last executing test programs: 2m54.704336715s ago: executing program 1 (id=5299): pipe(&(0x7f0000019480)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r1, &(0x7f00000001c0)=[{&(0x7f0000000280)="dc", 0x1}], 0x1, 0x3) close(r1) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_int(r2, 0x1, 0x3c, &(0x7f0000000040)=0x1, 0xfff0) setsockopt$inet_tcp_TCP_REPAIR(r1, 0x6, 0x13, &(0x7f0000000300)=0x1, 0x4) connect$inet(r2, &(0x7f00000006c0)={0x2, 0x0, @empty}, 0x10) setsockopt$inet_tcp_TCP_REPAIR(r2, 0x6, 0x13, &(0x7f0000000900)=0xffffffffffffffff, 0x4) sendmmsg$inet(r2, &(0x7f0000000f00)=[{{0x0, 0x0, &(0x7f00000007c0)=[{&(0x7f0000000080)="b5", 0x1}, {&(0x7f0000000200)="c9", 0x1}, {&(0x7f0000000340)="01", 0x1}, {&(0x7f0000000400)='Q', 0x1}, {&(0x7f0000000500)="d7", 0x1}, {&(0x7f0000000600)='J', 0x1}, {&(0x7f0000000700)=')', 0x1}, {&(0x7f0000000180)='<', 0x1}], 0x8}}, {{0x0, 0x0, &(0x7f0000002dc0)=[{&(0x7f0000000a40)="db", 0x1}, {&(0x7f0000001a40)="5c8c56b4ef4b478bf9b431ece6b2d8bdf4abffaee5e1138ba457a84eec31c9fdec2e274f512ea28c50a9c25214a70c6582928702c1116955bbeb327a89cc181a2bba5a572cf813a2619731ddffd8564bcf36d365cf5292989d9e186920c1229e12c006db1d590be12125bea3b9f0484e445b75da02486b2258c270fc864e6cca131ebb987f1a1c94b00228f9674d8a3af8920957bb79b18a43d7845d07da9cbd606cfadeefaf79873f32a0f0b25f55b71c62992ae0a3c2b8971184735d18d37f600de6bc84cbe7b097df1d8532c8e1e111323f61c542d743b0dd583d9e24f06472bc958931dd1ff3008825260385bfcd5250de2546a6ff22e4fab1ab39e0e2ccb19c506aae9ff404c5054b930aafcd6a35ae51c499fc2e535d719dcb5b465a7e25b245aabca1cc62bfa0fded3d066ef4fdaddfe30bc8de62a3d3c41838e6969f1f8a965e0712b4a62e16d2162b576ce12c0135a94b84199e55d1acc00684f0027aa3d91ad483c00100535cb08f7ec2ef9ccc67b85da92968a8bfd90926f3fbfda59093c4181058c6e24149ef74ad8d3b3b75c4b82fe212ac4605a3b75c6d9c7e526892d59c8762b10d8d6eb1b7f05f896abc89d89e6a0456e164fb2a9054cb60ca35ec3a46986b71b32b2e7d2a66049d508d01ce88d082375179d4be44123778067b08bc1b53372f805f60bbf79a38508fb1215527a67e8b2f06e2bf684c894d2a42724037ef20a91ec4c315ad86d2d496b914a02424a74fce888d601ab281f7a5e8e67ca119055c1b99b3f243e75cad3f210304467f9b9053914ec48801b48dd0d0aa572a36687db0864b07caa6f85948df49c850046ce02f3293607dd09dc86d83b624f4920f125387bd9273de41e4ad7a51befce70e6559a9a248e1587baf1dc41cb9e7003679116a11eeb132587e8f2d9254d5816613b115bcd2bc8cc7b9f595cdf0b04284744377e3a290b3b86bb526cd62282e1f004f25f68f73d98f72497098a631aa4b257c9f07b41ad9a20fbb400fef83b1bac3332428b4cc973118bc0b2580e9a464323979733b0cce4c300a10d2c435ccdd7a0605bd6795935799bd8a901104a02ebebecff6951ebe04a5b0c46d52e3faa7b7bba337212e810632e27d76986c0cd53f2eec0ec029fb94932ae44aacbf795cb53a74d65117334bcf69d5ab34e165729c1879b7524947cf06ddaff6f1fd2a584c78613184e7ac73a9f5984af867450832e67bc59e104a3bd277be484f2122e56c84f05218d9cd5d6697f2240d60c849cd055697df4e4f4d795dfca72782c562d94dd5824ad548d27808258b99678a27952a832be729286ef4ba2a3e1874c9e1da45ef38e92680b5320e8e40a1e5e9301f53acd6850d36c82b3eb128f5505a12f4e555a92ea716d6489f4e042700db779d057c139c6259d26c8d80c45563fb50aa38dd31cfa8a84d9e989de66f4b987dea0775b77557f51cc15546622e7b09f60f22b9f987e9e91ecedb9cfeb3eb4f6b5be2e9206187331e56bfe34bfe69ee4326b802ab52d261749a0e32a165fff6a8dd159a2fcdeb4f84db808b2ad2db60f0a2a2fa38209fd395f9484fef2ee01ed377103b77df0bb981096309396e1d0f94d6bb74dbdf519142e1bb5d3bea69267f000537e396ff357b9d889af66a8dfb589d5f541b1fe003dd1d4a0853d25dea43135f98dd4df1cda11b5751eddc9dd46a57c7bde4a8b8c6f1dc77704f33aa84dc35610282abc8686563ac604d3c89f44e89c9f5f5b8de89e6e6ef5b6a0ff586d4235ff7445b610094657532a3daa966ee28b3c14ed0282913c7015b717497e77094221b7fc183611402c566000e9e6b98cd10fd042a4fe6676532eeed94d8c72e73af2a6e14618bf9da0fea8c8264a6139f800a9eedf8b84bda62e56434a3cd207da02c3eb7211f917fabe1f7d632dc71afe2d201c46143e84165119c2f73091eaf72998f56dfa37946bdb6a2d22988d58e1a485ca56011eb6386d9a2a57bf24fc3c3c93405dbe5246cc6050afb63c5dcba74dc89fac94b04e47233ced8cf0098711617a66567af09bbcc40f951fcb637bc74911dc4fa647696b3", 0x5c1}, {&(0x7f0000000840)="e3", 0x1}, {&(0x7f0000000680)="a7", 0x1}, {&(0x7f0000000540)='k', 0x1}, {&(0x7f00000002c0)="c8", 0x1}, {&(0x7f0000002bc0)='>', 0x1}], 0x7}}, {{0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000940)="b2", 0x1}], 0x1}}], 0x3, 0x4008440) splice(r0, 0x0, r1, 0x0, 0x10500, 0x0) connect$unix(r1, &(0x7f00000019c0)=@abs={0x0, 0x0, 0x4e20}, 0x6e) unshare(0x24020400) pselect6(0x40, &(0x7f0000000080)={0x0, 0x3, 0x500000000000000, 0x0, 0x8000, 0x0, 0x0, 0x7}, &(0x7f00000000c0)={0x1f, 0x0, 0x8, 0x5, 0xfffffffffffffff8, 0x0, 0x4000000000}, 0x0, 0x0, 0x0) 2m54.313151348s ago: executing program 1 (id=5306): sendmsg$NL802154_CMD_SET_CHANNEL(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x8081}, 0x20000854) r0 = bpf$MAP_CREATE_CONST_STR(0x0, 0x0, 0xe) ioctl$AUTOFS_IOC_EXPIRE(r0, 0x810c9365, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x10) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, &(0x7f0000004bc0)={0x0, 0x0, &(0x7f0000004b80)={&(0x7f0000000100)=ANY=[@ANYBLOB="60b80000", @ANYRES16, @ANYBLOB="050427bd7000fedbdf250100000008000100", @ANYRES32, @ANYBLOB="4400028040000100240001006d6f6465000000000000000000000000000000000000000000000000000000000500"], 0x60}, 0x1, 0x0, 0x0, 0x4000401}, 0x4040084) connect$pppl2tp(0xffffffffffffffff, &(0x7f0000000740)=@pppol2tpv3={0x18, 0x1, {0x3, 0xffffffffffffffff, {0x2, 0x4e24, @broadcast}, 0x2, 0x0, 0x4}}, 0x2e) socket$pppl2tp(0x18, 0x1, 0x1) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000100)=@newqdisc={0x44, 0x24, 0x1, 0x80000000, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {0x8, 0x3}, {0xa, 0xffe0}, {0xfff1, 0x9}}, [@qdisc_kind_options=@q_fq_pie={{0xb}, {0x14, 0x8002, [@TCA_FQ_PIE_LIMIT={0x8, 0x1, 0xf4b6}, @TCA_FQ_PIE_FLOWS={0x8, 0x2, 0xfe2a}]}}]}, 0x44}}, 0x20004055) sendmsg$nl_route(r1, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0300000000000000280012800a00010076786c616e00"], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22cca65c15}, 0x4008840) 2m54.130302139s ago: executing program 1 (id=5309): r0 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_NO_ENOBUFS(r0, 0x10e, 0xc, &(0x7f0000000040)=0x7f, 0x4) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000400)={0xffffffffffffffff, 0x20, &(0x7f00000003c0)={&(0x7f0000000240)=""/117, 0x75, 0x0, &(0x7f00000002c0)=""/8, 0x8}}, 0x10) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x13, &(0x7f0000000300)=ANY=[@ANYBLOB="180300000005000000000000000000001801000011af000000000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000d5030000020000838500000071000000180100002020752500000000806020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000400000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xf, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r1, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="380000001a00010000000000000000000a008000", @ANYRES32=0x0, @ANYBLOB="0000000008001f00ff80000014"], 0x38}, 0x1, 0x0, 0x0, 0x220008c0}, 0x0) 2m53.675089735s ago: executing program 1 (id=5316): syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000000)='ns/pid\x00') (async) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000480)='cgroup.controllers\x00', 0x275a, 0x0) write$tun(r0, &(0x7f0000000000)=ANY=[], 0x38) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x10012, r0, 0x0) (async) r1 = syz_open_procfs$namespace(0x0, &(0x7f0000000140)='ns/pid_for_children\x00') (async) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000040), r2) (async) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r5 = socket(0x400000000010, 0x3, 0x0) (async) r6 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0x25dfdbfd, {0x0, 0x0, 0x0, r7, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x45}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x5}, 0x0) r8 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r8) (async) socket$netlink(0x10, 0x3, 0x0) (async) ioctl$SIOCSIFHWADDR(r8, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x7}}) (async) r9 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000380)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r9, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000480)=@newtfilter={0x44, 0x2c, 0xd27, 0x170bd2c, 0x2, {0x0, 0x0, 0x0, r10, {0x0, 0x10}, {}, {0x8, 0xffe0}}, [@filter_kind_options=@f_flow={{0x9}, {0x14, 0x2, [@TCA_FLOW_MODE={0x8, 0x2, 0x1}, @TCA_FLOW_KEYS={0x8, 0x1, 0x1a29d}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4894}, 0x2) (async) r11 = socket$kcm(0x11, 0x3, 0x0) setsockopt$sock_attach_bpf(r11, 0x107, 0xf, &(0x7f0000000600), 0x56) (async) sendmsg$kcm(r11, &(0x7f0000000280)={&(0x7f0000000540)=@xdp={0x2c, 0x0, r10, 0x42}, 0x80, &(0x7f0000000440)=[{&(0x7f00000001c0)="27030200dc0f14000e0005000024c1020000ff1107c2fb7fe0406e52534b4f6b3d327db412f40000000000000000", 0x2e}], 0x1}, 0x4005) (async) sendmsg$NLBL_UNLABEL_C_STATICREMOVEDEF(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)={0x38, r3, 0x1, 0x0, 0x0, {0x4}, [@NLBL_UNLABEL_A_IPV4ADDR={0x5, 0x4, @multicast1}, @NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'veth1_to_team\x00'}, @NLBL_UNLABEL_A_IPV4MASK={0x5, 0x5, @multicast1}]}, 0x38}}, 0x0) mkdirat$cgroup(r1, &(0x7f0000000000)='syz0\x00', 0x1ff) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x10, 0x4, 0x0, 0x0, 0x5, 0x0, 0x0, 0x41100, 0x66, '\x00', 0x0, @fallback=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) r12 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r12, &(0x7f0000000000)=ANY=[], 0x32600) (async) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r12, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) 2m53.491738522s ago: executing program 1 (id=5318): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)=@newlink={0x44, 0x10, 0xffffffffffffffff, 0x70bd27, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, 0x2017, 0x1820c}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @macvlan={{0xc}, {0x14, 0x2, 0x0, 0x1, [@IFLA_MACVLAN_FLAGS={0x6}, @IFLA_MACVLAN_MODE={0x8, 0x1, 0x2}]}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x20004041}, 0x80000) r2 = getuid() sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000680)=ANY=[@ANYBLOB="b00400003f008c1c24bd7000f8fbffff0c0000009c0486800c004f006d6163766c616e008c0409807104e3800600170027000000cb018b359c9518ebfaed6806676ea8b7269ea73ab3d7d49a7eb884829b00d6c6aaf54e4b29927ceebfdca1e8b8fd5191f6b1515b71449033a26a2f9fdbc799b0896d9641b12545bca1576815b39f3f01b275c454e2486319176acd605dab9c2cf049d6d578d398462e7000dad2a5849ddf78c860b0e37792852e0ec0fea9112945739752198fe9ac01c28083006d80c0b92c2f55fbd572ed4743fb1d6eb166030a01a665fbeafb0b3244fe8a68029c9ac4a0a5bb57be8d661dea680572bca483187e522bc51549931095a598424a0426b13f03f9c194635c0793a1da6039761b79e012387c5689448a0497e165131a3bac425a05663301b1d9229b6111085e8fc2f182b94bd048f1a119c883fe7900240183800400448004002a8014002d000000000000000000000000000000000004002080040004800400c280f6000200a44a5124437933441edffb3597e5305cdbd2829993af0c3649032e0c13608414fd0a0cf06c23795f7215174d58cfc850bf0a4155902d7b9703b064ffdca1866ef255949b447e6a83ce6377e9d543f6551ed294b0dd57e6f1837620f66213927faca5f85e07ed4479eacc805696e27fb182e8b98d0264ee784db3226555552db72248dd3124c78376f4866fb45a6484c979e63f904e861c30c2412aa712fef386ac596e040ddfc3b98ecda3472c5f0d673f3afae11258399c7e098f850d76dd760e44313f0de563f5258c3d9186d295ec96a248f2b1e32e977f28c58b9415c9a46c417b5e55c3e005c37272f8742423ccfaee00003b024e800c00f6000500000000000000cc019c800800b1000a0101002acbed98d196b01cb5de818077516c7c84fd450a118748c5fa193924f732e37e46ee7c5a7205151c7ca5da22cb7d439d060ad623376fe86da4524e3114da332ff72686d761eb3143a1e6bc585fc3ea3bfb666073c4df1d2652ded789c26e72ffb9b4b2e5cc866513abe03509dddabe285e14101871af2b2f72ec5738a5d90221de38ecc5a1576b66eb39e40b1acd00db112227e8d616ed2abd12514662b97e691741296738a906d14e8b4db74961993102e827f626d202fb046ce10f0fb54eb4148cc0f8229c07e0e0ab831acc5a0302e5a5e6f756e4eceacff6ef9cac5445379212f8ef58fabc75624dea2ab374983eb2c093ec7fff04cc10474fc0aca29eaed4a573830305432eb7cd91d0d0ef7ce20d27efd133a6149f24225191381dac7008fcb6d199e93e936c681612deb3ddd4adb74dd797b60f54e659148171a91a6a5a382fcbfbba5475f10e17d865e83479f45e1175c89187ef4b7d4ff64f2720f57298321438ef63734f3ad707e7e2b634b2c2965d420d90d1e9e98ef7a93aeb59f9c488381cfa6151df1fc128a3971d54238e79d99bb190a68378741a6b77243f25f3ee9ed284678123406777559ff95fca5be2d9", @ANYRES32=r2, @ANYBLOB="08009100", @ANYRES32=0xee00, @ANYBLOB="2d001f80dddb5247bf62d93dda18cd7ea89b374bac9fa3facc13f03f09ae08572dd567de54c3ac150acd33a417000000210b538953d4aa8d517177af5355b547690847fa457daf539fbeabaa76e3a967149ffefb5e89d6db92e6c64bd4c57a000000001300e2003a5c2e5c7b232cff7b2d7b282b5e0000"], 0x4b0}, 0x1, 0x0, 0x0, 0x2000c882}, 0x0) 2m53.251406075s ago: executing program 1 (id=5321): socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r1, 0x0, r2, 0x0, 0x6, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r3, 0x0) write$cgroup_devices(r2, 0x0, 0x6) write(r0, 0x0, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000000100)={@random="4d3cce42bf6b", @multicast, @val={@void, {0x8100, 0x6, 0x0, 0x4}}, {@arp={0x806, @generic={0x300, 0x22ba, 0x6, 0x8, 0x3, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xd}, "6c04add7dfefc917", @remote, "ee023dc56dcd22f84b8fa07ef53b9aed"}}}}, &(0x7f0000000140)={0x1, 0x2, [0x359, 0x861, 0x37a, 0x469]}) mmap(&(0x7f00009fd000/0x600000)=nil, 0x600000, 0x100000d, 0x6031, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x3000007, 0x31, r2, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) r4 = socket$kcm(0x2d, 0x2, 0x0) ioctl$sock_kcm_SIOCKCMATTACH(r4, 0x89e0, &(0x7f0000000040)) ioctl$sock_kcm_SIOCKCMATTACH(0xffffffffffffffff, 0x89e0, 0x0) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r6 = socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000000080)={'syzkaller1\x00', @broadcast}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0xd, 0x4, &(0x7f0000000340)=ANY=[@ANYBLOB="180000000000000000000000000000007914c0000000000095"], &(0x7f0000000080)='syzkaller\x00', 0x6, 0x0, 0x0, 0x0, 0x2a}, 0x94) ioctl$sock_inet_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f00000003c0)={0x0, {0x2, 0x4e20, @rand_addr=0x64010100}, {0x2, 0x4a24, @remote}, {0x2, 0x4e25, @multicast2}, 0x204, 0x0, 0x0, 0x0, 0x2008, 0x0, 0x200003, 0x2, 0x2}) write$tun(r5, &(0x7f00000003c0)=ANY=[@ANYBLOB="080000fa"], 0xdc) socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="5800000010001fff26bd70008000000000000000", @ANYRES8=r3, @ANYRES8, @ANYRES32, @ANYBLOB="000000000000009704001200060003008000000000000a0006"], 0x58}, 0x1, 0x0, 0x0, 0x1}, 0x4000) 2m37.439356182s ago: executing program 32 (id=5321): socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r1, 0x0, r2, 0x0, 0x6, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r3, 0x0) write$cgroup_devices(r2, 0x0, 0x6) write(r0, 0x0, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000000100)={@random="4d3cce42bf6b", @multicast, @val={@void, {0x8100, 0x6, 0x0, 0x4}}, {@arp={0x806, @generic={0x300, 0x22ba, 0x6, 0x8, 0x3, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xd}, "6c04add7dfefc917", @remote, "ee023dc56dcd22f84b8fa07ef53b9aed"}}}}, &(0x7f0000000140)={0x1, 0x2, [0x359, 0x861, 0x37a, 0x469]}) mmap(&(0x7f00009fd000/0x600000)=nil, 0x600000, 0x100000d, 0x6031, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x3000007, 0x31, r2, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) r4 = socket$kcm(0x2d, 0x2, 0x0) ioctl$sock_kcm_SIOCKCMATTACH(r4, 0x89e0, &(0x7f0000000040)) ioctl$sock_kcm_SIOCKCMATTACH(0xffffffffffffffff, 0x89e0, 0x0) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r6 = socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000000080)={'syzkaller1\x00', @broadcast}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0xd, 0x4, &(0x7f0000000340)=ANY=[@ANYBLOB="180000000000000000000000000000007914c0000000000095"], &(0x7f0000000080)='syzkaller\x00', 0x6, 0x0, 0x0, 0x0, 0x2a}, 0x94) ioctl$sock_inet_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f00000003c0)={0x0, {0x2, 0x4e20, @rand_addr=0x64010100}, {0x2, 0x4a24, @remote}, {0x2, 0x4e25, @multicast2}, 0x204, 0x0, 0x0, 0x0, 0x2008, 0x0, 0x200003, 0x2, 0x2}) write$tun(r5, &(0x7f00000003c0)=ANY=[@ANYBLOB="080000fa"], 0xdc) socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="5800000010001fff26bd70008000000000000000", @ANYRES8=r3, @ANYRES8, @ANYRES32, @ANYBLOB="000000000000009704001200060003008000000000000a0006"], 0x58}, 0x1, 0x0, 0x0, 0x1}, 0x4000) 1m12.66973969s ago: executing program 3 (id=6361): r0 = socket(0x10, 0x803, 0x0) r1 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_TX_RING(r1, 0x11b, 0x3, &(0x7f0000000140)=0x40, 0x4) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$XFS_IOC_FD_TO_HANDLE(0xffffffffffffffff, 0xc038586a, &(0x7f0000000400)={r2, &(0x7f0000000200)='-\x00', 0x101c00, &(0x7f0000000280)={@_ha_fsid={[0x9, 0xa0]}, {0x0, 0x5, 0x7, 0x6}}, 0x15, &(0x7f0000000300), &(0x7f00000003c0)=0x1}) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_ULP(r3, 0x6, 0x1f, &(0x7f0000000500), 0x3) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r4 = socket(0x400000000010, 0x3, 0x0) r5 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r6, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}, 0x1, 0x0, 0x0, 0x50}, 0x0) sendmsg$nl_route_sched(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=@newtfilter={0x30, 0x2c, 0xd27, 0x70bd28, 0x0, {0x0, 0x0, 0x0, r6, {0x5, 0x7}, {}, {0x7, 0xe}}, [@filter_kind_options=@f_fw={{0x7}, {0x4}}]}, 0x30}, 0x1, 0x0, 0x0, 0x84}, 0x8000) r7 = socket(0x400000000010, 0x3, 0x0) r8 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=@newtfilter={0x24, 0x2c, 0xd27, 0x70bd26, 0x6000000, {0x0, 0x0, 0x0, r9, {0x0, 0x2}, {}, {0x7, 0xe}}}, 0x24}, 0x1, 0x0, 0x0, 0x4}, 0x4000800) setsockopt$XDP_UMEM_REG(r1, 0x11b, 0x4, &(0x7f0000000340)={&(0x7f00000000c0)=""/62, 0x328000, 0x800, 0x9, 0x3}, 0x20) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(0xffffffffffffffff, 0x8933, &(0x7f0000000580)={'batadv_slave_1\x00', 0x0}) r11 = socket$kcm(0x21, 0x2, 0x2) sendmsg$kcm(r11, &(0x7f0000000140)={&(0x7f0000000440)=@rxrpc=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x0, @loopback}}, 0x80, &(0x7f00000004c0)=[{&(0x7f0000000100)="a6", 0xfffffcf4}, {0x0}], 0x2, &(0x7f0000001a00)=ANY=[@ANYBLOB="180000000000000010010000010000007d95df16a39b1a6c900000000000000001000005040500002b24ec10064b6f2f000000fb718aef932f3889d1fdda5b00000009860f5878c37ffe36e1165814d435be5b317c6c8189767d2f97879f07a515bb7c169f46933d9338f4ab04834e6f618988c5944741afe403461323110f62055394412158e7a3adb164d641aa40d4ab077fe34232aa8b319d7666d0998a61d7da0c86d70000001010"], 0x10b8}, 0x106) recvmmsg(r11, &(0x7f0000001d80)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000180)=""/62, 0x3e}, 0x80000001}], 0x1, 0x40002000, 0x0) bind$xdp(r1, &(0x7f0000000240)={0x2c, 0x1, r10}, 0x10) sendmsg$nl_route(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[], 0x4c}, 0x1, 0x0, 0x0, 0x44801}, 0x4040) 1m9.86411609s ago: executing program 3 (id=6365): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0x13, &(0x7f0000000080)=ANY=[@ANYBLOB="18080000000000000000000002000000851000000600000018020000", @ANYRES32, @ANYBLOB="00000000000000006600020000000000180000000000000000000000000000009500040000000000360a020000000000180100002020782500000000002020207b1a00fe00000000bfa100000000000007010000f8ffffffb702000008000000b50a00000000000085000000060000009500000000000000"], &(0x7f0000000000)='GPL\x00', 0x2, 0xff5c, &(0x7f0000000340)=""/222}, 0x78) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=@updpolicy={0xfc, 0x19, 0x1, 0x0, 0x0, {{@in=@empty, @in6=@mcast2, 0x0, 0x8, 0x0, 0x0, 0xa, 0x0, 0x0, 0x87, 0x0, 0xffffffffffffffff}, {0x0, 0xa9, 0x0, 0x1, 0x0, 0xffffffffffffffff}, {0x4, 0x9fd, 0x40800000000000, 0x800000000000002}}, [@tmpl={0x44, 0x5, [{{@in=@broadcast, 0x0, 0x3c}, 0x0, @in6=@dev={0xfe, 0x80, '\x00', 0x3c}, 0x2, 0x4, 0x3, 0x0, 0x0, 0x0, 0x200}]}]}, 0xfc}}, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000680)=ANY=[@ANYBLOB="bc00000021000100ffffffff00000000fc020000000000000000000000000001fe80000000000000008000000000003a00000000000000000a0000202e000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000000000000500011000a0101010000000000000000000000007f0000010000000000000000000000007f000001000000000000000000000000000000000000000000000000000000013c040000000000000a00"], 0xbc}, 0x1, 0x0, 0x0, 0x40000}, 0x0) 1m9.694668708s ago: executing program 3 (id=6367): r0 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000980)=@raw={'raw\x00', 0x8, 0x3, 0x530, 0x1d8, 0xffffffff, 0xffffffff, 0x1d8, 0xffffffff, 0x460, 0xffffffff, 0xffffffff, 0x460, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'bridge0\x00'}, 0x0, 0x1b0, 0x1d8, 0x0, {}, [@common=@unspec=@helper={{0x48}, {0x0, 'amanda\x00'}}, @common=@unspec=@conntrack2={{0xc0}, {{@ipv6=@private1, [0xff000000, 0xffffffff, 0xff, 0xffffffff], @ipv6=@private1={0xfc, 0x1, '\x00', 0x1}, [0xffffff00, 0xff, 0xffffffff, 0xffffffff], @ipv6=@empty, [0xff000000, 0xff, 0xff, 0xff], @ipv6=@local, [0xffffffff, 0xff000000, 0xff000000, 0xffffff00], 0x80, 0x54, 0x3b, 0x4e20, 0x4e23, 0x4e21, 0x4e23, 0x446, 0x39a}, 0x100, 0x20}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'erspan0\x00', 'gre0\x00', {0xff}, {}, 0x0, 0x0, 0x0, 0x4b}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'vcan0\x00', {0x3, 0x0, 0x41, 0xfffffffe, 0xe, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x590) r1 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f00000005c0)=@raw={'raw\x00', 0x3c1, 0x3, 0x318, 0x0, 0x111, 0x4b4, 0x150, 0x700, 0x248, 0x278, 0x278, 0x248, 0x278, 0x3, 0x0, {[{{@ipv6={@mcast2, @private0={0xfc, 0x0, '\x00', 0x1}, [0x0, 0x0, 0x0, 0xff], [], 'vlan0\x00', 'caif0\x00', {}, {}, 0x88}, 0x0, 0x128, 0x150, 0x0, {}, [@common=@inet=@multiport={{0x50}, {0x0, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4e22, 0x0, 0x0, 0x0, 0x4e22]}}, @common=@unspec=@connmark={{0x30}}]}, @common=@inet=@TCPMSS={0x28, 'TCPMSS\x00', 0x0, {0x5}}}, {{@ipv6={@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @private1, [0xffffffff], [], 'geneve1\x00', 'erspan0\x00', {}, {}, 0x0, 0x0, 0x2}, 0x0, 0xd0, 0xf8, 0x0, {0x0, 0x88000000}, [@inet=@rpfilter={{0x28}, {0x4}}]}, @common=@unspec=@CONNSECMARK={0x28, 'CONNSECMARK\x00', 0x0, {0x1}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x378) 1m8.890966434s ago: executing program 3 (id=6375): r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f00000006c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x43}}, 0x10) sendmmsg$inet(r0, &(0x7f0000000840)=[{{&(0x7f0000000c00)={0x2, 0x4e22, @multicast2}, 0x10, 0x0}}], 0x1, 0x2000c044) sendto$inet(r0, &(0x7f00000000c0)="8689d46205a34100bf2bbe11a5ce7839edaf02afe39ead95913e9c4f8cf31440006769ebdf12cfacae8e8c03f5db079da7d9ecda75e2a7d49d5cbcb370c4d789390a328ba42c9c60cf2154d1b659aa709e8980a522cfb72f23ad87fb7019706ccae98cfe7c4fd23e8297b8cabc46ede1ac3da78f1b488c6357e7edfcd417df6660af20a54ecdcb02f689ae15ee655d4b7b1ea733e88ee9f53669388dff487c1c49953f3bc142112bd4b582b29b35d43962ed245c2cd5d5df40a3e0ed6beaf3b641e84b0f0dfa121a9efe05269f9f4a0e9bcbf43c7a90a711f453668c730c3badedca687b71a9c27bab9e724cc4a4918713031596ea6fd01124f973f257ccd9665aee7df4a9d64f079d176abc00000000d7af3e2dd4396f72373fb0a787a6129ca41181f5087fb843212550b58e3707d5a0399de36c2503836cbe2133de4f574e9e05c96788b0de1bd13e390445433d96737b964fa8af2ac4b2f0f9390ca93d8d3d810044d024359e067c4553230ab748947d33f8fc115ce9a49e6571c45a05d786cbd49342c236537dbbeec666b07baab917252113a5b9a77283189b518f356debe42d80cf2d0687b9c64d0253a6a09286fded6e4f8557b8fb4f25ca4fb138af8945c74bbc98748eaaa030be5317646f195e6e085ac6ddb29542e3581961259987241f7e7061526a7afec8962e74215fea43703a4e543ee9d1a3c3f5f2a41977ece8fdadcf89ce331ce59bebae5f53513d0e10485d7ddbda60513bf339602510b3a23ea29a0d5d03a61e34d12942ea4a847c884b27b5344a456d02a55f8929cc567e7c792c01fab7a7b32780a14c361000609b817dd91507b04d875279527946fdb8fb92a512485e234d092c28f1d0a0498731ccc0eb10515d510e8945839307b46512ceca6f495fdd2c6ae5eb2ef3b2a40ebdc7edf0048e3fb5e3d97a9ea5113a6b70d20ad5c43f0df95d88c0f121a1884da21a21f0ba47420f8391a97921cc51871dbb272e43710fe71d5e342c3afd10608a8b02f00e8fbd8d570b6faace86c494ecea8913233391e7b7cec3d571bb3032181ed58e1b513e511f79ee562c8cde9b3b74c2e95dcde7fadb5a666bdc0c1684794620ce8cf0c0aee8e90b3ef6e7160d3f055cb4d1ced32e4edc15e7d102952d3237e6c02c591a95a182bf190c0124abc7f1225332ff1c5e1b94e4e9bf02c1a18bd7bfce20707f7298da322560bc1a4cf298d46f5bf8ff41da21e25aa17f65f9ee43ca890b5ef6a3ccf3efedf3ca60a9acef1352ad0c43e6cf375108cf0974ce89a99adba7e6a3f8949dc573440fafe0e3abdd0066057a2d868e8386080f18a421568d8e7a89536a4173861bd55245c8fcf7dcba18edce36d2e85b9630fbc218db9ebd16abb11ac06fdbf2bc3e6394d4c6e7ae71813d30772d487743a2856348fee09989ce03331e7848770fc91e62191c20fe5f4a73c5dae467dd612bdb63b1e50921d38271305d7412103d5a6214d6d534d1d530b9169f882b6926bbd338f0282a8bd9a44603934e5249e83f1d0947b39f82a7843d2b6f796d8abf7ff3e66cfd4519324d71cebbf6580dffc10d555e479e9acaa12c3c59e3732c181aa4223d0fcdac514e9d7c7963c2634964520286b028f60a4ae612b8e6049315139e884cbffd6836253094ad023329183496cf663366ad4d7f7f5f1bd2db9b0d33f106c041fba4494c7da404d45d8955e5459ca4a62862721ec1fa534fd95e262c5814426816e60000000000000000001aa4fb6f40ec24f42f6949cc28d2a0d4eb61cb1664627582d962523586539445b81e9759321652280ecb", 0xffe3, 0x0, 0x0, 0x0) 1m8.744835232s ago: executing program 3 (id=6378): unshare(0x68040200) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0xfdffa000) socket(0x10, 0x3, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x6, 0x4, 0x9, 0x8, 0x0, 0xffffffffffffffff, 0x2}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x15, 0xc, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0xfffffffd}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x1e00, 0x0, '\x00', 0x0, @sk_reuseport=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) socket(0x10, 0x3, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000300)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000340)={r1, 0x2000002, 0x0, 0x0, &(0x7f0000000200), 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x4}, 0x50) 1m6.574504076s ago: executing program 3 (id=6392): bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) r0 = socket$kcm(0x10, 0x3, 0x10) r1 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)={0x38, 0x1403, 0x1, 0x70bd2a, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'lo\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x89}, 0x24048800) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000000080), r2) sendmsg$ETHTOOL_MSG_TSINFO_GET(r2, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000180)={0x0, 0x2c}, 0x1, 0x0, 0x0, 0x20048881}, 0x2000c800) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000080)="1400000016000b63d25a8064100094f90224fc05", 0x14}], 0x1, 0x0, 0x0, 0x10}, 0x0) r3 = socket$kcm(0x29, 0x0, 0x0) getsockopt$kcm_KCM_RECV_DISABLE(r3, 0x119, 0x1, &(0x7f0000000040), 0x4) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x10, 0x80002, 0x0) r6 = socket(0xa, 0x3, 0xff) sendmsg$inet6(r6, &(0x7f0000001c00)={&(0x7f0000000000)={0xa, 0xa, 0x4, @mcast2}, 0x1c, 0x0}, 0x20008b98) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket$netlink(0x10, 0x3, 0x0) r9 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r9, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r9, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r8, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r10, @ANYBLOB="01000000020000001c0012000c000100626f6e64000000000c0002000800010005"], 0x3c}}, 0x0) sendmsg$nl_route(r7, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000400)=ANY=[@ANYBLOB="5000000010001fff000000008000000000000000", @ANYRES32=0x0, @ANYBLOB="00000000003f000028001280090001007665746800000000180002801400010000000000", @ANYRES32=0x0, @ANYBLOB="400401000000000008000a00", @ANYRES32=r10, @ANYBLOB="d1bfce0c7e55f5c6e2dc342e4371758fab1f58f72f3d9dc57373774f2c39ba642003b5803409fd45debb3fd50565964098171c0d3988fa6efd9d77904a4c5ccd2bdb23395f0cd851e23e5df4f8adc847872449244f40c1b42c2e87fdbf992ac8ce36e685db6bbdeed9b541af5960795e467b852462973a08419b96bd49275da1e91f22cfe5b3c290e3fdb4f454fd458c0769759b39d38034284e816181cd109700bba2a9e61ab38b6c845f0fbe88915ba2ea4fdc31a1829615b56a7030a03b8a10665d386efd20d0cabe304009a57b0896add2f9132172499deba1df5021c767ad0f21ee5d0b"], 0x50}}, 0x0) sendmmsg$alg(r5, &(0x7f00000000c0), 0x492492492492627, 0x0) r11 = socket(0x10, 0x803, 0x2) syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), r11) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001b00)={0x3, 0xc, &(0x7f0000000140)=ANY=[@ANYBLOB="18020000800000000000000000000000850000001700000018010000b600000000000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000feff20ff850000007b00000095"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x20, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) r12 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x6, 0xc, &(0x7f0000000140)=ANY=[], &(0x7f0000000340)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r12, 0x5, 0xe, 0x0, &(0x7f00000001c0)="0101000871a7832e6b7303c3cd59", 0x0, 0xd01, 0x2a0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x3}, 0x50) getsockname$packet(r11, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000003c0)=0x14) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="3c0000001000010400eeffff11ffffffff000000", @ANYRES32=r13, @ANYRES32=r6], 0x3c}}, 0x0) 54.145551218s ago: executing program 4 (id=6505): r0 = socket$inet6_udp(0xa, 0x2, 