000001540)={0x12, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="180000000000f4ff000000000000000073010f000000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xf}, 0x94) r1 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="02000000040000000800040001"], 0x48) bpf$MAP_LOOKUP_ELEM(0x5, &(0x7f00000000c0)={r1, &(0x7f0000000000), &(0x7f0000000040)=""/73}, 0x70) r2 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r2, 0x107, 0x12, &(0x7f0000000100)={0x3, 0x3}, 0x4) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$TIPC_CMD_SHOW_NAME_TABLE(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000600)={0x30, r4, 0x1, 0x0, 0x0, {{}, {}, {0x14, 0x19, {0x3, 0x1, 0x1}}}}, 0x30}}, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x6, 0xc, &(0x7f0000000140)=ANY=[@ANYBLOB="18020000fcffffff00000000000000008500000036000000180100006420002500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000001800000850000000600000095"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x1, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r5, 0x0, 0xe, 0x0, &(0x7f0000000880)="e977e82a0d0f0b11c3e35739287f", 0x0, 0x1004, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x9}, 0x50) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r5, 0x0, 0xe, 0x0, &(0x7f0000000100)="178d048604bf0bfb1945d7430008", 0x0, 0x501, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x9}, 0x50) setsockopt$packet_rx_ring(r2, 0x107, 0x5, &(0x7f0000000040)=@req3={0x1000, 0x3a, 0x1000, 0x3a, 0x9, 0x0, 0xffffffff}, 0x1c) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000540)={0x6, 0x3, &(0x7f0000000780)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x48}, 0x94) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x200000c, 0x3032, 0xffffffffffffffff, 0x0) r6 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$IPT_SO_SET_REPLACE(r6, 0x4000000000000, 0x40, &(0x7f0000000900)=@raw={'raw\x00', 0x4001, 0x3, 0x468, 0x3d0, 0xb, 0x148, 0x0, 0x148, 0x3d0, 0x230, 0x242, 0x3d0, 0x215, 0x3, 0x0, {[{{@ip={@local, @remote, 0xff, 0x0, 'batadv_slave_0\x00', 'macvtap0\x00', {}, {0xff}, 0x73, 0x2, 0xa}, 0x0, 0x2d0, 0x300, 0x0, {0xff0f000000000000}, [@common=@inet=@l2tp={{0x30}, {0x1, 0x0, 0x3, 0x0, 0xe}}, @common=@unspec=@bpf1={{0x230, 'bpf\x00', 0x0}, @pinned={0xe, 0x0, 0x6, './file0\x00'}}]}, @common=@inet=@SET2={0x30, 'SET\x00', 0x2, {{}, {0x7fc, 0x6}, 0x0, 0x1}}}, {{@uncond, 0xec010000, 0x70, 0xd0}, @common=@SET={0x60, 'SET\x00', 0x0, {{0x4, [0x1, 0x6, 0x4, 0x5, 0x8, 0x4], 0x0, 0x5}, {0x0, [0x1, 0x0, 0x2, 0x0, 0x3, 0x2], 0x0, 0x7}}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x4c8) ppoll(&(0x7f0000000240)=[{0xffffffffffffffff, 0x8407}, {r2, 0x2}], 0x2, 0x0, 0x0, 0x0) 3.235013325s ago: executing program 1 (id=1385): r0 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) ioctl$IOCTL_GET_NCIDEV_IDX(0xffffffffffffffff, 0x0, &(0x7f0000000000)=0x0) connect$nfc_llcp(r0, &(0x7f0000000080)={0x27, r1, 0x1, 0x7, 0x6, 0x3, "7f5d036e875f34ed4df9fabf3d1f5018e71dafc0ee49a8dfd06cd94c254530be1c40fd83118e823cf6589e06616b8fd78e8895743f3ec3d11c0cc3789d3792", 0x23}, 0x60) openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x5410c3, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8032, 0xffffffffffffffff, 0x0) 2.383715452s ago: executing program 1 (id=1389): r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000180)={0x700, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=ANY=[@ANYBLOB="020d000014000000f0ffffff0000000005000600000000000a0080ff00000000fc0100000000000000ffffffff000000000000000000000005000500000000000a000000000000000000000000000000000000000000080000000000000000000800120002000200000000000000000030002b0002"], 0xa0}}, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYRESOCT=0x0, @ANYRESHEX=r0, @ANYRESHEX=r0], 0x48) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000140)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a5c000000060a010400000000000000000a0000010900010073797a3100000000300004802c0001800b000100736f636b657400001c000280d70002400000000808000300000000cb08000140000000030900020073797a32000000000000000000000100000a00"/132], 0x84}, 0x1, 0x0, 0x0, 0x4000850}, 0x24000000) close(0x3) r3 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) connect$bt_l2cap(r3, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) r4 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) ioctl$sock_bt_hidp_HIDPCONNADD(r4, 0x400448c8, &(0x7f0000000400)={r3, r3, 0x6, 0x0, 0x0, 0x9, 0x5f, 0xc08, 0x1012, 0xc3, 0x1, 0x5, 'syz0\x00'}) r5 = socket(0x10, 0x3, 0x4) sendmsg$nl_route_sched(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000006c0)=@newqdisc={0x164, 0x14, 0xf0b, 0x0, 0x0, {0x2, 0x0, 0x0, 0x0, {0x5}, {0xb, 0x1}, {0x0, 0xa}}, [@qdisc_kind_options=@q_plug={{0x9}, {0xc, 0x2, {0x0, 0x200000c1}}}, @qdisc_kind_options=@q_choke={{0xa}, {0x11c, 0x2, [@TCA_CHOKE_STAB={0x104, 0x2, "775766c7eacc3f59bbdce8b09e5e50bb25080fd7182ad5b927c1fdfe3055ab6b9f10d07a5357d88548335f834e3dadd39ac5b09a96628a13a30a236e9f68779e2bae878bd6c9c3272627e845d320683c6f200195d1c068507e387786b742e5d11b2f5c3d17a42b13f1125ea5fd8b69f8c613ac572d832abdf18f3c81c42b6b6820059978dc5fc09c021d138bd4c01f36a6b4960939b5ac1f19d0cf2bfb43d8c4703a190852485da690f2e77296f0f4d6c614e1668f9ad44aa6c3b3cfab4f89ed36c9409b1aff8063f3ba5152bb026e319e86a083424ece1d2fc0890d2aafae63f68f9d76b5e4b65bcf580a4cd7c9994f4b85fe8dbd7ef9fd9469aaa615be5722"}, @TCA_CHOKE_PARMS={0x14, 0x1, {0x9, 0x1, 0xa, 0x16, 0x15, 0x15, 0x6}}]}}]}, 0x164}, 0x1, 0x0, 0x0, 0x20004040}, 0x0) r6 = socket(0x2b, 0x1, 0x1) setsockopt$inet6_IPV6_DSTOPTS(r6, 0x29, 0x3b, &(0x7f0000000080)={0x3b}, 0x8) setsockopt$RDS_CANCEL_SENT_TO(r6, 0x114, 0x1, &(0x7f0000000000)={0x2, 0x4e20, @remote}, 0x10) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="4000e10000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) r7 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1, 0xd, &(0x7f0000000300)=ANY=[@ANYBLOB="18000000000000000000000000000000850000002f00000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r7, 0x0, 0xe, 0x0, &(0x7f00000008c0)="7a7fa22c2aff88df53ef2a2d280f", 0x0, 0xa00, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 2.357022562s ago: executing program 1 (id=1392): r0 = syz_init_net_socket$llc(0x1a, 0x2, 0x0) r1 = socket$kcm(0xa, 0x3, 0x3a) sendmsg$kcm(r1, &(0x7f0000000080)={&(0x7f0000000000)=@l2tp6={0xa, 0x0, 0x0, @loopback={0xffffffffffff0000, 0xac14140c}, 0x1, 0x2}, 0x80, &(0x7f0000000b00)=[{&(0x7f00000000c0)='f', 0x1}, {&(0x7f0000000540)}, {&(0x7f00000005c0)="a41500d40f870153ee4fce193c25ab26263ea88ba244b08d18ae8faf7d8f03eb931e4c6ea59abefa0deafe4aad080951eb6cb2248f9b7b5030c0f25523f7bc7fce26e21d9cb2f496e56ba52ad15cb9df02350b229f699b58695e87994fa6b72e71c4975fb27f21c231144f4550e312fc00a115a5b8b43c9e4f8051144f3d3bb7587a1bc3e4adef44dcbac98f8c11846f30dc605a1991f3737be04d1b71392453c03acc93aa1b287e3cca9dec1ee42f5936d4e98371fa29c513e6", 0xba}, {&(0x7f00000006c0)="2048ce86e9f504a0a1212621677c30c5d24967e23f30ea1eea02186558c83aa6c66c40f6ece5b43b75977f42ac35bc44c304b341eb8107d6fb5aa637ea922ff6420f895fe5c1a33585e220ad1d953c6b3c7699e001c74dd310cb8391884aede6d5ac2a591ff8d889073136cda13303085bd54422c5f8dca2a8b25a763fffc22ce50f9710824592295b", 0x89}, {&(0x7f0000000e00)="2aa82a00ea25473cc9e3360ebbadd8ba169758f322fca210d2b7c867457b72639f1c3f3fe06d19c7094876552f34f6ce562365cac6cc9bf5440e81b7e5db4401f4ea2deb09aa79f85234ae31bd7abf9b09c695bfa200620c41e031217cace97e822902bc2e8de1d887e3784c86f950498d5570e058a5f47adbfa49136c74f4fb109ab9395bd0d8520b669ce2897e6fcaf57b77aa0ed64c01fc23f4621c30e0755509895e60eb9f06ada40a65e3471615e26b735cf72166c8957f5c30bc65c2561a04d5d786b2789b5959f1927ef10a0746a7327540159848b1ad13b8e3eabb5afe59fde89e64e0087b310aa47d7fe4df9dc59dfd0c4a6eb2228535803e4317d9b518ebabd9ede2a4ae83ddcae57627e8e1fdb91e04a4c95d3c9ef3bd100e9b27892fd37d9f4823e1b85d590d17d29420f34e9acf43cb01371477ee10132a41e1cda0d16dd317b707a7699e1c32360c04f44a0e24a78978a0da6fd06026545f2b403497f2798102971864809bbcd41547051b79a9735cffa670e795f76d482b6599d2a553f254a5968f80b3fe500bc4744d25e9f7741328526dcf4a49d2ce5b29948407892f7e072962563d865690abc1c3707ac382b3abdad2404f258d6183e0b3cf89578c50573ab118f156598278a9f7d08df520553862905df992b3a4127184776c04bea8f7d7789bcbfdbbfb50142238ffc354df5bcdee306c7f3cfdc290155a096102c08c5a34295c30dbe57a026be40e2eba634dc76551b963ad0624447e1d69f5959d85ca248a72038994a023717716a92ac9a142da90e6613e4e9f3554f757f5a487edc72ff01a96c26ea181e090cdb67d6b28394c3992f98278cf36ad1f4bf949efc54283117e8b0dff0f75c29827b9ef1c92d44ee0cbc5162e38b564455b59178d2408efe63cc52b64178189fe9d6c1f8d4aeaa5113798d9940db85f7a10f2a2ed0b7b861b0108c4916a65ef2a44aa89918a49099377b9323f0e2deac62da951648c33bd4a8cd51fdeab113623afe2fd80ca3234fb2c5ecb4e7e8943b109e9c6f9a844c92c408310226f07edfc227adb0ba9f4fb6dfde82d9c71a61dac9760aff4e50971f99550c75312a5fb89b60182688822d9905918959d3c940740bc95e033fea62156e33754b70d6aecb092aa0b2de63677374355ee45ee9e7c6f5fb50e0ad21d73e43563e1232e3dfbf1f56340133a0f4c647159d9da475699cc3ba7a36010d6bd2a04786fa960b034663d4f9d124c01e177ce8e9aa92698a59616c70113fd4a31a8ede297aa4f2b04fe149e2418c43880ddf750f06d45e5225a6c7083d795f253432e6acee59902036e9eb87b1b8de6eb577c275d23bcaa99871cbd2c8c29a3ae892e348e488614496370a105500bfd1a5342fa1e4a4344e4dc76a137a2165ab3e8f97c6a8fc3cbae2ca87dfcef4c1513147613526c4c038cf58651f8e3340b4b39f35378d95d3416986f1a145bceb849c11e23b24a33c67485e04251daa23a3acbe7b39a0e4633659436ddea19958f041be897dc672992e158b4515202055ed24335fe513f5911d67c32b49469d7c14ee0647160a3b344970452f724cd6d6e39a8944c3e53dcb33aa8faf50af0287528778db17e93eedece9e5cd3ed23dd718b537b57223acc9810bc3f4091a355d7db170a2c3137e0a3235bf4b92612dff4299a73b9bf91ee2675f010eadcab10e22be53db0e29d1c46214e67e7a8405e11f769e38a266c997f43c0400bdabe607783794f4563c6feeb59a4bd872e2a58fae457186e5e35cbcc438148962f818cbc6beb80d21177482345bf1f4b6b086ad231141c3aa4bcd13c2dd1a00fe3832d3d9fc3f32693870647fa4442c07ea08e8c03d6973e025d5c6ae92468dec31b0cd7356729b20219978ae56f7dfdd6925e5fbb449ff9b94b6f178f03d3905cfbf701ccd02c639ac2e577be6edce2a87a7249bae4302bc47348afcd4e06d55fadef47ff93c12ae97be8e3f4f73ddb28089749cb0bafe1698cfeda8e60486700d35955a9cfa9699c11d849086f724d4b64c1c9bc107beb4f5f74db9518be34cc60222c599af34d9407e788f2b097b44aec82ce0c305eac5a434e51ad5e9d05faf4423f88c5f87d334d053f165988421ed8099220715ce7f0b2f202e96e43e19ff362d9d7dba808dca41bee26b0f2cb6dc473e0ff99554eb8aa794b91e4789a67f8ee552aad3c7a5d61676ac3498fcc9c0c27dbc7cdf7816f1a9b4fab6ae54711899ea9df46d0b58845a2414660c59f80da76c0bf2ee39442c5e446b68ded7aec22a872733257f165064efb0c1555cc739106423abf24a53cf8f7fc102e88f03d7733bc0bd907e376f839bd34ae9157af02e72a13e6465c3830ae4e782bd528f5be979b64b4a38b49931ee03343b29b6a06322b99decefba9f623afc63a2406b723250faa2082dc8e03a30ce0e810e3013acf5bd5ede632a171bb2230eda6a2a47262aa4599e2dc4048211cef0a318b28d766ce93031d1ab700e615fb559a19e674afe4aa2a9e8e1ed056155ddd2769f47ee78b744b956899caca90de379acf777ea69fc53c4938ecd4f19a99f8cb21dbc50ae5bf0d3763e7f7e1ab2b0455698bfc84ab5516135a486d05f5f468f114716a848201f7b52feb5412e6c28ef6f4210d96e1ab3f01f40b8ae82a06d6d9588257f5d987906cfcae36427cccac253950a0cfa5052ee6b72c4340f14052ef0691cb033793a2170940d36223e19d8c5473bcd91c913c994875d0bb93bdf629abbb541d53e003ad5dd7b8aaade406d40f966107fefbc54268bd8e6ee11da21dcc81296de0f3db4c4650d7b2715ae6bd7090f081cfee9618d0ad8955b0196ec8cfab3bbb2eb6f57b4c683f22b07c3871325f812d0f9d3d6dba2c904aee856da3e67da73e6cf52616eded93aceb2e1c12f4ca16ab40266899296f8053bd4075ebe5bbf94db2d023e9a47b3a259ff937fdc6151e0593abb78b6bb0ec36f705b3477441948fa51cb1fe030d3a6fee63374a9107d4435c5da90091d306423996b45964b995ed967b018eb99f85d57a0e7f71405170ad2087c40aca5e16a006c55b79c145777b9673fcaf56d1c793eb5c269a00902f74e27d6358a04fe314a883a73c0d2fe97c984b74d1dc0e5a177221aa7015ce63c6918638f4136325b4b7c239d247a09da342be206a7f61b48a7e0fa5935a43b5e678b9fbbec23e8a95e71feb3e6d72781a94b635f351015cd7cddcef96be8d42d720e25980c4df871f55f42fd3dc3991adc6ed6b3816b04f401029a9745b0aa3b7e88d7702a5f0919f8dd43fff132e9a71802e0c9a3a9a2ba384aae61890571da3934cb2002aec9c5615a92bc3269e7bec9997c8d2426b9702324d9fcd2de8f17939d0ba401cd46350cccc8ba03e10ef60b7a8f311995c9e9721713184d1e35f35b3d3c5397b8d91206f72d9a04d065b566c2dbf27f1c240c1cc0a1bc505bdca22d1ad8656f7c3d7bd87544e3a0c6a15b276da339344f562c9d6377a9c5d1bc5cb28d84c69dc66f6841e48fb03f36dc43d4e21f234a349a6a18164e77223e86f43a870a5d797c2a1a6cbd0feac252547ec791bd105ff95a1ad7684ac40b2294c94abd14f7e6921bcf095c4059a5112ab96b72390b6587c8a34035cc83e6a3d4190a98c30d4f6a51e315db24676f6857783abc3d9be537da302fa7491af9004b069601747dd48c4f0dbbdf273b5c3cc134b5988c7ff68690f4dd34d1b5e22a8cb8b8ad60483ffd3b58588a0f1864bd5275d6f5fe6a82db0804f7fe9de7f6a55bb308620411c811aaf5cd7975c163fca301205d7bc69b5b6b23019a770a0b66b0bef0124b82ad8def837c67f528f069a4c703f82ab8a633233c620be9fdf42e0ad710f1fdac4674b379b608b91df55f3095c4629670508623c70929db93b54641ae4c5122cbd93b9eaac67dddea9b89a6406b7a520fba95f558d02f16bfe3d559a296add737255e2aa4a311ec0b96f9ca5e5e020a22b8cc3392e113f351b69b5d93c1cef18a3197d3042f73d2f10de07e1844fc9f6af35ab309d400346a0baac6bf03da7829cfcdd128a22e6b2fe22081f451f960a98dea49cbdb7ac89324306a3342eb2098bdef08965410320f798b4569278f50f1b344e13c5ae32154c90ee8d10ebe7628b98be500e24bee8f2ae04c73b5f93ba7cb7acbe3307beafed6e5d6dc35eb8d8e755520dc7da456a973e3258a486caf6fb956fe12b85664d8078f7138640fac3c85ec7830092ac5eddef3141651a0331742005e2590c910f62c2b528bc2f0c63e3939a82abe36c3e0641b0ba861184391e7fd37bb6b783a2e36683bd35b33dfb18bf801cdce1502c7769520710049d70b867b7ac8081acba1ed53467cdbd2c897f92834757760d4228882df2275d0f24bcedbf1fb2a7dfaf52f94e4b8af4f5a18e71d752fb6e3fb06bc60198e40c0fac81329e8b880ece2665286e9dcb166f1474b99b943181bd47db44ee9c5a57be68610769258cc109418b35d945ff1ea9ca05c1527f7178f4a80cd1087238d4c4a5b5093bc14a82b56e78f65e6e2752a6700340a7887b267b7472b982a9c64b25b74151659fe115f5a38c3f0abde27b8b4df5ce4bf56acc76ed9855a05583e526a2f078df1702e9712bc933aa62c8855b1fb28fcf62b9f069a74f2cf2c82d94ec75199945ca9b53540cf4714d9fbbaacaaf12fd780b41360913a87db3f3fcb85fc85f4af2463d9b80306f5817c41730de62d7039f530c0c128b1011de91aef7253292e1cef4daf43049978ca212b7398acdb775d86c878f858868ec5d54022f14f04aedc76454edd93eedc0602a03c280810164dce8bca6cf889501cd537debb99aa137f3c9a671b6d8b0901d2bb949706282df38ac1cc9f01a2093165d95c9155800b1f1f0c074bf9462b83cf9afdf5661a2931bc6e33035b4908016a38dbd5d3e4fa7dd654027afadb7785cb6d77954b19631dacae0e436ec3b41959c36d88aa68144e211a39ce1c27d87e3b0406a48b23bafc8ed3bc1d163d9cefae5c15b40d8d75f4d0369779f5715ac99b626e56cd3cb6ba60da4e1bdeb4b26c9f12585a1c54582dea490a883898ba0913933f67b282627cef2d8e9f95e1fa1997cdf1a615382dde5f8609e1b744ec53a9bc0ba5a08c52c647ad84632368b474629243c73a84c8af08e230a3168efebaa9308402a2db0ca09a445a51a50a740c8712ea13338e8b9115d696861ee5dca689b11aa75392d247f4a40b3b4df60de834489c96d2c5042ffea53fc7943136fdea0528a6ba3cad703ed5eff252b5a63512105be8cd894401ea3d5b2569addfe1ee1bafcd2d1f8ea3c0ee7fd6f8af2a615b60e96e1b6b8ff56678cea26c122158695badfa29068d4c453899744ee9486f91c84050ffebb76711370f12f4a5a383c213867cc43197ee8c929e4ec1210975560014c9cad25300a88239a844a2b55e4ac6cb0d397949077497006951cdf2bf5141f5a996ca0053ed0dc4a15c391ca0362023a3914e2523f9fe8c9456aa1408e672fac3073a20bf700ce2d5327a8d8e702d4eeeb85a5c59632c52d1ddae6a3dea64c68088a77a211463fc6d689a9be05dfa20d030a3b870c1e697cf471003b5b179237dc081bfc195a3f70fd4b6c03f13b7e139625a228ae8679d885e12f70c3e0cf677bb590913b58db373d12ebbb8e54e485408e3d7128db4aa53aec9baa529bcd74977309ebb4e3809ed61f1a0fd1cf007ef86495f1ab73317c04475438721b5fd038a34159c484c8482ca7a6d180a9fbda67b191d63d5443a6", 0x1000}, {&(0x7f00000004c0)}, {&(0x7f0000000840)="df95a61cebf6e329f0d892a38b6c4e2dda56fd33dffffbeb6c5987c08bc0f11a84f65754db76a11ae552c913a3c2dc357e680dd41c69f27992aeadef928cb0c5bd431311743055a91788205b173bf6b44d9c80fbdf49189ce18b199e4e72ca0d8875b43007836926da48b6a97a77dd119dc8902eb14695ea303925f52a433be4f9036086e8207f6dbc85f142373ad61cd2ec3fa2347f77f1a171a78893b22c1578f1bbe3b093b6d191ab4175ccd904cc21fa942b809a3681fef688e553b42dbdf617bd28", 0xc4}, {0x0}, {0x0}, {&(0x7f0000000780)="95bd266105e54da32d15afe9c06298b22cf6830859b1a50a65790a519b2769a920e1348f436ff3638132458d732ed1d6f0575d07ce7a7a", 0x37}], 0xa, 0x0, 0x0, 0x900}, 0x60) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000340)=@deltclass={0x2c, 0x29, 0x800, 0x70bd2b, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, {0xb, 0xfff3}, {0x4, 0xfff1}, {0x8, 0xc}}, [@tclass_kind_options=@c_red={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000080}, 0x0) sendmsg$IPSET_CMD_LIST(r2, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)=ANY=[@ANYBLOB="280000000706010200000000000000000a0000050e0001000700"], 0x28}, 0x1, 0x0, 0x0, 0x4000}, 0x4) ioctl$XFS_IOC_FD_TO_HANDLE(r0, 0xc038586a, &(0x7f0000000180)={r0, &(0x7f0000000040)='blkio.bfq.io_queued\x00', 0xc082, 0x0, 0x5, &(0x7f00000000c0), &(0x7f0000000100)=0x1}) r5 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r5, 0x107, 0x12, &(0x7f0000000000)={0x0, 0x8000}, 0x4) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r7 = socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r7, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @broadcast}) write$tun(r6, &(0x7f00000000c0)=ANY=[@ANYBLOB="080008000600090000001400000045"], 0xfce) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000b40)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000040)={r9, 0xffffffffffffffff}, 0x4) r11 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x1f, 0x18, &(0x7f00000003c0)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702100000000002020267b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b7030000fffffff88500000004000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r10, @ANYBLOB="0000000000000000b70500000800000085000000a700000095", @ANYRESHEX=r3], &(0x7f0000000600)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x10, '\x00', 0x0, @fallback=0x22, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000000)={r11}, 0xc) r12 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000300), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_TSINFO_GET(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB, @ANYRES16=r12, @ANYBLOB="010000000000000000001d00000020000180140002006e657464657673696d3000000000000008"], 0x34}}, 0x0) ioctl$sock_bt_hidp_HIDPGETCONNINFO(r4, 0x800448d3, &(0x7f0000000c80)={@none, 0xfff, 0x6, 0x8, 0x5, 0x2, "3de3ec9ae3c724fe2f9bd0af27c8d617197ef4b2ed8bd6e0f603e646d7cb8a65f1c191f9f4a5810a2565ececbd771600ffd1edb59212f2874b480287ec294e84af5ce61f642cbd53aea036944ca0eefae708aad5e03d91cc8eccfd4ec4665065f52089208b99ebf8fd14645a3919cb804846ecde861b5e51324e355bc43721f9"}) bind$llc(r0, &(0x7f0000000140)={0x1a, 0x0, 0x0, 0xff, 0x2, 0x9}, 0x10) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='blkio.bfq.io_queued\x00', 0x275a, 0x0) socket$alg(0x26, 0x5, 0x0) r13 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r13, 0x107, 0xf, &(0x7f0000000000)=0x9, 0x4) ioctl$sock_SIOCGIFINDEX(r13, 0x8933, &(0x7f0000000300)={'ip_vti0\x00'}) sendto$packet(r13, &(0x7f00000001c0)="0b03feff4f00021202004788aa96a13bb1000011000088ca1a00", 0x1a, 0x8811, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x9, 0x6, @multicast}, 0x14) 2.332053202s ago: executing program 4 (id=1393): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) getsockopt$bt_hci(r0, 0x0, 0x2, 0x0, &(0x7f0000000280)) r1 = socket$packet(0x11, 0x3, 0x300) r2 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], &(0x7f0000000040)='syzkaller\x00'}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r2, 0x5, 0xe, 0x0, &(0x7f0000000000)="259a53f271a76d2608004c6588a8", 0x0, 0xd11, 0x2a0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x40}, 0x50) unshare(0x20000400) r3 = socket$nl_rdma(0x10, 0x3, 0x14) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000100)={0x4, 0x6}, 0x4) setsockopt$sock_int(r1, 0x1, 0x2c, &(0x7f0000000040)=0xff000000, 0x4) setsockopt$packet_int(r1, 0x107, 0x16, 0x0, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) unshare(0x200) socket$nl_generic(0x10, 0x3, 0x10) sendmsg$FOU_CMD_DEL(r4, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x40800}, 0x8000) pipe(0x0) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r6 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r5, &(0x7f0000000280)={@val={0x1c, 0x800}, @val={0x1, 0x0, 0x0, 0x0, 0x3d}, @mpls={[], @ipv4=@tcp={{0x6, 0x4, 0x0, 0x0, 0x3f, 0x0, 0x0, 0x0, 0x84, 0x0, @empty=0x3fffffff, @local}, {{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x7, 0xb, 0x0, 0x0, 0x0, 0x18, {[@window={0xe, 0x3}, @timestamp={0x5, 0x2}, @generic={0x0, 0x2, "d588dc050391"}]}}}}}}, 0x4e) bpf$PROG_LOAD(0x5, &(0x7f0000001100)={0x1, 0xe, &(0x7f00000002c0)=ANY=[@ANYRES16=r3], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000)={0x8}, 0x8, 0x10, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x4}, 0x10}, 0x94) 2.229020471s ago: executing program 3 (id=1395): r0 = socket(0x10, 0x3, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="050000000c0000004208000040000000c0"], 0x50) r1 = socket$inet(0x2, 0x2, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x1c1341, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) ioctl$TUNSETCARRIER(r2, 0x400454e2, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8b04, &(0x7f0000000000)={'wlan1\x00'}) syz_emit_ethernet(0x4a, &(0x7f00000005c0)={@broadcast, @multicast, @val={@void, {0x8100, 0x0, 0x0, 0x2}}, {@ipv6={0x86dd, @icmpv6={0x7, 0x6, "d172f5", 0x10, 0x3a, 0xff, @ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}, @mcast2, {[], @ni={0xc46ee13d8e75c188, 0x0, 0x0, 0xc2, 0x2, 0x9}}}}}}, 0x0) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000380)=@newlink={0x4c, 0x10, 0x401, 0x70bd26, 0x255fdbfd, {0x0, 0x0, 0x0, 0x0, 0x155a, 0x4c901}, [@IFLA_LINKINFO={0x2c, 0x12, 0x0, 0x1, @bond={{0x9}, {0x1c, 0x2, 0x0, 0x1, [@IFLA_BOND_MIIMON={0x8, 0x3, 0x2}, @IFLA_BOND_PEER_NOTIF_DELAY={0x8, 0x1c, 0x4}, @IFLA_BOND_DOWNDELAY={0x8, 0x5, 0x5}]}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x20008000}, 0x24048044) 2.037587335s ago: executing program 2 (id=1397): r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc2(&(0x7f0000000000), r0) sendmsg$nl_generic(r0, 0x0, 0x88c0) recvmmsg(r0, &(0x7f0000002b00)=[{{0x0, 0x0, &(0x7f0000000340)=[{&(0x7f0000000500)=""/212, 0xd4}, {&(0x7f0000000040)=""/80, 0x50}, {&(0x7f0000000f00)=""/231, 0xe7}, {&(0x7f0000000180)=""/137, 0x89}, {&(0x7f0000002c00)=""/4079, 0xfef}], 0x5}, 0x5}, {{0x0, 0x0, 0x0}, 0xfffffffc}, {{0x0, 0x0, 0x0}, 0x5}, {{0x0, 0x0, 0x0}, 0x77}], 0x4, 0x40002002, 0x0) 1.815242638s ago: executing program 3 (id=1398): r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket(0x1e, 0x1, 0x0) connect$tipc(r1, &(0x7f0000000000)=@name={0x1e, 0x2, 0x0, {{0x1, 0x1}}}, 0x10) syz_genetlink_get_family_id$ipvs(&(0x7f0000000100), r1) getsockopt$bt_BT_POWER(0xffffffffffffffff, 0x112, 0x9, 0x0, &(0x7f0000000080)) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r0, 0x8982, &(0x7f0000000600)={0x0, 'netdevsim0\x00', {}, 0x3}) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_inet_SIOCSIFDSTADDR(r1, 0x8918, &(0x7f0000000480)={'batadv_slave_0\x00', {0x2, 0x4e24, @empty}}) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), 0xffffffffffffffff) r6 = socket(0x40000000015, 0x5, 0x0) r7 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r7, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000004c0)=[{&(0x7f0000000380)="2e00000010008188e6b62aa73772cc9f1ba1f848110000005e140602000000000e000a001000000002900000121f", 0x2e}], 0x1}, 0x40) r8 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$nbd(&(0x7f0000000000), 0xffffffffffffffff) r10 = socket(0x10, 0x3, 0x0) sendmsg$nl_generic(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)={0x1c, 0x5a, 0x1, 0x0, 0x25dfdbfb, {0xa}, [@typed={0x8, 0x1, 0x0, 0x0, @fd}]}, 0x1c}}, 0x4) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) sendmsg$NBD_CMD_CONNECT(r8, &(0x7f0000001ac0)={0x0, 0x0, &(0x7f0000001a80)={&(0x7f00000001c0)=ANY=[@ANYBLOB='|\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="0100ffffffff0000000001000000100007800c00018008000100", @ANYRES32=r11, @ANYBLOB="0c0005006c010000000000000c000200ff7f000000000000400007800c00018008000100", @ANYRES32=r11, @ANYBLOB="0c00018008000100", @ANYRES32=r11], 0x7c}}, 0x20000000) sendmsg$kcm(r7, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000040)="2e00000010008188040f80ec59acbc0413a1f848110000005e140602000300000e000a000f00000002800000121f", 0x2e}], 0x1}, 0x8084) socket$nl_generic(0x10, 0x3, 0x10) ioctl$BTRFS_IOC_START_SYNC(r11, 0x80089418, &(0x7f0000000340)) r12 = socket(0x10, 0x803, 0x0) sendto(r12, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r12, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x365}, {&(0x7f0000000280)=""/85, 0x7c}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000400)=""/106, 0x645}, {&(0x7f0000000980)=""/73, 0x1b}, {&(0x7f0000000200)=""/77, 0x14}, {&(0x7f00000007c0)=""/154, 0x21}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0xffffffffffffff2f, 0x4000000}}], 0x4000000000003b4, 0x2040000, &(0x7f0000003700)={0x77359400}) sendmsg$nl_generic(r12, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000300)=ANY=[@ANYBLOB="1c0000003a0096eef56015fc0701002000000000e6ffff0a00000008"], 0x1c}, 0x1, 0x0, 0x0, 0xd1}, 0x10) getsockopt(r6, 0x200000000114, 0x2721, 0x0, &(0x7f0000000000)) sendmsg$NL80211_CMD_FRAME(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000fc0)={&(0x7f0000000540)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r5, @ANYBLOB="010026bd7000004000000200020008000300ca06936a6649605ce68cf06b1dcc5c51d5032813629d03c339139957cebfc37730a1eba97fdf6a1400d6f5cc7d42910611aa9ef2a4f3a788740c", @ANYRES32=r4, @ANYBLOB], 0x1c}, 0x1, 0x0, 0x0, 0x4845}, 0x80) sendmsg$NL80211_CMD_SET_INTERFACE(r2, &(0x7f00000003c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000380)={&(0x7f0000000280)={0xd8, 0x0, 0x200, 0x70bd25, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r4}, @val={0xc, 0x99, {0xf, 0x5e}}}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x6}, @NL80211_ATTR_IFTYPE={0x8, 0x5, 0xa}, @NL80211_ATTR_MESH_ID={0xa}, @NL80211_ATTR_4ADDR={0x5}, @NL80211_ATTR_MESH_ID={0xa}, @mon_options=[@NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR={0xa}, @NL80211_ATTR_MNTR_FLAGS={0x18, 0x17, 0x0, 0x1, [@NL80211_MNTR_FLAG_COOK_FRAMES={0x4}, @NL80211_MNTR_FLAG_PLCPFAIL={0x4}, @NL80211_MNTR_FLAG_COOK_FRAMES={0x4}, @NL80211_MNTR_FLAG_COOK_FRAMES={0x4}, @NL80211_MNTR_FLAG_FCSFAIL={0x4}]}, @NL80211_ATTR_MNTR_FLAGS={0x8, 0x17, 0x0, 0x1, [@NL80211_MNTR_FLAG_OTHER_BSS={0x4}]}, @NL80211_ATTR_MNTR_FLAGS={0x18, 0x17, 0x0, 0x1, [@NL80211_MNTR_FLAG_PLCPFAIL={0x4}, @NL80211_MNTR_FLAG_COOK_FRAMES={0x4}, @NL80211_MNTR_FLAG_COOK_FRAMES={0x4}, @NL80211_MNTR_FLAG_OTHER_BSS={0x4}, @NL80211_MNTR_FLAG_FCSFAIL={0x4}]}, @NL80211_ATTR_MNTR_FLAGS={0x20, 0x17, 0x0, 0x1, [@NL80211_MNTR_FLAG_OTHER_BSS={0x4}, @NL80211_MNTR_FLAG_ACTIVE={0x4}, @NL80211_MNTR_FLAG_CONTROL={0x4}, @NL80211_MNTR_FLAG_OTHER_BSS={0x4}, @NL80211_MNTR_FLAG_ACTIVE={0x4}, @NL80211_MNTR_FLAG_COOK_FRAMES={0x4}, @NL80211_MNTR_FLAG_FCSFAIL={0x4}]}, @NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR={0xa}, @NL80211_ATTR_MNTR_FLAGS={0x8, 0x17, 0x0, 0x1, [@NL80211_MNTR_FLAG_ACTIVE={0x4}]}], @NL80211_ATTR_4ADDR={0x5}]}, 0xd8}, 0x1, 0x0, 0x0, 0x2820}, 0x20008041) 1.548324955s ago: executing program 0 (id=1400): r0 = socket$netlink(0x10, 0x3, 0x4) writev(r0, &(0x7f0000000080)=[{&(0x7f0000000180)="580000001400192340834b80040d8c560a117436c379000000007b6fc18d332878e9ca945f6400940f6a0325010ebc000000000000008000f0fffeffe809005300ffe6e66e7e4acf921bf09cb39fb7f82e21cbea9e86e992", 0x58}], 0x1) (async) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) (async) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000029c0)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$unix(r3, &(0x7f0000000ac0)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="18a6e60000000000010000000100ef0000", @ANYRES32=r2, @ANYRES32=r3], 