last executing test programs: 8.36099333s ago: executing program 2 (id=3693): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f0000000900)=ANY=[@ANYBLOB="fc00000019000100000000000000000020010000000000000000000000000000ac1414aa00000000000000000000000000000000000000000a00000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000000000000a900000000000000000000000000000000000000000000000000000000000000ffffffffffffffff000000000000000000000000000000000000000000000000000a000800000000000000000080400000000000000000080000000000000000000000000000000044000500ac1414aa000000000000000000000000000080003c00000000000000ffffffff0000000000000000000000000000000000030000000000000000000000000000f9b0b47239265126c92580194d90a4b786f1f582844b70b655d06d469d435f855ed6ad92102117162dcdcbd746f8d7900bdeb224"], 0xfc}}, 0x0) r1 = socket$inet6_sctp(0xa, 0x801, 0x84) sendmmsg$inet(r1, &(0x7f0000000d00)=[{{&(0x7f0000000040)={0x2, 0x4e21, @rand_addr=0x64010101}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000080)='e', 0x1}], 0x1}}, {{&(0x7f0000000880)={0x2, 0x4e23, @rand_addr=0x64010105}, 0x10, &(0x7f0000000a80)=[{&(0x7f00000008c0)='K', 0x1}], 0x1}}], 0x2, 0x4000) shutdown(r1, 0x1) setsockopt(r1, 0x84, 0x7d, &(0x7f00000002c0)="aa8e0cf56164be5b", 0x8) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r3, 0x6, 0x13, &(0x7f0000000180)=0x100000001, 0x4) connect$inet6(r3, &(0x7f0000000300)={0xa, 0x4e24, 0x6bb, @ipv4={'\x00', '\xff\xff', @local}, 0x5}, 0x1c) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c0000004600070128bd700000010000017c0f8707000480362c"], 0x1c}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) openat$ppp(0xffffffffffffff9c, &(0x7f0000000100), 0x40, 0x0) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r5, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={'\x00', '\xff\xff', @empty}, 0xf}, 0x1c) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(r6, 0x29, 0x1a, &(0x7f0000001a80)=0x5, 0x4) bind$inet6(r6, &(0x7f0000000140)={0xa, 0x4e22}, 0x1c) bind$inet6(0xffffffffffffffff, 0x0, 0x0) r7 = socket$kcm(0x10, 0x2, 0x4) sendmsg$kcm(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000280)="89000000120081ae08060cdc030000007f03e3f7000000006ee2ffca1b1f0000000004c00e72f750375ed08a56331dbf9ed7815e381ad6e747033a0093b837dc6cc01e32efaec8c7a6ec00120c11014002080c00bdad446b9bbc7a46e3988285dcdf12f21308f868fece01955fed0009d78f0a947ee2b49e33538afa8af92347514f0b56a20ff27fff", 0x89}], 0x1}, 0x4040) setsockopt$inet6_tcp_TCP_ULP(r3, 0x6, 0x1f, &(0x7f0000000540), 0x3) r8 = socket$inet6_sctp(0xa, 0x801, 0x84) sendto$inet6(r8, &(0x7f00000005c0)="f5", 0x1, 0x0, &(0x7f0000000240)={0xa, 0x4e20, 0xfffffffc, @rand_addr=' \x01\x00'}, 0x1c) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r8, 0x84, 0x7c, &(0x7f00000002c0)={0x0, 0x0, 0x4}, 0x8) setsockopt$inet6_tcp_TLS_TX(r3, 0x11a, 0x1, &(0x7f00000004c0)=@gcm_256={{0x303, 0x3a}, "56db7a2700f81000", "a8ef1a3a33071799b7bbebfa6dc371290d0e3808802000", "336819df", "4008000000008700"}, 0x38) sendto$inet6(r3, &(0x7f0000000000)="442e2717bdbd39f5d2185ec9050d681a1038f4288cdf755974233383e991deafe13ec24721ef116fda212dd27e0721c58186bfbe1d785b388574284f5aa4690e75ef85fed10d5ea68101b561eceaa0819d3a08dd490e3e7329bbd7ae3046144c707d3711683e31c48321a00eb417197763febc793fbeb3fbe48b0ad4c53b53a0310a82a3b056fba67949c02123fef77ba70ad4fee04ed92b740fde61d4772679940150e8983afa27d5283cdccaaa86d51aa1e3fdc06ffdd7533cf66aa908e64d866539a7f5ebf84174207b3fa5f28033e38439c6a1fe21e545db15c52eb05df08c8a7ac656471e8fa1ba9733abd75f991a", 0xf1, 0x40, 0x0, 0x0) sendmsg$nl_xfrm(r2, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000007c0)=@migrate={0xec, 0x21, 0x1, 0x0, 0x4, {{@in6=@mcast1, @in6=@private2, 0x0, 0x5, 0x0, 0x0, 0xa}}, [@migrate={0x9c, 0x11, [{@in6=@remote, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, @in6=@rand_addr=' \x01\x00', @in6=@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x6c, 0x2, 0x0, 0x3501, 0x2, 0x2}, {@in6=@private1={0xfc, 0x1, '\x00', 0x1}, @in6=@dev={0xfe, 0x80, '\x00', 0x35}, @in=@local, @in6=@private2={0xfc, 0x2, '\x00', 0x1}, 0x3c, 0x0, 0x0, 0x0, 0xa, 0xa}]}]}, 0xec}}, 0x0) 8.242627479s ago: executing program 2 (id=3695): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r0, 0x84, 0x8, &(0x7f0000000000)=0x8, 0x4) r1 = socket$nl_crypto(0x10, 0x3, 0x15) setsockopt$MRT_ADD_MFC_PROXY(0xffffffffffffffff, 0x0, 0xd2, &(0x7f0000000040)={@dev={0xac, 0x14, 0x14, 0x15}, @empty, 0x2, "4f6fb4d1af0f724e6118ecfbac0200843af29708e2355d0e7ea0c543011a00", 0xfffffffc, 0x4, 0x81, 0x8}, 0x3c) r2 = socket$kcm(0x10, 0x2, 0x10) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000070000040900010073797a30000000009c000000090a010400000000000000000700000308000a40000000000900020073797a30000000000900010073797a3000000000080005400000000d58001280200001800e000100636f6e6e6c696d69740000000c0002800800014000000008200001800e000100636f6e6e6c696d69740000000c00028008000140000000001400017b090001006cdbf80789f3f947dd000280080003"], 0xe4}, 0x1, 0x0, 0x0, 0x8001}, 0x20050840) sendmsg$kcm(r2, &(0x7f0000000000)={0x0, 0xd18c9b25, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f030041000b05d25a806c8c6394f90324fc60100000000a000200053582c137153e3704020180fc5409000c00", 0x33fe0}], 0x1}, 0x0) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000380)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000340)={&(0x7f0000000200)=@allocspi={0x120, 0x16, 0x400, 0x70bd2d, 0x25dfdbfc, {{{@in=@initdev={0xac, 0x1e, 0x0, 0x0}, @in6=@dev={0xfe, 0x80, '\x00', 0x25}, 0x4e21, 0x0, 0x4e23, 0x6, 0x2, 0x80, 0xa0, 0x67}, {@in6=@dev={0xfe, 0x80, '\x00', 0x32}, 0x4d6, 0x2b}, @in6=@remote, {0xd, 0xfffffffffffffffd, 0x9, 0x0, 0x4, 0x9, 0x100, 0x4}, {0x4, 0x4, 0x7, 0x1}, {0xb435, 0xd380, 0xf751}, 0x70bd27, 0x0, 0x2, 0x2, 0x6, 0x80}, 0x3, 0x200}, [@XFRMA_SET_MARK_MASK={0x8, 0x1e, 0xfcb}, @mark={0xc, 0x15, {0x35075c, 0x7}}, @srcaddr={0x14, 0xd, @in=@private=0xa010100}]}, 0x120}, 0x1, 0x0, 0x0, 0x4000}, 0x5) sendmsg$nl_crypto(r1, &(0x7f00000009c0)={0x0, 0x0, &(0x7f0000000980)={&(0x7f0000000100)=ANY=[@ANYBLOB="f0000000120021002dbd7000fcdbdf2561656769733132386c00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200000002c00000000000000000000080001000400000005000100"], 0xf0}}, 0x0) 7.553722809s ago: executing program 2 (id=3696): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=@can_newroute={0x44, 0x18, 0x1, 0x70bd29, 0x25dfdbfe, {0x1d, 0x1, 0x5}, [@CGW_MOD_UID={0x8, 0xe, 0xffffffffffffffff}, @CGW_DST_IF={0x8}, @CGW_MOD_SET={0x15, 0x4, {{{0x4}, 0x3, 0x3, 0x0, 0x0, "918a76e1efa19e91"}, 0x5}}, @CGW_SRC_IF={0x8}]}, 0x44}}, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r2, 0x800448d2, &(0x7f0000000200)) r3 = socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000002c0)) r4 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0xc0802, 0x0) ioctl$PPPIOCNEWUNIT(r4, 0xc004743e, &(0x7f00000000c0)) ioctl$PPPIOCSMAXCID(r4, 0x40047451, &(0x7f0000000200)=0x8) ioctl$PPPIOCSFLAGS1(r4, 0x40047459, &(0x7f0000000100)=0x2000004) pwritev(r4, &(0x7f0000000080)=[{&(0x7f00000003c0)}], 0x1, 0x3e42, 0x407ff) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) socket$nl_netfilter(0x10, 0x3, 0xc) close(0x3) sendmsg$nl_xfrm(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000840)=ANY=[@ANYBLOB="fc0000001900010000000000fcdbdf2500000000000000000000000000000000fe8000000002000000000000000000bb00000000000000000200000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000000000000004000000000000000000000000000000000000000000000000000000000000000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000001000000000000004400050000000000000000000000000000000000000000022b0000000a000000fe8000000000000000000000000000aa0000000004"], 0xfc}, 0x1, 0x0, 0x0, 0x20008000}, 0x0) r6 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r6, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x13}}, 0x10) setsockopt$sock_int(r6, 0x1, 0x6, &(0x7f0000000000)=0x4, 0x4) connect$inet(r6, &(0x7f0000000040)={0x2, 0x0, @broadcast}, 0x10) sendmmsg$inet(r6, &(0x7f0000004d00)=[{{0x0, 0x6000, 0x0, 0x0, 0x0, 0x0, 0x30000}}], 0x400000000000284, 0xf00) sendmsg$ETHTOOL_MSG_TSINFO_GET(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000500)=ANY=[@ANYBLOB="18000000", @ANYRES16=0x0, @ANYBLOB="7575b852"], 0x18}, 0x1, 0x0, 0x0, 0x24004041}, 0x4008000) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="600000000206010800000000000000000700000114000780080011400000008b05001500ff0000000500010006000000050005000200000005000400020000000900020073797a300000000011000300686173683a69702c6d61726b00000000969bfd63b0ac6734e2b09054df57c455ea6cd069824502bc9bfe04deb754d844ae0d77421738daf53dd39d876f7fe41353b82d2f9dcf05fa4c47959fb58667eca8e96a259627d8197e3e53ffce218652595e7c41832d449d430edb70565129f3267d447da4f79f3daf6b3a7e826d8f27d501fd1ccc2d097169a37fb45aac71b9e5c05ac33aa380ca372da6dcb9cca81326b2829fbf8b9f1cf4af603a7280e1bb5b5a4782055d3719835f5abc148d254868fff2e896c29c20ed18d4e7c8257a9d7dc2de7efc98ea81e3ca408df43c6a3131"], 0x60}, 0x1, 0x0, 0x0, 0x20008804}, 0x0) 6.141654641s ago: executing program 2 (id=3704): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000000c0)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128-generic\x00'}, 0x58) r1 = socket$inet_udp(0x2, 0x2, 0x0) socket$netlink(0x10, 0x3, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_RES_MR_GET(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000340)=ANY=[@ANYBLOB="200000001a140100000000000000000008000300000000000800", @ANYRES64=r2], 0x20}, 0x1, 0x0, 0x0, 0x4000015}, 0x0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000000)={'filter\x00', 0xb001, 0x4, 0x3c8, 0x1f8, 0x110, 0x0, 0x2e0, 0x2e0, 0x2e0, 0x7fffffe, 0x0, {[{{@arp={@local, @empty, 0x0, 0x0, 0x0, 0x2, {@empty, {[0x0, 0x0, 0x92aa842669e14d00]}}, {@mac=@random="f135419f37d9", {[0x0, 0xff]}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'pimreg\x00', 'veth0_to_bond\x00'}, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@empty, @mac, @initdev={0xac, 0x1e, 0x0, 0x0}, @local, 0x2, 0x1}}}, {{@arp={@dev={0xac, 0x14, 0x14, 0x3e}, @empty, 0x0, 0x0, 0x0, 0xd, {@mac=@link_local}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth0_to_team\x00', 'ip6tnl0\x00', {}, {0xff}}, 0xc0, 0xe8}, @unspec=@CLASSIFY={0x28}}, {{@arp={@dev={0xac, 0x14, 0x14, 0x11}, @loopback, 0xffffff00, 0xffffffff, 0x6, 0x2d, {@empty, {[0x0, 0x0, 0xff]}}, {@mac=@multicast, {[0xff, 0xff, 0x0, 0x0, 0xff]}}, 0x4b, 0x5, 0x10, 0xe, 0x3ff, 0x3, 'bond_slave_1\x00', 'hsr0\x00', {}, {0xff}, 0x0, 0x2f6}, 0xc0, 0xe8}, @unspec=@NFQUEUE3={0x28}}], {{'\x00', 0xc0, 0xe8}, {0x28}}}}, 0x418) r4 = accept4(r0, 0x0, 0x0, 0x80000) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000200)="ad00"/16, 0x10) sendmmsg$unix(r4, &(0x7f0000003dc0)=[{{&(0x7f0000000000)=@file={0x0, './file0\x00'}, 0x6e, 0x0, 0x0, 0x0, 0x0, 0x9802}}, {{&(0x7f0000000280)=@file={0x0, './file0\x00'}, 0x6e, 0x0}}], 0x299, 0xfdef) r5 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_NO_ENOBUFS(r5, 0x10e, 0xc, &(0x7f0000000340)=0x6, 0x4) sendmsg$nl_route(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000680)=ANY=[@ANYBLOB="24000000120001000000ff7f00000000800000f3"], 0x24}}, 0x0) 5.951590651s ago: executing program 3 (id=3705): syz_emit_ethernet(0x16, &(0x7f0000000340)=ANY=[@ANYBLOB="aaaaaaaaaaaa00000000000088a8d0ff8100000088fb536e79286c65b9581c049de6db040d9c53dccd543caa0cddc51e59b417a5333348a87eaba842bfddfa287c42e5f08b80f985614f5586397595bad04fccb1cf47daf23c5ce9ff6d3c8be5c1878bb9b838feca12a75ea37ea8dd9e541741dd2fd1ca70b17e72"], 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="22000000040000001000000012"], 0x48) r1 = bpf$ITER_CREATE(0x21, &(0x7f0000000000), 0x8) getsockname$packet(0xffffffffffffffff, &(0x7f0000000140)={0x11, 0x0, 0x0}, &(0x7f0000000280)=0x14) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) ioctl$FS_IOC_RESVSP(r3, 0x40305828, &(0x7f0000000140)={0x0, 0x0, 0x9, 0xf9}) write$cgroup_int(r3, &(0x7f0000000200)=0xf, 0x12) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000002c0)={0x3, 0x4, 0x4, 0xa, 0x0, r1, 0x8, '\x00', r2, r3, 0x0, 0x3, 0x4}, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000180)={{r0, 0xffffffffffffffff}, &(0x7f0000000080), &(0x7f00000001c0)=r0}, 0x20) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f00000000c0)={r0}, 0x4) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000001c0)={0x3, 0x8, &(0x7f0000000100)=@framed={{0x18, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000}, [@func={0x85, 0x0, 0x1, 0x0, 0x3}, @map_fd={0x18, 0x1, 0x1, 0x0, r4}, @exit={0x95, 0x0, 0x7b00}, @call={0x85, 0x0, 0x0, 0x13}]}, &(0x7f0000000040)='GPL\x00', 0x2, 0x0, 0x0, 0x41000}, 0x94) syz_emit_ethernet(0x16, &(0x7f0000000340)=ANY=[@ANYBLOB="aaaaaaaaaaaa00000000000088a8d0ff8100000088fb536e79286c65b9581c049de6db040d9c53dccd543caa0cddc51e59b417a5333348a87eaba842bfddfa287c42e5f08b80f985614f5586397595bad04fccb1cf47daf23c5ce9ff6d3c8be5c1878bb9b838feca12a75ea37ea8dd9e541741dd2fd1ca70b17e72"], 0x0) (async) socket$nl_netfilter(0x10, 0x3, 0xc) (async) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="22000000040000001000000012"], 0x48) (async) bpf$ITER_CREATE(0x21, &(0x7f0000000000), 0x8) (async) getsockname$packet(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000280)=0x14) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) (async) ioctl$FS_IOC_RESVSP(r3, 0x40305828, &(0x7f0000000140)={0x0, 0x0, 0x9, 0xf9}) (async) write$cgroup_int(r3, &(0x7f0000000200)=0xf, 0x12) (async) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000002c0)={0x3, 0x4, 0x4, 0xa, 0x0, r1, 0x8, '\x00', r2, r3, 0x0, 0x3, 0x4}, 0x50) (async) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000180)={{r0}, &(0x7f0000000080), &(0x7f00000001c0)=r0}, 0x20) (async) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f00000000c0)={r0}, 0x4) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000001c0)={0x3, 0x8, &(0x7f0000000100)=@framed={{0x18, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000}, [@func={0x85, 0x0, 0x1, 0x0, 0x3}, @map_fd={0x18, 0x1, 0x1, 0x0, r4}, @exit={0x95, 0x0, 0x7b00}, @call={0x85, 0x0, 0x0, 0x13}]}, &(0x7f0000000040)='GPL\x00', 0x2, 0x0, 0x0, 0x41000}, 0x94) (async) 5.950275123s ago: executing program 2 (id=3707): setsockopt$WPAN_SECURITY_LEVEL(0xffffffffffffffff, 0x0, 0x2, &(0x7f0000000100)=0xfffffffe, 0x4) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, &(0x7f00000004c0)=',8Z', 0x3) r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r1, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000040)=0x14) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="0000000000004a641c0012000c000100626f6e64000000000c0002000800010006"], 0x3c}, 0x1, 0x0, 0x0, 0x8d0}, 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c00000010001fff0000000001000000000000d7", @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800a000100767863616e0000000400028008000a00", @ANYRES32=r2], 0x3c}, 0x1, 0x0, 0x0, 0x40000}, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket(0x1, 0x803, 0x0) socket$netlink(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x8) sendmsg$IPVS_CMD_SET_INFO(r3, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socket$inet6_sctp(0xa, 0x1, 0x84) r5 = socket$packet(0x11, 0x3, 0x300) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x180, 0x0) close(r7) socket$nl_route(0x10, 0x3, 0x0) ioctl$SIOCSIFHWADDR(r7, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r8 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000440)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfb, {0x0, 0x0, 0x0, r9, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x6361, 0x5, 0xffffffff, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) r10 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r10, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)=@getqdisc={0x30, 0x26, 0x800, 0x70bd2d, 0x25dfdbfd, {0x0, 0x0, 0x0, r4, {0xffe0, 0xfff1}, {0x5}, {0x2, 0xfff2}}, [{0x4}, {0x4}, {0x4}]}, 0x30}, 0x1, 0x0, 0x0, 0x404c84c}, 0x400c000) setsockopt$packet_int(r5, 0x107, 0xf, &(0x7f0000000100)=0x207, 0x4) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000040)={'syzkaller0\x00', 0x0}) sendto$packet(r5, &(0x7f00000002c0)="05031620d3fc140000004788031c09102c28", 0xfce0, 0x4, &(0x7f0000000140)={0x11, 0x0, r11, 0x1, 0x0, 0x6, @multicast}, 0x14) 5.778487346s ago: executing program 3 (id=3708): r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000380)=[{&(0x7f0000000000)="d80000001c0081054e81f782db44b904021d08040e000000100d10a118000c000600142603600e1208000f0000810401a8001600200001400300000803600cfab94dcf5c0461c1d67f6f94007134cf6ee0800080e408e8d8ef52a98516277ce06ebace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775730d16a4683f5aeb4edbb57a5025ccca9e00360db70100000040fad95667e006dcdf63951f215ce3bb9ad8099639cace81ed0bffec193e2a9ecbee5de6ccd4d6e4ed6f3d93452a92954b43370e970189", 0xd8}], 0x1, 0x0, 0x0, 0x7400}, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xe8001, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x2}) ioctl$TUNSETOFFLOAD(r1, 0x400454c9, 0xba98575a95aeb70d) ioctl$TUNGETIFF(r1, 0x800454d2, &(0x7f0000000000)={'dvmrp0\x00'}) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r2, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)=[{&(0x7f0000000200)={0x18, 0x76, 0xc19, 0x0, 0x0, "", [@nested={0x5, 0xd, 0x0, 0x1, [@generic="14"]}]}, 0x18}], 0x1, 0x0, 0x0, 0x8000040}, 0x44) r3 = socket$nl_route(0x10, 0x3, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000c80)={'veth1_virt_wifi\x00', 0x0}) openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x40, 0x0) sendmsg$nl_route_sched(r3, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000001240)=@newqdisc={0x45c, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x4, {0x0, 0x0, 0x0, r4, {0x0, 0x9}, {0xffff, 0xffff}, {0x0, 0x10}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x430, 0x2, [@TCA_TBF_PARMS={0x28, 0x1, {{0x0, 0x0, 0x0, 0x2, 0x6}, {0x1, 0x0, 0x0, 0x0, 0x2, 0x8000}}}, @TCA_TBF_PTAB={0x404, 0x3, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x8d, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x2, 0xfffffffd, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x10001, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20, 0x400, 0xf, 0x0, 0x5, 0x5, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x3, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe, 0x0, 0x100000, 0x3, 0x0, 0x8, 0x0, 0x3, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1fffffc, 0x0, 0x0, 0x0, 0x0, 0x4, 0x4, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x2, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2]}]}}]}, 0x45c}}, 0x20004000) 5.663306312s ago: executing program 4 (id=3709): unshare(0x20000100) r0 = socket$phonet(0x23, 0x2, 0x1) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x12, r0, 0x1000) socket$netlink(0x10, 0x3, 0xf) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="240000002000014d3446e0b246f0c74008f2bd7000ffdbdf2502"], 0x24}, 0x1, 0x0, 0x0, 0x240480d4}, 0x0) 5.503867364s ago: executing program 4 (id=3711): r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040), 0x801, 0x0) write$rfkill(r0, &(0x7f0000000080)={0x0, 0x1, 0x3, 0x3, 0xfd}, 0x8) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$NL80211_CMD_ADD_NAN_FUNCTION(r1, &(0x7f0000000300)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f00000002c0)={&(0x7f0000000100)={0x194, r2, 0x800, 0x70bd2d, 0x25dfdbfe, {{}, {@void, @val={0xc, 0x99, {0x8, 0x6a}}}}, [@NL80211_ATTR_NAN_FUNC={0x138, 0xf0, 0x0, 0x1, [@NL80211_NAN_FUNC_PUBLISH_TYPE={0x5, 0x3, 0x5}, @NL80211_NAN_FUNC_TYPE={0x5, 0x1, 0x1}, @NL80211_NAN_FUNC_SERVICE_INFO={0x47, 0xb, "cf0f6856dc0b8b4affa6fdb86995c080a2e13cdbd7ec86dec8ed0a786f83e212a57a213e339e31a6feb84841e7ff8c62865e182f55f7cbdcd294eca3418948bf907193"}, @NL80211_NAN_FUNC_SRF={0x6c, 0xc, 0x0, 0x1, [@NL80211_NAN_SRF_INCLUDE={0x4}, @NL80211_NAN_SRF_MAC_ADDRS={0x58, 0x4, 0x0, 0x1, [{0xa, 0x6, @broadcast}, {0xa, 0x6, @broadcast}, {0xa, 0x6, @device_b}, {0xa, 0x6, @device_b}, {0xa, 0x6, @device_b}, {0xa}, {0xa, 0x6, @device_b}]}, @NL80211_NAN_SRF_INCLUDE={0x4}, @NL80211_NAN_SRF_BF_IDX={0x5, 0x3, 0x7}]}, @NL80211_NAN_FUNC_RX_MATCH_FILTER={0x44, 0xd, 0x0, 0x1, [{0x40, 0x0, "8cae57ef7dae245be24d3777d6e82c6b20f7d5056822febec4a8f89e7b185d9869bdb930f77e6453214a4c3f03a531b1ef6f9e29e441f1eaeda63178"}]}, @NL80211_NAN_FUNC_PUBLISH_BCAST={0x4}, @NL80211_NAN_FUNC_TTL={0x8, 0xa, 0x44db}, @NL80211_NAN_FUNC_TTL={0x8, 0xa, 0x8}, @NL80211_NAN_FUNC_FOLLOW_UP_DEST={0xa}, @NL80211_NAN_FUNC_SERVICE_ID={0xa, 0x2, "49b965f97371"}]}, @NL80211_ATTR_NAN_FUNC={0x3c, 0xf0, 0x0, 0x1, [@NL80211_NAN_FUNC_TERM_REASON={0x5, 0x10, 0xd}, @NL80211_NAN_FUNC_PUBLISH_BCAST={0x4}, @NL80211_NAN_FUNC_SERVICE_ID={0xa, 0x2, "65b117aefd2c"}, @NL80211_NAN_FUNC_TYPE={0x5}, @NL80211_NAN_FUNC_CLOSE_RANGE={0x4}, @NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID={0x5, 0x7, 0x6}, @NL80211_NAN_FUNC_TTL={0x8, 0xa, 0x9}, @NL80211_NAN_FUNC_CLOSE_RANGE={0x4}]}]}, 0x194}, 0x1, 0x0, 0x0, 0x4080}, 0x4000881) write$rfkill(r0, &(0x7f0000000340)={0x6, 0x0, 0x0, 0x0, 0x1}, 0x8) 5.46620583s ago: executing program 4 (id=3712): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000001440), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_COALESCE_SET(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000140)={0x34, r1, 0x1, 0x4005, 0xfffffffe, {}, [@ETHTOOL_A_COALESCE_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'syz_tun\x00'}]}, @ETHTOOL_A_COALESCE_RX_USECS_LOW={0x8, 0xe, 0x9}]}, 0x34}}, 0x0) r2 = socket$inet6(0xa, 0x80002, 0x0) sendmsg$sock(r2, &(0x7f0000000540)={&(0x7f0000000580)=@in6={0xa, 0x4ea3, 0x81, @loopback, 0x3}, 0x80, 0x0, 0x0, &(0x7f0000000700)=[@mark={{0x14, 0x1, 0x24, 0x80000001}}], 0x18}, 0x4c040) r3 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r3, &(0x7f0000000000)={0x2, 0x4e21, @broadcast}, 0x2f) setsockopt$inet_tcp_TCP_CONGESTION(r3, 0x6, 0xd, &(0x7f0000000280)='vegas', 0x5) connect$inet(r3, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x1b}}, 0x10) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)={{0x14}, [@NFT_MSG_NEWRULE={0x6c, 0x6, 0xa, 0x401, 0x0, 0x0, {0x2, 0x0, 0xffff}, [@NFTA_RULE_EXPRESSIONS={0x40, 0x4, 0x0, 0x1, [{0x3c, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0x2c, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_TYPE={0x5, 0x2, 0x94}, @NFTA_EXTHDR_OFFSET={0x8, 0x3, 0x1, 0x0, 0xf5}, @NFTA_EXTHDR_LEN={0x8, 0x4, 0x1, 0x0, 0x1}, @NFTA_EXTHDR_FLAGS={0x8, 0x6, 0x1, 0x0, 0x2}, @NFTA_EXTHDR_DREG={0x8, 0x1, 0x1, 0x0, 0x13}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x94}}, 0x0) pipe(0x0) r5 = socket$kcm(0x10, 0x2, 0x4) sendmsg$kcm(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000840)="89000000120081ae08060cdc030000fe7f03214e000000000001ffca1b1f0000000024c00e72f750375ed08a56331dbf9ed7815e381ad6e747033a0093b837dc6cc01e32efaec8c7a6ec00150c00014003080c00bdad446b31007a46e3988285dcdf12f21308f868fece01955fed0009d78f0a947e", 0x75}, {&(0x7f0000000140)="11d6cb557c8496a2fe7a81f38210bfa9b70ee09c", 0x14}], 0x2}, 0x4000000) 5.286696305s ago: executing program 1 (id=3713): socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r1, 0x0, r3, 0x0, 0xf3a, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, 0x0) r4 = socket$inet(0x2, 0x2, 0x1) sendmsg$inet(r4, &(0x7f0000000600)={&(0x7f0000000040)={0x2, 0xffff, @dev={0xac, 0x14, 0x14, 0x11}}, 0x10, &(0x7f00000000c0)=[{&(0x7f0000000400)='\b\x00', 0x2}, {&(0x7f0000000140)="2d0000008058", 0x6}], 0x2, &(0x7f0000000100)=ANY=[@ANYBLOB="1c000000000000000200000007000000890b040a0101027f00000100000000001c000000000000000000000008"], 0x40}, 0x20000000) close(r2) write(r0, 0x0, 0x0) mmap(&(0x7f00009fd000/0x600000)=nil, 0x600000, 0x100000d, 0x6031, 0xffffffffffffffff, 0xa1b92000) r5 = socket$rds(0x15, 0x5, 0x0) bind$rds(r5, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x8, 0x3032, 0xffffffffffffffff, 0x3000) sendmsg$rds(r5, &(0x7f0000000080)={&(0x7f0000000040)={0x2, 0x4, @local}, 0x10, 0x0, 0x0, &(0x7f0000000240)=[@rdma_args={0x48, 0x114, 0x1, {{0x5, 0x8}, {0x0}, &(0x7f0000000440)=[{&(0x7f0000001880)=""/4112, 0x1010}], 0x1, 0x20}}], 0x48, 0x80}, 0x0) accept4$alg(0xffffffffffffffff, 0x0, 0x0, 0x800) 5.196358558s ago: executing program 3 (id=3714): r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$F2FS_IOC_SET_COMPRESS_OPTION(r0, 0x4002f516, &(0x7f0000000040)={0x3c, 0x8}) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nbd(&(0x7f0000000000), 0xffffffffffffffff) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) sendmsg$NBD_CMD_CONNECT(r1, &(0x7f0000001ac0)={0x0, 0x0, &(0x7f0000001a80)={&(0x7f0000000140)={0x38, r2, 0x1, 0xffffffff, 0x0, {}, [@NBD_ATTR_SOCKETS={0x10, 0x7, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r3}}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7fff}]}, 0x38}}, 0x20000000) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = socket$inet6_sctp(0xa, 0x5, 0x84) sendmsg$inet(r5, &(0x7f0000000f80)={&(0x7f0000000000)={0x2, 0x4e21, @rand_addr=0x64010101}, 0x10, &(0x7f0000000140)=[{&(0x7f0000000180)="8d", 0x1}], 0x1}, 0x2c044010) shutdown(r5, 0x1) getsockopt$inet_sctp6_SCTP_LOCAL_AUTH_CHUNKS(r5, 0x84, 0x1b, &(0x7f0000000040), &(0x7f00000001c0)=0x8) r6 = syz_genetlink_get_family_id$nbd(&(0x7f0000000380), 0xffffffffffffffff) sendmsg$NBD_CMD_DISCONNECT(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)={0x1c, r6, 0x100, 0x70bd2b, 0x25dfdbfc, {}, [@NBD_ATTR_INDEX={0x8, 0x1, 0x0}]}, 0x1c}, 0x1, 0x0, 0x0, 0x24040090}, 0x20000040) sendmsg$NBD_CMD_STATUS(r1, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x2c, r6, 0xc00, 0x70bd28, 0x25dfdbfc, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0xed8}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc}]}, 0x2c}, 0x1, 0x0, 0x0, 0x401}, 0x24000010) r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r8 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet_int(r8, 0x0, 0x1, &(0x7f0000000000)=0xffffff7e, 0x4) bind$inet(r8, &(0x7f0000000040)={0x2, 0x4e24, @multicast2}, 0x10) r9 = syz_genetlink_get_family_id$nl802154(&(0x7f00000003c0), 0xffffffffffffffff) sendmsg$NL802154_CMD_GET_SEC_DEV(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x20, r9, 0xeb923771a6a8c729, 0x70bd26, 0x25dfdbfe, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x3}]}, 0x20}, 0x1, 0x0, 0x0, 0x880}, 0x200840c4) r10 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000340), r4) sendmsg$IEEE802154_SCAN_REQ(r4, &(0x7f0000000680)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000640)={&(0x7f0000000600)={0x1c, r10, 0x800, 0x70bd25, 0x25dfdbfd, {}, [@IEEE802154_ATTR_PAGE={0x5, 0x1d, 0x1d}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8004}, 0x400) sendmsg$NL802154_CMD_NEW_SEC_KEY(r1, &(0x7f00000004c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000480)={&(0x7f00000003c0)={0x9c, r9, 0x1, 0x70bd2b, 0x25dfdbfb, {}, [@NL802154_ATTR_SEC_KEY={0x88, 0x30, 0x0, 0x1, [@NL802154_KEY_ATTR_ID={0x10, 0x1, 0x0, 0x1, [@NL802154_KEY_ID_ATTR_SOURCE_EXTENDED={0xc, 0x5, 0x3}]}, @NL802154_KEY_ATTR_BYTES={0x14, 0x4, "5012f1813cc1c8239823aca39cf229b7"}, @NL802154_KEY_ATTR_ID={0x58, 0x1, 0x0, 0x1, [@NL802154_KEY_ID_ATTR_IMPLICIT={0x24, 0x3, 0x0, 0x1, [@NL802154_DEV_ADDR_ATTR_PAN_ID={0x6, 0x1, 0xffff}, @NL802154_DEV_ADDR_ATTR_MODE={0x8}, @NL802154_DEV_ADDR_ATTR_SHORT={0x6, 0x3, 0xfffe}, @NL802154_DEV_ADDR_ATTR_MODE={0x8}]}, @NL802154_KEY_ID_ATTR_SOURCE_SHORT={0x8, 0x4, 0x8}, @NL802154_KEY_ID_ATTR_MODE={0x8}, @NL802154_KEY_ID_ATTR_IMPLICIT={0xc, 0x3, 0x0, 0x1, [@NL802154_DEV_ADDR_ATTR_MODE={0x8}]}, @NL802154_KEY_ID_ATTR_MODE={0x8, 0x1, 0x3}, @NL802154_KEY_ID_ATTR_SOURCE_EXTENDED={0xc, 0x5, 0x1ff}]}, @NL802154_KEY_ATTR_USAGE_FRAMES={0x5, 0x2, 0x10}]}]}, 0x9c}, 0x1, 0x0, 0x0, 0x4000090}, 0x48080) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYRES16=r3, @ANYRES32=r0, @ANYBLOB="2900b1d19fc4d1891dffe2ca87015d05cd123862ff1807399d73c5a8feeb147a804c9204152ba026ad17440900000040af9826c24712f1493e94810f57a418ad0d1acab6bac34bbd939d599430edd0d6ad9d06453b5d2ab8536cdeaa"], 0x34}, 0x1, 0x0, 0x0, 0x48815}, 0x8810) readv(r0, &(0x7f0000002d80)=[{&(0x7f0000000500)=""/206, 0xce}, {&(0x7f0000001b00)=""/4096, 0x1000}, {&(0x7f0000002b00)=""/245, 0xf5}, {&(0x7f0000002c00)=""/23, 0x17}, {&(0x7f0000002c40)=""/47, 0x2f}, {&(0x7f0000002c80)=""/252, 0xfc}], 0x6) 4.840984549s ago: executing program 0 (id=3716): r0 = socket$inet(0x2, 0x2, 0x1) sendmsg$inet(r0, &(0x7f0000000600)={&(0x7f0000000040)={0x2, 0xffff, @dev={0xac, 0x14, 0x14, 0x11}}, 0x10, &(0x7f00000000c0)=[{&(0x7f0000000400)='\b\x00', 0x2}, {&(0x7f0000000140)="2d0000008058", 0x6}], 0x2, &(0x7f0000000100)=ANY=[@ANYBLOB="1c000000000000000000000007000000890b040a"], 0x40}, 0x20000000) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010600000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff1b000000020000000900010073797a30000001000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000680)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a3c000000120a01020000000000000000020000000900020073797a310000000008000440000000000900010073797a3000000000080003400000000a14000000110001"], 