last executing test programs: 6.600360759s ago: executing program 3 (id=7919): sendmsg$IPCTNL_MSG_EXP_NEW(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000000)={0xb0, 0x0, 0x2, 0x301, 0x0, 0x0, {0x7, 0x0, 0x10}, [@CTA_EXPECT_NAT={0x40, 0xa, 0x0, 0x1, [@CTA_EXPECT_NAT_TUPLE={0x2c, 0x2, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x3a}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x4}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x2}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x21}}]}, @CTA_EXPECT_NAT_DIR={0x8}, @CTA_EXPECT_NAT_DIR={0x8, 0x1, 0x1, 0x0, 0x1}]}, @CTA_EXPECT_NAT={0x5c, 0xa, 0x0, 0x1, [@CTA_EXPECT_NAT_TUPLE={0x4c, 0x2, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @ipv4={'\x00', '\xff\xff', @broadcast}}, {0x14, 0x4, @mcast1}}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x4}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x4}]}, @CTA_EXPECT_NAT_TUPLE={0xc, 0x2, 0x0, 0x1, [@CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x4}]}]}]}, 0xb0}, 0x1, 0x0, 0x0, 0x40010}, 0x4008000) r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000140)={0x0, 0x6}, 0x4) r1 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000000)={0x0, 0xb007}, 0x4) r2 = socket(0x10, 0x803, 0x0) r3 = socket$inet6_mptcp(0xa, 0x1, 0x106) socketpair(0x2c, 0x3, 0x0, &(0x7f0000000740)) connect$inet6(r3, &(0x7f0000000000)={0xa, 0x4001, 0x1, @dev={0xfe, 0x80, '\x00', 0x39}, 0x3e}, 0x1c) syz_emit_ethernet(0x4e, &(0x7f0000000080)=ANY=[@ANYBLOB="0180c2000000aaaaaaaaaaaa86dd6080a08300180000fc010000000000", @ANYRESHEX, @ANYBLOB="456a0be670ac321dc2"], 0x0) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)=@base={0x8, 0x4, 0x4, 0x4}, 0x48) bpf$BPF_MAP_LOOKUP_AND_DELETE_ELEM(0x15, &(0x7f0000000200)={r4, &(0x7f00000000c0), 0x0}, 0x20) setsockopt$inet6_tcp_TCP_CONGESTION(r3, 0x6, 0xd, &(0x7f0000000040)='highspeed', 0x6) sendto(r2, &(0x7f0000000c40)="120000001200e7ef007b0000000000faffa0", 0x12, 0x8800, 0x0, 0x0) r5 = syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/time_for_children\x00') ioctl$EXT4_IOC_SETFSUUID(r5, 0x4008662c, 0x0) 6.287348953s ago: executing program 3 (id=7925): getsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x11, &(0x7f0000000000), &(0x7f0000000040)=0x4) r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_STAT_DEL(r0, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x50, 0x1412, 0x400, 0x70bd2d, 0x25dfdbfd, "", [@RDMA_NLDEV_ATTR_RES_LQPN={0x8, 0x15, 0x4}, @RDMA_NLDEV_ATTR_STAT_COUNTER_ID={0x8, 0x4f, 0x1}, @RDMA_NLDEV_ATTR_STAT_COUNTER_ID={0x8, 0x4f, 0x5}, @RDMA_NLDEV_ATTR_RES_LQPN={0x8}, @RDMA_NLDEV_ATTR_RES_LQPN={0x8, 0x15, 0x4}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x1}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x2}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8}]}, 0x50}, 0x1, 0x0, 0x0, 0x4000}, 0x4000) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(r0, 0xd000943d, &(0x7f00000001c0)={0xbe3, [{}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0}], 0xb8, "b3386c7bd70294"}) ioctl$BTRFS_IOC_TREE_SEARCH_V2(r0, 0xc0709411, &(0x7f00000011c0)={{r1, 0x5222f9e2, 0x5, 0x9, 0x401, 0x8000000000000000, 0x4, 0x4, 0x40000, 0x0, 0x7, 0x3, 0xfff, 0xd7a2, 0x68e}, 0x38, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) shutdown(r0, 0x1) r2 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000001280)='memory.swap.current\x00', 0x0, 0x0) recvfrom$x25(r2, &(0x7f00000012c0)=""/227, 0xe3, 0x0, &(0x7f00000013c0), 0x12) getsockopt$inet_sctp_SCTP_GET_LOCAL_ADDRS(r2, 0x84, 0x6d, &(0x7f0000001400)={0x0, 0x1000, "c0daccc38133340eef7ea8a69ca888def8e5b0a8ef726ac412f93a658c0607a362aac738ad880c763bcb9f3013bf92fa58a897830c552db54334f6e31de2b3de42952878ecf1c8da0e96f709aebf248000420f8cf3ec03a0ad153a1cc20f619cfe5511fd0b0a2d811f8f30dbfda792950fd75276cb60c3ec00efb5015be65996ccf23580ab580202497dd1bb650cf3324446266f022244cf51f8e7983df2ba0a289dbd23f90e740904e639afd9fff6ddee216917c905aa4acc39c929834f426b9f59e71626a0975c42ea9e1b109ca0b55c023732f73ca1368b63e23749cce100d5b5b29cbdbb6d7d934be6b928bcc5c209e3324da3f527ad2f0e614933a579853ba3933fc820671a5a79ba5cfed7d84b6f94f87adec9bf92f88cd4c48e446655d67c15815f28bb0d66e9643b83abef69e4db23e77fc5f832b7c423756a9df11c6a2a5a86db30799b12a9557876c0708347429a5b2be6d665dd3d6a503a5c61616e453740127d7961a81b43ef8f21cbb5435bee029f6b72b81277fe8cb22c73210820435fcd4c816bf3b2e994ab069ebf7b0f7cd2849c0c8b962325ac9b36859550174e7b76d5f49cc144491dc3d36bd85cf92f35f98b64f2c5d67f5262126c71b4f1b56200dc9f479d3d6409b09481faad78dc8b032d9f49eb8cd20f05889b77e246af4364a132531b739534267ae7ce2e13b4784c42d44321e875a67cce9354716f1059ac73c8e3d03ee6aabf752e497b5ad1bf1cdaf96172be1e301bd9d97c114f052ed551ffb2ecac6b5132c717951734c05ef8360cba1163448df6f36a2701e03f3fff74fc8db8761779d974e709d694975a9d291da22bc3c5e19d93a0305d14051b8e5ff5c6e485e306f9c23b5a461fee26b37d428b5be381cff696c52d5f0a939c8babe2ae83b1a7124b4426cbc99fa450b5fb02c5a0ea9607765ee4e055a38769c44c761a218e2dd46cbfb786d760a342687a75a1b1fb600c2d246f692d6df63a3f270c8481f6b27cf9f4a87b48076781c3c3c89f36533fc0ef092b4dede3f888e30630e8c6bc48381cf8bae0be08b6b266a870834c030bd326e0850f6bec36ad87c04bd92a5b974fa672ab8275da86d95f56be951c9a686afa02e0cda26371f85fb4373c4b11da2eccbc8f357e4881fc6a77878a15cee4b41e14c7ed4acad07e1966b3a006f71c6d49bbb6730a332de33426222c9b19c04b1e52fa22ad6ad4607a0443771be620c3b975de0fc5558ee3e54ef2ed52b84a724b5f1711d75ca04e4f6f8ba874c01f047be600a90883f1126183de9972a72712af3d6191f6242580812e96146ff6620cc8e6e12c22efffb3509bb154588bdf6730cd2126cb0ea1b6bfe1dc1ebdf5ebef2df8d9b2c41c7096a5b1df1ffc808264a96d15b09c8c6635cd442ebc5220e7eac68dc9a65d6ab67c25f091c70cec68e46fa18d0bf80c842c875b4432c79520cea791b9e1099a213039ecb211b0a9aef96112e35f732b3d86b6fe9d5bd280a318fe7bfd8d457eef7425fffe22c91e20dfb66833717c2d8ce69e9dcaa2feab020a2f05e2f601fe431dc0eea9d5887c9e993bdd0f27e21a8dd956fc0af26a82c480c04c9c767d7e2af03b7465b6363a163b9d92f2ef5fca836335e400df99bd0a7d3a63f52f4597ba99845b2a9c0cb84d15f7e60d018a48c2f0875e10960f8a200086974737268d7ec2a99fd0c2d734d7ff9f68173e40280b8d12456195da3c92d8296b276846b9355433026d37013ec5e286f32639bd58b8fb41876063d0a492cea9d038df4f40dd1c30cf0acfa6e8285e48ab6e1e4ae5d47ac89b0bb35539c0d4a42728656b9b4eeda7fdfcf62d28a14df317fbe64fffd56157457034076226a8ee098d2c67dbac00497f9ed4ae114193222ac9ea703e07d37a55e7c5de12563dd87149f17a32e0f28e0f2017a5097e29eab4154ee338accadd0cc8d43020cc440ce65f850269f4ec301591278dd2ecbe82a0193ed9ee768aa572b1b1c71068e3f82cc77038e1c7eedabc6f15ad7d722891025140fa1615d40037fc3193292696d0ae5a1735b72bf617a98aacafd0d53e5381baf4a2faeef8c7ed16eca8f8f890757e78dc94ce0bf1db0533b44e24aedd38417cfec4e70784c4beabe1f7204240c8869c2ebdae6a1a7e1f20d20bf7b6410c0a622e0375c05e4ac7e479c509f5f04529d7910e499824157af0633e34a0f0a2c54df3740c510ecf831bbaeb1918cf46cdcac003bf957b1337646cb48ac6d01504b92ab9ce117945783bf0f496fb0721ebd1265526bb2cc30c1df3b147f6c6de667c41feff5f674dd341e8adc6d825baa3951ee90568e5b78f1d787edf192d57f046d2b040efabebcd7064a830ebeb3a7f2d5fbdc9639c89a3947acfe8ef1f4b2b9e449ec4c7658ba55f6dc0b088a12d74f9523f3d33d6c2aa0d84ad32c26173e0d53d32c29182f3229cf52e7450958beff73773cceb296d2da34c26bf339523676ed7a6183241d6dce4cd7258a2e9412e71c1967e818be0ee5ab79a45363a27d58827777f9ff1788eb6305d2bf83cd9534289bc813869fd1b8abcad9d0995595d6817b91ad7ab6a7610cba0d10dca5cc92d93ada96184113cbb1df8b1fb9ec26c078718bbbad702739a351146586fa04ee3096a96ea42494f48e2d91cf543b28f0a1b0c29a184c8cfbf722d711b9aed07cbe7dc4dec06644aca6f104e14cc3cb68ae41dbe67bf2b27c425daa4870837e51caeae5d40392a89a21f75e9c40d15036a9e9ec49cddf27068738d2625c890941d18767eb75574acbd05773fd9725543c2dc8aec0810e28a7e3ea47976ce48d266d8a627afc197854a29c81a33d335a52dd126e956919c1ede6a5d8fa22bc1ebd8a6b86e060dfd45f2924ae48133eb926e6bd7ac5381c3dc1feee0c1db06e881ecbddea376b79b033a6601326a4bbe9348e484ab7aff57140833b4a52d7f14d139fce6c50bb3b19d2b5ff04eae450bd8c8f17bb42d2543bc1eb33e3bf1c3255f9bc43583d638f72346a62dc788657a027ce67f2bf435092ec80debce0d3b6d89211965a54db7ffb932fea7cd62bd603bfa3ff42e5cbb8a8005b688281e5a9906778da3b3397af7909478afa0759d0cf00fd67cbfd686b2667a96b670f1e5f9e62abfc559f15fea0f641aba83ec042e0dd51c17d6e50529b6946acb4f649416eb61ace2f3d2bfa00002fc1dbea7cdbe8fa5161895d29a8f08e9f25ab3066d526304eb9a8985df353099ad534daeee575f2f766b7fd391b35db3b243d385aea7e4e4ada90a82152bd060cd20a3234fe7bebe1e80702569d937f969da52c7f53bb5cbbbb06fd5e72dfa612ff2e83b51e782a9e0141906e28f956a9db79237ef737d9a5e70fc400d139e74b9f874761898ad861244d4754ec7ad54a3d1260461b8bc8b3968b795f25093ea76aaf5646798d5a1da333c50b82e1084d3cfb498be878dcea8e855b36df7459dfd6783c7e1c6a18d90495e8b3cee92c6a5be081015ebeffa796c660120d5fa4854b3abb4a375040237e866deba2ea981928bd51ed90bf9f4b26a04dd4a50f325a5b9df1ca14ba1d07f6b49b3fde76425dda1a5c6deb2db3d537359cffc2431275fdc1fc11b71bd01a3af366678509ea326d378153f827578a6f422d5483e71622af21c45dbf16ac06f9ab11b65a0a90e054797726c224d9764453032bdef2361c1840d25fd9a6986f1a5070171060b65bebe9514fc3cbf29624e1b2604278128b58138c52382e2e8720ac37d04e9338d557ad37b5f9a856b65b5ba8c1052021355d53c72c2f501a00fe4e2b7ec0658c69e1cd8747839d1d2879f3fef0155596f75217efaa3974f7f4a5c167af62a16f8dc395847ec406265c3131f9682603438f36d476d8a1867d579a4619b0b4e9e083422c1e6222d961d67dc361ddd7361a8285fee937e140539e8e0c7bf67ca55a9adced83ab5a8c22f7433a5c3aa8e7cdcd47d1642d2cfc1b1b9134adf81639fc8ddd0cd04bb029b7cc6fda1965187b5b85eaac07c434c5891907dda28fefed2db2e7a57b15cc75316a3626c71bb65a2a62cc4ef6530fbc764affa18cac1c5d916bc758a7a78609f54217a2be736a2a0b9b80c6d836b5c6b3695e122acda61db346b8807e76d076790927d8dd9a9d54a00adf89d23621d58a4ecd5db2465484b6beea89d31ad77c0bd517fb9cae4e66887b98757295bfae2b2e6a0a5217f97c0f62707596e6d2131aef0469d238e959fcff051af71df9ac774a998886e5e30b5d8091a71a82647a4a13d313953ec9f3915b22986287ef7ce7150a42cee4bedf83478dcf8ac1a0ce3ad223e9334b7ad6853103196b90056355279d2bee1b13c54229bdc8e2c2dc2ca3b1e20146bb57cabf37c8984717abf04d2652ddb5bc4fa08474333c999873d410bfc945a2478f22478950e96f8fcfd97d281ec166958208b7f47d18bcd170c391bd809ca15eff3ed38f3db37a6ec3562420457e1a337d445c68c3122ad06e1d5122bb8b76bea4bc4052687cee3d9d8c8d62a4398f27952e35048456a0945b0b5bde91c07981389a90cf0fbcd9bcc16feb26258812ad1f04c27464e9b54661b24440002c7a94900bf767860cd7cf0500aa3b9b4c4a10dc122f44ac4cc0e0b65052c2a642499c060440bae458c339e27e8b48520e9255a4566d7318b9dfe6150ca561090932e44a55d6d56f7d69b436a8c2d0a38b88a5fcda5448c697882fa62bcf96598694142e674488fe2491944959744e07fbc20ba5384df163d70a69e11dc6caf9b4bb9cf26a331a732c748ae8d772aecc353c2efcd9cd1466d484ca0be2c0c0526b0c0f8d5fd60fd5e145d9dd9bef22e23e84b788ebccb08c1dff2a987b12940a5ed322aed8ca4714dad66fa5e72658f05e0b66abd27f3807d392aab2cee6b3996b554581cf8101437aa9b050c1464b802e7c95eeda065827a7645fb6c6b202c8e3fb7cc71a90433b4d107b0d252b92623afa10b24352afe80473b8458e09c21468d6d7758c2d0ede8e72f2c6409f20205888ae10ccb32b34b7739ab5fe539333eebcd0cc2cd1f5e88b5f9f94302b1f6b6b212c5049c8475b06544bd75197c74a85c461ffe9d96963cdb581dc1d76691ee07c771f7be7d62008b7061e836d57519d2a8bff36937089c65ef9e6d822d10dc8a97a6c75b1b0e9fdee254923b99687ff80b6f5821ad02dc2649a3d611a5dec40861fc4df7983d8c8a421f6814dc13438e9dc8238238548d335ab2ad5a16571b01b22d3335d0d83ae735a33b6a6ff9e92a58a88e35bc011776352842ff70574f000d74e49c40e29f05c2a83e28ec6d8217d7bd4b259440b921637a5eaf6f770e31778b123836355561d7e885e47d72dd8e9aedd02a5cb2cd6421134d2e0be0b93907bf5ba80a1558f22cdfe121f30e0a9e9c138b19bc2e80e74450aa114792b469bcbe58ea136efadd1b151e8803b3be60fb13857b14e4422d5695c718d231384a6a0841f3e75b624be7bd23ee01cab688c827b5036cc3ee342a97499cbcf65e3f2ded25cb9ac2a69bc63f68c393bea40ace3c0435b112e53b224ce0c046d2210a57d8149dad167b5f20ac60d0773e48054b487096867b87a6ced8b7acf45bcf6448f14c039875c533d16c8f1a09b2a2d4d0d9d064dd029f8395c31b6556324dab1a26445f7c294a6417f4554f05970810f9e271449a9ef6fda29b6631570f56cd8f6579172e5520accaea2c87ef1565405c6518b6a983e3bb5b365beb73835294f85714c3aadaebf70f4e02b868a2950e9223b86bbd41bff3f739f346d9f5"}, &(0x7f0000002440)=0x1008) setsockopt$inet_sctp6_SCTP_AUTH_DEACTIVATE_KEY(r2, 0x84, 0x23, &(0x7f0000002480)={r3, 0x8}, 0x8) r4 = socket$inet(0x2, 0x5, 0xa) getsockopt$EBT_SO_GET_ENTRIES(r4, 0x0, 0x81, &(0x7f0000002580)={'broute\x00', 0x0, 0x4, 0x3b, [0x9, 0x3ff, 0x9d98, 0x1ff, 0x6, 0x3e], 0x5, &(0x7f00000024c0)=[{}, {}, {}, {}, {}], &(0x7f0000002540)=""/59}, &(0x7f0000002600)=0x78) ioctl$sock_inet_SIOCSIFPFLAGS(r0, 0x8934, &(0x7f0000002640)={'syzkaller1\x00', 0x7}) ioctl$XFS_IOC_FSGROWFSDATA(r0, 0x4010586e, &(0x7f0000002680)={0x4, 0x7f}) ioctl$sock_inet_SIOCSIFDSTADDR(r2, 0x8918, &(0x7f00000026c0)={'veth0_to_hsr\x00', {0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x25}}}) ioctl$XFS_IOC_PATH_TO_FSHANDLE(r2, 0xc0385868, &(0x7f0000002800)={r2, &(0x7f0000002700)='+\\9\x00', 0x101002, &(0x7f0000002740)={@align=0x2, {0x9, 0x1, 0x6, 0x5}}, 0xfffffffc, &(0x7f0000002780)={@_ha_fsid}, &(0x7f00000027c0)=0x2}) sendmsg$TIPC_NL_UDP_GET_REMOTEIP(r5, &(0x7f0000002a80)={&(0x7f0000002840)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000002a40)={&(0x7f0000002880)={0x1ac, 0x0, 0x20, 0x70bd25, 0x25dfdbfc, {}, [@TIPC_NLA_LINK={0x60, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_PROP={0x44, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1c}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xffffff7f}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xa}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x4}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7ff}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xffffffff}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x200}]}]}, @TIPC_NLA_NET={0x48, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0x8}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x3}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x5}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x1}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x5}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x483}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x7}]}, @TIPC_NLA_NET={0x24, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0x10}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x5}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x2}]}, @TIPC_NLA_PUBL={0x54, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0xfffffffc}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x5}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0xfff}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x7}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x8000}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x89a}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0xffff21cf}, @TIPC_NLA_PUBL_LOWER={0x8}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x6}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x3}]}, @TIPC_NLA_BEARER={0x20, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_PROP={0x1c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0xc47}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfffffc18}]}]}, @TIPC_NLA_NODE={0x58, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x81}, @TIPC_NLA_NODE_KEY={0x47, 0x4, {'gcm(aes)\x00', 0x1f, "01e5ea1e872816e62cb9a964a146af19cfa27808e689e6bcfd82303354d89a"}}, @TIPC_NLA_NODE_KEY_MASTER={0x4}]}]}, 0x1ac}}, 0x5) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000002ac0)='./cgroup.cpu/syz1\x00', 0x200002, 0x0) sendmsg$AUDIT_SET(r5, &(0x7f0000002bc0)={&(0x7f0000002b00)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000002b80)={&(0x7f0000002b40)={0x3c, 0x3e9, 0x400, 0x70bd2a, 0x25dfdbff, {0x10, 0x0, 0x0, 0x0, 0x1, 0x7, 0x5, 0x2, 0x0, 0x9, 0x8}, ["", "", "", "", "", "", "", ""]}, 0x3c}, 0x1, 0x0, 0x0, 0x20000000}, 0x20000004) setsockopt$inet_sctp_SCTP_AUTH_DELETE_KEY(r4, 0x84, 0x19, &(0x7f0000002c00)={r3, 0x2}, 0x8) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000002c80), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000002cc0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_PMKSA(r5, &(0x7f0000002dc0)={&(0x7f0000002c40)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000002d80)={&(0x7f0000002d00)={0x5c, r6, 0x400, 0x70bd2c, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r7}, @void}}, [@NL80211_ATTR_SSID={0x22, 0x34, @random="c00a0fa25201d6cf222c2551d8b8680f7de6fc3f5bb667dda6147917c810"}, @NL80211_ATTR_PMK={0x14, 0xfe, "12d8bb31d2ac4dd1da2b33cc6d882655"}, @NL80211_ATTR_PMK_REAUTH_THRESHOLD={0x5, 0x120, 0x4b}]}, 0x5c}, 0x1, 0x0, 0x0, 0x4040000}, 0xc080) ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE(r4, 0x4048587b, &(0x7f0000004080)={{r4, &(0x7f0000002e00)='\x00', 0xc000, &(0x7f0000002e40)={@align=0x7, {0x4, 0xa00, 0xd3a, 0x9}}, 0x0, &(0x7f0000002e80)={@_ha_fsid}, &(0x7f0000002ec0)=0x69}, 0x2, &(0x7f0000004040)=[{0x3, 0x3, &(0x7f0000002f00)='{],u\x00', &(0x7f0000002f40)="e6fc8882b5502d88a6293a3db238e9c1e6bc5c8c6c091ae50b15acdf18df1ceb2dd4dd3885d3fd3e11e0c86201781805b01adf4685cb56c53560cc571a6c4a05f06ce061b8ac8ddf9e3fb107e1fbe340100b9a465954a1986973f0d0808750cd37b64d86838ff7a2d940df8cfe989ff0278b8ea962fda9d8c1f28ad44bb5345ac0e8304f9ebc7b2e6bd09cc6cce7421e86347aa7d123a782e8520d", 0x9b, 0x8}, {0x3, 0x5d3f, &(0x7f0000003000)='nl80211\x00', &(0x7f0000003040)="2affc4f89b89e3d5a2912971e7866f5a0ccd417b9bf827b349039e7614fa5a4d69c7ee510e5159241511e71d81e4c456a1425f6cb40e30556e13b681622e8def76d9500ea7c4367c29cc30c4eebe95a913462467afad8327b34d77982308c752e9e2491c8bfceabdd8e496bdd96351b6b46d9bb54739e6b2329fd01a3152654e78780b8fa144cd5abc639d45617755877197563a5311021ac35f8ca6352a159f173a41fcf15d353af4ffabfb2cf572349c9b29644863853b7fba4e0662ba15850625ace26d96bfa1a0bc63e8a8b0747584f456996e42ff7b7dd9ebbe73064d39ffad6f132e1a12530d0286abfcd6d889473f894a23257e520a7e33ddbf1c85053df4cb59202cfd126606197f761497ad24e398cd8aad619f06753e7642c1b2a326795568d16be1d1de4a9ade9c043caf66bace09918a738e9a6f61ff4bbe59292ee983d1b722b3bbc3bfdc2ba3680f66054a1c2431f0836f4db889a2371bdc524ed3d54a6a9b92db2add40e3c158b33cd98ebb46b9e42476e31616720ae78d116385ec93c768f1a15fdc5a246540cd8d69345ba1a53bee14465298ef0522fd9bd62926a2e5c7f7c26e39432eacd11012279af0912a79035e7432b2e3e4eedc2f902807337e2d6f9be75ed32d224ee8e9633fab80e0aba79f6903bddb00ae608e54cb7922ef34776048d4f3570879f6ba1960651ca10eb8510415e4818e3ce7e3248e98deebbb8ef142dbffbb2e8d533c53c4775b50c3063df1f204b11f663c223bce459576636f542adac1f3ab9d829bd4751711e4ffd6b16ea5168121bb8a712a0e8bf2b01372c59c2656c51d417f67f848aef966ece2a55b2b6de01eee9c3a65c943b8ae14c5260176297129a775e820904e7042914edbdfc85354de1ca51d03c8dfca9712093a88cb339756cf3e2f53c2f2a0a1f7bd60b5155dbd53f32f4467ba420365dcb718e1771686ae9acc10e2fb90d55068efaa10e6d166367323faf571b77c8e1537dc430bf08c4735a4909c2cdd4e6c65e0a23ab879057f889d61616fce4dc4ae06640307481f535635d126aa05cd34f24e3bbfd47b28821e180ef45b5d5679d648ad51af1010770171837f4ef2e04171f60eac91e1627643125a6100a7e5f10f65a6fa55dbad6194dcc1169267b4d776deec2d159935f9f8d681484389462cf653e4b4f4501358f945d2b0b358af172f657d44d00416e1a247bd5bc3a1cf2564ff49ac74abe3f5b59cc01dfd96cd6510b4cb9c3fec6c33dc4b9c6276f81fdc24632d2679a7f0581acc0bd7d2d170550ba1a4a9eacb7e56aff86d18d693a9c255b38020914100256359348e83de74f3e94c04d06b1a4ea28aed1be4b745fa70e3441a8750c993beeab0fc88b0b77061b28c1bf25a7efa74d546081688c0a5b75e073f7e95dcde464d150796bd117388b2c24db69bf74e4250f10cfa4c4deb952bb5bd74030327f9933140a9e5ed88d07d35bddf0493f5fe533001ac8681710eb10cde6c80be03b05f2d76990d80889199afcea9b830dc5bc222308c90b457e84fd727c1216da2aff0b2f0e2ae5f2a54e44857f99975df5040dc6a604992446ba620a859438b32a335de9b82d31ef1922ba2f03cb125ca4a31d8d88f63930d30d464dea65e32970ab6781f127a87dc1fb3d6d1d33dfbc8abe38bf61a63c48284c7d13eca00afe8c0d517f0b5c6cffa95a5fa0eac8d715fefc19dbffed13b8d89b80f4d7bfadc43f618730dab3228888cbfbe23e2dba5a8b06408b4c5687b4f836aec14e626f1d4cab2059acb0829629c75bebc55dc5230d276917cc1d9c0774f40caa4c4cd22a5e90e61d3078b219d5484d6c5a345693a9b1d8d27b160617b9d075979c9cf91db2aa3e4cc2e8ad5eed6ef534696e6863d8b4dc08fe5675a443698fdb2d5f2d78432909349db925ee849378a97fc3c4af0c1c8ffa74b4005d9019d919a070aa9ede1c1c35cb8532ad3b561b4cd393aa50176b68f409b29b91001f7d29c45175e875e26f2ef6bf6176a840fc192f440932c90e038c0639bc1b3d372988ac6245053c1f0b53caa7213dcb1e945150ece16918b089373b45796f55f94efa683577166158c82babd959fa19d3d84ac8d6867102041b4d683a45205acefece59c8acbfdc27c6fe08696d9d05b250e96feb2a44884c2201d705fb1ecb750f5de4e97dd77932bab2000a04db4609b459b0fde1cc430d62a458b4d859280989e5e156dd928254c1a15d869d1c22e2a224cd347ca06b071abfa55ee2f8c4cde2ed2dc73c5cc8ba154564df7dae3f7f9e5b44ecc4119d5249d8e95287df314fef4fe9aff634483f308a88c39c9d556365a719f9affa84011c370e239c43985c140204df73e5661a32d284d1cb24aa9b1c67c5476f4ba4a81577e80204e00b95b3682b362e2431c43d01a6fc3c615981cca91233c04a0949e5a16863cb77e82d2929e599901bac66aa31546d348282101852b57a922bc98ee64111e50a2d076011c2a0abf0071c69861c6510b8172b882c1bf22975277e14e728a434b185d982c63d896ae9a651e9cb3d5e4405a4791b15ea26cbff6cc3930eba9f13c2dd66c70e8c095ec2212dda3e4d678b4d612513fbb8139ba15898c2d00df7e53b9542c1b3f0972c51c94b9b50b77037e50cc010a9a84ae2ea397431c1e162f0e6e2a23c29da98270722a2837f7a51ab7c5d278eac49844043aff61111aba09eeb467ddafaf244030762a4c24def1fab8289b28d808d707d335caa321331390a860e8e3a7649c6e2bfb264addca3211de09983744f232befd52a40b1ceb1c5b749cc7b329b7d19ccd29e56257fa1369b0106ce036a0cbd9ff9b777156aa3f3f00e34a20f49dcb43b63080e38bddcf0835bb26df3794106b9eec9051fe59c46212bf55e4500d87e472eb1367968b1cfc5628ca47dd4271a7ad40256db10f682d7b36b9dc8158e2f9de260c59bbeaa83e91deca14f01c7528fdfc4254917a687acbb982013e24580b05b8d805fc0d8775572314793bb13ebb170da156d9d37cd6b56b071cf7e9e81b8ba636c3ee3c1fb67dc2cec5685dad879e35a200527c83f2a04a466a1648d9061e2c5f4b7b27f224dab1e29100fc826b0b37269cf81f34e02945747957abe44acca0c06cf878810a6a8b58e2c85cb269b045d04ae86c605b8fd21d962c438c322241d69714c47855244af2fe0e9a566c9c7669f625c8dc4c2ee9952e2057edc31855fc1b9e7ef85bf14b8dfbe670f24237707a023a095def5636758116b948734de109d42219c88828285871afe231c3e8137fb1c2ac1258b3d5ab9dd97c9c0ba868078f11c7553b75a357ba62acb08b1b9abffabdcd09f9e16154cc301b2735286ec3dbb558cb74fc3d7205c3fe46f05d7c9927778651d38eb4bc41dd1448ec557c2c3d0aafb8bd30fdfdb97b9955a81258e067ae982e5be3532f3fae28f399aab01245e529f537c8b29c85269882941ba7b98c4b5aa546dd2fdefdd0096e47879ff0dca86f23b330f6477f14db5913ee63e3dd8a0ea88f7895ae1a8071de23dbda6e08428d871821614a085bc487906c21a3e7b2cfcd660a8b27a2ad32db87e2c7c38ed517c29575c9116e36f75ec1f8e3f91e4fb10ea0bcda2e355f82df1e3d5ebb58cd6d1b3cf9ee6db973487845c6f2ec25bf3f753d24f0db8228807ffeedcd75d7acd516c26820b5e13da4569ba720d95d3a5106561fc0c34b582def67bc9c7d4ad78dd53fb408418c614186c521b9c0c2357abbdd345122c3134be2b9db71e430b29483a8fb59fb99834ebbf62d7be9dd4c72dc33f3e9d97e125d9333cf1eb19c5257d7bf3aae671f5c2451f195ed05a4c04ea4c0f14bb4daaa7ea3874cf4adb59ad3d0fc69f2a819af0ec5855528f6c9af2545d91e38123e68fdf7e5b92526d219a9c52552475a17782df97c587ddbc184c580276267cb615034cba6bdcc6d1e0ea4f3a718ec1c279e309de6be0963bbae09f8ecdaea4369191a422b62b94ff297d0bb792c14bcf69112ec8f640ea8a3c52dc8aa0e168599fc007b9b879c8900e93895998717eee91d7eed1b7557c49b9f892244acfd4ed5392b676ff1a43b78db32acf8a1acbbaabc4a6f26d7369eb854357d2c75298a5745a9b4d4a62b8ee3dbfd02e4058cc3d1a5440fcacd5b23a7ddc4ec377da6f6d5161f59645e340afba5a2ae52d74ba43c2ac2e9afce8e196f695b50b8218e7b983a8359795f59c8bafc8bc2a0fd635177d9f16e0104e61b243ceca65fb12533862df7fb1b018166007868e275d61bf28ed8bea6093d998cd56a4805a979818608406cc6a42d6ac3c0ea7afd48d9ffedf2f9d3c9e74d7659b979b3ead1d7f6eaed310d782586aee50c2ad2bc29e221695844732e318e4696da014060340eda2f3d686f35c769d216eb304c46e90b591ee05e8490e7bd2b843bcfb79e9f25aeb99c1bf806cfe238e599b3621e980ebe6c84cd98ec6052eac28b29ead369d2cfe11b2d9b69ad84928f6c256f71761be2e2fda0beef7bc693504e22513a27d4e10eeb522443fc984332cf7cf3875557328833796dbb00853892454cabf8cd129b97fd691a29a54c4cd8f1fc3f9a04c1631bdcd9c1497b331f1bfd35b868f7f21f2664c2bbaa4a73e816ceb9bf94a2b9acbfb7d4e9ed2896eb5fb273559bd55fb09904ec6cf27528ee35de2c41084058e1a0e32c915d5c91320e830f8e3aee948dd997709d5a16dbfa2cf38c4ab054c4800f99fbf692ce4e7c77953170abda61f560d2553c58e756b518b084c665b27c69f2a86a62ec8d4544949bb1b073a851d7ba6f15292a4eb42a4993e0c35fb78c42d658cdb9dfc4d846f494a3ab4ef8825127859f10c44f1aa2dd5a5be564ff7e8fc6732d192acdbc2d365599ee197f8da07cdefe1c59771850943a86b8ebc13ec2ca2b6a3f40b8535ddfd2589f383453a508c25ee1ddaca5c1b06d77f9a4997ace455347d94101dceb052c267a6b0f2d4bbb60868e95efa6c102f7fb379c6e83b5f1cca9d18678a5968ff393a5f61249af82d6d72e4e4c5da1e6045421a7722103ecc4c7d51bc003425d9f397cfa29cfd379db67860bbdb559ed0b0fd12f3852e605b388df9e5efcf71f68e033aa617af7063d91f6119450b47df0fd13e682f653833991fb459581e28a82f98a70df3303713214300619f808057e15aef94da73ec9b342de1077c40de3c347cb9536ad772f076546de6673bd521e6760d4301aecaa6cf8cd415295b17dde9abb1a73daadcc2ee263e1949fd21967a1dfd725d9ab81db628f0316a29c8c63f225581070f85fe624700e22f139f79234773746f2bf2ad55b4b423096674cda584b6276695bea73eeb187c6946b572a9b98f187f210495b1e75095c83f70f2548355e705092a043f1ecce1fbbd8660ce71bfb4e45d1e3fc44922fd384efe632b04defb90eb80056def07a670ddc335adfd381bb8deab0539cb0023edcd05722c478c82158794bc86e332a114713c5d82874d5630e39afda267f1fa87faf67f14599e945328f576fa583716e84b7c0b7c401cac8c1d4e69ec3728c974b078c140d509c8edb81d63a509df4ec72f100700ef72059b6bc112bfef8142ce2ea53848f123a36257abe00a850b59708ae6101a5006d96dccc553790cff126d9336eca18158829fc931a96058cddb740ec2f6c2751dce55346512c9f0435e769e5cd9a3e826fba981a45cae61f9b5dd373c2a7c0bd4be0062fce188d197e43f3cac0f018b5187e276fef477778ec21ac173195dd33f79d331abe0b8231a5217c9aabbfac1f4f", 