0x18, 0xcc040}, 0x64004084) (async) socket$can_bcm(0x1d, 0x2, 0x2) (async) recvmsg$unix(r2, &(0x7f0000000400)={0x0, 0x0, 0x0}, 0x0) (async) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) (async) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x2, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000300000000000000feffff10850000000700000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x100, 0x70, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe}, 0x94) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000340)=@newtaction={0x44, 0x32, 0xffffffffffffffff, 0x0, 0x0, {}, [{0x30, 0x1, [@m_bpf={0x2c, 0x1, 0x0, 0x0, {{0x8}, {0x4}, {0x4}, {0xc}, {0xc}}}]}]}, 0x44}}, 0x0) (async) sendmsg$NL802154_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000340)=ANY=[@ANYBLOB='@\x00\x00\x00', @ANYRES16, @ANYBLOB="01002bbd7000fedbdf25070000000a0004007770616e3000000008000100010000000800050000000000080003"], 0x40}}, 0x8084) (async) r5 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000340)=ANY=[@ANYBLOB="180100002000010000000000fcdbdf2506"], 0x118}], 0x1, 0x0, 0x0, 0x20008001}, 0x0) r6 = bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000180)={r4, 0x0, 0x30, 0x0, @val=@uprobe_multi={&(0x7f00000002c0)='./cgroup/cgroup.procs\x00', &(0x7f0000000300)=[0x0], 0x0, 0x0, 0x1}}, 0x40) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000680)={r6, 0x23, 0x0}, 0x10) (async) sendmsg$NFT_BATCH(r1, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000400)=ANY=[@ANYBLOB="140000001000010000000000000000000300000a580000000604000000000000000000000a0000030900010073797a31000000002c0004800a00018007000100637400001c0002800800014000000013080002400000001005000300000000000900020073797a3200000000140000001100010000000000000000000a00000a"], 0x80}, 0x1, 0x0, 0x0, 0x4008091}, 0x10) (async) r7 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="12000000530000000400000002"], 0x48) (async) r8 = syz_init_net_socket$llc(0x1a, 0x2, 0x0) bind$llc(r8, &(0x7f0000000140)={0x1a, 0x0, 0x0, 0x0, 0x2, 0x9}, 0x10) (async) r9 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='blkio.bfq.io_queued\x00', 0x275a, 0x0) write$cgroup_int(r9, &(0x7f0000000000), 0xffffff6a) (async) sendfile(r8, r9, 0x0, 0xffffffff000) (async) connect$llc(r8, &(0x7f0000000040)={0x1a, 0xf, 0xf3, 0xa, 0x6, 0xf, @broadcast}, 0xa) (async) socketpair(0x1, 0x3, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000005c0)={r7, &(0x7f0000000480), &(0x7f0000000580)=@tcp=r11}, 0x20) (async) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000080)={r7, &(0x7f0000000140), &(0x7f0000000000)=@tcp6=r10, 0x1}, 0x20) (async) r12 = socket$nl_generic(0x10, 0x3, 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x8, &(0x7f0000002340)=ANY=[], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, r12}, 0x94) (async) r13 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x8, &(0x7f00000012c0)=ANY=[@ANYBLOB="620af8ff0c200021bfa100000000000007010000f8ffffffb702000003000000bd1200000000000085000000d0000000b70000000000000095000000000000003fba6a7d36d9b18ed812a2e2c49e8020a6f4e0e4a9446ca2b5f1cc1a100a9af698393aa0f3881f9c24aa56f15199fad0093c59d66b5ece9f36c70d0f010c5077da80fb982c1e9400c603146cea484a415b76966118b64f751a0f241b072e90080008002d75593a280000c93e64c227c95aa0b784625704f07a72c2918451ebdcf4cef7f9606056fe5c34664c0af9360a1f7a5e6b607130c89f18c0c1089d8b85880000c29c48b45ef4adf634be763288d01aa27ae8b09e13e79ab20b0b8ed8fb7a68af2ad0000000000000006f803c6468082089b302d7bff8f06f7f918d65eae391cb41336023cdcedb5e0125ebbcebddcf10cb2364149215108355ee570f8078be5cab389cd65e7133719acd97cfa107d40224edc5465a932b77e74e802a0d42bc6099ad23000000803a90bce6dc3a13871765df961c2ed3b1006ef6c1ff0900000000000010c63a949e8b7955394ffa82b8e942c89112f40cfd7c3a1d37a6ab87b1586602d985430cea0162ab3fcf4591c926abfb076719237c8d0e60b0eea24492a660583eecdbf5bcd3de3a83209da17a0faf60fd6ad9b97aa5fa68480366c9c6fd6fa5043aa3926b81e3b59c9f081d6a08000000ea2b1a52496dfcaf99431412fd134a996382a1a04d5bb924cfe5f3185418d60532be9c4d2ec7c32f2095e63c8cdc28f74d043ed8dba2f23b01a9aeb980aff9fa3a64709270c701db801f44cf945b7632f32030916f89c6dad7603f2ba2a790d62d6faec2fed44da4928b30142bdda5e6c5d50b83bae616b5054d1e7c13b1355d6f4a8245eaa4997da9c77af4c0eb97fca585ec6bf58351d599e9b61e8caab9c70764b0a8a7583c90b3433b809bdb9fbd48bc873495cbff8a41326eea31ae4e0f75057df3c9d13330ca006bce1a84521f14518c9b476fccbd6c712016219848624b87cec2dbe98223a0eb4fa39f6b5c02e6d6d90756ff57902a8f57010000009700ce0b4b8bc22941330000000000000000000300000000000000000000000010008bc0d955f2a83366b99711e6e8861c46495ba585a4b2d02edc3e28dd279a896249ed85b9806f0b6c4a000000002b43dcacc413b48dafb7a2c8cb482bac0ac502d9ba96ffffff7f00000000df73be83bb7d5ad883ef3b7cda42013d53046da21b40216e14ba2d6af8656bfff17addaedab25b30002abbba7fa725f38400be7c1f001b2cd317902f19e385be9e48dccff72943327d830689da6b53ffffffff631c7771429d1200000033ed846197fcff5e1c7c3d1d6e3a52872baef9753fffffffffffffe09fec2271fe010cd7bb2366fde4a59429738fcc917a57f94f6c453cea623cc5ee0c2a5ff870ce5dfd3467decb05cfd9fcd41df54cdbd9d10a64c108285e71b5565b1768ee58969c41595229df17bcad70fb4021428ce978275d5bc8955778567bc79e13b78249788f11f708008b75d4fe32b561d46ea3abe0fa4d30dc94ef241875f3b4b6ab7929a57affe7d7fa29822aea68a660e717a04becff0f719107000000000000002d7e927123d8ecbbc55bf404571be54c72d978cf2804107f0238abccd32368e57040906df0042e19000000000000002c06f815312e086dd022c074eb8a322fb0bf47c0a8d154b405c37feaf3dd95f6ef44cd1fe582786105c7df8be4877084d4173731efe895efc71f665c4d75cf2458e35d2c9062ece84c99e061887a20639b41c8c12ee86c50804042b3eac1f879b136345cf67ca3fb2b5e518a75f9e7d7101d5e186c489b3a06fb99e0aa7f23a054de2f4d92d6bd72ee2c9fdc75aaaf1e3e483b4ad055e4af403269b4a39ce40293947d9a631bcbf3583784acbda216550d7aec6b79e30cbd128f54c2d3335457ac0eaaa99bf0bdc14ae358c3b377327ac9ecc34f24c9ae153ec60ac0694da85bff9f5f4df9b3fdf242b985bf16b99c9cc0ad1857036f1a985f369191ae954febb3df464bfe0f773ee9afe72f32a2befb89d3777399f5874c553a2ebe9061fe86e669642e09bb6d163118e4cbe024fd452277c3887d6116c6cc9d8046c216c1f8a9778cb26e22a2a998de5eaeadea2a40da8daccf080842a486721737390cbf3a74cb2003efb9a101b51ab63e9600040000b8a8c9ae3d14f93100c2e0893862eef552fcde2981f48c482bde6e4a4304e50c349f4f9ecee27defd83871c5191e10096e7e60fc3541a2c905a1a95e9571bf38aebd15172f94e3245c582909e2a3bce109b6000000000000000000d6d5210d7560eb92d6a97a27602b81f7636df1535bef1497f90100000000000000abf9010000007740890200d627e87306703be8672dc84eeadba6a41891c170d1ab57075228a9f46ed9bd1f08fb8191bbab2dc51de3a61f0868afc4294859323e7a45319f18101288a0268893373750d10a3fc22dd704e4214de5946912d6c98cd1a9fbe1e7ef8c08acaf30235b920500d2eca55f74a23641f61f2d5b308cf0d031b0c7f0ced69b93e9960ff5f76062adae283d9756237badf4e7965bbe2777e808fcba821aa8e8c5c39609ff85000000000000c1fee30a3f7a85d1b29e58c77685efc0ceb1c8e5729c66018d169fc03aa188546b3ad2a182068e1e3a0e2505bc7f41019645466a31c72ad53bc19faa5401120000793ac48c1b539c75ab40743b00020000a1f68df75cf43f8ecc8d3726602111b40e761fd210a1920382f14d12ca3c3431ee97471c781d0d1280fb00818654a53b6df4b2c97cc1c98d85fda8f80fe908b65550b441233151122b41a8d73062197655b7f0469250a5989cef0e10773920ed3ccee42d2c3eb80159da5c002511e6eb93842054cfce2ac306cb6e472db3fd67a49b6855a694a8d359add43907003223a47a7fae4f3748d5a432825bc40a03aaef1c8488d86dc211dd2a3ba71e0f45492ef1f8b65ccb3dcd251a61b152d02c29ca0a3328fa7753a5cddea1acaae55ae8263fb284b7a6ab2a8826c1b948207c498cf4824ab1ea3225a53072423b907c6682f8999e0311da5b8378bc841e1787e3a8128dda381a26cb2b365702ff8a27831375b2ddaa2f56e21169f7ca4fd9655ccd4a584acd244e965a0afedaff7c415ff682a4044b3381cc2df28278c9a6824c52048a7cfabda294925cc0956bffa8e950ff5e49f41ae600d830207bf728cd9807933c3c16d80bbea611a18becc2dc38ca0a6f5740f340b76edcd1f539bd43007231dcef58c7b88b5aeedaf9626cb51ce1737c10ab37d4f98a934b0f900e0eb639878a1200629f5503cf679154d27681d7a3744cbcd42af59407c9c8e39c5271868917954e604352ba26171d004f1cb2976fab3fa19c7d3ef9678bff79f5155524f061378f94fb453786c3a6f78b10d383b49e31d1568bd43ee34ce6e6be235aa6207285665c2fba773671da41959f51610963b48930658e2d6125a26085001345b0473240b7e5e91811312c43663e76f711d7219ecdec75c7ea1cf0f8f8fff40247d59bbde2ebb8659197e0f37a71be1b12a182ed7de3acba28561a04b807f7a4647e2ea6d8fb92541d07c3d5e4ba077d3cad9f8ba1919592014c00c8eccb2ca5d48ba7b1c3fb185a4bb79700cf51f818b0c701c8de47d12281a67bdaf4b0c50bee9e8f5936250df2e15c1172e7ea6619f7db330700d1e9e42a035e6fd532f61fbfed9c4a7124a1e38eee50a6bbcd1d4e3f68c3f27dd9a70f1a7c6046237ddfb0b26e197322226367d998010458cd4df10af249ce717f6f45e5176e0ddae3054d7289d4e13ab0912703ee39ce264572b89194fdf7acecc35cf8309d4b680a08eed367dad855fce210f1a7c7222dd360eafb4bef7d58bf83362930af6e3f3f851abdc0003bdf9401b533019e90feb069189100007a82df8d9b5f44ebf9355e7b1b01c9470608d4f306d21004730396a4d6c6d46e1ffac97aa93c36123532a36186575266be4981c847160079421d0137801e553069f8d025c40f287378810defc7f2ed4e15f6af17b21153394f8bcfa6a23a77c8d61c9bbc127a57b8d631f36558d9093dee08bc53d97a8003363421738650a26c8fd87b13026799caf58e59951b125e7f161ca34e2c0dd65a23d01a3cb191e743de07247c7f993cf01166fa2ac1ba02f60550e63a7f50422e478c6b5d87f9bd0567a279a9d85a380db25c43bd0529ad783b9d64aaac1b793afb44b7126e17d2b7c0d6be650de7eeef3f3605af344015d03c3e7819145cb9fe1978c98bf9cf10773db59505ae33708c728844c872dfd2cb0b29754f928c59306ce105ca18cb72f0944d0e4fea0a0abd0285bdaf1b000000c089d640c2facb0d1e6243873ac4b1e1068c45c715b68effb7d58d1f9e726dbf6bd910ca4ce0e075658ede42192cf393a50dcc197b03402fed75083628e5dd38213d353b9049e71f037064b05e73ec00c710f1ffc5737d397d555d1cf8859cc05fea8dc3c6a5b3b6fa1c81707479db1833d593a271253aa11efdb36b74784f2fc286814848e92d8ee541bc179813297a0a4cc3c8f80c28701185bea091f32475e859479b734727afc110e1abcff460172fd1b42e3c0e2a4bf94a060069000010000087c7572a1e7596f89e5c3d5e70640c90815f77b7b13d0000000085a1e1e84900000000000000000000000000b422fc160a458ee5a91a2471e6e56fdabec6c73ce8983fc68f0b7cdcdde632e6f54a07620e8aa116ce9e84fc3cd5e8288a333dcebb233da9186796995ba69487d8f77d2f8800f02d690fc70a08b231cad1bdcf3740a95d4dd1cfe0f417f275493cf33b19ffff93dfdaf7eb00b8ad87cdf7c21bab5af8e2bac54ee5597e6508c1158124a538c36f9bb11fea7d8b8c7e954b1bc7811654a6636b33f271d0923e9ecd1b724b8feffadfc23c07000000f0785fb722f346d6a5dffe1884d4d0cd8f00000092c85ed44db68ab800000000000000406e6ed9b219ad07125381087298e75965d1cc5932ddf9e66351ba332a34bee3e3d562c914c629933f0b8724cf680889ade72558d191d9890c69a718f9018586c5131c8dc8e0379bafda1a0fd2997ff115215ce23dca8db7236c1554cdaaadcce2f31834c1bd1908d8e1b361034db56be76acb7654a195bc3e98df3a5dffd5b0783883ef7da3433110e37f7c7cb7f3800de7f99abf910d6949e062747a9c87dcfcc716d6a9c0ec53b9cffe3cfd1df69a76f373d7f997edb9b80bdea1a99c2a6fbb25e035deadaadd7917ebfedd6304a19491769476208684e343f86b4d55a7dbbb07283cb1e35a139d24ebc5b4f8e35a82d3a7f84cb1e02a5a92b53567088be0b1ca023ccd518c0e0715b1c8760801a419ebd2e26440ff7493019bdb655cc88d72d6d7b6bca5a2e19b63ec52fcc49a729f11ab377f7132c543d29646a9378eea0761b7ed9d2172e33ed87c6513c843b180cc00000000006bedf2ed716ca43a941119b96d82b26d9061de240d85ec2cfa462bd52104489bb7a7548d7cc53627031e909c69cb824233975a1ea645de63522407c3a240a37e946f30ebf075ea97846a0a8d2286f3f446b1b99ab83a12ddf8a1c06294eadc3eb3e339591afd5c00000000000000000000000000000000000000000000000000579dad8347a3d16976bb7483840b32db0158fb6c809349333325a7866ca5d3133e33ef1a183cefdb65a79fa71800988c8445029e024822dbcfcab49c3a0aec9bd43e6e14078b260700d849a2aa14c9b593f6dcb1de334c065ecfd65031606e55949c185bcda9fde4f9b46a76b8a24bbcd31b22373eb0473248150cd179405ee1af1183b0c0ce3483dc1d9bf732b0751b78fb211d6706b55960c6431afbc02b3c7e08086573939290bb9e590a3875f02a828bf209d0"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls}, 0x48) bpf$BPF_PROG_DETACH(0x1c, &(0x7f0000000000)=ANY=[@ANYRES32=r13, @ANYRES32=r13, @ANYBLOB="2f001b000000000000000000", @ANYRES32, @ANYBLOB, @ANYRES64=0x0], 0x20) 1.547673691s ago: executing program 0 (id=1401): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x2, 0x4, 0x6, 0x5, 0x1000}, 0x50) r1 = socket$inet6(0xa, 0x2, 0x3a) r2 = socket$unix(0x1, 0x2, 0x0) bind$unix(r2, &(0x7f0000000080)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) r3 = socket$unix(0x1, 0x2, 0x0) r4 = socket$unix(0x1, 0x2, 0x0) connect$unix(r4, &(0x7f0000000180)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) sendmmsg(r4, &(0x7f0000002dc0), 0x307017fdb7a66cb, 0x0) r5 = socket(0x23, 0x5, 0x0) listen(r5, 0x400) r6 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r6, 0x1, r5, &(0x7f0000000040)={0x10000008}) connect$unix(r3, &(0x7f0000000180)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) ppoll(&(0x7f0000000040)=[{r4, 0x7329}, {r3, 0x718c}, {r1, 0x2204}], 0x3, 0x0, 0x0, 0x0) close(r2) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000a40)={0x11, 0x9, &(0x7f0000000040)=@framed={{0x18, 0x7, 0x0, 0x0, 0x400000, 0x0, 0x0, 0x0, 0x20}, [@map_fd={0x18, 0x8, 0x1, 0x0, r0}, @func={0x85, 0x0, 0x1, 0x0, 0x3}, @initr0, @exit]}, &(0x7f0000000000)='GPL\x00'}, 0x94) r8 = socket(0x2, 0x2, 0x1) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000c80)={0x6, 0x1d, &(0x7f0000000800)=ANY=[@ANYBLOB="1800000000010000000000004a0e000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf090000000000005509010000000000950000000000000018120000", @ANYRES32=r0, @ANYBLOB="0000000000000000b703000000000000850000000c000000b70000000000000018630000080000000000000001000000689330000400000018120000", @ANYRES32=r0, @ANYBLOB="0000000000000000b703000000000000850000000c000000b700000000000000d5560600fcffffffbf9100009f2f355ab7020000000000008500000084000000b7000000000000009500000000000000"], &(0x7f0000000900)='syzkaller\x00', 0x1, 0x96, &(0x7f0000000b00)=""/150, 0x41100, 0x20, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, &(0x7f0000000bc0)={0x9, 0x1}, 0x8, 0x10, &(0x7f0000000c00)={0x5, 0xe, 0x400}, 0x10, 0x0, 0x0, 0x0, &(0x7f0000000c40)=[r0, r0, r0, 0x1, r0], 0x0, 0x10, 0xff}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000240)={{r0, 0xffffffffffffffff}, &(0x7f00000007c0), &(0x7f0000000200)=r7}, 0x1a) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000500)={r0, 0x58, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0}}, 0x10) r11 = bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000540), 0x4) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000680)={{r0, 0xffffffffffffffff}, &(0x7f0000000600), &(0x7f0000000640)=r7}, 0x20) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000f00)=@bpf_lsm={0x1d, 0xf, &(0x7f0000000940)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x2}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000d40)='GPL\x00', 0x8000, 0x67, &(0x7f0000000d80)=""/103, 0x41000, 0x24, '\x00', r10, 0x1b, 0xffffffffffffffff, 0x8, &(0x7f0000000e00)={0x4, 0x1}, 0x8, 0x10, &(0x7f0000000e40)={0x0, 0xf, 0x101, 0xfffffffe}, 0x10, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000e80)=[{0x3, 0x4, 0x4, 0x5}, {0x4, 0x2, 0xd, 0x7}, {0x3, 0x1, 0x6}, {0x4, 0x4, 0x1, 0xb}, {0x1, 0x4, 0xb, 0x1}, {0x3, 0x1, 0xa, 0x1}], 0x10, 0xb}, 0x94) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000700)={0x6, 0x1a, &(0x7f0000000280)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x4}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x6}}, @kfunc={0x85, 0x0, 0x2, 0x0, 0x5}, @ringbuf_query={{0x18, 0x1, 0x1, 0x0, r9}}, @tail_call={{0x18, 0x2, 0x1, 0x0, r0}}, @btf_id={0x18, 0x5, 0x3, 0x0, 0x1}, @map_val={0x18, 0x3, 0x2, 0x0, r0, 0x0, 0x0, 0x0, 0x8}]}, &(0x7f0000000380)='GPL\x00', 0x8, 0xa7, &(0x7f00000003c0)=""/167, 0x41100, 0x1, '\x00', r10, 0x25, r11, 0x8, &(0x7f0000000580)={0x1, 0x1}, 0x8, 0x10, &(0x7f00000005c0)={0x0, 0x0, 0x4, 0x9}, 0x10, 0x0, 0x0, 0x0, &(0x7f00000006c0)=[r0, r12, r0, r0], 0x0, 0x10, 0x5}, 0x94) connect$pptp(r8, &(0x7f0000000140)={0x18, 0x2, {0x1, @broadcast}}, 0x1e) bind$unix(r8, &(0x7f0000000000)=@abs, 0x6e) 1.406090064s ago: executing program 0 (id=1402): socket$l2tp6(0xa, 0x2, 0x73) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x10, 0x4, &(0x7f0000000700)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x8}, [@generic={0x91, 0x1, 0x1, 0x2b}]}, &(0x7f0000000c40)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd}, 0x94) syz_emit_ethernet(0x66, &(0x7f0000000000)={@random="cf702e8cf675", @remote, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, '\x00', 0x30, 0x3a, 0xff, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @mcast2, {[], @ndisc_redir={0x89, 0x0, 0x0, '\x00', @dev, @dev, [{0x2, 0x1, "002b228078c8"}]}}}}}}, 0x0) getsockopt$inet_tcp_buf(r1, 0x6, 0xb, &(0x7f0000000240)=""/249, &(0x7f0000000340)=0xf9) syz_emit_ethernet(0x6a, &(0x7f0000000380)=ANY=[@ANYBLOB="bbbbbbbbbbbb0000000000000800450f005c0000000000019078ac1e0001ac1414aa05009078e00000e04000002000000000000400000a010100ac1414aa8610000000000004b29a0006ff8f5896441177bf39dad413f1bc03a7c2d4017b8a8608000000020602000000b69fae095f944476105dcb7be3c60110e11217efa9adc82e7912a6290136a628f0247d576a"], 0x0) bind$inet6(r0, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) listen(r0, 0x3) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040)='syz_tun\x00', 0x10) syz_emit_ethernet(0x56, &(0x7f0000000080)={@local, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}, @void, {@canfd={0xd, {{0x3, 0x0, 0x0, 0x1}, 0x1c, 0x1, 0x0, 0x0, "8fc8e9303cc4143f9f8a2b05a77f0775c84f82cd15aa38a1a7c52168be2ad1490bc3e1a1a6a2cc27e09d96c70a232c1b31424de31a075de3ec816564ff2908ff"}}}}, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r1, 0x6, 0x13, &(0x7f0000000140)=0xffffffffffffffff, 0x4) syz_emit_ethernet(0xfffffffffffffe3a, &(0x7f00000001c0)={@multicast, @link_local, @void, {@ipv4={0x800, @icmp={{0x10, 0x4, 0x0, 0x7, 0x54, 0x68, 0x0, 0x52, 0x1, 0x0, @multicast1, @local, {[@lsrr={0x83, 0xf, 0xd7, [@empty, @remote, @loopback]}, @lsrr={0x83, 0x0, 0x98, [@loopback, @local, @broadcast, @dev={0xac, 0x14, 0x14, 0x14}]}, @rr={0x7, 0x3, 0xee}, @ra={0x94, 0x4, 0x1}]}}, @timestamp_reply={0xe, 0x0, 0x0, 0x0, 0x9, 0x4, 0x805, 0x7}}}}}, 0x0) r2 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x6, 0xc, &(0x7f0000000140)=ANY=[@ANYBLOB="18020000040000000000000000000000850000002c000000180100002020732500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000001700000095"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1c, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000000)={r4, r3, 0x25, 0x8, @void}, 0x10) ioctl$SIOCPNGETOBJECT(r1, 0x89e0, &(0x7f0000000180)=0x8000) 1.355305555s ago: executing program 0 (id=1403): unshare(0x20400) r0 = socket$igmp6(0xa, 0x3, 0x2) socket$inet6_mptcp(0xa, 0x1, 0x106) ioctl$XFS_IOC_FD_TO_HANDLE(0xffffffffffffffff, 0xc038586a, 0x0) r1 = bpf$MAP_CREATE(0x0, 0x0, 0x48) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) close(0x4) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, 0x0, 0x4028801) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4) r4 = bpf$MAP_CREATE(0x1900000000000000, &(0x7f0000000040)=ANY=[@ANYBLOB="1b00000000000000000000000020"], 0x48) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000e40)={0x11, 0x7, &(0x7f0000000240)=@framed={{0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x5}, [@cb_func={0x18, 0x0, 0x4, 0x0, 0x4}, @map_val={0x18, 0x4, 0x2, 0x0, r3, 0x0, 0x0, 0x0, 0x8001}]}, &(0x7f0000000200)='syzkaller\x00', 0x2, 0x0, 0x0, 0x41000, 0x43, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x7}, 0x94) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000cc0)={0x6, 0x26, &(0x7f0000000f00)=ANY=[@ANYBLOB="1800000000000000000000000300000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf090000000000005509010000000000950000000000000018450000fcffffff0000000000000000183500000500000000", @ANYRES32=r1, @ANYBLOB="0000000000000000b703000000000000850000000c000000b7000000000000001857000005000000000000000000000018010000696c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300001000000085000000060000001834000004000000000000000000000018630000040000000000000008000000bf91000000000000b7023d3ab9454de423d70000020000008500000085000000b700000000000000"], &(0x7f0000000b80)='GPL\x00', 0x2, 0xd, &(0x7f0000000bc0)=""/13, 0x41000, 0x58, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, &(0x7f0000000c00)={0x5, 0x1}, 0x8, 0x10, &(0x7f0000000c40)={0x2, 0x6, 0x0, 0x400}, 0x10, 0x0, 0x0, 0x0, &(0x7f0000000c80)=[r4, r1, 0xffffffffffffffff], 0x0, 0x10, 0xffff0001}, 0x94) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000440)=@raw={'raw\x00', 0x8, 0x3, 0x4c8, 0x0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x3f8, 0xffffffff, 0xffffffff, 0x3f8, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'bridge0\x00'}, 0x0, 0x148, 0x170, 0x0, {}, [@common=@unspec=@helper={{0x48}}, @common=@inet=@hashlimit1={{0x58}, {'bond_slave_1\x00', {0x41, 0x1ff, 0x6, 0xb0e2, 0x10001, 0x84e, 0xfffffffb, 0x18, 0x8}, {0x1}}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'erspan0\x00', 'gre0\x00', {0xff}, {}, 0x0, 0x0, 0x0, 0x4b}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'vcan0\x00', {0x3, 0x0, 0x41, 0xfffffffe, 0x2, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x528) syz_emit_ethernet(0x7e, &(0x7f0000000d80)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaabb86dd6026843500480601fe80000000000000000000e5584a010100aa00004e224a85d32fd87108b9f4f74b3f9009f8d0eb499bea1011cd92f0", @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB="2002f3d8907800101e160840a8c62540169d563df1167b340b68027cd8ac1e0302040205160000004000000200000001ff0000000100000800000000"], 0x0) pipe(&(0x7f0000000100)) socket$kcm(0xa, 0x5, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000001680)=ANY=[@ANYBLOB="282000002e00090027bd7000000000000400000004001d001020098008"], 0x2028}, 0x1, 0x0, 0x0, 0x42804}, 0x4000000) unshare(0x18000900) socket$nl_route(0x10, 0x3, 0x0) write(0xffffffffffffffff, 0x0, 0x0) bpf$BPF_PROG_QUERY(0x10, 0x0, 0x0) r6 = socket$alg(0x26, 0x5, 0x0) setsockopt$ALG_SET_KEY(r6, 0x117, 0x1, &(0x7f0000000300), 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r7 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r7, 0x84, 0xd, &(0x7f0000000000)=@assoc_value, &(0x7f0000000100)=0x8) pwritev(r0, &(0x7f0000000500)=[{&(0x7f0000000080)="023543b7ef1d308e3ebe3d63f02c25687784f2e974db65b45ea209712c53034ffcfd9f1eb6246af726179c95", 0x2c}, {&(0x7f00000000c0)="a5fd8c3462d1148fcaa007041db271fb80a511c68a9fc2dd6e75", 0x1a}, {&(0x7f0000000140)="1ec3657da9896e25673c43055d16a7aeb8b8bcc8bcffdbb635a5398453794b2d1f5c289f0fdfa0468fb31b0cca681197d980fad7add50d5247a8b32b08d93ce800abf904b0f5bfc010bac55b1e1d961e80b84c079c2d32f2e0a0972dde7b949375fbdab156b93a364ccf3b60f6270a5cb547e11531e820da9ce37f343d8b1422f39a484bdb71552a7dec68a5cccd1aa9e84211f100e80e9b240cf2b86d63d6ec6bc7d0866263a9ab4d290352eb938d0fa777f41f97ba340ed27437a48807a3177d8efdd7bbb8c8bed600a93b1c32fb", 0xcf}, {&(0x7f0000000980)="9d39d80002643cf5dec9e86679bb94633875f5dbbed3eed4546d4e4c52b0027c3222b5aa331ea56312daada82cc35368e1333fe20d4c9883862df3fee6c65f55ad814572a9a064dc7eda2bce1702adb63e353355445e88", 0x57}, {&(0x7f00000002c0)="ec439586502ae17086cf030070286280ddb6033200000080000000002bc63d35ce1120e85fb508632e9e5652f6ff063501dc1801e6561d0a404e66b0a880cfdfdebe463ae6db97536a18a55a4e0190276cbc5bef6302fb2738fe2bec69003c7b5eb1047fbfcf4c1a4b2d79a4383f61be682e104a", 0x74}, {&(0x7f0000000340)="3895d403922f94648c193f09d7fadaeec11a2fad103e32186d42117ab426f56204eb883e4d6022c622261cb5c5ed05d82867bd5e41f30f762ddebb1f8c586069def37c1fe1ade6c10bc08e63084ca0fd2e6227c7727b80555f65b90ea4b9eb21d6d0b10827aa71b8fc07250f8f95e3688299fc69c911c5ec3061d6f384be2406375b1d7bca90dd7c343f4456b1053b33d274fb82f36afe8d88d9b9da6bcfdefcbb32210300f30287e2d3b5a40371148380b8c8ca0834b20c80e13eabc432b1ed9cc4be8e39c5634ca98bd1b94cf5a1fd1b049b56e20523582987c69cd67ba6330a5e350e6a0e5a907e5334afc4c710d8097a80", 0xf3}, {&(0x7f0000000600)="79d978635f5dfd6c6fc40cef2004e873833ed5d02a5f8ad80500317e5848787917030000004a97f82b55348eae04a6dab050cac46714e36f0c3003c450a555e5a32640cb32795b1485b30d67509c304170fd13042ef7e743652d90bd9624089b981359947943f6f0d3a78e27fb16f1a662d0d760b94be038db350c8d858830dad78515dba0aab3a5", 0x88}], 0x7, 0x69, 0xa) 1.237386512s ago: executing program 4 (id=1404): r0 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={0x0, 0x14}}, 0x0) getsockname$packet(r0, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) getsockopt$PNPIPE_IFINDEX(r0, 0x113, 0x2, &(0x7f0000000080)=0x0, &(0x7f0000000500)=0x4) setsockopt$inet6_mreq(r0, 0x29, 0x9813e3d4795e0f50, &(0x7f00000002c0)={@remote, r1}, 0x14) r2 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000480)=[{&(0x7f0000000000)="1400000010003507d25a806f8c6394f90324fc60", 0x14}], 0x1}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) bind$netlink(r3, &(0x7f00000001c0), 0xc) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="0b00000005000000020000000400000005"], 0x48) ioctl$XFS_IOC_FD_TO_HANDLE(r4, 0xc038586a, &(0x7f0000000400)={r2, &(0x7f0000000300)='\x18^\x00', 0x0, &(0x7f0000000340)={@_ha_fsid={[0x400, 0x7]}, {0x4, 0x3, 0xc, 0x6}}, 0x8c47, &(0x7f00000005c0)={@_ha_fsid}, &(0x7f00000003c0)=0x7}) ioctl$TUNGETVNETHDRSZ(r5, 0x800454d7, &(0x7f00000004c0)) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000002100010001000000000000000a00000000000000000000000600150002000000080003"], 0x50}}, 0x24004044) r7 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) close(0x3) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="19000000040000000800000008"], 0x48) r8 = bpf$PROG_LOAD(0x5, &(0x7f0000000d00)={0x1d, 0x15, &(0x7f0000000200)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000000000047b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000100850000000100000018110000", @ANYRES32=r7, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000010000850000008200000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_GET_PROG_INFO(0xa, &(0x7f0000000a80)={r8, 0x0, 0x0}, 0x10) r9 = socket(0x10, 0x3, 0x0) getsockopt$PNPIPE_IFINDEX(r0, 0x113, 0x2, &(0x7f0000000540), &(0x7f0000000580)=0x4) sendmsg$nl_generic(r9, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000003140)=ANY=[@ANYBLOB="c01800002000010a0000000000000000020000002c01018028014880ed00a90013466820cd76bb221fbb4acd690c6a8b9c760a61eeec7793b579aefdb936d00f403d3f04637cdb9ac70e28c5dd66ddedde2d0930650e6821f9a26a4a193c1d06a3e75523f901e44fe087ae32c836c6d6ddba3af8e9a2beae8936168f9fa38c395f5cf7408df69c60bf584bee86a6312e9ce866e456c3eda6f2924082d78a2f385bdbd0c9afb54758c102bf13094645fb6aa34d424ec776691fee3d25307f61fed2752babf7c686e8a3d9b59a8343bcf4121bf5cf400a0c1070855fac565cad8968a97ce0a12a1161054d82d0a240b7dedf9ba3cc63e9d1c3b9a8402f7d5b4cafcd48928a3d4a76498900000014007c00ff01000000000000000000000000000108003d00", @ANYRES32=r9, @ANYBLOB="08001a"], 0x18c0}, 0x1, 0x0, 0x0, 0x880}, 0x0) recvmmsg(r2, &(0x7f0000001180)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, &(0x7f0000001b80)=[{&(0x7f0000000680)=""/120, 0x78}, {&(0x7f0000000440)=""/27, 0x1b}, {&(0x7f0000000840)=""/234, 0xea}, {&(0x7f0000003380)=""/4096, 0x1000}, {&(0x7f0000001a00)=""/50, 0x32}], 0x5}, 0xfffffffc}, {{0x0, 0x0, 0x0}}], 0x3, 0x42, 0x0) r10 = socket$nl_route(0x10, 0x3, 0x0) r11 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r11, 0x8933, &(0x7f0000000040)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r10, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000005c0)=@newqdisc={0x134, 0x24, 0x4ee4e6a52ff56541, 0x8000000, 0x0, {0x0, 0x0, 0x0, r12, {0x0, 0xffe0}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x104, 0x2, {{0xfffffffe, 0x2, 0x10000, 0xa, 0xe7, 0xcc36}, [@TCA_NETEM_LOSS={0xb8, 0x5, 0x0, 0x1, [@NETEM_LOSS_GI={0x69, 0x1, {0x40, 0xf, 0xa, 0x4006559, 0x8}}, @NETEM_LOSS_GE={0x14, 0x2, {0x5, 0xfffffffa, 0xa, 0x6}}, @NETEM_LOSS_GI={0x18, 0x1, {0xd82c, 0x8, 0x6, 0x0, 0xc5e0}}, @NETEM_LOSS_GI={0x18, 0x1, {0x1000, 0x2, 0x0, 0x8, 0x1}}, @NETEM_LOSS_GI={0x18, 0x1, {0x4, 0x4, 0x9de, 0x9, 0xb502}}, @NETEM_LOSS_GI={0x18, 0x1, {0x8, 0x0, 0xfffff001, 0xf6, 0x3}}, @NETEM_LOSS_GE={0x14, 0x2, {0x5b, 0x20000, 0x3, 0xa}}, @NETEM_LOSS_GE={0x14, 0x2, {0x2, 0x40003, 0x0, 0x6}}]}, @TCA_NETEM_JITTER64={0xc, 0xb, 0x6}, @TCA_NETEM_CORRUPT={0xc, 0x4, {0x40009, 0xae}}, @TCA_NETEM_LATENCY64={0xc, 