0x64}}, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f0000000d80)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000d00)=ANY=[@ANYBLOB="140000001000010000000000000000000220000a3c000000120a09080000000000000000020000000900020073797a310000000008000440000000000900010073797a3000000000080003400000000a"], 0x64}, 0x1, 0x0, 0x0, 0x5}, 0x0) r3 = openat$cgroup_procs(r1, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r3, &(0x7f00000001c0), 0x12) r4 = openat$cgroup_freezer_state(r1, &(0x7f0000000080), 0x2, 0x0) r5 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000000)="2e00000011008188e6b62aa73f72cc9f0ba1f8483d0000005e140602000000000e000a0010000000028000001294", 0x2e}], 0x1}, 0x0) sendmsg$nl_crypto(0xffffffffffffffff, 0x0, 0x40) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, 0x0, 0x0) write$cgroup_freezer_state(r4, &(0x7f00000000c0)='THAWED\x00', 0x7) 4.747897708s ago: executing program 1 (id=3717): bpf$MAP_CREATE(0x0, &(0x7f0000000240)=@base={0xf, 0x4, 0x8, 0x3}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x5, 0xc, &(0x7f0000000000)=@framed, &(0x7f0000000440)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x39, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x36, 0x0, 0x0, 0x0}, 0x94) 4.741611358s ago: executing program 0 (id=3718): socket$inet_icmp(0x2, 0x2, 0x1) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r0, 0x8982, &(0x7f0000000180)={0x0, 'bridge0\x00', {0x4}, 0x2}) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)={0x30, 0x40, 0x107, 0x70bd2b, 0x0, {0x4, 0x7c}, [@nested={0x4, 0x1c2}, @nested={0xc, 0x1, 0x0, 0x1, [@typed={0x6, 0x6, 0x0, 0x0, @str='\x84;'}]}, @nested={0xc, 0x2, 0x0, 0x1, [@typed={0x8, 0x4, 0x0, 0x0, @pid}]}]}, 0x30}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f00000002c0)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x101, 0x0, 0x0, {0x7}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x54, 0x9, 0xa, 0x401, 0x0, 0x0, {0x7}, [@NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0x3}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x8}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x8}, @NFTA_SET_DATA_LEN={0x8, 0x7, 0x1, 0x0, 0x29}, @NFTA_SET_DATA_TYPE={0x8}]}, @NFT_MSG_NEWSETELEM={0x44, 0xc, 0xa, 0x101, 0x0, 0x0, {0x7, 0x0, 0x4004}, [@NFTA_SET_ELEM_LIST_ELEMENTS={0x18, 0x3, 0x0, 0x1, [{0x14, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_SET_ELEM_DATA={0x8, 0x2, 0x0, 0x1, [@NFTA_DATA_VERDICT={0x4}]}]}]}, @NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x0, 0x84}}}, 0xe0}, 0x1, 0x0, 0x0, 0x8000}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000003c80)=ANY=[@ANYBLOB="b70000000d6d0300bfa30000000000000703000000feffff620af0fff8ffffff71a4f0ff000000002704000000ffffffdd0a05000000000014000000016d030063030400000000001d44010000000000620a00fe00ffffffdb03000000000000b500f3ff000000009500000000000000023bc065b70300c6dfa041b63af4a3912435b1a864a710aad58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e5f58b7382a8b7e8177168001815548000000000000000275daf51efd601b6bf01c8e8b1b526375ee4dd6fcd82e4fee5bef7af9aa0d7f300c095199fe3ff3128e599b0eaebbdbd732c9cc20eec363e4a8f6456e5ccae25ea21714ee18cf5d803e04d83b46e21557c0afc646cb7790b3e6440c2fbdb00a3e35208b0bb0d2cd829e654400e2438ec649dc74a28610643a98d9ec21ead2ed51b104d4d91af25b845b9f75dd08d123deda8ebc72f526d8e8afcb913466aaa7f6df70252e79166d858fcd0e06dd31af9612f2460d0b11008e59a5923906f88b53987af1714e72ba7616536fd9aa58f2477184b6a89adaf17b0baf587aef370a2d426a6041bdef728d236619074d6ebdfd1f5089048ddff6da40f9411fe7226a40409d6e37c4f46756d31cb467600ade70063e5291569b33d21dae356e1c51f03a801be8189679a16da18ec0ae564162a277c7a775d55dfc28abbe9b5ea62d84f3a10746443d64364f56e24e6d2105bd901128c7e0ec82770c8206b1deeed4155617572652d950ad31928b0b0c3dc2869f478341d02d0f5ad94b081fcd507acb4b9c65fee7d26b34381fcb59b854e9d5a17f48a7382f13d000000225d85ae49cee383dc5049076b98fb6853ab39a21514da60d2ae20cfb91d6a49964757cdf538f9ce2bdb1ab062cd54e67051d355d84ce97bb0c6b4a595e487efbb2d71cde2c10f0bc6980fe78683ac5c0c31032599ddd71063be9261eee52216d009df5daf87068a608628efc56c752af4c52048ef8c126aeef5f510a8f1aded94a129e4aec6e8d9ab06faffc3a15d96c2ea3e2e04cfe031b287539d0540059fe6c7fe7cd8697502c7596566d674e425da5e87e59602a9610f0000d36f38df9ba60248d9a0d61282dfb15eb6841bb64a1b3045024a982f3c48153baae2c4e7bf37548c7f1a4cad2422ee965a38f7defbd2960242b104e20dc2d9b0c3560811ea6c3560a43364d402ccdd9069bd50b994fd6a34ee18022a579dfc0229cc0dc9881610270928eeeb883418f562ae00003ea96d10f172c0374d6eed82640700dfffffffffff499c5a90ff59d54d1f92ecc48899b212c55318294270a1ad10c80fef7c64a403ade624d47afce829ba0f85da6d888f18ea40ab959f6074ab2a40d85d15017ab513cdc6c0e57fb1c1ca5f1380d7b4ead35a385e0b4a26b702396df7e0c1e02b6e4114f254a9bf93f04bf072f0bc2d38092909ef3613861f5c0b000000000000eedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf82807773e534015ea52acb1188883ad2a3b1832371fe5bc621426d1ed0a4a99702cc1b6912a1e717d2a9441eb315209d199e029e9135753208165b9cdbae2ed9dc7358f0ebadde0b727f27feeb744ddcc536cbae315c7d8516800ef3f9a6a8906943408e6df3c391e97ba48db0a5adbfd03aac93df8866fb010aec0e92bed1fe3907000000466f4ca2195234648e0a1ca50db6f3d9436a7d55a9ad382400000000c95265b2bd83d64a532869d701723fedcbada1ee7baa19faf67256b56a41fd355b6a686b50f0937f778af083e055f6138a757ebd0ed91124a6b244f9acf41ac5d73a008364e0606a594817031fc2f52c8785fe0721719b3d654026c6ea08b83b45eb6dc5f6a9257d2283c42efc54fa84323a3304f41ff442c8843187f1dd48ef3fa293774d582956ff0f40b10ca94f6feeb2893c17888e1cdba94a6ea80c33ead5261458f40d31fe8df15efaaeea831555877f9538c6ee6ba65893ff1f928ba7554ba51dd5ab2b7932f5954f31a878e2fae6691d1aee1da02ba516467df3e7d1daac43738612e4fee18a22da19fcdb4c2890cda1f96b952511e3a69d694d625e0b2f80724a5bfc1e8890205f3a6da2819d2f9e77c7c64affa54fec0136cbafa5f62e96753b639a924599c1f69219927ea5301fff0a6063d427f068840a754c02181561542c2571f983e96735600000554f327a353511ccedde99493c31ac05a7b57f03ca91a01ba2c60ca99e8ebc15ec3d59901da21afd6400000000832503969e2b15f36b788bce5ccdbaf75c94cb93499f6947a967a7bce14c6d80010f5c653d22d49030a8c2a4ab595bf4238f18ca428dafc7ac96d40460780000000051a2104f22e6db5a62b5089c1b45282d38864daa3ae81d6b0968d1d2867b91b7d120968308c31db2633d6864da40b54783a17aaeb6737c323f9f98e354cc98c2c73e1661261173f359e93d2c80000000998809ec8f0232b3955e052a4cecd89008f70314a0bdd491ec86a4555d89fe0120f64c62e8e3ed8bcb45202c204bbec8d722824c0ebccbaf1ea4a003fe9af5d785d0128171c90d9900ce2532b0f9d01c4b45294fbba468df3e1b393cb4e62e754598e47df6bd06431c94bc5d047899fd219f448bf9189c65c9d91cda6b52a373803a9e0600f86909bc90addb7b9aee813df534aac4b32fc7741c7e3f426b9ed20debd883593ff5d691b8068cd849904568916694d461b76a58d88cf0f520310a1e9fdc18cde98d662eee077515d0a8811922929e085392ab3d1311b8243266d87047f601fa000000000000006acc19808d7cf29bc974b0ea92499a419aa095e203c1bafbb9b9a7c2bca3f0a18ee4952f2d325a56390578f12205db653a536f0100e0eda300a43a13bd1b9f3322405d1efd78e578dc6b3fb84f3738a4b6caa84feda91f3edb32231ec75300000000000087efa51c5d95ecba4e50e529d1e8c89600e809dc3d0a2f65579c23457949a50f2d0455cf79a43746979f99f6a1527f004f1e37a3926937e84fb478199dc1020f4beb98b88b5e7885e9a617aa6c8e10d4202c5afeb06e2f9115558ea12f92d7ae633d0f086b3f03b20d546fa66a72e38207c9d20035ab63de71a30f1240de52536941242d23896ab74a3c6670fdc49c14f34fc4eadd6db8d80eba439772bf60a1db1829f1a57d3f18f4edaeb5d37918e6fddcd821da67a0785585a4443440dc65600e64a6a2744c46570e8f46da1ab990ca053cbfe801000000000000000000000000000000d55d7182af2ea5f8d0ad495e3eb9421963a5a683c3dcb2d300aa3b2cfe946d2348c35f5d67d68ac07c8f84b3679e77c2e629ecec7c12c35d6b6971b8ae13cc0095f5a3bfdcffffffffffffffff61ed2b3ecfb16d19037c8c88c91dda1f904fbbc864e95ad43d6dd6d5eadbcea25682ba4b91e14c3fbfdfd1d480e7f13a65dbaa1af102d97681656bf56ff0cf36518f674237ce097d39008cc3257778de878bcd37467386f993be6d20c93a7791e7f2a155ce379b4cda2500108052aeb9bd03ffbda9ff485d6576a492d436d52edcd420e7deaa4343a0add3941ceb3a805e46beef9dca77a4edcbb42aa0caf0bbd6cec72d85540293cb4849b0610800000000000000000000000000000000f9814d5f6c8673c143ff2f901e71b8818665b56f7a03afe3d900007656659db4cb06aaaf9f02cfab5b9e61cc00e8e194299219a3f4c4c53bddea4cc48737842952ff08aeac15685df194ca89da8cf6d29a2be9779181fd5d105af5786094d9130f5826b18b9667b971a994f3fd06961912052f441e96884fcdc91f4a974242aabfc8adbadc9ca27955b5c90f1ed9a46ed044272383d3768871a9c8cfd7948aea445c55684351002ed4a4af45341de8e5e1f33624bd2ec1591dd00bbe05000000f89a928662e9b9449db34394fc5e946fadaee576e28ac0feab4e3585ed43d206218f524083840a78b723621f3b706bb7f5e42b5376642f8ad4028d4ead407240e7467d1b37a7e20690d7672c7e926fded95cf805516ad836eb730619a05af36fb28329d6feb33219cc9164461a8ba3afd5949b9a6046c53663df30a149414089c1ae8f3476236b05dde8dda4843a62c591f8d2b1a62d0db8dc826219bd87398b33e13e3a7a1511573cb1a8cdce3a8fea40792297d023ef52de2e75b9dbbfb8713178e2409b8d3b981bc2ae74621e536b9d3f09a15dada1561a8192d65cc59d7ed5a6bd610000000000000000000000000000000000000000000000b41248c570c4223a471b755ce6956908e2b0e5dbc5e71ff2373d3ed89c2e2eafac81c21ac2436d2ffacffe2fc0d601a50221c88a47b264c5129004f350963b52702c5a360000000000000000000000000000000b4077dc8a1801a8bf833350d302c5439ea3dd0f3b8eb1dc93af1fbf863d33a38a53a02ec1e5b90cb673d6b0cfe7f35b20e438653e0f73ddfc78e3e1d1cc9798af0eb9b61bb4fc72454a57237b68ea614ad898374e952784a18ffb9dc4447acd7ad28a63f88007ad8cba31a6fdd9982c97a913dffe69654d3a00b98c45ead9b9619f946c82f5789379d0d942020652ccfac45e1ef5e93e72b7d5381a3c61fbabc1286285110540075bc7aee3e595f9850b9e96887d53404add0021b198be851d9f797d964fe7501997524d28ce7b1d5f8203d9f756efd5676c5d85052030c27e2a99ee39007d9b3c305b1c7d14899b42149d6c437d863651d30426e36ff66bafa93ce3f76c18b8c91ac65b7ab49f03b7c0d0687e1ee0369e88d674f51fe69423000000000000596444d8a7bf983d6f0342b2987e520100000000000000f37cda7868234eeefbd472c7b396c182f2b9a8bf2f85ad1a7b18681784c8fcf0cf5e34baebc594de0d6c9244a834b82a162739619b5f2e3c24378417f71f855b7958fbae631a8aa30b2120a9e23d8711f529b0cd7ce6ee2b0841a4d9e82e6ef54089b64175338ed7effe440c97c663a1000000000033f9ee8bc74fb676198caf54f9a07461c30b4b65890f2b64e68eb2a265f641e68af046fb8751055c6dba7e49068656dbf01c26b3812cec4204084e4c3f5abb86121a3eddd10720d3b66a3a8033aab499cf56b7e5b01d37c1d7b4f5968040cd727efc9a1d69fa550313969508472efa833327d1bcae9167e3316f272ba2efdebf91f15b4a2bc27ea303834692d92961d3dcff0e4f55d9e3e7c66e8d3324216c4c77b95c000c5f30d56da969b1ce3a3e1a8ce5a632b3c404e7b455cac15273ce31a57dc7bed120f5396671eb7f8670ddc26ecc7461b1badfc98076c95aa811954827767c023c51e183cf1de0230912617f72169a3f9bda12524491e213929a9d095abb9e57f33ad7e5301e5995e65246bc06f931d983596a4979d403f1b3984123633e9af67a0972612b5874f2000000009a8c3199c30dd0c416da1c22e346958bda493b297fcb98181ac449ca17a08e27ae81320e316e018fc9c77e7434079bc06ca1d315a94d177a888cc189fa5649bf5b9ab787118c29d735cc6dfaa965ea9ebbbaff83a06292aff2e3ed23750786136f113cdb04b881f721d02bd3c99b9dd3fa2713cda74eb3dd3422c736dc5c7bd3d1d008b5af391dac38341744dc38e8620fd4b35974ef1d93a907f37a84e1d630dd93fcde4aaf59e0e1f64ba3eec9da0b3d3b241fa52d9db1b137140b27434e74b783f9b62cc516f99e425ed603c5e65c0c3b08815a4aac7c1db4e47261148fa3a54359a2157b9a0fcecd54abbfaaee20f9a6dcc5380f01f22b8fd02b340118a65cef1597f5ce8d8a602120a3b2bb8ccc199dc36b2110a2200a2d3eaff9bc85ff68cd233fb2c8198682bd1c99fd7d66f3554439db4145028bc69579e516fd32253f641b0bffebc32cd3e90d67c77017ae323d8d31bd9f061d270d89737acea845067d8fd36fcce1ae9cd64beeae55d4c8159262240837b2854e5e08c58551453f1b9e46c6a7aaa972255fe7ad8f653168ce260000000000000000008b816f1b5e51781fa92c8b2c886bd992507715f8554276f56e3498156ca6d639de489096f49f2e1850d7399b1fe3801d3b2c0f65abcb67ac3ded74b099f76fee439abfb20c23864280855f395e3449859040832ea50df150deb14fc420a8e91ec84ccd338ada3c5778cbd52bcc2ac93b00e64959286b99231afa239dbefc90a21180f12a03c370980c8101d8a014f6139e998c938bccc92bfc987af6f02ec667c9597c19cc4193c09d152093013629b93e5104447e54ba7bc95ed2b3532421d6a0424c1e000000000000c1af53b85ab7060d6797a18cac2bf246a16f503e09832de7f7aa523d2325b4e3b651b1883ab9a3012f2b5b91e2782250a650d2dddca42a671f083b4a3739a651feb7c1c6903f50ce2cb6501fa22cf55230792a1e2fc902c9115a3b912dcef392b050c9a2870e7da0ca2ce908ff7bc5c72b591004ec3034b189a580e7f6ef153c04bb5599ab22686c5520a02e14a53f105d7b6a097e86b61500bdd7e6e133a9870ec9c0bb77c90702910cc39a0f3a419f12ba636b5837a5ecb110c89fb8d14da2d04175b18a14b2618d05fb58e9a832a4993472e5d068fe44e92676e484662a"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x13, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8}, 0x94) socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$smc(&(0x7f0000000000), 0xffffffffffffffff) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=@newqdisc={0x38, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdfc, {0x0, 0x0, 0x0, r7, {}, {0xffff, 0xffff}, {0x2, 0x1}}, [@qdisc_kind_options=@q_skbprio={{0xc}, {0x8, 0x2, 0x7}}]}, 0x38}, 0x1, 0x0, 0x0, 0x400dc}, 0x4000080) sendmsg$nl_route_sched(r4, &(0x7f0000000680)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000640)={&(0x7f00000004c0)=@newqdisc={0x158, 0x24, 0x200, 0x70bd25, 0x25dfdbfc, {0x0, 0x0, 0x0, r7, {0xfff3, 0xffff}, {0xfffb, 0x3}, {0xffff, 0x3}}, [@TCA_INGRESS_BLOCK={0x8, 0xd, 0x3ff}, @TCA_STAB={0x12c, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x0, 0x9, 0x0, 0xa02, 0x0, 0x2d0, 0x5}}, {0x4}}, {{0x1c, 0x1, {0x7, 0x4, 0x1, 0x8000, 0x1, 0x2, 0x8, 0x2}}, {0x8, 0x2, [0x0, 0x6]}}, {{0x1c, 0x1, {0xaa, 0x4, 0x9, 0x2, 0x0, 0x1, 0xffffffff, 0x6}}, {0x10, 0x2, [0x7, 0x245, 0x3, 0x0, 0x1000, 0x4214]}}, {{0x1c, 0x1, {0xa, 0x7, 0xe, 0x3, 0x0, 0x1, 0x9, 0x1}}, {0x6, 0x2, [0x7]}}, {{0x1c, 0x1, {0x3c, 0xa8, 0xe, 0x4, 0x1, 0x3, 0x3, 0x2}}, {0x8, 0x2, [0xa4, 0x4]}}, {{0x1c, 0x1, {0x2, 0xd, 0x8, 0x7, 0x1, 0xfff, 0x9be0, 0x2}}, {0x8, 0x2, [0x7fff, 0x8]}}, {{0x1c, 0x1, {0x2, 0x4, 0x8, 0x3, 0x2, 0x2, 0x4, 0x2}}, {0x8, 0x2, [0x1ff, 0x2]}}, {{0x1c, 0x1, {0x8, 0x1, 0x2, 0x3, 0x2, 0xb, 0x3d98, 0x4}}, {0xc, 0x2, [0xae, 0x8, 0x2, 0x0]}}]}]}, 0x158}, 0x1, 0x0, 0x0, 0x20000054}, 0x20000000) r8 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$SMC_PNETID_DEL(r8, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)={0x14, r3, 0xe27, 0x70bd28, 0x0, {0x4, 0x7, 0x2}}, 0x14}, 0x1, 0x40030000000000}, 0x4000) r9 = socket(0x2a, 0x2, 0x0) getsockname$packet(r9, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000001480)=0x14) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, 0x0}, 0x44884) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, 0x0, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newtfilter={0x24, 0x2c, 0xd27, 0x2070bd2d, 0x25dfdffd, {0x0, 0x0, 0x0, r10, {0x6, 0x10}, {}, {0x8, 0xffe0}}}, 0x24}}, 0x0) socket$netlink(0x10, 0x3, 0x0) r11 = socket$kcm(0x10, 0x2, 0x0) write$cgroup_subtree(r11, &(0x7f0000000000)=ANY=[@ANYBLOB='V?\x00\x00-\x00'], 0xfe33) syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/uts\x00') unshare(0x2c060000) 4.732530057s ago: executing program 1 (id=3719): r0 = socket$nl_route(0x10, 0x3, 0x0) (async) r1 = socket$inet6(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'virt_wifi0\x00', 0x0}) setsockopt$inet6_mreq(r1, 0x29, 0x1b, &(0x7f0000000000)={@remote, r2}, 0x14) (async) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)=ANY=[@ANYBLOB="2400000000000907020000000000008007050000", @ANYRES32=0x0, @ANYBLOB="0c000180060002000f000000"], 0x24}, 0x1, 0x5502000000000000}, 0x4000) (async) sendmsg$nl_route_sched(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000580)=@newtfilter={0x123c, 0x11, 0x200, 0x2000, 0x0, {0x0, 0x0, 0x74, r2, {}, {0xafabc05531515610, 0xfff3}, {0x8, 0x5}}, [@filter_kind_options=@f_basic={{0xa}, {0x11ec, 0x2, [@TCA_BASIC_POLICE={0x884, 0x4, [@TCA_POLICE_PEAKRATE64={0xc, 0x9, 0x1}, @TCA_POLICE_RESULT={0x8, 0x5, 0x4}, @TCA_POLICE_RATE={0x404, 0x2, [0x5, 0x6, 0x3c, 0x8000, 0xe, 0x67dd, 0xd41, 0x8, 0x4, 0x3, 0x4, 0x0, 0x4, 0x4, 0x1, 0xee, 0xbc, 0xc, 0x8, 0xdbc, 0xffff3a19, 0x9, 0x8, 0x4, 0xa23b448, 0xffffffff, 0x8, 0xb9a, 0x3, 0x9ce, 0x9, 0x5, 0x7fff, 0x8, 0xfffffff8, 0x5, 0x1, 0x4f10, 0x3, 0x2, 0x7, 0x200, 0x1, 0x3296, 0x10000, 0x3, 0x2, 0x2, 0xff, 0x80000001, 0x6, 0x0, 0x3, 0x8001, 0xc, 0x2, 0x6249, 0xfffff18f, 0x6, 0xfffffffd, 0x5, 0x80000001, 0x0, 0x2, 0x6, 0x5, 0x5, 0x40, 0xe, 0x8, 0xf, 0xf, 0x5, 0x4, 0x7b, 0x5, 0xdc, 0x31000, 0xb0a, 0x35, 0x6, 0x4e48, 0x2, 0xfffffc01, 0x4, 0x0, 0x2, 0xffff0001, 0x3, 0x0, 0x8, 0x5, 0x5, 0x2, 0x0, 0xff, 0x200000, 0x8d, 0x6412, 0x9, 0x81, 0x2, 0x4, 0xf, 0x2, 0x6, 0x6, 0x4, 0x1, 0x6, 0xb2b, 0x2, 0x8, 0x4, 0x2, 0x0, 0x66e, 0x3, 0x18, 0x2, 0x8, 0xfca4, 0x5, 0x3d1, 0x40c, 0x40, 0x8, 0x9, 0x5, 0xcd3e, 0x3d57, 0x3, 0xc23, 0x81, 0x4, 0xc9, 0x2, 0x6, 0x8b3d, 0x6, 0x0, 0x8, 0x8, 0x9, 0x2, 0x40, 0x6, 0x4, 0xc1b7, 0x0, 0x6, 0x4, 0x2, 0x63, 0xffffffff, 0x101, 0x10003ff, 0x6, 0x3000, 0x86, 0x3, 0x2, 0x401, 0x10, 0x31b, 0x2, 0x2, 0x7e3, 0xa, 0xcba8, 0xb4, 0x9, 0x2, 0x23e504a5, 0x3, 0xc, 0x0, 0xec, 0x40, 0xfff, 0x2, 0x1, 0x7fff, 0x7, 0x7ff, 0xd86, 0x2a, 0x73297c7b, 0x4a, 0x5, 0x9, 0x7, 0x1000, 0x1, 0x81, 0x8, 0x7fffffff, 0x3, 0x10, 0x2, 0x100, 0x1, 0x7, 0x7, 0x7, 0x0, 0x400, 0xfffffffc, 0x3, 0x5, 0x28e4b185, 0x8001, 0x2a, 0x5, 0x9, 0x2, 0x57028c03, 0xf, 0x1, 0x5, 0x9, 0x3, 0x8, 0x6, 0x9, 0x200, 0xe, 0x9, 0x7, 0x80000001, 0x6, 0xd, 0x5, 0x1, 0x89, 0x6, 0xfff, 0x3, 0xfffffffe, 0xd1bc, 0xfffff000, 0x3, 0x8539, 0x3ff, 0x401, 0x2, 0x2, 0x1, 0x7, 0x8001, 0x100, 0x8, 0x8, 0x10, 0x9, 0x4940375a]}, @TCA_POLICE_RATE64={0xc, 0x8, 0x7}, @TCA_POLICE_RATE={0x404, 0x2, [0x13e0, 0x4, 0x2, 0x2, 0x1, 0x4, 0x3, 0xffff, 0x401, 0xfffffffb, 0x2, 0x2, 0x70, 0x40, 0x81, 0x7fff, 0x0, 0xf, 0x7, 0xae, 0x9, 0x1000, 0x5, 0x3, 0x7, 0x7, 0x80, 0x81, 0x4, 0x80, 0x40, 0x7, 0x9ec, 0x7, 0x9, 0x4, 0x0, 0x81, 0x5, 0x85, 0xffff, 0x61, 0x0, 0xc, 0x7, 0xda2, 0x7, 0x2, 0x80, 0x4, 0x3, 0x2, 0x8, 0x4, 0x46c, 0x4, 0x7, 0x6, 0x2f, 0x77, 0x4, 0x0, 0xfff, 0x2, 0x808, 0x92, 0x0, 0xfffffff9, 0xb36, 0x4, 0x80000001, 0x7ff, 0x882, 0x8, 0x8001, 0x0, 0x5, 0xfffff210, 0xeb, 0x8001, 0xfff, 0xa, 0x6, 0x80000000, 0x59, 0x5, 0xeec7, 0x8, 0x100, 0x7, 0xcba, 0x0, 0x1ff, 0x12, 0xffffffff, 0x10001, 0xb7a, 0xff, 0x5, 0x7, 0x7, 0x3, 0x8, 0x3ff, 0x0, 0x7ff, 0x7, 0x5, 0x8b66, 0xfffffff9, 0xc6b, 0x8001, 0x40, 0x2, 0x1, 0x17, 0x47e5, 0x9, 0x10001, 0x401, 0x918, 0x0, 0x9, 0x0, 0x1, 0xb9, 0x6, 0x100, 0x9, 0xa, 0xffff, 0x6, 0x7ff, 0x5, 0x80, 0x793, 0x2, 0x7, 0xf, 0x9e, 0x8001, 0x7ff, 0xfffffff7, 0x8000, 0x987a, 0x80, 0x41, 0x401, 0x7f, 0x5, 0x5, 0x2, 0x6, 0x7, 0x2c3a, 0xffff, 0x8000, 0xffff, 0x0, 0x8, 0x85, 0x8, 0x39ab, 0x400, 0x80, 0x6, 0x0, 0x7, 0x8, 0xfffffffb, 0x13809f1b, 0x1, 0x3, 0xf29c, 0x200, 0x2, 0xffff1ddd, 0xfff, 0x6, 0x8, 0x8, 0x800, 0xffff, 0x1, 0xff, 0x1, 0x0, 0x10000, 0x2, 0x1, 0x5, 0x83c5, 0x10000, 0xa, 0x6, 0x5, 0xf82, 0x0, 0x40, 0x9, 0x5, 0x4, 0x1, 0x4, 0xbb75, 0x5, 0x5, 0x9, 0x981a, 0xf, 0xd56, 0x9, 0x3, 0x7, 0x3, 0x200, 0x6, 0x7ff, 0x6, 0xd79e, 0x701, 0x0, 0x2, 0xd0, 0x4, 0x3, 0x7, 0x8, 0x8000, 0x4, 0x1000, 0x0, 0x7fd, 0x5078fc6c, 0x7, 0x3, 0x10a6a5, 0x8f, 0x7fff, 0x5, 0x2, 0x8, 0x8001, 0x0, 0x1, 0xa0, 0x1ff, 0xfff, 0xffff, 0x10001, 0x7, 0x8, 0xfffffff9, 0x4, 0xffff, 0xf]}, @TCA_POLICE_RESULT={0x8, 0x5, 0x5}, @TCA_POLICE_RATE64={0xc, 0x8, 0x3}, @TCA_POLICE_RESULT={0x8, 0x5, 0xa}, @TCA_POLICE_TBF={0x3c, 0x1, {0x0, 0x3, 0x4, 0x3d81556e, 0x2, {0xc, 0x2, 0x4, 0x2, 0x8, 0x401}, {0x1, 0x0, 0x0, 0xd, 0x30, 0xb34}, 0x643f, 0x9, 0x2}}]}, @TCA_BASIC_ACT={0x158, 0x3, [@m_skbmod={0x154, 0x8, 0x0, 0x0, {{0xb}, {0x54, 0x2, 0x0, 0x1, [@TCA_SKBMOD_DMAC={0xa, 0x3, @multicast}, @TCA_SKBMOD_PARMS={0x24, 0x2, {{0x4, 0x1000, 0xffffffffffffffff, 0x7, 0x8}, 0x10}}, @TCA_SKBMOD_DMAC={0xa, 0x3, @link_local}, @TCA_SKBMOD_ETYPE={0x6, 0x5, 0x7}, @TCA_SKBMOD_SMAC={0xa}]}, {0xd5, 0x6, "74693e894774d0a40ea1c11ab56cda923edeb6bd0381804d2c47ef75060bd490db49bd5e50c7964a2a5a270da5d79600588563b7926d6cfdea7dc436dcd17812dd2b701adf1ba5cfb173a54aa41364eda529e925571499a9d6f31f1ca98ac324279ad309bc162c777082df392d2c1fc726802d5f95492707251355849041a4297dd791dadb26fa51638cb47bf6eff72ce6ace6955f3b9e72df1ad63578af96afd4a773746c47c90e9fcd9dc4ab1c62ccc66dcf8f5fa3857910cfc9437f1e0837c450ff123365dfc75a6bf4f2177a4ea1fd"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x1, 0x2}}}}]}, @TCA_BASIC_CLASSID={0x8, 0x1, {0x4}}, @TCA_BASIC_POLICE={0x88, 0x4, [@TCA_POLICE_RATE64={0xc, 0x8, 0x6}, @TCA_POLICE_TBF={0x3c, 0x1, {0x7, 0x8028d87e6eedbe14, 0x6, 0xc7bf, 0x1, {0x6, 0x0, 0x9, 0x7c, 0xa340, 0x2}, {0x9d, 0x2, 0x4000, 0x2, 0xb8, 0x6}, 0x3, 0x81, 0x4b8c110c}}, @TCA_POLICE_TBF={0x3c, 0x1, {0xb6, 0x1, 0x800, 0xf8, 0x3, {0x3, 0x0, 0x1, 0x7f, 0x7df1, 0xdfe}, {0x3, 0x1, 0xf, 0x1000, 0x7fff, 0x8}, 0x549, 0x7, 0x8}}]}, @TCA_BASIC_ACT={0x2cc, 0x3, [@m_mpls={0x138, 0x8, 0x0, 0x0, {{0x9}, {0x54, 0x2, 0x0, 0x1, [@TCA_MPLS_BOS={0x5, 0x8, 0x1}, @TCA_MPLS_LABEL={0x8, 0x5, 0x9920c}, @TCA_MPLS_PROTO={0x6, 0x4, 0x6004}, @TCA_MPLS_LABEL={0x8, 0x5, 0x41348}, @TCA_MPLS_TC={0x5, 0x6, 0x1}, @TCA_MPLS_TTL={0x5, 0x7, 0x6}, @TCA_MPLS_LABEL={0x8, 0x5, 0xee545}, @TCA_MPLS_LABEL={0x8, 0x5, 0x2ff10}, @TCA_MPLS_BOS={0x5, 0x8, 0x1}, @TCA_MPLS_BOS={0x5}]}, {0xb9, 0x6, "0fb1c8623fae376cc6bf72f574a9e289123d1e21c941c742e4962b8b925fe5dbe3e9b3db8e281fbf4aa13a42e23a8e71937d67a8e639b93368bb263b176d1e5d7d6c0873032b97ee4606805f1be10e8602dc1394b2a46a9b3d4e4ecfff3d2fe9bfe2688da7ec17798e6947e99a61deb4910f79126dfb1d7c568afc1591ebb93cd8d1cc3c7e03ebd985c2e4414f171503ecef20d13bccd5e61e64457315e989780ad62cf61a42cb82c7121cc5c9267b45fc95537bf9"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x1}}}}, @m_ctinfo={0x190, 0x17, 0x0, 0x0, {{0xb}, {0x6c, 0x2, 0x0, 0x1, [@TCA_CTINFO_PARMS_DSCP_STATEMASK={0x8, 0x6, 0x6}, @TCA_CTINFO_PARMS_CPMARK_MASK={0x8}, @TCA_CTINFO_PARMS_CPMARK_MASK={0x8, 0x7, 0x6}, @TCA_CTINFO_ACT={0x18, 0x3, {0xffff7fff, 0xa86, 0x5, 0xc3d5, 0x4a}}, @TCA_CTINFO_ACT={0x18, 0x3, {0x7, 0x7, 0x8, 0x80000000, 0x4}}, @TCA_CTINFO_PARMS_DSCP_MASK={0x8, 0x5, 0xf}, @TCA_CTINFO_PARMS_DSCP_STATEMASK={0x8, 0x6, 0x7}, @TCA_CTINFO_PARMS_CPMARK_MASK={0x8, 0x7, 0x9}, @TCA_CTINFO_PARMS_DSCP_MASK={0x8, 0x5, 0x1}]}, {0xf9, 0x6, "2f7b64104e4148dd359bd96394bf3455598d43b76d65d23d43e775ef509e66b2bdafb96c4b559a469332262f2b6c1149225786dc21af235ea96e374774971b10e3a3088dcd397bf782598b13edd7696a545e38d7d157a92c55fe0b930b5ea148ea7d7bf9a516ac19217abcb56fc045b1eff08a097d9420741162bcc919d6196ae46cf88a1579a6004c2179bf7633557cecb67dfe9ef97f3e9bc8f5fcbfdb48290118d1cd6e8beb38df7f8566da11af67b13e00eb47bad0431136e2a5746be33e4507aac9bf806119b888d66e7b019bb95049929abc16f50f430292c5d04379806f94262e177551ceac75f3b606b700f5097dd61859"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x0, 0x1}}}}]}, @TCA_BASIC_ACT={0x4b0, 0x3, [@m_skbmod={0x74, 0x0, 0x0, 0x0, {{0xb}, {0xc, 0x2, 0x0, 0x1, [@TCA_SKBMOD_ETYPE={0x6, 0x5, 0x800}]}, {0x40, 0x6, "3d9032e4ac4b4bdc273b85ab20f2575ccc76aae1423bf3a095c480e4e3c77fc06bb887e0e60e84a57859bfc54008780e37026656fa4c88f2edc3308a"}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x3}}}}, @m_csum={0x148, 0x1c, 0x0, 0x0, {{0x9}, {0x74, 0x2, 0x0, 0x1, [@TCA_CSUM_PARMS={0x1c, 0x1, {{0x9, 0x10001, 0x2, 0x1000, 0x20}, 0x4c}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0x7, 0x64a0, 0x8, 0x7, 0xffffffff}, 0x34}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0x0, 0x6, 0x10000000, 0xa, 0x1}, 0x43}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0x2, 0x4, 0xffffffffffffffff, 0x1, 0x9}, 0x1c}}]}, {0xac, 0x6, "97df4de41442da7c44da790dadb7dc47886ae898592362c24cc8a11c6b0010314098a4a9ac46baa5d0b3d4ea1e0e289b34e593a8fc6e56d55f230b2b166f7fad53cda97d95997c2977f50336e6881151d41e6e2a55a4af45c674b665879258909d777923e58a036ae57e1ffcca7f378a99f16d9575fa8f2b69a6190040640c75304d0cd7d729bc4257b29c133f760cf75659e03b90733a96d8df632fdec5b9757c5712c11e9ea982"}, {0xc}, {0xc, 0x8, {0x0, 0x1}}}}, @m_gact={0x14c, 0xd, 0x0, 0x0, {{0x9}, {0x88, 0x2, 0x0, 0x1, [@TCA_GACT_PROB={0xc, 0x3, {0x2, 0xc21, 0x1}}, @TCA_GACT_PARMS={0x18, 0x2, {0xee, 0x6, 0x1, 0x270, 0x4}}, @TCA_GACT_PARMS={0x18, 0x2, {0xf, 0x3ff, 0x4, 0xa, 0x2}}, @TCA_GACT_PROB={0xc, 0x3, {0x0, 0x1ab8, 0x4}}, @TCA_GACT_PROB={0xc, 0x3, {0x0, 0x1909, 0xffffffffffffffff}}, @TCA_GACT_PARMS={0x18, 0x2, {0x2, 0x1, 0x5, 0x10, 0x8}}, @TCA_GACT_PROB={0xc, 0x3, {0x0, 0x7a8, 0x10000000}}, @TCA_GACT_PROB={0xc, 0x3, {0x2, 0xc9, 0x1}}]}, {0x99, 0x6, "f773a8ba433a75964f386b8f78288a0f325e58e4fa3e43bbe329569febed47b3b029239c6163c275455a7c926dff496b3f0f2ffe69b24cfd16f83b886c15ef526e0b1de8c45794bcf72c687f3509048e11d8cfd39a3bedff3894cd99810a259843e25462e7388ea4f550b20630e7d2b212d0f2a4400723769f0a61e8196d302618d9294046b33b74e5092f2e7ae31416beaf541658"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x5, 0x1}}}}, @m_ife={0x1a4, 0x5, 0x0, 0x0, {{0x8}, {0xc8, 0x2, 0x0, 0x1, [@TCA_IFE_METALST={0x34, 0x6, [@IFE_META_TCINDEX={0x4, 0x5, @void}, @IFE_META_PRIO={0x4, 0x3, @void}, @IFE_META_TCINDEX={0x4, 0x5, @void}, @IFE_META_TCINDEX={0x4, 0x5, @void}, @IFE_META_SKBMARK={0x8, 0x1, @val=0x67b44fc1}, @IFE_META_TCINDEX={0x4, 0x5, @void}, @IFE_META_SKBMARK={0x8, 0x1, @val=0x8}, @IFE_META_TCINDEX={0x6, 0x5, @val=0x8}, @IFE_META_SKBMARK={0x4, 0x1, @void}]}, @TCA_IFE_SMAC={0xa, 0x4, @broadcast}, @TCA_IFE_PARMS={0x1c, 0x1, {{0x5, 0x6, 0x1, 0x2, 0xf2}, 0x1}}, @TCA_IFE_METALST={0x30, 0x6, [@IFE_META_PRIO={0x4, 0x3, @void}, @IFE_META_SKBMARK={0x8, 0x1, @val=0x6}, @IFE_META_SKBMARK={0x4, 0x1, @void}, @IFE_META_SKBMARK={0x8, 0x1, @val=0x5}, @IFE_META_PRIO={0x4, 0x3, @void}, @IFE_META_PRIO={0x4, 0x3, @void}, @IFE_META_SKBMARK={0x8, 0x1, @val=0x400}, @IFE_META_PRIO={0x4, 0x3, @void}]}, @TCA_IFE_PARMS={0x1c, 0x1, {{0x6, 0x4, 0x10000000, 0x4, 0x1}, 0x1}}, @TCA_IFE_PARMS={0x1c, 0x1, {{0x9, 0x7, 0x6, 0x3, 0x6}}}]}, {0xb5, 0x6, "96faef283e1771be524af25e9b4fc1a7e78364765f3407b28847086524eaafdf0022d2057936009efe32081d5322a48378e192068c4453c793c6e6ebac3cc9940e48525b5caa5ef5783c24a3b36a885e9e5c10d0c89335eaf710f749083f1760aecec063b5fde14006891b1d60bd7d414c4ea8274500653a126ec42e850c8783e49d061f1ca10314037aaeeb47c7c5d9778161197cfa504f02a0fcb9e18cd5fed6bad1c8c3b3b9c9f5218418ab5d331921"}, {0xc}, {0xc, 0x8, {0x1, 0x6}}}}]}]}}, @TCA_RATE={0x6, 0x5, {0xff, 0x5}}, @TCA_RATE={0x6, 0x5, {0x76, 0x2}}, @TCA_CHAIN={0x8, 0xb, 0x18cb}, @TCA_CHAIN={0x8, 0xb, 0x1}]}, 0x123c}, 0x1, 0xf0ffffffffffff, 0x0, 0x1c005}, 0x0) (async) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) (async) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup.cpu/syz0\x00', 0x200002, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x80, 0x0) (async) r5 = socket$inet_udp(0x2, 0x2, 0x0) (async) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=ANY=[@ANYBLOB="380000001800dd8d00000000fbdbdf25020000100000000500000000060015000200000014001680100008800c00018005"], 0x38}}, 0x10044800) bind$inet(r5, 0x0, 0x0) (async) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r7, 0x10e, 0x1, &(0x7f0000000400)=0x1, 0x4) r8 = socket$nl_xfrm(0x10, 0x3, 0x6) pread64(r4, &(0x7f0000000340)=""/129, 0x81, 0x6) (async) sendmsg$nl_xfrm(r8, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000440)=ANY=[@ANYRES16=r1, @ANYRES8=r0, @ANYRESHEX=r1, @ANYBLOB="0000000000000000040000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000010000000000000044000500000000000000000000000000e0ffffff000000022b0000000a000000fe8000000000000000000000000000aa0000000004"], 0xfc}, 0x1, 0x0, 0x0, 0x20008000}, 0x0) (async) r9 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r9, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x33}}, 0x10) setsockopt$sock_int(r9, 0x1, 0x6, &(0x7f0000000000)=0x4, 0x4) (async) r10 = socket(0x2b, 0x80801, 0x1) setsockopt$inet6_mtu(r10, 0x29, 0x1e, 0x0, 0x15) connect$inet(r9, &(0x7f0000000040)={0x2, 0x0, @broadcast}, 0x10) sendmmsg$inet(r9, &(0x7f0000004d00)=[{{0x0, 0x6000, 0x0, 0x0, 0x0, 0x0, 0x30000}}], 0x400000000000284, 0xf00) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, 0x0, 0x0) r11 = openat$cgroup_pressure(r4, &(0x7f0000000040)='io.pressure\x00', 0x2, 0x0) write$cgroup_pressure(r11, &(0x7f0000000080)={'some', 0x20, 0x2000000008, 0x20, 0x10000000fffff}, 0x2f) close(0x4) 4.665651558s ago: executing program 0 (id=3720): bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000400)=@bpf_lsm={0x6, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="1800000000000000000000000300000800000000000000ff62000000020000009500000000000000"], &(0x7f0000000100)='GPL\x00', 0x5, 0xdb, &(0x7f0000000700)=""/219, 0x0, 0x85}, 0x94) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000880)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f0000000500)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000580)=[@op={0x2a, 0x117, 0x3, 0x1}, @op], 0x4}, {0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000280)="9d743c98d6ba81ce36d9efebfb6de188b7b617f3d155b430231050738b9aaeba5db4f14f166043fc6657ba56868d9a1444b779e27d584d557c50ef38b1662cfa43ebd2d820caeb07be36f11ea68da7b6cee5a11f46592f4380025bfe93a0e0fffef7ae6033cae128915a7cc47209cd7b7387efb03bae9746"}], 0x0, &(0x7f0000000340)=[@assoc={0x0, 0x117, 0x4, 0x3c0c}, @assoc={0x0, 0x117, 0x4, 0x18}], 0x0, 0x10}], 0x1, 0x800) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r2 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8916, &(0x7f0000001040)={'lo\x00', {0x2, 0x4e1c, @broadcast}}) r3 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r3, 0x89f1, &(0x7f0000000000)={'ip6tnl0\x00', &(0x7f00000005c0)={'syztnl0\x00', 