0x0) writev(r0, &(0x7f0000001680)=[{&(0x7f0000000300)="4db9092ef89b7bc2776388269d5d0cddf8514da8238ef15de5b152e8afb6bf71d12e6c3f72cac8111512f5c129ac889181c64f08a1ee683a6ccce0d3ffd6af30c12087c74a1e4585a589fc9fe8b343f062f43d5b5c50b6f342d3bd2123e8773c740c3319a1f299a0baed663eb52bb9e2fb14e5971ba166ac81ab37eef00bae4f7001ee48cd74114b0e4a5d18596376ed5148d375fa896f08fb580ab359dee7990f622614a5900389a25d6dfc78f70e882a692c2701e0d8782de3d5723c17d112b64a1ae0e3a3082edcc3a37b0fae808629994d53c174d801240253bb", 0xdc}, {&(0x7f0000000400)="d8642598dde2cfa84a2c62972cf32bf0fe4326deeea26750efee8a9db44e62c249645dfd5d42c1a47df1d8f742973cf08878d19cd6808d12f2b8db661de3f91ee133db638e01e711c7cbe54fad1e820b9a627ba008c59389dc4be3bbca6a6c5fc106a2ac03453fb7fa7fcf65e8087b1a94365fe42540e1c993817e0128c9af4abfbd53dd2a825194ae444244d2c8af66439d581806a5c49d0a3790222be84a5a485470464cbed149344084a6a422f10bcc1163f2be9fde302797d6cd599702cdfb532c7045d5cf2072496adc15292d6afe47a6118e9c76a49a6ad508dd377c1702c846fc9945", 0xe6}, {&(0x7f0000000500)="c682cad2b62c060246e1d52644e9847c4d334fb11747ebb5bedaf53b4289b914d36a21e53769a792f4bc548579051802223cf1eda54094d270ea4785cda9eaad63ecf93198c8c7514ad482d33dd3716a4e85cfb40c0944c429af17c52a0f672aaf8072e855480073147736b2366a2414500d7933608581684ddc022f875d927e0f3f9a00eeed73b23140cdc413", 0x8d}, {&(0x7f00000005c0)="ed85dae1375557684d408ddcc1bca340f709a49e86d68c43100afb00b973af7a60962bf3888720377109978bd06dd6b21d2d514cd870dcdc0ea378e83b260cb6002058a67bd122cdec982b3ddde564d5b19476b60ddaf22ff09187cd958cc26245078bfffea069de0a7ac0b28036175f88d013be08f15e1316aedd183bac824739fd70bade647b7703352aa29b553493c6ab4ba8158d343dfd9150f0c5b192b46cdd1d7ac31f02b6f41bd0f9167d8fba608f396ae5b3c9be3c9c114865a5221791395f35496ada7e9b65b4667745014d2df101df638d906e5d7602d83903108c2d033c61b63b206499ad541981deb55076e83a6d5f5184c58f2ccba596d84c8008acf3e863b137d7102e9d1085b7f7ab5ce4c7721d28ddd039e9160d6ad4ae5b1c5d278897a4b8c01e7399fde8ca3b7a60b0434976942182b312115d1e594a2296d8f7bcb83732e27ebaa7be27f2218c86650960229665582cd1be6c1ea679e553b2bd3f65579aaf82cdbb091f293a06a589d954ae64e30636238065761d404fefaafcfc086339b2845dfa9ce985e0c2cbe0a293ace9318cdbf5f3ca80cb7dcc699405e2aae289886a6ed625bfe523dc1e48f346a82e1d4a5c05a96c70ba17f990686c71e6fcb591043836571e2b33e9995b0c15614f6c205f708cf94ffcc24f807ca318264f424e4852b14562f217e3f64ee973cb5dcd1520ed32ce1f99e1d78d68d6dfadf323f4b0d6b1984f8086b06d02de8cb02b0282ab9202dae4f72145302b98d47b61ec067f51af411cd2fe5ddc8e457cd09718cc375425d0680cde8c88dae3a4cff7fd6f5fb54199bab0d7596130d9e6a92bea63224c7fba39e1760e12604641b679feb398b9ad7f28c1e770eff8504316f29aaaba7ece757dcea49b9dd07d62dbcf9c5410ceae50d34dd05d7c40f6d56de53f4756fd4536c3f63be1e323861d64ceb61d250632d1afe4a02e60df4a12bd9d117919f23b6bb1824869e3aa47f1e6110c28c41cb829a28719a0caa42775624410cc40e2517104a1726ce70a16ea7addc76f568913274f849088facb25b8a55a8c40e0984276f6f5a783c013c9ad92ce13c230f1e7494bae544167c6d2bb9377b15f91c11f163e719817e9cc3827f68aa99ee760f87a20e6444f37320afc620cd0497d8229e9442c5e2b6118f0fcb7f1fcb1798b6ea6af1d5c5574c24742f553bd8c9b2b5ad8710731e00555183c98e102fa92c05d0572308dd2f3dad26469934a389dafc71853d61d03ce1680e8e8ceb3b81d547bb640b948044be019f3f6fd525067222cccaa1d6f663674fdae0d9fc7be02fdbc6c29e482c147ed84a8b3ca27e3eee473517728caf4e01e1fb069574d9447d5fc5a95ec89edf3bdfef656c918434b45822e47e3d6084ac7a130d99bf794293a7e3bf7e5643e4c899dc3d4ab6aa265495394f2cc50f91cffaed09a2ee2f7aeb6be025c1ad1c6cbb45971dbb01870c8d95d580363a8e4aad437b9b74909b698c7193e42725b3173f5e29a7762ab090f735a4876e235c4ccda4a304ba45a189c2fc78cdc5b0f547a4a8bbc5985061d9fac5a8e3f90f5e9bd4aa2f53618486d634dc3aa58f7b79fe3e3e1c8679a63ae8d959b41fc9376befe8cae4ec6559ac9894df0e4ea5234f99214925180019aea0d4224e3c21f45d1de2e85e9ebf46cb206a8bbe67d8276d0960f5ba6daf803ea0a82b8f54ea0f395228e2e3a22b27ec09d9c639b135f99b9ed316235a304010712154b7928398726bd701fdac6f31e2912fa96557b18405349419d0e1519e34d916e71413132c64762d3a702918bc990a9981a037993fab1d967116b6daca8fce9ea226f84a483b57013a53f83e8d8dd8d800200df1c037388d1499afdc8154998ea391ddfb4df423c8adf5d783ed20193229ba9cd066b2f90f193f08bd7e53bb0dfa5be8183dfd06743f71e8a6d48360e87f5a53c93d15cb08f05366ce778d92f8264021bf00fa16b1c0ad75310394a0f860fbb2741e3adf00988105a969f174bb2363510487d951183104a427db214767ce9d3011f74b99425717a3da98108dd61802deeaf637c25ae4bf387ddf296aa68872a26dc73e66ff5f297ce6cea1b6f64b5b771316267cf6d1a4b0456bd1f5b8dcb8b33713dd207d76316d71843854b3ec74072eb7e76c846f0aaaedcd7e54b4edb9a25b4f40d34e67b5bcdb96eb7741ce9922c4388dbd0f9177bc2ba40efd2e544b85b0e9276736f0afc099b2c24230faf4ae3b6254e3b2a012336f55c3f841625300243f22bccda4eb408e2e0384be7b68d761e00872f3ec12e1e6ecf93f16fe102d85349aa84c0b5d3cea3de100f6cdff808e5787b30e848bd7f759d11a149c0a674762283964eb7813afe1948be69ce859e5c06af873a39d3b5b5af3c46133f1290209df7e09d3f69d0499a52c0d00a2964f7083103361aa7938516e455a10bd925a54e465f0677b38eea8b802b45a984be9c9a71721d43b9ed6936736860489f09a62af57b62bf9a4c9e40cb6280718eaa78431b018cc14f0b44ca492e072545c2e9bb158624edcaa3b2c6e26803432a3b1949179b63219d0d4b790b54d8b7fdf1c6fc750c322fba80c4c252051d5f6df2e33450e79349d0ef28c53e1fb9642b62240a6e90d939163c1942eeaef5575663c98b54ff73dcdf3fd17289d066ea2f2170cfdaef40aa2fdac76bb87d14de66a65c09babe2a0038bba7806b90126dbf150c59014d7a82468595be35fbdb66a05a53b95f0d76ab2fbf0d00ad6a59129c8c098c96a11a2ac5ab9af0601becd1c0966ff1043bd8bcc9d7187fa8dab67647bc3654b9c1096c878f0b5f4667baa326ca3446ba636adecac3c7359a063a01d0c5a1498a7afa2e9e508d8182269f9559e8873c3c788cac0218feb3b7484b5473ad1e31d7417206fef88c4da8aaaf3513f42565e1c3d11874a79648714aef2d6906aeffb80c8efaf00af767e86f0990292e542dcce3267d33103ee31de0d0a992df30b53b274aaa20e933ae117ce6fad716e19bd3b58084e7f314ff8d3c89907d0b58d7bf3b7aceaa99ad89e7a6baf81773a94ca0d306bc6ce91bb63d9dc2cd3a7439d27c29c9270ad4e7cca47b3f5d50753b5a952b4e9db83be2d4434c200b69e34d7f85395b2ab412a0454b9421e789ba8d91bbd5624949337a2ee2cffdefa914e01a76c5f0ab8b6db5288f15baae7e2d34b185a109c6ecfc2d1d018f2760189dedb8dd091aec19c9dd10f404d5c09f2dcb50d1c5b4cde354ffc9c89565b2267a857e1cdab8f67d4bb25174885274b86ab650350d5b1a99830f70a349b6895ab8436cc5e73b84a75f331674b6f474ec06a12072d65048e859416ad049b8a99ad0584aa92ea2c1c9d25109459e525f530a224bb6c8e89ab565b47ddd19a12bbcc0d1f621f7a24b279abaf6679180b4cb96546f73225c18dcf612b9debf5db7e9dd6f1f58d203c13c30ab6ebb5bfc30bf1ea989ba0f739916329926eb5de06ac07580aaea6e6465dad27ed18238a3776f336fa17ef9153b6a86852a16b17e5108f9896780fc7f9223109e32abf7ae6496051d9bd9a0c5286732ee21b9a28279c48a8635ffff24504c81bb6319dcf6c8ba6c564cc553b549ac27c98a7a4e17714da9b962f1ecf07a797e455fe5b5662548966b8abaf59682cd95cb5b2c2afe9a31eebe6f113e7ae2aaa5e356d85decdc538ffffecf30c605486f95ce1daeb8c4398d4f2c9b6d04ee9876dbc3906fdf1192210c95c336dba4d9c885085290f2c60d723cfa8d29cee79241b25c278c4eb420e226b2baf30f17f3bde22b4156beeabb7a960d7b021d4d23d35dfb29e84f87e63e0b3b027f5036d27a14c94e8c048f0fefd3e4b104b994834ae1aba2d158b780a111535f6bf24c58eed10c0d0cc92182c70a2fddf9c7c0d417106cd0d0aa95c4b2462a3b87b8ec7b3fc7dcd06ec4e8d8cfd899c5a2c7d0fd4fff929df800d3efffe51c614d9ddd8c2f56feaf39e860ac08ecdc85217e695c4c6d151e9c35a02bda3b753754353aadf3ac282ee3a4103929b0e14faaa121ef83be5a70e6d97dc866a043111b0566dfd7c3e4e6ffbd057a4047dc07ea1ce0ce267f8ad2f26f57f205dd21f1503ae8439840a359f521058c18a0296f7b2c58f08c1af991a505ab30c3c37107e944686ba2b255a5dd15a96d644fec9af578b77726d356e235cbaaf05c9a08e3cc4a06a6643e2e44e192e9573f88b56aa5411a0823845968a1ec5799323b8aac9a9f6ff937c7bec444fd15785298324a01b619e613e5389d8ec195b8d7377d513911a4b6e7d1ee2c2e88947333d19efd3e49f41d27ad8337cd9e8406825892a9383cde039775eaf07d63c0486fa9cf8ac5b377af0b00d93753b157931ba96bd59b5de8f0e17783c79ded3e9ab542bc71b7e6594b4c25581fdc473a1657c4898215d30954dda577fdf3609d074f9c9f43366c52e89b3adcc1dcc87871d18d0d30bc33c80798b1fad8ea64bc01ac67cf0de2cab46788f72558bf1b6a9bf7a25a1e06fdf9eebbe746238f3f3699ef33d4af82cbee0e4ef88ab292ba69386c621e1d61fbc0260cf5f0059afa043840893575e8bbe37c8227cf9e23f3240b64d44beb454a1be28e2cd6ea5a67f9cad52cc8b47b8131b1ab94ef4b13f91df79f0552265a19aad7c93f268f5c797d0f4ee4b37f6f87357714e2fad77cb66ed27e6fd41e4d751b6f31f0fc103b5cae73da660a9763ccbf28e44218bc4834e46159c2093a7c110c6581170ee60075331f9e4a86649d5b3200004d48547133b1f0e0df7d4329a462981328f5c7e4c52009eff08a2b49e5d058546f4270fdc64f9dec6bfdede113f8813e99ea16a93d74805dad132faf268f1575adcf960d8a8f963d219f24421c78a713b02609fdd055944cd9f204c027ec7dad16582dfd0c089c3a3344f0b5e9abc5d133de8a709735aa7f4969083942c9e7a596c8e374f2ed0a16617b86b0d0fe7bbc2580c5bf297f3dab8d44c6179e3aa7fd88be7bef0598bc8d4734b1f8e4ecd464013acc61bc6782468ca0489e1190d1aa1f215c5a0769d9aa57c77fca752d99b64226db69650dad5b33d9795f677d3ff48b589dfc93f6e0ae6513a436d2c6f7efa3065dba5dad37f98c0d0bf196f71f4ab9b49ca7962d0a571b9cc076411219d1ef7977dc06a6e5c27fdcbc8c1ec28945965fc26568cca2628299c26828e967ce3f5fbfd4bd0fbf47bcf5c2a058c3048117d13ec701d0902ac883ae8d9816718df8756d844c2445d9f992570b9c68c4cd6cd0025037e7ac59d55b08d8c97cc92225134b8e9a145738da777b5c07d14600aef5bb53e80906378d79263c024a6298a06fb24731f49972e66f5d5064378673e27e40e12ac577df06ac4ac4118cf68f44ab4dbb259f88f062f6b67de6f23bcceeb4cc87caf4d3e465a902435f389cc69b25bc575f3faa63e0cdaf3aadf2afc186e04acf8d717282a61e1ec47a4a0c6cca75b305f55ecb0d77198e266883718bdeee1a56d8544c3c4cb368249b6dc15e7149101624a57cee0a9b0c47abb927fccbc6f52d4ad82455969d2a31a88df47a41a69b1f14dba7096c1afc8f2751cda9e7fba7f4b81f698251f772d4acbe441b90fed1b3fb216fdab12d200abf9816bed54ce7a0353c0525563dbbfc6d347bedc233b4c87041d69de301a5eea822d03964951112dd3801c235c7588e558910e0ebc59ef8c76967b44abc284ccc18bf1068367c3cd7c831ba110ab17ac80c4b3799eb7b1136bf1151d20a6c71b08e3a0ce772a85ac3c2dabc3452ac", 0x1000}, {&(0x7f00000015c0)="c46fab792464bc75741d4e6de3440d47de338e7f9aaf446a550cde667e803829afd5414ba0744fca1cffc66d35bdff2248942a4664b99eb2eb1241291273133de773c6ab4fd6be5a9bd9dd94527ab46d18e180cda31780fe50d3b68965827545706923a72f5b3bf833582e10fd92afe7827fd3dfa32e15f48a0c1c1150cf551f4071b044b605a2ef19f6905ce808cccc09fed02da567e006788a7771a4611dd96a06384d29ed471bff840113", 0xac}], 0x5) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'ip6_vti0\x00', &(0x7f0000000000)={'syztnl0\x00', 0x0, 0x29, 0xe6, 0xfc, 0x0, 0x62, @ipv4={'\x00', '\xff\xff', @remote}, @dev={0xfe, 0x80, '\x00', 0x2c}, 0x40, 0x10, 0x4, 0xb23}}) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-twofish-3way\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5910fae9d6dcd3292ea54c7b6ef915d564c90c200", 0x18) r2 = accept4(r1, 0x0, 0x0, 0x0) sendmsg$NL80211_CMD_ADD_NAN_FUNCTION(r2, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000640)=ANY=[], 0x3aa0}, 0x1, 0x0, 0x0, 0x40}, 0x24004015) readv(r2, &(0x7f0000000580)=[{&(0x7f0000000280)=""/198, 0xc6}, {&(0x7f0000002000)=""/21, 0x15}, {&(0x7f0000000480)=""/166, 0xa6}], 0x3) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f00000000c0)={{{@in6=@private2, @in6=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@dev}, 0x0, @in=@multicast1}}, &(0x7f00000001c0)=0xe8) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000200)={{{@in=@remote, @in=@rand_addr=0x64010101, 0x4e23, 0x3, 0x4e20, 0x0, 0xa, 0xa0, 0x80, 0x3b, 0x0, r3}, {0xfffffffffffffffa, 0x100000000, 0xc933, 0xa, 0xc857, 0x7, 0x7fffffffffffffff, 0x9}, {0x9, 0x0, 0x9, 0xfffffffffffffffc}, 0x5, 0x6e6bb3, 0x2, 0x0, 0x1}, {{@in=@dev={0xac, 0x14, 0x14, 0x1d}, 0x4d6, 0xff}, 0x2, @in=@private=0xa010102, 0x3502, 0x3, 0x3, 0xca, 0x1, 0x2, 0xc}}, 0xe8) 53.737364029s ago: executing program 4 (id=6509): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000010100000000000000000018010000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bca2000000000000a6020000f8ffffffb703000008000000b704000000000000850000003300000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback=0xa, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc641}, 0x94) r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xf}}, 0x10) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000000)=0x4, 0x4) connect$inet(r0, &(0x7f0000000280)={0x2, 0x0, @broadcast}, 0x10) r1 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r1, &(0x7f0000000140)=@pppol2tpin6={0x18, 0x1, {0x0, r0, 0x1, 0x0, 0x0, 0x0, {0xa, 0x0, 0x4000000, @mcast1}}}, 0x32) ioctl$XFS_IOC_FD_TO_HANDLE(r0, 0xc038586a, &(0x7f0000000240)={r1, &(0x7f0000000040)='\x00', 0x81000, &(0x7f0000000080)={@_ha_fsid={[0x3b, 0x8]}, {0xffc0, 0x3, 0xfffffffa, 0x800}}, 0x9, &(0x7f00000001c0), &(0x7f0000000200)}) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, &(0x7f00000002c0)={0x0, 0x3}, &(0x7f0000000300)=0x8) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f0000000380)={r3, 0x3c, &(0x7f0000000340)=[@in={0x2, 0x4e20, @rand_addr=0x64010102}, @in={0x2, 0x4e22, @multicast1}, @in6={0xa, 0x4e23, 0x3, @dev={0xfe, 0x80, '\x00', 0x39}, 0x6}]}, &(0x7f00000003c0)=0x10) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x14}}, 0x10) 53.451399886s ago: executing program 4 (id=6511): r0 = socket$nl_crypto(0x10, 0x3, 0x15) sendmsg$NFQNL_MSG_VERDICT_BATCH(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000580)={&(0x7f0000000480)=ANY=[@ANYBLOB="2c160000030301030000000000000000020000040800034000000e100800034000000000080f034000e1ff06"], 0x2c}, 0x1, 0x0, 0x0, 0x20000804}, 0x4000) getsockopt$sock_buf(r0, 0x1, 0x1c, 0xffffffffffffffff, &(0x7f0000000000)=0xa) r1 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x7c, '\x00', 0x0, 0x0, 0x0, 0x0, 0x3}, 0x50) r2 = socket$inet(0x2, 0x2, 0x0) setsockopt$inet_mreqn(r2, 0x0, 0x23, &(0x7f0000000740)={@multicast2, @dev={0xac, 0x14, 0x14, 0x2a}}, 0xc) unshare(0x400) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000001a00)=ANY=[@ANYBLOB="0600000004000000040000000600000000000000", @ANYRES32=0x1, @ANYBLOB="00000000000000000000000000000000008410f5294eeabfe58d758435e100ed309d70487a7f06488dd9d94ffa5b1e3fa7902ef1a78f38bf7bfe245228bd450be59235051913620312175d04cf5a71ee43bd7a351ff8239ce5b079cc61760911defe60887292ae5c01c5413b294e717975ce7bd86e71e8fee72f5427392fdb74c030119f219019bd3d2d4f6fb562246083da6aa2f7ae44b86934d29e2a4c2e29042a058bf4ef8f0a94bc5149185906a49e9ae4487c080500c55a5bde417e29f643afe23fc35ce3948e88f702d1bcb3df7dc3fc75024fc8391574ee8dbbe2427be872f0e265c023", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000300)={r3, 0xfffffffffffffddf, &(0x7f0000000140)}, 0x10) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000001b40)={0x1f, 0x1d, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000001000000b708000000000000dbaaf8fff1000000b5080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r1, @ANYBLOB="0000000000000000b70500000800000085000000b3000000b7080000000000007b8af8ff00000000b7080000060000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r1, @ANYBLOB="0000000000000000b70500000800000085000000b300000095"], &(0x7f0000000600)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x10, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x94) r5 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$sock_qrtr_SIOCGIFADDR(r5, 0x890c, 0x0) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000000)={r4}, 0xc) r6 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r6, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x11}}, 0x10) ioctl$BTRFS_IOC_BALANCE(r3, 0x5000940c, 0x0) setsockopt$sock_int(r6, 0x1, 0xb, &(0x7f0000000000)=0x5, 0x4) r7 = socket$alg(0x26, 0x5, 0x0) bind$alg(r7, &(0x7f00000000c0)={0x26, 'hash\x00', 0x0, 0x0, 'sha1\x00'}, 0x58) r8 = accept4(r7, 0x0, 0x0, 0x800) unshare(0x60060200) sendmmsg$alg(r8, &(0x7f0000001980)=[{0x0, 0x0, &(0x7f0000000180), 0x0, 0x0, 0x0, 0x4010}, {0x0, 0x0, &(0x7f0000001900)=[{&(0x7f0000000640)="c76cc545c1785f9d72013c05e1b55b911e74b8414f60eb28f07ee7962787e3d755ec813cae318199fa1d67873901c27b3ecbc4324a1c362bd5265f54ce4695f99d5a7d5fec69dc4d84690e0a1b0c08dd9a5238dfa05421e24a6ee82000e4c8de5f8e558d714de98cde6be46f12bb3fdfc03ef69e284ecbe000abc8c48ac5ecb9b1c62d644dd3450abe07b3c66aec3296270a5facaea00a02f1f56db5c161d80b0a5f60469893550c9bef584f176b3af25c", 0xb1}, {&(0x7f0000000780)="1eec695155485cb0f1df56e966ddc3612fae692ed082facbbe21b0a8522d3bcf921e94d199790d8623fa551d30dd1d2f1fc04ae81ee05d1f890b5e3271be8861fdf2637bade317aa785a57b3e37378ce52d53fc2c0d1195421cf63dca1ea33ced527003ec276eba8abd3f9410a9f8303a02ded681f005f1b8bef771930d7d414b6cf7e2dd9f2de545629ff5ed590a170ecb50616ea2d928e5e44af9329d82ca1880ae6dcacfd6b096fdaef1acf8e0ad5fc3e36176fdd2a17c570ec87c058c8a22a6aecf101646d51c778325dff51509f836282636b34c7f42e90a6cedb0eda089f27597a93455c6270a6e6e649c2feee1eeb", 0xf2}, {&(0x7f0000000880)="93a3e42ee471703e885814092fc471179c8a8d1fea9ba942fe9f565f73df5cda6bfcc41b902ab36380c93dde275796df96de350d4baa934a90b02ead727356a99c1a7c2152107c028957fd1ba3855881bf56e503c0da23e2b132f2685cce442b3e76ab2a56b9f25b0b90a1e4f42a8d509f4c8fcd9a2bed3b9f4395a1ad22dd2f19047117532333b24441d227ec10d76f1f3c8657991cb85a2e41c94722ea2de175dd53e507d8d745a4d7a957bd08835886afb3242df676ffee1eee1ae8a759dee9034dbeca6b0e8f87cf5936e86726965774519fa8484274429577d4ab03e70e69eba75289f47029c4839bbbb98e5789ca88953ac38a4428596ec7727b75dde4a24f786e7883813882a29e4340cee0d1b0b3a3c9f6c3d1ff9416c962f3bba3ddfc0c9d495eca5be8399dc8a42b53e007a230878a074adc7990e416112431169e935c482140e1d19eaa3c5ecfb875654c1652dcdef95e1adb63cff09071af2048d90f6e513db237a061a451ded1ae238d87ef688a80401fd01f6dc0504d23fa104b6b0ab07d427d1b776ed5b3367ebb573d9f286b6c705310cf73619372d42eb8cc3ec592b5cc8e76e38f3ebbaa9d9711f92056ad3dbbbc4bbe72297f977fc85471dbd182880a976033bdf3151a2669cfc991ae21b70c76ad128b708723508726f572ff4016c1781a48574c4652d9dcd9edbd42d152e8ca01ca347050c2d079851b59e6dae957b31d55faf6d1585722db4fabbf525d93530f42589edd79583ebefcc77914b57d842ac73640334fe4bc074b4dd3167cbcc9ac39d8202a278ebe14cf965e1731d525ea5498833e6a9ec55cfaf5ccee08262b949c985b4a651a3cf9f0fa80c14f6a9ca33478d91f55e3c6bdd2672e58ece7f43640b803c4be2d888f894c0af8b533a3a0995c4be7a7e40290ee8079565a118d0dcba51c48278d275871b9c17b7ce973dd68cc8f0419cb55ed0eb241856cd8ae3fa9d5f89b8aeec8d688a44aac673017c8dc5f571ea924d068a100a86bad754636a3c85ea037f85582d43aa90144ebbebbefe5b25c97fbc0a6627cc9995dce1ca75b129e6e307fbb52b640a34aaa2a2e6ed8738b2d584528ff34ce7d14d06056a13b4314de78b1360bde9c6a8abe6b22dade9c8e8644a0ee96324d67225cf8f1c6bf3e0aec3736f326f3f2a05c0bede58d30d494dab87f17899d65d121a175fe7f591b0bffb3488267ac73644572895eae363adc9b1945ececad94c37684216a30b9fddacddaf8c0c3c970b18d2248cf2dd3085d2e189e352bbf11d7114291ac3384b06e6f19be8295ed37a2b9382caf37492a74d4bd8cd93eaa4e97bbd997c5d7ad585d00b439132ffc7c037f37a47910e3fab4c949ae7c50c5f02fcaed860036359cafa541a4351bd3acb126ae2a90bda5797c951ff34f9322fca6157298fc8e2f50792531c6b38ce4280e7f66eb45ff379ace480bc890b4720deee0056675ece101f323ad219a9adb0551051e67c08a5e2e592f04e281ff9d8dbe2196351934654f23b2d7cbc6e409328e7de4d5133a1d0c855cc51410e0e335c3f245d5eeb0c2a12457aa320433e3833fbb78549253794fec6357d624d2136bc5c2d8c598a106d51856f45703e8b426a879f4084b3167f93129b197000c109c862e4aecf50906f33384bdd7b304c21e2808e7687c00cc08eed80ede1a7d8bba25aae064c14bd0a575d9eff986c9382a0fe726763af94f8778b3e47bf6e6972bd5ef662cdab9c8e6bf72f7d23d069dd0e8e5fd90279a93818457894434239b4c020b373b385c62c2c1a322474bc14ce37722ffe675655abe5592f087b4c13f26ad7b57152aeed530365837d49f1859bdba55101d2e514b38209c477d893b9b8371ff7b649e6452bdcf90275a65553a468f020d55f0081a18abbbad97722960d2ccec4c007d6e4cbb7ab6dc8167c721877f6d1c7344c6234dcf7d9cd231390260980f1bcff6ce978e2d65158de1026f7df6842efaa0763d945c5cf7e2ed36361b490571e6ce0b7072e56860a5bdf3feb0f9911b307926dd9bcdec03d5605069933fc97de5e7d51cd807a2219046c6f0efff98333e12f886ad418e1edbe6335dfba1940990a6f4f62a5452aba43ec05649b8f738365aadc22615d7102cfdfd1774e12b76aac4ab4a01f19e150bda225a3d053b38e6738287d7967e30fb85f610e49f51bac4bd23beb8bf0acc03b6b13e42a5e51fd1250ee989f97f06b32465088987a7dc115364eefbde62407c985ce74caa202a0c2244ddce52ef8477ed8752e15c029a09e31f59933ddc82602457516f5232d89100b4091b04867f6c35d9d4106785d4925f25c817717c9e366d0d3f5466b677db5a55fdf0be3248968d7f902d9f8cb9472f05c661473428bec6f668c5992dda8421ec18f6cfab7c7086a129c2a33e6709e03bc702f2771e080844d3a94eb81d10396125093b5e7845625932b6b2d85ecbe018ce9e0335e622c49b5a0674969c54c20eee275406eaabb04e5cdd7702e42d3f61a0f5aad3aec431bf1b3f7cc994f3ab91b438d9ff7c308866dc80e8e5a0f9324327fcb08578b6c5bd2120ccc5c7f5bd0dab366ba385c3ea4edc14320c12fa8beef5a8fcf15243b9c135f16e853803abe6e6735267a675a034a8ea58e15c636885069e727436d0393a6bca045be8106e3dddaf262d643622637dffeaaa470380d5e43f733b5a1e858f978e6578a203e4ab5ee8b3b8f927720891b053e21b163fac12cc80e58dadecc7c61f2fade1aa4f4a1e711df4cb9be727c934b1e52e58f36ea892acab2de337a828a830c0b1abd0048996808f4a50410aa46bb96a8814dfd0f0526e50ec5948d1d7283ae0d2fe421ead2afbfa17d458fbb7a30be67c6b603381d490b4aca79fafff556f93325d531dfc6de2ada80f149a535b08faaf7cc9c769bcdafa90c3f67956dc191b24b2f2b8f0688bcf605fea23b9c2b4d5556ee9b437ff891747c3834097950c6a426ca74d140b800c1e4f41d136171de530fdaff5e7d71167738198fb72ae2690c8cfe5f05c9c1da370bbc6491f0a1bbe1fa6342df69db9f2311be861a523e40a7b6d116a5fdebf79ef7e838d181e36428af567d2a63c4bf43592835a553bd17eee3e5a1d7b65bb055d7b353ea92222cab6c4c9a9de5b4e9f55f0f239971c6789772e0dfd89ac182b1863bd0bb8902e045211d1981bfa131ec6b75d805e0b223045e269dcc0ae85b7e779d9d8fe77b5f4270204087ff55e24b8decbc1c050d1e66b9e58782951800c243349c872a393d69c12991b20eee500b5b153e743a214260be8deeed0a51b523ff21c292f08b477e705cbc056f49d71f225fa44292e58512a187dd8db8b0673c2f812df1e0f97f09782cd4843bfde2ed14f0f5d10b3e0b1d8db8f642ec1d78e97fce7747b5a94c68afa130cec0d2296593679e769ebcfe2b3ddb3df6362403eb51b69c475d72ff705065b06125bd011bda940b97f86a46e4635dc4d46f8a4f16ad6c62c45ad1c2de157c361bceedaf2d596b5a008ad7e0adb2502a7580489b2d678546f3882c6ae8df804f23cfce8734a9df2549a1e08d00737bc3081cfb30c4638c0ee31b2ed3e47858f7ca941941264d3419ff82e24979e774c227a9de92abfa00695f67236003f5f0c000bd6fdadf05cdb7170a26345826d1623b1a07d2f50f7bcf853fc0c9d3aeab9ce413ff607ac88c4f4516ae887752a2379eb52efb5464b20b1e83514d5bc8a4bfeac6c3fb21b62a812358da2ca4eeb9fc9b6256d873ee5ea63b919ad8f2da1a3f82009bc67518e753d519476b9787cb2037477dc82f5435932aa1ec125519d91ebdeec798802395c015981427163ad5370119268ee61fe7a76d09c6cd46cf62bc4255760177302d138da6b3ee4fcc6471ffeda914bad9be0d5aa246c9eb10f52f94412f7bacebed9f9931d8c411b9e6263d0fb75d7f2ce2b0a73d06192c66f09636cccc4e99fc993152a0231dc7ca1a30be26447f18e9a12eac21af9da5b68202a7dc93c3f1ab1d99db15dfcad2f4c5c96ad24021510ae6893019ea7b6575306321ec5bf43e7ae771a04762d5280a4c77a7dc6f6dd808660c36b065e10897933a36e4a76a793110ce102b91c80741503754f2c7864e5642a1ab5c8633fdce706c0b89b25233892cd2d05ce40b9780c90739e3c5bfc5a6eb7a546060c5dbe443d09f812e9cea8f0888360026feb3dce756d76e55f3c8114187a11f171d9f330f5972ff0c1393e715c8a29b04e44b0fb5a5a85fce6f8135a774d936f32c8df0fd3342c2070eb8126834ac17a07207b65eeb65b8551acd537834fd1c214924777a575bea10d32803287ab91173fa7c8a2bd4f5b10be2ec065f6d8c3472f133340035ff9bc561c88433a1a984025d4005e10792f067c12b76e21121f770b89a6333e989296974cb3020202b20a6fafed14838801d2d2057ca79da9cdf2b574d8102070bc11d95bb1c12559f28f9dfd87d69bad40587435489aa6025438ba5bdf80150e4c4cda69c0c1d69bbd180ee5acf30bb86136cb761af48b212a126b7ba431dad1b3944308841e62090f2e8d8187e2bd285be7c72f1ac8a270b974d82c7689cc21d9b6987a9e29264d07b3bbbfc593faabbc9c77001e28d416a4d73f7ce653f47b63416337868898c9e20928ab45911347ab09a3662eda582d68829f58bd0c50cda2d50d53e63239ddd01434783f9be7b60726906e31fba95748fdecab9df467e2a7bc283131919ed144012c2cd97b60013a8b0704b86819e53f04ded7e35358558b26c14ad19168b530acb8262808960f94086e891bdf0d76d3139d351ef677f054c5bb71ce0fbdc7abffce32167c1b02d5030367f5c3ace874eb6af965a80019767d978fe72137586050e5e9a73b16c3324e62ea172855d83a64ce6639b2262a7d207ab224920f8f975865ec1f6bac5798a972c48ee5e1ce0f6e3e17fbbb862c72d18f5b4127aaa42ad5f54c4179fe1c4e521b7edfc944dc166bf398a7cb54b347e2bfaf92eb56dae4e491b78876c692b7bf3ebda63e2edecfee66e7ef829a0c5995d84b56b65eb930d86ddd26337ac7b201128e68feac4ace42ed27a9353217a7c95fcedf8e86d30796429ca6f84eecde8db43b8ca9df314076ca0b3cadaf8d21aa76882b3bb3da5f46245a3cd209b4daddd3978254e03a77443e009dcd7d55b0a13aefbca28a9f8d12bb65d8db46d30113f47bd7c5e8800edb1202721adc15bf2b208bab30de442999bf6b5876212f20f3904ffe093457cf6bda8c1ce5d4a95ac99b16ed1a2b07e2a913bb7abc3a27fc4f25f659c23bdc814ccd3dfc40db686971052386b43ed45dad6cc6ed9768c784e707d7f5e829fedce431d5cd57874b6928bbdc3fb56401f425519f8bb383b5ea1258daa31d0c81ec505f35e963487927fbc8c2dc09473e0d5d70eec9adabf5f321c5f214f827172d0804e466f354537e4b7cb0b78f4cb4fe8a01b2bba4e1eeb41ec97df6b4a42aab471229ef9a73b12e41c53ac42573c23a68210f9c50f45b96c410a56383681b5cff9ee2668c9fab89e730b9c9bb32b04eabbc7e9b8583857b41106cea65f9d39d79be59593fbdee8f2945260d75962c823a07ec7dd31b16a0c630d8f4c5151d480770a3beb0cbad56e13d61e167be640388920294b3f569b1c853b6f5fb90fe1b80df32b2f2ad8fedb8c0f4061689e6dc507fe4ba1743b06c6cd9fbe7329db2bfc8a7d26eeeb0df441c76eff92d408a4fc2cdd911e41bba9acb13d305958d9e66c38b8b52b1dd00d564c47d6cb3ada4", 0x1000}, {&(0x7f0000001880)="7fa095bae02399bf57a7bed757ad4c746ca94fd91dc7827c0619be9d51ed2355455d650fa3a599c95b79fc6b6320f222a97e105728d174ce5b694d8e", 0x3c}, {&(0x7f00000018c0)="ff9b9fb62d2b716cff6b79f20342b1a14f1092375c4ef06f10675bc23c99f3caddc515e05352ad9b7699b8760601f23cd366b3cd9c2a4edb0ff0fa70", 0x3c}], 0x5, 0x0, 0x0, 0x20020040}], 0x2, 0x20040) r9 = socket$nl_generic(0x10, 0x3, 0x10) r10 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000740), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_SUBFLOW_CREATE(r9, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x14, r10, 0x1, 0x70bd27, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x400c0}, 0x0) sendmsg$MPTCP_PM_CMD_GET_ADDR(r8, &(0x7f0000000400)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x400010}, 0xc, &(0x7f00000003c0)={&(0x7f00000002c0)={0x18, r10, 0x10, 0x70bd28, 0x25dfdbfc, {}, [@MPTCP_PM_ATTR_ADDR_REMOTE={0x4}]}, 0x18}, 0x1, 0x0, 0x0, 0x4}, 0x20000000) connect$inet(r6, &(0x7f0000000040)={0x2, 0x4e20, @multicast2}, 0x10) socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r8, &(0x7f0000000140)=@pppol2tp={0x18, 0x1, {0x0, r9, {0x2, 0x4e1d, @multicast2}, 0x3, 0x2, 0x2, 0x4}}, 0x26) getsockopt$IPT_SO_GET_ENTRIES(r6, 0x0, 0x41, &(0x7f0000000040)={'security\x00', 0x14, "0c457e0ad62564d35c01268367e100ef2d3d8a53"}, &(0x7f0000000080)=0x38) 47.334645062s ago: executing program 0 (id=6537): syz_emit_ethernet(0x3e, &(0x7f0000000000)={@local, @empty, @void, {@ipv4={0x800, @tcp={{0x6, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x6, 0x0, @remote, @local, {[@ra={0x94, 0x4, 0x1}]}}, {{0x4e22, 0x4001, 0x41424344, 0x41424344, 0x0, 0x0, 0x6, 0x2, 0x0, 0x0, 0x0, {[@fastopen={0x22, 0x3, "89"}]}}}}}}}, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000007c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(sm4)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000001280)="b7f2288a911993f08d3aaea2bc0000de", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000002440)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000001a40)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18, 0x4000801}], 0x1, 0x40) recvmmsg(r1, &(0x7f0000000a00)=[{{0x0, 0x0, &(0x7f0000000840)=[{&(0x7f00000028c0)=""/4096, 0x1000}], 0x1}, 0xf}], 0x1, 0x2101, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000300)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x41100, 0xa}, 0x94) r2 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000780)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00'}, 0x94) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907009875f37538e486dd63"], 0xfdef) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r2, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x88be, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f000000c280)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000001100000000000a20000000000a01010000000000000000050000080900010073797a30000000005c000000030a03000000000000000000050000000900010073797a30000000000900030073797a300000000008000c40000000032800048008000240000000120800014000000000140004"], 0xa4}}, 0x0) 46.647159463s ago: executing program 0 (id=6539): r0 = socket$inet(0x2, 0x3, 0x6) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000001040)={'gre0\x00', 0x0}) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB="380000003300070102000000fffbdf250a7c00193dce6480c0cdca75e5ca8986c9f7050078326de2f32a92eed3a196b75031c2e39729d2a408873f5daa45f16ddb1b9e43b99e7564c442d771082fca214539320205a2fba410dd6dd2312b34116d6f03606aec0473eeea8859831ce1482ce6ba15b48bec61a095e47eb616cf894dd0cb36ff824850e76b56f32ee490fbbc411768352ba72f480a995aca855921f3e67ef0a5db9faa3c35b200000000000000d808c9dbf293a7758a1cc70ff5951a7573a3c611d11fcae2cea6bd42bfcbe628eeed32ae5da53f5a1406a061e6bfc9a338ba23a1fba38231c9ca651fefec1d87c60543585c4e2452dccecc22870cc4291d64701e4e51da4d28b88f3b225196179eb78257cc7dcf935615d38ee00d9bb1d456801e976f5b2f760180d5b5bc0825811edd8d24c6b9cf924e3e2eaf116be88ce326f510198942317989eb0cf865e3576f61800644bc4d361e68f66071d427ada7a7641570cc673d92f409ab3a196e606d2b21da0d2f52d8aa22ab1959763ea4c7b570dac94a26c3b6041f83c74e1e151003c4ba2b6283321bb61439b863895bcb284f54956df6dc33680c6537b5f25c37aac104b7cf7b8fb8c618133118a4cbdb38e4e9fea9136ac74590e535d90000000000fcf0143767d668123d6e25aade15d85a2369c157199e84d289fd66688c8b14263b0af7772f59ac94034da0f92355e8d866698015cfb5475cb14f7a309e7fe3718f4754c7d1de3c33dff9b24b654c1e8cf1fa0632f487bb555e22a0056599404402b87df2b16ac399c1a35260ae08c47db27c7fd2f6b8bc13166e0df9d752f311f8de15c45255ab99328feecdd6b96824a6c881b1c01ea708c3fe9900758c327ec0f502797619a55e99fcf6a7720b7720876f5c31e746d391d7b614fb4d2b65b2a9"], 0x38}, 0x1, 0x0, 0x0, 0xc044}, 0xc050) 46.38607753s ago: executing program 0 (id=6542): r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000080)=@filter={'filter\x00', 0xe, 0x4, 0x90, [0x0, 0x200000000180, 0x2000000002c6, 0x2000000004dc], 0x0, 0x0, 0x0}, 0x108) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_int(r1, 0x29, 0x46, &(0x7f0000000440)=0x8000, 0x4) sendto$inet6(r1, 0x0, 0x0, 0x0, &(0x7f0000000200)={0xa, 