0xa, 0x100020}, @TCA_NETEM_LATENCY64={0xc, 0xa, 0x1}]}}}]}, 0x134}, 0x1, 0x0, 0x0, 0x4546cfee17049510}, 0x0) socket$unix(0x1, 0x5, 0x0) 1.176883048s ago: executing program 2 (id=1405): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$unix(0x1, 0x1, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000440)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x70bd2c, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xffff}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0xa, 0x7f61, 0x1, 0xc5, 0xe23, 0x3, 0x1, 0x7fff, 0x1}}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x20008001}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000500)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd26, 0x25dfdbfc, {0x0, 0x0, 0x0, r3, {0x0, 0x10}, {0x5, 0xb}, {0xffe0, 0x3}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x1, 0x4}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x20004070}, 0x4008000) r4 = socket$unix(0x1, 0x1, 0x0) r5 = socket$kcm(0x11, 0x3, 0x0) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r6) socket$unix(0x1, 0x2, 0x0) ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000000200)={'syzkaller0\x00', @random='x \x00\a\x00\b'}) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$kcm(r5, &(0x7f0000000280)={&(0x7f0000000380)=@xdp={0x2c, 0x0, r7, 0x3e}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000180)='\'', 0x1}, {&(0x7f0000000540)="f5b859ba05a072db1f7eec72f3b51376275d99cc4c068a5878de4d1423c5d03383da1ed2ce0ed921b97a45f0d2bfe30e402aa30e7328574dfecfb92923872f69a3a721ea644a4d80e3961c72fd41bd4041b4de010818704bc54a86d8eee2b5e1154e7ea048c538e6d5f2673e541f488ca691c33e74881a5ac4d7dfc38de0e4ca1719236454aff91c3e946097c8f9340beb4f76e5e5457ebb2fb8bc60bf98482a00f9861dc11fc322616bb9bc9368272e919ca6ec5a7ad4123f8705e2e4145183b4913398047261a002a6abbe960be7cf", 0xd0}], 0x2}, 0x5) r8 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r8, 0x400448c9, 0x0) r9 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) setsockopt$sock_int(r9, 0x1, 0x21, &(0x7f0000000000)=0x1, 0x4) openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040), 0x801, 0x0) r10 = openat$rfkill(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r11 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r11, 0x1, r10, &(0x7f0000000000)={0x20000008}) socket$kcm(0x23, 0x2, 0x0) r12 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) close(r12) bind$bt_hci(r9, &(0x7f0000000040)={0x1f, 0xffffffffffffffff, 0x2}, 0x6) r13 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r13, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000300)=@newlink={0x60, 0x10, 0xffffffffffffffff, 0x70bd27, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, 0x1ba20, 0x40a38}, [@IFLA_LINKINFO={0x38, 0x12, 0x0, 0x1, @vlan={{0x9}, {0x28, 0x2, 0x0, 0x1, [@IFLA_VLAN_ID={0x6, 0x1, 0x4}, @IFLA_VLAN_INGRESS_QOS={0x1c, 0x4, 0x0, 0x1, [@IFLA_VLAN_QOS_MAPPING={0xc, 0x1, {0x80000000, 0x67}}, @IFLA_VLAN_QOS_MAPPING={0xc, 0x1, {0x8}}]}]}}}, @IFLA_LINK={0x8}]}, 0x60}}, 0x8000002) 797.667776ms ago: executing program 3 (id=1406): r0 = socket$l2tp(0x2, 0x2, 0x73) sendmmsg(r0, &(0x7f000000dd80)=[{{&(0x7f00000000c0)=@in={0x2, 0x4e22, @remote}, 0x80, &(0x7f0000000400)=[{0x0, 0x700}, {&(0x7f0000000200)="97", 0x1}], 0x2}}], 0x1, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000700)=@base={0x12, 0x4, 0x8, 0x1}, 0x50) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000180)={r1, 0x58, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0}}, 0x10) r3 = bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000280)=0xffffffffffffffff, 0x4) bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=@base={0x3, 0x4, 0x12a30a9f, 0x3, 0x8100, 0x1, 0x101, '\x00', r2, r3, 0x1, 0x1, 0x2}, 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000040)={0x11, 0xc, &(0x7f00000001c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r1}, {}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x3}}]}, &(0x7f0000000240)='GPL\x00', 0x4, 0x1007, &(0x7f00000024c0)=""/4103, 0x0, 0xd, '\x00', 0x0, 0x0, r3}, 0x94) 608.615836ms ago: executing program 4 (id=1407): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000400)=ANY=[@ANYBLOB="180000002500010324bd5502ffdbdf25010000000400ae"], 0x18}, 0x1, 0x0, 0x0, 0x4008}, 0x0) recvmsg(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000740)=[{&(0x7f00000016c0)=""/4086, 0xff6}, {&(0x7f0000003700)=""/4087, 0xff7}, {&(0x7f0000000280)=""/58, 0x3a}, {&(0x7f00000026c0)=""/4083, 0xff3}, {&(0x7f0000004700)=""/4096, 0x1000}, {&(0x7f00000000c0)=""/58, 0x3a}], 0x6}, 0x32120) socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000001540)={0x12, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="180000000000f4ff000000000000000073010f000000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xf}, 0x94) r1 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="02000000040000000800040001"], 0x48) bpf$MAP_LOOKUP_ELEM(0x5, &(0x7f00000000c0)={r1, &(0x7f0000000000), &(0x7f0000000040)=""/73}, 0x70) r2 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r2, 0x107, 0x12, &(0x7f0000000100)={0x3, 0x3}, 0x4) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$TIPC_CMD_SHOW_NAME_TABLE(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000600)={0x30, r4, 0x1, 0x0, 0x0, {{}, {}, {0x14, 0x19, {0x3, 0x1, 0x1}}}}, 0x30}}, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x6, 0xc, &(0x7f0000000140)=ANY=[@ANYBLOB="18020000fcffffff00000000000000008500000036000000180100006420002500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000001800000850000000600000095"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x1, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r5, 0x0, 0xe, 0x0, &(0x7f0000000880)="e977e82a0d0f0b11c3e35739287f", 0x0, 0x1004, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x9}, 0x50) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r5, 0x0, 0xe, 0x0, &(0x7f0000000100)="178d048604bf0bfb1945d7430008", 0x0, 0x501, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x9}, 0x50) setsockopt$packet_rx_ring(r2, 0x107, 0x5, &(0x7f0000000040)=@req3={0x1000, 0x3a, 0x1000, 0x3a, 0x9, 0x0, 0xffffffff}, 0x1c) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000540)={0x6, 0x3, &(0x7f0000000780)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x48}, 0x94) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x200000c, 0x3032, 0xffffffffffffffff, 0x0) socket$inet_icmp_raw(0x2, 0x3, 0x1) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0}, 0x48) ppoll(&(0x7f0000000240)=[{0xffffffffffffffff, 0x8407}, {r2, 0x2}], 0x2, 0x0, 0x0, 0x0) 607.59442ms ago: executing program 0 (id=1408): close(0x3) r0 = socket(0x2, 0x80805, 0x0) shutdown(0xffffffffffffffff, 0x0) close(0x3) sendmsg$NFT_MSG_GETOBJ_RESET(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x20, 0x15, 0xa, 0x301, 0x0, 0x0, {0xa, 0x0, 0x6}, [@NFTA_OBJ_HANDLE={0xc, 0x6, 0x1, 0x0, 0x5}]}, 0x20}, 0x1, 0x0, 0x0, 0x8009}, 0x40040) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x10, &(0x7f00000001c0)=[@in={0x2, 0x4e23, @rand_addr=0x64010100}]}, &(0x7f0000000140)=0x10) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x7a, &(0x7f0000000340)={r1, @in={{0x2, 0x4e22, @local}}}, &(0x7f0000000040)=0x84) sendmmsg$inet_sctp(r0, &(0x7f00000032c0)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="30000000000000008400000001000000000000017c"], 0x30}], 0x1, 0x0) socket$inet_sctp(0x2, 0x5, 0x84) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) ioctl$SIOCX25SFACILITIES(0xffffffffffffffff, 0x89e3, &(0x7f0000000080)={0x44, 0x800000, 0x8, 0x7, 0x2}) write$bt_hci(r3, &(0x7f0000000080)=ANY=[], 0x6) recvmsg(r2, &(0x7f0000000780)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_generic(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000400)=ANY=[@ANYBLOB="180000002500010324bd5502ffdbdf25010000000400"], 0x18}, 0x1, 0x0, 0x0, 0xef61caf084274b56}, 0x0) r4 = socket(0x28, 0x1, 0x5) pipe(&(0x7f0000000240)={0xffffffffffffffff}) splice(r5, 0x0, r4, 0x0, 0x9, 0x5) bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="0e0000000400000008000000000000", @ANYRES32=0x1, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000000400"/28], 0x50) r6 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$EBT_SO_GET_INIT_ENTRIES(r6, 0x0, 0x83, &(0x7f00000001c0)={'broute\x00', 0x0, 0x3, 0xed, [0x4, 0xfffffffffffffffe, 0x38f, 0x2, 0x7ff, 0x7], 0x1, &(0x7f0000000180)=[{}], &(0x7f00000004c0)=""/237}, &(0x7f0000000040)=0x78) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="14006b742500190326bd03000080000005000000"], 0x14}, 0x1, 0x0, 0x0, 0x4000000}, 0x24044004) r8 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r8, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)={0x14, 0x2e, 0x9, 0x70bd27, 0x0, {0x4}}, 0x14}, 0x1, 0x0, 0x0, 0x42804}, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000e80), r7) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) socket$unix(0x1, 0x2, 0x0) 516.871476ms ago: executing program 3 (id=1409): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000980)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f00000007c0)={&(0x7f0000000380)=ANY=[@ANYBLOB="140000001000010000000000000000000300000afc030000090a01040000000000000000050000046802098034000280240001800800014000000003080001400000000208000140ffffff00080001400000c4570c0001800800014000007fff080001400000000760000280340001800800014000008ae7080001400000000708000140000000030800014000006905080001400000800008000140000000021c0001800800014000000002080001400000000108000140000000010c00018008000140000000000c0102804400018008000140000066a0080001400000a534080001400000000208000140000004030800014000000008080001400000ffff0800014000000009080001407fffffff1c000180080001400000000108000140ffffffff0800014000000000040001801c000180080001400000007f080001400000004b080001400000000234000180080001400000099008000140fffffff908000140000000060800014000000005080001400000000008000140000000020c00018008000140000006411c000180080001400000000908000140000008bd08000140000080012c00018008000140000000030800014000003ca3080001400000fd57080001400000231608000140000000c40800014040000000b400028014000180080001406809505108000140000000022c000180080001400000000a0800014000000003080001400000004e080001400000000708000140000000053c0001800800014000000001080001400000000008000140fffffff9080001400000043c08000140000000010800014000000e8f08000140000000000c00018008000140000005f524000180080001400000000d080001400000000f080001400000000b080001400000000c040001800900020073797a31000000004401098008000140000000fd08000140000000095c0002803c00018008000140000000070800014000000007080001400000ffff0800014000000001080001400000009508000140000008000800014000000e001c000180080001400000000008000140000000060800014000000003080001400000000308000140000000000800014000000008bc00028014000180080001400000000608000140000000004c000180080001400000000b08000140000000000800014000009c4d080001400000001e080001400000000008000140000000020800014000000003080001400000000908000140000000083c00018008000140000000060800014000000006080001400000040108000140000000050800014000000007080001400000000808000140000000031c000180080001400000000108000140000000e4080001400000ffff08000540000000170900010073797a300000000008000f40000000090c000d4045d0d4dc498cdd160800064000000000140000001100010000000000000000000300000a"], 0x424}, 0x1, 0x0, 0x0, 0x24044880}, 0xb83b33189071b8cc) (async, rerun: 32) r1 = socket$nl_route(0x10, 0x3, 0x0) (rerun: 32) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000800)=@can_newroute={0x14c, 0x18, 0x1, 0x70bd2c, 0x25dfdbfe, {0x1d, 0x1, 0x4}, [@CGW_CS_CRC8={0x11e, 0x6, {0x0, 0x2, 0x8, 0x0, 0xff, "71ec6d721744cd5200080000f8cfcad4c4ec6511ec028c5028564abce83afe14c93e15e556c2baed7f897fe841c155a2b2a4b9f3052995cdf66a9c7922ff0300005b6c67281f1519cd7c32c2bf7563b9452575505da99ea128d37616896be8764a2c78edbad5bde7a5e405bdc893770338925f824bd24689c0d11a5568fc3aaa9ad0d7766d8ea8d3bf1006e3df494e2f373148ecb4adafdd39874e9808b118301f1e76054a64c6d243523f5de7b347f3b740e105d0ed18fae7289635301ebd8949268090b3bcd4cbed5f1cfe93cff41a9630802f96defe9e8ea850529827c5e301953a8abaafa1f121e590f74e28233f4129d4587eee87ec5d42c3ef0619022c", 0x0, "5c8d586b2a88d818b56d2a5e15c8a95d29e5b2ea"}}, @CGW_MOD_XOR={0x15, 0x3, {{{0x3, 0x1}, 0x5, 0x7, 0x0, 0x0, "00000000000001fe"}, 0x2}}]}, 0x14c}}, 0x4c8c8) (async) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000880)=ANY=[@ANYBLOB="1200000004000000080000000b"], 0x48) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f00000000c0)={r2, &(0x7f0000000040), 0x0}, 0x20) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x13, 0xe, &(0x7f0000000c00)=ANY=[@ANYBLOB="b702000000000080bfa30000000000000703000000feffff7a0af0fff8ffff1971a4f0ff00000000b706000008ffffff9c6400000000000045040400010000001704000001000a00b7040000000100006a0af2fe00000000850000004c000000b70000000000000095000000000000008e17f199a68b061b93d83298a8cdda1ce784909b849d5550ad855dab54d8877a6db61d69f2ffcaa10350e11cb97ce8df1bc9a0c4eeceb9971e43405d621ffbc9b0d8ca56b50f0c010ddb03cf1c62d57c08a90b189d190c341035de53a9a53608c10556e5734eb84049761051ce540c772e201b2de17dfdb5b60939d5d6aed4062049b87e03e2cd18a77dda613e0c64497fcc059c062234d5595f6fbaa187b81d1106000000000f0000fd9ac3d09e29a9d542ca9d85a5c9c88474895d679838def0a83a733dc6a39b63a5ed69d32394c53361d7480884bd8000000000000000b91c61bd99dc89f12907af7dccd106cb937b450f859ce8292a79c3e40000b59b0fc46d6cec3c080a882add4e1179bd4a44f231a2d73148be428ba953df4aece69311687f4122073a236c3a32efa04137d46f0247d2638da3261c8162bb7c7824be6195a66d2e17e122040e11001131ce319045e5b3334e68475ac3f46aa2837f9004600daded9b19b35eebe52613c346e255421b23a278fd00004270b1cd5fc9aa2286ccca37db965d9dd366598f5ec993cb0cf127e2a46cfbdf63eea190d86a4d1b75ae98480100bd5828954a7d093a54f7e75b3753508ca3c41685d1e407315e59d626c23b3f89a926e9382966853774e7dd1f1a2177cdf2802237c177d543e8da47a01f05e113e53518270239b69c117e2637c31085f4d8a596b6edab26afaf6605b231199f38a6fc7eb83714387450ea18eafbace8eec18a4b2c442e7b88a7611c1283bec84e1715fb9f4fcaf52c08058fc4f21c0ad71adabdd850aed3eeec6eaab347bdf474e17b9aa345d1e6e3bb83f90230bdf53e7d0e5c3f914d905422b83f30936674ba8f0bffaf2305c0972df71fe5f4e015064716897bced7798509e64df360d95f9a4099f86438ac2bbcbdbd1d9db21a1d5c065567fd70aae68096827fa5c2d9bd20292344c7dcf6241447cfbb05b5d0fdb4e08afbac5397b64aa369922ed7ed8918f97294b6854210d2b93aaf92159dbaa2f186d4a420c68d6baf1c31de4f0bf478bfd51bb1e96ea849a80ae5a89be7e38474c7aade344d68324f9e12a6b9770e6bd12ae69efffaee58040753701af84c2924c1b5aea1650f42c9ae9820a33095f062fb88313d035ea405515a61a4be64f9fa0985c5be592090cc48291004609fdac2ab6100000000000000a84570c7c00d647daf8af334050b61e9b2d3f0adad1d1ff47be19b8da2799e9ecef8efabe73f92dbd0760f8bbd9c710bd1371e2b5d9a2ea2190f5e4f5cd641cdfe5d89f84a368ef7e6ff1eacdc0ec9e97b8f9c9e314661ea0aa8a104008d188b66b3a4aedeed9df4238a08fc2fb1007233cc2c87fcaa0cccd8ec03440eafe1c8660c73acc17bff740d199a7c0c52c63c0408b5158e0000000c275eedb02f141113cf2c55b2c08c2c68cc99d2bb5840fba332e1c82862ec9b90106248f81d32a47ac94ddee815dba8aeb5d3121cf247a81aef7805b020e9eec44cbe3055be69fe066824ba2292b9cdce41635fc00df96fb10a3a8cc60c4a76c65ebbb0640e0a29de94edf5cbefac1c5fa96e7080af804b22cabce10ea52f1018527f4aa39cdafa3eff63de2a7f50d042667820f6f86f276afb2b8134301e031351ee13013137e9d5cec0c84d7e3f82c6fd12eb98f9ea654bcb9ce59a2015183c6e65bb0537e611b830d74c30fb8207fca0990acdbb51e4e234026e00000000b3ebae3eb52c140953a350fcf0124b1a30b1afc29ea56f8413686d912eb8118d73ef9c6d3843ebcb555301c0205dd3bd9b1d742e334319c8979c322e92fbc2c400"/1423], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000340)}, 0x42) 516.184762ms ago: executing program 2 (id=1410): r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = syz_init_net_socket$nfc_llcp(0x27, 0x1, 0x1) getpeername$packet(r1, 0x0, 0x0) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt(r2, 0x84, 0x80, &(0x7f0000000000)="0000000000000002", 0x8) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x10, 0x2, &(0x7f0000000040)=@raw=[@ldst={0x3, 0x2, 0x3, 0xa, 0x1, 0xfffffffffffffff2, 0xffffffffffffffff}, @exit], &(0x7f0000000000)='GPL\x00', 0x1, 0x0, 0x0, 0x0, 0x20}, 0x94) r3 = socket$inet6_udp(0xa, 0x2, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_GET_BYINDEX(r4, &(0x7f0000001400)={0x0, 0x0, &(0x7f00000013c0)={&(0x7f00000003c0)=ANY=[@ANYBLOB="24c300000f060101000000000000000000000001050001000700000006000b0000000000bf2dacba8cff41c44fe798c990f9d9e909007abc6bb4bd4e607ba5747da5f947d23a9441cc7449b812e0c065b75bcc691335dcea5a0f00000000000037533f10724abe0c799c0632240a9cd1f57eff0d50376ee3c13f4a34e0889f1f0bcbb461"], 0x24}, 0x1, 0x0, 0x0, 0x20000015}, 0x4000000) connect$pppl2tp(r0, &(0x7f0000000040)=@pppol2tpv3={0x18, 0x1, {0x3, r3, {0x2, 0x0, @multicast2}, 0x2}}, 0x2e) r5 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0xc0802, 0x0) ioctl$PPPIOCNEWUNIT(r5, 0xc004743e, &(0x7f00000000c0)) pwritev(r5, &(0x7f0000000080)=[{&(0x7f0000000240)="c021", 0x2}], 0x1, 0x7, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$BTRFS_IOC_DEFRAG(r4, 0x50009402, 0x0) r7 = socket$netlink(0x10, 0x3, 0x10) r8 = socket$inet(0x2b, 0x801, 0x0) setsockopt$inet_tcp_int(r8, 0x6, 0x2e, &(0x7f00000000c0)=0xb1e0, 0x4) bind$netlink(r7, &(0x7f0000514ff4)={0x10, 0x0, 0x25dfdbfb, 0x10000400}, 0xc) bind$netlink(r7, &(0x7f0000000080)={0x10, 0x0, 0x25dfdbfb, 0x1}, 0xc) r9 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000380), r6) sendmsg$L2TP_CMD_SESSION_GET(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="00100000000000070000000500130000000000140008000000009f00000000000080000000001b0500120000000000000ea13372db98f0eb312b1acc0378524922e191dc118fb81c06547498dd1f0de71cdc37e8bc4a41eef1ca593eb5ff980ac4138467221942a07a6b92956c40ded936a80d706139743f5702e057e2a46070991734a89f42b8a4a0ffcbd32fdceb7c9059357013172fa2619fbcb56be8c73e9d97560bc61eb19f2eb9"], 0x38}, 0x1, 0x0, 0x0, 0x804}, 0x0) r10 = syz_genetlink_get_family_id$devlink(&(0x7f0000000080), r6) sendmsg$DEVLINK_CMD_SB_OCC_MAX_CLEAR(r6, &(0x7f0000000280)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000240)={&(0x7f0000000180)=ANY=[@ANYBLOB="b0000000", @ANYRES16=r10, @ANYRES8=r7], 0xb0}, 0x1, 0x0, 0x0, 0x40}, 0x4000080) 152.404821ms ago: executing program 3 (id=1411): bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1, 0x3, &(0x7f0000001a00)=ANY=[@ANYBLOB="18000000030000000000000026d0000095002b000000000093adff012255f674412d02000000880b5f04596a5e99fce658be2f200c699223886d8be4b50000005ab527ee3697f98125f30e6326996a3cfee33025a30b45bdcf2c69d105e5e55a1d273683623f1a5dc6e3c7e20eb7a98ecf3bd2cf898e924abe26ac296f660e69ba982fd76e00dcff7f0000ca6b78ad833488cfe4109eaf009eddcf21f5c63cde2f00150200000001000000520a0000151d010000000100bf00000000cc587424363da52001a3cdf2000000db74596fd72c002a60c1bc7dc8c38b7d2e13c50424b9dd1145d03ff45f70685c6bd9ff41c69b7de406e89dcbb7677e65a88a8407a9e7f9c0e91028b0856eb1ed9474480737a55ebb0bd701f7fb21135c6172eba7eb8a341f07e5a2d1e88b3cfc22df01e4bac9d97328fa2a82b5e8741e02056d93a433f50479387467824262852c7939db5672d07cdbe8e14abf56497e5d56dbe37551b870b2851c3f0a1a9ebfcba105a6ccdd01b0f04edb256c0200000073f6db43661bd7f0e2536ffbfe5ca31b4083145531458b7d1e341c6b351ebc5223f54d6bec93f4ef088e5d1be2515226988d664709ff03f1aa3dc7f1580ace9bf2afd28d0700000000000000d6eb372713255012e028cb2654d493a0b43bf21375709f348f5eda2967199cc936859a538100070000000000dc10e13ef227f627a40000ad1fa253d33fa74f172d3407ae4e1e347c0c6ef9dd2b6bb700000000000000000c586272c3f4d79bc36315745cb149f3cb385e6add14652003c7cdd3324f07d134d3a6c718bbd1aafe1140cff0be4c6f8df084c5e9734ae30aa9af030025f01ab03a9b1074407136bc506031f0916a39d3057d55183612b39e73ae8e6dc30356886a831836469e2051d937eb85f3f2d5ae2c1dca476b97419a3b76ed62409d004d7fbe362145d19605d760df4c5124ca325d374b371867a79b35c6617fc3327191fbf514573f0e30d1d60be2168fffc2f3dccd599a2cb77f124e22f87673675805494db821f39b50d938d5fd8c6b2a3a324c257bc9110971b749ccd74089ed6b86f81ca3ba47d8f71d290ed1b1a11f7a67125170c88c3b6a50692cc0064fc6bbd312536ac15016c85c6332226401b110da9c786eeca22debc99335587b54c13c3107008fa069af8223b38ced735c2d906551004d8dc10d88738488da01ffa4add56474573c964a270000f2f16625c0c10200000000c7a5ca60fdad159f2e44171f39638410020000004825d081f2d987f05c534187738655d7dc958f2046fa0c1619a6554b82d9c162eb61ca74f1ffdaccf0ea5f06e0fca8b27ff3983ab74fd3d560700a1fab44e77e312b3b129e000302d613916c9bcf9f0000fac73a5b6bfb27f88dba816020be760f7b45e001efada8000000000000fdaf4660402f7b3b79a433e08074ea2462974a00040000eb01352638f56dae0249d15ba8767259658878b7492cfbacde9b57cf4de00788adce638190f3570e0b4c80ef682df22201270955afb6008846557ee3bc09fda6dbb6550d597300eb82a184c96ffde5a30e5433e866665b98ca2002c804c22ff2634b7bfbf5c0d586cda5b45fd00dede1e88a4d41dee7cc76d7a23d06acb1d2d4c58faea84158bb440df2a694f4cdcaa4f65c22efffffffffffdd00000000d503d79986958115ae07b70f991430b7fb475d77b869ee02000000000000000000001ffff0ef89b2a68d2b05c995445d8a7700bcdfbec74fb2dd163e863315e84498dfb52bb93f6c9084659ce777ddac563c8596c2b1d8180289a61faa95a82bf1cfb7f2fd7252e9322abe282c33445d443a67467893b9bf0d1c8130ae6b226900000635376413c29f7c6f7b7e29b9a0c64e68328661f0c06e21f7d7dc22174ea4447a6f60edef3a4168d40200fbc71104512efe8e5d7d934aa289b4bd2b870000000000000000000007000000002000000000009b777883a02f0593dfc4cb4114b9f9cf4ad155110cc6ace2b322ac31bfa27847c799c8009a1ea5b98e525e6383ad7fd9795170e7b11e247603c2ff49a11459c7f606d729d3979676bffb3049166bb84a0f061991bd57c2566c10c282352aba05b6164ef876915a3f2491e4793e590dcc71de10da96366c1e992c0068c940dd4422c9882d3aa0f8a797b8fea6efcfb5276b7679f15559edaa977504cc0b2f777acb907ebf5fc14add71d0bca37405ded69b77ab4a3d7487fd04000000de17e1e13b93669b79556abb722d9c085b189b5fd1f30e8dc813f608830b110001732135e8e7262f290000923bfb6b41ff3792cee2fc37eee739c3e36a4bc80112968ec0d8902eced1fe552018014a463abbbf7ccd6a92a5734e3ebfca9b6e88e031f31de2183652e77c164c646a1cfd3710aa4205d8d4d4f974133ccb1e49feb42664eccd809c0ba8917eda87489e8946d5c8156197bcb66fd5606c63e3389ee9e8552381646365066ef9a36a449c96485c22ad1aa423b7b89efbc6cd54000bb0ea5f4f1e87"], 0x0, 0x4}, 0x94) r0 = socket$rds(0x15, 0x5, 0x0) setsockopt$SO_RDS_TRANSPORT(r0, 0x114, 0x8, &(0x7f0000000180)=0x1, 0x4) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) sendmmsg$inet6(r1, &(0x7f0000001f00)=[{{&(0x7f0000000240)={0xa, 0x4e23, 0x3fe, @private0, 0x2000003}, 0x1c, &(0x7f0000000180)=[{&(0x7f0000000440)="14", 0x1}], 0x1}}], 0x1, 0x931766f6319eed44) shutdown(r1, 0x1) getsockopt$bt_hci(r1, 0x84, 0x80, &(0x7f0000002100)=""/4127, &(0x7f0000000000)=0x101f) 57.05295ms ago: executing program 0 (id=1412): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) r2 = socket$netlink(0x10, 0x3, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e22, 0x40007f, @dev={0xfe, 0x80, '\x00', 0x20}, 0xc7}, 0x1c) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wlan1\x00'}) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl(r3, 0x8b2c, &(0x7f0000000040)) r4 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={0x0, 0x24}}, 0x0) getsockname$packet(r4, &(0x7f0000000080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="4800000010000507000000000000000016000000", @ANYRES32=r5, @ANYBLOB="0000000200000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000140)=@newqdisc={0x30, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_clsact={0xb}]}, 0x30}}, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000002c0)={&(0x7f0000000500)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x6, [@enum64={0x4, 0x0, 0x0, 0x13, 0x0, 0x4}]}, {0x0, [0x61, 0x2e, 0x3e, 0x61]}}, 0x0, 0x2a, 0x0, 0x8, 0x1}, 0x28) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x4) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), r7) getsockname$packet(r7, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14) sendmsg$nl_route_sched(r6, 0x0, 0x4010) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r1, 0x84, 0x6, &(0x7f0000000440)={0x0, @in6={{0xa, 0x4e24, 0xb, @mcast1, 0x582e}}}, &(0x7f0000000500)=0x84) sendmsg$IPCTNL_MSG_CT_GET(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000001010102000000000000000002000000240002800c000280050081003a00000014000180080001000000000008000200000000000c0019800800020099"], 0x44}}, 0x0) 16.925822ms ago: executing program 3 (id=1413): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)=ANY=[@ANYBLOB="30000000400007012bbd700000000000017c00000400c2801400018006000600843b000006001700843b0000040002"], 0x30}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x4e22, 0xffffe000, @empty, 0x405e}, 0x1c) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r4, 0x3) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r5, 0x0) r6 = socket$inet6_mptcp(0xa, 0x1, 0x106) listen(r6, 0xa7ba) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r7, 0x0) r8 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r5, 0x6, 0xe, &(0x7f0000000280)={@in6={{0xa, 0x4e21, 0x2, @mcast2, 0xc0000000}}, 0x0, 0x0, 0x1d, 0x0, "96f545de642d5626f0ab65d100e9ebabc53fc208cf62bb49106f5cccc56c95be5ffca3693df6b6b775439f92a55942e8245aeab82b30c8513f04526794f5171a448ab4c234b48912d2998c9dc0a773c8"}, 0xd8) listen(r8, 0x0) r9 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r9, 0x0) r10 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r10, &(0x7f00000000c0)=[{&(0x7f0000000200)="580000001400192340834b80040d8c560a0677bc45ff810500000000000058000b480400945f64009400050028925a01000000000000008000f0fffeffe809000000fff5dd0000001000010002081000418e00000004fcff", 0x58}], 0x1) splice(r1, 0x0, r3, 0x0, 0x6, 0x0) r11 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) r12 = socket$can_raw(0x1d, 0x3, 0x1) setsockopt$CAN_RAW_JOIN_FILTERS(r12, 0x65, 0x6, 0x0, 0x0) write$cgroup_subtree(r11, &(0x7f0000000280)=ANY=[], 0x10448) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r11, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000240)={0x0, 0x0, 0xffffffffffffff25, 0x0, 0x1, 0x2, 0x11fe726f7e78fcf0}, 0x28) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000003380)={&(0x7f0000000000)=ANY=[@ANYBLOB="9feb010018000000000000006c0000006c000000080000000600000001000013040000000200000843000000010000000e00000006000004030000000000000005000000f70a009a0500000002000000970000000900000001000000030000000400000000000000ffffff7f0700000000000000060000000a0000000200000000000100002e71005f5f2e"], &(0x7f0000000200)=""/5, 0x8c, 0x5, 0x1, 0x7}, 0x28) close(r2) 0s ago: executing program 2 (id=1414): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000240)={0x5c, 0x2, 0x6, 0x5, 0x0, 0x0, {0x0, 0x0, 0x1}, [@IPSET_ATTR_REVISION={0x5, 0x4, 0x1}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_TIMEOUT={0x8, 0x6, 0x0, 0x0, 0x5}]}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_TYPENAME={0x15, 0x3, 'hash:ip,port,net\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}]}, 0x5c}, 0x1, 0x0, 0x0, 0x40002}, 0x8000) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000240)={0x44, r3, 0x1, 0x0, 0x0, {}, [@MPTCP_PM_ATTR_ADDR={0x30, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @empty}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x1}]}]}, 0x44}}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x200000000000011, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000000)={'bridge0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000080)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@RTM_NEWMDB={0x38, 0x54, 0x1e5, 0x0, 0xfffffffd, {0x7, r6}, [@MDBA_SET_ENTRY={0x20, 0x1, {r8, 0x1, 0x1, 0x1, {@ip4=@broadcast, 0x86dd}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4}, 0x0) socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=@newlink={0x94, 0x10, 0x801, 0x70bd2b, 0x200000, {0x0, 0x0, 0x0, r6, 0x90, 0x800}, [@IFLA_PHYS_SWITCH_ID={0xe, 0x24, "d6e0263927d4fc8faac7"}, @IFLA_GROUP={0x8}, @IFLA_PORT_SELF={0x5c, 0x19, 0x0, 0x1, [@IFLA_PORT_HOST_UUID={0x14, 0x5, "04d0f0a4414bed5293f98dc231f600"}, @IFLA_PORT_PROFILE={0x9, 0x2, 'syz0\x00'}, @IFLA_PORT_PROFILE={0x15, 0x2, 'hash:ip,port,net\x00'}, @IFLA_PORT_INSTANCE_UUID={0x14, 0x4, "bf78aa6d445e5173a4c0bd36f88f38cf"}, @IFLA_PORT_PROFILE={0x9, 0x2, '^\'%[\x00'}]}]}, 0x94}}, 0x4000880) kernel console