0x1000, 0xa}]}) bind$unix(r8, &(0x7f0000004100)=@abs={0x1, 0x0, 0x4e20}, 0x6e) ioctl$PPPIOCSFLAGS1(r8, 0x40047459, &(0x7f0000004180)=0x100000) ioctl$BTRFS_IOC_QUOTA_CTL(r2, 0xc0109428, &(0x7f00000041c0)={0x3, 0x2}) getsockname$packet(r2, &(0x7f0000004240)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000004280)=0x14) getsockopt$inet_mreqn(r8, 0x0, 0x23, &(0x7f00000042c0)={@empty, @initdev, 0x0}, &(0x7f0000004300)=0xc) sendmsg$nl_route(r5, &(0x7f00000043c0)={&(0x7f0000004200)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000004380)={&(0x7f0000004340)=@mpls_getnetconf={0x3c, 0x52, 0x8, 0x70bd28, 0x25dfdbfd, {}, [@NETCONFA_IFINDEX={0x8, 0x1, r9}, @NETCONFA_IFINDEX={0x8, 0x1, r10}, @NETCONFA_IFINDEX={0x8}, @NETCONFA_IFINDEX={0x8}, @NETCONFA_IFINDEX={0x8}]}, 0x3c}, 0x1, 0x0, 0x0, 0x14}, 0x2800) 5.893247146s ago: executing program 3 (id=7930): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000600)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x6364, 0x5, 0xffffffff, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = socket$kcm(0x11, 0x3, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000006c0)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdc01, {0x0, 0x0, 0x0, r6, {0x0, 0xd}, {0xffff, 0xb}, {0xffff, 0xffe0}}, [@qdisc_kind_options=@q_fq_codel={{0xd}, {0x14, 0x2, [@TCA_FQ_CODEL_CE_THRESHOLD={0x8, 0x7, 0xfffffff9}, @TCA_FQ_CODEL_CE_THRESHOLD_MASK={0x5, 0xb, 0x11}]}}]}, 0x48}, 0x1, 0x0, 0x0, 0x240040e0}, 0x4890) r7 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) setsockopt$sock_attach_bpf(r4, 0x107, 0xf, &(0x7f0000000600), 0x56) sendmsg$kcm(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000180)="27030200590214000600602fb96dbcf706e10500000086ddffff1144ee1611d4b8bf4a31accb", 0x26}], 0x1}, 0x0) 5.49374204s ago: executing program 3 (id=7937): r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000003c0), 0x1c1341, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000000000)=ANY=[@ANYBLOB="0380c2000000f287a0060f06080001ae"], 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0xe22}, 0x1c) r3 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r3, 0x1, 0x2, &(0x7f0000000240)=0x9, 0x4) setsockopt$sock_int(r2, 0x1, 0x2, &(0x7f00000002c0)=0x10401, 0x4) r4 = socket$alg(0x26, 0x5, 0x0) bind$alg(r4, &(0x7f0000000040)={0x26, 'skcipher\x00', 0x0, 0x0, 'xts(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, &(0x7f0000000000)="adcd1a9a3fc36e961ed00fe41b0cd695", 0x20) r5 = accept4$alg(r4, 0x0, 0x0, 0x0) sendmmsg$alg(r5, &(0x7f00000021c0)=[{0x0, 0x0, &(0x7f0000001000)=[{&(0x7f0000000100)="a92e81d0991808e33c2330164cf023df", 0xfffffc81}], 0x1, &(0x7f0000001040)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18, 0x880}], 0x1, 0x80001) recvmsg(r5, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000540)=[{&(0x7f00000002c0)=""/216, 0xd8}], 0x1}, 0x2000) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x4, 0x4, &(0x7f0000000000)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x7a}]}, &(0x7f00000000c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x38, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bind$inet6(r3, &(0x7f0000000040)={0xa, 0xe22}, 0x1c) close(r1) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$tipc(&(0x7f0000000200), 0xffffffffffffffff) sendmsg$TIPC_CMD_ENABLE_BEARER(r6, &(0x7f00000002c0)={0x0, 0xffffffffffffff14, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) writev(r0, &(0x7f00000001c0)=[{&(0x7f0000000000)="89e7ee2c7cdad9b4b47380c988ca", 0x140}], 0x1) 3.750733727s ago: executing program 4 (id=7953): socket$inet_sctp(0x2, 0x5, 0x84) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x200000000000011, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'bridge0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x2000, &(0x7f0000000140)={&(0x7f0000000740)=ANY=[@ANYBLOB="7000000010000304000080000000000000007400", @ANYRES32=r2, @ANYBLOB="0000000003120100500012800b000100627269646765000040000280080005000100"], 0x70}, 0x1, 0x0, 0x0, 0x2800}, 0x40) 2.41547049s ago: executing program 4 (id=7955): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000100900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWCHAIN={0x38, 0x3, 0xa, 0x3, 0x0, 0x0, {0x2}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}, @NFTA_CHAIN_HANDLE={0xc, 0x2, 0x1, 0x0, 0x1}]}], {0x14}}, 0x60}}, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f00000003c0)={'batadv_slave_1\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000180)=@delchain={0x24, 0x5f, 0xf31, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {0xfffb}, {0xfff3, 0x2}, {0xffff, 0xe}}}, 0x24}}, 0x0) 2.312594197s ago: executing program 3 (id=7958): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000100)={0x26, 'skcipher\x00', 0x0, 0x0, 'cts(cbc(serpent))\x00'}, 0x58) close(0x3) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r2) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r3) sendmsg$TIPC_CMD_ENABLE_BEARER(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}}, 0x0) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000540)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=@newqdisc={0x6c, 0x24, 0x4ee4e6a52ff56541, 0x1001, 0x25dfdbfd, {0x0, 0x0, 0x0, r6, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x40, 0x2, [@TCA_TBF_PRATE64={0xc, 0x5, 0xc2240edb8ac75ac7}, @TCA_TBF_BURST={0x8, 0x6, 0xff}, @TCA_TBF_PARMS={0x28, 0x1, {{0x5a, 0x2, 0x84a, 0x9, 0x1, 0x800}, {0x8c, 0x1, 0xfffc, 0x7fff, 0x4, 0xb}, 0x5, 0x34, 0x91f}}]}}]}, 0x6c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x50) r7 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdbfe, {0x0, 0x0, 0x0, r8, {0x0, 0x9}, {0xffff, 0xb}, {0xffff, 0xffe0}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0xffffffff, 0x8}}]}}]}, 0x48}, 0x1, 0x0, 0x0, 0xb0}, 0x4890) socket$nl_route(0x10, 0x3, 0x0) ioctl$SIOCSIFHWADDR(r2, 0x8922, &(0x7f0000002280)={'syzkaller0\x00', @dev={'\xaa\xaa\xaa\xaa\xaa', 0x26}}) 2.240225991s ago: executing program 0 (id=7959): bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x94) r0 = syz_genetlink_get_family_id$devlink(&(0x7f0000000100), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$DEVLINK_CMD_TRAP_GROUP_SET(r1, &(0x7f0000000400)={0x0, 0xa7, &(0x7f00000003c0)={&(0x7f0000000300)={0x4c, r0, 0x1, 0x0, 0x0, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0xd}, {0x8, 0x8e, 0x1}}]}, 0x4c}}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_LIST(r2, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x54, 0x7, 0x6, 0x5, 0x0, 0x0, {0x5, 0x0, 0x2}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_FLAGS={0x8, 0x6, 0x1, 0x0, 0x3ff}, @IPSET_ATTR_FLAGS={0x8}, @IPSET_ATTR_FLAGS={0x8, 0x6, 0x1, 0x0, 0x42}]}, 0x54}, 0x1, 0x0, 0x0, 0x44000}, 0x40000) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000080)={0x54, 0x2, 0x6, 0x5, 0x0, 0x0, {}, [@IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_CADT_FLAGS={0x8, 0x8, 0x0, 0x0, 0x80}]}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_FAMILY={0x5}, @IPSET_ATTR_TYPENAME={0xd, 0x3, 'list:set\x00'}]}, 0x54}}, 0x0) ioctl$sock_SIOCGSKNS(0xffffffffffffffff, 0x894c, &(0x7f0000000000)=0xa) 2.159760328s ago: executing program 4 (id=7960): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000600)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x6364, 0x5, 0xffffffff, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = socket$kcm(0x11, 0x3, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000006c0)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdc01, {0x0, 0x0, 0x0, r6, {0x0, 0xd}, {0xffff, 0xb}, {0xffff, 0xffe0}}, [@qdisc_kind_options=@q_fq_codel={{0xd}, {0x14, 0x2, [@TCA_FQ_CODEL_CE_THRESHOLD={0x8, 0x7, 0xfffffff9}, @TCA_FQ_CODEL_CE_THRESHOLD_MASK={0x5, 0xb, 0x11}]}}]}, 0x48}, 0x1, 0x0, 0x0, 0x240040e0}, 0x4890) r7 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) setsockopt$sock_attach_bpf(r4, 0x107, 0xf, &(0x7f0000000600), 0x56) sendmsg$kcm(r4, &(0x7f00000000c0)={&(0x7f0000000580)=@xdp={0x2c, 0x0, r8, 0x3e}, 0x80, 0x0}, 0x0) 1.99068503s ago: executing program 0 (id=7963): syz_emit_ethernet(0x36, &(0x7f0000000280)={@local, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @void, {@ipv4={0x800, @dccp={{0x6, 0x4, 0x1, 0x8, 0x28, 0x68, 0x0, 0x9, 0x21, 0x0, @rand_addr=0x64010100, @multicast2, {[@generic={0x82, 0x2}]}}, {{0x4e21, 0x4e23, 0x4, 0x1, 0xb, 0x0, 0x0, 0x0, 0x3, "740e23", 0xd, '1\x00'}}}}}}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a2c000700180a050000000000000000000a0000000900010073797a30000000000900020073797a31000000001400000011"], 0x54}}, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r0, &(0x7f0000000240)=ANY=[@ANYBLOB="000086dd0500560008005400000060ec970001983a00fc000018c6ba35000000000000000700ff020000000000000000000000000001"], 0xfdef) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000003840), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000002c0)={'wlan1\x00', 0x0}) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r6 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r6, 0x107, 0xf, &(0x7f0000000240)=0x2, 0x4) setsockopt$packet_rx_ring(r6, 0x107, 0x5, &(0x7f0000000040)=@req3={0x1000, 0x3a, 0x1000, 0x3a}, 0x1c) r7 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r7, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @broadcast}) write$tun(r5, &(0x7f0000000a00)={@val={0x0, 0x16}, @val={0x0, 0x3, 0x6, 0x1, 0xf, 0x40}, @ipv4=@generic={{0x5, 0x4, 0x3, 0x5, 0x1c, 0x67, 0x0, 0xe, 0x29, 0x0, @private=0xa010100, @empty}, "e290cb2b424e285a"}}, 0x2a) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r8, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000340)=@newlink={0x20, 0x10, 0xffffffffffffffff, 0x70bd27, 0x25dfdbfa, {0x0, 0x0, 0x0, 0x0, 0x115}}, 0x20}, 0x1, 0x0, 0x0, 0x880}, 0x8048802) sendmsg$NL80211_CMD_DEL_KEY(r2, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000b00)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010026bd95b68cbbf1774c24000008000300", @ANYRES32=r4], 0x28}, 0x1, 0x0, 0x0, 0x8000}, 0x8c0) r9 = socket$alg(0x26, 0x5, 0x0) bind$alg(r9, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-camellia-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r9, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r10 = accept4(r9, 0x0, 0x0, 0x800) sendmmsg$alg(r10, &(0x7f0000003700)=[{0x0, 0x0, &(0x7f0000000440)=[{&(0x7f0000001340)="ec3d788a47e83bd160b8ac738a70c71c3374c77c0fa13efcb33d8d3935b120aaf287d6286e491141a63ef97905e5184382e568f8dbb6693047e25fb50a08e563df1c598b872e95bf3a986b66daab6c167e70762d5ade17bef91a2e7960fe6d75361f88e1feaf471bd5a95e88b6555e1738c1d59373334afcea7ffc0d8d12b93ce4de82b8c77c4f6810093c1cdc16edaae94ef46ca3768cce1a8a9101bad6f157f7d1b2e27004aa9cda743d69db42a293d0f66b533cf42508e663fa14706af4bb230ff60ecee0b5785871dfc9b7d565dcf17504e32575e0e4148bc825564f9ac41d18aea0efb43d5999b7f7fde614686532692d469a05263b9389d115f06c0a0785a02fdaf30c0f21e58639ad2bf658b5a985bfa11cff87e5f8d4323ceae815dc8f00d2e207d7f37c1ee0c05bc2c531ad6e522609308600b0b72a786f6bf22deb88067406b48b0e79587e9077d4f2608f6d0eb131cc08d138e914177fa9676c53c28f388dc3bc88aa9c3d74674cdc343d53ec2b46edf8d0d1c8a8722e97c56d99b998d8e0d7da1ceb5ac240bb4f6d16c651fb92c9e9faf4c269bc07ab89f83500a492786d85ba35f6ee01d0d75270075aa266ab158a6d41b1cd3f4e54b8b5432b36a40b097b2a0d05824e6f1834ae20d3832484f39db39878af737cec27d63783f047cc0f60aa50eef300a4adb18966f9ecb1d14b17ef4ede259a9ac740b4015e", 0x200}], 0x1, 0x0, 0x0, 0x20000000}], 0x1, 0x20044881) recvmsg(r10, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r11 = socket(0x2, 0x80805, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r11, 0x84, 0x6f, &(0x7f00000000c0)={0x0, 0x10, &(0x7f0000000080)=[@in={0x2, 0x0, @private=0xa010101}]}, &(0x7f0000000100)=0x10) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r11, 0x84, 0x1d, &(0x7f0000000000)={0x1, [0x0]}, &(0x7f0000000040)=0x8) 1.690019727s ago: executing program 4 (id=7965): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @multicast1}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x4, 0xe4}]}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) sendmmsg$inet(r0, &(0x7f0000001140)=[{{0x0, 0x0, &(0x7f00000006c0)=[{&(0x7f0000000140)="0c03573afa64193f5c0c67f7ed0f08ef102566dce7ec5f66a648201426236ae476434d7c6d4dbb49b6af27b75412ff599713", 0x32}, {&(0x7f0000000180)="47b6b1bcf13967b3c4bf3cc68f653effb380625761263b1720c5cb1c081f2af91cfebdad5d8f59f17b8a1d71b9c27079e4fe363d15d9fd80591447d7dce56e707f13b3168cd1dbb94cbf2a21264246d1b563d39bab7e3e105e9956260704ea72f04250aa97c76a", 0x67}, {&(0x7f0000000500)="eb11946c3eeac60839553f9e6003a7c6fa8120c1cc9efcc39e37b1bce4396dd05c5d8b881233767b", 0x28}, {&(0x7f0000000840)="396b0b2d92a081c10b00000001000000015ae169ced3036d77380fdfb4a449f37d3b3b69f6306c0a52aac4d6243e7bbe7faa4a1b07ee8d91d06cdc44210faf7d05755236", 0x44}, {&(0x7f0000000740)="8fd7e1a2dae37ddf36b42888adb33b24cd5e70270cb2d35209544b64813df407ff978c073d5ba9a9e32da3814e10996ef7943420ecfecc2de257612ab795736ed45429621b51fc18dc63218e25f3e78d6308e06b7e9be8620ae26f73aed8774085f407be383588ab", 0x68}], 0x5}}], 0x1, 0x40080) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000100)='bbr', 0x3) socket$nl_sock_diag(0x10, 0x3, 0x4) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000600)=0xdfa, 0x4) sendto$inet(r0, &(0x7f0000000580)="17", 0x59a, 0x100080a2, 0x0, 0x0) 1.57268895s ago: executing program 2 (id=7966): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r0, &(0x7f0000000600)={@val={0x6f01, 0x800}, @val={0x3, 0x3, 0x2a, 0xc, 0x27}, @mpls={[], @ipv4=@tcp={{0x5, 0x4, 0x0, 0x0, 0x34, 0x0, 0x0, 0x0, 0x84, 0x0, @empty=0x3fffff20, @local}, {{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x5, 0x8, 0x0, 0x5, 0x0, 0x18, {[@timestamp={0x5, 0xa, 0x7fffff8}]}}}}}}, 0x42) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, 0x0}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), r2) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000180)="77690add", 0x4}], 0x1, 0x1) setsockopt$inet6_tcp_int(r3, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x4) connect$inet6(r3, &(0x7f0000000300)={0xa, 0x4e23, 0x0, @ipv4={'\x00', '\xff\xff', @loopback}}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r3, 0x6, 0x1f, &(0x7f00000002c0), 0x3) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000100)=0x1, 0x4) sendmsg$NFNL_MSG_CTHELPER_NEW(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000180)=ANY=[], 0x14}, 0x1, 0x0, 0x0, 0x60048040}, 0xc040445) setsockopt$inet6_tcp_TLS_TX(r3, 0x11a, 0x2, &(0x7f0000000000)=@gcm_256={{0x303, 0x36}, "00000007e4008000", "8b3de2aabc000000000000000d00000000000000000000080000000000000800", "e73400", "000080c32a00"}, 0x38) r4 = socket$inet(0x2, 0x6000000000000001, 0x0) mmap(&(0x7f0000001000/0x200000)=nil, 0x200000, 0x2000001, 0x2011, r4, 0x0) 1.441640128s ago: executing program 3 (id=7968): r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000003c0), 0x1c1341, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000000000)=ANY=[@ANYBLOB="0380c2000000f287a0060f06080001ae"], 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0xe22}, 0x1c) r3 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r3, 0x1, 0x2, &(0x7f0000000240)=0x9, 0x4) setsockopt$sock_int(r2, 0x1, 0x2, &(0x7f00000002c0)=0x10401, 0x4) r4 = socket$alg(0x26, 0x5, 0x0) bind$alg(r4, &(0x7f0000000040)={0x26, 'skcipher\x00', 0x0, 0x0, 'xts(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, &(0x7f0000000000)="adcd1a9a3fc36e961ed00fe41b0cd695", 0x20) r5 = accept4$alg(r4, 0x0, 0x0, 0x0) sendmmsg$alg(r5, &(0x7f00000021c0)=[{0x0, 0x0, &(0x7f0000001000)=[{&(0x7f0000000100)="a92e81d0991808e33c2330164cf023df", 0xfffffc81}], 0x1, &(0x7f0000001040)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18, 0x880}], 0x1, 0x80001) recvmsg(r5, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000540)=[{&(0x7f00000002c0)=""/216, 0xd8}], 0x1}, 0x2000) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x4, 0x4, &(0x7f0000000000)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x7a}]}, &(0x7f00000000c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x38, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bind$inet6(r3, &(0x7f0000000040)={0xa, 0xe22}, 0x1c) close(r1) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$tipc(&(0x7f0000000200), 0xffffffffffffffff) sendmsg$TIPC_CMD_ENABLE_BEARER(r6, &(0x7f00000002c0)={0x0, 0xffffffffffffff14, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) writev(r0, &(0x7f00000001c0)=[{&(0x7f0000000000)="89e7ee2c7cdad9b4b47380c988ca", 0x140}], 0x1) 1.354295134s ago: executing program 0 (id=7969): r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) sendmsg$inet6(0xffffffffffffffff, &(0x7f0000001c00)={0x0, 0x0, &(0x7f0000000000)=[{0x0}, {&(0x7f0000000440)="9eb1d91a92dc", 0x6}], 0x2}, 0x20008b88) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8b1a, 0x0) 1.199521848s ago: executing program 1 (id=7971): sendmsg$IPCTNL_MSG_EXP_NEW(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000000)={0xb0, 0x0, 0x2, 0x301, 0x0, 0x0, {0x7, 0x0, 0x10}, [@CTA_EXPECT_NAT={0x40, 0xa, 0x0, 0x1, [@CTA_EXPECT_NAT_TUPLE={0x2c, 0x2, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x3a}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x4}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x2}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x21}}]}, @CTA_EXPECT_NAT_DIR={0x8}, @CTA_EXPECT_NAT_DIR={0x8, 0x1, 0x1, 0x0, 0x1}]}, @CTA_EXPECT_NAT={0x5c, 0xa, 0x0, 0x1, [@CTA_EXPECT_NAT_TUPLE={0x4c, 0x2, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @ipv4={'\x00', '\xff\xff', @broadcast}}, {0x14, 0x4, @mcast1}}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x4}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x4}]}, @CTA_EXPECT_NAT_TUPLE={0xc, 0x2, 0x0, 0x1, [@CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x4}]}]}]}, 0xb0}, 0x1, 0x0, 0x0, 0x40010}, 0x4008000) r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000140)={0x0, 0x6}, 0x4) r1 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000000)={0x0, 0xb007}, 0x4) r2 = socket(0x10, 0x803, 0x0) r3 = socket$inet6_mptcp(0xa, 0x1, 0x106) socketpair(0x2c, 0x3, 0x0, &(0x7f0000000740)) connect$inet6(r3, &(0x7f0000000000)={0xa, 0x4001, 0x1, @dev={0xfe, 0x80, '\x00', 0x39}, 0x3e}, 0x1c) syz_emit_ethernet(0x4e, &(0x7f0000000080)=ANY=[@ANYBLOB="0180c2000000aaaaaaaaaaaa86dd6080a08300180000fc010000000000", @ANYRESHEX, @ANYBLOB="456a0be670ac321dc2"], 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000040)=@base={0x8, 0x4, 0x4, 0x4}, 0x48) sendto(r2, &(0x7f0000000c40)="120000001200e7ef007b0000000000faffa0", 0x12, 0x8800, 0x0, 0x0) recvmmsg(r2, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x321}, {&(0x7f0000000280)=""/85, 0x21}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000580)=""/106, 0x659}, {&(0x7f0000000980)=""/73, 0xd}, {&(0x7f0000000200)=""/77, 0x69}, {&(0x7f00000007c0)=""/141, 0xc4}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0x41}, 0x5}], 0x4000000000003b4, 0x2000, &(0x7f0000003700)={0x77359400}) 1.179080319s ago: executing program 0 (id=7972): r0 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000000)={'vcan0\x00', 0x0}) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x0, 0x3, &(0x7f0000000000)=@framed={{0x18, 0x8, 0x0, 0x0, 0x4}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000100)=@bpf_ext={0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x41100, 0x50, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x1313f, 0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000000), 0x10, 0x749}, 0x94) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close(r2) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TUNSETOFFLOAD(r3, 0xc004743e, 0x110e22fff6) ioctl$TUNGETVNETLE(r2, 0x4010744d, &(0x7f0000000180)) bind$can_j1939(r0, &(0x7f00000000c0)={0x1d, r1, 0xf0}, 0x18) connect$can_j1939(r0, &(0x7f0000000140)={0x1d, r1}, 0x18) sendmmsg(r0, &(0x7f0000003e40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4) 1.094956507s ago: executing program 2 (id=7973): r0 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000340), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f00000002c0), r2) sendmsg$TIPC_NL_NET_SET(r2, &(0x7f0000000600)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f00000005c0)={&(0x7f0000000380)={0x238, r3, 0x800, 0x70bd26, 0x25dfdbfb, {}, [@TIPC_NLA_LINK={0x50, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x34, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x2}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x40}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}]}, @TIPC_NLA_NODE={0x9c, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_KEY={0x44, 0x4, {'gcm(aes)\x00', 0x1c, "e0ffb0a60e16299b23830d93b03560be98ae9be50848acd4e5fdb8e0"}}, @TIPC_NLA_NODE_ID={0x54, 0x3, "884c5b7a836bd09d8a496117139844f204fa0ccb4ce5285e846432a0258ac2c43dfbdfac6d70bd5e07228c9f28c16bd5e927be5d855270a1f66da83efc67840fec953313d219a52b22119d5d2ee4fb05"}]}, @TIPC_NLA_PUBL={0x44, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x8001}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x6}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x2}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x2}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x2}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x7}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x5}, @TIPC_NLA_PUBL_TYPE={0x8}]}, @TIPC_NLA_NODE={0xc, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_ADDR={0x8, 0x1, 0xb}]}, @TIPC_NLA_SOCK={0x18, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_CON={0x14, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_FLAG={0x8, 0x1, 0x1}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x56a}]}]}, @TIPC_NLA_LINK={0x5c, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}]}, @TIPC_NLA_BEARER={0x68, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x15}]}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_PROP={0x24, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1b}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xa22d}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x80000001}]}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0xff}, @TIPC_NLA_BEARER_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0xf}]}]}, @TIPC_NLA_PUBL={0xc, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0xffff}]}]}, 0x238}, 0x1, 0x0, 0x0, 0x4000804}, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_AUTHENTICATE(r2, &(0x7f0000000240)={&(0x7f0000000040), 0xc, &(0x7f0000000200)={&(0x7f0000000100)={0xcc, r1, 0x8, 0x70bd2b, 0x25dfdbff, {{}, {@val={0x8, 0x3, r4}, @val={0xc, 0x99, {0xde, 0x36}}}}, [@key_params=[@NL80211_ATTR_KEY_DEFAULT={0x4}, @NL80211_ATTR_KEY_DEFAULT_MGMT={0x4}, @NL80211_ATTR_KEY={0x44, 0x50, 0x0, 0x1, [@NL80211_KEY_DEFAULT_MGMT={0x4}, @NL80211_KEY_DATA_WEP104={0x11, 0x1, "ac90c6ffb883c138c509a52367"}, @NL80211_KEY_IDX={0x5, 0x2, 0x1}, @NL80211_KEY_DATA_WEP104={0x11, 0x1, "dc486ca8e03f5bda9a6e1fad1c"}, @NL80211_KEY_TYPE={0x8, 0x7, 0x2}, @NL80211_KEY_DEFAULT={0x4}]}, @NL80211_ATTR_KEY_DATA_WEP40={0x9, 0x7, "de08db2bd9"}, @NL80211_ATTR_KEY_DATA_WEP40={0x9, 0x7, "8aa83a7b49"}, @NL80211_ATTR_KEY_DEFAULT_TYPES={0x28, 0x6e, 0x0, 0x1, [@NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}]}, @NL80211_ATTR_KEY_DATA_WEP40={0x9, 0x7, "719298a38c"}, @NL80211_ATTR_KEY_DEFAULT={0x4}, @NL80211_ATTR_KEY_DEFAULT={0x4}, @NL80211_ATTR_KEY_DEFAULT={0x4}]]}, 0xcc}, 0x1, 0x0, 0x0, 0x24004010}, 0x0) sendmsg$NL80211_CMD_TDLS_OPER(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000a00)={&(0x7f0000000080)=ANY=[@ANYBLOB="28000400", @ANYRES16=r1, @ANYBLOB="010000000000fddbdf250800000008000300", @ANYRES32=0x0, @ANYBLOB="0c0099000100000001000000"], 0x28}}, 0x0) 964.163753ms ago: executing program 1 (id=7974): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000003840), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000002c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_DEL_KEY(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000100)={0x1c, r1, 0x1, 0x70bd26, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r2}, @void}}}, 0x1c}, 0x1, 0x0, 0x0, 0x8000}, 0x8c0) sendmmsg$sock(0xffffffffffffffff, &(0x7f0000003b40)=[{{0x0, 0x0, &(0x7f00000009c0)=[{&(0x7f00000002c0)="f973085a6ea39ea1b25a1c6b351e11245900557d1c8e9f86bae5e5c64e50ef25afb0295d0c303850b4bff4d088bf9df67e013836e2882dad3f7698b52997f7efa9eb96f09be1c3019445927c6b2fe32d38ae2bcad2ac0d85ebd42914fb18b7d0670f8b3be16755ead6a6fb713fa618ce2cf424ea7cc84b04016b9a2afbfaf68803f1c1acb74fef", 0x87}, {&(0x7f0000000380)="82f294054d05973abfac6a6f31050418457d017c5fd68b034cf51b9f6a6d71daa5c776bca90037bc7c3d88b151fbf856f69ebd05e750f13f02af646b284953b6640a08c827c6f2ff4ad8e84077f9f03f94792aa17c4743cba3f355bb9c5b04b91ed70d253db68e17cdd561fab504479f723388dda974e2a9fb1bcda474c08d6222179b19e902009ea3cb3e42408bab6c1f29cb62d058050639", 0x99}, {&(0x7f0000000780)}, {&(0x7f0000000800)}], 0x4}}, {{0x0, 0x0, &(0x7f0000000600)=[{0x0}, {&(0x7f0000000ac0)}], 0x2, &(0x7f0000000cc0)=[@mark={{0x14, 0x1, 0x24, 0x9a9}}, @timestamping={{0x14, 0x1, 0x25, 0x101}}, @txtime={{0x18, 0x1, 0x3d, 0x80}}], 0x48}}], 0x2, 0x20000044) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3be", 0x6) r4 = accept4(r3, 0x0, 0x0, 