0x0, 0x0, 0x10, 0x0, 0x4, 0x40, @ipv4={'\x00', '\xff\xff', @loopback}, @loopback={0xfec0ffff00000000, 0xffff8881114a4aa8}, 0x10, 0x8, 0x5, 0x77f87502}}) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x400, 0x0) ioctl$F2FS_IOC_START_ATOMIC_WRITE(r4, 0xf501, 0x0) 4.472640799s ago: executing program 0 (id=3721): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f00000003c0)) r2 = socket$netlink(0x10, 0x3, 0x4) write(r2, &(0x7f0000000040)="2700000014000707030e0000120f0a0011000100f5fe009d2fb112ff000000008a151f75080039", 0x27) sendmsg$ETHTOOL_MSG_PAUSE_SET(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)={0x2c, r1, 0x431, 0x70bd28, 0x25dfdbfe, {}, [@ETHTOOL_A_PAUSE_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'gretap0\x00'}]}]}, 0x2c}, 0x1, 0x0, 0x0, 0x2004e910}, 0x40) r3 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) r4 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r4, &(0x7f0000000140)='^', 0x34000, 0x0, &(0x7f0000004ff0)={0x2, 0x0, @rand_addr=0xfffffffffffffffe}, 0x10) listen(r4, 0xfff) r5 = accept4(r4, 0x0, 0x0, 0x0) getsockopt$inet_sctp_SCTP_GET_ASSOC_STATS(r5, 0x84, 0x70, &(0x7f0000000180)={0x0, @in={{0x2, 0x4e20, @loopback}}, [0x7, 0x2, 0x925, 0xffffffff00000001, 0xc42, 0x200, 0x6e1, 0x2090c5d2, 0xffffffffffff77ae, 0x2, 0x4, 0x7, 0x100000001, 0x2, 0x9]}, &(0x7f00000000c0)=0x100) ioctl$INCFS_IOC_GET_FILLED_BLOCKS(r3, 0x80286722, &(0x7f00000000c0)={&(0x7f0000000080)=""/21, 0x15, 0x6, 0xfffffffd}) ioctl$XFS_IOC_FD_TO_HANDLE(r3, 0xc038586a, &(0x7f0000000200)={r3, &(0x7f0000000100)='@$\\,-\xbf.1\x00', 0x4000, &(0x7f0000000140)={@align=0xf, {0x1ff, 0x0, 0x1, 0x7f}}, 0x10000, &(0x7f0000000180)={@_ha_fsid}, &(0x7f00000001c0)=0x60000}) r7 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000280), 0xffffffffffffffff) sendmsg$TIPC_NL_BEARER_ADD(r6, &(0x7f0000000380)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000340)={&(0x7f00000002c0)=ANY=[@ANYBLOB="80000000", @ANYRES16=r7, @ANYBLOB="000827bd7000fbdbdf25150000000c00018008000300020000005400028044000380080001000300000008000100080000000800020f000000000800010004000000080002001db200000800020006000000080002000100000008000200080000000c00038008000100000000000c00078008000200540b0000"], 0x80}, 0x1, 0x0, 0x0, 0x4800}, 0x14) sendmsg$netlink(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000001240)={0x48, 0x37, 0x1, 0x0, 0x0, "", [@nested={0xfffffffffffffcd8, 0x119}, @nested={0x34, 0x11, 0x0, 0x1, [@nested={0x2f, 0xcf, 0x0, 0x1, [@generic="d478b585fcf4962925eb81095dd3d92e983e841d6ef7368187237f5e91a74d57e8aaee05ec6319", @nested={0x4, 0x95}]}]}]}, 0x48}], 0x1, 0x0, 0x0, 0x84}, 0x300) 4.472021275s ago: executing program 1 (id=3722): r0 = socket$nl_rdma(0x10, 0x3, 0x14) accept(0xffffffffffffffff, &(0x7f00000005c0)=@vsock, &(0x7f0000000640)=0x80) read(r0, &(0x7f0000000040)=""/64, 0xe) ioctl$F2FS_IOC_MOVE_RANGE(r0, 0xc020f509, &(0x7f00000002c0)={r0, 0xbf40, 0xfe00000000000000, 0xffffffffffffffff}) ioctl$EXT4_IOC_MOVE_EXT(r1, 0xc028660f, &(0x7f0000000300)={0x0, r0, 0x45b5, 0x8, 0x1, 0x2}) sendmsg$RDMA_NLDEV_CMD_RES_GET(r0, &(0x7f0000000540)={0x0, 0x63, &(0x7f0000000080)={&(0x7f0000000380)=ANY=[@ANYBLOB="100000000914e73f"], 0x4e}}, 0x20008000) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_buf(r2, 0x29, 0x20, &(0x7f00000000c0)="0bbb268dd6ffa80800000000000000000000210d0000aaa8fa017242ba9380d41100000000000000290000003b000000", 0xfe60) r3 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r3, &(0x7f0000000480)={0xa, 0x4e20, 0x1, @private2, 0x2}, 0x1c) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000680)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01020000000000000000010000000900010073797a30000000002c000000030a01080000000000000000010000000900030073797a32000000000900010073797a30000000005c000000060a010400000000000000000100000008000b40000000000900010073797a300000000034000480300001800a0001006d61746368000000200002800c000300b07346e358c219250800010023707500080002"], 0xd0}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) sendmsg$NFT_MSG_GETTABLE(r4, &(0x7f0000000b40)={0x0, 0x0, &(0x7f0000000b00)={&(0x7f0000000180)=ANY=[@ANYBLOB="14000000040a0101"], 0x14}, 0x1, 0x0, 0x0, 0x444}, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000740)=ANY=[@ANYBLOB="5e000000100001002cbd7000f9dbdf25000000065cfe6064dbc58b1f297bb013a723191a310756eff130d33400dbe66fc990b40e18a8d4e55d447299c50ece3f850d012cd5ecad7abdafa1089cd8a44cbb9f8bb4dfa273c77b87f54290bb734b3ba75e585b8319fc3c52", @ANYRES32=0x0, @ANYBLOB="1588040003010400050021000900000017002400191ee5f27b2c9ce3dbd996f06dd5ab5cfd49f000"], 0x40}, 0x1, 0x0, 0x0, 0x40801}, 0x400c080) r6 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$devlink(&(0x7f0000008280), r6) sendmsg$DEVLINK_CMD_SB_POOL_GET(r6, &(0x7f00000084c0)={0x0, 0x0, &(0x7f0000008480)={&(0x7f0000000800)=ANY=[@ANYBLOB="8600"/17, @ANYRESDEC=r2, @ANYBLOB="010026bd7000fddbdf250f0000000e0001006e657464657673696d0000000f0002006e657464657673696d30000008000b00018000000600110006000000"], 0x44}, 0x1, 0x0, 0x0, 0x24000084}, 0x40080) syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) socket$nl_generic(0x10, 0x3, 0x10) r7 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r7, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x320, 0x150, 0x168, 0x9, 0x150, 0xb, 0x250, 0x250, 0x250, 0x250, 0x250, 0x3, 0x0, {[{{@ipv6={@remote, @rand_addr=' \x01\x00', [], [], 'veth0_to_bridge\x00', 'sit0\x00', {}, {}, 0x6c}, 0x6000000, 0x108, 0x150, 0x0, {0x0, 0x28e}, [@common=@inet=@ipcomp={{0x30}, {[], 0x74c8aad696aabd1d}}, @common=@inet=@ipcomp={{0x30}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@mcast2, 'dvmrp0\x00'}}}, {{@uncond, 0x0, 0xd0, 0x100, 0x0, {}, [@common=@inet=@set2={{0x28}}]}, @common=@inet=@SET2={0x30, 'SET\x00', 0x2, {{}, {0x2}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x380) socket$inet_udp(0x2, 0x2, 0x0) bind$inet(0xffffffffffffffff, &(0x7f00000003c0)={0x2, 0x0, @loopback}, 0x10) r8 = socket$netlink(0x10, 0x3, 0x0) r9 = socket(0x28, 0x3, 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) sendmsg$nl_route(r9, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="300000001c000104000000000000000002000000", @ANYRES32=r11, @ANYBLOB="000011000a0001000180c2000004000000000f0001000000"], 0x30}}, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000000)={'lo\x00'}) 4.468428732s ago: executing program 4 (id=3723): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x275a, 0x0) mmap(&(0x7f0000002000/0x3000)=nil, 0x3000, 0x0, 0x12, r0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000000)={&(0x7f00000000c0)=ANY=[@ANYBLOB="9feb010020000000000c00a7551e6c59fcdb4b8843d17360"], &(0x7f0000001f80)=""/226, 0x26, 0xe2, 0x6}, 0x28) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=@newlink={0x64, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x585d}, [@IFLA_AF_SPEC={0x1c, 0x1a, 0x0, 0x1, [@AF_INET6={0x18, 0xa, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @private2}]}]}, @IFLA_IFNAME={0x14, 0x3, 'ipvlan0\x00'}, @IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @ipvlan={{0xb}, {0x4}}}]}, 0x64}, 0x1, 0x0, 0x0, 0x840}, 0x0) 4.388163091s ago: executing program 4 (id=3724): r0 = socket(0x2, 0x80805, 0x0) socket$netlink(0x10, 0x3, 0x0) (async) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r2, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x1c}}, 0x0) (async) sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r2, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x1c}}, 0x0) r3 = socket$inet6_mptcp(0xa, 0x1, 0x106) setsockopt$inet6_tcp_int(r3, 0x6, 0x24, &(0x7f0000000000)=0x8, 0x4) getsockname$packet(r2, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32=r4, @ANYBLOB="f5ff0f00252155b21c0012000c000100626f6e64000000000c0002000800010001"], 0x3c}}, 0x40000) socket$nl_route(0x10, 0x3, 0x0) (async) r5 = socket$nl_route(0x10, 0x3, 0x0) socket(0x10, 0x803, 0x2) (async) r6 = socket(0x10, 0x803, 0x2) syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), r6) getsockname$packet(r6, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000003c0)=0x14) (async) getsockname$packet(r6, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000003c0)=0x14) r7 = socket(0x1, 0x803, 0x0) socket$igmp6(0xa, 0x3, 0x2) (async) r8 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$IP6T_SO_SET_ADD_COUNTERS(r8, 0x29, 0x41, &(0x7f00000002c0)={'security\x00', 0x4, [{}, {}, {}, {}]}, 0x68) getsockname$packet(r7, &(0x7f0000000400)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000500)=0x14) sendmsg$nl_route(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000006c0)=ANY=[@ANYBLOB="4c0000001000030428bd7800fcdbdf2500000000", @ANYRES32=0x0, @ANYBLOB="46060900000049875850a8dd5633b27645ca00001c00f27f09000100766c616e000000000c0002800600010002000000080005008b5f92a24e1f0c4e75c41711ef2d0b8ce25d5ffc6c0ac041c96d55f1d1598fd20d8c067e02c2c7401d21212d33eb0f8e680587e846c0d949e73a3304227395a0e22d49d9e09f71e10499dc9c93a9d2cb17c28dbc4b", @ANYRES32=r9, @ANYBLOB="0800040005000000"], 0x4c}, 0x1, 0x0, 0x0, 0x600}, 0x0) r10 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_timeval(r10, 0x1, 0x14, &(0x7f00000002c0)={0x77359400}, 0x10) (async) setsockopt$sock_timeval(r10, 0x1, 0x14, &(0x7f00000002c0)={0x77359400}, 0x10) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f0000000840)={0x0, 0x68, &(0x7f0000000780)=[@in={0x2, 0x4e23, @rand_addr=0x64010102}, @in={0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0xe}}, @in6={0xa, 0x4e24, 0x9ca, @mcast1, 0xb6}, @in6={0xa, 0x4e21, 0xc09, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x5}, @in={0x2, 0x4e21, @initdev={0xac, 0x1e, 0x1, 0x0}}]}, &(0x7f0000000940)=0x10) (async) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f0000000840)={0x0, 0x68, &(0x7f0000000780)=[@in={0x2, 0x4e23, @rand_addr=0x64010102}, @in={0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0xe}}, @in6={0xa, 0x4e24, 0x9ca, @mcast1, 0xb6}, @in6={0xa, 0x4e21, 0xc09, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x5}, @in={0x2, 0x4e21, @initdev={0xac, 0x1e, 0x1, 0x0}}]}, &(0x7f0000000940)=0x10) setsockopt$inet_sctp_SCTP_MAX_BURST(r0, 0x84, 0x14, &(0x7f0000000980)=@assoc_value={r11, 0x4}, 0x8) sendmsg$nl_route(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000680)=ANY=[@ANYBLOB="3c00000010000305000000000007000000000000", @ANYRES32=0x0, @ANYBLOB="0000000006100000140012800b00010062726964676500000400028008000a00", @ANYRES32=r4], 0x3c}, 0x1, 0x0, 0x0, 0x800}, 0x440b0) r12 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0a00000004000000ff0f000007"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1f, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r12, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000080ff7f00b70400000000000085000000c300000095"], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x80000}, 0x94) (async) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1f, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r12, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000080ff7f00b70400000000000085000000c300000095"], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x80000}, 0x94) r13 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000340)={r13, 0x2000002, 0xe, 0x0, &(0x7f00000004c0)="df034affffffffffff0000000000", 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x4c) sendmmsg$inet_sctp(r0, &(0x7f00000032c0)=[{&(0x7f00000000c0)=@in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, &(0x7f00000004c0)=[{&(0x7f0000000100)='a', 0xdd02}], 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="3000000000000000840000ec59f806e80001000000000000000c00"/49, @ANYRES32=0x0], 0x30}], 0x1, 0x0) 4.334756192s ago: executing program 3 (id=3725): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$kcm(0x11, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) sendmsg$nl_route_sched(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000580)=@gettaction={0x114, 0x32, 0x4, 0x70bd25, 0x25dfdbfb, {}, [@action_gd=@TCA_ACT_TAB={0x1c, 0x1, [{0xc, 0x15, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x80000000}}, {0xc, 0x4, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'nat\x00'}}]}, @action_dump_flags=@TCA_ROOT_FLAGS={0xc}, @action_dump_flags=@TCA_ROOT_FLAGS={0xc, 0x2, {0x1}}, @action_gd=@TCA_ACT_TAB={0x4}, @action_dump_flags=@TCA_ROOT_TIME_DELTA={0x8, 0x4, 0xc}, @action_gd=@TCA_ACT_TAB={0x68, 0x1, [{0x10, 0x92, 0x0, 0x0, @TCA_ACT_KIND={0x9, 0x1, 'vlan\x00'}}, {0x10, 0x1a, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'skbmod\x00'}}, {0xc, 0x1, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x8}}, {0x10, 0x11, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'police\x00'}}, {0xc, 0x1d, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x6}}, {0xc, 0x4, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'bpf\x00'}}, {0x10, 0x9, 0x0, 0x0, @TCA_ACT_KIND={0x9, 0x1, 'gact\x00'}}]}, @action_gd=@TCA_ACT_TAB={0x58, 0x1, [{0xc, 0x19, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x35d7}}, {0xc, 0x9, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0xd8d3}}, {0xc, 0x0, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0xb}}, {0xc, 0x17, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'ipt\x00'}}, {0x10, 0x10, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'mirred\x00'}}, {0x14, 0xa, 0x0, 0x0, @TCA_ACT_KIND={0xd, 0x1, 'connmark\x00'}}]}]}, 0x114}, 0x1, 0x0, 0x0, 0x20000001}, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) sendto$packet(0xffffffffffffffff, 0x0, 0x0, 0x4, 0x0, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x8000, 0x0) close(r4) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r7 = syz_genetlink_get_family_id$nbd(&(0x7f0000000100), 0xffffffffffffffff) r8 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NBD_CMD_RECONFIGURE(r8, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="810902000000000000000300000008000100000000001c000780180001"], 0x38}, 0x1, 0x0, 0x0, 0x2008810}, 0x48080) sendmsg$nl_route_sched(r5, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000180)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdc01, {0x0, 0x0, 0x0, r6, {0x0, 0x8}, {0xffff, 0xb}, {0xffff, 0xffe0}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0xc, 0x8, 0x0, 0xffff0001, 0x5, 0x4, 0x8001, 0x401, 0x6}}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x240040e0}, 0x4890) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) sendmsg$kcm(r1, &(0x7f00000000c0)={&(0x7f0000000380)=@xdp={0x2c, 0x8, r6, 0x3a}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000140)='\a', 0x1}], 0x1}, 0x400d5) 4.219648604s ago: executing program 1 (id=3726): sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000000480)=[{{&(0x7f0000000040)={0xa, 0x4e23, 0xb, @loopback, 0x1}, 0x1c, &(0x7f0000000380)=[{&(0x7f0000000140)='2', 0x1}], 0x1}}], 0x1, 0x8000) socket$nl_route(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) connect$inet6(0xffffffffffffffff, &(0x7f0000000180)={0xa, 0x4e22, 0xcc15, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x9}, 0x1c) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(0x0) splice(r0, 0x0, 0xffffffffffffffff, 0x0, 0xf3a, 0x0) mkdirat$cgroup(0xffffffffffffffff, &(0x7f0000000000)='syz0\x00', 0x1ff) bpf$PROG_LOAD(0x5, 0x0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000380)='memory.events\x00', 0x275a, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='memory.events\x00', 0x7a05, 0x1700) r3 = socket$inet_mptcp(0x2, 0x1, 0x106) bind$inet(r3, &(0x7f0000000080)={0x2, 0x4e24, @multicast2}, 0x10) connect$inet(r3, &(0x7f0000000140)={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x21}}, 0x10) writev(r3, &(0x7f0000000200)=[{&(0x7f00000000c0)='X', 0x8030000}], 0x11) shutdown(r3, 0x1) write$cgroup_int(r2, &(0x7f0000000200)=0x10001, 0x12) sendfile(r2, r1, 0x0, 0xf03a0005) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x7a44, 0x1700) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = socket$nl_generic(0x10, 0x3, 0x10) syz_emit_ethernet(0x2a, &(0x7f00000000c0)={@local, @random="fad1e048716e", @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x4e20, 0x8}}}}}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0200000004000000"], 0x50) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f0000000400)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r7, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000000)={0x24, r8, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r9}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0xb}]}, 0x24}, 0x1, 0x0, 0x0, 0x400c000}, 0x0) sendmsg$NL80211_CMD_SET_MCAST_RATE(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRESDEC=r1, @ANYRES64=0x0, @ANYRES64=r4], 0x24}, 0x1, 0x0, 0x0, 0x4c040}, 0x24008840) 4.172530059s ago: executing program 4 (id=3727): unshare(0x6a040000) (async) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff) mkdirat$cgroup_root(0xffffffffffffff9c, 0x0, 0x1ff) (async) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280), 0x200002, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x40841, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) (async) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-serpent-avx2\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, 0x0, 0x0) (async) r3 = accept4(r2, 0x0, 0x0, 0x80800) sendmmsg$alg(r3, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) (async) recvmsg(r3, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) (async) r4 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) (async) write$tun(r1, &(0x7f0000000280)=ANY=[@ANYBLOB="04000000ffffffffffffa2aaaaaaaaaa86dd60b79a56004c2900fe8000000000000009002000000000aaff030000ecff0000000000000000000132000400083006"], 0x86) (async) r5 = openat$cgroup_procs(r0, &(0x7f00000002c0)='cgroup.procs\x00', 0x2, 0x0) (async) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r6, &(0x7f0000000100)=ANY=[], 0x32600) (async) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r6, 0x0) (async) r7 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_int(r7, 0x29, 0x49, &(0x7f0000000180)=0x2800, 0x4) (async) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) (async) write$cgroup_pid(r5, &(0x7f00000000c0), 0x12) pread64(r5, &(0x7f0000001840)=""/4096, 0x1000, 0x1) (async) r8 = socket$inet(0xa, 0x801, 0x84) connect$inet(r8, &(0x7f0000004cc0)={0x2, 0x4e22, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) (async) listen(r8, 0x28) (async) r9 = accept4(r8, 0x0, 0x0, 0xc0000) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r9, 0x84, 0x7a, &(0x7f0000000340)={0x0, @in6={{0xa, 0x3, 0x4, @mcast1}}}, &(0x7f0000000040)=0x84) (async) openat$cgroup_procs(0xffffffffffffffff, &(0x7f00000002c0)='cgroup.procs\x00', 0x2, 0x0) 4.139472222s ago: executing program 0 (id=3728): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r1) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) ioctl$sock_bt_hidp_HIDPGETCONNINFO(0xffffffffffffffff, 0x800448d3, &(0x7f0000000280)={@any, 0x9, 0x81, 0x4, 0x6b0, 0x7f, "22cc0f40031afd0f66e0f167c2b0becb7ea27c566f1bdec78f4c0bbd464d0612172c397dbf0bfcf45132276fff0e45562cb24fc21539579c061518a0e6192ef865ce0ae2e69be70cc9f44538435e0cd533e9f380367d80bde2eb648f7a662082830ff81d5a6bea549e853a315db082310ff02815d62cf4bfe9a7180dbbdd577a"}) sendmsg$DEVLINK_CMD_RATE_NEW(0xffffffffffffffff, 0x0, 0x800) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="4c00df250700"/20, @ANYRES32=0x0, @ANYBLOB="31020500001002000800230002000000080004000100000008000d00e62200000a0001000180c2000002"], 0x4c}, 0x1, 0x0, 0x0, 0x20044850}, 0x8000) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r4 = socket(0x400000000010, 0x3, 0x0) r5 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000540)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x70bd27, 0xffffffff, {0x0, 0x0, 0x0, r6, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x2}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x4, 0xffff2153, 0x2, 0xb, 0xd, 0x1c4, 0x7, 0x2, 0x6}}}}]}, 0x58}}, 0x0) r7 = socket$unix(0x1, 0x1, 0x0) r8 = socket$unix(0x1, 0x1, 0x0) r9 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r9, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000340)=@newtfilter={0x84, 0x2c, 0xd27, 0x30bd29, 0x25dfdc00, {0x0, 0x0, 0x0, r10, {0x4, 0x5}, {}, {0x7, 0x5}}, [@filter_kind_options=@f_matchall={{0xd}, {0x50, 0x2, [@TCA_MATCHALL_ACT={0x4c, 0x2, [@m_ife={0x48, 0x1, 0x0, 0x0, {{0x8}, {0x20, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c, 0x1, {{0x4, 0xb, 0x10000000, 0x9, 0x3}}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x3}}}}]}]}}]}, 0x84}, 0x1, 0x0, 0x0, 0x20048091}, 0x0) r11 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x149540, 0x0) close(r11) socket$nl_route(0x10, 0x3, 0x0) ioctl$SIOCSIFHWADDR(r11, 0x8914, &(0x7f0000000000)={'syzkaller0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}}) r12 = socket$kcm(0x11, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$kcm(r12, &(0x7f00000001c0)={&(0x7f0000000840)=@xdp={0x2c, 0x7, r13, 0x31}, 0x80, &(0x7f00000000c0)=[{&(0x7f00000002c0)='\x00', 0x5dc}], 0x1}, 0x4) sendmsg$NFT_BATCH(r2, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a5c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc200011800e000100636f6e6e6c696d69740000040c00028008000140fffff27414000000110001"], 0x84}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$NFT_BATCH(r1, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSETELEM={0x40, 0xc, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x6}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x14, 0x3, 0x0, 0x1, [{0x10, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0xc, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0x6, 0x1, '\x00\x00'}]}]}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x68}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) 367.580891ms ago: executing program 1 (id=3729): unshare(0x6a040000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) socket$netlink(0x10, 0x3, 0xf) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmmsg$inet(0xffffffffffffffff, 0x0, 0x0, 0x20008880) shutdown(0xffffffffffffffff, 0x1) getsockopt$inet_sctp6_SCTP_DELAYED_SACK(0xffffffffffffffff, 0x84, 0x10, 0x0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(0xffffffffffffffff, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, &(0x7f0000000080)) syz_genetlink_get_family_id$nl80211(0x0, r1) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_GET_FTM_RESPONDER_STATS(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000140)={0x1c, r3, 0x601, 0x70bd2c, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r4}, @void}}}, 0x1c}, 0x1, 0x0, 0x0, 0x40000}, 0x20040844) getsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(0xffffffffffffffff, 0x84, 0x72, &(0x7f00000006c0)={0x0, 0x353}, &(0x7f0000000700)=0xc) r5 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r5, &(0x7f0000000040)={0x2, 0x4e23, @private=0xa010101}, 0x10) sendmsg$IPVS_CMD_ZERO(0xffffffffffffffff, &(0x7f0000000680)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x14}, 0x4040080) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x2c3dfa0909aa2eff, &(0x7f0000000000)={&(0x7f0000000200)=ANY=[@ANYBLOB="240000002000010327bd7000ffdbdf2502"], 0x24}, 0x1, 0x0, 0x0, 0x240480d4}, 0x0) 365.259825ms ago: executing program 0 (id=3730): socket$inet6_sctp(0xa, 0x1, 0x84) sendmsg$TIPC_CMD_GET_LINKS(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000340)={0x24, 0x0, 0x800, 0x70bd25, 0x25dfdbff, {{}, {}, {0x8, 0x11, 0x2}}, ["", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0xc000}, 0x1) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) connect$inet6(r0, &(0x7f0000000300)={0xa, 0x1, 0xfffffffe, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x2e}}}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f00000000c0), 0x4) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000280)=@gcm_256={{0x303}, "1afc7c14d332bcc6", "a9ba0c85d68723369f51322151d9f41aaa2832bb07cc1e49ad714beac6f1ade8", "49960d8f", "bff2a81527ae4190"}, 0x38) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nbd(&(0x7f0000000200), r1) sendmsg$NBD_CMD_CONNECT(r1, &(0x7f00000027c0)={0x0, 0x0, &(0x7f0000002780)={&(0x7f00000002c0)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010029bd7000fbdbdf25010000000c00020000000000000000001c0007801800018008000100", @ANYBLOB="04"], 0x3c}, 0x1, 0x0, 0x0, 0x4000004}, 0x4000) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='freezer.state\x00', 0x275a, 0x0) write$cgroup_int(r3, &(0x7f0000000000), 0xffffff6a) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r3, 0x84, 0x1d, &(0x7f0000000100)={0x6, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, &(0x7f00000001c0)=0x1c) r4 = socket$inet6_sctp(0xa, 0x1, 0x84) sendmsg$IEEE802154_ASSOCIATE_RESP(r1, &(0x7f0000000600)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0x30, 0x0, 0x800, 0x70bd26, 0x25dfdbfd, {}, [@IEEE802154_ATTR_STATUS={0x5, 0x3, 0x3}, @IEEE802154_ATTR_COORD_HW_ADDR={0xc, 0x9, {0xaaaaaaaaaaaa0102}}, @IEEE802154_ATTR_COORD_SHORT_ADDR={0x6, 0x8, 0xfffe}]}, 0x30}, 0x1, 0x0, 0x0, 0x40}, 0x4000) r5 = socket$inet6_sctp(0xa, 0x6, 0x84) setsockopt$MRT_DEL_VIF(r3, 0x0, 0xcb, 0x0, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) r7 = socket$nl_crypto(0x10, 0x3, 0x15) sendmsg$nl_crypto(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[], 0xe0}}, 0x0) sendmsg$nl_crypto(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000340)=ANY=[], 0xf0}, 0x1, 0x0, 0x0, 0x4004080}, 0x0) sendmsg$NFT_MSG_GETCHAIN(r6, &(0x7f0000000440)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x800800}, 0xc, &(0x7f0000000400)={&(0x7f00000004c0)=ANY=[@ANYBLOB="20000000040a010100000000000000000a0000010900030073797a320000000083df0a63f183422e4215036c08a6377775327d731a22565a505990290b084f38d7af564b530c79f51a3b1c74ad86292d882cae"], 0x20}, 0x1, 0x0, 0x0, 0x40}, 0x80) r8 = socket$tipc(0x1e, 0x2, 0x0) bind$bt_hci(r8, &(0x7f0000000040), 0x6) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r5, 0x84, 0x64, &(0x7f0000000000)=[@in={0x2, 0x4e22, @empty}], 0x10) listen(r5, 0x3) sendmsg$inet6(r4, &(0x7f0000001dc0)={&(0x7f0000000840)={0xa, 0x4e22, 0x906, @mcast2, 0x7}, 0x1c, &(0x7f0000001d40)=[{&(0x7f0000000880)="fa", 0x1}], 0x1}, 0x40085) socket$netlink(0x10, 0x3, 0x4) writev(0xffffffffffffffff, &(0x7f0000000000)=[{0x0}], 0x1) sendfile(r0, r3, 0x0, 0x20000000002) 278.147569ms ago: executing program 3 (id=3731): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r0, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x20, &(0x7f00000003c0)=[@in={0x2, 0x4e24, @initdev={0xac, 0x1e, 0x3, 0x0}}, @in={0x2, 0x4e24, @remote}]}, &(0x7f0000000340)=0x10) r2 = socket$inet6_mptcp(0xa, 0x1, 0x106) setsockopt$inet6_tcp_int(r2, 0x6, 0x1, &(0x7f0000000100), 0x4) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f00000000c0)={r1, @in={{0x2, 0x0, @empty}}, 0x0, 0x0, 0x0, 0x0, 0xce024d}, 0x9c) 77.839044ms ago: executing program 2 (id=3732): r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000080)={@mcast1, 0x800, 0x0, 0x103, 0x1, 0x3}, 0x20) setsockopt$inet6_int(r0, 0x29, 0x1000000000021, &(0x7f0000000040)=0x5, 0x4) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000200), 0xffffffffffffffff) sendmsg$TIPC_NL_KEY_SET(r1, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000000)=ANY=[@ANYBLOB='\\\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="130823bd7000fddbdf2517000000480006804400040067636d286165732900000000000000000000000000000000000000000000008e5f"], 0x5c}, 0x1, 0x0, 0x0, 0x20048044}, 0x20008000) sendmsg$inet6(r0, &(0x7f00000000c0)={&(0x7f0000000100)={0xa, 0x4e20, 0x80000, @loopback, 0xffee}, 0x1c, 0x0, 0x0, &(0x7f0000000140)=ANY=[], 0x28}, 0x14) r3 = socket(0x2a, 0x2, 0x0) getsockname$packet(r3, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000001480)=0x14) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000440)=@newqdisc={0x44, 0x24, 0xf0b, 0x0, 0x8, {0x0, 0x0, 0x0, r4, {}, {0xffff, 0xffff}, {0x0, 0xfff1}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_RSC={0x10, 0x1, {0x7, 0x7, 0x19}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000084}, 0x44884) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000500)=@newtfilter={0x884, 0x2c, 0xd27, 0x70bd25, 0x25dfdffd, {0x0, 0x0, 0x0, r4, {0x6}, {}, {0x8, 0x6}}, [@filter_kind_options=@f_route={{0xa}, {0x854, 0x2, [@TCA_ROUTE4_POLICE={0x850, 0x5, [@TCA_POLICE_RATE={0x404, 0x2, [0xffff, 0x80, 0x800, 0x5, 0xf8a, 0x75, 0x7fffffff, 0x4, 0x7fffffff, 0x1, 0xfffffffb, 0x4, 0x6, 0x4, 0x8, 0x2, 0x0, 0x1, 0x8, 0x7ff, 0xdb, 0x72f4, 0x6, 0x7, 0xd6, 0x0, 0x7, 0x3, 0x2, 0x5a18, 0x2a, 0x5, 0xa, 0x5, 0x6, 0x6, 0x1, 0x0, 0x5, 0xd, 0x6, 0xe60, 0x3a, 0x14, 0x31, 0xc4e2, 0xbf3, 0xfffffff7, 0x2, 0x8, 0x50, 0xfffffff2, 0x8, 0x8, 0x80000001, 0xfffffff7, 0x671b, 0x0, 0x1, 0x9, 0x36, 0xd, 0x79, 0x0, 0x9, 0x8, 0x8, 0x4, 0x10, 0x722b, 0x3f38b6fd, 0x7, 0x4, 0xcb8, 0x713e, 0x8, 0x9, 0x5, 0x33b1026, 0xe9de, 0xf6, 0xd, 0xc, 0x7800000, 0xc1, 0x6f, 0x5, 0x8, 0x2, 0x4, 0xace1, 0x4, 0x6, 0x2, 0x4, 0xff, 0x87, 0x99cf, 0xf, 