output (not intermixed with test programs): 635] bond1: (slave geneve2): Enslaving as an active interface with an up link [ 141.582929][ T6639] netlink: 68 bytes leftover after parsing attributes in process `syz.2.188'. [ 141.594146][ T6639] netlink: 168 bytes leftover after parsing attributes in process `syz.2.188'. [ 141.833101][ T6647] netlink: 12 bytes leftover after parsing attributes in process `syz.2.192'. [ 141.860889][ T6647] netlink: 12 bytes leftover after parsing attributes in process `syz.2.192'. [ 141.894391][ T6648] xt_limit: Overflow, try lower: 324382443/0 [ 142.275686][ T6666] netlink: 28 bytes leftover after parsing attributes in process `syz.2.195'. [ 142.407079][ T6670] netlink: 8 bytes leftover after parsing attributes in process `syz.3.197'. [ 142.518741][ T6675] netlink: 'syz.1.198': attribute type 1 has an invalid length. [ 142.628204][ T6675] 8021q: adding VLAN 0 to HW filter on device bond1 [ 142.762633][ T6686] netlink: 'syz.1.198': attribute type 1 has an invalid length. [ 142.795690][ T6680] bond1: (slave batadv1): Opening slave failed [ 142.898984][ T6689] netlink: 'syz.4.202': attribute type 10 has an invalid length. [ 143.416680][ T6689] team0: Port device geneve1 added [ 143.682215][ T6764] warning: `syz.0.210' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 144.702941][ T6806] tipc: Failed to remove unknown binding: 66,0,0/0:1800520329/1800520330 [ 144.736899][ T6770] af_packet: tpacket_rcv: packet too big, clamped from 1 to 4294967272. macoff=96 [ 146.008766][ T6851] sctp: [Deprecated]: syz.3.236 (pid 6851) Use of int in maxseg socket option. [ 146.008766][ T6851] Use struct sctp_assoc_value instead [ 146.529688][ T6866] __nla_validate_parse: 13 callbacks suppressed [ 146.529709][ T6866] netlink: 24 bytes leftover after parsing attributes in process `syz.1.240'. [ 146.808518][ T6873] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 146.831267][ T6874] block nbd0: not configured, cannot reconfigure [ 147.147999][ T6882] netlink: 'syz.2.247': attribute type 10 has an invalid length. [ 147.193202][ T6883] bridge0: entered promiscuous mode [ 147.217984][ T6883] bridge0: entered allmulticast mode [ 147.245186][ T6883] team0: Port device bridge0 added [ 147.307429][ T6882] team0 (unregistering): Port device team_slave_0 removed [ 147.347960][ T6882] team0 (unregistering): Port device team_slave_1 removed [ 147.831401][ T6904] netlink: 68 bytes leftover after parsing attributes in process `syz.0.251'. [ 147.855271][ T6902] raw_sendmsg: syz.1.252 forgot to set AF_INET. Fix it! [ 147.863043][ T6904] netlink: 168 bytes leftover after parsing attributes in process `syz.0.251'. [ 148.182709][ T6914] netlink: 12 bytes leftover after parsing attributes in process `syz.1.256'. [ 148.284265][ T6914] netlink: 28 bytes leftover after parsing attributes in process `syz.1.256'. [ 148.305571][ T6914] netlink: 28 bytes leftover after parsing attributes in process `syz.1.256'. [ 148.461093][ T6925] syzkaller0: entered promiscuous mode [ 148.471700][ T6925] syzkaller0: entered allmulticast mode [ 149.108624][ T6942] netlink: 68 bytes leftover after parsing attributes in process `syz.1.265'. [ 149.169602][ T6942] netlink: 168 bytes leftover after parsing attributes in process `syz.1.265'. [ 149.934182][ T6957] netlink: 4 bytes leftover after parsing attributes in process `syz.1.271'. [ 149.972858][ T6960] netlink: 'syz.0.272': attribute type 1 has an invalid length. [ 150.147364][ T6965] syzkaller0: entered promiscuous mode [ 150.158083][ T6965] syzkaller0: entered allmulticast mode [ 150.674445][ T6984] netlink: 32 bytes leftover after parsing attributes in process `syz.4.275'. [ 150.885004][ T6979] bridge0: port 2(bridge_slave_1) entered disabled state [ 150.893072][ T6979] bridge0: port 1(bridge_slave_0) entered disabled state [ 151.561809][ T6979] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 151.581512][ T6979] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 151.698582][ T6979] gretap1: left allmulticast mode [ 151.754107][ T7001] syz_tun: entered allmulticast mode [ 151.762113][ T6753] netdevsim netdevsim4 eth0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 151.779187][ T6753] netdevsim netdevsim4 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 151.795996][ T6746] netdevsim netdevsim4 eth1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 151.820926][ T6746] netdevsim netdevsim4 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 151.862189][ T6746] netdevsim netdevsim4 eth2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 151.895977][ T6746] netdevsim netdevsim4 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 151.936938][ T6746] netdevsim netdevsim4 eth3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 151.966495][ T6746] netdevsim netdevsim4 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 152.001842][ T7043] netlink: 'syz.3.285': attribute type 1 has an invalid length. [ 194.537093][ T1318] ieee802154 phy0 wpan0: encryption failed: -22 [ 194.543732][ T1318] ieee802154 phy1 wpan1: encryption failed: -22 [ 199.681852][ T7059] __nla_validate_parse: 2 callbacks suppressed [ 199.681874][ T7059] netlink: 16 bytes leftover after parsing attributes in process `syz.1.288'. [ 199.735384][ T7059] netlink: 64 bytes leftover after parsing attributes in process `syz.1.288'. [ 199.831918][ T7070] netlink: 68 bytes leftover after parsing attributes in process `syz.4.292'. [ 199.849091][ T7070] netlink: 168 bytes leftover after parsing attributes in process `syz.4.292'. [ 200.059676][ T7076] bridge_slave_0: left allmulticast mode [ 200.080367][ T7076] bridge_slave_0: left promiscuous mode [ 200.120488][ T7076] bridge0: port 1(bridge_slave_0) entered disabled state [ 200.152962][ T7076] bridge_slave_1: left allmulticast mode [ 200.158869][ T7076] bridge_slave_1: left promiscuous mode [ 200.166615][ T7076] bridge0: port 2(bridge_slave_1) entered disabled state [ 200.198339][ T7076] bond0: (slave bond_slave_0): Releasing backup interface [ 200.222522][ T7076] bond0: (slave bond_slave_1): Releasing backup interface [ 200.254494][ T7076] team0: Port device team_slave_0 removed [ 200.279462][ T7076] team0: Port device team_slave_1 removed [ 200.293926][ T7076] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 200.318521][ T7076] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 200.346120][ T7076] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 200.438929][ T7091] FAULT_INJECTION: forcing a failure. [ 200.438929][ T7091] name failslab, interval 1, probability 0, space 0, times 1 [ 200.467703][ T7091] CPU: 0 UID: 0 PID: 7091 Comm: syz.2.300 Not tainted syzkaller #0 PREEMPT(full) [ 200.467734][ T7091] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 200.467746][ T7091] Call Trace: [ 200.467754][ T7091] [ 200.467763][ T7091] dump_stack_lvl+0xe8/0x150 [ 200.467794][ T7091] should_fail_ex+0x412/0x560 [ 200.467828][ T7091] should_failslab+0xa8/0x100 [ 200.467861][ T7091] __kmalloc_noprof+0xe8/0x760 [ 200.467890][ T7091] ? tomoyo_realpath_from_path+0xe3/0x5d0 [ 200.467924][ T7091] tomoyo_realpath_from_path+0xe3/0x5d0 [ 200.467954][ T7091] ? tomoyo_domain+0xd7/0x130 [ 200.467988][ T7091] ? tomoyo_path_number_perm+0x219/0x630 [ 200.468012][ T7091] tomoyo_path_number_perm+0x246/0x630 [ 200.468039][ T7091] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 200.468062][ T7091] ? __lock_acquire+0x6b5/0x2cf0 [ 200.468102][ T7091] ? __mutex_unlock_slowpath+0x1be/0x6f0 [ 200.468148][ T7091] ? __fget_files+0x2a/0x420 [ 200.468176][ T7091] ? __fget_files+0x2a/0x420 [ 200.468199][ T7091] ? __fget_files+0x3a0/0x420 [ 200.468222][ T7091] ? __fget_files+0x2a/0x420 [ 200.468251][ T7091] security_file_ioctl+0xc3/0x2a0 [ 200.468276][ T7091] __se_sys_ioctl+0x47/0x170 [ 200.468307][ T7091] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 200.468330][ T7091] do_syscall_64+0x15f/0xf80 [ 200.468349][ T7091] ? trace_irq_disable+0x3b/0x140 [ 200.468379][ T7091] ? clear_bhb_loop+0x40/0x90 [ 200.468405][ T7091] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 200.468424][ T7091] RIP: 0033:0x7fe86359ce59 [ 200.468444][ T7091] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 200.468459][ T7091] RSP: 002b:00007fe864377028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 200.468482][ T7091] RAX: ffffffffffffffda RBX: 00007fe863815fa0 RCX: 00007fe86359ce59 [ 200.468496][ T7091] RDX: 0000200000000000 RSI: 000000000000890b RDI: 0000000000000003 [ 200.468508][ T7091] RBP: 00007fe864377090 R08: 0000000000000000 R09: 0000000000000000 [ 200.468528][ T7091] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 200.468540][ T7091] R13: 00007fe863816038 R14: 00007fe863815fa0 R15: 00007ffef0f9fca8 [ 200.468575][ T7091] [ 200.468646][ T7091] ERROR: Out of memory at tomoyo_realpath_from_path. [ 200.637832][ T7098] netlink: 8 bytes leftover after parsing attributes in process `syz.1.303'. [ 200.690374][ T7100] netlink: 68 bytes leftover after parsing attributes in process `syz.4.304'. [ 200.737172][ T7100] netlink: 168 bytes leftover after parsing attributes in process `syz.4.304'. [ 200.926505][ T7110] netlink: 8 bytes leftover after parsing attributes in process `syz.4.306'. [ 200.995106][ T7110] macvlan2: entered allmulticast mode [ 201.003799][ T7110] gretap0: entered allmulticast mode [ 201.159000][ T7116] netlink: 12 bytes leftover after parsing attributes in process `syz.4.308'. [ 201.179488][ T7116] openvswitch: netlink: Flow set message rejected, Key attribute missing. [ 201.375787][ T7127] netlink: 28 bytes leftover after parsing attributes in process `syz.3.310'. [ 201.459210][ T7133] x_tables: arp_tables: NFQUEUE target: not valid for this family [ 201.902848][ T7151] netlink: 'syz.0.313': attribute type 1 has an invalid length. [ 203.196268][ T7189] dummy0: mtu less than device minimum [ 203.798822][ T7199] bond0: entered promiscuous mode [ 203.811331][ T7199] batadv0: entered promiscuous mode [ 203.822218][ T7196] nbd: must specify at least one socket [ 203.833298][ T7199] hsr1: Slave A (bond0) is not up; please bring it up to get a fully working HSR network [ 203.855779][ T7199] 8021q: adding VLAN 0 to HW filter on device hsr1 [ 203.869426][ T7199] bond0: left promiscuous mode [ 203.893263][ T7199] batadv0: left promiscuous mode [ 204.582357][ T7220] openvswitch: netlink: ct_state flags 010000e0 unsupported [ 204.752132][ T7227] netlink: 'syz.0.333': attribute type 4 has an invalid length. [ 204.815416][ T7227] __nla_validate_parse: 4 callbacks suppressed [ 204.815435][ T7227] netlink: 13 bytes leftover after parsing attributes in process `syz.0.333'. [ 204.927250][ T7231] netlink: 'syz.1.335': attribute type 1 has an invalid length. [ 204.999652][ T7233] netlink: 28 bytes leftover after parsing attributes in process `syz.1.335'. [ 205.209263][ T7231] 8021q: adding VLAN 0 to HW filter on device bond3 [ 205.366903][ T7231] netlink: 'syz.1.335': attribute type 1 has an invalid length. [ 205.377997][ T7249] netlink: 8 bytes leftover after parsing attributes in process `syz.3.340'. [ 205.437871][ T7231] bond3: (slave batadv1): Opening slave failed [ 205.528069][ T7253] netlink: 24 bytes leftover after parsing attributes in process `syz.2.339'. [ 205.603526][ T7256] netlink: 20 bytes leftover after parsing attributes in process `syz.4.341'. [ 206.210873][ T7265] lo speed is unknown, defaulting to 1000 [ 206.236027][ T7267] netlink: 8 bytes leftover after parsing attributes in process `syz.3.344'. [ 206.259305][ T7265] lo speed is unknown, defaulting to 1000 [ 206.277536][ T7265] lo speed is unknown, defaulting to 1000 [ 206.730590][ T7281] netlink: 12 bytes leftover after parsing attributes in process `syz.0.349'. [ 207.696988][ T7298] netlink: 'syz.4.354': attribute type 1 has an invalid length. [ 207.763604][ T7301] netlink: 28 bytes leftover after parsing attributes in process `syz.4.354'. [ 207.822943][ T7298] 8021q: adding VLAN 0 to HW filter on device bond2 [ 207.879936][ T7265] infiniband sqz0: set active [ 207.885545][ T7265] infiniband sqz0: added lo [ 207.918224][ T7265] smbdirect: ib_dev[sqz0]: added: IB_CA max_fast_reg_page_list_len=512 device_cap_flags=0x1c001223c76 kernel_cap_flags=0x14 page_size_cap=0xfffff000 [ 207.933843][ T7265] smbdirect: ib_dev[sqz0]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=32 max_cqe=32767 max_qp_wr=1048576 max_send_sge=32 max_recv_sge=32 [ 207.952408][ T7265] smbdirect: ib_dev[sqz0]PORT[1]: iwarp=0 ib=0 roce=1 v1=0 v2=1 core_cap_flags=0x803005 [ 208.023401][ T7304] netlink: 'syz.4.354': attribute type 1 has an invalid length. [ 208.034159][ T7265] RDS/IB: sqz0: added [ 208.035452][ T7265] smc: adding ib device sqz0 with port count 1 [ 208.035623][ T7265] smc: ib device sqz0 port 1 has no pnetid [ 208.488098][ T7036] lo speed is unknown, defaulting to 1000 [ 208.531590][ T7282] netlink: 8 bytes leftover after parsing attributes in process `syz.3.348'. [ 208.541774][ T7304] bond2: (slave batadv1): Opening slave failed [ 208.579206][ T6748] netdevsim netdevsim0 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 208.601049][ T7265] lo speed is unknown, defaulting to 1000 [ 208.610472][ T6748] netdevsim netdevsim0 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 208.643982][ T6748] netdevsim netdevsim0 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 208.659501][ T7039] lo speed is unknown, defaulting to 1000 [ 208.670095][ T6748] netdevsim netdevsim0 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 208.883119][ T7318] netlink: 24 bytes leftover after parsing attributes in process `syz.0.356'. [ 209.953464][ T7343] __nla_validate_parse: 5 callbacks suppressed [ 209.953485][ T7343] netlink: 4 bytes leftover after parsing attributes in process `syz.3.361'. [ 210.014576][ T7347] nbd: must specify a size in bytes for the device [ 210.035517][ T7349] netlink: 4 bytes leftover after parsing attributes in process `syz.3.361'. [ 210.186642][ T7265] lo speed is unknown, defaulting to 1000 [ 210.403730][ T7354] netlink: 68 bytes leftover after parsing attributes in process `syz.3.365'. [ 210.441237][ T7354] netlink: 168 bytes leftover after parsing attributes in process `syz.3.365'. [ 210.666811][ T7363] netlink: 4 bytes leftover after parsing attributes in process `syz.0.367'. [ 210.777241][ T7367] netlink: 8 bytes leftover after parsing attributes in process `syz.4.369'. [ 210.819335][ T7367] netlink: 16 bytes leftover after parsing attributes in process `syz.4.369'. [ 210.844430][ T7363] netlink: 4 bytes leftover after parsing attributes in process `syz.0.367'. [ 210.885014][ T7363] netlink: 348 bytes leftover after parsing attributes in process `syz.0.367'. [ 210.895024][ T7367] macvlan3: entered allmulticast mode [ 210.906813][ T7370] netlink: 28 bytes leftover after parsing attributes in process `syz.1.370'. [ 211.242813][ T7375] geneve2: entered promiscuous mode [ 211.678238][ T7384] tipc: Invalid UDP bearer configuration [ 211.678307][ T7384] tipc: Enabling of bearer rejected, failed to enable media [ 212.431885][ T7265] lo speed is unknown, defaulting to 1000 [ 212.852069][ T7411] gretap0: entered promiscuous mode [ 212.866402][ T7413] xt_hashlimit: size too large, truncated to 1048576 [ 212.901228][ T7411] macvlan3: entered allmulticast mode [ 212.940612][ T7411] gretap0: entered allmulticast mode [ 213.271147][ T7265] lo speed is unknown, defaulting to 1000 [ 213.791001][ T7265] lo speed is unknown, defaulting to 1000 [ 214.605930][ T7451] tipc: Started in network mode [ 214.648348][ T7451] tipc: Node identity 2619dc0f80ef, cluster identity 4711 [ 214.695027][ T7451] tipc: Enabled bearer , priority 0 [ 214.744285][ T7443] syzkaller0: entered promiscuous mode [ 214.786718][ T7443] syzkaller0: entered allmulticast mode [ 214.932672][ T7443] tipc: Resetting bearer [ 215.117452][ T7443] tipc: Disabling bearer [ 215.778505][ T7475] lo speed is unknown, defaulting to 1000 [ 216.044495][ T7488] IPv6: NLM_F_CREATE should be specified when creating new route [ 216.097123][ T7488] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 216.106890][ T7488] IPv6: NLM_F_CREATE should be set when creating new route [ 216.115540][ T7488] IPv6: NLM_F_CREATE should be set when creating new route [ 216.123859][ T7488] IPv6: NLM_F_CREATE should be set when creating new route [ 216.400788][ T7495] netlink: 'syz.4.407': attribute type 1 has an invalid length. [ 216.438469][ T7497] xt_hashlimit: size too large, truncated to 1048576 [ 216.498056][ T7502] __nla_validate_parse: 11 callbacks suppressed [ 216.498077][ T7502] netlink: 28 bytes leftover after parsing attributes in process `syz.4.407'. [ 216.499883][ T7501] netlink: 'syz.0.409': attribute type 9 has an invalid length. [ 216.584534][ T7495] 8021q: adding VLAN 0 to HW filter on device bond3 [ 216.709536][ T7495] netlink: 'syz.4.407': attribute type 1 has an invalid length. [ 216.779179][ T7495] bond3: (slave batadv1): Opening slave failed [ 216.943984][ T7510] netlink: 8 bytes leftover after parsing attributes in process `syz.3.411'. [ 217.406470][ T7522] FAULT_INJECTION: forcing a failure. [ 217.406470][ T7522] name fail_page_alloc, interval 1, probability 0, space 0, times 1 [ 217.444250][ T7523] netlink: 36 bytes leftover after parsing attributes in process `syz.4.414'. [ 217.460322][ T7522] CPU: 0 UID: 0 PID: 7522 Comm: syz.3.415 Not tainted syzkaller #0 PREEMPT(full) [ 217.460352][ T7522] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 217.460364][ T7522] Call Trace: [ 217.460372][ T7522] [ 217.460381][ T7522] dump_stack_lvl+0xe8/0x150 [ 217.460412][ T7522] should_fail_ex+0x412/0x560 [ 217.460446][ T7522] prepare_alloc_pages+0x22a/0x650 [ 217.460486][ T7522] __alloc_frozen_pages_noprof+0x12f/0x380 [ 217.460522][ T7522] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 217.460559][ T7522] ? __pfx_policy_nodemask+0x10/0x10 [ 217.460595][ T7522] ? __lock_acquire+0x6b5/0x2cf0 [ 217.460622][ T7522] alloc_pages_mpol+0x235/0x490 [ 217.460659][ T7522] folio_alloc_mpol_noprof+0x39/0x160 [ 217.460693][ T7522] vma_alloc_folio_noprof+0xe1/0x1e0 [ 217.460717][ T7522] ? __pfx_vma_alloc_folio_noprof+0x10/0x10 [ 217.460738][ T7522] ? __pte_offset_map+0x29/0x240 [ 217.460765][ T7522] ? __pte_offset_map+0x29/0x240 [ 217.460793][ T7522] do_pte_missing+0x159d/0x33f0 [ 217.460838][ T7522] ? handle_mm_fault+0xee/0x3170 [ 217.460868][ T7522] handle_mm_fault+0x1bd7/0x3170 [ 217.460911][ T7522] ? handle_mm_fault+0xee/0x3170 [ 217.460944][ T7522] ? __pfx_handle_mm_fault+0x10/0x10 [ 217.460991][ T7522] ? lock_mm_and_find_vma+0xa7/0x340 [ 217.461032][ T7522] do_user_addr_fault+0x75b/0x1340 [ 217.461072][ T7522] exc_page_fault+0x6a/0xc0 [ 217.461105][ T7522] asm_exc_page_fault+0x26/0x30 [ 217.461124][ T7522] RIP: 0010:rep_movs_alternative+0x4a/0x90 [ 217.461149][ T7522] Code: cc cc cc 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 8b 06 48 89 07 48 83 c6 08 48 83 c7 08 83 e9 08 74 db 83 f9 08 73 e8 eb c5 a4 c3 cc cc cc cc 48 8b 06 48 89 07 48 8d 47 08 48 83 e0 f8 48 [ 217.461165][ T7522] RSP: 0018:ffffc90003477ac8 EFLAGS: 00050202 [ 217.461185][ T7522] RAX: ffffffff84b21801 RBX: 00000000000013b0 RCX: 0000000000000e38 [ 217.461199][ T7522] RDX: 0000000000000000 RSI: ffff88804e300578 RDI: 0000200000001000 [ 217.461212][ T7522] RBP: ffffc90003477c90 R08: ffff88804e3013af R09: 1ffff11009c60275 [ 217.461226][ T7522] R10: dffffc0000000000 R11: ffffed1009c60276 R12: 0000200000001e38 [ 217.461240][ T7522] R13: 00007ffffffff000 R14: ffff88804e300000 R15: 0000200000000a88 [ 217.461263][ T7522] ? _copy_to_user+0x1/0xb0 [ 217.461301][ T7522] _copy_to_user+0x8a/0xb0 [ 217.461333][ T7522] sctp_getsockopt_local_addrs+0xd27/0xf10 [ 217.461376][ T7522] ? sctp_getsockopt_local_addrs+0x6ac/0xf10 [ 217.461409][ T7522] ? __pfx_sctp_getsockopt_local_addrs+0x10/0x10 [ 217.461437][ T7522] ? do_raw_spin_lock+0x12b/0x2f0 [ 217.461469][ T7522] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 217.461509][ T7522] ? __local_bh_enable_ip+0xd0/0x130 [ 217.461536][ T7522] sctp_getsockopt+0x68f/0xb90 [ 217.461560][ T7522] ? __pfx_sock_common_getsockopt+0x10/0x10 [ 217.461587][ T7522] do_sock_getsockopt+0x51d/0x7e0 [ 217.461625][ T7522] ? __pfx_do_sock_getsockopt+0x10/0x10 [ 217.461674][ T7522] ? __fget_files+0x3a0/0x420 [ 217.461698][ T7522] ? __fget_files+0x2a/0x420 [ 217.461732][ T7522] __x64_sys_getsockopt+0x1a4/0x240 [ 217.461768][ T7522] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 217.461790][ T7522] do_syscall_64+0x15f/0xf80 [ 217.461808][ T7522] ? trace_irq_disable+0x3b/0x140 [ 217.461837][ T7522] ? clear_bhb_loop+0x40/0x90 [ 217.461863][ T7522] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 217.461883][ T7522] RIP: 0033:0x7f521999ce59 [ 217.461908][ T7522] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 217.461923][ T7522] RSP: 002b:00007f521a787028 EFLAGS: 00000246 ORIG_RAX: 0000000000000037 [ 217.461943][ T7522] RAX: ffffffffffffffda RBX: 00007f5219c16090 RCX: 00007f521999ce59 [ 217.461957][ T7522] RDX: 000000000000006d RSI: 0000000000000084 RDI: 0000000000000003 [ 217.461969][ T7522] RBP: 00007f521a787090 R08: 0000200000000180 R09: 0000000000000000 [ 217.461982][ T7522] R10: 0000200000000a80 R11: 0000000000000246 R12: 0000000000000001 [ 217.461994][ T7522] R13: 00007f5219c16128 R14: 00007f5219c16090 R15: 00007ffe3c7b1158 [ 217.462036][ T7522] [ 217.891743][ T7523] netlink: 36 bytes leftover after parsing attributes in process `syz.4.414'. [ 217.900677][ T7523] netlink: 40 bytes leftover after parsing attributes in process `syz.4.414'. [ 218.135991][ T7530] netlink: 8 bytes leftover after parsing attributes in process `syz.1.418'. [ 218.718831][ T7552] netlink: 20 bytes leftover after parsing attributes in process `syz.4.422'. [ 218.738515][ T7552] 8021q: VLANs not supported on ip_vti0 [ 218.757252][ T7542] lo speed is unknown, defaulting to 1000 [ 219.035158][ T7558] netlink: 'syz.4.424': attribute type 1 has an invalid length. [ 219.077359][ T7558] 8021q: adding VLAN 0 to HW filter on device bond4 [ 219.102671][ T7558] netlink: 28 bytes leftover after parsing attributes in process `syz.4.424'. [ 219.268058][ T7564] netlink: 'syz.4.424': attribute type 1 has an invalid length. [ 219.338693][ T7564] bond4: (slave batadv1): Opening slave failed [ 219.589543][ T7573] hmac(sh: entered promiscuous mode [ 220.022361][ T7578] FAULT_INJECTION: forcing a failure. [ 220.022361][ T7578] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 220.097743][ T7578] CPU: 1 UID: 0 PID: 7578 Comm: syz.0.431 Not tainted syzkaller #0 PREEMPT(full) [ 220.097772][ T7578] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 220.097783][ T7578] Call Trace: [ 220.097792][ T7578] [ 220.097800][ T7578] dump_stack_lvl+0xe8/0x150 [ 220.097829][ T7578] should_fail_ex+0x412/0x560 [ 220.097861][ T7578] _copy_to_user+0x31/0xb0 [ 220.097900][ T7578] simple_read_from_buffer+0xe1/0x170 [ 220.097930][ T7578] proc_fail_nth_read+0x1bb/0x230 [ 220.097960][ T7578] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 220.097989][ T7578] ? rw_verify_area+0x2a6/0x4d0 [ 220.098016][ T7578] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 220.098042][ T7578] vfs_read+0x20c/0xa70 [ 220.098075][ T7578] ? __pfx___mutex_lock+0x10/0x10 [ 220.098097][ T7578] ? __pfx_vfs_read+0x10/0x10 [ 220.098126][ T7578] ? __fget_files+0x2a/0x420 [ 220.098154][ T7578] ? __fget_files+0x3a0/0x420 [ 220.098176][ T7578] ? __fget_files+0x2a/0x420 [ 220.098209][ T7578] ksys_read+0x150/0x270 [ 220.098239][ T7578] ? __pfx_ksys_read+0x10/0x10 [ 220.098264][ T7578] ? fput+0xa0/0xd0 [ 220.098294][ T7578] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 220.098316][ T7578] do_syscall_64+0x15f/0xf80 [ 220.098333][ T7578] ? trace_irq_disable+0x3b/0x140 [ 220.098362][ T7578] ? clear_bhb_loop+0x40/0x90 [ 220.098388][ T7578] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 220.098408][ T7578] RIP: 0033:0x7f8da1f5d68e [ 220.098426][ T7578] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 220.098443][ T7578] RSP: 002b:00007f8da2ecefe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 220.098464][ T7578] RAX: ffffffffffffffda RBX: 00007f8da2ecf6c0 RCX: 00007f8da1f5d68e [ 220.098479][ T7578] RDX: 000000000000000f RSI: 00007f8da2ecf0a0 RDI: 0000000000000004 [ 220.098490][ T7578] RBP: 00007f8da2ecf090 R08: 0000000000000000 R09: 0000000000000000 [ 220.098502][ T7578] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 220.098514][ T7578] R13: 00007f8da2216128 R14: 00007f8da2216090 R15: 00007ffe17033b88 [ 220.098547][ T7578] [ 220.373302][ T7582] netlink: 8 bytes leftover after parsing attributes in process `syz.3.433'. [ 220.528085][ T7582] macvlan4: entered allmulticast mode [ 220.669070][ T7592] netlink: 'syz.2.432': attribute type 9 has an invalid length. [ 220.733771][ T7591] netlink: 1084 bytes leftover after parsing attributes in process `syz.2.432'. [ 221.607539][ T7619] bond2: option arp_all_targets: invalid value (129) [ 221.624933][ T7619] bond2 (unregistering): Released all slaves [ 222.100904][ T7637] __nla_validate_parse: 6 callbacks suppressed [ 222.100925][ T7637] netlink: 64 bytes leftover after parsing attributes in process `syz.2.449'. [ 222.215721][ T7639] netlink: 4 bytes leftover after parsing attributes in process `syz.2.449'. [ 222.245503][ T7639] openvswitch: netlink: IP tunnel attribute has 4 unknown bytes. [ 222.263616][ T7639] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 222.310697][ T7641] bridge1: entered promiscuous mode [ 222.316080][ T7641] bridge1: entered allmulticast mode [ 222.407381][ T7641] team0: Port device bridge1 added [ 222.733930][ T7656] netlink: 72 bytes leftover after parsing attributes in process `syz.1.454'. [ 222.743041][ T7656] netlink: 12 bytes leftover after parsing attributes in process `syz.1.454'. [ 222.782709][ T7656] netlink: 8 bytes leftover after parsing attributes in process `syz.1.454'. [ 222.809029][ T7658] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 222.998780][ T7670] netlink: 8 bytes leftover after parsing attributes in process `syz.1.461'. [ 223.221066][ T7682] netlink: 8 bytes leftover after parsing attributes in process `syz.3.463'. [ 223.259331][ T7684] netlink: 212360 bytes leftover after parsing attributes in process `syz.1.464'. [ 223.480572][ T7692] netlink: 'syz.3.467': attribute type 1 has an invalid length. [ 223.513053][ T7692] netlink: 28 bytes leftover after parsing attributes in process `syz.3.467'. [ 223.783197][ T7706] netlink: 8 bytes leftover after parsing attributes in process `syz.1.473'. [ 223.821066][ T7711] xt_hashlimit: size too large, truncated to 1048576 [ 224.102963][ T7726] netlink: 'syz.1.476': attribute type 1 has an invalid length. [ 224.119277][ T7726] netlink: 'syz.1.476': attribute type 2 has an invalid length. [ 226.642147][ T7826] syzkaller0: entered promiscuous mode [ 226.663618][ T7826] syzkaller0: entered allmulticast mode [ 226.818251][ T7832] openvswitch: netlink: IP tunnel attribute has 4 unknown bytes. [ 226.836086][ T7832] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 226.866290][ T7835] openvswitch: netlink: IP tunnel attribute has 4 unknown bytes. [ 226.874107][ T7835] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 227.077740][ T7840] 8021q: VLANs not supported on ip6gre0 [ 227.124626][ T7841] lo speed is unknown, defaulting to 1000 [ 227.229490][ T7845] xt_hashlimit: size too large, truncated to 1048576 [ 227.387727][ T7854] netlink: 'syz.2.512': attribute type 9 has an invalid length. [ 227.561355][ T7857] bridge0: port 1(vlan2) entered blocking state [ 227.587104][ T7857] bridge0: port 1(vlan2) entered disabled state [ 227.622078][ T7857] vlan2: entered allmulticast mode [ 227.643326][ T7857] geneve0: entered allmulticast mode [ 227.678968][ T7857] vlan2: entered promiscuous mode [ 227.694602][ T7857] geneve0: entered promiscuous mode [ 227.956794][ T7869] __nla_validate_parse: 28 callbacks suppressed [ 227.956814][ T7869] netlink: 72 bytes leftover after parsing attributes in process `syz.2.517'. [ 227.972174][ T7869] netlink: 12 bytes leftover after parsing attributes in process `syz.2.517'. [ 227.981063][ T7869] netlink: 8 bytes leftover after parsing attributes in process `syz.2.517'. [ 228.010988][ T7862] netlink: 8 bytes leftover after parsing attributes in process `syz.4.513'. [ 228.241640][ T7875] netlink: 40 bytes leftover after parsing attributes in process `syz.0.518'. [ 228.746516][ T7880] netlink: 12 bytes leftover after parsing attributes in process `syz.2.520'. [ 228.895091][ T7887] netlink: 64 bytes leftover after parsing attributes in process `syz.3.522'. [ 229.027753][ T7884] netlink: 36 bytes leftover after parsing attributes in process `syz.0.519'. [ 229.211315][ T7892] netlink: 4 bytes leftover after parsing attributes in process `syz.3.522'. [ 229.238352][ T7892] openvswitch: netlink: IP tunnel attribute has 4 unknown bytes. [ 229.273391][ T7892] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 229.515887][ T7899] xt_hashlimit: size too large, truncated to 1048576 [ 229.663271][ T7903] netlink: 'syz.3.527': attribute type 9 has an invalid length. [ 230.020405][ T7909] netlink: 72 bytes leftover after parsing attributes in process `syz.3.530'. [ 230.176384][ T7919] syzkaller0: entered promiscuous mode [ 230.182189][ T7919] syzkaller0: entered allmulticast mode [ 230.364561][ T7925] tipc: Started in network mode [ 230.374286][ T7925] tipc: Node identity 4280a9defe27, cluster identity 4711 [ 230.385226][ T7925] tipc: Enabled bearer , priority 0 [ 230.392517][ T7922] syzkaller0: entered promiscuous mode [ 230.398346][ T7922] syzkaller0: entered allmulticast mode [ 230.448283][ T7930] RDS: rds_bind could not find a transport for ::ffff:172.20.20.170, load rds_tcp or rds_rdma? [ 230.643517][ T7934] syzkaller0: entered promiscuous mode [ 230.719915][ T7934] syzkaller0: entered allmulticast mode [ 230.742973][ T7934] tc action pedit offset must be on 32 bit boundaries [ 230.880003][ T7942] netlink: 'syz.4.540': attribute type 1 has an invalid length. [ 231.011053][ T7916] tipc: Resetting bearer [ 231.036314][ T7916] tipc: Disabling bearer [ 231.071553][ T7944] bond5: (slave vxcan3): The slave device specified does not support setting the MAC address [ 231.082855][ T7944] bond5: (slave vxcan3): Error -95 calling set_mac_address [ 231.278911][ T7949] bond5: (slave bridge2): Enslaving as an active interface with a down link [ 232.387910][ T8006] syzkaller0: entered promiscuous mode [ 232.413561][ T8006] syzkaller0: entered allmulticast mode [ 232.451663][ T8015] netlink: 'syz.3.556': attribute type 2 has an invalid length. [ 232.757305][ T8026] bond6 (unregistering): Released all slaves [ 232.945519][ T8037] netlink: 'syz.4.565': attribute type 8 has an invalid length. [ 232.959480][ T8039] FAULT_INJECTION: forcing a failure. [ 232.959480][ T8039] name failslab, interval 1, probability 0, space 0, times 0 [ 232.972561][ T8039] CPU: 0 UID: 0 PID: 8039 Comm: syz.3.567 Not tainted syzkaller #0 PREEMPT(full) [ 232.972588][ T8039] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 232.972600][ T8039] Call Trace: [ 232.972608][ T8039] [ 232.972616][ T8039] dump_stack_lvl+0xe8/0x150 [ 232.972646][ T8039] should_fail_ex+0x412/0x560 [ 232.972676][ T8039] ? __d_alloc+0x37/0x6f0 [ 232.972704][ T8039] should_failslab+0xa8/0x100 [ 232.972736][ T8039] kmem_cache_alloc_lru_noprof+0x87/0x640 [ 232.972773][ T8039] __d_alloc+0x37/0x6f0 [ 232.972806][ T8039] d_alloc+0x4b/0x190 [ 232.972829][ T8039] ? lookup_one_qstr_excl+0xc4/0x360 [ 232.972860][ T8039] lookup_one_qstr_excl+0xd8/0x360 [ 232.972887][ T8039] ? lookup_noperm_common+0x245/0x430 [ 232.972916][ T8039] start_dirop+0x5c/0x90 [ 232.972942][ T8039] simple_start_creating+0xcc/0x110 [ 232.972979][ T8039] ? __pfx_simple_start_creating+0x10/0x10 [ 232.973007][ T8039] ? do_raw_spin_unlock+0xf5/0x210 [ 232.973035][ T8039] ? mntput+0x65/0xc0 [ 232.973061][ T8039] debugfs_start_creating+0xdb/0x1a0 [ 232.973085][ T8039] __debugfs_create_file+0x6f/0x400 [ 232.973111][ T8039] debugfs_create_file_full+0x3f/0x60 [ 232.973136][ T8039] ref_tracker_dir_debugfs+0x197/0x360 [ 232.973166][ T8039] ? __pfx_ref_tracker_dir_debugfs+0x10/0x10 [ 232.973226][ T8039] ? __kvmalloc_node_noprof+0x545/0x8a0 [ 232.973255][ T8039] ? alloc_netdev_mqs+0xa8/0x1210 [ 232.973282][ T8039] ? __raw_spin_lock_init+0x45/0x100 [ 232.973315][ T8039] alloc_netdev_mqs+0x274/0x1210 [ 232.973335][ T8039] ? __pfx_macvlan_setup+0x10/0x10 [ 232.973369][ T8039] rtnl_create_link+0x31f/0xd70 [ 232.973400][ T8039] rtnl_newlink_create+0x277/0xb70 [ 232.973430][ T8039] ? __pfx___nla_validate_parse+0x10/0x10 [ 232.973472][ T8039] ? __pfx_rtnl_newlink_create+0x10/0x10 [ 232.973506][ T8039] ? __pfx___mutex_lock+0x10/0x10 [ 232.973541][ T8039] ? ns_capable+0x89/0xe0 [ 232.973567][ T8039] rtnl_newlink+0x166a/0x1bb0 [ 232.973613][ T8039] ? __pfx_rtnl_newlink+0x10/0x10 [ 232.973637][ T8039] ? do_syscall_64+0x15f/0xf80 [ 232.973655][ T8039] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 232.973716][ T8039] ? kasan_quarantine_put+0xbb/0x1f0 [ 232.973743][ T8039] ? lockdep_hardirqs_on+0x7a/0x110 [ 232.973778][ T8039] ? nlmon_xmit+0xb0/0x100 [ 232.973801][ T8039] ? kmem_cache_free+0x182/0x650 [ 232.973843][ T8039] ? __lock_acquire+0x6b5/0x2cf0 [ 232.973871][ T8039] ? __dev_queue_xmit+0x2b6/0x3950 [ 232.973896][ T8039] ? __local_bh_enable_ip+0xd0/0x130 [ 232.973916][ T8039] ? lockdep_hardirqs_on+0x7a/0x110 [ 232.973944][ T8039] ? __dev_queue_xmit+0x2b6/0x3950 [ 232.973970][ T8039] ? __local_bh_enable_ip+0xd0/0x130 [ 232.973989][ T8039] ? __dev_queue_xmit+0x2b6/0x3950 [ 232.974017][ T8039] ? rtnetlink_rcv_msg+0x1b9/0xbe0 [ 232.974061][ T8039] ? __pfx_rtnl_newlink+0x10/0x10 [ 232.974087][ T8039] rtnetlink_rcv_msg+0x7d5/0xbe0 [ 232.974118][ T8039] ? rtnetlink_rcv_msg+0x1b9/0xbe0 [ 232.974143][ T8039] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 232.974168][ T8039] ? ref_tracker_free+0x693/0x840 [ 232.974197][ T8039] ? __pfx_ref_tracker_free+0x10/0x10 [ 232.974235][ T8039] netlink_rcv_skb+0x232/0x4b0 [ 232.974265][ T8039] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 232.974293][ T8039] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 232.974336][ T8039] ? netlink_deliver_tap+0x2e/0x1b0 [ 232.974364][ T8039] ? netlink_deliver_tap+0x2e/0x1b0 [ 232.974396][ T8039] netlink_unicast+0x75c/0x8e0 [ 232.974434][ T8039] netlink_sendmsg+0x813/0xb40 [ 232.974472][ T8039] ? __pfx_netlink_sendmsg+0x10/0x10 [ 232.974503][ T8039] ? aa_sock_msg_perm+0xf1/0x1b0 [ 232.974531][ T8039] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 232.974559][ T8039] ____sys_sendmsg+0x972/0x9f0 [ 232.974588][ T8039] ? __might_fault+0xaf/0x130 [ 232.974619][ T8039] ? __pfx_____sys_sendmsg+0x10/0x10 [ 232.974657][ T8039] ? import_iovec+0x73/0xa0 [ 232.974690][ T8039] ___sys_sendmsg+0x2a5/0x360 [ 232.974718][ T8039] ? __lock_acquire+0x6b5/0x2cf0 [ 232.974744][ T8039] ? __pfx____sys_sendmsg+0x10/0x10 [ 232.974779][ T8039] ? kstrtouint+0x6e/0xe0 [ 232.974832][ T8039] ? __fget_files+0x2a/0x420 [ 232.974854][ T8039] ? __fget_files+0x3a0/0x420 [ 232.974888][ T8039] __sys_sendmmsg+0x27c/0x4e0 [ 232.974924][ T8039] ? __pfx___sys_sendmmsg+0x10/0x10 [ 232.974951][ T8039] ? __mutex_unlock_slowpath+0x1be/0x6f0 [ 232.975009][ T8039] ? ksys_write+0x242/0x270 [ 232.975040][ T8039] ? __pfx_ksys_write+0x10/0x10 [ 232.975075][ T8039] __x64_sys_sendmmsg+0xa0/0xc0 [ 232.975106][ T8039] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 232.975126][ T8039] do_syscall_64+0x15f/0xf80 [ 232.975144][ T8039] ? trace_irq_disable+0x3b/0x140 [ 232.975173][ T8039] ? clear_bhb_loop+0x40/0x90 [ 232.975198][ T8039] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 232.975218][ T8039] RIP: 0033:0x7f521999ce59 [ 232.975238][ T8039] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 232.975254][ T8039] RSP: 002b:00007f521a7a8028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 232.975275][ T8039] RAX: ffffffffffffffda RBX: 00007f5219c15fa0 RCX: 00007f521999ce59 [ 232.975289][ T8039] RDX: 040000000000009f RSI: 00002000000002c0 RDI: 0000000000000004 [ 232.975302][ T8039] RBP: 00007f521a7a8090 R08: 0000000000000000 R09: 0000000000000000 [ 232.975313][ T8039] R10: 0000000000000020 R11: 0000000000000246 R12: 0000000000000001 [ 232.975324][ T8039] R13: 00007f5219c16038 R14: 00007f5219c15fa0 R15: 00007ffe3c7b1158 [ 232.975358][ T8039] [ 233.520713][ T8041] 8021q: VLANs not supported on ip_vti0 [ 233.727154][ T8052] openvswitch: netlink: Unexpected mask (mask=200044, allowed=1004c) [ 234.059398][ T8069] __nla_validate_parse: 15 callbacks suppressed [ 234.059420][ T8069] netlink: 72 bytes leftover after parsing attributes in process `syz.0.575'. [ 234.094695][ T8069] netlink: 12 bytes leftover after parsing attributes in process `syz.0.575'. [ 234.104614][ T8069] netlink: 8 bytes leftover after parsing attributes in process `syz.0.575'. [ 234.183413][ T8078] veth0_macvtap: entered allmulticast mode [ 234.203996][ T8078] A link change request failed with some changes committed already. Interface veth0_macvtap may have been left with an inconsistent configuration, please check. [ 234.236768][ T8065] wg1: entered promiscuous mode [ 234.241717][ T8065] wg1: entered allmulticast mode [ 234.406468][ T8086] netlink: 28 bytes leftover after parsing attributes in process `syz.2.581'. [ 234.655466][ T8096] netlink: 68 bytes leftover after parsing attributes in process `syz.1.585'. [ 234.666780][ T8096] netlink: 168 bytes leftover after parsing attributes in process `syz.1.585'. [ 234.686533][ T8090] bond1: option lacp_active: invalid value (8) [ 234.711933][ T8090] bond1 (unregistering): Released all slaves [ 234.778953][ T8101] netlink: 28 bytes leftover after parsing attributes in process `syz.1.586'. [ 234.787440][ T8091] bond1: option lacp_active: invalid value (8) [ 234.812606][ T8091] bond1 (unregistering): Released all slaves [ 235.097242][ T8110] netlink: 64 bytes leftover after parsing attributes in process `syz.4.589'. [ 235.172723][ T8115] netlink: 72 bytes leftover after parsing attributes in process `syz.1.590'. [ 235.216081][ T8115] netlink: 12 bytes leftover after parsing attributes in process `syz.1.590'. [ 235.343922][ T8111] netlink: 'syz.3.587': attribute type 5 has an invalid length. [ 235.534874][ T8126] syzkaller0: entered promiscuous mode [ 235.540859][ T8126] syzkaller0: entered allmulticast mode [ 235.622535][ T8110] openvswitch: netlink: IP tunnel attribute has 4 unknown bytes. [ 235.630348][ T8110] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 236.237102][ T8150] sctp: [Deprecated]: syz.4.599 (pid 8150) Use of int in max_burst socket option. [ 236.237102][ T8150] Use struct sctp_assoc_value instead [ 236.348175][ T8153] lo speed is unknown, defaulting to 1000 [ 236.453312][ T7035] IPVS: starting estimator thread 0... [ 236.595091][ T8166] IPVS: using max 23 ests per chain, 55200 per kthread [ 236.877537][ T8181] IPVS: set_ctl: invalid protocol: 0 172.20.20.187:20004 [ 237.383503][ T8174] lo speed is unknown, defaulting to 1000 [ 241.969724][ T8190] gretap0: left allmulticast mode [ 242.047650][ T6750] netdevsim netdevsim3 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 242.057199][ T6750] netdevsim netdevsim3 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 242.069211][ T6750] netdevsim netdevsim3 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 242.089860][ T8197] Set syz1 is full, maxelem 65536 reached [ 242.181744][ T6750] netdevsim netdevsim3 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 242.318064][ T8222] __nla_validate_parse: 8 callbacks suppressed [ 242.318085][ T8222] netlink: 16 bytes leftover after parsing attributes in process `syz.2.616'. [ 242.376198][ T8223] netlink: 72 bytes leftover after parsing attributes in process `syz.3.615'. [ 242.385457][ T8223] netlink: 12 bytes leftover after parsing attributes in process `syz.3.615'. [ 242.394356][ T8223] netlink: 8 bytes leftover after parsing attributes in process `syz.3.615'. [ 242.639137][ T8230] lo speed is unknown, defaulting to 1000 [ 244.309745][ T8262] netlink: 'syz.3.626': attribute type 1 has an invalid length. [ 244.366046][ T8265] netlink: 64 bytes leftover after parsing attributes in process `syz.0.627'. [ 244.421650][ T8266] netlink: 20 bytes leftover after parsing attributes in process `syz.3.626'. [ 244.515728][ T8268] netlink: 28 bytes leftover after parsing attributes in process `syz.3.626'. [ 244.628579][ T8270] netlink: 48 bytes leftover after parsing attributes in process `syz.1.628'. [ 244.782148][ T8266] bond2: (slave bridge2): making interface the new active one [ 244.790897][ T8266] bond2: (slave bridge2): Enslaving as an active interface with an up link [ 244.808229][ T8268] 8021q: adding VLAN 0 to HW filter on device bond2 [ 244.842502][ T8271] macvlan5: entered promiscuous mode [ 244.857447][ T8271] macvlan5: entered allmulticast mode [ 244.879568][ T8271] bond2: entered promiscuous mode [ 244.897923][ T8265] netlink: 4 bytes leftover after parsing attributes in process `syz.0.627'. [ 244.907656][ T8271] bridge2: entered promiscuous mode [ 244.925575][ T8271] 8021q: adding VLAN 0 to HW filter on device macvlan5 [ 244.945977][ T8271] bond2: (slave macvlan5): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 244.963824][ T8267] openvswitch: netlink: IP tunnel attribute has 4 unknown bytes. [ 244.971627][ T8267] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 244.984165][ T8271] bond2: left promiscuous mode [ 244.996112][ T8271] bridge2: left promiscuous mode [ 245.164087][ T8270] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 245.261487][ T8278] bridge2: entered promiscuous mode [ 245.296722][ T8278] bridge2: entered allmulticast mode [ 245.574596][ T8299] xt_bpf: check failed: parse error [ 245.665044][ T8270] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 245.846110][ T8308] netlink: 'syz.2.637': attribute type 32 has an invalid length. [ 245.854149][ T8308] netlink: 8 bytes leftover after parsing attributes in process `syz.2.637'. [ 245.883182][ T8270] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 245.911484][ T8308] bond1: Setting coupled_control to off (0) [ 246.087734][ T8270] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 246.339049][ T6753] tipc: Subscription rejected, illegal request [ 246.377238][ T8328] x_tables: ip6_tables: eui64 match: used from hooks OUTPUT, but only valid from PREROUTING/INPUT/FORWARD [ 246.679092][ T6753] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 246.694498][ T6753] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 246.711178][ T6753] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 246.753473][ T6753] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 247.490783][ T8376] lo speed is unknown, defaulting to 1000 [ 247.566250][ T8382] FAULT_INJECTION: forcing a failure. [ 247.566250][ T8382] name failslab, interval 1, probability 0, space 0, times 0 [ 247.598699][ T8382] CPU: 1 UID: 0 PID: 8382 Comm: syz.0.660 Not tainted syzkaller #0 PREEMPT(full) [ 247.598728][ T8382] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 247.598739][ T8382] Call Trace: [ 247.598747][ T8382] [ 247.598755][ T8382] dump_stack_lvl+0xe8/0x150 [ 247.598785][ T8382] should_fail_ex+0x412/0x560 [ 247.598818][ T8382] should_failslab+0xa8/0x100 [ 247.598848][ T8382] __kmalloc_cache_noprof+0x88/0x660 [ 247.598875][ T8382] ? __asan_memset+0x22/0x50 [ 247.598897][ T8382] ? alloc_netdev_mqs+0xbf0/0x1210 [ 247.598917][ T8382] ? __xdp_rxq_info_reg+0x171/0x280 [ 247.598952][ T8382] alloc_netdev_mqs+0xbf0/0x1210 [ 247.598983][ T8382] rtnl_create_link+0x31f/0xd70 [ 247.599012][ T8382] rtnl_newlink_create+0x277/0xb70 [ 247.599042][ T8382] ? __pfx___nla_validate_parse+0x10/0x10 [ 247.599083][ T8382] ? __pfx_rtnl_newlink_create+0x10/0x10 [ 247.599121][ T8382] ? __pfx___mutex_lock+0x10/0x10 [ 247.599154][ T8382] ? ns_capable+0x89/0xe0 [ 247.599179][ T8382] rtnl_newlink+0x166a/0x1bb0 [ 247.599208][ T8382] ? __lock_acquire+0x6b5/0x2cf0 [ 247.599243][ T8382] ? __pfx_rtnl_newlink+0x10/0x10 [ 247.599277][ T8382] ? __lock_acquire+0x6b5/0x2cf0 [ 247.599302][ T8382] ? __lock_acquire+0x6b5/0x2cf0 [ 247.599335][ T8382] ? unwind_next_frame+0xa6/0x2550 [ 247.599367][ T8382] ? unwind_next_frame+0xa6/0x2550 [ 247.599395][ T8382] ? is_bpf_text_address+0x26/0x2b0 [ 247.599430][ T8382] ? is_bpf_text_address+0x26/0x2b0 [ 247.599458][ T8382] ? __lock_acquire+0x6b5/0x2cf0 [ 247.599484][ T8382] ? kernel_text_address+0xa5/0xe0 [ 247.599513][ T8382] ? __kernel_text_address+0xd/0x30 [ 247.599540][ T8382] ? unwind_get_return_address+0x4d/0x90 [ 247.599574][ T8382] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 247.599603][ T8382] ? arch_stack_walk+0xfb/0x150 [ 247.599641][ T8382] ? rtnetlink_rcv_msg+0x1b9/0xbe0 [ 247.599683][ T8382] ? __pfx_rtnl_newlink+0x10/0x10 [ 247.599710][ T8382] rtnetlink_rcv_msg+0x7d5/0xbe0 [ 247.599733][ T8382] ? kmem_cache_alloc_node_noprof+0x384/0x690 [ 247.599760][ T8382] ? netlink_sendmsg+0x5d4/0xb40 [ 247.599791][ T8382] ? rtnetlink_rcv_msg+0x1b9/0xbe0 [ 247.599816][ T8382] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 247.599844][ T8382] ? __lock_acquire+0x6b5/0x2cf0 [ 247.599880][ T8382] netlink_rcv_skb+0x232/0x4b0 [ 247.599910][ T8382] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 247.599939][ T8382] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 247.599981][ T8382] ? netlink_deliver_tap+0x2e/0x1b0 [ 247.600009][ T8382] ? netlink_deliver_tap+0x2e/0x1b0 [ 247.600042][ T8382] netlink_unicast+0x75c/0x8e0 [ 247.600080][ T8382] netlink_sendmsg+0x813/0xb40 [ 247.600121][ T8382] ? __pfx_netlink_sendmsg+0x10/0x10 [ 247.600154][ T8382] ? aa_sock_msg_perm+0xf1/0x1b0 [ 247.600184][ T8382] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 247.600215][ T8382] ____sys_sendmsg+0x972/0x9f0 [ 247.600246][ T8382] ? __might_fault+0xaf/0x130 [ 247.600279][ T8382] ? __pfx_____sys_sendmsg+0x10/0x10 [ 247.600319][ T8382] ? import_iovec+0x73/0xa0 [ 247.600354][ T8382] ___sys_sendmsg+0x2a5/0x360 [ 247.600382][ T8382] ? __lock_acquire+0x6b5/0x2cf0 [ 247.600410][ T8382] ? __pfx____sys_sendmsg+0x10/0x10 [ 247.600446][ T8382] ? kstrtouint+0x6e/0xe0 [ 247.600500][ T8382] ? __fget_files+0x2a/0x420 [ 247.600523][ T8382] ? __fget_files+0x3a0/0x420 [ 247.600569][ T8382] __sys_sendmmsg+0x27c/0x4e0 [ 247.600606][ T8382] ? __pfx___sys_sendmmsg+0x10/0x10 [ 247.600633][ T8382] ? __mutex_unlock_slowpath+0x1be/0x6f0 [ 247.600683][ T8382] ? ksys_write+0x242/0x270 [ 247.600715][ T8382] ? __pfx_ksys_write+0x10/0x10 [ 247.600751][ T8382] __x64_sys_sendmmsg+0xa0/0xc0 [ 247.600781][ T8382] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 247.600802][ T8382] do_syscall_64+0x15f/0xf80 [ 247.600819][ T8382] ? trace_irq_disable+0x3b/0x140 [ 247.600849][ T8382] ? clear_bhb_loop+0x40/0x90 [ 247.600873][ T8382] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 247.600892][ T8382] RIP: 0033:0x7f8da1f9ce59 [ 247.600912][ T8382] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 247.600928][ T8382] RSP: 002b:00007f8da2ef0028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 247.600950][ T8382] RAX: ffffffffffffffda RBX: 00007f8da2215fa0 RCX: 00007f8da1f9ce59 [ 247.600964][ T8382] RDX: 040000000000009f RSI: 00002000000002c0 RDI: 0000000000000004 [ 247.600978][ T8382] RBP: 00007f8da2ef0090 R08: 0000000000000000 R09: 0000000000000000 [ 247.600989][ T8382] R10: 0000000000000020 R11: 0000000000000246 R12: 0000000000000002 [ 247.601001][ T8382] R13: 00007f8da2216038 R14: 00007f8da2215fa0 R15: 00007ffe17033b88 [ 247.601035][ T8382] [ 248.350612][ T8397] __nla_validate_parse: 4 callbacks suppressed [ 248.350632][ T8397] netlink: 16 bytes leftover after parsing attributes in process `syz.0.662'. [ 248.556549][ T8403] netlink: 'syz.2.663': attribute type 39 has an invalid length. [ 248.667399][ T8409] netlink: 68 bytes leftover after parsing attributes in process `syz.3.666'. [ 248.706673][ T8409] netlink: 168 bytes leftover after parsing attributes in process `syz.3.666'. [ 248.712040][ T8411] netlink: 8 bytes leftover after parsing attributes in process `syz.4.667'. [ 248.904531][ T8403] hsr_slave_0 (unregistering): left promiscuous mode [ 248.932332][ T8411] macvlan4: entered allmulticast mode [ 249.225990][ T8427] netlink: 220 bytes leftover after parsing attributes in process `syz.4.670'. [ 249.265224][ T8427] netlink: 44 bytes leftover after parsing attributes in process `syz.4.670'. [ 250.157858][ T8466] netlink: 16 bytes leftover after parsing attributes in process `syz.2.677'. [ 250.202284][ T8466] lo speed is unknown, defaulting to 1000 [ 250.642153][ T8476] netlink: 68 bytes leftover after parsing attributes in process `syz.4.679'. [ 250.662907][ T8479] xt_hashlimit: size too large, truncated to 1048576 [ 250.672286][ T8476] netlink: 168 bytes leftover after parsing attributes in process `syz.4.679'. [ 250.716150][ T8483] netlink: 'syz.3.681': attribute type 9 has an invalid length. [ 250.729333][ T8480] gtp0: entered promiscuous mode [ 250.742867][ T8480] gtp0: entered allmulticast mode [ 250.911941][ T6750] netdevsim netdevsim0 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 250.943277][ T6750] netdevsim netdevsim0 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 250.975343][ T6750] netdevsim netdevsim0 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 251.004229][ T6750] netdevsim netdevsim0 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 251.301539][ T8501] syzkaller1: entered promiscuous mode [ 251.311428][ T8501] syzkaller1: entered allmulticast mode [ 251.956668][ T8524] xt_TCPMSS: Only works on TCP SYN packets [ 251.963310][ T8524] netlink: 12 bytes leftover after parsing attributes in process `syz.3.689'. [ 252.166088][ T8528] xt_CT: You must specify a L4 protocol and not use inversions on it [ 252.493191][ T8536] infiniband syz0: set down [ 252.506683][ T8536] infiniband syz0: added bridge_slave_1 [ 252.521517][ T8536] smbdirect: ib_dev[syz0]: added: IB_CA max_fast_reg_page_list_len=512 device_cap_flags=0x1c001223c76 kernel_cap_flags=0x14 page_size_cap=0xfffff000 [ 252.538047][ T8536] smbdirect: ib_dev[syz0]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=32 max_cqe=32767 max_qp_wr=1048576 max_send_sge=32 max_recv_sge=32 [ 252.555800][ T8536] smbdirect: ib_dev[syz0]PORT[1]: iwarp=0 ib=0 roce=1 v1=0 v2=1 core_cap_flags=0x803005 [ 252.613117][ T8536] RDS/IB: syz0: added [ 252.617250][ T8536] smc: adding ib device syz0 with port count 1 [ 252.623449][ T8536] smc: ib device syz0 port 1 has no pnetid [ 252.714756][ T8540] lo speed is unknown, defaulting to 1000 [ 253.176373][ T8545] netlink: 'syz.3.697': attribute type 14 has an invalid length. [ 253.627790][ T8541] __nla_validate_parse: 6 callbacks suppressed [ 253.627810][ T8541] netlink: 44 bytes leftover after parsing attributes in process `syz.1.695'. [ 253.722751][ T8557] bond6: entered promiscuous mode [ 253.734723][ T8557] bond6: entered allmulticast mode [ 253.747707][ T8557] 8021q: adding VLAN 0 to HW filter on device bond6 [ 253.765607][ T8559] syzkaller0: entered promiscuous mode [ 253.771161][ T8559] syzkaller0: entered allmulticast mode [ 254.147836][ T8566] netlink: 68 bytes leftover after parsing attributes in process `syz.3.703'. [ 254.158487][ T8566] netlink: 168 bytes leftover after parsing attributes in process `syz.3.703'. [ 254.200795][ T8568] netlink: 8 bytes leftover after parsing attributes in process `syz.4.704'. [ 254.282752][ T8570] netlink: 16 bytes leftover after parsing attributes in process `syz.3.705'. [ 254.713612][ T8578] : renamed from wg2 (while UP) [ 256.109351][ T1318] ieee802154 phy0 wpan0: encryption failed: -22 [ 256.115751][ T1318] ieee802154 phy1 wpan1: encryption failed: -22 [ 256.157803][ T8602] netlink: 4 bytes leftover after parsing attributes in process `syz.4.714'. [ 256.167324][ T8602] openvswitch: netlink: IP tunnel attribute has 4 unknown bytes. [ 256.208703][ T8602] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 256.459868][ T8609] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 256.668824][ T8618] netlink: 'syz.2.716': attribute type 1 has an invalid length. [ 256.782451][ T8624] ieee802154 phy0 wpan0: encryption failed: -22 [ 257.280294][ T8623] lo speed is unknown, defaulting to 1000 [ 257.715937][ T8635] netdevsim netdevsim0 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 257.793069][ T8640] netlink: 4 bytes leftover after parsing attributes in process `syz.2.726'. [ 257.885583][ T8640] hsr_slave_1: left promiscuous mode [ 257.964272][ T8637] netlink: 8 bytes leftover after parsing attributes in process `syz.2.726'. [ 257.974338][ T8637] netlink: 'syz.2.726': attribute type 29 has an invalid length. [ 257.982214][ T8637] netlink: 4 bytes leftover after parsing attributes in process `syz.2.726'. [ 258.060818][ T8635] netdevsim netdevsim0 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 258.267557][ T8653] A link change request failed with some changes committed already. Interface wlan0 may have been left with an inconsistent configuration, please check. [ 258.594770][ T8662] syz.2.734 (8662) used obsolete PPPIOCDETACH ioctl [ 258.706265][ T8658] netlink: 4 bytes leftover after parsing attributes in process `syz.1.733'. [ 258.716368][ T8658] openvswitch: netlink: IP tunnel attribute has 4 unknown bytes. [ 258.733986][ T8658] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 258.821954][ T8635] netdevsim netdevsim0 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 259.153443][ T8677] IPVS: set_ctl: invalid protocol: 2 0.0.0.0:20002 [ 259.163134][ T8677] x_tables: ip6_tables: rpfilter match: used from hooks OUTPUT, but only valid from PREROUTING [ 259.341918][ T7023] lo speed is unknown, defaulting to 1000 [ 259.496775][ T8685] netlink: 'syz.2.742': attribute type 10 has an invalid length. [ 259.505013][ T8685] netlink: 228 bytes leftover after parsing attributes in process `syz.2.742'. [ 259.677270][ T8635] netdevsim netdevsim0 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 260.018222][ T6754] netdevsim netdevsim0 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 260.081175][ T8717] netlink: 'syz.1.747': attribute type 1 has an invalid length. [ 260.137734][ T8717] bond6: entered promiscuous mode [ 260.144288][ T8719] netlink: 44 bytes leftover after parsing attributes in process `syz.1.747'. [ 260.170599][ T8717] bond6: entered allmulticast mode [ 260.190853][ T8717] 8021q: adding VLAN 0 to HW filter on device bond6 [ 260.231229][ T6748] netdevsim netdevsim0 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 260.252332][ T6748] tipc: Subscription rejected, illegal request [ 260.344304][ T6754] netdevsim netdevsim0 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 260.414930][ T6754] netdevsim netdevsim0 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 260.922753][ T8749] Cannot find del_set index 1 as target [ 261.138097][ T8761] lo speed is unknown, defaulting to 1000 [ 261.152875][ T8759] netlink: 40 bytes leftover after parsing attributes in process `syz.3.757'. [ 261.410786][ T8780] netlink: 8 bytes leftover after parsing attributes in process `syz.3.761'. [ 261.562640][ T8777] tipc: Started in network mode [ 261.591704][ T8777] tipc: Node identity ca8ee0b32728, cluster identity 4711 [ 261.647025][ T8777] tipc: Enabled bearer , priority 0 [ 261.687382][ T8790] netlink: 'syz.3.762': attribute type 9 has an invalid length. [ 261.867848][ T8785] syzkaller0: entered promiscuous