0x800) sendmmsg$alg(r4, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r4, &(0x7f00000005c0)={0x0, 0x0, 0x0}, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r5, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r6, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r7, @ANYBLOB="d50633008000009effffffffffff080211000001"], 0x6f4}}, 0x0) 954.324391ms ago: executing program 2 (id=7975): openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='rdma.current\x00', 0x26e1, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000000)=[{0x0}, {&(0x7f0000001e80)="aa581ff83dac4a636cb9b825c4009d215634b12c4ce8a4e1d32e2e4b6e56cfa1ba5838097ddae0b6c9ed0c8dc5de524ba7be7f3a6a99ac2381647c160c8426233028a94e97a555b71e0d337e23fd9a6319f4550066", 0x55}], 0x2}, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000000c0)={'team0\x00', 0x0}) getpid() sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000380)=ANY=[@ANYBLOB="2800000010000104000002000000000000000000", @ANYRES32=r1, @ANYBLOB="03c000000000000008000a00", @ANYRES64, @ANYBLOB], 0x28}, 0x1, 0x0, 0x0, 0x24004885}, 0x4054) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r3 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r3, &(0x7f0000000100)={0xa, 0x4e20, 0x0, @empty, 0x3}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x0, 0x4, &(0x7f0000000300)=ANY=[], 0x0}, 0x94) bind$bt_hci(0xffffffffffffffff, &(0x7f0000000000)={0x27}, 0x74) getsockname(0xffffffffffffffff, 0x0, &(0x7f0000000140)) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TLS_TX(r5, 0x6, 0x1, &(0x7f00000000c0)=@gcm_256={{0x303}, "000302000c000208", "5171bb74cd3660dab9e200", "d8a024e5", "20000926000200"}, 0x38) setsockopt$inet6_tcp_TCP_REPAIR(r5, 0x6, 0x13, &(0x7f0000000100)=0x1, 0x4) sendmsg(0xffffffffffffffff, &(0x7f0000000640)={&(0x7f00000000c0)=@caif=@dgm={0x25, 0xf}, 0x80, 0x0, 0x0, 0x0, 0x0, 0x11000000}, 0x0) setsockopt$inet6_tcp_int(r5, 0x6, 0x2000000000000020, &(0x7f0000000040)=0xa, 0x1959cc36) connect$inet6(r5, &(0x7f00000001c0)={0xa, 0x0, 0x0, @loopback, 0x3}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR(r5, 0x6, 0x13, &(0x7f0000001840), 0x4) sendmsg$nl_xfrm(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000940)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES64, @ANYRESHEX, @ANYRES8=r2, @ANYRES64=r4], 0x23c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) socket$inet_udp(0x2, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={0x0}}, 0x400c0) getsockname$packet(r7, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000500)=ANY=[@ANYBLOB="48000000101000000000000000c0d6c878f064eb16c8b14928b047de726ed0c87b901d06fd6441a62d6fa9510045ba23869843cdb4d335457a0c468a100b469ff7931cdebdb7c96583c74a78de75bc08c0d3f318e5aa7d08e6c4e3742d25ec52ab9dd0038a215d6e5e46b7d9497774f0bdb386392995f3b48f7f47c2647213f46186bd3f7ef3f1f8d0661a9ba4a2735304fe1ed49934fbca8fda72916f01a9e389c4436bad35424ada68adf5044f09683827d3572ac0b98ce5bb5faabde511e22262e4d2e621a4aac10abc84957e9b5a2c5ae348ba983157b56d6b7ec02aee1cc90648ae9bb843", @ANYRES32=r8, @ANYRESOCT=0x0], 0x48}}, 0x8040) sendmsg$nl_route_sched(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000680)=@newqdisc={0xd4, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r8, {}, {0xfff1, 0xffff}, {0xa}}, [@TCA_STAB={0xb0, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x4, 0x40, 0x7ff, 0x7fffffff, 0x2, 0x1, 0x1, 0x1}}, {0x6, 0x2, [0xb]}}, {{0x1c, 0x1, {0x4, 0x7, 0x3, 0x9, 0x1, 0x3, 0x20fd, 0x7}}, {0x12, 0x2, [0x1, 0xff, 0x6, 0x3, 0xa5, 0x8, 0x6]}}, {{0x1c, 0x1, {0x7, 0xa, 0x5, 0x9fd, 0x0, 0x7, 0x100, 0x7}}, {0x12, 0x2, [0x3, 0x442a, 0x2e96, 0x2, 0x0, 0x46e, 0x8]}}, {{0x1c, 0x1, {0x80, 0xf9, 0x101, 0x400000, 0xb2c47ad328971ccb, 0x7, 0x4, 0x4}}, {0xc, 0x2, [0x5, 0xcef, 0x3, 0x81]}}]}]}, 0xd4}, 0x1, 0xfffc}, 0x4000800) 935.429545ms ago: executing program 0 (id=7976): r0 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r0, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r1 = socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000140)={'macvtap0\x00'}) sendmsg$nl_route_sched(r1, 0x0, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newlink={0x40, 0x10, 0x49920d862a92153b, 0x800, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x1b400}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @vti={{0x8}, {0x14, 0x2, 0x0, 0x1, [@vti_common_policy=[@IFLA_VTI_IKEY={0x8, 0x2, 0x6}, @IFLA_VTI_FWMARK={0x8, 0x6, 0x3}]]}}}]}, 0x40}}, 0x0) r3 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r3, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x7}, 0x1c) listen(r3, 0xfffffffc) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x1, 0x41071, 0xffffffffffffffff, 0x0) r4 = socket$inet(0x2, 0x1, 0x0) setsockopt$sock_int(r4, 0x1, 0xf, &(0x7f0000356ffc)=0xffffffffffffff40, 0x4) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), 0xffffffffffffffff) r7 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(r7, 0x84, 0x22, &(0x7f0000000800)={0xf, 0x2, 0x1, 0x590}, 0x10) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000040), 0xffffffffffffffff) r10 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r10, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) sendmsg$MPTCP_PM_CMD_DEL_ADDR(r8, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)={0x28, r9, 0x7, 0x0, 0x0, {}, [@MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @local}]}]}, 0x28}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r5, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f00000004c0)={0x30, r6, 0x1, 0x70bd2c, 0x1000000, {}, [@MPTCP_PM_ATTR_ADDR={0x1c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @dev={0xac, 0x14, 0x14, 0x37}}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x3}]}]}, 0x30}, 0x1, 0xff07}, 0x2000000) 890.311979ms ago: executing program 1 (id=7977): r0 = socket(0x80000000000000a, 0x2, 0x0) setsockopt$inet6_group_source_req(r0, 0x29, 0x2a, &(0x7f0000000200)={0x0, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}, 0x2}}, {{0xa, 0x0, 0x0, @remote}}}, 0x108) r1 = socket(0x80000000000000a, 0x2, 0x0) setsockopt$inet6_group_source_req(r1, 0x29, 0x2a, &(0x7f0000000080)={0x20, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x0, 0x0, @remote}}}, 0x108) setsockopt$inet6_group_source_req(r1, 0x29, 0x2b, &(0x7f0000000200)={0x0, {{0xa, 0xffff, 0x0, @mcast1={0xff, 0x7}, 0x10000}}, {{0xa, 0x0, 0x0, @mcast1}}}, 0x108) setsockopt$inet6_group_source_req(r1, 0x29, 0x2b, &(0x7f0000000200)={0x0, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @local}}}}, 0x108) close(r0) r2 = socket(0x2a, 0x2, 0x0) ioctl$SIOCSIFMTU(r2, 0x8922, &(0x7f0000000080)={'dummy0\x00'}) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000980)=[{&(0x7f0000000080)="5c00000011006bec9e3be35c6e17aa31076b876c0d000000ba090000160af3653c001ac00400020208000300030001002c000000eab556a705251e618294ff0051f60a84c9f4d4938037e786a6d0000300000000000000ffffc6c953", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x4a046) setsockopt$inet6_group_source_req(r2, 0x29, 0x2e, &(0x7f00000000c0)={0xff, {{0xa, 0x4e22, 0x6, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0xb}}, {{0xa, 0x4e20, 0x0, @empty, 0x4}}}, 0x108) 708.000353ms ago: executing program 2 (id=7978): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_SET(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="20000214010026bd700002dcdf2505005400000000807ca19387eb005d8a"], 0x20}, 0x1, 0x0, 0x0, 0x4000801}, 0x0) socket$inet_udp(0x2, 0x2, 0x0) ioctl$AUTOFS_IOC_READY(r1, 0x9360, 0x0) r2 = socket$l2tp(0x2, 0x2, 0x73) socket$inet6(0xa, 0x966d7f7a3d03df2e, 0x3) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000001fc0)={0x0, 0x0, 0x5}, 0xc) sendmsg$nl_route(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[], 0x30}, 0x1, 0x0, 0x0, 0x4000140}, 0x0) socket$nl_route(0x10, 0x3, 0x0) (async) socket$nl_rdma(0x10, 0x3, 0x14) (async) sendmsg$RDMA_NLDEV_CMD_SET(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="20000214010026bd700002dcdf2505005400000000807ca19387eb005d8a"], 0x20}, 0x1, 0x0, 0x0, 0x4000801}, 0x0) (async) socket$inet_udp(0x2, 0x2, 0x0) (async) ioctl$AUTOFS_IOC_READY(r1, 0x9360, 0x0) (async) socket$l2tp(0x2, 0x2, 0x73) (async) socket$inet6(0xa, 0x966d7f7a3d03df2e, 0x3) (async) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000001fc0)={0x0, 0x0, 0x5}, 0xc) (async) sendmsg$nl_route(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[], 0x30}, 0x1, 0x0, 0x0, 0x4000140}, 0x0) (async) 689.495834ms ago: executing program 4 (id=7979): r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000013c0)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="050027bd7000000000000600000008000300", @ANYRES32=r1, @ANYBLOB="08004d01"], 0x24}, 0x1, 0x0, 0x0, 0x20040091}, 0x4) (fail_nth: 7) 665.774794ms ago: executing program 1 (id=7980): sendmsg$IPCTNL_MSG_EXP_NEW(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000480)={&(0x7f00000001c0)=ANY=[@ANYBLOB="b00000000002010300000000000000000700001040000a802c0002800c000280050001003a000000060003400004000006000340000200000c0002a10500010021000000080001400000000008000140000000015c000a804c0002800c00028005000100000000002c0001801400030000000000000000000000ffffffffffff14000400ff010000000000000000000000000001a39940ee31060003400004000006000340000400000c0002800600034000040000"], 0xb0}, 0x1, 0x0, 0x0, 0x40010}, 0x4008000) r0 = socket(0x10, 0x803, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='cpuset.memory_pressure_enabled\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r1, 0x0) r2 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) syz_emit_ethernet(0xfdef, &(0x7f0000000100)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaaaa86dd6092c01f00082f00fe8000000000000000000000000000bb00000000000000000000070000000000242065580000000000000021000086dd080088be4305400f10"], 0x0) setsockopt$bt_BT_SECURITY(r2, 0x112, 0x4, &(0x7f0000000080)={0x4}, 0x2) sendto(r0, &(0x7f0000000c40)="120000001200e7ef007b0000000000faffa0", 0x12, 0x8800, 0x0, 0x0) recvmmsg(r0, &(0x7f00000037c0), 0x0, 0x382da836b54caa9d, &(0x7f0000003700)={0x77359400}) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000180)={'wlan0\x00', 0x0}) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f00000003c0), 0xffffffffffffffff) sendmsg$NL80211_CMD_START_P2P_DEVICE(r3, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000480)={0x1c, r5, 0x1, 0x70bd2b, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r4}, @void}}}, 0x1c}, 0x1, 0x0, 0x0, 0xc000}, 0x0) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), r1) sendmsg$NL80211_CMD_CHANNEL_SWITCH(r0, &(0x7f0000001680)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000001640)={&(0x7f0000000c80)={0x934, r6, 0x400, 0x70bd28, 0x25dfdbfc, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_CSA_IES={0x914, 0xb9, 0x0, 0x1, [@beacon_params=[@NL80211_ATTR_BEACON_HEAD={0x2ae, 0xe, {{{0x0, 0x0, 0x8, 0x0, 0x0, 0x1, 0x1}, {0x5}, @device_b, @device_b, @from_mac, {0x2, 0xe}}, 0x1, @random=0xa3, 0x2000, @val={0x0, 0x6, @default_ibss_ssid}, @val={0x1, 0x3, [{0x2, 0x1}, {0x2, 0x1}, {0xc, 0x1}]}, @void, @val={0x4, 0x6, {0xe, 0x3, 0x0, 0x1}}, @val={0x6, 0x2, 0x7ff}, @void, @val={0x25, 0x3, {0x0, 0x10, 0x7}}, @void, @void, @void, @val={0x72, 0x6}, @void, @val={0x76, 0x6, {0x9, 0x1, 0x38, 0x10}}, [{0xdd, 0xb4, "1c870e640b8ee8038f439bca7aeeb24254a3248ee4057c30efc0258b4ee459ca3d9b6eab421863837f5c4e071b2413e8e0882a00fa3215978c8e9e1c8d106df038e976765f728c35f7f4a31d632b007186bc863ed94e44097f7b3aaf968dfb5d381e1fe953ba8d844936af4bdc9b9ba2bbd54895ed35f0882719bf0916053fabea21dc34965f7b30f9b645d440bf113b5b35d51290b3beddaa10e4948f90715a6d027ff35a5651ae78794c2217f78ba77c22bb7d"}, {0xdd, 0x37, "495b771d43224b535efce664ec635c63846f77401bf3d68cd4614ae6c47f4462b4f3dcd380ea335c8afe929ad41efe48299d7cb7cb385e"}, {0xdd, 0x4e, "f28894b8c8a98ba6ae99108bf73fd6d2db269b4fc2a956dc2f551c32a418c194aa9523119b94b049c5bdf66522ede3b9f1494e139d237fdc8daefdea4769e0c598d94650764e4726bb927933c9c1"}, {0xdd, 0x96, "3088378c79190d0528c07bed57fb1a8c58d8a2a1858b020dd469175257364d1d82033b4ef9be608648687cafc59698edc44ec1784680167eae47fddefb06644b306d56298cde9291d54bc0872d50eb208b9804affe864390082bdcd2ad89b194a75ea0f77f52fc13bb60ebc98511489a6bd7869f215de99bfe6aa68ed67bd36a15e49ded33859750902baee58b12ed4ea32b72299550"}, {0xdd, 0x19, "b02fea1718f47758577d067e9459f60a7bf0070a3a889c42c3"}, {0xdd, 0xd, "6d168d075c74640632c5d4e125"}, {0xdd, 0x55, "3d8f3e1540093d339aa0fe3f14a077105284b4d0e14ec2d4c2eed33e20b322e90bce24ea94855c64f0c7206556700703a68c9c8b5720762ec3791c7a88116021f80ac6576c3d7dcf8886ca7440992fb97f8e175209"}]}}, @NL80211_ATTR_BEACON_HEAD={0x2fa, 0xe, {{{0x0, 0x0, 0x8, 0x0, 0x0, 0x1, 0x1, 0x1}, {0x9}, @device_b, @broadcast, @initial, {0x7, 0x7f3}}, 0x1, @default, 0x652, @val={0x0, 0x1f, @random="37d281ace400ffcd36c251ede727bd2f6783bf9213246a9398e6db06413192"}, @val={0x1, 0x6, [{0x48, 0x1}, {0x48}, {0xb, 0x1}, {0x1, 0x1}, {0x9}, {0xb, 0x1}]}, @void, @void, @val={0x6, 0x2, 0x2}, @void, @void, @val={0x2a, 0x1, {0x1, 0x1}}, @void, @void, @void, @void, @val={0x76, 0x6, {0xa5, 0x2, 0x0, 0x8000}}, [{0xdd, 0xbd, "7d53a163ac65c303438596aee33384ae46db1a1d174c01fffb3beeda8c943d7045ae4e9d22c0bf042c375b762d83fcdeb7b73f9b0a4de97eb56c22806fdeb8932dfde691bf1784b71985ce1e95f02a4fb32992f1923b398c901ce7034e4fc5bdae139151c83a0ecfa5a26186159f3f01b27dbfabf4b54437d8943be842dfe4b9014895de8189562ca66c08ec73a21a2f5f3d7c96c06287e989759d1e0fedbf361dcad607f5272ae08b8de13d609e76629173a911a9e0153d3ca693dbe5"}, {0xdd, 0xbf, "2a7be0ed6b65efe51bfd971a46d82f1e166f8a7e24305dcb0554798ded75ffaecff28bad652b16c4e3ab30d3f11d95ddd11c6fffc525eb801c26472d2aa1dc28bc5f44fe972723eabff87b05bde4e1209717f3a0a3c0063b13950a4b7ec481468309c9ed5b38ff24e8070a12c5201a9ad536756e037931c607d2c4f80184a4730d7b315b15935e4a9fae77e9d8dc1b3663b583b10600b1b3719813e5719f1e44d526acbbe2f6a2c531a5eb85dc9da78f525aec02fc2e43c64e8e21e798aced"}, {0xdd, 0xea, "aec644fb1c6a339e719f6d0c4bf580dcd8252aac29c2edbeda389bd6fe48a7c477df2daa6d18ce80ef83cc7b449c7a51100eda77d40ee18a5a18ffb28b5d894fa2119568722961a6392bc2c0d397debdccfbed6f7e7d5b769bee74ed0a1dae8ca354015dbb4c26945b3b7051e540d4424054374e3751a90d506e5e8b29f73e495a788f6240342a5b0caadd49f5dc353fb4c5508f0f9bea88ad2887f56f3ebdc798f88a45300937935fd01b427c5bddb8169d86189d16fbc5efadb79ae8fc8138b9d76387ceeaf7a7f50860c53ad0f23730330c48e5193666561ac0bb40988904193016ca03f5380747f6"}, {0xdd, 0x2c, "6420ef44c407e4f59e011f807819190dec3ea1f80fc3bc326ffdaa044e6b958ba5cdba50b9132d79d2d7551f"}]}}, @NL80211_ATTR_IE_ASSOC_RESP={0x45, 0x80, [@prep={0x83, 0x25, {{0x0, 0x1}, 0x8, 0x1, @device_a, 0x4, @value=@broadcast, 0x10001, 0x1, @broadcast, 0x1}}, @sec_chan_ofs={0x3e, 0x1, 0x3}, @peer_mgmt={0x75, 0x6, {0x1, 0x7d89, @void, @val=0x21, @void}}, @mesh_config={0x71, 0x7, {0xffffffffffffffff, 0x0, 0x0, 0x0, 0x2, 0x20}}, @ext_channel_switch={0x3c, 0x4, {0x1, 0x6, 0xb, 0x3}}]}, @NL80211_ATTR_BEACON_TAIL={0x12a, 0xf, [@mic={0x8c, 0x18, {0x4, "7bc99cdd81c1", @long="4c77b919f1387efd4e08ea103ed520a9"}}, @supported_rates={0x1, 0x1, [{0xc, 0x1}]}, @ssid={0x0, 0x6, @default_ibss_ssid}, @channel_switch={0x25, 0x3, {0x4, 0xac, 0x2}}, @random_vendor={0xdd, 0x12, "e9dd9ffc0708dea50c32459934b3e323b410"}, @random={0x10, 0xc7, "0f089920fe16654d727818814e3ff7bc995c032e76187498ee62d4dc5aa04f0f470afcd91ef69901bd2c68a4203b60dc7a218c4d9c0e9f078caf9608d229a91da5552ff28a0f3f92e444d4e92e3cfc87579cfab1b899c6f9ae0689e3c49cffe68fd8c42ed20a500e25a215c5b1477fe76dcb01541bb924ad5070104c3aa34a63973377090dfaf16bcbce012313eaf9b24bcbd6dc24111a8ea9bed0a2347117e10bd4c213519c471ae43437cbb9ec919e2b5bc48e8ebd9dc900ee868e129af76bf543b6037469c7"}, @ht={0x2d, 0x1a, {0x10, 0x1, 0x6, 0x0, {0x3, 0x7, 0x0, 0x8, 0x0, 0x1, 0x1, 0x2}, 0x8, 0xa3, 0x50}}, @sec_chan_ofs={0x3e, 0x1, 0x3}]}, @NL80211_ATTR_IE_PROBE_RESP={0x1cc, 0x7f, [@fast_bss_trans={0x37, 0x10e, {0xa, 0x7, "0c168c9fb18ff6a02c20ab4b7771965e", "34064301a7fe742fee35b554d1612af5fb7e2515c1252e666fd7c539fff8c3cd", "a6cd59afae9e5f77c26c81bb5cf17d0f60e561be7238620427c7cc9664a0d0b3", [{0x2, 0x1f, "135885edcd375988f8824483f0ff51ff961be02f3d758535573b4a26545b89"}, {0x1, 0x17, "0f3205198d53e1d79d61eceb68a18fd4e363ad04974c43"}, {0x4, 0x9, "c8bddf0586d50139ba"}, {0x2, 0x27, "de743f6fe312f4a447416b2200a89196e52538696900cc547f2bff067a93e9c5d831cea9e51043"}, {0xd, 0x14, "aacc9432acad181b97fb8fbc8bd3f37c07c801df"}, {0x4, 0x14, "ae174e3c27d263e53d6b4565b4b26dd0052a917f"}, {0x1, 0x20, "f0a642fe0c838c27838228fc738a6f081008b523263e00d0b9bc9950e38d3b83"}]}}, @preq={0x82, 0x88, {{}, 0x0, 0x28, 0x7cbb5ee5, @device_b, 0x7, @void, 0x5, 0x7, 0xa, [{{0x1}, @device_a, 0x9}, {{}, @device_b, 0x4d}, {{0x1}, @device_b, 0xb}, {{0x1, 0x0, 0x1}, @broadcast}, {{0x1}, @broadcast, 0xfffffff5}, {{}, @broadcast, 0x1fe000}, {{}, @broadcast, 0x9}, {{0x1, 0x0, 0x1}, @device_a, 0x9}, {{0x0, 0x0, 0x1}, @device_b}, {{}, @device_a, 0xfffffffd}]}}, @erp={0x2a, 0x1, {0x1, 0x1}}, @dsss={0x3, 0x1, 0x30}, @peer_mgmt={0x75, 0x18, {0x1, 0xce2a, @val=0x6, @val=0x33, @val="5c821308e0dbbe9f2dd140dc138f935c"}}, @channel_switch={0x25, 0x3, {0x0, 0x5c, 0x1}}, @sec_chan_ofs={0x3e, 0x1, 0x2}, @chsw_timing={0x68, 0x4, {0x2, 0x4}}]}], @NL80211_ATTR_CSA_C_OFF_BEACON={0x6, 0xba, [0x2]}, @NL80211_ATTR_CSA_C_OFF_PRESP={0xc, 0xbb, [0x0, 0x4006, 0x7ff, 0x8f5a]}, @NL80211_ATTR_CSA_C_OFF_BEACON={0x10, 0xba, [0xc9f, 0x4, 0xe09, 0x9, 0xffff, 0x5]}]}, @NL80211_ATTR_CH_SWITCH_BLOCK_TX={0x4}]}, 0x934}, 0x1, 0x0, 0x0, 0x40050}, 0x80) 248.762871ms ago: executing program 0 (id=7981): r0 = socket$kcm(0x10, 0x3, 0x10) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000040)="1400000016000b63d25a80648c2594f90b24fc60", 0x8c0}], 0x1}, 0x0) recvmsg$kcm(r0, &(0x7f00000030c0)={0x0, 0x0, &(0x7f0000002e80)=[{&(0x7f0000000d40)=""/204, 0xcc}, {&(0x7f0000000640)=""/178, 0xb2}, {&(0x7f00000001c0)=""/124, 0x7c}, {&(0x7f0000000a80)=""/196, 0xc4}, {&(0x7f0000004140)=""/4093, 0xffd}, {&(0x7f0000000580)=""/179, 0xb3}, {&(0x7f0000000440)=""/125, 0x7d}, {&(0x7f0000003100)=""/4099, 0x1003}, {&(0x7f0000000740)=""/247, 0xf7}, {&(0x7f00000009c0)=""/132, 0x84}, {&(0x7f0000000c40)=""/222, 0xde}], 0xb, 0x0, 0x20}, 0x0) 248.357101ms ago: executing program 1 (id=7982): r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) sendmsg$inet6(0xffffffffffffffff, &(0x7f0000001c00)={0x0, 0x0, &(0x7f0000000000)=[{0x0}, {&(0x7f0000000440)="9eb1d91a92dc", 0x6}], 0x2}, 0x20008b88) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8b1a, 0x0) 248.233473ms ago: executing program 2 (id=7983): r0 = accept(0xffffffffffffffff, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, &(0x7f00000000c0)=0x80) r1 = syz_genetlink_get_family_id$devlink(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_SB_OCC_SNAPSHOT(r0, &(0x7f00000002c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000280)={&(0x7f0000000180)={0x84, r1, 0x2, 0x70bd2c, 0x25dfdbfd, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0xb, 0xc}}, {@pci={{0x8}, {0x11}}, {0x8, 0xb, 0x5}}, {@pci={{0x8}, {0x11}}, {0x8, 0xb, 0xd2bc}}]}, 0x84}, 0x1, 0x0, 0x0, 0x8000}, 0x2000c040) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$inet6_int(r2, 0x29, 0x4a, 0x0, &(0x7f0000000080)) r3 = socket$kcm(0xa, 0x922000000003, 0x11) setsockopt$sock_attach_bpf(r3, 0x29, 0x24, &(0x7f0000000600), 0x4) sendmsg$kcm(r3, &(0x7f0000000240)={&(0x7f0000000380)=@l2tp6={0xa, 0x0, 0x7, @local, 0x0, 0x20}, 0x80, &(0x7f0000000980)=[{&(0x7f0000000340)="f4001100052b3b25fe80070000000000000000000009ffffffe000"/40, 0xfd1b}], 0x1}, 0x20040000) 165.77755ms ago: executing program 4 (id=7984): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000001c0)=ANY=[@ANYBLOB='\\\x00\x00\x00', @ANYRES16, @ANYBLOB="010000000000000000001400000008000200fc00000018000180140002"], 0x5c}, 0x1, 0x0, 0x0, 0x4000800}, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000003c0)=ANY=[@ANYBLOB="4c0000001000370400"/20, @ANYRES32=0x0, @ANYBLOB="a3140500000000002c001280080001006774700020fd9e5508094f0000080000000000000000000000ffffac1e001100"/60], 0x4c}}, 0x8040) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000600)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01010000000000000000010000040900010073797a300000000040000000030a01080000000000000000010000000900030073797a320000000014000480080002400000000008000140000000000900010073797a300000000050000000060a010400000000000000000100000008000b40000000000900010073797a30000000002800048024000180090001006d657461000000001400028008000140000000120800024000000019140000001100", @ANYRES16=r2], 0xd8}, 0x1, 0x0, 0x0, 0x40000}, 0x4000010) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0xc0802, 0x0) ioctl$PPPIOCNEWUNIT(r3, 0xc004743e, &(0x7f00000000c0)) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000001c0)={0x12, 0x4, &(0x7f0000001300)=ANY=[@ANYBLOB="18000000000000000000000000000000711234000000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xf}, 0x94) pwritev(r3, &(0x7f0000000380)=[{&(0x7f0000000040)='\x00!', 0x2}, {&(0x7f0000000140)="abffa99a7d6ed2dcacc958fd3a5c773e03b4a54890c6ba34d4a318f17925141e844a5882851431385aa863defbc0d479f945bbd8eb945276a091970bbeccd52a559731b33c20fd6eb7d6adb5ba81c0eccf6ee0dfd3f702812d39c7853360046b50ad6a4436d4247a5e920c58f140a138faa35246b17306e25f6e34b456ccefe6c20a544cb784ec517071b8f1563bb232c4019084d9003f1a2832609a0e8eb141c1ded373dd38c0e827721ecab5570c9b"}, {&(0x7f0000000240)="43e51f1bce2ede7abb6a4b66c403f7e047ecee20f0c2fcb0e9a0fa457ecafec104711845155c12d3083c2643fa79d4831d46244b8543a725fd5366f46c47f28a49d9cd9504e8fcb98c7295b91fddb7740713db6271cd2cabd133fcda03c5c0f034350170b69e304f501b3d0b0adab4ab55293a945272119c6ce79f8290df879fff628d42f94b5057e51e8a86a1879350d393acc57a51418944c4ebd0bc038ee67565694f4a4a655c4c280a6c171c3d9f3526cd4edb361a"}, {&(0x7f0000000300)="f2671cb24621eed7e7a51d5659a146245add4a2f90cb80f9129d9a161de443485cc5ee75345f3572a222faec0745c7d800937747222bbd7f4dc9514a4799640f8255dc6a4743dab90efdb54b411a188a4e021ae5b392d4de7029e547a196c8990184ef06499677b80d5e21e063b3e263e1b2d2df8b2200a968be53e544fc"}], 0x1000000000000215, 0x5, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x4000000) sendmsg$NFT_MSG_GETRULE(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB="38000000070a010100000006000000000a0040010900010073797a3100"], 0x38}, 0x1, 0x0, 0x0, 0x20040850}, 0x44054) 85.271076ms ago: executing program 1 (id=7985): sendmsg$IPCTNL_MSG_EXP_NEW(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000000)={0xe0, 0x0, 0x2, 0x301, 0x0, 0x0, {0x7, 0x0, 0x10}, [@CTA_EXPECT_NAT={0x78, 0xa, 0x0, 0x1, [@CTA_EXPECT_NAT_TUPLE={0x2c, 0x2, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x3a}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x4}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x2}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x21}}]}, @CTA_EXPECT_NAT_DIR={0x8}, @CTA_EXPECT_NAT_DIR={0x8, 0x1, 0x1, 0x0, 0x1}, @CTA_EXPECT_NAT_TUPLE={0x38, 0x2, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x3a}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x84}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x3}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x3}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x6}}]}]}, @CTA_EXPECT_NAT={0x54, 0xa, 0x0, 0x1, [@CTA_EXPECT_NAT_TUPLE={0x4c, 0x2, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @ipv4={'\x00', '\xff\xff', @broadcast}}, {0x14, 0x4, @mcast1}}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x4}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x4}]}, @CTA_EXPECT_NAT_TUPLE={0x4}]}]}, 0xe0}, 0x1, 0x0, 0x0, 0x40010}, 0x4008000) r0 = socket(0x10, 0x803, 0x0) sendto(r0, &(0x7f0000000c40)="120000001200e7ef007b0000000000faffa0", 0x12, 0x8800, 0x0, 0x0) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x321}, {&(0x7f0000000280)=""/85, 0x21}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000580)=""/106, 0x659}, {&(0x7f0000000980)=""/73, 0xd}, {&(0x7f0000000200)=""/77, 0x69}, {&(0x7f00000007c0)=""/141, 0xc4}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0x41}, 0x5}], 0x4000000000003b4, 0x2000, &(0x7f0000003700)={0x77359400}) (fail_nth: 4) 0s ago: executing program 2 (id=7986): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) r2 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) r3 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) ioctl$sock_bt_hidp_HIDPCONNADD(r2, 0x400448c8, &(0x7f00000000c0)={r3, r2, 0x7, 0x0, 0x0, 0x7, 0x0, 0x209, 0x3, 0x5, 0x3, 0x2, 'syz1\x00'}) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) r5 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc2(&(0x7f0000000080), r5) syz_emit_ethernet(0x68, &(0x7f0000005a40)={@multicast, @random="6076b5cad4f6", @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "75e700", 0x32, 0x3a, 0x0, @rand_addr=' \x01\x00', @mcast2, {[], @param_prob={0x4, 0x0, 0x0, 0x0, {0x0, 0x6, "a3579e", 0x0, 0x2b, 0x0, @mcast1, @remote, [], "6be2"}}}}}}}, 0x0) sendmsg$nl_generic(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000007c0)={0x14, 0x15, 0x301, 0x0, 0x0, {0xa}}, 0x14}}, 0x0) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000440)={0x70, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r4}, @void}}, [@beacon=[@NL80211_ATTR_BEACON_HEAD={0x31, 0xe, {{{}, {}, @device_b, @device_b, @from_mac}, 0x0, @default, 0x0, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @val={0x71, 0x7, {0x1, 0x0, 0x1, 0x1, 0xffffffffffffffff, 0x7, 0x1}}, @void}}, @NL80211_ATTR_FTM_RESPONDER={0x8, 