0x306, 0x6505, 0x4, 0x98, 0x3, 0x6, 0x1, 0x5ba, 0x8, 0x0, 0x7ff, 0x7ff, 0x6, 0x7fffffff, 0x8, 0x3c00000, 0x101, 0xf98, 0x5, 0xc46c, 0x8, 0x7, 0x3b, 0x9, 0xffffffff, 0x81, 0x2, 0x5, 0x1, 0x1000, 0x200, 0xc51, 0x6ee2, 0xe81, 0x8901, 0x2, 0x4, 0x3, 0x7, 0x7b9, 0xfa, 0x40, 0xe, 0x6, 0x9, 0x7fffffff, 0x7fffffff, 0x4ff5a575, 0xc6b7, 0x1, 0xffff8001, 0x40, 0xff, 0x7, 0x5, 0x6e7, 0x3, 0x1, 0xa434, 0xffff, 0x6, 0x6, 0x6, 0x9, 0x4, 0xfffffff7, 0x10001, 0xfffffffa, 0x0, 0x3, 0x3, 0xffffffff, 0x5, 0x357a, 0x1, 0x1, 0x4, 0x4, 0x6, 0x7f, 0x7, 0x8, 0x3, 0x10001, 0xcbf, 0x7, 0x5, 0xf6, 0x8, 0x4, 0x9f8, 0x9, 0x6, 0x1, 0x9, 0x8, 0xff, 0x1ff, 0x2b, 0x5, 0x8, 0x9, 0xff, 0x2, 0x2, 0xfffffff8, 0x5, 0xc3, 0x40, 0x7, 0x80000001, 0x4000000, 0x3, 0xffffffff, 0x800, 0x8, 0x4, 0xb, 0x4, 0x8, 0x1, 0x7f, 0x6, 0x1, 0x10000, 0xacd6, 0xfffffff7, 0x200, 0x10001, 0x8, 0xfffffffa, 0x2, 0x2, 0x4, 0x9, 0x6, 0xffff108b, 0xfffffead, 0x0, 0x0, 0x1ff, 0x4, 0x3, 0x8, 0x0, 0xa6d, 0x5c5, 0x2, 0x6, 0x82, 0x3, 0xffffff7d, 0x8001, 0xffffff2d, 0x2, 0x1000, 0x80000000]}, @TCA_POLICE_AVRATE={0x8, 0x4, 0x2}, @TCA_POLICE_TBF={0x3c, 0x1, {0x5, 0x20000000, 0x200, 0xc8, 0x0, {0xa, 0x2, 0x3, 0x1, 0x4, 0x3}, {0x6, 0x1, 0x1, 0xbbc0, 0x9, 0x1}, 0x96f, 0x7f, 0xa}}, @TCA_POLICE_PEAKRATE={0x404, 0x3, [0x0, 0x6, 0x2, 0x7f, 0x3, 0x8, 0x5, 0x3, 0x3, 0x5, 0x80000001, 0x6, 0x0, 0x8, 0x80000000, 0x6032, 0xc2, 0x9, 0x1000, 0x6, 0x6f, 0x7c45, 0x0, 0x5, 0x9, 0x9, 0xef, 0x291d, 0x0, 0x8, 0x1, 0x8, 0x1, 0x0, 0x2, 0x0, 0xf08, 0xb, 0x6, 0x0, 0xf96a, 0x8, 0x2, 0xc791, 0x6597121a, 0x9, 0x25dc, 0x40, 0x0, 0x0, 0x6, 0x93, 0x7, 0x0, 0x7, 0x4, 0xde1, 0x7fffffff, 0xe32, 0x1, 0xfffffff7, 0x9, 0x10000, 0x6ff0, 0x9, 0x0, 0xfffffff9, 0x1, 0x9, 0xb, 0x58000, 0x2bcd, 0x80000001, 0x1, 0x10001, 0x3, 0x19, 0x1, 0xffffffff, 0x8001, 0x1, 0x1, 0x2, 0x9, 0x9, 0x8000, 0x490000, 0xfffffff2, 0xb3f, 0xffffb6fa, 0x4, 0x0, 0x401, 0x5, 0xd, 0x8, 0x401, 0x4, 0x1ff, 0x3, 0x7f, 0x9, 0x5, 0x97, 0x3, 0x3, 0xc, 0xf, 0x3, 0x3ff, 0x4, 0x80000000, 0x10, 0x8, 0x30, 0x0, 0x4, 0x5, 0xb, 0x40, 0xffffffff, 0x7fffffff, 0x6, 0x101, 0x1, 0xfffffff7, 0x3, 0x0, 0xcc, 0x1, 0x26c0, 0x2, 0x1, 0x5, 0x9, 0x9, 0x2, 0xfffffff8, 0xdc88, 0x8, 0x0, 0x3f, 0x7, 0x6, 0x5, 0x3, 0x0, 0x4, 0x2, 0xd, 0x0, 0xbbb, 0x27e, 0x1, 0x75b, 0x8, 0x2, 0x7, 0x2, 0x3, 0x9, 0xfffffffc, 0x5, 0x3, 0x0, 0x9, 0x6, 0x9, 0x1ff, 0x9, 0xa461, 0x8, 0x7, 0x2, 0x800, 0x0, 0x0, 0x6, 0x9, 0x9, 0x49e88dee, 0x3ff, 0x6, 0x6, 0x0, 0x0, 0x9b85, 0x37, 0x800, 0xfffffffe, 0x6, 0x5, 0x6, 0x3, 0x2, 0xd, 0xffffffb4, 0x8000, 0x5, 0xfffffffa, 0x2, 0x3, 0x4a00000, 0x80000001, 0xe71a, 0x6, 0x9, 0x4, 0x2, 0x4, 0x61, 0x1, 0x2, 0xfffffffc, 0x10001, 0x6, 0x2, 0x2, 0x7, 0x7, 0x6, 0x80000000, 0x2, 0x7fff, 0x5, 0xf, 0x401, 0x400, 0xba, 0x8, 0x200, 0x8, 0xb33b, 0x9, 0x7, 0x1, 0x4, 0x8, 0x7, 0x0, 0x2, 0x3, 0x9, 0x0, 0x10, 0xd177, 0x7, 0x6ef, 0x2bd, 0x1, 0x2d, 0xa047, 0xe9e, 0x120000, 0x7, 0x38000]}]}]}}]}, 0x884}}, 0x20004811) bpf$PROG_LOAD(0x5, &(0x7f0000000f80)={0x1, 0xe, &(0x7f00000014c0)=ANY=[@ANYBLOB="b700000081000000bfa300000000000007030000f1feffff720a06fef8ffff929cff71a400fe000000007110bf00000000001d300200000000004704000001ed03040f030000000000001d440000000000006b0a04fe0000000072030000000a0000b500f9ff000000009500000000000000023bc065b58111c6dfa041b63af4a3912435f1a864a710aad58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a7168c50000000190f32050e436fe275daf51efd601b6bf01c8e8b1b526375ec4dd6fcd82e4fe51bef7af9aa0d7d600c095199fe3ff3128e599b0eaebbdbd732c9cc00eec363e4a8f6456e2cc21557c0afc646cb7798b3e6440c2fbdb00a3e35208b0bb0d2cd829e654400e2438ec649dc74a28610643a98d9ec21ead2ed51b104d4d91af25b845d8a7925c3109b151b8b9f75dd08d123deda88c658d42ecbf28bf7076c15b463bebc72f526d8e8afcb913466aaa7f6df70252e79166d858fcd0e06dd31af9612f2460d0b11008e59a5923906f88b53987ad1714e72ba7a54f0c33d39000d06a59ff616276fd9aa58f2477184b6a89adaf17b0a6041bdef728d236619074d6ebdfd1f5089048ddff6da40f9411fe722631cb467600ade70063e5291569b33d21dae356e1c51f03a801be8189679a16da18ec0ae564162a27afea62d84f3a10746443d6438e959532e0617d419c6bc6ea9f2bca4464f56e24e6d2105bd901204a1deeed4155617572652d950ad31928b0b0c3dc2869f478341d02d0f5ad94b081fcd507acb4b9c65fee9d5a17f48a7382f13d000000225d85ae49cee383dc5049076b989b40000000000000da60d2ae20cfb91d6a49964757cdf538f9ce2bdb1ab062cd54e67011d355d84ce97bb0c6b4a595e487efbb2d71cde2c140952f9a0f0bc6980fe78683ac5c0c31032599ddd71063be9261b2e1aab1675b34a26048ef8c12adaef5f510a8f1aded94a129e4aec6f8d9ab06faffc3a15d96c2ea3e2e04cfe031b2875353193f82ade69d0540059fe6c7fe7cd8697502c7596566d674e425da5e87e59602a9f6590521d31d3804b3e0a1053abdc31282dfb15eb6841bb64a1b304502dda787343ce3c953992e4a982f3c48153baae244e7bf37548c7f1a4cad2422ee965a38f7defbd2160242b104e20dc2d9b0c35608d402ccdd9069bd50b994fda7a9de44028d6112a0c2d21b2dc98816106dec28eaeb883418f562ae00003ea96d10f172c0374d6eed826416050000000bfe9b4a9c5a90ff59d54d1f92ecc4e95dd2d18383117c039862198899b212c55318294270a1ad10c80fef7c24d47afce829ba0f85da6d888f18ea40ab959f6074ab2a40d85d15017ab513cdc6c0e57fb1c1ca571380d7b4ead35a385e0b4a26b702396df7e0c1e02b6e4114f244a9bf93f04bf072f0861f7580e69db384ac7eeedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba34015ea5aacb1188883ad2a3b1832371fe5bc621426d1ed0a4a99702cc1b6912a1e717d29135753208165b9cdbae2ed9dc7358f0ebadde0b727f27feeb744ddcc536cbae315c7d1fe1399562ba6824840bd2951680f6f2f9a6a8346962a350845ffa0d829e4f79adc287906943408e6df3c391e97ba48db0a5adbfd03aac93df8866fb010aec0e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00e10000c95265b2bd83d64a532869d701723fedcbada1ee7baa5b6a686b50f0937f778af083e055f6138a757ebd0ed91124a6b244f9acf41ac5d73a008364e0606a594817031fc2f52c8785fe0721719b3d654026c6ea08b83b5703dad844ceb201ddeb6dc5f6a903792283c42efc54fa84323afc4c10eff462c8843187f1dd48ef3fa293774d582956ff0f40b10ca94f6feeb2893c17888e1cdba94a6ea80c33ead5722c3293a493f1479531dd88261458f40d31fe8df15efaaeea831555877f9538d6ee6ba65893ff1f908ba7554ba583fef3ec7932f5954f31a878e2fae6691d1aee1da02ba516467df3e7d1daac43738012e4fee18a22da19fcdb4c2890cda1f96b952511e3a69d694d625e0b2f808890205f3a6da2819d2f9e77c7c64affa54fec0136cbafa5f6f096753b639a924599c1f69219927ea5301fff0a6063d427f0688471f983e9673560000000000000000005a7b57f03ca91a01ba2e30ca99e8ebc15ecb4d91675767999d146aef7799738b292fd640dfef6b04d086f737a159d7e0c6e4d81ad64a8bbca48568325b2969e2b15f36b788bce5ccdbaf75c94cb93e7c0660d80010f5c653d22d490cba8c2a4ab595bf4238f18ca428dafc7ac96d404607a0000000051a2104f22e6db5a62b5089c1b45282d38864daa3ae81d6b0968d1d2867b91b7d120617d12d91db2633d6864da40b54783a17aaeb6737c323f9f98e354cc98dcfe23ad01bd1c61563e69ffe1c2c73e16e1461173f359e93d2c5e424c17998809ec8f0232b3955e052a4cecd89008f70314a0bdec86f9b1eb93d491ec86a4555d89fe0120f64c62e8e3ed8bcb45202c3d4bbec8d722824c0ebca8db1ea4a003d2fbdc1f9be78537756ab5bbe4fe9af5d785d0128171c90d9900ce2532b0f9d00000010000000000df3e1b583cb4e62e754598e47df6bd06431c94bc5d047899fd219f448bf9189c65c9d91eda6b52a373803a9efe44f86909bc90addb7b9aee813df534aac4b3093c91b8068cd84990453f806694d461b76a58d88cf0f520310a1e80dc18cde9ad662eee077515d0a8811922929e085392ab3d1311b8243266d87047f601fa88a0da36b9f302e8262395174328f2482d14008de83070744f143fdec90ba5a82668d5fac114c13955ad6dca5db2231d8ba14c54c47ed04a4b4ace17e357e1d6432399f87a7a14245bbd796a090f3b247b95d37ff40a404bdad74bd20000000000000000000099fef7cd7af3ce64a92f95d89d125b1e641240d7e5e27a3d1f7684448c3e3822d617e205061298b939a191be4b48e169bde2cae3accc5bd40a2968b59c93d35f8e42366fdef9a2abae1cf01ce68abff28861aac8302d268569dd42e194e330c7aaa54ebbcefd23f21ce8153b9926e12e925cb56119df72c7533a48d028ad0c74e2a9478fa3be18a1a2b65079cc1c00000000000000f59dd19e8d525206c0a728cfd42193abe8130bc01a2d69841f3d7799ac04bdc590bb1c89b9c695f163e57343c9bfb59909433c9001c5f8b23e38534a538fc933cac6c2a92d038df638a0f226df9fb857bd414c2cd69985e8053e3dfa41614d7c74d04d8c2471041d17c730fad28395f8d4688898cd58b9d600c851626529bb58aa364b55e73f053450665e7b94ed1012fd7a8139166fd5e59c84f4ab279b1b99c028db4cb9680c8035f967db18de738844da7e260a830c1ffa49f5af3c15423a0e315acb82a3e89218cb314e68fda4d94aa1d815babc13b9fd336d205c5913ef67cf0216e2d81e6127bd9d7fab28800eaab2355992f8ce4cd38add4b272c0bee4076ca4847ffa691cf78fb7ec212bad3bef29f577ea7159b7f3025b3d977ff7c91024cf71126233cb8791c3c2c2e3995a72d2016665f785109db64080d01ff6802f758fdd2c2f5394f00"/2589], &(0x7f00000001c0)='GPL\x00', 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', r4, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000f40), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x94) 0s ago: executing program 3 (id=3733): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket(0x10, 0x803, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'team_slave_1\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000600)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xffe0, 0xffff}}, [@qdisc_kind_options=@q_fq={{0x7}, {0xc, 0x2, [@TCA_FQ_FLOW_REFILL_DELAY={0x8, 0x9, 0xfffffbff}]}}]}, 0x38}, 0x1, 0x0, 0x0, 0x890}, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'bond0\x00', 0x0}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000080)={'veth0\x00', 0x0}) setsockopt$packet_add_memb(r6, 0x107, 0x1, &(0x7f00000004c0)={r7, 0x3, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x29}}, 0x10) ioctl$sock_TIOCINQ(r1, 0x541b, &(0x7f00000001c0)) setsockopt$packet_add_memb(r6, 0x107, 0x1, &(0x7f0000000000)={r7, 0x1, 0x6, @random="790c7edd3d8d"}, 0x10) sendmsg$nl_route(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@newlink={0x44, 0x10, 0xffffffffffffffff, 0x70bd2c, 0x25dedbff, {0x0, 0x0, 0x0, 0x0, 0x56d09, 0x6101}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @ipvlan={{0xb}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r7}, @IFLA_MASTER={0x8, 0xa, r4}]}, 0x44}, 0x1, 0x0, 0x0, 0x14000000}, 0x40040) ioctl$sock_ipv6_tunnel_SIOCCHGPRL(0xffffffffffffffff, 0x89f7, &(0x7f0000000140)={'sit0\x00', &(0x7f00000000c0)={@local, 0x0, 0x0, 0x50, 0x0, [{}, {}, {@empty}, {@dev}, {@broadcast}]}}) kernel console output (not intermixed with test programs): in process `syz.2.2537'. [ 589.070528][ T95] netdevsim netdevsim2 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 589.080036][ T95] netdevsim netdevsim2 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 589.099470][T16473] xt_TCPMSS: Only works on TCP SYN packets [ 589.239827][T16476] bond9: entered promiscuous mode [ 589.263255][T16476] 8021q: adding VLAN 0 to HW filter on device bond9 [ 589.279694][T16478] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2538'. [ 589.387777][T16480] netlink: 212368 bytes leftover after parsing attributes in process `syz.1.2539'. [ 590.106279][ T8120] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 590.286254][T16511] netlink: 104 bytes leftover after parsing attributes in process `syz.3.2547'. [ 590.302129][T16513] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2549'. [ 590.312788][T16511] netlink: 112 bytes leftover after parsing attributes in process `syz.3.2547'. [ 590.474855][T16520] syzkaller1: entered promiscuous mode [ 590.480419][T16520] syzkaller1: entered allmulticast mode [ 591.152172][ T8120] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 591.220067][T16546] netlink: 36 bytes leftover after parsing attributes in process `syz.1.2553'. [ 592.031754][ T8149] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 592.116713][T16581] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2565'. [ 592.186472][ T8120] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 592.358310][T16582] macvtap1: entered allmulticast mode [ 592.371213][T16582] dummy0: entered allmulticast mode [ 592.388138][T16582] dummy0: entered promiscuous mode [ 592.448356][T16582] dummy0: left allmulticast mode [ 592.547970][ T8120] dummy0: left promiscuous mode [ 593.227764][ T8120] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 593.391772][T16623] netlink: 52 bytes leftover after parsing attributes in process `syz.1.2574'. [ 593.401834][T16623] netlink: 'syz.1.2574': attribute type 1 has an invalid length. [ 593.464047][T16625] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2575'. [ 593.668905][T16633] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 594.266999][ T8112] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 594.765248][T16696] netlink: 'syz.3.2596': attribute type 16 has an invalid length. [ 594.773377][T16696] netlink: 'syz.3.2596': attribute type 3 has an invalid length. [ 594.794676][T16696] __nla_validate_parse: 3 callbacks suppressed [ 594.794695][T16696] netlink: 64066 bytes leftover after parsing attributes in process `syz.3.2596'. [ 595.104389][T16699] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2598'. [ 595.188274][ T5365] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 595.310786][ T8112] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 595.719821][ T8149] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 596.178958][T16727] bond11: option arp_all_targets: invalid value (3) [ 596.318097][T16727] bond11 (unregistering): Released all slaves [ 596.354950][ T8113] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 596.412749][T16729] workqueue: Failed to create a rescuer kthread for wq "bond11": -EINTR [ 596.764594][T16736] netlink: 144 bytes leftover after parsing attributes in process `syz.0.2607'. [ 596.952340][T16747] netlink: 'syz.4.2609': attribute type 5 has an invalid length. [ 597.386510][ T8112] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 597.418404][T16763] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2613'. [ 597.479367][T16762] tipc: Enabled bearer , priority 16 [ 597.536796][T16763] hsr_slave_0: left promiscuous mode [ 597.563520][T16765] netlink: 20 bytes leftover after parsing attributes in process `syz.0.2615'. [ 598.280286][ T8150] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 598.427531][ T8113] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 598.929034][T16820] netlink: del zone limit has 8 unknown bytes [ 598.961236][T16822] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2630'. [ 599.077003][T16827] netlink: 'syz.1.2632': attribute type 4 has an invalid length. [ 599.086048][T16827] netlink: 'syz.1.2632': attribute type 8 has an invalid length. [ 599.093918][T16827] netlink: 212 bytes leftover after parsing attributes in process `syz.1.2632'. [ 599.286357][T16826] netlink: 92 bytes leftover after parsing attributes in process `syz.2.2631'. [ 599.466328][ T8113] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 599.774508][T16854] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2641'. [ 599.784531][T16854] netlink: 15 bytes leftover after parsing attributes in process `syz.4.2641'. [ 600.123792][T16867] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2647'. [ 600.326430][T16867] bond10 (unregistering): Released all slaves [ 600.381173][T16882] batadv_slave_1: entered promiscuous mode [ 600.395278][T16884] netlink: 476 bytes leftover after parsing attributes in process `syz.3.2647'. [ 600.450618][T16881] netlink: 92 bytes leftover after parsing attributes in process `syz.1.2650'. [ 600.506461][ T8113] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 600.823753][T16898] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2654'. [ 600.838121][T16898] netlink: 15 bytes leftover after parsing attributes in process `syz.1.2654'. [ 600.894353][T16901] netlink: 'syz.4.2655': attribute type 11 has an invalid length. [ 600.903710][T16901] netlink: 199788 bytes leftover after parsing attributes in process `syz.4.2655'. [ 601.073165][T16910] netlink: 'syz.3.2658': attribute type 1 has an invalid length. [ 601.227452][T16915] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2661'. [ 601.237946][T16917] netlink: 180 bytes leftover after parsing attributes in process `syz.1.2660'. [ 601.247140][T16915] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2661'. [ 601.418444][ T5365] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 601.461419][T16928] IPv6: sit3: Disabled Multicast RS [ 601.463198][T16930] netlink: 'syz.3.2666': attribute type 1 has an invalid length. [ 601.546262][ T8113] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 601.558822][T16930] 8021q: adding VLAN 0 to HW filter on device bond10 [ 601.599425][T16930] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2666'. [ 602.148941][T16974] netlink: 'syz.4.2674': attribute type 5 has an invalid length. [ 602.253065][T16980] netlink: 'syz.4.2677': attribute type 10 has an invalid length. [ 602.587148][ T8113] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 603.144742][T17011] netlink: 'syz.3.2688': attribute type 4 has an invalid length. [ 603.158129][T17011] netlink: 'syz.3.2688': attribute type 4 has an invalid length. [ 603.626470][ T8112] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 603.997712][T17038] RDS: rds_bind could not find a transport for ::8000:0:20:0, load rds_tcp or rds_rdma? [ 604.531806][ T8150] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 604.670051][ T8113] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 605.077172][T17067] IPVS: set_ctl: invalid protocol: 12 172.20.20.187:20002 [ 605.236599][T17077] __nla_validate_parse: 4 callbacks suppressed [ 605.236614][T17077] netlink: 20 bytes leftover after parsing attributes in process `syz.4.2704'. [ 605.253286][T17077] netlink: 44 bytes leftover after parsing attributes in process `syz.4.2704'. [ 605.302727][ T5365] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 605.338239][T17079] geneve3: entered promiscuous mode [ 605.343479][T17079] geneve3: entered allmulticast mode [ 605.706239][ T8113] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 606.503148][T17025] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 606.751814][T17098] netlink: 'syz.1.2711': attribute type 1 has an invalid length. [ 606.773678][ T8113] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 606.800953][T17098] netlink: 60 bytes leftover after parsing attributes in process `syz.1.2711'. [ 607.150840][T17123] netlink: 207952 bytes leftover after parsing attributes in process `syz.4.2717'. [ 607.285819][T17130] workqueue: name exceeds WQ_NAME_LEN. Truncating to: 1ùà^!‚Y‡°”õËí [ 607.285819][T17130] 3ìUH†5rºBnœæ [ 607.549402][T17135] netlink: 48 bytes leftover after parsing attributes in process `syz.3.2719'. [ 607.574122][T17135] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2719'. [ 607.615772][ T5365] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 607.699098][T17115] syzkaller0: entered promiscuous mode [ 607.704737][T17115] syzkaller0: entered allmulticast mode [ 607.765747][T17115] syzkaller0: tun_net_xmit 1280 [ 607.771490][T17115] syzkaller0: create flow: hash 799836076 index 1 [ 607.777862][T17138] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2720'. [ 607.830717][ T8113] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 607.920034][T17150] netlink: 68 bytes leftover after parsing attributes in process `syz.4.2722'. [ 608.041432][T17113] syzkaller0: delete flow: hash 799836076 index 1 [ 608.433512][T17164] netlink: 'syz.4.2725': attribute type 41 has an invalid length. [ 608.874603][ T8113] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 608.942776][T17182] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2729'. [ 608.958402][T17182] netlink: 15 bytes leftover after parsing attributes in process `syz.3.2729'. [ 609.947292][ T8113] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 610.626658][ T8113] page_pool_release_retry() stalled pool shutdown: id 134, 1 inflight 60 sec [ 610.679923][ T8150] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 611.008081][ T8113] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 611.163221][T17158] netlink: 'syz.4.2725': attribute type 2 has an invalid length. [ 611.458404][T17191] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2730'. [ 611.720524][T17202] netlink: 92 bytes leftover after parsing attributes in process `syz.2.2734'. [ 611.935353][T17219] netlink: 'syz.3.2741': attribute type 1 has an invalid length. [ 611.982486][T17219] 8021q: adding VLAN 0 to HW filter on device bond11 [ 612.011610][T17222] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 612.041605][ T8112] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 612.051385][T17219] bond11: (slave dummy0): Enslaving as a backup interface with an up link [ 612.166993][ T3274] bond11: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 612.263193][T17224] netlink: 'syz.3.2741': attribute type 10 has an invalid length. [ 612.271087][T17224] netlink: 40 bytes leftover after parsing attributes in process `syz.3.2741'. [ 612.283743][ T7112] bond11: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 612.304127][T17224] dummy0: entered promiscuous mode [ 612.314813][T17224] bond11: (slave dummy0): Removing an active aggregator [ 612.325269][T17224] bond11: (slave dummy0): Releasing backup interface [ 612.972292][T17261] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2752'. [ 613.086494][ T8113] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 613.276486][T17265] bond12: option primary: mode dependency failed, not supported in mode balance-rr(0) [ 613.288974][T17265] bond12 (unregistering): Released all slaves [ 613.744690][T17268] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2755'. [ 613.794739][ T8149] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 614.116680][ T8112] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 614.821590][T17210] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 614.833686][T17236] netlink: 'syz.0.2745': attribute type 11 has an invalid length. [ 614.887001][ T8149] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 615.110065][T17283] syzkaller0: entered allmulticast mode [ 615.142838][T17285] openvswitch: netlink: Unknown nsh attribute 0 [ 615.154251][T17285] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 615.192285][ T8113] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 615.484802][T17304] netlink: 248 bytes leftover after parsing attributes in process `syz.0.2767'. [ 615.541154][T17305] syzkaller0: entered promiscuous mode [ 615.562502][T17305] syzkaller0: entered allmulticast mode [ 615.601627][T17310] syzkaller0: entered promiscuous mode [ 615.607312][T17310] syzkaller0: entered allmulticast mode [ 615.645696][T17312] tipc: Enabled bearer , priority 0 [ 615.654905][T17310] tipc: Enabling of bearer rejected, already enabled [ 615.673994][T17312] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2769'. [ 615.675774][T17317] sctp: [Deprecated]: syz.1.2766 (pid 17317) Use of struct sctp_assoc_value in delayed_ack socket option. [ 615.675774][T17317] Use struct sctp_sack_info instead [ 615.703006][T17320] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2769'. [ 615.713100][T17317] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2766'. [ 615.722013][T17317] netlink: 15 bytes leftover after parsing attributes in process `syz.1.2766'. [ 615.754910][T17310] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 615.823163][T17312] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 615.861606][T17326] syzkaller0: entered promiscuous mode [ 615.867178][T17326] syzkaller0: entered allmulticast mode [ 615.876248][T17308] tipc: Resetting bearer [ 615.935717][T17308] tipc: Disabling bearer [ 616.226544][ T8113] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 616.521705][T17351] bond12: option primary: mode dependency failed, not supported in mode balance-rr(0) [ 616.592588][T17351] bond12 (unregistering): Released all slaves [ 616.660442][T17362] __nla_validate_parse: 1 callbacks suppressed [ 616.660471][T17362] netlink: 32 bytes leftover after parsing attributes in process `syz.4.2782'. [ 616.756879][T17367] netlink: 92 bytes leftover after parsing attributes in process `syz.0.2783'. [ 616.860334][T17377] dvmrp8: entered allmulticast mode [ 617.184935][T17394] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2792'. [ 617.271095][T17403] netlink: 'syz.3.2792': attribute type 11 has an invalid length. [ 617.545260][T17419] xt_CHECKSUM: CHECKSUM should be avoided. If really needed, restrict with "-p udp" and only use in OUTPUT [ 617.598617][T17418] netlink: 'syz.1.2795': attribute type 4 has an invalid length. [ 617.629378][T17418] netlink: 'syz.1.2795': attribute type 4 has an invalid length. [ 617.787504][T17425] netlink: 92 bytes leftover after parsing attributes in process `syz.2.2797'. [ 618.120775][T17446] netlink: 108 bytes leftover after parsing attributes in process `syz.2.2804'. [ 618.306529][ T8120] net_ratelimit: 12 callbacks suppressed [ 618.306549][ T8120] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 618.453326][T17444] 8021q: adding VLAN 0 to HW filter on device bond0 [ 618.480642][T17444] 8021q: adding VLAN 0 to HW filter on device team0 [ 618.526905][T17444] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 618.657893][T17444] batadv_slave_1: left promiscuous mode [ 618.671788][T17444] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 618.683579][T17444] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 618.722966][T17444] veth1_vlan: left promiscuous mode [ 618.734295][T17444] vlan0: left promiscuous mode [ 618.740650][T17444] veth1_vlan: entered promiscuous mode [ 618.753384][T17444] veth1_macvtap: left promiscuous mode [ 618.760828][T17444] veth0_macvtap: left promiscuous mode [ 618.768249][T17444] veth0_macvtap: entered promiscuous mode [ 618.776108][T17444] veth1_macvtap: entered promiscuous mode [ 618.786164][T17444] geneve0: entered promiscuous mode [ 618.796046][T17444] netdevsim netdevsim2 netdevsim0: left promiscuous mode [ 618.806092][T17444] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 618.828201][T17444] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 618.847954][T17444] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 618.857175][T17444] A link change request failed with some changes committed already. Interface wlan0 may have been left with an inconsistent configuration, please check. [ 618.959236][T17466] syzkaller1: entered promiscuous mode [ 618.965055][T17466] syzkaller1: entered allmulticast mode [ 618.975022][ T13] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 618.984370][ T13] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 619.020737][ T13] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 619.030753][T17451] tipc: Enabled bearer , priority 0 [ 619.062869][ T8149] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 619.190739][T17491] IPVS: sync thread started: state = BACKUP, mcast_ifn = veth0_to_hsr, syncid = 1, id = 0 [ 619.365819][T17496] netlink: 92 bytes leftover after parsing attributes in process `syz.2.2814'. [ 619.387259][ T8120] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 619.639991][T17510] bridge_slave_1: left allmulticast mode [ 619.646095][T17510] bridge_slave_1: left promiscuous mode [ 619.658602][T17510] bridge0: port 2(bridge_slave_1) entered disabled state [ 619.691248][T17510] bond0: (slave bond_slave_0): Releasing backup interface [ 619.691466][T17514] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2819'. [ 619.726492][T17514] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2819'. [ 619.752462][T17505] nbd2: detected capacity change from 0 to 127 [ 619.764931][T17510] bond0: (slave bond_slave_1): Releasing backup interface [ 619.781989][T17510] team_slave_1: left allmulticast mode [ 619.806243][T17520] netlink: 'syz.1.2819': attribute type 10 has an invalid length. [ 619.816272][T17510] team0: Port device team_slave_1 removed [ 619.845396][T15394] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 619.861086][T17521] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2821'. [ 619.881283][T17510] bond0: (slave netdevsim1): Releasing backup interface [ 619.965760][T17510] bond2: (slave bridge1): Releasing active interface [ 619.983911][T17510] bond4: (slave bridge2): Releasing backup interface [ 619.992744][T17510] bridge2: left promiscuous mode [ 620.008453][T17510] bond10: (slave veth9): Releasing active interface [ 620.030958][T17512] pim6reg: entered allmulticast mode [ 620.058681][ T5645] block nbd2: Receive control failed (result -104) [ 620.068315][T15394] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 620.094813][ T3274] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 620.340123][T17529] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2823'. [ 620.447747][ T8120] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 620.584752][T17534] xt_SECMARK: mode already set to 1 cannot mix with rules for mode 4 [ 620.704833][ T5639] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 620.728998][ T5639] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 620.740069][ T5639] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 620.751204][ T5639] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 620.762841][ T5639] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 621.200163][T17551] openvswitch: netlink: Unexpected mask (mask=200440, allowed=10048) [ 621.302919][ T7112] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 621.313072][ T7112] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 621.322604][T17554] RDS: rds_bind could not find a transport for fec0:ffff::1, load rds_tcp or rds_rdma? [ 621.554895][ T7548] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 621.611871][T15394] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 621.709240][T17579] xt_HMARK: proto mask must be zero with L3 mode [ 621.754968][T17574] tipc: Enabled bearer , priority 0 [ 621.877016][T17574] tipc: Resetting bearer [ 621.890624][T17593] __nla_validate_parse: 4 callbacks suppressed [ 621.890647][T17593] netlink: 14 bytes leftover after parsing attributes in process `syz.0.2842'. [ 621.949645][T17593] bond0 (unregistering): Released all slaves [ 621.996186][T17597] netlink: 132 bytes leftover after parsing attributes in process `syz.0.2842'. [ 621.996214][T17572] tipc: Disabling bearer [ 622.039555][T17597] netlink: 324 bytes leftover after parsing attributes in process `syz.0.2842'. [ 622.054746][T17601] netlink: 240 bytes leftover after parsing attributes in process `syz.4.2841'. [ 622.129108][ T7548] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 622.523663][T17613] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2846'. [ 622.678331][ T7548] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 622.948283][ T5639] Bluetooth: hci5: command tx timeout [ 623.014048][T17536] bridge0: port 1(bridge_slave_0) entered blocking state [ 623.022891][T17536] bridge0: port 1(bridge_slave_0) entered disabled state [ 623.030478][T17536] bridge_slave_0: entered allmulticast mode [ 623.038155][T17536] bridge_slave_0: entered promiscuous mode [ 623.083583][T17536] bridge0: port 2(bridge_slave_1) entered blocking state [ 623.091059][T17536] bridge0: port 2(bridge_slave_1) entered disabled state [ 623.093797][ T4964] block nbd2: Connection timed out, retrying (0/1 alive) [ 623.098443][T17536] bridge_slave_1: entered allmulticast mode [ 623.101355][T17536] bridge_slave_1: entered promiscuous mode [ 623.122123][ T4964] block nbd2: Connection timed out, retrying (0/1 alive) [ 623.134167][ T25] block nbd2: Dead connection, failed to find a fallback [ 623.146579][ T25] block nbd2: shutting down sockets [ 623.155065][ T4964] block nbd2: Connection timed out, retrying (0/1 alive) [ 623.165877][ T25] blk_print_req_error: 136 callbacks suppressed [ 623.165896][ T25] I/O error, dev nbd2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 623.185278][ T4964] block nbd2: Connection timed out, retrying (0/1 alive) [ 623.197034][ T25] buffer_io_error: 138 callbacks suppressed [ 623.197057][ T25] Buffer I/O error on dev nbd2, logical block 0, async page read [ 623.212659][ T25] I/O error, dev nbd2, sector 6 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 623.221882][ T25] Buffer I/O error on dev nbd2, logical block 3, async page read [ 623.229984][ T25] I/O error, dev nbd2, sector 4 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 623.239907][ T25] Buffer I/O error on dev nbd2, logical block 2, async page read [ 623.247844][ T25] I/O error, dev nbd2, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 623.257113][ T25] Buffer I/O error on dev nbd2, logical block 1, async page read [ 623.275613][T15689] I/O error, dev nbd2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 623.284718][T15689] Buffer I/O error on dev nbd2, logical block 0, async page read [ 623.293872][T15689] I/O error, dev nbd2, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 623.303192][T15689] Buffer I/O error on dev nbd2, logical block 1, async page read [ 623.311211][T15689] I/O error, dev nbd2, sector 4 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 623.321887][T15689] Buffer I/O error on dev nbd2, logical block 2, async page read [ 623.329976][T15689] I/O error, dev nbd2, sector 6 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 623.339127][T15689] Buffer I/O error on dev nbd2, logical block 3, async page read [ 623.347322][T15689] I/O error, dev nbd2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 623.356834][T15689] Buffer I/O error on dev nbd2, logical block 0, async page read [ 623.364770][T15689] I/O error, dev nbd2, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 623.375218][T15689] Buffer I/O error on dev nbd2, logical block 1, async page read [ 623.385752][T15689] ldm_validate_partition_table(): Disk read failed. [ 623.392856][T17536] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 623.401148][T15689] Dev nbd2: unable to read RDB block 0 [ 623.411898][T15689] nbd2: unable to read partition table [ 623.456455][T15689] ldm_validate_partition_table(): Disk read failed. [ 623.465790][T15689] Dev nbd2: unable to read RDB block 0 [ 623.474568][T15689] nbd2: unable to read partition table [ 623.501758][ T7548] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 623.524034][T17536] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 623.544260][T17633] netlink: 40 bytes leftover after parsing attributes in process `syz.1.2849'. [ 623.638406][T17635] netlink: 68 bytes leftover after parsing attributes in process `syz.1.2850'. [ 623.731079][T17536] team0: Port device team_slave_0 added [ 623.756234][T17536] team0: Port device team_slave_1 added [ 623.877603][T17643] netlink: 'syz.1.2852': attribute type 1 has an invalid length. [ 623.897207][T17536] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 623.904505][T17536] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 623.953044][T17536] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 624.016456][T17643] 8021q: adding VLAN 0 to HW filter on device bond11 [ 624.024818][T17536] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 624.031866][T17536] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 624.058872][T17536] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 624.094695][T17644] bond11: (slave veth11): Enslaving as an active interface with a down link [ 624.162760][T17536] hsr_slave_0: entered promiscuous mode [ 624.169708][T17536] hsr_slave_1: entered promiscuous mode [ 624.176383][T17536] debugfs: 'hsr0' already exists in 'hsr' [ 624.182171][T17536] Cannot create hsr debugfs directory [ 624.199801][T17644] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 624.210808][T17644] bond11: (slave batadv0): making interface the new active one [ 624.232129][T17644] batadv0: entered promiscuous mode [ 624.243579][T17644] bond11: (slave batadv0): Enslaving as an active interface with an up link [ 624.317250][T17644] bond11 (unregistering): (slave veth11): Releasing active interface [ 624.353221][T17644] bond11 (unregistering): (slave batadv0): Releasing active interface [ 624.366425][T17644] bond11 (unregistering): Released all slaves [ 624.996364][ T5639] Bluetooth: hci5: command tx timeout [ 625.002375][T17596] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 625.268511][ T7548] bond1 (unregistering): (slave bridge3): Releasing backup interface [ 625.277602][ T7548] bridge3 (unregistering): left promiscuous mode [ 625.284042][ T7548] bridge3 (unregistering): left allmulticast mode [ 625.364828][ T7548] bond0 (unregistering): Released all slaves [ 625.376304][ T7548] bond1 (unregistering): Released all slaves [ 625.399084][ T7548] bond2 (unregistering): (slave veth5): Releasing active interface [ 625.408269][ T7548] bond2 (unregistering): Released all slaves [ 625.424589][ T7548] bond3 (unregistering): Released all slaves [ 625.451257][ T7548] bond4 (unregistering): Released all slaves [ 625.469469][ T7548] tipc: Disabling bearer [ 625.479229][ T7548] bond5 (unregistering): Released all slaves [ 625.496915][ T7548] bond6 (unregistering): Released all slaves [ 625.513715][ T7548] bond7 (unregistering): Released all slaves [ 625.532737][ T7548] bond8 (unregistering): Released all slaves [ 625.565217][ T7548] bond9 (unregistering): Released all slaves [ 625.582065][ T7548] bond10 (unregistering): Released all slaves [ 625.601323][ T7548] bond11 (unregistering): Released all slaves [ 625.774950][ C0] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 625.951818][ T7548] : left promiscuous mode [ 626.456766][ T7548] tipc: Left network mode [ 626.472275][T17688] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2860'. [ 626.506078][ T7548] IPVS: stopping backup sync thread 17491 ... [ 626.570270][T17692] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2861'. [ 626.623813][T17669] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2857'. [ 626.663655][T17692] IPVS: persistence engine module ip_vs_pe_À not found [ 626.968571][T17704] __nla_validate_parse: 2 callbacks suppressed [ 626.968592][T17704] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2864'. [ 627.014085][ T5294] 8021q: adding VLAN 0 to HW filter on device eth1 [ 627.087322][ T5639] Bluetooth: hci5: command tx timeout [ 627.105427][T17704] bond0: ARP target 170.170.170.170 is already present [ 627.112393][T17704] bond0: option arp_ip_target: invalid value (2863311530) [ 627.188599][T17709] netlink: 104 bytes leftover after parsing attributes in process `syz.4.2866'. [ 627.318349][T17715] netlink: 72 bytes leftover after parsing attributes in process `syz.0.2868'. [ 627.327460][T17715] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2868'. [ 627.347863][T17715] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2868'. [ 627.494820][T17722] openvswitch: netlink: Missing valid actions attribute. [ 627.502214][T17722] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 628.194167][T17756] netlink: 'syz.0.2876': attribute type 49 has an invalid length. [ 628.261735][T17759] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2877'. [ 628.306692][T17760] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2877'. [ 628.638532][T17776] netlink: 'syz.4.2881': attribute type 10 has an invalid length. [ 628.767730][T17776] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci5/hci5:200/input10 [ 629.073370][T17791] IPVS: dh: TCP 172.20.20.170:0 - no destination available [ 629.156413][ T5639] Bluetooth: hci5: command tx timeout [ 629.413096][T17536] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 629.451204][T17536] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 629.460092][T17536] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 629.489525][T17536] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 629.569281][T17536] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 629.593637][T17536] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 629.601882][T17536] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 629.682014][T17536] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 630.202653][T17536] 8021q: adding VLAN 0 to HW filter on device bond0 [ 630.292602][T17536] 8021q: adding VLAN 0 to HW filter on device team0 [ 630.353073][ T1015] bridge0: port 1(bridge_slave_0) entered blocking state [ 630.360361][ T1015] bridge0: port 1(bridge_slave_0) entered forwarding state [ 630.504940][ T1015] bridge0: port 2(bridge_slave_1) entered blocking state [ 630.512266][ T1015] bridge0: port 2(bridge_slave_1) entered forwarding state [ 630.678318][T17536] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 631.130180][T17838] sctp: [Deprecated]: syz.4.2888 (pid 17838) Use of struct sctp_assoc_value in delayed_ack socket option. [ 631.130180][T17838] Use struct sctp_sack_info instead [ 631.541022][T17849] sch_tbf: burst 0 is lower than device ip6gre0 mtu (1448) ! [ 631.550410][T17858] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2893'. [ 631.626014][T17849] syzkaller0: entered promiscuous mode [ 631.634642][T17842] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2890'. [ 631.652131][T17849] syzkaller0: entered allmulticast mode [ 632.066340][T17849] vlan2: entered promiscuous mode [ 632.085504][T17849] bridge0: entered promiscuous mode [ 632.301459][ T7548] hsr_slave_0: left promiscuous mode [ 632.330445][ T7548] hsr_slave_1: left promiscuous mode [ 632.363849][ T7548] veth1_macvtap: left promiscuous mode [ 632.370213][ T7548] veth0_macvtap: left promiscuous mode [ 632.937807][T17536] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 633.115357][T17536] veth0_vlan: entered promiscuous mode [ 633.133213][T17536] veth1_vlan: entered promiscuous mode [ 633.193725][T17536] veth0_macvtap: entered promiscuous mode [ 633.222968][T17536] veth1_macvtap: entered promiscuous mode [ 633.246866][T17536] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 633.270419][T17536] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 633.295240][ T3263] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 633.304481][ T3263] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 633.349387][ T3263] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 633.359766][ T3263] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 633.602855][T17902] netlink: 92 bytes leftover after parsing attributes in process `syz.1.2901'. [ 633.638795][ T3263] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 633.662428][ T3263] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 633.720303][ T3263] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 633.735438][ T3263] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 634.336124][T17924] xt_CT: You must specify a L4 protocol and not use inversions on it [ 634.399864][T17940] netlink: 'syz.4.2907': attribute type 11 has an invalid length. [ 634.505009][T17942] syzkaller1: entered promiscuous mode [ 634.511234][T17942] syzkaller1: entered allmulticast mode [ 634.520502][T17942] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2908'. [ 634.764294][ C0] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 635.239464][ T5645] block nbd3: Receive control failed (result -32) [ 635.250551][ T5639] block nbd3: Receive control failed (result -32) [ 635.471518][ T5645] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 635.518680][ T5645] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 635.579175][ T5645] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 635.590483][ T5645] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 635.601615][ T5645] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 635.703178][ T7548] IPVS: stop unused estimator thread 0... [ 636.071063][T17969] bond0: entered promiscuous mode [ 636.076632][T17969] 8021q: adding VLAN 0 to HW filter on device bond0 [ 636.305509][T17977] netlink: 660 bytes leftover after parsing attributes in process `syz.0.2917'. [ 636.317390][T17977] netlink: 76 bytes leftover after parsing attributes in process `syz.0.2917'. [ 636.406000][T17980] netlink: 92 bytes leftover after parsing attributes in process `syz.0.2918'. [ 636.490253][T17982] netlink: 32 bytes leftover after parsing attributes in process `syz.0.2919'. [ 636.952032][T17998] netlink: 'syz.4.2921': attribute type 5 has an invalid length. [ 637.284051][ T7548] netdevsim netdevsim1 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 637.294957][ T7548] netdevsim netdevsim1 netdevsim3 (unregistering): unset [0, 1] type 1 family 0 port 2816 - 0 [ 637.305266][ T7548] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 637.678889][ T5639] Bluetooth: hci3: command tx timeout [ 637.911097][T18002] netlink: 'syz.2.2922': attribute type 21 has an invalid length. [ 637.919002][T18002] netlink: 128 bytes leftover after parsing attributes in process `syz.2.2922'. [ 637.977258][ T7548] netdevsim netdevsim1 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 637.987643][ T7548] netdevsim netdevsim1 netdevsim2 (unregistering): unset [0, 1] type 1 family 0 port 2816 - 0 [ 638.047652][ T7548] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 638.096626][T18002] netlink: 'syz.2.2922': attribute type 4 has an invalid length. [ 638.137646][T18002] netlink: 3 bytes leftover after parsing attributes in process `syz.2.2922'. [ 638.292764][ T7548] netdevsim netdevsim1 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 638.303109][ T7548] netdevsim netdevsim1 netdevsim1 (unregistering): unset [0, 1] type 1 family 0 port 2816 - 0 [ 638.313488][ T7548] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 638.350922][T18034] netlink: 92 bytes leftover after parsing attributes in process `syz.4.2928'. [ 638.400431][T17952] bridge0: port 1(bridge_slave_0) entered blocking state [ 638.407921][T17952] bridge0: port 1(bridge_slave_0) entered disabled state [ 638.415251][T17952] bridge_slave_0: entered allmulticast mode [ 638.422650][T17952] bridge_slave_0: entered promiscuous mode [ 638.458285][T17952] bridge0: port 2(bridge_slave_1) entered blocking state [ 638.465728][T17952] bridge0: port 2(bridge_slave_1) entered disabled state [ 638.473135][T17952] bridge_slave_1: entered allmulticast mode [ 638.480601][T17952] bridge_slave_1: entered promiscuous mode [ 638.547675][T17952] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 638.561766][T17952] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 638.605610][T17952] team0: Port device team_slave_0 added [ 638.614090][T17952] team0: Port device team_slave_1 added [ 638.642714][T17952] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 638.650237][T17952] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 638.688122][T17952] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 638.701142][T17952] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 638.708326][T17952] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 638.734405][T17952] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 638.806253][T17952] hsr_slave_0: entered promiscuous mode [ 638.813118][T17952] hsr_slave_1: entered promiscuous mode [ 639.086457][ T7548] netdevsim netdevsim1 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 639.101533][ T7548] netdevsim netdevsim1 netdevsim0 (unregistering): unset [0, 1] type 1 family 0 port 2816 - 0 [ 639.112525][ T7548] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 639.183213][T18050] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2933'. [ 639.803237][ T5639] Bluetooth: hci3: command tx timeout [ 639.945130][T18064] netlink: 292 bytes leftover after parsing attributes in process `syz.4.2935'. [ 640.232813][ T7548] pim6reg99999999: left allmulticast mode [ 641.060134][ T7548] bond0 (unregistering): Released all slaves [ 641.071349][ T7548] bond1 (unregistering): Released all slaves [ 641.087450][ T7548] bond2 (unregistering): Released all slaves [ 641.103010][ T7548] bond3 (unregistering): Released all slaves [ 641.118583][ T7548] bond4 (unregistering): Released all slaves [ 641.160262][ T7548] bond5 (unregistering): Released all slaves [ 641.176227][ T7548] bond6 (unregistering): Released all slaves [ 641.192377][ T7548] bond7 (unregistering): Released all slaves [ 641.210820][ T7548] bond8 (unregistering): Released all slaves [ 641.227107][ T7548] bond9 (unregistering): Released all slaves [ 641.270464][ T7548] bond10 (unregistering): Released all slaves [ 641.315838][ T5294] 8021q: adding VLAN 0 to HW filter on device eth1 [ 641.507931][ T30] audit: type=1800 audit(1781301404.599:10): pid=18097 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.2940" name="memory.events" dev="tmpfs" ino=3146 res=0 errno=0 [ 641.742188][ T7548] : left promiscuous mode [ 641.946344][ T5639] Bluetooth: hci3: command tx timeout [ 642.283285][T18131] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 642.319309][T18131] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2943'. [ 642.342240][T18131] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2943'. [ 642.358423][T18131] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2943'. [ 643.724213][ T7548] tipc: Disabling bearer [ 643.738901][ T7548] tipc: Left network mode [ 643.758887][ T5294] 8021q: adding VLAN 0 to HW filter on device eth2 [ 643.889534][ T12] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 643.947168][ T5639] Bluetooth: hci3: command tx timeout [ 643.957857][ T95] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 643.990301][ T95] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 644.349206][T18166] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2947'. [ 644.425611][T18164] netlink: 36 bytes leftover after parsing attributes in process `syz.2.2947'. [ 644.530016][T18172] netlink: 72 bytes leftover after parsing attributes in process `syz.4.2948'. [ 644.601897][T18172] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2948'. [ 644.742536][T18170] netlink: 476 bytes leftover after parsing attributes in process `syz.4.2948'. [ 644.883637][T18177] bond11 (unregistering): Released all slaves [ 645.291609][T18193] netlink: 92 bytes leftover after parsing attributes in process `syz.3.2951'. [ 646.686115][T17952] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 646.702323][T17952] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 646.737575][T17952] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 646.762841][T17952] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 646.865071][T17952] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 646.943111][T17952] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 646.967194][T17952] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 647.012974][T17952] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 647.293103][T18262] netlink: 'syz.0.2958': attribute type 6 has an invalid length. [ 647.376702][T18252] ipt_ECN: cannot use operation on non-tcp rule [ 647.400746][T18252] netlink: zone id is out of range [ 647.415238][T18252] netlink: zone id is out of range [ 647.432794][T18252] netlink: zone id is out of range [ 647.440600][T18252] netlink: zone id is out of range [ 647.455830][T18252] netlink: zone id is out of range [ 647.483237][T18252] netlink: zone id is out of range [ 647.513027][T18252] netlink: zone id is out of range [ 647.543440][T18252] netlink: zone id is out of range [ 647.581031][T18252] netlink: zone id is out of range [ 647.628533][T18252] netlink: zone id is out of range [ 648.503715][T17952] 8021q: adding VLAN 0 to HW filter on device bond0 [ 648.620409][T17952] 8021q: adding VLAN 0 to HW filter on device team0 [ 648.673534][ T1015] bridge0: port 1(bridge_slave_0) entered blocking state [ 648.680833][ T1015] bridge0: port 1(bridge_slave_0) entered forwarding state [ 648.736671][ T1015] bridge0: port 2(bridge_slave_1) entered blocking state [ 648.743926][ T1015] bridge0: port 2(bridge_slave_1) entered forwarding state [ 649.320476][ T7548] veth1_macvtap: left promiscuous mode [ 649.328881][ T7548] veth0_macvtap: left promiscuous mode [ 649.337331][ T7548] veth1_vlan: left promiscuous mode [ 649.343036][ T7548] veth0_vlan: left promiscuous mode [ 650.930700][T18361] netlink: 'syz.0.2975': attribute type 4 has an invalid length. [ 650.954158][T18363] netlink: 116 bytes leftover after parsing attributes in process `syz.4.2976'. [ 651.097611][ T8150] hid-generic 0005:0007:0007.0001: unknown main item tag 0x0 [ 651.126135][ T8150] hid-generic 0005:0007:0007.0001: unknown main item tag 0x7 [ 651.159976][ T8150] hid-generic 0005:0007:0007.0001: unknown main item tag 0x7 [ 651.200466][ T8150] hid-generic 0005:0007:0007.0001: unknown main item tag 0x0 [ 651.237971][ T8150] hid-generic 0005:0007:0007.0001: unknown main item tag 0x4 [ 651.260214][ T8150] hid-generic 0005:0007:0007.0001: ignoring exceeding usage max [ 651.469078][T18384] netlink: 'syz.3.2980': attribute type 1 has an invalid length. [ 651.488407][ T8150] hid-generic 0005:0007:0007.0001: hidraw0: BLUETOOTH HID v0.03 Device [syz0] on aa:aa:aa:aa:aa:aa [ 651.503213][T18384] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2980'. [ 651.702045][ T7548] IPVS: stop unused estimator thread 0... [ 651.799099][T18386] fido_id[18386]: Failed to open report descriptor at '/sys/devices/virtual/bluetooth/hci3/hci3:200/report_descriptor': No such file or directory [ 651.873260][T18395] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2982'. [ 651.891462][T17952] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 652.090351][T17952] veth0_vlan: entered promiscuous mode [ 652.143125][T17952] veth1_vlan: entered promiscuous mode [ 652.144131][T18399] netlink: 'syz.3.2984': attribute type 1 has an invalid length. [ 652.320294][T18411] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2986'. [ 653.193077][T18410] veth1_macvtap: left promiscuous mode [ 653.199857][T18410] macsec0: entered promiscuous mode [ 653.205160][T18410] macsec0: entered allmulticast mode [ 653.223297][T18413] macvlan2: entered promiscuous mode [ 653.231877][T18413] macvlan2: entered allmulticast mode [ 653.266007][T15396] syz0: Port: 1 Link DOWN [ 653.384739][T18425] bond12: (slave bond_slave_1): Device is not bonding slave [ 653.393363][T18425] bond12: option active_slave: invalid value (bond_slave_1) [ 653.416203][T18425] bond12 (unregistering): Released all slaves [ 653.631077][T18429] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2988'. [ 653.735317][T18436] netlink: 68 bytes leftover after parsing attributes in process `syz.0.2990'. [ 653.825282][T17952] veth0_macvtap: entered promiscuous mode [ 653.959942][T18440] team0: entered allmulticast mode [ 653.978681][T18440] team_slave_0: entered allmulticast mode [ 653.993462][T18440] team_slave_1: entered allmulticast mode [ 654.032992][T17952] veth1_macvtap: entered promiscuous mode [ 654.207102][T18445] veth0: entered promiscuous mode [ 654.354631][T18444] veth0: left promiscuous mode [ 654.381402][T17952] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 654.424200][T17952] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 654.487525][T11231] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 654.507366][T11231] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 654.537465][T11231] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 654.552202][T11231] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 654.605311][T18458] tipc: Enabling of bearer rejected, already enabled [ 654.634102][T18457] tipc: Enabling of bearer rejected, already enabled [ 654.912281][ T7548] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 654.937273][ T7548] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 655.074913][ T36] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 655.102470][ T36] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 655.267971][T18474] mac80211_hwsim hwsim31 syzkaller0: Caught tx_queue_len zero misconfig [ 655.449695][T18487] netlink: 'syz.3.3000': attribute type 13 has an invalid length. [ 655.523072][ T5645] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 655.568299][ T5645] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 655.582103][ T5645] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 655.594064][ T5645] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 655.603055][ T5645] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 655.660104][ T8149] IPVS: starting estimator thread 0... [ 655.765823][T18493] IPVS: using max 29 ests per chain, 69600 per kthread [ 655.903167][T18496] net_ratelimit: 45 callbacks suppressed [ 655.903193][T18496] openvswitch: netlink: push_nsh: missing base or metadata attributes [ 655.934644][T18496] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 656.006988][T18498] bridge0: port 2(syz_tun) entered blocking state [ 656.044197][T18498] bridge0: port 2(syz_tun) entered disabled state [ 656.096955][T18498] syz_tun: entered allmulticast mode [ 656.150168][T18498] vlan4: entered promiscuous mode [ 656.703212][T18529] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3011'. [ 656.756399][T18529] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3011'. [ 656.776706][T18529] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3011'. [ 656.800702][T18529] xt_l2tp: invalid flags combination: 8 [ 657.007473][T18533] tipc: Enabled bearer , priority 0 [ 657.036078][T18534] syzkaller0: entered promiscuous mode [ 657.043144][T18534] syzkaller0: entered allmulticast mode [ 657.094048][T18534] tipc: Resetting bearer [ 657.175748][T18534] tipc: Disabling bearer [ 657.329061][T18543] netlink: 'syz.2.3016': attribute type 1 has an invalid length. [ 657.412731][T18543] 8021q: adding VLAN 0 to HW filter on device bond8 [ 657.499817][T18548] bond8: (slave veth13): Enslaving as an active interface with a down link [ 657.598745][T18543] vlan5: entered allmulticast mode [ 657.604091][T18543] veth0_to_bond: entered allmulticast mode [ 657.617972][T18543] bond8: (slave vlan5): Opening slave failed [ 657.707143][ T5639] Bluetooth: hci1: command tx timeout [ 657.996891][T18488] bridge0: port 1(bridge_slave_0) entered blocking state [ 658.006562][T18488] bridge0: port 1(bridge_slave_0) entered disabled state [ 658.013231][T18571] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3020'. [ 658.018258][T18488] bridge_slave_0: entered