mode [ 261.879017][ T8785] syzkaller0: entered allmulticast mode [ 261.892930][ T8785] tipc: Resetting bearer [ 262.201180][ T8775] tipc: Resetting bearer [ 264.121527][ T8775] tipc: Disabling bearer [ 264.130943][ T8802] netlink: 'syz.0.763': attribute type 29 has an invalid length. [ 264.185643][ T7307] tipc: Node number set to 3987136691 [ 264.352517][ T8824] xt_hashlimit: size too large, truncated to 1048576 [ 264.422356][ T8829] netlink: 'syz.0.769': attribute type 9 has an invalid length. [ 264.490533][ T8826] netlink: 'syz.2.771': attribute type 11 has an invalid length. [ 264.588730][ T8836] netlink: 8 bytes leftover after parsing attributes in process `syz.3.774'. [ 264.693008][ T8837] netlink: 12 bytes leftover after parsing attributes in process `syz.1.775'. [ 264.876699][ T8844] netlink: 44 bytes leftover after parsing attributes in process `syz.3.774'. [ 265.027418][ T8845] netlink: 'syz.1.777': attribute type 6 has an invalid length. [ 265.312906][ T8873] syzkaller0: entered promiscuous mode [ 265.318485][ T8873] syzkaller0: entered allmulticast mode [ 265.429555][ T8866] tipc: Enabled bearer , priority 0 [ 265.516210][ T8867] netlink: 56 bytes leftover after parsing attributes in process `syz.0.779'. [ 265.562384][ T8866] tipc: Resetting bearer [ 265.636200][ T8866] tipc: Disabling bearer [ 265.677906][ T8867] netlink: 24 bytes leftover after parsing attributes in process `syz.0.779'. [ 265.712297][ T8882] syzkaller0: entered promiscuous mode [ 265.718210][ T8882] syzkaller0: entered allmulticast mode [ 266.057385][ T8894] tipc: Enabling of bearer rejected, failed to enable media [ 266.122529][ T8894] tipc: Enabling of bearer rejected, failed to enable media [ 266.165799][ T8894] tipc: Enabling of bearer rejected, failed to enable media [ 266.173050][ T8902] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 266.189109][ T8894] tipc: Enabling of bearer rejected, failed to enable media [ 266.201102][ T8902] netlink: 55 bytes leftover after parsing attributes in process `syz.0.792'. [ 266.226941][ T8894] tipc: Enabling of bearer rejected, failed to enable media [ 266.238114][ T8894] tipc: Enabling of bearer rejected, failed to enable media [ 266.251609][ T8894] tipc: Enabling of bearer rejected, failed to enable media [ 266.290944][ T8894] tipc: Enabling of bearer rejected, failed to enable media [ 266.337761][ T8894] tipc: Enabling of bearer rejected, failed to enable media [ 266.363667][ T8894] tipc: Enabling of bearer rejected, failed to enable media [ 266.375217][ T8894] tipc: Enabling of bearer rejected, failed to enable media [ 266.385193][ T8894] tipc: Enabling of bearer rejected, failed to enable media [ 266.421173][ T8894] tipc: Enabling of bearer rejected, failed to enable media [ 266.445623][ T8894] tipc: Enabling of bearer rejected, failed to enable media [ 266.474479][ T8894] tipc: Enabling of bearer rejected, failed to enable media [ 266.494869][ T8894] tipc: Enabling of bearer rejected, failed to enable media [ 266.518071][ T8894] tipc: Enabling of bearer rejected, failed to enable media [ 266.538069][ T8894] tipc: Enabling of bearer rejected, failed to enable media [ 266.561944][ T8894] tipc: Enabling of bearer rejected, failed to enable media [ 266.586768][ T8894] tipc: Enabling of bearer rejected, failed to enable media [ 266.630051][ T8894] tipc: Enabling of bearer rejected, failed to enable media [ 266.677415][ T8894] tipc: Enabling of bearer rejected, failed to enable media [ 266.712244][ T8894] tipc: Enabling of bearer rejected, failed to enable media [ 266.754308][ T8894] tipc: Enabling of bearer rejected, failed to enable media [ 266.757598][ T8910] netlink: 8 bytes leftover after parsing attributes in process `syz.1.796'. [ 267.010841][ T8894] tipc: Enabling of bearer rejected, failed to enable media [ 267.042136][ T8910] gretap0: entered promiscuous mode [ 267.047712][ T8910] macvlan2: entered allmulticast mode [ 267.053117][ T8910] gretap0: entered allmulticast mode [ 267.239773][ T8914] lo speed is unknown, defaulting to 1000 [ 267.768713][ T8931] netlink: 8 bytes leftover after parsing attributes in process `syz.0.801'. [ 267.857447][ T8934] netlink: 8 bytes leftover after parsing attributes in process `syz.2.803'. [ 268.083916][ T8939] netlink: 20 bytes leftover after parsing attributes in process `syz.4.805'. [ 268.387697][ T8944] nbd: nbd64 already in use [ 268.602024][ T8203] udevd[8203]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 268.833967][ T8962] macvlan5: entered allmulticast mode [ 269.682270][ T8987] __nla_validate_parse: 8 callbacks suppressed [ 269.682290][ T8987] netlink: 4 bytes leftover after parsing attributes in process `syz.4.817'. [ 269.813808][ T8993] netlink: 24 bytes leftover after parsing attributes in process `syz.0.818'. [ 270.182120][ T8997] syzkaller1: entered promiscuous mode [ 270.197771][ T8997] syzkaller1: entered allmulticast mode [ 270.584399][ T9013] netlink: 56 bytes leftover after parsing attributes in process `syz.2.824'. [ 270.620951][ T9009] lo speed is unknown, defaulting to 1000 [ 270.662374][ T9017] mac80211_hwsim hwsim6 wlan0: entered promiscuous mode [ 270.670891][ T9018] openvswitch: netlink: VXLAN extension message has 44 unknown bytes. [ 271.283500][ T9035] 8021q: VLANs not supported on ip6gre0 [ 271.578830][ T9043] netlink: 'syz.4.832': attribute type 1 has an invalid length. [ 271.675174][ T9043] 8021q: adding VLAN 0 to HW filter on device bond7 [ 271.736286][ T9049] bond7: (slave geneve2): making interface the new active one [ 271.745725][ T9049] bond7: (slave geneve2): Enslaving as an active interface with an up link [ 271.944921][ T6750] netdevsim netdevsim4 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 272.094907][ T6750] netdevsim netdevsim4 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 272.142014][ T6750] netdevsim netdevsim4 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 272.170836][ T6750] netdevsim netdevsim4 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 272.514170][ T9074] netlink: 8 bytes leftover after parsing attributes in process `syz.4.840'. [ 272.685910][ T9074] macvlan6: entered allmulticast mode [ 272.943335][ T9091] bond3: (slave lo): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 273.051990][ T9091] bond3: (slave lo): Enslaving as an active interface with an up link [ 273.061678][ T9091] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 273.349531][ T9086] bond1: up delay (2) is not a multiple of miimon (80), value rounded to 0 ms [ 273.390511][ T9086] bond1: entered promiscuous mode [ 273.409058][ T9086] 8021q: adding VLAN 0 to HW filter on device bond1 [ 273.483055][ T9102] netlink: 24 bytes leftover after parsing attributes in process `syz.4.848'. [ 273.676642][ T9118] netlink: 68 bytes leftover after parsing attributes in process `syz.0.854'. [ 273.686876][ T9118] netlink: 168 bytes leftover after parsing attributes in process `syz.0.854'. [ 273.897534][ T9123] netlink: 'syz.4.857': attribute type 7 has an invalid length. [ 273.939117][ T5767] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 273.947795][ T5767] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 273.956995][ T9123] netlink: 4 bytes leftover after parsing attributes in process `syz.4.857'. [ 273.966518][ T9123] netlink: 'syz.4.857': attribute type 7 has an invalid length. [ 273.974201][ T9123] netlink: 4 bytes leftover after parsing attributes in process `syz.4.857'. [ 274.007850][ T9121] lo speed is unknown, defaulting to 1000 [ 274.418376][ T9142] netlink: 4 bytes leftover after parsing attributes in process `syz.3.862'. [ 274.656942][ T9159] FAULT_INJECTION: forcing a failure. [ 274.656942][ T9159] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 274.711144][ T9159] CPU: 0 UID: 0 PID: 9159 Comm: syz.0.865 Not tainted syzkaller #0 PREEMPT(full) [ 274.711174][ T9159] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 274.711186][ T9159] Call Trace: [ 274.711194][ T9159] [ 274.711202][ T9159] dump_stack_lvl+0xe8/0x150 [ 274.711232][ T9159] should_fail_ex+0x412/0x560 [ 274.711267][ T9159] _copy_from_user+0x2d/0xb0 [ 274.711297][ T9159] do_sock_getsockopt+0x200/0x7e0 [ 274.711332][ T9159] ? __pfx_do_sock_getsockopt+0x10/0x10 [ 274.711380][ T9159] ? __fget_files+0x3a0/0x420 [ 274.711414][ T9159] ? __fget_files+0x2a/0x420 [ 274.711445][ T9159] __x64_sys_getsockopt+0x1a4/0x240 [ 274.711481][ T9159] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 274.711504][ T9159] do_syscall_64+0x15f/0xf80 [ 274.711523][ T9159] ? trace_irq_disable+0x3b/0x140 [ 274.711553][ T9159] ? clear_bhb_loop+0x40/0x90 [ 274.711578][ T9159] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 274.711598][ T9159] RIP: 0033:0x7f8da1f9ce59 [ 274.711619][ T9159] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 274.711636][ T9159] RSP: 002b:00007f8da2ecf028 EFLAGS: 00000246 ORIG_RAX: 0000000000000037 [ 274.711660][ T9159] RAX: ffffffffffffffda RBX: 00007f8da2216090 RCX: 00007f8da1f9ce59 [ 274.711674][ T9159] RDX: 0000000000000039 RSI: 0000000000000001 RDI: 0000000000000004 [ 274.711685][ T9159] RBP: 00007f8da2ecf090 R08: 0000200000000280 R09: 0000000000000000 [ 274.711698][ T9159] R10: 0000200000000240 R11: 0000000000000246 R12: 0000000000000001 [ 274.711710][ T9159] R13: 00007f8da2216128 R14: 00007f8da2216090 R15: 00007ffe17033b88 [ 274.711742][ T9159] [ 275.214606][ T9167] netlink: 68 bytes leftover after parsing attributes in process `syz.0.867'. [ 275.227899][ T9167] netlink: 168 bytes leftover after parsing attributes in process `syz.0.867'. [ 275.607505][ T9179] netlink: 4 bytes leftover after parsing attributes in process `syz.4.869'. [ 275.781603][ T9170] openvswitch: netlink: IP tunnel attribute has 4 unknown bytes. [ 275.818784][ T9170] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 275.890892][ T9197] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 275.899672][ T9197] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 275.908126][ T9197] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 276.011642][ T9197] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 276.020094][ T9197] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 276.240529][ T9198] dummy0: left promiscuous mode [ 276.308455][ T9198] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 276.660271][ T9211] bridge2: entered promiscuous mode [ 276.684930][ T9211] bridge2: entered allmulticast mode [ 276.712991][ T9211] team0: Port device bridge2 added [ 276.855649][ T9222] FAULT_INJECTION: forcing a failure. [ 276.855649][ T9222] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 276.889644][ T9222] CPU: 0 UID: 0 PID: 9222 Comm: syz.4.877 Not tainted syzkaller #0 PREEMPT(full) [ 276.889672][ T9222] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 276.889683][ T9222] Call Trace: [ 276.889691][ T9222] [ 276.889699][ T9222] dump_stack_lvl+0xe8/0x150 [ 276.889730][ T9222] should_fail_ex+0x412/0x560 [ 276.889762][ T9222] _copy_from_user+0x2d/0xb0 [ 276.889792][ T9222] sk_getsockopt+0x1d4/0x2840 [ 276.889831][ T9222] ? __pfx_sk_getsockopt+0x10/0x10 [ 276.889884][ T9222] ? __might_fault+0xaf/0x130 [ 276.889911][ T9222] ? __might_fault+0xaf/0x130 [ 276.889957][ T9222] do_sock_getsockopt+0x2bd/0x7e0 [ 276.889995][ T9222] ? __pfx_do_sock_getsockopt+0x10/0x10 [ 276.890042][ T9222] ? __fget_files+0x3a0/0x420 [ 276.890065][ T9222] ? __fget_files+0x2a/0x420 [ 276.890097][ T9222] __x64_sys_getsockopt+0x1a4/0x240 [ 276.890133][ T9222] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 276.890156][ T9222] do_syscall_64+0x15f/0xf80 [ 276.890175][ T9222] ? trace_irq_disable+0x3b/0x140 [ 276.890203][ T9222] ? clear_bhb_loop+0x40/0x90 [ 276.890229][ T9222] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 276.890249][ T9222] RIP: 0033:0x7fd6d5d9ce59 [ 276.890269][ T9222] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 276.890285][ T9222] RSP: 002b:00007fd6d3ff6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000037 [ 276.890307][ T9222] RAX: ffffffffffffffda RBX: 00007fd6d6016090 RCX: 00007fd6d5d9ce59 [ 276.890322][ T9222] RDX: 0000000000000039 RSI: 0000000000000001 RDI: 0000000000000004 [ 276.890334][ T9222] RBP: 00007fd6d3ff6090 R08: 0000200000000280 R09: 0000000000000000 [ 276.890347][ T9222] R10: 0000200000000240 R11: 0000000000000246 R12: 0000000000000001 [ 276.890359][ T9222] R13: 00007fd6d6016128 R14: 00007fd6d6016090 R15: 00007ffc8ed02228 [ 276.890392][ T9222] [ 277.162133][ T9224] netlink: 'syz.1.878': attribute type 2 has an invalid length. [ 277.578757][ T9234] netlink: 68 bytes leftover after parsing attributes in process `syz.3.880'. [ 277.621057][ T9234] netlink: 168 bytes leftover after parsing attributes in process `syz.3.880'. [ 278.162892][ T9244] netlink: 'syz.2.884': attribute type 33 has an invalid length. [ 278.170702][ T9244] netlink: 152 bytes leftover after parsing attributes in process `syz.2.884'. [ 278.647843][ T9252] netlink: 32 bytes leftover after parsing attributes in process `syz.2.885'. [ 278.852776][ T9254] netlink: 24 bytes leftover after parsing attributes in process `syz.1.888'. [ 279.057271][ T9267] netlink: 16150 bytes leftover after parsing attributes in process `syz.3.882'. [ 279.258143][ T9273] netlink: 212368 bytes leftover after parsing attributes in process `syz.1.890'. [ 279.535352][ T9282] gretap0: entered promiscuous mode [ 279.775803][ T9287] netlink: 'syz.4.891': attribute type 12 has an invalid length. [ 280.020999][ T9282] 8021q: adding VLAN 0 to HW filter on device bond0 [ 280.038144][ T9282] 8021q: adding VLAN 0 to HW filter on device team0 [ 280.259555][ T9282] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 280.456589][ T9282] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 280.468087][ T9306] tipc: Trying to set illegal importance in message [ 280.476594][ T9282] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 280.529095][ T9282] veth1_vlan: left promiscuous mode [ 280.546396][ T9282] veth0_vlan: left promiscuous mode [ 280.578341][ T9282] veth0_vlan: entered promiscuous mode [ 280.628268][ T9282] veth1_vlan: entered promiscuous mode [ 280.676901][ T9282] veth1_macvtap: left promiscuous mode [ 280.687234][ T9282] veth0_macvtap: left promiscuous mode [ 280.703978][ T9282] veth0_macvtap: entered promiscuous mode [ 280.794563][ T9282] veth1_macvtap: entered promiscuous mode [ 280.827793][ T9282] mac80211_hwsim hwsim6 wlan0: left promiscuous mode [ 280.835119][ T9282] net_ratelimit: 1017 callbacks suppressed [ 280.835137][ T9282] A link change request failed with some changes committed already. Interface wlan0 may have been left with an inconsistent configuration, please check. [ 280.996734][ T9300] pim6reg1: entered promiscuous mode [ 281.002780][ T9300] pim6reg1: entered allmulticast mode [ 281.797309][ T9316] lo speed is unknown, defaulting to 1000 [ 282.126994][ T9332] netlink: 'syz.2.900': attribute type 1 has an invalid length. [ 282.197890][ T9334] __nla_validate_parse: 2 callbacks suppressed [ 282.197910][ T9334] netlink: 16 bytes leftover after parsing attributes in process `syz.2.900'. [ 282.286809][ T9332] 8021q: adding VLAN 0 to HW filter on device bond2 [ 283.071578][ T9345] netlink: 68 bytes leftover after parsing attributes in process `syz.4.904'. [ 283.101940][ T9345] netlink: 168 bytes leftover after parsing attributes in process `syz.4.904'. [ 283.462087][ T9349] IPVS: set_ctl: invalid protocol: 47 10.1.1.0:20004 [ 283.588427][ T7023] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 283.967250][ T9362] netlink: 8 bytes leftover after parsing attributes in process `syz.4.909'. [ 284.089683][ T9362] macvlan7: entered allmulticast mode [ 284.336184][ T9375] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 284.635138][ T9380] netlink: 52 bytes leftover after parsing attributes in process `syz.2.915'. [ 284.660077][ T9380] bridge0: port 2(bridge_slave_1) entered disabled state [ 284.668812][ T9380] bridge0: port 1(bridge_slave_0) entered disabled state [ 284.690572][ T9383] netlink: 'syz.1.916': attribute type 1 has an invalid length. [ 284.738715][ T9380] netlink: 76 bytes leftover after parsing attributes in process `syz.2.915'. [ 284.740690][ T9383] 8021q: adding VLAN 0 to HW filter on device bond7 [ 284.756155][ T9380] bridge0: port 2(bridge_slave_1) entered blocking state [ 284.763399][ T9380] bridge0: port 2(bridge_slave_1) entered forwarding state [ 284.771040][ T9380] bridge0: port 1(bridge_slave_0) entered blocking state [ 284.778213][ T9380] bridge0: port 1(bridge_slave_0) entered forwarding state [ 284.791498][ T9380] netlink: 52 bytes leftover after parsing attributes in process `syz.2.915'. [ 284.805694][ T9380] bridge0: port 2(bridge_slave_1) entered disabled state [ 284.813099][ T9380] bridge0: port 1(bridge_slave_0) entered disabled state [ 284.833958][ T9383] netlink: 28 bytes leftover after parsing attributes in process `syz.1.916'. [ 284.905553][ T9389] netlink: 'syz.1.916': attribute type 1 has an invalid length. [ 284.956403][ T9389] bond7: (slave batadv1): Opening slave failed [ 285.454189][ T9404] netlink: 8 bytes leftover after parsing attributes in process `syz.3.922'. [ 285.470477][ T9404] macvlan5: entered allmulticast mode [ 285.475899][ T9404] gretap0: entered allmulticast mode [ 285.520701][ T9402] netlink: 'syz.2.921': attribute type 10 has an invalid length. [ 286.326108][ T9426] netlink: 8 bytes leftover after parsing attributes in process `syz.0.931'. [ 286.487491][ T9429] gretap0: entered promiscuous mode [ 286.525204][ T9429] macvlan2: entered allmulticast mode [ 286.557251][ T9429] gretap0: entered allmulticast mode [ 286.854083][ T9437] dvmrp1: tun_chr_ioctl cmd 1074025677 [ 286.882899][ T9437] dvmrp1: linktype set to 804 [ 286.900638][ T9437] xt_ecn: cannot match TCP bits for non-tcp packets [ 287.055248][ T9440] lo speed is unknown, defaulting to 1000 [ 287.733826][ T9464] Bluetooth: hci0: Opcode 0x0c20 failed: -22 [ 287.873510][ T9464] netlink: set zone limit has 4 unknown bytes [ 287.990536][ T9475] __nla_validate_parse: 3 callbacks suppressed [ 287.990557][ T9475] netlink: 8 bytes leftover after parsing attributes in process `syz.3.947'. [ 288.017222][ T9475] macvlan6: entered allmulticast mode [ 288.765561][ T9503] netlink: 264 bytes leftover after parsing attributes in process `syz.2.956'. [ 288.810411][ T9509] netlink: 14 bytes leftover after parsing attributes in process `syz.1.957'. [ 288.823332][ T9506] vlan2: entered allmulticast mode [ 288.828086][ T9511] netlink: 8 bytes leftover after parsing attributes in process `syz.3.958'. [ 288.829894][ T9506] bond0: entered allmulticast mode [ 288.843015][ T9506] bond_slave_0: entered allmulticast mode [ 288.848872][ T9506] bond_slave_1: entered allmulticast mode [ 288.882631][ T9511] macvlan7: entered allmulticast mode [ 288.963865][ T9509] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 288.994489][ T9509] bond_slave_0: left allmulticast mode [ 289.005630][ T9509] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 289.015140][ T9509] bond_slave_1: left allmulticast mode [ 289.021608][ T9509] bond0 (unregistering): Released all slaves [ 289.566764][ T9535] netlink: 'syz.3.966': attribute type 10 has an invalid length. [ 289.642596][ T9538] netlink: 'syz.3.966': attribute type 10 has an invalid length. [ 289.709904][ T9535] team0: Port device dummy0 added [ 289.832178][ T9546] netlink: 14 bytes leftover after parsing attributes in process `syz.4.968'. [ 289.854359][ T9538] team0: Port device dummy0 removed [ 289.913041][ T9538] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 290.541877][ T9560] netlink: 12 bytes leftover after parsing attributes in process `syz.3.972'. [ 290.612816][ T9564] netlink: 'syz.0.974': attribute type 6 has an invalid length. [ 291.077287][ T9588] netlink: 28 bytes leftover after parsing attributes in process `syz.4.981'. [ 291.208074][ T9597] netlink: 212376 bytes leftover after parsing attributes in process `syz.0.984'. [ 291.225695][ T9595] netlink: 76 bytes leftover after parsing attributes in process `syz.1.983'. [ 291.262660][ T9597] sctp: [Deprecated]: syz.0.984 (pid 9597) Use of struct sctp_assoc_value in delayed_ack socket option. [ 291.262660][ T9597] Use struct sctp_sack_info instead [ 291.376195][ T9602] netlink: 8 bytes leftover after parsing attributes in process `syz.3.985'. [ 291.806974][ T9625] hsr_slave_1 (unregistering): left promiscuous mode [ 291.860463][ T9626] netlink: 'syz.3.993': attribute type 1 has an invalid length. [ 291.868832][ T9626] netlink: 'syz.3.993': attribute type 1 has an invalid length. [ 291.965722][ T9632] tipc: Started in network mode [ 291.970739][ T9632] tipc: Node identity 3ae35d49849c, cluster identity 4711 [ 291.977978][ T9632] tipc: Enabled bearer , priority 0 [ 292.009959][ T9632] syzkaller0: entered promiscuous mode [ 292.015458][ T9632] syzkaller0: entered allmulticast mode [ 292.042049][ T9632] tipc: Resetting bearer [ 292.164998][ T9630] tipc: Resetting bearer [ 292.898559][ T9648] netlink: 'syz.0.999': attribute type 58 has an invalid length. [ 293.183024][ T7023] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 294.458572][ T9630] tipc: Disabling bearer [ 294.531709][ T7013] tipc: Node number set to 3196017993 [ 294.714207][ T9656] __nla_validate_parse: 8 callbacks suppressed [ 294.714226][ T9656] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1002'. [ 294.738557][ T9656] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 295.038953][ T9664] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1005'. [ 295.128857][ T9667] xt_hashlimit: size too large, truncated to 1048576 [ 295.135719][ T9669] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 295.176966][ T9673] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1005'. [ 295.421948][ T9680] netlink: 'syz.1.1006': attribute type 1 has an invalid length. [ 295.440087][ T9680] netlink: 224 bytes leftover after parsing attributes in process `syz.1.1006'. [ 295.673889][ T9687] netlink: 72 bytes leftover after parsing attributes in process `syz.2.1010'. [ 295.912162][ T9692] netlink: 'syz.2.1010': attribute type 11 has an invalid length. [ 296.642897][ T9731] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 296.670453][ T9731] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 296.717036][ T9731] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 296.727737][ T9737] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1019'. [ 296.736813][ T9737] netlink: 'syz.1.1019': attribute type 20 has an invalid length. [ 296.759190][ T9731] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 296.792416][ T9731] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 296.804381][ T9734] netlink: 180568 bytes leftover after parsing attributes in process `syz.4.1018'. [ 296.809516][ T9731] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 296.840209][ T9731] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 296.840604][ T6749] netdevsim netdevsim1 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 296.856915][ T6749] netdevsim netdevsim1 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 297.040653][ T6749] netdevsim netdevsim1 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 297.058573][ T6749] netdevsim netdevsim1 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 297.230775][ T9752] netlink: 'syz.3.1021': attribute type 29 has an invalid length. [ 297.262073][ T9752] netlink: 'syz.3.1021': attribute type 29 has an invalid length. [ 297.435838][ T9745] tipc: Enabled bearer , priority 0 [ 297.558532][ T9752] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1021'. [ 297.673995][ T9745] syzkaller0: entered promiscuous mode [ 297.682770][ T9745] syzkaller0: entered allmulticast mode [ 297.695335][ T9745] tipc: Resetting bearer [ 297.765713][ T6750] tipc: Resetting bearer [ 297.860350][ T9744] tipc: Resetting bearer [ 297.880252][ T9764] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1025'. [ 297.965098][ T9767] xt_hashlimit: size too large, truncated to 1048576 [ 298.013055][ T9770] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1027'. [ 298.133174][ T9773] netlink: 'syz.0.1026': attribute type 9 has an invalid length. [ 298.240991][ C0] net_ratelimit: 1018 callbacks suppressed [ 298.241012][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 298.568073][ T9790] openvswitch: netlink: ufid size 20 bytes exceeds the range (1, 16) [ 298.583414][ T9790] openvswitch: netlink: Flow set message rejected, Key attribute missing. [ 299.254979][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 300.176651][ T9744] tipc: Disabling bearer [ 300.213404][ T9786] workqueue: Failed to create a rescuer kthread for wq "wg-crypt-wireguard%d": -EINTR [ 300.284211][ T9787] tipc: Enabling of bearer rejected, media not registered [ 300.294834][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 300.427384][ T9797] netlink: 'syz.0.1035': attribute type 62 has an invalid length. [ 300.672357][ T9815] __nla_validate_parse: 2 callbacks suppressed [ 300.672377][ T9815] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1040'. [ 300.832277][ T9821] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1043'. [ 300.913102][ T9825] netlink: 64 bytes leftover after parsing attributes in process `syz.2.1045'. [ 301.069537][ T9835] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1047'. [ 301.132605][ T9835] macvlan3: entered allmulticast mode [ 301.176979][ T9836] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1045'. [ 301.235312][ T9836] openvswitch: netlink: IP tunnel attribute has 4 unknown bytes. [ 301.253121][ T9836] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 301.599553][ T9854] lo speed is unknown, defaulting to 1000 [ 301.622319][ T9859] netlink: 48 bytes leftover after parsing attributes in process `syz.1.1056'. [ 301.876365][ T9865] netlink: 'syz.3.1058': attribute type 2 has an invalid length. [ 301.916409][ T9865] netlink: 'syz.3.1058': attribute type 2 has an invalid length. [ 302.129406][ T9872] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1060'. [ 302.168332][ T9872] macvlan4: entered allmulticast mode [ 302.190931][ T9870] syzkaller0: entered promiscuous mode [ 302.196477][ T9870] syzkaller0: entered allmulticast mode [ 302.299718][ T9876] netlink: 64 bytes leftover after parsing attributes in process `syz.3.1062'. [ 302.504294][ T9882] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1062'. [ 302.539850][ T9886] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 302.569093][ T9881] openvswitch: netlink: IP tunnel attribute has 4 unknown bytes. [ 302.576920][ T9881] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 302.727915][ T7019] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 303.008416][ T9903] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1068'. [ 303.681005][ T9922] bridge3: entered promiscuous mode [ 303.686291][ T9922] bridge3: entered allmulticast mode [ 303.730074][ T9922] team0: Port device bridge3 added [ 303.784861][ C0] net_ratelimit: 1 callbacks suppressed [ 303.784883][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 303.913383][ T9930] bond3: entered promiscuous mode [ 304.430634][ T9949] openvswitch: netlink: IP tunnel attribute has 4 unknown bytes. [ 304.438445][ T9949] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 304.682831][ T9954] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 304.918668][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 305.286212][ T9967] faux_driver regulatory: loading /lib/firmware/regulatory.db failed with error -4 [ 305.325848][ T9967] faux_driver regulatory: Direct firmware load for regulatory.db failed with error -4 [ 305.362047][ T9967] faux_driver regulatory: Falling back to