0x10e, 0x0, 0x1, [@NL80211_FTM_RESP_ATTR_ENABLED={0x4}]}], @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}], @NL80211_ATTR_BEACON_INTERVAL={0x8}, @NL80211_ATTR_DTIM_PERIOD={0x8, 0xd, 0xa4a2}]}, 0x70}, 0x1, 0x0, 0x0, 0x4004000}, 0x0) sendmsg$NL80211_CMD_SET_WDS_PEER(r0, &(0x7f00000002c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x40, r1, 0x4, 0x70bd29, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r4}, @val={0xc, 0x99, {0x4, 0x2f}}}}, [@NL80211_ATTR_MAC={0xa, 0x6, @from_mac=@device_b}, @NL80211_ATTR_MAC={0xa}]}, 0x40}, 0x1, 0x0, 0x0, 0x10}, 0x0) kernel console output (not intermixed with test programs): im3: set [1, 0] type 2 family 0 port 6081 - 0 [ 764.472140][T19365] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 764.514914][T19365] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 764.700040][T19379] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 764.732422][T19379] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 764.892237][T25310] netlink: 'syz.1.6775': attribute type 1 has an invalid length. [ 764.966326][T25315] Cannot find del_set index 4 as target [ 765.092219][T25310] bond1: entered promiscuous mode [ 765.113322][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 765.129670][T25310] bond1: entered allmulticast mode [ 765.149290][T25310] 8021q: adding VLAN 0 to HW filter on device bond1 [ 765.187477][T25314] erspan1: entered allmulticast mode [ 765.235249][T25314] bond1: (slave erspan1): making interface the new active one [ 765.242798][T25314] erspan1: entered promiscuous mode [ 765.257051][T25314] bond1: (slave erspan1): Enslaving as an active interface with an up link [ 765.439986][T25335] netlink: 'syz.3.6779': attribute type 20 has an invalid length. [ 765.450169][T25335] IPv6: NLM_F_CREATE should be specified when creating new route [ 765.529636][T25335] mac80211_hwsim hwsim37 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 766.059011][T25350] bridge0: port 2(bridge_slave_1) entered disabled state [ 766.112811][T25366] netlink: 72 bytes leftover after parsing attributes in process `syz.1.6787'. [ 766.153086][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 766.406089][ T5633] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 766.422795][ T5633] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 766.434327][ T5633] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 766.444885][ T5633] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 766.460718][ T5633] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 766.578948][T25356] syz.3.6784 (25356) used greatest stack depth: 17352 bytes left [ 767.202993][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 767.216190][T25405] netlink: 20 bytes leftover after parsing attributes in process `syz.1.6798'. [ 767.291867][T19379] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 767.348384][T13261] IPVS: starting estimator thread 0... [ 767.444447][T25414] IPVS: using max 29 ests per chain, 69600 per kthread [ 767.607311][T19379] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 767.767430][ T36] wlan1: Trigger new scan to find an IBSS to join [ 767.799023][T19379] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 767.839058][T25429] FAULT_INJECTION: forcing a failure. [ 767.839058][T25429] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 767.882994][T25429] CPU: 1 UID: 0 PID: 25429 Comm: syz.3.6805 Not tainted syzkaller #0 PREEMPT(full) [ 767.883024][T25429] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 767.883038][T25429] Call Trace: [ 767.883047][T25429] [ 767.883056][T25429] dump_stack_lvl+0xe8/0x150 [ 767.883086][T25429] should_fail_ex+0x40c/0x560 [ 767.883126][T25429] _copy_from_user+0x2d/0xb0 [ 767.883151][T25429] do_sock_getsockopt+0x200/0x7e0 [ 767.883181][T25429] ? __pfx_do_sock_getsockopt+0x10/0x10 [ 767.883222][T25429] ? __fget_files+0x3a2/0x420 [ 767.883243][T25429] ? __fget_files+0x2a/0x420 [ 767.883271][T25429] __x64_sys_getsockopt+0x1a4/0x240 [ 767.883302][T25429] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 767.883325][T25429] do_syscall_64+0x174/0x580 [ 767.883346][T25429] ? trace_irq_disable+0x3b/0x140 [ 767.883367][T25429] ? clear_bhb_loop+0x40/0x90 [ 767.883394][T25429] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 767.883415][T25429] RIP: 0033:0x7efe52f9ce59 [ 767.883436][T25429] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 767.883455][T25429] RSP: 002b:00007efe53f15028 EFLAGS: 00000246 ORIG_RAX: 0000000000000037 [ 767.883478][T25429] RAX: ffffffffffffffda RBX: 00007efe53215fa0 RCX: 00007efe52f9ce59 [ 767.883494][T25429] RDX: 0000000000000004 RSI: 0000000000000112 RDI: 0000000000000004 [ 767.883508][T25429] RBP: 00007efe53f15090 R08: 0000200000000080 R09: 0000000000000000 [ 767.883523][T25429] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 767.883536][T25429] R13: 00007efe53216038 R14: 00007efe53215fa0 R15: 00007ffcf7e76fe8 [ 767.883570][T25429] [ 768.141022][T25434] netlink: 666 bytes leftover after parsing attributes in process `syz.1.6807'. [ 768.227751][T19379] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 768.238749][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 768.272744][T25441] netlink: 12 bytes leftover after parsing attributes in process `syz.0.6809'. [ 768.553949][ T5630] Bluetooth: hci3: command tx timeout [ 768.884925][T19379] bridge_slave_1: left allmulticast mode [ 768.893338][T19379] bridge_slave_1: left promiscuous mode [ 768.901028][T19379] bridge0: port 2(bridge_slave_1) entered disabled state [ 768.931500][T19379] bridge_slave_0: left allmulticast mode [ 768.946960][T19379] bridge_slave_0: left promiscuous mode [ 768.960408][T19379] bridge0: port 1(bridge_slave_0) entered disabled state [ 769.086485][T25469] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6817'. [ 769.281918][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 769.646872][T19379] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 769.665423][T19379] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 769.676859][T19379] bond0 (unregistering): Released all slaves [ 769.693797][T19379] bond1 (unregistering): Released all slaves [ 769.804313][ T5288] 8021q: adding VLAN 0 to HW filter on device eth1 [ 770.010799][T19379] tipc: Disabling bearer [ 770.025242][T19379] tipc: Left network mode [ 770.028143][T25496] FAULT_INJECTION: forcing a failure. [ 770.028143][T25496] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 770.095315][T25373] bridge0: port 1(bridge_slave_0) entered blocking state [ 770.102849][T25373] bridge0: port 1(bridge_slave_0) entered disabled state [ 770.108384][T25496] CPU: 1 UID: 0 PID: 25496 Comm: syz.3.6819 Not tainted syzkaller #0 PREEMPT(full) [ 770.108458][T25496] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 770.108497][T25496] Call Trace: [ 770.108521][T25496] [ 770.108550][T25496] dump_stack_lvl+0xe8/0x150 [ 770.108635][T25496] should_fail_ex+0x40c/0x560 [ 770.108729][T25496] _copy_to_user+0x31/0xb0 [ 770.108811][T25496] simple_read_from_buffer+0xe1/0x170 [ 770.108898][T25496] proc_fail_nth_read+0x1bb/0x230 [ 770.108996][T25496] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 770.109074][T25496] ? rw_verify_area+0x24a/0x4c0 [ 770.109161][T25496] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 770.109223][T25496] vfs_read+0x213/0xa80 [ 770.109301][T25496] ? __pfx___mutex_lock+0x10/0x10 [ 770.109364][T25496] ? __pfx_vfs_read+0x10/0x10 [ 770.109448][T25496] ? __fget_files+0x2a/0x420 [ 770.109528][T25496] ? __fget_files+0x3a2/0x420 [ 770.109581][T25496] ? __fget_files+0x2a/0x420 [ 770.109663][T25496] ksys_read+0x150/0x270 [ 770.109743][T25496] ? __pfx_ksys_read+0x10/0x10 [ 770.109839][T25496] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 770.109909][T25496] do_syscall_64+0x174/0x580 [ 770.109962][T25496] ? trace_irq_disable+0x3b/0x140 [ 770.110019][T25496] ? clear_bhb_loop+0x40/0x90 [ 770.110093][T25496] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 770.110155][T25496] RIP: 0033:0x7efe52f5d68e [ 770.110216][T25496] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 770.110260][T25496] RSP: 002b:00007efe53f14fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 770.110318][T25496] RAX: ffffffffffffffda RBX: 00007efe53f156c0 RCX: 00007efe52f5d68e [ 770.110367][T25496] RDX: 000000000000000f RSI: 00007efe53f150a0 RDI: 0000000000000007 [ 770.110420][T25496] RBP: 00007efe53f15090 R08: 0000000000000000 R09: 0000000000000000 [ 770.110461][T25496] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 770.110494][T25496] R13: 00007efe53216038 R14: 00007efe53215fa0 R15: 00007ffcf7e76fe8 [ 770.110587][T25496] [ 770.323122][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 770.418979][T25373] bridge_slave_0: entered allmulticast mode [ 770.428522][T25373] bridge_slave_0: entered promiscuous mode [ 770.438927][T25373] bridge0: port 2(bridge_slave_1) entered blocking state [ 770.447561][T25373] bridge0: port 2(bridge_slave_1) entered disabled state [ 770.455467][T25373] bridge_slave_1: entered allmulticast mode [ 770.463903][T25373] bridge_slave_1: entered promiscuous mode [ 770.634153][ T5630] Bluetooth: hci3: command tx timeout [ 770.675622][T25516] netlink: 4 bytes leftover after parsing attributes in process `syz.3.6824'. [ 770.715308][T25373] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 770.728297][T25373] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 770.855030][T25516] macsec1: entered promiscuous mode [ 770.860508][T25516] bridge0: entered promiscuous mode [ 770.868864][T25516] macsec1: entered allmulticast mode [ 770.874801][T25516] bridge0: entered allmulticast mode [ 770.881972][T25516] bridge0: port 3(macsec1) entered blocking state [ 770.891747][T25516] bridge0: port 3(macsec1) entered disabled state [ 770.905978][T25516] bridge0: left allmulticast mode [ 770.940050][T25373] team0: Port device team_slave_0 added [ 770.962264][T13260] bridge0: left promiscuous mode [ 770.968420][T25528] FAULT_INJECTION: forcing a failure. [ 770.968420][T25528] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 771.014145][T25528] CPU: 1 UID: 0 PID: 25528 Comm: syz.0.6828 Not tainted syzkaller #0 PREEMPT(full) [ 771.014172][T25528] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 771.014184][T25528] Call Trace: [ 771.014193][T25528] [ 771.014202][T25528] dump_stack_lvl+0xe8/0x150 [ 771.014231][T25528] should_fail_ex+0x40c/0x560 [ 771.014265][T25528] _copy_from_user+0x2d/0xb0 [ 771.014289][T25528] ___sys_recvmsg+0x173/0x5a0 [ 771.014313][T25528] ? ktime_get_ts64+0xa9/0x410 [ 771.014337][T25528] ? __pfx____sys_recvmsg+0x10/0x10 [ 771.014364][T25528] ? __fget_files+0x2a/0x420 [ 771.014404][T25528] ? __fget_files+0x3a2/0x420 [ 771.014433][T25528] do_recvmmsg+0x31a/0x7f0 [ 771.014465][T25528] ? __pfx_do_recvmmsg+0x10/0x10 [ 771.014500][T25528] ? get_timespec64+0x119/0x1b0 [ 771.014522][T25528] ? __pfx_get_timespec64+0x10/0x10 [ 771.014555][T25528] __x64_sys_recvmmsg+0x1b7/0x250 [ 771.014582][T25528] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 771.014642][T25528] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 771.014667][T25528] do_syscall_64+0x174/0x580 [ 771.014688][T25528] ? trace_irq_disable+0x3b/0x140 [ 771.014709][T25528] ? clear_bhb_loop+0x40/0x90 [ 771.014736][T25528] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 771.014758][T25528] RIP: 0033:0x7f6ba959ce59 [ 771.014778][T25528] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 771.014797][T25528] RSP: 002b:00007f6baa4f0028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 771.014820][T25528] RAX: ffffffffffffffda RBX: 00007f6ba9816090 RCX: 00007f6ba959ce59 [ 771.014836][T25528] RDX: 04000000000003b4 RSI: 00002000000037c0 RDI: 0000000000000003 [ 771.014852][T25528] RBP: 00007f6baa4f0090 R08: 0000200000003700 R09: 0000000000000000 [ 771.014867][T25528] R10: 0000000000002000 R11: 0000000000000246 R12: 0000000000000001 [ 771.014881][T25528] R13: 00007f6ba9816128 R14: 00007f6ba9816090 R15: 00007ffcb8fbb678 [ 771.014915][T25528] [ 771.018079][T25373] team0: Port device team_slave_1 added [ 771.273551][T25530] netlink: 44 bytes leftover after parsing attributes in process `syz.1.6829'. [ 771.354176][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 771.551641][T25543] netlink: 76 bytes leftover after parsing attributes in process `syz.1.6833'. [ 771.647811][T25543] bridge0: port 2(bridge_slave_1) entered blocking state [ 771.655132][T25543] bridge0: port 2(bridge_slave_1) entered listening state [ 771.662537][T25543] bridge0: port 1(bridge_slave_0) entered blocking state [ 771.669774][T25543] bridge0: port 1(bridge_slave_0) entered listening state [ 771.680417][T25535] netlink: 40 bytes leftover after parsing attributes in process `syz.0.6830'. [ 771.703847][T25373] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 771.722043][T25373] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 771.782999][T25373] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 771.827882][T19379] hsr_slave_0: left promiscuous mode [ 771.851619][T19379] hsr_slave_1: left promiscuous mode [ 771.875745][T25557] sctp: [Deprecated]: syz.2.6834 (pid 25557) Use of int in max_burst socket option. [ 771.875745][T25557] Use struct sctp_assoc_value instead [ 771.877043][T19379] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 771.939854][T19379] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 771.971763][T19379] veth1_macvtap: left promiscuous mode [ 771.979553][T19379] veth1_vlan: left promiscuous mode [ 771.992719][T19379] veth0_vlan: left promiscuous mode [ 772.345373][T19379] team0 (unregistering): Port device team_slave_1 removed [ 772.371717][T19379] team0 (unregistering): Port device team_slave_0 removed [ 772.393099][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 772.520386][T25373] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 772.527447][T25373] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 772.556793][T25373] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 772.587199][ T5288] 8021q: adding VLAN 0 to HW filter on device eth2 [ 772.717353][ T5630] Bluetooth: hci3: command tx timeout [ 772.726633][T19365] wlan1: Trigger new scan to find an IBSS to join [ 772.743174][T25373] hsr_slave_0: entered promiscuous mode [ 772.749937][T25373] hsr_slave_1: entered promiscuous mode [ 772.756898][T25373] debugfs: 'hsr0' already exists in 'hsr' [ 772.762740][T25373] Cannot create hsr debugfs directory [ 772.952549][T25576] xt_hashlimit: size too large, truncated to 1048576 [ 772.976698][T25571] syzkaller0: entered promiscuous mode [ 772.989381][T25574] netlink: 16 bytes leftover after parsing attributes in process `syz.2.6841'. [ 773.002143][T25571] syzkaller0: entered allmulticast mode [ 773.119765][T25578] tipc: Enabled bearer , priority 0 [ 773.258539][T25569] tipc: Resetting bearer [ 773.378775][T25569] tipc: Disabling bearer [ 773.432996][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 773.548371][T25608] Bluetooth: MGMT ver 1.23 [ 773.580574][T19379] IPVS: stop unused estimator thread 0... [ 773.725881][T19363] wlan1: Creating new IBSS network, BSSID ee:51:2b:ed:7e:ed [ 774.472956][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 774.567891][T25655] netlink: 'syz.2.6864': attribute type 39 has an invalid length. [ 774.707889][T25659] netlink: 12 bytes leftover after parsing attributes in process `syz.2.6864'. [ 774.794186][ T5630] Bluetooth: hci3: command tx timeout [ 775.251920][T25373] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 775.281889][T25373] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 775.316862][T25373] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 775.328871][T25688] netlink: 32 bytes leftover after parsing attributes in process `syz.0.6874'. [ 775.368050][T25373] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 775.411610][T25373] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 775.451758][T25373] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 775.464382][T25373] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 775.504527][T25373] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 775.512969][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 775.791370][T25373] 8021q: adding VLAN 0 to HW filter on device bond0 [ 775.835633][T25715] xt_hl: Unknown TTL match mode: 255 [ 775.854932][T25373] 8021q: adding VLAN 0 to HW filter on device team0 [ 775.867778][T25715] netlink: 'syz.2.6883': attribute type 39 has an invalid length. [ 775.888083][T19365] bridge0: port 1(bridge_slave_0) entered blocking state [ 775.895322][T19365] bridge0: port 1(bridge_slave_0) entered forwarding state [ 775.936940][T25720] xt_hl: Unknown TTL match mode: 255 [ 775.972216][T19365] bridge0: port 2(bridge_slave_1) entered blocking state [ 775.979467][T19365] bridge0: port 2(bridge_slave_1) entered forwarding state [ 776.031886][T25724] netlink: 28 bytes leftover after parsing attributes in process `syz.3.6885'. [ 776.275411][T25734] netlink: 32 bytes leftover after parsing attributes in process `syz.0.6888'. [ 776.341940][T25735] syzkaller0: entered promiscuous mode [ 776.383715][T25735] syzkaller0: entered allmulticast mode [ 776.555394][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 777.027877][T25768] netlink: 28 bytes leftover after parsing attributes in process `syz.1.6896'. [ 777.364196][T25784] FAULT_INJECTION: forcing a failure. [ 777.364196][T25784] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 777.412761][T25784] CPU: 1 UID: 0 PID: 25784 Comm: syz.1.6899 Not tainted syzkaller #0 PREEMPT(full) [ 777.412792][T25784] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 777.412807][T25784] Call Trace: [ 777.412817][T25784] [ 777.412827][T25784] dump_stack_lvl+0xe8/0x150 [ 777.412864][T25784] should_fail_ex+0x40c/0x560 [ 777.412900][T25784] _copy_to_user+0x31/0xb0 [ 777.412927][T25784] simple_read_from_buffer+0xe1/0x170 [ 777.412956][T25784] proc_fail_nth_read+0x1bb/0x230 [ 777.412983][T25784] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 777.413022][T25784] ? rw_verify_area+0x24a/0x4c0 [ 777.413050][T25784] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 777.413073][T25784] vfs_read+0x213/0xa80 [ 777.413106][T25784] ? __pfx___mutex_lock+0x10/0x10 [ 777.413130][T25784] ? __pfx_vfs_read+0x10/0x10 [ 777.413159][T25784] ? __fget_files+0x2a/0x420 [ 777.413186][T25784] ? __fget_files+0x3a2/0x420 [ 777.413208][T25784] ? __fget_files+0x2a/0x420 [ 777.413240][T25784] ksys_read+0x150/0x270 [ 777.413270][T25784] ? __pfx_ksys_read+0x10/0x10 [ 777.413306][T25784] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 777.413331][T25784] do_syscall_64+0x174/0x580 [ 777.413352][T25784] ? trace_irq_disable+0x3b/0x140 [ 777.413374][T25784] ? clear_bhb_loop+0x40/0x90 [ 777.413414][T25784] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 777.413437][T25784] RIP: 0033:0x7fb24015d68e [ 777.413457][T25784] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 777.413476][T25784] RSP: 002b:00007fb240f9dfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 777.413499][T25784] RAX: ffffffffffffffda RBX: 00007fb240f9e6c0 RCX: 00007fb24015d68e [ 777.413516][T25784] RDX: 000000000000000f RSI: 00007fb240f9e0a0 RDI: 0000000000000005 [ 777.413529][T25784] RBP: 00007fb240f9e090 R08: 0000000000000000 R09: 0000000000000000 [ 777.413543][T25784] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 777.413555][T25784] R13: 00007fb240416038 R14: 00007fb240415fa0 R15: 00007ffd5a527278 [ 777.413589][T25784] [ 777.619503][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 777.625891][T25788] netlink: 32 bytes leftover after parsing attributes in process `syz.3.6900'. [ 777.868985][T25798] syzkaller0: entered promiscuous mode [ 777.902062][T25798] syzkaller0: entered allmulticast mode [ 778.158901][T25373] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 778.203946][T25814] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6907'. [ 778.227416][T25814] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6907'. [ 778.242721][T25814] vlan0: entered promiscuous mode [ 778.427765][T25826] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6909'. [ 778.633059][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 778.816239][T25843] Cannot find add_set index 0 as target [ 779.111522][T25373] veth0_vlan: entered promiscuous mode [ 779.160361][T25373] veth1_vlan: entered promiscuous mode [ 779.232445][T25856] syzkaller0: entered promiscuous mode [ 779.243803][T25856] syzkaller0: entered allmulticast mode [ 779.267107][T25855] syzkaller0: entered promiscuous mode [ 779.287484][T25855] syzkaller0: entered allmulticast mode [ 779.538288][T25373] veth0_macvtap: entered promiscuous mode [ 779.626690][T25373] veth1_macvtap: entered promiscuous mode [ 779.673212][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 779.701041][T25373] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 779.746015][T25373] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 779.792537][T19379] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 779.811181][T19379] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 779.843899][T19363] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 779.871568][T19363] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 780.361257][ T14] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 780.385010][ T14] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 780.436589][T25888] netlink: 20 bytes leftover after parsing attributes in process `syz.3.6925'. [ 780.465424][T25888] netlink: 20 bytes leftover after parsing attributes in process `syz.3.6925'. [ 780.584530][T25884] syzkaller0: entered promiscuous mode [ 780.592496][T25884] syzkaller0: entered allmulticast mode [ 780.713731][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 781.755124][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 782.802957][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 783.243228][T19365] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 783.257821][T19365] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 783.456332][T25908] FAULT_INJECTION: forcing a failure. [ 783.456332][T25908] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 783.491517][T25908] CPU: 1 UID: 0 PID: 25908 Comm: syz.4.6786 Not tainted syzkaller #0 PREEMPT(full) [ 783.491545][T25908] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 783.491559][T25908] Call Trace: [ 783.491568][T25908] [ 783.491577][T25908] dump_stack_lvl+0xe8/0x150 [ 783.491624][T25908] should_fail_ex+0x40c/0x560 [ 783.491677][T25908] _copy_from_iter+0x1d3/0x1660 [ 783.491710][T25908] ? kmem_cache_alloc_node_noprof+0x1b1/0x610 [ 783.491745][T25908] ? rcu_is_watching+0x15/0xb0 [ 783.491774][T25908] ? trace_kmem_cache_alloc+0x29/0xe0 [ 783.491809][T25908] ? kmem_cache_alloc_node_noprof+0x3b8/0x610 [ 783.491842][T25908] ? __pfx__copy_from_iter+0x10/0x10 [ 783.491875][T25908] ? __alloc_skb+0x276/0x7a0 [ 783.491895][T25908] ? __alloc_skb+0x276/0x7a0 [ 783.491922][T25908] ? netlink_sendmsg+0x650/0xb40 [ 783.491948][T25908] ? skb_put+0x112/0x210 [ 783.491973][T25908] netlink_sendmsg+0x6c0/0xb40 [ 783.492009][T25908] ? __pfx_netlink_sendmsg+0x10/0x10 [ 783.492039][T25908] ? aa_sock_msg_perm+0xf1/0x1b0 [ 783.492072][T25908] ? __pfx_netlink_sendmsg+0x10/0x10 [ 783.492097][T25908] sock_sendmsg_nosec+0x13a/0x180 [ 783.492131][T25908] ____sys_sendmsg+0x54e/0x850 [ 783.492162][T25908] ? __pfx_____sys_sendmsg+0x10/0x10 [ 783.492198][T25908] ? import_iovec+0x73/0xa0 [ 783.492225][T25908] ___sys_sendmsg+0x2a5/0x360 [ 783.492249][T25908] ? __lock_acquire+0x683/0x2cf0 [ 783.492278][T25908] ? __pfx____sys_sendmsg+0x10/0x10 [ 783.492346][T25908] ? __fget_files+0x2a/0x420 [ 783.492368][T25908] ? __fget_files+0x3a2/0x420 [ 783.492401][T25908] __x64_sys_sendmsg+0x1b1/0x290 [ 783.492439][T25908] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 783.492485][T25908] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 783.492511][T25908] do_syscall_64+0x174/0x580 [ 783.492532][T25908] ? trace_irq_disable+0x3b/0x140 [ 783.492554][T25908] ? clear_bhb_loop+0x40/0x90 [ 783.492582][T25908] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 783.492605][T25908] RIP: 0033:0x7f79d399ce59 [ 783.492626][T25908] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 783.492647][T25908] RSP: 002b:00007f79d4779028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 783.492671][T25908] RAX: ffffffffffffffda RBX: 00007f79d3c15fa0 RCX: 00007f79d399ce59 [ 783.492688][T25908] RDX: 0000000000000000 RSI: 0000200000000340 RDI: 0000000000000004 [ 783.492702][T25908] RBP: 00007f79d4779090 R08: 0000000000000000 R09: 0000000000000000 [ 783.492716][T25908] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 783.492729][T25908] R13: 00007f79d3c16038 R14: 00007f79d3c15fa0 R15: 00007ffc6c62d588 [ 783.492764][T25908] [ 783.706502][T25916] syzkaller0: entered promiscuous mode [ 783.783307][T25916] syzkaller0: entered allmulticast mode [ 783.833164][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 783.846211][T25919] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6937'. [ 783.866634][T25920] FAULT_INJECTION: forcing a