allmulticast mode [ 658.031800][T18488] bridge_slave_0: entered promiscuous mode [ 658.042519][T18488] bridge0: port 2(bridge_slave_1) entered blocking state [ 658.051055][T18488] bridge0: port 2(bridge_slave_1) entered disabled state [ 658.059518][T18488] bridge_slave_1: entered allmulticast mode [ 658.070462][T18488] bridge_slave_1: entered promiscuous mode [ 658.129351][T18488] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 658.149976][T18488] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 658.304617][T18488] team0: Port device team_slave_0 added [ 658.416255][T18580] netlink: 'syz.1.3021': attribute type 1 has an invalid length. [ 658.505116][T18488] team0: Port device team_slave_1 added [ 658.671876][T18580] 8021q: adding VLAN 0 to HW filter on device bond1 [ 658.859240][T18488] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 658.870823][T18488] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 658.899829][T18488] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 658.952395][T18488] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 658.961625][T18488] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 659.002421][T18488] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 659.413739][T18488] hsr_slave_0: entered promiscuous mode [ 659.461129][T18488] hsr_slave_1: entered promiscuous mode [ 659.483242][T18488] debugfs: 'hsr0' already exists in 'hsr' [ 659.514078][T18488] Cannot create hsr debugfs directory [ 659.786198][ T5639] Bluetooth: hci1: command tx timeout [ 659.810386][T18629] netlink: 'syz.2.3031': attribute type 30 has an invalid length. [ 659.857132][T18617] netlink: 20 bytes leftover after parsing attributes in process `syz.1.3028'. [ 660.243661][T18637] netlink: 4560 bytes leftover after parsing attributes in process `syz.1.3032'. [ 660.278754][T18637] netlink: 4560 bytes leftover after parsing attributes in process `syz.1.3032'. [ 661.196348][T18488] netdevsim netdevsim4 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 661.220872][T18488] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 661.232534][T18488] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 1] type 2 family 0 port 38184 - 0 [ 661.299080][T18667] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3035'. [ 661.335163][T18669] netlink: 36 bytes leftover after parsing attributes in process `syz.3.3037'. [ 661.581282][T18488] netdevsim netdevsim4 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 661.609189][T18488] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 661.636733][T18488] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 1] type 2 family 0 port 38184 - 0 [ 661.685207][T18674] lo: Caught tx_queue_len zero misconfig [ 661.866493][ T5639] Bluetooth: hci1: command tx timeout [ 661.879501][T18488] netdevsim netdevsim4 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 661.910290][T18488] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 661.939668][T18488] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 1] type 2 family 0 port 38184 - 0 [ 662.131622][T18686] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3041'. [ 662.160049][T18488] netdevsim netdevsim4 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 662.202661][T18488] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 662.225495][T18488] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 1] type 2 family 0 port 38184 - 0 [ 662.480575][T18692] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3043'. [ 662.699865][T18696] netlink: 'syz.3.3045': attribute type 1 has an invalid length. [ 662.729745][T18696] netlink: 'syz.3.3045': attribute type 7 has an invalid length. [ 662.761304][T18696] netlink: 'syz.3.3045': attribute type 8 has an invalid length. [ 662.780175][T18696] netlink: 208 bytes leftover after parsing attributes in process `syz.3.3045'. [ 662.802705][T18696] NCSI netlink: No device for ifindex 1073545264 [ 662.887587][T18702] tipc: Started in network mode [ 662.907702][T18702] tipc: Node identity fe800000000000000000000000000014, cluster identity 4711 [ 662.952338][T18702] tipc: Enabling of bearer rejected, failed to enable media [ 663.050573][T18709] netlink: 'syz.3.3048': attribute type 2 has an invalid length. [ 663.084413][T18488] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 663.135531][T18488] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 663.155169][T18488] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 663.202938][T18488] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 663.229461][T18488] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 663.293711][T18488] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 663.330083][T18488] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 663.377919][T18488] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 663.545228][T18735] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3054'. [ 663.763677][T18488] 8021q: adding VLAN 0 to HW filter on device bond0 [ 663.838221][T18488] 8021q: adding VLAN 0 to HW filter on device team0 [ 663.847004][T18746] netlink: 'syz.1.3057': attribute type 2 has an invalid length. [ 663.881394][T11231] bridge0: port 1(bridge_slave_0) entered blocking state [ 663.888892][T11231] bridge0: port 1(bridge_slave_0) entered forwarding state [ 663.899981][T18746] netlink: 14 bytes leftover after parsing attributes in process `syz.1.3057'. [ 663.949983][ T5639] Bluetooth: hci1: command tx timeout [ 664.010895][T11231] bridge0: port 2(bridge_slave_1) entered blocking state [ 664.018231][T11231] bridge0: port 2(bridge_slave_1) entered forwarding state [ 664.236811][T18758] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3060'. [ 664.260213][T18758] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3060'. [ 664.295095][T18759] netlink: 36 bytes leftover after parsing attributes in process `syz.0.3060'. [ 665.079453][T18772] bridge0: port 2(bridge_slave_1) entered disabled state [ 665.087709][T18772] bridge0: port 1(bridge_slave_0) entered disabled state [ 665.570366][T18772] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 665.625193][T18772] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 666.287589][ T3263] netdevsim netdevsim1 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 666.318730][ T3263] netdevsim netdevsim1 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 666.354357][ T3263] netdevsim netdevsim1 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 666.380565][ T3263] netdevsim netdevsim1 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 666.471268][T18789] netlink: 'syz.3.3069': attribute type 9 has an invalid length. [ 666.592834][T18795] netlink: 9286 bytes leftover after parsing attributes in process `syz.1.3070'. [ 666.610509][T18796] netlink: 32 bytes leftover after parsing attributes in process `syz.0.3071'. [ 666.969850][T18807] netlink: 'syz.0.3074': attribute type 2 has an invalid length. [ 666.990547][T18807] xt_bpf: check failed: parse error [ 667.129173][T18488] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 667.184920][T18813] __nla_validate_parse: 2 callbacks suppressed [ 667.184943][T18813] netlink: 72 bytes leftover after parsing attributes in process `syz.0.3076'. [ 667.386480][T18821] vlan2: entered promiscuous mode [ 667.414385][T18821] bridge0: entered promiscuous mode [ 667.491449][T18830] netlink: 132 bytes leftover after parsing attributes in process `syz.3.3080'. [ 667.509454][T18832] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3079'. [ 667.561632][T18835] netlink: 68 bytes leftover after parsing attributes in process `syz.0.3079'. [ 667.888636][T18488] veth0_vlan: entered promiscuous mode [ 667.989587][T18848] pim6reg0: tun_chr_ioctl cmd 1074025675 [ 668.005471][T18848] pim6reg0: persist disabled [ 668.064256][T18860] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3086'. [ 668.130426][T18488] veth1_vlan: entered promiscuous mode [ 668.142548][T18853] syzkaller0: entered promiscuous mode [ 668.152223][T18853] syzkaller0: entered allmulticast mode [ 668.174191][T18863] netlink: 'syz.0.3087': attribute type 1 has an invalid length. [ 668.293573][T18865] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3088'. [ 668.323119][T18865] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3088'. [ 668.342911][T18488] veth0_macvtap: entered promiscuous mode [ 668.350663][T18870] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3088'. [ 668.365097][T18870] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3088'. [ 668.417725][T18488] veth1_macvtap: entered promiscuous mode [ 668.432451][T18867] tipc: Enabling of bearer rejected, failed to enable media [ 668.443861][ T7547] netdevsim netdevsim1 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 668.470951][ T7547] netdevsim netdevsim1 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 668.491263][ T7547] netdevsim netdevsim1 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 668.510688][T18488] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 668.531253][ T7547] netdevsim netdevsim1 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 668.563097][T18488] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 668.610762][ T7547] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 668.633080][ T7547] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 668.662210][T18881] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3090'. [ 668.680982][ T7547] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 668.756560][ T7547] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 669.056238][ T7551] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 669.075174][ T7551] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 669.215750][T18897] 8021q: adding VLAN 0 to HW filter on device bond10 [ 669.224982][T18897] bond9: (slave bond10): Enslaving as an active interface with an up link [ 669.269071][T18893] bond9: (slave gretap4): Enslaving as an active interface with an up link [ 669.290868][T11231] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 669.316086][T11231] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 669.992103][ T5645] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 670.011016][ T5645] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 670.024327][ T5645] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 670.041251][ T5645] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 670.052720][ T5645] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 670.522754][T18958] syzkaller1: entered promiscuous mode [ 670.537662][T18958] syzkaller1: entered allmulticast mode [ 670.574602][T18957] netlink: 'syz.2.3110': attribute type 8 has an invalid length. [ 671.014538][T18969] netdevsim netdevsim2 netdevsim0: entered promiscuous mode [ 671.057850][T18969] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 672.107258][ T5645] Bluetooth: hci0: command tx timeout [ 672.496694][T19009] syz_tun (unregistering): left allmulticast mode [ 672.562651][T19009] bridge0: port 2(syz_tun) entered disabled state [ 672.592461][T19009] vlan4: left promiscuous mode [ 672.764313][T19027] __nla_validate_parse: 10 callbacks suppressed [ 672.771847][T19027] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3122'. [ 672.862751][T19029] netlink: 5 bytes leftover after parsing attributes in process `syz.4.3123'. [ 672.875029][T19030] netlink: 5 bytes leftover after parsing attributes in process `syz.4.3123'. [ 673.122293][T19039] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3125'. [ 673.329284][T18940] bridge0: port 1(bridge_slave_0) entered blocking state [ 673.337026][T18940] bridge0: port 1(bridge_slave_0) entered disabled state [ 673.345052][T18940] bridge_slave_0: entered allmulticast mode [ 673.357226][T18940] bridge_slave_0: entered promiscuous mode [ 673.366595][T18940] bridge0: port 2(bridge_slave_1) entered blocking state [ 673.373880][T18940] bridge0: port 2(bridge_slave_1) entered disabled state [ 673.381643][T18940] bridge_slave_1: entered allmulticast mode [ 673.390010][T18940] bridge_slave_1: entered promiscuous mode [ 673.460066][T18940] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 673.499585][T18940] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 673.677198][T18940] team0: Port device team_slave_0 added [ 673.717761][T18940] team0: Port device team_slave_1 added [ 673.770167][ T8149] IPVS: starting estimator thread 0... [ 673.781510][T19059] IPVS: ip_vs_add_dest(): server weight less than zero [ 673.801983][T19059] IPVS: rr: FWM 3 0x00000003 - no destination available [ 673.827257][T18940] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 673.836162][T19059] IPVS: rr: FWM 3 0x00000003 - no destination available [ 673.843308][T18940] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 673.870898][T19062] IPVS: using max 24 ests per chain, 57600 per kthread [ 673.915467][T18940] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 673.945036][T18940] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 673.965161][T18940] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 674.018813][T18940] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 674.171380][T18940] hsr_slave_0: entered promiscuous mode [ 674.186344][ T5645] Bluetooth: hci0: command tx timeout [ 674.188982][T18940] hsr_slave_1: entered promiscuous mode [ 674.223950][T18940] debugfs: 'hsr0' already exists in 'hsr' [ 674.241228][T18940] Cannot create hsr debugfs directory [ 674.414889][T19076] netlink: 20 bytes leftover after parsing attributes in process `syz.1.3136'. [ 674.447043][T19076] netlink: 20 bytes leftover after parsing attributes in process `syz.1.3136'. [ 674.477485][T19076] netlink: 211720 bytes leftover after parsing attributes in process `syz.1.3136'. [ 674.694880][T19083] sch_fq: defrate 4294967293 ignored. [ 674.707906][T19083] netlink: 'syz.4.3139': attribute type 1 has an invalid length. [ 675.366629][T19115] netdevsim netdevsim4: Firmware load for './file0/file0/..' refused, path contains '..' component [ 675.423583][T19111] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3147'. [ 675.444258][T19111] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3147'. [ 675.459329][T19118] netlink: 'syz.1.3149': attribute type 1 has an invalid length. [ 675.480083][T19111] netlink: 'syz.4.3147': attribute type 18 has an invalid length. [ 675.497820][T19111] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3147'. [ 675.571220][T19119] erspan1: entered allmulticast mode [ 675.627258][T19118] syz.1.3149 (19118) used obsolete PPPIOCDETACH ioctl [ 676.030982][T19129] sctp: [Deprecated]: syz.3.3152 (pid 19129) Use of int in max_burst socket option deprecated. [ 676.030982][T19129] Use struct sctp_assoc_value instead [ 676.072891][T18940] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 676.084546][T18940] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 676.102365][T18940] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 676.114298][T18940] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 676.130438][T18940] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 676.150410][T18940] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 676.164233][T18940] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 676.204877][T18940] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 676.239814][T19131] netlink: 'syz.3.3152': attribute type 2 has an invalid length. [ 676.269320][ T5645] Bluetooth: hci0: command tx timeout [ 676.758306][T18940] 8021q: adding VLAN 0 to HW filter on device bond0 [ 676.828967][T18940] 8021q: adding VLAN 0 to HW filter on device team0 [ 676.910479][ T7551] bridge0: port 1(bridge_slave_0) entered blocking state [ 676.917933][ T7551] bridge0: port 1(bridge_slave_0) entered forwarding state [ 676.987772][ T3263] bridge0: port 2(bridge_slave_1) entered blocking state [ 676.994988][ T3263] bridge0: port 2(bridge_slave_1) entered forwarding state [ 677.100652][T19162] netlink: 'syz.3.3163': attribute type 1 has an invalid length. [ 677.224465][T19168] netlink: 'syz.2.3165': attribute type 13 has an invalid length. [ 677.263543][T19168] netlink: 'syz.2.3165': attribute type 17 has an invalid length. [ 677.482270][T19168] 8021q: adding VLAN 0 to HW filter on device bond0 [ 677.493533][T19168] 8021q: adding VLAN 0 to HW filter on device team0 [ 677.510900][T19168] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 677.579379][T19168] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 677.590372][T19168] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 677.613185][T19168] veth1_vlan: left promiscuous mode [ 677.621806][T19168] veth0_vlan: left promiscuous mode [ 677.629753][T19168] veth0_vlan: entered promiscuous mode [ 677.642232][T19168] veth1_vlan: entered promiscuous mode [ 677.655774][T19168] veth1_macvtap: left promiscuous mode [ 677.663317][T19168] veth0_macvtap: left promiscuous mode [ 677.671977][T19168] veth0_macvtap: entered promiscuous mode [ 677.691524][T19168] veth1_macvtap: entered promiscuous mode [ 677.701817][T19168] geneve0: left promiscuous mode [ 677.713448][T19168] geneve0: entered promiscuous mode [ 677.727309][T19168] netdevsim netdevsim2 netdevsim0: left promiscuous mode [ 677.742857][T19168] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 677.757581][T19168] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 677.773185][T19168] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 677.812125][T19168] 8021q: adding VLAN 0 to HW filter on device bond1 [ 677.828701][T19168] 8021q: adding VLAN 0 to HW filter on device bond2 [ 677.866653][T19198] netlink: 'syz.1.3172': attribute type 11 has an invalid length. [ 678.347264][ T5645] Bluetooth: hci0: command tx timeout [ 682.865582][T19168] erspan1: refused to change device tx_queue_len [ 682.873221][T19168] A link change request failed with some changes committed already. Interface erspan1 may have been left with an inconsistent configuration, please check. [ 682.965632][ T1015] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 683.000550][ T1015] netdevsim netdevsim2 netdevsim1: set [1, 1] type 2 family 0 port 58357 - 0 [ 683.028653][ T1015] netdevsim netdevsim2 netdevsim1: set [1, 2] type 2 family 0 port 20004 - 0 [ 683.042532][ T1015] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 683.054843][ T1015] netdevsim netdevsim2 netdevsim2: set [1, 1] type 2 family 0 port 58357 - 0 [ 683.070216][ T1015] netdevsim netdevsim2 netdevsim2: set [1, 2] type 2 family 0 port 20004 - 0 [ 683.304054][T19199] 8021q: adding VLAN 0 to HW filter on device bond0 [ 683.334163][T19199] 8021q: adding VLAN 0 to HW filter on device team0 [ 683.364349][T19199] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 683.453059][T19199] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 683.480688][T19199] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 683.518096][T19199] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 683.539913][T19199] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 683.567870][T19199] veth1_vlan: left promiscuous mode [ 683.576642][T19199] veth0_vlan: left promiscuous mode [ 683.584600][T19199] veth0_vlan: entered promiscuous mode [ 683.594964][T19199] veth1_vlan: entered promiscuous mode [ 683.607396][T19199] veth1_macvtap: left promiscuous mode [ 683.614485][T19199] veth0_macvtap: left promiscuous mode [ 683.622396][T19199] veth0_macvtap: entered promiscuous mode [ 683.630197][T19199] veth1_macvtap: entered promiscuous mode [ 683.645807][T19199] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 683.656184][T19199] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 683.665999][T19199] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 683.678972][T19199] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 683.691234][T19199] 8021q: adding VLAN 0 to HW filter on device bond1 [ 683.705122][T19200] mac80211_hwsim hwsim52 wlan0: entered promiscuous mode [ 683.719585][T19200] mac80211_hwsim hwsim52 wlan0: entered allmulticast mode [ 683.745536][ T1015] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 683.764759][ T1015] netdevsim netdevsim2 netdevsim3: set [1, 1] type 2 family 0 port 58357 - 0 [ 683.781425][ T1015] netdevsim netdevsim2 netdevsim3: set [1, 2] type 2 family 0 port 20004 - 0 [ 683.832019][T11231] bridge0: port 1(bridge_slave_0) entered blocking state [ 683.839284][T11231] bridge0: port 1(bridge_slave_0) entered forwarding state [ 683.877589][T19225] __nla_validate_parse: 5 callbacks suppressed [ 683.877612][T19225] netlink: 3 bytes leftover after parsing attributes in process `syz.1.3177'. [ 683.879986][T11231] bridge0: port 2(bridge_slave_1) entered blocking state [ 683.900173][T11231] bridge0: port 2(bridge_slave_1) entered forwarding state [ 683.952003][T19229] netlink: 'syz.3.3178': attribute type 61 has an invalid length. [ 684.002270][T19225] 0ªX¹¦À: renamed from batadv0 (while UP) [ 684.032244][T19225] 0ªX¹¦À: entered allmulticast mode [ 684.049247][T19225] A link change request failed with some changes committed already. Interface 60ªX¹¦À may have been left with an inconsistent configuration, please check. [ 684.119957][ T1015] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 684.168139][T19235] veth0: entered promiscuous mode [ 684.177250][T19235] veth0: left promiscuous mode [ 684.191902][ T1015] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 684.210515][ T1015] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 684.252370][ T1015] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 684.316492][T19244] netlink: 292 bytes leftover after parsing attributes in process `syz.1.3183'. [ 684.345215][ T1015] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 684.454936][T19248] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3184'. [ 684.484753][T19245] bridge0: port 2(vlan5) entered blocking state [ 684.498067][T19247] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3184'. [ 684.544049][T19245] bridge0: port 2(vlan5) entered disabled state [ 684.583651][T19245] vlan5: entered allmulticast mode [ 684.663081][T19245] vlan5: entered promiscuous mode [ 684.767670][T19245] vlan4: entered promiscuous mode [ 685.213585][T19277] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3188'. [ 685.258546][T19279] syzkaller1: entered promiscuous mode [ 685.297362][T19279] syzkaller1: entered allmulticast mode [ 685.862127][T19305] x_tables: unsorted entry at hook 2 [ 686.252904][T19319] sctp: [Deprecated]: syz.3.3200 (pid 19319) Use of int in max_burst socket option. [ 686.252904][T19319] Use struct sctp_assoc_value instead [ 686.318102][T19320] netlink: 44 bytes leftover after parsing attributes in process `syz.1.3198'. [ 686.597414][T19329] netlink: 'syz.1.3201': attribute type 39 has an invalid length. [ 686.797672][T18940] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 687.000164][T18940] veth0_vlan: entered promiscuous mode [ 687.061809][T18940] veth1_vlan: entered promiscuous mode [ 687.190545][T18940] veth0_macvtap: entered promiscuous mode [ 687.221150][T18940] veth1_macvtap: entered promiscuous mode [ 687.285323][T18940] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 687.329943][T18940] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 687.377078][ T3263] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 687.403537][T19340] x_tables: duplicate underflow at hook 2 [ 687.418492][ T7548] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 687.431715][ T7548] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 687.478036][ T7548] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 687.818434][ T7112] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 687.841666][ T7112] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 687.961489][ T7112] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 687.996975][ T7112] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 688.185841][ C1] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 688.325690][T19359] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3212'. [ 688.382474][T19359] netlink: 'syz.4.3212': attribute type 1 has an invalid length. [ 688.589605][T19372] netlink: 199836 bytes leftover after parsing attributes in process `syz.3.3215'. [ 688.655693][T19372] ksmbd: Unknown IPC event: 1, ignore. [ 692.644288][T19383] netlink: 20 bytes leftover after parsing attributes in process `syz.1.3218'. [ 692.868288][T19389] netlink: 260 bytes leftover after parsing attributes in process `syz.1.3220'. [ 693.060041][T19404] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3225'. [ 693.132731][T19405] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3224'. [ 693.182910][ T1015] nci: nci_rx_work: unknown MT 0x7 [ 693.232250][T19405] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 693.793592][T19396] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 694.154383][T19434] netlink: 44 bytes leftover after parsing attributes in process `syz.1.3231'. [ 694.567957][T19444] netlink: 'syz.4.3236': attribute type 1 has an invalid length. [ 694.644199][T19433] A link change request failed with some changes committed already. Interface bridge_slave_0 may have been left with an inconsistent configuration, please check. [ 694.734999][T19444] 8021q: adding VLAN 0 to HW filter on device bond1 [ 694.859012][T19445] bond1: (slave ip6gretap0): Enslaving as a backup interface with an up link [ 694.906842][ T7548] bond1: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 695.085647][ T7551] bond1: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 695.319433][T19462] syzkaller0: default qdisc (pfifo_fast) fail, fallback to noqueue [ 695.428007][T19482] netlink: 'syz.0.3244': attribute type 1 has an invalid length. [ 695.444098][T19482] netlink: 228 bytes leftover after parsing attributes in process `syz.0.3244'. [ 695.475614][ C1] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 695.500111][T19478] netlink: 92 bytes leftover after parsing attributes in process `syz.1.3242'. [ 696.050426][T19512] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3255'. [ 696.087754][T19513] netlink: 'syz.1.3255': attribute type 3 has an invalid length. [ 696.117340][T19512] netlink: 'syz.1.3255': attribute type 3 has an invalid length. [ 696.201711][T19518] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3257'. [ 696.538804][T19527] netlink: 92 bytes leftover after parsing attributes in process `syz.0.3260'. [ 696.648082][T19534] netlink: 'syz.2.3262': attribute type 1 has an invalid length. [ 696.668751][T19534] veth1_vlan: Device is already in use. [ 696.772063][T19537] netlink: 'syz.3.3263': attribute type 8 has an invalid length. [ 696.837567][T19537] geneve2: entered promiscuous mode [ 696.880438][T19537] geneve2: entered allmulticast mode [ 696.960560][T19547] xt_TCPMSS: Only works on TCP SYN packets [ 697.318733][T19554] IPv6: NLM_F_REPLACE set, but no existing node found! [ 697.631630][T19570] syzkaller0: renamed from batadv_slave_1 (while UP) [ 697.693346][T19572] __nla_validate_parse: 5 callbacks suppressed [ 697.693369][T19572] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3272'. [ 697.721744][T19575] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3272'. [ 698.156664][T19589] ipt_rpfilter: unknown options [ 698.167873][T19584] netlink: 92 bytes leftover after parsing attributes in process `syz.0.3274'. [ 698.941708][T19594] bridge0: port 2(bridge_slave_1) entered disabled state [ 698.950200][T19594] bridge0: port 1(bridge_slave_0) entered disabled state [ 699.346108][ T5639] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 699.363801][ T5639] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 699.377660][ T5639] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 699.400195][ T5639] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 699.410989][ T5639] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 699.579402][T19594] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 699.624334][T19594] batman_adv: batadv0: Interface deactivated: syzkaller0 [ 699.973579][ T7547] netdevsim netdevsim4 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 699.998629][ T7547] netdevsim netdevsim4 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 700.174892][ T7547] netdevsim netdevsim4 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 700.189714][T19622] xt_recent: hitcount (4294967288) is larger than allowed maximum (65535) [ 700.217438][ T7547] netdevsim netdevsim4 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 700.608309][T19632] netlink: 92 bytes leftover after parsing attributes in process `syz.0.3288'. [ 700.938399][T19644] IPVS: sync thread started: state = BACKUP, mcast_ifn = veth0_to_bond, syncid = 3, id = 0 [ 701.172982][T19649] Bluetooth: MGMT ver 1.23 [ 701.229819][ T5645] Bluetooth: hci0: command tx timeout [ 701.546197][ T5645] Bluetooth: hci4: command tx timeout [ 