0x4e20, 0x0, @dev={0xfe, 0x80, '\x00', 0x33}}, 0x1c) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=ANY=[@ANYBLOB="74000000000101040000000000000000020000002400018014000180080001000000000008000200e00000020c0002800500010000000000240002800c00028005000100000000001400018008000100ac1e000108000200e000000208000740000000001000"], 0x74}}, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r2, 0x8933, &(0x7f0000000040)={'team0\x00', 0x0}) r5 = socket$inet_mptcp(0x2, 0x1, 0x106) getsockopt$inet_mreqsrc(r5, 0x0, 0x25, &(0x7f0000000000)={@multicast2, @dev, @empty}, &(0x7f0000000080)=0xc) getsockopt$SO_TIMESTAMP(r5, 0x1, 0x62, 0x0, &(0x7f0000000140)) socket$packet(0x11, 0x3, 0x300) r6 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="020000000400000008000000010000008000", @ANYRES32=0x0, @ANYBLOB='\x00'/10, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB='\x00'/28], 0x48) r7 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x10, 0x1c, &(0x7f00000002c0)=ANY=[@ANYBLOB="1808000000000000000000000000000018110000", @ANYRES32=r7, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000005000000bca900000000000035090100000020009500000000000000b7020000000000007b9af8ff00000000bd09020000000000dbaaf8fff1000000bf8200000000000007080000f8ffffffbfa420000000000007090000f0ffffffc70200000800000018220000", @ANYRES32=r6, @ANYBLOB="0000000000000000b7050000080000004608f1ff76000000bf9800000000000056080000000000008500000007000000b70000000000000095"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_msg=0x7, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmsg$nl_route(r2, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000001c0)=ANY=[@ANYBLOB="54000000100003040007057007c78d9292cb", @ANYRES32=0x0, @ANYBLOB="00030000000000002c0012800b00010062726964676500001c00028008000500010000000500250001000000050029000000000008", @ANYRES32=r4], 0x54}, 0x1, 0x0, 0x0, 0x4}, 0x8044) 45.525357685s ago: executing program 2 (id=6546): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, 0x0, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000280)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSET={0x58, 0x9, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x2}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0xfffffffc}, @NFTA_SET_EXPR={0x1c, 0x11, 0x0, 0x1, @tunnel={{0xb}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_TUNNEL_KEY={0x8}]}}}]}, @NFT_MSG_NEWFLOWTABLE={0x40, 0x16, 0xa, 0x5, 0x0, 0x0, {0x1, 0x0, 0x1}, [@NFTA_FLOWTABLE_FLAGS={0x8, 0x7, 0x1, 0x0, 0x1}, @NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_FLOWTABLE_FLAGS={0x8}, @NFTA_FLOWTABLE_HOOK={0x4}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0xc0}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) 45.306579368s ago: executing program 2 (id=6548): syz_emit_ethernet(0x3e, &(0x7f0000000000)={@local, @empty, @void, {@ipv4={0x800, @tcp={{0x6, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x6, 0x0, @remote, @local, {[@ra={0x94, 0x4, 0x1}]}}, {{0x4e22, 0x4001, 0x41424344, 0x41424344, 0x0, 0x0, 0x6, 0x2, 0x0, 0x0, 0x0, {[@fastopen={0x22, 0x3, "89"}]}}}}}}}, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000007c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(sm4)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000001280)="b7f2288a911993f08d3aaea2bc0000de", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000002440)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000001a40)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18, 0x4000801}], 0x1, 0x40) recvmmsg(r1, &(0x7f0000000a00)=[{{0x0, 0x0, &(0x7f0000000840)=[{&(0x7f00000028c0)=""/4096, 0x1000}], 0x1}, 0xf}], 0x1, 0x2101, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000300)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x41100, 0xa}, 0x94) r2 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000780)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00'}, 0x94) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907009875f37538e486dd63"], 0xfdef) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r2, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x88be, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f000000c280)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000001100000000000a20000000000a01010000000000000000050000080900010073797a30000000005c000000030a03000000000000000000050000000900010073797a30000000000900030073797a300000000008000c40000000032800048008000240000000120800014000000000140004"], 0xa4}}, 0x0) 45.294161216s ago: executing program 0 (id=6549): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0200000004000000080000000100000080"], 0x48) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000080)={r0}, 0x4) bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x16, 0x10, &(0x7f0000000100)=@framed={{0x18, 0x0, 0x0, 0x0, 0xc00d100, 0x0, 0x0, 0x0, 0x100}, [@snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0xb}, {}, {}, {}, {0x7, 0x1, 0xb, 0x4, 0xa, 0x0, 0xb0ffffff}, {}, {}, {0x18, 0x3, 0x2, 0x0, r0}, {}, {0x85, 0x0, 0x0, 0xb6}}]}, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @flow_dissector, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 45.070908244s ago: executing program 0 (id=6550): r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, 0x0, 0x0) bind$inet6(r1, &(0x7f0000000080)={0xa, 0x2, 0x200, @loopback, 0x7}, 0x1c) sendto$inet6(r1, &(0x7f0000000840), 0x0, 0x200080c0, &(0x7f00000001c0)={0xa, 0x2, 0x8000, @loopback, 0x8}, 0x1c) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000140)='cdg', 0x3) sendmmsg$sock(r1, 0x0, 0x0, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$IP6T_SO_SET_REPLACE(r3, 0x29, 0x40, &(0x7f0000000980)=@raw={'raw\x00', 0x8, 0x3, 0x328, 0x148, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x258, 0xffffffff, 0xffffffff, 0x258, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [0x0, 0x0, 0x0, 0xff], [0x0, 0x0, 0x0, 0xffffffff], 'dvmrp0\x00', 'dvmrp1\x00', {}, {}, 0x0, 0xfd, 0x4}, 0x0, 0x120, 0x148, 0x0, {}, [@common=@unspec=@nfacct={{0x48}, {'syz0\x00', 0x6a5f}}, @common=@frag={{0x30}, {[0x2d, 0x200], 0x0, 0x8, 0x2}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00', 0x0, {0x7}}}, {{@uncond, 0x0, 0xa8, 0x110}, @unspec=@CT1={0x68, 'CT\x00', 0x1, {0x10, 0x2, 0x9c, 0x5, 'syz0\x00', 'syz1\x00', {0x159c}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x388) sendmsg$NFT_BATCH(r2, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000001400)=ANY=[@ANYBLOB], 0x78}}, 0x0) bind$inet6(r0, &(0x7f00000000c0)={0xa, 0x4e21, 0xb, @empty}, 0x1c) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e21, 0x0, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x39}}}, 0x1c) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000300)={0x0, @in6={{0xa, 0x0, 0x0, @dev={0xfe, 0x80, '\x00', 0x2c}, 0xfffffffe}}, 0x80000, 0x0, 0x0, 0x0, 0xb3550aa4ba878396}, 0x9c) r4 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r4, 0x0, 0x80, &(0x7f0000000d00)=@nat={'nat\x00', 0x19, 0x1, 0x21e, [0x200000002300, 0x0, 0x0, 0x2000000024be, 0x2000000024ee], 0x20, 0x0, 0x0}, 0x296) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) getsockname$unix(0xffffffffffffffff, 0x0, &(0x7f0000000080)) syz_emit_ethernet(0x1f, &(0x7f0000000280)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaaaa0011aaab63f876976c0cee145e4c67651dcaac1e5461dcf1a4cd6900faeba6bac50a3133dfce8d8bed7a2e14"], 0x0) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f00000002c0)='ns/time_for_children\x00') unshare(0x6a040000) socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$IP_VS_SO_SET_ADD(0xffffffffffffffff, 0x0, 0x482, &(0x7f0000000080)={0x2c, @multicast1, 0x4e23, 0x3, 'sh\x00', 0x2e, 0x20005, 0x3b}, 0x2c) r5 = socket$kcm(0xa, 0x2, 0x0) setsockopt$IP_VS_SO_SET_ADDDEST(0xffffffffffffffff, 0x0, 0x487, &(0x7f0000000000)={{0x84, @private=0xa010102, 0x4e20, 0x3, 'lc\x00', 0x5, 0x8, 0x77}, {@loopback, 0x4e20, 0x10000, 0x2, 0x2}}, 0x44) unshare(0x2010100) sendmsg$sock(r5, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e22, 0x0, @dev}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0) 44.41718675s ago: executing program 2 (id=6553): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x200000000000011, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'bridge0\x00'}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000080)={'bridge_slave_1\x00'}) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'vcan0\x00', 0x0}) r5 = socket(0x2, 0x80805, 0x0) setsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(r5, 0x84, 0xa, &(0x7f0000000400)={0x93de, 0x1, 0x0, 0x3, 0x1ff, 0x7, 0xdff8, 0xb}, 0x20) connect$can_bcm(0xffffffffffffffff, &(0x7f00000000c0)={0x1d, r4}, 0x10) sendmsg$can_bcm(0xffffffffffffffff, 0x0, 0x20040051) sendmsg$nl_route(r1, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x801, 0x0, 0x200000, {0x0, 0x0, 0x0, 0x0, 0x90, 0x800}, [@IFLA_MASTER={0x8}, @IFLA_GROUP={0x8}]}, 0x30}}, 0x4000880) 44.042621606s ago: executing program 2 (id=6554): unshare(0x8040480) socket$nl_generic(0x10, 0x3, 0x10) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300020000000000fbdbdf25fc0000000000000000000000000000000000000000000000000000000000000000000004000100000a0060803b0000", @ANYRES32=0xee01], 0xb8}}, 0x50) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9"], 0xb8}}, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9990000000000000000fc0000000000000001"], 0xb8}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xa, 0xc, &(0x7f0000000040)=ANY=[@ANYRESDEC=r0], 0x0, 0x0, 0x0, 0x0, 0x0, 0x71, '\x00', 0x0, @fallback=0xf, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd}, 0x94) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000000)=ANY=[], 0x134}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x2000c014}, 0x0) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[], 0xb8}, 0x1, 0x0, 0x0, 0x4040095}, 0x40010) sendmsg$nl_xfrm(r3, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="b80000001300e9990000000000000000fc000000000000000000000000000000ac1e00010000000000000000000000fcffffffffffffff000a0040"], 0xb8}, 0x1, 0x0, 0x0, 0x14}, 0x0) 43.870716618s ago: executing program 2 (id=6555): r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r0, 0x107, 0xf, &(0x7f0000000100)=0x207, 0x4) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'ip6tnl0\x00', 0x0}) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFNL_MSG_ACCT_NEW(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000180)={0x38, 0x0, 0x7, 0x201, 0x0, 0x0, {0x1, 0x0, 0x8}, [@NFACCT_BYTES={0xc, 0x3, 0x1, 0x0, 0x8a}, @NFACCT_PKTS={0xc, 0x2, 0x1, 0x0, 0x3}, @NFACCT_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x38}, 0x1, 0x0, 0x0, 0x810}, 0x4004090) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r4, &(0x7f0000000100)={0x40000000, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)={0x2, 0x18, 0x0, 0x0, 0x2}, 0x10}}, 0x0) ioctl$FS_IOC_GETFSSYSFSPATH(r4, 0x80811501, &(0x7f0000000700)={0x80}) sendmsg$nl_route(r3, &(0x7f0000000180)={0x0, 0xfffffffffffffebd, &(0x7f0000000300)={&(0x7f0000000680)=@ipv4_newroute={0x0, 0x18, 0x1, 0x70bd2a, 0x25dfdbfe, {0x2, 0x90, 0x0, 0x4, 0xfd, 0x3, 0xfd, 0x5, 0x200}, [@RTA_DPORT={0x0, 0x1d, 0x4e23}, @RTA_IP_PROTO={0x0, 0x1b, 0x3a}, @RTA_PRIORITY={0x0, 0x6, 0x2}, @RTA_SPORT={0x0, 0x1c, 0x4e21}, @RTA_DPORT={0x0, 0x1d, 0x4e21}]}, 0x2c}, 0x1, 0x0, 0x0, 0x2000c0c1}, 0x40000) sendto$packet(r0, &(0x7f00000002c0)="05031600d3fc140000004788031c09103c28", 0xfce0, 0x4, &(0x7f0000000140)={0x11, 0x86dd, r1, 0x1, 0x0, 0x6, @multicast}, 0x14) ioctl$sock_inet_SIOCSIFADDR(r0, 0x8916, &(0x7f0000000040)={'wlan1\x00', {0x2, 0x4e23, @remote}}) r5 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0x42000, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000000)={'pim6reg1\x00', 0x2}) ioctl$TUNSETLINK(r5, 0x400454cd, 0x306) socket$nl_rdma(0x10, 0x3, 0x14) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000100)={&(0x7f0000000580)=ANY=[@ANYBLOB="9feb01001800000000000000300000003000f6b64a940000040000000000000700000000000000000000000d504fba000002000000000000cc59000000da0800"/78], &(0x7f0000000340)=""/142, 0x4e, 0x8e, 0x1}, 0x28) r6 = socket(0x400000000010, 0x3, 0x0) r7 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r9 = socket$alg(0x26, 0x5, 0x0) bind$alg(r9, &(0x7f0000000140)={0x26, 'hash\x00', 0x0, 0x0, 'cmac(des3_ede-generic)\x00'}, 0x58) close(0x3) sendmsg$nl_route_sched(r6, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffffd, {0x0, 0x0, 0x0, r8, {0x0, 0x1}, {0xffff, 0xffff}, {0xffe0, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000007c0)=@newtfilter={0x45c, 0x2c, 0xd3f, 0x30bd29, 0x25dfdbfd, {0x0, 0x0, 0x0, r8, {0x7, 0xfff3}, {}, {0x7, 0x300}}, [@filter_kind_options=@f_basic={{0xa}, {0x42c, 0x2, [@TCA_BASIC_POLICE={0x428, 0x4, [@TCA_POLICE_PEAKRATE64={0xc, 0x9, 0x6}, @TCA_POLICE_RATE={0x404, 0x2, [0xfffffffc, 0x5, 0xa, 0x0, 0xe043, 0x1ff, 0xa, 0x2, 0x4f, 0x86, 0x7, 0x3b2, 0x9, 0x4, 0xffffffff, 0x8, 0x8000, 0x7, 0xf, 0x4, 0x4, 0xc, 0x0, 0x6, 0x5, 0x0, 0xef, 0x1, 0x6, 0x2, 0xffffffff, 0x2, 0x829, 0xf9f, 0x8, 0x5, 0x1000, 0xf, 0x7, 0x9, 0x5f5, 0xcc, 0xd, 0x16, 0x1, 0x10, 0x5, 0xffff2831, 0x5, 0x4, 0x8, 0x4, 0x81, 0x7fff, 0xdd8c, 0x3, 0x4, 0x800, 0x80, 0xa, 0x10000, 0xdf12, 0x4, 0x8001, 0xaa6, 0xab, 0x5, 0x6, 0x10, 0x2, 0x8000, 0xa, 0x4, 0x8478, 0x6, 0xa10, 0x8, 0x6, 0x2, 0x8, 0x3, 0x5, 0x40, 0x6, 0x0, 0x5, 0x2, 0xc, 0x6, 0x3, 0xe1, 0x80000001, 0x815, 0x7, 0x9, 0xffff4c92, 0xae9b, 0x1, 0x7, 0x6, 0x8, 0x2, 0x1, 0xfffffeff, 0x3ff, 0x8001, 0x4, 0xd, 0x8, 0x4, 0x6, 0x6, 0x9, 0xe653, 0x1b3dbc57, 0x81, 0x4, 0x0, 0x5, 0x3, 0x6, 0xd, 0xcd80, 0xfc9c, 0x56, 0x9, 0xfffffffa, 0x4cc, 0xeb5, 0x9, 0x7c00, 0x13, 0x0, 0xcb5, 0x9, 0x8, 0x1000000, 0x7, 0x8001, 0x3, 0x0, 0xfff, 0xfffffe01, 0x7, 0x7, 0x1ff, 0x2, 0x3ff, 0x401, 0x9, 0x7, 0xa, 0x2, 0x200, 0x0, 0x1ff, 0x7d918ed, 0x0, 0x4, 0x19, 0x5, 0x9, 0x5, 0x1, 0x800, 0x8, 0x8000, 0x7, 0x8, 0x3, 0xffffffa0, 0x6, 0x0, 0xfffffeff, 0xffffffff, 0x3, 0x7, 0x1068, 0x0, 0x6, 0x8, 0x9abb, 0x2, 0x1, 0x4, 0xb1, 0x9, 0x86fd, 0x8, 0x6, 0xf, 0x800, 0x0, 0x8, 0x8, 0x172, 0x7, 0x3, 0x9, 0x3, 0xff, 0x5, 0x3, 0xffff, 0x10001, 0x9, 0x10000, 0x3e, 0x1, 0xffffffff, 0x800, 0x8001, 0x7f, 0x6, 0x8, 0x1, 0x7, 0xfffffff8, 0x80, 0x2, 0xffffffff, 0xdbc, 0xffffffaf, 0x9, 0x8, 0x80, 0x6, 0x0, 0x7ff, 0x8, 0xfff, 0x0, 0x1, 0x0, 0x800, 0x8, 0x9, 0x81, 0x40, 0x9, 0x9, 0x5, 0x4, 0x10, 0x8000001, 0xf19d, 0x6, 0x1, 0x7, 0x0, 0x80, 0x0, 0x14d6, 0xffffffff, 0x0, 0x1]}, @TCA_POLICE_RESULT={0x8, 0x5, 0x2}, @TCA_POLICE_PEAKRATE64={0xc, 0x9, 0x4}]}]}}]}, 0x45c}, 0x1, 0x0, 0x0, 0x4000814}, 0x800) sendmsg$DEVLINK_CMD_TRAP_GET(r3, &(0x7f0000000640)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000600)={&(0x7f0000000480)={0xf8, 0x0, 0x2, 0x70bd2a, 0x25dfdbfb, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x1c}}, {@pci={{0x8}, {0x11}}, {0x1c}}, {@pci={{0x8}, {0x11}}, {0x1c}}, {@pci={{0x8}, {0x11}}, {0x1c}}]}, 0xf8}, 0x1, 0x0, 0x0, 0x20004045}, 0x4000) getsockopt$inet_mreq(r6, 0x0, 0x24, &(0x7f0000000080)={@empty, @remote}, &(0x7f0000000180)=0x8) r10 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r10, 0x10e, 0xc, &(0x7f0000000180)={0x80000020}, 0x10) sendmsg$nl_route(r10, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000280)=@getlink={0x44, 0x12, 0x18efde40b3708357, 0xfffffffd, 0x0, {}, [@IFLA_MAP={0x24, 0xe, {0xd, 0x4d, 0x6, 0x7, 0x6, 0xfa}}]}, 0x44}}, 0x0) 42.277914836s ago: executing program 5 (id=6557): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, 0x0, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000280)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSET={0x58, 0x9, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x2}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0xfffffffc}, @NFTA_SET_EXPR={0x1c, 0x11, 0x0, 0x1, @tunnel={{0xb}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_TUNNEL_KEY={0x8}]}}}]}, @NFT_MSG_NEWFLOWTABLE={0x40, 0x16, 0xa, 0x5, 0x0, 0x0, {0x1, 0x0, 0x1}, [@NFTA_FLOWTABLE_FLAGS={0x8, 0x7, 0x1, 0x0, 0x1}, @NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_FLOWTABLE_FLAGS={0x8}, @NFTA_FLOWTABLE_HOOK={0x4}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0xc0}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) 42.142219038s ago: executing program 5 (id=6558): openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) socket$unix(0x1, 0x2, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(r0, 0x0, 0x275a, 0x0) socket(0x15, 0x5, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, 0x0, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, 0x0, 0x0) socket$netlink(0x10, 0x3, 0x4) socket$key(0xf, 0x3, 0x2) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newtaction={0x70, 0x30, 0x0, 0x70bd28, 0x0, {0x9}, [{0x5c, 0x1, [@m_sample={0x58, 0x23, 0x0, 0x0, {{0xb}, {0x2c, 0x2, 0x0, 0x1, [@TCA_SAMPLE_TRUNC_SIZE={0x8, 0x4, 0xde3}, @TCA_SAMPLE_RATE={0x8}, @TCA_SAMPLE_PARMS={0x18, 0x2, {0x0, 0x0, 0x0, 0x0, 0x80000}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x5}}}}]}]}, 0x70}}, 0x8011) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB="9000000010000305000000000000000000000700", @ANYRES32=0x0, @ANYBLOB="996e06004d4c0700540012800800010068737200480002800500030008000000050003000500000005000300fd00000008000200", @ANYRES32=r3, @ANYBLOB="08000100", @ANYRES32=r4], 0x90}, 0x1, 0x0, 0xa00}, 0x0) 42.061664953s ago: executing program 2 (id=6559): r0 = socket(0x2, 0x2, 0x1) setsockopt$bt_hci_HCI_FILTER(r0, 0x0, 0x2, &(0x7f0000002f00)={0x7, [0x731e, 0x8001], 0x8000}, 0x10) getsockopt$WPAN_SECURITY_LEVEL(r0, 0x0, 0x2, 0x0, &(0x7f0000002fc0)) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='pids.current\x00', 0x275a, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r3, 0x10e, 0xc, &(0x7f0000000000)=0x201, 0x4) sendmsg$nl_route(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000040c0)=ANY=[@ANYBLOB="240000004a00030029bd7000fddbdf250a000000", @ANYRES32=0x0, @ANYBLOB="0000000004"], 0x24}}, 0x40004040) mmap(&(0x7f0000002000/0x3000)=nil, 0x3000, 0x0, 0x12, r2, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r5, 0x0, r6, 0x0, 0xf3a, 0x0) r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$nbd(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NBD_CMD_CONNECT(r7, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB='T\x00\x00\x00', @ANYRES16=r8, @ANYBLOB="01002bbd7000fcdbdf250100000009000a005e5e402d5b00000010000780a1fe018008010100", @ANYRES32, @ANYBLOB="0c00080003000000000000000c00060001000000000000000c0002000100000000000000"], 0x54}, 0x1, 0x0, 0x0, 0x40040}, 0x8c0) write$cgroup_pid(r6, &(0x7f0000000000), 0xffffff98) write$cgroup_devices(r6, &(0x7f0000000080)={'c', ' *:* ', 'rw\x00'}, 0x9) ioctl$F2FS_IOC_COMMIT_ATOMIC_WRITE(0xffffffffffffffff, 0xf502, 0x0) write(r4, 0x0, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000280)=ANY=[@ANYBLOB="3000000040000701feffffff02000000eb7b0000040042800c00018006000603000a00000c00028008001480040015801870121b6deae263f6d0d9a56c9ca9b4569201f937cf307473485ee3e6b0c79fb49e67ae0b843ffe10cd86eac6383788fdb377e26bf3c2"], 0x30}, 0x1, 0x0, 0x0, 0x4048011}, 0x8180) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000040)={'bond_slave_0\x00'}) ioctl$sock_inet6_tcp_SIOCINQ(r2, 0x541b, &(0x7f0000000100)) setsockopt$RXRPC_UPGRADEABLE_SERVICE(r0, 0x110, 0x5, &(0x7f00000001c0)=[0x1, 0x1], 0x2) 41.882967484s ago: executing program 5 (id=6560): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x4e5ef4b7a78df6d, 0x0, 0x0, {0x7}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x4c, 0x9, 0xa, 0x401, 0x0, 0x0, {0x7}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0xd}, @NFTA_SET_DATA_TYPE={0x8, 0x6, 0x1, 0x0, 0xffffff00}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x38}]}, @NFT_MSG_NEWSETELEM={0x4c, 0xc, 0xa, 0x101, 0x0, 0x0, {0x7, 0x0, 0x8}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x20, 0x3, 0x0, 0x1, [{0x1c, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_SET_ELEM_DATA={0x10, 0x2, 0x0, 0x1, [@NFTA_DATA_VERDICT={0xc, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffc}]}]}]}]}]}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x0, 0x84}}}, 0xe0}}, 0x0) accept4(r0, &(0x7f0000000040)=@x25={0x9, @remote}, &(0x7f0000000200)=0x80, 0x80800) (async) r1 = accept4(r0, &(0x7f0000000040)=@x25={0x9, @remote}, &(0x7f0000000200)=0x80, 0x80800) r2 = syz_genetlink_get_family_id$devlink(&(0x7f0000000280), 0xffffffffffffffff) ioctl$sock_inet_udp_SIOCOUTQ(r1, 0x5411, &(0x7f00000002c0)) socket$inet(0x2, 0x2, 0x0) (async) r3 = socket$inet(0x2, 0x2, 0x0) setsockopt$inet_opts(r3, 0x0, 0x4, &(0x7f0000000000)="8907040400", 0x5) (async) setsockopt$inet_opts(r3, 0x0, 0x4, &(0x7f0000000000)="8907040400", 0x5) sendto$inet(r3, 0x0, 0x0, 0x40010, &(0x7f0000000040)={0x2, 0x4e21, @multicast1}, 0x10) sendmsg$DEVLINK_CMD_SB_GET(r1, &(0x7f00000003c0)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000380)={&(0x7f0000000400)=ANY=[@ANYBLOB="8c000000", @ANYRES16=r2, @ANYBLOB="00012abd7000ffdbdf250b0000000e0001006e657464657673696d0000000f0002006e657464657673696d30000008000b00520c00000e0001006e657464657673696d0000000f0002006e657464657673696d30000008000b00060000000e0001006e659a4832ba87abb1da61e941005b148aa47464657673696d0000000f0002006e657464657673696d30000008000b0003000000"], 0x8c}}, 0x4040890) 41.785150952s ago: executing program 5 (id=6561): syz_emit_ethernet(0x3e, &(0x7f0000000000)={@local, @empty, @void, {@ipv4={0x800, @tcp={{0x6, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x6, 0x0, @remote, @local, {[@ra={0x94, 0x4, 0x1}]}}, {{0x4e22, 0x4001, 0x41424344, 0x41424344, 0x0, 0x0, 0x6, 0x2, 0x0, 0x0, 0x0, {[@fastopen={0x22, 0x3, "89"}]}}}}}}}, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000007c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(sm4)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000001280)="b7f2288a911993f08d3aaea2bc0000de", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000002440)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000001a40)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18, 0x4000801}], 0x1, 0x40) recvmmsg(r1, &(0x7f0000000a00)=[{{0x0, 0x0, &(0x7f0000000840)=[{&(0x7f00000028c0)=""/4096, 0x1000}], 0x1}, 0xf}], 0x1, 0x2101, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000300)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x41100, 0xa}, 0x94) r2 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000780)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00'}, 0x94) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907009875f37538e486dd63"], 0xfdef) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r2, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x88be, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newtfilter={0x44, 0x2c, 0xf3f, 0x70bd2a, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, {0xb, 0xfff3}, {}, {0x7, 0x300}}, [@filter_kind_options=@f_basic={{0xa}, {0x14, 0x2, [@TCA_BASIC_EMATCHES={0x10, 0x2, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8}, @TCA_EMATCH_TREE_LIST={0x4}]}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x20041090}, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f000000c280)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000001100000000000a20000000000a01010000000000000000050000080900010073797a30000000005c000000030a03000000000000000000050000000900010073797a30000000000900030073797a300000000008000c40000000032800048008000240000000120800014000000000140004"], 0xa4}}, 0x0) socket(0x2b, 0x1, 0x1) 41.741975891s ago: executing program 4 (id=6562): syz_emit_ethernet(0x3e, &(0x7f0000000000)={@local, @empty, @void, {@ipv4={0x800, @tcp={{0x6, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x6, 0x0, @remote, @local, {[@ra={0x94, 0x4, 0x1}]}}, {{0x4e22, 0x4001, 0x41424344, 0x41424344, 0x0, 0x0, 0x6, 0x2, 0x0, 0x0, 0x0, {[@fastopen={0x22, 0x3, "89"}]}}}}}}}, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000007c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(sm4)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000001280)="b7f2288a911993f08d3aaea2bc0000de", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000002440)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000001a40)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18, 0x4000801}], 0x1, 0x40) recvmmsg(r1, &(0x7f0000000a00)=[{{0x0, 0x0, &(0x7f0000000840)=[{&(0x7f00000028c0)=""/4096, 0x1000}], 0x1}, 0xf}], 0x1, 0x2101, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000300)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x41100, 0xa}, 0x94) r2 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000780)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00'}, 0x94) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907009875f37538e486dd63"], 0xfdef) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r2, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x88be, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f000000c280)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000001100000000000a20000000000a01010000000000000000050000080900010073797a30000000005c000000030a03000000000000000000050000000900010073797a30000000000900030073797a300000000008000c40000000032800048008000240000000120800014000000000140004"], 0xa4}}, 0x0) 40.669058756s ago: executing program 5 (id=6563): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=@delchain={0x24, 0x65, 0x400, 0x70bd29, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, {0x509d884560ba1ba6, 0x3}, {}, {0x8, 0x10}}}, 0x24}}, 0x10) (async) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000100)=@newqdisc={0x44, 0x24, 0x1, 0x70bd28, 0x4, {0x0, 0x0, 0x0, 0x0, {0x8, 0x3}, {0xa, 0x8}, {0xfff1, 0x9}}, [@qdisc_kind_options=@q_fq_pie={{0xb}, {0x14, 0x8002, [@TCA_FQ_PIE_LIMIT={0x0, 0x1, 0x2}, @TCA_FQ_PIE_FLOWS={0x8, 0x2, 0xfe2a}]}}]}, 0x44}}, 0x20004055) (async) sendmmsg$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) (async) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="40008000100037a535e1047d0401000000000000", @ANYRES32=0x0, @ANYBLOB="c30803000b2ebe262000128008000100736974001400028008000300e000000206000f0001000000"], 0x40}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) r1 = socket$kcm(0x10, 0x2, 0x0) sendmsg$IPCTNL_MSG_CT_DELETE(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000300)=ANY=[@ANYBLOB="38000000020101010800000000000000030000001400108008000240000000070800034000000fff1000"], 0x38}}, 0x24000881) (async) sendmsg$IPCTNL_MSG_CT_GET(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000002c0)=ANY=[@ANYBLOB="680000000101010200000000000000000a00000908001a4000010000080015400000496d0c001880080003400000397d38"], 0x68}, 0x1, 0x0, 0x0, 0x4800}, 0x4) (async) sendmsg$kcm(r1, &(0x7f0000000000)={0x0, 0x4, &(0x7f0000000080)=[{&(0x7f0000000200)="2e0400001c008102e00f80ecdb4cb9f207c804a00d00000088081afb0a0002000a0ada1b40d80800c500c50083b8", 0xfec9}], 0x1, 0x0, 0x0, 0x5865}, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x8, 0x32, 0xffffffffffffffff, 0x0) r2 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000001c0)={0x18, 0x27, &(0x7f0000000380)=ANY=[@ANYBLOB="1800000006000000000000004300000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b702000014000000b7030000fffe000085000000550901000000088095000000000000001801000020696c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000020000008500000006000000180100002020752500000000002020207b20f8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7040000070000008500000006000000180100002020692500000000002020207b1af8ff00000000bfa120000000000007010000f8ffffffb702000008000000b70300000f0000008500000006000000bf91000000000000b7020000030000008500000084000000b7000000000500009500"/288], &(0x7f0000000080)='GPL\x00', 0xa, 0xff8, &(0x7f0000000780)=""/4088, 0x41000, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x8000d}, 0x94) (async) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x0) (async) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0300000000000000280012800a00010076786c616e00"], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22cca65c15}, 0x4008840) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket$inet_sctp(0x2, 0x5, 0x84) (async) r5 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r5, 0x84, 0x6f, &(0x7f0000000140)={0x0, 0x1c, &(0x7f0000000240)=[@in6={0xa, 0x4e20, 0x6, @private0={0xfc, 0x0, '\x00', 0x1}, 0x8000}]}, &(0x7f0000000180)=0x10) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r5, 0x84, 0x1d, &(0x7f0000000200)={0x1, [0x0]}, &(0x7f0000000080)=0x8) setsockopt$inet_sctp6_SCTP_RTOINFO(r5, 0x84, 0x0, &(0x7f00000004c0)={r6, 0x3, 0x1000, 0x7fffffff}, 0x10) (async) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r4, 0x84, 0x9, &(0x7f0000000580)={r6, @in6={{0xa, 0x4e24, 0xffffffff, @empty, 0xfffffffc}}, 0x3, 0x0, 0x8, 0x0, 0x21, 0x40, 0xf}, 0x9c) (async) r7 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r7, &(0x7f00000000c0), 0x10) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r3, &(0x7f0000000500)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f00000004c0)={&(0x7f0000000040)={0x3c, 0x3, 0x1, 0x3, 0x0, 0x0, {0x1, 0x0, 0x8}, [@CTA_LABELS_MASK={0x28, 0x17, [0x9, 0x6, 0xfffff801, 0x8, 0x4, 0x101, 0x8001, 0x2, 0xff]}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4000040}, 0x1) sendmsg$can_bcm(r7, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000700)={&(0x7f00000003c0)={0x1, 0x440, 0x0, {0x0, 0x2710}, {0x0, 0xea60}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "a5976ac6ffd41fd8"}}, 0x48}, 0x1, 0x0, 0x0, 0x8800}, 0x410) (async) sendmsg$can_bcm(r7, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000680)={0x1, 0x282, 