failure. [ 783.866634][T25920] name failslab, interval 1, probability 0, space 0, times 0 [ 783.884102][T25920] CPU: 1 UID: 0 PID: 25920 Comm: syz.2.6936 Not tainted syzkaller #0 PREEMPT(full) [ 783.884143][T25920] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 783.884156][T25920] Call Trace: [ 783.884164][T25920] [ 783.884173][T25920] dump_stack_lvl+0xe8/0x150 [ 783.884203][T25920] should_fail_ex+0x40c/0x560 [ 783.884235][T25920] should_failslab+0xa8/0x100 [ 783.884262][T25920] __kmalloc_cache_noprof+0xa8/0x660 [ 783.884295][T25920] ? rtnl_newlink+0x136/0x1bd0 [ 783.884314][T25920] ? rtnl_newlink+0x136/0x1bd0 [ 783.884347][T25920] rtnl_newlink+0x136/0x1bd0 [ 783.884368][T25920] ? kasan_save_track+0x4f/0x80 [ 783.884386][T25920] ? kasan_save_track+0x3e/0x80 [ 783.884403][T25920] ? kasan_save_free_info+0x40/0x50 [ 783.884428][T25920] ? __kasan_slab_free+0x5c/0x80 [ 783.884446][T25920] ? kmem_cache_free+0x182/0x650 [ 783.884465][T25920] ? dev_hard_start_xmit+0x2cd/0x830 [ 783.884488][T25920] ? __netlink_deliver_tap+0x5b4/0x860 [ 783.884510][T25920] ? netlink_deliver_tap+0x19c/0x1b0 [ 783.884531][T25920] ? netlink_unicast+0x77f/0x940 [ 783.884549][T25920] ? netlink_sendmsg+0x813/0xb40 [ 783.884573][T25920] ? __pfx_rtnl_newlink+0x10/0x10 [ 783.884591][T25920] ? do_syscall_64+0x174/0x580 [ 783.884609][T25920] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 783.884663][T25920] ? kasan_quarantine_put+0xbb/0x1f0 [ 783.884694][T25920] ? lockdep_hardirqs_on+0x7a/0x110 [ 783.884727][T25920] ? nlmon_xmit+0xb0/0x100 [ 783.884823][T25920] ? kmem_cache_free+0x182/0x650 [ 783.884854][T25920] ? __lock_acquire+0x683/0x2cf0 [ 783.884880][T25920] ? __dev_queue_xmit+0x29b/0x37f0 [ 783.884907][T25920] ? __local_bh_enable_ip+0xd0/0x130 [ 783.884936][T25920] ? lockdep_hardirqs_on+0x7a/0x110 [ 783.884966][T25920] ? __dev_queue_xmit+0x29b/0x37f0 [ 783.884988][T25920] ? __local_bh_enable_ip+0xd0/0x130 [ 783.885015][T25920] ? __dev_queue_xmit+0x29b/0x37f0 [ 783.885045][T25920] ? rtnetlink_rcv_msg+0x1c9/0xc00 [ 783.885077][T25920] ? __pfx_rtnl_newlink+0x10/0x10 [ 783.885108][T25920] ? __pfx_rtnl_newlink+0x10/0x10 [ 783.885126][T25920] rtnetlink_rcv_msg+0x802/0xc00 [ 783.885162][T25920] ? rtnetlink_rcv_msg+0x1c9/0xc00 [ 783.885193][T25920] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 783.885222][T25920] ? ref_tracker_free+0x689/0x830 [ 783.885254][T25920] ? __pfx_ref_tracker_free+0x10/0x10 [ 783.885292][T25920] netlink_rcv_skb+0x226/0x4a0 [ 783.885317][T25920] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 783.885356][T25920] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 783.885392][T25920] ? netlink_deliver_tap+0x2e/0x1b0 [ 783.885415][T25920] ? netlink_deliver_tap+0x2e/0x1b0 [ 783.885443][T25920] netlink_unicast+0x7bb/0x940 [ 783.885475][T25920] netlink_sendmsg+0x813/0xb40 [ 783.885507][T25920] ? __pfx_netlink_sendmsg+0x10/0x10 [ 783.885535][T25920] ? aa_sock_msg_perm+0xf1/0x1b0 [ 783.885564][T25920] ? __pfx_netlink_sendmsg+0x10/0x10 [ 783.885587][T25920] sock_sendmsg_nosec+0x13a/0x180 [ 783.885618][T25920] ____sys_sendmsg+0x54e/0x850 [ 783.885646][T25920] ? __pfx_____sys_sendmsg+0x10/0x10 [ 783.885678][T25920] ? import_iovec+0x73/0xa0 [ 783.885703][T25920] ___sys_sendmsg+0x2a5/0x360 [ 783.885724][T25920] ? __lock_acquire+0x683/0x2cf0 [ 783.885749][T25920] ? __pfx____sys_sendmsg+0x10/0x10 [ 783.885804][T25920] ? __fget_files+0x2a/0x420 [ 783.885824][T25920] ? __fget_files+0x3a2/0x420 [ 783.885854][T25920] __x64_sys_sendmsg+0x1b1/0x290 [ 783.885879][T25920] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 783.885919][T25920] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 783.885942][T25920] do_syscall_64+0x174/0x580 [ 783.885977][T25920] ? trace_irq_disable+0x3b/0x140 [ 783.886010][T25920] ? clear_bhb_loop+0x40/0x90 [ 783.886035][T25920] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 783.886056][T25920] RIP: 0033:0x7f5526f9ce59 [ 783.886075][T25920] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 783.886092][T25920] RSP: 002b:00007f5527f30028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 783.886113][T25920] RAX: ffffffffffffffda RBX: 00007f5527215fa0 RCX: 00007f5526f9ce59 [ 783.886129][T25920] RDX: 0000000000000000 RSI: 0000200000000240 RDI: 0000000000000003 [ 783.886142][T25920] RBP: 00007f5527f30090 R08: 0000000000000000 R09: 0000000000000000 [ 783.886154][T25920] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 783.886167][T25920] R13: 00007f5527216038 R14: 00007f5527215fa0 R15: 00007ffd77bfbce8 [ 783.886199][T25920] [ 783.886334][T25920] netlink: 52 bytes leftover after parsing attributes in process `syz.2.6936'. [ 784.481416][T25920] bridge0: port 2(bridge_slave_1) entered disabled state [ 784.488907][T25920] bridge0: port 1(bridge_slave_0) entered disabled state [ 784.560277][T25927] syzkaller0: entered promiscuous mode [ 784.598046][T25927] syzkaller0: entered allmulticast mode [ 784.760060][T25951] netlink: 24 bytes leftover after parsing attributes in process `syz.4.6939'. [ 784.873817][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 784.995211][T25959] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6943'. [ 785.008409][T25959] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6943'. [ 785.326069][T25973] netlink: 20 bytes leftover after parsing attributes in process `syz.3.6944'. [ 785.336730][T25973] netlink: 20 bytes leftover after parsing attributes in process `syz.3.6944'. [ 785.359023][T25964] syzkaller0: entered promiscuous mode [ 785.365525][T25964] syzkaller0: entered allmulticast mode [ 785.381772][T25972] netlink: 16 bytes leftover after parsing attributes in process `syz.4.6949'. [ 785.786692][T25989] xt_TCPMSS: Only works on TCP SYN packets [ 785.913080][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 786.798807][ C0] bridge0: port 1(bridge_slave_0) entered learning state [ 786.806185][ C0] bridge0: port 2(bridge_slave_1) entered learning state [ 786.962964][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 787.768506][T25991] workqueue: Failed to create a rescuer kthread for wq "bond1": -EINTR [ 787.993012][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 788.107545][T26017] __nla_validate_parse: 1 callbacks suppressed [ 788.107568][T26017] netlink: 52 bytes leftover after parsing attributes in process `syz.2.6966'. [ 788.219690][T26023] netlink: 88 bytes leftover after parsing attributes in process `syz.2.6971'. [ 788.447269][T26034] netlink: 20 bytes leftover after parsing attributes in process `syz.2.6975'. [ 788.471734][T26034] netlink: 20 bytes leftover after parsing attributes in process `syz.2.6975'. [ 788.900518][T26062] netlink: 'syz.3.6986': attribute type 4 has an invalid length. [ 788.910266][T26063] openvswitch: netlink: VXLAN extension 1536 out of range max 1 [ 789.032948][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 789.107795][T26068] syzkaller0: entered promiscuous mode [ 789.122485][T26068] syzkaller0: entered allmulticast mode [ 789.534062][T26089] netlink: 96 bytes leftover after parsing attributes in process `syz.4.6993'. [ 789.588929][T26082] syzkaller0: entered promiscuous mode [ 789.613238][T26082] syzkaller0: entered allmulticast mode [ 789.651381][T26095] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6996'. [ 789.691368][T26089] vlan2: entered allmulticast mode [ 789.720241][T26089] bridge0: entered allmulticast mode [ 789.741042][T26095] veth0_macvtap: left promiscuous mode [ 789.831065][T26103] netlink: 'syz.3.6998': attribute type 20 has an invalid length. [ 790.078802][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 791.122964][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 791.787693][T26105] mac80211_hwsim hwsim37 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 791.797706][T19363] wlan1: Selected IBSS BSSID ee:51:2b:ed:7e:ed based on configured SSID [ 792.152992][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 792.227263][T26128] openvswitch: netlink: IP tunnel attribute has 4 unknown bytes. [ 792.289627][T26133] netlink: 'syz.4.7012': attribute type 4 has an invalid length. [ 792.302547][T26131] netlink: 20 bytes leftover after parsing attributes in process `syz.1.7011'. [ 792.336768][T26128] netlink: 32 bytes leftover after parsing attributes in process `syz.0.7009'. [ 792.352591][T26131] netlink: 20 bytes leftover after parsing attributes in process `syz.1.7011'. [ 792.546474][T26141] netlink: 20 bytes leftover after parsing attributes in process `syz.2.7016'. [ 792.718883][T26151] syzkaller0: entered promiscuous mode [ 792.731165][T26151] syzkaller0: entered allmulticast mode [ 792.869708][T26156] netlink: 'syz.1.7023': attribute type 20 has an invalid length. [ 792.898860][T26156] IPv6: NLM_F_CREATE should be specified when creating new route [ 792.926141][T26160] netlink: 'syz.4.7025': attribute type 10 has an invalid length. [ 792.942509][T26156] mac80211_hwsim hwsim34 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 792.996518][T26160] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 793.061886][T26160] netlink: 'syz.4.7025': attribute type 4 has an invalid length. [ 793.131957][T26171] __nla_validate_parse: 4 callbacks suppressed [ 793.131978][T26171] netlink: 20 bytes leftover after parsing attributes in process `syz.3.7029'. [ 793.150152][T26169] tipc: Started in network mode [ 793.165571][T26171] netlink: 20 bytes leftover after parsing attributes in process `syz.3.7029'. [ 793.192812][T26169] tipc: Node identity 7ae9966029ac, cluster identity 4711 [ 793.203897][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 793.217243][T26169] tipc: Enabled bearer , priority 0 [ 793.227681][T26176] syzkaller0: entered promiscuous mode [ 793.255058][T26176] syzkaller0: entered allmulticast mode [ 793.301219][T26169] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 793.332165][T26169] tipc: Resetting bearer [ 793.346439][T26168] tipc: Resetting bearer [ 793.394802][T26168] tipc: Disabling bearer [ 793.457889][T26185] FAULT_INJECTION: forcing a failure. [ 793.457889][T26185] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 793.482997][T26187] netlink: 40 bytes leftover after parsing attributes in process `syz.4.7035'. [ 793.501125][T26185] CPU: 1 UID: 0 PID: 26185 Comm: syz.0.7034 Not tainted syzkaller #0 PREEMPT(full) [ 793.501154][T26185] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 793.501168][T26185] Call Trace: [ 793.501178][T26185] [ 793.501188][T26185] dump_stack_lvl+0xe8/0x150 [ 793.501220][T26185] should_fail_ex+0x40c/0x560 [ 793.501256][T26185] _copy_from_iter+0x1d3/0x1660 [ 793.501288][T26185] ? kmem_cache_alloc_node_noprof+0x1b1/0x610 [ 793.501323][T26185] ? rcu_is_watching+0x15/0xb0 [ 793.501351][T26185] ? trace_kmem_cache_alloc+0x29/0xe0 [ 793.501395][T26185] ? kmem_cache_alloc_node_noprof+0x3b8/0x610 [ 793.501429][T26185] ? __pfx__copy_from_iter+0x10/0x10 [ 793.501462][T26185] ? __alloc_skb+0x276/0x7a0 [ 793.501481][T26185] ? __alloc_skb+0x276/0x7a0 [ 793.501508][T26185] ? netlink_sendmsg+0x650/0xb40 [ 793.501532][T26185] ? skb_put+0x112/0x210 [ 793.501558][T26185] netlink_sendmsg+0x6c0/0xb40 [ 793.501594][T26185] ? __pfx_netlink_sendmsg+0x10/0x10 [ 793.501625][T26185] ? aa_sock_msg_perm+0xf1/0x1b0 [ 793.501659][T26185] ? __pfx_netlink_sendmsg+0x10/0x10 [ 793.501684][T26185] sock_sendmsg_nosec+0x13a/0x180 [ 793.501718][T26185] ____sys_sendmsg+0x54e/0x850 [ 793.501749][T26185] ? __pfx_____sys_sendmsg+0x10/0x10 [ 793.501784][T26185] ? import_iovec+0x73/0xa0 [ 793.501811][T26185] ___sys_sendmsg+0x2a5/0x360 [ 793.501835][T26185] ? __lock_acquire+0x683/0x2cf0 [ 793.501863][T26185] ? __pfx____sys_sendmsg+0x10/0x10 [ 793.501927][T26185] ? __fget_files+0x2a/0x420 [ 793.501949][T26185] ? __fget_files+0x3a2/0x420 [ 793.501982][T26185] __x64_sys_sendmsg+0x1b1/0x290 [ 793.502010][T26185] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 793.502059][T26185] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 793.502084][T26185] do_syscall_64+0x174/0x580 [ 793.502118][T26185] ? trace_irq_disable+0x3b/0x140 [ 793.502139][T26185] ? clear_bhb_loop+0x40/0x90 [ 793.502165][T26185] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 793.502187][T26185] RIP: 0033:0x7f6ba959ce59 [ 793.502206][T26185] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 793.502226][T26185] RSP: 002b:00007f6baa511028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 793.502248][T26185] RAX: ffffffffffffffda RBX: 00007f6ba9815fa0 RCX: 00007f6ba959ce59 [ 793.502283][T26185] RDX: 0000000000000000 RSI: 00002000000002c0 RDI: 0000000000000003 [ 793.502297][T26185] RBP: 00007f6baa511090 R08: 0000000000000000 R09: 0000000000000000 [ 793.502310][T26185] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 793.502324][T26185] R13: 00007f6ba9816038 R14: 00007f6ba9815fa0 R15: 00007ffcb8fbb678 [ 793.502357][T26185] [ 793.955294][T26197] netlink: 'syz.0.7040': attribute type 1 has an invalid length. [ 794.015813][T26204] netlink: 'syz.0.7040': attribute type 50 has an invalid length. [ 794.149072][T26204] bond1: (slave bridge2): making interface the new active one [ 794.159863][T26204] bond1: (slave bridge2): Enslaving as an active interface with an up link [ 794.233004][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 794.245790][T26212] netlink: 20 bytes leftover after parsing attributes in process `syz.1.7043'. [ 794.257050][T26212] netlink: 20 bytes leftover after parsing attributes in process `syz.1.7043'. [ 794.389631][T26218] syzkaller0: entered promiscuous mode [ 794.397582][T26218] syzkaller0: entered allmulticast mode [ 794.433700][T26221] netlink: 4 bytes leftover after parsing attributes in process `syz.3.7048'. [ 794.467176][T26221] netlink: 216 bytes leftover after parsing attributes in process `syz.3.7048'. [ 794.482591][T26221] netlink: 8 bytes leftover after parsing attributes in process `syz.3.7048'. [ 794.568331][T26225] netlink: 40 bytes leftover after parsing attributes in process `syz.1.7049'. [ 794.579369][T26228] netlink: 'syz.0.7050': attribute type 20 has an invalid length. [ 795.273097][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 796.319053][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 796.894632][T26254] IPv6: NLM_F_CREATE should be specified when creating new route [ 797.128373][T26264] FAULT_INJECTION: forcing a failure. [ 797.128373][T26264] name failslab, interval 1, probability 0, space 0, times 0 [ 797.147172][T26264] CPU: 1 UID: 0 PID: 26264 Comm: syz.4.7058 Not tainted syzkaller #0 PREEMPT(full) [ 797.147200][T26264] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 797.147214][T26264] Call Trace: [ 797.147224][T26264] [ 797.147233][T26264] dump_stack_lvl+0xe8/0x150 [ 797.147267][T26264] should_fail_ex+0x40c/0x560 [ 797.147303][T26264] should_failslab+0xa8/0x100 [ 797.147332][T26264] kmem_cache_alloc_node_noprof+0xb3/0x610 [ 797.147364][T26264] ? local_lock_release+0x9c/0x160 [ 797.147400][T26264] ? __alloc_skb+0x1d7/0x7a0 [ 797.147419][T26264] ? __alloc_skb+0x1d7/0x7a0 [ 797.147448][T26264] __alloc_skb+0x1d7/0x7a0 [ 797.147475][T26264] create_monitor_ctrl_event+0x38/0x470 [ 797.147621][T26264] mgmt_cmd_complete+0x20e/0x5e0 [ 797.147660][T26264] set_debug_keys+0x303/0x5c0 [ 797.147722][T26264] ? __pfx_set_debug_keys+0x10/0x10 [ 797.147767][T26264] hci_mgmt_cmd+0xa2c/0xfc0 [ 797.147838][T26264] hci_sock_sendmsg+0x6e1/0xf50 [ 797.147875][T26264] ? __pfx_aa_sk_perm+0x10/0x10 [ 797.147901][T26264] ? __pfx_hci_sock_sendmsg+0x10/0x10 [ 797.147936][T26264] ? aa_sock_msg_perm+0xf1/0x1b0 [ 797.147976][T26264] ? __pfx_hci_sock_sendmsg+0x10/0x10 [ 797.148006][T26264] sock_sendmsg_nosec+0x13a/0x180 [ 797.148041][T26264] sock_write_iter+0x2de/0x3e0 [ 797.148072][T26264] ? __pfx_sock_write_iter+0x10/0x10 [ 797.148110][T26264] ? bpf_lsm_file_permission+0x9/0x20 [ 797.148140][T26264] ? security_file_permission+0x75/0x260 [ 797.148185][T26264] vfs_write+0x612/0xba0 [ 797.148223][T26264] ? __pfx_vfs_write+0x10/0x10 [ 797.148261][T26264] ? __fget_files+0x2a/0x420 [ 797.148295][T26264] ksys_write+0x150/0x270 [ 797.148325][T26264] ? __pfx_ksys_write+0x10/0x10 [ 797.148366][T26264] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 797.148391][T26264] do_syscall_64+0x174/0x580 [ 797.148413][T26264] ? trace_irq_disable+0x3b/0x140 [ 797.148435][T26264] ? clear_bhb_loop+0x40/0x90 [ 797.148463][T26264] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 797.148485][T26264] RIP: 0033:0x7f79d399ce59 [ 797.148506][T26264] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 797.148534][T26264] RSP: 002b:00007f79d4779028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 797.148558][T26264] RAX: ffffffffffffffda RBX: 00007f79d3c15fa0 RCX: 00007f79d399ce59 [ 797.148575][T26264] RDX: 0000000000000007 RSI: 0000200000000000 RDI: 0000000000000004 [ 797.148589][T26264] RBP: 00007f79d4779090 R08: 0000000000000000 R09: 0000000000000000 [ 797.148603][T26264] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 797.148617][T26264] R13: 00007f79d3c16038 R14: 00007f79d3c15fa0 R15: 00007ffc6c62d588 [ 797.148654][T26264] [ 797.386905][T26267] netlink: 36 bytes leftover after parsing attributes in process `syz.1.7060'. [ 797.397785][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 797.557870][T26274] syzkaller0: entered promiscuous mode [ 797.586338][T26274] syzkaller0: entered allmulticast mode [ 797.696486][T26283] netlink: 'syz.3.7066': attribute type 1 has an invalid length. [ 797.707005][T26279] netlink: 'syz.1.7064': attribute type 20 has an invalid length. [ 797.896122][T26293] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci3/hci3:200/input8 [ 797.995461][T26288] mac80211_hwsim hwsim34 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 798.240651][T26305] __nla_validate_parse: 5 callbacks suppressed [ 798.240671][T26305] netlink: 1688 bytes leftover after parsing attributes in process `syz.0.7074'. [ 798.280786][T26309] netlink: 20 bytes leftover after parsing attributes in process `syz.2.7076'. [ 798.323404][T26309] netlink: 20 bytes leftover after parsing attributes in process `syz.2.7076'. [ 798.392933][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 798.571493][T26322] netlink: 108 bytes leftover after parsing attributes in process `syz.0.7079'. [ 798.687881][T26325] syzkaller0: entered promiscuous mode [ 798.689710][T26328] netlink: 'syz.3.7085': attribute type 20 has an invalid length. [ 798.714638][T26325] syzkaller0: entered allmulticast mode [ 798.736342][T26328] mac80211_hwsim hwsim37 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 798.746192][T19361] wlan1: Selected IBSS BSSID ee:51:2b:ed:7e:ed based on configured SSID [ 798.818481][T26326] syzkaller0: entered promiscuous mode [ 798.826299][T26326] syzkaller0: entered allmulticast mode [ 799.058917][T26338] netlink: 1688 bytes leftover after parsing attributes in process `syz.0.7089'. [ 799.334517][T19354] nci: nci_add_new_protocol: the target found does not have the desired protocol [ 799.432955][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 799.480076][T26369] netlink: 20 bytes leftover after parsing attributes in process `syz.1.7093'. [ 799.507391][T26369] netlink: 20 bytes leftover after parsing attributes in process `syz.1.7093'. [ 799.657829][T26375] netlink: 'syz.4.7097': attribute type 20 has an invalid length. [ 799.666735][T26375] IPv6: NLM_F_CREATE should be specified when creating new route [ 799.681425][T26375] mac80211_hwsim hwsim39 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 800.472959][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 801.513088][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 801.764199][ T36] wlan1: Trigger new scan to find an IBSS to join [ 802.153059][ C0] bridge0: port 2(bridge_slave_1) entered forwarding state [ 802.160407][ C0] bridge0: topology change detected, propagating [ 802.167126][ C0] bridge0: port 1(bridge_slave_0) entered forwarding state [ 802.174401][ C0] bridge0: topology change detected, propagating [ 802.232440][T26346] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 802.553031][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 803.219139][T26379] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 803.422098][T26401] netlink: 8 bytes leftover after parsing attributes in process `syz.3.7105'. [ 803.436498][T26406] tipc: Enabling of bearer rejected, already enabled [ 803.518937][T19354] netdevsim netdevsim4 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 803.552448][T19354] netdevsim netdevsim4 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 803.584313][T19354] netdevsim netdevsim4 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 803.593225][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 803.625569][T19354] netdevsim netdevsim4 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 803.759634][T26421] netlink: 'syz.4.7112': attribute type 20 has an invalid length. [ 803.791491][T26421] mac80211_hwsim hwsim39 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 804.591085][T26466] netlink: 232 bytes leftover after parsing attributes in process `syz.3.7127'. [ 804.602816][T26465] syzkaller0: entered promiscuous mode [ 804.608565][T26465] syzkaller0: entered allmulticast mode [ 804.632932][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 804.640050][T26466] block nbd0: Unsupported socket: should be TCP or UNIX. [ 804.654811][T26465] tipc: Enabled bearer , priority 0 [ 804.664549][T26463] tipc: Resetting bearer [ 804.704531][T26463] tipc: Disabling bearer [ 805.080634][T26479] netlink: 'syz.3.7132': attribute type 1 has an invalid length. [ 805.205168][T26483] bond1: (slave ip6gretap1): Enslaving as a backup interface with an up link [ 805.291887][T26483] netlink: 28 bytes leftover after parsing attributes in process `syz.3.7132'. [ 805.408134][T26479] veth3: entered promiscuous mode [ 805.440285][T26479] bond1: (slave veth3): Enslaving as a backup interface with a down link [ 805.457312][T19354] bond1: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 805.482501][T26483] 8021q: adding VLAN 0 to HW filter on device bond1 [ 805.561405][T26495] netlink: 16 bytes leftover after parsing attributes in process `syz.0.7139'. [ 805.635010][T19361] bond1: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 805.658505][T26495] netlink: 16 bytes leftover after parsing attributes in process `syz.0.7139'. [ 805.672933][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 805.701466][T26498] netlink: 4 bytes leftover after parsing attributes in process `syz.1.7141'. [ 805.714611][T26495] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 805.886877][T26507] FAULT_INJECTION: forcing a failure. [ 805.886877][T26507] name failslab, interval 1, probability 0, space 0, times 0 [ 805.900834][T26507] CPU: 1 UID: 0 PID: 26507 Comm: syz.0.7144 Not tainted syzkaller #0 PREEMPT(full) [ 805.900863][T26507] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 805.900877][T26507] Call Trace: [ 805.900886][T26507] [ 805.900896][T26507] dump_stack_lvl+0xe8/0x150 [ 805.900929][T26507] should_fail_ex+0x40c/0x560 [ 805.900967][T26507] should_failslab+0xa8/0x100 [ 805.900996][T26507] __kmalloc_node_track_caller_noprof+0x100/0x730 [ 805.901034][T26507] ? __lock_acquire+0x683/0x2cf0 [ 805.901056][T26507] ? __kernfs_new_node+0xa9/0x980 [ 805.901079][T26507] ? __kernfs_new_node+0xa9/0x980 [ 805.901111][T26507] kstrdup+0x42/0x100 [ 805.901136][T26507] __kernfs_new_node+0xa9/0x980 [ 805.901171][T26507] ? __pfx___kernfs_new_node+0x10/0x10 [ 805.901197][T26507] ? kernfs_root+0x1c/0x230 [ 805.901228][T26507] ? kernfs_root+0x1c/0x230 [ 805.901250][T26507] ? kernfs_root+0x1c/0x230 [ 805.901271][T26507] ? kernfs_root+0x1c/0x230 [ 805.901299][T26507] kernfs_new_node+0xea/0x140 [ 805.901332][T26507] kernfs_create_link+0xa7/0x200 [ 805.901367][T26507] sysfs_do_create_link_sd+0x83/0x110 [ 805.901393][T26507] device_add_class_symlinks+0x1cf/0x240 [ 805.901532][T26507] device_add+0x467/0xb80 [ 805.901562][T26507] tty_register_device_attr+0x422/0x950 [ 805.901635][T26507] ? __pfx_tty_register_device_attr+0x10/0x10 [ 805.901677][T26507] ? tty_port_register_device+0xca/0x150 [ 805.901734][T26507] rfcomm_dev_ioctl+0x1b6c/0x21c0 [ 805.901779][T26507] ? kasan_quarantine_put+0xbb/0x1f0 [ 805.901813][T26507] ? __pfx_rfcomm_dev_ioctl+0x10/0x10 [ 805.901867][T26507] ? tomoyo_path_number_perm+0x219/0x5f0 [ 805.901894][T26507] ? tomoyo_path_number_perm+0x219/0x5f0 [ 805.901928][T26507] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 805.901964][T26507] sock_do_ioctl+0x101/0x320 [ 805.901995][T26507] ? __pfx_sock_do_ioctl+0x10/0x10 [ 805.902022][T26507] ? hook_file_ioctl+0x1f0/0x5f0 [ 805.902064][T26507] sock_ioctl+0x57a/0x7e0 [ 805.902094][T26507] ? __pfx_sock_ioctl+0x10/0x10 [ 805.902123][T26507] ? __fget_files+0x2a/0x420 [ 805.902144][T26507] ? __fget_files+0x3a2/0x420 [ 805.902165][T26507] ? __fget_files+0x2a/0x420 [ 805.902191][T26507] ? bpf_lsm_file_ioctl+0x9/0x20 [ 805.902222][T26507] ? __pfx_sock_ioctl+0x10/0x10 [ 805.902250][T26507] __se_sys_ioctl+0xfc/0x170 [ 805.902277][T26507] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 805.902302][T26507] do_syscall_64+0x174/0x580 [ 