sysfs fallback for: regulatory.db [ 305.645440][ T9978] bridge_slave_0: left allmulticast mode [ 305.651170][ T9978] bridge_slave_0: left promiscuous mode [ 305.657013][ T9978] bridge0: port 1(bridge_slave_0) entered disabled state [ 305.722165][ T9999] __nla_validate_parse: 9 callbacks suppressed [ 305.722187][ T9999] netlink: 64 bytes leftover after parsing attributes in process `syz.3.1093'. [ 305.767492][ T9978] bridge_slave_1: left allmulticast mode [ 305.777558][ T9978] bridge_slave_1: left promiscuous mode [ 305.783361][ T9978] bridge0: port 2(bridge_slave_1) entered disabled state [ 305.795286][ T9978] bond0: (slave bond_slave_0): Releasing backup interface [ 305.830519][ T9978] bond0: (slave bond_slave_1): Releasing backup interface [ 305.861835][ T9978] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 305.893321][ T9978] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 305.920702][ T9978] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 305.954691][ T9978] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 305.996153][T10015] netlink: 68 bytes leftover after parsing attributes in process `syz.4.1096'. [ 306.007016][T10015] netlink: 168 bytes leftover after parsing attributes in process `syz.4.1096'. [ 306.044953][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 306.073088][T10016] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1093'. [ 306.091030][ T9978] bond0: (slave batadv1): Releasing backup interface [ 306.161200][T10021] openvswitch: netlink: IP tunnel attribute has 4 unknown bytes. [ 306.224326][T10021] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 306.231729][T10011] bridge2: entered promiscuous mode [ 306.238473][T10011] bridge2: entered allmulticast mode [ 306.279289][T10011] team0: Port device bridge2 added [ 306.345701][T10030] netlink: 'syz.4.1100': attribute type 13 has an invalid length. [ 306.548366][T10030] sch_tbf: burst 6 is lower than device gretap0 mtu (1476) ! [ 306.557504][T10036] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1102'. [ 306.653035][T10041] netlink: 'syz.1.1101': attribute type 6 has an invalid length. [ 306.669694][T10042] netlink: 'syz.3.1102': attribute type 9 has an invalid length. [ 306.929757][T10051] netlink: 39 bytes leftover after parsing attributes in process `syz.0.1103'. [ 307.096386][T10059] syzkaller0: entered promiscuous mode [ 307.102167][T10059] syzkaller0: entered allmulticast mode [ 307.108687][ T7019] IPVS: starting estimator thread 0... [ 307.112507][T10056] tipc: Enabled bearer , priority 0 [ 307.127069][T10046] syzkaller0: mtu less than device minimum [ 307.137933][T10045] tipc: Resetting bearer [ 307.150119][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 307.190952][T10045] tipc: Disabling bearer [ 307.255096][T10060] IPVS: using max 24 ests per chain, 57600 per kthread [ 307.267515][T10064] netlink: 68 bytes leftover after parsing attributes in process `syz.4.1107'. [ 307.278117][T10064] netlink: 168 bytes leftover after parsing attributes in process `syz.4.1107'. [ 307.336070][T10066] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1108'. [ 307.472939][T10071] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1110'. [ 307.500384][T10071] netlink: 'syz.2.1110': attribute type 1 has an invalid length. [ 307.508338][T10071] netlink: 'syz.2.1110': attribute type 2 has an invalid length. [ 307.592751][T10075] netlink: 'syz.2.1112': attribute type 1 has an invalid length. [ 307.641631][T10075] bond4: (slave bridge2): making interface the new active one [ 307.663829][T10075] bond4: (slave bridge2): Enslaving as an active interface with an up link [ 308.324745][T10098] bridge3: entered promiscuous mode [ 308.330079][T10098] bridge3: entered allmulticast mode [ 308.360976][T10098] team0: Port device bridge3 added [ 308.430633][T10089] xt_bpf: check failed: parse error [ 309.070332][T10117] netlink: 'syz.4.1124': attribute type 1 has an invalid length. [ 309.262339][T10128] netlink: 'syz.4.1129': attribute type 1 has an invalid length. [ 309.330843][T10128] 8021q: adding VLAN 0 to HW filter on device bond8 [ 309.396990][ C0] net_ratelimit: 1 callbacks suppressed [ 309.397011][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 309.678198][T10133] netlink: 'syz.4.1129': attribute type 1 has an invalid length. [ 309.718904][T10133] bond8: (slave batadv1): Opening slave failed [ 310.153226][T10160] FAULT_INJECTION: forcing a failure. [ 310.153226][T10160] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 310.184891][T10160] CPU: 1 UID: 0 PID: 10160 Comm: syz.0.1138 Not tainted syzkaller #0 PREEMPT(full) [ 310.184920][T10160] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 310.184933][T10160] Call Trace: [ 310.184942][T10160] [ 310.184950][T10160] dump_stack_lvl+0xe8/0x150 [ 310.184990][T10160] should_fail_ex+0x412/0x560 [ 310.185023][T10160] _copy_from_user+0x2d/0xb0 [ 310.185054][T10160] ___sys_sendmsg+0x1c6/0x360 [ 310.185084][T10160] ? __lock_acquire+0x6b5/0x2cf0 [ 310.185112][T10160] ? __pfx____sys_sendmsg+0x10/0x10 [ 310.185148][T10160] ? kstrtouint+0x6e/0xe0 [ 310.185205][T10160] ? __fget_files+0x2a/0x420 [ 310.185229][T10160] ? __fget_files+0x3a0/0x420 [ 310.185264][T10160] __sys_sendmmsg+0x27c/0x4e0 [ 310.185300][T10160] ? __pfx___sys_sendmmsg+0x10/0x10 [ 310.185327][T10160] ? __mutex_unlock_slowpath+0x1be/0x6f0 [ 310.185374][T10160] ? ksys_write+0x242/0x270 [ 310.185405][T10160] ? __pfx_ksys_write+0x10/0x10 [ 310.185441][T10160] __x64_sys_sendmmsg+0xa0/0xc0 [ 310.185470][T10160] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 310.185492][T10160] do_syscall_64+0x15f/0xf80 [ 310.185511][T10160] ? trace_irq_disable+0x3b/0x140 [ 310.185539][T10160] ? clear_bhb_loop+0x40/0x90 [ 310.185565][T10160] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 310.185585][T10160] RIP: 0033:0x7f8da1f9ce59 [ 310.185604][T10160] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 310.185620][T10160] RSP: 002b:00007f8da2ef0028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 310.185642][T10160] RAX: ffffffffffffffda RBX: 00007f8da2215fa0 RCX: 00007f8da1f9ce59 [ 310.185656][T10160] RDX: 040000000000009f RSI: 00002000000002c0 RDI: 000000000000000c [ 310.185669][T10160] RBP: 00007f8da2ef0090 R08: 0000000000000000 R09: 0000000000000000 [ 310.185681][T10160] R10: 0000000000000020 R11: 0000000000000246 R12: 0000000000000001 [ 310.185693][T10160] R13: 00007f8da2216038 R14: 00007f8da2215fa0 R15: 00007ffe17033b88 [ 310.185725][T10160] [ 310.506296][T10167] veth1_to_bond: entered allmulticast mode [ 310.516216][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 310.702020][T10172] veth1_to_bond: left allmulticast mode [ 310.761139][T10180] netlink: 'syz.0.1146': attribute type 10 has an invalid length. [ 310.771463][T10184] __nla_validate_parse: 14 callbacks suppressed [ 310.771481][T10184] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1144'. [ 310.784314][T10186] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1147'. [ 310.789542][T10184] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1144'. [ 310.796323][T10186] openvswitch: netlink: Flow actions attr not present in new flow. [ 310.826225][T10187] bridge4: entered promiscuous mode [ 310.831529][T10187] bridge4: entered allmulticast mode [ 310.842163][T10187] team0: Port device bridge4 added [ 311.056432][T10200] FAULT_INJECTION: forcing a failure. [ 311.056432][T10200] name failslab, interval 1, probability 0, space 0, times 0 [ 311.095225][T10200] CPU: 0 UID: 0 PID: 10200 Comm: syz.3.1151 Not tainted syzkaller #0 PREEMPT(full) [ 311.095256][T10200] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 311.095268][T10200] Call Trace: [ 311.095276][T10200] [ 311.095285][T10200] dump_stack_lvl+0xe8/0x150 [ 311.095314][T10200] should_fail_ex+0x412/0x560 [ 311.095347][T10200] should_failslab+0xa8/0x100 [ 311.095380][T10200] kmem_cache_alloc_node_noprof+0x8f/0x690 [ 311.095408][T10200] ? __alloc_skb+0x186/0x7d0 [ 311.095433][T10200] ? __alloc_skb+0x1d0/0x7d0 [ 311.095457][T10200] ? __local_bh_enable_ip+0xd0/0x130 [ 311.095484][T10200] __alloc_skb+0x1d0/0x7d0 [ 311.095515][T10200] netlink_sendmsg+0x5d4/0xb40 [ 311.095554][T10200] ? __pfx_netlink_sendmsg+0x10/0x10 [ 311.095588][T10200] ? aa_sock_msg_perm+0xf1/0x1b0 [ 311.095617][T10200] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 311.095649][T10200] ____sys_sendmsg+0x972/0x9f0 [ 311.095678][T10200] ? __might_fault+0xaf/0x130 [ 311.095719][T10200] ? __pfx_____sys_sendmsg+0x10/0x10 [ 311.095759][T10200] ? import_iovec+0x73/0xa0 [ 311.095792][T10200] ___sys_sendmsg+0x2a5/0x360 [ 311.095822][T10200] ? __lock_acquire+0x6b5/0x2cf0 [ 311.095849][T10200] ? __pfx____sys_sendmsg+0x10/0x10 [ 311.095885][T10200] ? kstrtouint+0x6e/0xe0 [ 311.095936][T10200] ? __fget_files+0x2a/0x420 [ 311.095959][T10200] ? __fget_files+0x3a0/0x420 [ 311.095993][T10200] __sys_sendmmsg+0x27c/0x4e0 [ 311.096029][T10200] ? __pfx___sys_sendmmsg+0x10/0x10 [ 311.096056][T10200] ? __mutex_unlock_slowpath+0x1be/0x6f0 [ 311.096103][T10200] ? ksys_write+0x242/0x270 [ 311.096133][T10200] ? __pfx_ksys_write+0x10/0x10 [ 311.096168][T10200] __x64_sys_sendmmsg+0xa0/0xc0 [ 311.096198][T10200] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 311.096220][T10200] do_syscall_64+0x15f/0xf80 [ 311.096238][T10200] ? trace_irq_disable+0x3b/0x140 [ 311.096267][T10200] ? clear_bhb_loop+0x40/0x90 [ 311.096290][T10200] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 311.096310][T10200] RIP: 0033:0x7f521999ce59 [ 311.096330][T10200] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 311.096348][T10200] RSP: 002b:00007f521a7a8028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 311.096372][T10200] RAX: ffffffffffffffda RBX: 00007f5219c15fa0 RCX: 00007f521999ce59 [ 311.096386][T10200] RDX: 040000000000009f RSI: 00002000000002c0 RDI: 000000000000000c [ 311.096399][T10200] RBP: 00007f521a7a8090 R08: 0000000000000000 R09: 0000000000000000 [ 311.096410][T10200] R10: 0000000000000020 R11: 0000000000000246 R12: 0000000000000001 [ 311.096422][T10200] R13: 00007f5219c16038 R14: 00007f5219c15fa0 R15: 00007ffe3c7b1158 [ 311.096452][T10200] [ 311.653638][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 311.828870][T10219] netlink: 28 bytes leftover after parsing attributes in process `syz.4.1157'. [ 311.931112][T10219] IPVS: Scheduler module ip_vs_sip not found [ 311.970393][T10229] netlink: 244 bytes leftover after parsing attributes in process `syz.2.1159'. [ 312.119017][T10237] netlink: 28 bytes leftover after parsing attributes in process `syz.4.1164'. [ 312.197257][T10240] macsec0: entered promiscuous mode [ 312.220404][T10242] netlink: 'syz.3.1165': attribute type 1 has an invalid length. [ 312.235045][T10240] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1163'. [ 312.278102][T10240] macsec0 (unregistering): left promiscuous mode [ 312.312110][T10244] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1166'. [ 312.345464][T10242] 8021q: adding VLAN 0 to HW filter on device bond4 [ 312.397503][T10242] bond4: (slave geneve3): making interface the new active one [ 312.408438][T10242] bond4: (slave geneve3): Enslaving as an active interface with an up link [ 312.419220][ T6756] netdevsim netdevsim3 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 312.431241][ T6756] netdevsim netdevsim3 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 312.464545][ T6749] netdevsim netdevsim3 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 312.480300][ T6749] netdevsim netdevsim3 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 312.576231][T10255] bridge3: entered promiscuous mode [ 312.588827][T10255] bridge3: entered allmulticast mode [ 312.786124][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 312.875890][T10270] netlink: 40 bytes leftover after parsing attributes in process `syz.1.1173'. [ 313.178480][T10281] syzkaller0: entered promiscuous mode [ 313.187131][T10281] syzkaller0: entered allmulticast mode [ 313.258841][T10281] simple: basic_1 [ 313.262768][T10281] simple: basic_2 [ 313.266439][T10281] simple: basic_3 [ 313.269747][T10287] netlink: 224 bytes leftover after parsing attributes in process `syz.3.1178'. [ 313.270095][T10281] simple: basic_4 [ 313.282784][T10281] simple: basic_5 [ 313.286534][T10281] simple: basic_6 [ 313.290229][T10281] simple: basic_7 [ 313.293891][T10281] simple: basic_8 [ 313.297549][T10281] simple: basic_9 [ 313.301216][T10281] simple: basic_10 [ 313.304966][T10281] simple: basic_11 [ 313.308732][T10281] simple: basic_12 [ 313.312482][T10281] simple: basic_13 [ 313.316232][T10281] simple: basic_14 [ 313.319989][T10281] simple: basic_15 [ 313.323814][T10281] simple: basic_16 [ 313.327569][T10281] simple: basic_17 [ 313.331333][T10281] 0: reclassify loop, rule prio 0, protocol 800 [ 313.427834][T10293] macvlan3: entered allmulticast mode [ 313.857539][T10296] vlan4: entered promiscuous mode [ 313.912403][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 314.073837][T10313] FAULT_INJECTION: forcing a failure. [ 314.073837][T10313] name failslab, interval 1, probability 0, space 0, times 0 [ 314.086603][T10313] CPU: 0 UID: 0 PID: 10313 Comm: syz.4.1186 Not tainted syzkaller #0 PREEMPT(full) [ 314.086630][T10313] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 314.086642][T10313] Call Trace: [ 314.086651][T10313] [ 314.086660][T10313] dump_stack_lvl+0xe8/0x150 [ 314.086690][T10313] should_fail_ex+0x412/0x560 [ 314.086723][T10313] should_failslab+0xa8/0x100 [ 314.086754][T10313] ? skb_clone+0x212/0x3a0 [ 314.086774][T10313] kmem_cache_alloc_noprof+0x87/0x650 [ 314.086803][T10313] ? __netlink_lookup+0xc6/0x8b0 [ 314.086841][T10313] skb_clone+0x212/0x3a0 [ 314.086865][T10313] __netlink_deliver_tap+0x404/0x850 [ 314.086923][T10313] ? netlink_deliver_tap+0x2e/0x1b0 [ 314.086954][T10313] netlink_deliver_tap+0x19c/0x1b0 [ 314.086985][T10313] netlink_unicast+0x730/0x8e0 [ 314.087025][T10313] netlink_sendmsg+0x813/0xb40 [ 314.087066][T10313] ? __pfx_netlink_sendmsg+0x10/0x10 [ 314.087100][T10313] ? aa_sock_msg_perm+0xf1/0x1b0 [ 314.087129][T10313] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 314.087162][T10313] ____sys_sendmsg+0x972/0x9f0 [ 314.087194][T10313] ? __might_fault+0xaf/0x130 [ 314.087229][T10313] ? __pfx_____sys_sendmsg+0x10/0x10 [ 314.087270][T10313] ? import_iovec+0x73/0xa0 [ 314.087304][T10313] ___sys_sendmsg+0x2a5/0x360 [ 314.087333][T10313] ? __lock_acquire+0x6b5/0x2cf0 [ 314.087361][T10313] ? __pfx____sys_sendmsg+0x10/0x10 [ 314.087398][T10313] ? kstrtouint+0x6e/0xe0 [ 314.087453][T10313] ? __fget_files+0x2a/0x420 [ 314.087477][T10313] ? __fget_files+0x3a0/0x420 [ 314.087514][T10313] __sys_sendmmsg+0x27c/0x4e0 [ 314.087552][T10313] ? __pfx___sys_sendmmsg+0x10/0x10 [ 314.087580][T10313] ? __mutex_unlock_slowpath+0x1be/0x6f0 [ 314.087631][T10313] ? ksys_write+0x242/0x270 [ 314.087662][T10313] ? __pfx_ksys_write+0x10/0x10 [ 314.087698][T10313] __x64_sys_sendmmsg+0xa0/0xc0 [ 314.087728][T10313] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 314.087750][T10313] do_syscall_64+0x15f/0xf80 [ 314.087768][T10313] ? trace_irq_disable+0x3b/0x140 [ 314.087798][T10313] ? clear_bhb_loop+0x40/0x90 [ 314.087824][T10313] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 314.087845][T10313] RIP: 0033:0x7fd6d5d9ce59 [ 314.087866][T10313] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 314.087892][T10313] RSP: 002b:00007fd6d6b87028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 314.087917][T10313] RAX: ffffffffffffffda RBX: 00007fd6d6015fa0 RCX: 00007fd6d5d9ce59 [ 314.087932][T10313] RDX: 040000000000009f RSI: 00002000000002c0 RDI: 000000000000000c [ 314.087946][T10313] RBP: 00007fd6d6b87090 R08: 0000000000000000 R09: 0000000000000000 [ 314.087958][T10313] R10: 0000000000000020 R11: 0000000000000246 R12: 0000000000000001 [ 314.087970][T10313] R13: 00007fd6d6016038 R14: 00007fd6d6015fa0 R15: 00007ffc8ed02228 [ 314.088005][T10313] [ 314.618424][T10320] : renamed from veth0_to_bond (while UP) [ 314.760732][T10329] hma(kX: entered promiscuous mode [ 315.002188][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 315.075937][T10345] FAULT_INJECTION: forcing a failure. [ 315.075937][T10345] name failslab, interval 1, probability 0, space 0, times 0 [ 315.175671][T10345] CPU: 0 UID: 0 PID: 10345 Comm: syz.3.1198 Not tainted syzkaller #0 PREEMPT(full) [ 315.175700][T10345] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 315.175710][T10345] Call Trace: [ 315.175718][T10345] [ 315.175726][T10345] dump_stack_lvl+0xe8/0x150 [ 315.175756][T10345] should_fail_ex+0x412/0x560 [ 315.175786][T10345] should_failslab+0xa8/0x100 [ 315.175830][T10345] kmem_cache_alloc_node_noprof+0x8f/0x690 [ 315.175859][T10345] ? __alloc_skb+0x186/0x7d0 [ 315.175885][T10345] ? __alloc_skb+0x1d0/0x7d0 [ 315.175917][T10345] ? __local_bh_enable_ip+0xd0/0x130 [ 315.175945][T10345] __alloc_skb+0x1d0/0x7d0 [ 315.175972][T10345] ? netlink_ack_tlv_len+0x6c/0x210 [ 315.176004][T10345] netlink_ack+0x146/0xa50 [ 315.176028][T10345] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 315.176057][T10345] ? __lock_acquire+0x6b5/0x2cf0 [ 315.176093][T10345] netlink_rcv_skb+0x2b6/0x4b0 [ 315.176122][T10345] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 315.176151][T10345] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 315.176193][T10345] ? netlink_deliver_tap+0x2e/0x1b0 [ 315.176221][T10345] ? netlink_deliver_tap+0x2e/0x1b0 [ 315.176255][T10345] netlink_unicast+0x75c/0x8e0 [ 315.176292][T10345] netlink_sendmsg+0x813/0xb40 [ 315.176331][T10345] ? __pfx_netlink_sendmsg+0x10/0x10 [ 315.176363][T10345] ? aa_sock_msg_perm+0xf1/0x1b0 [ 315.176392][T10345] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 315.176423][T10345] ____sys_sendmsg+0x972/0x9f0 [ 315.176452][T10345] ? __might_fault+0xaf/0x130 [ 315.176481][T10345] ? __pfx_____sys_sendmsg+0x10/0x10 [ 315.176521][T10345] ? import_iovec+0x73/0xa0 [ 315.176554][T10345] ___sys_sendmsg+0x2a5/0x360 [ 315.176582][T10345] ? __lock_acquire+0x6b5/0x2cf0 [ 315.176608][T10345] ? __pfx____sys_sendmsg+0x10/0x10 [ 315.176643][T10345] ? kstrtouint+0x6e/0xe0 [ 315.176695][T10345] ? __fget_files+0x2a/0x420 [ 315.176717][T10345] ? __fget_files+0x3a0/0x420 [ 315.176753][T10345] __sys_sendmmsg+0x27c/0x4e0 [ 315.176789][T10345] ? __pfx___sys_sendmmsg+0x10/0x10 [ 315.176815][T10345] ? __mutex_unlock_slowpath+0x1be/0x6f0 [ 315.176874][T10345] ? ksys_write+0x242/0x270 [ 315.176906][T10345] ? __pfx_ksys_write+0x10/0x10 [ 315.176941][T10345] __x64_sys_sendmmsg+0xa0/0xc0 [ 315.176972][T10345] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 315.176993][T10345] do_syscall_64+0x15f/0xf80 [ 315.177011][T10345] ? trace_irq_disable+0x3b/0x140 [ 315.177041][T10345] ? clear_bhb_loop+0x40/0x90 [ 315.177066][T10345] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 315.177086][T10345] RIP: 0033:0x7f521999ce59 [ 315.177106][T10345] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 315.177124][T10345] RSP: 002b:00007f521a7a8028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 315.177146][T10345] RAX: ffffffffffffffda RBX: 00007f5219c15fa0 RCX: 00007f521999ce59 [ 315.177161][T10345] RDX: 040000000000009f RSI: 00002000000002c0 RDI: 000000000000000c [ 315.177175][T10345] RBP: 00007f521a7a8090 R08: 0000000000000000 R09: 0000000000000000 [ 315.177188][T10345] R10: 0000000000000020 R11: 0000000000000246 R12: 0000000000000001 [ 315.177200][T10345] R13: 00007f5219c16038 R14: 00007f5219c15fa0 R15: 00007ffe3c7b1158 [ 315.177234][T10345] [ 316.295163][T10378] __nla_validate_parse: 6 callbacks suppressed [ 316.295184][T10378] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1208'. [ 316.327924][T10375] lo speed is unknown, defaulting to 1000 [ 316.370361][T10378] ieee802154 phy0 wpan0: encryption failed: -90 [ 316.375913][T10382] bridge5: entered promiscuous mode [ 316.381981][T10382] bridge5: entered allmulticast mode [ 316.391609][T10382] team0: Port device bridge5 added [ 316.398942][T10370] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1204'. [ 317.061324][T10407] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1216'. [ 317.120477][T10410] netlink: 68 bytes leftover after parsing attributes in process `syz.0.1215'. [ 317.165694][T10410] netlink: 168 bytes leftover after parsing attributes in process `syz.0.1215'. [ 317.442107][T10424] netlink: 64 bytes leftover after parsing attributes in process `syz.2.1220'. [ 317.501115][ T1318] ieee802154 phy0 wpan0: encryption failed: -22 [ 317.508319][T10426] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1222'. [ 317.691823][T10427] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1220'. [ 317.732739][T10427] openvswitch: netlink: IP tunnel attribute has 4 unknown bytes. [ 317.754797][T10427] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 317.930831][T10433] A link change request failed with some changes committed already. Interface vlan2 may have been left with an inconsistent configuration, please check. [ 317.962435][T10443] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 318.057559][T10449] netlink: 'syz.0.1228': attribute type 1 has an invalid length. [ 318.080296][T10444] openvswitch: netlink: Actions may not be safe on all matching packets [ 318.170521][T10456] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1228'. [ 318.294948][T10449] 8021q: adding VLAN 0 to HW filter on device bond2 [ 318.554396][T10449] netlink: 'syz.0.1228': attribute type 1 has an invalid length. [ 318.566611][T10455] bridge3: entered promiscuous mode [ 318.572422][T10455] bridge3: entered allmulticast mode [ 318.653841][T10464] netlink: 68 bytes leftover after parsing attributes in process `syz.4.1229'. [ 318.772233][T10449] bond2: (slave batadv1): Opening slave failed [ 319.040570][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 319.137201][T10483] ip6gre2: entered promiscuous mode [ 319.142578][T10483] ip6gre2: entered allmulticast mode [ 319.415681][ T6740] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 319.456325][ T5824] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 319.466206][ T6740] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 319.651540][T10490] lo speed is unknown, defaulting to 1000 [ 319.917034][T10504] FAULT_INJECTION: forcing a failure. [ 319.917034][T10504] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 319.972407][T10504] CPU: 1 UID: 0 PID: 10504 Comm: syz.3.1242 Not tainted syzkaller #0 PREEMPT(full) [ 319.972437][T10504] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 319.972450][T10504] Call Trace: [ 319.972458][T10504] [ 319.972467][T10504] dump_stack_lvl+0xe8/0x150 [ 319.972497][T10504] should_fail_ex+0x412/0x560 [ 319.972529][T10504] _copy_from_user+0x2d/0xb0 [ 319.972559][T10504] __sys_bpf+0x229/0x950 [ 319.972593][T10504] ? __pfx___sys_bpf+0x10/0x10 [ 319.972640][T10504] ? ksys_write+0x242/0x270 [ 319.972673][T10504] ? __pfx_ksys_write+0x10/0x10 [ 319.972707][T10504] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 319.972739][T10504] __x64_sys_bpf+0x7c/0x90 [ 319.972769][T10504] do_syscall_64+0x15f/0xf80 [ 319.972788][T10504] ? trace_irq_disable+0x3b/0x140 [ 319.972818][T10504] ? clear_bhb_loop+0x40/0x90 [ 319.972843][T10504] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 319.972863][T10504] RIP: 0033:0x7f521999ce59 [ 319.972883][T10504] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 319.972901][T10504] RSP: 002b:00007f521a7a8028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 319.972923][T10504] RAX: ffffffffffffffda RBX: 00007f5219c15fa0 RCX: 00007f521999ce59 [ 319.972937][T10504] RDX: 0000000000000094 RSI: 0000200000000440 RDI: 0000000000000005 [ 319.972950][T10504] RBP: 00007f521a7a8090 R08: 0000000000000000 R09: 0000000000000000 [ 319.972962][T10504] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 319.972974][T10504] R13: 00007f5219c16038 R14: 00007f5219c15fa0 R15: 00007ffe3c7b1158 [ 319.973007][T10504] [ 320.078245][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 320.311754][ T5824] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 320.407126][T10510] tun0: tun_chr_ioctl cmd 1074025675 [ 320.428271][T10510] tun0: persist enabled [ 320.443314][T10510] tun0: tun_chr_ioctl cmd 1074025675 [ 320.467955][T10510] tun0: persist disabled [ 320.478716][ T7036] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 320.570660][T10521] bridge4: entered promiscuous mode [ 320.585730][T10521] bridge4: entered allmulticast mode [ 320.625537][T10523] netlink: 'syz.0.1250': attribute type 1 has an invalid length. [ 320.797649][T10523] 8021q: adding VLAN 0 to HW filter on device bond3 [ 321.003058][T10525] netlink: 'syz.0.1250': attribute type 1 has an invalid length. [ 321.016548][T10525] bond3: (slave batadv1): Opening slave failed [ 321.101105][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 321.569652][T10535] bond5: Unable to set down delay as MII monitoring is disabled [ 321.656218][T10535] bond5 (unregistering): Released all slaves [ 322.106264][T10550] __nla_validate_parse: 6 callbacks suppressed [ 322.106288][T10550] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1258'. [ 322.136406][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 322.279270][T10555] netlink: 64 bytes leftover after parsing attributes in process `syz.2.1256'. [ 322.517475][T10564] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1256'. [ 322.570519][T10567] xt_hashlimit: size too large, truncated to 1048576 [ 322.612806][T10568] openvswitch: netlink: IP tunnel attribute has 4 unknown bytes. [ 322.620613][T10568] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 322.654513][T10569] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1263'. [ 322.722852][T10571] netlink: 'syz.3.1264': attribute type 9 has an invalid length. [ 322.845723][T10573] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1265'. [ 323.204940][T10586] bond0: up delay (2) is not a multiple of miimon (80), value rounded to 0 ms [ 323.218127][T10586] bond0: entered promiscuous mode [ 323.223683][T10586] 8021q: adding VLAN 0 to HW filter on device bond0 [ 323.233568][T10583] netlink: 40 bytes leftover after parsing attributes in process `syz.3.1269'. [ 323.254940][T10592] netlink: 28 bytes leftover after parsing attributes in process `syz.2.1268'. [ 323.268979][T10592] netlink: 55631 bytes leftover after parsing attributes in process `syz.2.1268'. [ 323.274333][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 323.370903][T10594] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1272'. [ 323.514898][ C1] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 323.692855][T10617] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1277'. [ 323.741986][T10621] xt_hashlimit: size too large, truncated to 1048576 [ 323.811715][T10623] netlink: 'syz.3.1279': attribute type 9 has an invalid length. [ 324.182601][T10631] netlink: 'syz.4.1281': attribute type 1 has an invalid length. [ 324.190743][T10631] netlink: 'syz.4.1281': attribute type 1 has an invalid length. [ 324.278812][T10640] netlink: 'syz.3.1283': attribute type 11 has an invalid length. [ 324.297215][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 324.360317][T10642] netlink: 'syz.1.1285': attribute type 83 has an invalid length. [ 324.466669][T10648] netlink: 'syz.1.1288': attribute type 16 has an invalid length. [ 324.548583][T10650] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for gretap1 [ 324.698955][T10658] xt_hashlimit: size too large, truncated to 1048576 [ 324.870055][T10664] netlink: 'syz.3.1293': attribute type 9 has an invalid length. [ 325.075275][T10672] openvswitch: netlink: Actions may not be safe on all matching packets [ 325.134655][T10676] netlink: 'syz.0.1300': attribute type 1 has an invalid length. [ 