0xffffffff, {0x77359400}, {}, {}, 0x1, @can={{}, 0x4, 0x3, 0x0, 0x0, "ee6a491530f05065"}}, 0x48}, 0x1, 0x0, 0x0, 0x2000e014}, 0x0) sendmmsg(r3, &(0x7f00000002c0), 0x40000000000009f, 0x0) 40.63274338s ago: executing program 4 (id=6564): unshare(0x8040480) socket$nl_generic(0x10, 0x3, 0x10) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300020000000000fbdbdf25fc0000000000000000000000000000000000000000000000000000000000000000000004000100000a0060803b0000", @ANYRES32=0xee01], 0xb8}}, 0x50) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9"], 0xb8}}, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9990000000000000000fc0000000000000001"], 0xb8}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xa, 0xc, &(0x7f0000000040)=ANY=[@ANYRESDEC=r0], 0x0, 0x0, 0x0, 0x0, 0x0, 0x71, '\x00', 0x0, @fallback=0xf, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd}, 0x94) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000000)=ANY=[], 0x134}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x2000c014}, 0x0) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[], 0xb8}, 0x1, 0x0, 0x0, 0x4040095}, 0x40010) sendmsg$nl_xfrm(r3, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="b80000001300e9990000000000000000fc000000000000000000000000000000ac1e000100000000000000000000000030000000000000000a0040"], 0xb8}, 0x1, 0x0, 0x0, 0x14}, 0x0) 40.561544578s ago: executing program 0 (id=6565): bpf$LINK_GET_NEXT_ID(0x1f, &(0x7f0000000040)={0x5}, 0x8) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='freezer.state\x00', 0x275a, 0x0) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="2fcb", 0x2}], 0x1) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040), 0x200002, 0x0) r2 = openat$cgroup_devices(r1, &(0x7f00000000c0)='devices.deny\x00', 0x2, 0x0) write$cgroup_devices(r2, &(0x7f0000000980)=ANY=[@ANYBLOB='b *:', @ANYRESOCT=r2], 0xe) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, r0, 0x0) getpeername$packet(0xffffffffffffffff, &(0x7f0000000080), &(0x7f0000000380)=0x14) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup.net/syz1\x00', 0x200002, 0x0) r3 = socket(0x400000000010, 0x3, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000740)=@newtfilter={0x60, 0x2c, 0xd27, 0x70bd28, 0x25dfdbfc, {0x0, 0x0, 0x0, r5, {0xfff3, 0x7}, {}, {0x8, 0x1}}, [@filter_kind_options=@f_cgroup={{0xb}, {0x30, 0x2, [@TCA_CGROUP_EMATCHES={0x2c, 0x3, 0x0, 0x1, [@TCA_EMATCH_TREE_LIST={0x20, 0x2, 0x0, 0x1, [@TCF_EM_U32={0x1c, 0x1, 0x0, 0x0, {{0xf700}, {0x4, 0x5, 0x7, 0x2}}}]}, @TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x1}}]}]}}]}, 0x60}, 0x1, 0x0, 0x0, 0x80}, 0x40010) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000440)={r0, r5, 0x25, 0x4, @void}, 0x10) ioctl$XFS_IOC_PATH_TO_FSHANDLE(0xffffffffffffffff, 0xc0385868, &(0x7f00000002c0)={0xffffffffffffffff, &(0x7f00000000c0)='GPL\x00', 0x8c0, &(0x7f0000000100)={@align=0x1, {0xd, 0x4, 0x6, 0x4}}, 0x5, &(0x7f00000001c0)={@_ha_fsid}, &(0x7f0000000240)=0x10001}) ioctl$ifreq_SIOCGIFINDEX_team(r6, 0x8933, &(0x7f0000000300)) r7 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f00000005c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x0, 0x0, 0x2}}, 0x0, 0x1a}, 0x28) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000500)={0x6, 0x3, &(0x7f0000000200)=ANY=[@ANYBLOB="1800000020000000000000000000000095"], &(0x7f0000000280)='GPL\x00', 0x5, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, r7, 0x8, 0x0, 0x0, 0x10, &(0x7f00000004c0), 0x10}, 0x94) syz_emit_ethernet(0x66, &(0x7f0000000140)={@link_local, @remote, @void, {@ipv4={0x800, @gre={{0x5, 0x4, 0x0, 0x0, 0x58, 0x0, 0x0, 0x0, 0x2f, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, @dev={0xac, 0x14, 0x14, 0xff}}, {{}, {}, {}, {0x8, 0x88be, 0x0, {{0x0, 0x1, 0x4}}}}}}}}, 0x0) mmap(&(0x7f000009e000/0x4000)=nil, 0x4000, 0x2800007, 0x8032, 0xffffffffffffffff, 0x0) 40.25447686s ago: executing program 4 (id=6566): syz_emit_ethernet(0x3e, &(0x7f0000000000)={@local, @empty, @void, {@ipv4={0x800, @tcp={{0x6, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x6, 0x0, @remote, @local, {[@ra={0x94, 0x4, 0x1}]}}, {{0x4e22, 0x4001, 0x41424344, 0x41424344, 0x0, 0x0, 0x6, 0x2, 0x0, 0x0, 0x0, {[@fastopen={0x22, 0x3, "89"}]}}}}}}}, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000007c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(sm4)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000001280)="b7f2288a911993f08d3aaea2bc0000de", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000002440)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000001a40)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18, 0x4000801}], 0x1, 0x40) recvmmsg(r1, &(0x7f0000000a00)=[{{0x0, 0x0, &(0x7f0000000840)=[{&(0x7f00000028c0)=""/4096, 0x1000}], 0x1}, 0xf}], 0x1, 0x2101, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000300)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x41100, 0xa}, 0x94) r2 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000780)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00'}, 0x94) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907009875f37538e486dd63"], 0xfdef) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r2, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x88be, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newtfilter={0x44, 0x2c, 0xf3f, 0x70bd2a, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, {0xb, 0xfff3}, {}, {0x7, 0x300}}, [@filter_kind_options=@f_basic={{0xa}, {0x14, 0x2, [@TCA_BASIC_EMATCHES={0x10, 0x2, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8}, @TCA_EMATCH_TREE_LIST={0x4}]}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x20041090}, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f000000c280)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000001100000000000a20000000000a01010000000000000000050000080900010073797a30000000005c000000030a03000000000000000000050000000900010073797a30000000000900030073797a300000000008000c40000000032800048008000240000000120800014000000000140004"], 0xa4}}, 0x0) socket(0x2b, 0x1, 0x1) 40.203429952s ago: executing program 5 (id=6567): bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000000)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x18, 0x18, 0x2, [@restrict, @func_proto]}}, &(0x7f0000001b80)=""/4090, 0x32, 0xffa, 0xa}, 0x28) r0 = socket(0x10, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000180)={'ip6_vti0\x00', &(0x7f0000000240)={'syztnl1\x00', 0x0, 0x0, 0xa5, 0x4, 0x30, 0x46, @private0={0xfc, 0x0, '\x00', 0xfd}, @empty, 0x8000, 0x80, 0x7, 0x1}}) setsockopt$inet_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f0000000080)={@in={{0x2, 0x4e21, @remote}}, 0x0, 0x0, 0x32, 0x0, "99aa4e2c06afbb810e40b2840e6dfa758adcb43f1fdc306235068db20c7fafdbd6c40ef3d8ea3dc9b1caae7df579d91814ebeaeeb37c097c61fa4318a6ed2bc4918a0c34ff627d5e31d3f9f163f6d5bd"}, 0xd8) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f0000000040)={'syztnl1\x00', 0x0}) r1 = syz_init_net_socket$x25(0x9, 0x5, 0x0) ioctl$SIOCX25SFACILITIES(r1, 0x89e3, &(0x7f0000000080)={0x3d, 0x400007e, 0xb, 0x7, 0x203b, 0x8100}) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f00000001c0), r0) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt(r3, 0x84, 0x81, &(0x7f00000002c0), 0x0) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000700)={'wlan1\x00'}) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff) r5 = socket$nl_generic(0x10, 0x3, 0x10) syz_emit_ethernet(0x6a, &(0x7f00000000c0)={@broadcast, @link_local, @void, {@ipv4={0x800, @gre={{0x5, 0x4, 0x3, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x2f, 0x0, @private, @broadcast}, {{0x0, 0x0, 0x1, 0x0, 0x2, 0x0, 0x0, 0x4, 0x22eb, 0x0, 0x0, [0x0]}, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x800, [0x0]}}}}}}, 0x0) sendmsg$IPVS_CMD_NEW_SERVICE(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)={0x4c, r4, 0x1, 0x0, 0x0, {}, [@IPVS_CMD_ATTR_SERVICE={0x38, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_AF={0x6, 0x1, 0x2}, @IPVS_SVC_ATTR_FWMARK={0x8}, @IPVS_SVC_ATTR_FLAGS={0xc}, @IPVS_SVC_ATTR_NETMASK={0x8}, @IPVS_SVC_ATTR_TIMEOUT={0x8}, @IPVS_SVC_ATTR_PE_NAME={0x8, 0x6}]}]}, 0x4c}}, 0x0) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$IP_VS_SO_GET_SERVICES(r6, 0x0, 0x482, &(0x7f0000001640)=""/139, &(0x7f0000000100)=0x8) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r3, 0x84, 0x15, 0x0, 0x0) sendto$inet6(r3, &(0x7f0000000700)="e2", 0x1, 0x40000, 0x0, 0x0) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r0, &(0x7f0000000300)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000200)={0x1c, r2, 0x20, 0x70bd27, 0x25dfdbfe, {}, [@ETHTOOL_A_LINKMODES_MASTER_SLAVE_CFG={0x5, 0x7, 0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000004}, 0x20044880) ioctl$sock_SIOCINQ(0xffffffffffffffff, 0x541b, 0x0) 0s ago: executing program 33 (id=6565): bpf$LINK_GET_NEXT_ID(0x1f, &(0x7f0000000040)={0x5}, 0x8) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='freezer.state\x00', 0x275a, 0x0) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="2fcb", 0x2}], 0x1) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040), 0x200002, 0x0) r2 = openat$cgroup_devices(r1, &(0x7f00000000c0)='devices.deny\x00', 0x2, 0x0) write$cgroup_devices(r2, &(0x7f0000000980)=ANY=[@ANYBLOB='b *:', @ANYRESOCT=r2], 0xe) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, r0, 0x0) getpeername$packet(0xffffffffffffffff, &(0x7f0000000080), &(0x7f0000000380)=0x14) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup.net/syz1\x00', 0x200002, 0x0) r3 = socket(0x400000000010, 0x3, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000740)=@newtfilter={0x60, 0x2c, 0xd27, 0x70bd28, 0x25dfdbfc, {0x0, 0x0, 0x0, r5, {0xfff3, 0x7}, {}, {0x8, 0x1}}, [@filter_kind_options=@f_cgroup={{0xb}, {0x30, 0x2, [@TCA_CGROUP_EMATCHES={0x2c, 0x3, 0x0, 0x1, [@TCA_EMATCH_TREE_LIST={0x20, 0x2, 0x0, 0x1, [@TCF_EM_U32={0x1c, 0x1, 0x0, 0x0, {{0xf700}, {0x4, 0x5, 0x7, 0x2}}}]}, @TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x1}}]}]}}]}, 0x60}, 0x1, 0x0, 0x0, 0x80}, 0x40010) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000440)={r0, r5, 0x25, 0x4, @void}, 0x10) ioctl$XFS_IOC_PATH_TO_FSHANDLE(0xffffffffffffffff, 0xc0385868, &(0x7f00000002c0)={0xffffffffffffffff, &(0x7f00000000c0)='GPL\x00', 0x8c0, &(0x7f0000000100)={@align=0x1, {0xd, 0x4, 0x6, 0x4}}, 0x5, &(0x7f00000001c0)={@_ha_fsid}, &(0x7f0000000240)=0x10001}) ioctl$ifreq_SIOCGIFINDEX_team(r6, 0x8933, &(0x7f0000000300)) r7 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f00000005c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x0, 0x0, 0x2}}, 0x0, 0x1a}, 0x28) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000500)={0x6, 0x3, &(0x7f0000000200)=ANY=[@ANYBLOB="1800000020000000000000000000000095"], &(0x7f0000000280)='GPL\x00', 0x5, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, r7, 0x8, 0x0, 0x0, 0x10, &(0x7f00000004c0), 0x10}, 0x94) syz_emit_ethernet(0x66, &(0x7f0000000140)={@link_local, @remote, @void, {@ipv4={0x800, @gre={{0x5, 0x4, 0x0, 0x0, 0x58, 0x0, 0x0, 0x0, 0x2f, 0x0, @dev={0xac, 0x14, 0x14, 0xe}, @dev={0xac, 0x14, 0x14, 0xff}}, {{}, {}, {}, {0x8, 0x88be, 0x0, {{0x0, 0x1, 0x4}}}}}}}}, 0x0) mmap(&(0x7f000009e000/0x4000)=nil, 0x4000, 0x2800007, 0x8032, 0xffffffffffffffff, 0x0) kernel console output (not intermixed with test programs): 664.093691][T24053] netlink: 16 bytes leftover after parsing attributes in process `syz.2.5655'. [ 664.109958][T24053] veth1_to_team: entered promiscuous mode [ 664.194269][T24053] veth1_to_team: left promiscuous mode [ 664.490685][T24072] netlink: 4 bytes leftover after parsing attributes in process `syz.3.5663'. [ 664.577212][T24075] netlink: 8 bytes leftover after parsing attributes in process `syz.5.5662'. [ 664.587237][T24075] netlink: 8 bytes leftover after parsing attributes in process `syz.5.5662'. [ 665.363634][ T809] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 665.435843][T24109] xt_bpf: check failed: parse error [ 665.595202][T24117] netlink: 'syz.4.5677': attribute type 5 has an invalid length. [ 665.725685][T24126] netlink: 'syz.0.5679': attribute type 7 has an invalid length. [ 665.834193][ T5917] net_ratelimit: 60 callbacks suppressed [ 665.834216][ T5917] bond9: (slave gretap0): failed to get link speed/duplex [ 665.947252][ T5908] bond10: (slave gretap0): failed to get link speed/duplex [ 665.962593][ T5917] bond15: (slave gretap0): failed to get link speed/duplex [ 666.044272][ T5917] bond9: (slave gretap0): failed to get link speed/duplex [ 666.104339][ T5917] bond10: (slave gretap0): failed to get link speed/duplex [ 666.228471][T24144] 8021q: adding VLAN 0 to HW filter on device bond0 [ 666.293297][ T5917] bond7: (slave gretap0): link status up again after 0 ms [ 666.333530][T13549] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 666.343162][T24144] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 666.344204][ T5917] bond7: (slave gretap0): link status up again after 0 ms [ 666.439689][T24151] xt_bpf: check failed: parse error [ 666.447147][ T36] bond7: (slave gretap0): link status up again after 0 ms [ 666.493163][ T36] bond7: (slave gretap0): link status up again after 0 ms [ 666.504305][T24156] netlink: 'syz.2.5690': attribute type 16 has an invalid length. [ 666.533400][T24156] netlink: 'syz.2.5690': attribute type 17 has an invalid length. [ 666.544567][T24144] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 666.553114][ T48] bond7: (slave gretap0): link status up again after 0 ms [ 666.574564][T24144] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 666.595048][ T5901] bridge0: port 1(bridge_slave_0) entered blocking state [ 666.602242][ T5901] bridge0: port 1(bridge_slave_0) entered forwarding state [ 666.632712][ T5901] bridge0: port 2(bridge_slave_1) entered blocking state [ 666.639910][ T5901] bridge0: port 2(bridge_slave_1) entered forwarding state [ 666.858448][ T5755] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 667.377957][T24190] xt_bpf: check failed: parse error [ 667.456746][T24182] bridge0: port 1(bridge_slave_0) entered disabled state [ 667.560218][T24182] bridge_slave_0 (unregistering): left allmulticast mode [ 667.577656][T24182] bridge_slave_0 (unregistering): left promiscuous mode [ 667.589636][T24200] xt_hashlimit: size too large, truncated to 1048576 [ 667.597003][T24182] bridge0: port 1(bridge_slave_0) entered disabled state [ 667.725779][T24205] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 667.773110][T24206] x_tables: ip6_tables: TCPMSS target: only valid for protocol 6 [ 667.859204][T13585] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 668.111489][T24210] 8021q: adding VLAN 0 to HW filter on device bond11 [ 668.219032][T24220] sctp: [Deprecated]: syz.0.5711 (pid 24220) Use of int in maxseg socket option. [ 668.219032][T24220] Use struct sctp_assoc_value instead [ 668.254591][T24217] bond11: (slave veth7): Enslaving as an active interface with an up link [ 668.290019][T24210] bond11: (slave bridge5): Enslaving as an active interface with an up link [ 668.333195][T24224] __nla_validate_parse: 74 callbacks suppressed [ 668.333218][T24224] netlink: 20 bytes leftover after parsing attributes in process `syz.3.5713'. [ 668.489700][T24232] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5717'. [ 668.490224][T24229] netlink: 28 bytes leftover after parsing attributes in process `syz.0.5715'. [ 668.499003][T24233] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5717'. [ 668.516998][T24229] netlink: 'syz.0.5715': attribute type 7 has an invalid length. [ 668.536072][T24229] netlink: 'syz.0.5715': attribute type 8 has an invalid length. [ 668.546095][T24229] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5715'. [ 668.589426][T24226] ip6tnl1: entered allmulticast mode [ 668.616268][T24235] xt_hashlimit: size too large, truncated to 1048576 [ 668.765446][T24240] x_tables: ip6_tables: TCPMSS target: only valid for protocol 6 [ 669.271559][T24252] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5724'. [ 669.502322][T24261] ip6tnl2: entered allmulticast mode [ 669.961255][T24284] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5733'. [ 670.142548][T24277] tipc: Enabling of bearer rejected, failed to enable media [ 670.152260][T24277] tipc: Enabling of bearer rejected, failed to enable media [ 670.197751][T24277] tipc: Enabling of bearer rejected, failed to enable media [ 670.254401][T24296] netlink: 'syz.4.5735': attribute type 1 has an invalid length. [ 670.494375][T24311] netlink: 'syz.0.5742': attribute type 1 has an invalid length. [ 670.638525][T24311] 8021q: adding VLAN 0 to HW filter on device bond8 [ 670.688264][T24311] bond7: (slave gretap0): Removing an active aggregator [ 670.692103][T24318] netlink: 'syz.5.5744': attribute type 1 has an invalid length. [ 670.703854][T24311] bond7: (slave gretap0): Releasing backup interface [ 670.717265][T24311] bond8: (slave gretap0): Enslaving as a backup interface with an up link [ 670.801845][T24318] 8021q: adding VLAN 0 to HW filter on device bond1 [ 670.832782][ T5912] net_ratelimit: 93 callbacks suppressed [ 670.832802][ T5912] bond8: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 670.867873][T24322] bond1: (slave gretap0): Enslaving as a backup interface with an up link [ 670.918432][ T5901] bond1: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 670.998942][T24328] batadv_slave_1: entered promiscuous mode [ 671.017290][ T180] bond1: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 671.056482][ T36] bond8: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 671.148520][T24326] lo speed is unknown, defaulting to 1000 [ 671.340059][ T36] bond7: (slave gretap0): failed to get link speed/duplex [ 671.363890][T24325] batadv_slave_1: left promiscuous mode [ 671.537541][T24348] netlink: 4 bytes leftover after parsing attributes in process `syz.5.5755'. [ 671.553012][ T5908] bond7: (slave gretap0): failed to get link speed/duplex [ 671.665611][T24360] netlink: 48 bytes leftover after parsing attributes in process `syz.0.5760'. [ 671.675346][T24360] netlink: 16 bytes leftover after parsing attributes in process `syz.0.5760'. [ 671.687732][ T5901] bond10: (slave gretap0): failed to get link speed/duplex [ 671.762678][ T5917] bond7: (slave gretap0): failed to get link speed/duplex [ 671.827806][T13549] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 671.863169][T24363] netlink: 'syz.3.5761': attribute type 1 has an invalid length. [ 671.954848][T24362] bond7: (slave gretap0): Removing an active aggregator [ 671.962561][T24362] bond7: (slave gretap0): Releasing backup interface [ 672.164961][T24382] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 672.271223][ T36] bond15: (slave gretap0): failed to get link speed/duplex [ 672.741618][T24407] netlink: 'syz.3.5776': attribute type 10 has an invalid length. [ 672.750432][T24408] xt_hashlimit: size too large, truncated to 1048576 [ 672.825640][T24411] x_tables: ip6_tables: TCPMSS target: only valid for protocol 6 [ 673.359504][T24407] geneve1: left promiscuous mode [ 673.434029][T24407] bond0: (slave geneve1): Releasing backup interface [ 673.454444][ T180] netdevsim netdevsim2 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 673.463684][ T180] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 673.472843][ T180] netdevsim netdevsim2 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 673.481840][ T180] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 673.539512][ T180] netdevsim netdevsim2 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 673.563835][ T180] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 673.593061][ T180] netdevsim netdevsim2 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 673.627966][ T180] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 673.658638][ T180] netdevsim netdevsim3 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 673.701268][ T180] netdevsim netdevsim3 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 673.711920][ T180] netdevsim netdevsim3 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 673.749166][ T180] netdevsim netdevsim3 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 673.883788][T24433] bond15: (slave gretap0): Removing an active aggregator [ 673.903576][T24433] bond15: (slave gretap0): Releasing backup interface [ 673.935555][T24439] FAULT_INJECTION: forcing a failure. [ 673.935555][T24439] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 673.973371][T24439] CPU: 1 UID: 0 PID: 24439 Comm: syz.0.5782 Not tainted syzkaller #0 PREEMPT(full) [ 673.973403][T24439] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 673.973417][T24439] Call Trace: [ 673.973427][T24439] [ 673.973436][T24439] dump_stack_lvl+0xe8/0x150 [ 673.973469][T24439] should_fail_ex+0x412/0x560 [ 673.973500][T24439] _copy_from_iter+0x1d3/0x1670 [ 673.973529][T24439] ? rcu_is_watching+0x15/0xb0 [ 673.973563][T24439] ? __pfx__copy_from_iter+0x10/0x10 [ 673.973597][T24439] ? netlink_sendmsg+0x650/0xb40 [ 673.973624][T24439] ? skb_put+0x11b/0x210 [ 673.973652][T24439] netlink_sendmsg+0x6c0/0xb40 [ 673.973696][T24439] ? __pfx_netlink_sendmsg+0x10/0x10 [ 673.973728][T24439] ? aa_sock_msg_perm+0xf1/0x1b0 [ 673.973764][T24439] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 673.973800][T24439] ____sys_sendmsg+0x972/0x9f0 [ 673.973826][T24439] ? __might_fault+0xaf/0x130 [ 673.973863][T24439] ? __pfx_____sys_sendmsg+0x10/0x10 [ 673.973900][T24439] ? import_iovec+0x73/0xa0 [ 673.973931][T24439] ___sys_sendmsg+0x2a5/0x360 [ 673.973956][T24439] ? __lock_acquire+0x6b5/0x2cf0 [ 673.973985][T24439] ? __pfx____sys_sendmsg+0x10/0x10 [ 673.974050][T24439] ? __fget_files+0x2a/0x420 [ 673.974076][T24439] ? __fget_files+0x3a0/0x420 [ 673.974119][T24439] __x64_sys_sendmsg+0x1bd/0x2a0 [ 673.974150][T24439] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 673.974187][T24439] ? __pfx_ksys_write+0x10/0x10 [ 673.974242][T24439] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 673.974266][T24439] do_syscall_64+0x174/0x580 [ 673.974290][T24439] ? trace_irq_disable+0x3b/0x140 [ 673.974323][T24439] ? clear_bhb_loop+0x40/0x90 [ 673.974350][T24439] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 673.974390][T24439] RIP: 0033:0x7f02bfb9ce59 [ 673.974411][T24439] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 673.974431][T24439] RSP: 002b:00007f02c0b10028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 673.974455][T24439] RAX: ffffffffffffffda RBX: 00007f02bfe16090 RCX: 00007f02bfb9ce59 [ 673.974472][T24439] RDX: 0000000002000800 RSI: 0000200000000000 RDI: 0000000000000006 [ 673.974487][T24439] RBP: 00007f02c0b10090 R08: 0000000000000000 R09: 0000000000000000 [ 673.974501][T24439] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 673.974514][T24439] R13: 00007f02bfe16128 R14: 00007f02bfe16090 R15: 00007ffee25838c8 [ 673.974548][T24439] [ 674.366930][T24447] bridge0: port 3(syz_tun) entered blocking state [ 674.395396][T24447] bridge0: port 3(syz_tun) entered disabled state [ 674.415508][T24447] syz_tun: entered allmulticast mode [ 674.455966][T24447] syz_tun: entered promiscuous mode [ 674.517648][T24447] bridge0: port 3(syz_tun) entered blocking state [ 674.524346][T24447] bridge0: port 3(syz_tun) entered forwarding state [ 674.569620][T24457] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 674.640717][T24461] netlink: 'syz.3.5792': attribute type 1 has an invalid length. [ 674.751828][T24461] 8021q: adding VLAN 0 to HW filter on device bond8 [ 674.810299][T24469] netlink: 'syz.5.5793': attribute type 1 has an invalid length. [ 674.819685][T24467] bond8: (slave gretap0): Enslaving as a backup interface with an up link [ 674.952956][T24469] 8021q: adding VLAN 0 to HW filter on device bond2 [ 675.005838][T24471] bond1: (slave gretap0): Removing an active aggregator [ 675.034084][T24471] bond1: (slave gretap0): Releasing backup interface [ 675.071897][T24471] bond2: (slave gretap0): Enslaving as an active interface with an up link [ 675.215200][T24486] xt_hashlimit: size too large, truncated to 1048576 [ 675.288741][T24491] x_tables: ip6_tables: TCPMSS target: only valid for protocol 6 [ 675.371734][T24490] lo speed is unknown, defaulting to 1000 [ 675.484699][T24496] __nla_validate_parse: 1 callbacks suppressed [ 675.484721][T24496] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5801'. [ 675.570648][T24502] netlink: 'syz.5.5803': attribute type 61 has an invalid length. [ 675.936867][ T48] net_ratelimit: 41 callbacks suppressed [ 675.936889][ T48] bond9: (slave gretap0): failed to get link speed/duplex [ 675.989471][T24517] netlink: 'syz.4.5807': attribute type 13 has an invalid length. [ 676.022157][T24517] netlink: 'syz.4.5807': attribute type 17 has an invalid length. [ 676.032240][ T48] bond10: (slave gretap0): failed to get link speed/duplex [ 676.052798][T24517] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5807'. [ 676.093345][ T5367] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 676.123878][ T48] bond9: (slave gretap0): failed to get link speed/duplex [ 676.163014][ T48] bond10: (slave gretap0): failed to get link speed/duplex [ 676.188239][T24526] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 676.242755][ T5901] bond9: (slave gretap0): failed to get link speed/duplex [ 676.295327][ T36] bond10: (slave gretap0): failed to get link speed/duplex [ 676.354380][ T36] bond9: (slave gretap0): failed to get link speed/duplex [ 676.433542][ T36] bond10: (slave gretap0): failed to get link speed/duplex [ 676.482936][ T36] bond9: (slave gretap0): failed to get link speed/duplex [ 676.606464][T24535] netlink: 16 bytes leftover after parsing attributes in process `syz.2.5814'. [ 676.748555][T24537] bond8: (slave gretap0): Removing an active aggregator [ 676.759272][T24537] bond8: (slave gretap0): Releasing backup interface [ 676.843464][T24542] sctp: [Deprecated]: syz.5.5816 (pid 24542) Use of int in max_burst socket option. [ 676.843464][T24542] Use struct sctp_assoc_value instead [ 677.008517][T24547] xt_hashlimit: size too large, truncated to 1048576 [ 677.039973][T24548] x_tables: ip6_tables: TCPMSS target: only valid for protocol 6 [ 677.341967][T24562] netlink: 28 bytes leftover after parsing attributes in process `syz.4.5824'. [ 677.439878][T24563] netlink: 36 bytes leftover after parsing attributes in process `syz.4.5824'. [ 678.083318][T24599] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 678.261272][T24608] xt_hashlimit: size too large, truncated to 1048576 [ 678.316487][T24612] x_tables: ip6_tables: TCPMSS target: only valid for protocol 6 [ 678.480709][T13586] hsr0: entered promiscuous mode [ 678.501357][T24616] netlink: 4 bytes leftover after parsing attributes in process `syz.5.5841'. [ 678.815931][T24625] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 679.086975][T24638] FAULT_INJECTION: forcing a failure. [ 679.086975][T24638] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 679.143053][T24638] CPU: 0 UID: 0 PID: 24638 Comm: syz.4.5848 Not tainted syzkaller #0 PREEMPT(full) [ 679.143084][T24638] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 679.143098][T24638] Call Trace: [ 679.143107][T24638] [ 679.143118][T24638] dump_stack_lvl+0xe8/0x150 [ 679.143157][T24638] should_fail_ex+0x412/0x560 [ 679.143188][T24638] _copy_to_user+0x31/0xb0 [ 679.143219][T24638] simple_read_from_buffer+0xe1/0x170 [ 679.143254][T24638] proc_fail_nth_read+0x1bb/0x230 [ 679.143289][T24638] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 679.143322][T24638] ? rw_verify_area+0x2a6/0x4d0 [ 679.143354][T24638] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 679.143386][T24638] vfs_read+0x20c/0xa70 [ 679.143425][T24638] ? __pfx___mutex_lock+0x10/0x10 [ 679.143453][T24638] ? __pfx_vfs_read+0x10/0x10 [ 679.143487][T24638] ? __fget_files+0x2a/0x420 [ 679.143519][T24638] ? __fget_files+0x3a0/0x420 [ 679.143546][T24638] ? __fget_files+0x2a/0x420 [ 679.143584][T24638] ksys_read+0x150/0x270 [ 679.143619][T24638] ? __pfx_ksys_read+0x10/0x10 [ 679.143662][T24638] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 679.143687][T24638] do_syscall_64+0x174/0x580 [ 679.143711][T24638] ? trace_irq_disable+0x3b/0x140 [ 679.143746][T24638] ? clear_bhb_loop+0x40/0x90 [ 679.143774][T24638] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 679.143797][T24638] RIP: 0033:0x7fc60135d68e [ 679.143818][T24638] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 679.143838][T24638] RSP: 002b:00007fc602194fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 679.143862][T24638] RAX: ffffffffffffffda RBX: 00007fc6021956c0 RCX: 00007fc60135d68e [ 679.143879][T24638] RDX: 000000000000000f RSI: 00007fc6021950a0 RDI: 0000000000000007 [ 679.143893][T24638] RBP: 00007fc602195090 R08: 0000000000000000 R09: 0000000000000000 [ 679.143907][T24638] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 679.143921][T24638] R13: 00007fc601616038 R14: 00007fc601615fa0 R15: 00007ffce4f494b8 [ 679.143957][T24638] [ 679.460257][T24648] netlink: 44 bytes leftover after parsing attributes in process `syz.5.5853'. [ 679.498032][T24648] netlink: 44 bytes leftover after parsing attributes in process `syz.5.5853'. [ 679.518292][T24642] x_tables: ip_tables: ah match: only valid for protocol 51 [ 679.554741][T24648] netlink: 24 bytes leftover after parsing attributes in process `syz.5.5853'. [ 679.595140][T24651] bond8: (slave gretap0): Removing an active aggregator [ 679.595931][T24655] xt_hashlimit: size too large, truncated to 