805.902322][T26507] ? trace_irq_disable+0x3b/0x140 [ 805.902343][T26507] ? clear_bhb_loop+0x40/0x90 [ 805.902371][T26507] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 805.902393][T26507] RIP: 0033:0x7f6ba959ce59 [ 805.902414][T26507] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 805.902434][T26507] RSP: 002b:00007f6baa511028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 805.902458][T26507] RAX: ffffffffffffffda RBX: 00007f6ba9815fa0 RCX: 00007f6ba959ce59 [ 805.902474][T26507] RDX: 0000200000000100 RSI: 00000000400452c8 RDI: 0000000000000004 [ 805.902489][T26507] RBP: 00007f6baa511090 R08: 0000000000000000 R09: 0000000000000000 [ 805.902503][T26507] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 805.902515][T26507] R13: 00007f6ba9816038 R14: 00007f6ba9815fa0 R15: 00007ffcb8fbb678 [ 805.902550][T26507] [ 806.370832][T26509] netlink: 32 bytes leftover after parsing attributes in process `syz.0.7145'. [ 806.569831][T26511] netlink: 232 bytes leftover after parsing attributes in process `syz.0.7146'. [ 806.713070][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 806.907398][T26521] netlink: 56 bytes leftover after parsing attributes in process `syz.1.7150'. [ 806.948593][T26521] netlink: 12 bytes leftover after parsing attributes in process `syz.1.7150'. [ 806.982997][T26521] netlink: 'syz.1.7150': attribute type 3 has an invalid length. [ 807.009349][T26525] syzkaller0: entered promiscuous mode [ 807.015375][T26521] netlink: 'syz.1.7150': attribute type 2 has an invalid length. [ 807.036661][T26525] syzkaller0: entered allmulticast mode [ 807.753033][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 807.767914][T19361] wlan1: Trigger new scan to find an IBSS to join [ 808.398965][T26591] tipc: Started in network mode [ 808.407760][T26591] tipc: Node identity de58b440b68b, cluster identity 4711 [ 808.417025][T26591] tipc: Enabled bearer , priority 0 [ 808.565177][T26599] __nla_validate_parse: 10 callbacks suppressed [ 808.565197][T26599] netlink: 32 bytes leftover after parsing attributes in process `syz.0.7182'. [ 808.598998][T26603] FAULT_INJECTION: forcing a failure. [ 808.598998][T26603] name failslab, interval 1, probability 0, space 0, times 0 [ 808.634940][T26603] CPU: 1 UID: 0 PID: 26603 Comm: syz.1.7183 Not tainted syzkaller #0 PREEMPT(full) [ 808.634970][T26603] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 808.634994][T26603] Call Trace: [ 808.635003][T26603] [ 808.635015][T26603] dump_stack_lvl+0xe8/0x150 [ 808.635065][T26603] should_fail_ex+0x40c/0x560 [ 808.635102][T26603] should_failslab+0xa8/0x100 [ 808.635130][T26603] __kmalloc_noprof+0xfe/0x720 [ 808.635165][T26603] ? rcu_is_watching+0x15/0xb0 [ 808.635192][T26603] ? tomoyo_realpath_from_path+0xef/0x640 [ 808.635222][T26603] ? tomoyo_realpath_from_path+0xef/0x640 [ 808.635259][T26603] tomoyo_realpath_from_path+0xef/0x640 [ 808.635300][T26603] ? tomoyo_path_number_perm+0x219/0x5f0 [ 808.635326][T26603] tomoyo_path_number_perm+0x246/0x5f0 [ 808.635354][T26603] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 808.635382][T26603] ? __lock_acquire+0x683/0x2cf0 [ 808.635422][T26603] ? hook_file_ioctl+0x1f0/0x5f0 [ 808.635470][T26603] ? __fget_files+0x2a/0x420 [ 808.635496][T26603] ? __fget_files+0x2a/0x420 [ 808.635522][T26603] ? __fget_files+0x3a2/0x420 [ 808.635543][T26603] ? __fget_files+0x2a/0x420 [ 808.635570][T26603] security_file_ioctl+0xc3/0x2a0 [ 808.635596][T26603] __se_sys_ioctl+0x47/0x170 [ 808.635625][T26603] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 808.635649][T26603] do_syscall_64+0x174/0x580 [ 808.635670][T26603] ? trace_irq_disable+0x3b/0x140 [ 808.635692][T26603] ? clear_bhb_loop+0x40/0x90 [ 808.635720][T26603] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 808.635743][T26603] RIP: 0033:0x7fb24019ce59 [ 808.635765][T26603] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 808.635785][T26603] RSP: 002b:00007fb240f9e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 808.635808][T26603] RAX: ffffffffffffffda RBX: 00007fb240415fa0 RCX: 00007fb24019ce59 [ 808.635824][T26603] RDX: 0000200000002480 RSI: 00000000400448c8 RDI: 0000000000000005 [ 808.635839][T26603] RBP: 00007fb240f9e090 R08: 0000000000000000 R09: 0000000000000000 [ 808.635853][T26603] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 808.635865][T26603] R13: 00007fb240416038 R14: 00007fb240415fa0 R15: 00007ffd5a527278 [ 808.635901][T26603] [ 808.635937][T26603] ERROR: Out of memory at tomoyo_realpath_from_path. [ 808.694093][T26591] syzkaller0: entered promiscuous mode [ 808.715547][T26603] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci3/hci3:200/input9 [ 808.744103][T26591] syzkaller0: entered allmulticast mode [ 808.746635][T26591] tipc: Resetting bearer [ 808.793506][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 809.067492][T19361] tipc: Resetting bearer [ 809.106780][T26606] tunl0: entered promiscuous mode [ 809.138361][T26606] netlink: 'syz.4.7184': attribute type 4 has an invalid length. [ 809.162687][T26606] netlink: 9 bytes leftover after parsing attributes in process `syz.4.7184'. [ 809.188926][T26590] tipc: Resetting bearer [ 809.206626][T26613] netlink: 104 bytes leftover after parsing attributes in process `syz.0.7187'. [ 809.350581][T26621] netlink: 8 bytes leftover after parsing attributes in process `syz.4.7190'. [ 809.448307][T26625] netlink: 'syz.4.7190': attribute type 21 has an invalid length. [ 809.458241][T26625] netlink: 156 bytes leftover after parsing attributes in process `syz.4.7190'. [ 809.833033][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 810.054062][T26640] openvswitch: netlink: IP tunnel dst address not specified [ 810.872961][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 811.371207][T26590] tipc: Disabling bearer [ 811.381435][T26621] netlink: 4 bytes leftover after parsing attributes in process `syz.4.7190'. [ 811.391957][T26621] netlink: 2 bytes leftover after parsing attributes in process `syz.4.7190'. [ 811.402236][T26621] veth1_to_bridge: entered allmulticast mode [ 811.409249][T26621] netlink: 4 bytes leftover after parsing attributes in process `syz.4.7190'. [ 811.418347][T26621] netlink: 2 bytes leftover after parsing attributes in process `syz.4.7190'. [ 811.430702][T13261] tipc: Node number set to 1758704704 [ 811.731122][T26659] netlink: 104 bytes leftover after parsing attributes in process `syz.4.7199'. [ 811.805610][T26660] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 811.837184][T26660] tipc: Enabled bearer , priority 10 [ 811.888297][T26665] syzkaller0: entered promiscuous mode [ 811.907381][T26665] syzkaller0: entered allmulticast mode [ 811.913042][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 811.943868][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 811.982104][T26667] sctp: [Deprecated]: syz.0.7204 (pid 26667) Use of struct sctp_assoc_value in delayed_ack socket option. [ 811.982104][T26667] Use struct sctp_sack_info instead [ 812.065558][T26667] macsec1: entered promiscuous mode [ 812.083507][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 812.223639][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 812.295991][T26685] vlan2: entered promiscuous mode [ 812.309959][T26685] bridge0: entered promiscuous mode [ 812.721353][T19379] wlan1: Trigger new scan to find an IBSS to join [ 812.783598][ C1] net_ratelimit: 3 callbacks suppressed [ 812.783616][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 812.799583][T26716] xt_AUDIT: Audit type out of range (valid range: 0..2) [ 812.924494][T13271] tipc: Node number set to 1397069408 [ 812.954774][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 813.063497][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 813.089822][T26732] openvswitch: netlink: Missing key (keys=40, expected=100) [ 813.206408][T13271] IPVS: starting estimator thread 0... [ 813.304218][T26740] IPVS: using max 27 ests per chain, 64800 per kthread [ 813.333545][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 813.659469][T19365] wlan1: Creating new IBSS network, BSSID c6:f6:40:91:05:3f [ 813.863641][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 813.928629][T26778] __nla_validate_parse: 6 callbacks suppressed [ 813.928652][T26778] netlink: 12 bytes leftover after parsing attributes in process `syz.2.7246'. [ 813.990804][T26778] netlink: 2 bytes leftover after parsing attributes in process `syz.2.7246'. [ 813.993179][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 814.264022][T26793] netlink: 16 bytes leftover after parsing attributes in process `syz.1.7254'. [ 814.437939][T26805] ipt_REJECT: TCP_RESET invalid for non-tcp [ 814.448963][T26805] netlink: 16 bytes leftover after parsing attributes in process `syz.2.7260'. [ 814.555920][T26808] netlink: 36 bytes leftover after parsing attributes in process `syz.1.7261'. [ 814.872972][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 814.920013][T26826] FAULT_INJECTION: forcing a failure. [ 814.920013][T26826] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 814.943412][T26826] CPU: 0 UID: 0 PID: 26826 Comm: syz.3.7270 Not tainted syzkaller #0 PREEMPT(full) [ 814.943441][T26826] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 814.943455][T26826] Call Trace: [ 814.943464][T26826] [ 814.943473][T26826] dump_stack_lvl+0xe8/0x150 [ 814.943505][T26826] should_fail_ex+0x40c/0x560 [ 814.943541][T26826] _copy_to_iter+0x404/0x1810 [ 814.943572][T26826] ? arch_stack_walk+0xfb/0x150 [ 814.943616][T26826] ? __pfx__copy_to_iter+0x10/0x10 [ 814.943651][T26826] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 814.943684][T26826] ? lockdep_hardirqs_on+0x7a/0x110 [ 814.943717][T26826] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 814.943747][T26826] ? __skb_try_recv_datagram+0x3de/0x4e0 [ 814.943789][T26826] __skb_datagram_iter+0xf8/0x980 [ 814.943817][T26826] ? __pfx_simple_copy_to_iter+0x10/0x10 [ 814.943853][T26826] skb_copy_datagram_iter+0xb5/0x240 [ 814.943884][T26826] netlink_recvmsg+0x2b9/0xa50 [ 814.943920][T26826] ? __pfx_netlink_recvmsg+0x10/0x10 [ 814.943967][T26826] ? aa_sock_msg_perm+0xf1/0x1b0 [ 814.943996][T26826] ? bpf_lsm_socket_recvmsg+0x9/0x20 [ 814.944024][T26826] ? security_socket_recvmsg+0x7e/0x2c0 [ 814.944134][T26826] ? __pfx_netlink_recvmsg+0x10/0x10 [ 814.944178][T26826] sock_recvmsg+0x196/0x1e0 [ 814.944213][T26826] ____sys_recvmsg+0x1e6/0x4a0 [ 814.944237][T26826] ? iovec_from_user+0x87/0x250 [ 814.944270][T26826] ? __pfx_____sys_recvmsg+0x10/0x10 [ 814.944324][T26826] ? import_iovec+0x73/0xa0 [ 814.944351][T26826] ___sys_recvmsg+0x213/0x5a0 [ 814.944375][T26826] ? ktime_get_ts64+0xa9/0x410 [ 814.944401][T26826] ? __pfx____sys_recvmsg+0x10/0x10 [ 814.944431][T26826] ? __fget_files+0x2a/0x420 [ 814.944471][T26826] ? __fget_files+0x3a2/0x420 [ 814.944503][T26826] do_recvmmsg+0x31a/0x7f0 [ 814.944536][T26826] ? __pfx_do_recvmmsg+0x10/0x10 [ 814.944575][T26826] ? get_timespec64+0x119/0x1b0 [ 814.944600][T26826] ? __pfx_get_timespec64+0x10/0x10 [ 814.944634][T26826] __x64_sys_recvmmsg+0x1b7/0x250 [ 814.944661][T26826] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 814.944695][T26826] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 814.944718][T26826] do_syscall_64+0x174/0x580 [ 814.944739][T26826] ? trace_irq_disable+0x3b/0x140 [ 814.944760][T26826] ? clear_bhb_loop+0x40/0x90 [ 814.944794][T26826] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 814.944821][T26826] RIP: 0033:0x7efe52f9ce59 [ 814.944858][T26826] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 814.944881][T26826] RSP: 002b:00007efe53f15028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 814.944905][T26826] RAX: ffffffffffffffda RBX: 00007efe53215fa0 RCX: 00007efe52f9ce59 [ 814.944920][T26826] RDX: 04000000000003b4 RSI: 00002000000037c0 RDI: 0000000000000003 [ 814.944935][T26826] RBP: 00007efe53f15090 R08: 0000200000003700 R09: 0000000000000000 [ 814.944949][T26826] R10: 0000000000002000 R11: 0000000000000246 R12: 0000000000000001 [ 814.944963][T26826] R13: 00007efe53216038 R14: 00007efe53215fa0 R15: 00007ffcf7e76fe8 [ 814.944997][T26826] [ 815.033382][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 815.417586][T26837] netlink: 'syz.4.7274': attribute type 10 has an invalid length. [ 815.450137][T26837] 8021q: adding VLAN 0 to HW filter on device team0 [ 815.467324][T26837] bond0: (slave team0): Enslaving as an active interface with an up link [ 815.890987][T26869] netlink: 'syz.4.7286': attribute type 3 has an invalid length. [ 815.912960][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 816.017210][T26875] netlink: 'syz.4.7288': attribute type 20 has an invalid length. [ 816.065598][T26875] mac80211_hwsim hwsim39 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 816.112715][T26878] netlink: 'syz.2.7289': attribute type 4 has an invalid length. [ 816.133000][T26878] netlink: 17 bytes leftover after parsing attributes in process `syz.2.7289'. [ 816.244934][T26886] netlink: 20 bytes leftover after parsing attributes in process `syz.2.7289'. [ 816.545004][T26898] netlink: 'syz.4.7298': attribute type 3 has an invalid length. [ 816.620783][T26904] netlink: 16 bytes leftover after parsing attributes in process `syz.3.7303'. [ 816.881371][T26918] netlink: 16 bytes leftover after parsing attributes in process `syz.3.7308'. [ 817.028538][T26926] mac80211_hwsim hwsim37 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 817.038767][ T36] wlan1: Selected IBSS BSSID ee:51:2b:ed:7e:ed based on configured SSID [ 817.066026][T26927] netlink: 8 bytes leftover after parsing attributes in process `syz.1.7310'. [ 817.106024][T26931] netlink: 'syz.2.7314': attribute type 3 has an invalid length. [ 817.509011][T26954] syzkaller0: entered promiscuous mode [ 817.519938][T26954] syzkaller0: entered allmulticast mode [ 817.819685][T26969] net_ratelimit: 3 callbacks suppressed [ 817.819705][T26969] openvswitch: netlink: nsh attribute has 4 unknown bytes. [ 817.848323][T26969] FAULT_INJECTION: forcing a failure. [ 817.848323][T26969] name failslab, interval 1, probability 0, space 0, times 0 [ 817.865903][T26969] CPU: 0 UID: 0 PID: 26969 Comm: syz.0.7329 Not tainted syzkaller #0 PREEMPT(full) [ 817.865933][T26969] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 817.865947][T26969] Call Trace: [ 817.865956][T26969] [ 817.865965][T26969] dump_stack_lvl+0xe8/0x150 [ 817.865997][T26969] should_fail_ex+0x40c/0x560 [ 817.866034][T26969] should_failslab+0xa8/0x100 [ 817.866063][T26969] kmem_cache_alloc_noprof+0xa6/0x5f0 [ 817.866096][T26969] ? skb_clone+0x212/0x3a0 [ 817.866120][T26969] ? skb_clone+0x212/0x3a0 [ 817.866151][T26969] skb_clone+0x212/0x3a0 [ 817.866180][T26969] __netlink_deliver_tap+0x413/0x860 [ 817.866224][T26969] ? netlink_deliver_tap+0x2e/0x1b0 [ 817.866251][T26969] netlink_deliver_tap+0x19c/0x1b0 [ 817.866280][T26969] netlink_sendskb+0x68/0x140 [ 817.866305][T26969] netlink_rcv_skb+0x2a4/0x4a0 [ 817.866332][T26969] ? __pfx_genl_rcv_msg+0x10/0x10 [ 817.866366][T26969] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 817.866409][T26969] ? down_read+0x2be/0x330 [ 817.866437][T26969] genl_rcv+0x28/0x40 [ 817.866465][T26969] netlink_unicast+0x7bb/0x940 [ 817.866499][T26969] netlink_sendmsg+0x813/0xb40 [ 817.866536][T26969] ? __pfx_netlink_sendmsg+0x10/0x10 [ 817.866566][T26969] ? aa_sock_msg_perm+0xf1/0x1b0 [ 817.866598][T26969] ? __pfx_netlink_sendmsg+0x10/0x10 [ 817.866628][T26969] sock_sendmsg_nosec+0x13a/0x180 [ 817.866662][T26969] ____sys_sendmsg+0x54e/0x850 [ 817.866693][T26969] ? __pfx_____sys_sendmsg+0x10/0x10 [ 817.866729][T26969] ? import_iovec+0x73/0xa0 [ 817.866756][T26969] ___sys_sendmsg+0x2a5/0x360 [ 817.866779][T26969] ? __lock_acquire+0x683/0x2cf0 [ 817.866806][T26969] ? __pfx____sys_sendmsg+0x10/0x10 [ 817.866867][T26969] ? __fget_files+0x2a/0x420 [ 817.866889][T26969] ? __fget_files+0x3a2/0x420 [ 817.866921][T26969] __x64_sys_sendmsg+0x1b1/0x290 [ 817.866947][T26969] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 817.866988][T26969] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 817.867011][T26969] do_syscall_64+0x174/0x580 [ 817.867030][T26969] ? trace_irq_disable+0x3b/0x140 [ 817.867051][T26969] ? clear_bhb_loop+0x40/0x90 [ 817.867078][T26969] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 817.867099][T26969] RIP: 0033:0x7f6ba959ce59 [ 817.867120][T26969] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 817.867141][T26969] RSP: 002b:00007f6baa511028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 817.867164][T26969] RAX: ffffffffffffffda RBX: 00007f6ba9815fa0 RCX: 00007f6ba959ce59 [ 817.867181][T26969] RDX: 000000000000c000 RSI: 00002000000004c0 RDI: 0000000000000008 [ 817.867196][T26969] RBP: 00007f6baa511090 R08: 0000000000000000 R09: 0000000000000000 [ 817.867210][T26969] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 817.867224][T26969] R13: 00007f6ba9816038 R14: 00007f6ba9815fa0 R15: 00007ffcb8fbb678 [ 817.867262][T26969] [ 817.993092][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 818.165138][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 818.468045][T26981] netlink: zone id is out of range [ 818.709097][T26994] syzkaller0: entered promiscuous mode [ 818.730916][T26994] syzkaller0: entered allmulticast mode [ 818.956053][T27007] __nla_validate_parse: 4 callbacks suppressed [ 818.956073][T27007] netlink: 8 bytes leftover after parsing attributes in process `syz.3.7346'. [ 819.033075][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 819.044525][T27007] netlink: 8 bytes leftover after parsing attributes in process `syz.3.7346'. [ 819.088374][T27012] netlink: 104 bytes leftover after parsing attributes in process `syz.4.7348'. [ 819.192933][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 819.277961][T27021] FAULT_INJECTION: forcing a failure. [ 819.277961][T27021] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 819.308156][T27021] CPU: 1 UID: 0 PID: 27021 Comm: syz.1.7354 Not tainted syzkaller #0 PREEMPT(full) [ 819.308187][T27021] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 819.308201][T27021] Call Trace: [ 819.308210][T27021] [ 819.308220][T27021] dump_stack_lvl+0xe8/0x150 [ 819.308253][T27021] should_fail_ex+0x40c/0x560 [ 819.308297][T27021] _copy_from_user+0x2d/0xb0 [ 819.308324][T27021] __copy_msghdr+0x390/0x590 [ 819.308354][T27021] ___sys_sendmsg+0x213/0x360 [ 819.308379][T27021] ? __lock_acquire+0x683/0x2cf0 [ 819.308407][T27021] ? __pfx____sys_sendmsg+0x10/0x10 [ 819.308478][T27021] ? __fget_files+0x2a/0x420 [ 819.308501][T27021] ? __fget_files+0x3a2/0x420 [ 819.308534][T27021] __x64_sys_sendmsg+0x1b1/0x290 [ 819.308562][T27021] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 819.308607][T27021] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 819.308632][T27021] do_syscall_64+0x174/0x580 [ 819.308654][T27021] ? trace_irq_disable+0x3b/0x140 [ 819.308676][T27021] ? clear_bhb_loop+0x40/0x90 [ 819.308704][T27021] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 819.308726][T27021] RIP: 0033:0x7fb24019ce59 [ 819.308748][T27021] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 819.308767][T27021] RSP: 002b:00007fb240f9e028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 819.308790][T27021] RAX: ffffffffffffffda RBX: 00007fb240415fa0 RCX: 00007fb24019ce59 [ 819.308807][T27021] RDX: 0000000000000004 RSI: 0000200000000500 RDI: 0000000000000008 [ 819.308821][T27021] RBP: 00007fb240f9e090 R08: 0000000000000000 R09: 0000000000000000 [ 819.308835][T27021] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 819.308848][T27021] R13: 00007fb240416038 R14: 00007fb240415fa0 R15: 00007ffd5a527278 [ 819.308883][T27021] [ 819.858786][T27045] syzkaller0: entered promiscuous mode [ 819.869540][T27045] syzkaller0: entered allmulticast mode [ 820.035347][T27055] netlink: 156 bytes leftover after parsing attributes in process `syz.2.7366'. [ 820.073401][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 820.233045][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 820.389561][T27077] netlink: 96 bytes leftover after parsing attributes in process `syz.3.7372'. [ 820.428702][T27071] syzkaller0: entered promiscuous mode [ 820.440127][T27071] syzkaller0: entered allmulticast mode [ 820.471172][T27077] vlan3: entered allmulticast mode [ 820.493193][T27077] bridge0: entered allmulticast mode [ 821.096183][T27109] netlink: 76 bytes leftover after parsing attributes in process `syz.4.7385'. [ 821.121718][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 821.185928][T27112] netlink: 'syz.1.7386': attribute type 11 has an invalid length. [ 821.194280][T27112] netlink: 4 bytes leftover after parsing attributes in process `syz.1.7386'. [ 821.237959][T27113] netlink: 52 bytes leftover after parsing attributes in process `syz.1.7386'. [ 821.278950][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 822.991709][T27109] netlink: 52 bytes leftover after parsing attributes in process `syz.4.7385'. [ 823.021422][T27113] bridge0: port 2(bridge_slave_1) entered disabled state [ 823.028885][T27113] bridge0: port 1(bridge_slave_0) entered disabled state [ 823.044763][T27109] bridge0: port 2(bridge_slave_1) entered disabled state [ 823.052562][T27109] bridge0: port 1(bridge_slave_0) entered disabled state [ 823.077584][T19365] netdevsim netdevsim1 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 823.107031][T19365] netdevsim netdevsim1 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 823.130579][T19365] netdevsim netdevsim1 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 823.192400][T19365] netdevsim netdevsim1 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 823.201289][ C1] net_ratelimit: 2 callbacks suppressed [ 823.201309][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 823.287590][T19363] wlan1: Selected IBSS BSSID c6:f6:40:91:05:3f based on configured SSID [ 823.353080][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 823.637008][T27141] netlink: 8 bytes leftover after parsing attributes in process `syz.4.7398'. [ 823.792641][T27155] Bluetooth: MGMT ver 1.23 [ 823.841759][T27147] syzkaller0: entered promiscuous mode [ 823.847590][T27147] syzkaller0: entered allmulticast mode [ 823.920045][T27147] vlan3: entered allmulticast mode [ 823.942711][T27147] bridge0: entered allmulticast mode [ 824.232947][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 824.392933][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 824.566256][T27182] sctp: [Deprecated]: syz.3.7413 (pid 27182) Use of struct sctp_assoc_value in delayed_ack socket option. [ 824.566256][T27182] Use struct sctp_sack_info instead [ 825.272953][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 825.432970][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 826.316979][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 826.473524][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 826.569217][T27181] netdevsim netdevsim3 netdevsim0: entered promiscuous mode [ 826.598170][T19363] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 826.632755][T19363] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 826.670897][T19363] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 826.693849][T19363] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 826.876819][T27198] netdevsim netdevsim1 netdevsim0: entered allmulticast mode [ 826.903366][T27198] __nla_validate_parse: 2 callbacks suppressed [ 826.903386][T27198] netlink: 8 bytes leftover after parsing attributes in process `syz.1.7419'. [ 826.940270][T27198] netlink: 'syz.1.7419': attribute type 8 has an invalid length. [ 827.275810][T27219] netlink: 4 bytes leftover after parsing attributes in process `syz.0.7428'. [ 827.353044][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 827.483946][T27227] x_tables: ip6_tables: mh match: only valid for protocol 135 [ 827.513145][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 827.535265][T27225] syzkaller0: entered promiscuous mode [ 827.540917][T27225] syzkaller0: entered allmulticast mode [ 828.393722][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 828.553045][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 829.432934][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 829.592942][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 830.472949][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 830.633041][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 830.726269][T27272] netlink: 36 bytes leftover after parsing attributes in process `syz.3.7446'. [ 830.967881][T27283] vcan0: tx drop: invalid sa for name 0x00000000000000f0 [ 831.266112][T27301] netlink: 'syz.4.7461': attribute type 24 has an invalid length. [ 831.432321][T27303] syzkaller0: entered promiscuous mode [ 831.440431][T27303] syzkaller0: entered allmulticast mode [ 831.513067][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 831.612719][T27322] FAULT_INJECTION: forcing a failure. [ 831.612719][T27322] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 831.632188][T27322] CPU: 0 UID: 0 PID: 27322 Comm: syz.4.7465 Not tainted syzkaller #0 PREEMPT(full) [ 831.632219][T27322] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 