701.665099][T19667] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3299'. [ 701.775172][T19667] netlink: 'syz.0.3299': attribute type 1 has an invalid length. [ 701.850788][T19667] bond1: entered promiscuous mode [ 701.857773][T19667] 8021q: adding VLAN 0 to HW filter on device bond1 [ 702.259835][T19612] bridge0: port 1(bridge_slave_0) entered blocking state [ 702.281309][T19612] bridge0: port 1(bridge_slave_0) entered disabled state [ 702.297910][T19612] bridge_slave_0: entered allmulticast mode [ 702.324077][T19612] bridge_slave_0: entered promiscuous mode [ 702.349528][T19694] workqueue: Failed to create a rescuer kthread for wq "bond2": -EINTR [ 702.354298][T19697] workqueue: Failed to create a rescuer kthread for wq "bond2": -EINTR [ 702.395036][T19612] bridge0: port 2(bridge_slave_1) entered blocking state [ 702.431976][T19612] bridge0: port 2(bridge_slave_1) entered disabled state [ 702.451701][T19612] bridge_slave_1: entered allmulticast mode [ 702.481681][T19612] bridge_slave_1: entered promiscuous mode [ 702.602386][T19713] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3307'. [ 702.777706][T19612] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 702.832502][T19612] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 703.040035][T19612] team0: Port device team_slave_0 added [ 703.129350][T19612] team0: Port device team_slave_1 added [ 703.272261][T19731] syzkaller0: default qdisc (pfifo_fast) fail, fallback to noqueue [ 703.283366][T19744] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3315'. [ 703.320903][T19737] tipc: Enabling of bearer rejected, failed to enable media [ 703.534015][T19612] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 703.561734][T19612] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 703.625665][ T5645] Bluetooth: hci4: command tx timeout [ 703.662226][T19612] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 703.757440][T19612] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 703.782567][T19612] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 703.866338][T19612] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 703.890237][T19757] netlink: 72 bytes leftover after parsing attributes in process `syz.3.3317'. [ 703.938645][T19763] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3321'. [ 704.152473][T19612] hsr_slave_0: entered promiscuous mode [ 704.182186][T19612] hsr_slave_1: entered promiscuous mode [ 704.204576][T19612] debugfs: 'hsr0' already exists in 'hsr' [ 704.225798][T19612] Cannot create hsr debugfs directory [ 704.559020][T19782] netlink: 9 bytes leftover after parsing attributes in process `syz.4.3325'. [ 704.651896][T19782] gretap0: entered promiscuous mode [ 705.213225][T19791] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3327'. [ 705.232319][T19792] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3327'. [ 705.292597][T19795] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3330'. [ 705.311982][T19797] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3330'. [ 705.482617][T19612] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 705.502075][T19612] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 1] type 2 family 0 port 58357 - 0 [ 705.513951][T19612] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 2] type 2 family 0 port 20004 - 0 [ 705.708093][ T5645] Bluetooth: hci4: command tx timeout [ 705.904851][T19612] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 705.919948][T19612] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 1] type 2 family 0 port 58357 - 0 [ 705.932197][T19612] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 2] type 2 family 0 port 20004 - 0 [ 705.986368][T19810] tipc: New replicast peer: 172.30.0.2 [ 706.002581][T19810] tipc: Enabled bearer , priority 10 [ 706.021042][T19807] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3334'. [ 706.058200][T19807] tipc: Disabling bearer [ 706.164664][T19612] bond0: (slave netdevsim1): Releasing backup interface [ 706.215017][T19612] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 706.239404][T19612] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 1] type 2 family 0 port 58357 - 0 [ 706.258387][T19612] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 2] type 2 family 0 port 20004 - 0 [ 706.316027][T19823] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3339'. [ 706.339246][T19823] tipc: Started in network mode [ 706.352937][T19823] tipc: Node identity aaaaaaaaaa3f, cluster identity 4711 [ 706.365150][T19823] tipc: Enabled bearer , priority 0 [ 706.804544][T19844] FAULT_INJECTION: forcing a failure. [ 706.804544][T19844] name failslab, interval 1, probability 0, space 0, times 0 [ 706.862643][T19844] CPU: 1 UID: 0 PID: 19844 Comm: syz.1.3345 Not tainted syzkaller #0 PREEMPT(full) [ 706.862680][T19844] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 706.862695][T19844] Call Trace: [ 706.862705][T19844] [ 706.862714][T19844] dump_stack_lvl+0xe8/0x150 [ 706.862804][T19844] should_fail_ex+0x40c/0x560 [ 706.862870][T19844] should_failslab+0xa8/0x100 [ 706.862933][T19844] ? skb_clone+0x212/0x3a0 [ 706.863043][T19844] kmem_cache_alloc_noprof+0x87/0x650 [ 706.863087][T19844] skb_clone+0x212/0x3a0 [ 706.863116][T19844] __netlink_deliver_tap+0x413/0x860 [ 706.863198][T19844] ? netlink_deliver_tap+0x2e/0x1b0 [ 706.863224][T19844] netlink_deliver_tap+0x19c/0x1b0 [ 706.863249][T19844] netlink_unicast+0x77f/0x940 [ 706.863319][T19844] netlink_sendmsg+0x813/0xb40 [ 706.863353][T19844] ? __pfx_netlink_sendmsg+0x10/0x10 [ 706.863382][T19844] ? aa_sock_msg_perm+0xf1/0x1b0 [ 706.863461][T19844] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 706.863507][T19844] ? __pfx_netlink_sendmsg+0x10/0x10 [ 706.863533][T19844] ____sys_sendmsg+0x9b9/0xa20 [ 706.863557][T19844] ? __might_fault+0xaf/0x130 [ 706.863600][T19844] ? __pfx_____sys_sendmsg+0x10/0x10 [ 706.863641][T19844] ? import_iovec+0x73/0xa0 [ 706.863698][T19844] ___sys_sendmsg+0x2a5/0x360 [ 706.863721][T19844] ? __lock_acquire+0x683/0x2cd0 [ 706.863765][T19844] ? __pfx____sys_sendmsg+0x10/0x10 [ 706.863830][T19844] ? __fget_files+0x2a/0x420 [ 706.863871][T19844] ? __fget_files+0x3a2/0x420 [ 706.863910][T19844] __x64_sys_sendmsg+0x1bd/0x2a0 [ 706.863938][T19844] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 706.863972][T19844] ? __pfx_ksys_write+0x10/0x10 [ 706.864015][T19844] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 706.864053][T19844] do_syscall_64+0x174/0x580 [ 706.864101][T19844] ? trace_irq_disable+0x3b/0x140 [ 706.864145][T19844] ? clear_bhb_loop+0x40/0x90 [ 706.864172][T19844] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 706.864193][T19844] RIP: 0033:0x7f0624b9ce59 [ 706.864214][T19844] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 706.864233][T19844] RSP: 002b:00007f06259dc028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 706.864256][T19844] RAX: ffffffffffffffda RBX: 00007f0624e15fa0 RCX: 00007f0624b9ce59 [ 706.864273][T19844] RDX: 0000000004004010 RSI: 0000200000000140 RDI: 0000000000000003 [ 706.864287][T19844] RBP: 00007f06259dc090 R08: 0000000000000000 R09: 0000000000000000 [ 706.864301][T19844] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 706.864313][T19844] R13: 00007f0624e16038 R14: 00007f0624e15fa0 R15: 00007fffd0e42618 [ 706.864349][T19844] [ 707.223608][T19612] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 707.236804][T19612] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 707.254116][T19612] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 707.274242][T19612] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 707.292701][T19612] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 707.306939][T19612] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 707.316862][T19612] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 707.336139][T19612] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 707.352531][T19856] netlink: 'syz.1.3349': attribute type 37 has an invalid length. [ 707.383676][T19856] lo: entered allmulticast mode [ 707.401134][T19856] bond0: entered promiscuous mode [ 707.426423][T19856] bond_slave_0: entered promiscuous mode [ 707.442668][T19856] bond_slave_1: entered promiscuous mode [ 707.549826][ T5739] tipc: Node number set to 9808554 [ 707.786363][ T5645] Bluetooth: hci4: command tx timeout [ 707.872241][T19612] 8021q: adding VLAN 0 to HW filter on device bond0 [ 707.960628][T19612] 8021q: adding VLAN 0 to HW filter on device team0 [ 707.992761][T19895] FAULT_INJECTION: forcing a failure. [ 707.992761][T19895] name failslab, interval 1, probability 0, space 0, times 0 [ 708.007603][T19895] CPU: 1 UID: 0 PID: 19895 Comm: syz.0.3358 Not tainted syzkaller #0 PREEMPT(full) [ 708.007631][T19895] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 708.007644][T19895] Call Trace: [ 708.007652][T19895] [ 708.007661][T19895] dump_stack_lvl+0xe8/0x150 [ 708.007691][T19895] should_fail_ex+0x40c/0x560 [ 708.007733][T19895] should_failslab+0xa8/0x100 [ 708.007757][T19895] __kmalloc_cache_noprof+0x88/0x660 [ 708.007790][T19895] ? tcf_action_init_1+0x1c2/0x740 [ 708.007949][T19895] tcf_action_init_1+0x1c2/0x740 [ 708.007989][T19895] ? __pfx_tcf_action_init_1+0x10/0x10 [ 708.008028][T19895] ? _raw_read_unlock+0x28/0x50 [ 708.008093][T19895] ? tc_action_load_ops+0x247/0x540 [ 708.008148][T19895] ? __nla_parse+0x40/0x60 [ 708.008183][T19895] tcf_action_init+0x30e/0xb10 [ 708.008226][T19895] ? __pfx_tcf_action_init+0x10/0x10 [ 708.008289][T19895] ? __pfx___nla_validate_parse+0x10/0x10 [ 708.008316][T19895] ? rcu_is_watching+0x15/0xb0 [ 708.008392][T19895] tc_ctl_action+0x43b/0xc70 [ 708.008438][T19895] ? __pfx_tc_ctl_action+0x10/0x10 [ 708.008477][T19895] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 708.008558][T19895] ? __pfx_tc_ctl_action+0x10/0x10 [ 708.008588][T19895] rtnetlink_rcv_msg+0x7b9/0xc00 [ 708.008686][T19895] ? rtnetlink_rcv_msg+0x1c9/0xc00 [ 708.008718][T19895] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 708.008749][T19895] ? ref_tracker_free+0x689/0x830 [ 708.008810][T19895] ? __pfx_ref_tracker_free+0x10/0x10 [ 708.008844][T19895] netlink_rcv_skb+0x226/0x4a0 [ 708.008870][T19895] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 708.008905][T19895] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 708.008943][T19895] ? netlink_deliver_tap+0x2e/0x1b0 [ 708.008966][T19895] ? netlink_deliver_tap+0x2e/0x1b0 [ 708.008996][T19895] netlink_unicast+0x7bb/0x940 [ 708.009053][T19895] netlink_sendmsg+0x813/0xb40 [ 708.009088][T19895] ? __pfx_netlink_sendmsg+0x10/0x10 [ 708.009117][T19895] ? aa_sock_msg_perm+0xf1/0x1b0 [ 708.009151][T19895] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 708.009179][T19895] ? __pfx_netlink_sendmsg+0x10/0x10 [ 708.009206][T19895] ____sys_sendmsg+0x9b9/0xa20 [ 708.009229][T19895] ? __might_fault+0xaf/0x130 [ 708.009265][T19895] ? __pfx_____sys_sendmsg+0x10/0x10 [ 708.009299][T19895] ? import_iovec+0x73/0xa0 [ 708.009328][T19895] ___sys_sendmsg+0x2a5/0x360 [ 708.009351][T19895] ? __lock_acquire+0x683/0x2cd0 [ 708.009378][T19895] ? __pfx____sys_sendmsg+0x10/0x10 [ 708.009483][T19895] ? __fget_files+0x2a/0x420 [ 708.009509][T19895] ? __fget_files+0x3a2/0x420 [ 708.009548][T19895] __x64_sys_sendmsg+0x1bd/0x2a0 [ 708.009575][T19895] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 708.009611][T19895] ? __pfx_ksys_write+0x10/0x10 [ 708.009654][T19895] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 708.009678][T19895] do_syscall_64+0x174/0x580 [ 708.009701][T19895] ? trace_irq_disable+0x3b/0x140 [ 708.009733][T19895] ? clear_bhb_loop+0x40/0x90 [ 708.009761][T19895] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 708.009782][T19895] RIP: 0033:0x7f0302b9ce59 [ 708.009801][T19895] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 708.009820][T19895] RSP: 002b:00007f03039e6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 708.009842][T19895] RAX: ffffffffffffffda RBX: 00007f0302e15fa0 RCX: 00007f0302b9ce59 [ 708.009859][T19895] RDX: 0000000004004010 RSI: 0000200000000140 RDI: 0000000000000003 [ 708.009872][T19895] RBP: 00007f03039e6090 R08: 0000000000000000 R09: 0000000000000000 [ 708.009886][T19895] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 708.009898][T19895] R13: 00007f0302e16038 R14: 00007f0302e15fa0 R15: 00007ffe5629a308 [ 708.009934][T19895] [ 708.477996][ T3274] bridge0: port 1(bridge_slave_0) entered blocking state [ 708.485221][ T3274] bridge0: port 1(bridge_slave_0) entered forwarding state [ 708.511039][ T3274] bridge0: port 2(bridge_slave_1) entered blocking state [ 708.518669][ T3274] bridge0: port 2(bridge_slave_1) entered forwarding state [ 708.534099][T19898] __nla_validate_parse: 7 callbacks suppressed [ 708.534123][T19898] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3359'. [ 708.794890][T19900] netlink: 20 bytes leftover after parsing attributes in process `syz.0.3360'. [ 708.872901][T19908] netlink: 64 bytes leftover after parsing attributes in process `syz.4.3362'. [ 708.915510][T19909] netlink: 64 bytes leftover after parsing attributes in process `syz.4.3362'. [ 708.948022][T19908] netlink: 64 bytes leftover after parsing attributes in process `syz.4.3362'. [ 709.505130][T19937] netlink: 'syz.0.3367': attribute type 10 has an invalid length. [ 709.800784][T19612] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 709.994994][T19612] veth0_vlan: entered promiscuous mode [ 710.049317][T19612] veth1_vlan: entered promiscuous mode [ 710.180011][T19612] veth0_macvtap: entered promiscuous mode [ 710.205305][T19612] veth1_macvtap: entered promiscuous mode [ 710.207110][T19963] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3372'. [ 710.341875][T19612] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 710.409842][T19612] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 710.498103][ T7112] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 710.525548][ T7112] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 710.554901][ T7112] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 710.569141][ T7112] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 710.825918][ C1] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 710.975113][T19982] bridge0: port 2(bridge_slave_1) entered disabled state [ 710.983481][T19982] bridge0: port 1(bridge_slave_0) entered disabled state [ 711.038126][T19982] bridge_slave_0: left allmulticast mode [ 711.043854][T19982] bridge_slave_0: left promiscuous mode [ 711.053466][T19982] bridge0: port 1(bridge_slave_0) entered disabled state [ 711.072695][T19982] bridge_slave_1: left allmulticast mode [ 711.080253][T19982] bridge_slave_1: left promiscuous mode [ 711.087265][T19982] bridge0: port 2(bridge_slave_1) entered disabled state [ 711.104911][T19982] bond0: (slave bond_slave_0): Releasing backup interface [ 711.123448][T19982] bond0: (slave bond_slave_1): Releasing backup interface [ 711.139832][T19982] team_slave_0: left allmulticast mode [ 711.149237][T19982] team0: Port device team_slave_0 removed [ 711.161094][T19982] team_slave_1: left allmulticast mode [ 711.169443][T19982] team0: Port device team_slave_1 removed [ 711.179096][T19982] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 711.190885][T19982] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 711.202499][T19982] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 711.214698][T19982] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 711.235294][T19982] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 711.801684][T19995] mac80211_hwsim hwsim50 wlan0: entered promiscuous mode [ 711.809864][T19995] mac80211_hwsim hwsim50 wlan0: entered allmulticast mode [ 713.533487][T19968] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 713.633800][ T95] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 713.649536][ T95] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 713.758322][ T95] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 713.787531][ T95] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 713.861567][T20005] netlink: 44 bytes leftover after parsing attributes in process `syz.4.3381'. [ 713.880324][T19999] xt_CT: No such helper "snmp_trap" [ 713.890341][T20005] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3381'. [ 714.072002][T20012] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3384'. [ 714.094949][T20014] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3279'. [ 714.100148][T20012] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3384'. [ 714.240286][T20020] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3387'. [ 714.260941][T20020] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3387'. [ 714.292726][T20020] netlink: 'syz.4.3387': attribute type 1 has an invalid length. [ 714.348745][T20020] bond2: entered promiscuous mode [ 714.357069][T20020] 8021q: adding VLAN 0 to HW filter on device bond2 [ 714.459468][T20020] netlink: 28 bytes leftover after parsing attributes in process `syz.4.3387'. [ 714.476912][T20020] bond2: entered allmulticast mode [ 714.490771][T20034] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3389'. [ 714.561708][T20036] netlink: 236 bytes leftover after parsing attributes in process `syz.0.3391'. [ 714.597522][T20020] bond2: (slave bridge1): making interface the new active one [ 714.620371][T20020] bridge1: entered promiscuous mode [ 714.630863][T20020] bridge1: entered allmulticast mode [ 714.654277][T20020] bond2: (slave bridge1): Enslaving as an active interface with an up link [ 714.811273][T20039] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 714.961414][T20041] bridge0: port 2(bridge_slave_1) entered disabled state [ 715.117305][T20055] 8021q: adding VLAN 0 to HW filter on device batadv1 [ 715.140065][T20055] batadv1: entered allmulticast mode [ 715.196300][T20055] team0: Port device batadv1 added [ 715.720378][T20079] netlink: 'syz.1.3401': attribute type 1 has an invalid length. [ 715.737818][T20079] workqueue: Failed to create a rescuer kthread for wq "bond2": -EINTR [ 715.832305][T20090] xt_hl: Unknown Hop Limit match mode: 206 [ 716.206633][T20107] x_tables: ip6_tables: TCPMSS target: only valid for protocol 6 [ 716.317512][T20112] netlink: 'syz.0.3407': attribute type 39 has an invalid length. [ 716.366617][T20111] netlink: 'syz.1.3409': attribute type 21 has an invalid length. [ 716.410099][T20111] veth0_to_bridge: mtu less than device minimum [ 717.040887][T20135] netlink: 'syz.1.3415': attribute type 4 has an invalid length. [ 719.323174][T20114] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 719.616492][T20154] netlink: 'syz.1.3423': attribute type 4 has an invalid length. [ 719.642430][T20154] __nla_validate_parse: 7 callbacks suppressed [ 719.642451][T20154] netlink: 240 bytes leftover after parsing attributes in process `syz.1.3423'. [ 719.710286][T20150] bond1: left promiscuous mode [ 719.727949][ T65] bridge0: port 2(bridge_slave_1) entered blocking state [ 719.735271][ T65] bridge0: port 2(bridge_slave_1) entered forwarding state [ 719.790729][T20154] bridge_slave_0: left allmulticast mode [ 719.823915][T20154] bridge_slave_0: left promiscuous mode [ 719.872672][T20154] bridge0: port 1(bridge_slave_0) entered disabled state [ 719.922240][T20154] bridge_slave_1: left allmulticast mode [ 719.945031][T20154] bridge_slave_1: left promiscuous mode [ 719.973563][T20154] bridge0: port 2(bridge_slave_1) entered disabled state [ 719.998076][T20154] bond0: (slave bond_slave_0): Releasing backup interface [ 720.007796][T20154] bond_slave_0: left promiscuous mode [ 720.025234][T20154] bond0: (slave bond_slave_1): Releasing backup interface [ 720.039688][T20154] bond_slave_1: left promiscuous mode [ 720.087005][T20154] team0: Port device team_slave_0 removed [ 720.122465][T20154] team0: Port device team_slave_1 removed [ 720.136578][T20171] netlink: 'syz.0.3426': attribute type 10 has an invalid length. [ 720.145372][T20171] netlink: 228 bytes leftover after parsing attributes in process `syz.0.3426'. [ 720.153553][T20154] batman_adv: 60ªX¹¦À: Interface deactivated: batadv_slave_0 [ 720.166222][T20154] batman_adv: 60ªX¹¦À: Removing interface: batadv_slave_0 [ 720.178420][T20154] batman_adv: 60ªX¹¦À: Interface deactivated: batadv_slave_1 [ 720.201765][T20154] batman_adv: 60ªX¹¦À: Removing interface: batadv_slave_1 [ 720.217714][T20154] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 720.240180][T20168] netlink: 1100 bytes leftover after parsing attributes in process `syz.1.3423'. [ 720.389270][T20173] IPVS: set_ctl: invalid protocol: 0 172.30.0.1:20068 [ 720.510693][T20180] netlink: 92 bytes leftover after parsing attributes in process `syz.4.3430'. [ 720.599063][T20184] v: renamed from veth0_vlan (while UP) [ 720.749385][T20188] netlink: 32 bytes leftover after parsing attributes in process `syz.0.3432'. [ 721.114800][T20214] netlink: 'syz.1.3441': attribute type 1 has an invalid length. [ 721.229208][T20218] bond2: (slave ip6gretap1): Enslaving as a backup interface with an up link [ 721.320888][T20218] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3441'. [ 721.386143][T20225] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3441'. [ 721.401946][T20214] veth3: entered promiscuous mode [ 721.469467][T20214] bond2: (slave veth3): Enslaving as a backup interface with a down link [ 721.509100][T20218] 8021q: adding VLAN 0 to HW filter on device bond2 [ 721.522980][ T95] bond2: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 721.658918][T20232] xt_CT: No such helper "syz0" [ 721.708400][ T3274] bond2: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 721.731515][T20231] xt_CT: No such helper "syz0" [ 721.875180][T20240] netlink: 'syz.1.3446': attribute type 25 has an invalid length. [ 722.050283][T20244] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3448'. [ 722.182082][T20252] sit0: mtu less than device minimum [ 722.237604][T20252] netlink: 44 bytes leftover after parsing attributes in process `syz.2.3452'. [ 722.292848][T20257] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3454'. [ 722.400391][T20262] bridge0: port 3(ipvlan2) entered blocking state [ 722.424972][T20262] bridge0: port 3(ipvlan2) entered disabled state [ 722.462807][T20262] ipvlan2: entered allmulticast mode [ 722.489272][T20262] bridge0: entered allmulticast mode [ 722.512468][T20262] ipvlan2: left allmulticast mode [ 722.519107][T20262] bridge0: left allmulticast mode [ 722.642042][T20274] xt_hashlimit: size too large, truncated to 1048576 [ 722.912158][T20291] sctp: [Deprecated]: syz.0.3465 (pid 20291) Use of int in max_burst socket option deprecated. [ 722.912158][T20291] Use struct sctp_assoc_value instead [ 722.962260][T20293] lo: entered allmulticast mode [ 723.521011][T20321] FAULT_INJECTION: forcing a failure. [ 723.521011][T20321] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 723.534455][T20321] CPU: 1 UID: 0 PID: 20321 Comm: syz.1.3474 Not tainted syzkaller #0 PREEMPT(full) [ 723.534482][T20321] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 723.534496][T20321] Call Trace: [ 723.534504][T20321] [ 723.534513][T20321] dump_stack_lvl+0xe8/0x150 [ 723.534545][T20321] should_fail_ex+0x40c/0x560 [ 723.534587][T20321] _copy_to_user+0x31/0xb0 [ 723.534617][T20321] simple_read_from_buffer+0xe1/0x170 [ 723.534651][T20321] proc_fail_nth_read+0x1bb/0x230 [ 723.534705][T20321] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 723.534738][T20321] ? rw_verify_area+0x24a/0x4c0 [ 723.534771][T20321] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 723.534799][T20321] vfs_read+0x213/0xa80 [ 723.534835][T20321] ? __pfx___mutex_lock+0x10/0x10 [ 723.534861][T20321] ? __pfx_vfs_read+0x10/0x10 [ 723.534893][T20321] ? __fget_files+0x2a/0x420 [ 723.534922][T20321] ? __fget_files+0x3a2/0x420 [ 723.534946][T20321] ? __fget_files+0x2a/0x420 [ 723.534981][T20321] ksys_read+0x150/0x270 [ 723.535015][T20321] ? __pfx_ksys_read+0x10/0x10 [ 723.535068][T20321] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 723.535092][T20321] do_syscall_64+0x174/0x580 [ 723.535116][T20321] ? clear_bhb_loop+0x40/0x90 [ 723.535143][T20321] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 723.535164][T20321] RIP: 0033:0x7f0624b5d68e [ 723.535183][T20321] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 723.535201][T20321] RSP: 002b:00007f06259dbfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 723.535224][T20321] RAX: ffffffffffffffda RBX: 00007f06259dc6c0 RCX: 00007f0624b5d68e [ 723.535240][T20321] RDX: 000000000000000f RSI: 00007f06259dc0a0 RDI: 0000000000000005 [ 723.535254][T20321] RBP: 00007f06259dc090 R08: 0000000000000000 R09: 0000000000000000 [ 723.535267][T20321] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 723.535280][T20321] R13: 00007f0624e16038 R14: 00007f0624e15fa0 R15: 00007fffd0e42618 [ 723.535316][T20321] [ 723.938185][T20300] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 724.153220][T20344] openvswitch: netlink: Flow get message rejected, Key attribute missing. [ 724.575094][T20365] gretap0: left promiscuous mode [ 724.694884][T20365] bond2: left promiscuous mode [ 724.709325][T20365] bridge1: left promiscuous mode [ 724.726884][T20365] bond2: left allmulticast mode [ 724.738436][T20365] bridge1: left allmulticast mode [ 725.098878][T20379] __nla_validate_parse: 12 callbacks suppressed [ 725.098900][T20379] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3489'. [ 725.316336][T20387] netlink: 'syz.0.3493': attribute type 1 has an invalid length. [ 725.804875][T20399] netlink: 16 bytes leftover after parsing attributes in process `syz.0.3496'. [ 725.986975][T20413] bridge0: entered allmulticast mode [ 726.163262][T20421] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3503'. [ 726.173144][T20421] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3503'. [ 726.199563][T20425] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3503'. [ 726.208964][T20425] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3503'. [ 726.712640][T20417] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3502'. [ 726.747254][T20438] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3508'. [ 726.766084][T20438] vlan2: entered promiscuous mode [ 726.771208][T20438] gretap0: entered promiscuous mode [ 726.808458][T20417] netlink: 'syz.0.3502': attribute type 1 has an invalid length. [ 726.816587][T20417] netlink: 'syz.0.3502': attribute type 2 has an invalid length. [ 727.067400][T20448] netlink: 'syz.3.3508': attribute type 25 has an invalid length. [ 727.378658][T20463] netlink: 'syz.4.3515': attribute type 2 has an invalid length. [ 727.386463][T20463] netlink: 232 bytes leftover after parsing attributes in process `syz.4.3515'. [ 727.649301][T20473] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3518'. [ 727.659786][T20471] workqueue: Failed to create a rescuer kthread for wq "nfc2_nci_tx_wq": -EINTR [ 728.744325][T20523] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 729.308942][T20529] bond2: Removing last ns target with arp_interval on [ 729.588892][T20544] ip6gre1: entered promiscuous mode [ 729.594792][T20544] ip6gre1: entered allmulticast mode [ 729.833837][T20558] netlink: 'syz.0.3536': attribute type 2 has an invalid length. [ 729.842876][T20558] netlink: 'syz.0.3536': attribute type 1 has an invalid length. [ 730.026700][T20560] netlink: 'syz.4.3537': attribute type 1 has an invalid length. [ 730.071792][T20566] netlink: 'syz.2.3540': attribute type 1 has an invalid length. [ 730.167994][T20566] bond1: entered promiscuous mode [ 730.177715][T20566] 8021q: adding VLAN 0 to HW filter on device bond1 [ 730.313343][T20566] 8021q: adding VLAN 0 to HW filter on device bond1 [ 730.320736][T20566] bond1: (slave vti0): The slave device specified does not support setting the MAC address [ 730.330884][T20566] bond1: (slave vti0): Setting fail_over_mac to active for active-backup mode [ 730.409513][T20566] bond1: (slave vti0): making interface the new active one [ 730.417158][T20566] vti0: entered promiscuous mode [ 730.436652][T20566] bond1: (slave vti0): Enslaving as an active interface with an up link [ 730.668368][T20591] bridge0: port 1(bridge_slave_0) entered disabled state [ 730.692540][T20593] __nla_validate_parse: 7 callbacks suppressed [ 730.692562][T20593] netlink: 32 bytes leftover after parsing attributes in process `syz.1.3547'. [ 730.718177][T20591] netlink: 'syz.2.3546': attribute type 5 has an invalid length. [ 730.941532][T20601] netlink: 92 bytes leftover after parsing attributes in process `syz.1.3550'. [ 731.078079][T20609] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3553'. [ 731.164963][T20611] netlink: 'syz.0.3555': attribute type 3 has an invalid length. [ 731.217384][T20616] netlink: 52 bytes leftover after parsing attributes in process `syz.3.3557'. [ 731.435558][ T3274] tipc: Subscription rejected, illegal request [ 731.463730][T20624] netlink: 