1048576 [ 679.628199][T24651] bond8: (slave gretap0): Releasing backup interface [ 679.679715][T24657] x_tables: ip6_tables: TCPMSS target: only valid for protocol 6 [ 679.720324][T24651] bond3: (slave syz_tun): Removing an active aggregator [ 679.746305][T24653] netlink: 12 bytes leftover after parsing attributes in process `syz.5.5853'. [ 679.756947][T24651] bond3: (slave syz_tun): Releasing backup interface [ 679.814133][T24651] bridge_slave_0: left allmulticast mode [ 679.822704][T24651] bridge_slave_0: left promiscuous mode [ 679.828693][T24651] bridge0: port 1(bridge_slave_0) entered disabled state [ 679.845496][T24651] bridge_slave_1: left allmulticast mode [ 679.875287][T24651] bridge_slave_1: left promiscuous mode [ 679.889424][T24651] bridge0: port 2(bridge_slave_1) entered disabled state [ 679.928671][T24651] bond0: (slave bond_slave_0): Releasing backup interface [ 679.976363][T24651] bond0: (slave bond_slave_1): Releasing backup interface [ 680.007972][T24651] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 680.026360][T24651] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 680.055900][T24651] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 680.063545][T24651] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 680.627654][T24691] __nla_validate_parse: 5 callbacks suppressed [ 680.627676][T24691] netlink: 20 bytes leftover after parsing attributes in process `syz.3.5868'. [ 680.679830][T24685] netlink: 148 bytes leftover after parsing attributes in process `syz.5.5866'. [ 680.807010][T24700] netlink: 28 bytes leftover after parsing attributes in process `syz.2.5869'. [ 680.843396][T24700] netlink: 'syz.2.5869': attribute type 7 has an invalid length. [ 680.873236][T24700] netlink: 'syz.2.5869': attribute type 8 has an invalid length. [ 680.899268][T24700] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5869'. [ 680.973132][T19362] Bluetooth: hci0: Opcode 0x0c03 failed: -110 [ 681.019574][T24710] net_ratelimit: 69 callbacks suppressed [ 681.019595][T24710] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 681.035846][ T5917] bond10: (slave gretap0): failed to get link speed/duplex [ 681.072776][ T5908] bond9: (slave gretap0): failed to get link speed/duplex [ 681.148221][T24713] netlink: 116 bytes leftover after parsing attributes in process `syz.4.5875'. [ 681.179666][T24710] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 681.190229][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 681.201314][T24710] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 681.226020][T24716] nicvf0: tun_chr_ioctl cmd 1074025677 [ 681.242185][T24716] nicvf0: linktype set to 780 [ 681.251878][T24710] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 681.263350][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 681.273559][T24710] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 681.283656][T24710] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 681.297649][T24721] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5878'. [ 681.327329][T24706] lo speed is unknown, defaulting to 1000 [ 681.571003][T24730] bond11: (slave veth7): Releasing backup interface [ 681.584649][T24730] bond11: (slave veth7): the permanent HWaddr of slave - b2:83:55:7c:85:f6 - is still in use by bond - set the HWaddr of slave to a different address to avoid conflicts [ 681.611407][T24730] bond11: (slave bridge5): Releasing backup interface [ 681.644167][T24727] netlink: 'syz.4.5880': attribute type 17 has an invalid length. [ 681.860566][T24742] netlink: 28 bytes leftover after parsing attributes in process `syz.0.5887'. [ 681.892383][T24744] netlink: 15 bytes leftover after parsing attributes in process `syz.4.5888'. [ 681.913769][T24742] netlink: 'syz.0.5887': attribute type 7 has an invalid length. [ 681.942474][T24742] netlink: 'syz.0.5887': attribute type 8 has an invalid length. [ 681.984085][T24742] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5887'. [ 682.089117][T24745] netlink: 'syz.3.5886': attribute type 1 has an invalid length. [ 682.230387][T24745] 8021q: adding VLAN 0 to HW filter on device bond9 [ 682.452068][T24767] netlink: 'syz.0.5894': attribute type 1 has an invalid length. [ 682.464565][T24769] IPVS: set_ctl: invalid protocol: 43 255.255.255.255:20000 [ 682.524844][T24773] bond2: (slave gretap0): Removing an active aggregator [ 682.537289][T24773] bond2: (slave gretap0): Releasing backup interface [ 682.559731][T24773] syz_tun: left allmulticast mode [ 682.588484][T24773] syz_tun: left promiscuous mode [ 682.604761][T24773] bridge0: port 3(syz_tun) entered disabled state [ 682.632906][T24773] bridge_slave_0: left allmulticast mode [ 682.639000][T24773] bridge_slave_0: left promiscuous mode [ 682.647714][T24773] bridge0: port 1(bridge_slave_0) entered disabled state [ 682.662414][T24773] bridge_slave_1: left allmulticast mode [ 682.669989][T24773] bridge_slave_1: left promiscuous mode [ 682.676045][T24773] bridge0: port 2(bridge_slave_1) entered disabled state [ 682.699967][T24773] bond0: (slave bond_slave_0): Releasing backup interface [ 682.747333][T24773] bond0: (slave bond_slave_1): Releasing backup interface [ 682.789216][T24773] team0: Port device team_slave_0 removed [ 682.816756][T24773] team0: Port device team_slave_1 removed [ 682.842225][T24773] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 682.856197][T24773] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 682.869168][T24773] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 682.878383][T24773] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 683.172106][T24793] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5906'. [ 683.209838][T24796] netlink: 'syz.2.5905': attribute type 7 has an invalid length. [ 683.230987][T24796] netlink: 'syz.2.5905': attribute type 8 has an invalid length. [ 683.264691][T24798] syzkaller1: entered promiscuous mode [ 683.284051][T24798] syzkaller1: entered allmulticast mode [ 684.084093][T24824] bridge0: port 2(bridge_slave_1) entered disabled state [ 684.275755][ T10] lo speed is unknown, defaulting to 1000 [ 684.283074][ T5908] netdevsim netdevsim0 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 684.296512][ T10] syz2: Port: 1 Link DOWN [ 684.302923][ T5908] netdevsim netdevsim0 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 684.323047][ T5908] netdevsim netdevsim0 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 684.359847][ T5908] netdevsim netdevsim0 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 684.436294][T24841] xt_hashlimit: size too large, truncated to 1048576 [ 684.490514][T24846] x_tables: ip6_tables: TCPMSS target: only valid for protocol 6 [ 684.551572][T24847] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 684.640237][T24845] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 684.877319][T24863] netlink: 'syz.5.5924': attribute type 6 has an invalid length. [ 685.693275][T19362] Bluetooth: hci2: command 0x0405 tx timeout [ 686.022769][T24900] net_ratelimit: 252 callbacks suppressed [ 686.022791][T24900] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 686.039123][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 686.058479][T24900] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 686.067015][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 686.087432][T24900] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 686.096226][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 686.102193][T24903] IPVS: set_ctl: invalid protocol: 137 172.20.20.170:20004 [ 686.114384][T24900] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 686.122853][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 686.131334][T24900] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 686.139870][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 686.481051][T24905] syzkaller0: entered promiscuous mode [ 686.505600][T24905] syzkaller0: entered allmulticast mode [ 686.607868][T24925] xt_hashlimit: size too large, truncated to 1048576 [ 686.642510][T24929] x_tables: ip6_tables: TCPMSS target: only valid for protocol 6 [ 686.860660][T24937] __nla_validate_parse: 8 callbacks suppressed [ 686.860684][T24937] netlink: 24 bytes leftover after parsing attributes in process `syz.0.5946'. [ 687.311512][T24950] bond3: (slave lo): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 687.356520][T24950] bond3: (slave lo): Enslaving as an active interface with an up link [ 687.489844][T24960] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5954'. [ 687.520583][T24960] netlink: 20 bytes leftover after parsing attributes in process `syz.2.5954'. [ 687.598676][T24969] netlink: 8 bytes leftover after parsing attributes in process `syz.5.5957'. [ 687.654936][T24971] netlink: 12 bytes leftover after parsing attributes in process `syz.5.5957'. [ 687.795120][T24971] ipvlan2: entered allmulticast mode [ 687.821609][T24971] batadv0: entered allmulticast mode [ 687.848353][T24971] 8021q: adding VLAN 0 to HW filter on device ipvlan2 [ 687.890616][T24980] xt_hashlimit: size too large, truncated to 1048576 [ 687.930602][T24984] x_tables: ip6_tables: TCPMSS target: only valid for protocol 6 [ 688.058882][T24988] netlink: 'syz.0.5963': attribute type 4 has an invalid length. [ 688.536179][T25009] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5969'. [ 688.950924][T25011] xfrm1: entered allmulticast mode [ 689.291411][T25043] xt_hashlimit: size too large, truncated to 1048576 [ 689.310963][T25040] netlink: 16 bytes leftover after parsing attributes in process `syz.4.5980'. [ 689.378859][T25048] x_tables: ip6_tables: TCPMSS target: only valid for protocol 6 [ 689.601131][T25057] bridge_slave_1: entered promiscuous mode [ 689.901343][T25064] netlink: 'syz.2.5987': attribute type 1 has an invalid length. [ 689.935572][T25064] netlink: 'syz.2.5987': attribute type 2 has an invalid length. [ 690.037557][T25069] netlink: 11562 bytes leftover after parsing attributes in process `syz.0.5989'. [ 690.055585][T25070] netlink: 4 bytes leftover after parsing attributes in process `syz.3.5990'. [ 690.078680][T25069] netlink: 1047 bytes leftover after parsing attributes in process `syz.0.5989'. [ 690.115616][T25069] veth0_to_bond: default FDB implementation only supports local addresses [ 690.515905][T25093] xt_hashlimit: size too large, truncated to 1048576 [ 690.540999][T25097] x_tables: ip6_tables: TCPMSS target: only valid for protocol 6 [ 690.654940][T25100] netlink: 'syz.3.6002': attribute type 10 has an invalid length. [ 690.798485][T25106] veth0: entered promiscuous mode [ 691.412985][ T180] net_ratelimit: 438 callbacks suppressed [ 691.413007][ T180] bond10: (slave gretap0): failed to get link speed/duplex [ 691.434589][ T5912] bond9: (slave gretap0): failed to get link speed/duplex [ 691.443550][T25131] netlink: 'syz.5.6010': attribute type 7 has an invalid length. [ 691.472672][T25131] netlink: 'syz.5.6010': attribute type 8 has an invalid length. [ 691.516759][T25131] team0: entered promiscuous mode [ 691.534646][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 691.555179][T25131] bond0: entered promiscuous mode [ 691.565852][T25131] erspan0: entered promiscuous mode [ 691.573006][T25131] hsr0: Slave A (team0) is not up; please bring it up to get a fully working HSR network [ 691.592827][T25131] hsr0: Slave B (bond0) is not up; please bring it up to get a fully working HSR network [ 691.605079][T25131] 8021q: adding VLAN 0 to HW filter on device hsr0 [ 691.703939][ T180] bond10: (slave gretap0): failed to get link speed/duplex [ 691.724116][ T180] bond9: (slave gretap0): failed to get link speed/duplex [ 691.827148][T25139] netlink: 'syz.0.6012': attribute type 1 has an invalid length. [ 691.921190][T25149] netlink: 'syz.5.6014': attribute type 11 has an invalid length. [ 692.030387][T25139] 8021q: adding VLAN 0 to HW filter on device bond10 [ 692.113732][ T36] bond9: (slave gretap0): failed to get link speed/duplex [ 692.133026][ T36] bond10: (slave gretap0): failed to get link speed/duplex [ 692.233746][ T36] bond9: (slave gretap0): failed to get link speed/duplex [ 692.284505][ T5917] bond10: (slave gretap0): failed to get link speed/duplex [ 692.311816][T25162] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 692.462917][ T180] bond10: (slave gretap0): failed to get link speed/duplex [ 692.550323][T25168] syzkaller0: entered promiscuous mode [ 692.563497][T25168] syzkaller0: entered allmulticast mode [ 692.998494][ T30] audit: type=1804 audit(1780937123.207:7): pid=25194 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.3.6024" name="/newroot/522/memory.events" dev="tmpfs" ino=2667 res=1 errno=0 [ 693.276451][ T180] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 693.294237][ T180] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 694.200277][T25231] __nla_validate_parse: 7 callbacks suppressed [ 694.200298][T25231] netlink: 12 bytes leftover after parsing attributes in process `syz.2.6041'. [ 694.395071][T25235] netlink: 72 bytes leftover after parsing attributes in process `syz.0.6043'. [ 694.415625][T25235] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6043'. [ 694.425586][T25235] netdevsim netdevsim0 netdevsim0: entered promiscuous mode [ 694.439772][T25235] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 694.467093][T25235] netlink: 12 bytes leftover after parsing attributes in process `syz.0.6043'. [ 694.775015][T25246] syzkaller1: entered promiscuous mode [ 694.792500][T25246] syzkaller1: entered allmulticast mode [ 694.863892][T25260] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6050'. [ 694.946241][T25261] Bluetooth: MGMT ver 1.23 [ 695.127932][T25268] netlink: 'syz.3.6052': attribute type 1 has an invalid length. [ 695.181888][T25268] netlink: 28 bytes leftover after parsing attributes in process `syz.3.6052'. [ 695.627880][T19164] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 695.643602][T19164] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 695.655571][T19164] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 695.670031][T19164] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 695.681567][T19164] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 695.938151][ T48] wlan1: Trigger new scan to find an IBSS to join [ 696.171689][T25312] netlink: 28 bytes leftover after parsing attributes in process `syz.5.6065'. [ 696.199122][T25312] netlink: 'syz.5.6065': attribute type 7 has an invalid length. [ 696.226549][T25312] netlink: 'syz.5.6065': attribute type 8 has an invalid length. [ 696.260723][T25312] netlink: 4 bytes leftover after parsing attributes in process `syz.5.6065'. [ 696.405301][T25322] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6067'. [ 696.451770][T25322] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6067'. [ 696.476343][ T180] net_ratelimit: 60 callbacks suppressed [ 696.476366][ T180] bond10: (slave gretap0): failed to get link speed/duplex [ 696.532815][ T5917] bond9: (slave gretap0): failed to get link speed/duplex [ 696.620341][T25289] lo speed is unknown, defaulting to 1000 [ 696.712713][ T5917] bond9: (slave gretap0): failed to get link speed/duplex [ 696.752716][ T48] bond10: (slave gretap0): failed to get link speed/duplex [ 696.892840][ T180] bond10: (slave gretap0): failed to get link speed/duplex [ 696.944196][ T5917] bond9: (slave gretap0): failed to get link speed/duplex [ 697.052777][T19362] Bluetooth: hci2: Opcode 0x0401 failed: -110 [ 697.063216][T19164] Bluetooth: hci2: command 0x0405 tx timeout [ 697.157211][T25350] openvswitch: netlink: nsh attribute has 4 unknown bytes. [ 697.170287][T25350] netlink: 'syz.3.6072': attribute type 1 has an invalid length. [ 697.182765][T25350] netlink: 'syz.3.6072': attribute type 2 has an invalid length. [ 697.220420][T25289] bridge0: port 1(bridge_slave_0) entered blocking state [ 697.239854][T25289] bridge0: port 1(bridge_slave_0) entered disabled state [ 697.254448][T25289] bridge_slave_0: entered allmulticast mode [ 697.266758][T25289] bridge_slave_0: entered promiscuous mode [ 697.277545][T25350] tun1: tun_chr_ioctl cmd 1074812118 [ 697.285484][T25289] bridge0: port 2(bridge_slave_1) entered blocking state [ 697.297471][T25289] bridge0: port 2(bridge_slave_1) entered disabled state [ 697.306063][T25289] bridge_slave_1: entered allmulticast mode [ 697.318261][T25289] bridge_slave_1: entered promiscuous mode [ 697.335184][T25350] tun1: tun_chr_ioctl cmd 1074033169 [ 697.423255][T25289] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 697.449204][T25289] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 697.585642][T25361] bridge0: port 2(bridge_slave_1) entered blocking state [ 697.592898][T25361] bridge0: port 2(bridge_slave_1) entered forwarding state [ 697.600552][T25361] bridge0: port 1(bridge_slave_0) entered blocking state [ 697.607786][T25361] bridge0: port 1(bridge_slave_0) entered forwarding state [ 697.641248][T25361] veth1_vlan: left promiscuous mode [ 697.649865][T25361] veth0_vlan: left promiscuous mode [ 697.658718][T25361] veth0_vlan: entered promiscuous mode [ 697.670216][T25361] veth1_vlan: entered promiscuous mode [ 697.681307][T25361] veth1_macvtap: left promiscuous mode [ 697.688933][T25361] veth0_macvtap: left promiscuous mode [ 697.697654][T25361] veth0_macvtap: entered promiscuous mode [ 697.705639][T25361] veth1_macvtap: entered promiscuous mode [ 697.720924][T25361] 8021q: adding VLAN 0 to HW filter on device bond1 [ 697.729150][T25361] 8021q: adding VLAN 0 to HW filter on device hsr1 [ 697.742371][T25361] 8021q: adding VLAN 0 to HW filter on device bond2 [ 697.750717][T25361] bond3: left promiscuous mode [ 697.755775][T25361] bridge1: left promiscuous mode [ 697.762414][T25361] 8021q: adding VLAN 0 to HW filter on device bond3 [ 697.770768][T25339] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 697.783046][T19164] Bluetooth: hci5: command tx timeout [ 697.800003][T25361] 8021q: adding VLAN 0 to HW filter on device bond4 [ 697.808344][T25361] 8021q: adding VLAN 0 to HW filter on device bond5 [ 697.818046][T25361] 8021q: adding VLAN 0 to HW filter on device bond6 [ 697.828016][T25361] ip6gre1: left promiscuous mode [ 697.839446][T25361] bond7: left allmulticast mode [ 697.851340][T25361] 8021q: adding VLAN 0 to HW filter on device bond7 [ 697.877833][T25361] vlan2: left promiscuous mode [ 697.889957][T25361] hsr0: left promiscuous mode [ 697.895540][T25361] vlan2: left allmulticast mode [ 697.900630][T25361] hsr0: left allmulticast mode [ 697.922893][T25361] hsr_slave_0: left allmulticast mode [ 697.931067][T25361] hsr_slave_1: left allmulticast mode [ 697.964137][T25361] 8021q: adding VLAN 0 to HW filter on device eth0 [ 697.974616][T25361] 8021q: adding VLAN 0 to HW filter on device eth1 [ 697.995251][T25361] 8021q: adding VLAN 0 to HW filter on device eth2 [ 698.011685][T25361] 8021q: adding VLAN 0 to HW filter on device eth3 [ 698.021633][T25361] bond10: left promiscuous mode [ 698.153790][ T48] netdevsim netdevsim4 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 698.212764][ T180] bond9: (slave gretap0): failed to get link speed/duplex [ 698.222268][T25373] netlink: 'syz.4.6080': attribute type 1 has an invalid length. [ 698.232924][T25289] team0: Port device team_slave_0 added [ 698.255789][T25289] team0: Port device team_slave_1 added [ 698.279107][ T48] netdevsim netdevsim4 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 698.293826][ T5901] bond10: (slave gretap0): failed to get link speed/duplex [ 698.378207][ T48] netdevsim netdevsim4 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 698.400555][ T48] netdevsim netdevsim4 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 698.507525][T25383] vlan0: entered promiscuous mode [ 698.525111][T25289] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 698.550139][T25289] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 698.582099][T25289] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 698.636880][T25289] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 698.658889][T25289] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 698.702405][T25289] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 698.746662][T25396] bond0: option active_slave: mode dependency failed, not supported in mode balance-rr(0) [ 698.806220][T25397] bond0: option active_slave: mode dependency failed, not supported in mode balance-rr(0) [ 698.885877][ T5912] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 698.918055][ T5780] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 698.927469][ T5912] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 698.982880][ T48] wlan1: Trigger new scan to find an IBSS to join [ 699.004183][ T48] bond9: (slave gretap0): failed to get link speed/duplex [ 699.032920][ T5780] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 699.099346][ T5912] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 699.118843][ T5912] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 699.126936][ T5780] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 699.149104][T25429] netlink: 'syz.4.6092': attribute type 1 has an invalid length. [ 699.191057][T25289] hsr_slave_0: entered promiscuous mode [ 699.205384][T25432] xt_hashlimit: size too large, truncated to 1048576 [ 699.215013][T25289] hsr_slave_1: entered promiscuous mode [ 699.221668][T25289] debugfs: 'hsr0' already exists in 'hsr' [ 699.232471][T25289] Cannot create hsr debugfs directory [ 699.253647][T25435] x_tables: ip6_tables: TCPMSS target: only valid for protocol 6 [ 699.330839][T25429] 8021q: adding VLAN 0 to HW filter on device bond16 [ 699.383466][T25441] __nla_validate_parse: 3 callbacks suppressed [ 699.383488][T25441] netlink: 8 bytes leftover after parsing attributes in process `syz.5.6091'. [ 699.520064][T25448] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6095'. [ 699.534632][ T5780] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 699.633102][ T5780] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 699.863172][T19164] Bluetooth: hci5: command tx timeout [ 700.024457][ T5780] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 700.351897][T25477] batadv0: entered promiscuous mode [ 700.383928][T25481] netlink: 'syz.5.6104': attribute type 1 has an invalid length. [ 700.470309][T25481] 8021q: adding VLAN 0 to HW filter on device bond5 [ 700.762343][T25489] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6107'. [ 700.865549][T25496] netlink: 28 bytes leftover after parsing attributes in process `syz.4.6109'. [ 700.876245][T25496] netlink: 'syz.4.6109': attribute type 7 has an invalid length. [ 700.886200][T25496] netlink: 'syz.4.6109': attribute type 8 has an invalid length. [ 700.904309][T25496] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6109'. [ 701.170741][T25502] netlink: 12 bytes leftover after parsing attributes in process `syz.5.6111'. [ 701.449352][T25514] netlink: 4 bytes leftover after parsing attributes in process `syz.3.6114'. [ 701.553218][T25390] net_ratelimit: 20 callbacks suppressed [ 701.553238][T25390] bond10: (slave gretap0): failed to get link speed/duplex [ 701.572124][T25289] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 701.604739][T25289] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 701.626019][T25289] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 701.653929][T25289] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 701.677190][T25289] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 701.696194][T25289] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 701.713164][T25289] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 701.733671][T25289] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 701.793634][ T5912] bond10: (slave gretap0): failed to get link speed/duplex [ 701.833090][T25401] bond9: (slave gretap0): failed to get link speed/duplex [ 701.933238][T19164] Bluetooth: hci5: command tx timeout [ 701.939027][ T48] wlan1: Trigger new scan to find an IBSS to join [ 701.972694][T25401] bond10: (slave gretap0): failed to get link speed/duplex [ 701.982952][T25401] bond9: (slave gretap0): failed to get link speed/duplex [ 702.084702][T25401] bond10: (slave gretap0): failed to get link speed/duplex [ 702.100207][T25544] netlink: 204 bytes leftover after parsing attributes in process `syz.3.6119'. [ 702.130316][T25544] netlink: 84 bytes leftover after parsing attributes in process `syz.3.6119'. [ 702.168124][T25289] 8021q: adding VLAN 0 to HW filter on device bond0 [ 702.196927][T25547] netlink: 'syz.2.6121': attribute type 1 has an invalid length. [ 702.280988][T25547] bond13: entered promiscuous mode [ 702.303631][T25547] 8021q: adding VLAN 0 to HW filter on device bond13 [ 702.353684][T25406] bond10: (slave gretap0): failed to get link speed/duplex [ 702.402681][ T5912] bond9: (slave gretap0): failed to get link speed/duplex [ 702.440244][T25289] 8021q: adding VLAN 0 to HW filter on device team0 [ 702.539989][ T5912] bridge0: port 1(bridge_slave_0) entered blocking state [ 702.547354][ T5912] bridge0: port 1(bridge_slave_0) entered forwarding state [ 702.575068][T25559] netlink: 28 bytes leftover after parsing attributes in process `syz.5.6122'. [ 702.603208][ T5912] bridge0: port 2(bridge_slave_1) entered blocking state [ 702.607001][T25559] netlink: 'syz.5.6122': attribute type 7 has an invalid length. [ 702.610448][ T5912] bridge0: port 2(bridge_slave_1) entered forwarding state [ 702.619374][T25406] bond10: (slave gretap0): failed to get link speed/duplex [ 702.656414][T25563] syzkaller1: tun_chr_ioctl cmd 1074025677 [ 702.676250][T25563] syzkaller1: linktype set to 825 [ 702.687885][T25559] netlink: 'syz.5.6122': attribute type 8 has an invalid length. [ 702.871702][ T5912] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 702.942849][ T5912] bond10: (slave gretap0): failed to get link speed/duplex [ 703.150647][T25577] netlink: 'syz.5.6129': attribute type 1 has an invalid length. [ 703.327636][T25577] 8021q: adding VLAN 0 to HW filter on device bond6 [ 703.810802][T25599] 8021q: adding VLAN 0 to HW filter on device bond14 [ 703.938999][T25603] bond14: (slave batadv1): Opening slave failed [ 704.014087][T19164] Bluetooth: hci5: command tx timeout [ 704.265861][T25289] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 704.436336][T25590] bond7 (unregistering): Released all slaves [ 704.550135][T25289] veth0_vlan: entered promiscuous mode [ 704.608371][T25289] veth1_vlan: entered promiscuous mode [ 704.667265][T25624] netlink: 'syz.3.6142': attribute type 11 has an invalid length. [ 704.695471][T25624] __nla_validate_parse: 4 callbacks suppressed [ 704.695491][T25624] netlink: 199788 bytes leftover after parsing attributes in process `syz.3.6142'. [ 704.726073][T25289] veth0_macvtap: entered promiscuous mode [ 704.748591][T25626] netlink: 12 bytes leftover after parsing attributes in process `syz.2.6143'. [ 704.762476][T25289] veth1_macvtap: entered promiscuous mode [ 704.825324][T25289] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 704.850067][T25289] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 704.885517][T25400] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 704.919267][T25400] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 704.928997][T25400] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 704.954931][T25400] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 705.268876][T25636] netlink: 224 bytes leftover after parsing attributes in process `syz.2.6147'. [ 705.506322][T25400] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 705.537532][T25400] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 705.641438][T25399] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 705.661760][T25399] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 706.644475][T25399] net_ratelimit: 47 callbacks suppressed [ 706.644504][T25399] bond9: (slave gretap0): failed to get link speed/duplex [ 706.692722][T25406] bond10: (slave gretap0): failed to get link speed/duplex [ 706.751902][T25696] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 706.762075][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 706.790679][T25699] FAULT_INJECTION: forcing a failure. [ 706.790679][T25699] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 706.792983][ T48] bond9: (slave gretap0): failed to get link speed/duplex [ 706.823133][ T48] bond10: (slave gretap0): failed to get link speed/duplex [ 706.840292][T25699] CPU: 1 UID: 0 PID: 25699 Comm: syz.3.6167 Not tainted syzkaller #0 PREEMPT(full) [ 706.840323][T25699] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 706.840338][T25699] Call Trace: [ 706.840348][T25699] [ 706.840358][T25699] dump_stack_lvl+0xe8/0x150 [ 706.840393][T25699] should_fail_ex+0x412/0x560 [ 706.840435][T25699] _copy_from_user+0x2d/0xb0 [ 706.840465][T25699] __sys_connect+0x156/0x450 [ 706.840492][T25699] ? __pfx___sys_connect+0x10/0x10 [ 706.840528][T25699] ? __pfx_ksys_write+0x10/0x10 [ 706.840569][T25699] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 706.840594][T25699] __x64_sys_connect+0x7a/0x90 [ 706.840618][T25699] do_syscall_64+0x174/0x580 [ 706.840643][T25699] ? trace_irq_disable+0x3b/0x140 [ 706.840678][T25699] ? clear_bhb_loop+0x40/0x90 [ 706.840706][T25699] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 706.840728][T25699] RIP: 0033:0x7f7670b9ce59 [ 706.840749][T25699] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 