325.445830][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 325.877983][ T8203] udevd[8203]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 326.415979][T10715] A link change request failed with some changes committed already. Interface geneve1 may have been left with an inconsistent configuration, please check. [ 326.566671][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 326.722479][T10723] xt_hashlimit: size too large, truncated to 1048576 [ 326.826276][T10732] netlink: 'syz.0.1312': attribute type 9 has an invalid length. [ 327.360181][T10737] xt_bpf: check failed: parse error [ 327.482320][T10743] tipc: Failed to remove unknown binding: 66,1,1/0:2765474567/2765474569 [ 327.584216][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 327.601109][T10745] bridge0: port 2(vlan3) entered blocking state [ 327.607724][T10745] bridge0: port 2(vlan3) entered disabled state [ 327.614203][T10745] vlan3: entered allmulticast mode [ 327.619347][T10745] bridge0: entered allmulticast mode [ 327.633963][T10745] vlan3: left allmulticast mode [ 327.652349][T10745] bridge0: left allmulticast mode [ 328.015738][T10760] __nla_validate_parse: 9 callbacks suppressed [ 328.015760][T10760] netlink: 164 bytes leftover after parsing attributes in process `syz.4.1326'. [ 328.290711][T10771] xt_hashlimit: size too large, truncated to 1048576 [ 328.305760][T10768] tipc: Enabled bearer , priority 10 [ 328.360992][T10778] netlink: 'syz.2.1329': attribute type 9 has an invalid length. [ 328.370572][T10779] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1330'. [ 328.384124][T10781] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1330'. [ 328.453500][T10768] netlink: 56 bytes leftover after parsing attributes in process `syz.0.1328'. [ 328.500490][T10779] bond9: entered promiscuous mode [ 328.507526][T10779] 8021q: adding VLAN 0 to HW filter on device bond9 [ 328.642157][T10790] netlink: 24 bytes leftover after parsing attributes in process `syz.4.1331'. [ 328.712352][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 329.064784][T10800] netlink: 'syz.4.1335': attribute type 1 has an invalid length. [ 329.169497][T10803] netlink: 28 bytes leftover after parsing attributes in process `syz.4.1335'. [ 329.186778][T10800] 8021q: adding VLAN 0 to HW filter on device bond10 [ 329.203128][T10805] x_tables: ip_tables: TPROXY target: used from hooks FORWARD, but only usable from PREROUTING [ 329.229373][T10805] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1336'. [ 329.272520][ T5824] tipc: Node number set to 2801196047 [ 329.460619][T10806] netlink: 'syz.4.1335': attribute type 1 has an invalid length. [ 329.527355][T10806] bond10: (slave batadv1): Opening slave failed [ 329.593743][T10804] xt_bpf: check failed: parse error [ 329.832029][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 329.975989][T10672] Set syz1 is full, maxelem 65536 reached [ 330.225806][T10817] netlink: 64 bytes leftover after parsing attributes in process `syz.2.1340'. [ 330.283956][T10825] xt_hashlimit: size too large, truncated to 1048576 [ 330.306915][T10827] netlink: 20 bytes leftover after parsing attributes in process `syz.3.1338'. [ 330.352023][T10828] netlink: 'syz.4.1343': attribute type 9 has an invalid length. [ 330.474703][T10836] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1340'. [ 330.540584][T10837] openvswitch: netlink: IP tunnel attribute has 4 unknown bytes. [ 330.554647][T10837] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 331.023745][T10845] block nbd0: server does not support multiple connections per device. [ 331.037892][T10845] block nbd0: shutting down sockets [ 331.202162][T10859] netlink: 'syz.2.1352': attribute type 1 has an invalid length. [ 331.244678][T10859] netlink: 'syz.2.1352': attribute type 2 has an invalid length. [ 331.514836][ C1] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 331.530959][ T7019] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 331.630092][T10860] xt_bpf: check failed: parse error [ 331.677552][T10870] netdevsim netdevsim1 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 331.711589][T10870] netdevsim netdevsim1 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 332.122824][T10870] netdevsim netdevsim1 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 332.133081][T10870] netdevsim netdevsim1 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 332.260917][T10890] xt_hashlimit: size too large, truncated to 1048576 [ 332.358700][T10890] netlink: 'syz.0.1360': attribute type 9 has an invalid length. [ 332.633739][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 332.711806][T10904] lo speed is unknown, defaulting to 1000 [ 332.916534][T10913] ieee802154 phy0 wpan0: encryption failed: -22 [ 333.378093][T10932] xt_bpf: check failed: parse error [ 333.520690][T10870] netdevsim netdevsim1 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 333.541443][T10870] netdevsim netdevsim1 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 333.675307][T10935] xt_hashlimit: size too large, truncated to 1048576 [ 333.763293][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 333.776121][T10937] netlink: 'syz.0.1371': attribute type 9 has an invalid length. [ 334.466126][T10870] netdevsim netdevsim1 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 334.477083][T10870] netdevsim netdevsim1 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 334.521875][T10942] syzkaller0: entered allmulticast mode [ 334.926406][ T6756] netdevsim netdevsim1 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 334.934657][ T6756] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 334.982907][ T6756] netdevsim netdevsim1 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 334.991149][ T6756] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 335.219773][T10977] xt_hashlimit: size too large, truncated to 1048576 [ 335.300660][ T6756] netdevsim netdevsim1 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 335.317405][ T6756] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 335.334488][ T6756] netdevsim netdevsim1 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 335.397102][ T6756] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 335.405666][T10980] netlink: 'syz.4.1382': attribute type 9 has an invalid length. [ 335.779748][T10994] __nla_validate_parse: 4 callbacks suppressed [ 335.779770][T10994] netlink: 32 bytes leftover after parsing attributes in process `syz.0.1386'. [ 336.113542][T10990] xt_bpf: check failed: parse error [ 336.121356][T11003] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1389'. [ 336.224734][T11006] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1391'. [ 336.400105][T11015] netlink: 'syz.1.1392': attribute type 1 has an invalid length. [ 336.431858][T11015] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1392'. [ 336.465739][T11015] netlink: 'syz.1.1392': attribute type 1 has an invalid length. [ 336.617570][T11018] bond6: down delay (5) is not a multiple of miimon (2), value rounded to 4 ms [ 336.626698][T11018] bond6: entered promiscuous mode [ 336.749993][T11019] syzkaller1: entered promiscuous mode [ 336.756905][T11019] syzkaller1: entered allmulticast mode [ 336.833515][ T6749] tipc: Subscription rejected, illegal request [ 336.853419][T11029] netlink: 'syz.3.1398': attribute type 10 has an invalid length. [ 336.864982][T11031] netlink: 48 bytes leftover after parsing attributes in process `syz.0.1399'. [ 336.874185][T11031] netlink: 'syz.0.1399': attribute type 1 has an invalid length. [ 336.876938][T11033] SET target dimension over the limit! [ 336.883898][T11029] bond0: (slave dummy0): Releasing backup interface [ 336.888098][T11033] SET target dimension over the limit! [ 336.899892][T11031] netlink: 20 bytes leftover after parsing attributes in process `syz.0.1399'. [ 336.900695][T11033] SET target dimension over the limit! [ 336.914268][T11029] team0: Port device dummy0 added [ 336.916309][T11033] SET target dimension over the limit! [ 336.926298][T11033] SET target dimension over the limit! [ 336.932420][T11033] SET target dimension over the limit! [ 336.939234][T11033] SET target dimension over the limit! [ 336.945557][T11033] SET target dimension over the limit! [ 336.951739][T11033] SET target dimension over the limit! [ 336.958250][T11033] SET target dimension over the limit! [ 337.061570][T11034] netlink: 'syz.3.1398': attribute type 10 has an invalid length. [ 337.099511][T11034] team0: Port device dummy0 removed [ 337.107705][T11034] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 337.253915][T11046] xt_hashlimit: size too large, truncated to 1048576 [ 337.393023][T11051] netlink: 'syz.4.1404': attribute type 21 has an invalid length. [ 337.400917][T11051] netlink: 36 bytes leftover after parsing attributes in process `syz.4.1404'. [ 337.427224][T11051] netlink: 6032 bytes leftover after parsing attributes in process `syz.4.1404'. [ 337.439225][T11051] lo: Caught tx_queue_len zero misconfig [ 337.445036][T11051] netem: unknown loss type 0 [ 337.451363][T11051] netem: change failed [ 337.698041][ T5645] block nbd0: Receive control failed (result -32) [ 337.709079][ T5640] block nbd0: Receive control failed (result -32) [ 337.725314][T11029] nbd0: detected capacity change from 0 to 63 [ 337.732317][T11050] netlink: 'syz.0.1403': attribute type 9 has an invalid length. [ 337.733759][ T8203] block nbd0: Dead connection, failed to find a fallback [ 337.750181][ T8203] block nbd0: shutting down sockets [ 337.756187][ T8203] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 337.766778][ T8203] Buffer I/O error on dev nbd0, logical block 0, async page read [ 337.775154][ T8203] I/O error, dev nbd0, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 337.784245][ T8203] Buffer I/O error on dev nbd0, logical block 1, async page read [ 337.793755][ T8203] I/O error, dev nbd0, sector 4 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 337.828427][ T8203] Buffer I/O error on dev nbd0, logical block 2, async page read [ 337.836760][ T8203] I/O error, dev nbd0, sector 6 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 337.845969][ T8203] Buffer I/O error on dev nbd0, logical block 3, async page read [ 337.854017][ T8203] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 337.863146][ T8203] Buffer I/O error on dev nbd0, logical block 0, async page read [ 337.871371][ T8203] I/O error, dev nbd0, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 337.901999][ T8203] Buffer I/O error on dev nbd0, logical block 1, async page read [ 337.910969][ T8203] I/O error, dev nbd0, sector 4 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 337.959127][ T8203] Buffer I/O error on dev nbd0, logical block 2, async page read [ 337.969820][ T8203] I/O error, dev nbd0, sector 6 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 337.981467][ T8203] Buffer I/O error on dev nbd0, logical block 3, async page read [ 337.991114][ T8203] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 338.000281][ T8203] Buffer I/O error on dev nbd0, logical block 0, async page read [ 338.022082][ T8203] I/O error, dev nbd0, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 338.031183][ T8203] Buffer I/O error on dev nbd0, logical block 1, async page read [ 338.059885][ T8203] ldm_validate_partition_table(): Disk read failed. [ 338.069887][ T8203] Dev nbd0: unable to read RDB block 0 [ 338.094366][ T8203] nbd0: unable to read partition table [ 338.115060][ T8203] ldm_validate_partition_table(): Disk read failed. [ 338.125655][ T8203] Dev nbd0: unable to read RDB block 0 [ 338.133635][ T8203] nbd0: unable to read partition table [ 338.590850][T11076] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1412'. [ 338.644418][T11080] [ 338.646830][T11080] ====================================================== [ 338.654044][T11080] WARNING: possible circular locking dependency detected [ 338.661109][T11080] syzkaller #0 Not tainted [ 338.665565][T11080] ------------------------------------------------------ [ 338.672613][T11080] syz.2.1414/11080 is trying to acquire lock: [ 338.678880][T11080] ffffffff8ea85520 (fs_reclaim){+.+.}-{0:0}, at: __kmalloc_cache_noprof+0x40/0x660 [ 338.688258][T11080] [ 338.688258][T11080] but task is already holding lock: [ 338.695651][T11080] ffff88805315e0e0 (k-sk_lock-AF_INET6/1){+.+.}-{0:0}, at: mptcp_subflow_create_socket+0x142/0x800 [ 338.706389][T11080] [ 338.706389][T11080] which lock already depends on the new lock. [ 338.706389][T11080] [ 338.716817][T11080] [ 338.716817][T11080] the existing dependency chain (in reverse order) is: [ 338.725844][T11080] [ 338.725844][T11080] -> #7 (k-sk_lock-AF_INET6/1){+.+.}-{0:0}: [ 338.734001][T11080] lock_sock_nested+0x41/0x100 [ 338.739406][T11080] mptcp_subflow_create_socket+0x142/0x800 [ 338.745748][T11080] __mptcp_nmpc_sk+0x155/0x790 [ 338.751064][T11080] mptcp_connect+0x71/0x830 [ 338.756099][T11080] __inet_stream_connect+0x25a/0xdd0 [ 338.761993][T11080] inet_stream_connect+0x66/0xa0 [ 338.767457][T11080] __sys_connect+0x312/0x450 [ 338.772660][T11080] __x64_sys_connect+0x7a/0x90 [ 338.778048][T11080] do_syscall_64+0x15f/0xf80 [ 338.783199][T11080] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 338.789647][T11080] [ 338.789647][T11080] -> #6 (sk_lock-AF_INET6){+.+.}-{0:0}: [ 338.797486][T11080] lock_sock_nested+0x41/0x100 [ 338.802785][T11080] inet_shutdown+0x6a/0x390 [ 338.807907][T11080] nbd_mark_nsock_dead+0x2e9/0x560 [ 338.813542][T11080] sock_shutdown+0x15e/0x260 [ 338.818656][T11080] nbd_clear_sock+0x24/0x170 [ 338.823770][T11080] nbd_config_put+0x2dd/0x580 [ 338.829003][T11080] nbd_genl_connect+0x19d5/0x1cf0 [ 338.834739][T11080] genl_family_rcv_msg_doit+0x22a/0x330 [ 338.840930][T11080] genl_rcv_msg+0x61c/0x7a0 [ 338.846225][T11080] netlink_rcv_skb+0x232/0x4b0 [ 338.851542][T11080] genl_rcv+0x28/0x40 [ 338.856180][T11080] netlink_unicast+0x75c/0x8e0 [ 338.861489][T11080] netlink_sendmsg+0x813/0xb40 [ 338.866804][T11080] ____sys_sendmsg+0x972/0x9f0 [ 338.872103][T11080] ___sys_sendmsg+0x2a5/0x360 [ 338.877316][T11080] __x64_sys_sendmsg+0x1bd/0x2a0 [ 338.882790][T11080] do_syscall_64+0x15f/0xf80 [ 338.888082][T11080] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 338.894604][T11080] [ 338.894604][T11080] -> #5 (&nsock->tx_lock){+.+.}-{4:4}: [ 338.902354][T11080] __mutex_lock+0x1a3/0x1550 [ 338.907588][T11080] nbd_queue_rq+0x37b/0x1100 [ 338.912801][T11080] blk_mq_dispatch_rq_list+0xa70/0x1910 [ 338.918871][T11080] __blk_mq_sched_dispatch_requests+0xdcc/0x1600 [ 338.925730][T11080] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 338.932241][T11080] blk_mq_run_hw_queue+0x348/0x4f0 [ 338.937984][T11080] blk_mq_dispatch_list+0xd16/0xe10 [ 338.943719][T11080] blk_mq_flush_plug_list+0x48d/0x570 [ 338.949626][T11080] __blk_flush_plug+0x3ed/0x4d0 [ 338.955008][T11080] __submit_bio+0x28d/0x580 [ 338.960053][T11080] submit_bio_noacct_nocheck+0x2f4/0xa40 [ 338.966220][T11080] block_read_full_folio+0x599/0x830 [ 338.972041][T11080] filemap_read_folio+0x137/0x3b0 [ 338.977631][T11080] do_read_cache_folio+0x358/0x590 [ 338.983305][T11080] read_part_sector+0xb6/0x2b0 [ 338.988617][T11080] adfspart_check_ICS+0xb1/0x960 [ 338.994104][T11080] bdev_disk_changed+0x817/0x1770 [ 338.999694][T11080] blkdev_get_whole+0x380/0x510 [ 339.005099][T11080] bdev_open+0x31e/0xd30 [ 339.009891][T11080] blkdev_open+0x470/0x610 [ 339.014831][T11080] do_dentry_open+0x785/0x14e0 [ 339.020141][T11080] vfs_open+0x3b/0x340 [ 339.024741][T11080] path_openat+0x2e08/0x3860 [ 339.029874][T11080] do_file_open+0x23e/0x4a0 [ 339.034996][T11080] do_sys_openat2+0x113/0x200 [ 339.040200][T11080] __x64_sys_openat+0x138/0x170 [ 339.045589][T11080] do_syscall_64+0x15f/0xf80 [ 339.050704][T11080] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 339.057122][T11080] [ 339.057122][T11080] -> #4 (&cmd->lock){+.+.}-{4:4}: [ 339.064451][T11080] __mutex_lock+0x1a3/0x1550 [ 339.069593][T11080] nbd_queue_rq+0xc6/0x1100 [ 339.074718][T11080] blk_mq_dispatch_rq_list+0xa70/0x1910 [ 339.080842][T11080] __blk_mq_sched_dispatch_requests+0xdcc/0x1600 [ 339.087708][T11080] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 339.094294][T11080] blk_mq_run_hw_queue+0x348/0x4f0 [ 339.099940][T11080] blk_mq_dispatch_list+0xd16/0xe10 [ 339.105689][T11080] blk_mq_flush_plug_list+0x48d/0x570 [ 339.111598][T11080] __blk_flush_plug+0x3ed/0x4d0 [ 339.116983][T11080] __submit_bio+0x28d/0x580 [ 339.122012][T11080] submit_bio_noacct_nocheck+0x2f4/0xa40 [ 339.128294][T11080] block_read_full_folio+0x599/0x830 [ 339.134108][T11080] filemap_read_folio+0x137/0x3b0 [ 339.139780][T11080] do_read_cache_folio+0x358/0x590 [ 339.145442][T11080] read_part_sector+0xb6/0x2b0 [ 339.150738][T11080] adfspart_check_ICS+0xb1/0x960 [ 339.156209][T11080] bdev_disk_changed+0x817/0x1770 [ 339.161770][T11080] blkdev_get_whole+0x380/0x510 [ 339.167270][T11080] bdev_open+0x31e/0xd30 [ 339.172045][T11080] blkdev_open+0x470/0x610 [ 339.177002][T11080] do_dentry_open+0x785/0x14e0 [ 339.182297][T11080] vfs_open+0x3b/0x340 [ 339.186992][T11080] path_openat+0x2e08/0x3860 [ 339.192138][T11080] do_file_open+0x23e/0x4a0 [ 339.197189][T11080] do_sys_openat2+0x113/0x200 [ 339.202402][T11080] __x64_sys_openat+0x138/0x170 [ 339.207781][T11080] do_syscall_64+0x15f/0xf80 [ 339.212912][T11080] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 339.219426][T11080] [ 339.219426][T11080] -> #3 (set->srcu){.+.+}-{0:0}: [ 339.226566][T11080] __synchronize_srcu+0xca/0x300 [ 339.232117][T11080] elevator_switch+0x1e8/0x7a0 [ 339.237409][T11080] elevator_change+0x2cc/0x450 [ 339.242704][T11080] elevator_set_default+0x36c/0x430 [ 339.248609][T11080] blk_register_queue+0x3e9/0x4e0 [ 339.254174][T11080] __add_disk+0x677/0xd50 [ 339.259064][T11080] add_disk_fwnode+0xfb/0x480 [ 339.264276][T11080] nbd_dev_add+0x72c/0xb50 [ 339.269223][T11080] nbd_init+0x168/0x1f0 [ 339.273910][T11080] do_one_initcall+0x250/0x870 [ 339.279285][T11080] do_initcall_level+0x104/0x190 [ 339.284759][T11080] do_initcalls+0x59/0xa0 [ 339.289622][T11080] kernel_init_freeable+0x2a6/0x3e0 [ 339.295350][T11080] kernel_init+0x1d/0x1d0 [ 339.300204][T11080] ret_from_fork+0x514/0xb70 [ 339.305404][T11080] ret_from_fork_asm+0x1a/0x30 [ 339.310799][T11080] [ 339.310799][T11080] -> #2 (&q->elevator_lock){+.+.}-{4:4}: [ 339.318626][T11080] __mutex_lock+0x1a3/0x1550 [ 339.323743][T11080] elevator_change+0x1b3/0x450 [ 339.329124][T11080] elevator_set_none+0xb5/0x140 [ 339.334508][T11080] blk_mq_update_nr_hw_queues+0x5e7/0x1a60 [ 339.340926][T11080] nbd_start_device+0x17f/0xb10 [ 339.346302][T11080] nbd_genl_connect+0x165b/0x1cf0 [ 339.351850][T11080] genl_family_rcv_msg_doit+0x22a/0x330 [ 339.357920][T11080] genl_rcv_msg+0x61c/0x7a0 [ 339.362946][T11080] netlink_rcv_skb+0x232/0x4b0 [ 339.368237][T11080] genl_rcv+0x28/0x40 [ 339.372746][T11080] netlink_unicast+0x75c/0x8e0 [ 339.378055][T11080] netlink_sendmsg+0x813/0xb40 [ 339.383439][T11080] ____sys_sendmsg+0x972/0x9f0 [ 339.388740][T11080] ___sys_sendmsg+0x2a5/0x360 [ 339.394035][T11080] __x64_sys_sendmsg+0x1bd/0x2a0 [ 339.399506][T11080] do_syscall_64+0x15f/0xf80 [ 339.404618][T11080] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 339.411038][T11080] [ 339.411038][T11080] -> #1 (&q->q_usage_counter(io)#49){++++}-{0:0}: [ 339.419654][T11080] blk_alloc_queue+0x546/0x680 [ 339.424971][T11080] __blk_mq_alloc_disk+0x197/0x390 [ 339.430604][T11080] nbd_dev_add+0x499/0xb50 [ 339.435601][T11080] nbd_init+0x168/0x1f0 [ 339.440295][T11080] do_one_initcall+0x250/0x870 [ 339.445586][T11080] do_initcall_level+0x104/0x190 [ 339.451072][T11080] do_initcalls+0x59/0xa0 [ 339.455952][T11080] kernel_init_freeable+0x2a6/0x3e0 [ 339.461693][T11080] kernel_init+0x1d/0x1d0 [ 339.466568][T11080] ret_from_fork+0x514/0xb70 [ 339.471689][T11080] ret_from_fork_asm+0x1a/0x30 [ 339.477071][T11080] [ 339.477071][T11080] -> #0 (fs_reclaim){+.+.}-{0:0}: [ 339.484463][T11080] __lock_acquire+0x15a5/0x2cf0 [ 339.489861][T11080] lock_acquire+0x106/0x350 [ 339.494908][T11080] fs_reclaim_acquire+0x71/0x100 [ 339.500388][T11080] __kmalloc_cache_noprof+0x40/0x660 [ 339.506210][T11080] ref_tracker_alloc+0x15a/0x4c0 [ 339.511684][T11080] get_net_track+0x16e/0x230 [ 339.516819][T11080] sk_net_refcnt_upgrade+0xb2/0x130 [ 339.522548][T11080] mptcp_subflow_create_socket+0x32b/0x800 [ 339.528882][T11080] __mptcp_nmpc_sk+0x155/0x790 [ 339.534168][T11080] mptcp_pm_nl_add_addr_doit+0xe25/0x1420 [ 339.540417][T11080] genl_family_rcv_msg_doit+0x22a/0x330 [ 339.546500][T11080] genl_rcv_msg+0x61c/0x7a0 [ 339.551532][T11080] netlink_rcv_skb+0x232/0x4b0 [ 339.556827][T11080] genl_rcv+0x28/0x40 [ 339.561334][T11080] netlink_unicast+0x75c/0x8e0 [ 339.566628][T11080] netlink_sendmsg+0x813/0xb40 [ 339.572531][T11080] ____sys_sendmsg+0x972/0x9f0 [ 339.577832][T11080] ___sys_sendmsg+0x2a5/0x360 [ 339.583141][T11080] __x64_sys_sendmsg+0x1bd/0x2a0 [ 339.589011][T11080] do_syscall_64+0x15f/0xf80 [ 339.594123][T11080] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 339.600542][T11080] [ 339.600542][T11080] other info that might help us debug this: [ 339.600542][T11080] [ 339.610854][T11080] Chain exists of: [ 339.610854][T11080] fs_reclaim --> sk_lock-AF_INET6 --> k-sk_lock-AF_INET6/1 [ 339.610854][T11080] [ 339.624080][T11080] Possible unsafe locking scenario: [ 339.624080][T11080] [ 339.631534][T11080] CPU0 CPU1 [ 339.636917][T11080] ---- ---- [ 339.642282][T11080] lock(k-sk_lock-AF_INET6/1); [ 339.647167][T11080] lock(sk_lock-AF_INET6); [ 339.654196][T11080] lock(k-sk_lock-AF_INET6/1); [ 339.661840][T11080] lock(fs_reclaim); [ 339.665832][T11080] [ 339.665832][T11080] *** DEADLOCK *** [ 339.665832][T11080] [ 339.673992][T11080] 4 locks held by syz.2.1414/11080: [ 339.679192][T11080] #0: ffffffff8fe3fac8 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 [ 339.687391][T11080] #1: ffffffff8fe3f900 (genl_mutex){+.+.}-{4:4}, at: genl_rcv_msg+0x10b/0x7a0 [ 339.696374][T11080] #2: ffff888057fa9be0 (msk_lock-AF_INET6){+.+.}-{0:0}, at: mptcp_pm_nl_add_addr_doit+0xdc7/0x1420 [ 339.707184][T11080] #3: ffff88805315e0e0 (k-sk_lock-AF_INET6/1){+.+.}-{0:0}, at: mptcp_subflow_create_socket+0x142/0x800 [ 339.718392][T11080] [ 339.718392][T11080] stack backtrace: [ 339.724282][T11080] CPU: 0 UID: 0 PID: 11080 Comm: syz.2.1414 Not tainted syzkaller #0 PREEMPT(full) [ 339.724302][T11080] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 339.724313][T11080] Call Trace: [ 339.724320][T11080] [ 339.724328][T11080] dump_stack_lvl+0xe8/0x150 [ 339.724347][T11080] print_circular_bug+0x2e1/0x300 [ 339.724371][T11080] check_noncircular+0x12e/0x150 [ 339.724394][T11080] __lock_acquire+0x15a5/0x2cf0 [ 339.724413][T11080] ? check_noncircular+0xda/0x150 [ 339.724435][T11080] ? lockdep_unlock+0x5d/0xd0 [ 339.724449][T11080] ? __lock_acquire+0x146e/0x2cf0 [ 339.724468][T11080] ? __kmalloc_cache_noprof+0x40/0x660 [ 339.724497][T11080] lock_acquire+0x106/0x350 [ 339.724513][T11080] ? __kmalloc_cache_noprof+0x40/0x660 [ 339.724540][T11080] fs_reclaim_acquire+0x71/0x100 [ 339.724562][T11080] ? __kmalloc_cache_noprof+0x40/0x660 [ 339.724585][T11080] __kmalloc_cache_noprof+0x40/0x660 [ 339.724612][T11080] ? ref_tracker_alloc+0x15a/0x4c0 [ 339.724638][T11080] ? rcu_is_watching+0x15/0xb0 [ 339.724662][T11080] ref_tracker_alloc+0x15a/0x4c0 [ 339.724690][T11080] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 339.724715][T11080] ? ref_tracker_free+0x522/0x840 [ 339.724742][T11080] ? __pfx_ref_tracker_free+0x10/0x10 [ 339.724767][T11080] ? sk_net_refcnt_upgrade+0x8c/0x130 [ 339.724796][T11080] ? mptcp_subflow_create_socket+0x32b/0x800 [ 339.724816][T11080] ? __mptcp_nmpc_sk+0x155/0x790 [ 339.724837][T11080] ? mptcp_pm_nl_add_addr_doit+0xe25/0x1420 [ 339.724864][T11080] ? genl_family_rcv_msg_doit+0x22a/0x330 [ 339.724888][T11080] ? net_passive_dec+0x177/0x250 [ 339.724909][T11080] ? __pfx_net_passive_dec+0x10/0x10 [ 339.724930][T11080] get_net_track+0x16e/0x230 [ 339.724954][T11080] sk_net_refcnt_upgrade+0xb2/0x130 [ 339.724979][T11080] mptcp_subflow_create_socket+0x32b/0x800 [ 339.724999][T11080] ? __pfx_mptcp_subflow_create_socket+0x10/0x10 [ 339.725018][T11080] ? do_raw_spin_lock+0x12b/0x2f0 [ 339.725045][T11080] ? lock_sock_nested+0x6a/0x100 [ 339.725064][T11080] __mptcp_nmpc_sk+0x155/0x790 [ 339.725083][T11080] ? __pfx___mptcp_nmpc_sk+0x10/0x10 [ 339.725100][T11080] ? mptcp_pm_nl_add_addr_doit+0xdc7/0x1420 [ 339.725124][T11080] ? __local_bh_enable_ip+0xd0/0x130 [ 339.725142][T11080] mptcp_pm_nl_add_addr_doit+0xe25/0x1420 [ 339.725170][T11080] ? __pfx_mptcp_pm_nl_add_addr_doit+0x10/0x10 [ 339.725206][T11080] ? genl_family_rcv_msg_attrs_parse+0x20b/0x2f0 [ 339.725224][T11080] ? genl_family_rcv_msg_attrs_parse+0x265/0x2f0 [ 339.725253][T11080] genl_family_rcv_msg_doit+0x22a/0x330 [ 339.725271][T11080] ? __asan_memcpy+0x40/0x70 [ 339.725292][T11080] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 339.725314][T11080] ? bpf_lsm_capable+0x9/0x20 [ 339.725330][T11080] ? security_capable+0x7e/0x2c0 [ 339.725351][T11080] genl_rcv_msg+0x61c/0x7a0 [ 339.725370][T11080] ? __pfx_genl_rcv_msg+0x10/0x10 [ 339.725387][T11080] ? __pfx_mptcp_pm_nl_add_addr_doit+0x10/0x10 [ 339.725411][T11080] ? __pfx_ref_tracker_free+0x10/0x10 [ 339.725436][T11080] netlink_rcv_skb+0x232/0x4b0 [ 339.725459][T11080] ? __pfx_genl_rcv_msg+0x10/0x10 [ 339.725477][T11080] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 339.725510][T11080] ? down_read+0x270/0x2e0 [ 339.725526][T11080] ? genl_rcv+0xd/0x40 [ 339.725542][T11080] genl_rcv+0x28/0x40 [ 339.725557][T11080] netlink_unicast+0x75c/0x8e0 [ 339.725582][T11080] netlink_sendmsg+0x813/0xb40 [ 339.725608][T11080] ? __pfx_netlink_sendmsg+0x10/0x10 [ 339.725633][T11080] ? aa_sock_msg_perm+0xf1/0x1b0 [ 339.725654][T11080] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 339.725677][T11080] ____sys_sendmsg+0x972/0x9f0 [ 339.725702][T11080] ? __might_fault+0xaf/0x130 [ 339.725724][T11080] ? __pfx_____sys_sendmsg+0x10/0x10 [ 339.725751][T11080] ? import_iovec+0x73/0xa0 [ 339.725775][T11080] ___sys_sendmsg+0x2a5/0x360 [ 339.725798][T11080] ? __lock_acquire+0x6b5/0x2cf0 [ 339.725816][T11080] ? __pfx____sys_sendmsg+0x10/0x10 [ 339.725842][T11080] ? futex_wait+0x2a2/0x390 [ 339.725874][T11080] ? __fget_files+0x2a/0x420 [ 339.725892][T11080] ? __fget_files+0x3a0/0x420 [ 339.725914][T11080] __x64_sys_sendmsg+0x1bd/0x2a0 [ 339.725939][T11080] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 339.725966][T11080] ? rcu_is_watching+0x15/0xb0 [ 339.725988][T11080] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 339.726004][T11080] do_syscall_64+0x15f/0xf80 [ 339.726019][T11080] ? trace_irq_disable+0x3b/0x140 [ 339.726043][T11080] ? clear_bhb_loop+0x40/0x90 [ 339.726061][T11080] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 339.726076][T11080] RIP: 0033:0x7fe86359ce59 [ 339.726091][T11080] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 339.726106][T11080] RSP: 002b:00007fe864377028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 339.726123][T11080] RAX: ffffffffffffffda RBX: 00007fe863815fa0 RCX: 00007fe86359ce59 [ 339.726135][T11080] RDX: 0000000000000000 RSI: 0000200000000400 RDI: 0000000000000005 [ 339.726146][T11080] RBP: 00007fe863632d6f R08: 0000000000000000 R09: 0000000000000000 [ 339.726156][T11080] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 339.726166][T11080] R13: 00007fe863816038 R14: 00007fe863815fa0 R15: 00007ffef0f9fca8 [ 339.726184][T11080] [ 340.321684][T11088] A link change request failed with some changes committed already. Interface bridge0 may have been left with an inconsistent configuration, please check. [ 347.494735][ C1] ip6_tunnel: ip6gre2 xmit: Local address not yet configured!