831.632234][T27322] Call Trace: [ 831.632243][T27322] [ 831.632253][T27322] dump_stack_lvl+0xe8/0x150 [ 831.632286][T27322] should_fail_ex+0x40c/0x560 [ 831.632323][T27322] _copy_from_user+0x2d/0xb0 [ 831.632349][T27322] ___sys_recvmsg+0x173/0x5a0 [ 831.632375][T27322] ? ktime_get_ts64+0xa9/0x410 [ 831.632402][T27322] ? __pfx____sys_recvmsg+0x10/0x10 [ 831.632434][T27322] ? __fget_files+0x2a/0x420 [ 831.632476][T27322] ? __fget_files+0x3a2/0x420 [ 831.632510][T27322] do_recvmmsg+0x31a/0x7f0 [ 831.632546][T27322] ? __pfx_do_recvmmsg+0x10/0x10 [ 831.632596][T27322] ? get_timespec64+0x119/0x1b0 [ 831.632621][T27322] ? __pfx_get_timespec64+0x10/0x10 [ 831.632659][T27322] __x64_sys_recvmmsg+0x1b7/0x250 [ 831.632689][T27322] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 831.632726][T27322] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 831.632752][T27322] do_syscall_64+0x174/0x580 [ 831.632773][T27322] ? trace_irq_disable+0x3b/0x140 [ 831.632806][T27322] ? clear_bhb_loop+0x40/0x90 [ 831.632833][T27322] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 831.632860][T27322] RIP: 0033:0x7f79d399ce59 [ 831.632881][T27322] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 831.632900][T27322] RSP: 002b:00007f79d4779028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 831.632922][T27322] RAX: ffffffffffffffda RBX: 00007f79d3c15fa0 RCX: 00007f79d399ce59 [ 831.632938][T27322] RDX: 04000000000003b4 RSI: 00002000000037c0 RDI: 0000000000000003 [ 831.632953][T27322] RBP: 00007f79d4779090 R08: 0000200000003700 R09: 0000000000000000 [ 831.632967][T27322] R10: 0000000000002000 R11: 0000000000000246 R12: 0000000000000001 [ 831.632980][T27322] R13: 00007f79d3c16038 R14: 00007f79d3c15fa0 R15: 00007ffc6c62d588 [ 831.633015][T27322] [ 831.673392][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 832.095171][T27338] xt_CHECKSUM: unsupported CHECKSUM operation 68 [ 832.553049][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 832.712984][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 833.592947][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 833.757941][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 834.200750][T27346] netlink: 36 bytes leftover after parsing attributes in process `syz.3.7476'. [ 834.480318][T27360] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci3/hci3:200/input10 [ 834.633025][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 834.792926][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 834.817731][T27369] netlink: 8 bytes leftover after parsing attributes in process `syz.1.7485'. [ 834.887301][T27370] netlink: 4 bytes leftover after parsing attributes in process `syz.0.7486'. [ 834.887462][T19379] tipc: Subscription rejected, illegal request [ 834.920898][T27370] netlink: 'syz.0.7486': attribute type 10 has an invalid length. [ 834.942968][T27370] netlink: 12 bytes leftover after parsing attributes in process `syz.0.7486'. [ 834.958222][T27373] netlink: 8 bytes leftover after parsing attributes in process `syz.0.7486'. [ 835.607826][T27392] tipc: Enabled bearer , priority 24 [ 835.672967][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 835.832990][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 835.876719][T27407] nftables ruleset with unbound set [ 835.941221][T27407] netlink: 4 bytes leftover after parsing attributes in process `syz.3.7502'. [ 836.031518][T27412] netlink: 24 bytes leftover after parsing attributes in process `syz.1.7505'. [ 836.101024][T27421] netlink: 4 bytes leftover after parsing attributes in process `syz.2.7506'. [ 836.499958][T27438] netlink: 32 bytes leftover after parsing attributes in process `syz.1.7511'. [ 836.714896][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 836.872925][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 837.225560][T27463] syzkaller0: entered promiscuous mode [ 837.241395][T27463] syzkaller0: entered allmulticast mode [ 837.281389][T27470] netlink: 'syz.3.7527': attribute type 29 has an invalid length. [ 837.315607][T27470] netlink: 8 bytes leftover after parsing attributes in process `syz.3.7527'. [ 837.452464][T27479] netlink: 'syz.2.7530': attribute type 2 has an invalid length. [ 837.752932][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 837.912978][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 838.793073][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 838.952939][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 839.501521][T27488] bond0: (slave dummy0): Releasing backup interface [ 839.518133][T27488] batman_adv: batadv0: Adding interface: dummy0 [ 839.524564][T27488] batman_adv: batadv0: The MTU of interface dummy0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 839.552699][T27488] batman_adv: batadv0: Not using interface dummy0 (retrying later): interface not active [ 839.796343][T27507] __nla_validate_parse: 1 callbacks suppressed [ 839.796364][T27507] netlink: 56 bytes leftover after parsing attributes in process `syz.1.7538'. [ 839.833031][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 839.929812][T27515] syzkaller0: entered promiscuous mode [ 839.935718][T27515] syzkaller0: entered allmulticast mode [ 839.993059][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 840.257035][T27533] netlink: 48 bytes leftover after parsing attributes in process `syz.2.7545'. [ 840.275764][T27533] Cannot find del_set index 3 as target [ 840.872926][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 841.032942][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 841.912943][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 842.072954][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 842.489713][T27548] syzkaller0: entered promiscuous mode [ 842.511497][T27548] syzkaller0: entered allmulticast mode [ 842.540880][T27548] FAULT_INJECTION: forcing a failure. [ 842.540880][T27548] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 842.576911][T27548] CPU: 1 UID: 0 PID: 27548 Comm: syz.4.7552 Not tainted syzkaller #0 PREEMPT(full) [ 842.576941][T27548] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 842.576955][T27548] Call Trace: [ 842.576975][T27548] [ 842.576984][T27548] dump_stack_lvl+0xe8/0x150 [ 842.577039][T27548] should_fail_ex+0x40c/0x560 [ 842.577075][T27548] _copy_from_iter+0x3b0/0x1660 [ 842.577121][T27548] ? __pfx__copy_from_iter+0x10/0x10 [ 842.577160][T27548] ? dev_get_by_index+0x22/0x2d0 [ 842.577188][T27548] ? dev_get_by_index+0x22/0x2d0 [ 842.577223][T27548] packet_sendmsg+0x2f1d/0x5040 [ 842.577334][T27548] ? aa_label_sk_perm+0x532/0x6e0 [ 842.577361][T27548] ? __lock_acquire+0x683/0x2cf0 [ 842.577392][T27548] ? __lock_acquire+0x683/0x2cf0 [ 842.577430][T27548] ? unwind_next_frame+0x8f/0x2550 [ 842.577476][T27548] ? __pfx_packet_sendmsg+0x10/0x10 [ 842.577515][T27548] ? __pfx_aa_sk_perm+0x10/0x10 [ 842.577543][T27548] ? aa_sock_msg_perm+0xf1/0x1b0 [ 842.577575][T27548] ? __pfx_packet_sendmsg+0x10/0x10 [ 842.577599][T27548] sock_sendmsg_nosec+0x13a/0x180 [ 842.577633][T27548] ____sys_sendmsg+0x54e/0x850 [ 842.577665][T27548] ? __pfx_____sys_sendmsg+0x10/0x10 [ 842.577700][T27548] ? import_iovec+0x73/0xa0 [ 842.577727][T27548] ___sys_sendmsg+0x2a5/0x360 [ 842.577750][T27548] ? __lock_acquire+0x683/0x2cf0 [ 842.577777][T27548] ? __pfx____sys_sendmsg+0x10/0x10 [ 842.577839][T27548] ? __fget_files+0x2a/0x420 [ 842.577859][T27548] ? __fget_files+0x3a2/0x420 [ 842.577892][T27548] __x64_sys_sendmsg+0x1b1/0x290 [ 842.577920][T27548] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 842.577964][T27548] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 842.577995][T27548] do_syscall_64+0x174/0x580 [ 842.578019][T27548] ? clear_bhb_loop+0x40/0x90 [ 842.578065][T27548] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 842.578087][T27548] RIP: 0033:0x7f79d399ce59 [ 842.578108][T27548] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 842.578128][T27548] RSP: 002b:00007f79d4779028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 842.578152][T27548] RAX: ffffffffffffffda RBX: 00007f79d3c15fa0 RCX: 00007f79d399ce59 [ 842.578169][T27548] RDX: 0000000000000005 RSI: 0000200000000280 RDI: 0000000000000007 [ 842.578184][T27548] RBP: 00007f79d4779090 R08: 0000000000000000 R09: 0000000000000000 [ 842.578198][T27548] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 842.578211][T27548] R13: 00007f79d3c16038 R14: 00007f79d3c15fa0 R15: 00007ffc6c62d588 [ 842.578247][T27548] [ 842.953041][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 843.113470][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 843.376515][T27572] FAULT_INJECTION: forcing a failure. [ 843.376515][T27572] name failslab, interval 1, probability 0, space 0, times 0 [ 843.419228][T27572] CPU: 0 UID: 0 PID: 27572 Comm: syz.1.7562 Not tainted syzkaller #0 PREEMPT(full) [ 843.419257][T27572] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 843.419271][T27572] Call Trace: [ 843.419280][T27572] [ 843.419289][T27572] dump_stack_lvl+0xe8/0x150 [ 843.419322][T27572] should_fail_ex+0x40c/0x560 [ 843.419358][T27572] should_failslab+0xa8/0x100 [ 843.419387][T27572] kmem_cache_alloc_noprof+0xa6/0x5f0 [ 843.419421][T27572] ? skb_clone+0x212/0x3a0 [ 843.419445][T27572] ? skb_clone+0x212/0x3a0 [ 843.419477][T27572] skb_clone+0x212/0x3a0 [ 843.419506][T27572] __netlink_deliver_tap+0x413/0x860 [ 843.419544][T27572] ? netlink_deliver_tap+0x2e/0x1b0 [ 843.419572][T27572] netlink_deliver_tap+0x19c/0x1b0 [ 843.419599][T27572] netlink_sendskb+0x68/0x140 [ 843.419624][T27572] netlink_rcv_skb+0x2a4/0x4a0 [ 843.419650][T27572] ? __pfx_genl_rcv_msg+0x10/0x10 [ 843.419683][T27572] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 843.419736][T27572] ? down_read+0x2be/0x330 [ 843.419763][T27572] genl_rcv+0x28/0x40 [ 843.419789][T27572] netlink_unicast+0x7bb/0x940 [ 843.419821][T27572] netlink_sendmsg+0x813/0xb40 [ 843.419855][T27572] ? __pfx_netlink_sendmsg+0x10/0x10 [ 843.419884][T27572] ? aa_sock_msg_perm+0xf1/0x1b0 [ 843.419915][T27572] ? __pfx_netlink_sendmsg+0x10/0x10 [ 843.419938][T27572] sock_sendmsg_nosec+0x13a/0x180 [ 843.419970][T27572] ____sys_sendmsg+0x54e/0x850 [ 843.419999][T27572] ? __pfx_____sys_sendmsg+0x10/0x10 [ 843.420031][T27572] ? import_iovec+0x73/0xa0 [ 843.420066][T27572] ___sys_sendmsg+0x2a5/0x360 [ 843.420088][T27572] ? __lock_acquire+0x683/0x2cf0 [ 843.420115][T27572] ? __pfx____sys_sendmsg+0x10/0x10 [ 843.420174][T27572] ? __fget_files+0x2a/0x420 [ 843.420195][T27572] ? __fget_files+0x3a2/0x420 [ 843.420226][T27572] __x64_sys_sendmsg+0x1b1/0x290 [ 843.420252][T27572] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 843.420294][T27572] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 843.420317][T27572] do_syscall_64+0x174/0x580 [ 843.420335][T27572] ? trace_irq_disable+0x3b/0x140 [ 843.420355][T27572] ? clear_bhb_loop+0x40/0x90 [ 843.420379][T27572] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 843.420400][T27572] RIP: 0033:0x7fb24019ce59 [ 843.420420][T27572] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 843.420438][T27572] RSP: 002b:00007fb240f9e028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 843.420459][T27572] RAX: ffffffffffffffda RBX: 00007fb240415fa0 RCX: 00007fb24019ce59 [ 843.420475][T27572] RDX: 0000000000000840 RSI: 0000200000000200 RDI: 0000000000000003 [ 843.420487][T27572] RBP: 00007fb240f9e090 R08: 0000000000000000 R09: 0000000000000000 [ 843.420499][T27572] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 843.420511][T27572] R13: 00007fb240416038 R14: 00007fb240415fa0 R15: 00007ffd5a527278 [ 843.420543][T27572] [ 843.717716][T27578] netlink: 104 bytes leftover after parsing attributes in process `syz.3.7564'. [ 843.992935][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 844.152911][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 844.353638][T27606] syzkaller0: entered promiscuous mode [ 844.369493][T27606] syzkaller0: entered allmulticast mode [ 844.391497][T27605] syzkaller0: entered promiscuous mode [ 844.407336][T27605] syzkaller0: entered allmulticast mode [ 844.498505][T27611] netlink: 104 bytes leftover after parsing attributes in process `syz.0.7575'. [ 844.587002][T27614] netlink: 12 bytes leftover after parsing attributes in process `syz.4.7577'. [ 844.617466][T27614] block nbd3: Unsupported socket: should be TCP or UNIX. [ 845.032931][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 845.175875][T27639] netlink: 8 bytes leftover after parsing attributes in process `syz.0.7588'. [ 845.196054][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 845.268644][T27643] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 845.699736][T27667] netlink: 4 bytes leftover after parsing attributes in process `syz.0.7600'. [ 845.874568][T27675] netlink: 24 bytes leftover after parsing attributes in process `syz.4.7604'. [ 845.908666][T27675] netlink: 24 bytes leftover after parsing attributes in process `syz.4.7604'. [ 845.994285][T27680] netlink: 1752 bytes leftover after parsing attributes in process `syz.0.7605'. [ 846.073085][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 846.232920][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 846.374382][ T30] audit: type=1804 audit(1782836784.280:9): pid=27702 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.0.7614" name="/newroot/327/cgroup.controllers" dev="tmpfs" ino=1668 res=1 errno=0 [ 846.430498][ T30] audit: type=1800 audit(1782836784.280:10): pid=27702 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.7614" name="cgroup.controllers" dev="tmpfs" ino=1668 res=0 errno=0 [ 846.519353][T27690] netlink: 'syz.1.7609': attribute type 4 has an invalid length. [ 846.566526][T27709] netlink: 8 bytes leftover after parsing attributes in process `syz.0.7617'. [ 846.630811][T27709] bond2: option xmit_hash_policy: invalid value (64) [ 846.642455][T27709] bond2 (unregistering): Released all slaves [ 846.883655][T27717] netlink: 4 bytes leftover after parsing attributes in process `syz.0.7620'. [ 846.956176][T27721] netlink: 1752 bytes leftover after parsing attributes in process `syz.3.7621'. [ 847.112918][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 847.260924][T27732] IPv6: NLM_F_CREATE should be specified when creating new route [ 847.273049][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 847.315880][T27738] syzkaller1: entered promiscuous mode [ 847.335903][T27739] netlink: 8 bytes leftover after parsing attributes in process `syz.4.7626'. [ 847.336854][T27738] syzkaller1: entered allmulticast mode [ 847.599629][T27752] netlink: 40 bytes leftover after parsing attributes in process `syz.2.7634'. [ 848.153066][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 848.177321][T27783] FAULT_INJECTION: forcing a failure. [ 848.177321][T27783] name failslab, interval 1, probability 0, space 0, times 0 [ 848.210271][T27783] CPU: 1 UID: 0 PID: 27783 Comm: syz.4.7646 Not tainted syzkaller #0 PREEMPT(full) [ 848.210298][T27783] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 848.210311][T27783] Call Trace: [ 848.210319][T27783] [ 848.210328][T27783] dump_stack_lvl+0xe8/0x150 [ 848.210358][T27783] should_fail_ex+0x40c/0x560 [ 848.210391][T27783] should_failslab+0xa8/0x100 [ 848.210416][T27783] kmem_cache_alloc_noprof+0xa6/0x5f0 [ 848.210465][T27783] ? skb_clone+0x212/0x3a0 [ 848.210487][T27783] ? skb_clone+0x212/0x3a0 [ 848.210518][T27783] skb_clone+0x212/0x3a0 [ 848.210546][T27783] __netlink_deliver_tap+0x413/0x860 [ 848.210582][T27783] ? netlink_deliver_tap+0x2e/0x1b0 [ 848.210608][T27783] netlink_deliver_tap+0x19c/0x1b0 [ 848.210634][T27783] netlink_unicast+0x77f/0x940 [ 848.210668][T27783] netlink_sendmsg+0x813/0xb40 [ 848.210704][T27783] ? __pfx_netlink_sendmsg+0x10/0x10 [ 848.210745][T27783] ? aa_sock_msg_perm+0xf1/0x1b0 [ 848.210776][T27783] ? __pfx_netlink_sendmsg+0x10/0x10 [ 848.210799][T27783] sock_sendmsg_nosec+0x13a/0x180 [ 848.210830][T27783] ____sys_sendmsg+0x54e/0x850 [ 848.210858][T27783] ? __pfx_____sys_sendmsg+0x10/0x10 [ 848.210890][T27783] ? import_iovec+0x73/0xa0 [ 848.210927][T27783] ___sys_sendmsg+0x2a5/0x360 [ 848.210949][T27783] ? __lock_acquire+0x683/0x2cf0 [ 848.210975][T27783] ? __pfx____sys_sendmsg+0x10/0x10 [ 848.211034][T27783] ? __fget_files+0x2a/0x420 [ 848.211053][T27783] ? __fget_files+0x3a2/0x420 [ 848.211084][T27783] __x64_sys_sendmsg+0x1b1/0x290 [ 848.211110][T27783] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 848.211152][T27783] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 848.211174][T27783] do_syscall_64+0x174/0x580 [ 848.211193][T27783] ? trace_irq_disable+0x3b/0x140 [ 848.211213][T27783] ? clear_bhb_loop+0x40/0x90 [ 848.211238][T27783] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 848.211258][T27783] RIP: 0033:0x7f79d399ce59 [ 848.211277][T27783] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 848.211295][T27783] RSP: 002b:00007f79d4779028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 848.211317][T27783] RAX: ffffffffffffffda RBX: 00007f79d3c15fa0 RCX: 00007f79d399ce59 [ 848.211332][T27783] RDX: 0000000000000844 RSI: 0000200000000040 RDI: 0000000000000004 [ 848.211345][T27783] RBP: 00007f79d4779090 R08: 0000000000000000 R09: 0000000000000000 [ 848.211358][T27783] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 848.211370][T27783] R13: 00007f79d3c16038 R14: 00007f79d3c15fa0 R15: 00007ffc6c62d588 [ 848.211402][T27783] [ 849.192974][ C1] net_ratelimit: 1 callbacks suppressed [ 849.192994][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 849.513357][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 849.649981][T27845] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 849.665414][T27845] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 849.737850][T27845] netdevsim netdevsim1 netdevsim0: left allmulticast mode [ 849.770804][T27845] vlan3: left allmulticast mode [ 849.776738][T27845] bond0: left allmulticast mode [ 849.782130][T27845] bond_slave_0: left allmulticast mode [ 849.787885][T27845] bond_slave_1: left allmulticast mode [ 849.794186][T27845] bond1: left promiscuous mode [ 849.798971][T27845] erspan1: left promiscuous mode [ 849.806613][T27845] bond1: left allmulticast mode [ 849.815425][T27845] erspan1: left allmulticast mode [ 849.826368][T19361] netdevsim netdevsim1 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 849.837308][T19361] netdevsim netdevsim1 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 849.847151][ T14] netdevsim netdevsim1 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 849.863658][ T14] netdevsim netdevsim1 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 849.876572][ T14] netdevsim netdevsim1 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 849.903521][ T14] netdevsim netdevsim1 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 849.924611][ T14] netdevsim netdevsim1 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 849.965781][ T14] netdevsim netdevsim1 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 850.233012][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 850.471266][T27876] netlink: 'syz.1.7681': attribute type 1 has an invalid length. [ 850.514546][T27876] __nla_validate_parse: 7 callbacks suppressed [ 850.514566][T27876] netlink: 756 bytes leftover after parsing attributes in process `syz.1.7681'. [ 850.553035][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 850.605160][T27876] 8021q: adding VLAN 0 to HW filter on device bond0 [ 850.623335][T27876] 8021q: adding VLAN 0 to HW filter on device team0 [ 850.654076][T27883] netlink: 'syz.0.7683': attribute type 2 has an invalid length. [ 851.037024][T27906] netlink: 28 bytes leftover after parsing attributes in process `syz.2.7691'. [ 851.050527][T27907] netlink: 28 bytes leftover after parsing attributes in process `syz.2.7691'. [ 851.273073][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 851.306334][T27919] netlink: 'syz.2.7697': attribute type 3 has an invalid length. [ 851.315500][T27920] netlink: 'syz.0.7696': attribute type 1 has an invalid length. [ 851.333774][T27919] netlink: 80 bytes leftover after parsing attributes in process `syz.2.7697'. [ 851.362453][T27925] netlink: 8 bytes leftover after parsing attributes in process `syz.4.7699'. [ 851.396298][T27920] bond2: entered promiscuous mode [ 851.409558][T27920] bond2: entered allmulticast mode [ 851.417757][T27920] 8021q: adding VLAN 0 to HW filter on device bond2 [ 851.439077][T27926] erspan1: entered allmulticast mode [ 851.461145][T27926] bond2: (slave erspan1): making interface the new active one [ 851.475930][T27926] erspan1: entered promiscuous mode [ 851.484621][T27926] bond2: (slave erspan1): Enslaving as an active interface with an up link [ 851.593068][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 851.883029][T27949] netlink: 20 bytes leftover after parsing attributes in process `syz.1.7709'. [ 852.109516][T27962] netlink: 28 bytes leftover after parsing attributes in process `syz.1.7714'. [ 852.207967][T27958] syzkaller0: entered promiscuous mode [ 852.216697][T27958] syzkaller0: entered allmulticast mode [ 852.227334][T27970] IPVS: set_ctl: invalid protocol: 1 255.255.255.255:20003 [ 852.312926][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 852.632970][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 853.352939][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 853.363749][T19372] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 853.676892][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 854.333818][T27976] bridge2: trying to set multicast startup query interval above maximum, setting to 8640000 (86400000ms) [ 854.393008][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 854.713037][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 855.329933][T28035] syzkaller0: entered promiscuous mode [ 855.355127][T28035] syzkaller0: entered allmulticast mode [ 855.369117][T28037] netlink: 1752 bytes leftover after parsing attributes in process `syz.3.7742'. [ 855.414040][T28041] netlink: 104 bytes leftover after parsing attributes in process `syz.4.7743'. [ 855.433027][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 855.527977][T28045] netlink: 12 bytes leftover after parsing attributes in process `syz.4.7746'. [ 855.576415][T28047] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci3/hci3:200/input11 [ 855.752909][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 856.232255][T28058] netlink: 'syz.2.7748': attribute type 2 has an invalid length. [ 856.259603][T28077] netlink: 12 bytes leftover after parsing attributes in process `syz.3.7756'. [ 856.295605][T28077] 8021q: adding VLAN 0 to HW filter on device macsec1 [ 856.319072][T28077] netlink: 52 bytes leftover after parsing attributes in process `syz.3.7756'. [ 856.345462][T28077] bridge0: port 1(bridge_slave_0) entered disabled state [ 856.472917][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 856.503319][T28084] syzkaller0: entered promiscuous mode [ 856.510962][T28084] syzkaller0: entered allmulticast mode [ 856.793034][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 856.879960][T28092] netlink: 4 bytes leftover after parsing attributes in process `syz.1.7762'. [ 856.991319][T28097] netlink: 'syz.0.7766': attribute type 1 has an invalid length. [ 857.010208][T28097] netlink: 756 bytes leftover after parsing attributes in process `syz.0.7766'. [ 857.205429][T28108] openvswitch: netlink: VXLAN extension 1536 out of range max 1 [ 857.399060][T28115] syzkaller0: entered promiscuous mode [ 857.414540][T28115] syzkaller0: entered allmulticast mode [ 857.427624][T28122] bridge_slave_1: left allmulticast mode [ 857.446549][T28122] bridge0: port 2(bridge_slave_1) entered disabled state [ 857.469824][T28122] bridge_slave_0: left allmulticast mode [ 857.486704][T28122] bridge_slave_0: left promiscuous mode [ 857.500317][T28122] bridge0: port 1(bridge_slave_0) entered disabled state [ 857.513326][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 857.610211][T28128] netlink: 'syz.4.7779': attribute type 12 has an invalid length. [ 857.803987][T28137] netlink: 'syz.1.7781': attribute type 1 has an invalid length. [ 857.822415][T28137] netlink: 756 bytes leftover after parsing attributes in process `syz.1.7781'. [ 858.547514][T28180] netlink: 'syz.2.7797': attribute type 1 has an invalid length. [ 858.553432][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 858.569533][T28180] netlink: 756 bytes leftover after parsing attributes in process `syz.2.7797'. [ 858.586176][T28180] bridge0: port 2(bridge_slave_1) entered blocking state [ 858.593443][T28180] bridge0: port 2(bridge_slave_1) entered listening state [ 858.600862][T28180] bridge0: port 1(bridge_slave_0) entered blocking state [ 858.608148][T28180] bridge0: port 1(bridge_slave_0) entered listening state [ 858.664799][T28184] netlink: 8 bytes leftover after parsing attributes in process `syz.3.7800'. [ 858.695613][T28184] netlink: 8 bytes leftover after parsing attributes in process `syz.3.7800'. [ 858.896292][T28196] netlink: 8 bytes leftover after parsing attributes in process `syz.3.7804'. [ 859.082654][ T36] netdevsim netdevsim1 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 