706.840769][T25699] RSP: 002b:00007f76719f5028 EFLAGS: 00000246 ORIG_RAX: 000000000000002a [ 706.840793][T25699] RAX: ffffffffffffffda RBX: 00007f7670e15fa0 RCX: 00007f7670b9ce59 [ 706.840809][T25699] RDX: 000000000000000e RSI: 0000200000000380 RDI: 0000000000000004 [ 706.840824][T25699] RBP: 00007f76719f5090 R08: 0000000000000000 R09: 0000000000000000 [ 706.840838][T25699] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 706.840851][T25699] R13: 00007f7670e16038 R14: 00007f7670e15fa0 R15: 00007ffc75e0d328 [ 706.840887][T25699] [ 707.014325][ T48] bond10: (slave gretap0): failed to get link speed/duplex [ 707.022116][ T48] bond9: (slave gretap0): failed to get link speed/duplex [ 707.123139][T25400] bond10: (slave gretap0): failed to get link speed/duplex [ 707.152844][T25400] bond9: (slave gretap0): failed to get link speed/duplex [ 707.988012][T25706] veth1_to_batadv: entered promiscuous mode [ 707.997707][T25706] veth1_to_batadv: entered allmulticast mode [ 708.145162][T25711] netlink: 24 bytes leftover after parsing attributes in process `syz.2.6172'. [ 708.188475][T25711] ip6gre3: entered promiscuous mode [ 708.202754][T25711] ip6gre3: entered allmulticast mode [ 708.243918][T25713] FAULT_INJECTION: forcing a failure. [ 708.243918][T25713] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 708.259467][T25713] CPU: 1 UID: 0 PID: 25713 Comm: syz.4.6173 Not tainted syzkaller #0 PREEMPT(full) [ 708.259498][T25713] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 708.259513][T25713] Call Trace: [ 708.259522][T25713] [ 708.259532][T25713] dump_stack_lvl+0xe8/0x150 [ 708.259565][T25713] should_fail_ex+0x412/0x560 [ 708.259595][T25713] _copy_from_user+0x2d/0xb0 [ 708.259624][T25713] bpf_test_init+0xd8/0x150 [ 708.259756][T25713] bpf_prog_test_run_skb+0x392/0x2260 [ 708.259785][T25713] ? bpf_prog_test_run_skb+0x271/0x2260 [ 708.259833][T25713] ? __fget_files+0x3a0/0x420 [ 708.259861][T25713] ? __fget_files+0x2a/0x420 [ 708.259894][T25713] ? __pfx_bpf_prog_test_run_skb+0x10/0x10 [ 708.259921][T25713] bpf_prog_test_run+0x2c7/0x340 [ 708.259962][T25713] __sys_bpf+0x643/0x950 [ 708.259998][T25713] ? __pfx___sys_bpf+0x10/0x10 [ 708.260049][T25713] ? ksys_write+0x242/0x270 [ 708.260085][T25713] ? __pfx_ksys_write+0x10/0x10 [ 708.260124][T25713] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 708.260149][T25713] __x64_sys_bpf+0x7c/0x90 [ 708.260180][T25713] do_syscall_64+0x174/0x580 [ 708.260205][T25713] ? trace_irq_disable+0x3b/0x140 [ 708.260239][T25713] ? clear_bhb_loop+0x40/0x90 [ 708.260267][T25713] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 708.260290][T25713] RIP: 0033:0x7fc60139ce59 [ 708.260310][T25713] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 708.260330][T25713] RSP: 002b:00007fc602195028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 708.260355][T25713] RAX: ffffffffffffffda RBX: 00007fc601615fa0 RCX: 00007fc60139ce59 [ 708.260371][T25713] RDX: 0000000000000023 RSI: 0000200000000240 RDI: 000000000000000a [ 708.260386][T25713] RBP: 00007fc602195090 R08: 0000000000000000 R09: 0000000000000000 [ 708.260401][T25713] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 708.260414][T25713] R13: 00007fc601616038 R14: 00007fc601615fa0 R15: 00007ffce4f494b8 [ 708.260450][T25713] [ 708.493068][T25679] Bluetooth: hci0: Opcode 0x0c03 failed: -110 [ 708.695377][T25719] lo speed is unknown, defaulting to 1000 [ 709.133413][T19164] Bluetooth: hci5: command tx timeout [ 709.597207][T25727] netlink: 'syz.2.6178': attribute type 1 has an invalid length. [ 709.632404][T25727] 8021q: adding VLAN 0 to HW filter on device bond15 [ 710.619045][T25763] FAULT_INJECTION: forcing a failure. [ 710.619045][T25763] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 710.663441][T25763] CPU: 1 UID: 0 PID: 25763 Comm: syz.3.6190 Not tainted syzkaller #0 PREEMPT(full) [ 710.663471][T25763] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 710.663485][T25763] Call Trace: [ 710.663494][T25763] [ 710.663513][T25763] dump_stack_lvl+0xe8/0x150 [ 710.663546][T25763] should_fail_ex+0x412/0x560 [ 710.663577][T25763] prepare_alloc_pages+0x22a/0x650 [ 710.663622][T25763] __alloc_frozen_pages_noprof+0x12f/0x380 [ 710.663651][T25763] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 710.663692][T25763] ? __pfx_policy_nodemask+0x10/0x10 [ 710.663716][T25763] ? trace_kmalloc+0x2a/0xf0 [ 710.663748][T25763] ? __pfx__copy_from_iter+0x10/0x10 [ 710.663777][T25763] alloc_pages_mpol+0x235/0x490 [ 710.663806][T25763] alloc_pages_noprof+0xac/0x2a0 [ 710.663835][T25763] af_alg_sendmsg+0x1446/0x2650 [ 710.663883][T25763] ? __pfx_af_alg_sendmsg+0x10/0x10 [ 710.663906][T25763] ? __pfx_aa_sk_perm+0x10/0x10 [ 710.663936][T25763] ? tomoyo_socket_sendmsg_permission+0x1e0/0x300 [ 710.663980][T25763] ? aa_sock_msg_perm+0xf1/0x1b0 [ 710.664016][T25763] ? skcipher_sendmsg+0x26/0xf0 [ 710.664046][T25763] ____sys_sendmsg+0x972/0x9f0 [ 710.664073][T25763] ? __might_fault+0xaf/0x130 [ 710.664110][T25763] ? __pfx_____sys_sendmsg+0x10/0x10 [ 710.664148][T25763] ? import_iovec+0x73/0xa0 [ 710.664181][T25763] ___sys_sendmsg+0x2a5/0x360 [ 710.664207][T25763] ? __lock_acquire+0x6b5/0x2cf0 [ 710.664238][T25763] ? __pfx____sys_sendmsg+0x10/0x10 [ 710.664271][T25763] ? kstrtouint+0x6e/0xe0 [ 710.664336][T25763] ? __fget_files+0x2a/0x420 [ 710.664363][T25763] ? __fget_files+0x3a0/0x420 [ 710.664404][T25763] __sys_sendmmsg+0x27c/0x4e0 [ 710.664438][T25763] ? __pfx___sys_sendmmsg+0x10/0x10 [ 710.664463][T25763] ? __mutex_unlock_slowpath+0x1be/0x6f0 [ 710.664526][T25763] ? ksys_write+0x242/0x270 [ 710.664563][T25763] ? __pfx_ksys_write+0x10/0x10 [ 710.664604][T25763] __x64_sys_sendmmsg+0xa0/0xc0 [ 710.664631][T25763] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 710.664656][T25763] do_syscall_64+0x174/0x580 [ 710.664680][T25763] ? trace_irq_disable+0x3b/0x140 [ 710.664715][T25763] ? clear_bhb_loop+0x40/0x90 [ 710.664743][T25763] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 710.664765][T25763] RIP: 0033:0x7f7670b9ce59 [ 710.664785][T25763] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 710.664804][T25763] RSP: 002b:00007f76719f5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 710.664829][T25763] RAX: ffffffffffffffda RBX: 00007f7670e15fa0 RCX: 00007f7670b9ce59 [ 710.664846][T25763] RDX: 0000000000000001 RSI: 0000200000000040 RDI: 0000000000000004 [ 710.664861][T25763] RBP: 00007f76719f5090 R08: 0000000000000000 R09: 0000000000000000 [ 710.664874][T25763] R10: 0000000000040800 R11: 0000000000000246 R12: 0000000000000002 [ 710.664888][T25763] R13: 00007f7670e16038 R14: 00007f7670e15fa0 R15: 00007ffc75e0d328 [ 710.664924][T25763] [ 711.028624][T25768] FAULT_INJECTION: forcing a failure. [ 711.028624][T25768] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 711.069843][T25768] CPU: 0 UID: 0 PID: 25768 Comm: syz.4.6193 Not tainted syzkaller #0 PREEMPT(full) [ 711.069876][T25768] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 711.069890][T25768] Call Trace: [ 711.069899][T25768] [ 711.069909][T25768] dump_stack_lvl+0xe8/0x150 [ 711.069942][T25768] should_fail_ex+0x412/0x560 [ 711.069974][T25768] _copy_from_iter+0x1d3/0x1670 [ 711.070003][T25768] ? rcu_is_watching+0x15/0xb0 [ 711.070038][T25768] ? __pfx__copy_from_iter+0x10/0x10 [ 711.070072][T25768] ? netlink_sendmsg+0x650/0xb40 [ 711.070098][T25768] ? skb_put+0x11b/0x210 [ 711.070126][T25768] netlink_sendmsg+0x6c0/0xb40 [ 711.070163][T25768] ? __pfx_netlink_sendmsg+0x10/0x10 [ 711.070194][T25768] ? aa_sock_msg_perm+0xf1/0x1b0 [ 711.070229][T25768] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 711.070265][T25768] ____sys_sendmsg+0x972/0x9f0 [ 711.070292][T25768] ? __might_fault+0xaf/0x130 [ 711.070334][T25768] ? __pfx_____sys_sendmsg+0x10/0x10 [ 711.070371][T25768] ? import_iovec+0x73/0xa0 [ 711.070401][T25768] ___sys_sendmsg+0x2a5/0x360 [ 711.070427][T25768] ? __lock_acquire+0x6b5/0x2cf0 [ 711.070466][T25768] ? __pfx____sys_sendmsg+0x10/0x10 [ 711.070532][T25768] ? __fget_files+0x2a/0x420 [ 711.070559][T25768] ? __fget_files+0x3a0/0x420 [ 711.070599][T25768] __x64_sys_sendmsg+0x1bd/0x2a0 [ 711.070629][T25768] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 711.070667][T25768] ? __pfx_ksys_write+0x10/0x10 [ 711.070710][T25768] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 711.070735][T25768] do_syscall_64+0x174/0x580 [ 711.070760][T25768] ? trace_irq_disable+0x3b/0x140 [ 711.070794][T25768] ? clear_bhb_loop+0x40/0x90 [ 711.070822][T25768] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 711.070845][T25768] RIP: 0033:0x7fc60139ce59 [ 711.070867][T25768] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 711.070886][T25768] RSP: 002b:00007fc602195028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 711.070910][T25768] RAX: ffffffffffffffda RBX: 00007fc601615fa0 RCX: 00007fc60139ce59 [ 711.070927][T25768] RDX: 0000000000000000 RSI: 0000200000000440 RDI: 0000000000000003 [ 711.070942][T25768] RBP: 00007fc602195090 R08: 0000000000000000 R09: 0000000000000000 [ 711.070956][T25768] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 711.070970][T25768] R13: 00007fc601616038 R14: 00007fc601615fa0 R15: 00007ffce4f494b8 [ 711.071006][T25768] [ 711.389375][T25770] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6192'. [ 711.453638][ C0] ip6_tnl_xmit_ctl: 2 callbacks suppressed [ 711.453658][ C0] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 711.467383][ C0] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 711.586526][T25779] netlink: 84 bytes leftover after parsing attributes in process `syz.4.6197'. [ 711.657998][T25783] bond3: (slave lo): Releasing backup interface [ 711.685364][T25783] bond3: (slave lo): last VLAN challenged slave left bond - VLAN blocking is removed [ 711.738071][T25783] net_ratelimit: 59 callbacks suppressed [ 711.738095][T25783] A link change request failed with some changes committed already. Interface erspan0 may have been left with an inconsistent configuration, please check. [ 711.764228][ T5912] bond10: (slave gretap0): failed to get link speed/duplex [ 711.793316][T25406] bond9: (slave gretap0): failed to get link speed/duplex [ 711.879555][T25789] netlink: 20 bytes leftover after parsing attributes in process `syz.0.6200'. [ 711.899855][T25406] bond10: (slave gretap0): failed to get link speed/duplex [ 711.952779][ T5912] bond9: (slave gretap0): failed to get link speed/duplex [ 712.022766][ T5912] bond10: (slave gretap0): failed to get link speed/duplex [ 712.070820][ T5912] bond9: (slave gretap0): failed to get link speed/duplex [ 712.152730][T25399] bond10: (slave gretap0): failed to get link speed/duplex [ 712.162852][T25800] tun0: tun_chr_ioctl cmd 1074812117 [ 712.204976][T25800] vlan2: entered allmulticast mode [ 712.216972][T25800] bond0: entered allmulticast mode [ 712.233057][T25800] bond_slave_0: entered allmulticast mode [ 712.251911][T25800] bond_slave_1: entered allmulticast mode [ 712.279174][T25806] tipc: Started in network mode [ 712.289781][T25806] tipc: Node identity 7f000001, cluster identity 4711 [ 712.307829][T25806] tipc: Enabled bearer , priority 10 [ 712.335450][ T5912] bond10: (slave gretap0): failed to get link speed/duplex [ 712.352004][T25800] netlink: 68 bytes leftover after parsing attributes in process `syz.0.6205'. [ 712.382676][T25390] bond9: (slave gretap0): failed to get link speed/duplex [ 712.394441][T25800] tipc: New replicast peer: fe80:0000:0000:0000:0000:0000:0000:00bb [ 712.416355][T25800] tipc: Enabled bearer , priority 10 [ 713.014551][T25819] netlink: 84 bytes leftover after parsing attributes in process `syz.3.6209'. [ 713.327190][T25825] FAULT_INJECTION: forcing a failure. [ 713.327190][T25825] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 713.352479][T25825] CPU: 0 UID: 0 PID: 25825 Comm: syz.5.6211 Not tainted syzkaller #0 PREEMPT(full) [ 713.352515][T25825] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 713.352529][T25825] Call Trace: [ 713.352539][T25825] [ 713.352549][T25825] dump_stack_lvl+0xe8/0x150 [ 713.352582][T25825] should_fail_ex+0x412/0x560 [ 713.352612][T25825] _copy_to_user+0x31/0xb0 [ 713.352642][T25825] simple_read_from_buffer+0xe1/0x170 [ 713.352677][T25825] proc_fail_nth_read+0x1bb/0x230 [ 713.352712][T25825] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 713.352754][T25825] ? rw_verify_area+0x2a6/0x4d0 [ 713.352787][T25825] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 713.352818][T25825] vfs_read+0x20c/0xa70 [ 713.352856][T25825] ? __pfx___mutex_lock+0x10/0x10 [ 713.352884][T25825] ? __pfx_vfs_read+0x10/0x10 [ 713.352918][T25825] ? __fget_files+0x2a/0x420 [ 713.352951][T25825] ? __fget_files+0x3a0/0x420 [ 713.352978][T25825] ? __fget_files+0x2a/0x420 [ 713.353016][T25825] ksys_read+0x150/0x270 [ 713.353052][T25825] ? __pfx_ksys_read+0x10/0x10 [ 713.353094][T25825] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 713.353119][T25825] do_syscall_64+0x174/0x580 [ 713.353142][T25825] ? trace_irq_disable+0x3b/0x140 [ 713.353176][T25825] ? clear_bhb_loop+0x40/0x90 [ 713.353204][T25825] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 713.353227][T25825] RIP: 0033:0x7fe03cb5d68e [ 713.353248][T25825] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 713.353267][T25825] RSP: 002b:00007fe03adf5fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 713.353291][T25825] RAX: ffffffffffffffda RBX: 00007fe03adf66c0 RCX: 00007fe03cb5d68e [ 713.353307][T25825] RDX: 000000000000000f RSI: 00007fe03adf60a0 RDI: 0000000000000004 [ 713.353321][T25825] RBP: 00007fe03adf6090 R08: 0000000000000000 R09: 0000000000000000 [ 713.353336][T25825] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 713.353349][T25825] R13: 00007fe03ce16038 R14: 00007fe03ce15fa0 R15: 00007ffe13e044d8 [ 713.353385][T25825] [ 713.567281][T13556] tipc: Node number set to 2130706433 [ 713.619811][T19164] Bluetooth: hci0: Opcode 0x0c03 failed: -110 [ 714.029573][T25849] netlink: 84 bytes leftover after parsing attributes in process `syz.2.6223'. [ 714.195267][T25858] netlink: 204 bytes leftover after parsing attributes in process `syz.0.6224'. [ 714.405492][T25864] netlink: 16 bytes leftover after parsing attributes in process `syz.2.6227'. [ 714.502780][T25869] ip6erspan0: entered allmulticast mode [ 714.798599][T25887] netlink: 84 bytes leftover after parsing attributes in process `syz.3.6235'. [ 714.944716][T25893] IPv6: NLM_F_REPLACE set, but no existing node found! [ 714.963066][T25894] IPv6: NLM_F_REPLACE set, but no existing node found! [ 715.128943][T19362] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 715.142414][T19362] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 715.153587][T19362] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 715.163268][T19362] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 715.171464][T19362] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 715.643793][T16646] syz_tun (unregistering): left allmulticast mode [ 715.807320][T25926] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for gretap1 [ 715.834113][T25926] batman_adv: batadv0: Adding interface: gretap1 [ 715.842398][T25926] batman_adv: batadv0: The MTU of interface gretap1 is too small (1462) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 715.910354][T25926] batman_adv: batadv0: Interface activated: gretap1 [ 715.938497][T25934] netlink: 84 bytes leftover after parsing attributes in process `syz.0.6249'. [ 715.957689][T25933] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 716.166731][T25897] lo speed is unknown, defaulting to 1000 [ 716.498692][T25950] netlink: 28 bytes leftover after parsing attributes in process `syz.0.6254'. [ 716.508263][T25950] netlink: 28 bytes leftover after parsing attributes in process `syz.0.6254'. [ 716.650307][T25958] netlink: 177456 bytes leftover after parsing attributes in process `syz.0.6256'. [ 716.722843][T25958] netlink: 'syz.0.6256': attribute type 3 has an invalid length. [ 716.808748][T25955] lo speed is unknown, defaulting to 1000 [ 716.832649][T25965] netlink: 28 bytes leftover after parsing attributes in process `syz.5.6258'. [ 716.841864][T25965] netlink: 'syz.5.6258': attribute type 7 has an invalid length. [ 716.851239][T25965] netlink: 'syz.5.6258': attribute type 8 has an invalid length. [ 716.859303][T25965] netlink: 4 bytes leftover after parsing attributes in process `syz.5.6258'. [ 717.091798][T25897] bridge0: port 1(bridge_slave_0) entered blocking state [ 717.109883][T25897] bridge0: port 1(bridge_slave_0) entered disabled state [ 717.129597][T25897] bridge_slave_0: entered allmulticast mode [ 717.160676][T25897] bridge_slave_0: entered promiscuous mode [ 717.181702][T25979] net_ratelimit: 55 callbacks suppressed [ 717.181722][T25979] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 717.216930][T25400] bond9: (slave gretap0): failed to get link speed/duplex [ 717.227642][T19164] Bluetooth: hci4: command tx timeout [ 717.241084][T25897] bridge0: port 2(bridge_slave_1) entered blocking state [ 717.257256][T25897] bridge0: port 2(bridge_slave_1) entered disabled state [ 717.280413][T25897] bridge_slave_1: entered allmulticast mode [ 717.312096][T25897] bridge_slave_1: entered promiscuous mode [ 717.456549][T25897] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 717.516558][T25987] netlink: 20 bytes leftover after parsing attributes in process `syz.5.6262'. [ 717.538445][T25897] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 717.556060][T25987] netlink: 8 bytes leftover after parsing attributes in process `syz.5.6262'. [ 717.574980][T25987] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 717.706212][T25897] team0: Port device team_slave_0 added [ 717.726185][T25897] team0: Port device team_slave_1 added [ 717.907031][T25993] xt_bpf: check failed: parse error [ 717.931183][T25978] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 717.947365][T25897] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 717.987663][T25897] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 718.045437][T25897] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 718.103960][T25400] bond10: (slave gretap0): failed to get link speed/duplex [ 718.287928][T26006] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 718.318446][T25897] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 718.332596][T25897] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 718.362800][T25897] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 718.448529][T26005] syzkaller0: entered promiscuous mode [ 718.454610][T26005] syzkaller0: entered allmulticast mode [ 719.306706][T19164] Bluetooth: hci4: command tx timeout [ 719.407480][T26013] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 720.135505][T26012] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 721.379662][T19164] Bluetooth: hci4: command tx timeout [ 722.296991][T25999] lo speed is unknown, defaulting to 1000 [ 722.330395][ T180] bridge_slave_1: left promiscuous mode [ 722.338105][ T180] bridge0: port 2(bridge_slave_1) entered disabled state [ 722.348871][ T180] bridge_slave_0: left allmulticast mode [ 722.354851][ T180] bridge_slave_0: left promiscuous mode [ 722.360687][ T180] bridge0: port 1(bridge_slave_0) entered disabled state [ 722.551416][T26066] netlink: 'syz.5.6273': attribute type 1 has an invalid length. [ 722.559555][ T180] erspan0 (unregistering): left promiscuous mode [ 722.591300][ T180] bond15 (unregistering): (slave gretap0): Removing an active aggregator [ 722.600298][ T180] bond15 (unregistering): (slave gretap0): Releasing backup interface [ 722.689888][ T180]  (unregistering): left promiscuous mode [ 722.695907][ T180] bond_slave_0: left promiscuous mode [ 722.701473][ T180] bond_slave_1: left promiscuous mode [ 722.713251][ T180]  (unregistering): (slave bond_slave_0): Releasing backup interface [ 722.724088][ T180]  (unregistering): (slave bond_slave_1): Releasing backup interface [ 722.733477][ T180]  (unregistering): Released all slaves [ 722.747333][ T180] bond1 (unregistering): Released all slaves [ 722.765072][ T180] bond2 (unregistering): Released all slaves [ 722.797300][ T180] bond3 (unregistering): Released all slaves [ 722.816093][ T180] bond4 (unregistering): Released all slaves [ 722.834166][ T180] bond5 (unregistering): Released all slaves [ 722.850211][ T180] bond6 (unregistering): Released all slaves [ 722.882427][ T180] =v (unregistering): Released all slaves [ 722.910381][ T180] bond7 (unregistering): Released all slaves [ 722.932256][ T180] bond8 (unregistering): Released all slaves [ 722.948738][ T180] bond9 (unregistering): Released all slaves [ 722.969466][ T180] bond10 (unregistering): Released all slaves [ 723.008379][ T180] bond11 (unregistering): Released all slaves [ 723.024837][ T180] bond12 (unregistering): Released all slaves [ 723.041364][ T180] bond13 (unregistering): Released all slaves [ 723.070827][ T180] bond14 (unregistering): Released all slaves [ 723.088071][ T180] bond15 (unregistering): Released all slaves [ 723.108777][ T180] bond16 (unregistering): Released all slaves [ 723.152203][T25897] hsr_slave_0: entered promiscuous mode [ 723.163760][T25897] hsr_slave_1: entered promiscuous mode [ 723.170241][T25897] debugfs: 'hsr0' already exists in 'hsr' [ 723.176532][T25897] Cannot create hsr debugfs directory [ 723.182901][ T48] bond10: (slave gretap0): failed to get link speed/duplex [ 723.247271][T26066] 8021q: adding VLAN 0 to HW filter on device bond7 [ 723.454065][T19164] Bluetooth: hci4: command tx timeout [ 723.481473][T26077] netlink: 16 bytes leftover after parsing attributes in process `syz.5.6276'. [ 723.547237][ T180] tipc: Disabling bearer [ 723.605809][ T180] tipc: Left network mode [ 723.710991][ T180] IPVS: stopping backup sync thread 13602 ... [ 723.820481][T26082] netlink: 28 bytes leftover after parsing attributes in process `syz.3.6277'. [ 723.847100][T26084] xt_bpf: check failed: parse error [ 723.882767][ T138] bond10: (slave gretap0): failed to get link speed/duplex [ 724.304148][ T48] bond10: (slave gretap0): failed to get link speed/duplex [ 724.396947][T26095] netlink: 28 bytes leftover after parsing attributes in process `syz.0.6282'. [ 724.482595][T26100] IPv6: addrconf: prefix option has invalid lifetime [ 724.489363][T26100] IPv6: addrconf: prefix option has invalid lifetime [ 724.515051][T26102] netlink: 16 bytes leftover after parsing attributes in process `syz.3.6284'. [ 724.533622][T25401] bond9: (slave gretap0): failed to get link speed/duplex [ 724.716073][T25897] netdevsim netdevsim4 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 724.727926][T25897] netdevsim netdevsim4 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 724.858593][ T180] hsr_slave_0: left promiscuous mode [ 724.898773][ T180] hsr_slave_1: left promiscuous mode [ 724.918547][ T180] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 724.942006][ T180] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 724.967756][T26119] xt_bpf: check failed: parse error [ 725.079197][T26122] netlink: 28 bytes leftover after parsing attributes in process `syz.5.6289'. [ 725.113679][T26125] netlink: 15 bytes leftover after parsing attributes in process `syz.3.6291'. [ 725.123151][T26125] openvswitch: netlink: Flow key attr not present in new flow. [ 725.227895][T26130] netlink: 32 bytes leftover after parsing attributes in process `syz.2.6290'. [ 725.433216][ T48] bond10: (slave gretap0): failed to get link speed/duplex [ 725.474002][T25401] bond9: (slave gretap0): failed to get link speed/duplex [ 725.544196][T19164] Bluetooth: hci4: command tx timeout [ 725.567764][T25897] netdevsim netdevsim4 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 725.580878][T25897] netdevsim netdevsim4 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 725.618619][T26135] ±ÿÿÿÿa–ïD: renamed from lo [ 725.645841][T25389] bond10: (slave gretap0): failed to get link speed/duplex [ 725.785975][T25897] netdevsim netdevsim4 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 725.810562][T25897] netdevsim netdevsim4 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 725.848519][T26146] netlink: 12 bytes leftover after parsing attributes in process `syz.5.6296'. [ 725.975031][T26148] ipt_rpfilter: unknown options [ 725.988335][T25897] netdevsim netdevsim4 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 726.009646][T25897] netdevsim netdevsim4 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 726.235965][ T180] IPVS: stop unused estimator thread 0... [ 726.409948][T26162] netlink: 28 bytes leftover after parsing attributes in process `syz.3.6302'. [ 726.629404][T25897] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 726.647446][T25897] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 726.663791][T25897] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 726.698090][T25897] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 726.718516][T25897] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 726.739585][T25897] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 726.749283][T25897] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 726.751935][T26174] netlink: 32 bytes leftover after parsing attributes in process `syz.3.6306'. [ 726.784172][T25897] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 726.813844][ C0] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 727.019825][T26188] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 727.160186][T25897] 8021q: adding VLAN 0 to HW filter on device bond0 [ 727.319447][T25897] 8021q: adding VLAN 0 to HW filter on device team0 [ 727.351757][ T180] bridge0: port 1(bridge_slave_0) entered blocking state [ 727.359016][ T180] bridge0: port 1(bridge_slave_0) entered forwarding state [ 727.414734][ T138] bridge0: port 2(bridge_slave_1) entered blocking state [ 727.422002][ T138] bridge0: port 2(bridge_slave_1) entered forwarding state [ 727.452762][ C0] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 727.541554][T26205] tipc: Enabled bearer , priority 0 [ 727.560191][T26205] syzkaller0: entered promiscuous mode [ 727.566662][T26205] syzkaller0: entered allmulticast mode [ 727.696511][T26213] netlink: 'syz.0.6320': attribute type 1 has an invalid length. [ 727.746813][T26205] 8021q: adding VLAN 0 to HW filter on device team0 [ 727.762209][T26205] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 727.809873][ T30] audit: type=1800 audit(1780937158.017:8): pid=26220 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.6320" name=3A202E31323334352E2E2E2E2028313829207238203D2030783363333130303030300A202020202020323A202E31323334352E2E382E20283835292063616C6C2070632B360A202020202020333A202E2E2E2E2E2E2E2E382E2028313829207230203D203078313130303030303066666666666666660A202020202020353A202E2E2E2E2E2E2E2E382E202836362920696620773820733E2030783020676F746F2070632B300A202020202020363A202E2E2E2E2E2E2E2E2E2E20283138292072 dev="tmpfs" ino=196 res=0 errno=0 [ 727.868797][T26205] veth1_vlan: left promiscuous mode [ 727.880937][T26205] veth1_vlan: entered promiscuous mode [ 727.909381][T26205] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 727.918935][T26205] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 727.931625][T26205] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 727.948933][T26205] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 727.963431][T26205] 8021q: adding VLAN 0 to HW filter on device bond0 [ 727.971602][T26205] 8021q: adding VLAN 0 to HW filter on device bond1 [ 727.988275][T26205] 8021q: adding VLAN 0 to HW filter on device bond2 [ 728.001103][T26205] 8021q: adding VLAN 0 to HW filter on device bond3 [ 728.029694][T26205] 8021q: adding VLAN 0 to HW filter on device bond4 [ 728.038164][T26205] 8021q: adding VLAN 0 to HW filter on device bond5 [ 728.048505][T26205] 8021q: adding VLAN 0 to HW filter on device bond6 [ 728.057622][T26205] 8021q: adding VLAN 0 to HW filter on device bond7 [ 728.065923][T26205] 8021q: adding VLAN 0 to HW filter on device bond8 [ 728.128598][T26224] tipc: Resetting bearer [ 728.144271][ T180] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 728.153755][ T180] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 728.165422][T26204] tipc: Resetting bearer [ 728.220918][T26204] tipc: Disabling bearer [ 728.241163][ T180] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 728.251513][ T180] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 728.284698][ T180] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 728.300991][ T180] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 728.321706][ T180] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 728.349692][ T180] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 728.386792][ T138] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 728.414868][T13556] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 728.433065][ T138] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 728.455570][ T138] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 728.474410][ T138] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 728.484180][T22192] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 728.502793][ T138] net_ratelimit: 18 callbacks suppressed [ 728.502815][ T138] bond9: (slave gretap0): failed to get link speed/duplex [ 728.519169][T26236] __nla_validate_parse: 5 callbacks suppressed [ 728.519205][T26236] netlink: 20 bytes leftover after parsing attributes in process `syz.2.6324'. [ 