'syz.0.3561': attribute type 1 has an invalid length. [ 731.477210][T20624] netlink: 224 bytes leftover after parsing attributes in process `syz.0.3561'. [ 732.383935][T20634] netlink: 'syz.3.3565': attribute type 4 has an invalid length. [ 732.414270][T20633] veth0: entered promiscuous mode [ 732.422099][T20639] netlink: 'syz.4.3566': attribute type 3 has an invalid length. [ 732.497322][T20631] xt_CT: No such helper "netbios-ns" [ 732.504741][T20633] bond0: (slave ipvlan2): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 732.567903][T20637] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3562'. [ 732.610929][T20631] syzkaller0: entered allmulticast mode [ 732.747708][T20650] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3570'. [ 732.810411][T20633] veth0: left promiscuous mode [ 732.902841][T20655] netlink: 20 bytes leftover after parsing attributes in process `syz.4.3570'. [ 732.916362][T20654] netlink: 92 bytes leftover after parsing attributes in process `syz.0.3572'. [ 733.322278][ T30] audit: type=1107 audit(1781301496.399:11): pid=20666 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='' [ 733.401726][T20676] netlink: 68 bytes leftover after parsing attributes in process `syz.1.3578'. [ 734.925637][T20702] bond2: entered promiscuous mode [ 734.930921][T20702] bond2: entered allmulticast mode [ 734.937407][T20702] 8021q: adding VLAN 0 to HW filter on device bond2 [ 734.946620][T20716] openvswitch: netlink: Flow key attr not present in new flow. [ 734.999305][ T5645] Bluetooth: hci3: command tx timeout [ 735.029261][T20711] bond3: entered promiscuous mode [ 735.034631][T20711] bond3: entered allmulticast mode [ 735.040502][T20711] 8021q: adding VLAN 0 to HW filter on device bond3 [ 735.824367][T20748] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 735.899279][T20758] __nla_validate_parse: 3 callbacks suppressed [ 735.899306][T20758] netlink: 116 bytes leftover after parsing attributes in process `syz.4.3595'. [ 735.951565][T20748] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3595'. [ 736.040096][T20763] netlink: 27 bytes leftover after parsing attributes in process `syz.0.3601'. [ 736.119858][T20767] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3597'. [ 736.527826][T20779] netlink: 'syz.2.3604': attribute type 24 has an invalid length. [ 736.635790][T20791] netlink: 'syz.3.3608': attribute type 1 has an invalid length. [ 736.723436][T20791] bond3: entered promiscuous mode [ 736.731792][T20791] 8021q: adding VLAN 0 to HW filter on device bond3 [ 736.747251][T20791] netlink: 44 bytes leftover after parsing attributes in process `syz.3.3608'. [ 736.787102][T20791] bond3: (slave bridge2): making interface the new active one [ 736.795003][T20791] bridge2: entered promiscuous mode [ 736.803865][T20791] bond3: (slave bridge2): Enslaving as an active interface with an up link [ 736.849120][T20795] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3609'. [ 736.910154][T20797] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3611'. [ 736.920206][T20795] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3609'. [ 736.922562][T20797] netlink: 'syz.3.3611': attribute type 2 has an invalid length. [ 736.937440][T20797] netlink: 'syz.3.3611': attribute type 1 has an invalid length. [ 736.945296][T20797] netlink: 152 bytes leftover after parsing attributes in process `syz.3.3611'. [ 737.217053][T20813] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3615'. [ 737.853540][T20846] sch_tbf: burst 0 is lower than device syzkaller0 mtu (1514) ! [ 738.431548][T20829] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 738.871290][T20883] syzkaller1: entered promiscuous mode [ 738.905094][T20883] syzkaller1: entered allmulticast mode [ 739.041339][T20892] bridge4: entered promiscuous mode [ 739.046639][T20892] bridge4: entered allmulticast mode [ 739.056708][T20892] team0: Port device bridge4 added [ 739.246288][T20896] 8021q: adding VLAN 0 to HW filter on device ipvlan2 [ 739.787985][T20920] netlink: 'syz.1.3643': attribute type 58 has an invalid length. [ 739.832405][T20920] batadv0: entered promiscuous mode [ 739.850378][T20920] batadv0: left promiscuous mode [ 740.080249][T15395] bridge0: entered promiscuous mode [ 740.379315][T20957] netlink: 'syz.3.3651': attribute type 13 has an invalid length. [ 740.418755][T20957] netlink: 'syz.3.3651': attribute type 17 has an invalid length. [ 741.141371][T20976] __nla_validate_parse: 13 callbacks suppressed [ 741.141396][T20976] netlink: 52 bytes leftover after parsing attributes in process `syz.2.3659'. [ 741.463684][T20957] 8021q: adding VLAN 0 to HW filter on device bond0 [ 741.482884][T20957] team0: left allmulticast mode [ 741.497834][T20957] batadv1: left allmulticast mode [ 741.518118][T20957] 8021q: adding VLAN 0 to HW filter on device team0 [ 741.558366][ C1] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 741.585807][T20957] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 741.749558][T20957] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 741.760599][T20957] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 741.790160][T20957] virt_wifi0: default qdisc (pfifo_fast) fail, fallback to noqueue [ 741.804656][T20957] veth1_vlan: left promiscuous mode [ 741.813077][T20957] veth0_vlan: left promiscuous mode [ 741.819863][T20957] veth0_vlan: entered promiscuous mode [ 741.831941][T20957] veth1_vlan: entered promiscuous mode [ 741.861170][T20957] veth0_macvtap: left promiscuous mode [ 741.869576][T20957] veth0_macvtap: entered promiscuous mode [ 741.946943][T20957] veth1_macvtap: entered promiscuous mode [ 741.953150][T20957] veth1_macvtap: entered allmulticast mode [ 741.961045][T20957] macsec0: left promiscuous mode [ 741.967157][T20957] macsec0: left allmulticast mode [ 741.972365][T20957] veth1_macvtap: left allmulticast mode [ 741.988788][T20957] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 742.036100][T20957] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 742.080738][T20957] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 742.203604][T20957] netdevsim netdevsim3 netdevsim2: refused to change device tx_queue_len [ 742.222214][T20957] A link change request failed with some changes committed already. Interface netdevsim2 may have been left with an inconsistent configuration, please check. [ 742.293741][T20957] syz.3.3651 (20957) used greatest stack depth: 16416 bytes left [ 742.428529][T20988] netlink: 44 bytes leftover after parsing attributes in process `syz.3.3661'. [ 742.548917][T20976] netlink: 52 bytes leftover after parsing attributes in process `syz.2.3659'. [ 742.634538][T20981] bridge0: trying to set multicast startup query interval below minimum, setting to 100 (1000ms) [ 742.711106][T20993] netlink: 80 bytes leftover after parsing attributes in process `syz.0.3662'. [ 742.931898][T20999] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 742.952230][T20999] batadv_slave_1: entered promiscuous mode [ 743.002796][T21004] netlink: 36 bytes leftover after parsing attributes in process `syz.0.3666'. [ 743.188029][T21004] netlink: 16 bytes leftover after parsing attributes in process `syz.0.3666'. [ 743.213761][T21004] IPv6: NLM_F_CREATE should be specified when creating new route [ 743.237752][T21011] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3668'. [ 743.247236][T21004] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 743.254502][T21004] IPv6: NLM_F_CREATE should be set when creating new route [ 743.262403][T21004] IPv6: NLM_F_CREATE should be set when creating new route [ 743.279926][T21012] netlink: 92 bytes leftover after parsing attributes in process `syz.4.3667'. [ 743.545049][T21015] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 743.552515][T21015] IPv6: NLM_F_CREATE should be set when creating new route [ 744.216721][T21015] bridge0: port 2(bridge_slave_1) entered disabled state [ 744.764866][T21015] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 745.408002][T21036] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3674'. [ 745.486362][ T65] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 745.638405][ T65] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 745.651881][ T65] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 745.675617][ T65] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 745.952473][T21041] workqueue: Failed to create a rescuer kthread for wq "nfc2_nci_cmd_wq": -EINTR [ 745.953279][T21042] workqueue: Failed to create a rescuer kthread for wq "nfc2_nci_cmd_wq": -EINTR [ 746.057293][T21057] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3680'. [ 746.381498][T21070] netlink: 92 bytes leftover after parsing attributes in process `syz.4.3681'. [ 746.833858][T21091] netlink: 'syz.1.3687': attribute type 13 has an invalid length. [ 746.929703][T21099] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3691'. [ 747.155359][T21099] 8021q: adding VLAN 0 to HW filter on device bond4 [ 747.165373][ T7112] bond2: (slave ip6gretap1): link status up again after 0 ms [ 747.185996][T21103] ipvlan2: entered allmulticast mode [ 747.191370][T21103] bond4: entered allmulticast mode [ 747.227271][T21116] netlink: 212368 bytes leftover after parsing attributes in process `syz.2.3695'. [ 747.237861][T21107] bond4: (slave ipip0): refused to change device type [ 747.258770][ T95] bond2: (slave ip6gretap1): link status up again after 0 ms [ 747.297453][T21118] netlink: 'syz.2.3695': attribute type 1 has an invalid length. [ 747.367881][ T1015] bond2: (slave ip6gretap1): link status up again after 0 ms [ 747.473705][ T95] bond2: (slave ip6gretap1): link status up again after 0 ms [ 747.482120][ T95] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 747.584987][T11231] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 747.697054][ T95] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 747.865455][T21125] bond3: down delay (5) is not a multiple of miimon (2), value rounded to 4 ms [ 747.919920][T21125] bond3: entered promiscuous mode [ 748.015861][T11231] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 748.237353][ T12] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 748.395170][T21147] netlink: 72 bytes leftover after parsing attributes in process `syz.0.3698'. [ 748.505954][T21147] netlink: 72 bytes leftover after parsing attributes in process `syz.0.3698'. [ 748.548106][ T95] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 748.650624][T21146] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3697'. [ 748.696444][ T95] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 748.958269][T21161] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3700'. [ 749.041275][T21163] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3700'. [ 749.051813][T21170] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3702'. [ 749.101501][T21161] bond2 (unregistering): Released all slaves [ 749.243367][T21175] syzkaller1: entered promiscuous mode [ 749.249099][T21175] syzkaller1: entered allmulticast mode [ 749.277886][T21180] netlink: 'syz.2.3704': attribute type 6 has an invalid length. [ 749.286729][T21180] x_tables: arp_tables: NFQUEUE target: not valid for this family [ 749.304045][T21169] netlink: 'syz.3.3702': attribute type 11 has an invalid length. [ 749.476671][T21187] netlink: 'syz.2.3707': attribute type 1 has an invalid length. [ 749.573921][T21192] netlink: 'syz.3.3708': attribute type 12 has an invalid length. [ 749.583006][T21192] netlink: 132 bytes leftover after parsing attributes in process `syz.3.3708'. [ 749.618682][T21192] syzkaller1: tun_chr_ioctl cmd 2147767506 [ 749.626602][T21192] sch_tbf: burst 0 is lower than device veth1_virt_wifi mtu (1514) ! [ 749.662930][T21195] syzkaller0: entered promiscuous mode [ 749.670187][T21195] syzkaller0: entered allmulticast mode [ 750.195879][T21209] nbd: nbd3 already in use [ 750.574985][T21217] netlink: 'syz.0.3716': attribute type 10 has an invalid length. [ 751.041355][T21240] netlink: 'syz.4.3724': attribute type 1 has an invalid length. [ 751.051705][T21233] xt_ipcomp: unknown flags 1D [ 751.087052][T21240] bond4: entered promiscuous mode [ 751.093615][T21240] 8021q: adding VLAN 0 to HW filter on device bond4 [ 751.255941][T21247] syzkaller0: entered promiscuous mode [ 751.261605][T21247] syzkaller0: entered allmulticast mode [ 754.525226][ T5639] Bluetooth: hci5: command 0x0406 tx timeout [ 754.917461][ T7552] net_ratelimit: 16 callbacks suppressed [ 754.917485][ T7552] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 755.063741][T21267] __nla_validate_parse: 5 callbacks suppressed [ 755.063762][T21267] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3730'. [ 755.153121][ T7552] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 755.200813][ T5645] block nbd4: Receive control failed (result -1) [ 755.306792][ T7552] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 755.636999][T21273] [ 755.639405][T21273] ====================================================== [ 755.646625][T21273] WARNING: possible circular locking dependency detected [ 755.653778][T21273] syzkaller #0 Not tainted [ 755.658316][T21273] ------------------------------------------------------ [ 755.665357][T21273] syz.2.3732/21273 is trying to acquire lock: [ 755.671531][T21273] ffffffff8ea84d80 (fs_reclaim){+.+.}-{0:0}, at: prepare_alloc_pages+0x15b/0x650 [ 755.681323][T21273] [ 755.681323][T21273] but task is already holding lock: [ 755.688710][T21273] ffff888077cb8e68 (mapping.invalidate_lock#2){++++}-{4:4}, at: filemap_fault+0x9f6/0x1360 [ 755.698875][T21273] [ 755.698875][T21273] which lock already depends on the new lock. [ 755.698875][T21273] [ 755.710077][T21273] [ 755.710077][T21273] the existing dependency chain (in reverse order) is: [ 755.719105][T21273] [ 755.719105][T21273] -> #9 (mapping.invalidate_lock#2){++++}-{4:4}: [ 755.727656][T21273] down_read+0x47/0x2e0 [ 755.732542][T21273] filemap_fault+0x6c8/0x1360 [ 755.737771][T21273] __do_fault+0x138/0x2a0 [ 755.742654][T21273] do_pte_missing+0x6e1/0x3540 [ 755.747968][T21273] handle_mm_fault+0x1b38/0x3080 [ 755.753451][T21273] do_user_addr_fault+0xa4d/0x1340 [ 755.759582][T21273] exc_page_fault+0x6a/0xc0 [ 755.764632][T21273] asm_exc_page_fault+0x26/0x30 [ 755.770038][T21273] [ 755.770038][T21273] -> #8 (vm_lock){++++}-{0:0}: [ 755.777900][T21273] __vma_start_exclude_readers+0x283/0x930 [ 755.785139][T21273] __vma_start_write+0xdc/0x290 [ 755.790556][T21273] mprotect_fixup+0x761/0xb10 [ 755.795813][T21273] setup_arg_pages+0x658/0xbd0 [ 755.801239][T21273] load_elf_binary+0xc7e/0x2950 [ 755.806692][T21273] bprm_execve+0x9c7/0x1630 [ 755.811755][T21273] kernel_execve+0x8c0/0x9b0 [ 755.816923][T21273] try_to_run_init_process+0x13/0x60 [ 755.822969][T21273] kernel_init+0xad/0x1d0 [ 755.827958][T21273] ret_from_fork+0x514/0xb70 [ 755.833160][T21273] ret_from_fork_asm+0x1a/0x30 [ 755.838503][T21273] [ 755.838503][T21273] -> #7 (&mm->mmap_lock){++++}-{4:4}: [ 755.846824][T21273] __might_fault+0xcb/0x130 [ 755.851876][T21273] _copy_from_user+0x28/0xb0 [ 755.857011][T21273] csum_and_copy_from_iter_full+0x210/0x1fb0 [ 755.863533][T21273] ip_generic_getfrag+0x149/0x2d0 [ 755.869224][T21273] __ip6_append_data+0x3aef/0x4080 [ 755.874935][T21273] ip6_append_data+0x108/0x270 [ 755.880336][T21273] rawv6_sendmsg+0x1298/0x18c0 [ 755.885910][T21273] ____sys_sendmsg+0x853/0xa20 [ 755.891219][T21273] ___sys_sendmsg+0x2a5/0x360 [ 755.896443][T21273] __x64_sys_sendmsg+0x1bd/0x2a0 [ 755.902013][T21273] do_syscall_64+0x174/0x580 [ 755.907142][T21273] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 755.913573][T21273] [ 755.913573][T21273] -> #6 (sk_lock-AF_INET6){+.+.}-{0:0}: [ 755.921323][T21273] lock_sock_nested+0x41/0x100 [ 755.926721][T21273] inet_shutdown+0x6a/0x390 [ 755.931863][T21273] nbd_mark_nsock_dead+0x2cb/0x550 [ 755.937607][T21273] recv_work+0x1cef/0x1e10 [ 755.942608][T21273] process_scheduled_works+0xa8e/0x14e0 [ 755.948703][T21273] worker_thread+0xa47/0xfb0 [ 755.953939][T21273] kthread+0x389/0x470 [ 755.958577][T21273] ret_from_fork+0x514/0xb70 [ 755.963834][T21273] ret_from_fork_asm+0x1a/0x30 [ 755.969400][T21273] [ 755.969400][T21273] -> #5 (&nsock->tx_lock){+.+.}-{4:4}: [ 755.977156][T21273] __mutex_lock+0x19d/0x1590 [ 755.982338][T21273] nbd_queue_rq+0x373/0x1150 [ 755.987489][T21273] blk_mq_dispatch_rq_list+0x499/0x1990 [ 755.993724][T21273] __blk_mq_sched_dispatch_requests+0xd36/0x1580 [ 756.000812][T21273] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 756.007335][T21273] blk_mq_run_hw_queue+0x348/0x4f0 [ 756.012984][T21273] blk_mq_dispatch_list+0xd11/0xe10 [ 756.018719][T21273] blk_mq_flush_plug_list+0x45f/0x540 [ 756.024634][T21273] __blk_flush_plug+0x3ed/0x4d0 [ 756.030295][T21273] __submit_bio+0x465/0x560 [ 756.035703][T21273] submit_bio_noacct_nocheck+0x2f4/0xa40 [ 756.041877][T21273] block_read_full_folio+0x599/0x830 [ 756.047702][T21273] filemap_read_folio+0x12c/0x3a0 [ 756.053270][T21273] do_read_cache_folio+0x354/0x590 [ 756.059451][T21273] read_part_sector+0xb6/0x2b0 [ 756.065196][T21273] adfspart_check_ICS+0xb1/0x960 [ 756.071406][T21273] bdev_disk_changed+0x82b/0x1780 [ 756.076983][T21273] blkdev_get_whole+0x372/0x510 [ 756.083013][T21273] bdev_open+0x324/0xd70 [ 756.087806][T21273] blkdev_open+0x461/0x600 [ 756.092765][T21273] do_dentry_open+0x816/0x1380 [ 756.098074][T21273] vfs_open+0x3b/0x340 [ 756.102689][T21273] path_openat+0x2e3b/0x3890 [ 756.108187][T21273] do_file_open+0x23e/0x4a0 [ 756.113621][T21273] do_sys_openat2+0x113/0x200 [ 756.119740][T21273] __x64_sys_openat+0x138/0x170 [ 756.125253][T21273] do_syscall_64+0x174/0x580 [ 756.130401][T21273] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 756.136844][T21273] [ 756.136844][T21273] -> #4 (&cmd->lock){+.+.}-{4:4}: [ 756.144599][T21273] __mutex_lock+0x19d/0x1590 [ 756.149816][T21273] nbd_queue_rq+0xc1/0x1150 [ 756.154866][T21273] blk_mq_dispatch_rq_list+0x499/0x1990 [ 756.161643][T21273] __blk_mq_sched_dispatch_requests+0xd36/0x1580 [ 756.168528][T21273] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 756.175178][T21273] blk_mq_run_hw_queue+0x348/0x4f0 [ 756.180831][T21273] blk_mq_dispatch_list+0xd11/0xe10 [ 756.186593][T21273] blk_mq_flush_plug_list+0x45f/0x540 [ 756.192506][T21273] __blk_flush_plug+0x3ed/0x4d0 [ 756.197908][T21273] __submit_bio+0x465/0x560 [ 756.202951][T21273] submit_bio_noacct_nocheck+0x2f4/0xa40 [ 756.209138][T21273] block_read_full_folio+0x599/0x830 [ 756.214960][T21273] filemap_read_folio+0x12c/0x3a0 [ 756.220532][T21273] do_read_cache_folio+0x354/0x590 [ 756.226237][T21273] read_part_sector+0xb6/0x2b0 [ 756.231561][T21273] adfspart_check_ICS+0xb1/0x960 [ 756.237049][T21273] bdev_disk_changed+0x82b/0x1780 [ 756.242655][T21273] blkdev_get_whole+0x372/0x510 [ 756.248131][T21273] bdev_open+0x324/0xd70 [ 756.253084][T21273] blkdev_open+0x461/0x600 [ 756.258049][T21273] do_dentry_open+0x816/0x1380 [ 756.263364][T21273] vfs_open+0x3b/0x340 [ 756.267977][T21273] path_openat+0x2e3b/0x3890 [ 756.273284][T21273] do_file_open+0x23e/0x4a0 [ 756.278514][T21273] do_sys_openat2+0x113/0x200 [ 756.283764][T21273] __x64_sys_openat+0x138/0x170 [ 756.289167][T21273] do_syscall_64+0x174/0x580 [ 756.294308][T21273] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 756.300739][T21273] [ 756.300739][T21273] -> #3 (set->srcu){.+.+}-{0:0}: [ 756.307884][T21273] __synchronize_srcu+0xc9/0x2f0 [ 756.313449][T21273] elevator_switch+0x1e8/0x7b0 [ 756.318765][T21273] elevator_change+0x2fa/0x480 [ 756.324083][T21273] elevator_set_default+0x375/0x440 [ 756.329834][T21273] blk_register_queue+0x3f3/0x4e0 [ 756.335411][T21273] __add_disk+0x6cb/0xe30 [ 756.340301][T21273] add_disk_fwnode+0xfb/0x4b0 [ 756.345539][T21273] nbd_dev_add+0x733/0xb60 [ 756.350510][T21273] nbd_init+0x15f/0x1e0 [ 756.355350][T21273] do_one_initcall+0x250/0x870 [ 756.360681][T21273] do_initcall_level+0x10a/0x1a0 [ 756.366241][T21273] do_initcalls+0x59/0xa0 [ 756.371118][T21273] kernel_init_freeable+0x29d/0x3e0 [ 756.376862][T21273] kernel_init+0x1d/0x1d0 [ 756.381751][T21273] ret_from_fork+0x514/0xb70 [ 756.386969][T21273] ret_from_fork_asm+0x1a/0x30 [ 756.392620][T21273] [ 756.392620][T21273] -> #2 (&q->elevator_lock){+.+.}-{4:4}: [ 756.400463][T21273] __mutex_lock+0x19d/0x1590 [ 756.405611][T21273] elevator_change+0x1af/0x480 [ 756.410961][T21273] elevator_set_none+0xb5/0x140 [ 756.416360][T21273] blk_mq_update_nr_hw_queues+0x5ef/0x19f0 [ 756.422711][T21273] nbd_start_device+0x189/0xb30 [ 756.428106][T21273] nbd_genl_connect+0x1597/0x1c10 [ 756.433718][T21273] genl_family_rcv_msg_doit+0x233/0x340 [ 756.439905][T21273] genl_rcv_msg+0x614/0x7a0 [ 756.444960][T21273] netlink_rcv_skb+0x226/0x4a0 [ 756.450257][T21273] genl_rcv+0x28/0x40 [ 756.454784][T21273] netlink_unicast+0x7bb/0x940 [ 756.460186][T21273] netlink_sendmsg+0x813/0xb40 [ 756.465491][T21273] ____sys_sendmsg+0x9b9/0xa20 [ 756.470809][T21273] ___sys_sendmsg+0x2a5/0x360 [ 756.476041][T21273] __x64_sys_sendmsg+0x1bd/0x2a0 [ 756.481536][T21273] do_syscall_64+0x174/0x580 [ 756.486669][T21273] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 756.493119][T21273] [ 756.493119][T21273] -> #1 (&q->q_usage_counter(io)#49){++++}-{0:0}: [ 756.501755][T21273] blk_alloc_queue+0x544/0x690 [ 756.507062][T21273] __blk_mq_alloc_disk+0x194/0x390 [ 756.512717][T21273] nbd_dev_add+0x494/0xb60 [ 756.517675][T21273] nbd_init+0x15f/0x1e0 [ 756.522369][T21273] do_one_initcall+0x250/0x870 [ 756.527681][T21273] do_initcall_level+0x10a/0x1a0 [ 756.533349][T21273] do_initcalls+0x59/0xa0 [ 756.538260][T21273] kernel_init_freeable+0x29d/0x3e0 [ 756.544354][T21273] kernel_init+0x1d/0x1d0 [ 756.549272][T21273] ret_from_fork+0x514/0xb70 [ 756.554778][T21273] ret_from_fork_asm+0x1a/0x30 [ 756.560090][T21273] [ 756.560090][T21273] -> #0 (fs_reclaim){+.+.}-{0:0}: [ 756.567949][T21273] __lock_acquire+0x1520/0x2cd0 [ 756.573868][T21273] lock_acquire+0x106/0x350 [ 756.579000][T21273] fs_reclaim_acquire+0x71/0x100 [ 756.584670][T21273] prepare_alloc_pages+0x15b/0x650 [ 756.590332][T21273] __alloc_frozen_pages_noprof+0x12f/0x380 [ 756.597639][T21273] alloc_pages_mpol+0x212/0x380 [ 756.603044][T21273] alloc_pages_noprof+0xac/0x2a0 [ 756.608617][T21273] folio_alloc_noprof+0x1e/0x30 [ 756.614152][T21273] filemap_alloc_folio_noprof+0x111/0x470 [ 756.620594][T21273] __filemap_get_folio_mpol+0x3fc/0xb00 [ 756.626686][T21273] filemap_fault+0xa25/0x1360 [ 756.631934][T21273] __do_fault+0x138/0x2a0 [ 756.636813][T21273] do_pte_missing+0x228c/0x3540 [ 756.642819][T21273] handle_mm_fault+0x1b38/0x3080 [ 756.648296][T21273] do_user_addr_fault+0xa4d/0x1340 [ 756.654030][T21273] exc_page_fault+0x6a/0xc0 [ 756.659071][T21273] asm_exc_page_fault+0x26/0x30 [ 756.664544][T21273] [ 756.664544][T21273] other info that might help us debug this: [ 756.664544][T21273] [ 756.675023][T21273] Chain exists of: [ 756.675023][T21273] fs_reclaim --> vm_lock --> mapping.invalidate_lock#2 [ 756.675023][T21273] [ 756.689682][T21273] Possible unsafe locking scenario: [ 756.689682][T21273] [ 756.697242][T21273] CPU0 CPU1 [ 756.702997][T21273] ---- ---- [ 756.708483][T21273] rlock(mapping.invalidate_lock#2); [ 756.714366][T21273] lock(vm_lock); [ 756.722477][T21273] lock(mapping.invalidate_lock#2); [ 756.731319][T21273] lock(fs_reclaim); [ 756.735363][T21273] [ 756.735363][T21273] *** DEADLOCK *** [ 756.735363][T21273] [ 756.743796][T21273] 1 lock held by syz.2.3732/21273: [ 756.748953][T21273] #0: ffff888077cb8e68 (mapping.invalidate_lock#2){++++}-{4:4}, at: filemap_fault+0x9f6/0x1360 [ 756.759536][T21273] [ 756.759536][T21273] stack backtrace: [ 756.765528][T21273] CPU: 0 UID: 0 PID: 21273 Comm: syz.2.3732 Not tainted syzkaller #0 PREEMPT(full) [ 756.765548][T21273] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 756.765560][T21273] Call Trace: [ 756.765570][T21273] [ 756.765579][T21273] dump_stack_lvl+0xe8/0x150 [ 756.765601][T21273] print_circular_bug+0x2e1/0x300 [ 756.765626][T21273] check_noncircular+0x12e/0x150 [ 756.765651][T21273] __lock_acquire+0x1520/0x2cd0 [ 756.765674][T21273] ? __pfx_policy_nodemask+0x10/0x10 [ 756.765708][T21273] ? prepare_alloc_pages+0x15b/0x650 [ 756.765733][T21273] lock_acquire+0x106/0x350 [ 756.765749][T21273] ? prepare_alloc_pages+0x15b/0x650 [ 756.765777][T21273] ? alloc_pages_noprof+0x156/0x2a0 [ 756.765791][T21273] ? read_pages+0x2e3/0x5a0 [ 756.765812][T21273] ? page_rmappable_folio+0xa1/0x170 [ 756.765831][T21273] fs_reclaim_acquire+0x71/0x100 [ 756.765856][T21273] ? prepare_alloc_pages+0x15b/0x650 [ 756.765881][T21273] prepare_alloc_pages+0x15b/0x650 [ 756.765911][T21273] __alloc_frozen_pages_noprof+0x12f/0x380 [ 756.765941][T21273] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 756.765971][T21273] ? __pfx_policy_nodemask+0x10/0x10 [ 756.766002][T21273] alloc_pages_mpol+0x212/0x380 [ 756.766021][T21273] alloc_pages_noprof+0xac/0x2a0 [ 756.766038][T21273] folio_alloc_noprof+0x1e/0x30 [ 756.766059][T21273] filemap_alloc_folio_noprof+0x111/0x470 [ 756.766085][T21273] ? __pfx_filemap_alloc_folio_noprof+0x10/0x10 [ 756.766106][T21273] ? filemap_fault+0x9f6/0x1360 [ 756.766134][T21273] __filemap_get_folio_mpol+0x3fc/0xb00 [ 756.766162][T21273] filemap_fault+0xa25/0x1360 [ 756.766190][T21273] ? __pfx_filemap_fault+0x10/0x10 [ 756.766215][T21273] ? __pfx_filemap_map_pages+0x10/0x10 [ 756.766246][T21273] __do_fault+0x138/0x2a0 [ 756.766271][T21273] ? do_pte_missing+0x1403/0x3540 [ 756.766296][T21273] do_pte_missing+0x228c/0x3540 [ 756.766326][T21273] ? handle_mm_fault+0xec/0x3080 [ 756.766349][T21273] handle_mm_fault+0x1b38/0x3080 [ 756.766376][T21273] ? handle_mm_fault+0xec/0x3080 [ 756.766401][T21273] ? __pfx_handle_mm_fault+0x10/0x10 [ 756.766420][T21273] ? lock_vma_under_rcu+0x45a/0x500 [ 756.766444][T21273] ? __pfx_do_futex+0x10/0x10 [ 756.766489][T21273] do_user_addr_fault+0xa4d/0x1340 [ 756.766512][T21273] ? trace_page_fault_user+0x84/0x1e0 [ 756.766531][T21273] exc_page_fault+0x6a/0xc0 [ 756.766550][T21273] asm_exc_page_fault+0x26/0x30 [ 756.766569][T21273] RIP: 0033:0x7f93c3271756 [ 756.766586][T21273] Code: ff 48 83 e8 01 48 89 de bf 01 00 00 00 48 c1 e0 0e 48 c1 ee 06 48 01 c8 48 89 d9 81 e6 ff 3f 00 00 48 c1 e9 03 83 e1 07 d3 e7 <40> 84 bc 06 20 20 00 00 0f 85 20 fe ff ff e9 d4 fd ff ff 0f 1f 80 [ 756.766602][T21273] RSP: 002b:00007ffc3768e4c0 EFLAGS: 00010202 [ 756.766617][T21273] RAX: 000000110c3ec000 RBX: ffffffff841fdb31 RCX: 0000000000000006 [ 756.766629][T21273] RDX: 0000000000001b31 RSI: 0000000000003f6c RDI: 0000000000000040 [ 756.766640][T21273] RBP: 0000000000000000 R08: 00007f93c3600000 R09: 00007f93c3602000 [ 756.766652][T21273] R10: 00000000841fdb35 R11: 0000000000000004 R12: 00007f93c3616038 [ 756.766663][T21273] R13: 00000000000006d5 R14: ffffffff841fdc89 R15: 00007f93c4145720 [ 756.766676][T21273] ? gfs2_glock_shrink_count+0x9/0x30 [ 756.766784][T21273] ? clear_glock+0x131/0x220 [ 756.766809][T21273] [ 757.329006][ T95] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 757.597737][T21275] veth0: entered promiscuous mode [ 757.728596][T21278] ipvlan3: entered promiscuous mode [ 757.756522][ T12] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 757.818352][T21272] veth0: left promiscuous mode [ 757.866267][ T12] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 757.985537][ T7112] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 758.095514][ T7112] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 758.206011][ T95] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 758.496239][ T12] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 759.936641][ T7112] net_ratelimit: 12 callbacks suppressed [ 759.936679][ T7112] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 760.056008][ T7112] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 760.166027][ T7112] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 760.276024][ T7552] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 760.385709][ T7552] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 760.496036][T11231] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 760.606003][ T12] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 760.716876][ T7552] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 760.826675][ T7552] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 760.946055][ T95] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 765.005992][T11231] net_ratelimit: 35 callbacks suppressed [ 765.006015][T11231] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 765.126042][ T12] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 765.236106][ T7112] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 765.346083][ T12] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 765.465881][T11231] bond2: (slave ip6gretap1): failed to get link speed/duplex [ 765.576053][ T7112] bond2: (slave ip6gretap1): failed to get link speed/duplex