859.112038][ T36] netdevsim netdevsim1 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 859.141693][ T36] netdevsim netdevsim1 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 859.158127][ T36] netdevsim netdevsim1 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 859.580749][T28230] veth0: entered promiscuous mode [ 859.593292][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 859.621925][T28230] veth0: left promiscuous mode [ 859.727437][T28240] FAULT_INJECTION: forcing a failure. [ 859.727437][T28240] name failslab, interval 1, probability 0, space 0, times 0 [ 859.760346][T28240] CPU: 1 UID: 0 PID: 28240 Comm: syz.3.7824 Not tainted syzkaller #0 PREEMPT(full) [ 859.760375][T28240] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 859.760389][T28240] Call Trace: [ 859.760397][T28240] [ 859.760407][T28240] dump_stack_lvl+0xe8/0x150 [ 859.760439][T28240] should_fail_ex+0x40c/0x560 [ 859.760474][T28240] should_failslab+0xa8/0x100 [ 859.760502][T28240] kmem_cache_alloc_noprof+0xa6/0x5f0 [ 859.760535][T28240] ? skb_clone+0x212/0x3a0 [ 859.760568][T28240] ? skb_clone+0x212/0x3a0 [ 859.760597][T28240] skb_clone+0x212/0x3a0 [ 859.760624][T28240] __netlink_deliver_tap+0x413/0x860 [ 859.760658][T28240] ? netlink_deliver_tap+0x2e/0x1b0 [ 859.760701][T28240] netlink_deliver_tap+0x19c/0x1b0 [ 859.760748][T28240] netlink_unicast+0x77f/0x940 [ 859.760781][T28240] netlink_sendmsg+0x813/0xb40 [ 859.760815][T28240] ? __pfx_netlink_sendmsg+0x10/0x10 [ 859.760844][T28240] ? aa_sock_msg_perm+0xf1/0x1b0 [ 859.760875][T28240] ? __pfx_netlink_sendmsg+0x10/0x10 [ 859.760898][T28240] sock_sendmsg_nosec+0x13a/0x180 [ 859.760929][T28240] ____sys_sendmsg+0x54e/0x850 [ 859.760958][T28240] ? __pfx_____sys_sendmsg+0x10/0x10 [ 859.760990][T28240] ? import_iovec+0x73/0xa0 [ 859.761016][T28240] ___sys_sendmsg+0x2a5/0x360 [ 859.761037][T28240] ? __lock_acquire+0x683/0x2cf0 [ 859.761064][T28240] ? __pfx____sys_sendmsg+0x10/0x10 [ 859.761122][T28240] ? __fget_files+0x2a/0x420 [ 859.761142][T28240] ? __fget_files+0x3a2/0x420 [ 859.761173][T28240] __x64_sys_sendmsg+0x1b1/0x290 [ 859.761199][T28240] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 859.761242][T28240] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 859.761265][T28240] do_syscall_64+0x174/0x580 [ 859.761284][T28240] ? trace_irq_disable+0x3b/0x140 [ 859.761305][T28240] ? clear_bhb_loop+0x40/0x90 [ 859.761330][T28240] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 859.761351][T28240] RIP: 0033:0x7efe52f9ce59 [ 859.761370][T28240] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 859.761387][T28240] RSP: 002b:00007efe53f15028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 859.761409][T28240] RAX: ffffffffffffffda RBX: 00007efe53215fa0 RCX: 00007efe52f9ce59 [ 859.761424][T28240] RDX: 0000000000000000 RSI: 0000200000000200 RDI: 0000000000000003 [ 859.761437][T28240] RBP: 00007efe53f15090 R08: 0000000000000000 R09: 0000000000000000 [ 859.761449][T28240] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 859.761461][T28240] R13: 00007efe53216038 R14: 00007efe53215fa0 R15: 00007ffcf7e76fe8 [ 859.761494][T28240] [ 860.226229][ T5630] block nbd3: Receive control failed (result -32) [ 860.261098][T28254] netlink: 'syz.0.7830': attribute type 4 has an invalid length. [ 860.296815][T28256] openvswitch: netlink: EtherType 50a is less than min 600 [ 860.570959][T28264] __nla_validate_parse: 2 callbacks suppressed [ 860.570982][T28264] netlink: 204 bytes leftover after parsing attributes in process `syz.3.7833'. [ 860.619990][ T5833] IPVS: starting estimator thread 0... [ 860.632919][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 860.660667][T28273] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 860.679652][T28273] tipc: Enabled bearer , priority 10 [ 860.713243][ T14] wlan1: Trigger new scan to find an IBSS to join [ 860.720013][T28275] IPVS: using max 28 ests per chain, 67200 per kthread [ 860.783040][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 860.930995][T28286] syzkaller0: entered promiscuous mode [ 860.937979][T28288] netlink: 104 bytes leftover after parsing attributes in process `syz.2.7844'. [ 860.957662][T28286] syzkaller0: entered allmulticast mode [ 861.002657][T28286] tipc: Enabled bearer , priority 0 [ 861.018505][T28285] tipc: Resetting bearer [ 861.027287][T28291] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 861.053315][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 861.062633][T28285] tipc: Disabling bearer [ 861.189860][T28296] netlink: 'syz.2.7848': attribute type 2 has an invalid length. [ 861.415238][T28308] netlink: 72 bytes leftover after parsing attributes in process `syz.0.7853'. [ 861.587979][T28314] syzkaller0: entered promiscuous mode [ 861.593799][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 861.602322][T28314] syzkaller0: entered allmulticast mode [ 861.672988][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 861.720698][T28317] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 861.756593][T19361] wlan1: Trigger new scan to find an IBSS to join [ 861.765099][T28317] netlink: 56 bytes leftover after parsing attributes in process `syz.0.7857'. [ 861.904292][T28317] bond3 (unregistering): Released all slaves [ 862.273784][T28339] bond1: option arp_interval: mode dependency failed, not supported in mode balance-tlb(5) [ 862.294858][T28339] bond1 (unregistering): Released all slaves [ 862.382021][T28349] netlink: 24 bytes leftover after parsing attributes in process `syz.2.7866'. [ 862.516797][T28355] xt_hashlimit: size too large, truncated to 1048576 [ 862.646014][T28360] syzkaller0: entered promiscuous mode [ 862.669069][T28360] syzkaller0: entered allmulticast mode [ 862.824792][T28371] netlink: 12 bytes leftover after parsing attributes in process `syz.3.7875'. [ 862.995262][T28371] 8021q: adding VLAN 0 to HW filter on device bond3 [ 863.035701][T28375] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 863.059042][T28371] netlink: 24 bytes leftover after parsing attributes in process `syz.3.7875'. [ 863.187705][T28388] netlink: 8 bytes leftover after parsing attributes in process `syz.2.7880'. [ 863.218776][T28388] netlink: 'syz.2.7880': attribute type 5 has an invalid length. [ 863.244687][T28388] netlink: 20 bytes leftover after parsing attributes in process `syz.2.7880'. [ 863.287675][T28395] FAULT_INJECTION: forcing a failure. [ 863.287675][T28395] name failslab, interval 1, probability 0, space 0, times 0 [ 863.302096][T28395] CPU: 0 UID: 0 PID: 28395 Comm: syz.0.7881 Not tainted syzkaller #0 PREEMPT(full) [ 863.302123][T28395] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 863.302137][T28395] Call Trace: [ 863.302146][T28395] [ 863.302155][T28395] dump_stack_lvl+0xe8/0x150 [ 863.302188][T28395] should_fail_ex+0x40c/0x560 [ 863.302225][T28395] should_failslab+0xa8/0x100 [ 863.302253][T28395] kmem_cache_alloc_noprof+0xa6/0x5f0 [ 863.302285][T28395] ? skb_clone+0x212/0x3a0 [ 863.302308][T28395] ? skb_clone+0x212/0x3a0 [ 863.302339][T28395] skb_clone+0x212/0x3a0 [ 863.302367][T28395] __netlink_deliver_tap+0x413/0x860 [ 863.302407][T28395] ? netlink_deliver_tap+0x2e/0x1b0 [ 863.302434][T28395] netlink_deliver_tap+0x19c/0x1b0 [ 863.302461][T28395] netlink_sendskb+0x68/0x140 [ 863.302498][T28395] nlmsg_notify+0x126/0x1a0 [ 863.302527][T28395] qdisc_graft+0x1166/0x1600 [ 863.302576][T28395] ? __pfx_qdisc_graft+0x10/0x10 [ 863.302618][T28395] ? trace_qdisc_create+0x83/0x200 [ 863.302648][T28395] ? qdisc_create+0xa62/0xf00 [ 863.302681][T28395] tc_modify_qdisc+0x1968/0x2390 [ 863.302729][T28395] ? __pfx_tc_modify_qdisc+0x10/0x10 [ 863.302762][T28395] ? __dev_queue_xmit+0x29b/0x37f0 [ 863.302817][T28395] ? __pfx_tc_modify_qdisc+0x10/0x10 [ 863.302848][T28395] rtnetlink_rcv_msg+0x7b9/0xc00 [ 863.302887][T28395] ? rtnetlink_rcv_msg+0x1c9/0xc00 [ 863.302920][T28395] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 863.302951][T28395] ? ref_tracker_free+0x689/0x830 [ 863.302985][T28395] ? __pfx_ref_tracker_free+0x10/0x10 [ 863.303028][T28395] netlink_rcv_skb+0x226/0x4a0 [ 863.303053][T28395] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 863.303089][T28395] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 863.303127][T28395] ? netlink_deliver_tap+0x2e/0x1b0 [ 863.303151][T28395] ? netlink_deliver_tap+0x2e/0x1b0 [ 863.303182][T28395] netlink_unicast+0x7bb/0x940 [ 863.303216][T28395] netlink_sendmsg+0x813/0xb40 [ 863.303251][T28395] ? __pfx_netlink_sendmsg+0x10/0x10 [ 863.303282][T28395] ? aa_sock_msg_perm+0xf1/0x1b0 [ 863.303314][T28395] ? __pfx_netlink_sendmsg+0x10/0x10 [ 863.303338][T28395] sock_sendmsg_nosec+0x13a/0x180 [ 863.303371][T28395] ____sys_sendmsg+0x54e/0x850 [ 863.303401][T28395] ? __pfx_____sys_sendmsg+0x10/0x10 [ 863.303435][T28395] ? import_iovec+0x73/0xa0 [ 863.303470][T28395] ___sys_sendmsg+0x2a5/0x360 [ 863.303493][T28395] ? __lock_acquire+0x683/0x2cf0 [ 863.303520][T28395] ? __pfx____sys_sendmsg+0x10/0x10 [ 863.303549][T28395] ? kstrtouint+0x6e/0xe0 [ 863.303622][T28395] ? __fget_files+0x2a/0x420 [ 863.303661][T28395] ? __fget_files+0x3a2/0x420 [ 863.303695][T28395] __sys_sendmmsg+0x273/0x4d0 [ 863.303727][T28395] ? __pfx___sys_sendmmsg+0x10/0x10 [ 863.303764][T28395] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 863.303814][T28395] ? ksys_write+0x242/0x270 [ 863.303843][T28395] ? __pfx_ksys_write+0x10/0x10 [ 863.303879][T28395] __x64_sys_sendmmsg+0xa0/0xc0 [ 863.303904][T28395] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 863.303928][T28395] do_syscall_64+0x174/0x580 [ 863.303951][T28395] ? clear_bhb_loop+0x40/0x90 [ 863.303980][T28395] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 863.304003][T28395] RIP: 0033:0x7f6ba959ce59 [ 863.304023][T28395] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 863.304042][T28395] RSP: 002b:00007f6baa511028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 863.304066][T28395] RAX: ffffffffffffffda RBX: 00007f6ba9815fa0 RCX: 00007f6ba959ce59 [ 863.304082][T28395] RDX: 040000000000009f RSI: 00002000000002c0 RDI: 0000000000000004 [ 863.304098][T28395] RBP: 00007f6baa511090 R08: 0000000000000000 R09: 0000000000000000 [ 863.304112][T28395] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 863.304126][T28395] R13: 00007f6ba9816038 R14: 00007f6ba9815fa0 R15: 00007ffcb8fbb678 [ 863.304169][T28395] [ 863.712158][T28391] syzkaller0: entered promiscuous mode [ 863.717742][T28391] syzkaller0: entered allmulticast mode [ 863.860151][T28408] netlink: 'syz.3.7888': attribute type 1 has an invalid length. [ 863.870753][T28408] netlink: 756 bytes leftover after parsing attributes in process `syz.3.7888'. [ 863.936201][T28405] syzkaller0: entered promiscuous mode [ 863.941927][T28408] netlink: 'syz.3.7888': attribute type 3 has an invalid length. [ 863.964066][T28405] syzkaller0: entered allmulticast mode [ 864.713307][ C0] net_ratelimit: 5 callbacks suppressed [ 864.713329][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 864.715050][T19365] wlan1: Trigger new scan to find an IBSS to join [ 864.792950][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 865.636548][T28486] __nla_validate_parse: 2 callbacks suppressed [ 865.636567][T28486] netlink: 1624 bytes leftover after parsing attributes in process `syz.2.7916'. [ 865.663863][T28490] netlink: 4 bytes leftover after parsing attributes in process `syz.4.7918'. [ 865.679214][T19379] wlan1: Creating new IBSS network, BSSID 1e:3a:3b:4a:55:77 [ 865.763408][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 865.833057][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 866.040878][T28521] netlink: 28 bytes leftover after parsing attributes in process `syz.4.7924'. [ 866.069373][T28521] netlink: 28 bytes leftover after parsing attributes in process `syz.4.7924'. [ 866.179922][T28527] netlink: 'syz.0.7927': attribute type 1 has an invalid length. [ 866.204677][T28527] netlink: 756 bytes leftover after parsing attributes in process `syz.0.7927'. [ 866.337846][T28531] netlink: 4 bytes leftover after parsing attributes in process `syz.2.7929'. [ 866.434937][T28533] syzkaller0: entered promiscuous mode [ 866.449712][T28533] syzkaller0: entered allmulticast mode [ 866.459297][T28538] netlink: 1752 bytes leftover after parsing attributes in process `syz.1.7932'. [ 866.480268][T28537] netlink: 1624 bytes leftover after parsing attributes in process `syz.0.7931'. [ 866.621372][T28543] openvswitch: netlink: VXLAN extension 1536 out of range max 1 [ 866.791836][T28551] syzkaller0: entered promiscuous mode [ 866.802426][T28551] syzkaller0: entered allmulticast mode [ 866.805440][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 866.873526][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 867.092080][T28558] tipc: Enabled bearer , priority 0 [ 867.145458][T28561] syzkaller0: entered promiscuous mode [ 867.151117][T28561] syzkaller0: entered allmulticast mode [ 867.161378][T28561] tipc: Resetting bearer [ 867.330336][T28576] netlink: 52 bytes leftover after parsing attributes in process `syz.4.7943'. [ 867.354117][T28578] xt_hl: Unknown TTL match mode: 255 [ 867.549468][T28586] syzkaller0: entered promiscuous mode [ 867.555834][T28586] syzkaller0: entered allmulticast mode [ 867.597913][T28548] tipc: Resetting bearer [ 867.756422][T19354] wlan1: Trigger new scan to find an IBSS to join [ 867.792418][T28594] netlink: 'syz.1.7950': attribute type 1 has an invalid length. [ 867.802928][T28594] netlink: 756 bytes leftover after parsing attributes in process `syz.1.7950'. [ 867.843339][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 867.917931][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 868.876283][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 869.705254][T28548] tipc: Disabling bearer [ 869.913082][ C0] net_ratelimit: 1 callbacks suppressed [ 869.913101][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 869.995232][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 870.015013][T28611] tipc: Enabling of bearer rejected, failed to enable media [ 870.156209][T28616] syzkaller0: entered promiscuous mode [ 870.198826][T28616] syzkaller0: entered allmulticast mode [ 870.426668][T28632] syzkaller1: entered promiscuous mode [ 870.445069][T28632] syzkaller1: entered allmulticast mode [ 870.619968][T28633] syzkaller1: left promiscuous mode [ 870.635016][T28633] syzkaller1: left allmulticast mode [ 870.712955][ T36] wlan1: Trigger new scan to find an IBSS to join [ 870.726785][T28650] netlink: 'syz.1.7967': attribute type 1 has an invalid length. [ 870.753385][T28650] __nla_validate_parse: 3 callbacks suppressed [ 870.753407][T28650] netlink: 756 bytes leftover after parsing attributes in process `syz.1.7967'. [ 870.963128][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 871.020526][T28661] tipc: Enabled bearer , priority 0 [ 871.033002][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 871.103879][T28661] syzkaller0: entered promiscuous mode [ 871.109650][T28661] syzkaller0: entered allmulticast mode [ 871.119962][T28661] tipc: Resetting bearer [ 871.152570][T28667] vcan0: tx drop: invalid sa for name 0x00000000000000f0 [ 871.580779][T28687] FAULT_INJECTION: forcing a failure. [ 871.580779][T28687] name failslab, interval 1, probability 0, space 0, times 0 [ 871.602623][T28687] CPU: 0 UID: 0 PID: 28687 Comm: syz.4.7979 Not tainted syzkaller #0 PREEMPT(full) [ 871.602654][T28687] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 871.602668][T28687] Call Trace: [ 871.602677][T28687] [ 871.602686][T28687] dump_stack_lvl+0xe8/0x150 [ 871.602720][T28687] should_fail_ex+0x40c/0x560 [ 871.602775][T28687] should_failslab+0xa8/0x100 [ 871.602805][T28687] kmem_cache_alloc_node_noprof+0xb3/0x610 [ 871.602841][T28687] ? local_lock_release+0x9c/0x160 [ 871.602878][T28687] ? __alloc_skb+0x1d7/0x7a0 [ 871.602897][T28687] ? __alloc_skb+0x1d7/0x7a0 [ 871.602925][T28687] __alloc_skb+0x1d7/0x7a0 [ 871.602952][T28687] netlink_ack+0x136/0xb30 [ 871.602974][T28687] ? __pfx_genl_rcv_msg+0x10/0x10 [ 871.603011][T28687] ? __pfx_nl80211_post_doit+0x10/0x10 [ 871.603040][T28687] ? __pfx_ref_tracker_free+0x10/0x10 [ 871.603084][T28687] netlink_rcv_skb+0x2a4/0x4a0 [ 871.603111][T28687] ? __pfx_genl_rcv_msg+0x10/0x10 [ 871.603144][T28687] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 871.603187][T28687] ? down_read+0x2be/0x330 [ 871.603216][T28687] genl_rcv+0x28/0x40 [ 871.603244][T28687] netlink_unicast+0x7bb/0x940 [ 871.603279][T28687] netlink_sendmsg+0x813/0xb40 [ 871.603315][T28687] ? __pfx_netlink_sendmsg+0x10/0x10 [ 871.603346][T28687] ? aa_sock_msg_perm+0xf1/0x1b0 [ 871.603379][T28687] ? __pfx_netlink_sendmsg+0x10/0x10 [ 871.603404][T28687] sock_sendmsg_nosec+0x13a/0x180 [ 871.603437][T28687] ____sys_sendmsg+0x54e/0x850 [ 871.603468][T28687] ? __pfx_____sys_sendmsg+0x10/0x10 [ 871.603502][T28687] ? import_iovec+0x73/0xa0 [ 871.603530][T28687] ___sys_sendmsg+0x2a5/0x360 [ 871.603554][T28687] ? __lock_acquire+0x683/0x2cf0 [ 871.603590][T28687] ? __pfx____sys_sendmsg+0x10/0x10 [ 871.603657][T28687] ? __fget_files+0x2a/0x420 [ 871.603678][T28687] ? __fget_files+0x3a2/0x420 [ 871.603713][T28687] __x64_sys_sendmsg+0x1b1/0x290 [ 871.603743][T28687] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 871.603788][T28687] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 871.603814][T28687] do_syscall_64+0x174/0x580 [ 871.603838][T28687] ? clear_bhb_loop+0x40/0x90 [ 871.603866][T28687] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 871.603889][T28687] RIP: 0033:0x7f79d399ce59 [ 871.603911][T28687] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 871.603931][T28687] RSP: 002b:00007f79d4779028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 871.603955][T28687] RAX: ffffffffffffffda RBX: 00007f79d3c15fa0 RCX: 00007f79d399ce59 [ 871.603972][T28687] RDX: 0000000000000004 RSI: 0000200000000180 RDI: 0000000000000003 [ 871.603986][T28687] RBP: 00007f79d4779090 R08: 0000000000000000 R09: 0000000000000000 [ 871.603999][T28687] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 871.604012][T28687] R13: 00007f79d3c16038 R14: 00007f79d3c15fa0 R15: 00007ffc6c62d588 [ 871.604048][T28687] [ 871.979093][T19363] tipc: Resetting bearer [ 871.991767][T28652] tipc: Resetting bearer [ 872.003245][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 872.051969][T28697] netlink: 32 bytes leftover after parsing attributes in process `syz.4.7984'. [ 872.073722][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 872.123994][T28701] netlink: 24 bytes leftover after parsing attributes in process `syz.4.7984'. [ 872.221365][T28706] FAULT_INJECTION: forcing a failure. [ 872.221365][T28706] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 872.235112][T28706] CPU: 0 UID: 0 PID: 28706 Comm: syz.1.7985 Not tainted syzkaller #0 PREEMPT(full) [ 872.235140][T28706] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 872.235154][T28706] Call Trace: [ 872.235163][T28706] [ 872.235172][T28706] dump_stack_lvl+0xe8/0x150 [ 872.235204][T28706] should_fail_ex+0x40c/0x560 [ 872.235252][T28706] _copy_to_user+0x31/0xb0 [ 872.235278][T28706] simple_read_from_buffer+0xe1/0x170 [ 872.235305][T28706] proc_fail_nth_read+0x1bb/0x230 [ 872.235333][T28706] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 872.235359][T28706] ? rw_verify_area+0x24a/0x4c0 [ 872.235387][T28706] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 872.235409][T28706] vfs_read+0x213/0xa80 [ 872.235440][T28706] ? __pfx___mutex_lock+0x10/0x10 [ 872.235461][T28706] ? __pfx_vfs_read+0x10/0x10 [ 872.235489][T28706] ? __fget_files+0x2a/0x420 [ 872.235513][T28706] ? __fget_files+0x3a2/0x420 [ 872.235533][T28706] ? __fget_files+0x2a/0x420 [ 872.235573][T28706] ksys_read+0x150/0x270 [ 872.235602][T28706] ? __pfx_ksys_read+0x10/0x10 [ 872.235654][T28706] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 872.235679][T28706] do_syscall_64+0x174/0x580 [ 872.235700][T28706] ? trace_irq_disable+0x3b/0x140 [ 872.235722][T28706] ? clear_bhb_loop+0x40/0x90 [ 872.235749][T28706] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 872.235773][T28706] RIP: 0033:0x7fb24015d68e [ 872.235793][T28706] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 872.235813][T28706] RSP: 002b:00007fb240f7cfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 872.235837][T28706] RAX: ffffffffffffffda RBX: 00007fb240f7d6c0 RCX: 00007fb24015d68e [ 872.235854][T28706] RDX: 000000000000000f RSI: 00007fb240f7d0a0 RDI: 0000000000000004 [ 872.235868][T28706] RBP: 00007fb240f7d090 R08: 0000000000000000 R09: 0000000000000000 [ 872.235882][T28706] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 872.235895][T28706] R13: 00007fb240416128 R14: 00007fb240416090 R15: 00007ffd5a527278 [ 872.235931][T28706] [ 873.043064][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 873.113822][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 873.757625][ T36] wlan1: Creating new IBSS network, BSSID ce:4f:87:76:8d:6b [ 873.833843][ C0] bridge0: port 1(bridge_slave_0) entered learning state [ 873.841137][ C0] bridge0: port 2(bridge_slave_1) entered learning state [ 874.036343][T19363] Oops: divide error: 0000 [#1] SMP KASAN PTI [ 874.042480][T19363] CPU: 1 UID: 0 PID: 19363 Comm: kworker/u8:23 Not tainted syzkaller #0 PREEMPT(full) [ 874.052167][T19363] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 874.062260][T19363] Workqueue: events_unbound cfg80211_wiphy_work [ 874.068592][T19363] RIP: 0010:mac80211_hwsim_link_info_changed+0x4d1/0x1010 [ 874.075774][T19363] Code: 0b 49 89 fc e8 20 c1 1f fb 4c 89 e7 48 c7 07 00 00 00 00 41 c6 44 1e 04 f8 eb 2b e8 49 2e b2 fa e9 d1 fd ff ff 44 89 e0 31 d2 f6 29 d1 48 69 f1 e8 03 00 00 48 8b 7c 24 48 31 d2 b9 05 00 00 [ 874.095471][T19363] RSP: 0018:ffffc9000403f880 EFLAGS: 00010246 [ 874.101557][T19363] RAX: 000000003417c6e0 RBX: dffffc0000000000 RCX: 0000000000000000 [ 874.105282][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 874.109532][T19363] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffffff8c2a9f80 [ 874.124374][T19363] RBP: ffffc9000403f978 R08: ffffffff9032d3f7 R09: 1ffffffff2065a7e [ 874.132361][T19363] R10: dffffc0000000000 R11: fffffbfff2065a7f R12: 000000003417c6e0 [ 874.140345][T19363] R13: ffff8880500f7c08 R14: 1ffff92000807f1c R15: 0000000000000200 [ 874.148328][T19363] FS: 0000000000000000(0000) GS:ffff888125326000(0000) knlGS:0000000000000000 [ 874.157267][T19363] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 874.163879][T19363] CR2: 00007f5527eedff8 CR3: 00000000537dc000 CR4: 00000000003526f0 [ 874.171865][T19363] Call Trace: [ 874.175153][T19363] [ 874.178125][T19363] ? __pfx_mac80211_hwsim_link_info_changed+0x10/0x10 [ 874.185006][T19363] ? __pfx_mac80211_hwsim_link_info_changed+0x10/0x10 [ 874.191792][T19363] drv_link_info_changed+0x4ba/0x810 [ 874.197181][T19363] ieee80211_offchannel_return+0x383/0x500 [ 874.203088][T19363] ? __pfx_mac80211_hwsim_sw_scan_complete+0x10/0x10 [ 874.209799][T19363] __ieee80211_scan_completed+0x734/0xb20 [ 874.215543][T19363] cfg80211_wiphy_work+0x29e/0x420 [ 874.220679][T19363] ? process_scheduled_works+0xa20/0x14e0 [ 874.226432][T19363] process_scheduled_works+0xa8e/0x14e0 [ 874.232052][T19363] ? __pfx_process_scheduled_works+0x10/0x10 [ 874.238083][T19363] ? assign_work+0x3cf/0x5d0 [ 874.242711][T19363] worker_thread+0xa47/0xfb0 [ 874.247346][T19363] kthread+0x388/0x470 [ 874.251441][T19363] ? __pfx_worker_thread+0x10/0x10 [ 874.256590][T19363] ? __pfx_kthread+0x10/0x10 [ 874.261210][T19363] ret_from_fork+0x514/0xb70 [ 874.265844][T19363] ? __pfx_ret_from_fork+0x10/0x10 [ 874.271000][T19363] ? __switch_to+0xc89/0x1420 [ 874.275842][T19363] ? __pfx_kthread+0x10/0x10 [ 874.280456][T19363] ret_from_fork_asm+0x1a/0x30 [ 874.285262][T19363] [ 874.288311][T19363] Modules linked in: [ 874.293169][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 874.300533][T19363] ---[ end trace 0000000000000000 ]--- [ 874.310301][T19363] RIP: 0010:mac80211_hwsim_link_info_changed+0x4d1/0x1010 [ 874.318894][T19363] Code: 0b 49 89 fc e8 20 c1 1f fb 4c 89 e7 48 c7 07 00 00 00 00 41 c6 44 1e 04 f8 eb 2b e8 49 2e b2 fa e9 d1 fd ff ff 44 89 e0 31 d2 f6 29 d1 48 69 f1 e8 03 00 00 48 8b 7c 24 48 31 d2 b9 05 00 00 [ 874.339339][T19363] RSP: 0018:ffffc9000403f880 EFLAGS: 00010246 [ 874.346080][T19363] RAX: 000000003417c6e0 RBX: dffffc0000000000 RCX: 0000000000000000 [ 874.355089][T19363] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffffff8c2a9f80 [ 874.363894][T19363] RBP: ffffc9000403f978 R08: ffffffff9032d3f7 R09: 1ffffffff2065a7e [ 874.371925][T19363] R10: dffffc0000000000 R11: fffffbfff2065a7f R12: 000000003417c6e0 [ 874.380517][T19363] R13: ffff8880500f7c08 R14: 1ffff92000807f1c R15: 0000000000000200 [ 874.388674][T19363] FS: 0000000000000000(0000) GS:ffff888125326000(0000) knlGS:0000000000000000 [ 874.397952][T19363] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 874.404788][T19363] CR2: 00007f5527eedff8 CR3: 0000000025dd8000 CR4: 00000000003526f0 [ 874.413595][T19363] Kernel panic - not syncing: Fatal exception [ 874.420294][T19363] Kernel Offset: disabled [ 874.424622][T19363] Rebooting in 86400 seconds..