728.534979][ T138] bond10: (slave gretap0): failed to get link speed/duplex [ 728.627416][T26236] bridge7: trying to set multicast query interval above maximum, setting to 8640000 (86400000ms) [ 728.650961][T26236] netlink: 28 bytes leftover after parsing attributes in process `syz.2.6324'. [ 728.661224][T22192] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 728.671211][ T138] bond10: (slave gretap0): failed to get link speed/duplex [ 728.681799][T22192] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 728.689783][T26236] netlink: 28 bytes leftover after parsing attributes in process `syz.2.6324'. [ 728.699972][ T138] bond9: (slave gretap0): failed to get link speed/duplex [ 728.795615][ T5908] bond10: (slave gretap0): failed to get link speed/duplex [ 728.816301][ T180] bond9: (slave gretap0): failed to get link speed/duplex [ 728.893947][T26246] netlink: 28 bytes leftover after parsing attributes in process `syz.2.6327'. [ 728.913830][ T5908] bond10: (slave gretap0): failed to get link speed/duplex [ 728.954129][T25389] bond9: (slave gretap0): failed to get link speed/duplex [ 729.037760][T26251] xt_bpf: check failed: parse error [ 729.043345][T25389] bond10: (slave gretap0): failed to get link speed/duplex [ 729.072942][T25404] bond9: (slave gretap0): failed to get link speed/duplex [ 729.502362][T26266] netlink: 56 bytes leftover after parsing attributes in process `syz.2.6333'. [ 729.691567][T25897] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 730.156027][T26284] netlink: 28 bytes leftover after parsing attributes in process `syz.2.6338'. [ 730.400950][T26294] xt_bpf: check failed: parse error [ 730.455306][T25897] veth0_vlan: entered promiscuous mode [ 730.489248][T25897] veth1_vlan: entered promiscuous mode [ 730.571434][T25897] veth0_macvtap: entered promiscuous mode [ 730.596757][T25897] veth1_macvtap: entered promiscuous mode [ 730.624960][T25897] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 730.645060][T25897] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 730.665168][ T138] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 730.684045][ T138] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 730.708690][ T138] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 730.726112][ T138] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 730.852211][T26303] FAULT_INJECTION: forcing a failure. [ 730.852211][T26303] name failslab, interval 1, probability 0, space 0, times 0 [ 730.951556][T26303] CPU: 0 UID: 0 PID: 26303 Comm: syz.0.6345 Not tainted syzkaller #0 PREEMPT(full) [ 730.951590][T26303] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 730.951605][T26303] Call Trace: [ 730.951615][T26303] [ 730.951625][T26303] dump_stack_lvl+0xe8/0x150 [ 730.951659][T26303] should_fail_ex+0x412/0x560 [ 730.951690][T26303] should_failslab+0xa8/0x100 [ 730.951716][T26303] __kmalloc_cache_node_noprof+0x8a/0x6b0 [ 730.951749][T26303] ? trace_kmalloc+0x2a/0xf0 [ 730.951778][T26303] ? page_pool_create_percpu+0x76/0xc80 [ 730.951905][T26303] page_pool_create_percpu+0x76/0xc80 [ 730.951938][T26303] ? __kvmalloc_node_noprof+0x393/0x8a0 [ 730.951979][T26303] bpf_test_run_xdp_live+0x23d/0x1cf0 [ 730.952007][T26303] ? arch_stack_walk+0xfb/0x150 [ 730.952067][T26303] ? __pfx_stack_trace_save+0x10/0x10 [ 730.952104][T26303] ? stack_depot_save_flags+0x33/0x810 [ 730.952137][T26303] ? __pfx_bpf_test_run_xdp_live+0x10/0x10 [ 730.952163][T26303] ? bpf_test_init+0x9f/0x150 [ 730.952184][T26303] ? bpf_prog_test_run_xdp+0x529/0x1160 [ 730.952210][T26303] ? bpf_prog_test_run+0x2c7/0x340 [ 730.952230][T26303] ? __sys_bpf+0x643/0x950 [ 730.952260][T26303] ? __x64_sys_bpf+0x7c/0x90 [ 730.952326][T26303] ? __might_fault+0xaf/0x130 [ 730.952356][T26303] ? __might_fault+0xaf/0x130 [ 730.952392][T26303] ? __pfx_xdp_test_run_init_page+0x10/0x10 [ 730.952432][T26303] ? _copy_from_user+0x94/0xb0 [ 730.952459][T26303] ? bpf_test_init+0x113/0x150 [ 730.952483][T26303] ? xdp_convert_md_to_buff+0x5b/0x330 [ 730.952521][T26303] bpf_prog_test_run_xdp+0x81c/0x1160 [ 730.952565][T26303] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 730.952597][T26303] ? __fget_files+0x2a/0x420 [ 730.952630][T26303] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 730.952658][T26303] bpf_prog_test_run+0x2c7/0x340 [ 730.952684][T26303] __sys_bpf+0x643/0x950 [ 730.952721][T26303] ? __pfx___sys_bpf+0x10/0x10 [ 730.952771][T26303] ? ksys_write+0x242/0x270 [ 730.952806][T26303] ? __pfx_ksys_write+0x10/0x10 [ 730.952844][T26303] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 730.952869][T26303] __x64_sys_bpf+0x7c/0x90 [ 730.952900][T26303] do_syscall_64+0x174/0x580 [ 730.952924][T26303] ? trace_irq_disable+0x3b/0x140 [ 730.952957][T26303] ? clear_bhb_loop+0x40/0x90 [ 730.952984][T26303] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 730.953007][T26303] RIP: 0033:0x7f4aacb9ce59 [ 730.953028][T26303] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 730.953046][T26303] RSP: 002b:00007f4aadb0c028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 730.953070][T26303] RAX: ffffffffffffffda RBX: 00007f4aace15fa0 RCX: 00007f4aacb9ce59 [ 730.953087][T26303] RDX: 0000000000000050 RSI: 0000200000000b80 RDI: 000000000000000a [ 730.953101][T26303] RBP: 00007f4aadb0c090 R08: 0000000000000000 R09: 0000000000000000 [ 730.953115][T26303] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 730.953128][T26303] R13: 00007f4aace16038 R14: 00007f4aace15fa0 R15: 00007fff98d99678 [ 730.953164][T26303] [ 731.277648][T25389] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 731.301212][T25389] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 731.414444][ T180] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 731.422422][ T180] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 731.549694][T26311] bridge_slave_0: left allmulticast mode [ 731.582757][T26311] bridge_slave_0: left promiscuous mode [ 731.590617][T26311] bridge0: port 1(bridge_slave_0) entered disabled state [ 731.608176][T26311] bridge_slave_1: left allmulticast mode [ 731.614489][T26311] bridge_slave_1: left promiscuous mode [ 731.620351][T26311] bridge0: port 2(bridge_slave_1) entered disabled state [ 731.634991][T26317] netlink: 28 bytes leftover after parsing attributes in process `syz.5.6350'. [ 731.656402][T26311] bond0: (slave bond_slave_0): Releasing backup interface [ 731.667943][T26311] bond_slave_0: left allmulticast mode [ 731.706790][T26311] bond0: (slave bond_slave_1): Releasing backup interface [ 731.737312][T26311] bond_slave_1: left allmulticast mode [ 731.841362][T26311] team0: Port device team_slave_0 removed [ 731.869588][T26311] team0: Port device team_slave_1 removed [ 731.899526][T26321] netlink: 'syz.3.6352': attribute type 10 has an invalid length. [ 731.911420][T26321] netlink: 40 bytes leftover after parsing attributes in process `syz.3.6352'. [ 731.930271][T26311] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 731.954273][T26311] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 731.986063][T26311] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 732.013422][T26311] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 732.065962][T19362] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 732.091200][T19362] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 732.100074][T19362] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 732.103988][ C0] ip6_tnl_xmit_ctl: 6 callbacks suppressed [ 732.104041][ C0] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 732.120942][T19362] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 732.131685][T19362] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 732.343528][T26335] netlink: 'syz.3.6355': attribute type 8 has an invalid length. [ 732.507879][T26330] syzkaller0: entered promiscuous mode [ 732.521890][T26330] syzkaller0: entered allmulticast mode [ 732.733026][ C0] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 732.866924][T26360] xt_bpf: check failed: parse error [ 734.174385][T19362] Bluetooth: hci3: command tx timeout [ 736.035242][ T5908] net_ratelimit: 32 callbacks suppressed [ 736.035263][ T5908] bond10: (slave gretap0): failed to get link speed/duplex [ 736.164200][ T5908] bond9: (slave gretap0): failed to get link speed/duplex [ 736.212816][ T48] bond10: (slave gretap0): failed to get link speed/duplex [ 736.250190][T26387] netlink: 28 bytes leftover after parsing attributes in process `syz.0.6363'. [ 736.267252][T19362] Bluetooth: hci3: command tx timeout [ 736.302837][ T5908] bond9: (slave gretap0): failed to get link speed/duplex [ 736.337869][T26393] netlink: 28 bytes leftover after parsing attributes in process `syz.3.6365'. [ 736.356881][ T5908] bond10: (slave gretap0): failed to get link speed/duplex [ 736.423564][ T5908] bond9: (slave gretap0): failed to get link speed/duplex [ 736.471345][T26398] netlink: 'syz.0.6368': attribute type 1 has an invalid length. [ 736.479390][ T5908] bond10: (slave gretap0): failed to get link speed/duplex [ 736.518249][T26401] xt_hashlimit: size too large, truncated to 1048576 [ 736.527215][T26400] netlink: 48 bytes leftover after parsing attributes in process `syz.5.6366'. [ 736.548547][T26405] x_tables: ip6_tables: TCPMSS target: only valid for protocol 6 [ 736.601026][T26398] 8021q: adding VLAN 0 to HW filter on device bond1 [ 736.615186][T25390] bond10: (slave gretap0): failed to get link speed/duplex [ 736.649202][T26328] lo speed is unknown, defaulting to 1000 [ 736.704052][ T5908] bond9: (slave gretap0): failed to get link speed/duplex [ 736.802873][T25401] bond10: (slave gretap0): failed to get link speed/duplex [ 736.995784][T26422] netlink: 52 bytes leftover after parsing attributes in process `syz.0.6372'. [ 737.010211][T26417] netlink: 52 bytes leftover after parsing attributes in process `syz.0.6372'. [ 737.408161][T26434] netlink: 'syz.4.6379': attribute type 1 has an invalid length. [ 737.448176][T26435] netlink: 28 bytes leftover after parsing attributes in process `syz.5.6377'. [ 737.582821][T26328] bridge0: port 1(bridge_slave_0) entered blocking state [ 737.610265][T26328] bridge0: port 1(bridge_slave_0) entered disabled state [ 737.654832][T26328] bridge_slave_0: entered allmulticast mode [ 737.675720][T26328] bridge_slave_0: entered promiscuous mode [ 737.706525][T26328] bridge0: port 2(bridge_slave_1) entered blocking state [ 737.725100][T26328] bridge0: port 2(bridge_slave_1) entered disabled state [ 737.752879][T26328] bridge_slave_1: entered allmulticast mode [ 737.768784][T26328] bridge_slave_1: entered promiscuous mode [ 737.797690][T26438] lo speed is unknown, defaulting to 1000 [ 737.807507][T26445] xt_bpf: check failed: parse error [ 737.922073][T26328] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 737.961158][T26448] FAULT_INJECTION: forcing a failure. [ 737.961158][T26448] name failslab, interval 1, probability 0, space 0, times 0 [ 737.974857][T26448] CPU: 0 UID: 0 PID: 26448 Comm: syz.0.6383 Not tainted syzkaller #0 PREEMPT(full) [ 737.974887][T26448] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 737.974902][T26448] Call Trace: [ 737.974911][T26448] [ 737.974920][T26448] dump_stack_lvl+0xe8/0x150 [ 737.974952][T26448] should_fail_ex+0x412/0x560 [ 737.974982][T26448] should_failslab+0xa8/0x100 [ 737.975006][T26448] __kmalloc_noprof+0xe8/0x760 [ 737.975040][T26448] ? tomoyo_realpath_from_path+0xe3/0x5d0 [ 737.975071][T26448] tomoyo_realpath_from_path+0xe3/0x5d0 [ 737.975096][T26448] ? tomoyo_domain+0xd7/0x130 [ 737.975125][T26448] ? tomoyo_path_number_perm+0x219/0x630 [ 737.975158][T26448] tomoyo_path_number_perm+0x246/0x630 [ 737.975193][T26448] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 737.975223][T26448] ? __lock_acquire+0x6b5/0x2cf0 [ 737.975265][T26448] ? __mutex_unlock_slowpath+0x1be/0x6f0 [ 737.975317][T26448] ? __fget_files+0x2a/0x420 [ 737.975350][T26448] ? __fget_files+0x2a/0x420 [ 737.975377][T26448] ? __fget_files+0x3a0/0x420 [ 737.975404][T26448] ? __fget_files+0x2a/0x420 [ 737.975442][T26448] security_file_ioctl+0xc3/0x2a0 [ 737.975476][T26448] __se_sys_ioctl+0x47/0x170 [ 737.975510][T26448] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 737.975536][T26448] do_syscall_64+0x174/0x580 [ 737.975564][T26448] ? clear_bhb_loop+0x40/0x90 [ 737.975591][T26448] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 737.975615][T26448] RIP: 0033:0x7f4aacb9ce59 [ 737.975636][T26448] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 737.975656][T26448] RSP: 002b:00007f4aadb0c028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 737.975680][T26448] RAX: ffffffffffffffda RBX: 00007f4aace15fa0 RCX: 00007f4aacb9ce59 [ 737.975697][T26448] RDX: 0000200000000580 RSI: 00000000401c5820 RDI: 0000000000000007 [ 737.975712][T26448] RBP: 00007f4aadb0c090 R08: 0000000000000000 R09: 0000000000000000 [ 737.975726][T26448] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 737.975739][T26448] R13: 00007f4aace16038 R14: 00007f4aace15fa0 R15: 00007fff98d99678 [ 737.975786][T26448] [ 737.975896][T26448] ERROR: Out of memory at tomoyo_realpath_from_path. [ 738.231474][T26328] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 738.335013][T19362] Bluetooth: hci3: command tx timeout [ 738.528277][T26328] team0: Port device team_slave_0 added [ 738.549191][T26459] netlink: 12 bytes leftover after parsing attributes in process `syz.0.6386'. [ 738.638088][T26328] team0: Port device team_slave_1 added [ 738.759156][T26463] bond2 (unregistering): Released all slaves [ 738.823279][T26473] FAULT_INJECTION: forcing a failure. [ 738.823279][T26473] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 738.836915][T26473] CPU: 1 UID: 0 PID: 26473 Comm: syz.5.6390 Not tainted syzkaller #0 PREEMPT(full) [ 738.836941][T26473] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 738.836954][T26473] Call Trace: [ 738.836962][T26473] [ 738.836970][T26473] dump_stack_lvl+0xe8/0x150 [ 738.836997][T26473] should_fail_ex+0x412/0x560 [ 738.837022][T26473] _copy_from_iter+0x1d3/0x1670 [ 738.837043][T26473] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 738.837079][T26473] ? __pfx_policy_nodemask+0x10/0x10 [ 738.837098][T26473] ? trace_kmalloc+0x2a/0xf0 [ 738.837124][T26473] ? __pfx__copy_from_iter+0x10/0x10 [ 738.837148][T26473] ? alloc_pages_mpol+0x3c0/0x490 [ 738.837175][T26473] af_alg_sendmsg+0x1552/0x2650 [ 738.837216][T26473] ? __pfx_af_alg_sendmsg+0x10/0x10 [ 738.837236][T26473] ? __pfx_aa_sk_perm+0x10/0x10 [ 738.837260][T26473] ? tomoyo_socket_sendmsg_permission+0x1e0/0x300 [ 738.837297][T26473] ? aa_sock_msg_perm+0xf1/0x1b0 [ 738.837325][T26473] ? skcipher_sendmsg+0x26/0xf0 [ 738.837349][T26473] ____sys_sendmsg+0x972/0x9f0 [ 738.837371][T26473] ? __might_fault+0xaf/0x130 [ 738.837401][T26473] ? __pfx_____sys_sendmsg+0x10/0x10 [ 738.837430][T26473] ? import_iovec+0x73/0xa0 [ 738.837456][T26473] ___sys_sendmsg+0x2a5/0x360 [ 738.837476][T26473] ? __lock_acquire+0x6b5/0x2cf0 [ 738.837501][T26473] ? __pfx____sys_sendmsg+0x10/0x10 [ 738.837527][T26473] ? kstrtouint+0x6e/0xe0 [ 738.837578][T26473] ? __fget_files+0x2a/0x420 [ 738.837603][T26473] ? __fget_files+0x3a0/0x420 [ 738.837647][T26473] __sys_sendmmsg+0x27c/0x4e0 [ 738.837680][T26473] ? __pfx___sys_sendmmsg+0x10/0x10 [ 738.837710][T26473] ? __mutex_unlock_slowpath+0x1be/0x6f0 [ 738.837754][T26473] ? ksys_write+0x242/0x270 [ 738.837784][T26473] ? __pfx_ksys_write+0x10/0x10 [ 738.837818][T26473] __x64_sys_sendmmsg+0xa0/0xc0 [ 738.837841][T26473] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 738.837861][T26473] do_syscall_64+0x174/0x580 [ 738.837882][T26473] ? trace_irq_disable+0x3b/0x140 [ 738.837935][T26473] ? clear_bhb_loop+0x40/0x90 [ 738.837960][T26473] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 738.837979][T26473] RIP: 0033:0x7fe03cb9ce59 [ 738.837997][T26473] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 738.838014][T26473] RSP: 002b:00007fe03adf6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 738.838034][T26473] RAX: ffffffffffffffda RBX: 00007fe03ce15fa0 RCX: 00007fe03cb9ce59 [ 738.838047][T26473] RDX: 0000000000000001 RSI: 0000200000000040 RDI: 0000000000000004 [ 738.838058][T26473] RBP: 00007fe03adf6090 R08: 0000000000000000 R09: 0000000000000000 [ 738.838069][T26473] R10: 0000000000040800 R11: 0000000000000246 R12: 0000000000000002 [ 738.838081][T26473] R13: 00007fe03ce16038 R14: 00007fe03ce15fa0 R15: 00007ffe13e044d8 [ 738.838110][T26473] [ 739.149734][T26328] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 739.156899][T26328] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 739.185090][T26328] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 739.198643][T26328] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 739.207257][T26328] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 739.237526][T26328] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 739.289286][T26328] hsr_slave_0: entered promiscuous mode [ 739.296473][T26328] hsr_slave_1: entered promiscuous mode [ 739.303257][T26328] debugfs: 'hsr0' already exists in 'hsr' [ 739.309032][T26328] Cannot create hsr debugfs directory [ 739.520862][T26477] netlink: 28 bytes leftover after parsing attributes in process `syz.0.6391'. [ 739.564155][T26479] lo speed is unknown, defaulting to 1000 [ 739.612989][ C0] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 739.633433][T26479] lo speed is unknown, defaulting to 1000 [ 739.676553][T26483] netlink: 'syz.3.6392': attribute type 1 has an invalid length. [ 739.698134][T26479] lo speed is unknown, defaulting to 1000 [ 739.792224][T26490] netlink: 36 bytes leftover after parsing attributes in process `syz.4.6396'. [ 739.907574][T26497] netlink: 'syz.4.6396': attribute type 10 has an invalid length. [ 740.010863][T26500] netlink: 28 bytes leftover after parsing attributes in process `syz.0.6397'. [ 740.029737][T26500] netlink: 'syz.0.6397': attribute type 7 has an invalid length. [ 740.047179][T26500] netlink: 'syz.0.6397': attribute type 8 has an invalid length. [ 740.105248][T26486] bond10: (slave veth3): Enslaving as an active interface with a down link [ 740.197112][T26480] bond10: (slave veth5): Enslaving as an active interface with a down link [ 740.220857][T26494] netlink: 'syz.4.6396': attribute type 3 has an invalid length. [ 740.288990][T26328] netdevsim netdevsim2 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 740.320200][T26328] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 740.334564][T26479] infiniband syz0: set active [ 740.344338][T26479] infiniband syz0: added lo [ 740.373836][T26497] 8021q: adding VLAN 0 to HW filter on device team0 [ 740.384301][T26497] bond0: (slave team0): Enslaving as an active interface with an up link [ 740.414733][T19362] Bluetooth: hci3: command tx timeout [ 740.423700][T26500] team0: entered promiscuous mode [ 740.437885][T26500] bond0: entered promiscuous mode [ 740.453556][T26500] erspan0: entered promiscuous mode [ 740.460203][T26500] debugfs: 'hsr1' already exists in 'hsr' [ 740.483575][T26500] Cannot create hsr debugfs directory [ 740.493512][T26479] smbdirect: ib_dev[syz0]: added: IB_CA max_fast_reg_page_list_len=512 device_cap_flags=0x1c001223c76 kernel_cap_flags=0x14 page_size_cap=0xfffff000 [ 740.520283][T26500] hsr1: Slave A (team0) is not up; please bring it up to get a fully working HSR network [ 740.536304][T26500] hsr1: Slave B (bond0) is not up; please bring it up to get a fully working HSR network [ 740.547220][T26479] smbdirect: ib_dev[syz0]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=32 max_cqe=32767 max_qp_wr=1048576 max_send_sge=32 max_recv_sge=32 [ 740.583687][T26500] 8021q: adding VLAN 0 to HW filter on device hsr1 [ 740.590283][T26479] smbdirect: ib_dev[syz0]PORT[1]: iwarp=0 ib=0 roce=1 v1=0 v2=1 core_cap_flags=0x803005 [ 740.624372][ T5367] lo speed is unknown, defaulting to 1000 [ 740.725111][T26479] RDS/IB: syz0: added [ 740.756219][T26479] smc: adding ib device syz0 with port count 1 [ 740.771325][T26479] smc: ib device syz0 port 1 has no pnetid [ 740.807565][T26328] netdevsim netdevsim2 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 740.818937][T26328] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 740.877578][ T5367] lo speed is unknown, defaulting to 1000 [ 740.928437][T26479] lo speed is unknown, defaulting to 1000 [ 741.014766][T26328] netdevsim netdevsim2 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 741.044994][T26328] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 741.113899][T25404] net_ratelimit: 17 callbacks suppressed [ 741.113921][T25404] bond9: (slave gretap0): failed to get link speed/duplex [ 741.247822][T26328] netdevsim netdevsim2 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 741.271384][T26328] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 741.286163][T26528] netlink: 'syz.5.6405': attribute type 1 has an invalid length. [ 741.382826][T25404] bond9: (slave gretap0): failed to get link speed/duplex [ 741.423848][T25390] bond10: (slave gretap0): failed to get link speed/duplex [ 741.524126][T25390] bond9: (slave gretap0): failed to get link speed/duplex [ 741.545162][ C0] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 741.557582][T26479] lo speed is unknown, defaulting to 1000 [ 741.559722][T25390] bond10: (slave gretap0): failed to get link speed/duplex [ 741.665204][T26328] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 741.681108][T26328] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 741.692018][T26328] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 741.707326][T26328] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 741.720732][T26328] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 741.749476][T26328] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 741.766945][T26328] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 741.786866][T26328] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 741.991586][T26545] __nla_validate_parse: 2 callbacks suppressed [ 741.991605][T26545] netlink: 124 bytes leftover after parsing attributes in process `syz.4.6410'. [ 742.007751][ T48] bond9: (slave gretap0): failed to get link speed/duplex [ 742.073042][T25401] bond10: (slave gretap0): failed to get link speed/duplex [ 742.158704][T26328] 8021q: adding VLAN 0 to HW filter on device bond0 [ 742.203157][T25401] bond10: (slave gretap0): failed to get link speed/duplex [ 742.220965][T26552] netlink: 'syz.5.6412': attribute type 61 has an invalid length. [ 742.245790][T26328] 8021q: adding VLAN 0 to HW filter on device team0 [ 742.272894][ T5908] bond9: (slave gretap0): failed to get link speed/duplex [ 742.281530][T26479] lo speed is unknown, defaulting to 1000 [ 742.299284][ T5908] bridge0: port 1(bridge_slave_0) entered blocking state [ 742.306552][ T5908] bridge0: port 1(bridge_slave_0) entered forwarding state [ 742.369927][T26558] FAULT_INJECTION: forcing a failure. [ 742.369927][T26558] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 742.383347][ T5908] bond10: (slave gretap0): failed to get link speed/duplex [ 742.411513][ T5908] bridge0: port 2(bridge_slave_1) entered blocking state [ 742.418801][ T5908] bridge0: port 2(bridge_slave_1) entered forwarding state [ 742.448192][T26558] CPU: 0 UID: 0 PID: 26558 Comm: syz.0.6413 Not tainted syzkaller #0 PREEMPT(full) [ 742.448223][T26558] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 742.448237][T26558] Call Trace: [ 742.448247][T26558] [ 742.448257][T26558] dump_stack_lvl+0xe8/0x150 [ 742.448289][T26558] should_fail_ex+0x412/0x560 [ 742.448320][T26558] _copy_from_user+0x2d/0xb0 [ 742.448349][T26558] kstrtouint_from_user+0xd6/0x180 [ 742.448376][T26558] ? __pfx_kstrtouint_from_user+0x10/0x10 [ 742.448419][T26558] proc_fail_nth_write+0x8e/0x210 [ 742.448449][T26558] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 742.448486][T26558] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 742.448518][T26558] vfs_write+0x29a/0xb90 [ 742.448561][T26558] ? __pfx_vfs_write+0x10/0x10 [ 742.448596][T26558] ? __fget_files+0x2a/0x420 [ 742.448629][T26558] ? __fget_files+0x3a0/0x420 [ 742.448655][T26558] ? __fget_files+0x2a/0x420 [ 742.448693][T26558] ksys_write+0x150/0x270 [ 742.448729][T26558] ? __pfx_ksys_write+0x10/0x10 [ 742.448771][T26558] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 742.448796][T26558] do_syscall_64+0x174/0x580 [ 742.448821][T26558] ? trace_irq_disable+0x3b/0x140 [ 742.448854][T26558] ? clear_bhb_loop+0x40/0x90 [ 742.448890][T26558] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 742.448912][T26558] RIP: 0033:0x7f4aacb5d68e [ 742.448933][T26558] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 742.448953][T26558] RSP: 002b:00007f4aadb0bfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 742.448977][T26558] RAX: ffffffffffffffda RBX: 00007f4aadb0c6c0 RCX: 00007f4aacb5d68e [ 742.448993][T26558] RDX: 0000000000000001 RSI: 00007f4aadb0c0a0 RDI: 0000000000000004 [ 742.449007][T26558] RBP: 00007f4aadb0c090 R08: 0000000000000000 R09: 0000000000000000 [ 742.449021][T26558] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 742.449034][T26558] R13: 00007f4aace16038 R14: 00007f4aace15fa0 R15: 00007fff98d99678 [ 742.449072][T26558] [ 742.673357][T19362] Bluetooth: hci3: command tx timeout [ 743.148352][T26580] netlink: 12 bytes leftover after parsing attributes in process `syz.5.6420'. [ 743.176996][T26580] tipc: Enabling of bearer rejected, failed to enable media [ 743.320636][T26479] lo speed is unknown, defaulting to 1000 [ 743.556873][T26328] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 743.645586][T26328] veth0_vlan: entered promiscuous mode [ 743.702889][T26328] veth1_vlan: entered promiscuous mode [ 743.822386][T26328] veth0_macvtap: entered promiscuous mode [ 743.848953][T26328] veth1_macvtap: entered promiscuous mode [ 743.918471][T26328] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 743.956320][T26479] lo speed is unknown, defaulting to 1000 [ 743.976584][T26328] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 744.016575][ T48] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 744.053275][ T48] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 744.087216][ T48] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 744.111685][ T48] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 744.149406][T26617] netlink: 28 bytes leftover after parsing attributes in process `syz.5.6430'. [ 744.195006][T26617] netlink: 'syz.5.6430': attribute type 7 has an invalid length. [ 744.204253][T26617] netlink: 'syz.5.6430': attribute type 8 has an invalid length. [ 744.212275][T26617] netlink: 4 bytes leftover after parsing attributes in process `syz.5.6430'. [ 744.547286][ T48] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 744.579898][ T48] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 744.669819][T25389] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 744.699418][T25389] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 744.753422][T26479] lo speed is unknown, defaulting to 1000 [ 745.199357][T26640] bond1 (unregistering): Released all slaves [ 745.376962][T26479] lo speed is unknown, defaulting to 1000 [ 745.544786][T26651] xt_bpf: check failed: parse error [ 745.635068][T26654] netlink: 28 bytes leftover after parsing attributes in process `syz.4.6442'. [ 745.646099][T26654] netlink: 'syz.4.6442': attribute type 7 has an invalid length. [ 745.654963][T26654] netlink: 'syz.4.6442': attribute type 8 has an invalid length. [ 745.663155][T26654] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6442'. [ 745.689359][T26654] team0: entered promiscuous mode [ 745.697794][T26654] team_slave_0: entered promiscuous mode [ 745.706786][T26654] team_slave_1: entered promiscuous mode [ 745.714194][T26654] team0: left promiscuous mode [ 745.722938][T26654] team_slave_0: left promiscuous mode [ 745.728982][T26654] team_slave_1: left promiscuous mode [ 745.843566][T26479] lo speed is unknown, defaulting to 1000 [ 745.966071][T26665] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6445'. [ 746.419407][T26479] lo speed is unknown, defaulting to 1000 [ 746.433228][T25404] net_ratelimit: 47 callbacks suppressed [ 746.433248][T25404] bond10: (slave gretap0): failed to get link speed/duplex [ 746.514155][T25404] bond9: (slave gretap0): failed to get link speed/duplex [ 746.602817][T25404] bond10: (slave gretap0): failed to get link speed/duplex [ 746.644223][T25390] bond9: (slave gretap0): failed to get link speed/duplex [ 746.722723][T25404] bond10: (slave gretap0): failed to get link speed/duplex [ 746.763862][T25389] bond9: (slave gretap0): failed to get link speed/duplex [ 746.817247][T26686] xt_bpf: check failed: parse error [ 746.833232][T25389] bond10: (slave gretap0): failed to get link speed/duplex [ 746.885426][T26479] lo speed is unknown, defaulting to 1000 [ 746.894417][T25404] bond9: (slave gretap0): failed to get link speed/duplex [ 746.962698][T25404] bond10: (slave gretap0): failed to get link speed/duplex [ 747.028916][ T5908] bond9: (slave gretap0): failed to get link speed/duplex [ 747.459367][T26715] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6464'. [ 747.487662][T26715] netlink: 12 bytes leftover after parsing attributes in process `syz.2.6464'. [ 747.559498][T26479] lo speed is unknown, defaulting to 1000 [ 747.776674][T26729] netlink: 'syz.0.6470': attribute type 9 has an invalid length. [ 747.802746][T26729] netlink: 'syz.0.6470': attribute type 6 has an invalid length. [ 747.829334][T26729] netlink: 'syz.0.6470': attribute type 7 has an invalid length. [ 747.840881][T26729] netlink: 'syz.0.6470': attribute type 8 has an invalid length. [ 748.231546][T26479] lo speed is unknown, defaulting to 1000 [ 748.685818][T26737] lo speed is unknown, defaulting to 1000 [ 749.213962][T19362] Bluetooth: hci3: command tx timeout [ 749.393836][T19164] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 749.408947][T19164] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 749.444866][T19164] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 749.504536][T19164] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 749.521327][T19164] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 749.635159][T26776] xt_CONNSECMARK: invalid mode: 254 [ 750.239947][T26796] netlink: 36 bytes leftover after parsing attributes in process `syz.5.6490'. [ 750.275156][T26783] netlink: 212368 bytes leftover after parsing attributes in process `syz.2.6487'. [ 750.536213][T26802] netlink: 24 bytes leftover after parsing attributes in process `syz.0.6491'. [ 750.580031][T26802] netlink: 'syz.0.6491': attribute type 1 has an invalid length. [ 750.749229][T26816] netlink: 16 bytes leftover after parsing attributes in process `syz.4.6495'. [ 750.765964][T26802] 8021q: adding VLAN 0 to HW filter on device bond2 [ 750.779482][T26816] netlink: 'syz.4.6495': attribute type 6 has an invalid length. [ 750.826260][T26811] bridge_slave_0: left allmulticast mode [ 750.867604][T26811] bridge_slave_0: left promiscuous mode [ 750.883422][T26802] netlink: 16 bytes leftover after parsing attributes in process `syz.0.6491'. [ 750.893926][T26819] netlink: 8 bytes leftover after parsing attributes in process `syz.5.6496'. [ 750.896035][T26811] bridge0: port 1(bridge_slave_0) entered disabled state [ 750.965981][T26811] bridge_slave_1: left allmulticast mode [ 750.981614][T26811] bridge_slave_1: left promiscuous mode [ 750.997721][T26811] bridge0: port 2(bridge_slave_1) entered disabled state [ 751.007334][T26822] netlink: 'syz.4.6497': attribute type 10 has an invalid length. [ 751.016670][T26822] netlink: 55 bytes leftover after parsing attributes in process `syz.4.6497'. [ 751.038105][T26811] bond0: (slave bond_slave_0): Releasing backup interface [ 751.057226][T26811] bond0: (slave bond_slave_1): Releasing backup interface [ 751.100660][T26811] team0: Port device team_slave_0 removed [ 751.111488][T26811] team0: Port device team_slave_1 removed [ 751.118454][T26811] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 751.129544][T26811] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 751.143851][T26811] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 751.151438][T26811] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 751.180629][T26812] bond2: (slave geneve2): making interface the new active one [ 751.199170][T26812] bond2: (slave geneve2): Enslaving as an active interface with an up link [ 751.211625][T26815] netlink: 'syz.0.6491': attribute type 8 has an invalid length. [ 751.233425][T26815] sch_fq: defrate 0 ignored. [ 751.255134][T26825] syzkaller0: entered promiscuous mode [ 751.269447][T26825] syzkaller0: entered allmulticast mode [ 751.485558][T26832] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6500'. [ 751.515234][T26835] netlink: 'syz.2.6501': attribute type 7 has an invalid length. [ 751.550020][T26835] netlink: 'syz.2.6501': attribute type 8 has an invalid length. [ 751.564626][T26837] sock: sock_timestamping_bind_phc: sock not bind to device [ 751.609451][T26767] lo speed is unknown, defaulting to 1000 [ 751.737532][T19164] Bluetooth: hci1: command tx timeout [ 751.806407][T26835] team0: entered promiscuous mode [ 751.830185][T26835] bond0: entered promiscuous mode [ 751.852276][T26835] erspan0: entered promiscuous mode [ 751.878465][T26835] debugfs: 'hsr1' already exists in 'hsr' [ 751.893248][T26835] Cannot create hsr debugfs directory [ 751.904232][T26835] hsr1: Slave A (team0) is not up; please bring it up to get a fully working HSR network [ 751.918571][T26835] hsr1: Slave B (bond0) is not up; please bring it up to get a fully working HSR network [ 751.937470][T26835] 8021q: adding VLAN 0 to HW filter on device hsr1 [ 751.970592][T25402] netdevsim netdevsim0 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 751.999304][T26850] net_ratelimit: 49 callbacks suppressed [ 751.999327][T26850] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 752.015125][T25402] netdevsim netdevsim0 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 752.027012][T25402] netdevsim netdevsim0 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 752.036414][T25402] netdevsim netdevsim0 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 752.060174][T26844] netdevsim netdevsim5 netdevsim0: entered allmulticast mode [ 752.061840][T26767] lo speed is unknown, defaulting to 1000 [ 752.078308][T26844] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 752.192871][T25401] bond9: (slave gretap0): failed to get link speed/duplex [ 752.254755][ T180] bond10: (slave gretap0): failed to get link speed/duplex [ 752.688307][T26875] __nla_validate_parse: 4 callbacks suppressed [ 752.688339][T26875] netlink: 24 bytes leftover after parsing attributes in process `syz.2.6510'. [ 752.754391][T26880] netlink: 8 bytes leftover after parsing attributes in process `syz.5.6512'. [ 753.144674][T25404] bond0 (unregistering): Released all slaves [ 753.156578][T25404] bond1 (unregistering): Released all slaves [ 753.173406][T25404] bond2 (unregistering): Released all slaves [ 753.202177][T25404] bond3 (unregistering): Released all slaves [ 753.225058][T25404] bond4 (unregistering): Released all slaves [ 753.241546][T25404] bond5 (unregistering): Released all slaves [ 753.258811][T25404] bond6 (unregistering): Released all slaves [ 753.288241][T25404] bond7 (unregistering): Released all slaves [ 753.307045][T25404] bond8 (unregistering): Released all slaves [ 753.323707][T25404] bond9 (unregistering): Released all slaves [ 753.341489][T25404] bond10 (unregistering): (slave veth3): Releasing active interface [ 753.352889][T25404] bond10 (unregistering): (slave veth5): Releasing active interface [ 753.372628][T25404] bond10 (unregistering): Released all slaves [ 753.468336][ T5296] 8021q: adding VLAN 0 to HW filter on device eth1 [ 753.507023][ T138] bond10: (slave gretap0): failed to get link speed/duplex [ 753.668727][T26882] lo speed is unknown, defaulting to 1000 [ 753.668802][T25404] tipc: Left network mode [ 753.676932][T25390] bond10: (slave gretap0): failed to get link speed/duplex [ 753.706204][ C0] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 753.769369][T26902] netlink: 28 bytes leftover after parsing attributes in process `syz.2.6516'. [ 753.778844][T19164] Bluetooth: hci1: command tx timeout [ 753.784696][T26902] netlink: 'syz.2.6516': attribute type 7 has an invalid length. [ 753.798165][T26902] netlink: 'syz.2.6516': attribute type 8 has an invalid length. [ 753.798960][T26882] lo speed is unknown, defaulting to 1000 [ 753.860068][T26902] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6516'. [ 754.033039][T25399] bond9: (slave gretap0): failed to get link speed/duplex [ 754.653532][T26925] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 754.770626][T26924] tap0: tun_chr_ioctl cmd 1074025677 [ 754.802881][T26933] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6522'. [ 754.803169][T26924] tap0: linktype set to 774 [ 754.876613][ T138] bond9: (slave gretap0): failed to get link speed/duplex [ 755.852844][T19164] Bluetooth: hci1: command tx timeout [ 756.207395][T26978] IPVS: length: 24 != 73656 [ 756.219789][T26978] netlink: 8 bytes leftover after parsing attributes in process `syz.5.6526'. [ 756.734685][T25400] smc: removing ib device syz0 [ 756.749795][ T5296] 8021q: adding VLAN 0 to HW filter on device eth2 [ 756.810057][T25400] smbdirect: ib_dev[syz0] removed [ 756.820067][T13555] lo speed is unknown, defaulting to 1000 [ 756.830794][T25389] bond9: (slave gretap0): failed to get link speed/duplex [ 756.851189][T13555] syz0: Port: 1 Link DOWN [ 756.899400][ C0] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 757.598969][T27003] A link change request failed with some changes committed already. Interface erspan0 may have been left with an inconsistent configuration, please check. [ 757.700046][T26767] bridge0: port 1(bridge_slave_0) entered blocking state [ 757.727402][T26767] bridge0: port 1(bridge_slave_0) entered disabled state [ 757.756464][T26767] bridge_slave_0: entered allmulticast mode [ 757.815230][T26767] bridge_slave_0: entered promiscuous mode [ 757.871609][T26767] bridge0: port 2(bridge_slave_1) entered blocking state [ 757.894576][T26767] bridge0: port 2(bridge_slave_1) entered disabled state [ 757.922220][T26767] bridge_slave_1: entered allmulticast mode [ 757.935376][T19164] Bluetooth: hci1: command tx timeout [ 757.954088][T27016] netlink: 24 bytes leftover after parsing attributes in process `syz.2.6532'. [ 757.977712][T26767] bridge_slave_1: entered promiscuous mode [ 758.353340][T27023] xt_hashlimit: size too large, truncated to 1048576 [ 758.427012][T25401] bond10: (slave gretap0): failed to get link speed/duplex [ 758.448775][T27030] x_tables: ip6_tables: TCPMSS target: only valid for protocol 6 [ 758.464263][T25401] bond9: (slave gretap0): failed to get link speed/duplex [ 758.583980][T25401] bond10: (slave gretap0): failed to get link speed/duplex [ 758.628827][T26767] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 758.693704][T27037] netlink: 12 bytes leftover after parsing attributes in process `syz.2.6536'. [ 758.704918][T26767] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 758.755335][T27037] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6536'. [ 758.813795][ C0] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 759.352120][T26767] team0: Port device team_slave_0 added [ 759.421350][T26767] team0: Port device team_slave_1 added [ 759.592138][ T5296] 8021q: adding VLAN 0 to HW filter on device eth3 [ 759.624318][T27057] 8021q: VLANs not supported on ip_vti0 [ 759.765875][T26767] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 759.796431][T26767] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 759.899680][T27070] netlink: 52 bytes leftover after parsing attributes in process `syz.0.6542'. [ 759.916440][T26767] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 759.942748][T27072] xt_bpf: check failed: parse error [ 759.948483][T26767] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 759.966666][T26767] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 760.042912][T26767] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 760.093670][ C0] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 760.147450][T27078] netlink: 12 bytes leftover after parsing attributes in process `syz.2.6545'. [ 760.195503][T27081] netlink: 12 bytes leftover after parsing attributes in process `syz.2.6545'. [ 760.208203][T25401] bond9: (slave gretap0): failed to get link speed/duplex [ 760.397052][T25401] bond9: (slave gretap0): failed to get link speed/duplex [ 760.933702][T26767] hsr_slave_0: entered promiscuous mode [ 760.969245][T26767] hsr_slave_1: entered promiscuous mode [ 760.993644][T26767] debugfs: 'hsr0' already exists in 'hsr' [ 761.005701][T26767] Cannot create hsr debugfs directory [ 761.022871][ T48] bond9: (slave gretap0): failed to get link speed/duplex [ 761.077003][T27106] xt_nfacct: accounting object `syz0' does not exist [ 761.723674][T27107] lo speed is unknown, defaulting to 1000 [ 761.858748][T27122] A link change request failed with some changes committed already. Interface erspan0 may have been left with an inconsistent configuration, please check. [ 762.080448][ T5296] 8021q: adding VLAN 0 to HW filter on device eth4 [ 762.435173][ T180] bond10: (slave gretap0): failed to get link speed/duplex [ 762.446750][T27141] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 763.924331][ T36] bond10: (slave gretap0): failed to get link speed/duplex [ 763.946335][T25404] IPVS: stop unused estimator thread 0... [ 764.083112][ T36] bond10: (slave gretap0): failed to get link speed/duplex [ 764.114438][ T180] bond9: (slave gretap0): failed to get link speed/duplex [ 764.395961][T25402] bond10: (slave gretap0): failed to get link speed/duplex [ 764.424175][T25402] bond9: (slave gretap0): failed to get link speed/duplex [ 764.527349][T25401] bond10: (slave gretap0): failed to get link speed/duplex [ 764.557819][T25390] bond9: (slave gretap0): failed to get link speed/duplex [ 764.658396][T25401] bond10: (slave gretap0): failed to get link speed/duplex [ 764.714103][T25399] bond9: (slave gretap0): failed to get link speed/duplex [ 764.792737][T25390] bond10: (slave gretap0): failed to get link speed/duplex [ 765.622035][T27213] netlink: 750 bytes leftover after parsing attributes in process `syz.5.6563'. [ 770.322548][ C1] sched: DL replenish lagged too much [ 775.660707][T25389] net_ratelimit: 12 callbacks suppressed [ 775.660732][T25389] bond9: (slave gretap0): failed to get link speed/duplex [ 777.788135][T25398] bond10: (slave gretap0): failed to get link speed/duplex [ 783.778311][ C0] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 792.747116][T25405] bond9: (slave gretap0): failed to get link speed/duplex [ 795.303341][ C0] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 801.367689][T25392] bond10: (slave gretap0): failed to get link speed/duplex [ 811.793623][ T5894] bond9: (slave gretap0): failed to get link speed/duplex [ 816.352427][T19362] Bluetooth: hci2: command 0x0405 tx timeout [ 818.978511][ C0] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 820.231075][ T5912] bond10: (slave gretap0): failed to get link speed/duplex [ 824.100998][ C0] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 843.782838][ T5652] Bluetooth: hci5: command 0x0406 tx timeout [ 844.578302][ C0] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 870.186830][ C0] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 906.033243][ C0] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 912.602473][ C1] rcu: INFO: rcu_preempt detected stalls on CPUs/tasks: [ 912.609490][ C1] rcu: Tasks blocked on level-0 rcu_node (CPUs 0-1): P23603/1:b..l P25897/1:b..l [ 912.619328][ C1] rcu: (detected by 1, t=10502 jiffies, g=150981, q=733955 ncpus=2) [ 912.627448][ C1] task:syz-executor state:R running task stack:22392 pid:25897 tgid:25897 ppid:25886 task_flags:0x400140 flags:0x00080000 [ 912.642554][ C1] Call Trace: [ 912.645901][ C1] [ 912.648887][ C1] __schedule+0x1821/0x5740 [ 912.653466][ C1] ? is_bpf_text_address+0x26/0x2b0 [ 912.658719][ C1] ? kernel_text_address+0xa5/0xe0 [ 912.663911][ C1] ? unwind_get_return_address+0x4d/0x90 [ 912.669606][ C1] ? __pfx___schedule+0x10/0x10 [ 912.674498][ C1] ? __lock_acquire+0x6b5/0x2cf0 [ 912.679508][ C1] preempt_schedule_irq+0x4d/0xa0 [ 912.684577][ C1] irqentry_exit+0x14f/0x8b0 [ 912.689248][ C1] ? trace_irq_disable+0x3b/0x140 [ 912.694718][ C1] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 912.700747][ C1] RIP: 0010:__update_page_owner_free_handle+0xe2/0x470 [ 912.707652][ C1] Code: be 48 03 00 00 48 c7 c2 a0 55 dd 8b e8 07 1d 67 ff 48 bb 00 00 00 00 00 fc ff df 48 c7 c0 10 1f 26 8e 48 c1 e8 03 80 3c 18 00 <74> 0c 48 c7 c7 10 1f 26 8e e8 00 3e f6 ff 4c 2b 25 99 4d eb 0b 49 [ 912.727311][ C1] RSP: 0018:ffffc900068c7728 EFLAGS: 00000246 [ 912.733431][ C1] RAX: 1ffffffff1c4c3e2 RBX: dffffc0000000000 RCX: ffff888061cb3e00 [ 912.741539][ C1] RDX: 0000000000000000 RSI: ffffffff8c28b9c0 RDI: ffffffff8c28b980 [ 912.749562][ C1] RBP: 0000000000000002 R08: ffffffff823ad0ae R09: ffffffff8e95cc20 [ 912.757572][ C1] R10: 000000000000000d R11: ffffffff81b0e0e0 R12: ffffea0001319a00 [ 912.765582][ C1] R13: 1ffffd4000263341 R14: ffffffff823ad0ae R15: 000000bb7f2ba6f1 [ 912.773600][ C1] ? __update_page_owner_free_handle+0x2e/0x470 [ 912.779897][ C1] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 912.786111][ C1] ? __update_page_owner_free_handle+0x2e/0x470 [ 912.792415][ C1] ? __update_page_owner_free_handle+0x71/0x470 [ 912.798713][ C1] __reset_page_owner+0x85/0x1f0 [ 912.803814][ C1] __free_frozen_pages+0xc1c/0xd30 [ 912.808989][ C1] __slab_free+0x274/0x2c0 [ 912.813477][ C1] qlist_free_all+0x99/0x100 [ 912.818113][ C1] kasan_quarantine_reduce+0x148/0x160 [ 912.823622][ C1] __kasan_slab_alloc+0x22/0x80 [ 912.828521][ C1] __kmalloc_noprof+0x316/0x760 [ 912.833420][ C1] ? tomoyo_encode+0x28b/0x550 [ 912.838226][ C1] ? __kmalloc_noprof+0x1b8/0x760 [ 912.843318][ C1] tomoyo_encode+0x28b/0x550 [ 912.847956][ C1] tomoyo_realpath_from_path+0x58d/0x5d0 [ 912.853642][ C1] tomoyo_path_perm+0x283/0x560 [ 912.858548][ C1] ? tomoyo_path_perm+0x251/0x560 [ 912.863621][ C1] ? __pfx_tomoyo_path_perm+0x10/0x10 [ 912.869036][ C1] ? __x64_sys_openat+0x138/0x170 [ 912.874158][ C1] security_inode_getattr+0x12b/0x310 [ 912.879585][ C1] __x64_sys_newfstat+0x13b/0x270 [ 912.884672][ C1] ? __pfx___x64_sys_newfstat+0x10/0x10 [ 912.890298][ C1] ? rcu_is_watching+0x15/0xb0 [ 912.895127][ C1] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 912.901238][ C1] do_syscall_64+0x174/0x580 [ 912.905880][ C1] ? trace_irq_disable+0x3b/0x140 [ 912.910954][ C1] ? clear_bhb_loop+0x40/0x90 [ 912.915673][ C1] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 912.921604][ C1] RIP: 0033:0x7faf18d9b467 [ 912.926056][ C1] RSP: 002b:00007ffdb9f82c68 EFLAGS: 00000206 ORIG_RAX: 0000000000000005 [ 912.934600][ C1] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007faf18d9b467 [ 912.942612][ C1] RDX: 0000000000000000 RSI: 00007ffdb9f82c70 RDI: 0000000000000003 [ 912.950721][ C1] RBP: 00007ffdb9f83e5c R08: 0000000000000000 R09: 0000000000000000 [ 912.958817][ C1] R10: 0000000000000000 R11: 0000000000000206 R12: 00007ffdb9f83e70 [ 912.966910][ C1] R13: 00007faf18e321ca R14: 00000000000bd9ab R15: 00007ffdb9f83eb0 [ 912.974947][ C1] [ 912.977998][ C1] task:syz-executor state:R running task stack:22040 pid:23603 tgid:23603 ppid:23602 task_flags:0x400140 flags:0x00080000 [ 912.991540][ C1] Call Trace: [ 912.995148][ C1] [ 912.998114][ C1] __schedule+0x1821/0x5740 [ 913.002670][ C1] ? __lock_acquire+0x6b5/0x2cf0 [ 913.007672][ C1] ? __lock_acquire+0x6b5/0x2cf0 [ 913.012667][ C1] ? __pfx___schedule+0x10/0x10 [ 913.017561][ C1] ? lockdep_hardirqs_on+0x7a/0x110 [ 913.022810][ C1] ? irqentry_exit+0x218/0x8b0 [ 913.027641][ C1] preempt_schedule_notrace+0x57/0x90 [ 913.033407][ C1] preempt_schedule_notrace_thunk+0x16/0x30 [ 913.039356][ C1] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 913.045744][ C1] ? is_module_text_address+0x1d/0x1e0 [ 913.051282][ C1] rcu_is_watching+0x7f/0xb0 [ 913.055950][ C1] ? is_module_text_address+0x1d/0x1e0 [ 913.061486][ C1] is_module_text_address+0x147/0x1e0 [ 913.067013][ C1] kernel_text_address+0x94/0xe0 [ 913.072012][ C1] __kernel_text_address+0xd/0x30 [ 913.077089][ C1] unwind_get_return_address+0x4d/0x90 [ 913.082596][ C1] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 913.088816][ C1] arch_stack_walk+0xfb/0x150 [ 913.093999][ C1] stack_trace_save+0xa9/0x100 [ 913.098818][ C1] ? __pfx_stack_trace_save+0x10/0x10 [ 913.104347][ C1] save_stack+0x122/0x230 [ 913.108734][ C1] ? __pfx_save_stack+0x10/0x10 [ 913.113643][ C1] ? __free_frozen_pages+0xc1c/0xd30 [ 913.118991][ C1] ? __slab_free+0x274/0x2c0 [ 913.123637][ C1] ? qlist_free_all+0x99/0x100 [ 913.128451][ C1] ? kasan_quarantine_reduce+0x148/0x160 [ 913.134131][ C1] ? __kasan_slab_alloc+0x22/0x80 [ 913.139205][ C1] ? __kmalloc_noprof+0x316/0x760 [ 913.144276][ C1] ? tomoyo_encode+0x28b/0x550 [ 913.149086][ C1] ? tomoyo_realpath_from_path+0x58d/0x5d0 [ 913.154931][ C1] ? tomoyo_path_perm+0x283/0x560 [ 913.160005][ C1] ? security_inode_getattr+0x12b/0x310 [ 913.165601][ C1] ? __x64_sys_newfstat+0x13b/0x270 [ 913.170913][ C1] ? do_syscall_64+0x174/0x580 [ 913.175733][ C1] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 913.181876][ C1] __reset_page_owner+0x71/0x1f0 [ 913.186886][ C1] __free_frozen_pages+0xc1c/0xd30 [ 913.192067][ C1] __slab_free+0x274/0x2c0 [ 913.196549][ C1] qlist_free_all+0x99/0x100 [ 913.201239][ C1] kasan_quarantine_reduce+0x148/0x160 [ 913.206769][ C1] __kasan_slab_alloc+0x22/0x80 [ 913.211701][ C1] __kmalloc_noprof+0x316/0x760 [ 913.216805][ C1] ? tomoyo_encode+0x28b/0x550 [ 913.221705][ C1] ? __kmalloc_noprof+0x1b8/0x760 [ 913.227345][ C1] tomoyo_encode+0x28b/0x550 [ 913.232685][ C1] tomoyo_realpath_from_path+0x58d/0x5d0 [ 913.238384][ C1] tomoyo_path_perm+0x283/0x560 [ 913.243378][ C1] ? tomoyo_path_perm+0x251/0x560 [ 913.248466][ C1] ? __pfx_tomoyo_path_perm+0x10/0x10 [ 913.253881][ C1] ? __x64_sys_openat+0x138/0x170 [ 913.259092][ C1] security_inode_getattr+0x12b/0x310 [ 913.265050][ C1] __x64_sys_newfstat+0x13b/0x270 [ 913.270215][ C1] ? __pfx___x64_sys_newfstat+0x10/0x10 [ 913.276009][ C1] ? rcu_is_watching+0x15/0xb0 [ 913.281106][ C1] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 913.287230][ C1] do_syscall_64+0x174/0x580 [ 913.291873][ C1] ? trace_irq_disable+0x3b/0x140 [ 913.296957][ C1] ? clear_bhb_loop+0x40/0x90 [ 913.301718][ C1] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 913.307661][ C1] RIP: 0033:0x7fe03cb9b467 [ 913.312124][ C1] RSP: 002b:00007ffe13e03688 EFLAGS: 00000206 ORIG_RAX: 0000000000000005 [ 913.320581][ C1] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fe03cb9b467 [ 913.328596][ C1] RDX: 0000000000000000 RSI: 00007ffe13e03690 RDI: 0000000000000003 [ 913.336703][ C1] RBP: 00007ffe13e0487c R08: 0000000000000000 R09: 0000000000000000 [ 913.344899][ C1] R10: 0000000000000000 R11: 0000000000000206 R12: 00007ffe13e04890 [ 913.352914][ C1] R13: 00007fe03cc321ca R14: 00000000000baff4 R15: 00007ffe13e048d0 [ 913.360957][ C1] [ 913.364014][ C1] rcu: rcu_preempt kthread starved for 7783 jiffies! g150981 f0x2 RCU_GP_WAIT_FQS(5) ->state=0x0 ->cpu=0 [ 913.375252][ C1] rcu: Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior. [ 913.385358][ C1] rcu: RCU grace-period kthread stack dump: [ 913.391466][ C1] task:rcu_preempt state:R running task stack:27544 pid:16 tgid:16 ppid:2 task_flags:0x208040 flags:0x00080000 [ 913.405019][ C1] Call Trace: [ 913.408346][ C1] [ 913.411321][ C1] __schedule+0x1821/0x5740 [ 913.415869][ C1] ? __lock_acquire+0x6b5/0x2cf0 [ 913.420901][ C1] ? __pfx___schedule+0x10/0x10 [ 913.425815][ C1] ? schedule+0x90/0x360 [ 913.430116][ C1] schedule+0x164/0x360 [ 913.434327][ C1] schedule_timeout+0x158/0x2c0 [ 913.439237][ C1] ? __pfx_schedule_timeout+0x10/0x10 [ 913.444662][ C1] ? __pfx_process_timeout+0x10/0x10 [ 913.450062][ C1] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 913.455916][ C1] ? prepare_to_swait_event+0x340/0x370 [ 913.461531][ C1] rcu_gp_fqs_loop+0x312/0x11d0 [ 913.466455][ C1] ? __pfx_rcu_watching_snap_recheck+0x10/0x10 [ 913.472709][ C1] ? __pfx_rcu_gp_fqs_loop+0x10/0x10 [ 913.478067][ C1] ? _raw_spin_unlock_irq+0x2e/0x50 [ 913.483347][ C1] rcu_gp_kthread+0x9e/0x2b0 [ 913.488010][ C1] ? __pfx_rcu_gp_kthread+0x10/0x10 [ 913.493266][ C1] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 913.499138][ C1] ? __kthread_parkme+0x7a/0x1f0 [ 913.504223][ C1] ? __kthread_parkme+0x19c/0x1f0 [ 913.509317][ C1] kthread+0x389/0x470 [ 913.513453][ C1] ? __pfx_rcu_gp_kthread+0x10/0x10 [ 913.518725][ C1] ? __pfx_kthread+0x10/0x10 [ 913.523385][ C1] ret_from_fork+0x514/0xb70 [ 913.528047][ C1] ? __pfx_ret_from_fork+0x10/0x10 [ 913.533225][ C1] ? __switch_to+0xc79/0x1410 [ 913.537976][ C1] ? __pfx_kthread+0x10/0x10 [ 913.542628][ C1] ret_from_fork_asm+0x1a/0x30 [ 913.547472][ C1] [ 913.550539][ C1] rcu: Stack dump where RCU GP kthread last ran: [ 913.556919][ C1] Sending NMI from CPU 1 to CPUs 0: [ 913.562187][ C0] NMI backtrace for cpu 0 [ 913.562210][ C0] CPU: 0 UID: 0 PID: 25438 Comm: kworker/R-bond1 Not tainted syzkaller #0 PREEMPT(full) [ 913.562245][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 913.562265][ C0] Workqueue: bond16 bond_3ad_state_machine_handler [ 913.562402][ C0] RIP: 0010:lock_acquire+0x58/0x350 [ 913.562431][ C0] Code: 8b 05 ec ab 97 11 48 89 44 24 58 0f 1f 44 00 00 65 8b 05 ef ab 97 11 83 f8 08 0f 83 83 01 00 00 89 c0 48 0f a3 05 98 f9 8e 0e <73> 0d e8 91 28 09 00 84 c0 0f 84 ca 01 00 00 83 3d 72 2c 8f 0e 00 [ 913.562450][ C0] RSP: 0018:ffffc90000006df8 EFLAGS: 00000293 [ 913.562467][ C0] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000002 [ 913.562480][ C0] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffffff8e95cc20 [ 913.562494][ C0] RBP: ffffffff8176e256 R08: 0000000000000000 R09: 0000000000000000 [ 913.562508][ C0] R10: ffffc90000006fb8 R11: ffffffff81b0e0e0 R12: 0000000000000002 [ 913.562523][ C0] R13: ffffffff8e95cc20 R14: 0000000000000000 R15: 0000000000000000 [ 913.562537][ C0] FS: 0000000000000000(0000) GS:ffff88812528b000(0000) knlGS:0000000000000000 [ 913.562554][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 913.562570][ C0] CR2: 00007fa201713d47 CR3: 000000007a600000 CR4: 00000000003526f0 [ 913.562590][ C0] Call Trace: [ 913.562598][ C0] [ 913.562612][ C0] ? unwind_next_frame+0xa6/0x2550 [ 913.562638][ C0] ? kasan_save_stack+0x3e/0x60 [ 913.562668][ C0] ? unwind_next_frame+0xa6/0x2550 [ 913.562692][ C0] unwind_next_frame+0xc3/0x2550 [ 913.562716][ C0] ? unwind_next_frame+0xa6/0x2550 [ 913.562745][ C0] ? unwind_next_frame+0xa6/0x2550 [ 913.562770][ C0] ? stack_trace_save+0xa9/0x100 [ 913.562799][ C0] ? kasan_save_stack+0x3e/0x60 [ 913.562830][ C0] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 913.562863][ C0] arch_stack_walk+0x11b/0x150 [ 913.562894][ C0] ? kasan_save_stack+0x3e/0x60 [ 913.562925][ C0] stack_trace_save+0xa9/0x100 [ 913.562957][ C0] ? __pfx_stack_trace_save+0x10/0x10 [ 913.562995][ C0] kasan_save_stack+0x3e/0x60 [ 913.563022][ C0] ? kasan_save_stack+0x3e/0x60 [ 913.563084][ C0] kasan_record_aux_stack+0xbd/0xd0 [ 913.563109][ C0] ? __pfx_dst_destroy_rcu+0x10/0x10 [ 913.563172][ C0] call_rcu+0xee/0x890 [ 913.563201][ C0] ? dst_release+0x126/0x1b0 [ 913.563230][ C0] skb_release_head_state+0x71/0x360 [ 913.563256][ C0] __kfree_skb+0x24/0x210 [ 913.563278][ C0] nft_synproxy_eval_v4+0x352/0x4e0 [ 913.563383][ C0] ? __pfx_nft_synproxy_eval_v4+0x10/0x10 [ 913.563416][ C0] ? nf_ip_checksum+0x13c/0x510 [ 913.563478][ C0] nft_synproxy_do_eval+0x305/0x580 [ 913.563513][ C0] ? __pfx_nft_synproxy_do_eval+0x10/0x10 [ 913.563548][ C0] ? __lock_acquire+0x6b5/0x2cf0 [ 913.563575][ C0] nft_do_chain+0x48d/0x1ae0 [ 913.563662][ C0] ? lock_acquire+0x106/0x350 [ 913.563688][ C0] ? __pfx_nft_do_chain+0x10/0x10 [ 913.563724][ C0] ? ipt_do_table+0x2b2/0x1630 [ 913.563785][ C0] ? nf_nat_inet_fn+0x95b/0xbf0 [ 913.563814][ C0] nft_do_chain_inet+0x360/0x4b0 [ 913.563892][ C0] ? __pfx_nft_do_chain_inet+0x10/0x10 [ 913.563922][ C0] ? ipt_do_table+0x2b2/0x1630 [ 913.563948][ C0] ? nf_nat_ipv4_local_in+0x223/0x720 [ 913.563976][ C0] ? __pfx_nft_do_chain_inet+0x10/0x10 [ 913.564008][ C0] nf_hook_slow+0xc5/0x220 [ 913.564039][ C0] NF_HOOK+0x21f/0x3c0 [ 913.564095][ C0] ? __pfx_ip_local_deliver_finish+0x10/0x10 [ 913.564121][ C0] ? NF_HOOK+0x9e/0x3c0 [ 913.564144][ C0] ? __pfx_NF_HOOK+0x10/0x10 [ 913.564167][ C0] ? ip_rcv_finish_core+0xda3/0x1c00 [ 913.564196][ C0] ? __pfx_ip_local_deliver_finish+0x10/0x10 [ 913.564226][ C0] ? ip_local_deliver+0x12a/0x1b0 [ 913.564253][ C0] NF_HOOK+0x336/0x3c0 [ 913.564279][ C0] ? __pfx_ip_rcv_finish+0x10/0x10 [ 913.564303][ C0] ? NF_HOOK+0x9e/0x3c0 [ 913.564333][ C0] ? __pfx_NF_HOOK+0x10/0x10 [ 913.564359][ C0] ? __pfx_ip_rcv_finish+0x10/0x10 [ 913.564388][ C0] ? __pfx_ip_rcv+0x10/0x10 [ 913.564412][ C0] ? __pfx_ip_rcv+0x10/0x10 [ 913.564435][ C0] ? process_backlog+0x3eb/0x1950 [ 913.564454][ C0] process_backlog+0xaa3/0x1950 [ 913.564486][ C0] __napi_poll+0xae/0x340 [ 913.564538][ C0] ? skb_defer_free_flush+0x233/0x260 [ 913.564571][ C0] net_rx_action+0x627/0xf70 [ 913.564600][ C0] ? __pfx_net_rx_action+0x10/0x10 [ 913.564629][ C0] ? sched_balance_domains+0x7ea/0x900 [ 913.564660][ C0] handle_softirqs+0x22a/0x840 [ 913.564683][ C0] ? do_softirq+0x76/0xd0 [ 913.564706][ C0] ? bond_3ad_state_machine_handler+0x5907/0x5bf0 [ 913.564739][ C0] do_softirq+0x76/0xd0 [ 913.564758][ C0] [ 913.564766][ C0] [ 913.564774][ C0] __local_bh_enable_ip+0xf8/0x130 [ 913.564795][ C0] bond_3ad_state_machine_handler+0x5907/0x5bf0 [ 913.564836][ C0] ? lock_acquire+0x106/0x350 [ 913.564859][ C0] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 913.564888][ C0] ? bond_3ad_state_machine_handler+0xd0/0x5bf0 [ 913.564921][ C0] ? __pfx_bond_3ad_state_machine_handler+0x10/0x10 [ 913.564953][ C0] ? process_scheduled_works+0xa70/0x1860 [ 913.564980][ C0] ? process_scheduled_works+0xa70/0x1860 [ 913.565000][ C0] ? process_scheduled_works+0xa70/0x1860 [ 913.565023][ C0] process_scheduled_works+0xb5d/0x1860 [ 913.565064][ C0] ? __pfx_process_scheduled_works+0x10/0x10 [ 913.565084][ C0] ? do_raw_spin_lock+0x12b/0x2f0 [ 913.565124][ C0] rescuer_thread+0x827/0x1130 [ 913.565156][ C0] ? rescuer_thread+0xbb/0x1130 [ 913.565191][ C0] kthread+0x389/0x470 [ 913.565218][ C0] ? __pfx_rescuer_thread+0x10/0x10 [ 913.565241][ C0] ? __pfx_kthread+0x10/0x10 [ 913.565268][ C0] ret_from_fork+0x514/0xb70 [ 913.565291][ C0] ? __pfx_ret_from_fork+0x10/0x10 [ 913.565312][ C0] ? __switch_to+0xc79/0x1410 [ 913.565368][ C0] ? __pfx_kthread+0x10/0x10 [ 913.565395][ C0] ret_from_fork_asm+0x1a/0x30 [ 913.565430][ C0]